543 lines
26 KiB
Markdown
543 lines
26 KiB
Markdown
# Active Context — PEDW FrontEnd
|
||
|
||
## Current development focus (from recent commits)
|
||
|
||
- Search/case navigation correctness, especially breadcrumb and back-link behavior.
|
||
- My Portal "view all" and DNS application path handling.
|
||
- Welsh/English email behavior for specific notification templates.
|
||
- PDF output formatting and hyperlink behavior.
|
||
|
||
## Recently changed areas (high signal)
|
||
|
||
- `components/breadcrumbs.js`
|
||
- `components/case/summary.js`
|
||
- `components/search/searchresults.js`
|
||
- `components/search/addresssearchresults.js`
|
||
- `components/myportal/viewall.js`
|
||
- `pages/myportal/case/[ticketnumber].js`
|
||
- `pages/api/email/notify.js`
|
||
- `actions/index.js`
|
||
- `actions/core/env.js`
|
||
- `actions/core/logger.js`
|
||
- `actions/core/hash.js`
|
||
- `actions/core/token.js`
|
||
- `actions/core/headers.js`
|
||
- `actions/services/legacyActionsService.js`
|
||
- `i18n.js`
|
||
|
||
## Active concerns
|
||
|
||
- Breadcrumb and route-state logic is complex and query-dependent (`va`, `adv`, `ads`, `key`), so regressions are easy.
|
||
- Locale-specific route and label behavior is still a high-risk area due to rewrite + component logic coupling.
|
||
- Sensitive logging remains present in auth/email/actions paths and should be reduced/redacted over time.
|
||
- Hash validation on some file endpoints appears inconsistent (some checks active, some commented), requiring careful change discipline.
|
||
|
||
## Refactor status update (2026-03-12)
|
||
|
||
- Priority 1 refactor (Phase 1) is in place:
|
||
- `actions/index.js` now acts as a compatibility barrel.
|
||
- Core helper concerns were extracted into `actions/core/*`.
|
||
- Existing API/file/domain wrappers were moved into `actions/services/legacyActionsService.js` with backward-compatible exports retained via the barrel.
|
||
- No intentional behavior changes were introduced in this phase; focus was structural risk reduction.
|
||
- Priority 1 refactor (Phase 2) is now in place:
|
||
- Domain service grouping modules added under `actions/services/*`.
|
||
- `actions/services/index.js` now provides grouped service barrel exports.
|
||
- `actions/index.js` now re-exports from `./services` and `./core/*` while preserving existing public action names.
|
||
- `legacyActionsService` remains as a compatibility backing module and should be slimmed in later increments as consumers move to direct service imports.
|
||
|
||
## Refactor status update (Priority 1 execution pass — 2026-03-12)
|
||
|
||
- Completed an additional Priority 1 consumer-migration pass focused on high-use portal/form helpers.
|
||
- Updated these files to use focused service/core imports instead of broad `actions` barrel imports:
|
||
- `components/case/representation/representationElements.js`
|
||
- `components/elements/index.js`
|
||
- `components/utils/index.js`
|
||
- `lib/newappeal/loadNewAppealPage.js`
|
||
- `lib/myportal/loadMyPortalAppealPage.js`
|
||
- `components/myportal/topthree.js`
|
||
- `components/myportal/topthree_reps.js`
|
||
- `components/myportal/awaitingsubmissionfromblob.js`
|
||
- Compatibility model remains in place via `actions/index.js`; migration is incremental and non-breaking by design.
|
||
|
||
## Refactor status update (Priority 1 execution pass — viewall/search/unsubscribe)
|
||
|
||
- Completed another focused import migration pass to reduce broad `actions` barrel coupling in user-facing high-use areas:
|
||
- `components/myportal/viewall.js`
|
||
- `components/search/addresssearchresults.js`
|
||
- `pages/unsubscribe/[watchlistid].js`
|
||
- `pages/unsubscribeall/[watchlistid].js`
|
||
- These files now use explicit imports from `actions/services/*` and `actions/core/*` modules.
|
||
- Remaining non-comment broad `actions` imports are now primarily in selected `pages/api/endpoint/*` and `pages/api/file/*` handlers.
