@gov-cy/govcy-express-services 1.4.3 → 1.6.0

package/README.md

@@ -30,6 +30,8 @@ The APIs used for submission, temporary save and file uploads are not part of th
 - [✅ Best Practices](#-best-practices)
 - [📦 Full installation guide](#-full-installation-guide)
 - [🛠️ Usage](#%EF%B8%8F-usage)
+  - [🔑 Authentication Middleware](#-authentication-middleware)
+    - [cyLogin Access Policies](#cylogin-access-policies)
   - [🧩 Dynamic services](#-dynamic-services)
     - [Pages](#pages)
     - [Form vs static pages](#form-vs-static-pages)
@@ -142,13 +144,67 @@ npm start
 ```
 The server will start on `https://localhost:44319` (see [NOTES.md](NOTES.md#local-development) for more details on this).
 
-### Authentication Middleware
+### 🔑 Authentication Middleware
 Authentication is handled via OpenID Connect using CY Login and is configured using environment variables. The middleware ensures users have valid sessions before accessing protected routes. 
 
 The CY Login tokens are used to also connect with the various APIs through [cyConnect](https://dev.azure.com/cyprus-gov-cds/Documentation/_wiki/wikis/Documentation/74/CY-Connect), so make sure to include the correct `scope` when requesting for a [cyLogin client registration](https://dev.azure.com/cyprus-gov-cds/Documentation/_wiki/wikis/Documentation/34/Developer-Guide).
 
 The CY Login settings are configured in the `secrets/.env` file.
 
+#### cyLogin Access Policies
+
+Each service can specify which types of authenticated CY Login profiles are allowed to access it using the `site.cyLoginPolicies` property in its site configuration.
+
+```json
+"cyLoginPolicies": ["naturalPerson", "legalPerson"]
+```
+
+##### Supported Policies
+
+| Policy name     | Description                                                  | Typical use                                          |
+| --------------- | ------------------------------------------------------------ | ---------------------------------------------------- |
+| `naturalPerson` | Allows individual users (Cypriot citizens or foreign residents) who have a verified profile in the Civil Registry. Identified by `profile_type: "Individual"` and a 10-digit identifier starting with `00` (citizen) or `05` (foreigner). | Citizen-facing services, personal applications, etc. |
+| `legalPerson`   | Allows legal entities (companies, partnerships, organisations) with verified profiles in the Registrar of Companies. Identified by `profile_type: "Organisation"` and a `legal_unique_identifier`. | Business-facing services, company submissions, etc.  |
+
+##### How it works
+
+- Access is granted if **any** of the listed policies pass.
+- If the user’s CY Login profile does not match any of the allowed policies, the request is blocked. 
+
+##### Defaults
+
+If `cyLoginPolicies` is omitted, the framework defaults to:
+
+```json
+"cyLoginPolicies": ["naturalPerson"]
+```
+
+This maintains backward compatibility with existing services that only supported individual (civil registry) users.
+
+##### Example
+
+Allow both natural and legal persons:
+
+```json
+"site": {
+  "cyLoginPolicies": ["naturalPerson", "legalPerson"]
+}
+```
+
+Restrict access to natural persons only:
+
+```json
+"site": {
+  "cyLoginPolicies": ["naturalPerson"]
+}
+```
+
+##### Notes
+
+- This configuration applies globally to the service.
+- Both `requireAuth` and `cyLoginPolicy` middlewares must be present on protected routes (automatically included by the default route setup).
+
+
 ### 🧩 Dynamic Services
 Services are rendered dynamically using JSON templates stored in the `/data` folder. All the service configuration, pages, routes, and logic is stored in the JSON files. The service will load `data/:siteId.json` to get the form data when a user visits `/:siteId/:pageUrl`. Checkout the [express-service-shema.json](express-service-shema.json) and the example JSON structure of the **[test.json](data/test.json)** file for more details.
 
@@ -158,6 +214,7 @@ Here is an example JSON config:
 {
   "site": {
     "id": "test",
+    "cyLoginPolicies": ["naturalPerson"], //<-- Allowed CY Login policies
     "lang": "el",     //<-- Default language
     "languages": [    //<-- Supported languages
       {
@@ -716,6 +773,8 @@ Here is an example JSON config:
 Here are some details explaining the JSON structure:
 
 - `site` object: Contains information about the site, including the site ID, language, and footer links. See [govcy-frontend-renderer](https://github.com/gov-cy/govcy-frontend-renderer/tree/main#site-and-page-meta-data-explained) for more details. Some fields that are only specific to the govcy-express-forms project are the following:
+  - `usesDSFSubmissionPlatform`: A boolean that indicates whether the service uses the DSF submission platform (transforms submission data as needed)
+  - `cyLoginPolicies`: which types of authenticated CY Login profiles are allowed to access the service
   - `submissionDataVersion` : The submission data version,
   - `rendererVersion` : The govcy-frontend-renderer version,
   - `designSystemsVersion` : The govcy-design-system version,
@@ -2604,227 +2663,8 @@ To help back-end systems recognize the field as a file, the field's element name
 If these endpoints are not defined in the service JSON, the file upload logic is skipped entirely.
