@hmcts/media-viewer 4.2.0 → 4.2.4-exui-3994-f

package/api/security/idam-client.ts

@@ -0,0 +1,100 @@
+import Axios, { AxiosInstance } from 'axios';
+import { URLSearchParams } from 'url';
+import { logger } from '../logger';
+import { config } from '../config';
+
+const email = 'abb@b.com';
+const forename = 'EM';
+const surname = 'showcase';
+
+/**
+ * IDAM client that creates a user then gets a token
+ */
+export class IdamClient {
+
+  private readonly http: AxiosInstance;
+  private readonly client: string;
+  private readonly secret: string;
+  private readonly redirect: string;
+  private readonly password: string;
+
+  constructor() {
+    console.log('this is the idam key', config.idam.secret);
+    console.log('this is the idam URL', config.idam.url);
+    this.http = Axios.create({
+      baseURL: config.idam.url
+    });
+    this.client = config.idam.client;
+    this.secret = config.idam.secret;
+    this.redirect = config.idam.redirect;
+    this.password = config.idam.password;
+  }
+
+  /**
+   * Create a user then generate a token for it
+   */
+  public async getToken(): Promise<string> {
+
+    let token = await this.getIdamTokenInIthc();
+    if (token) {
+      return `Bearer ${token}`;
+    }
+    await this.createUser();
+    token = await this.getIdamToken();
+    return `Bearer ${token}`;
+  }
+
+  private async createUser() {
+    try {
+      await this.http.post('/testing-support/accounts', { email, password: this.password, forename, surname, roles: [{ code: 'caseworker-hrs' }] });
+    } catch (err: any) {
+      logger.warn('could not create the user, possibly because the user already exists ', err.message);
+      logger.debug('\n', err.stack);
+    }
+  }
+
+  private async getIdamToken(): Promise<string> {
+    const headers = {
+      'Content-Type': 'application/x-www-form-urlencoded'
+    };
+
+    const params = new URLSearchParams();
+    params.append('scope', 'openid roles profile');
+    params.append('grant_type', 'password');
+    params.append('redirect_uri', this.redirect);
+    params.append('client_id', this.client);
+    params.append('client_secret', this.secret);
+    params.append('username', email);
+    params.append('password', this.password);
+    console.log('these are the params', params);
+    try {
+      const response = await this.http.post('/o/token', params, { headers });
+      return response.data['access_token'];
+    } catch (err: any) {
+      logger.error('Error getting idam token', err.message);
+      throw err;
+    }
+  }
+
+  private async getIdamTokenInIthc(): Promise<string | undefined> {
+    const headers = {
+      'Content-Type': 'application/x-www-form-urlencoded'
+    };
+
+    const params = new URLSearchParams();
+    params.append('scope', 'openid roles profile');
+    params.append('grant_type', 'password');
+    params.append('redirect_uri', this.redirect);
+    params.append('client_id', this.client);
+    params.append('client_secret', this.secret);
+    params.append('username', 'ithctestuser@hmcts.net');
+    params.append('password', 'Password123!');
+    try {
+      const response = await this.http.post('/o/token', params, { headers });
+      return response.data['access_token'];
+    } catch (err: any) {
+      logger.warn('Error getting ITHC idam token', err.message);
+      return undefined;
+    }
+  }
+}

