[HOTE-972] feat: Keep data in session on refresh

[faggc]

Description

https://nhsd-jira.digital.nhs.uk/browse/HOTE-972
Added session storage to context classes

Context

This prevents the loss of data from page refreshes.

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I am familiar with the contributing guidelines
• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming

---

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[Copilot]

Pull request overview

Adds client-side session persistence to several UI React Context providers so form/journey state survives page refreshes in the React Router SPA.

Changes:

• Introduces sessionService / sessionStorageService abstractions for rehydrating/dehydrating state to window.sessionStorage.
• Updates Auth, Create Order, Journey Navigation, and Postcode Lookup contexts to load initial state from session storage and persist changes.
• Adds Jest unit tests for the new session persistence behaviors and a sessionStorage mock in jest.setup.ts.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
ui/src/state/PostcodeLookupContext.tsx	Rehydrates and persists postcode lookup state via sessionService.
ui/src/state/OrderContext.tsx	Rehydrates and persists orderAnswers via sessionService, clearing on reset.
ui/src/state/NavigationContext.tsx	Reworks navigation state handling and persists step history/return-to-step via sessionService.
ui/src/state/AuthContext.tsx	Rehydrates and persists the authenticated user via sessionService.
ui/src/lib/services/session-storage-service.ts	Adds a thin wrapper around window.sessionStorage with JSON encode/decode.
ui/src/lib/services/session-service.ts	Adds typed helpers + centralised keys for context persistence.
ui/src/tests/state/PostcodeLookupContext.test.tsx	Adds tests covering postcode lookup persistence and clearing.
ui/src/tests/state/OrderContext.test.tsx	Adds tests covering create-order persistence and reset clearing.
ui/src/tests/state/AuthContext.test.tsx	Adds tests covering auth user rehydration and persistence.
ui/src/tests/lib/services/session-service.test.ts	Adds tests for sessionService helpers and storage keys.
ui/jest.setup.ts	Adds a deterministic sessionStorage mock and clears it before each test.

[github-actions]

Lambdas Coverage Report

Lines	Statements	Branches	Functions
	97% (1164/1200)	89.9% (365/406)	94.14% (177/188)

[github-actions]

UI Coverage Report

Lines	Statements	Branches	Functions
	95.26% (5394/5662)	86.45% (613/709)	86.93% (193/222)

[Copilot]

Pull request overview

This PR adds client-side session persistence for several UI React Context providers so that journey/order data survives a page refresh within the same browser tab.

Changes:

• Introduces sessionStorage wrapper services (session-storage-service + session-service) with namespaced keys.
• Rehydrates/dehydrates context state for Auth, Journey Navigation, Order, and Postcode Lookup via session storage.
• Adds Jest sessionStorage mocking plus new/updated unit tests for the new persistence behavior (partial coverage).

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
ui/src/state/PostcodeLookupContext.tsx	Rehydrate/dehydrate postcode lookup state to session storage.
ui/src/state/OrderContext.tsx	Rehydrate/dehydrate order answers to session storage.
ui/src/state/NavigationContext.tsx	Rehydrate/dehydrate journey navigation state to session storage.
ui/src/state/AuthContext.tsx	Rehydrate/dehydrate auth user state to session storage.
ui/src/lib/services/session-storage-service.ts	Adds a small wrapper around window.sessionStorage with JSON (de)serialization.
ui/src/lib/services/session-service.ts	Adds a typed façade for session persistence keys and operations.
ui/src/tests/state/PostcodeLookupContext.test.tsx	Adds unit tests for postcode lookup persistence.
ui/src/tests/state/OrderContext.test.tsx	Adds unit tests for order answers persistence.
ui/src/tests/state/AuthContext.test.tsx	Extends auth context tests to verify session persistence.
ui/src/tests/lib/services/session-service.test.ts	Adds unit tests for the session service wrapper.
ui/jest.setup.ts	Adds a custom sessionStorage mock and clears it before each test.

[sonarqubecloud]

Quality Gate passed

Issues
11 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cptiv2020]

@faggc Is this change to using session storage only for the alpha? Do we plan to change this solution in the beta or subsequent phases? AI's comment "session storage [...] increases exposure of patient PII to any XSS/browser extension and generally isn't appropriate for sensitive identifiers [...]" is valid.

[faggc]

@cptiv2020 I believe this is likely to be used in subsequent phases. The comment regarding PII, I have had a discussion with @philipcoulter1. We have been advised that this is allowed for our application.

[philipcoulter1]

Yes, as per the review of the security architect, the data we currently store client side is good for now.