From 6b7be562b5acba08d3896478f9c344f668f9d125 Mon Sep 17 00:00:00 2001 From: Ian Hodges Date: Thu, 17 Sep 2026 12:52:59 +0100 Subject: [PATCH 1/5] CCM-22725: amend youngest key logic so it grabs the date correctly --- .../get-private-key.test.ts | 20 +++++++++---------- .../key-generation-utils/get-private-key.ts | 11 ++++++---- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/src/utils/src/__tests__/key-generation-utils/get-private-key.test.ts b/src/utils/src/__tests__/key-generation-utils/get-private-key.test.ts index c89dd9d..23bb7fb 100644 --- a/src/utils/src/__tests__/key-generation-utils/get-private-key.test.ts +++ b/src/utils/src/__tests__/key-generation-utils/get-private-key.test.ts @@ -72,7 +72,7 @@ describe('getPrivateKey', () => { it('gets private key from ssm', async () => { (parameterStore.getAllParameters as jest.Mock).mockReturnValue([ { - Name: `privatekey_20201105_${testKeyId1}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_20201105_${testKeyId1}.pem`, Value: testPrivateKey1, }, ]); @@ -93,15 +93,15 @@ describe('getPrivateKey', () => { (parameterStore.getAllParameters as jest.Mock).mockReturnValue([ { - Name: `privatekey_${todaysDate}_${testKeyId1}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_${todaysDate}_${testKeyId1}.pem`, Value: testPrivateKey1, }, { - Name: `privatekey_20201203_${testKeyId2}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_20201203_${testKeyId2}.pem`, Value: testPrivateKey2, }, { - Name: `privatekey_20211103_${testKeyId3}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_20211103_${testKeyId3}.pem`, Value: testPrivateKey3, }, ]); @@ -124,15 +124,15 @@ describe('getPrivateKey', () => { (parameterStore.getAllParameters as jest.Mock).mockReturnValue([ { - Name: `privatekey_${yesterdaysDate}_${testKeyId1}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_${yesterdaysDate}_${testKeyId1}.pem`, Value: testPrivateKey1, }, { - Name: `privatekey_20201103_${testKeyId2}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_20201103_${testKeyId2}.pem`, Value: testPrivateKey2, }, { - Name: `privatekey_20211103_${testKeyId3}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_20211103_${testKeyId3}.pem`, Value: testPrivateKey3, }, ]); @@ -150,15 +150,15 @@ describe('getPrivateKey', () => { it('selects youngest key when more than one key exists and the youngest key wasnt generated today or yesterday', async () => { (parameterStore.getAllParameters as jest.Mock).mockReturnValue([ { - Name: `privatekey_20221103_${testKeyId1}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_20221103_${testKeyId1}.pem`, Value: testPrivateKey1, }, { - Name: `privatekey_20201103_${testKeyId2}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_20201103_${testKeyId2}.pem`, Value: testPrivateKey2, }, { - Name: `privatekey_20211103_${testKeyId3}.pem`, + Name: `/test_component/main/apim/private_key/privatekey_20211103_${testKeyId3}.pem`, Value: testPrivateKey3, }, ]); diff --git a/src/utils/src/key-generation-utils/get-private-key.ts b/src/utils/src/key-generation-utils/get-private-key.ts index a15d14f..72008b4 100644 --- a/src/utils/src/key-generation-utils/get-private-key.ts +++ b/src/utils/src/key-generation-utils/get-private-key.ts @@ -9,6 +9,9 @@ import { const PRIVATE_KEY_REGEX = /privatekey_(\d{8})_(.+)\.pem/; +const getPrivateKeyDate = (name: string) => + name.match(PRIVATE_KEY_REGEX)?.