@docupace/pipeline 1.0.7-alpha.1 → 1.0.7-alpha.11

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.7-alpha.1",
+  "version": "1.0.7-alpha.11",
   "description": "",
   "main": "index.js",
   "type": "module",
   "bin": {
     "dp-changeset-cli": "src/changeset/cli.js",
-    "dp-next-cli": "src/next/cli.js"
+    "dp-next-cli": "src/next/cli.js",
+    "dp-auth0-cli": "src/auth0/cli.js"
   },
   "keywords": [
     "bash"
@@ -15,6 +16,7 @@
   "license": "ISC",
   "dependencies": {
     "@changesets/cli": "^2.27.10",
+    "auth0-deploy-cli": "^7.24.3",
     "axios": "^1.7.9",
     "commander": "^12.1.0",
     "dotenv": "^16.4.7",

package/src/auth0/cli.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+
+import { Command } from 'commander';
+import {
+  configureFromSite
+} from './configure.js';
+import {
+  getVaultSecrets
+} from './vault.js'
+
+import dotenv from 'dotenv';
+
+dotenv.config({ path: ['.env.pipeline.local', 'config/.env.pipeline.local'] });
+
+const program = new Command();
+
+program
+    .command('configureFromSite <fromSite> <toSite> <env> <deployUI> <deployGraphQLServer> <useNewDomain>')
+    .description('Configure the Auth0 tenants in env for the given site')
+    .action(async (fromSite, toSite, env, deployUI, deployGraphQLServer, useNewDomain) => {
+        await configureFromSite(fromSite, toSite, env, deployUI, deployGraphQLServer, useNewDomain);
+    });
+
+program
+  .command('getVaultSecrets <vaultPath>')
+  .description('Get Secrets for Vault PATH')
+  .action(async (vaultPath) => {
+    await getVaultSecrets(vaultPath);
+  });
+
+program.parse(process.argv);

