Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • A Ahad Mobile
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 0
    • Issues 0
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 0
    • Merge requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Terraform modules
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • holatech
  • Ahad Mobile
  • Merge requests
  • !156

fix(admin,kyc): reject kyc override when applicant data is missing

  • Review changes

  • Download
  • Patches
  • Plain diff
Merged Hung Hoang requested to merge hunghoang/fix/admin-kyc-empty-data into develop Oct 29, 2026
  • Overview 2
  • Commits 1
  • Pipelines 1
  • Changes 3

Summary

Fixes the issue where an admin account could force-complete (override) a user's KYC record even when the user had not submitted any KYC information or ID documents.

  • Lark bug: https://hola-tech.sg.larksuite.com/record/NxVrrDmUCeRl7fcd3R9llwIGg4c
  • Priority: High
  • Module: [Admin] Users & KYC / Backend KYC Override

Root Cause

Previously, KycService.overrideKycToCompleted only checked whether a record existed and whether its current status was already COMPLETED. When a user started KYC or opened the mobile KYC screen without submitting documents, an initial record with PENDING status existed with null personal and document fields. When an admin clicked "Override to completed", applyStatus fetched empty applicant info from Sumsub, but still proceeded to update the record status to COMPLETED, verify the user, and emit KYC_COMPLETED.

Changes

  1. Backend (be/src/modules/kyc/services/kyc.service.ts):

    • In overrideKycToCompleted:
      • Validate that the KYC record exists and has a non-empty recordId.
      • Fetch fresh applicant details from Sumsub and inspect both local DB fields and Sumsub applicant fields.
      • Reject with BadRequestException('User has not submitted KYC information') if documentNumber or documentType is missing.
      • Pass prefetched applicant fields to applyStatus to avoid a redundant second HTTP request to Sumsub.
    • Updated applyStatus to accept optional prefetchedFields when transitioning to COMPLETED.
  2. Unit Tests:

    • be/src/modules/kyc/services/kyc.service.spec.ts: Added test cases covering:
      • Rejection when user has no KYC record.
      • Rejection when recordId is missing.
      • Rejection when KYC document data is missing from both DB and Sumsub.
      • Successful override when document details are present.
    • admin/src/features/users/user-detail-page.test.tsx: Added test verifying the override dialog stays open and handles the rejection when KYC data is missing.

Verification

  • Ran backend unit test suite: pnpm test src/modules/kyc/services/kyc.service.spec.ts -> 76/76 passed.
  • Ran backend admin test suite: pnpm test src/modules/admin/services/admin-users.service.spec.ts -> 3/3 passed.
  • Ran admin portal test suite: pnpm test src/features/users/user-detail-page.test.tsx -> 5/5 passed.
  • Full admin test suite: 71 test suites, 835/835 tests passed.
  • Production build: pnpm build passed on both be and admin.
Assignee
Assign to
Reviewers
Request review from
Time tracking
Source branch: hunghoang/fix/admin-kyc-empty-data