apiVersion: jenkins.io/v1 kind: PipelineActivity metadata: annotations: lighthouse.jenkins-x.io/cloneURI: https://github.com/greencapitaltrade/destiny.git lighthouse.jenkins-x.io/job: release pipeline.jenkins-x.io/traceID: 43328dd91456e5c8a26bde811acb3a3b creationTimestamp: "2026-08-14T04:51:19Z" generation: 7 labels: branch: main build: "184" context: release created-by-lighthouse: "true" event-GUID: c5b31ff0-979b-11f1-8af8-0e98cf378e84 lighthouse.jenkins-x.io/baseSHA: e5a62c59d58da0f5482698519d4a008bd4c638c5 lighthouse.jenkins-x.io/branch: main lighthouse.jenkins-x.io/buildNum: "1786683079116" lighthouse.jenkins-x.io/context: release lighthouse.jenkins-x.io/id: apitaltrade-destiny-main-release-bqdm6 lighthouse.jenkins-x.io/job: release lighthouse.jenkins-x.io/lastCommitSHA: e5a62c59d58da0f5482698519d4a008bd4c638c5 lighthouse.jenkins-x.io/refs.org: greencapitaltrade lighthouse.jenkins-x.io/refs.repo: destiny lighthouse.jenkins-x.io/type: postsubmit owner: greencapitaltrade podName: apitaltrade-destiny-main-release-fl86v-from-build-pack-pod provider: github repository: destiny tekton.dev/pipeline: apitaltrade-destiny-main-release managedFields: - apiVersion: jenkins.io/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:labels: f:branch: {} f:context: {} f:owner: {} f:provider: {} f:repository: {} f:spec: f:lastCommitMessage: {} f:lastCommitSHA: {} f:releaseNotesURL: {} f:version: {} manager: jx-changelog-0.10.29 operation: Update time: "2026-08-14T04:54:29Z" - apiVersion: jenkins.io/v1 fieldsType: FieldsV1 fieldsV1: f:metadata: f:annotations: .: {} f:lighthouse.jenkins-x.io/cloneURI: {} f:lighthouse.jenkins-x.io/job: {} f:pipeline.jenkins-x.io/traceID: {} f:labels: .: {} f:build: {} f:created-by-lighthouse: {} f:event-GUID: {} f:lighthouse.jenkins-x.io/baseSHA: {} f:lighthouse.jenkins-x.io/branch: {} f:lighthouse.jenkins-x.io/buildNum: {} f:lighthouse.jenkins-x.io/context: {} f:lighthouse.jenkins-x.io/id: {} f:lighthouse.jenkins-x.io/job: {} f:lighthouse.jenkins-x.io/lastCommitSHA: {} f:lighthouse.jenkins-x.io/refs.org: {} f:lighthouse.jenkins-x.io/refs.repo: {} f:lighthouse.jenkins-x.io/type: {} f:podName: {} f:tekton.dev/pipeline: {} f:spec: .: {} f:baseSHA: {} f:batchPipelineActivity: {} f:build: {} f:buildLogsUrl: {} f:completedTimestamp: {} f:context: {} f:gitBranch: {} f:gitOwner: {} f:gitRepository: {} f:gitUrl: {} f:message: {} f:pipeline: {} f:startedTimestamp: {} f:status: {} f:steps: {} manager: jx-build-controller operation: Update time: "2026-08-14T04:56:50Z" name: greencapitaltrade-destiny-main-184 namespace: jx resourceVersion: "268269298" uid: c0b817b6-47a2-4e5f-80dd-a44598d8dfeb spec: baseSHA: e5a62c59d58da0f5482698519d4a008bd4c638c5 batchPipelineActivity: {} build: "184" buildLogsUrl: s3://logs-gct-prod-20260425045301534100000007/jenkins-x/logs/greencapitaltrade/destiny/main/184.log completedTimestamp: "2026-08-14T04:56:44Z" context: release gitBranch: main gitOwner: greencapitaltrade gitRepository: destiny gitUrl: https://github.com/greencapitaltrade/destiny.git lastCommitMessage: | fix: scope every tenant-owned lookup to the caller's organization Per the org-scoping audit, these routes looked records up org-blind by caller-supplied id: - PUT /applications/:id could mutate any org's application; POST /:application_id/loan_config completed a foreign application's flow step. Both now filter on the forwarded x-gct-org-id. - GET /applications/:user_id/active and /:user_id/documentation resolved by user_id alone; documentation also created rows with no organization_id. Both scoped, and created rows now carry the org. - The reviews router is mounted without the application middleware, so approve/reject reached any org's underwriting step -- the step lookup now joins applications with an org filter. - flows trusted caller-supplied organization_id (query on list, body on create) and served/updated/deactivated any flow by id. All five routes now use the forwarded header; create assigns the caller's org. - personal_data GET/PUT /:id served any row by id despite the application_user mount -- rows are now tied to ctx.applicationUser. - application_user_documents validate/verify/delete joined applications without an org filter -- KYC approval/deletion was cross-tenant. - The bare /bank_statement mount (no :application_id, so its filters were undefined) had no consumers and is removed. Missing headers resolve as not-found (?? null), never a 500. Provider callbacks (Digio/Saafe signature-authenticated) stay intentionally unscoped. Co-Authored-By: Claude Fable 5 lastCommitSHA: a87577bcd6080565815c1b7677534a982de32714 message: 'Tasks Completed: 1 (Failed: 0, Cancelled 0), Skipped: 0' pipeline: greencapitaltrade/destiny/main releaseNotesURL: https://github.com/greencapitaltrade/destiny/releases/tag/v1.79.2 startedTimestamp: "2026-08-14T04:51:19Z" status: Succeeded steps: - kind: Stage stage: completedTimestamp: "2026-08-14T04:56:44Z" name: from build pack startedTimestamp: "2026-08-14T04:51:22Z" status: Succeeded steps: - completedTimestamp: "2026-08-14T04:51:38Z" name: Git Clone startedTimestamp: "2026-08-14T04:51:22Z" status: Succeeded - completedTimestamp: "2026-08-14T04:51:45Z" name: Next Version startedTimestamp: "2026-08-14T04:51:39Z" status: Succeeded - completedTimestamp: "2026-08-14T04:51:49Z" name: Jx Variables startedTimestamp: "2026-08-14T04:51:46Z" status: Succeeded - completedTimestamp: "2026-08-14T04:52:50Z" name: Build Npm Install startedTimestamp: "2026-08-14T04:51:50Z" status: Succeeded - completedTimestamp: "2026-08-14T04:54:19Z" name: Build Container Build startedTimestamp: "2026-08-14T04:52:50Z" status: Succeeded - completedTimestamp: "2026-08-14T04:54:29Z" name: Promote Changelog startedTimestamp: "2026-08-14T04:54:19Z" status: Succeeded - completedTimestamp: "2026-08-14T04:54:33Z" name: Promote Helm Release startedTimestamp: "2026-08-14T04:54:30Z" status: Succeeded - completedTimestamp: "2026-08-14T04:56:03Z" name: Promote Jx Promote startedTimestamp: "2026-08-14T04:54:34Z" status: Succeeded - completedTimestamp: "2026-08-14T04:56:44Z" name: Publish Org Kb startedTimestamp: "2026-08-14T04:56:03Z" status: Succeeded - kind: Promote promote: environment: staging pullRequest: pullRequestURL: https://github.com/greencapitaltrade/mcu/pull/5479 startedTimestamp: "2026-08-14T04:55:28Z" status: Succeeded startedTimestamp: "2026-08-14T04:55:28Z" status: Succeeded - kind: Promote promote: environment: production pullRequest: pullRequestURL: https://github.com/greencapitaltrade/mcu/pull/5480 startedTimestamp: "2026-08-14T04:56:00Z" status: Succeeded startedTimestamp: "2026-08-14T04:56:00Z" status: Succeeded version: 1.79.2 status: {}