- Ya
- 7 Julai 2026, 20:39 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 5a817ed
Two related borrower-authorization holes on the self-service app endpoints: - Privilege escalation (#2): patchLoanFile applied any statusId with no caller-rights check, so a borrower (party to their own app, zero operator rights) could PATCH loan-file {statusId:8} to mark their loan FUNDED (or APPROVED/CLEAR_TO_CLOSE). Now a non-operator may only advance DRAFT -> APPLICATION_TAKEN (the submit); every other status is operator-only. - Post-submission edit lock (#4): requireWrite(req, uid) authorized any party to write at any status, so a borrower could keep mutating URLA data (borrower identity, income, assets, declarations) while the file was in processing/underwriting, silently diverging the record. The borrower write gate now also requires the loan file to still be DRAFT; operators are unaffected (they short-circuit) and reads are unaffected. Document uploads live on a different controller and remain available post-submission.