1305 lines
60 KiB
Markdown
1305 lines
60 KiB
Markdown
# Change Log (AI/Human Curated)
|
||
|
||
## Entry Template
|
||
|
||
```
|
||
date: YYYY-MM-DD
|
||
author: <agent|name>
|
||
scope: <files/routes/features>
|
||
type: change
|
||
rationale: <why change was made>
|
||
impact: <user/system/security/i18n/a11y>
|
||
status: completed|rolled-back|partial
|
||
|
||
Summary:
|
||
Validation:
|
||
Follow-ups:
|
||
```
|
||
|
||
---
|
||
|
||
### CL-001: Initial AI Enablement Bundle
|
||
|
||
date: 2026-03-11
|
||
author: Cline
|
||
scope: `.clinerules`, `ai-prompts/`, `context/`, `memory-bank/`
|
||
type: change
|
||
rationale: Establish consistent AI collaboration, delivery guardrails, and durable project context.
|
||
impact: Higher consistency/safety in future changes, especially around auth/i18n/public-service reliability.
|
||
status: completed
|
||
|
||
Summary:
|
||
Created repository-specific governance, prompt templates, context documentation, and memory protocols with seed entries.
|
||
|
||
Validation:
|
||
|
||
- File structure and contents created in-repo.
|
||
- Content aligned to detected stack and key paths (`next-auth`, Prisma, middleware, i18n rewrites, Redux HYDRATE/persist).
|
||
|
||
Follow-ups:
|
||
|
||
- Confirm owner assignments for open questions.
|
||
- Add automation checks to enforce key guardrails over time.
|
||
|
||
---
|
||
|
||
### CL-002: Priority 1 Refactor (Phase 1) — `actions/index.js` split foundation
|
||
|
||
date: 2026-03-12
|
||
author: Cline
|
||
scope: `actions/index.js`, `actions/core/*`, `actions/services/legacyActionsService.js`, `actions/clients/README.md`, `memory-bank/*`
|
||
type: change
|
||
rationale: Reduce coupling in the actions monolith by extracting core helpers while keeping backward-compatible exports for existing consumers.
|
||
impact: Lower regression blast radius for future actions-related changes; no intended functional behavior change.
|
||
status: completed
|
||
|
||
Summary:
|
||
Extracted helper concerns from `actions/index.js` into focused `actions/core` modules (`env`, `logger`, `hash`, `token`, `headers`). Replaced `actions/index.js` with a compatibility barrel and moved operational wrappers into `actions/services/legacyActionsService.js` with imports from core helpers.
|
||
|
||
Validation:
|
||
|
||
- Branch created: `0000-update-actions-monolith`.
|
||
- Compatibility preserved by re-exporting legacy service functions plus core exports from `actions/index.js`.
|
||
- Lint run for regression check.
|
||
|
||
Follow-ups:
|
||
|
||
- Phase 2: split `legacyActionsService` by domain into dedicated service/client modules.
|
||
- Add helper-focused automated tests for core modules and export parity checks.
|
||
|
||
---
|
||
|
||
### CL-003: Priority 1 Refactor (Phase 2) — service grouping via compatibility layer
|
||
|
||
date: 2026-03-12
|
||
author: Cline
|
||
scope: `actions/services/*`, `actions/index.js`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue reducing monolith risk by introducing domain service boundaries while preserving public action exports.
|
||
impact: Maintains backward compatibility for existing `../actions` imports; improves maintainability and safer future migration to targeted imports.
|
||
status: completed
|
||
|
||
Summary:
|
||
Added grouped service modules (`searchService`, `caseService`, `accountService`, `portalService`, `documentService`, `referenceDataService`, `notifyService`, `adminService`, `integrationService`) plus `actions/services/index.js` barrel. Updated `actions/index.js` to export from `./services` (and core modules), keeping legacy function names/signatures available.
|
||
|
||
Validation:
|
||
|
||
- Service export coverage check confirms all legacy exports are represented in grouped services.
|
||
- `npm run lint` still fails due legacy Next/ESLint option incompatibility (tooling issue, unchanged by this refactor).
|
||
|
||
Follow-ups:
|
||
|
||
- Incrementally migrate high-churn consumers to direct service imports.
|
||
- Add automated export-parity and helper unit tests.
|
||
|
||
---
|
||
|
||
### CL-004: Priority 1 Refactor (Phase 3) — targeted consumer import migration
|
||
|
||
date: 2026-03-12
|
||
author: Cline
|
||
scope: `components/case/summary.js`, `pages/api/email/notify.js`, selected `pages/api/endpoint/*`, `memory-bank/*`
|
||
type: change
|
||
rationale: Begin replacing broad `actions` barrel imports with focused service/core module imports in high-churn and representative endpoint areas.
|
||
impact: Lower coupling to monolithic action entrypoint while preserving behavior and public compatibility.
|
||
status: completed
|
||
|
||
Summary:
|
||
Migrated targeted consumers to direct imports from `actions/services/*` and `actions/core/*` without changing function signatures or route contracts.
|
||
|
||
Validation:
|
||
|
||
- Lint still blocked by repository ESLint/Next option compatibility issue (pre-existing tooling configuration).
|
||
- Manual testing remains required for search/case/myportal/auth/notify/file matrix.
|
||
|
||
Follow-ups:
|
||
|
||
- Continue phased import migration for additional `pages/api/endpoint/**` handlers.
|
||
- Add export-parity and helper-level tests as planned.
|
||
|
||
---
|
||
|
||
### CL-005: Priority 1 Refactor (Phase 4) — helper hardening + redacted logging baseline
|
||
|
||
date: 2026-03-12
|
||
author: Cline
|
||
scope: `actions/core/{guards,logger}.js`, `actions/index.js`, selected API handlers
|
||
type: change
|
||
rationale: Introduce low-risk guard and redaction primitives, then apply them to sensitive/high-churn API paths to reduce injection/privacy risk while preserving behavior.
|
||
impact: Better input hygiene and safer diagnostics in selected notify/login/contact flows; no intended contract changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
Added `guards` helper module (`isNonEmptyString`, `sanitizeString`, `escapeODataString`) and logger redaction utility (`redactSensitive`). Adopted these helpers in `notify`, `getpreferredlanguage_api`, and `createcrmtask_api` handlers.
|
||
|
||
Validation:
|
||
|
||
- `npm run lint` remains blocked by existing Next/ESLint options incompatibility in repository tooling.
|
||
- Targeted diff review confirms changes are scoped to helper hardening and selected handlers.
|
||
|
||
Follow-ups:
|
||
|
||
- Continue Phase 4 adoption for additional sensitive file/email/auth handlers.
|
||
- Add focused unit tests for `guards` and `redactSensitive` behavior.