[1] ?? ''; + const validateParamName = (name: string) => { // eslint-disable-next-line sonarjs/prefer-regexp-exec const nameComponents = name?.match(PRIVATE_KEY_REGEX); @@ -37,19 +40,19 @@ const getValidPrivateKey = async (ssmPath: string) => { // generated private key may not be valid if APIM's cache has not // been refreshed const [youngestKey, secondYoungestKey] = keyList.toSorted((a, b) => { - const aCreatedDate = Number(a.Name.split('_')[1]); - const bCreatedDate = Number(b.Name.split('_')[1]); + const aCreatedDate = Number(getPrivateKeyDate(a.Name)); + const bCreatedDate = Number(getPrivateKeyDate(b.Name)); return bCreatedDate - aCreatedDate; }); if (!secondYoungestKey) { logger.info({ - description: `Selecting youngest private key: ${youngestKey.Name}`, + description: `Only one private key found: ${youngestKey.Name}`, }); return youngestKey; } - const youngestKeyCreatedDate = youngestKey.Name.split('_')[1]; + const youngestKeyCreatedDate = getPrivateKeyDate(youngestKey.Name); const todaysDateUnformatted = new Date(); const todaysDate = format(todaysDateUnformatted, 'yyyyMMdd'); From c18a8572be59236228e1c6f462fc0236bd1e48d3 Mon Sep 17 00:00:00 2001 From: Ian Hodges Date: Thu, 17 Sep 2026 13:11:50 +0100 Subject: [PATCH 2/5] CCM-22725: fix vulnerabilites --- pnpm-lock.yaml | 25 +++---------------------- pnpm-workspace.yaml | 2 ++ 2 files changed, 5 insertions(+), 22 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 5f6b88a..222d0a1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -122,6 +122,8 @@ overrides: esbuild@>=0.27.3 <0.28.1: '>=0.28.1' minimatch@>=10.0.0 <10.2.3: '>=10.2.3' yaml@>=2.0.0 <2.8.3: '>=2.8.3' + js-yaml@>=3.0.0 <3.15.2: '>=3.15.2' + js-yaml@>=4.0.0 <4.3.1: '>=4.3.1' importers: @@ -1717,9 +1719,6 @@ packages: arg@4.1.3: resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==} - argparse@1.0.10: - resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==} - argparse@2.0.1: resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==} @@ -3134,10 +3133,6 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.1: - resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} - hasBin: true - js-yaml@4.3.1: resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} hasBin: true @@ -3761,9 +3756,6 @@ packages: resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==} engines: {node: '>=0.10.0'} - sprintf-js@1.0.3: - resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} - stable-hash-x@0.2.0: resolution: {integrity: sha512-o3yWv49B/o4QZk5ZcsALc6t0+eCelPc44zZsLtCQnZPDwFpDYSWcDnrv2TtMmMbQ7uKo3J0HTURCqckw23czNQ==} engines: {node: '>=12.0.0'} @@ -4879,7 +4871,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 3.15.1 + js-yaml: 4.3.1 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -5757,10 +5749,6 @@ snapshots: arg@4.1.3: {} - argparse@1.0.10: - dependencies: - sprintf-js: 1.0.3 - argparse@2.0.1: {} aria-query@5.3.2: {} @@ -7744,11 +7732,6 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.1: - dependencies: - argparse: 1.0.10 - esprima: 4.0.1 - js-yaml@4.3.1: dependencies: argparse: 2.0.1 @@ -8388,8 +8371,6 @@ snapshots: source-map@0.6.1: {} - sprintf-js@1.0.3: {} - stable-hash-x@0.2.0: {} stack-trace@0.0.10: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ffd11c4..c07009f 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -70,6 +70,8 @@ overrides: esbuild@>=0.27.3 <0.28.1: '>=0.28.1' minimatch@>=10.0.0 <10.2.3: '>=10.2.3' yaml@>=2.0.0 <2.8.3: '>=2.8.3' + js-yaml@>=3.0.0 <3.15.2: '>=3.15.2' + js-yaml@>=4.0.0 <4.3.1: '>=4.3.1' resolutionMode: time-based trustPolicy: no-downgrade trustPolicyExclude: From 2a669f637089f6d248361adfcec8b334bc1c9d8e Mon Sep 17 00:00:00 2001 From: Ian Hodges Date: Thu, 17 Sep 2026 13:14:36 +0100 Subject: [PATCH 3/5] CCM-22725: fix vulnerabilites --- pnpm-lock.yaml | 12 ++++++------ pnpm-workspace.yaml | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 222d0a1..34b46e0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -123,7 +123,7 @@ overrides: minimatch@>=10.0.0 <10.2.3: '>=10.2.3' yaml@>=2.0.0 <2.8.3: '>=2.8.3' js-yaml@>=3.0.0 <3.15.2: '>=3.15.2' - js-yaml@>=4.0.0 <4.3.1: '>=4.3.1' + js-yaml@>=4.0.0 <4.3.2: '>=4.3.2' importers: @@ -3133,8 +3133,8 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@5.2.3: + resolution: {integrity: sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==} hasBin: true jsdom@20.0.3: @@ -4821,7 +4821,7 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 5.2.3 minimatch: 3.1.5 strip-json-comments: 3.1.1 transitivePeerDependencies: @@ -4871,7 +4871,7 @@ snapshots: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 4.3.1 + js-yaml: 5.2.3 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -7732,7 +7732,7 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@4.3.1: + js-yaml@5.2.3: dependencies: argparse: 2.0.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index c07009f..a020ced 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -71,7 +71,7 @@ overrides: minimatch@>=10.0.0 <10.2.3: '>=10.2.3' yaml@>=2.0.0 <2.8.3: '>=2.8.3' js-yaml@>=3.0.0 <3.15.2: '>=3.15.2' - js-yaml@>=4.0.0 <4.3.1: '>=4.3.1' + js-yaml@>=4.0.0 <4.3.2: '>=4.3.2' resolutionMode: time-based trustPolicy: no-downgrade trustPolicyExclude: From 32ed97073f2ba55ff03e6ea6e704c948659610c0 Mon Sep 17 00:00:00 2001 From: Ian Hodges Date: Thu, 17 Sep 2026 13:21:31 +0100 Subject: [PATCH 4/5] CCM-22725: linting changes --- src/utils/src/key-generation-utils/get-private-key.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/src/key-generation-utils/get-private-key.ts b/src/utils/src/key-generation-utils/get-private-key.ts index 72008b4..a76ed4f 100644 --- a/src/utils/src/key-generation-utils/get-private-key.ts +++ b/src/utils/src/key-generation-utils/get-private-key.ts @@ -10,7 +10,7 @@ import { const PRIVATE_KEY_REGEX = /privatekey_(\d{8})_(.+)\.pem/; const getPrivateKeyDate = (name: string) => - name.match(PRIVATE_KEY_REGEX)?.[1] ?? ''; + PRIVATE_KEY_REGEX.exec(name)?.[1] ?? ''; const validateParamName = (name: string) => { // eslint-disable-next-line sonarjs/prefer-regexp-exec From a683aea0349c5c1f5bab571b3fc4f5bb1ae294ba Mon Sep 17 00:00:00 2001 From: Ian Hodges Date: Fri, 18 Sep 2026 08:24:36 +0100 Subject: [PATCH 5/5] CCM-22725: small refactor for consistency --- src/utils/src/key-generation-utils/get-private-key.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/utils/src/key-generation-utils/get-private-key.ts b/src/utils/src/key-generation-utils/get-private-key.ts index a76ed4f..72aac6f 100644 --- a/src/utils/src/key-generation-utils/get-private-key.ts +++ b/src/utils/src/key-generation-utils/get-private-key.ts @@ -13,8 +13,7 @@ const getPrivateKeyDate = (name: string) => PRIVATE_KEY_REGEX.exec(name)?.[1] ?? ''; const validateParamName = (name: string) => { - // eslint-disable-next-line sonarjs/prefer-regexp-exec - const nameComponents = name?.match(PRIVATE_KEY_REGEX); + const nameComponents = PRIVATE_KEY_REGEX.exec(name); logger.info({ description: 'validating parameter name', parameter: name }); // return true if regex matches and component parses as a yyyyMMdd format return (