Update memory-bank with phase 14 follow-up hardening closeout

2026-03-13 14:21:12 +00:00
parent b8fa514e3b
commit 43204dfb54
4 changed files with 2789 additions and 0 deletions
@@ -0,0 +1,632 @@
+# Progress — PEDW FrontEnd
+
+## Completed / evidenced milestones
+
+- Bilingual routing structure is established with extensive Welsh rewrites and locale namespace mapping.
+- Next-auth + Prisma SQL Server persistence is integrated for user/session lifecycle.
+- Broad API surface exists for search, case, portal, admin, and file/document operations.
+- CRM/relay hash pattern is implemented across many endpoint handlers.
+- Recent shipped updates focused on:
+    - search/case back-navigation and breadcrumb behavior,
+    - DNS/view-all navigation logic,
+    - preferred-language handling for notify template selection,
+    - PDF formatting/hyperlink fixes,
+    - upload validation character updates.
+
+## Work in progress signals
+
+- Ongoing iterative fixes in breadcrumb/case-summary flows suggest navigation consistency is still being tuned.
+- Mixed proxy/non-proxy endpoint implementations continue to evolve in parallel.
+- Priority 1 refactor plan execution started for `actions/index.js` split (Phase 1 foundation complete).
+
+## Planned / partially implemented (inferred from code state)
+
+- Partial migration or coexistence of deployment/runtime patterns (Next runtime plus custom server artifacts).
+- Continued refinement of document/email workflow behavior (template/language and formatting quality).
+- Prioritized structural refactor backlog documented in `memory-bank/refactor-backlog.md`.
+
+## Known technical debt
+
+- `actions/services/legacyActionsService.js` still holds broad domain wrappers after Phase 1 extraction (core helpers now separated).
+- Significant duplication of token/hash/relay logic across endpoint files.
+- Inconsistent security/hash guard enforcement in some file routes.
+- Sparse automated test coverage (`tests/` currently empty).
+- Verbose logging in sensitive flows (auth/email/actions/file) increases privacy risk.
+
+## Latest update (2026-03-12)
+
+- Branch `0000-update-actions-monolith` created from development branch for Priority 1 refactor implementation.
+- `actions/index.js` reduced to a compatibility barrel.
+- New core helper modules added under `actions/core/`:
+    - `env.js`
+    - `logger.js`
+    - `hash.js`
+    - `token.js`
+    - `headers.js`
+- Existing action wrappers moved to `actions/services/legacyActionsService.js` and continue to be exported via the barrel for compatibility.
+- `actions/clients/` scaffolded for upcoming client extraction phase.
+- Phase 2 service grouping completed with dedicated service files and `actions/services/index.js` barrel.
+- Export parity check confirms grouped service modules cover all legacy exported action names.
+- Phase 3 migration started by moving selected high-churn consumers and representative endpoint handlers to direct `actions/services/*` and `actions/core/*` imports.
+- Phase 4 hardening baseline added with new guard helpers and redacted logging, adopted in selected notify/login/contact API handlers.
+- Additional Priority 1 consumer migration pass completed for high-use portal/form/representation helpers:
+    - Updated direct service/core imports in:
+        - `components/admin/tabs/documents.js`
+        - `components/admin/tabs/storage.js`
+        - `components/admin/utils/serverside.js`
+        - `components/case/documents.js`
+        - `components/case/representation/representationComplete.js`
+        - `components/case/representation/representationElements.js`
+        - `components/elements/index.js`
+        - `components/myportal/awaitingsubmissionfromblob.js`
+        - `components/myportal/topthree.js`
+        - `components/myportal/topthree_reps.js`
+        - `components/utils/index.js`
+        - `lib/myportal/loadMyPortalAppealPage.js`
+        - `lib/newappeal/loadNewAppealPage.js`
+- Additional Priority 1 consumer migration pass completed for view-all/search/unsubscribe flows:
+    - Updated direct service/core imports in:
+        - `components/myportal/viewall.js`
+        - `components/search/addresssearchresults.js`
+        - `pages/unsubscribe/[watchlistid].js`
+        - `pages/unsubscribeall/[watchlistid].js`
+- Broad `actions` barrel import count reduced again; remaining non-comment usages are now concentrated in selected `pages/api/endpoint/*` and `pages/api/file/*` handlers.
