npm package: @st-graphics/premium
Description: ST Graphics Premium implementation
Author: Yong Jun, May Linn
Latest version: 0.2.20

# st-graphics-premium

![Premium Flow](./doc/PremiumFlow.png)
<!-- 
## Logic Flow

1. Fetch JSON on page load
   - `client/premium.js` > `.fetchContent()`
   - Pass in un-prefixed JSON ID into query string as `resourceKey`
   - ![Example JSON ID](./doc/example_JSON_id.png)
2. Hit `getPremiumContentUrl` lambda
  - `SESSIONID` not present in cookie
  - 403
  - Fallback to `client/premium.js` > `.fetchPublicContent()`
  - Fetch public JSON directly from S3
3. Render login widget

1. Client initialize login flow
  - Refer to: `client/premium.js` > `.getAuthorizationUrl()`
  - returns url which will go into the `href` of login `<a>`
  - `redirect_uri` in query string set to `/create-session` lambda endpoint
  - `window.location` passed into `state` in query string
  - eg. `https://ds-acc-auth.sphdigital.com/amserver/oauth2/authorize?response_type=code&client_id=st_graphics&state=eyJyZWRpcmVjdF91cmwiOiJodHRwOi8vc3QtdmlzdWFscy5jb20vaW5mb2dyYXBoaWNzL2hkYi1sZWFzZS0yMDE4L2luZGV4Lmh0bWwifQ%3D%3D&redirect_uri=https%3A%2F%2Fepc9c723qd.execute-api.ap-southeast-1.amazonaws.com%2Fproduction%2Fcreate-session&scope=uid%20aologinid%20aovisitorid%20aonickname%20aoregservice`
2. After login is handled by LDAP, redirect to `/create-session` lambda endpoint
  - Expects to receive OAuth2 authorization `code` and `state`
3. New session creation
  - Refer to: `functions/createSession/index.js`
  - Exchange token - `functions/createSession/authenticate.js` > `exchangeToken`
  - Fetch user info - `functions/createSession/authenticate.js` > `fetchUserInfo`
  - Verify user is subscriber - `functions/createSession/authenticate.js` > `verifyUser`
  - Store session in DynamoDB - `functions/createSession/Session.js`
  - Obtain auth `request origin` (eg. https://graphics.straitstimes.com/interactives/2018/12/awesome-story) from `state`
  - Redirect to request origin
  - Return `SESSIONID` in cookie
  - Any error (server, authentication etc) will be handled in a catch block and lambda exit by redirecting back to request origin. Therefore client will not see any error but login widget will continue to show. Go to Cloudwatch Log to check error
4. Redirect back. Set-cookie `SESSIONID`

1. Fetch JSON again on redirect back
  - Refer to: `client/premium.js` > `.fetchContent()`
  - Hit `getPremiumContentUrl` lambda
  - `SESSIONID` present in cookie
2. Check session exist
  - Refer to: `functions/getPremiumContentUrl/index.js` & `functions/getPremiumContentUrl/authenticate.js`
  - Retrieve session from DynamoDB
  - Renew credentials if necessary - `functions/getPremiumContentUrl/authenticate.js` > `renewCredential`
  - Fetch user info - `functions/getPremiumContentUrl/authenticate.js` > `fetchUserInfo`
  - Verify user is subscriber - `functions/getPremiumContentUrl/authenticate.js` > `verifyUser`
  - Update session record in DynamoDB - `functions/getPremiumContentUrl/Session.js`
3. Prepare signed URL to fetch premium JSON
  - Obtain [signed URL to premium JSON from S3](./functions/getPremiumContentUrl/index.js#L50)
  - 200

## Build and deploy process
0. Add CodeCommit repo `st-graphics-premium` in git remote: `git remote add deploy https://git-codecommit.ap-southeast-1.amazonaws.com/v1/repos/st-graphics-premium`
  - arn:aws:codecommit:ap-southeast-1:445350688363:st-graphics-premium
1. **Update code**
2. **`git commit` and `git push deploy master`**
3. New commit triggers a CloudWatch event `st-graphics-premium-source-change`
  - arn:aws:events:ap-southeast-1:445350688363:rule/st-graphics-premium-source-change
4. CloudWatch event starts CodePipeline `st-graphics-premium-pipeline`
  - arn:aws:codepipeline:ap-southeast-1:445350688363:st-graphics-premium-pipeline
5. CodePipeline uses the S3 bucket `st-graphics-build` for storing and transfers of build artefacts in between stages of the pipeline
  - arn:aws:s3:::st-graphics-build
6. CodePipeline pass updated source through CodeBuild `st-graphics-premium-build`
  - arn:aws:codebuild:ap-southeast-1:445350688363:project/st-graphics-premium-build
7. CodeBuild performs three actions:
   1. Install Lambda npm dependencies
   2. Copy Swagger template (API configuration) to `st-graphics-code` bucket
   3. [Package](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/package.html) referenced resources from CloudFormation templates
8. Packaged CloudFormation templates will be hand over to CloudFormation to generate the change set for the `st-graphics-premium` stack
  - Development: arn:aws:cloudformation:ap-southeast-1:445350688363:stack/st-graphics-premium/7b40abc0-d6e9-11e8-9b98-0299b044e622
  - Production: arn:aws:cloudformation:ap-southeast-1:070427650325:stack/st-graphics-premium/e93f9490-ed43-11e8-a907-067362399fde
9. **From AWS console, visit the respective CloudFormation stacks and execute the prepared change set**

Only the steps 1, 2 & 9 higlighted in **bold** requires user involvement. The rest perform automatically in the background.

Executing of change set can be done independently. i.e.
- execute `developement` change set first
- test API to make sure change is not breaking anything and working as intended
- make changes to fix any bug
- deploy again
- when ready execute `production` change set
 -->