@platform-modules/civil-aviation-authority 2.3.303 → 2.3.305

package/dist/auth/authenticate-jwt-session.js

@@ -17,11 +17,19 @@ async function authorizeVerifiedJwtSession(verified, sessionReader, options) {
         if (!sessionValid) {
             return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
         }
+        if (parsed.sessionId != null) {
+            const isCurrent = await (0, user_session_validation_1.validateJwtSessionIsCurrent)(parsed.userId, parsed.sessionId, sessionReader);
+            if (!isCurrent) {
+                return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+            }
+        }
     }
+    const sessionId = await (0, user_session_validation_1.resolveAuthorizedSessionId)(parsed.userId, parsed.sessionId, sessionReader);
+    const { sessionId: _jwtSessionId, ...claimsWithoutSession } = parsed.raw;
     return {
         ok: true,
-        claims: parsed.raw,
+        claims: claimsWithoutSession,
         userId: parsed.userId,
-        sessionId: parsed.sessionId,
+        sessionId,
     };
 }

package/dist/auth/user-session-validation.d.ts

@@ -3,11 +3,18 @@
  * JWT remains valid cryptographically until exp; access is allowed only while
  * the bound user_sessions row is active and not expired.
  */
+export type UserSessionRow = {
+    id?: number;
+};
 export type UserSessionReader = {
     isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
     /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
-    isSessionActive?(userId: number): Promise<unknown>;
+    isSessionActive?(userId: number): Promise<UserSessionRow | null | undefined>;
+    /** Latest active session row id for user (highest id). */
+    getLatestActiveSessionId?(userId: number): Promise<number | null>;
 };
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+export declare function isSingleSessionOnLogin(): boolean;
 /** When true (default), JWT must include sessionId and that session must be active. */
 export declare function isRequireJwtSessionId(): boolean;
 export declare function resolveJwtSessionId(sessionId: unknown): number | null;
@@ -15,9 +22,18 @@ export declare function resolveJwtSessionId(sessionId: unknown): number | null;
  * Validate that a verified JWT is still authorized (not logged out / expired server-side).
  */
 export declare function validateUserSessionBinding(userId: number, sessionId: number | null | undefined, reader: UserSessionReader): Promise<boolean>;
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+export declare function validateJwtSessionIsCurrent(userId: number, sessionId: number, reader: UserSessionReader): Promise<boolean>;
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+export declare function resolveAuthorizedSessionId(userId: number, jwtSessionId: number | null, reader: UserSessionReader): Promise<number | null>;
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
 export declare function applyActiveUserSessionFilters(qb: {
     andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+    orderBy?: (sort: string, order?: 'ASC' | 'DESC') => unknown;
+}, alias?: string): void;
+/** Prefer newest active session when multiple rows match (legacy path). */
+export declare function applyLatestActiveUserSessionOrdering(qb: {
+    orderBy: (sort: string, order?: 'ASC' | 'DESC') => unknown;
 }, alias?: string): void;
 /** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 export declare function activeUserSessionSql(alias?: string): {

package/dist/auth/user-session-validation.js

@@ -5,11 +5,20 @@
  * the bound user_sessions row is active and not expired.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSingleSessionOnLogin = isSingleSessionOnLogin;
 exports.isRequireJwtSessionId = isRequireJwtSessionId;
 exports.resolveJwtSessionId = resolveJwtSessionId;
 exports.validateUserSessionBinding = validateUserSessionBinding;
+exports.validateJwtSessionIsCurrent = validateJwtSessionIsCurrent;
+exports.resolveAuthorizedSessionId = resolveAuthorizedSessionId;
 exports.applyActiveUserSessionFilters = applyActiveUserSessionFilters;
+exports.applyLatestActiveUserSessionOrdering = applyLatestActiveUserSessionOrdering;
 exports.activeUserSessionSql = activeUserSessionSql;
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+function isSingleSessionOnLogin() {
+    const raw = (process.env.SINGLE_SESSION_ON_LOGIN ?? 'true').trim().toLowerCase();
+    return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
 /** When true (default), JWT must include sessionId and that session must be active. */
 function isRequireJwtSessionId() {
     const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
@@ -41,16 +50,42 @@ async function validateUserSessionBinding(userId, sessionId, reader) {
     const legacy = await reader.isSessionActive(userId);
     return !!legacy;
 }
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+async function validateJwtSessionIsCurrent(userId, sessionId, reader) {
+    if (!isSingleSessionOnLogin() || !reader.getLatestActiveSessionId)
+        return true;
+    const latest = await reader.getLatestActiveSessionId(userId);
+    if (latest == null)
+        return true;
+    return latest === sessionId;
+}
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+async function resolveAuthorizedSessionId(userId, jwtSessionId, reader) {
+    if (jwtSessionId != null)
+        return jwtSessionId;
+    if (reader.getLatestActiveSessionId) {
+        return reader.getLatestActiveSessionId(userId);
+    }
+    if (!reader.isSessionActive)
+        return null;
+    const legacy = await reader.isSessionActive(userId);
+    const legacyId = Number(legacy?.id);
+    return Number.isFinite(legacyId) && legacyId > 0 ? legacyId : null;
+}
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
 function applyActiveUserSessionFilters(qb, alias = 'user_sessions') {
     qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
-    qb.andWhere(`${alias}.is_deleted = :is_deleted`, { is_deleted: false });
+    qb.andWhere(`(${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted)`, { is_deleted: false });
     qb.andWhere(`(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`, { session_now: new Date() });
 }
+/** Prefer newest active session when multiple rows match (legacy path). */
+function applyLatestActiveUserSessionOrdering(qb, alias = 'user_sessions') {
+    qb.orderBy(`${alias}.id`, 'DESC');
+}
 /** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 function activeUserSessionSql(alias = 'user_sessions') {
     return {
-        clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+        clause: `${alias}.is_active = :is_active AND (${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted) AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
         params: {
             is_active: true,
             is_deleted: false,

