Merge branch 'main' into CDD-3090-simplified-BE-chart-watermark

Author: kathryn-dale

README.md

@@ -77,20 +77,25 @@ Once again, you should include this line in the `.env` file at the root level of
 
 See the [Django documentation | SECRET_KEY](https://docs.djangoproject.com/en/4.2/ref/settings/#secret-key) for more information.
 
-4. Set up the virtual environment and install the project dependencies via:
+4. Set up for running the non-public version locally.
+
+If you want to run the non-public version (i.e. pass a valid JWT into requests), you'll have to link to a deployed cognito instance by adding env variables as per the [guidance below](#remote-infrastructure)
+Once again, you should include these in the `.env` file at the root level of your project structure.
+
+5. Set up the virtual environment and install the project dependencies via:
 ```bash
 uhd venv create
 ```
 This command will create a virtual environment at the `.venv/` folder at the root level of the project.
 The version of Python which will be used is dictated by the aforementioned `.python-version` file.
 And finally, the entire project dependencies will be installed within the virtual environment.
 
-5. Apply the database migrations and ensure Django collects all required static files.
+6. Apply the database migrations and ensure Django collects all required static files.
 ```bash
 uhd server setup-all
 ```
 
-6. Run a development server:
+7. Run a development server:
 ```bash
 uhd server run-local
 ```
@@ -323,6 +328,13 @@ for the app to collect the necessary static files:
 uhd server setup-static-files
 ```
 
+If using the JWT locally for passing permission sets with API requests from the frontend,
+you will need to set up the variables for validating the token via cognito:
+
+- `export COGNITO_AWS_REGION=eu-west-2` - This is unlikely to change
+- `export COGNITO_USER_POOL=eu-west-2_a123bc4DE` - Can be found be checking the `User pool ID` value for your environment on the [AWS console] (https://eu-west-2.console.aws.amazon.com/cognito/v2/idp/user-pools?region=eu-west-2)
+- `export COGNITO_JWT_AUTH_HEADER=HTTP_X_UHD_AUTH` - This is unlikely to change
+
 ---
 
 ## Using the API

cms/dashboard/templates/cms_starting_pages/landing_page.json

@@ -1,33 +1,43 @@
 {
-    "id": 79,
-    "meta": {
-        "search_description": "",
-        "type": "landing_page.LandingPage",
-        "detail_url": "https://http:/api/pages/79/",
-        "html_url": "https://http://localhost:3000/landing-page/",
-        "slug": "landing-page",
-        "show_in_menus": false,
-        "seo_title": "Home | UKHSA data dashboard",
-        "first_published_at": "2024-09-20T13:06:42.106160+01:00",
-        "alias_of": null,
-        "parent": {
-            "id": 3,
-            "meta": {
-                "type": "home.UKHSARootPage",
-                "detail_url": "https://http:/api/pages/3/",
-                "html_url": null
-            },
-            "title": "UKHSA Dashboard Root"
-        }
-    },
-    "title": "Landing page",
-    "sub_title": "showing public health data across England",
-    "page_description": "",
-    "body": "",
-    "related_links": [],
-    "related_links_layout": "Footer",
-    "last_published_at": "2024-09-20T14:04:30.332316+01:00",
-    "last_updated_at": "2024-09-24T16:40:55.228390+01:00",
-    "seo_change_frequency": 5,
-    "seo_priority": "0.5"
+  "id": 79,
+  "meta": {
+    "search_description": "",
+    "type": "landing_page.LandingPage",
+    "detail_url": "https://http:/api/pages/79/",
+    "html_url": "https://http://localhost:3000/landing-page/",
+    "slug": "landing-page",
+    "show_in_menus": false,
+    "seo_title": "Home | UKHSA data dashboard",
+    "first_published_at": "2024-09-20T13:06:42.106160+01:00",
+    "alias_of": null,
+    "parent": {
+      "id": 3,
+      "meta": {
+        "type": "home.UKHSARootPage",
+        "detail_url": "https://http:/api/pages/3/",
+        "html_url": null
+      },
+      "title": "UKHSA Dashboard Root"
+    }
+  },
+  "title": "Landing page",
+  "sub_title": "showing public health data across England",
+  "page_description": "",
+  "health_topic": [
+    {
+      "type": "health_topic",
+      "value": {
+        "heading": "Health themes",
+        "page": 83
+      },
+      "id": "557c2a3c-3487-4f22-91f4-76905eee178f"
+    }
+  ],
+  "body": "",
+  "related_links": [],
+  "related_links_layout": "Footer",
+  "last_published_at": "2024-09-20T14:04:30.332316+01:00",
+  "last_updated_at": "2024-09-24T16:40:55.228390+01:00",
+  "seo_change_frequency": 5,
+  "seo_priority": "0.5"
 }

cms/dynamic_content/blocks.py

@@ -1,5 +1,6 @@
 from django.core.exceptions import ValidationError
