robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merged PR 2317: Auth stabilisation: add reason-coded guards to MyPortal loaders

Browse Source 
Adds incremental auth/session hardening across myportal loader paths (loadMyPortalAppealPage, searchresults, addresssearchresults) with explicit guard ordering and reason-coded diagnostics for missing session, missing session identity, missing cookie identity, contact/account lookup failures, and upstream dependency failures. Includes targeted Phase22 loader guard tests and keeps redirect behaviour policy unchanged.

Related work items: #23020
This commit is contained in:
Robert Bond
2026-05-14 10:27:12 +00:00
parent d0b2fd077a
commit 4fb62a6773
7 changed files with 532 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/phase22/index.test.cjs
+4
View File
@@ -13,6 +13,8 @@ const runRepresentationBuildRepsArrRulesTests = require("./representation-build-
const runSessionClientTests = require("./session-client-behaviour.test.cjs");
const runNewAppealLoaderGuardTests = require("./newappeal-loader-guards.test.cjs");
const runMyPortalLoaderGuardTests = require("./myportal-loader-guards.test.cjs");
const runMyPortalSearchResultsLoaderGuardTests = require("./myportal-searchresults-loader-guards.test.cjs");
const runMyPortalAddressSearchResultsLoaderGuardTests = require("./myportal-addresssearchresults-loader-guards.test.cjs");
const runRepresentationLoaderGuardTests = require("./representation-loader-guards.test.cjs");
const run = async () => {
@@ -31,6 +33,8 @@ const run = async () => {
await runSessionClientTests();
await runNewAppealLoaderGuardTests();
await runMyPortalLoaderGuardTests();
await runMyPortalSearchResultsLoaderGuardTests();
await runMyPortalAddressSearchResultsLoaderGuardTests();
await runRepresentationLoaderGuardTests();
console.log("Phase 22 combined suite passed.");
};
tests/phase22/myportal-addresssearchresults-loader-guards.test.cjs
+149
View File
@@ -0,0 +1,149 @@
const assert = require("assert");
const fs = require("fs");
const path = require("path");
const vm = require("vm");
const tests = [];
const test = (name, fn) => tests.push({ name, fn });
const loadMyPortalAddressSearchResultsPage = (overrides = {}) => {
const filePath = path.join(
__dirname,
"..",
"..",
"pages",
"myportal",
"addresssearchresults.js"
);
let source = fs.readFileSync(filePath, "utf8");
source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
source = source.slice(source.indexOf("export const getServerSideProps"));
source = source.replace(
/export\s+const\s+getServerSideProps\s*=\s*/,
"const getServerSideProps = "
);
source = source.replace(/const mapStateToProps[\s\S]*$/, "");
source += "\nmodule.exports = { getServerSideProps };\n";
const context = {
module: { exports: {} },
exports: {},
getIP: () => {},
consoleLogger: () => {},
getSession: async () => ({ user: { id: "u-1", email: "x@y.z" } }),
getPersonalAccount: async () => ({}),
getAddressSearch: async () => ({ value: [] }),
getAdvancedSearch: async () => ({ value: [] }),
getWatchedCases: async () => ({ value: [] }),
getSearchDetails: async () => ({ value: [] }),
getPortalModuleDetails: async () => ({}),
getFormCollectionByID: () => ({ LogicalCollectionName: "x" }),
setShowReps: () => ({}),
setSearch: () => ({}),
setContainerID: () => ({}),
setAccountDetails: () => ({}),
setSearchResults: () => ({}),
setSearchDetails: () => ({}),
setWatchedCases: () => ({}),
setWatchedCasesDetails: () => ({}),
setLoggedInUserId: () => ({}),
wrapper: {
getServerSideProps: (factory) => async (ctx) => {
const store = { dispatch: () => {} };
return factory(store)(ctx);
}
},
process: { env: {} },
console,
...overrides
};
vm.runInNewContext(source, context, { filename: filePath });
return context.module.exports;
};
test("addresssearchresults redirects to signin when session is missing", async () => {
const mod = loadMyPortalAddressSearchResultsPage({
getSession: async () => null
});
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
});
test("addresssearchresults redirects to signin when session user identity is missing", async () => {
const mod = loadMyPortalAddressSearchResultsPage({
getSession: async () => ({ user: { id: "u-1" } })
});
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
});
test("addresssearchresults redirects to signin when pinsUser cookie is missing", async () => {
const mod = loadMyPortalAddressSearchResultsPage();
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: {} }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
});
test("addresssearchresults classifies contact lookup failure and redirects to signin", async () => {
let capturedLog = null;
const mod = loadMyPortalAddressSearchResultsPage({
getPersonalAccount: async () => ({ errorCode: "CONTACT_MISSING" }),
consoleLogger: (entry) => {
capturedLog = entry;
}
});
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
assert.strictEqual(capturedLog.reasonCode, "CONTACT_LOOKUP_FAILED");
});
test("addresssearchresults classifies upstream failure and redirects to signin", async () => {
let capturedLog = null;
const mod = loadMyPortalAddressSearchResultsPage({
getAdvancedSearch: async () => {
throw new Error("search unavailable");
},
consoleLogger: (entry) => {
capturedLog = entry;
}
});
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
assert.strictEqual(capturedLog.reasonCode, "UPSTREAM_FAILURE");
});
const run = async () => {
let passed = 0;
for (const currentTest of tests) {
await currentTest.fn();
