Production deploy

.env.example

@@ -35,6 +35,7 @@ FILE_API_KEY_SOUTHWARK=👻
 FILE_API_KEY_EPSOM_EWELL=👻
 FILE_API_KEY_MEDWAY=👻
 FILE_API_KEY_GATESHEAD=👻
+FILE_API_KEY_DONCASTER=👻
 
 # Editor
 EDITOR_URL_EXT=http://localhost:3000

api.planx.uk/.env.test.example

@@ -25,6 +25,7 @@ FILE_API_KEY_SOUTHWARK=👻
 FILE_API_KEY_EPSOM_EWELL=👻
 FILE_API_KEY_MEDWAY=👻
 FILE_API_KEY_GATESHEAD=👻
+FILE_API_KEY_DONCASTER=👻
 
 # Editor
 EDITOR_URL_EXT=example.com

api.planx.uk/modules/auth/middleware.ts

@@ -110,6 +110,10 @@ export const useFilePermission: RequestHandler = (req, _res, next): void => {
     isEqual(
       req.headers["api-key"] as string,
       process.env.FILE_API_KEY_EPSOM_EWELL!,
+    ) ||
+    isEqual(
+      req.headers["api-key"] as string,
+      process.env.FILE_API_KEY_DONCASTER!,
     );
   if (!isAuthenticated) return next({ status: 401, message: "Unauthorised" });
   return next();

docker-compose.yml

@@ -130,6 +130,7 @@ services:
       FILE_API_KEY_EPSOM_EWELL: ${FILE_API_KEY_EPSOM_EWELL}
       FILE_API_KEY_MEDWAY: ${FILE_API_KEY_MEDWAY}
       FILE_API_KEY_GATESHEAD: ${FILE_API_KEY_GATESHEAD}
+      FILE_API_KEY_DONCASTER: ${FILE_API_KEY_DONCASTER}
       FILE_API_KEY_NEXUS: ${FILE_API_KEY_NEXUS}
       FILE_API_KEY: ${FILE_API_KEY}
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}

editor.planx.uk/src/ui/editor/ToggleIconButton.tsx

@@ -23,15 +23,16 @@ const ToggleIconButton: React.FC<ToggleIconButtonProps> = ({
     <Tooltip title={tooltip} placement="right">
       <IconButton
         aria-label={ariaLabel}
+        aria-pressed={isToggled}
         onClick={onToggle}
         size="large"
         sx={(theme) => ({
           position: "relative",
           background: theme.palette.background.paper,
           padding: theme.spacing(1),
           color: isToggled
-            ? theme.palette.text.disabled
-            : theme.palette.text.primary,
+            ? theme.palette.text.primary
+            : theme.palette.text.disabled,
 
           "&:hover": {
             background: theme.palette.common.white,
@@ -45,7 +46,7 @@ const ToggleIconButton: React.FC<ToggleIconButtonProps> = ({
             top: "55%",
             left: "48%",
             transform: "translate(-50%, -50%)",
-            opacity: isToggled ? 1 : 0,
+            opacity: isToggled ? 0 : 1,
             transition: "opacity 0.2s ease-in-out",
           }}
         >

