@govuk-pay/cli 0.0.42 → 0.0.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govuk-pay/cli",
-  "version": "0.0.42",
+  "version": "0.0.44",
   "description": "GOV.UK Pay Command Line Interface",
   "bin": {
     "pay": "bin/cli.js",

package/resources/legacy-ruby-cli/config/secrets.yml

@@ -65,6 +65,7 @@ pay-low-pass:
       master_db_password:                           aws/rds/superuser/deploy-tooling/pact-broker/password # pragma: allowlist secret
       DB_PASSWORD:                                  aws/rds/application_users/deploy/pact_broker # pragma: allowlist secret
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/deploy/pact_broker_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/deploy/pact_broker_support_readwrite # pragma: allowlist secret
     stubs:
       smartpay-expected-password:          pay-stubs/smartpay/expected-password
       smartpay-expected-user:              pay-stubs/smartpay/expected-user
@@ -74,6 +75,7 @@ pay-low-pass:
     adminusers:
       DB_PASSWORD:                                  aws/rds/application_users/test/adminusers1
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test/adminusers_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test/adminusers_support_readwrite # pragma: allowlist secret
       NOTIFY_API_KEY:                               notify/api_key/ci/test.adminusers.notify_api_key
       SENTRY_DSN:                                   sentry_io/adminusers_dsn
     cardid:
@@ -81,6 +83,7 @@ pay-low-pass:
     connector:
       DB_PASSWORD:                                                       aws/rds/application_users/test/connector2
       DB_SUPPORT_PASSWORD_READONLY:                                      aws/rds/support_readonly_users/test/connector_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                                     aws/rds/support_readwrite_users/test/connector_support_readwrite # pragma: allowlist secret
       NOTIFY_API_KEY:                                                    notify/api_key/ci/test.connector.notify_api_key
       GDS_CONNECTOR_STRIPE_AUTH_TOKEN:                                   stripe/test/test/account-api-key
       GDS_CONNECTOR_STRIPE_AUTH_LIVE_TOKEN:                              stripe/test/test/account-api-key
@@ -110,10 +113,12 @@ pay-low-pass:
     ledger:
       DB_PASSWORD:                                  aws/rds/application_users/test/ledger
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test/ledger_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test/ledger_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/ledger_dsn
     webhooks:
       DB_PASSWORD:                                  aws/rds/application_users/test/webhooks # pragma: allowlist secret
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test/webhooks_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test/webhooks_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/webhooks_dsn
     product-page:
       pager_duty_cloudwatch_integration_url:        pager-duty/govuk-pay-product-page/amazon-cloudwatch-integration-url
@@ -126,6 +131,7 @@ pay-low-pass:
       DB_USER:                                      ""
       DB_PASSWORD:                                  ""
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test/publicauth_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test/publicauth_support_readwrite # pragma: allowlist secret
       # These secrets are used by the app, but having them set to an empty string tries to overwrite working secrets with
       # the words 'Password Store'. They are not in pay-low-pass, so for now to stop them being overwritten I'm commenting them out
       # TOKEN_DB_BCRYPT_SALT:                         ""
@@ -135,6 +141,7 @@ pay-low-pass:
       DB_USER:                                      ""
       DB_PASSWORD:                                  ""
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test/products_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test/products_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/products_dsn
     products-ui:
       SESSION_ENCRYPTION_KEY:                       ""
@@ -171,6 +178,7 @@ pay-low-pass:
     adminusers:
       DB_PASSWORD:                                  aws/rds/application_users/test/adminusers
