Merge pull request 'PartnerUi fixes' (#162) from finishline into main

Reviewed-on: #162
2026-10-24 11:49:45 +02:00
parent cc62696017 16fb6b9434
commit a3f461478c
11 changed files with 235 additions and 516 deletions
@@ -1,4 +1,4 @@
-using PostFundManagement.Application.Abstractions.Services;
+using PostFundManagement.Application.Abstractions.Services;
 using PostFundManagement.Application.Extensions;
 using PostFundManagement.Domain.Abstractions;
 using PostFundManagement.Domain.Errors;
@@ -13,22 +13,29 @@ public sealed class SetUserLockoutEndpoint : IEndpoint
    {
        builder.MapPut("api/users/{userId:Guid}/session/lockout/{disable:bool}", async (Guid userId, bool disable, HttpContext context,
            IUserService service, CancellationToken cancellationToken = default) =>
-                await service.SetUserLockoutAsync(userId, context.GetUserId(), disable, cancellationToken) switch
-                {
-                    {  IsSuccess: true } => Results.Ok(),
-                    var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
-                    var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
-                    var r => Results.InternalServerError(r.Errors.ToProblems())
-                })
-            .WithDescription("Lock user session")
-            .RequireAuthorization(Constants.MainScope)
-            .WithName(typeof(SetUserLockoutEndpoint).ToEndpointName())
-            .MapToApiVersion(new ApiVersion(1))
-            .Produces(StatusCodes.Status200OK)
-            .Produces(StatusCodes.Status401Unauthorized)
-            .Produces<Problems>(StatusCodes.Status404NotFound)
-            .Produces<Problems>(StatusCodes.Status400BadRequest)
-            .Produces<Problems>(StatusCodes.Status500InternalServerError)
-            .WithTags(EndpointTags.Users);
+        {
+            var (_, role) = context.User.GetUserRole();
+            if (role != null && role.Equals("Partner", StringComparison.OrdinalIgnoreCase))
+                return Results.Forbid();
+
+            return await service.SetUserLockoutAsync(userId, context.GetUserId(), disable, cancellationToken) switch
+            {
+                {  IsSuccess: true } => Results.Ok(),
+                var r when r.HasError<NotFoundError>() => Results.NotFound(r.Errors.ToProblems()),
+                var r when r.HasError<UpdateError>() => Results.BadRequest(r.Errors.ToProblems()),
+                var r => Results.InternalServerError(r.Errors.ToProblems())
+            };
+        })
+        .WithDescription("Lock user session")
+        .RequireAuthorization(Constants.MainScope)
+        .WithName(typeof(SetUserLockoutEndpoint).ToEndpointName())
+        .MapToApiVersion(new ApiVersion(1))
+        .Produces(StatusCodes.Status200OK)
+        .Produces(StatusCodes.Status401Unauthorized)
+        .Produces(StatusCodes.Status403Forbidden)
+        .Produces<Problems>(StatusCodes.Status404NotFound)
+        .Produces<Problems>(StatusCodes.Status400BadRequest)
+        .Produces<Problems>(StatusCodes.Status500InternalServerError)
+        .WithTags(EndpointTags.Users);
    }
 }
@@ -29,7 +29,7 @@ builder.Services.AddApiVersioning(options =>

 builder.Services.AddScoped<ActiveUserFilter>();
 builder.Services.AddScoped<UserRoleFilter>();
-builder.Services.AddTransient<ITenantContextService, TenantContextService>();
+builder.Services.AddScoped<ITenantContextService, TenantContextService>();

 builder.Services.AddEndpoints(Assembly.GetExecutingAssembly());
 builder.Services.AddApiServices(builder.Configuration);
@@ -218,4 +218,4 @@ app.MapGet("/", () => Results.Redirect($"/openapi/{latestVersionGroup}"))
 if (!app.Environment.IsDevelopment())
    app.UseExceptionHandler("/Error", createScopeForErrors: true);

-app.Run();
+app.Run();
@@ -1,4 +1,4 @@
-namespace PostFundManagement.Application.Extensions;
+namespace PostFundManagement.Application.Extensions;

 public static class General
 {
@@ -16,7 +16,8 @@ public static class General

    public static (bool Decoded, Guid userId) GetUserId(this ClaimsPrincipal principal)
    {
-        var subClaim = principal.FindFirst(JwtRegisteredClaimNames.Sub)?.Value ?? principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        var subClaim = principal.FindFirst(JwtRegisteredClaimNames.Sub)?.Value 
+            ?? principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;

        var decoded = Guid.TryParse(subClaim, out var userId);

@@ -25,20 +26,34 @@ public static class General

    public static (bool Decoded, string email) GetUserEmail(this ClaimsPrincipal principal)
    {
-        var emailClaim = principal.FindFirst("email")?.Value ?? principal.FindFirst(ClaimTypes.Email)?.Value;
+        var emailClaim = principal.FindFirst("email")?.Value 
+            ?? principal.FindFirst(ClaimTypes.Email)?.Value
+            ?? principal.FindFirst("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress")?.Value
+            ?? principal.FindFirst("preferred_username")?.Value
+            ?? principal.FindFirst("name")?.Value
+            ?? principal.FindFirst(ClaimTypes.Name)?.Value;

        var decoded = !string.IsNullOrWhiteSpace(emailClaim);

-        return (decoded, emailClaim!);
+        return (decoded, emailClaim ?? string.Empty);
    }

    public static (bool Decoded, string role) GetUserRole(this ClaimsPrincipal principal)
    {
-        var roleClaim = principal.FindFirst("role")?.Value ?? principal.FindFirst(ClaimTypes.Role)?.Value;
+        var roleClaims = principal.FindAll("role")
+            .Concat(principal.FindAll(ClaimTypes.Role))
+            .Concat(principal.FindAll("http://schemas.microsoft.com/ws/2008/06/identity/claims/role"))
+            .Concat(principal.FindAll("roles"))
+            .Select(c => c.Value)
+            .Where(v => !string.IsNullOrWhiteSpace(v))
+            .ToList();

-        var decoded = !string.IsNullOrWhiteSpace(roleClaim);
+        var partnerRole = roleClaims.FirstOrDefault(r => r.Equals("Partner", StringComparison.OrdinalIgnoreCase));
+        var role = partnerRole ?? roleClaims.FirstOrDefault();

