@platform-modules/foreign-ministry 1.3.336 → 1.3.337

package/.env

@@ -1,11 +1,5 @@
-# DB_HOST=localhost
-# DB_PORT=5432
-# DB_USER=postgres
-# DB_PASS=Fa@123
-# DB_NAME=FM
-
-DB_HOST=164.52.222.169
-DB_PORT=5432 
-DB_USER=postgres_admin_user
-DB_PASS=pg_admin_user_pwd_caa_fa_$%^&OIukhjgcvbn
-DB_NAME=FM
+DB_HOST=localhost
+DB_PORT=5432
+DB_USER=postgres
+DB_PASS=Fa@123
+DB_NAME=FM

package/dist/auth/authenticate-jwt-session.d.ts

@@ -0,0 +1,19 @@
+import type { UserSessionReader } from './user-session-validation';
+export type JwtAuthFailure = {
+    ok: false;
+    statusCode: 401;
+    message: string;
+};
+export type JwtAuthSuccess = {
+    ok: true;
+    claims: Record<string, unknown>;
+    userId: number;
+    sessionId: number | null;
+};
+export type JwtAuthResult = JwtAuthSuccess | JwtAuthFailure;
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+export declare function authorizeVerifiedJwtSession(verified: Record<string, unknown>, sessionReader: UserSessionReader, options?: {
+    requireActiveSession?: boolean;
+}): Promise<JwtAuthResult>;

package/dist/auth/authenticate-jwt-session.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeVerifiedJwtSession = authorizeVerifiedJwtSession;
+const jwt_token_helper_1 = require("./jwt-token.helper");
+const user_session_validation_1 = require("./user-session-validation");
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+async function authorizeVerifiedJwtSession(verified, sessionReader, options) {
+    const parsed = (0, jwt_token_helper_1.parseVerifiedJwtClaims)(verified);
+    if (!parsed) {
+        return { ok: false, statusCode: 401, message: 'Invalid Token' };
+    }
+    const requireActiveSession = options?.requireActiveSession !== false;
+    if (requireActiveSession) {
+        const sessionValid = await (0, user_session_validation_1.validateUserSessionBinding)(parsed.userId, parsed.sessionId, sessionReader);
+        if (!sessionValid) {
+            return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+        }
+        if (parsed.sessionId != null) {
+            const isCurrent = await (0, user_session_validation_1.validateJwtSessionIsCurrent)(parsed.userId, parsed.sessionId, sessionReader);
+            if (!isCurrent) {
+                return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+            }
+        }
+    }
+    const sessionId = await (0, user_session_validation_1.resolveAuthorizedSessionId)(parsed.userId, parsed.sessionId, sessionReader);
+    const { sessionId: _jwtSessionId, ...claimsWithoutSession } = parsed.raw;
+    return {
+        ok: true,
+        claims: claimsWithoutSession,
+        userId: parsed.userId,
+        sessionId,
+    };
+}

package/dist/auth/jwt-token.helper.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Extract portal API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+export declare function extractJwtToken(headers: Record<string, string | string[] | undefined> | undefined): string | null;
+export type JwtTokenRequest = {
+    headers: Record<string, string | string[] | undefined>;
+    body?: unknown;
+};
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+export declare function extractJwtTokenFromRequest(request: JwtTokenRequest): string | null;
+export type VerifiedJwtClaims = {
+    userId: number;
+    sessionId: number | null;
+    raw: Record<string, unknown>;
+};
+/** Parse verified JWT payload into userId + sessionId. */
+export declare function parseVerifiedJwtClaims(verified: Record<string, unknown>): VerifiedJwtClaims | null;

