Skip to content

Commit

Permalink
Rename project
Browse files Browse the repository at this point in the history
  • Loading branch information
runner committed Dec 13, 2024
1 parent 599e8d4 commit 9ea876f
Show file tree
Hide file tree
Showing 19 changed files with 81 additions and 81 deletions.
4 changes: 2 additions & 2 deletions .github/workflows/security_npm_dependency.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@ name: Security npm dependency check
on:
workflow_dispatch:
schedule:
- cron: "19 6 * * MON-FRI" # Every weekday
- cron: "24 8 * * MON-FRI" # Every weekday
jobs:
security-npm-dependency-check:
name: Project security npm dependency check
uses: ministryofjustice/hmpps-github-actions/.github/workflows/security_npm_dependency.yml@v2 # WORKFLOW_VERSION
with:
channel_id: C05J915DX0Q
channel_id: launchpad-alerts
secrets: inherit
4 changes: 2 additions & 2 deletions .github/workflows/security_trivy.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@ name: Security trivy dependency check
on:
workflow_dispatch:
schedule:
- cron: "19 6 * * MON-FRI" # Every weekday
- cron: "24 8 * * MON-FRI" # Every weekday
jobs:
security-kotlin-trivy-check:
name: Project security trivy dependency check
uses: ministryofjustice/hmpps-github-actions/.github/workflows/security_trivy.yml@v2 # WORKFLOW_VERSION
with:
channel_id: C05J915DX0Q
channel_id: launchpad-alerts
secrets: inherit
4 changes: 2 additions & 2 deletions .github/workflows/security_veracode_pipeline_scan.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@ name: Security veracode pipeline scan
on:
workflow_dispatch:
schedule:
- cron: "19 6 * * MON-FRI" # Every weekday
- cron: "24 8 * * MON-FRI" # Every weekday
jobs:
security-veracode-pipeline-scan:
name: Project security veracode pipeline scan
uses: ministryofjustice/hmpps-github-actions/.github/workflows/security_veracode_pipeline_scan.yml@v2 # WORKFLOW_VERSION
with:
channel_id: C05J915DX0Q
channel_id: launchpad-alerts
secrets: inherit
4 changes: 2 additions & 2 deletions .github/workflows/security_veracode_policy_scan.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@ name: Security veracode policy scan
on:
workflow_dispatch:
schedule:
- cron: "34 6 * * 1" # Every Monday
- cron: "17 7 * * 1" # Every Monday
jobs:
security-veracode-policy-check:
name: Project security veracode policy scan
uses: ministryofjustice/hmpps-github-actions/.github/workflows/security_veracode_policy_scan.yml@v2 # WORKFLOW_VERSION
with:
channel_id: C05J915DX0Q
channel_id: launchpad-alerts
secrets: inherit
68 changes: 34 additions & 34 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,62 +10,62 @@ The library will attempt to self-install itself by running it via npx: `npx @min

It will then prompt you to perform some manual tasks - if you have stub tests for your health endpoints you might need add some additional stubbing.

See PR [#479](https://github.com/ministryofjustice/hmpps-template-typescript/pull/479)
See PR [#479](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/479)

**November 18th 2024** - Moving away from csurf and to csrf-sync

[csurf](https://www.npmjs.com/package/csurf) has been deprecated for some time and this removes that dependency and implements the [synchronizer token pattern](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#transmissing-csrf-tokens-in-synchronized-patterns) using [csrf-sync](https://www.npmjs.com/package/csrf-sync).

**Note:** Previously csurf used to generate new tokens on every request. The new library generates tokens once per session which is preferrable due to the extra calls to redis that per-request would generate. It is possible to force a refresh/revocation of a token by explicitly calling: `req.csrfToken(true)`

See PR [#481](https://github.com/ministryofjustice/hmpps-template-typescript/pull/481)
See PR [#481](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/481)

**November 5th 2024** - Disable 301 redirects on missing static content folders

Previously a non-existent static resource returned a 301 without the appropriate CSP response header.
Now it will return a 404 with the correct header. This was an issue flagged by ZAP

See PR [#383](https://github.com/ministryofjustice/hmpps-template-typescript/pull/383)
See PR [#383](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/383)

**October 29th 2024** - Move to node 22

Node 22 is now LTS. Notes [here](https://nodejs.org/en/blog/announcements/v22-release-announce)

See PR [#474](https://github.com/ministryofjustice/hmpps-template-typescript/pull/474)
See PR [#474](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/474)

**September 25th 2024** - Removing dependency on dotenv

Removing dependency on [dotenv](https://www.npmjs.com/package/dotenv).
Use Node's `-env-file` [mechanism](https://nodejs.org/dist/latest-v20.x/docs/api/cli.html#--env-fileconfig) instead of requiring the dotenv module.