 Existing services will continue to work without modification.
 
- ### ✨ Custom pages feature
-The **Custom pages** feature allows developers to add service-specific custom pages that exist outside the standard Express Services JSON configuration.  
-
-These pages can collect data, display conditional content, and inject custom sections into the **review** and **email** stages of the service flow.
-
-#### What do custom pages get out of the framework
-With the custom pages feature, developers can define **pages** and **routes** on an express **service**. On these pages the following apply out of the box: 
-- Login requirement
-- User policy requirement
-- Any service eligibility checks
-- Csrf protection on POST
-- Generic error page on errors
-
-The developers can also choose to:
-- store values in the session to be submitted via the submission API
-- define where and what the users sees in the `review` page
-- define errors regarding the custom page in the `review` page 
-- define what the user receives the `email`
-
-#### What the framework expects from custom pages
-
-- Every custom page **must be defined** at startup using `defineCustomPages(app, siteId, pageUrl, ...)`.
-- Custom pages are **not** automatically discovered, they must be registered explicitly.
-- Each page must specify on **start up**:
-    - `pageTitle`: multilingual object for display in review and email
-    - `insertAfterPageUrl`: the page **after which** this custom page will appear
-    - `summaryElements`, `errors`, and `email` are managed dynamically in session
-	    - **NOTE**: Usually a default `required` error must be defined on start up. This will ensure that the when the users try to submit in the “Check your answers” review page, they get an error message to complete an action.
-    - `extraProps` extra property stored in the session to be used by the developers as they wish
-- During **runtime**, developers are responsible for setting:
-    - `data`: data to include in submission, using the `setCustomPageData` function
-    - `summaryElements`: what appears in the “Check your answers” review page, using the `setCustomPageSummaryElements` function
-    - `email`: array of [`dsf-email-templates`](https://github.com/gov-cy/dsf-email-templates) components for the submission confirmation email, using the `setCustomPageEmail`
-    - `errors`: errors that appear in the  “Check your answers” review page. Developers can use the `addCustomPageError` function to add an error, or the `clearCustomPageErrors` to clear the errors
-#### Available methods
-
-| Method                                                                                                                                           | Purpose                                                                                   |
-| ------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- |
-| `defineCustomPages(store, siteId, pageUrl, pageTitle, insertAfterSummary, insertAfterPageUrl, errors, summaryElements, summaryHtml, extraProps)` | Registers a custom page definition in `app`. Must be called once at startup.              |
-| `getCustomPageDefinition(store, siteId, pageUrl)`                                                                                                | Retrieves the custom page definition for a given siteId and pageUrl                       |
-| `resetCustomPages(configStore, store, siteId)`                                                                                                   | Resets per-session data from the global definitions.                                      |
-| `setCustomPageData(store, siteId, pageUrl, dataObject)`                                                                                          | Sets or replaces the data object used during submission.                                  |
-| `setCustomPageSummaryElements(store, siteId, pageUrl, summaryElements)`                                                                          | Sets what appears in the review page summary.                                             |
-| `clearCustomPageErrors(store, siteId, pageUrl)`                                                                                                  | Clears validation errors.                                                                 |
-| `addCustomPageError(store, siteId, pageUrl, errorId, errorTextObject)`                                                                           | Adds a validation error.                                                                  |
-| `setCustomPageEmail(store, siteId, pageUrl, arrayOfEmailObjects)`                                                                                | Defines email sections for the confirmation email using `dsf-email-templates` components. |
-| `setCustomPageProperty(store, siteId, pageUrl, property, value, isDefinition = false)`                                                           | Sets a custom property on a given custom page definition or instance                      |
-| `getCustomPageProperty(store, siteId, pageUrl, property, isDefinition = false)`                                                                  | Gets a custom property from a given custom page definition or instance.                   |
-
----
-##### Example
-
-Below is a practical example of a custom **Declarations** page added to an existing service.
