Levandor

Customization Clients Catalog

9 min read

Customization Clients Catalog

Per-client synthesis of the 22 findings/client-*.md reports. Each row is a single client/customization/<name> branch analysed via read-only three-dot (merge-base) diffs against origin/devel. For the engine that makes this possible see customization-architecture; for the full branch inventory (incl. non-client branches) see customization-branch-catalog. Siblings: INDEX, architecture-overview, flows, bin-and-scripts.

Scope of this catalog

22 client findings exist across 3 repos: vuer_oss (19 clients — the video-identification engine), portal_css (2 clients — the customer self-service web portal), esign_oss (1 client — the e-signature service). All branch facts are merge-base (devel...customization/<x>) deltas — i.e. what the client adds on top of the shared ancestor, not two-dot upgrade backlog.

"CORE-file override" = upgrade risk

The customization/ overlay tree is the intended low-risk extension surface. Files outside customization/ (i.e. server/, client/, config/*.json, bin/, package.json, db/migrate/, root entrypoints) that a client modifies are genuine rebase/merge-conflict hazards on every devel upgrade. The “CORE override (risk Y/N)” column flags clients that patch base-product code beyond config — see patterns-across-clients.

Covered clients

ClientRepoCustomization scopeClient-specific bin scriptsCORE-file overrides (upgrade risk)Scale (files / ins)Last activity
instacashesign_ossflows(offer-lifecycle RPC), sms(2FA), api(eSign↔Vuer MQ RPC), auth(JWT)noneN (3 config-only: config.js, config/dev.json, config/docker.json)14 / 3552025-11-20 (vencelvarga)
cib (portal)portal_cssflows/pages, email(strong-auth→EMAIL), branding(CIB), cv(InfoCert), api(CIB RPC + signature)noneY (WebServer.js, routes.js, customerDataCache.js, Express 4→5, package.json)193 / 15,3772026-04-21 (jurki)
unicredit-srb (portal)portal_cssflows(onboarding+PEP gate), branding(UniCredit), cv(PDF.js), api(UnicreditRPCClient SOAP bridge, JMBG)noneY (WebServer.js, login.endpoint.js, config, form-group.twig, flags.styl)306 / 79,0342026-03-26 (Bence László)
barionvuer_ossflows(5-lang aborted lib), email(MJML), branding, cv(KYC-API host), api(Barion report REST + room-export)bin/batch-export.jsY (WebServerAuth.js host-bypass, room.js status, config/roles.json, config.js)461 / 23,7552026-05-07 (Makkai Krisztián)
bb (MBH/MKB ex-BB)vuer_ossflows(loan-orig), email, sms, cron(jBPM), branding, SOAP/ESB(670 WSDL), Oracle DBbb-esb, bb-kyc, bb-archive-check/repair, bb-marketing-report, bb-migrate-data, bb-reports + 3 overlayY (heavy: soap_server.js, routes.js, auditlog.js, Letter.js, CallbackRequest.js, roles.json+154, oracledb)1114 / 141,8452026-05-14 (vencelvarga)
cib (vuer)vuer_ossflows(account-opening/KYC), email(38 dirs), sms, cron(reminders), branding(soft-POS), cv(zod validator), SOAP(Infocert+Girinfo), clamavcib.js, corpo.js, infocert.js, test.corporate.js, zod.test.js + girinfo.jsY (30 core: PortalService.js, CreateCustomer.js, integrationLog.js, WebServer.js, config)440 / 48,9152026-04-21 (jurki)
