This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. It points them at the human-authored references they should consult before producing output.
Security model: SECURITY.md
Agents that scan this repository should consult SECURITY.md
for the project's threat model, in-scope / out-of-scope
declarations, and known non-findings before reporting issues.
Write requests are being moved from the legacy command
pipeline to the typed command infrastructure in
fineract-command (FSIP-5). Both styles
exist in the code today and the legacy one is still far more
common. In a feature whose write requests already go through
CommandDispatcher, keep to that style and do not add legacy
handlers next to it.
The new style uses:
- request and response DTOs in the feature's
datapackage - a
Command<Request>subclass in itscommandpackage - a
CommandHandler<Request, Response>in itshandlerpackage - a REST resource that injects
CommandDispatcher, sets the request as the command payload and returnsdispatcher.dispatch(command).get() - business services that take the typed request, never a
JsonCommand
It does not use the legacy API: NewCommandSourceHandler,
@CommandType, CommandWrapper, CommandWrapperBuilder,
PortfolioCommandSourceWritePlatformService, JsonCommand or
FromJsonHelper.
Reference implementations (copy the annotations on their handlers as well):
- payment types:
fineract-core/src/main/java/org/apache/fineract/portfolio/paymenttype/ - documents and images:
fineract-document/src/main/java/org/apache/fineract/infrastructure/documentmanagement/
Background and instructions:
- fineract-command/REFACTORING.md: how to migrate a feature
- fineract-command/README.md: why the new infrastructure exists
fineract-doc/src/docs/en/chapters/command/: architecture, dispatcher and handlers- FSIP-5 on the project wiki
Where the documentation and the reference implementations disagree, follow the reference implementations.