security: enforce authenticated CRM contact ownership

pages/api/auth/[...nextauth].js

@@ -14,8 +14,8 @@ import { PrismaAdapter } from "@next-auth/prisma-adapter";
 import { PrismaClient } from "@prisma/client";
 import NextAuth from "next-auth";
 import EmailProvider from "../../../lib/auth/email-provider";
+import { resolveCrmLocale } from "../../../lib/auth/resolveCrmLocale";
 import { consoleLogger, redactSensitive } from "../../../actions/core/logger";
-import { getPortalLogin } from "../../../actions/services/accountService";
 
 const prisma = new PrismaClient();
 
@@ -53,8 +53,6 @@ const createVerificationTokenSynchronizationAdapter = (
     };
 };
 
-const WELSH_LANGUAGE_CODE = 846040000;
-
 const authDiagnostic = (event, metadata = {}) => {
     try {
         const safeMeta = JSON.parse(JSON.stringify(metadata));
@@ -84,29 +82,6 @@ const appendParamsAndPathToNewUrl = (fromUrl, toUrl) => {
     }
 };
 
-const resolveCrmLocale = async (email) => {
-    if (!email) return null;
-
-    try {
-        const portalUserObj = await getPortalLogin(email);
-        const preferredLanguage =
-            portalUserObj?.value?.[0]?.pinswg_preferredlanguage;
-
-        if (preferredLanguage === WELSH_LANGUAGE_CODE) {
-            return "cy";
-        }
-
-        if (preferredLanguage != null) {
-            return "en";
-        }
-
-        return null;
-    } catch (error) {
-        consoleLogger(error);
-        return null;
-    }
-};
-
 const resolveEffectiveLocale = async (req, email) => {
     const crmLocale = await resolveCrmLocale(email);
     if (crmLocale) {

pages/api/auth/resolve-locale.js

@@ -1,8 +1,3 @@
-import { getPortalLogin } from "../../../actions/services/accountService";
-import { consoleLogger } from "../../../actions/core/logger";
-
-const WELSH_LANGUAGE_CODE = 846040000;
-
 const resolveRequestLocale = (req) =>
     req?.query?.locale ||
     req?.body?.locale ||
@@ -14,30 +9,8 @@ export default async function handler(req, res) {
         return res.status(405).json({ message: "Method not allowed" });
     }
 
-    const email = String(req.body?.email || "")
-        .trim()
-        .toLowerCase();
-    const sessionLocale = resolveRequestLocale(req);
+    const requestedLocale = resolveRequestLocale(req);
+    const locale = requestedLocale === "cy" ? "cy" : "en";
 
-    if (!email) {
-        return res.status(200).json({ locale: sessionLocale });
-    }
-
-    try {
-        const portalUserObj = await getPortalLogin(email);
-        const preferredLanguage =
-            portalUserObj?.value?.[0]?.pinswg_preferredlanguage;
-
-        const locale =
-            preferredLanguage === WELSH_LANGUAGE_CODE
-                ? "cy"
-                : preferredLanguage != null
-                  ? "en"
-                  : sessionLocale;
-
-        return res.status(200).json({ locale });
-    } catch (error) {
-        consoleLogger(error);
-        return res.status(200).json({ locale: sessionLocale });
-    }
+    return res.status(200).json({ locale });
 }

pages/api/endpoint/getportallogin_api.js

@@ -17,20 +17,61 @@
  */
 
 import { azureHeadersPaged } from "../../../actions/core/headers";
+import { escapeODataString } from "../../../actions/core/guards";
 import { hashAPIPath } from "../../../actions/core/hash";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 import { respondError } from "../middleware/apiResponse";
 import { relayGet } from "../middleware/relayForwarding";
 import { RELAY_POLICY_STRICT_LOGIN } from "../middleware/relayPolicyPresets";
 
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+$/;
+
 export default async function ApiProxy(req, res) {
+    if (req.method !== "GET") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Only GET is supported"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    const authenticatedEmail = session?.user?.email;
+
+    if (
+        typeof authenticatedEmail !== "string" ||
+        !EMAIL_PATTERN.test(authenticatedEmail.trim())
+    ) {
+        return respondError(res, {
+            status: 401,
+            code: "UNAUTHENTICATED",
+            message: "Authentication required"
+        });
+    }
+
     const emailAddress = req.query.emailAddress;
     const checkHash = req.query.hash;
 
-    if (typeof emailAddress !== "string" || emailAddress.trim().length === 0) {
+    if (
+        typeof emailAddress !== "string" ||
+        !EMAIL_PATTERN.test(emailAddress.trim())
+    ) {
         return respondError(res, {
             status: 400,
-            code: "EMAIL_ADDRESS_REQUIRED",
-            message: "emailAddress is required"
+            code: "INVALID_EMAIL_ADDRESS",
+            message: "emailAddress must be a valid email address"
+        });
+    }
+
+    const normalizedAuthenticatedEmail = authenticatedEmail.trim().toLowerCase();
+    const normalizedRequestedEmail = emailAddress.trim().toLowerCase();
+
+    if (normalizedRequestedEmail !== normalizedAuthenticatedEmail) {
+        return respondError(res, {
+            status: 403,
+            code: "FORBIDDEN",
+            message: "Request not permitted"
         });
     }
 
@@ -63,7 +104,7 @@ export default async function ApiProxy(req, res) {
 
     const queryUrl =
         "contacts?$filter=emailaddress1 eq '" +
-        emailAddress +
+        escapeODataString(normalizedAuthenticatedEmail) +
         "' and statuscode eq 1&$count=true&$select=pinswg_preferredlanguage,emailaddress1,contactid,yomifullname,firstname,lastname";
 
     const relayPolicy = RELAY_POLICY_STRICT_LOGIN;