Phase 3 harden CSRF invalid POST and work access handling

app/modules/notice_cases/ui.py

@@ -46,6 +46,12 @@ from app.modules.core.tenancy.year_control import redirect_if_financial_year_loc
 router = APIRouter(prefix="/notice-cases", tags=["notice-cases-ui"])
 
 
+def _csrf_rejected(request: Request):
+    from app.core.http_responses import forbidden_response
+    return forbidden_response(request, "CSRF validation failed")
+
+
+
 def _base_ctx(request: Request, user, db, **ctx):
     base = {
         "request": request,
@@ -249,7 +255,10 @@ def case_create_submit(
     remarks: str = Form(""),
     csrf_token: str = Form(...),
 ):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user, response = _require_user(request, db, "notice_cases.create")
@@ -316,7 +325,10 @@ def case_edit_page(request: Request, case_id: int):
 
 @router.post("/{case_id}/edit")
 def case_edit_submit(request: Request, case_id: int, department: str = Form("GST"), case_type: str = Form("Notice"), title: str = Form(""), reference_no: str = Form(""), din_ack_no: str = Form(""), notice_date: str = Form(""), due_date: str = Form(""), financial_year: str = Form(""), assessment_year: str = Form(""), period_label: str = Form(""), status: str = Form("open"), priority: str = Form("normal"), assigned_partner_user_id: str = Form(""), assigned_manager_user_id: str = Form(""), assigned_staff_user_id: str = Form(""), issue_summary: str = Form(""), remarks: str = Form(""), csrf_token: str = Form(...)):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user, response = _require_user(request, db, "notice_cases.edit")
@@ -348,7 +360,10 @@ def case_edit_submit(request: Request, case_id: int, department: str = Form("GST
 
 @router.post("/{case_id}/events")
 def case_add_event(request: Request, case_id: int, event_type: str = Form("Internal Note"), event_date: str = Form(""), description: str = Form(""), next_due_date: str = Form(""), csrf_token: str = Form(...)):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user, response = _require_user(request, db, "notice_cases.events.manage")
@@ -368,7 +383,10 @@ def case_add_event(request: Request, case_id: int, event_type: str = Form("Inter
 
 @router.post("/{case_id}/hearings")
 def case_add_hearing(request: Request, case_id: int, hearing_date: str = Form(""), hearing_time: str = Form(""), venue_or_mode: str = Form(""), officer_name: str = Form(""), agenda: str = Form(""), outcome: str = Form(""), status: str = Form("scheduled"), csrf_token: str = Form(...)):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user, response = _require_user(request, db, "notice_cases.hearings.manage")
@@ -388,7 +406,10 @@ def case_add_hearing(request: Request, case_id: int, hearing_date: str = Form(""
 
 @router.post("/{case_id}/orders")
 def case_add_order(request: Request, case_id: int, order_type: str = Form("Other"), order_no: str = Form(""), order_date: str = Form(""), demand_amount: str = Form("0"), tax_amount: str = Form("0"), interest_amount: str = Form("0"), penalty_amount: str = Form("0"), summary: str = Form(""), appeal_due_date: str = Form(""), appeal_filed: str | None = Form(None), csrf_token: str = Form(...)):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user, response = _require_user(request, db, "notice_cases.orders.manage")
@@ -408,7 +429,10 @@ def case_add_order(request: Request, case_id: int, order_type: str = Form("Other
 
 @router.post("/{case_id}/documents/upload")
 def case_document_upload(request: Request, case_id: int, title: str = Form(""), document_type: str = Form("OTHER"), description: str = Form(""), event_id: str = Form(""), file: UploadFile = File(...), csrf_token: str = Form(...)):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user, response = _require_user(request, db, "notice_cases.documents.upload")
@@ -451,7 +475,10 @@ def case_document_download(request: Request, document_id: int):
 
 @router.post("/documents/{document_id}/delete")
 def case_document_delete(request: Request, document_id: int, csrf_token: str = Form(...)):
-    validate_csrf(request, csrf_token)
+    try:
+        validate_csrf(request, csrf_token)
+    except PermissionError:
+        return _csrf_rejected(request)
     db = CommonSessionLocal()
     try:
         user, response = _require_user(request, db, "notice_cases.documents.delete")