Merged PR 2290: add guard rail to check for locale and ensure verify request is language spec...

add guard rail to check for locale and ensure verify request is language specific

Related work items: #22303

pages/api/auth/[...nextauth].js

@@ -37,12 +37,12 @@ const appendParamsAndPathToNewUrl = (fromUrl, toUrl) => {
     return toUrlObj.toString();
 };
 
-const resolveRequestLocale = (req) => {
+// const resolveRequestLocale = (req) => {
-    const locale =
+//     const locale =
-        req?.body?.locale || req?.query?.locale || req?.cookies?.pedw_locale;
+//         req?.body?.locale || req?.query?.locale || req?.cookies?.pedw_locale;
 
-    return locale === "cy" ? "cy" : "en";
+//     return locale === "cy" ? "cy" : "en";
-};
+// };
 
 const resolveCrmLocale = async (email) => {
     if (!email) return null;
@@ -94,6 +94,44 @@ const buildLocalizedVerificationUrl = ({ url, email, effectiveLocale }) => {
     return appendParamsAndPathToNewUrl(url, newURL);
 };
 
+const getLocaleFromCallbackUrl = (callbackUrl) => {
+    if (!callbackUrl) return null;
+
+    try {
+        const parsed = new URL(callbackUrl);
+        const locale = parsed.searchParams.get("locale");
+
+        if (locale === "cy" || parsed.pathname.startsWith("/cy")) {
+            return "cy";
+        }
+
+        if (locale === "en") {
+            return "en";
+        }
+
+        return null;
+    } catch {
+        return null;
+    }
+};
+
+const resolveRequestLocale = (req) => {
+    const directLocale =
+        req?.body?.locale || req?.query?.locale || req?.cookies?.pedw_locale;
+
+    if (directLocale === "cy") return "cy";
+    if (directLocale === "en") return "en";
+
+    const callbackLocale =
+        getLocaleFromCallbackUrl(req?.body?.callbackUrl) ||
+        getLocaleFromCallbackUrl(req?.query?.callbackUrl) ||
+        getLocaleFromCallbackUrl(
+            req?.cookies?.["__Secure-next-auth.callback-url"]
+        );
+
+    return callbackLocale === "cy" ? "cy" : "en";
+};
+
 const authOptions = (req, res) => {
     const requestLocale = resolveRequestLocale(req);