robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,186 Commits 6 Branches 3 Tags
71de8a2d142e79656c00fb767685dbcb5ff88ad6
Commit Graph
175 Commits
Author SHA1 Message Date
robbond 71de8a2d14 refactor: extract server-side CRM contact update 2026-11-06 09:58:02 +00:00
robbond ddcef8f5ea security: remove obsolete CRM login endpoint 2026-11-06 09:22:29 +00:00
robbond f7479b72b9 security: remove obsolete CRM password update functionality 2026-11-06 09:14:54 +00:00
robbond e1f8fb5c96 Revert "security: enforce authenticated CRM contact ownership" 
This reverts commit e13700ab65.
 2026-11-06 06:42:16 +00:00
robbond e13700ab65 security: enforce authenticated CRM contact ownership 2026-11-06 06:36:53 +00:00
robbond a0a1331a97 fix(security): retire obsolete CRM representation deletion endpoint 2026-11-05 17:18:30 +00:00
robbond faf3aa3675 fix(security): enforce ownership on private draft case creation 2026-11-05 16:58:35 +00:00
robbond 9b0cb9adc8 fix(security): retire legacy direct CRM case creation endpoint 2026-11-05 16:37:10 +00:00
robbond 93bf7e174f fix(security): enforce ownership on private draft PDF generation 2026-11-05 14:11:45 +00:00
robbond 8b045ab781 fix(security): enforce ownership across appeal completion 2026-11-05 13:28:43 +00:00
robbond fc960f907f fix(security): enforce ownership on private draft blob deletion 2026-11-05 13:04:09 +00:00
robbond 056dace563 fix(security): enforce ownership on draft blob listing proxy 2026-11-05 12:59:55 +00:00
robbond 9d6d3b9f71 fix(security): enforce ownership on appeal and representation blob proxies 2026-11-05 12:53:24 +00:00
robbond 0a115a8808 security: preserve representation history in watched-case upsert 2026-11-05 12:48:45 +00:00
robbond 706083b6f0 test: update endpoint contract fixtures and add test filtering 2026-11-05 10:25:59 +00:00
robbond 431c45ba2b security: enforce CRM watched-case deletion ownership 2026-11-05 10:24:52 +00:00
robbond 569faa77e5 fix(security): isolate NextAuth email provider from Nodemailer 2026-11-04 11:26:01 +00:00
robbond d9f0c0797d fix(security): strip video embeds from rich text linkification 2026-11-04 10:51:56 +00:00
robbond ebe8cab03f fix(deps): migrate ESLint tooling for Next.js 16 2026-11-04 10:01:40 +00:00
robbond 3f91a3e095 fix(security): replace nookies with patched cookie utility 2026-11-04 06:54:36 +00:00
robbond 16ca736789 chore(deps): update NextAuth v4 compatibility baseline 2026-11-03 10:15:53 +00:00
robbond bb50b17277 fix(ithc): correct server-side session retrieval for file APIs 2026-11-03 09:25:02 +00:00
robbond d417860d1d Merge branch 'SIPS-Development' into feature/ithc-mitigation 2026-11-02 16:05:12 +00:00
Robert Bond 93eabe8e6d Merged PR 2665: 25470 testing authentication handler 
Related work items: #25470
 2026-11-02 12:41:09 +00:00
robbond be2df2da8f Merge remote-tracking branch 'origin/SIPS-Development' into feature/ithc-mitigation 2026-10-27 13:33:15 +00:00
Robert Bond 2b691ac4ef Merged PR 2653: fix: preserve LPA questionnaire PDF metadata during submission 
fix: preserve LPA questionnaire PDF metadata during submission