package/dist/i18n/workflow-chat-message.builder.d.ts

@@ -58,7 +58,9 @@ export declare function renderSynchronizedWorkflowMessage(templateKey: string, e
 export declare function renderSynchronizedChatMessage(templateKey: string, enParams: Record<string, string>, arParams: Record<string, string>): BilingualText;
 export declare function buildBilingualFromTemplate(templateCatalog: Record<string, BilingualText>, key: string, params?: Record<string, string>, arParams?: Record<string, string>): BilingualText;
 export declare function workflowTemplate(key: string, params?: Record<string, string>, arParams?: Record<string, string>): BilingualText;
-/** Create/submit step for assign-tasks-emp workflow logs. */
+/** Submit/create step for assign-tasks-emp — same as HR / logistics (`Request Submitted`). */
+export declare function buildAssignTasksEmpSubmittedWorkflowFields(): BilingualText;
+/** Task-assigned step (approval pending from assignee) — not the submit row. */
 export declare function buildAssignTasksEmpAssignedWorkflowFields(): BilingualText;
 /** Approval step — pending from assigned employee. */
 export declare function buildAssignTasksEmpPendingFromWorkflowFields(params: {

package/dist/i18n/workflow-chat-message.builder.js

@@ -17,6 +17,7 @@ exports.renderSynchronizedWorkflowMessage = renderSynchronizedWorkflowMessage;
 exports.renderSynchronizedChatMessage = renderSynchronizedChatMessage;
 exports.buildBilingualFromTemplate = buildBilingualFromTemplate;
 exports.workflowTemplate = workflowTemplate;
+exports.buildAssignTasksEmpSubmittedWorkflowFields = buildAssignTasksEmpSubmittedWorkflowFields;
 exports.buildAssignTasksEmpAssignedWorkflowFields = buildAssignTasksEmpAssignedWorkflowFields;
 exports.buildAssignTasksEmpPendingFromWorkflowFields = buildAssignTasksEmpPendingFromWorkflowFields;
 exports.buildAssignTasksEmpPendingWorkflowFields = buildAssignTasksEmpPendingWorkflowFields;
@@ -171,7 +172,11 @@ function resolveAssignTasksEmpWorkflowTemplate(key, enParams = {}, arParams) {
         ar: interpolate(tpl.ar, arabicParams),
     };
 }
-/** Create/submit step for assign-tasks-emp workflow logs. */
+/** Submit/create step for assign-tasks-emp — same as HR / logistics (`Request Submitted`). */
+function buildAssignTasksEmpSubmittedWorkflowFields() {
+    return buildSynchronizedWorkflowMessage({ action: 'request_submitted' });
+}
+/** Task-assigned step (approval pending from assignee) — not the submit row. */
 function buildAssignTasksEmpAssignedWorkflowFields() {
     return resolveAssignTasksEmpWorkflowTemplate('request_assigned');
 }
@@ -187,14 +192,37 @@ function buildAssignTasksEmpPendingWorkflowFields() {
 }
 function resolveStoredAssignTasksEmpTemplateKey(content, actors) {
     const normalized = content?.trim();
-    if (!normalized || !(normalized in ASSIGN_TASKS_EMP_WF_FALLBACKS))
+    if (!normalized)
         return null;
-    if (normalized === 'request_pending_from') {
-        const nameEn = actors?.userName?.trim() || 'Unknown User';
+    if (normalized in ASSIGN_TASKS_EMP_WF_FALLBACKS) {
+        if (normalized === 'request_pending_from') {
+            const nameEn = actors?.userName?.trim() || 'Unknown User';
+            const nameAr = resolveArabicWorkflowActorName(actors, nameEn);
+            return resolveAssignTasksEmpWorkflowTemplate('request_pending_from', { name: nameEn }, { name: nameAr });
+        }
+        return resolveAssignTasksEmpWorkflowTemplate(normalized);
+    }
+    const requestSubmitted = WORKFLOW_TEMPLATES.request_submitted;
+    if (requestSubmitted &&
+        (normalized === requestSubmitted.en ||
+            normalized.toLowerCase() === requestSubmitted.en.toLowerCase())) {
+        return { en: requestSubmitted.en, ar: requestSubmitted.ar };
+    }
+    const requestAssigned = WORKFLOW_TEMPLATES.request_assigned;
+    if (requestAssigned && normalized === requestAssigned.en) {
+        return resolveAssignTasksEmpWorkflowTemplate('request_assigned');
+    }
+    const pendingFromPrefix = WORKFLOW_TEMPLATES.request_pending_from?.en.split('{{name}}')[0].trim();
+    if (pendingFromPrefix && normalized.startsWith(pendingFromPrefix)) {
+        const nameEn = normalized.slice(pendingFromPrefix.length).trim();
         const nameAr = resolveArabicWorkflowActorName(actors, nameEn);
         return resolveAssignTasksEmpWorkflowTemplate('request_pending_from', { name: nameEn }, { name: nameAr });
     }
-    return resolveAssignTasksEmpWorkflowTemplate(normalized);
+    const requestPending = WORKFLOW_TEMPLATES.request_pending;
+    if (requestPending && normalized === requestPending.en) {
+        return resolveAssignTasksEmpWorkflowTemplate('request_pending');
+    }
+    return null;
 }
 function chatTemplate(key, params = {}, arParams) {
     return buildBilingualFromTemplate(CHAT_TEMPLATES, key, params, arParams);
@@ -1180,6 +1208,65 @@ function tryResolveItHelpdeskMuscatLegacyWorkflowAr(content, actors) {
             comment,
         }).ar;
     }
+    if (/^IT Technician rejected the request$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'role_outcome_by_user_rejected',
+            roleName: 'IT Technician',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^IT Technician closed the request$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'role_outcome_by_user_closed',
+            roleName: 'IT Technician',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    m = base.match(/^Workflow routed to direct resolution path - request closed by (.+)$/i);
+    if (m) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'routing_direct_approval',
+            roleName: m[1].trim(),
+            roleArabicName: actors?.roleArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^HOS notification not required, request rejected$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'hos_not_required_rejected',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^HOS notification not required, request closed$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'hos_not_required_closed',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^L3 assignment not required, request rejected$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'l3_not_required_rejected',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
+    if (/^L3 assignment not required, request closed$/i.test(base)) {
+        return buildItHelpdeskMuscatWorkflowLog({
+            variant: 'l3_not_required_closed',
+            userName: actors?.userName?.trim() || 'IT Technician',
+            userArabicName: actors?.userArabicName,
+            comment,
+        }).ar;
+    }
     return null;
 }
 function resolveWorkflowContentAr(content, actors) {
@@ -1391,6 +1478,14 @@ function enrichWorkflowLog(log) {
     if (assignTasksEmpResolved) {
         content_ar = assignTasksEmpResolved.ar;
     }
+    const submittedTpl = WORKFLOW_TEMPLATES.request_submitted;
+    const assignedTpl = WORKFLOW_TEMPLATES.request_assigned;
+    if (submittedTpl &&
+        assignedTpl &&
+        content === submittedTpl.en &&
+        content_ar === assignedTpl.ar) {
+        content_ar = submittedTpl.ar;
+    }
     return {
         ...log,
         ...(content !== rawContent ? { content } : {}),