|
||
|
||
## Refactor status update (Priority 1 execution pass — endpoint/file proxies)
|
||
|
||
- Completed focused import migration for selected endpoint and file proxy handlers:
|
||
- `pages/api/endpoint/getmylpacases_api.js`
|
||
- `pages/api/endpoint/getbasicdnssearchpaged_api.js`
|
||
- `pages/api/endpoint/getsearchdocumentdetailspaged_api.js`
|
||
- `pages/api/endpoint/getbasicsearchpaged_api.js`
|
||
- `pages/api/file/getawaitingsubmissionfromblobproxy.js`
|
||
- `pages/api/file/getrepsblobproxy.js`
|
||
- `pages/api/file/getbloblistproxy.js`
|
||
- `pages/api/file/createappealcompletemessageproxy_api.js`
|
||
- Replaced broad `../../../actions` imports with focused `actions/core/*` and service-module imports.
|
||
- Eliminated duplicated local hash helper in `getmylpacases_api.js` by reusing shared `actions/core/hash`.
|
||
- Current broad-import scan indicates only comment-only legacy references remain.
|
||
|
||
## Delivery handover status (2026-03-13)
|
||
|
||
- Current import-migration wave has been checked in and completed through PR.
|
||
- This branch is now treated as the completed migration baseline.
|
||
- Next implementation chunk should start on a **new branch** and target decomposition of `actions/services/legacyActionsService.js`.
|
||
- Immediate focus for next branch:
|
||
1. extract low-risk reference/search wrappers into direct service/client modules,
|
||
2. migrate portal/document internals in small parity-checked batches,
|
||
3. slim compatibility layer once parity is proven.
|
||
|
||
## Phase 5 kickoff status (2026-03-13)
|
||
|
||
- Branch in progress: `TASK21997-phase5-legacyactions-split`.
|
||
- First decomposition slice completed:
|
||
- search wrappers extracted to `actions/services/searchDirectService.js`
|
||
- reference-data wrappers extracted to `actions/services/referenceDataDirectService.js`
|
||
- `searchService` and `referenceDataService` now route through these direct modules.
|
||
- `legacyActionsService` remains in place for non-migrated domains (portal/document/account/case/admin/notify/integration) pending next slices.
|
||
|
||
## Phase 5 status update (2026-03-13 — document slice)
|
||
|
||
- Added `actions/services/documentDirectService.js` and migrated `documentService.js` to route through it.
|
||
- `legacyActionsService` now remains for:
|
||
- portal, account, case, admin, notify, integration domains.
|
||
- Search/reference/document grouped services now point at dedicated direct modules.
|
||
|
||
## Phase 5 completion status (2026-03-13)
|
||
|
||
- Grouped services now route through focused direct modules for all domains:
|
||
- search, reference-data, document, portal, account, case, admin, integration, notify.
|
||
- `actions/services/legacyActionsService.js` has been removed.
|
||
- Current architecture baseline:
|
||
- `actions/index.js` -> compatibility barrel re-exporting `actions/services` + core modules
|
||
- `actions/services/*Service.js` -> grouped public service boundaries
|
||
- `actions/services/*DirectService.js` -> implementation modules per domain
|
||
- Validation checkpoints completed:
|
||
- zero `legacyActionsService` imports in `actions/services/*.js`
|
||
- lint passes with warnings only
|
||
- build succeeds
|
||
|
||
## Phase 6 hardening status (2026-03-13 — in progress)
|
||
|
||
- Working branch: `TASK21998-phase6-postphase5-hardening` (created from `SIPS-Development`).
|
||
- Main hardening actions completed so far:
|
||
- Added focused parity test harness:
|
||
- `tests/phase6/service-parity.test.cjs`
|
||
- verifies grouped service import/export parity and `actions/services/index.js` re-export stability.
|
||
- Added shared error-path helper:
|
||
- `actions/services/httpServiceUtils.js`
|
||
- consolidates repeated `consoleLogger + error.response` and `ErrResponse` generation patterns.
