Fix: [AEA-4902] - use a different mock oidc app per environment

.github/workflows/cdk_release_code.yml

@@ -50,7 +50,9 @@ on:
         type: boolean
       useCustomCognitoDomain:
         type: boolean
-      APIGEE_TOKEN_ENDPOINT:
+      APIGEE_CIS2_TOKEN_ENDPOINT:
+        type: string
+      APIGEE_MOCK_TOKEN_ENDPOINT:
         type: string
       APIGEE_PRESCRIPTIONS_ENDPOINT:
         type: string
@@ -65,12 +67,8 @@ on:
         required: true
       primaryOidcClientId:
         required: false
-      primaryOidClientSecret:
-        required: false
       mockOidcClientId:
         required: false
-      mockOidClientSecret:
-        required: false
       APIGEE_API_KEY:
         required: false
 jobs:
@@ -157,16 +155,14 @@ jobs:
           --argjson allowAutoDeleteObjects "true" \
           --arg cloudfrontDistributionId "${cloudfrontDistributionId}" \
           --arg cloudfrontCertArn "${cloudfrontCertArn}" \
-          --arg useMockOidc "${{ inputs.useMockOidc }}" \
+          --argjson useMockOidc "${{ inputs.useMockOidc }}" \
           --arg primaryOidcClientId "${{ secrets.primaryOidcClientId }}" \
-          --arg primaryOidClientSecret "${{ secrets.primaryOidClientSecret }}" \
           --arg primaryOidcIssuer "${{ inputs.primaryOidcIssuer }}" \
           --arg primaryOidcAuthorizeEndpoint "${{ inputs.primaryOidcAuthorizeEndpoint }}" \
           --arg primaryOidcTokenEndpoint "${{ inputs.primaryOidcTokenEndpoint }}" \
           --arg primaryOidcUserInfoEndpoint "${{ inputs.primaryOidcUserInfoEndpoint }}" \
           --arg primaryOidcjwksEndpoint "${{ inputs.primaryOidcjwksEndpoint }}" \
           --arg mockOidcClientId "${{ secrets.mockOidcClientId }}" \
-          --arg mockOidClientSecret "${{ secrets.mockOidClientSecret }}" \
           --arg mockOidcIssuer "${{ inputs.mockOidcIssuer }}" \
           --arg mockOidcAuthorizeEndpoint "${{ inputs.mockOidcAuthorizeEndpoint }}" \
           --arg mockOidcTokenEndpoint "${{ inputs.mockOidcTokenEndpoint }}" \
@@ -176,7 +172,8 @@ jobs:
           --arg fullCloudfrontDomain "${fullCloudfrontDomain}" \
           --argjson useCustomCognitoDomain "${{ inputs.useCustomCognitoDomain }}" \
           --argjson useLocalhostCallback "${{ inputs.useLocalhostCallback }}" \
-          --arg apigeeTokenEndpoint "${{ inputs.APIGEE_TOKEN_ENDPOINT }}" \
+          --arg apigeeCIS2TokenEndpoint "${{ inputs.APIGEE_CIS2_TOKEN_ENDPOINT }}" \
+          --arg apigeeMockTokenEndpoint "${{ inputs.APIGEE_MOCK_TOKEN_ENDPOINT }}" \
           --arg apigeePrescriptionsEndpoint "${{ inputs.APIGEE_PRESCRIPTIONS_ENDPOINT }}" \
           --arg apigeeApiKey "${{ secrets.APIGEE_API_KEY }}" \
           --arg jwtKid "${{ inputs.JWT_KID }}" \
@@ -196,22 +193,21 @@ jobs:
             "fullCloudfrontDomain": $fullCloudfrontDomain,
             "useMockOidc": $useMockOidc,
             "primaryOidcClientId": $primaryOidcClientId,
-            "primaryOidClientSecret": $primaryOidClientSecret,
             "primaryOidcIssuer": $primaryOidcIssuer,
             "primaryOidcAuthorizeEndpoint": $primaryOidcAuthorizeEndpoint,
             "primaryOidcTokenEndpoint": $primaryOidcTokenEndpoint,
             "primaryOidcUserInfoEndpoint": $primaryOidcUserInfoEndpoint,
             "primaryOidcjwksEndpoint": $primaryOidcjwksEndpoint,
             "mockOidcClientId": $mockOidcClientId,
-            "mockOidClientSecret": $mockOidClientSecret,
             "mockOidcIssuer": $mockOidcIssuer,
             "mockOidcAuthorizeEndpoint": $mockOidcAuthorizeEndpoint,
             "mockOidcTokenEndpoint": $mockOidcTokenEndpoint,
             "mockOidcUserInfoEndpoint": $mockOidcUserInfoEndpoint,
             "mockOidcjwksEndpoint": $mockOidcjwksEndpoint,
             "useCustomCognitoDomain": $useCustomCognitoDomain,
             "useLocalhostCallback": $useLocalhostCallback,
-            "apigeeTokenEndpoint": $apigeeTokenEndpoint,
+            "apigeeCIS2TokenEndpoint": $apigeeCIS2TokenEndpoint,
+            "apigeeMockTokenEndpoint": $apigeeMockTokenEndpoint,
             "apigeePrescriptionsEndpoint": $apigeePrescriptionsEndpoint,
             "apigeeApiKey": $apigeeApiKey,
             "jwtKid": $jwtKid,

