@platform-modules/foreign-ministry 1.3.337 → 1.3.338

package/src/models/SlaMyRequestsViewModel.ts

@@ -1,172 +1,172 @@
-import { ViewColumn, ViewEntity } from "typeorm";
-import { SlaRequestStatus } from "./SlaRequestModel";
-
-/** Top-level `request_obj` keys omitted from `request_fields` (see sql/vw_sla_my_requests.sql). */
-export const SLA_MY_REQUESTS_REQUEST_OBJ_EXCLUDED_KEYS = [
-    "id",
-    "status",
-    "role_id",
-    "user_id",
-    "createdBy",
-    "created_at",
-    "updated_by",
-    "updated_at",
-    "req_user_department_id",
-    "workflow_execution_id",
-    "department_id",
-    "req_user_section_id",
-    "service_type_id",
-    "service_type",
-    "created_by",
-    "service_id",
-    "sub_service_id",
-    "attachments",
-    "is_deleted",
-    "sla_request",
-    "sla_request_id",
-] as const;
-
-const VW_SLA_MY_REQUESTS_SQL = `
-SELECT
-    sr.id AS sla_request_id,
-    sr.user_id,
-    sr.service_id AS service_id,
-    sr.sub_service_id AS sub_service_id,
-    TRIM(COALESCE(creator.employee_name, ''))::TEXT AS created_by,
-    sr.created_at,
-    TRIM(COALESCE(dept.department_name, ''))::TEXT AS req_user_department_id,
-    TRIM(COALESCE(sec.section_name, ''))::TEXT AS req_user_section_id,
-    TRIM(COALESCE(svc.name, ''))::TEXT AS service_name,
-    TRIM(COALESCE(subsvc.sub_service_name, ''))::TEXT AS sub_service_name,
-    sr.status::TEXT AS status,
-    sr.request_id,
-    (
-        COALESCE(sr.request_obj, '{}'::jsonb)
-        - 'id'
-        - 'status'
-        - 'role_id'
-        - 'user_id'
-        - 'createdBy'
-        - 'created_at'
-        - 'updated_by'
-        - 'updated_at'
-        - 'req_user_department_id'
-        - 'workflow_execution_id'
-        - 'department_id'
-        - 'req_user_section_id'
-        - 'service_type_id'
-        - 'service_type'
-        - 'created_by'
-        - 'service_id'
-        - 'sub_service_id'
-        - 'attachments'
-        - 'is_deleted'
-        - 'sla_request'
-        - 'sla_request_id'
-    ) AS request_fields
-FROM sla_requests sr
-LEFT JOIN users creator
-    ON sr.created_by ~ '^[0-9]+$'
-    AND creator.id = sr.created_by::integer
-    AND COALESCE(creator.is_deleted, false) = false
-LEFT JOIN departments dept
-    ON dept.id = sr.req_user_department_id AND COALESCE(dept.is_deleted, false) = false
-LEFT JOIN sections sec
-    ON sec.id = sr.req_user_section_id AND COALESCE(sec.is_deleted, false) = false
-LEFT JOIN fm_services svc
-    ON svc.id = sr.service_id AND COALESCE(svc.is_deleted, false) = false
-LEFT JOIN fm_sub_services subsvc
-    ON subsvc.id = sr.sub_service_id AND COALESCE(subsvc.is_deleted, false) = false
-WHERE COALESCE(sr.is_deleted, false) = false
-`;
-
-/**
- * Read-only view for SLA "my requests" listings.
- * Display-name columns reuse sla_requests field names; values come from joined lookup tables.
- * Service-specific payload keys live in `request_fields` (filtered `request_obj`).
- */
-@ViewEntity({
-    name: "vw_sla_my_requests",
-    expression: VW_SLA_MY_REQUESTS_SQL,
-})
-export class SlaMyRequestsView {
-    @ViewColumn()
-    sla_request_id: number;
-
-    /** Request owner (`sla_requests.user_id`) — filter with WHERE user_id = :userId for "my requests". */
-    @ViewColumn()
-    user_id: number;
-
-    /** Numeric fm_services.id used for filtering. */
-    @ViewColumn()
-    service_id: number;
-
-    /** Numeric fm_sub_services.id used for filtering. */
-    @ViewColumn()
-    sub_service_id: number;
-
-    @ViewColumn()
-    created_by: string;
-
-    @ViewColumn()
-    created_at: Date;
-
-    @ViewColumn()
-    req_user_department_id: string;
-
-    @ViewColumn()
-    req_user_section_id: string;
-
-    @ViewColumn()
-    service_name: string;
-
-    @ViewColumn()
-    sub_service_name: string;
-
-    @ViewColumn()
-    status: SlaRequestStatus | string;
-
-    @ViewColumn()
-    request_id: number;
-
-    /** Remaining `request_obj` keys after excluding workflow/common duplicates. */
-    @ViewColumn()
-    request_fields: Record<string, unknown>;
-}
-
-/** Flatten view row: fixed columns plus each entry in `request_fields`. */
-export function flattenSlaMyRequestsViewRow(
-    row: SlaMyRequestsView
-): Record<string, unknown> {
-    const {
-        sla_request_id,
-        user_id,
-        service_id,
-        sub_service_id,
-        created_by,
-        created_at,
-        req_user_department_id,
-        req_user_section_id,
-        service_name,
-        sub_service_name,
-        status,
-        request_id,
-        request_fields,
-    } = row;
-
-    return {
-        sla_request_id,
-        user_id,
-        service_id,
-        sub_service_id,
-        created_by,
-        created_at,
-        req_user_department_id,
-        req_user_section_id,
-        service_name,
-        sub_service_name,
-        status,
-        request_id,
-        ...(request_fields ?? {}),
-    };
-}
+import { ViewColumn, ViewEntity } from "typeorm";
+import { SlaRequestStatus } from "./SlaRequestModel";
+
+/** Top-level `request_obj` keys omitted from `request_fields` (see sql/vw_sla_my_requests.sql). */
+export const SLA_MY_REQUESTS_REQUEST_OBJ_EXCLUDED_KEYS = [
+    "id",
+    "status",
+    "role_id",
+    "user_id",
+    "createdBy",
+    "created_at",
+    "updated_by",
+    "updated_at",
+    "req_user_department_id",
+    "workflow_execution_id",
+    "department_id",
+    "req_user_section_id",
+    "service_type_id",
+    "service_type",
+    "created_by",
+    "service_id",
+    "sub_service_id",
+    "attachments",
+    "is_deleted",
+    "sla_request",
+    "sla_request_id",
+] as const;
+
+const VW_SLA_MY_REQUESTS_SQL = `
+SELECT
+    sr.id AS sla_request_id,
+    sr.user_id,
+    sr.service_id AS service_id,
+    sr.sub_service_id AS sub_service_id,
+    TRIM(COALESCE(creator.employee_name, ''))::TEXT AS created_by,
+    sr.created_at,
+    TRIM(COALESCE(dept.department_name, ''))::TEXT AS req_user_department_id,
+    TRIM(COALESCE(sec.section_name, ''))::TEXT AS req_user_section_id,
+    TRIM(COALESCE(svc.name, ''))::TEXT AS service_name,
+    TRIM(COALESCE(subsvc.sub_service_name, ''))::TEXT AS sub_service_name,
+    sr.status::TEXT AS status,
+    sr.request_id,
+    (
+        COALESCE(sr.request_obj, '{}'::jsonb)
+        - 'id'
+        - 'status'
+        - 'role_id'
+        - 'user_id'
+        - 'createdBy'
+        - 'created_at'
+        - 'updated_by'
+        - 'updated_at'
+        - 'req_user_department_id'
