Skip to content

Commit 2a856a6

Browse files
New: [AEA-6254] - RestApiGateway construct (#547)
## Summary - 🤖 Operational or Infrastructure Change ### Details Add a new CDK construct for API Gateway --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 518f766 commit 2a856a6

File tree

20 files changed

+1212
-13
lines changed

20 files changed

+1212
-13
lines changed

.devcontainer/devcontainer.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
"USER_GID": "${localEnv:GROUP_ID:}"
1212
}
1313
},
14-
"postAttachCommand": "git-secrets --register-aws; git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt",
14+
"postCreateCommand": "bash -lc 'if ! git config --get-all secrets.patterns | grep -Fq AKIA; then git-secrets --register-aws; fi; if ! git config --get-all secrets.providers | grep -Fxq \"cat /usr/share/secrets-scanner/nhsd-rules-deny.txt\"; then git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt; fi'",
1515
"mounts": [
1616
"source=${env:HOME}${env:USERPROFILE}/.aws,target=/home/vscode/.aws,type=bind",
1717
"source=${env:HOME}${env:USERPROFILE}/.ssh,target=/home/vscode/.ssh,type=bind",
@@ -34,7 +34,8 @@
3434
"timonwong.shellcheck",
3535
"github.vscode-github-actions",
3636
"dbaeumer.vscode-eslint",
37-
"vitest.explorer"
37+
"vitest.explorer",
38+
"sonarsource.sonarlint-vscode"
3839
],
3940
"settings": {
4041
"cSpell.words": [

