KamoCRM

Staff can delete a never-received mortgage application; a received one answers 409 (SITP TP21FU)

FixSecurityService
Shipped
October 18, 2026 at 11:12 PM UTC
Author
Kamo
Commit
8e25989

DELETE **************** went through AppMortgageService.delete, which 500'd for every application (borrower satellite rows left behind). The shared library now purges the whole application in one transaction and refuses a record of business with ApplicationRetainedException; this controller answers that with 409 ("Withdraw it instead") instead of 500. The right check is unchanged (MLOS_SUSPEND_OR_WITHDRAW, or the borrower's own application). **************** runs the purge and, in the same transaction, retires a deal (mlos_loan_transaction) the deleted loan leaves empty, so it stops showing in the deal-grouped pipeline. The deal row stays (append-only timeline, borrower's vault documents).

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free ForeverView Pricing