Merge from main and regenerate yarn.lock

.babelrc

@@ -1,17 +1,17 @@
 // .babelrc
 {
   "presets": [
-    ["es2015", {"modules": false}],
-    "react"
-  ],
-  "plugins": [
-    "transform-object-assign",
-    "transform-class-properties",
-    "react-hot-loader/babel"
-  ],
-  "env": {
-    "test": {
-      "plugins": ["transform-es2015-modules-commonjs"]
-    }
-  }
+    "@babel/preset-react",
+    [
+      "@babel/preset-env",
+      {
+          "useBuiltIns": "entry",
+          "corejs": "3.19",
+          "targets": {
+              "chrome": 75,
+              "ios": 12
+          }
+      }
+    ]
+  ]
 }

.eslintrc.json

@@ -21,5 +21,10 @@
     "extends": ["eslint:recommended", "plugin:react/recommended"],
     "globals": {
         "Promise": false
+    },
+    "settings": {
+        "react": {
+            "version": "detect"
+        }
     }
 }

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @guardian/digital-cms

.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Build deployment artifacts
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: guardian/setup-scala@v1
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: CI yarn
+        shell: bash
+        run: |
+          yarn install --force --frozen-lockfile
+          yarn lint
+          yarn test
+          yarn build
+
+      - name: CI sbt
+        shell: bash
+        run: |
+          sbt clean compile test Debian/packageBin
+
+      - name: Upload to riff-raff
+        uses: guardian/actions-riff-raff@v4
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
+          buildNumberOffset: 1319
+          projectName: editorial-tools:atom-workshop
+          configPath: riff-raff.yaml
+          contentDirectories: |
+            atom-workshop:
+              - target/atom-workshop_1.0_all.deb

.github/workflows/snyk.yml

@@ -0,0 +1,18 @@
+# This action runs snyk monitor on every push to main
+name: Snyk
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  security:
+    uses: guardian/.github/.github/workflows/sbt-node-snyk.yml@main
+    with:
+      DEBUG: true
+      ORG: guardian
+      SKIP_NODE: false
+    secrets:
+       SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

.gitignore

@@ -8,3 +8,4 @@ node_modules/
 public/build
 ensime-langserver.log
 pc.stdout.log
+.bsp/

.java-version

@@ -1 +1 @@
-1.8.0.232
+11

.nvmrc

@@ -1 +1 @@
-12.13.1
+20.8.1

.tool-versions

@@ -0,0 +1 @@
+java corretto-11.0.22.7.1

Brewfile

@@ -1,4 +1,3 @@
 brew "yarn"
-cask "AdoptOpenJDK/openjdk/adoptopenjdk8"
 cask "guardian/devtools/gu-scala"
 brew "guardian/devtools/dev-nginx"

README.md

@@ -9,10 +9,15 @@ for both the composer and capi AWS accounts from [janus](https://janus.gutools.c
 
 This project requires Node, so we recommend you use [node version manager](https://github.com/nvm-sh/nvm) `nvm`. Run `brew install nvm` if you do not have it. Run `nvm use` in the root of the project to ensure you are using the right version of node. The project's node version is set in the `.nvmrc` file.
 
-The project also requires Java version `1.8.0.232` (or lower). The easiest way to set this is with `jenv`:
-- `brew install jenv`
-- Download and install the appopriate Java version: [jdk8u232-b09](https://adoptopenjdk.net/archive.html)
-- `jenv add /Library/Java/JavaVirtualMachines/adoptopenjdk-8.jdk/Contents/Home/`
+The project also requires Java 11. The [easiest](https://docs.google.com/document/d/1ZR-YnaXCT5_gLVmTCeGs0mWd3KPaAozPjQK8uUzHZ9w/edit#heading=h.kgqqi53p3ltt)
+way to install this is with `asdf install`, which will install the version of `java` specified in our
+[.tool-versions](.tool-versions) file:
+
+```shell
+$ brew install asdf
+$ asdf plugin add java
+$ asdf install
+```
 