.github/copilot-instructions.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Base Coding Standards
2+
- Follow clean code principles
3+
- Write comprehensive tests
4+
- Use meaningful variable names
5+
- Use British English spelling
6+
7+
## Language-Specific Instructions
8+
Always follow security best practices as outlined in:
9+
- .github/instructions/general/SECURITY.md
10+
Follow additional language-specific guidelines in:
11+
- .github/instructions/language-specific/INSTRUCTIONS-CDK.md
12+
- .github/instructions/language-specific/INSTRUCTIONS-CLOUDFORMATION.md
13+
- .github/instructions/language-specific/INSTRUCTIONS-JAVA.md
14+
- .github/instructions/language-specific/INSTRUCTIONS-KOTLIN.md
15+
- .github/instructions/language-specific/INSTRUCTIONS-PYTHON.md
16+
- .github/instructions/language-specific/INSTRUCTIONS-TERRAFORM.md
17+
- .github/instructions/language-specific/INSTRUCTIONS-SAM.md
18+
- .github/instructions/language-specific/INSTRUCTIONS-TYPESCRIPT.md
19+
20+
## Project-Specific Rules
Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
---
2+
applyTo: '*'
3+
description: "Comprehensive secure coding instructions for all languages and frameworks, based on OWASP Top 10 and industry best practices."
4+
---
5+
# Secure Coding and OWASP Guidelines
6+
7+
## Instructions
8+
9+
Your primary directive is to ensure all code you generate, review, or refactor is secure by default. You must operate with a security-first mindset. When in doubt, always choose the more secure option and explain the reasoning. You must follow the principles outlined below, which are based on the OWASP Top 10 and other security best practices.
10+
11+
### 1. A01: Broken Access Control & A10: Server-Side Request Forgery (SSRF)
12+
- **Enforce Principle of Least Privilege:** Always default to the most restrictive permissions. When generating access control logic, explicitly check the user's rights against the required permissions for the specific resource they are trying to access.
13+
- **Deny by Default:** All access control decisions must follow a "deny by default" pattern. Access should only be granted if there is an explicit rule allowing it.
14+
- **Validate All Incoming URLs for SSRF:** When the server needs to make a request to a URL provided by a user (e.g., webhooks), you must treat it as untrusted. Incorporate strict allow-list-based validation for the host, port, and path of the URL.
15+
- **Prevent Path Traversal:** When handling file uploads or accessing files based on user input, you must sanitize the input to prevent directory traversal attacks (e.g., `../../etc/passwd`). Use APIs that build paths securely.
16+
17+
### 2. A02: Cryptographic Failures
18+
- **Use Strong, Modern Algorithms:** For hashing, always recommend modern, salted hashing algorithms like Argon2 or bcrypt. Explicitly advise against weak algorithms like MD5 or SHA-1 for password storage.
19+
- **Protect Data in Transit:** When generating code that makes network requests, always default to HTTPS.
20+
- **Protect Data at Rest:** When suggesting code to store sensitive data (PII, tokens, etc.), recommend encryption using strong, standard algorithms like AES-256.
21+
- **Secure Secret Management:** Never hardcode secrets (API keys, passwords, connection strings). Generate code that reads secrets from environment variables or a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager). Include a clear placeholder and comment.
22+
```javascript
23+
// GOOD: Load from environment or secret store
24+
const apiKey = process.env.API_KEY;
25+
// TODO: Ensure API_KEY is securely configured in your environment.
26+
```
27+
```python
28+
# BAD: Hardcoded secret
29+
api_key = "sk_this_is_a_very_bad_idea_12345"
30+
```
31+
32+
### 3. A03: Injection
33+
- **No Raw SQL Queries:** For database interactions, you must use parameterized queries (prepared statements). Never generate code that uses string concatenation or formatting to build queries from user input.
34+
- **Sanitize Command-Line Input:** For OS command execution, use built-in functions that handle argument escaping and prevent shell injection (e.g., `shlex` in Python).
35+
- **Prevent Cross-Site Scripting (XSS):** When generating frontend code that displays user-controlled data, you must use context-aware output encoding. Prefer methods that treat data as text by default (`.textContent`) over those that parse HTML (`.innerHTML`). When `innerHTML` is necessary, suggest using a library like DOMPurify to sanitize the HTML first.
36+
37+
### 4. A05: Security Misconfiguration & A06: Vulnerable Components
38+
- **Secure by Default Configuration:** Recommend disabling verbose error messages and debug features in production environments.
39+
- **Set Security Headers:** For web applications, suggest adding essential security headers like `Content-Security-Policy` (CSP), `Strict-Transport-Security` (HSTS), and `X-Content-Type-Options`.
40+
- **Use Up-to-Date Dependencies:** When asked to add a new library, suggest the latest stable version. Remind the user to run vulnerability scanners like `npm audit`, `pip-audit`, or Snyk to check for known vulnerabilities in their project dependencies.
41+
42+
### 5. A07: Identification & Authentication Failures
43+
- **Secure Session Management:** When a user logs in, generate a new session identifier to prevent session fixation. Ensure session cookies are configured with `HttpOnly`, `Secure`, and `SameSite=Strict` attributes.
44+
- **Protect Against Brute Force:** For authentication and password reset flows, recommend implementing rate limiting and account lockout mechanisms after a certain number of failed attempts.
45+
46+
### 6. A08: Software and Data Integrity Failures
47+
