security-enhancements

Author: CIS Guru

2-Aquiis.Application/Services/BaseService.cs

@@ -375,10 +375,171 @@ private void SetOrganizationId(TEntity entity, Guid organizationId)
         /// </summary>
         protected virtual async Task<TEntity> SetCreateDefaultsAsync(TEntity entity)
         {
+            // Automatically propagate IsSampleData flag from parent entities
+            await InheritSampleDataFlagFromParentsAsync(entity);
+            
             await Task.CompletedTask;
             return entity;
         }
 
+        /// <summary>
+        /// Checks parent entities for IsSampleData flag and propagates to child entity.
+        /// If any parent entity has IsSampleData = true, the child entity is marked as sample data.
+        /// This ensures sample data "taints" all related records for proper cleanup.
+        /// </summary>
+        /// <param name="entity">The entity being created</param>
+        /// <returns>Task</returns>
+        protected virtual async Task InheritSampleDataFlagFromParentsAsync(TEntity entity)
+        {
+            try
+            {
+                // If already marked as sample data, no need to check parents
+                if (entity.IsSampleData)
+                {
+                    return;
+                }
+
+                // Check for common parent relationship properties
+                var entityType = typeof(TEntity);
+                var properties = entityType.GetProperties();
+
+                // Common parent ID properties to check
+                var parentIdProperties = new[] 
+                { 
+                    "PropertyId", 
+                    "LeaseId", 
+                    "InvoiceId", 
+                    "TenantId", 
+                    "ProspectiveTenantId", 
+                    "RentalApplicationId",
+                    "RepairId",
+                    "InspectionId",
+                    "MaintenanceRequestId",
+                    "OrganizationId" // Check organization itself for multi-tenant sample orgs
+                };
+
+                foreach (var parentPropName in parentIdProperties)
+                {
+                    var parentIdProperty = properties.FirstOrDefault(p => 
+                        p.Name == parentPropName && 
+                        (p.PropertyType == typeof(Guid) || p.PropertyType == typeof(Guid?)));
+
+                    if (parentIdProperty == null) continue;
+
+                    var parentId = parentIdProperty.GetValue(entity);
+                    if (parentId == null || (parentId is Guid guidValue && guidValue == Guid.Empty)) continue;
+
+                    // Determine parent entity type and check IsSampleData flag
+                    bool parentIsSampleData = await CheckParentEntityIsSampleDataAsync(parentPropName, (Guid)parentId);
+                    
+                    if (parentIsSampleData)
+                    {
+                        entity.IsSampleData = true;
+                        _logger.LogInformation(
+                            $"{typeof(TEntity).Name} marked as sample data - inherited from {parentPropName} ({parentId})");
+                        return; // Once marked as sample data, no need to check other parents
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                // Log but don't fail entity creation if sample data check fails
+                _logger.LogWarning(ex, $"Error checking parent sample data flag for {typeof(TEntity).Name}");
+            }
+        }
+
+        /// <summary>
+        /// Checks if a parent entity has IsSampleData = true.
+        /// Simple direct query approach for better reliability and maintainability.
+        /// </summary>
+        /// <param name="parentPropertyName">Parent property name (e.g., "LeaseId", "PropertyId")</param>
+        /// <param name="parentId">Parent entity ID</param>
+        /// <returns>True if parent is sample data, false otherwise</returns>
+        private async Task<bool> CheckParentEntityIsSampleDataAsync(string parentPropertyName, Guid parentId)
+        {
+            try
+            {
+                // Direct queries for each entity type - simple and reliable
+                switch (parentPropertyName)
+                {
+                    case "PropertyId":
+                        var property = await _context.Properties
+                            .Where(p => p.Id == parentId)
+                            .Select(p => p.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return property;
+
+                    case "LeaseId":
+                        var lease = await _context.Leases
+                            .Where(l => l.Id == parentId)
+                            .Select(l => l.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return lease;
+
+                    case "InvoiceId":
+                        var invoice = await _context.Invoices
+                            .Where(i => i.Id == parentId)
+                            .Select(i => i.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return invoice;
+
+                    case "TenantId":
+                        var tenant = await _context.Tenants
+                            .Where(t => t.Id == parentId)
+                            .Select(t => t.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return tenant;
+
+                    case "ProspectiveTenantId":
+                        var prospect = await _context.ProspectiveTenants
+                            .Where(pt => pt.Id == parentId)
+                            .Select(pt => pt.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return prospect;
+
+                    case "RentalApplicationId":
+                        var application = await _context.RentalApplications
+                            .Where(ra => ra.Id == parentId)
+                            .Select(ra => ra.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return application;
+
+                    case "RepairId":
+                        var repair = await _context.Repairs
+                            .Where(r => r.Id == parentId)
+                            .Select(r => r.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return repair;
+
+                    case "InspectionId":
+                        var inspection = await _context.Inspections
+                            .Where(i => i.Id == parentId)
+                            .Select(i => i.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return inspection;
+
+                    case "MaintenanceRequestId":
+                        var maintenanceRequest = await _context.MaintenanceRequests
+                            .Where(mr => mr.Id == parentId)
+                            .Select(mr => mr.IsSampleData)
+                            .FirstOrDefaultAsync();
+                        return maintenanceRequest;
+
+                    // OrganizationId is NOT checked - Organizations don't have IsSampleData flag
+                    // Sample data is marked at the entity level within an organization
+
+                    default:
+                        _logger.LogDebug($"Unknown parent property: {parentPropertyName}");
+                        return false;
+                }
+            }
+            catch (Exception ex)
+            {
+                _logger.LogDebug(ex, $"Could not check IsSampleData for {parentPropertyName}");
+                return false;
+            }
+        }
+
         /// <summary>
         /// Hook method called after creating entity for post-creation operations.
         /// Override in derived services to handle side effects like updating related entities.