.github/workflows/ci.yml

@@ -115,19 +115,18 @@ jobs:
       mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
       useLocalhostCallback: true
       useCustomCognitoDomain: true
-      APIGEE_TOKEN_ENDPOINT: "https://internal-dev.api.service.nhs.uk/oauth2/token"
+      APIGEE_CIS2_TOKEN_ENDPOINT: "https://internal-dev.api.service.nhs.uk/oauth2/token"
+      APIGEE_MOCK_TOKEN_ENDPOINT: "https://internal-dev.api.service.nhs.uk/oauth2-mock/token"
       APIGEE_PRESCRIPTIONS_ENDPOINT: "https://internal-dev.api.service.nhs.uk/clinical-prescription-tracker/"
-      JWT_KID: "eps-cpt-ui-test"
+      JWT_KID: "eps-cpt-ui-dev"
       ROLE_ID: "555254242106"
       LOG_LEVEL: "DEBUG"
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
-      primaryOidcClientId: ${{ secrets.PTL_PRIMARY_OIDC_CLIENT_ID }}
-      primaryOidClientSecret: ${{ secrets.PTL_PRIMARY_OIDC_CLIENT_SECRET }}
-      mockOidcClientId: ${{ secrets.PTL_MOCK_CLIENT_ID }}
-      mockOidClientSecret: ${{ secrets.PTL_MOCK_CLIENT_SECRET }}
-      CIS2_PRIVATE_KEY: ${{ secrets.PTL_CIS2_PRIVATE_KEY }}
+      primaryOidcClientId: ${{ secrets.DEV_CIS2_OIDC_CLIENT_ID }}
+      mockOidcClientId: ${{ secrets.DEV_MOCK_CLIENT_ID }}
+      CIS2_PRIVATE_KEY: ${{ secrets.DEV_JWT_PRIVATE_KEY }}
       REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}
       APIGEE_API_KEY: ${{ secrets.APIGEE_DEV_API_KEY }}
 
@@ -161,25 +160,24 @@ jobs:
       primaryOidcTokenEndpoint: "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/access_token"
       primaryOidcUserInfoEndpoint: "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/userinfo"
       primaryOidcjwksEndpoint: "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/connect/jwk_uri"
-      mockOidcIssuer: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev"
-      mockOidcAuthorizeEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/auth"
-      mockOidcTokenEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/token"
-      mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/userinfo"
-      mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
+      mockOidcIssuer: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-qa"
+      mockOidcAuthorizeEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-qa/protocol/openid-connect/auth"
+      mockOidcTokenEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-qa/protocol/openid-connect/token"
+      mockOidcUserInfoEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-qa/protocol/openid-connect/userinfo"
+      mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-qa/protocol/openid-connect/certs"
       useLocalhostCallback: false
       useCustomCognitoDomain: true
-      APIGEE_TOKEN_ENDPOINT: "https://internal-qa.api.service.nhs.uk/oauth2/token"
+      APIGEE_CIS2_TOKEN_ENDPOINT: "https://internal-qa.api.service.nhs.uk/oauth2-int/token"
+      APIGEE_MOCK_TOKEN_ENDPOINT: "https://internal-qa.api.service.nhs.uk/oauth2-mock/token"
       APIGEE_PRESCRIPTIONS_ENDPOINT: "https://internal-qa.api.service.nhs.uk/clinical-prescription-tracker/"
-      JWT_KID: "eps-cpt-ui-test"
+      JWT_KID: "eps-cpt-ui-qa"
       ROLE_ID: "555254242106"
       LOG_LEVEL: "DEBUG"
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.QA_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.QA_CLOUD_FORMATION_DEPLOY_ROLE }}
-      primaryOidcClientId: ${{ secrets.PTL_PRIMARY_OIDC_CLIENT_ID }}
-      primaryOidClientSecret: ${{ secrets.PTL_PRIMARY_OIDC_CLIENT_SECRET }}
-      mockOidcClientId: ${{ secrets.PTL_MOCK_CLIENT_ID }}
-      mockOidClientSecret: ${{ secrets.PTL_MOCK_CLIENT_SECRET }}
-      CIS2_PRIVATE_KEY: ${{ secrets.PTL_CIS2_PRIVATE_KEY }}
+      primaryOidcClientId: ${{ secrets.QA_CIS2_OIDC_CLIENT_ID }}
+      mockOidcClientId: ${{ secrets.QA_MOCK_CLIENT_ID }}
+      CIS2_PRIVATE_KEY: ${{ secrets.QA_JWT_PRIVATE_KEY }}
       REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}
       APIGEE_API_KEY: ${{ secrets.APIGEE_QA_API_KEY }}

