Ocrvs 4046

.trivyignore.yaml

@@ -40,10 +40,16 @@ vulnerabilities:
   - id: CVE-2022-1471
     statement: Dashboards vulns (java libs)
   - id: CVE-2024-25710
-    statement: Metabase v0.46 vulnerability (remove when v0.49 is released)
+    statement: Metabase v0.46 vulnerability, fixed in Metabase v0.49
   - id: CVE-2024-26308
-    statement: Metabase v0.46 vulnerability (remove when v0.49 is released)
+    statement: Metabase v0.46 vulnerability, fixed in Metabase v0.49
   - id: CVE-2024-22201
-    statement: Metabase v0.46 vulnerability (remove when v0.49 is released)
+    statement: Metabase v0.46 vulnerability, fixed in Metabase v0.49
   - id: CVE-2023-36478
-    statement: Metabase v0.46 vulnerability (remove when v0.49 is released)
+    statement: Metabase v0.46 vulnerability, fixed in Metabase v0.49
+  - id: CVE-2024-21634
+    statement: Metabase v0.46 vulnerability, fixed in Metabase v0.49
+  - id: CVE-2024-4068
+    statement: Transitive dependency of lint-staged, jest and msw. Not running in production. Likely fixed by upgrading.
+  - id: CVE-2024-37890
+    statement: ws vulnerability, transitive dependency of jest, storybook, graphql-codegen, not running in production.

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 1.5.0 (TBD)
+## 1.5.0
 
 ## Breaking changes
 
@@ -20,18 +20,36 @@
 
   We are dropping support for 'agentDefault' to be used as initial value for SELECT_WITH_DYNAMIC_OPTIONS type of fields. The country config package now must return the form with prepopulated initial values to show default addresses. [#6871](https://github.com/opencrvs/opencrvs-core/issues/6871)
 
+- #### Remove system admin UI items: Application, User roles
+
+  We have now moved to configuring these items directly from country configuration repository.
+
 ## New features
 
 - Add loading spinners before JavaScript bundle has loaded for both login and client
+- Add loading bar before javaScript bundle has loaded for client and when fetching records [#6641](https://github.com/opencrvs/opencrvs-core/issues/6641)
 - Support for landscape certificate templates
 - Allow defining maxLength attribute for number type fields [#6356](https://github.com/opencrvs/opencrvs-core/issues/6356)
+- Certificate handlebar for registration fees `registrationFees` [#6817](https://github.com/opencrvs/opencrvs-core/issues/6817)
+- Logged in user details handlebar `loggedInUser` [#6529](https://github.com/opencrvs/opencrvs-core/issues/6529)
+- Introduce two new properties to the form field `DOCUMENT_UPLOADER_WITH_OPTION`
+  - `compressImagesToSizeMB` : An optional prop of number type to define a compressed size. Compression is ignored when the input file is already smaller or equal of the given value or a falsy given value.
+  - `maxSizeMB`: An optional validation prop to prevent input of a file bigger than a defined value.
+- Metabase default credentials now must be configured via countryconfig repository environment variables and secrets otherwise the dashboard service won't start [#6578](https://github.com/opencrvs/opencrvs-core/issues/6578)
+- Introduce rate limiting to routes that could potentially be bruteforced or extracted PII from [#6145](https://github.com/opencrvs/opencrvs-core/pull/6145)
+
+## Improvements
+
+- Development time logs are now much tidier and errors easier to point out. Production logging will still remain as is. [#7022](https://github.com/opencrvs/opencrvs-core/pull/7022)
+- Mask emails and phone numbers from notification logs [#7204](https://github.com/opencrvs/opencrvs-core/pull/7204)
 
