Revert "Rollback to before rework" (#139782)

.github/workflows/audit-account.yml

@@ -46,16 +46,16 @@ jobs:
           echo "Reports with no entries will be omitted"
           CI_ACTIVE="$(./audit-account.sh ci_active resources.json)"
           [[ $(jq -r 'length' <<< "${CI_ACTIVE}") -gt 0 ]] && jq -r '(.[0] 
-            | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv' <<< "${CI_ACTIVE}" > reports/ci_active.csv
+            | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv' <<< "${CI_ACTIVE}" > reports/ci_active.csv || :
           CI_INACTIVE="$(./audit-account.sh ci_inactive resources.json)"
           [[ $(jq -r 'length' <<< "${CI_INACTIVE}") -gt 0 ]] && jq -r '(.[0] 
-            | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv' <<< "${CI_INACTIVE}" > reports/ci_inactive.csv
+            | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv' <<< "${CI_INACTIVE}" > reports/ci_inactive.csv || :
           CF_OTHER="$(./audit-account.sh cf_other resources.json)"
           [[ $(jq -r 'length' <<< "${CF_OTHER}") -gt 0 ]] && jq -r '(.[0] 
-            | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv' <<< "${CF_OTHER}" > reports/cf_other.csv
+            | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv' <<< "${CF_OTHER}" > reports/cf_other.csv || :
           UNTAGGED="$(./audit-account.sh untagged resources.json)"
           [[ $(jq -r 'length' <<< "${UNTAGGED}") -gt 0 ]] && jq -r '(.[0] 
-            | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv' <<< "${UNTAGGED}" > reports/untagged.csv
+            | keys_unsorted) as $keys | $keys, map([.[ $keys[] ]])[] | @csv' <<< "${UNTAGGED}" > reports/untagged.csv || :
       - name: Upload reports
         uses: actions/upload-artifact@v4
         with:

.github/workflows/deploy.yml

@@ -7,8 +7,8 @@ on:
       - "!skipci*"
 
 concurrency:
-  # Ensuring group key matches the destroy workflow currently in master
-  group: ${{ github.workflow }}-${{ github.ref_name }}
+  # Ensuring group key matches the destroy workflow currently in main
+  group: ${{ github.ref_name }}
   cancel-in-progress: false
 
 permissions:

.github/workflows/destroy.yml

@@ -8,6 +8,9 @@ on:
         description: "Name of the environment to destroy:"
         required: true
 
+concurrency:
+  group: ${{ inputs.environment || github.event.ref }}
+
 permissions:
   id-token: write
   contents: read
@@ -62,4 +65,18 @@ jobs:
           inputs: '{ "topics": "mgmt.connect.cms-carts-seds.carts-bigmac-streams-${{env.BRANCH_NAME}}.config,mgmt.connect.cms-carts-seds.carts-bigmac-streams-${{env.BRANCH_NAME}}.offsets,mgmt.connect.cms-carts-seds.carts-bigmac-streams-${{env.BRANCH_NAME}}.status"}'
           ref: refs/heads/master # Otherwise workflow-dispatch tries to operate off of our default name
       - name: Destroy
-        run: ./run destroy --stage $STAGE_PREFIX$branch_name --verify false
+        run: ./run destroy --stage $STAGE_PREFIX$branch_name --verify false
+
+  # Notify the integrations channel when a destroy action fails
+  notify_on_destroy_failure:
+    runs-on: ubuntu-latest
+    needs: 
+      - destroy
+    if: ${{ failure() }}
+    steps:
+      - name: Slack Notification
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_TITLE: ":boom: A destroy action has failed on ${{ github.repository }}."
+          MSG_MINIMAL: true
+          SLACK_WEBHOOK: ${{ secrets.INTEGRATIONS_SLACK_WEBHOOK }}

.github/workflows/post-deploy-slack-notification.yml

@@ -8,7 +8,6 @@ on:
       - 'main'
       - 'val'
       - 'production'
-      - 'snyk-**'
 
 jobs:
   notify_on_failure:
@@ -24,20 +23,6 @@ jobs:
           MSG_MINIMAL: true
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
 
-  # Notify the integrations channel only when a Snyk auto merge fails
-  notify_failed_snyk_auto_merge:
-    runs-on: ubuntu-latest
-    #only check branch names that begin with snyk-
-    if: ${{ github.event.workflow_run.conclusion == 'failure' && startsWith(github.event.workflow_run.head_branch, 'snyk-') }}
-    steps:
-      - name: Slack Notification
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_TITLE: ":boom: A Synk auto merge has failed in ${{ github.repository }}"
-          SLACK_MESSAGE: "${{ github.event.workflow_run.html_url }}"
-          MSG_MINIMAL: true
-          SLACK_WEBHOOK: ${{ secrets.INTEGRATIONS_SLACK_WEBHOOK }}
-
   # Sends a slack message to the mdct-prod-releases channel in CMS slack
   notify_on_prod_release:
     runs-on: ubuntu-latest

