@platform-modules/civil-aviation-authority 2.3.303 → 2.3.304

package/dist/auth/authenticate-jwt-session.js

@@ -17,11 +17,19 @@ async function authorizeVerifiedJwtSession(verified, sessionReader, options) {
         if (!sessionValid) {
             return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
         }
+        if (parsed.sessionId != null) {
+            const isCurrent = await (0, user_session_validation_1.validateJwtSessionIsCurrent)(parsed.userId, parsed.sessionId, sessionReader);
+            if (!isCurrent) {
+                return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+            }
+        }
     }
+    const sessionId = await (0, user_session_validation_1.resolveAuthorizedSessionId)(parsed.userId, parsed.sessionId, sessionReader);
+    const { sessionId: _jwtSessionId, ...claimsWithoutSession } = parsed.raw;
     return {
         ok: true,
-        claims: parsed.raw,
+        claims: claimsWithoutSession,
         userId: parsed.userId,
-        sessionId: parsed.sessionId,
+        sessionId,
     };
 }

package/dist/auth/user-session-validation.d.ts

@@ -3,11 +3,18 @@
  * JWT remains valid cryptographically until exp; access is allowed only while
  * the bound user_sessions row is active and not expired.
  */
+export type UserSessionRow = {
+    id?: number;
+};
 export type UserSessionReader = {
     isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
     /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
-    isSessionActive?(userId: number): Promise<unknown>;
+    isSessionActive?(userId: number): Promise<UserSessionRow | null | undefined>;
+    /** Latest active session row id for user (highest id). */
+    getLatestActiveSessionId?(userId: number): Promise<number | null>;
 };
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+export declare function isSingleSessionOnLogin(): boolean;
 /** When true (default), JWT must include sessionId and that session must be active. */
 export declare function isRequireJwtSessionId(): boolean;
 export declare function resolveJwtSessionId(sessionId: unknown): number | null;
@@ -15,9 +22,18 @@ export declare function resolveJwtSessionId(sessionId: unknown): number | null;
  * Validate that a verified JWT is still authorized (not logged out / expired server-side).
  */
 export declare function validateUserSessionBinding(userId: number, sessionId: number | null | undefined, reader: UserSessionReader): Promise<boolean>;
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+export declare function validateJwtSessionIsCurrent(userId: number, sessionId: number, reader: UserSessionReader): Promise<boolean>;
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+export declare function resolveAuthorizedSessionId(userId: number, jwtSessionId: number | null, reader: UserSessionReader): Promise<number | null>;
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
 export declare function applyActiveUserSessionFilters(qb: {
     andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+    orderBy?: (sort: string, order?: 'ASC' | 'DESC') => unknown;
+}, alias?: string): void;
+/** Prefer newest active session when multiple rows match (legacy path). */
+export declare function applyLatestActiveUserSessionOrdering(qb: {
+    orderBy: (sort: string, order?: 'ASC' | 'DESC') => unknown;
 }, alias?: string): void;
 /** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 export declare function activeUserSessionSql(alias?: string): {

package/dist/auth/user-session-validation.js

@@ -5,11 +5,20 @@
  * the bound user_sessions row is active and not expired.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSingleSessionOnLogin = isSingleSessionOnLogin;
 exports.isRequireJwtSessionId = isRequireJwtSessionId;
 exports.resolveJwtSessionId = resolveJwtSessionId;
 exports.validateUserSessionBinding = validateUserSessionBinding;
+exports.validateJwtSessionIsCurrent = validateJwtSessionIsCurrent;
+exports.resolveAuthorizedSessionId = resolveAuthorizedSessionId;
 exports.applyActiveUserSessionFilters = applyActiveUserSessionFilters;
+exports.applyLatestActiveUserSessionOrdering = applyLatestActiveUserSessionOrdering;
 exports.activeUserSessionSql = activeUserSessionSql;
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+function isSingleSessionOnLogin() {
+    const raw = (process.env.SINGLE_SESSION_ON_LOGIN ?? 'true').trim().toLowerCase();
+    return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
 /** When true (default), JWT must include sessionId and that session must be active. */
 function isRequireJwtSessionId() {
     const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
@@ -41,16 +50,42 @@ async function validateUserSessionBinding(userId, sessionId, reader) {
     const legacy = await reader.isSessionActive(userId);
     return !!legacy;
 }
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+async function validateJwtSessionIsCurrent(userId, sessionId, reader) {
+    if (!isSingleSessionOnLogin() || !reader.getLatestActiveSessionId)
+        return true;
+    const latest = await reader.getLatestActiveSessionId(userId);
+    if (latest == null)
+        return true;
+    return latest === sessionId;
+}
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+async function resolveAuthorizedSessionId(userId, jwtSessionId, reader) {
+    if (jwtSessionId != null)
+        return jwtSessionId;
+    if (reader.getLatestActiveSessionId) {
+        return reader.getLatestActiveSessionId(userId);
+    }
+    if (!reader.isSessionActive)
+        return null;
+    const legacy = await reader.isSessionActive(userId);
+    const legacyId = Number(legacy?.id);
+    return Number.isFinite(legacyId) && legacyId > 0 ? legacyId : null;
+}
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
 function applyActiveUserSessionFilters(qb, alias = 'user_sessions') {
     qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
-    qb.andWhere(`${alias}.is_deleted = :is_deleted`, { is_deleted: false });
+    qb.andWhere(`(${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted)`, { is_deleted: false });
     qb.andWhere(`(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`, { session_now: new Date() });
 }
+/** Prefer newest active session when multiple rows match (legacy path). */
+function applyLatestActiveUserSessionOrdering(qb, alias = 'user_sessions') {
+    qb.orderBy(`${alias}.id`, 'DESC');
+}
 /** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 function activeUserSessionSql(alias = 'user_sessions') {
     return {
-        clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+        clause: `${alias}.is_active = :is_active AND (${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted) AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
         params: {
             is_active: true,
             is_deleted: false,

