Merge pull request #783 from DEFRA/feat/df-924-remove-group-claims

feat/df-924: Removed group claims

Author: jbarnsley10

README.md

@@ -60,7 +60,6 @@ MONGO_DATABASE=""
 OIDC_JWKS_URI=""
 OIDC_VERIFY_AUD=""
 OIDC_VERIFY_ISS=""
-ROLE_EDITOR_GROUP_ID=""
 HTTP_PROXY=
 HTTPS_PROXY=
 NO_PROXY=

docker-compose.integration-test.yml

@@ -82,6 +82,48 @@ services:
       retries: 18
       start_period: 90s
 
+  forms-entitlement-api-test:
+    image: defradigital/forms-entitlement-api:latest
+    container_name: forms-entitlement-api-test
+    platform: linux/amd64
+    environment:
+      NODE_ENV: production
+      PORT: 3004
+      # Mongo
+      MONGO_URI: mongodb://mongo_test:27017/forms-entitlement-api?replicaSet=rs0&directConnection=true
+      MONGO_DATABASE: forms-entitlement-api
+      # OIDC
+      OIDC_JWKS_URI: 'http://oidc:80/.well-known/openid-configuration/jwks'
+      OIDC_VERIFY_AUD: 'newman-test-client'
+      OIDC_VERIFY_ISS: 'http://oidc:80'
+      SYNC_ADMIN_USERS_ENABLED: false
+      TRACE_HEADER: x-trace-id
+      LOG_LEVEL: info
+      AWS_REGION: eu-west-2
+      AWS_ACCESS_KEY_ID: test
+      AWS_SECRET_ACCESS_KEY: test
+    networks:
+      - forms_test_net
+    ports:
+      - '3004:3004'
+    healthcheck:
+      test:
+        [
+          'CMD-SHELL',
+          'curl -fsS http://localhost:3004/health >/dev/null || exit 1'
+        ]
+      interval: 10s
+      timeout: 10s
+      retries: 18
+      start_period: 15s
+    depends_on:
+      mongo_test:
+        condition: service_healthy
+      oidc:
+        condition: service_healthy
+      localstack:
+        condition: service_healthy
+
   app_test:
     image: app-test
     build:
@@ -107,27 +149,21 @@ services:
       OIDC_JWKS_URI: 'http://oidc:80/.well-known/openid-configuration/jwks'
       OIDC_VERIFY_AUD: 'newman-test-client'
       OIDC_VERIFY_ISS: 'http://oidc:80'
-      ROLE_EDITOR_GROUP_ID: '7049296f-2156-4d61-8ac3-349276438ef9'
-      TRACING_HEADER: x-cdp-request-id
-      AWS_REGION: eu-west-2
-      FEATURE_FLAG_PUBLISH_AUDIT_EVENTS: false
       FORM_DEF_BUCKET_NAME: form-definition-storage
       S3_FORCE_PATH_STYLE: true
       S3_ENDPOINT: http://localstack:4566
       SNS_ENDPOINT: http://localstack:4566
       SNS_TOPIC_ARN: arn:aws:sns:eu-west-2:000000000000:forms_manager_events
+      AWS_REGION: eu-west-2
       AWS_ACCESS_KEY_ID: test
       AWS_SECRET_ACCESS_KEY: test
-      ENTITLEMENT_URL: http://localhost:3004
-      FEATURE_FLAG_USE_ENTITLEMENT_API: false
+      ENTITLEMENT_URL: http://forms-entitlement-api-test:3004
+      FEATURE_FLAG_PUBLISH_AUDIT_EVENTS: false
+      FEATURE_FLAG_USE_ENTITLEMENT_API: true
       # PUBLIC_KEY is a test value - do not use for any deployments
       PUBLIC_KEY_FOR_SECRETS: 'LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQ0lqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FnOEFNSUlDQ2dLQ0FnRUE0WU53YUJjenlBdWpJZ2k2aTBmawpINUVYeGxtTmNBd1AzUkpRaDB2ckxjeDIxU2RCSkFOUU5JWmdTcWhST3ViUlozWTJWQ2Zsbkd3cFVSTTNrY0tFCkNHUlk2Nk5leVUwL3QzS2hVOUY1cG1heVBSVUFiWkRjalFCL0xYbVNGUUdGelZDQlp0ZjBIeHJiSnBUNDFiSGIKR05udFpDdm94WjZQOUJxdU4wa2c0Y1JXcTdyWUozVE1xWXArc1RzQU01UFZwMVh6WklIRFJ2UVJ2bktnMDVUUQovRFA1cXcvYkdwelVsQ01WVU9MTHhxL2xTY040RnhDRTRUUi9kSWNNM25wTU1PUUVjaEhLcEE2SWs3UmhmQml0CjZBSEpINWN2c0dWUTFHUmlvUXBIWXBWclZLRFV5ZmIrS3VzbjlWUTVTQ3JGZDJ3WWRaRzBkdVNOZFp3VklJQm8KVElWZjlrSUMrZjl5YTVLMmcvalJhMXUyVGdNc3UvZnM4UWVRZHk2disxNkFtWFA1cXNXYUtFK00zRkJoRitrZAozbS91YjNJVFRRVmplYWY1M2ZsTVlMZlZmN2NVR2FQN0VIajlUY0dGYVlGTzhuWGNWbS9lT2lkMXBGL3p5NCtzCnpFZG5oOFNRYm5ncElwdFJiMk51Wmw5RWZNR01CTFlyQ3FiWnMyYU1KV0N5M1FGWFZDeTYzUzZhRDkrbzQ1N0cKUDNGVnNZY2d2eHAzTGVTQ0phUHMzL0FlSjh1MUFSeHZwMG02ZjdPLy9yMFFQYzJnd2RyZjRVMUkwdlduclh2eApCc2RMWU5NMXVYVjhMKzExYloxeGpVaFU4QldTd3dnTTdQMGxqVTJ4UE9WbG55MlFGeXh0ZTgzK0E5SXNBcmFxCmthNlhEdDhYZkNZYm84dEpnem9mbEs4Q0F3RUFBUT09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQ=='
     depends_on:
-      mongo_test:
-        condition: service_healthy
-      oidc:
-        condition: service_healthy
-      localstack:
+      forms-entitlement-api-test:
         condition: service_healthy
     command: ['npm', 'start', '--ignore-scripts']
     networks:

