Updates

TODO: Still no access to routes on staging... hmmm...

.drone.yml

@@ -3,30 +3,26 @@ type: docker
 name: Test Pipeline
 
 workspace:
-  path: /drone/grow
+  path: /drone/auth
 
 steps:
 - name: yarn install
   image: node:latest
   commands:
   - yarn install
-
 - name: Code Style Checks
   image: node:latest
   commands:
   - yarn prettier
-
 - name: Lint
   image: node:latest
   commands:
   - yarn lint
-
 - name: Unit Tests
   image: node:latest
   commands:
   - yarn test
-
+- name: Send Test Status Notification
-- name: Send Status Notification
   image: plugins/webhook
   settings:
     urls: https://lab.mifi.dev/hooks/9p65zpagctgkmndo8nwwm4199r
@@ -41,34 +37,14 @@ steps:
     status:
       - success
       - failure
-
-trigger:
-  event:
-  - push
-
----
-kind: pipeline
-type: docker
-name: Build Pipeline
-
-workspace:
-  path: /drone/grow
-
-steps:
-- name: yarn install
-  image: node:latest
-  commands:
-  - yarn install
-
 - name: Build
   image: node:latest
   commands:
   - yarn build
-
+- name: Send Build Status Notifications
-- name: Send Status Notifications
   image: plugins/webhook
   settings:
-    urls: https://lab.mifi.dev/hooks/ccw34hdf7tgbjmzp96nptn938r
+    urls: https://lab.mifi.dev/hooks/9p65zpagctgkmndo8nwwm4199r
     content_type: application/json
     template: |
       {
@@ -81,14 +57,12 @@ steps:
       - success
       - failure
 
-depends_on:
-  - Test Pipeline
-
 trigger:
   branch:
   - main
+  - develop
   event:
-  - push
+  - pull_request
 
 ---
 kind: pipeline
@@ -96,39 +70,23 @@ type: docker
 name: Publish Pipeline
 
 workspace:
-  path: /drone/grow
+  path: /drone/auth
 
 steps:
-- name: Build Service
+- name: Build Package
   image: node:latest
   commands:
-    - cp /drone/grow/package.json ./
+    - yarn install
-    - cp /drone/grow/yarn.lock ./
-    - yarn install --frozen-lockfile
-    - cp -r /drone/grow/* .
     - yarn build
 - name: Publish NPM
-  image: plugins/npm
+  image: node:20-alpine
-  settings:
+  failure: ignore
-    username: mifi
+  commands:
-    registry: git.mifi.dev
+    - yarn publish -t ${DRONE_TAG}
-    token:
-    - from_secret: gitea_token
-- name: Publish Image
-  image: plugins/docker
-  settings:
-    auto_tag: true
-    squash: true
-    repo: git.mifi.dev/mifi/auth
-    registry: git.mifi.dev
-    ssh-agent-key:
-      from_secret: gitea_token
   volumes:
-  - name: dockersock
+  - name: npmrc
-    Path: /var/run/docker.sock
+    path: /drone/auth/.npmrc
-  - name: dockerconfig
+- name: Report NPM Publish Status
-    Path: /.docker/config.json
-- name: Send Status Notifications
   image: plugins/webhook
   settings:
     urls: https://lab.mifi.dev/hooks/ccw34hdf7tgbjmzp96nptn938r
@@ -136,7 +94,35 @@ steps:
     template: |
       {
         "icon_url":"https://emojipedia-us.s3.dualstack.us-west-1.amazonaws.com/thumbs/120/apple/198/freezing-face_1f976.png",
-        "text": "[{{ repo.name }} - New tagged docker image release {{tag}} from # {{ build.number }}] Deploy {{ build.status }} {{#success build.status}}:tada:{{else}}:poop:{{/success}}",
+        "text": "[{{ repo.name }} - New npm package release {{tag}} from # {{ build.number }}] Deploy {{ build.status }} {{#success build.status}}:tada:{{else}}:poop:{{/success}}",
+        "username":"DroneBot"
+      }
+  when:
+    status:
+      - success
+      - failure
+- name: Publish Image
+  image: plugins/docker
+  settings:
+    auto_tag: true
+    repo: git.mifi.dev/mifi/mifi/auth
+    registry: git.mifi.dev
+    debug: true
+    ssh-agent-key:
+      from_secret: reg_token    
+    username: <token>
+    password:
+      from_secret: reg_token
+  secrets: [reg_token]
+- name: Report Image Publish Status
+  image: plugins/webhook
+  settings:
+    urls: https://lab.mifi.dev/hooks/ccw34hdf7tgbjmzp96nptn938r
+    content_type: application/json
+    template: |
+      {
+        "icon_url":"https://emojipedia-us.s3.dualstack.us-west-1.amazonaws.com/thumbs/120/apple/198/freezing-face_1f976.png",
+        "text": "[{{ repo.name }} - New docker image release {{tag}} from # {{ build.number }}] Deploy {{ build.status }} {{#success build.status}}:tada:{{else}}:poop:{{/success}}",
         "username":"DroneBot"
       }
   when:
@@ -145,13 +131,18 @@ steps:
       - failure
 
