From eeb4a1f4415599b5d63798908b08fbef50dd7b08 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Thu, 5 Nov 2026 10:02:30 +0000
Subject: [PATCH 01/24] fix: restore watched-case deletion through
 subscriptions facade

---
 pages/api/endpoint/gethash_api.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pages/api/endpoint/gethash_api.js b/pages/api/endpoint/gethash_api.js
index f0ef869e..3829aed1 100644
--- a/pages/api/endpoint/gethash_api.js
+++ b/pages/api/endpoint/gethash_api.js
@@ -27,6 +27,7 @@ ApiProxy.get(async (req, res) => {
         "/api/endpoint/getportallogin_api",
         "/api/endpoint/deletemyrepresentations_api",
         "/api/endpoint/deletewatchedcases_api",
+        "/api/subscriptions/delete-watched-case",
         "/api/file/upload",
         "/api/file/uploadsinglefile",
         "/api/file/deleteblobcase",
@@ -41,7 +42,7 @@ ApiProxy.get(async (req, res) => {
         typeof queryPath !== "string" ||
         queryPath.length === 0 ||
         !queryPath.startsWith("/api/") ||
-        !allowedPrefix.some((prefix) => queryPath.startsWith(prefix)) ||
+        !allowedPrefix.includes(queryPath) ||
         queryPath.includes("/api/endpoint/gethash_api")
     ) {
         return respondError(res, {

From 431c45ba2b1885ed6ed982343287e681fd08dda7 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Thu, 5 Nov 2026 10:24:52 +0000
Subject: [PATCH 02/24] security: enforce CRM watched-case deletion ownership

---
 pages/api/endpoint/deletewatchedcases_api.js  | 121 +++++++-
 .../endpoint-handler-contract.test.cjs        | 292 ++++++++++++++++--
 2 files changed, 381 insertions(+), 32 deletions(-)

diff --git a/pages/api/endpoint/deletewatchedcases_api.js b/pages/api/endpoint/deletewatchedcases_api.js
index 5c59ecff..af4aad28 100644
--- a/pages/api/endpoint/deletewatchedcases_api.js
+++ b/pages/api/endpoint/deletewatchedcases_api.js
@@ -11,32 +11,143 @@
  */
 
 import axios from "axios";
+import { getServerSession } from "next-auth/next";
+import { azureHeaders } from "../../../actions/core/headers";
+import { escapeODataString } from "../../../actions/core/guards";
 import { consoleLogger } from "../../../actions/core/logger";
 import { getToken } from "../../../actions/core/token";
 import { hashAPIPath } from "../../../actions/core/hash";
+import { authOptions } from "../auth/[...nextauth]";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { relayGetData } from "../middleware/relayForwarding";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
+const GUID_PATTERN =
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+const normaliseGuid = (value) => value.trim().toLowerCase();
+
 export default async function ApiProxy(req, res) {
     const watchedCaseID = req.query.watchedCaseID;
 
     if (
         typeof watchedCaseID !== "string" ||
-        watchedCaseID.trim().length === 0
+        !GUID_PATTERN.test(watchedCaseID)
     ) {
         return respondError(res, {
             status: 400,
-            code: "WATCHED_CASE_ID_REQUIRED",
-            message: "watchedCaseID is required"
+            code: "INVALID_WATCHED_CASE_ID",
+            message: "watchedCaseID must be a valid GUID"
+        });
+    }
+
+    if (req.method !== "DELETE") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Only DELETE is supported"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    const authenticatedEmail = session?.user?.email;
+
+    if (
+        typeof authenticatedEmail !== "string" ||
+        authenticatedEmail.trim().length === 0
+    ) {
+        return respondError(res, {
+            status: 401,
+            code: "UNAUTHENTICATED",
+            message: "Authentication required"
         });
     }
 
     try {
         const token = await getToken();
-        const queryUrl = "pinswg_watchlists(" + watchedCaseID + ")";
+        const requestOptionsBuilder = (accessToken) => azureHeaders(accessToken);
+        const escapedEmail = escapeODataString(authenticatedEmail);
+        const contactQueryUrl =
+            "contacts?$filter=emailaddress1 eq '" +
+            escapedEmail +
+            "' and statuscode eq 1&$select=contactid";
+        const contactResponse = await relayGetData({
+            queryUrl: contactQueryUrl,
+            accessToken: token.access_token,
+            requestOptionsBuilder
+        });
+        const contacts = contactResponse?.data?.value;
+
+        if (!Array.isArray(contacts)) {
+            return respondError(res, {
+                status: 500,
+                code: "CONTACT_LOOKUP_FAILED",
+                message: "Unable to verify portal contact"
+            });
+        }
+
+        if (
+            contacts.length !== 1 ||
+            typeof contacts[0]?.contactid !== "string" ||
+            !GUID_PATTERN.test(contacts[0].contactid.trim())
+        ) {
+            return respondError(res, {
+                status: 403,
+                code: "CONTACT_IDENTITY_NOT_RESOLVED",
+                message: "Request not permitted"
+            });
+        }
+
+        const normalisedWatchedCaseID = normaliseGuid(watchedCaseID);
+        const watchlistQueryUrl =
+            "pinswg_watchlists(" +
+            normalisedWatchedCaseID +
+            ")?$select=pinswg_watchlistid,_pinswg_contact_value";
+        let watchlistResponse;
+
+        try {
+            watchlistResponse = await relayGetData({
+                queryUrl: watchlistQueryUrl,
+                accessToken: token.access_token,
+                requestOptionsBuilder
+            });
+        } catch (error) {
+            if (error?.response?.status === 404) {
+                return respondError(res, {
+                    status: 404,
+                    code: "WATCHED_CASE_NOT_FOUND",
+                    message: "Watched case not found"
+                });
+            }
+
+            throw error;
+        }
+
+        const watchlist = watchlistResponse?.data;
+        const watchlistContactID = watchlist?._pinswg_contact_value;
+        const watchlistRecordID = watchlist?.pinswg_watchlistid;
+
+        if (
+            typeof watchlistRecordID !== "string" ||
+            !GUID_PATTERN.test(watchlistRecordID.trim()) ||
+            normaliseGuid(watchlistRecordID) !== normalisedWatchedCaseID ||
+            typeof watchlistContactID !== "string" ||
+            !GUID_PATTERN.test(watchlistContactID.trim()) ||
+            normaliseGuid(watchlistContactID) !==
+                normaliseGuid(contacts[0].contactid)
+        ) {
+            return respondError(res, {
+                status: 404,
+                code: "WATCHED_CASE_NOT_FOUND",
+                message: "Watched case not found"
+            });
+        }
+
+        const queryUrl =
+            "pinswg_watchlists(" + normalisedWatchedCaseID + ")";
 
         const config = {
             method: "delete",
@@ -56,7 +167,7 @@ export default async function ApiProxy(req, res) {
     } catch (error) {
         consoleLogger(error);
         return respondError(res, {
-            status: 400,
+            status: 500,
             code: "WATCHED_CASE_DELETE_FAILED",
             message: "Failed to delete watched case"
         });
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 90a48c71..575556a4 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -2977,48 +2977,286 @@ test("createwatchedcases catch path returns WATCHED_CASE_UPSERT_FAILED", async (
     );
 });
 
-test("deletewatchedcases returns WATCHED_CASE_ID_REQUIRED when watchedCaseID missing", async () => {
+const WATCHED_CASE_ID = "11111111-1111-1111-1111-111111111111";
+const CONTACT_ID = "22222222-2222-2222-2222-222222222222";
+const OTHER_CONTACT_ID = "33333333-3333-3333-3333-333333333333";
+
+const createDeleteWatchedCasesFixture = (overrides = {}) => {
+    const calls = {
+        session: [],
+        token: 0,
+        relay: [],
+        delete: []
+    };
+    const session = Object.prototype.hasOwnProperty.call(overrides, "session")
+        ? overrides.session
+        : { user: { email: "user.o'neill@test.local" } };
+    const contacts = Object.prototype.hasOwnProperty.call(overrides, "contacts")
+        ? overrides.contacts
+        : [{ contactid: CONTACT_ID }];
+    const watchlist = Object.prototype.hasOwnProperty.call(
+        overrides,
+        "watchlist"
+    )
+        ? overrides.watchlist
+        : {
+              pinswg_watchlistid: WATCHED_CASE_ID,
+              _pinswg_contact_value: CONTACT_ID
+          };
+
     const mod = loadModule("pages/api/endpoint/deletewatchedcases_api.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return session;
+        },
+        authOptions: (req, res) => ({ req, res }),
+        getToken: async () => {
+            calls.token += 1;
+            return { access_token: "token" };
+        },
+        relayGetData: async (options) => {
+            calls.relay.push(options);
+
+            if (options.queryUrl.startsWith("contacts?")) {
+                if (overrides.contactLookupError) {
+                    throw overrides.contactLookupError;
+                }
+                return { data: { value: contacts } };
+            }
+
+            if (overrides.watchlistLookupError) {
+                throw overrides.watchlistLookupError;
+            }
+            return { data: watchlist };
+        },
+        escapeODataString: (value) => value.trim().replace(/'/g, "''"),
+        azureHeaders: (accessToken) => ({
+            headers: { Authorization: `Bearer ${accessToken}` }
+        }),
         hashAPIPath: () => "&hash=expected",
-        axios: async () => ({ data: {} }),
-        consoleLogger: () => {}
-    });
-
-    const req = { query: {} };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(
-        res.state.jsonBody.error.code,
-        "WATCHED_CASE_ID_REQUIRED"
-    );
-});
-
-test("deletewatchedcases catch path returns WATCHED_CASE_DELETE_FAILED", async () => {
-    const mod = loadModule("pages/api/endpoint/deletewatchedcases_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => {
-            throw new Error("delete failed");
+        axios: async (config) => {
+            calls.delete.push(config);
+            if (overrides.deleteError) throw overrides.deleteError;
+            return { data: { removed: true } };
         },
         consoleLogger: () => {}
     });
 
-    const req = { query: { watchedCaseID: "w1" } };
+    return { mod, calls };
+};
+
+const invokeDeleteWatchedCase = async (fixture, request = {}) => {
+    const req = {
+        method: "DELETE",
+        query: { watchedCaseID: WATCHED_CASE_ID },
+        ...request
+    };
     const res = createRes();
-    await mod.default(req, res);
+    await fixture.mod.default(req, res);
+    return { req, res };
+};
+
+test("deletewatchedcases rejects missing watchedCaseID without CRM access", async () => {
+    const fixture = createDeleteWatchedCasesFixture();
+    const { res } = await invokeDeleteWatchedCase(fixture, { query: {} });
 
     assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "INVALID_WATCHED_CASE_ID"
+    );
+    assert.strictEqual(fixture.calls.session.length, 0);
+    assert.strictEqual(fixture.calls.token, 0);
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases rejects malformed and array watchedCaseID values", async () => {
+    for (const watchedCaseID of [
+        "not-a-guid",
+        ` ${WATCHED_CASE_ID} `,
+        [WATCHED_CASE_ID]
+    ]) {
+        const fixture = createDeleteWatchedCasesFixture();
+        const { res } = await invokeDeleteWatchedCase(fixture, {
+            query: { watchedCaseID }
+        });
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(
+            res.state.jsonBody.error.code,
+            "INVALID_WATCHED_CASE_ID"
+        );
+        assert.strictEqual(fixture.calls.token, 0);
+        assert.strictEqual(fixture.calls.delete.length, 0);
+    }
+});
+
+test("deletewatchedcases rejects non-DELETE methods without CRM access", async () => {
+    const fixture = createDeleteWatchedCasesFixture();
+    const { res } = await invokeDeleteWatchedCase(fixture, { method: "GET" });
+
+    assert.strictEqual(res.state.statusCode, 405);
+    assert.strictEqual(res.state.jsonBody.error.code, "METHOD_NOT_ALLOWED");
+    assert.strictEqual(fixture.calls.session.length, 0);
+    assert.strictEqual(fixture.calls.token, 0);
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases rejects missing session without CRM access", async () => {
+    const fixture = createDeleteWatchedCasesFixture({ session: null });
+    const { req, res } = await invokeDeleteWatchedCase(fixture);
+
+    assert.strictEqual(res.state.statusCode, 401);
+    assert.strictEqual(res.state.jsonBody.error.code, "UNAUTHENTICATED");
+    assert.strictEqual(fixture.calls.session[0][0], req);
+    assert.strictEqual(fixture.calls.session[0][1], res);
+    assert.strictEqual(fixture.calls.token, 0);
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases rejects session without email", async () => {
+    const fixture = createDeleteWatchedCasesFixture({
+        session: { user: { id: "application-user" } }
+    });
+    const { res } = await invokeDeleteWatchedCase(fixture);
+
+    assert.strictEqual(res.state.statusCode, 401);
+    assert.strictEqual(res.state.jsonBody.error.code, "UNAUTHENTICATED");
+    assert.strictEqual(fixture.calls.token, 0);
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases denies zero active CRM contacts", async () => {
+    const fixture = createDeleteWatchedCasesFixture({ contacts: [] });
+    const { res } = await invokeDeleteWatchedCase(fixture);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "CONTACT_IDENTITY_NOT_RESOLVED"
+    );
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases denies multiple active CRM contacts", async () => {
+    const fixture = createDeleteWatchedCasesFixture({
+        contacts: [{ contactid: CONTACT_ID }, { contactid: OTHER_CONTACT_ID }]
+    });
+    const { res } = await invokeDeleteWatchedCase(fixture);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "CONTACT_IDENTITY_NOT_RESOLVED"
+    );
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases fails closed when CRM contact lookup fails", async () => {
+    const fixture = createDeleteWatchedCasesFixture({
+        contactLookupError: new Error("CRM unavailable")
+    });
+    const { res } = await invokeDeleteWatchedCase(fixture);
+
+    assert.strictEqual(res.state.statusCode, 500);
     assert.strictEqual(
         res.state.jsonBody.error.code,
         "WATCHED_CASE_DELETE_FAILED"
     );
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases returns 404 for unknown watchlist", async () => {
+    const lookupError = new Error("not found");
+    lookupError.response = { status: 404 };
+    const fixture = createDeleteWatchedCasesFixture({
+        watchlistLookupError: lookupError
+    });
+    const { res } = await invokeDeleteWatchedCase(fixture);
+
+    assert.strictEqual(res.state.statusCode, 404);
+    assert.strictEqual(res.state.jsonBody.error.code, "WATCHED_CASE_NOT_FOUND");
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases returns 404 for non-owned watchlist", async () => {
+    const fixture = createDeleteWatchedCasesFixture({
+        watchlist: {
+            pinswg_watchlistid: WATCHED_CASE_ID,
+            _pinswg_contact_value: OTHER_CONTACT_ID
+        }
+    });
+    const { res } = await invokeDeleteWatchedCase(fixture);
+
+    assert.strictEqual(res.state.statusCode, 404);
+    assert.strictEqual(res.state.jsonBody.error.code, "WATCHED_CASE_NOT_FOUND");
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases deletes exactly once for the authenticated CRM contact", async () => {
+    const fixture = createDeleteWatchedCasesFixture();
+    const { req, res } = await invokeDeleteWatchedCase(fixture);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        removed: true
+    });
+    assert.strictEqual(fixture.calls.relay.length, 2);
+    assert.strictEqual(
+        fixture.calls.relay[0].queryUrl,
+        "contacts?$filter=emailaddress1 eq 'user.o''neill@test.local' and statuscode eq 1&$select=contactid"
+    );
+    assert.strictEqual(
+        fixture.calls.relay[1].queryUrl,
+        `pinswg_watchlists(${WATCHED_CASE_ID})?$select=pinswg_watchlistid,_pinswg_contact_value`
+    );
+    assert.strictEqual(fixture.calls.delete.length, 1);
+    assert.strictEqual(fixture.calls.delete[0].method, "delete");
+    assert.match(
+        fixture.calls.delete[0].url,
+        new RegExp(`pinswg_watchlists\\(${WATCHED_CASE_ID}\\)&hash=expected$`)
+    );
+    assert.strictEqual(fixture.calls.session[0][0], req);
+});
+
+test("deletewatchedcases ignores client-supplied contact and email identity", async () => {
+    const fixture = createDeleteWatchedCasesFixture({
+        watchlist: {
+            pinswg_watchlistid: WATCHED_CASE_ID,
+            _pinswg_contact_value: OTHER_CONTACT_ID
+        }
+    });
+    const { res } = await invokeDeleteWatchedCase(fixture, {
+        query: {
+            watchedCaseID: WATCHED_CASE_ID,
+            contactid: OTHER_CONTACT_ID,
+            email: "other@test.local"
+        },
+        body: { contactid: OTHER_CONTACT_ID, email: "other@test.local" }
+    });
+
+    assert.strictEqual(res.state.statusCode, 404);
+    assert.match(fixture.calls.relay[0].queryUrl, /user\.o''neill@test\.local/);
+    assert.doesNotMatch(fixture.calls.relay[0].queryUrl, /other@test\.local/);
+    assert.strictEqual(fixture.calls.delete.length, 0);
+});
+
+test("deletewatchedcases does not let a valid HMAC override ownership", async () => {
+    const fixture = createDeleteWatchedCasesFixture({
+        watchlist: {
+            pinswg_watchlistid: WATCHED_CASE_ID,
+            _pinswg_contact_value: OTHER_CONTACT_ID
+        }
+    });
+    const { res } = await invokeDeleteWatchedCase(fixture, {
+        query: { watchedCaseID: WATCHED_CASE_ID, hash: "valid-signature" }
+    });
+
+    assert.strictEqual(res.state.statusCode, 404);
+    assert.strictEqual(res.state.jsonBody.error.code, "WATCHED_CASE_NOT_FOUND");
+    assert.strictEqual(fixture.calls.delete.length, 0);
 });
 
 test("deletewatchedcasesproxy returns WATCHED_CASE_ID_REQUIRED when watchedCaseID missing", async () => {

From 706083b6f0beced4fd3db0e17c6c6f94c8f16828 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Thu, 5 Nov 2026 10:25:08 +0000
Subject: [PATCH 03/24] test: update endpoint contract fixtures and add test
 filtering

---
 .../endpoint-handler-contract.test.cjs        | 36 +++++++++++++++----
 1 file changed, 29 insertions(+), 7 deletions(-)

diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 575556a4..671f6470 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -1215,7 +1215,7 @@ test("getadvancedsearchpaged returns SEARCH_STRING_REQUIRED when searchstring mi
         respondSuccess: respondSuccessMock,
         relayGet: async () => ({}),
         azureHeadersPagedCustom: () => ({}),
-        _: { has: () => false }
+        hasOwn: (obj, key) => Object.prototype.hasOwnProperty.call(obj, key)
     });
 
     const req = {
@@ -1238,7 +1238,7 @@ test("getadvancedsearchpaged returns ORDER_BY_REQUIRED when orderby missing", as
         respondSuccess: respondSuccessMock,
         relayGet: async () => ({}),
         azureHeadersPagedCustom: () => ({}),
-        _: { has: () => false }
+        hasOwn: (obj, key) => Object.prototype.hasOwnProperty.call(obj, key)
     });
 
     const req = {
@@ -1262,7 +1262,7 @@ test("getadvancedsearchpaged catch path returns ADVANCED_SEARCH_PAGED_FETCH_FAIL
         relayGet: async ({ res, errorResponse }) =>
             respondErrorMock(res, errorResponse),
         azureHeadersPagedCustom: () => ({}),
-        _: { has: () => false }
+        hasOwn: (obj, key) => Object.prototype.hasOwnProperty.call(obj, key)
     });
 
     const req = {
@@ -4416,10 +4416,20 @@ test("getToken catch path returns TOKEN_FETCH_FAILED", async () => {
 
 test("getsipsmedia returns success contract", async () => {
     const mod = loadModule("pages/api/endpoint/getsipsmedia_api.js", {
-        respondSuccess: respondSuccessMock
+        respondError: respondErrorMock,
+        relayGet: async ({ res }) =>
+            respondSuccessMock(res, {
+                "@odata.count": 4,
+                value: []
+            })
     });
 
-    const req = { query: {} };
+    const req = {
+        method: "GET",
+        query: {
+            caseid: "11111111-1111-4111-8111-111111111111"
+        }
+    };
     const res = createRes();
     await mod.default(req, res);
 
@@ -4459,13 +4469,25 @@ test("getappealtypesfornewappeal returns METHOD_NOT_ALLOWED for non-GET methods"
 });
 
 const run = async () => {
+    const filter = process.env.PEDW_TEST_FILTER;
+
+    const selectedTests = filter
+        ? tests.filter((currentTest) => currentTest.name.includes(filter))
+        : tests;
+
+    if (selectedTests.length === 0) {
+        throw new Error(`No tests match filter: ${filter}`);
+    }
+
     let passed = 0;
-    for (const currentTest of tests) {
+
+    for (const currentTest of selectedTests) {
         await currentTest.fn();
         passed += 1;
     }
+
     console.log(
-        `Phase 21 endpoint-handler contract tests passed (${passed}/${tests.length}).`
+        `Phase 21 endpoint-handler contract tests passed (${passed}/${selectedTests.length}).`
     );
 };
 

From 0a115a8808590bbbe78fb903803190485b1eba79 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Thu, 5 Nov 2026 12:48:45 +0000
Subject: [PATCH 04/24] security: preserve representation history in
 watched-case upsert

---
 pages/api/endpoint/createwatchedcases_api.js  | 197 +++++-
 .../endpoint-handler-contract.test.cjs        | 589 +++++++++++++++++-
 2 files changed, 749 insertions(+), 37 deletions(-)

diff --git a/pages/api/endpoint/createwatchedcases_api.js b/pages/api/endpoint/createwatchedcases_api.js
index 0c67b6a2..aad9fff9 100644
--- a/pages/api/endpoint/createwatchedcases_api.js
+++ b/pages/api/endpoint/createwatchedcases_api.js
@@ -16,38 +16,73 @@ import { getToken } from "../../../actions/core/token";
 import { hashAPIPath } from "../../../actions/core/hash";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
 import { relayGetData } from "../middleware/relayForwarding";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
+import { azureHeaders } from "../../../actions/core/headers";
+import { escapeODataString } from "../../../actions/core/guards";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
+const GUID_PATTERN =
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 const recordExists = async (incidentId, contactId, accessToken) => {
     const filter = `$filter=pinswg_WatchedCase/incidentid eq ${incidentId} and pinswg_Contact/contactid eq ${contactId}`;
-    const queryUrl = `pinswg_watchlists?${filter}`;
+    const queryUrl =
+        `pinswg_watchlists?${filter}` +
+        "&$select=pinswg_watchlistid,_pinswg_contact_value,_pinswg_watchedcase_value,pinswg_representationsubmitted";
 
-    try {
-        const response = await relayGetData({
-            queryUrl,
-            accessToken,
-            requestOptionsBuilder: (token) => ({
-                headers: {
-                    Authorization: "Bearer " + token,
-                    Accept: "application/json"
-                }
-            })
-        });
+    const response = await relayGetData({
+        queryUrl,
+        accessToken,
+        requestOptionsBuilder: (token) => ({
+            headers: {
+                Authorization: "Bearer " + token,
+                Accept: "application/json"
+            }
+        })
+    });
 
-        if (response.data.value && response.data.value.length > 0) {
-            return response.data.value[0]; // return the existing record
-        }
+    const records = response?.data?.value;
 
-        return null;
-    } catch (err) {
-        throw err;
+    if (!Array.isArray(records)) {
+        return {
+            status: "invalid",
+            records: []
+        };
     }
+
+    return {
+        status: "found",
+        records
+    };
 };
 
 export default async function ApiProxy(req, res) {
+    if (req.method !== "POST") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Only POST is supported"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    const authenticatedEmail = session?.user?.email;
+
+    if (
+        typeof authenticatedEmail !== "string" ||
+        authenticatedEmail.trim().length === 0
+    ) {
+        return respondError(res, {
+            status: 401,
+            code: "UNAUTHENTICATED",
+            message: "Authentication required"
+        });
+    }
+
     const data = req.body;
     const watchedCaseBind = data?.["pinswg_WatchedCase@odata.bind"];
     const contactBind = data?.["pinswg_Contact@odata.bind"];
@@ -66,8 +101,13 @@ export default async function ApiProxy(req, res) {
         });
     }
 
-    const watchedCaseMatch = watchedCaseBind.match(/\(([^)]+)\)/);
-    const contactMatch = contactBind.match(/\(([^)]+)\)/);
+    const watchedCaseMatch = watchedCaseBind.match(
+        /^\/incidents\(([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\)$/i
+    );
+
+    const contactMatch = contactBind.match(
+        /^\/contacts\(([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\)$/i
+    );
 
     if (!watchedCaseMatch || !contactMatch) {
         return respondError(res, {
@@ -79,26 +119,118 @@ export default async function ApiProxy(req, res) {
 
     try {
         const token = await getToken();
-
         const incidentId = watchedCaseMatch[1];
         const contactId = contactMatch[1];
 
-        const existingRecord = await recordExists(
+        const escapedEmail = escapeODataString(authenticatedEmail);
+
+        const contactQueryUrl =
+            "contacts?$filter=emailaddress1 eq '" +
+            escapedEmail +
+            "' and statuscode eq 1&$select=contactid";
+
+        const contactResponse = await relayGetData({
+            queryUrl: contactQueryUrl,
+            accessToken: token.access_token,
+            requestOptionsBuilder: (accessToken) => azureHeaders(accessToken)
+        });
+
+        const contacts = contactResponse?.data?.value;
+
+        if (
+            !Array.isArray(contacts) ||
+            contacts.length !== 1 ||
+            typeof contacts[0]?.contactid !== "string" ||
+            !GUID_PATTERN.test(contacts[0].contactid.trim())
+        ) {
+            return respondError(res, {
+                status: 403,
+                code: "CONTACT_IDENTITY_NOT_RESOLVED",
+                message: "Request not permitted"
+            });
+        }
+
+        if (
+            contactId.trim().toLowerCase() !==
+            contacts[0].contactid.trim().toLowerCase()
+        ) {
+            return respondError(res, {
+                status: 403,
+                code: "CONTACT_OWNERSHIP_MISMATCH",
+                message: "Request not permitted"
+            });
+        }
+
+        const lookup = await recordExists(
             incidentId,
             contactId,
             token.access_token
         );
 
-        let method, queryUrl;
-
-        if (existingRecord) {
-            method = "patch";
-            queryUrl = `pinswg_watchlists(${existingRecord.pinswg_watchlistid})`;
-        } else {
-            method = "post";
-            queryUrl = "pinswg_watchlists";
+        if (lookup.status === "invalid") {
+            return respondError(res, {
+                status: 500,
+                code: "WATCHLIST_LOOKUP_FAILED",
+                message: "Unable to verify existing watched-case records"
+            });
         }
 
+        const records = lookup.records;
+
+        const isRepresentationSubmission =
+            data?.pinswg_representationsubmitted != null;
+
+        // Validate every returned record before considering it for an update.
+        const validRecords = records.every((record) => {
+            const recordID = record?.pinswg_watchlistid;
+            const recordContactID = record?._pinswg_contact_value;
+            const recordCaseID = record?._pinswg_watchedcase_value;
+
+            return (
+                typeof recordID === "string" &&
+                GUID_PATTERN.test(recordID) &&
+                typeof recordContactID === "string" &&
+                GUID_PATTERN.test(recordContactID) &&
+                typeof recordCaseID === "string" &&
+                GUID_PATTERN.test(recordCaseID) &&
+                recordContactID.toLowerCase() === contactId.toLowerCase() &&
+                recordCaseID.toLowerCase() === incidentId.toLowerCase()
+            );
+        });
+
+        if (!validRecords) {
+            return respondError(res, {
+                status: 403,
+                code: "WATCHLIST_OWNERSHIP_MISMATCH",
+                message: "Request not permitted"
+            });
+        }
+
+        const watchingOnlyRecords = records.filter(
+            (record) => record.pinswg_representationsubmitted == null
+        );
+
+        let existingRecord;
+
+        if (isRepresentationSubmission) {
+            // Reuse a watching-only record for the first representation.
+            // Never overwrite an earlier representation submission.
+            existingRecord =
+                watchingOnlyRecords.length === 1
+                    ? watchingOnlyRecords[0]
+                    : null;
+        } else {
+            // Watching or subscribing: prefer a watching-only record.
+            // Otherwise reuse an existing representation-associated record.
+            existingRecord = watchingOnlyRecords[0] ?? records[0] ?? null;
+        }
+
+        const method = existingRecord ? "patch" : "post";
+
+        const queryUrl = existingRecord
+            ? `pinswg_watchlists(${existingRecord.pinswg_watchlistid})`
+            : "pinswg_watchlists";
+
         const config = {
             method: method,
             url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
@@ -110,7 +242,10 @@ export default async function ApiProxy(req, res) {
                 Authorization: "Bearer " + token.access_token,
                 "Content-Type": "application/json"
             },
-            data: JSON.stringify(data)
+            data: JSON.stringify({
+                ...data,
+                "pinswg_Contact@odata.bind": `/contacts(${contacts[0].contactid.trim()})`
+            })
         };
 
         const result = await axios(config);
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 671f6470..77eed608 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -2912,10 +2912,16 @@ test("createwatchedcases returns WATCHED_CASE_BINDINGS_REQUIRED when bindings mi
         getToken: async () => ({ access_token: "token" }),
         hashAPIPath: () => "&hash=expected",
         axios: async () => ({ data: {} }),
-        consoleLogger: () => {}
+        consoleLogger: () => {},
+        getServerSession: async () => ({
+            user: {
+                email: "test@example.com"
+            }
+        }),
+        authOptions: () => ({})
     });
 
-    const req = { body: {} };
+    const req = { method: "POST", body: {} };
     const res = createRes();
     await mod.default(req, res);
 
@@ -2933,10 +2939,17 @@ test("createwatchedcases returns INVALID_BINDING_FORMAT when bindings invalid",
         getToken: async () => ({ access_token: "token" }),
         hashAPIPath: () => "&hash=expected",
         axios: async () => ({ data: {} }),
-        consoleLogger: () => {}
+        consoleLogger: () => {},
+        getServerSession: async () => ({
+            user: {
+                email: "test@example.com"
+            }
+        }),
+        authOptions: () => ({})
     });
 
     const req = {
+        method: "POST",
         body: {
             "pinswg_WatchedCase@odata.bind": "/incidents",
             "pinswg_Contact@odata.bind": "/contacts"
@@ -2958,13 +2971,22 @@ test("createwatchedcases catch path returns WATCHED_CASE_UPSERT_FAILED", async (
         },
         hashAPIPath: () => "&hash=expected",
         axios: async () => ({ data: {} }),
-        consoleLogger: () => {}
+        consoleLogger: () => {},
+        getServerSession: async () => ({
+            user: {
+                email: "test@example.com"
+            }
+        }),
+        authOptions: () => ({})
     });
 
     const req = {
+        method: "POST",
         body: {
-            "pinswg_WatchedCase@odata.bind": "/incidents(incident-id)",
-            "pinswg_Contact@odata.bind": "/contacts(contact-id)"
+            "pinswg_WatchedCase@odata.bind":
+                "/incidents(11111111-1111-1111-1111-111111111111)",
+            "pinswg_Contact@odata.bind":
+                "/contacts(22222222-2222-2222-2222-222222222222)"
         }
     };
     const res = createRes();
@@ -2977,6 +2999,561 @@ test("createwatchedcases catch path returns WATCHED_CASE_UPSERT_FAILED", async (
     );
 });
 
+test("createwatchedcases rejects unauthenticated requests before CRM access", async () => {
+    let tokenCalls = 0;
+    let relayCalls = 0;
+    let writeCalls = 0;
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getServerSession: async () => null,
+        authOptions: () => ({}),
+        getToken: async () => {
+            tokenCalls += 1;
+            return { access_token: "token" };
+        },
+        relayGetData: async () => {
+            relayCalls += 1;
+            return { data: { value: [] } };
+        },
+        hashAPIPath: () => "&hash=expected",
+        axios: async () => {
+            writeCalls += 1;
+            return { data: {} };
+        },
+        consoleLogger: () => {},
+        authOptions: () => ({})
+    });
+
+    const req = {
+        method: "POST",
+        body: {
+            "pinswg_WatchedCase@odata.bind":
+                "/incidents(11111111-1111-1111-1111-111111111111)",
+            "pinswg_Contact@odata.bind":
+                "/contacts(22222222-2222-2222-2222-222222222222)"
+        }
+    };
+
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 401);
+    assert.strictEqual(res.state.jsonBody.error.code, "UNAUTHENTICATED");
+    assert.strictEqual(tokenCalls, 0);
+    assert.strictEqual(relayCalls, 0);
+    assert.strictEqual(writeCalls, 0);
+});
+
+test("createwatchedcases rejects another contact before CRM write", async () => {
+    let writeCalls = 0;
+
+    const ownContactID = "22222222-2222-2222-2222-222222222222";
+    const otherContactID = "33333333-3333-3333-3333-333333333333";
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getServerSession: async () => ({
+            user: { email: "test@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({
+            headers: { Authorization: "Bearer token" }
+        }),
+        escapeODataString: (value) => value.replace(/'/g, "''"),
+        relayGetData: async ({ queryUrl }) => {
+            if (queryUrl.startsWith("contacts?")) {
+                return {
+                    data: {
+                        value: [{ contactid: ownContactID }]
+                    }
+                };
+            }
+
+            return { data: { value: [] } };
+        },
+        hashAPIPath: () => "&hash=expected",
+        axios: async () => {
+            writeCalls += 1;
+            return { data: {} };
+        },
+        consoleLogger: () => {}
+    });
+
+    const req = {
+        method: "POST",
+        body: {
+            "pinswg_WatchedCase@odata.bind":
+                "/incidents(11111111-1111-1111-1111-111111111111)",
+            "pinswg_Contact@odata.bind": `/contacts(${otherContactID})`
+        }
+    };
+
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "CONTACT_OWNERSHIP_MISMATCH"
+    );
+    assert.strictEqual(writeCalls, 0);
+});
+
+test("createwatchedcases rejects malformed GUID bindings before CRM access", async () => {
+    let tokenCalls = 0;
+    let relayCalls = 0;
+    let writeCalls = 0;
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getServerSession: async () => ({
+            user: { email: "test@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => {
+            tokenCalls += 1;
+            return { access_token: "token" };
+        },
+        relayGetData: async () => {
+            relayCalls += 1;
+            return { data: { value: [] } };
+        },
+        hashAPIPath: () => "&hash=expected",
+        axios: async () => {
+            writeCalls += 1;
+            return { data: {} };
+        },
+        consoleLogger: () => {}
+    });
+
+    const req = {
+        method: "POST",
+        body: {
+            "pinswg_WatchedCase@odata.bind": "/incidents(not-a-valid-guid)",
+            "pinswg_Contact@odata.bind":
+                "/contacts(22222222-2222-2222-2222-222222222222)"
+        }
+    };
+
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_BINDING_FORMAT");
+    assert.strictEqual(tokenCalls, 0);
+    assert.strictEqual(relayCalls, 0);
+    assert.strictEqual(writeCalls, 0);
+});
+
+test("createwatchedcases rejects existing watchlist with mismatched ownership", async () => {
+    let writeCalls = 0;
+
+    const ownContactID = "22222222-2222-2222-2222-222222222222";
+    const otherContactID = "33333333-3333-3333-3333-333333333333";
+    const caseID = "11111111-1111-1111-1111-111111111111";
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getServerSession: async () => ({
+            user: { email: "test@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({
+            headers: { Authorization: "Bearer token" }
+        }),
+        escapeODataString: (value) => value.replace(/'/g, "''"),
+        relayGetData: async ({ queryUrl }) => {
+            if (queryUrl.startsWith("contacts?")) {
+                return {
+                    data: { value: [{ contactid: ownContactID }] }
+                };
+            }
+
+            if (queryUrl.startsWith("pinswg_watchlists?")) {
+                return {
+                    data: {
+                        value: [
+                            {
+                                pinswg_watchlistid:
+                                    "44444444-4444-4444-4444-444444444444",
+                                _pinswg_contact_value: otherContactID,
+                                _pinswg_watchedcase_value: caseID
+                            }
+                        ]
+                    }
+                };
+            }
+
+            throw new Error("Unexpected CRM query");
+        },
+        hashAPIPath: () => "&hash=expected",
+        axios: async () => {
+            writeCalls += 1;
+            return { data: {} };
+        },
+        consoleLogger: () => {}
+    });
+
+    const req = {
+        method: "POST",
+        body: {
+            "pinswg_WatchedCase@odata.bind": `/incidents(${caseID})`,
+            "pinswg_Contact@odata.bind": `/contacts(${ownContactID})`
+        }
+    };
+
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "WATCHLIST_OWNERSHIP_MISMATCH"
+    );
+    assert.strictEqual(writeCalls, 0);
+});
+
+test("createwatchedcases allows multiple existing watchlists for the same contact and case", async () => {
+    const writes = [];
+
+    const contactID = "22222222-2222-2222-2222-222222222222";
+    const caseID = "11111111-1111-1111-1111-111111111111";
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getServerSession: async () => ({
+            user: { email: "test@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({
+            headers: { Authorization: "Bearer token" }
+        }),
+        escapeODataString: (value) => value.replace(/'/g, "''"),
+        relayGetData: async ({ queryUrl }) => {
+            if (queryUrl.startsWith("contacts?")) {
+                return {
+                    data: { value: [{ contactid: contactID }] }
+                };
+            }
+
+            if (queryUrl.startsWith("pinswg_watchlists?")) {
+                return {
+                    data: {
+                        value: [
+                            {
+                                pinswg_watchlistid:
+                                    "44444444-4444-4444-4444-444444444444",
+                                _pinswg_contact_value: contactID,
+                                _pinswg_watchedcase_value: caseID
+                            },
+                            {
+                                pinswg_watchlistid:
+                                    "55555555-5555-5555-5555-555555555555",
+                                _pinswg_contact_value: contactID,
+                                _pinswg_watchedcase_value: caseID
+                            }
+                        ]
+                    }
+                };
+            }
+
+            throw new Error("Unexpected CRM query");
+        },
+        hashAPIPath: () => "&hash=expected",
+        axios: async (config) => {
+            writes.push(config);
+            return { data: {} };
+        },
+        consoleLogger: () => {}
+    });
+
+    const req = {
+        method: "POST",
+        body: {
+            "pinswg_WatchedCase@odata.bind": `/incidents(${caseID})`,
+            "pinswg_Contact@odata.bind": `/contacts(${contactID})`
+        }
+    };
+
+    const res = createRes();
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(writes.length, 1);
+    assert.strictEqual(writes[0].method, "patch");
+
+    assert.ok(
+        writes[0].url.includes(
+            "pinswg_watchlists(44444444-4444-4444-4444-444444444444)"
+        )
+    );
+});
+
+test("createwatchedcases creates a watched case for the authenticated contact", async () => {
+    const contactID = "22222222-2222-2222-2222-222222222222";
+    const caseID = "11111111-1111-1111-1111-111111111111";
+    const writes = [];
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getServerSession: async () => ({
+            user: { email: "test@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({
+            headers: { Authorization: "Bearer token" }
+        }),
+        escapeODataString: (value) => value.replace(/'/g, "''"),
+        relayGetData: async ({ queryUrl }) => {
+            if (queryUrl.startsWith("contacts?")) {
+                return {
+                    data: { value: [{ contactid: contactID }] }
+                };
+            }
+
+            if (queryUrl.startsWith("pinswg_watchlists?")) {
+                return { data: { value: [] } };
+            }
+
+            throw new Error("Unexpected CRM query");
+        },
+        hashAPIPath: () => "&hash=expected",
+        axios: async (config) => {
+            writes.push(config);
+            return { data: { created: true } };
+        },
+        consoleLogger: () => {}
+    });
+
+    const body = {
+        "pinswg_WatchedCase@odata.bind": `/incidents(${caseID})`,
+        "pinswg_Contact@odata.bind": `/contacts(${contactID})`,
+        pinswg_emailnotifications: true
+    };
+
+    const res = createRes();
+
+    await mod.default(
+        {
+            method: "POST",
+            body
+        },
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(writes.length, 1);
+    assert.strictEqual(writes[0].method, "post");
+    assert.ok(writes[0].url.includes("pinswg_watchlists"));
+
+    const writtenData = JSON.parse(writes[0].data);
+
+    assert.strictEqual(
+        writtenData["pinswg_Contact@odata.bind"],
+        `/contacts(${contactID})`
+    );
+    assert.strictEqual(
+        writtenData["pinswg_WatchedCase@odata.bind"],
+        `/incidents(${caseID})`
+    );
+    assert.strictEqual(writtenData.pinswg_emailnotifications, true);
+});
+
+test("createwatchedcases updates a verified watchlist preserving representation fields", async () => {
+    const contactID = "22222222-2222-2222-2222-222222222222";
+    const caseID = "11111111-1111-1111-1111-111111111111";
+    const watchlistID = "44444444-4444-4444-4444-444444444444";
+    const writes = [];
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getServerSession: async () => ({
+            user: { email: "test@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({
+            headers: { Authorization: "Bearer token" }
+        }),
+        escapeODataString: (value) => value.replace(/'/g, "''"),
+        relayGetData: async ({ queryUrl }) => {
+            if (queryUrl.startsWith("contacts?")) {
+                return {
+                    data: { value: [{ contactid: contactID }] }
+                };
+            }
+
+            if (queryUrl.startsWith("pinswg_watchlists?")) {
+                return {
+                    data: {
+                        value: [
+                            {
+                                pinswg_watchlistid: watchlistID,
+                                _pinswg_contact_value: contactID,
+                                _pinswg_watchedcase_value: caseID
+                            }
+                        ]
+                    }
+                };
+            }
+
+            throw new Error("Unexpected CRM query");
+        },
+        hashAPIPath: () => "&hash=expected",
+        axios: async (config) => {
+            writes.push(config);
+            return { data: { updated: true } };
+        },
+        consoleLogger: () => {}
+    });
+
+    const body = {
+        "pinswg_WatchedCase@odata.bind": `/incidents(${caseID})`,
+        "pinswg_Contact@odata.bind": `/contacts(${contactID})`,
+        pinswg_emailnotifications: true,
+        pinswg_representationsubmitted: true,
+        pinswg_representationtype: 1
+    };
+
+    const res = createRes();
+
+    await mod.default({ method: "POST", body }, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(writes.length, 1);
+    assert.strictEqual(writes[0].method, "patch");
+    assert.ok(writes[0].url.includes(`pinswg_watchlists(${watchlistID})`));
+
+    const writtenData = JSON.parse(writes[0].data);
+
+    assert.strictEqual(writtenData.pinswg_emailnotifications, true);
+    assert.strictEqual(writtenData.pinswg_representationsubmitted, true);
+    assert.strictEqual(writtenData.pinswg_representationtype, 1);
+    assert.strictEqual(
+        writtenData["pinswg_Contact@odata.bind"],
+        `/contacts(${contactID})`
+    );
+});
+
+test("createwatchedcases preserves previous representations when submitting another", async () => {
+    const contactID = "22222222-2222-2222-2222-222222222222";
+    const caseID = "11111111-1111-1111-1111-111111111111";
+    const writes = [];
+
+    const existingRecords = [
+        {
+            pinswg_watchlistid: "44444444-4444-4444-4444-444444444444",
+            _pinswg_contact_value: contactID,
+            _pinswg_watchedcase_value: caseID,
+            pinswg_representationsubmitted: "2025-01-07T10:00:00Z",
+            pinswg_representationtype: 1
+        },
+        {
+            pinswg_watchlistid: "55555555-5555-5555-5555-555555555555",
+            _pinswg_contact_value: contactID,
+            _pinswg_watchedcase_value: caseID,
+            pinswg_representationsubmitted: "2025-01-09T14:00:00Z",
+            pinswg_representationtype: 2
+        }
+    ];
+
+    const mod = loadModule("pages/api/endpoint/createwatchedcases_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        getServerSession: async () => ({
+            user: { email: "test@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({ access_token: "token" }),
+        azureHeaders: () => ({
+            headers: { Authorization: "Bearer token" }
+        }),
+        escapeODataString: (value) => value.replace(/'/g, "''"),
+        relayGetData: async ({ queryUrl }) => {
+            if (queryUrl.startsWith("contacts?")) {
+                return {
+                    data: { value: [{ contactid: contactID }] }
+                };
+            }
+
+            if (queryUrl.startsWith("pinswg_watchlists?")) {
+                assert.ok(queryUrl.includes("pinswg_representationsubmitted"));
+
+                return {
+                    data: { value: existingRecords }
+                };
+            }
+
+            throw new Error("Unexpected CRM query");
+        },
+        hashAPIPath: () => "&hash=expected",
+        axios: async (config) => {
+            writes.push(config);
+            return { data: { created: true } };
+        },
+        consoleLogger: () => {}
+    });
+
+    const submissionDate = "2025-01-14T09:30:00Z";
+
+    const body = {
+        "pinswg_WatchedCase@odata.bind": `/incidents(${caseID})`,
+        "pinswg_Contact@odata.bind": `/contacts(${contactID})`,
+        pinswg_representationsubmitted: submissionDate,
+        pinswg_representationtype: 3
+    };
+
+    const res = createRes();
+
+    await mod.default({ method: "POST", body }, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(writes.length, 1);
+
+    // A new submission must not PATCH a historical representation.
+    assert.strictEqual(writes[0].method, "post");
+    assert.ok(writes[0].url.includes("pinswg_watchlists"));
+    assert.ok(
+        !writes[0].url.includes(
+            "pinswg_watchlists(44444444-4444-4444-4444-444444444444)"
+        )
+    );
+
+    const writtenData = JSON.parse(writes[0].data);
+
+    assert.strictEqual(
+        writtenData.pinswg_representationsubmitted,
+        submissionDate
+    );
+    assert.strictEqual(writtenData.pinswg_representationtype, 3);
+    assert.strictEqual(
+        writtenData["pinswg_Contact@odata.bind"],
+        `/contacts(${contactID})`
+    );
+
+    // Neither historical submission was modified.
+    assert.strictEqual(
+        existingRecords[0].pinswg_representationsubmitted,
+        "2025-01-07T10:00:00Z"
+    );
+    assert.strictEqual(
+        existingRecords[1].pinswg_representationsubmitted,
+        "2025-01-09T14:00:00Z"
+    );
+});
+
 const WATCHED_CASE_ID = "11111111-1111-1111-1111-111111111111";
 const CONTACT_ID = "22222222-2222-2222-2222-222222222222";
 const OTHER_CONTACT_ID = "33333333-3333-3333-3333-333333333333";

