diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 0000000..061cacf --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,41 @@ +// For format details, see https://aka.ms/devcontainer.json. For config options, see the +// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu +{ + "name": "Ubuntu", + // Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile + "image": "mcr.microsoft.com/devcontainers/base:jammy", + "features": { + "ghcr.io/devcontainers/features/node:1": {}, + "ghcr.io/devcontainers/features/aws-cli:1": {}, + "ghcr.io/jungaretti/features/make:1": {}, + "ghcr.io/customink/codespaces-features/sam-cli:1": {}, + "ghcr.io/devcontainers/features/python:1": {} + }, + + // Features to add to the dev container. More info: https://containers.dev/features. + // "features": {}, + + // Use 'forwardPorts' to make a list of ports inside the container available locally. + "forwardPorts": [ + 8080, + 5173 + ], + "customizations": { + "vscode": { + "extensions": [ + "EditorConfig.EditorConfig", + "waderyan.gitblame", + "Gruntfuggly.todo-tree" + ] + } + } + + // Use 'postCreateCommand' to run commands after the container is created. + // "postCreateCommand": "uname -a", + + // Configure tool-specific properties. + // "customizations": {}, + + // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root. + // "remoteUser": "root" +} diff --git a/.editorconfig b/.editorconfig index b4e3016..6f2f4eb 100644 --- a/.editorconfig +++ b/.editorconfig @@ -10,4 +10,8 @@ trim_trailing_whitespace = true [*.md] max_line_length = off -trim_trailing_whitespace = false \ No newline at end of file +trim_trailing_whitespace = false + +[{Makefile,**.mk}] +# Use tabs for indentation (Makefiles require tabs) +indent_style = tab diff --git a/.env.sample b/.env.sample index 3eb9dda..b253798 100644 --- a/.env.sample +++ b/.env.sample @@ -1,4 +1,5 @@ -AadValidClientId="39c28870-94e4-47ee-b4fb-affe0bf96c9f" AadClientSecret="" RunEnvironment="dev" -JwtSigningKey="YOUR_RANDOM_STRING HERE" \ No newline at end of file +JwtSigningKey="YOUR_RANDOM_STRING HERE" +VITE_RUN_ENVIRONMENT="local-dev" +AWS_REGION=us-east-1 diff --git a/.eslintignore b/.eslintignore index 5e8f050..dbfc198 100644 --- a/.eslintignore +++ b/.eslintignore @@ -1 +1,2 @@ -/**/*.d.ts \ No newline at end of file +/**/*.d.ts +vite.config.ts \ No newline at end of file diff --git a/.eslintrc b/.eslintrc index ff2dd6a..37e59b2 100644 --- a/.eslintrc +++ b/.eslintrc @@ -1,8 +1,10 @@ { - "extends": ["plugin:prettier/recommended", "plugin:@typescript-eslint/recommended"], + "extends": [ + "plugin:prettier/recommended", + "plugin:@typescript-eslint/recommended" + ], "plugins": ["import"], "rules": { - // turn on errors for missing imports "import/no-unresolved": "error", "import/extensions": [ "error", @@ -13,18 +15,20 @@ "ts": "never", "tsx": "never" } - ], - "no-unused-vars": "off", - "max-classes-per-file": "off", - "func-names": "off", - "@typescript-eslint/no-unused-vars": [ - "warn", // or "error" - { - "argsIgnorePattern": "^_", - "varsIgnorePattern": "^_", - "caughtErrorsIgnorePattern": "^_" - } - ] + ], + "no-unused-vars": "off", + "max-classes-per-file": "off", + "func-names": "off", + "@typescript-eslint/no-unused-vars": [ + "warn", + { + "argsIgnorePattern": "^_", + "varsIgnorePattern": "^_", + "caughtErrorsIgnorePattern": "^_" + } + ], + "@typescript-eslint/no-explicit-any": "warn", + "@typescript-eslint/explicit-module-boundary-types": "off" }, "settings": { "import/parsers": { @@ -32,7 +36,11 @@ }, "import/resolver": { "typescript": { - "alwaysTryTypes": true + "alwaysTryTypes": true, + "project": [ + "src/api/tsconfig.json", // Path to tsconfig.json in src/api + "src/ui/tsconfig.json" // Path to tsconfig.json in src/ui + ] } } }, @@ -42,6 +50,13 @@ "rules": { "@typescript-eslint/no-explicit-any": "off" } + }, + { + "files": ["src/ui/*", "src/ui/**/*"], + "rules": { + "@typescript-eslint/no-explicit-any": "off", + "@typescript-eslint/no-unused-vars": "off" + } } ] } diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs new file mode 100644 index 0000000..3bf6651 --- /dev/null +++ b/.git-blame-ignore-revs @@ -0,0 +1 @@ +f8a107d276786cb76b22e43dbb1860f85d2a2289 \ No newline at end of file diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml index 54e8cd4..9e6683e 100644 --- a/.github/workflows/deploy-dev.yml +++ b/.github/workflows/deploy-dev.yml @@ -14,7 +14,7 @@ jobs: - name: Set up Node uses: actions/setup-node@v4 with: - node-version: 20.x + node-version: 22.x - uses: actions/checkout@v4 env: HUSKY: "0" @@ -27,17 +27,17 @@ jobs: deploy-dev: runs-on: ubuntu-latest concurrency: - group: ${{ github.event.repository.name }}-dev + group: ${{ github.event.repository.name }}-dev-env cancel-in-progress: false environment: "AWS DEV" - name: Deploy to AWS DEV + name: Deploy to DEV needs: - test-unit steps: - name: Set up Node for testing uses: actions/setup-node@v4 with: - node-version: 20.x + node-version: 22.x - uses: actions/checkout@v4 env: HUSKY: "0" @@ -53,22 +53,34 @@ jobs: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} aws-region: us-east-1 - - run: make deploy_dev + - name: Publish to AWS + run: make deploy_dev env: HUSKY: "0" - test: + VITE_RUN_ENVIRONMENT: dev + - name: Publish to Cloudflare + uses: cloudflare/pages-action@v1 + with: + apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} + accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + projectName: management-ui-dev + directory: dist_ui/ + gitHubToken: ${{ secrets.GITHUB_TOKEN }} + branch: main + + test-dev: runs-on: ubuntu-latest - name: Run Live Integration Tests + name: Run Live Tests needs: - deploy-dev concurrency: - group: ${{ github.event.repository.name }}-dev + group: ${{ github.event.repository.name }}-dev-env cancel-in-progress: false steps: - name: Set up Node uses: actions/setup-node@v4 with: - node-version: 20.x + node-version: 22.x - uses: actions/checkout@v4 env: HUSKY: "0" @@ -76,5 +88,14 @@ jobs: uses: actions/setup-python@v5 with: python-version: 3.11 + - name: Run health check + run: make dev_health_check - name: Run live testing run: make test_live_integration + env: + JWT_KEY: ${{ secrets.JWT_KEY }} + - name: Run E2E testing + run: make test_e2e + env: + PLAYWRIGHT_USERNAME: ${{ secrets.PLAYWRIGHT_USERNAME }} + PLAYWRIGHT_PASSWORD: ${{ secrets.PLAYWRIGHT_PASSWORD }} diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml index cb99f8c..e2bab4a 100644 --- a/.github/workflows/deploy-prod.yml +++ b/.github/workflows/deploy-prod.yml @@ -11,10 +11,10 @@ jobs: runs-on: ubuntu-latest name: Run Unit Tests steps: - - name: Set up Node for testing + - name: Set up Node uses: actions/setup-node@v4 with: - node-version: 20.x + node-version: 22.x - uses: actions/checkout@v4 env: HUSKY: "0" @@ -30,14 +30,14 @@ jobs: group: ${{ github.event.repository.name }}-dev cancel-in-progress: false environment: "AWS DEV" - name: Deploy to AWS DEV + name: Deploy to DEV needs: - test-unit steps: - name: Set up Node for testing uses: actions/setup-node@v4 with: - node-version: 20.x + node-version: 22.x - uses: actions/checkout@v4 env: HUSKY: "0" @@ -53,48 +53,68 @@ jobs: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} aws-region: us-east-1 - - run: make deploy_dev + - name: Publish to AWS + run: make deploy_dev env: HUSKY: "0" - test: + VITE_RUN_ENVIRONMENT: dev + - name: Publish to Cloudflare + uses: cloudflare/pages-action@v1 + with: + apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} + accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + projectName: management-ui-dev + directory: dist_ui/ + gitHubToken: ${{ secrets.GITHUB_TOKEN }} + branch: main + + test-dev: runs-on: ubuntu-latest - name: Run Live Integration Tests + name: Run Live Tests needs: - deploy-dev concurrency: group: ${{ github.event.repository.name }}-dev cancel-in-progress: false steps: - - name: Set up Node for testing + - name: Set up Node uses: actions/setup-node@v4 with: - node-version: 20.x + node-version: 22.x - uses: actions/checkout@v4 env: - HUSKY: "0" + HUSKY: "0" - name: Set up Python 3.11 for testing uses: actions/setup-python@v5 with: python-version: 3.11 - name: Run live testing run: make test_live_integration - deploy-aws-prod: + env: + JWT_KEY: ${{ secrets.JWT_KEY }} + - name: Run E2E testing + run: make test_e2e + env: + PLAYWRIGHT_USERNAME: ${{ secrets.PLAYWRIGHT_USERNAME }} + PLAYWRIGHT_PASSWORD: ${{ secrets.PLAYWRIGHT_PASSWORD }} + + deploy-prod: runs-on: ubuntu-latest - name: Deploy to AWS PROD + name: Deploy to Prod concurrency: group: ${{ github.event.repository.name }}-prod cancel-in-progress: false needs: - - test + - test-dev environment: "AWS PROD" steps: - name: Set up Node for testing uses: actions/setup-node@v4 with: - node-version: 20.x + node-version: 22.x - uses: actions/checkout@v4 env: - HUSKY: "0" + HUSKY: "0" - uses: aws-actions/setup-sam@v2 with: use-installer: true @@ -107,14 +127,26 @@ jobs: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} aws-region: us-east-1 - - run: make deploy_prod + - name: Publish to AWS + run: make deploy_prod env: HUSKY: "0" + VITE_RUN_ENVIRONMENT: prod + - name: Publish to Cloudflare + uses: cloudflare/pages-action@v1 + with: + apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} + accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} + projectName: management-ui-prod + directory: dist_ui/ + gitHubToken: ${{ secrets.GITHUB_TOKEN }} + branch: main + health-check-prod: runs-on: ubuntu-latest name: Confirm services healthy needs: - - deploy-aws-prod + - deploy-prod concurrency: group: ${{ github.event.repository.name }}-prod cancel-in-progress: false @@ -122,9 +154,9 @@ jobs: - name: Set up Node for testing uses: actions/setup-node@v4 with: - node-version: 20.x + node-version: 22.x - uses: actions/checkout@v4 env: - HUSKY: "0" + HUSKY: "0" - name: Call the health check script run: make prod_health_check diff --git a/.gitignore b/.gitignore index 4461ec8..4ce03d7 100644 --- a/.gitignore +++ b/.gitignore @@ -133,6 +133,12 @@ dist .aws-sam/ build/ dist/ +dist_ui/ *.pyc -__pycache__ \ No newline at end of file +__pycache__ +/test-results/ +/playwright-report/ +/blob-report/ +/playwright/.cache/ +dist_devel/ diff --git a/.husky/pre-commit b/.husky/pre-commit index 965b109..de2afa0 100644 --- a/.husky/pre-commit +++ b/.husky/pre-commit @@ -1 +1,15 @@ -yarn run lint-staged \ No newline at end of file +# Get all staged files +STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACMR) + +if [ -n "$STAGED_FILES" ]; then + echo "Running lint with fix on staged files..." + # Run lint on all files (modifies files in the working directory) + yarn lint --fix + yarn prettier:write + + echo "Re-adding originally staged files to the staging area..." + # Re-add only the originally staged files + echo "$STAGED_FILES" | xargs git add +else + echo "No staged files to process." +fi diff --git a/.lintstagedrc.json b/.lintstagedrc.json index 33cf71e..3fdff7d 100644 --- a/.lintstagedrc.json +++ b/.lintstagedrc.json @@ -1,6 +1 @@ -{ - "*.ts": [ - "yarn run prettier:write", - "yarn run lint --fix" - ] - } \ No newline at end of file +{ "src/**/*.{ts,js,tsx,jsx}": ["yarn run lint --fix", "yarn run prettier:write"] } \ No newline at end of file diff --git a/.yarnrc.yml b/.yarnrc.yml new file mode 100644 index 0000000..3186f3f --- /dev/null +++ b/.yarnrc.yml @@ -0,0 +1 @@ +nodeLinker: node-modules diff --git a/LICENSE b/LICENSE index d2e28a7..d4c7438 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,6 @@ BSD 3-Clause License -Copyright (c) 2024, ACM@UIUC +Copyright (c) 2024-2025, ACM@UIUC Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: diff --git a/Makefile b/Makefile index acb21e2..c292711 100644 --- a/Makefile +++ b/Makefile @@ -11,19 +11,21 @@ integration_test_directory_root = tests/live_integration/ # CHANGE ME (as needed) application_key=infra-core-api application_name="InfraCoreApi" -techlead="dsingh14@illinois.edu" +techlead="tarasha2@illinois.edu" region="us-east-1" # DO NOT CHANGE common_params = --no-confirm-changeset \ - --no-fail-on-empty-changeset \ - --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND \ - --region $(region) \ - --stack-name $(application_key) \ + --no-fail-on-empty-changeset \ + --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND \ + --region $(region) \ + --stack-name $(application_key) \ --tags "project=$(application_key)" "techlead=$(techlead)" \ --s3-prefix $(application_key) \ --resolve-s3 +GIT_HASH := $(shell git rev-parse --short HEAD) + .PHONY: build clean check_account_prod: @@ -42,38 +44,49 @@ check_account_dev: clean: rm -rf .aws-sam rm -rf node_modules/ - rm -rf src/dist/ - rm -rf src/build/ + rm -rf src/api/node_modules/ + rm -rf src/ui/node_modules/ + rm -rf dist/ + rm -rf dist_ui/ + rm -rf dist_devel/ build: src/ cloudformation/ docs/ yarn -D - yarn build:lambda + VITE_BUILD_HASH=$(GIT_HASH) yarn build + cp -r src/api/resources/ dist/api/resources + rm -rf dist/lambda/sqs sam build --template-file cloudformation/main.yml local: - yarn run dev + VITE_BUILD_HASH=$(GIT_HASH) yarn run dev -deploy_prod: check_account_prod build +deploy_prod: check_account_prod build aws sts get-caller-identity --query Account --output text sam deploy $(common_params) --parameter-overrides $(run_env)=prod $(set_application_prefix)=$(application_key) $(set_application_name)="$(application_name)" deploy_dev: check_account_dev build sam deploy $(common_params) --parameter-overrides $(run_env)=dev $(set_application_prefix)=$(application_key) $(set_application_name)="$(application_name)" -install_test_deps: +install: yarn -D + pip install cfn-lint -test_live_integration: install_test_deps +test_live_integration: install yarn test:live -test_unit: install_test_deps +test_unit: install yarn typecheck yarn lint + cfn-lint cloudformation/**/* --ignore-templates cloudformation/phony-swagger.yml yarn prettier yarn test:unit +test_e2e: install + yarn playwright install + yarn test:e2e + dev_health_check: - curl -f https://$(application_key).aws.qa.acmuiuc.org/api/v1/healthz + curl -f https://$(application_key).aws.qa.acmuiuc.org/api/v1/healthz && curl -f https://manage.qa.acmuiuc.org prod_health_check: - curl -f https://$(application_key).aws.acmuiuc.org/api/v1/healthz \ No newline at end of file + curl -f https://$(application_key).aws.acmuiuc.org/api/v1/healthz && curl -f https://manage.acm.illinois.edu diff --git a/README.md b/README.md index 6d2d289..8805535 100644 --- a/README.md +++ b/README.md @@ -1,41 +1,10 @@ -# ACM @ UIUC Core API +# ACM @ UIUC Core +This repository is split into multiple parts: +* `src/api/` for the API source code +* `src/ui/` for the UI source code +* `src/common/` for common modules between the API and the UI (such as constants, types, errors, etc.) -## Run Locally -1. Copy `.env.sample` as `.env` and set the `JwtSigningKey` to a random string. -2. Enable Tailscale VPN so you can reach the development database in AWS -3. Log into AWS with `aws configure sso` so you can retrieve the AWS secret and configuration. -4. `yarn -D` -5. `make check_account_dev` - If this fails make sure that AWS is configured. -6. `make local` +## Getting Started +You will need node>=22 installed, as well as the AWS CLI and the AWS SAM CLI. The best way to work with all of this is to open the environment in a container within your IDE (VS Code should prompt you to do so: use "Clone in Container" for best performance). This container will have all needed software installed. -## Build for AWS Lambda -1. `make clean` -2. `make build` - -## Deploy to AWS env - -1. Get AWS credentials with `aws configure sso` -2. Ensure AWS profile is set to the right account (DEV or PROD). -3. Run `make deploy_dev` or `make deploy_prod`. - -## Generating JWT token - -Create a `.env` file containing your `AadClientSecret`. - -```bash -node --env-file=.env get_msft_jwt.js -``` - -## Configuring AWS - -SSO URL: `https://acmillinois.awsapps.com/start/#` - -``` -aws configure sso -``` - -Log in with SSO. Then, export the `AWS_PROFILE` that the above command outputted. - -```bash -export AWS_PROFILE=ABC-DEV -``` +Then, run `make install` to install all packages, and `make local` to start the UI and API servers! The UI will be accessible on `http://localhost:5173/` and the API on `http://localhost:8080/`. diff --git a/cloudformation/custom-domain.yml b/cloudformation/custom-domain.yml new file mode 100644 index 0000000..bb8b331 --- /dev/null +++ b/cloudformation/custom-domain.yml @@ -0,0 +1,50 @@ +Parameters: + GWCertArn: + Description: Certificate ARN + Type: String + GWBaseDomainName: + Description: Base domain name + Type: String + GWApiId: + Description: API ID + Type: String + GWHostedZoneId: + Description: Hosted Zone ID + Type: String + RunEnvironment: + Type: String + AllowedValues: [ 'dev', 'prod' ] + RecordName: + Type: String + +Conditions: + IsDev: !Equals [!Ref RunEnvironment, 'dev'] + +Resources: + CustomDomainName: + Type: AWS::ApiGateway::DomainName + Properties: + RegionalCertificateArn: !Ref GWCertArn + EndpointConfiguration: + Types: + - REGIONAL + DomainName: !Sub "${RecordName}.${GWBaseDomainName}" + SecurityPolicy: TLS_1_2 + + CDApiMapping: + Type: 'AWS::ApiGatewayV2::ApiMapping' + Properties: + DomainName: !Ref CustomDomainName + ApiId: !Ref GWApiId + Stage: default + + CDRoute53RecordSetDev: + Condition: IsDev + Type: AWS::Route53::RecordSet + Properties: + HostedZoneId: !Ref GWHostedZoneId + Name: !Sub "${RecordName}.${GWBaseDomainName}" + Type: A + AliasTarget: + DNSName: !GetAtt CustomDomainName.RegionalDomainName + HostedZoneId: !GetAtt CustomDomainName.RegionalHostedZoneId diff --git a/cloudformation/iam.yml b/cloudformation/iam.yml index fd00d2b..6493af7 100644 --- a/cloudformation/iam.yml +++ b/cloudformation/iam.yml @@ -10,10 +10,16 @@ Parameters: LambdaFunctionName: Type: String AllowedPattern: ^[a-zA-Z0-9]+[a-zA-Z0-9-]+[a-zA-Z0-9]+$ + SesEmailDomain: + Type: String + SqsQueueArn: + Type: String Resources: ApiLambdaIAMRole: Type: AWS::IAM::Role Properties: + ManagedPolicyArns: + - arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole AssumeRolePolicyDocument: Version: '2012-10-17' Statement: @@ -24,6 +30,29 @@ Resources: Service: - lambda.amazonaws.com Policies: + - PolicyDocument: + Version: '2012-10-17' + Statement: + - Action: + - ses:SendEmail + - ses:SendRawEmail + Effect: Allow + Resource: "*" + Condition: + StringEquals: + ses:FromAddress: !Sub "membership@${SesEmailDomain}" + ForAllValues:StringLike: + ses:Recipients: + - "*@illinois.edu" + PolicyName: ses-membership + - PolicyDocument: + Version: '2012-10-17' + Statement: + - Action: + - sqs:SendMessage + Effect: Allow + Resource: !Ref SqsQueueArn + PolicyName: lambda-sqs - PolicyDocument: Version: '2012-10-17' Statement: @@ -73,6 +102,12 @@ Resources: - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-events-ticketing-metadata - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-merchstore-metadata/* - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-merchstore-metadata + - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-iam-userroles + - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-iam-userroles/* + - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-iam-grouproles + - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-iam-grouproles/* + - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-stripe-links + - !Sub arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/infra-core-api-stripe-links/* PolicyName: lambda-dynamo Outputs: @@ -81,4 +116,4 @@ Outputs: Value: Fn::GetAtt: - ApiLambdaIAMRole - - Arn \ No newline at end of file + - Arn diff --git a/cloudformation/main.yml b/cloudformation/main.yml index 46a55c9..8cac567 100644 --- a/cloudformation/main.yml +++ b/cloudformation/main.yml @@ -22,6 +22,14 @@ Parameters: Default: false Type: String AllowedValues: [true, false] + SqsLambdaTimeout: + Description: How long the SQS lambda is permitted to run (in seconds) + Default: 300 + Type: Number + SqsMessageTimeout: + Description: MessageVisibilityTimeout for the SQS Lambda queue (should be at least 6xSqsLambdaTimeout) + Default: 1800 + Type: Number Conditions: IsProd: !Equals [!Ref RunEnvironment, 'prod'] @@ -32,17 +40,23 @@ Mappings: General: dev: LogRetentionDays: 7 + SesDomain: "aws.qa.acmuiuc.org" prod: - LogRetentionDays: 30 + LogRetentionDays: 365 + SesDomain: "acm.illinois.edu" ApiGwConfig: dev: ApiCertificateArn: arn:aws:acm:us-east-1:427040638965:certificate/63ccdf0b-d2b5-44f0-b589-eceffb935c23 HostedZoneId: Z04502822NVIA85WM2SML ApiDomainName: "aws.qa.acmuiuc.org" + EnvDomainName: "aws.qa.acmuiuc.org" + EnvCertificateArn: arn:aws:acm:us-east-1:427040638965:certificate/63ccdf0b-d2b5-44f0-b589-eceffb935c23 prod: ApiCertificateArn: arn:aws:acm:us-east-1:298118738376:certificate/6142a0e2-d62f-478e-bf15-5bdb616fe705 HostedZoneId: Z05246633460N5MEB9DBF - ApiDomainName: "aws.acmuiuc.org" # CHANGE ME + ApiDomainName: "aws.acmuiuc.org" + EnvDomainName: "acm.illinois.edu" + EnvCertificateArn: arn:aws:acm:us-east-1:298118738376:certificate/aeb93d9e-b0b7-4272-9c12-24ca5058c77e EnvironmentToCidr: dev: SecurityGroupIds: @@ -67,6 +81,8 @@ Resources: Parameters: RunEnvironment: !Ref RunEnvironment LambdaFunctionName: !Sub ${ApplicationPrefix}-lambda + SesEmailDomain: !FindInMap [General, !Ref RunEnvironment, SesDomain] + SqsQueueArn: !GetAtt AppSQSQueues.Outputs.MainQueueArn AppLogGroups: Type: AWS::Serverless::Application @@ -76,14 +92,79 @@ Resources: LambdaFunctionName: !Sub ${ApplicationPrefix}-lambda LogRetentionDays: !FindInMap [General, !Ref RunEnvironment, LogRetentionDays] + AppSQSQueues: + Type: AWS::Serverless::Application + Properties: + Location: ./sqs.yml + Parameters: + QueueName: !Sub ${ApplicationPrefix}-sqs + MessageTimeout: !Ref SqsMessageTimeout + + IcalDomainProxy: + Type: AWS::Serverless::Application + Properties: + Location: ./custom-domain.yml + Parameters: + RunEnvironment: !Ref RunEnvironment + RecordName: ical + GWBaseDomainName: !FindInMap + - ApiGwConfig + - !Ref RunEnvironment + - EnvDomainName + GWCertArn: !FindInMap + - ApiGwConfig + - !Ref RunEnvironment + - EnvCertificateArn + GWApiId: !Ref AppApiGateway + GWHostedZoneId: !FindInMap [ApiGwConfig, !Ref RunEnvironment, HostedZoneId] + + LinkryDomainProxy: + Type: AWS::Serverless::Application + Properties: + Location: ./custom-domain.yml + Parameters: + RunEnvironment: !Ref RunEnvironment + RecordName: go + GWBaseDomainName: !FindInMap + - ApiGwConfig + - !Ref RunEnvironment + - EnvDomainName + GWCertArn: !FindInMap + - ApiGwConfig + - !Ref RunEnvironment + - EnvCertificateArn + GWApiId: !Ref AppApiGateway + GWHostedZoneId: !FindInMap [ApiGwConfig, !Ref RunEnvironment, HostedZoneId] + + + CoreUrlProd: + Type: AWS::Serverless::Application + Condition: IsProd + Properties: + Location: ./custom-domain.yml + Parameters: + RunEnvironment: !Ref RunEnvironment + RecordName: core + GWBaseDomainName: !FindInMap + - ApiGwConfig + - !Ref RunEnvironment + - EnvDomainName + GWCertArn: !FindInMap + - ApiGwConfig + - !Ref RunEnvironment + - EnvCertificateArn + GWApiId: !Ref AppApiGateway + GWHostedZoneId: !FindInMap [ApiGwConfig, !Ref RunEnvironment, HostedZoneId] + AppApiLambdaFunction: Type: AWS::Serverless::Function DependsOn: - AppLogGroups Properties: - CodeUri: ../dist/src/ + Architectures: [arm64] + CodeUri: ../dist/lambda AutoPublishAlias: live - Runtime: nodejs20.x + Runtime: nodejs22.x Description: !Sub "${ApplicationFriendlyName} API Lambda" FunctionName: !Sub ${ApplicationPrefix}-lambda Handler: lambda.handler @@ -93,7 +174,7 @@ Resources: Environment: Variables: RunEnvironment: !Ref RunEnvironment - VpcConfig: + VpcConfig: Ipv6AllowedForDualStack: !If [ShouldAttachVpc, True, !Ref AWS::NoValue] SecurityGroupIds: !If [ShouldAttachVpc, !FindInMap [EnvironmentToCidr, !Ref RunEnvironment, SecurityGroupIds], !Ref AWS::NoValue] SubnetIds: !If [ShouldAttachVpc, !FindInMap [EnvironmentToCidr, !Ref RunEnvironment, SubnetIds], !Ref AWS::NoValue] @@ -105,9 +186,80 @@ Resources: Path: /{proxy+} Method: ANY + AppSqsLambdaFunction: + Type: AWS::Serverless::Function + DependsOn: + - AppLogGroups + Properties: + Architectures: [arm64] + CodeUri: ../dist/sqsConsumer + AutoPublishAlias: live + Runtime: nodejs22.x + Description: !Sub "${ApplicationFriendlyName} SQS Lambda" + FunctionName: !Sub ${ApplicationPrefix}-sqs-lambda + Handler: index.handler + MemorySize: 512 + Role: !GetAtt AppSecurityRoles.Outputs.MainFunctionRoleArn + Timeout: !Ref SqsLambdaTimeout + LoggingConfig: + LogGroup: !Sub /aws/lambda/${ApplicationPrefix}-lambda + Environment: + Variables: + RunEnvironment: !Ref RunEnvironment + VpcConfig: + Ipv6AllowedForDualStack: !If [ShouldAttachVpc, True, !Ref AWS::NoValue] + SecurityGroupIds: !If [ShouldAttachVpc, !FindInMap [EnvironmentToCidr, !Ref RunEnvironment, SecurityGroupIds], !Ref AWS::NoValue] + SubnetIds: !If [ShouldAttachVpc, !FindInMap [EnvironmentToCidr, !Ref RunEnvironment, SubnetIds], !Ref AWS::NoValue] + + SQSLambdaEventMapping: + Type: AWS::Lambda::EventSourceMapping + DependsOn: + - AppSqsLambdaFunction + Properties: + BatchSize: 5 + EventSourceArn: !GetAtt AppSQSQueues.Outputs.MainQueueArn + FunctionName: !Sub ${ApplicationPrefix}-sqs-lambda + FunctionResponseTypes: + - ReportBatchItemFailures + + IamGroupRolesTable: + Type: 'AWS::DynamoDB::Table' + DeletionPolicy: "Retain" + UpdateReplacePolicy: "Retain" + Properties: + BillingMode: 'PAY_PER_REQUEST' + TableName: infra-core-api-iam-grouproles + DeletionProtectionEnabled: true + PointInTimeRecoverySpecification: + PointInTimeRecoveryEnabled: false + AttributeDefinitions: + - AttributeName: groupUuid + AttributeType: S + KeySchema: + - AttributeName: groupUuid + KeyType: HASH + + IamUserRolesTable: + Type: 'AWS::DynamoDB::Table' + DeletionPolicy: "Retain" + UpdateReplacePolicy: "Retain" + Properties: + BillingMode: 'PAY_PER_REQUEST' + TableName: infra-core-api-iam-userroles + DeletionProtectionEnabled: true + PointInTimeRecoverySpecification: + PointInTimeRecoveryEnabled: false + AttributeDefinitions: + - AttributeName: userEmail + AttributeType: S + KeySchema: + - AttributeName: userEmail + KeyType: HASH + EventRecordsTable: Type: 'AWS::DynamoDB::Table' - DeletionPolicy: "Retain" + DeletionPolicy: "Retain" + UpdateReplacePolicy: "Retain" Properties: BillingMode: 'PAY_PER_REQUEST' TableName: infra-core-api-events @@ -130,9 +282,38 @@ Resources: Projection: ProjectionType: ALL + StripeLinksTable: + Type: 'AWS::DynamoDB::Table' + DeletionPolicy: "Retain" + UpdateReplacePolicy: "Retain" + Properties: + BillingMode: 'PAY_PER_REQUEST' + TableName: infra-core-api-stripe-links + DeletionProtectionEnabled: true + PointInTimeRecoverySpecification: + PointInTimeRecoveryEnabled: false + AttributeDefinitions: + - AttributeName: userId + AttributeType: S + - AttributeName: linkId + AttributeType: S + KeySchema: + - AttributeName: userId + KeyType: "HASH" + - AttributeName: linkId + KeyType: "RANGE" + GlobalSecondaryIndexes: + - IndexName: LinkIdIndex + KeySchema: + - AttributeName: linkId + KeyType: "HASH" + Projection: + ProjectionType: "ALL" + CacheRecordsTable: Type: 'AWS::DynamoDB::Table' - DeletionPolicy: "Retain" + DeletionPolicy: "Retain" + UpdateReplacePolicy: "Retain" Properties: BillingMode: 'PAY_PER_REQUEST' TableName: infra-core-api-cache @@ -151,7 +332,7 @@ Resources: AppApiGateway: Type: AWS::Serverless::Api - DependsOn: + DependsOn: - AppApiLambdaFunction Properties: Name: !Sub ${ApplicationPrefix}-gateway @@ -162,7 +343,7 @@ Resources: Name: AWS::Include Parameters: Location: ./phony-swagger.yml - Domain: + Domain: DomainName: !Sub - "${ApplicationPrefix}.