 from django.db import models
+from wagtail import blocks
 from wagtail.blocks import (
     CharBlock,
     ChoiceBlock,
@@ -263,3 +264,26 @@ class SectionFooterLink(StructBlock):
 
     class Meta:
         icon = "link"
+
+
+class HealthTopicSectionLink(blocks.StructBlock):
+    heading = blocks.TextBlock(help_text=help_texts.HEADING_BLOCK, required=True)
+    page = PageLinkChooserBlock(
+        page_type=["topics_list.TopicsListPage"],
+        required=True,
+        help_text=help_texts.TOPIC_PAGE_FIELD,
+    )
+
+    class Meta:
+        icon = "link"
+
+    @classmethod
+    def get_api_representation(cls, value, context=None) -> dict | None:
+        if value:
+            page = value.get("page")
+
+            return {
+                "heading": value["heading"],
+                "page": page.id if page else None,
+            }
+        return None

cms/home/migrations/0035_landingpage_health_topic.py

@@ -0,0 +1,46 @@
+# Generated by Django 5.2.13 on 2026-05-07 09:08
+
+import wagtail.fields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("home", "0034_alter_landingpage_body_headline_metric_card"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="landingpage",
+            name="health_topic",
+            field=wagtail.fields.StreamField(
+                [("health_topic", 2)],
+                block_lookup={
+                    0: (
+                        "wagtail.blocks.TextBlock",
+                        (),
+                        {
+                            "help_text": "\nThe text you add here will be used as the heading for this section. \n",
+                            "required": True,
+                        },
+                    ),
+                    1: (
+                        "cms.dynamic_content.blocks.PageLinkChooserBlock",
+                        (),
+                        {
+                            "help_text": "\nThe related topic page you want to link to. Eg: `COVID-19`\n",
+                            "page_type": ["topics_list.TopicsListPage"],
+                            "required": True,
+                        },
+                    ),
+                    2: (
+                        "wagtail.blocks.StructBlock",
+                        [[("heading", 0), ("page", 1)]],
+                        {},
+                    ),
+                },
+                default=list,
+            ),
+        ),
+    ]

cms/home/models/landing_page.py

@@ -2,7 +2,7 @@
 from modelcluster.fields import ParentalKey
 from wagtail.admin.panels import FieldPanel, InlinePanel, ObjectList, TabbedInterface
 from wagtail.api import APIField
-from wagtail.fields import RichTextField
+from wagtail.fields import RichTextField, StreamField
 from wagtail.models import Page
 
 from cms.dashboard.enums import (
@@ -17,8 +17,12 @@
 from cms.dynamic_content import help_texts
 from cms.dynamic_content.access import ALLOWABLE_BODY_CONTENT_SECTION_LINK
 from cms.dynamic_content.announcements import Announcement
+from cms.dynamic_content.blocks import HealthTopicSectionLink
 from cms.home.managers import LandingPageManager
 
+HEALTH_TOPIC_SECTION_LINK_MIN_NUM: int = 1
+HEALTH_TOPIC_SECTION_LINK_MAX_NUM: int = 1
+
 
 class LandingPage(UKHSAPage):
     is_creatable = True
@@ -31,6 +35,13 @@ class LandingPage(UKHSAPage):
         help_text=help_texts.PAGE_DESCRIPTION_FIELD,
     )
     body = ALLOWABLE_BODY_CONTENT_SECTION_LINK
+    health_topic = StreamField(
+        block_types=[("health_topic", HealthTopicSectionLink())],
+        min_num=HEALTH_TOPIC_SECTION_LINK_MIN_NUM,
+        max_num=HEALTH_TOPIC_SECTION_LINK_MAX_NUM,
+        default=list,
+        use_json_field=True,
+    )
 
     related_links_layout = models.CharField(
         verbose_name="Layout",
@@ -49,13 +60,15 @@ class LandingPage(UKHSAPage):
         FieldPanel("sub_title"),
         FieldPanel("page_description"),
         FieldPanel("body"),
+        FieldPanel("health_topic"),
     ]
 
     api_fields = UKHSAPage.api_fields + [
         APIField("title"),
         APIField("sub_title"),
         APIField("page_description"),
         APIField("body"),
+        APIField("health_topic"),
         APIField("related_links_layout"),
         APIField("related_links"),
         APIField("search_description"),

cms/snippets/migrations/0015_alter_simplemenu_body.py

@@ -0,0 +1,46 @@
+# Generated by Django 5.2.13 on 2026-05-07 09:08
+
+import django.db.models.deletion
+import wagtail.fields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("snippets", "0014_simplemenu"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="simplemenu",
+            name="body",
+            field=wagtail.fields.StreamField(