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test-perf/adminusers_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test-perf/adminusers_support_readwrite # pragma: allowlist secret
       NOTIFY_API_KEY:                               notify/api_key/ci/test_perf.adminusers.notify_api_key # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/adminusers_dsn
     cardid:
@@ -178,6 +186,7 @@ pay-low-pass:
     connector:
       DB_PASSWORD:                                                       aws/rds/superuser/test-12/connector/payment-password
       DB_SUPPORT_PASSWORD_READONLY:                                      aws/rds/support_readonly_users/test-perf/connector_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                                     aws/rds/support_readwrite_users/test-perf/connector_support_readwrite # pragma: allowlist secret
       NOTIFY_API_KEY:                                                    notify/api_key/ci/test_perf.connector.notify_api_key # pragma: allowlist secret
       GDS_CONNECTOR_STRIPE_AUTH_TOKEN:                                   stripe/test/test/account-api-key
       GDS_CONNECTOR_STRIPE_AUTH_LIVE_TOKEN:                              stripe/test/test/account-api-key
@@ -207,6 +216,7 @@ pay-low-pass:
     ledger:
       DB_PASSWORD:                                  aws/rds/application_users/test/ledger
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test-perf/ledger_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test-perf/ledger_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/ledger_dsn
     publicapi:
       # These secrets are used by the app, but having them set to an empty string tries to overwrite working secrets with
@@ -217,6 +227,7 @@ pay-low-pass:
       DB_USER:                                      ""
       DB_PASSWORD:                                  ""
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test-perf/publicauth_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test-perf/publicauth_support_readwrite # pragma: allowlist secret
       # These secrets are used by the app, but having them set to an empty string tries to overwrite working secrets with
       # the words 'Password Store'. They are not in pay-low-pass, so for now to stop them being overwritten I'm commenting them out
       # TOKEN_DB_BCRYPT_SALT:                         ""
@@ -226,6 +237,7 @@ pay-low-pass:
       DB_USER:                                      ""
       DB_PASSWORD:                                  ""
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test-perf/products_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test-perf/products_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/products_dsn
     products-ui:
       SESSION_ENCRYPTION_KEY:                       ""
@@ -260,6 +272,7 @@ pay-low-pass:
     webhooks:
       DB_PASSWORD:                                  aws/rds/application_users/test/webhooks # pragma: allowlist secret
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/test-perf/webhooks_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/test-perf/webhooks_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/webhooks_dsn
   test:
     alb_and_s3_logging_pipeline:
@@ -279,6 +292,7 @@ pay-low-pass:
     adminusers:
       DB_PASSWORD:                                  aws/rds/application_users/staging/adminusers1
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/staging/adminusers_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/staging/adminusers_support_readwrite # pragma: allowlist secret
       NOTIFY_API_KEY:                               notify/api_key/deploy/staging.adminusers.notify_api_key
       SENTRY_DSN:                                   sentry_io/adminusers_dsn
     cardid:
@@ -286,6 +300,7 @@ pay-low-pass:
     connector:
       DB_PASSWORD:                                                       aws/rds/application_users/staging/connector1
       DB_SUPPORT_PASSWORD_READONLY:                                      aws/rds/support_readonly_users/staging/connector_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                                     aws/rds/support_readwrite_users/staging/connector_support_readwrite # pragma: allowlist secret
