[Social Work] - Deactivate Staff accounts after 60 days of inactivity

backend/compact-connect/lambdas/nodejs/yarn.lock

@@ -4674,9 +4674,9 @@ ms@^2.1.1, ms@^2.1.3:
   integrity sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==
 
 nanoid@^3.3.16:
-  version "3.3.16"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.16.tgz#a04d8ec4b1f10009d2d533947aefe4293737816c"
-  integrity sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==
+  version "3.3.18"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.18.tgz#f66a2de1199ffde0fcf21c8a5f13106b1c081913"
+  integrity sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==
 
 napi-postinstall@^0.3.4:
   version "0.3.4"

backend/cosmetology-app/lambdas/nodejs/yarn.lock

@@ -4674,9 +4674,9 @@ ms@^2.1.1, ms@^2.1.3:
   integrity sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==
 
 nanoid@^3.3.16:
-  version "3.3.16"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.16.tgz#a04d8ec4b1f10009d2d533947aefe4293737816c"
-  integrity sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==
+  version "3.3.18"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.18.tgz#f66a2de1199ffde0fcf21c8a5f13106b1c081913"
+  integrity sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==
 
 napi-postinstall@^0.3.4:
   version "0.3.4"

backend/social-work-app/lambdas/nodejs/email-notification-service/lambda.ts

@@ -348,6 +348,24 @@ export class Lambda implements LambdaInterface {
                 event.templateVariables.newJurisdiction
             );
             break;
+        case 'staffUserInactivityNotification':
+            if (!event.templateVariables?.staffUserFirstName
+                || !event.templateVariables?.staffUserLastName
+                || !event.templateVariables?.staffUserEmail
+                || !event.templateVariables?.deactivationDate
+                || !event.templateVariables?.inactivityPeriodDays) {
+                throw new Error('Missing required template variables for staffUserInactivityNotification template.');
+            }
+            await this.emailService.sendStaffUserInactivityNotificationEmail(
+                event.compact,
+                event.specificEmails || [],
+                event.templateVariables.staffUserFirstName,
+                event.templateVariables.staffUserLastName,
+                event.templateVariables.staffUserEmail,
+                event.templateVariables.deactivationDate,
+                event.templateVariables.inactivityPeriodDays
+            );
+            break;
         default:
             logger.info('Unsupported email template provided', { template: event.template });
             throw new Error(`Unsupported email template: ${event.template}`);

backend/social-work-app/lambdas/nodejs/lib/email/email-notification-service.ts

@@ -4,6 +4,15 @@ import { RecipientType } from '../models/email-notification-service-event';
 
 const environmentVariableService = new EnvironmentVariablesService();
 
+/** Format an ISO 8601 date string (YYYY-MM-DD) for display as MM/DD/YYYY (e.g. "09/14/2026"). Timezone-neutral. */
+function formatIsoDateAsSlashFormat(isoDate: string): string {
+    const [year, month, day] = isoDate.split('-').map(Number);
+    const paddedMonth = String(month).padStart(2, '0');
+    const paddedDay = String(day).padStart(2, '0');
+
+    return `${paddedMonth}/${paddedDay}/${year}`;
+}
+
 /**
  * Email service for handling email notifications
  */
@@ -77,4 +86,59 @@ export class EmailNotificationService extends BaseEmailService {
 
         await this.sendEmail({ htmlContent, subject, recipients, errorMessage: 'Unable to send home jurisdiction change state notification email' });
     }
+
+    /**
+     * Sends a notification that a staff user's account is scheduled for inactivity deactivation.
+     *
+     * The body is written in the third person so the same email serves the staff user and their
+     * administrators, and states an absolute date rather than a countdown so it stays true whenever it is read.
+     *
+     * @param compact - The compact name
+     * @param specificEmails - The address(es) to send this notification to
+     * @param staffUserFirstName - The affected staff user's first name
+     * @param staffUserLastName - The affected staff user's last name
+     * @param staffUserEmail - The affected staff user's email address
+     * @param deactivationDate - ISO 8601 date string (YYYY-MM-DD) the account is deactivated on
+     * @param inactivityPeriodDays - How many days of inactivity trigger deactivation
+     */
+    public async sendStaffUserInactivityNotificationEmail(
+        compact: string,
+        specificEmails: string[],
+        staffUserFirstName: string,
+        staffUserLastName: string,
+        staffUserEmail: string,
+        deactivationDate: string,
+        inactivityPeriodDays: number
+    ): Promise<void> {
+        this.logger.info('Sending staff user inactivity notification email', { compact: compact });
+
+        if (specificEmails.length === 0) {
+            throw new Error('No recipients found for staff user inactivity notification email');
+        }
+
+        const compactConfig = await this.compactConfigurationClient.getCompactConfiguration(compact);
+        const staffUserName = `${staffUserFirstName} ${staffUserLastName}`;
+        const deactivationDateDisplay = formatIsoDateAsSlashFormat(deactivationDate);
+        const subject = `CompactConnect account for ${staffUserName} will be deactivated on ${deactivationDateDisplay}`;
+
+        const report = this.getNewEmailTemplate();
+        const bodyText = `The ${compactConfig.compactName} CompactConnect account for ${staffUserName} (${staffUserEmail}) will be deactivated on **${deactivationDateDisplay}**. CompactConnect deactivates staff user accounts after ${inactivityPeriodDays} days with no sign-in activity.\n\n` +
+            `To prevent deactivation, ${staffUserName} should sign in to CompactConnect before **${deactivationDateDisplay}**.\n\n` +
+            `If the account has already been deactivated, an administrator will need to re-invite ${staffUserName} to CompactConnect to restore access.\n\n` +
+            `Sign in: ${environmentVariableService.getUiBasePathUrl()}/Dashboard`;
+
+        this.insertHeader(report, 'Account Deactivation Notice');
+        this.insertBody(report, bodyText, 'center', true);
+        this.insertFooter(report);
+
+        const htmlContent = this.renderTemplate(report);
+
+        await this.sendEmail({
+            htmlContent,
+            subject,
+            recipients: specificEmails,
+            errorMessage: 'Unable to send staff user inactivity notification email'
+        });
+    }
+
 }

backend/social-work-app/lambdas/nodejs/tests/email-notification-service.test.ts

@@ -1168,4 +1168,58 @@ describe('EmailNotificationServiceLambda', () => {
                 .toThrow('Missing required template variables for home jurisdiction change notification template.');
         });
     });
+
+    describe('Staff User Inactivity Notification', () => {
+        const SAMPLE_STAFF_USER_INACTIVITY_NOTIFICATION_EVENT: EmailNotificationEvent = {
+            template: 'staffUserInactivityNotification',
+            recipientType: 'SPECIFIC',
+            compact: 'socw',
+            specificEmails: ['jane@example.com'],
+            templateVariables: {
+                staffUserFirstName: 'Jane',
+                staffUserLastName: 'Smith',
+                staffUserEmail: 'jane@example.com',
+                deactivationDate: '2026-09-14',
+                inactivityPeriodDays: 60
+            }
+        };
+
+        it('should successfully send staff user inactivity notification email', async () => {
+            mockDynamoDBClient.on(GetItemCommand).resolves({ Item: SAMPLE_COMPACT_CONFIGURATION });
+
+            const response = await lambda.handler(
+                SAMPLE_STAFF_USER_INACTIVITY_NOTIFICATION_EVENT,
+                {} as any
+            );
+
+            expect(response).toEqual({ message: 'Email message sent' });
+            expect(mockSESClient).toHaveReceivedCommandWith(SendEmailCommand, {
+                Destination: {
+                    ToAddresses: ['jane@example.com']
+                }
+            });
+        });
+
+        it('should throw error when required template variables are missing', async () => {
+            const eventWithMissingVariables: EmailNotificationEvent = {
+                ...SAMPLE_STAFF_USER_INACTIVITY_NOTIFICATION_EVENT,
+                templateVariables: {}
+            };
+
+            await expect(lambda.handler(eventWithMissingVariables, {} as any))
+                .rejects
+                .toThrow('Missing required template variables for staffUserInactivityNotification template.');
+        });
+
+        it('should throw error when no recipients are provided', async () => {
+            const eventWithNoRecipients: EmailNotificationEvent = {
+                ...SAMPLE_STAFF_USER_INACTIVITY_NOTIFICATION_EVENT,
+                specificEmails: []
+            };
+
+            await expect(lambda.handler(eventWithNoRecipients, {} as any))
+                .rejects
+                .toThrow('No recipients found for staff user inactivity notification email');
+        });
+    });
 });

backend/social-work-app/lambdas/nodejs/tests/lib/email/email-notification-service.test.ts

