EW-1047: Add TSP System on Dev Environments

ansible/roles/schulcloud-server-init/templates/configmap_file_init.yml.j2

@@ -559,5 +559,37 @@ data:
 
         # ========== End of the Instance seed data configuration section.
 
+    # ========== Start of TSP system creation
+    if [[ $SC_THEME == "thr" ]]; then
+      echo "Adding TSP system to systems collection"
+
+      TSP_SYSTEM_OAUTH_CLIENT_SECRET=$(node scripts/secret.js -s $AES_KEY -e $TSP_SYSTEM_OAUTH_CLIENT_SECRET)
+      mongosh $DATABASE__URL --quiet --eval 'db.systems.insertOne(
+          {
+            "_id": ObjectId("66d707f5c5202ba10c5e6256"),
+            "alias": "TSP",
+            "displayName": "Thüringer Schulportal",
+            "type": "oauth",
+            "provisioningStrategy": "tsp",
+            "oauthConfig": {
+              "clientId": "'$TSP_SYSTEM_OAUTH_CLIENT_ID'",
+              "clientSecret": "'$TSP_SYSTEM_OAUTH_CLIENT_SECRET'",
+              "tokenEndpoint": "https://test2.schulportal-thueringen.de/auth/realms/TIS/protocol/openid-connect/token",
+              "grantType": "authorization_code",
+              "scope": "openid",
+              "responseType": "code",
+              "redirectUri": "https://{{ NAMESPACE }}.thr.dbildungscloud.dev/api/v3/sso/oauth",
+              "authEndpoint": "https://test2.schulportal-thueringen.de/auth/realms/TIS/protocol/openid-connect/auth",
+              "provider": "tsp",
+              "jwksEndpoint": "https://test2.schulportal-thueringen.de/auth/realms/TIS/protocol/openid-connect/certs",
+              "issuer": "https://test2.schulportal-thueringen.de/auth/realms/TIS"
+            }
+          }
+      );'
+
+      echo "Successfully added TSP system"
+    fi
+    # ========== End of TSP system creation
+
     # Database indexes synchronization, it's crucial until we have all the entities in NestJS app.
     npm run syncIndexes

ansible/roles/schulcloud-server-tspsync/tasks/main.yml

@@ -111,3 +111,24 @@
       state: "{{ 'present' if WITH_TSP_SYNC|bool else 'absent'}}"
     tags:
       - configmap
+
+  - name: remove old API TSP Sync Init Job
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      api_version: batch/v1
+      kind: Job
+      name: api-tsp-sync-init
+      state: absent
+      wait: yes
+    tags:
+      - job
+
+  - name: API TSP Sync Init Job
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      template: api-tsp-sync-init.yml.j2
+      state: present
+    tags:
+      - job

ansible/roles/schulcloud-server-tspsync/templates/api-tsp-sync-cronjob-configmap.yml.j2

@@ -15,4 +15,11 @@ data:
   IDENTITY_MANAGEMENT__INTERNAL_URI: "{{ IDENTITY_MANAGEMENT__INTERNAL_URI }}"
   IDENTITY_MANAGEMENT__EXTERNAL_URI: "{{ IDENTITY_MANAGEMENT__EXTERNAL_URI }}"
   IDENTITY_MANAGEMENT__TENANT: "{{ IDENTITY_MANAGEMENT__TENANT }}"
-  IDENTITY_MANAGEMENT__CLIENTID: "{{ IDENTITY_MANAGEMENT__CLIENTID }}"
+  IDENTITY_MANAGEMENT__CLIENTID: "{{ IDENTITY_MANAGEMENT__CLIENTID }}"
+  FEATURE_TSP_SYNC_ENABLED: "{{ FEATURE_TSP_SYNC_ENABLED }}"
+  TSP_API_CLIENT_BASE_URL: "{{ TSP_API_CLIENT_BASE_URL }}"
+  TSP_API_CLIENT_TOKEN_LIFETIME_MS: "{{ TSP_API_CLIENT_TOKEN_LIFETIME_MS }}"
+  TSP_SYNC_SCHOOL_LIMIT: "{{ TSP_SYNC_SCHOOL_LIMIT }}"
+  TSP_SYNC_DATA_LIMIT: "{{ TSP_SYNC_DATA_LIMIT }}"
+  TSP_SYNC_SCHOOL_DAYS_TO_FETCH: "{{ TSP_SYNC_SCHOOL_DAYS_TO_FETCH }}"
+  TSP_SYNC_DATA_DAYS_TO_FETCH: "{{ TSP_SYNC_DATA_DAYS_TO_FETCH }}"