package/dist/auth/jwt-token.helper.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractJwtToken = extractJwtToken;
+exports.extractJwtTokenFromRequest = extractJwtTokenFromRequest;
+exports.parseVerifiedJwtClaims = parseVerifiedJwtClaims;
+/**
+ * Extract portal API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+function extractJwtToken(headers) {
+    if (!headers)
+        return null;
+    const pick = (value) => {
+        const raw = Array.isArray(value) ? value[0] : value;
+        const trimmed = raw?.trim();
+        return trimmed ? trimmed : null;
+    };
+    const fromJwtHeader = pick(headers.jwt ?? headers.JWT);
+    if (fromJwtHeader)
+        return fromJwtHeader;
+    const authorization = pick(headers.authorization ?? headers.Authorization);
+    if (!authorization)
+        return null;
+    const bearerMatch = /^Bearer\s+(.+)$/i.exec(authorization);
+    if (bearerMatch?.[1]?.trim())
+        return bearerMatch[1].trim();
+    return authorization;
+}
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+function extractJwtTokenFromRequest(request) {
+    const fromHeaders = extractJwtToken(request.headers);
+    if (fromHeaders)
+        return fromHeaders;
+    const body = request.body;
+    if (!body || typeof body !== 'object')
+        return null;
+    for (const key of ['token', 'jwt', 'access_token']) {
+        const value = body[key];
+        if (typeof value === 'string' && value.trim())
+            return value.trim();
+    }
+    return null;
+}
+/** Parse verified JWT payload into userId + sessionId. */
+function parseVerifiedJwtClaims(verified) {
+    const userId = Number(verified.userId);
+    if (!Number.isFinite(userId) || userId <= 0)
+        return null;
+    const sessionIdRaw = verified.sessionId;
+    const parsedSessionId = sessionIdRaw == null || sessionIdRaw === '' ? null : Number(sessionIdRaw);
+    return {
+        userId,
+        sessionId: parsedSessionId != null && Number.isFinite(parsedSessionId) && parsedSessionId > 0
+            ? parsedSessionId
+            : null,
+        raw: verified,
+    };
+}

package/dist/auth/user-session-validation.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Server-side JWT session binding (VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+export type UserSessionRow = {
+    id?: number;
+};
+export type UserSessionReader = {
+    isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
+    /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
+    isSessionActive?(userId: number): Promise<UserSessionRow | null | undefined>;
+    /** Latest active session row id for user (highest id). */
+    getLatestActiveSessionId?(userId: number): Promise<number | null>;
+};
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+export declare function isSingleSessionOnLogin(): boolean;
+/** When true (default), JWT must include sessionId and that session must be active. */
+export declare function isRequireJwtSessionId(): boolean;
+export declare function resolveJwtSessionId(sessionId: unknown): number | null;
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+export declare function validateUserSessionBinding(userId: number, sessionId: number | null | undefined, reader: UserSessionReader): Promise<boolean>;
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+export declare function validateJwtSessionIsCurrent(userId: number, sessionId: number, reader: UserSessionReader): Promise<boolean>;
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+export declare function resolveAuthorizedSessionId(userId: number, jwtSessionId: number | null, reader: UserSessionReader): Promise<number | null>;
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+export declare function applyActiveUserSessionFilters(qb: {
+    andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+    orderBy?: (sort: string, order?: 'ASC' | 'DESC') => unknown;
+}, alias?: string): void;
+/** Prefer newest active session when multiple rows match (legacy path). */
+export declare function applyLatestActiveUserSessionOrdering(qb: {
+    orderBy: (sort: string, order?: 'ASC' | 'DESC') => unknown;
+}, alias?: string): void;
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
+export declare function activeUserSessionSql(alias?: string): {
+    clause: string;
+    params: Record<string, unknown>;
+};

