Skip to content

Commit 4a726b9

Browse files
arcuri82arcuri82
committed
pay-publicapi initial commit
1 parent 5fd4836 commit 4a726b9

472 files changed

Lines changed: 48475 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎jdk_11_maven/cs/rest/pay-publicapi/.secrets.baseline‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
{
2+
"version": "1.4.0",
3+
"plugins_used": [
4+
{
5+
"name": "ArtifactoryDetector"
6+
},
7+
{
8+
"name": "AWSKeyDetector"
9+
},
10+
{
11+
"name": "AzureStorageKeyDetector"
12+
},
13+
{
14+
"name": "Base64HighEntropyString",
15+
"limit": 4.5
16+
},
17+
{
18+
"name": "BasicAuthDetector"
19+
},
20+
{
21+
"name": "CloudantDetector"
22+
},
23+
{
24+
"name": "DiscordBotTokenDetector"
25+
},
26+
{
27+
"name": "GitHubTokenDetector"
28+
},
29+
{
30+
"name": "HexHighEntropyString",
31+
"limit": 3.0
32+
},
33+
{
34+
"name": "IbmCloudIamDetector"
35+
},
36+
{
37+
"name": "IbmCosHmacDetector"
38+
},
39+
{
40+
"name": "JwtTokenDetector"
41+
},
42+
{
43+
"name": "KeywordDetector",
44+
"keyword_exclude": ""
45+
},
46+
{
47+
"name": "MailchimpDetector"
48+
},
49+
{
50+
"name": "NpmDetector"
51+
},
52+
{
53+
"name": "PrivateKeyDetector"
54+
},
55+
{
56+
"name": "SendGridDetector"
57+
},
58+
{
59+
"name": "SlackDetector"
60+
},
61+
{
62+
"name": "SoftlayerDetector"
63+
},
64+
{
65+
"name": "SquareOAuthDetector"
66+
},
67+
{
68+
"name": "StripeDetector"
69+
},
70+
{
71+
"name": "TwilioKeyDetector"
72+
}
73+
],
74+
"filters_used": [
75+
{
76+
"path": "detect_secrets.filters.allowlist.is_line_allowlisted"
77+
},
78+
{
79+
"path": "detect_secrets.filters.common.is_baseline_file",
80+
"filename": ".secrets.baseline"
81+
},
82+
{
83+
"path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
84+
"min_level": 2
85+
},
86+
{
87+
"path": "detect_secrets.filters.heuristic.is_indirect_reference"
88+
},
89+
{
90+
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
91+
},
92+
{
93+
"path": "detect_secrets.filters.heuristic.is_lock_file"
94+
},
95+
{
96+
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
97+
},
98+
{
99+
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
100+
},
101+
{
102+
"path": "detect_secrets.filters.heuristic.is_prefixed_with_dollar_sign"
103+
},
104+
{
105+
"path": "detect_secrets.filters.heuristic.is_sequential_string"
106+
},
107+
{
108+
"path": "detect_secrets.filters.heuristic.is_swagger_file"
109+
},
110+
{
111+
"path": "detect_secrets.filters.heuristic.is_templated_secret"
112+
}
113+
],
114+
"results": {
115+
"openapi/publicapi_spec.json": [
116+
{
117+
"type": "Base64 High Entropy String",
118+
"filename": "openapi/publicapi_spec.json",
119+
"hashed_secret": "0ca33fee4444c18265ffce030b9e327b54f05ae0",
120+
"is_verified": false,
121+
"line_number": 602
122+
}
123+
],
124+
"src/main/java/uk/gov/pay/api/model/CreateCardPaymentRequest.java": [
125+
{
126+
"type": "Base64 High Entropy String",
127+
"filename": "src/main/java/uk/gov/pay/api/model/CreateCardPaymentRequest.java",
128+
"hashed_secret": "0ca33fee4444c18265ffce030b9e327b54f05ae0",
129+
"is_verified": false,
130+
"line_number": 202
131+
}
132+
],
133+
"src/main/java/uk/gov/pay/api/resources/PaymentsResource.java": [
134+
{
135+
"type": "Base64 High Entropy String",
136+
"filename": "src/main/java/uk/gov/pay/api/resources/PaymentsResource.java",
137+
"hashed_secret": "0ca33fee4444c18265ffce030b9e327b54f05ae0",
138+
"is_verified": false,
139+
"line_number": 241
140+
}
141+
],
142+
"src/test/java/uk/gov/pay/api/filter/AuthorizationValidationFilterTest.java": [
143+
{
144+
"type": "Secret Keyword",
145+
"filename": "src/test/java/uk/gov/pay/api/filter/AuthorizationValidationFilterTest.java",
146+
"hashed_secret": "70abceeb20d82fc2d55e8934d1ad05ad17609752",
147+
"is_verified": false,
148+
"line_number": 36
149+
},
150+
{
151+
"type": "Secret Keyword",
152+
"filename": "src/test/java/uk/gov/pay/api/filter/AuthorizationValidationFilterTest.java",
153+
"hashed_secret": "a0936a38d2c31ad225d670f529a82319fc5bb915",
154+
"is_verified": false,
155+
"line_number": 87
156+
}
157+
],
158+
"src/test/resources/config/empty-elevated-accounts-test-config.yaml": [
159+
{
160+
"type": "Secret Keyword",
161+
"filename": "src/test/resources/config/empty-elevated-accounts-test-config.yaml",
162+
"hashed_secret": "3d4478f77d368235803ceb52bbd45b7240e6af62",
163+
"is_verified": false,
164+
"line_number": 48
165+
}
166+
],
167+
"src/test/resources/config/test-config.yaml": [
168+
{
169+
"type": "Secret Keyword",
170+
"filename": "src/test/resources/config/test-config.yaml",
171+
"hashed_secret": "3d4478f77d368235803ceb52bbd45b7240e6af62",
172+
"is_verified": false,
173+
"line_number": 50
174+
}
175+
],
176+
"src/test/resources/pacts/publicapi-connector-get-payment-refund.json": [
177+
{
178+
"type": "Base64 High Entropy String",
179+
"filename": "src/test/resources/pacts/publicapi-connector-get-payment-refund.json",
180+
"hashed_secret": "4c39a6a28507c3d7ea6de26da0bd1d27cff4a4af",
181+
"is_verified": false,
182+
"line_number": 25
183+
}
184+
],
185+
"src/test/resources/pacts/publicapi-ledger-get-one-agreement.json": [
186+
{
187+
"type": "Base64 High Entropy String",
188+
"filename": "src/test/resources/pacts/publicapi-ledger-get-one-agreement.json",
189+
"hashed_secret": "2d893b1b122fa0a884e02bb0a5b20764a80ef6e4",
190+
"is_verified": false,
191+
"line_number": 22
192+
}
193+
]
194+
},
195+
"generated_at": "2023-09-06T14:26:21Z"
196+
}

‎jdk_11_maven/cs/rest/pay-publicapi/CONTRIBUTING.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# GOV.UK Pay contributing guide
2+
3+
This guide covers the basics of how to contribute to the GOV.UK Pay project.
4+
5+
## Pull requests
6+
The team's pull request checklist can be found [here](https://github.com/alphagov/pay-team-manual/blob/master/docs/development-processes/pull-request-checklist.md)
7+
8+
## Contributions from beyond the team
9+
If you have an idea to share or a feature to request to raise please contact the GOV.UK Pay team govuk-pay-support@digital.cabinet-office.gov.uk.
10+
11+
If this is a security issue please do not submit a pull request or raise a GitHub issue, instead, please read the disclosure process [here](/README.md#responsible-disclosure).

‎jdk_11_maven/cs/rest/pay-publicapi/Dockerfile‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
FROM eclipse-temurin:11-jre-alpine@sha256:77f7c2509dba2f346bf042e424d395b16b0c432ee1eabf0cbcc17922dc900c73
2+
3+
RUN ["apk", "--no-cache", "upgrade"]
4+
5+
ARG DNS_TTL=15
6+
7+
# Default to UTF-8 file.encoding
8+
ENV LANG C.UTF-8
9+
10+
RUN echo networkaddress.cache.ttl=$DNS_TTL >> "$JAVA_HOME/conf/security/java.security"
11+
12+
RUN ["apk", "add", "--no-cache", "bash", "tini"]
13+
14+
ENV PORT 8080
15+
ENV ADMIN_PORT 8081
16+
17+
EXPOSE 8080
18+
EXPOSE 8081
19+
20+
WORKDIR /app
21+
22+
ADD docker-startup.sh /app/docker-startup.sh
23+
ADD target/*.yaml /app/
24+
ADD target/pay-*-allinone.jar /app/
25+
26+
ENTRYPOINT ["tini", "-e", "143", "--"]
27+
28+
CMD ["bash", "./docker-startup.sh"]

‎jdk_11_maven/cs/rest/pay-publicapi/LICENSE‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2015 Crown Copyright (Government Digital Service)
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.
22+