+        - 'workflow_execution_id'
+        - 'department_id'
+        - 'req_user_section_id'
+        - 'service_type_id'
+        - 'service_type'
+        - 'created_by'
+        - 'service_id'
+        - 'sub_service_id'
+        - 'attachments'
+        - 'is_deleted'
+        - 'sla_request'
+        - 'sla_request_id'
+    ) AS request_fields
+FROM sla_requests sr
+LEFT JOIN users creator
+    ON sr.created_by ~ '^[0-9]+$'
+    AND creator.id = sr.created_by::integer
+    AND COALESCE(creator.is_deleted, false) = false
+LEFT JOIN departments dept
+    ON dept.id = sr.req_user_department_id AND COALESCE(dept.is_deleted, false) = false
+LEFT JOIN sections sec
+    ON sec.id = sr.req_user_section_id AND COALESCE(sec.is_deleted, false) = false
+LEFT JOIN fm_services svc
+    ON svc.id = sr.service_id AND COALESCE(svc.is_deleted, false) = false
+LEFT JOIN fm_sub_services subsvc
+    ON subsvc.id = sr.sub_service_id AND COALESCE(subsvc.is_deleted, false) = false
+WHERE COALESCE(sr.is_deleted, false) = false
+`;
+
+/**
+ * Read-only view for SLA "my requests" listings.
+ * Display-name columns reuse sla_requests field names; values come from joined lookup tables.
+ * Service-specific payload keys live in `request_fields` (filtered `request_obj`).
+ */
+@ViewEntity({
+    name: "vw_sla_my_requests",
+    expression: VW_SLA_MY_REQUESTS_SQL,
+})
+export class SlaMyRequestsView {
+    @ViewColumn()
+    sla_request_id: number;
+
+    /** Request owner (`sla_requests.user_id`) — filter with WHERE user_id = :userId for "my requests". */
+    @ViewColumn()
+    user_id: number;
+
+    /** Numeric fm_services.id used for filtering. */
+    @ViewColumn()
+    service_id: number;
+
+    /** Numeric fm_sub_services.id used for filtering. */
+    @ViewColumn()
+    sub_service_id: number;
+
+    @ViewColumn()
+    created_by: string;
+
+    @ViewColumn()
+    created_at: Date;
+
+    @ViewColumn()
+    req_user_department_id: string;
+
+    @ViewColumn()
+    req_user_section_id: string;
+
+    @ViewColumn()
+    service_name: string;
+
+    @ViewColumn()
+    sub_service_name: string;
+
+    @ViewColumn()
+    status: SlaRequestStatus | string;
+
+    @ViewColumn()
+    request_id: number;
+
+    /** Remaining `request_obj` keys after excluding workflow/common duplicates. */
+    @ViewColumn()
+    request_fields: Record<string, unknown>;
+}
+
+/** Flatten view row: fixed columns plus each entry in `request_fields`. */
+export function flattenSlaMyRequestsViewRow(
+    row: SlaMyRequestsView
+): Record<string, unknown> {
+    const {
+        sla_request_id,
+        user_id,
+        service_id,
+        sub_service_id,
+        created_by,
+        created_at,
+        req_user_department_id,
+        req_user_section_id,
+        service_name,
+        sub_service_name,
+        status,
+        request_id,
+        request_fields,
+    } = row;
+
+    return {
+        sla_request_id,
+        user_id,
+        service_id,
+        sub_service_id,
+        created_by,
+        created_at,
+        req_user_department_id,
+        req_user_section_id,
+        service_name,
+        sub_service_name,
+        status,
+        request_id,
+        ...(request_fields ?? {}),
+    };
+}

