SMURFI

.dockerignore

@@ -8,20 +8,21 @@
 .gitignore
 .ipynb_checkpoints
 node_modules
+mobile/**
 web/build
-web/coverage-cypress
-web/coverage
-web/.nyc_output
-web/node_modules
-web/cypress
-web/.pnp.*
-web/.yarn/*
+web/**/node_modules
+web/apps/wps-web/coverage
+web/apps/wps-web/coverage-playwright
+web/apps/wps-web/.nyc_output
+web/apps/wps-web/.nyc_temp_playwright
+web/apps/wps-web/playwright
+web/apps/wps-web/.pnp.*
+web/apps/wps-web/.yarn/*
 !web/.yarn/patches
 !web/.yarn/plugins
 !web/.yarn/releases
 !web/.yarn/sdks
 !web/.yarn/versions
-r
 .dockerignore
 grib
 **/Dockerfile*

.env.example

@@ -50,14 +50,22 @@ CLASSPATH=/somewhere/wps/api/libs/REDapp_Lib.jar:/somewhere/wps/api/libs/WTime.j
 SFMS_SECRET=somesecret
 NATS_STREAM_PREFIX=local
 NATS_SERVER=localhost
-OBJECT_STORE_SERVER=object_store_server
-OBJECT_STORE_USER_ID=object_store_user
-OBJECT_STORE_SECRET=object_store_secret
-OBJECT_STORE_BUCKET=object_store_bucket
 DEM_NAME=dem_mosaic_250_max.tif
 TPI_DEM_NAME=bc_dem_50m_tpi.tif
 CLASSIFIED_TPI_DEM_NAME=bc_dem_50m_tpi_win100_classified.tif
 CLASSIFIED_TPI_DEM_FUEL_MASKED_NAME=bc_dem_50m_tpi_win100_classified_fuel_masked.tif
 SENTRY_DSN=some_dsn
 DOCKER_HOST=unix:///Users/<you>/.docker/run/docker.sock
-DATA_RETENTION_THRESHOLD=358
+DATA_RETENTION_THRESHOLD=358
+EARTHDATA_USERNAME=test
+EARTHDATA_PASSWORD=test
+#### Object Store
+OBJECT_STORE_SERVER=object_store_server
+OBJECT_STORE_USER_ID=object_store_user
+OBJECT_STORE_SECRET=object_store_secret
+OBJECT_STORE_BUCKET=object_store_bucket
+GRIB_RETENTION_THRESHOLD=2
+WX_OBJECT_STORE_SERVER=wx_object_store_server
+WX_OBJECT_STORE_USER_ID=wx_object_store_server
+WX_OBJECT_STORE_SECRET=wx_object_store_server
+WX_OBJECT_STORE_BUCKET=wx_object_store_server

.github/actions/aps-publish/action.yml

@@ -0,0 +1,55 @@
+name: APS Publish
+description: Render, publish, and upload the APS gateway configuration
+
+inputs:
+  gateway-id:
+    description: APS gateway id
+    required: true
+  client-id:
+    description: APS service account client id
+    required: true
+  client-secret:
+    description: APS service account client secret
+    required: true
+  project-namespace:
+    description: OpenShift namespace that contains the upstream ASA Go service
+    required: true
+  host:
+    description: Public APS hostname for the rendered route
+    required: true
+  suffix:
+    description: Config suffix used for service naming, tag scope, and gwa qualifier
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Render ASA Go APS gateway config
+      shell: bash
+      env:
+        APS_NAMESPACE: ${{ inputs.gateway-id }}
+        PROJECT_NAMESPACE: ${{ inputs.project-namespace }}
+        ASA_GO_HOST: ${{ inputs.host }}
+        SUFFIX: ${{ inputs.suffix }}
+      run: |
+        set -euo pipefail
+        CONFIG_PATH=".github/tmp/asa-go-gw-config-${SUFFIX}.yaml"
+        mkdir -p "$(dirname "${CONFIG_PATH}")"
+        bash "${{ github.workspace }}/openshift/scripts/render_asa_go_gateway_config.sh" \
+          "${SUFFIX}" \
+          "${CONFIG_PATH}"
+
+    - name: Publish ASA Go APS gateway config
+      uses: ./.github/actions/gwa-publish
+      with:
+        gateway-id: ${{ inputs.gateway-id }}
+        client-id: ${{ inputs.client-id }}
+        client-secret: ${{ inputs.client-secret }}
+        config-path: .github/tmp/asa-go-gw-config-${{ inputs.suffix }}.yaml
+        qualifier: ${{ inputs.suffix }}
+
+    - name: Upload ASA Go APS gateway config
+      uses: actions/upload-artifact@v7
+      with:
+        name: asa-go-aps-gateway-config-${{ inputs.suffix }}
+        path: .github/tmp/asa-go-gw-config-${{ inputs.suffix }}.yaml