${BaseDomainName}" - BaseDomainName: !FindInMap @@ -216,14 +397,33 @@ Resources: Condition: IsProd Properties: AlarmName: !Sub ${ApplicationPrefix}-gateway-latency-high - AlarmDescription: !Sub 'Alarm if ${ApplicationPrefix} API gateway latency is > 3s.' + AlarmDescription: 'Trailing Mean - 95% API gateway latency is > 1.25s for 2 times in 4 minutes.' Namespace: 'AWS/ApiGateway' MetricName: 'Latency' - Statistic: 'Average' - Period: '60' - EvaluationPeriods: '1' + ExtendedStatistic: 'tm95' + Period: '120' + EvaluationPeriods: '2' ComparisonOperator: 'GreaterThanThreshold' - Threshold: '3000' + Threshold: '1250' + AlarmActions: + - !Ref AlertSNSArn + Dimensions: + - Name: 'ApiName' + Value: !Sub ${ApplicationPrefix}-gateway + + AppApiGatewayNoRequestsAlarm: + Type: 'AWS::CloudWatch::Alarm' + Condition: IsProd + Properties: + AlarmName: !Sub ${ApplicationPrefix}-gateway-no-requests + AlarmDescription: 'No requests have been received in the past 5 minutes.' + Namespace: 'AWS/ApiGateway' + MetricName: 'Count' + Statistic: 'Sum' + Period: '300' + EvaluationPeriods: '1' + ComparisonOperator: 'LessThanThreshold' + Threshold: '1' AlarmActions: - !Ref AlertSNSArn Dimensions: @@ -235,7 +435,7 @@ Resources: Condition: IsProd Properties: AlarmName: !Sub ${ApplicationPrefix}-gateway-5xx - AlarmDescription: !Sub 'Alarm if ${ApplicationPrefix} API gateway 5XX errors are detected.' + AlarmDescription: 'More than 2 API gateway 5XX errors were detected.' Namespace: 'AWS/ApiGateway' MetricName: '5XXError' Statistic: 'Average' @@ -249,6 +449,23 @@ Resources: - Name: 'ApiName' Value: !Sub ${ApplicationPrefix}-gateway + + AppDLQMessagesAlarm: + Type: 'AWS::CloudWatch::Alarm' + Condition: IsProd + Properties: + AlarmName: !Sub ${ApplicationPrefix}-sqs-dlq + AlarmDescription: 'Items are present in the application DLQ, meaning some messages failed to process.' + Namespace: 'AWS/SQS' + MetricName: 'ApproximateNumberOfMessagesVisible' + Statistic: 'Sum' + Period: '60' + EvaluationPeriods: '1' + ComparisonOperator: 'GreaterThanThreshold' + Threshold: '0' + AlarmActions: + - !Ref AlertSNSArn + APILambdaPermission: Type: AWS::Lambda::Permission Properties: @@ -264,4 +481,4 @@ Resources: - !Ref AWS::AccountId - ":" - !Ref AppApiGateway - - "/*/*/*" \ No newline at end of file + - "/*/*/*" diff --git a/cloudformation/phony-swagger.yml b/cloudformation/phony-swagger.yml index 28da910..af44d95 100644 --- a/cloudformation/phony-swagger.yml +++ b/cloudformation/phony-swagger.yml @@ -7,6 +7,26 @@ info: email: infra@acm.illinois.edu paths: + /: + x-amazon-apigateway-any-method: + responses: + 200: + description: OK + + x-amazon-apigateway-auth: + type: NONE + + x-amazon-apigateway-integration: + responses: + default: + statusCode: 200 + passthroughBehavior: when_no_match + httpMethod: POST + contentHandling: CONVERT_TO_TEXT + type: aws_proxy + uri: + Fn::Sub: "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${ApplicationPrefix}-lambda/invocations" + /{proxy+}: x-amazon-apigateway-any-method: responses: @@ -25,4 +45,4 @@ paths: contentHandling: CONVERT_TO_TEXT type: aws_proxy uri: - Fn::Sub: "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${ApplicationPrefix}-lambda/invocations" \ No newline at end of file + Fn::Sub: "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${ApplicationPrefix}-lambda/invocations" diff --git a/cloudformation/sqs.yml b/cloudformation/sqs.yml new file mode 100644 index 0000000..6689e70 --- /dev/null +++ b/cloudformation/sqs.yml @@ -0,0 +1,40 @@ +AWSTemplateFormatVersion: '2010-09-09' +Description: Stack SQS Queues +Transform: AWS::Serverless-2016-10-31 +Parameters: + QueueName: + Type: String + AllowedPattern: ^[a-zA-Z0-9]+[a-zA-Z0-9-]+[a-zA-Z0-9]+$ + MessageTimeout: + Type: Number +Resources: + AppDLQ: + Type: AWS::SQS::Queue + Properties: + QueueName: !Sub ${QueueName}-dlq + VisibilityTimeout: !Ref MessageTimeout + AppQueue: + Type: AWS::SQS::Queue + Properties: + QueueName: !Ref QueueName + VisibilityTimeout: !Ref MessageTimeout + RedrivePolicy: + deadLetterTargetArn: + Fn::GetAtt: + - "AppDLQ" + - "Arn" + maxReceiveCount: 3 + +Outputs: + MainQueueArn: + Description: Main Queue Arn + Value: + Fn::GetAtt: + - AppQueue + - Arn + DLQArn: + Description: Dead-letter Queue Arn + Value: + Fn::GetAtt: + - AppDLQ + - Arn diff --git a/generate_jwt.js b/generate_jwt.js index 02f58a0..7a0a91f 100644 --- a/generate_jwt.js +++ b/generate_jwt.js @@ -1,36 +1,68 @@ -import jwt from 'jsonwebtoken'; -import * as dotenv from "dotenv"; -dotenv.config(); +import jwt from "jsonwebtoken"; +import { + SecretsManagerClient, + GetSecretValueCommand, +} from "@aws-sdk/client-secrets-manager"; +import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts"; -const username = process.env.JWTGEN_USERNAME || 'infra@acm.illinois.edu' +export const getSecretValue = async (secretId) => { + const smClient = new SecretsManagerClient(); + const data = await smClient.send( + new GetSecretValueCommand({ SecretId: secretId }), + ); + if (!data.SecretString) { + return null; + } + try { + return JSON.parse(data.SecretString); + } catch { + return null; + } +}; + +const secrets = await getSecretValue("infra-core-api-config"); +const client = new STSClient({ region: "us-east-1" }); +const command = new GetCallerIdentityCommand({}); +let data; +try { + data = await client.send(command); +} catch { + console.error( + `Could not get AWS STS credentials: are you logged in to AWS? Run "aws configure sso" to log in.`, + ); + process.exit(1); +} + +const username = process.env.JWTGEN_USERNAME || data.UserId?.split(":")[1]; const payload = { - aud: "custom_jwt", - iss: "custom_jwt", - iat: Math.floor(Date.now() / 1000), - nbf: Math.floor(Date.now() / 1000), - exp: Math.floor(Date.now() / 1000) + (3600 * 24), // Token expires after 24 hour - acr: "1", - aio: "AXQAi/8TAAAA", - amr: ["pwd"], - appid: "your-app-id", - appidacr: "1", - email: username, - groups: ["0"], - idp: "https://login.microsoftonline.com", - ipaddr: "192.168.1.1", - name: "John Doe", - oid: "00000000-0000-0000-0000-000000000000", - rh: "rh-value", - scp: "user_impersonation", - sub: "subject", - tid: "tenant-id", - unique_name: username, - uti: "uti-value", - ver: "1.0" + aud: "custom_jwt", + iss: "custom_jwt", + iat: Math.floor(Date.now() / 1000), + nbf: Math.floor(Date.now() / 1000), + exp: Math.floor(Date.now() / 1000) + 3600 * 24, // Token expires after 24 hour + acr: "1", + aio: "AXQAi/8TAAAA", + amr: ["pwd"], + appid: "your-app-id", + appidacr: "1", + email: username, + groups: ["0"], + idp: "https://login.microsoftonline.com", + ipaddr: "192.168.1.1", + name: "Doe, John", + oid: "00000000-0000-0000-0000-000000000000", + rh: "rh-value", + scp: "user_impersonation", + sub: "subject", + tid: "tenant-id", + unique_name: username, + uti: "uti-value", + ver: "1.0", }; -const secretKey = process.env.JwtSigningKey; -const token = jwt.sign(payload, secretKey, { algorithm: 'HS256' }); -console.log(`USERNAME=${username}`) -console.log('=====================') -console.log(token) +const token = jwt.sign(payload, secrets["jwt_key"], { + algorithm: "HS256", +}); +console.log(`USERNAME=${username}`); +console.log("====================="); +console.log(token); diff --git a/get_msft_jwt.js b/get_msft_jwt.js index fe14278..fb43b7c 100644 --- a/get_msft_jwt.js +++ b/get_msft_jwt.js @@ -1,28 +1,28 @@ -import request from 'request'; +import request from "request"; const client_secret = process.env.AadClientSecret; if (!client_secret) { - console.error("Did not find client secret in environment."); - process.exit(1); + console.error("Did not find client secret in environment."); + process.exit(1); } var options = { - 'method': 'POST', - 'url': 'https://login.microsoftonline.com/c8d9148f-9a59-4db3-827d-42ea0c2b6e2e/oauth2/token', - 'headers': { - 'Content-Type': 'application/x-www-form-urlencoded', - 'Cookie': 'esctx=PAQABBwEAAAApTwJmzXqdR4BN2miheQMYx8m4odNFiSkFXBDxAsyDVihl0yV2geMRVf-xYZ_GI34ZgJzPlzsLI4IyGrHFUcRyt_kOrGgfKtxKD_l8Shb9DAyh2xT4JeGXJhIyqsMO-lMmpvDuGjePONePVhmPE4TzQuQUh6V8Y4yWwBV10HljcSWz0Jp0DGs5MB4wMCl3CVwgAA; fpc=Asmn40XcT3RJkq8G_zKhA64gJa0wAQAAANHbRN4OAAAADPYZNQMAAADZ20TeDgAAABa8tnsBAAAAeN1E3g4AAAA; stsservicecookie=estsfd; x-ms-gateway-slice=estsfd' - }, - form: { - 'grant_type': 'client_credentials', - 'client_id': '519866d4-45a8-44ae-9925-9fb61b85074e', - 'client_secret': client_secret, - 'resource': 'api://5e08cf0f-53bb-4e09-9df2-e9bdc3467296', - 'scope': 'api://5e08cf0f-53bb-4e09-9df2-e9bdc3467296/ACM.Events.Login' - } - }; - request(options, function (error, response) { - if (error) throw new Error(error); - console.log(JSON.parse(response.body)['access_token']); - }); - \ No newline at end of file + method: "POST", + url: "https://login.microsoftonline.com/c8d9148f-9a59-4db3-827d-42ea0c2b6e2e/oauth2/token", + headers: { + "Content-Type": "application/x-www-form-urlencoded", + Cookie: + "esctx=PAQABBwEAAAApTwJmzXqdR4BN2miheQMYx8m4odNFiSkFXBDxAsyDVihl0yV2geMRVf-xYZ_GI34ZgJzPlzsLI4IyGrHFUcRyt_kOrGgfKtxKD_l8Shb9DAyh2xT4JeGXJhIyqsMO-lMmpvDuGjePONePVhmPE4TzQuQUh6V8Y4yWwBV10HljcSWz0Jp0DGs5MB4wMCl3CVwgAA; fpc=Asmn40XcT3RJkq8G_zKhA64gJa0wAQAAANHbRN4OAAAADPYZNQMAAADZ20TeDgAAABa8tnsBAAAAeN1E3g4AAAA; stsservicecookie=estsfd; x-ms-gateway-slice=estsfd", + }, + form: { + grant_type: "client_credentials", + client_id: "519866d4-45a8-44ae-9925-9fb61b85074e", + client_secret: client_secret, + resource: "api://5e08cf0f-53bb-4e09-9df2-e9bdc3467296", + scope: "api://5e08cf0f-53bb-4e09-9df2-e9bdc3467296/ACM.Events.Login", + }, +}; +request(options, function (error, response) { + if (error) throw new Error(error); + console.log(JSON.parse(response.body)["access_token"]); +}); diff --git a/package.json b/package.json index 2760240..0cd06b1 100644 --- a/package.json +++ b/package.json @@ -1,77 +1,84 @@ { - "name": "infra-sample-api-node", + "name": "infra-core", "version": "1.0.0", - "description": "ACM@UIUC Infra - Sample AWS Lambda in Node", - "main": "index.js", - "author": "ACM@UIUC", - "license": "BSD-3-Clause", + "private": true, "type": "module", + "workspaces": [ + "src/api", + "src/ui" + ], + "packageManager": "yarn@1.22.22", "scripts": { - "build": "rm -rf dist/ && tsc", - "dev": "touch .env && tsx watch src/index.ts", - "build:lambda": "yarn build && cp package.json dist/src/ && yarn lockfile-manage", - "lockfile-manage": "synp --source-file yarn.lock && cp package-lock.json dist/src/ && rm package-lock.json", - "typecheck": "tsc --noEmit", - "lint": "eslint . --ext .ts --cache", - "prettier": "prettier --check src/*.ts src/**/*.ts tests/**/*.ts", - "prettier:write": "prettier --write src/*.ts src/**/*.ts tests/**/*.ts", + "build": "yarn workspaces run build && yarn lockfile-manage", + "dev": "concurrently --names 'api,ui' 'yarn workspace infra-core-api run dev' 'yarn workspace infra-core-ui run dev'", + "lockfile-manage": "synp --with-workspace --source-file yarn.lock && cp package-lock.json dist/lambda/ && cp package-lock.json dist/sqsConsumer/ && cp src/api/package.lambda.json dist/lambda/package.json && cp src/api/package.lambda.json dist/sqsConsumer/package.json && rm package-lock.json", + "prettier": "yarn workspaces run prettier && prettier --check tests/**/*.ts", + "prettier:write": "yarn workspaces run prettier:write && prettier --write tests/**/*.ts", + "lint": "yarn workspaces run lint", "prepare": "node .husky/install.mjs || true", - "lint-staged": "lint-staged", - "test:unit": "cross-env APPLICATION_KEY=infra-core-api vitest tests/unit", + "typecheck": "yarn workspaces run typecheck", + "test:unit": "cross-env RunEnvironment='dev' vitest run tests/unit --config tests/unit/vitest.config.ts && yarn workspace infra-core-ui run test:unit", "test:unit-ui": "yarn test:unit --ui", - "test:unit-watch": "cross-env APPLICATION_KEY=infra-core-api vitest tests/unit", - "test:live": "cross-env APPLICATION_KEY=infra-core-api vitest tests/live", - "test:live-ui": "yarn test:live --ui" + "test:unit-watch": "vitest tests/unit", + "test:live": "vitest tests/live", + "test:live-ui": "yarn test:live --ui", + "test:e2e": "playwright test", + "test:e2e-ui": "playwright test --ui" }, + "dependencies": {}, "devDependencies": { - "@tsconfig/node20": "^20.1.4", + "@eslint/compat": "^1.1.1", + "@playwright/test": "^1.49.1", + "@tsconfig/node22": "^22.0.0", "@types/node": "^22.1.0", + "@types/pluralize": "^0.0.33", + "@types/react": "^18.3.3", + "@types/react-dom": "^18.3.0", "@types/supertest": "^6.0.2", "@typescript-eslint/eslint-plugin": "^8.0.1", "@typescript-eslint/parser": "^8.0.1", + "@vitejs/plugin-react": "^4.3.1", "@vitest/ui": "^2.0.5", - "aws-sdk-client-mock": "^4.0.1", + "aws-sdk-client-mock": "^4.1.0", + "concurrently": "^9.1.2", "cross-env": "^7.0.3", "esbuild": "^0.23.0", "eslint": "^8.57.0", + "eslint-config-airbnb": "^19.0.4", + "eslint-config-airbnb-typescript": "^18.0.0", "eslint-config-esnext": "^4.1.0", + "eslint-config-mantine": "^3.2.0", "eslint-config-prettier": "^9.1.0", "eslint-import-resolver-typescript": "^3.6.1", "eslint-plugin-import": "^2.29.1", + "eslint-plugin-jsx-a11y": "^6.9.0", "eslint-plugin-prettier": "^5.2.1", + "eslint-plugin-react": "^7.35.0", + "eslint-plugin-react-hooks": "^4.6.2", "husky": "^9.1.4", - "lint-staged": "^15.2.8", - "node-ical": "^0.18.0", + "identity-obj-proxy": "^3.0.0", + "jsdom": "^24.1.1", + "node-ical": "^0.20.1", + "postcss": "^8.4.41", + "postcss-preset-mantine": "^1.17.0", + "postcss-simple-vars": "^7.0.1", "prettier": "^3.3.3", + "prop-types": "^15.8.1", "request": "^2.88.2", + "storybook": "^8.2.8", + "storybook-dark-mode": "^4.0.2", + "stylelint": "^16.8.1", + "stylelint-config-standard-scss": "^13.1.0", "supertest": "^7.0.0", - "synp": "^1.9.13", + "synp": "^1.9.14", "tsx": "^4.16.5", "typescript": "^5.5.4", - "vitest": "^2.0.5" + "typescript-eslint": "^8.0.1", + "vite-tsconfig-paths": "^5.0.1", + "vitest": "^2.0.5", + "yarn-upgrade-all": "^0.7.4" }, - "dependencies": { - "@aws-sdk/client-dynamodb": "^3.624.0", - "@aws-sdk/client-secrets-manager": "^3.624.0", - "@aws-sdk/util-dynamodb": "^3.624.0", - "@azure/msal-node": "^2.16.1", - "@fastify/auth": "^5.0.1", - "@fastify/aws-lambda": "^5.0.0", - "@fastify/caching": "^9.0.1", - "@fastify/cors": "^10.0.1", - "@touch4it/ical-timezones": "^1.9.0", - "discord.js": "^14.15.3", - "dotenv": "^16.4.5", - "fastify": "^5.1.0", - "fastify-plugin": "^4.5.1", - "ical-generator": "^7.2.0", - "jsonwebtoken": "^9.0.2", - "jwks-rsa": "^3.1.0", - "moment": "^2.30.1", - "moment-timezone": "^0.5.45", - "zod": "^3.23.8", - "zod-to-json-schema": "^3.23.2", - "zod-validation-error": "^3.3.1" - }, - "packageManager": "yarn@1.22.22+sha1.ac34549e6aa8e7ead463a7407e1c7390f61a6610" + "resolutions": { + "pdfjs-dist": "^4.8.69" + } } diff --git a/playwright.config.ts b/playwright.config.ts new file mode 100644 index 0000000..6610300 --- /dev/null +++ b/playwright.config.ts @@ -0,0 +1,43 @@ +import { defineConfig, devices } from '@playwright/test'; + +export default defineConfig({ + testDir: './tests/e2e/', + /* Run tests in files in parallel */ + fullyParallel: false, + /* Fail the build on CI if you accidentally left test.only in the source code. */ + forbidOnly: !!process.env.CI, + /* Retry on CI only */ + retries: process.env.CI ? 2 : 0, + /* Opt out of parallel tests on CI. */ + workers: process.env.CI ? 1 : undefined, + /* Reporter to use. See https://playwright.dev/docs/test-reporters */ + reporter: process.env.CI ? 'github' : 'html', + /* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */ + use: { + /* Base URL to use in actions like `await page.goto('/')`. */ + // baseURL: 'http://127.0.0.1:3000', + + /* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */ + trace: 'on-first-retry', + }, + + /* Configure projects for major browsers */ + projects: [ + { + name: 'chromium', + use: { ...devices['Desktop Chrome'] }, + }, + + { + name: 'firefox', + use: { ...devices['Desktop Firefox'] }, + }, + ], + + /* Run your local dev server before starting the tests */ + // webServer: { + // command: 'npm run start', + // url: 'http://127.0.0.1:3000', + // reuseExistingServer: !process.env.CI, + // }, +}); diff --git a/src/api/README.md b/src/api/README.md new file mode 100644 index 0000000..6d2d289 --- /dev/null +++ b/src/api/README.md @@ -0,0 +1,41 @@ +# ACM @ UIUC Core API + +## Run Locally +1. Copy `.env.sample` as `.env` and set the `JwtSigningKey` to a random string. +2. Enable Tailscale VPN so you can reach the development database in AWS +3. Log into AWS with `aws configure sso` so you can retrieve the AWS secret and configuration. +4. `yarn -D` +5. `make check_account_dev` - If this fails make sure that AWS is configured. +6. `make local` + +## Build for AWS Lambda +1. `make clean` +2. `make build` + +## Deploy to AWS env + +1. Get AWS credentials with `aws configure sso` +2. Ensure AWS profile is set to the right account (DEV or PROD). +3. Run `make deploy_dev` or `make deploy_prod`. + +## Generating JWT token + +Create a `.env` file containing your `AadClientSecret`. + +```bash +node --env-file=.env get_msft_jwt.js +``` + +## Configuring AWS + +SSO URL: `https://acmillinois.awsapps.com/start/#` + +``` +aws configure sso +``` + +Log in with SSO. Then, export the `AWS_PROFILE` that the above command outputted. + +```bash +export AWS_PROFILE=ABC-DEV +``` diff --git a/src/api/build.js b/src/api/build.js new file mode 100644 index 0000000..cb6dff6 --- /dev/null +++ b/src/api/build.js @@ -0,0 +1,56 @@ +import esbuild from "esbuild"; +import { resolve } from "path"; + + +const commonParams = { + bundle: true, + format: "esm", + minify: true, + outExtension: { ".js": ".mjs" }, + loader: { + ".png": "file", + ".pkpass": "file", + ".json": "file", + }, // File loaders + target: "es2022", // Target ES2022 + sourcemap: false, + platform: "node", + external: ["aws-sdk", "moment-timezone", "passkit-generator", "fastify"], + alias: { + 'moment-timezone': resolve(process.cwd(), '../../node_modules/moment-timezone/builds/moment-timezone-with-data-10-year-range.js') + }, + banner: { + js: ` + import path from 'path'; + import { fileURLToPath } from 'url'; + import { createRequire as topLevelCreateRequire } from 'module'; + const require = topLevelCreateRequire(import.meta.url); + const __filename = fileURLToPath(import.meta.url); + const __dirname = path.dirname(__filename); + `.trim(), + }, // Banner for compatibility with CommonJS +} +esbuild + .build({ + ...commonParams, + entryPoints: ["api/lambda.js"], + outdir: "../../dist/lambda/", + external: [...commonParams.external, "sqs/*"], + }) + .then(() => console.log("API server build completed successfully!")) + .catch((error) => { + console.error("API server build failed:", error); + process.exit(1); + }); + + esbuild + .build({ + ...commonParams, + entryPoints: ["api/sqs/index.js", "api/sqs/driver.js"], + outdir: "../../dist/sqsConsumer/", + }) + .then(() => console.log("SQS consumer build completed successfully!")) + .catch((error) => { + console.error("SQS consumer build failed:", error); + process.exit(1); + }); diff --git a/src/api/esbuild.config.js b/src/api/esbuild.config.js new file mode 100644 index 0000000..c48615a --- /dev/null +++ b/src/api/esbuild.config.js @@ -0,0 +1,47 @@ +import { build, context } from 'esbuild'; +import { readFileSync } from 'fs'; +import { resolve } from 'path'; + +const isWatching = !!process.argv.includes('--watch') +const nodePackage = JSON.parse(readFileSync(resolve(process.cwd(), 'package.json'), 'utf8')); + +const buildOptions = { + entryPoints: [resolve(process.cwd(), 'index.ts')], + outfile: resolve(process.cwd(), '../', '../', 'dist_devel', 'index.js'), + bundle: true, + platform: 'node', + format: 'esm', + external: [ + Object.keys(nodePackage.dependencies ?? {}), + Object.keys(nodePackage.peerDependencies ?? {}), + Object.keys(nodePackage.devDependencies ?? {}), + ].flat(), + loader: { + '.png': 'file', // Add this line to specify a loader for .png files + }, + alias: { + 'moment-timezone': resolve(process.cwd(), '../../node_modules/moment-timezone/builds/moment-timezone-with-data-10-year-range.js') + }, + banner: { + js: ` + import path from 'path'; + import { fileURLToPath } from 'url'; + import { createRequire as topLevelCreateRequire } from 'module'; + const require = topLevelCreateRequire(import.meta.url); + const __filename = fileURLToPath(import.meta.url); + const __dirname = path.dirname(__filename); + `.trim(), + }, // Banner for compatibility with CommonJS +}; + +if (isWatching) { + context(buildOptions).then(ctx => { + if (isWatching) { + ctx.watch(); + } else { + ctx.rebuild(); + } + }); +} else { + build(buildOptions) +} diff --git a/src/api/functions/authorization.ts b/src/api/functions/authorization.ts new file mode 100644 index 0000000..83e7b58 --- /dev/null +++ b/src/api/functions/authorization.ts @@ -0,0 +1,110 @@ +import { DynamoDBClient, GetItemCommand } from "@aws-sdk/client-dynamodb"; +import { unmarshall } from "@aws-sdk/util-dynamodb"; +import { genericConfig } from "../../common/config.js"; +import { DatabaseFetchError } from "../../common/errors/index.js"; +import { allAppRoles, AppRoles } from "../../common/roles.js"; +import { FastifyInstance } from "fastify"; + +export const AUTH_DECISION_CACHE_SECONDS = 180; + +export async function getUserRoles( + dynamoClient: DynamoDBClient, + fastifyApp: FastifyInstance, + userId: string, +): Promise { + const cachedValue = fastifyApp.nodeCache.get(`userroles-${userId}`); + if (cachedValue) { + fastifyApp.log.info(`Returning cached auth decision for user ${userId}`); + return cachedValue as AppRoles[]; + } + const tableName = `${genericConfig["IAMTablePrefix"]}-userroles`; + const command = new GetItemCommand({ + TableName: tableName, + Key: { + userEmail: { S: userId }, + }, + }); + const response = await dynamoClient.send(command); + if (!response) { + throw new DatabaseFetchError({ + message: "Could not get user roles", + }); + } + if (!response.Item) { + return []; + } + const items = unmarshall(response.Item) as { roles: AppRoles[] | ["all"] }; + if (!