package/dist/auth/user-session-validation.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * Server-side JWT session binding (VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSingleSessionOnLogin = isSingleSessionOnLogin;
+exports.isRequireJwtSessionId = isRequireJwtSessionId;
+exports.resolveJwtSessionId = resolveJwtSessionId;
+exports.validateUserSessionBinding = validateUserSessionBinding;
+exports.validateJwtSessionIsCurrent = validateJwtSessionIsCurrent;
+exports.resolveAuthorizedSessionId = resolveAuthorizedSessionId;
+exports.applyActiveUserSessionFilters = applyActiveUserSessionFilters;
+exports.applyLatestActiveUserSessionOrdering = applyLatestActiveUserSessionOrdering;
+exports.activeUserSessionSql = activeUserSessionSql;
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+function isSingleSessionOnLogin() {
+    const raw = (process.env.SINGLE_SESSION_ON_LOGIN ?? 'true').trim().toLowerCase();
+    return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+/** When true (default), JWT must include sessionId and that session must be active. */
+function isRequireJwtSessionId() {
+    const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
+    return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+function resolveJwtSessionId(sessionId) {
+    if (sessionId == null || sessionId === '')
+        return null;
+    const sid = Number(sessionId);
+    if (!Number.isFinite(sid) || sid <= 0)
+        return null;
+    return sid;
+}
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+async function validateUserSessionBinding(userId, sessionId, reader) {
+    if (!Number.isFinite(userId) || userId <= 0)
+        return false;
+    const sid = resolveJwtSessionId(sessionId);
+    if (sid != null) {
+        return reader.isSessionActiveById(sid, userId);
+    }
+    if (isRequireJwtSessionId()) {
+        return false;
+    }
+    if (!reader.isSessionActive)
+        return false;
+    const legacy = await reader.isSessionActive(userId);
+    return !!legacy;
+}
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+async function validateJwtSessionIsCurrent(userId, sessionId, reader) {
+    if (!isSingleSessionOnLogin() || !reader.getLatestActiveSessionId)
+        return true;
+    const latest = await reader.getLatestActiveSessionId(userId);
+    if (latest == null)
+        return true;
+    return latest === sessionId;
+}
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+async function resolveAuthorizedSessionId(userId, jwtSessionId, reader) {
+    if (jwtSessionId != null)
+        return jwtSessionId;
+    if (reader.getLatestActiveSessionId) {
+        return reader.getLatestActiveSessionId(userId);
+    }
+    if (!reader.isSessionActive)
+        return null;
+    const legacy = await reader.isSessionActive(userId);
+    const legacyId = Number(legacy?.id);
+    return Number.isFinite(legacyId) && legacyId > 0 ? legacyId : null;
+}
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+function applyActiveUserSessionFilters(qb, alias = 'user_sessions') {
+    qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
+    qb.andWhere(`(${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted)`, { is_deleted: false });
+    qb.andWhere(`(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`, { session_now: new Date() });
+}
+/** Prefer newest active session when multiple rows match (legacy path). */
+function applyLatestActiveUserSessionOrdering(qb, alias = 'user_sessions') {
+    qb.orderBy(`${alias}.id`, 'DESC');
+}
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
+function activeUserSessionSql(alias = 'user_sessions') {
+    return {
+        clause: `${alias}.is_active = :is_active AND (${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted) AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+        params: {
+            is_active: true,
+            is_deleted: false,
+            session_now: new Date(),
+        },
+    };
+}

