#3896 - Mask Institution User Income View (#3932)

- Masked the `totalFamilyIncome` following the same approach used to
mask the MSFAA.
- Masked only for public institutions.
- The method used to format the money in the NOA UI when it is a number
has no issues with the "masked" string.

![image](https://github.com/user-attachments/assets/9ae48b52-d619-442a-82cf-65db7a9c20c1)

### Sample UI with the masked value


![image](https://github.com/user-attachments/assets/d6eaf9c7-c568-44a2-b7ce-0c1cbeb58781)

sources/packages/backend/apps/api/src/route-controllers/assessment/_tests_/e2e/assessment.institutions.controller.getAssessmentNOA.e2e-spec.ts

@@ -106,7 +106,10 @@ describe("AssessmentInstitutionsController(e2e)-getAssessmentNOA", () => {
         applicationId: application.id,
         applicationNumber: application.applicationNumber,
         applicationStatus: application.applicationStatus,
-        assessment: assessment.assessmentData,
+        assessment: {
+          ...assessment.assessmentData,
+          totalFamilyIncome: "XXXXX",
+        },
         disbursement: {
           disbursement1COEStatus: firstDisbursementSchedule.coeStatus,
           disbursement1Date: getDateOnlyFullMonthFormat(
@@ -210,7 +213,10 @@ describe("AssessmentInstitutionsController(e2e)-getAssessmentNOA", () => {
         applicationId: application.id,
         applicationNumber: application.applicationNumber,
         applicationStatus: application.applicationStatus,
-        assessment: assessment.assessmentData,
+        assessment: {
+          ...assessment.assessmentData,
+          totalFamilyIncome: "XXXXX",
+        },
         disbursement: {
           disbursement1COEStatus: firstDisbursementSchedule.coeStatus,
           disbursement1Date: getDateOnlyFullMonthFormat(

sources/packages/backend/apps/api/src/route-controllers/assessment/assessment.aest.controller.ts

@@ -106,6 +106,7 @@ export class AssessmentAESTController extends BaseController {
   ): Promise<AssessmentNOAAPIOutDTO> {
     return this.assessmentControllerService.getAssessmentNOA(assessmentId, {
       maskMSFAA: false,
+      maskTotalFamilyIncome: false,
     });
   }
 

sources/packages/backend/apps/api/src/route-controllers/assessment/assessment.controller.service.ts

@@ -26,6 +26,7 @@ import {
   ApplicationExceptionService,
   MASKED_MSFAA_NUMBER,
   ApplicationOfferingChangeRequestService,
+  MASKED_MONEY_AMOUNT,
 } from "../../services";
 import {
   AssessmentNOAAPIOutDTO,
@@ -34,6 +35,7 @@ import {
   RequestAssessmentTypeAPIOutDTO,
   AssessmentHistorySummaryAPIOutDTO,
   DynamicAwardValue,
+  AssessmentAPIOutDTO,
 } from "./models/assessment.dto";
 import { getUserFullName } from "../../utilities";
 import { getDateOnlyFormat, getDateOnlyFullMonthFormat } from "@sims/utilities";
@@ -63,6 +65,8 @@ export class AssessmentControllerService {
    * - `studentId` optional student for authorization when needed.
    * - `applicationId` application id,
    * - `maskMSFAA` mask MSFAA or not.
+   * - `maskTotalFamilyIncome` mask total family income resulted
+   * from the assessment calculations. Defaults to true if not provided.
    * @returns notice of assessment data.
    */
   async getAssessmentNOA(
@@ -71,8 +75,10 @@ export class AssessmentControllerService {
       studentId?: number;
       applicationId?: number;
       maskMSFAA?: boolean;
+      maskTotalFamilyIncome?: boolean;
     },
   ): Promise<AssessmentNOAAPIOutDTO> {
+    const maskTotalFamilyIncome = options?.maskTotalFamilyIncome ?? true;
     const assessment = await this.assessmentService.getAssessmentForNOA(
       assessmentId,
       { studentId: options?.studentId, applicationId: options?.applicationId },
@@ -88,8 +94,13 @@ export class AssessmentControllerService {
       );
     }
 
+    const assessmentDTO: AssessmentAPIOutDTO = assessment.assessmentData;
+    if (maskTotalFamilyIncome) {
+      assessmentDTO.totalFamilyIncome = MASKED_MONEY_AMOUNT;
+    }
+
     return {
-      assessment: assessment.assessmentData,
+      assessment: assessmentDTO,
       applicationId: assessment.application.id,
       noaApprovalStatus: assessment.noaApprovalStatus,
       applicationStatus: assessment.application.applicationStatus,

sources/packages/backend/apps/api/src/route-controllers/assessment/assessment.students.controller.ts

@@ -66,6 +66,7 @@ export class AssessmentStudentsController extends BaseController {
     return this.assessmentControllerService.getAssessmentNOA(assessmentId, {
       studentId: userToken.studentId,
       maskMSFAA: false,
+      maskTotalFamilyIncome: false,
     });
   }
 

sources/packages/backend/apps/api/src/route-controllers/assessment/models/assessment.dto.ts

@@ -71,14 +71,28 @@ export class AssessmentHistorySummaryAPIOutDTO {
   hasUnsuccessfulWeeks?: boolean;
 }
 
+/**
+ * Assessment calculations output with possible
+ * adjustments for API output DTO.
+ */
+export type AssessmentAPIOutDTO = Omit<Assessment, "totalFamilyIncome"> & {
+  /**
+   * Total family income to be considered.
+   * Users without proper access should see only a masked value.
+   * This property overrides the original type to allow to keep
+   * the property as number and also as a string, when a mask is required.
+   */
+  totalFamilyIncome: number | string;
+};
+
 export class AssessmentNOAAPIOutDTO {
   @ApiProperty({
     description:
       "Dynamic output of the workflow calculation. " +
       "Contains data that could represent a part-time or a full-time assessment. " +
       "Part-time and full-time will have some common and some specific properties for each payload.",
   })
-  assessment: Assessment;
+  assessment: AssessmentAPIOutDTO;
   applicationId: number;
   applicationNumber: string;
   applicationCurrentAssessmentId: number;

sources/packages/backend/apps/api/src/services/student-assessment/student-assessment.constants.ts

@@ -3,3 +3,4 @@ export const ASSESSMENT_NOT_FOUND = "ASSESSMENT_NOT_FOUND";
 export const ASSESSMENT_INVALID_OPERATION_IN_THE_CURRENT_STATE =
   "ASSESSMENT_INVALID_OPERATION_IN_THE_CURRENT_STATE";
 export const MASKED_MSFAA_NUMBER = "XXXXXXXXXX";
+export const MASKED_MONEY_AMOUNT = "XXXXX";