account-lookup-service 17.5.0 → 17.6.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [17.6.0](https://github.com/mojaloop/account-lookup-service/compare/v17.5.0...v17.6.0) (2025-03-19)
+
+
+### Features
+
+* **csi-1244:** add DELETE participants validation ([#539](https://github.com/mojaloop/account-lookup-service/issues/539)) ([773baa1](https://github.com/mojaloop/account-lookup-service/commit/773baa154acd38051c61b10201d6fca6a33e614e))
+
 ## [17.5.0](https://github.com/mojaloop/account-lookup-service/compare/v17.4.1...v17.5.0) (2025-03-18)
 
 

package/config/default.json

@@ -106,5 +106,6 @@
     }
   },
   "API_DOC_ENDPOINTS_ENABLED": true,
-  "FEATURE_ENABLE_EXTENDED_PARTY_ID_TYPE": false
+  "FEATURE_ENABLE_EXTENDED_PARTY_ID_TYPE": false,
+  "DELETE_PARTICIPANT_VALIDATION_ENABLED": false
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "account-lookup-service",
   "description": "Account Lookup Service is used to validate Party and Participant lookups.",
-  "version": "17.5.0",
+  "version": "17.6.0",
   "license": "Apache-2.0",
   "author": "ModusBox",
   "contributors": [

package/src/domain/participants/participants.js

@@ -625,8 +625,7 @@ const deleteParticipants = async (headers, params, method, query, cache) => {
     try {
       const fspiopError = ErrorHandler.Factory.reformatFSPIOPError(err, ErrorHandler.Enums.FSPIOPErrorCodes.DELETE_PARTY_INFO_ERROR)
       const errorCallbackEndpointType = params.SubId ? Enums.EndPoints.FspEndpointTypes.FSPIOP_CALLBACK_URL_PARTICIPANT_SUB_ID_PUT_ERROR : Enums.EndPoints.FspEndpointTypes.FSPIOP_CALLBACK_URL_PARTICIPANT_PUT_ERROR
-      await participant.sendErrorToParticipant(headers[Enums.Http.Headers.FSPIOP.SOURCE], errorCallbackEndpointType,
-        fspiopError.toApiErrorObject(Config.ERROR_HANDLING), headers, params)
+      await participant.sendErrorToParticipant(headers[Enums.Http.Headers.FSPIOP.SOURCE], errorCallbackEndpointType, fspiopError.toApiErrorObject(Config.ERROR_HANDLING), headers, params)
       util.countFspiopError(fspiopError, { operation: 'deleteParticipants', step })
     } catch (exc) {
       // We can't do anything else here- we _must_ handle all errors _within_ this function because

package/src/lib/config.js

@@ -173,7 +173,8 @@ const config = {
   API_DOC_ENDPOINTS_ENABLED: RC.API_DOC_ENDPOINTS_ENABLED || false,
   FEATURE_ENABLE_EXTENDED_PARTY_ID_TYPE: RC.FEATURE_ENABLE_EXTENDED_PARTY_ID_TYPE || false,
   PROTOCOL_VERSIONS: getProtocolVersions(DEFAULT_PROTOCOL_VERSION, RC.PROTOCOL_VERSIONS),
-  PROXY_CACHE_CONFIG: RC.PROXY_CACHE
+  PROXY_CACHE_CONFIG: RC.PROXY_CACHE,
+  DELETE_PARTICIPANT_VALIDATION_ENABLED: RC.DELETE_PARTICIPANT_VALIDATION_ENABLED || false
 }
 
 if (config.JWS_SIGN) {

package/src/models/oracle/facade.js

@@ -59,6 +59,8 @@ exports.oracleRequest = async (headers, method, params = {}, query = {}, payload
     const currency = (payload && payload.currency) ? payload.currency : (query && query.currency) ? query.currency : undefined
     const partySubIdOrType = (params && params.SubId) ? params.SubId : (query && query.partySubIdOrType) ? query.partySubIdOrType : undefined
     const isGetRequest = method.toUpperCase() === Enums.Http.RestMethods.GET
+    const isDeleteRequest = method.toUpperCase() === Enums.Http.RestMethods.DELETE
+
     if (currency && partySubIdOrType && isGetRequest) {
       url = await _getOracleEndpointByTypeCurrencyAndSubId(partyIdType, partyIdentifier, currency, partySubIdOrType, assertPendingAcquire)
     } else if (currency && isGetRequest) {
@@ -110,6 +112,41 @@ exports.oracleRequest = async (headers, method, params = {}, query = {}, payload
         return cachedOracleFspResponse
       }
 
+      if (isDeleteRequest && Config.DELETE_PARTICIPANT_VALIDATION_ENABLED) {
+        // If the request is a DELETE request, we need to ensure that the participant belongs to the requesting FSP
+        const getOracleResponse = await request.sendRequest({
+          url,
+          headers,
+          source: headers[Enums.Http.Headers.FSPIOP.SOURCE],
+          destination: headers[Enums.Http.Headers.FSPIOP.DESTINATION] || Config.HUB_NAME,
+          method: Enums.Http.RestMethods.GET,
+          payload,
+          hubNameRegex
+        })
+
+        if (getOracleResponse.status === Enums.Http.ReturnCodes.OK.CODE) {
+          const participant = getOracleResponse.data
+          if (participant?.partyList?.length > 0) {
+            const party = participant.partyList[0]
+            if (party.fspId === headers[Enums.Http.Headers.FSPIOP.SOURCE]) {
+              return await request.sendRequest({
+                url,
+                headers,
+                source: headers[Enums.Http.Headers.FSPIOP.SOURCE],
+                destination: headers[Enums.Http.Headers.FSPIOP.DESTINATION] || Config.HUB_NAME,
+                method: method.toUpperCase(),
+                payload,
+                hubNameRegex
+              })
+            } else {
+              throw ErrorHandler.Factory.createFSPIOPError(ErrorHandler.Enums.FSPIOPErrorCodes.DELETE_PARTY_INFO_ERROR, `The party ${partyIdType}:${partyIdentifier} does not belong to the requesting FSP`)
+            }
+          }
+        }
+
+        throw ErrorHandler.Factory.createFSPIOPError(ErrorHandler.Enums.FSPIOPErrorCodes.PARTY_NOT_FOUND)
+      }
+
       return await request.sendRequest({
         url,
         headers,