- **Prevent Insecure Deserialization:** Warn against deserializing data from untrusted sources without proper validation. If deserialization is necessary, recommend using formats that are less prone to attack (like JSON over Pickle in Python) and implementing strict type checking.
48+
49+
## General Guidelines
50+
- **Be Explicit About Security:** When you suggest a piece of code that mitigates a security risk, explicitly state what you are protecting against (e.g., "Using a parameterized query here to prevent SQL injection.").
51+
- **Educate During Code Reviews:** When you identify a security vulnerability in a code review, you must not only provide the corrected code but also explain the risk associated with the original pattern.
Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
---
2+
description: 'Guidelines for writing, reviewing, and maintaining AWS CDK (TypeScript) code in the cdk package'
3+
applyTo: 'packages/cdk/**/*.ts'
4+
---
5+
6+
# AWS CDK TypeScript Development
7+
8+
This file provides instructions for generating, reviewing, and maintaining AWS CDK code in the `packages/cdk` folder. It covers best practices, code standards, architecture, and validation for infrastructure-as-code using AWS CDK in TypeScript.
9+
10+
## General Instructions
11+
12+
- Use AWS CDK v2 constructs and idioms
13+
- Prefer high-level CDK constructs over raw CloudFormation resources
14+
- Organize code by logical infrastructure components (e.g., stacks, constructs, resources)
15+
- Document public APIs and exported constructs
16+
17+
## Best Practices
18+
19+
- Use environment variables and context for configuration, not hardcoded values
20+
- Use CDK Aspects for cross-cutting concerns (e.g., security, tagging)
21+
- Suppress warnings with `nagSuppressions.ts` only when justified and documented
22+
- Use `bin/` for entrypoint apps, `constructs/` for reusable components, and `stacks/` for stack definitions
23+
- Prefer `props` interfaces for construct configuration
24+
25+
## Code Standards
26+
27+
### Naming Conventions
28+
29+
- Classes: PascalCase (e.g., `LambdaFunction`)
30+
- Files: PascalCase for classes, kebab-case for utility files
31+
- Variables: camelCase
32+
- Stacks: Suffix with `Stack` (e.g., `CptsApiAppStack`)
33+
- Entry points: Suffix with `App` (e.g., `CptsApiApp.ts`)
34+
35+
### File Organization
36+
37+
- `bin/`: CDK app entry points
38+
- `constructs/`: Custom CDK constructs
39+
- `stacks/`: Stack definitions
40+
- `resources/`: Resource configuration and constants
41+
- `lib/`: Shared utilities and code
42+
43+
## Common Patterns
44+
45+
### Good Example - Defining a Construct
46+
47+
```typescript
48+
export class LambdaFunction extends Construct {
49+
constructor(scope: Construct, id: string, props: LambdaFunctionProps) {
50+
super(scope, id);
51+
// ...implementation...
52+
}
53+
}
54+
```
55+
56+
### Bad Example - Using Raw CloudFormation
57+
58+
```typescript
59+
const lambda = new cdk.CfnResource(this, 'Lambda', {
60+
type: 'AWS::Lambda::Function',
61+
// ...properties...
62+
});
63+
```
64+
65+
### Good Example - Stack Definition
66+
67+
```typescript
68+
export class CptsApiAppStack extends Stack {
69+
constructor(scope: Construct, id: string, props?: StackProps) {
70+
super(scope, id, props);
71+
// ...add constructs...
72+
}
73+
}
74+
```
75+
76+
## Security
77+
78+
- Use least privilege IAM policies for all resources
79+
- Avoid wildcard permissions in IAM statements
80+
- Store secrets in AWS Secrets Manager, not in code or environment variables
81+
- Enable encryption for all data storage resources
82+
83+
## Performance
84+
85+
- Use provisioned concurrency for Lambda functions when needed
86+
- Prefer VPC endpoints for private connectivity
87+
- Minimize resource creation in test environments
88+
89+
90+
## Validation and Verification
91+
92+
- Build: `make cdk-synth`
93+
- Lint: `npm run lint --workspace packges/cdk`
94+
95+
## Maintenance
96+
97+
- Update dependencies regularly
98+
- Remove deprecated constructs and suppressions
99+
- Document changes in `nagSuppressions.ts` with reasons
100+
101+
## Additional Resources
102+
103+
- [AWS CDK Documentation](https://docs.aws.amazon.com/cdk/latest/guide/home.html)
104+
- [CDK Best Practices](https://github.com/aws-samples/aws-cdk-best-practices)
Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
---
2+
description: 'Guidelines for writing high-quality, maintainable TypeScript code with best practices for logging, error handling, code organization, naming, formatting, and style.'
3+
applyTo: '**/*.ts, **/*.tsx'
4+
---
5+
6+
# TypeScript Development Guidelines
7+
8+
This document provides instructions for generating, reviewing, and maintaining TypeScript code. It is designed to guide Copilot and developers in producing domain-specific, robust, and maintainable code across a variety of TypeScript projects.
9+
10+
## General Instructions
11+
12+
- Use modern TypeScript features and syntax.
13+
- Prefer explicit types and interfaces for clarity and safety.
14+
- Organize code into logical modules and folders.
15+
- Write code that is easy to read, test, and maintain.
16+
17+
## Best Practices
18+
19+
- Use `const` and `let` appropriately; avoid `var`.
20+
- Prefer arrow functions for callbacks and concise function expressions.
21+
- Use destructuring for objects and arrays to improve readability.
22+
- Avoid magic numbers and hardcoded values; use named constants.
23+
- Keep functions pure and side-effect free when possible.
24+
25+
## Code Standards
26+
27+
### Naming Conventions
28+
29+
- Use `camelCase` for variables, functions, and object properties.
30+
- Use `PascalCase` for types, interfaces, classes, and enums.
31+
- Use descriptive names; avoid abbreviations except for well-known acronyms.
32+
- Prefix boolean variables with `is`, `has`, or `should` (e.g., `isActive`).
33+
