set up basicauth config to protect staging site

app/__init__.py

@@ -19,6 +19,7 @@ from flask.globals import _lookup_req_object, _request_ctx_stack
 from flask_login import LoginManager, current_user
 from flask_wtf import CSRFProtect
 from flask_wtf.csrf import CSRFError
+from flask_basicauth import BasicAuth
 from gds_metrics import GDSMetrics
 from govuk_frontend_jinja.flask_ext import init_govuk_frontend
 from itsdangerous import BadSignature
@@ -134,7 +135,7 @@ from app.url_converters import (
 login_manager = LoginManager()
 csrf = CSRFProtect()
 metrics = GDSMetrics()
-
+basic_auth = BasicAuth()
 
 # The current service attached to the request stack.
 def _get_current_service():
@@ -220,6 +221,8 @@ def create_app(application):
     login_manager.login_message_category = 'default'
     login_manager.session_protection = None
     login_manager.anonymous_user = AnonymousUser
+    
+    basic_auth = BasicAuth(application)
 
     # make sure we handle unicode correctly
     redis_client.redis_store.decode_responses = True

app/config.py

@@ -10,7 +10,7 @@ if os.environ.get('VCAP_APPLICATION'):
 
 class Config(object):
     ADMIN_CLIENT_SECRET = os.environ.get('ADMIN_CLIENT_SECRET')
-    API_HOST_NAME = os.environ.get('API_HOST_NAME')
+    API_HOST_NAME = os.environ.get('API_HOST_NAME', 'https://notifications-api.app.cloud.gov')
     SECRET_KEY = os.environ.get('SECRET_KEY')
     DANGEROUS_SALT = os.environ.get('DANGEROUS_SALT')
     ZENDESK_API_KEY = os.environ.get('ZENDESK_API_KEY')
@@ -62,13 +62,17 @@ class Config(object):
     LOGO_UPLOAD_BUCKET_NAME = 'public-logos-local'
     MOU_BUCKET_NAME = 'local-mou'
     TRANSIENT_UPLOADED_LETTERS = 'local-transient-uploaded-letters'
-    ROUTE_SECRET_KEY_1 = os.environ.get('ROUTE_SECRET_KEY_1', '')
-    ROUTE_SECRET_KEY_2 = os.environ.get('ROUTE_SECRET_KEY_2', '')
+    ROUTE_SECRET_KEY_1 = os.environ.get('ROUTE_SECRET_KEY_1', 'dev-route-secret-key-1')
+    ROUTE_SECRET_KEY_2 = os.environ.get('ROUTE_SECRET_KEY_2', 'dev-route-secret-key-2')
     CHECK_PROXY_HEADER = False
     ANTIVIRUS_ENABLED = True
 
     REDIS_URL = os.environ.get('REDIS_URL')
     REDIS_ENABLED = True
+    
+    BASIC_AUTH_USERNAME = os.environ.get('BASIC_AUTH_USERNAME')
+    BASIC_AUTH_PASSWORD = os.environ.get('BASIC_AUTH_PASSWORD')
+    BASIC_AUTH_FORCE = True
 
     ASSET_DOMAIN = ''
     ASSET_PATH = '/static/'
@@ -93,6 +97,7 @@ class Config(object):
 
 
 class Development(Config):
+    BASIC_AUTH_FORCE = True
     NOTIFY_LOG_PATH = 'application.log'
     DEBUG = True
     SESSION_COOKIE_SECURE = False
@@ -143,6 +148,7 @@ class Test(Development):
 
 
 class Preview(Config):
+    BASIC_AUTH_FORCE = True
     HTTP_PROTOCOL = 'https'
     HEADER_COLOUR = '#F499BE'  # $baby-pink
     CSV_UPLOAD_BUCKET_NAME = 'preview-notifications-csv-upload'
@@ -162,6 +168,7 @@ class Preview(Config):
 
 
 class Staging(Config):
+    BASIC_AUTH_FORCE = True
     HTTP_PROTOCOL = 'https'
     HEADER_COLOUR = '#6F72AF'  # $mauve
     CSV_UPLOAD_BUCKET_NAME = 'staging-notifications-csv-upload'
@@ -178,6 +185,7 @@ class Staging(Config):
 
