Feature/delta mig

.gitattributes

@@ -0,0 +1,3 @@
+# Windows checkouts must not use CRLF on shell scripts — breaks Linux shebang/exec
+# (symptom: exec /usr/local/bin/docker-entrypoint.sh: no such file or directory)
+*.sh text eol=lf

.github/workflows/test.yml

@@ -0,0 +1,68 @@
+name: Unit Tests & Coverage
+
+on:
+  push:
+    branches: [main, pre-stage, dev]
+  pull_request:
+
+jobs:
+  test-api:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: api
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: api/package-lock.json
+      - run: npm ci
+      - run: npm install @rollup/rollup-linux-x64-gnu --no-save
+      - run: npm run test:coverage
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: api-coverage-report
+          path: api/coverage/
+
+  test-ui:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ui
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: ui/package-lock.json
+      - run: npm ci --legacy-peer-deps
+      - run: npm run test:coverage
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: ui-coverage-report
+          path: ui/coverage/
+
+  test-upload-api:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: upload-api
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: upload-api/package-lock.json
+      - run: npm install --legacy-peer-deps
+      - run: npm run test:coverage
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: upload-api-coverage-report
+          path: upload-api/coverage/

.gitignore

@@ -16,6 +16,9 @@
 # Mono auto generated files
 mono_crash.*
 
+# App JSON file
+app.json
+
 # Build results
 [Dd]ebug/
 [Dd]ebugPublic/
@@ -360,10 +363,12 @@ upload-api/extracted_files*
 *copy*
 .qodo
 .vscode
-app.json
 # Snyk Security Extension - AI Rules (auto-generated)
 .cursor/rules/snyk_rules.mdc
 *extracted_files*
 *MigrationData*
 *.zip
 app.json
+
+# Test coverage (global)
+coverage/

.talismanrc

@@ -158,4 +158,35 @@ fileignoreconfig:
     checksum: f3bd8c6e981ed0acf26432859b2b7e388c0d90018513005cfc674726f14fe245
   - filename: ui/src/components/SchemaModal/index.tsx
     checksum: 607a465c9cd4a504b9a81750a3f9faa0f4e11c09414354d69ec7308c11f0046a
+
+fileignoreconfig:
+- filename: api/sso.utils.js
+  checksum: 5d589c128c4b38f8aacd70e5d02ddd7fa8e93ff7897ca69a1258378139d1d616
+version: "1.0"
+
+fileignoreconfig:
+- filename: api/package-lock.json
+  checksum: 4d2fd1905b5933e1d2c4d178e1536422d4aac84caa9640149eab0432a75b712d
+- filename: api/src/services/migration.service.ts
+  checksum: 1fdf5423840e170709c7c677c3a6a7c6ae61f373948c2ef295aa645a859c1af5
+- filename: api/src/services/contentMapper.service.ts
+  checksum: 03d5dcc31b38fd435f6a4389d6891c7fc1ba27b32dc2b382b91173d84f4565f7
+- filename: api/src/services/globalField.service.ts
+  checksum: b808815c7372f68fe9a5904d23be50cb0ec066592328ec1721dc3c395cbe3a2c
+- filename: api/src/services/taxonomy.service.ts
+  checksum: 840ab11838ebf08df44ada0a3674dad8cc124bc8bcbc5dfd1d9c585a34e4aeda
+- filename: api/src/services/org.service.ts
+  checksum: 0a50297164d7845d889fc78097164c4794a3f9cd7314c06365c8426a2a6ee52a
+- filename: ui/src/pages/Login/index.tsx
+  checksum: 7f7c008586db60f1cc8df625b88bfdc5c3bb861c21e40a55fc763f0ac4a6a8d2
+version: "1.0"
+
+fileignoreconfig:
+- filename: api/src/services/contentMapper.service.ts
+  checksum: 924b124214a93a7bec4c471304f5b270d5e735d506644180273b7118f3d37dd2
+version: "1.0"
+
+fileignoreconfig:
+- filename: ui/src/pages/Login/index.tsx
+  checksum: 213c6441dc87d82ce6b97679d457ae56c6e40ef13a89bddd4f21afcf566b5576
 version: "1.0"

