darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-07-25 10:29:14 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2582 from GSA/2581-adding-api_public_url-to-env

Browse Source 
Add API_PUBLIC_URL environment variable for public API access
This commit is contained in:
ccostino
2025-05-20 16:27:51 -04:00
committed by GitHub
parent e658ed2584 1b6894139d
commit 5dcf967941
14 changed files with 43 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.ds.baseline
View File

@@ -171,7 +171,7 @@
"filename": "app/config.py",
"hashed_secret": "577a4c667e4af8682ca431857214b3a920883efc",
"is_verified": false,
"line_number": 120,
"line_number": 122,
"is_secret": false
}
],
@@ -644,5 +644,5 @@
}
]
},
"generated_at": "2025-05-12T16:50:20Z"
"generated_at": "2025-05-19T21:41:23Z"
}

2
.github/workflows/deploy-demo.yml vendored
View File

@@ -63,6 +63,7 @@ jobs:
LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://notify-demo.app.cloud.gov/sign-out"
LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://notify-demo.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=STATE"
LOGIN_DOT_GOV_CERTS_URL: "https://secure.login.gov/api/openid_connect/certs"
API_PUBLIC_URL: ${{ secrets.API_PUBLIC_URL }}
with:
cf_username: ${{ secrets.CLOUDGOV_USERNAME }}
cf_password: ${{ secrets.CLOUDGOV_PASSWORD }}
@@ -87,6 +88,7 @@ jobs:
--var LOGIN_DOT_GOV_INITIAL_SIGNIN_URL="$LOGIN_DOT_GOV_INITIAL_SIGNIN_URL"
--var LOGIN_DOT_GOV_CERTS_URL="$LOGIN_DOT_GOV_CERTS_URL"
--var LOGIN_PEM="$LOGIN_PEM"
--var API_PUBLIC_URL="$API_PUBLIC_URL"
--strategy rolling
- name: Deploy egress proxy

2
.github/workflows/deploy-prod.yml vendored
View File

@@ -63,6 +63,7 @@ jobs:
LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://beta.notify.gov/sign-out"
LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://beta.notify.gov/sign-in&response_type=code&scope=openid+email&state=STATE"
LOGIN_DOT_GOV_CERTS_URL: "https://secure.login.gov/api/openid_connect/certs"
API_PUBLIC_URL: ${{ secrets.API_PUBLIC_URL }}
with:
cf_username: ${{ secrets.CLOUDGOV_USERNAME }}
cf_password: ${{ secrets.CLOUDGOV_PASSWORD }}
@@ -87,6 +88,7 @@ jobs:
--var LOGIN_DOT_GOV_INITIAL_SIGNIN_URL="$LOGIN_DOT_GOV_INITIAL_SIGNIN_URL"
--var LOGIN_DOT_GOV_CERTS_URL="$LOGIN_DOT_GOV_CERTS_URL"
--var LOGIN_PEM="$LOGIN_PEM"
--var API_PUBLIC_URL="$API_PUBLIC_URL"
--strategy rolling
- name: Deploy egress proxy

2
.github/workflows/deploy.yml vendored
View File

@@ -69,6 +69,7 @@ jobs:
LOGIN_DOT_GOV_SIGNOUT_REDIRECT: "https://notify-staging.app.cloud.gov/sign-out"
LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: "https://secure.login.gov/openid_connect/authorize?acr_values=http%3A%2F%2Fidmanagement.gov%2Fns%2Fassurance%2Fial%2F1&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:gsa:notify-gov&nonce=NONCE&prompt=select_account&redirect_uri=https://notify-staging.app.cloud.gov/sign-in&response_type=code&scope=openid+email&state=STATE"
LOGIN_DOT_GOV_CERTS_URL: "https://secure.login.gov/api/openid_connect/certs"
API_PUBLIC_URL: ${{ secrets.API_PUBLIC_URL }}
with:
cf_username: ${{ secrets.CLOUDGOV_USERNAME }}
cf_password: ${{ secrets.CLOUDGOV_PASSWORD }}
@@ -93,6 +94,7 @@ jobs:
--var LOGIN_DOT_GOV_INITIAL_SIGNIN_URL="$LOGIN_DOT_GOV_INITIAL_SIGNIN_URL"
--var LOGIN_DOT_GOV_CERTS_URL="$LOGIN_DOT_GOV_CERTS_URL"
--var LOGIN_PEM="$LOGIN_PEM"
--var API_PUBLIC_URL="$API_PUBLIC_URL"
--strategy rolling