("roles" in items)) { + return []; + } + if (items["roles"][0] === "all") { + fastifyApp.nodeCache.set( + `userroles-${userId}`, + allAppRoles, + AUTH_DECISION_CACHE_SECONDS, + ); + return allAppRoles; + } + fastifyApp.nodeCache.set( + `userroles-${userId}`, + items["roles"], + AUTH_DECISION_CACHE_SECONDS, + ); + return items["roles"] as AppRoles[]; +} + +export async function getGroupRoles( + dynamoClient: DynamoDBClient, + fastifyApp: FastifyInstance, + groupId: string, +) { + const cachedValue = fastifyApp.nodeCache.get(`grouproles-${groupId}`); + if (cachedValue) { + fastifyApp.log.info(`Returning cached auth decision for group ${groupId}`); + return cachedValue as AppRoles[]; + } + const tableName = `${genericConfig["IAMTablePrefix"]}-grouproles`; + const command = new GetItemCommand({ + TableName: tableName, + Key: { + groupUuid: { S: groupId }, + }, + }); + const response = await dynamoClient.send(command); + if (!response) { + throw new DatabaseFetchError({ + message: "Could not get group roles for user", + }); + } + if (!response.Item) { + fastifyApp.nodeCache.set( + `grouproles-${groupId}`, + [], + AUTH_DECISION_CACHE_SECONDS, + ); + return []; + } + const items = unmarshall(response.Item) as { roles: AppRoles[] | ["all"] }; + if (!("roles" in items)) { + fastifyApp.nodeCache.set( + `grouproles-${groupId}`, + [], + AUTH_DECISION_CACHE_SECONDS, + ); + return []; + } + if (items["roles"][0] === "all") { + fastifyApp.nodeCache.set( + `grouproles-${groupId}`, + allAppRoles, + AUTH_DECISION_CACHE_SECONDS, + ); + return allAppRoles; + } + fastifyApp.nodeCache.set( + `grouproles-${groupId}`, + items["roles"], + AUTH_DECISION_CACHE_SECONDS, + ); + return items["roles"] as AppRoles[]; +} diff --git a/src/functions/cache.ts b/src/api/functions/cache.ts similarity index 90% rename from src/functions/cache.ts rename to src/api/functions/cache.ts index b3a053e..6275988 100644 --- a/src/functions/cache.ts +++ b/src/api/functions/cache.ts @@ -3,14 +3,11 @@ import { PutItemCommand, QueryCommand, } from "@aws-sdk/client-dynamodb"; -import { genericConfig } from "../config.js"; +import { genericConfig } from "../../common/config.js"; import { marshall, unmarshall } from "@aws-sdk/util-dynamodb"; -const dynamoClient = new DynamoDBClient({ - region: genericConfig.AwsRegion, -}); - export async function getItemFromCache( + dynamoClient: DynamoDBClient, key: string, ): Promise> { const currentTime = Math.floor(Date.now() / 1000); @@ -37,6 +34,7 @@ export async function getItemFromCache( } export async function insertItemIntoCache( + dynamoClient: DynamoDBClient, key: string, value: Record, expireAt: Date, diff --git a/src/functions/discord.ts b/src/api/functions/discord.ts similarity index 93% rename from src/functions/discord.ts rename to src/api/functions/discord.ts index 53d53ef..5fb9268 100644 --- a/src/functions/discord.ts +++ b/src/api/functions/discord.ts @@ -12,9 +12,10 @@ import { type EventPostRequest } from "../routes/events.js"; import moment from "moment-timezone"; import { FastifyBaseLogger } from "fastify"; -import { DiscordEventError } from "../errors/index.js"; +import { DiscordEventError } from "../../common/errors/index.js"; import { getSecretValue } from "../plugins/auth.js"; -import { genericConfig } from "../config.js"; +import { genericConfig } from "../../common/config.js"; +import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"; // https://stackoverflow.com/a/3809435/5684541 // https://calendar-buff.acmuiuc.pages.dev/calendar?id=dd7af73a-3df6-4e12-b228-0d2dac34fda7&date=2024-08-30 @@ -24,12 +25,13 @@ export type IUpdateDiscord = EventPostRequest & { id: string }; const urlRegex = /https:\/\/[a-z0-9\.-]+\/calendar\?id=([a-f0-9-]+)/; export const updateDiscord = async ( + smClient: SecretsManagerClient, event: IUpdateDiscord, isDelete: boolean = false, logger: FastifyBaseLogger, ): Promise => { const secretApiConfig = - (await getSecretValue(genericConfig.ConfigSecretName)) || {}; + (await getSecretValue(smClient, genericConfig.ConfigSecretName)) || {}; const client = new Client({ intents: [GatewayIntentBits.Guilds] }); let payload: GuildScheduledEventCreateOptions | null = null; diff --git a/src/api/functions/entraId.ts b/src/api/functions/entraId.ts new file mode 100644 index 0000000..00e3dd7 --- /dev/null +++ b/src/api/functions/entraId.ts @@ -0,0 +1,449 @@ +import { + commChairsGroupId, + commChairsTestingGroupId, + execCouncilGroupId, + execCouncilTestingGroupId, + genericConfig, + officersGroupId, + officersGroupTestingId, +} from "../../common/config.js"; +import { + EntraFetchError, + EntraGroupError, + EntraInvitationError, + EntraPatchError, + InternalServerError, +} from "../../common/errors/index.js"; +import { getSecretValue } from "../plugins/auth.js"; +import { ConfidentialClientApplication } from "@azure/msal-node"; +import { getItemFromCache, insertItemIntoCache } from "./cache.js"; +import { + EntraGroupActions, + EntraInvitationResponse, + ProfilePatchRequest, +} from "../../common/types/iam.js"; +import { UserProfileDataBase } from "common/types/msGraphApi.js"; +import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"; +import { DynamoDBClient } from "@aws-sdk/client-dynamodb"; + +function validateGroupId(groupId: string): boolean { + const groupIdPattern = /^[a-zA-Z0-9-]+$/; // Adjust the pattern as needed + return groupIdPattern.test(groupId); +} + +export async function getEntraIdToken( + clients: { smClient: SecretsManagerClient; dynamoClient: DynamoDBClient }, + clientId: string, + scopes: string[] = ["https://graph.microsoft.com/.default"], +) { + const secretApiConfig = + (await getSecretValue(clients.smClient, genericConfig.ConfigSecretName)) || + {}; + if ( + !secretApiConfig.entra_id_private_key || + !secretApiConfig.entra_id_thumbprint + ) { + throw new InternalServerError({ + message: "Could not find Entra ID credentials.", + }); + } + const decodedPrivateKey = Buffer.from( + secretApiConfig.entra_id_private_key as string, + "base64", + ).toString("utf8"); + const cachedToken = await getItemFromCache( + clients.dynamoClient, + "entra_id_access_token", + ); + if (cachedToken) { + return cachedToken["token"] as string; + } + const config = { + auth: { + clientId: clientId, + authority: `https://login.microsoftonline.com/${genericConfig.EntraTenantId}`, + clientCertificate: { + thumbprint: (secretApiConfig.entra_id_thumbprint as string) || "", + privateKey: decodedPrivateKey, + }, + }, + }; + const cca = new ConfidentialClientApplication(config); + try { + const result = await cca.acquireTokenByClientCredential({ + scopes, + }); + const date = result?.expiresOn; + if (!date) { + throw new InternalServerError({ + message: `Failed to acquire token: token has no expiry field.`, + }); + } + date.setTime(date.getTime() - 30000); + if (result?.accessToken) { + await insertItemIntoCache( + clients.dynamoClient, + "entra_id_access_token", + { token: result?.accessToken }, + date, + ); + } + return result?.accessToken ?? null; + } catch (error) { + throw new InternalServerError({ + message: `Failed to acquire token: ${error}`, + }); + } +} + +/** + * Adds a user to the tenant by sending an invitation to their email + * @param token - Entra ID token authorized to take this action. + * @param email - The email address of the user to invite + * @throws {InternalServerError} If the invitation fails + * @returns {Promise} True if the invitation was successful + */ +export async function addToTenant(token: string, email: string) { + email = email.toLowerCase().replace(/\s/g, ""); + if (!email.endsWith("@illinois.edu")) { + throw new EntraInvitationError({ + email, + message: "User's domain must be illinois.edu to be invited.", + }); + } + try { + const body = { + invitedUserEmailAddress: email, + inviteRedirectUrl: "https://acm.illinois.edu", + }; + const url = "https://graph.microsoft.com/v1.0/invitations"; + const response = await fetch(url, { + method: "POST", + headers: { + Authorization: `Bearer ${token}`, + "Content-Type": "application/json", + }, + body: JSON.stringify(body), + }); + + if (!response.ok) { + const errorData = (await response.json()) as EntraInvitationResponse; + throw new EntraInvitationError({ + message: errorData.error?.message || response.statusText, + email, + }); + } + + return { success: true, email }; + } catch (error) { + if (error instanceof EntraInvitationError) { + throw error; + } + + throw new EntraInvitationError({ + message: error instanceof Error ? error.message : String(error), + email, + }); + } +} + +/** + * Resolves an email address to an OID using Microsoft Graph API. + * @param token - Entra ID token authorized to perform this action. + * @param email - The email address to resolve. + * @throws {Error} If the resolution fails. + * @returns {Promise} The OID of the user. + */ +export async function resolveEmailToOid( + token: string, + email: string, +): Promise { + email = email.toLowerCase().replace(/\s/g, ""); + + const url = `https://graph.microsoft.com/v1.0/users?$filter=mail eq '${email}'`; + + const response = await fetch(url, { + method: "GET", + headers: { + Authorization: `Bearer ${token}`, + "Content-Type": "application/json", + }, + }); + + if (!response.ok) { + const errorData = (await response.json()) as { + error?: { message?: string }; + }; + throw new Error(errorData?.error?.message ?? response.statusText); + } + + const data = (await response.json()) as { + value: { id: string }[]; + }; + + if (!data.value || data.value.length === 0) { + throw new Error(`No user found with email: ${email}`); + } + + return data.value[0].id; +} + +/** + * Adds or removes a user from an Entra ID group. + * @param token - Entra ID token authorized to take this action. + * @param email - The email address of the user to add or remove. + * @param group - The group ID to take action on. + * @param action - Whether to add or remove the user from the group. + * @throws {EntraGroupError} If the group action fails. + * @returns {Promise} True if the action was successful. + */ +export async function modifyGroup( + token: string, + email: string, + group: string, + action: EntraGroupActions, +): Promise { + email = email.toLowerCase().replace(/\s/g, ""); + if (!email.endsWith("@illinois.edu")) { + throw new EntraGroupError({ + group, + message: "User's domain must be illinois.edu to be added to the group.", + }); + } + // if adding to exec group, check that all exec members we want to add are paid members + const paidMemberRequiredGroups = [ + execCouncilGroupId, + execCouncilTestingGroupId, + officersGroupId, + officersGroupTestingId, + commChairsGroupId, + commChairsTestingGroupId, + ]; + if ( + paidMemberRequiredGroups.includes(group) && + action === EntraGroupActions.ADD + ) { + const netId = email.split("@")[0]; + const response = await fetch( + `https://membership.acm.illinois.edu/api/v1/checkMembership?netId=${netId}`, + ); + const membershipStatus = (await response.json()) as { + netId: string; + isPaidMember: boolean; + }; + if (!membershipStatus["isPaidMember"]) { + throw new EntraGroupError({ + message: `${netId} is not a paid member. This group requires that all members are paid members.`, + group, + }); + } + } + try { + const oid = await resolveEmailToOid(token, email); + const methodMapper = { + [EntraGroupActions.ADD]: "POST", + [EntraGroupActions.REMOVE]: "DELETE", + }; + + const urlMapper = { + [EntraGroupActions.ADD]: `https://graph.microsoft.com/v1.0/groups/${group}/members/$ref`, + [EntraGroupActions.REMOVE]: `https://graph.microsoft.com/v1.0/groups/${group}/members/${oid}/$ref`, + }; + const url = urlMapper[action]; + const body = { + "@odata.id": `https://graph.microsoft.com/v1.0/directoryObjects/${oid}`, + }; + + const response = await fetch(url, { + method: methodMapper[action], + headers: { + Authorization: `Bearer ${token}`, + "Content-Type": "application/json", + }, + body: JSON.stringify(body), + }); + + if (!response.ok) { + const errorData = (await response.json()) as { + error?: { message?: string }; + }; + if ( + errorData?.error?.message === + "One or more added object references already exist for the following modified properties: 'members'." + ) { + return true; + } + throw new EntraGroupError({ + message: errorData?.error?.message ?? response.statusText, + group, + }); + } + + return true; + } catch (error) { + if (error instanceof EntraGroupError) { + throw error; + } + const message = error instanceof Error ? error.message : String(error); + if (message) { + throw new EntraGroupError({ + message, + group, + }); + } + } + return false; +} + +/** + * Lists all members of an Entra ID group. + * @param token - Entra ID token authorized to take this action. + * @param group - The group ID to fetch members for. + * @throws {EntraGroupError} If the group action fails. + * @returns {Promise>} List of members with name and email. + */ +export async function listGroupMembers( + token: string, + group: string, +): Promise> { + if (!validateGroupId(group)) { + throw new EntraGroupError({ + message: "Invalid group ID format", + group, + }); + } + try { + const url = `https://graph.microsoft.com/v1.0/groups/${group}/members`; + const response = await fetch(url, { + method: "GET", + headers: { + Authorization: `Bearer ${token}`, + "Content-Type": "application/json", + }, + }); + + if (!response.ok) { + const errorData = (await response.json()) as { + error?: { message?: string }; + }; + throw new EntraGroupError({ + message: errorData?.error?.message ?? response.statusText, + group, + }); + } + + const data = (await response.json()) as { + value: Array<{ + displayName?: string; + mail?: string; + }>; + }; + + // Map the response to the desired format + const members = data.value.map((member) => ({ + name: member.displayName ?? "", + email: member.mail ?? "", + })); + + return members; + } catch (error) { + if (error instanceof EntraGroupError) { + throw error; + } + + throw new EntraGroupError({ + message: error instanceof Error ? error.message : String(error), + group, + }); + } +} + +/** + * Retrieves the profile of a user from Entra ID. + * @param token - Entra ID token authorized to perform this action. + * @param userId - The user ID to fetch the profile for. + * @throws {EntraUserError} If fetching the user profile fails. + * @returns {Promise} The user's profile information. + */ +export async function getUserProfile( + token: string, + email: string, +): Promise { + const userId = await resolveEmailToOid(token, email); + try { + const url = `https://graph.microsoft.com/v1.0/users/${userId}?$select=userPrincipalName,givenName,surname,displayName,otherMails,mail`; + const response = await fetch(url, { + method: "GET", + headers: { + Authorization: `Bearer ${token}`, + "Content-Type": "application/json", + }, + }); + + if (!response.ok) { + const errorData = (await response.json()) as { + error?: { message?: string }; + }; + throw new EntraFetchError({ + message: errorData?.error?.message ?? response.statusText, + email, + }); + } + return (await response.json()) as UserProfileDataBase; + } catch (error) { + if (error instanceof EntraFetchError) { + throw error; + } + + throw new EntraFetchError({ + message: error instanceof Error ? error.message : String(error), + email, + }); + } +} + +/** + * Patches the profile of a user from Entra ID. + * @param token - Entra ID token authorized to perform this action. + * @param userId - The user ID to patch the profile for. + * @throws {EntraUserError} If setting the user profile fails. + * @returns {Promise} nothing + */ +export async function patchUserProfile( + token: string, + email: string, + userId: string, + data: ProfilePatchRequest, +): Promise { + try { + const url = `https://graph.microsoft.com/v1.0/users/${userId}`; + const response = await fetch(url, { + method: "PATCH", + headers: { + Authorization: `Bearer ${token}`, + "Content-Type": "application/json", + }, + body: JSON.stringify(data), + }); + + if (!response.ok) { + const errorData = (await response.json()) as { + error?: { message?: string }; + }; + throw new EntraPatchError({ + message: errorData?.error?.message ?? response.statusText, + email, + }); + } + return; + } catch (error) { + if (error instanceof EntraPatchError) { + throw error; + } + + throw new EntraPatchError({ + message: error instanceof Error ? error.message : String(error), + email, + }); + } +} diff --git a/src/api/functions/membership.ts b/src/api/functions/membership.ts new file mode 100644 index 0000000..7f44624 --- /dev/null +++ b/src/api/functions/membership.ts @@ -0,0 +1,24 @@ +import { FastifyBaseLogger } from "fastify"; + +export async function checkPaidMembership( + endpoint: string, + log: FastifyBaseLogger, + netId: string, +) { + const membershipApiPayload = (await ( + await fetch(`${endpoint}?netId=${netId}`) + ).json()) as { netId: string; isPaidMember: boolean }; + log.trace(`Got Membership API Payload for ${netId}: ${membershipApiPayload}`); + try { + return membershipApiPayload["isPaidMember"]; + } catch (e: unknown) { + if (!(e instanceof Error)) { + log.error( + "Failed to get response from membership API (unknown error type.)", + ); + throw e; + } + log.error(`Failed to get response from membership API: ${e.toString()}`); + throw e; + } +} diff --git a/src/api/functions/mobileWallet.ts b/src/api/functions/mobileWallet.ts new file mode 100644 index 0000000..4042bb9 --- /dev/null +++ b/src/api/functions/mobileWallet.ts @@ -0,0 +1,124 @@ +import { getSecretValue } from "../plugins/auth.js"; +import { + ConfigType, + genericConfig, + SecretConfig, +} from "../../common/config.js"; +import { + InternalServerError, + UnauthorizedError, +} from "../../common/errors/index.js"; +import icon from "../resources/MembershipPass.pkpass/icon.png"; +import logo from "../resources/MembershipPass.pkpass/logo.png"; +import strip from "../resources/MembershipPass.pkpass/strip.png"; +import pass from "../resources/MembershipPass.pkpass/pass.js"; +import { PKPass } from "passkit-generator"; +import { promises as fs } from "fs"; +import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"; +import { RunEnvironment } from "common/roles.js"; +import pino from "pino"; + +function trim(s: string) { + return (s || "").replace(/^\s+|\s+$/g, ""); +} + +function convertName(name: string): string { + if (!name.includes(",")) { + return name; + } + return `${trim(name.split(",")[1])} ${name.split(",")[0]}`; +} + +export async function issueAppleWalletMembershipCard( + clients: { smClient: SecretsManagerClient }, + environmentConfig: ConfigType, + runEnvironment: RunEnvironment, + email: string, + logger: pino.Logger, + name?: string, +) { + if (!email.endsWith("@illinois.edu")) { + throw new UnauthorizedError({ + message: + "Cannot issue membership pass for emails not on the illinois.edu domain.", + }); + } + const secretApiConfig = (await getSecretValue( + clients.smClient, + genericConfig.ConfigSecretName, + )) as SecretConfig; + if (!secretApiConfig) { + throw new InternalServerError({ + message: "Could not retrieve signing data", + }); + } + const signerCert = Buffer.from( + secretApiConfig.acm_passkit_signerCert_base64, + "base64", + ).toString("utf-8"); + const signerKey = Buffer.from( + secretApiConfig.acm_passkit_signerKey_base64, + "base64", + ).toString("utf-8"); + const wwdr = Buffer.from( + secretApiConfig.apple_signing_cert_base64, + "base64", + ).toString("utf-8"); + pass["passTypeIdentifier"] = environmentConfig["PasskitIdentifier"]; + + const pkpass = new PKPass( + { + "icon.png": await fs.readFile(icon), + "logo.png": await fs.readFile(logo), + "strip.png": await fs.readFile(strip), + "pass.json": Buffer.from(JSON.stringify(pass)), + }, + { + wwdr, + signerCert, + signerKey, + }, + { + // logoText: app.runEnvironment === "dev" ? "INVALID Membership Pass" : "Membership Pass", + serialNumber: environmentConfig["PasskitSerialNumber"], + }, + ); + pkpass.setBarcodes({ + altText: email.split("@")[0], + format: "PKBarcodeFormatPDF417", + message: runEnvironment === "dev" ? `INVALID${email}INVALID` : email, + }); + const iat = new Date().toLocaleDateString("en-US", { + day: "2-digit", + month: "2-digit", + year: "numeric", + }); + if (name && name !== "") { + pkpass.secondaryFields.push({ + label: "Member Name", + key: "name", + value: convertName(name), + }); + } + if (runEnvironment === "prod") { + pkpass.backFields.push({ + label: "Verification URL", + key: "iss", + value: `https://membership.acm.illinois.edu/verify/${email.split("@")[0]}`, + }); + } else { + pkpass.backFields.push({ + label: "TESTING ONLY Pass", + key: "iss", + value: `Do not honor!`, + }); + } + pkpass.backFields.push({ label: "Pass Created On", key: "iat", value: iat }); + pkpass.backFields.push({ label: "Membership ID", key: "id", value: email }); + const buffer = pkpass.getAsBuffer(); + logger.info( + { type: "audit", actor: email, target: email }, + "Created membership verification pass", + ); + return buffer; +} diff --git a/src/api/functions/ses.ts b/src/api/functions/ses.ts new file mode 100644 index 0000000..dd9fc4c --- /dev/null +++ b/src/api/functions/ses.ts @@ -0,0 +1,134 @@ +import { SendRawEmailCommand } from "@aws-sdk/client-ses"; +import { encode } from "base64-arraybuffer"; + +/** + * Generates a SendRawEmailCommand for SES to send an email with an attached membership pass. + * + * @param recipientEmail - The email address of the recipient. + * * @param recipientEmail - The email address of the sender with a verified identity in SES. + * @param attachmentBuffer - The membership pass in ArrayBufferLike format. + * @returns The command to send the email via SES. + */ +export function generateMembershipEmailCommand( + recipientEmail: string, + senderEmail: string, + attachmentBuffer: ArrayBufferLike, +): SendRawEmailCommand { + const encodedAttachment = encode(attachmentBuffer); + const boundary = "----BoundaryForEmail"; + + const emailTemplate = ` + + + + Your ACM @ UIUC Membership + + + + + + +
 
+ +
+
+

Welcome

+

+ Thank you for becoming a member of ACM @ UIUC! Attached is your membership pass. + You can add it to your Apple or Google Wallet for easy access. +

+

+ If you have any questions, feel free to contact us at + infra@acm.illinois.edu. +

+

+ We also encourage you to check out our resources page, where you can find the benefits associated with your membership. + Welcome to ACM @ UIUC! +

+ +
+
+

+ ACM @ UIUC Homepage + Email ACM @ UIUC +

+
