@defra/forms-engine-plugin 4.0.38 → 4.0.39

package/.server/server/plugins/engine/pageControllers/StatusPageController.d.ts

@@ -6,6 +6,7 @@ import { type FormRequest, type FormResponseToolkit } from '~/src/server/routes/
 export declare class StatusPageController extends QuestionPageController {
     pageDef: PageStatus;
     allowSaveAndExit: boolean;
+    showReferenceNumber: boolean;
     constructor(model: FormModel, pageDef: PageStatus);
     getRelevantPath(): string;
     makeGetRouteHandler(): (request: FormRequest, context: FormContext, h: FormResponseToolkit) => Promise<import("@hapi/hapi").ResponseObject>;

package/.server/server/plugins/engine/pageControllers/StatusPageController.js

@@ -2,9 +2,11 @@ import { getCacheService } from "../helpers.js";
 import { QuestionPageController } from "./QuestionPageController.js";
 export class StatusPageController extends QuestionPageController {
   allowSaveAndExit = false;
+  showReferenceNumber = false;
   constructor(model, pageDef) {
     super(model, pageDef);
     this.viewName = 'confirmation';
+    this.showReferenceNumber = model.def.options?.showReferenceNumber ?? false;
   }
   getRelevantPath() {
     return this.getStatusPath();
@@ -41,7 +43,9 @@ export class StatusPageController extends QuestionPageController {
       return h.view(viewName, {
         ...viewModel,
         submissionGuidance,
-        formName
+        formName,
+        showReferenceNumber: this.showReferenceNumber,
+        referenceNumber: context.referenceNumber
       });
     };
   }

package/.server/server/plugins/engine/pageControllers/StatusPageController.js.map