-        return (decoded, roleClaim!);
+        var decoded = !string.IsNullOrWhiteSpace(role);
+
+        return (decoded, role ?? string.Empty);
    }

    public static Microsoft.AspNetCore.Mvc.ProblemDetails ToProblems(this IReadOnlyList<IError> errors, int statusCode = StatusCodes.Status400BadRequest) => new()
@@ -1,5 +1,5 @@
 <!doctype html>
-<html lang="en" class="h-full bg-slate-950 text-slate-100">
+<html lang="en" class="dark h-full bg-slate-950 text-slate-100">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
@@ -10,8 +10,8 @@
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
    <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@300;400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap" rel="stylesheet" />
  </head>
-  <body class="h-full bg-slate-950 font-sans text-slate-100 antialiased selection:bg-emerald-500/20 selection:text-emerald-300">
-    <div id="root" class="min-h-full flex flex-col"></div>
+  <body class="dark h-full bg-slate-950 font-sans text-slate-100 antialiased selection:bg-emerald-500/20 selection:text-emerald-300">
+    <div id="root" class="min-h-full flex flex-col bg-slate-950 text-slate-100"></div>
    <script src="/env-config.js"></script>
    <script type="module" src="/src/main.tsx"></script>
  </body>
@@ -17,7 +17,6 @@ import { AccountActivationModal } from '../components/auth/AccountActivationModa
 import { NonPartnerAccessDeniedModal } from '../components/auth/NonPartnerAccessDeniedModal';
 import { SessionExpiredModal } from '../components/auth/SessionExpiredModal';
 import { encodeHashIdSync } from '../services/toolsService';
-import { verifyTenantLockout, clearTenantLockoutCache } from '../services/tenantLockoutService';
 import {
  onSessionExpired,
  triggerSessionExpired,
@@ -510,35 +509,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                return;
              }

-              // Step 3: Verify tenant lockout using the HashId-encoded tenant ID
-              const effectiveTenantId =
-                parsedTenantId ??
-                syncResult.data?.tenantId ??
-                syncResult.data?.organisationId ??
-                tenantClaimValues.tenantId;
-
-              const tenantLockoutResult = await verifyTenantLockout(effectiveTenantId, tenantClaim);
-
-              if (!tenantLockoutResult.isActive) {
-                setIsPendingActivation(true);
-                setIsSynced(false);
-                setActivationError(tenantLockoutResult.errorMessage || 'Tenant is inactive or not found');
-                setIsLoading(false);
-                return;
-              }
-
-              if (tenantLockoutResult.tenant?.name) {
-                profile.tenant = tenantLockoutResult.tenant.name;
-                setTenantName(tenantLockoutResult.tenant.name);
-              }
-              if (tenantLockoutResult.tenant?.id !== undefined && !profile.tenant_id) {
-                const numericTid = Number(tenantLockoutResult.tenant.id);
-                if (!isNaN(numericTid) && numericTid > 0) {
-                  profile.tenant_id = numericTid;
-                  setTenantId(numericTid);
-                }
-              }
-
              setUser({ ...profile });
              localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(profile));

@@ -669,39 +639,6 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
                return;
              }

-              // Step 3: Verify tenant lockout using HashId-encoded tenant ID
-              const effectiveTenantId =
-                storedTenantId ??
-                syncResult.data?.tenantId ??
-                syncResult.data?.organisationId ??
-                tenantClaimValues.tenantId;
-
-              const tenantLockoutResult = await verifyTenantLockout(
-                effectiveTenantId,
-                storedTenantClaim,
-                hadPendingActivation
-              );
-
-              if (!tenantLockoutResult.isActive) {
-                setIsPendingActivation(true);
-                setIsSynced(false);
-                setActivationError(tenantLockoutResult.errorMessage || 'Tenant is inactive or not found');
-                return;
-              }
-
-              if (tenantLockoutResult.tenant?.name) {
-                if (resolvedUser) {
-                  resolvedUser.tenant = tenantLockoutResult.tenant.name;
-                }
-                setTenantName(tenantLockoutResult.tenant.name);
-              }
-              if (tenantLockoutResult.tenant?.id !== undefined && resolvedUser && !resolvedUser.tenant_id) {
-                const numericTid = Number(tenantLockoutResult.tenant.id);
-                if (!isNaN(numericTid) && numericTid > 0) {
-                  resolvedUser.tenant_id = numericTid;
-                  setTenantId(numericTid);
-                }
-              }
              if (resolvedUser) {
                setUser({ ...resolvedUser });
                localStorage.setItem(LOCAL_STORAGE_USER_KEY, JSON.stringify(resolvedUser));
@@ -746,8 +683,7 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
  const syncUserSession = async (force = true): Promise<UserSyncResult> => {
    try {
      await loadRuntimeConfig();
-      clearTenantLockoutCache();
-      if (sub) {
+            if (sub) {
        clearCachedUserRbac(sub);
      }

@@ -793,41 +729,7 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
        localStorage.setItem(LOCAL_STORAGE_CLAIMS_KEY, JSON.stringify(resolved.claims));
      } catch {}

-      const tenantClaimValues = extractTenantClaimValues(claims, accessToken);
-      const effectiveTenantId =
-        currentTenantId ??
-        result.data?.tenantId ??
-        result.data?.organisationId ??
-        tenantClaimValues.tenantId;
-      const effectiveTenantClaim = currentTenantClaim || tenantClaimValues.tenant || undefined;
-
-      // Step 3: Verify tenant lockout using HashId-encoded tenant ID
-      const tenantLockoutResult = await verifyTenantLockout(
-        effectiveTenantId,
-        effectiveTenantClaim,
-        true
-      );
-      if (!tenantLockoutResult.isActive) {
-        const msg = tenantLockoutResult.errorMessage || 'Tenant is not Active. Lockout active.';
-        setIsPendingActivation(true);
-        setIsSynced(false);
-        setActivationError(msg);
-        return {
-          success: false,
-          isActivationPending: true,
-          errorMessage: msg,
-        };
-      }
-
-      if (tenantLockoutResult.tenant?.name) {
-        setTenantName(tenantLockoutResult.tenant.name);
-      }
-      if (tenantLockoutResult.tenant?.id !== undefined && !tenantId) {
-        const numericTid = Number(tenantLockoutResult.tenant.id);
-        if (!isNaN(numericTid) && numericTid > 0) {
-          setTenantId(numericTid);
-        }
-      }
+      // Partner user verified successfully

