exui-2655-fortify scan issue

src/app/app.module.ts

@@ -14,7 +14,6 @@ import { LoggerModule, NGXLogger, NgxLoggerLevel } from 'ngx-logger';
 import { environment } from '../environments/environment';
 import { EnvironmentConfig } from '../models/environmentConfig.model';
 import { DefaultErrorHandler } from '../shared/errorHandler/defaultErrorHandler';
-import { CryptoWrapper } from '../shared/services/cryptoWrapper';
 import { JwtDecodeWrapper } from '../shared/services/jwtDecodeWrapper';
 import { LoggerService } from '../shared/services/logger.service';
 import { UserService } from '../user-profile/services/user.service';
@@ -105,7 +104,7 @@ export function launchDarklyClientIdFactory(envConfig: EnvironmentConfig): strin
     FeatureToggleGuard,
     { provide: RouterStateSerializer, useClass: CustomSerializer },
     UserService, { provide: ErrorHandler, useClass: DefaultErrorHandler },
-    CryptoWrapper, JwtDecodeWrapper, LoggerService, JurisdictionService,
+    JwtDecodeWrapper, LoggerService, JurisdictionService,
     { provide: FeatureToggleService, useClass: LaunchDarklyService },
     { provide: APP_INITIALIZER, useFactory: initApplication, deps: [Store, EnvironmentService], multi: true }
   ],

src/organisation/organisation.module.ts

@@ -21,7 +21,6 @@ import { RxReactiveFormsModule } from '@rxweb/reactive-form-validators';
 import { LoggerModule, NgxLoggerLevel } from 'ngx-logger';
 import { DefaultErrorHandler } from '../shared/errorHandler/defaultErrorHandler';
 import { AbstractAppInsights, AppInsightsWrapper } from '../shared/services/appInsightsWrapper';
-import { CryptoWrapper } from '../shared/services/cryptoWrapper';
 import { JwtDecodeWrapper } from '../shared/services/jwtDecodeWrapper';
 import { LoggerService } from '../shared/services/logger.service';
 import { MonitoringService } from '../shared/services/monitoring.service';
@@ -47,7 +46,7 @@ import { effects, reducers } from './store';
   declarations: [...fromContainers.containers, ...fromComponent.components],
   providers: [...fromServices.services, OrganisationGuard,
     { provide: AbstractAppInsights, useClass: AppInsightsWrapper },
-    CryptoWrapper, JwtDecodeWrapper, MonitoringService, LoggerService,
+    JwtDecodeWrapper, MonitoringService, LoggerService,
     { provide: ErrorHandler, useClass: DefaultErrorHandler }]
 })
 

src/shared/services/logger.service.spec.ts

@@ -1,61 +1,73 @@
 import { LoggerService } from './logger.service';
+import { UserInterface } from 'src/user-profile/models/user.model';
+
+const userDetails: UserInterface = {
+  email: '[email protected]',
+  orgId: '12345',
+  roles: ['pui-case-manager', 'pui-user-manager', 'pui-finance-manager', 'pui-organisation-manager'],
+  userId: '1',
+  sessionTimeout: {
+    idleModalDisplayTime: 10,
+    totalIdleTime: 50
+  }
+};
 
 describe('Logger service', () => {
   const mockedMonitoringService = jasmine.createSpyObj('mockedMonitoringService', ['logEvent', 'logException']);
   const mockedNgxLogger = jasmine.createSpyObj('mockedNgxLogger', ['trace', 'debug', 'info',
     'log', 'warn', 'error', 'fatal']);
-  const mockedCookieService = jasmine.createSpyObj('mockedCookieService', ['get']);
-  const mockedCryptoWrapper = jasmine.createSpyObj('mockedCryptoWrapper', ['encrypt', 'decrypt']);
-  const mockJwtDecodeWrapper = jasmine.createSpyObj('mockJwtDecodeWrapper', ['decode']);
+  const mockedSessionStorageService = jasmine.createSpyObj('mockedSessionStorageService', ['getItem']);
 