|
||
- Applied safe duplication reduction in:
|
||
- `searchDirectService.js`
|
||
- `referenceDataDirectService.js`
|
||
- `caseDirectService.js`
|
||
- `adminDirectService.js`
|
||
- Logging cleanup for sensitive/noisy service paths (removed debug `console.log` usage) in:
|
||
- `searchDirectService.js`
|
||
- `documentDirectService.js`
|
||
- `portalDirectService.js`
|
||
- `caseDirectService.js`
|
||
- `adminDirectService.js`
|
||
|
||
### Current validation evidence
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `npm run lint` -> warnings only
|
||
- Targeted local smoke snapshots:
|
||
- `GET /advancedsearch` and `GET /cy/advancedsearch` -> 200
|
||
- `GET /case` and `GET /cy/case` -> 200
|
||
- `GET /myportal` and `GET /cy/myportal` -> 307 redirect to `/auth/signin` (unauthenticated negative path)
|
||
- `GET /api/file/getbloblistproxy?container=test&casefolderID=test` -> 400 (negative path)
|
||
- `POST /api/email/notify` with empty payload -> 400 (negative path)
|
||
|
||
### Active caveat
|
||
|
||
- `GET /searchresults` and `GET /cy/searchresults` return 500 in current local dev run due pre-existing SSR serialization issue:
|
||
- `initialState.search.searchString` is undefined in `getServerSideProps` payload.
|
||
- captured in `/tmp/phase6-dev.log`.
|
||
|
||
## Phase 7 hardening status (2026-03-13)
|
||
|
||
- Working branch created from `origin/SIPS-Development`:
|
||
- `TASK21988a-phase7-postphase6-hardening`
|
||
- Pre-existing search results SSR serialization issue now addressed:
|
||
- `pages/searchresults.js`
|
||
- changed `setSearch(query.q)` to `setSearch(query?.q || "")` in `getServerSideProps`.
|
||
- local smoke result: both `/searchresults` and `/cy/searchresults` return 200 in this run.
|
||
- Behavioural test expansion delivered for remaining service domains:
|
||
- `tests/phase7/service-behaviour.test.cjs`
|
||
- covers document, portal, account, notify, integration.
|
||
|
||
### Phase 7 validation evidence snapshot
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `npm run lint` -> warnings only (existing react-hooks dependency warnings; no new lint errors)
|
||
|
||
### Phase 7 smoke/negative-path snapshot
|
||
|
||
- Dev server auto-bound to `localhost:3001` (3000 already in use).
|
||
- `GET /searchresults`, `GET /cy/searchresults` -> 200
|
||
- `GET /case`, `GET /cy/case` -> 200
|
||
- `GET /myportal`, `GET /cy/myportal` -> 307 redirect to `/auth/signin`
|
||
- `GET /api/file/getbloblistproxy?container=test&casefolderID=test` -> 400
|
||
- `POST /api/email/notify` with `{}` -> 400
|
||
|
||
### Testing strategy decision (captured)
|
||
|
||
- Current phase includes **both**:
|
||
1. migration/parity guard tests,
|
||
2. focused behavioural unit tests for critical response/error contracts.
|
||
- Broader behavioural coverage remains a follow-on expansion item after this focused baseline.
|
||
|
||
## Phase 8 hardening status (2026-03-13)
|
||
|
||
- Working branch created from `origin/SIPS-Development`:
|
||
- `TASK22017-phase8-hardening-slice`
|
||
- Sensitive API hardening slice completed across:
|
||
- `pages/api/file/deleteblobcase.js`
|
||
- `pages/api/file/deleteblobrep.js`
|
||
- `pages/api/file/createappealcompletemessage_api.js`
|
||
- `pages/api/endpoint/getportallogin_api.js`
|
||
- Hash/integrity posture updates:
|
||
- re-enabled hash validation on previously bypassed/commented file handlers
|
||
- added standardized early 400 handling for missing/invalid hash and missing key params
|
||
- preserved response-shape contracts and function signatures
|
||
- Logging discipline updates:
|
||
- removed noisy direct `console.log` usage in `createappealcompletemessage_api`
|
||
- routed error paths through `consoleLogger` in updated sensitive flow
|
||
- Required consumer parity updates applied:
|
||
- `actions/services/documentDirectService.js`
|
||
- now appends hash for `deleteblobcase` and `deleteblobrep` calls
|
||
- `actions/services/portalDirectService.js`
|
||
- now appends hash for `createappealcompletemessage_api` call using existing hash path contract
|
||
|
||
### Phase 8 validation evidence snapshot
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
### Phase 8 manual HTTP snapshot
|
||
|
||
- Dev server on `http://localhost:3001`.
