- Shipped
- November 11, 2026 at 9:49 AM UTC
- Author
- Kamo
- Commit
- 7635169
A borrower now gives five consents in the portal, each its own versioned text per lender (default v1 seeded with its hash on first touch, a lender overrides with a higher version) and each grant or withdrawal a WORM consent record with the hash of the exact text shown, IP, device and a JSON proof: e-sign, credit authorization (FCRA), privacy notice (GLBA), calls and texts (TCPA; one SMS and one call record per action) and the URLA Section 6 acknowledgments, signed with a typed name. GET/POST /{uid}/consents are party-gated with no operator bypass; a grant on a text that changed answers 409 TEXT_CHANGED. POST /{uid}/submit refuses with 409 CONSENTS_MISSING until the required four are granted, is a no-op on an application already taken, and otherwise moves the file to Application Taken through the same pipeline path the borrower's loan-file submit uses. This also fixes the e-consent endpoints, which have never worked: the disclosure text was saved without its NOT NULL body hash. /econsent now delegates to the new service. The closing desk marks which signer is the signed-in borrower (isMe), and a borrower can no longer open a co-borrower's signing link (403 NOT_YOUR_SIGNATURE); staff are unchanged. A malformed ITIN or passport on a borrower save answers 400, and a credit pull sends the ITIN when there is no SSN.