tasks

#!/bin/bash

set -Eeo pipefail

###########################
# Local Config Parameters #
###########################

AWS_DEFAULT_REGION=eu-west-2
IMAGE_REPO_NAME=deductions/ehr-repo
export NHS_SERVICE=ehr-repo
AWS_HELPERS_VERSION=0.2.27
echo "AWS helper scripts version: $AWS_HELPERS_VERSION"

###########################
# Shared utils            #
###########################

function download_util() {
  local UTIL_VERSION=$1
  local UTIL_FILENAME=$2

  local UTIL_FILEPATH="utils/$UTIL_VERSION/$UTIL_FILENAME"

  mkdir -p "utils/$UTIL_VERSION"
  if [[ ! -f $UTIL_FILEPATH ]];then
    wget --quiet -O $UTIL_FILEPATH https://github.com/nhsconnect/prm-deductions-support-infra/releases/download/${UTIL_VERSION}/${UTIL_FILENAME}
  fi
  chmod +x $UTIL_FILEPATH

  echo "$UTIL_FILEPATH"
}

function fetch_redaction_utils() {
  download_util $AWS_HELPERS_VERSION run-with-redaction.sh
  download_util $AWS_HELPERS_VERSION redactor
}

# Do not change the file name as the aws helper scripts depend on it
AWS_HELPERS_FILE="utils/$AWS_HELPERS_VERSION/aws-helpers"

mkdir -p "utils/$AWS_HELPERS_VERSION"

if [[ ! -f $AWS_HELPERS_FILE ]];then
  wget --quiet -O $AWS_HELPERS_FILE https://github.com/nhsconnect/prm-deductions-support-infra/releases/download/${AWS_HELPERS_VERSION}/aws-helpers
fi
chmod +x $AWS_HELPERS_FILE
source $AWS_HELPERS_FILE

####################################
# Instance (Environment) Variables #
####################################

function check_env {
  if [[ -z "${NHS_ENVIRONMENT}" ]]; then
    echo "Must set NHS_ENVIRONMENT"
    exit 1
  fi
}

function check_nhs_service {
  if [[ -z "${NHS_SERVICE}" ]]; then
    echo "Must set NHS_SERVICE"
    exit 1
  fi
}

function configure_domain_infix {
  if [[ "${NHS_ENVIRONMENT}" == "prod" ]]; then
    export DOMAIN_INFIX="prod"
  else
    export DOMAIN_INFIX="${NHS_ENVIRONMENT}.non-prod"
  fi
}

function configure_service_url {
  configure_domain_infix
  if [[ -z "${NHS_ENVIRONMENT}" ]]; then
    export SERVICE_URL="http://${NHS_SERVICE}:3000"
  else
    export SERVICE_URL="https://${NHS_SERVICE}.${DOMAIN_INFIX}.patient-deductions.nhs.uk"
  fi
}

function prepare_local_envs_for_ide {
  envs=$(printenv | grep "NODE_ENV" && \
          printenv | grep "AUTHORIZATION_KEYS" && \
          printenv | grep "SERVICE_URL"
  )

  echo "Paste these env vars to your IntelliJ run template:"
  echo $envs | tr ' ' ';'
}

function generate_secure_string {
  local length=$1
  LC_CTYPE="en_GB.UTF8" tr -dc 'A-Za-z0-9' < /dev/urandom | head -c $length ; echo
}

function configure_local_envs {
  export AUTHORIZATION_KEYS=$(generate_secure_string 10)
  export S3_BUCKET_NAME=test-bucket
  export LOCALSTACK_URL=http://localstack:4572
  export REPOSITORY_URI=$IMAGE_REPO_NAME
  export NODE_ENV=local

  export DYNAMODB_NAME=local-test-db
  export DYNAMODB_LOCAL_ENDPOINT=http://dynamodb-local:8000/
  export AWS_ACCESS_KEY_ID=$(generate_secure_string 20)
  export AWS_SECRET_ACCESS_KEY=$(generate_secure_string 20)

  configure_service_url
}

function configure_local_envs_for_docker_test {
  export AUTHORIZATION_KEYS=$(generate_secure_string 10)
  export S3_BUCKET_NAME=test-bucket
  export LOCALSTACK_URL=http://localstack:4572
  export REPOSITORY_URI=$IMAGE_REPO_NAME
  export NODE_ENV=local

  export DYNAMODB_NAME=local-test-db
  export DYNAMODB_LOCAL_ENDPOINT=http://dynamodb-local:8000/