 
 class Live(Config):
+    BASIC_AUTH_FORCE = True
     HEADER_COLOUR = '#005EA5'  # $govuk-blue
     HTTP_PROTOCOL = 'https'
     CSV_UPLOAD_BUCKET_NAME = 'notifications.prototype.csv_upload'

app/main/views/index.py

@@ -30,7 +30,7 @@ def index():
     return render_template(
         'views/signedout.html',
         sms_rate=CURRENT_SMS_RATE,
-        counts=status_api_client.get_count_of_live_services_and_organisations(),
+        counts=status_api_client.get_count_of_live_services_and_organisations()
     )
 
 

devcontainer-admin/.devcontainer.json

@@ -13,7 +13,8 @@
         },
         "python.linting.enabled": true,
         "python.linting.pylintEnabled": true,
-        "python.pythonPath": "/usr/local/bin/python"
+        "python.pythonPath": "/usr/local/bin/python",
+        "python.linting.pylintPath": "/usr/local/share/pip-global/bin/pylint"
     },
     "features": {
         "docker-from-docker": {
@@ -22,7 +23,7 @@
         }
     },
     "extensions": [
-        "ms-python.black-formatter",
+        "ms-python.python", // "ms-python.black-formatter"
         "donjayamanne.python-extension-pack",
         "ms-azuretools.vscode-docker",
         "ms-python.vscode-pylance",

devcontainer-admin/Dockerfile

@@ -28,6 +28,7 @@ RUN apt-get update \
     tldr \
     unzip \
     vim \
+    apache2-utils \
     && apt-get autoremove -y \
     && apt-get clean -y \
     && rm -rf /var/lib/apt/lists/*

devcontainer-admin/scripts/notify-admin-entrypoint.sh

@@ -7,6 +7,8 @@ set -ex
 # tools and the filesystem mount enabled should be located here. 
 ###################################################################
 
+echo "RUNNING ENTRYPOINT SCRIPT"
+
 # Define aliases
 echo -e "\n\n# User's Aliases" >> ~/.zshrc
 echo -e "alias fd=fdfind" >> ~/.zshrc
@@ -33,4 +35,6 @@ make generate-version-file
 npm run build
 
 # run flask
-# make run
+# make run
+
+echo "FINISHED ENTRYPOINT SCRIPT"

manifest.yml

@@ -29,8 +29,6 @@ applications:
       API_HOST_NAME: notifications-api.app.cloud.gov
       DANGEROUS_SALT: ((DANGEROUS_SALT))
       SECRET_KEY: ((SECRET_KEY))
-      ROUTE_SECRET_KEY_1: ((ROUTE_SECRET_KEY_1))
-      ROUTE_SECRET_KEY_2: ((ROUTE_SECRET_KEY_2))
 
       AWS_REGION: us-west-2
       AWS_ACCESS_KEY_ID: ((AWS_ACCESS_KEY_ID))

requirements.in

@@ -10,6 +10,7 @@ wtforms==3.0.1
 Flask-Login==0.6.1
 Werkzeug==2.1.2
 jinja2==3.1.2
+Flask-BasicAuth==0.2.0
 
 blinker==1.4
 pyexcel==0.7.0

requirements.txt

@@ -71,6 +71,8 @@ flask-redis==0.4.0
     # via notifications-utils
 flask-wtf==1.0.1
     # via -r requirements.in
+Flask-BasicAuth==0.2.0
+    # via -r requirements.in
 gds-metrics @ git+https://github.com/alphagov/gds_metrics_python.git@6f1840a57b6fb1ee40b7e84f2f18ec229de8aa72
     # via -r requirements.in
 geojson==2.5.0

varsfile.sample

@@ -5,3 +5,5 @@ ROUTE_SECRET_KEY_1: asdf
 ROUTE_SECRET_KEY_2: asdf
 AWS_ACCESS_KEY_ID: asdf
 AWS_SECRET_ACCESS_KEY: asdf
+BASIC_AUTH_USERNAME: asdf
+BASIC_AUTH_PASSWORD: asdf