package/src/auth0/configure.js

@@ -0,0 +1,622 @@
+import fs from 'fs';
+import path from 'path';
+import yaml from 'js-yaml';
+import { $ } from 'zx';
+import axios from 'axios';
+import crypto from 'crypto';
+import { deploy } from 'auth0-deploy-cli';
+
+import {
+  cloneEnvRepository,
+  cloneRepository,
+  readDeployConfig,
+  pushDeployConfig
+} from '../next/deploy.js';
+
+import {
+  getVaultSecrets,
+  updateVaultSecrets
+} from './vault.js';
+
+import {
+  getVaultSecretsConfigs,
+  environmentConfig
+} from '../next/config.js';
+
+async function ensureDirectoryExists(dirPath) {
+  try {
+    await fs.promises.mkdir(dirPath, { recursive: true });
+    console.log(`Directory created or already exists: ${dirPath}`);
+  } catch (err) {
+    console.error(`Failed to create directory: ${err.message}`);
+  }
+}
+
+async function addApplicationToApi ({application, auth0Domain, auth0AuthToken, coreApiIdentifier}){
+  console.log("Adding application to API authorized applications...");
+
+  try {
+    const auth0Response = await axios.get(`https://${auth0Domain}/api/v2/clients`, {
+      headers: {authorization: `Bearer ${auth0AuthToken}`},
+    });
+
+    const appAuth0ClientIdData = auth0Response.data.find(client => client.name === `${application}`);
+    const appAuth0ClientId = appAuth0ClientIdData.client_id;
+
+    await axios.post(
+          `https://${auth0Domain}/api/v2/client-grants`,
+      {
+        client_id: appAuth0ClientId,
+        audience: `${coreApiIdentifier}`,
+        scope: [],
+      },
+      {
+        headers: {
+          Authorization: `Bearer ${auth0AuthToken}`,
+          "Content-Type": "application/json",
+        },
+      }
+    );
+    console.log(`Application (${appAuth0ClientId}) authorized for API: ${coreApiIdentifier}`);
+  } catch (err) {
+    console.error(`Failed to add application: ${application}: ${err.message}`);
+  }
+
+}
+
+async function initializeAuth0Configuration({
+                                              initConfiguration,
+                                              auth0Domain,
+                                              auth0AuthToken,
+                                              coreApiIdentifier,
+                                            }) {
+  if (initConfiguration === "true") {
+    try {
+      // Create a new resource server in Auth0
+      console.log("Creating resource server in Auth0...");
+
+      const resourceServerResponse = await axios.post(
+        `https://${auth0Domain}/api/v2/resource-servers`,
+        {
+          name: "docupace-core",
+          identifier: `${coreApiIdentifier}`,
+          token_lifetime: 86400,
+          allow_offline_access: false,
+          signing_alg: "RS256",
+          skip_consent_for_verifiable_first_party_clients: true,
+          scopes: [],
+        },
+        {
+          headers: {
+            Authorization: `Bearer ${auth0AuthToken}`,
+            "Content-Type": "application/json",
+          },
+        }
+      );
+
+      const apiId = resourceServerResponse.data.id;
+
+      // Update tenant settings with the default audience
+      console.log("Updating tenant settings...");
+      await axios.patch(
+        `https://${auth0Domain}/api/v2/tenants/settings`,
+        {
+          default_audience: `${coreApiIdentifier}`,
+        },
+        {
+          headers: {
+            Authorization: `Bearer ${auth0AuthToken}`,
+            "Content-Type": "application/json",
+          },
+        }
+      );
+      console.log("Tenant settings updated successfully.");
+    } catch (error) {
+      console.error("Error during Auth0 configuration:", error.response?.data || error.message);
+    }
+  }
+}
+
+async function importAuth0Templates(directoryPath, auth0Domain, auth0ClientID, auth0ClientSecret) {
+  try {
+    const config = {
+      input_file: directoryPath,
+      config: {
+        AUTH0_DOMAIN: auth0Domain,
+        AUTH0_CLIENT_ID: auth0ClientID,
+        AUTH0_CLIENT_SECRET: auth0ClientSecret,
+      },
+      debug: true,
+    };
+
+    console.log('Starting Auth0 template import...');
+    await deploy(config);
+    console.log('Auth0 template import completed successfully!');
+  } catch (error) {
+    console.error('Error during Auth0 template import:', error.message);
+    process.exit(1); // Exit with an error code
+  }
+}
+
+async function updateJsonFile(filePath, updates) {
+  const content = await fs.promises.readFile(filePath, 'utf8');
+  const jsonContent = JSON.parse(content);
+  const updatedContent = JSON.stringify({...jsonContent, ...updates}, null, 2);