-
-```js
-import initializeGovCyExpressService from '@gov-cy/govcy-express-services';
-import {
-    defineCustomPages, resetCustomPages,
-    clearCustomPageErrors, addCustomPageError,
-    setCustomPageData, setCustomPageSummaryElements,
-    setCustomPageEmail, getCustomPageProperty, setCustomPageProperty
-} from '@gov-cy/govcy-express-services/customPages';
-
-// Initialize the service
-const service = initializeGovCyExpressService({
-    beforeMount({ siteRoute, app }) {
-
-        // ==========================================================
-        // 1️⃣ DEFINE GLOBAL CUSTOM PAGE CONFIGS (once per app)
-        // ==========================================================
-        defineCustomPages(
-            app, // <-- using app as store (global config)
-            "cso", // siteId
-            "/cso/custom", // pageUrl
-            { en: "My custom section", el: "Προσαρμοσμένη ενότητα" }, // pageTitle
-            "qualifications",     // insertAfterPageUrl
-            [                         // errors
-                {
-                    id: "custom-error",
-                    text: {
-                        en: "This is a custom error custom",
-                        el: "Αυτή ειναι ενα προσαρμοσμένη σφαλμα custom",
-                    }
-                }
-            ],
-            [     // summaryElements  
-                {
-                    key:
-                    {
-                        en: "Extra value",
-                        el: "Πρόσθετη τιμή"
-                    },
-                    value: []
-                }
-            ],
-            false,
-            { // other custom properties if needed like nextPage or initial data
-                nextPage: "/cso/memberships", // custom property nextPage. Not needed by Express but useful for the custom logic
-                data : // custom initial data. Useful when you need the data model to be standard or pre-populated
-                { 
-                    something: "",
-                }  
-             }
-        );
-
-        // ==========================================================
-        // 2️⃣ MIDDLEWARE: SET UP SESSION DATA FROM GLOBAL DEFINITIONS
-        // ==========================================================
-        app.use((req, res, next) => {
-            // Initialize session data for custom pages
-            req.session.siteData ??= {};
-            req.session.siteData["cso"] ??= {};
-
-            // Reset session copies if missing (first visit)
-            if (!req.session.siteData["cso"].customPages) {
-                resetCustomPages(app, req.session, "cso"); // 🔁 deep copy from app to session
-                req.session.save((err) => {
-                    if (err) console.error("⚠️ Error initializing customPages:", err);
-                });
-            }
-
-            next();
-        });
-
-        // ==========================================================
-        // 3️⃣ CUSTOM ROUTES (still per-user)
-        // ==========================================================
-
-        // GET `/cso/custom`
-        siteRoute("cso", "get", "/cso/custom", (req, res) => {
-
-            // Render the custom page using the session data
-            // It is important for POST to add the csrfToken and to pass on the route query parameter
-            res.send(`<form action="/cso/custom${(req.query.route === "review")?"?route=review":""}" method="post">
-                 custom for ${req.params.siteId}
-                 <input type="hidden" name="_csrf" value="${req.csrfToken()}">
-                <button type="submit">Submit custom page</button>
-            </form>`);
-
-        });
-
-        // POST `/cso/custom`
-        siteRoute("cso", "post", "/cso/custom", (req, res) => {
-
-            // Update custom page `data` dynamically`
-            setCustomPageData(req.session, "cso", "/cso/custom", {
-                something: "123",
-            });
-
-            // Update `summary elements` dynamically (example)
-            setCustomPageSummaryElements(req.session, "cso", "/cso/custom",
-                [
-                    {
-                        key: {
-                            en: "Extra value",
-                            el: "Πρόσθετη τιμή"
-                        },
-                        value: [
-                            {
-                                element: "textElement",
-                                params: {
-                                    text: {
-                                        en: "123 Changed",
-                                        el: "123 Αλλάχθηκε"
-                                    },
-                                    type: "span",
-                                    showNewLine: true,
-                                }
-                            }
-                        ]
-                    }
-                ]);
-
-            // Update the custom page `email` 
-            setCustomPageEmail(req.session, "cso", "/cso/custom", [
-                {
-                    component: "bodyKeyValue",
-                    params: {
-                        type: "ul",
-                        items: [
-                            { key: "Extra value", value: "123" },
-                            { key: "Priority level", value: "High" },
-                        ],
-                    },
-                }
-            ]);
-
-            // clear any previous errors
-            clearCustomPageErrors(req.session, "cso", "/cso/custom");
-
-            // Add a custom error
-            // addCustomPageError(req.session, "cso", "/cso/custom", {
-            //     id: "custom-error",
-            //     text: {
-            //         en: "This is a custom error custom",
-            //         el: "Αυτή ειναι ενα προσαρμοσμένη σφαλμα custom",