|
||
|
||
---
|
||
|
||
### CL-006: Priority 1 Refactor — consumer migration pass (portal/form/admin utilities)
|
||
|
||
date: 2026-03-12
|
||
author: Cline
|
||
scope: `components/admin/*`, `components/case/*`, `components/myportal/*`, `components/elements/index.js`, `components/utils/index.js`, `lib/*`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue Phase 3-style decoupling by replacing broad `actions` barrel imports with focused service/core imports in high-use consumer files while preserving behavior.
|
||
impact: Lower coupling to monolithic action barrel and clearer dependency boundaries; no intended functional behavior change.
|
||
status: completed
|
||
|
||
Summary:
|
||
Migrated a targeted set of portal/form/admin utility consumers from `../../actions`/`../../../actions` to explicit imports from `actions/services/*` and `actions/core/*`. Also resolved migration-side compile issues in `components/myportal/topthree_reps.js` (duplicate import source and invalid `res.status` usage in client context).
|
||
|
||
Validation:
|
||
|
||
- In-scope consumer files now have no broad `from "../../actions"` / `from "../../../actions"` imports.
|
||
- `npm run lint` re-run; result unchanged and blocked by pre-existing Next/ESLint option incompatibility.
|
||
|
||
Follow-ups:
|
||
|
||
- Continue migrating remaining broad `actions` imports in `components/myportal/viewall.js`, `components/search/addresssearchresults.js`, unsubscribe flows, and selected API endpoints.
|
||
- Add focused manual smoke checks for myportal representations and awaiting-submission deletion/edit flows after this import migration.
|
||
|
||
---
|
||
|
||
### CL-007: Priority 1 Refactor — consumer migration pass (viewall/search/unsubscribe)
|
||
|
||
date: 2026-03-12
|
||
author: Cline
|
||
scope: `components/myportal/viewall.js`, `components/search/addresssearchresults.js`, `pages/unsubscribe/[watchlistid].js`, `pages/unsubscribeall/[watchlistid].js`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue Phase 3 decoupling by removing additional broad `actions` barrel imports in high-use myportal/search/unsubscribe flows and replacing them with focused service/core imports.
|
||
impact: Reduced coupling to monolithic action barrel with intended behavior parity; no API contract changes intended.
|
||
status: completed
|
||
|
||
Summary:
|
||
Migrated four additional consumers away from `../../actions`:
|
||
|
||
- `components/myportal/viewall.js` -> `actions/services/documentService`, `actions/services/portalService`, `actions/core/logger`
|
||
- `components/search/addresssearchresults.js` -> `actions/services/portalService`
|
||
- `pages/unsubscribe/[watchlistid].js` -> `actions/core/{hash,token,headers,logger}`
|
||
- `pages/unsubscribeall/[watchlistid].js` -> `actions/core/{hash,token,headers,logger}`
|
||
|
||
Validation:
|
||
|
||
- Regex verification confirms these four files no longer import from the broad `actions` barrel.
|
||
- Repository-wide broad-import scan now reports 11 matches total, including comment-only occurrences and remaining endpoint/file handlers pending migration.
|
||
|
||
Follow-ups:
|
||
|
||
- Migrate remaining non-comment broad imports in selected `pages/api/endpoint/*` and `pages/api/file/*` handlers.
|
||
- Run focused manual smoke checks for myportal view-all watch/unwatch + unsubscribe routes (EN/CY path sanity and negative paths).
|
||
|
||
---
|
||
|
||
### CL-008: Priority 1 Refactor — endpoint/file proxy import migration chunk
|
||
|
||
date: 2026-03-12
|
||
author: Cline
|
||
scope: `pages/api/endpoint/*`, `pages/api/file/*` (selected handlers), `memory-bank/*`
|
||
type: change
|
||
rationale: Continue Phase 3 migration by replacing broad `actions` barrel imports in selected endpoint/file proxy handlers with focused `actions/core/*` and service module imports.
|
||
impact: Further reduces monolithic import coupling in API paths while preserving existing request/response behavior and hash/token/header patterns.
|
||
status: completed
|
||
|
||
Summary:
|
||
Migrated these handlers away from broad `../../../actions` imports:
|
||
|
||
- `pages/api/endpoint/getmylpacases_api.js`
|
||
- `getLPA` -> `actions/services/referenceDataService`
|
||
- `azureHeaders`, `consoleLogger`, `getToken`, `hashAPIPath` -> `actions/core/*`
|
||
- removed local duplicated `hashAPIPath` implementation
|
||
- `pages/api/endpoint/getbasicdnssearchpaged_api.js`
|
||
- `pages/api/endpoint/getsearchdocumentdetailspaged_api.js`
|
||
- `pages/api/endpoint/getbasicsearchpaged_api.js`
|
||
- `pages/api/file/getawaitingsubmissionfromblobproxy.js`
|
||
- `pages/api/file/getrepsblobproxy.js`
|
||
- `pages/api/file/getbloblistproxy.js`
|
||
- `pages/api/file/createappealcompletemessageproxy_api.js`
|
||
|
||
Validation:
|
||
|
||
- Regex scans over `pages/api/endpoint` and `pages/api/file` show **0** remaining broad `from "../../../actions"` imports.
|
||
- `git status --short` confirms this chunk is isolated to the targeted endpoint/file handlers.
|
||
|
||
Follow-ups:
|
||
|
||
- Run focused manual smoke checks for touched endpoint/file flows (paged search APIs, LPA case retrieval, blob proxy endpoints).
|
||
- Continue hardening pass for sensitive handlers with guard/redaction helpers where not yet applied.
|
||
|
||
---
|
||
|
||
### CL-009: Priority 1 import-migration wave checked in + PR completed; handover to next branch
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/*` consumer and endpoint migrations (completed), planning handover docs
|
||
type: change
|
||
rationale: Record that the current import-migration wave has been checked in and completed via pull request, and set the next refactor slice to start on a new branch.
|
||
impact: Clear project continuity and reduced risk of overlap between completed import migration work and upcoming `legacyActionsService` decomposition.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Import migration wave is now completed, checked in, and PR’d.
|
||
- Latest commits in this wave include:
|
||
- `f0202bb` — viewall/search/unsubscribe focused imports
|
||
- `fa98535` — endpoint/file proxy focused imports
|
||
- `bef8f25` — stale legacy comment cleanup
|
||
- Next chunk is explicitly designated as a new-branch activity focused on splitting `actions/services/legacyActionsService.js` into smaller direct service/client modules.
|
||
|
||
Validation:
|
||
|
||
- Broad `.../actions` import scans now show no active matches in `.js` files (legacy references are comment-only/removed).
|
||
- Branch history confirms migration commits are present and ordered for safe rollback.
|
||
|
||
Follow-ups:
|
||
|
||
- Create new branch for Phase 5 decomposition work.
|
||
- Start with low-risk extraction slices from `legacyActionsService.js` (reference/search first), then portal/document batches.
