Fix PandaDoc webhook: fetch fields via API and create applications

apps/backend/src/app.module.ts

@@ -15,6 +15,7 @@ import { DisciplinesModule } from './disciplines/disciplines.module';
 import { AdminInfoModule } from './admin-info/admin-info.module';
 import { CandidateInfoModule } from './candidate-info/candidate-info.module';
 import { AdminProvisioningModule } from './admin-provisioning/admin-provisioning.module';
+import { PandadocWebhookModule } from './pandadoc-webhook/pandadoc-webhook.module';
 
 @Module({
   imports: [
@@ -36,6 +37,8 @@ import { AdminProvisioningModule } from './admin-provisioning/admin-provisioning
     AdminProvisioningModule,
     LearnerInfoModule,
     ApplicationsModule,
+    CandidateInfoModule,
+    PandadocWebhookModule,
   ],
   controllers: [AppController],
   providers: [AppService],

apps/backend/src/applications/application.service.spec.ts

@@ -691,50 +691,6 @@ describe('ApplicationsService', () => {
       await expect(service.create(createApplicationDto)).rejects.toThrow();
     });
 
-    it('should not accept 0 weekly hours', async () => {
-      const createApplicationDto: CreateApplicationDto = {
-        ...dummyCreateApplicationDto,
-        weeklyHours: 0,
-      };
-
-      const savedApplication: Application = {
-        appId: 1,
-        ...createApplicationDto,
-        proposedStartDate: new Date('2024-01-01'),
-        endDate: new Date('2024-06-30'),
-        actualStartDate: undefined,
-        resume: 'janedoe_resume_2_6_2026.pdf',
-        coverLetter: 'janedoe_coverLetter_2_6_2026.pdf',
-        createdAt: new Date('2024-01-01'),
-        updatedAt: new Date('2024-01-01'),
-      };
-
-      mockRepository.save.mockResolvedValue(savedApplication);
-      await expect(service.create(createApplicationDto)).rejects.toThrow();
-    });
-
-    it('should not accept negative weekly hours', async () => {
-      const createApplicationDto: CreateApplicationDto = {
-        ...dummyCreateApplicationDto,
-        weeklyHours: -5,
-      };
-
-      const savedApplication: Application = {
-        appId: 1,
-        ...createApplicationDto,
-        proposedStartDate: new Date('2024-01-01'),
-        endDate: new Date('2024-06-30'),
-        actualStartDate: undefined,
-        resume: 'janedoe_resume_2_6_2026.pdf',
-        coverLetter: 'janedoe_coverLetter_2_6_2026.pdf',
-        createdAt: new Date('2024-01-01'),
-        updatedAt: new Date('2024-01-01'),
-      };
-
-      mockRepository.save.mockResolvedValue(savedApplication);
-      await expect(service.create(createApplicationDto)).rejects.toThrow();
-    });
-
     it('should send an email when creating an application', async () => {
       const savedApplication: Application = {
         appId: 2,
@@ -816,7 +772,7 @@ describe('ApplicationsService', () => {
       };
 
       await expect(service.create(createApplicationDto)).rejects.toThrow(
-        'Weekly hours must be greater than 0 and less than 7 * 24 hours',
+        'Weekly hours must be less than 7 * 24 hours',
       );
     });
   });

apps/backend/src/applications/applications.module.ts

@@ -36,5 +36,6 @@ import { cognitoIdentityProviderFactory } from '../admin-provisioning/cognito.pr
     ApplicationValidationEmailFilter,
     ApplicationCreationErrorFilter,
   ],
+  exports: [ApplicationsService],
 })
 export class ApplicationsModule {}

apps/backend/src/applications/applications.service.ts

@@ -21,6 +21,13 @@ import { LearnerInfo } from '../learner-info/learner-info.entity';
 import { PaginatedResult } from '../common/paginated-result.interface';
 import { ApplicationQueryDto } from './dto/application-query.dto';
 
+type CandidateCreateOptions = {
+  candidateName?: {
+    firstName?: string;
+    lastName?: string;
+  };
+};
+
 /**
  * Columns returned by the paginated list endpoints. Only the fields the admin
  * table renders are selected, so the bulk of each row (availability strings,
@@ -242,6 +249,8 @@ export class ApplicationsService {
     'Confidentiality_Form.pdf';
   private static readonly CONFIDENTIALITY_UPLOAD_FOLDER =
     'confidentiality-forms';
+  private static readonly PANDADOC_RESUBMISSION_LINK =
+    'https://eform.pandadoc.com/?eform=e27f6460-7fa2-40f2-825b-4a83c507b9fe';
 
   private static readonly APPLICATION_EXPORT_HEADERS =
     APPLICATION_EXPORT_COLUMNS.map(([, header]) => header).join(',');
@@ -387,9 +396,9 @@ export class ApplicationsService {
     }
 