-            //     }
-            // });
-
-            //if route is review, redirect to review page else go to nextPage property
-            if (req.query.route === "review") {
-                res.redirect("/cso/review");
-                return;
-            } else {
-                //example of using custom property nextPage
-                res.redirect(getCustomPageProperty(req.session, "cso", "/cso/custom", "nextPage", false));
-                return;
-            }
-        });
-
-
-        // ==========================================================
-    },
-});
-
-
-// Start the server
-service.startServer();
-
-```
-
+### ✨ Custom pages feature
+The **Custom pages** feature allows developers to code service-specific custom pages that exist outside the standard Express Services JSON configuration. More details at [Custom-pages.md](docs/Custom-pages.md)
 
 ### 🛣️ Routes
 The project uses express.js to serve the following routes:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gov-cy/govcy-express-services",
-  "version": "1.4.3",
+  "version": "1.6.0",
   "description": "An Express-based system that dynamically renders services using @gov-cy/govcy-frontend-renderer and posts data to a submission API.",
   "author": "DMRID - DSF Team",
   "license": "MIT",
@@ -56,7 +56,7 @@
     "coverage:badge": "coverage-badges --output ./coverage-badges.svg && npm run coverage:copy"
   },
   "dependencies": {
-    "@gov-cy/dsf-email-templates": "^2.1.1",
+    "@gov-cy/dsf-email-templates": "^2.1.11",
     "@gov-cy/govcy-frontend-renderer": "^1.26.0",
     "axios": "^1.9.0",
     "cookie-parser": "^1.4.7",

package/src/index.mjs

@@ -18,7 +18,7 @@ import { govcyCsrfMiddleware } from './middleware/govcyCsrf.mjs';
 import { govcySessionData } from './middleware/govcySessionData.mjs';
 import { govcyHttpErrorHandler } from './middleware/govcyHttpErrorHandler.mjs';
 import { govcyLanguageMiddleware } from './middleware/govcyLanguageMiddleware.mjs';
-import { requireAuth, naturalPersonPolicy, handleLoginRoute, handleSigninOidc, handleLogout } from './middleware/cyLoginAuth.mjs';
+import { requireAuth, cyLoginPolicy, handleLoginRoute, handleSigninOidc, handleLogout } from './middleware/cyLoginAuth.mjs';
 import { serviceConfigDataMiddleware } from './middleware/govcyConfigSiteData.mjs';
 import { govcyManifestHandler } from './middleware/govcyManifestHandler.mjs';
 import { govcyRoutePageHandler } from './middleware/govcyRoutePageHandler.mjs';
@@ -103,7 +103,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   // 🛠️ Debugging routes -----------------------------------------------------
   // 🙍🏻‍♂️ -- ROUTE: Debugging route Protected Route
   // if (!isProdOrStaging()) {
-  //   app.get('/user', requireAuth, naturalPersonPolicy, (req, res) => {
+  //   app.get('/user', requireAuth, cyLoginPolicy, (req, res) => {
   //     res.send(`
   //       User name: ${req.session.user.name}
   //       <br> Sub: ${req.session.user.sub}
@@ -139,7 +139,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/apis/:siteId/:pageUrl/upload',
     serviceConfigDataMiddleware,
     requireAuth, // UNCOMMENT 
-    naturalPersonPolicy, // UNCOMMENT 
+    cyLoginPolicy, // UNCOMMENT 
     govcyServiceEligibilityHandler(true), // UNCOMMENT 
     govcyFileUpload);
 
@@ -147,7 +147,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/apis/:siteId/:pageUrl/multiple/add/upload',
     serviceConfigDataMiddleware,
     requireAuth, // UNCOMMENT
-    naturalPersonPolicy, // UNCOMMENT
+    cyLoginPolicy, // UNCOMMENT
     govcyServiceEligibilityHandler(true), // UNCOMMENT
     govcyFileUpload
   );
@@ -176,7 +176,7 @@ export default function initializeGovCyExpressService(opts = {}) {
       injectSiteId,
       serviceConfigDataMiddleware,
       requireAuth,
-      naturalPersonPolicy,
+      cyLoginPolicy,
       govcyServiceEligibilityHandler(),
       ...handlers,
     ];
@@ -196,7 +196,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/apis/:siteId/:pageUrl/multiple/edit/:index/upload',
     serviceConfigDataMiddleware,
     requireAuth, // UNCOMMENT
-    naturalPersonPolicy, // UNCOMMENT
+    cyLoginPolicy, // UNCOMMENT
     govcyServiceEligibilityHandler(true), // UNCOMMENT
     govcyFileUpload
   );
@@ -205,7 +205,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.get('/:siteId/:pageUrl/multiple/add/view-file/:elementName',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyFileViewHandler());
 
@@ -213,7 +213,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.get('/:siteId/:pageUrl/multiple/add/delete-file/:elementName',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(),
     govcyLoadSubmissionData(),
     govcyFileDeletePageHandler(),
@@ -224,7 +224,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.get('/:siteId/:pageUrl/multiple/edit/:index/delete-file/:elementName',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(),
     govcyLoadSubmissionData(),
     govcyFileDeletePageHandler(),
@@ -236,7 +236,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/:siteId/:pageUrl/multiple/add/delete-file/:elementName',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyFileDeletePostHandler()
   );
@@ -245,7 +245,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/:siteId/:pageUrl/multiple/edit/:index/delete-file/:elementName',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyFileDeletePostHandler()
   );
@@ -255,33 +255,33 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.get('/:siteId/:pageUrl/multiple/edit/:index/view-file/:elementName',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyFileViewHandler());
 
   // 🏠 -- ROUTE: Handle route with only siteId (/:siteId or /:siteId/)
-  app.get('/:siteId', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(true), govcyLoadSubmissionData(), govcyPageHandler(), renderGovcyPage());