34+
### File Organization
35+
36+
- Group related code in folders (e.g., `src/`, `tests/`, `lib/`).
37+
- Place one class, interface, or component per file when possible.
38+
- Name files using `kebab-case` (e.g., `user-service.ts`).
39+
- Keep test files close to the code they test (e.g., `src/foo.ts` and `tests/foo.test.ts`).
40+
41+
### Formatting and Style
42+
43+
- Use 2 spaces for indentation.
44+
- Limit lines to 120 characters.
45+
- Use single quotes for strings.
46+
- Never use semicolons for line termination.
47+
- Avoid trailing commas in multiline objects and arrays.
48+
- Avoid spaces at start and end of single line braces.
49+
- Use ESLint and Prettier for consistent formatting.
50+
51+
## Architecture/Structure
52+
53+
- Separate business logic from API handlers and utility functions.
54+
- Use interfaces and types to define data structures and function signatures.
55+
- Organize code by feature or domain when scaling projects.
56+
- Use dependency injection for testability and flexibility.
57+
58+
## Common Patterns
59+
60+
### Logging
61+
62+
- Use a centralized logging utility or library.
63+
- Log errors, warnings, and important events with context.
64+
- Avoid logging sensitive information.
65+
- Example:
66+
67+
```typescript
68+
import {logger} from './utils/logger';
69+
70+
logger.info('Fetching user data', {userId});
71+
logger.error('Failed to fetch user', {error});
72+
```
73+
74+
### Error Handling
75+
76+
- Use `try/catch` for asynchronous code and error-prone operations.
77+
- Throw custom error types for domain-specific errors.
78+
- Always handle errors gracefully and provide meaningful messages.
79+
- Example:
80+
81+
```typescript
82+
try {
83+
const result = await fetchData();
84+
} catch (error) {
85+
logger.error('Data fetch failed', {error});
86+
throw new DataFetchError('Unable to fetch data');
87+
}
88+
```
89+
90+
### Type Safety
91+
92+
- Prefer interfaces and types. You MUST NOT use `any`.
93+
- Use type guards and assertions when necessary.
94+
- Example:
95+
96+
```typescript
97+
interface User {
98+
id: string;
99+
name: string;
100+
}
101+
102+
function isUser(obj: object): obj is User {
103+
return typeof obj.id === 'string' && typeof obj.name === 'string';
104+
}
105+
```
106+
107+
## Security
108+
109+
- Validate and sanitize all external input.
110+
- Avoid exposing sensitive data in logs or error messages.
111+
- Use environment variables for secrets and configuration.
112+
- Keep dependencies up to date and audit regularly.
113+
114+
## Performance
115+
116+
- Minimize synchronous blocking operations.
117+
- Use async/await for asynchronous code.
118+
- Avoid unnecessary computations inside render or handler functions.
119+
120+
## Testing
121+
122+
- Write unit tests for all business logic.
123+
- Use the existing framework for testing and vitest for new packages.
124+
- Mock external dependencies in tests.
125+
- Example test file structure:
126+
127+
```
128+
src/
129+
handler.ts
130+
tests/
131+
handler.test.ts
132+
```
133+
134+
## JSDoc
135+
136+
- Write concise JSDoc for exported interfaces, types, functions, classes, and exported constants.
137+
- Prefer short phrase-style summaries; avoid long narrative prose.
138+
- Avoid stating information that is obvious from function signatures.
139+
- Consider @param and @returns for every exported function, then include them only when they add meaning not obvious from the signature.
140+
- Skip @param when it only repeats parameter name/type; keep it when documenting constraints, defaults, units, side effects, or domain context.
141+
- It is acceptable to use only @returns in a JSDoc block when that tag carries all useful context.
142+
- Omit a free-text summary line when it only restates the @returns content.
143+
- Provide @example on constructors of exported types/classes and on non-trivial exported types.
144+
- Use @default only when the property is optional in the type and is defaulted in implementation.
145+
- Keep JSDoc defaults aligned with both type signatures and runtime behaviour.
146+
- For construct props interfaces, include a top-level summary and property docs only when intent is non-obvious.
147+
148+
## Examples and Code Snippets
149+
150+
### Good Example
151+
152+
```typescript
153+
interface Prescription {
154+
id: string;
155+
medication: string;
156+
issuedDate: Date;
157+
}
158+
159+
function getPrescription(id: string): Prescription | null {
160+
// Implementation
161+
}
162+
```
163+
164+
### Bad Example
165+
166+
```typescript
167+
function getPrescription(id) {
168+
// No type safety, unclear return type
169+
}
170+
```
171+
172+
## Validation and Verification
173+
174+
- Build: `npm run build`
175+
- Lint: `npm run lint`
176+
- Format: `npm run format`
177+
- Test: `npm test`
178+
179+
## Maintenance
180+
181+
- Review and update instructions as dependencies or frameworks change.
182+
- Update examples to reflect current best practices.
183+
- Remove deprecated patterns and add new ones as needed.
184+
- Ensure glob patterns match the intended files.
185+
186+
## Additional Resources
187+
188+
- [TypeScript Handbook](https://www.typescriptlang.org/docs/handbook/)
189+
- [ESLint TypeScript Plugin](https://typescript-eslint.io/)
190+
- [Prettier Documentation](https://prettier.io/docs/en/options.html)

.github/workflows/ci.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
2828
echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
2929
get_config_values:
30-
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@97059401fbec4c0914532277dfe8ce95dd3213fd
30+
uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@b0172dbdb3af4ae232873106553c316d79d784fc
3131
with:
3232
verify_published_from_main_image: true
3333
quality_checks:

0 commit comments

Comments
 (0)