 ## Bug fixes
 
 - Handle back button click after issuing a declaration [#6424](https://github.com/opencrvs/opencrvs-core/issues/6424)
 - Fix certificate verification QR code for a death declaration [#6230](https://github.com/opencrvs/opencrvs-core/issues/6230#issuecomment-1996766125)
 - Fix certificate verification QR code crashing when gender is unknown [#6422](https://github.com/opencrvs/opencrvs-core/issues/6422)
 - Fix certificate verification page missing registration center and the name of registrar [#6614](https://github.com/opencrvs/opencrvs-core/issues/6614)
+- Amend certificate verification showing the certifying date instead of records creation date [#7098](https://github.com/opencrvs/opencrvs-core/pull/7098)
 - Fix records not getting issued [#6216] (https://github.com/opencrvs/opencrvs-core/issues/6216)
 - Fix record correction e2e failing due to stale data getting saved on redux
 - Convert eventDates to LocalDate before formatting [#6719](https://github.com/opencrvs/opencrvs-core/issues/6719)
@@ -41,8 +59,36 @@
 - Fix certificate templates not getting populated for health facility event locations & ADMIN_LEVEL > 2
 - Fix download failure for incomplete (without date of death) death declarations [#6807](https://github.com/opencrvs/opencrvs-core/issues/6807)
 - Fix search result declaration record audit unassign issue [#5781](https://github.com/opencrvs/opencrvs-core/issues/5781)
-- In review page, Eliminating the 'No supporting documents' and 'upload' prompts when documents are already uploaded [#6231] (https://github.com/opencrvs/opencrvs-core/issues/6231)
-
+- In review page, Eliminating the 'No supporting documents' and 'upload' prompts when documents are already uploaded [#6231](https://github.com/opencrvs/opencrvs-core/issues/6231)
+- In record audit page, after 'Correction request approved' the “record corrected” action is removed from history [#6228](https://github.com/opencrvs/opencrvs-core/issues/6228)
+- Fix Registrar of any location should be able to review a correction request [#6247](https://github.com/opencrvs/opencrvs-core/issues/6247)
+- remove upload button when no supporting docs are configured [#5944](https://github.com/opencrvs/opencrvs-core/issues/5944)
+- Fix issues of invisible inputs when navigating from can't login link in login page [#6163](https://github.com/opencrvs/opencrvs-core/issues/6163)
+- Fix the "Continue" button being disabled when changes in correction form is made [#6780](https://github.com/opencrvs/opencrvs-core/issues/6780)
+- Remove leading slash from `resendAuthenticationCode` in login to fix resend email button [#6987](https://github.com/opencrvs/opencrvs-core/issues/6987) [#7037](https://github.com/opencrvs/opencrvs-core/issues/7037)
+- Fix 'Place of Certification' is showing wrong in certificate [#7060] (https://github.com/opencrvs/opencrvs-core/issues/7060)
+- Fix dashboard cron jobs not working [#7016](https://github.com/opencrvs/opencrvs-core/issues/7016)
+- Fix Check for valid date to handle incomplete marriage declarations [#7017](https://github.com/opencrvs/opencrvs-core/issues/7017)
+- Fix session expiration when user tries to change phone number [#7003](https://github.com/opencrvs/opencrvs-core/pull/7025)
+- Fix French translation missing for relationship to informant when trying to correct record, print and issue record [#6341] (https://github.com/opencrvs/opencrvs-core/issues/6341)
+- Fix client modal glitches on integrations page [#7002](https://github.com/opencrvs/opencrvs-core/issues/7002)
+- Fix print record page for an unsaved declaration [#6893](https://github.com/opencrvs/opencrvs-core/issues/6893)
+- Fix Reset pagination to default page (1) when location changes in UserList [#6481](https://github.com/opencrvs/opencrvs-core/issues/6481)
+- Fix Disabling 'Mark as duplicate' button when duplicate reason is empty too [#7083](https://github.com/opencrvs/opencrvs-core/pull/7083)
+- Fix certificate overflowing in preview certificate view [#7157](https://github.com/opencrvs/opencrvs-core/pull/7157)
+- Fix records going completely missing when an unexpected error happens in the backend [#7021](https://github.com/opencrvs/opencrvs-core/pull/7021)
+- Fix correction done from a certificate preview page [#7065](https://github.com/opencrvs/opencrvs-core/pull/7093)
+- Fix "Print and issue to groom|bride" is added to a different variable [#7046](https://github.com/opencrvs/opencrvs-core/issues/7046)
+- Fix search query is not being saved in the advanced search results [#7110](https://github.com/opencrvs/opencrvs-core/pull/7117)
+- Fix removed duplicateTrackingId check in createDuplicateTask method [#7024](https://github.com/opencrvs/opencrvs-core/issues/7024)
+- Fix address property handling and corrected country data transformation logic [#6989](https://github.com/opencrvs/opencrvs-core/issues/6989)
+- Fix search indexing BRN's in place of identifiers. Adds spouseIdentifier to search with [#7189](https://github.com/opencrvs/opencrvs-core/pull/7189)
+- Rename `farajaland-map.geojson` in dashboards to `map.geojson` to not tie opencrvs-core into a specific country implementation name [#7251](https://github.com/opencrvs/opencrvs-core/pull/7251)
+- Fix unassign action not appearing in audit history [#7035](https://github.com/opencrvs/opencrvs-core/pull/7072)
+- Update advanced search list properly when assignments change [#7307](https://github.com/opencrvs/opencrvs-core/pull/7307)
+- Update Content-Security-Policy to allow loading fonts from country configuration [#7296](https://github.com/opencrvs/opencrvs-core/pull/7296)
+- Fix frontend crashing on 'Registration by Status' under performance due to missing translations [#7129](https://github.com/opencrvs/opencrvs-core/pull/7129)
+- Fix email of practitioner to be saved in hearth. A migration is added to correct the email of practitoiner in existing db. [7315](https://github.com/opencrvs/opencrvs-core/pull/7315)
 
