PatchLoanFile is no longer a status backdoor; unblocking a condition needs the underwrite right; clear cascades

FixSecurityService
Ya
7 Julai 2026, 23:43 UTC
Mwandishi
Kamo
Ahadi ya
1e52573

**************** status changes are the pipeline state machine's job (POST /transitions enforces legal arrows + per-arrow role gate + open-blocking-condition gate). patchLoanFile now rejects EVERY status change except the borrower's own submit (DRAFT->APPLICATION_TAKEN by a non-operator party) — previously any LOS-write operator could PATCH loan-file {statusId:8} to FUND past unmet conditions, skipping underwriting. **************** pass whether the caller holds LOS_UNDERWRITE_LOAN to update() so a true->false downgrade of a blocking condition is underwriter-only (SecurityException -> 403). **************** cascade suppressConditionRequirements (NOT_APPLICABLE) like waive/delete, so a manually-cleared condition stops the borrower being asked for its now-moot documents.

Mabadiliko yote

Je, unaona nini kuhusu usafiri?

Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.

Kuwa Huru MileleMtazamo wa bei