.github/actions/asa-go-setup/action.yml

@@ -0,0 +1,39 @@
+name: ASA Go Setup
+description: Install Node.js, build the keycloak plugin, and install asa-go dependencies
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js environment
+      uses: actions/setup-node@v6
+      with:
+        node-version: "20"
+
+    - uses: actions/cache@v5
+      id: asa-go-keycloak-cache
+      with:
+        path: mobile/keycloak/node_modules
+        key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }}
+
+    - name: Install keycloak plugin
+      if: steps.asa-go-keycloak-cache.outputs.cache-hit != 'true'
+      working-directory: ./mobile/keycloak
+      shell: bash
+      run: yarn install
+
+    - name: Build keycloak plugin
+      working-directory: ./mobile/keycloak
+      shell: bash
+      run: yarn build
+
+    - uses: actions/cache@v5
+      id: asa-go-cache
+      with:
+        path: mobile/asa-go/node_modules
+        key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }}
+
+    - name: Install dependencies
+      if: steps.asa-go-cache.outputs.cache-hit != 'true'
+      working-directory: ./mobile/asa-go
+      shell: bash
+      run: yarn install

.github/actions/asa-go-validate-mui-license/action.yml

@@ -0,0 +1,24 @@
+name: Validate ASA Go MUI License
+description: Verify the MUI X Pro license key is present and valid
+
+inputs:
+  mui-license-key:
+    description: MUI X Pro license key
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Validate MUI License
+      working-directory: ./mobile/asa-go
+      shell: bash
+      env:
+        VITE_MUI_LICENSE_KEY: ${{ inputs.mui-license-key }}
+      run: |
+        node -e "
+          const { verifyLicense, generateReleaseInfo } = require('./node_modules/@mui/x-license-pro/node/verifyLicense/verifyLicense.js');
+          const result = verifyLicense({ releaseInfo: generateReleaseInfo(), licenseKey: process.env.VITE_MUI_LICENSE_KEY, acceptedScopes: ['pro', 'premium'] });
+          if (result.meta?.expiryTimestamp) console.log('MUI license expiry:', new Date(result.meta.expiryTimestamp).toISOString().split('T')[0]);
+          console.log('MUI license status:', result.status);
+          if (result.status !== 'Valid') { console.error('MUI license check failed'); process.exit(1); }
+        "