See PR [#441](https://github.com/ministryofjustice/hmpps-template-typescript/pull/441)
See PR [#441](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/441)

**September 25th 2024** - Removing dependency on uuid

Removing dependency on [uuid](https://www.npmjs.com/package/uuid).
Use Node's `crypto.randomUUID()` instead of requiring the uuid module - there's no need if just using v4 UUIDs.

See PR [#439](https://github.com/ministryofjustice/hmpps-template-typescript/pull/439)
See PR [#439](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/439)

**September 19th 2024** - Renaming config domain

The `config.domain` property has been renamed to `config.ingressUrl` to reflect the fact that it should be set to a URL
rather than just a domain name.

See PR [#435](https://github.com/ministryofjustice/hmpps-template-typescript/pull/435)
See PR [#435](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/435)

**September 6th 2024** - Authentication and credentials tidy-up

We have recently tidied up some of the authentication process. To begin with, we added default credentials in HMPPS Auth
(PR: [hmpps-auth#1777](https://github.com/ministryofjustice/hmpps-auth/pull/1777)) to support the template project
out of the box. The necessary updates for using these credentials were made in
PR: [#412](https://github.com/ministryofjustice/hmpps-template-typescript/pull/412) and
PR: [#414](https://github.com/ministryofjustice/hmpps-template-typescript/pull/414). We also updated the documentation
PR: [#412](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/412) and
PR: [#414](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/414). We also updated the documentation
to clarify the OIDC/OAuth2 process.

Additionally, we cleaned up both the authentication middleware and the user details population middleware. These changes
can be found in PR: [#413](https://github.com/ministryofjustice/hmpps-template-typescript/pull/413) and
PR: [#415](https://github.com/ministryofjustice/hmpps-template-typescript/pull/415).
can be found in PR: [#413](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/413) and
PR: [#415](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/415).

As part of this change we also renamed the env var names used for configuring our client's credentials. It was felt that the previous names were confusing/misleading.

Expand All @@ -89,7 +89,7 @@ SYSTEM_CLIENT_SECRET -> CLIENT_CREDS_CLIENT_SECRET

We have recently introduced several enhancements to the ESBuild process to improve stability, logging, and basic type annotations. These are part of

PR: [#388](https://github.com/ministryofjustice/hmpps-template-typescript/pull/388) and PR: [#378](https://github.com/ministryofjustice/hmpps-template-typescript/pull/378)
PR: [#388](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/388) and PR: [#378](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/378)

Additionally, we have integrated a new and improved process for handling asset cache-busting. Previously, we appended a query string representing the build number or Git commit hash to our assets for cache-busting. With the recent introduction of ESBuild, we have implemented a more common asset-revving solution, using the hash of the asset in the asset's output filename, like `/assets/js/app.UG7VY7MS.js`.

Expand All @@ -99,7 +99,7 @@ In brief, this implementation creates a `manifest.json` file during the asset bu

To see the full conversation see the #typescript slack channel

PR: [#377](https://github.com/ministryofjustice/hmpps-template-typescript/pull/377)
PR: [#377](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/377)

---

Expand All @@ -111,7 +111,7 @@ Previously we added some guidance suggesting developers remove it but this was n

Rather than add to the complexity of the rewrite script we've decided to remove these checks entirely.

PR: [#388](https://github.com/ministryofjustice/hmpps-template-typescript/pull/388)
PR: [#388](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/388)

---

Expand All @@ -122,39 +122,39 @@ It's worth adopting now but there are subsequent commits and changes that will c

To see the full conversation see the #typescript slack channel

PR: [#375](https://github.com/ministryofjustice/hmpps-template-typescript/pull/375)
PR: [#375](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/375)

---

**May 22nd 2024** – Remove prometheus metrics middleware and metrics app. We had discussed that very few teams actually go on to set up a dashboard to surface the information and tend to use application insights instead for the information. In addition it had also caused a memory leak and production issues (manifesting in increased 502 error rates) in at least two applications that had inherited from the template so it seems wise to remove this tooling by default.

PR: [#365](https://github.com/ministryofjustice/hmpps-template-typescript/pull/365)
PR: [#365](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/365)

---

**May 10th 2024** – Derive user details from the `authorization_code` "user" token instead of making an API call to `hmpps-manage-users-api`, thereby removing an unnecessary dependency.

PR: [#352](https://github.com/ministryofjustice/hmpps-template-typescript/pull/352)
PR: [#352](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/352)

---

**February 29th 2024** – Use same node version for outdated check and security scan. This currently defaults to node 16

PR: [#321](https://github.com/ministryofjustice/hmpps-template-typescript/pull/321)
PR: [#321](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/321)

---

**February 15th 2024** – Move over to use Debian 12 based image (bookworm)

PR: [#316](https://github.com/ministryofjustice/hmpps-template-typescript/pull/316)
PR: [#316](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/316)

---

**January 9th 2024** – Move over to Gov UK Frontend 5.0 and MoJ Frontend 2.0

Note, this removed support for IE8,9,10 etc.

