robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merged PR 2315: Auth stabilistatiion and hardening

Browse Source 
Related work items: #23020
This commit is contained in:
Robert Bond
2026-05-14 08:55:49 +00:00
parent d295a507ac
commit d0b2fd077a
41 changed files with 1462 additions and 418 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/auth/sessionClient.js
+47
View File
@@ -0,0 +1,47 @@
import { destroyCookie } from "nookies";
import { signOut } from "next-auth/react";
const AUTH_COOKIE_CANDIDATES = [
"next-auth.csrf-token",
"next-auth.callback-url",
"__Secure-next-auth.callback-url",
"pedw_locale",
"pinsUser"
];
export const buildSignedOutCallbackUrl = (locale) =>
locale === "cy" ? "/cy/allgofnodi" : "/logout";
const resolveSignOutArgs = (args) => {
if (typeof args === "string") {
return {
locale: args,
callbackUrl: undefined,
signOutFn: signOut
};
}
return {
locale: args?.locale,
callbackUrl: args?.callbackUrl,
signOutFn: args?.signOutFn || signOut
};
};
export const clearSessionArtifacts = () => {
if (typeof window !== "undefined") {
window.localStorage.clear();
}
AUTH_COOKIE_CANDIDATES.forEach((cookieName) => {
destroyCookie(null, cookieName, { path: "/" });
});
};
export const performPortalSignOut = async (args) => {
const { locale, callbackUrl, signOutFn } = resolveSignOutArgs(args);
clearSessionArtifacts();
return signOutFn({
callbackUrl: callbackUrl || buildSignedOutCallbackUrl(locale)
});
};
lib/forms/readFormXml.js
+10
View File
@@ -2,6 +2,8 @@
import fs from "fs";
import path from "path";
const xmlCache = new Map();
/**
* Reads /data/formsxml/{appealtypes}.xml and normalises it.
* Returns { xmlStr } or throws on missing file.
@@ -12,6 +14,12 @@ export function readFormXml(appealtypes) {
const configDirectory = path.resolve(process.cwd(), "data/formsxml");
const filePath = path.join(configDirectory, `${appealtypes}.xml`);
const cacheKey = filePath;
const cached = xmlCache.get(cacheKey);
if (cached) {
return { xmlStr: cached, filePath, fromCache: true };
}
let xmlStr = fs.readFileSync(filePath, "utf8");
// Keep existing normalisation behaviour
@@ -20,5 +28,7 @@ export function readFormXml(appealtypes) {
xmlStr = xmlStr.replace(/> <"/g, "><");
xmlStr = xmlStr.toString();
xmlCache.set(cacheKey, xmlStr);
return { xmlStr, filePath };
}
lib/myportal/loadMyPortalAppealPage.js
+84 -12
View File
@@ -11,7 +11,7 @@ import {
getProgressFromBlob
} from "../../actions/services/documentService";
import { getPersonalAccount } from "../../actions/services/accountService";
import { getIP } from "../../actions/core/logger";
import { consoleLogger, getIP } from "../../actions/core/logger";
import { readFormXml } from "../forms/readFormXml";
import { requireQueryParams } from "../routing/requireQueryParams";
@@ -32,11 +32,27 @@ export async function loadMyPortalAppealPage(ctx) {
"casereference"
]);
if (!required.ok) {
consoleLogger({
name: "MyPortalAppealLoaderMissingQuery",
message:
"loadMyPortalAppealPage missing required query params; redirecting",
hasAppealType: !!query?.appealtypes,
hasAppealTypeId: !!query?.apt,
hasCaseReference: !!query?.casereference
});
return { redirect: required.redirect };
}
const session = await getSession(ctx);
if (!session) {
if (!session || !session?.user?.id || !session?.user?.email) {
consoleLogger({
name: "MyPortalAppealLoaderMissingSession",
message:
"loadMyPortalAppealPage missing session identity; redirecting to signin",
hasSession: !!session,
hasUserId: !!session?.user?.id,
hasUserEmail: !!session?.user?.email
});
return {
redirect: {
destination: "/auth/signin",
@@ -50,21 +66,60 @@ export async function loadMyPortalAppealPage(ctx) {
const loggedInUserIdent = session.user.id;
const loggedInUserEmail = session.user.email;
const accountDetails = await getPersonalAccount(loggedInUser);
if (!loggedInUser) {
consoleLogger({
name: "MyPortalAppealLoaderMissingPinsUserCookie",
message:
"loadMyPortalAppealPage missing pinsUser cookie; redirecting to signin"
});
return {
redirect: {
