fix(fsma): location complete only with name+phone+address or GLN

services/compliance/app/fsma_spreadsheet.py

@@ -20,6 +20,8 @@
 from datetime import datetime, timezone
 from typing import Any
 
+from shared.fsma_validation import gln_for_export
+
 from .csv_safety import sanitize_cell, sanitize_sequence
 
 # Mandatory FDA 204 spreadsheet columns in required sort order
@@ -269,21 +271,23 @@ def _normalise_event(
         "product_description": _pick(event.get("product_description"), kdes.get("product_description")),
         "quantity": _pick(event.get("quantity"), kdes.get("quantity")),
         "unit_of_measure": _pick(event.get("uom"), event.get("unit_of_measure"), kdes.get("unit_of_measure")),
-        "origin_gln": _pick(
-            event.get("facility_gln"),
-            event.get("location_gln"),
-            kdes.get("ship_from_gln"),
+        "origin_gln": gln_for_export(
+            _pick(
+                event.get("facility_gln"),
+                event.get("location_gln"),
+                kdes.get("ship_from_gln"),
+            )
         ),
         "origin_name": _pick(
             event.get("facility_name"),
             event.get("location_name"),
             kdes.get("ship_from_location"),
         ),
         "origin_address": _pick(event.get("facility_address"), event.get("ship_from_address")),
-        "destination_gln": _pick(event.get("dest_gln"), kdes.get("ship_to_gln")),
+        "destination_gln": gln_for_export(_pick(event.get("dest_gln"), kdes.get("ship_to_gln"))),
         "destination_name": _pick(event.get("dest_name"), kdes.get("ship_to_location")),
         "destination_address": _pick(event.get("dest_address"), event.get("ship_to_address")),
-        "tlc_source_gln": _pick(kdes.get("tlc_source_gln")),
+        "tlc_source_gln": gln_for_export(_pick(kdes.get("tlc_source_gln"))),
         "tlc_source_fda_reg": _pick(kdes.get("tlc_source_fda_reg")),
         "reference_document_type": _pick(kdes.get("reference_document_type"), event.get("document_type")),
         "reference_document_number": _pick(kdes.get("reference_document_number"), event.get("ref_doc")),

services/compliance/tests/test_hermes_export_gln.py

@@ -0,0 +1,46 @@
+"""Data-free GLN regressions for FDA spreadsheet rows."""
+
+import csv
+import io
+
+import pytest
+
+from services.compliance.app import fsma_spreadsheet
+
+
+@pytest.mark.parametrize("raw", ["x", "1", "bad"])
+@pytest.mark.parametrize("origin", ["facility_gln", "location_gln", "ship_from_gln"])
+@pytest.mark.parametrize("destination", ["dest_gln", "ship_to_gln"])
+def test_spreadsheet_omits_invalid_glns(raw, origin, destination):
+    event = {"kdes": {"tlc_source_gln": raw}}
+    for key in (origin, destination):
+        target = event["kdes"] if key.startswith("ship_") else event
+        target[key] = raw
+
+    row = fsma_spreadsheet._normalise_event(event)
+
+    for column in ("origin_gln", "destination_gln", "tlc_source_gln"):
+        assert row[column] == ""
+    assert row["additional_kdes_json"] == ""
+
+
+@pytest.mark.parametrize("raw", ["x", "1", "bad"])
+def test_spreadsheet_csv_omits_invalid_glns(raw):
+    event = {"facility_gln": raw, "dest_gln": raw, "kdes": {"tlc_source_gln": raw}}
+
+    rows = list(csv.reader(io.StringIO(fsma_spreadsheet.generate_fda_csv([event]))))
+    header_index = next(index for index, row in enumerate(rows) if row == fsma_spreadsheet.FDA_HEADERS)
+    row = dict(zip(fsma_spreadsheet.FDA_COLUMNS, rows[header_index + 1]))
+
+    for column in ("origin_gln", "destination_gln", "tlc_source_gln"):
+        assert row[column] == ""
+
+
+def test_spreadsheet_preserves_filtered_glns(monkeypatch):
+    marker = "GLN_MARKER"
+    monkeypatch.setattr(fsma_spreadsheet, "gln_for_export", lambda value: marker)
+
+    row = fsma_spreadsheet._normalise_event({})
+
+    for column in ("origin_gln", "destination_gln", "tlc_source_gln"):
+        assert row[column] == marker

services/graph/app/exporters/recall_contacts_csv.py

@@ -30,6 +30,8 @@
 
 from typing import Any, Dict, List, Optional
 
+from shared.fsma_validation import gln_for_export
+
 from .safe_text import csv_safe
 