      setActivationPending(false);
      setIsPendingActivation(false);
@@ -873,8 +775,7 @@ export const AuthProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
      localStorage.removeItem(LOCAL_STORAGE_SUB_KEY);
      localStorage.removeItem(LOCAL_STORAGE_CLAIMS_KEY);
      clearUserSyncInBrowser();
-      clearTenantLockoutCache();
-      setUser(null);
+            setUser(null);
      setSub('');
      setClaims({});
      setTenantId(null);
@@ -2,18 +2,14 @@ import React, { useState, useEffect } from 'react';
 import { createPortal } from 'react-dom';
 import { useNavigate } from 'react-router-dom';
 import {
-  ShieldAlert,
  RefreshCw,
  LogOut,
-  UserCheck,
-  CheckCircle2,
-  AlertTriangle,
-  ArrowLeft,
-  Mail,
  Building2,
-  Fingerprint,
+  Clock,
+  ArrowLeft,
+  Sparkles,
 } from 'lucide-react';
-import { BrandLogo } from '../ui/BrandLogo';
+import { PfmPartnerLogo } from '../common/PfmPartnerLogo';
 import { AuthUserProfile, UserClaims } from '../../auth/AuthProvider';
 import { cancelSessionExpiration, dismissSubordinateModals } from '../../services/sessionExpiration';

@@ -29,7 +25,6 @@ interface AccountActivationModalProps {
 export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
  user,
  claims,
-  sub,
  onSync,
  onLogout,
  initialError,
@@ -37,7 +32,6 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
  const navigate = useNavigate();
  const [isSyncing, setIsSyncing] = useState(false);
  const [errorMessage, setErrorMessage] = useState<string | null>(initialError || null);
-  const [syncAttemptCount, setSyncAttemptCount] = useState(0);

  useEffect(() => {
    if (initialError !== undefined) {
@@ -54,16 +48,9 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
    user?.name ||
    (claims.name as string) ||
    (claims.preferred_username as string) ||
-    'Registered Partner';
-
-  const displayEmail =
-    user?.email ||
-    (claims.email as string) ||
-    (claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'] as string) ||
-    '';
+    'Partner';

  const tenant = user?.tenant || (claims.tenant as string) || (claims.org as string) || 'Partner Organisation';
-  const role = user?.role || (claims.role as string) || 'Partner';

  const handleSyncClick = async () => {
    if (isSyncing) return;
@@ -80,10 +67,9 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
      }

      if (!result.success) {
-        setSyncAttemptCount((prev) => prev + 1);
        setErrorMessage(
          result.errorMessage ||
-            'Your partner account is not yet enabled. Please ask your funding administrator to activate your account.'
+            'Activation is still being reviewed by your funding administrator. Please check back shortly.'
        );
      }
    } catch (err: unknown) {
@@ -93,10 +79,7 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
        navigate('/', { replace: true });
        return;
      }
-      setErrorMessage(
-        errObj?.message ||
-          'Account activation check encountered an error. Please confirm with your administrator and try again.'
-      );
+      setErrorMessage('Unable to verify activation right now. Please try again in a few moments.');
    } finally {
      setIsSyncing(false);
    }
@@ -116,147 +99,87 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
      role="dialog"
      aria-modal="true"
      aria-labelledby="activation-modal-title"
-      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 sm:p-6 bg-[#060a12]/90 backdrop-blur-md animate-in fade-in duration-200 select-none overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 sm:p-6 bg-slate-950/80 backdrop-blur-2xl animate-in fade-in duration-300 select-none overflow-y-auto"
    >
+      {/* Background ambient lighting matching LandingPage */}
+      <div className="pointer-events-none absolute inset-0 overflow-hidden">
+        <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 w-[500px] h-[500px] bg-gradient-to-tr from-emerald-500/15 via-teal-500/10 to-cyan-500/15 blur-[120px] rounded-full" />
+      </div>
+
      <div
-        className="relative w-full max-w-xl bg-[#0d1322] border border-amber-500/30 rounded-2xl shadow-2xl shadow-black/80 overflow-hidden flex flex-col text-slate-100 my-auto"
+        className="relative w-full max-w-md rounded-3xl border border-white/10 bg-slate-900/85 backdrop-blur-xl shadow-[0_25px_60px_rgba(0,0,0,0.85),inset_0_1px_1px_rgba(255,255,255,0.15)] overflow-hidden flex flex-col items-center text-center p-8 sm:p-10 my-auto space-y-6"
        onClick={(e) => e.stopPropagation()}
      >
-        <div className="h-1.5 w-full bg-gradient-to-r from-amber-500 via-amber-400 to-emerald-500" />
+        {/* Glowing Brand Icon Lockup */}
+        <div className="relative flex items-center justify-center pt-2">
+          <div className="absolute -inset-3 rounded-full bg-emerald-500/20 blur-xl animate-pulse" />
+          <PfmPartnerLogo className="h-16 w-16 drop-shadow-[0_8px_24px_rgba(16,185,129,0.35)] relative z-10" />
+        </div>

