Compare revisions

_docs/

.env

.DS_Store

# Ignore certificates

azure-sp.pem

stages:

  - build

  - test

  - staging

  - smoketest

  - deploy

variables:

  ## (Optional) More verbose output from pipeline. Enabling it might reveal secrets.

  #CI_DEBUG_TRACE: "true"

include:

  - template: Jobs/SAST.gitlab-ci.yml

## Use buildkit to build the container.

## Buildkit: https://github.com/moby/buildkit

          --opt build-arg:CI_COMMIT_SHA=${CI_COMMIT_SHA} \

          --output type=image,name=${DOCKER_IMAGE_NAME}:${DOCKER_TAG},push=true

sast:

    ## Static Application Security Test

    ## You can override the included template(s) by including variable overrides

    ## SAST customization:

    ##   https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings

    stage: test

## Run the tests. If any of the tests fails, pipeline is rejected.

test:

  ## Optional: include stage and environment name

  services:

    - name: mongo:4.2  # update to reflect same version used on production

      alias: mongo

  script:

      - pip install --disable-pip-version-check -e /app[test]

      ## Run tests with coverage reporting

      - coverage run -m pytest

      ## Run basic reporting for badge

      - coverage report

      ## Generate detailed report for gitlab annotations.

      - coverage xml -o coverage.xml

  coverage: '/(?i)total.*? (100(?:\.0+)?\%|[1-9]?\d(?:\.\d+)?\%)$/'

  artifacts:

    reports:

      coverage_report:

        coverage_format: cobertura

        path: coverage.xml

## Job to setup new staging job.

deploy to staging:

    stage: staging

    ## Only run this stage when main branch receives changes.

    only:

        - main

    ## Use microsoft provided azure cli image, that contains az cli.

    image: mcr.microsoft.com/azure-cli

    ## Setup the environment variables. The can be accessed through the gitlab 

    ## Deployments -> Environments. Generates url based on the app and branch name.

    environment:

        name: $CI_JOB_STAGE

        url: https://${AZURE_APP_NAME}-${CI_ENVIRONMENT_SLUG}.azurewebsites.net

    before_script:

        ## Make sanity check that gitlab variables stage is done.

        - test -z "${AZURE_SP_NAME}" && (echo "Missing required variable AZURE_SP_NAME. See 'Staging.md'"; exit 1)

        - test -f "${AZURE_SP_CERT}" || ( echo "AZURE_SP_CERT (${AZURE_SP_CERT}) file is missing!"; exit 1)

        - test -z "${AZURE_APP_NAME}" && (echo "Missing required variable AZURE_APP_NAME. See 'Staging.md'"; exit 1)

        - test -z "${AZURE_RESOURCE_GROUP}" && (echo "Missing required variable DOCKER_AUTH_CONFIG. See 'Staging.md'"; exit 1)        

        ## Login into azure

        - az login --service-principal -u "${AZURE_SP_NAME}" -p "${AZURE_SP_CERT}" --tenant "jyu.onmicrosoft.com"

    script:

        ## Create staging slot and copy settings from production

        - |

          az webapp deployment slot create -n "$AZURE_APP_NAME" -g "$AZURE_RESOURCE_GROUP" \

            --slot "$CI_ENVIRONMENT_SLUG" --configuration-source "$AZURE_APP_NAME"

        ## TODO: Create a snapshot of database, and use it.

        ## If you need to change settings see: https://docs.microsoft.com/en-us/cli/azure/webapp/config/appsettings

        ## Change container tag to reflect branch we're running on

        - |

          az webapp config container set -n "$AZURE_APP_NAME" -g "$AZURE_RESOURCE_GROUP" \

            --docker-custom-image-name "${DOCKER_IMAGE_NAME}:${DOCKER_TAG}" -s "$CI_ENVIRONMENT_SLUG"

        ## In case slot already existed, restart the slot

        - az webapp restart -n "$AZURE_APP_NAME" -g "$AZURE_RESOURCE_GROUP" -s "$CI_ENVIRONMENT_SLUG"

        ## Restart is not immediate, it takes a sec or two, depending on container changes.

        - sleep 20

        ## Store server info as artifact for prosperity

        - curl "$CI_ENVIRONMENT_URL/server-info" -o server-info.json

    artifacts:

        paths:

            - server-info.json

## Run smoketest to check that staging app is responding as expected.

staging smoketest:

    stage: smoketest

    image: ${DOCKER_IMAGE_NAME}:${DOCKER_TAG}

    environment:

        name: staging

        url: https://${AZURE_APP_NAME}-${CI_ENVIRONMENT_SLUG}.azurewebsites.net

    only:

        - main

    script:

        - pip install --disable-pip-version-check -e .[test]

      - pytest -v

      - echo "Test run succesfully!"

