feat: Implement Crime IDAM Integration (#357)

apps/web/.env.example

@@ -29,6 +29,16 @@ CFT_IDAM_URL=https://idam-web-public.aat.platform.hmcts.net
 # - CFT_IDAM_CLIENT_SECRET
 SSO_ALLOW_HTTP_REDIRECT=false
 
+# Crime IDAM Configuration
+# Crime IDAM secrets loaded from Azure Key Vault:
+# - CRIME_IDAM_BASE_URL
+# - CRIME_IDAM_CLIENT_ID
+# - CRIME_IDAM_CLIENT_SECRET
+# - CRIME_IDAM_SCOPE (defaults to "openid profile roles" if not provided)
+#
+# Enable Crime IDAM in development (disabled by default):
+# ENABLE_CRIME_IDAM=true
+
 # Azure B2C Configuration (for CaTH verified users)
 # B2C_CLIENT_ID and B2C_CLIENT_SECRET are loaded from Azure Key Vault.
 # Non-secret config must be set here for local development.

apps/web/helm/values.yaml

@@ -12,6 +12,7 @@ nodejs:
     POSTGRES_DATABASE: cath
     CFT_IDAM_URL: https://idam-web-public.{{ .Values.global.environment }}.platform.hmcts.net
     CATH_SERVICE_URL: https://cath-web.{{ .Values.global.environment }}.platform.hmcts.net
+    CRIME_IDAM_BASE_URL: https://login.sit.cjscp.org.uk
     GOVUK_NOTIFY_TEMPLATE_ID_SUBSCRIPTION: 5b5c31d0-27a3-466b-b750-bd1a858cd50f
     GOVUK_NOTIFY_TEMPLATE_ID_SUBSCRIPTION_PDF_AND_SUMMARY: ebc08910-5dd5-44c5-b3fc-72f90935f858
     GOVUK_NOTIFY_TEMPLATE_ID_SUBSCRIPTION_SUMMARY_ONLY: bf0802f9-3199-4774-a0c1-f9cb1755ff8f

apps/web/src/app.test.ts

@@ -52,6 +52,7 @@ vi.mock("@hmcts/auth", () => ({
   b2cForgotPasswordHandler: vi.fn(),
   cftCallbackHandler: vi.fn(),
   configurePassport: vi.fn(),
+  crimeCallbackHandler: vi.fn(),
   sessionTimeoutMiddleware: vi.fn((_req: any, _res: any, next: any) => next()),
   ssoCallbackHandler: vi.fn()
 }));

apps/web/src/app.ts

@@ -10,6 +10,7 @@ import {
   b2cForgotPasswordHandler,
   cftCallbackHandler,
   configurePassport,
+  crimeCallbackHandler,
   sessionTimeoutMiddleware,
   ssoCallbackHandler
 } from "@hmcts/auth";
@@ -75,6 +76,7 @@ export async function createApp(): Promise<Express> {
   app.use(
     configureHelmet({
       cftIdamUrl: process.env.CFT_IDAM_URL,
+      crimeIdamUrl: process.env.CRIME_IDAM_BASE_URL,
       b2cCustomDomain: process.env.B2C_CUSTOM_DOMAIN,
       b2cTenantName: process.env.B2C_TENANT_NAME
     })
@@ -141,6 +143,9 @@ export async function createApp(): Promise<Express> {
   // Manual route registration for CFT callback (maintains /cft-login/return URL for external CFT IDAM config)
   app.get("/cft-login/return", cftCallbackHandler);
 
+  // Manual route registration for Crime IDAM callback (maintains /crime-login/return URL for external Crime IDAM config)
+  app.get("/crime-login/return", crimeCallbackHandler);
+
   // Manual route registration for B2C callback (maintains /login/return URL for Azure B2C config)
   // Supports both GET (response_mode=query) and POST (response_mode=form_post)
   app.get("/login/return", b2cCallbackHandler);

apps/web/src/server.ts

@@ -7,7 +7,6 @@ import { createApp } from "./app.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-
 const PORT = process.env.PORT || 8080;
 const IS_PRODUCTION = process.env.NODE_ENV === "production";
 

docs/GITHUB_SECRETS_SETUP.md

@@ -57,6 +57,19 @@ The following secrets must be configured in your GitHub repository settings (`Se
 | `CFT_INVALID_TEST_ACCOUNT` | CFT IDAM invalid test account email |
 | `CFT_INVALID_TEST_ACCOUNT_PASSWORD` | CFT IDAM invalid test account password |
 
+### Test User Credentials (Crime IDAM)
+
+| Secret Name | Description |
+|------------|-------------|
+| `CRIME_IDAM_BASE_URL` | Crime IDAM base URL |
+| `CRIME_IDAM_CLIENT_ID` | Crime IDAM Client ID |
+| `CRIME_IDAM_CLIENT_SECRET` | Crime IDAM Client Secret |
+| `CRIME_IDAM_SCOPE` | Crime IDAM OAuth scope (defaults to "openid profile roles") |
+| `CRIME_VALID_TEST_ACCOUNT` | Crime IDAM valid test account email |
+| `CRIME_VALID_TEST_ACCOUNT_PASSWORD` | Crime IDAM valid test account password |
+| `CRIME_INVALID_TEST_ACCOUNT` | Crime IDAM invalid test account email |
+| `CRIME_INVALID_TEST_ACCOUNT_PASSWORD` | Crime IDAM invalid test account password |
+
 ## Workflow Configuration
 
 The E2E tests workflow (`.github/workflows/e2e.yml`) automatically uses these secrets when running tests on: