feat: Read govpay secrets from table

.env.example

@@ -107,4 +107,5 @@ GOV_UK_PAY_TOKEN_GLOUCESTER=👻
 GOV_UK_PAY_TOKEN_MEDWAY=👻
 
 ## End-to-end test team (borrows Lambeth's details)
+GOV_UK_PAY_SECRET_E2E=👻
 GOV_UK_PAY_TOKEN_E2E=👻

api.planx.uk/modules/pay/controller.ts

@@ -60,6 +60,7 @@ export const makePaymentViaProxy: PaymentProxyController = async (
       ),
     },
     req,
+    res,
   )(req, res, next);
 };
 

api.planx.uk/modules/pay/middleware.ts

@@ -5,19 +5,26 @@ import { ServerError } from "../../errors";
 
 /**
  * Confirm that this local authority (aka team) has a pay token
- * TODO: Check this against a DB value instead of env vars?
  */
-export const isTeamUsingGovPay: RequestHandler = (req, _res, next) => {
-  const isSupported =
-    process.env[`GOV_UK_PAY_TOKEN_${req.params.localAuthority.toUpperCase()}`];
+export const isTeamUsingGovPay: RequestHandler = async (req, res, next) => {
+  const env =
+    process.env.APP_ENVIRONMENT === "production" ? "production" : "staging";
 
-  if (!isSupported) {
+  const { govPayToken } = await $api.team.getIntegrations({
+    env,
+    slug: req.params.localAuthority,
+    encryptionKey: process.env.ENCRYPTION_KEY!,
+  });
+
+  if (!govPayToken) {
     return next({
       status: 400,
       message: `GOV.UK Pay is not enabled for this local authority (${req.params.localAuthority})`,
     });
   }
 
+  res.locals.govPayToken = govPayToken;
+
   next();
 };
 

api.planx.uk/modules/pay/proxy.ts

@@ -1,19 +1,15 @@
-import { Request } from "express";
+import { Response, Request } from "express";
 import { fixRequestBody, Options } from "http-proxy-middleware";
 import { useProxy } from "../../shared/middleware/proxy";
 
-export const usePayProxy = (options: Partial<Options>, req: Request) => {
+export const usePayProxy = (options: Partial<Options>, req: Request, res: Response) => {
   return useProxy({
     target: "https://publicapi.payments.service.gov.uk/v1/payments",
     onProxyReq: fixRequestBody,
     headers: {
       ...(req.headers as NodeJS.Dict<string | string[]>),
       "content-type": "application/json",
-      Authorization: `Bearer ${
-        process.env[
-          `GOV_UK_PAY_TOKEN_${req.params.localAuthority}`.toUpperCase()
-        ]
-      }`,
+      Authorization: `Bearer ${res.locals.govPayToken}`,
     },
     ...options,
   });

e2e/tests/ui-driven/src/context.ts

@@ -82,6 +82,8 @@ export async function setUpTestContext(
       publisherId: context.user!.id!,
     });
   }
+  await setupGovPaySecret($admin, context);
+
   return context;
 }
 
@@ -327,3 +329,29 @@ async function deleteTeam(adminGQLClient: GraphQLClient, context: Context) {
     }
   }
 }
+
+async function setupGovPaySecret($admin: CoreDomainClient, context: Context) {
+  try {
+    await $admin.client.request(
+      gql`
+        mutation SetupGovPaySecret(
+          $team_id: Int
+          $staging_govpay_secret: String
+        ) {
+          update_team_integrations(
+            where: { team_id: { _eq: $team_id } }
+            _set: { staging_govpay_secret: $staging_govpay_secret }
+          ) {
+            affected_rows
+          }
+        }
+      `,
+      {
+        team_id: context.team.id,
+        staging_govpay_secret: process.env.GOV_UK_PAY_SECRET_E2E,
+      },
+    );
+  } catch (error) {
+    throw Error("Failed to setup GovPay secret for E2E team");
+  }
+}