package/dist/models/DepartmentsModel.d.ts

@@ -4,5 +4,6 @@ export declare class Departments extends BaseModel {
     department_arabic_name: string | null;
     department_code: string;
     department_description: string;
+    DG_department_id: number | null;
     constructor(department_name: string, department_code: string, department_description: string);
 }

package/dist/models/DepartmentsModel.js

@@ -37,6 +37,10 @@ __decorate([
     (0, typeorm_1.Column)({ nullable: false }),
     __metadata("design:type", String)
 ], Departments.prototype, "department_description", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'integer', nullable: true, name: 'DG_department_id' }),
+    __metadata("design:type", Object)
+], Departments.prototype, "DG_department_id", void 0);
 exports.Departments = Departments = __decorate([
     (0, typeorm_1.Entity)({ name: 'departments' }),
     __metadata("design:paramtypes", [String, String, String])

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "@platform-modules/civil-aviation-authority",
-  "version": "2.3.303",
+  "version": "2.3.305",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
   "scripts": {

package/scripts/sync-sla-reports-sql.js

@@ -1,7 +1,7 @@
 /**
  * Applies SLA report views + stored procedures to PostgreSQL (idempotent CREATE OR REPLACE).
  *
- * Env (shared_models/.env or Reports_Service/.env):
+ * Env from shared_models/.env only:
  *   DB_HOST / TYPEORM_HOST
  *   DB_PORT / TYPEORM_PORT
  *   DB_USER / TYPEORM_USERNAME
@@ -20,31 +20,25 @@ const { Client } = require('pg');
 function loadEnvFiles() {
   const dotenv = require('dotenv');
   const packageRoot = path.resolve(__dirname, '..');
-  const cwdEnv = path.join(process.cwd(), '.env');
   const packageEnv = path.join(packageRoot, '.env');
-  const reportsEnv = path.resolve(packageRoot, '..', 'Reports_Service', '.env');
 
-  if (fs.existsSync(cwdEnv)) {
-    dotenv.config({ path: cwdEnv });
-  }
-  if (fs.existsSync(packageEnv)) {
-    dotenv.config({ path: packageEnv, override: true });
-  }
-  if (fs.existsSync(reportsEnv)) {
-    dotenv.config({ path: reportsEnv, override: true });
+  if (!fs.existsSync(packageEnv)) {
+    throw new Error(`Missing env file: ${packageEnv}`);
   }
+
+  dotenv.config({ path: packageEnv, override: true });
 }
 
 function getDbConfig() {
-  const host = (process.env.TYPEORM_HOST || process.env.DB_HOST || '').trim();
-  const port = parseInt(process.env.TYPEORM_PORT || process.env.DB_PORT || '5432', 10);
-  const user = (process.env.TYPEORM_USERNAME || process.env.DB_USER || '').trim();
-  const password = process.env.TYPEORM_PASSWORD || process.env.DB_PASS || '';
-  const database = (process.env.TYPEORM_DATABASE || process.env.DB_NAME || '').trim();
+  const host = (process.env.DB_HOST || process.env.TYPEORM_HOST || '').trim();
+  const port = parseInt(process.env.DB_PORT || process.env.TYPEORM_PORT || '5432', 10);
+  const user = (process.env.DB_USER || process.env.TYPEORM_USERNAME || '').trim();
+  const password = process.env.DB_PASS || process.env.TYPEORM_PASSWORD || '';
+  const database = (process.env.DB_NAME || process.env.TYPEORM_DATABASE || '').trim();
 
   if (!host || !user || !database) {
     throw new Error(
-      'Missing DB config. Set TYPEORM_* in Reports_Service/.env or DB_* in shared_models/.env'
+      'Missing DB config. Set DB_HOST, DB_USER, DB_NAME (and DB_PASS) in shared_models/.env'
     );
   }
 

package/sql/README.md

@@ -10,7 +10,7 @@ Applied in order by `npm run sync:sla-sql` (see `sla-reports-sync.manifest.json`
 | `sla_reports_approvals_workbook.sql` | Approvals Excel workbook (Requests + Approvals per sub-service) |
 | `sla_reports_admin_procedures.sql` | Admin SLA report functions (requires procedures file) |
 
