@govuk-pay/cli 0.0.52 → 0.0.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govuk-pay/cli",
-  "version": "0.0.52",
+  "version": "0.0.54",
   "description": "GOV.UK Pay Command Line Interface",
   "bin": {
     "pay": "bin/cli.js",
@@ -19,6 +19,7 @@
     "@aws-sdk/client-rds": "^3.709.0",
     "@aws-sdk/client-ssm": "^3.709.0",
     "@aws-sdk/client-sts": "^3.709.0",
+    "cli-table3": "^0.6.5",
     "handlebars": "^4.7.8",
     "openurl": "^1.1.1",
     "semver": "^7.6.3",

package/readme.md

@@ -23,9 +23,10 @@ once it's installed you can run it using `pay [arguments]` or `payx [arguments]`
 If you'd rather not install it globally you can run it using `npx @govuk-pay/cli`.
 
 We're in the process of porting the existing Ruby CLI into typescript, we've tried to make that process
-transparent to the users of the CLI.  Most of the commands rely on the existing ruby implementation therefore
-you'll need `rbenv` installed with `bundler` installed into it.  When handing over to ruby we use `zsh` by default,
-if you want a different shell or `rbenv` you can set the following environment variables:
+transparent to the users of the CLI. None of the commands now rely on the ruby implementation, but you can 
+(for now) still execute the ruby versions by using `pay legacy`. You'll need `rbenv` installed with `bundler
+installed into it. When handing over to ruby we use `zsh` by default, if you want a different shell or `rbenv`
+you can set the following environment variables:
 
  - `PAY_CLI_RBENV_COMMAND` - defaults to `rbenv`
  - `PAY_CLI_SHELL_COMMAND` - defaults to `zsh`

package/src/commands/secrets/config/config.types.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SERVICE_NAMES = exports.ENVIRONMENT_NAMES = exports.SECRET_SOURCES = void 0;
+exports.SECRET_SOURCES = [
+    'bitwarden-cli',
+    'pay-low-pass',
+    'ssm',
+    'value'
+];
+exports.ENVIRONMENT_NAMES = [
+    'deploy',
+    'deploy-7',
+    'deploy-tooling',
+    'dev',
+    'production',
+    'production-2',
+    'staging',
+    'staging-2',
+    'test',
+    'test-12',
+    'test-perf-1'
+];
+exports.SERVICE_NAMES = [
+    'adminusers',
+    'alb_and_s3_logging_pipeline',
+    'amazon-managed-prometheus',
+    'cardid',
+    'cd-main',
+    'cd-pay-deploy',
+    'cd-pay-dev',
+    'codebuild',
+    'connector',
+    'deploy',
+    'frontend',
+    'ledger',
+    'network',
+    'pact-broker',
+    'pact-broker-auth',
+    'product-page',
+    'products',
+    'products-ui',
+    'publicapi',
+    'publicauth',
+    'selfservice',
+    'stubs',
+    'toolbox',
+    'webhooks',
+    'webhooks_intrusion_monitoring',
+    'worldpay_secure_file_gateway'
+];

package/src/commands/secrets/config/secrets/bitwarden_cli.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BITWARDEN_CLI_CONFIG = void 0;
+exports.BITWARDEN_CLI_CONFIG = {};

package/src/commands/secrets/config/secrets/pay_low_pass/deploy-7.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_7_CONFIG = void 0;
+exports.DEPLOY_7_CONFIG = {
+    deploy: {
+        PAGER_DUTY_CLOUDWATCH_INTEGRATION_URL: 'pager-duty/govuk-pay/amazon-cloudwatch-integration-url',
+        PAGER_DUTY_CLOUDWATCH_INTEGRATION_URL_STAGING: 'pager-duty/govuk-pay-staging-smoke-tests/amazon-cloudwatch-integration-url'
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/deploy-tooling.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_TOOLING_CONFIG = void 0;
+exports.DEPLOY_TOOLING_CONFIG = {
+    'pact-broker': {
+        master_db_user: 'aws/rds/superuser/deploy-tooling/pact-broker/username',
+        master_db_password: 'aws/rds/superuser/deploy-tooling/pact-broker/password', // pragma: allowlist secret
+        DB_PASSWORD: 'aws/rds/application_users/deploy/pact_broker', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/deploy/pact_broker_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/deploy/pact_broker_support_readwrite' // pragma: allowlist secret
+    },
+    stubs: {
+        'smartpay-expected-password': 'pay-stubs/smartpay/expected-password', // pragma: allowlist secret
+        'smartpay-expected-user': 'pay-stubs/smartpay/expected-user',
+        'worldpay-expected-password': 'pay-stubs/worldpay/expected-password', // pragma: allowlist secret
+        'worldpay-expected-user': 'pay-stubs/worldpay/expected-user'
