@platform-modules/civil-aviation-authority 2.3.301 → 2.3.303

package/dist/auth/authenticate-jwt-session.d.ts

@@ -0,0 +1,19 @@
+import type { UserSessionReader } from './user-session-validation';
+export type JwtAuthFailure = {
+    ok: false;
+    statusCode: 401;
+    message: string;
+};
+export type JwtAuthSuccess = {
+    ok: true;
+    claims: Record<string, unknown>;
+    userId: number;
+    sessionId: number | null;
+};
+export type JwtAuthResult = JwtAuthSuccess | JwtAuthFailure;
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+export declare function authorizeVerifiedJwtSession(verified: Record<string, unknown>, sessionReader: UserSessionReader, options?: {
+    requireActiveSession?: boolean;
+}): Promise<JwtAuthResult>;

package/dist/auth/authenticate-jwt-session.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeVerifiedJwtSession = authorizeVerifiedJwtSession;
+const jwt_token_helper_1 = require("./jwt-token.helper");
+const user_session_validation_1 = require("./user-session-validation");
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+async function authorizeVerifiedJwtSession(verified, sessionReader, options) {
+    const parsed = (0, jwt_token_helper_1.parseVerifiedJwtClaims)(verified);
+    if (!parsed) {
+        return { ok: false, statusCode: 401, message: 'Invalid Token' };
+    }
+    const requireActiveSession = options?.requireActiveSession !== false;
+    if (requireActiveSession) {
+        const sessionValid = await (0, user_session_validation_1.validateUserSessionBinding)(parsed.userId, parsed.sessionId, sessionReader);
+        if (!sessionValid) {
+            return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+        }
+    }
+    return {
+        ok: true,
+        claims: parsed.raw,
+        userId: parsed.userId,
+        sessionId: parsed.sessionId,
+    };
+}

package/dist/auth/jwt-token.helper.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Extract CAA API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+export declare function extractJwtToken(headers: Record<string, string | string[] | undefined> | undefined): string | null;
+export type JwtTokenRequest = {
+    headers: Record<string, string | string[] | undefined>;
+    body?: unknown;
+};
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+export declare function extractJwtTokenFromRequest(request: JwtTokenRequest): string | null;
+export type VerifiedJwtClaims = {
+    userId: number;
+    sessionId: number | null;
+    raw: Record<string, unknown>;
+};
+/** Parse verified JWT payload into userId + sessionId. */
+export declare function parseVerifiedJwtClaims(verified: Record<string, unknown>): VerifiedJwtClaims | null;

package/dist/auth/jwt-token.helper.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractJwtToken = extractJwtToken;
+exports.extractJwtTokenFromRequest = extractJwtTokenFromRequest;
+exports.parseVerifiedJwtClaims = parseVerifiedJwtClaims;
+/**
+ * Extract CAA API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+function extractJwtToken(headers) {
+    if (!headers)
+        return null;
+    const pick = (value) => {
+        const raw = Array.isArray(value) ? value[0] : value;
+        const trimmed = raw?.trim();
+        return trimmed ? trimmed : null;
+    };
+    const fromJwtHeader = pick(headers.jwt ?? headers.JWT);
+    if (fromJwtHeader)
+        return fromJwtHeader;
+    const authorization = pick(headers.authorization ?? headers.Authorization);
+    if (!authorization)
+        return null;
+    const bearerMatch = /^Bearer\s+(.+)$/i.exec(authorization);
+    if (bearerMatch?.[1]?.trim())
+        return bearerMatch[1].trim();
+    return authorization;
+}
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+function extractJwtTokenFromRequest(request) {
+    const fromHeaders = extractJwtToken(request.headers);
+    if (fromHeaders)
+        return fromHeaders;
+    const body = request.body;
+    if (!body || typeof body !== 'object')
+        return null;
+    for (const key of ['token', 'jwt', 'access_token']) {
+        const value = body[key];
+        if (typeof value === 'string' && value.trim())
+            return value.trim();
+    }
+    return null;
+}
+/** Parse verified JWT payload into userId + sessionId. */
+function parseVerifiedJwtClaims(verified) {
+    const userId = Number(verified.userId);
+    if (!Number.isFinite(userId) || userId <= 0)
+        return null;
+    const sessionIdRaw = verified.sessionId;
+    const parsedSessionId = sessionIdRaw == null || sessionIdRaw === '' ? null : Number(sessionIdRaw);
+    return {
+        userId,
+        sessionId: parsedSessionId != null && Number.isFinite(parsedSessionId) && parsedSessionId > 0
+            ? parsedSessionId
+            : null,
+        raw: verified,
+    };
+}

