Merge remote-tracking branch 'bcgov/main' into docs/flyway-test-fixture-strategy

Author: gpascucci

.github/workflows/analysis.yml

@@ -40,10 +40,14 @@ jobs:
           java-cache: maven
           java-distribution: temurin
           java-version: "21"
-          # cpd.exclusions: RoadGroupLookup is a verbatim port of the legacy RMG tables
-          # (RoadGroupUtil.setRmgByTfaTsbNumberCode/setRmgByTflNumberCode), where ~18 of the
-          # TSA cases are token-identical apart from their literals. CPD reads that as 174
-          # duplicated lines; the table is the business rule and must not be de-duplicated.
+          # cpd.exclusions: both RoadGroup lookups are verbatim ports of the legacy RMG tables,
+          # where ~18 of the TSA cases are token-identical apart from their literals. CPD reads
+          # that as ~174 duplicated lines each; the tables ARE the business rule and must not be
+          # de-duplicated. schedule6 ports setRmgByTfaTsbNumberCode/setRmgByTflNumberCode;
+          # schedule10 ports setRG10ByTsaTsbNumberCode/setRG10ByTflNumberCode.
+          # They are NOT interchangeable: the same inputs map to DIFFERENT road groups (TSA 01 ->
+          # 15 vs 11, TSA 08 -> 10 vs 7, TFL 08 -> 7 vs 10), so "resolving" the duplication by
+          # merging them would silently corrupt one schedule's derived, user-visible Road Group.
           # xmlReportPaths: with the ITs running, the pom's jacoco `merge`/`report-merged` executions
           # produce the union of surefire and failsafe coverage. Sonar would otherwise keep reading
           # the unit-only report and still count IT-covered lines as uncovered.
@@ -52,7 +56,7 @@ jobs:
             -Dsonar.projectKey=bcgov-sonarcloud_nr-ilcr_backend
             -Dsonar.host.url=https://sonarcloud.io
             -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco-merged/jacoco.xml
-            -Dsonar.cpd.exclusions=**/schedule6/RoadGroupLookup.java
+            -Dsonar.cpd.exclusions=**/schedule6/RoadGroupLookup.java,**/schedule10/RoadGroup10Lookup.java
           sonar_token: ${{ secrets.sonar_token_backend }}
           triggers: ('backend/')
 
@@ -64,7 +68,12 @@ jobs:
       checks: write
       security-events: write
     runs-on: ubuntu-24.04
-    timeout-minutes: 5
+    # Covers all four commands below — npm ci, lint, format:check AND a coverage run — not the tests
+    # alone. Raised from 5 after PR #317 was cancelled at 4m58s with zero test failures: the same job
+    # had passed at 3m22s one commit earlier, so the 5-minute budget was already two thirds spent and
+    # a growing component suite left no room for runner variance. 10 restores headroom without
+    # hiding a genuine hang.
+    timeout-minutes: 10
     steps:
       - uses: bcgov/action-test-and-analyse@8f699e3fd3fadd9a6adf6f4b1f2638ef7ecfefb9 # v2.0.0
         env:

.github/workflows/merge.yml

@@ -29,12 +29,9 @@ jobs:
       # Get PR number for squash merges to main
       - id: pr
         uses: bcgov/action-get-pr@28b0adf8e4d40720d41f9c87356ce24b0a4bd6af # v0.3.1
-  # TEST/PROD deploys are held behind ENABLE_OPENSHIFT_DEPLOY until the code
-  # is ready for those environments; set the repo variable to "true" to open
-  # the pipeline. PR sandbox deploys (pr-open.yml) are not gated.
+  # TEST deploys run on every merge and fail visibly if misconfigured.
   deploy-test:
     name: TEST Deploys (${{ needs.init.outputs.pr }})
-    if: ${{ vars.ENABLE_OPENSHIFT_DEPLOY == 'true' }}
     needs: [init]
     uses: ./.github/workflows/reusable-deploy.yml
     secrets: inherit
@@ -51,60 +48,63 @@ jobs:
     with:
       target: test
 
