Develop

.github/workflows/deployment.yaml

@@ -3,7 +3,7 @@ name: Deploy REMS CDK
 on:
   push:
     branches:
-      - '**'
+      - "**"
 
 permissions:
   id-token: write
@@ -47,6 +47,7 @@ jobs:
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN_DEV }}
           aws-region: ${{ secrets.CDK_REGION_DEV }}
+
       - name: Deploy to Dev
         run: npx cdk diff && npx cdk deploy --all --require-approval never --force
         env:
@@ -68,6 +69,8 @@ jobs:
           DB_INSTANCE_SIZE: micro
           DB_INSTANCE_CLASS: burstable3
           OIDC_SECRET_ARN: ${{ secrets.OIDC_SECRET_ARN_DEV }}
+          WEBHOOK_SECRET_ARN: ${{ secrets.WEBHOOK_SECRET_ARN_DEV }}
+          REQUESTOR_URL: ${{ vars.REQUESTOR_URL_DEV }}
 
   deploy-staging:
     if: github.ref == 'refs/heads/main'
@@ -106,6 +109,8 @@ jobs:
           DB_INSTANCE_SIZE: micro
           DB_INSTANCE_CLASS: burstable3
           OIDC_SECRET_ARN: ${{ secrets.OIDC_SECRET_ARN_STAGING }}
+          WEBHOOK_SECRET_ARN: ${{ secrets.WEBHOOK_SECRET_ARN_STAGING }}
+          REQUESTOR_URL: ${{ vars.REQUESTOR_URL_STAGING }}
 
   deploy-prod:
     if: github.ref == 'refs/heads/main'
@@ -148,3 +153,5 @@ jobs:
           DB_INSTANCE_CLASS: burstable3
           OIDC_SECRET_ARN: ${{ secrets.OIDC_SECRET_ARN_PROD }}
           MONITORING_PROMETHEUS_ROLE: ${{ secrets.MONITORING_PROMETHEUS_ROLE }}
+          WEBHOOK_SECRET_ARN: ${{ secrets.WEBHOOK_SECRET_ARN_PROD }}
+          REQUESTOR_URL: ${{ vars.REQUESTOR_URL_PROD }}

config/config.ts

@@ -20,100 +20,92 @@ export interface Config {
   deployEnvironment: string;
   dbRetention: number;
   remsTokenSecretArn: string;
-  ampWorkspaceId: string; 
+  ampWorkspaceId: string;
   monitoringAccountId: string;
   project?: string;
   owner?: string;
-  monitoringPrometheusRole?: string 
+  monitoringPrometheusRole?: string;
+  requestorUrl: string;
+  webhookSecretArn: string;  // Full ARN of rems/webhook-secret in Secrets Manager
 }
 
 export function getConfig(): Config {
-    const deployEnv = process.env.DEPLOY_ENV || "dev"; 
-    const isProd = deployEnv === "prod" || deployEnv === "production";
+  const deployEnv = process.env.DEPLOY_ENV || "dev";
+  const isProd = deployEnv === "prod" || deployEnv === "production";
 