|
||
|
||
---
|
||
|
||
### CL-010: Phase 5 kickoff — first legacy split slice (search/reference direct modules)
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/searchDirectService.js`, `actions/services/referenceDataDirectService.js`, `actions/services/{searchService,referenceDataService}.js`
|
||
type: change
|
||
rationale: Start Phase 5 decomposition on a new branch by extracting low-risk search/reference wrappers from `legacyActionsService.js` into direct domain modules while keeping service exports stable.
|
||
impact: Search/reference service exports now route through focused direct modules; compatibility signatures preserved for callers importing from service barrels.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Created branch `TASK21997-phase5-legacyactions-split` from `SIPS-Development`.
|
||
- Added `searchDirectService.js` containing extracted search/address/document-search wrapper implementations.
|
||
- Added `referenceDataDirectService.js` containing extracted reference-data wrapper implementations.
|
||
- Updated `searchService.js` and `referenceDataService.js` to import from the new direct modules instead of `legacyActionsService`.
|
||
|
||
Validation:
|
||
|
||
- `npm run lint` (result unchanged): still fails due pre-existing Next/ESLint options incompatibility in repository tooling.
|
||
- Import checks confirm:
|
||
- `searchService.js` -> `./searchDirectService`
|
||
- `referenceDataService.js` -> `./referenceDataDirectService`
|
||
- Branch/status check confirms only Phase 5 slice files are modified on the new branch.
|
||
|
||
Follow-ups:
|
||
|
||
- Continue portal/document extraction slices from `legacyActionsService.js` in small batches.
|
||
- After each slice, re-point corresponding grouped service modules and remove dead wrappers once no longer referenced.
|
||
|
||
---
|
||
|
||
### CL-011: Phase 5 document slice — direct document module extraction
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/documentDirectService.js`, `actions/services/documentService.js`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue Phase 5 decomposition by extracting document/file wrappers from `legacyActionsService.js` into a dedicated direct module while preserving grouped service API compatibility.
|
||
impact: Document/file grouped service exports now route through focused direct implementation; legacy coupling reduced for document domain with no expected caller contract changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Added `documentDirectService.js` with extracted blob/file upload, download, pdf, and container helpers.
|
||
- Re-pointed `documentService.js` imports to `./documentDirectService`.
|
||
- Kept export names and signatures unchanged at grouped service boundary.
|
||
|
||
Validation:
|
||
|
||
- Service import scan confirms `documentService.js` no longer imports from `legacyActionsService`.
|
||
- Remaining legacy-backed grouped modules: `portalService`, `accountService`, `caseService`, `adminService`, `notifyService`, `integrationService`.
|
||
- `npm run lint` completes with warnings only (no blocking errors).
|
||
|
||
Follow-ups:
|
||
|
||
- Next recommended slice: `portalDirectService` extraction, then `account/case`.
|
||
- Continue per-slice parity checks and legacy import reduction scan.
|
||
|
||
---
|
||
|
||
### CL-012: Phase 5 portal slice — direct portal module extraction
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/portalDirectService.js`, `actions/services/portalService.js`
|
||
type: change
|
||
rationale: Continue Phase 5 decomposition by extracting portal-domain wrappers from `legacyActionsService` into a direct module while preserving grouped service contract stability.
|
||
impact: Portal grouped exports now route through a focused direct module; reduced coupling to legacy monolith.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Added `portalDirectService.js`.
|
||
- Updated `portalService.js` to import from `./portalDirectService`.
|
||
|
||
Validation:
|
||
|
||
- Legacy import scan reduced remaining `legacyActionsService`-backed grouped modules.
|
||
- `npm run lint` completes with warnings only.
|
||
|
||
Follow-ups:
|
||
|
||
- Extract account + case direct modules.
|
||
|
||
---
|
||
|
||
### CL-013: Phase 5 account/case slice — direct module extraction
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/{accountDirectService,caseDirectService,accountService,caseService}.js`
|
||
type: change
|
||
rationale: Continue Phase 5 by moving account and case wrappers out of legacy module into dedicated direct modules while keeping grouped service API stable.
|
||
impact: Account/case grouped services now point to direct implementations; further legacy decoupling.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Added `accountDirectService.js` and `caseDirectService.js`.
|
||
- Re-pointed `accountService.js` and `caseService.js`.
|
||
|
||
Validation:
|
||
|
||
- Legacy import scan left only admin/integration/notify using legacy.
|
||
- `npm run lint` completes with warnings only.
|
||
|
||
Follow-ups:
|
||
|
||
- Extract admin + integration + notify direct modules.
|
||
|
||
---
|
||
|
||
### CL-014: Phase 5 final extraction slice — admin/integration/notify direct modules
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/{adminDirectService,integrationDirectService,notifyDirectService,adminService,integrationService,notifyService}.js`
|
||
type: change
|
||
rationale: Complete Phase 5 domain decomposition by extracting final legacy-backed grouped services into direct modules.
|
||
impact: All grouped service modules now route through direct implementations.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Added `adminDirectService.js`, `integrationDirectService.js`, `notifyDirectService.js`.
|
||
- Re-pointed `adminService.js`, `integrationService.js`, `notifyService.js`.
|
||
|
||
Validation:
|
||
|
||
- `actions/services` scan reports zero `./legacyActionsService` imports.
|
||
- `npm run lint` completes with warnings only.
|
||
|
||
Follow-ups:
|
||
|
||
- Remove dead `legacyActionsService.js` implementation.
|
||
|
||
---
|
||
|
||
### CL-015: Phase 5 cleanup — remove legacy actions service
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/legacyActionsService.js` (deleted)
|
||
type: change
|
||
rationale: Finalize Phase 5 after full routing migration by removing dead legacy implementation module.
|
||
impact: Monolithic legacy service removed; architecture now uses grouped service façade + direct per-domain modules.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Deleted `actions/services/legacyActionsService.js` after zero-reference verification.
|
||
|
||
Validation:
|
||
|
||
- Project scan confirms no `legacyActionsService` references in `.js` files.
|
||
- `npm run lint` completes with warnings only.
|
||
- `npm run build` succeeds.
|
||
|
||
Follow-ups:
|
||
|
||
- Begin next phase: post-split hardening/tests/logging cleanup.
|
||
|
||
---
|
||
|
||
### CL-016: Phase 6 hardening — parity tests, safe dedupe, and logging cleanup
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/*DirectService.js`, `actions/services/httpServiceUtils.js`, `tests/phase6/service-parity.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Start post-Phase-5 hardening by adding focused parity checks, reducing repeated axios/error-handling patterns without contract changes, and removing noisy logs in sensitive service paths.