package/api/security/service-auth-provider-client.ts

@@ -0,0 +1,46 @@
+import Axios, { AxiosInstance } from "axios";
+import * as otp from "otp";
+import { config } from "../config";
+import { logger } from "../logger";
+
+/**
+ * Client for the service auth provider API that fetches an S2S token
+ */
+export class ServiceAuthProviderClient {
+
+    private readonly http: AxiosInstance;
+    private readonly microservice: string;
+    private readonly secret: string;
+
+    constructor() {
+        console.log("this is the s2s key", config.s2s.secret);
+        console.log("this is the s2s URL", config.s2s.url);
+        this.http = Axios.create({
+            baseURL: config.s2s.url,
+            headers: {
+                "Content-Type": "application/json"
+            }
+        });
+        this.microservice = config.s2s.microservice;
+        this.secret = config.s2s.secret;
+    }
+
+    /**
+     * Generate a one time password and fetch an S2S token
+     */
+    public async getToken(): Promise<string> {
+        const body = {
+            microservice: this.microservice,
+            oneTimePassword: otp({ secret: this.secret }).totp(),
+        };
+
+        try {
+            const response = await this.http.post("/lease", body);
+            return `Bearer ${response.data}`;
+        }
+        catch (err: any) {
+            logger.error("Error getting s2s token", err.message);
+            throw err;
+        }
+    }
+}

package/api/security/token-repository.ts

@@ -0,0 +1,50 @@
+import { logger } from "../logger";
+import Timeout = NodeJS.Timeout;
+
+/**
+ * Stateful repository that stores a token and refreshes it periodically
+ */
+export class TokenRepository {
+
+  private token: string = "";
+  private refreshHandler: Timeout | undefined;
+
+  constructor(
+    private readonly client: TokenClient,
+    private readonly tokenRefreshTime: number
+  ) {}
+
+  public async init(): Promise<void> {
+    await this.updateToken();
+    this.refreshHandler = setInterval(() => this.updateToken(), this.tokenRefreshTime);
+  }
+
+  /**
+   * Stop refreshing the token and clean up the interval
+   */
+  public destroy(): void {
+    if (this.refreshHandler) {
+      clearInterval(this.refreshHandler);
+    }
+  }
+
+  private async updateToken(): Promise<void> {
+    this.token = await this.client.getToken();
+
+    logger.log("Refreshed token");
+  } catch (err) {
+    logger.error("Failed to refresh token", err.message);
+  }
+
+  /**
+   * Return the current token
+   */
+  public getToken(): string {
+    return this.token;
+  }
+
+}
+
+export interface TokenClient {
+  getToken(): Promise<string>;
+}

package/api/server.ts

@@ -0,0 +1,95 @@
+import { logger } from './logger';
+import * as path from 'path';
+import * as nunjucks from 'nunjucks';
+import * as express from 'express';
+import { ClientRequest } from 'http';
+import { config } from './config';
+import { legacyCreateProxyMiddleware } from 'http-proxy-middleware';
+import { TokenRepository } from './security/token-repository';
+import { ServiceAuthProviderClient } from './security/service-auth-provider-client';
+import { IdamClient } from './security/idam-client';
+import { healthcheckRoutes } from './health';
+
+process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+
+const frontendRoot = path.join(__dirname, '..', 'demo-app');
+const app = express();
+
+app.use(express.static(frontendRoot));
+nunjucks.configure(frontendRoot, {
+    autoescape: true,
+    express: app
+});
+
+const serviceAuthRepository = new TokenRepository(new ServiceAuthProviderClient(), config.tokenRefreshTime);
+const idamRepository = new TokenRepository(new IdamClient(), config.tokenRefreshTime);
+
+Promise.all([serviceAuthRepository.init(), idamRepository.init()])
+    .then(() => {
+
+        logger.info('idamToken: ' + idamRepository.getToken());
+        logger.info('s2sToken: ' + serviceAuthRepository.getToken());
+
+        const addHeaders = (req: ClientRequest) => {
+            req.setHeader('Authorization', idamRepository.getToken());
+            req.setHeader('ServiceAuthorization', serviceAuthRepository.getToken());
+        };
+
+        const proxyOptions = {
+            onProxyReq: addHeaders,
+            secure: false,
+            changeOrigin: true
+        };
+
+        const assemblyProxy = config.proxies.assembly;
+        app.use(legacyCreateProxyMiddleware(assemblyProxy.endpoints, {
+            target: assemblyProxy.target,
+            pathRewrite: assemblyProxy.pathRewrite,
+            ...proxyOptions
+        }));
+
+        const annotationProxy = config.proxies.annotation;
+        app.use(legacyCreateProxyMiddleware(annotationProxy.endpoints, {
+            target: annotationProxy.target,
+            pathRewrite: annotationProxy.pathRewrite,
+            ...proxyOptions
+        }));
+
+        const dmStoreProxy = config.proxies.dmStore;
+        app.use(legacyCreateProxyMiddleware(dmStoreProxy.endpoints, {
+            target: dmStoreProxy.target,
+            onProxyReq: (req: ClientRequest) => {
+                req.setHeader('user-roles', 'caseworker');
+                req.setHeader('ServiceAuthorization', serviceAuthRepository.getToken());
+            },
+            secure: false,
+            changeOrigin: true
+        }));
+
+        const npaProxy = config.proxies.npa;
+        app.use(legacyCreateProxyMiddleware(npaProxy.endpoints, { target: npaProxy.target, ...proxyOptions }));
+
+        const icpProxy = config.proxies.icp;
+        app.use(legacyCreateProxyMiddleware(icpProxy.endpoints, {
+            target: icpProxy.target,
+            ...proxyOptions,
+            ws: true,
+            headers: { 'Authorization': idamRepository.getToken() }
+        }));
+
+        const hrsProxy = config.proxies.hrsApi;
+        app.use(legacyCreateProxyMiddleware(hrsProxy.endpoints, { target: hrsProxy.target, ...proxyOptions }));
+
+        app.use('/', healthcheckRoutes);
+        app.use('/dm-store', (req, res) => res.render('index.html'));
+        app.use('/', (req, res) => res.render('index.html'));
+
+        logger.info('Listening on port ' + config.port);
+
+        app.listen(config.port);
+
+    })
+    .catch(err => {
+        logger.error('Could not start em-showcase application >> ', err.message);
+        logger.error('\n', err.stack);
+    });