package/dist/i18n/workflow-chat-message.builder.d.ts

@@ -58,7 +58,9 @@ export declare function renderSynchronizedWorkflowMessage(templateKey: string, e
 export declare function renderSynchronizedChatMessage(templateKey: string, enParams: Record<string, string>, arParams: Record<string, string>): BilingualText;
 export declare function buildBilingualFromTemplate(templateCatalog: Record<string, BilingualText>, key: string, params?: Record<string, string>, arParams?: Record<string, string>): BilingualText;
 export declare function workflowTemplate(key: string, params?: Record<string, string>, arParams?: Record<string, string>): BilingualText;
-/** Create/submit step for assign-tasks-emp workflow logs. */
+/** Submit/create step for assign-tasks-emp — same as HR / logistics (`Request Submitted`). */
+export declare function buildAssignTasksEmpSubmittedWorkflowFields(): BilingualText;
+/** Task-assigned step (approval pending from assignee) — not the submit row. */
 export declare function buildAssignTasksEmpAssignedWorkflowFields(): BilingualText;
 /** Approval step — pending from assigned employee. */
 export declare function buildAssignTasksEmpPendingFromWorkflowFields(params: {

package/dist/i18n/workflow-chat-message.builder.js

@@ -17,6 +17,7 @@ exports.renderSynchronizedWorkflowMessage = renderSynchronizedWorkflowMessage;
 exports.renderSynchronizedChatMessage = renderSynchronizedChatMessage;
 exports.buildBilingualFromTemplate = buildBilingualFromTemplate;
 exports.workflowTemplate = workflowTemplate;
+exports.buildAssignTasksEmpSubmittedWorkflowFields = buildAssignTasksEmpSubmittedWorkflowFields;
 exports.buildAssignTasksEmpAssignedWorkflowFields = buildAssignTasksEmpAssignedWorkflowFields;
 exports.buildAssignTasksEmpPendingFromWorkflowFields = buildAssignTasksEmpPendingFromWorkflowFields;
 exports.buildAssignTasksEmpPendingWorkflowFields = buildAssignTasksEmpPendingWorkflowFields;
@@ -171,7 +172,11 @@ function resolveAssignTasksEmpWorkflowTemplate(key, enParams = {}, arParams) {
         ar: interpolate(tpl.ar, arabicParams),
     };
 }
-/** Create/submit step for assign-tasks-emp workflow logs. */
+/** Submit/create step for assign-tasks-emp — same as HR / logistics (`Request Submitted`). */
+function buildAssignTasksEmpSubmittedWorkflowFields() {
+    return buildSynchronizedWorkflowMessage({ action: 'request_submitted' });
+}
+/** Task-assigned step (approval pending from assignee) — not the submit row. */
 function buildAssignTasksEmpAssignedWorkflowFields() {
     return resolveAssignTasksEmpWorkflowTemplate('request_assigned');
 }
@@ -187,14 +192,37 @@ function buildAssignTasksEmpPendingWorkflowFields() {
 }
 function resolveStoredAssignTasksEmpTemplateKey(content, actors) {
     const normalized = content?.trim();
-    if (!normalized || !(normalized in ASSIGN_TASKS_EMP_WF_FALLBACKS))
+    if (!normalized)
         return null;
-    if (normalized === 'request_pending_from') {
-        const nameEn = actors?.userName?.trim() || 'Unknown User';
+    if (normalized in ASSIGN_TASKS_EMP_WF_FALLBACKS) {
+        if (normalized === 'request_pending_from') {
+            const nameEn = actors?.userName?.trim() || 'Unknown User';
+            const nameAr = resolveArabicWorkflowActorName(actors, nameEn);
+            return resolveAssignTasksEmpWorkflowTemplate('request_pending_from', { name: nameEn }, { name: nameAr });
+        }
+        return resolveAssignTasksEmpWorkflowTemplate(normalized);
+    }
+    const requestSubmitted = WORKFLOW_TEMPLATES.request_submitted;
+    if (requestSubmitted &&
+        (normalized === requestSubmitted.en ||
+            normalized.toLowerCase() === requestSubmitted.en.toLowerCase())) {
+        return { en: requestSubmitted.en, ar: requestSubmitted.ar };
+    }
+    const requestAssigned = WORKFLOW_TEMPLATES.request_assigned;
+    if (requestAssigned && normalized === requestAssigned.en) {
+        return resolveAssignTasksEmpWorkflowTemplate('request_assigned');
+    }
+    const pendingFromPrefix = WORKFLOW_TEMPLATES.request_pending_from?.en.split('{{name}}')[0].trim();