@@ -1 +1 @@
-{"version":3,"file":"StatusPageController.js","names":["getCacheService","QuestionPageController","StatusPageController","allowSaveAndExit","constructor","model","pageDef","viewName","getRelevantPath","getStatusPath","makeGetRouteHandler","request","context","h","viewModel","cacheService","server","confirmationState","getConfirmationState","confirmed","proceed","getStartPath","slug","params","formsService","services","getFormMetadata","getFormMetadataById","submissionGuidance","storedFormId","formId","formName","title","undefined","view"],"sources":["../../../../../src/server/plugins/engine/pageControllers/StatusPageController.ts"],"sourcesContent":["import { type PageStatus } from '@defra/forms-model'\n\nimport { getCacheService } from '~/src/server/plugins/engine/helpers.js'\nimport { type FormModel } from '~/src/server/plugins/engine/models/index.js'\nimport { QuestionPageController } from '~/src/server/plugins/engine/pageControllers/QuestionPageController.js'\nimport { type FormContext } from '~/src/server/plugins/engine/types.js'\nimport {\n  type FormRequest,\n  type FormResponseToolkit\n} from '~/src/server/routes/types.js'\n\nexport class StatusPageController extends QuestionPageController {\n  declare pageDef: PageStatus\n  allowSaveAndExit = false\n\n  constructor(model: FormModel, pageDef: PageStatus) {\n    super(model, pageDef)\n    this.viewName = 'confirmation'\n  }\n\n  getRelevantPath() {\n    return this.getStatusPath()\n  }\n\n  makeGetRouteHandler() {\n    return async (\n      request: FormRequest,\n      context: FormContext,\n      h: FormResponseToolkit\n    ) => {\n      const { viewModel, viewName } = this\n\n      const cacheService = getCacheService(request.server)\n      const confirmationState = await cacheService.getConfirmationState(request)\n\n      // If there's no confirmation state, then\n      // redirect the user back to the start of the form\n      if (!confirmationState.confirmed) {\n        return this.proceed(request, h, this.getStartPath())\n      }\n\n      const slug = request.params.slug\n      const { formsService } = this.model.services\n      const { getFormMetadata, getFormMetadataById } = formsService\n\n      const { submissionGuidance } = await getFormMetadata(slug)\n\n      // Re-read form name if overriding display (for example, in a feedback form)\n      const storedFormId = confirmationState.formId\n      const formName = storedFormId\n        ? (await getFormMetadataById(storedFormId)).title\n        : undefined\n\n      return h.view(viewName, {\n        ...viewModel,\n        submissionGuidance,\n        formName\n      })\n    }\n  }\n}\n"],"mappings":"AAEA,SAASA,eAAe;AAExB,SAASC,sBAAsB;AAO/B,OAAO,MAAMC,oBAAoB,SAASD,sBAAsB,CAAC;EAE/DE,gBAAgB,GAAG,KAAK;EAExBC,WAAWA,CAACC,KAAgB,EAAEC,OAAmB,EAAE;IACjD,KAAK,CAACD,KAAK,EAAEC,OAAO,CAAC;IACrB,IAAI,CAACC,QAAQ,GAAG,cAAc;EAChC;EAEAC,eAAeA,CAAA,EAAG;IAChB,OAAO,IAAI,CAACC,aAAa,CAAC,CAAC;EAC7B;EAEAC,mBAAmBA,CAAA,EAAG;IACpB,OAAO,OACLC,OAAoB,EACpBC,OAAoB,EACpBC,CAAsB,KACnB;MACH,MAAM;QAAEC,SAAS;QAAEP;MAAS,CAAC,GAAG,IAAI;MAEpC,MAAMQ,YAAY,GAAGf,eAAe,CAACW,OAAO,CAACK,MAAM,CAAC;MACpD,MAAMC,iBAAiB,GAAG,MAAMF,YAAY,CAACG,oBAAoB,CAACP,OAAO,CAAC;;MAE1E;MACA;MACA,IAAI,CAACM,iBAAiB,CAACE,SAAS,EAAE;QAChC,OAAO,IAAI,CAACC,OAAO,CAACT,OAAO,EAAEE,CAAC,EAAE,IAAI,CAACQ,YAAY,CAAC,CAAC,CAAC;MACtD;MAEA,MAAMC,IAAI,GAAGX,OAAO,CAACY,MAAM,CAACD,IAAI;MAChC,MAAM;QAAEE;MAAa,CAAC,GAAG,IAAI,CAACnB,KAAK,CAACoB,QAAQ;MAC5C,MAAM;QAAEC,eAAe;QAAEC;MAAoB,CAAC,GAAGH,YAAY;MAE7D,MAAM;QAAEI;MAAmB,CAAC,GAAG,MAAMF,eAAe,CAACJ,IAAI,CAAC;;MAE1D;MACA,MAAMO,YAAY,GAAGZ,iBAAiB,CAACa,MAAM;MAC7C,MAAMC,QAAQ,GAAGF,YAAY,GACzB,CAAC,MAAMF,mBAAmB,CAACE,YAAY,CAAC,EAAEG,KAAK,GAC/CC,SAAS;MAEb,OAAOpB,CAAC,CAACqB,IAAI,CAAC3B,QAAQ,EAAE;QACtB,GAAGO,SAAS;QACZc,kBAAkB;QAClBG;MACF,CAAC,CAAC;IACJ,CAAC;EACH;AACF","ignoreList":[]}