+  await fs.promises.writeFile(filePath, updatedContent);
+}
+
+async function replaceInFile(filePath, replacements) {
+  let content = await fs.promises.readFile(filePath, 'utf8');
+  for (const [search, replace] of replacements) {
+    content = content.replace(new RegExp(search, 'g'), replace);
+  }
+  await fs.promises.writeFile(filePath, content);
+}
+
+async function templateAuth0(siteUrl, coreApiContext, env, filePaths, deployUI, deployGraphQLServer, commonSecrets) {
+  try {
+    let uiAllowedCallbacksUrls,
+      uiAllowedLogoutUrls;
+    let graphqlAllowedCallbacksUrls,
+      graphqlAllowedLogoutUrls;
+
+    // Configure URLs based on environment
+    if (env === 'prd') {
+      uiAllowedCallbacksUrls = [`https://${siteUrl}/api/auth/callback`];
+      uiAllowedLogoutUrls = [`https://${siteUrl}`];
+
+      graphqlAllowedCallbacksUrls = [`https://${siteUrl}/api/graphql/callback`];
+      graphqlAllowedLogoutUrls = [`https://${siteUrl}/api/graphql/`];
+    } else {
+      uiAllowedCallbacksUrls = [
+        `https://${siteUrl}/api/auth/callback`,
+        `http://localhost:3000/api/auth/callback`,
+      ];
+      uiAllowedLogoutUrls = [
+        `https://${siteUrl}`,
+        `http://localhost:3000`,
+      ];
+
+      graphqlAllowedCallbacksUrls = [
+        `https://${siteUrl}/api/graphql/callback`,
+        `http://localhost:4000/api/graphql/callback`,
+      ];
+      graphqlAllowedLogoutUrls = [
+        `http://localhost:4000/api/graphql/`,
+        `https://${siteUrl}/api/graphql/`,
+      ];
+    }
+
+    const configureUI = deployUI === 'true';
+    if (configureUI) {
+      console.log('ui_allowed_callbacks_urls ->', uiAllowedCallbacksUrls);
+      console.log('ui_allowed_logout_urls ->', uiAllowedLogoutUrls);
+
+      await updateJsonFile(filePaths.uiJson, {
+        callbacks: uiAllowedCallbacksUrls,
+        allowed_logout_urls: uiAllowedLogoutUrls,
+      });
+      console.log('Updated URLs for main UI...');
+    } else {
+      await fs.promises.unlink(filePaths.uiJson);
+      await updateJsonFile(filePaths.databaseJson, {
+        enabled_clients: (content) => content.enabled_clients.filter((client) => client !== 'docupace-ui-main'),
+      });
+      console.log("Removed 'docupace-ui-main' from enabled_clients in database.json");
+    }
+
+    const configureGraphqlServer = deployGraphQLServer === 'true';
+    if (configureGraphqlServer) {
+      console.log('graphql_allowed_callbacks_urls ->', graphqlAllowedCallbacksUrls);
+      console.log('graphql_allowed_logout_urls ->', graphqlAllowedLogoutUrls);
+
+      await updateJsonFile(filePaths.graphqlJson, {
+        callbacks: graphqlAllowedCallbacksUrls,
+        allowed_logout_urls: graphqlAllowedLogoutUrls,
+      });
+      console.log('Updated URLs for GraphQL server...');
+    } else {
+      await fs.promises.unlink(filePaths.graphqlJson);
+      await updateJsonFile(filePaths.databaseJson, {
+        enabled_clients: (content) => content.enabled_clients.filter((client) => client !== 'docupace-graphql'),
+      });
+      console.log("Removed 'docupace-graphql' from enabled_clients in database.json");
+    }
+
+    // TWILIO configuration
+    await replaceInFile(filePaths.twilioJson, [
+      ['twilioauthtokenplaceholder', commonSecrets.TWILIO_AUTH_TOKEN],
+      ['twiliosidplaceholder', commonSecrets.TWILIO_SID],
+      ['twiliofromplaceholder', commonSecrets.TWILIO_FROM_NUMBER],
+    ]);
+
+    console.log('TWILIO configuration updated...');
+
+    // Database configuration
+    await replaceInFile(filePaths.databaseLoginJs, [
+      ['"${docupaceHost}"', `"${siteUrl}"`],
+      ['"${docupaceContext}"', `"${coreApiContext}"`],
+    ]);
+
+    // MFA configuration
+    // if (process.env.AUTH0_MFA === 'ENABLE') {
+    //   console.log('AUTH0 MFA is enabled');
+    //   await execAsync('rsync -av ./auth0template/templateMFA/ ./auth0template/template/');
+    // } else if (process.env.AUTH0_MFA === 'DISABLE') {
+    //   console.log('AUTH0 MFA is disabled');
+    //   await execAsync('rsync -av ./auth0template/templateNoMFA/ ./auth0template/template/');
+    // }
+
+    console.log('Template configuration completed.');
+  } catch (err) {
+    console.error('Error configuring Auth0 templates:', err);
+  }
+}
+
+async function getAuth0AuthToken(auth0Domain, clientId, clientSecret) {
+  try {
+    const response = await axios.post(`https://${auth0Domain}/oauth/token`, {
+      client_id: clientId,
+      client_secret: clientSecret,
+      audience: `https://${auth0Domain}/api/v2/`,
+      grant_type: 'client_credentials',
+    }, {
+      headers: {
