PatchLoanFile is no longer a status backdoor; unblocking a condition needs the underwrite right; clear cascades

FixSecurityService
Shipped
July 7, 2026 at 11:43 PM UTC
Author
Kamo
Commit
1e52573

**************** status changes are the pipeline state machine's job (POST /transitions enforces legal arrows + per-arrow role gate + open-blocking-condition gate). patchLoanFile now rejects EVERY status change except the borrower's own submit (DRAFT->APPLICATION_TAKEN by a non-operator party) — previously any LOS-write operator could PATCH loan-file {statusId:8} to FUND past unmet conditions, skipping underwriting. **************** pass whether the caller holds LOS_UNDERWRITE_LOAN to update() so a true->false downgrade of a blocking condition is underwriter-only (SecurityException -> 403). **************** cascade suppressConditionRequirements (NOT_APPLICABLE) like waive/delete, so a manually-cleared condition stops the borrower being asked for its now-moot documents.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing