Summary
Fixes the issue where an admin account could force-complete (override) a user's KYC record even when the user had not submitted any KYC information or ID documents.
- Lark bug: https://hola-tech.sg.larksuite.com/record/NxVrrDmUCeRl7fcd3R9llwIGg4c
- Priority: High
- Module: [Admin] Users & KYC / Backend KYC Override
Root Cause
Previously, KycService.overrideKycToCompleted only checked whether a record existed and whether its current status was already COMPLETED. When a user started KYC or opened the mobile KYC screen without submitting documents, an initial record with PENDING status existed with null personal and document fields. When an admin clicked "Override to completed", applyStatus fetched empty applicant info from Sumsub, but still proceeded to update the record status to COMPLETED, verify the user, and emit KYC_COMPLETED.
Changes
-
Backend (
be/src/modules/kyc/services/kyc.service.ts):- In
overrideKycToCompleted:- Validate that the KYC record exists and has a non-empty
recordId. - Fetch fresh applicant details from Sumsub and inspect both local DB fields and Sumsub applicant fields.
- Reject with
BadRequestException('User has not submitted KYC information')ifdocumentNumberordocumentTypeis missing. - Pass prefetched applicant fields to
applyStatusto avoid a redundant second HTTP request to Sumsub.
- Validate that the KYC record exists and has a non-empty
- Updated
applyStatusto accept optionalprefetchedFieldswhen transitioning toCOMPLETED.
- In
-
Unit Tests:
-
be/src/modules/kyc/services/kyc.service.spec.ts: Added test cases covering:- Rejection when user has no KYC record.
- Rejection when
recordIdis missing. - Rejection when KYC document data is missing from both DB and Sumsub.
- Successful override when document details are present.
-
admin/src/features/users/user-detail-page.test.tsx: Added test verifying the override dialog stays open and handles the rejection when KYC data is missing.
-
Verification
- Ran backend unit test suite:
pnpm test src/modules/kyc/services/kyc.service.spec.ts-> 76/76 passed. - Ran backend admin test suite:
pnpm test src/modules/admin/services/admin-users.service.spec.ts-> 3/3 passed. - Ran admin portal test suite:
pnpm test src/features/users/user-detail-page.test.tsx-> 5/5 passed. - Full admin test suite: 71 test suites, 835/835 tests passed.
- Production build:
pnpm buildpassed on bothbeandadmin.