 volumes:
-- name: dockersock
-  path: /var/run/docker.sock
 - name: dockerconfig
-  path: /volume1/docker/labs/grow-auth/dockerconfig.json
+  host:
+    path: /volume1/docker/dockerconfig.json
+- name: dockersock
+  host:
+    path: /var/run/docker.sock
+- name: npmrc
+  host:
+    path: /volume1/docker/beethoven/labs-auth/.npmrc
 
 depends_on:
-  - Build Pipeline
+  - Test Pipeline
 
 trigger:
   event:
@@ -160,29 +151,33 @@ trigger:
 ---
 kind: pipeline
 type: docker
-name: Deploy Pipeline
+name: Staging Deploy Pipeline
 
 workspace:
-  path: /drone/grow
+  path: /drone/auth
-
-# image_pull_secrets:
-# - from_secret: gitea_token
 
 steps:
 - name: Deploy Container
   image: docker
+  privileged: true
+  environment:
+    CONTAINER_PREFIX: staging
+    HOST: area51.mifi.dev
+    ROUTE_PREFIX: /auth
+    PORT: 9001
   commands:
-    - compose build .
+    - docker compose -f docker-compose.staging-build.yml build --pull --no-cache
-    - compose up --wait
+    - docker compose -f docker-compose.staging-build.yml up --remove-orphans --force-recreate --wait
   volumes:
-  - name: env
+  - name: env-secrets
-    path: /.env
+    path: /drone/auth/staging.env
   - name: dockersock
-    Path: /var/run/docker.sock
+    path: /var/run/docker.sock
   - name: dockerconfig
-    Path: /.docker/config.json
+    path: /drone/auth/.docker/config.json
 - name: Send Status Notifications
   image: plugins/webhook
+  privileged: true
   settings:
     urls: https://lab.mifi.dev/hooks/ccw34hdf7tgbjmzp96nptn938r
     content_type: application/json
@@ -198,16 +193,90 @@ steps:
       - failure
 
 volumes:
-- name: env
-  path: /volume1/docker/labs/grow-auth/.env
-- name: dockersock
-  path: /var/run/docker.sock
 - name: dockerconfig
-  path: /volume1/docker/labs/grow-auth/dockerconfig.json
+  host:
+    path: /volume1/docker/dockerconfig.json
+- name: dockersock
+  host:
+    path: /var/run/docker.sock
+- name: env-secrets
+  host:
+    path: /volume1/docker/beethoven/labs-auth/staging.env
 