package/dist/i18n/workflow-chat-i18n.json

@@ -18,7 +18,7 @@
         },
         "request_approval_pending": {
             "en": "Request Approval Pending",
-            "ar": "في انتظار الموافقة على الطلب"
+            "ar": "الموافقة على الطلب قيد الانتظار"
         },
         "request_approval_in_progress_from": {
             "en": "Request Approval In Progress from {{name}}",
@@ -26,7 +26,7 @@
         },
         "request_approval_pending_from": {
             "en": "Request Approval Pending from {{name}}",
-            "ar": "في انتظار موافقة {{name}}"
+            "ar": "الموافقة على الطلب قيد الانتظار من {{name}}"
         },
         "request_approved_by": {
             "en": "Request Approved by {{name}}{{comment}}",
@@ -46,11 +46,11 @@
         },
         "request_returned_for_modification_by": {
             "en": "Request Returned for Modification by {{name}}{{comment}}",
-            "ar": "تم إرجاع الطلب للتعديل من قبل {{name}}{{comment}}"
+            "ar": "تمت إعادة الطلب للتعديل من قبل {{name}}{{comment}}"
         },
         "request_returned_for_modification": {
             "en": "Request Returned for Modification{{comment}}",
-            "ar": "تم إرجاع الطلب للتعديل{{comment}}"
+            "ar": "تمت إعادة الطلب للتعديل{{comment}}"
         },
         "request_closed_by": {
             "en": "Request Closed by: {{name}}{{comment}}",
@@ -62,47 +62,47 @@
         },
         "it_helpdesk_wf_hos_assigned": {
             "en": "{{approverRoleName}} assigned the request to {{assignedRoleName}}{{comment}}",
-            "ar": "قام {{approverRoleName}} بتعيين الطلب إلى {{assignedRoleName}}{{comment}}"
+            "ar": "تم تعيين الطلب إلى {{assignedRoleName}} من قبل {{approverRoleName}}{{comment}}"
         },
         "it_helpdesk_wf_technician_assigned": {
             "en": "IT technician {{level}} assigned by {{approverRoleName}}{{comment}}",
-            "ar": "تم تعيين فني IT {{level}} بواسطة {{approverRoleName}}{{comment}}"
+            "ar": "تم تعيين فني تقنية المعلومات {{level}} من قبل {{approverRoleName}}{{comment}}"
         },
         "it_helpdesk_wf_reassigned_technician": {
             "en": "{{approverRoleName}} reassigned request to Technician{{comment}}{{modifiers}}",
-            "ar": "أعاد {{approverRoleName}} تعيين الطلب إلى الفني{{comment}}{{modifiers}}"
+            "ar": "{{approverRoleName}} تمت إعادة تعيين الطلب إلى الفني{{comment}}{{modifiers}}"
         },
         "it_helpdesk_wf_reassigned_l3": {
             "en": "{{approverRoleName}} reassigned request to L3{{comment}}{{modifiers}}",
-            "ar": "أعاد {{approverRoleName}} تعيين الطلب إلى L3{{comment}}{{modifiers}}"
+            "ar": "{{approverRoleName}} تمت إعادة تعيين الطلب إلى المستوى الثالث (L3){{comment}}{{modifiers}}"
         },
         "it_helpdesk_wf_reassigned_generic": {
             "en": "{{approverRoleName}} {{level}} reassigned{{comment}}{{modifiers}}",
-            "ar": "أعاد {{approverRoleName}} {{level}} التعيين{{comment}}{{modifiers}}"
+            "ar": "{{approverRoleName}} {{level}} إعادة التعيين{{comment}}{{modifiers}}"
         },
         "it_helpdesk_wf_closed_request": {
             "en": "{{approverRoleName}} closed request{{comment}}",
-            "ar": "أغلق {{approverRoleName}} الطلب{{comment}}"
+            "ar": "تم إغلاق الطلب من قبل {{approverRoleName}}{{comment}}"
         },
         "it_helpdesk_wf_closed_request_cap": {
             "en": "{{approverRoleName}} Closed request{{comment}}",
-            "ar": "أغلق {{approverRoleName}} الطلب{{comment}}"
+            "ar": "تم إغلاق الطلب من قبل {{approverRoleName}}{{comment}}"
         },
         "it_helpdesk_wf_l3_approved_by": {
             "en": "{{roleName}} approved the request by {{userName}}{{comment}}",
-            "ar": "وافق {{roleName}} على الطلب من قبل {{userName}}{{comment}}"
+            "ar": "{{roleName}} تمت الموافقة على الطلب من قبل {{userName}}{{comment}}"
         },
         "it_helpdesk_wf_l3_rejected_by": {
             "en": "{{roleName}} rejected the request by {{userName}}{{comment}}",
-            "ar": "رفض {{roleName}} على الطلب من قبل {{userName}}{{comment}}"
+            "ar": "{{roleName}} تم رفض الطلب من قبل {{userName}}{{comment}}"
         },
         "it_helpdesk_wf_level_approved": {