From 9d6d3b9f71e5192b54ac1a949fbea1dc35cb061d Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Wed, 4 Nov 2026 13:23:51 +0000
Subject: [PATCH 05/24] fix(security): enforce ownership on appeal and
 representation blob proxies

---
 .../getawaitingsubmissionfromblobproxy.js     |  48 +++-
 pages/api/file/getrepsblobproxy.js            |   5 +-
 tests/phase21/file-handler-contract.test.cjs  | 209 ++++++++++++++++--
 3 files changed, 238 insertions(+), 24 deletions(-)

diff --git a/pages/api/file/getawaitingsubmissionfromblobproxy.js b/pages/api/file/getawaitingsubmissionfromblobproxy.js
index 3dcda590..8b2ceb6e 100644
--- a/pages/api/file/getawaitingsubmissionfromblobproxy.js
+++ b/pages/api/file/getawaitingsubmissionfromblobproxy.js
@@ -4,16 +4,38 @@ import { consoleLogger } from "../../../actions/core/logger";
 import { hashAPIPath } from "../../../actions/core/hash";
 import axios from "axios";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 
-const hasValue = (value) =>
-    typeof value === "string" && value.trim().length > 0;
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
 
 export default async function ApiProxy(req, res) {
+    res.setHeader("Allow", "GET");
+
+    if (req.method !== "GET") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
+        });
+    }
+
     const containerName = req.query.container;
 
-    if (!hasValue(containerName)) {
+    if (typeof containerName === "undefined" || containerName === "") {
         return respondError(res, {
             status: 400,
             code: "MISSING_REQUIRED_QUERY",
@@ -21,10 +43,28 @@ export default async function ApiProxy(req, res) {
         });
     }
 
+    if (!isValidContainer(containerName)) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
     const token = await getToken();
 
     const queryUrl =
-        "/api/file/getawaitingsubmissionfromblob?container=" + containerName;
+        "/api/file/getawaitingsubmissionfromblob?container=" +
+        encodeURIComponent(containerName);
 
     try {
         const { data } = await axios.get(
diff --git a/pages/api/file/getrepsblobproxy.js b/pages/api/file/getrepsblobproxy.js
index 228fedf7..cf279da2 100644
--- a/pages/api/file/getrepsblobproxy.js
+++ b/pages/api/file/getrepsblobproxy.js
@@ -4,7 +4,8 @@ import { consoleLogger } from "../../../actions/core/logger";
 import { hashAPIPath } from "../../../actions/core/hash";
 import axios from "axios";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
-import { getSession } from "next-auth/react";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 
@@ -50,7 +51,7 @@ export default async function ApiProxy(req, res) {
         });
     }
 
-    const session = await getSession({ req });
+    const session = await getServerSession(req, res, authOptions(req, res));
     if (
         typeof session?.user?.id !== "string" ||
         session.user.id.length === 0 ||
diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index b3d5e0f5..5632e6b8 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -2245,12 +2245,20 @@ test("getbloblistproxy dependency failure returns GET_BLOB_LIST_PROXY_FAILED", a
 });
 
 const loadOrdinaryRepsProxy = (overrides = {}) => {
-    const calls = { token: 0, hash: [], axios: [] };
+    const calls = { session: [], options: [], token: 0, hash: [], axios: [] };
+    const options = { id: "pedw-representation-options" };
     const payload = { "@odata.count": 1, value: [{ id: "r1" }] };
     const mod = loadModule("pages/api/file/getrepsblobproxy.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        getSession: async () => ({ user: { id: "user-container" } }),
+        authOptions: (req, res) => {
+            calls.options.push([req, res]);
+            return options;
+        },
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return { user: { id: "user-container" } };
+        },
         getToken: async () => {
             calls.token += 1;
             return { access_token: "tok" };
@@ -2271,7 +2279,7 @@ const loadOrdinaryRepsProxy = (overrides = {}) => {
         ...overrides
     });
 
-    return { mod, calls, payload };
+    return { mod, calls, options, payload };
 };
 
 const ordinaryRepsRequest = (overrides = {}) => ({
@@ -2295,7 +2303,7 @@ for (const sessionCase of [
 ]) {
     test(`getrepsblobproxy rejects ${sessionCase.name} before proxy work`, async () => {
         const loaded = loadOrdinaryRepsProxy({
-            getSession: async () => sessionCase.session
+            getServerSession: async () => sessionCase.session
         });
         const res = createRes();
 
@@ -2309,7 +2317,7 @@ for (const sessionCase of [
 
 test("getrepsblobproxy rejects cross-container access before proxy work", async () => {
     const loaded = loadOrdinaryRepsProxy({
-        getSession: async () => ({ user: { id: "different-container" } })
+        getServerSession: async () => ({ user: { id: "different-container" } })
     });
     const res = createRes();
 
@@ -2321,7 +2329,9 @@ test("getrepsblobproxy rejects cross-container access before proxy work", async
 });
 
 test("administrative cookie alone cannot authorize getrepsblobproxy", async () => {
-    const loaded = loadOrdinaryRepsProxy({ getSession: async () => null });
+    const loaded = loadOrdinaryRepsProxy({
+        getServerSession: async () => null
+    });
     const res = createRes();
 
     await loaded.mod.default(
@@ -2369,11 +2379,14 @@ for (const containerCase of [
 
 test("getrepsblobproxy preserves signed path and response for owning user", async () => {
     const loaded = loadOrdinaryRepsProxy();
+    const req = ordinaryRepsRequest();
     const res = createRes();
 
-    await loaded.mod.default(ordinaryRepsRequest(), res);
+    await loaded.mod.default(req, res);
 
     assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+    assert.deepStrictEqual(loaded.calls.session, [[req, res, loaded.options]]);
     assert.strictEqual(loaded.calls.token, 1);
     assert.deepStrictEqual(loaded.calls.hash, [
         "/api/file/getrepsblob?container=user-container"
@@ -2388,6 +2401,29 @@ test("getrepsblobproxy preserves signed path and response for owning user", asyn
     );
 });
 
+test("getrepsblobproxy dependency failure returns GET_REPS_BLOB_PROXY_FAILED", async () => {
+    const loaded = loadOrdinaryRepsProxy({
+        axios: {
+            get: async (...args) => {
+                loaded.calls.axios.push(args);
+                throw new Error("representation proxy failed");
+            }
+        }
+    });
+    const res = createRes();
+
+    await loaded.mod.default(ordinaryRepsRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "GET_REPS_BLOB_PROXY_FAILED"
+    );
+    assert.strictEqual(loaded.calls.token, 1);
+    assert.strictEqual(loaded.calls.hash.length, 1);
+    assert.strictEqual(loaded.calls.axios.length, 1);
+});
+
 const loadAdminRepsProxy = (overrides = {}) => {
     const calls = { token: 0, hash: [], axios: [] };
     const payload = { "@odata.count": 1, value: [{ id: "admin-r1" }] };
@@ -2596,36 +2632,173 @@ test("admin storage completion uses dedicated POST route while ordinary completi
     assert.match(ordinarySource, /sendRepCompleteMessage\(/);
 });
 
-test("getawaitingsubmissionfromblobproxy dependency failure returns GET_AWAITING_SUBMISSION_PROXY_FAILED", async () => {
+const loadAwaitingSubmissionProxy = (overrides = {}) => {
+    const calls = { session: [], options: [], token: 0, hash: [], axios: [] };
+    const options = { id: "pedw-awaiting-submission-options" };
+    const payload = {
+        "@odata.count": 1,
+        value: [{ pinswg_name: "TMP-SYNTHETIC" }],
+        case: [{ ticketnumber: "TMP-SYNTHETIC" }]
+    };
     const mod = loadModule(
         "pages/api/file/getawaitingsubmissionfromblobproxy.js",
         {
             respondError: respondErrorMock,
             respondSuccess: respondSuccessMock,
-            getToken: async () => ({ access_token: "tok" }),
-            azureHeaders: () => ({ headers: {} }),
-            hashAPIPath: () => "&hash=abc",
+            authOptions: (req, res) => {
+                calls.options.push([req, res]);
+                return options;
+            },
+            getServerSession: async (...args) => {
+                calls.session.push(args);
+                return { user: { id: "user-container" } };
+            },
+            getToken: async () => {
+                calls.token += 1;
+                return { access_token: "tok" };
+            },
+            azureHeaders: () => ({
+                headers: { Authorization: "Bearer tok" }
+            }),
+            hashAPIPath: (queryPath) => {
+                calls.hash.push(queryPath);
+                return "&hash=abc";
+            },
             consoleLogger: () => {},
             process: { env: { API_ROOT: "http://example.com" } },
             axios: {
-                get: async () => {
-                    throw new Error("awaiting failed");
+                get: async (...args) => {
+                    calls.axios.push(args);
+                    return { data: payload };
                 }
-            }
+            },
+            ...overrides
         }
     );
 
-    const req = {
-        query: { container: "c1" }
-    };
+    return { mod, calls, options, payload };
+};
+
+const awaitingSubmissionRequest = (overrides = {}) => ({
+    method: "GET",
+    query: { container: "user-container" },
+    headers: {},
+    ...overrides
+});
+
+for (const sessionCase of [
+    { name: "missing session", session: null },
+    { name: "session without user id", session: { user: {} } },
+    { name: "session with empty user id", session: { user: { id: "" } } },
+    { name: "session with non-string user id", session: { user: { id: 123 } } }
+]) {
+    test(`getawaitingsubmissionfromblobproxy rejects ${sessionCase.name} before proxy work`, async () => {
+        const loaded = loadAwaitingSubmissionProxy({
+            getServerSession: async () => sessionCase.session
+        });
+        const res = createRes();
+
+        await loaded.mod.default(awaitingSubmissionRequest(), res);
+
+        assert.strictEqual(res.state.statusCode, 403);
+        assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+        assertNoProxyWork(loaded.calls);
+    });
+}
+
+test("getawaitingsubmissionfromblobproxy rejects cross-container access before proxy work", async () => {
+    const loaded = loadAwaitingSubmissionProxy({
+        getServerSession: async () => ({ user: { id: "different-container" } })
+    });
     const res = createRes();
-    await mod.default(req, res);
+
+    await loaded.mod.default(awaitingSubmissionRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assertNoProxyWork(loaded.calls);
+});
+
+test("getawaitingsubmissionfromblobproxy rejects unsupported methods before proxy work", async () => {
+    const loaded = loadAwaitingSubmissionProxy();
+    const res = createRes();
+
+    await loaded.mod.default(
+        awaitingSubmissionRequest({ method: "POST" }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 405);
+    assert.strictEqual(res.state.jsonBody.error.code, "METHOD_NOT_ALLOWED");
+    assertNoProxyWork(loaded.calls);
+});
+
+for (const containerCase of [
+    { name: "missing container", query: {} },
+    { name: "empty container", query: { container: "" } },
+    { name: "null container", query: { container: null } },
+    { name: "non-string container", query: { container: ["user-container"] } },
+    { name: "malformed container", query: { container: "Invalid_Container" } }
+]) {
+    test(`getawaitingsubmissionfromblobproxy rejects ${containerCase.name} before proxy work`, async () => {
+        const loaded = loadAwaitingSubmissionProxy();
+        const res = createRes();
+
+        await loaded.mod.default(
+            awaitingSubmissionRequest({ query: containerCase.query }),
+            res
+        );
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assertNoProxyWork(loaded.calls);
+    });
+}
+
+test("getawaitingsubmissionfromblobproxy preserves signed path and response for owning user", async () => {
+    const loaded = loadAwaitingSubmissionProxy();
+    const req = awaitingSubmissionRequest();
+    const res = createRes();
+
+    await loaded.mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+    assert.deepStrictEqual(loaded.calls.session, [[req, res, loaded.options]]);
+    assert.strictEqual(loaded.calls.token, 1);
+    assert.deepStrictEqual(loaded.calls.hash, [
+        "/api/file/getawaitingsubmissionfromblob?container=user-container"
+    ]);
+    assert.strictEqual(
+        loaded.calls.axios[0][0],
+        "http://example.com/api/file/getawaitingsubmissionfromblob?container=user-container&hash=abc"
+    );
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(res.state.jsonBody)),
+        loaded.payload
+    );
+});
+
+test("getawaitingsubmissionfromblobproxy dependency failure returns GET_AWAITING_SUBMISSION_PROXY_FAILED", async () => {
+    const loaded = loadAwaitingSubmissionProxy({
+        axios: {
+            get: async (...args) => {
+                loaded.calls.axios.push(args);
+                throw new Error("awaiting failed");
+            }
+        }
+    });
+    const res = createRes();
+
+    await loaded.mod.default(awaitingSubmissionRequest(), res);
 
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(
         res.state.jsonBody.error.code,
         "GET_AWAITING_SUBMISSION_PROXY_FAILED"
     );
+    assert.strictEqual(loaded.calls.token, 1);
+    assert.strictEqual(loaded.calls.hash.length, 1);
+    assert.strictEqual(loaded.calls.axios.length, 1);
 });
 
 test("createappealcompletemessageproxy dependency failure returns CREATE_APPEAL_COMPLETE_MESSAGE_PROXY_FAILED", async () => {

From 056dace56304341022185ae8dff3980f95067bff Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Wed, 4 Nov 2026 13:45:56 +0000
Subject: [PATCH 06/24] fix(security): enforce ownership on draft blob listing
 proxy

---
 pages/api/file/getbloblistproxy.js           |  42 ++++
 tests/phase21/file-handler-contract.test.cjs | 212 ++++++++++++++++---
 2 files changed, 228 insertions(+), 26 deletions(-)

diff --git a/pages/api/file/getbloblistproxy.js b/pages/api/file/getbloblistproxy.js
index 6dd29acf..7881099a 100644
--- a/pages/api/file/getbloblistproxy.js
+++ b/pages/api/file/getbloblistproxy.js
@@ -4,13 +4,38 @@ import { consoleLogger } from "../../../actions/core/logger";
 import { hashAPIPath } from "../../../actions/core/hash";
 import axios from "axios";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 
 const hasValue = (value) =>
     typeof value === "string" && value.trim().length > 0;
 
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
 export default async function ApiProxy(req, res) {
+    res.setHeader("Allow", "GET");
+
+    if (req.method !== "GET") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
+        });
+    }
+
     const containerName = req.query.container;
     const casefolderID = req.query.casefolderID;
 
@@ -22,6 +47,23 @@ export default async function ApiProxy(req, res) {
         });
     }
 
+    if (!isValidContainer(containerName)) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
     const token = await getToken();
 
     const queryUrl =
diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index 5632e6b8..be84d5c8 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -2189,59 +2189,219 @@ test("admin representation completion accepts legitimate filename punctuation",
     assert.strictEqual(loaded.calls.queue.length, 1);
 });
 
-test("getbloblistproxy success returns proxied payload", async () => {
+const loadBlobListProxy = ({ session, ...overrides } = {}) => {
+    const calls = {
+        session: [],
+        options: [],
+        token: 0,
+        hash: [],
+        headers: [],
+        axios: []
+    };
+    const options = { id: "pedw-blob-list-options" };
+    const payload = { value: [{ id: "blob-1" }] };
+    const resolvedSession =
+        typeof session === "undefined"
+            ? { user: { id: "user-container" } }
+            : session;
     const mod = loadModule("pages/api/file/getbloblistproxy.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "tok" }),
-        azureHeaders: () => ({ headers: { Authorization: "Bearer tok" } }),
-        hashAPIPath: () => "&hash=abc",
+        authOptions: (req, res) => {
+            calls.options.push([req, res]);
+            return options;
+        },
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return resolvedSession;
+        },
+        getToken: async () => {
+            calls.token += 1;
+            return { access_token: "synthetic-token" };
+        },
+        azureHeaders: (accessToken) => {
+            calls.headers.push(accessToken);
+            return {
+                headers: { Authorization: "Bearer synthetic-token" }
+            };
+        },
+        hashAPIPath: (queryPath) => {
+            calls.hash.push(queryPath);
+            return "&hash=synthetic-hash";
+        },
         consoleLogger: () => {},
         process: { env: { API_ROOT: "http://example.com" } },
         axios: {
-            get: async () => ({ data: { value: [{ id: "b1" }] } })
-        }
+            get: async (...args) => {
+                calls.axios.push(args);
+                return { data: payload };
+            }
+        },
+        ...overrides
     });
 
-    const req = {
-        query: { container: "cont/1", casefolderID: "CASE/1" }
-    };
+    return { mod, calls, options, payload };
+};
+
+const blobListProxyRequest = (overrides = {}) => ({
+    method: "GET",
+    query: { container: "user-container", casefolderID: "CASE/1" },
+    headers: {},
+    ...overrides
+});
+
+const assertNoBlobListProxyWork = (calls) => {
+    assert.strictEqual(calls.token, 0);
+    assert.strictEqual(calls.hash.length, 0);
+    assert.strictEqual(calls.headers.length, 0);
+    assert.strictEqual(calls.axios.length, 0);
+};
+
+test("getbloblistproxy rejects unsupported methods before authentication or proxy work", async () => {
+    const loaded = loadBlobListProxy();
     const res = createRes();
-    await mod.default(req, res);
 
-    assert.strictEqual(res.state.statusCode, 200);
-    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
-        value: [{ id: "b1" }]
+    await loaded.mod.default(blobListProxyRequest({ method: "POST" }), res);
+
+    assert.strictEqual(res.state.statusCode, 405);
+    assert.strictEqual(res.state.jsonBody.error.code, "METHOD_NOT_ALLOWED");
+    assert.strictEqual(loaded.calls.options.length, 0);
+    assert.strictEqual(loaded.calls.session.length, 0);
+    assertNoBlobListProxyWork(loaded.calls);
+});
+
+test("getbloblistproxy rejects a missing container before authentication or proxy work", async () => {
+    const loaded = loadBlobListProxy();
+    const res = createRes();
+
+    await loaded.mod.default(
+        blobListProxyRequest({ query: { casefolderID: "CASE/1" } }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "MISSING_REQUIRED_QUERY");
+    assert.strictEqual(loaded.calls.options.length, 0);
+    assert.strictEqual(loaded.calls.session.length, 0);
+    assertNoBlobListProxyWork(loaded.calls);
+});
+
+test("getbloblistproxy rejects a malformed container before authentication or proxy work", async () => {
+    const loaded = loadBlobListProxy();
+    const res = createRes();
+
+    await loaded.mod.default(
+        blobListProxyRequest({
+            query: { container: "Invalid_Container", casefolderID: "CASE/1" }
+        }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_REQUEST");
+    assert.strictEqual(loaded.calls.options.length, 0);
+    assert.strictEqual(loaded.calls.session.length, 0);
+    assertNoBlobListProxyWork(loaded.calls);
+});
+
+test("getbloblistproxy rejects a missing casefolderID before authentication or proxy work", async () => {
+    const loaded = loadBlobListProxy();
+    const res = createRes();
+
+    await loaded.mod.default(
+        blobListProxyRequest({ query: { container: "user-container" } }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "MISSING_REQUIRED_QUERY");
+    assert.strictEqual(loaded.calls.options.length, 0);
+    assert.strictEqual(loaded.calls.session.length, 0);
+    assertNoBlobListProxyWork(loaded.calls);
+});
+
+for (const sessionCase of [
+    { name: "missing session", session: null },
+    { name: "session without user id", session: { user: {} } },
+    { name: "session with empty user id", session: { user: { id: "" } } },
+    { name: "session with non-string user id", session: { user: { id: 123 } } }
+]) {
+    test(`getbloblistproxy rejects ${sessionCase.name} before proxy work`, async () => {
+        const loaded = loadBlobListProxy({ session: sessionCase.session });
+        const res = createRes();
+
+        await loaded.mod.default(blobListProxyRequest(), res);
+
+        assert.strictEqual(res.state.statusCode, 403);
+        assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+        assertNoBlobListProxyWork(loaded.calls);
     });
+}
+
+test("getbloblistproxy rejects cross-container access before proxy work", async () => {
+    const loaded = loadBlobListProxy({
+        session: { user: { id: "different-container" } }
+    });
+    const res = createRes();
+
+    await loaded.mod.default(blobListProxyRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assertNoBlobListProxyWork(loaded.calls);
+});
+
+test("getbloblistproxy preserves signed path, bearer header and response for owning user", async () => {
+    const loaded = loadBlobListProxy();
+    const req = blobListProxyRequest();
+    const res = createRes();
+
+    await loaded.mod.default(req, res);
+
+    const expectedPath =
+        "/api/file/getbloblist?container=user-container&casefolderID=CASE%2F1";
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+    assert.deepStrictEqual(loaded.calls.session, [[req, res, loaded.options]]);
+    assert.strictEqual(loaded.calls.token, 1);
+    assert.deepStrictEqual(loaded.calls.hash, [expectedPath]);
+    assert.deepStrictEqual(loaded.calls.headers, ["synthetic-token"]);
+    assert.strictEqual(loaded.calls.axios.length, 1);
+    assert.strictEqual(
+        loaded.calls.axios[0][0],
+        `http://example.com${expectedPath}&hash=synthetic-hash`
+    );
+    assert.deepStrictEqual(loaded.calls.axios[0][1], {
+        headers: { Authorization: "Bearer synthetic-token" }
+    });
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(res.state.jsonBody)),
+        loaded.payload
+    );
 });
 
 test("getbloblistproxy dependency failure returns GET_BLOB_LIST_PROXY_FAILED", async () => {
-    const mod = loadModule("pages/api/file/getbloblistproxy.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "tok" }),
-        azureHeaders: () => ({ headers: {} }),
-        hashAPIPath: () => "&hash=abc",
-        consoleLogger: () => {},
-        process: { env: { API_ROOT: "http://example.com" } },
+    const loaded = loadBlobListProxy({
         axios: {
-            get: async () => {
+            get: async (...args) => {
+                loaded.calls.axios.push(args);
                 throw new Error("proxy failed");
             }
         }
     });
 
-    const req = {
-        query: { container: "c1", casefolderID: "f1" }
-    };
     const res = createRes();
-    await mod.default(req, res);
+    await loaded.mod.default(blobListProxyRequest(), res);
 
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(
         res.state.jsonBody.error.code,
         "GET_BLOB_LIST_PROXY_FAILED"
     );
+    assert.strictEqual(loaded.calls.token, 1);
+    assert.strictEqual(loaded.calls.hash.length, 1);
+    assert.strictEqual(loaded.calls.headers.length, 1);
+    assert.strictEqual(loaded.calls.axios.length, 1);
 });
 
 const loadOrdinaryRepsProxy = (overrides = {}) => {

From fc960f907feffb3d0c62afec2f53380b59b90764 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Wed, 4 Nov 2026 14:01:50 +0000
Subject: [PATCH 07/24] fix(security): enforce ownership on private draft blob
 deletion

---
 .../file/deleteawaitingsubmissionfromblob.js  |  47 +-
 pages/api/file/deleteblob.js                  |  47 +-
 tests/phase21/file-handler-contract.test.cjs  | 439 +++++++++++++++++-
 3 files changed, 510 insertions(+), 23 deletions(-)

diff --git a/pages/api/file/deleteawaitingsubmissionfromblob.js b/pages/api/file/deleteawaitingsubmissionfromblob.js
index 4740aa45..f4af12c6 100644
--- a/pages/api/file/deleteawaitingsubmissionfromblob.js
+++ b/pages/api/file/deleteawaitingsubmissionfromblob.js
@@ -1,6 +1,8 @@
 import { hashAPIPath } from "../../../actions/core/hash";
 import { deleteBlob } from "../../../actions/azurestorage";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 import nextConnect from "next-connect";
 import middleware from "../middleware/middleware";
@@ -8,6 +10,22 @@ import middleware from "../middleware/middleware";
 const ApiProxy = nextConnect();
 ApiProxy.use(middleware);
 
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
 ApiProxy.get(async (req, res) => {
     const containerName = req.query.container;
     const casefolderID = req.query.casefolderID;
@@ -15,14 +33,10 @@ ApiProxy.get(async (req, res) => {
     const checkHash = req.query.hash;
 
     if (
-        typeof containerName === "undefined" ||
-        containerName.length === 0 ||
-        typeof casefolderID === "undefined" ||
-        casefolderID.length === 0 ||
-        typeof blobName === "undefined" ||
-        blobName.length === 0 ||
-        typeof checkHash === "undefined" ||
-        checkHash.length === 0
+        !hasValue(containerName) ||
+        !hasValue(casefolderID) ||
+        !hasValue(blobName) ||
+        !hasValue(checkHash)
     ) {
         return respondError(res, {
             status: 400,
@@ -34,6 +48,23 @@ ApiProxy.get(async (req, res) => {
     const casefolderIDTrimmed = casefolderID.trim();
     const blobNameTrimmed = blobName.trim();
 
+    if (!isValidContainer(containerName)) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
     const hashCandidatePaths = [
         "/api/file/deleteawaitingsubmissionfromblob?container=" +
             containerName +
diff --git a/pages/api/file/deleteblob.js b/pages/api/file/deleteblob.js
index 5402078b..2736f848 100644
--- a/pages/api/file/deleteblob.js
+++ b/pages/api/file/deleteblob.js
@@ -1,6 +1,8 @@
 import { hashAPIPath } from "../../../actions/core/hash";
 import { deleteBlob } from "../../../actions/azurestorage";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 import nextConnect from "next-connect";
 import middleware from "../middleware/middleware";
@@ -8,6 +10,22 @@ import middleware from "../middleware/middleware";
 const ApiProxy = nextConnect();
 ApiProxy.use(middleware);
 
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
 ApiProxy.get(async (req, res) => {
     const containerName = req.query.container;
     const casefolderID = req.query.casefolderID;
@@ -15,14 +33,10 @@ ApiProxy.get(async (req, res) => {
     const checkHash = req.query.hash;
 
     if (
-        typeof containerName === "undefined" ||
-        containerName.length === 0 ||
-        typeof casefolderID === "undefined" ||
-        casefolderID.length === 0 ||
-        typeof blobName === "undefined" ||
-        blobName.length === 0 ||
-        typeof checkHash === "undefined" ||
-        checkHash.length === 0
+        !hasValue(containerName) ||
+        !hasValue(casefolderID) ||
+        !hasValue(blobName) ||
+        !hasValue(checkHash)
     ) {
         return respondError(res, {
             status: 400,
@@ -34,6 +48,23 @@ ApiProxy.get(async (req, res) => {
     const casefolderIDTrimmed = casefolderID.trim();
     const blobNameTrimmed = blobName.trim();
 
+    if (!isValidContainer(containerName)) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
     const hashCandidatePaths = [
         "/api/file/deleteblob?container=" +
             containerName +
diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index be84d5c8..c3ba9cac 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -247,6 +247,8 @@ test("deleteblob handler returns MISSING_REQUIRED_QUERY when blobname missing",
     const mod = loadModule("pages/api/file/deleteblob.js", {
         nextConnect: createNextConnectMock(),
         middleware: () => {},
+        getServerSession: async () => ({ user: { id: "container-1" } }),
+        authOptions: () => ({}),
         hashAPIPath: () => "&hash=expected",
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
@@ -254,7 +256,11 @@ test("deleteblob handler returns MISSING_REQUIRED_QUERY when blobname missing",
     });
 
     const req = {
-        query: { container: "c1", casefolderID: "f1", hash: "expected" }
+        query: {
+            container: "container-1",
+            casefolderID: "f1",
+            hash: "expected"
+        }
     };
     const res = createRes();
     await mod.default.handler(req, res);
@@ -268,8 +274,10 @@ test("deleteblob handler accepts encoded hash variant and normalizes prefixed pa
     const mod = loadModule("pages/api/file/deleteblob.js", {
         nextConnect: createNextConnectMock(),
         middleware: () => {},
+        getServerSession: async () => ({ user: { id: "container-1" } }),
+        authOptions: () => ({}),
         hashAPIPath: (queryPath) =>
-            queryPath.includes("/api/file/deleteblob?container=c1")
+            queryPath.includes("/api/file/deleteblob?container=container-1")
                 ? "&hash=expected"
                 : "&hash=other",
         respondError: respondErrorMock,
@@ -282,7 +290,7 @@ test("deleteblob handler accepts encoded hash variant and normalizes prefixed pa
 
     const req = {
         query: {
-            container: "c1",
+            container: "container-1",
             casefolderID: "TMP-LFE1C",
             blobname:
                 "TMP-LFE1C/files/2026-03-18_-_Site_Location_Plan_-_test document 021.xlsx",
@@ -303,6 +311,8 @@ test("deleteblob handler dependency failure returns DELETE_BLOB_FAILED", async (
     const mod = loadModule("pages/api/file/deleteblob.js", {
         nextConnect: createNextConnectMock(),
         middleware: () => {},
+        getServerSession: async () => ({ user: { id: "container-1" } }),
+        authOptions: () => ({}),
         hashAPIPath: () => "&hash=expected",
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
@@ -313,7 +323,7 @@ test("deleteblob handler dependency failure returns DELETE_BLOB_FAILED", async (
 
     const req = {
         query: {
-            container: "c1",
+            container: "container-1",
             casefolderID: "f1",
             blobname: "doc.pdf",
             hash: "expected"
@@ -1221,8 +1231,12 @@ test("deleteawaitingsubmissionfromblob accepts legacy deleteblob hash variant",
         {
             nextConnect: createNextConnectMock(),
             middleware: () => {},
+            getServerSession: async () => ({ user: { id: "container-1" } }),
+            authOptions: () => ({}),
             hashAPIPath: (queryPath) =>
-                queryPath.includes("/api/file/deleteblob?container=c1")
+                queryPath.includes(
+                    "/api/file/deleteblob?container=container-1"
+                )
                     ? "&hash=expected"
                     : "&hash=other",
             respondError: respondErrorMock,
@@ -1236,7 +1250,7 @@ test("deleteawaitingsubmissionfromblob accepts legacy deleteblob hash variant",
 
     const req = {
         query: {
-            container: "c1",
+            container: "container-1",
             casefolderID: "CASE-1",
             blobname: "CASE-1/files/doc.pdf",
             hash: "expected"
@@ -1255,6 +1269,8 @@ test("deleteawaitingsubmissionfromblob dependency failure returns DELETE_AWAITIN
         {
             nextConnect: createNextConnectMock(),
             middleware: () => {},
+            getServerSession: async () => ({ user: { id: "container-1" } }),
+            authOptions: () => ({}),
             hashAPIPath: () => "&hash=expected",
             respondError: respondErrorMock,
             respondSuccess: respondSuccessMock,
@@ -1266,7 +1282,7 @@ test("deleteawaitingsubmissionfromblob dependency failure returns DELETE_AWAITIN
 
     const req = {
         query: {
-            container: "c1",
+            container: "container-1",
             casefolderID: "CASE-1",
             blobname: "doc.pdf",
             hash: "expected"
@@ -1282,6 +1298,245 @@ test("deleteawaitingsubmissionfromblob dependency failure returns DELETE_AWAITIN
     );
 });
 
+const ownerBoundBlobDeletionCases = [
+    {
+        name: "deleteblob",
+        route: "pages/api/file/deleteblob.js"
+    },
+    {
+        name: "deleteawaitingsubmissionfromblob",
+        route: "pages/api/file/deleteawaitingsubmissionfromblob.js"
+    }
+];
+
+const loadOwnerBoundBlobDeletion = (
+    deletionCase,
+    { session, ...overrides } = {}
+) => {
+    const calls = {
+        options: [],
+        session: [],
+        hash: [],
+        deletion: []
+    };
+    const options = { id: `${deletionCase.name}-options` };
+    const resolvedSession =
+        typeof session === "undefined"
+            ? { user: { id: "owner-container" } }
+            : session;
+    const mod = loadModule(deletionCase.route, {
+        nextConnect: createNextConnectMock(),
+        middleware: () => {},
+        authOptions: (req, res) => {
+            calls.options.push([req, res]);
+            return options;
+        },
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return resolvedSession;
+        },
+        hashAPIPath: (queryPath) => {
+            calls.hash.push(queryPath);
+            return "&hash=expected";
+        },
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        deleteBlob: async (...args) => {
+            calls.deletion.push(args);
+            return { deleted: true };
+        },
+        ...overrides
+    });
+
+    return { mod, calls, options };
+};
+
+const ownerBoundBlobDeletionRequest = (overrides = {}) => ({
+    query: {
+        container: "owner-container",
+        casefolderID: "CASE-1",
+        blobname: "document.pdf",
+        hash: "expected"
+    },
+    ...overrides
+});
+
+const assertNoOwnerBoundBlobDeletion = (calls) => {
+    assert.strictEqual(calls.hash.length, 0);
+    assert.strictEqual(calls.deletion.length, 0);
+};
+
+for (const deletionCase of ownerBoundBlobDeletionCases) {
+    for (const sessionCase of [
+        { name: "missing session", session: null },
+        { name: "session without user id", session: { user: {} } },
+        { name: "session with empty user id", session: { user: { id: "" } } },
+        {
+            name: "session with non-string user id",
+            session: { user: { id: 123 } }
+        }
+    ]) {
+        test(`${deletionCase.name} rejects ${sessionCase.name} before HMAC or Azure deletion`, async () => {
+            const loaded = loadOwnerBoundBlobDeletion(deletionCase, {
+                session: sessionCase.session
+            });
+            const res = createRes();
+
+            await loaded.mod.default.handler(
+                ownerBoundBlobDeletionRequest(),
+                res
+            );
+
+            assert.strictEqual(res.state.statusCode, 403);
+            assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+            assertNoOwnerBoundBlobDeletion(loaded.calls);
+        });
+    }
+
+    test(`${deletionCase.name} rejects cross-container deletion before HMAC or Azure deletion`, async () => {
+        const loaded = loadOwnerBoundBlobDeletion(deletionCase, {
+            session: { user: { id: "different-container" } }
+        });
+        const res = createRes();
+
+        await loaded.mod.default.handler(ownerBoundBlobDeletionRequest(), res);
+
+        assert.strictEqual(res.state.statusCode, 403);
+        assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+        assertNoOwnerBoundBlobDeletion(loaded.calls);
+    });
+
+    test(`${deletionCase.name} rejects an invalid container before authentication or deletion`, async () => {
+        const loaded = loadOwnerBoundBlobDeletion(deletionCase);
+        const res = createRes();
+
+        await loaded.mod.default.handler(
+            ownerBoundBlobDeletionRequest({
+                query: {
+                    container: "Invalid_Container",
+                    casefolderID: "CASE-1",
+                    blobname: "document.pdf",
+                    hash: "expected"
+                }
+            }),
+            res
+        );
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(res.state.jsonBody.error.code, "INVALID_REQUEST");
+        assert.strictEqual(loaded.calls.options.length, 0);
+        assert.strictEqual(loaded.calls.session.length, 0);
+        assertNoOwnerBoundBlobDeletion(loaded.calls);
+    });
+
+    test(`${deletionCase.name} rejects a missing blob name before authentication or deletion`, async () => {
+        const loaded = loadOwnerBoundBlobDeletion(deletionCase);
+        const res = createRes();
+
+        await loaded.mod.default.handler(
+            ownerBoundBlobDeletionRequest({
+                query: {
+                    container: "owner-container",
+                    casefolderID: "CASE-1",
+                    hash: "expected"
+                }
+            }),
+            res
+        );
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(
+            res.state.jsonBody.error.code,
+            "MISSING_REQUIRED_QUERY"
+        );
+        assert.strictEqual(loaded.calls.options.length, 0);
+        assert.strictEqual(loaded.calls.session.length, 0);
+        assertNoOwnerBoundBlobDeletion(loaded.calls);
+    });
+
+    test(`${deletionCase.name} rejects malformed folder and blob parameters before authentication or deletion`, async () => {
+        const loaded = loadOwnerBoundBlobDeletion(deletionCase);
+
+        for (const query of [
+            {
+                container: "owner-container",
+                casefolderID: ["CASE-1"],
+                blobname: "document.pdf",
+                hash: "expected"
+            },
+            {
+                container: "owner-container",
+                casefolderID: "CASE-1",
+                blobname: ["document.pdf"],
+                hash: "expected"
+            },
+            {
+                container: "owner-container",
+                casefolderID: "   ",
+                blobname: "document.pdf",
+                hash: "expected"
+            },
+            {
+                container: "owner-container",
+                casefolderID: "CASE-1",
+                blobname: "   ",
+                hash: "expected"
+            }
+        ]) {
+            const res = createRes();
+
+            await loaded.mod.default.handler(
+                ownerBoundBlobDeletionRequest({ query }),
+                res
+            );
+
+            assert.strictEqual(res.state.statusCode, 400);
+            assert.strictEqual(
+                res.state.jsonBody.error.code,
+                "MISSING_REQUIRED_QUERY"
+            );
+        }
+
+        assert.strictEqual(loaded.calls.options.length, 0);
+        assert.strictEqual(loaded.calls.session.length, 0);
+        assertNoOwnerBoundBlobDeletion(loaded.calls);
+    });
+
+    test(`${deletionCase.name} rejects an invalid HMAC after owner authentication and before deletion`, async () => {
+        const loaded = loadOwnerBoundBlobDeletion(deletionCase, {
+            hashAPIPath: () => "&hash=different"
+        });
+        const res = createRes();
+
+        await loaded.mod.default.handler(ownerBoundBlobDeletionRequest(), res);
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
+        assert.strictEqual(loaded.calls.deletion.length, 0);
+    });
+
+    test(`${deletionCase.name} preserves owner deletion and request-aware session arguments`, async () => {
+        const loaded = loadOwnerBoundBlobDeletion(deletionCase);
+        const req = ownerBoundBlobDeletionRequest();
+        const res = createRes();
+
+        await loaded.mod.default.handler(req, res);
+
+        assert.strictEqual(res.state.statusCode, 200);
+        assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+        assert.deepStrictEqual(loaded.calls.session, [
+            [req, res, loaded.options]
+        ]);
+        assert.strictEqual(loaded.calls.hash.length, 1);
+        assert.deepStrictEqual(loaded.calls.deletion, [
+            ["owner-container", "CASE-1/files/document.pdf"]
+        ]);
+        assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+            data: { deleted: true }
+        });
+    });
+}
+
 test("getrepsblob handler success returns representations payload", async () => {
     const mod = loadModule("pages/api/file/getrepsblob.js", {
         nextConnect: createNextConnectMock(),
@@ -3527,6 +3782,176 @@ test("downloadblob handler success sets attachment header and returns body", asy
     assert.strictEqual(res.state.sentBody.toString(), "file-content");
 });
 
+const loadDownloadBlobCapability = (overrides = {}) => {
+    const calls = { hash: [], download: [] };
+    const mod = loadModule("pages/api/file/downloadblob.js", {
+        nextConnect: createNextConnectMock(),
+        middleware: () => {},
+        hashAPIPath: (queryPath) => {
+            calls.hash.push(queryPath);
+            return queryPath ===
+                "/api/file/downloadblob?container=selected-container&casefolderID=CASE%2F1&blobname=document.pdf"
+                ? "&hash=valid-capability"
+                : "&hash=other-capability";
+        },
+        respondError: respondErrorMock,
+        downloadFile: async (...args) => {
+            calls.download.push(args);
+            return Buffer.from("private-draft-content");
+        },
+        ...overrides
+    });
+
+    return { mod, calls };
+};
+
+const downloadBlobCapabilityRequest = (overrides = {}) => ({
+    query: {
+        container: "selected-container",
+        casefolderID: "CASE/1",
+        blobname: "document.pdf",
+        hash: "valid-capability"
+    },
+    ...overrides
+});
+
+test("downloadblob preserves anonymous access with a valid exact-resource capability", async () => {
+    const loaded = loadDownloadBlobCapability();
+    const res = createRes();
+
+    await loaded.mod.default.handler(downloadBlobCapabilityRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.download, [
+        ["selected-container", "CASE/1/files/document.pdf"]
+    ]);
+    assert.strictEqual(
+        res.state.headers["content-disposition"],
+        "attachment; filename=document.pdf"
+    );
+    assert.strictEqual(res.state.sentBody.toString(), "private-draft-content");
+});
+
+test("downloadblob rejects a missing capability before Azure download", async () => {
+    const loaded = loadDownloadBlobCapability();
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        downloadBlobCapabilityRequest({
+            query: {
+                container: "selected-container",
+                casefolderID: "CASE/1",
+                blobname: "document.pdf"
+            }
+        }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "MISSING_REQUIRED_QUERY");
+    assert.strictEqual(loaded.calls.hash.length, 0);
+    assert.strictEqual(loaded.calls.download.length, 0);
+});
+
+test("downloadblob rejects an invalid capability before Azure download", async () => {
+    const loaded = loadDownloadBlobCapability();
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        downloadBlobCapabilityRequest({
+            query: {
+                container: "selected-container",
+                casefolderID: "CASE/1",
+                blobname: "document.pdf",
+                hash: "invalid-capability"
+            }
+        }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
+    assert.strictEqual(loaded.calls.download.length, 0);
+});
+
+for (const capabilityCase of [
+    {
+        name: "different blob",
+        query: {
+            container: "selected-container",
+            casefolderID: "CASE/1",
+            blobname: "other-document.pdf",
+            hash: "valid-capability"
+        }
+    },
+    {
+        name: "different folder",
+        query: {
+            container: "selected-container",
+            casefolderID: "CASE/2",
+            blobname: "document.pdf",
+            hash: "valid-capability"
+        }
+    },
+    {
+        name: "different container",
+        query: {
+            container: "other-container",
+            casefolderID: "CASE/1",
+            blobname: "document.pdf",
+            hash: "valid-capability"
+        }
+    }
+]) {
+    test(`downloadblob rejects a capability issued for a ${capabilityCase.name}`, async () => {
+        const loaded = loadDownloadBlobCapability();
+        const res = createRes();
+
+        await loaded.mod.default.handler(
+            downloadBlobCapabilityRequest({ query: capabilityCase.query }),
+            res
+        );
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
+        assert.strictEqual(loaded.calls.download.length, 0);
+    });
+}
+
+test("downloadblob rejects a delete-operation capability before Azure download", async () => {
+    const loaded = loadDownloadBlobCapability({
+        hashAPIPath: (queryPath) => {
+            loaded.calls.hash.push(queryPath);
+            return queryPath.startsWith("/api/file/deleteblob?")
+                ? "&hash=valid-capability"
+                : "&hash=other-capability";
+        }
+    });
+    const res = createRes();
+
+    await loaded.mod.default.handler(downloadBlobCapabilityRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
+    assert.strictEqual(loaded.calls.download.length, 0);
+});
+
+test("downloadblob preserves dependency failure contract for a valid capability", async () => {
+    const loaded = loadDownloadBlobCapability({
+        downloadFile: async (...args) => {
+            loaded.calls.download.push(args);
+            throw new Error("download failed");
+        }
+    });
+    const res = createRes();
+
+    await loaded.mod.default.handler(downloadBlobCapabilityRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "DOWNLOAD_BLOB_FAILED");
+    assert.strictEqual(loaded.calls.download.length, 1);
+});
+
 test("upload handler dependency failure returns UPLOAD_FAILED", async () => {
     const mod = loadModule("pages/api/file/upload.js", {
         nextConnect: createNextConnectMock(),