 depends_on:
-  - Build Pipeline
+  - Test Pipeline
+
+trigger:
+  branch:
+  - develop
+  event:
+  - push
+
+---
+kind: pipeline
+type: docker
+name: Production Deploy Pipeline
+
+workspace:
+  path: /drone/auth
+
+clone:
+  disable: true
+
+steps:
+- name: Deploy Container
+  image: docker
+  privileged: true
+  environment:
+    CONTAINER_PREFIX: staging
+    HOST: area51.mifi.dev
+    ROUTE_PREFIX: /auth
+    PORT: 9001
+  commands:
+    - docker compose -f docker-compose.production-build.yml pull
+    - docker compose -f docker-compose.production-build.yml build --no-cache
+    - docker compose -f docker-compose.production-build.yml rm --stop
+    - docker compose -f docker-compose.production-build.yml up --wait
+  volumes:
+  - name: env-secrets
+    path: /drone/auth/production.env
+  - name: dockersock
+    path: /var/run/docker.sock
+  - name: dockerconfig
+    path: /drone/auth/.docker/config.json
+- name: Send Status Notifications
+  image: plugins/webhook
+  privileged: true
+  settings:
+    urls: https://lab.mifi.dev/hooks/ccw34hdf7tgbjmzp96nptn938r
+    content_type: application/json
+    template: |
+      {
+        "icon_url":"https://emojipedia-us.s3.dualstack.us-west-1.amazonaws.com/thumbs/120/apple/198/freezing-face_1f976.png",
+        "text": "[{{ repo.name }} - Build # {{ build.number }}] Deploy {{ build.status }} {{#success build.status}}:tada:{{else}}:poop:{{/success}}",
+        "username":"DroneBot"
+      }
+  when:
+    status:
+      - success
+      - failure
+
+volumes:
+- name: dockerconfig
+  host:
+    path: /volume1/docker/dockerconfig.json
+- name: dockersock
+  host:
+    path: /var/run/docker.sock
+- name: env-secrets
+  host:
+    path: /volume1/docker/beethoven/labs-auth/staging.env
+
+depends_on:
+  - Test Pipeline
 
 trigger:
   event:
-  - tag
+  - promote
+  target:
+  - production

.env.dev

@@ -0,0 +1,31 @@
+HOST=localhost
+PORT=9001
+
+ROUTE_PREFIX=/auth
+
+LOGIN_ROUTE=/login
+RESET_ROUTE=/reset
+
+# DB_ADMIN_USERNAME=root
+# DB_ADMIN_PASSWORD=password
+DB_USERNAME=user
+DB_PASSWORD=password
+DB_NAME=auth
+
+MONGO_INITDB_ROOT_USERNAME=$DB_USERNAME
+MONGO_INITDB_ROOT_PASSWORD=$DB_PASSWORD
+MONGO_INITDB_DATABASE=$DB_NAME
+
+SESSION_KEY=shjhakjfhfjdshjksdhfdshfhfduyeyb73te4
+
+JWT_AUDIENCE=Grow.io
+JWT_ISSUER=Grow Latch
+JWT_SECRET=Th!sIs a d3v3lopm3nt server SEcr¢T.
+
+LOGIN_VALID_TIME=12H
+RESET_VALID_MINUTES=15
+DEFAULT_TOKEN_DAYS=1
+
+CONTAINER_PREFIX=dev
+SERVICE_NAME=auth-service
+ENV=development

Dockerfile

@@ -1,27 +1,28 @@
-# FROM node:20-alpine AS build
+ARG ENV=production
-# RUN mkdir -p /home/node/app/node_modules && chown -R node:node /home/node/app
+ARG MONGO_VERSION=latest
-# WORKDIR /home/node/app
+ARG PORT=9001
-# COPY package*.json .
-# COPY dist/lib .
-# USER node
-# RUN yarn install --frozen-lockfile --production
-# COPY --chown=node:node node_modules ./node_modules
-# CMD ["node", "dist/lib/server/index.js"]
 
+## mongo build stage
+FROM mongo:$MONGO_VERSION AS database
+COPY mongo-init.sh /docker-entrypoint-initdb.d
+
+## stage one, build the service
 FROM node:20-alpine AS build
+ENV NODE_ENV development
 WORKDIR /home/node/app
 COPY package*.json ./
 COPY tsconfig.json ./
 COPY lib ./lib
 RUN ls -a
 RUN yarn install
-RUN yarn build:production
+RUN yarn build
 
