hms-dbmi
diff --git a/‎.gitignore
Lines changed: 3 additions & 0 deletions b/‎.gitignore
Lines changed: 3 additions & 0 deletions
diff --git a/‎.m2/README.md
Lines changed: 4 additions & 0 deletions b/‎.m2/README.md
Lines changed: 4 additions & 0 deletions
diff --git a/‎Jenkinsfile.fence
Lines changed: 41 additions & 0 deletions b/‎Jenkinsfile.fence
Lines changed: 41 additions & 0 deletions
diff --git a/‎cache.http
Lines changed: 12 additions & 0 deletions b/‎cache.http
Lines changed: 12 additions & 0 deletions
diff --git a/‎config/psama/bdc/psama-db-config.properties
Lines changed: 4 additions & 0 deletions b/‎config/psama/bdc/psama-db-config.properties
Lines changed: 4 additions & 0 deletions
diff --git a/‎config/psama/psama.env
Lines changed: 32 additions & 0 deletions b/‎config/psama/psama.env
Lines changed: 32 additions & 0 deletions
diff --git a/‎docker-compose.dev.yml
Lines changed: 52 additions & 0 deletions b/‎docker-compose.dev.yml
Lines changed: 52 additions & 0 deletions
diff --git a/‎jenkinsfile
Lines changed: 48 additions & 0 deletions b/‎jenkinsfile
Lines changed: 48 additions & 0 deletions
diff --git a/‎pic-sure-auth-db/Dockerfile
Lines changed: 1 addition & 1 deletion b/‎pic-sure-auth-db/Dockerfile
Lines changed: 1 addition & 1 deletion
diff --git a/‎pic-sure-auth-db/db/sql/V4__ADD_CREATE_USER_STORED_PROCEDURE.sql
Lines changed: 43 additions & 0 deletions b/‎pic-sure-auth-db/db/sql/V4__ADD_CREATE_USER_STORED_PROCEDURE.sql
Lines changed: 43 additions & 0 deletions
@@ -30,3 +30,6 @@ pic-sure-auth-services.war.deployed
 *.war
 *.deployed
 *.failed
+
+.m2
+!.m2/README.md
@@ -0,0 +1,4 @@
+The .m2 dir is used to pass proxy args to Jenkins
+for environments that access the outside internet via
+an HTTP proxy
+
@@ -0,0 +1,41 @@
+pipeline {
+    agent any
+
+    parameters {
+        string(name: 'DOCKER_REGISTRY', description: 'Docker registry URL (e.g., ECR URL)', defaultValue: 'hms-dbmi')
+        string(name: 'REPOSITORY_NAME', description: 'Docker repository name', defaultValue: 'psama')
+        string(name: 'DATASOURCE_URL', description: 'Datasource URL', defaultValue: '${database_host_address}')
+        string(name: 'DATASOURCE_USERNAME', description: 'Datasource username', defaultValue: '${database_app_user_secret_name}')
+        string(name: 'STACK_SPECIFIC_APPLICATION_ID', description: 'Application ID for base query', defaultValue: '${application_id_for_base_query}')
+    }
+
+    environment {
+        DOCKER_BUILD_ARGS = "-f ./pic-sure-auth-services/bdc.Dockerfile"
+        GIT_BRANCH_SHORT = sh(script: 'echo ${GIT_BRANCH} | cut -d "/" -f 2', returnStdout: true).trim()
+        GIT_COMMIT_SHORT = sh(script: 'echo ${GIT_COMMIT} | cut -c1-7', returnStdout: true).trim()
+        IMAGE_TAG = "${GIT_BRANCH_SHORT}_${GIT_COMMIT_SHORT}"
+        LATEST_TAG = "latest"
+    }
+
+    stages {
+        stage('Build Docker Image') {
+            steps {
+                script {
+                    // Define the build args
+                    def buildArgs = " --build-arg DATASOURCE_URL=${env.DATASOURCE_URL} " +
+                                    " --build-arg DATASOURCE_USERNAME=${env.DATASOURCE_USERNAME} " +
+                                    " --build-arg STACK_SPECIFIC_APPLICATION_ID=${env.STACK_SPECIFIC_APPLICATION_ID} "
+
+                    sh "docker build ${DOCKER_BUILD_ARGS} ${buildArgs} -t ${params.DOCKER_REGISTRY}/${params.REPOSITORY_NAME}:${IMAGE_TAG} ."
