Skip to content

Commit b988351

Browse files
anthony-nhsdependabot[bot]
anthony-nhs
and
dependabot[bot]
authored
Fix: [AEA-0000] - do not use cognito custom domain for pull request (#185)
## Summary - Routine Change ### Details - do not use custom cognito domain for pull request - use argjson to pass boolean to cdk.json - update to latest quality checks - add secret scanning config --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 parent 53e78a8 commit b988351

File tree

13 files changed

+120
-41
lines changed

13 files changed

+120
-41
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
"source=${env:HOME}${env:USERPROFILE}/.gnupg,target=/home/vscode/.gnupg,type=bind",
1515
"source=${env:HOME}${env:USERPROFILE}/.npmrc,target=/home/vscode/.npmrc,type=bind"
1616
],
17+
"remoteEnv": { "LOCAL_WORKSPACE_FOLDER": "${localWorkspaceFolder}" },
18+
"postAttachCommand": "docker build -f https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/tags/v4.0.4/dockerfiles/nhsd-git-secrets.dockerfile -t git-secrets . && poetry run pre-commit install --install-hooks -f",
1719
"features": {
1820
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
1921
"version": "latest",

‎.gitallowed‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"?
2+
github-token: ?"?\$\{\{\s*secrets\.GITHUB_TOKEN\s*\}\}"?
3+
token: ?"?\$\{\{\s*secrets\.DEPENDABOT_TOKEN\s*\}\}"?
4+
id-token: write
5+
accountId: "123456789012"
6+
token: `https:\/\/\${props\.fullCloudfrontDomain}\/api\/token`,
7+
token: `https:\/\/\${props\.fullCloudfrontDomain}\/api\/mocktoken`,
8+
target: RecordTarget.fromIpAddresses\("127.0.0.1"\),
9+
const token = jwks.token\({
10+
.SAMtemplates*
11+
.*\.gitallowed.*
12+
.test\/*
13+
.127\.0\.0\.1
14+
.token: newToken
15+
const token = await getToken()
16+
const token = new sam.CfnFunction\(this, 'Token', {
17+
const token = new nodeLambda.NodejsFunction\(this, "tokenLambda", {
18+
AWS_ACCOUNT_ID=591291862413
19+
const token = new .*\(this, "TokenResources", {
20+
token: props..*TokenEndpoint
21+
token: `\${baseApiGwUrl}\/.*[Tt]oken`
22+
token: `.*{props\.cloudfrontDomain}\/api\/token`
23+
packages\/auth_demo\/src\/App.tsx:150

‎.github/workflows/cdk_release_code.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ on:
4646
type: string
4747
useLocalhostCallback:
4848
type: boolean
49+
useCustomCognitoDomain:
50+
type: boolean
4951
secrets:
5052
CLOUD_FORMATION_DEPLOY_ROLE:
5153
required: true
@@ -139,7 +141,7 @@ jobs:
139141
--arg logRetentionInDays "${{ inputs.LOG_RETENTION_IN_DAYS }}" \
140142
--arg epsDomainName "${epsDomainName}" \
141143
--arg epsHostedZoneId "${epsHostedZoneId}" \
142-
--arg allowAutoDeleteObjects "true" \
144+
--argjson allowAutoDeleteObjects "true" \
143145
--arg cloudfrontDistributionId "${cloudfrontDistributionId}" \
144146
--arg cloudfrontCertArn "${cloudfrontCertArn}" \
145147
--arg useMockOidc "${{ inputs.useMockOidc }}" \
@@ -159,7 +161,8 @@ jobs:
159161
--arg mockOidcjwksEndpoint "${{ inputs.mockOidcjwksEndpoint }}" \
160162
--arg shortCloudfrontDomain "${shortCloudfrontDomain}" \
161163
--arg fullCloudfrontDomain "${fullCloudfrontDomain}" \
162-
--arg useLocalhostCallback "${{ inputs.useLocalhostCallback }}" \
164+
--argjson useCustomCognitoDomain "${{ inputs.useCustomCognitoDomain }}" \
165+
--argjson useLocalhostCallback "${{ inputs.useLocalhostCallback }}" \
163166
'.context += {
164167
"serviceName": $serviceName,
165168
"VERSION_NUMBER": $VERSION_NUMBER,
@@ -187,6 +190,7 @@ jobs:
187190
"mockOidcTokenEndpoint": $mockOidcTokenEndpoint,
188191
"mockOidcUserInfoEndpoint": $mockOidcUserInfoEndpoint,
189192
"mockOidcjwksEndpoint": $mockOidcjwksEndpoint,
193+
"useCustomCognitoDomain": $useCustomCognitoDomain,
190194
"useLocalhostCallback": $useLocalhostCallback}' \
191195
.build/cdk.json > .build/cdk.new.json
192196
mv .build/cdk.new.json .build/cdk.json

