Merge branch 'develop' into 5621-add-regional-user-support-for-stt-feedback-reports-page

Author: mattcoleanderson

.circleci/deployment/jobs.yml

@@ -125,7 +125,7 @@
           app-dir: tdrs-frontend
       - run:
           name: Run Cypress e2e tests
-          command: cd tdrs-frontend; yarn test:e2e-ci -- --config baseUrl="https://tdp-frontend-develop.acf.hhs.gov" --env cypressToken=$CYPRESS_TOKEN,apiUrl="https://tdp-frontend-develop.acf.hhs.gov/v1",adminUrl="https://tdp-frontend-develop.acf.hhs.gov/admin"
+          command: cd tdrs-frontend; yarn test:e2e-ci --config baseUrl="https://tdp-frontend-develop.acf.hhs.gov" --env cypressToken=$CYPRESS_TOKEN,apiUrl="https://tdp-frontend-develop.acf.hhs.gov/v1",adminUrl="https://tdp-frontend-develop.acf.hhs.gov/admin"
       - store_artifacts:
           path: tdrs-frontend/cypress/screenshots/
       - store_artifacts:

.github/ISSUE_TEMPLATE/release-tracker-issue-template.md

@@ -0,0 +1,90 @@
+---
+name: Release Tracker
+about: Track the release handoff to OFA, staging validation, and production deployment.
+title: Release Tracker vX.X.X
+labels: ''
+assignees: ''
+
+---
+
+# Release Tracker Issue Template
+
+**TITLE:** Release vX.X.X
+
+**CONTENT:**
+
+### 🔗 Included Pull Requests (Dev Team)
+*List the PRs included in this release. **Testing instructions for each feature must be located within these linked PRs.***
+* #XXX - [Feature/Bugfix Title]
+* #XXX - [Feature/Bugfix Title]
+
+### ➡️ URL of GitHub Release Tag:
+https://github.com/raft-tech/TANF-app/releases/tag/vX.X.X
+
+---
+
+### 📦 1. Preparation & Handoff (Dev / UX / PM)
+*Ensuring the release branch is ready and documented before ACF takes over.*
+
+- [ ] **Release Tagged:** `develop` branch tagged with the new release version.
+- [ ] **Release Branch Created:** Branch cut from `develop`.
+- [ ] **PR Opened to Staging:** PR opened from the release branch to `HHS:main`.
+- [ ] **Testing Instructions Verified:** All linked PRs contain clear testing instructions for ACF validation.
+- [ ] **UX/Documentation Check:** UX team has reviewed the PRs, confirmed user-facing changes, and started drafting Release Notes and Knowledge Center guidance.
+- [ ] **Migration Flag:** Does this release include a database migration? **[Yes / No]** *(If Yes, rollback from production will be highly complex).*
+- [ ] **Handoff Complete:** Issue assigned to @[Alex_username] for Staging validation.
+
+---
+
+### 🧪 2. Staging Validation & QASP (ACF / Alex)
+*Tracking the status once ACF takes over deployment and testing.*
+
+- [ ] **Staging Cleared:** Team notified that Staging is about to be updated/restarted.
+- [ ] **Deployed to Staging:** PR merged and deployed to the Staging environment.
+- [ ] **Feature Validation:** Testing instructions from the linked PRs have been executed and passed.
+- [ ] **Regression Validation:** Core workflows (login, submissions, data integrity, etc.) remain functional.
+
+**🐛 Bug Tracking Protocol (If issues are found in Staging):**
+1. **Non-Dev Team:** Add a comment on this issue describing the bug/unexpected behavior.
+2. **Dev Team:** Review the comment, investigate root cause, and open a formal GitHub Issue.
+3. **Triage Decision:**
+    * *Revert:* If isolated to a new feature, revert the PR out of the release candidate.
+    * *Hotfix:* Warranted **only if** the bug blocks the release entirely AND the production release is needed ASAP. (Dev cuts hotfix PR against the release branch -> merged to `HHS:main` for re-testing).
+
+- [ ] **Documentation Finalized:** UX team confirms all Release Notes and Knowledge Center updates are finalized and ready for launch.
+
+---
+
+### 🚦 3. Production-Ready Sign-Off
+- [ ] ACF/Alex confirms all PRs are validated, no blocking bugs exist, documentation is finalized, and the release is approved for production deployment.
+
+---
+
+### 🛟 4. Rollback & Contingency Reference
+*Review before production deployment.*
+
+* **Pipeline/CircleCI Failure:** Retry the pipeline. If it fails again, requires a hotfix to unblock.
+* **Missing Config/Secrets (App crashes on boot):** Do not rollback. ACF updates environment variables in the production console and restarts the app.
+* **Third-Party API Blocked in Prod:** Dev provides an emergency hotfix to hide the broken UI component.
+* **Performance/Database Lockup Under Load:** Dev writes an emergency hotfix for the offending query.
+* **Critical Regression Post-Deploy:**
+    * *No migrations in release:* Rollback the deployment to the previous stable version.
+    * *Migrations in release:* Rollback is generally not possible; requires an emergency hotfix.
+
+---
+
+### 🚀 5. Production Deployment (ACF / Alex)
+*The final deployment executed by ACF.*
+
+- [ ] **Maintenance Mode:** Alex has enabled the maintenance page to ensure users are out of the system.
+- [ ] **Deployed to Prod:** PR opened and merged to `HHS:master`, triggering deployment.
+- [ ] **Post-Launch Verification:** Quick check that the production environment is stable post-deploy, and the maintenance page is deactivated.
+
+---
+
+### 📢 6. Post-Release Communication (PM / UX / ACF)
+*Closing the loop with users and stakeholders.*
+
+- [ ] **Release Notes Published:** (UX team) Plain-language, user-facing release notes and Knowledge Center guidance have been published.
+- [ ] **Stakeholders Notified:** (ACF) Any required external communication regarding the new version has been sent.
+- [ ] **Close this Issue:** (ACF / PM) The release is fully deployed and stable.

