security: enforce authenticated CRM contact ownership

pages/api/auth/[...nextauth].js

@@ -14,8 +14,8 @@ import { PrismaAdapter } from "@next-auth/prisma-adapter";
 import { PrismaClient } from "@prisma/client";
 import NextAuth from "next-auth";
 import EmailProvider from "../../../lib/auth/email-provider";
+import { resolveCrmLocale } from "../../../lib/auth/resolveCrmLocale";
 import { consoleLogger, redactSensitive } from "../../../actions/core/logger";
-import { getPortalLogin } from "../../../actions/services/accountService";
 
 const prisma = new PrismaClient();
 
@@ -53,8 +53,6 @@ const createVerificationTokenSynchronizationAdapter = (
     };
 };
 
-const WELSH_LANGUAGE_CODE = 846040000;
-
 const authDiagnostic = (event, metadata = {}) => {
     try {
         const safeMeta = JSON.parse(JSON.stringify(metadata));
@@ -84,29 +82,6 @@ const appendParamsAndPathToNewUrl = (fromUrl, toUrl) => {
     }
 };
 
-const resolveCrmLocale = async (email) => {
-    if (!email) return null;
-
-    try {
-        const portalUserObj = await getPortalLogin(email);
-        const preferredLanguage =
-            portalUserObj?.value?.[0]?.pinswg_preferredlanguage;
-
-        if (preferredLanguage === WELSH_LANGUAGE_CODE) {
-            return "cy";
-        }
-
-        if (preferredLanguage != null) {
-            return "en";
-        }
-
-        return null;
-    } catch (error) {
-        consoleLogger(error);
-        return null;
-    }
-};
-
 const resolveEffectiveLocale = async (req, email) => {
     const crmLocale = await resolveCrmLocale(email);
     if (crmLocale) {

pages/api/auth/resolve-locale.js

@@ -1,8 +1,3 @@
-import { getPortalLogin } from "../../../actions/services/accountService";
-import { consoleLogger } from "../../../actions/core/logger";
-
-const WELSH_LANGUAGE_CODE = 846040000;
-
 const resolveRequestLocale = (req) =>
     req?.query?.locale ||
     req?.body?.locale ||
@@ -14,30 +9,8 @@ export default async function handler(req, res) {
         return res.status(405).json({ message: "Method not allowed" });
     }
 
-    const email = String(req.body?.email || "")
-        .trim()
-        .toLowerCase();
-    const sessionLocale = resolveRequestLocale(req);
+    const requestedLocale = resolveRequestLocale(req);
+    const locale = requestedLocale === "cy" ? "cy" : "en";
 
-    if (!email) {
-        return res.status(200).json({ locale: sessionLocale });
-    }
-
-    try {
-        const portalUserObj = await getPortalLogin(email);
-        const preferredLanguage =
-            portalUserObj?.value?.[0]?.pinswg_preferredlanguage;
-
-        const locale =
-            preferredLanguage === WELSH_LANGUAGE_CODE
-                ? "cy"
-                : preferredLanguage != null
-                  ? "en"
-                  : sessionLocale;
-
-        return res.status(200).json({ locale });
-    } catch (error) {
-        consoleLogger(error);
-        return res.status(200).json({ locale: sessionLocale });
-    }
+    return res.status(200).json({ locale });
 }