+                    sh "docker tag ${params.DOCKER_REGISTRY}/${params.REPOSITORY_NAME}:${IMAGE_TAG} ${params.DOCKER_REGISTRY}/${params.REPOSITORY_NAME}:${LATEST_TAG}"
+                }
+            }
+        }
+        stage('Deploy Docker Image') {
+            steps {
+                sh "docker save ${params.DOCKER_REGISTRY}/${params.REPOSITORY_NAME}:${LATEST_TAG} | gzip > psama.tar.gz"
+                sh "aws s3 --sse=AES256 cp psama.tar.gz s3://$S3_BUCKET_NAME/releases/psama/psama.tar.gz"
+            }
+        }
+    }
+}
@@ -0,0 +1,12 @@
+# This class can be used to interact with the CacheController in the PSAMA API
+# The CacheController must be enable in the application.properties file
+# You can enable it by setting the following property:
+# app.cache.inspect.enabled=true
+# If you are using a environment variable to set the property, you can set it like this:
+# CACHE_INSPECT_ENABLED=true
+
+### GET /cache - Get a list of all caches in the application
+GET https://dev.picsure.biodatacatalyst.nhlbi.nih.gov/psama/cache
+
+### GET /cache/{cacheName} - Get the contents of a specific cache
+GET https://dev.picsure.biodatacatalyst.nhlbi.nih.gov/psama/cache/mergedRulesCache
@@ -0,0 +1,4 @@
+spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.MySQL8Dialect
+spring.datasource.driver-class-name=com.amazonaws.secretsmanager.sql.AWSSecretsManagerMySQLDriver
+spring.datasource.url=jdbc-secretsmanager:mysql://${DATASOURCE_URL}/auth?useUnicode=true&characterEncoding=UTF-8&autoReconnect=true&autoReconnectForPools=true
+spring.datasource.username=${DATASOURCE_USERNAME}
@@ -0,0 +1,32 @@
+# This is a template file that can be used to configure the application. Pass this to the dockerfile and
+# the application will be configured with the values provided in this file.
+
+# These properties are used to configure our applications JWT token.
+# The JWT token is used to authenticate the user and authorize them to access the application
+# after initial login.
+APPLICATION_CLIENT_SECRET=
+APPLICATION_CLIENT_SECRET_IS_BASE_64=false
+STACK_SPECIFIC_APPLICATION_ID=
+
+# Fence IDP Configuration
+FENCE_IDP_PROVIDER_IS_ENABLED=false
+FENCE_CLIENT_ID=
+FENCE_CLIENT_SECRET=
+FENCE_IDP_PROVIDER_URI=
+
+# AIM AHEAD Authorized Access (A4) OKTA IDP Configuration
+A4_OKTA_IDP_PROVIDER_IS_ENABLED=false
+A4_OKTA_CLIENT_SECRET=
+A4_OKTA_CLIENT_ID=
+A4_OKTA_CONNECTION_ID=
+A4_OKTA_IDP_PROVIDER_URI=
+
+# Auth0 IDP Configuration (Generally, this is used for the All-In-One and Authorized Access)
+AUTH0_IDP_PROVIDER_IS_ENABLED=false
+AUTH0_HOST=
+AUTH0_DENIED_EMAIL_ENABLED=
+
+# Open Access IDP Configuration
+OPEN_IDP_PROVIDER_IS_ENABLED=false
+
+SYSTEM_NAME=PIC-SURE BioDataCatalyst
@@ -0,0 +1,52 @@
+version: '3.8'
+services:
+  pic-sure-auth-service:
+    build:
+        context: .