        ## Environment url can be inherited from CI_ENVIROMNENT_URL, which is one defined

        ## in the `environment.url:`. Using it here explicitly.

        - echo "Testing againsta deployment address ${CI_ENVIROMNENT_URL}"

        - pytest -v --environment-url="${CI_ENVIROMNENT_URL}" tests/test_smoke.py

## Deploy latest image to the production

deploy:

## Push latest image into registry with the `latest` tag.

docker tag latest:

  stage: deploy

  environment: production

  environment:

    name: production

  image: docker:20.10.23

  only:

    - main

    - mkdir -p ${HOME}/.docker && echo "${DOCKER_AUTH_CONFIG}" > "${HOME}/.docker/config.json"

    ## Add the `latest` tag to the image we have build.

    - docker buildx imagetools create ${DOCKER_IMAGE_NAME}:${DOCKER_TAG} --tag ${DOCKER_IMAGE_NAME}:latest

## Swap the production and staging slots around.

staging to production:

    stage: deploy

    ## Only run this stage when main branch receives changes.

    only:

        - main

    ## Use microsoft provided azure cli image, that contains az cli.

    image: mcr.microsoft.com/azure-cli

    environment:

        name: production

        url: https://${AZURE_APP_NAME}.azurewebsites.net/

    before_script:

        ## Login into azure

        - az login --service-principal -u "${AZURE_SP_NAME}" -p "${AZURE_SP_CERT}" --tenant "jyu.onmicrosoft.com"

    script:

        ## Swap production and staging slots.

        - az webapp deployment slot swap -g "$AZURE_RESOURCE_GROUP" -n "$AZURE_APP_NAME" -s staging --target-slot production

## Summary

Briefly describe the issue and its impact on the project concisely.

## Steps to Reproduce

1. List the steps to reproduce the issue

2. Provide any relevant details such as browser, device, version, etc.

## Expected Outcome

What should happen after following the steps?

## Actual Outcome

What actually happens after following the steps?

## Additional Context

- Include any relevant screenshots, logs, or code snippets

- Indicate if the issue occurs only in certain conditions, environments, or browsers

## Possible fixes

If you are familiar with the issue and in a position to help, it would be appreciated!

/label ~bug

## Declare default flask app as environment variable

## https://flask.palletsprojects.com/en/2.2.x/cli/

ARG FLASK_APP=tjts5901.app

ARG FLASK_APP=tjts5901.app:flask_app

ENV FLASK_APP=${FLASK_APP}

## Setup the default port for flask to listen on

## Run Flask app when container started, and listen all the interfaces

## Note: CMD doesn't run command in build, but defines an starting command

## when container is started (or arguments for ENTRYPOINT).

CMD flask run --host=0.0.0.0 # --port=${FLASK_RUN_PORT} --app=${FLASK_APP}

#CMD flask run --host=0.0.0.0 # --port=${FLASK_RUN_PORT} --app=${FLASK_APP}

CMD gunicorn --bind "0.0.0.0:${FLASK_RUN_PORT}" "${FLASK_APP}"

## Examples for other commands:

## Run nothing, so that the container can be used as a base image

#CMD ["bash", "-c", "sleep infinity"]

## Run Flask app using Gunicorn, which unlike Flask, doesn't complain about being development thing.

#CMD gunicorn --bind "0.0.0.0:${PORT}"" tjts5901.app:app

## Install requirements using pip. This is done before copying the app, so that

## requirements layer is cached. This way, if app code changes, only app code is

## Copy app to WORKDIR folder

COPY . .

## Compile translations before installing app. This is done to make sure that

## translations are compiled before app is installed.

RUN pybabel compile -f -d src/tjts5901/translations/

## Install self as editable (`-e`) module. In a long run it would be recommeded

## to remove `COPY` and only install app as a package.

RUN pip --disable-pip-version-check install -v -e .