 ## Refactor
 

development-environment/dev.sh

@@ -10,7 +10,6 @@ set -e
 DIR=$(cd "$(dirname "$0")"; pwd)
 
 export LANGUAGES="en,fr"
-export LOG_LEVEL="error"
 
 if [  -n "$(uname -a | grep Ubuntu)" ]; then
   OS="UBUNTU"

docker-compose.yml

@@ -151,7 +151,7 @@ services:
       dockerfile: ./packages/webhooks/Dockerfile
     restart: unless-stopped
     environment:
-      - REDIS_HOST=redis://redis:6379
+      - REDIS_HOST=redis
       - MONGO_URL=mongodb://mongo1/webhooks
       - AUTH_URL=http://auth:4040
       - USER_MANAGEMENT_URL=http://user-mgnt:3030/

infrastructure/nginx-default.conf

@@ -44,7 +44,7 @@ add_header X-Permitted-Cross-Domain-Policies master-only;
 # I need to change our application code so we can increase security by disabling 'unsafe-inline' 'unsafe-eval'
 # directives for css and js(if you have inline css or js, you will need to keep it too).
 # more: http://www.html5rocks.com/en/tutorials/security/content-security-policy/#inline-code-considered-harmful
-add_header Content-Security-Policy "default-src 'self' {{CONTENT_SECURITY_POLICY_WILDCARD}} *.sentry.io/ sentry.io/; font-src fonts.gstatic.com; object-src 'none'; script-src 'self' 'unsafe-eval' blob: https: http: storage.googleapis.com/workbox-cdn/ sentry.io/api/embed/error-page/; style-src 'self' fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: http: https: ";
+add_header Content-Security-Policy "default-src 'self' {{CONTENT_SECURITY_POLICY_WILDCARD}} *.sentry.io/ sentry.io/; font-src fonts.gstatic.com {{CONTENT_SECURITY_POLICY_WILDCARD}}; object-src 'none'; script-src 'self' 'unsafe-eval' blob: https: http: storage.googleapis.com/workbox-cdn/ sentry.io/api/embed/error-page/; style-src 'self' fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: http: https: ";
 
 server {
     listen       80;

packages/auth/package.json

@@ -5,7 +5,7 @@
   "license": "MPL-2.0",
   "private": true,
   "scripts": {
-    "start": "cross-env NODE_ENV=development NODE_OPTIONS=--dns-result-order=ipv4first nodemon --exec ts-node -r tsconfig-paths/register src/index.ts",
+    "start": "cross-env NODE_ENV=development NODE_OPTIONS=--dns-result-order=ipv4first nodemon --quiet --exec ts-node -r tsconfig-paths/register src/index.ts",
     "start:prod": "TS_NODE_BASEURL=./build/dist/src node -r tsconfig-paths/register build/dist/src/index.js",
     "test": "jest --coverage --silent --noStackTrace && yarn test:compilation",
     "test:watch": "jest --watch",

