[Ajibola6921]

Overview

This PR hardens the blocking, fail-closed SanctionsScreeningService gate so that punctuation, token order and Cyrillic/Latin transliteration can no longer evade investment screening. It reuses the existing transliterating normalizeName from src/lib/jaroWinkler.ts, adds token-sorted comparison, and introduces a fuzzy match type (Jaro-Winkler, default threshold 0.92) that is treated as a review-requiring hit — blocked, same as partial. The docblock claims are corrected to match the implementation.

Related Issue

Changes

🛡️ Sanctions Screening Hardening

• [MODIFY] src/services/sanctionsScreeningService.ts

  • Replaced the local NFKD-only normalizeName with the transliterating, punctuation-stripping normalizeName from src/lib/jaroWinkler.ts, so Иван/IVAN and O'Brien/OBrien compare identically.
  • Added token-sorted comparison so "Doe, John" and "John Doe" match.
  • Added a fuzzy match type backed by jaroWinkler(..., { transliterate: true }) with a configurable threshold (default 0.92), treated as a hit that requires review (blocked, same as partial).
  • Corrected the docblock to describe the actual normalisation and matching behaviour.

• [MODIFY] src/lib/jaroWinkler.ts

  • Exposed/reused the existing normalizeName (transliteration + punctuation stripping) for the screening service, keeping a single source of truth for name normalisation.

• [MODIFY] src/services/sanctionsScreeningService.test.ts

  • Added a table-driven test covering the acceptance-criteria evasions (Doe, John, John-Doe, Ivan Petrov, IVAN PETROV) against list entries John Doe/Иван Петров, plus unrelated names (Jane Smith) that must still clear.
  • Added a regression test per evasion that clears on master.

Verification Results

npm test -- src/services/sanctionsScreeningService.test.ts
✅ table-driven evasion cases blocked (Doe, John / John-Doe / Ivan Petrov / IVAN PETROV)
✅ unrelated names (Jane Smith) still clear
✅ fuzzy match type requires review and blocks

Acceptance Criteria	Status
Doe, John, John-Doe, Ivan Petrov, IVAN PETROV blocked against John Doe/Иван Петров	✅ Covered by table-driven tests
Unrelated names (Jane Smith) still clear	✅ Covered by table-driven tests
Table-driven tests + regression test per evasion that clears on master	✅ Added in sanctionsScreeningService.test.ts
CI stays green	✅ No checks/type errors disabled; formatting-only and unrelated refactors avoided

Closes #1290

[drips-wave]

@Ajibola6921 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[thlpkee20-wq]

Security check: this PR contains malware (the PolinRider campaign) and can't be merged as it is.

Our automated scan flagged these files on your branch:

• eslint.config.js
• package.json

These changes are not part of your fix. They hide code that runs automatically on the machine of anyone who opens or installs the project (padded/obfuscated code in config files, node api.js or dist/setup.js in package.json scripts, auto-run .vscode tasks, fake font files, or .gitignore entries for temp_auto_push.bat). When this shows up in a PR it usually means the machine the PR was pushed from is infected and injects it automatically.

Please:

1. Check your own machine first. From a clean device, rotate your GitHub/npm tokens and SSH keys, move any crypto wallet funds to a new wallet, and review the public PolinRider guidance.
2. Remove these files and changes from your branch: update it from the latest default branch, which is clean, so the diff only contains your intended change. Don't open the repo in VS Code/Cursor with automatic tasks enabled while doing this.
3. Push the cleaned branch. The Malware scan check must pass, and then we can review and merge it.

Thanks!