feat: braking out thei am infra, dropping the service for the gitcoin… (

passportxyz#3071)

* feat: braking out thei am infra, dropping the service for the gitcoin domain

* feat: drop TODO

* feat: reworking infra, added the embed ECS task

* feat: adding passport-embed service

* feat: added building the docker image for the embed service to the workflow

* Update infra/aws/embed.ts

Co-authored-by: larisa17 <[email protected]>

* Update infra/aws/embed.ts

Co-authored-by: larisa17 <[email protected]>

* Update infra/aws/embed.ts

Co-authored-by: larisa17 <[email protected]>

* feat: forgoit to add cluster.ts

* feat: adidng dummy test for embed

* feat: updating ../infra/yarn.lock

* feat: have removed embed workspace for now

---------

Co-authored-by: larisa17 <[email protected]>

.github/workflows/build_and_deploy_generic.yml

@@ -17,8 +17,8 @@ on:
         required: true
 
 jobs:
-  docker:
-    name: Build and push docker image
+  docker_iam:
+    name: Build and push IAM docker image
     runs-on: ubuntu-latest
     steps:
       - name: Load secret
@@ -32,7 +32,7 @@ jobs:
           AWS_ACCESS_KEY_ID: op://DevOps/passport-xyz-${{ inputs.environment }}-secrets/ci/AWS_ACCESS_KEY_ID
           AWS_SECRET_ACCESS_KEY: op://DevOps/passport-xyz-${{ inputs.environment }}-secrets/ci/AWS_SECRET_ACCESS_KEY
 
-      - id: build_and_push_docker_image
+      - id: build_and_push_docker_iam_image
         uses: passportxyz/gh-workflows/.github/actions/build_and_push@v1
         with:
           refspec: ${{ inputs.refspec }}
@@ -44,6 +44,33 @@ jobs:
           dockerfile_name: iam/Dockerfile
           build_dir: ./
 
+  docker_embed:
+    name: Build and push embed docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Load secret
+        id: op-load-secret
+        uses: 1password/load-secrets-action@v1
+        with:
+          export-env: true
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          CLOUDFLARE_API_TOKEN: op://DevOps/passport-xyz-${{ inputs.environment }}-secrets/ci/CLOUDFLARE_API_TOKEN
+          AWS_ACCESS_KEY_ID: op://DevOps/passport-xyz-${{ inputs.environment }}-secrets/ci/AWS_ACCESS_KEY_ID
+          AWS_SECRET_ACCESS_KEY: op://DevOps/passport-xyz-${{ inputs.environment }}-secrets/ci/AWS_SECRET_ACCESS_KEY
+
+      - id: build_and_push_docker_embed_image
+        uses: passportxyz/gh-workflows/.github/actions/build_and_push@v1
+        with:
+          refspec: ${{ inputs.refspec }}
+          docker_tag: ${{ inputs.docker_tag }}
+          ecr_repository_name: passport-embed
+          aws_region: us-west-2
+          aws_access_key_id: ${{ env.AWS_ACCESS_KEY_ID }}
+          aws_secret_access_key: ${{ env.AWS_SECRET_ACCESS_KEY }}
+          dockerfile_name: embed/Dockerfile
+          build_dir: ./
+
   deploy_preview:
     name: Preview - Deploying AWS Infra
     runs-on: ubuntu-latest
@@ -88,7 +115,7 @@ jobs:
 
   deploy_confirm:
     name: Review Approval Pending
-    needs: [docker, deploy_preview]
+    needs: [docker_iam, docker_embed, deploy_preview]
     runs-on: ubuntu-latest
     environment: ${{ inputs.environment }}
     steps:
@@ -98,7 +125,7 @@ jobs:
 
   deploy_backends:
     name: Deploying AWS Infra
-    needs: [docker, deploy_preview, deploy_confirm]
+    needs: [docker_iam, docker_embed, deploy_preview, deploy_confirm]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

