mian >int

.circleci/config.yml

@@ -747,6 +747,8 @@ commands:
 
 
             make server_test
+          no_output_timeout: 20m
+
           environment:
             APPLICATION: '<< parameters.application >>'
             # 8 since this runs on xlarge with 8 CPUs
@@ -883,6 +885,7 @@ commands:
             --workers << parameters.workers >> \
             --shard="${SHARD}/${CIRCLE_NODE_TOTAL}" \
             << parameters.path >>
+          no_output_timeout: 60m
       - store_artifacts:
           path: playwright-report
       - run:
@@ -1345,6 +1348,7 @@ jobs:
             echo 'export MOVE_MIL_DOD_TLS_KEY=$(cat config/tls/devlocal-https.key)' >> $BASH_ENV
             source $BASH_ENV
             make db_dev_fresh
+          no_output_timeout: 60m
           environment:
             APPLICATION: app
             DB_PASSWORD: mysecretpassword
@@ -1727,6 +1731,7 @@ jobs:
           command: |
             export REACT_APP_ERROR_LOGGING=otel
             make client_build
+          no_output_timeout: 20m
       # only save the cache on default branch builds so that PRs don't pollute
       # the cache
       - when:
@@ -2010,6 +2015,18 @@ jobs:
           repo: app-tasks
       - announce_failure
 
+  # `prod_auth_check` checks if approved before going to prod
+  prod_auth_check:
+    executor: tls_small
+    steps:
+      - run: echo "build approved by $CIRCLE_USERNAME"
+      - run:
+          name: Check if Prod approval has rights
+          command: |
+            if [[ $CIRCLE_USERNAME != "josiahzimmerman-caci" && $CIRCLE_USERNAME != "deandreJones" && $CIRCLE_USERNAME != "cameroncaci" ]]; then
+               exit 1
+            fi
+      - announce_failure
   # All of the deploy tasks need to checkout the code so they can run the `scripts/do-exclusively` script
 
   # `deploy_dp3_migrations` deploys migrations to the dp3 environment
@@ -2320,6 +2337,10 @@ workflows:
       - integration_tests_load:
           requires:
             - compile_app_server
+            # limiting this run to integrationBranch only due to multiple branch pipeline
+          filters:
+              branches:
+                only: integrationTesting
 
       - client_test:
           requires:
@@ -2562,6 +2583,13 @@ workflows:
             - deploy_stg_app
             - deploy_stg_app_client_tls
 
+      - prod_auth_check:
+          requires:
+           - approve_prd_deploy
+          filters:
+            branches:
+              only: main
+
       - deploy_storybook_dp3:
           requires:
             - build_storybook
@@ -2576,28 +2604,28 @@ workflows:
 
       - push_otel_collector_image_prd:
           requires:
-            - approve_prd_deploy
+            - prod_auth_check
           filters:
             branches:
               only: main
 
       - push_app_prd:
           requires:
-            - approve_prd_deploy
+            - prod_auth_check
           filters:
             branches:
               only: main
 
       - push_migrations_prd:
           requires:
-            - approve_prd_deploy
+            - prod_auth_check
           filters:
             branches:
               only: main
 
       - push_tasks_prd:
           requires:
-            - approve_prd_deploy
+            - prod_auth_check
           filters:
             branches:
               only: main

.envrc

@@ -119,6 +119,11 @@ export DB_NAME_TEST=test_db
 export DB_RETRY_INTERVAL=5s
 export DB_SSL_MODE=disable
 
+# Experimental feature flags, these will be replaced by the config/env/*.env files for live deployments
+# Multi Move feature flag
+# This is utilized if flipt config does not receive a URL
+export FEATURE_FLAG_MULTI_MOVE=true
+
 # Okta.mil configuration
 
 # Tenant

.github/CODEOWNERS

@@ -6,4 +6,4 @@
 # owners will be requested for a review.
 # Add language specific code owners if it becomes relevant
 
-* @deandreJones @cameroncaci @josiahzimmerman-caci
+* @transcom/codeowners

.github/workflows/auto-approve.yml

@@ -13,6 +13,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: approve
-        uses: hmarr/auto-approve-action@v3.2.1
+        uses: hmarr/auto-approve-action@v4.0.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/go-auto-approve.yml

@@ -55,7 +55,7 @@ jobs:
     needs: [tidy]
     steps:
       - name: approve
-        uses: hmarr/auto-approve-action@v3.2.1
+        uses: hmarr/auto-approve-action@v4.0.0
         if: github.actor == 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'dependencies')
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'