packages/auth/src/config/plugins.ts

@@ -8,27 +8,27 @@
  *
  * Copyright (C) The OpenCRVS Authors located at https://github.com/opencrvs/opencrvs-core/blob/master/AUTHORS.
  */
+import { SENTRY_DSN } from '@auth/constants'
+import { ServerRegisterPluginObject } from '@hapi/hapi'
+import { logger } from '@opencrvs/commons'
 import * as Pino from 'hapi-pino'
 import * as Sentry from 'hapi-sentry'
-import { SENTRY_DSN } from '@auth/constants'
-import { logger } from '@auth/logger'
 
-interface IHapiPlugin {
-  plugin: typeof Sentry | typeof Pino
-  options: Record<string, unknown>
-}
+type IHapiPlugin<T = any> = ServerRegisterPluginObject<T>
 
 export default function getPlugins() {
-  const plugins: IHapiPlugin[] = [
-    {
+  const plugins: IHapiPlugin[] = []
+
+  if (process.env.NODE_ENV === 'production') {
+    plugins.push({
       plugin: Pino,
       options: {
         prettyPrint: false,
         logPayload: false,
         instance: logger
       }
-    }
-  ]
+    })
+  }
 
   if (SENTRY_DSN) {
     plugins.push({

packages/auth/src/database.ts

@@ -11,7 +11,7 @@
 import * as redis from 'redis'
 import { REDIS_HOST } from '@auth/constants'
 import { promisify } from 'util'
-import { logger } from '@auth/logger'
+import { logger } from '@opencrvs/commons'
 
 let redisClient: redis.RedisClient
 

packages/auth/src/features/authenticate/service.ts

@@ -31,7 +31,7 @@ import {
   sendVerificationCode,
   storeVerificationCode
 } from '@auth/features/verifyCode/service'
-import { logger } from '@auth/logger'
+import { logger } from '@opencrvs/commons'
 import { unauthorized } from '@hapi/boom'
 import { chainW, tryCatch } from 'fp-ts/Either'
 import { pipe } from 'fp-ts/function'

packages/auth/src/features/invalidateToken/handler.ts

@@ -13,7 +13,7 @@ import * as Joi from 'joi'
 import { internal } from '@hapi/boom'
 import { invalidateToken } from '@auth/features/invalidateToken/service'
 import { postUserActionToMetrics } from '@auth/features/authenticate/service'
-import { logger } from '@auth/logger'
+import { logger } from '@opencrvs/commons'
 
 interface IInvalidateTokenPayload {
   token: string

packages/auth/src/features/retrievalSteps/sendUserName/handler.test.ts

@@ -14,7 +14,7 @@ import {
   storeRetrievalStepInformation,
   RetrievalSteps
 } from '@auth/features/retrievalSteps/verifyUser/service'
-import { logger } from '@auth/logger'
+import { logger } from '@opencrvs/commons'
 
 const fetch = fetchAny as fetchAny.FetchMock
 

packages/auth/src/features/retrievalSteps/sendUserName/handler.ts

@@ -19,7 +19,7 @@ import {
   RetrievalSteps,
   deleteRetrievalStepInformation
 } from '@auth/features/retrievalSteps/verifyUser/service'
-import { logger } from '@auth/logger'
+import { logger } from '@opencrvs/commons'
 import { PRODUCTION } from '@auth/constants'
 import { postUserActionToMetrics } from '@auth/features/authenticate/service'
 

packages/auth/src/features/retrievalSteps/verifyNumber/handler.ts

@@ -17,7 +17,7 @@ import {
 } from '@auth/features/retrievalSteps/verifyUser/service'
 import { checkVerificationCode } from '@auth/features/verifyCode/service'
 import { unauthorized } from '@hapi/boom'
-import { logger } from '@auth/logger'
+import { logger } from '@opencrvs/commons'
 