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/deploy.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_CONFIG = void 0;
+exports.DEPLOY_CONFIG = {
+    worldpay_secure_file_gateway: {
+        'private-key': 'worldpay/secure_file_gateway/worldpay_secure_file_gateway.rsa',
+        'public-key': 'worldpay/secure_file_gateway/worldpay_secure_file_gateway.rsa.pub',
+        passphrase: 'worldpay/secure_file_gateway/passphrase'
+    },
+    alb_and_s3_logging_pipeline: {
+        firehose_hec_token: 'splunk/firehose-hec-token'
+    },
+    'amazon-managed-prometheus': {
+        pager_duty_cloudwatch_integration_url_in_hours_only: 'pager-duty/govuk-pay-in-hours-only/amazon-cloudwatch-integration-url',
+        pager_duty_cloudwatch_integration_url_24_7_p1: 'pager-duty/govuk-pay/amazon-cloudwatch-integration-url'
+    },
+    'cd-pay-deploy': {
+        'docker-email': 'dockerhub/concourse-email',
+        'docker-username': 'dockerhub/concourse-username',
+        'docker-password': 'dockerhub/concourse-password', // pragma: allowlist secret
+        'docker-access-token': 'dockerhub/concourse-access-token',
+        'end-to-end/docker-email': 'dockerhub/concourse-email',
+        'end-to-end/docker-password': 'dockerhub/concourse-password', // pragma: allowlist secret
+        'end-to-end/docker-username': 'dockerhub/concourse-username',
+        'end-to-end/docker-access-token': 'dockerhub/concourse-access-token',
+        'github-access-token': 'alphagov-pay-ci-concourse/github.com-concourse-github-personal-access-token',
+        'grafana-annotations-password': 'concourse/grafana_annotations', // pragma: allowlist secret
+        'pact-broker-password': 'pact/pact_broker_password', // pragma: allowlist secret
+        'pact-broker-username': 'pact/pact_broker_username',
+        'pact-broker/pact-broker-password': 'pact/pact_broker_password', // pragma: allowlist secret
+        'pact-broker/pact-broker-username': 'pact/pact_broker_username',
+        'slack-notification-secret': 'slack/notification-secret', // pragma: allowlist secret
+        'internal-vulnerability-scan/jira-api-username': 'jira/concourse-ci/username',
+        'internal-vulnerability-scan/jira-api-token': 'jira/concourse-ci/internal-vulnerability-scan/api-token'
+    },
+    'cd-pay-dev': {
+        'docker-email': 'dockerhub/concourse-email',
+        'docker-username': 'dockerhub/concourse-username',
+        'docker-password': 'dockerhub/concourse-password', // pragma: allowlist secret
+        'docker-access-token': 'dockerhub/concourse-access-token',
+        'github-access-token': 'alphagov-pay-ci-concourse/github.com-concourse-github-personal-access-token',
+        'grafana-annotations-password': 'concourse/grafana_annotations', // pragma: allowlist secret
+        'pact-broker-password': 'pact/pact_broker_password', // pragma: allowlist secret
+        'pact-broker-username': 'pact/pact_broker_username',
+        'pay-js-commons/github-access-token': 'alphagov-pay-ci-concourse/github.com-concourse-github-personal-access-token',
+        'pr-ci/github-access-token': 'alphagov-pay-ci-concourse/github.com-concourse-github-personal-access-token',
+        'slack-notification-secret': 'slack/notification-secret', // pragma: allowlist secret
+        'smartpay-expected-password': 'pay-stubs/smartpay/expected-password', // pragma: allowlist secret
+        'smartpay-expected-user': 'pay-stubs/smartpay/expected-user',
+        'worldpay-expected-password': 'pay-stubs/worldpay/expected-password', // pragma: allowlist secret
+        'worldpay-expected-user': 'pay-stubs/worldpay/expected-user'
+    },
+    'cd-main': {
+        'docker-email': 'dockerhub/concourse-email',
+        'docker-username': 'dockerhub/concourse-username',
+        'docker-password': 'dockerhub/concourse-password', // pragma: allowlist secret
+        'docker-access-token': 'dockerhub/concourse-access-token',
+        'slack-notification-secret': 'slack/notification-secret' // pragma: allowlist secret
+    },
+    'pact-broker-auth': {
+        'pact-broker-basic-auth-password': 'pact/pact_broker_password', // pragma: allowlist secret
+        'pact-broker-basic-auth-username': 'pact/pact_broker_username'
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/dev.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEV_CONFIG = void 0;