package/api/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "moduleResolution": "node",
+    "module": "commonjs",
+    "target": "es2017",
+    "sourceMap": false,
+    "experimentalDecorators": true,
+    "noImplicitAny": false,
+    "strict": true,
+    "declaration": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "lib": [
+      "es2017",
+      "dom"
+    ]
+  }
+}

package/audit.json

@@ -0,0 +1,178 @@
+{
+  "10020_Missing Anti-clickjacking Header_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET":"ignore",
+  "10020_Missing Anti-clickjacking Header_http://em-media-viewer-aat.service.core-compute-aat.internal_GET":"ignore",
+  "10020_Missing Anti-clickjacking Header_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET": "ignore",
+  "10020_Missing Anti-clickjacking Header_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/favicon.ico_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.96acd4d01af80abd.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.6d5f7063fb5a8c32.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.a401c5fc4b6193d2.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.e35dd9b56a21e867.css_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dcd4fb7b33048603.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.f88cc007c0700df3.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.8ba4f35154d017a2.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.0dcefbd05835f425.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.4d921e39b524c8d3.css_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.52154b7c19dda4f6.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.5b7187c59a43f2fc.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.6df62ec327ec9be3.css_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.9429ae27359822a5.css_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.4fab7ec1ce128df9.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.143ce593bb147bf3.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.ae769f5f7fb9a89c.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.6d8dffcd51641a9b.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.8d7bdc607a2695bb.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.2d533c67363d538f.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.7303cfcececa1519.css_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.49362d86ed181e29.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dfeaaef9803fce7f.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.0a5a45ce0b795698.css_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/main.93216e71f43061f7.js_GET": "ignore",
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.4761073bfa7193bb.js_GET": "ignore", 
+  "10021_X-Content-Type-Options Header Missing_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.0b251dc6113ca090.css_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.96acd4d01af80abd.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.6d5f7063fb5a8c32.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dcd4fb7b33048603.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.f88cc007c0700df3.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.8ba4f35154d017a2.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.52154b7c19dda4f6.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.5b7187c59a43f2fc.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.4fab7ec1ce128df9.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.143ce593bb147bf3.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.ae769f5f7fb9a89c.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.6d8dffcd51641a9b.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.8d7bdc607a2695bb.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.2d533c67363d538f.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.49362d86ed181e29.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dfeaaef9803fce7f.js_GET": "ignore",
+  "10027_Information Disclosure - Suspicious Comments_http://em-media-viewer-aat.service.core-compute-aat.internal/main.93216e71f43061f7.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/favicon.ico_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.96acd4d01af80abd.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.6d5f7063fb5a8c32.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.a401c5fc4b6193d2.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.e35dd9b56a21e867.css_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dcd4fb7b33048603.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.f88cc007c0700df3.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.8ba4f35154d017a2.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.0dcefbd05835f425.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.4d921e39b524c8d3.css_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.52154b7c19dda4f6.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.5b7187c59a43f2fc.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.6df62ec327ec9be3.css_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.4fab7ec1ce128df9.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.9429ae27359822a5.css_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.143ce593bb147bf3.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.6d8dffcd51641a9b.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.ae769f5f7fb9a89c.js_GET":"ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.2d533c67363d538f.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.7303cfcececa1519.css_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.49362d86ed181e29.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dfeaaef9803fce7f.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.0a5a45ce0b795698.css_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/main.93216e71f43061f7.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.4761073bfa7193bb.js_GET": "ignore",
+  "10037_Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.0b251dc6113ca090.css_GET": "ignore",
+  "10038_Content Security Policy (CSP) Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET":"ignore",
+  "10038_Content Security Policy (CSP) Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal_GET": "ignore",
+  "10038_Content Security Policy (CSP) Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET":"ignore",
+  "10038_Content Security Policy (CSP) Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET":"ignore",
+  "10049_Non-Storable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.96acd4d01af80abd.js_GET": "ignore",
+  "10049_Storable and Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET": "ignore",