             "en": "Level {{level}} approved by {{approverRoleName}}{{comment}}",
-            "ar": "تمت الموافقة على المستوى {{level}} من قبل {{approverRoleName}}{{comment}}"
+            "ar": "تمت الموافقة من قبل {{approverRoleName}} للمستوى {{level}}{{comment}}"
         },
         "it_helpdesk_wf_rejected": {
             "en": "{{approverRoleName}} rejected the request{{comment}}",
-            "ar": "رفض {{approverRoleName}} الطلب{{comment}}"
+            "ar": "{{approverRoleName}} تم رفض الطلب{{comment}}"
         },
         "it_helpdesk_wf_status_by_role": {
             "en": "Request {{status}} by {{approverRoleName}}{{comment}}",
@@ -110,29 +110,29 @@
         },
         "it_helpdesk_wf_l3_step_rejected": {
             "en": "{{roleName}} rejected the request{{comment}}",
-            "ar": "رفض {{roleName}} الطلب{{comment}}"
+            "ar": "{{roleName}} تم رفض الطلب{{comment}}"
         },
         "it_helpdesk_wf_technician_completed": {
             "en": "Technician action completed - request closed by {{roleName}}{{comment}}",
-            "ar": "اكتمل إجراء الفني - تم إغلاق الطلب بواسطة {{roleName}}{{comment}}"
+            "ar": "تم استكمال إجراء الفني - تم إغلاق الطلب من قبل {{roleName}}{{comment}}"
         },
         "it_helpdesk_wf_routing_rejected": {
             "en": "Workflow routing completed - request rejected at L3{{comment}}",
-            "ar": "اكتمل توجيه سير العمل - تم رفض الطلب في L3{{comment}}"
+            "ar": "تم استكمال مسار سير العمل - تم رفض الطلب في المستوى الثالث (L3){{comment}}"
         },
         "it_helpdesk_wf_routing_resolved": {
             "en": "Workflow routing completed - request resolved at L3",
-            "ar": "اكتمل توجيه سير العمل - تم حل الطلب في L3"
+            "ar": "تم استكمال مسار سير العمل - تم حل الطلب في المستوى الثالث (L3)"
         }
     },
     "chatTemplates": {
         "request_submitted_by": {
             "en": "Request Submitted by {{userName}} ({{employeeId}})",
-            "ar": "تم تقديم الطلب بواسطة {{userName}} ({{employeeId}})"
+            "ar": "تم تقديم الطلب من قبل {{userName}} ({{employeeId}})"
         },
         "cancellation_submitted_by": {
             "en": "Cancellation request submitted by {{userName}} ({{employeeId}})",
-            "ar": "تم تقديم طلب الإلغاء بواسطة {{userName}} ({{employeeId}})"
+            "ar": "تم تقديم طلب الإلغاء من قبل {{userName}} ({{employeeId}})"
         },
         "cancellation_submitted": {
             "en": "Cancellation request submitted",
@@ -152,7 +152,7 @@
         },
         "request_returned_for_modification_by_role": {
             "en": "Request Returned for Modification by: {{roleName}}{{comment}}",
-            "ar": "تم إرجاع الطلب للتعديل من قبل: {{roleName}}{{comment}}"
+            "ar": "تمت إعادة الطلب للتعديل من قبل: {{roleName}}{{comment}}"
         },
         "request_approved": {
             "en": "Request Approved{{comment}}",
@@ -164,7 +164,7 @@
         },
         "request_returned_for_modification": {
             "en": "Request Returned for Modification{{comment}}",
-            "ar": "تم إرجاع الطلب للتعديل{{comment}}"
+            "ar": "تمت إعادة الطلب للتعديل{{comment}}"
         },
         "request_closed_by_role": {
             "en": "Request Closed by: {{roleName}}{{comment}}",
@@ -172,11 +172,11 @@
         },
         "request_for_change_by_role": {
             "en": "Request For Change by: {{roleName}}{{comment}}",
-            "ar": "طلب تعديل من قبل: {{roleName}}{{comment}}"
+            "ar": "طلب تغيير من قبل: {{roleName}}{{comment}}"
         },
         "request_for_change_requested_by_role": {
             "en": "Request For Change requested by: {{roleName}}{{comment}}",
-            "ar": "تم طلب التعديل من قبل: {{roleName}}{{comment}}"
+            "ar": "تم طلب التغيير من قبل: {{roleName}}{{comment}}"
         },
         "attachment_uploaded": {
             "en": "Attachment uploaded: {{fileName}}",
@@ -188,11 +188,11 @@
         },
         "task_status_in_progress_by_role": {
             "en": "Task status updated to \"In Progress\" by: {{roleName}}",
-            "ar": "تم تحديث حالة المهمة إلى \"قيد التنفيذ\" بواسطة: {{roleName}}"
+            "ar": "تم تحديث حالة المهمة إلى \"قيد التنفيذ\" من قبل: {{roleName}}"
         },
