Adds incremental auth/session hardening across myportal loader paths (loadMyPortalAppealPage, searchresults, addresssearchresults) with explicit guard ordering and reason-coded diagnostics for missing session, missing session identity, missing cookie identity, contact/account lookup failures, and upstream dependency failures. Includes targeted Phase22 loader guard tests and keeps redirect behaviour policy unchanged. Related work items: #23020
150 lines
5.0 KiB
JavaScript
150 lines
5.0 KiB
JavaScript
const assert = require("assert");
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
const vm = require("vm");
|
|
|
|
const tests = [];
|
|
const test = (name, fn) => tests.push({ name, fn });
|
|
|
|
const loadMyPortalAddressSearchResultsPage = (overrides = {}) => {
|
|
const filePath = path.join(
|
|
__dirname,
|
|
"..",
|
|
"..",
|
|
"pages",
|
|
"myportal",
|
|
"addresssearchresults.js"
|
|
);
|
|
|
|
let source = fs.readFileSync(filePath, "utf8");
|
|
source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
|
|
source = source.slice(source.indexOf("export const getServerSideProps"));
|
|
source = source.replace(
|
|
/export\s+const\s+getServerSideProps\s*=\s*/,
|
|
"const getServerSideProps = "
|
|
);
|
|
source = source.replace(/const mapStateToProps[\s\S]*$/, "");
|
|
source += "\nmodule.exports = { getServerSideProps };\n";
|
|
|
|
const context = {
|
|
module: { exports: {} },
|
|
exports: {},
|
|
getIP: () => {},
|
|
consoleLogger: () => {},
|
|
getSession: async () => ({ user: { id: "u-1", email: "x@y.z" } }),
|
|
getPersonalAccount: async () => ({}),
|
|
getAddressSearch: async () => ({ value: [] }),
|
|
getAdvancedSearch: async () => ({ value: [] }),
|
|
getWatchedCases: async () => ({ value: [] }),
|
|
getSearchDetails: async () => ({ value: [] }),
|
|
getPortalModuleDetails: async () => ({}),
|
|
getFormCollectionByID: () => ({ LogicalCollectionName: "x" }),
|
|
setShowReps: () => ({}),
|
|
setSearch: () => ({}),
|
|
setContainerID: () => ({}),
|
|
setAccountDetails: () => ({}),
|
|
setSearchResults: () => ({}),
|
|
setSearchDetails: () => ({}),
|
|
setWatchedCases: () => ({}),
|
|
setWatchedCasesDetails: () => ({}),
|
|
setLoggedInUserId: () => ({}),
|
|
wrapper: {
|
|
getServerSideProps: (factory) => async (ctx) => {
|
|
const store = { dispatch: () => {} };
|
|
return factory(store)(ctx);
|
|
}
|
|
},
|
|
process: { env: {} },
|
|
console,
|
|
...overrides
|
|
};
|
|
|
|
vm.runInNewContext(source, context, { filename: filePath });
|
|
return context.module.exports;
|
|
};
|
|
|
|
test("addresssearchresults redirects to signin when session is missing", async () => {
|
|
const mod = loadMyPortalAddressSearchResultsPage({
|
|
getSession: async () => null
|
|
});
|
|
const result = await mod.getServerSideProps({
|
|
query: { q: "CAS" },
|
|
req: { cookies: { pinsUser: "contact-1" } }
|
|
});
|
|
assert.strictEqual(result.redirect.destination, "/auth/signin");
|
|
});
|
|
|
|
test("addresssearchresults redirects to signin when session user identity is missing", async () => {
|
|
const mod = loadMyPortalAddressSearchResultsPage({
|
|
getSession: async () => ({ user: { id: "u-1" } })
|
|
});
|
|
const result = await mod.getServerSideProps({
|
|
query: { q: "CAS" },
|
|
req: { cookies: { pinsUser: "contact-1" } }
|
|
});
|
|
assert.strictEqual(result.redirect.destination, "/auth/signin");
|
|
});
|
|
|
|
test("addresssearchresults redirects to signin when pinsUser cookie is missing", async () => {
|
|
const mod = loadMyPortalAddressSearchResultsPage();
|
|
const result = await mod.getServerSideProps({
|
|
query: { q: "CAS" },
|
|
req: { cookies: {} }
|
|
});
|
|
assert.strictEqual(result.redirect.destination, "/auth/signin");
|
|
});
|
|
|
|
test("addresssearchresults classifies contact lookup failure and redirects to signin", async () => {
|
|
let capturedLog = null;
|
|
const mod = loadMyPortalAddressSearchResultsPage({
|
|
getPersonalAccount: async () => ({ errorCode: "CONTACT_MISSING" }),
|
|
consoleLogger: (entry) => {
|
|
capturedLog = entry;
|
|
}
|
|
});
|
|
const result = await mod.getServerSideProps({
|
|
query: { q: "CAS" },
|
|
req: { cookies: { pinsUser: "contact-1" } }
|
|
});
|
|
assert.strictEqual(result.redirect.destination, "/auth/signin");
|
|
assert.strictEqual(capturedLog.reasonCode, "CONTACT_LOOKUP_FAILED");
|
|
});
|
|
|
|
test("addresssearchresults classifies upstream failure and redirects to signin", async () => {
|
|
let capturedLog = null;
|
|
const mod = loadMyPortalAddressSearchResultsPage({
|
|
getAdvancedSearch: async () => {
|
|
throw new Error("search unavailable");
|
|
},
|
|
consoleLogger: (entry) => {
|
|
capturedLog = entry;
|
|
}
|
|
});
|
|
const result = await mod.getServerSideProps({
|
|
query: { q: "CAS" },
|
|
req: { cookies: { pinsUser: "contact-1" } }
|
|
});
|
|
assert.strictEqual(result.redirect.destination, "/auth/signin");
|
|
assert.strictEqual(capturedLog.reasonCode, "UPSTREAM_FAILURE");
|
|
});
|
|
|
|
const run = async () => {
|
|
let passed = 0;
|
|
for (const currentTest of tests) {
|
|
await currentTest.fn();
|
|
passed += 1;
|
|
}
|
|
console.log(
|
|
`Phase 22 myportal-addresssearchresults-loader-guards tests passed (${passed}/${tests.length}).`
|
|
);
|
|
};
|
|
|
|
module.exports = run;
|
|
|
|
if (require.main === module) {
|
|
run().catch((error) => {
|
|
console.error(error);
|
|
process.exit(1);
|
|
});
|
|
}
|