.gitignore

@@ -12,6 +12,7 @@ tdrs-frontend/yarn-error.log*
 tdrs-frontend/vars-frontend.yml
 tdrs-frontend/pa11y-screenshots/*
 tdrs-frontend/cypress/reports*
+tdrs-frontend/test-results*.xml
 .eslintcache
 downloads/
 
@@ -125,8 +126,3 @@ cypress.env.json
 tdrs-backend/*.pg
 tdrs-backend/django.log
 
-# Pytest cache
-tdrs-backend/.pytest_cache/*
-
-# frontend cypress test results
-tdrs-frontend/test-results*.xml

Taskfile.yml

@@ -293,8 +293,8 @@ tasks:
     dir: tdrs-backend
     cmds:
       - export CYPRESS_TOKEN=local-cypress-token
-      - docker-compose exec web python manage.py delete_cypress_users -usernames new-cypress@teamraft.com cypress-admin@teamraft.com
-      - docker-compose exec web python manage.py loaddata cypress/users cypress/data_files cypress/regions cypress/profile_editing_regions cypress/profile_editing_users
+      - docker compose -f docker-compose.yml exec web python manage.py delete_cypress_users -usernames new-cypress@teamraft.com cypress-admin@teamraft.com cypress-data-analyst-dana@teamraft.com cypress-fra-data-analyst-derek@teamraft.com cypress-data-analyst-donna@teamraft.com cypress-fra-data-analyst-david@teamraft.com cypress-fra-ofa-regional-staff-rachel@acf.hhs.gov cypress-fra-ofa-regional-staff-robert@acf.hhs.gov cypress-fra-ofa-regional-staff-rita@acf.hhs.gov cypress-fra-ofa-regional-staff-ryan@acf.hhs.gov
+      - docker compose -f docker-compose.yml exec web python manage.py loaddata cypress/users cypress/data_files cypress/regions cypress/profile_editing_regions cypress/profile_editing_users
 