ARG CI_COMMIT_SHA

ENV CI_COMMIT_SHA=${CI_COMMIT_SHA}

## Download the currency exchange rates from European Central Bank

RUN flask update-currency-rates

## Save build date and time

RUN echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> /app/.env

```

Please see the `docs/tjts5901` folder for more complete documentation.

## Reporting issues and bugs

To report bugs, please use [the project "issues" form](https://gitlab.jyu.fi/startuplab/courses/tjts5901-continuous-software-engineering/TJTS5901-K23_template/-/issues/new?issuable_template=Default)

[python: **.py]

[jinja2: **/templates/**.html]

      fallback_to_build_date: true

  - macros:

      module_name: macros

      # Change to something else

      j2_variable_start_string: "{j2{"

      j2_variable_end_string: "}j2}"

extra:

  social:

# Setup sentry environment to separate development issues from production. This variable name is

# maybe set by gitlab pipeline. <https://docs.gitlab.com/ee/ci/environments/>

CI_ENVIRONMENT_NAME=development

# Setup CI environment url to point on localhost for testing purposes.

CI_ENVIRONMENT_URL=http://localhost:5001

test = [

  "pytest",

  "coverage",

  "coverage[toml]",

  "requests",

  "faker",

]

docs = [

  "mkdocs",

testpaths = [

    "tests",

]

filterwarnings = [

  ## Silence json encoder warnings for Flask >=2.3

  # "ignore::DeprecationWarning:mongoengine.connection",

  # "ignore::DeprecationWarning:flask_mongoengine.json",

  # "ignore::DeprecationWarning:flask.json.provider",

]

[tool.coverage.run]

branch = true

source_pkgs = [

    "tjts5901",

]

# Framework and libraries

flask==2.2.2

python-dotenv

flask-login

flask-babel

flask-mongoengine==1.0

CurrencyConverter

Flask-APScheduler

# Git hooks

pre-commit

sentry-sdk[pymongo]

# More production-ready web server

#gunicorn

gunicorn

    request,

)

from flask_babel import _

from .utils import get_version

from .db import init_db

from .i18n import init_babel

logger = logging.getLogger(__name__)

    flask_app.config.from_mapping(

        SECRET_KEY='dev',

        BRAND="Hill Valley DMC dealership",

        BRAND=_("Hill Valley DMC dealership"),

    )

    # load the instance config, if it exists, when not testing

    except OSError:

        pass

    # Initialize the Flask-Babel extension.

    init_babel(flask_app)

    # Initialize the database connection.

    init_db(flask_app)

    # Initialize the scheduler.

    from .scheduler import init_scheduler  # pylint: disable=import-outside-toplevel

    init_scheduler(flask_app)

    @flask_app.route('/debug-sentry')

    def trigger_error():

        division_by_zero = 1 / 0

    # a simple page that says hello

    @flask_app.route('/hello')

    def hello():

        return 'Hello, World!'

        return _('Hello, World!')

    from . import auth

    flask_app.register_blueprint(auth.bp)

    from .auth import init_auth

    init_auth(flask_app)

    from .notification import init_notification

    init_notification(flask_app)

    from .currency import init_currency

    init_currency(flask_app)

    from . import items

    flask_app.register_blueprint(items.bp)

    flask_app.register_blueprint(items.api)

    flask_app.add_url_rule('/', endpoint='index')

    return flask_app

# Create the Flask application.

flask_app = create_app()

@flask_app.route("/server-info")

def server_info() -> Response:

    """

from datetime import datetime

import functools

import logging

from flask import (

    Blueprint, flash, g, redirect, render_template, request, session, url_for

    Blueprint, flash, redirect, render_template, request, session, url_for, abort

)

from flask_login import (

    LoginManager,

    login_user,

    logout_user,

    login_required,

    current_user,

)

from flask_babel import _

from babel.dates import get_timezone

from werkzeug.security import check_password_hash, generate_password_hash

from sentry_sdk import set_user

from .models import User

from .models import AccessToken, Bid, User, Item

from mongoengine import DoesNotExist

from mongoengine.queryset.visitor import Q

bp = Blueprint('auth', __name__, url_prefix='/auth')

logger = logging.getLogger(__name__)

@bp.before_app_request

def load_logged_in_user():

def init_auth(app):

    """

    If a user id is stored in the session, load the user object from

    Integrate authentication into the application.

    """

    app.register_blueprint(bp)

    user_id = session.get('user_id')

    login_manager = LoginManager()

    login_manager.login_view = 'auth.login'

    login_manager.user_loader(load_logged_in_user)

    if user_id is None:

        g.user = None

        set_user(None)

    app.config['AUTH_HEADER_NAME'] = 'Authorization'

    login_manager.request_loader(load_user_from_request)

    else:

        g.user = User.objects.get(id=user_id)

        set_user({"id": str(g.user.id), "email": g.user.email})

    login_manager.init_app(app)

    logger.debug("Initialized authentication")

def load_user_from_request(request):

    """

    Load a user from the request.

    This function is used by Flask-Login to load a user from the request.

    """

    api_key = request.headers.get("Authorization")

    if api_key:

        api_key = api_key.replace("Bearer ", "", 1)

        try:

            token = AccessToken.objects.get(token=api_key)

            if token.expires and token.expires < datetime.utcnow():

                logger.warning("Token expired: %s", api_key)

                return None

            # User is authenticated

            token.last_used_at = datetime.utcnow()

            token.save()

            logger.debug("User authenticated via token: %r", token.user.email, extra={

                "user": token.user.email,

                "user_id": str(token.user.id),

                "token": token.token,

            })

            return token.user

        except DoesNotExist:

            logger.error("Token not found: %s", api_key)

    return None

def load_logged_in_user(user_id):

    """

    Load a user from the database, given the user's id.

    """

    try:

        user = User.objects.get(id=user_id)

        set_user({"id": str(user.id), "email": user.email})

    except DoesNotExist:

        logger.error("User not found: %s", user_id)

        return None

    return user

def get_user_by_email(email: str) -> User:

    """

    Get a user from the database, given the user's email.

    If the email is 'me', then the current user is returned.

    :param email: The email of the user to get.

    """

    if email is None:

        abort(404)

def login_required(view):

    @functools.wraps(view)

    def wrapped_view(**kwargs):

        if g.user is None:

            return redirect(url_for('auth.login'))

    if email == "me" and current_user.is_authenticated:

        email = current_user.email

        return view(**kwargs)

    try:

        user = User.objects.get_or_404(email=email)

    except DoesNotExist:

        logger.error("User not found: %s", email)

        abort(404)

    return wrapped_view

    return user

@bp.route('/register', methods=('GET', 'POST'))

        elif not terms:

            error = 'You must agree to the terms.'

        timezone = None

        try:

            if user_tz := request.form.get('timezone', None):

                timezone = get_timezone(user_tz).zone

        except Exception as exc:

            logger.debug("Error getting timezone from user data: %s", exc)

            timezone = None

        if error is None:

            try:

                user = User(

                    email=email,

                    password=generate_password_hash(password)

                    password=generate_password_hash(password),

                    timezone=timezone,

                )

                user.save()

                flash("You have been registered. Please log in.")

        email = request.form['email']

        password = request.form['password']

        user = None

        error = None

        try:

            user = User.objects.get(email=email)

            error = 'Incorrect password.'

        if error is None:

            session.clear()

            session['user_id'] = str(user['id'])

            remember_me = bool(request.form.get("remember-me", False))

            if login_user(user, remember=remember_me):

                flash(f"Hello {email}, You have been logged in.")

            return redirect(url_for('items.index'))

        print("Error logging in:", error)

                next = request.args.get('next')

                # Better check that the user actually clicked on a relative link

                # or else they could redirect you to a malicious website!

                if next is None or not next.startswith('/'):

                    next = url_for('index')

                return redirect(next)

            else:

                error = "Error logging in."

        logger.info("Error logging user in: %r: Error: %s", email, error)

        flash(error)

    return render_template('auth/login.html')

@bp.route('/logout')

@login_required

def logout():

    session.clear()

    """

    Log out the current user.

    Also removes the "remember me" cookie.

    """

    logout_user()

    flash("You have been logged out.")

    return redirect(url_for('index'))

@bp.route('/profile', defaults={'email': 'me'})

@bp.route('/profile/<email>')

@login_required

def profile(email):

    """

    Show the user's profile page for the given email.

    If the email is 'me', then the current user's profile is shown.

    """

    user: User = get_user_by_email(email)