.github/workflows/deploy_website_content.yml

@@ -98,7 +98,7 @@ jobs:
           staticBucketName=$(aws cloudformation list-exports --query "Exports[?Name=='${{ inputs.SERVICE_NAME }}-stateful-resources:StaticContentBucket:Name'].Value" --output text)
           aws s3 cp ".build/packages/staticContent/404.html" "s3://${staticBucketName}/404.html"
           aws s3 cp ".build/packages/staticContent/500.html" "s3://${staticBucketName}/500.html"
-          aws s3 cp ".build/packages/staticContent/jwks/dev/jwks.json" "s3://${staticBucketName}/jwks.json"
+          aws s3 cp ".build/packages/staticContent/jwks/${{ inputs.TARGET_ENVIRONMENT }}/jwks.json" "s3://${staticBucketName}/jwks.json"
           aws s3 cp --recursive ".build/packages/cpt-ui/out/" "s3://${staticBucketName}/${{ inputs.VERSION_NUMBER }}/"
 
       - name: deploy auth_demo website (temp for testing)

.github/workflows/pull_request.yml

@@ -80,19 +80,22 @@ jobs:
       mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
       useLocalhostCallback: true
       useCustomCognitoDomain: false
-      APIGEE_TOKEN_ENDPOINT: "https://internal-dev.api.service.nhs.uk/oauth2/token"
+      APIGEE_CIS2_TOKEN_ENDPOINT: "https://internal-dev.api.service.nhs.uk/oauth2/token"
+      APIGEE_MOCK_TOKEN_ENDPOINT: "https://internal-dev.api.service.nhs.uk/oauth2-mock/token"
       APIGEE_PRESCRIPTIONS_ENDPOINT: "https://internal-dev.api.service.nhs.uk/clinical-prescription-tracker/"
       JWT_KID: "eps-cpt-ui-test"
+      # this needs uncommenting and above line deleted once it is merged
+      # JWT_KID: "eps-cpt-ui-dev"
       ROLE_ID: "555254242106"
       LOG_LEVEL: "DEBUG"
     secrets:
       CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}
       CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
-      primaryOidcClientId: ${{ secrets.PTL_PRIMARY_OIDC_CLIENT_ID }}
-      primaryOidClientSecret: ${{ secrets.PTL_PRIMARY_OIDC_CLIENT_SECRET }}
-      mockOidcClientId: ${{ secrets.PTL_MOCK_CLIENT_ID }}
-      mockOidClientSecret: ${{ secrets.PTL_MOCK_CLIENT_SECRET }}
+      primaryOidcClientId: ${{ secrets.DEV_CIS2_OIDC_CLIENT_ID }}
+      mockOidcClientId: ${{ secrets.DEV_MOCK_CLIENT_ID }}
       CIS2_PRIVATE_KEY: ${{ secrets.PTL_CIS2_PRIVATE_KEY }}
+      # this needs uncommenting and above line deleted once it is merged
+      # CIS2_PRIVATE_KEY: ${{ secrets.DEV_JWT_PRIVATE_KEY }}
       REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}
       APIGEE_API_KEY: ${{ secrets.APIGEE_DEV_API_KEY }}