feat(week8): JWT auth, SSM Parameter Store, and UI overhaul

2026-05-30 07:06:21 +01:00
parent 0de2d1dd42
commit dcaef8ff13
49 changed files with 8868 additions and 723 deletions
@@ -19,22 +19,18 @@ jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
-
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
-
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: app/backend/package-lock.json
-
      - name: Install backend dependencies
        working-directory: app/backend
        run: npm ci
-
      - name: Run ESLint
        working-directory: app/backend
        run: npx eslint . --ext .js --max-warnings=0
@@ -43,22 +39,18 @@ jobs:
    name: Unit Tests
    runs-on: ubuntu-latest
    needs: lint
-
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
-
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: app/backend/package-lock.json
-
      - name: Install backend dependencies
        working-directory: app/backend
        run: npm ci
-
      - name: Run unit tests
        working-directory: app/backend
        run: npm test
@@ -67,14 +59,11 @@ jobs:
    name: Build & Integration Test
    runs-on: ubuntu-latest
    needs: unit-test
-
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
-
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
-
      - name: Build backend image
        uses: docker/build-push-action@v5
        with:
@@ -85,7 +74,6 @@ jobs:
          tags: task-backend:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max
-
      - name: Build frontend image
        uses: docker/build-push-action@v5
        with:
@@ -96,10 +84,8 @@ jobs:
          tags: task-frontend:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max
-
      - name: Start stack
        run: docker compose up -d
-
      - name: Wait for backend to be healthy
        run: |
          echo "Waiting for backend health..."
@@ -117,7 +103,6 @@ jobs:
            fi
            sleep 5
          done
-
      - name: Wait for frontend to be healthy
        run: |
          echo "Waiting for frontend health..."
@@ -135,7 +120,6 @@ jobs:
            fi
            sleep 5
          done
-
      - name: Assert backend health endpoint
        run: |
          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost/api/health)
@@ -146,7 +130,6 @@ jobs:
            exit 1
          fi
          echo "PASSED"
-
      - name: Assert frontend serves 200
        run: |
          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost)
@@ -157,11 +140,9 @@ jobs:
            exit 1
          fi
          echo "PASSED"
-
      - name: Print logs on failure
        if: failure()
        run: docker compose logs
-
      - name: Tear down stack
        if: always()
        run: docker compose down --volumes
@@ -171,34 +152,27 @@ jobs:
    runs-on: ubuntu-latest
    needs: build-and-integration-test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
-
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
-
      - name: Extract short SHA
        id: vars
        run: echo "sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::424522917561:role/github-actions-scalable-task-platform
          aws-region: us-east-1
-
      - name: Log in to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2
-
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
      - name: Build and push backend
        uses: docker/build-push-action@v5
        with:
@@ -212,7 +186,6 @@ jobs:
            ${{ env.DOCKERHUB_REGISTRY }}/task-backend:sha-${{ steps.vars.outputs.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
-
      - name: Build and push frontend
        uses: docker/build-push-action@v5
        with:
@@ -226,7 +199,6 @@ jobs:
            ${{ env.DOCKERHUB_REGISTRY }}/task-frontend:sha-${{ steps.vars.outputs.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
-
      - name: Job summary
        run: |
          echo "### Published Images - $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_STEP_SUMMARY
@@ -254,25 +226,20 @@ jobs:
    defaults:
      run:
        working-directory: infra/terraform
-
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
-
      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::424522917561:role/github-actions-scalable-task-platform
          aws-region: us-east-1
-
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.10.3
-
      - name: Terraform Init
        run: terraform init
-
      - name: Terraform Plan
        run: terraform plan -no-color -lock-timeout=5m
        env:
@@ -282,6 +249,7 @@ jobs:
          TF_VAR_db_username: ${{ secrets.TF_VAR_db_username }}
          TF_VAR_db_password: ${{ secrets.TF_VAR_db_password }}
          TF_VAR_db_host: ${{ secrets.TF_VAR_db_host }}
+          TF_VAR_jwt_secret: ${{ secrets.TF_VAR_JWT_SECRET }}

  terraform-apply:
    name: Terraform Apply
@@ -294,26 +262,21 @@ jobs:
    defaults:
      run:
        working-directory: infra/terraform
-
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
-
      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::424522917561:role/github-actions-scalable-task-platform
          aws-region: us-east-1
-
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.10.3
-
      - name: Terraform Init
        run: terraform init
-
-      - name: Terraform Apply — provision RDS
+      - name: Terraform Apply - provision SSM and infrastructure
        run: terraform apply -auto-approve -lock-timeout=5m
        env:
          TF_VAR_aws_account_id: ${{ secrets.TF_VAR_AWS_ACCOUNT_ID }}
@@ -322,14 +285,13 @@ jobs:
          TF_VAR_db_username: ${{ secrets.TF_VAR_db_username }}
          TF_VAR_db_password: ${{ secrets.TF_VAR_db_password }}
          TF_VAR_db_host: ${{ secrets.TF_VAR_db_host }}
-
+          TF_VAR_jwt_secret: ${{ secrets.TF_VAR_JWT_SECRET }}
      - name: Capture RDS hostname
        id: rds
        run: |
          RDS_HOST=$(terraform output -raw rds_hostname)
          echo "hostname=$RDS_HOST" >> $GITHUB_OUTPUT
-
-      - name: Terraform Apply — wire EC2 with RDS hostname
+      - name: Terraform Apply - wire EC2 with RDS hostname
        run: terraform apply -auto-approve -lock-timeout=5m
        env:
          TF_VAR_aws_account_id: ${{ secrets.TF_VAR_AWS_ACCOUNT_ID }}
@@ -338,10 +300,11 @@ jobs:
          TF_VAR_db_username: ${{ secrets.TF_VAR_db_username }}
          TF_VAR_db_password: ${{ secrets.TF_VAR_db_password }}
          TF_VAR_db_host: ${{ steps.rds.outputs.hostname }}
-
+          TF_VAR_jwt_secret: ${{ secrets.TF_VAR_JWT_SECRET }}
      - name: Job summary
        run: |
          echo "### Terraform Apply - $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- RDS hostname: \`${{ steps.rds.outputs.hostname }}\`" >> $GITHUB_STEP_SUMMARY
-          echo "- EC2 re-provisioned with DB connection wired" >> $GITHUB_STEP_SUMMARY
+          echo "- SSM parameters provisioned" >> $GITHUB_STEP_SUMMARY
+          echo "- EC2 startup script fetches secrets from SSM at runtime" >> $GITHUB_STEP_SUMMARY