From 55f0d982c12fcc8623b0e78ec83fe2af12de2207 Mon Sep 17 00:00:00 2001
From: Ashley Ward <421038+ashward@users.noreply.github.com>
Date: Wed, 10 Jul 2024 17:29:09 +0100
Subject: [PATCH] Changing the back link to user proper urls rather than just
 relying on the browser history as the CSP breaks this

---
 src/controllers/deleteController.ts       | 2 +-
 src/controllers/keyController.ts          | 2 +-
 src/controllers/revokeController.ts       | 2 +-
 src/controllers/verificationController.ts | 8 ++++----
 views/back-button.njk                     | 1 -
 views/checkVerification.njk               | 1 -
 views/completion.njk                      | 1 -
 views/dashboard.njk                       | 1 -
 views/delete.njk                          | 1 -
 views/keySuccessPage.njk                  | 1 -
 views/layout.njk                          | 7 +++++++
 views/newKey.njk                          | 1 -
 views/rejectedPage.njk                    | 1 -
 views/revoke.njk                          | 1 -
 views/verification.njk                    | 1 -
 15 files changed, 14 insertions(+), 17 deletions(-)
 delete mode 100644 views/back-button.njk

diff --git a/src/controllers/deleteController.ts b/src/controllers/deleteController.ts
index 1112e097..2fb8e0b9 100644
--- a/src/controllers/deleteController.ts
+++ b/src/controllers/deleteController.ts
@@ -10,7 +10,7 @@ export const showDeleteKey = async (req: Request, res: Response, next: NextFunct
     const apiKey = await ApiService.getKey(user, customerKeyId)
     const createdAt = DashboardPresenter.formatDate(apiKey.CreatedAt, true)
 
-    res.render('delete', { apiKey, createdAt })
+    res.render('delete', { apiKey, createdAt, backLinkHref: '/dashboard' })
   } catch (error) {
     next(error)
   }
diff --git a/src/controllers/keyController.ts b/src/controllers/keyController.ts
index dca22961..663ef501 100644
--- a/src/controllers/keyController.ts
+++ b/src/controllers/keyController.ts
@@ -5,7 +5,7 @@ import { ApiKeyPresenter } from '../presenters/apiKeyPresenter'
 import { validationResult } from 'express-validator'
 
 export const newKey = (_req: Request, res: Response): void => {
-  res.render('newKey')
+  res.render('newKey', { backLinkHref: '/dashboard' })
 }
 
 export const create = async (req: Request, res: Response, next: NextFunction): Promise<void> => {
diff --git a/src/controllers/revokeController.ts b/src/controllers/revokeController.ts
index 2a3dec6b..8554b906 100644
--- a/src/controllers/revokeController.ts
+++ b/src/controllers/revokeController.ts
@@ -10,7 +10,7 @@ export const showRevoke = async (req: Request, res: Response, next: NextFunction
     const apiKey = await ApiService.getKey(user, customerKeyId)
     const createdAt = DashboardPresenter.formatDate(apiKey.CreatedAt, true)
 
-    res.render('revoke', { apiKey, createdAt })
+    res.render('revoke', { apiKey, createdAt, backLinkHref: '/dashboard' })
   } catch (error) {
     next(error)
   }
diff --git a/src/controllers/verificationController.ts b/src/controllers/verificationController.ts
index 465eb9ff..9db90e56 100644
--- a/src/controllers/verificationController.ts
+++ b/src/controllers/verificationController.ts
@@ -47,7 +47,7 @@ export const newVerificationPage = (req: Request, res: Response): void => {
   session.eoriNumber = session.eoriNumber ?? ''
   session.ukacsReference = session.ukacsReference ?? ''
   session.emailAddress = session.emailAddress ?? ''
-  res.render('verification', { session })
+  res.render('verification', { session, backLinkHref: '/' })
 }
 
 export const checkVerificationDetails = async (req: Request, res: Response, next: NextFunction): Promise<void> => {
@@ -76,9 +76,9 @@ export const checkVerificationDetails = async (req: Request, res: Response, next
       }
     }
     if (Object.keys(errors).length === 0) {
-      res.render('checkVerification', { body, session })
+      res.render('checkVerification', { body, session, backLinkHref: '/verification' })
     } else {
-      res.render('verification', { body, session, errors, errorList: Object.values(errors) })
+      res.render('verification', { body, session, errors, errorList: Object.values(errors), backLinkHref: '/' })
     }
   } catch (error) {
     next(error)
@@ -127,7 +127,7 @@ export const applicationComplete = async (req: Request, res: Response, next: Nex
       req.session = null
       res.render('completion', { applicationReference })
     } else {
-      res.render('checkVerification', { body, session, errors, errorList: Object.values(errors) })
+      res.render('checkVerification', { body, session, errors, errorList: Object.values(errors), backLinkHref: '/verification' })
     }
   } catch (error) {
     next(error)
diff --git a/views/back-button.njk b/views/back-button.njk
deleted file mode 100644
index 425caed3..00000000
--- a/views/back-button.njk
+++ /dev/null
@@ -1 +0,0 @@
-<a href="javascript:history.back()" class="govuk-back-link">Back</a>
diff --git a/views/checkVerification.njk b/views/checkVerification.njk
index 98b76b1c..3e627ccd 100644
--- a/views/checkVerification.njk
+++ b/views/checkVerification.njk
@@ -4,7 +4,6 @@
 {% from "govuk/components/error-summary/macro.njk" import govukErrorSummary %}
 
