Merged PR 2317: Auth stabilisation: add reason-coded guards to MyPortal loaders

Adds incremental auth/session hardening across myportal loader paths (loadMyPortalAppealPage, searchresults, addresssearchresults) with explicit guard ordering and reason-coded diagnostics for missing session, missing session identity, missing cookie identity, contact/account lookup failures, and upstream dependency failures. Includes targeted Phase22 loader guard tests and keeps redirect behaviour policy unchanged.

Related work items: #23020

tests/phase22/myportal-loader-guards.test.cjs

@@ -57,6 +57,19 @@ test("myportal loader redirects to signin when session is missing", async () =>
     assert.strictEqual(result.redirect.destination, "/auth/signin");
 });
 
+test("myportal loader redirects to signin when session user identity is missing", async () => {
+    const mod = loadMyPortalLoader({
+        getSession: async () => ({ user: { id: "u-1" } })
+    });
+
+    const result = await mod.loadMyPortalAppealPage({
+        query: { appealtypes: "s78", apt: "1", casereference: "CAS-1" },
+        req: { cookies: { pinsUser: "contact-1" } }
+    });
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
 test("myportal loader redirects to signin when pinsUser cookie is missing", async () => {
     const mod = loadMyPortalLoader();
 
@@ -99,6 +112,24 @@ test("myportal loader redirects to myportal when dependency fetch fails", async
     assert.strictEqual(result.redirect.destination, "/myportal");
 });
 
+test("myportal loader classifies account lookup failure and redirects to signin", async () => {
+    let capturedLog = null;
+    const mod = loadMyPortalLoader({
+        getPersonalAccount: async () => ({ errorCode: "CRM_CONTACT_MISSING" }),
+        consoleLogger: (entry) => {
+            capturedLog = entry;
+        }
+    });
+
+    const result = await mod.loadMyPortalAppealPage({
+        query: { appealtypes: "s78", apt: "1", casereference: "CAS-1" },
+        req: { cookies: { pinsUser: "contact-1" } }
+    });
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+    assert.strictEqual(capturedLog.reasonCode, "CONTACT_LOOKUP_FAILED");
+});
+
 const run = async () => {
     let passed = 0;