[10-10CG] Reset csrfToken on 403 response for fetchFacilities

[coope93]

Are you removing, renaming or moving a folder in this PR?

• No, I'm not changing any folders (skip to TeamSites and delete the rest of this section)
• Yes, I'm removing, renaming or moving a folder

If the folder you changed contains a manifest.json, search for its entryName in the content-build registry.json (the entryName there will match).

If an entry for this folder exists in content-build and you are:

1. Deleting a folder:

   1. First search vets-website for all instances of the entryName in your manifest.json and remove them in a separate PR. Look particularly for references in src/applications/static-pages/static-pages-entry.js and src/platform/forms/constants.js. If you do not do this, other applications will break!
      • Add the link to your merged vets-website PR here
   2. Then, Delete the application entry in registry.json and merge that PR before this one
      • Add the link to your merged content-build PR here

2. Renaming or moving a folder: Update the entry in the registry.json, but do not merge it until your vets-website changes here are merged. The content-build PR must be merged immediately after your vets-website change is merged in to avoid CI errors with content-build (and Tugboat).

⚠️ TeamSites ⚠️

Examples of a TeamSite: https://va.gov/health and https://benefits.va.gov/benefits/. This scenario is also referred to as the "injected" header and footer. You can reach out in the #sitewide-public-websites Slack channel for questions.

Did you change site-wide styles, platform utilities or other infrastructure?

• No
• Yes, and I used the proxy-rewrite steps to test the injected header scenario

Summary

• We have consistently been seeing 403 Invalid Authenticity Token in our new facilities search page. The last two appear to have tried to pass invalid csrf tokens from the client.
• This change checks the response, and if the error response was a 403 - Invalid Authenticity Token error we set the csrfToken in localStorage to an empty string. If the request is retried, it will trigger the logic that checks if there is a token, and if not it makes a HEAD request to ensure it has a valid token, which then calls the fetchFacilities with a valid token.
• 1010 Health Apps
• This work is behind the caregiver_use_facilities_API toggle

Related issue(s)

• [FE] 10-10CG - Facilities: Launch at 10% va.gov-team#92034

Testing done

• Updated unit specs
• Manual testing in RI

Screenshots

No UI changes

	Before	After
Mobile
Desktop

What areas of the site does it impact?

10-10CG

Acceptance criteria

Quality Assurance & Testing

• I fixed|updated|added unit tests and integration tests for each feature (if applicable).
• No sensitive information (i.e. PII/credentials/internal URLs/etc.) is captured in logging, hardcoded, or specs
• Linting warnings have been addressed
• Documentation has been updated (link to documentation *if necessary)
• Screenshot of the developed feature is added
• Accessibility testing has been performed

Error Handling

• Browser console contains no warnings or errors.
• Events are being sent to the appropriate logging solution
• Feature/bug has a monitor built into Datadog or Grafana (if applicable)

Authentication

• Did you login to a local build and verify all authenticated routes work as expected with a test user

[coope93]

This errors object was just showing

{
 errors: [
   [Object]
 ]
}

Which is not helpful. This will instead show the error array which has more detail.

[coope93]

I only want to trigger this for 403s AND when it is an Invalid Authenticity Token, since there are other valid 403 responses we don't want to trigger this logic.

[coope93]

Added new Sentry log so we know when these occur and give us more detail into what's going on.

[va-vfs-bot]

Sentry call found

Sentry captures a lot of data, and we want to make sure that we only keep information that will be useful for troubleshooting issues. This means that PII should not be recorded.

What you can do

Review your call to Sentry and see if you can reasonably reduce any information that is included, or wait for a VSP review.