feat(EMS-3490): no pdf - application submission - xlsx - protect from…

… modification (#2584)

.env.sample

@@ -19,6 +19,7 @@ API_KEY=
 SESSION_SECRET=
 JWT_SIGNING_KEY=
 MOCK_ACCOUNT_PASSWORD=
+EXCELJS_PROTECTION_PASSWORD=
 
 # UI
 UI_PORT=

.github/workflows/deployment.yml

@@ -172,7 +172,8 @@ jobs:
             COMPANIES_HOUSE_API_KEY='${{ secrets.COMPANIES_HOUSE_API_KEY }}' \
             JWT_SIGNING_KEY='${{ secrets.JWT_SIGNING_KEY }}' \
             UNDERWRITING_TEAM_EMAIL='${{ secrets.UNDERWRITING_TEAM_EMAIL }}' \
-            FEEDBACK_EMAIL_RECIPIENT='${{ secrets.FEEDBACK_EMAIL_RECIPIENT }}'
+            FEEDBACK_EMAIL_RECIPIENT='${{ secrets.FEEDBACK_EMAIL_RECIPIENT }}' \
+            EXCELJS_PROTECTION_PASSWORD='${{ secrets.EXCELJS_PROTECTION_PASSWORD }}'
 
       - name: Slot 🔀
         uses: azure/cli@v2.0.0

.github/workflows/test.yml

@@ -48,6 +48,7 @@ env:
   FEEDBACK_EMAIL_RECIPIENT: ${{ secrets.FEEDBACK_EMAIL_RECIPIENT }}
   MOCK_ACCOUNT_PASSWORD: ${{ secrets.MOCK_ACCOUNT_PASSWORD }}
   JWT_SIGNING_KEY: ${{ secrets.JWT_SIGNING_KEY }}
+  EXCELJS_PROTECTION_PASSWORD: ${{ secrets.EXCELJS_PROTECTION_PASSWORD }}
 
 jobs:
   # 1. Setup test infrastructure

src/api/.env.sample

@@ -15,6 +15,7 @@ API_KEY=
 SESSION_SECRET=
 JWT_SIGNING_KEY=
 MOCK_ACCOUNT_PASSWORD=
+EXCELJS_PROTECTION_PASSWORD=
 
 # APIM
 APIM_MDM_URL=
@@ -46,4 +47,4 @@ LOSS_PAYEE_ENCRYPTION_KEY=
 CRON_SCHEDULE_UNVERIFIED_ACCOUNT=
 CRON_SCHEDULE_INACTIVE_APPLICATION=
 CRON_SCHEDULE_SUBMISSION_DEADLINE_REMINDER_EMAIL=
-APPLICATION_URL=
+APPLICATION_URL=

src/api/generate-xlsx/index.test.ts

@@ -12,7 +12,10 @@ describe('api/generate-xlsx/index', () => {
 
     expect(result).toEqual(expected);
 
-    // delete the file so we don't create a file during unit tests.
+    /**
+     * delete the file,
+     * so that we don't create a file during unit tests.
+     */
 
     await fileSystem.unlink(expected);
   });

src/api/generate-xlsx/index.ts

@@ -1,9 +1,14 @@
+import dotenv from 'dotenv';
 import ExcelJS from 'exceljs';
 import mapApplicationToXLSX from './map-application-to-XLSX';
 import HEADER_COLUMNS from './header-columns';
 import styledColumns from './styled-columns';
 import { Application } from '../types';
 
+dotenv.config();
+
+const { EXCELJS_PROTECTION_PASSWORD } = process.env;
+
 /**
  * XLSX
  * Generate an XLSX file with exceljs
@@ -33,6 +38,9 @@ const XLSX = (application: Application): Promise<string> => {
 
       let worksheet = workbook.addWorksheet(refNumber);
 
+      // protect the worksheet from modification
+      worksheet.protect(String(EXCELJS_PROTECTION_PASSWORD), {});
+
       // add header columns to the worksheet
       worksheet.columns = HEADER_COLUMNS;