14
app/__init__.py
View File

@@ -141,7 +141,7 @@ navigation = {
def _csp(config):
asset_domain = config["ASSET_DOMAIN"]
logo_domain = config["LOGO_CDN_DOMAIN"]
api_host_name = config["API_HOST_NAME"]
api_public_url = config["API_PUBLIC_URL"]
csp = {
"default-src": ["'self'", asset_domain],
@@ -172,14 +172,14 @@ def _csp(config):
"img-src": ["'self'", asset_domain, logo_domain],
}
if api_host_name:
csp["connect-src"].append(api_host_name)
if api_public_url:
csp["connect-src"].append(api_public_url)
# this is for web socket
if api_host_name.startswith("http://"):
ws_url = api_host_name.replace("http://", "ws://")
if api_public_url.startswith("http://"):
ws_url = api_public_url.replace("http://", "ws://")
csp["connect-src"].append(ws_url)
elif api_host_name.startswith("https://"):
ws_url = api_host_name.replace("https://", "wss://")
elif api_public_url.startswith("https://"):
ws_url = api_public_url.replace("https://", "wss://")
csp["connect-src"].append(ws_url)
return csp

4
app/config.py
View File

@@ -12,6 +12,8 @@ class Config(object):
NOTIFY_APP_NAME = "admin"
NOTIFY_ENVIRONMENT = getenv("NOTIFY_ENVIRONMENT", "development")
API_HOST_NAME = getenv("API_HOST_NAME", "localhost")
API_PUBLIC_URL = getenv("API_PUBLIC_URL", "localhost")
ADMIN_BASE_URL = getenv("ADMIN_BASE_URL", "http://localhost:6012")
HEADER_COLOUR = (
"#81878b" # mix(govuk-colour("dark-grey"), govuk-colour("mid-grey"))
@@ -132,6 +134,8 @@ class Test(Development):
ASSET_PATH = "https://static.example.com/"
API_HOST_NAME = "http://you-forgot-to-mock-an-api-call-to"
API_PUBLIC_URL = "http://you-forgot-to-mock-an-api-call-to"
REDIS_URL = "redis://you-forgot-to-mock-a-redis-call-to"
LOGO_CDN_DOMAIN = "static-logos.test.com"

4
app/main/views/jobs.py
View File

@@ -58,11 +58,11 @@ def view_job(service_id, job_id):
filter_args = parse_filter_args(request.args)
filter_args["status"] = set_status_filters(filter_args)
api_host_name = os.environ.get("API_HOST_NAME")
api_public_url = os.environ.get("API_PUBLIC_URL")
return render_template(
"views/jobs/job.html",
api_host_name=api_host_name,
api_public_url=api_public_url,
FEATURE_SOCKET_ENABLED=current_app.config["FEATURE_SOCKET_ENABLED"],
job=job,
status=request.args.get("status", ""),

2
app/templates/views/jobs/job.html
View File

@@ -14,7 +14,7 @@
{% if not job.finished_processing %}
<p class="max-width-full">This page refreshes automatically to show the latest message activity delivery rates, details, and reports.<br>You can watch it in progress or check back later.</p>
{% endif %}
<div data-job-id="{{ job.id }}" data-feature="{{FEATURE_SOCKET_ENABLED | lower}}" data-host="{{ api_host_name }}">
<div data-job-id="{{ job.id }}" data-feature="{{FEATURE_SOCKET_ENABLED | lower}}" data-host="{{ api_public_url }}">
{% if not job.finished_processing %}
<div
data-resource="{{ updates_url }}"

1
deploy-config/demo.yml
View File

@@ -8,3 +8,4 @@ redis_enabled: 1
nr_agent_id: '1134302465'
nr_app_id: '1083160688'
FEATURE_SOCKET_ENABLED: true
API_PUBLIC_URL: https://notify-api-demo.app.cloud.gov

1
deploy-config/production.yml
View File

@@ -8,3 +8,4 @@ redis_enabled: 1
nr_agent_id: '1050708682'
nr_app_id: '1050708682'
FEATURE_SOCKET_ENABLED: false
API_PUBLIC_URL: https://notify-api-production.app.cloud.gov

1
deploy-config/staging.yml
View File

@@ -8,3 +8,4 @@ redis_enabled: 1
nr_agent_id: '1134291385'
nr_app_id: '1031640326'
FEATURE_SOCKET_ENABLED: false
API_PUBLIC_URL: https://notify-api-staging.app.cloud.gov

2
manifest.yml
View File

@@ -61,5 +61,7 @@ applications:
LOGIN_DOT_GOV_INITIAL_SIGNIN_URL: ((LOGIN_DOT_GOV_INITIAL_SIGNIN_URL))
LOGIN_DOT_GOV_CERTS_URL: ((LOGIN_DOT_GOV_CERTS_URL))
API_PUBLIC_URL: ((API_PUBLIC_URL))
# feature flagging
FEATURE_SOCKET_ENABLED: ((FEATURE_SOCKET_ENABLED))

16
tests/app/main/views/test_headers.py
View File

@@ -33,15 +33,15 @@ def test_owasp_useful_headers_set(
)
assert search(r"style-src 'self' static\.example\.com 'nonce-.*';", csp)
assert search(r"img-src 'self' static\.example\.com static-logos\.test\.com", csp)
api_host_name = current_app.config.get("API_HOST_NAME")
assert api_host_name is not None, f"API_HOST_NAME: {api_host_name} — is missing"
api_public_url = current_app.config.get("API_PUBLIC_URL")
assert api_public_url is not None, f"API_PUBLIC_URL: {api_public_url} — is missing"
assert api_host_name in csp
if api_host_name.startswith("http://"):
assert api_host_name.replace("http://", "ws://") in csp
elif api_host_name.startswith("https://"):
assert api_host_name.replace("https://", "wss://") in csp
assert api_public_url in csp
if api_public_url.startswith("http://"):
assert api_public_url.replace("http://", "ws://") in csp
elif api_public_url.startswith("https://"):
assert api_public_url.replace("https://", "wss://") in csp
else:
raise AssertionError(
f"Unexpected API_HOST_NAME format: {api_host_name} — must start with 'http://' or 'https://'"
f"Unexpected API_PUBLIC_URL format: {api_public_url} — must start with 'http://' or 'https://'"
)

11
tests/app/main/views/test_manage_users.py
View File

@@ -27,7 +27,6 @@ from tests.conftest import (
(
create_active_user_with_permissions(),
(
"Test User test@user.gsa.gov (you) "
"Permissions "
"Can See dashboard "
@@ -44,7 +43,11 @@ from tests.conftest import (
),
(
create_active_user_view_permissions(),
("Test User With Permissions test@user.gsa.gov (you) " "Permissions " "Can See dashboard"),
(
"Test User With Permissions test@user.gsa.gov (you) "
"Permissions "
"Can See dashboard"
),
False,
),
(
@@ -232,7 +235,9 @@ def test_should_show_caseworker_on_overview_page(
assert normalize_spaces(page.select_one("h1").text) == "Team members"
assert normalize_spaces(page.select(".user-list-item")[0].text) == (
"Test User With Permissions test@user.gsa.gov (you) " "Permissions " "Can See dashboard"
"Test User With Permissions test@user.gsa.gov (you) "
"Permissions "
"Can See dashboard"
)
# [1:5] are invited users
assert normalize_spaces(page.select(".user-list-item")[6].text) == (