Merged PR 2315: Auth stabilistatiion and hardening

Related work items: #23020
2026-05-14 08:55:49 +00:00
parent d295a507ac
commit d0b2fd077a
41 changed files with 1462 additions and 418 deletions
@@ -0,0 +1,34 @@
+# Auth & Session Reliability Notes
+
+Last updated: 2026-05-13
+
+## Known issue
+
+Users are intermittently prompted to sign in again despite apparently valid prior session state.
+
+## Confirmed risk contributors in code
+
+1. Duplicated logout/cookie clearing logic across multiple components.
+2. Mixed callback cookie names in runtime history (`next-auth.callback-url` and `__Secure-next-auth.callback-url`).
+3. Redirect URL parsing that could fail hard on malformed/unexpected URL inputs.
+4. Hard SSR redirects to `/auth/signin` on missing/transient upstream account/contact states.
+
+## Stabilisation changes started
+
+- Added `lib/auth/sessionClient.js`:
+    - normalized cookie/session artifact cleanup
+    - shared signed-out callback path by locale
+    - shared `performPortalSignOut(...)` helper
+- Adopted helper in:
+    - `components/timeout/index.js`
+    - `components/myportal/servicebanner.js`
+    - `components/header.js`
+- Updated NextAuth callback locale detection to check both callback cookie variants.
+- Hardened NextAuth URL append and redirect parsing fallbacks.
+
+## Remaining auth hardening backlog
+
+1. Migrate remaining logout implementations to shared helper.
+2. Add request-correlation-safe auth diagnostics (no secrets/tokens).
+3. Evaluate session TTL/update strategy (`maxAge`, `updateAge`) with production evidence.
+4. Add env validation checks for `NEXTAUTH_URL`, `CY_API_ROOT`, proxy/header assumptions.
@@ -0,0 +1,38 @@
+# Current Platform State (PEDW) — feature/restart-from-sips
+
+Last updated: 2026-05-13
+
+## Summary
+
+PEDW is in a **late-stage refactor stabilization** phase.
+
+- New Appeal refactor stream (Slices 1–8) is complete per tracker/state docs.
+- Representations stream remains structurally complex and only partially decomposed.
+- Platform architecture direction remains valid: bounded, behaviour-preserving slices.
+
+## What is complete
+
+- New Appeal slice stream documented complete (`context/refactor-tracker.md`, `context/newappeal-refactor-current-state.md`).
+- Significant route/breadcrumb decomposition and helper extraction completed.
+- Broad endpoint contract hardening completed across key clusters.
+
+## What is incomplete
+
+- Auth/session reliability hardening (intermittent re-signin prompts).
+- SSR loader resilience normalization across myportal/representation/new appeal.
+- Logging hardening consistency in auth/file/account-sensitive paths.
+- Remaining decomposition hotspots (`components/elements/index.js`, representation flow internals).
+
+## Operational risk profile (current)
+
+Top active risks:
+
+1. Auth/session intermittency (callback/cookie/SSR timing interplay).
+2. Fragile nested state assumptions in loader-heavy paths.
+3. Production log noise and inconsistent redaction patterns.
+4. Manual effort burden for EN/CY parity and journey regression checks.
+
+## Notes on stale/legacy guidance
+
+- Some context docs still describe pre-refactor representation baseline; treat those as historical unless updated by active slice evidence.
+- Legacy commented code remains in active files (especially journey files) and should be treated as cleanup debt, not source-of-truth runtime behaviour.
@@ -0,0 +1,29 @@
+# Performance & Stability Baseline (Phase 1)
+
+Last updated: 2026-05-13
+
+## Baseline observations
+
+### Performance
+
+- Loader-heavy pages (myportal/representation/new appeal) perform multiple external calls per SSR request.
+- Form XML is read/normalized repeatedly from disk in SSR path.
+- Some large components still combine orchestration + rendering, increasing rerender work.
+
+### Stability
+
+- Several SSR/data paths assume nested API response shapes without guard rails.
+- Representation resume/new loader had crash/redirect fragility around missing contact/representation objects.
+- Logging noise can mask actionable failure signals.
+
+## Changes started in this phase
+
+1. Added in-memory XML cache in `lib/forms/readFormXml.js` (safe, process-local).
+2. Added null/redirect guards in `lib/representation/pageLoaders.js` for missing user/contact and missing representation entry.
+3. Began auth-path de-duplication and redirect hardening (see auth reliability doc).
+
+## Next baseline improvements
+
+1. Add guarded defaults in remaining loader paths (`loadNewAppealPage`, myportal page loaders).
+2. Introduce structured non-sensitive SSR failure telemetry for dependency failures.
+3. Expand bounded concurrency/parallelism where safe and contract-preserving.
@@ -0,0 +1,62 @@
+# Phase 1 Stabilisation Plan (Execution Start)
+
+Last updated: 2026-05-14
+
+## Goal
+
+Reduce operational risk without changing PEDW business behaviour.
+
+## Priority order
+
+1. **Auth/session reliability**
+2. **SSR/data-loading resilience**
+3. **Logging/observability hardening**
+4. **Low-risk performance improvements**
+
+## Slice plan
+
+### Slice P0.1 (started)
+
+- Centralize client-side signout/cookie cleanup into shared helper.
+- Replace duplicated logout logic in timeout and portal/header surfaces.
+
+Status: completed across timeout, header, service banner, myportal, furtherdetails, and auth error paths.
+
+### Slice P0.2 (started)
+
+- Harden NextAuth redirect/locale callback handling.
+- Add safer URL parsing fallback behaviour.
+
+Status: completed with callback-cookie parity support and redacted diagnostics.
+
+### Slice P1.1 (started)
+
+- Add defensive null and redirect handling in representation SSR loader path.
+
+Status: expanded to new appeal, myportal appeal, and representation loader guard hardening.
+
+### Slice P3.1 (started)
+
+- Add in-memory XML read cache for form XML to reduce repeated disk read/normalization cost.
+
+Status: completed.
+
+## Immediate slices status (updated)
+
+1. Add defensive wrappers for external dependency failures in new-appeal/myportal/representation SSR loaders (fallback redirects + safe defaults).
+    - Status: completed.
+2. Expand focused tests around loader negative paths (missing query/session/cookie/search result branches).
+    - Status: completed with dedicated phase22 suites for newappeal, myportal, and representation loaders.
+3. Add lightweight diagnostics for SSR loader dependency failures (redacted, non-sensitive).
+    - Status: completed.
+4. Reduce remaining low-value commented legacy blocks in active flow files where behaviour is already covered by tests.
+    - Status: completed for active myportal case-ticket page path.
+
+## Next recommended Phase 1 closure slices
+
+1. Add targeted loader-dependency-failure tests (thrown service errors -> safe redirect) for newappeal/myportal/representation loaders.
+    - Status: in progress (newappeal + myportal dependency-failure tests added; representation search-miss redirect coverage added).
+2. Perform a focused pass on remaining active flow files for stale commented code/debug remnants and remove where behaviour is covered.
+    - Status: in progress (myportal case-ticket path completed; further active-flow pass still open).
+3. Refresh current-platform-state/auth-session-reliability notes with latest implemented slices and residual risks.
+    - Status: not started.