@platform-modules/foreign-ministry 1.3.355 → 1.3.359

package/dist/auth/authenticate-jwt-session.d.ts

@@ -0,0 +1,19 @@
+import type { UserSessionReader } from './user-session-validation';
+export type JwtAuthFailure = {
+    ok: false;
+    statusCode: 401;
+    message: string;
+};
+export type JwtAuthSuccess = {
+    ok: true;
+    claims: Record<string, unknown>;
+    userId: number;
+    sessionId: number | null;
+};
+export type JwtAuthResult = JwtAuthSuccess | JwtAuthFailure;
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+export declare function authorizeVerifiedJwtSession(verified: Record<string, unknown>, sessionReader: UserSessionReader, options?: {
+    requireActiveSession?: boolean;
+}): Promise<JwtAuthResult>;

package/dist/auth/authenticate-jwt-session.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeVerifiedJwtSession = authorizeVerifiedJwtSession;
+const jwt_token_helper_1 = require("./jwt-token.helper");
+const user_session_validation_1 = require("./user-session-validation");
+/**
+ * After jwt.verify(), enforce server-side session binding (logout revocation).
+ */
+async function authorizeVerifiedJwtSession(verified, sessionReader, options) {
+    const parsed = (0, jwt_token_helper_1.parseVerifiedJwtClaims)(verified);
+    if (!parsed) {
+        return { ok: false, statusCode: 401, message: 'Invalid Token' };
+    }
+    const requireActiveSession = options?.requireActiveSession !== false;
+    if (requireActiveSession) {
+        const sessionValid = await (0, user_session_validation_1.validateUserSessionBinding)(parsed.userId, parsed.sessionId, sessionReader);
+        if (!sessionValid) {
+            return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+        }
+        if (parsed.sessionId != null) {
+            const isCurrent = await (0, user_session_validation_1.validateJwtSessionIsCurrent)(parsed.userId, parsed.sessionId, sessionReader);
+            if (!isCurrent) {
+                return { ok: false, statusCode: 401, message: 'Session Expired please login again' };
+            }
+        }
+    }
+    const sessionId = await (0, user_session_validation_1.resolveAuthorizedSessionId)(parsed.userId, parsed.sessionId, sessionReader);
+    const { sessionId: _jwtSessionId, ...claimsWithoutSession } = parsed.raw;
+    return {
+        ok: true,
+        claims: claimsWithoutSession,
+        userId: parsed.userId,
+        sessionId,
+    };
+}

package/dist/auth/jwt-token.helper.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Extract portal API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+export declare function extractJwtToken(headers: Record<string, string | string[] | undefined> | undefined): string | null;
+export type JwtTokenRequest = {
+    headers: Record<string, string | string[] | undefined>;
+    body?: unknown;
+};
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+export declare function extractJwtTokenFromRequest(request: JwtTokenRequest): string | null;
+export type VerifiedJwtClaims = {
+    userId: number;
+    sessionId: number | null;
+    raw: Record<string, unknown>;
+};
+/** Parse verified JWT payload into userId + sessionId. */
+export declare function parseVerifiedJwtClaims(verified: Record<string, unknown>): VerifiedJwtClaims | null;

package/dist/auth/jwt-token.helper.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractJwtToken = extractJwtToken;
+exports.extractJwtTokenFromRequest = extractJwtTokenFromRequest;
+exports.parseVerifiedJwtClaims = parseVerifiedJwtClaims;
+/**
+ * Extract portal API JWT from standard request headers.
+ * Supports `jwt` header (legacy) and `Authorization: Bearer <token>`.
+ */
+function extractJwtToken(headers) {
+    if (!headers)
+        return null;
+    const pick = (value) => {
+        const raw = Array.isArray(value) ? value[0] : value;
+        const trimmed = raw?.trim();
+        return trimmed ? trimmed : null;
+    };
+    const fromJwtHeader = pick(headers.jwt ?? headers.JWT);
+    if (fromJwtHeader)
+        return fromJwtHeader;
+    const authorization = pick(headers.authorization ?? headers.Authorization);
+    if (!authorization)
+        return null;
+    const bearerMatch = /^Bearer\s+(.+)$/i.exec(authorization);
+    if (bearerMatch?.[1]?.trim())
+        return bearerMatch[1].trim();
+    return authorization;
+}
+/** JWT from headers (`jwt`, `Authorization: Bearer`) or JSON body (`token`, `jwt`, `access_token`). */
+function extractJwtTokenFromRequest(request) {
+    const fromHeaders = extractJwtToken(request.headers);
+    if (fromHeaders)
+        return fromHeaders;
+    const body = request.body;
+    if (!body || typeof body !== 'object')
+        return null;
+    for (const key of ['token', 'jwt', 'access_token']) {
+        const value = body[key];
+        if (typeof value === 'string' && value.trim())
+            return value.trim();
+    }
+    return null;
+}
+/** Parse verified JWT payload into userId + sessionId. */
+function parseVerifiedJwtClaims(verified) {
+    const userId = Number(verified.userId);
+    if (!Number.isFinite(userId) || userId <= 0)
+        return null;
+    const sessionIdRaw = verified.sessionId;
+    const parsedSessionId = sessionIdRaw == null || sessionIdRaw === '' ? null : Number(sessionIdRaw);
+    return {
+        userId,
+        sessionId: parsedSessionId != null && Number.isFinite(parsedSessionId) && parsedSessionId > 0
+            ? parsedSessionId
+            : null,
+        raw: verified,
+    };
+}

