Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add "No Access" page #559

Closed
wants to merge 20 commits into from
Closed

Add "No Access" page #559

wants to merge 20 commits into from

Conversation

dynamictulip
Copy link
Collaborator

@dynamictulip dynamictulip commented Oct 14, 2024 •
edited
Loading

Changes the auth processes in FIAT to allow unauthorised users to be redirected to a "No Access" page.

User Story 135671: Build: Authentication - Add access-denied screen

Changes

No Access specific changes

  • Add ADR about "No Access" page
  • Create authorised FIAT user role and add role requirement to authorisation
  • Add no access page and add redirect logic (described in ADR)
  • Hide header and footer areas not accessible to users without FIAT access
  • Make cookies, accessibility statement and privacy notice pages accessible to users without FIAT access
  • Update MockHttpContext to have separate cookie mocks and to mock user authentication state

Other changes:

  • Fix Privacy page having incorrect width
  • Move EnvironmentExtensions.cs into the Extensions folder
  • Change SameSite setting for the login cookie to current Microsoft recommendation of Lax
  • Move FIAT cookie names to static config class
  • Update name of cookie consent cookie to be consistent with application name and what is displayed in the Cookie UI

(This was a long running piece of work with change of direction which originally touched these areas)

Screenshots of UI changes

New "No Access" page

image

Header changes

Authorised user (No change)

image

Unauthorised user

image

Footer changes

Authorised user (No change)

image

Unauthorised user

image

Checklist

  • Pull request attached to the appropriate user story in Azure DevOps
  • ADR decision log updated (if needed)
  • Release notes added to CHANGELOG.md
  • Testing complete - all manual and automated tests pass

@dynamictulip dynamictulip force-pushed the add-access-denied-page branch 2 times, most recently from 8d70139 to 60d1b59 Compare October 16, 2024 14:48
@dynamictulip dynamictulip changed the title WIP - Add access denied page Add "No Access" page Oct 30, 2024
@dynamictulip dynamictulip marked this pull request as ready for review October 30, 2024 10:40
nwarms
nwarms previously approved these changes Oct 30, 2024
View reviewed changes
Copy link
Collaborator

@nwarms nwarms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving as my comment isn't really a huge issue so up to you if you want to do it

@dynamictulip
Move AutomationAuthorizationHandler to be in the authentication sec…
5e2a1c8 
…tion
@dynamictulip
Share an anonymous page model between always accessible pages
4b50701 
Reduces code, makes it easier to see which pages have anonymous access and aggregates the behavior into one place
@sonarcloud SonarCloud
Copy link

sonarcloud bot commented Oct 30, 2024

Quality Gate Failed Quality Gate failed

Failed conditions
2 New Code Smells (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

@dynamictulip
Copy link
Collaborator Author

dynamictulip commented Oct 30, 2024 •
edited
Loading

Moving to using a feature branch which is formed from the main code implementation part of this branch. Other commits will be merged into that branch

New PR at #580

@dynamictulip dynamictulip deleted the add-access-denied-page branch October 30, 2024 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nwarms nwarms nwarms approved these changes

@CMurrell148 CMurrell148 Awaiting requested review from CMurrell148 CMurrell148 is a code owner

@dneed-nimble dneed-nimble Awaiting requested review from dneed-nimble dneed-nimble is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@dynamictulip @nwarms