Gap 2587/redirect to404when not allowed on a page

packages/admin/src/middleware.page.ts

@@ -11,7 +11,16 @@ const authenticateRequest = async (req: NextRequest, res: NextResponse) => {
   const authCookie = req.cookies.get('session_id');
   const userJwtCookie = req.cookies.get(process.env.JWT_COOKIE_NAME);
 
-  if (!authCookie || !userJwtCookie) {
+  const isLoggedIn = !!userJwtCookie;
+  const isLoggedInAsAdmin = !!authCookie;
+  // means that the user is logged in but not as an admin/superAdmin (otherwise they would have had the session_id cookie set)
+  if (isLoggedIn && !isLoggedInAsAdmin) {
+    const url = getLoginUrl({ redirectTo404: true });
+    logger.info(
+      `User is not an admin - redirecting it to appropriate app 404 page`
+    );
+    return NextResponse.redirect(url, { status: 302 });
+  } else if (!isLoggedIn || !isLoggedInAsAdmin) {
     let url = getLoginUrl();
     if (isSubmissionExportLink(req)) {
       url += `?${generateRedirectUrl(req)}`;
@@ -21,6 +30,7 @@ const authenticateRequest = async (req: NextRequest, res: NextResponse) => {
   }
 
   const isValidSession = await isValidAdminSession(authCookie);
+  //user has the session_id cookie set but not valid
   if (!isValidSession) {
     const url = getLoginUrl({ redirectToApplicant: true });
     logger.info(`Admin session invalid - logging in via applicant app: ${url}`);

packages/admin/src/utils/general.ts

@@ -28,13 +28,17 @@ const getObjEntriesByKeySubstr = (substr: string, obj: object) => {
 
 type GetLoginUrlOptions = {
   redirectToApplicant?: boolean;
+  redirectTo404?: boolean;
 };
 
 const getLoginUrl = (options?: GetLoginUrlOptions) => {
   const oneLoginEnabled = process.env.ONE_LOGIN_ENABLED === 'true';
   if (options?.redirectToApplicant && oneLoginEnabled) {
     return `${process.env.V2_LOGIN_URL}?redirectUrl=${process.env.APPLICANT_DOMAIN}/dashboard`;
   }
+  if (options?.redirectTo404 && oneLoginEnabled) {
+    return `${process.env.V2_LOGIN_URL}?redirectUrl=/404`;
+  }
   return oneLoginEnabled
     ? (process.env.V2_LOGIN_URL as string)
     : (process.env.LOGIN_URL as string);

packages/applicant/src/pages/404.page.tsx

@@ -26,7 +26,7 @@ const Custom404 = () => {
             </p>
             <p className="govuk-body">
               To return to the dashboard, please visit the{' '}
-              <Link href="/" className="govuk-link">
+              <Link href="/dashboard" className="govuk-link">
                 dashboard
               </Link>{' '}
               page.