package/dist/auth/user-session-validation.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Server-side JWT session binding (VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+export type UserSessionRow = {
+    id?: number;
+};
+export type UserSessionReader = {
+    isSessionActiveById(sessionId: number, userId: number): Promise<boolean>;
+    /** Legacy fallback when REQUIRE_JWT_SESSION_ID=false and token has no sessionId. */
+    isSessionActive?(userId: number): Promise<UserSessionRow | null | undefined>;
+    /** Latest active session row id for user (highest id). */
+    getLatestActiveSessionId?(userId: number): Promise<number | null>;
+};
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+export declare function isSingleSessionOnLogin(): boolean;
+/** When true (default), JWT must include sessionId and that session must be active. */
+export declare function isRequireJwtSessionId(): boolean;
+export declare function resolveJwtSessionId(sessionId: unknown): number | null;
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+export declare function validateUserSessionBinding(userId: number, sessionId: number | null | undefined, reader: UserSessionReader): Promise<boolean>;
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+export declare function validateJwtSessionIsCurrent(userId: number, sessionId: number, reader: UserSessionReader): Promise<boolean>;
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+export declare function resolveAuthorizedSessionId(userId: number, jwtSessionId: number | null, reader: UserSessionReader): Promise<number | null>;
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+export declare function applyActiveUserSessionFilters(qb: {
+    andWhere: (clause: string, params?: Record<string, unknown>) => unknown;
+    orderBy?: (sort: string, order?: 'ASC' | 'DESC') => unknown;
+}, alias?: string): void;
+/** Prefer newest active session when multiple rows match (legacy path). */
+export declare function applyLatestActiveUserSessionOrdering(qb: {
+    orderBy: (sort: string, order?: 'ASC' | 'DESC') => unknown;
+}, alias?: string): void;
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
+export declare function activeUserSessionSql(alias?: string): {
+    clause: string;
+    params: Record<string, unknown>;
+};