|
||
- Negative-path checks for invalid/missing hash (and missing required params where relevant) return **400** across all 4 target handlers.
|
||
- Valid-hash spot-check for `getportallogin_api` reached hash-validated path but still returned **400** due local upstream relay/CRM dependency behavior.
|
||
|
||
## Phase 9 hardening status (2026-03-13)
|
||
|
||
- Working branch created from `origin/SIPS-Development`:
|
||
- `TASK22019-phase-9-hardening`
|
||
- Additional sensitive API hardening slice completed across:
|
||
- `pages/api/file/createrepcompletemessage_api.js`
|
||
- `pages/api/file/upload.js`
|
||
- `pages/api/file/uploadsinglefile.js`
|
||
- `pages/api/file/setupcontainer.js`
|
||
- Hash/integrity posture updates:
|
||
- re-enabled/enforced hash checks in handlers where hash validation was bypassed/commented
|
||
- standardized early 400 handling for missing/invalid hash and missing key query/body values
|
||
- preserved response-shape contracts and function signatures
|
||
- Logging discipline updates:
|
||
- removed noisy `console.log` traces from sensitive upload/rep-complete message paths
|
||
- retained centralized error logging via `consoleLogger` where present
|
||
- Required caller parity updates applied:
|
||
- `actions/services/portalDirectService.js`
|
||
- `sendRepCompleteMessage` now appends hash
|
||
- `actions/services/documentDirectService.js`
|
||
- `uploadFiles`, `uploadRepFiles`, `uploadSingleFile` now append hash
|
||
|
||
### Phase 9 validation evidence snapshot
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
### Phase 9 manual HTTP snapshot
|
||
|
||
- Negative-path checks for missing/invalid hash and invalid/missing key params on all 4 phase-9 handlers return **400** on local server (`localhost:3000`).
|
||
- Valid-hash happy-path spot-check completed using `.env.local` hash key:
|
||
- `POST /api/file/uploadsinglefile?hash=<valid>` -> **200**
|
||
|
||
## Phase 10 hardening status (2026-03-13)
|
||
|
||
- Continued on branch:
|
||
- `TASK22019-phase-9-hardening`
|
||
- Additional sensitive API hardening slice completed across:
|
||
- `pages/api/file/getawaitingsubmissionfromblob.js`
|
||
- `pages/api/file/getprogressobjblob.js`
|
||
- `pages/api/file/getbloblist.js`
|
||
- `pages/api/file/getrepsblob.js`
|
||
- Hash/integrity posture updates:
|
||
- explicit early 400 guards for missing/empty required query inputs and hash
|
||
- standardized early hash-mismatch 400 behaviour in all 4 handlers
|
||
- preserved response-shape contracts and function signatures
|
||
- Logging discipline updates:
|
||
- removed old commented debug traces in touched handlers
|
||
- Caller parity:
|
||
- no additional service-layer updates required in this slice; existing direct services already append hash for these APIs.
|
||
|
||
### Phase 10 validation evidence snapshot
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
### Phase 10 manual HTTP snapshot
|
||
|
||
- Missing-hash negative-path checks for all 4 handlers return **400** (`localhost:3000`).
|
||
- Valid-hash spot-check result:
|
||
- `getbloblist` returned **500** with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).
|
||
|
||
## Phase 11 hardening status (2026-03-13)
|
||
|
||
- Continued on branch:
|
||
- `TASK22019-phase-9-hardening`
|
||
- Additional sensitive API hardening slice completed across:
|
||
- `pages/api/file/getbloblist.js`
|
||
- `pages/api/file/deleteblob.js`
|
||
- `pages/api/file/deleteawaitingsubmissionfromblob.js`
|
||
- Hash/integrity posture updates:
|
||
- explicit early 400 guards for missing/empty required query inputs and hash
|
||
- standardized early hash-mismatch 400 behaviour in all touched handlers
|
||
- preserved response-shape contracts and function signatures
|
||
- Logging discipline updates:
|
||
- removed old commented debug traces in touched handlers
|
||
- Caller parity:
|
||
- no additional service-layer updates required in this slice.
|
||
|
||
### Phase 11 validation evidence snapshot
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
### Phase 11 manual HTTP snapshot
|
||
|
||
- Missing/invalid-hash negative-path checks for selected handlers return **400** (`localhost:3000`).