-        <div className="p-6 pb-4 border-b border-slate-800/80 bg-[#0f172a]/60">
-          <div className="flex items-start justify-between gap-4">
-            <div className="flex items-center gap-3.5">
-              <div className="relative p-2.5 rounded-xl bg-amber-500/10 border border-amber-500/20 text-amber-400">
-                <ShieldAlert className="w-6 h-6" />
-                <span className="absolute -top-1 -right-1 flex h-2.5 w-2.5">
-                  <span className="animate-ping absolute inline-flex h-full w-full rounded-full bg-amber-400 opacity-75"></span>
-                  <span className="relative inline-flex rounded-full h-2.5 w-2.5 bg-amber-500"></span>
-                </span>
-              </div>
-              <div>
-                <span className="inline-flex items-center gap-1.5 text-[11px] font-semibold tracking-wider uppercase text-amber-400 bg-amber-500/10 border border-amber-500/20 px-2 py-0.5 rounded-full mb-1">
-                  Access Restricted • Activation Pending
-                </span>
-                <h2 id="activation-modal-title" className="text-lg sm:text-xl font-bold text-white tracking-tight">
-                  {errorMessage?.toLowerCase().includes('tenant')
-                    ? 'Organisation Account Inactive'
-                    : 'Partner Account Pending Activation'}
-                </h2>
-              </div>
-            </div>
-
-            <BrandLogo size={36} showGlow={false} animateOnHover={false} />
+        {/* Title & Organization Pill */}
+        <div className="space-y-2">
+          <div className="inline-flex items-center gap-1.5 px-3 py-1 rounded-full bg-emerald-500/10 border border-emerald-500/20 text-[11px] font-semibold text-emerald-300">
+            <Clock className="w-3.5 h-3.5 text-emerald-400" />
+            <span>Activation Pending</span>
+          </div>
+          <h2 id="activation-modal-title" className="text-2xl font-bold tracking-tight text-white">
+            Welcome,{' '}
+            <span className="bg-gradient-to-r from-emerald-300 via-teal-200 to-cyan-300 bg-clip-text text-transparent">
+              {displayName}
+            </span>
+          </h2>
+          <div className="inline-flex items-center gap-1.5 text-xs text-slate-400 font-medium">
+            <Building2 className="w-3.5 h-3.5 text-teal-400 shrink-0" />
+            <span>{tenant}</span>
          </div>
        </div>

-        <div className="p-6 space-y-5 overflow-y-auto max-h-[70vh]">
-          <div className="bg-slate-900/80 border border-slate-800 rounded-xl p-4 space-y-2.5">
-            <div className="flex items-center gap-2 text-emerald-400 text-xs font-semibold">
-              <CheckCircle2 className="w-4 h-4 shrink-0" />
-              <span>Signed In Successfully</span>
-            </div>
-            <p className="text-xs text-slate-300 leading-relaxed">
-              You have signed in successfully, but your partner account is waiting to be activated by the funding administrator.
-            </p>
-            <p className="text-xs text-slate-400 leading-relaxed border-t border-slate-800/80 pt-2 font-medium">
-              Once your administrator confirms your account is active, click{' '}
-              <strong className="text-white">Check Account Status</strong> below to open your dashboard.
-            </p>
-          </div>
-
-          <div className="rounded-xl border border-slate-800 bg-[#090e1a]/60 p-4 space-y-3">
-            <div className="text-[11px] font-semibold text-slate-400 uppercase tracking-wider flex items-center justify-between">
-              <span>Your Partner Profile</span>
-              <span className="text-amber-400/90 text-[10px] font-mono bg-amber-500/10 px-2 py-0.5 rounded border border-amber-500/20">
-                Pending Activation
-              </span>
-            </div>
-
-            <div className="grid grid-cols-1 sm:grid-cols-2 gap-3 text-xs">
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <UserCheck className="w-4 h-4 text-emerald-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Name</span>
-                  <span className="font-semibold text-white truncate block">{displayName}</span>
-                </div>
-              </div>
-
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <Mail className="w-4 h-4 text-teal-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Email</span>
-                  <span className="font-semibold text-slate-200 truncate block">{displayEmail || 'Not specified'}</span>
-                </div>
-              </div>
-
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <Building2 className="w-4 h-4 text-cyan-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Organisation / Role</span>
-                  <span className="font-semibold text-slate-200 truncate block">
-                    {tenant} ({role})
-                  </span>
-                </div>
-              </div>
-
-              <div className="flex items-center gap-2.5 bg-slate-900/60 p-2.5 rounded-lg border border-slate-800/60">
-                <Fingerprint className="w-4 h-4 text-slate-400 shrink-0" />
-                <div className="min-w-0">
-                  <span className="text-[10px] text-slate-500 block">Account ID</span>
-                  <span className="font-mono text-[11px] text-slate-400 truncate block">{sub || 'SSO-Principal'}</span>
-                </div>
-              </div>
-            </div>
-          </div>
-
-          {errorMessage && (
-            <div className="rounded-xl border border-rose-500/30 bg-rose-500/10 p-3.5 flex items-start gap-3 animate-in fade-in duration-150">
-              <AlertTriangle className="w-4 h-4 text-rose-400 shrink-0 mt-0.5" />
-              <div className="space-y-1">
-                <p className="text-xs font-semibold text-rose-300">Account Not Activated Yet</p>
-                <p className="text-xs text-rose-200/90 leading-relaxed">{errorMessage}</p>
-                {syncAttemptCount > 0 && (
-                  <p className="text-[11px] text-rose-400/80 pt-1">
-                    Checked #{syncAttemptCount} at {new Date().toLocaleTimeString()}
-                  </p>
-                )}
-              </div>
-            </div>
-          )}
-        </div>
-
-        <div className="p-5 border-t border-slate-800/80 bg-[#0a0f1d] flex flex-col sm:flex-row items-center justify-between gap-3">
-          <div className="flex items-center gap-2 w-full sm:w-auto">
-            <button
-              onClick={handleNavigateLanding}
-              type="button"
-              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3.5 py-2 text-xs font-medium text-slate-400 hover:text-slate-200 bg-slate-900 hover:bg-slate-800 border border-slate-800 rounded-xl transition cursor-pointer"
-            >
-              <ArrowLeft className="w-3.5 h-3.5" />
-              <span>Home Page</span>
-            </button>
-
-            <button
-              onClick={handleSignOut}
-              type="button"
-              className="flex-1 sm:flex-none inline-flex items-center justify-center gap-1.5 px-3.5 py-2 text-xs font-medium text-slate-400 hover:text-rose-400 bg-slate-900 hover:bg-rose-500/10 border border-slate-800 hover:border-rose-500/30 rounded-xl transition cursor-pointer"
-            >
-              <LogOut className="w-3.5 h-3.5" />
-              <span>Sign Out</span>
-            </button>
+        {/* Core Friendly Message */}
+        <p className="text-sm text-slate-300 leading-relaxed max-w-sm">
+          Your credentials have been authenticated. Your funding administrator is finalizing your portfolio access.
+        </p>
+
+        {/* Notice badge if check returned not yet ready */}
+        {errorMessage && (
+          <div className="w-full rounded-2xl bg-amber-500/10 border border-amber-500/20 p-3 text-xs text-amber-300/90 leading-relaxed text-center flex items-center justify-center gap-2">
+            <Sparkles className="w-4 h-4 text-amber-400 shrink-0" />
+            <span>{errorMessage}</span>
          </div>
+        )}

