@platform-modules/civil-aviation-authority 2.3.300 → 2.3.302

package/dist/auth/user-session-validation.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Server-side JWT session binding (CAA VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+export type UserSessionReader = {
+    isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
+    /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
+    isSessionActive?(userId: number): Promise<unknown>;
+};
+/** When true (default), JWT must include sessionId and that session must be active. */
+export declare function isRequireJwtSessionId(): boolean;
+export declare function resolveJwtSessionId(sessionId: unknown): number | null;
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+export declare function validateUserSessionBinding(userId: number, sessionId: number | null | undefined, reader: UserSessionReader): Promise<boolean>;
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+export declare function activeUserSessionSql(alias?: string): {
+    clause: string;
+    params: Record<string, unknown>;
+};

package/dist/auth/user-session-validation.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Server-side JWT session binding (CAA VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRequireJwtSessionId = isRequireJwtSessionId;
+exports.resolveJwtSessionId = resolveJwtSessionId;
+exports.validateUserSessionBinding = validateUserSessionBinding;
+exports.activeUserSessionSql = activeUserSessionSql;
+/** When true (default), JWT must include sessionId and that session must be active. */
+function isRequireJwtSessionId() {
+    const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
+    return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+function resolveJwtSessionId(sessionId) {
+    if (sessionId == null || sessionId === '')
+        return null;
+    const sid = Number(sessionId);
+    if (!Number.isFinite(sid) || sid <= 0)
+        return null;
+    return sid;
+}
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+async function validateUserSessionBinding(userId, sessionId, reader) {
+    if (!Number.isFinite(userId) || userId <= 0)
+        return false;
+    const sid = resolveJwtSessionId(sessionId);
+    if (sid != null) {
+        return reader.isSessionActiveById(sid, userId);
+    }
+    if (isRequireJwtSessionId()) {
+        return false;
+    }
+    if (!reader.isSessionActive)
+        return false;
+    const legacy = await reader.isSessionActive(userId);
+    return !!legacy;
+}
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+function activeUserSessionSql(alias = 'user_sessions') {
+    return {
+        clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+        params: {
+            is_active: true,
+            is_deleted: false,
+            session_now: new Date(),
+        },
+    };
+}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from './models/user';
 export * from './models/role';
 export * from './models/user-sessions';
+export * from './auth/user-session-validation';
 export * from './models/ITHelpDeskModel';
 export * from './models/ServiceTypeModel';
 export * from './models/CAAServices';

package/dist/index.js

@@ -20,6 +20,7 @@ exports.RespondToEnquiriesRequestAttachment = exports.RespondToEnquiriesWorkFlow
 __exportStar(require("./models/user"), exports);
 __exportStar(require("./models/role"), exports);
 __exportStar(require("./models/user-sessions"), exports);
+__exportStar(require("./auth/user-session-validation"), exports);
 __exportStar(require("./models/ITHelpDeskModel"), exports);
 // export * from './models/ITServicesTypesSalalahModel'; // REMOVED - table no longer used
 // export * from './models/ITServicesTypesMuscatModel'; // REMOVED - table no longer used

package/dist/models/ResidentialUnitRentalRequestModel.d.ts

@@ -23,6 +23,7 @@ export declare class ResidentialUnitRentalRequest extends BaseModel {
     family_size: number;
     phone_number: string;
     location_of_unit: string;
+    number_of_apartments: string | null;
     comment: string;
     status: string;
     user_id: number;

package/dist/models/ResidentialUnitRentalRequestModel.js

@@ -69,6 +69,10 @@ __decorate([
     (0, typeorm_1.Column)({ type: 'varchar', length: 255, nullable: true }),
     __metadata("design:type", String)
 ], ResidentialUnitRentalRequest.prototype, "location_of_unit", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', length: 255, nullable: true }),
+    __metadata("design:type", Object)
+], ResidentialUnitRentalRequest.prototype, "number_of_apartments", void 0);
 __decorate([
     (0, typeorm_1.Column)({ type: 'text', nullable: true }),
     __metadata("design:type", String)