ansible/roles/schulcloud-server-tspsync/templates/api-tsp-sync-cronjob.yml.j2

@@ -50,6 +50,8 @@ spec:
             envFrom:
             - configMapRef:
                 name: api-tsp-sync-cronjob-configmap
+            - configMapRef:
+                name: api-configmap
             - secretRef:
                 name: api-secret
             command: ['/bin/sh', '-c']

ansible/roles/schulcloud-server-tspsync/templates/api-tsp-sync-init.yml.j2

@@ -0,0 +1,40 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: api-tsp-sync-init
+  namespace: {{ NAMESPACE }}
+  labels:
+    app: api-tsp-sync-init
+spec:
+  template:
+    metadata:
+      labels:
+        app: api-tsp-sync-init
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        runAsNonRoot: true
+      containers:
+      - name: api-tsp-sync-init
+        image: {{ SCHULCLOUD_SERVER_IMAGE }}:{{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+        imagePullPolicy: IfNotPresent
+        envFrom:
+        - configMapRef:
+            name: api-tsp-sync-cronjob-configmap
+        - configMapRef:
+            name: api-configmap
+        - secretRef:
+            name: api-secret
+        command: ['/bin/sh', '-c']
+        args: ['npm run nest:start:sync tsp']
+        resources:
+          limits:
+            cpu: {{ API_CPU_LIMITS|default("2000m", true) }}
+            memory: {{ API_MEMORY_LIMITS|default("2Gi", true) }}
+          requests:
+            cpu: {{ API_CPU_REQUESTS|default("100m", true) }}
+            memory: {{ API_MEMORY_REQUESTS|default("150Mi", true) }}
+      restartPolicy: Never
+  backoffLimit: 5

apps/server/src/console/console.ts

@@ -16,6 +16,7 @@ void bootstrap.init().then(async (app) => {
 		await app.init();
 		await bootstrap.boot();
 		await app.close();
+		process.exit(0);
 	} catch (e) {
 		// eslint-disable-next-line no-console
 		console.error(e);

apps/server/src/infra/tsp-client/tsp-client-config.ts

@@ -1,4 +1,4 @@
 export interface TspClientConfig {
-	TSP_API_BASE_URL: string;
-	TSP_API_TOKEN_LIFETIME_MS: number;
+	TSP_API_CLIENT_BASE_URL: string;
+	TSP_API_CLIENT_TOKEN_LIFETIME_MS: number;
 }

apps/server/src/infra/tsp-client/tsp-client-factory.integration.spec.ts

@@ -20,9 +20,9 @@ describe('TspClientFactory Integration', () => {
 				createMock<ConfigService>({
 					getOrThrow: (key: string) => {
 						switch (key) {
-							case 'TSP_API_BASE_URL':
+							case 'TSP_API_CLIENT_BASE_URL':
 								return 'https://test2.schulportal-thueringen.de/tip-ms/api';
-							case 'TSP_API_TOKEN_LIFETIME_MS':
+							case 'TSP_API_CLIENT_TOKEN_LIFETIME_MS':
 								return 30_000;
 							default:
 								throw new Error(`Unknown key: ${key}`);

apps/server/src/infra/tsp-client/tsp-client-factory.spec.ts

@@ -5,13 +5,15 @@ import { ServerConfig } from '@modules/server';
 import { ConfigService } from '@nestjs/config';
 import { Test, TestingModule } from '@nestjs/testing';
 import axios from 'axios';
+import { DefaultEncryptionService, EncryptionService } from '../encryption';
 import { TspClientFactory } from './tsp-client-factory';
 