+ + + `; + + const rawEmail = ` +MIME-Version: 1.0 +Content-Type: multipart/mixed; boundary="${boundary}" +From: ACM @ UIUC <${senderEmail}> +To: ${recipientEmail} +Subject: Your ACM @ UIUC Membership + +--${boundary} +Content-Type: text/html; charset="UTF-8" + +${emailTemplate} + +--${boundary} +Content-Type: application/vnd.apple.pkpass +Content-Transfer-Encoding: base64 +Content-Disposition: attachment; filename="membership.pkpass" + +${encodedAttachment} +--${boundary}--`.trim(); + return new SendRawEmailCommand({ + RawMessage: { + Data: new TextEncoder().encode(rawEmail), + }, + }); +} diff --git a/src/api/functions/stripe.ts b/src/api/functions/stripe.ts new file mode 100644 index 0000000..5078af8 --- /dev/null +++ b/src/api/functions/stripe.ts @@ -0,0 +1,55 @@ +import Stripe from "stripe"; + +export type StripeLinkCreateParams = { + invoiceId: string; + invoiceAmountUsd: number; + contactName: string; + contactEmail: string; + createdBy: string; + stripeApiKey: string; +}; + +/** + * Create a Stripe payment link for an invoice. Note that invoiceAmountUsd MUST IN CENTS!! + * @param {StripeLinkCreateParams} options + * @returns {string} A stripe link that can be used to pay the invoice + */ +export const createStripeLink = async ({ + invoiceId, + invoiceAmountUsd, + contactName, + contactEmail, + createdBy, + stripeApiKey, +}: StripeLinkCreateParams): Promise<{ + linkId: string; + priceId: string; + productId: string; + url: string; +}> => { + const stripe = new Stripe(stripeApiKey); + const description = `Created for ${contactName} (${contactEmail}) by ${createdBy}.`; + const product = await stripe.products.create({ + name: `Payment for Invoice: ${invoiceId}`, + description, + }); + const price = await stripe.prices.create({ + currency: "usd", + unit_amount: invoiceAmountUsd, + product: product.id, + }); + const paymentLink = await stripe.paymentLinks.create({ + line_items: [ + { + price: price.id, + quantity: 1, + }, + ], + }); + return { + url: paymentLink.url, + linkId: paymentLink.id, + productId: product.id, + priceId: price.id, + }; +}; diff --git a/src/functions/validation.ts b/src/api/functions/validation.ts similarity index 100% rename from src/functions/validation.ts rename to src/api/functions/validation.ts diff --git a/src/index.ts b/src/api/index.ts similarity index 53% rename from src/index.ts rename to src/api/index.ts index 683b592..d049bd6 100644 --- a/src/index.ts +++ b/src/api/index.ts @@ -5,25 +5,56 @@ import FastifyAuthProvider from "@fastify/auth"; import fastifyAuthPlugin from "./plugins/auth.js"; import protectedRoute from "./routes/protected.js"; import errorHandlerPlugin from "./plugins/errorHandler.js"; -import { RunEnvironment, runEnvironments } from "./roles.js"; -import { InternalServerError } from "./errors/index.js"; +import { RunEnvironment, runEnvironments } from "../common/roles.js"; +import { InternalServerError } from "../common/errors/index.js"; import eventsPlugin from "./routes/events.js"; import cors from "@fastify/cors"; import fastifyZodValidationPlugin from "./plugins/validate.js"; -import { environmentConfig } from "./config.js"; +import { environmentConfig, genericConfig } from "../common/config.js"; import organizationsPlugin from "./routes/organizations.js"; import icalPlugin from "./routes/ics.js"; import vendingPlugin from "./routes/vending.js"; import * as dotenv from "dotenv"; -import ssoManagementRoute from "./routes/sso.js"; +import iamRoutes from "./routes/iam.js"; import ticketsPlugin from "./routes/tickets.js"; +import { STSClient, GetCallerIdentityCommand } from "@aws-sdk/client-sts"; +import NodeCache from "node-cache"; +import { DynamoDBClient } from "@aws-sdk/client-dynamodb"; +import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"; +import mobileWalletRoute from "./routes/mobileWallet.js"; +import stripeRoutes from "./routes/stripe.js"; + dotenv.config(); const now = () => Date.now(); async function init() { + const dynamoClient = new DynamoDBClient({ + region: genericConfig.AwsRegion, + }); + + const secretsManagerClient = new SecretsManagerClient({ + region: genericConfig.AwsRegion, + }); + const app: FastifyInstance = fastify({ - logger: true, + logger: { + level: process.env.LOG_LEVEL || "info", + }, + rewriteUrl: (req) => { + const url = req.url; + const hostname = req.headers.host || ""; + const customDomainBaseMappers: Record = { + "ical.acm.illinois.edu": `/api/v1/ical${url}`, + "ical.aws.qa.acmuiuc.org": `/api/v1/ical${url}`, + "go.acm.illinois.edu": `/api/v1/linkry/redir${url}`, + "go.aws.qa.acmuiuc.org": `/api/v1/linkry/redir${url}`, + }; + if (hostname in customDomainBaseMappers) { + return customDomainBaseMappers[hostname]; + } + return url || "/"; + }, disableRequestLogging: true, genReqId: (request) => { const header = request.headers["x-apigateway-event"]; @@ -48,10 +79,16 @@ async function init() { }); } app.runEnvironment = process.env.RunEnvironment as RunEnvironment; - app.environmentConfig = environmentConfig[app.runEnvironment]; + app.environmentConfig = + environmentConfig[app.runEnvironment as RunEnvironment]; + app.nodeCache = new NodeCache({ checkperiod: 30 }); + app.dynamoClient = dynamoClient; + app.secretsManagerClient = secretsManagerClient; app.addHook("onRequest", (req, _, done) => { req.startTime = now(); - req.log.info({ url: req.raw.url }, "received request"); + const hostname = req.hostname; + const url = req.raw.url; + req.log.info({ hostname, url, method: req.method }, "received request"); done(); }); @@ -66,6 +103,7 @@ async function init() { ); done(); }); + app.get("/", (_, reply) => reply.send("Welcome to the ACM @ UIUC Core API!")); app.get("/api/v1/healthz", (_, reply) => reply.send({ message: "UP" })); await app.register( async (api, _options) => { @@ -73,8 +111,10 @@ async function init() { api.register(eventsPlugin, { prefix: "/events" }); api.register(organizationsPlugin, { prefix: "/organizations" }); api.register(icalPlugin, { prefix: "/ical" }); - api.register(ssoManagementRoute, { prefix: "/sso" }); + api.register(iamRoutes, { prefix: "/iam" }); api.register(ticketsPlugin, { prefix: "/tickets" }); + api.register(mobileWalletRoute, { prefix: "/mobileWallet" }); + api.register(stripeRoutes, { prefix: "/stripe" }); if (app.runEnvironment === "dev") { api.register(vendingPlugin, { prefix: "/vending" }); } @@ -84,17 +124,27 @@ async function init() { await app.register(cors, { origin: app.environmentConfig.ValidCorsOrigins, }); - + app.log.info("Initialized new Fastify instance..."); return app; } if (import.meta.url === `file://${process.argv[1]}`) { - // local development + console.log(`Logging level set to ${process.env.LOG_LEVEL || "info"}`); + const client = new STSClient({ region: genericConfig.AwsRegion }); + const command = new GetCallerIdentityCommand({}); + try { + const data = await client.send(command); + console.log(`Logged in to AWS as ${data.Arn} on account ${data.Account}.`); + } catch { + console.error( + `Could not get AWS STS credentials: are you logged in to AWS? Run "aws configure sso" to log in.`, + ); + process.exit(1); + } const app = await init(); - app.listen({ port: 8080 }, (err) => { + app.listen({ port: 8080 }, async (err) => { /* eslint no-console: ["error", {"allow": ["log", "error"]}] */ if (err) console.error(err); - console.log("Server listening on 8080"); }); } export default init; diff --git a/src/lambda.ts b/src/api/lambda.ts similarity index 100% rename from src/lambda.ts rename to src/api/lambda.ts diff --git a/src/api/package.json b/src/api/package.json new file mode 100644 index 0000000..52c1946 --- /dev/null +++ b/src/api/package.json @@ -0,0 +1,59 @@ +{ + "name": "infra-core-api", + "version": "1.0.0", + "description": "ACM@UIUC Infra - Sample AWS Lambda in Node", + "main": "index.js", + "author": "ACM@UIUC", + "license": "BSD-3-Clause", + "type": "module", + "scripts": { + "build": "tsc && node build.js", + "dev": "cross-env LOG_LEVEL=debug concurrently --names 'esbuild,server' 'node esbuild.config.js --watch' 'cd ../../dist_devel && nodemon index.js'", + "typecheck": "tsc --noEmit", + "lint": "eslint . --ext .ts --cache", + "prettier": "prettier --check *.ts **/*.ts", + "prettier:write": "prettier --write *.ts **/*.ts" + }, + "dependencies": { + "@aws-sdk/client-dynamodb": "^3.624.0", + "@aws-sdk/client-secrets-manager": "^3.624.0", + "@aws-sdk/client-ses": "^3.734.0", + "@aws-sdk/client-sqs": "^3.738.0", + "@aws-sdk/client-sts": "^3.726.0", + "@aws-sdk/util-dynamodb": "^3.624.0", + "@azure/msal-node": "^2.16.1", + "@fastify/auth": "^5.0.1", + "@fastify/aws-lambda": "^5.0.0", + "@fastify/caching": "^9.0.1", + "@fastify/cors": "^10.0.1", + "@middy/core": "^6.0.0", + "@middy/event-normalizer": "^6.0.0", + "@middy/sqs-partial-batch-failure": "^6.0.0", + "@touch4it/ical-timezones": "^1.9.0", + "base64-arraybuffer": "^1.0.2", + "discord.js": "^14.15.3", + "dotenv": "^16.4.5", + "esbuild": "^0.24.2", + "fastify": "^5.1.0", + "fastify-plugin": "^4.5.1", + "ical-generator": "^7.2.0", + "jsonwebtoken": "^9.0.2", + "jwks-rsa": "^3.1.0", + "moment": "^2.30.1", + "moment-timezone": "^0.5.45", + "node-cache": "^5.1.2", + "passkit-generator": "^3.3.1", + "pino": "^9.6.0", + "pluralize": "^8.0.0", + "stripe": "^17.6.0", + "uuid": "^11.0.5", + "zod": "^3.23.8", + "zod-to-json-schema": "^3.23.2", + "zod-validation-error": "^3.3.1" + }, + "devDependencies": { + "@tsconfig/node22": "^22.0.0", + "@types/aws-lambda": "^8.10.147", + "nodemon": "^3.1.9" + } +} diff --git a/src/api/package.lambda.json b/src/api/package.lambda.json new file mode 100644 index 0000000..ae609ba --- /dev/null +++ b/src/api/package.lambda.json @@ -0,0 +1,15 @@ +{ + "name": "infra-core-api", + "version": "1.0.0", + "description": "ACM@UIUC Infra - Sample AWS Lambda in Node", + "main": "index.js", + "author": "ACM@UIUC", + "license": "BSD-3-Clause", + "type": "module", + "dependencies": { + "moment-timezone": "^0.5.45", + "passkit-generator": "^3.3.1", + "fastify": "^5.1.0" + }, + "devDependencies": {} +} diff --git a/src/plugins/auth.ts b/src/api/plugins/auth.ts similarity index 78% rename from src/plugins/auth.ts rename to src/api/plugins/auth.ts index afe8e14..4453c27 100644 --- a/src/plugins/auth.ts +++ b/src/api/plugins/auth.ts @@ -6,14 +6,15 @@ import { SecretsManagerClient, GetSecretValueCommand, } from "@aws-sdk/client-secrets-manager"; -import { AppRoles } from "../roles.js"; +import { AppRoles } from "../../common/roles.js"; import { BaseError, InternalServerError, UnauthenticatedError, UnauthorizedError, -} from "../errors/index.js"; -import { genericConfig, SecretConfig } from "../config.js"; +} from "../../common/errors/index.js"; +import { genericConfig, SecretConfig } from "../../common/config.js"; +import { getGroupRoles, getUserRoles } from "../functions/authorization.js"; function intersection(setA: Set, setB: Set): Set { const _intersection = new Set(); @@ -47,15 +48,14 @@ export type AadToken = { sub: string; tid: string; unique_name: string; + upn?: string; uti: string; ver: string; roles?: string[]; }; -const smClient = new SecretsManagerClient({ - region: genericConfig.AwsRegion, -}); export const getSecretValue = async ( + smClient: SecretsManagerClient, secretId: string, ): Promise | null | SecretConfig> => { const data = await smClient.send( @@ -112,7 +112,10 @@ const authPlugin: FastifyPluginAsync = async (fastify, _options) => { signingKey = process.env.JwtSigningKey || (( - (await getSecretValue(genericConfig.ConfigSecretName)) || { + (await getSecretValue( + fastify.secretsManagerClient, + genericConfig.ConfigSecretName, + )) || { jwt_key: "", } ).jwt_key as string) || @@ -157,19 +160,24 @@ const authPlugin: FastifyPluginAsync = async (fastify, _options) => { verifyOptions, ) as AadToken; request.tokenPayload = verifiedTokenData; - request.username = verifiedTokenData.email || verifiedTokenData.sub; + request.username = + verifiedTokenData.email || + verifiedTokenData.upn?.replace("acm.illinois.edu", "illinois.edu") || + verifiedTokenData.sub; const expectedRoles = new Set(validRoles); - if ( - verifiedTokenData.groups && - fastify.environmentConfig.GroupRoleMapping - ) { - for (const group of verifiedTokenData.groups) { - if (fastify.environmentConfig["GroupRoleMapping"][group]) { - for (const role of fastify.environmentConfig["GroupRoleMapping"][ - group - ]) { + if (verifiedTokenData.groups) { + const groupRoles = await Promise.allSettled( + verifiedTokenData.groups.map((x) => + getGroupRoles(fastify.dynamoClient, fastify, x), + ), + ); + for (const result of groupRoles) { + if (result.status === "fulfilled") { + for (const role of result.value) { userRoles.add(role); } + } else { + request.log.warn(`Failed to get group roles: ${result.reason}`); } } } else { @@ -188,14 +196,22 @@ const authPlugin: FastifyPluginAsync = async (fastify, _options) => { } } } + // add user-specific role overrides - if (request.username && fastify.environmentConfig.UserRoleMapping) { - if (fastify.environmentConfig["UserRoleMapping"][request.username]) { - for (const role of fastify.environmentConfig["UserRoleMapping"][ - request.username - ]) { + if (request.username) { + try { + const userAuth = await getUserRoles( + fastify.dynamoClient, + fastify, + request.username, + ); + for (const role of userAuth) { userRoles.add(role); } + } catch (e) { + request.log.warn( + `Failed to get user role mapping for ${request.username}: ${e}`, + ); } } if ( @@ -216,12 +232,15 @@ const authPlugin: FastifyPluginAsync = async (fastify, _options) => { }); } if (err instanceof Error) { - request.log.error(`Failed to verify JWT: ${err.toString()}`); + request.log.error(`Failed to verify JWT: ${err.toString()} `); + throw err; } throw new UnauthenticatedError({ message: "Invalid token.", }); } + request.log.info(`authenticated request from ${request.username} `); + request.userRoles = userRoles; return userRoles; }, ); diff --git a/src/plugins/errorHandler.ts b/src/api/plugins/errorHandler.ts similarity index 97% rename from src/plugins/errorHandler.ts rename to src/api/plugins/errorHandler.ts index b1d998d..53b7c6e 100644 --- a/src/plugins/errorHandler.ts +++ b/src/api/plugins/errorHandler.ts @@ -5,7 +5,7 @@ import { InternalServerError, NotFoundError, ValidationError, -} from "../errors/index.js"; +} from "../../common/errors/index.js"; const errorHandlerPlugin = fp(async (fastify) => { fastify.setErrorHandler( diff --git a/src/plugins/validate.ts b/src/api/plugins/validate.ts similarity index 87% rename from src/plugins/validate.ts rename to src/api/plugins/validate.ts index 12724b4..cf948b7 100644 --- a/src/plugins/validate.ts +++ b/src/api/plugins/validate.ts @@ -1,6 +1,9 @@ import { FastifyPluginAsync, FastifyReply, FastifyRequest } from "fastify"; import fp from "fastify-plugin"; -import { InternalServerError, ValidationError } from "../errors/index.js"; +import { + InternalServerError, + ValidationError, +} from "../../common/errors/index.js"; import { z, ZodError } from "zod"; import { fromError } from "zod-validation-error"; @@ -13,7 +16,7 @@ const zodValidationPlugin: FastifyPluginAsync = async (fastify, _options) => { zodSchema: z.ZodTypeAny, ): Promise { try { - await zodSchema.parseAsync(request.body); + await zodSchema.parseAsync(request.body || {}); } catch (e: unknown) { if (e instanceof ZodError) { throw new ValidationError({ diff --git a/src/api/resources/MembershipPass.pkpass/icon.png b/src/api/resources/MembershipPass.pkpass/icon.png new file mode 100644 index 0000000..3800ba0 Binary files /dev/null and b/src/api/resources/MembershipPass.pkpass/icon.png differ diff --git a/src/api/resources/MembershipPass.pkpass/logo.png b/src/api/resources/MembershipPass.pkpass/logo.png new file mode 100644 index 0000000..ae292cf Binary files /dev/null and b/src/api/resources/MembershipPass.pkpass/logo.png differ diff --git a/src/api/resources/MembershipPass.pkpass/pass.ts b/src/api/resources/MembershipPass.pkpass/pass.ts new file mode 100644 index 0000000..e0515a4 --- /dev/null +++ b/src/api/resources/MembershipPass.pkpass/pass.ts @@ -0,0 +1,18 @@ +export default { + sharingProhibited: true, + organizationName: "ACM @ UIUC", + description: "ACM Membership Pass", + teamIdentifier: "8VNQTQM2L6", + passTypeIdentifier: "REPLACE_ME", + foregroundColor: "rgb(242,253,255)", + labelColor: "rgb(243,155,109)", + backgroundColor: "rgb(0,83,179)", + logoText: "Membership Pass", + formatVersion: 1, + storeCard: { + headerFields: [], + secondaryFields: [], + auxiliaryFields: [], + backFields: [], + }, +}; diff --git a/src/api/resources/MembershipPass.pkpass/strip.png b/src/api/resources/MembershipPass.pkpass/strip.png new file mode 100644 index 0000000..b6be36f Binary files /dev/null and b/src/api/resources/MembershipPass.pkpass/strip.png differ diff --git a/src/api/resources/types.d.ts b/src/api/resources/types.d.ts new file mode 100644 index 0000000..45fdf85 --- /dev/null +++ b/src/api/resources/types.d.ts @@ -0,0 +1,11 @@ +/* eslint-disable @typescript-eslint/no-explicit-any */ + +declare module "*.png" { + const value: string; + export default value; +} + +declare module "*.json" { + const value: Record; + export default value; +} diff --git a/src/routes/events.ts b/src/api/routes/events.ts similarity index 79% rename from src/routes/events.ts rename to src/api/routes/events.ts index 2fa43dd..da3cd80 100644 --- a/src/routes/events.ts +++ b/src/api/routes/events.ts @@ -1,25 +1,25 @@ import { FastifyPluginAsync, FastifyRequest } from "fastify"; -import { AppRoles } from "../roles.js"; +import { AppRoles } from "../../common/roles.js"; import { z } from "zod"; import { zodToJsonSchema } from "zod-to-json-schema"; -import { OrganizationList } from "../orgs.js"; +import { OrganizationList } from "../../common/orgs.js"; import { DeleteItemCommand, - DynamoDBClient, GetItemCommand, PutItemCommand, QueryCommand, ScanCommand, } from "@aws-sdk/client-dynamodb"; -import { genericConfig } from "../config.js"; +import { genericConfig } from "../../common/config.js"; import { marshall, unmarshall } from "@aws-sdk/util-dynamodb"; import { BaseError, DatabaseFetchError, DatabaseInsertError, DiscordEventError, + NotFoundError, ValidationError, -} from "../errors/index.js"; +} from "../../common/errors/index.js"; import { randomUUID } from "crypto"; import moment from "moment-timezone"; import { IUpdateDiscord, updateDiscord } from "../functions/discord.js"; @@ -27,6 +27,7 @@ import { IUpdateDiscord, updateDiscord } from "../functions/discord.js"; // POST const repeatOptions = ["weekly", "biweekly"] as const; +const EVENT_CACHE_SECONDS = 90; export type EventRepeatOptions = (typeof repeatOptions)[number]; const baseSchema = z.object({ @@ -80,16 +81,12 @@ const getEventsSchema = z.array(getEventSchema); export type EventsGetResponse = z.infer; type EventsGetQueryParams = { upcomingOnly?: boolean }; -const dynamoClient = new DynamoDBClient({ - region: genericConfig.AwsRegion, -}); - const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { fastify.post<{ Body: EventPostRequest }>( "/:id?", { schema: { - response: { 200: responseJsonSchema }, + response: { 201: responseJsonSchema }, }, preValidation: async (request, reply) => { await fastify.zodValidateBody(request, reply, postRequestSchema); @@ -106,7 +103,7 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { ).id; const entryUUID = userProvidedId || randomUUID(); if (userProvidedId) { - const response = await dynamoClient.send( + const response = await fastify.dynamoClient.send( new GetItemCommand({ TableName: genericConfig.EventsDynamoTableName, Key: { id: { S: userProvidedId } }, @@ -128,27 +125,35 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { : new Date().toISOString(), updatedAt: new Date().toISOString(), }; - await dynamoClient.send( + await fastify.dynamoClient.send( new PutItemCommand({ TableName: genericConfig.EventsDynamoTableName, Item: marshall(entry), }), ); - + let verb = "created"; + if (userProvidedId && userProvidedId === entryUUID) { + verb = "modified"; + } try { if (request.body.featured && !request.body.repeats) { - await updateDiscord(entry, false, request.log); + await updateDiscord( + fastify.secretsManagerClient, + entry, + false, + request.log, + ); } } catch (e: unknown) { // restore original DB status if Discord fails. - await dynamoClient.send( + await fastify.dynamoClient.send( new DeleteItemCommand({ TableName: genericConfig.EventsDynamoTableName, Key: { id: { S: entryUUID } }, }), ); if (userProvidedId) { - await dynamoClient.send( + await fastify.dynamoClient.send( new PutItemCommand({ TableName: genericConfig.EventsDynamoTableName, Item: originalEvent, @@ -157,18 +162,21 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { } if (e instanceof Error) { - request.log.error(`Failed to publish event to Discord: ${e}`); + request.log.error(`Failed to publish event to Discord: ${e} `); } if (e instanceof BaseError) { throw e; } throw new DiscordEventError({}); } - - reply.send({ + reply.status(201).send({ id: entryUUID, resource: `/api/v1/events/${entryUUID}`, }); + request.log.info( + { type: "audit", actor: request.username, target: entryUUID }, + `${verb} event "${entryUUID}"`, + ); } catch (e: unknown) { if (e instanceof Error) { request.log.error("Failed to insert to DynamoDB: " + e.toString()); @@ -192,7 +200,7 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { async (request: FastifyRequest, reply) => { const id = request.params.id; try { - const response = await dynamoClient.send( + const response = await fastify.dynamoClient.send( new QueryCommand({ TableName: genericConfig.EventsDynamoTableName, KeyConditionExpression: "#id = :id", @@ -204,10 +212,15 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { ); const items = response.Items?.map((item) => unmarshall(item)); if (items?.length !== 1) { - throw new Error("Event not found"); + throw new NotFoundError({ + endpointName: request.url, + }); } reply.send(items[0]); } catch (e: unknown) { + if (e instanceof BaseError) { + throw e; + } if (e instanceof Error) { request.log.error("Failed to get from DynamoDB: " + e.toString()); } @@ -226,7 +239,7 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { "/:id", { schema: { - response: { 200: responseJsonSchema }, + response: { 201: responseJsonSchema }, }, onRequest: async (request, reply) => { await fastify.authorize(request, reply, [AppRoles.EVENTS_MANAGER]); @@ -235,14 +248,19 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { async (request: FastifyRequest, reply) => { const id = request.params.id; try { - await dynamoClient.send( + await fastify.dynamoClient.send( new DeleteItemCommand({ TableName: genericConfig.EventsDynamoTableName, Key: marshall({ id }), }), ); - await updateDiscord({ id } as IUpdateDiscord, true, request.log); - reply.send({ + await updateDiscord( + fastify.secretsManagerClient, + { id } as IUpdateDiscord, + true, + request.log, + ); + reply.status(201).send({ id, resource: `/api/v1/events/${id}`, }); @@ -254,6 +272,10 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { message: "Failed to delete event from Dynamo table.", }); } + request.log.info( + { type: "audit", actor: request.username, target: id }, + `deleted event "${id}"`, + ); }, ); type EventsGetRequest = { @@ -275,8 +297,20 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { }, async (request: FastifyRequest, reply) => { const upcomingOnly = request.query?.upcomingOnly || false; + const cachedResponse = fastify.nodeCache.get( + `events-upcoming_only=${upcomingOnly}`, + ); + if (cachedResponse) { + return reply + .header( + "cache-control", + "public, max-age=7200, stale-while-revalidate=900, stale-if-error=86400", + ) + .header("acm-cache-status", "hit") + .send(cachedResponse); + } try { - const response = await dynamoClient.send( + const response = await fastify.dynamoClient.send( new ScanCommand({ TableName: genericConfig.EventsDynamoTableName }), ); const items = response.Items?.map((item) => unmarshall(item)); @@ -306,23 +340,29 @@ const eventsPlugin: FastifyPluginAsync = async (fastify, _options) => { ); } catch (e: unknown) { request.log.warn( - `Could not compute upcoming event status for event ${item.title}: ${e instanceof Error ? e.toString() : e}`, + `Could not compute upcoming event status for event ${item.title}: ${e instanceof Error ? e.toString() : e} `, ); return false; } }); } + fastify.nodeCache.set( + `events-upcoming_only=${upcomingOnly}`, + parsedItems, + EVENT_CACHE_SECONDS, + ); reply .header( "cache-control", "public, max-age=7200, stale-while-revalidate=900, stale-if-error=86400", ) + .header("acm-cache-status", "miss") .send(parsedItems); } catch (e: unknown) { if (e instanceof Error) { request.log.error("Failed to get from DynamoDB: " + e.toString()); } else { - request.log.error(`Failed to get from DynamoDB. ${e}`); + request.log.error(`Failed to get from DynamoDB.