|
||
- Valid-hash spot-check result:
|
||
- `getbloblist` returned **500** with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).
|
||
|
||
## Phase 12 hardening status (2026-03-13)
|
||
|
||
- Continued on branch:
|
||
- `TASK22019-phase-9-hardening`
|
||
- Additional sensitive API hardening slice completed across:
|
||
- `pages/api/file/downloadblob.js`
|
||
- `pages/api/file/getbloblistproxy.js`
|
||
- `pages/api/file/getrepsblobproxy.js`
|
||
- `pages/api/file/getawaitingsubmissionfromblobproxy.js`
|
||
- Hash/integrity posture updates:
|
||
- explicit early 400 guards for missing/empty required query inputs
|
||
- standardized early hash-mismatch 400 behaviour in `downloadblob`
|
||
- preserved response-shape contracts and function signatures
|
||
|
||
### Phase 12 validation evidence snapshot
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
### Phase 12 manual HTTP snapshot
|
||
|
||
- Missing/invalid-input negative-path checks for selected handlers return **400** (`localhost:3000`).
|
||
- Valid-hash spot-check result:
|
||
- `downloadblob` returned **500** with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).
|
||
|
||
## Phase 13 hardening status (2026-03-13)
|
||
|
||
- Continued on branch:
|
||
- `TASK22019-phase-9-hardening`
|
||
- Additional sensitive API hardening slice completed across:
|
||
- `pages/api/file/deleteblobcase.js`
|
||
- `pages/api/file/deleteblobrep.js`
|
||
- `pages/api/file/createcaseinvolvement_api.js`
|
||
- `pages/api/file/createrepinvolvement_api.js`
|
||
- Hash/integrity posture updates:
|
||
- explicit early 400 guards for missing/empty required query/body inputs
|
||
- standardized early hash-mismatch 400 behaviour in delete-blob handlers
|
||
- preserved response-shape contracts and function signatures
|
||
- Logging discipline updates:
|
||
- removed noisy direct body/query logging from involvement handlers
|
||
|
||
### Phase 13 validation evidence snapshot
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
### Phase 13 manual HTTP snapshot
|
||
|
||
- Missing/invalid-input negative-path checks for selected handlers return **400** (`localhost:3000`).
|
||
- Valid-hash spot-check result:
|
||
- `deleteblobcase` returned **500** with valid hash in local environment (consistent with downstream/local dependency constraints; hash gate passed).
|
||
|
||
## Phase 14 hardening status (2026-03-13)
|
||
|
||
- Continued on branch:
|
||
- `TASK22019-phase-9-hardening`
|
||
- Addressed browser runtime error in authenticated new-appeal journey:
|
||
- `TypeError` in `hashAPIPath` caused by client-side code attempting to parse server-only `HASHKEY`.
|
||
- Implemented server-side hash signing bridge for browser callers:
|
||
- new endpoint `pages/api/endpoint/gethash_api.js`
|
||
- session-gated (`getSession`), allow-listed supported API prefixes, returns `{ hash }`.
|
||
- Updated direct service callers to use signer endpoint instead of direct client hash computation:
|
||
- `actions/services/documentDirectService.js`
|
||
- `actions/services/portalDirectService.js`
|
||
- Maintained contract compatibility for target file APIs and existing response shapes.
|
||
|
||
### Phase 14 validation evidence snapshot
|
||
|
||
- phase6 parity/behaviour tests -> pass
|
||
- phase7/8/9/10/11/12/13 behaviour tests -> pass
|
||
- phase14 behaviour tests -> pass (4/4)
|
||
- lint -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
## Phase 14 closeout follow-up status (2026-03-13)
|
||
|
||
- Continued on branch:
|
||
- `TASK22019-phase-9-hardening`
|
||
- Browser-safe hash signing expanded for portal login flow:
|
||
- `actions/services/accountDirectService.js`
|
||
- `getPortalLogin` now requests signed hash from `/api/endpoint/gethash_api`
|
||
- server fallback retained for non-browser contexts when `HASHKEY` is present
|
||
- `pages/api/endpoint/gethash_api.js`
|
||
- allow-list now includes `/api/endpoint/getportallogin_api`
|
||
- Contract alignment + runtime fix updates:
|
||
- `pages/api/file/getrepsblob.js`
|
||
- removed hard requirement for `casefolderID` to match actual route contract (`container + hash`)
|
||
- `components/elements/index.js`
|
||
- restored missing `updateLinks` import required by Quill-related runtime path
|
||
|
||
### Follow-up validation evidence
|
||
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- full previously-run phase6–phase14 suite remains passing
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` set)
|
||
|
||
### Active risk posture after follow-up
|
||
|
||
- Signer endpoint scope remains controlled by strict allow-list (single new path added).
