robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: remove obsolete CRM password update functionality

Browse Source
This commit is contained in:
robbond
2026-11-06 09:14:54 +00:00
parent e1f8fb5c96
commit f7479b72b9
9 changed files with 0 additions and 486 deletions
Download Patch File Download Diff File Expand all files Collapse all files
actions/services/accountDirectService.js
-14
View File
@@ -22,20 +22,6 @@ export const getLogin = (emailAddress, pwd) => {
});
};
export const updatePassword = (contactId, newpassword) => {
var queryUrl = "/api/endpoint/updateaccount_api?contactId=" + contactId;
var data = { "pinswg_custom_password": newpassword };
var config = {
method: "post",
url: queryUrl,
data: data
};
return requestJson(config).catch((error) => {
consoleLogger(error);
});
};
export const updateAccount = async (contactId, updateBody, ssr) => {
var queryUrl =
(ssr ? BASE_URL : "") +
actions/services/accountService.js
-2
View File
@@ -1,7 +1,6 @@
import {
getPersonalAccount,
getLogin,
updatePassword,
updateAccount,
createAccount,
getEmailAccountCheck,
@@ -13,7 +12,6 @@ import {
export {
getPersonalAccount,
getLogin,
updatePassword,
updateAccount,
createAccount,
getEmailAccountCheck,
components/account/changepassword.js
-184
View File
@@ -1,184 +0,0 @@
import useTranslation from "next-translate/useTranslation";
import Link from "next/link";
import { useRouter } from "next/router";
import React, { useState } from "react";
import { connect } from "react-redux";
import { Field, formValueSelector, reduxForm } from "redux-form";
import { updatePassword } from "../../actions/services/accountService";
const RenderTextfield = ({
id,
className,
rows,
datafieldname,
name,
label,
input,
type,
errorMsg,
meta: { touched, error },
...custom
}) => {
return (
<>
<div
className={
touched && error
? "govuk-form-group govuk-form-group--error"
: "govuk-form-group "
}
>
<label className="govuk-label " htmlFor={id} id={id + "_label"}>
{label}
</label>
{touched && error && (
<span id={id + "-error"} className="govuk-error-message">
<span className="govuk-visually-hidden">Error:</span>{" "}
{touched &&
((error && (
<span>{errorMsg ? errorMsg : error}</span>
)) ||
(warning && <span>{warning}</span>))}
</span>
)}
<input
{...input}
className={className}
name={name}
id={id}
type={type}
/>
</div>
</>
);
};
const ChangePassword = (props) => {
const {
footerLinks,
pages,
handleSubmit,
value,
setPasswordUpdated,
passwordUpdated
} = props;
let { t, lang } = useTranslation();
const router = useRouter();
const { locale } = router;
let errorsobj = {};
const onHandleSubmit = (values) => {
let contactid = props.props.accountDetails.loggedinUserId;
let updateBody = props.props.form.changepasswordForm.values.newpassword;
console.log(contactid, updateBody);
updatePassword(contactid, updateBody);
setPasswordUpdated(true);
};
const required = (value) => (value ? undefined : "Is required");
const passwordsMustMatch = (value, allValues) =>
value !== allValues.newpassword ? "Passwords do not match" : undefined;
const minLength = (min) => (value) =>
value && value.length < min
? `Must be at least ${min} characters`
: undefined;
const [hasErrors, setHasErrors] = useState("");
return (
<>
{passwordUpdated != true ? (
<form onSubmit={handleSubmit(onHandleSubmit)}>
<fieldset className="govuk-fieldset">
<Field
name="newpassword"
id="newpassword"
component={RenderTextfield}
type="password"
className="govuk-input govuk-input--width-20"
validate={[required, minLength(6)]}
label="New password"
/>
<Field
name="confirmpassword"
id="confirmpassword"
component={RenderTextfield}
type="password"
className="govuk-input govuk-input--width-20"
validate={[required, passwordsMustMatch]}
label="Confirm new password"
/>
</fieldset>
<div className="govuk-button-group">
<button
type="submit"
className="govuk-button"
data-module="govuk-button"
>
Continue
</button>
<Link
href={
"/myportal?q=" +
props.accountDetails.loggedinUserId
}
className="govuk-link"
>
Cancel
</Link>
</div>
</form>
) : (
<>
<p className="govuk-body">
<Link
href={
"/myportal?q=" +
props.accountDetails.loggedinUserId
}
className="govuk-link"
>
Go to My Portal
</Link>
</p>
</>
)}
</>
);
};
const mapStateToProps = (state) => {
return {
search: state.search,
searchResultsObj: state.searchResultsObj,
formData: state.formData,
appealType: state.appealType,
accountDetails: state.accountDetails
//form: state.form,