         "task_completed_by_role": {
             "en": "Task Completed by: {{roleName}}{{comment}}",
-            "ar": "تم إكمال المهمة بواسطة: {{roleName}}{{comment}}"
+            "ar": "اكتملت المهمة من قبل: {{roleName}}{{comment}}"
         },
         "task_status_updated": {
             "en": "Task status updated to {{status}}",
@@ -204,23 +204,23 @@
         },
         "it_helpdesk_technician_assigned": {
             "en": "IT technician {{level}} assigned to {{assignedRoleName}}: {{assignedUserName}}{{comment}}",
-            "ar": "تم تعيين فني IT {{level}} إلى {{assignedRoleName}}: {{assignedUserName}}{{comment}}"
+            "ar": "تم تعيين فني تقنية المعلومات {{level}} إلى {{assignedRoleName}}: {{assignedUserName}}{{comment}}"
         },
         "it_helpdesk_reassigned_to_role": {
             "en": "{{approverRoleName}} reassigned request to {{reassignedRoleName}}{{comment}}",
-            "ar": "أعاد {{approverRoleName}} تعيين الطلب إلى {{reassignedRoleName}}{{comment}}"
+            "ar": "{{approverRoleName}} تمت إعادة تعيين الطلب إلى {{reassignedRoleName}}{{comment}}"
         },
         "it_helpdesk_reassigned_to_l3": {
             "en": "{{approverRoleName}} reassigned request to L3{{comment}}",
-            "ar": "أعاد {{approverRoleName}} تعيين الطلب إلى L3{{comment}}"
+            "ar": "{{approverRoleName}} تمت إعادة تعيين الطلب إلى المستوى الثالث (L3){{comment}}"
         },
         "it_helpdesk_reassigned_generic": {
             "en": "{{approverRoleName}} {{level}} reassigned the request{{comment}}",
-            "ar": "أعاد {{approverRoleName}} {{level}} تعيين الطلب{{comment}}"
+            "ar": "{{approverRoleName}} {{level}} تمت إعادة تعيين الطلب{{comment}}"
         },
         "request_submitted_with_ref": {
             "en": "{{requestLabel}} #{{requestId}} has been submitted by {{userName}} ({{employeeId}})",
-            "ar": "تم تقديم {{requestLabel}} رقم {{requestId}} بواسطة {{userName}} ({{employeeId}})"
+            "ar": "تم تقديم {{requestLabel}} رقم {{requestId}} من قبل {{userName}} ({{employeeId}})"
         },
         "security_access_approval_step": {
             "en": "{{productLabel}} request #{{requestId}} was {{statusWord}} (approval step {{approvalLevel}}).{{comment}}",
@@ -228,7 +228,7 @@
         },
         "logistics_actual_return_updated": {
             "en": "{{roleName}} updated the Vehicle Actual Return Date, Time, and Reason. Actual Return Date: {{date}}, Actual Return Time: {{time}}, Reason: {{reason}}",
-            "ar": "قام {{roleName}} بتحديث تاريخ ووقت وسبب الإرجاع الفعلي للمركبة. تاريخ الإرجاع الفعلي: {{date}}، وقت الإرجاع الفعلي: {{time}}، السبب: {{reason}}"
+            "ar": "قام {{roleName}} بتحديث تاريخ الإرجاع الفعلي للمركبة والوقت والسبب. تاريخ الإرجاع الفعلي: {{date}}، وقت الإرجاع الفعلي: {{time}}، السبب: {{reason}}"
         }
     },
     "notificationTemplates": {
@@ -238,11 +238,11 @@
         },
         "it_helpdesk_notif_request_closed": {
             "en": "IT request #{{requestId}} has been closed",
-            "ar": "تم إغلاق طلب IT رقم {{requestId}}"
+            "ar": "تم إغلاق طلب تقنية المعلومات رقم {{requestId}}"
         },
         "it_helpdesk_notif_request_rejected": {
             "en": "IT request #{{requestId}} has been rejected",
-            "ar": "تم رفض طلب IT رقم {{requestId}}"
+            "ar": "تم رفض طلب تقنية المعلومات رقم {{requestId}}"
         },
         "fm_request_submitted_title": {
             "en": "Request Submitted",
@@ -305,15 +305,15 @@
     "chatStatusLabels": {
         "Submitted": "تم التقديم",
         "Received": "تم الاستلام",
-        "Approved": "موافق عليه",
-        "Rejected": "مرفوض",
+        "Approved": "تم الموافقة",
+        "Rejected": "تم الرفض",
         "Pending": "قيد الانتظار",
-        "Returned for Modification": "أُعيد للتعديل",
-        "Request For Change": "طلب تعديل",
+        "Returned for Modification": "تمت إعادته للتعديل",
+        "Request For Change": "طلب تغيير",
         "Closed": "مغلق",
         "Completed": "مكتمل",
-        "Assigned": "معيّن",
-        "Reassigned": "أعيد التعيين",
+        "Assigned": "تم التعيين",
+        "Reassigned": "تمت إعادة التعيين",
         "In Progress": "قيد التنفيذ",
         "Attachment uploaded": "تم رفع المرفق"
     }