package/dist/models/StudyLeaveWorkflowModel.d.ts

@@ -15,7 +15,9 @@ export declare class StudyLeaveWorkFlow extends BaseModel {
     approver_role_id: number | null;
     approver_user_id: number | null;
     approved_by: number | null;
+    department_id: number | null;
+    section_id: number | null;
     status: StudyLeaveWorkFlowStatus;
     status_ar: string | null;
-    constructor(request_id: number, content: string, status: StudyLeaveWorkFlowStatus, service_id?: number | null, sub_service_id?: number | null, order?: number, approver_role_id?: number | null, approver_user_id?: number | null, approved_by?: number | null);
+    constructor(request_id: number, content: string, status: StudyLeaveWorkFlowStatus, service_id?: number | null, sub_service_id?: number | null, order?: number, approver_role_id?: number | null, approver_user_id?: number | null, approved_by?: number | null, department_id?: number | null, section_id?: number | null);
 }

package/dist/models/StudyLeaveWorkflowModel.js

@@ -20,7 +20,7 @@ var StudyLeaveWorkFlowStatus;
     StudyLeaveWorkFlowStatus["REJECTED"] = "Rejected";
 })(StudyLeaveWorkFlowStatus || (exports.StudyLeaveWorkFlowStatus = StudyLeaveWorkFlowStatus = {}));
 let StudyLeaveWorkFlow = class StudyLeaveWorkFlow extends BaseModel_1.BaseModel {
-    constructor(request_id, content, status, service_id, sub_service_id, order, approver_role_id, approver_user_id, approved_by) {
+    constructor(request_id, content, status, service_id, sub_service_id, order, approver_role_id, approver_user_id, approved_by, department_id, section_id) {
         super();
         this.request_id = request_id;
         this.service_id = service_id || null;
@@ -31,6 +31,8 @@ let StudyLeaveWorkFlow = class StudyLeaveWorkFlow extends BaseModel_1.BaseModel
         this.approver_role_id = approver_role_id || null;
         this.approver_user_id = approver_user_id || null;
         this.approved_by = approved_by || null;
+        this.department_id = department_id || null;
+        this.section_id = section_id || null;
     }
 };
 exports.StudyLeaveWorkFlow = StudyLeaveWorkFlow;
@@ -70,6 +72,14 @@ __decorate([
     (0, typeorm_1.Column)({ type: "integer", nullable: true }),
     __metadata("design:type", Object)
 ], StudyLeaveWorkFlow.prototype, "approved_by", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "integer", nullable: true }),
+    __metadata("design:type", Object)
+], StudyLeaveWorkFlow.prototype, "department_id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "integer", nullable: true }),
+    __metadata("design:type", Object)
+], StudyLeaveWorkFlow.prototype, "section_id", void 0);
 __decorate([
     (0, typeorm_1.Column)({
         type: "enum",
@@ -85,5 +95,5 @@ __decorate([
 ], StudyLeaveWorkFlow.prototype, "status_ar", void 0);
 exports.StudyLeaveWorkFlow = StudyLeaveWorkFlow = __decorate([
     (0, typeorm_1.Entity)({ name: "study_leave_workflows" }),
-    __metadata("design:paramtypes", [Number, String, String, Object, Object, Number, Object, Object, Object])
+    __metadata("design:paramtypes", [Number, String, String, Object, Object, Number, Object, Object, Object, Object, Object])
 ], StudyLeaveWorkFlow);

package/dist/models/TrainingWorkflowModel.d.ts

@@ -15,7 +15,9 @@ export declare class TrainingWorkFlow extends BaseModel {
     approver_role_id: number | null;
     approver_user_id: number | null;
     approved_by: number | null;
+    department_id: number | null;
+    section_id: number | null;
     status: TrainingWorkFlowStatus;
     status_ar: string | null;
-    constructor(request_id: number, content: string, status: TrainingWorkFlowStatus, service_id?: number | null, sub_service_id?: number | null, order?: number, approver_role_id?: number | null, approver_user_id?: number | null, approved_by?: number | null);
+    constructor(request_id: number, content: string, status: TrainingWorkFlowStatus, service_id?: number | null, sub_service_id?: number | null, order?: number, approver_role_id?: number | null, approver_user_id?: number | null, approved_by?: number | null, department_id?: number | null, section_id?: number | null);
 }