-    return {
-      project: process.env.PROJECT || "ACDC",
-      owner: process.env.OWNER || "biocloud",
-      deployEnvironment: deployEnv,
-      remsTokenSecretArn: process.env.REMS_TOKEN_ARN || "arn:aws:secretmanager:region:account:secret:rems-token-secret",
-      oidcClientSecretArn:
-        process.env.OIDC_SECRET_ARN ||
-        "arn:aws:secretmanager:region:account:secret:rems-oidc-client-secret",
-      accountId: process.env.CDK_ACCOUNT_ID || "000000000000",
-      region: process.env.CDK_REGION || "ap-southeast-2",
-      vpcCidr: process.env.VPC_CIDR || "192.168.0.0/24",
-      publicUrl: process.env.PUBLIC_URL || "https://dev-rems.example.org/",
-      hostName: process.env.HOST_NAME || "dev-rems.example.org",
-      hostZone: process.env.HOST_ZONE || "example.org",
-      certificateArn:
-        process.env.CERTIFICATE_ARN ||
-        "arn:aws:acm:region:account:certificate/dev",
-      containerImage: process.env.CONTAINER_IMAGE || "cscfi/rems:latest",
-      dbName: process.env.DB_NAME || "rems",
-      dbUser: process.env.DB_USER || "rems",
-      postgresVersion: getPostgresEngineVersion(
-        process.env.POSTGRES_VERSION || "17.4"
-      ),
-      dbInstanceSize: getDBInstanceSize(
-        process.env.DB_INSTANCE_SIZE || "micro"
-      ),
-      dbInstanceClass: getDBInstanceClass(
-        process.env.DB_INSTANCE_CLASS || "burstable3"
-      ),
-      dbRetention: deployEnv === "prod" || deployEnv === "production" ? 30 : 7,
-      natGatewayCount:
-        deployEnv === "prod" || deployEnv === "production" ? 3 : 1,
-      ampWorkspaceId: process.env.AMP_WORKSPACE_ID || "ws-XXXXXXXX", 
-      monitoringAccountId: process.env.MONITORING_ACCOUNT_ID || "000000000000",
-      monitoringPrometheusRole: process.env.MONITORING_PROMETHEUS_ROLE || "arn:aws:iam::123456789012:role/MonitoringAccountPrometheusRole",
-    };
+  return {
+    project: process.env.PROJECT || "ACDC",
+    owner: process.env.OWNER || "biocloud",
+    deployEnvironment: deployEnv,
+    remsTokenSecretArn: process.env.REMS_TOKEN_ARN || "arn:aws:secretmanager:region:account:secret:rems-token-secret",
+    oidcClientSecretArn:
+      process.env.OIDC_SECRET_ARN ||
+      "arn:aws:secretmanager:region:account:secret:rems-oidc-client-secret",
+    accountId: process.env.CDK_ACCOUNT_ID || "000000000000",
+    region: process.env.CDK_REGION || "ap-southeast-2",
+    vpcCidr: process.env.VPC_CIDR || "192.168.0.0/24",
+    publicUrl: process.env.PUBLIC_URL || "https://dev-rems.example.org/",
+    hostName: process.env.HOST_NAME || "dev-rems.example.org",
+    hostZone: process.env.HOST_ZONE || "example.org",
+    certificateArn:
+      process.env.CERTIFICATE_ARN ||
+      "arn:aws:acm:region:account:certificate/dev",
+    containerImage: process.env.CONTAINER_IMAGE || "cscfi/rems:latest",
+    dbName: process.env.DB_NAME || "rems",
+    dbUser: process.env.DB_USER || "rems",
+    postgresVersion: getPostgresEngineVersion(
+      process.env.POSTGRES_VERSION || "17.4"
+    ),
+    dbInstanceSize: getDBInstanceSize(
+      process.env.DB_INSTANCE_SIZE || "micro"
+    ),
+    dbInstanceClass: getDBInstanceClass(
+      process.env.DB_INSTANCE_CLASS || "burstable3"
+    ),
+    dbRetention: isProd ? 30 : 7,
+    natGatewayCount: isProd ? 3 : 1,
+    ampWorkspaceId: process.env.AMP_WORKSPACE_ID || "ws-XXXXXXXX",
+    monitoringAccountId: process.env.MONITORING_ACCOUNT_ID || "000000000000",
+    monitoringPrometheusRole:
+      process.env.MONITORING_PROMETHEUS_ROLE ||
+      "arn:aws:iam::123456789012:role/MonitoringAccountPrometheusRole",
+    requestorUrl:
+      process.env.REQUESTOR_URL || "https://data.test.biocommons.org.au/requestor",
+    // Full ARN required — fromSecretCompleteArn needs the suffix (e.g. -4Zbga6)
+    // Set WEBHOOK_SECRET_ARN in CI/CD or .env per environment:
+    //   aws secretsmanager describe-secret --secret-id rems/webhook-secret | jq '.ARN'
+    webhookSecretArn:
+      process.env.WEBHOOK_SECRET_ARN ||
+      "arn:aws:secretsmanager:ap-southeast-2:000000000000:secret:rems/webhook-secret-??????",
+  };
 }
-
 
 export function getPostgresEngineVersion(version: string): PostgresEngineVersion {
   switch (version) {
-    case "13.20":
-      return PostgresEngineVersion.VER_13_20;
-    case "14.9":
-      return PostgresEngineVersion.VER_14_9;
-    case "15.9":
-      return PostgresEngineVersion.VER_15_9;
-    case "16.8":
-      return PostgresEngineVersion.VER_16_8;
-    case "17.4":
-      return PostgresEngineVersion.VER_17_4;
-    default:
-      throw new Error(`Unsupported Postgres version: ${version}`);
+    case "13.20": return PostgresEngineVersion.VER_13_20;
+    case "14.9": return PostgresEngineVersion.VER_14_9;
+    case "15.9": return PostgresEngineVersion.VER_15_9;
+    case "16.8": return PostgresEngineVersion.VER_16_8;
+    case "17.4": return PostgresEngineVersion.VER_17_4;
+    default: throw new Error(`Unsupported Postgres version: ${version}`);
   }
 }
 
-export function getDBInstanceSize(
-  size: string
-): InstanceSize {
+export function getDBInstanceSize(size: string): InstanceSize {
   switch (size.toLowerCase()) {
-    case "micro":
-      return InstanceSize.MICRO;
-    case "small":
-      return InstanceSize.SMALL;
-    case "medium":
-      return InstanceSize.MEDIUM;
-    case "large":
-      return InstanceSize.LARGE;;
-    default:
-      throw new Error(`Unsupported Postgres Instance size: ${size}`);
+    case "micro": return InstanceSize.MICRO;
+    case "small": return InstanceSize.SMALL;
+    case "medium": return InstanceSize.MEDIUM;
+    case "large": return InstanceSize.LARGE;
+    default: throw new Error(`Unsupported Postgres Instance size: ${size}`);
   }
 }
 
 export function getDBInstanceClass(cls: string): InstanceClass {
   switch (cls.toLowerCase()) {
-    case "burstable2":
-      return InstanceClass.BURSTABLE2;
-    case "burstable3":
-      return InstanceClass.BURSTABLE3;
-    case "memory":
-      return InstanceClass.MEMORY5;
-    default:
-      throw new Error(`Unsupported DB instance class: ${cls}`);
+    case "burstable2": return InstanceClass.BURSTABLE2;
+    case "burstable3": return InstanceClass.BURSTABLE3;
+    case "memory": return InstanceClass.MEMORY5;
+    default: throw new Error(`Unsupported DB instance class: ${cls}`);
   }
-}
-
+}