Support VA Formulary Advisor team adding injected header

[jilladams]

Description

VA Formulary Advisor plans to adopt the injected header / megamenu.
Currently a file-based site in TeamSite. Site isn't launched so we need to handle both staging prod domains:

• va.gov/formularyadvisor
• www.va.gov/formularyadvisor
• vaww.internet.staging.va.gov/formularyadvisor

Tasks

Our team will need to:

• add the domain with both www and non-www to the proxy-rewrite-whitelist.json allow list, with "cookieOnly": true for staging testing. - .5hr

• add the domain to Devops code that handles the TeamSite CORS allowed origins for bucket-prod-va-gov-assets and bucket-preview-va-gov-assets. The buckets are now part of the vets-api module, so you just need to make sure any needed origins are in the local allowed_origins list: https://github.com/department-of-veterans-affairs/devops/blob/master/terraform/environments/dsva-vagov-prod/main.tf#L274 - .5hr

• PR shepherding - .5-1hr

2-2.5hrs.

Additional context

DEPO teamsite overview - explains the mechanisms, and has notes on testing, for the implementing team. (And has an incorrect code pointer, ticketed here: department-of-veterans-affairs/va.gov-team#43364)

After our work, the team will need to test on Staging. Once they confirm that injected header works and they're ready to publish, we'll need to update code to cookieOnly: false . That is separately ticketed under

To test

• Load https://www.ea.oit.va.gov/
• Open developer tools, Console
• Type document.cookie = "proxyRewrite=true;", and hit Enter. This creates a cookie that you will then find under Application cookies in dev tools until you clear cookies.
• Refresh the page, and injected header should load.

Acceptance Criteria

• On http://ea.oit.va.gov, when setting cookie in the console the global header is injected
• Let DM (Jill) know when your changes have deployed to production, so she can notify the VAFW team

CMS Team

Please check the team(s) that will do this work.

• Program
• Platform CMS Team
• Sitewide Crew
• ⭐️ Sitewide CMS
• ⭐️ Public Websites
• ⭐️ Facilities
• ⭐️ User support

[wesrowe]

Blocked until external team meets with us

[jilladams]

Team confirmed domain - added to ticket, moving this this to Stretch / Next sprint for S63.

[allisonlu]

PR opened on vets-website: department-of-veterans-affairs/vets-website#21711

[allisonlu]

PR opened on devops: https://github.com/department-of-veterans-affairs/devops/pull/11618

[allisonlu]

Changes merged on both repos. Will confirm that cookie is working later today with the daily deploy

[allisonlu]

@jilladams Do you know if the team has already added these scripts to their HTML? I forgot to confirm during our meeting the other day.

https://depo-platform-documentation.scrollhelp.site/developer-docs/teamsite-overview#TeamSiteoverview-ScriptsandTeamSiteAdministration

[jilladams]

Have emailed the team to flag this requirement. Thanks for noting!

[jilladams]

@allisonlu the team will add the headers, but no timing shared yet. You're not able to test the cookie til that's done on their end, right?

If that's true, let's close this and I can cut a follow up ticket to test the cookie once they've shipped the scripts.

[allisonlu]

Yup, I won't be able to test until they put in the script. I'll close ticket now

[jilladams]

The VA Formulary Advisor team wants to add the injected header/footer to their TeamSite, which is not yet launched.
We have added the following prod & staging domains to the required allow lists per docs:

• va.gov/formularyadvisor
• www.va.gov/formularyadvisor
• vaww.internet.staging.va.gov/formularyadvisor

The Formulary team added the script lines per docs. So in theory: everything is in place to set the browser cookie to reveal header/footer for testing.

However, when they try to set the cookie, they get a 403 on one of the listed scripts:

GET https://prod-va-gov-assets.s3-us-gov-west-1.amazonaws.com/js/settings.js net::ERR_ABORTED 403 (Forbidden)

Filed a VFS Platform Support ticket to ask for help. We may need to reopen this or file a separate ticket, tbd.

[jilladams]

Per Platform support, the script throwing 403 doesn't exist. 🙃 Not reopening ticket, just advising team to remove that script.

2yo ticket for updating docs 🙃 :
department-of-veterans-affairs/va.gov-team#8701

We'll need to keep this in mind for future teams who want the header.