|
||
impact: Improved maintainability and safety posture in service layer with preserved grouped-service signatures/return shapes; added regression guard for service export stability.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Added `tests/phase6/service-parity.test.cjs` to verify:
|
||
- grouped service import/export parity for search/reference/document/portal/account/case/admin/integration/notify
|
||
- `actions/services/index.js` re-export list stability
|
||
- Added `actions/services/httpServiceUtils.js` with shared helpers:
|
||
- `logAndReturnResponse`
|
||
- `buildEmptyValueErrorResponse`
|
||
- `logAndReturnEmptyValueErrorResponse`
|
||
- Applied low-risk dedupe refactors in:
|
||
- `searchDirectService.js`
|
||
- `referenceDataDirectService.js`
|
||
- `caseDirectService.js`
|
||
- `adminDirectService.js`
|
||
- Removed debug `console.log` traces from sensitive/noisy direct service flows in:
|
||
- `searchDirectService.js`
|
||
- `documentDirectService.js`
|
||
- `portalDirectService.js`
|
||
- `caseDirectService.js`
|
||
- `adminDirectService.js`
|
||
- Added focused behavioural service test pack:
|
||
- `tests/phase6/service-behaviour.test.cjs`
|
||
- mocked axios and logger checks to assert success/error contract handling for selected critical functions.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `npm run lint` -> warnings only (pre-existing warning set)
|
||
- Targeted smoke/negative checks on local dev server:
|
||
- `GET /advancedsearch` and `GET /cy/advancedsearch` -> 200
|
||
- `GET /case` and `GET /cy/case` -> 200
|
||
- `GET /myportal` and `GET /cy/myportal` -> 307 to `/auth/signin` (unauthenticated negative path)
|
||
- `GET /api/file/getbloblistproxy?container=test&casefolderID=test` -> 400 (negative path)
|
||
- `POST /api/email/notify` with `{}` -> 400 (negative path)
|
||
- `GET /searchresults` and `/cy/searchresults` -> 500 due pre-existing SSR serialization issue (`initialState.search.searchString` undefined)
|
||
|
||
Follow-ups:
|
||
|
||
- Investigate/fix pre-existing `/searchresults` SSR serialization issue before broader search smoke confidence sign-off.
|
||
- Optional next increment: extend behavioural coverage to document/portal/account/notify/integration direct-service contracts.
|
||
|
||
---
|
||
|
||
### CL-017: Phase 7 hardening — search SSR fix + behavioural expansion for remaining service domains
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/searchresults.js`, `tests/phase7/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Start Phase 7 from a new branch based on `origin/SIPS-Development`, fix known pre-existing `/searchresults` SSR serialization failure, and extend behavioural/negative-path coverage for remaining direct-service domains.
|
||
impact: Search results SSR now safely serializes when query `q` is absent; behavioural confidence improved across document/portal/account/notify/integration service contracts with no signature/return-shape changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Created branch: `TASK21988a-phase7-postphase6-hardening` (from `origin/SIPS-Development`).
|
||
- Fixed pre-existing SSR issue in `pages/searchresults.js` by changing:
|
||
- `setSearch(query.q)` -> `setSearch(query?.q || "")`
|
||
- Added `tests/phase7/service-behaviour.test.cjs` with mocked-axios behavioural assertions for:
|
||
- document
|
||
- portal
|
||
- account
|
||
- notify
|
||
- integration
|
||
- Included feasible negative-path checks for relay/hash/token-sensitive behavior patterns (hashed URL composition and existing per-function error contracts).
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `npm run lint` -> warnings only, no new lint errors introduced
|
||
- Manual smoke/negative-path checks (local dev on `localhost:3001` due `3000` in use):
|
||
- `/searchresults`, `/cy/searchresults` -> 200
|
||
- `/case`, `/cy/case` -> 200
|
||
- `/myportal`, `/cy/myportal` -> 307 to `/auth/signin`
|
||
- `/api/file/getbloblistproxy?container=test&casefolderID=test` -> 400
|
||
- `POST /api/email/notify` with `{}` -> 400
|
||
|
||
Follow-ups:
|
||
|
||
- Continue incremental hardening in sensitive relay/hash/token flows without changing external contracts.
|
||
- Keep lint warning backlog separate from this refactor stream unless explicitly scoped.
|
||
|
||
Rollback plan:
|
||
|
||
- Revert `pages/searchresults.js` and remove `tests/phase7/service-behaviour.test.cjs` if regression is observed.
|
||
|
||
---
|
||
|
||
### CL-018: Phase 8 hardening — hash enforcement and negative-path standardization in sensitive APIs
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{deleteblobcase,deleteblobrep,createappealcompletemessage_api}.js`, `pages/api/endpoint/getportallogin_api.js`, `actions/services/{documentDirectService,portalDirectService}.js`, `tests/phase8/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Deliver a small reversible hardening slice by re-enforcing hash guards in high-risk handlers, standardizing invalid-input negative paths, and reducing noisy/sensitive logging while preserving external contracts.
|
||
impact: Stronger hash/integrity guard posture and consistent 400 negative paths for invalid/missing hash and required params; no intended response-shape or signature changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Started from latest `origin/SIPS-Development` on new branch `TASK22017-phase8-hardening-slice`.
|
||
- Re-enabled/enforced hash validation in:
|
||
- `deleteblobcase`
|
||
- `deleteblobrep`
|
||
- `createappealcompletemessage_api`
|
||
- Standardized early 400 handling for missing required query params where feasible:
|
||
- container/casefolder/repfile/tempcaseref/emailAddress checks as applicable
|
||
- Hardened `getportallogin_api`:
|
||
- explicit early validation for email/hash before token fetch
|
||
- removed unnecessary lodash branch complexity while preserving output behavior
|
||
- Improved logging discipline in sensitive flow:
|
||
- removed noisy `console.log` traces from `createappealcompletemessage_api`
|
||
- switched error logging to `consoleLogger`
|
||
- Added parity updates required for existing callers after hash re-enforcement:
|
||
- `documentDirectService` now appends hash on `deleteblobcase` and `deleteblobrep`
|
||
- `portalDirectService` now appends hash for `createappealcompletemessage_api` call using existing hash path contract
|
||
- Added focused phase-8 tests:
|
||
- `tests/phase8/service-behaviour.test.cjs`
|
||
- covers invalid/missing hash and missing key inputs as applicable across the 4 target handlers
|
||
- includes one valid-hash happy-path contract check for `getportallogin_api` via mocks
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings; no new lint errors)
|
||
- Manual HTTP checks (local server `http://localhost:3001`):
|
||
- invalid/missing hash for all 4 handlers -> 400
|
||
- missing required key params where tested -> 400
|
||
- valid-hash spot-check (`getportallogin_api`) still returned 400 due upstream relay/CRM behavior in local env (hash gate passed, downstream dependency failed)
|
||
|
||
Follow-ups:
|
||
|
||
- Investigate local relay/CRM dependency behavior for `getportallogin_api` happy path in integrated environment.
|
||
- Continue incremental hash/negative-path hardening for other sensitive `pages/api/file/**` handlers still carrying commented bypass patterns.