 interface IVerifyNumberPayload {
   nonce: string

packages/auth/src/features/verifyCode/handler.ts

@@ -20,7 +20,7 @@ import {
   createToken,
   postUserActionToMetrics
 } from '@auth/features/authenticate/service'
-import { logger } from '@auth/logger'
+import { logger } from '@opencrvs/commons'
 import { WEB_USER_JWT_AUDIENCES, JWT_ISSUER } from '@auth/constants'
 interface IVerifyPayload {
   nonce: string

packages/auth/src/server.ts

@@ -67,7 +67,7 @@ import sendUserNameHandler, {
   requestSchema as reqSendUserNameSchema
 } from '@auth/features/retrievalSteps/sendUserName/handler'
 import { tokenHandler } from '@auth/features/system/handler'
-import { logger } from '@auth/logger'
+import { logger } from '@opencrvs/commons'
 import { getPublicKey } from '@auth/features/authenticate/service'
 import anonymousTokenHandler, {
   responseSchema

packages/client/index.html

@@ -39,70 +39,81 @@
     <style>
       body,
       html {
-        background-color: #f5f5f5;
+        background-color: #f8f8f8;
+        margin: 0;
       }
-      #spinner {
+      .pgrs-wrapper1240 {
+        height: 100vh;
+        width: 100vw;
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        justify-content: center;
         opacity: 0;
-        position: absolute;
-        left: 50%;
-        top: 50%;
-        transform: translate(-25px, -25px);
-        animation: a 2s forwards;
+        animation: fadeIn 2s forwards;
+        font-family: sans-serif;
       }
-      #spinner g {
-        transform-origin: center;
-        animation: b 2s linear infinite;
+      .progress-bar {
+        width: 276px;
+        height: 8px;
+        margin-top: 27px;
+        border-radius: 100px;
+        background: #d9d9d9;
       }
-      #spinner g circle {
-        stroke-linecap: round;
-        animation: c 1.5s ease-in-out infinite;
+      #root-app-progress {
+        width: 0;
+        height: 8px;
+        border-radius: 100px;
+        background: #4972bb;
+        animation: progressAnimation 200s ease-out forwards;
       }
-      @keyframes a {
-        85% {
-          opacity: 0;
+      @keyframes progressAnimation {
+        0%,
+        1% {
+          min-width: 0%;
         }
-        100% {
-          opacity: 1;
+        3% {
+          min-width: 80%;
+        }
+        6% {
+          min-width: 91%;
+        }
+        10% {
+          min-width: 94%;
+        }
+        30% {
+          min-width: 96%;
         }
-      }
-      @keyframes b {
         100% {
-          transform: rotate(360deg);
+          min-width: 99%;
         }
       }
-      @keyframes c {
-        0% {
-          stroke-dasharray: 0 150;
-          stroke-dashoffset: 0;
-        }
-        47.5% {
-          stroke-dasharray: 42 150;
-          stroke-dashoffset: -16;
+      @keyframes fadeIn {
+        0%,
+        85% {
+          opacity: 0;
         }
-        95%,
         100% {
-          stroke-dasharray: 42 150;
-          stroke-dashoffset: -59;
+          opacity: 1;
         }
       }
     </style>
   </head>
-
   <body>
     <noscript> You need to enable JavaScript to run this app. </noscript>
     <div id="root">
-      <svg
-        id="spinner"
-        width="50"
-        height="50"
-        stroke="#4C68C1"
-        viewBox="0 0 24 24"
-        xmlns="http://www.w3.org/2000/svg"
-      >
-        <g>
-          <circle cx="12" cy="12" r="9.5" fill="none" stroke-width="2"></circle>
-        </g>
-      </svg>
+      <div class="pgrs-wrapper1240">
+        <img
+          src="./images/logo-90x90.svg"
+          width="90"
+          height="90"
+          alt="OpenCRVS logo"
+        />
+        <div class="progress-bar">
+          <div id="root-app-progress"></div>
+        </div>
+        <p>Installing application...</p>
+      </div>
     </div>
     <script type="module" src="/src/index.tsx"></script>
   </body>