From 9a7bd9ed3a08479b881b9d47ac631cd4f4b3b9af Mon Sep 17 00:00:00 2001
From: DevSoftTech Server <info.devsofttech@gmail.com>
Date: Tue, 28 Jul 2026 00:32:39 +0530
Subject: [PATCH] Clamp HIU consent dateRange.to to current UTC

---
 app/Libraries/Abdm/M3HiuGatewayClient.php   | 33 +++++++++++++++++++++
 app/Libraries/Abdm/M3HiuWorkflowService.php | 33 ++++++++++++++++++++-
 2 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/app/Libraries/Abdm/M3HiuGatewayClient.php b/app/Libraries/Abdm/M3HiuGatewayClient.php
index ffa1fd7..6748b63 100644
--- a/app/Libraries/Abdm/M3HiuGatewayClient.php
+++ b/app/Libraries/Abdm/M3HiuGatewayClient.php
@@ -76,6 +76,7 @@ class M3HiuGatewayClient
             ];
         }
         $payload['hfr_id'] = $hfrId;
+        $payload = $this->clampConsentDateRangeToNow($payload);
 
         $url = $this->baseUrl . $path;
         $headers = [
@@ -177,6 +178,38 @@ class M3HiuGatewayClient
         return $response;
     }
 
+    private function clampConsentDateRangeToNow(array $payload): array
+    {
+        if (! isset($payload['consent']) || ! is_array($payload['consent'])) {
+            return $payload;
+        }
+        if (! isset($payload['consent']['permission']) || ! is_array($payload['consent']['permission'])) {
+            return $payload;
+        }
+        if (! isset($payload['consent']['permission']['dateRange']) || ! is_array($payload['consent']['permission']['dateRange'])) {
+            return $payload;
+        }
+
+        $toRaw = trim((string) ($payload['consent']['permission']['dateRange']['to'] ?? ''));
+        if ($toRaw === '') {
+            return $payload;
+        }
+
+        $nowUtc = new \DateTimeImmutable('now', new \DateTimeZone('UTC'));
+        $nowIso = $nowUtc->format('Y-m-d\TH:i:s.000\Z');
+
+        try {
+            $toAt = new \DateTimeImmutable($toRaw);
+            if ($toAt->getTimestamp() > $nowUtc->getTimestamp()) {
+                $payload['consent']['permission']['dateRange']['to'] = $nowIso;
+            }
+        } catch (\Throwable $e) {
+            $payload['consent']['permission']['dateRange']['to'] = $nowIso;
+        }
+
+        return $payload;
+    }
+
     private function callGet(string $path, array $query, string $eventKey): array
     {
         $settings = $this->resolveRuntimeSettings();
diff --git a/app/Libraries/Abdm/M3HiuWorkflowService.php b/app/Libraries/Abdm/M3HiuWorkflowService.php
index d61745b..2cfa3dd 100644
--- a/app/Libraries/Abdm/M3HiuWorkflowService.php
+++ b/app/Libraries/Abdm/M3HiuWorkflowService.php
@@ -765,6 +765,8 @@ class M3HiuWorkflowService
                 ];
             }
 
+            $consent = $this->clampConsentPermissionDateRangeToNow($consent);
+
             return [
                 'ok' => 1,
                 'payload' => $base + ['consent' => $consent],
@@ -926,7 +928,6 @@ class M3HiuWorkflowService
             ->setTimezone($utcTz)
             ->format('Y-m-d\TH:i:s.000\Z');
         $toUtc = $nowIst
-            ->setTime(23, 59, 59)
             ->setTimezone($utcTz)
             ->format('Y-m-d\TH:i:s.000\Z');
         $eraseAtUtc = $nowIst
@@ -984,6 +985,36 @@ class M3HiuWorkflowService
         return $consent;
     }
 
+    private function clampConsentPermissionDateRangeToNow(array $consent): array
+    {
+        if (! isset($consent['permission']) || ! is_array($consent['permission'])) {
+            return $consent;
+        }
+        if (! isset($consent['permission']['dateRange']) || ! is_array($consent['permission']['dateRange'])) {
+            return $consent;
+        }
+
+        $toRaw = trim((string) ($consent['permission']['dateRange']['to'] ?? ''));
+        if ($toRaw === '') {
+            return $consent;
+        }
+
+        $nowUtc = new \DateTimeImmutable('now', new \DateTimeZone('UTC'));
+        $nowIso = $nowUtc->format('Y-m-d\TH:i:s.000\Z');
+
+        try {
+            $toAt = new \DateTimeImmutable($toRaw);
+            if ($toAt->getTimestamp() > $nowUtc->getTimestamp()) {
+                $consent['permission']['dateRange']['to'] = $nowIso;
+            }
+        } catch (\Throwable $e) {
+            // Fall back to current UTC to avoid sending invalid timestamp shapes.
+            $consent['permission']['dateRange']['to'] = $nowIso;
+        }
+
+        return $consent;
+    }
+
     /**
      * Normalize legacy/record hiTypes to HIU consent hiTypes accepted by bridge.
      *