|
||
- Response-shape contract stability preserved for touched handlers/services.
|
||
- Remaining risk is primarily external dependency behavior on valid-hash happy paths in local environments (relay/storage), not hash-bypass behavior.
|
||
|
||
## Phase 15 hardening status (2026-03-13)
|
||
|
||
- Working branch created from `origin/SIPS-Development`:
|
||
- `TASK22028-phase15-hardening-slice`
|
||
- Delivered consistency-only hardening across 4 additional sensitive file handlers:
|
||
- `pages/api/file/upload.js`
|
||
- `pages/api/file/uploadsinglefile.js`
|
||
- `pages/api/file/createappealcompletemessage_api.js`
|
||
- `pages/api/file/setupcontainer.js`
|
||
- Hardening posture updates:
|
||
- standardized explicit early 400 on missing hash where validation was already required
|
||
- standardized early hash-mismatch return path style in `setupcontainer`
|
||
- preserved response-shape/signature contracts (no intended contract changes)
|
||
- Added focused phase-15 tests:
|
||
- `tests/phase15/service-behaviour.test.cjs`
|
||
- negative-path checks for missing/invalid hash across all selected handlers
|
||
- required-input negative-path checks where applicable
|
||
- one valid-hash mocked happy-path check (`setupcontainer` response shape)
|
||
|
||
### Phase 15 validation evidence snapshot
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||
|
||
### Phase 15 manual HTTP snapshot
|
||
|
||
- Dev server run on `http://localhost:3002`.
|
||
- Missing/invalid hash negative-path checks for selected handlers -> **400**.
|
||
- Missing required params where applicable -> **400**.
|
||
- Valid-hash spot-check:
|
||
- `GET /api/file/setupcontainer?ident=c1&hash=<valid>` -> **200**.
|
||
|
||
## Phase 16 hardening status (2026-03-13)
|
||
|
||
- Continued on branch:
|
||
- `TASK22028-phase15-hardening-slice`
|
||
- Added a consistency-only file-proxy hardening slice across:
|
||
- `pages/api/file/getbloblistproxy.js`
|
||
- `pages/api/file/getrepsblobproxy.js`
|
||
- `pages/api/file/getawaitingsubmissionfromblobproxy.js`
|
||
- Changes focused on:
|
||
- standardized required-input guards via `hasValue`
|
||
- removed unused imports/dead constants from touched proxy handlers
|
||
- preserved existing response contracts and status semantics
|
||
- Added focused test pack:
|
||
- `tests/phase16/service-behaviour.test.cjs`
|
||
|
||
### Phase 16 validation evidence snapshot
|
||
|
||
- phase6 parity + phase6–phase15 behavioural suites: pass
|
||
- phase16 behavioural suite: pass (4/4)
|
||
- lint: warnings only (pre-existing)
|
||
|
||
## Likely next steps
|
||
|
||
1. Stabilize and simplify breadcrumb/back-link decision logic with focused regression checks.
|
||
2. Standardize hash-check enforcement patterns across file and endpoint APIs.
|
||
3. Reduce verbose logging in sensitive flows (auth/email/file/account).
|
||
4. Expand automated tests for navigation and representation eligibility edge-cases (currently minimal `tests/`).
|
||
|
||
See `memory-bank/refactor-backlog.md` for the prioritized refactor plan and sequencing.
|
||
Priority 1 detailed execution plan is documented in `memory-bank/refactor-plan-actions-index.md`.
|
||
|
||
## Areas currently important for contributors
|
||
|
||
- `components/breadcrumbs.js`
|
||
- `components/case/summary.js`
|
||
- `pages/api/endpoint/**`
|
||
- `pages/api/file/**`
|
||
- `pages/api/auth/[...nextauth].js`
|
||
- `pages/api/email/notify.js`
|
||
- `next.config.js`, `i18n.js`, `locales/**`
|