.github/actions/gwa-publish/action.yml

@@ -0,0 +1,52 @@
+name: GWA Publish
+description: Install gwa, authenticate, and publish APS gateway configuration
+
+inputs:
+  gateway-id:
+    description: APS gateway id
+    required: true
+  client-id:
+    description: APS service account client id
+    required: true
+  client-secret:
+    description: APS service account client secret
+    required: true
+  config-path:
+    description: Path to the gateway config file to publish
+    required: true
+  qualifier:
+    description:
+      Qualifier used with publish-gateway. Qualifiers allow one gateway to hold
+      multiple independent config sets without pruning other service configs.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install GWA CLI
+      shell: bash
+      run: |
+        set -euo pipefail
+        GWA_BIN_DIR="${RUNNER_TEMP}/gwa-bin"
+        mkdir -p "${GWA_BIN_DIR}"
+        curl -L "https://github.com/bcgov/gwa-cli/releases/download/v3.0.7/gwa_Linux_x86_64.tgz" \
+          | tar -zxf - -C "${GWA_BIN_DIR}"
+        echo "${GWA_BIN_DIR}" >> "${GITHUB_PATH}"
+
+    - name: Login and publish gateway config
+      shell: bash
+      env:
+        GATEWAY_ID: ${{ inputs.gateway-id }}
+        GWA_CLIENT_ID: ${{ inputs.client-id }}
+        GWA_CLIENT_SECRET: ${{ inputs.client-secret }}
+        CONFIG_PATH: ${{ inputs.config-path }}
+        QUALIFIER: ${{ inputs.qualifier }}
+      run: |
+        set -euo pipefail
+
+        gwa config set --gateway "${GATEWAY_ID}"
+        gwa login \
+          --client-id="${GWA_CLIENT_ID}" \
+          --client-secret="${GWA_CLIENT_SECRET}"
+
+        gwa publish-gateway "${CONFIG_PATH}" --qualifier "${QUALIFIER}"

.github/actions/oc-login/action.yml

@@ -0,0 +1,34 @@
+name: OC Login
+description: Request a short-lived token via the TokenRequest API and log in
+
+inputs:
+  oc-server:
+    description: OpenShift server URL
+    required: true
+  oc-token:
+    description: Long-lived service account token
+    required: true
+  oc-namespace:
+    description: OpenShift namespace for the service account
+    required: true
+  oc-service-account:
+    description: Service account name
+    required: false
+    default: ghactions
+
+runs:
+  using: composite
+  steps:
+    - name: OC Login
+      shell: bash
+      env:
+        OC_SERVER: ${{ inputs.oc-server }}
+        OC_TOKEN: ${{ inputs.oc-token }}
+      run: |
+        OC_TEMP_TOKEN=$(curl -sk -X POST \
+          "${OC_SERVER}/api/v1/namespaces/${{ inputs.oc-namespace }}/serviceaccounts/${{ inputs.oc-service-account }}/token" \
+          -H "Authorization: Bearer ${OC_TOKEN}" \
+          -H "Content-Type: application/json" \
+          -d '{"spec": {"expirationSeconds": 600}}' \
+          | jq -r '.status.token')
+        oc login --token="${OC_TEMP_TOKEN}" --server="${OC_SERVER}"

.github/actions/oc-setup/action.yml

@@ -0,0 +1,19 @@
+name: OC Setup
+description: Common setup steps for OpenShift deployment jobs
+
+runs:
+  using: composite
+  steps:
+    - name: Log public IP address
+      shell: bash
+      run: |
+        echo -e "Public IPv4:"
+        curl -s https://api.ipify.org
+        echo -e "\nPublic IPv4(v6):"
+        curl -s https://api64.ipify.org
+
+    - name: Install OpenShift CLI tools
+      uses: redhat-actions/openshift-tools-installer@v1
+      with:
+        oc: "4.14"
+        skip_cache: true

.github/actions/python-setup/action.yml

@@ -0,0 +1,39 @@
+name: Python Setup
+description: Install uv, cache venv, and install Python dependencies
+
+inputs:
+  install-jdk:
+    description: Whether to install JDK
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Install uv
+      uses: astral-sh/setup-uv@v8.1.0
+      with:
+        version: "0.11.11"
+
+    - name: Cache .venv
+      id: cache-venv
+      uses: actions/cache@v5
+      with:
+        path: ~/work/wps/wps/backend/.venv
+        key: ${{ runner.os }}-venv-uv-0.9.11-${{ hashFiles('**/uv.lock') }}
+
+    - name: Install JDK
+      if: inputs.install-jdk == 'true' && steps.cache-venv.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        apt-get update --fix-missing
+        apt-get -y install default-jdk
+
+    - name: Install python dependencies using uv
+      if: steps.cache-venv.outputs.cache-hit != 'true'
+      working-directory: ./backend
+      shell: bash
+      run: |
+        uv sync --all-extras
+        uv pip install setuptools
+        uv pip install --no-build-isolation gdal==$(gdal-config --version)