   it('should be Truthy', () => {
-    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedCookieService,
-      mockedCryptoWrapper, mockJwtDecodeWrapper);
+    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedSessionStorageService);
     expect(service).toBeTruthy();
   });
 
   it('should be able to call info', () => {
-    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedCookieService,
-      mockedCryptoWrapper, mockJwtDecodeWrapper);
+    mockedSessionStorageService.getItem.and.returnValue(JSON.stringify(userDetails));
+    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedSessionStorageService);
     service.info('message');
     expect(mockedMonitoringService.logEvent).toHaveBeenCalled();
     expect(mockedNgxLogger.info).toHaveBeenCalled();
   });
 
   it('should be able to call warn', () => {
-    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedCookieService,
-      mockedCryptoWrapper, mockJwtDecodeWrapper);
+    mockedSessionStorageService.getItem.and.returnValue(JSON.stringify(userDetails));
+    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedSessionStorageService);
     service.warn('message');
     expect(mockedMonitoringService.logEvent).toHaveBeenCalled();
     expect(mockedNgxLogger.warn).toHaveBeenCalled();
   });
 
   it('should be able to call error', () => {
-    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedCookieService,
-      mockedCryptoWrapper, mockJwtDecodeWrapper);
+    mockedSessionStorageService.getItem.and.returnValue(JSON.stringify(userDetails));
+    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedSessionStorageService);
     service.error('message');
     expect(mockedMonitoringService.logException).toHaveBeenCalled();
     expect(mockedNgxLogger.error).toHaveBeenCalled();
+    expect(mockedSessionStorageService.getItem).toHaveBeenCalled();
   });
 
   it('should be able to call fatal', () => {
-    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedCookieService,
-      mockedCryptoWrapper, mockJwtDecodeWrapper);
+    mockedSessionStorageService.getItem.and.returnValue(JSON.stringify(userDetails));
+    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedSessionStorageService);
     service.fatal('message');
     expect(mockedMonitoringService.logException).toHaveBeenCalled();
     expect(mockedNgxLogger.fatal).toHaveBeenCalled();
+    expect(mockedSessionStorageService.getItem).toHaveBeenCalled();
   });
 
   it('should be able to call debug', () => {
-    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedCookieService,
-      mockedCryptoWrapper, mockJwtDecodeWrapper);
+    mockedSessionStorageService.getItem.and.returnValue(JSON.stringify(userDetails));
+    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedSessionStorageService);
     service.debug('message');
     expect(mockedMonitoringService.logEvent).toHaveBeenCalled();
+    expect(mockedSessionStorageService.getItem).toHaveBeenCalled();
   });
 
   it('should be able to call trace', () => {
-    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedCookieService,
-      mockedCryptoWrapper, mockJwtDecodeWrapper);
+    mockedSessionStorageService.getItem.and.returnValue(JSON.stringify(userDetails));
+    const service = new LoggerService(mockedMonitoringService, mockedNgxLogger, mockedSessionStorageService);
     service.trace('message');
     expect(mockedMonitoringService.logEvent).toHaveBeenCalled();
     expect(mockedNgxLogger.trace).toHaveBeenCalled();

src/shared/services/logger.service.ts

@@ -1,10 +1,9 @@
 import { Injectable } from '@angular/core';
-import { CookieService } from 'ngx-cookie';
 import { NGXLogger } from 'ngx-logger';
-import { CryptoWrapper } from './cryptoWrapper';
-import { JwtDecodeWrapper } from './jwtDecodeWrapper';
 import { MonitoringService } from './monitoring.service';
 import { environment } from 'src/environments/environment';
+import { SessionStorageService } from '../services/session-storage.service';
+import { UserInterface } from 'src/user-profile/models/user.model';
 
 export interface ILoggerService {
     trace(message: any, ...additional: any[]): void;
@@ -23,9 +22,7 @@ export class LoggerService implements ILoggerService {
   public COOKIE_KEYS;
   constructor(private readonly monitoringService: MonitoringService,
                 private readonly ngxLogger: NGXLogger,
-                private readonly cookieService: CookieService,
-                private readonly cryptoWrapper: CryptoWrapper,
-                private readonly jwtDecodeWrapper: JwtDecodeWrapper) {
+                private readonly sessionStorageService: SessionStorageService) {
     this.COOKIE_KEYS = {
       TOKEN: environment.cookies.token,
       USER: environment.cookies.userId
@@ -84,13 +81,11 @@ export class LoggerService implements ILoggerService {
   }
 