+        'Content-Type': 'application/json',
+      },
+    });
+
+    const authToken = response.data.access_token;
+    // console.log("Auth0 Auth Token:", authToken);
+    return authToken;
+  } catch (error) {
+    console.error("Error fetching Auth0 token:", error.response ? error.response.data : error.message);
+  }
+}
+
+async function configureUI(siteHost, coreURL, docupaceHost, site, env, useNewDomain, auth0Domain, auth0ClientId, auth0ClientSecret, auth0Token, vaultSiteSecretsPath, imageTag, repoPath) {
+  console.log(`Configuring UI for site: ${site} Host: ${siteHost} in env: ${env}`);
+
+  try {
+    const auth0Response = await axios.get(`https://${auth0Domain}/api/v2/clients`, {
+      headers: {authorization: `Bearer ${auth0Token}`},
+    });
+
+    const uiClient = auth0Response.data.find(client => client.name === "docupace-ui-main");
+    const uiAuth0ClientId = uiClient.client_id;
+    const uiAuth0ClientSecret = uiClient.client_secret;
+
+    // Generate Auth0 Secret
+    const uiAuth0Secret = crypto.randomBytes(48).toString('base64').replace(/[^a-zA-Z0-9]/g, '');
+
+    // Prepare data payload
+    console.log("Preparing Vault UI data payload...");
+    const uiSecretData = JSON.stringify({
+      data: {
+        AUTH0_CLIENT_ID: uiAuth0ClientId,
+        AUTH0_CLIENT_SECRET: uiAuth0ClientSecret,
+        AUTH0_SECRET: uiAuth0Secret,
+      },
+    });
+
+    await updateVaultSecrets(vaultSiteSecretsPath, uiSecretData);
+
+    // Prepare ui.app.yaml
+    const uiAppYaml = `
+repo: docupace-ui-main
+revision: master
+`.trim();
+
+    // Prepare ui.values.yaml
+    const uiValuesYaml = `
+uiMain:
+  auth0BaseUrl: https://${siteHost}
+  auth0IssuerBaseUrl: https://${auth0Domain}
+  auth0ClientId: vault:secret/data/${site}/ui/config#AUTH0_CLIENT_ID
+  graphqlClientUrl: https://${siteHost}/api/graphql
+  graphqlServerUrl: https://${siteHost}/api/graphql
+  connectUrl: https://${siteHost}
+  coreUrl: https://${coreURL}
+  env:
+    AUTH0_CLIENT_SECRET: vault:secret/data/${site}/ui/config#AUTH0_CLIENT_SECRET
+    AUTH0_SECRET: vault:secret/data/${site}/ui/config#AUTH0_SECRET
+image:
+  repository: registry.paperout.com/docupace-ui-main-dev-docker-local/docupace-ui-main
+  tag: ${imageTag}
+imagePullSecrets:
+  - name: jf-artifactory
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: ${siteHost}
+    external-dns.alpha.kubernetes.io/zone: public
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+  hosts:
+    - host: ${siteHost}
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - hosts:
+        - ${siteHost}
+      secretName: dp-next-ui-cert
+externalConnectIngress:
+  enabled: ${useNewDomain}
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    external-dns.alpha.kubernetes.io/hostname: ${siteHost}
+    external-dns.alpha.kubernetes.io/zone: public
+    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      proxy_set_header Host ${siteHost};
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 8k
+  hosts:
+    - host: ${siteHost}
+      paths:
+        - path: /core
+        - path: /core_b2b
+        - path: /core_reports
+        - path: /corerealm
+        - path: /connect
+        - path: /webstart
+        - path: /core_ws
+        - path: /core_docupload
+        - path: /core_ariws
+        - path: /core_restws
+        - path: /core_webdav
+  tls:
+    - hosts:
+        - ${siteHost}
+      secretName: dp-next-ui-cert
+externalConnectService:
+  enabled: ${useNewDomain}
+  name: external-connect
+  domain: ${docupaceHost}
+`.trim();
+
+    // Write configuration files
+    console.log("Writing configuration files...");
+    await ensureDirectoryExists(path.resolve(`${repoPath}/dp/${site}`));
+
+    await fs.writeFile(`${repoPath}/dp/${site}/ui.app.yaml`, uiAppYaml, (err) => {
+      if (err) {
+        console.error("Failed to write the file:", err);
+      } else {
+        console.log("File written successfully.");
+      }
+    });
+
+    await fs.writeFile(`${repoPath}/dp/${site}/ui.values.yaml`, uiValuesYaml, (err) => {
+      if (err) {
+        console.error("Failed to write the file:", err);
+      } else {
+        console.log("File written successfully.");
+      }
+    });
+    console.log("Done!");
+  } catch (error) {
+    console.error("Error configuring UI:", error);
+  }
+}
+
+async function configureGraphQLServer(siteHost, coreURL, docupaceHost, site, env, auth0Domain, auth0ClientId, auth0ClientSecret, auth0Token, vaultSiteSecretsPath, imageTag, standardConfigRemoteBranch, repoPath, commonSecrets) {
+  console.log(`Configuring GraphQL Server for site: ${site} Host: ${siteHost} in env: ${env}`);