+exports.DEV_CONFIG = {
+    alb_and_s3_logging_pipeline: {
+        firehose_hec_token: 'splunk/firehose-hec-token'
+    },
+    codebuild: {
+        'docker-username': 'dockerhub/concourse-username',
+        'docker-access-token': 'dockerhub/concourse-access-token',
+        'github-access-token': 'alphagov-pay-ci-concourse/github.com-concourse-github-personal-access-token'
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/production-2.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRODUCTION_2_CONFIG = void 0;
+exports.PRODUCTION_2_CONFIG = {
+    adminusers: {
+        DB_PASSWORD: 'aws/rds/application_users/production/adminusers1', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/production/adminusers_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/production/adminusers_support_readwrite', // pragma: allowlist secret
+        NOTIFY_API_KEY: 'notify/api_key/deploy/production.adminusers.notify_api_key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/adminusers_dsn'
+    },
+    cardid: {
+        SENTRY_DSN: 'sentry_io/cardid_dsn'
+    },
+    connector: {
+        DB_PASSWORD: 'aws/rds/application_users/production/connector2', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/production/connector_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/production/connector_support_readwrite', // pragma: allowlist secret
+        NOTIFY_API_KEY: 'notify/api_key/deploy/production.connector.notify_api_key', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_AUTH_TOKEN: 'stripe/production/test/account-api-key',
+        GDS_CONNECTOR_STRIPE_AUTH_LIVE_TOKEN: 'stripe/production/live/account-api-key',
+        GDS_CONNECTOR_STRIPE_WEBHOOK_SIGN_SECRET: 'stripe/production/test/webhook-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_WEBHOOK_LIVE_SIGN_SECRET: 'stripe/production/live/webhook-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_CONNECT_APPLICATION_WEBHOOK_LIVE_SIGN_SECRET: 'stripe/production/live/webhook-connect-events-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_CONNECT_APPLICATION_WEBHOOK_TEST_SIGN_SECRET: 'stripe/production/test/webhook-connect-events-secret', // pragma: allowlist secret
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE: 'apple_pay/worldpay/production/payment-processing-certificate-20230906',
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_PRIVATE_KEY: 'apple_pay/worldpay/production/payment-processing-private-key-20230906', // pragma: allowlist secret
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE_SECONDARY: 'apple_pay/worldpay/production/payment-processing-certificate-20230906',
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_PRIVATE_KEY_SECONDARY: 'apple_pay/worldpay/production/payment-processing-private-key-20230906', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/connector_dsn',
+        SANDBOX_AUTH_TOKEN: 'smoke-test-api-token/notifications/production_sandbox_auth_token'
+    },
+    frontend: {
+        WORLDPAY_APPLE_PAY_MERCHANT_ID: 'apple_pay/worldpay/production/merchant-id',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID_CERTIFICATE: 'apple_pay/worldpay/production/merchant-id-certificate-20240730',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID_CERTIFICATE_KEY: 'apple_pay/worldpay/production/merchant-id-certificate-key-20240730',
+        STRIPE_APPLE_PAY_MERCHANT_ID: 'apple_pay/stripe/production/merchant-id',
+        STRIPE_APPLE_PAY_MERCHANT_ID_CERTIFICATE: 'apple_pay/stripe/production/merchant-id-certificate-20240730',
+        STRIPE_APPLE_PAY_MERCHANT_ID_CERTIFICATE_KEY: 'apple_pay/stripe/production/merchant-id-certificate-key-20240730',
+        STRIPE_TEST_PUBLISHABLE_API_KEY: 'stripe/production/test/publishable-api-key', // pragma: allowlist secret
+        STRIPE_LIVE_PUBLISHABLE_API_KEY: 'stripe/production/live/publishable-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/frontend_dsn',
+        SENTRY_CSP_REPORT_URI: 'sentry/frontend_csp_report_uri',
+        GOOGLE_PAY_MERCHANT_ID: 'google_pay/merchant_identifier',
+        GOOGLE_PAY_MERCHANT_ID_2: 'google_pay/merchant_identifier_2'
+    },
+    ledger: {
