BC-5522-Implementation of an API for deleting data

ansible/roles/schulcloud-server-core/tasks/main.yml

@@ -142,3 +142,17 @@
     when:
      - KEDA_ENABLED is defined and KEDA_ENABLED|bool
      - SCALED_PREVIEW_GENERATOR_ENABLED is defined and SCALED_PREVIEW_GENERATOR_ENABLED|bool
+
+
+  - name: AdminApiServerDeployment
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      template: admin-api-server-deployment.yml.j2
+
+  - name: AdminApiServerService
+    kubernetes.core.k8s:
+      kubeconfig: ~/.kube/config
+      namespace: "{{ NAMESPACE }}"
+      template: admin-api-server-svc.yml.j2
+

ansible/roles/schulcloud-server-core/templates/admin-api-server-deployment.yml.j2

@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: admin-api-deployment
+  namespace: {{ NAMESPACE }}
+  labels:
+    app: admin-api-serv
+    app.kubernetes.io/part-of: schulcloud-verbund
+    app.kubernetes.io/version: {{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+    app.kubernetes.io/name: admin-api-serv
+    app.kubernetes.io/component: admin-api
+    app.kubernetes.io/managed-by: ansible
+    git.branch: {{ SCHULCLOUD_SERVER_BRANCH_NAME }}
+    git.repo: {{ SCHULCLOUD_SERVER_REPO_NAME }}
+spec:
+  replicas: {{ TLDRAW_SERVER_REPLICAS|default("1", true) }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      #maxUnavailable: 1
+  revisionHistoryLimit: 4
+  paused: false
+  selector:
+    matchLabels:
+      app: admin-api-serv
+  template:
+    metadata:
+      labels:
+        app: admin-api-serv
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        runAsNonRoot: true
+      containers:
+      - name: admin-api
+        image: {{ SCHULCLOUD_SERVER_IMAGE }}:{{ SCHULCLOUD_SERVER_IMAGE_TAG }}
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 4030
+          name: admin-api-serv
+          protocol: TCP
+        envFrom:
+        - configMapRef:
+            name: api-configmap
+        - secretRef:
+            name: api-secret
+        command: ['npm', 'run', 'nest:start:admin-api-server:prod']
+        resources:
+          limits:
+            cpu: {{ ADMIN_API_SERVER_CPU_LIMITS|default("2000m", true) }}
+            memory: {{ ADMIN_API_SERVER_MEMORY_LIMITS|default("4Gi", true) }}
+          requests:
+            cpu: {{  ADMIN_API_SERVER_CPU_REQUESTS|default("100m", true) }}
+            memory: {{  ADMIN_API_SERVER_MEMORY_REQUESTS|default("150Mi", true) }}

ansible/roles/schulcloud-server-core/templates/admin-api-server-svc.yml.j2

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: admin-api-serv-svc
+  namespace: {{ NAMESPACE }}
+  labels:
+    app: admin-api-serv
+spec:
+  type: ClusterIP
+  ports:
+    # port for http managing drawing data
+    - port: 4030
+      targetPort: 4030
+      protocol: TCP
+      name: admin-api-serv
+  selector:
+    app: admin-api-serv

ansible/roles/schulcloud-server-core/templates/deployment.yml.j2

@@ -49,6 +49,9 @@ spec:
         - containerPort: 3030
           name: api
           protocol: TCP
+        - containerPort: 4030
+          name: api-admin
+          protocol: TCP
         - containerPort: 9090
           name: api-metrics
           protocol: TCP

ansible/roles/schulcloud-server-core/templates/svc.yml.j2

@@ -12,6 +12,10 @@ spec:
       targetPort: 3030
       protocol: TCP
       name: api
+    - port: 4030
+      targetPort: 4030
+      protocol: TCP
+      name: api-admin
     - port: {{ PORT_METRICS_SERVER }}
       targetPort: 9090
       protocol: TCP