       NOTIFY_API_KEY:                                                    notify/api_key/deploy/staging.connector.notify_api_key
       GDS_CONNECTOR_STRIPE_AUTH_TOKEN:                                   stripe/staging/test/account-api-key
       GDS_CONNECTOR_STRIPE_AUTH_LIVE_TOKEN:                              stripe/staging/test/account-api-key
@@ -313,9 +328,11 @@ pay-low-pass:
     ledger:
       DB_PASSWORD:                                  aws/rds/application_users/staging/ledger
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/staging/ledger_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/staging/ledger_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/ledger_dsn
     products:
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/staging/products_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/staging/products_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/products_dsn
     products-ui:
       SENTRY_DSN:                                   sentry_io/products_ui_dsn
@@ -328,6 +345,7 @@ pay-low-pass:
       # TOKEN_API_HMAC_SECRET:                        ""
     publicauth:
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/staging/publicauth_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/staging/publicauth_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/publicauth_dsn
       # These secrets are used by the app, but having them set to an empty string tries to overwrite working secrets with
       # the words 'Password Store'. They are not in pay-low-pass, so for now to stop them being overwritten I'm commenting them out
@@ -364,6 +382,7 @@ pay-low-pass:
     webhooks:
       DB_PASSWORD:                                  aws/rds/application_users/staging/webhooks # pragma: allowlist secret
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/staging/webhooks_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/staging/webhooks_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/webhooks_dsn
     webhooks_intrusion_monitoring:
       pager_duty_cloudwatch_integration_url:        pager-duty/govuk-pay-staging-webhooks/amazon-cloudwatch-integration-url
@@ -374,6 +393,7 @@ pay-low-pass:
     adminusers:
       DB_PASSWORD:                                  aws/rds/application_users/production/adminusers1
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/production/adminusers_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/production/adminusers_support_readwrite # pragma: allowlist secret
       NOTIFY_API_KEY:                               notify/api_key/deploy/production.adminusers.notify_api_key
       SENTRY_DSN:                                   sentry_io/adminusers_dsn
     cardid:
@@ -381,6 +401,7 @@ pay-low-pass:
     connector:
       DB_PASSWORD:                                                       aws/rds/application_users/production/connector2
       DB_SUPPORT_PASSWORD_READONLY:                                      aws/rds/support_readonly_users/production/connector_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                                     aws/rds/support_readwrite_users/production/connector_support_readwrite # pragma: allowlist secret
       NOTIFY_API_KEY:                                                    notify/api_key/deploy/production.connector.notify_api_key
       GDS_CONNECTOR_STRIPE_AUTH_TOKEN:                                   stripe/production/test/account-api-key
       GDS_CONNECTOR_STRIPE_AUTH_LIVE_TOKEN:                              stripe/production/live/account-api-key
@@ -410,6 +431,7 @@ pay-low-pass:
     ledger:
       DB_PASSWORD:                                  aws/rds/application_users/production/ledger
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/production/ledger_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/production/ledger_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/ledger_dsn
     network:
       PAGER_DUTY_CLOUDWATCH_ALB_INTEGRATION_URL:    pager-duty/govuk-pay-cloudwatch-alb/amazon-cloudwatch-integration-url
@@ -417,6 +439,7 @@ pay-low-pass:
       pager_duty_cloudwatch_integration_url:        pager-duty/govuk-pay-product-page/amazon-cloudwatch-integration-url
     products:
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/production/products_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/production/products_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/products_dsn
     products-ui:
       SENTRY_DSN:                                   sentry_io/products_ui_dsn
@@ -427,6 +450,7 @@ pay-low-pass:
       SENTRY_DSN:                                   sentry_io/publicapi_dsn
     publicauth:
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/production/publicauth_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/production/publicauth_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/publicauth_dsn
       # These secrets are used by the app, but having them set to an empty string tries to overwrite working secrets with
       # the words 'Password Store'. They are not in pay-low-pass, so for now to stop them being overwritten I'm commenting them out
@@ -461,6 +485,7 @@ pay-low-pass:
     webhooks:
       DB_PASSWORD:                                  aws/rds/application_users/production/webhooks # pragma: allowlist secret
       DB_SUPPORT_PASSWORD_READONLY:                 aws/rds/support_readonly_users/production/webhooks_support_readonly # pragma: allowlist secret
+      DB_SUPPORT_PASSWORD_READWRITE:                aws/rds/support_readwrite_users/production/webhooks_support_readwrite # pragma: allowlist secret
       SENTRY_DSN:                                   sentry_io/webhooks_dsn
     webhooks_intrusion_monitoring:
       pager_duty_cloudwatch_integration_url:        pager-duty/govuk-pay/amazon-cloudwatch-integration-url
@@ -502,14 +527,17 @@ value:
     pact-broker:
       DB_USER: "pact_broker"
       DB_SUPPORT_USER_READONLY: "pact_broker_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "pact_broker_support_readwrite"
   test-12:
     adminusers:
       DB_USER: "adminusers1"
       DB_SUPPORT_USER_READONLY: "adminusers_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "adminusers_support_readwrite"
       NOTIFY_SECRET: ""
     connector:
       DB_USER: "connector2"
       DB_SUPPORT_USER_READONLY: "connector_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "connector_support_readwrite"
       NOTIFY_SECRET: ""
     frontend:
       AB_TEST_THRESHOLD:      "50"
@@ -518,15 +546,19 @@ value:
     ledger:
       DB_USER: "ledger"
       DB_SUPPORT_USER_READONLY: "ledger_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "ledger_support_readwrite"
     webhooks:
       DB_USER: "webhooks"
       DB_SUPPORT_USER_READONLY: "webhooks_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "webhooks_support_readwrite"
     publicauth:
       DB_USER: "publicauth1"
       DB_SUPPORT_USER_READONLY: "publicauth_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "publicauth_support_readwrite"
     products:
       DB_USER: "products"
       DB_SUPPORT_USER_READONLY: "products_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "products_support_readwrite"
     toolbox:
       AUTH_GITHUB_VIEW_ONLY_TEAM_ID: "3304536"
       AUTH_GITHUB_USER_SUPPORT_TEAM_ID: "3304536"
@@ -537,10 +569,12 @@ value:
     adminusers:
       DB_USER: "adminusers"
       DB_SUPPORT_USER_READONLY: "adminusers_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "adminusers_support_readwrite"
       NOTIFY_SECRET: ""
     connector:
       DB_USER: "connector"
       DB_SUPPORT_USER_READONLY: "connector_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "connector_support_readwrite"
       NOTIFY_SECRET: ""
     frontend:
       AB_TEST_THRESHOLD:      "50"
@@ -549,12 +583,15 @@ value:
     ledger:
       DB_USER: "ledger"
       DB_SUPPORT_USER_READONLY: "ledger_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "ledger_support_readwrite"
     publicauth:
       DB_USER: "publicauth"
       DB_SUPPORT_USER_READONLY: "publicauth_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "publicauth_support_readwrite"
     products:
       DB_USER: "products"
       DB_SUPPORT_USER_READONLY: "products_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "products_support_readwrite"
     terraform:
       PERF_ENV: "true"
     toolbox:
@@ -566,14 +603,17 @@ value:
     webhooks:
       DB_USER: "webhooks"
       DB_SUPPORT_USER_READONLY: "webhooks_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "webhooks_support_readwrite"
   staging-2:
     adminusers:
       DB_USER: "adminusers1"
       DB_SUPPORT_USER_READONLY: "adminusers_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "adminusers_support_readwrite"
       NOTIFY_SECRET: ""
     connector:
       DB_USER: "connector1"
       DB_SUPPORT_USER_READONLY: "connector_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "connector_support_readwrite"
       NOTIFY_SECRET: ""
     frontend:
       AB_TEST_THRESHOLD:      "50"
@@ -582,12 +622,15 @@ value:
     ledger:
       DB_USER: "ledger"
       DB_SUPPORT_USER_READONLY: "ledger_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "ledger_support_readwrite"
     publicauth:
       DB_USER: "publicauth1"
       DB_SUPPORT_USER_READONLY: "publicauth_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "publicauth_support_readwrite"
     products:
       DB_USER: "products"
       DB_SUPPORT_USER_READONLY: "products_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "products_support_readwrite"
     toolbox:
       AUTH_GITHUB_VIEW_ONLY_TEAM_ID: "3304500"
       AUTH_GITHUB_USER_SUPPORT_TEAM_ID: "3304500"
@@ -597,26 +640,32 @@ value:
     webhooks:
       DB_USER: "webhooks"
       DB_SUPPORT_USER_READONLY: "webhooks_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "webhooks_support_readwrite"
   production-2:
     adminusers:
       DB_USER: "adminusers1"
       DB_SUPPORT_USER_READONLY: "adminusers_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "adminusers_support_readwrite"
       NOTIFY_SECRET: ""
     connector:
       DB_USER: "connector2"
       DB_SUPPORT_USER_READONLY: "connector_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "connector_support_readwrite"
       NOTIFY_SECRET: ""
     frontend:
       AB_TEST_THRESHOLD:     "50"
     ledger:
       DB_USER: "ledger"
       DB_SUPPORT_USER_READONLY: "ledger_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "ledger_support_readwrite"
     publicauth:
       DB_USER: "publicauth1"
       DB_SUPPORT_USER_READONLY: "publicauth_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "publicauth_support_readwrite"
     products:
       DB_USER: "products"
       DB_SUPPORT_USER_READONLY: "products_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "products_support_readwrite"
     toolbox:
       AUTH_GITHUB_VIEW_ONLY_TEAM_ID: "7196958"
       AUTH_GITHUB_USER_SUPPORT_TEAM_ID: "3304532"
@@ -626,3 +675,4 @@ value:
     webhooks:
       DB_USER: "webhooks"
       DB_SUPPORT_USER_READONLY: "webhooks_support_readonly"
+      DB_SUPPORT_USER_READWRITE: "webhooks_support_readwrite"

package/resources/legacy-ruby-cli/config/service_secrets.yml

@@ -4,6 +4,8 @@ adminusers:
   - DB_PASSWORD
   - DB_SUPPORT_USER_READONLY
   - DB_SUPPORT_PASSWORD_READONLY
+  - DB_SUPPORT_USER_READWRITE
+  - DB_SUPPORT_PASSWORD_READWRITE
   - NOTIFY_API_KEY
   - NOTIFY_SECRET
   - SENTRY_DSN
@@ -19,6 +21,8 @@ connector:
   - DB_PASSWORD
   - DB_SUPPORT_USER_READONLY
   - DB_SUPPORT_PASSWORD_READONLY
+  - DB_SUPPORT_USER_READWRITE
+  - DB_SUPPORT_PASSWORD_READWRITE
   - NOTIFY_SECRET
   - NOTIFY_API_KEY
   - GDS_CONNECTOR_STRIPE_AUTH_TOKEN
@@ -43,6 +47,8 @@ pact-broker:
   - DB_PASSWORD
   - DB_SUPPORT_USER_READONLY
   - DB_SUPPORT_PASSWORD_READONLY
+  - DB_SUPPORT_USER_READWRITE
+  - DB_SUPPORT_PASSWORD_READWRITE
 pact-broker-auth:
   - pact-broker-basic-auth-password
   - pact-broker-basic-auth-username
@@ -74,6 +80,8 @@ publicauth:
   - DB_PASSWORD
   - DB_SUPPORT_USER_READONLY
   - DB_SUPPORT_PASSWORD_READONLY
+  - DB_SUPPORT_USER_READWRITE
+  - DB_SUPPORT_PASSWORD_READWRITE
   # These secrets are used by the app, but having them set to an empty string tries to overwrite working secrets with
   # the words 'Password Store'. They are not in pay-low-pass, so for now to stop them being overwritten I'm commenting them out
   # - TOKEN_DB_BCRYPT_SALT
@@ -86,6 +94,8 @@ products:
   - DB_PASSWORD
   - DB_SUPPORT_USER_READONLY
   - DB_SUPPORT_PASSWORD_READONLY
+  - DB_SUPPORT_USER_READWRITE
+  - DB_SUPPORT_PASSWORD_READWRITE
   - SENTRY_DSN
 products-ui:
   - SESSION_ENCRYPTION_KEY
@@ -104,12 +114,16 @@ ledger:
   - DB_USER
   - DB_SUPPORT_USER_READONLY
   - DB_SUPPORT_PASSWORD_READONLY
+  - DB_SUPPORT_USER_READWRITE
+  - DB_SUPPORT_PASSWORD_READWRITE
   - SENTRY_DSN
 webhooks:
   - DB_PASSWORD
   - DB_USER
   - DB_SUPPORT_USER_READONLY
