FINERACT-1977: 4-eye-principle, maker-checker permission

[marta-jankovics]

Description

Describe the changes made and why they were made.

Ignore if these details are present on the associated Apache Fineract JIRA ticket.

Checklist

Please make sure these boxes are checked before submitting your pull request - thanks!

• Write the commit message as per https://github.com/apache/fineract/#pull-requests

• Acknowledge that we will not review PRs that are not passing the build ("green") - it is your responsibility to get a proposed PR to pass the build, not primarily the project's maintainers.

• Create/update unit or integration tests for verifying the changes made.

• Follow coding conventions at https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions.

• Add required Swagger annotation and update API documentation at fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with details of any API changes

• Submission is not a "code dump". (Large changes can be made "in repository" via a branch. Ask on the developer mailing list for guidance, if required.)

FYI our guidelines for code reviews are at https://cwiki.apache.org/confluence/display/FINERACT/Code+Review+Guide.

[IOhacker]

I have reviewed the code and it is Ok for the create client maker-checker action.

Is there a way to include in the integration test case some coverage for Loan, Savings, Transaction (disbursement, withdrawal/deposit)?

This is because I think that this is an important feature enhancement.

[marta-jankovics]

I have reviewed the code and it is Ok for the create client maker-checker action.

Is there a way to include in the integration test case some coverage for Loan, Savings, Transaction (disbursement, withdrawal/deposit)?

This is because I think that this is an important feature enhancement.

Thank you for your review.
I chose CREATE_CLIENT because it is one of the most complicated cases. The request and the command is made for CREATE_CLIENT which is not maker-checker, but ACTIVATE_CLIENT, which runs hidden as a side-action, is maker-checker. So when you try to approve the maker CREATE_CLIENT command request, it should be successful, even if the main action is not 'maker'.
For your request I've added now one more test case, which is more simpler: WITHDRAWAL_SAVINGSACCOUNT. It is a real maker-checker transaction level action, on Savings Account main entity.
If 4 eye is working for both of these cases then I do not think that any more tests are required, because the concept is the same for all other entities/actions.

[adamsaghy]

This seems not correct to me. If we are not storing the initial command, anyone can call it again without any error... Am i missing something?

[marta-jankovics]

Any other call would fail, because the idempotency key is unique, but not with 'Too early' error, which would be the correct error code in this case.