     // Validate weeklyHours is positive
-    if (dto.weeklyHours <= 0 || dto.weeklyHours > 7 * 24) {
+    if (dto.weeklyHours > 7 * 24) {
       throw new BadRequestException(
-        'Weekly hours must be greater than 0 and less than 7 * 24 hours',
+        'Weekly hours must be less than 7 * 24 hours',
       );
     }
   }
@@ -880,6 +889,7 @@ export class ApplicationsService {
    */
   async create(
     createApplicationDto: CreateApplicationDto,
+    options?: CandidateCreateOptions,
   ): Promise<Application> {
     this.validateApplicationDto(createApplicationDto);
     const normalizedEmail = createApplicationDto.email.trim().toLowerCase();
@@ -896,10 +906,18 @@ export class ApplicationsService {
     });
     const saved = await this.applicationRepository.save(application);
 
-    await this.candidateProvisioningService.provisionSubmittedCandidate(
-      saved,
-      existingApplicationCount === 0,
-    );
+    if (options?.candidateName) {
+      await this.candidateProvisioningService.provisionSubmittedCandidate(
+        saved,
+        existingApplicationCount === 0,
+        options.candidateName,
+      );
+    } else {
+      await this.candidateProvisioningService.provisionSubmittedCandidate(
+        saved,
+        existingApplicationCount === 0,
+      );
+    }
 
     return saved;
   }
@@ -1091,6 +1109,31 @@ export class ApplicationsService {
     await this.applicationRepository.remove(application);
   }
 
+  async sendSubmissionErrorEmail(
+    applicantDto: CreateApplicationDto,
+    errorMessage: string,
+    applicantName = 'Applicant',
+  ): Promise<void> {
+    const recipientEmail = applicantDto.email?.trim();
+
+    if (!recipientEmail) {
+      return;
+    }
+
+    const emailBody = this.buildApplicationSubmissionErrorEmailBody(
+      applicantName,
+      applicantDto,
+      errorMessage,
+      ApplicationsService.PANDADOC_RESUBMISSION_LINK,
+    );
+
+    await this.emailService.queueEmail(
+      recipientEmail,
+      'Action Required: Issue with Your Application Submission',
+      emailBody,
+    );
+  }
+
   /**
    * Builds the HTML email body for a failed application submission.
    * Uses data directly from the DTO — no database lookup required.

apps/backend/src/applications/candidate-provisioning.service.spec.ts

@@ -188,4 +188,25 @@ describe('CandidateProvisioningService', () => {
       expect.not.stringContaining('Temporary password:'),
     );
   });
+
+  it('uses provided candidate names for database user creation and email greeting', async () => {
+    mockCognitoIdentityProvider.send.mockResolvedValue({});
+
+    await service.provisionSubmittedCandidate(application, true, {
+      firstName: 'Avery',
+      lastName: 'Johnson',
+    });
+
+    expect(mockUsersService.create).toHaveBeenCalledWith(
+      'jane.doe@example.com',
+      'Avery',
+      'Johnson',
+      UserType.STANDARD,
+    );
+    expect(mockEmailService.queueEmail).toHaveBeenCalledWith(
+      'jane.doe@example.com',
+      'Your application has been submitted',
+      expect.stringContaining('Hello Avery,'),
+    );
+  });
 });

apps/backend/src/applications/candidate-provisioning.service.ts

@@ -12,6 +12,11 @@ import { CandidateInfoService } from '../candidate-info/candidate-info.service';
 import { UsersService } from '../users/users.service';
 import { UserType } from '../users/types';
 
+type CandidateName = {
+  firstName?: string;
+  lastName?: string;
+};
+
 @Injectable()
 export class CandidateProvisioningService {
   private readonly logger = new Logger(CandidateProvisioningService.name);
@@ -72,6 +77,28 @@ export class CandidateProvisioningService {
     return { firstName, lastName };
   }
 
+  private cleanNamePart(value: string | undefined): string | undefined {
+    if (!value) {
+      return undefined;
+    }
+
+    const trimmed = value.trim();
+    return trimmed ? this.toTitleCase(trimmed) : undefined;
+  }
+
+  private resolveCandidateName(
+    email: string,
+    candidateName?: CandidateName,
+  ): { firstName: string; lastName: string } {
+    const derived = this.deriveNameParts(email);
+
+    return {
+      firstName:
+        this.cleanNamePart(candidateName?.firstName) ?? derived.firstName,
+      lastName: this.cleanNamePart(candidateName?.lastName) ?? derived.lastName,
+    };
+  }
+
   private generateTemporaryPassword(): string {
     const randomSegment = randomBytes(12).toString('base64url');
     return `Bhchp-${randomSegment}Aa1!`;
@@ -95,13 +122,19 @@ export class CandidateProvisioningService {
     await this.cognitoIdentityProvider.send(command);
   }
 
-  private async ensureStandardUser(email: string): Promise<void> {
+  private async ensureStandardUser(
+    email: string,
+    candidateName?: CandidateName,
+  ): Promise<void> {
     const existingUser = await this.usersService.findOne(email);
     if (existingUser) {
       return;
     }
 
