Feat/tf to cdk

.gitignore

@@ -4,6 +4,7 @@ logs
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+docs
 
 # Next.js cache and compiled artifacts
 .next/

.prettierrc

@@ -0,0 +1,6 @@
+{
+  "singleQuote": false,
+  "trailingComma": "es5",
+  "semi": false,
+  "printWidth": 100
+}

.trunk/.gitignore

@@ -0,0 +1,9 @@
+*out
+*logs
+*actions
+*notifications
+*tools
+plugins
+user_trunk.yaml
+user.yaml
+tmp

.trunk/configs/.hadolint.yaml

@@ -0,0 +1,4 @@
+# Following source doesn't work in most setups
+ignored:
+  - SC1090
+  - SC1091

.trunk/configs/.markdownlint.yaml

@@ -0,0 +1,2 @@
+# Prettier friendly markdownlint config (all formatting rules disabled)
+extends: markdownlint/style/prettier

.trunk/configs/.shellcheckrc

@@ -0,0 +1,7 @@
+enable=all
+source-path=SCRIPTDIR
+disable=SC2154
+
+# If you're having issues with shellcheck following source, disable the errors via:
+# disable=SC1090
+# disable=SC1091

.trunk/configs/.yamllint.yaml

@@ -0,0 +1,7 @@
+rules:
+  quoted-strings:
+    required: only-when-needed
+    extra-allowed: ["{|}"]
+  key-duplicates: {}
+  octal-values:
+    forbid-implicit-octal: true

.trunk/configs/svgo.config.mjs

@@ -0,0 +1,14 @@
+export default {
+  plugins: [
+    {
+      name: "preset-default",
+      params: {
+        overrides: {
+          removeViewBox: false, // https://github.com/svg/svgo/issues/1128
+          sortAttrs: true,
+          removeOffCanvasPaths: true,
+        },
+      },
+    },
+  ],
+}

.trunk/trunk.yaml

@@ -0,0 +1,42 @@
+# This file controls the behavior of Trunk: https://docs.trunk.io/cli
+# To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
+version: 0.1
+cli:
+  version: 1.24.0
+# Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
+plugins:
+  sources:
+    - id: trunk
+      ref: v1.7.1
+      uri: https://github.com/trunk-io/plugins
+# Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
+runtimes:
+  enabled:
+    - go@1.21.0
+    - node@22.16.0
+    - python@3.10.8
+# This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
+lint:
+  enabled:
+    - actionlint@1.7.7
+    - checkov@3.2.457
+    - eslint@8.57.0
+    - git-diff-check
+    - hadolint@2.12.1-beta
+    - markdownlint@0.45.0
+    - osv-scanner@2.0.3
+    - oxipng@9.1.5
+    - prettier@3.6.2
+    - shellcheck@0.10.0
+    - shfmt@3.6.0
+    - svgo@4.0.0
+    - taplo@0.9.3
+    - trufflehog@3.90.2
+    - yamllint@1.37.1
+actions:
+  disabled:
+    - trunk-announce
+    - trunk-check-pre-push
+    - trunk-fmt-pre-commit
+  enabled:
+    - trunk-upgrade-available

api/src/services/email.service.ts

@@ -1,34 +1,31 @@
+import * as aws from '@aws-sdk/client-sesv2';
+import { HttpService } from '@nestjs/axios';
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
+import {
+  LanguagesEnum,
+  ListingEventsTypeEnum,
+  ReviewOrderTypeEnum,
+} from '@prisma/client';
+import dayjs from 'dayjs';
+import advanced from 'dayjs/plugin/advancedFormat';
+import tz from 'dayjs/plugin/timezone';
+import utc from 'dayjs/plugin/utc';
 import fs from 'fs';
 import Handlebars from 'handlebars';
 import juice from 'juice';
 import Polyglot from 'node-polyglot';
-import { firstValueFrom } from 'rxjs';
 import path from 'path';
-import dayjs from 'dayjs';
-import utc from 'dayjs/plugin/utc';
-import tz from 'dayjs/plugin/timezone';
-import advanced from 'dayjs/plugin/advancedFormat';
-import * as aws from '@aws-sdk/client-sesv2';
-import { TranslationService } from './translation.service';
-import { JurisdictionService } from './jurisdiction.service';
+import { firstValueFrom } from 'rxjs';
+import { ApplicationCreate } from '../dtos/applications/application-create.dto';
 import { Jurisdiction } from '../dtos/jurisdictions/jurisdiction.dto';
-import {
-  LanguagesEnum,
-  ListingEventsTypeEnum,
-  ReviewOrderTypeEnum,
-} from '@prisma/client';
-import { IdDTO } from '../dtos/shared/id.dto';
 import { Listing } from '../dtos/listings/listing.dto';
-import { ApplicationCreate } from '../dtos/applications/application-create.dto';
-import { User } from '../dtos/users/user.dto';
+import { IdDTO } from '../dtos/shared/id.dto';
 import Unit from '../dtos/units/unit.dto';
+import { User } from '../dtos/users/user.dto';
 import { getPublicEmailURL } from '../utilities/get-public-email-url';
-
-dayjs.extend(utc);
-dayjs.extend(tz);
+import { JurisdictionService } from './jurisdiction.service';
+import { TranslationService } from './translation.service';
 dayjs.extend(advanced);
 