+        DB_PASSWORD: 'aws/rds/application_users/production/ledger', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/production/ledger_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/production/ledger_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/ledger_dsn'
+    },
+    network: {
+        PAGER_DUTY_CLOUDWATCH_ALB_INTEGRATION_URL: 'pager-duty/govuk-pay-cloudwatch-alb/amazon-cloudwatch-integration-url'
+    },
+    'product-page': {
+        pager_duty_cloudwatch_integration_url: 'pager-duty/govuk-pay-product-page/amazon-cloudwatch-integration-url'
+    },
+    products: {
+        DB_PASSWORD: 'aws/rds/application_users/production/products', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/production/products_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/production/products_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/products_dsn'
+    },
+    'products-ui': {
+        SENTRY_DSN: 'sentry_io/products_ui_dsn',
+        GOOGLE_RECAPTCHA_SECRET_KEY: 'google/production/captcha-secret-key', // pragma: allowlist secret
+        GOOGLE_RECAPTCHA_SITE_KEY: 'google/production/captcha-site-key',
+        GOOGLE_RECAPTCHA_ENTERPRISE_PROJECT_ID: 'google/production/captcha-enterprise-project-id'
+    },
+    publicapi: {
+        SENTRY_DSN: 'sentry_io/publicapi_dsn'
+    },
+    publicauth: {
+        DB_PASSWORD: 'aws/rds/application_users/production/publicauth', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/production/publicauth_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/production/publicauth_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/publicauth_dsn'
+    },
+    selfservice: {
+        ZENDESK_API_KEY: 'zendesk/api_key', // pragma: allowlist secret
+        ZENDESK_USER: 'zendesk/user',
+        STRIPE_ACCOUNT_API_KEY: 'stripe/production/live/account-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/selfservice_dsn'
+    },
+    toolbox: {
+        AUTH_GITHUB_CLIENT_ID: 'pay-toolbox/production/github_client_id',
+        AUTH_GITHUB_CLIENT_SECRET: 'pay-toolbox/production/github_client_secret', // pragma: allowlist secret
+        STRIPE_ACCOUNT_API_KEY: 'stripe/production/live/account-api-key', // pragma: allowlist secret
+        STRIPE_ACCOUNT_TEST_API_KEY: 'stripe/production/test/account-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/toolbox_dsn',
+        ZENDESK_API_KEY: 'zendesk/api_key', // pragma: allowlist secret
+        ZENDESK_USER: 'zendesk/user'
+    },
+    webhooks: {
+        DB_PASSWORD: 'aws/rds/application_users/production/webhooks', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/production/webhooks_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/production/webhooks_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/webhooks_dsn'
+    },
+    webhooks_intrusion_monitoring: {
+        pager_duty_cloudwatch_integration_url: 'pager-duty/govuk-pay/amazon-cloudwatch-integration-url'
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/production.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRODUCTION_CONFIG = void 0;
+exports.PRODUCTION_CONFIG = {
+    alb_and_s3_logging_pipeline: {
+        firehose_hec_token: 'splunk/firehose-hec-token'
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/staging-2.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STAGING_2_CONFIG = void 0;
+exports.STAGING_2_CONFIG = {
+    adminusers: {
+        DB_PASSWORD: 'aws/rds/application_users/staging/adminusers1', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/staging/adminusers_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/staging/adminusers_support_readwrite', // pragma: allowlist secret
+        NOTIFY_API_KEY: 'notify/api_key/deploy/staging.adminusers.notify_api_key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/adminusers_dsn'
+    },
+    cardid: {
+        SENTRY_DSN: 'sentry_io/cardid_dsn'
+    },
+    connector: {
+        DB_PASSWORD: 'aws/rds/application_users/staging/connector1', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/staging/connector_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/staging/connector_support_readwrite', // pragma: allowlist secret
+        NOTIFY_API_KEY: 'notify/api_key/deploy/staging.connector.notify_api_key', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_AUTH_TOKEN: 'stripe/staging/test/account-api-key',
+        GDS_CONNECTOR_STRIPE_AUTH_LIVE_TOKEN: 'stripe/staging/test/account-api-key',