-From **shared_models** (uses `shared_models/.env`, or `Reports_Service/.env` when present in monorepo):
+From **shared_models** (reads DB config from `shared_models/.env` only — `DB_HOST`, `DB_USER`, `DB_PASS`, `DB_NAME`):
 
 ```bash
 cd shared_models && npm run sync:sla-sql

package/sql/alter_sla_requests_status_to_varchar.sql

@@ -1,18 +1,25 @@
 -- Migrate sla_requests.status from PostgreSQL enum to varchar(64) in-place (preserves data).
--- Drops SLA views only when converting from enum (safe for sync:sla-sql manifest runs).
+-- Drops SLA views when a type change is required (recreated by later sync:sla-sql files).
 -- Idempotent when status is already varchar(64).
 
 DO $$
 DECLARE
     status_udt text;
+    status_len integer;
 BEGIN
-    SELECT c.udt_name
-    INTO status_udt
+    SELECT c.udt_name, c.character_maximum_length
+    INTO status_udt, status_len
     FROM information_schema.columns c
     WHERE c.table_schema = 'public'
       AND c.table_name = 'sla_requests'
       AND c.column_name = 'status';
 
+    IF status_udt IS NULL THEN
+        RAISE NOTICE 'sla_requests.status not found — skip type migration';
+        RETURN;
+    END IF;
+
+    -- Enum -> varchar(64)
     IF status_udt = 'sla_requests_status_enum' THEN
         DROP VIEW IF EXISTS vw_sla_approvals CASCADE;
         DROP VIEW IF EXISTS vw_sla_my_requests CASCADE;
@@ -21,9 +28,16 @@ BEGIN
             ALTER COLUMN status TYPE varchar(64) USING status::text;
 
         DROP TYPE IF EXISTS sla_requests_status_enum;
-    ELSIF status_udt = 'varchar' THEN
+
+    -- Already varchar but not length 64 (views block ALTER TYPE)
+    ELSIF status_udt = 'varchar' AND status_len IS DISTINCT FROM 64 THEN
+        DROP VIEW IF EXISTS vw_sla_approvals CASCADE;
+        DROP VIEW IF EXISTS vw_sla_my_requests CASCADE;
+
         ALTER TABLE sla_requests
             ALTER COLUMN status TYPE varchar(64);
+
+    -- Already varchar(64) — nothing to do
     END IF;
 END $$;
 

package/sql/caa_api_payload_changes_2026_07.sql

@@ -139,3 +139,7 @@ ALTER TABLE followup_report_items
   ADD COLUMN IF NOT EXISTS file_name VARCHAR(255),
   ADD COLUMN IF NOT EXISTS file_type VARCHAR(100),
   ADD COLUMN IF NOT EXISTS file_size BIGINT;
+
+-- 10. Departments: optional parent DG department reference (self FK to departments.id)
+ALTER TABLE departments
+  ADD COLUMN IF NOT EXISTS "DG_department_id" INTEGER NULL;

package/sql/sla_reports_admin_procedures.sql

@@ -22,6 +22,8 @@ $$;
 -- ADMIN — my requests Excel (optional p_target_user_id)
 -- Per sub-service Requests + Approvals sheets (same as user my-requests download)
 -- ---------------------------------------------------------------------------
+DROP FUNCTION IF EXISTS sp_sla_admin_my_requests_excel_export(INT, INT[], INT[], TEXT[], DATE, DATE, TEXT, TEXT, TEXT);
+
 CREATE OR REPLACE FUNCTION sp_sla_admin_my_requests_excel_export(
   p_target_user_id    INT      DEFAULT NULL,
   p_service_ids       INT[]    DEFAULT NULL,
@@ -31,7 +33,8 @@ CREATE OR REPLACE FUNCTION sp_sla_admin_my_requests_excel_export(
   p_to_date           DATE     DEFAULT NULL,
   p_search_text       TEXT     DEFAULT NULL,
   p_sort_by           TEXT     DEFAULT 'created_at',
-  p_sort_order        TEXT     DEFAULT 'DESC'
+  p_sort_order        TEXT     DEFAULT 'DESC',
+  p_extra_filter_sql  TEXT     DEFAULT 'TRUE'
 )
 RETURNS TABLE (
   sheet_order         INT,
@@ -63,7 +66,11 @@ DECLARE
   v_sheet_order       INT := 0;
   v_user_filter       TEXT;
 BEGIN
-  v_user_filter := CASE WHEN p_target_user_id IS NULL THEN 'TRUE' ELSE format('v.user_id = %s', p_target_user_id) END;
+  v_user_filter := format(
+    '(%s) AND (%s)',
+    CASE WHEN p_target_user_id IS NULL THEN 'TRUE' ELSE format('v.user_id = %s', p_target_user_id) END,
+    COALESCE(NULLIF(trim(p_extra_filter_sql), ''), 'TRUE')
+  );
 
   v_sort_col := CASE lower(trim(p_sort_by))
     WHEN 'updated_at'  THEN 'v.created_at'
@@ -199,6 +206,10 @@ DROP FUNCTION IF EXISTS sp_sla_approvals_excel_export_internal(
   TEXT, BOOLEAN, INT, INT[], INT[], TEXT[], TEXT[], DATE, DATE, TEXT, TEXT, TEXT
 );
 
+DROP FUNCTION IF EXISTS sp_sla_approvals_excel_export(
+  INT, INT[], INT[], TEXT[], TEXT[], DATE, DATE, TEXT, TEXT, TEXT
+);
+
 CREATE OR REPLACE FUNCTION sp_sla_approvals_excel_export(
   p_approver_user_id    INT,
   p_service_ids         INT[]    DEFAULT NULL,
@@ -209,7 +220,8 @@ CREATE OR REPLACE FUNCTION sp_sla_approvals_excel_export(
   p_to_date             DATE     DEFAULT NULL,
   p_search_text         TEXT     DEFAULT NULL,
   p_sort_by             TEXT     DEFAULT 'created_at',
