Configure API proxy timeout

[TimDanielsCQI]

Jira link

See PO-3939

Change description

Updates @hmcts/opal-frontend-common-node from 0.0.39 to released version 0.0.43.

This consumes the shared proxy timeout and error-handling support delivered in opal-frontend-common-node-lib#368.

The frontend branch configures a 30-second API proxy timeout and passes it to both the Fines Service and User Service proxies. Startup now fails clearly if that timeout configuration is absent.

The upgraded shared library:

• applies the configured timeout to upstream proxy requests;
• maps timeout and recognised transport failures to a 504 Gateway Timeout problem response with retriable: true;
• maps unexpected proxy failures to 502 Bad Gateway with retriable: false;
• does not automatically replay requests. Any retry remains an explicit frontend decision and should only be enabled for safe, idempotent requests.

sequenceDiagram
    participant B as Browser
    participant F as opal-frontend SSR server
    participant P as Express proxy route<br/>OpalApiProxy
    participant O as opal-fines-service

    B->>F: GET /sign-in or app route
    F-->>B: HTML / JS / SSR response

    B->>F: API call to /opal-fines-service/...
    F->>P: Route matched in Express
    P->>O: Proxied request to upstream backend
    O-->>P: Backend response
    P-->>F: Proxied response returned
    F-->>B: Final HTTP response

    alt backend times out / transport failure
        P-->>F: 504 or 502 problem response
        F-->>B: Deterministic error payload
    end

Loading

Testing completed

• Confirmed Yarn resolves @hmcts/opal-frontend-common-node to exactly 0.0.43.
• corepack yarn build:ssr — passed.
• corepack yarn test:coverage — passed: 288 test files, 2,941 tests.
• Local smoke test completed:
  • http://localhost:4550/health returned HTTP 200.
  • http://localhost:4200/sign-in returned HTTP 200.

The exact smoke test that I did was:

1. Start opal-frontend on PO-3939 using the updated common-node package.
2. Open the app and confirm the login/sign-in page still loads.
3. Stop or block opal-fines-service.
4. Trigger a frontend request that goes through /opal-fines-service.
5. In Chrome DevTools Network, confirm the response is still deterministic:

• status 504
• body includes title: "Gateway Timeout"
• body includes detail: "The upstream service did not respond in time."
• body includes retriable: true

Testing the timeout and retry

Use the server already running on PO-3939 at http://localhost:4200.

1. Open a Terminal and confirm the local Fines container is running:

   docker ps --format '{{.Names}}\t{{.Status}}' | rg 'opal-fines-service'

   The name is normally:

   opal-stack-opal-fines-service-1
   

2. In Chrome, open http://localhost:4200/sign-in and sign in.

3. Open Developer Tools → Network:

   • tick Preserve log;
   • clear existing requests;
   • optionally filter for business-units.

4. Navigate to a point just before a Fines data request. Recommended:

   • choose Accounts;
   • start creating a new account;
   • select New;
   • stop just before pressing Continue.

5. In the second Terminal, freeze Fines:

   docker pause opal-stack-opal-fines-service-1

   “Pause” freezes the backend without closing its connection. The frontend proxy can connect, but receives no reply.

6. Immediately press Continue in the browser.

7. Wait approximately 65 seconds. PO-3939’s default timeout is 30 seconds:

   • after about 30 seconds, the proxy returns a 504;
   • the frontend retries the safe GET once;
   • after roughly another 30 seconds, it returns a second 504;
   • the Gateway Timeout warning should then appear.

8. In Chrome Network, confirm two requests to the same Fines endpoint. Each should show:

   {
     "title": "Gateway Timeout",
     "status": 504,
     "detail": "The backend service did not respond in time.",
     "retriable": true
   }

9. Restore Fines immediately:

   docker unpause opal-stack-opal-fines-service-1

10. Refresh the page or start the journey again to confirm the local stack is normal.

Only do this against your own local Docker stack!

Security Vulnerability Assessment

CVE Suppression: Are there any CVEs present in the codebase (either newly introduced or pre-existing) that are being intentionally suppressed or ignored by this commit?

• Yes
• No

Checklist

• commit messages are meaningful and follow good commit message guidelines
• README and other documentation has been updated / added (if needed)
• tests have been updated / new tests has been added (if needed)
• Does this PR introduce a breaking change

[iamfrankiemoran]

Minor change as part of the common-node-library changes

[TimDanielsCQI]

Changes done to this library (including readme) and opal-frontend pr

[iamfrankiemoran]

LGTM once library is released and bumped here

[Arnabsubedi233]

LGTM

[TimDanielsCQI]

Have updated this branch to consume opal-frontend-common-node-lib v0.0.43

[iamfrankiemoran]

LGTM