‎jdk_11_maven/cs/rest/pay-publicapi/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# pay-publicapi
2+
3+
GOV.UK Pay Public API service in Java (Dropwizard)
4+
5+
## General configuration
6+
7+
Configuration of the application is performed via environment variables, some of which are mandatory.
8+
9+
| Variable | Required? | Default | Description |
10+
| --------------------------- | --------- | -------------- | ---------------------------------------------------------------------------------------------------------- |
11+
| `ADMIN_PORT` | No | 8081 | The port number to listen for Dropwizard admin requests on. |
12+
| `ALLOW_HTTP_FOR_RETURN_URL` | No | false | Whether to allow service return URLs to be non-HTTPS |
13+
| `CONNECTOR_URL` | Yes | N/A | The URL to the [connector](https://github.com/alphagov/pay-connector) service |
14+
| `DISABLE_INTERNAL_HTTPS` | No | false | Disable secure connection for calls to internal APIs |
15+
| `PORT` | No | 8080 | The port number to listen for requests on. |
16+
| `PUBLICAPI_BASE` | Yes | N/A | The base URL clients can use to reach the API. e.g. http://api.example.org:1234/ |
17+
| `PUBLIC_AUTH_URL` | Yes | N/A | The URL to the [publicauth](https://github.com/alphagov/pay-publicauth) service |
18+
| `REDIS_URL` | No | localhost:6379 | The location of the redis endpoint to store rate-limiter information in |
19+
| `TOKEN_API_HMAC_SECRET` | Yes | N/A | Hmac secret to be used to validate that the given token is genuine (Api Key = Token + Hmac (Token, Secret) |
20+
21+
## Rate limiting
22+
23+
The application will rate-limit incoming API requests, recording the current
24+
rate limit state in Redis (see `REDIS_URL` above). The rate-limiting behaviour
25+
can be tuned via the following environment variables which all have default
26+
values:
27+
28+
| Variable | Default | Description |
29+
| ---------------------------------- | ------------ | ------------------------------------------ |
30+
| `RATE_LIMITER_VALUE` | Default 75 | Number of non-`POST` requests allowed per `RATE_LIMITER_PER_MILLIS` milliseconds |
31+
| `RATE_LIMITER_VALUE_POST` | Default 15 | Number of `POST` requests allowed per `RATE_LIMITER_PER_MILLIS` milliseconds |
32+
| `RATE_LIMITER_ELEVATED_ACCOUNTS` | N/A | Comma-separated list of accounts to which `..._ELEVATED_...` limits apply (example: `1,2,3`) |
33+
| `RATE_LIMITER_ELEVATED_VALUE_GET` | Default 100 | Number of non-`POST` requests allowed per `RATE_LIMITER_PER_MILLIS` milliseconds (for `RATE_LIMITER_ELEVATED_ACCOUNTS`) |
34+
| `RATE_LIMITER_ELEVATED_VALUE_POST` | Default 40 | Number of `POST` requests allowed per `RATE_LIMITER_PER_MILLIS` milliseconds (for `RATE_LIMITER_ELEVATED_ACCOUNTS`) |
35+
| `RATE_LIMITER_VALUE_PER_NODE` | Default 25 | Number of non-`POST` requests allowed per `RATE_LIMITER_PER_MILLIS` milliseconds for a given client |
36+
| `RATE_LIMITER_VALUE_PER_NODE_POST` | Default 5 | Number of `POST` requests allowed per `RATE_LIMITER_PER_MILLIS` milliseconds for a given client |
37+
| `RATE_LIMITER_PER_MILLIS` | Default 1000 | Rate limiter time window |
38+
| `RATE_LIMITER_LOW_TRAFFIC_ACCOUNTS` | N/A | Comma-separated list of accounts to which `..._LOW_TRAFFIC_...` limits apply (example: `5,6,7`) |
39+
| `RATE_LIMITER_LOW_TRAFFIC_VALUE_GET` | Default 4500 | Number of non-`POST` requests allowed per `RATE_LIMITER_LOW_TRAFFIC_PER_MILLIS` in milliseconds for a given account (for `RATE_LIMITER_LOW_TRAFFIC_ACCOUNTS`) |
40+
| `RATE_LIMITER_LOW_TRAFFIC_VALUE_POST`| Default 1 | Number of `POST` requests allowed per `RATE_LIMITER_LOW_TRAFFIC_PER_MILLIS` in milliseconds (for `RATE_LIMITER_LOW_TRAFFIC_ACCOUNTS`) |
41+
| `RATE_LIMITER_LOW_TRAFFIC_PER_MILLIS`| Default 60000| rate limit internal per `RATE_LIMITER_LOW_TRAFFIC_PER_MILLIS` (in milliseconds) for `RATE_LIMITER_LOW_TRAFFIC_ACCOUNTS` |
42+
43+
## API specification
44+
45+
Read our [developer documentation](https://docs.payments.service.gov.uk/#gov-uk-pay-documentation) for guidance on using the API.
46+
47+
For more detailed information you can use our [OpenAPI specifiation](https://github.com/alphagov/pay-publicapi/blob/master/openapi/publicapi_spec.json)
48+
49+
## Dependencies
50+
51+
- https://www.mock-server.com/ is used for mocking dependent services
52+
53+
## Licence
54+
55+
[MIT License](LICENSE)
56+
57+
## Vulnerability Disclosure
58+
59+
GOV.UK Pay aims to stay secure for everyone. If you are a security researcher and have discovered a security vulnerability in this code, we appreciate your help in disclosing it to us in a responsible manner. Please refer to our [vulnerability disclosure policy](https://www.gov.uk/help/report-vulnerability) and our [security.txt](https://vdp.cabinetoffice.gov.uk/.well-known/security.txt) file for details.

