Merge branch 'main' into EW-1006

hpi-schul-cloud · Oct 8, 2024 · fe7dd8c · fe7dd8c
2 parents d74dc3a + d95880a
commit fe7dd8c
Show file tree

Hide file tree

Showing 107 changed files with 6,840 additions and 654 deletions.
diff --git a/ansible/roles/schulcloud-server-init/templates/configmap_file_init.yml.j2 b/ansible/roles/schulcloud-server-init/templates/configmap_file_init.yml.j2
@@ -517,6 +517,11 @@ data:
 
     # ========== Start of the CTL seed data configuration section.
     echo "Inserting ctl seed data secrets to external-tools..."
+
+         # Encrypt secrets of external tools that contain an lti11 config.
+                $CTL_SEED_SECRET_ONLINE_DIA_MATHE=$(node scripts/secret.js -s $AES_KEY -e $CTL_SEED_SECRET_ONLINE_DIA_MATHE)
+                $CTL_SEED_SECRET_ONLINE_DIA_DEUTSCH=$(node scripts/secret.js -s $AES_KEY -e $CTL_SEED_SECRET_ONLINE_DIA_DEUTSCH)
+
     mongosh $DATABASE__URL --quiet --eval 'db.getCollection("external-tools").updateOne(
            {
              "name": "Product Test Onlinediagnose Grundschule - Mathematik",