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ env:
99

1010
jobs:
1111
quality_checks:
12-
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v3.0.0
12+
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v4.0.4
1313
secrets:
1414
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
1515

@@ -114,6 +114,7 @@ jobs:
114114
mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/userinfo"
115115
mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
116116
useLocalhostCallback: true
117+
useCustomCognitoDomain: true
117118
secrets:
118119
CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
119120
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -159,6 +160,7 @@ jobs:
159160
mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/userinfo"
160161
mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
161162
useLocalhostCallback: false
163+
useCustomCognitoDomain: true
162164
secrets:
163165
CDK_PULL_IMAGE_ROLE: ${{ secrets.QA_CDK_PULL_IMAGE_ROLE }}
164166
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.QA_CLOUD_FORMATION_DEPLOY_ROLE }}

‎.github/workflows/pull_request.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ env:
99

1010
jobs:
1111
quality_checks:
12-
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v3.0.0
12+
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v4.0.4
1313
secrets:
1414
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
1515

@@ -79,6 +79,7 @@ jobs:
7979
mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/userinfo"
8080
mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
8181
useLocalhostCallback: true
82+
useCustomCognitoDomain: false
8283
secrets:
8384
CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
8485
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}

‎.github/workflows/release.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ env:
88

99
jobs:
1010
quality_checks:
11-
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v3.0.0
11+
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@v4.0.4
1212
secrets:
1313
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
1414

@@ -133,6 +133,7 @@ jobs:
133133
mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/userinfo"
134134
mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
135135
useLocalhostCallback: true
136+
useCustomCognitoDomain: true
136137
secrets:
137138
CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
138139
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -177,6 +178,7 @@ jobs:
177178
mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/userinfo"
178179
mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
179180
useLocalhostCallback: false
181+
useCustomCognitoDomain: true
180182
secrets:
181183
CDK_PULL_IMAGE_ROLE: ${{ secrets.REF_CDK_PULL_IMAGE_ROLE }}
182184
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.REF_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -206,6 +208,7 @@ jobs:
206208
mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/userinfo"
207209
mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
208210
useLocalhostCallback: false
211+
useCustomCognitoDomain: true
209212
secrets:
210213
CDK_PULL_IMAGE_ROLE: ${{ secrets.QA_CDK_PULL_IMAGE_ROLE }}
211214
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.QA_CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -235,6 +238,7 @@ jobs:
235238
mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/userinfo"
236239
mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
237240
useLocalhostCallback: false
241+
useCustomCognitoDomain: true
238242
secrets:
239243
CDK_PULL_IMAGE_ROLE: ${{ secrets.INT_CDK_PULL_IMAGE_ROLE }}
240244
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.INT_CLOUD_FORMATION_DEPLOY_ROLE }}

‎.github/workflows/release_all_stacks.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ on:
4040
type: string
4141
useLocalhostCallback:
4242
type: boolean
43+
useCustomCognitoDomain:
44+
type: boolean
4345
secrets:
4446
CLOUD_FORMATION_DEPLOY_ROLE:
4547
required: true
@@ -110,6 +112,7 @@ jobs:
110112
mockOidcUserInfoEndpoint: ${{ inputs.mockOidcUserInfoEndpoint }}
111113
mockOidcjwksEndpoint: ${{ inputs.mockOidcjwksEndpoint }}
112114
useLocalhostCallback: ${{ inputs.useLocalhostCallback }}
115+
useCustomCognitoDomain: ${{ inputs.useCustomCognitoDomain }}
113116
secrets:
114117
CDK_PULL_IMAGE_ROLE: ${{ secrets.CDK_PULL_IMAGE_ROLE }}
115118
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -151,6 +154,7 @@ jobs:
151154
mockOidcUserInfoEndpoint: ${{ inputs.mockOidcUserInfoEndpoint }}
152155
mockOidcjwksEndpoint: ${{ inputs.mockOidcjwksEndpoint }}
153156
useLocalhostCallback: ${{ inputs.useLocalhostCallback }}
157+
useCustomCognitoDomain: ${{ inputs.useCustomCognitoDomain }}
154158
secrets:
155159
CDK_PULL_IMAGE_ROLE: ${{ secrets.CDK_PULL_IMAGE_ROLE }}
156160
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
@@ -245,6 +249,7 @@ jobs:
245249
mockOidcUserInfoEndpoint: ${{ inputs.mockOidcUserInfoEndpoint }}
246250
mockOidcjwksEndpoint: ${{ inputs.mockOidcjwksEndpoint }}
247251
useLocalhostCallback: ${{ inputs.useLocalhostCallback }}
252+
useCustomCognitoDomain: ${{ inputs.useCustomCognitoDomain }}
248253
secrets:
249254
CDK_PULL_IMAGE_ROLE: ${{ secrets.CDK_PULL_IMAGE_ROLE }}
250255
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}