  configure_service_url
}

function get_aws_account_id {
     AWS_ACCOUNT_ID=$(dojo -c Dojofile-infra "aws sts get-caller-identity | jq -r .Account")
 }

function configure_aws_service_e2e_test_auth_keys_for_ehr_repo {
    check_env
    assume_environment_role $NHS_ENVIRONMENT
    parameter_name="/repo/${NHS_ENVIRONMENT}/user-input/api-keys/${NHS_SERVICE}/e2e-test"
    export E2E_TEST_AUTHORIZATION_KEYS_FOR_EHR_REPO=$(get_aws_ssm_secret ${parameter_name})
}

function get_aws_ssm_secret {
  secret_id=$1
  json=$(dojo -c Dojofile-infra "aws ssm get-parameter --with-decryption --region $AWS_DEFAULT_REGION --name $secret_id")
  if [ $? != 0 ]; then
    >&2 echo "Failed to obtain AWS secret from SSM: $secret_id"
    exit 5
  fi
  echo $json | jq -r ".Parameter.Value"
}

#######################
# Terraform Functions #
#######################

function tf_init {
  check_env

  cd terraform

  terraform init -reconfigure \
    -backend-config key="${NHS_SERVICE}-${NHS_ENVIRONMENT}/terraform.tfstate" \
    -backend-config bucket="prm-deductions-${NHS_ENVIRONMENT}-terraform-state" \
    -backend-config dynamodb_table="prm-deductions-${NHS_ENVIRONMENT}-terraform-table" \
    -backend-config region=${AWS_DEFAULT_REGION}
}

function tf_init_db_roles {
  check_env
  cd terraform-db-roles

  terraform init -reconfigure \
    -backend-config key="${NHS_SERVICE}-${NHS_ENVIRONMENT}-db-roles/terraform.tfstate" \
    -backend-config bucket="prm-deductions-${NHS_ENVIRONMENT}-terraform-state" \
    -backend-config dynamodb_table="prm-deductions-${NHS_ENVIRONMENT}-terraform-table" \
    -backend-config region=${AWS_DEFAULT_REGION}
}

function configure_tf_plan_filename {
  certs=$1
  if [[ "${certs}" == "true" ]]; then
    export TF_PLAN_FILENAME="certs_deployment.tfplan"
  else
    export TF_PLAN_FILENAME="deployment.tfplan"
  fi
}

function tf_plan {
  operation=$1
  certs=$2

  set_image_tag
  TARGET=""

  configure_tf_plan_filename $certs

  if [[ "${certs}" == "true" ]]; then
    TARGET="-target=aws_acm_certificate.ehr-repo-cert"
  fi

  tf_init
  terraform get # modules
  if [[ "${operation}" == "create" ]]; then
    terraform plan -var task_image_tag=$IMAGE_TAG -var-file=$NHS_ENVIRONMENT.tfvars $TARGET -out="${TF_PLAN_FILENAME}"
  elif [[ "${operation}" == "destroy" ]]; then
    terraform plan -var task_image_tag=$IMAGE_TAG -var-file=$NHS_ENVIRONMENT.tfvars -out="${TF_PLAN_FILENAME}" -destroy
  else
    echo "Unknown operation (should be create or destroy), got: ${operation}"
    exit 1
  fi
}

function tf_plan_db_roles {
  operation=$1
  db_host=$(_get_aws_ssm_secret "/repo/${NHS_ENVIRONMENT}/output/prm-deductions-ehr-repository/db-host")
  db_username=$(_get_aws_ssm_secret "/repo/${NHS_ENVIRONMENT}/user-input/ehr-repo-db-username")
  db_password=$(_get_aws_ssm_secret "/repo/${NHS_ENVIRONMENT}/user-input/ehr-repo-db-password")
  db_name=$(_get_aws_ssm_secret "/repo/${NHS_ENVIRONMENT}/output/prm-deductions-ehr-repository/db-name")

  tf_init_db_roles
  terraform get # modules
  if [[ "${operation}" == "create" ]]; then
    terraform plan -var db_host=$db_host -var db_username=$db_username -var db_password=$db_password -var environment=$NHS_ENVIRONMENT -var db_name=$db_name -out="db-roles.tfplan"
  elif [[ "${operation}" == "destroy" ]]; then
    terraform plan -var db_host=$db_host -var db_username=$db_username -var db_password=$db_password -var environment=$NHS_ENVIRONMENT -var db_name=$db_name -out="db-roles.tfplan" -destroy
  else
    echo "Unknown operation (should be create or destroy), got: ${operation}"
    exit 1
  fi
}

function tf_apply {
  tf_init
  terraform get # modules
  terraform apply deployment.tfplan
}

function tf_apply_certs {
  tf_init
  terraform get # modules
  terraform apply certs_deployment.tfplan
}

function tf_apply_db_roles {
  tf_init_db_roles
  terraform get # modules
  terraform apply --parallelism=1 "db-roles.tfplan"
}