|
||
|
||
Rollback plan:
|
||
|
||
- Revert the four hardened API files and the two direct-service hash append updates.
|
||
- Remove `tests/phase8/service-behaviour.test.cjs` if the full phase-8 slice is rolled back.
|
||
- Re-run phase6/phase7 baseline tests and lint to confirm rollback parity.
|
||
|
||
---
|
||
|
||
### CL-019: Phase 9 hardening — additional file-handler hash enforcement slice
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{createrepcompletemessage_api,upload,uploadsinglefile,setupcontainer}.js`, `actions/services/{portalDirectService,documentDirectService}.js`, `tests/phase9/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue incremental hardening with a small reversible slice focused on additional sensitive file handlers still showing bypassed/commented hash checks or inconsistent negative-path behavior.
|
||
impact: Stronger hash/integrity guard posture and standardized 400 negative paths for invalid/missing hash and key params; no intended signature or response-shape contract changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Started from latest `origin/SIPS-Development` on branch `TASK22019-phase-9-hardening`.
|
||
- Re-enabled/enforced hash validation and early 400 guards in:
|
||
- `createrepcompletemessage_api`
|
||
- `upload`
|
||
- `uploadsinglefile`
|
||
- `setupcontainer`
|
||
- Reduced noisy logs in sensitive paths and retained structured error logging where applicable.
|
||
- Added required caller parity updates:
|
||
- `portalDirectService.sendRepCompleteMessage` now appends hash
|
||
- `documentDirectService.uploadFiles/uploadRepFiles/uploadSingleFile` now append hash
|
||
- Added focused phase-9 tests:
|
||
- `tests/phase9/service-behaviour.test.cjs`
|
||
- negative-path coverage for the 4 selected phase-9 handlers
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings; no new lint errors)
|
||
- Manual HTTP negative-path checks on `localhost:3000`:
|
||
- missing/invalid hash for each selected handler -> 400
|
||
- missing required key params where tested -> 400
|
||
- Valid-hash HTTP spot-check:
|
||
- `POST /api/file/uploadsinglefile?hash=<valid>` -> 200 (hash generated from `.env.local` key)
|
||
|
||
Follow-ups:
|
||
|
||
- Continue incremental hardening slices for remaining sensitive handlers with commented/bypassed hash checks.
|
||
|
||
Rollback plan:
|
||
|
||
- Revert the 4 hardened API handlers and 2 caller parity service files.
|
||
- Remove `tests/phase9/service-behaviour.test.cjs` if rolling back full phase-9 slice.
|
||
- Re-run phase6/7/8/9 tests and lint to confirm rollback parity.
|
||
|
||
---
|
||
|
||
### CL-020: Phase 10 hardening — file retrieval handlers negative-path standardization
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{getawaitingsubmissionfromblob,getprogressobjblob,getbloblist,getrepsblob}.js`, `tests/phase10/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue connected hardening slices on the same work-item branch, targeting additional sensitive file retrieval handlers with inconsistent early guards and legacy commented hash/debug handling.
|
||
impact: Stronger and more consistent 400 negative-path behavior for missing/invalid hash and missing key params, with no intended signature or response-shape contract changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Continued from Phase 9 on branch `TASK22019-phase-9-hardening`.
|
||
- Hardened 4 additional handlers:
|
||
- `getawaitingsubmissionfromblob`
|
||
- `getprogressobjblob`
|
||
- `getbloblist`
|
||
- `getrepsblob`
|
||
- Added explicit early guards for required query/hash inputs.
|
||
- Standardized hash mismatch handling to early 400 return.
|
||
- Removed legacy commented debug blocks in touched handlers.
|
||
- Added focused phase-10 tests:
|
||
- `tests/phase10/service-behaviour.test.cjs`
|
||
- includes negative-path coverage for all 4 handlers and one valid-hash mocked happy path.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||
- Manual HTTP checks (`localhost:3000`):
|
||
- missing hash for each selected phase-10 handler -> 400
|
||
- valid hash `getbloblist` spot-check -> 500 due local downstream/storage dependency constraints
|
||
|
||
Follow-ups:
|
||
|
||
- Continue next incremental slice for remaining sensitive handlers with commented/bypassed hash checks.
|
||
|
||
Rollback plan:
|
||
|
||
- Revert the 4 hardened API handlers.
|
||
- Remove `tests/phase10/service-behaviour.test.cjs` if rolling back full phase-10 slice.
|
||
- Re-run phase6/7/8/9/10 tests + lint to confirm rollback parity.
|
||
|
||
---
|
||
|
||
### CL-021: Phase 11 hardening — delete/bloblist hash guard standardization
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{getbloblist,deleteblob,deleteawaitingsubmissionfromblob}.js`, `tests/phase11/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue connected hardening slices on the same work-item branch, targeting additional sensitive blob/delete handlers with inconsistent early guards and legacy commented traces.
|
||
impact: More consistent and explicit 400 negative-path handling for missing/invalid hash and key params, with no intended signature or response-shape contract changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Continued on branch `TASK22019-phase-9-hardening`.
|
||
- Hardened 3 additional handlers:
|
||
- `getbloblist`
|
||
- `deleteblob`
|
||
- `deleteawaitingsubmissionfromblob`
|
||
- Added explicit early guards for required query/hash inputs.
|
||
- Standardized hash mismatch handling to early 400 return.
|
||
- Removed legacy commented debug traces in touched handlers.
|
||
- Added focused phase-11 tests:
|
||
- `tests/phase11/service-behaviour.test.cjs`
|
||
- includes negative-path coverage and one valid-hash mocked happy path.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||
- Manual HTTP checks (`localhost:3000`):
|
||
- missing/invalid hash for selected phase-11 handlers -> 400
|
||
- valid-hash `getbloblist` spot-check -> 500 due local downstream/storage dependency constraints
|
||
|
||
Follow-ups:
|
||
|
||
- Continue next incremental slice for remaining sensitive handlers with commented/bypassed hash checks.
|
||
|
||
Rollback plan:
|
||
|
||
- Revert the 3 hardened API handlers.
|
||
- Remove `tests/phase11/service-behaviour.test.cjs` if rolling back full phase-11 slice.
|
||
- Re-run phase6/7/8/9/10/11 tests + lint to confirm rollback parity.
|
||
|
||
---
|
||
|
||
### CL-022: Phase 12 hardening — download/proxy param and hash guard standardization
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{downloadblob,getbloblistproxy,getrepsblobproxy,getawaitingsubmissionfromblobproxy}.js`, `tests/phase12/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue connected hardening slices on the same work-item branch, targeting additional sensitive download/proxy handlers with inconsistent early guards.
|
||
impact: More consistent and explicit 400 negative-path handling for missing/invalid hash and key params, with no intended signature or response-shape contract changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Continued on branch `TASK22019-phase-9-hardening`.
