@i4e/invest4edu-access-core 0.36.0 → 0.37.0

package/README.md

@@ -112,6 +112,9 @@ Model.find(q).setOptions({ skipTenant: true });          // one query
   (`/user-entity-link`) — which hats may coexist on one person
 - `ROLE_TYPE_PRIORITY`, `CLIENT_APP_ROLE_NAMES`, `pickPortalRoleName` (`/portal-roles`) —
   which role names a portal session
+- `MOBILE_LOGIN_SOURCES`, `CLIENT_APP_LOGIN_SOURCES`, `PARTNER_APP_HATS`,
+  `APP_BUNDLE_ID_PATTERN`, `appBundleIdOf` (`/mobile-app-identity`) — which mobile app a login
+  came from, which hats it flags, and the bundle id its session keeps
 
 ## Not covered
 **Aggregation pipelines** — add an explicit `{ $match: { account_id } }` stage.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@i4e/invest4edu-access-core",
-  "version": "0.36.0",
-  "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
+  "version": "0.37.0",
+  "description": "Shared access-control primitives for NeoFindesk: tenant keystone, role capabilities, reportee tree, entity/role vocabulary, mobile app identity, feature flags, and the unified access engine (registry schema, snapshot resolver, visibleWhen).",
   "type": "module",
   "exports": {
     ".": "./src/index.js",
@@ -22,6 +22,7 @@
     "./route-features": "./src/route-features.js",
     "./route-screen": "./src/route-screen.js",
     "./report-audience": "./src/report-audience.js",
+    "./mobile-app-identity": "./src/mobile-app-identity.js",
     "./subscription-lifecycle": "./src/subscription-lifecycle.js",
     "./entitlement-store": "./src/entitlement-store.js",
     "./proration": "./src/proration.js",

package/src/index.js

@@ -35,6 +35,13 @@ export {
   ROLE_TYPE_PRIORITY,
   pickPortalRoleName,
 } from "./portal-roles.js";
+export {
+  MOBILE_LOGIN_SOURCES,
+  CLIENT_APP_LOGIN_SOURCES,
+  PARTNER_APP_HATS,
+  APP_BUNDLE_ID_PATTERN,
+  appBundleIdOf,
+} from "./mobile-app-identity.js";
 export {
   DEFAULT_ACCESS_FLAGS,
   ACCESS_FLAG_ENV_NAMES,

package/src/mobile-app-identity.js

@@ -0,0 +1,52 @@
+/**
+ * Which mobile app a login came from, and what it may record — @i4e/invest4edu-access-core.
+ *
+ * Two apps sign in to the same backends: the partner app (NeoFinDesk) and the client app
+ * (InvestValue AI). A person's hat names the app: a client hat is the client app, every other
+ * hat the partner app. Both backends read these to decide which hat a mobile login flags and
+ * what bundle id its session row keeps.
+ *
+ * ── Why this lives in the package rather than in each backend ─────────────────────────
+ * nfd-api-node declared these in src/api/common/mobileAppIdentity.js and nfd-api-node-v2 in
+ * services/user/user.js, held together by tests pinning each copy's literals (BRI-1263). The
+ * sets are fixed by the domain — the mobile platforms and the entity kinds — so they are
+ * constants, not reference data; but two copies of a constant are still two definitions.
+ */
+import { ENTITY } from './entity-status.js';
+
+/**
+ * Login / creation `source` values that mean "a mobile app" without naming which one. The
+ * partner app sends these, and so did the client app before it had its own values.
+ */
+export const MOBILE_LOGIN_SOURCES = new Set(['MOBILE_ANDROID', 'MOBILE_IOS', 'MOBILE_APP']);
+
+/** Sources only the client app (InvestValue AI) sends: they name the app, not just "mobile". */
+export const CLIENT_APP_LOGIN_SOURCES = new Set(['IV_CLIENT_APP_IOS', 'IV_CLIENT_APP_ANDROID']);
+
+/** Hats the partner app (NeoFinDesk) signs in as — every hat except the client one. */
+export const PARTNER_APP_HATS = Object.values(ENTITY).filter((t) => t !== ENTITY.CLIENT);
+
+/**
+ * A bundle id / package name: iOS reverse-DNS (letters, digits, `.`, `-`) and Android
+ * (letters, digits, `.`, `_`), at most 255 characters. Anything else — markup, a newline, a
+ * spreadsheet formula — is not an app identifier and is not stored.
+ */
+export const APP_BUNDLE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/;
+
+/**
+ * The calling app's bundle id for a session row, or null.
+ *
+ * A login whose source names a non-mobile channel (WEB, PARTNER_API, …) stores null whatever
+ * it sends. A login with NO source keeps it: the client app sends none on its OTP, MPIN and
+ * biometric logins, and those are exactly the logins the bundle id is for. Checked for shape
+ * only, not against an allowlist — a stale app build must still be able to log in.
+ *
+ * @param {object} body  the login request body; reads `source` (or `creation_source`) and `appBundleId`
+ * @returns {string|null}
+ */
+export function appBundleIdOf(body) {
+  const source = String(body?.source || body?.creation_source || '').trim().toUpperCase();
+  if (source && !MOBILE_LOGIN_SOURCES.has(source) && !CLIENT_APP_LOGIN_SOURCES.has(source)) return null;
+  const value = typeof body?.appBundleId === 'string' ? body.appBundleId.trim() : '';
+  return APP_BUNDLE_ID_PATTERN.test(value) ? value : null;
+}