package/dist/models/TrainingWorkflowModel.js

@@ -20,7 +20,7 @@ var TrainingWorkFlowStatus;
     TrainingWorkFlowStatus["REJECTED"] = "Rejected";
 })(TrainingWorkFlowStatus || (exports.TrainingWorkFlowStatus = TrainingWorkFlowStatus = {}));
 let TrainingWorkFlow = class TrainingWorkFlow extends BaseModel_1.BaseModel {
-    constructor(request_id, content, status, service_id, sub_service_id, order, approver_role_id, approver_user_id, approved_by) {
+    constructor(request_id, content, status, service_id, sub_service_id, order, approver_role_id, approver_user_id, approved_by, department_id, section_id) {
         super();
         this.request_id = request_id;
         this.service_id = service_id || null;
@@ -31,6 +31,8 @@ let TrainingWorkFlow = class TrainingWorkFlow extends BaseModel_1.BaseModel {
         this.approver_role_id = approver_role_id || null;
         this.approver_user_id = approver_user_id || null;
         this.approved_by = approved_by || null;
+        this.department_id = department_id || null;
+        this.section_id = section_id || null;
     }
 };
 exports.TrainingWorkFlow = TrainingWorkFlow;
@@ -70,6 +72,14 @@ __decorate([
     (0, typeorm_1.Column)({ type: "integer", nullable: true }),
     __metadata("design:type", Object)
 ], TrainingWorkFlow.prototype, "approved_by", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "integer", nullable: true }),
+    __metadata("design:type", Object)
+], TrainingWorkFlow.prototype, "department_id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "integer", nullable: true }),
+    __metadata("design:type", Object)
+], TrainingWorkFlow.prototype, "section_id", void 0);
 __decorate([
     (0, typeorm_1.Column)({
         type: "enum",
@@ -85,5 +95,5 @@ __decorate([
 ], TrainingWorkFlow.prototype, "status_ar", void 0);
 exports.TrainingWorkFlow = TrainingWorkFlow = __decorate([
     (0, typeorm_1.Entity)({ name: "training_workflows" }),
-    __metadata("design:paramtypes", [Number, String, String, Object, Object, Number, Object, Object, Object])
+    __metadata("design:paramtypes", [Number, String, String, Object, Object, Number, Object, Object, Object, Object, Object])
 ], TrainingWorkFlow);

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "@platform-modules/civil-aviation-authority",
-  "version": "2.3.300",
+  "version": "2.3.302",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
   "scripts": {

package/sql/caa_api_payload_changes_2026_07.sql

@@ -9,6 +9,9 @@ ALTER TYPE asset_maintenance_category_en ADD VALUE IF NOT EXISTS 'Other';
 ALTER TABLE residential_unit_rental_requests
   ALTER COLUMN preferred_start_date DROP NOT NULL;
 
+ALTER TABLE residential_unit_rental_requests
+  ADD COLUMN IF NOT EXISTS number_of_apartments VARCHAR(255);
+
 -- 3. Appeal against administrative decision: optional / removed payload fields
 ALTER TABLE appeal_against_administrative_decision_requests
   ALTER COLUMN description DROP NOT NULL,