+{"version":3,"file":"StatusPageController.js","names":["getCacheService","QuestionPageController","StatusPageController","allowSaveAndExit","showReferenceNumber","constructor","model","pageDef","viewName","def","options","getRelevantPath","getStatusPath","makeGetRouteHandler","request","context","h","viewModel","cacheService","server","confirmationState","getConfirmationState","confirmed","proceed","getStartPath","slug","params","formsService","services","getFormMetadata","getFormMetadataById","submissionGuidance","storedFormId","formId","formName","title","undefined","view","referenceNumber"],"sources":["../../../../../src/server/plugins/engine/pageControllers/StatusPageController.ts"],"sourcesContent":["import { type PageStatus } from '@defra/forms-model'\n\nimport { getCacheService } from '~/src/server/plugins/engine/helpers.js'\nimport { type FormModel } from '~/src/server/plugins/engine/models/index.js'\nimport { QuestionPageController } from '~/src/server/plugins/engine/pageControllers/QuestionPageController.js'\nimport { type FormContext } from '~/src/server/plugins/engine/types.js'\nimport {\n  type FormRequest,\n  type FormResponseToolkit\n} from '~/src/server/routes/types.js'\n\nexport class StatusPageController extends QuestionPageController {\n  declare pageDef: PageStatus\n  allowSaveAndExit = false\n  showReferenceNumber = false\n\n  constructor(model: FormModel, pageDef: PageStatus) {\n    super(model, pageDef)\n    this.viewName = 'confirmation'\n    this.showReferenceNumber = model.def.options?.showReferenceNumber ?? false\n  }\n\n  getRelevantPath() {\n    return this.getStatusPath()\n  }\n\n  makeGetRouteHandler() {\n    return async (\n      request: FormRequest,\n      context: FormContext,\n      h: FormResponseToolkit\n    ) => {\n      const { viewModel, viewName } = this\n\n      const cacheService = getCacheService(request.server)\n      const confirmationState = await cacheService.getConfirmationState(request)\n\n      // If there's no confirmation state, then\n      // redirect the user back to the start of the form\n      if (!confirmationState.confirmed) {\n        return this.proceed(request, h, this.getStartPath())\n      }\n\n      const slug = request.params.slug\n      const { formsService } = this.model.services\n      const { getFormMetadata, getFormMetadataById } = formsService\n\n      const { submissionGuidance } = await getFormMetadata(slug)\n\n      // Re-read form name if overriding display (for example, in a feedback form)\n      const storedFormId = confirmationState.formId\n      const formName = storedFormId\n        ? (await getFormMetadataById(storedFormId)).title\n        : undefined\n\n      return h.view(viewName, {\n        ...viewModel,\n        submissionGuidance,\n        formName,\n        showReferenceNumber: this.showReferenceNumber,\n        referenceNumber: context.referenceNumber\n      })\n    }\n  }\n}\n"],"mappings":"AAEA,SAASA,eAAe;AAExB,SAASC,sBAAsB;AAO/B,OAAO,MAAMC,oBAAoB,SAASD,sBAAsB,CAAC;EAE/DE,gBAAgB,GAAG,KAAK;EACxBC,mBAAmB,GAAG,KAAK;EAE3BC,WAAWA,CAACC,KAAgB,EAAEC,OAAmB,EAAE;IACjD,KAAK,CAACD,KAAK,EAAEC,OAAO,CAAC;IACrB,IAAI,CAACC,QAAQ,GAAG,cAAc;IAC9B,IAAI,CAACJ,mBAAmB,GAAGE,KAAK,CAACG,GAAG,CAACC,OAAO,EAAEN,mBAAmB,IAAI,KAAK;EAC5E;EAEAO,eAAeA,CAAA,EAAG;IAChB,OAAO,IAAI,CAACC,aAAa,CAAC,CAAC;EAC7B;EAEAC,mBAAmBA,CAAA,EAAG;IACpB,OAAO,OACLC,OAAoB,EACpBC,OAAoB,EACpBC,CAAsB,KACnB;MACH,MAAM;QAAEC,SAAS;QAAET;MAAS,CAAC,GAAG,IAAI;MAEpC,MAAMU,YAAY,GAAGlB,eAAe,CAACc,OAAO,CAACK,MAAM,CAAC;MACpD,MAAMC,iBAAiB,GAAG,MAAMF,YAAY,CAACG,oBAAoB,CAACP,OAAO,CAAC;;MAE1E;MACA;MACA,IAAI,CAACM,iBAAiB,CAACE,SAAS,EAAE;QAChC,OAAO,IAAI,CAACC,OAAO,CAACT,OAAO,EAAEE,CAAC,EAAE,IAAI,CAACQ,YAAY,CAAC,CAAC,CAAC;MACtD;MAEA,MAAMC,IAAI,GAAGX,OAAO,CAACY,MAAM,CAACD,IAAI;MAChC,MAAM;QAAEE;MAAa,CAAC,GAAG,IAAI,CAACrB,KAAK,CAACsB,QAAQ;MAC5C,MAAM;QAAEC,eAAe;QAAEC;MAAoB,CAAC,GAAGH,YAAY;MAE7D,MAAM;QAAEI;MAAmB,CAAC,GAAG,MAAMF,eAAe,CAACJ,IAAI,CAAC;;MAE1D;MACA,MAAMO,YAAY,GAAGZ,iBAAiB,CAACa,MAAM;MAC7C,MAAMC,QAAQ,GAAGF,YAAY,GACzB,CAAC,MAAMF,mBAAmB,CAACE,YAAY,CAAC,EAAEG,KAAK,GAC/CC,SAAS;MAEb,OAAOpB,CAAC,CAACqB,IAAI,CAAC7B,QAAQ,EAAE;QACtB,GAAGS,SAAS;QACZc,kBAAkB;QAClBG,QAAQ;QACR9B,mBAAmB,EAAE,IAAI,CAACA,mBAAmB;QAC7CkC,eAAe,EAAEvB,OAAO,CAACuB;MAC3B,CAAC,CAAC;IACJ,CAAC;EACH;AACF","ignoreList":[]}

