@i4e/invest4edu-access-core 0.35.0 → 0.37.0

package/README.md

@@ -112,6 +112,9 @@ Model.find(q).setOptions({ skipTenant: true });          // one query
   (`/user-entity-link`) — which hats may coexist on one person
 - `ROLE_TYPE_PRIORITY`, `CLIENT_APP_ROLE_NAMES`, `pickPortalRoleName` (`/portal-roles`) —
   which role names a portal session
+- `MOBILE_LOGIN_SOURCES`, `CLIENT_APP_LOGIN_SOURCES`, `PARTNER_APP_HATS`,
+  `APP_BUNDLE_ID_PATTERN`, `appBundleIdOf` (`/mobile-app-identity`) — which mobile app a login
+  came from, which hats it flags, and the bundle id its session keeps
 
 ## Not covered
 **Aggregation pipelines** — add an explicit `{ $match: { account_id } }` stage.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.35.0",
-  "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
+  "version": "0.37.0",
+  "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, mobile app identity, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {
     ".": "./src/index.js",
@@ -22,6 +22,7 @@
     "./route-features": "./src/route-features.js",
     "./route-screen": "./src/route-screen.js",
     "./report-audience": "./src/report-audience.js",
+    "./mobile-app-identity": "./src/mobile-app-identity.js",
     "./subscription-lifecycle": "./src/subscription-lifecycle.js",
     "./entitlement-store": "./src/entitlement-store.js",
     "./proration": "./src/proration.js",

package/src/index.js

@@ -35,6 +35,13 @@ export {
   ROLE_TYPE_PRIORITY,
   pickPortalRoleName,
 } from "./portal-roles.js";
+export {
+  MOBILE_LOGIN_SOURCES,
+  CLIENT_APP_LOGIN_SOURCES,
+  PARTNER_APP_HATS,
+  APP_BUNDLE_ID_PATTERN,
+  appBundleIdOf,
+} from "./mobile-app-identity.js";
 export {
   DEFAULT_ACCESS_FLAGS,
   ACCESS_FLAG_ENV_NAMES,

package/src/mobile-app-identity.js

@@ -0,0 +1,52 @@
+/**
+ * Which mobile app a login came from, and what it may record — @i4e/invest4edu-access-core.
+ *
+ * Two apps sign in to the same backends: the partner app (NeoFinDesk) and the client app
+ * (InvestValue AI). A person's hat names the app: a client hat is the client app, every other
+ * hat the partner app. Both backends read these to decide which hat a mobile login flags and
+ * what bundle id its session row keeps.
+ *
+ * ── Why this lives in the package rather than in each backend ─────────────────────────
+ * nfd-api-node declared these in src/api/common/mobileAppIdentity.js and nfd-api-node-v2 in
+ * services/user/user.js, held together by tests pinning each copy's literals (BRI-1263). The
+ * sets are fixed by the domain — the mobile platforms and the entity kinds — so they are
+ * constants, not reference data; but two copies of a constant are still two definitions.
+ */
+import { ENTITY } from './entity-status.js';
+
+/**
+ * Login / creation `source` values that mean "a mobile app" without naming which one. The
+ * partner app sends these, and so did the client app before it had its own values.
+ */
+export const MOBILE_LOGIN_SOURCES = new Set(['MOBILE_ANDROID', 'MOBILE_IOS', 'MOBILE_APP']);
+
+/** Sources only the client app (InvestValue AI) sends: they name the app, not just "mobile". */
+export const CLIENT_APP_LOGIN_SOURCES = new Set(['IV_CLIENT_APP_IOS', 'IV_CLIENT_APP_ANDROID']);
+
+/** Hats the partner app (NeoFinDesk) signs in as — every hat except the client one. */
+export const PARTNER_APP_HATS = Object.values(ENTITY).filter((t) => t !== ENTITY.CLIENT);
+
+/**
+ * A bundle id / package name: iOS reverse-DNS (letters, digits, `.`, `-`) and Android
+ * (letters, digits, `.`, `_`), at most 255 characters. Anything else — markup, a newline, a
+ * spreadsheet formula — is not an app identifier and is not stored.
+ */
+export const APP_BUNDLE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/;
+
+/**
+ * The calling app's bundle id for a session row, or null.
+ *
+ * A login whose source names a non-mobile channel (WEB, PARTNER_API, …) stores null whatever
+ * it sends. A login with NO source keeps it: the client app sends none on its OTP, MPIN and
+ * biometric logins, and those are exactly the logins the bundle id is for. Checked for shape
+ * only, not against an allowlist — a stale app build must still be able to log in.
+ *
+ * @param {object} body  the login request body; reads `source` (or `creation_source`) and `appBundleId`
+ * @returns {string|null}
+ */
+export function appBundleIdOf(body) {
+  const source = String(body?.source || body?.creation_source || '').trim().toUpperCase();
+  if (source && !MOBILE_LOGIN_SOURCES.has(source) && !CLIENT_APP_LOGIN_SOURCES.has(source)) return null;
+  const value = typeof body?.appBundleId === 'string' ? body.appBundleId.trim() : '';
+  return APP_BUNDLE_ID_PATTERN.test(value) ? value : null;
+}

