47 lines
2.3 KiB
Markdown
47 lines
2.3 KiB
Markdown
# AI Context — PEDW FrontEnd
|
|
|
|
## Overview
|
|
|
|
PEDW FrontEnd is a Next.js 14 (Pages Router) bilingual (EN/CY) public-service portal for planning case search, case detail/document viewing, and authenticated portal workflows (appeals, representations, watchlists, dashboard views).
|
|
|
|
## Architecture
|
|
|
|
- Monorepo-style Next.js app with UI routes in `pages/` and API handlers in `pages/api/**`.
|
|
- Redux (`next-redux-wrapper` + `redux-persist`) for shared client/server state.
|
|
- `next-auth` for auth/session with Prisma adapter.
|
|
- Integration-heavy BFF pattern: API routes proxy to relay/CRM and storage/notify services.
|
|
|
|
## Key components
|
|
|
|
- `components/breadcrumbs.js`: central breadcrumb/back-link behavior.
|
|
- `components/case/summary.js`: case-detail tabs, representation eligibility logic, watch/email actions.
|
|
- `actions/index.js`: shared API utilities, token/header/hash helpers, many side-effect wrappers.
|
|
- `pages/api/endpoint/**`: relay-backed business-data APIs.
|
|
- `pages/api/file/**`: blob/document/PDF/upload endpoints.
|
|
|
|
## Data model boundaries
|
|
|
|
- Prisma (`prisma/schema.prisma`) stores auth/session entities only (`User`, `Account`, `Session`, `VerificationToken`) on SQL Server.
|
|
- Business/case data is external (Dynamics/relay path), not persisted as Prisma domain models here.
|
|
|
|
## API/integration patterns
|
|
|
|
- Many endpoint handlers compute HMAC hash query params (`hash`) for relay-bound requests.
|
|
- Token acquisition + OData headers are reused across proxy handlers.
|
|
- File endpoints often validate request hash for sensitive blob actions.
|
|
- GOV.UK Notify used for email, including language-specific template selection in some flows.
|
|
|
|
## Infrastructure/tooling
|
|
|
|
- Scripts: `npm run dev`, `npm run build`, `npm start`, `npm run lint`.
|
|
- CI/CD artifacts present: `azure-pipelines.yml`, `Jenkinsfile`, `Dockerfile` (active production source-of-truth not explicit in repo).
|
|
- Security controls: `middleware.js` CSP/runtime headers + `next.config.js` security headers.
|
|
|
|
## Development constraints
|
|
|
|
- Preserve auth/session behavior in `pages/api/auth/[...nextauth].js`.
|
|
- Do not weaken CSP/security headers in `middleware.js` or `next.config.js`.
|
|
- Keep EN/CY parity across routes and locale resources (`i18n.js`, `locales/**`, rewrites).
|
|
- Treat relay hash behavior as security-sensitive; keep path/hash compatibility stable.
|
|
- Avoid logging secrets/personal data in auth/email/file/account flows.
|