2-Aquiis.Application/Services/CalendarEventService.cs

@@ -239,6 +239,12 @@ private CalendarEvent CreateEventFromEntity<T>(T entity)
             where T : BaseModel, ISchedulableEntity
         {
             var eventType = entity.GetEventType();
+            var propertyId = entity.GetPropertyId();
+            
+            // Get property address for Location field
+            var property = propertyId.HasValue 
+                ? _context.Properties.FirstOrDefault(p => p.Id == propertyId.Value) 
+                : null;
 
             return new CalendarEvent
             {
@@ -249,32 +255,43 @@ private CalendarEvent CreateEventFromEntity<T>(T entity)
                 EventType = eventType,
                 Status = entity.GetEventStatus(),
                 Description = entity.GetEventDescription(),
-                PropertyId = entity.GetPropertyId(),
+                PropertyId = propertyId,
+                Location = property?.Address ?? string.Empty, // Set location to property address
                 Color = CalendarEventTypes.GetColor(eventType),
                 Icon = CalendarEventTypes.GetIcon(eventType),
                 SourceEntityId = entity.Id,
                 SourceEntityType = typeof(T).Name,
                 OrganizationId = entity.OrganizationId,
                 CreatedBy = entity.CreatedBy,
-                CreatedOn = DateTime.UtcNow
+                CreatedOn = DateTime.UtcNow,
+                IsSampleData = entity.IsSampleData // Inherit sample data flag from entity
             };
         }
 
         /// <summary>
         /// Update a CalendarEvent from a schedulable entity
         /// </summary>
         private void UpdateEventFromEntity<T>(CalendarEvent evt, T entity) 
-            where T : ISchedulableEntity
+            where T : BaseModel, ISchedulableEntity
         {
+            var propertyId = entity.GetPropertyId();
+            
+            // Get property address for Location field
+            var property = propertyId.HasValue 
+                ? _context.Properties.FirstOrDefault(p => p.Id == propertyId.Value) 
+                : null;
+            
             evt.Title = entity.GetEventTitle();
             evt.StartOn = entity.GetEventStart();
             evt.DurationMinutes = entity.GetEventDuration();
             evt.EventType = entity.GetEventType();
             evt.Status = entity.GetEventStatus();
             evt.Description = entity.GetEventDescription();
-            evt.PropertyId = entity.GetPropertyId();
+            evt.PropertyId = propertyId;
+            evt.Location = property?.Address ?? string.Empty; // Update location to property address
             evt.Color = CalendarEventTypes.GetColor(entity.GetEventType());
             evt.Icon = CalendarEventTypes.GetIcon(entity.GetEventType());
+            evt.IsSampleData = entity.IsSampleData; // Inherit sample data flag from entity
         }
     }
 }

