[dev] [Marfuen] mariano/cs-312-feature-add-personnel-employment-events-date-tracking

apps/api/src/app.module.ts

@@ -55,6 +55,7 @@ import { AdminFeatureFlagsModule } from './admin-feature-flags/admin-feature-fla
 import { TimelinesModule } from './timelines/timelines.module';
 import { BackgroundChecksModule } from './background-checks/background-checks.module';
 import { BillingModule } from './billing/billing.module';
+import { OffboardingChecklistModule } from './offboarding-checklist/offboarding-checklist.module';
 
 @Module({
   imports: [
@@ -122,6 +123,7 @@ import { BillingModule } from './billing/billing.module';
     AdminOrganizationsModule,
     AdminFeatureFlagsModule,
     TimelinesModule,
+    OffboardingChecklistModule,
   ],
   controllers: [AppController],
   providers: [

apps/api/src/integration-platform/controllers/sync.controller.ts

@@ -48,6 +48,7 @@ interface GoogleWorkspaceUser {
   isAdmin?: boolean;
   suspended?: boolean;
   orgUnitPath?: string;
+  creationTime?: string;
 }
 
 interface GoogleWorkspaceUsersResponse {
@@ -381,9 +382,12 @@ export class SyncController {
         });
 
         if (existingMember) {
-          // Never reactivate deactivated members — whether deactivated manually
-          // by an admin or by a previous sync, they should stay deactivated.
-          // Admins can reactivate manually if needed.
+          if (!existingMember.onboardDate && gwUser.creationTime) {
+            await db.member.update({
+              where: { id: existingMember.id },
+              data: { onboardDate: new Date(gwUser.creationTime) },
+            });
+          }
           results.skipped++;
           results.details.push({
             email: normalizedEmail,
@@ -402,6 +406,7 @@ export class SyncController {
             userId,
             role: 'employee',
             isActive: true,
+            ...(gwUser.creationTime ? { onboardDate: new Date(gwUser.creationTime) } : {}),
           },
         });
 
@@ -839,6 +844,12 @@ export class SyncController {
         });
 
         if (existingMember) {
+          if (!existingMember.onboardDate && worker.start_date) {
+            await db.member.update({
+              where: { id: existingMember.id },
+              data: { onboardDate: new Date(worker.start_date) },
+            });
+          }
           if (existingMember.deactivated) {
             await db.member.update({
               where: { id: existingMember.id },
@@ -865,6 +876,7 @@ export class SyncController {
               userId,
               role: 'employee',
               isActive: true,
+              ...(worker.start_date ? { onboardDate: new Date(worker.start_date) } : {}),
             },
           });
           results.imported++;
@@ -1333,7 +1345,12 @@ export class SyncController {
         });
 
         if (existingMember) {
-          // If member was deactivated but is now active in JumpCloud, reactivate them
+          if (!existingMember.onboardDate && jcUser.created) {
+            await db.member.update({
+              where: { id: existingMember.id },
+              data: { onboardDate: new Date(jcUser.created) },
+            });
+          }
           if (existingMember.deactivated) {
             await db.member.update({
               where: { id: existingMember.id },
@@ -1365,6 +1382,7 @@ export class SyncController {
             userId,
             role: 'employee',
             isActive: true,
+            ...(jcUser.created ? { onboardDate: new Date(jcUser.created) } : {}),
           },
         });
 

apps/api/src/integration-platform/services/generic-employee-sync.service.ts

@@ -185,13 +185,17 @@ export class GenericEmployeeSyncService {
             );
           }
 