   frontend-e2e-local:
     desc: Run Cypress E2E tests locally (Cypress on host, app in docker)
@@ -303,9 +303,9 @@ tasks:
       - docker compose -f docker-compose.local.yml up -d --build tdp-frontend
       - |
         if command -v corepack >/dev/null 2>&1; then
-          corepack prepare yarn@4.6.0 --activate && CYPRESS_API_URL=http://localhost:8989/v1 CYPRESS_ADMIN_URL=http://localhost:8989/admin env -u ELECTRON_RUN_AS_NODE yarn test:e2e
+          corepack prepare yarn@4.6.0 --activate && env -u ELECTRON_RUN_AS_NODE yarn test:e2e
         else
-          CYPRESS_API_URL=http://localhost:8989/v1 CYPRESS_ADMIN_URL=http://localhost:8989/admin env -u ELECTRON_RUN_AS_NODE npx --yes @yarnpkg/cli-dist@4.6.0 test:e2e
+          env -u ELECTRON_RUN_AS_NODE npx --yes @yarnpkg/cli-dist@4.6.0 test:e2e
         fi
 
   frontend-e2e-ci-local:
@@ -320,11 +320,18 @@ tasks:
       - env -u ELECTRON_RUN_AS_NODE npx cypress verify || env -u ELECTRON_RUN_AS_NODE npx cypress install --force
       - |
         if command -v corepack >/dev/null 2>&1; then
-          corepack prepare yarn@4.6.0 --activate && CYPRESS_API_URL=http://localhost:8989/v1 CYPRESS_ADMIN_URL=http://localhost:8989/admin CYPRESS_TOKEN={{.CYPRESS_TOKEN}} env -u ELECTRON_RUN_AS_NODE yarn test:e2e-ci
+          env -u ELECTRON_RUN_AS_NODE yarn test:e2e-ci
         else
-          CYPRESS_API_URL=http://localhost:8989/v1 CYPRESS_ADMIN_URL=http://localhost:8989/admin CYPRESS_TOKEN={{.CYPRESS_TOKEN}} env -u ELECTRON_RUN_AS_NODE npx --yes @yarnpkg/cli-dist@4.6.0 test:e2e-ci
+          env -u ELECTRON_RUN_AS_NODE npx --yes @yarnpkg/cli-dist@4.6.0 test:e2e-ci
         fi
 
+  frontend-e2e-cmd:
+    desc: Run Cypress E2E tests headlessly from the command line (app in docker)
+    dir: tdrs-frontend
+    cmds:
+      - docker compose -f docker-compose.yml up -d --build tdp-frontend
+      - CYPRESS_TOKEN=${CYPRESS_TOKEN:-local-cypress-token} npm run test:e2e-ci
+
   k6:
     desc: Run k6 performance tests
     dir: performance-tests

tdrs-backend/celery_start.sh

@@ -3,20 +3,46 @@
 echo "Starting celery"
 
 if [[ $1 == "cloud" ]]; then
-    # Get the computed URI from VCAP_SERVICES
-    REDIS_URI=$(echo $VCAP_SERVICES | jq -r '."aws-elasticache-redis"[0].credentials.uri')
+    # Build the broker URL with TLS scheme and correct DB number (matching cloudgov.py logic)
+    REDIS_BASE=$(echo $VCAP_SERVICES | jq -r '."aws-elasticache-redis"[0].credentials | "rediss://:\(.password)@\(.host):\(.port)"')
+    ENV_NAME=$(echo $VCAP_APPLICATION | jq -r '.application_name | split("-") | last')
+    # Running python method, to not duplicate logic for determining the DB number
+    BROKER_DB=$(python -c "from tdpservice.common.util import get_cloudgov_broker_db_numbers; print(get_cloudgov_broker_db_numbers('${ENV_NAME}')['celery'])")
+    REDIS_URI="${REDIS_BASE}/${BROKER_DB}"
+
+    # Log the broker config (redact password)
+    echo "REDIS_URI: $(echo $REDIS_URI | sed 's/:.*@/:\/\/***@/')"
+    echo "ENV_NAME: ${ENV_NAME}, BROKER_DB: ${BROKER_DB}"
+
+    if [[ -z "$REDIS_BASE" || "$REDIS_BASE" == "rediss://:@:" ]]; then
+        echo "ERROR: Failed to extract Redis credentials from VCAP_SERVICES"
+        exit 1
+    fi
+    if [[ -z "$BROKER_DB" ]]; then
+        echo "ERROR: Failed to determine broker DB number for env '${ENV_NAME}'"
+        exit 1
+    fi
 