embed/Dockerfile

@@ -0,0 +1,9 @@
+FROM node:20.11
+WORKDIR /usr/src
+
+COPY . .
+
+RUN yarn
+
+EXPOSE 80 443
+CMD [ "node", "embed/dist/main.js" ]

embed/README.md

@@ -0,0 +1,42 @@
+# Passport Embed
+
+The Passport Embed service implements the backend part used by the passport embed UI component.
+
+
+```
+# Ensure you copy and update the required variables for the environment
+$ cp ./.env-example.env ./.env
+
+# Install and start the IAM server
+$ yarn install
+$ yarn start
+```
+
+Then send a ??? request to `http://localhost:81/???` with the following JSON body:
+
+```
+???
+```
+
+## Adding new environment variables to IAM
+
+1. Add the new variable and real value to your own `.env` file.
+2. Add the new variable to `.env-example.env` with a placeholder value for documentation.
+3. Add the new variable into the build process, making sure the new variable value is injected into the Pulumi scripts
+   for all environments (`review`, `staging`, and `production`).
+
+There are a few options for adding the variable into the build process:
+
+- Add the value to AWS Secrets Manager, and add a new item to the `secrets` array in the `iam` container definition.
+  **Note that you will have to add it to all AWS Secrets Manager resources in all AWS accounts used.**
+- Add the value to Github Actions Secrets and inject it into the process environment IAM-related workflows on the Pulumi
+  deploy step. Pull the variable into the Pulumi files using `proccess.env.NEW_VAR`, and refer to
+  that variable in the `secrets` array.
+- (If the value can be public) Hardcode the value in plaintext into the Github Actions script and feed it into the
+  Pulumi file as described above. Alternatively, hardcode the value into the Pulumi file directly. Also note that it can
+  be added to `environment` array in the `iam` container definition instead of `secrets`, since the value can be public.
+
+## Cache
+
+Passport uses redis to handle caching. For local development you can spin up a redis instance using docker:
+`docker run -d -p 6379:6379 redis` or using whatever other method you prefer. The redis instance should be available at `localhost:6379` by default.

embed/__tests__/dummy.test.ts

@@ -0,0 +1,10 @@
+
+describe("Dummy Test", () => {
+
+  describe("testSomething", () => {
+    it("should just succeed", async () => {
+      expect(1).toEqual(1);
+    });
+
+  });
+});

embed/babel.config.json

@@ -0,0 +1,12 @@
+{
+  "presets": [
+    "@babel/preset-typescript",
+    ["@babel/preset-env", { "targets": { "node": "current" } }]
+  ],
+  "plugins": [
+    "@babel/plugin-syntax-import-assertions",
+    "babel-plugin-transform-import-meta",
+    ["babel-plugin-replace-import-extension", { "extMapping": { ".js": "" } }],
+    "@babel/plugin-transform-modules-commonjs"
+  ]
+}

embed/jest.config.cjs

@@ -0,0 +1,5 @@
+module.exports = {
+  modulePathIgnorePatterns: ["<rootDir>/dist/"],
+  setupFiles: ["dotenv/config", "<rootDir>/jest.setup.cjs"],
+  testEnvironment: "node",
+};