diff --git a/ansible/roles/schulcloud-server-tspsync/defaults/main.yml b/ansible/roles/schulcloud-server-tspsync/defaults/main.yml
@@ -0,0 +1 @@
+SERVER_TSP_SYNC_CRONJOB_SCHEDULE: "9 3 * * *"
diff --git a/ansible/roles/schulcloud-server-tspsync/tasks/main.yml b/ansible/roles/schulcloud-server-tspsync/tasks/main.yml
@@ -81,3 +81,33 @@
     when: not WITH_TSP
     tags:
       - cronjob
+
+  - name: API TSP Sync CronJob
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      template: api-tsp-sync-cronjob.yml.j2
+    when: WITH_TSP_SYNC
+    tags:
+      - cronjob
+
+  - name: remove API TSP Sync CronJob
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      state: absent
+      api_version: batch/v1
+      kind: CronJob
+      namespace: "{{ NAMESPACE }}"
+      name: api-tsp-sync-cronjob
+    when: not WITH_TSP_SYNC
+    tags:
+      - cronjob
+
+  - name: API TSP Sync CronJob ConfigMap
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      template: api-tsp-sync-cronjob-configmap.yml.j2
+      state: "{{ 'present' if WITH_TSP_SYNC|bool else 'absent'}}"
+    tags:
+      - configmap
diff --git a/ansible/roles/schulcloud-server-tspsync/templates/api-tsp-sync-cronjob-configmap.yml.j2 b/ansible/roles/schulcloud-server-tspsync/templates/api-tsp-sync-cronjob-configmap.yml.j2
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: {{ NAMESPACE }}
+  name: api-tsp-sync-cronjob-configmap
+  labels:
+    app: api-tsp-sync-cronjob
+data:
+  NODE_OPTIONS: "--max-old-space-size=3072"
+  NEST_LOG_LEVEL: "error"
+  EXIT_ON_ERROR: "true"
+  FEATURE_IDENTITY_MANAGEMENT_ENABLED: "{{ FEATURE_IDENTITY_MANAGEMENT_ENABLED }}"
+  FEATURE_IDENTITY_MANAGEMENT_STORE_ENABLED: "{{ FEATURE_IDENTITY_MANAGEMENT_STORE_ENABLED }}"
+  FEATURE_IDENTITY_MANAGEMENT_LOGIN_ENABLED: "{{ FEATURE_IDENTITY_MANAGEMENT_LOGIN_ENABLED }}"
+  IDENTITY_MANAGEMENT__INTERNAL_URI: "{{ IDENTITY_MANAGEMENT__INTERNAL_URI }}"
+  IDENTITY_MANAGEMENT__EXTERNAL_URI: "{{ IDENTITY_MANAGEMENT__EXTERNAL_URI }}"
+  IDENTITY_MANAGEMENT__TENANT: "{{ IDENTITY_MANAGEMENT__TENANT }}"
+  IDENTITY_MANAGEMENT__CLIENTID: "{{ IDENTITY_MANAGEMENT__CLIENTID }}"
diff --git a/ansible/roles/schulcloud-server-tspsync/templates/api-tsp-sync-cronjob.yml.j2 b/ansible/roles/schulcloud-server-tspsync/templates/api-tsp-sync-cronjob.yml.j2
@@ -0,0 +1,109 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  namespace: {{ NAMESPACE }}
+  labels:
+    app: api-tsp-sync-cronjob
+    app.kubernetes.io/part-of: schulcloud-verbund
+    app.kubernetes.io/version: {{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+    app.kubernetes.io/name: api-tsp-sync-cronjob
+    app.kubernetes.io/component: sync
+    app.kubernetes.io/managed-by: ansible
+    git.branch: {{ SCHULCLOUD_SERVER_BRANCH_NAME }}
+    git.repo: {{ SCHULCLOUD_SERVER_REPO_NAME }}
+  name: api-tsp-sync-cronjob
+spec:
+  concurrencyPolicy: Forbid
+  schedule: "{{ SERVER_TSP_SYNC_CRONJOB_SCHEDULE }}"
+  jobTemplate:
+    metadata:
+      labels:
+        app: api-tsp-sync-cronjob
+        app.kubernetes.io/part-of: schulcloud-verbund
+        app.kubernetes.io/version: {{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+        app.kubernetes.io/name: api-tsp-sync-cronjob
+        app.kubernetes.io/component: sync
+        app.kubernetes.io/managed-by: ansible
+        git.branch: {{ SCHULCLOUD_SERVER_BRANCH_NAME }}
+        git.repo: {{ SCHULCLOUD_SERVER_REPO_NAME }}
+    spec:
+      template:
+        metadata:
+          labels:
+            app: api-tsp-sync-cronjob
+            app.kubernetes.io/part-of: schulcloud-verbund
+            app.kubernetes.io/version: {{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+            app.kubernetes.io/name: api-tsp-sync-cronjob
+            app.kubernetes.io/component: sync
+            app.kubernetes.io/managed-by: ansible
+            git.branch: {{ SCHULCLOUD_SERVER_BRANCH_NAME }}
+            git.repo: {{ SCHULCLOUD_SERVER_REPO_NAME }}
+        spec:
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+            runAsNonRoot: true
+          containers:
+          - name: api-tsp-sync-cronjob
+            image: {{ SCHULCLOUD_SERVER_IMAGE }}:{{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+            envFrom:
+            - configMapRef:
+                name: api-tsp-sync-cronjob-configmap
+            - secretRef:
+                name: api-secret
+            command: ['/bin/sh', '-c']
+            args: ['npm run nest:start:sync tsp']
+            resources:
+              limits:
+                cpu: {{ API_CPU_LIMITS|default("2000m", true) }}
+                memory: {{ API_MEMORY_LIMITS|default("2Gi", true) }}
+              requests:
+                cpu: {{ API_CPU_REQUESTS|default("100m", true) }}
+                memory: {{ API_MEMORY_REQUESTS|default("150Mi", true) }}
+          restartPolicy: OnFailure
+{% if AFFINITY_ENABLE is defined and AFFINITY_ENABLE|bool %}
+          affinity:
+            podAffinity:
+              preferredDuringSchedulingIgnoredDuringExecution:
+              - weight: 20
+                podAffinityTerm:
+                  labelSelector:
+                    matchExpressions:
+                    - key: app.kubernetes.io/part-of
+                      operator: In
+                      values:
+                      - schulcloud-verbund
+                  topologyKey: "kubernetes.io/hostname"
+                  namespaceSelector: {}
+              - weight: 10
+                podAffinityTerm:
+                  labelSelector:
+                    matchExpressions:
+                    - key: git.repo
+                      operator: In
+                      values:
+                      - {{ SCHULCLOUD_SERVER_REPO_NAME }}
+                  topologyKey: "kubernetes.io/hostname"
+                  namespaceSelector: {}
+              - weight: 10
+                podAffinityTerm:
+                  labelSelector:
+                    matchExpressions:
+                    - key: git.branch
+                      operator: In
+                      values:
+                      - {{ SCHULCLOUD_SERVER_BRANCH_NAME }}
+                  topologyKey: "kubernetes.io/hostname"
+                  namespaceSelector: {}
+              - weight: 10
+                podAffinityTerm:
+                  labelSelector:
+                    matchExpressions:
+                    - key: app.kubernetes.io/version
+                      operator: In
+                      values:
+                      - {{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+                  topologyKey: "kubernetes.io/hostname"
+                  namespaceSelector: {}
+{% endif %}
diff --git a/apps/server/src/apps/server.app.ts b/apps/server/src/apps/server.app.ts
@@ -7,6 +7,7 @@ import { AccountService } from '@modules/account';
 import { SystemRule } from '@modules/authorization/domain/rules';
 
