hof 22.8.4-unhandled-error-fix-beta.1 → 22.9.0-beta

package/package/frontend/toolkit/assets/stylesheets/modules/_progressive-reveal.scss

@@ -0,0 +1,17 @@
+.reveal {
+    float: left;
+    width: 100%;
+    .panel-indent {
+        margin-top: $gutter-half / 2;
+        margin-bottom: $gutter-half;
+    }
+}
+
+fieldset + .reveal {
+    margin-top: -$gutter-half;
+    margin-bottom: $gutter-half;
+    @include media(tablet) {
+        margin-top: -$gutter;
+        margin-bottom: $gutter;
+    }
+}

package/package/frontend/toolkit/assets/stylesheets/modules/_validation.scss

@@ -0,0 +1,51 @@
+.validation-summary {
+    padding-left: $gutter-half - $validation-bdr-size-lg;
+    padding-right: $gutter-half;
+    border-width: $validation-bdr-size-lg;
+
+    &:focus {
+        outline: $focus-outline;
+    }
+
+    h2 {
+        margin: 0.3em 0;
+    }
+    ul {
+        margin: 0;
+        li {
+            margin: 0;
+            padding: 3px 0;
+        }
+    }
+    a {
+        @include bold-19;
+    }
+}
+
+.govuk-form-group--error {
+    box-sizing: border-box;
+    padding-left: $gutter-half - $validation-bdr-size;
+    border-left: $validation-bdr-size-lg solid $error-colour;
+
+    &:focus {
+        outline: $focus-outline;
+    }
+
+    .form-control {
+        margin-bottom: $validation-bdr-size;
+    }
+}
+
+.govuk-error-message {
+    display: block;
+    @include media(tablet) {
+        margin-bottom: 0.5em;
+    }
+    @include bold-19;
+    color: $error-colour;
+}
+
+.invalid-input,
+.govuk-form-group--error .date-input {
+    border: $validation-bdr-size solid $error-colour;
+}

package/package/frontend/toolkit/index.js

@@ -0,0 +1,10 @@
+module.exports = {
+  helpers: require('./assets/javascript/helpers'),
+  formFocus: require('./assets/javascript/form-focus'),
+  progressiveReveal: require('./assets/javascript/progressive-reveal'),
+  validation: require('./assets/javascript/validation'),
+  detailsSummary: function () {
+    require('./assets/javascript/vendor/details.polyfill');
+  },
+  characterCount: require('./assets/javascript/character-count')
+};

