Revise app client process by jusdino · Pull Request #989 · csg-org/CompactConnect

jusdino · 2025-08-05T22:15:46Z

Description List

Tweaked the docs and app_client script a bit to split secrets from context of their use

While I worked on #981

Summary by CodeRabbit

Documentation
- Updated credential transmission instructions to separate sensitive credentials (clientId and clientSecret) from contextual information, providing a clearer process for secure sharing.
- Added a dedicated email template section for sharing contextual details, including compact name, state, and relevant URLs.
- Improved clarity and formatting in onboarding instructions for IT staff.

coderabbitai · 2025-08-05T22:15:59Z

Walkthrough

The changes update onboarding documentation and the app client creation script to separate the output of sensitive credentials from contextual information. The script now generates a credentials JSON containing only clientId and clientSecret, and a distinct email template with contextual details. Documentation was revised to reflect and clarify this new process.

Changes

Cohort / File(s)	Change Summary
App Client Creation Script `backend/compact-connect/app_clients/bin/create_app_client.py`	Refactored to separate sensitive credentials (output as JSON) from contextual information (output as an email template). Added `print_email_template` function. Simplified `print_credentials` function. Updated main control flow.
Onboarding Documentation `backend/compact-connect/app_clients/README.md`, `backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md`	Updated to clarify that credentials JSON now contains only `clientId` and `clientSecret`. Contextual information is now provided separately via email. Adjusted instructions and examples accordingly.

Sequence Diagram(s)

sequenceDiagram
    participant User
    participant Script

    User->>Script: Run create_app_client.py
    Script->>User: Output Credentials JSON (clientId, clientSecret)
    Script->>User: Output Email Template (contextual info, link placeholder)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

Feat/create app client generation script #921: Introduced the original interactive app client creation script and related documentation, which this PR directly builds upon by refactoring the output structure.

Suggested reviewers

jlkravitz

Poem

A rabbit with paws so neat and keen,
Splits secrets from context, keeps things clean.
Credentials in JSON, snug and tight,
Context in emails, clear and right.
With scripts and docs now up to date—
Safe onboarding, isn’t it great? 🐇✨

Note

⚡️ Unit Test Generation is now available in beta!

Learn more here, or try it out under "Finishing Touches" below.

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between cb83b95 and 842e96a.

📒 Files selected for processing (3)

backend/compact-connect/app_clients/README.md (1 hunks)
backend/compact-connect/app_clients/bin/create_app_client.py (3 hunks)
backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md (9 hunks)

🧰 Additional context used

🧠 Learnings (9)

📓 Common learnings

Learnt from: landonshumway-ia
PR: csg-org/CompactConnect#798
File: backend/compact-connect/docs/onboarding/JURISDICTION_COMPACT_ONBOARDING.md:117-117
Timestamp: 2025-05-13T22:33:53.986Z
Learning: The app_clients directory is located at the root of the compact-connect directory, so the correct relative path from docs/onboarding is ../../app_clients/README.md

📚 Learning: the app_clients directory is located at the root of the compact-connect directory, so the correct re...

Learnt from: landonshumway-ia
PR: csg-org/CompactConnect#798
File: backend/compact-connect/docs/onboarding/JURISDICTION_COMPACT_ONBOARDING.md:117-117
Timestamp: 2025-05-13T22:33:53.986Z
Learning: The app_clients directory is located at the root of the compact-connect directory, so the correct relative path from docs/onboarding is ../../app_clients/README.md

Applied to files:

backend/compact-connect/app_clients/README.md
backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md
backend/compact-connect/app_clients/bin/create_app_client.py

📚 Learning: in the compactconnect frontend codebase, the team prefers to keep non-dynamic text directly in vue t...

Learnt from: rmolinares
PR: csg-org/CompactConnect#905
File: webroot/src/components/UpdateHomeJurisdiction/UpdateHomeJurisdiction.vue:32-41
Timestamp: 2025-07-03T15:35:57.893Z
Learning: In the CompactConnect frontend codebase, the team prefers to keep non-dynamic text directly in Vue templates rather than moving it to computed properties in TypeScript modules, as this approach prevents cluttering the TS files with template labels.

