Support VA Enterprise Architecture Home team adding injected header

[jilladams]

Description

VA Enterprise Architecture Home plans to adopt the injected header / megamenu.

Our team will need to:

• add the site to the proxy-rewrite-whitelist.json allow list, with "cookieOnly": true for staging testing.

• ask devops to add the subdomain to an allow list for the CORS header

Additional context

DEPO teamsite overview - explains the mechanisms, and has notes on testing, for the implementing team

After our work, the team will need to test on Staging. Once they confirm that injected header works and they're ready to publish, we'll need to update code to cookieOnly: false . That is separately ticketed under

Acceptance Criteria

• On http://ea.oit.va.gov, when setting cookie in the console (by running document.cookie = "proxyRewrite=true;") the global header is injected
• Schedule meeting with EAH team to ensure support

CMS Team

Please check the team(s) that will do this work.

• Program
• Platform CMS Team
• Sitewide Crew
• ⭐️ Sitewide CMS
• ⭐️ Public Websites
• ⭐️ Facilities
• ⭐️ User support

[allisonlu]

PR opened on vets-website: department-of-veterans-affairs/vets-website#21423

I have a meeting with Elijah from DevOps today to confirm if I also need to add this hostname to Terraform (see second bullet on Considerations when editing and testing the allowlist). I will update later today.

[jilladams]

@ElijahLynn Allison is out sick as of earlier this afternoon. Curious if you all were able to meet prior or if you know the answer re: adding a hostname to Terraform (comment above in thread)?

[ElijahLynn]

Allison is out sick as of earlier this afternoon. Curious if you all were able to meet prior or if you know the answer re: adding a hostname to Terraform (comment above in thread)?

We weren't able to meet but our team can take this on. ccing @jkalexander7 @ENeal49 for prioritization.

[jilladams]

Confirmed that we do need help to add this domain to 2 devops locations that PW team doesn't have write access to. CMS Platform team has time sensitive deadlines and can't help right now without some escalation, so we've asked for help from Platform team for now.

CMS-team channel thread re: capacity for Elijah: https://dsva.slack.com/archives/CT4GZBM8F/p1656009212359809
Platform help request: https://dsva.slack.com/archives/CBU0KDSB1/p1656015220936849

[jsgarmon]

@jilladams : anyone is free to put in a PR to the devops repo. If you know what changes need to be made there, putting in your own PR is the fastest way to get them in.

[jilladams]

@jsgarmon thanks! The commit examples linked from https://depo-platform-documentation.scrollhelp.site/developer-docs/teamsite-overview#TeamSiteoverview-Considerationswheneditingandtestingtheallowlist are pointing at a commit hash version of the file. Links from that doc =

• https://github.com/department-of-veterans-affairs/devops/blob/c5687fc1b483eaea17a1191eb41440fb560d01d6/terraform/environments/dsva-vagov-prod/main.tf#L277
• https://github.com/department-of-veterans-affairs/devops/blob/c5687fc1b483eaea17a1191eb41440fb560d01d6/terraform/environments/dsva-vagov-prod/main.tf#L290

It looks like the file has been significantly refactored in master. Are you able to offer any pointers about the current state of the code that handles the TeamSite CORS allowed origins for bucket-prod-va-gov-assets and bucket-preview-va-gov-assets? Or: how that's done these days? (Searching the repo for CORS, and the bucket names, doesn't turn up any insights.)

[jsgarmon]

The buckets are now part of the vets-api module, so you just need to make sure any needed origins are in the local allowed_origins list: https://github.com/department-of-veterans-affairs/devops/blob/master/terraform/environments/dsva-vagov-prod/main.tf#L274

[jilladams]

(Ticketed the docs update: department-of-veterans-affairs/va.gov-team#43364)

[jilladams]

@ryguyk flagging that as this one is a sprint goal, we may need your help next week to pick it up if Allison's out longer. We can check in on Mon/Tues am, once we know either way.

[allisonlu]

PR opened on devops repo: https://github.com/department-of-veterans-affairs/devops/pull/11465

This PR has been merged as of 6/27/2022

[allisonlu]

PR on vets-website has also been merged today.

After these changes get deployed, we'll be ready to check and set the cookie value in the browser

[jilladams]

@allisonlu I wanted to confirm this before notifying Sagar it's ready but realized I don't know exactly how to help them know what to do next. I was under the impression we could modify the cookie in dev tools to get the injected header to show. Do you know if that's true, and if so, which one we're looking at?

[allisonlu]

@jilladams
According to the documentation, we would have to click the Console tab, and paste this in: document.cookie = "proxyRewrite=true;", then press Enter. But when I do this, I'm expecting the header to be activated, but it doesn't display even after refreshing the page (the cookie is still there though).

@jsgarmon do you have any more insight on this? or who to contact?

[allisonlu]

Ah! Nevermind, I got it to show up. Be sure to turn off your CORS setting on your browser, folks!

[allisonlu]

new PRs opened to add ea.oit.va.gov on top of the www version to ensure both get the injected header:

vets-website: department-of-veterans-affairs/vets-website#21523 - merged as of 7/1
devops: https://github.com/department-of-veterans-affairs/devops/pull/11489 - merged as of 6/30

edit (6/30/2022): fixing links

[allisonlu]

Both https://www.ea.oit.va.gov/ and https://ea.oit.va.gov/ have the injected header with the proxyRewrite cookie set to true!