destination: "/auth/signin",
permanent: false
}
};
}
// Fetch config + blob assets in parallel
const [appealTypeData, mandatoryFieldsData, pickListData, blobList] =
await Promise.all([
let appealTypeData;
let mandatoryFieldsData;
let pickListData;
let blobList;
let blobProgress;
let accountDetails;
try {
[
appealTypeData,
mandatoryFieldsData,
pickListData,
blobList,
blobProgress,
accountDetails
] = await Promise.all([
getAppealsTypesForNewAppeal(),
getMandatoryFields(query.appealtypes),
getPickLists(query.appealtypes),
getFilesFromBlob(loggedInUserIdent, query.casereference)
getFilesFromBlob(loggedInUserIdent, query.casereference),
getProgressFromBlob(loggedInUserIdent, query.casereference),
getPersonalAccount(loggedInUser)
]);
const blobProgress = await getProgressFromBlob(
loggedInUserIdent,
query.casereference
);
} catch (_error) {
consoleLogger({
name: "MyPortalAppealLoaderDependencyFailure",
message:
"loadMyPortalAppealPage dependency fetch failed; redirecting to /myportal",
appealType: query?.appealtypes,
hasCaseReference: !!query?.casereference,
error: _error?.message
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
// Optional: awaiting-submission view setup when query.key exists
let awaitingSubmissionFromBlob = null;
@@ -74,7 +129,24 @@ export async function loadMyPortalAppealPage(ctx) {
);
}
const { xmlStr } = readFormXml(query.appealtypes);
let xmlStr = "";
try {
xmlStr = readFormXml(query.appealtypes).xmlStr;
} catch (_error) {
consoleLogger({
name: "MyPortalAppealLoaderXmlReadFailure",
message:
"loadMyPortalAppealPage XML read failed; redirecting to /myportal",
appealType: query?.appealtypes,
error: _error?.message
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
return {
session,
lib/newappeal/fileListHelpers.js
+1 -1
View File
@@ -1,5 +1,5 @@
export const mergeWithExistingFilesList = (buildAppealFilesArray, values) => {
return values.hasOwnProperty("filesList")
return Object.prototype.hasOwnProperty.call(values, "filesList")
? (buildAppealFilesArray.concat(values.filesList),
buildAppealFilesArray.filter(function (item, idx) {
return item.name;
lib/newappeal/loadNewAppealPage.js
+89 -8
View File
@@ -7,7 +7,7 @@ import {
} from "../../actions/services/referenceDataService";
import { getProgressFromBlob } from "../../actions/services/documentService";
import { getPersonalAccount } from "../../actions/services/accountService";
import { getIP } from "../../actions/core/logger";
import { consoleLogger, getIP } from "../../actions/core/logger";
import { readFormXml } from "../forms/readFormXml";
import { requireQueryParams } from "../routing/requireQueryParams";
@@ -29,6 +29,28 @@ export async function loadNewAppealPage(ctx) {
const session = await getSession(ctx);
if (!session) {
consoleLogger({
name: "NewAppealLoaderAuthGuard",
reasonCode: "NO_SESSION",
message: "loadNewAppealPage missing session; redirecting to signin"
});
return {
redirect: {
destination: "/auth/signin",
permanent: false
}
};
}
if (!session?.user?.id || !session?.user?.email) {
consoleLogger({
name: "NewAppealLoaderAuthGuard",
reasonCode: "NO_SESSION_USER",
message:
"loadNewAppealPage missing session user identity; redirecting to signin",
hasSessionUserId: !!session?.user?.id,
hasSessionUserEmail: !!session?.user?.email
});
return {
redirect: {
destination: "/auth/signin",
@@ -42,17 +64,76 @@ export async function loadNewAppealPage(ctx) {
const loggedInUserIdent = session.user.id;
const loggedInUserEmail = session.user.email;
const [appealTypeData, mandatoryFieldsData, pickListData] =
await Promise.all([
if (!loggedInUser) {
consoleLogger({
name: "NewAppealLoaderAuthGuard",
reasonCode: "NO_PINSUSER_COOKIE",
message:
"loadNewAppealPage missing pinsUser cookie identity; redirecting to signin"
});
return {
redirect: {
destination: "/auth/signin",
permanent: false
}
};
}
let appealTypeData;
let mandatoryFieldsData;
let pickListData;
let blobProgress;
let accountDetails;
try {
[
appealTypeData,
mandatoryFieldsData,
pickListData,