+
+  try {
+    const auth0Response = await axios.get(`https://${auth0Domain}/api/v2/clients`, {
+      headers: {authorization: `Bearer ${auth0Token}`},
+    });
+
+    const graphQLServerClient = auth0Response.data.find(client => client.name === "docupace-graphql");
+    const graphQLServerClientCredentials = auth0Response.data.find(client => client.name === "docupace-graphql-client-credentials");
+
+    const graphQLServerAuth0ClientId = graphQLServerClient.client_id;
+    const graphQLServerAuth0ClientSecret = graphQLServerClient.client_secret;
+
+    const graphQLServerCCAuth0ClientId = graphQLServerClientCredentials.client_id;
+    const graphQLServerCCAuth0ClientSecret = graphQLServerClientCredentials.client_secret;
+
+    // Prepare data payload
+    console.log("Preparing Vault GraphQL Server data payload...");
+    const graphQLServerSecretData = JSON.stringify({
+      data: {
+        AUTH0_CLIENT_ID: graphQLServerAuth0ClientId,
+        AUTH0_CLIENT_SECRET: graphQLServerAuth0ClientSecret,
+        AUTH0_CC_CLIENT_ID: graphQLServerCCAuth0ClientId,
+        AUTH0_CC_CLIENT_SECRET: graphQLServerCCAuth0ClientSecret,
+        CORE_PASSWORD: commonSecrets.CORE_PASSWORD,
+        REMOTE_CONFIG_PATH: commonSecrets.REMOTE_CONFIG_PATH,
+        STANDARD_CONFIG_REMOTE_PATH: commonSecrets.STANDARD_CONFIG_REMOTE_PATH,
+      },
+    });
+
+    await updateVaultSecrets(vaultSiteSecretsPath, graphQLServerSecretData);
+
+    // Prepare ui.app.yaml
+    const graphQLServerAppYaml = `
+repo: docupace-graphql-server
+revision: ${standardConfigRemoteBranch}
+`.trim();
+
+    // Prepare ui.values.yaml
+    const graphQLServerValuesYaml = `
+graphqlServer:
+  auth0Domain: https://${auth0Domain}
+  auth0ClientId: vault:secret/data/${site}/graphql-server/config#AUTH0_CLIENT_ID
+  auth0Audience: ${commonSecrets.CORE_API_IDENTIFIER}
+  baseUrl: https://${siteHost}/api/graphql
+  coreUrl: https://${coreURL}
+  integrationHubUrl: "https://${commonSecrets.INTEGRATION_HUB_URL}"
+  standardConfigRemoteBranch: ${standardConfigRemoteBranch}
+  apiLevel: "2"
+  env:
+    AUTH0_CLIENT_SECRET: vault:secret/data/${site}/graphql-server/config#AUTH0_CLIENT_SECRET
+    STANDARD_CONFIG_REMOTE_PATH: vault:secret/data/common/config#STANDARD_CONFIG_REMOTE_PATH
+    AUTH0_CC_CLIENT_ID: vault:secret/data/${site}/graphql-server/config#AUTH0_CC_CLIENT_ID
+    AUTH0_CC_CLIENT_SECRET: vault:secret/data/${site}/graphql-server/config#AUTH0_CC_CLIENT_SECRET
+image:
+  repository: registry.paperout.com/docupace-graphql-server-dev-docker-local/docupace-graphql-server
+  tag: ${imageTag}
+imagePullSecrets:
+  - name: jf-artifactory
+ingress:
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: ${siteHost}
+    external-dns.alpha.kubernetes.io/zone: public
+    cert-manager.io/cluster-issuer: letsencrypt
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+  enabled: true
+  className: nginx
+  hosts:
+    - host: ${siteHost}
+      paths:
+        - path: /api/graphql
+          pathType: Prefix
+  tls:
+    - hosts:
+        - ${siteHost}
+      secretName: dp-next-ui-cert
+`.trim();
+
+    // Write configuration files
+    console.log("Writing ArgoCD GraphQL Server configuration files...");
+    await ensureDirectoryExists(path.resolve(`${repoPath}/dp/${site}`));
+
+    await fs.writeFile(`${repoPath}/dp/${site}/graphql-server.app.yaml`, graphQLServerAppYaml, (err) => {
+      if (err) {
+        console.error("Failed to write the file:", err);
+      } else {
+        console.log("File written successfully.");
+      }
+    });
+
+    await fs.writeFile(`${repoPath}/dp/${site}/graphql-server.values.yaml`, graphQLServerValuesYaml, (err) => {
+      if (err) {
+        console.error("Failed to write the file:", err);
+      } else {
+        console.log("File written successfully.");
+      }
+    });
+    console.log("Done!");
+  } catch (error) {
+    console.error("Error configuring GraphQL Server:", error);
+  }
+}
+
+export async function configureFromSite(fromSite, toSite, env, deployUI, deployGraphQLServer, useNewDomain) {
+  console.log(`Configuring Auth0 tenants and ArgoCD apps for site: ${toSite} in env: ${env} from site: ${fromSite}`);
+  // Common Secrets
+  const commonSecretsPath = getVaultSecretsConfigs(toSite).commonSecretsPath;
+  console.log(`commonSecretsPath => ${commonSecretsPath}`)
+  const commonSecrets = await getVaultSecrets(commonSecretsPath);
+
+  // Site Common Secrets
+  const siteCommonSecretsPath = getVaultSecretsConfigs(toSite).siteCommonSecretsPath;
+  console.log(`siteCommonSecretsPath => ${siteCommonSecretsPath}`)
