From 0ff2d69ba60bb56bee7da7b70a54a726056535e8 Mon Sep 17 00:00:00 2001
From: Robert Bond <Robert.Bond@test.gov.wales>
Date: Tue, 5 May 2026 08:25:17 +0000
Subject: [PATCH] Merged PR 2290: add guard rail to check for locale and ensure
 verify request is language spec...

add guard rail to check for locale and ensure verify request is language specific

Related work items: #22303
---
 pages/api/auth/[...nextauth].js | 48 +++++++++++++++++++++++++++++----
 1 file changed, 43 insertions(+), 5 deletions(-)

diff --git a/pages/api/auth/[...nextauth].js b/pages/api/auth/[...nextauth].js
index 09ffa396..4c4534c3 100644
--- a/pages/api/auth/[...nextauth].js
+++ b/pages/api/auth/[...nextauth].js
@@ -37,12 +37,12 @@ const appendParamsAndPathToNewUrl = (fromUrl, toUrl) => {
     return toUrlObj.toString();
 };
 
-const resolveRequestLocale = (req) => {
-    const locale =
-        req?.body?.locale || req?.query?.locale || req?.cookies?.pedw_locale;
+// const resolveRequestLocale = (req) => {
+//     const locale =
+//         req?.body?.locale || req?.query?.locale || req?.cookies?.pedw_locale;
 
-    return locale === "cy" ? "cy" : "en";
-};
+//     return locale === "cy" ? "cy" : "en";
+// };
 
 const resolveCrmLocale = async (email) => {
     if (!email) return null;
@@ -94,6 +94,44 @@ const buildLocalizedVerificationUrl = ({ url, email, effectiveLocale }) => {
     return appendParamsAndPathToNewUrl(url, newURL);
 };
 
+const getLocaleFromCallbackUrl = (callbackUrl) => {
+    if (!callbackUrl) return null;
+
+    try {
+        const parsed = new URL(callbackUrl);
+        const locale = parsed.searchParams.get("locale");
+
+        if (locale === "cy" || parsed.pathname.startsWith("/cy")) {
+            return "cy";
+        }
+
+        if (locale === "en") {
+            return "en";
+        }
+
+        return null;
+    } catch {
+        return null;
+    }
+};
+
+const resolveRequestLocale = (req) => {
+    const directLocale =
+        req?.body?.locale || req?.query?.locale || req?.cookies?.pedw_locale;
+
+    if (directLocale === "cy") return "cy";
+    if (directLocale === "en") return "en";
+
+    const callbackLocale =
+        getLocaleFromCallbackUrl(req?.body?.callbackUrl) ||
+        getLocaleFromCallbackUrl(req?.query?.callbackUrl) ||
+        getLocaleFromCallbackUrl(
+            req?.cookies?.["__Secure-next-auth.callback-url"]
+        );
+
+    return callbackLocale === "cy" ? "cy" : "en";
+};
+
 const authOptions = (req, res) => {
     const requestLocale = resolveRequestLocale(req);