+    if (pendingFromPrefix && normalized.startsWith(pendingFromPrefix)) {
+        const nameEn = normalized.slice(pendingFromPrefix.length).trim();
         const nameAr = resolveArabicWorkflowActorName(actors, nameEn);
         return resolveAssignTasksEmpWorkflowTemplate('request_pending_from', { name: nameEn }, { name: nameAr });
     }
-    return resolveAssignTasksEmpWorkflowTemplate(normalized);
+    const requestPending = WORKFLOW_TEMPLATES.request_pending;
+    if (requestPending && normalized === requestPending.en) {
+        return resolveAssignTasksEmpWorkflowTemplate('request_pending');
+    }
+    return null;
 }
 function chatTemplate(key, params = {}, arParams) {
     return buildBilingualFromTemplate(CHAT_TEMPLATES, key, params, arParams);
@@ -1180,6 +1208,65 @@ function tryResolveItHelpdeskMuscatLegacyWorkflowAr(content, actors) {
             comment,
         }).ar;
     }
+    if (/^IT Technician rejected the request$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'role_outcome_by_user_rejected',
+            roleName: 'IT Technician',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^IT Technician closed the request$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'role_outcome_by_user_closed',
+            roleName: 'IT Technician',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    m = base.match(/^Workflow routed to direct resolution path - request closed by (.+)$/i);
+    if (m) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'routing_direct_approval',
+            roleName: m[1].trim(),
+            roleArabicName: actors?.roleArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^HOS notification not required, request rejected$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'hos_not_required_rejected',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^HOS notification not required, request closed$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'hos_not_required_closed',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^L3 assignment not required, request rejected$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'l3_not_required_rejected',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^L3 assignment not required, request closed$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'l3_not_required_closed',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
     return null;
 }
 function resolveWorkflowContentAr(content, actors) {
@@ -1391,6 +1478,14 @@ function enrichWorkflowLog(log) {
     if (assignTasksEmpResolved) {
         content_ar = assignTasksEmpResolved.ar;
     }
+    const submittedTpl = WORKFLOW_TEMPLATES.request_submitted;
+    const assignedTpl = WORKFLOW_TEMPLATES.request_assigned;
+    if (submittedTpl &&
+        assignedTpl &&
+        content === submittedTpl.en &&
+        content_ar === assignedTpl.ar) {
+        content_ar = submittedTpl.ar;
+    }
     return {
         ...log,
         ...(content !== rawContent ? { content } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "@platform-modules/civil-aviation-authority",
-  "version": "2.3.303",
+  "version": "2.3.304",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
   "scripts": {

package/src/auth/authenticate-jwt-session.ts

@@ -1,5 +1,9 @@
 import { parseVerifiedJwtClaims } from './jwt-token.helper';
-import { validateUserSessionBinding } from './user-session-validation';
+import {
+  resolveAuthorizedSessionId,
+  validateJwtSessionIsCurrent,
+  validateUserSessionBinding,
+} from './user-session-validation';
 import type { UserSessionReader } from './user-session-validation';
 
 export type JwtAuthFailure = {
@@ -40,12 +44,30 @@ export async function authorizeVerifiedJwtSession(
     if (!sessionValid) {
       return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
     }
+
+    if (parsed.sessionId != null) {
+      const isCurrent = await validateJwtSessionIsCurrent(
+        parsed.userId,
+        parsed.sessionId,
+        sessionReader,
+      );
+      if (!isCurrent) {
+        return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+      }
+    }
   }
 