From 8b045ab78105126833f6fb78f1bda07732be0b03 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Wed, 4 Nov 2026 14:20:11 +0000
Subject: [PATCH 08/24] fix(security): enforce ownership across appeal
 completion

---
 pages/api/endpoint/gethash_api.js             |  70 +-
 .../file/createappealcompletemessage_api.js   |  53 +-
 .../createappealcompletemessageproxy_api.js   |  51 +-
 tests/phase21/file-handler-contract.test.cjs  | 630 +++++++++++++++++-
 4 files changed, 791 insertions(+), 13 deletions(-)

diff --git a/pages/api/endpoint/gethash_api.js b/pages/api/endpoint/gethash_api.js
index 3829aed1..c68f61fe 100644
--- a/pages/api/endpoint/gethash_api.js
+++ b/pages/api/endpoint/gethash_api.js
@@ -1,12 +1,25 @@
 import { hashAPIPath } from "../../../actions/core/hash";
 import nextConnect from "next-connect";
-import { getSession } from "next-auth/react";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
 
 const ApiProxy = nextConnect();
 
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidTempCaseRef = (value) =>
+    typeof value === "string" &&
+    value.length <= 100 &&
+    !value.includes("..") &&
+    /^[A-Za-z0-9](?:[A-Za-z0-9/-]*[A-Za-z0-9])?$/.test(value);
+
 ApiProxy.get(async (req, res) => {
-    const session = await getSession({ req });
+    const session = await getServerSession(req, res, authOptions(req, res));
 
     if (!session) {
         return respondError(res, {
@@ -52,6 +65,59 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
+    if (
+        queryPath.startsWith("/api/file/createappealcompletemessage_api") &&
+        queryPath !== "/api/file/createappealcompletemessage_api"
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_HASH_PATH",
+            message: "Invalid path for hash generation"
+        });
+    }
+
+    if (queryPath === "/api/file/createappealcompletemessage_api") {
+        let completionPath;
+
+        try {
+            completionPath = new URL(rawQueryPath, "http://localhost");
+        } catch (_error) {
+            return respondError(res, {
+                status: 400,
+                code: "INVALID_HASH_PATH",
+                message: "Invalid path for hash generation"
+            });
+        }
+
+        const containerName = completionPath.searchParams.get("container");
+        const tempCaseRef = completionPath.searchParams.get("tempcaseref");
+
+        if (
+            !isValidContainer(containerName) ||
+            !isValidTempCaseRef(tempCaseRef) ||
+            completionPath.searchParams.getAll("container").length !== 1 ||
+            completionPath.searchParams.getAll("tempcaseref").length !== 1
+        ) {
+            return respondError(res, {
+                status: 400,
+                code: "INVALID_HASH_PATH",
+                message: "Invalid path for hash generation"
+            });
+        }
+
+        if (
+            typeof session?.user?.id !== "string" ||
+            session.user.id.length === 0 ||
+            session.user.id !== containerName
+        ) {
+            return respondError(res, {
+                status: 403,
+                code: "FORBIDDEN",
+                message: "Request not permitted"
+            });
+        }
+    }
+
     return respondSuccess(res, { hash: hashAPIPath(rawQueryPath) });
 });
 
diff --git a/pages/api/file/createappealcompletemessage_api.js b/pages/api/file/createappealcompletemessage_api.js
index 17c43b1e..ebe4e59e 100644
--- a/pages/api/file/createappealcompletemessage_api.js
+++ b/pages/api/file/createappealcompletemessage_api.js
@@ -13,10 +13,34 @@ import _ from "lodash";
 import nextConnect from "next-connect";
 import middleware from "../middleware/middleware";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 const ApiProxy = nextConnect();
 ApiProxy.use(middleware);
 
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidTempCaseRef = (value) =>
+    typeof value === "string" &&
+    value.length <= 100 &&
+    !value.includes("..") &&
+    /^[A-Za-z0-9](?:[A-Za-z0-9/-]*[A-Za-z0-9])?$/.test(value);
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
 ApiProxy.get(async (req, res) => {
     const containerName = req.query.container;
     const tempCaseRef = req.query.tempcaseref;
@@ -24,12 +48,9 @@ ApiProxy.get(async (req, res) => {
     const checkHash = req.query.hash;
 
     if (
-        typeof containerName === "undefined" ||
-        containerName.length === 0 ||
-        typeof tempCaseRef === "undefined" ||
-        tempCaseRef.length === 0 ||
-        typeof checkHash === "undefined" ||
-        checkHash.length === 0
+        !hasValue(containerName) ||
+        !hasValue(tempCaseRef) ||
+        !hasValue(checkHash)
     ) {
         return respondError(res, {
             status: 400,
@@ -38,6 +59,26 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
+    if (
+        !isValidContainer(containerName) ||
+        !isValidTempCaseRef(tempCaseRef)
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
     const hashCandidatePaths = [
         "/api/file/createappealcompletemessage_api?container=" +
             containerName +
diff --git a/pages/api/file/createappealcompletemessageproxy_api.js b/pages/api/file/createappealcompletemessageproxy_api.js
index 81d3c443..0e89180e 100644
--- a/pages/api/file/createappealcompletemessageproxy_api.js
+++ b/pages/api/file/createappealcompletemessageproxy_api.js
@@ -4,6 +4,8 @@ import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import axios from "axios";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 import nextConnect from "next-connect";
 import middleware from "../middleware/middleware";
@@ -16,6 +18,25 @@ const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
 const hasValue = (value) =>
     typeof value === "string" && value.trim().length > 0;
 
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidTempCaseRef = (value) =>
+    typeof value === "string" &&
+    value.length <= 100 &&
+    !value.includes("..") &&
+    /^[A-Za-z0-9](?:[A-Za-z0-9/-]*[A-Za-z0-9])?$/.test(value);
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
 ApiProxy.get(async (req, res) => {
     const containerName = req.query.container;
     const tempCaseRef = req.query.tempcaseref;
@@ -28,6 +49,26 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
+    if (
+        !isValidContainer(containerName) ||
+        !isValidTempCaseRef(tempCaseRef)
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
     const token = await getToken();
 
     const queryUrl =
@@ -37,9 +78,17 @@ ApiProxy.get(async (req, res) => {
         encodeURIComponent(tempCaseRef);
 
     try {
+        const requestOptions = azureHeaders(token.access_token);
+        if (typeof req.headers?.cookie === "string") {
+            requestOptions.headers = {
+                ...requestOptions.headers,
+                cookie: req.headers.cookie
+            };
+        }
+
         const { data } = await axios.get(
             BASE_URL + queryUrl + hashAPIPath(queryUrl),
-            azureHeaders(token.access_token)
+            requestOptions
         );
         return respondSuccess(res, data);
     } catch (error) {
diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index c3ba9cac..83f86e28 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -1628,7 +1628,8 @@ test("general hash endpoint does not authorize getrepsblob signing", async () =>
     let hashCalls = 0;
     const mod = loadModule("pages/api/endpoint/gethash_api.js", {
         nextConnect: createNextConnectMock(),
-        getSession: async () => ({ user: { id: "user-container" } }),
+        getServerSession: async () => ({ user: { id: "user-container" } }),
+        authOptions: () => ({}),
         hashAPIPath: () => {
             hashCalls += 1;
             return "&hash=unexpected";
@@ -1652,6 +1653,146 @@ test("general hash endpoint does not authorize getrepsblob signing", async () =>
     assert.strictEqual(hashCalls, 0);
 });
 
+const loadAppealCompletionSigning = ({ session, ...overrides } = {}) => {
+    const calls = { options: [], session: [], hash: [] };
+    const options = { id: "appeal-completion-signing-options" };
+    const resolvedSession =
+        typeof session === "undefined"
+            ? { user: { id: "owner-container" } }
+            : session;
+    const mod = loadModule("pages/api/endpoint/gethash_api.js", {
+        nextConnect: createNextConnectMock(),
+        authOptions: (req, res) => {
+            calls.options.push([req, res]);
+            return options;
+        },
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return resolvedSession;
+        },
+        hashAPIPath: (queryPath) => {
+            calls.hash.push(queryPath);
+            return "&hash=completion-capability";
+        },
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        URL,
+        ...overrides
+    });
+
+    return { mod, calls, options };
+};
+
+const appealCompletionSigningRequest = (pathValue) => ({
+    query: {
+        path:
+            pathValue ||
+            "/api/file/createappealcompletemessage_api?container=owner-container&tempcaseref=TMP-CASE-1"
+    }
+});
+
+for (const sessionCase of [
+    { name: "missing session", session: null, status: 401, code: "UNAUTHENTICATED" },
+    { name: "session without user id", session: { user: {} } },
+    { name: "session with empty user id", session: { user: { id: "" } } },
+    {
+        name: "session with non-string user id",
+        session: { user: { id: 123 } }
+    },
+    {
+        name: "foreign-container session",
+        session: { user: { id: "foreign-container" } }
+    }
+]) {
+    test(`gethash rejects appeal completion signing for ${sessionCase.name} before HMAC generation`, async () => {
+        const loaded = loadAppealCompletionSigning({ session: sessionCase.session });
+        const res = createRes();
+
+        await loaded.mod.default.handler(appealCompletionSigningRequest(), res);
+
+        assert.strictEqual(res.state.statusCode, sessionCase.status || 403);
+        assert.strictEqual(
+            res.state.jsonBody.error.code,
+            sessionCase.code || "FORBIDDEN"
+        );
+        assert.strictEqual(loaded.calls.hash.length, 0);
+    });
+}
+
+for (const pathCase of [
+    {
+        name: "missing container",
+        path: "/api/file/createappealcompletemessage_api?tempcaseref=TMP-CASE-1"
+    },
+    {
+        name: "invalid container",
+        path: "/api/file/createappealcompletemessage_api?container=Invalid_Container&tempcaseref=TMP-CASE-1"
+    },
+    {
+        name: "missing draft reference",
+        path: "/api/file/createappealcompletemessage_api?container=owner-container"
+    },
+    {
+        name: "malformed draft reference",
+        path: "/api/file/createappealcompletemessage_api?container=owner-container&tempcaseref=..%2Fforeign"
+    },
+    {
+        name: "duplicate container binding",
+        path: "/api/file/createappealcompletemessage_api?container=owner-container&container=foreign-container&tempcaseref=TMP-CASE-1"
+    },
+    {
+        name: "duplicate draft binding",
+        path: "/api/file/createappealcompletemessage_api?container=owner-container&tempcaseref=TMP-CASE-1&tempcaseref=TMP-CASE-2"
+    },
+    {
+        name: "completion route lookalike",
+        path: "/api/file/createappealcompletemessage_api-foreign?container=owner-container&tempcaseref=TMP-CASE-1"
+    }
+]) {
+    test(`gethash rejects appeal completion signing with ${pathCase.name} before HMAC generation`, async () => {
+        const loaded = loadAppealCompletionSigning();
+        const res = createRes();
+
+        await loaded.mod.default.handler(
+            appealCompletionSigningRequest(pathCase.path),
+            res
+        );
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH_PATH");
+        assert.strictEqual(loaded.calls.hash.length, 0);
+    });
+}
+
+test("gethash issues the existing appeal completion capability only to the owning session", async () => {
+    const loaded = loadAppealCompletionSigning();
+    const req = appealCompletionSigningRequest();
+    const res = createRes();
+
+    await loaded.mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+    assert.deepStrictEqual(loaded.calls.session, [[req, res, loaded.options]]);
+    assert.deepStrictEqual(loaded.calls.hash, [req.query.path]);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        hash: "&hash=completion-capability"
+    });
+});
+
+test("gethash preserves unrelated allow-listed signing without applying completion ownership", async () => {
+    const loaded = loadAppealCompletionSigning({
+        session: { user: { email: "user@test.local" } }
+    });
+    const req = appealCompletionSigningRequest("/api/file/upload");
+    const res = createRes();
+
+    await loaded.mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.hash, [req.query.path]);
+});
+
 test("getrepsblob handler dependency failure returns GET_REPS_BLOB_FAILED", async () => {
     const mod = loadModule("pages/api/file/getrepsblob.js", {
         nextConnect: createNextConnectMock(),
@@ -3216,12 +3357,488 @@ test("getawaitingsubmissionfromblobproxy dependency failure returns GET_AWAITING
     assert.strictEqual(loaded.calls.axios.length, 1);
 });
 
+const loadAppealCompletionProxy = ({ session, ...overrides } = {}) => {
+    const calls = {
+        options: [],
+        session: [],
+        token: 0,
+        hash: [],
+        headers: [],
+        axios: []
+    };
+    const options = { id: "appeal-completion-proxy-options" };
+    const payload = { status: "success" };
+    const resolvedSession =
+        typeof session === "undefined"
+            ? { user: { id: "owner-container" } }
+            : session;
+    const mod = loadModule(
+        "pages/api/file/createappealcompletemessageproxy_api.js",
+        {
+            nextConnect: createNextConnectMock(),
+            middleware: () => {},
+            respondError: respondErrorMock,
+            respondSuccess: respondSuccessMock,
+            authOptions: (req, res) => {
+                calls.options.push([req, res]);
+                return options;
+            },
+            getServerSession: async (...args) => {
+                calls.session.push(args);
+                return resolvedSession;
+            },
+            getToken: async () => {
+                calls.token += 1;
+                return { access_token: "synthetic-token" };
+            },
+            azureHeaders: (token) => {
+                calls.headers.push(token);
+                return { headers: { Authorization: `Bearer ${token}` } };
+            },
+            hashAPIPath: (queryPath) => {
+                calls.hash.push(queryPath);
+                return "&hash=synthetic-hash";
+            },
+            consoleLogger: () => {},
+            process: { env: { API_ROOT: "http://example.com" } },
+            axios: {
+                get: async (...args) => {
+                    calls.axios.push(args);
+                    return { data: payload };
+                }
+            },
+            ...overrides
+        }
+    );
+
+    return { mod, calls, options, payload };
+};
+
+const appealCompletionProxyRequest = (overrides = {}) => ({
+    query: {
+        container: "owner-container",
+        tempcaseref: "TMP-CASE-1"
+    },
+    headers: { cookie: "next-auth.session-token=synthetic-session" },
+    ...overrides
+});
+
+const assertNoAppealCompletionProxyWork = (calls) => {
+    assert.strictEqual(calls.token, 0);
+    assert.strictEqual(calls.hash.length, 0);
+    assert.strictEqual(calls.headers.length, 0);
+    assert.strictEqual(calls.axios.length, 0);
+};
+
+for (const sessionCase of [
+    { name: "missing session", session: null },
+    { name: "session without user id", session: { user: {} } },
+    { name: "session with empty user id", session: { user: { id: "" } } },
+    {
+        name: "session with non-string user id",
+        session: { user: { id: 123 } }
+    },
+    {
+        name: "cross-container session",
+        session: { user: { id: "foreign-container" } }
+    }
+]) {
+    test(`createappealcompletemessageproxy rejects ${sessionCase.name} before token, signing or submission`, async () => {
+        const loaded = loadAppealCompletionProxy({
+            session: sessionCase.session
+        });
+        const res = createRes();
+
+        await loaded.mod.default.handler(appealCompletionProxyRequest(), res);
+
+        assert.strictEqual(res.state.statusCode, 403);
+        assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+        assertNoAppealCompletionProxyWork(loaded.calls);
+    });
+}
+
+for (const inputCase of [
+    {
+        name: "invalid container",
+        query: { container: "Invalid_Container", tempcaseref: "TMP-CASE-1" }
+    },
+    {
+        name: "missing temporary case reference",
+        query: { container: "owner-container" },
+        code: "MISSING_REQUIRED_QUERY"
+    },
+    {
+        name: "malformed temporary case reference",
+        query: { container: "owner-container", tempcaseref: "../foreign" }
+    },
+    {
+        name: "array temporary case reference",
+        query: { container: "owner-container", tempcaseref: ["TMP-CASE-1"] },
+        code: "MISSING_REQUIRED_QUERY"
+    }
+]) {
+    test(`createappealcompletemessageproxy rejects ${inputCase.name} before authentication or submission`, async () => {
+        const loaded = loadAppealCompletionProxy();
+        const res = createRes();
+
+        await loaded.mod.default.handler(
+            appealCompletionProxyRequest({ query: inputCase.query }),
+            res
+        );
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(
+            res.state.jsonBody.error.code,
+            inputCase.code || "INVALID_REQUEST"
+        );
+        assert.strictEqual(loaded.calls.options.length, 0);
+        assert.strictEqual(loaded.calls.session.length, 0);
+        assertNoAppealCompletionProxyWork(loaded.calls);
+    });
+}
+
+test("createappealcompletemessageproxy preserves owner submission and forwards the authenticated cookie", async () => {
+    const loaded = loadAppealCompletionProxy();
+    const req = appealCompletionProxyRequest();
+    const res = createRes();
+
+    await loaded.mod.default.handler(req, res);
+
+    const expectedPath =
+        "/api/file/createappealcompletemessage_api?container=owner-container&tempcaseref=TMP-CASE-1";
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+    assert.deepStrictEqual(loaded.calls.session, [[req, res, loaded.options]]);
+    assert.strictEqual(loaded.calls.token, 1);
+    assert.deepStrictEqual(loaded.calls.hash, [expectedPath]);
+    assert.deepStrictEqual(loaded.calls.headers, ["synthetic-token"]);
+    assert.strictEqual(loaded.calls.axios.length, 1);
+    assert.strictEqual(
+        loaded.calls.axios[0][0],
+        `http://example.com${expectedPath}&hash=synthetic-hash`
+    );
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(loaded.calls.axios[0][1])),
+        {
+            headers: {
+                Authorization: "Bearer synthetic-token",
+                cookie: "next-auth.session-token=synthetic-session"
+            }
+        }
+    );
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(res.state.jsonBody)),
+        loaded.payload
+    );
+});
+
+const loadAppealCompletionDirect = ({ session, ...overrides } = {}) => {
+    const calls = {
+        options: [],
+        session: [],
+        hash: [],
+        progress: [],
+        download: [],
+        createBlob: [],
+        caseBlob: [],
+        account: [],
+        queue: []
+    };
+    const options = { id: "appeal-completion-direct-options" };
+    const resolvedSession =
+        typeof session === "undefined"
+            ? { user: { id: "owner-container" } }
+            : session;
+    const progress = {
+        pinswg_siteaddressline1: "Line 1",
+        pinswg_siteaddressline2: "",
+        pinswg_siteaddresstown: "Town",
+        pinswg_siteaddresscounty: "County",
+        pinswg_siteaddresspostcode: "CF1 1AA",
+        pinswg_lpaapplicationreference: "LPA-1",
+        pinswg_developmentdescription: "Description",
+        pinswg_name: "draft-name"
+    };
+    const caseObject = {
+        "customerid_contact@odata.bind":
+            "/contacts(00000000-0000-0000-0000-000000000001)"
+    };
+    const mod = loadModule("pages/api/file/createappealcompletemessage_api.js", {
+        nextConnect: createNextConnectMock(),
+        middleware: () => {},
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        authOptions: (req, res) => {
+            calls.options.push([req, res]);
+            return options;
+        },
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return resolvedSession;
+        },
+        hashAPIPath: (queryPath) => {
+            calls.hash.push(queryPath);
+            return "&hash=expected";
+        },
+        getProgressBlobs: async (...args) => {
+            calls.progress.push(args);
+            return { path: "TMP-CASE-1/progress.json" };
+        },
+        downloadProgressFile: async (...args) => {
+            calls.download.push(args);
+            return args[1].endsWith("_case.json")
+                ? { ...caseObject }
+                : { ...progress };
+        },
+        createBlob: async (...args) => {
+            calls.createBlob.push(args);
+            return {};
+        },
+        getCaseBlob: async (...args) => {
+            calls.caseBlob.push(args);
+            return {};
+        },
+        updateAccount: async (...args) => {
+            calls.account.push(args);
+            return {};
+        },
+        createCaseCompleteMessage: async (...args) => {
+            calls.queue.push(args);
+            return {};
+        },
+        consoleLogger: () => {},
+        _: { isEmpty: (value) => value === undefined || value === null || value === "" },
+        ...overrides
+    });
+
+    return { mod, calls, options };
+};
+
+const appealCompletionDirectRequest = (overrides = {}) => ({
+    query: {
+        container: "owner-container",
+        tempcaseref: "TMP-CASE-1",
+        inv: "846040001",
+        hash: "expected"
+    },
+    ...overrides
+});
+
+const assertNoAppealCompletionEffects = (calls) => {
+    assert.strictEqual(calls.progress.length, 0);
+    assert.strictEqual(calls.download.length, 0);
+    assert.strictEqual(calls.createBlob.length, 0);
+    assert.strictEqual(calls.caseBlob.length, 0);
+    assert.strictEqual(calls.account.length, 0);
+    assert.strictEqual(calls.queue.length, 0);
+};
+
+for (const sessionCase of [
+    { name: "missing session", session: null },
+    { name: "session without user id", session: { user: {} } },
+    { name: "session with empty user id", session: { user: { id: "" } } },
+    {
+        name: "session with non-string user id",
+        session: { user: { id: 123 } }
+    },
+    {
+        name: "cross-container session",
+        session: { user: { id: "foreign-container" } }
+    }
+]) {
+    test(`createappealcompletemessage_api blocks direct bypass with ${sessionCase.name} before HMAC or side effects`, async () => {
+        const loaded = loadAppealCompletionDirect({ session: sessionCase.session });
+        const res = createRes();
+
+        await loaded.mod.default.handler(appealCompletionDirectRequest(), res);
+
+        assert.strictEqual(res.state.statusCode, 403);
+        assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+        assert.strictEqual(loaded.calls.hash.length, 0);
+        assertNoAppealCompletionEffects(loaded.calls);
+    });
+}
+
+for (const inputCase of [
+    {
+        name: "invalid container",
+        query: {
+            container: "Invalid_Container",
+            tempcaseref: "TMP-CASE-1",
+            hash: "expected"
+        }
+    },
+    {
+        name: "missing temporary case reference",
+        query: { container: "owner-container", hash: "expected" },
+        code: "MISSING_REQUIRED_QUERY"
+    },
+    {
+        name: "malformed temporary case reference",
+        query: {
+            container: "owner-container",
+            tempcaseref: "../foreign",
+            hash: "expected"
+        }
+    }
+]) {
+    test(`createappealcompletemessage_api rejects ${inputCase.name} before authentication or side effects`, async () => {
+        const loaded = loadAppealCompletionDirect();
+        const res = createRes();
+
+        await loaded.mod.default.handler(
+            appealCompletionDirectRequest({ query: inputCase.query }),
+            res
+        );
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(
+            res.state.jsonBody.error.code,
+            inputCase.code || "INVALID_REQUEST"
+        );
+        assert.strictEqual(loaded.calls.options.length, 0);
+        assert.strictEqual(loaded.calls.session.length, 0);
+        assert.strictEqual(loaded.calls.hash.length, 0);
+        assertNoAppealCompletionEffects(loaded.calls);
+    });
+}
+
+for (const hashCase of [
+    { name: "missing HMAC", hash: undefined },
+    { name: "invalid HMAC", hash: "wrong" }
+]) {
+    test(`createappealcompletemessage_api rejects ${hashCase.name} after owner authentication and before side effects`, async () => {
+        const loaded = loadAppealCompletionDirect();
+        const request = appealCompletionDirectRequest();
+        const res = createRes();
+
+        if (typeof hashCase.hash === "undefined") delete request.query.hash;
+        else request.query.hash = hashCase.hash;
+        await loaded.mod.default.handler(request, res);
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assertNoAppealCompletionEffects(loaded.calls);
+    });
+}
+
+for (const resourceCase of [
+    {
+        name: "another container",
+        query: {
+            container: "other-container",
+            tempcaseref: "TMP-CASE-1",
+            inv: "846040001",
+            hash: "expected"
+        },
+        session: { user: { id: "other-container" } }
+    },
+    {
+        name: "another draft folder",
+        query: {
+            container: "owner-container",
+            tempcaseref: "TMP-CASE-2",
+            inv: "846040001",
+            hash: "expected"
+        }
+    }
+]) {
+    test(`createappealcompletemessage_api rejects an HMAC issued for ${resourceCase.name}`, async () => {
+        const loaded = loadAppealCompletionDirect({
+            session: resourceCase.session,
+            hashAPIPath: (queryPath) => {
+                loaded.calls.hash.push(queryPath);
+                return queryPath ===
+                    "/api/file/createappealcompletemessage_api?container=owner-container&tempcaseref=TMP-CASE-1"
+                    ? "&hash=expected"
+                    : "&hash=other";
+            }
+        });
+        const res = createRes();
+
+        await loaded.mod.default.handler(
+            appealCompletionDirectRequest({ query: resourceCase.query }),
+            res
+        );
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
+        assertNoAppealCompletionEffects(loaded.calls);
+    });
+}
+
+test("createappealcompletemessage_api rejects a capability for another operation", async () => {
+    const loaded = loadAppealCompletionDirect({
+        hashAPIPath: (queryPath) => {
+            loaded.calls.hash.push(queryPath);
+            return queryPath.startsWith("/api/file/deleteblob?")
+                ? "&hash=expected"
+                : "&hash=other";
+        }
+    });
+    const res = createRes();
+
+    await loaded.mod.default.handler(appealCompletionDirectRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
+    assertNoAppealCompletionEffects(loaded.calls);
+});
+
+test("createappealcompletemessage_api preserves owner payloads and downstream completion calls", async () => {
+    const loaded = loadAppealCompletionDirect();
+    const req = appealCompletionDirectRequest();
+    const res = createRes();
+
+    await loaded.mod.default.handler(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+    assert.deepStrictEqual(loaded.calls.session, [[req, res, loaded.options]]);
+    assert.deepStrictEqual(loaded.calls.progress, [
+        ["owner-container", "TMP-CASE-1"]
+    ]);
+    assert.deepStrictEqual(loaded.calls.download, [
+        ["owner-container", "TMP-CASE-1/progress.json", "TMP-CASE-1"],
+        [
+            "owner-container",
+            "TMP-CASE-1/TMP-CASE-1_case.json",
+            "TMP-CASE-1"
+        ]
+    ]);
+    const savedProgress = JSON.parse(loaded.calls.createBlob[0][0]);
+    assert.strictEqual(savedProgress.appealComplete, "TMP-CASE-1");
+    assert.strictEqual(Object.hasOwn(savedProgress, "pinswg_name"), false);
+    assert.deepStrictEqual(loaded.calls.createBlob[0].slice(1), [
+        "owner-container",
+        "TMP-CASE-1"
+    ]);
+    assert.strictEqual(loaded.calls.caseBlob.length, 1);
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(loaded.calls.account)),
+        [
+            [
+                "00000000-0000-0000-0000-000000000001",
+                { pinswg_typeofinvolvement: 846040001 },
+                true
+            ]
+        ]
+    );
+    assert.deepStrictEqual(loaded.calls.queue, [
+        ["owner-container", "TMP-CASE-1"]
+    ]);
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        status: "success"
+    });
+});
+
 test("createappealcompletemessageproxy dependency failure returns CREATE_APPEAL_COMPLETE_MESSAGE_PROXY_FAILED", async () => {
     const mod = loadModule(
         "pages/api/file/createappealcompletemessageproxy_api.js",
         {
             nextConnect: createNextConnectMock(),
             middleware: () => {},
+            getServerSession: async () => ({ user: { id: "container-1" } }),
+            authOptions: () => ({}),
             respondError: respondErrorMock,
             respondSuccess: respondSuccessMock,
             getToken: async () => ({ access_token: "tok" }),
@@ -3238,7 +3855,8 @@ test("createappealcompletemessageproxy dependency failure returns CREATE_APPEAL_
     );
 
     const req = {
-        query: { container: "c1", tempcaseref: "TMP1" }
+        query: { container: "container-1", tempcaseref: "TMP1" },
+        headers: { cookie: "next-auth.session-token=synthetic" }
     };
     const res = createRes();
     await mod.default.handler(req, res);
@@ -3256,6 +3874,8 @@ test("createappealcompletemessage_api accepts encoded hash variant and returns s
         {
             nextConnect: createNextConnectMock(),
             middleware: () => {},
+            getServerSession: async () => ({ user: { id: "container-1" } }),
+            authOptions: () => ({}),
             respondError: respondErrorMock,
             respondSuccess: respondSuccessMock,
             hashAPIPath: (queryPath) =>
@@ -3293,7 +3913,7 @@ test("createappealcompletemessage_api accepts encoded hash variant and returns s
 
     const req = {
         query: {
-            container: "cont/1",
+            container: "container-1",
             tempcaseref: "TMP/1",
             inv: "846040001",
             hash: "expected"
@@ -3314,6 +3934,8 @@ test("createappealcompletemessage_api dependency failure returns CREATE_APPEAL_C
         {
             nextConnect: createNextConnectMock(),
             middleware: () => {},
+            getServerSession: async () => ({ user: { id: "owner-container" } }),
+            authOptions: () => ({}),
             respondError: respondErrorMock,
             respondSuccess: respondSuccessMock,
             hashAPIPath: () => "&hash=expected",
@@ -3327,7 +3949,7 @@ test("createappealcompletemessage_api dependency failure returns CREATE_APPEAL_C
 
     const req = {
         query: {
-            container: "c1",
+            container: "owner-container",
             tempcaseref: "TMP1",
             hash: "expected"
         }

From 93bf7e174fea59c7c6b920f65f0c42494af65e90 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Thu, 5 Nov 2026 14:11:45 +0000
Subject: [PATCH 09/24] fix(security): enforce ownership on private draft PDF
 generation

---
 pages/api/file/generateappealpdf.js          |  88 +++-
 pages/api/file/generatepdf.js                |  95 +++-
 tests/phase21/file-handler-contract.test.cjs | 488 +++++++++++++++++--
 3 files changed, 627 insertions(+), 44 deletions(-)

diff --git a/pages/api/file/generateappealpdf.js b/pages/api/file/generateappealpdf.js
index 34fc1119..3f014bbc 100644
--- a/pages/api/file/generateappealpdf.js
+++ b/pages/api/file/generateappealpdf.js
@@ -85,27 +85,68 @@ import { getPickLists } from "../../../actions/services/referenceDataService";
 import { planningappeals78_pdf } from "../../../components/pdftemplates/planningappeals78_pdf";
 import { other_pdf } from "../../../components/pdftemplates/other_pdf";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 //const ApiProxy = nextConnect();
 // ApiProxy.use(middleware);
 
 // ApiProxy.post(async (req, res) => {
 
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidDraftFolder = (value) =>
+    typeof value === "string" &&
+    value.length <= 100 &&
+    !value.includes("..") &&
+    /^[A-Za-z0-9](?:[A-Za-z0-9/-]*[A-Za-z0-9])?$/.test(value);
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
 export default async function handler(req, res) {
     const checkHash = req.query.hash;
     const appealType = req.query.appealType;
     const isDownload = req.query?.download === "true";
 
-    let appealBodyObj =
-        typeof req.body === "string" ? JSON.parse(req.body) : req.body;
+    let appealBodyObj;
+    try {
+        appealBodyObj =
+            typeof req.body === "string" ? JSON.parse(req.body) : req.body;
+    } catch (_error) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    if (
+        !appealBodyObj ||
+        typeof appealBodyObj !== "object" ||
+        Array.isArray(appealBodyObj)
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
     const containerID = appealBodyObj.containerID;
     const casefolderID = appealBodyObj.casefolderID;
     const locale = appealBodyObj.locale || "en";
     let checkquerypath = "/api/file/generateappealpdf";
 
     if (
-        typeof checkHash === "undefined" ||
-        checkHash.length === 0 ||
         typeof appealType === "undefined" ||
         String(appealType).length === 0 ||
         typeof containerID === "undefined" ||
@@ -121,6 +162,45 @@ export default async function handler(req, res) {
         });
     }
 
+    if (
+        typeof appealType !== "string" ||
+        !isValidContainer(containerID) ||
+        !isValidDraftFolder(casefolderID) ||
+        (typeof req.query.download !== "undefined" &&
+            typeof req.query.download !== "string") ||
+        [
+            "container",
+            "containerID",
+            "casefolderID",
+            "caseRef",
+            "ticketnumber"
+        ].some((key) => Object.prototype.hasOwnProperty.call(req.query, key))
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerID
+    ) {
+        return forbidden(res);
+    }
+
+    if (typeof checkHash !== "string" || checkHash.length === 0) {
+        return respondError(res, {
+            status: 400,
+            code: "MISSING_REQUIRED_QUERY",
+            message:
+                "hash, appealType, containerID and casefolderID are required"
+        });
+    }
+
     checkquerypath =
         checkquerypath +
         "?appealType=" +
diff --git a/pages/api/file/generatepdf.js b/pages/api/file/generatepdf.js
index 9963dd9f..67d7e05d 100644
--- a/pages/api/file/generatepdf.js
+++ b/pages/api/file/generatepdf.js
@@ -84,16 +84,58 @@ import { writtenStatement_pdf } from "../../../components/pdftemplates/writtenSt
 import { other_pdf } from "../../../components/pdftemplates/other_pdf";
 import { consoleLogger } from "../../../actions/core/logger";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 //const ApiProxy = nextConnect();
 // ApiProxy.use(middleware);
 
 // ApiProxy.post(async (req, res) => {
 
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidDraftFolder = (value) =>
+    typeof value === "string" &&
+    value.length <= 100 &&
+    !value.includes("..") &&
+    /^[A-Za-z0-9](?:[A-Za-z0-9/-]*[A-Za-z0-9])?$/.test(value);
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
 export default async function handler(req, res) {
     const shouldDownload = req.query.download === "true";
     const checkHash = req.query.hash;
-    let reqBodyobj =
-        typeof req.body === "string" ? JSON.parse(req.body) : req.body;
+    let reqBodyobj;
+    try {
+        reqBodyobj =
+            typeof req.body === "string" ? JSON.parse(req.body) : req.body;
+    } catch (_error) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    if (
+        !reqBodyobj ||
+        typeof reqBodyobj !== "object" ||
+        Array.isArray(reqBodyobj)
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
 
     const cleanFilesList = (blobList) => {
         let newblobList = Array.isArray(blobList?.filesList)
@@ -164,7 +206,54 @@ export default async function handler(req, res) {
         checkquerypath += "?download=true";
     }
 
-    if (typeof checkHash === "undefined" || checkHash.length === 0) {
+    if (
+        typeof containerID === "undefined" ||
+        String(containerID).length === 0 ||
+        typeof caseRef === "undefined" ||
+        String(caseRef).length === 0
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "MISSING_REQUIRED_QUERY",
+            message: "containerID and case reference are required"
+        });
+    }
+
+    if (
+        !isValidContainer(containerID) ||
+        !isValidDraftFolder(caseRef) ||
+        ["ticketnumber", "caseRef"].some(
+            (key) =>
+                Object.prototype.hasOwnProperty.call(reqBodyobj, key) &&
+                !isValidDraftFolder(reqBodyobj[key])
+        ) ||
+        (typeof req.query.download !== "undefined" &&
+            typeof req.query.download !== "string") ||
+        [
+            "container",
+            "containerID",
+            "casefolderID",
+            "caseRef",
+            "ticketnumber"
+        ].some((key) => Object.prototype.hasOwnProperty.call(req.query, key))
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerID
+    ) {
+        return forbidden(res);
+    }
+
+    if (typeof checkHash !== "string" || checkHash.length === 0) {
         return respondError(res, {
             status: 400,
             code: "HASH_REQUIRED",
diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index 83f86e28..cb195bab 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -4795,77 +4795,491 @@ test("generateappealpdfcopy catch path returns APPEAL_PDF_COPY_GENERATION_FAILED
     );
 });
 
-test("generatepdf catch path returns GENERATE_PDF_FAILED", async () => {
+const PDF_OWNER_CONTAINER = "owner-container";
+const PDF_CASE_FOLDER = "CASE-1";
+
+const loadGeneratePdf = (overrides = {}) => {
     const { Readable } = require("stream");
+    const calls = {
+        session: [],
+        options: [],
+        hash: [],
+        render: [],
+        create: []
+    };
+    const options = { id: "generate-pdf-options" };
     const mod = loadModule("pages/api/file/generatepdf.js", {
         Buffer,
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        hashAPIPath: () => "&hash=expected",
+        authOptions: (req, res) => {
+            calls.options.push([req, res]);
+            return options;
+        },
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return { user: { id: PDF_OWNER_CONTAINER } };
+        },
+        hashAPIPath: (queryPath) => {
+            calls.hash.push(queryPath);
+            return queryPath.includes("?")
+                ? "&hash=expected"
+                : "?hash=expected";
+        },
         consoleLogger: () => {},
         ReactPDF: {
-            renderToStream: async () => Readable.from(["pdf"])
+            renderToStream: async (...args) => {
+                calls.render.push(args);
+                return Readable.from(["pdf"]);
+            }
         },
-        createRepPDFBlob: async () => {
-            throw new Error("pdf write failed");
+        createRepPDFBlob: async (...args) => {
+            calls.create.push(args);
+            return { id: "representation-pdf" };
         },
-        other_pdf: () => ({ type: "other" })
+        other_pdf: () => ({ type: "other" }),
+        ...overrides
     });
 
-    const req = {
+    return { mod, calls, options };
+};
+
+const generatePdfRequest = (overrides = {}) => ({
+    method: "POST",
+    query: { hash: "expected" },
+    body: {
+        representationType: "Other",
+        repfile_name: "rep-file",
+        containerID: PDF_OWNER_CONTAINER,
+        caseRef: PDF_CASE_FOLDER
+    },
+    ...overrides
+});
+
+const loadGenerateAppealPdf = (overrides = {}) => {
+    const { Readable } = require("stream");
+    const calls = {
+        session: [],
+        options: [],
+        hash: [],
+        temp: [],
+        progress: [],
+        download: [],
+        pickLists: [],
+        render: [],
+        create: []
+    };
+    const options = { id: "generate-appeal-pdf-options" };
+    const mod = loadModule("pages/api/file/generateappealpdf.js", {
+        Buffer,
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        authOptions: (req, res) => {
+            calls.options.push([req, res]);
+            return options;
+        },
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return { user: { id: PDF_OWNER_CONTAINER } };
+        },
+        hashAPIPath: (queryPath) => {
+            calls.hash.push(queryPath);
+            return "&hash=expected";
+        },
+        getTempCaseBlob: async (...args) => {
+            calls.temp.push(args);
+            return { ticketnumber: PDF_CASE_FOLDER };
+        },
+        getProgressBlobs: async (...args) => {
+            calls.progress.push(args);
+            return { path: `${PDF_CASE_FOLDER}/progress.json` };
+        },
+        downloadProgressFile: async (...args) => {
+            calls.download.push(args);
+            return {
+                pinswg_name: PDF_CASE_FOLDER,
+                pinswg_appealcasetype: "846040000"
+            };
+        },
+        getPickLists: async (...args) => {
+            calls.pickLists.push(args);
+            return {};
+        },
+        planningappeals78_pdf: () => ({ type: "planning" }),
+        other_pdf: () => ({ type: "other" }),
+        ReactPDF: {
+            renderToStream: async (...args) => {
+                calls.render.push(args);
+                return Readable.from(["pdf"]);
+            }
+        },
+        createAppealPDFBlob: async (...args) => {
+            calls.create.push(args);
+            return { id: "appeal-pdf" };
+        },
+        ...overrides
+    });
+
+    return { mod, calls, options };
+};
+
+const generateAppealPdfRequest = (overrides = {}) => ({
+    method: "POST",
+    query: { hash: "expected", appealType: "846040000" },
+    body: {
+        containerID: PDF_OWNER_CONTAINER,
+        casefolderID: PDF_CASE_FOLDER,
+        filesList: []
+    },
+    ...overrides
+});
+
+const assertNoGeneratePdfWork = (calls) => {
+    assert.strictEqual(calls.render.length, 0);
+    assert.strictEqual(calls.create.length, 0);
+};
+
+const assertNoGenerateAppealPdfWork = (calls) => {
+    assert.strictEqual(calls.temp.length, 0);
+    assert.strictEqual(calls.progress.length, 0);
+    assert.strictEqual(calls.download.length, 0);
+    assert.strictEqual(calls.pickLists.length, 0);
+    assert.strictEqual(calls.render.length, 0);
+    assert.strictEqual(calls.create.length, 0);
+};
+
+for (const endpoint of [
+    {
+        name: "generatepdf",
+        load: loadGeneratePdf,
+        request: generatePdfRequest,
+        assertNoWork: assertNoGeneratePdfWork
+    },
+    {
+        name: "generateappealpdf",
+        load: loadGenerateAppealPdf,
+        request: generateAppealPdfRequest,
+        assertNoWork: assertNoGenerateAppealPdfWork
+    }
+]) {
+    for (const sessionCase of [
+        { name: "missing session", session: null },
+        { name: "missing session user id", session: { user: {} } },
+        { name: "empty session user id", session: { user: { id: "" } } },
+        {
+            name: "non-string session user id",
+            session: { user: { id: 123 } }
+        }
+    ]) {
+        test(`${endpoint.name} rejects ${sessionCase.name} before privileged work`, async () => {
+            const loaded = endpoint.load({
+                getServerSession: async () => sessionCase.session
+            });
+            const res = createRes();
+
+            await loaded.mod.default(endpoint.request(), res);
+
+            assert.strictEqual(res.state.statusCode, 403);
+            assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+            endpoint.assertNoWork(loaded.calls);
+        });
+    }
+
+    test(`${endpoint.name} rejects another user's container before privileged work`, async () => {
+        const loaded = endpoint.load({
+            getServerSession: async () => ({ user: { id: "different-container" } })
+        });
+        const res = createRes();
+
+        await loaded.mod.default(endpoint.request(), res);
+
+        assert.strictEqual(res.state.statusCode, 403);
+        assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+        endpoint.assertNoWork(loaded.calls);
+    });
+
+    test(`${endpoint.name} ignores a client-provided user identity`, async () => {
+        const loaded = endpoint.load({
+            getServerSession: async () => ({ user: { id: "different-container" } })
+        });
+        const req = endpoint.request();
+        req.body.userID = PDF_OWNER_CONTAINER;
+        const res = createRes();
+
+        await loaded.mod.default(req, res);
+
+        assert.strictEqual(res.state.statusCode, 403);
+        endpoint.assertNoWork(loaded.calls);
+    });
+
+    test(`${endpoint.name} passes req, res and request-scoped auth options to getServerSession`, async () => {
+        const loaded = endpoint.load();
+        const req = endpoint.request();
+        const res = createRes();
+
+        await loaded.mod.default(req, res);
+
+        assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+        assert.deepStrictEqual(loaded.calls.session, [
+            [req, res, loaded.options]
+        ]);
+    });
+}
+
+for (const containerCase of [
+    { name: "missing", value: undefined },
+    { name: "invalid", value: "Invalid_Container" },
+    { name: "ambiguous", value: [PDF_OWNER_CONTAINER] }
+]) {
+    test(`generatepdf rejects ${containerCase.name} container before privileged work`, async () => {
+        const loaded = loadGeneratePdf();
+        const req = generatePdfRequest();
+        if (typeof containerCase.value === "undefined") {
+            delete req.body.containerID;
+        } else {
+            req.body.containerID = containerCase.value;
+        }
+        const res = createRes();
+
+        await loaded.mod.default(req, res);
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assertNoGeneratePdfWork(loaded.calls);
+    });
+
+    test(`generateappealpdf rejects ${containerCase.name} container before privileged work`, async () => {
+        const loaded = loadGenerateAppealPdf();
+        const req = generateAppealPdfRequest();
+        if (typeof containerCase.value === "undefined") {
+            delete req.body.containerID;
+        } else {
+            req.body.containerID = containerCase.value;
+        }
+        const res = createRes();
+
+        await loaded.mod.default(req, res);
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assertNoGenerateAppealPdfWork(loaded.calls);
+    });
+}
+
+test("generatepdf rejects missing draft-folder identifiers", async () => {
+    const loaded = loadGeneratePdf();
+    const res = createRes();
+
+    await loaded.mod.default(
+        generatePdfRequest({
+            body: {
+                representationType: "Other",
+                repfile_name: "rep-file",
+                containerID: PDF_OWNER_CONTAINER
+            }
+        }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assertNoGeneratePdfWork(loaded.calls);
+});
+
+test("generateappealpdf rejects missing or malformed draft-folder identifiers", async () => {
+    for (const value of [undefined, "../CASE-1", [PDF_CASE_FOLDER]]) {
+        const loaded = loadGenerateAppealPdf();
+        const req = generateAppealPdfRequest();
+        if (typeof value === "undefined") {
+            delete req.body.casefolderID;
+        } else {
+            req.body.casefolderID = value;
+        }
+        const res = createRes();
+        await loaded.mod.default(req, res);
+        assert.strictEqual(res.state.statusCode, 400);
+        assertNoGenerateAppealPdfWork(loaded.calls);
+    }
+});
+
+for (const endpoint of [
+    {
+        name: "generatepdf",
+        load: loadGeneratePdf,
+        request: generatePdfRequest,
+        assertNoWork: assertNoGeneratePdfWork
+    },
+    {
+        name: "generateappealpdf",
+        load: loadGenerateAppealPdf,
+        request: generateAppealPdfRequest,
+        assertNoWork: assertNoGenerateAppealPdfWork
+    }
+]) {
+    test(`${endpoint.name} rejects a query/body container ambiguity`, async () => {
+        const loaded = endpoint.load();
+        const req = endpoint.request();
+        req.query.containerID = PDF_OWNER_CONTAINER;
+        const res = createRes();
+        await loaded.mod.default(req, res);
+        assert.strictEqual(res.state.statusCode, 400);
+        endpoint.assertNoWork(loaded.calls);
+    });
+
+    test(`${endpoint.name} rejects missing HMAC before privileged work`, async () => {
+        const loaded = endpoint.load();
+        const req = endpoint.request();
+        delete req.query.hash;
+        const res = createRes();
+        await loaded.mod.default(req, res);
+        assert.strictEqual(res.state.statusCode, 400);
+        endpoint.assertNoWork(loaded.calls);
+    });
+
+    test(`${endpoint.name} rejects invalid HMAC before privileged work`, async () => {
+        const loaded = endpoint.load();
+        const req = endpoint.request();
+        req.query.hash = "wrong";
+        const res = createRes();
+        await loaded.mod.default(req, res);
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
+        endpoint.assertNoWork(loaded.calls);
+    });
+
+    test(`${endpoint.name} rejects a valid HMAC for an unauthorised container`, async () => {
+        const loaded = endpoint.load({
+            getServerSession: async () => ({ user: { id: "different-container" } })
+        });
+        const res = createRes();
+        await loaded.mod.default(endpoint.request(), res);
+        assert.strictEqual(res.state.statusCode, 403);
+        endpoint.assertNoWork(loaded.calls);
+    });
+}
+
+test("generatepdf owner success writes the PDF to the authorised container", async () => {
+    const loaded = loadGeneratePdf();
+    const res = createRes();
+
+    await loaded.mod.default(generatePdfRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(loaded.calls.render.length, 1);
+    assert.strictEqual(loaded.calls.create.length, 1);
+    assert.strictEqual(loaded.calls.create[0][1], PDF_OWNER_CONTAINER);
+    assert.strictEqual(loaded.calls.create[0][2], PDF_CASE_FOLDER);
+    assert.strictEqual(loaded.calls.create[0][3], "rep-file");
+    assert.strictEqual(res.state.jsonBody.status, "success");
+});
+
+test("generatepdf preserves ticketnumber precedence when references differ", async () => {
+    const loaded = loadGeneratePdf();
+    const res = createRes();
+
+    await loaded.mod.default(
+        generatePdfRequest({
+            body: {
+                representationType: "Other",
+                repfile_name: "rep-file",
+                containerID: PDF_OWNER_CONTAINER,
+                ticketnumber: PDF_CASE_FOLDER,
+                caseRef: "CASE-2"
+            }
+        }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(loaded.calls.create.length, 1);
+    assert.strictEqual(loaded.calls.create[0][1], PDF_OWNER_CONTAINER);
+    assert.strictEqual(loaded.calls.create[0][2], PDF_CASE_FOLDER);
+    assert.strictEqual(res.state.jsonBody.status, "success");
+});
+
+test("generatepdf rejects malformed secondary case references", async () => {
+    const loaded = loadGeneratePdf();
+    const res = createRes();
+
+    await loaded.mod.default(
+        generatePdfRequest({
+            body: {
+                representationType: "Other",
+                repfile_name: "rep-file",
+                containerID: PDF_OWNER_CONTAINER,
+                ticketnumber: PDF_CASE_FOLDER,
+                caseRef: "../other-case"
+            }
+        }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assertNoGeneratePdfWork(loaded.calls);
+});
+
+test("generateappealpdf owner success reads and writes only the authorised container", async () => {
+    const loaded = loadGenerateAppealPdf();
+    const res = createRes();
+
+    await loaded.mod.default(generateAppealPdfRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(loaded.calls.temp[0][0], PDF_OWNER_CONTAINER);
+    assert.strictEqual(loaded.calls.progress[0][0], PDF_OWNER_CONTAINER);
+    assert.strictEqual(loaded.calls.download[0][0], PDF_OWNER_CONTAINER);
+    assert.strictEqual(loaded.calls.create[0][1], PDF_OWNER_CONTAINER);
+    assert.strictEqual(loaded.calls.create[0][2], PDF_CASE_FOLDER);
+    assert.strictEqual(res.state.jsonBody.status, "success");
+});
+
+test("generatepdf catch path returns GENERATE_PDF_FAILED for an authorised owner", async () => {
+    const loaded = loadGeneratePdf({
+        createRepPDFBlob: async (...args) => {
+            loaded.calls.create.push(args);
+            throw new Error("pdf write failed");
+        }
+    });
+    const req = generatePdfRequest({
         query: { hash: "expected", download: "true" },
         body: {
             representationType: "Other",
             repfile_name: "rep-file",
-            containerID: "c1",
-            casefolderID: "f1",
-            caseRef: "CAS-1"
+            containerID: PDF_OWNER_CONTAINER,
+            caseRef: PDF_CASE_FOLDER
         }
-    };
+    });
     const res = createRes();
-    await mod.default(req, res);
+    await loaded.mod.default(req, res);
 