cofidisvuer_ossflows(253f, product×role matrix), email(195f), sms(bespoke gateway), cron(7), cv(6 instr), SOAP(Mobilengine), clamavbatch-export.js + 16 overlay (Mobilengine pipeline, GDPR)Y (46 core incl. 5 DB migrations, auditlog.js, Letter.js, FlowScopeMap.js, config+1000)791 / 69,5962026-05-22 (jurki)
dap (govt eID)vuer_ossflows(govt eID multi-check), cron(suspend), cv(DapAutoCheck pipeline + 525k OCR dict), api(KKSzB SOAP mock, JWS/mTLS result delivery), Prometheusdap-reports, dap-get-missing-final-result, dap-binary-clear, video-analyzer, reset-id-number-limitation, kkszb-testY (server.js, IdentificationRouterRPCServer.js, ResourceManager RPCs, googlePlayIntegrityCheck.js, supervisor confs)247 / 549,347 (96% CSV)2026-05-21 (kzsolt1984)
demovuer_ossflows(demo-* parallel set), sms(e-sign link), cron(flow-list repoint), cv(warp minScore), api(clientGate KAÜ SAML + eSignConnect)noneY (CreateCustomer.js, EsignApi.js, FlowLiveUpdateService.js, TranslationCryptoService.js, config.js, Express 5)114 / 8,7532026-05-21 (Szecsődi Imre)
fundamentavuer_ossflows(funda offer+verification, tb variants), email(MJML), sms, cron(room delete/export), cv(ABBYY FlexiCapture engine in CORE), api(custom reports), clamavnone (only bin/.eslintrc.json)Y (server/ocr/engines/AbbyFlexiCapture.js NEW core, EmailService.js, Letter.js, SmsService.js, CustomerService.js, ExportRoomPageService.js)225 / 87,8592026-05-11 (Szabó Márton)
generali-atvilagitasvuer_ossflows(gen-*), email(8 new), cron(PDF→SFTP), cv(5 instr), api(invoice-reports REST + SFTP), clamav, consent-cddgenerate-pdfY (ReplayData.js positional-arg change, db/helpers.js, SelfServiceRoomService.js, FlowBase.js, config)154 / 9,2282026-05-20 (jurki)
kh (K&H Bank)vuer_ossflows(110f banking), email(55 MJML), sms(gateway), cron(7 Kafka/DWH), cv(7 instr), SOAP(52 WSDL: Kaller/Apollo/OH), Oracle, Kafka DWH/GDPR30+ overlay (kaller_server, kh-dwh-*, kh-reports, soap servers, reports) + core bin/pg2ora_migrator/Y (heavy: AppointmentService.js+163, soap_server.js, 5 core db/migrate, config+480, nginx/supervisor confs)523 / 52,9412026-05-12 (Peter Szollar)
magnet (MagnetBank)vuer_ossflows(~40 mb-* banking), email, sms(gateway), branding, api(TASZ/OSZ Postgres/FacekomApi), import/export(CSV)tasz.jsY (FlowFilterService.js+21 only real logic; rest config/UI/debug; csv-parse/iconv-lite deps)337 / 25,4552026-05-08 (Peter Szollar)
mbh (MBH Bank)vuer_ossflows(3-stage self-service), email(MJML+supervisor), branding, cv(thresholds 0.6→0.62), api(GIRO + ESB /external), custom-settings UIbin/mbh-cli.js (in CORE bin)Y (WebServerAuth.js /external bypass, auditlog.js, Letter.js, 4 CV task threshold bumps, integrationLog.js, config)174 / 13,5122026-04-24 (Szabó Márton)
microsecvuer_ossflows(non-RT eIDV, voice-liveness), sms(provider), cron(status), cv(5 instr + OCR/MRZ/eMRTD), api(mTLS client-cert login, ActiveMQ), Elasticsearchroom-statistics.jsY (heavy auth: WebServerAuth.js+66, clientCertStrategy.js NEW, logger/elastic.js NEW, auditlog.js, logger.js, cron.js)90 / 8,9112026-03-27 (bencelaszlo)