+  const sessionId = await resolveAuthorizedSessionId(
+    parsed.userId,
+    parsed.sessionId,
+    sessionReader,
+  );
+  const { sessionId: _jwtSessionId, ...claimsWithoutSession } = parsed.raw;
+
   return {
     ok: true,
-    claims: parsed.raw,
+    claims: claimsWithoutSession,
     userId: parsed.userId,
-    sessionId: parsed.sessionId,
+    sessionId,
   };
 }

package/src/auth/user-session-validation.ts

@@ -4,12 +4,24 @@
  * the bound user_sessions row is active and not expired.
  */
 
+export type UserSessionRow = {
+  id?: number;
+};
+
 export type UserSessionReader = {
   isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
   /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
-  isSessionActive?(userId: number): Promise<unknown>;
+  isSessionActive?(userId: number): Promise<UserSessionRow | null | undefined>;
+  /** Latest active session row id for user (highest id). */
+  getLatestActiveSessionId?(userId: number): Promise<number | null>;
 };
 
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+export function isSingleSessionOnLogin(): boolean {
+  const raw = (process.env.SINGLE_SESSION_ON_LOGIN ?? 'true').trim().toLowerCase();
+  return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+
 /** When true (default), JWT must include sessionId and that session must be active. */
 export function isRequireJwtSessionId(): boolean {
   const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
@@ -47,28 +59,70 @@ export async function validateUserSessionBinding(
   return !!legacy;
 }
 
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+export async function validateJwtSessionIsCurrent(
+  userId: number,
+  sessionId: number,
+  reader: UserSessionReader,
+): Promise<boolean> {
+  if (!isSingleSessionOnLogin() || !reader.getLatestActiveSessionId) return true;
+  const latest = await reader.getLatestActiveSessionId(userId);
+  if (latest == null) return true;
+  return latest === sessionId;
+}
+
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+export async function resolveAuthorizedSessionId(
+  userId: number,
+  jwtSessionId: number | null,
+  reader: UserSessionReader,
+): Promise<number | null> {
+  if (jwtSessionId != null) return jwtSessionId;
+
+  if (reader.getLatestActiveSessionId) {
+    return reader.getLatestActiveSessionId(userId);
+  }
+
+  if (!reader.isSessionActive) return null;
+  const legacy = await reader.isSessionActive(userId);
+  const legacyId = Number(legacy?.id);
+  return Number.isFinite(legacyId) && legacyId > 0 ? legacyId : null;
+}
+
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
 export function applyActiveUserSessionFilters(
   qb: {
     andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+    orderBy?: (sort: string, order?: 'ASC' | 'DESC') => unknown;
   },
   alias = 'user_sessions',
 ): void {
   qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
-  qb.andWhere(`${alias}.is_deleted = :is_deleted`, { is_deleted: false });
+  qb.andWhere(
+    `(${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted)`,
+    { is_deleted: false },
+  );
   qb.andWhere(
     `(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
     { session_now: new Date() },
   );
 }
 
+/** Prefer newest active session when multiple rows match (legacy path). */
+export function applyLatestActiveUserSessionOrdering(
+  qb: { orderBy: (sort: string, order?: 'ASC' | 'DESC') => unknown },
+  alias = 'user_sessions',
+): void {
+  qb.orderBy(`${alias}.id`, 'DESC');
+}
+
 /** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 export function activeUserSessionSql(alias = 'user_sessions'): {
   clause: string;
   params: Record<string, unknown>;
 } {
   return {
-    clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+    clause: `${alias}.is_active = :is_active AND (${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted) AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
     params: {
       is_active: true,
       is_deleted: false,