package/src/report-audience.js

@@ -58,6 +58,17 @@ export const AUDIENCE = Object.freeze({
  */
 export const SECTION_KEYS = Object.freeze([
   "actions", // the 3-step action plan / recommendations
+  /*
+   * The per-holding VERDICT — a fund's Buy/Hold/Watch/Exit chip and a stock's signal.
+   *
+   * Separate from `actions` because they are withheld for the same reason but live in different
+   * places: `actions` is one panel, this is a chip on every fund row and every stock row across
+   * several tabs. A client who cannot see the action plan but can see "EXIT" against a fund has
+   * been given the recommendation anyway, just without the reasoning.
+   *
+   * Covers BOTH vocabularies — funds carry `action`, stocks carry `signal`.
+   */
+  "fundActions",
   "phc", // portfolio health-check detail body
   "chat", // AI chat
   "performance", // performance / gains
@@ -70,6 +81,7 @@ export const SECTION_KEYS = Object.freeze([
 /** Everything on. The answer whenever we cannot prove a narrower one is correct. */
 export const ALL_VISIBLE = Object.freeze({
   actions: true,
+  fundActions: true,
   phc: true,
   chat: true,
   performance: true,
@@ -81,17 +93,36 @@ export const ALL_VISIBLE = Object.freeze({
   tone: "adviser",
 });
 
-/** The reduced view. Partner and RM-E1 clients get exactly this; direct adds the CTA. */
+/**
+ * The reduced view — REVISED 21 Sep 2026.
+ *
+ * It used to withhold almost the whole report. It now withholds exactly the RECOMMENDATION and
+ * nothing else, because the reason for withholding was never "this client should see less": it is
+ * that an employee services them and that conversation belongs to the RM. Everything the client
+ * can read for themselves — the health detail, performance, fund analysis, the score breakdown,
+ * per-fund detail — tells them where they stand without telling them what to do.
+ *
+ * Two keys carry it, and both are needed: the action plan is one panel, but the per-holding
+ * verdict is a chip on every fund and stock row. Withholding the panel alone would hand over the
+ * recommendation anyway, minus the reasoning.
+ *
+ * `chat` stays locked for the same reason, and it is the subtle one: a client can simply ASK the
+ * chat whether to sell a fund. Leaving it open would route around both keys above.
+ *
+ * `tone: b2c` stays: the narrative still speaks to a client rather than an adviser, and it must
+ * keep describing rather than prescribing now that it is the main thing they read.
+ */
 const REDUCED = Object.freeze({
   actions: false,
-  phc: false,
+  fundActions: false,
   chat: false,
-  performance: false,
-  keyInsights: false,
-  fundAnalysis: false,
-  scoreBreakdownFunds: false,
+  phc: true,
+  performance: true,
+  keyInsights: true,
+  fundAnalysis: true,
+  scoreBreakdownFunds: true,
   advisorCta: false,
-  fundDetail: "minimal",
+  fundDetail: "full",
   tone: "b2c",
 });