package/dist/auth/user-session-validation.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * Server-side JWT session binding (VAPT M003/M004).
+ * JWT remains valid cryptographically until exp; access is allowed only while
+ * the bound user_sessions row is active and not expired.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSingleSessionOnLogin = isSingleSessionOnLogin;
+exports.isRequireJwtSessionId = isRequireJwtSessionId;
+exports.resolveJwtSessionId = resolveJwtSessionId;
+exports.validateUserSessionBinding = validateUserSessionBinding;
+exports.validateJwtSessionIsCurrent = validateJwtSessionIsCurrent;
+exports.resolveAuthorizedSessionId = resolveAuthorizedSessionId;
+exports.applyActiveUserSessionFilters = applyActiveUserSessionFilters;
+exports.applyLatestActiveUserSessionOrdering = applyLatestActiveUserSessionOrdering;
+exports.activeUserSessionSql = activeUserSessionSql;
+/** Default true — only the newest active session may use the API when JWT carries sessionId. */
+function isSingleSessionOnLogin() {
+    const raw = (process.env.SINGLE_SESSION_ON_LOGIN ?? 'true').trim().toLowerCase();
+    return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+/** When true (default), JWT must include sessionId and that session must be active. */
+function isRequireJwtSessionId() {
+    const raw = (process.env.REQUIRE_JWT_SESSION_ID ?? 'true').trim().toLowerCase();
+    return raw !== 'false' && raw !== '0' && raw !== 'no';
+}
+function resolveJwtSessionId(sessionId) {
+    if (sessionId == null || sessionId === '')
+        return null;
+    const sid = Number(sessionId);
+    if (!Number.isFinite(sid) || sid <= 0)
+        return null;
+    return sid;
+}
+/**
+ * Validate that a verified JWT is still authorized (not logged out / expired server-side).
+ */
+async function validateUserSessionBinding(userId, sessionId, reader) {
+    if (!Number.isFinite(userId) || userId <= 0)
+        return false;
+    const sid = resolveJwtSessionId(sessionId);
+    if (sid != null) {
+        return reader.isSessionActiveById(sid, userId);
+    }
+    if (isRequireJwtSessionId()) {
+        return false;
+    }
+    if (!reader.isSessionActive)
+        return false;
+    const legacy = await reader.isSessionActive(userId);
+    return !!legacy;
+}
+/** After row-level active check, enforce single-session policy (reject superseded JWTs). */
+async function validateJwtSessionIsCurrent(userId, sessionId, reader) {
+    if (!isSingleSessionOnLogin() || !reader.getLatestActiveSessionId)
+        return true;
+    const latest = await reader.getLatestActiveSessionId(userId);
+    if (latest == null)
+        return true;
+    return latest === sessionId;
+}
+/** Resolve session id for request meta: JWT claim first, else latest active DB row. */
+async function resolveAuthorizedSessionId(userId, jwtSessionId, reader) {
+    if (jwtSessionId != null)
+        return jwtSessionId;
+    if (reader.getLatestActiveSessionId) {
+        return reader.getLatestActiveSessionId(userId);
+    }
+    if (!reader.isSessionActive)
+        return null;
+    const legacy = await reader.isSessionActive(userId);
+    const legacyId = Number(legacy?.id);
+    return Number.isFinite(legacyId) && legacyId > 0 ? legacyId : null;
+}
+/** Shared TypeORM filters: active, not deleted, not past expires_at. */
+function applyActiveUserSessionFilters(qb, alias = 'user_sessions') {
+    qb.andWhere(`${alias}.is_active = :is_active`, { is_active: true });
+    qb.andWhere(`(${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted)`, { is_deleted: false });
+    qb.andWhere(`(${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`, { session_now: new Date() });
+}
+/** Prefer newest active session when multiple rows match (legacy path). */
+function applyLatestActiveUserSessionOrdering(qb, alias = 'user_sessions') {
+    qb.orderBy(`${alias}.id`, 'DESC');
+}
+/** @deprecated Use applyActiveUserSessionFilters — kept for backward compatibility. */
+function activeUserSessionSql(alias = 'user_sessions') {
+    return {
+        clause: `${alias}.is_active = :is_active AND (${alias}.is_deleted IS NULL OR ${alias}.is_deleted = :is_deleted) AND (${alias}.expires_at IS NULL OR ${alias}.expires_at > :session_now)`,
+        params: {
+            is_active: true,
+            is_deleted: false,
+            session_now: new Date(),
+        },
+    };
+}

package/dist/helpers/employee-evaluation-request.utils.d.ts

@@ -34,3 +34,15 @@ export declare function persistEmployeeEvaluationScores(manager: EntityManager,
     averageScore: number;
     employeeCount: number;
 }>;
+/** Sync person_scores/answers on an existing request (draft update or draft promotion). */
+export declare function syncEmployeeEvaluationScores(manager: EntityManager, opts: {
+    requestId: number;
+    formId: number;
+    createdBy: string;
+    employees: NormalizedEmployeeSubmission[];
+    validateAnswers?: boolean;
+}): Promise<{
+    totalScore: number | null;
+    averageScore: number | null;
+    employeeCount: number;
+}>;