+- Additional Priority 1 endpoint/file proxy migration chunk completed:
+    - Updated imports in:
+        - `pages/api/endpoint/getmylpacases_api.js`
+        - `pages/api/endpoint/getbasicdnssearchpaged_api.js`
+        - `pages/api/endpoint/getsearchdocumentdetailspaged_api.js`
+        - `pages/api/endpoint/getbasicsearchpaged_api.js`
+        - `pages/api/file/getawaitingsubmissionfromblobproxy.js`
+        - `pages/api/file/getrepsblobproxy.js`
+        - `pages/api/file/getbloblistproxy.js`
+        - `pages/api/file/createappealcompletemessageproxy_api.js`
+    - Migrated from broad `../../../actions` imports to focused `actions/core/*` + service imports.
+    - Removed duplicated local hash helper in `getmylpacases_api.js` and reused `actions/core/hash`.
+- Broad `actions` import scan now reports only comment-only references (no active broad imports in `.js` files).
+- Lint check re-run outcome unchanged: `next lint` fails due legacy/unsupported ESLint options in repo tooling config (not introduced by this refactor pass).
+
+## Handover update (2026-03-13)
+
+- Priority 1 import-migration wave has been checked in and completed via pull request.
+- Recent migration commits captured in this wave:
+    - `f0202bb`
+    - `fa98535`
+    - `bef8f25`
+- Active broad `.../actions` imports are now eliminated from live `.js` code paths.
+- Next refactor phase will begin on a **new branch** and focus on splitting `actions/services/legacyActionsService.js` into smaller direct implementation modules.
+- Recommended decomposition order for the new branch:
+    1. reference/search extraction
+    2. portal/document extraction
+    3. compatibility layer slimming + dead wrapper removal
+
+## Latest update (2026-03-13 — Phase 5 kickoff)
+
+- New branch created from `SIPS-Development`: `TASK21997-phase5-legacyactions-split`.
+- Completed first Phase 5 decomposition slice from `legacyActionsService`:
+    - Added `actions/services/searchDirectService.js`
+    - Added `actions/services/referenceDataDirectService.js`
+    - Updated `actions/services/searchService.js` to source from `searchDirectService`
+    - Updated `actions/services/referenceDataService.js` to source from `referenceDataDirectService`
+- Compatibility approach preserved: public grouped service exports and function signatures remain unchanged for callers.
+- Validation status unchanged:
+    - `npm run lint` still fails due pre-existing Next/ESLint option incompatibility in repo tooling configuration.
+
+## Latest update (2026-03-13 — Phase 5 document slice)
+
+- Continued on branch `TASK21997-phase5-legacyactions-split`.
+- Completed second decomposition slice from `legacyActionsService`:
+    - Added `actions/services/documentDirectService.js`
+    - Updated `actions/services/documentService.js` to source from `documentDirectService`
+- Compatibility approach preserved:
+    - grouped service export names/signatures unchanged for consumers.
+- Verification:
+    - service import scan now shows remaining legacy-backed grouped modules are:
+        - `portalService`, `accountService`, `caseService`, `adminService`, `notifyService`, `integrationService`
+    - `npm run lint` passes with warnings only (no blocking errors).
+
+## Latest update (2026-03-13 — Phase 5 completion)
+
+- Continued decomposition and completed all remaining slices on `TASK21997-phase5-legacyactions-split`:
+    - portal direct extraction
+    - account + case direct extraction
+    - admin + integration + notify direct extraction
+    - legacy cleanup/removal
+- New direct modules now in place:
+    - `portalDirectService.js`
+    - `accountDirectService.js`
+    - `caseDirectService.js`
+    - `adminDirectService.js`
+    - `integrationDirectService.js`
+    - `notifyDirectService.js`
+- `actions/services/legacyActionsService.js` removed after import parity checks.