infrastructure/application/Pulumi.production.yaml

@@ -4,12 +4,20 @@ config:
   application:airbrake-project-key:
     secure: AAABAPIGB+gWevPn0SzWnuSuV1RmdwpLOlWKnu8cM/kxLfslvdCIRcU0n0M0XNJ3jwj4EdFn7/llsL1Kg2XnDA==
   application:cloudflare-zone-id: a9b9933f28e786ec4cfd4bb596f5a519
+  application:db-host:
+    secure: AAABAKLhVuIZjULxXm7L5orM9cKtWXnC4/HWfaKulZ/mFMmUV6vX7brSfmI1ablEf3aUtUJ7/T/RzcLJkL86yEw0n88SkgQrxj+KLybM0ZH8Sy8=
+  application:db-password:
+    secure: AAABAExMwTLOjC9suf2i6hYygiqnvm7cNaS2F2iqr/zpPMX4dhh7My8Nm5dD0WRGiTsiv9I2v24eUfAVZgLC0w==
+  application:db-url:
+    secure: AAABAFMl4J25TQyb+dAVA/8g5KR1aIP7cOZrrLqYzv4ScF4AGIDWnp6zC9wV+Odja2LZyy10cbUojs1mybg1EV82UAZfEX+HCcaNixJvTuoC0h4swDMdLXX9vvs1QqsC6Q+7qp96hQCT8CW81TbdDSVIu2mLbV8dnjyuD2R8o4tt5pBmXKCVJJ4zWI5LuukolIj3nw==
   application:encryption-key:
     secure: AAABAGbTpoRtazwoNFNmaPCW0RdeTqjhEzQuYR1kl4ft7EWNxqswAu8Dc9T+YBxkYr3uaHbu5obzyo8I4QuVgg==
   application:file-api-key:
     secure: AAABAGyTfLujGho+V0tEhFXQRET5FjYK6txyaFTB3gY/VaKzq8yNlocJTAM5nt8mBhF6T+AeQD2GxW63
   application:file-api-key-barnet:
     secure: AAABANMl+fVFsRVGXvJV/aLManXO+TldXVDhp5QH6KGWJoG7O9Ket63zIW1iOiinINWJ2I5OizI=
+  application:file-api-key-doncaster:
+    secure: AAABANsIFFm3IsQKbZHe4lEZGsJv3bcK2XOVzd6IiKj+4i/eiILIc7BS0KDQxqLskQ6QCv1sDw04pie8cvAlKqVYWBGmomA2
   application:file-api-key-epsom-ewell:
     secure: AAABANvwhiVRBq8NH7ZqcToUzYn4X+KfC5Wm8WjWUKXT5TuVXqC6zHhVVKFBbmdtKjC4j5M4+bWsLiFO9dO0MLobxLpK7YCE
   application:file-api-key-gateshead:
@@ -43,6 +51,8 @@ config:
     secure: AAABABnYUYnZbOVTfN/n+m6kMQV951efSyHJYKVkGmtYvbPkpAk+BUIciL6AbJvW2x5bBuYvsrmY1v5lyZkoqoJ3XgDA/MTBQNIiNg==
   application:mapbox-access-token:
     secure: AAABAGwrLOkFpIZ3u8XeKIsfk1ujqFYKdv4us+ia2EdCXU8sBj2LiXfn8K6UcOifzf3HlOA6CYL3WwalKLmtvuq90CInbipB3dtY4Mr2Vx7NcUA7zxbUtli+8WcShIiNq490GwlTlf7ChjnNSIr3FzCeK3D/Xiq25wT0398c5ZwHyg==
+  application:mb-db-connection-uri:
+    secure: AAABAFxCleouG7pLLASpxso/YVGiTOn23PdFvK3iSJ4ak9rc6ryCTWyNlnh1+jlR5NOPJ0TUhVZX6EpW0ufFGDtMXCA8KoqGnW4MujbyqJrEyoznoV0FObIzzGCIWiocww+VVpkACrOFHAurcotGeICxwXJpstg04U2s6x5/eoA7RwWuAIoV2dnrcBZklCIeRuXjuyAZ
   application:metabase-api-key:
     secure: AAABAAdkLyFGZJ50HENSAkvYZ9Y3Qj2oKysmBKNWbqgcCLYz+dDvgEBPTbzG6lNgOqUyySJDmquMilyiUtTLau7rpF4txEM/O4DHmAinVg==
   application:metabase-encryption-secret-key:

infrastructure/application/Pulumi.staging.yaml

@@ -5,12 +5,20 @@ config:
     secure: AAABABujxMHxU8Abj4QpyQTz7bLt3AP2wBFaypVkDZ2khzc6eh6lHLljTEkzpLUncno3gNNDXnrmxzXvqKnQdQ==
   application:cloudflare-zone-id:
     secure: AAABAPZz/bzFCZEZd+jzPpYP4HXAOLYQmLGf2YLQE2YPfMBUtDC83KCo2l2DJ4AL4OKL+jFFx8wrrJc6DDwXJQ==
+  application:db-host:
+    secure: AAABANgnZHJlsCzbsGz1dXhEb2zQzEOM6wQd+AnqQKvn54W/eNcf6NWtlFUpTvVmd/9IhLzl7TSHowXKq8EGjeTnaBDsnefFq9wNGAft76dmYCU=
+  application:db-password:
+    secure: AAABAKd+etETq8AV5V3Xrl5X2H+rYtSw91GDBSwFyjT/HLJT9sOLNR296GTxrHkNQ8BxSOq4rxrlMHIt0lL/DQ==
+  application:db-url:
+    secure: AAABAHaVuHg4NkZjMQv7N8hpKRJL13IW721pPo/ou6+itPn2PLYr8s8YjTbaxDGZg9LiB5QAgbihA1fSnIolokoZ/wJ7VzkHOI59Icci0CEoOgQrUfzDFevpgt3HaTmyrxIzemMbOPl/dGcJCTW0K9NkRADWE4z2OERcFwQBRUZuRSwIbV7teXpbY15IAW24FLNM+g==
   application:encryption-key:
     secure: AAABAFTW2eRwQnXJq/IboPWtStOWXiF9WcsUKEiuosmp7TLZt52uKE3L+NrEGgsThOl3NkvFW2HhFa2XL6aB5w==
   application:file-api-key:
     secure: AAABAN0LjLOgxCkr5ZqQLn6FkZPcrPlvNG4fbNZ02W2qC1VVYVee/3aToZQuXuokVwnIPNbbe2w=
   application:file-api-key-barnet:
     secure: AAABAFpZq81zy3CKFXUgi9oEGIGp7LDVD3TNlYkZD4liX0bxOrmMJYdDpMmyGt4aGARF63nEUmo=
+  application:file-api-key-doncaster:
+    secure: AAABAIZjfr4tVG+HG9+83bPYQjgD1hmK5P+SbYpq4qGue07rHA02kciAkTMCyxD5Lzb0WX0K6fm5cvH2tof5mmX7gJGTkMVc
   application:file-api-key-epsom-ewell:
     secure: AAABAD1/nlJ2EOEglLiiNsOLbOd3KWCONhNhJAIdZQVnrSRsNIzX2luszOreQf20EYl8AZ4L1TiheqUHSt22e5z1FiLWoCtY
   application:file-api-key-gateshead:
@@ -44,6 +52,8 @@ config:
     secure: AAABACbmLC4176IBxX5iL64/nycSXEsCYSQ0hTb7t2OCVlWUc627Vr/EpBhcqPrw9q+0z8UOvRJG5/c/DflZxfPxyJRUVNu+
   application:mapbox-access-token:
     secure: AAABAMWf2zVq5/mKCLynpgzAidNsnbUEBpb47n7MRWp2xzRgwaf3kzOvnZax9N04ZScQqU6I5/tEKTBAbSb8MIBJ8mU2iTZbPg8FD6wYsetRyftm1K39KBsIl9aS7fXvZFOG7BsC4qMDEhlDkH8gbV2HTev3VvvRUe3lzVhjNGNHqQ==
+  application:mb-db-connection-uri:
+    secure: AAABAJowah1iT5v6cgduzhTzJxcFLVRW1/nfh80aL0+IxD9MlCABab5L/rKxMeVN+wdxU7XyyXbRwXcShYKpQtLWBCD+yaFiIJgXgbdsfMnd2IEZxwWZu5GwAGbo2zY/fHOsS/mq1F5pysSliEJubFz8EIpOHQFykXXgUFtNy+NmL5GIiex+Zz5MJKSEFBQkyRrkcOEz
   application:metabase-api-key:
     secure: AAABAFf+hW09AWupsY6adrPAJHCkrTMeRX7/gaUHLYXi3QS77MVelPp9K0L4zyUL8u7zDanjuE9G/bfIlcVXLwiLLKAJkt5to9knKJqTXg==
   application:metabase-encryption-secret-key:

infrastructure/application/index.ts

@@ -114,16 +114,15 @@ export = async () => {
     vpc,
   });
 
-  const dbRootUrl: string = await data.requireOutputValue("dbRootUrl");
+  const DB_ROOT_USERNAME = "dbuser";
 