-  deploy-prod:
-    name: PROD Deploys (${{ needs.init.outputs.pr }})
-    if: ${{ vars.ENABLE_OPENSHIFT_DEPLOY == 'true' }}
-    needs: [tests, init]
-    uses: ./.github/workflows/reusable-deploy.yml
-    secrets: inherit
-    with:
-      environment: prod
-      target: prod
-      tag: ${{ needs.init.outputs.pr }}
-
-  # Sync Sysdig email alerts for PROD. No-ops cleanly if SYSDIG_API_TOKEN is
-  # unset or monitoring/alerts/ is empty — adoption is gradual. Alert
-  # templates live in monitoring/alerts/ in this repo; add or remove files
-  # there to customize the alert set.
-  monitor-prod:
-    name: Sysdig Monitor (PROD)
-    if: ${{ vars.ENABLE_OPENSHIFT_DEPLOY == 'true' }}
-    needs: [deploy-prod]
-    runs-on: ubuntu-24.04
-    environment: prod
-    permissions:
-      contents: read
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v7
-      - uses: bcgov/actions/sysdig-monitor@4ad61a784f1c17765b03d8d6de9737c1d3f4c0f2 # v0.5.0
-        with:
-          sysdig_api_token: ${{ secrets.SYSDIG_API_TOKEN }}
-          oc_namespace: ${{ secrets.oc_namespace }}
-          app: ${{ github.event.repository.name }}
-
-  promote:
-    name: Promote Images
-    if: ${{ vars.ENABLE_OPENSHIFT_DEPLOY == 'true' }}
-    needs: [deploy-prod, init]
-    runs-on: ubuntu-slim
-    permissions:
-      packages: write
-    strategy:
-      matrix:
-        package: [backend, frontend]
-    timeout-minutes: 1
-    steps:
-      - uses: shrink/actions-docker-registry-tag@e6aaef25c595b6e0edd18bf4c7dbfea3abd43299 # v5
-        with:
-          registry: ghcr.io
-          repository: ${{ github.repository }}/${{ matrix.package }}
-          target: ${{ needs.init.outputs.pr }}
-          tags: prod
+  # ── PROD pipeline: commented out until the prod environment is ready ──
+  # It still lacks prod-scoped ORACLEDB_* secrets and would silently fall
+  # back to the repo-level TEST database values. Once those are set, restore
+  # the jobs below and add deploy-prod + promote back to the results job's
+  # `needs` list.
+  #
+  # deploy-prod:
+  #   name: PROD Deploys (${{ needs.init.outputs.pr }})
+  #   needs: [tests, init]
+  #   uses: ./.github/workflows/reusable-deploy.yml
+  #   secrets: inherit
+  #   with:
+  #     environment: prod
+  #     target: prod
+  #     tag: ${{ needs.init.outputs.pr }}
+  #
+  # # Sync Sysdig email alerts for PROD. No-ops cleanly if SYSDIG_API_TOKEN is
+  # # unset or monitoring/alerts/ is empty — adoption is gradual. Alert
+  # # templates live in monitoring/alerts/ in this repo; add or remove files
+  # # there to customize the alert set.
+  # monitor-prod:
+  #   name: Sysdig Monitor (PROD)
+  #   needs: [deploy-prod]
+  #   runs-on: ubuntu-24.04
+  #   environment: prod
+  #   permissions:
+  #     contents: read
+  #   timeout-minutes: 5
+  #   steps:
+  #     - uses: actions/checkout@v7
+  #     - uses: bcgov/actions/sysdig-monitor@4ad61a784f1c17765b03d8d6de9737c1d3f4c0f2 # v0.5.0
+  #       with:
+  #         sysdig_api_token: ${{ secrets.SYSDIG_API_TOKEN }}
+  #         oc_namespace: ${{ secrets.oc_namespace }}
+  #         app: ${{ github.event.repository.name }}
+  #
+  # promote:
+  #   name: Promote Images
+  #   needs: [deploy-prod, init]
+  #   runs-on: ubuntu-slim
+  #   permissions:
+  #     packages: write
+  #   strategy:
+  #     matrix:
+  #       package: [backend, frontend]
+  #   timeout-minutes: 1
+  #   steps:
+  #     - uses: shrink/actions-docker-registry-tag@e6aaef25c595b6e0edd18bf4c7dbfea3abd43299 # v5
+  #       with:
+  #         registry: ghcr.io
+  #         repository: ${{ github.repository }}/${{ matrix.package }}
+  #         target: ${{ needs.init.outputs.pr }}
+  #         tags: prod
 
   results:
     name: Merge Results
-    needs: [init, deploy-test, tests, deploy-prod, promote]
+    needs: [init, deploy-test, tests]
     if: always()
     runs-on: ubuntu-slim
     timeout-minutes: 1