package/src/i18n/workflow-chat-message.builder.ts

@@ -221,7 +221,12 @@ function resolveAssignTasksEmpWorkflowTemplate(
   };
 }
 
-/** Create/submit step for assign-tasks-emp workflow logs. */
+/** Submit/create step for assign-tasks-emp — same as HR / logistics (`Request Submitted`). */
+export function buildAssignTasksEmpSubmittedWorkflowFields(): BilingualText {
+  return buildSynchronizedWorkflowMessage({ action: 'request_submitted' });
+}
+
+/** Task-assigned step (approval pending from assignee) — not the submit row. */
 export function buildAssignTasksEmpAssignedWorkflowFields(): BilingualText {
   return resolveAssignTasksEmpWorkflowTemplate('request_assigned');
 }
@@ -250,9 +255,38 @@ function resolveStoredAssignTasksEmpTemplateKey(
   actors?: BilingualActorNames,
 ): BilingualText | null {
   const normalized = content?.trim();
-  if (!normalized || !(normalized in ASSIGN_TASKS_EMP_WF_FALLBACKS)) return null;
-  if (normalized === 'request_pending_from') {
-    const nameEn = actors?.userName?.trim() || 'Unknown User';
+  if (!normalized) return null;
+
+  if (normalized in ASSIGN_TASKS_EMP_WF_FALLBACKS) {
+    if (normalized === 'request_pending_from') {
+      const nameEn = actors?.userName?.trim() || 'Unknown User';
+      const nameAr = resolveArabicWorkflowActorName(actors, nameEn);
+      return resolveAssignTasksEmpWorkflowTemplate(
+        'request_pending_from',
+        { name: nameEn },
+        { name: nameAr },
+      );
+    }
+    return resolveAssignTasksEmpWorkflowTemplate(normalized as AssignTasksEmpWorkflowTemplateKey);
+  }
+
+  const requestSubmitted = WORKFLOW_TEMPLATES.request_submitted;
+  if (
+    requestSubmitted &&
+    (normalized === requestSubmitted.en ||
+      normalized.toLowerCase() === requestSubmitted.en.toLowerCase())
+  ) {
+    return { en: requestSubmitted.en, ar: requestSubmitted.ar };
+  }
+
+  const requestAssigned = WORKFLOW_TEMPLATES.request_assigned;
+  if (requestAssigned && normalized === requestAssigned.en) {
+    return resolveAssignTasksEmpWorkflowTemplate('request_assigned');
+  }
+
+  const pendingFromPrefix = WORKFLOW_TEMPLATES.request_pending_from?.en.split('{{name}}')[0].trim();
+  if (pendingFromPrefix && normalized.startsWith(pendingFromPrefix)) {
+    const nameEn = normalized.slice(pendingFromPrefix.length).trim();
     const nameAr = resolveArabicWorkflowActorName(actors, nameEn);
     return resolveAssignTasksEmpWorkflowTemplate(
       'request_pending_from',
@@ -260,7 +294,13 @@ function resolveStoredAssignTasksEmpTemplateKey(
       { name: nameAr },
     );
   }
-  return resolveAssignTasksEmpWorkflowTemplate(normalized as AssignTasksEmpWorkflowTemplateKey);
+
+  const requestPending = WORKFLOW_TEMPLATES.request_pending;
+  if (requestPending && normalized === requestPending.en) {
+    return resolveAssignTasksEmpWorkflowTemplate('request_pending');
+  }
+
+  return null;
 }
 
 export function chatTemplate(
@@ -1800,6 +1840,72 @@ function tryResolveItHelpdeskMuscatLegacyWorkflowAr(
     }).ar;
   }
 
+  if (/^IT Technician rejected the request$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'role_outcome_by_user_rejected',
+      roleName: 'IT Technician',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^IT Technician closed the request$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'role_outcome_by_user_closed',
+      roleName: 'IT Technician',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  m = base.match(/^Workflow routed to direct resolution path - request closed by (.+)$/i);
+  if (m) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'routing_direct_approval',
+      roleName: m[1].trim(),
+      roleArabicName: actors?.roleArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^HOS notification not required, request rejected$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'hos_not_required_rejected',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^HOS notification not required, request closed$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'hos_not_required_closed',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^L3 assignment not required, request rejected$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'l3_not_required_rejected',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^L3 assignment not required, request closed$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'l3_not_required_closed',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
   return null;
 }
 
@@ -2042,6 +2148,18 @@ export function enrichWorkflowLog(log: Record<string, unknown>): Record<string,
   if (assignTasksEmpResolved) {
     content_ar = assignTasksEmpResolved.ar;
   }
+
+  const submittedTpl = WORKFLOW_TEMPLATES.request_submitted;
+  const assignedTpl = WORKFLOW_TEMPLATES.request_assigned;
+  if (
+    submittedTpl &&
+    assignedTpl &&
+    content === submittedTpl.en &&
+    content_ar === assignedTpl.ar
+  ) {
+    content_ar = submittedTpl.ar;
+  }
+
   return {
     ...log,
     ...(content !== rawContent ? { content } : {}),