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(res.state.jsonBody.error.code, "GENERATE_PDF_FAILED");
+    assert.strictEqual(loaded.calls.render.length, 1);
+    assert.strictEqual(loaded.calls.create.length, 1);
 });
 
-test("generateappealpdf catch path returns GENERATE_APPEAL_PDF_FAILED", async () => {
-    const mod = loadModule("pages/api/file/generateappealpdf.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        hashAPIPath: () => "&hash=expected",
-        getTempCaseBlob: async () => ({ ticketnumber: "CAS-1" }),
-        getProgressBlobs: async () => ({ path: "CAS-1/progress.json" }),
+test("generateappealpdf catch path returns GENERATE_APPEAL_PDF_FAILED for an authorised owner", async () => {
+    const loaded = loadGenerateAppealPdf({
         downloadProgressFile: async () => {
+            loaded.calls.download.push([
+                PDF_OWNER_CONTAINER,
+                `${PDF_CASE_FOLDER}/progress.json`,
+                PDF_CASE_FOLDER
+            ]);
             throw new Error("progress failed");
-        },
-        getPickLists: async () => ({}),
-        planningappeals78_pdf: () => ({ type: "planning" }),
-        other_pdf: () => ({ type: "other" }),
-        ReactPDF: {
-            renderToStream: async () => {
-                throw new Error("render failed");
-            }
         }
     });
 
-    const req = {
-        query: { hash: "expected", appealType: "846040000" },
-        body: {
-            containerID: "c1",
-            casefolderID: "f1",
-            caseRef: "CAS-1",
-            filesList: []
-        }
-    };
     const res = createRes();
-    await mod.default(req, res);
+    await loaded.mod.default(generateAppealPdfRequest(), res);
 
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(
         res.state.jsonBody.error.code,
         "GENERATE_APPEAL_PDF_FAILED"
     );
+    assert.strictEqual(loaded.calls.temp.length, 1);
+    assert.strictEqual(loaded.calls.progress.length, 1);
+    assert.strictEqual(loaded.calls.download.length, 1);
+    assert.strictEqual(loaded.calls.render.length, 0);
+    assert.strictEqual(loaded.calls.create.length, 0);
 });
 
 const run = async () => {

From 9b0cb9adc87b3058d6b4989b7647848867d055fd Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Thu, 5 Nov 2026 16:37:10 +0000
Subject: [PATCH 10/24] fix(security): retire legacy direct CRM case creation
 endpoint

---
 actions/services/caseDirectService.js         |  29 ----
 actions/services/caseService.js               |   2 -
 components/newappeal/createCase.js            |   7 -
 pages/api/endpoint/createcase_api.js          | 150 ------------------
 pages/api/endpoint/createcrmtask_api.js       |  43 -----
 .../endpoint-handler-contract.test.cjs        |  78 +--------
 6 files changed, 6 insertions(+), 303 deletions(-)
 delete mode 100644 pages/api/endpoint/createcase_api.js

diff --git a/actions/services/caseDirectService.js b/actions/services/caseDirectService.js
index 04c4649d..253c3c23 100644
--- a/actions/services/caseDirectService.js
+++ b/actions/services/caseDirectService.js
@@ -76,35 +76,6 @@ export const getAppealID = (
         });
 };
 
-export const createNewCase = (
-    appealTypeId,
-    lpaID,
-    contactid,
-    createBody,
-    containerName
-) => {
-    appealTypeId = parseInt(appealTypeId);
-
-    var data = createBody;
-
-    var queryUrl = buildFileQuery("/api/endpoint/createcase_api", {
-        appealTypeId,
-        lpaID,
-        contactid,
-        containername: containerName
-    });
-
-    var config = {
-        method: "post",
-        url: withBaseUrl(BASE_URL, queryUrl),
-        data: data
-    };
-
-    return requestJson(config).catch((error) => {
-        consoleLogger(error);
-    });
-};
-
 export const createNewCaseBlob = (
     appealTypeId,
     lpaID,
diff --git a/actions/services/caseService.js b/actions/services/caseService.js
index 063cc5bb..5148ff92 100644
--- a/actions/services/caseService.js
+++ b/actions/services/caseService.js
@@ -4,7 +4,6 @@ import {
     getSIPSEvents,
     getSIPSMedia,
     getAppealID,
-    createNewCase,
     createNewCaseBlob,
     updateCase,
     updateCaseBlob,
@@ -26,7 +25,6 @@ export {
     getSIPSEvents,
     getSIPSMedia,
     getAppealID,
-    createNewCase,
     createNewCaseBlob,
     updateCase,
     updateCaseBlob,
diff --git a/components/newappeal/createCase.js b/components/newappeal/createCase.js
index c7e60792..46bbd0e7 100644
--- a/components/newappeal/createCase.js
+++ b/components/newappeal/createCase.js
@@ -393,13 +393,6 @@ let CreateCase = (props) => {
 
         delete values.confirmHASCAS;
 
-        // createNewCase(
-        //     appTypeCollection.appealTypeID,
-        //     values.lpaTypes,
-        //     props.loggedInUser,
-        //     values,
-        //     props.containerID
-        // )
         const selectedLpaName = props.LPAData.LPAData.value.filter((obj) => {
             return obj.accountid === values.lpaTypes;
         })[0].name;
diff --git a/pages/api/endpoint/createcase_api.js b/pages/api/endpoint/createcase_api.js
deleted file mode 100644
index 469b9e3c..00000000
--- a/pages/api/endpoint/createcase_api.js
+++ /dev/null
@@ -1,150 +0,0 @@
-/**
- * @swagger
- * /api/endpoint/createcase_api:
- *   post:
- *     tags: [Case]
- *     description: Create case
- *     summary: Phase 2
- *     parameters:
- *       - name: body
- *         in: requestbody
- *         required: true
- *         example: {}
- *         schema:
- *           type: object
- *       - name: contactid
- *         in: query
- *         required: true
- *         example: pinswg_planningappeals78s
- *         schema:
- *           type: string
- *       - name: appealTypeId
- *         in: query
- *         required: true
- *         example: pinswg_planningappeals78id
- *         schema:
- *           type: string
- *       - name: containername
- *         in: query
- *         required: true
- *         example: pinswg_planningappeals78id
- *         schema:
- *           type: string
- *       - name: lpaID
- *         in: query
- *         required: true
- *         example: pinswg_planningappeals78id
- *         schema:
- *           type: string
- *     responses:
- *       200:
- *         description: Success
- */
-
-import axios from "axios";
-import { consoleLogger } from "../../../actions/core/logger";
-import { getToken } from "../../../actions/core/token";
-import { getCaseBlob } from "../../../actions/azurestorage";
-import { hashAPIPath } from "../../../actions/core/hash";
-import { respondError, respondSuccess } from "../middleware/apiResponse";
-
-const WEBAPI_URL =
-    process.env.RELAY_ROOT ||
-    "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
-
-export default async function ApiProxy(req, res) {
-    const createCaseBody = req.body;
-    const contactid = req.query.contactid;
-    const appealTypeId = req.query.appealTypeId;
-    const containerName = req.query.containername;
-    const lpaID = req.query.lpaID;
-    const queryUrl = "incidents";
-
-    if (!createCaseBody || typeof createCaseBody !== "object") {
-        return respondError(res, {
-            status: 400,
-            code: "CASE_PAYLOAD_REQUIRED",
-            message: "Case payload is required"
-        });
-    }
-    if (typeof contactid !== "string" || contactid.trim().length === 0) {
-        return respondError(res, {
-            status: 400,
-            code: "CONTACT_ID_REQUIRED",
-            message: "contactid is required"
-        });
-    }
-    if (typeof appealTypeId !== "string" || appealTypeId.trim().length === 0) {
-        return respondError(res, {
-            status: 400,
-            code: "APPEAL_TYPE_ID_REQUIRED",
-            message: "appealTypeId is required"
-        });
-    }
-    if (
-        typeof containerName !== "string" ||
-        containerName.trim().length === 0
-    ) {
-        return respondError(res, {
-            status: 400,
-            code: "CONTAINER_NAME_REQUIRED",
-            message: "containername is required"
-        });
-    }
-    if (typeof lpaID !== "string" || lpaID.trim().length === 0) {
-        return respondError(res, {
-            status: 400,
-            code: "LPA_ID_REQUIRED",
-            message: "lpaID is required"
-        });
-    }
-
-    try {
-        const token = await getToken();
-
-        const data = {
-            "title": "insertion test case",
-            "caseorigincode": 3,
-            "servicestage": 1,
-            "customerid_contact@odata.bind": "/contacts(" + contactid + ")",
-            "pinswg_appealcasetype": appealTypeId,
-            "pinswg_AssociatedLPA@odata.bind": "/accounts(" + lpaID + ")"
-        };
-        const newData = Object.assign(data, createCaseBody);
-
-        delete newData.lpaTypes;
-        delete newData.appealTypes;
-
-        console.log("/////Create Case:\n", newData, "\n//////////////");
-
-        const config = {
-            method: "post",
-            url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-            headers: {
-                "OData-MaxVersion": "4.0",
-                "OData-Version": "4.0",
-                "Accept": "application/json",
-                "Prefer": 'odata.include-annotations="*",return=representation',
-                "Authorization": "Bearer " + token.access_token,
-                "Content-Type": "application/json"
-            },
-            data: JSON.stringify(newData)
-        };
-
-        const { data: responseData } = await axios(config);
-        await getCaseBlob(
-            containerName,
-            responseData.ticketnumber,
-            createCaseBody
-        );
-
-        return respondSuccess(res, responseData);
-    } catch (error) {
-        consoleLogger(error);
-        return respondError(res, {
-            status: 400,
-            code: "CASE_CREATE_FAILED",
-            message: "Failed to create case"
-        });
-    }
-}
diff --git a/pages/api/endpoint/createcrmtask_api.js b/pages/api/endpoint/createcrmtask_api.js
index af2f66b1..964a3247 100644
--- a/pages/api/endpoint/createcrmtask_api.js
+++ b/pages/api/endpoint/createcrmtask_api.js
@@ -1,46 +1,3 @@
-/**
- * @swagger
- * /api/endpoint/createcase_api:
- *   post:
- *     tags: [Case]
- *     description: Create case
- *     summary: Phase 2
- *     parameters:
- *       - name: body
- *         in: requestbody
- *         required: true
- *         example: {}
- *         schema:
- *           type: object
- *       - name: contactid
- *         in: query
- *         required: true
- *         example: pinswg_planningappeals78s
- *         schema:
- *           type: string
- *       - name: appealTypeId
- *         in: query
- *         required: true
- *         example: pinswg_planningappeals78id
- *         schema:
- *           type: string
- *       - name: containername
- *         in: query
- *         required: true
- *         example: pinswg_planningappeals78id
- *         schema:
- *           type: string
- *       - name: lpaID
- *         in: query
- *         required: true
- *         example: pinswg_planningappeals78id
- *         schema:
- *           type: string
- *     responses:
- *       200:
- *         description: Success
- */
-
 import axios from "axios";
 import { isNonEmptyString, sanitizeString } from "../../../actions/core/guards";
 import { consoleLogger } from "../../../actions/core/logger";
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 77eed608..ccdd8dd0 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -4624,76 +4624,6 @@ test("getappealpdfdocuments catch path returns APPEAL_PDF_DOCUMENTS_FETCH_FAILED
     );
 });
 
-test("createcase returns CASE_PAYLOAD_REQUIRED when body missing", async () => {
-    const mod = loadModule("pages/api/endpoint/createcase_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        getCaseBlob: async () => {},
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => ({ data: { ticketnumber: "CAS-1" } }),
-        consoleLogger: () => {}
-    });
-
-    const req = { query: {}, body: undefined };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "CASE_PAYLOAD_REQUIRED");
-});
-
-test("createcase returns CONTACT_ID_REQUIRED when contactid missing", async () => {
-    const mod = loadModule("pages/api/endpoint/createcase_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        getCaseBlob: async () => {},
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => ({ data: { ticketnumber: "CAS-1" } }),
-        consoleLogger: () => {}
-    });
-
-    const req = {
-        query: { appealTypeId: "a1", containername: "c1", lpaID: "l1" },
-        body: { title: "x" }
-    };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "CONTACT_ID_REQUIRED");
-});
-
-test("createcase catch path returns CASE_CREATE_FAILED", async () => {
-    const mod = loadModule("pages/api/endpoint/createcase_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        getCaseBlob: async () => {},
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => {
-            throw new Error("create failed");
-        },
-        consoleLogger: () => {}
-    });
-
-    const req = {
-        query: {
-            contactid: "c1",
-            appealTypeId: "a1",
-            containername: "container",
-            lpaID: "l1"
-        },
-        body: { title: "x" }
-    };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "CASE_CREATE_FAILED");
-});
-
 test("updatecase returns CASE_UPDATE_PAYLOAD_REQUIRED when body missing", async () => {
     const mod = loadModule("pages/api/endpoint/updatecase_api.js", {
         respondError: respondErrorMock,
@@ -4836,7 +4766,8 @@ test("gethash returns UNAUTHENTICATED when session missing", async () => {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
         hashAPIPath: () => "&hash=expected",
-        getSession: async () => null,
+        getServerSession: async () => null,
+        authOptions: () => ({}),
         nextConnect: () => {
             const handler = { registeredGet: null };
             handler.get = (cb) => {
@@ -4860,7 +4791,10 @@ test("gethash returns INVALID_HASH_PATH when path is invalid", async () => {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
         hashAPIPath: () => "&hash=expected",
-        getSession: async () => ({ user: { email: "user@test.local" } }),
+        getServerSession: async () => ({
+            user: { email: "user@test.local" }
+        }),
+        authOptions: () => ({}),
         nextConnect: () => {
             const handler = { registeredGet: null };
             handler.get = (cb) => {

From faf3aa367506e1ed33e2d2998c694dbf59a59a12 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Wed, 4 Nov 2026 16:07:23 +0000
Subject: [PATCH 11/24] fix(security): enforce ownership on private draft case
 creation

---
 pages/api/file/createcase_api.js             |  91 ++++++-
 tests/phase21/file-handler-contract.test.cjs | 258 +++++++++++++++++++
 2 files changed, 338 insertions(+), 11 deletions(-)

diff --git a/pages/api/file/createcase_api.js b/pages/api/file/createcase_api.js
index 95360e26..1b3d8c4b 100644
--- a/pages/api/file/createcase_api.js
+++ b/pages/api/file/createcase_api.js
@@ -9,30 +9,59 @@ import { getTempCaseRef } from "../../../components/utils";
 import { v4 as uuidv4 } from "uuid";
 import { hashAPIPath } from "../../../actions/core/hash";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 
 const WEBAPI_URL =
     process.env.RELAY_ROOT ||
     "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
 
+const hasValue = (value) =>
+    typeof value === "string" && value.trim().length > 0;
+
+const isValidContainer = (value) =>
+    typeof value === "string" &&
+    value.length >= 3 &&
+    value.length <= 63 &&
+    /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+
+const isValidDraftFolder = (value) =>
+    typeof value === "string" &&
+    value.length <= 100 &&
+    !value.includes("..") &&
+    /^[A-Za-z0-9](?:[A-Za-z0-9/-]*[A-Za-z0-9])?$/.test(value);
+
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
 export default async function ApiProxy(req, res) {
-    var createCaseBody = req.body;
+    let createCaseBody;
+    try {
+        createCaseBody =
+            typeof req.body === "string" ? JSON.parse(req.body) : req.body;
+    } catch (_error) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
     var contactid = req.query.contactid;
     var appealTypeId = req.query.appealTypeId;
     var containerName = req.query.containername;
     var lpaID = req.query.lpaID;
     var queryUrl = "incidents";
-    var token = await getToken();
-    var tempCaseRef = getTempCaseRef();
 
     if (
-        typeof contactid === "undefined" ||
-        contactid.length === 0 ||
-        typeof appealTypeId === "undefined" ||
-        appealTypeId.length === 0 ||
-        typeof containerName === "undefined" ||
-        containerName.length === 0 ||
-        typeof lpaID === "undefined" ||
-        lpaID.length === 0
+        !hasValue(contactid) ||
+        !hasValue(appealTypeId) ||
+        !hasValue(containerName) ||
+        !hasValue(lpaID)
     ) {
         return respondError(res, {
             status: 400,
@@ -42,6 +71,46 @@ export default async function ApiProxy(req, res) {
         });
     }
 
+    if (
+        !createCaseBody ||
+        typeof createCaseBody !== "object" ||
+        Array.isArray(createCaseBody) ||
+        !isValidContainer(containerName) ||
+        ["container", "containerID", "containername"].some(
+            (key) => Object.prototype.hasOwnProperty.call(createCaseBody, key)
+        ) ||
+        ["container", "containerID"].some((key) =>
+            Object.prototype.hasOwnProperty.call(req.query, key)
+        )
+    ) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    if (
+        typeof session?.user?.id !== "string" ||
+        session.user.id.length === 0 ||
+        session.user.id !== containerName
+    ) {
+        return forbidden(res);
+    }
+
+    var tempCaseRef = getTempCaseRef();
+
+    if (!isValidDraftFolder(tempCaseRef)) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_REQUEST",
+            message: "Invalid request"
+        });
+    }
+
+    var token = await getToken();
+
     var data = {
         "title": tempCaseRef,
         "ticketnumber": tempCaseRef,
diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index cb195bab..3f3a18c3 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -5282,6 +5282,264 @@ test("generateappealpdf catch path returns GENERATE_APPEAL_PDF_FAILED for an aut
     assert.strictEqual(loaded.calls.create.length, 0);
 });
 
+const CASE_OWNER_CONTAINER = "case-owner-container";
+const GENERATED_CASE_REFERENCE = "TMP-CASE-04E";
+
+const loadCreateCase = (overrides = {}) => {
+    const calls = {
+        session: [],
+        options: [],
+        token: 0,
+        reference: 0,
+        caseBlob: [],
+        appealBlob: []
+    };
+    const options = { id: "create-case-options" };
+    const mod = loadModule("pages/api/file/createcase_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        authOptions: (req, res) => {
+            calls.options.push([req, res]);
+            return options;
+        },
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return { user: { id: CASE_OWNER_CONTAINER } };
+        },
+        getToken: async () => {
+            calls.token += 1;
+            return { access_token: "synthetic-token" };
+        },
+        getTempCaseRef: () => {
+            calls.reference += 1;
+            return GENERATED_CASE_REFERENCE;
+        },
+        uuidv4: () => "00000000-0000-4000-8000-00000000004e",
+        getCaseBlob: async (...args) => {
+            calls.caseBlob.push(args);
+            return `${GENERATED_CASE_REFERENCE}/${GENERATED_CASE_REFERENCE}_case.json`;
+        },
+        createBlob: async (...args) => {
+            calls.appealBlob.push(args);
+            return GENERATED_CASE_REFERENCE;
+        },
+        _: { isEmpty: (value) => !value || Object.keys(value).length === 0 },
+        ...overrides
+    });
+
+    return { mod, calls, options };
+};
+
+const createCaseRequest = (overrides = {}) => ({
+    method: "POST",
+    query: {
+        contactid: "00000000-0000-4000-8000-000000000001",
+        appealTypeId: "846040000",
+        containername: CASE_OWNER_CONTAINER,
+        lpaID: "00000000-0000-4000-8000-000000000002"
+    },
+    body: {
+        pinswg_lpaname: "Synthetic LPA",
+        createdon: "2026-11-04T00:00:00.000Z"
+    },
+    ...overrides
+});
+
+const assertNoCreateCaseSideEffects = (calls) => {
+    assert.strictEqual(calls.token, 0);
+    assert.strictEqual(calls.reference, 0);
+    assert.strictEqual(calls.caseBlob.length, 0);
+    assert.strictEqual(calls.appealBlob.length, 0);
+};
+
+for (const sessionCase of [
+    { name: "missing session", session: null },
+    { name: "missing session user ID", session: { user: {} } },
+    { name: "empty session user ID", session: { user: { id: "" } } },
+    {
+        name: "non-string session user ID",
+        session: { user: { id: 123 } }
+    }
+]) {
+    test(`createcase_api rejects ${sessionCase.name} before private draft creation`, async () => {
+        const loaded = loadCreateCase({
+            getServerSession: async () => sessionCase.session
+        });
+        const res = createRes();
+
+        await loaded.mod.default(createCaseRequest(), res);
+
+        assert.strictEqual(res.state.statusCode, 403);
+        assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+        assertNoCreateCaseSideEffects(loaded.calls);
+    });
+}
+
+test("createcase_api rejects a foreign destination container before private draft creation", async () => {
+    const loaded = loadCreateCase({
+        getServerSession: async () => ({ user: { id: "different-container" } })
+    });
+    const res = createRes();
+
+    await loaded.mod.default(createCaseRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assertNoCreateCaseSideEffects(loaded.calls);
+});
+
+test("createcase_api does not trust a caller-supplied identity", async () => {
+    const loaded = loadCreateCase({
+        getServerSession: async () => ({ user: { id: "different-container" } })
+    });
+    const req = createCaseRequest();
+    req.body.userID = CASE_OWNER_CONTAINER;
+    const res = createRes();
+
+    await loaded.mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assertNoCreateCaseSideEffects(loaded.calls);
+});
+
+test("createcase_api passes req, res and request-scoped options to getServerSession", async () => {
+    const loaded = loadCreateCase();
+    const req = createCaseRequest();
+    const res = createRes();
+
+    await loaded.mod.default(req, res);
+
+    assert.deepStrictEqual(loaded.calls.options, [[req, res]]);
+    assert.deepStrictEqual(loaded.calls.session, [[req, res, loaded.options]]);
+});
+
+for (const containerCase of [
+    { name: "missing", value: undefined },
+    { name: "invalid", value: "Invalid_Container" },
+    { name: "array-valued", value: [CASE_OWNER_CONTAINER] }
+]) {
+    test(`createcase_api rejects a ${containerCase.name} container before private draft creation`, async () => {
+        const loaded = loadCreateCase();
+        const req = createCaseRequest();
+        if (typeof containerCase.value === "undefined") {
+            delete req.query.containername;
+        } else {
+            req.query.containername = containerCase.value;
+        }
+        const res = createRes();
+
+        await loaded.mod.default(req, res);
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assertNoCreateCaseSideEffects(loaded.calls);
+    });
+}
+
+test("createcase_api rejects malformed JSON before private draft creation", async () => {
+    const loaded = loadCreateCase();
+    const res = createRes();
+
+    await loaded.mod.default(createCaseRequest({ body: "{" }), res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_REQUEST");
+    assertNoCreateCaseSideEffects(loaded.calls);
+});
+
+test("createcase_api rejects ambiguous destination identifiers before private draft creation", async () => {
+    for (const request of [
+        createCaseRequest({
+            query: {
+                ...createCaseRequest().query,
+                containerID: CASE_OWNER_CONTAINER
+            }
+        }),
+        createCaseRequest({
+            body: {
+                ...createCaseRequest().body,
+                containername: CASE_OWNER_CONTAINER
+            }
+        })
+    ]) {
+        const loaded = loadCreateCase();
+        const res = createRes();
+
+        await loaded.mod.default(request, res);
+
+        assert.strictEqual(res.state.statusCode, 400);
+        assert.strictEqual(res.state.jsonBody.error.code, "INVALID_REQUEST");
+        assertNoCreateCaseSideEffects(loaded.calls);
+    }
+});
+
+test("createcase_api rejects an invalid generated folder before token acquisition and Blob writes", async () => {
+    const loaded = loadCreateCase({ getTempCaseRef: () => "../foreign-case" });
+    const res = createRes();
+
+    await loaded.mod.default(createCaseRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_REQUEST");
+    assert.strictEqual(loaded.calls.token, 0);
+    assert.strictEqual(loaded.calls.caseBlob.length, 0);
+    assert.strictEqual(loaded.calls.appealBlob.length, 0);
+});
+
+test("createcase_api creates both draft JSON blobs in the authenticated owner's container", async () => {
+    const loaded = loadCreateCase();
+    const req = createCaseRequest();
+    const res = createRes();
+
+    await loaded.mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(loaded.calls.token, 1);
+    assert.strictEqual(loaded.calls.reference, 1);
+    assert.strictEqual(loaded.calls.caseBlob.length, 1);
+    assert.strictEqual(loaded.calls.appealBlob.length, 1);
+    assert.strictEqual(loaded.calls.caseBlob[0][0], CASE_OWNER_CONTAINER);
+    assert.strictEqual(
+        loaded.calls.caseBlob[0][1],
+        GENERATED_CASE_REFERENCE
+    );
+    assert.strictEqual(loaded.calls.appealBlob[0][1], CASE_OWNER_CONTAINER);
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(loaded.calls.caseBlob[0][2])),
+        JSON.parse(JSON.stringify(res.state.jsonBody))
+    );
+    assert.deepStrictEqual(JSON.parse(loaded.calls.appealBlob[0][0]), {
+        pinswg_name: GENERATED_CASE_REFERENCE,
+        pinswg_appealcasetype: "846040000",
+        _pinswg_associatedlpa_value:
+            "00000000-0000-4000-8000-000000000002"
+    });
+    assert.strictEqual(res.state.jsonBody.ticketnumber, GENERATED_CASE_REFERENCE);
+    assert.strictEqual(res.state.jsonBody.title, GENERATED_CASE_REFERENCE);
+    assert.strictEqual(
+        res.state.jsonBody.incidentid,
+        "00000000-0000-4000-8000-00000000004e"
+    );
+});
+
+test("createcase_api preserves the existing propagated token dependency failure for an authorised owner", async () => {
+    const loaded = loadCreateCase({
+        getToken: async () => {
+            loaded.calls.token += 1;
+            throw new Error("token failure");
+        }
+    });
+    const res = createRes();
+
+    await assert.rejects(
+        loaded.mod.default(createCaseRequest(), res),
+        /token failure/
+    );
+
+    assert.strictEqual(loaded.calls.token, 1);
+    assert.strictEqual(loaded.calls.caseBlob.length, 0);
+    assert.strictEqual(loaded.calls.appealBlob.length, 0);
+});
+
 const run = async () => {
     let passed = 0;
     for (const currentTest of tests) {

From a0a1331a978d9ad0184fce66fbd704280f01ae4d Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Thu, 5 Nov 2026 17:18:30 +0000
Subject: [PATCH 12/24] fix(security): retire obsolete CRM representation
 deletion endpoint

---
 actions/services/portalDirectService.js       | 18 -----
 actions/services/portalService.js             |  2 -
 .../endpoint/deletemyrepresentations_api.js   | 66 -----------------
 pages/api/endpoint/gethash_api.js             |  1 -
 tests/phase14/service-behaviour.test.cjs      | 30 ++------
 .../endpoint-handler-contract.test.cjs        | 57 +--------------
 .../phase22/portal-service-behaviour.test.cjs | 33 ---------
 tests/phase7/service-behaviour.test.cjs       | 73 +------------------
 8 files changed, 13 insertions(+), 267 deletions(-)
 delete mode 100644 pages/api/endpoint/deletemyrepresentations_api.js

diff --git a/actions/services/portalDirectService.js b/actions/services/portalDirectService.js
index 6e315a41..16fad67a 100644
--- a/actions/services/portalDirectService.js
+++ b/actions/services/portalDirectService.js
@@ -144,24 +144,6 @@ export const createWatchedCases = async (formValues) => {
     }
 };
 
-export const deleteMyRepresentations = (myRepresentationsID) => {
-    var queryUrl = buildFileQuery("/api/endpoint/deletemyrepresentations_api", {
-        myRepresentationsID
-    });
-
-    return deleteSignedJson(queryUrl, {
-        headers: {
-            "OData-MaxVersion": "4.0",
-            "OData-Version": "4.0",
-            "Accept": "application/json;odata.metadata=none",
-            "Prefer": 'odata.include-annotations="*",return=representation',
-            "Content-Type": "application/json"
-        }
-    }).catch((error) => {
-        consoleLogger(error);
-    });
-};
-
 export const deleteAwaitingSubmissions = (incidentID) => {
     var queryUrl = buildFileQuery(
         "/api/endpoint/deleteawaitingsubmissions_api",
diff --git a/actions/services/portalService.js b/actions/services/portalService.js
index a0b7f31c..8ce9c3b7 100644
--- a/actions/services/portalService.js
+++ b/actions/services/portalService.js
@@ -12,7 +12,6 @@ import {
     getAwaitingSubmissionProxy,
     createWatchedCases,
     deleteWatchedCases,
-    deleteMyRepresentations,
     deleteAwaitingSubmissions,
     sendCaseCompleteMessage,
     sendCaseCompleteMessageProxy,
@@ -35,7 +34,6 @@ export {
     getAwaitingSubmissionProxy,
     createWatchedCases,
     deleteWatchedCases,
-    deleteMyRepresentations,
     deleteAwaitingSubmissions,
     sendCaseCompleteMessage,
     sendCaseCompleteMessageProxy,
diff --git a/pages/api/endpoint/deletemyrepresentations_api.js b/pages/api/endpoint/deletemyrepresentations_api.js
deleted file mode 100644
index 62e02b46..00000000
--- a/pages/api/endpoint/deletemyrepresentations_api.js
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * @swagger
- * /api/endpoint/deleteamyrepresentations_api:
- *   delete:
- *     tags: [Portal,Representations]
- *     summary: Phase 2
- *     description: Delete my representations
- *     responses:
- *       200:
- *         description: Success
- */
-
-import axios from "axios";
-import { consoleLogger } from "../../../actions/core/logger";
-import { getToken } from "../../../actions/core/token";
-
-import { hashAPIPath } from "../../../actions/core/hash";
-import { respondError, respondSuccess } from "../middleware/apiResponse";
-
-const WEBAPI_URL =
-    process.env.RELAY_ROOT ||
-    "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
-
-export default async function ApiProxy(req, res) {
-    const myRepresentationsID = req.query.myRepresentationsID;
-
-    if (
-        typeof myRepresentationsID !== "string" ||
-        myRepresentationsID.trim().length === 0
-    ) {
-        return respondError(res, {
-            status: 400,
-            code: "MY_REPRESENTATION_ID_REQUIRED",
-            message: "myRepresentationsID is required"
-        });
-    }
-
-    try {
-        const token = await getToken();
-        const queryUrl =
-            "pinswg_representationses(" + myRepresentationsID + ")";
-
-        const config = {
-            method: "delete",
-            url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-            headers: {
-                "OData-MaxVersion": "4.0",
-                "OData-Version": "4.0",
-                Accept: "application/json",
-                Prefer: 'odata.include-annotations="*",return=representation',
-                Authorization: "Bearer " + token.access_token,
-                "Content-Type": "application/json"
-            }
-        };
-
-        const { data } = await axios(config);
-        return respondSuccess(res, data);
-    } catch (error) {
-        consoleLogger(error);
-        return respondError(res, {
-            status: 400,
-            code: "MY_REPRESENTATION_DELETE_FAILED",
-            message: "Failed to delete representation"
-        });
-    }
-}
diff --git a/pages/api/endpoint/gethash_api.js b/pages/api/endpoint/gethash_api.js
index c68f61fe..fb3e28f9 100644
--- a/pages/api/endpoint/gethash_api.js
+++ b/pages/api/endpoint/gethash_api.js
@@ -38,7 +38,6 @@ ApiProxy.get(async (req, res) => {
 
     const allowedPrefix = [
         "/api/endpoint/getportallogin_api",
-        "/api/endpoint/deletemyrepresentations_api",
         "/api/endpoint/deletewatchedcases_api",
         "/api/subscriptions/delete-watched-case",
         "/api/file/upload",
diff --git a/tests/phase14/service-behaviour.test.cjs b/tests/phase14/service-behaviour.test.cjs
index 31a3f599..398c9636 100644
--- a/tests/phase14/service-behaviour.test.cjs
+++ b/tests/phase14/service-behaviour.test.cjs
@@ -22,12 +22,20 @@ const loadModule = (relativePath, injected = {}) => {
     source +=
         '\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
 
+    const respondError = (res, { status, ...error }) =>
+        res.status(status).json({ error });
+    const respondSuccess = (res, data) => res.status(200).json(data);
+
     const context = {
         module: { exports: {} },
         exports: {},
         require,
         process,
         console: { log: () => {}, error: () => {} },
+        getServerSession: injected.getServerSession || injected.getSession,
+        authOptions: injected.authOptions || (() => ({})),
+        respondError,
+        respondSuccess,
         ...injected
     };
 
@@ -196,28 +204,6 @@ test("gethash_api returns hash for allow-listed deletewatchedcases path", async
     });
 });
 
-test("gethash_api returns hash for allow-listed deletemyrepresentations path", async () => {
-    const mod = loadModule("pages/api/endpoint/gethash_api.js", {
-        hashAPIPath: () => "&hash=delrep",
-        getSession: async () => ({ user: { id: "u1" } }),
-        nextConnect: createNextConnectMock(),
-        middleware: () => {}
-    });
-
-    const req = {
-        query: {
-            path: "/api/endpoint/deletemyrepresentations_api?myRepresentationsID=abc"
-        }
-    };
-    const res = createRes();
-    await mod.default.handler(req, res);
-
-    assert.strictEqual(res.state.statusCode, 200);
-    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
-        hash: "&hash=delrep"
-    });
-});
-
 test("gethash_api rejects unauthenticated requests with 401", async () => {
     const mod = loadModule("pages/api/endpoint/gethash_api.js", {
         hashAPIPath: () => "&hash=expected",
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index ccdd8dd0..6c3b2f0f 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -3888,56 +3888,6 @@ test("deletewatchedcasesproxy catch path returns WATCHED_CASE_PROXY_DELETE_FAILE
     );
 });
 
-test("deletemyrepresentations returns MY_REPRESENTATION_ID_REQUIRED when myRepresentationsID missing", async () => {
-    const mod = loadModule(
-        "pages/api/endpoint/deletemyrepresentations_api.js",
-        {
-            respondError: respondErrorMock,
-            respondSuccess: respondSuccessMock,
-            getToken: async () => ({ access_token: "token" }),
-            hashAPIPath: () => "&hash=expected",
-            axios: async () => ({ data: {} }),
-            consoleLogger: () => {}
-        }
-    );
-
-    const req = { query: {} };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(
-        res.state.jsonBody.error.code,
-        "MY_REPRESENTATION_ID_REQUIRED"
-    );
-});
-
-test("deletemyrepresentations catch path returns MY_REPRESENTATION_DELETE_FAILED", async () => {
-    const mod = loadModule(
-        "pages/api/endpoint/deletemyrepresentations_api.js",
-        {
-            respondError: respondErrorMock,
-            respondSuccess: respondSuccessMock,
-            getToken: async () => ({ access_token: "token" }),
-            hashAPIPath: () => "&hash=expected",
-            axios: async () => {
-                throw new Error("delete failed");
-            },
-            consoleLogger: () => {}
-        }
-    );
-
-    const req = { query: { myRepresentationsID: "r1" } };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(
-        res.state.jsonBody.error.code,
-        "MY_REPRESENTATION_DELETE_FAILED"
-    );
-});
-
 test("deleteawaitingsubmissions returns INCIDENT_ID_REQUIRED when incidentID missing", async () => {
     const mod = loadModule(
         "pages/api/endpoint/deleteawaitingsubmissions_api.js",
@@ -4948,9 +4898,8 @@ test("getsipsmedia returns success contract", async () => {
     assert.strictEqual(res.state.jsonBody["@odata.count"], 4);
 });
 
-test("getsipsmedia returns METHOD_NOT_ALLOWED for non-GET methods", async () => {
+test("getsipsmedia returns CASE_ID_REQUIRED when caseid missing", async () => {
     const mod = loadModule("pages/api/endpoint/getsipsmedia_api.js", {
-        respondSuccess: respondSuccessMock,
         respondError: respondErrorMock
     });
 
@@ -4958,8 +4907,8 @@ test("getsipsmedia returns METHOD_NOT_ALLOWED for non-GET methods", async () =>
     const res = createRes();
     await mod.default(req, res);
 
-    assert.strictEqual(res.state.statusCode, 405);
-    assert.strictEqual(res.state.jsonBody.error.code, "METHOD_NOT_ALLOWED");
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "CASE_ID_REQUIRED");
 });
 
 test("getappealtypesfornewappeal returns METHOD_NOT_ALLOWED for non-GET methods", async () => {
diff --git a/tests/phase22/portal-service-behaviour.test.cjs b/tests/phase22/portal-service-behaviour.test.cjs
index 2c847fd6..bbae655b 100644
--- a/tests/phase22/portal-service-behaviour.test.cjs
+++ b/tests/phase22/portal-service-behaviour.test.cjs
@@ -43,39 +43,6 @@ test("portal/sendCaseCompleteMessage appends signed hash suffix to inv query", a
     );
 });
 
-test("portal/deleteMyRepresentations uses signed delete request with headers", async () => {
-    const axios = createAxiosMock();
-    const logger = createLoggerMock();
-
-    const requestCalls = [];
-    const requestJson = async (config) => {
-        requestCalls.push(config);
-        return { deleted: true };
-    };
-
-    const portal = loadServiceModule("portalDirectService.js", {
-        axios,
-        BASE_URL: "",
-        consoleLogger: logger.consoleLogger,
-        buildHashedQueryUrl: async (queryUrl) => `${queryUrl}&hash=xyz`,
-        requestJson
-    });
-
-    const result = await portal.deleteMyRepresentations("rep-1");
-
-    assert.deepStrictEqual(normalize(result), { deleted: true });
-    assert.strictEqual(requestCalls.length, 1);
-    assert.strictEqual(requestCalls[0].method, "delete");
-    assert.strictEqual(
-        requestCalls[0].url,
-        "/api/endpoint/deletemyrepresentations_api?myRepresentationsID=rep-1&hash=xyz"
-    );
-    assert.strictEqual(
-        requestCalls[0].headers["Content-Type"],
-        "application/json"
-    );
-});
-
 test("portal/createWatchedCases posts to harmonized route helper URL", async () => {
     const axios = createAxiosMock();
     const logger = createLoggerMock();
diff --git a/tests/phase7/service-behaviour.test.cjs b/tests/phase7/service-behaviour.test.cjs
index dbe91bb3..05764a66 100644
--- a/tests/phase7/service-behaviour.test.cjs
+++ b/tests/phase7/service-behaviour.test.cjs
@@ -65,75 +65,6 @@ test("document/getAwaitingSubmissionFromBlob logs and returns undefined on failu
     assert.strictEqual(logger.calls.length, 1);
 });
 
