Merged PR 2315: Auth stabilistatiion and hardening

Related work items: #23020
2026-05-14 08:55:49 +00:00
parent d295a507ac
commit d0b2fd077a
41 changed files with 1462 additions and 418 deletions
@@ -0,0 +1,122 @@
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+const loadNewAppealLoader = (overrides = {}) => {
+    const filePath = path.join(
+        __dirname,
+        "..",
+        "..",
+        "lib",
+        "newappeal",
+        "loadNewAppealPage.js"
+    );
+
+    let source = fs.readFileSync(filePath, "utf8");
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(
+        /export\s+async\s+function\s+loadNewAppealPage/,
+        "async function loadNewAppealPage"
+    );
+    source += "\nmodule.exports = { loadNewAppealPage };\n";
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        getSession: async () => ({ user: { id: "u-1", email: "x@y.z" } }),
+        getAppealsTypesForNewAppeal: async () => ({}),
+        getMandatoryFields: async () => ({}),
+        getPickLists: async () => ({}),
+        getProgressFromBlob: async () => ({}),
+        getPersonalAccount: async () => ({}),
+        consoleLogger: () => {},
+        getIP: () => {},
+        readFormXml: () => ({ xmlStr: "<xml/>" }),
+        requireQueryParams: () => ({ ok: true }),
+        ...overrides
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+test("newappeal loader redirects to signin when session is missing", async () => {
+    const mod = loadNewAppealLoader({
+        getSession: async () => null
+    });
+
+    const result = await mod.loadNewAppealPage({
+        query: { appealtypes: "s78", apt: "1", id: "CASE-1" },
+        req: { cookies: { pinsUser: "contact-1" } }
+    });
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("newappeal loader redirects to signin when pinsUser cookie is missing", async () => {
+    const mod = loadNewAppealLoader();
+
+    const result = await mod.loadNewAppealPage({
+        query: { appealtypes: "s78", apt: "1", id: "CASE-1" },
+        req: { cookies: {} }
+    });
+
+    assert.strictEqual(result.redirect.destination, "/auth/signin");
+});
+
+test("newappeal loader returns query-param redirect when required query is missing", async () => {
+    const mod = loadNewAppealLoader({
+        requireQueryParams: () => ({
+            ok: false,
+            redirect: { destination: "/myportal", permanent: false }
+        })
+    });
+
+    const result = await mod.loadNewAppealPage({
+        query: {},
+        req: { cookies: { pinsUser: "contact-1" } }
+    });
+
+    assert.strictEqual(result.redirect.destination, "/myportal");
+});
+
+test("newappeal loader redirects to myportal when dependency fetch fails", async () => {
+    const mod = loadNewAppealLoader({
+        getMandatoryFields: async () => {
+            throw new Error("mandatory fields unavailable");
+        }
+    });
+
+    const result = await mod.loadNewAppealPage({
+        query: { appealtypes: "s78", apt: "1", id: "CASE-1" },
+        req: { cookies: { pinsUser: "contact-1" } }
+    });
+
+    assert.strictEqual(result.redirect.destination, "/myportal");
+});
+
+const run = async () => {
+    let passed = 0;
+
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+
+    console.log(
+        `Phase 22 newappeal-loader-guards tests passed (${passed}/${tests.length}).`
+    );
+};
+
+module.exports = run;
+
+if (require.main === module) {
+    run().catch((error) => {
+        console.error(error);
+        process.exit(1);
+    });
+}