passed += 1;
}
console.log(
`Phase 22 myportal-addresssearchresults-loader-guards tests passed (${passed}/${tests.length}).`
);
};
module.exports = run;
if (require.main === module) {
run().catch((error) => {
console.error(error);
process.exit(1);
});
}
tests/phase22/myportal-loader-guards.test.cjs
+31
View File
@@ -57,6 +57,19 @@ test("myportal loader redirects to signin when session is missing", async () =>
assert.strictEqual(result.redirect.destination, "/auth/signin");
});
test("myportal loader redirects to signin when session user identity is missing", async () => {
const mod = loadMyPortalLoader({
getSession: async () => ({ user: { id: "u-1" } })
});
const result = await mod.loadMyPortalAppealPage({
query: { appealtypes: "s78", apt: "1", casereference: "CAS-1" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
});
test("myportal loader redirects to signin when pinsUser cookie is missing", async () => {
const mod = loadMyPortalLoader();
@@ -99,6 +112,24 @@ test("myportal loader redirects to myportal when dependency fetch fails", async
assert.strictEqual(result.redirect.destination, "/myportal");
});
test("myportal loader classifies account lookup failure and redirects to signin", async () => {
let capturedLog = null;
const mod = loadMyPortalLoader({
getPersonalAccount: async () => ({ errorCode: "CRM_CONTACT_MISSING" }),
consoleLogger: (entry) => {
capturedLog = entry;
}
});
const result = await mod.loadMyPortalAppealPage({
query: { appealtypes: "s78", apt: "1", casereference: "CAS-1" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
assert.strictEqual(capturedLog.reasonCode, "CONTACT_LOOKUP_FAILED");
});
const run = async () => {
let passed = 0;
tests/phase22/myportal-searchresults-loader-guards.test.cjs
+146
View File
@@ -0,0 +1,146 @@
const assert = require("assert");
const fs = require("fs");
const path = require("path");
const vm = require("vm");
const tests = [];
const test = (name, fn) => tests.push({ name, fn });
const loadMyPortalSearchResultsPage = (overrides = {}) => {
const filePath = path.join(
__dirname,
"..",
"..",
"pages",
"myportal",
"searchresults.js"
);
let source = fs.readFileSync(filePath, "utf8");
source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
source = source.slice(source.indexOf("export const getServerSideProps"));
source = source.replace(
/export\s+const\s+getServerSideProps\s*=\s*/,
"const getServerSideProps = "
);
source = source.replace(/const mapStateToProps[\s\S]*$/, "");
source += "\nmodule.exports = { getServerSideProps };\n";
const context = {
module: { exports: {} },
exports: {},
getIP: () => {},
consoleLogger: () => {},
getSession: async () => ({
user: { id: "u-1", email: "test@example.com" }
}),
getPortalLogin: async () => ({ value: [{ contactid: "contact-1" }] }),
getPersonalAccount: async () => ({}),
getWatchedCases: async () => ({ value: [] }),
getPortalModuleDetails: async () => ({}),
getFormCollectionByID: () => ({ LogicalCollectionName: "x" }),
setShowReps: () => ({}),
setAccountDetails: () => ({}),
setSearch: () => ({}),
setWatchedCases: () => ({}),
setWatchedCasesDetails: () => ({}),
setLoggedInUserId: () => ({}),
setContainerID: () => ({}),
wrapper: {
getServerSideProps: (factory) => async (ctx) => {
const store = { dispatch: () => {} };
return factory(store)(ctx);
}
},
process: { env: {} },
console,
...overrides
};
vm.runInNewContext(source, context, { filename: filePath });
return context.module.exports;
};
test("myportal searchresults redirects to signin when session is missing", async () => {
const mod = loadMyPortalSearchResultsPage({ getSession: async () => null });
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
});
test("myportal searchresults redirects to signin when session user identity is missing", async () => {
const mod = loadMyPortalSearchResultsPage({
getSession: async () => ({ user: { id: "u-1" } })
});
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
});
test("myportal searchresults redirects to signin when pinsUser cookie is missing", async () => {
const mod = loadMyPortalSearchResultsPage();
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: {} }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
});
test("myportal searchresults classifies contact lookup failure and redirects to signin", async () => {
let capturedLog = null;
const mod = loadMyPortalSearchResultsPage({
getPortalLogin: async () => ({ value: [] }),
consoleLogger: (entry) => {
capturedLog = entry;
}
});
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
assert.strictEqual(capturedLog.reasonCode, "CONTACT_LOOKUP_FAILED");
});
test("myportal searchresults classifies upstream failure and redirects to signin", async () => {
let capturedLog = null;
const mod = loadMyPortalSearchResultsPage({
getPortalLogin: async () => {
throw new Error("crm unavailable");
},
consoleLogger: (entry) => {
capturedLog = entry;
}
});
const result = await mod.getServerSideProps({
query: { q: "CAS" },
req: { cookies: { pinsUser: "contact-1" } }
});
assert.strictEqual(result.redirect.destination, "/auth/signin");
assert.strictEqual(capturedLog.reasonCode, "UPSTREAM_FAILURE");
});
const run = async () => {
let passed = 0;
for (const currentTest of tests) {
await currentTest.fn();
passed += 1;
}
console.log(
`Phase 22 myportal-searchresults-loader-guards tests passed (${passed}/${tests.length}).`
);
};
module.exports = run;
if (require.main === module) {
run().catch((error) => {
console.error(error);
process.exit(1);
});
}