package/package/index.js

@@ -0,0 +1,351 @@
+'use strict';
+
+const crypto = require('crypto');
+const express = require('express');
+const morgan = require('morgan');
+const path = require('path');
+const http = require('http');
+const https = require('https');
+const mixins = require('./frontend').mixins;
+const hofMiddleware = require('./middleware');
+const markdown = require('./lib/markdown');
+const translate = require('i18n-future').middleware;
+const router = require('./lib/router');
+const health = require('./lib/health');
+const serveStatic = require('./lib/serve-static');
+const gaTagSetup = require('./lib/ga-tag');
+const deIndexer = require('./lib/deindex');
+const sessionStore = require('./lib/sessions');
+const settings = require('./lib/settings');
+const defaults = require('./config/hof-defaults');
+const logger = require('./lib/logger');
+const helmet = require('helmet');
+const _ = require('lodash');
+const deprecate = require('deprecate');
+
+const customConfig = {};
+
+const getConfig = function () {
+  const args = [].slice.call(arguments);
+  const config = _.merge.apply(_, [{}, defaults, customConfig].concat(args));
+
+  if (!config.theme) {
+    config.theme = require('./frontend').themes.govUK;
+  } else if (typeof config.theme === 'string') {
+    config.theme = require('./frontend').themes[config.theme];
+  }
+
+  config.markdown = config.markdown || {};
+
+  return config;
+};
+
+const loadRoutes = (app, config) => {
+  config.routes.forEach(route => {
+    const routeConfig = Object.assign({}, config, {
+      route,
+      sharedViews: app.get('views')
+    });
+    app.use(route.baseUrl || '/', router(routeConfig));
+  });
+};
+
+const applyErrorMiddlewares = (app, config) => {
+  if (config.serviceUnavailable === true) {
+    app.use(hofMiddleware.serviceUnavailable({
+      logger: config.logger
+    }));
+  }
+
+  app.use(hofMiddleware.notFound({
+    logger: config.logger
+  }));
+
+  app.use(hofMiddleware.errors({
+    logger: config.logger,
+    debug: config.env === 'development'
+  }));
+};
+
+const getContentSecurityPolicy = (config, res) => {
+  const csp = config.csp;
+
+  /* eslint-disable quotes */
+  const directives = {
+    defaultSrc: ["'none'"],
+    styleSrc: ["'self'"],
+    imgSrc: ["'self'"],
+    fontSrc: ["'self'", 'data:', 'https://design-system.service.gov.uk'],
+    scriptSrc: ["'self'", `'nonce-${res.locals.nonce}'`],
+    'frame-ancestors': ["'none'"]
+  };
+  /* eslint-enable quotes */
+
+  const gaDirectives = {
+    styleSrc: ['www.googletagmanager.com', 'fonts.googleapis.com', 'tagmanager.google.com'],
+    fontSrc: ['fonts.gstatic.com '],
+    scriptSrc: ['www.google-analytics.com', 'ssl.google-analytics.com'],
+    imgSrc: [
+      'www.google-analytics.com',
+      'ssl.gstatic.com',
+      'www.google.co.uk/ads/ga-audiences'
+    ],
+    connectSrc: [
+      "'self'",
+      'https://www.google-analytics.com',
+      'https://region1.google-analytics.com',
+      'https://region1.analytics.google.com'
+    ]
+  };
+
+  if (config.gaTagId) {
+    directives.styleSrc = directives.styleSrc.concat(gaDirectives.styleSrc);
+    directives.scriptSrc = directives.scriptSrc.concat(gaDirectives.scriptSrc);
+    directives.fontSrc = directives.fontSrc.concat(gaDirectives.fontSrc);
+    directives.imgSrc = directives.imgSrc.concat(gaDirectives.imgSrc);
+    directives.connectSrc = gaDirectives.connectSrc;
+  }
+
+  if (csp && !csp.disabled) {
+    _.each(csp, (value, name) => {
+      if (name === 'disabled') {
+        return;
+      }
+      if (directives[name] && directives[name].length) {
+        // concat unique directives with existing directives
+        directives[name] = _.uniq(directives[name].concat(value));
+      } else {
+        directives[name] = _.isArray(value) ? value : [value];
+      }
+    });
+  }
+  return directives;
+};
+
+/**
+ * Creates a new HOF application
+ *
+ * @param options {object} Configuration options for the HOF application
+ * @param options.behaviours {object | Array<object>} The HOF behaviour(s) to invoke for all sub-applications
+ * @param options.translations {string} The translations path for the application
+ * @param options.routes {Array<object>} The sub-applications for this app: for sandbox; require('./apps/sandbox')
+ * @param options.views {Array<string>} The view template paths for the application
+ * @param options.middleware {Array<function>} An array of Express middleware functions to use
+ * @param options.theme {string} Optional HOF theme - defaults to govuk
+ * @param options.markdown {object} Optional markdown options
+ * @param options.getTerms {boolean} Optional boolean - whether to mount the /terms endpoint
+ * @param options.getCookies {boolean} Optional boolean - whether to mount the /cookies endpoint
+ * @param options.noCache {boolean} Optional boolean - whether to disable caching
+ * @param options.getAccessibilityStatement {boolean} Optional boolean - whether to mount the
+ * /accessibility-statement endpoint
+ *
+ * @returns {object} A new HOF application using the configuration supplied in options
+ */
+function bootstrap(options) {
+  const config = getConfig(options);
+
+  const app = express();
+  const userMiddleware = express.Router();
+
+  app.use(helmet());
+
+  // Add common locals all pages can access
+  app.use((req, res, next) => {
+    res.locals.nonce = crypto.randomBytes(16).toString('hex');
+    res.locals.appName = config.appName;
+    res.locals.htmlLang = config.htmlLang;
+    res.locals.cookieName = config.session.name;
+    // session timeout warning configs
+    res.locals.sessionTimeOut = config.session.ttl;
+    res.locals.sessionTimeOutWarning = config.sessionTimeOutWarning;
+    res.locals.sessionTimeoutWarningContent = config.sessionTimeoutWarningContent;
+    res.locals.exitFormContent = config.exitFormContent;
+    res.locals.saveExitFormContent = config.saveExitFormContent;