-test("portal/deleteMyRepresentations appends hash and returns data", async () => {
-    const axios = createAxiosMock();
-    const logger = createLoggerMock();
-    const signCalls = [];
-
-    axios.getHandler = async (url) => {
-        if (url.startsWith("/api/endpoint/gethash_api?path=")) {
-            signCalls.push(url);
-            return { data: { hash: "&hash=portal123" } };
-        }
-
-        throw new Error("Unexpected get url: " + url);
-    };
-
-    axios.requestHandler = async () => ({ data: { removed: true } });
-
-    const portal = loadServiceModule("portalDirectService.js", {
-        axios,
-        BASE_URL: "",
-        consoleLogger: logger.consoleLogger,
-        hashAPIPath: () => "&hash=fallback"
-    });
-
-    const result = await portal.deleteMyRepresentations("rep-1");
-
-    assert.deepStrictEqual(normalize(result), { removed: true });
-    assert.strictEqual(
-        signCalls[0],
-        "/api/endpoint/gethash_api?path=%2Fapi%2Fendpoint%2Fdeletemyrepresentations_api%3FmyRepresentationsID%3Drep-1"
-    );
-    assert.strictEqual(
-        axios.calls[0].url,
-        "/api/endpoint/gethash_api?path=%2Fapi%2Fendpoint%2Fdeletemyrepresentations_api%3FmyRepresentationsID%3Drep-1"
-    );
-    assert.strictEqual(
-        axios.calls[1].config.url,
-        "/api/endpoint/deletemyrepresentations_api?myRepresentationsID=rep-1&hash=portal123"
-    );
-    assert.strictEqual(axios.calls[1].config.method, "delete");
-});
-
-test("portal/deleteMyRepresentations logs and returns undefined on failure", async () => {
-    const axios = createAxiosMock();
-    const logger = createLoggerMock();
-
-    axios.getHandler = async (url) => {
-        if (url.startsWith("/api/endpoint/gethash_api?path=")) {
-            return { data: { hash: "&hash=portal-fail" } };
-        }
-
-        throw new Error("Unexpected get url: " + url);
-    };
-
-    axios.requestHandler = async () =>
-        Promise.reject(createAxiosError(401, "Unauthorized"));
-
-    const portal = loadServiceModule("portalDirectService.js", {
-        axios,
-        BASE_URL: "",
-        consoleLogger: logger.consoleLogger,
-        hashAPIPath: () => "&hash=fallback"
-    });
-
-    const result = await portal.deleteMyRepresentations("rep-2");
-
-    assert.strictEqual(result, undefined);
-    assert.strictEqual(logger.calls.length, 1);
-});
-
 test("portal/deleteWatchedCases uses signer hash and returns data", async () => {
     const axios = createAxiosMock();
     const logger = createLoggerMock();
@@ -162,11 +93,11 @@ test("portal/deleteWatchedCases uses signer hash and returns data", async () =>
     assert.deepStrictEqual(normalize(result), { removed: true });
     assert.strictEqual(
         signCalls[0],
-        "/api/endpoint/gethash_api?path=%2Fapi%2Fendpoint%2Fdeletewatchedcases_api%3FwatchedCaseID%3Dwatch-1"
+        "/api/endpoint/gethash_api?path=%2Fapi%2Fsubscriptions%2Fdelete-watched-case%3FwatchedCaseID%3Dwatch-1"
     );
     assert.strictEqual(
         axios.calls[1].config.url,
-        "/api/endpoint/deletewatchedcases_api?watchedCaseID=watch-1&hash=watch123"
+        "/api/subscriptions/delete-watched-case?watchedCaseID=watch-1&hash=watch123"
     );
 });
 

From e13700ab654fb259195d6bc334c603c5ecd9c423 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Thu, 5 Nov 2026 06:49:00 +0000
Subject: [PATCH 13/24] security: enforce authenticated CRM contact ownership

---
 lib/auth/resolveCrmLocale.js                  |  42 +++
 pages/api/auth/[...nextauth].js               |  27 +-
 pages/api/auth/resolve-locale.js              |  33 +--
 pages/api/endpoint/getportallogin_api.js      |  49 +++-
 .../endpoint-handler-contract.test.cjs        | 243 +++++++++++++-----
 tests/phase22/auth-redirect-safety.test.cjs   |   7 +-
 .../preauth-locale-resolution.test.cjs        | 242 +++++++++++++++++
 7 files changed, 517 insertions(+), 126 deletions(-)
 create mode 100644 lib/auth/resolveCrmLocale.js
 create mode 100644 tests/phase22/preauth-locale-resolution.test.cjs

diff --git a/lib/auth/resolveCrmLocale.js b/lib/auth/resolveCrmLocale.js
new file mode 100644
index 00000000..0677ab16
--- /dev/null
+++ b/lib/auth/resolveCrmLocale.js
@@ -0,0 +1,42 @@
+import { azureHeadersPaged } from "../../actions/core/headers";
+import { escapeODataString } from "../../actions/core/guards";
+import { consoleLogger } from "../../actions/core/logger";
+import { relayGetData } from "../../pages/api/middleware/relayForwarding";
+import { RELAY_POLICY_STRICT_LOGIN } from "../../pages/api/middleware/relayPolicyPresets";
+
+const WELSH_LANGUAGE_CODE = 846040000;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+export const resolveCrmLocale = async (email) => {
+    if (typeof email !== "string") return null;
+
+    const normalizedEmail = email.trim().toLowerCase();
+
+    if (!EMAIL_PATTERN.test(normalizedEmail)) return null;
+
+    const queryUrl =
+        "contacts?$filter=emailaddress1 eq '" +
+        escapeODataString(normalizedEmail) +
+        "' and statuscode eq 1&$count=true&$select=pinswg_preferredlanguage";
+
+    try {
+        const { data } = await relayGetData({
+            queryUrl,
+            requestOptionsBuilder: (accessToken) =>
+                azureHeadersPaged(accessToken),
+            relayPolicy: RELAY_POLICY_STRICT_LOGIN
+        });
+        const preferredLanguage = data?.value?.[0]?.pinswg_preferredlanguage;
+
+        if (preferredLanguage === WELSH_LANGUAGE_CODE) return "cy";
+        if (preferredLanguage != null) return "en";
+
+        return null;
+    } catch (error) {
+        consoleLogger({
+            name: "ResolveCrmLocale",
+            message: "CRM locale lookup failed"
+        });
+        return null;
+    }
+};
\ No newline at end of file
diff --git a/pages/api/auth/[...nextauth].js b/pages/api/auth/[...nextauth].js
index ac88da54..f953bf13 100644
--- a/pages/api/auth/[...nextauth].js
+++ b/pages/api/auth/[...nextauth].js
@@ -14,8 +14,8 @@ import { PrismaAdapter } from "@next-auth/prisma-adapter";
 import { PrismaClient } from "@prisma/client";
 import NextAuth from "next-auth";
 import EmailProvider from "../../../lib/auth/email-provider";
+import { resolveCrmLocale } from "../../../lib/auth/resolveCrmLocale";
 import { consoleLogger, redactSensitive } from "../../../actions/core/logger";
-import { getPortalLogin } from "../../../actions/services/accountService";
 
 const prisma = new PrismaClient();
 
@@ -53,8 +53,6 @@ const createVerificationTokenSynchronizationAdapter = (
     };
 };
 
-const WELSH_LANGUAGE_CODE = 846040000;
-
 const authDiagnostic = (event, metadata = {}) => {
     try {
         const safeMeta = JSON.parse(JSON.stringify(metadata));
@@ -84,29 +82,6 @@ const appendParamsAndPathToNewUrl = (fromUrl, toUrl) => {
     }
 };
 
-const resolveCrmLocale = async (email) => {
-    if (!email) return null;
-
-    try {
-        const portalUserObj = await getPortalLogin(email);
-        const preferredLanguage =
-            portalUserObj?.value?.[0]?.pinswg_preferredlanguage;
-
-        if (preferredLanguage === WELSH_LANGUAGE_CODE) {
-            return "cy";
-        }
-
-        if (preferredLanguage != null) {
-            return "en";
-        }
-
-        return null;
-    } catch (error) {
-        consoleLogger(error);
-        return null;
-    }
-};
-
 const resolveEffectiveLocale = async (req, email) => {
     const crmLocale = await resolveCrmLocale(email);
     if (crmLocale) {
diff --git a/pages/api/auth/resolve-locale.js b/pages/api/auth/resolve-locale.js
index f89bf9df..f029dce2 100644
--- a/pages/api/auth/resolve-locale.js
+++ b/pages/api/auth/resolve-locale.js
@@ -1,8 +1,3 @@
-import { getPortalLogin } from "../../../actions/services/accountService";
-import { consoleLogger } from "../../../actions/core/logger";
-
-const WELSH_LANGUAGE_CODE = 846040000;
-
 const resolveRequestLocale = (req) =>
     req?.query?.locale ||
     req?.body?.locale ||
@@ -14,30 +9,8 @@ export default async function handler(req, res) {
         return res.status(405).json({ message: "Method not allowed" });
     }
 
-    const email = String(req.body?.email || "")
-        .trim()
-        .toLowerCase();
-    const sessionLocale = resolveRequestLocale(req);
+    const requestedLocale = resolveRequestLocale(req);
+    const locale = requestedLocale === "cy" ? "cy" : "en";
 
-    if (!email) {
-        return res.status(200).json({ locale: sessionLocale });
-    }
-
-    try {
-        const portalUserObj = await getPortalLogin(email);
-        const preferredLanguage =
-            portalUserObj?.value?.[0]?.pinswg_preferredlanguage;
-
-        const locale =
-            preferredLanguage === WELSH_LANGUAGE_CODE
-                ? "cy"
-                : preferredLanguage != null
-                  ? "en"
-                  : sessionLocale;
-
-        return res.status(200).json({ locale });
-    } catch (error) {
-        consoleLogger(error);
-        return res.status(200).json({ locale: sessionLocale });
-    }
+    return res.status(200).json({ locale });
 }
diff --git a/pages/api/endpoint/getportallogin_api.js b/pages/api/endpoint/getportallogin_api.js
index 00871021..c690be08 100644
--- a/pages/api/endpoint/getportallogin_api.js
+++ b/pages/api/endpoint/getportallogin_api.js
@@ -17,20 +17,61 @@
  */
 
 import { azureHeadersPaged } from "../../../actions/core/headers";
+import { escapeODataString } from "../../../actions/core/guards";
 import { hashAPIPath } from "../../../actions/core/hash";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
 import { respondError } from "../middleware/apiResponse";
 import { relayGet } from "../middleware/relayForwarding";
 import { RELAY_POLICY_STRICT_LOGIN } from "../middleware/relayPolicyPresets";
 
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+$/;
+
 export default async function ApiProxy(req, res) {
+    if (req.method !== "GET") {
+        return respondError(res, {
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Only GET is supported"
+        });
+    }
+
+    const session = await getServerSession(req, res, authOptions(req, res));
+    const authenticatedEmail = session?.user?.email;
+
+    if (
+        typeof authenticatedEmail !== "string" ||
+        !EMAIL_PATTERN.test(authenticatedEmail.trim())
+    ) {
+        return respondError(res, {
+            status: 401,
+            code: "UNAUTHENTICATED",
+            message: "Authentication required"
+        });
+    }
+
     const emailAddress = req.query.emailAddress;
     const checkHash = req.query.hash;
 
-    if (typeof emailAddress !== "string" || emailAddress.trim().length === 0) {
+    if (
+        typeof emailAddress !== "string" ||
+        !EMAIL_PATTERN.test(emailAddress.trim())
+    ) {
         return respondError(res, {
             status: 400,
-            code: "EMAIL_ADDRESS_REQUIRED",
-            message: "emailAddress is required"
+            code: "INVALID_EMAIL_ADDRESS",
+            message: "emailAddress must be a valid email address"
+        });
+    }
+
+    const normalizedAuthenticatedEmail = authenticatedEmail.trim().toLowerCase();
+    const normalizedRequestedEmail = emailAddress.trim().toLowerCase();
+
+    if (normalizedRequestedEmail !== normalizedAuthenticatedEmail) {
+        return respondError(res, {
+            status: 403,
+            code: "FORBIDDEN",
+            message: "Request not permitted"
         });
     }
 
@@ -63,7 +104,7 @@ export default async function ApiProxy(req, res) {
 
     const queryUrl =
         "contacts?$filter=emailaddress1 eq '" +
-        emailAddress +
+        escapeODataString(normalizedAuthenticatedEmail) +
         "' and statuscode eq 1&$count=true&$select=pinswg_preferredlanguage,emailaddress1,contactid,yomifullname,firstname,lastname";
 
     const relayPolicy = RELAY_POLICY_STRICT_LOGIN;
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 6c3b2f0f..3821f9e2 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -323,64 +323,157 @@ test("getlogin passes strict relayPolicy overrides to relayGet", async () => {
     });
 });
 
-test("getportallogin returns HASH_REQUIRED when hash missing", async () => {
+const createPortalLoginFixture = (overrides = {}) => {
+    const calls = {
+        session: [],
+        hash: [],
+        relay: []
+    };
+    const session = Object.prototype.hasOwnProperty.call(overrides, "session")
+        ? overrides.session
+        : { user: { email: "user@test.local" } };
+
     const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        relayGet: async () => ({}),
-        hashAPIPath: (input) =>
-            input && input.startsWith("/api/endpoint/getportallogin_api")
-                ? "&hash=expected"
-                : "&hash=relay",
-        azureHeadersPaged: () => ({})
+        getServerSession: async (...args) => {
+            calls.session.push(args);
+            return session;
+        },
+        authOptions: (req, res) => ({ req, res }),
+        relayGet: async (options) => {
+            calls.relay.push(options);
+            if (overrides.relayGet) return overrides.relayGet(options);
+            return respondSuccessMock(options.res, { value: [] });
+        },
+        hashAPIPath: (input) => {
+            calls.hash.push(input);
+            if (overrides.hashAPIPath) return overrides.hashAPIPath(input);
+            return "&hash=expected";
+        },
+        escapeODataString: (value) => value.trim().replace(/'/g, "''"),
+        azureHeadersPaged: (accessToken) => ({ accessToken })
     });
 
-    const req = { query: { emailAddress: "user@test.local" } };
+    return { mod, calls };
+};
+
+const invokePortalLogin = async (
+    fixture,
+    query = { emailAddress: "user@test.local", hash: "expected" },
+    method = "GET"
+) => {
+    const req = { method, query };
     const res = createRes();
-    await mod.default(req, res);
+    await fixture.mod.default(req, res);
+
+    return { req, res };
+};
+
+test("getportallogin rejects unsupported methods before authentication", async () => {
+    const fixture = createPortalLoginFixture();
+    const { res } = await invokePortalLogin(fixture, undefined, "POST");
+
+    assert.strictEqual(res.state.statusCode, 405);
+    assert.strictEqual(res.state.jsonBody.error.code, "METHOD_NOT_ALLOWED");
+    assert.strictEqual(fixture.calls.session.length, 0);
+    assert.strictEqual(fixture.calls.relay.length, 0);
+});
+
+test("getportallogin rejects missing session", async () => {
+    const fixture = createPortalLoginFixture({ session: null });
+    const { req, res } = await invokePortalLogin(fixture);
+
+    assert.strictEqual(res.state.statusCode, 401);
+    assert.strictEqual(res.state.jsonBody.error.code, "UNAUTHENTICATED");
+    assert.strictEqual(fixture.calls.session[0][0], req);
+    assert.strictEqual(fixture.calls.session[0][1], res);
+    assert.strictEqual(fixture.calls.relay.length, 0);
+});
+
+test("getportallogin rejects session without email", async () => {
+    const fixture = createPortalLoginFixture({
+        session: { user: { id: "application-user" } }
+    });
+    const { res } = await invokePortalLogin(fixture);
+
+    assert.strictEqual(res.state.statusCode, 401);
+    assert.strictEqual(res.state.jsonBody.error.code, "UNAUTHENTICATED");
+    assert.strictEqual(fixture.calls.relay.length, 0);
+});
+
+test("getportallogin rejects malformed requested email", async () => {
+    const fixture = createPortalLoginFixture();
+    const { res } = await invokePortalLogin(fixture, {
+        emailAddress: "not-an-email",
+        hash: "expected"
+    });
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_EMAIL_ADDRESS");
+    assert.strictEqual(fixture.calls.relay.length, 0);
+});
+
+test("getportallogin rejects another user's email before CRM access", async () => {
+    const fixture = createPortalLoginFixture();
+    const { res } = await invokePortalLogin(fixture, {
+        emailAddress: "other@test.local",
+        hash: "expected"
+    });
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(fixture.calls.hash.length, 0);
+    assert.strictEqual(fixture.calls.relay.length, 0);
+});
+
+test("getportallogin valid HMAC for another email does not bypass ownership", async () => {
+    const fixture = createPortalLoginFixture({
+        hashAPIPath: (input) =>
+            input.includes("other%40test.local") ||
+            input.includes("other@test.local")
+                ? "&hash=valid-other-user-hash"
+                : "&hash=unexpected"
+    });
+    const { res } = await invokePortalLogin(fixture, {
+        emailAddress: "other@test.local",
+        hash: "valid-other-user-hash"
+    });
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(fixture.calls.relay.length, 0);
+});
+
+test("getportallogin returns HASH_REQUIRED when hash missing", async () => {
+    const fixture = createPortalLoginFixture();
+    const { res } = await invokePortalLogin(fixture, {
+        emailAddress: "user@test.local"
+    });
 
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(res.state.jsonBody.error.code, "HASH_REQUIRED");
+    assert.strictEqual(fixture.calls.relay.length, 0);
 });
 
 test("getportallogin returns INVALID_HASH when hash mismatch", async () => {
-    const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        relayGet: async () => ({}),
-        hashAPIPath: (input) =>
-            input && input.startsWith("/api/endpoint/getportallogin_api")
-                ? "&hash=expected"
-                : "&hash=relay",
-        azureHeadersPaged: () => ({})
+    const fixture = createPortalLoginFixture();
+    const { res } = await invokePortalLogin(fixture, {
+        emailAddress: "user@test.local",
+        hash: "wrong"
     });
 
-    const req = { query: { emailAddress: "user@test.local", hash: "wrong" } };
-    const res = createRes();
-    await mod.default(req, res);
-
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
+    assert.strictEqual(fixture.calls.relay.length, 0);
 });
 
 test("getportallogin catch path returns PORTAL_LOGIN_FETCH_FAILED", async () => {
-    const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
+    const fixture = createPortalLoginFixture({
         relayGet: async ({ res, errorResponse }) =>
-            respondErrorMock(res, errorResponse),
-        hashAPIPath: (input) =>
-            input && input.startsWith("/api/endpoint/getportallogin_api")
-                ? "&hash=expected"
-                : "&hash=relay",
-        azureHeadersPaged: () => ({})
+            respondErrorMock(res, errorResponse)
     });
-
-    const req = {
-        query: { emailAddress: "user@test.local", hash: "expected" }
-    };
-    const res = createRes();
-    await mod.default(req, res);
+    const { res } = await invokePortalLogin(fixture);
 
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(
@@ -391,26 +484,13 @@ test("getportallogin catch path returns PORTAL_LOGIN_FETCH_FAILED", async () =>
 
 test("getportallogin passes strict relayPolicy overrides to relayGet", async () => {
     let capturedRelayPolicy = null;
-
-    const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
+    const fixture = createPortalLoginFixture({
         relayGet: async ({ relayPolicy, res }) => {
             capturedRelayPolicy = relayPolicy;
             return respondSuccessMock(res, { value: [] });
-        },
-        hashAPIPath: (input) =>
-            input && input.startsWith("/api/endpoint/getportallogin_api")
-                ? "&hash=expected"
-                : "&hash=relay",
-        azureHeadersPaged: () => ({})
+        }
     });
-
-    const req = {
-        query: { emailAddress: "user@test.local", hash: "expected" }
-    };
-    const res = createRes();
-    await mod.default(req, res);
+    const { res } = await invokePortalLogin(fixture);
 
     assert.strictEqual(res.state.statusCode, 200);
     assert.deepStrictEqual(JSON.parse(JSON.stringify(capturedRelayPolicy)), {
@@ -423,23 +503,19 @@ test("getportallogin passes strict relayPolicy overrides to relayGet", async ()
 });
 
 test("getportallogin accepts encoded email hash variant", async () => {
-    const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
+    const fixture = createPortalLoginFixture({
+        session: { user: { email: "user+test@local" } },
         relayGet: async ({ res }) =>
             respondSuccessMock(res, { value: [{ contactid: "c1" }] }),
         hashAPIPath: (input) =>
             input && input.includes("emailAddress=user%2Btest%40local")
                 ? "&hash=expected"
-                : "&hash=other",
-        azureHeadersPaged: () => ({})
+                : "&hash=other"
+    });
+    const { res } = await invokePortalLogin(fixture, {
+        emailAddress: "user+test@local",
+        hash: "expected"
     });
-
-    const req = {
-        query: { emailAddress: "user+test@local", hash: "expected" }
-    };
-    const res = createRes();
-    await mod.default(req, res);
 
     assert.strictEqual(res.state.statusCode, 200);
     assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
@@ -447,6 +523,45 @@ test("getportallogin accepts encoded email hash variant", async () => {
     });
 });
 
+test("getportallogin uses normalized session email and preserves CRM response", async () => {
+    let capturedQueryUrl;
+    const crmResponse = {
+        value: [
+            {
+                pinswg_preferredlanguage: 846040000,
+                emailaddress1: "user.o'neill@test.local",
+                contactid: "contact-1",
+                yomifullname: "O'Neill, User",
+                firstname: "User",
+                lastname: "O'Neill"
+            }
+        ]
+    };
+    const fixture = createPortalLoginFixture({
+        session: { user: { email: " User.O'Neill@Test.Local " } },
+        relayGet: async ({ queryUrl, res }) => {
+            capturedQueryUrl = queryUrl;
+            return respondSuccessMock(res, crmResponse);
+        }
+    });
+    const { res } = await invokePortalLogin(fixture, {
+        emailAddress: "user.o'neill@test.local",
+        hash: "expected"
+    });
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(res.state.jsonBody)),
+        crmResponse
+    );
+    assert.match(capturedQueryUrl, /emailaddress1 eq 'user\.o''neill@test\.local'/);
+    assert.match(capturedQueryUrl, /statuscode eq 1/);
+    assert.match(
+        capturedQueryUrl,
+        /\$select=pinswg_preferredlanguage,emailaddress1,contactid,yomifullname,firstname,lastname$/
+    );
+});
+
 test("getnewappeals catch path returns ADMIN_NEW_APPEALS_FETCH_FAILED", async () => {
     const mod = loadModule("pages/api/admin/getnewappeals_api.js", {
         respondError: respondErrorMock,
diff --git a/tests/phase22/auth-redirect-safety.test.cjs b/tests/phase22/auth-redirect-safety.test.cjs
index 4416c311..0a194b5c 100644
--- a/tests/phase22/auth-redirect-safety.test.cjs
+++ b/tests/phase22/auth-redirect-safety.test.cjs
@@ -6,7 +6,10 @@ const vm = require("vm");
 const tests = [];
 const test = (name, fn) => tests.push({ name, fn });
 
-const loadAuthInternals = ({ adapterFactory = () => ({}) } = {}) => {
+const loadAuthInternals = ({
+    adapterFactory = () => ({}),
+    resolveCrmLocale = async () => null
+} = {}) => {
     const filePath = path.join(
         __dirname,
         "..",
@@ -56,7 +59,7 @@ const loadAuthInternals = ({ adapterFactory = () => ({}) } = {}) => {
         },
         NextAuth: () => ({}),
         EmailProvider: () => ({}),
-        getPortalLogin: async () => ({ value: [] }),
+        resolveCrmLocale,
         redactSensitive: (value) => value,
         consoleLogger: () => {},
         console: {
diff --git a/tests/phase22/preauth-locale-resolution.test.cjs b/tests/phase22/preauth-locale-resolution.test.cjs
new file mode 100644
index 00000000..2e2d5b76
--- /dev/null
+++ b/tests/phase22/preauth-locale-resolution.test.cjs
@@ -0,0 +1,242 @@
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+const loadModule = (relativePath, injected = {}) => {
+    const filePath = path.join(rootDir, relativePath);
+    let source = fs.readFileSync(filePath, "utf8");
+    const exportNames = Array.from(
+        source.matchAll(/export const\s+(\w+)\s*=/g)
+    ).map((match) => match[1]);
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(/export const\s+/g, "const ");
+    source = source.replace(
+        /export default async function\s+(\w+)\s*\(/g,
+        "async function $1("
+    );
+    source += `\nmodule.exports = { ${exportNames.join(", ")} };\n`;
+    source +=
+        '\nif (typeof handler !== "undefined") module.exports.default = handler;\n';
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        process,
+        console: { log: () => {}, info: () => {}, warn: () => {}, error: () => {} },
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const normalize = (value) => JSON.parse(JSON.stringify(value));
+
+const createRes = () => {
+    const state = { statusCode: null, jsonBody: undefined };
+
+    return {
+        state,
+        status(code) {
+            state.statusCode = code;
+            return this;
+        },
+        json(body) {
+            state.jsonBody = body;
+            return body;
+        }
+    };
+};
+
+const loadLocaleResolver = ({ relayGetData }) =>
+    loadModule("lib/auth/resolveCrmLocale.js", {
+        azureHeadersPaged: (accessToken) => ({ accessToken }),
+        escapeODataString: (value) => value.trim().replace(/'/g, "''"),
+        consoleLogger: () => {},
+        relayGetData,
+        RELAY_POLICY_STRICT_LOGIN: {
+            method: "GET",
+            timeoutMs: 5000,
+            maxRetries: 0,
+            retryBaseDelayMs: 0,
+            retryMaxDelayMs: 0
+        }
+    });
+
+test("pre-auth CRM locale lookup returns Welsh and selects only language", async () => {
+    let capturedRequest;
+    const mod = loadLocaleResolver({
+        relayGetData: async (request) => {
+            capturedRequest = request;
+            return {
+                data: {
+                    value: [
+                        {
+                            pinswg_preferredlanguage: 846040000,
+                            contactid: "must-not-be-returned",
+                            firstname: "Must not be returned"
+                        }
+                    ]
+                }
+            };
+        }
+    });
+
+    const result = await mod.resolveCrmLocale(" Person@Example.com ");
+    const selectClause = new URLSearchParams(
+        capturedRequest.queryUrl.split("?")[1]
+    ).get("$select");
+
+    assert.strictEqual(result, "cy");
+    assert.match(capturedRequest.queryUrl, /\$filter=emailaddress1 eq /);
+    assert.match(capturedRequest.queryUrl, /statuscode eq 1/);
+    assert.strictEqual(selectClause, "pinswg_preferredlanguage");
+    assert.ok(result === "en" || result === "cy" || result === null);
+    for (const field of [
+        "contactid",
+        "emailaddress1",
+        "firstname",
+        "lastname",
+        "yomifullname"
+    ]) {
+        assert.doesNotMatch(selectClause, new RegExp(field));
+        assert.doesNotMatch(result, new RegExp(field));
+    }
+});
+
+test("pre-auth CRM locale lookup returns English for a non-Welsh value", async () => {
+    const mod = loadLocaleResolver({
+        relayGetData: async () => ({
+            data: { value: [{ pinswg_preferredlanguage: 846040001 }] }
+        })
+    });
+
+    assert.strictEqual(await mod.resolveCrmLocale("person@example.com"), "en");
+});
+
+test("pre-auth CRM locale lookup returns null for no contact", async () => {
+    const mod = loadLocaleResolver({
+        relayGetData: async () => ({ data: { value: [] } })
+    });
+
+    assert.strictEqual(await mod.resolveCrmLocale("person@example.com"), null);
+});
+
+test("pre-auth CRM locale lookup preserves first-contact duplicate semantics", async () => {
+    const mod = loadLocaleResolver({
+        relayGetData: async () => ({
+            data: {
+                value: [
+                    { pinswg_preferredlanguage: 846040001 },
+                    { pinswg_preferredlanguage: 846040000 }
+                ]
+            }
+        })
+    });
+
+    assert.strictEqual(await mod.resolveCrmLocale("person@example.com"), "en");
+});
+
+test("pre-auth CRM locale lookup rejects malformed email without CRM access", async () => {
+    let relayCalls = 0;
+    const mod = loadLocaleResolver({
+        relayGetData: async () => {
+            relayCalls += 1;
+            return { data: { value: [] } };
+        }
+    });
+
+    assert.strictEqual(await mod.resolveCrmLocale("not-an-email"), null);
+    assert.strictEqual(relayCalls, 0);
+});
+
+test("pre-auth CRM locale lookup fails closed without leaking CRM details", async () => {
+    const mod = loadLocaleResolver({
+        relayGetData: async () => {
+            throw new Error("CRM secret response details");
+        }
+    });
+
+    assert.strictEqual(await mod.resolveCrmLocale("person@example.com"), null);
+});
+
+test("pre-auth CRM locale lookup escapes OData apostrophes", async () => {
+    let queryUrl;
+    const mod = loadLocaleResolver({
+        relayGetData: async (request) => {
+            queryUrl = request.queryUrl;
+            return { data: { value: [] } };
+        }
+    });
+
+    await mod.resolveCrmLocale("o'connor@example.com");
+
+    assert.match(queryUrl, /o''connor@example\.com/);
+});
+
+test("public sign-in locale route preserves response without CRM lookup", async () => {
+    const source = fs.readFileSync(
+        path.join(rootDir, "pages/api/auth/resolve-locale.js"),
+        "utf8"
+    );
+    const mod = loadModule("pages/api/auth/resolve-locale.js");
+    const res = createRes();
+
+    await mod.default(
+        {
+            method: "POST",
+            body: { email: "other@example.com", locale: "cy" },
+            query: {},
+            cookies: {}
+        },
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(normalize(res.state.jsonBody), { locale: "cy" });
+    assert.doesNotMatch(source, /getPortalLogin|resolveCrmLocale|relayGetData/);
+});
+
+test("both pre-auth callers no longer depend on getPortalLogin", () => {
+    const nextAuthSource = fs.readFileSync(
+        path.join(rootDir, "pages/api/auth/[...nextauth].js"),
+        "utf8"
+    );
+    const routeSource = fs.readFileSync(
+        path.join(rootDir, "pages/api/auth/resolve-locale.js"),
+        "utf8"
+    );
+
+    assert.doesNotMatch(nextAuthSource, /getPortalLogin/);
+    assert.doesNotMatch(routeSource, /getPortalLogin/);
+    assert.match(nextAuthSource, /resolveCrmLocale/);
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 22 pre-auth locale tests passed (${passed}/${tests.length}).`
+    );
+};
+
+if (require.main === module) {
+    run().catch((error) => {
+        console.error(error);
+        process.exit(1);
+    });
+}
+
+module.exports = run;
\ No newline at end of file

From e1f8fb5c96c01857d3ef9486b942192ee8f4629b Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 06:42:16 +0000
Subject: [PATCH 14/24] Revert "security: enforce authenticated CRM contact
 ownership"

This reverts commit e13700ab654fb259195d6bc334c603c5ecd9c423.
---
 lib/auth/resolveCrmLocale.js                  |  42 ---
 pages/api/auth/[...nextauth].js               |  27 +-
 pages/api/auth/resolve-locale.js              |  33 ++-
 pages/api/endpoint/getportallogin_api.js      |  49 +---
 .../endpoint-handler-contract.test.cjs        | 243 +++++-------------
 tests/phase22/auth-redirect-safety.test.cjs   |   7 +-
 .../preauth-locale-resolution.test.cjs        | 242 -----------------
 7 files changed, 126 insertions(+), 517 deletions(-)
 delete mode 100644 lib/auth/resolveCrmLocale.js
 delete mode 100644 tests/phase22/preauth-locale-resolution.test.cjs

diff --git a/lib/auth/resolveCrmLocale.js b/lib/auth/resolveCrmLocale.js
deleted file mode 100644
index 0677ab16..00000000
--- a/lib/auth/resolveCrmLocale.js
+++ /dev/null
@@ -1,42 +0,0 @@
-import { azureHeadersPaged } from "../../actions/core/headers";
-import { escapeODataString } from "../../actions/core/guards";
-import { consoleLogger } from "../../actions/core/logger";
-import { relayGetData } from "../../pages/api/middleware/relayForwarding";
-import { RELAY_POLICY_STRICT_LOGIN } from "../../pages/api/middleware/relayPolicyPresets";
-
-const WELSH_LANGUAGE_CODE = 846040000;
-const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-
-export const resolveCrmLocale = async (email) => {
-    if (typeof email !== "string") return null;
-
-    const normalizedEmail = email.trim().toLowerCase();
-
-    if (!EMAIL_PATTERN.test(normalizedEmail)) return null;
-
-    const queryUrl =
-        "contacts?$filter=emailaddress1 eq '" +
-        escapeODataString(normalizedEmail) +
-        "' and statuscode eq 1&$count=true&$select=pinswg_preferredlanguage";
-
-    try {
-        const { data } = await relayGetData({
-            queryUrl,
-            requestOptionsBuilder: (accessToken) =>
-                azureHeadersPaged(accessToken),
-            relayPolicy: RELAY_POLICY_STRICT_LOGIN
-        });
-        const preferredLanguage = data?.value?.[0]?.pinswg_preferredlanguage;
-
-        if (preferredLanguage === WELSH_LANGUAGE_CODE) return "cy";
-        if (preferredLanguage != null) return "en";
-
-        return null;
-    } catch (error) {
-        consoleLogger({
-            name: "ResolveCrmLocale",
-            message: "CRM locale lookup failed"
-        });
-        return null;
-    }
-};
\ No newline at end of file
diff --git a/pages/api/auth/[...nextauth].js b/pages/api/auth/[...nextauth].js
index f953bf13..ac88da54 100644
--- a/pages/api/auth/[...nextauth].js
+++ b/pages/api/auth/[...nextauth].js
@@ -14,8 +14,8 @@ import { PrismaAdapter } from "@next-auth/prisma-adapter";
 import { PrismaClient } from "@prisma/client";
 import NextAuth from "next-auth";
 import EmailProvider from "../../../lib/auth/email-provider";
-import { resolveCrmLocale } from "../../../lib/auth/resolveCrmLocale";
 import { consoleLogger, redactSensitive } from "../../../actions/core/logger";
+import { getPortalLogin } from "../../../actions/services/accountService";
 
 const prisma = new PrismaClient();
 
@@ -53,6 +53,8 @@ const createVerificationTokenSynchronizationAdapter = (
     };
 };
 
+const WELSH_LANGUAGE_CODE = 846040000;
+
 const authDiagnostic = (event, metadata = {}) => {
     try {
         const safeMeta = JSON.parse(JSON.stringify(metadata));
@@ -82,6 +84,29 @@ const appendParamsAndPathToNewUrl = (fromUrl, toUrl) => {
     }
 };
 
+const resolveCrmLocale = async (email) => {
+    if (!email) return null;
+
+    try {
+        const portalUserObj = await getPortalLogin(email);
+        const preferredLanguage =
+            portalUserObj?.value?.[0]?.pinswg_preferredlanguage;
+
+        if (preferredLanguage === WELSH_LANGUAGE_CODE) {
+            return "cy";
+        }
+
+        if (preferredLanguage != null) {
+            return "en";
+        }
+
+        return null;
+    } catch (error) {
+        consoleLogger(error);
+        return null;
+    }
+};
+
 const resolveEffectiveLocale = async (req, email) => {
     const crmLocale = await resolveCrmLocale(email);
     if (crmLocale) {
diff --git a/pages/api/auth/resolve-locale.js b/pages/api/auth/resolve-locale.js
index f029dce2..f89bf9df 100644
--- a/pages/api/auth/resolve-locale.js
+++ b/pages/api/auth/resolve-locale.js
@@ -1,3 +1,8 @@
+import { getPortalLogin } from "../../../actions/services/accountService";
+import { consoleLogger } from "../../../actions/core/logger";
+
+const WELSH_LANGUAGE_CODE = 846040000;
+
 const resolveRequestLocale = (req) =>
     req?.query?.locale ||
     req?.body?.locale ||
@@ -9,8 +14,30 @@ export default async function handler(req, res) {
         return res.status(405).json({ message: "Method not allowed" });
     }
 
-    const requestedLocale = resolveRequestLocale(req);
-    const locale = requestedLocale === "cy" ? "cy" : "en";
+    const email = String(req.body?.email || "")
+        .trim()
+        .toLowerCase();
+    const sessionLocale = resolveRequestLocale(req);
 
-    return res.status(200).json({ locale });
+    if (!email) {
+        return res.status(200).json({ locale: sessionLocale });
+    }
+
+    try {
+        const portalUserObj = await getPortalLogin(email);
+        const preferredLanguage =
+            portalUserObj?.value?.[0]?.pinswg_preferredlanguage;
+
+        const locale =
+            preferredLanguage === WELSH_LANGUAGE_CODE
+                ? "cy"
+                : preferredLanguage != null
+                  ? "en"
+                  : sessionLocale;
+
+        return res.status(200).json({ locale });
+    } catch (error) {
+        consoleLogger(error);
+        return res.status(200).json({ locale: sessionLocale });
+    }
 }
diff --git a/pages/api/endpoint/getportallogin_api.js b/pages/api/endpoint/getportallogin_api.js
index c690be08..00871021 100644
--- a/pages/api/endpoint/getportallogin_api.js
+++ b/pages/api/endpoint/getportallogin_api.js
@@ -17,61 +17,20 @@
  */
 
 import { azureHeadersPaged } from "../../../actions/core/headers";
-import { escapeODataString } from "../../../actions/core/guards";
 import { hashAPIPath } from "../../../actions/core/hash";
-import { getServerSession } from "next-auth/next";
-import { authOptions } from "../auth/[...nextauth]";
 import { respondError } from "../middleware/apiResponse";
 import { relayGet } from "../middleware/relayForwarding";
 import { RELAY_POLICY_STRICT_LOGIN } from "../middleware/relayPolicyPresets";
 
-const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+$/;
-
 export default async function ApiProxy(req, res) {
-    if (req.method !== "GET") {
-        return respondError(res, {
-            status: 405,
-            code: "METHOD_NOT_ALLOWED",
-            message: "Only GET is supported"
-        });
-    }
-
-    const session = await getServerSession(req, res, authOptions(req, res));
-    const authenticatedEmail = session?.user?.email;
-
-    if (
-        typeof authenticatedEmail !== "string" ||
-        !EMAIL_PATTERN.test(authenticatedEmail.trim())
-    ) {
-        return respondError(res, {
-            status: 401,
-            code: "UNAUTHENTICATED",
-            message: "Authentication required"
-        });
-    }
-
     const emailAddress = req.query.emailAddress;
     const checkHash = req.query.hash;
 
-    if (
-        typeof emailAddress !== "string" ||
-        !EMAIL_PATTERN.test(emailAddress.trim())
-    ) {
+    if (typeof emailAddress !== "string" || emailAddress.trim().length === 0) {
         return respondError(res, {
             status: 400,
-            code: "INVALID_EMAIL_ADDRESS",
-            message: "emailAddress must be a valid email address"
-        });
-    }
-
-    const normalizedAuthenticatedEmail = authenticatedEmail.trim().toLowerCase();
-    const normalizedRequestedEmail = emailAddress.trim().toLowerCase();
-
-    if (normalizedRequestedEmail !== normalizedAuthenticatedEmail) {
-        return respondError(res, {
-            status: 403,
-            code: "FORBIDDEN",
-            message: "Request not permitted"
+            code: "EMAIL_ADDRESS_REQUIRED",
+            message: "emailAddress is required"
         });
     }
 
@@ -104,7 +63,7 @@ export default async function ApiProxy(req, res) {
 
     const queryUrl =
         "contacts?$filter=emailaddress1 eq '" +
-        escapeODataString(normalizedAuthenticatedEmail) +
+        emailAddress +
         "' and statuscode eq 1&$count=true&$select=pinswg_preferredlanguage,emailaddress1,contactid,yomifullname,firstname,lastname";
 
     const relayPolicy = RELAY_POLICY_STRICT_LOGIN;
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 3821f9e2..6c3b2f0f 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -323,157 +323,64 @@ test("getlogin passes strict relayPolicy overrides to relayGet", async () => {
     });
 });
 
-const createPortalLoginFixture = (overrides = {}) => {
-    const calls = {
-        session: [],
-        hash: [],
-        relay: []
-    };
-    const session = Object.prototype.hasOwnProperty.call(overrides, "session")
-        ? overrides.session
-        : { user: { email: "user@test.local" } };
-
+test("getportallogin returns HASH_REQUIRED when hash missing", async () => {
     const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        getServerSession: async (...args) => {
-            calls.session.push(args);
-            return session;
-        },
-        authOptions: (req, res) => ({ req, res }),
-        relayGet: async (options) => {
-            calls.relay.push(options);
-            if (overrides.relayGet) return overrides.relayGet(options);
-            return respondSuccessMock(options.res, { value: [] });
-        },
-        hashAPIPath: (input) => {
-            calls.hash.push(input);
-            if (overrides.hashAPIPath) return overrides.hashAPIPath(input);
-            return "&hash=expected";
-        },
-        escapeODataString: (value) => value.trim().replace(/'/g, "''"),
-        azureHeadersPaged: (accessToken) => ({ accessToken })
-    });
-
-    return { mod, calls };
-};
-
-const invokePortalLogin = async (
-    fixture,
-    query = { emailAddress: "user@test.local", hash: "expected" },
-    method = "GET"
-) => {
-    const req = { method, query };
-    const res = createRes();
-    await fixture.mod.default(req, res);
-
-    return { req, res };
-};
-
-test("getportallogin rejects unsupported methods before authentication", async () => {
-    const fixture = createPortalLoginFixture();
-    const { res } = await invokePortalLogin(fixture, undefined, "POST");
-
-    assert.strictEqual(res.state.statusCode, 405);
-    assert.strictEqual(res.state.jsonBody.error.code, "METHOD_NOT_ALLOWED");
-    assert.strictEqual(fixture.calls.session.length, 0);
-    assert.strictEqual(fixture.calls.relay.length, 0);
-});
-
-test("getportallogin rejects missing session", async () => {
-    const fixture = createPortalLoginFixture({ session: null });
-    const { req, res } = await invokePortalLogin(fixture);
-
-    assert.strictEqual(res.state.statusCode, 401);
-    assert.strictEqual(res.state.jsonBody.error.code, "UNAUTHENTICATED");
-    assert.strictEqual(fixture.calls.session[0][0], req);
-    assert.strictEqual(fixture.calls.session[0][1], res);
-    assert.strictEqual(fixture.calls.relay.length, 0);
-});
-
-test("getportallogin rejects session without email", async () => {
-    const fixture = createPortalLoginFixture({
-        session: { user: { id: "application-user" } }
-    });
-    const { res } = await invokePortalLogin(fixture);
-
-    assert.strictEqual(res.state.statusCode, 401);
-    assert.strictEqual(res.state.jsonBody.error.code, "UNAUTHENTICATED");
-    assert.strictEqual(fixture.calls.relay.length, 0);
-});
-
-test("getportallogin rejects malformed requested email", async () => {
-    const fixture = createPortalLoginFixture();
-    const { res } = await invokePortalLogin(fixture, {
-        emailAddress: "not-an-email",
-        hash: "expected"
-    });
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_EMAIL_ADDRESS");
-    assert.strictEqual(fixture.calls.relay.length, 0);
-});
-
-test("getportallogin rejects another user's email before CRM access", async () => {
-    const fixture = createPortalLoginFixture();
-    const { res } = await invokePortalLogin(fixture, {
-        emailAddress: "other@test.local",
-        hash: "expected"
-    });
-
-    assert.strictEqual(res.state.statusCode, 403);
-    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
-    assert.strictEqual(fixture.calls.hash.length, 0);
-    assert.strictEqual(fixture.calls.relay.length, 0);
-});
-
-test("getportallogin valid HMAC for another email does not bypass ownership", async () => {
-    const fixture = createPortalLoginFixture({
+        relayGet: async () => ({}),
         hashAPIPath: (input) =>
-            input.includes("other%40test.local") ||
-            input.includes("other@test.local")
-                ? "&hash=valid-other-user-hash"
-                : "&hash=unexpected"
-    });
-    const { res } = await invokePortalLogin(fixture, {
-        emailAddress: "other@test.local",
-        hash: "valid-other-user-hash"
+            input && input.startsWith("/api/endpoint/getportallogin_api")
+                ? "&hash=expected"
+                : "&hash=relay",
+        azureHeadersPaged: () => ({})
     });
 