.github/workflows/pull-request.yml

@@ -44,21 +44,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PRNUM: ${{ github.event.pull_request.number }}
-          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
-
-  #Notify the integrations channel only when a Snyk auto merge fails pr checks
-  notify_on_pr_failure:
-    runs-on: ubuntu-latest
-    needs: 
-      - linting
-      - jest-frontend
-      - jest-backend
-    #only check branch names that begin with snyk-
-    if: ${{ failure() && startsWith(github.head_ref, 'snyk-') }}
-    steps:
-      - name: Slack Notification
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_TITLE: ":boom: A Synk auto merge has failed pull request checks in ${{ github.repository }}."
-          MSG_MINIMAL: true
-          SLACK_WEBHOOK: ${{ secrets.INTEGRATIONS_SLACK_WEBHOOK }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}

.github/workflows/scan_security-hub-jira-integration.yml

@@ -21,13 +21,12 @@ jobs:
           aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
           role-to-assume: ${{ secrets.PRODUCTION_SYNC_OIDC_ROLE }}
       - name: Sync Security Hub and Jira
-        uses: Enterprise-CMCS/mac-fc-security-hub-visibility@v1.0.5
+        uses: Enterprise-CMCS/mac-fc-security-hub-visibility@v2.0.9
         with:
           jira-username: "mdct_github_service_account"
           jira-token: ${{ secrets.JIRA_ENT_USER_TOKEN }}
-          jira-host: jiraent.cms.gov
           jira-project-key: CMDCT
           jira-ignore-statuses: Done, Closed, Canceled
           jira-custom-fields: '{ "customfield_10100": "CMDCT-2280", "customfield_26700" : [{"id": "40101", "value": "CARTS"}] }'
           aws-severities: CRITICAL, HIGH, MEDIUM
-          assign-jira-ticket-to: "MWTW"
+          jira-assignee: "MWTW"

README.md

@@ -4,7 +4,7 @@
 [![Maintainability](https://api.codeclimate.com/v1/badges/f1775f53aedf747e85b2/maintainability)](https://codeclimate.com/repos/6449718c21275100df510ea9/maintainability)
 [![Test Coverage](https://api.codeclimate.com/v1/badges/f1775f53aedf747e85b2/test_coverage)](https://codeclimate.com/repos/6449718c21275100df510ea9/test_coverage)
 
-### Integration Environment Deploy Status:
+## Integration Environment Deploy Status:
 | Branch  | Build Status |
 | ------------- | ------------- |
 | main  | ![deploy](https://github.com/Enterprise-CMCS/macpro-mdct-carts/actions/workflows/deploy.yml/badge.svg)  |
@@ -16,7 +16,7 @@ CARTS is the CMCS MDCT application for collecting state data related to coverage
 
 Under section 2108(a) of the Act, states must assess the operation of their separate CHIP and Medicaid expansion programs and the progress made in reducing the number of uncovered, low-income children. The results of the assessment are reported to the Secretary by January 1 following the end of the FY in the CHIP Annual Reporting Template System (CARTS). CARTS collects information about programmatic changes, performance goals, program operation, program financing, program challenges and accomplishments.
 
-_Note: The [`main`](https://github.com/Enterprise-CMCS/macpro-mdct-carts/tree/main) branch contains CARTSv3. All code related to CARTSv2 (legacy) can be found in the [`master`](https://github.com/Enterprise-CMCS/macpro-mdct-carts/tree/master) branch._
+_Note: The [`main`](https://github.com/Enterprise-CMCS/macpro-mdct-carts/tree/main) branch contains CARTSv3. All code related to CARTSv2 (legacy) can be found in the [`skipci-archive-carts-v2`](https://github.com/Enterprise-CMCS/macpro-mdct-carts/tree/skipci-archive-carts-v2) branch._
 
 ## Table of contents
 
@@ -115,10 +115,7 @@ On the SEDS side, this topic is updated on every submission of seds data, but CA
 - 4th quarter data.
 - The rollover for a "new year" is October, and future submissions are not recognized until that threshold
 
-Updates outside of that time frame will need to be manually corrected in CARTS, or the integration will need to be modifed to collect data for old forms. CARTS additionally looks for the `enrollmentCounts` property which is only included in forms 21E and 64.21E (question 7), either by manual trigger or update. See SEDS files:
-
-- [generateEnrollmentTotals](https://github.com/Enterprise-CMCS/macpro-mdct-seds/blob/master/services/app-api/handlers/state-forms/post/generateEnrollmentTotals.js)
-- [updateStateForms](https://github.com/Enterprise-CMCS/macpro-mdct-seds/blob/master/services/app-api/handlers/state-forms/post/updateStateForms.js)
+Updates outside of that time frame will need to be manually corrected in CARTS, or the integration will need to be modifed to collect data for old forms. CARTS additionally looks for the `enrollmentCounts` property which is only included in forms 21E and 64.21E (question 7), either by manual trigger or update.
 