.github/workflows/reusable-deploy.yml

@@ -45,7 +45,10 @@ jobs:
     env:
       DB_USER: ${{ secrets.ORACLEDB_USERNAME }}
       DB_PASS: ${{ secrets.ORACLEDB_PASSWORD }}
+      DB_HOST: ${{ secrets.ORACLEDB_HOST }}
+      DB_SERVICENAME: ${{ secrets.ORACLEDB_SERVICENAME }}
       COGNITO_POOL: ${{ secrets.USER_POOLS_ID }}
+      COGNITO_CLIENT: ${{ secrets.USER_POOLS_WEB_CLIENT_ID }}
     steps:
       - uses: bcgov/action-deployer-openshift@27a85b7b157bfc9c3c9bf0aca53bcd288d4d2506 # v4.2.1
         id: deploy
@@ -55,12 +58,25 @@ jobs:
           oc_server: ${{ vars.OC_SERVER }}
           oc_token: ${{ secrets.OC_TOKEN }}
           overwrite: true
+          # Cognito redirect fallbacks must match FAM's registration EXACTLY
+          # (Cognito string-matches; see FAM repo oidc_clients_ilcr.tf):
+          # sign-in has NO trailing slash, and dev PR hosts (nr-ilcr-0..49)
+          # register only the plain <app>/logout. test/prod also register the
+          # chain-prefixed logout — set env-scoped COGNITO_REDIRECT_SIGN_OUT
+          # there for full federated (SiteMinder/Keycloak) logout.
           parameters:
             -p ZONE='${{ inputs.target }}'
             -p NAME='${{ github.event.repository.name }}'
             -p SPRING_DATASOURCE_USERNAME="$DB_USER"
             -p SPRING_DATASOURCE_PASSWORD="$DB_PASS"
+            -p ORACLEDB_HOST="$DB_HOST"
+            -p ORACLEDB_SERVICENAME="$DB_SERVICENAME"
             -p COGNITO_USER_POOL="$COGNITO_POOL"
+            -p COGNITO_CLIENT_ID="$COGNITO_CLIENT"
+            -p COGNITO_DOMAIN='${{ vars.COGNITO_DOMAIN || 'lza-prod-fam-user-pool-domain.auth.ca-central-1.amazoncognito.com' }}'
+            -p COGNITO_OAUTH_SCOPES='${{ vars.COGNITO_OAUTH_SCOPES || 'openid' }}'
+            -p COGNITO_REDIRECT_SIGN_IN='${{ vars.COGNITO_REDIRECT_SIGN_IN || format('https://{0}-{1}.apps.gold.devops.gov.bc.ca', github.event.repository.name, inputs.target) }}'
+            -p COGNITO_REDIRECT_SIGN_OUT='${{ vars.COGNITO_REDIRECT_SIGN_OUT || format('https://{0}-{1}.apps.gold.devops.gov.bc.ca/logout', github.event.repository.name, inputs.target) }}'
           triggers: ${{ inputs.triggers }}
 
   deploy:
@@ -75,20 +91,18 @@ jobs:
         include:
           - name: backend
             file: backend/openshift.deploy.yml
-            # Security and datasource flags come from GitHub vars, resolved
-            # environment-first, and FAIL CLOSED: auth is enforced unless a
-            # var explicitly opts a scope out. The backend refuses to start
-            # with security off and the datasource on (DeployedSecurityGuard),
-            # so a mock-auth deployment requires disabling both — mock auth
-            # never fronts real data.
+            # Oracle host/servicename are environment-scoped SECRETS, passed
+            # through the init job above (env-scoped secrets don't resolve in
+            # this matrix — GitHub evaluates it before the environment
+            # attaches) into the backend Secret. ILCR_SECURITY_ENABLED is
+            # hardcoded "true" in the backend template — deployed pods always
+            # enforce auth.
             parameters: -p IMAGE_TAG="${{ inputs.tag }}"
-              -p ORACLEDB_HOST="${{ vars.ORACLEDB_HOST }}"
-              -p ORACLEDB_SERVICENAME="${{ vars.ORACLEDB_SERVICENAME }}"
-              -p ILCR_SECURITY_ENABLED="${{ vars.ILCR_SECURITY_ENABLED || 'true' }}"
               -p ILCR_DATASOURCE_ENABLED="${{ vars.ILCR_DATASOURCE_ENABLED || 'true' }}"
           - name: frontend
             file: frontend/openshift.deploy.yml
             parameters: -p IMAGE_TAG="${{ inputs.tag }}"
+              -p COGNITO_DOMAIN="${{ vars.COGNITO_DOMAIN || 'lza-prod-fam-user-pool-domain.auth.ca-central-1.amazoncognito.com' }}"
     outputs:
       triggered: ${{ steps.deploy.outputs.triggered }}
     steps:

.github/workflows/reusable-tests.yml

@@ -68,6 +68,13 @@ jobs:
     # raw-Playwright frontend/e2e). Only the DATA-INDEPENDENT `@smoke` project runs here: it aborts /api,
     # so it needs neither the seeded delivery Oracle nor the pinned fixtures the deployed env lacks. The
     # full data-backed suite (setup + chromium — SCH1/SEC) is a LOCAL/manual gate; see frontend/e2e/README.md.
+    #
+    # The smoke runs against a LOCAL Vite server on localhost, NOT the deployed PR URL. Since Story 1.2
+    # turned auth on, mock auth is (by design) disabled off-localhost — `isMockAuth()` double-gates on
+    # `isLocalHost()` (src/env.ts) — so an anonymous visit to a deployed host correctly bounces to the
+    # FAM/Cognito Hosted UI and never renders the shell. On localhost with the repo-default
+    # `{ mockUser: true }` config the shell renders client-side, keeping this smoke auth- AND
+    # backend-independent (the scenarios still abort every /api call).
     defaults:
       run:
         working-directory: frontend/e2e
@@ -82,17 +89,28 @@ jobs:
           node-version: 24
           cache: "npm"
           cache-dependency-path: frontend/e2e/package-lock.json
-      - name: Install dependencies
+      - name: Install e2e dependencies
         run: |
           npm ci
           npx playwright install --with-deps chromium
 
-      - name: Run smoke (data-independent)
+      - name: Install frontend
+        working-directory: frontend
+        run: npm ci
+
+      - name: Run smoke (data-independent, localhost mock auth)
+        working-directory: frontend
         env:
-          E2E_BASE_URL: https://${{ env.PREFIX }}.${{ env.DOMAIN }}/
           CI: "true"
         run: |
-          npm test -- --project=smoke --reporter=html
+          # Serve the app on localhost so mock auth engages (isMockAuth() requires localhost); the
+          # @smoke scenarios abort /api, so no backend is needed. No E2E_BASE_URL → the Playwright
+          # config defaults baseURL to http://localhost:3000.
+          npm run dev -- --port 3000 &
+          DEV_PID=$!
+          npx --yes wait-on -t 120000 http://localhost:3000
+          ( cd e2e && npm test -- --project=smoke --reporter=html )
+          kill "$DEV_PID" 2>/dev/null || true
 
       - uses: actions/upload-artifact@v7
         if: (! cancelled())

README.md

@@ -86,6 +86,70 @@ mvn spring-boot:run
 
 Do not commit real database passwords. Put local values in `.env`; the file is git-ignored.
 
