ON HOLD! - fix: [C4R-884] user still able to access an app

backend/src/modules/application/services/application.service.ts

@@ -75,7 +75,7 @@ export class ApplicationService {
     private readonly mailService: MailService,
     private readonly organizationService: OrganizationService,
     private readonly ongApplicationRepository: OngApplicationRepository,
-  ) { }
+  ) {}
 
   public async create(
     createApplicationDto: CreateApplicationDto,
@@ -434,6 +434,17 @@ export class ApplicationService {
       }
     }
 
+    // if application is disabled, sign out all users from all organizations
+    if (updateApplicationDto.status === ApplicationStatus.DISABLED) {
+      const ongApplications = await this.ongApplicationService.findMany({
+        where: { applicationId: id },
+      });
+      const organizationIds = ongApplications.map(
+        (ongApplication) => ongApplication.organizationId,
+      );
+      await this.userService.signOutAllOrganization(organizationIds);
+    }
+
     return this.applicationRepository.update({ id }, updateApplicationDto);
   }
 
@@ -446,6 +457,8 @@ export class ApplicationService {
       applicationId,
       OngApplicationStatus.RESTRICTED,
     );
+
+    await this.userService.signOutAllOrganization([organizationId]);
   }
 
   public async restore(
@@ -594,7 +607,9 @@ export class ApplicationService {
         'ongApp.applicationId = application.id',
       )
       .where('ongApp.organizationId = :organizationId', { organizationId })
-      .andWhere('ongApp.status != :status', { status: OngApplicationStatus.PENDING })
+      .andWhere('ongApp.status != :status', {
+        status: OngApplicationStatus.PENDING,
+      })
       .orWhere('application.type = :type', {
         type: ApplicationTypeEnum.INDEPENDENT,
       })
@@ -772,7 +787,7 @@ export class ApplicationService {
 
     const finalStatus =
       applicationStatus === ApplicationStatus.DISABLED &&
-        status !== OngApplicationStatus.RESTRICTED
+      status !== OngApplicationStatus.RESTRICTED
         ? ApplicationStatus.DISABLED
         : status;
 

backend/src/modules/organization/organization.module.ts

@@ -1,4 +1,4 @@
-import { Module } from '@nestjs/common';
+import { forwardRef, Module } from '@nestjs/common';
 import { OrganizationController } from './controllers/organization.controller';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { ApplicationModule } from '../application/application.module';
@@ -70,6 +70,7 @@ import { CivicCenterModule } from '../civic-center-service/civic-center.module';
     UserModule,
     PracticeProgramModule,
     CivicCenterModule,
+    forwardRef(() => UserModule),
   ],
   controllers: [
     OrganizationApplicationController,

backend/src/modules/organization/services/organization.service.ts

@@ -1,6 +1,8 @@
 import {
   BadRequestException,
+  forwardRef,
   HttpException,
+  Inject,
   Injectable,
   InternalServerErrorException,
   Logger,
@@ -14,6 +16,7 @@ import { CivicCenterServiceService } from 'src/modules/civic-center-service/serv
 import { PracticeProgramService } from 'src/modules/practice-program/services/practice-program.service';
 import { Role } from 'src/modules/user/enums/role.enum';
 import { FILE_TYPE } from 'src/shared/enum/FileType.enum';
+import { UserService } from 'src/modules/user/services/user.service';
 import { AnafService } from 'src/shared/services';
 import { FileManagerService } from 'src/shared/services/file-manager.service';
 import { NomenclaturesService } from 'src/shared/services/nomenclatures.service';
@@ -79,7 +82,9 @@ export class OrganizationService {
     private readonly mailService: MailService,
     private readonly practiceProgramService: PracticeProgramService,
     private readonly civicCenterService: CivicCenterServiceService,
-  ) { }
+    @Inject(forwardRef(() => UserService))
+    private readonly userService: UserService,
+  ) {}
 
   public async create(
     createUserRequestDto: CreateUserRequestDto,
@@ -917,6 +922,8 @@ export class OrganizationService {
       status: OrganizationStatus.RESTRICTED,
     });
 
+    await this.userService.signOutAllOrganization([organizationId]);
+
     const {
       template,
       subject,

backend/src/modules/user/services/user.service.ts

@@ -1,6 +1,8 @@
 import {
   BadRequestException,
+  forwardRef,
   HttpException,
+  Inject,
   Injectable,
   InternalServerErrorException,
   Logger,
@@ -43,6 +45,7 @@ export class UserService {
   constructor(
     private readonly userRepository: UserRepository,
     private readonly cognitoService: CognitoUserService,
+    @Inject(forwardRef(() => OrganizationService))
     private readonly organizationService: OrganizationService,
     private readonly userOngApplicationService: UserOngApplicationService,
   ) {}
@@ -150,6 +153,8 @@ export class UserService {
           user.id,
           user.organizationId,
         );
+      } else {
+        await this.cognitoService.globalSignOut(user.cognitoId);
       }
 
       // 6. Update db user data
@@ -295,20 +300,20 @@ export class UserService {
     }
   }
 
-  async removeById(id: number, organizatioinId?: number): Promise<string> {
+  async removeById(id: number, organizationId?: number): Promise<string> {
     // 1. Get the user by id
-    const user = await this.getById(id, organizatioinId);
+    const user = await this.getById(id, organizationId);
 
     return this.remove(user);
   }
 
-  async restrictAccess(ids: number[], organizatioinId?: number) {
+  async restrictAccess(ids: number[], organizationId?: number) {
     const updated = [],
       failed = [];
     for (let i = 0; i < ids.length; i++) {
       const id = ids[i];
       try {
-        const user = await this.getById(id, organizatioinId);
+        const user = await this.getById(id, organizationId);
         await this.userRepository.update(
           { id },
           { status: UserStatus.RESTRICTED },
@@ -355,6 +360,16 @@ export class UserService {
     return;
   }
 
+  public async signOutAllOrganization(
+    organizationIds: number[],
+  ): Promise<void> {
+    const users = await this.findMany({ where: { id: In(organizationIds) } });
+
+    users.map(
+      async (user) => await this.cognitoService.globalSignOut(user.cognitoId),
+    );
+  }
+
   // ****************************************************
   // ***************** PRIVATE METHODS ******************
   // ****************************************************