pedwfrontend/AI_CONTEXT.md

AI Context — PEDW FrontEnd

Overview

PEDW FrontEnd is a Next.js 14 (Pages Router) bilingual (EN/CY) public-service portal for planning case search, case detail/document viewing, and authenticated portal workflows (appeals, representations, watchlists, dashboard views).

Architecture

• Monorepo-style Next.js app with UI routes in pages/ and API handlers in pages/api/**.
• Redux (next-redux-wrapper + redux-persist) for shared client/server state.
• next-auth for auth/session with Prisma adapter.
• Integration-heavy BFF pattern: API routes proxy to relay/CRM and storage/notify services.

Key components

• components/breadcrumbs.js: central breadcrumb/back-link behavior.
• components/case/summary.js: case-detail tabs, representation eligibility logic, watch/email actions.
• actions/index.js: shared API utilities, token/header/hash helpers, many side-effect wrappers.
• pages/api/endpoint/**: relay-backed business-data APIs.
• pages/api/file/**: blob/document/PDF/upload endpoints.

Data model boundaries

• Prisma (prisma/schema.prisma) stores auth/session entities only (User, Account, Session, VerificationToken) on SQL Server.
• Business/case data is external (Dynamics/relay path), not persisted as Prisma domain models here.

API/integration patterns

• Many endpoint handlers compute HMAC hash query params (hash) for relay-bound requests.
• Token acquisition + OData headers are reused across proxy handlers.
• File endpoints often validate request hash for sensitive blob actions.
• GOV.UK Notify used for email, including language-specific template selection in some flows.

Infrastructure/tooling

• Scripts: npm run dev, npm run build, npm start, npm run lint.
• CI/CD artifacts present: azure-pipelines.yml, Jenkinsfile, Dockerfile (active production source-of-truth not explicit in repo).
• Security controls: middleware.js CSP/runtime headers + next.config.js security headers.

Development constraints

• Preserve auth/session behavior in pages/api/auth/[...nextauth].js.
• Do not weaken CSP/security headers in middleware.js or next.config.js.
• Keep EN/CY parity across routes and locale resources (i18n.js, locales/**, rewrites).
• Treat relay hash behavior as security-sensitive; keep path/hash compatibility stable.
• Avoid logging secrets/personal data in auth/email/file/account flows.