+        {/* Action Button matching Specular / Landing styling */}
+        <div className="w-full space-y-3 pt-2">
          <button
            onClick={handleSyncClick}
            disabled={isSyncing}
            type="button"
            id="activation-sync-btn"
-            className="w-full sm:w-auto inline-flex items-center justify-center gap-2 px-5 py-2.5 text-xs font-semibold text-white bg-emerald-600 hover:bg-emerald-500 active:bg-emerald-700 disabled:opacity-50 disabled:pointer-events-none rounded-xl shadow-lg shadow-emerald-600/30 transition cursor-pointer"
+            className="w-full py-3.5 px-6 rounded-2xl bg-gradient-to-r from-emerald-600 via-teal-600 to-emerald-500 hover:from-emerald-500 hover:to-teal-500 active:scale-[0.99] disabled:opacity-60 disabled:pointer-events-none text-white font-bold text-sm tracking-wide shadow-[0_12px_30px_rgba(16,185,129,0.35),inset_0_1px_1px_rgba(255,255,255,0.3)] hover:shadow-[0_16px_36px_rgba(16,185,129,0.5)] transition-all flex items-center justify-center gap-2 cursor-pointer"
          >
-            <RefreshCw className={`w-4 h-4 ${isSyncing ? 'animate-spin' : ''}`} />
+            <RefreshCw className={`w-4 h-4 text-emerald-100 ${isSyncing ? 'animate-spin' : ''}`} />
            <span>{isSyncing ? 'Checking Status...' : 'Check Account Status'}</span>
          </button>
+
+          {/* Minimal Secondary Actions */}
+          <div className="flex items-center justify-center gap-4 text-xs pt-1">
+            <button
+              onClick={handleNavigateLanding}
+              type="button"
+              className="inline-flex items-center gap-1.5 text-slate-400 hover:text-slate-200 transition-colors py-1 cursor-pointer"
+            >
+              <ArrowLeft className="w-3.5 h-3.5" />
+              <span>Landing Page</span>
+            </button>
+            <span className="text-slate-700">•</span>
+            <button
+              onClick={handleSignOut}
+              type="button"
+              className="inline-flex items-center gap-1.5 text-slate-400 hover:text-rose-400 transition-colors py-1 cursor-pointer"
+            >
+              <LogOut className="w-3.5 h-3.5" />
+              <span>Sign Out</span>
+            </button>
+          </div>
        </div>
      </div>
    </div>
@@ -266,4 +189,3 @@ export const AccountActivationModal: React.FC<AccountActivationModalProps> = ({
    ? createPortal(modalContent, document.body)
    : modalContent;
 };
-
@@ -1,16 +1,8 @@
 import React, { useEffect } from 'react';
 import { createPortal } from 'react-dom';
 import { useNavigate } from 'react-router-dom';
-import {
-  ShieldAlert,
-  LogOut,
-  Ban,
-  Mail,
-  Building2,
-  Fingerprint,
-  Lock,
-} from 'lucide-react';
-import { BrandLogo } from '../ui/BrandLogo';
+import { ShieldCheck, LogOut, ArrowLeft, Lock } from 'lucide-react';
+import { PfmPartnerLogo } from '../common/PfmPartnerLogo';
 import { AuthUserProfile, UserClaims } from '../../auth/AuthProvider';
 import { cancelSessionExpiration, dismissSubordinateModals } from '../../services/sessionExpiration';

@@ -22,14 +14,9 @@ interface NonPartnerAccessDeniedModalProps {
  onLogout: () => Promise<void>;
 }

-/**
- * Blocks any authenticated user who does NOT hold the 'Partner' role.
- * RBAC on PartnerUI strictly permits only Partner roles; no other roles are allowed.
- */
 export const NonPartnerAccessDeniedModal: React.FC<NonPartnerAccessDeniedModalProps> = ({
  user,
  claims,
-  sub,
  roles,
  onLogout,
 }) => {
@@ -40,133 +27,79 @@ export const NonPartnerAccessDeniedModal: React.FC<NonPartnerAccessDeniedModalPr
    dismissSubordinateModals();
  }, []);

-  const displayName =
-    user?.name ||
-    (claims.name as string) ||
-    (claims.preferred_username as string) ||
-    'Authenticated User';
-
  const displayEmail =
    user?.email ||
    (claims.email as string) ||
    (claims['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'] as string) ||
-    '';
+    'Authenticated User';

-  const tenant = user?.tenant || (claims.tenant as string) || (claims.org as string) || 'Statutory Enterprise';
-  const assignedRolesDisplay = roles.length > 0 ? roles.join(', ') : user?.role || (claims.role as string) || 'Unassigned';
+  const assignedRolesDisplay = roles.length > 0 ? roles.join(', ') : user?.role || (claims.role as string) || 'Standard User';

  const handleLogoutClick = async () => {
    await onLogout();
    navigate('/', { replace: true });
  };

+  const handleLandingClick = () => {
+    navigate('/');
+  };
+
  const modalContent = (
    <div
      role="alertdialog"
      aria-modal="true"
      aria-labelledby="non-partner-denied-title"
-      aria-describedby="non-partner-denied-description"
-      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-black/85 backdrop-blur-md animate-in fade-in duration-200 overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-slate-950/85 backdrop-blur-2xl animate-in fade-in duration-300 overflow-y-auto"
    >
-      <div className="relative w-full max-w-lg overflow-hidden rounded-2xl bg-[#0e1424] border border-rose-900/60 shadow-2xl shadow-rose-950/50 my-auto">
-        <div className="h-2 w-full bg-gradient-to-r from-rose-600 via-red-500 to-amber-500" />
+      <div className="pointer-events-none absolute inset-0 overflow-hidden">
+        <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 w-[450px] h-[450px] bg-rose-500/10 blur-[120px] rounded-full" />
+      </div>