 type listingInfo = {
@@ -53,7 +50,7 @@ export class EmailService {
     private logger = new Logger(EmailService.name),
   ) {
     const sesClient = new aws.SESv2Client({
-      region: process.env.AWS_REGION,
+      region: process.env.SES_REGION || process.env.AWS_REGION,
     });
 
     this.client = sesClient;
@@ -138,7 +135,7 @@ export class EmailService {
 
     // juice inlines css to allow for email styling
     const inlineHtml = juice(rawHtml);
-    const govEmailXml = `<bulletin>\n <subject>${subject}</subject>\n  <body><![CDATA[\n     
+    const govEmailXml = `<bulletin>\n <subject>${subject}</subject>\n  <body><![CDATA[\n
       ${inlineHtml}\n   ]]></body>\n   <sms_body nil='true'></sms_body>\n   <from_address_id>${fromEmailAddress}</from_address_id>\n   <publish_rss type='boolean'>false</publish_rss>\n   <open_tracking type='boolean'>true</open_tracking>\n   <click_tracking type='boolean'>true</click_tracking>\n   <share_content_enabled type='boolean'>true</share_content_enabled>\n   <topics type='array'>\n     <topic>\n       <code>${GOVDELIVERY_TOPIC}</code>\n     </topic>\n   </topics>\n   <categories type='array' />\n </bulletin>`;
 
     await firstValueFrom(
@@ -177,8 +174,8 @@ export class EmailService {
               },
               Text: mailOptions.text
                 ? {
-                    Data: mailOptions.text,
-                  }
+                  Data: mailOptions.text,
+                }
                 : undefined,
             },
           },
@@ -659,9 +656,8 @@ export class EmailService {
       );
       tableRows.push({
         label: this.polyglot.t(`rentalOpportunity.${key}`),
-        value: `${bedroom?.length} unit${
-          bedroom.length > 1 ? 's' : ''
-        }${bathroomstring}${sqFtString}`,
+        value: `${bedroom?.length} unit${bedroom.length > 1 ? 's' : ''
+          }${bathroomstring}${sqFtString}`,
       });
     });
     if (units?.rent?.length) {
@@ -854,9 +850,8 @@ export class EmailService {
   formatPricing = (values: number[]): string => {
     const minPrice = Math.min(...values);
     const maxPrice = Math.max(...values);
-    return `$${minPrice.toLocaleString()}${
-      minPrice !== maxPrice ? ' - $' + maxPrice.toLocaleString() : ''
-    } per month`;
+    return `$${minPrice.toLocaleString()}${minPrice !== maxPrice ? ' - $' + maxPrice.toLocaleString() : ''
+      } per month`;
   };
 
   formatUnitDetails = (
@@ -874,9 +869,8 @@ export class EmailService {
     if (mappedField?.length) {
       const minValue = Math.min(...mappedField);
       const maxValue = Math.max(...mappedField);
-      return `, ${minValue.toLocaleString()}${
-        minValue !== maxValue ? ' - ' + maxValue.toLocaleString() : ''
-      } ${pluralLabel && maxValue === 1 ? pluralLabel : label}`;
+      return `, ${minValue.toLocaleString()}${minValue !== maxValue ? ' - ' + maxValue.toLocaleString() : ''
+        } ${pluralLabel && maxValue === 1 ? pluralLabel : label}`;
     }
     return '';
   };

build/docker/Dockerfile.backend

@@ -116,6 +116,7 @@ COPY --from=source --chown=node:node \
     /app/api/yarn*.lock \
     /app/api/prisma ./
 
