Skip to content

Commit 4e6f043

Browse files
lukaszgryglickilukaszgryglicki
authored
Merge pull request #4484 from communitybridge/lukaszgryglicki-update-gitignore
Update gitignore
2 parents f7fa410 + cde4b87 commit 4e6f043

23 files changed

+656
-2
lines changed

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,3 +241,7 @@ dist/*
241241
api-postman/*
242242

243243
cla-backend/run-python-test-example-*.py
244+
245+
# LG
246+
out
247+
*.secret

‎aws_env.md‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# Setting up AWS environment
2+
3+
You need to have MFA enabled for your AWS user, your `~/.aws/config` shoudl look like this:
4+
```
5+
[profile lfproduct-dev]
6+
role_arn = arn:aws:iam::395594542180:role/product-contractors-role
7+
source_profile = lfproduct
8+
region = us-east-1
9+
output = json
10+
11+
[profile lfproduct-test]
12+
role_arn = arn:aws:iam::726224182707:role/product-contractors-role
13+
source_profile = lfproduct
14+
region = us-east-1
15+
output = json
16+
17+
[profile lfproduct-staging]
18+
role_arn = arn:aws:iam::844390194980:role/product-contractors-role
19+
source_profile = lfproduct
20+
region = us-east-1
21+
output = json
22+
23+
[profile lfproduct-prod]
24+
role_arn = arn:aws:iam::716487311010:role/product-contractors-role
25+
source_profile = lfproduct
26+
region = us-east-1
27+
output = json
28+
29+
[default]
30+
region = us-east-1
31+
output = json
32+
```
33+
34+
It defines 4 profiles to use: `dev`, `staging`, `test` and `prod`.
35+
36+
You will be using one of them.
37+
38+
39+
Your `~/.aws/credentials` file shoudl initially look like this (replace `redacted`):
40+
```
41+
[lfproduct-long-term]
42+
aws_secret_access_key = [access_key_redacted]
43+
aws_access_key_id = [key_id_redacted]
44+
aws_mfa_device = arn:aws:iam::[arn_number_redacted]:mfa/[your_aws_user_redacted]
45+
46+
[default]
47+
aws_access_key_id = [key_id_redacted]
48+
aws_secret_access_key = [access_key_redacted]
49+
```
50+
51+
Now every 36 hours or less you need to refresh your MFA key by calling: `aws-mfa --force --duration 129600 --profile lfproduct`.
52+
53+
When called it adds or replaces the following section (`[lfproduct]` which is used as a source profile for `dev`, `test`, `staging` or `prod` in aws config) in `~/.aws/credentials`:
54+
```
55+
[lfproduct]
56+
assumed_role = False
57+
aws_access_key_id = [key_id_redacted]
58+
aws_secret_access_key = [secret_access_key_redacted]
59+
aws_session_token = [session_token_redacted]
60+
aws_security_token = [session_token_redacted]
61+
expiration = 2024-11-28 16:54:59 [now + 36 hours]
62+
63+
```
64+
65+
66+
Once you have all of this, you must set a correct set of environment variables to run either `python` or `golang` backends.
67+
68+
To do so you need to get credentials for a specific profile `lfproduct-`: `dev`, `test`, `staging`, `prod`. To see full one-time set of credentials you can call:
69+
- for `dev`: `` aws sts assume-role --role-arn arn:aws:iam::395594542180:role/product-contractors-role --profile lfproduct --role-session-name lfproduct-dev-session ``.
70+
- for `prod`: `` aws sts assume-role --role-arn arn:aws:iam::716487311010:role/product-contractors-role --profile lfproduct --role-session-name lfproduct-prod-session ``.
71+
72+
Note - just replace the iam::[number] depending on environment type (`[stage]`) and update `lfproduct-[stage]-name`.
73+
74+
You can set up a script like `setenv.sh` which will set all required variables, example for `dev`:
75+
```
76+
#!/bin/bash
77+
78+
rm -rf /tmp/aws
79+
cp -R /root/.aws /tmp/.aws
80+
81+
data="$(aws sts assume-role --role-arn arn:aws:iam::395594542180:role/product-contractors-role --profile lfproduct --role-session-name lfproduct-dev-session)"
82+
export AWS_ACCESS_KEY_ID="$(echo "${data}" | jq -r '.Credentials.AccessKeyId')"
83+
export AWS_SECRET_ACCESS_KEY="$(echo "${data}" | jq -r '.Credentials.SecretAccessKey')"
84+
export AWS_SESSION_TOKEN="$(echo "${data}" | jq -r '.Credentials.SessionToken')"
85+
export AWS_SECURITY_TOKEN="$(echo "${data}" | jq -r '.Credentials.SessionToken')"
86+
87+
export AWS_SDK_LOAD_CONFIG=true
88+
export AWS_PROFILE='lfproduct-dev'
89+
export AWS_REGION='us-east-1'
90+
export AWS_DEFAULT_REGION='us-east-1'
91+
export DYNAMODB_AWS_REGION='us-east-1'
92+
export REGION='us-east-1'
93+
94+
export PRODUCT_DOMAIN='dev.lfcla.com'
95+
export ROOT_DOMAIN='lfcla.dev.platform.linuxfoundation.org'
96+
export PORT='5000'
97+
export STAGE='dev'
98+
# export STAGE='local'
99+
export GH_ORG_VALIDATION=false
100+
export DISABLE_LOCAL_PERMISSION_CHECKS=true
101+
export COMPANY_USER_VALIDATION=false
102+
export CLA_SIGNATURE_FILES_BUCKET=cla-signature-files-dev
103+
```
104+
105+
Call it via `` . ./setenv.sh `` or `` source setenv.sh `` to execute in the current shell.
106+
107+
You can reset environment variables by exiting the shell session or calling the following `unsetenv.sh` in the current shell via: `` . ./unsetenv.sh `` or `` source unsetenv.sh ``:
108+
```
109+
#!/bin/bash
110+
rm -rf /tmp/.aws
111+
unset AWS_PROFILE
112+
unset AWS_REGION
113+
unset AWS_ACCESS_KEY_ID
114+
unset AWS_SECRET_ACCESS_KEY
115+
unset PRODUCT_DOMAIN
116+
unset ROOT_DOMAIN
117+
unset PORT
118+
unset STAGE
119+
unset AWS_SESSION_TOKEN
120+
unset AWS_SECURITY_TOKEN
121+
unset GH_ORG_VALIDATION
122+
unset DISABLE_LOCAL_PERMISSION_CHECKS
123+
unset COMPANY_USER_VALIDATION
124+
unset CLA_SIGNATURE_FILES_BUCKET
125+
unset DYNAMODB_AWS_REGION
126+
unset REGION
127+
unset AWS_ROLE_ARN
128+
unset AWS_TOKEN_SERIAL
129+
unset AWS_SDK_LOAD_CONFIG
130+
```

‎dev.md‎

Lines changed: 45 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,46 @@ locally and simply point to the DEV environment. The `STAGE` environment
133133
variable controls where we point. Make sure you export/provide/setup the AWS
134134
properties in order to connect.
135135

136+
137+
When running on Linux it looks like `.venv` sets $HOME to /tmp, and then python backend is looking for the AWS config file in `~/.aws/config`
138+
This means it ends up in `/tmp/.aws/config`. You can use the following scritp to activate your environment (`setenv.secret`) via: `source setenv.secret`:
139+
```
140+
#!/bin/bash
141+
rm -rf /tmp/aws
142+
cp -R ~/.aws /tmp/.aws
143+
export AWS_SDK_LOAD_CONFIG=1
144+
export AWS_PROFILE='lfproduct-dev'
145+
export AWS_REGION='us-east-1'
146+
data="$(aws sts assume-role --role-arn arn:aws:iam::395594542180:role/product-contractors-role --profile lfproduct --role-session-name lfproduct-dev-session)"
147+
export AWS_ACCESS_KEY_ID="$(echo "${data}" | jq -r '.Credentials.AccessKeyId')"
148+
export AWS_SECRET_ACCESS_KEY="$(echo "${data}" | jq -r '.Credentials.SecretAccessKey')"
149+
export AWS_SESSION_TOKEN="$(echo "${data}" | jq -r '.Credentials.SessionToken')"
150+
export AWS_SECURITY_TOKEN="$(echo "${data}" | jq -r '.Credentials.SessionToken')"
151+
export PRODUCT_DOMAIN='dev.lfcla.com'
152+
export ROOT_DOMAIN='lfcla.dev.platform.linuxfoundation.org'
153+
export PORT='5000'
154+
export STAGE='dev'
155+
```
156+
157+
And the following one to unset the environment:
158+
```
159+
#!/bin/bash
160+
rm -rf /tmp/.aws
161+
unset AWS_SDK_LOAD_CONFIG=1
162+
unset AWS_PROFILE
163+
unset AWS_REGION
164+
unset AWS_ACCESS_KEY_ID
165+
unset AWS_SECRET_ACCESS_KEY
166+
unset AWS_SESSION_TOKEN
167+
unset AWS_SECURITY_TOKEN
168+
unset PRODUCT_DOMAIN
169+
unset ROOT_DOMAIN
170+
unset PORT
171+
unset STAGE
172+
```
173+
174+
Please refer to [aws_env.md](aws_env.md) for more details.
175+
136176
## Run the Python Backend
137177