-        <div className="p-6 sm:p-8 space-y-6">
-          <div className="flex items-start gap-4">
-            <div className="flex h-12 w-12 shrink-0 items-center justify-center rounded-2xl bg-rose-500/15 border border-rose-500/30 text-rose-400">
-              <Ban className="h-6 w-6 text-rose-400" />
-            </div>
-            <div className="space-y-1">
-              <div className="flex items-center gap-2">
-                <span className="inline-flex items-center gap-1 text-[11px] font-semibold text-rose-400 bg-rose-950/60 px-2 py-0.5 rounded-md border border-rose-800/60">
-                  <Lock className="w-3 h-3" />
-                  Partner Role Required
-                </span>
-                <span className="text-xs text-slate-500">Security Policy</span>
-              </div>
-              <h2 id="non-partner-denied-title" className="text-lg font-bold text-white tracking-tight">
-                Access Denied: Partner Accounts Only
-              </h2>
-              <p id="non-partner-denied-description" className="text-xs text-slate-400 leading-relaxed">
-                This application is exclusively reserved for users assigned the <strong className="text-emerald-300">Partner</strong> role. Your account role (<strong className="text-rose-300">{assignedRolesDisplay}</strong>) is not permitted on the Partner Portal.
-              </p>
-            </div>
-          </div>
-
-          <div className="rounded-xl bg-slate-900/80 border border-slate-800 p-4 space-y-3 text-xs">
-            <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
-              <span className="text-slate-400 font-medium">Account Name</span>
-              <span className="text-white font-semibold">{displayName}</span>
-            </div>
-
-            {displayEmail && (
-              <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
-                <span className="text-slate-400 font-medium flex items-center gap-1.5">
-                  <Mail className="w-3.5 h-3.5 text-slate-500" />
-                  Email
-                </span>
-                <span className="text-slate-200 font-mono">{displayEmail}</span>
-              </div>
-            )}
-
-            <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
-              <span className="text-slate-400 font-medium flex items-center gap-1.5">
-                <Building2 className="w-3.5 h-3.5 text-slate-500" />
-                Assigned Role(s)
-              </span>
-              <span className="text-rose-400 font-semibold bg-rose-950/60 px-2 py-0.5 rounded border border-rose-800/50">
-                {assignedRolesDisplay}
-              </span>
-            </div>
-
-            {tenant && (
-              <div className="flex items-center justify-between pb-2 border-b border-slate-800/80">
-                <span className="text-slate-400 font-medium flex items-center gap-1.5">
-                  <Building2 className="w-3.5 h-3.5 text-slate-500" />
-                  Organisation / Tenant
-                </span>
-                <span className="text-slate-200 font-medium truncate max-w-[220px]">{tenant}</span>
-              </div>
-            )}
-
-            {sub && (
-              <div className="flex items-center justify-between text-[11px] text-slate-500">
-                <span className="flex items-center gap-1">
-                  <Fingerprint className="w-3 h-3" />
-                  Subject Key
-                </span>
-                <span className="font-mono text-slate-400 truncate max-w-[200px]">{sub}</span>
-              </div>
-            )}
-          </div>
-
-          <div className="p-4 rounded-xl bg-rose-950/20 border border-rose-900/40 text-xs text-rose-200 leading-relaxed space-y-1.5">
-            <p className="font-semibold text-rose-300 flex items-center gap-1.5">
-              <ShieldAlert className="w-4 h-4 text-rose-400" />
-              Portal Separation Notice
-            </p>
-            <p className="text-[11px] text-rose-300/90">
-              Internal staff, executives, programme managers, and administrators must sign in through the PFM Management Console. Only external grant recipients and project partners with the <strong>Partner</strong> role are permitted to use this portal.
-            </p>
-          </div>
-
-          <div className="pt-2">
-            <button
-              onClick={handleLogoutClick}
-              className="w-full flex items-center justify-center gap-2 py-2.5 px-4 rounded-xl bg-slate-800 hover:bg-slate-700 text-slate-200 hover:text-white text-xs font-semibold border border-slate-700 transition cursor-pointer shadow-sm"
-            >
-              <LogOut className="w-4 h-4 text-rose-400" />
-              <span>Sign Out & Return to Home</span>
-            </button>
-          </div>
+      <div
+        className="relative w-full max-w-md rounded-3xl border border-white/10 bg-slate-900/85 backdrop-blur-xl shadow-[0_25px_60px_rgba(0,0,0,0.85),inset_0_1px_1px_rgba(255,255,255,0.15)] overflow-hidden flex flex-col items-center text-center p-8 sm:p-10 my-auto space-y-6"
+        onClick={(e) => e.stopPropagation()}
+      >
+        <div className="relative flex items-center justify-center pt-2">
+          <div className="absolute -inset-3 rounded-full bg-rose-500/20 blur-xl" />
+          <PfmPartnerLogo className="h-16 w-16 drop-shadow-[0_8px_24px_rgba(244,63,94,0.35)] relative z-10" />
        </div>

-        <div className="px-6 py-3 bg-[#0a0f1d] border-t border-slate-800/80 flex items-center justify-between text-[11px] text-slate-500">
-          <div className="flex items-center gap-2">
-            <BrandLogo size={16} showGlow={false} animateOnHover={false} />
-            <span>PFM Partner Portal</span>
+        <div className="space-y-2">
+          <div className="inline-flex items-center gap-1.5 px-3 py-1 rounded-full bg-rose-500/10 border border-rose-500/20 text-[11px] font-semibold text-rose-300">
+            <Lock className="w-3.5 h-3.5 text-rose-400" />
+            <span>Partner Access Only</span>
          </div>
-          <span>Role Security Gate</span>
+          <h2 id="non-partner-denied-title" className="text-2xl font-bold tracking-tight text-white">
+            Role Authorization Required
+          </h2>
+        </div>
+
+        <p className="text-sm text-slate-300 leading-relaxed max-w-sm">
+          This portal is reserved for registered Grantee and Partner accounts. Your current profile (<strong className="text-rose-300">{assignedRolesDisplay}</strong>) does not have access.
+        </p>
+
+        <div className="w-full rounded-2xl bg-slate-950/50 border border-white/5 p-3 text-xs text-slate-400 font-mono truncate">
+          Signed in as {displayEmail}
+        </div>
+
+        <div className="w-full space-y-3 pt-2">
+          <button
+            onClick={handleLogoutClick}
+            type="button"
+            className="w-full py-3.5 px-6 rounded-2xl bg-gradient-to-r from-rose-600 via-rose-500 to-amber-600 hover:from-rose-500 hover:to-amber-500 text-white font-bold text-sm tracking-wide shadow-[0_12px_30px_rgba(244,63,94,0.35),inset_0_1px_1px_rgba(255,255,255,0.3)] hover:shadow-[0_16px_36px_rgba(244,63,94,0.5)] transition-all flex items-center justify-center gap-2 cursor-pointer"
+          >
+            <LogOut className="w-4 h-4 text-rose-100" />
+            <span>Switch Account / Sign Out</span>
+          </button>
+
+          <button
+            onClick={handleLandingClick}
+            type="button"
+            className="inline-flex items-center gap-1.5 text-xs text-slate-400 hover:text-slate-200 transition-colors py-1 cursor-pointer"
+          >
+            <ArrowLeft className="w-3.5 h-3.5" />
+            <span>Return to Landing Page</span>
+          </button>
        </div>
      </div>
    </div>
@@ -176,4 +109,3 @@ export const NonPartnerAccessDeniedModal: React.FC<NonPartnerAccessDeniedModalPr
    ? createPortal(modalContent, document.body)
    : modalContent;
 };
-
@@ -1,6 +1,7 @@
 import React, { useEffect, useState, useRef } from 'react';
 import { createPortal } from 'react-dom';
-import { ShieldAlert, Clock, ArrowRight, X, AlertTriangle, LogOut } from 'lucide-react';
+import { Clock, LogOut, RefreshCw } from 'lucide-react';
+import { PfmPartnerLogo } from '../common/PfmPartnerLogo';
 import { clearSessionAndRedirectToLanding, dismissSubordinateModals } from '../../services/sessionExpiration';