+- Validation evidence:
+    - `actions/services` import scan: zero `./legacyActionsService` references
+    - `npm run lint`: warnings only, no blocking errors
+    - `npm run build`: successful production build
+
+## Latest update (2026-03-13 — Phase 6 post-Phase-5 hardening, in progress)
+
+- Branch created from `SIPS-Development`: `TASK21998-phase6-postphase5-hardening`.
+- Added focused parity checks for grouped/direct service stability and service index barrel stability:
+    - `tests/phase6/service-parity.test.cjs`
+    - validates grouped service import/export parity across:
+        - search, referenceData, document, portal, account, case, admin, integration, notify
+    - validates `actions/services/index.js` export list stability/order.
+- Added shared service error helper:
+    - `actions/services/httpServiceUtils.js`
+    - centralizes common `consoleLogger + return error.response` and `ErrResponse` shape patterns.
+- Applied low-risk duplication reduction in direct services (no signature/shape changes intended):
+    - `searchDirectService.js`
+    - `referenceDataDirectService.js`
+    - `caseDirectService.js`
+    - `adminDirectService.js`
+- Logging cleanup/redaction-oriented hardening (sensitive-flow noisy logs removed):
+    - removed debug `console.log` statements from:
+        - `searchDirectService.js`
+        - `documentDirectService.js`
+        - `portalDirectService.js`
+        - `caseDirectService.js`
+        - `adminDirectService.js`
+
+### Validation snapshot (Phase 6)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `npm run lint` -> **warnings only** (same pre-existing warnings)
+
+### Decision captured (Phase 6)
+
+- Agreed approach: keep parity guard tests **and** add focused behavioural unit tests in the current refactor stream (instead of deferring all behavioural checks to long-term roadmap).
+- Implemented now:
+    - `tests/phase6/service-behaviour.test.cjs`
+    - mocked-axios behavioural checks for critical success/error contracts across search/reference/case/admin direct services.
+- Wider behavioural expansion remains on roadmap for additional domains/functions.
+
+### Targeted smoke snapshot (local dev server)
+
+- Search flow:
+    - `GET /searchresults` (EN/CY) -> **500** in local env due existing serialization issue (`initialState.search.searchString` undefined in SSR payload), observed in `/tmp/phase6-dev.log`.
+    - `GET /advancedsearch` and `GET /cy/advancedsearch` -> **200**
+- Case flow:
+    - `GET /case` and `GET /cy/case` -> **200**
+- My Portal flow (negative-path):
+    - `GET /myportal` and `GET /cy/myportal` -> **307** redirect to `/auth/signin` (expected unauthenticated behavior)
+- Document flow (negative-path):
+    - `GET /api/file/getbloblistproxy?container=test&casefolderID=test` -> **400**
+- Notify flow (negative-path):
+    - `POST /api/email/notify` with `{}` -> **400**
+
+## Latest update (2026-03-13 — Phase 8 hardening slice)
+
+- New branch created from `origin/SIPS-Development` with work item prefix:
+    - `TASK22017-phase8-hardening-slice`
+- Hardened four sensitive API handlers with minimal reversible guards:
+    - `pages/api/file/deleteblobcase.js`
+    - `pages/api/file/deleteblobrep.js`
+    - `pages/api/file/createappealcompletemessage_api.js`
+    - `pages/api/endpoint/getportallogin_api.js`
+- Scope delivered:
+    - re-enabled/enforced hash checks where bypassed/commented
+    - standardized early 400 negative paths for missing/invalid required query inputs
+    - reduced noisy sensitive-path logging and routed errors through `consoleLogger`
+    - preserved function signatures and existing response-shape contracts
+- Consumer parity updates (required to preserve behaviour after hash enforcement):
+    - `actions/services/documentDirectService.js`
+        - append hash for delete-blob-case/delete-blob-rep calls
+    - `actions/services/portalDirectService.js`
+        - append hash for create-appeal-complete-message call (hash path preserved to existing API contract)
+- Added focused tests:
+    - `tests/phase8/service-behaviour.test.cjs`
+    - covers negative paths for all 4 handlers (missing/invalid hash and missing key params as applicable)
+    - includes one happy-path check for `getportallogin_api` with valid hash via mocked dependencies
+
+### Validation snapshot (Phase 8)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `npm run lint` -> **warnings only** (pre-existing react-hooks dependency warnings; no new lint errors)
+
+### Manual HTTP checks (Phase 8)
+
+- Local dev server on `http://localhost:3001`.
