entitlements v2

.fossa.yml

+# Generated by FOSSA CLI (https://github.com/fossas/fossa-cli)
+# Visit https://fossa.com to learn more
+
+version: 2
+cli:
+  server: https://app.fossa.com
+  fetcher: custom
+  project: entitlements
+analyze:
+  modules:
+  - name: entitlements-v2-service
+    type: mvn
+    target: pom.xml
+    path: .
+  - name: entitlements-v2-core
+    type: mvn
+    target: entitlements-v2-core/pom.xml
+    path: .
+  - name: entitlements-v2-azure
+    type: mvn
+    target: provider/entitlements-v2-azure/pom.xml
+    path: .
+  - name: entitlements-v2-gcp
+    type: mvn
+    target: provider/entitlements-v2-gcp/pom.xml
+    path: .

.gitignore

+**/.idea
+**/target
+**/build
+**/.gradle
+**/out
+**/*.iml
+**/dependency-reduced-pom.xml
+**/*.pyc

.gitlab-ci.yml

+variables:
+  AZURE_SERVICE: entitlements
+  AZURE_BUILD_SUBDIR: provider/entitlements-v2-azure
+  AZURE_TEST_SUBDIR: testing/entitlements-v2-test-azure
+
+include:
+  - project: "osdu/platform/ci-cd-pipelines"
+    file: "standard-setup.yml"
+
+  - project: "osdu/platform/ci-cd-pipelines"
+    file: "build/maven.yml"
+
+  - project: "osdu/platform/ci-cd-pipelines"
+    file: "scanners/fossa-maven.yml"
+
+  - project: "osdu/platform/ci-cd-pipelines"
+    file: "scanners/gitlab-ultimate.yml"
+
+  - project: "osdu/platform/ci-cd-pipelines"
+    file: "cloud-providers/azure.yml"
+
+  - project: "osdu/platform/ci-cd-pipelines"
+    file: "publishing/pages.yml"

.mvn/community-maven.settings.xml

+<settings>
+    <profiles>
+        <profile>
+            <!-- This profile uses the CI-Token to authenticate with the server, and is the default case -->
+            <id>GitLab-Authenticate-With-Job-Token</id>
+            <activation>
+                <activeByDefault>true</activeByDefault>
+            </activation>
+            <properties>
+                <repo.releases.id>community-maven-repo</repo.releases.id>
+                <publish.snapshots.id>community-maven-via-job-token</publish.snapshots.id>
+                <publish.releases.id>community-maven-via-job-token</publish.releases.id>
+
+                <repo.releases.url>https://community.opengroup.org/api/v4/groups/17/-/packages/maven</repo.releases.url>
+                <publish.snapshots.url>https://community.opengroup.org/api/v4/projects/400/packages/maven</publish.snapshots.url>
+                <publish.releases.url>https://community.opengroup.org/api/v4/projects/400/packages/maven</publish.releases.url>
+            </properties>
+        </profile>
+
+        <profile>
+            <!-- This profile uses a personal token to authenticate, which is useful for local or manual runs. The
+                 presence of the COMMUNITY_MAVEN_TOKEN variable triggers this and overrides the CI Token
+                 based authentication -->
+            <id>GitLab-Authenticate-With-Private-Token</id>
+            <activation>
+                <property>
+                    <name>env.COMMUNITY_MAVEN_TOKEN</name>
+                </property>
+            </activation>
+            <properties>
+                <repo.releases.id>community-maven-repo</repo.releases.id>
+                <publish.snapshots.id>community-maven-via-private-token</publish.snapshots.id>
+                <publish.releases.id>community-maven-via-private-token</publish.releases.id>
+
+                <repo.releases.url>https://community.opengroup.org/api/v4/groups/17/-/packages/maven</repo.releases.url>
+                <publish.snapshots.url>https://community.opengroup.org/api/v4/projects/400/packages/maven</publish.snapshots.url>
+                <publish.releases.url>https://community.opengroup.org/api/v4/projects/400/packages/maven</publish.releases.url>
+            </properties>
+        </profile>
+    </profiles>
+
+    <servers>
+        <server>
+            <id>community-maven-via-job-token</id>
+            <configuration>
+                <httpHeaders>
+                    <property>
+                        <name>Job-Token</name>
+                        <value>${env.CI_JOB_TOKEN}</value>
+                    </property>
+                </httpHeaders>
+            </configuration>
+        </server>
+
+        <server>
+            <id>community-maven-via-private-token</id>
+            <configuration>
+                <httpHeaders>
+                    <property>
+                        <name>Private-Token</name>
+                        <value>${env.COMMUNITY_MAVEN_TOKEN}</value>
+                    </property>
+                </httpHeaders>
+            </configuration>
+        </server>
+
+        <server>
+            <id>azure-auth</id>
+            <configuration>
+                <tenant>${env.AZURE_TENANT_ID}</tenant>
+                <client>${env.AZURE_CLIENT_ID}</client>
+                <key>${env.AZURE_CLIENT_SECRET}</key>
+                <environment>AZURE</environment>
+            </configuration>
+        </server>
+    </servers>
+
+</settings>