package/src/models/SlaRequestModel.ts

@@ -1,57 +1,57 @@
-import { Column, Entity, Index } from "typeorm";
-import { BaseModel } from "./BaseModel";
-
-export enum SlaRequestStatus {
-    PENDING = "Pending",
-    IN_PROGRESS = "In Progress",
-    APPROVED = "Approved",
-    REJECTED = "Rejected",
-    ASSIGNED = "Assigned",
-    COMPLETED = "Completed"
-}
-
-@Entity({ name: "sla_requests" })
-// @Index("uq_sla_requests_request_id", ["request_id"])
-@Index("idx_sla_requests_user_id", ["user_id"])
-@Index("idx_sla_requests_service_subservice", ["service_id", "sub_service_id"])
-@Index("idx_sla_requests_workflow_execution_id", ["workflow_execution_id"])
-@Index("idx_sla_requests_status", ["status"])
-export class SlaRequest extends BaseModel {
-    @Column({ type: "int", nullable: true })
-    req_user_department_id: number | null;
-
-    @Column({ type: "int", nullable: true })
-    req_user_section_id: number | null;
-
-    @Column({ type: "int", nullable: true })
-    service_id: number | null;
-
-    @Column({ type: "int", nullable: true })
-    sub_service_id: number | null;
-
-    @Column({ type: "int", nullable: false })
-    user_id: number;
-
-    @Column({
-        type: "varchar",
-        length: 64,
-        default: SlaRequestStatus.PENDING,
-        nullable: false
-    })
-    status: string;
-
-    @Column({ type: "varchar", length: 255, nullable: true })
-    workflow_execution_id: string | null;
-
-    @Column({ type: "int", nullable: false })
-    request_id: number;
-
-    @Column({ type: "jsonb", nullable: false, default: () => "'{}'::jsonb" })
-    request_obj: Record<string, unknown>;
-
-    constructor() {
-        super();
-        this.request_id = 0;
-        this.request_obj = {};
-    }
-}
+import { Column, Entity, Index } from "typeorm";
+import { BaseModel } from "./BaseModel";
+
+export enum SlaRequestStatus {
+    PENDING = "Pending",
+    IN_PROGRESS = "In Progress",
+    APPROVED = "Approved",
+    REJECTED = "Rejected",
+    ASSIGNED = "Assigned",
+    COMPLETED = "Completed"
+}
+
+@Entity({ name: "sla_requests" })
+// @Index("uq_sla_requests_request_id", ["request_id"])
+@Index("idx_sla_requests_user_id", ["user_id"])
+@Index("idx_sla_requests_service_subservice", ["service_id", "sub_service_id"])
+@Index("idx_sla_requests_workflow_execution_id", ["workflow_execution_id"])
+@Index("idx_sla_requests_status", ["status"])
+export class SlaRequest extends BaseModel {
+    @Column({ type: "int", nullable: true })
+    req_user_department_id: number | null;
+
+    @Column({ type: "int", nullable: true })
+    req_user_section_id: number | null;
+
+    @Column({ type: "int", nullable: true })
+    service_id: number | null;
+
+    @Column({ type: "int", nullable: true })
+    sub_service_id: number | null;
+
+    @Column({ type: "int", nullable: false })
+    user_id: number;
+
+    @Column({
+        type: "varchar",
+        length: 64,
+        default: SlaRequestStatus.PENDING,
+        nullable: false
+    })
+    status: string;
+
+    @Column({ type: "varchar", length: 255, nullable: true })
+    workflow_execution_id: string | null;
+
+    @Column({ type: "int", nullable: false })
+    request_id: number;
+
+    @Column({ type: "jsonb", nullable: false, default: () => "'{}'::jsonb" })
+    request_obj: Record<string, unknown>;
+
+    constructor() {
+        super();
+        this.request_id = 0;
+        this.request_obj = {};
+    }
+}

package/src/sla-report-views.ts

@@ -1,3 +1,3 @@
-/** SLA report views — import from `@platform-modules/foreign-ministry/sla-report-views` (Reports_Service only). Not in main index to avoid TypeORM synchronize conflicts. */
-export * from './models/SlaMyRequestsViewModel';
-export * from './models/SlaApprovalsViewModel';
+/** SLA report views — import from `@platform-modules/foreign-ministry/sla-report-views` (Reports_Service only). Not in main index to avoid TypeORM synchronize conflicts. */
+export * from './models/SlaMyRequestsViewModel';
+export * from './models/SlaApprovalsViewModel';