@@ -201,4 +201,86 @@ describe('EmailNotificationService', () => {
             )).rejects.toThrow('No recipients found for jurisdiction oh in compact aslp');
         });
     });
+
+    describe('Staff User Inactivity Notification', () => {
+        const sendInactivityNotification = (recipients: string[] = ['jane@example.com']) =>
+            emailService.sendStaffUserInactivityNotificationEmail(
+                'aslp',
+                recipients,
+                'Jane',
+                'Smith',
+                'jane@example.com',
+                '2026-09-14',
+                60
+            );
+
+        it('should send the notification with expected subject and content', async () => {
+            mockCompactConfigurationClient.getCompactConfiguration.mockResolvedValue(SAMPLE_COMPACT_CONFIG);
+
+            await sendInactivityNotification(['jane@example.com', 'admin@example.com']);
+
+            expect(mockSESClient).toHaveReceivedCommandWith(
+                SendEmailCommand,
+                {
+                    Destination: {
+                        ToAddresses: ['jane@example.com', 'admin@example.com']
+                    },
+                    Content: {
+                        Simple: {
+                            Body: {
+                                Html: {
+                                    Charset: 'UTF-8',
+                                    Data: expect.stringContaining('<!DOCTYPE html>')
+                                }
+                            },
+                            Subject: {
+                                Charset: 'UTF-8',
+                                Data: 'CompactConnect account for Jane Smith will be deactivated on 09/14/2026'
+                            }
+                        }
+                    },
+                    FromEmailAddress: 'CompactConnect <noreply@example.org>'
+                }
+            );
+        });
+
+        it('should render the deactivation date, the account it refers to, and the recovery path', async () => {
+            mockCompactConfigurationClient.getCompactConfiguration.mockResolvedValue(SAMPLE_COMPACT_CONFIG);
+
+            await sendInactivityNotification();
+
+            const emailCall = mockSESClient.commandCalls(SendEmailCommand)[0];
+            const htmlContent = emailCall.args[0].input.Content?.Simple?.Body?.Html?.Data;
+
+            expect(htmlContent).toBeDefined();
+            // Third person throughout, so the same body serves the user and their administrators
+            expect(htmlContent).toContain('Jane Smith');
+            expect(htmlContent).toContain('jane@example.com');
+            expect(htmlContent).toContain('09/14/2026');
+            expect(htmlContent).toContain('60 days');
+            expect(htmlContent).toContain('re-invite');
+            expect(htmlContent).toContain('https://app.test.compactconnect.org/Dashboard');
+        });
+
+        it('should render the deactivation date in bold everywhere it appears in the body', async () => {
+            mockCompactConfigurationClient.getCompactConfiguration.mockResolvedValue(SAMPLE_COMPACT_CONFIG);
+
+            await sendInactivityNotification();
+
+            const emailCall = mockSESClient.commandCalls(SendEmailCommand)[0];
+            const htmlContent = emailCall.args[0].input.Content?.Simple?.Body?.Html?.Data;
+
+            // The date appears twice in the body: once stating the deactivation date, once as the
+            // sign-in deadline. Both should be emphasized so the date doesn't get lost in the paragraph.
+            expect(htmlContent?.match(/<strong>09\/14\/2026<\/strong>/g)).toHaveLength(2);
+        });
+
+        it('should throw when there are no recipients', async () => {
+            mockCompactConfigurationClient.getCompactConfiguration.mockResolvedValue(SAMPLE_COMPACT_CONFIG);
+
+            await expect(sendInactivityNotification([]))
+                .rejects
+                .toThrow('No recipients found for staff user inactivity notification email');
+        });
+    });
 });

backend/social-work-app/lambdas/nodejs/yarn.lock

@@ -4674,9 +4674,9 @@ ms@^2.1.1, ms@^2.1.3:
   integrity sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==
 
 nanoid@^3.3.16:
-  version "3.3.16"
-  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.16.tgz#a04d8ec4b1f10009d2d533947aefe4293737816c"
-  integrity sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==
+  version "3.3.18"
+  resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.18.tgz#f66a2de1199ffde0fcf21c8a5f13106b1c081913"
+  integrity sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==
 
 napi-postinstall@^0.3.4:
   version "0.3.4"

backend/social-work-app/lambdas/python/common/cc_common/data_model/schema/user/__init__.py