   // ----------------------- Metabase
-  const pgRoot = url.parse(dbRootUrl);
   const provider = new postgres.Provider("metabase", {
-    host: pgRoot.hostname as string,
-    port: Number(pgRoot.port),
-    username: pgRoot.auth!.split(":")[0] as string,
-    password: pgRoot.auth!.split(":")[1] as string,
-    database: pgRoot.path!.substring(1) as string,
+    host: config.requireSecret("db-host"),
+    port: 5432,
+    username: DB_ROOT_USERNAME,
+    password: config.requireSecret("db-password"),
+    database: "postgres",
     superuser: false,
   });
   const metabasePgPassword = config.requireSecret("metabasePgPassword");
@@ -212,7 +211,7 @@ export = async () => {
           { name: "MB_DB_TYPE", value: "postgres" },
           {
             name: "MB_DB_CONNECTION_URI",
-            value: pulumi.interpolate`postgres://${role.name}:${metabasePgPassword}@${pgRoot.hostname}:${pgRoot.port}/${metabasePgDatabase.name}`,
+            value: config.requireSecret("mb-db-connection-uri"),
           },
           { name: "MB_JETTY_HOST", value: "0.0.0.0" },
           { name: "MB_JETTY_PORT", value: String(METABASE_PORT) },
@@ -381,6 +380,10 @@ export = async () => {
             name: "FILE_API_KEY_GATESHEAD",
             value: config.requireSecret("file-api-key-gateshead"),
           },
+          {
+            name: "FILE_API_KEY_DONCASTER",
+            value: config.requireSecret("file-api-key-doncaster"),
+          },
           {
             name: "GOOGLE_CLIENT_ID",
             value: config.require("google-client-id"),
@@ -546,7 +549,7 @@ export = async () => {
           },
           {
             name: "PG_URL",
-            value: dbRootUrl,
+            value: config.requireSecret("db-url"),
           },
         ],
       },

infrastructure/application/services/hasura.ts

@@ -20,7 +20,6 @@ export const createHasuraService = async ({
 }: CreateService) => {
 
   const config = new pulumi.Config();
-  const dbRootUrl: string = await data.requireOutputValue("dbRootUrl");
   const DOMAIN: string = await certificates.requireOutputValue("domain");
 
   const lbHasura = new awsx.lb.ApplicationLoadBalancer("hasura", {
@@ -76,13 +75,18 @@ export const createHasuraService = async ({
           memory: config.requireNumber("hasura-proxy-memory"),
           portMappings: [hasuraListenerHttp],
           // hasuraProxy should wait for the hasura container to spin up before starting
-          dependsOn: [{
-            containerName: "hasura",
-            condition: "HEALTHY"
-          }],
+          dependsOn: [
+            {
+              containerName: "hasura",
+              condition: "HEALTHY",
+            },
+          ],
           healthCheck: {
             // hasuraProxy health depends on hasura health
-            command: ["CMD-SHELL", `wget --spider --quiet http://localhost:${HASURA_PROXY_PORT}/healthz || exit 1`],
+            command: [
+              "CMD-SHELL",
+              `wget --spider --quiet http://localhost:${HASURA_PROXY_PORT}/healthz || exit 1`,
+            ],
             interval: 15,
             timeout: 3,
             retries: 3,
@@ -100,7 +104,10 @@ export const createHasuraService = async ({
           cpu: config.requireNumber("hasura-cpu"),
           memory: config.requireNumber("hasura-memory"),
           healthCheck: {
-            command: ["CMD-SHELL", "curl --head http://localhost:8080/healthz || exit 1"],
+            command: [
+              "CMD-SHELL",
+              "curl --head http://localhost:8080/healthz || exit 1",
+            ],
             // wait 5m before running container-level health check, using same params as docker-compose
             startPeriod: 300,
             interval: 15,
@@ -132,7 +139,7 @@ export const createHasuraService = async ({
             { name: "HASURA_GRAPHQL_UNAUTHORIZED_ROLE", value: "public" },
             {
               name: "HASURA_GRAPHQL_DATABASE_URL",
-              value: dbRootUrl,
+              value: config.requireSecret("db-url"),
             },
             {
               name: "HASURA_PLANX_API_URL",