-  p_sort_order          TEXT     DEFAULT 'DESC'
+  p_sort_order          TEXT     DEFAULT 'DESC',
+  p_extra_filter_sql    TEXT     DEFAULT 'TRUE'
 )
 RETURNS TABLE (
   sheet_order INT, sub_service_id INT, sub_service_name TEXT, sheet_name TEXT, headers JSONB, rows JSONB
@@ -219,7 +231,11 @@ STABLE
 AS $$
 DECLARE
   v_exists TEXT := sla_approval_queue_exists_sql(p_approver_user_id);
-  v_own    TEXT := format('sr.user_id != %s', p_approver_user_id);
+  v_own    TEXT := format(
+    '(%s) AND (%s)',
+    format('sr.user_id != %s', p_approver_user_id),
+    COALESCE(NULLIF(trim(p_extra_filter_sql), ''), 'TRUE')
+  );
 BEGIN
   RETURN QUERY
   SELECT * FROM sp_sla_approvals_workbook_excel_export(
@@ -243,6 +259,10 @@ $$;
 -- Per sub-service Requests + Approvals; optional approver_user_id (NULL = all queues)
 -- Does not exclude own requests (unlike user approvals download)
 -- ---------------------------------------------------------------------------
+DROP FUNCTION IF EXISTS sp_sla_admin_approvals_excel_export(
+  INT, INT[], INT[], TEXT[], TEXT[], DATE, DATE, TEXT, TEXT, TEXT
+);
+
 CREATE OR REPLACE FUNCTION sp_sla_admin_approvals_excel_export(
   p_target_approver_user_id INT      DEFAULT NULL,
   p_service_ids             INT[]    DEFAULT NULL,
@@ -253,7 +273,8 @@ CREATE OR REPLACE FUNCTION sp_sla_admin_approvals_excel_export(
   p_to_date                 DATE     DEFAULT NULL,
   p_search_text             TEXT     DEFAULT NULL,
   p_sort_by                 TEXT     DEFAULT 'created_at',
-  p_sort_order              TEXT     DEFAULT 'DESC'
+  p_sort_order              TEXT     DEFAULT 'DESC',
+  p_extra_filter_sql        TEXT     DEFAULT 'TRUE'
 )
 RETURNS TABLE (
   sheet_order INT, sub_service_id INT, sub_service_name TEXT, sheet_name TEXT, headers JSONB, rows JSONB
@@ -263,7 +284,7 @@ STABLE
 AS $$
 DECLARE
   v_exists TEXT := sla_approval_queue_exists_sql_optional(p_target_approver_user_id);
-  v_own    TEXT := 'TRUE';
+  v_own    TEXT := COALESCE(NULLIF(trim(p_extra_filter_sql), ''), 'TRUE');
 BEGIN
   RETURN QUERY
   SELECT * FROM sp_sla_approvals_workbook_excel_export(

package/sql/sla_reports_procedures.sql

@@ -700,6 +700,8 @@ $$;
 -- MY REQUESTS — Excel workbook payload (one result row per sub-service sheet)
 -- Uses vw_sla_my_requests; flattening and dynamic columns are built in the database.
 -- ---------------------------------------------------------------------------
+DROP FUNCTION IF EXISTS sp_sla_my_requests_excel_export(INT, INT[], INT[], TEXT[], DATE, DATE, TEXT, TEXT, TEXT);
+
 CREATE OR REPLACE FUNCTION sp_sla_my_requests_excel_export(
   p_user_id           INT,
   p_service_ids       INT[]    DEFAULT NULL,
@@ -709,7 +711,8 @@ CREATE OR REPLACE FUNCTION sp_sla_my_requests_excel_export(
   p_to_date           DATE     DEFAULT NULL,
   p_search_text       TEXT     DEFAULT NULL,
   p_sort_by           TEXT     DEFAULT 'created_at',
-  p_sort_order        TEXT     DEFAULT 'DESC'
+  p_sort_order        TEXT     DEFAULT 'DESC',
+  p_extra_filter_sql  TEXT     DEFAULT 'TRUE'
 )
 RETURNS TABLE (
   sheet_order         INT,
@@ -739,7 +742,10 @@ DECLARE
   v_all_rows          JSONB;
   v_k                 TEXT;
   v_sheet_order       INT := 0;
+  v_extra             TEXT;
 BEGIN
+  v_extra := COALESCE(NULLIF(trim(p_extra_filter_sql), ''), 'TRUE');
+
   v_sort_col := CASE lower(trim(p_sort_by))
     WHEN 'updated_at'  THEN 'v.created_at'
     WHEN 'id'          THEN 'v.sla_request_id'
@@ -758,6 +764,7 @@ BEGIN
       INNER JOIN sla_requests sr ON sr.id = v.sla_request_id AND COALESCE(sr.is_deleted, false) = false
       LEFT JOIN caa_sub_services subsvc ON subsvc.id = sr.sub_service_id
       WHERE v.user_id = %1$s
+        AND (%2$s)
         AND v.status = ANY($1)
         AND ($2 IS NULL OR cardinality($2) = 0 OR sr.service_id = ANY($2))
         AND ($3 IS NULL OR cardinality($3) = 0 OR sr.sub_service_id = ANY($3))
@@ -765,24 +772,28 @@ BEGIN
         AND ($5 IS NULL OR v.created_at::date <= $5)
         AND ($6 IS NULL OR trim($6) = '' OR CAST(v.request_id AS TEXT) ILIKE '%%' || trim($6) || '%%')
       ORDER BY sub_service_name ASC
-    $q$, p_user_id)
+    $q$, p_user_id, v_extra)
     USING p_statuses, p_service_ids, p_sub_service_ids, p_from_date, p_to_date, p_search_text
   LOOP
     v_sheet_order := v_sheet_order + 1;
 
-    SELECT COALESCE(array_agg(DISTINCT keys.k ORDER BY keys.k), ARRAY[]::TEXT[])
+    EXECUTE format($q$
+      SELECT COALESCE(array_agg(DISTINCT keys.k ORDER BY keys.k), ARRAY[]::TEXT[])
+      FROM vw_sla_my_requests v