138178
```bash
@@ -162,6 +202,9 @@ open http://localhost:5000/v2/health
162202
open http://localhost:5000/v2/user/<some_uuid_from_users_table>
163203
```
164204

205+
To expose service running on the localhost to the outside world use: `` ./utils/ngrok.sh ``.
206+
And then tets via: `` API_URL='https://[redacted].ngrok-free.app' ./scripts/health.sh `` from another host (anywhere in the world).
207+
165208
## Building and Running the Go Backend
166209

167210
Current Endpoints:
@@ -331,9 +374,9 @@ First build and setup the environment. Then simply run it:
331374

332375
```bash
333376
# Mac
334-
./cla-mac
377+
./bin/cla-mac
335378
# or linux
336-
./cla
379+
./bin/cla
337380
```
338381

339382
You should see the typical diagnostic details on startup indicating that it

‎setenv.sh‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!/bin/bash
2+
3+
rm -rf /tmp/aws
4+
cp -R /root/.aws /tmp/.aws
5+
6+
dev_arn="$(cat ./product-contractors-role.dev.secret)"
7+
data="$(aws sts assume-role --role-arn ${dev_arn} --profile lfproduct --role-session-name lfproduct-dev-session)"
8+
export AWS_ACCESS_KEY_ID="$(echo "${data}" | jq -r '.Credentials.AccessKeyId')"
9+
export AWS_SECRET_ACCESS_KEY="$(echo "${data}" | jq -r '.Credentials.SecretAccessKey')"
10+
export AWS_SESSION_TOKEN="$(echo "${data}" | jq -r '.Credentials.SessionToken')"
11+
export AWS_SECURITY_TOKEN="$(echo "${data}" | jq -r '.Credentials.SessionToken')"
12+
export GITHUB_OAUTH_TOKEN="$(cat /etc/github/oauth)"
13+
export DOCUSIGN_INTEGRATOR_KEY="$(cat ./DOCUSIGN_INTEGRATOR_KEY.secret)"
14+
export DOCUSIGN_USER_ID="$(cat ./DOCUSIGN_USER_ID.secret)"
15+
export DOCUSIGN_AUTH_SERVER="$(cat ./DOCUSIGN_AUTH_SERVER.secret)"
16+
export DOCUSIGN_ROOT_URL="$(cat ./DOCUSIGN_ROOT_URL.secret)"
17+
export DOCUSIGN_ACCOUNT_ID="$(cat ./DOCUSIGN_ACCOUNT_ID.secret)"
18+
19+
export AWS_SDK_LOAD_CONFIG=true
20+
export AWS_PROFILE='lfproduct-dev'
21+
export AWS_REGION='us-east-1'
22+
export AWS_DEFAULT_REGION='us-east-1'
23+
export DYNAMODB_AWS_REGION='us-east-1'
24+
export REGION='us-east-1'
25+
26+
export PRODUCT_DOMAIN='dev.lfcla.com'
27+
export ROOT_DOMAIN='lfcla.dev.platform.linuxfoundation.org'
28+
export PORT='5000'
29+
export STAGE='dev'
30+
# export STAGE='local'
31+
export GH_ORG_VALIDATION=false
32+
export DISABLE_LOCAL_PERMISSION_CHECKS=true
33+
export COMPANY_USER_VALIDATION=false
34+
export CLA_SIGNATURE_FILES_BUCKET=cla-signature-files-dev