+                [("link", 2)],
+                block_lookup={
+                    0: (
+                        "wagtail.blocks.TextBlock",
+                        (),
+                        {
+                            "help_text": "\nThe title to display for this menu item.\nAs a general rule of thumb, the title length should be no longer than 60 characters.\n",
+                            "required": True,
+                        },
+                    ),
+                    1: (
+                        "wagtail.blocks.PageChooserBlock",
+                        ("wagtailcore.Page",),
+                        {
+                            "on_delete": django.db.models.deletion.CASCADE,
+                            "related_name": "+",
+                        },
+                    ),
+                    2: (
+                        "wagtail.blocks.StructBlock",
+                        [[("title", 0), ("page", 1)]],
+                        {},
+                    ),
+                },
+                help_text="\nLinks to display in the menu.\n",
+            ),
+        ),
+    ]

common/auth/cognito_jwt/backend.py

@@ -1,3 +1,5 @@
+import logging
+
 from django.apps import apps as django_apps
 from django.conf import settings
 from django.utils.encoding import force_str
@@ -8,17 +10,20 @@
 
 from .validator import TokenError, TokenValidator
 
+logger = logging.getLogger(__name__)
+
 # 2 objects expected when parsing Auth Header: 'Bearer' + token
 VALID_AUTH_HEADER_LENGTH = 2
 
 
 def get_authorization_header(request):
     """
-    Return request's 'X-UHD-AUTH:' header, as a bytestring.
+    Return request's authentication header, as a bytestring.
 
     Hide some test client ickyness where the header can be unicode.
     """
-    auth = request.META.get("HTTP_X_UHD_AUTH", b"")
+    auth_header = getattr(settings, "COGNITO_JWT_AUTH_HEADER", "Authorization")
+    auth = request.META.get(auth_header, b"")
     if isinstance(auth, str):
         # Work around django test client oddness
         auth = auth.encode(HTTP_HEADER_ENCODING)
@@ -50,6 +55,11 @@ def authenticate(self, request):
         else:
             user_model = self.get_user_model()
             user = user_model.objects.get_or_create_for_cognito(jwt_payload)
+        if not user:
+            logger.debug(
+                "Unable to create user from JWT, defaulting to unauthenticated"
+            )
+            return None
         return (user, jwt_token)
 
     @staticmethod

common/auth/cognito_jwt/user_manager.py

@@ -1,7 +1,7 @@
 import logging
 
 from django.contrib.auth import get_user_model
-from django.contrib.auth.models import BaseUserManager, User
+from django.contrib.auth.models import BaseUserManager
 
 logger = logging.getLogger(__name__)
 
@@ -10,17 +10,28 @@ class CognitoManager(BaseUserManager):
 
     @staticmethod
     def get_or_create_for_cognito(jwt_payload):
-        username = jwt_payload["entraObjectId"]
+        """Create an ephemeral user instance for this request.
+        We don't need to store or retrieve any info, we use what's in the JWT,
+        so this speeds up the request by removing the need for any DB access
+        """
         try:
-            user = get_user_model().objects.get(username=username)
-            logger.debug("Found existing user %s", user.username)
-        except User.DoesNotExist:
-            password = None
-            user = get_user_model().objects.create_user(
-                username=username,
-                password=password,
+            username = jwt_payload["entraObjectId"]
+            permission_sets = jwt_payload["permissionSets"]
+            if not permission_sets:
+                logger.debug(
+                    "Empty permissionSets in token for user: '%s'",
+                    username,
+                )
+                return None
+        except KeyError:
+            logger.debug(
+                "Error getting entraObjectId and/or permissionSets field(s)"
+                " from jwt payload: '%s'",
+                jwt_payload,
             )
-            logger.info("Created user %s", user.username)
-            user.is_active = True
-            user.save()
+            return None
+
+        user_class = get_user_model()
+        user = user_class(username=username)
+        user.permission_sets = permission_sets
         return user

config.py

@@ -63,6 +63,7 @@
 
 # Cognito configuration
 COGNITO_AWS_REGION = os.environ.get("COGNITO_AWS_REGION")
+COGNITO_JWT_AUTH_HEADER = os.environ.get("COGNITO_JWT_AUTH_HEADER")
 COGNITO_USER_POOL = os.environ.get("COGNITO_USER_POOL")
 
 # Database configuration