+        GDS_CONNECTOR_STRIPE_WEBHOOK_SIGN_SECRET: 'stripe/staging/test/webhook-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_WEBHOOK_LIVE_SIGN_SECRET: 'stripe/staging/test/webhook-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_CONNECT_APPLICATION_WEBHOOK_LIVE_SIGN_SECRET: 'stripe/staging/test/webhook-connect-events-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_CONNECT_APPLICATION_WEBHOOK_TEST_SIGN_SECRET: 'stripe/staging/test/webhook-connect-events-secret', // pragma: allowlist secret
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE: 'apple_pay/worldpay/test/payment-processing-certificate-20230906',
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_PRIVATE_KEY: 'apple_pay/worldpay/test/payment-processing-private-key-20230906', // pragma: allowlist secret
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE_SECONDARY: 'apple_pay/worldpay/test/payment-processing-certificate-20230906',
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_PRIVATE_KEY_SECONDARY: 'apple_pay/worldpay/test/payment-processing-private-key-20230906', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/connector_dsn',
+        SANDBOX_AUTH_TOKEN: 'smoke-test-api-token/notifications/staging_sandbox_auth_token'
+    },
+    frontend: {
+        WORLDPAY_APPLE_PAY_MERCHANT_ID: 'apple_pay/worldpay/test/merchant-id',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID_CERTIFICATE: 'apple_pay/worldpay/test/merchant-id-certificate-20230905',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID_CERTIFICATE_KEY: 'apple_pay/worldpay/test/merchant-id-certificate-key-20230905',
+        STRIPE_APPLE_PAY_MERCHANT_ID: 'apple_pay/stripe/staging/merchant-id',
+        STRIPE_APPLE_PAY_MERCHANT_ID_CERTIFICATE: 'apple_pay/stripe/staging/merchant-id-certificate-20230823',
+        STRIPE_APPLE_PAY_MERCHANT_ID_CERTIFICATE_KEY: 'apple_pay/stripe/staging/merchant-id-certificate-key-20230823',
+        STRIPE_TEST_PUBLISHABLE_API_KEY: 'stripe/staging/test/publishable-api-key', // pragma: allowlist secret
+        STRIPE_LIVE_PUBLISHABLE_API_KEY: 'stripe/staging/test/publishable-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/frontend_dsn',
+        SENTRY_CSP_REPORT_URI: 'sentry/frontend_csp_report_uri'
+    },
+    ledger: {
+        DB_PASSWORD: 'aws/rds/application_users/staging/ledger', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/staging/ledger_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/staging/ledger_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/ledger_dsn'
+    },
+    products: {
+        DB_PASSWORD: 'aws/rds/application_users/staging/products', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/staging/products_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/staging/products_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/products_dsn'
+    },
+    'products-ui': {
+        SENTRY_DSN: 'sentry_io/products_ui_dsn',
+        GOOGLE_RECAPTCHA_SECRET_KEY: 'google/test/captcha-secret-key', // pragma: allowlist secret
+        GOOGLE_RECAPTCHA_SITE_KEY: 'google/test/captcha-site-key'
+    },
+    publicapi: {
+        SENTRY_DSN: 'sentry_io/publicapi_dsn'
+    },
+    publicauth: {
+        DB_PASSWORD: 'aws/rds/application_users/staging/publicauth', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/staging/publicauth_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/staging/publicauth_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/publicauth_dsn'
+    },
+    'product-page': {
+        pager_duty_cloudwatch_integration_url: 'pager-duty/govuk-pay-product-page/amazon-cloudwatch-integration-url'
+    },
+    selfservice: {
+        ZENDESK_API_KEY: 'zendesk/api_key', // pragma: allowlist secret
+        ZENDESK_USER: 'zendesk/user',
+        STRIPE_ACCOUNT_API_KEY: 'stripe/staging/test/account-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/selfservice_dsn'
+    },
+    toolbox: {
+        AUTH_GITHUB_CLIENT_ID: 'pay-toolbox/staging/github_client_id',
+        AUTH_GITHUB_CLIENT_SECRET: 'pay-toolbox/staging/github_client_secret', // pragma: allowlist secret
+        STRIPE_ACCOUNT_API_KEY: 'stripe/staging/test/account-api-key', // pragma: allowlist secret
+        STRIPE_ACCOUNT_TEST_API_KEY: 'stripe/staging/test/account-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/toolbox_dsn',
