@govuk-pay/cli 0.0.109 → 0.0.111

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govuk-pay/cli",
-  "version": "0.0.109",
+  "version": "0.0.111",
   "description": "GOV.UK Pay Command Line Interface",
   "bin": {
     "pay": "bin/cli.js",

package/src/commands/secrets/config/secrets/pay_low_pass/deploy.js

@@ -24,6 +24,9 @@ exports.DEPLOY_CONFIG = {
         'end-to-end/docker-username': 'dockerhub/concourse-username',
         'end-to-end/docker-access-token': 'dockerhub/concourse-access-token',
         'github-access-token': 'alphagov-pay-ci-concourse/github.com-concourse-github-personal-access-token',
+        'github-app-id': 'pay-org-management/github-app-id',
+        'github-app-installation-id': 'pay-org-management/github-app-installation-id',
+        'github-app-pem': 'pay-org-management/github-app-pem',
         'grafana-annotations-password': 'concourse/grafana_annotations', // pragma: allowlist secret
         'pact-broker-password': 'pact/pact_broker_password', // pragma: allowlist secret
         'pact-broker-username': 'pact/pact_broker_username',

package/src/util/configs.js

@@ -50,8 +50,7 @@ exports.workspaceEnvVar = workspaceEnvVar;
 const AWS_ENV_VARS_TO_CHECK = [
     'AWS_ACCESS_KEY_ID',
     'AWS_SECRET_ACCESS_KEY',
-    'AWS_SESSION_TOKEN',
-    'AWS_CREDENTIAL_EXPIRATION'
+    'AWS_SESSION_TOKEN'
 ];
 /**
  * This function checks if there are AWS credentials in the environment, that they are for a named account, and their expiry status.
@@ -70,15 +69,21 @@ async function checkAwsCredentials(accountName) {
         }
     }
     const expirationTime = process.env.AWS_CREDENTIAL_EXPIRATION;
-    const expirationTimestamp = Date.parse(expirationTime);
-    const now = Date.now();
-    if (now >= expirationTimestamp) {
-        console.error(`There are AWS credentials in the env, but they have expired. They expired at ${expirationTime}`);
-        process.exit(1);
+    // If AWS_SESSION_TOKEN is set, but AWS_CREDENTIAL_EXPIRATION is not, treat the token expiration is effectively infinite
+    if (expirationTime === undefined || expirationTime === null || expirationTime?.trim() === '') {
+        console.warn('WARNING: The AWS credentials in the env have no expiration');
     }
-    // 15 minutes * 60 seconds in a minute * 1000 ms in a second
-    if (now >= (expirationTimestamp - (15 * 60 * 1000))) {
-        console.warn(`WARNING: The AWS credentials will expire at ${expirationTime} which is within 15 minutes\n`);
+    else {
+        const expirationTimestamp = Date.parse(expirationTime);
+        const now = Date.now();
+        if (now >= expirationTimestamp) {
+            console.error(`There are AWS credentials in the env, but they have expired. They expired at ${expirationTime}`);
+            process.exit(1);
+        }
+        // 15 minutes * 60 seconds in a minute * 1000 ms in a second
+        if (now >= (expirationTimestamp - (15 * 60 * 1000))) {
+            console.warn(`WARNING: The AWS credentials will expire at ${expirationTime} which is within 15 minutes\n`);
+        }
     }
     await checkAwsCredentialsAreForAccount(accountName);
 }

