FFS-1427: Implement custom 404/500 errors

app/.rubocop.yml

@@ -21,3 +21,5 @@ Layout/IndentationWidth:
 Layout/IndentationConsistency:
   Enabled: true
   EnforcedStyle: normal
+Layout/EndAlignment:
+  EnforcedStyleAlignWith: keyword

app/app/controllers/pages_controller.rb

@@ -1,4 +1,23 @@
 class PagesController < ApplicationController
   def home
   end
+
+  def error_404
+    # When in development environment, you'll need to set
+    #   config.consider_all_requests_local = false
+    # in config/development.rb for these pages to actually show up.
+    @cbv_flow = if session[:cbv_flow_id]
+                  CbvFlow.find(session[:cbv_flow_id])
+                end
+
+    render status: :not_found, formats: %i[html]
+  end
+
+  def error_500
+    # When in development environment, you'll need to set
+    #   config.consider_all_requests_local = false
+    # in config/development.rb for these pages to actually show up.
+
+    render status: :internal_server_error, formats: %i[html]
+  end
 end

app/app/views/pages/error_404.html.erb

@@ -0,0 +1,13 @@
+<% header = t(".header") %>
+<% content_for :title, header %>
+<h1><%= header %></h1>
+
+<div class="usa-prose">
+  <p><%= t(".error_code_html") %></p>
+
+  <% if @cbv_flow && @cbv_flow.cbv_flow_invitation %>
+    <%= link_to t(".return_to_entry"), @cbv_flow.cbv_flow_invitation.to_url %>
+  <% else %>
+    <%= link_to t(".return_to_welcome"), root_url %>
+  <% end %>
+</div>

app/app/views/pages/error_500.html.erb

@@ -0,0 +1,13 @@
+<% header = t(".header") %>
+<% content_for :title, header %>
+<h1><%= header %></h1>
+
+<div class="usa-prose">
+  <p><%= t(".error_code_html") %></p>
+
+  <p><%= t(".description") %></p>
+
+  <p>
+    <%= link_to t(".refresh"), "javascript:window.location.reload()" %>
+  </p>
+</div>

app/config/application.rb

@@ -35,6 +35,9 @@ class Application < Rails::Application
     # config.time_zone = "Central Time (US & Canada)"
     # config.eager_load_paths << Rails.root.join("extras")
 
+    # Allow specifying /404 and /500 routes for error pages
+    config.exceptions_app = self.routes
+
     # Don't generate system test files.
     config.generators.system_tests = nil
     config.autoload_paths += %W[#{config.root}/lib]

app/config/i18n-tasks.yml

@@ -138,6 +138,7 @@ ignore_missing:
     - "cbv.expired_invitations.show.body_2"
     - "help.*"
     - "shared.header.help"
+    - "pages.{error_404,error_500}.*"
 # - 'errors.messages.{accepted,blank,invalid,too_short,too_long}'
 # - '{devise,simple_form}.*'
 

app/config/locales/en.yml

@@ -517,6 +517,16 @@ en:
           title: Contact your employer's Human Resource Team
         title: I don't know my username
   pages:
+    error_404:
+      error_code_html: 'Error code: <strong>404</strong>'
+      header: We can't find the page you're looking for
+      return_to_entry: Return to entry page
+      return_to_welcome: Return to welcome page
+    error_500:
+      description: This is a problem on our end. There was an error with the server and our team has been notified. Please refresh your page, or try again later.
+      error_code_html: 'Error code: <strong>500</strong>'
+      header: It looks like something went wrong
+      refresh: Refresh page
     home:
       description_1: The SNAP Income Pilot is a new tool designed to help you connect your income details from your employer or payroll provider directly to your SNAP agency.
       description_2: Please note this pilot is not currently available.

app/config/routes.rb

@@ -70,4 +70,7 @@
       post :user_action, to: "user_events#user_action"
     end
   end
+
+  match "/404", to: "pages#error_404", via: :all
+  match "/500", to: "pages#error_500", via: :all
 end

app/spec/controllers/pages_controller_spec.rb

@@ -0,0 +1,40 @@
+require "rails_helper"
+
+RSpec.describe PagesController do
+  render_views
+
+  describe "#home" do
+    it "renders" do
+      get :home
+      expect(response).to be_successful
+      expect(response.body).to include("Welcome")
+    end
+  end
+
+  describe "#error_404" do
+    it "renders with a link to the homepage" do
+      get :error_404
+      expect(response.status).to eq(404)
+      expect(response.body).to include("We can't find the page")
+      expect(response.body).to include("Return to welcome")
+    end
+
+    describe "when a cbv_flow_id is in the session" do
+      let(:cbv_flow) { create(:cbv_flow) }
+
+      it "renders with a link to restart that CBV flow" do
+        get :error_404, session: { cbv_flow_id: cbv_flow.id }
+        expect(response.status).to eq(404)
+        expect(response.body).to include("Return to entry page")
+      end
+    end
+  end
+
+  describe "#error_500" do
+    it "renders" do
+      get :error_500
+      expect(response.status).to eq(500)
+      expect(response.body).to include("It looks like something went wrong")
+    end
+  end
+end

zap_options.conf

@@ -1,3 +1,16 @@
 network.globalExclusions.exclusions(0).exclusion.name=Search
 network.globalExclusions.exclusions(0).exclusion.enabled=true
 network.globalExclusions.exclusions(0).exclusion.value=/.*\/(?:.{2}\/)?cbv\/employer_search\?authenticity\_token.*/gm
+
+# Ignore CSP warnings on sitemap.xml
+globalalertfilter.filters.filter(0).ruleid=10038
+globalalertfilter.filters.filter(0).newrisk=-1
+globalalertfilter.filters.filter(0).url=.*/sitemap.xml$
+globalalertfilter.filters.filter(0).urlregex=true
+globalalertfilter.filters.filter(0).param=
+globalalertfilter.filters.filter(0).paramregex=false
+globalalertfilter.filters.filter(0).attack=
+globalalertfilter.filters.filter(0).attackregex=false
+globalalertfilter.filters.filter(0).evidence=
+globalalertfilter.filters.filter(0).evidenceregex=false
+globalalertfilter.filters.filter(0).enabled=true