 __all__ = ["RECALL_CONTACTS_HEADER", "RECEIVING_EVENT_TYPES", "build_recall_contacts_rows"]
@@ -68,7 +70,7 @@ def _row(
     event = event or {}
     return [
         csv_safe(facility.get("name") or ""),
-        csv_safe(facility.get("gln") or ""),
+        csv_safe(gln_for_export(facility.get("gln"))),
         csv_safe(facility.get("address") or ""),
         csv_safe(facility.get("facility_type") or ""),
         csv_safe(lot.get("tlc") or ""),

services/graph/app/exporters/trace_csv.py

@@ -32,6 +32,8 @@
 
 from typing import Any, Dict, List, Optional, Sequence
 
+from shared.fsma_validation import gln_for_export
+
 from .safe_text import csv_safe
 
 __all__ = ["TRACE_CSV_HEADER", "build_trace_csv_rows"]
@@ -70,7 +72,7 @@ def _row(
         csv_safe(event.get("event_date", "")),
         csv_safe(event.get("event_time", "")),
         csv_safe(facility.get("name", "")),
-        csv_safe(facility.get("gln", "")),
+        csv_safe(gln_for_export(facility.get("gln", ""))),
         csv_safe(facility.get("address", "")),
         csv_safe(event.get("confidence", "")),
     ]

services/graph/app/fsma_recall/models.py

@@ -10,6 +10,8 @@
 from enum import Enum
 from typing import Any, Dict, List, Optional
 
+from shared.fsma_validation import gln_for_export
+
 
 class RecallStatus(str, Enum):
     """Status of a recall drill."""
@@ -147,7 +149,7 @@ def to_dict(self) -> Dict[str, Any]:
             "severity": self.severity.value,
             "target_lot": self.target_lot,
             "target_gtin": self.target_gtin,
-            "target_facility_gln": self.target_facility_gln,
+            "target_facility_gln": gln_for_export(self.target_facility_gln),
             "initiated_by": self.initiated_by,
             "reason": self.reason,
             "description": self.description,
@@ -235,7 +237,7 @@ def to_dict(self) -> Dict[str, Any]:
             "data_completeness_pct": self.data_completeness_pct,
             "affected_facilities": [
                 {
-                    "gln": f.gln,
+                    "gln": gln_for_export(f.gln),
                     "name": f.name,
                     "facility_type": f.facility_type,
                     "lots_affected": f.lots_affected,

services/graph/app/routers/fsma/compliance.py

@@ -19,8 +19,6 @@
 from typing import List, Optional
 from urllib.parse import quote
 
-from shared.fsma_validation import normalize_gtin, verify_gs1_check_digit
-
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, Path as PathParam, Query, Request
 from fastapi.responses import StreamingResponse
@@ -36,6 +34,7 @@
     export_plan_json,
     export_plan_markdown,
 )
+from shared.fsma_validation import gln_for_export, normalize_gtin, verify_gs1_check_digit
 
 # Add shared utilities (portable path resolution)
 from shared.middleware import get_current_tenant_id
@@ -217,7 +216,7 @@ async def export_fda_request_sheet(
                     csv_safe(event.get("quantity", "")),
                     csv_safe(event.get("unit_of_measure", "")),
                     csv_safe(event.get("location_description", "")),
-                    csv_safe(event.get("location_gln", "")),
+                    csv_safe(gln_for_export(event.get("location_gln", ""))),
                     csv_safe(event.get("event_date", "")),
                     csv_safe(event.get("event_time", "")),
                     csv_safe(event.get("reference_doc_type", "")),
@@ -404,7 +403,11 @@ def _skip(reason: str) -> None:
                     _skip("transformation_incomplete")
                     continue
                 if not valid_transformation_id and transformation_id:
-                    transformation_id = f"urn:uuid:{transformation_id}" if not str(transformation_id).startswith("urn:") else transformation_id
+                    transformation_id = (
+                        f"urn:uuid:{transformation_id}"
+                        if not str(transformation_id).startswith("urn:")
+                        else transformation_id
+                    )
                     valid_transformation_id = True
                 epcis_event = {"type": "TransformationEvent", **common, "bizStep": BIZ_STEP_MAP[event_type]}
                 if input_epc:
@@ -429,7 +432,9 @@ def _skip(reason: str) -> None:
                 epcis_event = {
                     "type": "ObjectEvent",
                     **common,
-                    "action": "ADD" if event_type in ("CREATION", "RECEIVING", "HARVESTING", "INITIAL_PACKING") else "OBSERVE",
+                    "action": "ADD"
+                    if event_type in ("CREATION", "RECEIVING", "HARVESTING", "INITIAL_PACKING")
+                    else "OBSERVE",
                     "bizStep": BIZ_STEP_MAP[event_type],
                     "disposition": "in_transit" if event_type == "SHIPPING" else "in_progress",
                 }
@@ -592,7 +597,11 @@ def add_location_lists(parent, event):
                     sub_element(container, member, {"type": kind_uri}).text = str(item[member])
 
