RET-5980

[LahiruOshara]

Jira link

https://hmcts.atlassian.net/browse/RET-5980

Change description

Problem

Closing, replying to or updating a referral completed the Work Allocation tasks for
every open referral on the case. Reported from Production: closing referral 5
completed a caseworker's assigned task for referral 32.

The completion DMN only receives the CCD event id, so it cannot tell one referral
from another — it matches on case id + task type and completes everything it finds.

Fix

et-ccd-callbacks now completes the specific tasks itself:

1. Search POST /task (as the acting user — needs only Read) for the case's
   referral tasks.
2. Keep those whose additional_properties.referralNumber matches the referral
   that was actioned.
3. Close each with DELETE /task/{id} (service-to-service, reason completed).

The referral number is stamped onto each task by the configuration DMN — see the
paired et-wa-task-configuration PR, which also removes the blanket completion
rules. Task types per event mirror the DMN exactly, so behaviour is unchanged apart
from the cross-referral over-reach.

Changes

• WaTaskApiClient + request/response DTOs
• ReferralTaskCompletionService
• Hooks in Close / Reply / Update referral controllers
• WA_TASK_MANAGEMENT_API_URL config (app, charts, integration + apiTest)
• CFTLib S2S and exclusive-client env vars for local running

Testing

ReferralTaskCompletionServiceTest (8 tests) plus the three controller tests.

Screen.Recording.2026-09-03.at.10.04.51.mov

Security Vulnerability Assessment

CVE Suppression: Are there any CVEs present in the codebase (either newly introduced or pre-existing) that are being intentionally suppressed or ignored by this commit?

• Yes
• No

Checklist

• commit messages are meaningful and follow good commit message guidelines
• README and other documentation has been updated / added (if needed)
• tests have been updated / new tests has been added (if needed)
• [] Does this PR introduce a breaking change

[github-actions]

MyHMCTS/ExUI - https://xui-et-cos-pr-3422.preview.platform.hmcts.net
CCD Admin Web - https://admin-web-et-cos-pr-3422.preview.platform.hmcts.net
Camunda - https://camunda-et-cos-pr-3422.preview.platform.hmcts.net
SYA Web - https://et-sya-et-cos-pr-3422.preview.platform.hmcts.net
SYR Web - https://et-syr-et-cos-pr-3422.preview.platform.hmcts.net
Manage Org - https://xui-mo-webapp-et-cos-pr-3422.preview.platform.hmcts.net
Register Org - https://xui-mo-webapp-et-cos-pr-3422.preview.platform.hmcts.net/register-org/register
Approve Org - https://xui-ao-webapp-et-cos-pr-3422.preview.platform.hmcts.net

[github-actions]

Release version for latest commit is: RET-5980-2c27ee8

[github-actions]

Release version for latest commit is: RET-5980-d46d823

[github-actions]

Release version for latest commit is: RET-5980-248527a

[github-actions]

Release version for latest commit is: RET-5980-103a140

[github-actions]

Release version for latest commit is: RET-5980-04af301

[github-actions]

Release version for latest commit is: RET-5980-fdc888e

[github-actions]

Release version for latest commit is: RET-5980-6f6deae

[github-actions]

Release version for latest commit is: RET-5980-d5b5092

[hmcts-jenkins-d-to-i]

Plan Result (aat)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 1 to add, 1 to change, 1 to destroy.

• Update
  • azurerm_api_management_subscription.et_ccd_callbacks_subscription
• Replace
  • module.postgres.null_resource.set-user-permissions-additionaldbs["et_cos"]

Change Result (Click me)

  # azurerm_api_management_subscription.et_ccd_callbacks_subscription will be updated in-place
  ~ resource "azurerm_api_management_subscription" "et_ccd_callbacks_subscription" {
      ~ allow_tracing       = false -> true
        id                  = "/subscriptions/96c274ce-846d-4e48-89a7-d528432298a7/resourceGroups/cft-aat-network-rg/providers/Microsoft.ApiManagement/service/cft-api-mgmt-stg/subscriptions/ae446332-fbd9-4b60-b9ff-775dcb6a210b"
        # (10 unchanged attributes hidden)
    }

  # module.postgres.null_resource.set-user-permissions-additionaldbs["et_cos"] must be replaced
-/+ resource "null_resource" "set-user-permissions-additionaldbs" {
      ~ id       = "1103206680312820687" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "force_trigger"     = "5" -> "2"
            # (8 unchanged elements hidden)
        }
    }

Plan: 1 to add, 1 to change, 1 to destroy.

[hmcts-jenkins-d-to-i]

Plan Result (prod)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 1 to add, 1 to change, 1 to destroy.

• Update
  • azurerm_api_management_subscription.et_ccd_callbacks_subscription
• Replace
  • module.postgres.null_resource.set-user-permissions-additionaldbs["et_cos"]

Change Result (Click me)

  # azurerm_api_management_subscription.et_ccd_callbacks_subscription will be updated in-place
  ~ resource "azurerm_api_management_subscription" "et_ccd_callbacks_subscription" {
      ~ allow_tracing       = false -> true
        id                  = "/subscriptions/8cbc6f36-7c56-4963-9d36-739db5d00b27/resourceGroups/cft-prod-network-rg/providers/Microsoft.ApiManagement/service/cft-api-mgmt-prod/subscriptions/d084dc34-d05d-4cdd-9016-ae263313395e"
        # (10 unchanged attributes hidden)
    }

  # module.postgres.null_resource.set-user-permissions-additionaldbs["et_cos"] must be replaced
-/+ resource "null_resource" "set-user-permissions-additionaldbs" {
      ~ id       = "7696081667075943900" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "force_trigger"     = "5" -> "2"
            # (8 unchanged elements hidden)
        }
    }

Plan: 1 to add, 1 to change, 1 to destroy.