‎jdk_11_maven/cs/rest/pay-publicapi/build-local.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
cd "$(dirname "$0")"
6+
7+
mvn -DskipITs clean verify
8+
if [ "$(uname -m)" == "arm64" ]; then
9+
docker build -t governmentdigitalservice/pay-publicapi:local -f m1/arm64.Dockerfile .
10+
else
11+
docker build -t governmentdigitalservice/pay-publicapi:local .
12+
fi

‎jdk_11_maven/cs/rest/pay-publicapi/docker-startup.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/usr/bin/env bash
2+
3+
set -eu
4+
5+
exec java ${JAVA_OPTS} -jar *-allinone.jar server *.yaml

‎jdk_11_maven/cs/rest/pay-publicapi/docs/arch/adr-001-use-lettuce-core-lib-instead-of-dropwizard-redis.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# ADR 001 - Use lettuce-core library instead of dropwizard redis
2+
3+
## Context
4+
5+
We were using an [unsupported dropwizard-redis](https://github.com/benjamin-bader/droptools/tree/master/dropwizard-redis) bundle. Dropwizard now offer a managed bundle which provides a managed redis. This bundle uses `lettuce-core` instead of `jedis`.
6+
7+
[We wanted to upgrade to this new library](https://payments-platform.atlassian.net/browse/PP-6343).
8+
9+
The advantages of using this library are:
10+
11+
* Configuration
12+
* Client lifecycle management
13+
* Client health checks
14+
* Dropwizard Metrics integration
15+
16+
However, the dropwizard-redis library's io.dropwizard.redis.RedisClientFactory class
17+
[expects](https://github.com/dropwizard/dropwizard-redis/blob/master/src/main/java/io/dropwizard/redis/RedisClientFactory.java#L54)
18+
to make a connection with Redis on application startup. If a connection cannot be made an exception will be thrown
19+
which causes the application to fail to start up.
20+
21+
This has some unintended consequences:
22+
23+
* Mandating a connection on startup causes many integration tests to fail. Making a redis connection available for every relevant test is a fairly big change.
24+
* Mandating a connection might affect running Publicapi in dev/local environments.
25+
26+
In order to work around this issue we could either:
27+
28+
1. adapt the dropwizard-redis library so that it doesn't crash if the redis connection is not available
29+
2. use lettuce-core directly
30+
31+
| Option | Pros | Cons |
32+
|---------|---------|---------|
33+
| adapt | use common component; metrics instrumentation | more effort than justified |
34+
| use lettuce-core directly | simpler; not hard; we don't need the extra features of dropwizard-redis; we don't need healthchecks because redis is optional | |
35+
36+
On balance we think there are no advantages to us in using dropwizard-redis so we'll just use the lettuce-core library directly.
37+
38+
## Decision
39+
40+
We will use the [lettuce-core](https://github.com/lettuce-io/lettuce-core) directly.
41+
42+
## Status
43+
44+
Accepted

‎jdk_11_maven/cs/rest/pay-publicapi/env.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
ENV_FILE="$WORKSPACE/pay-scripts/services/publicapi.env"
3+
if [ -f $ENV_FILE ]
4+
then
5+
set -a
6+
source $ENV_FILE
7+
set +a
8+
fi
9+
10+
eval "$@"

0 commit comments

Comments
 (0)