‎.pre-commit-config.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,5 +59,14 @@ repos:
5959
types_or: [sh, shell]
6060
pass_filenames: false
6161

62+
- id: git-secrets
63+
name: Git Secrets
64+
description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.
65+
entry: bash
66+
args:
67+
- -c
68+
- 'docker run -v "$LOCAL_WORKSPACE_FOLDER:/src" git-secrets --pre_commit_hook'
69+
language: system
70+
6271
fail_fast: true
6372
default_stages: [pre-commit]

‎packages/cdk/bin/StatefulResourcesApp.ts‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ const app = new App()
1818
const serviceName = app.node.tryGetContext("serviceName")
1919
const version = app.node.tryGetContext("VERSION_NUMBER")
2020
const commit = app.node.tryGetContext("COMMIT_ID")
21+
const useCustomCognitoDomain = app.node.tryGetContext("useCustomCognitoDomain")
2122

2223
// add cdk-nag to everything
2324
Aspects.of(app).add(new AwsSolutionsChecks({verbose: true}))
@@ -31,7 +32,12 @@ Tags.of(app).add("cdkApp", "StatefulApp")
3132
const shortCloudfrontDomain = serviceName
3233
const parentCognitoDomain = `auth.${serviceName}`
3334
// shortCognitoDomain must be a subdomain of parentCognitoDomain
34-
const shortCognitoDomain = `login.${parentCognitoDomain}`
35+
let shortCognitoDomain
36+
if (useCustomCognitoDomain) {
37+
shortCognitoDomain = `login.${parentCognitoDomain}`
38+
} else {
39+
shortCognitoDomain = serviceName
40+
}
3541

3642
const UsCerts = new UsCertsStack(app, "UsCertsStack", {
3743
env: {

‎packages/cdk/resources/Cognito.ts‎

Lines changed: 28 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ export interface CognitoProps {
4444
readonly cognitoCertificate: ICertificate
4545
readonly hostedZone: IHostedZone
4646
readonly useLocalhostCallback: boolean
47+
readonly useCustomCognitoDomain: boolean
4748
}
4849

4950
/**
@@ -64,25 +65,35 @@ export class Cognito extends Construct {
6465
removalPolicy: RemovalPolicy.DESTROY
6566
})
6667

67-
const userPoolDomain = new UserPoolDomain(this, "UserPoolDomain", {
68-
userPool,
69-
customDomain: {
70-
domainName: props.fullCognitoDomain,
71-
certificate: props.cognitoCertificate
72-
}
73-
})
68+
let userPoolDomain: UserPoolDomain
69+
if (props.useCustomCognitoDomain) {
70+
userPoolDomain = new UserPoolDomain(this, "UserPoolDomain", {
71+
userPool,
72+
customDomain: {
73+
domainName: props.fullCognitoDomain,
74+
certificate: props.cognitoCertificate
75+
}
76+
})
7477

75-
new ARecord(this, "UserPoolCloudFrontAliasIpv4Record", {
76-
zone: props.hostedZone,
77-
recordName: props.shortCognitoDomain,
78-
target: RecordTarget.fromAlias(new UserPoolDomainTarget(userPoolDomain))
79-
})
78+
new ARecord(this, "UserPoolCloudFrontAliasIpv4Record", {
79+
zone: props.hostedZone,
80+
recordName: props.shortCognitoDomain,
81+
target: RecordTarget.fromAlias(new UserPoolDomainTarget(userPoolDomain))
82+
})
8083

81-
new AaaaRecord(this, "UserPoolCloudFrontAliasIpv6Record", {
82-
zone: props.hostedZone,
83-
recordName: props.shortCognitoDomain,
84-
target: RecordTarget.fromAlias(new UserPoolDomainTarget(userPoolDomain))
85-
})
84+
new AaaaRecord(this, "UserPoolCloudFrontAliasIpv6Record", {
85+
zone: props.hostedZone,
86+
recordName: props.shortCognitoDomain,
87+
target: RecordTarget.fromAlias(new UserPoolDomainTarget(userPoolDomain))
88+
})
89+
} else {
90+
userPoolDomain = new UserPoolDomain(this, "UserPoolDomain", {
91+
userPool,
92+
cognitoDomain: {
93+
domainPrefix: props.shortCognitoDomain
94+
}
95+
})
96+
}
8697

8798
// these are the endpoints that are added to user pool identity provider
8899
// note we override the token endpoint to point back to our custom token

0 commit comments

Comments
 (0)