Related work items: #25435
 2026-10-27 13:07:41 +00:00
robbond 65616f6307 ITHC: enforce container ownership on uploads 2026-10-27 06:05:47 +00:00
robbond 5e98d6e8c2 ITHC: enforce administrative case deletion authorization 2026-10-27 05:40:50 +00:00
robbond 8b607d8134 ITHC: enforce representation completion ownership and admin access 2026-10-26 17:11:38 +00:00
robbond 034b59a981 ITHC: enforce representation blob proxy ownership and admin access 2026-10-26 16:17:52 +00:00
robbond 37aeb03509 ITHC: protect administrative representation unlock endpoint 2026-10-26 15:27:10 +00:00
robbond 0daeb783b9 Stage 3: enforce blob deletion ownership and add admin representation deletion 
Also repairs two stale Phase 21 fixtures:
- Supplies a valid PDF to exercise the upload dependency-failure path.
- Injects getPersonalAccount into the representation-involvement VM fixture.
 2026-10-26 14:39:22 +00:00
robbond 848728584e Stage 2: integrate administrative login and protect dashboard 2026-10-26 14:31:07 +00:00
robbond d11c4a868e Add independent administrative authentication foundation 2026-10-26 12:51:42 +00:00
Robert Bond e864049bec Merged PR 2449: language helper 
Related work items: #23754
 2026-07-01 11:29:15 +00:00
Robert Bond ff699735c7 Merged PR 2442: remove lodash dependecies on _.has 
Related work items: #23754
 2026-06-29 13:08:06 +00:00
Robert Bond 94b19f9697 Merged PR 2432: Add myportal API grouping facade read slice 
Add myportal API grouping facade read slice

Related work items: #23754
 2026-06-25 09:37:01 +00:00
Robert Bond a1b89d19b8 Merged PR 2431: Add case details API grouping facade 
Add case details API grouping facade

Related work items: #23754
 2026-06-25 09:22:12 +00:00
Robert Bond f9f78548b0 Merged PR 2430: Add API grouping facade rollout checkpoint 
Add API grouping facade rollout checkpoint

Related work items: #23754
 2026-06-25 09:05:59 +00:00
Robert Bond a266fa5428 Merged PR 2429: Add public search API grouping facade slice 
Add public search API grouping facade slice

Related work items: #23754
 2026-06-25 08:48:43 +00:00
Robert Bond 33dcb6b863 Merged PR 2428: Add documents API grouping facade slice 
Add documents API grouping facade slice

Related work items: #23754
 2026-06-25 08:24:58 +00:00
Robert Bond 153f0d679e Merged PR 2427: update api facade 
Related work items: #23754
 2026-06-25 08:11:14 +00:00
Robert Bond be68b987a1 Merged PR 2405: Representation Entry Policy discovery and wrapper 
Related work items: #23754
 2026-06-19 08:19:56 +00:00
Robert Bond c84ff3fff9 Merged PR 2399: Adds characterization coverage and documentation for CRM query field profile 
Related work items: #23754
 2026-06-18 08:04:36 +00:00
Robert Bond a6941a8a06 Merged PR 2398: amends to appeal policy 
Related work items: #23754
 2026-06-18 05:17:10 +00:00
Robert Bond 475aa965b4 Merged PR 2395: helpers for dashboard domain layer 
Related work items: #23754
 2026-06-17 16:06:09 +00:00
Robert Bond 0b66a0e1d4 Merged PR 2394: adjusting reps domain logic 
Related work items: #23754
 2026-06-17 10:55:32 +00:00
Robert Bond c39e4bcc9a Merged PR 2375: update representation policy 
## Summary

Introduces a new `representation-policy` domain boundary and incrementally extracts low-risk representation entry policy logic while preserving existing behaviour.

This PR intentionally stops before extracting ROW and Advert entry rules because characterization uncovered behavioural differences between consumers that require a separate business decision.

## What Changed

Added:

```text
lib/domain/representation-policy/
```

Including:

- `resolveRepresentationWindow(...)`
- `isRepresentationWindowOpen(...)`
- `isRepresentationWindowClosed(...)`
- `canShowRepresentationButtonForAppealType(...)`
- `canStartHouseholderRepresentation(...)`
- `canStartCpoRepresentation(...)`

Updated consumers:

```text
components/case/summary/utils/representationEntry.js
components/search/repsonresults.js
```

## Extracted Behaviour

### Representation Window Calculation
Centralised shared representation window logic and adopted it in both consumers.

### Appeal Type Entry Gating
Centralised excluded appeal-type logic while preserving existing behaviour.

### Householder Rule
Centralised Householder (`846040004`) entry rule.

Preserved behaviour:

```text
Householder representations can only be started by LPAs.
```

### CPO Rule
Centralised CPO (`846040019`) entry rule.

Preserved behaviour using:

```text
pinswg_startdate
pinswg_statementduedate
```

No fallback date broadening introduced.

