Underwriting tracker

What it is

A queue view of underwriting work across all suppliers, as opposed to the per-supplier underwriting tabs. It answers "what needs underwriting attention" rather than "what is the state of this supplier".

Where it lives

Concern Location

Route

/underwriting/tracker (with /underwriting redirecting to it) — underwriting/underwriting-routing.routes.ts

Module

underwriting/underwriting.module.ts — imports SharedModule, declares one component

Component

underwriting/tracker/tracker.component.ts

Feature flag

UNDERWRITING_TRACKER

It is entirely EVA

This is the clearest example of the micro-front-end seam in the codebase. The component has no logic at all:

@Component({
  selector: 'app-tracker',
  templateUrl: './tracker.component.html',
  styleUrls: ['./tracker.component.scss'],
})
export class TrackerComponent {}
<div class="underwriting-tracker__container">
  <app-eva [url]="'underwriting-tracker'"></app-eva>
</div>

Everything a user sees — the grid, the filters, the actions — is served by EVA at ${evaApiUrl}underwriting-tracker, inside an iframe.

What Internal Admin still provides:

  • Routing — the URL, and the route guards (RouteAccessResolver, FeatureFlagsGeneralGuard, NgxPermissionsGuard).

  • Authentication — EvaComponent reads localStorage['currentUser'] and hands the JWT to EvaService, which either sets a shared-domain cookie or, on localhost, appends ?auth=<token> to the iframe URL.

  • Authorisation context — EvaComponent resolves the user’s sub-permissions via UsersService.getPermissionSubPerms(permCode) and sends them to EVA as part of the config message.

  • Feature flags — FeatureFlagsEvaService computes EVA’s flag set and pushes it over postMessage.

  • Chrome — the sidebar, layout, toasts and iframe resizing.

See iframe messaging and EVA for the protocol.

Bugs reported against "the UW tracker" are usually EVA bugs, not bugs in this repository. Before investigating here, establish whether the problem is in the iframe content (EVA) or in what this app passes to it (token, permissions, flags, size).

Access

Gate Detail

Feature flag

UNDERWRITING_TRACKER — checked twice: FeatureFlagsGeneralGuard initialises flags on the route, and the sidebar wraps the menu item in *appEnabledByFeatureFlag="featureFlags.UNDERWRITING_TRACKER".

Permissions

Route denies REST_UW_ACCESS and ADVANCE_AUDITORS; the sidebar item uses the same *ngxPermissionsExcept clause.

Sub-permissions

Passed through to EVA rather than enforced here — EVA decides what to show.

Note the flag gates visibility, not the route: /underwriting/tracker uses FeatureFlagsGeneralGuard (which always resolves true) rather than FeatureFlagGuard (which redirects to /404 when a flag is off). With the flag off the menu item disappears but the URL still renders — and the iframe will load whatever EVA serves.

Relationship to per-supplier underwriting

Surface Scope

/underwriting/tracker

Cross-supplier queue. EVA-rendered. This page.

/suppliers/:key/underwriting/*

One supplier’s assessment. Angular-rendered in this repository. See underwriting.

/suppliers/:key/new-underwriting

A flag-gated Angular rewrite of the per-supplier view (supplier-underwriting-beta/), not related to the tracker.

The underwriting/ module in this repository contains only the tracker. All per-supplier underwriting code lives under suppliers/supplier/supplier-underwriting/ — a naming trap worth remembering.

Other EVA-rendered surfaces

The tracker is not unique. EvaComponent is also used for:

  • The supplier top bar (EVA_IFRAME_SELECTOR.TOP_BAR) and the supplier menu (EVA_SUPPLIER_MENU flag).

  • The onboarding summary (EVA_ONBOARDING_SUMMARY flag).

  • Contract views (which can request a parent refresh via CONTRACTS__REFRESH).

  • The DEV Admin feature-flag and QA screens, which embed EVA in order to read and write EVA’s own flags — see DEV Admin.

Gotchas

  • The component is empty by design — do not look for tracker logic here.

  • app-eva takes a relative url ('underwriting-tracker'), resolved against evaApiUrl.

  • EvaComponent clears the EVA auth cookie on window:unload and window:beforeunload, so a hard refresh re-issues the token.

  • On localhost the token travels in the query string instead of a cookie, because the parent domain differs. Behaviour therefore differs between local and deployed environments.

  • The flag hides the menu entry but does not block the route.