package/.server/server/plugins/engine/referenceNumbers.d.ts

@@ -1,5 +1,12 @@
+/**
+ * To prevent confusion to users reading the reference number, ambiguous letters and numbers are removed.
+ * @param strCodes - array of binary input values
+ */
+export declare function convertToDecAlpha(strCodes: number[]): string;
 /**
  * Generates a reference number in the format of `XXX-XXX-XXX`, or `PREFIX-XXX-XXX` if a prefix is provided.
  * Provides no guarantee on uniqueness.
+ * To prevent confusion to users reading the reference number, ambiguous letters and numbers are removed
+ * (see https://gunkies.org/wiki/DEC_alphabet )
  */
 export declare function generateUniqueReference(prefix?: string): string;

package/.server/server/plugins/engine/referenceNumbers.js

@@ -1,17 +1,42 @@
 import { randomBytes } from 'node:crypto';
+import { RegExpMatcher, englishDataset, englishRecommendedTransformers } from 'obscenity';
+
+/**
+ * To prevent confusion to users reading the reference number, ambiguous letters and numbers are removed.
+ * @param strCodes - array of binary input values
+ */
+export function convertToDecAlpha(strCodes) {
+  const validChars = 'ABCDEFHJKLMNPRSTUVWXYZ23456789';
+  const strLen = validChars.length;
+  const outArray = [];
+  strCodes.forEach(code => {
+    const pos = code / 256 * strLen;
+    outArray.push(validChars.charAt(pos));
+  });
+  return outArray.join('');
+}
 
 /**
  * Generates a reference number in the format of `XXX-XXX-XXX`, or `PREFIX-XXX-XXX` if a prefix is provided.
  * Provides no guarantee on uniqueness.
+ * To prevent confusion to users reading the reference number, ambiguous letters and numbers are removed
+ * (see https://gunkies.org/wiki/DEC_alphabet )
  */
 export function generateUniqueReference(prefix) {
   const segmentLength = 3;
   const segmentCount = prefix ? 2 : 3;
   prefix = prefix ? `${prefix}-` : '';
-  const segments = Array.from({
-    length: segmentCount
-  }, () => randomBytes(segmentLength).toString('hex').slice(0, segmentLength) // 0-9a-f, might be good enough?
-  );
-  return `${prefix}${segments.join('-')}`.toUpperCase();
+  const profanityMatcher = new RegExpMatcher({
+    ...englishDataset.build(),
+    ...englishRecommendedTransformers
+  });
+  let referenceNumber;
+  do {
+    const segments = Array.from({
+      length: segmentCount
+    }, () => convertToDecAlpha([...randomBytes(segmentLength)]).slice(0, segmentLength * 2));
+    referenceNumber = `${prefix}${segments.join('-')}`.toUpperCase();
+  } while (profanityMatcher.hasMatch(referenceNumber.replaceAll('-', '')));
+  return referenceNumber;
 }
 //# sourceMappingURL=referenceNumbers.js.map