## Characterization Added

### ROW (`846040015`)
Documented:
- hearing vs non-hearing behaviour
- specialist-process field behaviour
- date gating
- appeal-type coercion behaviour

### Advert (`846040018`)
Documented:
- LPA/non-LPA behaviour
- specialist-process behaviour
- appeal-type coercion behaviour

## Important Findings

### ROW Divergence
Summary and Search consumers currently behave differently when only:

```text
pinswg_speacialistcaseprocess
```

exists.

### Advert Divergence
Summary and Search consumers currently use different specialist-process resolution paths.

### CRM Compatibility
Both fields remain in production use and must be preserved:

```text
pinswg_specialistcaseprocess
pinswg_speacialistcaseprocess
```

## Documentation

Added:

```text
lib/domain/representation-policy/README.md
```

Documenting:
- ownership
- non-goals
- CRM compatibility requirements
- ROW divergence
- Advert divergence
- future extraction constraints

## Validation

Executed during the slice series:

```bash
node tests/phase22/representation-window.test.cjs
node tests/phase22/representation-appeal-type-entry-gating.test.cjs
node tests/phase22/representation-householder-entry-rule.test.cjs
node tests/phase22/representation-cpo-entry-rule.test.cjs
node tests/phase22/representation-row-entry-rule.test.cjs
node tests/phase22/representation-advert-entry-rule.test.cjs
npm run lint
```

All passing.

## Out of Scope

No changes to:

- submission/finalisation
- uploads
- dashboards
- CRM/OData queries
- API routes
- Redux state
- translations
- blocked-message rendering
- CTA l...
 2026-06-08 10:51:02 +00:00
Robert Bond 9595ad86df Merged PR 2374: addeding domain layer extrraction 
# Summary

This PR introduces a **Case Lifecycle Domain Boundary** to centralize lifecycle decision logic and reduce coupling within the appeals application.

The work is **behaviour-preserving** and introduces no intentional changes to business rules, CRM integrations, translations, dashboards, API routes, or user-facing functionality.

## What was added

New lifecycle boundary:

```text
lib/domain/case-lifecycle/
```

Key responsibilities extracted:

- Specialist process normalization
- Appeal type mapping
- Specialist process stage override mapping
- Stage case-type resolution
- Stage catalogue lookup
- Closed-case status recognition
- Lifecycle stage index resolution
- Lifecycle stage status assignment

## Behaviour preserved

Characterization tests were added before each extraction to preserve:

- Appeal type mapping and aliases
- Specialist process handling
- Lifecycle stage progression
- Closed-case handling
- Status assignment (`complete`, `in-progress`, `not-started`)
- Existing ROW behaviour
- Existing `statuscode` lifecycle semantics

Closed-case recognition remains unchanged for:

```text
1000
5
6
846040013
846040059
846040060
```

## Documentation

Added:

```text
lib/domain/case-lifecycle/README.md
```

Documenting:

- Boundary ownership
- Non-goals
- Lifecycle invariants
- Known architectural constraints
- Future extraction roadmap

## Testing

Added lifecycle characterization coverage for:

- Stage wrapper behaviour
- Specialist process normalization
- Appeal type mapping
- Specialist process stage mapping
- Stage case-type resolution
- Stage catalogue lookup
- Progress behaviour
- Closed-case status handling
- Stage index resolution
- Stage status assignment

## Validation

- Lifecycle characterization tests passed
- `npm run lint` passed with no errors

## Out of Scope

No changes to:

- Stage catalogue ownership
- Representation eligibility
- Dashboard calculations
- CRM/OData queries
- API routes
- Redux state
- EN/CY translations
- Event visibility logic

## Risk

**Low risk**

The refactor was delivered through small, characterization-first slices with no functional changes intended.

Related work items: #23527
 2026-06-08 09:34:30 +00:00
Robert Bond c2ae6964f9 Merged PR 2318: auth stabilisation: extract shared myportal auth guard helper 
auth stabilisation: extract shared myportal auth guard helper

ntroduces a small shared SSR helper (resolveMyPortalAuthContext) to standardize common myportal auth/session guards (session presence, session user identity, and pinsUser cookie) with preserved reason-coded diagnostics and signin redirect behavior. Migrates exactly two loaders (pages/myportal/searchresults.js, pages/myportal/addresssearchresults.js) to use the helper while keeping loader-specific UPSTREAM_FAILURE and CONTACT_LOOKUP_FAILED logic unchanged.

Related work items: #23020
 2026-05-14 10:38:45 +00:00