.mvn/wrapper/MavenWrapperDownloader.java

+/*
+ * Copyright 2007-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.net.*;
+import java.io.*;
+import java.nio.channels.*;
+import java.util.Properties;
+
+public class MavenWrapperDownloader {
+
+    private static final String WRAPPER_VERSION = "0.5.6";
+    /**
+     * Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided.
+     */
+    private static final String DEFAULT_DOWNLOAD_URL = "https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/"
+        + WRAPPER_VERSION + "/maven-wrapper-" + WRAPPER_VERSION + ".jar";
+
+    /**
+     * Path to the maven-wrapper.properties file, which might contain a downloadUrl property to
+     * use instead of the default one.
+     */
+    private static final String MAVEN_WRAPPER_PROPERTIES_PATH =
+            ".mvn/wrapper/maven-wrapper.properties";
+
+    /**
+     * Path where the maven-wrapper.jar will be saved to.
+     */
+    private static final String MAVEN_WRAPPER_JAR_PATH =
+            ".mvn/wrapper/maven-wrapper.jar";
+
+    /**
+     * Name of the property which should be used to override the default download url for the wrapper.
+     */
+    private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl";
+
+    public static void main(String args[]) {
+        System.out.println("- Downloader started");
+        File baseDirectory = new File(args[0]);
+        System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath());
+
+        // If the maven-wrapper.properties exists, read it and check if it contains a custom
+        // wrapperUrl parameter.
+        File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH);
+        String url = DEFAULT_DOWNLOAD_URL;
+        if(mavenWrapperPropertyFile.exists()) {
+            FileInputStream mavenWrapperPropertyFileInputStream = null;
+            try {
+                mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile);
+                Properties mavenWrapperProperties = new Properties();
+                mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream);
+                url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url);
+            } catch (IOException e) {
+                System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'");
+            } finally {
+                try {
+                    if(mavenWrapperPropertyFileInputStream != null) {
+                        mavenWrapperPropertyFileInputStream.close();
+                    }
+                } catch (IOException e) {
+                    // Ignore ...
+                }
+            }
+        }
+        System.out.println("- Downloading from: " + url);
+
+        File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH);
+        if(!outputFile.getParentFile().exists()) {
+            if(!outputFile.getParentFile().mkdirs()) {
+                System.out.println(
+                        "- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'");
+            }
+        }
+        System.out.println("- Downloading to: " + outputFile.getAbsolutePath());
+        try {
+            downloadFileFromURL(url, outputFile);
+            System.out.println("Done");
+            System.exit(0);
+        } catch (Throwable e) {
+            System.out.println("- Error downloading");
+            e.printStackTrace();
+            System.exit(1);
+        }
+    }
+
+    private static void downloadFileFromURL(String urlString, File destination) throws Exception {
+        if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) {
+            String username = System.getenv("MVNW_USERNAME");
+            char[] password = System.getenv("MVNW_PASSWORD").toCharArray();
+            Authenticator.setDefault(new Authenticator() {
+                @Override
+                protected PasswordAuthentication getPasswordAuthentication() {
+                    return new PasswordAuthentication(username, password);
+                }
+            });
+        }
+        URL website = new URL(urlString);
+        ReadableByteChannel rbc;
+        rbc = Channels.newChannel(website.openStream());
+        FileOutputStream fos = new FileOutputStream(destination);
+        fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
+        fos.close();
+        rbc.close();
+    }
+
+}

.mvn/wrapper/maven-wrapper.properties

+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.0/apache-maven-3.6.0-bin.zip
+wrapperUrl=https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar

README.md

-# entitlements
-
-Standard V2 entitlements service.
+How to run integration tests in local environment for azure implementation,
+please refer to: testing/entitlements-v2-test-azure/README.md

devops/azure/README.md

+# Pipeline Support Commands
+
+```bash
+AZURE_SERVICE="entitlements"
+REPO_BRANCH="master"
+TAG="latest"
+PARTIAL=${REPO_BRANCH/\//-}
+BRANCH=${PARTIAL/./-}
+
+echo "--set image.branch=$BRANCH --set image.tag=$TAG"
+
+# Install the Service
+helm upgrade -i osdu-gitlab-$AZURE_SERVICE chart --set image.branch=$BRANCH --set image.tag=$TAG
+pod=$(kubectl get pod |grep $AZURE_SERVICE | tail -1 | awk '{print $1}')
+status=$(kubectl wait --for=condition=Ready pod/$pod --timeout=60s)
+if [[ "$status" != *"met"* ]]; then echo "POD didn't start correctly" ; exit 1 ; fi
+```

devops/azure/chart/Chart.yaml

+#  Copyright © Microsoft Corporation
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+apiVersion: v2
+name: entitlements-v2
+appVersion: "latest"
+description: Helm Chart for installing entitlements-v2 service.
+version: 0.1.0
+type: application

devops/azure/chart/helm-config.yaml

+# This file contains the essential configs for the osdu on azure helm chart
+global:
+
+  # Service(s) Replica Count
+  replicaCount: 2
+
+################################################################################
+# Specify the Gitlab branch being used for image creation
+# ie: community.opengroup.org:5555/osdu/platform/security-and-compliance/entitlements-v2/{{ .Values.global.branch }}/entitlements-v2:latest
+#
+image:
+  repository: #{container-registry}#.azurecr.io
+  branch: #{ENVIRONMENT_NAME}#
+  tag: #{Build.SourceVersion}#
+
+server:
+  servlet:
+    contextPath: /entitlements/v2
+
+app:
+  gremlin:
+    endpoint: #{GREMLIN_ENDPOINT}#
+    username: #{GREMLIN_USERNAME}#
+  cosmosdb:
+    cosmosDbAccountName: #{COSMOS_DB_ACCOUNT_NAME}#
+    resourceGroup: #{AZURE_RESOURCE_GROUP}#
+    subscriptionId: #{AZURE_SUBSCRIPTION_ID}#
+  integration:
+    tester: #{INTEGRATION_TESTER}#

devops/azure/chart/templates/azure-istio-auth-policy.yaml

+#  Copyright © Microsoft Corporation
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: {{ .Chart.Name }}-jwt-authz
+  namespace: osdu
+spec:
+  selector:
+    matchLabels:
+      app: {{ .Chart.Name }}
+  action: DENY
+  rules:
+    - from:
+        - source:
+            notRequestPrincipals: [ "*" ]
+      to:
+        - operation:
+            notPaths: ["/","*/index.html",
+                       "*/v2/api-docs",
+                       "*/swagger","*/swagger-resources","*/swagger-ui.html",
+                       "*/actuator/health", "*/health",
+                       "*/configuration/ui","*/configuration/security",
+                       "/entitlements/v2/swagger-resources/*",
+                       "/entitlements/v2/webjars/*" ]

devops/azure/chart/templates/deployment.yaml

+#  Copyright © Microsoft Corporation
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  namespace: osdu
+spec:
+  replicas: {{ .Values.global.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ .Chart.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Chart.Name }}
+        aadpodidbinding: osdu-identity
+    spec:
+      volumes:
+        - name: azure-keyvault
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: azure-keyvault
+      containers:
+        - name: {{ .Chart.Name }}
+          image: {{ .Values.image.repository }}/{{ .Chart.Name }}-{{ .Values.image.branch }}:{{ .Values.image.tag | default .Chart.AppVersion }}
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 80
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.server.servlet.contextPath }}/_ah/readiness_check
+              port: 80
+          volumeMounts:
+            - name: azure-keyvault
+              mountPath: '/mnt/azure-keyvault'
+              readOnly: true
+          env:
+            - name: LOGGING_LEVEL
+              value: INFO
+            - name: server.port
+              value: '80'
+            - name: KEYVAULT_URI
+              valueFrom:
+                configMapKeyRef:
+                  name: osdu-svc-properties
+                  key: ENV_KEYVAULT
+            - name: aad_client_id
+              valueFrom:
+                secretKeyRef:
+                  name: active-directory
+                  key: application-appid
+            - name: appinsights_key
+              valueFrom:
+                secretKeyRef:
+                  name: central-logging
+                  key: appinsights
+            - name: partition_service_endpoint
+              value: http://partition/api/partition/v1
+            - name: GREMLIN_ENDPOINT
+              value: {{ .Values.app.gremlin.endpoint }}
+            - name: GREMLIN_USERNAME
+              value: {{ .Values.app.gremlin.username }}
+            - name: cosmosdb_database
+              value: osdu-db
+            - name: COSMOS_DB_ACCOUNT_NAME
+              value: {{ .Values.app.cosmosdb.cosmosDbAccountName }}
+            - name: AZURE_RESOURCE_GROUP
+              value: {{ .Values.app.cosmosdb.resourceGroup }}
+            - name: AZURE_SUBSCRIPTION_ID
+              value: {{ .Values.app.cosmosdb.subscriptionId }}
+            - name: INTEGRATION_TESTER
+              value: {{ .Values.app.integration.tester}}
+            - name: azure_istioauth_enabled
+              value: "true"
\ No newline at end of file

devops/azure/chart/templates/service.yaml

+#  Copyright © Microsoft Corporation
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Chart.Name }}
+  namespace: osdu
+spec:
+  type: ClusterIP
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+  selector:
+    app: {{ .Chart.Name }}

devops/azure/chart/values.yaml

+#  Copyright © Microsoft Corporation
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+global:
+  replicaCount: 1
+
+image:
+  repository: community.opengroup.org:5555/osdu/platform/security-and-compliance/entitlements
+  branch: master
+  tag: latest
+
+server:
+  servlet:
+    contextPath: /entitlements/v2
+
+app:
+  gremlin:
+    endpoint: ""
+    port: 8901
+    username: ""
+    sslEnabled: true
+  cosmosdb:
+    cosmosDbAccountName: ""
+    resourceGroup: ""
+    subscriptionId: ""
+  integration:
+    tester: ""
\ No newline at end of file

devops/azure/development-pipeline.yml

+#  Copyright © Microsoft Corporation
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - master
+  paths:
+    exclude:
+      - /**/*.md
+      - .gitignore
+      - /docs
+      - /provider/entitlements-v2-gcp
+
+resources:
+  repositories:
+    - repository: FluxRepo
+      type: git
+      name: k8-gitops-manifests
+    - repository: TemplateRepo
+      type: git
+      name: infra-azure-provisioning
+
+variables:
+  - group: 'Azure - OSDU'
+  - group: 'Azure - OSDU Secrets'
+
+  - name: serviceName
+    value: "entitlements-v2"
+  - name: chartPath
+    value: "devops/azure/chart"
+  - name: valuesFile
+    value: "devops/azure/chart/helm-config.yaml"
+  - name: 'MANIFEST_REPO'
+    value: $[ resources.repositories['FluxRepo'].name ]
+  - name: SKIP_TESTS
+    value: 'false'
+
+stages:
+  - template: /devops/build-stage.yml@TemplateRepo
+    parameters:
+      mavenGoal: 'package'
+      mavenPublishJUnitResults: true
+      serviceCoreMavenOptions: '-P entitlements-v2-core'
+      mavenOptions: '-P entitlements-v2-azure'
+      copyFileContents: |
+        pom.xml
+        provider/entitlements-v2-azure/maven/settings.xml
+        provider/entitlements-v2-azure/pom.xml
+        provider/entitlements-v2-azure/target/*-spring-boot.jar
+      copyFileContentsToFlatten: ''
+      mavenSettingsFile: './maven/settings.xml'
+      serviceBase: ${{ variables.serviceName }}
+      testingRootFolder: 'testing'
+      chartPath: ${{ variables.chartPath }}