+- Negative-path checks:
+    - `GET /api/file/deleteblobcase?...` missing hash -> **400**
+    - `GET /api/file/deleteblobcase?...&hash=bad` -> **400**
+    - `GET /api/file/deleteblobrep?...` missing hash -> **400**
+    - `GET /api/file/deleteblobrep?...&hash=bad` -> **400**
+    - `GET /api/file/deleteblobrep?...` missing `repfile` -> **400**
+    - `GET /api/file/createappealcompletemessage_api?...` missing hash -> **400**
+    - `GET /api/file/createappealcompletemessage_api?...&hash=bad` -> **400**
+    - `GET /api/file/createappealcompletemessage_api?...` missing `tempcaseref` -> **400**
+    - `GET /api/endpoint/getportallogin_api?...` missing hash -> **400**
+    - `GET /api/endpoint/getportallogin_api?...&hash=bad` -> **400**
+    - `GET /api/endpoint/getportallogin_api?...` missing `emailAddress` -> **400**
+- Valid-hash spot-check:
+    - `GET /api/endpoint/getportallogin_api?...&hash=<valid>` reached handler with valid hash but returned **400** from upstream relay/CRM call in local environment (expected environmental dependency risk, not hash-guard bypass).
+
+## Latest update (2026-03-13 — Phase 9 hardening slice)
+
+- New branch created from `origin/SIPS-Development` with work item prefix:
+    - `TASK22019-phase-9-hardening`
+- Hardened four additional sensitive file handlers with minimal reversible changes:
+    - `pages/api/file/createrepcompletemessage_api.js`
+    - `pages/api/file/upload.js`
+    - `pages/api/file/uploadsinglefile.js`
+    - `pages/api/file/setupcontainer.js`
+- Scope delivered:
+    - re-enabled/enforced hash validation where bypassed/commented
+    - added/standardized early 400 negative paths for missing/invalid hash and missing key parameters
+    - reduced noisy logging in sensitive file-upload/message paths
+    - preserved handler signatures and external response-shape contracts
+- Consumer parity updates:
+    - `actions/services/portalDirectService.js`
+        - append hash for `createrepcompletemessage_api` call
+    - `actions/services/documentDirectService.js`
+        - append hash for `upload` and `uploadsinglefile` calls
+- Added focused tests:
+    - `tests/phase9/service-behaviour.test.cjs`
+    - covers negative paths across all 4 phase-9 handlers
+
+### Validation snapshot (Phase 9)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `npm run lint` -> **warnings only** (pre-existing react-hooks warnings; no new lint errors)
+
+### Manual HTTP checks (Phase 9)
+
+- Negative-path checks on `localhost:3000`:
+    - `GET /api/file/createrepcompletemessage_api?...` missing hash -> **400**
+    - `GET /api/file/createrepcompletemessage_api?...&hash=bad` -> **400**
+    - `POST /api/file/upload` missing hash -> **400**
+    - `POST /api/file/upload?hash=bad` -> **400**
+    - `POST /api/file/uploadsinglefile` missing hash -> **400**
+    - `POST /api/file/uploadsinglefile?hash=bad` -> **400**
+    - `GET /api/file/setupcontainer?ident=...` missing hash -> **400**
+    - `GET /api/file/setupcontainer?ident=...&hash=bad` -> **400**
+    - `GET /api/file/setupcontainer?hash=bad` (missing ident) -> **400**
+- Valid-hash happy-path spot-check:
+    - Completed using `.env.local` runtime key: `POST /api/file/uploadsinglefile?hash=<valid>` -> **200**
+
+### Rollback plan (Phase 9)
+
+1. Revert the four hardened API handlers.
+2. Revert direct-service hash append changes in `documentDirectService` and `portalDirectService`.
+3. Remove `tests/phase9/service-behaviour.test.cjs` if full slice rollback required.
+4. Re-run phase6/7/8/9 baseline tests + lint after rollback.