package/dist/auth/user-session-validation.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Server-side JWT session binding (CAA VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+export type UserSessionReader = {
+    isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
+    /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
+    isSessionActive?(userId: number): Promise<unknown>;
+};
+/** When true (default), JWT must include sessionId and that session must be active. */
+export declare function isRequireJwtSessionId(): boolean;
+export declare function resolveJwtSessionId(sessionId: unknown): number | null;
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+export declare function validateUserSessionBinding(userId: number, sessionId: number | null | undefined, reader: UserSessionReader): Promise<boolean>;
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+export declare function applyActiveUserSessionFilters(qb: {
+    andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+}, alias?: string): void;
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
+export declare function activeUserSessionSql(alias?: string): {
+    clause: string;
+    params: Record<string, unknown>;
+};

package/dist/auth/user-session-validation.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Server-side JWT session binding (CAA VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRequireJwtSessionId = isRequireJwtSessionId;
+exports.resolveJwtSessionId = resolveJwtSessionId;
+exports.validateUserSessionBinding = validateUserSessionBinding;
+exports.applyActiveUserSessionFilters = applyActiveUserSessionFilters;
+exports.activeUserSessionSql = activeUserSessionSql;
+/** When true (default), JWT must include sessionId and that session must be active. */
+function isRequireJwtSessionId() {
+    const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
+    return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+function resolveJwtSessionId(sessionId) {
+    if (sessionId == null || sessionId === '')
+        return null;
+    const sid = Number(sessionId);
+    if (!Number.isFinite(sid) || sid <= 0)
+        return null;
+    return sid;
+}
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+async function validateUserSessionBinding(userId, sessionId, reader) {
+    if (!Number.isFinite(userId) || userId <= 0)
+        return false;
+    const sid = resolveJwtSessionId(sessionId);
+    if (sid != null) {
+        return reader.isSessionActiveById(sid, userId);
+    }
+    if (isRequireJwtSessionId()) {
+        return false;
+    }
+    if (!reader.isSessionActive)
+        return false;
+    const legacy = await reader.isSessionActive(userId);
+    return !!legacy;
+}
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+function applyActiveUserSessionFilters(qb, alias = 'user_sessions') {
+    qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
+    qb.andWhere(`${alias}.is_deleted = :is_deleted`, { is_deleted: false });
+    qb.andWhere(`(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`, { session_now: new Date() });
+}
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
+function activeUserSessionSql(alias = 'user_sessions') {
+    return {
+        clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+        params: {
+            is_active: true,
+            is_deleted: false,
+            session_now: new Date(),
+        },
+    };
+}

package/dist/index.d.ts

@@ -1,6 +1,9 @@
 export * from './models/user';
 export * from './models/role';
 export * from './models/user-sessions';
+export * from './auth/user-session-validation';
+export * from './auth/jwt-token.helper';
+export * from './auth/authenticate-jwt-session';
 export * from './models/ITHelpDeskModel';
 export * from './models/ServiceTypeModel';
 export * from './models/CAAServices';

package/dist/index.js

@@ -20,6 +20,9 @@ exports.RespondToEnquiriesRequestAttachment = exports.RespondToEnquiriesWorkFlow
 __exportStar(require("./models/user"), exports);
 __exportStar(require("./models/role"), exports);
 __exportStar(require("./models/user-sessions"), exports);
+__exportStar(require("./auth/user-session-validation"), exports);
+__exportStar(require("./auth/jwt-token.helper"), exports);
+__exportStar(require("./auth/authenticate-jwt-session"), exports);
 __exportStar(require("./models/ITHelpDeskModel"), exports);
 // export * from './models/ITServicesTypesSalalahModel'; // REMOVED - table no longer used
 // export * from './models/ITServicesTypesMuscatModel'; // REMOVED - table no longer used