 interface SessionExpiredModalProps {
@@ -83,92 +84,61 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
  const modalContent = (
    <div
      id="session-expired-modal-backdrop"
-      className="fixed inset-0 z-[9999] flex items-center justify-center bg-black/85 backdrop-blur-md p-4 animate-in fade-in duration-200 overflow-y-auto"
+      className="fixed inset-0 z-[9999] flex items-center justify-center p-4 bg-slate-950/85 backdrop-blur-2xl animate-in fade-in duration-300 overflow-y-auto"
      onMouseEnter={() => setIsPaused(true)}
      onMouseLeave={() => setIsPaused(false)}
      role="dialog"
      aria-modal="true"
      aria-labelledby="session-expired-title"
    >
+      <div className="pointer-events-none absolute inset-0 overflow-hidden">
+        <div className="absolute top-1/2 left-1/2 -translate-x-1/2 -translate-y-1/2 w-[450px] h-[450px] bg-amber-500/10 blur-[120px] rounded-full" />
+      </div>
+
      <div
        id="session-expired-modal-content"
-        className="relative w-full max-w-md bg-[#0c121e] border border-amber-500/40 rounded-2xl shadow-2xl shadow-black/90 p-6 overflow-hidden text-slate-200 space-y-5 my-auto"
+        className="relative w-full max-w-md rounded-3xl border border-white/10 bg-slate-900/85 backdrop-blur-xl shadow-[0_25px_60px_rgba(0,0,0,0.85),inset_0_1px_1px_rgba(255,255,255,0.15)] overflow-hidden flex flex-col items-center text-center p-8 sm:p-10 my-auto space-y-6"
      >
-        <div className="absolute top-0 left-0 right-0 h-1 bg-gradient-to-r from-amber-500 via-orange-500 to-rose-500" />
-
-        <div className="flex items-start justify-between pt-1">
-          <div className="flex items-center gap-3">
-            <div className="w-12 h-12 rounded-2xl bg-amber-500/10 border border-amber-500/30 flex items-center justify-center text-amber-400 shrink-0 shadow-lg shadow-amber-500/10">
-              <ShieldAlert className="w-6 h-6" />
-            </div>
-            <div>
-              <div className="flex items-center gap-2">
-                <h3 id="session-expired-title" className="text-base font-bold text-white tracking-tight">
-                  Session Expired
-                </h3>
-                <span className="text-[10px] font-mono font-semibold px-2 py-0.5 rounded bg-rose-950/60 text-rose-300 border border-rose-800/60">
-                  HTTP 401
-                </span>
-              </div>
-              <p className="text-xs text-slate-400 mt-0.5">Please sign in again to continue</p>
-            </div>
-          </div>
-
-          <button
-            id="session-expired-close-btn"
-            type="button"
-            onClick={handleAction}
-            aria-label="Dismiss and return to landing page"
-            className="p-1.5 text-slate-400 hover:text-white rounded-lg hover:bg-slate-800/80 transition-colors"
-          >
-            <X className="w-4 h-4" />
-          </button>
-        </div>
-
-        <div className="space-y-2.5 text-xs text-slate-300 leading-relaxed bg-slate-900/60 p-4 rounded-xl border border-slate-800/80">
-          <p>
-            Your active working session has ended for security. To protect your information, please return to the home page and sign in again.
-          </p>
-          {reason && (
-            <div className="flex items-start gap-2 pt-1 text-[11px] text-amber-300/90 font-mono">
-              <AlertTriangle className="w-3.5 h-3.5 shrink-0 mt-0.5 text-amber-400" />
-              <span className="break-words">{reason}</span>
-            </div>
-          )}
+        <div className="relative flex items-center justify-center pt-2">
+          <div className="absolute -inset-3 rounded-full bg-amber-500/20 blur-xl" />
+          <PfmPartnerLogo className="h-16 w-16 drop-shadow-[0_8px_24px_rgba(245,158,11,0.35)] relative z-10" />
        </div>

        <div className="space-y-2">
-          <div className="flex items-center justify-between text-xs">
-            <span className="text-slate-400 flex items-center gap-1.5">
-              <Clock className="w-3.5 h-3.5 text-amber-400" />
-              Returning to home page in{' '}
-              <strong className="text-white font-mono">{secondsRemaining}s</strong>
-            </span>
-            {isPaused && (
-              <span className="text-[10px] text-amber-400/80 font-medium px-1.5 py-0.2 rounded bg-amber-950/40 border border-amber-900/60">
-                Paused on hover
-              </span>
-            )}
+          <div className="inline-flex items-center gap-1.5 px-3 py-1 rounded-full bg-amber-500/10 border border-amber-500/20 text-[11px] font-semibold text-amber-300">
+            <Clock className="w-3.5 h-3.5 text-amber-400" />
+            <span>Session Expired</span>
          </div>
+          <h2 id="session-expired-title" className="text-2xl font-bold tracking-tight text-white">
+            Security Session Ended
+          </h2>
+        </div>