+    res.locals.serviceUnavailable = config.serviceUnavailable;
+    res.locals.gaContainerId = config.ga4TagId;
+    next();
+  });
+
+  if (config.csp !== false && !config.csp.disabled) {
+    app.use((req, res, next) => {
+      helmet.contentSecurityPolicy({
+        directives: getContentSecurityPolicy(config, res)
+      })(req, res, next);
+    });
+  }
+
+  app.use(helmet.noSniff());
+
+  if (config.noCache && config.noCache !== 'false') {
+    app.use((req, res, next) => {
+      res.setHeader('cache-control', ['no-store', 'no-cache', 'must-revalidate', 'proxy-revalidate']);
+      res.setHeader('pragma', 'no-cache');
+      next();
+    });
+  }
+
+  if (!config || !config.routes || !config.routes.length) {
+    throw new Error('Must be called with a list of routes');
+  }
+
+  config.routes.forEach(route => {
+    if (!route.steps && !route.pages) {
+      throw new Error('Each app must have steps and/or pages');
+    }
+  });
+
+  if (config.middleware) {
+    config.middleware.forEach(middleware => app.use(middleware));
+  }
+
+  config.logger = logger(config);
+
+  morgan.token('id', req => _.get(req, 'session.id', 'N/A'));
+
+  app.use(morgan('sessionId=:id ' + morgan.combined, {
+    stream: config.logger.stream,
+    skip: (req, res) => config.loglevel !== 'debug' &&
+      (
+        res.statusCode >= 300 || !_.get(req, 'session.id') ||
+        config.ignoreMiddlewareLogs.some(v => req.originalUrl.includes(v))
+      )
+  }));
+
+  serveStatic(app, config);
+  settings(app, config);
+  gaTagSetup(app, config);
+  deIndexer(app, config);
+
+  const sessions = sessionStore(app, config);
+  app.use('/healthz', health(sessions));
+
+  app.use((req, res, next) => {
+    const id = _.get(req, 'session.id', 'N/A');
+    req.log = config.logger.logSession(id);
+    next();
+  });
+
+  app.use(translate({
+    resources: config.theme.translations,
+    path: path.resolve(config.root, config.translations) + '/__lng__/__ns__.json'
+  }));
+  app.use(mixins());
+  app.use(markdown(config.markdown));
+  // rate limits have to be loaded before all routes so it is applied to them
+  if (config.rateLimits.requests.active) {
+    app.use(hofMiddleware.rateLimiter(config, 'requests'));
+  }
+
+  // Set up routing so <YOUR-SITE-URL>/assets are served from /node_modules/govuk-frontend/govuk/assets
+  app.use('/assets', express.static(path.join(__dirname, '/node_modules/govuk-frontend/govuk/assets')));
+  // Check if service has been paused and redirect accordingly
+  const bypassPaths = ['/assets', '/healthcheck', '/service-unavailable'];
+
+  if (config.serviceUnavailable === true) {
+    app.use((req, res, next) => {
+      if (!bypassPaths.some(bypassPath => req.path.startsWith(bypassPath))) {
+        return res.redirect('/service-unavailable');
+      }
+      return next();
+    });
+  }
+  if (config.getAccessibility === true) {
+    deprecate(
+      '`getAccessibility` option is deprecated and may be removed in future versions.',
+      'Use `pages` to define static cookies page.'
+    );
+    app.get('/accessibility', (req, res) => {
+      const locals = Object.assign({}, req.translate('accessibility'));
+      res.render('accessibility', locals);
+    });
+  }
+  if (config.getCookies === true) {
+    deprecate(
+      '`getCookies` option is deprecated and may be removed in future versions.',
+      'Use `pages` to define static cookies page.'
+    );
+    app.get('/cookies', (req, res) => {
+      const locals = Object.assign({}, req.translate('cookies'));
+      res.render('cookies', locals);
+    });
+  }
+  if (config.getTerms === true) {
+    deprecate(
+      '`getTerms` option is deprecated and may be removed in future versions.',
+      'Use `pages` to define static terms and conditions page.'
+    );
+    app.get('/terms-and-conditions', (req, res) => {
+      const locals = Object.assign({}, req.translate('terms'));
+      res.render('terms', locals);
+    });
+  }
+
+  app.use(userMiddleware);
+  app.use(hofMiddleware.cookies(config));
+  loadRoutes(app, config);
+  applyErrorMiddlewares(app, config);
+
+  const instance = {
+    use() {
+      userMiddleware.use.apply(userMiddleware, arguments);
+      return instance;
+    },
+
+    server: null,
+
+    start: sConfig => {
+      let startConfig = sConfig;
+      startConfig = getConfig(config, startConfig);
+
+      const protocol = startConfig.protocol === 'http' ? http : https;
+
+      instance.server = protocol.createServer(app);
+
+      return new Promise((resolve, reject) => {
+        instance.server.listen(startConfig.port, startConfig.host, err => {
+          if (err) {
+            reject(new Error('Unable to connect to server'));
+          }
+          config.logger.log('info', `${config.appName} started!`);
+          resolve(instance);
+        });
+      });
+    },
+
+    stop() {
+      return new Promise((resolve, reject) => instance.server.close(err => {
+        if (err) {
+          reject(new Error('Unable to stop server'));
+        }
+        config.logger.log('info', `${config.appName} stopped!`);
+        resolve(instance);
+      }));
+    }
+  };
+
+  if (config.start !== false) {
+    instance.start(config);
+  }
+
+  return instance;
+}
+
+bootstrap.configure = function (key, val) {
+  if (arguments.length === 2 && typeof key === 'string') {
+    customConfig[key] = val;
+  } else if (typeof key === 'object') {
+    Object.assign(customConfig, key);
+  }
+};
+
+module.exports = bootstrap;
+module.exports.build = require('./build/');
+module.exports.transpiler = require('./transpiler/');
+module.exports.middleware = require('./middleware');
+module.exports.controller = require('./controller');
+module.exports.model = require('./model');
+module.exports.apis = require('./model/apis');
+module.exports.wizard = require('./wizard');
+module.exports.components = require('./components');
+module.exports.utils = require('./utilities');
+module.exports.frontend = require('./frontend');