+  app.get('/:siteId', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(true), govcyLoadSubmissionData(), govcyPageHandler(), renderGovcyPage());
 
   // 👀 -- ROUTE: Add Review Page Route (BEFORE the dynamic route)
-  app.get('/:siteId/review', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(), govcyLoadSubmissionData(), govcyReviewPageHandler(), renderGovcyPage());
+  app.get('/:siteId/review', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(), govcyLoadSubmissionData(), govcyReviewPageHandler(), renderGovcyPage());
 
   // ✅📄 -- ROUTE: Add Success PDF Route (BEFORE the dynamic route)
-  app.get('/:siteId/success/pdf', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(), govcySuccessPageHandler(true), govcyPDFRender());
+  app.get('/:siteId/success/pdf', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(), govcySuccessPageHandler(true), govcyPDFRender());
 
   // ✅ -- ROUTE: Add Success Page Route (BEFORE the dynamic route)
-  app.get('/:siteId/success', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(), govcySuccessPageHandler(), renderGovcyPage());
+  app.get('/:siteId/success', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(), govcySuccessPageHandler(), renderGovcyPage());
 
   // 👀🗃️ -- ROUTE: View file (BEFORE the dynamic route)
-  app.get('/:siteId/:pageUrl/view-file/:elementName', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(), govcyLoadSubmissionData(), govcyFileViewHandler());
+  app.get('/:siteId/:pageUrl/view-file/:elementName', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(), govcyLoadSubmissionData(), govcyFileViewHandler());
 
   // ❌🗃️ -- ROUTE: Delete file (BEFORE the dynamic route)
-  app.get('/:siteId/:pageUrl/delete-file/:elementName', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(), govcyLoadSubmissionData(), govcyFileDeletePageHandler(), renderGovcyPage());
+  app.get('/:siteId/:pageUrl/delete-file/:elementName', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(), govcyLoadSubmissionData(), govcyFileDeletePageHandler(), renderGovcyPage());
 
   // ➕ -- ROUTE: Add item page (BEFORE the generic dynamic route)
   app.get('/:siteId/:pageUrl/multiple/add',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyLoadSubmissionData(),
     govcyMultipleThingsAddHandler(),
@@ -293,7 +293,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/:siteId/:pageUrl/multiple/add',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyMultipleThingsAddPostHandler()
   );
@@ -302,7 +302,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.get('/:siteId/:pageUrl/multiple/edit/:index',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyLoadSubmissionData(),
     govcyMultipleThingsEditHandler(),
@@ -313,7 +313,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/:siteId/:pageUrl/multiple/edit/:index',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyMultipleThingsEditPostHandler()
   );
@@ -322,7 +322,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.get('/:siteId/:pageUrl/multiple/delete/:index',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(),
     govcyLoadSubmissionData(),
     govcyMultipleThingsDeletePageHandler(),
@@ -333,7 +333,7 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/:siteId/:pageUrl/multiple/delete/:index',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyMultipleThingsDeletePostHandler()
   );
@@ -344,22 +344,22 @@ export default function initializeGovCyExpressService(opts = {}) {
   app.post('/:siteId/:pageUrl/update-my-details-response',
     serviceConfigDataMiddleware,
     requireAuth,
-    naturalPersonPolicy,
+    cyLoginPolicy,
     govcyServiceEligibilityHandler(true),
     govcyUpdateMyDetailsPostHandler());
   // ----- `updateMyDetails` handling
 
   // 📝 -- ROUTE: Dynamic route to render pages based on siteId and pageUrl, using govcyPageHandler middleware
-  app.get('/:siteId/:pageUrl', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(true), govcyLoadSubmissionData(), govcyPageHandler(), renderGovcyPage());
+  app.get('/:siteId/:pageUrl', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(true), govcyLoadSubmissionData(), govcyPageHandler(), renderGovcyPage());
 
   // ❌🗃️📥 -- ROUTE: Handle POST requests for delete file
-  app.post('/:siteId/:pageUrl/delete-file/:elementName', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(true), govcyFileDeletePostHandler());
+  app.post('/:siteId/:pageUrl/delete-file/:elementName', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(true), govcyFileDeletePostHandler());
 
   // 📥 -- ROUTE: Handle POST requests for review page. The `submit` action
-  app.post('/:siteId/review', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(), govcyReviewPostHandler());
+  app.post('/:siteId/review', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(), govcyReviewPostHandler());
 
   // 👀📥 -- ROUTE: Handle POST requests (Form Submissions) based on siteId and pageUrl, using govcyFormsPostHandler middleware
-  app.post('/:siteId/:pageUrl', serviceConfigDataMiddleware, requireAuth, naturalPersonPolicy, govcyServiceEligibilityHandler(true), govcyFormsPostHandler());
+  app.post('/:siteId/:pageUrl', serviceConfigDataMiddleware, requireAuth, cyLoginPolicy, govcyServiceEligibilityHandler(true), govcyFormsPostHandler());
 
   // post for /:siteId/review
 

package/src/middleware/cyLoginAuth.mjs

@@ -7,10 +7,10 @@
 import { getLoginUrl, handleCallback, getLogoutUrl } from '../auth/cyLoginAuth.mjs';
 import { logger } from "../utils/govcyLogger.mjs";
 import { handleMiddlewareError } from "../utils/govcyUtils.mjs";
-import { errorResponse } from "../utils/govcyApiResponse.mjs"; 
+import { errorResponse } from "../utils/govcyApiResponse.mjs";
 import { isApiRequest } from '../utils/govcyApiDetection.mjs';
 
-/* c8 ignore start */
+
 /**
  * Middleware to check if the user is authenticated. If not, redirect to the login page.