+
+## Latest update (2026-03-13 — Phase 10 hardening slice)
+
+- Continued on branch:
+    - `TASK22019-phase-9-hardening`
+- Hardened four additional sensitive file handlers with minimal reversible changes:
+    - `pages/api/file/getawaitingsubmissionfromblob.js`
+    - `pages/api/file/getprogressobjblob.js`
+    - `pages/api/file/getbloblist.js`
+    - `pages/api/file/getrepsblob.js`
+- Scope delivered:
+    - added explicit early 400 handling for missing/empty required inputs (`container`, `casefolderID` where applicable, `hash`)
+    - standardized hash-mismatch negative-path checks to early return 400
+    - removed legacy/noisy commented debug blocks from touched handlers
+    - preserved existing handler signatures and response-shape contracts
+- Caller parity impact:
+    - no new caller changes required in this slice because direct-service consumers already append hash for these APIs.
+- Added focused tests:
+    - `tests/phase10/service-behaviour.test.cjs`
+    - covers negative paths for all 4 selected phase-10 handlers
+    - includes one valid-hash contract-preserving happy-path check (`getbloblist` via mocked dependencies)
+
+### Validation snapshot (Phase 10)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
+- `npm run lint` -> **warnings only** (pre-existing react-hooks warnings; no new lint errors)
+
+### Manual HTTP checks (Phase 10)
+
+- Negative-path checks on `localhost:3000`:
+    - `GET /api/file/getawaitingsubmissionfromblob?container=test` (missing hash) -> **400**
+    - `GET /api/file/getprogressobjblob?container=test&casefolderID=case-1` (missing hash) -> **400**
+    - `GET /api/file/getbloblist?container=test&casefolderID=case-1` (missing hash) -> **400**
+    - `GET /api/file/getrepsblob?container=test&casefolderID=case-1` (missing hash) -> **400**
+- Valid-hash happy-path spot-check:
+    - `GET /api/file/getbloblist?container=test&casefolderID=case-1&hash=<valid>` -> **500**
+    - expected due local storage/upstream dependency constraints, while confirming hash gate is no longer the failing check.
+
+### Rollback plan (Phase 10)
+
+1. Revert the four hardened API handlers.
+2. Remove `tests/phase10/service-behaviour.test.cjs` if full phase-10 rollback required.
+3. Re-run phase6/7/8/9/10 baseline tests + lint after rollback.
+
+## Latest update (2026-03-13 — Phase 11 hardening slice)
+
+- Continued on branch:
+    - `TASK22019-phase-9-hardening`
+- Hardened three additional sensitive file handlers with minimal reversible changes:
+    - `pages/api/file/getbloblist.js`
+    - `pages/api/file/deleteblob.js`
+    - `pages/api/file/deleteawaitingsubmissionfromblob.js`
+- Scope delivered:
+    - added explicit early 400 handling for missing/empty required query inputs (`container`, `casefolderID`, `blobname`, `hash` as applicable)
+    - standardized hash-mismatch negative-path checks to early return 400
+    - removed legacy/noisy commented debug traces in touched handlers
+    - preserved existing handler signatures and response-shape contracts
+- Caller parity impact:
+    - no new caller changes required in this slice; direct-service consumers already pass expected query/hash data.
+- Added focused tests:
+    - `tests/phase11/service-behaviour.test.cjs`
+    - covers negative paths for selected phase-11 handlers
+    - includes one valid-hash contract-preserving happy-path check (`getbloblist` via mocked dependencies)
+
+### Validation snapshot (Phase 11)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
+- `npm run lint` -> **warnings only** (pre-existing react-hooks warnings; no new lint errors)
+
+### Manual HTTP checks (Phase 11)
+
+- Negative-path checks on `localhost:3000`:
+    - `GET /api/file/getbloblist?container=test&casefolderID=case-1` (missing hash) -> **400**
+    - `GET /api/file/deleteblob?container=test&casefolderID=case-1&blobname=file.pdf` (missing hash) -> **400**
+    - `GET /api/file/deleteawaitingsubmissionfromblob?container=test&casefolderID=case-1&blobname=file.pdf` (missing hash) -> **400**
+    - `GET /api/file/deleteblob?container=test&casefolderID=case-1&hash=bad` (missing blobname/invalid hash) -> **400**
+- Valid-hash happy-path spot-check:
+    - `GET /api/file/getbloblist?container=test&casefolderID=case-1&hash=<valid>` -> **500**
+    - expected due local storage/upstream dependency constraints, while confirming hash gate is no longer the failing check.