package.json

@@ -23,12 +23,13 @@
     "postversion": "git add package.json package-lock.json && git commit -m $npm_package_version",
     "test": "jest --color --coverage --verbose",
     "test:watch": "jest --color --watch",
-    "test:integration:setup": "docker compose -f docker-compose.integration-test.yml up -d localstack oidc mongo_test",
+    "test:integration:setup": "docker compose -f docker-compose.integration-test.yml up -d localstack oidc mongo_test forms-entitlement-api-test",
+    "test:integration:seed": "docker run --rm --network forms-manager_forms_test_net -v './test/utils/seed-users.json:/seed-users.json' mongo:6.0 mongoimport --uri 'mongodb://mongo_test:27017/forms-entitlement-api?replicaSet=rs0&directConnection=true' --collection user-entitlement --file /seed-users.json --jsonArray --mode=upsert --upsertFields=userId",
     "test:integration:start": "docker compose -f docker-compose.integration-test.yml up --build -d app_test",
     "test:integration:wait": "echo 'Waiting for app...' && sleep 15 && until curl --fail http://localhost:3001/health; do echo 'Still waiting...'; sleep 5; done; echo 'App ready!'",
     "test:integration:run": "docker compose -f docker-compose.integration-test.yml run --rm --entrypoint=\"\" newman sh -c \"npm install -g newman-reporter-htmlextra && newman run /etc/newman/forms-manager-ci-mock.postman_collection.json -e /etc/newman/forms-manager-ci-mock.postman_environment.json -r cli,json,htmlextra --reporter-json-export /etc/newman/reports/newman-summary.json --reporter-htmlextra-export /etc/newman/reports/newman-report.html --reporter-htmlextra-showConsoleLogs\"",
     "test:integration:stop": "docker compose -f docker-compose.integration-test.yml down -v --remove-orphans",
-    "test:integration": "npm run test:integration:setup && npm run test:integration:start && npm run test:integration:wait && npm run test:integration:run; EXIT_CODE=$? && exit $EXIT_CODE",
+    "test:integration": "npm run test:integration:setup && npm run test:integration:seed && npm run test:integration:start && npm run test:integration:wait && npm run test:integration:run; EXIT_CODE=$? && exit $EXIT_CODE",
     "server:watch": "NODE_ENV=development tsx watch --clear-screen=false --enable-source-maps --exclude \"**/*.test.*\"",
     "server:watch:dev": "npm run server:watch -- ./src/index.js",
     "server:watch:debug": "npm run server:watch -- --inspect-wait ./src/index.js",