package/dist/i18n/workflow-chat-message.builder.d.ts

@@ -96,6 +96,13 @@ export declare function toChatPersistFields(bilingual: BilingualText, status: st
     status: string;
     status_ar: string | null;
 };
+/** User-typed chat — never auto-translate; message_ar stays null. */
+export declare function buildUserEnteredChatPersistFields(message: string, status: string): {
+    message: string;
+    message_ar: null;
+    status: string;
+    status_ar: string | null;
+};
 /** Bilingual chat insert fields for models using `content` column (Leave, Financial, etc.). */
 export declare function toContentChatPersistFields(bilingual: BilingualText, status: string): {
     content: string;
@@ -306,6 +313,8 @@ export declare function resolveChatStatusAr(status: string | null | undefined):
 export declare function extractBilingualActorsFromRecord(record: Record<string, unknown>): BilingualActorNames;
 export declare function resolveWorkflowContentAr(content: string | null | undefined, actors?: BilingualActorNames): string | null;
 export declare function resolveChatMessageAr(message: string | null | undefined, actors?: BilingualActorNames): string | null;
+/** True when message matches a known system chat template (safe to resolve message_ar). */
+export declare function isSystemGeneratedChatMessage(message: string | null | undefined, actors?: BilingualActorNames): boolean;
 /** Generic workflow log enricher — use in all module repositories. */
 export declare function enrichWorkflowLog(log: Record<string, unknown>): Record<string, unknown>;
 /** Generic chat enricher — use in all module repositories. Handles `message` or `content` column. */