+  "10049_Storable and Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/favicon.ico_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.96acd4d01af80abd.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.6d5f7063fb5a8c32.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.a401c5fc4b6193d2.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.e35dd9b56a21e867.css_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dcd4fb7b33048603.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.f88cc007c0700df3.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.8ba4f35154d017a2.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.0dcefbd05835f425.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.4d921e39b524c8d3.css_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.52154b7c19dda4f6.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.5b7187c59a43f2fc.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.6df62ec327ec9be3.css_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.4fab7ec1ce128df9.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.9429ae27359822a5.css_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.143ce593bb147bf3.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.ae769f5f7fb9a89c.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.6d8dffcd51641a9b.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.8d7bdc607a2695bb.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.2d533c67363d538f.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.7303cfcececa1519.css_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.49362d86ed181e29.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dfeaaef9803fce7f.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.0a5a45ce0b795698.css_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/main.93216e71f43061f7.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.4761073bfa7193bb.js_GET": "ignore",
+  "10049_Storable but Non-Cacheable Content_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.0b251dc6113ca090.css_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.96acd4d01af80abd.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.6d5f7063fb5a8c32.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.a401c5fc4b6193d2.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dcd4fb7b33048603.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.f88cc007c0700df3.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.8ba4f35154d017a2.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.0dcefbd05835f425.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.52154b7c19dda4f6.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.5b7187c59a43f2fc.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.4fab7ec1ce128df9.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.143ce593bb147bf3.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.6d8dffcd51641a9b.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.93216e71f43061f7.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.4761073bfa7193bb.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.ae769f5f7fb9a89c.js_GET":"ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.2d533c67363d538f.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.49362d86ed181e29.js_GET": "ignore",
+  "10063_Permissions Policy Header Not Set_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dfeaaef9803fce7f.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/favicon.ico_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.6d5f7063fb5a8c32.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.e35dd9b56a21e867.css_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.a401c5fc4b6193d2.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.4d921e39b524c8d3.css_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/polyfills.8ba4f35154d017a2.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.0dcefbd05835f425.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/styles.6df62ec327ec9be3.css_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.5b7187c59a43f2fc.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.4fab7ec1ce128df9.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.143ce593bb147bf3.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.ae769f5f7fb9a89c.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.6d8dffcd51641a9b.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.8d7bdc607a2695bb.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.2d533c67363d538f.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.49362d86ed181e29.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.dfeaaef9803fce7f.js_GET": "ignore",
+  "10096_Timestamp Disclosure - Unix_http://em-media-viewer-aat.service.core-compute-aat.internal/main.93216e71f43061f7.js_GET": "ignore",
+  "10104_User Agent Fuzzer_http://em-media-viewer-aat.service.core-compute-aat.internal/main.96acd4d01af80abd.js_GET": "ignore",
+  "10109_Modern Web Application_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET": "ignore",
+  "10109_Modern Web Application_http://em-media-viewer-aat.service.core-compute-aat.internal_GET": "ignore",
+  "10109_Modern Web Application_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET": "ignore",
+  "10109_Modern Web Application_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET": "ignore",
+  "40035_Hidden File Found_http://em-media-viewer-aat.service.core-compute-aat.internal/._darcs_GET": "ignore",
+  "40035_Hidden File Found_http://em-media-viewer-aat.service.core-compute-aat.internal/.bzr_GET": "ignore",
+  "40035_Hidden File Found_http://em-media-viewer-aat.service.core-compute-aat.internal/.hg_GET": "ignore",
+  "40035_Hidden File Found_http://em-media-viewer-aat.service.core-compute-aat.internal/BitKeeper_GET": "ignore",
+  "90004_Insufficient Site Isolation Against Spectre Vulnerability_http://em-media-viewer-aat.service.core-compute-aat.internal_GET":"ignore",
+  "90004_Insufficient Site Isolation Against Spectre Vulnerability_http://em-media-viewer-aat.service.core-compute-aat.internal/_GET":"ignore",
+  "90004_Insufficient Site Isolation Against Spectre Vulnerability_http://em-media-viewer-aat.service.core-compute-aat.internal/robots.txt_GET":"ignore",
+  "90004_Insufficient Site Isolation Against Spectre Vulnerability_http://em-media-viewer-aat.service.core-compute-aat.internal/sitemap.xml_GET":"ignore",
+  "90004_Insufficient Site Isolation Against Spectre Vulnerability_http://em-media-viewer-aat.service.core-compute-aat.internal/favicon.ico_GET": "ignore",
+  "90004_Insufficient Site Isolation Against Spectre Vulnerability_http://em-media-viewer-aat.service.core-compute-aat.internal/runtime.0dcefbd05835f425.js_GET":"ignore"
+}