+        dockerfile: ./pic-sure-auth-services/dev.Dockerfile
+    environment:
+      JAVA_OPTS: "-Xmx1024m -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005"
+      # Note: To use this you will need to set ENVIRONMENT variables for the application.properties
+    ports:
+      - "8090:8090" # Application port
+      - "5005:5005" # Debug port
+    depends_on:
+      auth-flyway:
+        condition: service_started
+
+  picsure-db:
+    build:
+      context: ./pic-sure-auth-db/
+      dockerfile: Dockerfile
+    environment:
+        MYSQL_DATABASE: auth
+        MYSQL_ROOT_PASSWORD: password
+    ports:
+        - "3306:3306" # MySQL port
+    command:
+      - --default-authentication-plugin=mysql_native_password # Required for MySQL 8.0
+    healthcheck:
+      test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  auth-flyway:
+    image: flyway/flyway:latest
+    volumes:
+      - ./pic-sure-auth-db/db/sql:/flyway/sql
+    # linux/amd64
+    platform: linux/amd64
+    environment:
+        - FLYWAY_URL=jdbc:mysql://picsure-db:3306/auth?useSSL=false
+        - FLYWAY_USER=root
+        - FLYWAY_PASSWORD=password
+        - FLYWAY_SCHEMAS=auth
+        - FLYWAY_LOCATIONS=filesystem:/flyway/sql
+        - FLYWAY_IGNORE_MISSING_MIGRATIONS=true
+        - FLYWAY_BASELINE_ON_MIGRATE=true
+    command:
+      - migrate
+    depends_on:
+      picsure-db:
+        condition: service_healthy
@@ -0,0 +1,48 @@
+pipeline {
+    agent any
+
+    parameters {
+        string(name: 'DOCKER_REGISTRY', description: 'Docker registry URL (e.g., ECR URL)', defaultValue: 'hms-dbmi')
+        string(name: 'REPOSITORY_NAME', description: 'Docker repository name', defaultValue: 'psama')
+        booleanParam(name: 'DEPLOY', description: 'Deploy the image to the registry', defaultValue: true)
+    }
+
+    environment {
+        DOCKER_BUILD_ARGS = "-f ./pic-sure-auth-services/Dockerfile --build-arg http_proxy=$http_proxy --build-arg https_proxy=$http_proxy --build-arg no_proxy=\"$no_proxy\" --build-arg HTTP_PROXY=$http_proxy --build-arg HTTPS_PROXY=$http_proxy --build-arg NO_PROXY=\"$no_proxy\""
+        GIT_BRANCH_SHORT = sh(script: 'echo ${GIT_BRANCH} | cut -d "/" -f 2', returnStdout: true).trim()
+        GIT_COMMIT_SHORT = sh(script: 'echo ${GIT_COMMIT} | cut -c1-7', returnStdout: true).trim()
+        IMAGE_TAG = "${GIT_BRANCH_SHORT}_${GIT_COMMIT_SHORT}"
+        LATEST_TAG = "LATEST"
+        EMAIL_TEMPLATE_VOLUME="-v $DOCKER_CONFIG_DIR/wildfly/emailTemplates:/opt/jboss/wildfly/standalone/configuration/emailTemplates "
+        TRUSTSTORE_VOLUME="-v $DOCKER_CONFIG_DIR/wildfly/application.truststore:/opt/jboss/wildfly/standalone/configuration/application.truststore"
+        PSAMA_OPTS="-Xms1g -Xmx2g -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true"
+        TRUSTSTORE_JAVA_OPTS="-Djavax.net.ssl.trustStore=/opt/jboss/wildfly/standalone/configuration/application.truststore -Djavax.net.ssl.trustStorePassword=password"
+    }
+
+    stages {
+        stage('build') {
+            steps {
+                sh "docker build ${DOCKER_BUILD_ARGS} -t ${params.DOCKER_REGISTRY}/${params.REPOSITORY_NAME}:${IMAGE_TAG} ."