 describe('TspClientFactory', () => {
 	let module: TestingModule;
 	let sut: TspClientFactory;
 	let configServiceMock: DeepMocked<ConfigService<ServerConfig, true>>;
 	let oauthAdapterServiceMock: DeepMocked<OauthAdapterService>;
+	let encryptionService: DeepMocked<EncryptionService>;
 
 	beforeAll(async () => {
 		module = await Test.createTestingModule({
@@ -26,22 +28,27 @@ describe('TspClientFactory', () => {
 					useValue: createMock<ConfigService<ServerConfig, true>>({
 						getOrThrow: (key: string) => {
 							switch (key) {
-								case 'TSP_API_BASE_URL':
+								case 'TSP_API_CLIENT_BASE_URL':
 									return faker.internet.url();
-								case 'TSP_API_TOKEN_LIFETIME_MS':
+								case 'TSP_API_CLIENT_TOKEN_LIFETIME_MS':
 									return faker.number.int();
 								default:
 									throw new Error(`Unknown key: ${key}`);
 							}
 						},
 					}),
 				},
+				{
+					provide: DefaultEncryptionService,
+					useValue: createMock<EncryptionService>(),
+				},
 			],
 		}).compile();
 
 		sut = module.get(TspClientFactory);
 		configServiceMock = module.get(ConfigService);
 		oauthAdapterServiceMock = module.get(OauthAdapterService);
+		encryptionService = module.get(DefaultEncryptionService);
 	});
 
 	afterAll(async () => {
@@ -118,6 +125,7 @@ describe('TspClientFactory', () => {
 
 			expect(response).toBeDefined();
 			expect(configServiceMock.getOrThrow).toHaveBeenCalledTimes(0);
+			expect(encryptionService.decrypt).toHaveBeenCalled();
 		});
 	});
 

apps/server/src/infra/tsp-client/tsp-client-factory.ts

@@ -1,9 +1,10 @@
-import { Injectable } from '@nestjs/common';
+import { Inject, Injectable } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { OauthAdapterService } from '@src/modules/oauth';
 import { OAuthGrantType } from '@src/modules/oauth/interface/oauth-grant-type.enum';
 import { ClientCredentialsGrantTokenRequest } from '@src/modules/oauth/service/dto';
 import * as jwt from 'jsonwebtoken';
+import { DefaultEncryptionService, EncryptionService } from '../encryption';
 import { Configuration, ExportApiFactory, ExportApiInterface } from './generated';
 import { TspClientConfig } from './tsp-client-config';
 
@@ -25,10 +26,11 @@ export class TspClientFactory {
 
 	constructor(
 		private readonly oauthAdapterService: OauthAdapterService,
-		configService: ConfigService<TspClientConfig, true>
+		configService: ConfigService<TspClientConfig, true>,
+		@Inject(DefaultEncryptionService) private readonly encryptionService: EncryptionService
 	) {
-		this.baseUrl = configService.getOrThrow<string>('TSP_API_BASE_URL');
-		this.tokenLifetime = configService.getOrThrow<number>('TSP_API_TOKEN_LIFETIME_MS');
+		this.baseUrl = configService.getOrThrow<string>('TSP_API_CLIENT_BASE_URL');
+		this.tokenLifetime = configService.getOrThrow<number>('TSP_API_CLIENT_TOKEN_LIFETIME_MS');
 	}
 
 	public createExportClient(params: FactoryParams): ExportApiInterface {
@@ -51,9 +53,10 @@ export class TspClientFactory {
 			return this.cachedToken;
 		}
 
+		const clientSecret = this.encryptionService.decrypt(params.clientSecret);
 		const payload = new ClientCredentialsGrantTokenRequest({
 			client_id: params.clientId,
-			client_secret: params.clientSecret,
+			client_secret: clientSecret,
 			grant_type: OAuthGrantType.CLIENT_CREDENTIALS_GRANT,
 		});
 

apps/server/src/infra/tsp-client/tsp-client.module.ts

@@ -1,9 +1,10 @@
 import { OauthModule } from '@modules/oauth';
 import { Module } from '@nestjs/common';
+import { EncryptionModule } from '../encryption';
 import { TspClientFactory } from './tsp-client-factory';
 