package/dist/helpers/employee-evaluation-request.utils.js

@@ -5,6 +5,7 @@ exports.normalizeEmployeeSubmissions = normalizeEmployeeSubmissions;
 exports.normalizeEmployeeDraftSubmissions = normalizeEmployeeDraftSubmissions;
 exports.resolveMaxEmployeesPerRequest = resolveMaxEmployeesPerRequest;
 exports.persistEmployeeEvaluationScores = persistEmployeeEvaluationScores;
+exports.syncEmployeeEvaluationScores = syncEmployeeEvaluationScores;
 const EmployeeEvaluationAnswerModel_1 = require("../models/EmployeeEvaluationAnswerModel");
 const EmployeeEvaluationPersonScoreModel_1 = require("../models/EmployeeEvaluationPersonScoreModel");
 const EmployeeEvaluationRequestModel_1 = require("../models/EmployeeEvaluationRequestModel");
@@ -213,3 +214,87 @@ async function persistEmployeeEvaluationScores(manager, opts) {
     });
     return { totalScore: requestTotal, averageScore, employeeCount };
 }
+/** Sync person_scores/answers on an existing request (draft update or draft promotion). */
+async function syncEmployeeEvaluationScores(manager, opts) {
+    const { requestId, formId, createdBy, employees, validateAnswers = false } = opts;
+    const payloadUserIds = new Set(employees.map((e) => e.user_id));
+    const existingScores = await manager.find(EmployeeEvaluationPersonScoreModel_1.EmployeeEvaluationPersonScore, {
+        where: { request_id: requestId, is_deleted: false },
+    });
+    for (const ps of existingScores) {
+        if (!payloadUserIds.has(ps.user_id)) {
+            await manager.update(EmployeeEvaluationPersonScoreModel_1.EmployeeEvaluationPersonScore, { id: ps.id }, { is_deleted: true, updated_by: createdBy });
+            await manager.update(EmployeeEvaluationAnswerModel_1.EmployeeEvaluationAnswers, { request_id: requestId, user_id: ps.user_id, is_deleted: false }, { is_deleted: true, updated_by: createdBy });
+        }
+    }
+    for (const emp of employees) {
+        const existingPerson = existingScores.find((p) => p.user_id === emp.user_id);
+        if (existingPerson) {
+            await manager.update(EmployeeEvaluationPersonScoreModel_1.EmployeeEvaluationPersonScore, { id: existingPerson.id }, { is_rca: Boolean(emp.is_rca), updated_by: createdBy });
+            await manager.update(EmployeeEvaluationAnswerModel_1.EmployeeEvaluationAnswers, { request_id: requestId, user_id: emp.user_id, is_deleted: false }, { is_deleted: true, updated_by: createdBy });
+        }
+        else {
+            await manager.save(EmployeeEvaluationPersonScoreModel_1.EmployeeEvaluationPersonScore, manager.create(EmployeeEvaluationPersonScoreModel_1.EmployeeEvaluationPersonScore, {
+                request_id: requestId,
+                user_id: emp.user_id,
+                is_rca: Boolean(emp.is_rca),
+                us_feedback: null,
+                total_score: null,
+                created_by: createdBy,
+                is_deleted: false,
+            }));
+        }
+        if (emp.answers.length > 0) {
+            let personTotal = 0;
+            for (const ans of emp.answers) {
+                const qMeta = await manager.findOne(EvaluationFormQuestionModel_1.EvaluationFormQuestion, {
+                    where: { id: ans.question_id, is_deleted: false },
+                });
+                const questionSectionId = qMeta?.form_section_id;
+                if (validateAnswers) {
+                    if (!qMeta || questionSectionId == null || questionSectionId !== ans.section_id) {
+                        throw new Error(`Invalid question ${ans.question_id} for section ${ans.section_id}`);
+                    }
+                    if (qMeta.max_score != null && ans.score > qMeta.max_score) {
+                        throw new Error(`score ${ans.score} exceeds max_score ${qMeta.max_score} for question ${ans.question_id}`);
+                    }
+                }
+                else if (qMeta &&
+                    qMeta.form_section_id != null &&
+                    qMeta.form_section_id !== ans.section_id) {
+                    throw new Error(`Invalid question ${ans.question_id} for section ${ans.section_id}`);
+                }
+                personTotal += ans.score;
+                await manager.save(EmployeeEvaluationAnswerModel_1.EmployeeEvaluationAnswers, manager.create(EmployeeEvaluationAnswerModel_1.EmployeeEvaluationAnswers, {
+                    request_id: requestId,
+                    user_id: emp.user_id,
+                    form_id: formId,
+                    section_id: ans.section_id,
+                    question_id: ans.question_id,
+                    score: ans.score,
+                    remarks: ans.remarks ?? null,
+                    created_by: createdBy,
+                    is_deleted: false,
+                }));
+            }
+            await manager.update(EmployeeEvaluationPersonScoreModel_1.EmployeeEvaluationPersonScore, { request_id: requestId, user_id: emp.user_id, is_deleted: false }, { total_score: personTotal, updated_by: createdBy });
+        }
+    }
+    const personRows = await manager.find(EmployeeEvaluationPersonScoreModel_1.EmployeeEvaluationPersonScore, {
+        where: { request_id: requestId, is_deleted: false },
+    });
+    const scores = personRows.map((p) => p.total_score ?? 0);
+    const requestTotal = scores.reduce((a, b) => a + b, 0);
+    const average = personRows.length ? requestTotal / personRows.length : 0;
+    await manager.update(EmployeeEvaluationRequestModel_1.EmployeeEvaluationRequests, { id: requestId }, {
+        total_score: personRows.length ? requestTotal : null,
+        average_score: personRows.length ? average : null,
+        employee_count: personRows.length,
+        updated_by: createdBy,
+    });
+    return {
+        totalScore: personRows.length ? requestTotal : null,
+        averageScore: personRows.length ? average : null,
+        employeeCount: personRows.length,
+    };
+}

package/dist/i18n/workflow-chat-i18n.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Re-exports the FM standard bilingual message builder.
+ * Import from '@platform-modules/foreign-ministry' in all services.
+ */
+export * from './workflow-chat-message.builder';

package/dist/i18n/workflow-chat-i18n.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Re-exports the FM standard bilingual message builder.
+ * Import from '@platform-modules/foreign-ministry' in all services.
+ */
+__exportStar(require("./workflow-chat-message.builder"), exports);