   public getMessage(message: any): string {
-    const jwt = this.cookieService.get(this.COOKIE_KEYS.TOKEN);
-    if (jwt) {
-      const jwtData = this.jwtDecodeWrapper.decode(jwt);
-      if (jwtData) {
-        const userIdEncrypted = this.cryptoWrapper.encrypt(jwtData.sub);
-        return `User - ${userIdEncrypted.toString()}, Message - ${message}, Timestamp - ${Date.now()}`;
-      }
+    const userInfoStr = this.sessionStorageService.getItem('userDetails');
+    const userInfo: UserInterface = JSON.parse(userInfoStr);
+    if (userInfo?.userId) {
+      const userId = userInfo.userId;
+      return `User - ${userId.toString()}, Message - ${message}, Timestamp - ${Date.now()}`;
     }
     return `Message - ${message}, Timestamp - ${Date.now()}`;
   }

src/user-profile/store/effects/user-profile.effects.ts

@@ -11,6 +11,7 @@ import { UserInterface } from '../../models/user.model';
 import { UserService } from '../../services/user.service';
 import * as authActions from '../actions';
 import { AuthActionTypes } from '../actions/';
+import { SessionStorageService } from '../../../shared/services/session-storage.service';
 
 @Injectable()
 export class UserProfileEffects {
@@ -19,7 +20,8 @@ export class UserProfileEffects {
     private readonly userService: UserService,
     private readonly loggerService: LoggerService,
     private readonly authService: UserService,
-    private readonly acceptTcService: AcceptTcService
+    private readonly acceptTcService: AcceptTcService,
+    private readonly sessionStorageService: SessionStorageService
   ) {}
 
   public getUser$ = createEffect(() => this.actions$.pipe(
@@ -28,6 +30,7 @@ export class UserProfileEffects {
       return this.userService.getUserDetails()
         .pipe(
           map((userDetails: UserInterface) => {
+            this.sessionStorageService.setItem('userDetails', JSON.stringify(userDetails));
             return new authActions.GetUserDetailsSuccess(userDetails);
           }),
           catchError((error: HttpErrorResponse) => {

src/user-profile/store/effects/user.effects.spec.ts

@@ -15,6 +15,7 @@ import {
   LoadHasAcceptedTCFail, LoadHasAcceptedTCSuccess
 } from '../actions';
 import * as fromUserEffects from './user-profile.effects';
+import { SessionStorageService } from '../../../shared/services/session-storage.service';
 
 describe('User Profile Effects', () => {
   let actions$;
@@ -30,6 +31,7 @@ describe('User Profile Effects', () => {
   ]);
 
   const mockedLoggerService = jasmine.createSpyObj('mockedLoggerService', ['trace', 'info', 'debug', 'log', 'warn', 'error', 'fatal']);
+  const mockedSessionStorageService = jasmine.createSpyObj('mockedSessionStorageService', ['setItem']);
 
   beforeEach(waitForAsync(() => {
     TestBed.configureTestingModule({
@@ -47,6 +49,10 @@ describe('User Profile Effects', () => {
           provide: LoggerService,
           useValue: mockedLoggerService
         },
+        {
+          provide: SessionStorageService,
+          useValue: mockedSessionStorageService
+        },
         fromUserEffects.UserProfileEffects,
         provideMockActions(() => actions$)
       ]
@@ -78,6 +84,7 @@ describe('User Profile Effects', () => {
       actions$ = hot('-a', { a: action });
       const expected = cold('-b', { b: completion });
       expect(effects.getUser$).toBeObservable(expected);
+      expect(mockedSessionStorageService.setItem).toHaveBeenCalledWith('userDetails', JSON.stringify(returnValue));
     }));
   });