package/dist/auth/authenticate-jwt-session.d.ts

@@ -1,19 +0,0 @@
-import type { UserSessionReader } from './user-session-validation';
-export type JwtAuthFailure = {
-    ok: false;
-    statusCode: 401;
-    message: string;
-};
-export type JwtAuthSuccess = {
-    ok: true;
-    claims: Record<string, unknown>;
-    userId: number;
-    sessionId: number | null;
-};
-export type JwtAuthResult = JwtAuthSuccess | JwtAuthFailure;
-/**
- * After jwt.verify(), enforce server-side session binding (logout revocation).
- */
-export declare function authorizeVerifiedJwtSession(verified: Record<string, unknown>, sessionReader: UserSessionReader, options?: {
-    requireActiveSession?: boolean;
-}): Promise<JwtAuthResult>;

package/dist/auth/authenticate-jwt-session.js

@@ -1,35 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorizeVerifiedJwtSession = authorizeVerifiedJwtSession;
-const jwt_token_helper_1 = require("./jwt-token.helper");
-const user_session_validation_1 = require("./user-session-validation");
-/**
- * After jwt.verify(), enforce server-side session binding (logout revocation).
- */
-async function authorizeVerifiedJwtSession(verified, sessionReader, options) {
-    const parsed = (0, jwt_token_helper_1.parseVerifiedJwtClaims)(verified);
-    if (!parsed) {
-        return { ok: false, statusCode: 401, message: 'Invalid Token' };
-    }
-    const requireActiveSession = options?.requireActiveSession !== false;
-    if (requireActiveSession) {
-        const sessionValid = await (0, user_session_validation_1.validateUserSessionBinding)(parsed.userId, parsed.sessionId, sessionReader);
-        if (!sessionValid) {
-            return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
-        }
-        if (parsed.sessionId != null) {
-            const isCurrent = await (0, user_session_validation_1.validateJwtSessionIsCurrent)(parsed.userId, parsed.sessionId, sessionReader);
-            if (!isCurrent) {
-                return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
-            }
-        }
-    }
-    const sessionId = await (0, user_session_validation_1.resolveAuthorizedSessionId)(parsed.userId, parsed.sessionId, sessionReader);
-    const { sessionId: _jwtSessionId, ...claimsWithoutSession } = parsed.raw;
-    return {
-        ok: true,
-        claims: claimsWithoutSession,
-        userId: parsed.userId,
-        sessionId,
-    };
-}

package/dist/auth/jwt-token.helper.d.ts

@@ -1,18 +0,0 @@
-/**
- * Extract portal API JWT from standard request headers.
- * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
- */
-export declare function extractJwtToken(headers: Record<string, string | string[] | undefined> | undefined): string | null;
-export type JwtTokenRequest = {
-    headers: Record<string, string | string[] | undefined>;
-    body?: unknown;
-};
-/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
-export declare function extractJwtTokenFromRequest(request: JwtTokenRequest): string | null;
-export type VerifiedJwtClaims = {
-    userId: number;
-    sessionId: number | null;
-    raw: Record<string, unknown>;
-};
-/** Parse verified JWT payload into userId + sessionId. */
-export declare function parseVerifiedJwtClaims(verified: Record<string, unknown>): VerifiedJwtClaims | null;

