@hmcts/media-viewer 4.2.34 → 4.2.37

package/README.md

@@ -122,6 +122,128 @@ Viewer and AAT-backed proxy configuration while keeping the browser at
 the opt-in external-service contracts for those live service probes. The lightweight
 route and health check remains available as `yarn smoke:local:aat`.
 
+### Test a local `em-icp-api` change
+
+The standalone app reaches ICP through its local API. Keep the other services on AAT,
+but override only `ICP_API_URL` in the ignored `.env` file:
+
+```
+ICP_API_URL=http://localhost:8080
+```
+
+Create an isolated worktree for the ICP branch under test. The example below uses
+PR #1546 and leaves the normal ICP checkout untouched:
+
+```
+cd ../em-icp-api
+git fetch origin pull/1546/head
+git worktree add --detach /private/tmp/em-icp-pr1546-validation FETCH_HEAD
+cd /private/tmp/em-icp-pr1546-validation
+yarn install --immutable
+docker compose -f docker-compose.yml up -d redis
+```
+
+Its `config/local-dev.yaml` is ignored by `em-icp-api`; create it and configure the
+AAT IdAM URL, local Redis and AAT Web PubSub client URL:
+
+```yaml
+idam:
+  url: https://idam-api.aat.platform.hmcts.net
+redis:
+  host: localhost
+  port: 6379
+  useTLS: "false"
+icp:
+  wsUrl: wss://em-icp-webpubsub.aat.platform.hmcts.net/client/hubs/localhub
+```
+
+Check that the active Azure identity can read the approved secret without printing its
+value:
+
+```
+az keyvault secret show \
+  --vault-name em-icp-aat \
+  --name em-icp-web-pubsub-primary-connection-string \
+  --query id -o tsv
+```
+
+Immediately before starting ICP, load the connection string into `NODE_CONFIG` only for
+that process. This command does not echo or write the secret to disk:
+
+```
+local_webpubsub_secret="$(az keyvault secret show \
+  --vault-name em-icp-aat \
+  --name em-icp-web-pubsub-primary-connection-string \
+  --query value -o tsv)"
+export NODE_CONFIG="$(LOCAL_WEBPUBSUB_SECRET="$local_webpubsub_secret" node -e 'console.log(JSON.stringify({secrets: {"em-icp": {"em-icp-web-pubsub-primary-connection-string": process.env.LOCAL_WEBPUBSUB_SECRET}}}))')"
+unset local_webpubsub_secret
+```
+
+For Web PubSub callback testing, make the following local-only edits in the ICP
+checkout before starting it. The API currently hard-codes the deployed `Hub`/`hub`
+names in three places, whereas the tunnel uses `localhub`; do not commit these edits
+with the change being tested:
+
+```
+app.ts: new WebPubSubServiceClient(primaryConnectionstring, "localhub")
+app.ts: new WebPubSubEventHandler("localhub", ...)
+api/routes/sessions.ts: new WebPubSubServiceClient(primaryConnectionstring, "localhub")
+```
+
+Then start ICP and check its health:
+
+```
+yarn start:local
+curl -fsS http://localhost:8080/health
+yarn test:unit
+```
+
+Then tunnel the AAT Web PubSub hub to the local ICP process in another terminal. Use
+the AAT Web PubSub endpoint and keep the upstream HTTP URL local:
+
+```
+npx --yes --package @azure/web-pubsub-tunnel-tool awps-tunnel run \
+  --hub localhub \
+  --endpoint https://em-icp-webpubsub-aat.webpubsub.azure.com \
+  --upstream http://localhost:8080 \
+  -s 1c4f0704-a29e-403d-b719-b90c34ef14c9 \
+  -g em-icp-aat
+```
+
+The tunnel needs an authenticated Azure identity that can read the AAT hub settings.
+If it reports `403` after resolving the subscription and resource group, obtain the
+required AAT Web PubSub access policy or RBAC permission; that is an Azure access
+blocker, not a local ICP or Media Viewer failure.
+
+Then start Media Viewer from its repository. Populate the ignored AAT `.env` if it
+does not already contain the approved AAT settings, then set the ICP override:
+
+```
+cd ../rpx-xui-media-viewer
+yarn env:populate:aat
+# In .env set:
+# ICP_API_URL=http://localhost:8080
+yarn start:aat
+```
+
+Open `http://localhost:3000/#/media-viewer`, then run the browser regression lane:
+
+```
+PLAYWRIGHT_REPORTERS=list yarn test:local:aat
+```
+
+This setup tests local ICP code with AAT authentication and Web PubSub; it does not
+recreate the complete retired `em-showcase` Docker stack. The validation run recorded
+19 passing ICP unit tests and 71 passing Media Viewer tests.
+
+Current ICP source warning: `api/routes/sessions.ts` logs the primary Web PubSub
+connection string. Do not make an authenticated `/icp/sessions/...` request with a
+real secret until that log statement is removed; this is a source-security blocker,
+not a Media Viewer setup failure.
+
+Stop the local processes with `Ctrl+C`, then clean up Redis from the ICP worktree with
+`docker compose -f docker-compose.yml down`.
+
 ### 5. Run Playwright tests
 Media Viewer is starting its Playwright migration with the same runner and
 reporting shape used in MC and MO, scaled to the current smoke coverage. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hmcts/media-viewer",
-  "version": "4.2.34",
+  "version": "4.2.37",
   "description": "Media Viewer",
   "keywords": [
     "Angular",
@@ -23,7 +23,7 @@
     "pdfjs-dist": "^4.10.38",
     "socket.io-client": "^4.8.0",
     "tslib": "^2.3.0",
-    "uuid": "^11.0.3"
+    "uuid": "^11.1.1"
   },
   "peerDependencies": {
     "@angular/animations": "^20.0.0",