+
+### Rollback plan (Phase 11)
+
+1. Revert the three hardened API handlers.
+2. Remove `tests/phase11/service-behaviour.test.cjs` if full phase-11 rollback required.
+3. Re-run phase6/7/8/9/10/11 baseline tests + lint after rollback.
+
+## Latest update (2026-03-13 — Phase 12 hardening slice)
+
+- Continued on branch:
+    - `TASK22019-phase-9-hardening`
+- Hardened four additional sensitive handlers with minimal reversible changes:
+    - `pages/api/file/downloadblob.js`
+    - `pages/api/file/getbloblistproxy.js`
+    - `pages/api/file/getrepsblobproxy.js`
+    - `pages/api/file/getawaitingsubmissionfromblobproxy.js`
+- Scope delivered:
+    - added explicit early 400 handling for missing/empty required query inputs (`container`, `casefolderID`, `blobname`, `hash` as applicable)
+    - standardized hash-mismatch negative-path checks for `downloadblob`
+    - preserved existing function signatures and response-shape contracts
+- Added focused tests:
+    - `tests/phase12/service-behaviour.test.cjs`
+    - covers negative paths for selected phase-12 handlers
+    - includes one valid-hash contract-preserving happy-path check (`downloadblob` via mocked dependencies)
+
+### Validation snapshot (Phase 12)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> **pass** (4/4)
+- `npm run lint` -> **warnings only** (pre-existing react-hooks warnings; no new lint errors)
+
+### Manual HTTP checks (Phase 12)
+
+- Negative-path checks on `localhost:3000`:
+    - `GET /api/file/downloadblob?container=test&casefolderID=case-1&blobname=file.pdf` (missing hash) -> **400**
+    - `GET /api/file/downloadblob?container=test&casefolderID=case-1&blobname=file.pdf&hash=bad` -> **400**
+    - `GET /api/file/getbloblistproxy?casefolderID=case-1` (missing container) -> **400**
+    - `GET /api/file/getrepsblobproxy` (missing container) -> **400**
+    - `GET /api/file/getawaitingsubmissionfromblobproxy` (missing container) -> **400**
+- Valid-hash happy-path spot-check:
+    - `GET /api/file/downloadblob?container=test&casefolderID=case-1&blobname=file.pdf&hash=<valid>` -> **500**
+    - expected due local storage/upstream dependency constraints, while confirming hash gate is no longer the failing check.
+
+### Rollback plan (Phase 12)
+
+1. Revert the four hardened API handlers.
+2. Remove `tests/phase12/service-behaviour.test.cjs` if full phase-12 rollback required.
+3. Re-run phase6/7/8/9/10/11/12 baseline tests + lint after rollback.
+
+## Latest update (2026-03-13 — Phase 13 hardening slice)
+
+- Continued on branch:
+    - `TASK22019-phase-9-hardening`
+- Hardened four additional sensitive handlers with minimal reversible changes:
+    - `pages/api/file/deleteblobcase.js`
+    - `pages/api/file/deleteblobrep.js`
+    - `pages/api/file/createcaseinvolvement_api.js`
+    - `pages/api/file/createrepinvolvement_api.js`
+- Scope delivered:
+    - added explicit early 400 handling for missing/empty required query/body inputs (`hash`, `contactid`, `incidentid` as applicable)
+    - standardized hash-mismatch negative-path checks for delete-blob handlers
+    - removed noisy body/query logging in involvement handlers
+    - preserved existing function signatures and response-shape contracts
+- Added focused tests:
+    - `tests/phase13/service-behaviour.test.cjs`
+    - covers negative paths for selected phase-13 handlers
+    - includes valid-hash/valid-body contract-preserving happy-path checks via mocked dependencies
+
+### Validation snapshot (Phase 13)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> **pass** (7/7)
+- `npm run lint` -> **warnings only** (pre-existing react-hooks warnings; no new lint errors)
+
+### Manual HTTP checks (Phase 13)
+
+- Negative-path checks on `localhost:3000`:
+    - `GET /api/file/deleteblobcase?container=test&casefolderID=case-1` (missing hash) -> **400**
+    - `GET /api/file/deleteblobcase?container=test&casefolderID=case-1&hash=bad` -> **400**
+    - `GET /api/file/deleteblobrep?container=test&casefolderID=case-1&repfile=r.pdf` (missing hash) -> **400**
+    - `POST /api/file/createcaseinvolvement_api` with `{}` -> **400**
+    - `POST /api/file/createrepinvolvement_api` with `{}` -> **400**
+- Valid-hash happy-path spot-check:
+    - `GET /api/file/deleteblobcase?container=test&casefolderID=case-1&hash=<valid>` -> **500**
+    - expected due local storage/upstream dependency constraints, while confirming hash gate is no longer the failing check.
