Route portal login hashing through authenticated signer

tests/phase14/service-behaviour.test.cjs

@@ -112,6 +112,26 @@ test("gethash_api returns hash for valid api path", async () => {
     });
 });
 
+test("gethash_api returns hash for allow-listed getportallogin path", async () => {
+    const mod = loadModule("pages/api/endpoint/gethash_api.js", {
+        hashAPIPath: () => "&hash=login",
+        getSession: async () => ({ user: { id: "u1" } }),
+        nextConnect: createNextConnectMock(),
+        middleware: () => {}
+    });
+
+    const req = {
+        query: { path: "/api/endpoint/getportallogin_api?emailAddress=a@b.com" }
+    };
+    const res = createRes();
+    await mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        hash: "&hash=login"
+    });
+});
+
 test("gethash_api rejects unauthenticated requests with 401", async () => {
     const mod = loadModule("pages/api/endpoint/gethash_api.js", {
         hashAPIPath: () => "&hash=expected",

tests/phase7/service-behaviour.test.cjs

@@ -208,31 +208,34 @@ test("portal/deleteMyRepresentations logs and returns undefined on failure", asy
 test("account/getPortalLogin appends hash and returns res.data", async () => {
     const axios = createAxiosMock();
     const logger = createLoggerMock();
-    const hashCalls = [];
-    const hashAPIPath = (queryPath) => {
-        hashCalls.push(queryPath);
-        return "&hash=login123";
-    };
+    const signCalls = [];
 
-    axios.getHandler = async () => ({ data: { value: [{ id: "user-1" }] } });
+    axios.getHandler = async (url) => {
+        if (url.startsWith("/api/endpoint/gethash_api?path=")) {
+            signCalls.push(url);
+            return { data: { hash: "&hash=login123" } };
+        }
+
+        return { data: { value: [{ id: "user-1" }] } };
+    };
 
     const account = loadServiceModule("accountDirectService.js", {
         axios,
         BASE_URL: "http://example.local",
         consoleLogger: logger.consoleLogger,
-        hashAPIPath
+        hashAPIPath: () => "&hash=fallback"
     });
 
     const result = await account.getPortalLogin("person@example.com");
 
     assert.deepStrictEqual(normalize(result), { value: [{ id: "user-1" }] });
-    assert.strictEqual(hashCalls.length, 1);
+    assert.strictEqual(signCalls.length, 1);
     assert.strictEqual(
-        hashCalls[0],
-        "/api/endpoint/getportallogin_api?emailAddress=person@example.com"
+        signCalls[0],
+        "/api/endpoint/gethash_api?path=%2Fapi%2Fendpoint%2Fgetportallogin_api%3FemailAddress%3Dperson%40example.com"
     );
     assert.strictEqual(
-        axios.calls[0].url,
+        axios.calls[1].url,
         "http://example.local/api/endpoint/getportallogin_api?emailAddress=person@example.com&hash=login123"
     );
 });
@@ -242,7 +245,13 @@ test("account/getPortalLogin returns JSON stringified error on failure", async (
     const logger = createLoggerMock();
     const error = createAxiosError(500, "Broken");
 
-    axios.getHandler = async () => Promise.reject(error);
+    axios.getHandler = async (url) => {
+        if (url.startsWith("/api/endpoint/gethash_api?path=")) {
+            return { data: { hash: "&hash=err" } };
+        }
+
+        return Promise.reject(error);
+    };
 
     const account = loadServiceModule("accountDirectService.js", {
         axios,