package/package/lib/deindex.js

@@ -0,0 +1,18 @@
+'use strict';
+
+module.exports = (app, config) => {
+  // Ensure the value of deIndex is evaluated as a boolean regardless of if single quotes are used
+  // to have the expected conditional behaviour in the Mustache template
+  const deIndex = (config.deIndexForm === 'true' || config.deIndexForm === true);
+
+  app.use((req, res, next) => {
+    // Preparing common res.locals properties
+    const properties = {
+      deIndex: deIndex
+    };
+    res.locals = Object.assign(res.locals, properties);
+    next();
+  });
+
+  return app;
+};

package/package/lib/encryption.js

@@ -0,0 +1,23 @@
+/* eslint-disable */ 
+'use strict';
+
+const crypto = require('crypto');
+const algorithm = 'aes-256-cbc';
+
+module.exports = password => ({
+
+  encrypt: text => {
+    const cipher = crypto.createCipher(algorithm, password);
+    let crypted = cipher.update(text, 'utf8', 'hex');
+    crypted += cipher.final('hex');
+    return crypted;
+  },
+
+  decrypt: text => {
+    const decipher = crypto.createDecipher(algorithm, password);
+    let dec = decipher.update(text, 'hex', 'utf8');
+    dec += decipher.final('utf8');
+    return dec;
+  }
+
+});