     echo "Starting Alloy"
     mkdir /home/vcap/app/alloy-data
     wget https://github.com/grafana/alloy/releases/download/v1.9.1/alloy-boringcrypto-linux-amd64.zip
-    unzip -a alloy-boringcrypto-linux-amd64.zip && rm -rf alloy-boringcrypto-linux-amd64.zip
-    chmod +x alloy-boringcrypto-linux-amd64
-    ./alloy-boringcrypto-linux-amd64 run --server.http.listen-addr=0.0.0.0:12345 --storage.path=/home/vcap/app/alloy-data /home/vcap/app/plg/alloy/alloy.config &
+    if ! unzip -a alloy-boringcrypto-linux-amd64.zip; then
+        echo "ERROR: Failed to unzip Alloy"
+    else
+        rm -rf alloy-boringcrypto-linux-amd64.zip
+        chmod +x alloy-boringcrypto-linux-amd64
+        ./alloy-boringcrypto-linux-amd64 run --server.http.listen-addr=0.0.0.0:12345 --storage.path=/home/vcap/app/alloy-data /home/vcap/app/plg/alloy/alloy.config &
+        echo "Alloy started (PID: $!)"
+    fi
 
     echo "Starting the Celery Exporter"
-    curl -L https://github.com/danihodovic/celery-exporter/releases/download/latest/celery-exporter -o ./celery-exporter
-    chmod +x ./celery-exporter
-    ./celery-exporter --broker-url="$REDIS_URI" --port 9808 &
+    if ! curl -fL https://github.com/danihodovic/celery-exporter/releases/download/latest/celery-exporter -o ./celery-exporter; then
+        echo "ERROR: Failed to download celery-exporter"
+    else
+        chmod +x ./celery-exporter
+        ./celery-exporter --broker-url="$REDIS_URI" --port 9808 &
+        echo "Celery Exporter started (PID: $!)"
+    fi
 fi
 
 # Celery worker config can be found here: https://docs.celeryq.dev/en/stable/userguide/workers.html#:~:text=The-,hostname,-argument%20can%20expand

tdrs-backend/tdpservice/fixtures/cypress/profile_editing_regions.json

@@ -30,5 +30,37 @@
             "user": "f6a7b8c9-d0e1-4f5a-3b4c-5d6e7f8a9b0c",
             "region": 3
         }
+    },
+    {
+        "model": "users.regionmeta",
+        "pk": 1005,
+        "fields": {
+            "user": "0a1b2c3d-4e5f-4a6b-8c9d-1e2f3a4b5c6d",
+            "region": 5
+        }
+    },
+    {
+        "model": "users.regionmeta",
+        "pk": 1006,
+        "fields": {
+            "user": "0a1b2c3d-4e5f-4a6b-8c9d-1e2f3a4b5c6d",
+            "region": 3
+        }
+    },
+    {
+        "model": "users.regionmeta",
+        "pk": 1007,
+        "fields": {
+            "user": "1b2c3d4e-5f6a-4b7c-8d9e-2f3a4b5c6d7e",
+            "region": 5
+        }
+    },
+    {
+        "model": "users.regionmeta",
+        "pk": 1008,
+        "fields": {
+            "user": "1b2c3d4e-5f6a-4b7c-8d9e-2f3a4b5c6d7e",
+            "region": 3
+        }
     }
 ]