};
};
const mapDispatchToProps = (dispatch) => {
return {
setCurrentSection: (currentSection) => {
dispatch(setCurrentSection(currentSection));
}
};
};
const selector = formValueSelector("changepasswordForm"); // <-- same as form name
export default connect(
mapStateToProps,
mapDispatchToProps
)(
reduxForm({
form: "changepasswordForm",
destroyOnUnmount: false
})(ChangePassword)
);
components/myportal/youraccount.js
-18
View File
@@ -27,24 +27,6 @@ export default function YourAccount() {
</Link>
</div>
</div>
{/* <div className="card-body">
<h3 className="heading-small card-heading">
{t("myportal:changepassword-card-title")}
</h3>
<p className="govuk-body-s">
{" "}
{t("myportal:changepassword-card-paragraph-one")}
</p>
<div>
<Link href="/account/changepassword">
<a className="govuk-button-secondary">
{t("myportal:changepassword-card-link")}
</a>
</Link>
</div>
</div> */}
</div>
</>
);
lib/routing/breadcrumbRendererFactories.js
-9
View File
@@ -472,15 +472,6 @@ export const createDetailAndAccountRouteRenderers = ({
{t("account:account-title")}
</li>
</>
),
"/account/changepassword": () => (
<>
{renderLinkCrumb(cyMyPortalHref, t("common:breadcrumb-my-portal"))}
<li className="govuk-breadcrumbs__list-item">
Update your password
</li>
</>
)
});
pages/account/changepassword.js
-120
View File
@@ -1,120 +0,0 @@
import Link from "next/link";
import _ from "lodash";
import Head from "next/head";
import Header from "../../components/header";
import Banner from "../../components/banner";
import CookieBanner from "../../components/cookieBanner";
import Breadcrumbs from "../../components/breadcrumbs";
import Footer from "../../components/footer";
import { useSelector, shallowEqual, connect } from "react-redux";
import { wrapper } from "../../store/store";
import { useRouter } from "next/router";
import { useState } from "react";
import useTranslation from "next-translate/useTranslation";
import { JSONPath as jsonpath } from "jsonpath-plus";
import { reduxForm, formValueSelector } from "redux-form";
import ChangePassword from "../../components/account/changepassword";
import xpath from "xpath";
import {
setAppealType,
setAppealTypeTitle,
setAppealTypeID,
setAppealLPA,
getAppealTypeObj
} from "../../store/appealType/action";
import {
getAppealsTypes,
getLPA
} from "../../actions/services/referenceDataService";
import { setLPA } from "../../store/lpa/action";
import { getSession, useSession } from "next-auth/react";
import NoSessionWarning from "../../components/nosession";
const Home = (props) => {
const { footerLinks, pages, formData } = props;
let { t, lang } = useTranslation();
const router = useRouter();
const { locale } = router;
const { appealtypes } = router.query;
const { appealType, LPAData } = props;
const [passwordUpdated, setPasswordUpdated] = useState(false);
const { data: session, status } = useSession();
if (status === "loading") {
return <NoSessionWarning loading={true} />;
}
if (status === "unauthenticated") {
router.push("/auth/signin");
return <NoSessionWarning />;
}
return (
<div>
<Head>
<title>
{t("search:page-title")} - {t("common:service-name")}
</title>
</Head>
<div id="page_wrapper">
<CookieBanner />
<Header />
<div className="govuk-grid-row">
<div className="govuk-grid-column-full">
<div className="govuk-width-container">
<Breadcrumbs slug={appealtypes} props={props} />
<main
className="govuk-main-wrapper--auto-spacing"
id="main-content"
role="main"
>
<div className="govuk-grid-row">
<div className="govuk-grid-column-two-thirds">
{passwordUpdated == true ? (
<h1>
Your password has been changed
</h1>
) : (
<h1>Change password</h1>
)}
<ChangePassword
props={props}
setPasswordUpdated={
setPasswordUpdated
}
passwordUpdated={passwordUpdated}
/>
</div>
</div>
</main>
</div>
</div>
</div>
<Footer footerLinks={footerLinks} ticketnumber={props} />
</div>
</div>
);
};
const mapStateToProps = (state) => {
return {
search: state.search,
searchResultsObj: state.searchResultsObj,
formData: state.formData,
appealType: state.appealType,
LPAData: state.LPAData,
form: state.form,
accountDetails: state.accountDetails
};
};
export default connect(mapStateToProps)(Home);
pages/api/endpoint/updatepassword_api.js
-71
View File
@@ -1,71 +0,0 @@
/**
* @swagger
* /api/endpoint/updatepassword_api:
* patch:
* tags: [Account]
* description: Update password
* summary: Phase 2
* responses:
* 200:
* description: Success
*/
import axios from "axios";