+          const needsOnboardDate =
+            !existingMember.onboardDate && employee.startDate;
+
           if (existingMember.deactivated && allowReactivation) {
             await db.member.update({
               where: { id: existingMember.id },
               data: {
                 deactivated: false,
                 isActive: true,
                 ...(needsHeal ? { role: healedRole } : {}),
+                ...(needsOnboardDate ? { onboardDate: new Date(employee.startDate!) } : {}),
               },
             });
             results.reactivated++;
@@ -200,10 +204,13 @@ export class GenericEmployeeSyncService {
               status: 'reactivated',
             });
           } else {
-            if (needsHeal) {
+            if (needsHeal || needsOnboardDate) {
               await db.member.update({
                 where: { id: existingMember.id },
-                data: { role: healedRole },
+                data: {
+                  ...(needsHeal ? { role: healedRole } : {}),
+                  ...(needsOnboardDate ? { onboardDate: new Date(employee.startDate!) } : {}),
+                },
               });
             }
             results.skipped++;
@@ -231,6 +238,7 @@ export class GenericEmployeeSyncService {
             userId: existingUser.id,
             role: sanitizedRole,
             isActive: true,
+            ...(employee.startDate ? { onboardDate: new Date(employee.startDate) } : {}),
           },
         });
 
@@ -294,7 +302,11 @@ export class GenericEmployeeSyncService {
         try {
           await db.member.update({
             where: { id: member.id },
-            data: { deactivated: true, isActive: false },
+            data: {
+              deactivated: true,
+              isActive: false,
+              offboardDate: member.offboardDate ?? new Date(),
+            },
           });
           results.deactivated++;
           results.details.push({