package/dist/models/ResidentialUnitRentalRequestModel.d.ts

@@ -23,6 +23,7 @@ export declare class ResidentialUnitRentalRequest extends BaseModel {
     family_size: number;
     phone_number: string;
     location_of_unit: string;
+    number_of_apartments: string | null;
     comment: string;
     status: string;
     user_id: number;

package/dist/models/ResidentialUnitRentalRequestModel.js

@@ -69,6 +69,10 @@ __decorate([
     (0, typeorm_1.Column)({ type: 'varchar', length: 255, nullable: true }),
     __metadata("design:type", String)
 ], ResidentialUnitRentalRequest.prototype, "location_of_unit", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', length: 255, nullable: true }),
+    __metadata("design:type", Object)
+], ResidentialUnitRentalRequest.prototype, "number_of_apartments", void 0);
 __decorate([
     (0, typeorm_1.Column)({ type: 'text', nullable: true }),
     __metadata("design:type", String)

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "@platform-modules/civil-aviation-authority",
-  "version": "2.3.301",
+  "version": "2.3.303",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
   "scripts": {

package/sql/caa_api_payload_changes_2026_07.sql

@@ -9,6 +9,9 @@ ALTER TYPE asset_maintenance_category_en ADD VALUE IF NOT EXISTS 'Other';
 ALTER TABLE residential_unit_rental_requests
   ALTER COLUMN preferred_start_date DROP NOT NULL;
 
+ALTER TABLE residential_unit_rental_requests
+  ADD COLUMN IF NOT EXISTS number_of_apartments VARCHAR(255);
+
 -- 3. Appeal against administrative decision: optional / removed payload fields
 ALTER TABLE appeal_against_administrative_decision_requests
   ALTER COLUMN description DROP NOT NULL,

package/src/auth/authenticate-jwt-session.ts

@@ -0,0 +1,51 @@
+import { parseVerifiedJwtClaims } from './jwt-token.helper';
+import { validateUserSessionBinding } from './user-session-validation';
+import type { UserSessionReader } from './user-session-validation';
+
+export type JwtAuthFailure = {
+  ok: false;
+  statusCode: 401;
+  message: string;
+};
+
+export type JwtAuthSuccess = {
+  ok: true;
+  claims: Record<string, unknown>;
+  userId: number;
+  sessionId: number | null;
+};
+
+export type JwtAuthResult = JwtAuthSuccess | JwtAuthFailure;
+
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+export async function authorizeVerifiedJwtSession(
+  verified: Record<string, unknown>,
+  sessionReader: UserSessionReader,
+  options?: { requireActiveSession?: boolean },
+): Promise<JwtAuthResult> {
+  const parsed = parseVerifiedJwtClaims(verified);
+  if (!parsed) {
+    return { ok: false, statusCode: 401, message: 'Invalid Token' };
+  }
+
+  const requireActiveSession = options?.requireActiveSession !== false;
+  if (requireActiveSession) {
+    const sessionValid = await validateUserSessionBinding(
+      parsed.userId,
+      parsed.sessionId,
+      sessionReader,
+    );
+    if (!sessionValid) {
+      return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+    }
+  }
+
+  return {
+    ok: true,
+    claims: parsed.raw,
+    userId: parsed.userId,
+    sessionId: parsed.sessionId,
+  };
+}

