Package: govtech-csg-xcg-secretsmanager
govtech-csg-xcg-secretsmanagerThis package belongs to theeXtended Code Guardrails (XCG)project, which consists of a series of packages that harden the Django web framework to prevent common web application vulnerabilities.Specifically, the Secrets Manager package provides AWS Secrets Manager support for Django secret key as well as database backends (MySQL and PostgreSQL).Do note that the README in this repository is intentionally limited in scope and is catered towards developers. For detailed instructions on installation, usage, and community guidelines, please refer to the published documentation athttps://xcg.tech.gov.sg.Security-related mattersFor instructions on how toreport a vulnerability, refer to theofficial documentation website.Additionally,enable email alerts for security issues by "watching" this repository. The "watch" button can be found near the top right corner of this repo's home page, and there are various options for configuring notification volume. To receive security alerts, either enable notifications for"All Activity"or"Custom -> Security alerts".Installing development dependenciesBefore building or testing the package, or committing changes, install the development dependencies into a virtual environment:# In the project root directorypython-mvenv.venv&&source.venv/bin/activate
pipinstall-rrequirements-dev.txtBuildingThe package can be built usingbuildas the build frontend andsetuptoolsas the build backend.Run the build command below:# In the project root directorypython-mbuild.This creates a directory nameddist/, which should contain 2 files:A.whl(wheel) file, which is abinary distribution formatfor Python packagesA.tar.gzfile, which is asource distribution formatfor Python packagesTo view the source files included in the source distribution, use thetarutility as follows:tar--list-fdist/<filename>.tar.gzTo install the package directly from either distribution files:pipinstall<name_of_distribution_file>TestingPrerequisitesTo run the tests for database backends, you have to first install MySQL and PostgreSQL on your development machine. Refer to the official documentation for installation instructions. Take note that your services should be running locally using their default ports (3306 for MySQL and 5432 for PostgreSQL).Having installed and started the database services, create a test user and a test database in each as targets for the test application. You can use the commands below for reference:MySQLCREATEUSER'secretsmanager_test'@'localhost'IDENTIFIEDBY'Password123!';GRANTALLPRIVILEGESON*.*TO'secretsmanager_test'@'localhost'WITHGRANTOPTION;FLUSHPRIVILEGES;CREATEDATABASEmysql_secretsmanager_testCHARACTERSETutf8;PostgreSQLCREATEUSERsecretsmanager_testWITHPASSWORD'Password123!';ALTERUSERsecretsmanager_testWITHSUPERUSER;CREATEDATABASEpostgresql_secretsmanager_testENCODING'UTF8';Running the testsBefore running the tests, you should have already created a virtual environment and installed all the development dependencies. If not, please follow theinstructions aboveto install them.With the development dependencies installed, perform an editable install of the Secrets Manager package itself:# Note: This command should be run from the project's root directory.pipinstall-e.Export the credentials for both database services as environment variables. This is required by thecreate_db_secrets.pyscript to create mock AWS Secrets Manager secrets for the Django application to use.exportMYSQL_USERNAME=<your_username>exportMYSQL_PASSWORD=<your_password>exportPOSTGRESQL_USERNAME=<your_username>exportPOSTGRESQL_PASSWORD=<your_password>Change to thetestsdirectory and run the stored database migrations for both configured databases (mysql_testandpostgresql_test) using the helper scriptmigrate_all_databases.sh.cdtests/
/bin/bashmigrate_all_databases.shFinally, staying within thetestsdirectory, run unit tests using the helper scriptrun_all_tests.sh./bin/bashrun_all_tests.shRunning pre-commit hooksNote: This section is only relevant if you intend to contribute codeThis project uses thepre-committoolto run Git pre-commit hooks for linting and code quality checks. Thepre-committool itself should have been installed along with thedevelopment dependencies. After cloning the repositoryfor the first time, run the command below to "install" the Git hooks:pre-commitinstallThe command above creates a file.git/hooks/pre-commit, which defines the shell commands to run before any Git commit is created.Subsequently, any invocation ofgit commitwill trigger the commands, rejecting the commit if there are linting errors. Issues should be automatically fixed, but you will need to re-stage the changes before attempting the commit again.For a list of hooks run bypre-commit, see itsconfiguration file.