+      INNER JOIN sla_requests sr ON sr.id = v.sla_request_id AND COALESCE(sr.is_deleted, false) = false
+      CROSS JOIN LATERAL jsonb_object_keys(COALESCE(v.request_fields, '{}'::jsonb)) AS keys(k)
+      WHERE v.user_id = %1$s
+        AND (%2$s)
+        AND v.status = ANY($1)
+        AND ($2 IS NULL OR cardinality($2) = 0 OR sr.service_id = ANY($2))
+        AND ($3 IS NULL OR cardinality($3) = 0 OR sr.sub_service_id = ANY($3))
+        AND ($4 IS NULL OR v.created_at::date >= $4)
+        AND ($5 IS NULL OR v.created_at::date <= $5)
+        AND ($6 IS NULL OR trim($6) = '' OR CAST(v.request_id AS TEXT) ILIKE '%%' || trim($6) || '%%')
+        AND COALESCE(sr.sub_service_id, 0) = %3$s
+    $q$, p_user_id, v_extra, v_sub.sub_service_id_num)
     INTO v_dyn_keys
-    FROM vw_sla_my_requests v
-    INNER JOIN sla_requests sr ON sr.id = v.sla_request_id AND COALESCE(sr.is_deleted, false) = false
-    CROSS JOIN LATERAL jsonb_object_keys(COALESCE(v.request_fields, '{}'::jsonb)) AS keys(k)
-    WHERE v.user_id = p_user_id
-      AND v.status = ANY(p_statuses)
-      AND (p_service_ids IS NULL OR cardinality(p_service_ids) = 0 OR sr.service_id = ANY(p_service_ids))
-      AND (p_sub_service_ids IS NULL OR cardinality(p_sub_service_ids) = 0 OR sr.sub_service_id = ANY(p_sub_service_ids))
-      AND (p_from_date IS NULL OR v.created_at::date >= p_from_date)
-      AND (p_to_date IS NULL OR v.created_at::date <= p_to_date)
-      AND (p_search_text IS NULL OR trim(p_search_text) = '' OR CAST(v.request_id AS TEXT) ILIKE '%' || trim(p_search_text) || '%')
-      AND COALESCE(sr.sub_service_id, 0) = v_sub.sub_service_id_num;
+    USING p_statuses, p_service_ids, p_sub_service_ids, p_from_date, p_to_date, p_search_text;
 
     v_dyn_labels := ARRAY[]::TEXT[];
     IF v_dyn_keys IS NOT NULL THEN
@@ -815,15 +826,16 @@ BEGIN
         INNER JOIN sla_requests sr ON sr.id = v.sla_request_id AND COALESCE(sr.is_deleted, false) = false
         LEFT JOIN users u ON u.id = v.user_id AND COALESCE(u.is_deleted, false) = false
         WHERE v.user_id = %1$s
+          AND (%2$s)
           AND v.status = ANY($1)
           AND ($2 IS NULL OR cardinality($2) = 0 OR sr.service_id = ANY($2))
           AND ($3 IS NULL OR cardinality($3) = 0 OR sr.sub_service_id = ANY($3))
           AND ($4 IS NULL OR v.created_at::date >= $4)
           AND ($5 IS NULL OR v.created_at::date <= $5)
           AND ($6 IS NULL OR trim($6) = '' OR CAST(v.request_id AS TEXT) ILIKE '%%' || trim($6) || '%%')
-          AND COALESCE(sr.sub_service_id, 0) = %2$s
-        ORDER BY %3$s %4$s, v.sla_request_id ASC
-      $q$, p_user_id, v_sub.sub_service_id_num, v_sort_col, v_sort_dir)
+          AND COALESCE(sr.sub_service_id, 0) = %3$s
+        ORDER BY %4$s %5$s, v.sla_request_id ASC
+      $q$, p_user_id, v_extra, v_sub.sub_service_id_num, v_sort_col, v_sort_dir)
       USING p_statuses, p_service_ids, p_sub_service_ids, p_from_date, p_to_date, p_search_text
     LOOP
       v_cells := ARRAY[
@@ -859,7 +871,7 @@ BEGIN
   RETURN QUERY
   SELECT *
   FROM sla_my_requests_approvals_excel_sheet(
-    format('v.user_id = %s', p_user_id),
+    format('v.user_id = %s AND (%s)', p_user_id, v_extra),
     p_statuses,
     p_service_ids,
     p_sub_service_ids,

package/src/auth/authenticate-jwt-session.ts

@@ -1,5 +1,9 @@
 import { parseVerifiedJwtClaims } from './jwt-token.helper';
-import { validateUserSessionBinding } from './user-session-validation';
+import {
+  resolveAuthorizedSessionId,
+  validateJwtSessionIsCurrent,
+  validateUserSessionBinding,
+} from './user-session-validation';
 import type { UserSessionReader } from './user-session-validation';
 
 export type JwtAuthFailure = {
@@ -40,12 +44,30 @@ export async function authorizeVerifiedJwtSession(
     if (!sessionValid) {
       return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
     }
+
+    if (parsed.sessionId != null) {
+      const isCurrent = await validateJwtSessionIsCurrent(
+        parsed.userId,
+        parsed.sessionId,
+        sessionReader,
+      );
+      if (!isCurrent) {
+        return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+      }
+    }
   }
 
+  const sessionId = await resolveAuthorizedSessionId(
+    parsed.userId,
+    parsed.sessionId,
+    sessionReader,
+  );
+  const { sessionId: _jwtSessionId, ...claimsWithoutSession } = parsed.raw;
+
   return {
     ok: true,
-    claims: parsed.raw,
+    claims: claimsWithoutSession,
     userId: parsed.userId,
-    sessionId: parsed.sessionId,
+    sessionId,
   };
 }

package/src/auth/user-session-validation.ts

@@ -4,12 +4,24 @@