+### Corporate SSL/TLS Intercept & Certificate Issues (e.g., Zscaler / PKIX) — Local Workaround
+
+*Note: This is a specific workaround for developers behind a corporate SSL-decryption/packet-inspection gateway (such as Zscaler) and is **not** required for all developers (e.g., if you are on a direct internet connection).*
+
+If your corporate network performs SSL decryption/packet-inspection, Maven inside the isolated Docker container may fail to connect to Maven Central (all dependencies, including JasperReports 7, resolve from Central — the build declares no custom `<repositories>`) with a `PKIX path building failed` error.
+
+The recommended, zero-import workaround is to leverage your Windows host's trusted certificate store by caching the dependencies on Windows once, and mounting your host's `.m2` repository into the container:
+
+1. **Seed the cache on Windows**:
+   Run this once inside your Windows terminal to download and cache the libraries (which automatically trusts your corporate certificate):
+   ```powershell
+   cd backend
+   mvn clean install -DskipTests
+   ```
+2. **Mount the cache in your local environment**:
+   Set the `M2_HOME` variable inside your local, ignored `.env` file pointing to your host's `.m2` directory:
+   ```properties
+   M2_HOME=/mnt/c/Users/<your-username>/.m2
+   ```
+   Docker Compose will automatically detect this variable and mount your local Windows Maven cache into the container's `/root/.m2` path, bypassing the certificate handshake issues completely!
+
+### Authentication (FAM/Cognito) — local testing
+
+The SPA has two auth modes, selected at runtime by `public/amplify-config.js` (loaded before the
+bundle). The repo default is **mock**; deployed environments mount a per-env ConfigMap over it. See
+`src/context/auth/` (the `AuthProvider` seam) and `src/config/auth/amplify-initializer.ts`.
+
+**Mock mode (default — no Cognito).** `npm run dev` with the backend running (security off by
+default) signs you in automatically. Use the **"Mock user"** dropdown in the header to switch
+`ILCR_ADMIN` ↔ `ILCR_SUBMITTER` — it switches both the nav/route-guards **and** the backend mock
+principal (via the `X-Mock-Groups` header), so it exercises role gating end to end. This is the
+fastest path for manual testing.
+
+**Real FAM/Cognito login (Hosted UI).**
+
+1. Frontend — copy the example config over the default (do **not** commit it; the repo default must
+   stay `mockUser: true`):
+   ```bash
+   cd frontend
+   cp amplify-config.local.example.js public/amplify-config.js
+   npm run dev            # then hard-refresh the browser (public/ files load at page load)
+   ```
+2. Backend — run with security on so `/api/v1/me` validates the real ID token:
+   ```bash
+   cd backend
+   ILCR_SECURITY_ENABLED=true COGNITO_REGION=ca-central-1 \
+   COGNITO_USER_POOL=ca-central-1_UpeAqsYt4 COGNITO_CLIENT_ID=352pis0ark86dam7ht1jlp9uj5 \
+   SPRING_PROFILES_ACTIVE=oracle,openshift ./mvnw spring-boot:run
+   ```
+3. Open `http://localhost:3000` → FAM Hosted UI → sign in (IDIR/BCeID) → back to the app with your
+   real role. Confirm the exact `cognitoDomain` with the FAM admin if the Hosted UI does not load.
+
+**Dev-only testing aids (real session, local dev only — `import.meta.env.DEV`, tree-shaken from every
+deployed build):**
+
+- **"View as (dev)"** header dropdown — overrides the role the SPA uses (nav + route guards) so you
+  can test both roles without re-logging-in. It is **frontend-only**: the backend still enforces your
+  real token, so admin APIs still `403` if your account isn't really in that group.
+- A **"viewing as" warning banner** appears whenever an override is active, naming your real role.
+- A **Sign out** button (header, Logout icon) runs the Cognito/loginproxy logout chain on a real
+  session; hidden in mock mode.
+
+When done with real login: `git checkout -- frontend/public/amplify-config.js`.
+
 ## Frontend Shared Conventions
 
 Reusable building blocks and global styles that new schedule/feature pages should adopt rather than
@@ -126,7 +190,7 @@ FAM authentication is tracked separately. The dashboard currently displays the s
 
 ## OpenShift Status
 
-OpenShift Gold is the destination environment, but the Gold project is not required for this local-dev scaffold. Pull requests always deploy a sandbox environment (zone = PR number mod 50). Merges to `main` deploy to TEST and then, if tests pass, to PROD in the same workflow run — but only while the `ENABLE_OPENSHIFT_DEPLOY` repository variable is `true`; it is left unset until the code is ready for those environments.
+OpenShift Gold is the destination environment, but the Gold project is not required for this local-dev scaffold. Pull requests always deploy a sandbox environment (zone = PR number mod 50). Merges to `main` deploy to TEST on every merge. The PROD pipeline (deploy, Sysdig monitor, image promotion) is commented out in `.github/workflows/merge.yml` until the `prod` GitHub environment has its own `ORACLEDB_*` secrets; restore those jobs to open PROD.
 
 Deployed pods fail closed on authentication: JWT enforcement (`ILCR_SECURITY_ENABLED`) and the Oracle datasource (`ILCR_DATASOURCE_ENABLED`) both default to `true` and can be overridden per scope with GitHub variables (environment-first, then repository). The backend refuses to start a deployed pod with security off while the datasource is on (`DeployedSecurityGuard`), so mock auth can never serve real data from a public route; setting both variables to `false` yields a data-less mock-auth smoke deployment.