package/src/auth/user-session-validation.ts

@@ -0,0 +1,63 @@
+/**
+ * Server-side JWT session binding (CAA VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+
+export type UserSessionReader = {
+  isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
+  /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
+  isSessionActive?(userId: number): Promise<unknown>;
+};
+
+/** When true (default), JWT must include sessionId and that session must be active. */
+export function isRequireJwtSessionId(): boolean {
+  const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
+  return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+
+export function resolveJwtSessionId(sessionId: unknown): number | null {
+  if (sessionId == null || sessionId === '') return null;
+  const sid = Number(sessionId);
+  if (!Number.isFinite(sid) || sid <= 0) return null;
+  return sid;
+}
+
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+export async function validateUserSessionBinding(
+  userId: number,
+  sessionId: number | null | undefined,
+  reader: UserSessionReader,
+): Promise<boolean> {
+  if (!Number.isFinite(userId) || userId <= 0) return false;
+
+  const sid = resolveJwtSessionId(sessionId);
+  if (sid != null) {
+    return reader.isSessionActiveById(sid, userId);
+  }
+
+  if (isRequireJwtSessionId()) {
+    return false;
+  }
+
+  if (!reader.isSessionActive) return false;
+  const legacy = await reader.isSessionActive(userId);
+  return !!legacy;
+}
+
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+export function activeUserSessionSql(alias = 'user_sessions'): {
+  clause: string;
+  params: Record<string, unknown>;
+} {
+  return {
+    clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+    params: {
+      is_active: true,
+      is_deleted: false,
+      session_now: new Date(),
+    },
+  };
+}

package/src/index.ts

@@ -3,6 +3,7 @@ import { JobTransferRequestStatus } from './models/JobTransferRequestModel';
 export * from './models/user';
 export * from './models/role';
 export * from './models/user-sessions';
+export * from './auth/user-session-validation';
 export * from './models/ITHelpDeskModel';
 // export * from './models/ITServicesTypesSalalahModel'; // REMOVED - table no longer used
 // export * from './models/ITServicesTypesMuscatModel'; // REMOVED - table no longer used

package/src/models/ResidentialUnitRentalRequestModel.ts

@@ -113,8 +113,8 @@ export class ResidentialUnitRentalRequest extends BaseModel {
 
     location_of_unit: string; 
 
- 
- 
+    @Column({ type: 'varchar', length: 255, nullable: true })
+    number_of_apartments: string | null;
 
     @Column({ type: 'text', nullable: true }) 
 

package/src/models/StudyLeaveWorkflowModel.ts

@@ -37,6 +37,12 @@ export class StudyLeaveWorkFlow extends BaseModel {
     @Column({ type: "integer", nullable: true })
     approved_by: number | null;
 
+    @Column({ type: "integer", nullable: true })
+    department_id: number | null;
+
+    @Column({ type: "integer", nullable: true })
+    section_id: number | null;
+
     @Column({
         type: "enum",
         enum: StudyLeaveWorkFlowStatus,
@@ -57,7 +63,9 @@ export class StudyLeaveWorkFlow extends BaseModel {
         order?: number,
         approver_role_id?: number | null,
         approver_user_id?: number | null,
-        approved_by?: number | null
+        approved_by?: number | null,
+        department_id?: number | null,
+        section_id?: number | null
     ) {
         super();
         this.request_id = request_id;
@@ -69,6 +77,8 @@ export class StudyLeaveWorkFlow extends BaseModel {
         this.approver_role_id = approver_role_id || null;
         this.approver_user_id = approver_user_id || null;
         this.approved_by = approved_by || null;
+        this.department_id = department_id || null;
+        this.section_id = section_id || null;
     }
 }
 

package/src/models/TrainingWorkflowModel.ts

@@ -37,6 +37,12 @@ export class TrainingWorkFlow extends BaseModel {
     @Column({ type: "integer", nullable: true })
     approved_by: number | null;
 
+    @Column({ type: "integer", nullable: true })
+    department_id: number | null;
+
+    @Column({ type: "integer", nullable: true })
+    section_id: number | null;
+
     @Column({
         type: "enum",
         enum: TrainingWorkFlowStatus,
@@ -57,7 +63,9 @@ export class TrainingWorkFlow extends BaseModel {
         order?: number,
         approver_role_id?: number | null,
         approver_user_id?: number | null,
-        approved_by?: number | null
+        approved_by?: number | null,
+        department_id?: number | null,
+        section_id?: number | null
     ) {
         super();
         this.request_id = request_id;
@@ -69,6 +77,8 @@ export class TrainingWorkFlow extends BaseModel {
         this.approver_role_id = approver_role_id || null;
         this.approver_user_id = approver_user_id || null;
         this.approved_by = approved_by || null;
+        this.department_id = department_id || null;
+        this.section_id = section_id || null;
     }
 }