+
+### Rollback plan (Phase 13)
+
+1. Revert the four hardened API handlers.
+2. Remove `tests/phase13/service-behaviour.test.cjs` if full phase-13 rollback required.
+3. Re-run phase6/7/8/9/10/11/12/13 baseline tests + lint after rollback.
+
+## Latest update (2026-03-13 — Phase 14 client-hash signing fix)
+
+- Continued on branch:
+    - `TASK22019-phase-9-hardening`
+- Fixed authenticated user-journey runtime error during new appeal flow where client-side hashing tried to use server-only `HASHKEY`.
+- Added authenticated server-side hash signer endpoint:
+    - `pages/api/endpoint/gethash_api.js`
+    - requires session (`getSession`), allow-lists supported API paths, returns `{ hash }`.
+- Updated direct services to request hash from server signer for browser calls, with server-side fallback only when `HASHKEY` exists:
+    - `actions/services/documentDirectService.js`
+    - `actions/services/portalDirectService.js`
+- Preserved existing API contracts and response shapes in file handlers.
+- Added focused tests:
+    - `tests/phase14/service-behaviour.test.cjs`
+    - covers signer endpoint negative paths + authenticated happy path.
+
+### Validation snapshot (Phase 14)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> **pass** (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> **pass** (4/4)
+- `npm run lint` -> **warnings only** (pre-existing hook dependency warnings)
+
+### Rollback plan (Phase 14)
+
+1. Revert `pages/api/endpoint/gethash_api.js`.
+2. Revert direct-service hash signer usage in `documentDirectService.js` and `portalDirectService.js`.
+3. Remove `tests/phase14/service-behaviour.test.cjs` if rolling back full phase-14 slice.
+4. Re-run phase6–phase14 tests + lint.
+
+## Latest update (2026-03-13 — Phase 14 closeout follow-up)
+
+- Continued on branch:
+    - `TASK22019-phase-9-hardening`
+- Completed follow-up hardening and contract-alignment after runtime verification:
+    - `actions/services/accountDirectService.js`
+        - `getPortalLogin` now uses authenticated signer endpoint (`/api/endpoint/gethash_api`) for browser-safe hash generation
+        - retains server-only fallback to local `hashAPIPath` when `HASHKEY` is available
+    - `pages/api/endpoint/gethash_api.js`
+        - allow-list expanded for `/api/endpoint/getportallogin_api`
+    - `pages/api/file/getrepsblob.js`
+        - removed enforced `casefolderID` guard and argument pass-through to align with route contract (`/api/file/getrepsblob?container=...`)
+    - `components/elements/index.js`
+        - added missing `updateLinks` import from `components/utils` to resolve Quill runtime error
+- Tests updated:
+    - `tests/phase7/service-behaviour.test.cjs`
+        - updated `getPortalLogin` expectations for signer endpoint behavior
+    - `tests/phase14/service-behaviour.test.cjs`
+        - added allow-list coverage for signer path `/api/endpoint/getportallogin_api`
+
+### Validation snapshot (Phase 14 follow-up)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `node tests/phase8/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase9/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase10/service-behaviour.test.cjs` -> **pass** (5/5)
+- `node tests/phase11/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase12/service-behaviour.test.cjs` -> **pass** (4/4)
+- `node tests/phase13/service-behaviour.test.cjs` -> **pass** (7/7)
+- `node tests/phase14/service-behaviour.test.cjs` -> **pass** (5/5)
+- `npm run lint` -> **warnings only** (pre-existing hook dependency warnings)
+
+### Risks + mitigations (follow-up)
+
+- Risk: signer endpoint over-expansion could broaden hash issuance.