-    assert.strictEqual(res.state.statusCode, 403);
-    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
-    assert.strictEqual(fixture.calls.relay.length, 0);
-});
-
-test("getportallogin returns HASH_REQUIRED when hash missing", async () => {
-    const fixture = createPortalLoginFixture();
-    const { res } = await invokePortalLogin(fixture, {
-        emailAddress: "user@test.local"
-    });
+    const req = { query: { emailAddress: "user@test.local" } };
+    const res = createRes();
+    await mod.default(req, res);
 
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(res.state.jsonBody.error.code, "HASH_REQUIRED");
-    assert.strictEqual(fixture.calls.relay.length, 0);
 });
 
 test("getportallogin returns INVALID_HASH when hash mismatch", async () => {
-    const fixture = createPortalLoginFixture();
-    const { res } = await invokePortalLogin(fixture, {
-        emailAddress: "user@test.local",
-        hash: "wrong"
+    const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        relayGet: async () => ({}),
+        hashAPIPath: (input) =>
+            input && input.startsWith("/api/endpoint/getportallogin_api")
+                ? "&hash=expected"
+                : "&hash=relay",
+        azureHeadersPaged: () => ({})
     });
 
+    const req = { query: { emailAddress: "user@test.local", hash: "wrong" } };
+    const res = createRes();
+    await mod.default(req, res);
+
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(res.state.jsonBody.error.code, "INVALID_HASH");
-    assert.strictEqual(fixture.calls.relay.length, 0);
 });
 
 test("getportallogin catch path returns PORTAL_LOGIN_FETCH_FAILED", async () => {
-    const fixture = createPortalLoginFixture({
+    const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
         relayGet: async ({ res, errorResponse }) =>
-            respondErrorMock(res, errorResponse)
+            respondErrorMock(res, errorResponse),
+        hashAPIPath: (input) =>
+            input && input.startsWith("/api/endpoint/getportallogin_api")
+                ? "&hash=expected"
+                : "&hash=relay",
+        azureHeadersPaged: () => ({})
     });
-    const { res } = await invokePortalLogin(fixture);
+
+    const req = {
+        query: { emailAddress: "user@test.local", hash: "expected" }
+    };
+    const res = createRes();
+    await mod.default(req, res);
 
     assert.strictEqual(res.state.statusCode, 400);
     assert.strictEqual(
@@ -484,13 +391,26 @@ test("getportallogin catch path returns PORTAL_LOGIN_FETCH_FAILED", async () =>
 
 test("getportallogin passes strict relayPolicy overrides to relayGet", async () => {
     let capturedRelayPolicy = null;
-    const fixture = createPortalLoginFixture({
+
+    const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
         relayGet: async ({ relayPolicy, res }) => {
             capturedRelayPolicy = relayPolicy;
             return respondSuccessMock(res, { value: [] });
-        }
+        },
+        hashAPIPath: (input) =>
+            input && input.startsWith("/api/endpoint/getportallogin_api")
+                ? "&hash=expected"
+                : "&hash=relay",
+        azureHeadersPaged: () => ({})
     });
-    const { res } = await invokePortalLogin(fixture);
+
+    const req = {
+        query: { emailAddress: "user@test.local", hash: "expected" }
+    };
+    const res = createRes();
+    await mod.default(req, res);
 
     assert.strictEqual(res.state.statusCode, 200);
     assert.deepStrictEqual(JSON.parse(JSON.stringify(capturedRelayPolicy)), {
@@ -503,65 +423,30 @@ test("getportallogin passes strict relayPolicy overrides to relayGet", async ()
 });
 
 test("getportallogin accepts encoded email hash variant", async () => {
-    const fixture = createPortalLoginFixture({
-        session: { user: { email: "user+test@local" } },
+    const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
         relayGet: async ({ res }) =>
             respondSuccessMock(res, { value: [{ contactid: "c1" }] }),
         hashAPIPath: (input) =>
             input && input.includes("emailAddress=user%2Btest%40local")
                 ? "&hash=expected"
-                : "&hash=other"
-    });
-    const { res } = await invokePortalLogin(fixture, {
-        emailAddress: "user+test@local",
-        hash: "expected"
+                : "&hash=other",
+        azureHeadersPaged: () => ({})
     });
 
+    const req = {
+        query: { emailAddress: "user+test@local", hash: "expected" }
+    };
+    const res = createRes();
+    await mod.default(req, res);
+
     assert.strictEqual(res.state.statusCode, 200);
     assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
         value: [{ contactid: "c1" }]
     });
 });
 
-test("getportallogin uses normalized session email and preserves CRM response", async () => {
-    let capturedQueryUrl;
-    const crmResponse = {
-        value: [
-            {
-                pinswg_preferredlanguage: 846040000,
-                emailaddress1: "user.o'neill@test.local",
-                contactid: "contact-1",
-                yomifullname: "O'Neill, User",
-                firstname: "User",
-                lastname: "O'Neill"
-            }
-        ]
-    };
-    const fixture = createPortalLoginFixture({
-        session: { user: { email: " User.O'Neill@Test.Local " } },
-        relayGet: async ({ queryUrl, res }) => {
-            capturedQueryUrl = queryUrl;
-            return respondSuccessMock(res, crmResponse);
-        }
-    });
-    const { res } = await invokePortalLogin(fixture, {
-        emailAddress: "user.o'neill@test.local",
-        hash: "expected"
-    });
-
-    assert.strictEqual(res.state.statusCode, 200);
-    assert.deepStrictEqual(
-        JSON.parse(JSON.stringify(res.state.jsonBody)),
-        crmResponse
-    );
-    assert.match(capturedQueryUrl, /emailaddress1 eq 'user\.o''neill@test\.local'/);
-    assert.match(capturedQueryUrl, /statuscode eq 1/);
-    assert.match(
-        capturedQueryUrl,
-        /\$select=pinswg_preferredlanguage,emailaddress1,contactid,yomifullname,firstname,lastname$/
-    );
-});
-
 test("getnewappeals catch path returns ADMIN_NEW_APPEALS_FETCH_FAILED", async () => {
     const mod = loadModule("pages/api/admin/getnewappeals_api.js", {
         respondError: respondErrorMock,
diff --git a/tests/phase22/auth-redirect-safety.test.cjs b/tests/phase22/auth-redirect-safety.test.cjs
index 0a194b5c..4416c311 100644
--- a/tests/phase22/auth-redirect-safety.test.cjs
+++ b/tests/phase22/auth-redirect-safety.test.cjs
@@ -6,10 +6,7 @@ const vm = require("vm");
 const tests = [];
 const test = (name, fn) => tests.push({ name, fn });
 
-const loadAuthInternals = ({
-    adapterFactory = () => ({}),
-    resolveCrmLocale = async () => null
-} = {}) => {
+const loadAuthInternals = ({ adapterFactory = () => ({}) } = {}) => {
     const filePath = path.join(
         __dirname,
         "..",
@@ -59,7 +56,7 @@ const loadAuthInternals = ({
         },
         NextAuth: () => ({}),
         EmailProvider: () => ({}),
-        resolveCrmLocale,
+        getPortalLogin: async () => ({ value: [] }),
         redactSensitive: (value) => value,
         consoleLogger: () => {},
         console: {
diff --git a/tests/phase22/preauth-locale-resolution.test.cjs b/tests/phase22/preauth-locale-resolution.test.cjs
deleted file mode 100644
index 2e2d5b76..00000000
--- a/tests/phase22/preauth-locale-resolution.test.cjs
+++ /dev/null
@@ -1,242 +0,0 @@
-const assert = require("assert");
-const fs = require("fs");
-const path = require("path");
-const vm = require("vm");
-
-const rootDir = path.resolve(__dirname, "..", "..");
-const tests = [];
-const test = (name, fn) => tests.push({ name, fn });
-
-const loadModule = (relativePath, injected = {}) => {
-    const filePath = path.join(rootDir, relativePath);
-    let source = fs.readFileSync(filePath, "utf8");
-    const exportNames = Array.from(
-        source.matchAll(/export const\s+(\w+)\s*=/g)
-    ).map((match) => match[1]);
-
-    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
-    source = source.replace(/export const\s+/g, "const ");
-    source = source.replace(
-        /export default async function\s+(\w+)\s*\(/g,
-        "async function $1("
-    );
-    source += `\nmodule.exports = { ${exportNames.join(", ")} };\n`;
-    source +=
-        '\nif (typeof handler !== "undefined") module.exports.default = handler;\n';
-
-    const context = {
-        module: { exports: {} },
-        exports: {},
-        require,
-        process,
-        console: { log: () => {}, info: () => {}, warn: () => {}, error: () => {} },
-        ...injected
-    };
-
-    vm.runInNewContext(source, context, { filename: filePath });
-    return context.module.exports;
-};
-
-const normalize = (value) => JSON.parse(JSON.stringify(value));
-
-const createRes = () => {
-    const state = { statusCode: null, jsonBody: undefined };
-
-    return {
-        state,
-        status(code) {
-            state.statusCode = code;
-            return this;
-        },
-        json(body) {
-            state.jsonBody = body;
-            return body;
-        }
-    };
-};
-
-const loadLocaleResolver = ({ relayGetData }) =>
-    loadModule("lib/auth/resolveCrmLocale.js", {
-        azureHeadersPaged: (accessToken) => ({ accessToken }),
-        escapeODataString: (value) => value.trim().replace(/'/g, "''"),
-        consoleLogger: () => {},
-        relayGetData,
-        RELAY_POLICY_STRICT_LOGIN: {
-            method: "GET",
-            timeoutMs: 5000,
-            maxRetries: 0,
-            retryBaseDelayMs: 0,
-            retryMaxDelayMs: 0
-        }
-    });
-
-test("pre-auth CRM locale lookup returns Welsh and selects only language", async () => {
-    let capturedRequest;
-    const mod = loadLocaleResolver({
-        relayGetData: async (request) => {
-            capturedRequest = request;
-            return {
-                data: {
-                    value: [
-                        {
-                            pinswg_preferredlanguage: 846040000,
-                            contactid: "must-not-be-returned",
-                            firstname: "Must not be returned"
-                        }
-                    ]
-                }
-            };
-        }
-    });
-
-    const result = await mod.resolveCrmLocale(" Person@Example.com ");
-    const selectClause = new URLSearchParams(
-        capturedRequest.queryUrl.split("?")[1]
-    ).get("$select");
-
-    assert.strictEqual(result, "cy");
-    assert.match(capturedRequest.queryUrl, /\$filter=emailaddress1 eq /);
-    assert.match(capturedRequest.queryUrl, /statuscode eq 1/);
-    assert.strictEqual(selectClause, "pinswg_preferredlanguage");
-    assert.ok(result === "en" || result === "cy" || result === null);
-    for (const field of [
-        "contactid",
-        "emailaddress1",
-        "firstname",
-        "lastname",
-        "yomifullname"
-    ]) {
-        assert.doesNotMatch(selectClause, new RegExp(field));
-        assert.doesNotMatch(result, new RegExp(field));
-    }
-});
-
-test("pre-auth CRM locale lookup returns English for a non-Welsh value", async () => {
-    const mod = loadLocaleResolver({
-        relayGetData: async () => ({
-            data: { value: [{ pinswg_preferredlanguage: 846040001 }] }
-        })
-    });
-
-    assert.strictEqual(await mod.resolveCrmLocale("person@example.com"), "en");
-});
-
-test("pre-auth CRM locale lookup returns null for no contact", async () => {
-    const mod = loadLocaleResolver({
-        relayGetData: async () => ({ data: { value: [] } })
-    });
-
-    assert.strictEqual(await mod.resolveCrmLocale("person@example.com"), null);
-});
-
-test("pre-auth CRM locale lookup preserves first-contact duplicate semantics", async () => {
-    const mod = loadLocaleResolver({
-        relayGetData: async () => ({
-            data: {
-                value: [
-                    { pinswg_preferredlanguage: 846040001 },
-                    { pinswg_preferredlanguage: 846040000 }
-                ]
-            }
-        })
-    });
-
-    assert.strictEqual(await mod.resolveCrmLocale("person@example.com"), "en");
-});
-
-test("pre-auth CRM locale lookup rejects malformed email without CRM access", async () => {
-    let relayCalls = 0;
-    const mod = loadLocaleResolver({
-        relayGetData: async () => {
-            relayCalls += 1;
-            return { data: { value: [] } };
-        }
-    });
-
-    assert.strictEqual(await mod.resolveCrmLocale("not-an-email"), null);
-    assert.strictEqual(relayCalls, 0);
-});
-
-test("pre-auth CRM locale lookup fails closed without leaking CRM details", async () => {
-    const mod = loadLocaleResolver({
-        relayGetData: async () => {
-            throw new Error("CRM secret response details");
-        }
-    });
-
-    assert.strictEqual(await mod.resolveCrmLocale("person@example.com"), null);
-});
-
-test("pre-auth CRM locale lookup escapes OData apostrophes", async () => {
-    let queryUrl;
-    const mod = loadLocaleResolver({
-        relayGetData: async (request) => {
-            queryUrl = request.queryUrl;
-            return { data: { value: [] } };
-        }
-    });
-
-    await mod.resolveCrmLocale("o'connor@example.com");
-
-    assert.match(queryUrl, /o''connor@example\.com/);
-});
-
-test("public sign-in locale route preserves response without CRM lookup", async () => {
-    const source = fs.readFileSync(
-        path.join(rootDir, "pages/api/auth/resolve-locale.js"),
-        "utf8"
-    );
-    const mod = loadModule("pages/api/auth/resolve-locale.js");
-    const res = createRes();
-
-    await mod.default(
-        {
-            method: "POST",
-            body: { email: "other@example.com", locale: "cy" },
-            query: {},
-            cookies: {}
-        },
-        res
-    );
-
-    assert.strictEqual(res.state.statusCode, 200);
-    assert.deepStrictEqual(normalize(res.state.jsonBody), { locale: "cy" });
-    assert.doesNotMatch(source, /getPortalLogin|resolveCrmLocale|relayGetData/);
-});
-
-test("both pre-auth callers no longer depend on getPortalLogin", () => {
-    const nextAuthSource = fs.readFileSync(
-        path.join(rootDir, "pages/api/auth/[...nextauth].js"),
-        "utf8"
-    );
-    const routeSource = fs.readFileSync(
-        path.join(rootDir, "pages/api/auth/resolve-locale.js"),
-        "utf8"
-    );
-
-    assert.doesNotMatch(nextAuthSource, /getPortalLogin/);
-    assert.doesNotMatch(routeSource, /getPortalLogin/);
-    assert.match(nextAuthSource, /resolveCrmLocale/);
-});
-
-const run = async () => {
-    let passed = 0;
-
-    for (const currentTest of tests) {
-        await currentTest.fn();
-        passed += 1;
-    }
-
-    console.log(
-        `Phase 22 pre-auth locale tests passed (${passed}/${tests.length}).`
-    );
-};
-
-if (require.main === module) {
-    run().catch((error) => {
-        console.error(error);
-        process.exit(1);
-    });
-}
-
-module.exports = run;
\ No newline at end of file

From f7479b72b9e9032d1a7ebc5d97579e634bf2eab4 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 09:14:54 +0000
Subject: [PATCH 15/24] security: remove obsolete CRM password update
 functionality

---
 actions/services/accountDirectService.js      |  14 --
 actions/services/accountService.js            |   2 -
 components/account/changepassword.js          | 184 ------------------
 components/myportal/youraccount.js            |  18 --
 lib/routing/breadcrumbRendererFactories.js    |   9 -
 pages/account/changepassword.js               | 120 ------------
 pages/api/endpoint/updatepassword_api.js      |  71 -------
 .../endpoint-handler-contract.test.cjs        |  62 ------
 .../breadcrumbs-route-map-structure.test.cjs  |   6 -
 9 files changed, 486 deletions(-)
 delete mode 100644 components/account/changepassword.js
 delete mode 100644 pages/account/changepassword.js
 delete mode 100644 pages/api/endpoint/updatepassword_api.js

diff --git a/actions/services/accountDirectService.js b/actions/services/accountDirectService.js
index 20a41ec0..e86fa1ac 100644
--- a/actions/services/accountDirectService.js
+++ b/actions/services/accountDirectService.js
@@ -22,20 +22,6 @@ export const getLogin = (emailAddress, pwd) => {
     });
 };
 
-export const updatePassword = (contactId, newpassword) => {
-    var queryUrl = "/api/endpoint/updateaccount_api?contactId=" + contactId;
-    var data = { "pinswg_custom_password": newpassword };
-    var config = {
-        method: "post",
-        url: queryUrl,
-        data: data
-    };
-
-    return requestJson(config).catch((error) => {
-        consoleLogger(error);
-    });
-};
-
 export const updateAccount = async (contactId, updateBody, ssr) => {
     var queryUrl =
         (ssr ? BASE_URL : "") +
diff --git a/actions/services/accountService.js b/actions/services/accountService.js
index 1cf7f7aa..85ddd0db 100644
--- a/actions/services/accountService.js
+++ b/actions/services/accountService.js
@@ -1,7 +1,6 @@
 import {
     getPersonalAccount,
     getLogin,
-    updatePassword,
     updateAccount,
     createAccount,
     getEmailAccountCheck,
@@ -13,7 +12,6 @@ import {
 export {
     getPersonalAccount,
     getLogin,
-    updatePassword,
     updateAccount,
     createAccount,
     getEmailAccountCheck,
diff --git a/components/account/changepassword.js b/components/account/changepassword.js
deleted file mode 100644
index 760be8a8..00000000
--- a/components/account/changepassword.js
+++ /dev/null
@@ -1,184 +0,0 @@
-import useTranslation from "next-translate/useTranslation";
-import Link from "next/link";
-import { useRouter } from "next/router";
-import React, { useState } from "react";
-import { connect } from "react-redux";
-import { Field, formValueSelector, reduxForm } from "redux-form";
-import { updatePassword } from "../../actions/services/accountService";
-
-const RenderTextfield = ({
-    id,
-    className,
-    rows,
-    datafieldname,
-    name,
-    label,
-    input,
-    type,
-    errorMsg,
-    meta: { touched, error },
-    ...custom
-}) => {
-    return (
-        <>
-            <div
-                className={
-                    touched && error
-                        ? "govuk-form-group govuk-form-group--error"
-                        : "govuk-form-group "
-                }
-            >
-                <label className="govuk-label " htmlFor={id} id={id + "_label"}>
-                    {label}
-                </label>
-                {touched && error && (
-                    <span id={id + "-error"} className="govuk-error-message">
-                        <span className="govuk-visually-hidden">Error:</span>{" "}
-                        {touched &&
-                            ((error && (
-                                <span>{errorMsg ? errorMsg : error}</span>
-                            )) ||
-                                (warning && <span>{warning}</span>))}
-                    </span>
-                )}
-                <input
-                    {...input}
-                    className={className}
-                    name={name}
-                    id={id}
-                    type={type}
-                />
-            </div>
-        </>
-    );
-};
-
-const ChangePassword = (props) => {
-    const {
-        footerLinks,
-        pages,
-        handleSubmit,
-        value,
-        setPasswordUpdated,
-        passwordUpdated
-    } = props;
-    let { t, lang } = useTranslation();
-
-    const router = useRouter();
-    const { locale } = router;
-
-    let errorsobj = {};
-
-    const onHandleSubmit = (values) => {
-        let contactid = props.props.accountDetails.loggedinUserId;
-        let updateBody = props.props.form.changepasswordForm.values.newpassword;
-        console.log(contactid, updateBody);
-        updatePassword(contactid, updateBody);
-        setPasswordUpdated(true);
-    };
-
-    const required = (value) => (value ? undefined : "Is required");
-
-    const passwordsMustMatch = (value, allValues) =>
-        value !== allValues.newpassword ? "Passwords do not match" : undefined;
-
-    const minLength = (min) => (value) =>
-        value && value.length < min
-            ? `Must be at least ${min} characters`
-            : undefined;
-
-    const [hasErrors, setHasErrors] = useState("");
-
-    return (
-        <>
-            {passwordUpdated != true ? (
-                <form onSubmit={handleSubmit(onHandleSubmit)}>
-                    <fieldset className="govuk-fieldset">
-                        <Field
-                            name="newpassword"
-                            id="newpassword"
-                            component={RenderTextfield}
-                            type="password"
-                            className="govuk-input govuk-input--width-20"
-                            validate={[required, minLength(6)]}
-                            label="New password"
-                        />
-                        <Field
-                            name="confirmpassword"
-                            id="confirmpassword"
-                            component={RenderTextfield}
-                            type="password"
-                            className="govuk-input govuk-input--width-20"
-                            validate={[required, passwordsMustMatch]}
-                            label="Confirm new password"
-                        />
-                    </fieldset>
-
-                    <div className="govuk-button-group">
-                        <button
-                            type="submit"
-                            className="govuk-button"
-                            data-module="govuk-button"
-                        >
-                            Continue
-                        </button>
-                        <Link
-                            href={
-                                "/myportal?q=" +
-                                props.accountDetails.loggedinUserId
-                            }
-                            className="govuk-link"
-                        >
-                            Cancel
-                        </Link>
-                    </div>
-                </form>
-            ) : (
-                <>
-                    <p className="govuk-body">
-                        <Link
-                            href={
-                                "/myportal?q=" +
-                                props.accountDetails.loggedinUserId
-                            }
-                            className="govuk-link"
-                        >
-                            Go to My Portal
-                        </Link>
-                    </p>
-                </>
-            )}
-        </>
-    );
-};
-
-const mapStateToProps = (state) => {
-    return {
-        search: state.search,
-        searchResultsObj: state.searchResultsObj,
-        formData: state.formData,
-        appealType: state.appealType,
-        accountDetails: state.accountDetails
-        //form: state.form,
-    };
-};
-
-const mapDispatchToProps = (dispatch) => {
-    return {
-        setCurrentSection: (currentSection) => {
-            dispatch(setCurrentSection(currentSection));
-        }
-    };
-};
-
-const selector = formValueSelector("changepasswordForm"); // <-- same as form name
-
-export default connect(
-    mapStateToProps,
-    mapDispatchToProps
-)(
-    reduxForm({
-        form: "changepasswordForm",
-        destroyOnUnmount: false
-    })(ChangePassword)
-);
diff --git a/components/myportal/youraccount.js b/components/myportal/youraccount.js
index 0f6bb6cf..64fbf470 100644
--- a/components/myportal/youraccount.js
+++ b/components/myportal/youraccount.js
@@ -27,24 +27,6 @@ export default function YourAccount() {
                         </Link>
                     </div>
                 </div>
-
-                {/* <div className="card-body">
-                <h3 className="heading-small card-heading">
-                    {t("myportal:changepassword-card-title")}
-                </h3>
-                <p className="govuk-body-s">
-                    {" "}
-                    {t("myportal:changepassword-card-paragraph-one")}
-                </p>
-
-                <div>
-                    <Link href="/account/changepassword">
-                        <a className="govuk-button-secondary">
-                            {t("myportal:changepassword-card-link")}
-                        </a>
-                    </Link>
-                </div>
-            </div> */}
             </div>
         </>
     );
diff --git a/lib/routing/breadcrumbRendererFactories.js b/lib/routing/breadcrumbRendererFactories.js
index 0d0961db..8bf1bec3 100644
--- a/lib/routing/breadcrumbRendererFactories.js
+++ b/lib/routing/breadcrumbRendererFactories.js
@@ -472,15 +472,6 @@ export const createDetailAndAccountRouteRenderers = ({
                 {t("account:account-title")}
             </li>
         </>
-    ),
-
-    "/account/changepassword": () => (
-        <>
-            {renderLinkCrumb(cyMyPortalHref, t("common:breadcrumb-my-portal"))}
-            <li className="govuk-breadcrumbs__list-item">
-                Update your password
-            </li>
-        </>
     )
 });
 
diff --git a/pages/account/changepassword.js b/pages/account/changepassword.js
deleted file mode 100644
index 92b19237..00000000
--- a/pages/account/changepassword.js
+++ /dev/null
@@ -1,120 +0,0 @@
-import Link from "next/link";
-import _ from "lodash";
-import Head from "next/head";
-import Header from "../../components/header";
-import Banner from "../../components/banner";
-import CookieBanner from "../../components/cookieBanner";
-import Breadcrumbs from "../../components/breadcrumbs";
-import Footer from "../../components/footer";
-
-import { useSelector, shallowEqual, connect } from "react-redux";
-import { wrapper } from "../../store/store";
-
-import { useRouter } from "next/router";
-import { useState } from "react";
-import useTranslation from "next-translate/useTranslation";
-import { JSONPath as jsonpath } from "jsonpath-plus";
-import { reduxForm, formValueSelector } from "redux-form";
-
-import ChangePassword from "../../components/account/changepassword";
-import xpath from "xpath";
-import {
-    setAppealType,
-    setAppealTypeTitle,
-    setAppealTypeID,
-    setAppealLPA,
-    getAppealTypeObj
-} from "../../store/appealType/action";
-import {
-    getAppealsTypes,
-    getLPA
-} from "../../actions/services/referenceDataService";
-import { setLPA } from "../../store/lpa/action";
-
-import { getSession, useSession } from "next-auth/react";
-import NoSessionWarning from "../../components/nosession";
-
-const Home = (props) => {
-    const { footerLinks, pages, formData } = props;
-    let { t, lang } = useTranslation();
-
-    const router = useRouter();
-    const { locale } = router;
-    const { appealtypes } = router.query;
-
-    const { appealType, LPAData } = props;
-    const [passwordUpdated, setPasswordUpdated] = useState(false);
-
-    const { data: session, status } = useSession();
-
-    if (status === "loading") {
-        return <NoSessionWarning loading={true} />;
-    }
-
-    if (status === "unauthenticated") {
-        router.push("/auth/signin");
-        return <NoSessionWarning />;
-    }
-
-    return (
-        <div>
-            <Head>
-                <title>
-                    {t("search:page-title")} - {t("common:service-name")}
-                </title>
-            </Head>
-            <div id="page_wrapper">
-                <CookieBanner />
-                <Header />
-
-                <div className="govuk-grid-row">
-                    <div className="govuk-grid-column-full">
-                        <div className="govuk-width-container">
-                            <Breadcrumbs slug={appealtypes} props={props} />
-                            <main
-                                className="govuk-main-wrapper--auto-spacing"
-                                id="main-content"
-                                role="main"
-                            >
-                                <div className="govuk-grid-row">
-                                    <div className="govuk-grid-column-two-thirds">
-                                        {passwordUpdated == true ? (
-                                            <h1>
-                                                Your password has been changed
-                                            </h1>
-                                        ) : (
-                                            <h1>Change password</h1>
-                                        )}
-                                        <ChangePassword
-                                            props={props}
-                                            setPasswordUpdated={
-                                                setPasswordUpdated
-                                            }
-                                            passwordUpdated={passwordUpdated}
-                                        />
-                                    </div>
-                                </div>
-                            </main>
-                        </div>
-                    </div>
-                </div>
-
-                <Footer footerLinks={footerLinks} ticketnumber={props} />
-            </div>
-        </div>
-    );
-};
-
-const mapStateToProps = (state) => {
-    return {
-        search: state.search,
-        searchResultsObj: state.searchResultsObj,
-        formData: state.formData,
-        appealType: state.appealType,
-        LPAData: state.LPAData,
-        form: state.form,
-        accountDetails: state.accountDetails
-    };
-};
-
-export default connect(mapStateToProps)(Home);
diff --git a/pages/api/endpoint/updatepassword_api.js b/pages/api/endpoint/updatepassword_api.js
deleted file mode 100644
index dc8a64cb..00000000
--- a/pages/api/endpoint/updatepassword_api.js
+++ /dev/null
@@ -1,71 +0,0 @@
-/**
- * @swagger
- * /api/endpoint/updatepassword_api:
- *   patch:
- *     tags: [Account]
- *     description: Update password
- *     summary: Phase 2
- *     responses:
- *       200:
- *         description: Success
- */
-
-import axios from "axios";
-import { consoleLogger } from "../../../actions/core/logger";
-import { getToken } from "../../../actions/core/token";
-import { hashAPIPath } from "../../../actions/core/hash";
-import { respondError, respondSuccess } from "../middleware/apiResponse";
-
-const WEBAPI_URL =
-    process.env.RELAY_ROOT ||
-    "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
-
-export default async function ApiProxy(req, res) {
-    const contactId = req.query.contactId;
-
-    if (typeof contactId !== "string" || contactId.trim().length === 0) {
-        return respondError(res, {
-            status: 400,
-            code: "CONTACT_ID_REQUIRED",
-            message: "contactId is required"
-        });
-    }
-
-    if (!req.body || Object.keys(req.body).length === 0) {
-        return respondError(res, {
-            status: 400,
-            code: "PASSWORD_UPDATE_PAYLOAD_REQUIRED",
-            message: "Password update payload is required"
-        });
-    }
-
-    try {
-        const token = await getToken();
-        const data = JSON.stringify(req.body);
-        const queryUrl = "contacts(" + contactId + ")";
-
-        const config = {
-            method: "patch",
-            url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-            headers: {
-                "OData-MaxVersion": "4.0",
-                "OData-Version": "4.0",
-                Accept: "application/json",
-                Prefer: 'odata.include-annotations="*",return=representation',
-                Authorization: "Bearer " + token.access_token,
-                "Content-Type": "application/json"
-            },
-            data
-        };
-
-        const response = await axios(config);
-        return respondSuccess(res, response.data);
-    } catch (error) {
-        consoleLogger(error);
-        return respondError(res, {
-            status: 400,
-            code: "PASSWORD_UPDATE_FAILED",
-            message: "Failed to update password"
-        });
-    }
-}
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 6c3b2f0f..dfbb3b2b 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -982,68 +982,6 @@ test("updateaccount catch path returns ACCOUNT_UPDATE_FAILED", async () => {
     assert.strictEqual(res.state.jsonBody.error.code, "ACCOUNT_UPDATE_FAILED");
 });
 
-test("updatepassword returns CONTACT_ID_REQUIRED when contactId missing", async () => {
-    const mod = loadModule("pages/api/endpoint/updatepassword_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => ({ data: { contactid: "c1" } }),
-        consoleLogger: () => {}
-    });
-
-    const req = { query: {}, body: { pinswg_password: "abc" } };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "CONTACT_ID_REQUIRED");
-});
-
-test("updatepassword returns PASSWORD_UPDATE_PAYLOAD_REQUIRED when body missing", async () => {
-    const mod = loadModule("pages/api/endpoint/updatepassword_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => ({ data: { contactid: "c1" } }),
-        consoleLogger: () => {}
-    });
-
-    const req = { query: { contactId: "c1" }, body: undefined };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(
-        res.state.jsonBody.error.code,
-        "PASSWORD_UPDATE_PAYLOAD_REQUIRED"
-    );
-});
-
-test("updatepassword catch path returns PASSWORD_UPDATE_FAILED", async () => {
-    const mod = loadModule("pages/api/endpoint/updatepassword_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => {
-            throw new Error("relay failed");
-        },
-        consoleLogger: () => {}
-    });
-
-    const req = {
-        query: { contactId: "c1" },
-        body: { pinswg_password: "abc" }
-    };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "PASSWORD_UPDATE_FAILED");
-});
-
 test("getbasicsearch returns SEARCH_STRING_REQUIRED when searchString missing", async () => {
     const mod = loadModule("pages/api/endpoint/getbasicsearch_api.js", {
         respondError: respondErrorMock,
diff --git a/tests/phase22/breadcrumbs-route-map-structure.test.cjs b/tests/phase22/breadcrumbs-route-map-structure.test.cjs
index 4dfd31a3..f416dca4 100644
--- a/tests/phase22/breadcrumbs-route-map-structure.test.cjs
+++ b/tests/phase22/breadcrumbs-route-map-structure.test.cjs
@@ -203,12 +203,6 @@ test("breadcrumbs/factory module includes expected mapped route definitions", as
         true,
         "Expected /account/personaldetails to be mapped in createDetailAndAccountRouteRenderers"
     );
-
-    assert.strictEqual(
-        source.includes('"/account/changepassword": () =>'),
-        true,
-        "Expected /account/changepassword to be mapped in createDetailAndAccountRouteRenderers"
-    );
 });
 
 test("breadcrumbs/component composes mapped routes via imported factories and shared resolver", async () => {

From ddcef8f5eaea81a4f58a7e9fe2886eab1ddfdbcb Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 09:22:29 +0000
Subject: [PATCH 16/24] security: remove obsolete CRM login endpoint

---
 actions/services/accountDirectService.js      | 11 ---
 actions/services/accountService.js            |  2 -
 pages/api/endpoint/getlogin_api.js            | 69 --------------
 .../endpoint-handler-contract.test.cjs        | 92 -------------------
 4 files changed, 174 deletions(-)
 delete mode 100644 pages/api/endpoint/getlogin_api.js

diff --git a/actions/services/accountDirectService.js b/actions/services/accountDirectService.js
index e86fa1ac..8e571774 100644
--- a/actions/services/accountDirectService.js
+++ b/actions/services/accountDirectService.js
@@ -11,17 +11,6 @@ export const getPersonalAccount = (contactid) => {
     });
 };
 
-export const getLogin = (emailAddress, pwd) => {
-    return getJson(
-        "/api/endpoint/getlogin_api?emailAddress=" +
-            emailAddress +
-            "&pwd=" +
-            pwd
-    ).catch((error) => {
-        consoleLogger(error);
-    });
-};
-
 export const updateAccount = async (contactId, updateBody, ssr) => {
     var queryUrl =
         (ssr ? BASE_URL : "") +
diff --git a/actions/services/accountService.js b/actions/services/accountService.js
index 85ddd0db..71edd9c1 100644
--- a/actions/services/accountService.js
+++ b/actions/services/accountService.js
@@ -1,6 +1,5 @@
 import {
     getPersonalAccount,
-    getLogin,
     updateAccount,
     createAccount,
     getEmailAccountCheck,
@@ -11,7 +10,6 @@ import {
 
 export {
     getPersonalAccount,
-    getLogin,
     updateAccount,
     createAccount,
     getEmailAccountCheck,
diff --git a/pages/api/endpoint/getlogin_api.js b/pages/api/endpoint/getlogin_api.js
deleted file mode 100644
index 3e00ea8a..00000000
--- a/pages/api/endpoint/getlogin_api.js
+++ /dev/null
@@ -1,69 +0,0 @@
-/**
- * @swagger
- * /api/endpoint/getlogin_api:
- *   get:
- *     tags: [Login]
- *     description: Returns the hello world
- *     summary: Phase 2
- *     parameters:
- *       - name: emailaddress
- *         in: query
- *         required: true
- *         schema:
- *           type: string
- *       - name: pwd
- *         in: query
- *         required: true
- *         schema:
- *           type: string
- *     responses:
- *       200:
- *         description: hello world
- */
-
-import { azureHeadersPaged } from "../../../actions/core/headers";
-import { respondError } from "../middleware/apiResponse";
-import { relayGet } from "../middleware/relayForwarding";
-import { RELAY_POLICY_STRICT_LOGIN } from "../middleware/relayPolicyPresets";
-
-export default async function ApiProxy(req, res) {
-    const emailAddress = req.query.emailAddress;
-    const pwd = req.query.pwd;
-
-    if (typeof emailAddress !== "string" || emailAddress.trim().length === 0) {
-        return respondError(res, {
-            status: 400,
-            code: "EMAIL_ADDRESS_REQUIRED",
-            message: "emailAddress is required"
-        });
-    }
-
-    if (typeof pwd !== "string" || pwd.trim().length === 0) {
-        return respondError(res, {
-            status: 400,
-            code: "PASSWORD_REQUIRED",
-            message: "pwd is required"
-        });
-    }
-
-    const queryUrl =
-        "contacts?$filter=emailaddress1 eq '" +
-        emailAddress +
-        "' and pinswg_custom_password eq '" +
-        pwd +
-        "'&$count=true&$select=emailaddress1,contactid,pinswg_custom_password,yomifullname,firstname,lastname";
-
-    const relayPolicy = RELAY_POLICY_STRICT_LOGIN;
-
-    return relayGet({
-        queryUrl,
-        res,
-        requestOptionsBuilder: (accessToken) => azureHeadersPaged(accessToken),
-        relayPolicy,
-        errorResponse: {
-            status: 400,
-            code: "LOGIN_FETCH_FAILED",
-            message: "Failed to fetch login details"
-        }
-    });
-}
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index dfbb3b2b..b00212ce 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -231,98 +231,6 @@ test("getpreferredlanguage success returns existing data payload contract", asyn
     });
 });
 
-test("getlogin returns EMAIL_ADDRESS_REQUIRED when emailAddress missing", async () => {
-    const mod = loadModule("pages/api/endpoint/getlogin_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        relayGet: async () => ({}),
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        azureHeadersPaged: () => ({}),
-        axios: { get: async () => ({ data: { value: [] } }) },
-        consoleLogger: () => {}
-    });
-
-    const req = { query: { pwd: "abc123" } };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "EMAIL_ADDRESS_REQUIRED");
-});
-
-test("getlogin returns PASSWORD_REQUIRED when pwd missing", async () => {
-    const mod = loadModule("pages/api/endpoint/getlogin_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        relayGet: async () => ({}),
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        azureHeadersPaged: () => ({}),
-        axios: { get: async () => ({ data: { value: [] } }) },
-        consoleLogger: () => {}
-    });
-
-    const req = { query: { emailAddress: "user@test.local" } };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "PASSWORD_REQUIRED");
-});
-
-test("getlogin catch path returns LOGIN_FETCH_FAILED", async () => {
-    const mod = loadModule("pages/api/endpoint/getlogin_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        relayGet: async ({ res, errorResponse }) =>
-            respondErrorMock(res, errorResponse),
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        azureHeadersPaged: () => ({}),
-        axios: {
-            get: async () => {
-                throw new Error("relay failed");
-            }
-        },
-        consoleLogger: () => {}
-    });
-
-    const req = { query: { emailAddress: "user@test.local", pwd: "abc123" } };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "LOGIN_FETCH_FAILED");
-});
-
-test("getlogin passes strict relayPolicy overrides to relayGet", async () => {
-    let capturedRelayPolicy = null;
-
-    const mod = loadModule("pages/api/endpoint/getlogin_api.js", {
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        relayGet: async ({ relayPolicy, res }) => {
-            capturedRelayPolicy = relayPolicy;
-            return respondSuccessMock(res, { value: [] });
-        },
-        azureHeadersPaged: () => ({})
-    });
-
-    const req = { query: { emailAddress: "user@test.local", pwd: "abc123" } };
-    const res = createRes();
-    await mod.default(req, res);
-
-    assert.strictEqual(res.state.statusCode, 200);
-    assert.deepStrictEqual(JSON.parse(JSON.stringify(capturedRelayPolicy)), {
-        method: "GET",
-        timeoutMs: 5000,
-        maxRetries: 0,
-        retryBaseDelayMs: 0,
-        retryMaxDelayMs: 0
-    });
-});
-
 test("getportallogin returns HASH_REQUIRED when hash missing", async () => {
     const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
         respondError: respondErrorMock,

From ea5e90943d2a5ef4cff6266878c4335b38472555 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 09:26:10 +0000
Subject: [PATCH 17/24] chore: remove unused legacy CRM password validation

---
 components/account/registerform.js | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/components/account/registerform.js b/components/account/registerform.js
index 82607dd4..51836bb9 100644
--- a/components/account/registerform.js
+++ b/components/account/registerform.js
@@ -92,11 +92,6 @@ const RegisterForm = (props) => {
             ? "Invalid phone number"
             : undefined;
 
-    const passwordsMatch = (value, allValues) =>
-        value !== allValues.pinswg_custom_password
-            ? "Passwords don't match"
-            : undefined;
-
     const minLength = (min) => (value) =>
         value && value.length < min
             ? `Must be ${min} characters or more`

From 71de8a2d142e79656c00fb767685dbcb5ff88ad6 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 09:58:02 +0000
Subject: [PATCH 18/24] refactor: extract server-side CRM contact update

---
 lib/server/updateCrmContact.js                |  29 +++
 pages/api/endpoint/updateaccount_api.js       |  30 +--
 .../file/createappealcompletemessage_api.js   |  17 +-
 tests/phase15/service-behaviour.test.cjs      |   2 +-
 .../endpoint-handler-contract.test.cjs        |  12 +-
 tests/phase21/file-handler-contract.test.cjs  | 245 +++++++++++-------
 tests/phase8/service-behaviour.test.cjs       |   2 +-
 7 files changed, 190 insertions(+), 147 deletions(-)
 create mode 100644 lib/server/updateCrmContact.js

diff --git a/lib/server/updateCrmContact.js b/lib/server/updateCrmContact.js
new file mode 100644
index 00000000..89a4308c
--- /dev/null
+++ b/lib/server/updateCrmContact.js
@@ -0,0 +1,29 @@
+import axios from "axios";
+import { getToken } from "../../actions/core/token";
+import { hashAPIPath } from "../../actions/core/hash";
+
+const WEBAPI_URL =
+    process.env.RELAY_ROOT ||
+    "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
+
+export const updateCrmContact = async (contactId, updatePayload) => {
+    const token = await getToken();
+    const queryUrl = "contacts(" + contactId + ")";
+
+    const config = {
+        method: "patch",
+        url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
+        headers: {
+            "OData-MaxVersion": "4.0",
+            "OData-Version": "4.0",
+            Accept: "application/json",
+            Prefer: 'odata.include-annotations="*",return=representation',
+            Authorization: "Bearer " + token.access_token,
+            "Content-Type": "application/json"
+        },
+        data: JSON.stringify(updatePayload)
+    };
+
+    const response = await axios(config);
+    return response.data;
+};
diff --git a/pages/api/endpoint/updateaccount_api.js b/pages/api/endpoint/updateaccount_api.js
index 7f7c1f34..d1747e83 100644
--- a/pages/api/endpoint/updateaccount_api.js
+++ b/pages/api/endpoint/updateaccount_api.js
@@ -10,15 +10,9 @@
  *         description: Success
  */
 
-import axios from "axios";
 import { consoleLogger } from "../../../actions/core/logger";
-import { getToken } from "../../../actions/core/token";
-import { hashAPIPath } from "../../../actions/core/hash";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
-
-const WEBAPI_URL =
-    process.env.RELAY_ROOT ||
-    "https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
+import { updateCrmContact } from "../../../lib/server/updateCrmContact";
 
 export default async function ApiProxy(req, res) {
     const contactId = req.query.contactId;
@@ -40,26 +34,8 @@ export default async function ApiProxy(req, res) {
     }
 
     try {
-        const token = await getToken();
-        const data = JSON.stringify(req.body);
-        const queryUrl = "contacts(" + contactId + ")";
-
-        const config = {
-            method: "patch",
-            url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
-            headers: {
-                "OData-MaxVersion": "4.0",
-                "OData-Version": "4.0",
-                Accept: "application/json",
-                Prefer: 'odata.include-annotations="*",return=representation',
-                Authorization: "Bearer " + token.access_token,
-                "Content-Type": "application/json"
-            },
-            data
-        };
-
-        const response = await axios(config);
-        return respondSuccess(res, response.data);
+        const data = await updateCrmContact(contactId, req.body);
+        return respondSuccess(res, data);
     } catch (error) {
         consoleLogger(error);
         return respondError(res, {
diff --git a/pages/api/file/createappealcompletemessage_api.js b/pages/api/file/createappealcompletemessage_api.js
index ebe4e59e..03401963 100644
--- a/pages/api/file/createappealcompletemessage_api.js
+++ b/pages/api/file/createappealcompletemessage_api.js
@@ -1,4 +1,4 @@
-import { updateAccount } from "../../../actions/services/accountService";
+import { updateCrmContact } from "../../../lib/server/updateCrmContact";
 import { hashAPIPath } from "../../../actions/core/hash";
 import { consoleLogger } from "../../../actions/core/logger";
 import {
@@ -59,10 +59,7 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
-    if (
-        !isValidContainer(containerName) ||
-        !isValidTempCaseRef(tempCaseRef)
-    ) {
+    if (!isValidContainer(containerName) || !isValidTempCaseRef(tempCaseRef)) {
         return respondError(res, {
             status: 400,
             code: "INVALID_REQUEST",
@@ -158,13 +155,9 @@ ApiProxy.get(async (req, res) => {
         if (typeofinvolvement != 846040000) {
             void (async () => {
                 try {
-                    await updateAccount(
-                        contactId[1],
-                        {
-                            pinswg_typeofinvolvement: 846040001
-                        },
-                        true
-                    );
+                    await updateCrmContact(contactId[1], {
+                        pinswg_typeofinvolvement: 846040001
+                    });
                 } catch (error) {
                     consoleLogger(error);
                 }
diff --git a/tests/phase15/service-behaviour.test.cjs b/tests/phase15/service-behaviour.test.cjs
index 207c55eb..9d5d596d 100644
--- a/tests/phase15/service-behaviour.test.cjs
+++ b/tests/phase15/service-behaviour.test.cjs
@@ -155,7 +155,7 @@ test("createappealcompletemessage_api rejects missing hash with 400", async () =
             createBlob: async () => ({}),
             getCaseBlob: async () => ({}),
             createCaseCompleteMessage: async () => ({}),
-            updateAccount: async () => ({}),
+            updateCrmContact: async () => ({}),
             consoleLogger: () => {},
             _: { isEmpty: (value) => !value },
             nextConnect,
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index b00212ce..1b34a7da 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -835,9 +835,7 @@ test("updateaccount returns CONTACT_ID_REQUIRED when contactId missing", async (
     const mod = loadModule("pages/api/endpoint/updateaccount_api.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => ({ data: { contactid: "c1" } }),
+        updateCrmContact: async () => ({ contactid: "c1" }),
         consoleLogger: () => {}
     });
 