  * the bound user_sessions row is active and not expired.
  */
 
+export type UserSessionRow = {
+  id?: number;
+};
+
 export type UserSessionReader = {
   isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
   /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
-  isSessionActive?(userId: number): Promise<unknown>;
+  isSessionActive?(userId: number): Promise<UserSessionRow | null | undefined>;
+  /** Latest active session row id for user (highest id). */
+  getLatestActiveSessionId?(userId: number): Promise<number | null>;
 };
 
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+export function isSingleSessionOnLogin(): boolean {
+  const raw = (process.env.SINGLE_SESSION_ON_LOGIN ?? 'true').trim().toLowerCase();
+  return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+
 /** When true (default), JWT must include sessionId and that session must be active. */
 export function isRequireJwtSessionId(): boolean {
   const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
@@ -47,28 +59,70 @@ export async function validateUserSessionBinding(
   return !!legacy;
 }
 
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+export async function validateJwtSessionIsCurrent(
+  userId: number,
+  sessionId: number,
+  reader: UserSessionReader,
+): Promise<boolean> {
+  if (!isSingleSessionOnLogin() || !reader.getLatestActiveSessionId) return true;
+  const latest = await reader.getLatestActiveSessionId(userId);
+  if (latest == null) return true;
+  return latest === sessionId;
+}
+
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+export async function resolveAuthorizedSessionId(
+  userId: number,
+  jwtSessionId: number | null,
+  reader: UserSessionReader,
+): Promise<number | null> {
+  if (jwtSessionId != null) return jwtSessionId;
+
+  if (reader.getLatestActiveSessionId) {
+    return reader.getLatestActiveSessionId(userId);
+  }
+
+  if (!reader.isSessionActive) return null;
+  const legacy = await reader.isSessionActive(userId);
+  const legacyId = Number(legacy?.id);
+  return Number.isFinite(legacyId) && legacyId > 0 ? legacyId : null;
+}
+
 /** Shared TypeORM filters: active, not deleted, not past expires_at. */
 export function applyActiveUserSessionFilters(
   qb: {
     andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+    orderBy?: (sort: string, order?: 'ASC' | 'DESC') => unknown;
   },
   alias = 'user_sessions',
 ): void {
   qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
-  qb.andWhere(`${alias}.is_deleted = :is_deleted`, { is_deleted: false });
+  qb.andWhere(
+    `(${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted)`,
+    { is_deleted: false },
+  );
   qb.andWhere(
     `(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
     { session_now: new Date() },
   );
 }
 
+/** Prefer newest active session when multiple rows match (legacy path). */
+export function applyLatestActiveUserSessionOrdering(
+  qb: { orderBy: (sort: string, order?: 'ASC' | 'DESC') => unknown },
+  alias = 'user_sessions',
+): void {
+  qb.orderBy(`${alias}.id`, 'DESC');
+}
+
 /** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
 export function activeUserSessionSql(alias = 'user_sessions'): {
   clause: string;
   params: Record<string, unknown>;
 } {
   return {
-    clause: `${alias}.is_active = :is_active AND ${alias}.is_deleted = :is_deleted AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+    clause: `${alias}.is_active = :is_active AND (${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted) AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
     params: {
       is_active: true,
       is_deleted: false,

package/src/i18n/workflow-chat-message.builder.ts

@@ -221,7 +221,12 @@ function resolveAssignTasksEmpWorkflowTemplate(
   };
 }
 
-/** Create/submit step for assign-tasks-emp workflow logs. */
+/** Submit/create step for assign-tasks-emp — same as HR / logistics (`Request Submitted`). */
+export function buildAssignTasksEmpSubmittedWorkflowFields(): BilingualText {
+  return buildSynchronizedWorkflowMessage({ action: 'request_submitted' });
+}
+
+/** Task-assigned step (approval pending from assignee) — not the submit row. */
 export function buildAssignTasksEmpAssignedWorkflowFields(): BilingualText {
   return resolveAssignTasksEmpWorkflowTemplate('request_assigned');
 }
@@ -250,9 +255,38 @@ function resolveStoredAssignTasksEmpTemplateKey(
   actors?: BilingualActorNames,
 ): BilingualText | null {
   const normalized = content?.trim();
-  if (!normalized || !(normalized in ASSIGN_TASKS_EMP_WF_FALLBACKS)) return null;
-  if (normalized === 'request_pending_from') {