mkb-instant (MKB/MBH)vuer_ossflows(309f multi-tenant: MKB/Takarék/Diákhitel/SZÉP/MFB/OSZK), email(OSZK/OSZNY variants), sms(ESB), branding, SOAP(71 WSDL ESB), Oracle, skill-matrix4 overlay + 7 CORE bin (mkb-cli, esb.mjs, oracle_client, get_call_report_data, repair-db, respond_user_auth)Y (config, roles.json, sidebar, bin/db/migrate-rdbms.js, bin/archive, bin/export_customers.js, oracledb dep)589 / 44,0962026-03-26 (tamaskonyhas)
mvm (MVM energy)vuer_oss(no flows — video-call only), email(MJML), sms, cron(archive/delete), api(TCT call-center + ForSales), virus-scan(RAPI), audit/SIEMnone (2 base bin modified)Y (OpenHours.js+20 cache inject, WebServerAuth.js IP-log, FileValidatorErrors.js NEW, auditlog.js, config)156 / 8,3072026-04-30 (bencelaszlo)
nusz (NÚSZ toll)vuer_ossflows(surcharge/vignette), email(large set), sms, cron(audio archive/delete), api(advanced reports RPC + email-validation)audio_archive, customer-data, remove-old-video-files, crypto/extract-room-attachments, crypto/helpers/setup (all CORE bin)Y (CustomerService.js waiting-fix, ReportsService.js, cron.js FFmpeg, PortalDataBase.js, TokenService.js, config)173 / 10,1382026-04-27 (Szekeres Tamás)
polgaribank (Polgári Bank)vuer_ossflows(phase proto bumps, drop girinfo step), email(inky→MJML migration), sms, cron(DeleteRooms retention), api(reports-advanced), password-policynone (28 bin = upstream merge-noise, all M)Y (Letter.js email-engine swap, Converter.js, roles.json scope removal, deletes core email layout, Express/commander/mq)138 / 6,3872026-02-25 (Szekeres Tamás)
raiffeisenvuer_ossflows(10+ PION/OSZK/PROSPECT/MYRA multi-channel), email(MJML+data-recovery), sms, cron(3: cert/sales-funnel/NRT), cv(MYRA instr+eMRTD mock), api(Girinfo+Kafka sales-funnel+MetaDefender/S3 virus)salesfunnel, raiffeisen-selfservice-failed-reports, raiffeisen-remove-location-data, generate-self-service-rooms, migrate-RFK-126, selfservice-proto-fixY (61 core: SelfServiceV2Service.js, RoomService.js, emrtd.process.js, Letter.js, rabbitmq.js, video-processor.js, DB migration)284 / 25,5192026-05-21 (Szecsődi Imre)
unicredit-srb (vuer)vuer_ossflows(uc-* KYC/AML), email(5 new), sms(provider), cron(4: CoreId/DMS/country/municipality), cv(Serbian OCR docs), api(Siron MSSQL/PEP/Lead/DMS)bin/cv-statistics (CORE bin)N→light (8 small core: PortalDataBase.js +checkbox, ShortenerService.js logs, layout sr-latn, header twig, tedious dep, config)377 / 26,4642026-02-13 (jurki)
unicredit (vuer)vuer_ossflows(uc-* incl. existing-customer), email, sms, cron(data-cleanup+vacuum), cv(NEW core visions: blink/hologram/liveness/smile), api(Giro SOAP + loopback), Splunkdb/disable_user, delete-rooms-from-xlsx, giro.test, run-cronjob (CORE bin) + cleanup-deleted-rooms overlayY (heavy CV: RecognitionService.js 89/66, CVRecipe.js +67, 4 NEW vision modules, CVApi.js, SelfServiceV2Service.js, SFTPService.js, config)190 / 23,5192026-05-19 (tamaskonyhas)

