@docupace/pipeline 1.0.33-matttest.3 → 1.0.34

package/src/auth0/export.js

@@ -0,0 +1,43 @@
+import { getVaultSecrets } from './vault.js';
+import { getVaultSecretsConfigs } from '../next/config.js';
+import { dump } from 'auth0-deploy-cli';
+
+export async function exportConf(site, env) {
+  try {
+    console.log(
+      `Exporting Auth0 configuration for site: ${site} and env: ${env}`,
+    );
+
+    const siteCommonSecretsPath =
+      getVaultSecretsConfigs(site).siteCommonSecretsPath;
+    console.log(`siteCommonSecretsPath => ${siteCommonSecretsPath}`);
+    const siteCommonSecrets = await getVaultSecrets(siteCommonSecretsPath);
+
+    const auth0Domain = `docupace-${env}-${site}.us.auth0.com`;
+    const auth0ClientId = siteCommonSecrets.AUTH0_CLIENT_ID;
+    const auth0ClientSecret = siteCommonSecrets.AUTH0_CLIENT_SECRET;
+
+    const config = {
+      config: {
+        AUTH0_DOMAIN: auth0Domain,
+        AUTH0_CLIENT_ID: auth0ClientId,
+        AUTH0_CLIENT_SECRET: auth0ClientSecret,
+      },
+      format: 'directory',
+      output_folder: `./auth0-${site}-export`,
+      export_ids: false,
+      env: false,
+      debug: true,
+    };
+
+    console.log(`Starting Auth0 ${site} configuration export...`);
+    await dump(config);
+    console.log(`Auth0 ${site} configuration export completed successfully!`);
+  } catch (error) {
+    console.error(
+      `Error during Auth0 ${site} configuration export:`,
+      error.message,
+    );
+    process.exit(1);
+  }
+}