 import { ColumnBoardService } from '@modules/board';
+import { ContextExternalToolService } from '@src/modules/tool/context-external-tool';
 import { CollaborativeStorageUc } from '@modules/collaborative-storage/uc/collaborative-storage.uc';
 import { GroupService } from '@modules/group';
 import { InternalServerModule } from '@modules/internal-server';
@@ -94,6 +95,8 @@ async function bootstrap() {
 	// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment,@typescript-eslint/no-unsafe-member-access
 	feathersExpress.services['nest-column-board-service'] = nestApp.get(ColumnBoardService);
 	// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment,@typescript-eslint/no-unsafe-member-access
+	feathersExpress.services['nest-context-external-tool-service'] = nestApp.get(ContextExternalToolService);
+	// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment,@typescript-eslint/no-unsafe-member-access
 	feathersExpress.services['nest-system-rule'] = nestApp.get(SystemRule);
 	// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access,@typescript-eslint/no-unsafe-assignment
 	feathersExpress.services['nest-orm'] = orm;

diff --git a/apps/server/src/infra/schulconnex-client/index.ts b/apps/server/src/infra/schulconnex-client/index.ts
@@ -1,6 +1,4 @@
 export { SchulconnexRestClientOptions } from './schulconnex-rest-client-options';
-export { SchulconnexClientModule } from './schulconnex-client.module';
 export { SchulconnexRestClient } from './schulconnex-rest-client';
 export * from './response';
-export { schulconnexResponseFactory, schulconnexPoliciesInfoResponseFactory } from './testing';
 export { SchulconnexClientConfig } from './schulconnex-client-config';
diff --git a/apps/server/src/infra/schulconnex-client/response/policies-info/index.ts b/apps/server/src/infra/schulconnex-client/response/policies-info/index.ts
@@ -2,3 +2,7 @@ export { SchulconnexPoliciesInfoTargetResponse } from './schulconnex-policies-in
 export { SchulconnexPoliciesInfoResponse } from './schulconnex-policies-info-response';
 export { SchulconnexPoliciesInfoActionType } from './schulconnex-policies-info-action-type';
 export { SchulconnexPoliciesInfoPermissionResponse } from './schulconnex-policies-info-permission-response';
+export { SchulconnexPoliciesInfoAccessControlResponse } from './schulconnex-policies-info-access-control-response';
+export { SchulconnexPoliciesInfoErrorDescriptionResponse } from './schulconnex-policies-info-error-description-response';
+export { SchulconnexPoliciesInfoLicenseResponse } from './schulconnex-policies-info-license-response';
+export { SchulconnexPoliciesInfoErrorResponse } from './schulconnex-policies-info-error-response';
diff --git a/...connex-client/response/policies-info/schulconnex-policies-info-access-control-response.ts b/...connex-client/response/policies-info/schulconnex-policies-info-access-control-response.ts
@@ -0,0 +1,13 @@
+import { Type } from 'class-transformer';
+import { IsObject, IsString, ValidateNested } from 'class-validator';
+import { SchulconnexPoliciesInfoErrorDescriptionResponse } from './schulconnex-policies-info-error-description-response';
+
+export class SchulconnexPoliciesInfoAccessControlResponse {
+	@IsString()
+	'@type'!: string;
+
+	@IsObject()
+	@ValidateNested()
+	@Type(() => SchulconnexPoliciesInfoErrorDescriptionResponse)
+	error!: SchulconnexPoliciesInfoErrorDescriptionResponse;
+}
diff --git a/...nex-client/response/policies-info/schulconnex-policies-info-error-description-response.ts b/...nex-client/response/policies-info/schulconnex-policies-info-error-description-response.ts
@@ -0,0 +1,9 @@
+import { IsString } from 'class-validator';
+
+export class SchulconnexPoliciesInfoErrorDescriptionResponse {
+	@IsString()
+	code!: string;
+
+	@IsString()
+	value!: string;
+}
diff --git a/...fra/schulconnex-client/response/policies-info/schulconnex-policies-info-error-response.ts b/...fra/schulconnex-client/response/policies-info/schulconnex-policies-info-error-response.ts
@@ -0,0 +1,10 @@
+import { Type } from 'class-transformer';
+import { IsObject, ValidateNested } from 'class-validator';
+import { SchulconnexPoliciesInfoAccessControlResponse } from './schulconnex-policies-info-access-control-response';
+
+export class SchulconnexPoliciesInfoErrorResponse {
+	@IsObject()
+	@ValidateNested()
+	@Type(() => SchulconnexPoliciesInfoAccessControlResponse)
+	access_control!: SchulconnexPoliciesInfoAccessControlResponse;
+}
diff --git a/...a/schulconnex-client/response/policies-info/schulconnex-policies-info-license-response.ts b/...a/schulconnex-client/response/policies-info/schulconnex-policies-info-license-response.ts
@@ -0,0 +1,16 @@
+import { Type } from 'class-transformer';
+import { IsArray, IsObject, ValidateNested } from 'class-validator';
+import { SchulconnexPoliciesInfoPermissionResponse } from './schulconnex-policies-info-permission-response';
+import { SchulconnexPoliciesInfoTargetResponse } from './schulconnex-policies-info-target-response';
+
+export class SchulconnexPoliciesInfoLicenseResponse {
+	@IsObject()
+	@ValidateNested()
+	@Type(() => SchulconnexPoliciesInfoTargetResponse)
+	target!: SchulconnexPoliciesInfoTargetResponse;
+
+	@IsArray()
+	@ValidateNested({ each: true })
+	@Type(() => SchulconnexPoliciesInfoPermissionResponse)
+	permission!: SchulconnexPoliciesInfoPermissionResponse[];
+}
diff --git a/...chulconnex-client/response/policies-info/schulconnex-policies-info-permission-response.ts b/...chulconnex-client/response/policies-info/schulconnex-policies-info-permission-response.ts
@@ -1,7 +1,8 @@
-import { IsArray } from 'class-validator';
+import { IsArray, IsString } from 'class-validator';
 import { SchulconnexPoliciesInfoActionType } from './schulconnex-policies-info-action-type';
 
