[jira] [Resolved] (FINERACT-2671) Client family member and GSIM account lookups return HTTP 500 instead of 404 when the record does not exist

["Abhishek Chaudhary (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/FINERACT-2671?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Abhishek Chaudhary resolved FINERACT-2671.
------------------------------------------
    Resolution: Fixed

> Client family member and GSIM account lookups return HTTP 500 instead of 404 when the record does not exist
> -----------------------------------------------------------------------------------------------------------
>
>                 Key: FINERACT-2671
>                 URL: https://issues.apache.org/jira/browse/FINERACT-2671
>             Project: Apache Fineract
>          Issue Type: Bug
>          Components: Client, Savings
>    Affects Versions: 1.14.0
>            Reporter: Abhishek Chaudhary
>            Priority: Major
>              Labels: bug
>
> *Observed behavior*
> Two read endpoints return a raw HTTP 500 due to an unhandled {{EmptyResultDataAccessException}} when the requested resource does not exist:
> {noformat}
> GET /fineract-provider/api/v1/clients/{clientId}/familymembers/{familyMemberId}
> GET /fineract-provider/api/v1/groups/{groupId}/gsimaccounts?parentGSIMId={id}
> {noformat}
> This can be reproduced on the current {{develop}} branch and is also present in {{1.14.0}}.
> *Root cause*
> * {{ClientFamilyMembersReadPlatformServiceImpl.getClientFamilyMember()}} calls {{jdbcTemplate.queryForObject(...)}} without handling the case where no rows are returned.
> * {{GSIMReadPlatformServiceImpl.findGSIMAccountByGSIMId()}} follows the same pattern. It is invoked from {{GroupsApiResource.retrieveGsimAccounts()}} whenever the {{parentGSIMId}} query parameter is supplied.
> When {{JdbcTemplate.queryForObject()}} finds no matching row, Spring throws {{EmptyResultDataAccessException}}. Since there is no dedicated exception mapper for it under {{org.apache.fineract.infrastructure.core.exceptionmapper}}, it falls through to {{DefaultExceptionMapper}}, resulting in an HTTP 500 instead of a 404.
> *Additional defect (Family Members)*
> The family-member lookup does not validate the {{clientId}} path parameter. The query filters only by {{fmb.id}}, meaning requests such as:
> {noformat}
> GET /clients/999/familymembers/5
> {noformat}
> can return a family member belonging to a different client.
> The lookup should instead be scoped as:
> {code:sql}
> WHERE fmb.client_id = ? AND fmb.id = ?
> {code}
> If the family member does not belong to the client specified in the path, the endpoint should return HTTP 404.
> *Expected behavior*
> Both endpoints should return HTTP 404 with the standard platform error payload when the requested resource does not exist.
> This should follow the existing Fineract pattern:
> * Catch {{EmptyResultDataAccessException}}.
> * Throw a domain-specific exception extending {{AbstractPlatformResourceNotFoundException}}.
> * Let {{PlatformResourceNotFoundExceptionMapper}} translate it into an HTTP 404 response.
> *Steps to reproduce*
> # Call:
> {noformat}
> GET /fineract-provider/api/v1/clients/1/familymembers/999999
> {noformat}
> Current: HTTP 500
> Expected: HTTP 404
> # Call:
> {noformat}
> GET /fineract-provider/api/v1/groups/1/gsimaccounts?parentGSIMId=999999
> {noformat}
> Current: HTTP 500
> Expected: HTTP 404
> # Create Client A with a family member M and Client B. Then call:
> {noformat}
> GET /clients/{B}/familymembers/{M}
> {noformat}
> Current: Returns the family member belonging to Client A.
> Expected: HTTP 404.
> *Proposed fix*
> * Introduce {{FamilyMemberNotFoundException}} and {{GSIMAccountNotFoundException}}, both extending {{AbstractPlatformResourceNotFoundException}}.
> * Catch {{EmptyResultDataAccessException}} in the corresponding read-platform service methods and rethrow the appropriate domain-specific exception.
> * Scope the family-member lookup by both {{client_id}} and {{familyMemberId}}.
> * Add integration tests covering:
> ** Non-existent family member → HTTP 404.
> ** Non-existent GSIM account → HTTP 404.
> ** Family member belonging to a different client → HTTP 404.
> I found this issue while reviewing the read-platform services and would like to work on it. Please assign it to me.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)