|
||
- Hardened 4 additional handlers:
|
||
- `downloadblob`
|
||
- `getbloblistproxy`
|
||
- `getrepsblobproxy`
|
||
- `getawaitingsubmissionfromblobproxy`
|
||
- Added explicit early guards for required query/hash inputs.
|
||
- Standardized hash mismatch handling to early 400 return for `downloadblob`.
|
||
- Added focused phase-12 tests:
|
||
- `tests/phase12/service-behaviour.test.cjs`
|
||
- includes negative-path coverage and one valid-hash mocked happy path.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||
- Manual HTTP checks (`localhost:3000`):
|
||
- missing/invalid inputs for selected phase-12 handlers -> 400
|
||
- valid-hash `downloadblob` spot-check -> 500 due local downstream/storage dependency constraints
|
||
|
||
Follow-ups:
|
||
|
||
- Continue next incremental slice for remaining sensitive handlers with commented/bypassed hash checks.
|
||
|
||
Rollback plan:
|
||
|
||
- Revert the 4 hardened API handlers.
|
||
- Remove `tests/phase12/service-behaviour.test.cjs` if rolling back full phase-12 slice.
|
||
- Re-run phase6/7/8/9/10/11/12 tests + lint to confirm rollback parity.
|
||
|
||
---
|
||
|
||
### CL-023: Phase 13 hardening — delete and involvement handler guard standardization
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{deleteblobcase,deleteblobrep,createcaseinvolvement_api,createrepinvolvement_api}.js`, `tests/phase13/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue connected hardening slices on the same work-item branch, targeting additional sensitive delete/involvement handlers with inconsistent early guard and logging behavior.
|
||
impact: More consistent and explicit 400 negative-path handling for missing/invalid hash and required body keys, with no intended signature or response-shape contract changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Continued on branch `TASK22019-phase-9-hardening`.
|
||
- Hardened 4 additional handlers:
|
||
- `deleteblobcase`
|
||
- `deleteblobrep`
|
||
- `createcaseinvolvement_api`
|
||
- `createrepinvolvement_api`
|
||
- Added explicit early guards for required hash/body inputs.
|
||
- Standardized hash mismatch handling to early 400 return for delete handlers.
|
||
- Removed noisy body/query logs from involvement handlers.
|
||
- Added focused phase-13 tests:
|
||
- `tests/phase13/service-behaviour.test.cjs`
|
||
- includes negative-path coverage and valid-input mocked happy paths.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||
- Manual HTTP checks (`localhost:3000`):
|
||
- missing/invalid inputs for selected phase-13 handlers -> 400
|
||
- valid-hash `deleteblobcase` spot-check -> 500 due local downstream/storage dependency constraints
|
||
|
||
Follow-ups:
|
||
|
||
- Continue next incremental slice for remaining sensitive handlers with commented/bypassed hash checks.
|
||
|
||
Rollback plan:
|
||
|
||
- Revert the 4 hardened API handlers.
|
||
- Remove `tests/phase13/service-behaviour.test.cjs` if rolling back full phase-13 slice.
|
||
- Re-run phase6/7/8/9/10/11/12/13 tests + lint to confirm rollback parity.
|
||
|
||
---
|
||
|
||
### CL-024: Phase 14 fix — authenticated server-side hash signing for browser callers
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/{documentDirectService,portalDirectService}.js`, `pages/api/endpoint/gethash_api.js`, `tests/phase14/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Fix runtime break in authenticated new-appeal journey where client-side hash generation attempted to use server-only `HASHKEY`.
|
||
impact: Restores browser flow while preserving hash-guard posture by moving hash generation to authenticated server endpoint; no intended external API contract changes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Added `gethash_api` endpoint to sign allow-listed API paths server-side.
|
||
- Endpoint enforces authenticated session and rejects unsupported paths.
|
||
- Updated direct services to fetch hash from signer endpoint for browser calls.
|
||
- Added server-side fallback hashing only when `HASHKEY` exists (non-browser contexts).
|
||
- Added phase-14 tests for missing-path, invalid-path, unauthenticated, and happy-path signer behavior.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `npm run lint` -> warnings only (pre-existing warnings)
|
||
|
||
Follow-ups:
|
||
|
||
- Keep signer allow-list tight and expand only for explicitly required browser-side hash use cases.
|
||
- Continue removing legacy client-side direct hash assumptions as encountered.
|
||
|
||
---
|
||
|
||
### CL-025: Phase 14 closeout follow-up — portal-login signer adoption + contract alignment fixes
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/accountDirectService.js`, `pages/api/endpoint/gethash_api.js`, `tests/phase7/service-behaviour.test.cjs`, `tests/phase14/service-behaviour.test.cjs`, `pages/api/file/getrepsblob.js`, `components/elements/index.js`, `memory-bank/*`
|
||
type: change
|
||
rationale: Extend browser-safe hash signing to portal-login call path, keep signer allow-list explicit, and align an over-tightened file guard with actual endpoint contract discovered during runtime verification.
|
||
impact: Removes remaining browser-side hash risk in portal login path; preserves API response contracts while restoring route-accurate parameter validation and resolving Quill runtime import issue.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Updated `accountDirectService.getPortalLogin` to use `/api/endpoint/gethash_api` for signed hash retrieval in browser contexts.
|
||
- Added `/api/endpoint/getportallogin_api` to signer endpoint allow-list in `gethash_api.js`.
|
||
- Updated tests to reflect signer-driven behavior and allow-list coverage:
|
||
- `tests/phase7/service-behaviour.test.cjs`
|
||
- `tests/phase14/service-behaviour.test.cjs`
|
||
- Applied follow-up runtime/contract fixes confirmed during manual verification:
|
||
- `pages/api/file/getrepsblob.js`: removed `casefolderID` hard requirement and pass-through argument to align with route usage (`container + hash`).
|
||
- `components/elements/index.js`: restored missing `updateLinks` import required by Quill-related flow.
|
||
- Branch pushed with follow-up commits:
|
||
- `6094874`
|
||
- `b8fa514`
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
Follow-ups:
|
||
|
||
- Keep signer allow-list expansion minimal and task-driven.
|
||
- Continue replacing remaining browser-side direct hash assumptions only where flows require it.
|
||
- Confirm work-item/branch naming alignment for any subsequent phase slices if strict tracker continuity is required.
|
||
|
||
---
|
||
|
||
### CL-026: Phase 15 hardening — consistency guards for additional hash-sensitive file handlers
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{upload,uploadsinglefile,createappealcompletemessage_api,setupcontainer}.js`, `tests/phase15/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Deliver a small reversible consistency-only hardening slice by standardizing missing/invalid hash negative paths and required input handling in additional sensitive file handlers.
