Adds incremental auth/session hardening across myportal loader paths (loadMyPortalAppealPage, searchresults, addresssearchresults) with explicit guard ordering and reason-coded diagnostics for missing session, missing session identity, missing cookie identity, contact/account lookup failures, and upstream dependency failures. Includes targeted Phase22 loader guard tests and keeps redirect behaviour policy unchanged. Related work items: #23020
200 lines
5.9 KiB
JavaScript
200 lines
5.9 KiB
JavaScript
// lib/myportal/loadMyPortalAppealPage.js
|
|
import { getSession } from "next-auth/react";
|
|
import {
|
|
getAppealsTypesForNewAppeal,
|
|
getMandatoryFields,
|
|
getPickLists
|
|
} from "../../actions/services/referenceDataService";
|
|
import {
|
|
getAwaitingSubmissionFromBlob,
|
|
getFilesFromBlob,
|
|
getProgressFromBlob
|
|
} from "../../actions/services/documentService";
|
|
import { getPersonalAccount } from "../../actions/services/accountService";
|
|
import { consoleLogger, getIP } from "../../actions/core/logger";
|
|
|
|
import { readFormXml } from "../forms/readFormXml";
|
|
import { requireQueryParams } from "../routing/requireQueryParams";
|
|
|
|
/**
|
|
* Loader for "resume appeal" in /myportal/[appealtypes]
|
|
*/
|
|
export async function loadMyPortalAppealPage(ctx) {
|
|
const { query, req } = ctx;
|
|
|
|
getIP(req);
|
|
|
|
// Required params for resume flow (adjust if your routes always provide them)
|
|
// casereference is the main identifier here
|
|
const required = requireQueryParams(query, [
|
|
"appealtypes",
|
|
"apt",
|
|
"casereference"
|
|
]);
|
|
if (!required.ok) {
|
|
consoleLogger({
|
|
name: "MyPortalAppealLoaderMissingQuery",
|
|
message:
|
|
"loadMyPortalAppealPage missing required query params; redirecting",
|
|
hasAppealType: !!query?.appealtypes,
|
|
hasAppealTypeId: !!query?.apt,
|
|
hasCaseReference: !!query?.casereference
|
|
});
|
|
return { redirect: required.redirect };
|
|
}
|
|
|
|
const session = await getSession(ctx);
|
|
if (!session) {
|
|
consoleLogger({
|
|
name: "MyPortalAppealLoaderAuthGuard",
|
|
reasonCode: "NO_SESSION",
|
|
message:
|
|
"loadMyPortalAppealPage missing session; redirecting to signin"
|
|
});
|
|
return {
|
|
redirect: {
|
|
destination: "/auth/signin",
|
|
permanent: false
|
|
}
|
|
};
|
|
}
|
|
|
|
if (!session?.user?.id || !session?.user?.email) {
|
|
consoleLogger({
|
|
name: "MyPortalAppealLoaderAuthGuard",
|
|
reasonCode: "NO_SESSION_USER",
|
|
message:
|
|
"loadMyPortalAppealPage missing session user identity; redirecting to signin",
|
|
hasUserId: !!session?.user?.id,
|
|
hasUserEmail: !!session?.user?.email
|
|
});
|
|
return {
|
|
redirect: {
|
|
destination: "/auth/signin",
|
|
permanent: false
|
|
}
|
|
};
|
|
}
|
|
|
|
const { cookies } = req;
|
|
const loggedInUser = cookies?.pinsUser;
|
|
const loggedInUserIdent = session.user.id;
|
|
const loggedInUserEmail = session.user.email;
|
|
|
|
if (!loggedInUser) {
|
|
consoleLogger({
|
|
name: "MyPortalAppealLoaderAuthGuard",
|
|
reasonCode: "NO_PINSUSER_COOKIE",
|
|
message:
|
|
"loadMyPortalAppealPage missing pinsUser cookie; redirecting to signin"
|
|
});
|
|
return {
|
|
redirect: {
|
|
destination: "/auth/signin",
|
|
permanent: false
|
|
}
|
|
};
|
|
}
|
|
|
|
// Fetch config + blob assets in parallel
|
|
let appealTypeData;
|
|
let mandatoryFieldsData;
|
|
let pickListData;
|
|
let blobList;
|
|
let blobProgress;
|
|
let accountDetails;
|
|
|
|
try {
|
|
[
|
|
appealTypeData,
|
|
mandatoryFieldsData,
|
|
pickListData,
|
|
blobList,
|
|
blobProgress,
|
|
accountDetails
|
|
] = await Promise.all([
|
|
getAppealsTypesForNewAppeal(),
|
|
getMandatoryFields(query.appealtypes),
|
|
getPickLists(query.appealtypes),
|
|
getFilesFromBlob(loggedInUserIdent, query.casereference),
|
|
getProgressFromBlob(loggedInUserIdent, query.casereference),
|
|
getPersonalAccount(loggedInUser)
|
|
]);
|
|
} catch (_error) {
|
|
consoleLogger({
|
|
name: "MyPortalAppealLoaderDependencyFailure",
|
|
reasonCode: "UPSTREAM_FAILURE",
|
|
message:
|
|
"loadMyPortalAppealPage dependency fetch failed; redirecting to /myportal",
|
|
appealType: query?.appealtypes,
|
|
hasCaseReference: !!query?.casereference,
|
|
error: _error?.message
|
|
});
|
|
return {
|
|
redirect: {
|
|
destination: "/myportal",
|
|
permanent: false
|
|
}
|
|
};
|
|
}
|
|
|
|
if (!accountDetails || accountDetails?.errorCode) {
|
|
consoleLogger({
|
|
name: "MyPortalAppealLoaderContactGuard",
|
|
reasonCode: "CONTACT_LOOKUP_FAILED",
|
|
message:
|
|
"loadMyPortalAppealPage account contact lookup failed; redirecting to signin",
|
|
hasAccountDetails: !!accountDetails,
|
|
hasErrorCode: !!accountDetails?.errorCode
|
|
});
|
|
return {
|
|
redirect: {
|
|
destination: "/auth/signin",
|
|
permanent: false
|
|
}
|
|
};
|
|
}
|
|
|
|
// Optional: awaiting-submission view setup when query.key exists
|
|
let awaitingSubmissionFromBlob = null;
|
|
if (Object.prototype.hasOwnProperty.call(query, "key")) {
|
|
awaitingSubmissionFromBlob = await getAwaitingSubmissionFromBlob(
|
|
session.user.id
|
|
);
|
|
}
|
|
|
|
let xmlStr = "";
|
|
try {
|
|
xmlStr = readFormXml(query.appealtypes).xmlStr;
|
|
} catch (_error) {
|
|
consoleLogger({
|
|
name: "MyPortalAppealLoaderXmlReadFailure",
|
|
message:
|
|
"loadMyPortalAppealPage XML read failed; redirecting to /myportal",
|
|
appealType: query?.appealtypes,
|
|
error: _error?.message
|
|
});
|
|
return {
|
|
redirect: {
|
|
destination: "/myportal",
|
|
permanent: false
|
|
}
|
|
};
|
|
}
|
|
|
|
return {
|
|
session,
|
|
loggedInUser,
|
|
loggedInUserIdent,
|
|
loggedInUserEmail,
|
|
appealTypeData,
|
|
mandatoryFieldsData,
|
|
pickListData,
|
|
blobList,
|
|
blobProgress,
|
|
accountDetails,
|
|
awaitingSubmissionFromBlob,
|
|
xmlStr
|
|
};
|
|
}
|