 For testing convenience, stateuser2 points at AL in CARTS and the stateuser points at AL in SEDS.
 

package.json

@@ -40,7 +40,7 @@
     "eslint-plugin-react": "^7.24.0",
     "eslint-plugin-react-hooks": "^2.x",
     "prettier": "^2.4.1",
-    "serverless": "^3.38.0",
+    "serverless": "^3.39.0",
     "serverless-bundle": "^6.1.0",
     "serverless-cloudfront-invalidate": "^1.12.2",
     "serverless-dotenv-plugin": "^3.0.0",

services/app-api/handlers/printing/printPdf.ts

@@ -21,7 +21,7 @@ export const print = handler(async (event, _context) => {
   if (DOMPurify.isSupported) {
     sanitizedHtml = DOMPurify.sanitize(rawHtml, {
       WHOLE_DOCUMENT: true,
-      ADD_TAGS: ["head"],
+      ADD_TAGS: ["head", "link", "base"],
     });
   }
   if (!sanitizedHtml) {
@@ -39,7 +39,7 @@ export const print = handler(async (event, _context) => {
       document_content: rawHtml,
       type: "pdf" as const,
       // This tag differentiates QMR and CARTS requests in DocRaptor's logs.
-      tag: "CARTS",
+      tag: `CARTS ${stage}`,
       test: stage !== "production",
       prince_options: {
         profile: "PDF/UA-1" as const,

services/app-api/handlers/printing/tests/printPdf.test.ts

@@ -54,7 +54,7 @@ describe("Test Print PDF handler", () => {
       doc: expect.objectContaining({
         document_content: html,
         type: "pdf",
-        tag: "CARTS",
+        tag: expect.stringMatching("CARTS"),
         prince_options: expect.objectContaining({
           profile: "PDF/UA-1",
         }),

services/app-api/handlers/stateStatus/tests/uncertify.test.ts

@@ -17,14 +17,29 @@ jest.mock("../../../libs/authorization", () => ({
     state: "AL",
   }),
 }));
+
 describe("Test Uncertify CARTS Report Handler", () => {
   test("uncertify CARTS report", async () => {
     const event: APIGatewayProxyEvent = {
       ...testEvent,
       pathParameters: { year: "2021", state: "AL" },
       body: `{"status": "in_progress", "username": "test user"}`,
     };
+
     const res = await updateStateStatus(event, null);
+
+    /*
+     * Convert date to a regex that doesn't care about seconds.
+     * For example "12:34:56 (UTC)" becomes /12:34:.. \(UTC\)/
+     * This reduces flakiness, in case a second passes during text execution
+     */
+    const expectedDateString = new Date()
+      .toString()
+      .replace("(", "\\(")
+      .replace(")", "\\)")
+      .replace("+", "\\+")
+      .replace(/(?<=\d{2}:\d{2}:)\d{2}/, "..");
+
     expect(res.statusCode).toBe(200);
     expect(dynamodbLib.update).toBeCalledWith({
       ExpressionAttributeNames: {
@@ -33,7 +48,7 @@ describe("Test Uncertify CARTS Report Handler", () => {
       },
       ExpressionAttributeValues: {
         ":status": "in_progress",
-        ":lastChanged": new Date().toString(),
+        ":lastChanged": expect.stringMatching(expectedDateString),
       },
       Key: {
         stateId: "AL",

services/app-api/libs/validation/backend-section.schema.ts

@@ -359,6 +359,9 @@ export const sectionSchema = {
           hint: {
             type: "string",
           },
+          mask: {
+            type: "string",
+          },
           questions: {
             type: "array",
             items: {

services/app-api/package.json

@@ -18,7 +18,7 @@
   "devDependencies": {
     "@types/dompurify": "^3.0.5",
     "@types/jest": "^27.4.0",
-    "@types/jsdom": "^21.1.6",
+    "@types/jsdom": "^21.1.7",
     "aws-sdk-client-mock": "^3.0.0",
     "jest": "^27.4.7",
     "serverless-associate-waf": "^1.2.1",
@@ -27,19 +27,22 @@
     "typescript": "^4.5.4"
   },
   "dependencies": {
-    "@aws-sdk/client-dynamodb": "^3.596.0",
-    "@aws-sdk/client-s3": "^3.596.0",
-    "@aws-sdk/client-ssm": "^3.596.0",
-    "@aws-sdk/lib-dynamodb": "^3.596.0",
-    "@aws-sdk/s3-request-presigner": "^3.596.0",
+    "@aws-sdk/client-dynamodb": "^3.621.0",
+    "@aws-sdk/client-s3": "^3.621.0",
+    "@aws-sdk/client-ssm": "^3.621.0",
+    "@aws-sdk/lib-dynamodb": "^3.621.0",
+    "@aws-sdk/s3-request-presigner": "^3.621.0",
     "aws-jwt-verify": "^3.1.0",
     "dompurify": "^3.1.4",
-    "jsdom": "^22.1.0",
+    "jsdom": "^24.1.0",
     "jsonpath-plus": "^5.1.0",
     "jsonschema": "^1.4.1",
     "jwt-decode": "^3.1.2",
     "uuid": "^7.0.3"
   },
+  "resolutions": {
+    "ws": "^8.18.0"
+  },
   "jest": {
     "verbose": true,
     "transform": {