     def add_common_tail(parent, event, *, include_action: bool = True):
-        fields = ("transformationID", "action", "bizStep", "disposition") if include_action else ("transformationID", "bizStep", "disposition")
+        fields = (
+            ("transformationID", "action", "bizStep", "disposition")
+            if include_action
+            else ("transformationID", "bizStep", "disposition")
+        )
         for field in fields:
             if field == "action" and event.get("type") != "ObjectEvent" and include_action:
                 # TransformationEvent has no action; still allow explicit passthrough when present

services/graph/app/routers/fsma/traceability.py

@@ -12,6 +12,7 @@
 from pydantic import BaseModel
 from shared.auth import require_api_key
 from shared.fsma_validation import (
+    gln_for_export,
     validate_gln,
     validate_gtin,
     validate_tlc,
@@ -185,7 +186,7 @@ async def trace_forward_endpoint(
         return {
             "lot_id": result.lot_id,
             "direction": result.direction,
-            "facilities": result.facilities,
+            "facilities": [{**facility, "gln": gln_for_export(facility.get("gln"))} for facility in result.facilities],
             "events": result.events,
             "downstream_lots": result.lots,
             "total_quantity": result.total_quantity,
@@ -314,7 +315,7 @@ async def trace_backward_endpoint(
         return {
             "lot_id": result.lot_id,
             "direction": result.direction,
-            "facilities": result.facilities,
+            "facilities": [{**facility, "gln": gln_for_export(facility.get("gln"))} for facility in result.facilities],
             "events": result.events,
             "source_lots": result.lots,
             "total_quantity": result.total_quantity,

services/graph/tests/test_hermes_export_gln.py

@@ -0,0 +1,93 @@
+"""Data-free GLN regressions for graph CSV exports."""
+
+import csv
+import io
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+from shared.fsma_validation import calculate_gs1_check_digit, gln_for_export
+
+from services.graph.app.exporters import recall_contacts_csv, trace_csv
+from services.graph.app.routers.fsma import compliance
+
+
+def shapes():
+    base = "0" * 12
+    return [None, "", " ", "x", "0", "x" * 13, base + str(calculate_gs1_check_digit(base))]
+
+
+@pytest.mark.parametrize("raw", shapes())
+def test_trace_facility_gln(raw):
+    assert trace_csv._row({}, {}, {"gln": raw})[8] == gln_for_export(raw)
+
+
+@pytest.mark.parametrize("raw", shapes())
+def test_recall_facility_gln(raw):
+    assert recall_contacts_csv._row({"gln": raw}, {}, {})[1] == gln_for_export(raw)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("raw", shapes())
+async def test_fda_sortable_gln(monkeypatch, raw):
+    monkeypatch.setattr(compliance, "reconcile_tenant_scope", lambda *a, **k: "x")
+    monkeypatch.setattr(compliance.uuid, "UUID", lambda value: value)
+    client = MagicMock()
+    client.__aenter__ = AsyncMock(return_value=client)
+    client.__aexit__ = AsyncMock(return_value=False)
+    monkeypatch.setattr(compliance, "Neo4jClient", MagicMock(return_value=client))
+    monkeypatch.setattr(compliance, "_load_range_export_events", AsyncMock(return_value=[{"location_gln": raw}]))
+    request = SimpleNamespace(url=SimpleNamespace(path="x"))
+    response = await compliance.export_fda_request_sheet.__wrapped__(
+        request, start_date="", end_date="", tlc=None, tenant_id=None, api_key=None
+    )
+    body = b"".join([chunk async for chunk in response.body_iterator]).decode("utf-8-sig")
+    assert list(csv.reader(io.StringIO(body)))[1][6] == gln_for_export(raw)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("raw", shapes())
+@pytest.mark.parametrize("direction", ["forward", "backward"])
+async def test_trace_api_gln(monkeypatch, raw, direction):
+    from services.graph.app.fsma.types import TraceResult
+    from services.graph.app.routers.fsma import traceability
+
+    result = TraceResult("x", direction, [{"gln": raw}], [], [], None, 0, 0)
+    client = MagicMock()
+    client.__aenter__ = AsyncMock(return_value=client)
+    client.__aexit__ = AsyncMock(return_value=False)
+    monkeypatch.setattr(traceability, "Neo4jClient", MagicMock(return_value=client))
+    monkeypatch.setattr(traceability, f"trace_{direction}", AsyncMock(return_value=result))
+    monkeypatch.setattr(traceability, "record_trace_query", MagicMock())
+    monkeypatch.setattr(traceability, "get_audit_log", lambda: SimpleNamespace(alog=AsyncMock()))
+    endpoint = getattr(traceability, f"trace_{direction}_endpoint").__wrapped__
+    response = await endpoint(SimpleNamespace(), tlc="x", max_depth=1, tenant_id=None, api_key=None)
+    assert response["facilities"][0]["gln"] == gln_for_export(raw)
+    assert result.facilities[0]["gln"] == raw
+
+
+@pytest.mark.parametrize("raw", shapes())
+def test_recall_result_gln(raw):
+    from services.graph.app.fsma_recall.models import AffectedFacility, RecallResult
+
+    facility = AffectedFacility(raw, "", "", [], None)
+    result = RecallResult("x", True, affected_facilities=[facility])
+    assert result.to_dict()["affected_facilities"][0]["gln"] == gln_for_export(raw)
+    assert facility.gln == raw
+
+
+@pytest.mark.parametrize("raw", shapes())
+def test_recall_target_gln(raw):
+    from datetime import datetime, timezone
+
+    from services.graph.app.fsma_recall.models import RecallDrill, RecallSeverity, RecallType
+
+    drill = RecallDrill(
+        "x",
+        "x",
+        datetime.now(timezone.utc),
+        next(iter(RecallType)),
+        next(iter(RecallSeverity)),
+        target_facility_gln=raw,
+    )
+    assert drill.to_dict()["target_facility_gln"] == gln_for_export(raw)