 You will then need to:
 

app/AppComponents.scala

@@ -1,41 +1,74 @@
+import com.gu.AppIdentity
 import com.gu.atom.play.ReindexController
-import config.LogConfig
-import config.Config.{config, permissions, dynamoDB, capiDynamoDB, capiLambdaClient}
-import controllers.ExplainerReindexController
-import db.AtomDataStores._
-import db.AtomWorkshopDB
-import db.ExplainerDB
-import db.ReindexDataStores._
+import com.gu.pandomainauth.{PanDomainAuthSettingsRefresher, S3BucketLoader}
+import config.{AWS, Config}
+import controllers.{AssetsComponents, ExplainerReindexController, PanDomainAuthActions}
+import db.{AtomDataStores, AtomWorkshopDB, ExplainerDB}
 import play.api.ApplicationLoader.Context
-import play.api._
+import play.api.{BuiltInComponentsFromContext, Configuration}
+import play.api.libs.ws.WSClient
 import play.api.libs.ws.ahc.AhcWSComponents
+import play.api.mvc.{ControllerComponents, EssentialFilter}
+import play.filters.HttpFiltersComponents
 import router.Routes
+import services.{AtomPublishers, Permissions}
 
-class AppComponents(context: Context)
-  extends BuiltInComponentsFromContext(context) with AhcWSComponents {
+class AppComponents(context: Context, identity: AppIdentity)
+  extends BuiltInComponentsFromContext(context) with AhcWSComponents with AssetsComponents with HttpFiltersComponents {
 
-  val logger = new LogConfig
+  lazy val config = new Config(context.initialConfiguration, identity)
 
-  lazy val router = new Routes(httpErrorHandler, appController, healthcheckController, loginController, assets, supportController, reindex, explainerReindex)
-  lazy val assets = new controllers.Assets(httpErrorHandler)
-  lazy val appController = new controllers.App(wsClient, atomWorkshopDB, permissions)
-  lazy val loginController = new controllers.Login(wsClient)
-  lazy val healthcheckController = new controllers.Healthcheck()
-  lazy val supportController = new controllers.Support(wsClient)
+  override lazy val router = new Routes(httpErrorHandler, appController, healthcheckController, loginController, assets, supportController, reindex, explainerReindex)
+  override lazy val httpFilters: Seq[EssentialFilter] = super.httpFilters.filterNot(_ == allowedHostsFilter)
 
-  lazy val reindex = new ReindexController(previewDataStore, publishedDataStore, reindexPreview, reindexPublished, Configuration(config), actorSystem)
+  lazy val appPermissions = new Permissions(config.effectiveStage)
+
+  private val pandaAuthActions = new PanDomainAuthActions {
+    override def authCallbackUrl: String = config.pandaAuthCallback
+
+    override def wsClient: WSClient = AppComponents.this.wsClient
+
+    override def controllerComponents: ControllerComponents = AppComponents.this.controllerComponents
+
+    override val panDomainSettings: PanDomainAuthSettingsRefresher = PanDomainAuthSettingsRefresher(
+      domain = config.pandaDomain,
+      system = config.pandaSystem,
+      S3BucketLoader.forAwsSdkV1(AWS.S3Client, "pan-domain-auth-settings")
+    )
+
+    override def permissions: Permissions = appPermissions
+  }
+
+  lazy val atomWorkshopDB = new AtomWorkshopDB()
+  lazy val explainerDB = new ExplainerDB()
+
+  lazy val atomDataStores = new AtomDataStores(config)
+  lazy val atomPublishers = new AtomPublishers(config)
+
+
+  lazy val appController = new controllers.App(controllerComponents, config, pandaAuthActions, atomWorkshopDB, atomDataStores, atomPublishers, appPermissions)
+  lazy val loginController = new controllers.Login(controllerComponents, wsClient, pandaAuthActions)
+  lazy val healthcheckController = new controllers.Healthcheck(controllerComponents)
+  lazy val supportController = new controllers.Support(controllerComponents, wsClient, config, pandaAuthActions)
+
+  lazy val reindex = new ReindexController(
+    atomDataStores.previewDataStore,
+    atomDataStores.publishedDataStore,
+    atomDataStores.reindexPreview,
+    atomDataStores.reindexPublished,
+    Configuration(config.config),
+    controllerComponents,
+    actorSystem
+  )
 