|
||
impact: Consistent early 400 behavior for missing/invalid hash and missing required params while preserving existing response shapes/signatures.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Started new branch from `origin/SIPS-Development`: `TASK22028-phase15-hardening-slice`.
|
||
- Applied minimal hardening updates:
|
||
- `upload.js`: explicit missing-hash guard before hash comparison.
|
||
- `uploadsinglefile.js`: explicit missing-hash guard before hash comparison.
|
||
- `createappealcompletemessage_api.js`: added missing-hash guard to existing required-input guard block.
|
||
- `setupcontainer.js`: standardized to early-return on hash mismatch; contract and status behavior preserved.
|
||
- Added focused tests:
|
||
- `tests/phase15/service-behaviour.test.cjs`
|
||
- covers missing-hash negative paths for all selected handlers
|
||
- includes required-input negative paths and one valid-hash happy-path shape check.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
- Manual checks on `localhost:3002`:
|
||
- invalid/missing hash for each selected handler -> 400
|
||
- missing required params where applicable -> 400
|
||
- valid-hash spot-check (`setupcontainer`) -> 200
|
||
|
||
Follow-ups:
|
||
|
||
- Continue small-batch consistency hardening for remaining sensitive handlers where guard patterns are still inconsistent.
|
||
- Keep manual happy-path checks constrained to feasible local dependencies; document downstream/environment-caused failures separately.
|
||
|
||
---
|
||
|
||
### CL-027: Phase 16 hardening — file proxy required-input guard consistency slice
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{getbloblistproxy,getrepsblobproxy,getawaitingsubmissionfromblobproxy}.js`, `tests/phase16/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Continue within the same branch using separate commits to apply a small consistency-only hardening slice for sensitive file proxy handlers.
|
||
impact: More consistent required-input validation and cleaner proxy handler internals without changing response-shape/signature contracts.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Continued on `TASK22028-phase15-hardening-slice` as a separate commit.
|
||
- Standardized required-input guards using a local `hasValue` helper in 3 file proxy handlers.
|
||
- Removed unused imports/constants from touched files.
|
||
- Added `tests/phase16/service-behaviour.test.cjs` with negative-path coverage and one valid-input contract check.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `npm run lint` -> warnings only (pre-existing)
|
||
- Manual checks (`localhost:3002`): missing required inputs across selected proxies -> 400
|
||
|
||
Follow-ups:
|
||
|
||
- Continue incremental endpoint/file proxy consistency slices with same contract-preserving constraints.
|
||
|
||
---
|
||
|
||
### CL-028: Follow-up fix — signer allow-list expanded for deleteblobcase browser path
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/endpoint/gethash_api.js`, `tests/phase14/service-behaviour.test.cjs`
|
||
type: change
|
||
rationale: Resolve runtime failure where browser-side `deleteAwaitingSubmissionsFromBlob` hash signing requested a path not present in signer allow-list.
|
||
impact: Restores browser-safe hash signing for delete-blob-case flow without weakening auth/session guard on signer endpoint.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Added `/api/file/deleteblobcase` to `gethash_api` allow-list.
|
||
- Added focused test coverage in phase-14 suite for the new allow-listed path.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (6/6)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (10/10)
|
||
- `npm run lint` -> warnings only (pre-existing)
|
||
|
||
Follow-ups:
|
||
|
||
- Keep signer allow-list additions minimal and path-specific.
|
||
|
||
---
|
||
|
||
### CL-029: Follow-up fix — signer coverage for additional delete flows
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `actions/services/{portalDirectService,documentDirectService}.js`, `pages/api/endpoint/gethash_api.js`, `tests/phase7/service-behaviour.test.cjs`, `tests/phase14/service-behaviour.test.cjs`
|
||
type: change
|
||
rationale: Resolve browser hash-signing gaps for additional delete operations still using direct client hash generation.
|
||
impact: Restores browser-safe signing for delete watched cases, delete my representations, and delete blob representation/awaiting-submission paths while retaining authenticated allow-list signer model.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Updated signer allow-list to include:
|
||
- `/api/endpoint/deletemyrepresentations_api`
|
||
- `/api/endpoint/deletewatchedcases_api`
|
||
- `/api/file/deleteblobrep`
|
||
- Migrated direct service calls to signer-based hash retrieval for:
|
||
- `portalDirectService.deleteWatchedCases`
|
||
- `portalDirectService.deleteMyRepresentations`
|
||
- `documentDirectService.deleteAwaitingSubmissionsFromBlob`
|
||
- `documentDirectService.deleteMyRepresentationsFromBlob`
|
||
- Extended focused tests:
|
||
- `tests/phase7/service-behaviour.test.cjs` (service signer usage)
|
||
- `tests/phase14/service-behaviour.test.cjs` (allow-list coverage)
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
|
||
- `npm run lint` -> warnings only (pre-existing)
|
||
|
||
Follow-ups:
|
||
|
||
- Keep allow-list expansion path-scoped and driven by concrete browser-call requirements only.
|
||
|
||
---
|
||
|
||
### CL-030: Follow-up fix — myportal delete caseRef alignment + i18n namespace
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `components/myportal/{viewall,topthree_reps}.js`, `i18n.js`, `memory-bank/*`
|
||
type: change
|
||
rationale: Align representation delete calls to stable case reference identifier and resolve missing locale namespace mapping for new-appeal route context.
|
||
impact: Prevents delete-call identifier mismatches in myportal representation flows and restores expected translation namespace availability for `/newappeal/[appealtypes]`.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Updated delete-representation callers to pass `caseRef` instead of display/ticket values in:
|
||
- `components/myportal/topthree_reps.js`
|
||
- `components/myportal/viewall.js`
|
||
- Included related view-all styling/class tidy updates and watched-case list refresh filtering adjustment.
|
||
- Added missing `myportal` namespace for route key:
|
||
- `i18n.js` -> `/newappeal/[appealtypes]`
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
|
||
- `npm run lint` -> warnings only (pre-existing)
|
||
|
||
Follow-ups:
|
||
|
||
- Keep delete calls consistently keyed on case reference across portal/view-all/top-three variants.
|
||
|
||
---
|
||
|
||
### CL-031: Phase 17 closeout — remaining sensitive file handler consistency hardening
|
||
|
||
date: 2026-03-13
|
||
author: Cline
|
||
scope: `pages/api/file/{generatepdf,generateappealpdf,createappealcompletemessageproxy_api}.js`, `tests/phase17/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Complete the remaining small hardening closeout slice in this stream by standardizing hash/input negative-path behavior and reducing noisy logging in the last priority-sensitive file handlers.
|
||
impact: Consistent 400 behavior for missing/invalid hash and missing required inputs in selected handlers; preserved response shapes/signatures.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Branch created from `origin/SIPS-Development`: `TASK22057-phase17-hardening-closeout`.
|
||
- Hardened:
|
||
- `generatepdf.js`
|
||
- `generateappealpdf.js`
|
||
- `createappealcompletemessageproxy_api.js`
|
||
- Added early 400 guards for missing/invalid hash and required params where applicable.
|
||
- Removed noisy direct logging in touched handlers.
|
||
- Added focused test pack `tests/phase17/service-behaviour.test.cjs`.
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
|
||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase17/service-behaviour.test.cjs` -> pass (6/6)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||
|
||
Follow-ups:
|
||
|
||
- If desired, run additional integrated HTTP/manual checks in an environment with full relay/storage dependencies for end-to-end happy-path confirmation beyond mocked behaviour tests.
|
||
|
||
---
|
||
|
||
### CL-032: Phase 18 additional consolidation slices — endpoint/file consistency and guard hygiene
|
||
|
||
date: 2026-03-14
|
||
author: Cline
|
||
scope: `pages/api/endpoint/{deletewatchedcases_api,getaccounts_api,getbasicsearchpaged_api,getappealpdfdocuments_api}.js`, `pages/api/file/{deleteblob,deleteawaitingsubmissionfromblob,getprogressobjblob,getbloblist,createcase_api,updatecase_api,editRepJson}.js`, `tests/phase18/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Complete the user-requested three additional small, reversible hardening slices (logging hygiene, hash-guard flow consistency, and required-input guard consistency) without broad refactor or contract drift.
|
||
impact: Improves consistency of negative-path behavior and reduces noisy logging in selected sensitive handlers while preserving response/signature contracts.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Implemented all three requested additional slices:
|
||
1. endpoint logging/input hygiene
|
||
2. file hash-guard flow consistency
|
||
3. create/update input-guard + logging hygiene
|
||
- Endpoint updates:
|
||
- `deletewatchedcases_api`: added required `watchedCaseID` early 400 guard and removed direct URL logging.
|
||
- `getaccounts_api`: added required `emailAddress` early 400 guard and removed direct query logging.
|
||
- `getbasicsearchpaged_api`: added required `searchString` early 400 guard and removed noisy query logging.
|
||
- `getappealpdfdocuments_api`: added required `incidentid` early 400 guard and removed direct URL logging.
|
||
- File handler updates:
|
||
- standardized hash-check flow by removing redundant post-validation branches in:
|
||
- `deleteblob`
|
||
- `deleteawaitingsubmissionfromblob`
|
||
- `getprogressobjblob`
|
||
- `getbloblist`
|
||
- added required-input early 400 guards in:
|
||
- `createcase_api` (contact/appealType/container/lpa)
|
||
- `updatecase_api` (collection/appealObj/incident/body)
|
||
- removed noisy tag logging in `editRepJson`.
|
||
- Added focused test pack:
|
||
- `tests/phase18/service-behaviour.test.cjs` with negative-path and contract-preserving happy-path checks (8/8 pass).
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
|
||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase17/service-behaviour.test.cjs` -> pass (6/6)
|
||
- `node tests/phase18/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `npm run lint` -> warnings only (pre-existing `react-hooks/exhaustive-deps` warnings)
|
||
|
||
Follow-ups:
|
||
|
||
- Optional: execute integrated manual HTTP matrix for phase-18 touched handlers in an environment with full relay/storage dependencies for non-mocked happy-path verification.
|
||
|
||
---
|
||
|
||
### CL-033: Phase 19 endpoint consistency slice — createwatchedcases guard hardening + noisy log cleanup
|
||
|
||
date: 2026-03-14
|
||
author: Cline
|
||
scope: `pages/api/endpoint/{createwatchedcases_api,getappealtypes_api,getdnslist_api}.js`, `tests/phase19/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Deliver a small reversible consistency-only slice for selected sensitive endpoint handlers by standardizing invalid required input handling and removing noisy logging without changing contracts.
|
||
impact: Improves negative-path consistency and logging hygiene for selected handlers; response signatures/shapes preserved.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- `createwatchedcases_api` now consistently rejects missing/malformed required `@odata.bind` values with early 400.
|
||
- Removed noisy query URL logging in:
|
||
- `getappealtypes_api`
|
||
- `getdnslist_api`
|
||
- Added focused behavioural test pack:
|
||
- `tests/phase19/service-behaviour.test.cjs` (5 tests)
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
|
||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase17/service-behaviour.test.cjs` -> pass (6/6)
|
||
- `node tests/phase18/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase19/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
Follow-ups:
|
||
|
||
- Continue same small-batch consistency pattern for remaining sensitive endpoint handlers only where clear guard/logging drift exists.
|
||
|
||
---
|
||
|
||
### CL-034: Phase 20 endpoint consistency slice — dns/basic-search guard + logging cleanup
|
||
|
||
date: 2026-03-14
|
||
author: Cline
|
||
scope: `pages/api/endpoint/{getbasicdnssearch_api,getbasicdnsurlsearch_api,getbasicsearchdetailspaged_api}.js`, `tests/phase20/service-behaviour.test.cjs`, `memory-bank/*`
|
||
type: change
|
||
rationale: Deliver a small reversible consistency-only slice by removing noisy logging and standardizing required-input negative-path handling in additional sensitive endpoint handlers.
|
||
impact: Improves endpoint negative-path consistency and logging hygiene while preserving response signatures/shapes.
|
||
status: completed
|
||
|
||
Summary:
|
||
|
||
- Removed noisy `console.log` query logging in `getbasicdnssearch_api`.
|
||
- Added early 400 handling for missing/empty `searchString` in `getbasicdnsurlsearch_api`.
|
||
- Added early 400 handling for missing required params (`appealTypeName`, `primaryIdAttribute`, `incidentID`) in `getbasicsearchdetailspaged_api`.
|
||
- Added focused behavioural test pack:
|
||
- `tests/phase20/service-behaviour.test.cjs` (5 tests)
|
||
|
||
Validation:
|
||
|
||
- `node tests/phase6/service-parity.test.cjs` -> pass
|
||
- `node tests/phase6/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase7/service-behaviour.test.cjs` -> pass (12/12)
|
||
- `node tests/phase8/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase9/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase10/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase11/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase12/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase13/service-behaviour.test.cjs` -> pass (7/7)
|
||
- `node tests/phase14/service-behaviour.test.cjs` -> pass (9/9)
|
||
- `node tests/phase15/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase16/service-behaviour.test.cjs` -> pass (4/4)
|
||
- `node tests/phase17/service-behaviour.test.cjs` -> pass (6/6)
|
||
- `node tests/phase18/service-behaviour.test.cjs` -> pass (8/8)
|
||
- `node tests/phase19/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `node tests/phase20/service-behaviour.test.cjs` -> pass (5/5)
|
||
- `npm run lint` -> warnings only (pre-existing hook dependency warnings)
|
||
|
||
Follow-ups:
|
||
|
||
- Continue same small-batch consistency pattern for remaining endpoint handlers where required-input/logging drift is clear.
|