package/catalog-info.yaml

@@ -0,0 +1,18 @@
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: "em-media-viewer"
+  annotations:
+    # This must match folder-name/job-name in Jenkins.
+    jenkins.io/job-full-name: cft:HMCTS_d_to_i/em-media-viewer
+    github.com/project-slug: hmcts/em-media-viewer
+  tags:
+    - nodejs
+  links:
+    - url: https://hmcts-reform.slack.com/app_redirect?channel=xui-pipeline
+      title: "#xui-pipeline on Slack"
+      icon: chat
+spec:
+  type: service
+  lifecycle: production
+  owner: dcd_em

package/charts/em-media-viewer/.helmignore

@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

package/charts/em-media-viewer/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+appVersion: "1.0"
+description: A Helm chart for EM Media Viewer Demo Application
+name: em-media-viewer
+home: https://github.com/hmcts/media-viewer
+version: 0.0.21
+dependencies:
+  - name: nodejs
+    version: 3.2.0
+    repository: 'oci://hmctspublic.azurecr.io/helm'

package/charts/em-media-viewer/templates/NOTES.txt

@@ -0,0 +1,8 @@
+Thank you for installing {{ .Chart.Name }}.
+
+Your release is named {{ .Release.Name }}.
+
+To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }}
+  $ helm get {{ .Release.Name }}