apps/api/src/offboarding-checklist/access-revocation.service.ts

@@ -0,0 +1,233 @@
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { AttachmentEntityType, db } from '@db';
+import { AttachmentsService } from '../attachments/attachments.service';
+
+@Injectable()
+export class AccessRevocationService {
+  constructor(private readonly attachmentsService: AttachmentsService) {}
+  async getAccessRevocations(organizationId: string, memberId: string) {
+    const vendors = await db.vendor.findMany({
+      where: { organizationId },
+      select: { id: true, name: true, website: true, logoUrl: true },
+      orderBy: { name: 'asc' },
+    });
+
+    const revocations = await db.offboardingAccessRevocation.findMany({
+      where: { organizationId, memberId },
+      include: {
+        revokedBy: { select: { id: true, name: true, email: true } },
+      },
+    });
+
+    const revocationMap = new Map(
+      revocations.map((r) => [r.vendorId, r]),
+    );
+
+    const vendorList = await Promise.all(
+      vendors.map(async (vendor) => {
+        const revocation = revocationMap.get(vendor.id);
+        const domain = vendor.website?.replace(/^https?:\/\//, '').replace(/\/.*$/, '') ?? null;
+        const evidence = revocation
+          ? await this.attachmentsService.getAttachments(
+              organizationId,
+              revocation.id,
+              AttachmentEntityType.offboarding_checklist,
+            )
+          : [];
+        return {
+          vendorId: vendor.id,
+          vendorName: vendor.name,
+          logoUrl: vendor.logoUrl ?? (domain ? `https://img.logo.dev/${domain}?token=pk_X-1ZO13GSgeOoUrIuJ6GMQ&size=64` : null),
+          revoked: !!revocation,
+          revokedAt: revocation?.revokedAt ?? null,
+          revokedBy: revocation?.revokedBy ?? null,
+          notes: revocation?.notes ?? null,
+          evidence,
+        };
+      }),
+    );
+
+    return {
+      vendors: vendorList,
+      totalVendors: vendors.length,
+      revokedCount: revocations.length,
+    };
+  }
+
+  async revokeVendorAccess({
+    organizationId,
+    memberId,
+    vendorId,
+    revokedById,
+    notes,
+    evidence,
+  }: {
+    organizationId: string;
+    memberId: string;
+    vendorId: string;
+    revokedById: string;
+    notes?: string;
+    evidence?: { fileName: string; fileType: string; fileData: string };
+  }) {
+    const vendor = await db.vendor.findFirst({
+      where: { id: vendorId, organizationId },
+    });
+
+    if (!vendor) {
+      throw new NotFoundException('Vendor not found in this organization');
+    }
+
+    const existing = await db.offboardingAccessRevocation.findUnique({
+      where: { memberId_vendorId: { memberId, vendorId } },
+    });
+
+    if (existing) {
+      throw new BadRequestException(
+        'Vendor access has already been revoked for this member',
+      );
+    }
+
+    const revocation = await db.offboardingAccessRevocation.create({
+      data: {
+        organizationId,
+        memberId,
+        vendorId,
+        revokedById,
+        notes,
+      },
+      include: {
+        revokedBy: { select: { id: true, name: true, email: true } },
+      },
+    });
+
+    if (evidence) {
+      await this.attachmentsService.uploadAttachment(
+        organizationId,
+        revocation.id,
+        AttachmentEntityType.offboarding_checklist,
+        evidence,
+        revokedById,
+      );
+    }
+
+    await this.syncAccessRevocationCompletion(
+      organizationId,
+      memberId,
+      revokedById,
+    );
+
+    return revocation;
+  }
+
+  async undoVendorRevocation({
+    organizationId,
+    memberId,
+    vendorId,
+  }: {
+    organizationId: string;
+    memberId: string;
+    vendorId: string;
+  }) {
+    const revocation = await db.offboardingAccessRevocation.findUnique({
+      where: { memberId_vendorId: { memberId, vendorId } },
+    });
+
+    if (!revocation) {
+      throw new NotFoundException('Revocation record not found');
+    }
+
+    await db.offboardingAccessRevocation.delete({
+      where: { id: revocation.id },
+    });
+
+    await this.syncAccessRevocationCompletion(organizationId, memberId);
+
+    return { success: true };
+  }
+
+  async revokeAllVendorAccess({
+    organizationId,
+    memberId,
+    revokedById,
+  }: {
+    organizationId: string;
+    memberId: string;
+    revokedById: string;
+  }) {
+    const vendors = await db.vendor.findMany({
+      where: { organizationId },
+      select: { id: true },
+    });
+
+    const existing = await db.offboardingAccessRevocation.findMany({
+      where: { organizationId, memberId },
+      select: { vendorId: true },
+    });
+
+    const existingSet = new Set(existing.map((r) => r.vendorId));
+    const toCreate = vendors.filter((v) => !existingSet.has(v.id));
+
+    if (toCreate.length > 0) {
+      await db.offboardingAccessRevocation.createMany({
+        data: toCreate.map((v) => ({
+          organizationId,
+          memberId,
+          vendorId: v.id,
+          revokedById,
+        })),
+        skipDuplicates: true,
+      });
+    }
+
+    await this.syncAccessRevocationCompletion(organizationId, memberId, revokedById);
+
+    return { confirmed: toCreate.length };
+  }
+
+  private async syncAccessRevocationCompletion(
+    organizationId: string,
+    memberId: string,
+    completedById?: string,
+  ) {
+    const templateItem = await db.offboardingChecklistTemplate.findFirst({
+      where: { organizationId, isAccessRevocation: true, isEnabled: true },
+    });
+
+    if (!templateItem) {
+      return;
+    }
+
+    const { totalVendors, revokedCount } = await this.getAccessRevocations(
+      organizationId,
+      memberId,
+    );
+
+    const allRevoked = totalVendors > 0 && revokedCount === totalVendors;
+
+    const existingCompletion =
+      await db.offboardingChecklistCompletion.findFirst({
+        where: { organizationId, memberId, templateItemId: templateItem.id },
+      });
+
+    if (allRevoked && !existingCompletion && completedById) {
+      await db.offboardingChecklistCompletion.create({
+        data: {
+          organizationId,
+          memberId,
+          templateItemId: templateItem.id,
+          completedById,
+        },
+      });
+    }
+
+    if (!allRevoked && existingCompletion) {
+      await db.offboardingChecklistCompletion.delete({
+        where: { id: existingCompletion.id },
+      });
+    }
+  }
+}