fix(training): remove rbac gate from mark-complete endpoint (#3501)

* fix(training): remove rbac gate from mark-complete endpoint

## Problem

A user with a custom role lacking portal:update permission is unable to mark training videos complete, receiving a 403 error and seeing "failed to mark video as completed" in the UI. The user can accept policies and complete device setup successfully, but gets blocked at the training endpoint.

## Root cause

The POST /v1/training/completions/:videoId/complete endpoint is gated by @RequirePermission('portal','update') in training.controller.ts. This creates an inconsistent permission model: policy acceptance uses session + member-ownership only (no RBAC check), while training completion enforces a portal:update requirement that custom roles may lack. Existing custom roles created before permission enforcement was added still lack this permission.

## Fix

Remove the @RequirePermission('portal','update') guard from the mark-complete endpoint. Training completion is a user action on their own record (like policy acceptance), not a privileged administrative operation, so it should authenticate by session + member-ownership only, not RBAC.

## Explicitly NOT touched

Policy enforcement at role creation time (from PR #3455) remains in place. Other training endpoints and their permission gates are unchanged. Portal write permissions on other operations are unaffected.

## Verification

Added regression test asserting that a user with a custom role lacking portal:update can successfully mark a training video complete. Existing training controller unit tests pass locally ✅.

* fix(todo): address cubic review

Address review findings.

* fix(todo): address cubic review

Address review findings.

* fix: address cubic review

Address review findings.

* fix(portal): log training completion-email failures in production (CS-774)

The completion-email failure path logged via the `logger` util, which no-ops
outside development — so in production a failed completion email was swallowed
silently (negating the response.ok check). Use console.error for this
operational error so it is visible in prod. Test now asserts console.error.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: tofikwest

apps/api/src/training/training.controller.spec.ts

@@ -20,6 +20,7 @@ describe('TrainingController', () => {
 
   const mockTrainingService = {
     sendTrainingCompletionEmailIfComplete: jest.fn(),
+    sendHipaaCompletionEmailIfComplete: jest.fn(),
     generateCertificate: jest.fn(),
     getCompletions: jest.fn(),
     markVideoComplete: jest.fn(),
@@ -65,6 +66,27 @@ describe('TrainingController', () => {
     });
   });
 
+  describe('sendHipaaTrainingCompletionEmail', () => {
+    const dto = { memberId: 'mem_123' };
+
+    it('should call trainingService.sendHipaaCompletionEmailIfComplete with correct params', async () => {
+      const serviceResult = { sent: true };
+      mockTrainingService.sendHipaaCompletionEmailIfComplete.mockResolvedValue(
+        serviceResult,
+      );
+
+      const result = await controller.sendHipaaTrainingCompletionEmail(
+        'org_123',
+        dto as never,
+      );
+
+      expect(
+        trainingService.sendHipaaCompletionEmailIfComplete,
+      ).toHaveBeenCalledWith('mem_123', 'org_123');
+      expect(result).toEqual(serviceResult);
+    });
+  });
+
   describe('generateCertificate', () => {
     const dto = { memberId: 'mem_123' };
 
@@ -202,6 +224,16 @@ describe('TrainingController', () => {
       ]);
     });
 
+    it('sendHipaaTrainingCompletionEmail should require training:update', () => {
+      const permissions = Reflect.getMetadata(
+        PERMISSIONS_KEY,
+        controller.sendHipaaTrainingCompletionEmail,
+      );
+      expect(permissions).toEqual([
+        { resource: 'training', actions: ['update'] },
+      ]);
+    });
+
     it('generateCertificate should require training:read', () => {
       const permissions = Reflect.getMetadata(
         PERMISSIONS_KEY,

apps/api/src/training/training.controller.ts

@@ -109,6 +109,29 @@ export class TrainingController {
     return result;
   }
 
+  @Post('send-hipaa-completion-email')
+  @HttpCode(HttpStatus.OK)
+  @RequirePermission('training', 'update')
+  @ApiOperation({
+    summary: 'Send HIPAA training completion email with certificate',
+    description:
+      'Checks if the member has completed the HIPAA Security Awareness Training. If so, sends an email with the HIPAA training certificate attached.',
+  })
+  @ApiResponse({
+    status: 200,
+    description: 'Email sent or reason why it was not sent',
+    type: SendTrainingCompletionResponseDto,
+  })
+  async sendHipaaTrainingCompletionEmail(
+    @OrganizationId() organizationId: string,
+    @Body() dto: SendTrainingCompletionDto,
+  ): Promise<SendTrainingCompletionResponseDto> {
+    return this.trainingService.sendHipaaCompletionEmailIfComplete(
+      dto.memberId,
+      organizationId,
+    );
+  }
+
   @Post('generate-certificate')
   @HttpCode(HttpStatus.OK)
   @RequirePermission('training', 'read')