+  const siteCommonSecrets = await getVaultSecrets(siteCommonSecretsPath);
+
+  const auth0Domain = `docupace-${env}-${toSite}.us.auth0.com`
+  const auth0ClientId = siteCommonSecrets.AUTH0_CLIENT_ID;
+  const auth0ClientSecret = siteCommonSecrets.AUTH0_CLIENT_SECRET;
+  const auth0Token = await getAuth0AuthToken(auth0Domain, auth0ClientId, auth0ClientSecret);
+
+  // UI app
+  const uiSecretsPath = getVaultSecretsConfigs(toSite).uiSecretsPath;
+  console.log(`uiSecretsPath => ${uiSecretsPath}`)
+
+  // GraphQL-Server app
+  const graphqlSecretsPath = getVaultSecretsConfigs(toSite).graphqlServerSecretsPath;
+  console.log(`graphqlSecretsPath => ${graphqlSecretsPath}`)
+
+  // Clone repositories
+  const repoPath = await cloneEnvRepository(env);
+  const templateRepoPath = await cloneRepository('template');
+  const auth0RepoPath = await cloneRepository('auth0-site-setup');
+
+  // Read deploy configs
+  const { deployConfig: deployUIConfig } = await readDeployConfig('ui', env, fromSite);
+  const uiImageTag = deployUIConfig.image.tag;
+
+  const { deployConfig: deployGraphQLServerConfig} = await readDeployConfig('graphql-server', env, fromSite);
+  const graphqlImageTag = deployGraphQLServerConfig.image.tag;
+  const graphqlStandardConfigRemoteBranch = deployGraphQLServerConfig.graphqlServer.standardConfigRemoteBranch;
+
+  // File paths
+  const filePaths = {
+    clientJson: './auth0-site-setup/template/clients/docupace-connect.json',
+    databaseLoginJs: './auth0-site-setup/template/database-connections/docupace/login.js',
+    loginHtml: './auth0-site-setup/template/pages/login.html',
+    graphqlJson: './auth0-site-setup/template/clients/docupace-graphql.json',
+    uiJson: './auth0-site-setup/template/clients/docupace-ui-main.json',
+    databaseJson: './auth0-site-setup/template/database-connections/docupace/database.json',
+    twilioJson: './auth0-site-setup/template/guardian/providers/sms-twilio.json',
+  };
+
+  console.log(`Copying Latest UI Image Tag: ${deployUIConfig.image.tag} from site: ${fromSite} to site: ${toSite}`);
+  console.log(`Copying Latest GraphQL Server Image Tag: ${deployGraphQLServerConfig.image.tag} from site: ${fromSite} to site: ${toSite}`);
+
+  // Get latest commit ID from TEMPLATE_DIR
+  let shortCommitId;
+  try {
+    process.chdir(templateRepoPath);
+    shortCommitId = (await $`git log --pretty=format:'%h' -n 1`).stdout.trim();
+
+    if (!shortCommitId) {
+      console.error("Error: Latest Template commit ID is empty or not set");
+    }
+
+    console.log(`Latest Template commit ID: ${shortCommitId}`);
+    process.chdir('..'); // Return to the parent directory
+  } catch (error) {
+    console.error("Error retrieving the latest template commit ID:", error.message);
+  }
+
+  const envConfig = environmentConfig[env];
+
+  let CORE_URL,
+    SITE_HOST,
+    CORE_API_CONTEXT,
+    CONNECT_URL,
+    DOCUPACE_HOST;
+  if (useNewDomain) {
+    const newUrl = envConfig.newUrl(toSite);
+    CORE_URL = `${newUrl}/core`;
+    SITE_HOST = newUrl;
+    CORE_API_CONTEXT = "core";
+    CONNECT_URL = `${newUrl}/connect`;
+    DOCUPACE_HOST = envConfig.docupaceHost();
+  } else {
+    const oldUrl = envConfig.oldUrl(toSite);
+    CORE_URL = oldUrl;
+    SITE_HOST = oldUrl;
+    CORE_API_CONTEXT = toSite;
+    CONNECT_URL = `${oldUrl}_ui`;
+  }
+
+  await templateAuth0(SITE_HOST, CORE_API_CONTEXT, env, filePaths, deployUI, deployGraphQLServer, commonSecrets);
+  await importAuth0Templates('./auth0-site-setup/template', auth0Domain, auth0ClientId, auth0ClientSecret);
+
+  if (deployUI === 'true') {
+    await configureUI(SITE_HOST, CORE_URL, DOCUPACE_HOST, toSite, env, useNewDomain, auth0Domain, auth0ClientId, auth0ClientSecret, auth0Token, uiSecretsPath, uiImageTag, repoPath);
+  }
+
+  await configureGraphQLServer(SITE_HOST, CORE_URL, DOCUPACE_HOST, toSite, env, auth0Domain, auth0ClientId, auth0ClientSecret, auth0Token, graphqlSecretsPath, graphqlImageTag, graphqlStandardConfigRemoteBranch, repoPath, commonSecrets);
+  await pushDeployConfig(repoPath, `Config update for ${toSite} from ${fromSite} with UI: ${uiImageTag} and GraphQL: ${graphqlImageTag}`);
+
+  await initializeAuth0Configuration({
+    initConfiguration: "true",
+    auth0Domain: auth0Domain,
+    auth0AuthToken: auth0Token,
+    coreApiIdentifier: commonSecrets.CORE_API_IDENTIFIER,
+  });
+
+  await addApplicationToApi({
+    application: 'docupace-graphql-client-credentials',
+    auth0Domain: auth0Domain,
+    auth0AuthToken: auth0Token,
+    coreApiIdentifier: commonSecrets.CORE_API_IDENTIFIER
+  })
+}