   - DB_SUPPORT_PASSWORD_READONLY
+  - DB_SUPPORT_USER_READWRITE
+  - DB_SUPPORT_PASSWORD_READWRITE
   - SENTRY_DSN
 toolbox:
   - AUTH_GITHUB_CLIENT_ID

package/src/commands/secrets/subcommands/audit.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.builder = exports.desc = exports.command = void 0;
+const node_child_process_1 = require("node:child_process");
+const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
+exports.command = 'audit <service> <env..>';
+exports.desc = 'Audits secrets for <service> for the given <envs..>';
+const builder = (yargs) => {
+    return yargs
+        .positional('service', {
+        type: 'string',
+        description: 'The service (e.g. connector) to audit the secret for'
+    })
+        .positional('env', {
+        type: 'string',
+        description: 'The environment (e.g. test-12) to audit the secret for'
+    });
+};
+exports.builder = builder;
+exports.handler = auditHandler;
+async function auditHandler(argv) {
+    const service = argv.service;
+    const envs = argv.env;
+    const preflightInfo = (0, preflight_js_1.default)();
+    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'audit', service, ...envs], { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+}
+exports.default = auditHandler;

package/src/commands/secrets/subcommands/copy.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.builder = exports.desc = exports.command = void 0;
+const node_child_process_1 = require("node:child_process");
+const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
+exports.command = 'copy <service> <src_env> <dest_env>';
+exports.desc = 'Copies secrets for <service> from <src_env> to <dest_env>';
+const builder = (yargs) => {
+    return yargs
+        .positional('service', {
+        type: 'string',
+        description: 'The service (e.g. connector) to copy the secrets for'
+    })
+        .positional('src_env', {
+        type: 'string',
+        description: 'The environment (e.g. test-12) to copy the secrets from'
+    })
+        .positional('dest_env', {
+        type: 'string',
+        description: 'The environment (e.g. test-perf-1) to copy the secrets to'
+    });
+};
+exports.builder = builder;
+exports.handler = copyHandler;
+async function copyHandler(argv) {
+    const service = argv.service;
+    const srcEnv = argv.src_env;
+    const destEnv = argv.dest_env;
+    const preflightInfo = (0, preflight_js_1.default)();
+    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'copy', service, srcEnv, destEnv], { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+}
+exports.default = copyHandler;

package/src/commands/secrets/subcommands/fetch.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.builder = exports.desc = exports.command = void 0;
+const node_child_process_1 = require("node:child_process");
+const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
+exports.command = 'fetch <env> <service> <secret_name> [--use-ssm]';
+exports.desc = 'Fetches a <named secret> for <service> for <env>, if use-ssm is set then get the secret from ssm';
+const builder = (yargs) => {
+    return yargs
+        .positional('env', {
+        type: 'string',
+        description: 'The environment (e.g. test-12) to fetch the secret for'
+    })
+        .positional('service', {
+        type: 'string',
+        description: 'The service (e.g. connector) to fetch the secret for'
+    })
+        .positional('secret_name', {
+        type: 'string',
+        description: 'The name of the secret to get'
+    })
+        .option('use-ssm', {
+        type: 'boolean',
+        default: false,
+        description: 'Query SSM to get the value'
+    });
+};
+exports.builder = builder;
+exports.handler = fetchHandler;
+async function fetchHandler(argv) {
+    const service = argv.service;
+    const env = argv.env;
+    const secretName = argv.secret_name;
+    const useSSM = argv.useSsm;
+    const preflightInfo = (0, preflight_js_1.default)();
+    const rbenvArgs = ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'fetch', env, service, secretName];
+    if (useSSM) {
+        rbenvArgs.push('--use-ssm');
+    }
+    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, rbenvArgs, { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+    // The fetch command doesn't output a newline which is really annoying, so add one