-    const nameEn = actors?.userName?.trim() || 'Unknown User';
+  if (!normalized) return null;
+
+  if (normalized in ASSIGN_TASKS_EMP_WF_FALLBACKS) {
+    if (normalized === 'request_pending_from') {
+      const nameEn = actors?.userName?.trim() || 'Unknown User';
+      const nameAr = resolveArabicWorkflowActorName(actors, nameEn);
+      return resolveAssignTasksEmpWorkflowTemplate(
+        'request_pending_from',
+        { name: nameEn },
+        { name: nameAr },
+      );
+    }
+    return resolveAssignTasksEmpWorkflowTemplate(normalized as AssignTasksEmpWorkflowTemplateKey);
+  }
+
+  const requestSubmitted = WORKFLOW_TEMPLATES.request_submitted;
+  if (
+    requestSubmitted &&
+    (normalized === requestSubmitted.en ||
+      normalized.toLowerCase() === requestSubmitted.en.toLowerCase())
+  ) {
+    return { en: requestSubmitted.en, ar: requestSubmitted.ar };
+  }
+
+  const requestAssigned = WORKFLOW_TEMPLATES.request_assigned;
+  if (requestAssigned && normalized === requestAssigned.en) {
+    return resolveAssignTasksEmpWorkflowTemplate('request_assigned');
+  }
+
+  const pendingFromPrefix = WORKFLOW_TEMPLATES.request_pending_from?.en.split('{{name}}')[0].trim();
+  if (pendingFromPrefix && normalized.startsWith(pendingFromPrefix)) {
+    const nameEn = normalized.slice(pendingFromPrefix.length).trim();
     const nameAr = resolveArabicWorkflowActorName(actors, nameEn);
     return resolveAssignTasksEmpWorkflowTemplate(
       'request_pending_from',
@@ -260,7 +294,13 @@ function resolveStoredAssignTasksEmpTemplateKey(
       { name: nameAr },
     );
   }
-  return resolveAssignTasksEmpWorkflowTemplate(normalized as AssignTasksEmpWorkflowTemplateKey);
+
+  const requestPending = WORKFLOW_TEMPLATES.request_pending;
+  if (requestPending && normalized === requestPending.en) {
+    return resolveAssignTasksEmpWorkflowTemplate('request_pending');
+  }
+
+  return null;
 }
 
 export function chatTemplate(
@@ -1800,6 +1840,72 @@ function tryResolveItHelpdeskMuscatLegacyWorkflowAr(
     }).ar;
   }
 
+  if (/^IT Technician rejected the request$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'role_outcome_by_user_rejected',
+      roleName: 'IT Technician',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^IT Technician closed the request$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'role_outcome_by_user_closed',
+      roleName: 'IT Technician',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  m = base.match(/^Workflow routed to direct resolution path - request closed by (.+)$/i);
+  if (m) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'routing_direct_approval',
+      roleName: m[1].trim(),
+      roleArabicName: actors?.roleArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^HOS notification not required, request rejected$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'hos_not_required_rejected',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^HOS notification not required, request closed$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'hos_not_required_closed',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^L3 assignment not required, request rejected$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'l3_not_required_rejected',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
+  if (/^L3 assignment not required, request closed$/i.test(base)) {
+    return buildItHelpdeskMuscatWorkflowLog({
+      variant: 'l3_not_required_closed',
+      userName: actors?.userName?.trim() || 'IT Technician',
+      userArabicName: actors?.userArabicName,
+      comment,
+    }).ar;
+  }
+
   return null;
 }
 
@@ -2042,6 +2148,18 @@ export function enrichWorkflowLog(log: Record<string, unknown>): Record<string,
   if (assignTasksEmpResolved) {
     content_ar = assignTasksEmpResolved.ar;
   }
+
+  const submittedTpl = WORKFLOW_TEMPLATES.request_submitted;
+  const assignedTpl = WORKFLOW_TEMPLATES.request_assigned;
+  if (
+    submittedTpl &&
+    assignedTpl &&
+    content === submittedTpl.en &&
+    content_ar === assignedTpl.ar
+  ) {
+    content_ar = submittedTpl.ar;
+  }
+
   return {
     ...log,
     ...(content !== rawContent ? { content } : {}),

package/src/models/DepartmentsModel.ts

@@ -16,6 +16,9 @@ export class Departments extends BaseModel {
     @Column({ nullable: false })
     department_description: string;
 
+    @Column({ type: 'integer', nullable: true, name: 'DG_department_id' })
+    DG_department_id: number | null;
+
     constructor(     
         department_name: string,
         department_code: string,