blobProgress,
accountDetails
] = await Promise.all([
getAppealsTypesForNewAppeal(),
getMandatoryFields(query.appealtypes),
getPickLists(query.appealtypes)
getPickLists(query.appealtypes),
getProgressFromBlob(loggedInUserIdent, query.id),
getPersonalAccount(loggedInUser)
]);
} catch (_error) {
consoleLogger({
name: "NewAppealLoaderDependencyFailure",
message:
"loadNewAppealPage dependency fetch failed; redirecting to /myportal",
appealType: query?.appealtypes,
hasCaseId: !!query?.id,
error: _error?.message
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
const blobProgress = await getProgressFromBlob(loggedInUserIdent, query.id);
const accountDetails = await getPersonalAccount(loggedInUser);
const { xmlStr } = readFormXml(query.appealtypes);
let xmlStr = "";
try {
xmlStr = readFormXml(query.appealtypes).xmlStr;
} catch (_error) {
consoleLogger({
name: "NewAppealLoaderXmlReadFailure",
message:
"loadNewAppealPage XML read failed; redirecting to /myportal",
appealType: query?.appealtypes,
error: _error?.message
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
return {
session,
lib/representation/pageLoaders.js
+121 -45
View File
@@ -9,6 +9,7 @@ import {
} from "../../actions/services/caseService";
import { getRepsFromBlob } from "../../actions/services/documentService";
import { getBasicSearch } from "../../actions/services/searchService";
import { consoleLogger } from "../../actions/core/logger";
import {
getFormCollectionByID,
getSearchDetails
@@ -41,7 +42,7 @@ const getDetails = (resultsObj, detailsType) => {
detailsType == "mySubmittedReps" ? resultsObj : resultsObj.value;
if (detailsType == "myRepresentations") {
const repsObj = resultsObj.map((searchDetail, index) => {
resultsObj.map((searchDetail) => {
detailsArr.push(
getCase(searchDetail["incidentID"]).then((data) => {
let caseID = "";
@@ -75,19 +76,21 @@ const getDetails = (resultsObj, detailsType) => {
}
let detArr = Promise.all(detailsArr);
console.log(detArr);
return detArr;
};
export const loadRepresentationBootstrap = async ({ ctx }) => {
const { query } = ctx;
console.log("The query", query);
let thisSession = await getSession(ctx);
let loggedInUser = {};
let loggedInUser = null;
if (!thisSession) {
console.log("not has sesssion.......");
consoleLogger({
name: "RepresentationLoaderMissingSession",
message:
"loadRepresentationBootstrap missing session; redirecting to signin"
});
return {
redirect: {
destination: "/auth/signin",
@@ -95,22 +98,28 @@ export const loadRepresentationBootstrap = async ({ ctx }) => {
}
};
} else {
[loggedInUser] = await Promise.all([
await getPortalLogin(thisSession.user.email)
]);
loggedInUser = await getPortalLogin(thisSession.user.email);
loggedInUser = loggedInUser?.value?.[0]?.contactid || null;
}
console.log(
"=====//////////=====",
thisSession,
thisSession.user.email,
loggedInUser
);
loggedInUser = loggedInUser.value[0].contactid;
if (!loggedInUser) {
consoleLogger({
name: "RepresentationLoaderMissingContact",
message:
"loadRepresentationBootstrap missing CRM contact id; redirecting to signin",
hasSessionEmail: !!thisSession?.user?.email
});
return {
redirect: {
destination: "/auth/signin",
permanent: false
}
};
}
const [accountDetails, myRepresentations] = await Promise.all([
await getPersonalAccount(loggedInUser),
await getRepsFromBlob(thisSession.user.id)
getPersonalAccount(loggedInUser),
getRepsFromBlob(thisSession.user.id)
]);
const myRepresentationsDetails = await getDetails(
@@ -118,10 +127,8 @@ export const loadRepresentationBootstrap = async ({ ctx }) => {
"myRepresentations"
);
console.log(accountDetails);
const isLPA =
accountDetails[
accountDetails?.[
"pinswg_typeofinvolvement@OData.Community.Display.V1.FormattedValue"
] == "LPA"
? true
@@ -148,9 +155,22 @@ export const loadExistingRepresentation = async ({ store, ctx, bootstrap }) => {
isLPA
} = bootstrap;
console.log("is lpa?:", isLPA);
const searchResultsObj = await getBasicSearch(query.case);
if (!searchResultsObj?.value?.[0]) {
consoleLogger({
