Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deploy 2023.04.2 to test #1371

Merged
merged 43 commits into from Apr 20, 2023
Merged

Deploy 2023.04.2 to test #1371

merged 43 commits into from Apr 20, 2023

Conversation

thekaveman
Copy link
Member

No description provided.

thekaveman and others added 30 commits April 13, 2023 21:48
@thekaveman
feat(settings): enforce strict Content Security Policy
6c65db8 
* disallow base-uri
* disallow object-src
* disallow unsafe-inline for script-src
* require nonce for script-src
@thekaveman
chore: implement nonce on <script> tags
9b20fa7
@thekaveman
chore(analytics): add nonce to inject <script> tag
ad9730d
@thekaveman
chore(enrollment): add nonce to payment processor script
24d954f 
use the more generic $.ajax() to download the script and apply the nonce
before execution
@thekaveman
feat(sentry): support CSP report-uri directive
2faabec 
sentry has out of the box support for receiving CSP reports
https://docs.sentry.io/product/security-policy-reporting/
@thekaveman
docs: strict CSP, Sentry report-uri config
02b5ef9
@thekaveman
docs: reword to more generic Agency Cards
1f7c9e9
@thekaveman
docs: update interconnections graph
0b2b230 
* add sentry
* make more generic Courtesy Cards --> Agency Cards
@thekaveman
docs: fix cc_data --> ac_data
bceb52a
@pre-commit-ci
chore(pre-commit): autoupdate hooks
9d0c22a 
updates:
- [github.com/Riverside-Healthcare/djLint: v1.19.17 → v1.23.0](djlint/djLint@v1.19.17...v1.23.0)
@dependabot
chore(deps-dev): bump cypress from 12.9.0 to 12.10.0 in /tests/cypress
c5227b9 
Bumps [cypress](https://github.com/cypress-io/cypress) from 12.9.0 to 12.10.0.
- [Release notes](https://github.com/cypress-io/cypress/releases)
- [Changelog](https://github.com/cypress-io/cypress/blob/develop/CHANGELOG.md)
- [Commits](cypress-io/cypress@v12.9.0...v12.10.0)

---
updated-dependencies:
- dependency-name: cypress
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@thekaveman
chore(nginx): add conf file from base image
9ecf172 
cal-itp/docker-python-web defines the default nginx.conf

take a copy so we can override for benefits
@thekaveman
feat(nginx): 404 known scraping targets
4f02d5d 
based on data from amplitude and sentry
@thekaveman
refactor: move rate limit from Django to nginx
c3b60ba
@thekaveman
fix(nginx): selective rate-limit for POST
8737676
@thekaveman
refactor(nginx): include common directives
e70b0c5
@thekaveman
docs(rate-limit): update with nginx config
ca0731c
@thekaveman
fix(tests): mock settings on middleware module
53fd701 
settings was removed from the session module with rate-limit refactor

this test shouldn't use the session module anyway, as it is testing
a middleware
@thekaveman
chore(terraform): remove unused rate limit env vars
78a77c7
@thekaveman
refactor(tests): use helper for CC setup
6fb30ac
@thekaveman
refactor(tests): rate limit wait helper
2ddaaf3 
POST to /eligibility/confirm needs to respect rate limit
@thekaveman
test(nginx): assert 404 on known scraping targets
8c0a3b5
@thekaveman
fix(nginx): filename optional
3ba8cc5 
checking for extension only
@thekaveman
fix(tests): simplify, ensure nginx throws 404
1f33670
@thekaveman
fix(tests): export rate limit consts
5b081bc 
otherwise these are undefined in the tests that need them
@thekaveman
refactor(tests): move helpers out of specs
120a962
@thekaveman
test(rate-limit): ensure nginx returns the failure
a1a3c43
@thekaveman
Docs: make Agency Cards use-case more generic (#1361)
48fa60b
@thekaveman
chore(pre-commit): autoupdate hooks (#1362)
f2e1ff8
@thekaveman
chore(deps-dev): bump cypress from 12.9.0 to 12.10.0 in /tests/cypress (
639b786 
#1363)
@thekaveman thekaveman requested a review from a team as a code owner April 20, 2023 22:04
@github-actions github-actions bot added docker Application container, devcontainer, Compose, etc. front-end HTML/CSS/JavaScript and Django templates back-end Django views, sessions, middleware, models, migrations etc. tests Related to automated testing (unit, UI, integration, etc.) and removed front-end HTML/CSS/JavaScript and Django templates labels Apr 20, 2023
@thekaveman thekaveman changed the title Release 2023.04.2 to test Deploy 2023.04.2 to test Apr 20, 2023
@thekaveman thekaveman mentioned this pull request Apr 20, 2023
Closed
13 tasks
@thekaveman thekaveman merged commit 235b046 into test Apr 20, 2023
22 checks passed
@github-actions github-actions bot added the deployment [auto] Pull requests that deploy to test or prod label Apr 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@angela-tran angela-tran angela-tran approved these changes

Assignees
No one assigned
Labels
back-end Django views, sessions, middleware, models, migrations etc. deployment [auto] Pull requests that deploy to test or prod docker Application container, devcontainer, Compose, etc. tests Related to automated testing (unit, UI, integration, etc.)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@thekaveman @angela-tran