DTR-1170: Wiring in LP-2 #28
Conversation
| updatedUa <- Future.fromTry(ua.set(AgentClientsPage, updatedList)) | ||
| _ <- sessionRepository.set(updatedUa) | ||
| } yield AgentLandingViewModel( | ||
| clientName = updatedClient.schemeName.getOrElse(""), |
There was a problem hiding this comment.
Just want to check, should the clientName be the schemeName?
There was a problem hiding this comment.
I think so as per confirmation from Laiba before, link for above pic is F6
| GET /agent/no-client-list controllers.agent.FailedToRetrieveClientController.onPageLoad() | ||
| GET /agent/no-authorised-clients controllers.agent.NoAuthorisedClientsController.onPageLoad() | ||
| GET /agent/authorised-client-manage-CIS-returns controllers.agent.AgentLandingController.onPageLoad() | ||
| GET /agent/cis-return-dashboard/:uniqueId controllers.agent.AgentLandingController.onPageLoad(uniqueId: String) |
There was a problem hiding this comment.
Our we ok to expose the uniqueId in the url ?
There was a problem hiding this comment.
Adding uniqueId as we need something that distinguish different agent clients. If we don't want uniqueId exposed in url, we can refactor the code to use index as we have all agent clients persisted in Mongo.
From the security side, I assume this should be fine. If the agent changes the uniqueId in the url from "123" (authorised) to "456"(unauthorised), we still have the guard in BE to ensure that only client authorised agent can view the landing page for a certain client. So agent would not see client's landing page whose uniqueId is "456".
Also uniqueId is not itself PII like utr or NINO or other sensitive info like tax office no. & ref that are actually exposed in the url in the as-is java service.
There was a problem hiding this comment.
Can we create a component simial to:
https://github.com/hmrc/customs-financials-secure-messaging-frontend/blob/main/app/views/GovukWrapper.scala.html#L66
There was a problem hiding this comment.
There was a problem hiding this comment.
Thanks Richy, updated now
|
No description provided.