+
 # Add only dependencies required to run the application
 COPY --from=optimize --chown=node:node /app/node_modules ./node_modules
 RUN yarn prisma generate
@@ -126,12 +127,16 @@ RUN mkdir ./src
 RUN mkdir ./src/temp
 RUN chmod 777 ./src/temp
 
+# Copy and set permissions for entrypoint script as root
+COPY build/docker/entrypoint-run.sh /app/api/entrypoint-run.sh
+RUN chown node:node /app/api/entrypoint-run.sh
+RUN chmod 755 /app/api/entrypoint-run.sh
+
 # When running this image, make sure to use the built-in node user
 USER node
 
-RUN yarn prisma generate
 
-CMD yarn start:prod
+ENTRYPOINT [ "/app/api/entrypoint-run.sh" ]
 
 #####################
 ##### NEW STAGE #####
@@ -159,10 +164,12 @@ COPY --from=source --chown=node:node /app/api/src ./src
 COPY --from=source --chown=node:node /app/api/prisma ./prisma
 COPY --from=source --chown=node:node /app/api/scripts ./scripts
 
+
+COPY build/docker/entrypoint-migrate.sh /app/api/entrypoint-migrate.sh
+RUN chown node:node /app/api/entrypoint-migrate.sh
+RUN chmod 755 /app/api/entrypoint-migrate.sh
 ## This CMD should be run as the node user
 USER node
+RUN yarn prisma generate
 
-# We need to skip all migrations that are just for local development (changes already exist in deployed environment)
-CMD if [ "$SKIP_MIGRATIONS" = TRUE ]; then yarn db:migration:skip 00_init || true && yarn db:migration:skip 02_hba_to_prisma || true && yarn db:migration:skip 03_0_external_listing || true && yarn db:migration:run; \
-    else yarn db:migration:run; \
-    fi
+ENTRYPOINT [ "/app/api/entrypoint-migrate.sh" ]

build/docker/entrypoint-migrate.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Debug the individual secret values
+echo "PGUSER: $PGUSER"
+echo "PGHOST: $PGHOST"
+echo "PGPORT: $PGPORT"
+echo "PGDATABASE: $PGDATABASE"
+echo "PGPASSWORD length: ${#PGPASSWORD}"
+
+# Validate port is numeric
+if ! echo "$PGPORT" | grep -qE '^[0-9]+$'; then
+  echo "ERROR: PGPORT is not a valid number: '$PGPORT'"
+  exit 1
+fi
+
+# URL encode the password to handle special characters
+ENCODED_PASSWORD=$(node -e "console.log(encodeURIComponent('$PGPASSWORD'))")
+
+export DATABASE_URL="postgresql://${PGUSER}:${ENCODED_PASSWORD}@${PGHOST}:${PGPORT}/${PGDATABASE}"
+echo "DATABASE_URL (password masked): postgresql://${PGUSER}:***@${PGHOST}:${PGPORT}/${PGDATABASE}"
+
+
+if [ "$SKIP_MIGRATIONS" = TRUE ];then
+  echo "Skipping Migrations"
+  yarn db:migration:skip 00_init || true && yarn db:migration:skip 02_hba_to_prisma || true && yarn db:migration:skip 03_0_external_listing || true && yarn db:migration:run;
+else
+  echo "Running migrations...${MIGRATION_CMD}";
+  yarn ${MIGRATION_CMD};
+fi

build/docker/entrypoint-run.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# Debug the individual secret values
+echo "PGUSER: $PGUSER"
+echo "PGHOST: $PGHOST"
+echo "PGPORT: $PGPORT"
+echo "PGDATABASE: $PGDATABASE"
+echo "PGPASSWORD length: ${#PGPASSWORD}"
+
+# Validate port is numeric
+if ! echo "$PGPORT" | grep -qE '^[0-9]+$'; then
+  echo "ERROR: PGPORT is not a valid number: '$PGPORT'"
+  exit 1
+fi
+
+# URL encode the password to handle special characters
+ENCODED_PASSWORD=$(node -e "console.log(encodeURIComponent('$PGPASSWORD'))")
+
+export DATABASE_URL="postgresql://${PGUSER}:${ENCODED_PASSWORD}@${PGHOST}:${PGPORT}/${PGDATABASE}"
+echo "DATABASE_URL (password masked): postgresql://${PGUSER}:***@${PGHOST}:${PGPORT}/${PGDATABASE}"
+
+echo "Starting Service..."
+yarn start:prod