 ## this is stage two , where the app actually runs
 FROM node:20-alpine AS containerize
+ENV NODE_ENV $ENV
 WORKDIR /home/node/app
 COPY package*.json ./
 RUN yarn install --frozen-lockfile --production
-COPY --from=0 /home/node/app/dist .
+COPY --from=build /home/node/app/dist .
-EXPOSE 80
+EXPOSE $PORT
 CMD ["node","server/index.js"]

README.md

@@ -1,2 +1,2 @@
-# grow-api
+# @mifi/auth
 

docker-compose.dev.yml

@@ -0,0 +1,41 @@
+version: '3.8'
+
+services:
+    auth-service_mongo:
+        env_file: .env.dev
+        container_name: ${CONTAINER_PREFIX}-auth-service_mongo
+        ports:
+            - 27017:27017
+        networks:
+            - backend
+        volumes:
+            - auth-db:/data/db
+            - auth-db:/data/configdb
+        restart: unless-stopped
+        image: mongo:latest
+    auth-service:
+        env_file: .env.dev
+        build:
+            context: .
+            args:
+              - PORT
+              - ENV
+        container_name: ${CONTAINER_PREFIX}-auth-service
+        ports:
+            - 9001:9001
+        environment:
+            - DB_HOST=${CONTAINER_PREFIX}-auth-service_mongo
+        networks:
+            - labs-net
+            - backend
+        restart: unless-stopped
+        image: node:20-alpine
+        depends_on:
+            - auth-service_mongo
+networks:
+    labs-net:
+        name: labs-net
+
+volumes:
+    auth-db:
+        external: true

docker-compose.staging-build.yml

@@ -0,0 +1,58 @@
+version: '3.8'
+
+services:
+    auth-service_mongo:
+        container_name: ${CONTAINER_PREFIX}-auth-service_mongo
+        env_file:
+            - staging.env
+        build:
+            context: .
+            target: database
+            args:
+              MONGO_VERSION: 4.4
+        networks:
+            - auth-backend
+        volumes:
+            - 'auth-db:/data/db'
+            - 'auth-db:/data/configdb'
+        restart: unless-stopped
+        image: mongo:4.4
+    auth-service:
+        container_name: ${CONTAINER_PREFIX}-auth-service
+        env_file:
+            - staging.env
+        build:
+            context: .
+            target: containerize
+            args:
+              - PORT
+              - ENV
+        environment:
+            - DB_HOST=${CONTAINER_PREFIX}-auth-service_mongo
+        labels:
+            - 'traefik.enable=true'
+            - 'traefik.docker.network=docknet'
+            - 'traefik.http.routers.labs-auth.rule=Host(`${HOST}`) && Path(`${ROUTE_PREFIX}`)'
+            - 'traefik.http.routers.labs-auth.entrypoints=websecure'
+            - 'traefik.http.routers.labs-auth.tls=true'
+            - 'traefik.http.routers.labs-auth.tls.certresolver=letsencrypt'
+            - 'traefik.http.routers.labs-auth.service=labs-auth-service'
+            - 'traefik.http.services.labs-auth-service.loadbalancer.server.port=${PORT}'
+        networks:
+            - auth-backend
+            - docknet
+        restart: unless-stopped
+        image: node:20-alpine
+        depends_on:
+            - auth-service_mongo
+networks:
+    auth-backend:
+        driver: bridge
+        external: false
+    docknet:
+        name: docknet
+        external: true
+
+volumes:
+    auth-db:
+        external: false