Dockerfile.e2e

@@ -1,4 +1,4 @@
-FROM alpine:3.19.0
+FROM alpine:3.19.1
 
 # hadolint ignore=DL3017
 RUN apk upgrade --no-cache busybox

Dockerfile.migrations

@@ -1,4 +1,4 @@
-FROM alpine:3.19.0
+FROM alpine:3.19.1
 
 # hadolint ignore=DL3017
 RUN apk upgrade --no-cache busybox

Dockerfile.migrations_local

@@ -18,7 +18,7 @@ RUN rm -f bin/milmove && make bin/milmove
 # FINAL #
 #########
 
-FROM alpine:3.19.0
+FROM alpine:3.19.1
 
 # hadolint ignore=DL3017
 RUN apk upgrade --no-cache busybox

Dockerfile.reviewapp

@@ -45,7 +45,7 @@ RUN set -x \
   && make bin/generate-test-data
 
 # define migrations before client build since it doesn't need client
-FROM alpine:3.19.0 as migrate
+FROM alpine:3.19.1 as migrate
 
 COPY --from=server_builder /build/bin/rds-ca-2019-root.pem /bin/rds-ca-2019-root.pem
 COPY --from=server_builder /build/bin/milmove /bin/milmove

Dockerfile.tools

@@ -1,4 +1,4 @@
-FROM alpine:3.19.0
+FROM alpine:3.19.1
 
 # hadolint ignore=DL3017
 RUN apk upgrade --no-cache busybox

Dockerfile.tools_local

@@ -18,7 +18,7 @@ RUN rm -f bin/prime-api-client && make bin/prime-api-client
 # FINAL #
 #########
 
-FROM alpine:3.19.0
+FROM alpine:3.19.1
 
 # hadolint ignore=DL3017
 RUN apk upgrade --no-cache busybox

cmd/milmove/gen_disable_certs_migration.go

@@ -0,0 +1,158 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+	"text/template"
+
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/spf13/viper"
+
+	"github.com/transcom/mymove/pkg/cli"
+)
+
+const (
+	// FingerprintFlag is the Certificate Fingerprint flag
+	DisableFingerprintFlag string = "fingerprint"
+
+	// template for adding client certificates
+	createDisableCertsMigration string = `
+-- This migration removes an expired cert which had read/write access to all orders and the prime API.
+-- OKTA Email is always the SHA-256 digest of the client SSL certificate @api.move.mil
+-- Delete the public cert and the user role to prevent login privilege utilization.
+-- For data integrity not delete the user account but set it to inactive.
+
+DELETE FROM public.client_certs
+where
+user_id = (select id from users where okta_email = '{{.Fingerprint}}@api.move.mil');
+
+DELETE FROM users_roles
+where
+user_id = (select id from users where okta_email = '{{.Fingerprint}}@api.move.mil');
+
+UPDTE users
+SET active=false
+WHERE
+okta_email='{{.Fingerprint}}@api.move.mil';
+
+`
+)
+
+// CertsTemplate is a struct that stores the context from which to generate the migration
+type DisableCertsTemplate struct {
+	Fingerprint string
+}
+
+// InitCertsMigrationFlags initializes certs migration command line flags
+func InitDisableCertsMigrationFlags(flag *pflag.FlagSet) {
+	flag.StringP(FingerprintFlag, "f", "", "Certificate fingerprint in SHA 256 form")
+}
+
+// CheckCertsMigration validates command line flags
+func CheckDisableCertsMigration(v *viper.Viper) error {
+	if err := cli.CheckMigration(v); err != nil {
+		return err
+	}
+
+	if err := cli.CheckMigrationFile(v); err != nil {
+		return err
+	}
+
+	if err := cli.CheckCAC(v); err != nil {
+		return err
+	}
+
+	if !v.GetBool(cli.CACFlag) {
+		fingerprint := v.GetString(FingerprintFlag)
+		if len(fingerprint) == 0 {
+			return fmt.Errorf("%s is missing", FingerprintFlag)
+		}
+		sha256Pattern := "^[a-f0-9]{64}$"
+		_, err := regexp.MatchString(sha256Pattern, fingerprint)
+		if err != nil {
+			return errors.Errorf("Fingerprint must be a valid SHA 256 hash")
+		}
+	}
+	return nil
+}
+
+func initGenDisableCertsMigrationFlags(flag *pflag.FlagSet) {
+	// Migration Config
+	cli.InitMigrationFlags(flag)
+
+	// Migration File Config
+	cli.InitMigrationFileFlags(flag)
+
+	// CAC Config
+	cli.InitCACFlags(flag)
+
+	// Init Certs Migration Flags
+	InitCertsMigrationFlags(flag)
+
+	// Don't sort command line flags
+	flag.SortFlags = false
+}
+
+func genDisableCertsMigration(cmd *cobra.Command, args []string) error {
+	// println("Function genDisableCertsMigration")
+	err := cmd.ParseFlags(args)
+	if err != nil {
+		return errors.Wrap(err, "could not ParseFlags on args")
+	}
+
+	flag := cmd.Flags()
+	err = flag.Parse(os.Args[1:])
+	if err != nil {
+		return errors.Wrap(err, "could not parse flags")
+	}
+
+	v := viper.New()
+	err = v.BindPFlags(flag)
+	if err != nil {
+		return errors.Wrap(err, "could not bind flags")
+	}
+	v.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
+	v.AutomaticEnv()
+
+	err = CheckDisableCertsMigration(v)
+	if err != nil {
+		return err
+	}
+	migrationManifest := v.GetString(cli.MigrationManifestFlag)
+	migrationName := v.GetString(cli.MigrationNameFlag)
+	migrationVersion := v.GetString(cli.MigrationVersionFlag)
+
+	var fingerprint string
+	{
+		fingerprint = v.GetString(FingerprintFlag)
+	}
+
+	certsDisableTemplate := DisableCertsTemplate{
+		Fingerprint: fingerprint,
+	}
+
+	var t1 = template.Must(template.New("disable_certs_migration").Parse(createDisableCertsMigration))
+
+	secureMigrationName := fmt.Sprintf("%s_%s.up.sql", migrationVersion, migrationName)
+
+	err = createMigration(tempMigrationPath, secureMigrationName, t1, certsDisableTemplate)
+	if err != nil {
+		return err
+	}
+
+	t2 := template.Must(template.New("migrations/app/secure").Parse(localMigrationTemplate))
+	err = createMigration("./migrations/app/secure", secureMigrationName, t2, nil)
+	if err != nil {
+		return err
+	}
+
+	err = addMigrationToManifest(migrationManifest, secureMigrationName)
+	if err != nil {
+		return err
+	}
+	return nil
+}