 export class SchulconnexPoliciesInfoPermissionResponse {
 	@IsArray()
+	@IsString({ each: true })
 	action!: SchulconnexPoliciesInfoActionType[];
 }
diff --git a/...src/infra/schulconnex-client/response/policies-info/schulconnex-policies-info-response.ts b/...src/infra/schulconnex-client/response/policies-info/schulconnex-policies-info-response.ts
@@ -1,16 +1,19 @@
-import { Type } from 'class-transformer';
-import { IsArray, IsObject, ValidateNested } from 'class-validator';
-import { SchulconnexPoliciesInfoPermissionResponse } from './schulconnex-policies-info-permission-response';
-import { SchulconnexPoliciesInfoTargetResponse } from './schulconnex-policies-info-target-response';
+import { PolymorphicArrayTransform } from '@shared/controller';
+import { ClassConstructor } from 'class-transformer';
+import { IsArray, ValidateNested } from 'class-validator';
+import { SchulconnexPoliciesInfoErrorResponse } from './schulconnex-policies-info-error-response';
+import { SchulconnexPoliciesInfoLicenseResponse } from './schulconnex-policies-info-license-response';
 
-export class SchulconnexPoliciesInfoResponse {
-	@IsObject()
-	@ValidateNested()
-	@Type(() => SchulconnexPoliciesInfoTargetResponse)
-	target!: SchulconnexPoliciesInfoTargetResponse;
+const policiesInfoDiscriminator = (
+	obj: unknown
+): ClassConstructor<SchulconnexPoliciesInfoLicenseResponse | SchulconnexPoliciesInfoErrorResponse> =>
+	typeof obj === 'object' && obj !== null && 'target' in obj && 'permission' in obj
+		? SchulconnexPoliciesInfoLicenseResponse
+		: SchulconnexPoliciesInfoErrorResponse;
 