‎sign-flow.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
EasyCLA Sign Flow: Sequence Overview
2+
3+
1. *User Creates a Pull Request (PR)*
4+
◦ A contributor initiates a PR in the repository hosted on GitHub, Gerrit, or GitLab.
5+
2. *Repository Triggers Activity Endpoint*
6+
• The repository platform sends a request to EasyCLA’s Python endpoint:
7+
◦ v2/repository-provider/{provider}/activity
8+
3. *EasyCLA Checks User Authorization*
9+
◦ EasyCLA internally verifies if the users involved in the PR are authorized to contribute to the repository.
10+
4. *Update Repository with User Status*
11+
◦ EasyCLA communicates back to the repository provider, updating the status of each user as either *signed* or *not signed*.
12+
5. *User Initiates Sign Process*
13+
◦ If a user is marked as *not signed*, they are prompted to begin the signing process and are redirected to the EasyCLA Contributor Console.
14+
6. *Contributor Chooses Sign Type*
15+
• Upon reaching the Contributor Console, the user selects one of two options:
16+
▪︎ *Individual Contributor*
17+
◦ *Corporate Contributor*
18+
7. *Individual Contributor Flow*
19+
• *a. Initiate Individual Signature Request*
20+
• The system invokes the Go-based endpoint:
21+
▪︎ v4/request-individual-signature
22+
◦ This action creates a new signature record with `signed = false` and initiates the signing process.
23+
• *a1. Redirect to DocuSign*
24+
◦ The API handles the integration with DocuSign, preparing a callback and redirect URL, and redirects the user to DocuSign for signing.
25+
• *a2. Completion of Signing*
26+
• Once the user completes the signing on DocuSign, a callback is triggered to:
27+
▪︎ v4/signed/individual/{installation_id}/{github_repository_id}/{change_request_id}
28+
◦ This endpoint updates the signature record’s `signed` flag to `true`, completing the process.
29+
8. *Corporate Contributor Flow*
30+
• *b. Initiate Corporate Signature Process*
31+
9. *Redirect to Company Search*
32+
▪︎ The user is redirected to a company search interface within the Contributor Console.
33+
10. *Search for Company*
34+
• Upon selecting a company, the system calls the Go-based search endpoint:
35+
• v3/organization/search?companyName=Info&amp;include-signing-entity-name=false
36+
▪︎ This retrieves the relevant company information.
37+
11. *Check and Prepare Employee Signature*
38+
• The system invokes the Python endpoint:
39+
• v2/check-prepare-employee-signature
40+
• This checks whether the company follows a Corporate CLA (CCLA) or an Entity CLA (ECLA) flow.
41+
• *i. If Company Has a CCLA:*
42+
◦ The system verifies if the user is authorized.
43+
◦ If *not authorized*, it prompts the user to contact the existing CLA manager for authorization.
44+
• The Go-based endpoint sends a notification to CLA managers:
45+
◦ v4/notify-cla-managers
46+
• An email is sent to the CLA managers, and the process ends.
47+
• *ii. If Company Does Not Have a CCLA:*
48+
◦ The system checks if the user is a CLA manager.
49+
• *A. User is a CLA Manager:*
50+
• Assigns CLA manager designee permissions via:
51+
◦ v4/company/{companySFID}/user/{userLFID}/claGroupID/{claGroupID}/is-cla-manager-designee
52+
• Verifies the assigned role:
53+
◦ v4/company/{companySFID}/user/{userLFID}/claGroupID/{claGroupID}/is-cla-manager-designee
54+
• If the role is confirmed, it calls the endpoint to request a corporate signature:
55+
◦ v4/request-corporate-signature
56+
◦ This creates the signature record, completing the process.
57+
• *B. User is Not a CLA Manager:*
58+
• Fetches company administrators using:
59+
◦ v4/company/{companySFID}/admin
60+
• Sends an invitation to become a company admin via:
61+
◦ /user/{userID}/invite-company-admin
62+
◦ An email is sent to the user to invite them as a company admin, concluding the process.

‎unsetenv.sh‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
rm -rf /tmp/.aws
3+
unset AWS_PROFILE
4+
unset AWS_REGION
5+
unset AWS_ACCESS_KEY_ID
6+
unset AWS_SECRET_ACCESS_KEY
7+
unset PRODUCT_DOMAIN
8+
unset ROOT_DOMAIN
9+
unset PORT
10+
unset STAGE
11+
unset AWS_SESSION_TOKEN
12+
unset AWS_SECURITY_TOKEN
13+
unset GH_ORG_VALIDATION
14+
unset DISABLE_LOCAL_PERMISSION_CHECKS
15+
unset COMPANY_USER_VALIDATION
16+
unset CLA_SIGNATURE_FILES_BUCKET
17+
unset DYNAMODB_AWS_REGION
18+
unset REGION
19+
unset AWS_ROLE_ARN
20+
unset AWS_TOKEN_SERIAL
21+
unset AWS_SDK_LOAD_CONFIG
22+
unset GITHUB_OAUTH_TOKEN
23+
unset DOCUSIGN_INTEGRATOR_KEY
24+
unset DOCUSIGN_USER_ID
25+
unset DOCUSIGN_AUTH_SERVER
26+
unset DOCUSIGN_ROOT_URL
27+
unset DOCUSIGN_ACCOUNT_ID

‎utils/describe_table.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/bash
2+
aws --profile lfproduct-dev dynamodb describe-table --table-name cla-dev-signatures

‎utils/example_pytest.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/bash
2+
pytest -vvv -s cla/tests/unit/test_docusign_models.py -p no:warnings -k test_request_individual_signature

‎utils/health_python_v2.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
# API_URL=https://[xyz].ngrok-free.app (defaults to localhost:5000)
3+
if [ -z "$API_URL" ]
4+
then
5+
export API_URL="http://localhost:5000"
6+
fi
7+
curl -s "${API_URL}/v2/health" | jq -r '.'

‎utils/lookup_company.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#!/bin/bash
2+
aws --profile lfproduct-dev dynamodb query --table-name cla-dev-companies --index-name company-name-index --key-condition-expression "company_name = :name" --expression-attribute-values '{":name":{"S":"Google LLC"}}'

0 commit comments

Comments
 (0)