Scale caveats (from the findings)

  • dap 549k insertions is ~96% two static OCR word-list CSVs (en_words.csv 466k + hu_words.csv 58k), not logic.
  • bb 670 WSDL files (~60% of its file count) are vendored SOAP contracts; mkb-instant 71, kh 52 similarly.
  • Several clients’ headline insertions are inflated by yarn.lock regen, docs .md, and binary .png/screenshot assets (notably fundamenta, generali, unicredit-srb, demo).

Patterns across clients

What (almost) every client customizes

Derived from the 22 findings; counts are clients exhibiting the pattern.

  • customization/ overlay is the norm (22/22). Every client delivers the bulk of work under the overlay tree; CORE edits are the exception flagged per-row. This validates the customization-architecture overlay/hook design.
  • Email templates (≈21/22). Nearly all vuer_oss clients modify the same base letter set: e-mail-invite, e-mail-verification, e-mail-device-change, e-mail-password-recovery, e-mail-restore, e-mail-archive, e-mail-auto-archive-summary, e-mail-cert-expiry, e-mail-audit-log-alarm, e-mail-user-password-change, e-mail-user-temporary-password + letterTypes.trans.js. (instacash/esign and mvm are the thin exceptions.)
  • SMS trans overrides (≈20/22). The same quartet recurs: sms-invite, sms-verification, sms-device-change, sms-user-temporary-password (*.sms.trans.js). A subset add a bespoke SMS gateway provider (customization/api/sms/SmsApi<Client>.js): cofidis, kh, magnet, microsec, unicredit-srb, mkb-instant(ESB), demo(debug only). Base SmsApiSmsApiCom is the default.
  • Branding asset + email layout (≈19/22). One client logo PNG under customization/assets/image/ + customization/ui/branding/pages/videochat.style.branding.styl + email-layout overlay (customization/ui/layouts/email/).
  • Per-client flows (20/22). customization/flow/<prefix>-* named per client (mb-, kh-, cib-, uc-, gen-, demo-, dap-, funda-, nusz-, mkb_/takarek_/diakhitel_, etc.). mvm is the only client with no flows (“MVM does not have flows like other partners” — video-call only). instacash (esign repo) customizes offer-lifecycle hooks instead of vuer flows.
  • Portal data + translations. customization/portal/PortalData.js(+.trans.js) and customization/translations/{roles,screenshot,email,user}.trans.js are touched by most vuer_oss clients.
  • Maintenance/security audit logs. Most clients ship dated customization/customization-maintenance/*.md + customization/customization-security/*.md (commonly a 2025-11-06.md plus older), evidencing periodic pentest/upgrade cycles.

Common opt-in subsystems (cross-client, not universal)

  • ClamAV antivirus on uploads (customization/listeners/clamav.js, document:virusScan hook): cib(vuer), cofidis, fundamenta, generali. Other virus-scan stacks: mvm (RAPI), raiffeisen (MetaDefender+S3), mbh (own), microsec/dap (PAD/liveness-style), kh (KhAntiVirusService).
  • Advanced/custom reports (RPC + UI page + XLSX, often ReportsAdvancedService / reports-advanced endpoint): polgaribank, nusz, cofidis, generali, magnet, raiffeisen, mbh, mkb-instant, unicredit, kh. This is the single most-cloned bespoke feature.
  • Custom password policy (customization/listeners/verify-password-*.js): polgaribank (strictest, fully tested), kh, mbh, dap, fundamenta, cofidis, unicredit.
  • eMRTD/MRZ/OCR document pipeline (<Client>{Ocr,Mrz,Emrtd}Service + CV instruction sets): dap, kh, microsec, unicredit, unicredit-srb, raiffeisen (mock), cofidis/generali (CV instr only).
  • GIRO/Girinfo (HU credit-bureau) lookups: kh, mbh, cib(vuer), unicredit, raiffeisen, demo(KAÜ via clientGate).
  • Oracle DB target (vs default Postgres): bb, kh, mkb-instant — all add oracledb to core package.json and Oracle bin tooling. magnet adds an external Postgres (OSZ). unicredit-srb adds tedious (MSSQL, for Siron).
  • Room export / archival + retention crons: barion, mvm, nusz (audio), polgaribank (DeleteRooms), unicredit (DataCleanup+vacuum), cofidis, raiffeisen, kh.

Who modifies CORE (upgrade risk) — and how much

  • CORE-override = Y for 21/22 clients. Only instacash (esign) is config-only (CORE risk N — its 3 core files are JSON/one guarded if). unicredit-srb (vuer) is the lightest “Y”: 8 tiny surgical core edits (logging, locale, a 'checkbox' array entry, tedious dep).
  • Heaviest CORE blast radius: bb (soap_server.js, auditlog.js, routes.js, Letter.js, roles.json+154, Oracle dep), kh (AppointmentService.js+163, soap_server.js, 5 core DB migrations, infra confs), unicredit (CV subsystem rewrite: RecognitionService.js 89/66, CVRecipe.js +67, 4 NEW core vision modules), fundamenta (NEW core OCR engine AbbyFlexiCapture.js), microsec (NEW core auth clientCertStrategy.js + logger/elastic.js), raiffeisen (61 core files, 10 server/**).
  • Recurring CORE hot-spots (the files most likely to conflict on upgrade):
    • config/dev.json + config/docker.json + config/roles.json — modified by essentially every client (the unavoidable conflict surface).
    • server/web/WebServerAuth.js — auth/firewall bypass for external API hosts: barion (kycapi), mbh (/external), mvm (IP-log), microsec (client-cert).
    • server/auditlog.js — audit-event additions: bb, cofidis, mbh, microsec, mvm.
    • server/e-mail/Letter.js — MJML rendering changes: fundamenta, mbh, polgaribank (full inky→MJML swap), bb, raiffeisen.
    • client/ui/regions/sidebar/{twig,trans.js} — nav entries for custom pages: ~all vuer_oss bank clients.
    • server/queue/rpc_server/CreateCustomer.js / CreateCustomer — demo, cib(vuer); server/service/SelfServiceV2Service.js — dap, raiffeisen, unicredit.
    • NEW top-level entrypoints in CORE: soap_server.js (bb, kh), googlePlayIntegrityCheck.js (dap), bin/mbh-cli.js (mbh), bin/cib.js etc. (cib).
    • Core db/migrate/ injections (shared migration timeline — high risk): cofidis (5), kh (5), generali/raiffeisen (1 each).
  • Express 4→5 migration is carried in-branch by many clients (cib-portal, cib-vuer, barion, demo, fundamenta, microsec, mbh, polgaribank, generali, unicredit-srb) — a cross-cutting core upgrade, merge-sensitive.
  • CV task threshold drift (silent behavioral divergence, not a conflict): mbh bumps face/action/holo/liveness 0.6→0.62 in core server/cv/tasks/*.

SOAP vs REST/RPC integration split

  • True SOAP/WSDL clients: bb (670 WSDL, ESB/jBPM), kh (52 WSDL, Kaller/Apollo), mkb-instant (71 WSDL, ESB), cib-vuer (Infocert+Girinfo), cofidis (Mobilengine), unicredit (Giro Client_CheckIDDocument.wsdl + loopback), dap (KKSzB mock).
  • REST/RPC/queue “API” (no WSDL despite the bucket name): barion (Barion callback), magnet (TASZ/OSZ), mvm (TCT/ForSales), generali (invoice+SFTP), raiffeisen (Kafka+IDV), nusz/polgaribank (reports-advanced RPC), unicredit-srb (Siron MSSQL + Lead/DMS REST), instacash (eSign MQ RPC).
  • Common bridge pattern: a per-client customization/server/queue/rpc_server/<Client>RPCServer.js on a rpc-<client> / <client>-rpc queue; the actual SOAP/backend termination lives in a separate backend service, not these repos.

Authorship / cadence signal

  • Most active maintainers across client branches: jurki (cib×2, cofidis, generali, unicredit-srb-vuer), Szecsődi Imre (demo, raiffeisen), Szekeres Tamás (nusz, polgaribank), tamaskonyhas (mkb-instant, unicredit), vencelvarga (bb, instacash), bencelaszlo (microsec, mvm), Szabó Márton (fundamenta, mbh).
  • Version lines cluster at 1.9.11.x for vuer_oss clients (shared core release train); commits-ahead range from 48 (barion/instacash) to 700 (raiffeisen), 602 (cib-vuer), 545 (kh) — roughly tracking integration depth.
  • Most branches are kept in sync via periodic Merge branch 'devel' / update/customization/<client>-YYYY-MM-DD commits; demo is the notable laggard (153 ahead / 143 behind devel — an upgrade backlog).

Sources

Synthesised from all 22 client findings files in /Users/levander/coding/facekom-v2-work/findings/:

  • client-esign_oss-instacash.md
  • client-portal_css-cib.md, client-portal_css-unicredit-srb.md
  • client-vuer_oss-barion.md, client-vuer_oss-bb.md, client-vuer_oss-cib.md, client-vuer_oss-cofidis.md, client-vuer_oss-dap.md, client-vuer_oss-demo.md, client-vuer_oss-fundamenta.md, client-vuer_oss-generali-atvilagitas.md, client-vuer_oss-kh.md, client-vuer_oss-magnet.md, client-vuer_oss-mbh.md, client-vuer_oss-microsec.md, client-vuer_oss-mkb-instant.md, client-vuer_oss-mvm.md, client-vuer_oss-nusz.md, client-vuer_oss-polgaribank.md, client-vuer_oss-raiffeisen.md, client-vuer_oss-unicredit-srb.md, client-vuer_oss-unicredit.md

Each findings file is itself sourced from read-only git (diff --shortstat/--name-status/--dirstat/--numstat, log, rev-list, capped show) on the three source repos at /Users/levander/coding/facekom/{esign_oss,portal_css,vuer_oss}.

Graph View

Backlinks