package/src/auth0/vault.js

@@ -0,0 +1,107 @@
+import axios from 'axios';
+
+/**
+ * Fetch secrets from Vault.
+ * @param {string} vaultPath - The path in Vault to fetch secrets from.
+ * @returns {Promise<Object>} - The secret data as a JSON object.
+ */
+export async function getVaultSecrets(vaultPath) {
+  if (!vaultPath) {
+    console.error("Error: VAULT_PATH is required.");
+    throw new Error("VAULT_PATH is required.");
+  }
+
+  const vaultToken = process.env.VAULT_TOKEN;
+  const vaultAddr = process.env.VAULT_ADDR;
+
+  if (!vaultToken || !vaultAddr) {
+    console.error("Error: VAULT_TOKEN and VAULT_ADDR must be set.");
+    throw new Error("VAULT_TOKEN and VAULT_ADDR must be set.");
+  }
+
+  try {
+    // Disable SSL verification globally by setting environment variable
+    if (process.env.VAULT_SKIP_VERIFY === 'true') {
+      process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+    }
+
+    // Fetch the secret from Vault
+    const response = await axios.get(`${vaultAddr}/v1/${vaultPath}`, {
+      headers: {
+        'X-Vault-Token': vaultToken,
+      },
+    });
+
+    // Validate the response contains JSON data
+    const data = response.data;
+    if (data && typeof data === 'object') {
+      // console.log(`Secrets fetched successfully from Vault at ${JSON.stringify(data.data.data)})`);
+      return data.data.data;
+    } else {
+      console.error("Error: Invalid JSON received from Vault.");
+      throw new Error("Invalid JSON received from Vault.");
+    }
+  } catch (error) {
+    if (error.response) {
+      console.error(
+        `Error: Failed to connect to Vault server at ${vaultAddr}. Response: ${error.response.status} ${error.response.statusText}`
+      );
+    } else {
+      console.error(`Error: ${error.message}`);
+    }
+    // throw error;
+  }
+}
+
+/**
+ * Update a secret in Vault.
+ * @param {string} vaultPath - The path in Vault where the secret should be updated.
+ * @param {Object} secretData - The secret data to be stored (as a JSON object).
+ * @returns {Promise<Object>} - The response from Vault as a JSON object.
+ */
+export async function updateVaultSecrets(vaultPath, secretData) {
+  if (!vaultPath || !secretData) {
+    console.error("Usage: updateVaultSecret(vaultPath, secretData)");
+    throw new Error("Both vaultPath and secretData are required.");
+  }
+
+  const vaultToken = process.env.VAULT_TOKEN;
+  const vaultAddr = process.env.VAULT_ADDR;
+
+  if (!vaultToken || !vaultAddr) {
+    console.error("Error: VAULT_TOKEN and VAULT_ADDR must be set.");
+    throw new Error("VAULT_TOKEN and VAULT_ADDR must be set.");
+  }
+
+  try {
+    // Disable SSL verification globally if VAULT_SKIP_VERIFY is set
+    if (process.env.VAULT_SKIP_VERIFY === 'true') {
+      process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+    }
+
+    // Make the POST request to update the Vault secret
+    const response = await axios.post(
+      `${vaultAddr}/v1/${vaultPath}`,
+      secretData,
+      {
+        headers: {
+          'X-Vault-Token': vaultToken,
+          'Content-Type': 'application/json',
+        },
+      }
+    );
+
+    // Return the response from Vault
+    console.log(response.data);
+    return response.data;
+  } catch (error) {
+    if (error.response) {
+      console.error(
+        `Error: Failed to update secret at ${vaultPath}. Response: ${error.response.status} ${error.response.statusText}`
+      );
+    } else {
+      console.error(`Error: ${error.message}`);
+    }
+    // throw error;
+  }
+}

package/src/next/config.js

@@ -4,23 +4,27 @@ export const environmentConfig = {
   dev: {
     newUrl: (site) => `${site}.dev.dpai.tech`,
     oldUrl: (site) => `https://www.dev.docupaceinc.com/${site}`,
+    docupaceHost: () => 'www.dev.docupaceinc.com',
   },
   qa: {
     newUrl: (site) => `${site}.qa.dpai.tech`,
     oldUrl: (site) => `https://www.preprod.docupaceinc.com/${site}`,
+    docupaceHost: () => 'www.preprod.docupaceinc.com',
   },
   uat: {
     newUrl: (site) => `${site}.qa.dpai.tech`,
     oldUrl: (site) => `https://www2.paperout.com/${site}_uat`,
+    docupaceHost: () => 'www2.paperout.com',
   },
   stage: {
     newUrl: (site) => `${site}.stage.dpai.tech`,
     oldUrl: (site) => `https://www2.paperout.com/${site}_staging`,
+    docupaceHost: () => 'www2.paperout.com',
   },
-
   prod: {
     newUrl: (site) => `${site}.dpai.tech`,
     oldUrl: (site) => `https://www2.paperout.com/${site}`,
+    docupaceHost: () => 'www2.paperout.com',
   },
 };
 