  * 
@@ -33,39 +33,7 @@ export function requireAuth(req, res, next) {
     next();
 }
 
-/**
- * Middleware to enforce natural person policy. If the user is not a natural person, return a 403 error.
- * 
- * @param {object} req The request object
- * @param {object} res The response object
- * @param {object} next The next middleware function
- */
-export function naturalPersonPolicy(req, res, next) {
-    // // allow only natural persons with approved profiles
-    // if (req.session.user.profile_type == 'Individual' && req.session.user.unique_identifier) {
-    //     next();
-    // } else {
-    //     return handleMiddlewareError("🚨 Access Denied: natural person policy not met.", 403, next);
-    // }
-    // https://dev.azure.com/cyprus-gov-cds/Documentation/_wiki/wikis/Documentation/42/For-Cyprus-Natural-or-Legal-person
-    const { profile_type, unique_identifier } = req.session.user || {};
-     // Allow only natural persons with approved profiles
-     if (profile_type === 'Individual' && unique_identifier) {
-        
-        // Validate Cypriot Citizen (starts with "00" and is 10 characters long)
-        if (unique_identifier.startsWith('00') && unique_identifier.length === 10) {
-            return next();
-        }
-
-        // Validate Foreigner with ARN (starts with "05" and is 10 characters long)
-        if (unique_identifier.startsWith('05') && unique_identifier.length === 10) {
-            return next();
-        }
-    }
-
-    // Deny access if validation fails
-    return handleMiddlewareError("🚨 Access Denied: natural person policy not met.", 403, next);
-}
+/* c8 ignore start */
 
 /**
  * Middleware to handle the login route. Redirects the user to the login URL.
@@ -107,11 +75,11 @@ export function handleSigninOidc() {
             // Redirect to the stored URL after login or fallback to '/'
             const redirectUrl = req.session.redirectAfterLogin || '/';
             // Clean up session for redirect after login
-            delete req.session.redirectAfterLogin; 
+            delete req.session.redirectAfterLogin;
             // Redirect to the stored URL
             res.redirect(redirectUrl);
         } catch (error) {
-            logger.debug('Token exchange failed:', error,req);
+            logger.debug('Token exchange failed:', error, req);
             res.status(500).send('Authentication failed');
         }
     }
@@ -138,4 +106,79 @@ export function handleLogout() {
         });
     };
 }
-/* c8 ignore end */
+/* c8 ignore end */
+
+
+/************************************************************************/
+/**
+ * Middleware to enforce natural person policy. If the user is not a verified natural person, return a false.
+ * 
+ * @param {object} req The request object
+ */
+export function naturalPersonPolicy(req) {
+    // https://dev.azure.com/cyprus-gov-cds/Documentation/_wiki/wikis/Documentation/42/For-Cyprus-Natural-or-Legal-person
+    const { profile_type, unique_identifier } = req.session.user || {};
+    // Allow only natural persons with approved profiles
+    if (profile_type === 'Individual' && unique_identifier) {
+
+        // Validate Cypriot Citizen (starts with "00" and is 10 characters long)
+        if (unique_identifier.startsWith('00') && unique_identifier.length === 10) {
+            return true;
+        }
+
+        // Validate Foreigner with ARN (starts with "05" and is 10 characters long)
+        if (unique_identifier.startsWith('05') && unique_identifier.length === 10) {
+            return true;
+        }
+    }
+
+    // Deny access if validation fails
+    return false;
+}
+
+/** * Middleware to enforce legal person policy. If the user is not a verified legal person, return false.