package/.server/server/plugins/engine/referenceNumbers.js.map

@@ -1 +1 @@
-{"version":3,"file":"referenceNumbers.js","names":["randomBytes","generateUniqueReference","prefix","segmentLength","segmentCount","segments","Array","from","length","toString","slice","join","toUpperCase"],"sources":["../../../../src/server/plugins/engine/referenceNumbers.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto'\n\n/**\n * Generates a reference number in the format of `XXX-XXX-XXX`, or `PREFIX-XXX-XXX` if a prefix is provided.\n * Provides no guarantee on uniqueness.\n */\nexport function generateUniqueReference(prefix?: string) {\n  const segmentLength = 3\n  const segmentCount = prefix ? 2 : 3\n  prefix = prefix ? `${prefix}-` : ''\n\n  const segments = Array.from(\n    { length: segmentCount },\n    () => randomBytes(segmentLength).toString('hex').slice(0, segmentLength) // 0-9a-f, might be good enough?\n  )\n\n  return `${prefix}${segments.join('-')}`.toUpperCase()\n}\n"],"mappings":"AAAA,SAASA,WAAW,QAAQ,aAAa;;AAEzC;AACA;AACA;AACA;AACA,OAAO,SAASC,uBAAuBA,CAACC,MAAe,EAAE;EACvD,MAAMC,aAAa,GAAG,CAAC;EACvB,MAAMC,YAAY,GAAGF,MAAM,GAAG,CAAC,GAAG,CAAC;EACnCA,MAAM,GAAGA,MAAM,GAAG,GAAGA,MAAM,GAAG,GAAG,EAAE;EAEnC,MAAMG,QAAQ,GAAGC,KAAK,CAACC,IAAI,CACzB;IAAEC,MAAM,EAAEJ;EAAa,CAAC,EACxB,MAAMJ,WAAW,CAACG,aAAa,CAAC,CAACM,QAAQ,CAAC,KAAK,CAAC,CAACC,KAAK,CAAC,CAAC,EAAEP,aAAa,CAAC,CAAC;EAC3E,CAAC;EAED,OAAO,GAAGD,MAAM,GAAGG,QAAQ,CAACM,IAAI,CAAC,GAAG,CAAC,EAAE,CAACC,WAAW,CAAC,CAAC;AACvD","ignoreList":[]}
+{"version":3,"file":"referenceNumbers.js","names":["randomBytes","RegExpMatcher","englishDataset","englishRecommendedTransformers","convertToDecAlpha","strCodes","validChars","strLen","length","outArray","forEach","code","pos","push","charAt","join","generateUniqueReference","prefix","segmentLength","segmentCount","profanityMatcher","build","referenceNumber","segments","Array","from","slice","toUpperCase","hasMatch","replaceAll"],"sources":["../../../../src/server/plugins/engine/referenceNumbers.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto'\n\nimport {\n  RegExpMatcher,\n  englishDataset,\n  englishRecommendedTransformers\n} from 'obscenity'\n\n/**\n * To prevent confusion to users reading the reference number, ambiguous letters and numbers are removed.\n * @param strCodes - array of binary input values\n */\nexport function convertToDecAlpha(strCodes: number[]) {\n  const validChars = 'ABCDEFHJKLMNPRSTUVWXYZ23456789'\n  const strLen = validChars.length\n  const outArray = [] as string[]\n\n  strCodes.forEach((code) => {\n    const pos = (code / 256) * strLen\n    outArray.push(validChars.charAt(pos))\n  })\n\n  return outArray.join('')\n}\n\n/**\n * Generates a reference number in the format of `XXX-XXX-XXX`, or `PREFIX-XXX-XXX` if a prefix is provided.\n * Provides no guarantee on uniqueness.\n * To prevent confusion to users reading the reference number, ambiguous letters and numbers are removed\n * (see https://gunkies.org/wiki/DEC_alphabet )\n */\nexport function generateUniqueReference(prefix?: string) {\n  const segmentLength = 3\n  const segmentCount = prefix ? 2 : 3\n  prefix = prefix ? `${prefix}-` : ''\n\n  const profanityMatcher = new RegExpMatcher({\n    ...englishDataset.build(),\n    ...englishRecommendedTransformers\n  })\n\n  let referenceNumber\n\n  do {\n    const segments = Array.from({ length: segmentCount }, () =>\n      convertToDecAlpha([...randomBytes(segmentLength)]).slice(\n        0,\n        segmentLength * 2\n      )\n    )\n\n    referenceNumber = `${prefix}${segments.join('-')}`.toUpperCase()\n  } while (profanityMatcher.hasMatch(referenceNumber.replaceAll('-', '')))\n\n  return referenceNumber\n}\n"],"mappings":"AAAA,SAASA,WAAW,QAAQ,aAAa;AAEzC,SACEC,aAAa,EACbC,cAAc,EACdC,8BAA8B,QACzB,WAAW;;AAElB;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAACC,QAAkB,EAAE;EACpD,MAAMC,UAAU,GAAG,gCAAgC;EACnD,MAAMC,MAAM,GAAGD,UAAU,CAACE,MAAM;EAChC,MAAMC,QAAQ,GAAG,EAAc;EAE/BJ,QAAQ,CAACK,OAAO,CAAEC,IAAI,IAAK;IACzB,MAAMC,GAAG,GAAID,IAAI,GAAG,GAAG,GAAIJ,MAAM;IACjCE,QAAQ,CAACI,IAAI,CAACP,UAAU,CAACQ,MAAM,CAACF,GAAG,CAAC,CAAC;EACvC,CAAC,CAAC;EAEF,OAAOH,QAAQ,CAACM,IAAI,CAAC,EAAE,CAAC;AAC1B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,uBAAuBA,CAACC,MAAe,EAAE;EACvD,MAAMC,aAAa,GAAG,CAAC;EACvB,MAAMC,YAAY,GAAGF,MAAM,GAAG,CAAC,GAAG,CAAC;EACnCA,MAAM,GAAGA,MAAM,GAAG,GAAGA,MAAM,GAAG,GAAG,EAAE;EAEnC,MAAMG,gBAAgB,GAAG,IAAInB,aAAa,CAAC;IACzC,GAAGC,cAAc,CAACmB,KAAK,CAAC,CAAC;IACzB,GAAGlB;EACL,CAAC,CAAC;EAEF,IAAImB,eAAe;EAEnB,GAAG;IACD,MAAMC,QAAQ,GAAGC,KAAK,CAACC,IAAI,CAAC;MAAEjB,MAAM,EAAEW;IAAa,CAAC,EAAE,MACpDf,iBAAiB,CAAC,CAAC,GAAGJ,WAAW,CAACkB,aAAa,CAAC,CAAC,CAAC,CAACQ,KAAK,CACtD,CAAC,EACDR,aAAa,GAAG,CAClB,CACF,CAAC;IAEDI,eAAe,GAAG,GAAGL,MAAM,GAAGM,QAAQ,CAACR,IAAI,CAAC,GAAG,CAAC,EAAE,CAACY,WAAW,CAAC,CAAC;EAClE,CAAC,QAAQP,gBAAgB,CAACQ,QAAQ,CAACN,eAAe,CAACO,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;EAEvE,OAAOP,eAAe;AACxB","ignoreList":[]}