 {% block content %}
-    {% include "back-button.njk" %}
     <div class="govuk-grid-row">
         <div class="govuk-grid-column-two-thirds-from-desktop">
             <h1 class="govuk-heading-l">Check your answers</h1>
diff --git a/views/completion.njk b/views/completion.njk
index 753aaf9a..54c3970f 100644
--- a/views/completion.njk
+++ b/views/completion.njk
@@ -1,6 +1,5 @@
 {% extends "layout.njk" %}
 {% block content %}
-    {% include "back-button.njk" %}
     <main class="govuk-main-wrapper govuk-width-container"
           id="main-content"
           role="main">
diff --git a/views/dashboard.njk b/views/dashboard.njk
index ed5f605b..1d4b7566 100644
--- a/views/dashboard.njk
+++ b/views/dashboard.njk
@@ -3,7 +3,6 @@
 {% block title %}Dashboard{% endblock %}
 {% set createKeyPath = ["/dashboard/new"] | join %}
 {% block content %}
-    {% include "back-button.njk" %}
     <span class="govuk-caption-l">Commodity Code Identification Tool Hub</span>
     <h1 class="govuk-heading-l">Your account</h1>
     <p class="govuk-body">
diff --git a/views/delete.njk b/views/delete.njk
index e2babd25..b5071522 100644
--- a/views/delete.njk
+++ b/views/delete.njk
@@ -2,7 +2,6 @@
 {% from "govuk/components/warning-text/macro.njk" import govukWarningText %}
 {% block title %}Dashboard{% endblock %}
 {% block content %}
-    {% include "back-button.njk" %}
     <h1 class="govuk-heading-l">Delete an API Key</h1>
     {{ govukWarningText({
         "text": "Your API Key will be deleted with immediate effect and cannot be reactivated once deleted.",
diff --git a/views/keySuccessPage.njk b/views/keySuccessPage.njk
index 4e02c5a1..099ad532 100644
--- a/views/keySuccessPage.njk
+++ b/views/keySuccessPage.njk
@@ -8,7 +8,6 @@
 
 {% block title %}Dashboard{% endblock %}
 {% block content %}
-  {% include "back-button.njk" %}
   {{ govukPanel({
       titleText: "Your API Key has been created successfully"
   }) }}
diff --git a/views/layout.njk b/views/layout.njk
index 6e2e756e..12388ada 100644
--- a/views/layout.njk
+++ b/views/layout.njk
@@ -1,5 +1,6 @@
 {% extends "govuk/template.njk" %}
 <!DOCTYPE html>
+{% from "govuk/components/back-link/macro.njk" import govukBackLink %}
 {% from "govuk/components/cookie-banner/macro.njk" import govukCookieBanner %}
 {% from "govuk/components/skip-link/macro.njk" import govukSkipLink %}
 {% from "govuk/components/header/macro.njk" import govukHeader %}
@@ -34,6 +35,12 @@
                 },
                 html: phaseBannerHtml
                 }) }}
+        {%- if backLinkHref %}
+        {{ govukBackLink({
+            href: backLinkHref,
+            text: "Back"
+        }) }}
+        {% endif %}
     {% endblock %}
     <body class="govuk-template_body govuk-frontend-supported">
         <main id="main-content"
diff --git a/views/newKey.njk b/views/newKey.njk
index 4741239d..afeb6a91 100644
--- a/views/newKey.njk
+++ b/views/newKey.njk
@@ -5,7 +5,6 @@
 
 {% block title %}Dashboard{% endblock %}
 {% block content %}
-    {% include "back-button.njk" %}
     {% if error %}
         {{ govukErrorSummary({
             titleText: "There is a problem",
diff --git a/views/rejectedPage.njk b/views/rejectedPage.njk
index 3bca6c44..bbc938be 100644
--- a/views/rejectedPage.njk
+++ b/views/rejectedPage.njk
@@ -2,7 +2,6 @@
 {% from "govuk/components/button/macro.njk" import govukButton %}
 
 {% block content %}
-    {% include "back-button.njk" %}
     <div class="govuk-grid-row">
         <div class="govuk-grid-column-two-thirds-from-desktop">
             <h1 class="govuk-heading-l">Your application has been rejected</h1>
diff --git a/views/revoke.njk b/views/revoke.njk
index 0b2cdb19..113c4998 100644
--- a/views/revoke.njk
+++ b/views/revoke.njk
@@ -4,7 +4,6 @@
 {% from "govuk/components/warning-text/macro.njk" import govukWarningText %}
 {% block title %}Dashboard{% endblock %}
 {% block content %}
-    {% include "back-button.njk" %}
     <h1 class="govuk-heading-l">Revoke an API Key</h1>
     <p class="govuk-body">
         Check the below details regarding the API Key you have selected to revoke and confirm your choice.
diff --git a/views/verification.njk b/views/verification.njk
index a48c457c..9432873e 100644
--- a/views/verification.njk
+++ b/views/verification.njk
@@ -3,7 +3,6 @@
 {% from "govuk/components/error-summary/macro.njk" import govukErrorSummary %}
 
 {% block content %}
-    {% include "back-button.njk" %}
     {% if errorList.length > 0 %}
         {{ govukErrorSummary({
             titleText: "There is a problem",