package/src/auth/jwt-token.helper.ts

@@ -0,0 +1,71 @@
+/**
+ * Extract CAA API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+export function extractJwtToken(
+  headers: Record<string, string | string[] | undefined> | undefined,
+): string | null {
+  if (!headers) return null;
+
+  const pick = (value: string | string[] | undefined): string | null => {
+    const raw = Array.isArray(value) ? value[0] : value;
+    const trimmed = raw?.trim();
+    return trimmed ? trimmed : null;
+  };
+
+  const fromJwtHeader = pick(headers.jwt ?? headers.JWT);
+  if (fromJwtHeader) return fromJwtHeader;
+
+  const authorization = pick(headers.authorization ?? headers.Authorization);
+  if (!authorization) return null;
+
+  const bearerMatch = /^Bearer\s+(.+)$/i.exec(authorization);
+  if (bearerMatch?.[1]?.trim()) return bearerMatch[1].trim();
+
+  return authorization;
+}
+
+export type JwtTokenRequest = {
+  headers: Record<string, string | string[] | undefined>;
+  body?: unknown;
+};
+
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+export function extractJwtTokenFromRequest(request: JwtTokenRequest): string | null {
+  const fromHeaders = extractJwtToken(request.headers);
+  if (fromHeaders) return fromHeaders;
+
+  const body = request.body as Record<string, unknown> | undefined;
+  if (!body || typeof body !== 'object') return null;
+
+  for (const key of ['token', 'jwt', 'access_token'] as const) {
+    const value = body[key];
+    if (typeof value === 'string' && value.trim()) return value.trim();
+  }
+  return null;
+}
+
+export type VerifiedJwtClaims = {
+  userId: number;
+  sessionId: number | null;
+  raw: Record<string, unknown>;
+};
+
+/** Parse verified JWT payload into userId + sessionId. */
+export function parseVerifiedJwtClaims(verified: Record<string, unknown>): VerifiedJwtClaims | null {
+  const userId = Number(verified.userId);
+  if (!Number.isFinite(userId) || userId <= 0) return null;
+
+  const sessionIdRaw = verified.sessionId;
+  const parsedSessionId =
+    sessionIdRaw == null || sessionIdRaw === '' ? null : Number(sessionIdRaw);
+
+  return {
+    userId,
+    sessionId:
+      parsedSessionId != null && Number.isFinite(parsedSessionId) && parsedSessionId > 0
+        ? parsedSessionId
+        : null,
+    raw: verified,
+  };
+}

package/src/auth/user-session-validation.ts

@@ -0,0 +1,78 @@
+/**
+ * Server-side JWT session binding (CAA VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+
+export type UserSessionReader = {
+  isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
+  /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
+  isSessionActive?(userId: number): Promise<unknown>;
+};
+
+/** When true (default), JWT must include sessionId and that session must be active. */
+export function isRequireJwtSessionId(): boolean {
+  const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
+  return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+
+export function resolveJwtSessionId(sessionId: unknown): number | null {
+  if (sessionId == null || sessionId === '') return null;
+  const sid = Number(sessionId);
+  if (!Number.isFinite(sid) || sid <= 0) return null;
+  return sid;
+}
+
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+export async function validateUserSessionBinding(
+  userId: number,
+  sessionId: number | null | undefined,
+  reader: UserSessionReader,
+): Promise<boolean> {
+  if (!Number.isFinite(userId) || userId <= 0) return false;
+
+  const sid = resolveJwtSessionId(sessionId);
+  if (sid != null) {
+    return reader.isSessionActiveById(sid, userId);
+  }
+
+  if (isRequireJwtSessionId()) {
+    return false;
+  }
+
+  if (!reader.isSessionActive) return false;
+  const legacy = await reader.isSessionActive(userId);
+  return !!legacy;
+}
+
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+export function applyActiveUserSessionFilters(
+  qb: {
+    andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+  },
+  alias = 'user_sessions',
+): void {
+  qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
+  qb.andWhere(`${alias}.is_deleted = :is_deleted`, { is_deleted: false });
+  qb.andWhere(
+    `(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+    { session_now: new Date() },
+  );
+}
+
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
+export function activeUserSessionSql(alias = 'user_sessions'): {
+  clause: string;
+  params: Record<string, unknown>;
+} {
+  return {
+    clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+    params: {
+      is_active: true,
+      is_deleted: false,
+      session_now: new Date(),
+    },
+  };
+}

package/src/index.ts

@@ -3,6 +3,9 @@ import { JobTransferRequestStatus } from './models/JobTransferRequestModel';
 export * from './models/user';
 export * from './models/role';
 export * from './models/user-sessions';
+export * from './auth/user-session-validation';
+export * from './auth/jwt-token.helper';
+export * from './auth/authenticate-jwt-session';
 export * from './models/ITHelpDeskModel';
 // export * from './models/ITServicesTypesSalalahModel'; // REMOVED - table no longer used
 // export * from './models/ITServicesTypesMuscatModel'; // REMOVED - table no longer used

package/src/models/ResidentialUnitRentalRequestModel.ts

@@ -113,8 +113,8 @@ export class ResidentialUnitRentalRequest extends BaseModel {
 
     location_of_unit: string; 
 
- 
- 
+    @Column({ type: 'varchar', length: 255, nullable: true })
+    number_of_apartments: string | null;
 
     @Column({ type: 'text', nullable: true })