+export class SchulconnexPoliciesInfoResponse {
 	@IsArray()
 	@ValidateNested({ each: true })
-	@Type(() => SchulconnexPoliciesInfoPermissionResponse)
-	permission!: SchulconnexPoliciesInfoPermissionResponse[];
+	@PolymorphicArrayTransform(policiesInfoDiscriminator)
+	data!: (SchulconnexPoliciesInfoLicenseResponse | SchulconnexPoliciesInfoErrorResponse)[];
 }
diff --git a/apps/server/src/infra/schulconnex-client/response/schulconnex-person-response.ts b/apps/server/src/infra/schulconnex-client/response/schulconnex-person-response.ts
@@ -2,6 +2,7 @@ import { Type } from 'class-transformer';
 import { IsObject, IsOptional, ValidateNested } from 'class-validator';
 import { SchulconnexGeburtResponse } from './schulconnex-geburt-response';
 import { SchulconnexNameResponse } from './schulconnex-name-response';
+import 'reflect-metadata';
 
 export class SchulconnexPersonResponse {
 	@IsObject()

diff --git a/apps/server/src/infra/schulconnex-client/schulconnex-api.interface.ts b/apps/server/src/infra/schulconnex-client/schulconnex-api.interface.ts
@@ -6,5 +6,5 @@ export interface SchulconnexApiInterface {
 
 	getPersonenInfo(params: SchulconnexPersonenInfoParams): Promise<SchulconnexResponse[]>;
 
-	getPoliciesInfo(accessToken: string, options?: { overrideUrl: string }): Promise<SchulconnexPoliciesInfoResponse[]>;
+	getPoliciesInfo(accessToken: string, options?: { overrideUrl: string }): Promise<SchulconnexPoliciesInfoResponse>;
 }
diff --git a/apps/server/src/infra/schulconnex-client/schulconnex-rest-client.spec.ts b/apps/server/src/infra/schulconnex-client/schulconnex-rest-client.spec.ts
@@ -5,10 +5,14 @@ import { axiosResponseFactory } from '@shared/testing';
 import { Logger } from '@src/core/logger';
 import { of } from 'rxjs';
 import { SchulconnexConfigurationMissingLoggable } from './loggable';
-import { SchulconnexPoliciesInfoResponse, SchulconnexResponse } from './response';
+import {
+	SchulconnexPoliciesInfoLicenseResponse,
+	SchulconnexPoliciesInfoResponse,
+	SchulconnexResponse,
+} from './response';
 import { SchulconnexRestClient } from './schulconnex-rest-client';
 import { SchulconnexRestClientOptions } from './schulconnex-rest-client-options';
-import { schulconnexPoliciesInfoResponseFactory, schulconnexResponseFactory } from './testing';
+import { schulconnexPoliciesInfoLicenseResponseFactory, schulconnexResponseFactory } from './testing';
 
 describe(SchulconnexRestClient.name, () => {
 	let client: SchulconnexRestClient;
@@ -199,7 +203,8 @@ describe(SchulconnexRestClient.name, () => {
 		describe('when requesting policies-info', () => {
 			const setup = () => {
 				const accessToken = 'accessToken';
-				const response: SchulconnexPoliciesInfoResponse[] = schulconnexPoliciesInfoResponseFactory.buildList(1);
+				const response: SchulconnexPoliciesInfoLicenseResponse[] =
+					schulconnexPoliciesInfoLicenseResponseFactory.buildList(1);
 
 				httpService.get.mockReturnValueOnce(of(axiosResponseFactory.build({ data: response })));
 
@@ -224,7 +229,7 @@ describe(SchulconnexRestClient.name, () => {
 			it('should return the response', async () => {
 				const { accessToken } = setup();
 
-				const result: SchulconnexPoliciesInfoResponse[] = await client.getPoliciesInfo(accessToken);
+				const result: SchulconnexPoliciesInfoResponse = await client.getPoliciesInfo(accessToken);
 
 				expect(result).toBeDefined();
 			});
@@ -234,7 +239,8 @@ describe(SchulconnexRestClient.name, () => {
 			const setup = () => {
 				const accessToken = 'accessToken';
 				const customUrl = 'https://override.url/policies-info';
-				const response: SchulconnexPoliciesInfoResponse[] = schulconnexPoliciesInfoResponseFactory.buildList(1);
+				const response: SchulconnexPoliciesInfoLicenseResponse[] =
+					schulconnexPoliciesInfoLicenseResponseFactory.buildList(1);
 
 				httpService.get.mockReturnValueOnce(of(axiosResponseFactory.build({ data: response })));