docker-compose.staging-image.yml

@@ -0,0 +1,43 @@
+version: '3.8'
+
+services:
+    auth-service_mongo:
+        container_name: ${CONTAINER_PREFIX}-auth-service_mongo
+        env_file:
+            - staging.env
+        networks:
+            - docknet
+        volumes:
+            - auth-db:/data
+            - ./mongo-init.js:/docker-entrypoint-initdb.d/mongo-init.js:ro
+        restart: unless-stopped
+        image: mongo:4.4
+    auth-service:
+        env_file:
+            - staging.env
+        container_name: ${CONTAINER_PREFIX}-auth-service
+        environment:
+            - DB_HOST=${CONTAINER_PREFIX}-auth-service_mongo
+        labels:
+            - 'traefik.enable=true'
+            - 'traefik.http.routers.grow.rule=Host(`${HOST}`) && Path(`${ROUTE_PREFIX}`)'
+            - 'traefik.http.routers.grow.entrypoints=websecure'
+            - 'traefik.http.routers.grow.tls=true'
+            - 'traefik.http.routers.grow.tls.certresolver=letsencrypt'
+            - 'traefik.http.routers.grow.service=grow-service'
+            - 'traefik.http.services.grow-service.loadbalancer.server.port=${PORT}'
+        networks:
+            - docknet
+        restart: unless-stopped
+        depends_on:
+            - auth-service_mongo
+        image: git.mifi.dev/mifi/mifi/auth:latest
+
+networks:
+    docknet:
+        name: docknet
+        external: true
+
+volumes:
+    auth-db:
+        external: false

docker-compose.yml

@@ -1,56 +0,0 @@
-version: '3.8'
-
-services:
-    auth-service_mongo:
-        container_name: ${CONTAINER_PREFIX}${SERVICE_NAME}_${DB_TYPE}
-        environment:
-            - ALLOW_EMPTY_PASSWORD=yes
-            - MONGO_INITDB_ROOT_USERNAME=${DB_USER}
-            - MONGO_INITDB_ROOT_PASSWORD=${DB_PASS}
-            - MONGO_INITDB_DATABASE=${DB_NAME}
-        networks:
-            - docknet
-        volumes:
-            - '/volume1/docker/labs/grow-auth/mongo:/data/db'
-        restart: unless-stopped
-        image: mongo
-    auth-service:
-        build: .
-        container_name: ${CONTAINER_PREFIX}-${SERVICE_NAME}
-        environment:
-            - PORT=${PORT}
-            - ROUTE_PREFIX=${ROUTE_PREFIX}
-            - LOGIN_ROUTE=${LOGIN_ROUTE}
-            - RESET_ROUTE=${RESET_ROUTE}
-            - DB_HOST=${CONTAINER_PREFIX}-${SERVICE_NAME}_${DB_TYPE}
-            - DB_USER=${DB_USER}
-            - DB_PASS=${DB_PASS}
-            - DB_NAME=${DB_NAME}
-            - SESSION_KEY=${SESSION_KEY}
-            - JWT_AUDIENCE=${JWT_AUDIENCE}
-            - JWT_ISSUER=${JWT_ISSUER}
-            - JWT_SECRET=${JWT_SECRET}
-            - LOGIN_VALID_TIME=${LOGIN_VALID_TIME}
-            - RESET_VALID_MINUTES=${RESET_VALID_MINUTES}
-            - DEFAULT_TOKEN_DAYS=${DEFAULT_TOKEN_DAYS}
-        labels:
-            - 'traefik.enable=true'
-            - 'traefik.http.routers.grow.rule=Host(`${HOST}`)'
-            - 'traefik.http.routers.grow.rule=Path(`${ROUTE_PREFIX}`)'
-            - 'traefik.http.routers.grow.entrypoints=websecure'
-            - 'traefik.http.routers.grow.tls=true'
-            - 'traefik.http.routers.grow.tls.certresolver=letsencrypt'
-            - 'traefik.http.routers.grow.service=gitea'
-            - 'traefik.http.services.gitea.loadbalancer.server.port=${PORT}'
-        networks:
-            - docknet
-        volumes:
-            - '/Volume1/docker/.yarnrc.yml:/.yarnrc.yml'
-            - '/Volume1/docker/labs/grow-auth/.env:/.env'
-        restart: unless-stopped
-        image: node
-        depends_on:
-            - auth-service_mongo
-networks:
-    docknet:
-        name: docknet