####################
# Script Functions #
####################

function create_secret_ssm_param {
  secret_id="$1"
  value="$2"
  set +e
  aws ssm get-parameter --region $AWS_DEFAULT_REGION --name "$secret_id" | jq -r ".Parameter.Value" > /dev/null
  if [[ $? == 0 ]]; then
    echo "Secret at $secret_id already exists"
  else
    set -e
    echo "Secret does not exists. Creating $secret_id"
    aws ssm put-parameter \
     --region $AWS_DEFAULT_REGION \
     --name "$secret_id" \
     --type SecureString \
     --overwrite \
     --value "$value"
  fi
}

function generate_secret_ssm_param {
  value=$(openssl rand -base64 24  | tr -d "/@\'+")
  create_secret_ssm_param "$1" "$value"
}

function generate_username_ssm_param {
  set +e
  value=$(< /dev/urandom tr -dc a-z | head -c12)
  set -e
  create_secret_ssm_param "$1" "$value"
}


############################
# Docker Related Functions #
############################

function docker_login {
  echo Logging in to Amazon ECR...
  eval $(dojo -c Dojofile-infra "aws ecr get-login --no-include-email --region $AWS_DEFAULT_REGION")
}

function configure_docker_repository_uri {
  docker_login
  get_aws_account_id
  export REPOSITORY_URI=$AWS_ACCOUNT_ID.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com/$IMAGE_REPO_NAME
}

function set_image_tag() {
  export IMAGE_TAG=$(git rev-parse HEAD | cut -c 1-8)
}

function build_docker_image() {
  echo Build started on $(date)
  set_image_tag
  echo Building the Docker image...
  docker build --build-arg UTILS_VERSION=$AWS_HELPERS_VERSION -t $REPOSITORY_URI:latest -t $REPOSITORY_URI:$IMAGE_TAG .
  echo Build completed on `date`
}