cmd/milmove/main.go

@@ -97,6 +97,17 @@ func main() {
 	initGenCertsMigrationFlags(genCertsMigrationCommand.Flags())
 	genCommand.AddCommand(genCertsMigrationCommand)
 
+	genDisableCertsMigrationCommand := &cobra.Command{
+		Use:                   "disable-certs-migration [ -f FINGERPRINT ] -n MIGRATION_NAME",
+		Short:                 "Generate migrations required for removing client certificates",
+		Long:                  "Generate migrations required for removing client certificates",
+		RunE:                  genDisableCertsMigration,
+		DisableFlagsInUseLine: true,
+		SilenceErrors:         true, // not needed
+	}
+	initGenDisableCertsMigrationFlags(genDisableCertsMigrationCommand.Flags())
+	genCommand.AddCommand(genDisableCertsMigrationCommand)
+
 	genDutyStationsMigrationCommand := &cobra.Command{
 		Use:                   "duty-stations-migration -f CSV_FILENAME -n MIGRATION_NAME",
 		Short:                 "Generate migrations required for adding duty stations",

cmd/milmove/serve.go

@@ -543,7 +543,7 @@ func buildRoutingConfig(appCtx appcontext.AppContext, v *viper.Viper, redisPool
 
 	featureFlagFetcher, err := featureflag.NewFeatureFlagFetcher(cli.GetFliptFetcherConfig(v))
 	if err != nil {
-		appCtx.Logger().Fatal("Could not instantiate feature flag featcher", zap.Error(err))
+		appCtx.Logger().Fatal("Could not instantiate feature flag fetcher", zap.Error(err))
 	}
 
 	routingConfig.HandlerConfig = handlers.NewHandlerConfig(

config/env/demo.app-client-tls.env

@@ -29,3 +29,4 @@ TELEMETRY_ENABLED=true
 TELEMETRY_ENDPOINT=localhost:4317
 TELEMETRY_USE_XRAY_ID=true
 TLS_ENABLED=true
+FEATURE_FLAG_MULTI_MOVE=false

config/env/demo.app.env

@@ -33,3 +33,4 @@ TELEMETRY_ENDPOINT=localhost:4317
 TELEMETRY_USE_XRAY_ID=true
 TLS_ENABLED=true
 SERVE_PRIME_SIMULATOR=true
+FEATURE_FLAG_MULTI_MOVE=false

config/env/exp.app-client-tls.env

@@ -29,3 +29,4 @@ TLS_ENABLED=true
 TELEMETRY_ENABLED=false
 TELEMETRY_ENDPOINT=localhost:4317
 TELEMETRY_USE_XRAY_ID=false
+FEATURE_FLAG_MULTI_MOVE=false

config/env/exp.app.env

@@ -33,3 +33,4 @@ SERVE_PRIME_SIMULATOR=true
 TELEMETRY_ENABLED=true
 TELEMETRY_ENDPOINT=localhost:4317
 TELEMETRY_USE_XRAY_ID=true
+FEATURE_FLAG_MULTI_MOVE=true