tdrs-backend/tdpservice/fixtures/cypress/profile_editing_users.json

@@ -190,5 +190,73 @@
                 ]
             ]
         }
+    },
+    {
+        "model": "users.user",
+        "pk": "0a1b2c3d-4e5f-4a6b-8c9d-1e2f3a4b5c6d",
+        "fields": {
+            "password": "",
+            "last_login": null,
+            "is_superuser": false,
+            "username": "cypress-fra-ofa-regional-staff-rita@acf.hhs.gov",
+            "first_name": "FRA OFA Regional Staff",
+            "last_name": "Rita",
+            "email": "cypress-fra-ofa-regional-staff-rita@acf.hhs.gov",
+            "is_staff": false,
+            "is_active": true,
+            "date_joined": "2025-11-26T00:00:00Z",
+            "stt": null,
+            "login_gov_uuid": null,
+            "hhs_id": null,
+            "account_approval_status": "Approved",
+            "access_requested_date": "2025-11-26T00:00:00Z",
+            "feature_flags": {},
+            "groups": [
+                [
+                    "OFA Regional Staff"
+                ]
+            ],
+            "user_permissions": [
+                [
+                    "has_fra_access",
+                    "users",
+                    "user"
+                ]
+            ]
+        }
+    },
+    {
+        "model": "users.user",
+        "pk": "1b2c3d4e-5f6a-4b7c-8d9e-2f3a4b5c6d7e",
+        "fields": {
+            "password": "",
+            "last_login": null,
+            "is_superuser": false,
+            "username": "cypress-fra-ofa-regional-staff-ryan@acf.hhs.gov",
+            "first_name": "FRA OFA Regional Staff",
+            "last_name": "Ryan",
+            "email": "cypress-fra-ofa-regional-staff-ryan@acf.hhs.gov",
+            "is_staff": false,
+            "is_active": true,
+            "date_joined": "2025-11-26T00:00:00Z",
+            "stt": null,
+            "login_gov_uuid": null,
+            "hhs_id": null,
+            "account_approval_status": "Approved",
+            "access_requested_date": "2025-11-26T00:00:00Z",
+            "feature_flags": {},
+            "groups": [
+                [
+                    "OFA Regional Staff"
+                ]
+            ],
+            "user_permissions": [
+                [
+                    "has_fra_access",
+                    "users",
+                    "user"
+                ]
+            ]
+        }
     }
 ]

tdrs-backend/tdpservice/settings/__init__.py

@@ -1,8 +1,6 @@
 from __future__ import absolute_import
 
 import logging
-import os
-
 from django.conf import settings
 
 # This will make sure the app is always imported when

tdrs-backend/tdpservice/users/admin.py

@@ -223,9 +223,11 @@ def status_with_indicator(self, obj):
             "pending": "orange",
             "approved": "green",
             "rejected": "red",
+            "cancelled": "gray",
         }
+        color = colors.get(obj.status, "black")
         return mark_safe(
-            f'<span style="color: {colors[obj.status]};">{obj.get_status_display()}</span>'
+            f'<span style="color: {color};">{obj.get_status_display()}</span>'
         )
 
     status_with_indicator.short_description = "Status"

tdrs-backend/tdpservice/users/migrations/0057_alter_userchangerequest_status.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.10 on 2026-03-17 13:30
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('users', '0056_historicaluser_historicalregionmeta_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='userchangerequest',
+            name='status',
+            field=models.CharField(choices=[('pending', 'Pending'), ('approved', 'Approved'), ('rejected', 'Rejected'), ('cancelled', 'Cancelled')], default='pending', help_text='The current status of this change request', max_length=20),
+        ),
+    ]