Applied to files:

backend/compact-connect/app_clients/README.md

📚 Learning: the compactconnect application uses a rest api gateway, not http api, so using `event.get('resource'...

Learnt from: landonshumway-ia
PR: csg-org/CompactConnect#796
File: backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_users.py:29-36
Timestamp: 2025-05-23T15:35:20.621Z
Learning: The CompactConnect application uses a REST API Gateway, not HTTP API, so using `event.get('resource')` for path routing is appropriate and reliable. There are no plans to use HTTP API integration in the near future.

Applied to files:

backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md

📚 Learning: in the compact_configured_states_871 migration, existing jurisdiction configurations that have licen...

Learnt from: landonshumway-ia
PR: csg-org/CompactConnect#882
File: backend/compact-connect/lambdas/python/migration/compact_configured_states_871/main.py:127-130
Timestamp: 2025-06-26T16:42:00.781Z
Learning: In the compact_configured_states_871 migration, existing jurisdiction configurations that have licenseeRegistrationEnabled: true are migrated with isLive: true for backwards compatibility. This prevents breaking existing live functionality since those states are already operational. The migration preserves the current live state of jurisdictions to maintain service continuity, while new states added after migration can start with isLive: false and be controlled by compact admins.

Applied to files:

backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md

📚 Learning: in compactconnect, landonshumway-ia prefers using the concrete `key` type instead of the `ikey` inte...

Learnt from: landonshumway-ia
PR: csg-org/CompactConnect#907
File: backend/compact-connect/stacks/persistent_stack/provider_table.py:0-0
Timestamp: 2025-07-21T20:45:42.420Z
Learning: In CompactConnect, landonshumway-ia prefers using the concrete `Key` type instead of the `IKey` interface for encryption_key parameters to intentionally prevent imported keys from being used. This is a security-conscious decision to ensure all encryption keys are newly created and managed within their infrastructure.

Applied to files:

backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md

📚 Learning: in compactconnect tests, hardcoded values (like license type abbreviations 'slp') in test queries ar...

Learnt from: landonshumway-ia
PR: csg-org/CompactConnect#769
File: backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_encumbrance.py:138-147
Timestamp: 2025-04-29T02:52:40.532Z
Learning: In CompactConnect tests, hardcoded values (like license type abbreviations 'slp') in test queries are sometimes used intentionally rather than using dynamic lookups. This is a deliberate design decision to make tests fail if default test data changes, requiring developers to consciously update related tests.

Applied to files:

backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md

📚 Learning: in the compactconnect project, authentication/authorization failures like misconfigured authorizers ...

Learnt from: landonshumway-ia
PR: csg-org/CompactConnect#769
File: backend/compact-connect/lambdas/python/provider-data-v1/handlers/encumbrance.py:39-41
Timestamp: 2025-04-29T02:09:36.291Z
Learning: In the CompactConnect project, authentication/authorization failures like misconfigured authorizers should be allowed to propagate as 500 errors rather than being caught and converted to 4xx errors, as this is intentional to trigger alerts for critical system issues.

Applied to files:

backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md

📚 Learning: in the compactconnect codebase, compact values come from custom attributes on the user's cognito acc...

Learnt from: landonshumway-ia
PR: csg-org/CompactConnect#929
File: backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py:1809-1814
Timestamp: 2025-07-15T02:02:56.052Z
Learning: In the CompactConnect codebase, compact values come from custom attributes on the user's Cognito account, not from user input. When get_compact_configuration raises CCNotFoundException, it should be allowed to propagate as a 500 error (CCInternalException) to trigger alerts for system configuration issues, rather than being treated as a 4xx user error.

Applied to files:

backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md

🪛 LanguageTool

backend/compact-connect/app_clients/it_staff_onboarding_instructions/README.md

[grammar] ~28-~28: Ensure spelling is correct
Context: ... password manager or secrets management system 2. Do not share these credentials with unau...