services/ingestion/app/csv_templates.py

@@ -343,6 +343,8 @@ async def list_templates():
 _PRODUCT_COLUMNS = ("product_description", "product", "description")
 _QUANTITY_COLUMNS = ("quantity", "qty")
 _UNIT_COLUMNS = ("unit_of_measure", "uom")
+_LOCATION_PHONE_COLUMNS = ("location_phone", "ship_from_phone", "receiving_phone", "phone")
+_LOCATION_ADDRESS_COLUMNS = ("location_address", "ship_from_address", "receiving_address", "address")
 _LOCATION_GLN_COLUMNS = ("location_gln", "ship_from_gln", "receiving_gln", "gln")
 _LOCATION_NAME_COLUMNS = (
     "location_name",
@@ -361,6 +363,8 @@ async def list_templates():
     _QUANTITY_COLUMNS,
     _UNIT_COLUMNS,
     _LOCATION_GLN_COLUMNS,
+    _LOCATION_PHONE_COLUMNS,
+    _LOCATION_ADDRESS_COLUMNS,
     _LOCATION_NAME_COLUMNS,
     _SHIP_TO_COLUMNS,
 )
@@ -1341,6 +1345,8 @@ def _reject(reason: str, message: str) -> None:
 
             # Location: strip whitespace and expand abbreviations
             loc_gln = _first_present(row, _LOCATION_GLN_COLUMNS) or None
+            loc_phone = _first_present(row, _LOCATION_PHONE_COLUMNS) or None
+            loc_address = _first_present(row, _LOCATION_ADDRESS_COLUMNS) or None
             _loc_raw = _first_present(row, _LOCATION_NAME_COLUMNS)
             loc_name = _normalize_location(_loc_raw) if _loc_raw else None
             if _loc_raw and loc_name != _loc_raw:
@@ -1411,6 +1417,8 @@ def _reject(reason: str, message: str) -> None:
                 "unit_of_measure",
                 "location_gln",
                 "location_name",
+                *_LOCATION_PHONE_COLUMNS,
+                *_LOCATION_ADDRESS_COLUMNS,
                 "cte_type",
                 "event_type",
                 "type",
@@ -1457,6 +1465,8 @@ def _reject(reason: str, message: str) -> None:
                 unit_of_measure=uom,
                 location_gln=loc_gln,
                 location_name=loc_name,
+                location_phone=loc_phone,
+                location_address=loc_address,
                 timestamp=ts,
                 kdes=kdes,
             )