${e} `); } throw new DatabaseFetchError({ message: "Failed to get events from Dynamo table.", diff --git a/src/api/routes/iam.ts b/src/api/routes/iam.ts new file mode 100644 index 0000000..6955c75 --- /dev/null +++ b/src/api/routes/iam.ts @@ -0,0 +1,425 @@ +import { FastifyPluginAsync } from "fastify"; +import { allAppRoles, AppRoles } from "../../common/roles.js"; +import { zodToJsonSchema } from "zod-to-json-schema"; +import { + addToTenant, + getEntraIdToken, + listGroupMembers, + modifyGroup, + patchUserProfile, +} from "../functions/entraId.js"; +import { + BaseError, + DatabaseFetchError, + DatabaseInsertError, + EntraGroupError, + EntraInvitationError, + InternalServerError, + NotFoundError, + UnauthorizedError, +} from "../../common/errors/index.js"; +import { PutItemCommand } from "@aws-sdk/client-dynamodb"; +import { genericConfig } from "../../common/config.js"; +import { marshall } from "@aws-sdk/util-dynamodb"; +import { + InviteUserPostRequest, + invitePostRequestSchema, + GroupMappingCreatePostRequest, + groupMappingCreatePostSchema, + entraActionResponseSchema, + groupModificationPatchSchema, + GroupModificationPatchRequest, + EntraGroupActions, + entraGroupMembershipListResponse, + ProfilePatchRequest, + entraProfilePatchRequest, +} from "../../common/types/iam.js"; +import { + AUTH_DECISION_CACHE_SECONDS, + getGroupRoles, +} from "../functions/authorization.js"; + +const iamRoutes: FastifyPluginAsync = async (fastify, _options) => { + fastify.patch<{ Body: ProfilePatchRequest }>( + "/profile", + { + preValidation: async (request, reply) => { + await fastify.zodValidateBody(request, reply, entraProfilePatchRequest); + }, + onRequest: async (request, reply) => { + await fastify.authorize(request, reply, allAppRoles); + }, + }, + async (request, reply) => { + if (!request.tokenPayload || !request.username) { + throw new UnauthorizedError({ + message: "User does not have the privileges for this task.", + }); + } + const userOid = request.tokenPayload["oid"]; + const entraIdToken = await getEntraIdToken( + { + smClient: fastify.secretsManagerClient, + dynamoClient: fastify.dynamoClient, + }, + fastify.environmentConfig.AadValidClientId, + ); + await patchUserProfile( + entraIdToken, + request.username, + userOid, + request.body, + ); + reply.send(201); + }, + ); + fastify.get<{ + Body: undefined; + Querystring: { groupId: string }; + }>( + "/groups/:groupId/roles", + { + schema: { + querystring: { + type: "object", + properties: { + groupId: { + type: "string", + }, + }, + }, + }, + onRequest: async (request, reply) => { + await fastify.authorize(request, reply, [AppRoles.IAM_ADMIN]); + }, + }, + async (request, reply) => { + try { + const groupId = (request.params as Record).groupId; + const roles = await getGroupRoles( + fastify.dynamoClient, + fastify, + groupId, + ); + return reply.send(roles); + } catch (e: unknown) { + if (e instanceof BaseError) { + throw e; + } + + request.log.error(e); + throw new DatabaseFetchError({ + message: "An error occurred finding the group role mapping.", + }); + } + }, + ); + fastify.post<{ + Body: GroupMappingCreatePostRequest; + Querystring: { groupId: string }; + }>( + "/groups/:groupId/roles", + { + schema: { + querystring: { + type: "object", + properties: { + groupId: { + type: "string", + }, + }, + }, + }, + preValidation: async (request, reply) => { + await fastify.zodValidateBody( + request, + reply, + groupMappingCreatePostSchema, + ); + }, + onRequest: async (request, reply) => { + await fastify.authorize(request, reply, [AppRoles.IAM_ADMIN]); + }, + }, + async (request, reply) => { + const groupId = (request.params as Record).groupId; + try { + const timestamp = new Date().toISOString(); + const command = new PutItemCommand({ + TableName: `${genericConfig.IAMTablePrefix}-grouproles`, + Item: marshall({ + groupUuid: groupId, + roles: request.body.roles, + createdAt: timestamp, + }), + }); + await fastify.dynamoClient.send(command); + fastify.nodeCache.set( + `grouproles-${groupId}`, + request.body.roles, + AUTH_DECISION_CACHE_SECONDS, + ); + } catch (e: unknown) { + fastify.nodeCache.del(`grouproles-${groupId}`); + if (e instanceof BaseError) { + throw e; + } + + request.log.error(e); + throw new DatabaseInsertError({ + message: "Could not create group role mapping.", + }); + } + reply.send({ message: "OK" }); + request.log.info( + { type: "audit", actor: request.username, target: groupId }, + `set target roles to ${request.body.roles.toString()}`, + ); + }, + ); + fastify.post<{ Body: InviteUserPostRequest }>( + "/inviteUsers", + { + schema: { + response: { 202: zodToJsonSchema(entraActionResponseSchema) }, + }, + preValidation: async (request, reply) => { + await fastify.zodValidateBody(request, reply, invitePostRequestSchema); + }, + onRequest: async (request, reply) => { + await fastify.authorize(request, reply, [AppRoles.IAM_INVITE_ONLY]); + }, + }, + async (request, reply) => { + const emails = request.body.emails; + const entraIdToken = await getEntraIdToken( + { + smClient: fastify.secretsManagerClient, + dynamoClient: fastify.dynamoClient, + }, + fastify.environmentConfig.AadValidClientId, + ); + if (!entraIdToken) { + throw new InternalServerError({ + message: "Could not get Entra ID token to perform task.", + }); + } + const response: Record[]> = { + success: [], + failure: [], + }; + const results = await Promise.allSettled( + emails.map((email) => addToTenant(entraIdToken, email)), + ); + for (let i = 0; i < results.length; i++) { + const result = results[i]; + if (result.status === "fulfilled") { + request.log.info( + { type: "audit", actor: request.username, target: emails[i] }, + "invited user to Entra ID tenant.", + ); + response.success.push({ email: emails[i] }); + } else { + request.log.info( + { type: "audit", actor: request.username, target: emails[i] }, + "failed to invite user to Entra ID tenant.", + ); + if (result.reason instanceof EntraInvitationError) { + response.failure.push({ + email: emails[i], + message: result.reason.message, + }); + } else { + response.failure.push({ + email: emails[i], + message: "An unknown error occurred.", + }); + } + } + } + reply.status(202).send(response); + }, + ); + fastify.patch<{ + Body: GroupModificationPatchRequest; + Querystring: { groupId: string }; + }>( + "/groups/:groupId", + { + schema: { + querystring: { + type: "object", + properties: { + groupId: { + type: "string", + }, + }, + }, + }, + preValidation: async (request, reply) => { + await fastify.zodValidateBody( + request, + reply, + groupModificationPatchSchema, + ); + }, + onRequest: async (request, reply) => { + await fastify.authorize(request, reply, [AppRoles.IAM_ADMIN]); + }, + }, + async (request, reply) => { + const groupId = (request.params as Record).groupId; + if (!groupId || groupId === "") { + throw new NotFoundError({ + endpointName: request.url, + }); + } + if (genericConfig.ProtectedEntraIDGroups.includes(groupId)) { + throw new EntraGroupError({ + code: 403, + message: + "This group is protected and cannot be modified by this service. You must log into Entra ID directly to modify this group.", + group: groupId, + }); + } + const entraIdToken = await getEntraIdToken( + { + smClient: fastify.secretsManagerClient, + dynamoClient: fastify.dynamoClient, + }, + fastify.environmentConfig.AadValidClientId, + ); + const addResults = await Promise.allSettled( + request.body.add.map((email) => + modifyGroup(entraIdToken, email, groupId, EntraGroupActions.ADD), + ), + ); + const removeResults = await Promise.allSettled( + request.body.remove.map((email) => + modifyGroup(entraIdToken, email, groupId, EntraGroupActions.REMOVE), + ), + ); + const response: Record[]> = { + success: [], + failure: [], + }; + for (let i = 0; i < addResults.length; i++) { + const result = addResults[i]; + if (result.status === "fulfilled") { + response.success.push({ email: request.body.add[i] }); + request.log.info( + { + type: "audit", + actor: request.username, + target: request.body.add[i], + }, + `added target to group ID ${groupId}`, + ); + } else { + request.log.info( + { + type: "audit", + actor: request.username, + target: request.body.add[i], + }, + `failed to add target to group ID ${groupId}`, + ); + if (result.reason instanceof EntraGroupError) { + response.failure.push({ + email: request.body.add[i], + message: result.reason.message, + }); + } else { + response.failure.push({ + email: request.body.add[i], + message: "An unknown error occurred.", + }); + } + } + } + for (let i = 0; i < removeResults.length; i++) { + const result = removeResults[i]; + if (result.status === "fulfilled") { + response.success.push({ email: request.body.remove[i] }); + request.log.info( + { + type: "audit", + actor: request.username, + target: request.body.remove[i], + }, + `removed target from group ID ${groupId}`, + ); + } else { + request.log.info( + { + type: "audit", + actor: request.username, + target: request.body.add[i], + }, + `failed to remove target from group ID ${groupId}`, + ); + if (result.reason instanceof EntraGroupError) { + response.failure.push({ + email: request.body.add[i], + message: result.reason.message, + }); + } else { + response.failure.push({ + email: request.body.add[i], + message: "An unknown error occurred.", + }); + } + } + } + reply.status(202).send(response); + }, + ); + fastify.get<{ + Querystring: { groupId: string }; + }>( + "/groups/:groupId", + { + schema: { + response: { 200: zodToJsonSchema(entraGroupMembershipListResponse) }, + querystring: { + type: "object", + properties: { + groupId: { + type: "string", + }, + }, + }, + }, + onRequest: async (request, reply) => { + await fastify.authorize(request, reply, [AppRoles.IAM_ADMIN]); + }, + }, + async (request, reply) => { + const groupId = (request.params as Record).groupId; + if (!groupId || groupId === "") { + throw new NotFoundError({ + endpointName: request.url, + }); + } + if (genericConfig.ProtectedEntraIDGroups.includes(groupId)) { + throw new EntraGroupError({ + code: 403, + message: + "This group is protected and cannot be read by this service. You must log into Entra ID directly to read this group.", + group: groupId, + }); + } + const entraIdToken = await getEntraIdToken( + { + smClient: fastify.secretsManagerClient, + dynamoClient: fastify.dynamoClient, + }, + fastify.environmentConfig.AadValidClientId, + ); + const response = await listGroupMembers(entraIdToken, groupId); + reply.status(200).send(response); + }, + ); +}; + +export default iamRoutes; diff --git a/src/routes/ics.ts b/src/api/routes/ics.ts similarity index 91% rename from src/routes/ics.ts rename to src/api/routes/ics.ts index aa1f6cc..3a10af7 100644 --- a/src/routes/ics.ts +++ b/src/api/routes/ics.ts @@ -1,13 +1,12 @@ import { FastifyPluginAsync } from "fastify"; import { - DynamoDBClient, QueryCommand, QueryCommandInput, ScanCommand, } from "@aws-sdk/client-dynamodb"; -import { genericConfig } from "../config.js"; +import { genericConfig } from "../../common/config.js"; import { unmarshall } from "@aws-sdk/util-dynamodb"; -import { NotFoundError, ValidationError } from "../errors/index.js"; +import { NotFoundError, ValidationError } from "../../common/errors/index.js"; import ical, { ICalCalendarMethod, ICalEventJSONRepeatingData, @@ -15,13 +14,9 @@ import ical, { } from "ical-generator"; import moment from "moment"; import { getVtimezoneComponent } from "@touch4it/ical-timezones"; -import { OrganizationList } from "../orgs.js"; +import { OrganizationList } from "../../common/orgs.js"; import { EventRepeatOptions } from "./events.js"; -const dynamoClient = new DynamoDBClient({ - region: genericConfig.AwsRegion, -}); - const repeatingIcalMap: Record = { weekly: { freq: ICalEventRepeatingFreq.WEEKLY }, @@ -54,7 +49,7 @@ const icalPlugin: FastifyPluginAsync = async (fastify, _options) => { queryParams = { ...queryParams, }; - response = await dynamoClient.send( + response = await fastify.dynamoClient.send( new QueryCommand({ ...queryParams, ExpressionAttributeValues: { @@ -67,7 +62,7 @@ const icalPlugin: FastifyPluginAsync = async (fastify, _options) => { }), ); } else { - response = await dynamoClient.send(new ScanCommand(queryParams)); + response = await fastify.dynamoClient.send(new ScanCommand(queryParams)); } const dynamoItems = response.Items ? response.Items.map((x) => unmarshall(x)) diff --git a/src/api/routes/mobileWallet.ts b/src/api/routes/mobileWallet.ts new file mode 100644 index 0000000..343563d --- /dev/null +++ b/src/api/routes/mobileWallet.ts @@ -0,0 +1,100 @@ +import { FastifyPluginAsync } from "fastify"; +import { + InternalServerError, + UnauthenticatedError, + ValidationError, +} from "../../common/errors/index.js"; +import { z } from "zod"; +import { checkPaidMembership } from "../functions/membership.js"; +import { + AvailableSQSFunctions, + SQSPayload, +} from "../../common/types/sqsMessage.js"; +import { SendMessageCommand, SQSClient } from "@aws-sdk/client-sqs"; +import { genericConfig } from "../../common/config.js"; +import { zodToJsonSchema } from "zod-to-json-schema"; + +const queuedResponseJsonSchema = zodToJsonSchema( + z.object({ + queueId: z.string().uuid(), + }), +); + +const mobileWalletRoute: FastifyPluginAsync = async (fastify, _options) => { + fastify.post<{ Querystring: { email: string } }>( + "/membership", + { + schema: { + response: { 202: queuedResponseJsonSchema }, + querystring: { + type: "object", + properties: { + email: { type: "string", format: "email" }, + }, + required: ["email"], + }, + }, + }, + async (request, reply) => { + if (!request.query.email) { + throw new UnauthenticatedError({ message: "Could not find user." }); + } + try { + await z + .string() + .email() + .refine( + (email) => email.endsWith("@illinois.edu"), + "Email must be on the illinois.edu domain.", + ) + .parseAsync(request.query.email); + } catch { + throw new ValidationError({ + message: "Email query parameter is not a valid email", + }); + } + const isPaidMember = await checkPaidMembership( + fastify.environmentConfig.MembershipApiEndpoint, + request.log, + request.query.email.replace("@illinois.edu", ""), + ); + if (!isPaidMember) { + throw new UnauthenticatedError({ + message: `${request.query.email} is not a paid member.`, + }); + } + const sqsPayload: SQSPayload = + { + function: AvailableSQSFunctions.EmailMembershipPass, + metadata: { + initiator: "public", + reqId: request.id, + }, + payload: { + email: request.query.email, + }, + }; + if (!fastify.sqsClient) { + fastify.sqsClient = new SQSClient({ + region: genericConfig.AwsRegion, + }); + } + const result = await fastify.sqsClient.send( + new SendMessageCommand({ + QueueUrl: fastify.environmentConfig.SqsQueueUrl, + MessageBody: JSON.stringify(sqsPayload), + }), + ); + if (!result.MessageId) { + request.log.error(result); + throw new InternalServerError({ + message: "Could not add job to queue.", + }); + } + request.log.info(`Queued job to SQS with message ID ${result.MessageId}`); + reply.status(202).send({ queueId: result.MessageId }); + }, + ); +}; + +export default mobileWalletRoute; diff --git a/src/routes/organizations.ts b/src/api/routes/organizations.ts similarity index 88% rename from src/routes/organizations.ts rename to src/api/routes/organizations.ts index ec4871d..da05b32 100644 --- a/src/routes/organizations.ts +++ b/src/api/routes/organizations.ts @@ -1,5 +1,5 @@ import { FastifyPluginAsync } from "fastify"; -import { OrganizationList } from "../orgs.js"; +import { OrganizationList } from "../../common/orgs.js"; import fastifyCaching from "@fastify/caching"; const organizationsPlugin: FastifyPluginAsync = async (fastify, _options) => { diff --git a/src/routes/protected.ts b/src/api/routes/protected.ts similarity index 100% rename from src/routes/protected.ts rename to src/api/routes/protected.ts diff --git a/src/api/routes/stripe.ts b/src/api/routes/stripe.ts new file mode 100644 index 0000000..2e94248 --- /dev/null +++ b/src/api/routes/stripe.ts @@ -0,0 +1,152 @@ +import { + PutItemCommand, + QueryCommand, + ScanCommand, +} from "@aws-sdk/client-dynamodb"; +import { marshall, unmarshall } from "@aws-sdk/util-dynamodb"; +import { + createStripeLink, + StripeLinkCreateParams, +} from "api/functions/stripe.js"; +import { getSecretValue } from "api/plugins/auth.js"; +import { genericConfig } from "common/config.js"; +import { + BaseError, + DatabaseFetchError, + InternalServerError, + UnauthenticatedError, +} from "common/errors/index.js"; +import { AppRoles } from "common/roles.js"; +import { + invoiceLinkPostResponseSchema, + invoiceLinkPostRequestSchema, + invoiceLinkGetResponseSchema, +} from "common/types/stripe.js"; +import { FastifyPluginAsync } from "fastify"; +import { z } from "zod"; +import { zodToJsonSchema } from "zod-to-json-schema"; + +const stripeRoutes: FastifyPluginAsync = async (fastify, _options) => { + fastify.get( + "/paymentLinks", + { + schema: { + response: { 200: zodToJsonSchema(invoiceLinkGetResponseSchema) }, + }, + onRequest: async (request, reply) => { + await fastify.authorize(request, reply, [AppRoles.STRIPE_LINK_CREATOR]); + }, + }, + async (request, reply) => { + let dynamoCommand; + if (request.userRoles?.has(AppRoles.BYPASS_OBJECT_LEVEL_AUTH)) { + dynamoCommand = new ScanCommand({ + TableName: genericConfig.StripeLinksDynamoTableName, + }); + } else { + dynamoCommand = new QueryCommand({ + TableName: genericConfig.StripeLinksDynamoTableName, + KeyConditionExpression: "userId = :userId", + ExpressionAttributeValues: { + ":userId": { S: request.username! }, + }, + }); + } + let result; + try { + result = await fastify.dynamoClient.send(dynamoCommand); + } catch (e) { + if (e instanceof BaseError) { + throw e; + } + request.log.error(e); + throw new DatabaseFetchError({ + message: "Could not get active links.", + }); + } + + if (result.Count === 0 || !result.Items) { + return []; + } + const parsed = result.Items.map((item) => unmarshall(item)).map( + (item) => ({ + id: item.linkId, + userId: item.userId, + link: item.url, + active: item.active, + invoiceId: item.invoiceId, + invoiceAmountUsd: item.amount, + createdAt: item.createdAt || null, + }), + ); + reply.status(200).send(parsed); + }, + ); + fastify.post<{ Body: z.infer }>( + "/paymentLinks", + { + schema: { + response: { 201: zodToJsonSchema(invoiceLinkPostResponseSchema) }, + }, + preValidation: async (request, reply) => { + await fastify.zodValidateBody( + request, + reply, + invoiceLinkPostRequestSchema, + ); + }, + onRequest: async (request, reply) => { + await fastify.authorize(request, reply, [AppRoles.STRIPE_LINK_CREATOR]); + }, + }, + async (request, reply) => { + if (!request.username) { + throw new UnauthenticatedError({ message: "No username found" }); + } + const secretApiConfig = + (await getSecretValue( + fastify.secretsManagerClient, + genericConfig.ConfigSecretName, + )) || {}; + if (!secretApiConfig) { + throw new InternalServerError({ + message: "Could not connect to Stripe.", + }); + } + const payload: StripeLinkCreateParams = { + ...request.body, + createdBy: request.username, + stripeApiKey: secretApiConfig.stripe_secret_key as string, + }; + const { url, linkId, priceId, productId } = + await createStripeLink(payload); + const invoiceId = request.body.invoiceId; + const dynamoCommand = new PutItemCommand({ + TableName: genericConfig.StripeLinksDynamoTableName, + Item: marshall({ + userId: request.username, + linkId, + priceId, + productId, + invoiceId, + url, + amount: request.body.invoiceAmountUsd, + active: true, + createdAt: new Date().toISOString(), + }), + }); + await fastify.dynamoClient.send(dynamoCommand); + request.log.info( + { + type: "audit", + actor: request.username, + target: `Link ${linkId} | Invoice ${invoiceId}`, + }, + "Created Stripe payment link", + ); + reply.status(201).send({ id: linkId, link: url }); + }, + ); +}; + +export default stripeRoutes; diff --git a/src/routes/tickets.ts b/src/api/routes/tickets.ts similarity index 94% rename from src/routes/tickets.ts rename to src/api/routes/tickets.ts index 58f0a3a..74783b9 100644 --- a/src/routes/tickets.ts +++ b/src/api/routes/tickets.ts @@ -1,12 +1,11 @@ import { FastifyPluginAsync } from "fastify"; import { z } from "zod"; import { - DynamoDBClient, QueryCommand, ScanCommand, UpdateItemCommand, } from "@aws-sdk/client-dynamodb"; -import { genericConfig } from "../config.js"; +import { genericConfig } from "../../common/config.js"; import { BaseError, DatabaseFetchError, @@ -16,10 +15,10 @@ import { TicketNotValidError, UnauthenticatedError, ValidationError, -} from "../errors/index.js"; +} from "../../common/errors/index.js"; import { unmarshall } from "@aws-sdk/util-dynamodb"; import { validateEmail } from "../functions/validation.js"; -import { AppRoles } from "../roles.js"; +import { AppRoles } from "../../common/roles.js"; import { zodToJsonSchema } from "zod-to-json-schema"; const postMerchSchema = z.object({ @@ -93,10 +92,6 @@ const postSchema = z.union([postMerchSchema, postTicketSchema]); type VerifyPostRequest = z.infer; -const dynamoClient = new DynamoDBClient({ - region: genericConfig.AwsRegion, -}); - type TicketsGetRequest = { Params: { id: string }; Querystring: { type: string }; @@ -140,7 +135,7 @@ const ticketsPlugin: FastifyPluginAsync = async (fastify, _options) => { }); const merchItems: ItemMetadata[] = []; - const response = await dynamoClient.send(merchCommand); + const response = await fastify.dynamoClient.send(merchCommand); const now = new Date(); if (response.Items) { @@ -175,7 +170,7 @@ const ticketsPlugin: FastifyPluginAsync = async (fastify, _options) => { }); const ticketItems: TicketItemMetadata[] = []; - const ticketResponse = await dynamoClient.send(ticketCommand); + const ticketResponse = await fastify.dynamoClient.send(ticketCommand); if (ticketResponse.Items) { for (const item of ticketResponse.Items.map((x) => unmarshall(x))) { @@ -243,7 +238,7 @@ const ticketsPlugin: FastifyPluginAsync = async (fastify, _options) => { ":itemId": { S: eventId }, }, }); - const response = await dynamoClient.send(command); + const response = await fastify.dynamoClient.send(command); if (!response.Items) { throw new NotFoundError({ endpointName: `/api/v1/tickets/${eventId}`, @@ -340,7 +335,7 @@ const ticketsPlugin: FastifyPluginAsync = async (fastify, _options) => { } let purchaserData: PurchaseData; try { - const ticketEntry = await dynamoClient.send(command); + const ticketEntry = await fastify.dynamoClient.send(command); if (!ticketEntry.Attributes) { throw new DatabaseFetchError({ message: "Could not find ticket data", @@ -436,8 +431,12 @@ const ticketsPlugin: FastifyPluginAsync = async (fastify, _options) => { message: `Unknown verification type!`, }); } - await dynamoClient.send(command); + await fastify.dynamoClient.send(command); reply.send(response); + request.log.info( + { type: "audit", actor: request.username, target: ticketId }, + `checked in ticket of type "${request.body.type}" ${request.body.type === "merch" ? `purchased by email ${request.body.email}.` : "."}`, + ); }, ); }; diff --git a/src/routes/vending.ts b/src/api/routes/vending.ts similarity index 100% rename from src/routes/vending.ts rename to src/api/routes/vending.ts diff --git a/src/api/sqs/driver.ts b/src/api/sqs/driver.ts new file mode 100644 index 0000000..faf682b --- /dev/null +++ b/src/api/sqs/driver.ts @@ -0,0 +1,26 @@ +import { SendMessageCommand, SQSClient } from "@aws-sdk/client-sqs"; +import { environmentConfig, genericConfig } from "common/config.js"; +import { parseSQSPayload } from "common/types/sqsMessage.js"; + +const queueUrl = environmentConfig["dev"].SqsQueueUrl; +const sqsClient = new SQSClient({ + region: genericConfig.AwsRegion, +}); + +const payload = parseSQSPayload({ + function: "ping", + payload: {}, + metadata: { + reqId: "1", + initiator: "dsingh14@illinois.edu", + }, +}); +if (!payload) { + throw new Error("not valid"); +} +const command = new SendMessageCommand({ + QueueUrl: queueUrl, + MessageBody: JSON.stringify(payload), +}); + +await sqsClient.send(command); diff --git a/src/api/sqs/handlers.ts b/src/api/sqs/handlers.ts new file mode 100644 index 0000000..50ef3f1 --- /dev/null +++ b/src/api/sqs/handlers.ts @@ -0,0 +1,57 @@ +import { AvailableSQSFunctions } from "common/types/sqsMessage.js"; +import { + currentEnvironmentConfig, + runEnvironment, + SQSHandlerFunction, +} from "./index.js"; +import { + getEntraIdToken, + getUserProfile, +} from "../../api/functions/entraId.js"; +import { DynamoDBClient } from "@aws-sdk/client-dynamodb"; +import { environmentConfig, genericConfig } from "../../common/config.js"; +import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"; +import { issueAppleWalletMembershipCard } from "../../api/functions/mobileWallet.js"; +import { generateMembershipEmailCommand } from "../../api/functions/ses.js"; +import { SESClient } from "@aws-sdk/client-ses"; + +export const emailMembershipPassHandler: SQSHandlerFunction< + AvailableSQSFunctions.EmailMembershipPass +> = async (payload, _metadata, logger) => { + const email = payload.email; + const commonConfig = { region: genericConfig.AwsRegion }; + const clients = { + smClient: new SecretsManagerClient(commonConfig), + dynamoClient: new DynamoDBClient(commonConfig), + }; + const entraIdToken = await getEntraIdToken( + clients, + currentEnvironmentConfig.AadValidClientId, + ); + const userProfile = await getUserProfile(entraIdToken, email); + const pkpass = await issueAppleWalletMembershipCard( + clients, + environmentConfig[runEnvironment], + runEnvironment, + email, + logger, + userProfile.displayName, + ); + const emailCommand = generateMembershipEmailCommand( + email, + `membership@${environmentConfig[runEnvironment].EmailDomain}`, + pkpass, + ); + if (runEnvironment === "dev" && email === "testinguser@illinois.edu") { + return; + } + const sesClient = new SESClient(commonConfig); + return await sesClient.send(emailCommand); +}; + +export const pingHandler: SQSHandlerFunction< + AvailableSQSFunctions.Ping +> = async (payload, metadata, logger) => { + logger.error("Not implemented yet!"); + return; +}; diff --git a/src/api/sqs/index.ts b/src/api/sqs/index.ts new file mode 100644 index 0000000..890697e --- /dev/null +++ b/src/api/sqs/index.ts @@ -0,0 +1,83 @@ +import middy from "@middy/core"; +import eventNormalizerMiddleware from "@middy/event-normalizer"; +import sqsPartialBatchFailure from "@middy/sqs-partial-batch-failure"; +import { Context, SQSEvent } from "aws-lambda"; +import { + parseSQSPayload, + sqsPayloadSchemas, + AvailableSQSFunctions, + SQSMessageMetadata, + AnySQSPayload, +} from "../../common/types/sqsMessage.js"; +import { logger } from "./logger.js"; +import { z, ZodError } from "zod"; +import pino from "pino"; +import { emailMembershipPassHandler, pingHandler } from "./handlers.js"; +import { ValidationError } from "../../common/errors/index.js"; +import { RunEnvironment } from "../../common/roles.js"; +import { environmentConfig } from "../../common/config.js"; + +export type SQSFunctionPayloadTypes = { + [K in keyof typeof sqsPayloadSchemas]: SQSHandlerFunction; +}; + +export type SQSHandlerFunction = ( + payload: z.infer<(typeof sqsPayloadSchemas)[T]>["payload"], + metadata: SQSMessageMetadata, + logger: pino.Logger, +) => Promise; + +const handlers: SQSFunctionPayloadTypes = { + [AvailableSQSFunctions.EmailMembershipPass]: emailMembershipPassHandler, + [AvailableSQSFunctions.Ping]: pingHandler, +}; +export const runEnvironment = process.env.RunEnvironment as RunEnvironment; +export const currentEnvironmentConfig = environmentConfig[runEnvironment]; + +export const handler = middy() + .use(eventNormalizerMiddleware()) + .use(sqsPartialBatchFailure()) + .handler((event: SQSEvent, _context: Context, { signal: _signal }) => { + const recordsPromises = event.Records.map(async (record, _index) => { + try { + let parsedBody = parseSQSPayload(record.body); + if (parsedBody instanceof ZodError) { + logger.error( + { sqsMessageId: record.messageId }, + parsedBody.toString(), + ); + throw new ValidationError({ + message: "Could not parse SQS payload", + }); + } + parsedBody = parsedBody as AnySQSPayload; + const childLogger = logger.child({ + sqsMessageId: record.messageId, + metadata: parsedBody.metadata, + function: parsedBody.function, + }); + const func = handlers[parsedBody.function] as SQSHandlerFunction< + typeof parsedBody.function + >; + childLogger.info(`Starting handler for ${parsedBody.function}...