package/.server/server/plugins/engine/views/confirmation.html

@@ -8,7 +8,8 @@
   <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds">
       {{ govukPanel({
-        titleText: pageTitle
+        titleText: pageTitle,
+        html: "Your reference number<br><strong>" + referenceNumber + "</strong>" if showReferenceNumber
       }) }}
       <h2 class="govuk-heading-m">What happens next</h2>
       <div class="app-prose-scope">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defra/forms-engine-plugin",
-  "version": "4.0.38",
+  "version": "4.0.39",
   "description": "Defra forms engine",
   "type": "module",
   "files": [
@@ -70,7 +70,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@defra/forms-model": "^3.0.597",
+    "@defra/forms-model": "^3.0.603",
     "@defra/hapi-tracing": "^1.29.0",
     "@elastic/ecs-pino-format": "^1.5.0",
     "@hapi/boom": "^10.0.1",
@@ -108,6 +108,7 @@
     "lodash": "^4.17.21",
     "marked": "^15.0.12",
     "nunjucks": "^3.2.4",
+    "obscenity": "^0.4.5",
     "outdent": "^0.8.0",
     "pino": "^9.14.0",
     "pino-pretty": "^13.1.2",

package/src/server/plugins/engine/pageControllers/StatusPageController.ts

@@ -12,10 +12,12 @@ import {
 export class StatusPageController extends QuestionPageController {
   declare pageDef: PageStatus
   allowSaveAndExit = false
+  showReferenceNumber = false
 
   constructor(model: FormModel, pageDef: PageStatus) {
     super(model, pageDef)
     this.viewName = 'confirmation'
+    this.showReferenceNumber = model.def.options?.showReferenceNumber ?? false
   }
 
   getRelevantPath() {
@@ -54,7 +56,9 @@ export class StatusPageController extends QuestionPageController {
       return h.view(viewName, {
         ...viewModel,
         submissionGuidance,
-        formName
+        formName,
+        showReferenceNumber: this.showReferenceNumber,
+        referenceNumber: context.referenceNumber
       })
     }
   }

package/src/server/plugins/engine/referenceNumbers.test.ts

@@ -1,4 +1,7 @@
-import { generateUniqueReference } from '~/src/server/plugins/engine/referenceNumbers.js'
+import {
+  convertToDecAlpha,
+  generateUniqueReference
+} from '~/src/server/plugins/engine/referenceNumbers.js'
 