package/src/util/configs.spec.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const globals_1 = require("@jest/globals");
+const configs_1 = require("./configs");
+(0, globals_1.describe)('config methods', () => {
+    const baseEnv = process.env;
+    const missingExpirationToken = 'WARNING: The AWS credentials in the env have no expiration';
+    const correctEnvVars = {
+        AWS_ACCESS_KEY_ID: 'test',
+        AWS_SECRET_ACCESS_KEY: 'test',
+        AWS_SESSION_TOKEN: 'test'
+    };
+    let errorSpy;
+    let warnSpy;
+    (0, globals_1.beforeEach)(() => {
+        errorSpy = globals_1.jest.spyOn(console, 'error').mockImplementation(() => { });
+        warnSpy = globals_1.jest.spyOn(console, 'warn').mockImplementation(() => { });
+        globals_1.jest.spyOn(process, 'exit').mockImplementation((code) => {
+            throw new Error(`process.exit: ${String(code)}`);
+        });
+        globals_1.jest.spyOn(Date, 'now').mockReturnValue(new Date('2025-01-01T12:00:00Z').getTime());
+        process.env = { ...baseEnv };
+    });
+    (0, globals_1.afterEach)(() => {
+        process.env = baseEnv;
+        globals_1.jest.resetAllMocks();
+    });
+    globals_1.test.each([
+        ['AWS_ACCESS_KEY_ID', '\'\'', { AWS_ACCESS_KEY_ID: '' }],
+        ['AWS_SECRET_ACCESS_KEY', 'null', { AWS_ACCESS_KEY_ID: 'test', AWS_SECRET_ACCESS_KEY: null }],
+        ['AWS_SESSION_TOKEN', 'undefined', { AWS_ACCESS_KEY_ID: 'test', AWS_SECRET_ACCESS_KEY: 'test', AWS_SESSION_TOKEN: undefined }]
+    ])('checkAwsCredentials exits if %s is %s', async (expectedVar, envValue, envVars) => {
+        process.env = { ...process.env, ...envVars };
+        const noCredError = `It looks like you do not have any AWS credentials in the environment (missing ${expectedVar}).`;
+        try {
+            await (0, configs_1.checkAwsCredentials)('test');
+            // throw an error so that if the logic is altered and process.exit isnt hit we can force the test to fail
+            throw new Error('Force the test to hit the catch');
+        }
+        catch (e) {
+            (0, globals_1.expect)(process.exit).toBeCalledWith(1);
+            (0, globals_1.expect)(errorSpy).toHaveBeenCalledTimes(2);
+            (0, globals_1.expect)(errorSpy.mock.calls[0]).toEqual([noCredError]);
+        }
+    });
+    globals_1.test.each([
+        ['\'\'', { AWS_CREDENTIAL_EXPIRATION: '' }],
+        ['null', { AWS_CREDENTIAL_EXPIRATION: null }],
+        ['undefined', { AWS_CREDENTIAL_EXPIRATION: undefined }]
+    ])('checkAwsCredentials skips checks on AWS_CREDENTIAL_EXPIRATION when its value is %s', async (awsCredentialExpiration, credToken) => {
+        process.env = { ...process.env, ...correctEnvVars, ...credToken };
+        try {
+            await (0, configs_1.checkAwsCredentials)('not-a-real-account');
+            // throw an error so that if the logic is altered and process.exit isnt hit we can force the test to fail
+            throw new Error('Force the test to hit the catch');
+        }
+        catch (e) {
+            (0, globals_1.expect)(process.exit).toBeCalledWith(1);
+            (0, globals_1.expect)(warnSpy).toBeCalledWith(missingExpirationToken);
+        }
+    });
+    (0, globals_1.it)('logs an error when AWS_CREDENTIAL_EXPIRATION has expired', async () => {
+        process.env = { ...process.env, ...correctEnvVars, ...{ AWS_CREDENTIAL_EXPIRATION: '2024-01-01T12:00:00Z' } };
+        try {
+            await (0, configs_1.checkAwsCredentials)('not-a-real-account');
+            // throw an error so that if the logic is altered and process.exit isnt hit we can force the test to fail
+            throw new Error('Force the test to hit the catch');
+        }
+        catch (e) {
+            (0, globals_1.expect)(process.exit).toBeCalledWith(1);
+            (0, globals_1.expect)(errorSpy).toBeCalledWith('There are AWS credentials in the env, but they have expired. They expired at 2024-01-01T12:00:00Z');
+        }
+    });
+    (0, globals_1.it)('logs a warning when AWS_CREDENTIAL_EXPIRATION has nearly expired', async () => {
+        process.env = { ...process.env, ...correctEnvVars, ...{ AWS_CREDENTIAL_EXPIRATION: '2025-01-01T12:10:00Z' } };
+        try {
+            await (0, configs_1.checkAwsCredentials)('not-a-real-account');
+            // throw an error so that if the logic is altered and process.exit isnt hit we can force the test to fail
+            throw new Error('Force the test to hit the catch');
+        }
+        catch (e) {
+            (0, globals_1.expect)(process.exit).toBeCalledWith(1);
+            (0, globals_1.expect)(warnSpy).toBeCalledWith('WARNING: The AWS credentials will expire at 2025-01-01T12:10:00Z which is within 15 minutes\n');
+        }
+    });
+});