Skip to content

FINERACT-2720: Scope entity-to-entity mapping results to user office hierarchy - #6197

Open
aya-abdallah-FOO wants to merge 1 commit into
apache:developfrom
foodeveloper:FINERACT-2720/office-entity-mapping-hierarchy-scope
Open

FINERACT-2720: Scope entity-to-entity mapping results to user office hierarchy#6197
aya-abdallah-FOO wants to merge 1 commit into
apache:developfrom
foodeveloper:FINERACT-2720/office-entity-mapping-hierarchy-scope

Conversation

@aya-abdallah-FOO

@aya-abdallah-FOO aya-abdallah-FOO commented Jul 28, 2026

Copy link
Copy Markdown

Description

When the All option is selected in the Office dropdown on the Entity-to-Entity Mapping screen (System → Entity to Entity Mapping), the API returns mappings across all offices
in the system, including branches the authenticated user has no access to. This violates office-level access restrictions.

Root cause: retrieveEntityToEntityMappings treats fromId = 0 (the "All" sentinel) as a pass-through, so the SQL returns every row regardless of the caller's office
hierarchy.

Fix

When fromId == 0 and the relation's from_entity_type is 1 (office), a recursive CTE (WITH RECURSIVE office_descendants) scopes results to only the authenticated user's
office and its descendants. Non-office relation types fall through to the existing query unchanged.

Testing

  • A user in a non-root office sees only their office (and child offices) in the Entity-to-Entity Mapping dropdown — not "All" or unrelated branches.
  • :fineract-provider:compileJava and :fineract-provider:compileTestJava pass clean

FINERACT-2720

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant