@getjones/test-infra 5.2.12 → 5.2.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getjones/test-infra",
-  "version": "5.2.12",
+  "version": "5.2.13",
   "description": "Providing internal and openapi interface",
   "main": "src/index.js",
   "files": [
@@ -19,7 +19,7 @@
   "license": "ISC",
   "dependencies": {
     "axios": "1.8.1",
-    "chai": "4.3.4",
+    "chai": "6.3.0",
     "dotenv": "16.5.0",
     "enum": "3.0.4",
     "form-data": "4.0.6",

package/src/common/commonFlows/records/records.js

@@ -23,6 +23,7 @@ const { TabExtractionRequestModel } = require('../../../saas/internal-api/requir
 const { DEFAULT_LEASE_PATH } = require('../../../saas/internal-api/requirements/consts/consts');
 const { RELATED_DOC_TYPES } = require('../../../saas/internal-api/uploadFiles/consts');
 const { WAIVER_REASONS, EXPIRY_TYPES } = compliance.models.waive;
+const { DEFAULT_PM_OVERRIDE_REASON } = require('../../../saas/internal-api/compliance/consts/overrideGapRequest/override.gap.request');
 
 const makeRecordNotResponsive = async function(recordId, context) {
 	const { data: record } = await contractors.services.getContractorById(recordId, context);
@@ -328,6 +329,45 @@ const rejectOverrideGapRequest = async (overrideGapRequestId, rejectReason, reco
 	return compliance.services.overrideGap.rejectOverrideGapRequest(overrideGapRequestId, rejectReason, record.dateModified, context);
 };
 
+const createPmOverrideRequest = async (recordId, policyName, attributeName, assigneeUserIds, context, {
+	requestReason = DEFAULT_PM_OVERRIDE_REASON,
+	expiryType = EXPIRY_TYPES.NEVER,
+	expiryDate = null,
+	expectError
+} = {}) => {
+	const { data: record } = await contractors.services.getContractorById(recordId, context);
+	const auditorContractorId = compliance.services.overrideGap.getAuditorContractorIdFromGap(record, policyName, attributeName);
+	return compliance.services.overrideGap.createPmOverrideRequest(auditorContractorId, context, {
+		requestReason,
+		expiryType,
+		expiryDate,
+		assigneeUserIds,
+		recordDateModified: record.dateModified,
+		expectError
+	});
+};
+
+const editPmOverrideRequest = async (overrideGapRequestId, recordId, context, {
+	requestReason,
+	expiryType,
+	expiryDate = null,
+	assigneeUserIds,
+	expectError
+} = {}) => {
+	const { data: record } = await contractors.services.getContractorById(recordId, context);
+	return compliance.services.overrideGap.editPmOverrideRequest(overrideGapRequestId, context, {
+		requestReason,
+		expiryType,
+		expiryDate,
+		assigneeUserIds,
+		recordDateModified: record.dateModified,
+		expectError
+	});
+};
+
+const deletePmOverrideRequest = (overrideGapRequestId, context, { expectError } = {}) =>
+	compliance.services.overrideGap.deletePmOverrideRequest(overrideGapRequestId, context, { expectError });
+
 const uploadMultipleCoiFiles = async (recordId, coiFilePaths, uploadedBy, uploaderEmail, context, { uploaderContext, duplicateHandling } = {}) => {
 	const recordResponse = await contractors.services.getContractorById(recordId, context);
 	const recordDateModified = recordResponse.data.dateModified;
@@ -447,6 +487,9 @@ module.exports = {
 	getActiveOverrides,
 	createOverrideGapRequest,
 	rejectOverrideGapRequest,
+	createPmOverrideRequest,
+	editPmOverrideRequest,
+	deletePmOverrideRequest,
 	uploadMultipleCoiFiles,
 	createTenantUser,
 	deleteRecordByName,

package/src/common/consts/projectSettings.js

@@ -21,6 +21,13 @@ module.exports = {
 		onForTenants: { overrideGapRequestSettings: { isOverrideGapRequestEnabledForVendors: false, isOverrideGapRequestEnabledForTenants: true, isOverrideGapRequestEnabledForGuests: false } },
 		onForGuests: { overrideGapRequestSettings: { isOverrideGapRequestEnabledForVendors: false, isOverrideGapRequestEnabledForTenants: false, isOverrideGapRequestEnabledForGuests: true } }
 	},
+	userOverrideRequest: {
+		onForAll: { userOverrideRequestSettings: { isUserOverrideRequestEnabledForVendors: true, isUserOverrideRequestEnabledForTenants: true, isUserOverrideRequestEnabledForGuests: true } },
+		offForAll: { userOverrideRequestSettings: { isUserOverrideRequestEnabledForVendors: false, isUserOverrideRequestEnabledForTenants: false, isUserOverrideRequestEnabledForGuests: false } },
+		onForVendors: { userOverrideRequestSettings: { isUserOverrideRequestEnabledForVendors: true, isUserOverrideRequestEnabledForTenants: false, isUserOverrideRequestEnabledForGuests: false } },
+		onForTenants: { userOverrideRequestSettings: { isUserOverrideRequestEnabledForVendors: false, isUserOverrideRequestEnabledForTenants: true, isUserOverrideRequestEnabledForGuests: false } },
+		onForGuests: { userOverrideRequestSettings: { isUserOverrideRequestEnabledForVendors: false, isUserOverrideRequestEnabledForTenants: false, isUserOverrideRequestEnabledForGuests: true } }
+	},
 	onboardingPhase: {
 		on: { onboardingPhase: true },
 		off: { onboardingPhase: false }

package/src/common/errorCodes.js

@@ -8,5 +8,6 @@ module.exports = {
 	NOT_FOUND: 'NOT_FOUND',
 	NOT_ELIGIBLE: 'NOT_ELIGIBLE',
 	RECORD_NOT_IN_ACCOUNT: 'RECORD_NOT_IN_ACCOUNT',
-	GLOBAL_RECORD_NOT_IN_ACCOUNT: 'GLOBAL_RECORD_NOT_IN_ACCOUNT'
+	GLOBAL_RECORD_NOT_IN_ACCOUNT: 'GLOBAL_RECORD_NOT_IN_ACCOUNT',
+	IDENTITY_CHANGED: 'IDENTITY_CHANGED'
 };

package/src/index.js

@@ -47,6 +47,8 @@ const getInternalAPI = () => {
 	const sampleCoi = require('./saas/internal-api/sampleCoi');
 
 	const threadScheduler = require('./saas/internal-api/thread-scheduler/runner');
+	const schedulerJobRun = require('./saas/internal-api/schedulerJobRun');
+	const certificial = require('./saas/internal-api/certificial');
 	const dbEmails = require('./saas/internal-api/dbEmails/index');
 	const agreement = require('./saas/internal-api/agreement/index');
 	const uploadFile = require('./saas/internal-api/uploadFiles/index');
@@ -86,6 +88,8 @@ const getInternalAPI = () => {
 		requestsTable,
 		sampleCoi,
 		threadScheduler,
+		schedulerJobRun,
+		certificial,
 		dbEmails,
 		emailCustomization,
 		factory,

package/src/saas/internal-api/accounts/api/core/accounts.core.api.js

@@ -5,6 +5,7 @@ const { backendUrl } = require('../../../../../env').getEnv();
 
 const Endpoints = {
 	getAccount: `${backendUrl}/saas/accounts`,
+	getAccountList: `${backendUrl}/saas/accountList`,
 	create: `${backendUrl}/saas/createaccount`,
 	delete: `${backendUrl}/saas/account`,
 	edit: accountId => `${backendUrl}/saas/account/${accountId}/settings`,
@@ -24,9 +25,13 @@ const updateAccountSettings = (accountId, settings, context) => {
 	return requests.putRequestHandler(Endpoints.edit(accountId), { accountId, ... settings }, context);
 };
 
-const getByName = (accountName, context) => {
+const getByName = (accountName, context, headers = {}) => {
 	const params = { name: accountName };
-	return requests.getRequestHandler(Endpoints.getAccount, params, context);
+	return requests.getRequestHandler(Endpoints.getAccount, params, context, headers);
+};
+
+const getAccountList = (context, headers = {}) => {
+	return requests.getRequestHandler(Endpoints.getAccountList, {}, context, headers);
 };
 
 const getFromCertificateHolder = certificateHolder => {
@@ -41,6 +46,7 @@ const getSupportAutomationAllowed = accountIds => {
 module.exports = {
 	create,
 	getByName,
+	getAccountList,
 	deleteAccount,
 	updateAccountSettings,
 	getFromCertificateHolder,

package/src/saas/internal-api/accounts/api/core/accounts.core.service.js

@@ -18,6 +18,10 @@ const createAccount = async (createAccountModel, context) => {
 	return accountsAPI.create(createAccountModel, context);
 };
 
+const getAccountsResponse = (accountName, context, headers = {}) => {
+	return accountsAPI.getByName(accountName, context, headers);
+};
+
 const getAccount = async (accountName, context) => {
 	const response = await accountsAPI.getByName(accountName, context);
 	expect(response.status, 'Failed to get accounts by name').to.equal(httpResponseStatusCodes.OK);
@@ -35,6 +39,10 @@ const getAccount = async (accountName, context) => {
 	return existingAccounts[0];
 };
 
+const getAccountList = context => {
+	return accountsAPI.getAccountList(context);
+};
+
 const getOrCreateAccount = async (createAccountModel, context) => {
 	validateType(createAccountModel, CreateAccountModel);
 	const existingAccount = await getAccount(createAccountModel.companyName, context);
@@ -94,6 +102,8 @@ const getSupportAutomationAllowed = async (accountIds, { expectError } = {}) =>
 
 module.exports = {
 	getAccount,
+	getAccountsResponse,
+	getAccountList,
 	getOrCreateAccount,
 	getAccountId,
 	createAccount,

package/src/saas/internal-api/auth/api/auth.service.js

@@ -12,7 +12,8 @@ const RETRYABLE_LOGIN_STATUSES = [
 	httpResponseStatusCodes.GATEWAY_TIMEOUT
 ];
 const MAX_LOGIN_ATTEMPTS = 3;
-const LOGIN_RETRY_DELAY_SECONDS = 1;
+const LOGIN_RETRY_STEP_TIMEOUT = 2000;
+const LOGIN_RETRY_RANGE_TIMEOUT = 5000;
 
 // Parallel callers for the same user share one login request
 const pendingLogins = new Map();
@@ -41,7 +42,8 @@ const loginWithRetry = async (email, password) => {
 		}
 
 		console.warn(`Login for ${email} failed with status ${response.status}, retrying`);
-		await timeUtils.waitFor(LOGIN_RETRY_DELAY_SECONDS).seconds;
+		const retryRandomTimeout = attempt * LOGIN_RETRY_STEP_TIMEOUT + Math.random() * LOGIN_RETRY_RANGE_TIMEOUT;
+		await timeUtils.waitFor(retryRandomTimeout).mSeconds;
 	}
 };
 
@@ -131,6 +133,14 @@ const getAuthenticatedUser = context => {
 	return authApi.getAuthenticatedUser(context);
 };
 
+// The id the backend stamps into the session on login — the same value
+// getLoggedInUserId() resolves from the JWT. Available only after the email
+// has logged in (getAuthCookie caches it); returns null otherwise.
+const getUserId = email => {
+	const identity = getSystemUserIdentity(email);
+	return identity ? identity.id : null;
+};
+
 const isHubUser = async (email, { expectError } = {}) => {
 	const response = await authApi.isHubUser(email);
 
@@ -198,6 +208,7 @@ module.exports = {
 	twoFAResendCode,
 	twoFAVerify,
 	getAuthenticatedUser,
+	getUserId,
 	isHubUser,
 	resetPassword,
 	getLoginAttempts,

package/src/saas/internal-api/certificial/api/certificial.api.js

@@ -0,0 +1,15 @@
+const requests = require('../../../../common/requests/cookieAuth/requests');
+const { backendUrl, threadSchedulerSecret } = require('../../../../env').getEnv();
+
+const Endpoints = {
+	enrollments: `${backendUrl}/schedulerJob/certificial/enrollments`
+};
+
+// Authenticated by x-scheduler-secret, not a cookie, so no ics context is passed.
+const getEnrollments = recordIds => {
+	const headers = { 'x-scheduler-secret': threadSchedulerSecret };
+
+	return requests.getRequestHandler(Endpoints.enrollments, { recordIds: recordIds.toString() }, null, headers);
+};
+
+module.exports = { getEnrollments };

package/src/saas/internal-api/certificial/api/certificial.service.js

@@ -0,0 +1,24 @@
+const certificialApi = require('./certificial.api');
+const httpResponseStatusCodes = require('../../../../common/httpResponseStatusCodes.json');
+
+// One row per requested record id. A record with no enrollment comes back with null fields, not a 404.
+const getEnrollmentStates = async recordIds => {
+	const response = await certificialApi.getEnrollments(recordIds);
+
+	if (response.status !== httpResponseStatusCodes.OK) {
+		throw new Error(`Failed to read Certificial enrollment state for records ${recordIds}, response status - ${response.status}`);
+	}
+
+	return response.data;
+};
+
+const getEnrollmentState = async recordId => {
+	const [enrollmentState] = await getEnrollmentStates([recordId]);
+
+	return enrollmentState;
+};
+
+module.exports = {
+	getEnrollmentStates,
+	getEnrollmentState
+};

package/src/saas/internal-api/certificial/consts.js

@@ -0,0 +1,8 @@
+// PENDING means Certificial never answered, so the row is never auto-retried.
+const ENROLLMENT_STATUSES = {
+	PENDING: 'PENDING',
+	ENROLLED: 'ENROLLED',
+	REJECTED: 'REJECTED'
+};
+
+module.exports = { ENROLLMENT_STATUSES };

package/src/saas/internal-api/certificial/index.js

@@ -0,0 +1,4 @@
+const services = require('./api/certificial.service');
+const consts = require('./consts');
+
+module.exports = { services, consts };

package/src/saas/internal-api/compliance/api/overrideGap/override.gap.api.js

@@ -13,7 +13,10 @@ const Endpoints = {
 	updateOverrideExpiryDate: auditorContractorId => `${backendUrl}/saas/integration-tests/override/${auditorContractorId}/expiry-date`,
 	getOverrideGapRequestById: overrideGapRequestId => `${backendUrl}/saas/gaps/override-gap-request/${overrideGapRequestId}`,
 	createOverrideGapRequest: `${backendUrl}/secured/vendor-app/record/override-gap-request`,
-	rejectOverrideGapRequest: `${backendUrl}/saas/gaps/override-gap-request/reject`
+	rejectOverrideGapRequest: `${backendUrl}/saas/gaps/override-gap-request/reject`,
+	createPmOverrideRequest: `${backendUrl}/saas/gaps/override-gap-request`,
+	pmOverrideRequestById: overrideGapRequestId => `${backendUrl}/saas/gaps/override-gap-request/${overrideGapRequestId}`,
+	eligibleOverrideAssignees: requestId => `${backendUrl}/saas/gaps/override-gap-request/assignees/${requestId}`
 };
 
 const waive = async (contractorId, waiveRequestModel, context) => {
@@ -70,6 +73,22 @@ const rejectOverrideGapRequest = (rejectModel, context) => {
 	return requests.patchRequestHandler(Endpoints.rejectOverrideGapRequest, context, rejectModel);
 };
 
+const createPmOverrideRequest = (pmOverrideRequestModel, context) => {
+	return requests.postRequestHandler(Endpoints.createPmOverrideRequest, pmOverrideRequestModel, context);
+};
+
+const editPmOverrideRequest = (overrideGapRequestId, pmOverrideRequestModel, context) => {
+	return requests.patchRequestHandler(Endpoints.pmOverrideRequestById(overrideGapRequestId), context, pmOverrideRequestModel);
+};
+
+const deletePmOverrideRequest = (overrideGapRequestId, context) => {
+	return requests.deleteRequestHandler(Endpoints.pmOverrideRequestById(overrideGapRequestId), context);
+};
+
+const getEligibleOverrideAssignees = (requestId, context) => {
+	return requests.getRequestHandler(Endpoints.eligibleOverrideAssignees(requestId), {}, context);
+};
+
 module.exports = {
 	waive,
 	retract,
@@ -82,5 +101,9 @@ module.exports = {
 	updateOverrideExpiryDate,
 	getOverrideGapRequestById,
 	createOverrideGapRequest,
-	rejectOverrideGapRequest
+	rejectOverrideGapRequest,
+	createPmOverrideRequest,
+	editPmOverrideRequest,
+	deletePmOverrideRequest,
+	getEligibleOverrideAssignees
 };

package/src/saas/internal-api/compliance/api/overrideGap/override.gap.service.js

@@ -10,7 +10,7 @@ const {
 	WAIVER_REASONS,
 	EXPIRY_TYPES
 } = require('../../models/waive/waive.model');
-const { OverrideGapRequestCreateModel, OverrideGapRequestRejectModel } = require('../../models/overrideGapRequest/override.gap.request.model');
+const { OverrideGapRequestCreateModel, OverrideGapRequestRejectModel, PmOverrideRequestModel } = require('../../models/overrideGapRequest/override.gap.request.model');
 const { validateType } = require('../../../../../common/validations/typeValidations');
 const auditUtil = require('../../utils/auditUtil');
 const httpResponseStatusCodes = require('../../../../../common/httpResponseStatusCodes.json');
@@ -277,6 +277,93 @@ const updateOverrideExpiryDate = async (auditorContractorId, expiryDate, context
 	return response;
 };
 
+const createPmOverrideRequest = async (auditorContractorId, context, {
+	requestReason,
+	expiryType,
+	expiryDate = null,
+	assigneeUserIds,
+	recordDateModified,
+	expectError
+} = {}) => {
+	const model = new PmOverrideRequestModel({
+		auditorContractorId,
+		requestReason,
+		expiryType,
+		expiryDate,
+		assigneeUserIds,
+		recordDateModified
+	});
+	validateType(model, PmOverrideRequestModel);
+	const response = await overrideGapApi.createPmOverrideRequest(model, context);
+
+	if (expectError) {
+		return response;
+	}
+
+	if (response.status !== httpResponseStatusCodes.CREATED) {
+		throw Error(`Failed to create PM override request. Status code: ${response.status}. Body: ${JSON.stringify(response.data)}`);
+	}
+
+	return response.data;
+};
+
+const editPmOverrideRequest = async (overrideGapRequestId, context, {
+	requestReason,
+	expiryType,
+	expiryDate = null,
+	assigneeUserIds,
+	recordDateModified,
+	expectError
+} = {}) => {
+	const model = new PmOverrideRequestModel({
+		requestReason,
+		expiryType,
+		expiryDate,
+		assigneeUserIds,
+		recordDateModified
+	});
+	validateType(model, PmOverrideRequestModel);
+	const response = await overrideGapApi.editPmOverrideRequest(overrideGapRequestId, model, context);
+
+	if (expectError) {
+		return response;
+	}
+
+	if (response.status !== httpResponseStatusCodes.NO_CONTENT) {
+		throw Error(`Failed to edit PM override request. Status code: ${response.status}`);
+	}
+
+	return response;
+};
+
+const deletePmOverrideRequest = async (overrideGapRequestId, context, { expectError } = {}) => {
+	const response = await overrideGapApi.deletePmOverrideRequest(overrideGapRequestId, context);
+
+	if (expectError) {
+		return response;
+	}
+
+	if (response.status !== httpResponseStatusCodes.NO_CONTENT) {
+		throw Error(`Failed to delete PM override request. Status code: ${response.status}`);
+	}
+
+	return response;
+};
+
+const getEligibleOverrideAssignees = async (requestId, context, { expectError } = {}) => {
+	const response = await overrideGapApi.getEligibleOverrideAssignees(requestId, context);
+
+	if (expectError) {
+		return response;
+	}
+
+	if (response.status !== httpResponseStatusCodes.OK) {
+		throw Error(`Failed to get eligible override assignees. Status code: ${response.status}`);
+	}
+
+	return response.data;
+};
+
 module.exports = {
 	waive,
 	waiveAll,
@@ -296,5 +383,9 @@ module.exports = {
 	getOverrideGapRequestById,
 	rejectOverrideGapRequest,
 	getAuditorContractorIdFromGap,
-	updateOverrideExpiryDate
+	updateOverrideExpiryDate,
+	createPmOverrideRequest,
+	editPmOverrideRequest,
+	deletePmOverrideRequest,
+	getEligibleOverrideAssignees
 };

package/src/saas/internal-api/compliance/consts/overrideGapRequest/override.gap.request.js

@@ -4,4 +4,11 @@ const OVERRIDE_GAP_REQUEST_STATUS = {
 	REJECTED: 'REJECTED'
 };
 
-module.exports = { OVERRIDE_GAP_REQUEST_STATUS };
+const OVERRIDE_REQUESTER_TYPE = {
+	HUB_USER: 'HUB_USER',
+	INVITER: 'INVITER'
+};
+
+const DEFAULT_PM_OVERRIDE_REASON = 'PM override request reason for integration tests exceeding minimum length of 35 characters.';
+
+module.exports = { OVERRIDE_GAP_REQUEST_STATUS, OVERRIDE_REQUESTER_TYPE, DEFAULT_PM_OVERRIDE_REASON };

package/src/saas/internal-api/compliance/models/overrideGapRequest/override.gap.request.model.js

@@ -13,4 +13,19 @@ class OverrideGapRequestRejectModel {
 		this.recordDateModified = recordDateModified;
 	}
 }
-module.exports = { OverrideGapRequestCreateModel, OverrideGapRequestRejectModel };
+
+class PmOverrideRequestModel {
+	constructor({ auditorContractorId, requestReason, expiryType, expiryDate = null, assigneeUserIds, recordDateModified }) {
+		if (auditorContractorId !== undefined) {
+			this.auditorContractorId = auditorContractorId;
+		}
+
+		this.requestReason = requestReason;
+		this.expiryType = expiryType;
+		this.expiryDate = expiryDate;
+		this.assigneeUserIds = assigneeUserIds;
+		this.recordDateModified = recordDateModified;
+	}
+}
+
+module.exports = { OverrideGapRequestCreateModel, OverrideGapRequestRejectModel, PmOverrideRequestModel };

package/src/saas/internal-api/dbEmails/api/db.emails.service.js

@@ -167,9 +167,40 @@ const waitForMail = async (emailModel, { maxSecondToWait = 30 } = {}) => {
 	return foundMails;
 };
 
+const waitForMails = async (emailModels, { maxSecondToWait = 60 } = {}) => {
+	const oneSecondInMilliseconds = 1000;
+	const started = new Date();
+	let timeFromTheStart = 0;
+	const foundMailsByModel = emailModels.map(() => []);
+
+	while (foundMailsByModel.some(found => found.length === 0) && timeFromTheStart < maxSecondToWait) {
+		for (let index = 0; index < emailModels.length; index++) {
+			if (foundMailsByModel[index].length > 0) {
+				continue;
+			}
+
+			const { data } = await getAllMessages(emailModels[index]);
+
+			if (data.length > 0) {
+				foundMailsByModel[index] = data;
+			}
+		}
+
+		if (foundMailsByModel.every(found => found.length > 0)) {
+			break;
+		}
+
+		timeFromTheStart = (new Date() - started) / oneSecondInMilliseconds;
+		await timeUtils.waitFor(3).seconds;
+	}
+
+	return foundMailsByModel;
+};
+
 module.exports = {
 	util,
 	waitForMail,
+	waitForMails,
 	getAllMessages,
 	getLastMessage,
 	deleteMultipleMessages,

package/src/saas/internal-api/dbEmails/consts/consts.js

@@ -54,6 +54,9 @@ const EMAIL_SUBJECT = {
 	overrideGapRequestPending: ({ vendorCompanyName }) => `${vendorCompanyName} asked for an exception`,
 	overrideGapRequestRejected: ({ accountName }) => `${accountName} denied your exception request`,
 	overrideGapRequestApproved: ({ accountName }) => `${accountName} approved your exception request`,
+	pmOverrideRequestAssigned: ({ requesterFullName, companyName }) => `${requesterFullName} asked you to override a gap for ${companyName}`,
+	pmOverrideRequestDenied: ({ rejecterFullName, companyName }) => `${rejecterFullName} Rejected your override request for ${companyName}`,
+	pmOverrideRequestApproved: ({ approverFullName, companyName }) => `${approverFullName} Approved your override request for ${companyName}`,
 	timedOverrideExpired: ({ recordCompanyName, requesterName }) => `Override ended - ${recordCompanyName} in ${requesterName}`,
 	allRecordsExport: 'Jones - All Records Export'
 };

package/src/saas/internal-api/notificationCenter/consts.js

@@ -3,7 +3,10 @@ const NOTIFICATION_TYPES = {
 	OVERRIDE_GAP_REQUEST_PENDING: 'NewOverrideGapRequest',
 	RELATED_DOC_UPDATED: 'RelatedDocUpdated',
 	GLOBAL_RECORD_RELATED_DOC_UPDATED: 'GlobalRecordRelatedDocUpdated',
-	TIMED_OVERRIDE_EXPIRED: 'TimedOverrideExpired'
+	TIMED_OVERRIDE_EXPIRED: 'TimedOverrideExpired',
+	PM_OVERRIDE_REQUEST: 'NewPmOverrideRequest',
+	PM_OVERRIDE_REQUEST_APPROVED: 'PmOverrideRequestApproved',
+	PM_OVERRIDE_REQUEST_REJECTED: 'PmOverrideRequestRejected'
 };
 
 module.exports = { NOTIFICATION_TYPES };

package/src/saas/internal-api/outlook/api/outlook.api.js

@@ -5,8 +5,8 @@ const Endpoints = {
 	getRequestIdByRecordIdBase64: base64RecordId => `${backendUrl}/secured/outlook/record/${base64RecordId}/compliance-report`
 };
 
-const getRequestIdByRecordIdBase64 = async (base64RecordId, context) => {
-	return requests.getRequestHandler(Endpoints.getRequestIdByRecordIdBase64(base64RecordId), {}, context);
+const getRequestIdByRecordIdBase64 = async (base64RecordId, context, headers = {}) => {
+	return requests.getRequestHandler(Endpoints.getRequestIdByRecordIdBase64(base64RecordId), {}, context, headers);
 };
 
 module.exports = {

package/src/saas/internal-api/outlook/api/outlook.service.js

@@ -1,7 +1,7 @@
 const vendorProfileApi = require('./outlook.api');
 
-const getRequestIdByRecordIdBase64 = async (base64RecordId, context) => {
-	return vendorProfileApi.getRequestIdByRecordIdBase64(base64RecordId, context);
+const getRequestIdByRecordIdBase64 = async (base64RecordId, context, headers = {}) => {
+	return vendorProfileApi.getRequestIdByRecordIdBase64(base64RecordId, context, headers);
 };
 
 const generateRecordIdBase64 = recordId => {

package/src/saas/internal-api/projects/models/settings/update.project.settings.model.js

@@ -8,7 +8,9 @@ class UpdateProjectSettingsModel {
 			projectId = null,
 			tenantSolution = false,
 			autocompleteSettings = {},
-			overrideGapRequestSettings = {}
+			overrideGapRequestSettings = {},
+			userOverrideRequestSettings = {},
+			relevantComplianceDocumentsSettings = {}
 		} = {}
 	) {
 		this.autoGaps = { ... DEFAULT_AUTOGAPS, ... autoGaps };
@@ -19,6 +21,8 @@ class UpdateProjectSettingsModel {
 		this.tenantSolution = tenantSolution;
 		this.autocompleteSettings = { ... DEFAULT_AUTOCOMPLETE_ADD_VENDORS, ... autocompleteSettings };
 		this.overrideGapRequestSettings = { ... DEFAULT_OVERRIDE_GAP_REQUEST, ... overrideGapRequestSettings };
+		this.userOverrideRequestSettings = { ... DEFAULT_USER_OVERRIDE_REQUEST, ... userOverrideRequestSettings };
+		this.relevantComplianceDocumentsSettings = { ... DEFAULT_RELEVANT_COMPLIANCE_DOCUMENTS, ... relevantComplianceDocumentsSettings };
 	}
 }
 
@@ -46,3 +50,15 @@ const DEFAULT_OVERRIDE_GAP_REQUEST = {
 	isOverrideGapRequestEnabledForTenants: false,
 	isOverrideGapRequestEnabledForGuests: false
 };
+
+const DEFAULT_USER_OVERRIDE_REQUEST = {
+	isUserOverrideRequestEnabledForVendors: false,
+	isUserOverrideRequestEnabledForTenants: false,
+	isUserOverrideRequestEnabledForGuests: false
+};
+
+const DEFAULT_RELEVANT_COMPLIANCE_DOCUMENTS = {
+	isRelevantComplianceDocumentsEnabledForVendors: false,
+	isRelevantComplianceDocumentsEnabledForTenants: false,
+	isRelevantComplianceDocumentsEnabledForGuests: false
+};

package/src/saas/internal-api/schedulerJobRun/api/scheduler.job.run.api.js

@@ -0,0 +1,31 @@
+const requests = require('../../../../common/requests/cookieAuth/requests');
+const { backendUrl } = require('../../../../env').getEnv();
+
+const Endpoints = {
+	base: `${backendUrl}/saas/integration-tests/scheduler-job-run`,
+	byId: id => `${backendUrl}/saas/integration-tests/scheduler-job-run/${id}`,
+	reclaim: `${backendUrl}/saas/integration-tests/scheduler-job-run/reclaim`
+};
+
+const seedJobRun = (body, context) => {
+	return requests.postRequestHandler(Endpoints.base, body, context);
+};
+
+const reclaimStaleJobRuns = (jobType, context) => {
+	return requests.postRequestHandler(Endpoints.reclaim, null, context, {}, { jobType });
+};
+
+const getJobRun = (id, context) => {
+	return requests.getRequestHandler(Endpoints.byId(id), {}, context);
+};
+
+const deleteJobRunsByType = (jobType, context) => {
+	return requests.deleteRequestHandler(Endpoints.base, context, {}, { jobType });
+};
+
+module.exports = {
+	seedJobRun,
+	reclaimStaleJobRuns,
+	getJobRun,
+	deleteJobRunsByType
+};

package/src/saas/internal-api/schedulerJobRun/api/scheduler.job.run.service.js

@@ -0,0 +1,56 @@
+const httpResponseStatusCodes = require('../../../../common/httpResponseStatusCodes.json');
+
+const authService = require('../../auth/api/auth.service');
+const schedulerJobRunApi = require('./scheduler.job.run.api');
+
+const SUCCESS_STATUSES = [httpResponseStatusCodes.OK, httpResponseStatusCodes.NO_CONTENT];
+
+// Seeds a job_run with backdated timestamps (applied with the DB clock) to simulate an orphaned run.
+// heartbeatMinutesAgo: null seeds a NULL heartbeat. Returns the id.
+const seedJobRun = async ({ jobType, status, startedMinutesAgo, heartbeatMinutesAgo = null }) => {
+	const response = await schedulerJobRunApi.seedJobRun(
+		{ jobType, status, startedMinutesAgo, heartbeatMinutesAgo }, await authService.getIcsCookie());
+
+	if (response.status !== httpResponseStatusCodes.OK) {
+		throw new Error(`seedJobRun failed for ${jobType}: ${JSON.stringify(response.data)}`);
+	}
+
+	return response.data;
+};
+
+// Runs reclaim in isolation (no overlap check, no job submitted) so a test can assert it without starting a real job.
+const reclaimStaleJobRuns = async jobType => {
+	const response = await schedulerJobRunApi.reclaimStaleJobRuns(jobType, await authService.getIcsCookie());
+
+	if (response.status !== httpResponseStatusCodes.OK) {
+		throw new Error(`reclaimStaleJobRuns failed for ${jobType}: ${JSON.stringify(response.data)}`);
+	}
+
+	return response.data;
+};
+
+const getJobRun = async id => {
+	const response = await schedulerJobRunApi.getJobRun(id, await authService.getIcsCookie());
+
+	if (response.status !== httpResponseStatusCodes.OK) {
+		throw new Error(`getJobRun failed for id ${id}: ${JSON.stringify(response.data)}`);
+	}
+
+	return response.data;
+};
+
+// Clears all job_run rows of a type between runs. Safe outside production, where only seeded rows exist.
+const deleteJobRunsByType = async jobType => {
+	const response = await schedulerJobRunApi.deleteJobRunsByType(jobType, await authService.getIcsCookie());
+
+	if (!SUCCESS_STATUSES.includes(response.status)) {
+		throw new Error(`deleteJobRunsByType failed for ${jobType}: ${JSON.stringify(response.data)}`);
+	}
+};
+
+module.exports = {
+	seedJobRun,
+	reclaimStaleJobRuns,
+	getJobRun,
+	deleteJobRunsByType
+};

package/src/saas/internal-api/schedulerJobRun/index.js

@@ -0,0 +1,3 @@
+const services = require('./api/scheduler.job.run.service');
+
+module.exports = { services };

package/src/saas/internal-api/thread-scheduler/runner.js

@@ -58,11 +58,28 @@ module.exports = {
 	runJobForExpireTimedOverrides: function(entityIds) {
 		return runSchedulerJob({ jobType: schedulerJobs.EXPIRE_TIMED_OVERRIDES, entityIds });
 	},
+	runJobForCertificialEnrollment: function(entityIds) {
+		requireScope(entityIds, schedulerJobs.CERTIFICIAL_ENROLLMENT);
+		return runSchedulerJob({ jobType: schedulerJobs.CERTIFICIAL_ENROLLMENT, entityIds });
+	},
+	runJobForCertificialMonitoring: function(entityIds) {
+		requireScope(entityIds, schedulerJobs.CERTIFICIAL_MONITORING);
+		return runSchedulerJob({ jobType: schedulerJobs.CERTIFICIAL_MONITORING, entityIds });
+	},
 	runAllJobsNew: function(entityIds) {
 		return runSchedulerJob({ jobType: schedulerJobs.ALL, entityIds });
 	}
 };
 
+/* An unscoped enrollment run emails a real broker for every eligible record in the environment and
+cannot be undone; an unscoped monitoring run polls and notifies on every active enrollment. A
+since: token still counts as a scope. */
+function requireScope(entityIds, jobType) {
+	if (!entityIds || !entityIds.length) {
+		throw new Error(`${jobType} must be scoped with entityIds`);
+	}
+}
+
 function isOverloadError(errorCode) {
 	const overloadResponseErrors = [httpResponseStatusCodes.TOO_MANY_REQUESTS, httpResponseStatusCodes.CONFLICT];
 	return overloadResponseErrors.includes(errorCode);

package/src/saas/internal-api/thread-scheduler/schedulerJobs.js

@@ -4,5 +4,7 @@ module.exports = {
 	SCHEDULED_REPORTS: 'SCHEDULED_REPORTS',
 	RELATED_DOCS: 'RELATED_DOCS',
 	EXPIRE_TIMED_OVERRIDES: 'EXPIRE_TIMED_OVERRIDES',
+	CERTIFICIAL_ENROLLMENT: 'CERTIFICIAL_ENROLLMENT',
+	CERTIFICIAL_MONITORING: 'CERTIFICIAL_MONITORING',
 	ALL: 'ALL'
 };

package/src/saas/internal-api/uploadFiles/api/upload.file.service.js

@@ -128,14 +128,28 @@ const createPolicyFiles = async (requestId, policyFileList, context, { shouldExp
 	return createPolicyFilesResponse;
 };
 
-const uploadAndCreatePolicyFile = async (policyTypeList, policyFilePath, requestId, context, { markAsScanned } = {}) => {
+const uploadPolicyModels = (policyTypeList, policyFilePath, requestId, context) => {
+	return Promise.all(policyTypeList.map(policyType => uploadPolicyFileAndGetPolicyModel(requestId, policyFilePath, policyType, context)));
+};
+
+const uploadAndCreatePolicyFile = async (policyTypeList, policyFilePath, requestId, context, { markAsScanned, maxRetries = 3 } = {}) => {
 	validateArray(policyTypeList);
 
-	const uploadedPolicyModelsList = await Promise.all(policyTypeList.map(async fileType => {
-		return uploadPolicyFileAndGetPolicyModel(requestId, policyFilePath, fileType, context);
-	}));
+	const policyModels = await uploadPolicyModels(policyTypeList, policyFilePath, requestId, context);
+	const policyFilesResponse = await createPolicyFiles(requestId, policyModels, context);
+
+	for (let retry = 1; retry <= maxRetries; retry++) {
+		const missingPolicyTypes = policyTypeList.filter(policyType => !policyFilesResponse.data[policyType]);
 
-	const policyFilesResponse = await createPolicyFiles(requestId, uploadedPolicyModelsList, context);
+		if (!missingPolicyTypes.length) {
+			break;
+		}
+
+		console.warn(`Policy types ${missingPolicyTypes} were not created for request ${requestId}, retry`);
+		const missingPolicyModels = await uploadPolicyModels(missingPolicyTypes, policyFilePath, requestId, context);
+		const retryResponse = await createPolicyFiles(requestId, missingPolicyModels, context);
+		Object.assign(policyFilesResponse.data, retryResponse.data);
+	}
 
 	if (markAsScanned) {
 		const { data: request } = await requestsApi.getRequestById(requestId, context);