import { consoleLogger } from "../../../actions/core/logger";
import { getToken } from "../../../actions/core/token";
import { hashAPIPath } from "../../../actions/core/hash";
import { respondError, respondSuccess } from "../middleware/apiResponse";
const WEBAPI_URL =
process.env.RELAY_ROOT ||
"https://dev-pedw-ns.servicebus.windows.net/dev-pedw-hc/";
export default async function ApiProxy(req, res) {
const contactId = req.query.contactId;
if (typeof contactId !== "string" || contactId.trim().length === 0) {
return respondError(res, {
status: 400,
code: "CONTACT_ID_REQUIRED",
message: "contactId is required"
});
}
if (!req.body || Object.keys(req.body).length === 0) {
return respondError(res, {
status: 400,
code: "PASSWORD_UPDATE_PAYLOAD_REQUIRED",
message: "Password update payload is required"
});
}
try {
const token = await getToken();
const data = JSON.stringify(req.body);
const queryUrl = "contacts(" + contactId + ")";
const config = {
method: "patch",
url: WEBAPI_URL + queryUrl + hashAPIPath(queryUrl),
headers: {
"OData-MaxVersion": "4.0",
"OData-Version": "4.0",
Accept: "application/json",
Prefer: 'odata.include-annotations="*",return=representation',
Authorization: "Bearer " + token.access_token,
"Content-Type": "application/json"
},
data
};
const response = await axios(config);
return respondSuccess(res, response.data);
} catch (error) {
consoleLogger(error);
return respondError(res, {
status: 400,
code: "PASSWORD_UPDATE_FAILED",
message: "Failed to update password"
});
}
}
tests/phase21/endpoint-handler-contract.test.cjs
-62
View File
@@ -982,68 +982,6 @@ test("updateaccount catch path returns ACCOUNT_UPDATE_FAILED", async () => {
assert.strictEqual(res.state.jsonBody.error.code, "ACCOUNT_UPDATE_FAILED");
});
test("updatepassword returns CONTACT_ID_REQUIRED when contactId missing", async () => {
const mod = loadModule("pages/api/endpoint/updatepassword_api.js", {
respondError: respondErrorMock,
respondSuccess: respondSuccessMock,
getToken: async () => ({ access_token: "token" }),
hashAPIPath: () => "&hash=expected",
axios: async () => ({ data: { contactid: "c1" } }),
consoleLogger: () => {}
});
const req = { query: {}, body: { pinswg_password: "abc" } };
const res = createRes();
await mod.default(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(res.state.jsonBody.error.code, "CONTACT_ID_REQUIRED");
});
test("updatepassword returns PASSWORD_UPDATE_PAYLOAD_REQUIRED when body missing", async () => {
const mod = loadModule("pages/api/endpoint/updatepassword_api.js", {
respondError: respondErrorMock,
respondSuccess: respondSuccessMock,
getToken: async () => ({ access_token: "token" }),
hashAPIPath: () => "&hash=expected",
axios: async () => ({ data: { contactid: "c1" } }),
consoleLogger: () => {}
});
const req = { query: { contactId: "c1" }, body: undefined };
const res = createRes();
await mod.default(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(
res.state.jsonBody.error.code,
"PASSWORD_UPDATE_PAYLOAD_REQUIRED"
);
});
test("updatepassword catch path returns PASSWORD_UPDATE_FAILED", async () => {
const mod = loadModule("pages/api/endpoint/updatepassword_api.js", {
respondError: respondErrorMock,
respondSuccess: respondSuccessMock,
getToken: async () => ({ access_token: "token" }),
hashAPIPath: () => "&hash=expected",
axios: async () => {
throw new Error("relay failed");
},
consoleLogger: () => {}
});
const req = {
query: { contactId: "c1" },
body: { pinswg_password: "abc" }
};
const res = createRes();
await mod.default(req, res);
assert.strictEqual(res.state.statusCode, 400);
assert.strictEqual(res.state.jsonBody.error.code, "PASSWORD_UPDATE_FAILED");
});
test("getbasicsearch returns SEARCH_STRING_REQUIRED when searchString missing", async () => {
const mod = loadModule("pages/api/endpoint/getbasicsearch_api.js", {
respondError: respondErrorMock,
tests/phase22/breadcrumbs-route-map-structure.test.cjs
-6
View File
@@ -203,12 +203,6 @@ test("breadcrumbs/factory module includes expected mapped route definitions", as
true,
"Expected /account/personaldetails to be mapped in createDetailAndAccountRouteRenderers"
);
assert.strictEqual(
source.includes('"/account/changepassword": () =>'),
true,
"Expected /account/changepassword to be mapped in createDetailAndAccountRouteRenderers"
);
});
test("breadcrumbs/component composes mapped routes via imported factories and shared resolver", async () => {