README.md

@@ -139,7 +139,7 @@ The following configuration is used in this project:
 - `awsSecretAccessKey`: The AWS secret access key.
 - `awsSessionToken`: The AWS session token.
 - `bucketName`: The name of the AWS S3 bucket. Default is `migartion-test`.
-- `buketKey`: The key for the AWS S3 bucket. Default is `project/package 45.zip`.
+- `bucketKey`: The key for the AWS S3 bucket. Default is `project/package 45.zip`.
 
 #### Local Path
 

api/.gitignore

@@ -367,4 +367,5 @@ database/
 /migration-data
 **/copy*
 **copy.ts
-manifest.json
+manifest.json
+coverage/

api/encrypt-manifest.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+
+/**
+ * One-time script to encrypt sensitive fields in manifest.json.
+ *
+ * Usage:
+ *   MANIFEST_ENCRYPT_KEY=<your-secret-key> node encrypt-manifest.js
+ *
+ * This will overwrite manifest.json with encrypted uid, client_id, and client_secret.
+ * Run once, then commit the encrypted manifest.json.
+ */
+
+const crypto = require("crypto");
+const fs = require("fs");
+const path = require("path");
+
+const ALGORITHM = "aes-256-gcm";
+const ENC_PREFIX = "enc:";
+const ENCRYPT_KEY = process.env.MANIFEST_ENCRYPT_KEY;
+const ENCRYPT_SALT = process.env.MANIFEST_ENCRYPT_SALT;
+
+if (!ENCRYPT_KEY || !ENCRYPT_SALT) {
+  console.error("Error: MANIFEST_ENCRYPT_KEY and MANIFEST_ENCRYPT_SALT environment variables are required.");
+  console.error("Usage: MANIFEST_ENCRYPT_KEY=<key> MANIFEST_ENCRYPT_SALT=<salt> node encrypt-manifest.js");
+  process.exit(1);
+}
+
+function encrypt(plaintext) {
+  const key = crypto.scryptSync(ENCRYPT_KEY, ENCRYPT_SALT, 32);
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  let encrypted = cipher.update(plaintext, "utf8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${ENC_PREFIX}${iv.toString("hex")}:${authTag}:${encrypted}`;
+}
+
+const manifestPath = path.join(__dirname, "manifest.json");
+const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+
+let changed = false;
+
+if (manifest.uid && !manifest.uid.startsWith(ENC_PREFIX)) {
+  console.log(`Encrypting uid: ${manifest.uid.substring(0, 8)}...`);
+  manifest.uid = encrypt(manifest.uid);
+  changed = true;
+}
+
+if (manifest.oauth?.client_id && !manifest.oauth.client_id.startsWith(ENC_PREFIX)) {
+  console.log(`Encrypting oauth.client_id: ${manifest.oauth.client_id.substring(0, 8)}...`);
+  manifest.oauth.client_id = encrypt(manifest.oauth.client_id);
+  changed = true;
+}
+
+if (manifest.oauth?.client_secret && !manifest.oauth.client_secret.startsWith(ENC_PREFIX)) {
+  console.log(`Encrypting oauth.client_secret: ${manifest.oauth.client_secret.substring(0, 8)}...`);
+  manifest.oauth.client_secret = encrypt(manifest.oauth.client_secret);
+  changed = true;
+}
+
+if (!changed) {
+  console.log("All sensitive fields are already encrypted. Nothing to do.");
+  process.exit(0);
+}
+
+fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 4) + "\n");
+console.log("\nmanifest.json updated with encrypted values.");
+console.log("Make sure to store MANIFEST_ENCRYPT_KEY securely (e.g. in your .env file).");