-          <div className="w-full h-2 bg-slate-800/90 rounded-full overflow-hidden border border-slate-700/60 p-0.5">
+        <p className="text-sm text-slate-300 leading-relaxed max-w-sm">
+          {reason || 'Your security credentials have expired for your protection. Please sign in again to continue.'}
+        </p>
+
+        {/* Smooth Countdown Bar */}
+        <div className="w-full space-y-2">
+          <div className="h-1.5 w-full bg-slate-800 rounded-full overflow-hidden">
            <div
-              className="h-full rounded-full bg-gradient-to-r from-amber-500 via-orange-500 to-rose-500 transition-all duration-75 ease-linear"
+              className="h-full bg-gradient-to-r from-emerald-400 to-teal-400 transition-all duration-75 ease-linear rounded-full"
              style={{ width: `${progressPercent}%` }}
            />
          </div>
+          <span className="text-[11px] text-slate-400 font-mono">
+            Redirecting in {secondsRemaining}s
+          </span>
        </div>

-        <div className="pt-2 flex flex-col sm:flex-row items-center gap-2.5">
+        <div className="w-full pt-1">
          <button
-            id="session-expired-return-btn"
-            type="button"
            onClick={handleAction}
-            className="w-full py-2.5 px-4 text-xs font-semibold text-white bg-gradient-to-r from-emerald-600 to-teal-600 hover:from-emerald-500 hover:to-teal-500 rounded-xl shadow-lg shadow-emerald-500/20 transition-all flex items-center justify-center gap-2 cursor-pointer"
+            type="button"
+            className="w-full py-3.5 px-6 rounded-2xl bg-gradient-to-r from-emerald-600 via-teal-600 to-emerald-500 hover:from-emerald-500 hover:to-teal-500 text-white font-bold text-sm tracking-wide shadow-[0_12px_30px_rgba(16,185,129,0.35),inset_0_1px_1px_rgba(255,255,255,0.3)] hover:shadow-[0_16px_36px_rgba(16,185,129,0.5)] transition-all flex items-center justify-center gap-2 cursor-pointer"
          >
-            <LogOut className="w-4 h-4" />
-            <span>Return to Home Page Now</span>
-            <ArrowRight className="w-3.5 h-3.5 ml-0.5" />
+            <RefreshCw className="w-4 h-4 text-emerald-100" />
+            <span>Sign In Again Now</span>
          </button>
        </div>
      </div>
@@ -179,4 +149,3 @@ export const SessionExpiredModal: React.FC<SessionExpiredModalProps> = ({
    ? createPortal(modalContent, document.body)
    : modalContent;
 };
-
@@ -1,7 +1,13 @@
@import "tailwindcss";

+:root {
+  color-scheme: dark;
+}
+
@layer base {
-  body {
+  html, body {
+    background-color: #020617; /* slate-950 */
+    color: #f8fafc; /* slate-100 */
    font-family: 'Plus Jakarta Sans', system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif;
  }

@@ -1585,13 +1585,7 @@ export const deleteUserClaim = async (targetUserId: string, claimId: string | nu
  await apiClient.delete(`/v1/api/users/${targetUserId}/claims/${claimId}`);
 };

-export const forceLogoutUser = async (userId: string): Promise<void> => {
-  await apiClient.put(`/v1/api/users/${userId}/session/logout`);
-};
-
-export const setUserLockout = async (userId: string, disable: boolean): Promise<void> => {
-  await apiClient.put(`/v1/api/users/${userId}/session/lockout/${disable}`);
-};
+// Administrative functions (forceLogoutUser, setUserLockout) removed from PartnerUI

 import {
  syncUserAccount,
@@ -189,19 +189,7 @@ async function executeBackendSync(
  userSub?: string,
  profile?: UserSyncProfile
 ): Promise<{ endpoint: string; data?: any }> {
-  const rawTenantId = profile?.tenant_id ?? (profile as any)?.tenantId;
-  const parsedTenantId =
-    rawTenantId !== undefined && rawTenantId !== null && rawTenantId !== ''
-      ? Number(rawTenantId)
-      : undefined;
-
-  const resolvedOrgId =
-    parsedTenantId !== undefined
-      ? parsedTenantId
-      : profile?.organisationId !== undefined && profile?.organisationId !== null && profile?.organisationId !== ''
-      ? Number(profile.organisationId)
-      : undefined;
-
+  const endpoint = '/v1/api/integration/sync';
  const payload = {
    id: userSub || profile?.id || profile?.sub,
    sub: userSub || profile?.sub,
@@ -209,40 +197,25 @@ async function executeBackendSync(
    name: profile?.name || undefined,
    role: profile?.role || undefined,
    tenant: profile?.tenant || undefined,
-    tenant_id: parsedTenantId,
-    organisationId: resolvedOrgId,
+    tenant_id: profile?.tenant_id,
+    organisationId: profile?.organisationId,
  };

-  let lastError: any = null;
-
-  for (const endpoint of USER_SYNC_CANDIDATE_ENDPOINTS) {
-    try {
-      let res;
-      if (endpoint === '/v1/api/integration/sync') {
-        try {
-          res = await apiClient.post(endpoint, payload);
-        } catch (postErr: any) {
-          const errStatus = postErr?.response?.status;
-          if (errStatus === 400 || errStatus === 415 || errStatus === 422) {
-            res = await apiClient.post(endpoint, {});
-          } else {
-            throw postErr;
-          }
-        }
-      } else {
-        res = await apiClient.post(endpoint, payload);
-      }
-      return { endpoint, data: res?.data };
-    } catch (err: any) {
-      lastError = err;
-      const status = err?.response?.status;
-      if (status === 401 || status === 403 || status === 423) {
+  try {
+    const res = await apiClient.post(endpoint, payload);
+    return { endpoint, data: res?.data };
+  } catch (err: any) {
+    const status = err?.response?.status;
+    if (status === 400 || status === 415 || status === 422) {
+      try {
+        const resFallback = await apiClient.post(endpoint, {});
+        return { endpoint, data: resFallback?.data };
+      } catch (fallbackErr) {
        throw err;
      }
    }
+    throw err;
  }
-
-  throw lastError || new Error('Failed to reach user sync endpoint');
 }

 export async function syncUserAccount(