+        ZENDESK_API_KEY: 'zendesk/api_key', // pragma: allowlist secret
+        ZENDESK_USER: 'zendesk/user'
+    },
+    webhooks: {
+        DB_PASSWORD: 'aws/rds/application_users/staging/webhooks', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/staging/webhooks_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/staging/webhooks_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/webhooks_dsn'
+    },
+    webhooks_intrusion_monitoring: {
+        pager_duty_cloudwatch_integration_url: 'pager-duty/govuk-pay-staging-webhooks/amazon-cloudwatch-integration-url'
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/staging.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STAGING_CONFIG = void 0;
+exports.STAGING_CONFIG = {
+    alb_and_s3_logging_pipeline: {
+        firehose_hec_token: 'splunk/firehose-hec-token'
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/test-12.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_12_CONFIG = void 0;
+exports.TEST_12_CONFIG = {
+    adminusers: {
+        DB_PASSWORD: 'aws/rds/application_users/test/adminusers1', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test/adminusers_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test/adminusers_support_readwrite', // pragma: allowlist secret
+        NOTIFY_API_KEY: 'notify/api_key/ci/test.adminusers.notify_api_key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/adminusers_dsn'
+    },
+    cardid: {
+        SENTRY_DSN: 'sentry_io/cardid_dsn'
+    },
+    connector: {
+        DB_PASSWORD: 'aws/rds/application_users/test/connector2', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test/connector_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test/connector_support_readwrite', // pragma: allowlist secret
+        NOTIFY_API_KEY: 'notify/api_key/ci/test.connector.notify_api_key', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_AUTH_TOKEN: 'stripe/test/test/account-api-key',
+        GDS_CONNECTOR_STRIPE_AUTH_LIVE_TOKEN: 'stripe/test/test/account-api-key',
+        GDS_CONNECTOR_STRIPE_WEBHOOK_SIGN_SECRET: 'stripe/test/test/webhook-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_WEBHOOK_LIVE_SIGN_SECRET: 'stripe/test/test/webhook-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_CONNECT_APPLICATION_WEBHOOK_LIVE_SIGN_SECRET: 'stripe/test/test/webhook-connect-events-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_CONNECT_APPLICATION_WEBHOOK_TEST_SIGN_SECRET: 'stripe/test/test/webhook-connect-events-secret', // pragma: allowlist secret
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE: 'apple_pay/worldpay/test/payment-processing-certificate-20230906',
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_PRIVATE_KEY: 'apple_pay/worldpay/test/payment-processing-private-key-20230906', // pragma: allowlist secret
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE_SECONDARY: 'apple_pay/worldpay/test/payment-processing-certificate-20230906',
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_PRIVATE_KEY_SECONDARY: 'apple_pay/worldpay/test/payment-processing-private-key-20230906', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/connector_dsn',
+        SANDBOX_AUTH_TOKEN: 'smoke-test-api-token/notifications/test_sandbox_auth_token'
+    },
+    frontend: {
+        SESSION_ENCRYPTION_KEY: '',
+        SESSION_ENCRYPTION_KEY_2: '',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID: 'apple_pay/worldpay/test/merchant-id',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID_CERTIFICATE: 'apple_pay/worldpay/test/merchant-id-certificate-20240730',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID_CERTIFICATE_KEY: 'apple_pay/worldpay/test/merchant-id-certificate-key-20240730',
+        STRIPE_APPLE_PAY_MERCHANT_ID: 'apple_pay/stripe/test/merchant-id',
+        STRIPE_APPLE_PAY_MERCHANT_ID_CERTIFICATE: 'apple_pay/stripe/test/merchant-id-certificate-20240730',
+        STRIPE_APPLE_PAY_MERCHANT_ID_CERTIFICATE_KEY: 'apple_pay/stripe/test/merchant-id-certificate-key-20240730',
+        STRIPE_TEST_PUBLISHABLE_API_KEY: 'stripe/test/test/publishable-api-key', // pragma: allowlist secret
+        STRIPE_LIVE_PUBLISHABLE_API_KEY: 'stripe/test/test/publishable-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/frontend_dsn',
+        SENTRY_CSP_REPORT_URI: 'sentry/frontend_csp_report_uri'