package/src/auth0/metadata.js

@@ -0,0 +1,132 @@
+import fs from 'fs-extra';
+import axios from 'axios';
+import path from 'path';
+import { cloneRepository } from '../next/deploy.js';
+import { getAuth0AuthToken } from './configure.js';
+import { getVaultSecrets } from './vault.js';
+import { getVaultSecretsConfigs } from '../next/config.js';
+import { pushDeployConfig } from '../next/deploy.js';
+
+export async function getAuth0Metadata(site, env) {
+  try {
+    const connectDeployRepoPath = await cloneRepository('connect-deploy');
+
+    if (env === 'qa') {
+      console.log(
+        `The environment is: (${env}), but connect-deploy has preprod instead`,
+      );
+      process.chdir(`${connectDeployRepoPath}/envs/preprod/${site}`);
+    } else {
+      process.chdir(`${connectDeployRepoPath}/envs/${env}/${site}`);
+    }
+
+    const configPath = path.join('conf', 'application.conf');
+    const appConf = await fs.readFile(configPath, 'utf-8');
+    const connectContext = appConf.match(
+      /application\.context\s*=\s*"(.*?)"/,
+    )?.[1];
+
+    if (!connectContext) {
+      console.error('connectContext not found in application.conf. Exiting...');
+      process.exit(1);
+    }
+
+    const siteHost = appConf.match(
+      /docupace\.baseUrlClient\s*=\s*"?https?:\/\/([^/]+)"?/,
+    )?.[1];
+
+    if (!siteHost) {
+      console.error('siteHost not found in application.conf. Exiting...');
+      process.exit(1);
+    }
+
+    const connectEndpoint = `https://${siteHost}${connectContext}`;
+    console.log('CONNECT_ENDPOINT:', connectEndpoint);
+
+    console.log('Requesting token from Auth0...');
+    const siteCommonSecretsPath =
+      getVaultSecretsConfigs(site).siteCommonSecretsPath;
+    console.log(`siteCommonSecretsPath => ${siteCommonSecretsPath}`);
+    const siteCommonSecrets = await getVaultSecrets(siteCommonSecretsPath);
+    const auth0Domain = `docupace-${env}-${site}.us.auth0.com`;
+    const auth0ClientId = siteCommonSecrets.AUTH0_CLIENT_ID;
+    const auth0ClientSecret = siteCommonSecrets.AUTH0_CLIENT_SECRET;
+    const auth0Token = await getAuth0AuthToken(
+      auth0Domain,
+      auth0ClientId,
+      auth0ClientSecret,
+    );
+
+    const auth0Response = await axios.get(
+      `https://${auth0Domain}/api/v2/clients`,
+      {
+        headers: { authorization: `Bearer ${auth0Token}` },
+      },
+    );
+
+    const connectClient = auth0Response.data.find(
+      (client) => client.name === 'docupace-connect',
+    );
+
+    if (!connectClient) {
+      console.error('Client "docupace-connect" not found.');
+      process.exit(1);
+    }
+
+    const clientId = connectClient.client_id;
+    console.log('Found client_id:', clientId);
+
+    const metadataRes = await axios.get(
+      `https://${auth0Domain}/samlp/metadata/${clientId}`,
+      {
+        responseType: 'text',
+      },
+    );
+
+    const metadata = metadataRes.data;
+
+    if (metadata.length < 2000) {
+      console.error(
+        'Downloaded metadata looks incorrect (too small). Exiting...',
+      );
+      process.exit(1);
+    }
+    await fs.ensureDir('conf/saml');
+    await fs.writeFile('conf/saml/auth0.xml', metadata);
+    console.log('SAML metadata written to conf/saml/auth0.xml');
+
+    let newConfig = appConf;
+
+    if (/useSAML\s*=/.test(appConf)) {
+      newConfig = newConfig.replace(/useSAML\s*=.*/, 'useSAML=true');
+    } else {
+      newConfig += '\nuseSAML=true';
+    }
+
+    const replacements = {
+      'saml.clients.auth0.idpMetadataPath': '${samlEnvPath}"/auth0.xml"',
+      'saml.clients.auth0.spEntityId': `"${connectEndpoint}"`,
+      'saml.clients.auth0.redirectFormInput': '"RelayState"',
+      'saml.clients.auth0.idpLoginUrl': `"https://${auth0Domain}/v2/logout?client_id=${clientId}&returnTo=${connectEndpoint}"`,
+    };
+
+    for (const [key, value] of Object.entries(replacements)) {
+      const pattern = new RegExp(`${key}\\s*=.*`, 'g');
+      if (pattern.test(newConfig)) {
+        newConfig = newConfig.replace(pattern, `${key}=${value}`);
+      } else {
+        newConfig += `\n${key}=${value}`;
+      }
+    }
+
+    await fs.writeFile(configPath, newConfig);
+    console.log('The application.conf has been updated.');
+    await pushDeployConfig(
+      connectDeployRepoPath,
+      `Auth0 SAML metadata update for site: (${site}) in env: (${env})`,
+    );
+  } catch (error) {
+    console.error('Error:', error.message);
+    process.exit(1);
+  }
+}

package/src/auth0/vault.js

@@ -44,7 +44,7 @@ export async function getVaultSecrets(vaultPath) {
   } catch (error) {
     if (error.response) {
       console.error(
-        `Error: Failed to connect to Vault server at ${vaultAddr}. Response: ${error.response.status} ${error.response.statusText}`
+        `Error: Failed to connect to Vault server at ${vaultAddr}. Response: ${error.response.status} ${error.response.statusText}`,
       );
     } else {
       console.error(`Error: ${error.message}`);
@@ -88,7 +88,7 @@ export async function updateVaultSecrets(vaultPath, secretData) {
           'X-Vault-Token': vaultToken,
           'Content-Type': 'application/json',
         },
-      }
+      },
     );
 