@@ -65,8 +69,16 @@ export const getBitbucketInfo = () => {
 
 export const getRepUrl = (repoName) => {
   const { username, password, workspace } = getBitbucketInfo();
-  const repoUrl = `https://${username}:${password}@bitbucket.org/${workspace}/${repoName}.git`;
-  return repoUrl;
+  return `https://${username}:${password}@bitbucket.org/${workspace}/${repoName}.git`;
 };
 
 export const jfRegistryUrl = 'registry.paperout.com';
+
+export const getVaultSecretsConfigs = (site) => {
+  return {
+    commonSecretsPath: 'secret/data/common/config',
+    siteCommonSecretsPath: `secret/data/${site}/common/config`,
+    graphqlServerSecretsPath: `secret/data/${site}/graphql-server/config`,
+    uiSecretsPath: `secret/data/${site}/ui/config`
+  }
+};

package/src/next/deploy.js

@@ -22,11 +22,40 @@ function getRepoLocalPath(env) {
   return { repoPath, repoName };
 }
 
-async function cloneEnvRepository(env) {
+function getRepoLocalPathByRepoSlug(repoSlug) {
+  const repoName = `${repoSlug}`;
+  const repoPath = path.join(process.cwd(), repoName);
+  return { repoPath, repoName };
+}
+
+function cleanUpRepoPath(repoPath) {
+  // Check and handle repo directory
+  if (fs.existsSync(repoPath)) {
+    console.log(`${repoPath} directory exists. Removing it...`);
+    fs.rmSync(repoPath, {
+      recursive: true,
+      force: true
+    });
+  }
+}
+
+export async function cloneEnvRepository(env) {
   const { repoPath, repoName } = getRepoLocalPath(env);
   const repoUrl = getRepUrl(repoName);
   console.log(`Cloning repository: ${repoName}`);
-  await $`git clone ${repoUrl}`;
+  await $`git clone --depth 1 ${repoUrl}`;
+  console.log(`Repository cloned to: ${repoPath}`);
+  return repoPath;
+}
+
+export async function cloneRepository(repoSlug) {
+  const { repoPath, repoName } = getRepoLocalPathByRepoSlug(repoSlug);
+  const repoUrl = getRepUrl(repoName);
+
+  await cleanUpRepoPath(repoPath)
+
+  console.log(`Cloning repository: ${repoName}`);
+  await $`git clone --depth 1 ${repoUrl}`;
   console.log(`Repository cloned to: ${repoPath}`);
   return repoPath;
 }
@@ -41,7 +70,7 @@ function getConfigPath(application, env, site) {
   return { repoPath, deployConfigFilePath };
 }
 
-async function readDeployConfig(application, env, site) {
+export async function readDeployConfig(application, env, site) {
   const { deployConfigFilePath } = getConfigPath(application, env, site);
 
   let deployConfig;
@@ -244,9 +273,7 @@ export async function deployFromSite(
 ) {
   if (isDeployCore === 'true') {
     const branchName = await getCoreBranchName(fromEnv, fromSite);
-
-    const coreEnv = toEnv == 'qa' ? 'preprod' : toEnv;
-    await deployCore(coreEnv, toSite, 'true', branchName);
+    await deployCore(toEnv, toSite, 'true', branchName);
 
     // To be added back when splitting between on prem and in cloud
     /*await runPipeline('site-deploy', 'deploy-core', 'main', {

package/src/next/jenkins.js

@@ -72,9 +72,9 @@ export async function deployCore(env, site, liquibase, gitBranch) {
       if (result) {
         console.log(`\nJob completed with result: ${result}`);
         if (result === 'SUCCESS') {
-          return;
+          process.exit(0);
         } else {
-          throw new Error('Jenkins job failed');
+          process.exit(1);
         }
       }
 
@@ -83,6 +83,6 @@ export async function deployCore(env, site, liquibase, gitBranch) {
     }
   } catch (error) {
     console.error('Error:', error.message);
-    throw new Error(error);
+    process.exit(1);
   }
 }