package/dist/auth/jwt-token.helper.js

@@ -1,58 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractJwtToken = extractJwtToken;
-exports.extractJwtTokenFromRequest = extractJwtTokenFromRequest;
-exports.parseVerifiedJwtClaims = parseVerifiedJwtClaims;
-/**
- * Extract portal API JWT from standard request headers.
- * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
- */
-function extractJwtToken(headers) {
-    if (!headers)
-        return null;
-    const pick = (value) => {
-        const raw = Array.isArray(value) ? value[0] : value;
-        const trimmed = raw?.trim();
-        return trimmed ? trimmed : null;
-    };
-    const fromJwtHeader = pick(headers.jwt ?? headers.JWT);
-    if (fromJwtHeader)
-        return fromJwtHeader;
-    const authorization = pick(headers.authorization ?? headers.Authorization);
-    if (!authorization)
-        return null;
-    const bearerMatch = /^Bearer\s+(.+)$/i.exec(authorization);
-    if (bearerMatch?.[1]?.trim())
-        return bearerMatch[1].trim();
-    return authorization;
-}
-/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
-function extractJwtTokenFromRequest(request) {
-    const fromHeaders = extractJwtToken(request.headers);
-    if (fromHeaders)
-        return fromHeaders;
-    const body = request.body;
-    if (!body || typeof body !== 'object')
-        return null;
-    for (const key of ['token', 'jwt', 'access_token']) {
-        const value = body[key];
-        if (typeof value === 'string' && value.trim())
-            return value.trim();
-    }
-    return null;
-}
-/** Parse verified JWT payload into userId + sessionId. */
-function parseVerifiedJwtClaims(verified) {
-    const userId = Number(verified.userId);
-    if (!Number.isFinite(userId) || userId <= 0)
-        return null;
-    const sessionIdRaw = verified.sessionId;
-    const parsedSessionId = sessionIdRaw == null || sessionIdRaw === '' ? null : Number(sessionIdRaw);
-    return {
-        userId,
-        sessionId: parsedSessionId != null && Number.isFinite(parsedSessionId) && parsedSessionId > 0
-            ? parsedSessionId
-            : null,
-        raw: verified,
-    };
-}

package/dist/auth/user-session-validation.d.ts

@@ -1,42 +0,0 @@
-/**
- * Server-side JWT session binding (VAPT M003/M004).
- * JWT remains valid cryptographically until exp; access is allowed only while
- * the bound user_sessions row is active and not expired.
- */
-export type UserSessionRow = {
-    id?: number;
-};
-export type UserSessionReader = {
-    isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
-    /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
-    isSessionActive?(userId: number): Promise<UserSessionRow | null | undefined>;
-    /** Latest active session row id for user (highest id). */
-    getLatestActiveSessionId?(userId: number): Promise<number | null>;
-};
-/** Default true — only the newest active session may use the API when JWT carries sessionId. */
-export declare function isSingleSessionOnLogin(): boolean;
-/** When true (default), JWT must include sessionId and that session must be active. */
-export declare function isRequireJwtSessionId(): boolean;
-export declare function resolveJwtSessionId(sessionId: unknown): number | null;
-/**
- * Validate that a verified JWT is still authorized (not logged out / expired server-side).
- */
-export declare function validateUserSessionBinding(userId: number, sessionId: number | null | undefined, reader: UserSessionReader): Promise<boolean>;
-/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
-export declare function validateJwtSessionIsCurrent(userId: number, sessionId: number, reader: UserSessionReader): Promise<boolean>;
-/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
-export declare function resolveAuthorizedSessionId(userId: number, jwtSessionId: number | null, reader: UserSessionReader): Promise<number | null>;
-/** Shared TypeORM filters: active, not deleted, not past expires_at. */
-export declare function applyActiveUserSessionFilters(qb: {
-    andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
-    orderBy?: (sort: string, order?: 'ASC' | 'DESC') => unknown;
-}, alias?: string): void;
-/** Prefer newest active session when multiple rows match (legacy path). */
-export declare function applyLatestActiveUserSessionOrdering(qb: {
-    orderBy: (sort: string, order?: 'ASC' | 'DESC') => unknown;
-}, alias?: string): void;
-/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
-export declare function activeUserSessionSql(alias?: string): {
-    clause: string;
-    params: Record<string, unknown>;
-};