2-Aquiis.Application/Services/DatabaseUnlockService.cs

@@ -69,4 +69,41 @@ public DatabaseUnlockService(
             return (false, $"Error unlocking database: {ex.Message}");
         }
     }
+    
+    /// <summary>
+    /// Archive encrypted database and create fresh database when password forgotten
+    /// </summary>
+    /// <param name="databasePath">Path to encrypted database</param>
+    /// <returns>(Success, ArchivedPath, ErrorMessage)</returns>
+    public async Task<(bool Success, string? ArchivedPath, string? ErrorMessage)> StartWithNewDatabaseAsync(
+        string databasePath)
+    {
+        try
+        {
+            _logger.LogWarning("User requested new database - archiving encrypted database");
+
+            // Create backups directory if it doesn't exist
+            var dbDirectory = Path.GetDirectoryName(databasePath)!;
+            var backupsDir = Path.Combine(dbDirectory, "Backups");
+            Directory.CreateDirectory(backupsDir);
+
+            // Generate archived filename with timestamp and .db extension for easy identification
+            var dbFileNameWithoutExt = Path.GetFileNameWithoutExtension(databasePath);
+            var timestamp = DateTime.Now.ToString("yyyyMMdd-HHmmss");
+            var archivedPath = Path.Combine(backupsDir, $"{dbFileNameWithoutExt}.{timestamp}.encrypted.db");
+
+            // Move encrypted database to backups
+            File.Move(databasePath, archivedPath);
+            _logger.LogInformation("Encrypted database archived to: {ArchivedPath}", archivedPath);
+
+            // New unencrypted database will be created automatically on app restart
+            // The app will detect no database exists and go through first-time setup
+            return (true, archivedPath, null);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Error archiving encrypted database");
+            return (false, null, $"Error archiving database: {ex.Message}");
+        }
+    }
 }

2-Aquiis.Application/Services/InspectionService.cs

@@ -152,33 +152,26 @@ public async Task<List<Inspection>> GetByPropertyIdAsync(Guid propertyId)
         /// </summary>
         public override async Task<Inspection> CreateAsync(Inspection inspection)
         {
-            // Base validation and creation
-            await ValidateEntityAsync(inspection);
-
-            var userId = await GetUserIdAsync();
-            var organizationId = await GetActiveOrganizationIdAsync();
-
-            inspection.Id = Guid.NewGuid();
-            inspection.OrganizationId = organizationId;
-            inspection.CreatedBy = userId;
-            inspection.CreatedOn = DateTime.UtcNow;
-
-            await _context.Inspections.AddAsync(inspection);
-            await _context.SaveChangesAsync();
-
-            // Create calendar event for the inspection
-            await _calendarEventService.CreateOrUpdateEventAsync(inspection);
-
-            // Update property inspection tracking if this is a routine inspection
-            if (inspection.InspectionType == ApplicationConstants.InspectionTypes.Routine)
+            // Call base.CreateAsync to handle:
+            // - Sample data propagation from Property
+            // - Organization context setup
+            // - Audit tracking fields
+            // - Validation
+            var createdInspection = await base.CreateAsync(inspection);
+
+            // Custom logic: Create calendar event for the inspection
+            await _calendarEventService.CreateOrUpdateEventAsync(createdInspection);
+
+            // Custom logic: Update property inspection tracking if this is a routine inspection
+            if (createdInspection.InspectionType == ApplicationConstants.InspectionTypes.Routine)
             {
-                await HandleRoutineInspectionCompletionAsync(inspection);
+                await HandleRoutineInspectionCompletionAsync(createdInspection);
             }
 
             _logger.LogInformation("Created inspection {InspectionId} for property {PropertyId}", 
-                inspection.Id, inspection.PropertyId);
+                createdInspection.Id, createdInspection.PropertyId);
 
-            return inspection;
+            return createdInspection;
         }
 
         /// <summary>