+    console.log();
+}
+exports.default = fetchHandler;

package/src/commands/secrets/subcommands/provision.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.builder = exports.desc = exports.command = void 0;
+const node_child_process_1 = require("node:child_process");
+const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
+exports.command = 'provision <service> <env>';
+exports.desc = 'Provisions secrets from config for <service> in <env>';
+const builder = (yargs) => {
+    return yargs
+        .positional('service', {
+        type: 'string',
+        description: 'The service (e.g. connector) to provision secrets for'
+    })
+        .positional('env', {
+        type: 'string',
+        description: 'The environment (e.g. test-12) to provision the secrets in'
+    });
+};
+exports.builder = builder;
+exports.handler = provisionHandler;
+async function provisionHandler(argv) {
+    const service = argv.service;
+    const env = argv.env;
+    const preflightInfo = (0, preflight_js_1.default)();
+    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'provision', service, env], { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+}
+exports.default = provisionHandler;

package/src/commands/secrets/utils/preflight.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_child_process_1 = require("node:child_process");
+const node_path_1 = __importDefault(require("node:path"));
+const constants_1 = require("../../../core/constants");
+function preflightCheck() {
+    const pathToLegacyRubyCli = node_path_1.default.join(constants_1.rootDir, 'resources', 'legacy-ruby-cli');
+    const rbenvCommand = process.env.PAY_CLI_RBENV_COMMAND ?? 'rbenv';
+    console.error('Checking for ruby dependencies prior to launch');
+    const whichRbenvResult = (0, node_child_process_1.spawnSync)('command', ['-v', rbenvCommand], { shell: true });
+    if (whichRbenvResult.status !== 0) {
+        console.error('You need rbenv installed before you can continue.');
+        process.exit(1);
+    }
+    console.error(`Ruby version manager ${rbenvCommand} available`);
+    console.error('Checking for bundler');
+    const whichBundlerResult = (0, node_child_process_1.spawnSync)(rbenvCommand, ['exec', 'bundle', '--version'], { shell: true, cwd: pathToLegacyRubyCli });
+    if (whichBundlerResult.status !== 0) {
+        console.error('You need bundler installed and available to rbenv before you can continue. Installing it...');
+        const installBundlerResult = (0, node_child_process_1.spawnSync)(rbenvCommand, ['exec', 'gem', 'install', 'bundler'], { shell: true, stdio: 'inherit', cwd: pathToLegacyRubyCli });
+        if (installBundlerResult.status !== 0) {
+            console.error('Could not install bundler, cannot continue');
+            process.exit(1);
+        }
+    }
+    console.error('Bundler available');
+    console.error('Checking for bundled dependencies');
+    const bundleCheckResult = (0, node_child_process_1.spawnSync)(rbenvCommand, ['exec', 'bundle', 'check'], { shell: true, cwd: pathToLegacyRubyCli });
+    if (bundleCheckResult.status !== 0) {
+        console.error('Not all bundler dependencies are installed, installing them now.');
+        const bundleInstallResult = (0, node_child_process_1.spawnSync)(rbenvCommand, ['exec', 'bundle', 'install'], { shell: true, stdio: 'inherit', cwd: pathToLegacyRubyCli });
+        if (bundleInstallResult.status !== 0) {
+            console.error('Failed to bundle install, cannot continue');
+            process.exit(1);
+        }
+    }
+    console.error('Bundled dependencies installed and available');
+    console.error('All ruby dependencies satisfied, executing legacy ruby cli');
+    return {
+        rbenvCommand,
+        pathToLegacyRubyCli
+    };
+}
+exports.default = preflightCheck;

package/src/commands/secrets.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.builder = exports.desc = exports.command = void 0;
+exports.command = 'secrets';
+exports.desc = 'Provision secrets (uses the legacy ruby CLI)';
+const builder = (yargs) => {
+    return yargs
+        .commandDir('secrets/subcommands')
+        .demandCommand();
+};
+exports.builder = builder;