###########
## TASKS ##
###########

command="$1"
case "${command}" in
  _dep)
      npm install
      npm run check-audit
      ;;
  dep)
      dojo "./tasks _dep"
      ;;
  _fix_dep)
      npm install
      npm run resolve-audit
      ;;
  fix_dep)
      dojo "./tasks _fix_dep"
      ;;
  _list_outdated)
      npm install
      npm outdated > outdated-dependencies.txt
      ;;
  list_outdated)
      dojo "./tasks _list_outdated"
      ;;
  update_package_json)
      dojo "npx npm-check-updates -u"
      ;;
  _build)
      rm -rf build/
      npm install
      npm run build
      ;;
  build)
      dojo "./tasks _build"
      ;;
  _setup_test_integration_local)
    configure_local_envs
    prepare_local_envs_for_ide
    ;;
  _test_lint)
      npm install
      npm run lint
      ;;
  test_lint)
      dojo "./tasks _test_lint"
      ;;
  _test_unit)
      npm install
      npm run test:unit
      ;;
  test_unit)
      dojo "./tasks _test_unit"
      ;;
 _test_integration_local)
      configure_local_envs
      npm install
      npm run test:integration
      ;;
  _test_integration)
      npm install
      sh scripts/create-dynamodb-table.sh
      node scripts/wait-for-localstack.js
      npm run test:integration
      ;;
  test_integration)
      configure_local_envs
      dojo -c Dojofile-itest "./tasks _test_integration"
      ;;
  test_integration_shell)
      configure_local_envs
      dojo -c Dojofile-itest
      ;;
  _test_all)
      npm install
      npm run lint
      npm run test:unit
      configure_local_envs
      sh scripts/create-dynamodb-table.sh
      npm run test:integration
      ;;
  test_all)
      configure_local_envs
      dojo -c Dojofile-itest "./tasks _test_all"
      ;;
  _test_performance)
      npm install
      npm run test:performance
      ;;
  test_performance)
      configure_aws_service_e2e_test_auth_keys_for_ehr_repo
      configure_service_url
      dojo "./tasks _test_performance"
      ;;
  _test_coverage)
      npm install
      sh scripts/create-dynamodb-table.sh
      npm run test:coverage
      ;;
  test_coverage)
      configure_local_envs
      dojo -c Dojofile-itest "./tasks _test_coverage"
      ;;
  test_coverage-github-action)
      npm install
      npm run test:coverage-unit-test-only
      ;;
  fetch_utils)
      fetch_redaction_utils
      ;;
  build_docker_local)
      configure_local_envs_for_docker_test
      fetch_redaction_utils
      build_docker_image
      ;;
  build_docker)
      configure_docker_repository_uri
      fetch_redaction_utils
      build_docker_image
      echo "Pushing the Docker image... $REPOSITORY_URI:latest $REPOSITORY_URI:$IMAGE_TAG"
      docker push $REPOSITORY_URI:$IMAGE_TAG
      ;;
  _test_docker)
      npm install
      sh scripts/create-dynamodb-table.sh
      node scripts/wait-for-localstack.js
      npm run test:docker
      ;;
  test_docker)
      configure_local_envs_for_docker_test
      configure_docker_repository_uri
      set_image_tag
      dojo -c Dojofile-dtest "./tasks _test_docker"
      ;;
  test_docker_local_shell)
      configure_local_envs_for_docker_test
      set_image_tag
      dojo -c Dojofile-dtest
      ;;
  test_docker_local)
      configure_local_envs_for_docker_test
      set_image_tag
      dojo -c Dojofile-dtest "./tasks _test_docker"
      ;;
  sanity_check)
      dojo "./tasks _sanity_check"
      ;;
  _sanity_check)
      configure_domain_infix
      check_env
      nslookup "ehr-repo.${DOMAIN_INFIX}.patient-deductions.nhs.uk"
      curl -i --fail "https://ehr-repo.${DOMAIN_INFIX}.patient-deductions.nhs.uk/health"
      ;;
  _tf)
      tf_init
      bash
      ;;
  tf)
      check_env
      dojo -c Dojofile-infra "./tasks _tf"
      ;;
  _tf_plan_certs)
      _assume_environment_role $NHS_ENVIRONMENT
      tf_plan "$2" true
      ;;
  tf_plan_certs)
      check_env
      dojo -c Dojofile-infra "./tasks _tf_plan_certs $2"
      ;;
  _tf_apply_certs)
      _assume_environment_role $NHS_ENVIRONMENT
      tf_apply_certs
      ;;
  tf_apply_certs)
      check_env
      dojo -c Dojofile-infra "./tasks _tf_apply_certs"
      ;;
  _tf_plan)
      _assume_environment_role $NHS_ENVIRONMENT
      tf_plan "$2"
      ;;
  _tf_plan_db_roles)
      _assume_environment_role $NHS_ENVIRONMENT
      tf_plan_db_roles "$2"
      ;;
  tf_plan_db_roles)
      check_env
      dojo -c Dojofile-infra "./tasks _tf_plan_db_roles $2"
      ;;
  tf_plan)
      check_env
      dojo -c Dojofile-infra "./tasks _tf_plan $2"
      ;;
  _tf_apply)
      _assume_environment_role $NHS_ENVIRONMENT
      tf_apply
      ;;
  tf_apply)
      check_env
      dojo -c Dojofile-infra "./tasks _tf_apply"
      ;;
  _tf_apply_db_roles)
      _assume_environment_role $NHS_ENVIRONMENT
      tf_apply_db_roles
      ;;
  tf_apply_db_roles)
      check_env
      dojo -c Dojofile-infra "./tasks _tf_apply_db_roles"
      ;;
  promote_docker_image)
      check_env
      set_image_tag
      promote_docker_image "$IMAGE_REPO_NAME:$IMAGE_TAG" "$NHS_ENVIRONMENT"
      ;;
  _wait_ecs)
      _assume_environment_role $NHS_ENVIRONMENT
      aws ecs wait services-stable \
        --region $AWS_DEFAULT_REGION \
        --cluster $NHS_ENVIRONMENT-ehr-repo-ecs-cluster \
        --service $NHS_ENVIRONMENT-${NHS_SERVICE}-service
      ;;
  wait_ecs)
      check_env
      dojo -c Dojofile-infra "./tasks _wait_ecs"
      ;;
  *)
      echo "Invalid command: '${command}'"
      exit 1
      ;;
esac
set +e