src/api/entitlements/service.js

@@ -1,4 +1,3 @@
-import { RoleScopes, Roles } from '@defra/forms-model'
 import Boom from '@hapi/boom'
 
 import { config } from '~/src/config/index.js'
@@ -57,11 +56,3 @@ export async function getUserScopes(oid, authToken) {
     return []
   }
 }
-
-/**
- * Gets the default scopes when entitlements API is not used
- * @returns {string[]} Default scopes array
- */
-export function getDefaultScopes() {
-  return [...RoleScopes[Roles.Admin]]
-}

src/api/entitlements/service.test.js

@@ -8,8 +8,6 @@ describe('entitlements service', () => {
     error: jest.fn()
   }
 
-  /** @type {() => string[]} */
-  let getDefaultScopes
   /** @type {(oid: string, authToken?: string) => Promise<string[]>} */
   let getUserScopes
   /** @type {any} */
@@ -46,7 +44,6 @@ describe('entitlements service', () => {
     getJson = /** @type {any} */ (fetchModule.getJson)
 
     const serviceModule = await import('~/src/api/entitlements/service.js')
-    getDefaultScopes = serviceModule.getDefaultScopes
     getUserScopes = serviceModule.getUserScopes
   })
 
@@ -171,29 +168,4 @@ describe('entitlements service', () => {
       )
     })
   })
-
-  describe('getDefaultScopes', () => {
-    it('should return admin scopes', () => {
-      const result = getDefaultScopes()
-
-      expect(result).toEqual([
-        'form-delete',
-        'form-edit',
-        'form-read',
-        'form-publish',
-        'user-create',
-        'user-delete',
-        'user-edit',
-        'forms-feedback'
-      ])
-    })
-
-    it('should return a new array instance each time', () => {
-      const result1 = getDefaultScopes()
-      const result2 = getDefaultScopes()
-
-      expect(result1).not.toBe(result2)
-      expect(result1).toEqual(result2)
-    })
-  })
 })

src/config/index.js

@@ -162,13 +162,6 @@ export const config = convict({
     default: null,
     env: 'OIDC_VERIFY_ISS'
   },
-  /** @type {SchemaObj<string>} */
-  roleEditorGroupId: {
-    doc: 'The AD security group the access token needs to claim membership of',
-    format: String,
-    default: null,
-    env: 'ROLE_EDITOR_GROUP_ID'
-  },
   tracing: {
     /** @type {SchemaObj<string>} */
 
@@ -228,13 +221,6 @@ export const config = convict({
     default: null,
     env: 'ENTITLEMENT_URL'
   },
-  /** @type {SchemaObj<boolean>} */
-  useEntitlementApi: {
-    doc: 'Feature flag to enable entitlement API for fetching scopes',
-    format: Boolean,
-    default: null,
-    env: 'FEATURE_FLAG_USE_ENTITLEMENT_API'
-  },
   /** @type {SchemaObj<string>} */
   publicKeyForSecrets: {
     doc: 'Public key for encryption of secrets',