Merged PR 2317: Auth stabilisation: add reason-coded guards to MyPortal loaders

Adds incremental auth/session hardening across myportal loader paths (loadMyPortalAppealPage, searchresults, addresssearchresults) with explicit guard ordering and reason-coded diagnostics for missing session, missing session identity, missing cookie identity, contact/account lookup failures, and upstream dependency failures. Includes targeted Phase22 loader guard tests and keeps redirect behaviour policy unchanged.

Related work items: #23020

lib/myportal/loadMyPortalAppealPage.js

@@ -44,12 +44,27 @@ export async function loadMyPortalAppealPage(ctx) {
     }
 
     const session = await getSession(ctx);
-    if (!session || !session?.user?.id || !session?.user?.email) {
+    if (!session) {
         consoleLogger({
-            name: "MyPortalAppealLoaderMissingSession",
+            name: "MyPortalAppealLoaderAuthGuard",
+            reasonCode: "NO_SESSION",
             message:
-                "loadMyPortalAppealPage missing session identity; redirecting to signin",
-            hasSession: !!session,
+                "loadMyPortalAppealPage missing session; redirecting to signin"
+        });
+        return {
+            redirect: {
+                destination: "/auth/signin",
+                permanent: false
+            }
+        };
+    }
+
+    if (!session?.user?.id || !session?.user?.email) {
+        consoleLogger({
+            name: "MyPortalAppealLoaderAuthGuard",
+            reasonCode: "NO_SESSION_USER",
+            message:
+                "loadMyPortalAppealPage missing session user identity; redirecting to signin",
             hasUserId: !!session?.user?.id,
             hasUserEmail: !!session?.user?.email
         });
@@ -68,7 +83,8 @@ export async function loadMyPortalAppealPage(ctx) {
 
     if (!loggedInUser) {
         consoleLogger({
-            name: "MyPortalAppealLoaderMissingPinsUserCookie",
+            name: "MyPortalAppealLoaderAuthGuard",
+            reasonCode: "NO_PINSUSER_COOKIE",
             message:
                 "loadMyPortalAppealPage missing pinsUser cookie; redirecting to signin"
         });
@@ -107,6 +123,7 @@ export async function loadMyPortalAppealPage(ctx) {
     } catch (_error) {
         consoleLogger({
             name: "MyPortalAppealLoaderDependencyFailure",
+            reasonCode: "UPSTREAM_FAILURE",
             message:
                 "loadMyPortalAppealPage dependency fetch failed; redirecting to /myportal",
             appealType: query?.appealtypes,
@@ -121,6 +138,23 @@ export async function loadMyPortalAppealPage(ctx) {
         };
     }
 
+    if (!accountDetails || accountDetails?.errorCode) {
+        consoleLogger({
+            name: "MyPortalAppealLoaderContactGuard",
+            reasonCode: "CONTACT_LOOKUP_FAILED",
+            message:
+                "loadMyPortalAppealPage account contact lookup failed; redirecting to signin",
+            hasAccountDetails: !!accountDetails,
+            hasErrorCode: !!accountDetails?.errorCode
+        });
+        return {
+            redirect: {
+                destination: "/auth/signin",
+                permanent: false
+            }
+        };
+    }
+
     // Optional: awaiting-submission view setup when query.key exists
     let awaitingSubmissionFromBlob = null;
     if (Object.prototype.hasOwnProperty.call(query, "key")) {