package/package/lib/ga-tag.js

@@ -0,0 +1,89 @@
+'use strict';
+
+const _ = require('lodash');
+
+const convertToGTMPage = text => {
+  // Remove leading and trailing slashes
+  let str = text.replace(/^\/|\/$/g, '');
+  // Replace hyphens with spaces and capitalize each word
+  str = str.replace(/-+/g, ' ').replace(/(^|\s)\S/g, function (match) {
+    return match.toUpperCase();
+  });
+  return str;
+};
+
+const pageView = (path, pageMap) => pageMap.get(path) || path;
+
+const createUris = routes => {
+  const uris = _.map(routes, subApp => {
+    let subAppUris = Object.keys(subApp.steps || {});
+    const subAppBaseUrl = subApp.baseUrl;
+
+    if (subAppBaseUrl) {
+      subAppUris = _.map(subAppUris, uri => `${subAppBaseUrl}${uri}`);
+      subAppUris.unshift(subAppBaseUrl);
+    }
+    return subAppUris;
+  });
+
+  return _.flatten(uris);
+};
+
+const createIdentifiers = routes => _.map(routes, route => {
+  const routeIdentifier = route
+    .replace(/^[^A-Z0-9]+/gi, '')
+    .toLowerCase()
+    .replace(/([^A-Z0-9]+)(.)/ig, function () {
+      return arguments[2].toUpperCase();
+    });
+
+  return [route, routeIdentifier];
+});
+
+const setupPageMap = routes => {
+  let mappedRoutes = createUris(routes);
+  mappedRoutes = createIdentifiers(mappedRoutes);
+
+  const pageMap = new Map(mappedRoutes);
+
+  return pageMap;
+};
+
+module.exports = (app, config) => {
+  const gaTagId = config.gaTagId;
+  const ga4TagId = config.ga4TagId;
+  const gtm = config.gtm;
+  const gaCrossDomainTrackingTagId = config.gaCrossDomainTrackingTagId;
+  const routes = config.routes;
+
+  if (gaTagId || ga4TagId || gtm.tagId) {
+    const pageMap = setupPageMap(routes);
+
+    app.use((req, res, next) => {
+      const page = pageView(req.path, pageMap);
+
+      // Preparing common res.locals properties
+      const properties = {
+        gaAllowDebug: config.env === 'development',
+        gaTagId: gaTagId,
+        ga4TagId: ga4TagId,
+        gaCrossDomainTrackingTagId: gaCrossDomainTrackingTagId,
+        'ga-id': gaTagId,
+        'ga-page': page
+      };
+
+      // Adding extra properties if a GTM TAG is available
+      if (gtm.tagId) {
+        gtm.config.pageName = gtm.composePageName(page, convertToGTMPage);
+        Object.assign(properties, {
+          gtmConfig: JSON.stringify(gtm.config),
+          gtmTagId: gtm.tagId
+        });
+      }
+      res.locals = Object.assign(res.locals, properties);
+      next();
+    });
+  }
+
+  return app;
+};

package/package/lib/health.js

@@ -0,0 +1,26 @@
+/*
+ * This file provides readiness and liveness checks for use with Kubernetes.
+ * For information on how to set them up, look at the Kubernetes documentation:
+ *
+ * https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+ *
+ */
+'use strict';
+
+const router = require('express').Router();
+const healthCheck = require('express-healthcheck');
+
+module.exports = redis => {
+  router.get('/ping', healthCheck());
+
+  router.get('/readiness', healthCheck({
+    test: () => {
+      if (!redis.connected && !redis.ready) {
+        return new Error('Session store unhealthy');
+      }
+      return 0;
+    }
+  }));
+
+  return router;
+};

package/package/lib/helpers.js

@@ -0,0 +1,66 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const getPath = (config, part) => {
+  let result = config.route[part] && path.resolve(config.root, config.route[part]);
+  if (!result) {
+    result = config.route.name && path.resolve(config.root, `apps/${config.route.name}/${part}`);
+  }
+  return result;
+};
+
+module.exports = class Helpers {
+  static getPaths(config) {
+    return {
+      fields: {
+        base: config.fields && path.resolve(config.root, config.fields),
+        route: getPath(config, 'fields')
+      },
+      views: getPath(config, 'views'),
+      translations: getPath(config, 'translations')
+    };
+  }
+
+  static getViews(views, strict) {
+    if (views) {
+      try {
+        fs.accessSync(views);
+      } catch (err) {
+        if (strict) {
+          throw new Error(`Cannot find route views at ${views}`);
+        } else {
+          return null;
+        }
+      }
+    }
+    return views;
+  }
+
+  static getFields(pathFields) {
+    let routeFields;
+    let fields;
+
+    if (pathFields.base) {
+      try {
+        fields = require(pathFields.base);
+      } catch (err) {
+        throw new Error(`Cannot find fields at ${pathFields.base}`);
+      }
+    }
+    if (pathFields.route) {
+      try {
+        routeFields = require(pathFields.route);
+      } catch (err) {
+        throw new Error(`Cannot find route fields at ${pathFields.route}`);
+      }
+    }
+
+    if (!fields && !routeFields) {
+      throw new Error('Set base fields or route fields or both');
+    }
+
+    return Object.assign({}, fields, routeFields);
+  }
+};