PR: [#297](https://github.com/ministryofjustice/hmpps-template-typescript/pull/297)
PR: [#297](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/297)

---

Expand All @@ -163,35 +163,35 @@ PR: [#297](https://github.com/ministryofjustice/hmpps-template-typescript/pull/2
This is to encourage services not to make additional calls to retrieve a user's role information.
Usually roles are cached with the session meaning that the user has to log out and in again to bring in changes to roles - as user details are also cached this will not change this behaviour.

PR: [#274](https://github.com/ministryofjustice/hmpps-template-typescript/pull/274)
PR: [#274](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/274)

---

**November 29th 2023** – Use in-memory token store when developing locally

PR: [#273](https://github.com/ministryofjustice/hmpps-template-typescript/pull/273)
PR: [#273](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/273)

---

**November 6th 2023** – Add HMPPS Manage Users API to health checks

PR: [#255](https://github.com/ministryofjustice/hmpps-template-typescript/pull/255)
PR: [#255](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/255)

---

**October 27th 2023** – Update to 4.0.0 of `jwt-decode` module

This had breaking changes and required an update to the import statement

PR: [#252](https://github.com/ministryofjustice/hmpps-template-typescript/pull/252)
PR: [#252](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/252)

---

**October 27th 2023** – Update application to use node.js version 20 and npm version 10

Application updated to node 20.8 along with one minor node module tweaks

PR: [#249](https://github.com/ministryofjustice/hmpps-template-typescript/pull/249)
PR: [#249](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/249)

---

Expand All @@ -200,7 +200,7 @@ PR: [#249](https://github.com/ministryofjustice/hmpps-template-typescript/pull/2
`/api/user/me` -> `/users/me` <br>
`/api/user/me/roles` -> `/users/me/roles`

PR: [#247](https://github.com/ministryofjustice/hmpps-template-typescript/pull/247)
PR: [#247](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/247)

---

Expand All @@ -212,7 +212,7 @@ and generic response types.
The user object built by `setUpCurrentUser` middleware is exposed in `res.locals` of request handlers
preventing the need for type assertions.

PR: [#238](https://github.com/ministryofjustice/hmpps-template-typescript/pull/238)
PR: [#238](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/238)

---

Expand All @@ -229,7 +229,7 @@ As part of the work on the [service catalogue](https://hmpps-developer-portal.hm

For more details ask on the `#hmpps-service-catalogue channel`.

PR: [here](https://github.com/ministryofjustice/hmpps-template-typescript/pull/231)
PR: [here](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/231)

---

Expand All @@ -240,44 +240,44 @@ This change adds a new info endpoint to expose this id in a consistent place.

For more details ask on the `#hmpps-service-catalogue channel`.

PR: [here](https://github.com/ministryofjustice/hmpps-template-typescript/pull/212)
PR: [here](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/212)

---

**June 9th 2023** - Do not retry POST requests by default

It's not safe to retry idempotent calls as this introduces the risk of creating multiple resources. This fix changes the default to not carry out any retries but allows switching on retrying if desired.

PR: [here](https://github.com/ministryofjustice/hmpps-template-typescript/pull/197)
PR: [here](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/197)

---

**April 13th 2023** - Caching fix

Asset caching was only set to 20 seconds. This fix changes the default to 1 hour which has a profound effect on the number of requests the application serves.

PR: [here](https://github.com/ministryofjustice/hmpps-template-typescript/pull/178)
PR: [here](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/178)

---

**April 4th 2023** - Remove unnecessary build step

There was an additional unnecessary build step as part of start:dev npm task. This more than doubled the start time on the initial run.

PR: [here](https://github.com/ministryofjustice/hmpps-template-typescript/pull/172)
PR: [here](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/172)

---

**March 20th 2023** - CSP fix for redirects during POST on session timeout

Updates the Content Security Policy to fix issues when users would be stuck on pages after submitting a form after their session times out. (Lots more detail in the PR)

PR: [here](https://github.com/ministryofjustice/hmpps-template-typescript/pull/170)
PR: [here](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/170)

---

**February 3rd 2023** - Revert multi build docker image

Multibuild docker images ended up taking a very long time after the upgrade to node 18 (1hr+). Some work needs to be done to move to support multi host builds in our circle orb, in the meantime we’ve removed this and are just building images solely for deployment.

PR: [here](https://github.com/ministryofjustice/hmpps-template-typescript/pull/149)
PR: [here](https://github.com/ministryofjustice/hmpps-managing-apps-staff-ui/pull/149)
Loading

0 comments on commit 9ea876f

Please sign in to comment.