feat(api): AB#52 legal compliance - JWT hardening, SMS consent, PII a…

JobFlow.API/Controllers/ChatController.cs

@@ -706,7 +706,7 @@ private async Task TrySendClientSmsAsync(Guid conversationId, string? content, s
             .Query()
             .FirstOrDefaultAsync(c => c.Id == conversation.OrganizationClientId.Value);
 
-        if (client is null || string.IsNullOrWhiteSpace(client.PhoneNumber))
+        if (client is null || string.IsNullOrWhiteSpace(client.PhoneNumber) || !client.SmsConsentGiven)
             return;
 
         var smsBody = BuildSmsBody(content, attachmentUrl);

JobFlow.API/Controllers/ClientHubAuthController.cs

@@ -122,7 +122,7 @@ private bool TryGetClientPortalSigningKey(out string signingKey, out IResult? er
 
     private (string accessToken, DateTimeOffset expiresAt) IssueClientPortalJwt(Guid organizationId, Guid organizationClientId, string signingKey)
     {
-        var expiresAt = DateTimeOffset.UtcNow.AddHours(8);
+        var expiresAt = DateTimeOffset.UtcNow.AddHours(2);
 
         var claims = new List<Claim>
         {

JobFlow.API/Controllers/OrganizationClientController.cs

@@ -175,6 +175,14 @@ public async Task<IResult> RestoreClient(Guid clientId)
         return result.IsSuccess ? Results.Ok(result) : result.ToProblemDetails();
     }
 
+    [HttpPost("{clientId:guid}/anonymize")]
+    public async Task<IResult> AnonymizeClient(Guid clientId)
+    {
+        var organizationId = HttpContext.GetOrganizationId();
+        var result = await organizationClientService.AnonymizeClientAsync(clientId, organizationId);
+        return result.IsSuccess ? Results.Ok() : result.ToProblemDetails();
+    }
+
     [HttpPost("import/preview")]
     [RequestSizeLimit(10 * 1024 * 1024)]
     [Consumes("multipart/form-data")]

JobFlow.API/Controllers/OrganizationClientPortalController.cs

@@ -106,7 +106,7 @@ private bool TryGetClientPortalSigningKey(out string signingKey, out IResult? er
 
     private (string token, DateTimeOffset expiresAt) IssueClientPortalJwt(Guid organizationId, Guid organizationClientId, string signingKey)
     {
-        var expiresAt = DateTimeOffset.UtcNow.AddHours(8);
+        var expiresAt = DateTimeOffset.UtcNow.AddHours(2);
 
         var claims = new List<Claim>
         {

JobFlow.API/Hubs/ChatHub.cs

@@ -215,7 +215,7 @@ private async Task TrySendClientSmsAsync(Guid conversationId, Guid messageId, st
             .Query()
             .FirstOrDefaultAsync(c => c.Id == conversation.OrganizationClientId.Value);
 
-        if (client is null || string.IsNullOrWhiteSpace(client.PhoneNumber))
+        if (client is null || string.IsNullOrWhiteSpace(client.PhoneNumber) || !client.SmsConsentGiven)
             return;
 
         var smsBody = BuildSmsBody(content, attachmentUrl);

JobFlow.Business/Models/DTOs/OrganizationDto.cs

@@ -19,6 +19,7 @@ public class OrganizationClientDto
 
     public string? PhoneNumber { get; set; }
     public string? EmailAddress { get; set; }
+    public bool SmsConsentGiven { get; set; }
     public OrganizationDto? Organization { get; set; }
     public string? FullName => $"{FirstName} {LastName}".Trim();
 

JobFlow.Business/Services/OrganizationClientService.cs

@@ -311,4 +311,29 @@ public async Task<Result> RestoreClient(Guid clientId, Guid organizationId)
         return Result.Success($"{clientToRestore.ClientFullName()} was successfully restored.");
     }
 
+    public async Task<Result> AnonymizeClientAsync(Guid clientId, Guid organizationId)
+    {
+        var client = await organizationClient.Query()
+            .FirstOrDefaultAsync(c => c.Id == clientId && c.OrganizationId == organizationId);
+
+        if (client is null)
+            return Result.Failure(OrganizationClientErrors.NoClientFound);
+
+        client.FirstName = "Deleted";
+        client.LastName = "User";
+        client.EmailAddress = null;
+        client.PhoneNumber = null;
+        client.Address1 = null;
+        client.Address2 = null;
+        client.City = null;
+        client.State = null;
+        client.ZipCode = null;
+        client.SmsConsentGiven = false;
+
+        organizationClient.Update(client);
+        await unitOfWork.SaveChangesAsync();
+
+        return Result.Success("Client PII anonymized successfully.");
+    }
+
 }

JobFlow.Business/Services/ServiceInterfaces/IOrganizationClientService.cs

@@ -24,4 +24,5 @@ Task<Result<CursorPagedResponseDto<OrganizationClient>>> GetClientsByOrganizatio
     Task<Result<OrganizationClient>> UpsertClient(OrganizationClient model);
     Task<Result<IEnumerable<OrganizationClient>>> UpsertMultipleClients(IEnumerable<OrganizationClient> modelList);
     Task<Result> RestoreClient(Guid clientId, Guid organizationId);
+    Task<Result> AnonymizeClientAsync(Guid clientId, Guid organizationId);
 }

JobFlow.Domain/Models/OrganizationClient.cs

@@ -12,6 +12,7 @@ public class OrganizationClient : Entity
     public string? PhoneNumber { get; set; }
     public string? EmailAddress { get; set; }
     public string? ZipCode { get; set; }
+    public bool SmsConsentGiven { get; set; } = false;
 
     public virtual Organization Organization { get; set; } = null!;