@@ -853,9 +851,7 @@ test("updateaccount returns ACCOUNT_UPDATE_PAYLOAD_REQUIRED when body missing",
     const mod = loadModule("pages/api/endpoint/updateaccount_api.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => ({ data: { contactid: "c1" } }),
+        updateCrmContact: async () => ({ contactid: "c1" }),
         consoleLogger: () => {}
     });
 
@@ -874,9 +870,7 @@ test("updateaccount catch path returns ACCOUNT_UPDATE_FAILED", async () => {
     const mod = loadModule("pages/api/endpoint/updateaccount_api.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
-        getToken: async () => ({ access_token: "token" }),
-        hashAPIPath: () => "&hash=expected",
-        axios: async () => {
+        updateCrmContact: async () => {
             throw new Error("relay failed");
         },
         consoleLogger: () => {}
diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index 3f3a18c3..a1ae3d79 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -149,7 +149,9 @@ const assertNoUploadWrites = (calls) => {
 };
 
 test("upload rejects a missing NextAuth session before HMAC or Azure write", async () => {
-    const loaded = loadUploadAuthorization({ getServerSession: async () => null });
+    const loaded = loadUploadAuthorization({
+        getServerSession: async () => null
+    });
     const res = createRes();
 
     await loaded.mod.default.handler(uploadAuthorizationRequest(), res);
@@ -906,9 +908,15 @@ for (const inputCase of [
     { name: "missing container", body: { container: undefined } },
     { name: "malformed container", body: { container: "Invalid_Container" } },
     { name: "missing case identifier", body: { casefolderID: undefined } },
-    { name: "case identifier path separator", body: { casefolderID: "TMP/CASE-1" } },
+    {
+        name: "case identifier path separator",
+        body: { casefolderID: "TMP/CASE-1" }
+    },
     { name: "case identifier traversal segment", body: { casefolderID: ".." } },
-    { name: "case identifier control character", body: { casefolderID: "TMP\u0000CASE" } }
+    {
+        name: "case identifier control character",
+        body: { casefolderID: "TMP\u0000CASE" }
+    }
 ]) {
     test(`admin case deletion rejects ${inputCase.name} without deletion`, async () => {
         const loaded = loadAdminCaseDeletion();
@@ -917,7 +925,8 @@ for (const inputCase of [
 
         request.body = { ...request.body, ...inputCase.body };
         Object.keys(request.body).forEach((key) => {
-            if (typeof request.body[key] === "undefined") delete request.body[key];
+            if (typeof request.body[key] === "undefined")
+                delete request.body[key];
         });
         await loaded.mod.default(request, res);
 
@@ -938,10 +947,9 @@ test("valid administrator can delete a cross-container case prefix with the exis
     assert.deepStrictEqual(loaded.calls.deletion, [
         [request.body.container, request.body.casefolderID]
     ]);
-    assert.deepStrictEqual(
-        JSON.parse(JSON.stringify(res.state.jsonBody)),
-        { data: loaded.payload }
-    );
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
+        data: loaded.payload
+    });
 });
 
 test("admin case deletion dependency failure returns DELETE_BLOB_CASE_FAILED", async () => {
@@ -1166,7 +1174,10 @@ test("valid administrative representation JSON edit preserves the existing mutat
     const updatedJson = JSON.parse(loaded.uploaded.content);
     assert.strictEqual(Object.hasOwn(updatedJson, "repComplete"), false);
     assert.strictEqual(updatedJson.containerID, loaded.sourceJson.containerID);
-    assert.strictEqual(updatedJson.ticketnumber, loaded.sourceJson.ticketnumber);
+    assert.strictEqual(
+        updatedJson.ticketnumber,
+        loaded.sourceJson.ticketnumber
+    );
     assert.strictEqual(
         updatedJson.representationType,
         loaded.sourceJson.representationType
@@ -1234,9 +1245,7 @@ test("deleteawaitingsubmissionfromblob accepts legacy deleteblob hash variant",
             getServerSession: async () => ({ user: { id: "container-1" } }),
             authOptions: () => ({}),
             hashAPIPath: (queryPath) =>
-                queryPath.includes(
-                    "/api/file/deleteblob?container=container-1"
-                )
+                queryPath.includes("/api/file/deleteblob?container=container-1")
                     ? "&hash=expected"
                     : "&hash=other",
             respondError: respondErrorMock,
@@ -1692,7 +1701,12 @@ const appealCompletionSigningRequest = (pathValue) => ({
 });
 
 for (const sessionCase of [
-    { name: "missing session", session: null, status: 401, code: "UNAUTHENTICATED" },
+    {
+        name: "missing session",
+        session: null,
+        status: 401,
+        code: "UNAUTHENTICATED"
+    },
     { name: "session without user id", session: { user: {} } },
     { name: "session with empty user id", session: { user: { id: "" } } },
     {
@@ -1705,7 +1719,9 @@ for (const sessionCase of [
     }
 ]) {
     test(`gethash rejects appeal completion signing for ${sessionCase.name} before HMAC generation`, async () => {
-        const loaded = loadAppealCompletionSigning({ session: sessionCase.session });
+        const loaded = loadAppealCompletionSigning({
+            session: sessionCase.session
+        });
         const res = createRes();
 
         await loaded.mod.default.handler(appealCompletionSigningRequest(), res);
@@ -2256,14 +2272,29 @@ test("createrepcompletemessage rejects unsupported methods before authorization
 
 for (const inputCase of [
     { name: "missing container", query: { container: undefined } },
-    { name: "invalid container type", query: { container: ["user-container"] } },
+    {
+        name: "invalid container type",
+        query: { container: ["user-container"] }
+    },
     { name: "malformed container", query: { container: "Invalid_Container" } },
     { name: "missing case reference", query: { tempcaseref: undefined } },
-    { name: "unsafe case-reference path separator", query: { tempcaseref: "CAS/123" } },
-    { name: "unsafe case-reference traversal segment", query: { tempcaseref: ".." } },
+    {
+        name: "unsafe case-reference path separator",
+        query: { tempcaseref: "CAS/123" }
+    },
+    {
+        name: "unsafe case-reference traversal segment",
+        query: { tempcaseref: ".." }
+    },
     { name: "missing representation identifier", query: { repid: undefined } },
-    { name: "unsafe representation path separator", query: { repid: "rep\\file" } },
-    { name: "unsafe representation control character", query: { repid: "rep\u0000file" } }
+    {
+        name: "unsafe representation path separator",
+        query: { repid: "rep\\file" }
+    },
+    {
+        name: "unsafe representation control character",
+        query: { repid: "rep\u0000file" }
+    }
 ]) {
     test(`createrepcompletemessage rejects ${inputCase.name} before authorization work`, async () => {
         const loaded = loadOrdinaryRepCompletion();
@@ -2272,7 +2303,8 @@ for (const inputCase of [
 
         request.query = { ...request.query, ...inputCase.query };
         Object.keys(request.query).forEach((key) => {
-            if (typeof request.query[key] === "undefined") delete request.query[key];
+            if (typeof request.query[key] === "undefined")
+                delete request.query[key];
         });
         await loaded.mod.default(request, res);
 
@@ -2416,7 +2448,13 @@ test("createrepcompletemessage dependency failure returns CREATE_REP_COMPLETE_ME
 });
 
 const loadAdminRepCompletion = (overrides = {}) => {
-    const calls = { noStore: 0, readSession: 0, validate: 0, origin: 0, queue: [] };
+    const calls = {
+        noStore: 0,
+        readSession: 0,
+        validate: 0,
+        origin: 0,
+        queue: []
+    };
     const payload = { messageId: "admin-message" };
     const mod = loadModule("pages/api/admin/createrepcompletemessage.js", {
         respondError: respondErrorMock,
@@ -2495,7 +2533,10 @@ for (const sessionCase of [
 }
 
 for (const originCase of [
-    { name: "missing Origin", headers: { cookie: "pedw_admin_session=admin-token" } },
+    {
+        name: "missing Origin",
+        headers: { cookie: "pedw_admin_session=admin-token" }
+    },
     {
         name: "cross-origin request",
         headers: {
@@ -2505,7 +2546,9 @@ for (const originCase of [
     }
 ]) {
     test(`admin representation completion rejects ${originCase.name}`, async () => {
-        const loaded = loadAdminRepCompletion({ hasTrustedSameOrigin: () => false });
+        const loaded = loadAdminRepCompletion({
+            hasTrustedSameOrigin: () => false
+        });
         const res = createRes();
 
         await loaded.mod.default(
@@ -2533,7 +2576,8 @@ for (const inputCase of [
 
         request.body = { ...request.body, ...inputCase.body };
         Object.keys(request.body).forEach((key) => {
-            if (typeof request.body[key] === "undefined") delete request.body[key];
+            if (typeof request.body[key] === "undefined")
+                delete request.body[key];
         });
         await loaded.mod.default(request, res);
 
@@ -3051,7 +3095,9 @@ for (const adminSessionCase of [
 
 for (const originCase of ["missing Origin", "cross-origin request"]) {
     test(`admin getrepsblobproxy rejects ${originCase} before proxy work`, async () => {
-        const loaded = loadAdminRepsProxy({ hasTrustedSameOrigin: () => false });
+        const loaded = loadAdminRepsProxy({
+            hasTrustedSameOrigin: () => false
+        });
         const req = adminRepsRequest();
         if (originCase === "missing Origin") delete req.headers.origin;
         if (originCase === "cross-origin request") {
@@ -3563,53 +3609,59 @@ const loadAppealCompletionDirect = ({ session, ...overrides } = {}) => {
         "customerid_contact@odata.bind":
             "/contacts(00000000-0000-0000-0000-000000000001)"
     };
-    const mod = loadModule("pages/api/file/createappealcompletemessage_api.js", {
-        nextConnect: createNextConnectMock(),
-        middleware: () => {},
-        respondError: respondErrorMock,
-        respondSuccess: respondSuccessMock,
-        authOptions: (req, res) => {
-            calls.options.push([req, res]);
-            return options;
-        },
-        getServerSession: async (...args) => {
-            calls.session.push(args);
-            return resolvedSession;
-        },
-        hashAPIPath: (queryPath) => {
-            calls.hash.push(queryPath);
-            return "&hash=expected";
-        },
-        getProgressBlobs: async (...args) => {
-            calls.progress.push(args);
-            return { path: "TMP-CASE-1/progress.json" };
-        },
-        downloadProgressFile: async (...args) => {
-            calls.download.push(args);
-            return args[1].endsWith("_case.json")
-                ? { ...caseObject }
-                : { ...progress };
-        },
-        createBlob: async (...args) => {
-            calls.createBlob.push(args);
-            return {};
-        },
-        getCaseBlob: async (...args) => {
-            calls.caseBlob.push(args);
-            return {};
-        },
-        updateAccount: async (...args) => {
-            calls.account.push(args);
-            return {};
-        },
-        createCaseCompleteMessage: async (...args) => {
-            calls.queue.push(args);
-            return {};
-        },
-        consoleLogger: () => {},
-        _: { isEmpty: (value) => value === undefined || value === null || value === "" },
-        ...overrides
-    });
+    const mod = loadModule(
+        "pages/api/file/createappealcompletemessage_api.js",
+        {
+            nextConnect: createNextConnectMock(),
+            middleware: () => {},
+            respondError: respondErrorMock,
+            respondSuccess: respondSuccessMock,
+            authOptions: (req, res) => {
+                calls.options.push([req, res]);
+                return options;
+            },
+            getServerSession: async (...args) => {
+                calls.session.push(args);
+                return resolvedSession;
+            },
+            hashAPIPath: (queryPath) => {
+                calls.hash.push(queryPath);
+                return "&hash=expected";
+            },
+            getProgressBlobs: async (...args) => {
+                calls.progress.push(args);
+                return { path: "TMP-CASE-1/progress.json" };
+            },
+            downloadProgressFile: async (...args) => {
+                calls.download.push(args);
+                return args[1].endsWith("_case.json")
+                    ? { ...caseObject }
+                    : { ...progress };
+            },
+            createBlob: async (...args) => {
+                calls.createBlob.push(args);
+                return {};
+            },
+            getCaseBlob: async (...args) => {
+                calls.caseBlob.push(args);
+                return {};
+            },
+            updateCrmContact: async (...args) => {
+                calls.account.push(args);
+                return {};
+            },
+            createCaseCompleteMessage: async (...args) => {
+                calls.queue.push(args);
+                return {};
+            },
+            consoleLogger: () => {},
+            _: {
+                isEmpty: (value) =>
+                    value === undefined || value === null || value === ""
+            },
+            ...overrides
+        }
+    );
 
     return { mod, calls, options };
 };
@@ -3647,7 +3699,9 @@ for (const sessionCase of [
     }
 ]) {
     test(`createappealcompletemessage_api blocks direct bypass with ${sessionCase.name} before HMAC or side effects`, async () => {
-        const loaded = loadAppealCompletionDirect({ session: sessionCase.session });
+        const loaded = loadAppealCompletionDirect({
+            session: sessionCase.session
+        });
         const res = createRes();
 
         await loaded.mod.default.handler(appealCompletionDirectRequest(), res);
@@ -3799,11 +3853,7 @@ test("createappealcompletemessage_api preserves owner payloads and downstream co
     ]);
     assert.deepStrictEqual(loaded.calls.download, [
         ["owner-container", "TMP-CASE-1/progress.json", "TMP-CASE-1"],
-        [
-            "owner-container",
-            "TMP-CASE-1/TMP-CASE-1_case.json",
-            "TMP-CASE-1"
-        ]
+        ["owner-container", "TMP-CASE-1/TMP-CASE-1_case.json", "TMP-CASE-1"]
     ]);
     const savedProgress = JSON.parse(loaded.calls.createBlob[0][0]);
     assert.strictEqual(savedProgress.appealComplete, "TMP-CASE-1");
@@ -3813,16 +3863,12 @@ test("createappealcompletemessage_api preserves owner payloads and downstream co
         "TMP-CASE-1"
     ]);
     assert.strictEqual(loaded.calls.caseBlob.length, 1);
-    assert.deepStrictEqual(
-        JSON.parse(JSON.stringify(loaded.calls.account)),
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(loaded.calls.account)), [
         [
-            [
-                "00000000-0000-0000-0000-000000000001",
-                { pinswg_typeofinvolvement: 846040001 },
-                true
-            ]
+            "00000000-0000-0000-0000-000000000001",
+            { pinswg_typeofinvolvement: 846040001 }
         ]
-    );
+    ]);
     assert.deepStrictEqual(loaded.calls.queue, [
         ["owner-container", "TMP-CASE-1"]
     ]);
@@ -3905,7 +3951,7 @@ test("createappealcompletemessage_api accepts encoded hash variant and returns s
             createBlob: async () => ({}),
             getCaseBlob: async () => ({}),
             createCaseCompleteMessage: async () => ({}),
-            updateAccount: async () => ({}),
+            updateCrmContact: async () => ({}),
             consoleLogger: () => {},
             _: { isEmpty: (v) => v === undefined || v === null || v === "" }
         }
@@ -4987,7 +5033,9 @@ for (const endpoint of [
 
     test(`${endpoint.name} rejects another user's container before privileged work`, async () => {
         const loaded = endpoint.load({
-            getServerSession: async () => ({ user: { id: "different-container" } })
+            getServerSession: async () => ({
+                user: { id: "different-container" }
+            })
         });
         const res = createRes();
 
@@ -5000,7 +5048,9 @@ for (const endpoint of [
 
     test(`${endpoint.name} ignores a client-provided user identity`, async () => {
         const loaded = endpoint.load({
-            getServerSession: async () => ({ user: { id: "different-container" } })
+            getServerSession: async () => ({
+                user: { id: "different-container" }
+            })
         });
         const req = endpoint.request();
         req.body.userID = PDF_OWNER_CONTAINER;
@@ -5146,7 +5196,9 @@ for (const endpoint of [
 
     test(`${endpoint.name} rejects a valid HMAC for an unauthorised container`, async () => {
         const loaded = endpoint.load({
-            getServerSession: async () => ({ user: { id: "different-container" } })
+            getServerSession: async () => ({
+                user: { id: "different-container" }
+            })
         });
         const res = createRes();
         await loaded.mod.default(endpoint.request(), res);
@@ -5498,10 +5550,7 @@ test("createcase_api creates both draft JSON blobs in the authenticated owner's
     assert.strictEqual(loaded.calls.caseBlob.length, 1);
     assert.strictEqual(loaded.calls.appealBlob.length, 1);
     assert.strictEqual(loaded.calls.caseBlob[0][0], CASE_OWNER_CONTAINER);
-    assert.strictEqual(
-        loaded.calls.caseBlob[0][1],
-        GENERATED_CASE_REFERENCE
-    );
+    assert.strictEqual(loaded.calls.caseBlob[0][1], GENERATED_CASE_REFERENCE);
     assert.strictEqual(loaded.calls.appealBlob[0][1], CASE_OWNER_CONTAINER);
     assert.deepStrictEqual(
         JSON.parse(JSON.stringify(loaded.calls.caseBlob[0][2])),
@@ -5510,10 +5559,12 @@ test("createcase_api creates both draft JSON blobs in the authenticated owner's
     assert.deepStrictEqual(JSON.parse(loaded.calls.appealBlob[0][0]), {
         pinswg_name: GENERATED_CASE_REFERENCE,
         pinswg_appealcasetype: "846040000",
-        _pinswg_associatedlpa_value:
-            "00000000-0000-4000-8000-000000000002"
+        _pinswg_associatedlpa_value: "00000000-0000-4000-8000-000000000002"
     });
-    assert.strictEqual(res.state.jsonBody.ticketnumber, GENERATED_CASE_REFERENCE);
+    assert.strictEqual(
+        res.state.jsonBody.ticketnumber,
+        GENERATED_CASE_REFERENCE
+    );
     assert.strictEqual(res.state.jsonBody.title, GENERATED_CASE_REFERENCE);
     assert.strictEqual(
         res.state.jsonBody.incidentid,
diff --git a/tests/phase8/service-behaviour.test.cjs b/tests/phase8/service-behaviour.test.cjs
index eb677911..77e109bb 100644
--- a/tests/phase8/service-behaviour.test.cjs
+++ b/tests/phase8/service-behaviour.test.cjs
@@ -140,7 +140,7 @@ test("createappealcompletemessage_api rejects invalid hash with 400", async () =
             createBlob: async () => {},
             getCaseBlob: async () => {},
             createCaseCompleteMessage: () => {},
-            updateAccount: async () => {},
+            updateCrmContact: async () => {},
             _: { isEmpty: (value) => !value },
             nextConnect,
             middleware: () => {}

From b9be188d275de0b7210c8c885e55486944c76c95 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 10:55:47 +0000
Subject: [PATCH 19/24] security: enforce CRM contact ownership and account
 field allowlist

---
 pages/api/endpoint/updateaccount_api.js       | 132 ++++++--
 .../endpoint-handler-contract.test.cjs        | 318 +++++++++++++++++-
 2 files changed, 422 insertions(+), 28 deletions(-)

diff --git a/pages/api/endpoint/updateaccount_api.js b/pages/api/endpoint/updateaccount_api.js
index d1747e83..1f3149f7 100644
--- a/pages/api/endpoint/updateaccount_api.js
+++ b/pages/api/endpoint/updateaccount_api.js
@@ -1,31 +1,68 @@
-/**
- * @swagger
- * /api/endpoint/updateaccount_api:
- *   patch:
- *     tags: [Account]
- *     description: Update account
- *     summary: Phase 2
- *     responses:
- *       200:
- *         description: Success
- */
-
 import { consoleLogger } from "../../../actions/core/logger";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
 import { updateCrmContact } from "../../../lib/server/updateCrmContact";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
+import { getToken } from "../../../actions/core/token";
+import { relayGetData } from "../middleware/relayForwarding";
+import { azureHeaders } from "../../../actions/core/headers";
+import { escapeODataString } from "../../../actions/core/guards";
+
+const GUID_PATTERN =
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+const ALLOWED_ACCOUNT_FIELDS = new Set([
+    "pinswg_preferredlanguage",
+    "firstname",
+    "lastname",
+    "telephone1",
+    "pinswg_companyname",
+    "address1_line1",
+    "address1_line2",
+    "address1_city",
+    "address1_county",
+    "address1_postalcode"
+]);
 
 export default async function ApiProxy(req, res) {
-    const contactId = req.query.contactId;
-
-    if (typeof contactId !== "string" || contactId.trim().length === 0) {
+    if (req.method !== "POST") {
+        res.setHeader("Allow", "POST");
         return respondError(res, {
-            status: 400,
-            code: "CONTACT_ID_REQUIRED",
-            message: "contactId is required"
+            status: 405,
+            code: "METHOD_NOT_ALLOWED",
+            message: "Method not allowed"
         });
     }
 
-    if (!req.body || Object.keys(req.body).length === 0) {
+    const session = await getServerSession(req, res, authOptions(req, res));
+
+    if (
+        typeof session?.user?.email !== "string" ||
+        session.user.email.trim().length === 0
+    ) {
+        return respondError(res, {
+            status: 401,
+            code: "UNAUTHENTICATED",
+            message: "Authentication required"
+        });
+    }
+
+    const contactId = req.query.contactId;
+
+    if (typeof contactId !== "string" || !GUID_PATTERN.test(contactId.trim())) {
+        return respondError(res, {
+            status: 400,
+            code: "INVALID_CONTACT_ID",
+            message: "A valid contactId is required"
+        });
+    }
+
+    if (
+        !req.body ||
+        typeof req.body !== "object" ||
+        Array.isArray(req.body) ||
+        Object.keys(req.body).length === 0
+    ) {
         return respondError(res, {
             status: 400,
             code: "ACCOUNT_UPDATE_PAYLOAD_REQUIRED",
@@ -34,7 +71,62 @@ export default async function ApiProxy(req, res) {
     }
 
     try {
-        const data = await updateCrmContact(contactId, req.body);
+        const token = await getToken();
+
+        const escapedEmail = escapeODataString(session.user.email);
+
+        const contactQueryUrl =
+            "contacts?$filter=emailaddress1 eq '" +
+            escapedEmail +
+            "' and statuscode eq 1&$select=contactid";
+
+        const contactResponse = await relayGetData({
+            queryUrl: contactQueryUrl,
+            accessToken: token.access_token,
+            requestOptionsBuilder: (accessToken) => azureHeaders(accessToken)
+        });
+
+        const contacts = contactResponse?.data?.value;
+
+        if (
+            !Array.isArray(contacts) ||
+            contacts.length !== 1 ||
+            typeof contacts[0]?.contactid !== "string" ||
+            !GUID_PATTERN.test(contacts[0].contactid.trim())
+        ) {
+            return respondError(res, {
+                status: 403,
+                code: "CONTACT_IDENTITY_NOT_RESOLVED",
+                message: "Request not permitted"
+            });
+        }
+
+        if (
+            contactId.trim().toLowerCase() !==
+            contacts[0].contactid.trim().toLowerCase()
+        ) {
+            return respondError(res, {
+                status: 403,
+                code: "CONTACT_OWNERSHIP_MISMATCH",
+                message: "Request not permitted"
+            });
+        }
+
+        const updatePayload = Object.fromEntries(
+            Object.entries(req.body).filter(([field]) =>
+                ALLOWED_ACCOUNT_FIELDS.has(field)
+            )
+        );
+
+        if (Object.keys(updatePayload).length === 0) {
+            return respondError(res, {
+                status: 400,
+                code: "NO_ALLOWED_ACCOUNT_FIELDS",
+                message: "No permitted account fields supplied"
+            });
+        }
+
+        const data = await updateCrmContact(contactId.trim(), updatePayload);
         return respondSuccess(res, data);
     } catch (error) {
         consoleLogger(error);
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 1b34a7da..437383f6 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -831,20 +831,40 @@ test("createaccount catch path returns ACCOUNT_CREATE_FAILED", async () => {
     assert.strictEqual(res.state.jsonBody.error.code, "ACCOUNT_CREATE_FAILED");
 });
 
-test("updateaccount returns CONTACT_ID_REQUIRED when contactId missing", async () => {
+test("updateaccount returns INVALID_CONTACT_ID when contactId missing", async () => {
     const mod = loadModule("pages/api/endpoint/updateaccount_api.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
         updateCrmContact: async () => ({ contactid: "c1" }),
-        consoleLogger: () => {}
+        consoleLogger: () => {},
+        getServerSession: async () => ({
+            user: { email: "owner@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({
+            access_token: "test-token"
+        }),
+        escapeODataString: (value) => value,
+        azureHeaders: (token) => ({
+            headers: { Authorization: `Bearer ${token}` }
+        }),
+        relayGetData: async () => ({
+            data: {
+                value: [
+                    {
+                        contactid: "00000000-0000-0000-0000-000000000001"
+                    }
+                ]
+            }
+        })
     });
 
-    const req = { query: {}, body: { firstname: "A" } };
+    const req = { method: "POST", query: {}, body: { firstname: "A" } };
     const res = createRes();
     await mod.default(req, res);
 
     assert.strictEqual(res.state.statusCode, 400);
-    assert.strictEqual(res.state.jsonBody.error.code, "CONTACT_ID_REQUIRED");
+    assert.strictEqual(res.state.jsonBody.error.code, "INVALID_CONTACT_ID");
 });
 
 test("updateaccount returns ACCOUNT_UPDATE_PAYLOAD_REQUIRED when body missing", async () => {
@@ -852,10 +872,34 @@ test("updateaccount returns ACCOUNT_UPDATE_PAYLOAD_REQUIRED when body missing",
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
         updateCrmContact: async () => ({ contactid: "c1" }),
-        consoleLogger: () => {}
+        consoleLogger: () => {},
+        getServerSession: async () => ({
+            user: { email: "owner@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({
+            access_token: "test-token"
+        }),
+        escapeODataString: (value) => value,
+        azureHeaders: (token) => ({
+            headers: { Authorization: `Bearer ${token}` }
+        }),
+        relayGetData: async () => ({
+            data: {
+                value: [
+                    {
+                        contactid: "00000000-0000-0000-0000-000000000001"
+                    }
+                ]
+            }
+        })
     });
 
-    const req = { query: { contactId: "c1" }, body: undefined };
+    const req = {
+        method: "POST",
+        query: { contactId: "00000000-0000-0000-0000-000000000001" },
+        body: undefined
+    };
     const res = createRes();
     await mod.default(req, res);
 
@@ -873,10 +917,34 @@ test("updateaccount catch path returns ACCOUNT_UPDATE_FAILED", async () => {
         updateCrmContact: async () => {
             throw new Error("relay failed");
         },
-        consoleLogger: () => {}
+        consoleLogger: () => {},
+        getServerSession: async () => ({
+            user: { email: "owner@example.com" }
+        }),
+        authOptions: () => ({}),
+        getToken: async () => ({
+            access_token: "test-token"
+        }),
+        escapeODataString: (value) => value,
+        azureHeaders: (token) => ({
+            headers: { Authorization: `Bearer ${token}` }
+        }),
+        relayGetData: async () => ({
+            data: {
+                value: [
+                    {
+                        contactid: "00000000-0000-0000-0000-000000000001"
+                    }
+                ]
+            }
+        })
     });
 
-    const req = { query: { contactId: "c1" }, body: { firstname: "A" } };
+    const req = {
+        method: "POST",
+        query: { contactId: "00000000-0000-0000-0000-000000000001" },
+        body: { firstname: "A" }
+    };
     const res = createRes();
     await mod.default(req, res);
 
@@ -884,6 +952,240 @@ test("updateaccount catch path returns ACCOUNT_UPDATE_FAILED", async () => {
     assert.strictEqual(res.state.jsonBody.error.code, "ACCOUNT_UPDATE_FAILED");
 });
 
+test("updateaccount rejects a different CRM contact before updating", async () => {
+    let updateCalls = 0;
+
+    const mod = loadModule("pages/api/endpoint/updateaccount_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        consoleLogger: () => {},
+
+        getServerSession: async () => ({
+            user: { email: "owner@example.com" }
+        }),
+        authOptions: () => ({}),
+
+        getToken: async () => ({
+            access_token: "test-token"
+        }),
+        escapeODataString: (value) => value,
+        azureHeaders: (token) => ({
+            headers: { Authorization: `Bearer ${token}` }
+        }),
+
+        relayGetData: async () => ({
+            data: {
+                value: [
+                    {
+                        contactid: "00000000-0000-0000-0000-000000000001"
+                    }
+                ]
+            }
+        }),
+
+        updateCrmContact: async () => {
+            updateCalls++;
+            return {};
+        }
+    });
+
+    const req = {
+        method: "POST",
+        query: {
+            contactId: "00000000-0000-0000-0000-000000000002"
+        },
+        body: {
+            firstname: "Unauthorised Update"
+        }
+    };
+
+    const res = createRes();
+
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "CONTACT_OWNERSHIP_MISMATCH"
+    );
+    assert.strictEqual(updateCalls, 0);
+});
+
+test("updateaccount rejects unresolved CRM identity before updating", async () => {
+    let updateCalls = 0;
+
+    const mod = loadModule("pages/api/endpoint/updateaccount_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        consoleLogger: () => {},
+
+        getServerSession: async () => ({
+            user: { email: "owner@example.com" }
+        }),
+        authOptions: () => ({}),
+
+        getToken: async () => ({
+            access_token: "test-token"
+        }),
+        escapeODataString: (value) => value,
+        azureHeaders: (token) => ({
+            headers: { Authorization: `Bearer ${token}` }
+        }),
+
+        relayGetData: async () => ({
+            data: {
+                value: []
+            }
+        }),
+
+        updateCrmContact: async () => {
+            updateCalls++;
+            return {};
+        }
+    });
+
+    const req = {
+        method: "POST",
+        query: {
+            contactId: "00000000-0000-0000-0000-000000000001"
+        },
+        body: {
+            firstname: "Unauthorised Update"
+        }
+    };
+
+    const res = createRes();
+
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "CONTACT_IDENTITY_NOT_RESOLVED"
+    );
+    assert.strictEqual(updateCalls, 0);
+});
+
+test("updateaccount strips prohibited CRM fields before updating", async () => {
+    const contactId = "00000000-0000-0000-0000-000000000001";
+    let capturedContactId;
+    let capturedPayload;
+    let updateCalls = 0;
+
+    const mod = loadModule("pages/api/endpoint/updateaccount_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        consoleLogger: () => {},
+
+        getServerSession: async () => ({
+            user: { email: "owner@example.com" }
+        }),
+        authOptions: () => ({}),
+
+        getToken: async () => ({
+            access_token: "test-token"
+        }),
+        escapeODataString: (value) => value,
+        azureHeaders: (token) => ({
+            headers: { Authorization: `Bearer ${token}` }
+        }),
+
+        relayGetData: async () => ({
+            data: {
+                value: [{ contactid: contactId }]
+            }
+        }),
+
+        updateCrmContact: async (id, payload) => {
+            updateCalls++;
+            capturedContactId = id;
+            capturedPayload = payload;
+            return { contactid: id };
+        }
+    });
+
+    const req = {
+        method: "POST",
+        query: { contactId },
+        body: {
+            firstname: "Robert",
+            telephone1: "01234567890",
+            emailaddress1: "attacker@example.com",
+            statuscode: 2,
+            contactid: "00000000-0000-0000-0000-000000000002"
+        }
+    };
+
+    const res = createRes();
+
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(updateCalls, 1);
+    assert.strictEqual(capturedContactId, contactId);
+
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(capturedPayload)), {
+        firstname: "Robert",
+        telephone1: "01234567890"
+    });
+});
+
+test("updateaccount rejects payload containing only prohibited fields", async () => {
+    const contactId = "00000000-0000-0000-0000-000000000001";
+    let updateCalls = 0;
+
+    const mod = loadModule("pages/api/endpoint/updateaccount_api.js", {
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        consoleLogger: () => {},
+
+        getServerSession: async () => ({
+            user: { email: "owner@example.com" }
+        }),
+        authOptions: () => ({}),
+
+        getToken: async () => ({
+            access_token: "test-token"
+        }),
+        escapeODataString: (value) => value,
+        azureHeaders: (token) => ({
+            headers: { Authorization: `Bearer ${token}` }
+        }),
+
+        relayGetData: async () => ({
+            data: {
+                value: [{ contactid: contactId }]
+            }
+        }),
+
+        updateCrmContact: async () => {
+            updateCalls++;
+            return {};
+        }
+    });
+
+    const req = {
+        method: "POST",
+        query: { contactId },
+        body: {
+            emailaddress1: "attacker@example.com",
+            statuscode: 2,
+            contactid: "00000000-0000-0000-0000-000000000002"
+        }
+    };
+
+    const res = createRes();
+
+    await mod.default(req, res);
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(
+        res.state.jsonBody.error.code,
+        "NO_ALLOWED_ACCOUNT_FIELDS"
+    );
+    assert.strictEqual(updateCalls, 0);
+});
+
 test("getbasicsearch returns SEARCH_STRING_REQUIRED when searchString missing", async () => {
     const mod = loadModule("pages/api/endpoint/getbasicsearch_api.js", {
         respondError: respondErrorMock,

From 4b552e9cddfc96348c02f3870ebc12d5e74d47bc Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 11:22:42 +0000
Subject: [PATCH 20/24] refactor: extract server-side CRM personal account
 lookup

---
 lib/server/getCrmPersonalAccount.js           | 16 +++++
 tests/phase21/_shared.cjs                     |  2 +
 .../endpoint-handler-contract.test.cjs        | 65 +++++++++++++++++++
 3 files changed, 83 insertions(+)
 create mode 100644 lib/server/getCrmPersonalAccount.js

diff --git a/lib/server/getCrmPersonalAccount.js b/lib/server/getCrmPersonalAccount.js
new file mode 100644
index 00000000..4d15ec17
--- /dev/null
+++ b/lib/server/getCrmPersonalAccount.js
@@ -0,0 +1,16 @@
+import { relayGetData } from "../../pages/api/middleware/relayForwarding";
+import { RELAY_POLICY_LOOKUP } from "../../pages/api/middleware/relayPolicyPresets";
+
+export const getCrmPersonalAccount = async (contactId) => {
+    const queryUrl =
+        "contacts(" +
+        contactId +
+        ")?$select=firstname, lastname, emailaddress1, telephone1, pinswg_companyname, address1_line1,address1_line2,address1_city, address1_county,address1_postalcode,pinswg_typeofinvolvement,pinswg_contact_associatedlpa,pinswg_preferredlanguage&$count=true";
+
+    const { data } = await relayGetData({
+        queryUrl,
+        relayPolicy: RELAY_POLICY_LOOKUP
+    });
+
+    return data;
+};
diff --git a/tests/phase21/_shared.cjs b/tests/phase21/_shared.cjs
index 811af4e8..768aea02 100644
--- a/tests/phase21/_shared.cjs
+++ b/tests/phase21/_shared.cjs
@@ -34,6 +34,8 @@ const loadModule = (relativePath, injected = {}) => {
         source += `\nif (typeof ${name} !== "undefined" && !module.exports.default) module.exports.default = ${name};\n`;
     });
 
+    source +=
+        '\nif (typeof getCrmPersonalAccount !== "undefined") module.exports.getCrmPersonalAccount = getCrmPersonalAccount;\n';
     source +=
         '\nif (typeof respondSuccess !== "undefined") module.exports.respondSuccess = respondSuccess;\n';
     source +=
diff --git a/tests/phase21/endpoint-handler-contract.test.cjs b/tests/phase21/endpoint-handler-contract.test.cjs
index 437383f6..45078ec2 100644
--- a/tests/phase21/endpoint-handler-contract.test.cjs
+++ b/tests/phase21/endpoint-handler-contract.test.cjs
@@ -9,6 +9,71 @@ const {
 const tests = [];
 const test = (name, fn) => tests.push({ name, fn });
 
+test("getCrmPersonalAccount returns the CRM response unchanged", async () => {
+    const contactId = "726158c6-708d-ec11-aad8-00224800be9c";
+    const crmResponse = {
+        contactid: contactId,
+        firstname: "Test",
+        lastname: "User",
+        emailaddress1: "test@example.com"
+    };
+
+    let capturedQueryUrl;
+
+    const mod = loadModule("lib/server/getCrmPersonalAccount.js", {
+        relayGetData: async ({ queryUrl }) => {
+            capturedQueryUrl = queryUrl;
+            return { data: crmResponse };
+        }
+    });
+
+    const result = await mod.getCrmPersonalAccount(contactId);
+
+    assert.deepStrictEqual(result, crmResponse);
+    assert.strictEqual(
+        capturedQueryUrl,
+        "contacts(" +
+            contactId +
+            ")?$select=firstname, lastname, emailaddress1, telephone1, pinswg_companyname, address1_line1,address1_line2,address1_city, address1_county,address1_postalcode,pinswg_typeofinvolvement,pinswg_contact_associatedlpa,pinswg_preferredlanguage&$count=true"
+    );
+});
+
+test("getCrmPersonalAccount preserves the CRM lookup relay policy", async () => {
+    let capturedRelayPolicy;
+
+    const mod = loadModule("lib/server/getCrmPersonalAccount.js", {
+        relayGetData: async ({ relayPolicy }) => {
+            capturedRelayPolicy = relayPolicy;
+            return { data: {} };
+        }
+    });
+
+    await mod.getCrmPersonalAccount("726158c6-708d-ec11-aad8-00224800be9c");
+
+    assert.deepStrictEqual(JSON.parse(JSON.stringify(capturedRelayPolicy)), {
+        method: "GET",
+        timeoutMs: 6000,
+        maxRetries: 1,
+        retryBaseDelayMs: 100,
+        retryMaxDelayMs: 500
+    });
+});
+
+test("getCrmPersonalAccount propagates CRM relay failures", async () => {
+    const relayError = new Error("CRM relay unavailable");
+
+    const mod = loadModule("lib/server/getCrmPersonalAccount.js", {
+        relayGetData: async () => {
+            throw relayError;
+        }
+    });
+
+    await assert.rejects(
+        () => mod.getCrmPersonalAccount("726158c6-708d-ec11-aad8-00224800be9c"),
+        (error) => error === relayError
+    );
+});
+
 test("getaccounts returns EMAIL_ADDRESS_REQUIRED when emailAddress missing", async () => {
     const mod = loadModule("pages/api/endpoint/getaccounts_api.js", {
         respondError: respondErrorMock,

From bf2e4a3254af73c031bfb19aaba50a71743bf18e Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 11:33:49 +0000
Subject: [PATCH 21/24] refactor: migrate myportal index account lookup to
 server helper

---
 pages/myportal/index.js                       |  26 +-
 .../myportal-index-loader-guards.test.cjs     | 244 ++++++++++++++++++
 2 files changed, 264 insertions(+), 6 deletions(-)
 create mode 100644 tests/phase22/myportal-index-loader-guards.test.cjs

diff --git a/pages/myportal/index.js b/pages/myportal/index.js
index dfc737c9..dc04b2ba 100644
--- a/pages/myportal/index.js
+++ b/pages/myportal/index.js
@@ -7,10 +7,8 @@ import pLimit from "p-limit";
 
 import { getIP } from "../../actions/core/logger";
 import { consoleLogger } from "../../actions/core/logger";
-import {
-    getPersonalAccount,
-    getPortalLogin
-} from "../../actions/services/accountService";
+import { getPortalLogin } from "../../actions/services/accountService";
+import { getCrmPersonalAccount } from "../../lib/server/getCrmPersonalAccount";
 import {
     getCase,
     getPortalModuleDetails
@@ -257,9 +255,25 @@ export const getServerSideProps = wrapper.getServerSideProps(
         }
 
         await createContainerProxy(thisSession.user.id);
-        const accountDetails = await getPersonalAccount(loggedInUser);
 