package/charts/em-media-viewer/values.aat.template.yaml

@@ -0,0 +1,4 @@
+nodejs:
+  # Don't modify below here
+  image: ${IMAGE_NAME}
+  ingressHost: ${SERVICE_FQDN}

package/charts/em-media-viewer/values.preview.template.yaml

@@ -0,0 +1,4 @@
+nodejs:
+  # Don't modify below here
+  image: ${IMAGE_NAME}
+  ingressHost: ${SERVICE_FQDN}

package/charts/em-media-viewer/values.yaml

@@ -0,0 +1,23 @@
+nodejs:
+  applicationPort: 1337
+  aadIdentityName: em
+  ingressHost: em-media-viewer-{{ .Values.global.environment }}.service.core-compute-{{ .Values.global.environment }}.internal
+  image: 'hmctspublic.azurecr.io/em/media-viewer:latest'
+  keyVaults:
+    em-showcase:
+      resourceGroup: em-showcase
+      secrets:
+        - microservicekey-em-gw
+        - show-oauth2-token
+        - password
+  environment:
+    REFORM_ENVIRONMENT: "{{ .Values.global.environment }}"
+    DOCASSEMBLY_URL: "http://dg-docassembly-{{ .Values.global.environment }}.service.core-compute-{{ .Values.global.environment }}.internal"
+    DM_STORE_APP_URL: "http://dm-store-{{ .Values.global.environment }}.service.core-compute-{{ .Values.global.environment }}.internal"
+    HRS_API_URL: "http://em-hrs-api-{{ .Values.global.environment }}.service.core-compute-{{ .Values.global.environment }}.internal"
+    ANNOTATION_API_URL: "http://em-anno-{{ .Values.global.environment }}.service.core-compute-{{ .Values.global.environment }}.internal"
+    ICP_API_URL: "https://em-icp-{{ .Values.global.environment }}.platform.hmcts.net"
+    IDAM_URL: "https://idam-api.{{ .Values.global.environment }}.platform.hmcts.net"
+    S2S_URL: "http://rpe-service-auth-provider-{{ .Values.global.environment }}.service.core-compute-{{ .Values.global.environment }}.internal"
+    NPA_URL: "http://em-npa-{{ .Values.global.environment }}.service.core-compute-{{ .Values.global.environment }}.internal"
+    REDIRECT_URL: "https://em-show-{{ .Values.global.environment }}.service.core-compute-{{ .Values.global.environment }}.internal/oauth2/callback"

package/config/dependency-check-suppressions.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress until="2024-04-01">
+       <notes><![CDATA[file name: lodash<4.17.11]]></notes>
+       <packageUrl regex="true">^pkg:npm/lodash@.*$</packageUrl>
+       <cve>CVE-2018-16487</cve>
+       <cve>CVE-2018-3721</cve>
+       <cve>CVE-2019-1010266</cve>
+       <cve>CVE-2019-10744</cve>
+    </suppress>
+    <suppress until="2024-04-01">
+       <notes><![CDATA[file name: lodash<4.17.21]]></notes>
+       <packageUrl regex="true">^pkg:npm/lodash@.*$</packageUrl>
+       <cve>CVE-2020-28500</cve>
+       <cve>CVE-2021-23337</cve>
+    </suppress>
+    <suppress until="2024-04-01">
+       <notes><![CDATA[file name: lodash<4.17.20]]></notes>
+       <packageUrl regex="true">^pkg:npm/lodash@.*$</packageUrl>
+       <cve>CVE-2020-8203</cve>
+    </suppress>
+    <suppress until="2024-04-01">
+       <notes><![CDATA[file name: xml2js:0.4.23]]></notes>
+       <packageUrl regex="true">^pkg:npm/xml2js@.*$</packageUrl>
+       <cve>CVE-2023-0842</cve>
+    </suppress>
+</suppressions>