embed/jest.setup.cjs

@@ -0,0 +1,20 @@
+const DIDKit = require("@spruceid/didkit-wasm-node");
+
+process.env.IAM_JWK = DIDKit.generateEd25519Key();
+process.env.IAM_JWK_EIP712 =
+  '{"kty":"EC","crv":"secp256k1","x":"PdB2nS-knyAxc6KPuxBr65vRpW-duAXwpeXlwGJ03eU","y":"MwoGZ08hF5uv-_UEC9BKsYdJVSbJNHcFhR1BZWer5RQ","d":"z9VrSNNZXf9ywUx3v_8cLDhSw8-pvAT9qu_WZmqqfWM"}';
+process.env.ATTESTATION_SIGNER_PRIVATE_KEY =
+  "0x04d16281ff3bf268b29cdd684183f72542757d24ae9fdfb863e7c755e599163a";
+process.env.TESTNET_ATTESTATION_SIGNER_PRIVATE_KEY =
+  "0x04d16281ff3bf268b29cdd684183f72542757d24ae9fdfb863e7c755e599163a";
+process.env.GITCOIN_VERIFIER_CHAIN_ID = "84531";
+process.env.ALLO_SCORER_ID = "1";
+process.env.SCORER_ENDPOINT = "http://127.0.0.1:8002";
+process.env.SCORER_API_KEY = "abcd";
+process.env.MORALIS_API_KEY = "abcd";
+process.env.EAS_GITCOIN_STAMP_SCHEMA = "0x";
+process.env.EAS_FEE_USD = "3";
+process.env.SCROLL_BADGE_PROVIDER_INFO =
+  '{"DeveloperList#PassportCommiterLevel1#6a51c84c":{"contractAddress":"0x71A848A38fFCcA5c7A431F2BB411Ab632Fa0c456","level":1}}';
+process.env.SCROLL_BADGE_ATTESTATION_SCHEMA_UID =
+  "0xa35b5470ebb301aa5d309a8ee6ea258cad680ea112c86e456d5f2254448afc74";

embed/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@gitcoin/passport-embed",
+  "private": true,
+  "version": "1.0.0",
+  "main": "dist/main.js",
+  "types": "src/types.d.ts",
+  "type": "module",
+  "license": "MIT",
+  "scripts": {
+    "clean": "rimraf dist node_modules",
+    "prebuild": "yarn run lint",
+    "build": "tsc",
+    "prestart": "yarn run build",
+    "start": "node .",
+    "debug": "concurrently --kill-others \"tsc --watch\" \"node --watch --inspect .\"",
+    "prod:start": "tsc && node .",
+    "test": "jest --verbose",
+    "prettier": "prettier --write .",
+    "lint": "tsc --noEmit && eslint --ext .ts,.js,.tsx .",
+    "lint:fix": "eslint --fix --ext .ts,.js,.tsx ."
+  },
+  "dependencies": {
+    "@ethereum-attestation-service/eas-sdk": "^2.7.0",
+    "@gitcoin/passport-identity": "^1.0.0",
+    "@gitcoin/passport-platforms": "^1.0.0",
+    "@gitcoin/passport-types": "^1.0.0",
+    "@spruceid/didkit-wasm-node": "^0.2.1",
+    "axios": "^0.27.2",
+    "cors": "^2.8.5",
+    "dotenv": "^16.0.0",
+    "ethers": "^6.13.4",
+    "express": "4",
+    "luxon": "^2.4.0",
+    "tslint": "^6.1.3",
+    "uuid": "^8.3.2"
+  },
+  "devDependencies": {
+    "@babel/core": "^7.23.3",
+    "@babel/plugin-syntax-import-assertions": "^7.23.3",
+    "@babel/plugin-transform-modules-commonjs": "^7.23.3",
+    "@babel/preset-env": "^7.23.3",
+    "@babel/preset-typescript": "^7.23.3",
+    "@types/cors": "^2.8.12",
+    "@types/express": "^4.17.13",
+    "@types/luxon": "^2.3.2",
+    "@types/node": "16",
+    "@types/node-fetch": "latest",
+    "@types/supertest": "^2.0.12",
+    "@types/webpack-env": "^1.16.3",
+    "babel-jest": "^29.7.0",
+    "babel-plugin-replace-import-extension": "^1.1.3",
+    "babel-plugin-transform-import-meta": "^2.2.1",
+    "eslint-plugin-prettier": "^5.1.3",
+    "jest": "^29.6.4",
+    "supertest": "^6.2.2",
+    "ts-jest": "^29.1.1",
+    "ts-node": "^10.9.1",
+    "tsx": "^4.7.0",
+    "typescript": "^5.3.3"
+  },
+  "resolutions": {
+    "leveldown": "6.1.1"
+  }
+}