`); + const result = func( + parsedBody.payload, + parsedBody.metadata, + childLogger, + ); + childLogger.info(`Finished handler for ${parsedBody.function}.`); + return result; + } catch (e: unknown) { + if (!(e instanceof Error)) { + logger.error( + { sqsMessageId: record.messageId }, + "An unknown-type error occurred.", + ); + throw e; + } + logger.error({ sqsMessageId: record.messageId }, e.toString()); + throw e; + } + }); + return Promise.allSettled(recordsPromises); + }); diff --git a/src/api/sqs/logger.ts b/src/api/sqs/logger.ts new file mode 100644 index 0000000..4991cb2 --- /dev/null +++ b/src/api/sqs/logger.ts @@ -0,0 +1,2 @@ +import { pino } from "pino"; +export const logger = pino().child({ context: "sqsHandler" }); diff --git a/src/api/tsconfig.json b/src/api/tsconfig.json new file mode 100644 index 0000000..7a90b5c --- /dev/null +++ b/src/api/tsconfig.json @@ -0,0 +1,20 @@ +{ + "extends": "@tsconfig/node22/tsconfig.json", + "compilerOptions": { + "module": "Node16", + "rootDir": "../", + "outDir": "../../dist", + "baseUrl": "../", + }, + "ts-node": { + "esm": true + }, + "include": [ + "../api/**/*.ts", + "../common/**/*.ts" + ], + "exclude": [ + "../../node_modules", + "../../dist" + ] +} diff --git a/src/types.d.ts b/src/api/types.d.ts similarity index 53% rename from src/types.d.ts rename to src/api/types.d.ts index e265a07..26eee1b 100644 --- a/src/types.d.ts +++ b/src/api/types.d.ts @@ -1,7 +1,13 @@ +/* eslint-disable @typescript-eslint/no-unused-vars */ import { FastifyRequest, FastifyInstance, FastifyReply } from "fastify"; -import { AppRoles, RunEnvironment } from "./roles.ts"; -import { AadToken } from "./plugins/auth.ts"; -import { ConfigType } from "./config.ts"; +import { AppRoles, RunEnvironment } from "../common/roles.js"; +import { AadToken } from "./plugins/auth.js"; +import { ConfigType } from "../common/config.js"; +import NodeCache from "node-cache"; +import { DynamoDBClient } from "@aws-sdk/client-dynamodb"; +import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager"; +import { SQSClient } from "@aws-sdk/client-sqs"; + declare module "fastify" { interface FastifyInstance { authenticate: ( @@ -20,10 +26,15 @@ declare module "fastify" { ) => Promise; runEnvironment: RunEnvironment; environmentConfig: ConfigType; + nodeCache: NodeCache; + dynamoClient: DynamoDBClient; + sqsClient?: SQSClient; + secretsManagerClient: SecretsManagerClient; } interface FastifyRequest { startTime: number; username?: string; + userRoles?: Set; tokenPayload?: AadToken; } } diff --git a/src/config.ts b/src/common/config.ts similarity index 55% rename from src/config.ts rename to src/common/config.ts index bcb189d..58995ee 100644 --- a/src/config.ts +++ b/src/common/config.ts @@ -1,4 +1,4 @@ -import { allAppRoles, AppRoles, RunEnvironment } from "./roles.js"; +import { AppRoles, RunEnvironment } from "./roles.js"; import { OriginFunction } from "@fastify/cors"; // From @fastify/cors @@ -6,21 +6,23 @@ type ArrayOfValueOrArray = Array>; type OriginType = string | boolean | RegExp; type ValueOrArray = T | ArrayOfValueOrArray; -type GroupRoleMapping = Record; type AzureRoleMapping = Record; -type UserRoleMapping = Record; export type ConfigType = { - GroupRoleMapping: GroupRoleMapping; AzureRoleMapping: AzureRoleMapping; - UserRoleMapping: UserRoleMapping; ValidCorsOrigins: ValueOrArray | OriginFunction; AadValidClientId: string; + PasskitIdentifier: string; + PasskitSerialNumber: string; + MembershipApiEndpoint: string; + EmailDomain: string; + SqsQueueUrl: string; }; -type GenericConfigType = { +export type GenericConfigType = { EventsDynamoTableName: string; CacheDynamoTableName: string; + StripeLinksDynamoTableName: string; ConfigSecretName: string; UpcomingEventThresholdSeconds: number; AwsRegion: string; @@ -29,14 +31,26 @@ type GenericConfigType = { TicketPurchasesTableName: string; TicketMetadataTableName: string; MerchStoreMetadataTableName: string; + IAMTablePrefix: string; + ProtectedEntraIDGroups: string[]; // these groups are too privileged to be modified via this portal and must be modified directly in Entra ID. }; type EnvironmentConfigType = { [env in RunEnvironment]: ConfigType; }; +export const infraChairsGroupId = "c0702752-50da-49da-83d4-bcbe6f7a9b1b"; +export const officersGroupId = "ff49e948-4587-416b-8224-65147540d5fc"; +export const officersGroupTestingId = "0e6e9199-506f-4ede-9d1b-e73f6811c9e5"; +export const execCouncilGroupId = "ad81254b-4eeb-4c96-8191-3acdce9194b1"; +export const execCouncilTestingGroupId = "dbe18eb2-9675-46c4-b1ef-749a6db4fedd"; +export const commChairsTestingGroupId = "d714adb7-07bb-4d4d-a40a-b035bc2a35a3"; +export const commChairsGroupId = "105e7d32-7289-435e-a67a-552c7f215507"; +export const miscTestingGroupId = "ff25ec56-6a33-420d-bdb0-51d8a3920e46"; + const genericConfig: GenericConfigType = { EventsDynamoTableName: "infra-core-api-events", + StripeLinksDynamoTableName: "infra-core-api-stripe-links", CacheDynamoTableName: "infra-core-api-cache", ConfigSecretName: "infra-core-api-config", UpcomingEventThresholdSeconds: 1800, // 30 mins @@ -46,21 +60,12 @@ const genericConfig: GenericConfigType = { MerchStoreMetadataTableName: "infra-merchstore-metadata", TicketPurchasesTableName: "infra-events-tickets", TicketMetadataTableName: "infra-events-ticketing-metadata", + IAMTablePrefix: "infra-core-api-iam", + ProtectedEntraIDGroups: [infraChairsGroupId, officersGroupId], } as const; const environmentConfig: EnvironmentConfigType = { dev: { - GroupRoleMapping: { - "48591dbc-cdcb-4544-9f63-e6b92b067e33": allAppRoles, // Infra Chairs - "940e4f9e-6891-4e28-9e29-148798495cdb": allAppRoles, // ACM Infra Team - "f8dfc4cf-456b-4da3-9053-f7fdeda5d5d6": allAppRoles, // Infra Leads - "0": allAppRoles, // Dummy Group for development only - "1": [], // Dummy Group for development only - "scanner-only": [AppRoles.TICKETS_SCANNER], - }, - UserRoleMapping: { - "infra-unit-test-nogrp@acm.illinois.edu": [AppRoles.TICKETS_SCANNER], - }, AzureRoleMapping: { AutonomousWriters: [AppRoles.EVENTS_MANAGER] }, ValidCorsOrigins: [ "http://localhost:3000", @@ -71,31 +76,15 @@ const environmentConfig: EnvironmentConfigType = { /^https:\/\/(?:.*\.)?acmuiuc\.pages\.dev$/, ], AadValidClientId: "39c28870-94e4-47ee-b4fb-affe0bf96c9f", + PasskitIdentifier: "pass.org.acmuiuc.qa.membership", + PasskitSerialNumber: "0", + MembershipApiEndpoint: + "https://infra-membership-api.aws.qa.acmuiuc.org/api/v1/checkMembership", + EmailDomain: "aws.qa.acmuiuc.org", + SqsQueueUrl: + "https://sqs.us-east-1.amazonaws.com/427040638965/infra-core-api-sqs", }, prod: { - GroupRoleMapping: { - "48591dbc-cdcb-4544-9f63-e6b92b067e33": allAppRoles, // Infra Chairs - "ff49e948-4587-416b-8224-65147540d5fc": allAppRoles, // Officers - "ad81254b-4eeb-4c96-8191-3acdce9194b1": [ - AppRoles.EVENTS_MANAGER, - AppRoles.SSO_INVITE_USER, - ], // Exec - }, - UserRoleMapping: { - "jlevine4@illinois.edu": allAppRoles, - "kaavyam2@illinois.edu": [AppRoles.TICKETS_SCANNER], - "hazellu2@illinois.edu": [AppRoles.TICKETS_SCANNER], - "cnwos@illinois.edu": [AppRoles.TICKETS_SCANNER], - "alfan2@illinois.edu": [AppRoles.TICKETS_SCANNER], - "naomil4@illinois.edu": [ - AppRoles.TICKETS_SCANNER, - AppRoles.TICKETS_MANAGER, - ], - "akori3@illinois.edu": [ - AppRoles.TICKETS_SCANNER, - AppRoles.TICKETS_MANAGER, - ], - }, AzureRoleMapping: { AutonomousWriters: [AppRoles.EVENTS_MANAGER] }, ValidCorsOrigins: [ "https://acm.illinois.edu", @@ -104,6 +93,13 @@ const environmentConfig: EnvironmentConfigType = { /^https:\/\/(?:.*\.)?acmuiuc\.pages\.dev$/, ], AadValidClientId: "5e08cf0f-53bb-4e09-9df2-e9bdc3467296", + PasskitIdentifier: "pass.edu.illinois.acm.membership", + PasskitSerialNumber: "0", + MembershipApiEndpoint: + "https://infra-membership-api.aws.acmuiuc.org/api/v1/checkMembership", + EmailDomain: "acm.illinois.edu", + SqsQueueUrl: + "https://sqs.us-east-1.amazonaws.com/298118738376/infra-core-api-sqs", }, }; @@ -113,6 +109,10 @@ export type SecretConfig = { discord_bot_token: string; entra_id_private_key: string; entra_id_thumbprint: string; + acm_passkit_signerCert_base64: string; + acm_passkit_signerKey_base64: string; + apple_signing_cert_base64: string; + stripe_secret_key: string; }; export { genericConfig, environmentConfig }; diff --git a/src/errors/index.ts b/src/common/errors/index.ts similarity index 74% rename from src/errors/index.ts rename to src/common/errors/index.ts index 8590204..de495a2 100644 --- a/src/errors/index.ts +++ b/src/common/errors/index.ts @@ -38,6 +38,17 @@ export abstract class BaseError extends Error { } } +export class NotImplementedError extends BaseError<"NotImplementedError"> { + constructor({ message }: { message?: string }) { + super({ + name: "NotImplementedError", + id: 100, + message: message || "This feature has not been implemented yet.", + httpStatusCode: 500, + }); + } +} + export class UnauthorizedError extends BaseError<"UnauthorizedError"> { constructor({ message }: { message: string }) { super({ name: "UnauthorizedError", id: 101, message, httpStatusCode: 401 }); @@ -130,7 +141,7 @@ export class EntraInvitationError extends BaseError<"EntraInvitationError"> { name: "EntraInvitationError", id: 108, message: message || "Could not invite user to Entra ID.", - httpStatusCode: 500, + httpStatusCode: 400, }); this.email = email; } @@ -168,3 +179,52 @@ export class NotSupportedError extends BaseError<"NotSupportedError"> { }); } } + +export class EntraGroupError extends BaseError<"EntraGroupError"> { + group: string; + constructor({ + code, + message, + group, + }: { + code?: number; + message?: string; + group: string; + }) { + super({ + name: "EntraGroupError", + id: 308, + message: + message || `Could not modify the group membership for group ${group}.`, + httpStatusCode: code || 500, + }); + this.group = group; + } +} + +export class EntraFetchError extends BaseError<"EntraFetchError"> { + email: string; + constructor({ message, email }: { message?: string; email: string }) { + super({ + name: "EntraFetchError", + id: 509, + message: message || "Could not get data from Entra ID.", + httpStatusCode: 500, + }); + this.email = email; + } +} + + +export class EntraPatchError extends BaseError<"EntraPatchError"> { + email: string; + constructor({ message, email }: { message?: string; email: string }) { + super({ + name: "EntraPatchError", + id: 510, + message: message || "Could not set data at Entra ID.", + httpStatusCode: 500, + }); + this.email = email; + } +} diff --git a/src/orgs.ts b/src/common/orgs.ts similarity index 100% rename from src/orgs.ts rename to src/common/orgs.ts diff --git a/src/roles.ts b/src/common/roles.ts similarity index 73% rename from src/roles.ts rename to src/common/roles.ts index c4d2ce0..c61d572 100644 --- a/src/roles.ts +++ b/src/common/roles.ts @@ -3,9 +3,12 @@ export const runEnvironments = ["dev", "prod"] as const; export type RunEnvironment = (typeof runEnvironments)[number]; export enum AppRoles { EVENTS_MANAGER = "manage:events", - SSO_INVITE_USER = "invite:sso", TICKETS_SCANNER = "scan:tickets", TICKETS_MANAGER = "manage:tickets", + IAM_ADMIN = "admin:iam", + IAM_INVITE_ONLY = "invite:iam", + STRIPE_LINK_CREATOR = "create:stripeLink", + BYPASS_OBJECT_LEVEL_AUTH = "bypass:ola", } export const allAppRoles = Object.values(AppRoles).filter( (value) => typeof value === "string", diff --git a/src/common/types/iam.ts b/src/common/types/iam.ts new file mode 100644 index 0000000..48756a5 --- /dev/null +++ b/src/common/types/iam.ts @@ -0,0 +1,77 @@ +import { AppRoles } from "../roles.js"; +import { z } from "zod"; + +export enum EntraGroupActions { + ADD, + REMOVE, +} + +export interface EntraInvitationResponse { + status: number; + data?: Record; + error?: { + message: string; + code?: string; + }; +} + +export const invitePostRequestSchema = z.object({ + emails: z.array(z.string()), +}); + +export type InviteUserPostRequest = z.infer; + +export const groupMappingCreatePostSchema = z.object({ + roles: z.union([ + z + .array(z.nativeEnum(AppRoles)) + .min(1) + .refine((items) => new Set(items).size === items.length, { + message: "All roles must be unique, no duplicate values allowed", + }), + z.tuple([z.literal("all")]), + ]), +}); + +export type GroupMappingCreatePostRequest = z.infer< + typeof groupMappingCreatePostSchema +>; + +export const entraActionResponseSchema = z.object({ + success: z.array(z.object({ email: z.string() })).optional(), + failure: z + .array(z.object({ email: z.string(), message: z.string() })) + .optional(), +}); + +export type EntraActionResponse = z.infer; + +export const groupModificationPatchSchema = z.object({ + add: z.array(z.string()), + remove: z.array(z.string()), +}); + +export type GroupModificationPatchRequest = z.infer< + typeof groupModificationPatchSchema +>; + +export const entraGroupMembershipListResponse = z.array( + z.object({ + name: z.string(), + email: z.string(), + }), +); + +export type GroupMemberGetResponse = z.infer< + typeof entraGroupMembershipListResponse +>; + +export const entraProfilePatchRequest = z.object({ + displayName: z.string().min(1), + givenName: z.string().min(1), + surname: z.string().min(1), + mail: z.string().email(), + otherMails: z.array(z.string()).min(1), +}); + +export type ProfilePatchRequest = z.infer; diff --git a/src/common/types/msGraphApi.ts b/src/common/types/msGraphApi.ts new file mode 100644 index 0000000..9e3532f --- /dev/null +++ b/src/common/types/msGraphApi.ts @@ -0,0 +1,12 @@ +export interface UserProfileDataBase { + userPrincipalName: string; + displayName?: string; + givenName?: string; + surname?: string; + mail?: string; + otherMails?: string[]; +} + +export interface UserProfileData extends UserProfileDataBase { + discordUsername?: string; +} diff --git a/src/common/types/sqsMessage.ts b/src/common/types/sqsMessage.ts new file mode 100644 index 0000000..524d985 --- /dev/null +++ b/src/common/types/sqsMessage.ts @@ -0,0 +1,58 @@ +import { z, ZodError, ZodType } from "zod"; + +export enum AvailableSQSFunctions { + Ping = "ping", + EmailMembershipPass = "emailMembershipPass", +} + +const sqsMessageMetadataSchema = z.object({ + reqId: z.string().min(1), + initiator: z.string().min(1), +}); + +export type SQSMessageMetadata = z.infer; + +const baseSchema = z.object({ + metadata: sqsMessageMetadataSchema, +}); + +const createSQSSchema = >( + func: T, + payloadSchema: P +) => + baseSchema.extend({ + function: z.literal(func), + payload: payloadSchema, + }); + +export const sqsPayloadSchemas = { + [AvailableSQSFunctions.Ping]: createSQSSchema(AvailableSQSFunctions.Ping, z.object({})), + [AvailableSQSFunctions.EmailMembershipPass]: createSQSSchema( + AvailableSQSFunctions.EmailMembershipPass, + z.object({ email: z.string().email() }) + ), +} as const; + +export const sqsPayloadSchema = z.discriminatedUnion( + "function", + [ + sqsPayloadSchemas[AvailableSQSFunctions.Ping], + sqsPayloadSchemas[AvailableSQSFunctions.EmailMembershipPass], + ] as const +); + + +export type SQSPayload = z.infer< + (typeof sqsPayloadSchemas)[T] +>; + +export type AnySQSPayload = z.infer; + +export function parseSQSPayload(json: unknown): AnySQSPayload | ZodError { + const parsed = sqsPayloadSchema.safeParse(json); + if (parsed.success) { + return parsed.data; + } else { + return parsed.error; + } +} diff --git a/src/common/types/stripe.ts b/src/common/types/stripe.ts new file mode 100644 index 0000000..5fb0153 --- /dev/null +++ b/src/common/types/stripe.ts @@ -0,0 +1,37 @@ +import { z } from "zod"; + +export const invoiceLinkPostResponseSchema = z.object({ + id: z.string().min(1), + link: z.string().url(), +}); + +export const invoiceLinkPostRequestSchema = z.object({ + invoiceId: z.string().min(1), + invoiceAmountUsd: z.number().min(50), + contactName: z.string().min(1), + contactEmail: z.string().email(), +}); + +export type PostInvoiceLinkRequest = z.infer< + typeof invoiceLinkPostRequestSchema +>; + +export type PostInvoiceLinkResponse = z.infer< + typeof invoiceLinkPostResponseSchema +>; + +export const invoiceLinkGetResponseSchema = z.array( + z.object({ + id: z.string().min(1), + userId: z.string().email(), + link: z.string().url(), + active: z.boolean(), + invoiceId: z.string().min(1), + invoiceAmountUsd: z.number().min(50), + createdAt: z.union([z.string().datetime(), z.null()]), + }), +); + +export type GetInvoiceLinksResponse = z.infer< + typeof invoiceLinkGetResponseSchema +>; diff --git a/src/common/utils.ts b/src/common/utils.ts new file mode 100644 index 0000000..be26125 --- /dev/null +++ b/src/common/utils.ts @@ -0,0 +1,11 @@ +export function transformCommaSeperatedName(name: string) { + if (name.includes(",")) { + try { + const split = name.split(","); + return `${split[1].slice(1, split[1].length).split(" ")[0]} ${split[0]}`; + } catch { + return name; + } + } + return name; +} diff --git a/src/functions/entraId.ts b/src/functions/entraId.ts deleted file mode 100644 index 709f379..0000000 --- a/src/functions/entraId.ts +++ /dev/null @@ -1,122 +0,0 @@ -import { genericConfig } from "../config.js"; -import { EntraInvitationError, InternalServerError } from "../errors/index.js"; -import { getSecretValue } from "../plugins/auth.js"; -import { ConfidentialClientApplication } from "@azure/msal-node"; -import { getItemFromCache, insertItemIntoCache } from "./cache.js"; - -interface EntraInvitationResponse { - status: number; - data?: Record; - error?: { - message: string; - code?: string; - }; -} -export async function getEntraIdToken( - clientId: string, - scopes: string[] = ["https://graph.microsoft.com/.default"], -) { - const secretApiConfig = - (await getSecretValue(genericConfig.ConfigSecretName)) || {}; - if ( - !secretApiConfig.entra_id_private_key || - !secretApiConfig.entra_id_thumbprint - ) { - throw new InternalServerError({ - message: "Could not find Entra ID credentials.", - }); - } - const decodedPrivateKey = Buffer.from( - secretApiConfig.entra_id_private_key as string, - "base64", - ).toString("utf8"); - const cachedToken = await getItemFromCache("entra_id_access_token"); - if (cachedToken) { - return cachedToken["token"] as string; - } - const config = { - auth: { - clientId: clientId, - authority: `https://login.microsoftonline.com/${genericConfig.EntraTenantId}`, - clientCertificate: { - thumbprint: (secretApiConfig.entra_id_thumbprint as string) || "", - privateKey: decodedPrivateKey, - }, - }, - }; - const cca = new ConfidentialClientApplication(config); - try { - const result = await cca.acquireTokenByClientCredential({ - scopes, - }); - const date = result?.expiresOn; - if (!date) { - throw new InternalServerError({ - message: `Failed to acquire token: token has no expiry field.`, - }); - } - date.setTime(date.getTime() - 30000); - if (result?.accessToken) { - await insertItemIntoCache( - "entra_id_access_token", - { token: result?.accessToken }, - date, - ); - } - return result?.accessToken ?? null; - } catch (error) { - throw new InternalServerError({ - message: `Failed to acquire token: ${error}`, - }); - } -} - -/** - * Adds a user to the tenant by sending an invitation to their email - * @param email - The email address of the user to invite - * @throws {InternalServerError} If the invitation fails - * @returns {Promise} True if the invitation was successful - */ -export async function addToTenant(token: string, email: string) { - email = email.toLowerCase().replace(/\s/g, ""); - if (!email.endsWith("@illinois.edu")) { - throw new EntraInvitationError({ - email, - message: "User's domain must be illinois.edu to be invited.", - }); - } - try { - const body = { - invitedUserEmailAddress: email, - inviteRedirectUrl: "https://acm.illinois.edu", - }; - const url = "https://graph.microsoft.com/v1.0/invitations"; - const response = await fetch(url, { - method: "POST", - headers: { - Authorization: `Bearer ${token}`, - "Content-Type": "application/json", - }, - body: JSON.stringify(body), - }); - - if (!response.ok) { - const errorData = (await response.json()) as EntraInvitationResponse; - throw new EntraInvitationError({ - message: errorData.error?.message || response.statusText, - email, - }); - } - - return { success: true, email }; - } catch (error) { - if (error instanceof EntraInvitationError) { - throw error; - } - - throw new EntraInvitationError({ - message: error instanceof Error ? error.message : String(error), - email, - }); - } -} diff --git a/src/routes/sso.ts b/src/routes/sso.ts deleted file mode 100644 index 4c622da..0000000 --- a/src/routes/sso.ts +++ /dev/null @@ -1,75 +0,0 @@ -import { FastifyPluginAsync } from "fastify"; -import { AppRoles } from "../roles.js"; -import { z } from "zod"; -import { zodToJsonSchema } from "zod-to-json-schema"; -import { addToTenant, getEntraIdToken } from "../functions/entraId.js"; -import { EntraInvitationError, InternalServerError } from "../errors/index.js"; - -const invitePostRequestSchema = z.object({ - emails: z.array(z.string()), -}); -export type InviteUserPostRequest = z.infer; - -const invitePostResponseSchema = zodToJsonSchema( - z.object({ - success: z.array(z.object({ email: z.string() })).optional(), - failure: z - .array(z.object({ email: z.string(), message: z.string() })) - .optional(), - }), -); - -const ssoManagementRoute: FastifyPluginAsync = async (fastify, _options) => { - fastify.post<{ Body: InviteUserPostRequest }>( - "/inviteUsers", - { - schema: { - response: { 200: invitePostResponseSchema }, - }, - preValidation: async (request, reply) => { - await fastify.zodValidateBody(request, reply, invitePostRequestSchema); - }, - onRequest: async (request, reply) => { - await fastify.authorize(request, reply, [AppRoles.SSO_INVITE_USER]); - }, - }, - async (request, reply) => { - const emails = request.body.emails; - const entraIdToken = await getEntraIdToken( - fastify.environmentConfig.AadValidClientId, - ); - if (!entraIdToken) { - throw new InternalServerError({ - message: "Could not get Entra ID token to perform task.", - }); - } - const response: Record[]> = { - success: [], - failure: [], - }; - const results = await Promise.allSettled( - emails.map((email) => addToTenant(entraIdToken, email)), - ); - for (let i = 0; i < results.length; i++) { - const result = results[i]; - if (result.status === "fulfilled") { - response.success.push({ email: emails[i] }); - } else { - if (result.reason instanceof EntraInvitationError) { - response.failure.push({ - email: emails[i], - message: result.reason.message, - }); - } - } - } - let statusCode = 201; - if (response.success.length === 0) { - statusCode = 500; - } - reply.status(statusCode).send(response); - }, - ); -}; - -export default ssoManagementRoute; diff --git a/src/ui/.prettierrc.cjs b/src/ui/.prettierrc.cjs new file mode 100644 index 0000000..2945481 --- /dev/null +++ b/src/ui/.prettierrc.cjs @@ -0,0 +1 @@ +module.exports = require('eslint-config-mantine/.prettierrc.js'); \ No newline at end of file diff --git a/src/ui/.stylelintrc.json b/src/ui/.stylelintrc.json new file mode 100644 index 0000000..a8a4b89 --- /dev/null +++ b/src/ui/.stylelintrc.json @@ -0,0 +1,28 @@ +{ + "extends": ["stylelint-config-standard-scss"], + "rules": { + "custom-property-pattern": null, + "selector-class-pattern": null, + "scss/no-duplicate-mixins": null, + "declaration-empty-line-before": null, + "declaration-block-no-redundant-longhand-properties": null, + "alpha-value-notation": null, + "custom-property-empty-line-before": null, + "property-no-vendor-prefix": null, + "color-function-notation": null, + "length-zero-no-unit": null, + "selector-not-notation": null, + "no-descending-specificity": null, + "comment-empty-line-before": null, + "scss/at-mixin-pattern": null, + "scss/at-rule-no-unknown": null, + "value-keyword-case": null, + "media-feature-range-notation": null, + "selector-pseudo-class-no-unknown": [ + true, + { + "ignorePseudoClasses": ["global"] + } + ] + } + } \ No newline at end of file diff --git a/src/ui/App.test.tsx b/src/ui/App.test.tsx new file mode 100644 index 0000000..4a2fc2a --- /dev/null +++ b/src/ui/App.test.tsx @@ -0,0 +1,44 @@ +import { render, screen } from '@testing-library/react'; +import App from './App'; + +describe('App', () => { + it('renders the App component and verifies the logo and text', () => { + render(); + + // Verify there are two instances of the logo + const logos = screen.getAllByAltText(/ACM Logo/i); // Assuming the alt text for the logo is "ACM Logo" + expect(logos).toHaveLength(2); + + // Verify the text "ACM@UIUC Management Portal" is present + const portalText = screen.getByText(/ACM@UIUC Management Portal/i); + expect(portalText).toBeInTheDocument(); + }); + + it('verifies the "Authorized Users Only" section', () => { + render(); + + // Verify the "Authorized Users Only" text is present + const authText = screen.getByText(/Authorized Users Only/i); + expect(authText).toBeInTheDocument(); + + // Verify the explanation text is present + const explanationText = screen.getByText(/Unauthorized or improper use or access/i); + expect(explanationText).toBeInTheDocument(); + }); + + it('verifies the "Sign in with Illinois NetID" button', () => { + render(); + + // Verify the button is present + const signInButton = screen.getByRole('button', { name: /Sign in with Illinois NetID/i }); + expect(signInButton).toBeInTheDocument(); + }); + + it('verifies the theme toggle is present', () => { + render(); + + // Verify the theme toggle is present + const themeToggle = screen.getByRole('switch'); // Assuming it uses a switch role + expect(themeToggle).toBeInTheDocument(); + }); +}); diff --git a/src/ui/App.tsx b/src/ui/App.tsx new file mode 100644 index 0000000..bd81b5e --- /dev/null +++ b/src/ui/App.tsx @@ -0,0 +1,25 @@ +import '@mantine/core/styles.css'; +import '@mantine/notifications/styles.css'; +import '@mantine/dates/styles.css'; +import { MantineProvider } from '@mantine/core'; +import { useColorScheme, useLocalStorage } from '@mantine/hooks'; +import { Notifications } from '@mantine/notifications'; + +import ColorSchemeContext from './ColorSchemeContext'; +import { Router } from './Router'; + +export default function App() { + const preferredColorScheme = useColorScheme(); + const [colorScheme, setColorScheme] = useLocalStorage({ + key: 'acm-manage-color-scheme', + defaultValue: preferredColorScheme, + }); + return ( + + + + + + + ); +} diff --git a/src/ui/ColorSchemeContext.tsx b/src/ui/ColorSchemeContext.tsx new file mode 100644 index 0000000..d706e96 --- /dev/null +++ b/src/ui/ColorSchemeContext.tsx @@ -0,0 +1,8 @@ +import { createContext } from 'react'; + +type ColorSchemeContextType = { + colorScheme: string; + onChange: CallableFunction; +} | null; + +export default createContext(null); diff --git a/src/ui/README.md b/src/ui/README.md new file mode 100644 index 0000000..df2028a --- /dev/null +++ b/src/ui/README.md @@ -0,0 +1,10 @@ +# Management API +## Running Locally +Create `.env.local` in this directory with the following content: +``` +VITE_RUN_ENVIRONMENT="dev" +``` + +If running against a local instance of the api, set to `local-dev` instead. + +Then install dependencies and run `yarn dev` to start development server. \ No newline at end of file diff --git a/src/ui/Router.tsx b/src/ui/Router.tsx new file mode 100644 index 0000000..5e8528e --- /dev/null +++ b/src/ui/Router.tsx @@ -0,0 +1,220 @@ +import { Anchor } from '@mantine/core'; +import { element } from 'prop-types'; +import React, { useState, useEffect, ReactNode } from 'react'; +import { createBrowserRouter, Navigate, RouterProvider, useLocation } from 'react-router-dom'; + +import { AcmAppShell } from './components/AppShell'; +import { useAuth } from './components/AuthContext'; +import AuthCallback from './components/AuthContext/AuthCallbackHandler.page'; +import { Error404Page } from './pages/Error404.page'; +import { Error500Page } from './pages/Error500.page'; +import { HomePage } from './pages/Home.page'; +import { LoginPage } from './pages/Login.page'; +import { LogoutPage } from './pages/Logout.page'; +import { ManageEventPage } from './pages/events/ManageEvent.page'; +import { ViewEventsPage } from './pages/events/ViewEvents.page'; +import { ScanTicketsPage } from './pages/tickets/ScanTickets.page'; +import { SelectTicketsPage } from './pages/tickets/SelectEventId.page'; +import { ViewTicketsPage } from './pages/tickets/ViewTickets.page'; +import { ManageIamPage } from './pages/iam/ManageIam.page'; +import { ManageProfilePage } from './pages/profile/ManageProfile.page'; +import { ManageStripeLinksPage } from './pages/stripe/ViewLinks.page'; + +const ProfileRediect: React.FC = () => { + const location = useLocation(); + + // Don't store login-related paths and ALLOW the callback path + const excludedPaths = [ + '/login', + '/logout', + '/force_login', + '/a', + '/auth/callback', // Add this to excluded paths + ]; + + if (excludedPaths.includes(location.pathname)) { + return ; + } + + // Include search params and hash in the return URL if they exist + const returnPath = location.pathname + location.search + location.hash; + const loginUrl = `/profile?returnTo=${encodeURIComponent(returnPath)}&firstTime=true`; + return ; +}; + +// Component to handle redirects to login with return path +const LoginRedirect: React.FC = () => { + const location = useLocation(); + + // Don't store login-related paths and ALLOW the callback path + const excludedPaths = [ + '/login', + '/logout', + '/force_login', + '/a', + '/auth/callback', // Add this to excluded paths + ]; + + if (excludedPaths.includes(location.pathname)) { + return ; + } + + // Include search params and hash in the return URL if they exist + const returnPath = location.pathname + location.search + location.hash; + const loginUrl = `/login?returnTo=${encodeURIComponent(returnPath)}&li=true`; + return ; +}; + +const commonRoutes = [ + { + path: '/force_login', + element: , + }, + { + path: '/logout', + element: , + }, + { + path: '/auth/callback', + element: , + }, +]; + +const profileRouter = createBrowserRouter([ + ...commonRoutes, + { + path: '/profile', + element: , + }, + { + path: '*', + element: , + }, +]); + +const unauthenticatedRouter = createBrowserRouter([ + ...commonRoutes, + { + path: '/', + element: , + }, + { + path: '/login', + element: , + }, + { + path: '*', + element: , + }, +]); + +const authenticatedRouter = createBrowserRouter([ + ...commonRoutes, + { + path: '/', + element: {null}, + }, + { + path: '/login', + element: , + }, + { + path: '/logout', + element: , + }, + { + path: '/profile', + element: , + }, + { + path: '/home', + element: , + }, + { + path: '/events/add', + element: , + }, + { + path: '/events/edit/:eventId', + element: , + }, + { + path: '/events/manage', + element: , + }, + { + path: '/tickets/scan', + element: , + }, + { + path: '/tickets', + element: , + }, + { + path: '/iam', + element: , + }, + { + path: '/tickets/manage/:eventId', + element: , + }, + { + path: '/stripe', + element: , + }, + // Catch-all route for authenticated users shows 404 page + { + path: '*', + element: , + }, +]); + +interface ErrorBoundaryProps { + children: ReactNode; +} + +const ErrorBoundary: React.FC = ({ children }) => { + const [hasError, setHasError] = useState(false); + const [error, setError] = useState(null); + const { isLoggedIn } = useAuth(); + + const onError = (errorObj: Error) => { + setHasError(true); + setError(errorObj); + }; + + useEffect(() => { + const errorHandler = (event: ErrorEvent) => { + onError(event.error); + }; + + window.addEventListener('error', errorHandler); + return () => { + window.removeEventListener('error', errorHandler); + }; + }, []); + + if (hasError && error) { + if (error.message === '404') { + return isLoggedIn ? : ; + } + return ; + } + + return <>{children}; +}; + +export const Router: React.FC = () => { + const { isLoggedIn } = useAuth(); + const router = isLoggedIn + ? authenticatedRouter + : isLoggedIn === null + ? profileRouter + : unauthenticatedRouter; + + return ( + + + + ); +}; diff --git a/src/ui/banner-blue.png b/src/ui/banner-blue.png new file mode 100644 index 0000000..2acdad7 Binary files /dev/null and b/src/ui/banner-blue.png differ diff --git a/src/ui/banner-white.png b/src/ui/banner-white.png new file mode 100644 index 0000000..ae292cf Binary files /dev/null and b/src/ui/banner-white.png differ diff --git a/src/ui/components/AppShell/index.tsx b/src/ui/components/AppShell/index.tsx new file mode 100644 index 0000000..8b5183a --- /dev/null +++ b/src/ui/components/AppShell/index.tsx @@ -0,0 +1,233 @@ +import { + AppShell, + Divider, + Group, + LoadingOverlay, + NavLink, + Skeleton, + Text, + useMantineColorScheme, +} from '@mantine/core'; +import { useDisclosure } from '@mantine/hooks'; +import { + IconCalendar, + IconCoin, + IconLink, + IconFileDollar, + IconPizza, + IconTicket, + IconLock, +} from '@tabler/icons-react'; +import { ReactNode } from 'react'; +import { useNavigate } from 'react-router-dom'; + +import { useAuth } from '../AuthContext/index.js'; +import { HeaderNavbar } from '../Navbar/index.js'; +import { AuthenticatedProfileDropdown } from '../ProfileDropdown/index.js'; +import { getCurrentRevision } from '@ui/util/revision.js'; +import { AppRoles } from '@common/roles.js'; +import { AuthGuard } from '../AuthGuard/index.js'; + +export interface AcmAppShellProps { + children: ReactNode; + active?: string; + showLoader?: boolean; + authenticated?: boolean; + showSidebar?: boolean; +} + +export const navItems = [ + { + link: '/events/manage', + name: 'Events', + icon: IconCalendar, + description: null, + validRoles: [AppRoles.EVENTS_MANAGER], + }, + { + link: '/tickets', + name: 'Ticketing/Merch', + icon: IconTicket, + description: null, + validRoles: [AppRoles.TICKETS_MANAGER, AppRoles.TICKETS_SCANNER], + }, + { + link: '/iam', + name: 'IAM', + icon: IconLock, + description: null, + validRoles: [AppRoles.IAM_ADMIN, AppRoles.IAM_INVITE_ONLY], + }, + { + link: '/stripe', + name: 'Stripe Link Creator', + icon: IconCoin, + description: null, + validRoles: [AppRoles.STRIPE_LINK_CREATOR], + }, +]; + +export const extLinks = [ + { + link: 'https://go.acm.illinois.edu/create', + name: 'Link Shortener', + icon: IconLink, + description: null, + }, + { + link: 'https://go.acm.illinois.edu/reimburse', + name: 'Funding and Reimbursement Requests', + icon: IconFileDollar, + description: null, + }, + { + link: 'https://go.acm.illinois.edu/sigpizza', + name: 'Pizza Request Form', + icon: IconPizza, + description: null, + }, +]; + +function isSameParentPath(path1: string | undefined, path2: string | undefined) { + if (!path1 || !path2) { + return false; + } + const splitPath1 = path1.split('/'); + const splitPath2 = path2.split('/'); + + // Ensure both paths are long enough to have a parent path + if (splitPath1.length < 2 || splitPath2.length < 2) { + return false; + } + + // Remove the last element (assumed to be the file or final directory) + const parentPath1 = splitPath1.slice(0, -1).join('/'); + const parentPath2 = splitPath2.slice(0, -1).join('/'); + return parentPath1 === parentPath2 && parentPath1 !== '/app'; +} + +export const renderNavItems = ( + items: Record[], + active: string | undefined, + navigate: CallableFunction +) => + items.map((item) => { + const link = ( + { + if (item.link.includes('://')) { + window.location.href = item.link; + } else { + navigate(item.link); + } + }} + key={item.name} + label={ + + {item.name} + + } + active={active === item.link || isSameParentPath(active, item.link)} + description={item.description || null} + leftSection={} + > + {item.children ? renderNavItems(item.children, active, navigate) : null} + + ); + if (item.link.at(0) == '/') { + return ( + } + > + {link} + + ); + } + return link; + }); + +type SidebarNavItemsProps = { + items: Record[]; + visible: boolean; + active?: string; +}; +const SidebarNavItems: React.FC = ({ items, visible, active }) => { + const navigate = useNavigate(); + if (!visible) { + return null; + } + return renderNavItems(items, active, navigate); +}; + +const AcmAppShell: React.FC = ({ + children, + active, + showLoader, + authenticated, + showSidebar, +}) => { + const { colorScheme } = useMantineColorScheme(); + if (authenticated === undefined) { + authenticated = true; + } + if (showSidebar === undefined) { + showSidebar = true; + } + const [opened, { toggle }] = useDisclosure(); + const { userData } = useAuth(); + return ( + + + + + {showSidebar && ( + + + +
+ + + + + + + + + + © {new Date().getFullYear()} ACM @ UIUC + + + Revision {getCurrentRevision()} + + + + )} + + {showLoader ? ( + + ) : ( + children + )} + + + ); +}; + +export { AcmAppShell, SidebarNavItems }; diff --git a/src/ui/components/AuthContext/AuthCallbackHandler.page.tsx b/src/ui/components/AuthContext/AuthCallbackHandler.page.tsx new file mode 100644 index 0000000..57ca19e --- /dev/null +++ b/src/ui/components/AuthContext/AuthCallbackHandler.page.tsx @@ -0,0 +1,42 @@ +import { useMsal } from '@azure/msal-react'; +import React, { useEffect } from 'react'; + +import FullScreenLoader from './LoadingScreen.js'; + +export const AuthCallback: React.FC = () => { + const { instance } = useMsal(); + const navigate = (path: string) => { + window.location.href = path; + }; + + useEffect(() => { + const handleCallback = async () => { + try { + // Check if we have pending redirects + const response = await instance.handleRedirectPromise(); + if (!response) { + navigate('/'); + return; + } + const returnPath = response.state || '/'; + const account = response.account; + if (account) { + instance.setActiveAccount(account); + } + + navigate(returnPath); + } catch (error) { + console.error('Failed to handle auth redirect:', error); + navigate('/login?error=callback_failed'); + } + }; + + setTimeout(() => { + handleCallback(); + }, 100); + }, [instance, navigate]); + + return ; +}; + +export default AuthCallback; diff --git a/src/ui/components/AuthContext/LoadingScreen.tsx b/src/ui/components/AuthContext/LoadingScreen.tsx new file mode 100644 index 0000000..96b3dd8 --- /dev/null +++ b/src/ui/components/AuthContext/LoadingScreen.tsx @@ -0,0 +1,24 @@ +import React from 'react'; +import { LoadingOverlay } from '@mantine/core'; +import { useColorScheme, useLocalStorage } from '@mantine/hooks'; + +const FullScreenLoader = () => { + const preferredColorScheme = useColorScheme(); + const [colorScheme, setColorScheme] = useLocalStorage({ + key: 'acm-manage-color-scheme', + defaultValue: preferredColorScheme, + }); + return ( + + ); +}; + +export default FullScreenLoader; diff --git a/src/ui/components/AuthContext/index.tsx b/src/ui/components/AuthContext/index.tsx new file mode 100644 index 0000000..7f13207 --- /dev/null +++ b/src/ui/components/AuthContext/index.tsx @@ -0,0 +1,245 @@ +import { + AuthenticationResult, + InteractionRequiredAuthError, + InteractionStatus, +} from '@azure/msal-browser'; +import { useMsal } from '@azure/msal-react'; +import { MantineProvider } from '@mantine/core'; +import React, { + createContext, + ReactNode, + useContext, + useState, + useEffect, + useCallback, +} from 'react'; + +import { CACHE_KEY_PREFIX, setCachedResponse } from '../AuthGuard/index.js'; + +import FullScreenLoader from './LoadingScreen.js'; + +import { getRunEnvironmentConfig, ValidServices } from '@ui/config.js'; +import { transformCommaSeperatedName } from '@common/utils.js'; +import { useApi } from '@ui/util/api.js'; + +interface AuthContextDataWrapper { + isLoggedIn: boolean; + userData: AuthContextData | null; + loginMsal: CallableFunction; + logout: CallableFunction; + getToken: CallableFunction; + logoutCallback: CallableFunction; + getApiToken: CallableFunction; + setLoginStatus: CallableFunction; +} + +export type AuthContextData = { + email?: string; + name?: string; +}; + +export const AuthContext = createContext({} as AuthContextDataWrapper); + +export const useAuth = () => useContext(AuthContext); + +interface AuthProviderProps { + children: ReactNode; +} + +export const clearAuthCache = () => { + for (const key of Object.keys(sessionStorage)) { + if (key.startsWith(CACHE_KEY_PREFIX)) { + sessionStorage.removeItem(key); + } + } +}; + +export const AuthProvider: React.FC = ({ children }) => { + const { instance, inProgress, accounts } = useMsal(); + const [userData, setUserData] = useState(null); + const [isLoggedIn, setIsLoggedIn] = useState(false); + const checkRoute = getRunEnvironmentConfig().ServiceConfiguration['core'].authCheckRoute; + if (!checkRoute) { + throw new Error('no check route found!'); + } + + const navigate = (path: string) => { + window.location.href = path; + }; + + useEffect(() => { + const handleRedirect = async () => { + const response = await instance.handleRedirectPromise(); + if (response) { + handleMsalResponse(response); + } else if (accounts.length > 0) { + setUserData({ + email: accounts[0].username, + name: transformCommaSeperatedName(accounts[0].name || ''), + }); + setIsLoggedIn(true); + } + }; + + if (inProgress === InteractionStatus.None) { + handleRedirect(); + } + }, [inProgress, accounts, instance]); + + const handleMsalResponse = useCallback( + (response: AuthenticationResult) => { + if (response?.account) { + if (!accounts.length) { + // If accounts array is empty, try silent authentication + instance + .ssoSilent({ + scopes: ['openid', 'profile', 'email'], + loginHint: response.account.username, + }) + .then(async (silentResponse) => { + if (silentResponse?.account?.name) { + setUserData({ + email: accounts[0].username, + name: transformCommaSeperatedName(accounts[0].name || ''), + }); + const api = useApi('core'); + const result = await api.get(checkRoute); + await setCachedResponse('core', checkRoute, result.data); + setIsLoggedIn(true); + } + }) + .catch(console.error); + return; + } + setUserData({ + email: accounts[0].username, + name: transformCommaSeperatedName(accounts[0].name || ''), + }); + setIsLoggedIn(true); + } + }, + [accounts, instance] + ); + + const getApiToken = useCallback( + async (service: ValidServices) => { + if (!userData) { + return null; + } + const scope = getRunEnvironmentConfig().ServiceConfiguration[service].loginScope; + const { apiId } = getRunEnvironmentConfig().ServiceConfiguration[service]; + if (!scope || !apiId) { + return null; + } + const msalAccounts = instance.getAllAccounts(); + if (msalAccounts.length > 0) { + const silentRequest = { + account: msalAccounts[0], + scopes: [scope], // Adjust scopes as needed, + resource: apiId, + }; + const tokenResponse = await instance.acquireTokenSilent(silentRequest); + return tokenResponse.accessToken; + } + throw new Error('More than one account found, cannot proceed.'); + }, + [userData, instance] + ); + + const getToken = useCallback(async () => { + if (!userData) { + return null; + } + try { + const msalAccounts = instance.getAllAccounts(); + if (msalAccounts.length > 0) { + const silentRequest = { + account: msalAccounts[0], + scopes: ['.default'], // Adjust scopes as needed + }; + const tokenResponse = await instance.acquireTokenSilent(silentRequest); + return tokenResponse.accessToken; + } + throw new Error('More than one account found, cannot proceed.'); + } catch (error) { + console.error('Silent token acquisition failed.', error); + if (error instanceof InteractionRequiredAuthError) { + // Fallback to interaction when silent token acquisition fails + try { + const interactiveRequest = { + scopes: ['.default'], // Adjust scopes as needed + redirectUri: '/auth/callback', // Redirect URI after login + }; + const tokenResponse: any = await instance.acquireTokenRedirect(interactiveRequest); + return tokenResponse.accessToken; + } catch (interactiveError) { + console.error('Interactive token acquisition failed.', interactiveError); + throw interactiveError; + } + } else { + throw error; + } + } + }, [userData, instance]); + + const loginMsal = useCallback( + async (returnTo: string) => { + if (!checkRoute) { + throw new Error('could not get user roles!'); + } + const accountsLocal = instance.getAllAccounts(); + if (accountsLocal.length > 0) { + instance.setActiveAccount(accountsLocal[0]); + const api = useApi('core'); + const result = await api.get(checkRoute); + await setCachedResponse('core', checkRoute, result.data); + setIsLoggedIn(true); + } else { + await instance.loginRedirect({ + scopes: ['openid', 'profile', 'email'], + state: returnTo, + redirectUri: `${window.location.origin}/auth/callback`, + }); + } + }, + [instance] + ); + const setLoginStatus = useCallback((val: boolean) => { + setIsLoggedIn(val); + }, []); + + const logout = useCallback(async () => { + try { + clearAuthCache(); + await instance.logoutRedirect(); + } catch (error) { + console.error('Logout failed:', error); + } + }, [instance, userData]); + const logoutCallback = () => { + setIsLoggedIn(false); + setUserData(null); + }; + return ( + + {inProgress !== InteractionStatus.None ? ( + + + + ) : ( + children + )} + + ); +}; diff --git a/src/ui/components/AuthGuard/index.tsx b/src/ui/components/AuthGuard/index.tsx new file mode 100644 index 0000000..cbbaf6a --- /dev/null +++ b/src/ui/components/AuthGuard/index.tsx @@ -0,0 +1,203 @@ +import { Card, Text, Title } from '@mantine/core'; +import React, { ReactNode, useEffect, useState } from 'react'; + +import { AcmAppShell, AcmAppShellProps } from '@ui/components/AppShell'; +import FullScreenLoader from '@ui/components/AuthContext/LoadingScreen'; +import { getRunEnvironmentConfig, ValidService } from '@ui/config'; +import { useApi } from '@ui/util/api'; +import { AppRoles } from '@common/roles'; + +export const CACHE_KEY_PREFIX = 'auth_response_cache_'; +const CACHE_DURATION = 2 * 60 * 60 * 1000; // 2 hours in milliseconds + +type CacheData = { + data: any; // Just the JSON response data + timestamp: number; +}; + +export type ResourceDefinition = { + service: ValidService; + validRoles: AppRoles[]; +}; + +const getAuthCacheKey = (service: ValidService, route: string) => + `${CACHE_KEY_PREFIX}${service}_${route}`; + +export const getCachedResponse = async ( + service: ValidService, + route: string +): Promise => { + const cacheKey = getAuthCacheKey(service, route); + const item = (await navigator.locks.request( + `lock_${cacheKey}`, + { mode: 'shared' }, + async (lock) => { + const cached = sessionStorage.getItem(getAuthCacheKey(service, route)); + if (!cached) return null; + + try { + const data = JSON.parse(cached) as CacheData; + const now = Date.now(); + + if (now - data.timestamp <= CACHE_DURATION) { + return data; + } + // Clear expired cache + sessionStorage.removeItem(getAuthCacheKey(service, route)); + } catch (e) { + console.error('Error parsing auth cache:', e); + sessionStorage.removeItem(getAuthCacheKey(service, route)); + } + return null; + } + )) as CacheData | null; + return item; +}; + +export const setCachedResponse = async (service: ValidService, route: string, data: any) => { + const cacheData: CacheData = { + data, + timestamp: Date.now(), + }; + const cacheKey = getAuthCacheKey(service, route); + await navigator.locks.request(`lock_${cacheKey}`, { mode: 'exclusive' }, async (lock) => { + sessionStorage.setItem(cacheKey, JSON.stringify(cacheData)); + }); +}; + +// Function to clear auth cache for all services +export const clearAuthCache = () => { + for (const key of Object.keys(sessionStorage)) { + if (key.startsWith(CACHE_KEY_PREFIX)) { + sessionStorage.removeItem(key); + } + } +}; + +export const AuthGuard: React.FC< + { + resourceDef: ResourceDefinition; + children: ReactNode; + isAppShell?: boolean; + loadingSkeleton?: ReactNode; + } & AcmAppShellProps +> = ({ resourceDef, children, isAppShell = true, loadingSkeleton, ...appShellProps }) => { + const { service, validRoles } = resourceDef; + const { baseEndpoint, authCheckRoute, friendlyName } = + getRunEnvironmentConfig().ServiceConfiguration[service]; + const [isAuthenticated, setIsAuthenticated] = useState(null); + const [username, setUsername] = useState(null); + const [roles, setRoles] = useState(null); + const [isLoading, setIsLoading] = useState(true); + const api = useApi(service); + + useEffect(() => { + async function getAuth() { + if (!authCheckRoute) { + setIsAuthenticated(true); + return; + } + if (validRoles.length === 0) { + setIsAuthenticated(true); + return; + } + const cachedData = await getCachedResponse(service, authCheckRoute); + const lockMode = cachedData ? 'shared' : 'exclusive'; + await navigator.locks.request(`lock_authGuard_loader`, { mode: lockMode }, async (lock) => { + try { + // We have to check the cache twice because if one exclusive process before us + // retrieved it we should now be able to use it. Theoretically this shouldn't + // ever trigger because AuthGuard on the navbar will always call first, but + // to protect against future implementations. + setIsLoading(true); + const cachedData = await getCachedResponse(service, authCheckRoute); + if (cachedData !== null) { + const userRoles = cachedData.data.roles; + let authenticated = false; + for (const item of userRoles) { + if (validRoles.indexOf(item) !== -1) { + authenticated = true; + break; + } + } + setUsername(cachedData.data.username); + setRoles(cachedData.data.roles); + setIsAuthenticated(authenticated); + setIsLoading(false); + return; + } + + // If no cache, make the API call + const result = await api.get(authCheckRoute); + // Cache just the response data + await setCachedResponse(service, authCheckRoute, result.data); + + const userRoles = result.data.roles; + let authenticated = false; + for (const item of userRoles) { + if (validRoles.indexOf(item) !== -1) { + authenticated = true; + break; + } + } + setIsAuthenticated(authenticated); + setRoles(result.data.roles); + setUsername(result.data.username); + setIsLoading(false); + } catch (e) { + setIsAuthenticated(false); + setIsLoading(false); + console.error(e); + } + }); + } + getAuth(); + }, [baseEndpoint, authCheckRoute, service]); + if (isLoading && loadingSkeleton) { + return loadingSkeleton; + } + if (isAuthenticated === null) { + if (isAppShell) { + return ; + } + return null; + } + + if (!isAuthenticated) { + if (isAppShell) { + return ( + + Unauthorized + + You have not been granted access to this module. Please fill out the{' '} + access request form to request + access to this module. + + + + Diagnostic Details + +