+    - Mitigation: strict allow-list retained; only required `getportallogin_api` path added.
+- Risk: tightened/changed guards could break existing caller contracts.
+    - Mitigation: `getrepsblob` guard aligned back to actual route contract; response shape unchanged.
+- Risk: UI runtime dependency regressions during hardening verification.
+    - Mitigation: missing `updateLinks` import restored with minimal diff.
+
+### Rollback plan (follow-up)
+
+1. Revert signer-path migration commit `6094874` (or files: `accountDirectService.js`, `gethash_api.js`, `tests/phase7`, `tests/phase14`).
+2. Revert contract/import alignment commit `b8fa514` (or files: `getrepsblob.js`, `components/elements/index.js`).
+3. Re-run phase6–phase14 tests and lint to confirm rollback parity.
+
+### Rollback plan (Phase 8)
+
+1. Revert the four hardened API handlers.
+2. Revert direct-service hash append changes in `documentDirectService` and `portalDirectService`.
+3. Remove `tests/phase8/service-behaviour.test.cjs` if full slice rollback required.
+4. Re-run phase6/7 baseline tests + lint after rollback.
+
+## Outstanding risks / gaps
+
+- Navigation regressions across EN/CY + route query combinations.
+- Drift between rewrite config and component-level locale path logic.
+- Deployment ambiguity due to multiple CI/CD artifacts (Azure pipeline, Jenkins, Docker) with unclear active source of truth.
+- Security posture variability where hash checks are bypassed/commented in selected handlers.
+
+## Latest update (2026-03-13 — Phase 7 post-Phase-6 hardening)
+
+- New branch created from `origin/SIPS-Development` with required work item prefix:
+    - `TASK21988a-phase7-postphase6-hardening`
+- Fixed known pre-existing SSR serialization issue on search results route:
+    - `pages/searchresults.js`
+    - updated SSR dispatch fallback from `setSearch(query.q)` to `setSearch(query?.q || "")`
+    - result: `/searchresults` and `/cy/searchresults` now return 200 in local smoke checks (no 500 observed in this run).
+- Added expanded behavioural coverage for remaining direct-service domains:
+    - new test file: `tests/phase7/service-behaviour.test.cjs`
+    - includes document, portal, account, notify, integration behavioural checks
+    - includes negative-path assertions for relay/hash/token-sensitive behaviors where feasible:
+        - hashed URL append checks (`hashAPIPath`)
+        - error handling contracts (undefined/error string/rethrow depending on existing function contract)
+
+### Validation snapshot (Phase 7)
+
+- `node tests/phase6/service-parity.test.cjs` -> **pass**
+- `node tests/phase6/service-behaviour.test.cjs` -> **pass** (8/8)
+- `node tests/phase7/service-behaviour.test.cjs` -> **pass** (10/10)
+- `npm run lint` -> **warnings only** (pre-existing hook dependency warnings; no new lint errors)
+
+### Targeted smoke snapshot (local dev server)
+
+- Note: dev server auto-started on `http://localhost:3001` because port `3000` was in use.
+- Search flow:
+    - `GET /searchresults` and `GET /cy/searchresults` -> **200**
+- Case flow:
+    - `GET /case` and `GET /cy/case` -> **200**
+- My Portal flow (negative-path):
+    - `GET /myportal` and `GET /cy/myportal` -> **307** redirect to `/auth/signin`
+- Document flow (negative-path):
+    - `GET /api/file/getbloblistproxy?container=test&casefolderID=test` -> **400**
+- Notify flow (negative-path):
+    - `POST /api/email/notify` with `{}` -> **400**