-    const { firstName, lastName } = this.deriveNameParts(email);
+    const { firstName, lastName } = this.resolveCandidateName(
+      email,
+      candidateName,
+    );
     await this.usersService.create(
       email,
       firstName,
@@ -121,9 +154,10 @@ export class CandidateProvisioningService {
   private buildSubmissionEmailBody(
     email: string,
     loginUrl: string,
+    candidateName?: CandidateName,
     temporaryPassword?: string,
   ): string {
-    const { firstName } = this.deriveNameParts(email);
+    const { firstName } = this.resolveCandidateName(email, candidateName);
     const passwordBlock = temporaryPassword
       ? `<p><strong>Temporary password:</strong> ${temporaryPassword}</p>`
       : '';
@@ -147,6 +181,7 @@ export class CandidateProvisioningService {
   async provisionSubmittedCandidate(
     application: Application,
     isFirstApplication: boolean,
+    candidateName?: CandidateName,
   ): Promise<void> {
     const normalizedEmail = application.email.trim().toLowerCase();
     const loginUrl = this.getPublicLoginUrl();
@@ -160,20 +195,20 @@ export class CandidateProvisioningService {
           normalizedEmail,
           temporaryPassword,
         );
-        await this.ensureStandardUser(normalizedEmail);
+        await this.ensureStandardUser(normalizedEmail, candidateName);
       } catch (error) {
         if (this.isUsernameExistsError(error)) {
           this.logger.warn(
             `Candidate Cognito user already exists for ${normalizedEmail}; sending login link without temporary password.`,
           );
           temporaryPassword = undefined;
-          await this.ensureStandardUser(normalizedEmail);
+          await this.ensureStandardUser(normalizedEmail, candidateName);
         } else {
           throw error;
         }
       }
     } else {
-      await this.ensureStandardUser(normalizedEmail);
+      await this.ensureStandardUser(normalizedEmail, candidateName);
     }
 
     await this.candidateInfoService.create(application.appId, normalizedEmail);
@@ -184,6 +219,7 @@ export class CandidateProvisioningService {
       this.buildSubmissionEmailBody(
         normalizedEmail,
         loginUrl,
+        candidateName,
         temporaryPassword,
       ),
     );

apps/backend/src/data-source.ts

@@ -27,6 +27,7 @@ const AppDataSource = new DataSource({
         ca: sslCa,
       }
     : undefined,
+  // ssl: { rejectUnauthorized: false },
   entities: [
     Application,
     CandidateInfo,

apps/backend/src/disciplines/disciplines.controller.ts

@@ -34,7 +34,7 @@ export class DisciplinesController {
    * @returns a list of all disciplines
    */
   @Get()
-  @Roles(UserType.ADMIN)
+  @Roles(UserType.ADMIN, UserType.STANDARD)
   async getAll(
     @Query('includeInactive') includeInactive?: string,
   ): Promise<Discipline[]> {

apps/backend/src/learner-info/learner-info.controller.ts

@@ -1,16 +1,19 @@
 import {
   Body,
   Controller,
+  ForbiddenException,
   Get,
   Param,
   Post,
+  Req,
   UseGuards,
   UseInterceptors,
 } from '@nestjs/common';
 import { LearnerInfo } from './learner-info.entity';
 import { ApiTags } from '@nestjs/swagger';
 import { LearnerInfoService } from './learner-info.service';
 import { CreateLearnerInfoDto } from './dto/create-learner-info.request.dto';
+import { ApplicationsService } from '../applications/applications.service';
 import { CurrentUserInterceptor } from '../interceptors/current-user.interceptor';
 import { AuthGuard } from '@nestjs/passport';
 import { UserType } from '../users/types';
@@ -25,7 +28,10 @@ import { RolesGuard } from '../auth/roles.guard';
 @UseInterceptors(CurrentUserInterceptor)
 @UseGuards(AuthGuard('jwt'), RolesGuard)
 export class LearnerInfoController {
-  constructor(private learnerInfoService: LearnerInfoService) {}
+  constructor(
+    private learnerInfoService: LearnerInfoService,
+    private applicationsService: ApplicationsService,
+  ) {}
 
   /**
    * Exposes an endpoint to create a learner info.
@@ -51,8 +57,20 @@ export class LearnerInfoController {
    * @throws {BadRequestException} if the id field is invalid (e.g. null or undefined)
    */
   @Get('/:appId')
-  @Roles(UserType.ADMIN)
-  async getLearnerInfo(@Param('appId') appId: number): Promise<LearnerInfo> {
+  @Roles(UserType.ADMIN, UserType.STANDARD)
+  async getLearnerInfo(
+    @Param('appId') appId: number,
+    @Req() req: { user?: { email?: string; userType?: UserType } },
+  ): Promise<LearnerInfo> {
+    if (req.user?.userType === UserType.STANDARD) {
+      const application = await this.applicationsService.findById(appId);
+      if (req.user.email !== application.email) {
+        throw new ForbiddenException(
+          'Standard users can only access their own learner info.',
+        );
+      }
+    }
+
     return await this.learnerInfoService.findById(appId);
   }
 }