apps/server/src/apps/admin-api-server.app.ts

@@ -0,0 +1,42 @@
+/* istanbul ignore file */
+/* eslint-disable no-console */
+import { NestFactory } from '@nestjs/core';
+import { install as sourceMapInstall } from 'source-map-support';
+import { LegacyLogger, Logger } from '@src/core/logger';
+import { enableOpenApiDocs } from '@shared/controller/swagger';
+import { AppStartLoggable } from '@src/apps/helpers/app-start-loggable';
+import { ExpressAdapter } from '@nestjs/platform-express';
+import express from 'express';
+import { AdminApiServerModule } from '@src/modules/server/admin-api.server.module';
+import { Configuration } from '@hpi-schul-cloud/commons/lib';
+
+async function bootstrap() {
+	sourceMapInstall();
+
+	const nestAdminServerExpress = express();
+	const nestAdminServerExpressAdapter = new ExpressAdapter(nestAdminServerExpress);
+	nestAdminServerExpressAdapter.disable('x-powered-by');
+	const nestAdminServerApp = await NestFactory.create(AdminApiServerModule, nestAdminServerExpressAdapter);
+	nestAdminServerApp.useLogger(await nestAdminServerApp.resolve(LegacyLogger));
+	nestAdminServerApp.enableCors();
+
+	const logger = await nestAdminServerApp.resolve(Logger);
+	enableOpenApiDocs(nestAdminServerApp, 'docs');
+	nestAdminServerApp.setGlobalPrefix('/admin/api/v1');
+
+	await nestAdminServerApp.init();
+
+	const adminApiServerPort = Configuration.get('ADMIN_API__PORT') as number;
+
+	nestAdminServerExpress.listen(adminApiServerPort, () => {
+		logger.info(
+			new AppStartLoggable({
+				appName: 'Admin API server app',
+				port: adminApiServerPort,
+				mountsDescription: `/admin/api/v1 --> Admin API Server`,
+			})
+		);
+	});
+}
+
+void bootstrap();

apps/server/src/modules/authentication/authentication.module.ts

@@ -18,6 +18,7 @@ import { JwtStrategy } from './strategy/jwt.strategy';
 import { LdapStrategy } from './strategy/ldap.strategy';
 import { LocalStrategy } from './strategy/local.strategy';
 import { Oauth2Strategy } from './strategy/oauth2.strategy';
+import { XApiKeyStrategy } from './strategy/x-api-key.strategy';
 
 // values copied from Algorithm definition. Type does not exist at runtime and can't be checked anymore otherwise
 const algorithms = [
@@ -76,6 +77,7 @@ const jwtModuleOptions: JwtModuleOptions = {
 		LdapService,
 		LdapStrategy,
 		Oauth2Strategy,
+		XApiKeyStrategy,
 	],
 	exports: [AuthenticationService],
 })

apps/server/src/modules/authentication/config/x-api-key.config.ts

@@ -0,0 +1,3 @@
+export interface XApiKeyConfig {
+	ADMIN_API__ALLOWED_API_KEYS: string[];
+}