+    },
+    ledger: {
+        DB_PASSWORD: 'aws/rds/application_users/test/ledger', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test/ledger_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test/ledger_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/ledger_dsn'
+    },
+    webhooks: {
+        DB_PASSWORD: 'aws/rds/application_users/test/webhooks', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test/webhooks_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test/webhooks_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/webhooks_dsn'
+    },
+    'product-page': {
+        pager_duty_cloudwatch_integration_url: 'pager-duty/govuk-pay-product-page/amazon-cloudwatch-integration-url'
+    },
+    publicapi: {
+        SENTRY_DSN: 'sentry_io/publicapi_dsn'
+    },
+    publicauth: {
+        DB_USER: '',
+        DB_PASSWORD: '',
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test/publicauth_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test/publicauth_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/publicauth_dsn'
+    },
+    products: {
+        DB_USER: '',
+        DB_PASSWORD: '',
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test/products_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test/products_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/products_dsn'
+    },
+    'products-ui': {
+        SESSION_ENCRYPTION_KEY: '',
+        SENTRY_DSN: 'sentry_io/products_ui_dsn',
+        GOOGLE_RECAPTCHA_SECRET_KEY: 'google/test/captcha-secret-key', // pragma: allowlist secret
+        GOOGLE_RECAPTCHA_SITE_KEY: 'google/test/captcha-site-key'
+    },
+    selfservice: {
+        SESSION_ENCRYPTION_KEY: '',
+        ZENDESK_API_KEY: 'zendesk/api_key', // pragma: allowlist secret
+        ZENDESK_USER: 'zendesk/user',
+        STRIPE_ACCOUNT_API_KEY: 'stripe/test/test/account-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/selfservice_dsn'
+    },
+    toolbox: {
+        AUTH_GITHUB_CLIENT_ID: 'pay-toolbox/test/github_client_id',
+        AUTH_GITHUB_CLIENT_SECRET: 'pay-toolbox/test/github_client_secret', // pragma: allowlist secret
+        STRIPE_ACCOUNT_API_KEY: 'stripe/test/test/account-api-key', // pragma: allowlist secret
+        STRIPE_ACCOUNT_TEST_API_KEY: 'stripe/test/test/account-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/toolbox_dsn',
+        ZENDESK_USER: 'zendesk/user',
+        ZENDESK_API_KEY: 'zendesk/api_key' // pragma: allowlist secret
+    }
+};

package/src/commands/secrets/config/secrets/pay_low_pass/test-perf-1.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_PERF_1_CONFIG = void 0;
+exports.TEST_PERF_1_CONFIG = {
+    adminusers: {
+        DB_PASSWORD: 'aws/rds/application_users/test/adminusers', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test-perf/adminusers_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test-perf/adminusers_support_readwrite', // pragma: allowlist secret
+        NOTIFY_API_KEY: 'notify/api_key/ci/test_perf.adminusers.notify_api_key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/adminusers_dsn'
+    },
+    cardid: {
+        SENTRY_DSN: 'sentry_io/cardid_dsn'
+    },
+    connector: {
+        DB_PASSWORD: 'aws/rds/superuser/test-12/connector/payment-password', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test-perf/connector_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test-perf/connector_support_readwrite', // pragma: allowlist secret
+        NOTIFY_API_KEY: 'notify/api_key/ci/test_perf.connector.notify_api_key', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_AUTH_TOKEN: 'stripe/test/test/account-api-key',
+        GDS_CONNECTOR_STRIPE_AUTH_LIVE_TOKEN: 'stripe/test/test/account-api-key',
+        GDS_CONNECTOR_STRIPE_WEBHOOK_SIGN_SECRET: 'stripe/test/test/webhook-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_WEBHOOK_LIVE_SIGN_SECRET: 'stripe/test/test/webhook-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_CONNECT_APPLICATION_WEBHOOK_LIVE_SIGN_SECRET: 'stripe/test/test/webhook-connect-events-secret', // pragma: allowlist secret
+        GDS_CONNECTOR_STRIPE_CONNECT_APPLICATION_WEBHOOK_TEST_SIGN_SECRET: 'stripe/test/test/webhook-connect-events-secret', // pragma: allowlist secret
