robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: remove obsolete CRM login endpoint

Browse Source
This commit is contained in:
robbond
2026-11-06 09:22:29 +00:00
parent f7479b72b9
commit ddcef8f5ea
4 changed files with 0 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
actions/services/accountDirectService.js
-11
View File
@@ -11,17 +11,6 @@ export const getPersonalAccount = (contactid) => {
});
};
export const getLogin = (emailAddress, pwd) => {
return getJson(
"/api/endpoint/getlogin_api?emailAddress=" +
emailAddress +
"&pwd=" +
pwd
).catch((error) => {
consoleLogger(error);
});
};
export const updateAccount = async (contactId, updateBody, ssr) => {
var queryUrl =
(ssr ? BASE_URL : "") +
actions/services/accountService.js
-2
View File
@@ -1,6 +1,5 @@
import {
getPersonalAccount,
getLogin,
updateAccount,
createAccount,
getEmailAccountCheck,
@@ -11,7 +10,6 @@ import {
export {
getPersonalAccount,
getLogin,
updateAccount,
createAccount,
getEmailAccountCheck,
pages/api/endpoint/getlogin_api.js
-69
View File
@@ -1,69 +0,0 @@
/**
* @swagger
* /api/endpoint/getlogin_api:
* get:
* tags: [Login]
* description: Returns the hello world
* summary: Phase 2
* parameters:
* - name: emailaddress
* in: query
* required: true
* schema:
* type: string
* - name: pwd
* in: query
* required: true
* schema:
* type: string
* responses:
* 200:
* description: hello world
*/
import { azureHeadersPaged } from "../../../actions/core/headers";
import { respondError } from "../middleware/apiResponse";
import { relayGet } from "../middleware/relayForwarding";
import { RELAY_POLICY_STRICT_LOGIN } from "../middleware/relayPolicyPresets";
export default async function ApiProxy(req, res) {
const emailAddress = req.query.emailAddress;
const pwd = req.query.pwd;
if (typeof emailAddress !== "string" || emailAddress.trim().length === 0) {
return respondError(res, {
status: 400,
code: "EMAIL_ADDRESS_REQUIRED",
message: "emailAddress is required"
});
}
if (typeof pwd !== "string" || pwd.trim().length === 0) {
return respondError(res, {
status: 400,
code: "PASSWORD_REQUIRED",
message: "pwd is required"
});
}
const queryUrl =
"contacts?$filter=emailaddress1 eq '" +
emailAddress +
"' and pinswg_custom_password eq '" +
pwd +
"'&$count=true&$select=emailaddress1,contactid,pinswg_custom_password,yomifullname,firstname,lastname";
const relayPolicy = RELAY_POLICY_STRICT_LOGIN;
return relayGet({
queryUrl,
res,
requestOptionsBuilder: (accessToken) => azureHeadersPaged(accessToken),
relayPolicy,
errorResponse: {
status: 400,
code: "LOGIN_FETCH_FAILED",
message: "Failed to fetch login details"
}
});
}
tests/phase21/endpoint-handler-contract.test.cjs
-92
View File
@@ -231,98 +231,6 @@ test("getpreferredlanguage success returns existing data payload contract", asyn
});
});
test("getlogin returns EMAIL_ADDRESS_REQUIRED when emailAddress missing", async () => {
const mod = loadModule("pages/api/endpoint/getlogin_api.js", {
respondError: respondErrorMock,
respondSuccess: respondSuccessMock,
relayGet: async () => ({}),
getToken: async () => ({ access_token: "token" }),
hashAPIPath: () => "&hash=expected",
azureHeadersPaged: () => ({}),
axios: { get: async () => ({ data: { value: [] } }) },
consoleLogger: () => {}
});
const req = { query: { pwd: "abc123" } };
const res = createRes();
await mod.default(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(res.state.jsonBody.error.code, "EMAIL_ADDRESS_REQUIRED");
});
test("getlogin returns PASSWORD_REQUIRED when pwd missing", async () => {
const mod = loadModule("pages/api/endpoint/getlogin_api.js", {
respondError: respondErrorMock,
respondSuccess: respondSuccessMock,
relayGet: async () => ({}),
getToken: async () => ({ access_token: "token" }),
hashAPIPath: () => "&hash=expected",
azureHeadersPaged: () => ({}),
axios: { get: async () => ({ data: { value: [] } }) },
consoleLogger: () => {}
});
const req = { query: { emailAddress: "user@test.local" } };
const res = createRes();
await mod.default(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(res.state.jsonBody.error.code, "PASSWORD_REQUIRED");
});
test("getlogin catch path returns LOGIN_FETCH_FAILED", async () => {
const mod = loadModule("pages/api/endpoint/getlogin_api.js", {
respondError: respondErrorMock,
respondSuccess: respondSuccessMock,
relayGet: async ({ res, errorResponse }) =>
respondErrorMock(res, errorResponse),
getToken: async () => ({ access_token: "token" }),
hashAPIPath: () => "&hash=expected",
azureHeadersPaged: () => ({}),
axios: {
get: async () => {
throw new Error("relay failed");
}
},
consoleLogger: () => {}
});
const req = { query: { emailAddress: "user@test.local", pwd: "abc123" } };
const res = createRes();
await mod.default(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(res.state.jsonBody.error.code, "LOGIN_FETCH_FAILED");
});
test("getlogin passes strict relayPolicy overrides to relayGet", async () => {
let capturedRelayPolicy = null;
const mod = loadModule("pages/api/endpoint/getlogin_api.js", {
respondError: respondErrorMock,
respondSuccess: respondSuccessMock,
relayGet: async ({ relayPolicy, res }) => {
capturedRelayPolicy = relayPolicy;
return respondSuccessMock(res, { value: [] });
},
azureHeadersPaged: () => ({})
});
const req = { query: { emailAddress: "user@test.local", pwd: "abc123" } };
const res = createRes();
await mod.default(req, res);
assert.strictEqual(res.state.statusCode, 200);
assert.deepStrictEqual(JSON.parse(JSON.stringify(capturedRelayPolicy)), {
method: "GET",
timeoutMs: 5000,
maxRetries: 0,
retryBaseDelayMs: 0,
retryMaxDelayMs: 0
});
});
test("getportallogin returns HASH_REQUIRED when hash missing", async () => {
const mod = loadModule("pages/api/endpoint/getportallogin_api.js", {
respondError: respondErrorMock,