embed/src/index.ts

@@ -0,0 +1,76 @@
+// import { EnsProvider } from './providers/ens';
+// Should this file be an app factory? If it was, we could move the provider config to main.ts and test in isolation
+
+// ---- Server
+import express from "express";
+
+// ---- Production plugins
+import cors from "cors";
+
+// ---- Config - check for all required env variables
+// We want to prevent the app from starting with default values or if it is misconfigured
+const configErrors = [];
+
+if (!process.env.IAM_JWK) {
+  configErrors.push("IAM_JWK is required");
+}
+
+if (!process.env.ATTESTATION_SIGNER_PRIVATE_KEY) {
+  configErrors.push("ATTESTATION_SIGNER_PRIVATE_KEY is required");
+}
+
+if (!process.env.TESTNET_ATTESTATION_SIGNER_PRIVATE_KEY) {
+  configErrors.push("TESTNET_ATTESTATION_SIGNER_PRIVATE_KEY is required");
+}
+
+if (!process.env.ALLO_SCORER_ID) {
+  configErrors.push("ALLO_SCORER_ID is required");
+}
+
+if (!process.env.SCORER_ENDPOINT) {
+  configErrors.push("SCORER_ENDPOINT is required");
+}
+
+if (!process.env.SCORER_API_KEY) {
+  configErrors.push("SCORER_API_KEY is required");
+}
+
+if (!process.env.EAS_GITCOIN_STAMP_SCHEMA) {
+  configErrors.push("EAS_GITCOIN_STAMP_SCHEMA is required");
+}
+
+if (!process.env.MORALIS_API_KEY) {
+  configErrors.push("MORALIS_API_KEY is required");
+}
+
+if (!process.env.IAM_JWK_EIP712) {
+  configErrors.push("IAM_JWK_EIP712 is required");
+}
+
+if (!process.env.EAS_FEE_USD) {
+  configErrors.push("EAS_FEE_USD is required");
+}
+
+if (configErrors.length > 0) {
+  configErrors.forEach((error) => console.error(error)); // eslint-disable-line no-console
+  throw new Error("Missing required configuration");
+}
+
+// create the app and run on port
+export const app = express();
+
+// parse JSON post bodies
+app.use(express.json());
+
+// set cors to accept calls from anywhere
+app.use(cors());
+
+// health check endpoint
+app.get("/health", (_req, res) => {
+  const data = {
+    message: "Ok",
+    date: new Date(),
+  };
+
+  res.status(200).send(data);
+});

embed/src/issuers.ts

@@ -0,0 +1,32 @@
+import * as DIDKit from "@spruceid/didkit-wasm-node";
+
+const key = process.env.IAM_JWK;
+const __issuer = DIDKit.keyToDID("key", key);
+const eip712Key = process.env.IAM_JWK_EIP712;
+const __eip712Issuer = DIDKit.keyToDID("ethr", eip712Key);
+
+const validIssuers = new Set([__issuer, __eip712Issuer]);
+
+export function getEd25519IssuerKey(): string {
+  return key;
+}
+
+export function getEd25519Issuer(): string {
+  return __issuer;
+}
+
+export function getEip712IssuerKey(): string {
+  return eip712Key;
+}
+
+export function getEip712Issuer(): string {
+  return __eip712Issuer;
+}
+
+export function getIssuerKey(signatureType: string): string {
+  return signatureType === "EIP712" ? eip712Key : key;
+}
+
+export function hasValidIssuer(issuer: string): boolean {
+  return validIssuers.has(issuer);
+}

embed/src/main.ts

@@ -0,0 +1,24 @@
+import "dotenv/config";
+
+// ---- Main App from index
+import { app } from "./index.js";
+
+// default port to listen on
+const port = process.env.EMBED_PORT || 80;
+
+const startServer = (): void => {
+  const server = app.listen(port, () => {
+    // eslint-disable-next-line no-console
+    console.log(`server started at http://localhost:${port}`);
+  });
+
+  // This should be > the ELB idle timeout, which is 60 seconds
+  server.keepAliveTimeout = 61 * 1000;
+};
+
+try {
+  startServer();
+} catch (error) {
+  // eslint-disable-next-line no-console
+  console.error(error);
+}