feat: DAH-4253 Authenticate housing counselor access with sign in link

[cliu02]

Description

When a user hits /sign-in?t={token}, authenticate for an active housing counselor who works for the same agency that the applicant specified in the token has granted access to.

Jira ticket

https://sfgovdt.jira.com/browse/DAH-4253

Before requesting eng review

Version Control

• branch name begins with angular if it contains updates to Angular code
• branch name contains the Jira ticket number
• PR name follows type: TICKET-NUMBER Description format, use DAH-000 if it does not need a ticket
• PR name follows urgent: Description format if it is urgent and does not need a ticket

Code quality

• the set of changes is small
• all automated code checks pass (linting, tests, coverage, etc.)
• if the PR is a bugfix, there are tests and logs around the bug

Code conventions

• web pages are formatted with .scss stylesheets and ui-seeds tokens, rather than inline styles or Tailwind

Review instructions

• instructions specify which environment(s) it applies to
• instructions work for PA testers
• instructions have already been performed at least once

Request eng review

• PR has needs review label
• Use Housing Eng group to automatically assign reviewers, and/or assign specific engineers
• If time sensitive, notify engineers in Slack

Before merging

Request product acceptance (PA) testing

• PA tested in the review environment (use needs product acceptance label)
• if PA testing cannot be done, changes are behind a feature flag

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a housing-counselor “access” authentication flow (backed by Salesforce checks) and wires it into the sign-in experience so counselors can follow an access link containing a JWT.

Changes:

• Add POST /api/v1/housing-counselor/access endpoint + controller/service logic to authorize counselor access to an applicant.
• Update sign-in UI flow to avoid auto-redirect when an access token (t) is present and to validate access after sign-in.
• Add/extend Ruby and JS tests for the new service/controller/API client behaviors.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
spec/services/force/housing_counselor_service_spec.rb	Adds specs for authorize_access and restructures shared request stubbing.
spec/controllers/api/v1/housing_counselor_controller_spec.rb	Adds controller specs for the new POST #access endpoint.
config/routes.rb	Adds POST /api/v1/housing-counselor/access route.
app/services/force/housing_counselor_service.rb	Implements counselor/applicant authorization and denial logging.
app/controllers/api/v1/housing_counselor_controller.rb	Adds access action to validate JWT + authorize using the service.
app/javascript/pages/sign-in.tsx	Prevents auto-redirect when t query param is present.
app/javascript/authentication/SignInForm.tsx	Calls access-auth endpoint after sign-in / on already-signed-in visits with t.
app/javascript/api/authApiService.ts	Adds API client method to post the counselor JWT to the access endpoint.
app/javascript/tests/api/authApiService.test.ts	Adds unit test coverage for new API client method.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.