+                sh "docker tag ${params.DOCKER_REGISTRY}/${params.REPOSITORY_NAME}:${IMAGE_TAG} ${params.DOCKER_REGISTRY}/${params.REPOSITORY_NAME}:${LATEST_TAG}"
+            }
+        }
+        stage('deploy') {
+            steps {
+                script {
+                    env.PROXY_OPTS = env.PROXY_OPTS == null ?: ''
+                    if (params.DEPLOY) {
+                        sh "docker stop psama || true"
+                        sh "docker rm psama || true"
+                        sh """docker run --name=psama --restart always \
+                            --network=picsure \
+                            --env-file /usr/local/docker-config/psama/.env \
+                            $EMAIL_TEMPLATE_VOLUME \
+                            $TRUSTSTORE_VOLUME \
+                            -e JAVA_OPTS="$PSAMA_OPTS $TRUSTSTORE_JAVA_OPTS" \
+                            -d ${params.DOCKER_REGISTRY}/${params.REPOSITORY_NAME}:${IMAGE_TAG}"""
+                   }
+                }
+            }
+        }
+    }
+}
@@ -1,4 +1,4 @@
-FROM mysql:5.7.24
+FROM mysql:8.2.0
 
 RUN mkdir /tempsql/
 COPY db/picsure-auth-dump-initial.sql /tempsql/picsure-auth-dump-initial.sql
 
@@ -0,0 +1,43 @@
+USE `auth`;
+
+DROP PROCEDURE IF EXISTS CreateUserWithRole;
+DELIMITER //
+CREATE PROCEDURE CreateUserWithRole(
+    IN user_email VARCHAR(255),
+    IN connection_id VARCHAR(255),
+    IN role_name VARCHAR(255),
+    IN user_general_metadata varchar(255)
+)
+BEGIN
+    -- Attempt to retrieve the UUIDs for the user and role based on the provided information
+    SELECT @userUUID := uuid FROM auth.user WHERE email = user_email AND connectionId = connection_id;
+    SELECT @roleUUID := uuid FROM auth.role WHERE name = role_name;
+    SELECT @picsureUserRoleId := uuid FROM auth.role WHERE name = 'PIC-SURE User';
+
+-- If the user does not exist, create a new user entry
+    IF @userUUID IS NULL THEN
+        set @baseUUID = UUID();
+        -- Generate a new UUID for the user
+        SET @userUUID = UNHEX(REPLACE(@baseUUID, '-', ''));
+        -- Retrieve the UUID for the connection
+        SELECT @connectionUUID := uuid FROM auth.connection WHERE id = connection_id;
+        SELECT @connectionSubPrefix := subPrefix FROM auth.connection WHERE id = connection_id;
+-- Insert the new user record into the user table
+        INSERT INTO auth.user (uuid, general_metadata, acceptedTOS, connectionId, email, matched, subject, is_active,
+                               long_term_token)
+        VALUES (@userUUID, user_general_metadata, CURRENT_TIMESTAMP, @connectionUUID, user_email, 0,
+                concat(@connectionSubPrefix, REPLACE(@baseUUID, '-', '')), 1, NULL);
+    END IF;
+
+    -- If the role exists, associate the user with the role
+    IF @roleUUID IS NOT NULL THEN
+        INSERT INTO auth.user_role (user_id, role_id) VALUES (@userUUID, @roleUUID);
+    END IF;
+
+    -- If the role is not PIC-SURE User, associate the user with the PIC-SURE User role as well
+    -- All users must have the PIC-SURE User role
+    IF @roleUUID IS NOT NULL AND @roleUUID != @picsureUserRoleId THEN
+        INSERT INTO auth.user_role (user_id, role_id) VALUES (@userUUID, @picsureUserRoleId);
+    END IF;
+END//
+DELIMITER ;
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM mysql:5.7.24`
	`1`	`+FROM mysql:8.2.0`
`2`	`2`
`3`	`3`	`RUN mkdir /tempsql/`
`4`	`4`	`COPY db/picsure-auth-dump-initial.sql /tempsql/picsure-auth-dump-initial.sql`