+ * 
+ * @param {object} req The request object
+ */
+export function legalPersonPolicy(req) {
+    // https://dev.azure.com/cyprus-gov-cds/Documentation/_wiki/wikis/Documentation/42/For-Cyprus-Natural-or-Legal-person
+    const { profile_type, legal_unique_identifier } = req.session.user || {};
+    // Allow only legal persons with approved profiles
+    if (profile_type === 'Organisation' && legal_unique_identifier) {
+        return true;
+    }
+
+    // Deny access if validation fails
+    return false;
+}
+
+const policyRegistry = {
+    naturalPerson: naturalPersonPolicy,
+    legalPerson: legalPersonPolicy,
+};
+
+export function cyLoginPolicy(req, res, next) {
+    // Check what is allowed in the service configuration
+    const allowed = req?.serviceData?.site?.cyLoginPolicies || ["naturalPerson"];
+
+    // Check each policy in the allowed list
+    for (const name of allowed) {
+        const policy = policyRegistry[name];
+        // Skip if the policy is not registered
+        if (!policy) {
+            console.warn(`🚨 Unknown policy: ${name}`);
+            continue
+        };
+
+        // 🚨 Strict mode: let errors throw naturally if data is malformed
+        const passed = policy(req);
+        if (passed) return next();
+    }
+
+    return handleMiddlewareError(
+        "🚨 Access Denied: none of the allowed CY Login policies matched.",
+        403,
+        next
+    );
+}
+/************************************************************************/

package/src/middleware/govcyPageHandler.mjs

@@ -26,6 +26,7 @@ export function govcyPageHandler() {
         logger.debug(`No pageUrl provided for siteId: ${siteId}`, req);
         // Example: Redirect to a default page or load a homepage
         pageUrl = "index"; // Change "index" to whatever makes sense for your service
+        req.params.pageUrl = pageUrl; // Update req.params to reflect the new pageUrl
       }
 
       // 🔍 Find the page by pageUrl

package/src/middleware/govcyReviewPostHandler.mjs

@@ -184,7 +184,7 @@ export function govcyReviewPostHandler() {
                 const submissionData = prepareSubmissionData(req, siteId, service);
 
                 // Prepare submission data for API
-                const submissionDataAPI = prepareSubmissionDataAPI(submissionData);
+                const submissionDataAPI = prepareSubmissionDataAPI(submissionData, service);
 
                 logger.debug("Prepared submission data for API:", submissionDataAPI);
 

package/src/middleware/govcyUpdateMyDetails.mjs

@@ -497,7 +497,7 @@ export function govcyUpdateMyDetailsPostHandler() {
                     // 🔄 User chose to update their details externally
                     const redirectUrl = constructUpdateMyDetailsRedirect(req, userId, umdBaseURL, returnUrl);
                     logger.info("User opted to update details externally", {
-                        userId: user.unique_identifier,
+                        userId: user.sub,
                         redirectUrl
                     });
                     return res.redirect(redirectUrl);

package/src/utils/govcyFormHandling.mjs

@@ -133,7 +133,7 @@ export function populateFormData(
                     // Delete link (preserve ?route=review if present)
                     element.params.deleteHref = `${basePath}/delete-file/${fieldName}${(routeParam) ? `?route=${routeParam}` : ''}`
 
-                   
+
                 } else {
                     // TODO: Ask Andreas how to handle empty file inputs
                     element.params.value = "";
@@ -295,3 +295,74 @@ export function getFormData(elements, formData, store = {}, siteId = "", pageUrl
 
     return filteredData;
 }
+
+/**
+ * Get empty form data for multipleThings elements.
+ * Used to fill in empty multipleThings pages with the correct structure
+ * 
+ * @param {object|Array} pageOrElements The page or elements of a conditional radio
+ * @param {object} emptyObject The object to populate with empty values
+ * @returns {object} An object with empty values for each form element 
+ */
+export function getMultipleThingsEmptyFormData(pageOrElements, emptyObject = {}) {
+    // Determine if we're given a full page or just an array of elements
+    let elements = [];
+    if (Array.isArray(pageOrElements)) {
+        elements = pageOrElements; // recursion case
+    } else if (pageOrElements?.pageTemplate?.sections) {
+        // Deep copy to avoid modifying the original
+        const pageTemplateCopy = JSON.parse(JSON.stringify(pageOrElements.pageTemplate));
+        // Find the first form element in sections
+        for (const section of pageTemplateCopy.sections) {
+            const form = section.elements?.find(el => el.element === "form");
+            if (form) {
+                elements = form?.params?.elements || [];
+                break;
+            }
+        }
+    } else {
+        // No valid elements
+        return emptyObject;
+    }
+
+    // Iterate through elements in order (like getFormData)
+    elements.forEach(element => {
+        const { name } = element.params || {};
+
+        if (ALLOWED_FORM_ELEMENTS.includes(element.element) && name) {
+            // Handle different element types
+            if (["checkboxes", "radios", "select"].includes(element.element)) {
+                emptyObject[name] = "";
+
+                // Handle conditional radios (same recursion pattern as getFormData)
+                if (element.element === "radios" && Array.isArray(element.params?.items)) {
+                    element.params.items.forEach(item => {
+                        if (item.conditionalElements) {
+                            Object.assign(
+                                emptyObject,
+                                getMultipleThingsEmptyFormData(item.conditionalElements, {})
+                            );
+                        }
+                    });
+                }
+            }
+
+            // Handle dateInput (single name, per your clarification)
+            else if (element.element === "dateInput") {
+                emptyObject[name] = "";
+            }
+
+            // Handle fileInput (suffix Attachment, per submission schema)
+            else if (element.element === "fileInput") {
+                emptyObject[`${name}Attachment`] = "";
+            }
+
+            // Handle all other elements (textInput, textArea, datePicker, etc.)
