Feature/DF-680 location maps auth (#1070)

* Add ordnanceSurveyApiSecret configuration

* Remove https://api.os.uk from CSP

* Update forms-engine-plugin to v4.0.43

Author: davidjamesstone

package-lock.json

@@ -41,7 +41,7 @@
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
     "@aws-sdk/client-sns": "^3.972.0",
-    "@defra/forms-engine-plugin": "^4.0.42",
+    "@defra/forms-engine-plugin": "^4.0.43",
     "@defra/forms-model": "^3.0.601",
     "@defra/hapi-tracing": "^1.30.0",
     "@elastic/ecs-pino-format": "^1.5.0",

package.json

@@ -308,6 +308,14 @@ export const config = convict({
     env: 'ORDNANCE_SURVEY_API_KEY'
   } as SchemaObj<string | undefined>,
 
+  ordnanceSurveyApiSecret: {
+    doc: 'The ordnance survey api secret used by the maps plugin',
+    format: String,
+    nullable: true,
+    default: undefined,
+    env: 'ORDNANCE_SURVEY_API_SECRET'
+  } as SchemaObj<string | undefined>,
+
   useMapsFeature: {
     doc: 'Feature flag to control maps',
     format: Boolean,

src/config/index.ts

@@ -185,7 +185,8 @@ export const configureEnginePlugin = async ({
         SummaryPageWithConfirmationEmailController,
         FeedbackPageController
       },
-      ordnanceSurveyApiKey: config.get('ordnanceSurveyApiKey')
+      ordnanceSurveyApiKey: config.get('ordnanceSurveyApiKey'),
+      ordnanceSurveyApiSecret: config.get('ordnanceSurveyApiSecret')
     }
   }
   const routeOptions = {

src/server/index.ts

@@ -11,11 +11,7 @@ describe('Server Blankie Plugin', () => {
       defaultSrc: ['self'],
       fontSrc: ['self', 'data:'],
       frameSrc: ['self', 'data:'],
-      connectSrc: [
-        'self',
-        'https://api.os.uk',
-        'https://test-uploader.cdp-int.defra.cloud'
-      ],
+      connectSrc: ['self', 'https://test-uploader.cdp-int.defra.cloud'],
       scriptSrc: ['self', 'strict-dynamic', 'unsafe-inline'],
       styleSrc: ['self', 'unsafe-inline'],
       imgSrc: ['self', 'data:'],
@@ -35,7 +31,6 @@ describe('Server Blankie Plugin', () => {
       frameSrc: ['self', 'data:'],
       connectSrc: [
         'self',
-        'https://api.os.uk',
         'https://*.google-analytics.com',
         'https://*.analytics.google.com',
         'https://*.googletagmanager.com',
@@ -76,6 +71,6 @@ describe('Server Blankie Plugin', () => {
 
     const { options } = configureBlankiePlugin()
 
-    expect(options?.connectSrc).toEqual(['self', 'https://api.os.uk'])
+    expect(options?.connectSrc).toEqual(['self'])
   })
 })

src/server/plugins/blankie.test.ts

@@ -29,7 +29,6 @@ export const configureBlankiePlugin = (): ServerRegisterPluginObject<
       fontSrc: ['self', 'data:'],
       connectSrc: [
         ['self'],
-        ['https://api.os.uk'],
         gaTrackingId ? googleAnalyticsOptions.connectSrc : [],
         uploaderUrl ? [uploaderUrl] : []
       ].flat(),