@@ -0,0 +1,70 @@
+# ruff: noqa: N802 we use camelCase to match the marshmallow schema definition
+
+from datetime import datetime
+from uuid import UUID
+
+from cc_common.data_model.schema.common import CCDataClass, CCPermissionsAction
+from cc_common.data_model.schema.user.record import UserRecordSchema
+
+
+class StaffUserData(CCDataClass):
+    """
+    Class representing a Staff User with getters for all properties.
+    """
+
+    # Define record schema at the class level
+    _record_schema = UserRecordSchema()
+
+    # Require valid data when creating instances
+    _requires_data_at_construction = True
+
+    @property
+    def userId(self) -> UUID:
+        return self._data['userId']
+
+    @property
+    def compact(self) -> str:
+        return self._data['compact']
+
+    @property
+    def status(self) -> str:
+        return self._data['status']
+
+    @property
+    def lastLoginAt(self) -> datetime | None:
+        """Absent for users who have not signed in since login tracking was introduced."""
+        return self._data.get('lastLoginAt')
+
+    # The attributes field is flattened here, since its nesting is a storage detail
+    @property
+    def email(self) -> str:
+        return self._data['attributes']['email']
+
+    @property
+    def givenName(self) -> str:
+        return self._data['attributes']['givenName']
+
+    @property
+    def familyName(self) -> str:
+        return self._data['attributes']['familyName']
+
+    @property
+    def compactActions(self) -> set[str]:
+        """Compact-level actions. Empty if the user only has jurisdiction permissions."""
+        return self._data['permissions'].get('actions', set())
+
+    @property
+    def jurisdictions(self) -> set[str]:
+        """Jurisdiction codes where this user holds any permission."""
+        return set(self._data['permissions']['jurisdictions'].keys())
+
+    def jurisdictionActions(self, jurisdiction: str) -> set[str]:
+        """The user's actions in one jurisdiction. Empty if they hold no permissions there."""
+        return self._data['permissions']['jurisdictions'].get(jurisdiction, set())
+
+    @property
+    def isCompactAdmin(self) -> bool:
+        return CCPermissionsAction.ADMIN in self.compactActions
+
+    def isJurisdictionAdmin(self, jurisdiction: str) -> bool:
+        return CCPermissionsAction.ADMIN in self.jurisdictionActions(jurisdiction)

backend/social-work-app/lambdas/python/common/cc_common/data_model/schema/user/api.py

@@ -45,6 +45,8 @@ class UserAPISchema(Schema):
     userId = Raw(required=True, allow_none=False)
     status = String(required=True, allow_none=False, validate=OneOf([status.value for status in StaffUserStatus]))
     dateOfUpdate = Raw(required=True, allow_none=False)
+    # Absent for users who have not signed in
+    lastLoginAt = Raw(required=False, allow_none=False)
     attributes = Nested(UserAttributesAPISchema(), required=True, allow_none=False)
     permissions = Dict(
         keys=String(validate=OneOf(config.compacts)),  # Key is one compact

backend/social-work-app/lambdas/python/common/cc_common/data_model/schema/user/record.py

@@ -1,6 +1,6 @@
 # ruff: noqa: N801, N815  invalid-name
 from marshmallow import Schema, post_dump, post_load, pre_dump
-from marshmallow.fields import UUID, Dict, Nested, String
+from marshmallow.fields import UUID, AwareDateTime, Dict, Nested, String
 from marshmallow.validate import Length, OneOf
 
 from cc_common.config import config
@@ -49,6 +49,9 @@ class UserRecordSchema(BaseRecordSchema):
     compact = String(required=True, allow_none=False, validate=OneOf(config.compacts))
     permissions = Nested(CompactPermissionsRecordSchema(), required=True, allow_none=False)
     status = String(required=True, allow_none=False, validate=OneOf([status.value for status in StaffUserStatus]))
+    # Set by the pre-token-generation hook on every successful access token generation. Absent for users who
+    # have not signed in
+    lastLoginAt = AwareDateTime(required=False, allow_none=False)
 
     # Generated fields
     famGiv = String(required=True, allow_none=False)