ErrorHandling.apply(async (req: express.Request,
                               res: express.Response,
                               next: express.NextFunction): Promise<void> => {
      const cookies = new Cookies(req, res)
      let user

      try {
        const authenticationToken = await getAuthToken(req)
        if (authenticationToken) {
          user = await IdamClient.retrieveUserFor(authenticationToken)
          res.locals.isLoggedIn = true
          res.locals.user = user
          setAuthCookie(cookies, authenticationToken)
        }
      } catch (err) {
        return loginErrorHandler(req, res, cookies, next, err)
      }

      if (res.locals.isLoggedIn) {
        if (isDefendantFirstContactPinLogin(req)) {
          // re-set state cookie as it was cleared above, we need it in this case
          cookies.set(stateCookieName, req.query.state)
          return res.redirect(FirstContactPaths.claimSummaryPage.uri)
        } else {
          await claimStoreClient.linkDefendant(user)
          res.redirect(await retrieveRedirectForLandingPage(req, res))
        }
      } else {
        if (res.locals.code) {
          trackCustomEvent('Authentication token undefined (jwt defined)',
            { requestValue: req.query.state })
        }
        res.redirect(OAuthHelper.forLogin(req, res))
      }
    }))

async function getOAuthAccessToken (req: express.Request, receiver: RoutablePath): Promise<string> {
  if (req.query.state !== OAuthHelper.getStateCookie(req)) {
    trackCustomEvent('State cookie mismatch (citizen)',
      {
        requestValue: req.query.state,
        cookieValue: OAuthHelper.getStateCookie(req)
      })
  }
  const authToken: AuthToken = await IdamClient.exchangeCode(
    req.query.code,
    buildURL(req, receiver.uri)
  )
  if (authToken) {
    return authToken.accessToken
  }
  return Promise.reject()
}

function loginErrorHandler (req: express.Request,
                            res: express.Response,
                            cookies: Cookies,
                            next: express.NextFunction,
                            err: Error,
                            receiver: RoutablePath = AppPaths.receiver) {
  if (hasTokenExpired(err)) {
    cookies.set(sessionCookie)
    logger.debug(`Protected path - expired auth token - access to ${req.path} rejected`)
    return res.redirect(OAuthHelper.forLogin(req, res, receiver))
  }
  cookies.set(stateCookieName, '')
  return next(err)
}

    ErrorHandling.apply(async (req: express.Request, res: express.Response) => {
      const form: Form<ClaimReference> = req.body

      if (form.hasErrors()) {
        renderView(form, res)
      } else {
        if (isCCBCCaseReference(form.model.reference)) {
          return res.redirect(mcolUrl)
        }

        const linked: boolean = await claimStoreClient.isClaimLinked(form.model.reference)

        if (linked) {
          return res.redirect(AppPaths.homePage.uri)
        }
        res.redirect(OAuthHelper.forPin(req, res, form.model.reference.toUpperCase()))
      }
    }))

 function accessDeniedCallback (req: express.Request, res: express.Response): void {
   res.redirect(OAuthHelper.forLogin(req, res))
 }

function receiverPath (req: express.Request, res: express.Response): string {
  return `${OAuthHelper.forUplift(req, res)}&jwt=${JwtExtractor.extract(req)}`
}

 private static getClaimRef (req: express.Request): string {
   return OAuthHelper.getStateCookie(req)
 }