Multicustomer

These updates are applicable for releases - 2021.04, 2021.07, 2021.10, 2022.07, 2022.10, 2023.01, 2023.07, 2023.10, 2024.01, 2024.07.

Description

Using the Get list "URL/services/data/v1/Holdings/operations/DigitalArrangements/getList" call to retrieve all the accounts of the customer.

In case of multi customer scenario, we are passing a tag "Membership_Id" to fetch the account of the specific customer.

But here the issue is, the service responds for any customer id which is passed in "{{Membership_Id"}}tag irrespective of whether it is linked to the core customer or not.

So if user "A" login in, user A can fetch the accounts of another user "B" by just passing the "Membership_Id" with B's core customer id value.

Path: localservices/Fabric/java/ArrangementsAPI-Services/src/main/java/com/temenos/infinity/api/arrangements/javaservice/GetAccountsOperation.java

Package: com.temenos.infinity.api.arrangements.javaservice;

• Import the package as shown below.
  Respective Code:
  • import com.temenos.infinity.api.arrangements.config.ArrangementsAPIServices;
  • import com.google.gson.JsonObject;
  • import com.kony.dbputilities.util.JSONUtil;
• Add one conditional statement within the Object invoke function.
  Respective Code:

if(!validateMemberShipId(request, 
        		request.getParameter(TemenosConstants.Membership_id), loginUserId, companyId)) {
        	alert.prepareError("loggedin user tried to fecth account for another membershipId").log();
        	return ErrorCodeEnum.ERR_11024.setErrorCode(new Result());
        }

Pls refer the Image,

• Add the below function at the end of the GetAccountsOperation class.
  Respective Code:

public boolean validateMemberShipId(DataControllerRequest request, String membershipId,
			String customerId, String companyId ) {
		
		if(StringUtils.isBlank(membershipId)) {
			return true;
		}
		
		Map<String, Object> inputParams = new HashMap<String, Object>();
		StringBuilder query = new StringBuilder();
		query.append("customerId").append(DBPUtilitiesConstants.EQUAL).append(customerId);
		query.append(DBPUtilitiesConstants.AND);
		query.append("companyLegalUnit").append(DBPUtilitiesConstants.EQUAL).append(companyId);
		query.append(DBPUtilitiesConstants.AND);
		query.append("coreCustomerId").append(DBPUtilitiesConstants.EQUAL).append(membershipId);
        inputParams.put("$filter", query.toString());
        String contractCustomersString = StringUtils.EMPTY;
		try {
			contractCustomersString = DBPServiceExecutorBuilder.builder()
			        .withServiceId(ArrangementsAPIServices.DBXDB_CONTRACT_CUSTOMERS.getServiceName())
			        .withOperationId(ArrangementsAPIServices.DBXDB_CONTRACT_CUSTOMERS.getOperationName())
			        .withRequestParameters(inputParams).withRequestHeaders(request.getHeaderMap())
			        .withDataControllerRequest(request)
			        .build().getResponse();
		} catch (Exception e) {
			alert.prepareError(e.toString()).log();
		}
		
		if(StringUtils.isNotBlank(contractCustomersString)) {
			JsonObject contractCustomers = JSONUtil.parseAsJsonObject(contractCustomersString);
			 
			return (JSONUtil.hasKey(contractCustomers, "contractcustomers")
                    && contractCustomers.get("contractcustomers").isJsonArray()
                    && contractCustomers.get("contractcustomers").getAsJsonArray().size() > 0);
		}
		
		return false;
	}