cdk/.gitignore

@@ -0,0 +1,8 @@
+*.js
+!jest.config.js
+*.d.ts
+node_modules
+
+# CDK asset staging directory
+.cdk.staging
+cdk.out

cdk/.npmignore

@@ -0,0 +1,6 @@
+*.ts
+!*.d.ts
+
+# CDK asset staging directory
+.cdk.staging
+cdk.out

cdk/README.md

@@ -0,0 +1,26 @@
+# Doorway App CDK Project
+
+This project uses [CDK](https://aws.amazon.com/cdk/) to deploy the ECS tasks and services to AWS. This presumes that you have already deployed [doorway-infra](https://github.com/metrotranscom/doorway-infra) to the environment.
+
+The `cdk.json` file tells the CDK Toolkit how to execute your app.
+
+# Necessary workstation setup
+
+You will need the following things set up before you work with the code in this repo:
+
+- A Typescript IDE like VS Code.
+- NodeJS - currently version 22 - I reccomend using [NVM](https://github.com/nvm-sh/nvm).
+- The [AWS CLI](https://aws.amazon.com/cli/).
+- The [AWS CDK](https://docs.aws.amazon.com/cdk/v2/guide/getting-started.html)
+- [Yarn](https://yarnpkg.com/)
+
+## Useful commands
+
+- `yarn test` Perform the jest unit tests.
+- `cdk synth` emits the synthesized CloudFormation template. This is also good to use on your local
+  workstation to make sure your CDK code hangs together. **This doesn't touch the actual AWS
+  infrastructure.**
+- `cdk deploy DoorwayBuildPipelineStack` This deploys the Doorway application delivery pipeline. **This impacts AWS and will only work if you have the proper access and have configured your AWS credentials file.**
+- `cdk deploy  DoorwayAppEnvironmentStack` This deploys a Doorway application. You will likely need to be an AWS admin to run this. You will also need to set an an environment variable named ENVIRONMENT. and a ".env" file named [$ENVIRONMENT].env for the scriot to load. **This impacts AWS and will only work if you have the proper access and have configured your AWS credentials file.**
+- `cdk diff` compare deployed stack with current state
+

cdk/bin/doorway-cdk.ts

@@ -0,0 +1,29 @@
+import * as cdk from "aws-cdk-lib"
+import { DoorwayBuildPipelineStack } from "../lib/build-pipeline/doorway-build-pipeline-stack"
+import { DoorwayAppEnvironmentStack } from "../lib/doorway_environment/doorway-app-environment-stack"
+import { DoorwayCloudFrontStack } from "../lib/doorway_environment/doorway-cloudfront-stack"
+
+/**
+ * This script is really just a wrapper to execute the various
+ * stacks that make up the Doorway Application infrastructure and build pipeline.
+ **/
+const app = new cdk.App()
+const environment = process.env.ENVIRONMENT || "dev"
+
+
+/** This stack creates the doorway application build pipeline **/
+new DoorwayBuildPipelineStack(app, "DoorwayBuildPipelineStack", {
+  githubSecret: "mtc/githubSecret",
+  dockerHubSecret: "mtc/dockerHub",
+})
+/** This  stack actually creates a doorway environment. */
+const appStack = new DoorwayAppEnvironmentStack(app, `DoorwayAppEnvironmentStack-${environment}`, environment)
+
+/** This stack creates the cert used by the cloudfront distribution. It sits in it's own stack because cloudfront certs have to be created in us-east-1  **/
+const cfCertStack = new DoorwayCloudFrontStack(app, `DoorwayCloudFrontStack-${environment}`, {
+  environment: environment,
+  publicDomainName: process.env.PUBLIC_PORTAL_DOMAIN || `${environment}.housingbayarea.mtc.ca.gov`,
+  partnersDomainName: process.env.PARTNERS_PORTAL_DOMAIN || `partners.${environment}.housingbayarea.mtc.ca.gov`,
+  loadBalancerDnsName: appStack.loadBalancerDnsName
+})
+