    +
  • Endpoint: {baseEndpoint}
    • +
  • + Service: {friendlyName} ({service}) +
    • +
  • User: {username}
    • +
  • Roles: {roles ? roles.join(', ') : none}
    • +
  • + Time: {new Date().toDateString()} {new Date().toLocaleTimeString()} +
    • +
+ + + ); + } + return null; + } + + if (isAppShell) { + return {children}; + } + + return <>{children}; +}; diff --git a/src/ui/components/DarkModeSwitch/index.tsx b/src/ui/components/DarkModeSwitch/index.tsx new file mode 100644 index 0000000..ae350bf --- /dev/null +++ b/src/ui/components/DarkModeSwitch/index.tsx @@ -0,0 +1,50 @@ +import { Switch, useMantineTheme, rem } from '@mantine/core'; +import { useColorScheme, useLocalStorage } from '@mantine/hooks'; +import { IconSun, IconMoonStars } from '@tabler/icons-react'; + +function DarkModeSwitch() { + const theme = useMantineTheme(); + const preferredColorScheme = useColorScheme(); + const [colorScheme, setColorScheme] = useLocalStorage({ + key: 'acm-manage-color-scheme', + defaultValue: preferredColorScheme, + }); + const sunIcon = ( + + ); + + const moonIcon = ( + + ); + + const handleToggle = (event: any) => { + if (event.currentTarget.checked) { + setColorScheme('dark'); + } else { + setColorScheme('light'); + } + }; + + return ( + { + handleToggle(event); + }} + onLabel={moonIcon} + offLabel={sunIcon} + /> + ); +} + +export { DarkModeSwitch }; diff --git a/src/ui/components/FullPageError/index.tsx b/src/ui/components/FullPageError/index.tsx new file mode 100644 index 0000000..25b43db --- /dev/null +++ b/src/ui/components/FullPageError/index.tsx @@ -0,0 +1,24 @@ +import { Container, Paper, Title, Text, Button } from '@mantine/core'; +import React, { MouseEventHandler } from 'react'; + +interface FullPageErrorProps { + errorCode?: number; + errorMessage?: string; + onRetry?: MouseEventHandler; +} + +const FullPageError: React.FC = ({ errorCode, errorMessage, onRetry }) => ( + + + {errorCode || 'An error occurred'} + {errorMessage || 'Something went wrong. Please try again later.'} + {onRetry && ( + + )} + + +); + +export default FullPageError; diff --git a/src/ui/components/LoginComponent/AcmLoginButton.tsx b/src/ui/components/LoginComponent/AcmLoginButton.tsx new file mode 100644 index 0000000..02782eb --- /dev/null +++ b/src/ui/components/LoginComponent/AcmLoginButton.tsx @@ -0,0 +1,22 @@ +import { useMsal } from '@azure/msal-react'; +import { Button, ButtonProps } from '@mantine/core'; + +import { useAuth } from '../AuthContext/index.js'; + +export function AcmLoginButton( + props: ButtonProps & React.ComponentPropsWithoutRef<'button'> & { returnTo: string } +) { + const { loginMsal } = useAuth(); + const { inProgress } = useMsal(); + return ( + + + + + + ); +}; + +export { AuthenticatedProfileDropdown }; diff --git a/src/ui/config.ts b/src/ui/config.ts new file mode 100644 index 0000000..7e9e227 --- /dev/null +++ b/src/ui/config.ts @@ -0,0 +1,142 @@ +import { + commChairsGroupId, + commChairsTestingGroupId, + execCouncilGroupId, + execCouncilTestingGroupId, + miscTestingGroupId, +} from '@common/config'; + +export const runEnvironments = ['dev', 'prod', 'local-dev'] as const; +// local dev should be used when you want to test against a local instance of the API + +export const services = ['core', 'tickets', 'merch', 'msGraphApi'] as const; +export type RunEnvironment = (typeof runEnvironments)[number]; +export type ValidServices = (typeof services)[number]; +export type ValidService = ValidServices; + +export type KnownGroups = { + Exec: string; + CommChairs: string; + StripeLinkCreators: string; +}; + +export type ConfigType = { + AadValidClientId: string; + ServiceConfiguration: Record; + KnownGroupMappings: KnownGroups; +}; + +export type ServiceConfiguration = { + friendlyName: string; + baseEndpoint: string; + authCheckRoute?: string; + loginScope?: string; + apiId?: string; +}; + +// type GenericConfigType = {}; + +type EnvironmentConfigType = { + [env in RunEnvironment]: ConfigType; +}; + +const environmentConfig: EnvironmentConfigType = { + 'local-dev': { + AadValidClientId: 'd1978c23-6455-426a-be4d-528b2d2e4026', + ServiceConfiguration: { + core: { + friendlyName: 'Core Management Service (NonProd)', + baseEndpoint: 'http://localhost:8080', + authCheckRoute: '/api/v1/protected', + loginScope: 'api://39c28870-94e4-47ee-b4fb-affe0bf96c9f/ACM.Events.Login', + apiId: 'api://39c28870-94e4-47ee-b4fb-affe0bf96c9f', + }, + tickets: { + friendlyName: 'Ticketing Service (NonProd)', + baseEndpoint: 'https://ticketing.aws.qa.acmuiuc.org', + }, + merch: { + friendlyName: 'Merch Sales Service (Prod)', + baseEndpoint: 'https://merchapi.acm.illinois.edu', + }, + msGraphApi: { + friendlyName: 'Microsoft Graph API', + baseEndpoint: 'https://graph.microsoft.com', + loginScope: 'https://graph.microsoft.com/.default', + apiId: 'https://graph.microsoft.com', + }, + }, + KnownGroupMappings: { + Exec: execCouncilTestingGroupId, + CommChairs: commChairsTestingGroupId, + StripeLinkCreators: miscTestingGroupId, + }, + }, + dev: { + AadValidClientId: 'd1978c23-6455-426a-be4d-528b2d2e4026', + ServiceConfiguration: { + core: { + friendlyName: 'Core Management Service (NonProd)', + baseEndpoint: 'https://infra-core-api.aws.qa.acmuiuc.org', + authCheckRoute: '/api/v1/protected', + loginScope: 'api://39c28870-94e4-47ee-b4fb-affe0bf96c9f/ACM.Events.Login', + apiId: 'api://39c28870-94e4-47ee-b4fb-affe0bf96c9f', + }, + tickets: { + friendlyName: 'Ticketing Service (NonProd)', + baseEndpoint: 'https://ticketing.aws.qa.acmuiuc.org', + }, + merch: { + friendlyName: 'Merch Sales Service (Prod)', + baseEndpoint: 'https://merchapi.acm.illinois.edu', + }, + msGraphApi: { + friendlyName: 'Microsoft Graph API', + baseEndpoint: 'https://graph.microsoft.com', + loginScope: 'https://graph.microsoft.com/.default', + apiId: 'https://graph.microsoft.com', + }, + }, + KnownGroupMappings: { + Exec: execCouncilTestingGroupId, + CommChairs: commChairsTestingGroupId, + StripeLinkCreators: miscTestingGroupId, + }, + }, + prod: { + AadValidClientId: '43fee67e-e383-4071-9233-ef33110e9386', + ServiceConfiguration: { + core: { + friendlyName: 'Core Management Service', + baseEndpoint: 'https://core.acm.illinois.edu', + authCheckRoute: '/api/v1/protected', + loginScope: 'api://5e08cf0f-53bb-4e09-9df2-e9bdc3467296/ACM.Events.Login', + apiId: 'api://5e08cf0f-53bb-4e09-9df2-e9bdc3467296', + }, + tickets: { + friendlyName: 'Ticketing Service', + baseEndpoint: 'https://ticketing.aws.acmuiuc.org', + }, + merch: { + friendlyName: 'Merch Sales Service', + baseEndpoint: 'https://merchapi.acm.illinois.edu', + }, + msGraphApi: { + friendlyName: 'Microsoft Graph API', + baseEndpoint: 'https://graph.microsoft.com', + loginScope: 'https://graph.microsoft.com/.default', + apiId: 'https://graph.microsoft.com', + }, + }, + KnownGroupMappings: { + Exec: execCouncilGroupId, + CommChairs: commChairsGroupId, + StripeLinkCreators: '675203eb-fbb9-4789-af2f-e87a3243f8e6', + }, + }, +} as const; + +const getRunEnvironmentConfig = () => + environmentConfig[(import.meta.env.VITE_RUN_ENVIRONMENT || 'dev') as RunEnvironment]; + +export { getRunEnvironmentConfig }; diff --git a/src/ui/index.html b/src/ui/index.html new file mode 100644 index 0000000..63c98ca --- /dev/null +++ b/src/ui/index.html @@ -0,0 +1,46 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + Management Portal | ACM@UIUC + + +
+ + + diff --git a/src/ui/main.tsx b/src/ui/main.tsx new file mode 100644 index 0000000..b3c1a51 --- /dev/null +++ b/src/ui/main.tsx @@ -0,0 +1,33 @@ +import { Configuration, PublicClientApplication } from '@azure/msal-browser'; +import { MsalProvider } from '@azure/msal-react'; +import ReactDOM from 'react-dom/client'; + +import App from './App'; +import { AuthProvider } from './components/AuthContext'; +import '@ungap/with-resolvers'; +import { getRunEnvironmentConfig } from './config'; + +const envConfig = getRunEnvironmentConfig(); + +const msalConfiguration: Configuration = { + auth: { + clientId: envConfig.AadValidClientId, + authority: 'https://login.microsoftonline.com/c8d9148f-9a59-4db3-827d-42ea0c2b6e2e', + redirectUri: `${window.location.origin}/auth/callback`, + postLogoutRedirectUri: `${window.location.origin}/logout`, + }, + cache: { + cacheLocation: 'sessionStorage', + storeAuthStateInCookie: true, + }, +}; + +const pca = new PublicClientApplication(msalConfiguration); + +ReactDOM.createRoot(document.getElementById('root')!).render( + + + + + +); diff --git a/src/ui/package.json b/src/ui/package.json new file mode 100644 index 0000000..3a63ed1 --- /dev/null +++ b/src/ui/package.json @@ -0,0 +1,95 @@ +{ + "name": "infra-core-ui", + "private": true, + "version": "0.0.0", + "scripts": { + "dev": "VITE_RUN_ENVIRONMENT=local-dev vite", + "dev:aws": "cross-env VITE_RUN_ENVIRONMENT=dev vite", + "build": "tsc && vite build", + "preview": "cross-env VITE_RUN_ENVIRONMENT=local-dev yarn build && cross-env VITE_RUN_ENVIRONMENT=local-dev serve -l 5173 -s ../../dist_ui/", + "typecheck": "tsc --noEmit", + "lint": " eslint . --ext .ts,.tsx --cache", + "prettier": "prettier --check \"**/*.{ts,tsx}\"", + "prettier:write": "prettier --write \"**/*.{ts,tsx}\"", + "vitest": "vitest run", + "vitest:watch": "vitest", + "test": "npm run typecheck && npm run prettier && npm run lint && npm run vitest && npm run build", + "test:unit": "yarn run vitest", + "storybook": "storybook dev -p 6006", + "storybook:build": "storybook build" + }, + "dependencies": { + "@azure/msal-browser": "^3.20.0", + "@azure/msal-react": "^2.0.22", + "@mantine/core": "^7.12.0", + "@mantine/dates": "^7.12.0", + "@mantine/form": "^7.12.0", + "@mantine/hooks": "^7.12.0", + "@mantine/notifications": "^7.12.0", + "@tabler/icons-react": "^3.29.0", + "@ungap/with-resolvers": "^0.1.0", + "axios": "^1.7.3", + "dayjs": "^1.11.12", + "dotenv": "^16.4.5", + "dotenv-cli": "^8.0.0", + "html5-qrcode": "^2.3.8", + "jsqr": "^1.4.0", + "pdfjs-dist": "^4.5.136", + "pluralize": "^8.0.0", + "react": "^18.3.1", + "react-dom": "^18.3.1", + "react-pdf": "^9.1.0", + "react-pdftotext": "^1.3.0", + "react-qr-reader": "^3.0.0-beta-1", + "react-router-dom": "^6.26.0", + "zod": "^3.23.8" + }, + "devDependencies": { + "@eslint/compat": "^1.1.1", + "@storybook/addon-essentials": "^8.2.8", + "@storybook/addon-interactions": "^8.2.8", + "@storybook/addon-links": "^8.2.8", + "@storybook/blocks": "^8.2.8", + "@storybook/react": "^8.2.8", + "@storybook/react-vite": "^8.2.8", + "@storybook/testing-library": "^0.2.2", + "@testing-library/dom": "^10.4.0", + "@testing-library/jest-dom": "^6.4.8", + "@testing-library/react": "^16.0.0", + "@testing-library/user-event": "^14.5.2", + "@types/pluralize": "^0.0.33", + "@types/react": "^18.3.3", + "@types/react-dom": "^18.3.0", + "@typescript-eslint/eslint-plugin": "^8.0.1", + "@typescript-eslint/parser": "^8.0.1", + "@vitejs/plugin-react": "^4.3.1", + "eslint-config-airbnb": "^19.0.4", + "eslint-config-airbnb-typescript": "^18.0.0", + "eslint-config-mantine": "^3.2.0", + "eslint-plugin-import": "^2.29.1", + "eslint-plugin-jsx-a11y": "^6.9.0", + "eslint-plugin-react": "^7.35.0", + "eslint-plugin-react-hooks": "^4.6.2", + "identity-obj-proxy": "^3.0.0", + "jsdom": "^24.1.1", + "postcss": "^8.4.41", + "postcss-preset-mantine": "^1.17.0", + "postcss-simple-vars": "^7.0.1", + "prettier": "^3.3.3", + "prop-types": "^15.8.1", + "serve": "^14.2.4", + "storybook": "^8.2.8", + "storybook-dark-mode": "^4.0.2", + "stylelint": "^16.8.1", + "stylelint-config-standard-scss": "^13.1.0", + "typescript": "^5.5.4", + "typescript-eslint": "^8.0.1", + "vite": "^6.0.11", + "vite-tsconfig-paths": "^5.0.1", + "vitest": "^2.0.5", + "yarn-upgrade-all": "^0.7.4" + }, + "resolutions": { + "pdfjs-dist": "4.5.136" + } +} diff --git a/src/ui/pages/Error404.page.tsx b/src/ui/pages/Error404.page.tsx new file mode 100644 index 0000000..3f970f0 --- /dev/null +++ b/src/ui/pages/Error404.page.tsx @@ -0,0 +1,24 @@ +import { Container, Title, Text, Anchor } from '@mantine/core'; +import React from 'react'; + +import { HeaderNavbar } from '@ui/components/Navbar'; + +export const Error404Page: React.FC<{ showNavbar?: boolean }> = ({ showNavbar }) => { + const realStuff = ( + <> + Page Not Found + + Perhaps you would like to go home? + + + ); + if (!showNavbar) { + return realStuff; + } + return ( + <> + + {realStuff} + + ); +}; diff --git a/src/ui/pages/Error500.page.tsx b/src/ui/pages/Error500.page.tsx new file mode 100644 index 0000000..abf8213 --- /dev/null +++ b/src/ui/pages/Error500.page.tsx @@ -0,0 +1,16 @@ +import { Container, Title, Text, Anchor } from '@mantine/core'; +import React from 'react'; + +import { HeaderNavbar } from '@ui/components/Navbar'; + +export const Error500Page: React.FC = () => ( + <> + + + An Error Occurred + + Perhaps you would like to go home? + + + +); diff --git a/src/ui/pages/Home.page.tsx b/src/ui/pages/Home.page.tsx new file mode 100644 index 0000000..432a48e --- /dev/null +++ b/src/ui/pages/Home.page.tsx @@ -0,0 +1,17 @@ +import React from 'react'; + +import { AcmAppShell } from '@ui/components/AppShell'; +import { Title, Text } from '@mantine/core'; +import { useAuth } from '@ui/components/AuthContext'; + +export const HomePage: React.FC = () => { + const { userData } = useAuth(); + return ( + <> + + Welcome, {userData?.name?.split(' ')[0]}! + Navigate the ACM @ UIUC Management Portal using the links in the menu bar. + + + ); +}; diff --git a/src/ui/pages/Login.page.tsx b/src/ui/pages/Login.page.tsx new file mode 100644 index 0000000..b6a28ad --- /dev/null +++ b/src/ui/pages/Login.page.tsx @@ -0,0 +1,55 @@ +import { useAuth } from '@ui/components/AuthContext'; +import { LoginComponent } from '@ui/components/LoginComponent'; +import { HeaderNavbar } from '@ui/components/Navbar'; +import { Center, Alert } from '@mantine/core'; +import { IconAlertCircle, IconAlertTriangle } from '@tabler/icons-react'; +import { useEffect } from 'react'; +import { useNavigate, useSearchParams } from 'react-router-dom'; +import { useApi } from '@ui/util/api'; + +export function LoginPage() { + const navigate = useNavigate(); + const graphApi = useApi('msGraphApi'); + const { isLoggedIn, setLoginStatus } = useAuth(); + const [searchParams] = useSearchParams(); + const showLogoutMessage = searchParams.get('lc') === 'true'; + const showLoginMessage = !showLogoutMessage && searchParams.get('li') === 'true'; + + useEffect(() => { + const evalState = async () => { + if (isLoggedIn) { + const returnTo = searchParams.get('returnTo'); + const me = (await graphApi.get('/v1.0/me?$select=givenName,surname')).data as { + givenName?: string; + surname?: string; + }; + if (!me.givenName || !me.surname) { + setLoginStatus(null); + navigate(`/profile?firstTime=true${returnTo ? `&returnTo=${returnTo}` : ''}`); + } else { + navigate(returnTo || '/home'); + } + } + }; + evalState(); + }, [navigate, isLoggedIn, searchParams]); + + return ( +
+ + {showLogoutMessage && ( + } title="Logged Out" color="blue"> + You have successfully logged out. + + )} + {showLoginMessage && ( + } title="Authentication Required" color="orange"> + You must log in to view this page. + + )} +
+ +
+
+ ); +} diff --git a/src/ui/pages/Logout.page.tsx b/src/ui/pages/Logout.page.tsx new file mode 100644 index 0000000..4101059 --- /dev/null +++ b/src/ui/pages/Logout.page.tsx @@ -0,0 +1,9 @@ +import { Navigate } from 'react-router-dom'; + +import { useAuth } from '@ui/components/AuthContext'; + +export function LogoutPage() { + const { logoutCallback } = useAuth(); + logoutCallback(); + return ; +} diff --git a/src/ui/pages/events/ManageEvent.page.tsx b/src/ui/pages/events/ManageEvent.page.tsx new file mode 100644 index 0000000..9dc36e7 --- /dev/null +++ b/src/ui/pages/events/ManageEvent.page.tsx @@ -0,0 +1,249 @@ +import { Title, Box, TextInput, Textarea, Switch, Select, Button, Loader } from '@mantine/core'; +import { DateTimePicker } from '@mantine/dates'; +import { useForm, zodResolver } from '@mantine/form'; +import { notifications } from '@mantine/notifications'; +import dayjs from 'dayjs'; +import React, { useEffect, useState } from 'react'; +import { useNavigate, useParams } from 'react-router-dom'; +import { z } from 'zod'; +import { AuthGuard } from '@ui/components/AuthGuard'; +import { getRunEnvironmentConfig } from '@ui/config'; +import { useApi } from '@ui/util/api'; +import { OrganizationList as orgList } from '@common/orgs'; +import { AppRoles } from '@common/roles'; + +export function capitalizeFirstLetter(string: string) { + return string.charAt(0).toUpperCase() + string.slice(1); +} + +const repeatOptions = ['weekly', 'biweekly'] as const; + +const baseBodySchema = z.object({ + title: z.string().min(1, 'Title is required'), + description: z.string().min(1, 'Description is required'), + start: z.date(), + end: z.optional(z.date()), + location: z.string().min(1, 'Location is required'), + locationLink: z.optional(z.string().url('Invalid URL')), + host: z.string().min(1, 'Host is required'), + featured: z.boolean().default(false), + paidEventId: z.string().min(1, 'Paid Event ID must be at least 1 character').optional(), +}); + +const requestBodySchema = baseBodySchema + .extend({ + repeats: z.optional(z.enum(repeatOptions)).nullable(), + repeatEnds: z.date().optional(), + }) + .refine((data) => (data.repeatEnds ? data.repeats !== undefined : true), { + message: 'Repeat frequency is required when Repeat End is specified.', + }) + .refine((data) => !data.end || data.end >= data.start, { + message: 'Event end date cannot be earlier than the start date.', + path: ['end'], + }) + .refine((data) => !data.repeatEnds || data.repeatEnds >= data.start, { + message: 'Repeat end date cannot be earlier than the start date.', + path: ['repeatEnds'], + }); + +type EventPostRequest = z.infer; + +export const ManageEventPage: React.FC = () => { + const [isSubmitting, setIsSubmitting] = useState(false); + const navigate = useNavigate(); + const api = useApi('core'); + + const { eventId } = useParams(); + + const isEditing = eventId !== undefined; + + useEffect(() => { + if (!isEditing) { + return; + } + // Fetch event data and populate form + const getEvent = async () => { + try { + const response = await api.get(`/api/v1/events/${eventId}`); + const eventData = response.data; + const formValues = { + title: eventData.title, + description: eventData.description, + start: new Date(eventData.start), + end: eventData.end ? new Date(eventData.end) : undefined, + location: eventData.location, + locationLink: eventData.locationLink, + host: eventData.host, + featured: eventData.featured, + repeats: eventData.repeats, + repeatEnds: eventData.repeatEnds ? new Date(eventData.repeatEnds) : undefined, + paidEventId: eventData.paidEventId, + }; + form.setValues(formValues); + } catch (error) { + console.error('Error fetching event data:', error); + notifications.show({ + message: 'Failed to fetch event data, please try again.', + }); + } + }; + getEvent(); + }, [eventId, isEditing]); + + const form = useForm({ + validate: zodResolver(requestBodySchema), + initialValues: { + title: '', + description: '', + start: new Date(), + end: new Date(new Date().valueOf() + 3.6e6), // 1 hr later + location: 'ACM Room (Siebel CS 1104)', + locationLink: 'https://maps.app.goo.gl/dwbBBBkfjkgj8gvA8', + host: 'ACM', + featured: false, + repeats: undefined, + repeatEnds: undefined, + paidEventId: undefined, + }, + }); + + const checkPaidEventId = async (paidEventId: string) => { + try { + const merchEndpoint = getRunEnvironmentConfig().ServiceConfiguration.merch.baseEndpoint; + const ticketEndpoint = getRunEnvironmentConfig().ServiceConfiguration.tickets.baseEndpoint; + const paidEventHref = paidEventId.startsWith('merch:') + ? `${merchEndpoint}/api/v1/merch/details?itemid=${paidEventId.slice(6)}` + : `${ticketEndpoint}/api/v1/event/details?eventid=${paidEventId}`; + const response = await api.get(paidEventHref); + return Boolean(response.status < 299 && response.status >= 200); + } catch (error) { + console.error('Error validating paid event ID:', error); + return false; + } + }; + + const handleSubmit = async (values: EventPostRequest) => { + try { + setIsSubmitting(true); + const realValues = { + ...values, + start: dayjs(values.start).format('YYYY-MM-DD[T]HH:mm:00'), + end: values.end ? dayjs(values.end).format('YYYY-MM-DD[T]HH:mm:00') : undefined, + repeatEnds: + values.repeatEnds && values.repeats + ? dayjs(values.repeatEnds).format('YYYY-MM-DD[T]HH:mm:00') + : undefined, + repeats: values.repeats ? values.repeats : undefined, + }; + + const eventURL = isEditing ? `/api/v1/events/${eventId}` : '/api/v1/events'; + const response = await api.post(eventURL, realValues); + notifications.show({ + title: isEditing ? 'Event updated!' : 'Event created!', + message: isEditing ? undefined : `The event ID is "${response.data.id}".`, + }); + navigate('/events/manage'); + } catch (error) { + setIsSubmitting(false); + console.error('Error creating/editing event:', error); + notifications.show({ + message: 'Failed to create/edit event, please try again.', + }); + } + }; + + return ( + + + + {isEditing ? `Edit` : `Create`} Event + +
+ +