name: "RepresentationExistingMissingSearchResult",
message:
"loadExistingRepresentation missing search result; redirecting to myportal",
hasCaseQuery: !!query?.case
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
const searchDetailsObj = await getSearchDetails(searchResultsObj);
store.dispatch(setSearchResults(searchResultsObj));
@@ -164,11 +184,26 @@ export const loadExistingRepresentation = async ({ store, ctx, bootstrap }) => {
}
const result = findObjectByKeyValue(
myRepresentations.value,
myRepresentations?.value || [],
"repfile_name",
query.created
);
if (!result) {
consoleLogger({
name: "RepresentationExistingMissingBlobEntry",
message:
"loadExistingRepresentation missing representation blob entry; redirecting to myportal",
hasCreatedQuery: !!query?.created
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
store.dispatch(
setCurrentReference({
"ticketnumber":
@@ -206,6 +241,21 @@ export const loadNewRepresentation = async ({ store, ctx, bootstrap }) => {
const { thisSession, accountDetails } = bootstrap;
const searchResultsObj = await getBasicSearch(query.case);
if (!searchResultsObj?.value?.[0]) {
consoleLogger({
name: "RepresentationNewMissingSearchResult",
message:
"loadNewRepresentation missing search result; redirecting to myportal",
hasCaseQuery: !!query?.case
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
const searchDetailsObj = await getSearchDetails(searchResultsObj);
store.dispatch(setContainerID(thisSession.user.id));
@@ -219,31 +269,26 @@ export const loadNewRepresentation = async ({ store, ctx, bootstrap }) => {
})
);
console.log(
accountDetails,
"===================== is nrw",
accountDetails.emailaddress1.includes(process.env.NRWDOMAIN),
"===================== "
);
store.dispatch(
setCurrentReference({
"isNRW":
accountDetails.emailaddress1.includes(process.env.NRWDOMAIN) ||
false,
"ticketnumber": searchResultsObj.value[0].ticketnumber,
"currentReference": searchResultsObj.value[0].title,
accountDetails?.emailaddress1?.includes(
process.env.NRWDOMAIN
) || false,
"ticketnumber": searchResultsObj?.value?.[0]?.ticketnumber,
"currentReference": searchResultsObj?.value?.[0]?.title,
"currentType": "myRepresentations",
"incidentid": searchResultsObj.value[0].incidentid,
"appealType": searchResultsObj.value[0].pinswg_appealcasetype,
"incidentid": searchResultsObj?.value?.[0]?.incidentid,
"appealType": searchResultsObj?.value?.[0]?.pinswg_appealcasetype,
"specialistProcess":
searchDetailsObj[0].value[0].pinswg_speacialistcaseprocess !=
null ||
searchDetailsObj[0].value[0].pinswg_specialistcaseprocess !=
null
? searchDetailsObj[0].value[0]
searchDetailsObj?.[0]?.value?.[0]
?.pinswg_speacialistcaseprocess != null ||
searchDetailsObj?.[0]?.value?.[0]
?.pinswg_specialistcaseprocess != null
? searchDetailsObj?.[0]?.value?.[0]
.pinswg_speacialistcaseprocess ||
searchDetailsObj[0].value[0].pinswg_specialistcaseprocess
searchDetailsObj?.[0]?.value?.[0]
.pinswg_specialistcaseprocess
: ""
})
);
@@ -259,15 +304,46 @@ export const loadNewRepresentation = async ({ store, ctx, bootstrap }) => {
};
export const loadRepresentationPage = async ({ store, ctx }) => {
const { query } = ctx;
if (!query?.case) {
consoleLogger({
name: "RepresentationLoaderMissingCaseQuery",
message:
"loadRepresentationPage missing case query; redirecting to myportal"
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
if (
Object.prototype.hasOwnProperty.call(query, "state") &&
!query?.created
) {
consoleLogger({
name: "RepresentationLoaderMissingCreatedQuery",
message:
"loadRepresentationPage missing created query for state flow; redirecting to myportal"
});
return {
redirect: {
destination: "/myportal",
permanent: false
}
};
}
const bootstrap = await loadRepresentationBootstrap({ ctx });
if (bootstrap?.redirect) {
return bootstrap;
}
const { query } = ctx;
if (query.hasOwnProperty("state")) {
if (Object.prototype.hasOwnProperty.call(query, "state")) {
return loadExistingRepresentation({ store, ctx, bootstrap });
}