Merged PR 2315: Auth stabilistatiion and hardening

Related work items: #23020

lib/myportal/loadMyPortalAppealPage.js

@@ -11,7 +11,7 @@ import {
     getProgressFromBlob
 } from "../../actions/services/documentService";
 import { getPersonalAccount } from "../../actions/services/accountService";
-import { getIP } from "../../actions/core/logger";
+import { consoleLogger, getIP } from "../../actions/core/logger";
 
 import { readFormXml } from "../forms/readFormXml";
 import { requireQueryParams } from "../routing/requireQueryParams";
@@ -32,11 +32,27 @@ export async function loadMyPortalAppealPage(ctx) {
         "casereference"
     ]);
     if (!required.ok) {
+        consoleLogger({
+            name: "MyPortalAppealLoaderMissingQuery",
+            message:
+                "loadMyPortalAppealPage missing required query params; redirecting",
+            hasAppealType: !!query?.appealtypes,
+            hasAppealTypeId: !!query?.apt,
+            hasCaseReference: !!query?.casereference
+        });
         return { redirect: required.redirect };
     }
 
     const session = await getSession(ctx);
-    if (!session) {
+    if (!session || !session?.user?.id || !session?.user?.email) {
+        consoleLogger({
+            name: "MyPortalAppealLoaderMissingSession",
+            message:
+                "loadMyPortalAppealPage missing session identity; redirecting to signin",
+            hasSession: !!session,
+            hasUserId: !!session?.user?.id,
+            hasUserEmail: !!session?.user?.email
+        });
         return {
             redirect: {
                 destination: "/auth/signin",
@@ -50,21 +66,60 @@ export async function loadMyPortalAppealPage(ctx) {
     const loggedInUserIdent = session.user.id;
     const loggedInUserEmail = session.user.email;
 
-    const accountDetails = await getPersonalAccount(loggedInUser);
+    if (!loggedInUser) {
+        consoleLogger({
+            name: "MyPortalAppealLoaderMissingPinsUserCookie",
+            message:
+                "loadMyPortalAppealPage missing pinsUser cookie; redirecting to signin"
+        });
+        return {
+            redirect: {
+                destination: "/auth/signin",
+                permanent: false
+            }
+        };
+    }
 
     // Fetch config + blob assets in parallel
-    const [appealTypeData, mandatoryFieldsData, pickListData, blobList] =
-        await Promise.all([
+    let appealTypeData;
+    let mandatoryFieldsData;
+    let pickListData;
+    let blobList;
+    let blobProgress;
+    let accountDetails;
+
+    try {
+        [
+            appealTypeData,
+            mandatoryFieldsData,
+            pickListData,
+            blobList,
+            blobProgress,
+            accountDetails
+        ] = await Promise.all([
             getAppealsTypesForNewAppeal(),
             getMandatoryFields(query.appealtypes),
             getPickLists(query.appealtypes),
-            getFilesFromBlob(loggedInUserIdent, query.casereference)
+            getFilesFromBlob(loggedInUserIdent, query.casereference),
+            getProgressFromBlob(loggedInUserIdent, query.casereference),
+            getPersonalAccount(loggedInUser)
         ]);
-
-    const blobProgress = await getProgressFromBlob(
-        loggedInUserIdent,
-        query.casereference
-    );
+    } catch (_error) {
+        consoleLogger({
+            name: "MyPortalAppealLoaderDependencyFailure",
+            message:
+                "loadMyPortalAppealPage dependency fetch failed; redirecting to /myportal",
+            appealType: query?.appealtypes,
+            hasCaseReference: !!query?.casereference,
+            error: _error?.message
+        });
+        return {
+            redirect: {
+                destination: "/myportal",
+                permanent: false
+            }
+        };
+    }
 
     // Optional: awaiting-submission view setup when query.key exists
     let awaitingSubmissionFromBlob = null;
@@ -74,7 +129,24 @@ export async function loadMyPortalAppealPage(ctx) {
         );
     }
 
-    const { xmlStr } = readFormXml(query.appealtypes);
+    let xmlStr = "";
+    try {
+        xmlStr = readFormXml(query.appealtypes).xmlStr;
+    } catch (_error) {
+        consoleLogger({
+            name: "MyPortalAppealLoaderXmlReadFailure",
+            message:
+                "loadMyPortalAppealPage XML read failed; redirecting to /myportal",
+            appealType: query?.appealtypes,
+            error: _error?.message
+        });
+        return {
+            redirect: {
+                destination: "/myportal",
+                permanent: false
+            }
+        };
+    }
 
     return {
         session,