     // Return the response from Vault
@@ -97,7 +97,7 @@ export async function updateVaultSecrets(vaultPath, secretData) {
   } catch (error) {
     if (error.response) {
       console.error(
-        `Error: Failed to update secret at ${vaultPath}. Response: ${error.response.status} ${error.response.statusText}`
+        `Error: Failed to update secret at ${vaultPath}. Response: ${error.response.status} ${error.response.statusText}`,
       );
     } else {
       console.error(`Error: ${error.message}`);

package/src/next/cli.js

@@ -4,12 +4,7 @@ import { Command } from 'commander';
 import { pull } from './pull.js';
 import { sonar } from './sonar.js';
 import { publish } from './publish.js';
-import {
-  deployAppWithTag,
-  deployFromSite,
-  getDefaultDeploySite,
-  getDeployTag,
-} from './deploy.js';
+import { deployFromSite } from './deploy.js';
 import { deployTemplate } from './deploy.js';
 import { copy } from './copy.js';
 import { vaultAddSiteData } from './vault.js';
@@ -106,30 +101,10 @@ program
   });
 
 program
-  .command('deploy-template')
+  .command('deployTemplate <site>')
   .description('Deploy an application for a specific site')
-  .action(async () => {
-    const deployTag = await getDeployTag();
-    const { env, site } = await getDefaultDeploySite(deployTag);
-    await deployTemplate(env, site, deployTag);
-  });
-
-program
-  .command('deployTemplate')
-  .description('Deploy an application for a specific site')
-  .action(async () => {
-    const deployTag = await getDeployTag();
-    const { env, site } = await getDefaultDeploySite(deployTag);
-    await deployTemplate(env, site, deployTag);
-  });
-
-program
-  .command('deploy-app <application>')
-  .description('Deploy an application for a specific site')
-  .action(async (application) => {
-    const deployTag = await getDeployTag();
-    const { env, site } = await getDefaultDeploySite(deployTag);
-    await deployAppWithTag(application, env, site, deployTag);
+  .action(async (site) => {
+    await deployTemplate(site);
   });
 
 program

package/src/next/config.js

@@ -80,5 +80,14 @@ export const getVaultSecretsConfigs = (site) => {
     siteCommonSecretsPath: `secret/data/${site}/common/config`,
     graphqlServerSecretsPath: `secret/data/${site}/graphql-server/config`,
     uiSecretsPath: `secret/data/${site}/ui/config`,
+    awsSecretsPath: `secret/data/${site}/aws/config`,
   };
 };
+
+export const coreSiteEnvMap = {
+  dev: 'dev',
+  qa: 'preprod',
+  stg: 'staging',
+  uat: 'uat',
+  prd: 'prod',
+};

package/src/next/deploy.js

@@ -266,7 +266,7 @@ export async function writeAndPushDeployConfig(
  * @param {string} site - The site name.
  */
 
-export async function getDeployTag() {
+async function getDeployTag() {
   const gitTag = (
     await $`git tag --points-at HEAD | grep '^v' | head -n 1`
   ).stdout.trim();
@@ -274,17 +274,12 @@ export async function getDeployTag() {
   return deployTag;
 }
 
-export async function getDefaultDeploySite(deployTag) {
-  const env = deployTag.includes('alpha') ? 'dev' : 'qa';
-  const site = env === 'dev' ? 'financialdev' : 'qa';
-  return { env, site };
-}
-
-export async function deployTemplate(env, site, deployTag) {
+export async function deployTemplate(site) {
+  const deployTag = await getDeployTag();
   console.log(`Deploying standard template for site: ${site}`);
   console.log(`Using deployment tag: ${deployTag}`);
   const { repoPath, deployConfigFilePath, deployConfig } =
-    await cloneAndReadDeployConfig('graphql-server', env, site);
+    await cloneAndReadDeployConfig('graphql-server', 'dev', site);
 
   deployConfig.graphqlServer.standardConfigRemoteBranch = deployTag;
 
@@ -297,17 +292,14 @@ export async function deployTemplate(env, site, deployTag) {
   console.log('Deployment completed successfully.');
 }
 