apps/server/src/modules/authentication/strategy/x-api-key.strategy.spec.ts

@@ -0,0 +1,70 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { Test, TestingModule } from '@nestjs/testing';
+import { ConfigService } from '@nestjs/config';
+import { createMock } from '@golevelup/ts-jest';
+import { XApiKeyStrategy } from './x-api-key.strategy';
+import { XApiKeyConfig } from '../config/x-api-key.config';
+
+describe('XApiKeyStrategy', () => {
+	let module: TestingModule;
+	let strategy: XApiKeyStrategy;
+	let configService: ConfigService<XApiKeyConfig, true>;
+
+	beforeAll(async () => {
+		module = await Test.createTestingModule({
+			imports: [],
+			providers: [
+				XApiKeyStrategy,
+				{
+					provide: ConfigService,
+					useValue: createMock<ConfigService<XApiKeyConfig, true>>({ get: () => ['1ab2c3d4e5f61ab2c3d4e5f6'] }),
+				},
+			],
+		}).compile();
+
+		strategy = module.get(XApiKeyStrategy);
+		configService = module.get(ConfigService<XApiKeyConfig, true>);
+	});
+
+	afterAll(async () => {
+		await module.close();
+	});
+
+	beforeEach(() => {
+		jest.resetAllMocks();
+	});
+
+	describe('validate', () => {
+		const setup = () => {
+			const CORRECT_API_KEY = '1ab2c3d4e5f61ab2c3d4e5f6';
+			const INVALID_API_KEY = '1ab2c3d4e5f61ab2c3d4e5f6778173';
+			// eslint-disable-next-line @typescript-eslint/no-unused-vars
+			const done = jest.fn((error: Error | null, data: boolean | null) => {});
+
+			return { CORRECT_API_KEY, INVALID_API_KEY, done };
+		};
+		describe('when a valid api key is provided', () => {
+			it('should do nothing', () => {
+				const { CORRECT_API_KEY, done } = setup();
+				strategy.validate(CORRECT_API_KEY, done);
+				expect(done).toBeCalledWith(null, true);
+			});
+		});
+
+		describe('when a invalid api key is provided', () => {
+			it('should throw error', () => {
+				const { INVALID_API_KEY, done } = setup();
+				strategy.validate(INVALID_API_KEY, done);
+				expect(done).toBeCalledWith(new UnauthorizedException(), null);
+			});
+		});
+	});
+
+	describe('constructor', () => {
+		it('should create strategy', () => {
+			const ApiKeyStrategy = new XApiKeyStrategy(configService);
+			expect(ApiKeyStrategy).toBeDefined();
+			expect(ApiKeyStrategy).toBeInstanceOf(XApiKeyStrategy);
+		});
+	});
+});

apps/server/src/modules/authentication/strategy/x-api-key.strategy.ts

@@ -0,0 +1,22 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ConfigService } from '@nestjs/config';
+import Strategy from 'passport-headerapikey';
+import { XApiKeyConfig } from '../config/x-api-key.config';
+
+@Injectable()
+export class XApiKeyStrategy extends PassportStrategy(Strategy, 'api-key') {
+	private readonly allowedApiKeys: string[];
+
+	constructor(private readonly configService: ConfigService<XApiKeyConfig, true>) {
+		super({ header: 'X-API-KEY' }, false);
+		this.allowedApiKeys = this.configService.get<string[]>('ADMIN_API__ALLOWED_API_KEYS');
+	}
+
+	public validate = (apiKey: string, done: (error: Error | null, data: boolean | null) => void) => {
+		if (this.allowedApiKeys.includes(apiKey)) {
+			done(null, true);
+		}
+		done(new UnauthorizedException(), null);
+	};
+}

apps/server/src/modules/deletion/controller/api-test/deletion-executions.api.spec.ts

@@ -0,0 +1,45 @@
+import { ExecutionContext, INestApplication } from '@nestjs/common';
+import { Test, TestingModule } from '@nestjs/testing';
+import { Request } from 'express';
+import { AuthGuard } from '@nestjs/passport';
+import { TestXApiKeyClient } from '@shared/testing';
+import { AdminApiServerTestModule } from '../../../server/admin-api.server.module';
+
+const baseRouteName = '/deletionExecutions';
+
+describe(`deletionExecution (api)`, () => {
+	let app: INestApplication;
+	let testXApiKeyClient: TestXApiKeyClient;
+	const API_KEY = '1ab2c3d4e5f61ab2c3d4e5f6';
+
+	beforeAll(async () => {
+		const module: TestingModule = await Test.createTestingModule({
+			imports: [AdminApiServerTestModule],
+		})
+			.overrideGuard(AuthGuard('api-key'))
+			.useValue({
+				canActivate(context: ExecutionContext) {
+					const req: Request = context.switchToHttp().getRequest();
+					req.headers['X-API-KEY'] = API_KEY;
+					return true;
+				},
+			})
+			.compile();
+
+		app = module.createNestApplication();
+		await app.init();
+		testXApiKeyClient = new TestXApiKeyClient(app, baseRouteName);
+	});
+
+	afterAll(async () => {
+		await app.close();
+	});
+
+	describe('when execute deletionRequests with default limit', () => {
+		it('should return status 204', async () => {
+			const response = await testXApiKeyClient.post('');
+
+			expect(response.status).toEqual(204);
+		});
+	});
+});