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE: 'apple_pay/worldpay/test/payment-processing-certificate-20230906',
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_PRIVATE_KEY: 'apple_pay/worldpay/test/payment-processing-private-key-20230906', // pragma: allowlist secret
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_CERTIFICATE_SECONDARY: 'apple_pay/worldpay/test/payment-processing-certificate-20230906',
+        WORLDPAY_APPLE_PAY_PAYMENT_PROCESSING_PRIVATE_KEY_SECONDARY: 'apple_pay/worldpay/test/payment-processing-private-key-20230906', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/connector_dsn',
+        SANDBOX_AUTH_TOKEN: 'smoke-test-api-token/notifications/test_sandbox_auth_token'
+    },
+    frontend: {
+        SESSION_ENCRYPTION_KEY: '',
+        SESSION_ENCRYPTION_KEY_2: '',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID: 'apple_pay/worldpay/test/merchant-id',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID_CERTIFICATE: 'apple_pay/worldpay/test/merchant-id-certificate-20240730',
+        WORLDPAY_APPLE_PAY_MERCHANT_ID_CERTIFICATE_KEY: 'apple_pay/worldpay/test/merchant-id-certificate-key-20240730',
+        STRIPE_APPLE_PAY_MERCHANT_ID: 'apple_pay/stripe/test/merchant-id',
+        STRIPE_APPLE_PAY_MERCHANT_ID_CERTIFICATE: 'apple_pay/stripe/test/merchant-id-certificate-20240730',
+        STRIPE_APPLE_PAY_MERCHANT_ID_CERTIFICATE_KEY: 'apple_pay/stripe/test/merchant-id-certificate-key-20240730', // pragma: allowlist secret
+        STRIPE_TEST_PUBLISHABLE_API_KEY: 'stripe/test/test/publishable-api-key', // pragma: allowlist secret
+        STRIPE_LIVE_PUBLISHABLE_API_KEY: 'stripe/test/test/publishable-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/frontend_dsn', // pragma: allowlist secret
+        SENTRY_CSP_REPORT_URI: 'sentry/frontend_csp_report_uri'
+    },
+    ledger: {
+        DB_PASSWORD: 'aws/rds/application_users/test/ledger', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test-perf/ledger_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test-perf/ledger_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/ledger_dsn'
+    },
+    publicapi: {
+        SENTRY_DSN: 'sentry_io/publicapi_dsn'
+    },
+    publicauth: {
+        DB_USER: '',
+        DB_PASSWORD: '',
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test-perf/publicauth_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test-perf/publicauth_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/publicauth_dsn'
+    },
+    products: {
+        DB_USER: '',
+        DB_PASSWORD: '',
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test-perf/products_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test-perf/products_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/products_dsn'
+    },
+    'products-ui': {
+        SESSION_ENCRYPTION_KEY: '',
+        SENTRY_DSN: 'sentry_io/products_ui_dsn',
+        GOOGLE_RECAPTCHA_SECRET_KEY: 'google/test/captcha-secret-key', // pragma: allowlist secret
+        GOOGLE_RECAPTCHA_SITE_KEY: 'google/test/captcha-site-key'
+    },
+    selfservice: {
+        SESSION_ENCRYPTION_KEY: '',
+        ZENDESK_API_KEY: 'zendesk/api_key', // pragma: allowlist secret
+        ZENDESK_USER: 'zendesk/user',
+        STRIPE_ACCOUNT_API_KEY: 'stripe/test/test/account-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/selfservice_dsn'
+    },
+    toolbox: {
+        AUTH_GITHUB_CLIENT_ID: 'pay-toolbox/test/github_client_id',
+        AUTH_GITHUB_CLIENT_SECRET: 'pay-toolbox/test/github_client_secret', // pragma: allowlist secret
+        STRIPE_ACCOUNT_API_KEY: 'stripe/test/test/account-api-key', // pragma: allowlist secret
+        STRIPE_ACCOUNT_TEST_API_KEY: 'stripe/test/test/account-api-key', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry/toolbox_dsn',
+        ZENDESK_API_KEY: 'zendesk/api_key', // pragma: allowlist secret
+        ZENDESK_USER: 'zendesk/user'
+    },
+    webhooks: {
+        DB_PASSWORD: 'aws/rds/application_users/test/webhooks', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READONLY: 'aws/rds/support_readonly_users/test-perf/webhooks_support_readonly', // pragma: allowlist secret
+        DB_SUPPORT_PASSWORD_READWRITE: 'aws/rds/support_readwrite_users/test-perf/webhooks_support_readwrite', // pragma: allowlist secret
+        SENTRY_DSN: 'sentry_io/webhooks_dsn'
+    }
+};