 @Module({
-	imports: [OauthModule],
+	imports: [OauthModule, EncryptionModule],
 	providers: [TspClientFactory],
 	exports: [TspClientFactory],
 })

apps/server/src/modules/server/server.config.ts

@@ -309,8 +309,8 @@ const config: ServerConfig = {
 	FEATURE_SANIS_GROUP_PROVISIONING_ENABLED: Configuration.get('FEATURE_SANIS_GROUP_PROVISIONING_ENABLED') as boolean,
 	FEATURE_AI_TUTOR_ENABLED: Configuration.get('FEATURE_AI_TUTOR_ENABLED') as boolean,
 	FEATURE_ROOMS_ENABLED: Configuration.get('FEATURE_ROOMS_ENABLED') as boolean,
-	TSP_API_BASE_URL: Configuration.get('TSP_API_BASE_URL') as string,
-	TSP_API_TOKEN_LIFETIME_MS: Configuration.get('TSP_API_TOKEN_LIFETIME_MS') as number,
+	TSP_API_CLIENT_BASE_URL: Configuration.get('TSP_API_CLIENT_BASE_URL') as string,
+	TSP_API_CLIENT_TOKEN_LIFETIME_MS: Configuration.get('TSP_API_CLIENT_TOKEN_LIFETIME_MS') as number,
 	TSP_SYNC_SCHOOL_LIMIT: Configuration.get('TSP_SYNC_SCHOOL_LIMIT') as number,
 	TSP_SYNC_SCHOOL_DAYS_TO_FETCH: Configuration.get('TSP_SYNC_SCHOOL_DAYS_TO_FETCH') as number,
 	TSP_SYNC_DATA_LIMIT: Configuration.get('TSP_SYNC_DATA_LIMIT') as number,

config/default.schema.json

@@ -174,7 +174,12 @@
 			"default": "",
 			"description": "The key used to sign/verify TSP request tokens."
 		},
-		"TSP_API_TOKEN_LIFETIME_MS": {
+		"TSP_API_CLIENT_BASE_URL": {
+			"type": "string",
+			"default": "",
+			"description": "The TSP API base URL."
+		},
+		"TSP_API_CLIENT_TOKEN_LIFETIME_MS": {
 			"type": "number",
 			"default": "30000",
 			"description": "The TSP token lifetime in milliseconds."

sonar-project.properties

@@ -4,7 +4,7 @@ sonar.sources=.
 sonar.tests=.
 sonar.test.inclusions=**/*.spec.ts
 sonar.exclusions=**/*.js,jest.config.ts,globalSetup.ts,globalTeardown.ts,**/*.app.ts,**/seed-data/*.ts,**/migrations/mikro-orm/*.ts,**/etherpad-api-client/**/*.ts,**/authorization-api-client/**/*.ts, **/course-api-client/**/*.ts,**/board-api-client/**/*.ts,**/generated/**/*.ts,**/room-api-client/**/*.ts,**/cards-api-client/**/*.ts,**/lessons-api-client/**/*.ts
-sonar.coverage.exclusions=**/board-management.uc.ts,**/*.module.ts,**/*.factory.ts,**/migrations/mikro-orm/*.ts,**/globalSetup.ts,**/globalTeardown.ts,**/etherpad-api-client/**/*.ts,**/authorization-api-client/**/*.ts, **/course-api-client/**/*.ts,**/board-api-client/**/*.ts,**/generated/**/*.ts,**/room-api-client/**/*.ts
+sonar.coverage.exclusions=**/board-management.uc.ts,**/*.module.ts,**/*.factory.ts,**/migrations/mikro-orm/*.ts,**/globalSetup.ts,**/globalTeardown.ts,**/etherpad-api-client/**/*.ts,**/authorization-api-client/**/*.ts, **/course-api-client/**/*.ts,**/board-api-client/**/*.ts,**/generated/**/*.ts,**/room-api-client/**/*.ts,apps/server/src/console/console.ts
 sonar.cpd.exclusions=**/controller/dto/**/*.ts,**/api/dto/**/*.ts,**/shared/testing/factory/*.factory.ts
 sonar.javascript.lcov.reportPaths=merged-lcov.info
 sonar.typescript.tsconfigPaths=tsconfig.json,src/apps/server/tsconfig.app.json