-export async function deployAppWithTag(application, env, site, deployTag) {
+export async function deploy(application, site) {
+  const deployTag = getDeployTag();
+
   console.log(`Deploying application: ${application} for site: ${site}`);
   console.log(`Using deployment tag: ${deployTag}`);
 
-  if (env !== 'dev') {
-    const appDetails = appInfo[application];
-    await copy2(appDetails.repositoryName, 'dev', env, deployTag);
-  }
-
   const { repoPath, deployConfigFilePath, deployConfig } =
-    await cloneAndReadDeployConfig(application, env, site);
+    await cloneAndReadDeployConfig(application, 'dev', site);
   const updatedConfigData = setTag(deployConfig, deployTag);
   await writeAndPushDeployConfig(
     repoPath,

package/terraform/init.sh

@@ -33,16 +33,28 @@ echo "$atlassian_workspace_runner_ssh_key" | base64 -d > ~/.ssh/id_ed25519
 chmod 600 ~/.ssh/id_ed25519
 ssh-keyscan bitbucket.org > ~/.ssh/known_hosts
 
-
+info () {
+  echo "PROJECT => $PROJECT"
+  echo "CURRENT_ENVIRONMENT => $CURRENT_ENVIRONMENT"
+  echo "SITE_NAME => $SITE_NAME"
+}
 
 if [[ "$PROJECT" == "s3" ]]; then
-terraform init \
-   -input=false \
-   -reconfigure \
-   -backend=true \
-   -backend-config=./env/${CURRENT_ENVIRONMENT}/us-west-2/backend.tfvars \
-   -backend-config="key=us-west-2/${PROJECT}/${SITE_NAME}/${CURRENT_ENVIRONMENT}/terraform.tfstate" 
-
+  info
+  terraform init \
+     -input=false \
+     -reconfigure \
+     -backend=true \
+     -backend-config=./env/${CURRENT_ENVIRONMENT}/us-west-2/backend.tfvars \
+     -backend-config="key=us-west-2/${PROJECT}/${SITE_NAME}/${CURRENT_ENVIRONMENT}/terraform.tfstate"
+elif [[ "$PROJECT" == "idp" ]]; then
+  info
+  terraform init \
+     -input=false \
+     -reconfigure \
+     -backend=true \
+     -backend-config=./env/${CURRENT_ENVIRONMENT}/us-west-2/backend.tfvars \
+     -backend-config="key=us-west-2/${PROJECT}/${SITE_NAME}/${CURRENT_ENVIRONMENT}/terraform.tfstate"
 else
   terraform init -backend-config=./env/${CURRENT_ENVIRONMENT}/us-west-2/backend.tfvars --reconfigure
-fi
+fi

package/terraform/plan.sh

@@ -44,11 +44,18 @@ elif [[ "$PROJECT" == "s3" ]];then
           -var="site=${SITE_NAME}" \
           -var="env=${CURRENT_ENVIRONMENT}" \
           -out .tfplan
+elif [[ "$PROJECT" == "idp" ]];then
+  terraform plan -var-file="./env/${CURRENT_ENVIRONMENT}/us-west-2/terraform.tfvars" \
+          -var="site=${SITE_NAME}" \
+          -var="env=${CURRENT_ENVIRONMENT}" \
+          -var="docupace_domain=${DOCUPACE_DOMAIN}" \
+          -var="docupace_next_domain=${DOCUPACE_NEXT_DOMAIN}" \
+          -var="old_page_design=${USE_OLD_PAGE_DESIGN}" \
+          -var="use_new_domain=${USE_NEW_DOMAIN}" \
+          -var="configure_autologin=${CONFIGURE_AUTOLOGIN}" \
+          -var="configure_ui_main=${CONFIGURE_UI_MAIN}" \
+          -var="enable_mfa=${ENABLE_MFA}" \
+          -out .tfplan
 else
   terraform plan -var-file="./env/${CURRENT_ENVIRONMENT}/us-west-2/terraform.tfvars" -out .tfplan
 fi
-
-
-
-
-