 describe('generateUniqueReference', () => {
   it('should generate a reference number with 3 segments when no prefix is provided', () => {
@@ -30,4 +33,42 @@ describe('generateUniqueReference', () => {
     const referenceNumber2 = generateUniqueReference()
     expect(referenceNumber1).not.toBe(referenceNumber2)
   })
+
+  describe('convertToDecAlpha', () => {
+    it('should generate correct characters in string', () => {
+      const allValuesHexPairs = Array.from(Array(256).keys())
+      expect(convertToDecAlpha(allValuesHexPairs)).toBe(
+        'AAAAAAAAA' +
+          'BBBBBBBBB' +
+          'CCCCCCCC' +
+          'DDDDDDDDD' +
+          'EEEEEEEE' +
+          'FFFFFFFFF' +
+          'HHHHHHHH' +
+          'JJJJJJJJJ' +
+          'KKKKKKKK' +
+          'LLLLLLLLL' +
+          'MMMMMMMM' +
+          'NNNNNNNNN' +
+          'PPPPPPPP' +
+          'RRRRRRRRR' +
+          'SSSSSSSS' +
+          'TTTTTTTTT' +
+          'UUUUUUUUU' +
+          'VVVVVVVV' +
+          'WWWWWWWWW' +
+          'XXXXXXXX' +
+          'YYYYYYYYY' +
+          'ZZZZZZZZ' +
+          '222222222' +
+          '33333333' +
+          '444444444' +
+          '55555555' +
+          '666666666' +
+          '77777777' +
+          '888888888' +
+          '99999999'
+      )
+    })
+  })
 })

package/src/server/plugins/engine/referenceNumbers.ts

@@ -1,18 +1,56 @@
 import { randomBytes } from 'node:crypto'
 
+import {
+  RegExpMatcher,
+  englishDataset,
+  englishRecommendedTransformers
+} from 'obscenity'
+
+/**
+ * To prevent confusion to users reading the reference number, ambiguous letters and numbers are removed.
+ * @param strCodes - array of binary input values
+ */
+export function convertToDecAlpha(strCodes: number[]) {
+  const validChars = 'ABCDEFHJKLMNPRSTUVWXYZ23456789'
+  const strLen = validChars.length
+  const outArray = [] as string[]
+
+  strCodes.forEach((code) => {
+    const pos = (code / 256) * strLen
+    outArray.push(validChars.charAt(pos))
+  })
+
+  return outArray.join('')
+}
+
 /**
  * Generates a reference number in the format of `XXX-XXX-XXX`, or `PREFIX-XXX-XXX` if a prefix is provided.
  * Provides no guarantee on uniqueness.
+ * To prevent confusion to users reading the reference number, ambiguous letters and numbers are removed
+ * (see https://gunkies.org/wiki/DEC_alphabet )
  */
 export function generateUniqueReference(prefix?: string) {
   const segmentLength = 3
   const segmentCount = prefix ? 2 : 3
   prefix = prefix ? `${prefix}-` : ''
 
-  const segments = Array.from(
-    { length: segmentCount },
-    () => randomBytes(segmentLength).toString('hex').slice(0, segmentLength) // 0-9a-f, might be good enough?
-  )
+  const profanityMatcher = new RegExpMatcher({
+    ...englishDataset.build(),
+    ...englishRecommendedTransformers
+  })
+
+  let referenceNumber
+
+  do {
+    const segments = Array.from({ length: segmentCount }, () =>
+      convertToDecAlpha([...randomBytes(segmentLength)]).slice(
+        0,
+        segmentLength * 2
+      )
+    )
+
+    referenceNumber = `${prefix}${segments.join('-')}`.toUpperCase()
+  } while (profanityMatcher.hasMatch(referenceNumber.replaceAll('-', '')))
 
-  return `${prefix}${segments.join('-')}`.toUpperCase()
+  return referenceNumber
 }

package/src/server/plugins/engine/views/confirmation.html

@@ -8,7 +8,8 @@
   <div class="govuk-grid-row">
     <div class="govuk-grid-column-two-thirds">
       {{ govukPanel({
-        titleText: pageTitle
+        titleText: pageTitle,
+        html: "Your reference number<br><strong>" + referenceNumber + "</strong>" if showReferenceNumber
       }) }}
       <h2 class="govuk-heading-m">What happens next</h2>
       <div class="app-prose-scope">