lib/constants/db.ts

@@ -1,5 +1,5 @@
-export const DB_HOST = process.env.DB_HOST || 'mongodb';
+export const DB_HOST = process.env.DB_HOST;
 export const DB_PORT = process.env.DB_PORT || 27017;
-export const DB_USER = process.env.DB_USER || 'test';
+export const DB_USERNAME = process.env.DB_USERNAME;
-export const DB_PASS = process.env.DB_PASSWORD || 'test';
+export const DB_PASSWORD = process.env.DB_PASSWORD;
-export const DB_NAME = process.env.DB_NAME || 'auth';
+export const DB_NAME = process.env.DB_NAME;

lib/constants/env.ts

@@ -1,4 +1,4 @@
-export const PACKAGE_NAME = '@mifi/latch';
+export const PACKAGE_NAME = '@mifi/auth';
 export const PORT = process.env.PORT || 9000;
 
 export const SESSION_KEY = process.env.SESSION_KEY || 'secret-key';

lib/db/index.ts

@@ -1,5 +1,5 @@
 import mongoose from 'mongoose';
 
-import { DB_HOST, DB_NAME, DB_PASS, DB_PORT, DB_USER } from '../constants/db';
+import { DB_HOST, DB_NAME, DB_PASSWORD, DB_PORT, DB_USERNAME } from '../constants/db';
 
-export const connection = mongoose.connect(`mongodb://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/${DB_NAME}`);
+export const connection = mongoose.connect(`mongodb://${DB_USERNAME}:${DB_PASSWORD}@${DB_HOST}:${DB_PORT}/${DB_NAME}`);

lib/server/controllers/auth.ts

@@ -7,10 +7,17 @@ import Auth from '../../db/model/auth';
 import { sign } from '../../utils/jwt';
 import passport from '../passport';
 import { ErrorCodes, getErrorBody } from '../../constants/errors';
+import { authenticated } from '../middleware/authenication';
 
 const routerOpts: Router.IRouterOptions = { prefix };
 const router: Router = new Router(routerOpts);
 
+router.get('/info', (ctx) => {
+    ctx.body = {
+        service: process.env.SERVICE_NAME,
+    };
+});
+
 router.post('/', async (ctx) => {
     const data = (await Auth.create(ctx.body)).save();
     ctx.body = { success: true, data: { ...data, strategies: undefined } };
@@ -37,7 +44,10 @@ router.post(process.env.RESET_ROUTE || RESET_ROUTE, async (ctx, next) => {
     ctx.body = { success: false, ...getErrorBody(ErrorCodes.RESET_REQUEST_DATA) };
 });
 
-router.patch('/:record', (ctx: Koa.Context) => {
+router.patch('/:record', authenticated(), (ctx: Koa.Context) => {
+    if (ctx.user !== ctx.param.record) {
+        ctx.throw(StatusCodes.UNAUTHORIZED);
+    }
     const data = Auth.findOneAndUpdate({ record: ctx.params.record });
     if (!data) {
         ctx.throw(StatusCodes.NOT_FOUND);

lib/server/index.ts

@@ -1,12 +1,11 @@
-import dotenv from 'dotenv';
-
 import app from './app';
 import { connection } from '../db';
 import { PORT } from '../constants/env';
 
-dotenv.config();
-
 connection.then(
-    () => app.listen(PORT),
+    () => {
-    (err) => console.error('ERROR!', err),
+        app.listen(PORT);
+        console.debug('Server up and listening', { env: process.env });
+    },
+    (err) => console.error('Could not reach database', { err, env: process.env }),
 );

mongo-init.sh

@@ -0,0 +1,14 @@
+set -e
+
+mongo <<EOF
+use $MONGO_INITDB_DATABASE
+
+db.createUser({
+  user: '$DB_USERNAME',
+  pwd: '$DB_PASSWORD',
+  roles: [{
+    role: 'readWrite',
+    db: '$MONGO_INITDB_DATABASE'
+  }]
+})
+EOF

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mifi/auth",
-  "version": "0.0.7",
+  "version": "0.0.38",
   "author": "mifi (Mike Fitzpatrick)",
   "license": "MIT",
   "scripts": {