+            else {
+                emptyObject[name] = "";
+            }
+        }
+    });
+
+    return emptyObject;
+}

package/src/utils/govcySubmitData.mjs

@@ -4,7 +4,8 @@ import * as dataLayer from "./govcyDataLayer.mjs";
 import { DSFEmailRenderer } from '@gov-cy/dsf-email-templates';
 import { ALLOWED_FORM_ELEMENTS } from "./govcyConstants.mjs";
 import { evaluatePageConditions } from "./govcyExpressions.mjs";
-import { getPageConfigData } from "./govcyLoadConfigData.mjs";
+import { getServiceConfigData, getPageConfigData } from "./govcyLoadConfigData.mjs";
+import { getMultipleThingsEmptyFormData } from "./govcyFormHandling.mjs";
 import { logger } from "./govcyLogger.mjs";
 import { createUmdManualPageTemplate } from "../middleware/govcyUpdateMyDetails.mjs"
 import nunjucks from "nunjucks";
@@ -252,21 +253,48 @@ export function prepareSubmissionData(req, siteId, service) {
 /**
  * Prepares the submission data for the API, stringifying all relevant fields.
  * 
- * @param {object} data data prepared by `prepareSubmissionData`
+ * @param {object} data data prepared by `prepareSubmissionData`\
+ * @param {object} service service config data
  * @returns {object} The API-ready submission data object with all fields as strings
  */
-export function prepareSubmissionDataAPI(data) {
+export function prepareSubmissionDataAPI(data, service) {
+
+    //deep copy data to avoid mutating the original
+    let dataObj = JSON.parse(JSON.stringify(data));
+    // get site?.submissionAPIEndpoint.isDSFSubmissionPlatform
+    const isDSFSubmissionPlatform = service?.site?.usesDSFSubmissionPlatform || false;
+
+    // If DSF Submission Platform, ensure submissionData is an array
+    // this is intended for multipleThings pages only
+    if (isDSFSubmissionPlatform) {
+        // loop through submissionData 
+        for (const [key, value] of Object.entries(dataObj.submissionData || {})) {
+            // check if the value is an empty array
+            if (Array.isArray(value) && value.length === 0) {
+                // get the pageConfigData for the page
+                try {
+                    const page = getPageConfigData(service, key);
+                    let pageEmptyData = getMultipleThingsEmptyFormData(page);
+                    //replace the dataObj.submissionData[key] with the empty data
+                    dataObj.submissionData[key] = [pageEmptyData];
+    
+                } catch (error) {
+                    logger.error('Error getting pageConfigData:', key);
+                }
+            }
+        }
+    }
 
     return {
-        submissionUsername: String(data.submissionUsername ?? ""),
-        submissionEmail: String(data.submissionEmail ?? ""),
-        submissionData: JSON.stringify(data.submissionData ?? {}),
-        submissionDataVersion: String(data.submissionDataVersion ?? ""),
-        printFriendlyData: JSON.stringify(data.printFriendlyData ?? []),
-        rendererData: JSON.stringify(data.rendererData ?? {}),
-        rendererVersion: String(data.rendererVersion ?? ""),
-        designSystemsVersion: String(data.designSystemsVersion ?? ""),
-        service: JSON.stringify(data.service ?? {})
+        submissionUsername: String(dataObj.submissionUsername ?? ""),
+        submissionEmail: String(dataObj.submissionEmail ?? ""),
+        submissionData: JSON.stringify(dataObj.submissionData ?? {}),
+        submissionDataVersion: String(dataObj.submissionDataVersion ?? ""),
+        printFriendlyData: JSON.stringify(dataObj.printFriendlyData ?? []),
+        rendererData: JSON.stringify(dataObj.rendererData ?? {}),
+        rendererVersion: String(dataObj.rendererVersion ?? ""),
+        designSystemsVersion: String(dataObj.designSystemsVersion ?? ""),
+        service: JSON.stringify(dataObj.service ?? {})
     };
 }
 

package/src/utils/govcyValidator.mjs

@@ -28,6 +28,7 @@ function validateValue(value, rules) {
     alpha: (val) => /^[A-Za-zΑ-Ωα-ω\u0370-\u03ff\u1f00-\u1fff\s]+$/.test(val),
     alphaNum: (val) => /^[A-Za-zΑ-Ωα-ω\u0370-\u03ff\u1f00-\u1fff0-9\s]+$/.test(val),
     noSpecialChars: (val) => /^([0-9]|[A-Z]|[a-z]|[α-ω]|[Α-Ω]|[,]|[.]|[-]|[(]|[)]|[?]|[!]|[;]|[:]|[\n]|[\r]|[ _]|[\u0370-\u03ff\u1f00-\u1fff])+$/.test(val),
+    noSpecialCharsEl: (val) => /^([0-9]|[α-ω]|[Α-Ω]|[,]|[.]|[-]|[(]|[)]|[?]|[!]|[;]|[:]|[\n]|[\r]|[ _]|[\u0370-\u03ff\u1f00-\u1fff])+$/.test(val),
     name: (val) => /^[A-Za-zΑ-Ωα-ω\u0370-\u03ff\u1f00-\u1fff\s'-]+$/.test(val),
     tel: (val) => /^(?:\+|00)?[\d\s\-()]{8,20}$/.test(val.replace(/[\s\-()]/g, '')),
     mobile: (val) => /^(?:\+|00)?[\d\s\-()]{8,20}$/.test(val.replace(/[\s\-()]/g, '')),