-        if (accountDetails?.errorCode) {
+        let accountDetails;
+
+        try {
+            accountDetails = await getCrmPersonalAccount(loggedInUser);
+        } catch (error) {
+            consoleLogger({
+                name: "MyPortalIndexAccountLookup",
+                reasonCode: "UPSTREAM_FAILURE",
+                message: "myportal index personal account lookup failed",
+                error: error?.message
+            });
+
+            return {
+                redirect: { destination: "/myportal/error", permanent: false }
+            };
+        }
+
+        if (!accountDetails || accountDetails.errorCode) {
             return {
                 redirect: { destination: "/myportal/error", permanent: false }
             };
diff --git a/tests/phase22/myportal-index-loader-guards.test.cjs b/tests/phase22/myportal-index-loader-guards.test.cjs
new file mode 100644
index 00000000..54418852
--- /dev/null
+++ b/tests/phase22/myportal-index-loader-guards.test.cjs
@@ -0,0 +1,244 @@
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+const loadIndexLoader = (overrides = {}) => {
+    const filePath = path.join(
+        __dirname,
+        "..",
+        "..",
+        "pages",
+        "myportal",
+        "index.js"
+    );
+
+    let source = fs.readFileSync(filePath, "utf8");
+
+    // Execute only the server-side loader, not the React component.
+    source = source.slice(source.indexOf("export const getServerSideProps"));
+    source = source.slice(0, source.indexOf("const mapStateToProps"));
+
+    source = source.replace(
+        /export\s+const\s+getServerSideProps\s*=/,
+        "const getServerSideProps ="
+    );
+    source += "\nmodule.exports = { getServerSideProps };\n";
+
+    const dispatches = [];
+    const store = {
+        dispatch: (action) => dispatches.push(action)
+    };
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        process: { env: {} },
+        console: { error: () => {} },
+        wrapper: {
+            getServerSideProps: (factory) => async (ctx) => factory(store)(ctx)
+        },
+        getSession: async () => ({
+            user: {
+                id: "session-user-1",
+                email: "user@example.com"
+            }
+        }),
+        getIP: () => {},
+        consoleLogger: () => {},
+        getPortalLogin: async () => ({
+            value: [{ contactid: "crm-contact-1" }]
+        }),
+        createContainerProxy: async () => {},
+        getCrmPersonalAccount: async () => ({
+            firstname: "Test",
+            pinswg_typeofinvolvement: 0,
+            pinswg_preferredlanguage: 0
+        }),
+        getMyCases: async () => ({ value: [] }),
+        getMyLPACases: async () => ({ value: [] }),
+        getRepsFromBlob: async () => ({ value: [] }),
+        getWatchedCases: async () => ({ value: [] }),
+        getAwaitingSubmissionFromBlob: async () => ({ value: [] }),
+        splitWatchedCasesBySubmissionState: () => ({
+            watchedCases: { value: [] },
+            submittedRepresentations: { value: [] }
+        }),
+        getPortalModuleDetails: async () => ({}),
+        getFormCollectionByID: () => ({
+            LogicalCollectionName: "pinswg_cases"
+        }),
+        pLimit: () => (fn) => fn(),
+        setLocale: (value) => ({ type: "locale", value }),
+        setShowReps: () => ({ type: "showReps" }),
+        setAccountDetails: (value) => ({ type: "accountDetails", value }),
+        setLoggedInUserId: (value) => ({ type: "loggedInUserId", value }),
+        setMyCases: () => ({ type: "myCases" }),
+        setMyCasesDetails: () => ({ type: "myCasesDetails" }),
+        setMyRepresentations: () => ({ type: "myRepresentations" }),
+        setMyRepresentationsDetails: () => ({
+            type: "myRepresentationsDetails"
+        }),
+        setWatchedCases: () => ({ type: "watchedCases" }),
+        setWatchedCasesDetails: () => ({ type: "watchedCasesDetails" }),
+        setMySubmittedReps: () => ({ type: "mySubmittedReps" }),
+        setMySubmittedRepsDetails: () => ({
+            type: "mySubmittedRepsDetails"
+        }),
+        setAwaitingSubmissionFromBlob: () => ({
+            type: "awaitingSubmission"
+        }),
+        setAwaitingSubmissionDetails: () => ({
+            type: "awaitingSubmissionDetails"
+        }),
+        setContainerID: () => ({ type: "containerID" }),
+        ...overrides
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+
+    return {
+        getServerSideProps: context.module.exports.getServerSideProps,
+        dispatches
+    };
+};
+
+const createContext = () => ({
+    req: { cookies: {} },
+    locale: "en"
+});
+
+test("missing session redirects to signin", async () => {
+    const loader = loadIndexLoader({
+        getSession: async () => null
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("missing session identity redirects to signin", async () => {
+    const loader = loadIndexLoader({
+        getSession: async () => ({
+            user: { id: "session-user-1" }
+        })
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("CRM contact lookup failure redirects to signin", async () => {
+    const loader = loadIndexLoader({
+        getPortalLogin: async () => {
+            throw new Error("CRM unavailable");
+        }
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("missing CRM contact redirects to signin", async () => {
+    const loader = loadIndexLoader({
+        getPortalLogin: async () => ({ value: [] })
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("personal account lookup exception redirects to error page", async () => {
+    const loader = loadIndexLoader({
+        getCrmPersonalAccount: async () => {
+            throw new Error("CRM account lookup failed");
+        }
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/myportal/error");
+});
+
+test("missing personal account redirects to error page", async () => {
+    const loader = loadIndexLoader({
+        getCrmPersonalAccount: async () => null
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/myportal/error");
+});
+
+test("personal account error response redirects to error page", async () => {
+    const loader = loadIndexLoader({
+        getCrmPersonalAccount: async () => ({
+            errorCode: "CRM_CONTACT_MISSING"
+        })
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/myportal/error");
+});
+
+test("successful lookup uses contact resolved from session email", async () => {
+    let capturedEmail;
+    let capturedContactId;
+
+    const loader = loadIndexLoader({
+        getPortalLogin: async (email) => {
+            capturedEmail = email;
+            return { value: [{ contactid: "crm-contact-123" }] };
+        },
+        getCrmPersonalAccount: async (contactId) => {
+            capturedContactId = contactId;
+            return {
+                firstname: "Test",
+                pinswg_typeofinvolvement: 0,
+                pinswg_preferredlanguage: 0
+            };
+        }
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(capturedEmail, "user@example.com");
+    assert.strictEqual(capturedContactId, "crm-contact-123");
+    assert.strictEqual(result.props.containerID, "session-user-1");
+
+    const accountDispatch = loader.dispatches.find(
+        (action) => action.type === "accountDetails"
+    );
+
+    assert.strictEqual(accountDispatch.value.firstname, "Test");
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 22 myportal-index-loader-guards tests passed (${passed}/${tests.length}).`
+    );
+};
+
+module.exports = run;
+
+if (require.main === module) {
+    run().catch((error) => {
+        console.error(error);
+        process.exit(1);
+    });
+}

From c49b491698a0405c7e85d77d0263e7232cdf78a5 Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 11:58:01 +0000
Subject: [PATCH 22/24] refactor: migrate myportal viewall account lookup to
 server helper

---
 pages/myportal/viewall.js                     |  27 +-
 .../myportal-viewall-loader-guards.test.cjs   | 314 ++++++++++++++++++
 2 files changed, 336 insertions(+), 5 deletions(-)
 create mode 100644 tests/phase22/myportal-viewall-loader-guards.test.cjs

diff --git a/pages/myportal/viewall.js b/pages/myportal/viewall.js
index 46aa4cbc..c6a4e656 100644
--- a/pages/myportal/viewall.js
+++ b/pages/myportal/viewall.js
@@ -14,10 +14,9 @@ import ServiceBanner from "../../components/myportal/servicebanner";
 import { getSession } from "next-auth/react";
 import pLimit from "p-limit";
 
-import {
-    getPersonalAccount,
-    getPortalLogin
-} from "../../actions/services/accountService";
+import { getPortalLogin } from "../../actions/services/accountService";
+import { getCrmPersonalAccount } from "../../lib/server/getCrmPersonalAccount";
+import { consoleLogger } from "../../actions/core/logger";
 
 import { getPortalModuleDetails } from "../../actions/services/caseService";
 
@@ -189,7 +188,25 @@ export const getServerSideProps = wrapper.getServerSideProps(
             };
         }
 
-        const accountDetails = await getPersonalAccount(loggedInUser);
+        let accountDetails;
+
+        try {
+            accountDetails = await getCrmPersonalAccount(loggedInUser);
+        } catch (error) {
+            consoleLogger({
+                name: "MyPortalViewAllAccountLookup",
+                reasonCode: "UPSTREAM_FAILURE",
+                message: "myportal viewall personal account lookup failed",
+                error: error?.message
+            });
+
+            return {
+                redirect: {
+                    destination: "/myportal/error",
+                    permanent: false
+                }
+            };
+        }
 
         if (!accountDetails || accountDetails.errorCode) {
             return {
diff --git a/tests/phase22/myportal-viewall-loader-guards.test.cjs b/tests/phase22/myportal-viewall-loader-guards.test.cjs
new file mode 100644
index 00000000..20b16af6
--- /dev/null
+++ b/tests/phase22/myportal-viewall-loader-guards.test.cjs
@@ -0,0 +1,314 @@
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+const loadViewAllLoader = (overrides = {}) => {
+    const filePath = path.join(
+        __dirname,
+        "..",
+        "..",
+        "pages",
+        "myportal",
+        "viewall.js"
+    );
+
+    let source = fs.readFileSync(filePath, "utf8");
+
+    // Execute the actual SSR loader, excluding the React component.
+    const start = source.indexOf("export const getServerSideProps");
+    const end = source.indexOf("const mapStateToProps", start);
+
+    assert.ok(start >= 0, "SSR loader declaration not found");
+    assert.ok(end > start, "SSR loader boundary not found");
+
+    source = source.slice(start, end);
+    source = source.replace(
+        /export\s+const\s+getServerSideProps\s*=/,
+        "const getServerSideProps ="
+    );
+    source += "\nmodule.exports = { getServerSideProps };\n";
+
+    const dispatches = [];
+    const store = {
+        dispatch: (action) => dispatches.push(action)
+    };
+
+    const action = (type) => (value) => ({ type, value });
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        console: {
+            log: () => {},
+            error: () => {}
+        },
+        wrapper: {
+            getServerSideProps: (factory) => async (ctx) => factory(store)(ctx)
+        },
+        getSession: async () => ({
+            user: {
+                id: "session-user-1",
+                email: "user@example.com"
+            }
+        }),
+        getPortalLogin: async () => ({
+            value: [{ contactid: "crm-contact-1" }]
+        }),
+        getCrmPersonalAccount: async () => ({
+            firstname: "Test",
+            pinswg_typeofinvolvement: 0
+        }),
+        consoleLogger: () => {},
+        pLimit: () => (fn) => fn(),
+        getMyCases: async () => ({ value: [] }),
+        getMyLPACases: async () => ({ value: [] }),
+        getWatchedCases: async () => ({ value: [] }),
+        getRepsFromBlob: async () => ({ value: [] }),
+        getAwaitingSubmissionFromBlob: async () => ({ value: [] }),
+        splitWatchedCasesBySubmissionState: () => ({
+            watchedCases: [],
+            submittedRepresentations: []
+        }),
+        getPortalModuleDetails: async () => ({}),
+        getFormCollectionByID: () => ({
+            LogicalCollectionName: "pinswg_cases"
+        }),
+        getBasicSearch: async () => ({ value: [] }),
+        setAccountDetails: action("accountDetails"),
+        setLoggedInUserId: action("loggedInUserId"),
+        setContainerID: action("containerID"),
+        setCurrentView: action("currentView"),
+        setMyCases: action("myCases"),
+        setMyCasesDetails: action("myCasesDetails"),
+        setWatchedCases: action("watchedCases"),
+        setWatchedCasesDetails: action("watchedCasesDetails"),
+        setMySubmittedReps: action("mySubmittedReps"),
+        setMySubmittedRepsDetails: action("mySubmittedRepsDetails"),
+        setMyRepresentations: action("myRepresentations"),
+        setMyRepresentationsDetails: action("myRepresentationsDetails"),
+        setAwaitingSubmissionFromBlob: action("awaitingSubmission"),
+        setAwaitingSubmissionDetails: action("awaitingSubmissionDetails"),
+        setSearchResults: action("searchResults"),
+        setSearch: action("search"),
+        ...overrides
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+
+    return {
+        getServerSideProps: context.module.exports.getServerSideProps,
+        dispatches
+    };
+};
+
+const createContext = (key = "myCases") => ({
+    query: { key },
+    req: { cookies: {} },
+    locale: "en"
+});
+
+const getDispatch = (loader, type) =>
+    loader.dispatches.find((item) => item.type === type);
+
+test("invalid view category redirects before account lookup", async () => {
+    let accountLookupCalled = false;
+
+    const loader = loadViewAllLoader({
+        getCrmPersonalAccount: async () => {
+            accountLookupCalled = true;
+            return {};
+        }
+    });
+
+    const result = await loader.getServerSideProps(createContext("invalid"));
+
+    assert.strictEqual(result.redirect.destination, "/myportal");
+    assert.strictEqual(accountLookupCalled, false);
+});
+
+test("missing session redirects to signin", async () => {
+    const loader = loadViewAllLoader({
+        getSession: async () => null
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("missing session email redirects to signin", async () => {
+    const loader = loadViewAllLoader({
+        getSession: async () => ({
+            user: { id: "session-user-1" }
+        })
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("missing CRM contact redirects to signin", async () => {
+    const loader = loadViewAllLoader({
+        getPortalLogin: async () => ({ value: [] })
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("personal account exception redirects to error page", async () => {
+    const loader = loadViewAllLoader({
+        getCrmPersonalAccount: async () => {
+            throw new Error("CRM unavailable");
+        }
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/myportal/error");
+});
+
+test("missing personal account redirects to error page", async () => {
+    const loader = loadViewAllLoader({
+        getCrmPersonalAccount: async () => null
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/myportal/error");
+});
+
+test("personal account error response redirects to error page", async () => {
+    const loader = loadViewAllLoader({
+        getCrmPersonalAccount: async () => ({
+            errorCode: "CRM_CONTACT_MISSING"
+        })
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(result.redirect.destination, "/myportal/error");
+});
+
+test("successful lookup uses session-resolved CRM contact", async () => {
+    let capturedEmail;
+    let capturedContactId;
+
+    const accountDetails = {
+        firstname: "Test",
+        pinswg_typeofinvolvement: 0
+    };
+
+    const loader = loadViewAllLoader({
+        getPortalLogin: async (email) => {
+            capturedEmail = email;
+            return {
+                value: [{ contactid: "crm-contact-123" }]
+            };
+        },
+        getCrmPersonalAccount: async (contactId) => {
+            capturedContactId = contactId;
+            return accountDetails;
+        }
+    });
+
+    const result = await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(capturedEmail, "user@example.com");
+    assert.strictEqual(capturedContactId, "crm-contact-123");
+    assert.ok(result.props);
+
+    assert.strictEqual(
+        getDispatch(loader, "accountDetails").value.firstname,
+        "Test"
+    );
+    assert.strictEqual(
+        getDispatch(loader, "loggedInUserId").value,
+        "crm-contact-123"
+    );
+    assert.strictEqual(
+        getDispatch(loader, "containerID").value,
+        "session-user-1"
+    );
+    assert.strictEqual(
+        getDispatch(loader, "currentView").value.viewKey,
+        "myCases"
+    );
+});
+
+test("all supported view categories load successfully", async () => {
+    const categories = [
+        "myCases",
+        "watchedCases",
+        "mySubmittedReps",
+        "myRepresentations",
+        "awaitingSubmissionDetails"
+    ];
+
+    for (const category of categories) {
+        const loader = loadViewAllLoader();
+
+        const result = await loader.getServerSideProps(createContext(category));
+
+        assert.ok(result.props, `${category} should return props`);
+
+        assert.strictEqual(
+            getDispatch(loader, "currentView").value.viewKey,
+            category
+        );
+    }
+});
+
+test("LPA account uses associated LPA for case lookup", async () => {
+    let capturedLpaId;
+    let personalCaseLookupCalled = false;
+
+    const loader = loadViewAllLoader({
+        getCrmPersonalAccount: async () => ({
+            pinswg_typeofinvolvement: 846040012,
+            "pinswg_contact_associatedlpa@OData.Community.Display.V1.FormattedValue":
+                "lpa-123"
+        }),
+        getMyLPACases: async (lpaId) => {
+            capturedLpaId = lpaId;
+            return { value: [] };
+        },
+        getMyCases: async () => {
+            personalCaseLookupCalled = true;
+            return { value: [] };
+        }
+    });
+
+    await loader.getServerSideProps(createContext());
+
+    assert.strictEqual(capturedLpaId, "lpa-123");
+    assert.strictEqual(personalCaseLookupCalled, false);
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 22 myportal-viewall-loader-guards tests passed (${passed}/${tests.length}).`
+    );
+};
+
+module.exports = run;
+
+if (require.main === module) {
+    run().catch((error) => {
+        console.error(error);
+        process.exit(1);
+    });
+}

From 946d361a67c71ac7eb81be6d5818e02637f7878a Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 13:02:49 +0000
Subject: [PATCH 23/24] test: cover ITHC cross-user blob deletion protection

---
 tests/phase21/file-handler-contract.test.cjs | 69 ++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index a1ae3d79..3ecf8f68 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -5591,6 +5591,75 @@ test("createcase_api preserves the existing propagated token dependency failure
     assert.strictEqual(loaded.calls.appealBlob.length, 0);
 });
 
+const loadRepresentationDeletion = (route, operationName, session) => {
+    const calls = [];
+    const mod = loadModule(route, {
+        nextConnect: createNextConnectMock(),
+        middleware: () => {},
+        getServerSession: async () => session,
+        authOptions: () => ({}),
+        hashAPIPath: () => "&hash=expected",
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        [operationName]: async (...args) => {
+            calls.push(args);
+            return { deleted: true };
+        }
+    });
+
+    return { mod, calls };
+};
+
+test("whole-representation deletion remains cross-user protected with zero Azure operations", async () => {
+    const loaded = loadRepresentationDeletion(
+        "pages/api/file/deleteblobrep.js",
+        "deleteBlobRep",
+        { user: { id: "different-container" } }
+    );
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        {
+            query: {
+                container: "organisation-container",
+                casefolderID: "CASE-1",
+                repfile: "REP-1",
+                hash: "expected"
+            }
+        },
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(loaded.calls.length, 0);
+});
+
+test("representation supporting-file deletion remains cross-user protected with zero Azure operations", async () => {
+    const loaded = loadRepresentationDeletion(
+        "pages/api/file/deleteblob.js",
+        "deleteBlob",
+        { user: { id: "different-container" } }
+    );
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        {
+            query: {
+                container: "organisation-container",
+                casefolderID: "CASE-1/REP-1",
+                blobname: "evidence.pdf",
+                hash: "expected"
+            }
+        },
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(loaded.calls.length, 0);
+});
+
 const run = async () => {
     let passed = 0;
     for (const currentTest of tests) {

From 1377aebc892ed71806a0d64f74b6f2aab421d9be Mon Sep 17 00:00:00 2001
From: robbond <rob@rdbsolutions.co.uk>
Date: Fri, 6 Nov 2026 17:05:40 +0000
Subject: [PATCH 24/24] fix: enforce representation blob ownership and secure
 SSR access

---
 actions/clients/fileClient.js                 |   4 +-
 actions/services/documentDirectService.js     |  39 ++++-
 lib/representation/pageLoaders.js             |   4 +-
 pages/api/admin/getrepsblobproxy.js           |  35 +++-
 pages/api/file/getrepsblob.js                 |  24 +++
 pages/api/file/getrepsblobproxy.js            |  27 ++-
 pages/myportal/case/[ticketnumber].js         |   3 +-
 pages/myportal/index.js                       |   4 +-
 pages/myportal/viewall.js                     |   3 +-
 tests/phase21/_shared.cjs                     |   1 +
 tests/phase21/file-handler-contract.test.cjs  |  70 +++++++-
 ...pi-grouping-facade-myportal-reads.test.cjs |   2 +-
 .../representation-list-ownership.test.cjs    | 157 ++++++++++++++++++
 tests/phase7/service-behaviour.test.cjs       |  87 ++++++++++
 tests/serviceHarness.cjs                      |  10 +-
 15 files changed, 447 insertions(+), 23 deletions(-)
 create mode 100644 tests/phase22/representation-list-ownership.test.cjs

diff --git a/actions/clients/fileClient.js b/actions/clients/fileClient.js
index c58c9748..856c7f04 100644
--- a/actions/clients/fileClient.js
+++ b/actions/clients/fileClient.js
@@ -1,8 +1,8 @@
 import { getJson, requestJson } from "./endpointClient";
 import { getSignedJson, postSignedJson } from "./signedRequestClient";
 
-export const getFileJson = (url) => {
-    return getJson(url);
+export const getFileJson = (url, config) => {
+    return getJson(url, config);
 };
 
 export const getSignedFileJson = async (queryUrl) => {
diff --git a/actions/services/documentDirectService.js b/actions/services/documentDirectService.js
index 436ee123..77ae6479 100644
--- a/actions/services/documentDirectService.js
+++ b/actions/services/documentDirectService.js
@@ -28,13 +28,48 @@ export const getAwaitingSubmissionFromBlob = (containerName) => {
     });
 };
 
-export const getRepsFromBlob = (containerName) => {
+export const getRepsFromBlob = (containerName, config) => {
     const route = buildFileQuery("/api/file/getrepsblob", {
         container: containerName
     });
 
+    const url = withBaseUrl(BASE_URL, appendHashSuffix(route, hashAPIPath));
+
+    const hasForwardedCookie =
+        typeof config?.headers?.Cookie === "string" &&
+        config.headers.Cookie.length > 0;
+
+    if (hasForwardedCookie) {
+        let trustedDestination = false;
+
+        try {
+            const destination = new URL(url);
+            const expectedOrigin = new URL(process.env.NEXTAUTH_URL);
+
+            trustedDestination =
+                destination.origin === expectedOrigin.origin &&
+                ["http:", "https:"].includes(destination.protocol) &&
+                !destination.username &&
+                !destination.password;
+        } catch {
+            trustedDestination = false;
+        }
+
+        if (!trustedDestination) {
+            return Promise.reject(
+                new Error("Untrusted representation request destination")
+            );
+        }
+    }
+
     return getFileJson(
-        withBaseUrl(BASE_URL, appendHashSuffix(route, hashAPIPath))
+        url,
+        hasForwardedCookie
+            ? {
+                  ...config,
+                  maxRedirects: 0
+              }
+            : config
     ).catch((error) => {
         consoleLogger(error);
     });
diff --git a/lib/representation/pageLoaders.js b/lib/representation/pageLoaders.js
index 60b5b4f4..853e568a 100644
--- a/lib/representation/pageLoaders.js
+++ b/lib/representation/pageLoaders.js
@@ -120,7 +120,9 @@ export const loadRepresentationBootstrap = async ({ ctx }) => {
 
     const [accountDetails, myRepresentations] = await Promise.all([
         getPersonalAccount(loggedInUser),
-        getRepsFromBlob(thisSession.user.id)
+        getRepsFromBlob(thisSession.user.id, {
+            headers: { Cookie: ctx.req?.headers?.cookie || "" }
+        })
     ]);
 
     const myRepresentationsDetails = await getDetails(
diff --git a/pages/api/admin/getrepsblobproxy.js b/pages/api/admin/getrepsblobproxy.js
index 129671d7..a8b1ba65 100644
--- a/pages/api/admin/getrepsblobproxy.js
+++ b/pages/api/admin/getrepsblobproxy.js
@@ -1,9 +1,11 @@
+import { BASE_URL } from "../../../actions/core/env";
 import { getToken } from "../../../actions/core/token";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
 import { hashAPIPath } from "../../../actions/core/hash";
 import axios from "axios";
 import {
+    ADMIN_SESSION_COOKIE,
     hasTrustedSameOrigin,
     readAdminSessionCookie,
     setAdminAuthNoStore,
@@ -11,7 +13,16 @@ import {
 } from "../../../lib/admin/adminAuth";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
 
-const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
+const isTrustedInternalDestination = () => {
+    try {
+        return (
+            new URL(BASE_URL).origin ===
+            new URL(process.env.NEXTAUTH_URL).origin
+        );
+    } catch {
+        return false;
+    }
+};
 
 const forbidden = (res) =>
     respondError(res, {
@@ -39,10 +50,7 @@ export default async function handler(req, res) {
     }
 
     const adminSession = readAdminSessionCookie(req);
-    if (
-        !validateAdminSession(adminSession) ||
-        !hasTrustedSameOrigin(req)
-    ) {
+    if (!validateAdminSession(adminSession) || !hasTrustedSameOrigin(req)) {
         return forbidden(res);
     }
 
@@ -55,14 +63,27 @@ export default async function handler(req, res) {
         });
     }
 
+    if (!isTrustedInternalDestination()) {
+        return forbidden(res);
+    }
+
     const token = await getToken();
     const queryUrl =
         "/api/file/getrepsblob?container=" + encodeURIComponent(container);
 
     try {
+        const config = azureHeaders(token.access_token);
+
         const { data } = await axios.get(
             BASE_URL + queryUrl + hashAPIPath(queryUrl),
-            azureHeaders(token.access_token)
+            {
+                ...config,
+                headers: {
+                    ...config.headers,
+                    Cookie: `${ADMIN_SESSION_COOKIE}=${encodeURIComponent(adminSession)}`
+                },
+                maxRedirects: 0
+            }
         );
         return respondSuccess(res, data);
     } catch (error) {
@@ -73,4 +94,4 @@ export default async function handler(req, res) {
             message: "Failed to fetch representation blobs"
         });
     }
-}
\ No newline at end of file
+}
diff --git a/pages/api/file/getrepsblob.js b/pages/api/file/getrepsblob.js
index 45dff296..ef58e15e 100644
--- a/pages/api/file/getrepsblob.js
+++ b/pages/api/file/getrepsblob.js
@@ -38,10 +38,23 @@ import middleware from "../middleware/middleware";
 import { hashAPIPath } from "../../../actions/core/hash";
 import { consoleLogger } from "../../../actions/core/logger";
 import { respondError, respondSuccess } from "../middleware/apiResponse";
+import { getServerSession } from "next-auth/next";
+import { authOptions } from "../auth/[...nextauth]";
+import {
+    readAdminSessionCookie,
+    validateAdminSession
+} from "../../../lib/admin/adminAuth";
 
 const ApiProxy = nextConnect();
 ApiProxy.use(middleware);
 
+const forbidden = (res) =>
+    respondError(res, {
+        status: 403,
+        code: "FORBIDDEN",
+        message: "Request not permitted"
+    });
+
 ApiProxy.get(async (req, res) => {
     const containerName = req.query.container;
     const checkHash = req.query.hash;
@@ -59,6 +72,17 @@ ApiProxy.get(async (req, res) => {
         });
     }
 
+    const session = await getServerSession(req, res, authOptions(req, res));
+    const isPortalOwner =
+        typeof session?.user?.id === "string" &&
+        session.user.id.length > 0 &&
+        session.user.id === containerName;
+    const isAdministrator = validateAdminSession(readAdminSessionCookie(req));
+
+    if (!isPortalOwner && !isAdministrator) {
+        return forbidden(res);
+    }
+
     const hashCandidatePaths = [
         "/api/file/getrepsblob?container=" + containerName,
         "/api/file/getrepsblob?container=" + encodeURIComponent(containerName)
diff --git a/pages/api/file/getrepsblobproxy.js b/pages/api/file/getrepsblobproxy.js
index cf279da2..126237e6 100644
--- a/pages/api/file/getrepsblobproxy.js
+++ b/pages/api/file/getrepsblobproxy.js
@@ -1,3 +1,4 @@
+import { BASE_URL } from "../../../actions/core/env";
 import { getToken } from "../../../actions/core/token";
 import { azureHeaders } from "../../../actions/core/headers";
 import { consoleLogger } from "../../../actions/core/logger";
@@ -7,7 +8,16 @@ import { respondError, respondSuccess } from "../middleware/apiResponse";
 import { getServerSession } from "next-auth/next";
 import { authOptions } from "../auth/[...nextauth]";
 
-const BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
+const isTrustedInternalDestination = () => {
+    try {
+        return (
+            new URL(BASE_URL).origin ===
+            new URL(process.env.NEXTAUTH_URL).origin
+        );
+    } catch {
+        return false;
+    }
+};
 
 const forbidden = (res) =>
     respondError(res, {
@@ -60,15 +70,28 @@ export default async function ApiProxy(req, res) {
         return forbidden(res);
     }
 
+    if (!isTrustedInternalDestination()) {
+        return forbidden(res);
+    }
+
     const token = await getToken();
 
     const queryUrl =
         "/api/file/getrepsblob?container=" + encodeURIComponent(containerName);
 
     try {
+        const config = azureHeaders(token.access_token);
+
         const { data } = await axios.get(
             BASE_URL + queryUrl + hashAPIPath(queryUrl),
-            azureHeaders(token.access_token)
+            {
+                ...config,
+                headers: {
+                    ...config.headers,
+                    Cookie: req.headers.cookie || ""
+                },
+                maxRedirects: 0
+            }
         );
         return respondSuccess(res, data);
     } catch (error) {
diff --git a/pages/myportal/case/[ticketnumber].js b/pages/myportal/case/[ticketnumber].js
index 04859115..9a28f691 100644
--- a/pages/myportal/case/[ticketnumber].js
+++ b/pages/myportal/case/[ticketnumber].js
@@ -304,7 +304,8 @@ export const getServerSideProps = wrapper.getServerSideProps(
                             break;
                         case "myRepresentations":
                             const myRepresentations = await getRepsFromBlob(
-                                thisSession.user.id
+                                thisSession.user.id,
+                                { headers: { Cookie: req.headers.cookie || "" } }
                             );
 
                             const myRepresentationsDetails = await getDetails(
diff --git a/pages/myportal/index.js b/pages/myportal/index.js
index dc04b2ba..4c0195e0 100644
--- a/pages/myportal/index.js
+++ b/pages/myportal/index.js
@@ -293,7 +293,9 @@ export const getServerSideProps = wrapper.getServerSideProps(
             awaitingSubmissionFromBlob
         ] = await Promise.all([
             isLPA ? getMyLPACases(lpaId) : getMyCases(loggedInUser),
-            getRepsFromBlob(thisSession.user.id),
+            getRepsFromBlob(thisSession.user.id, {
+                headers: { Cookie: req.headers.cookie || "" }
+            }),
             getWatchedCases(loggedInUser),
             getAwaitingSubmissionFromBlob(thisSession.user.id)
         ]);
diff --git a/pages/myportal/viewall.js b/pages/myportal/viewall.js
index c6a4e656..4db131b6 100644
--- a/pages/myportal/viewall.js
+++ b/pages/myportal/viewall.js
@@ -371,7 +371,8 @@ export const getServerSideProps = wrapper.getServerSideProps(
 
             case "myRepresentations": {
                 const myRepresentations = await getRepsFromBlob(
-                    thisSession.user.id
+                    thisSession.user.id,
+                    { headers: { Cookie: ctx.req?.headers?.cookie || "" } }
                 );
 
                 // The existing View All component reads
diff --git a/tests/phase21/_shared.cjs b/tests/phase21/_shared.cjs
index 768aea02..2903a0a2 100644
--- a/tests/phase21/_shared.cjs
+++ b/tests/phase21/_shared.cjs
@@ -50,6 +50,7 @@ const loadModule = (relativePath, injected = {}) => {
         exports: {},
         require,
         process,
+        URL,
         console: {
             log: () => {},
             info: () => {},
diff --git a/tests/phase21/file-handler-contract.test.cjs b/tests/phase21/file-handler-contract.test.cjs
index 3ecf8f68..53fcc5cc 100644
--- a/tests/phase21/file-handler-contract.test.cjs
+++ b/tests/phase21/file-handler-contract.test.cjs
@@ -1554,6 +1554,10 @@ test("getrepsblob handler success returns representations payload", async () =>
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
         consoleLogger: () => {},
+        getServerSession: async () => ({ user: { id: "c1" } }),
+        authOptions: () => ({}),
+        readAdminSessionCookie: () => null,
+        validateAdminSession: () => false,
         getRepsBlobs: async () => [
             { path: "c/ref_rep.json", name: "ref_rep.json" }
         ],
@@ -1612,6 +1616,10 @@ test("getrepsblob handler rejects invalid HMAC before Azure access", async () =>
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
         consoleLogger: () => {},
+        getServerSession: async () => ({ user: { id: "c1" } }),
+        authOptions: () => ({}),
+        readAdminSessionCookie: () => null,
+        validateAdminSession: () => false,
         getRepsBlobs: async () => {
             azureCalls += 1;
             return [];
@@ -1817,6 +1825,10 @@ test("getrepsblob handler dependency failure returns GET_REPS_BLOB_FAILED", asyn
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
         consoleLogger: () => {},
+        getServerSession: async () => ({ user: { id: "c1" } }),
+        authOptions: () => ({}),
+        readAdminSessionCookie: () => null,
+        validateAdminSession: () => false,
         getRepsBlobs: async () => {
             throw new Error("storage failure");
         },
@@ -1844,6 +1856,10 @@ test("getrepsblob handler accepts encoded container hash variant", async () => {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
         consoleLogger: () => {},
+        getServerSession: async () => ({ user: { id: "cont/1" } }),
+        authOptions: () => ({}),
+        readAdminSessionCookie: () => null,
+        validateAdminSession: () => false,
         getRepsBlobs: async () => [{ path: "cont/rep1.json" }],
         downloadAllRepsFiles: async () => ({ value: [{ id: "r-encoded" }] })
     });
@@ -2869,7 +2885,13 @@ const loadOrdinaryRepsProxy = (overrides = {}) => {
             return "&hash=abc";
         },
         consoleLogger: () => {},
-        process: { env: { API_ROOT: "http://example.com" } },
+        BASE_URL: "http://example.com",
+        process: {
+            env: {
+                API_ROOT: "http://example.com",
+                NEXTAUTH_URL: "http://example.com"
+            }
+        },
         axios: {
             get: async (...args) => {
                 calls.axios.push(args);
@@ -2979,7 +3001,9 @@ for (const containerCase of [
 
 test("getrepsblobproxy preserves signed path and response for owning user", async () => {
     const loaded = loadOrdinaryRepsProxy();
-    const req = ordinaryRepsRequest();
+    const req = ordinaryRepsRequest({
+        headers: { cookie: "next-auth.session-token=test-session" }
+    });
     const res = createRes();
 
     await loaded.mod.default(req, res);
@@ -2995,6 +3019,16 @@ test("getrepsblobproxy preserves signed path and response for owning user", asyn
         loaded.calls.axios[0][0],
         "http://example.com/api/file/getrepsblob?container=user-container&hash=abc"
     );
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(loaded.calls.axios[0][1])),
+        {
+            headers: {
+                Authorization: "Bearer tok",
+                Cookie: "next-auth.session-token=test-session"
+            },
+            maxRedirects: 0
+        }
+    );
     assert.deepStrictEqual(
         JSON.parse(JSON.stringify(res.state.jsonBody)),
         loaded.payload
@@ -3030,6 +3064,7 @@ const loadAdminRepsProxy = (overrides = {}) => {
     const mod = loadModule("pages/api/admin/getrepsblobproxy.js", {
         respondError: respondErrorMock,
         respondSuccess: respondSuccessMock,
+        ADMIN_SESSION_COOKIE: "pedw_admin_session",
         readAdminSessionCookie: () => "admin-token",
         validateAdminSession: () => true,
         hasTrustedSameOrigin: () => true,
@@ -3044,7 +3079,13 @@ const loadAdminRepsProxy = (overrides = {}) => {
             return "&hash=abc";
         },
         consoleLogger: () => {},
-        process: { env: { API_ROOT: "http://example.com" } },
+        BASE_URL: "http://example.com",
+        process: {
+            env: {
+                API_ROOT: "http://example.com",
+                NEXTAUTH_URL: "http://example.com"
+            }
+        },
         axios: {
             get: async (...args) => {
                 calls.axios.push(args);
@@ -3171,6 +3212,16 @@ test("admin getrepsblobproxy preserves cross-container signed path and response"
         loaded.calls.axios[0][0],
         "http://example.com/api/file/getrepsblob?container=selected-user-container&hash=abc"
     );
+    assert.deepStrictEqual(
+        JSON.parse(JSON.stringify(loaded.calls.axios[0][1])),
+        {
+            headers: {
+                Authorization: "Bearer tok",
+                Cookie: "pedw_admin_session=admin-token"
+            },
+            maxRedirects: 0
+        }
+    );
     assert.deepStrictEqual(
         JSON.parse(JSON.stringify(res.state.jsonBody)),
         loaded.payload
@@ -3202,6 +3253,19 @@ test("admin storage refresh uses dedicated POST proxy while ordinary callers rem
     assert.match(viewAllSource, /getRepsFromBlobProxy\(containerID\)/);
 });
 
+test("admin getrepsblobproxy rejects untrusted internal destination before proxy work", async () => {
+    const loaded = loadAdminRepsProxy({
+        BASE_URL: "https://attacker.example"
+    });
+    const res = createRes();
+
+    await loaded.mod.default(adminRepsRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assertNoProxyWork(loaded.calls);
+});
+
 test("admin storage completion uses dedicated POST route while ordinary completion remains unchanged", () => {
     const rootDir = path.resolve(__dirname, "..", "..");
     const adminSource = fs.readFileSync(
diff --git a/tests/phase22/api-grouping-facade-myportal-reads.test.cjs b/tests/phase22/api-grouping-facade-myportal-reads.test.cjs
index a9464293..0f334d5b 100644
--- a/tests/phase22/api-grouping-facade-myportal-reads.test.cjs
+++ b/tests/phase22/api-grouping-facade-myportal-reads.test.cjs
@@ -129,7 +129,7 @@ test("excluded route families remain outside this myportal slice", async () => {
     const pageSource = read("pages/myportal/index.js");
 
     assert.match(portalSource, /\/api\/subscriptions\/get-watched-cases/);
-    assert.match(pageSource, /getRepsFromBlob\(thisSession.user.id\)/);
+    assert.match(pageSource, /getRepsFromBlob\(thisSession.user.id,\s*\{/);
     assert.match(
         pageSource,
         /getAwaitingSubmissionFromBlob\(thisSession.user.id\)/
diff --git a/tests/phase22/representation-list-ownership.test.cjs b/tests/phase22/representation-list-ownership.test.cjs
new file mode 100644
index 00000000..82eb7ce4
--- /dev/null
+++ b/tests/phase22/representation-list-ownership.test.cjs
@@ -0,0 +1,157 @@
+const assert = require("assert");
+const {
+    loadModule,
+    createRes,
+    createNextConnectMock,
+    respondSuccessMock,
+    respondErrorMock
+} = require("../phase21/_shared.cjs");
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+const loadRepresentationList = ({ session = null, administrator = false } = {}) => {
+    const calls = { list: [], download: [] };
+    const mod = loadModule("pages/api/file/getrepsblob.js", {
+        nextConnect: createNextConnectMock(),
+        middleware: () => {},
+        getServerSession: async () => session,
+        authOptions: () => ({}),
+        readAdminSessionCookie: () =>
+            administrator ? "valid-admin-session" : null,
+        validateAdminSession: () => administrator,
+        hashAPIPath: () => "&hash=expected",
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        consoleLogger: () => {},
+        getRepsBlobs: async (...args) => {
+            calls.list.push(args);
+            return [{ path: "CASE/REP_rep.json" }];
+        },
+        downloadAllRepsFiles: async (...args) => {
+            calls.download.push(args);
+            return { value: [{ id: "rep-1" }] };
+        }
+    });
+
+    return { mod, calls };
+};
+
+const representationListRequest = (query = {}) => ({
+    query: {
+        container: "organisation-container",
+        hash: "expected",
+        ...query
+    },
+    headers: {}
+});
+
+test("representation listing rejects a missing session before Azure access", async () => {
+    const loaded = loadRepresentationList();
+    const res = createRes();
+
+    await loaded.mod.default.handler(representationListRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(res.state.jsonBody.error.code, "FORBIDDEN");
+    assert.strictEqual(loaded.calls.list.length, 0);
+    assert.strictEqual(loaded.calls.download.length, 0);
+});
+
+test("representation listing rejects cross-user container access before Azure access", async () => {
+    const loaded = loadRepresentationList({
+        session: { user: { id: "different-container" } }
+    });
+    const res = createRes();
+
+    await loaded.mod.default.handler(representationListRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 403);
+    assert.strictEqual(loaded.calls.list.length, 0);
+    assert.strictEqual(loaded.calls.download.length, 0);
+});
+
+test("representation listing preserves authorised organisation-container access", async () => {
+    const loaded = loadRepresentationList({
+        session: { user: { id: "organisation-container" } }
+    });
+    const res = createRes();
+
+    await loaded.mod.default.handler(representationListRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.deepStrictEqual(loaded.calls.list, [["organisation-container"]]);
+    assert.strictEqual(loaded.calls.download.length, 1);
+});
+
+test("representation listing preserves existing administrative access", async () => {
+    const loaded = loadRepresentationList({ administrator: true });
+    const res = createRes();
+
+    await loaded.mod.default.handler(representationListRequest(), res);
+
+    assert.strictEqual(res.state.statusCode, 200);
+    assert.strictEqual(loaded.calls.list.length, 1);
+});
+
+test("representation listing rejects a missing identifier before authentication or Azure access", async () => {
+    let sessionCalls = 0;
+    const loaded = loadRepresentationList({
+        session: { user: { id: "organisation-container" } }
+    });
+    loaded.mod = loadModule("pages/api/file/getrepsblob.js", {
+        nextConnect: createNextConnectMock(),
+        middleware: () => {},
+        getServerSession: async () => {
+            sessionCalls += 1;
+            return { user: { id: "organisation-container" } };
+        },
+        authOptions: () => ({}),
+        readAdminSessionCookie: () => null,
+        validateAdminSession: () => false,
+        hashAPIPath: () => "&hash=expected",
+        respondError: respondErrorMock,
+        respondSuccess: respondSuccessMock,
+        consoleLogger: () => {},
+        getRepsBlobs: async () => {
+            loaded.calls.list.push([]);
+            return [];
+        },
+        downloadAllRepsFiles: async () => {
+            loaded.calls.download.push([]);
+            return {};
+        }
+    });
+    const res = createRes();
+
+    await loaded.mod.default.handler(
+        representationListRequest({ container: "" }),
+        res
+    );
+
+    assert.strictEqual(res.state.statusCode, 400);
+    assert.strictEqual(res.state.jsonBody.error.code, "MISSING_REQUIRED_QUERY");
+    assert.strictEqual(sessionCalls, 0);
+    assert.strictEqual(loaded.calls.list.length, 0);
+    assert.strictEqual(loaded.calls.download.length, 0);
+});
+
+const run = async () => {
+    let passed = 0;
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+    console.log(
+        `Representation listing ownership tests passed (${passed}/${tests.length}).`
+    );
+};
+
+module.exports = run;
+
+if (require.main === module) {
+    run().catch((error) => {
+        console.error(error);
+        process.exit(1);
+    });
+}
diff --git a/tests/phase7/service-behaviour.test.cjs b/tests/phase7/service-behaviour.test.cjs
index 05764a66..e53a3071 100644
--- a/tests/phase7/service-behaviour.test.cjs
+++ b/tests/phase7/service-behaviour.test.cjs
@@ -65,6 +65,93 @@ test("document/getAwaitingSubmissionFromBlob logs and returns undefined on failu
     assert.strictEqual(logger.calls.length, 1);
 });
 
+test("document/getRepsFromBlob forwards cookies only to trusted origin without redirects", async () => {
+    const axios = createAxiosMock();
+    const logger = createLoggerMock();
+
+    axios.getHandler = async () => ({
+        data: { value: ["representation"] }
+    });
+
+    const document = loadServiceModule("documentDirectService.js", {
+        axios,
+        BASE_URL: "http://example.local",
+        consoleLogger: logger.consoleLogger,
+        hashAPIPath: () => "&hash=abc123"
+    });
+
+    const result = await document.getRepsFromBlob("container-1", {
+        headers: {
+            Cookie: "next-auth.session-token=test-session"
+        }
+    });
+
+    assert.deepStrictEqual(normalize(result), {
+        value: ["representation"]
+    });
+
+    assert.strictEqual(axios.calls.length, 1);
+    assert.strictEqual(
+        axios.calls[0].url,
+        "http://example.local/api/file/getrepsblob?container=container-1&hash=abc123"
+    );
+    assert.strictEqual(
+        axios.calls[0].config.headers.Cookie,
+        "next-auth.session-token=test-session"
+    );
+    assert.strictEqual(axios.calls[0].config.maxRedirects, 0);
+    assert.strictEqual(logger.calls.length, 0);
+});
+
+test("document/getRepsFromBlob rejects untrusted origin before HTTP request", async () => {
+    const axios = createAxiosMock();
+    const logger = createLoggerMock();
+
+    const document = loadServiceModule("documentDirectService.js", {
+        axios,
+        BASE_URL: "https://untrusted.example",
+        consoleLogger: logger.consoleLogger,
+        hashAPIPath: () => "&hash=abc123"
+    });
+
+    await assert.rejects(
+        document.getRepsFromBlob("container-1", {
+            headers: {
+                Cookie: "next-auth.session-token=test-session"
+            }
+        }),
+        /Untrusted representation request destination/
+    );
+
+    assert.strictEqual(axios.calls.length, 0);
+    assert.strictEqual(logger.calls.length, 0);
+});
+
+test("document/getRepsFromBlob preserves requests without forwarded cookies", async () => {
+    const axios = createAxiosMock();
+    const logger = createLoggerMock();
+
+    axios.getHandler = async () => ({
+        data: { value: ["representation"] }
+    });
+
+    const document = loadServiceModule("documentDirectService.js", {
+        axios,
+        BASE_URL: "http://example.local",
+        consoleLogger: logger.consoleLogger,
+        hashAPIPath: () => "&hash=abc123"
+    });
+
+    const result = await document.getRepsFromBlob("container-1");
+
+    assert.deepStrictEqual(normalize(result), {
+        value: ["representation"]
+    });
+    assert.strictEqual(axios.calls.length, 1);
+    assert.strictEqual(axios.calls[0].config, undefined);
+    assert.strictEqual(logger.calls.length, 0);
+});
+
 test("portal/deleteWatchedCases uses signer hash and returns data", async () => {
     const axios = createAxiosMock();
     const logger = createLoggerMock();
diff --git a/tests/serviceHarness.cjs b/tests/serviceHarness.cjs
index aea3882b..a489b5ce 100644
--- a/tests/serviceHarness.cjs
+++ b/tests/serviceHarness.cjs
@@ -89,8 +89,8 @@ const loadServiceModule = (fileName, injected = {}) => {
         return injected.axios(config).then((response) => response.data);
     };
 
-    const defaultGetFileJson = (url) => {
-        return defaultGetJson(url);
+    const defaultGetFileJson = (url, config) => {
+        return defaultGetJson(url, config);
     };
 
     const defaultBuildHashedQueryUrl = async (queryUrl) => {
@@ -207,8 +207,14 @@ const loadServiceModule = (fileName, injected = {}) => {
         module: { exports: {} },
         exports: {},
         require,
+        URL,
         URLSearchParams,
         encodeURIComponent,
+        process: injected.process || {
+            env: {
+                NEXTAUTH_URL: "http://example.local"
+            }
+        },
         FormData: global.FormData,
         console: {
             log: () => {},