   lazy val explainerReindex = new ExplainerReindexController(
     wsClient,
     explainerDB,
-    explainerPreviewDataStore,
-    explainerPublishedDataStore,
-    reindexPreview,
-    reindexPublished,
-    Configuration(config)
+    atomDataStores.explainerPreviewDataStore,
+    atomDataStores.explainerPublishedDataStore,
+    atomDataStores.reindexPreview,
+    atomDataStores.reindexPublished,
+    config,
+    controllerComponents
   )(actorSystem.dispatcher)
-
-  lazy val atomWorkshopDB = new AtomWorkshopDB()
-
-  lazy val explainerDB = new ExplainerDB()
-}
+}

app/AppLoader.scala

@@ -1,13 +1,37 @@
+import com.gu.conf.{ConfigurationLoader, FileConfigurationLocation, SSMConfigurationLocation}
+import com.gu.{AppIdentity, AwsIdentity, DevIdentity}
 import play.api.ApplicationLoader.Context
-import play.api.{Application, ApplicationLoader, LoggerConfigurator}
+import play.api.{Application, ApplicationLoader, Configuration, LoggerConfigurator}
+import software.amazon.awssdk.auth.credentials.{AwsCredentialsProvider, DefaultCredentialsProvider, ProfileCredentialsProvider}
 
-class AppLoader extends ApplicationLoader {
+import java.io.File
 
+class AppLoader extends ApplicationLoader {
   override def load(context: Context): Application = {
+    startLogging(context)
+
+    val appName = "atom-workshop"
+
+    val identity: AppIdentity = AppIdentity.whoAmI(appName)
+
+    val credentials: AwsCredentialsProvider = identity match {
+      case _: DevIdentity => ProfileCredentialsProvider.create("composer")
+      case _ => DefaultCredentialsProvider.create()
+    }
+
+    val loadedConfig = ConfigurationLoader.load(identity, credentials) {
+      case identity: AwsIdentity => SSMConfigurationLocation.default(identity)
+      case _: DevIdentity =>
+        val home = System.getProperty("user.home")
+        FileConfigurationLocation(new File(s"$home/.gu/$appName.conf"))
+    }
+
+    new AppComponents(context.copy(initialConfiguration = context.initialConfiguration.withFallback(Configuration(loadedConfig))), identity).application
+  }
+
+  private def startLogging(context: Context): Unit = {
     LoggerConfigurator(context.environment.classLoader).foreach {
       _.configure(context.environment)
     }
-    new AppComponents(context).application
   }
-
 }

app/config/AWS.scala

@@ -0,0 +1,33 @@
+package config
+
+import com.amazonaws.auth.profile.ProfileCredentialsProvider
+import com.amazonaws.auth.{AWSCredentialsProviderChain, InstanceProfileCredentialsProvider}
+import com.amazonaws.regions.{Region, Regions}
+import com.amazonaws.services.dynamodbv2.{AmazonDynamoDB, AmazonDynamoDBClientBuilder}
+import com.amazonaws.services.kinesis.{AmazonKinesis, AmazonKinesisClientBuilder}
+import com.amazonaws.services.s3.{AmazonS3, AmazonS3ClientBuilder}
+
+object AWS {
+  lazy val region: Region = Option(Regions.getCurrentRegion).getOrElse(Region.getRegion(Regions.EU_WEST_1))
+
+  lazy val credentials = new AWSCredentialsProviderChain(
+    new ProfileCredentialsProvider("composer"),
+    new InstanceProfileCredentialsProvider(false)
+  )
+
+  lazy val dynamoDB: AmazonDynamoDB = AmazonDynamoDBClientBuilder
+    .standard()
+    .withCredentials(AWS.credentials)
+    .withRegion(region.getName)
+    .build()
+
+  lazy val kinesisClient: AmazonKinesis = AmazonKinesisClientBuilder.standard()
+    .withCredentials(AWS.credentials)
+    .withRegion(region.getName)
+    .build()
+
+  lazy val S3Client: AmazonS3 = AmazonS3ClientBuilder.standard()
+    .withCredentials(credentials)
+    .withRegion(region.getName)
+    .build()
+}