Upgrade Flask and address Latest Python Dependencies in the API Repo

[mjones-oddball]

https://github.com/department-of-veterans-affairs/notification-api/pulls?q=is%3Aopen+is%3Apr+label%3Adependencies+label%3Apython

• [x] Upgrade flask to latest version (2.2.2)
• [x] Document any gaps in unit tests into new tickets
• [x] Remove security exceptions in Makefile for Safety
• [x] Remove Twistlock ignore rules and run Twistlock to identify what's left
  • [x] Reference existing TL tickets and close out those that no longer come up as a violation
• [x] For any dependencies or issues not resolved by flask upgrade: 1) first check that we do not already have them captured via "TL" (twistlock) tickets and 2) create new tickets if none are found
• [x] Update requirements.txt (see the README)
• [x] Group meeting to ensure tests/API params were not changed.

[kalbfled]

I deployed the branch for #1136 and could not get this branch successfully to deploy again. I'm still getting the Fargate errors.

[kalbfled]

The 724-flask-upgrade branch was deployed last night to test for proper billing stats generation. It created a new file in S3 and correctly produced a row in out BigQuery "dev-billing" table; it did not create a new row in the "dev-statistics" table. I will address that today and deploy again this evening.

[kalbfled]

I verified that stats generation works in BigQuery for the dev-billing and dev-statistics tables. The PR is now ready for review.

[Eallan919]

Cris to give another glance at this!

[cris-oddball]

PR still open, but agreed with Dave to send his branch to Perf for testing. On its way now.

[cris-oddball]

Flask Upgrade branch is now in Perf. Ran QA Suite against it - all tests pass

(notification-api-qa-py3.10)  ~/git-repos/notification-api-qa/ [add-delay*] pytest tests/                            
=========================================================================== test session starts ============================================================================
platform darwin -- Python 3.10.9, pytest-7.2.2, pluggy-1.0.0
rootdir: /Users/cris/git-repos/notification-api-qa, configfile: pytest.ini
collected 31 items                                                                                                                                                         

tests/test_communication_item.py::test_get_all_communication_items PASSED                                                                                            [  3%]
tests/test_inbound_number.py::test_get_all_communication_items PASSED                                                                                                [  6%]
tests/test_organizations.py::test_get_all_organizations PASSED                                                                                                       [  9%]
tests/test_provider_details.py::test_get_all_provider_details PASSED                                                                                                 [ 12%]
tests/test_service.py::test_get_all_services PASSED                                                                                                                  [ 16%]
tests/test_service.py::test_get_service_by_id PASSED                                                                                                                 [ 19%]
tests/test_service_api_key.py::test_get_all_api_keys PASSED                                                                                                          [ 22%]
tests/test_service_sms_sender.py::test_get_all_sms_senders PASSED                                                                                                    [ 25%]
tests/test_service_template.py::test_get_all_templates PASSED                                                                                                        [ 29%]
tests/test_service_template.py::test_get_sms_template_by_id PASSED                                                                                                   [ 32%]
tests/test_status.py::test_status PASSED                                                                                                                             [ 35%]
tests/test_v2_notifications_email.py::test_send_email[Email with Formatting] PASSED                                                                                  [ 38%]
tests/test_v2_notifications_email.py::test_send_email[Email with Personalization] PASSED                                                                             [ 41%]
tests/test_v2_notifications_email.py::test_send_email[Email with Custom Reply-To on Template] PASSED                                                                 [ 45%]
tests/test_v2_notifications_email.py::test_send_email[Email with Formatting and Optional Properties] PASSED                                                          [ 48%]
tests/test_v2_notifications_email.py::test_send_email[Email with VAPROFILEID recipient ID] PASSED                                                                    [ 51%]
tests/test_v2_notifications_email.py::test_send_email[Email with ICN recipient ID] PASSED                                                                            [ 54%]
tests/test_v2_notifications_email.py::test_send_email[Email with BIRLSID recipient ID] PASSED                                                                        [ 58%]
tests/test_v2_notifications_email.py::test_send_email[Email with with VAPROFILEID recipient ID and Optional Properties] PASSED                                       [ 61%]
tests/test_v2_notifications_sms.py::test_send_sms[Short SMS] PASSED                                                                                                  [ 64%]
tests/test_v2_notifications_sms.py::test_send_sms[Short Personalized SMS] PASSED                                                                                     [ 67%]
tests/test_v2_notifications_sms.py::test_send_sms[Short SMS with URL] PASSED                                                                                         [ 70%]
tests/test_v2_notifications_sms.py::test_send_sms[Long SMS 160+] PASSED                                                                                              [ 74%]
tests/test_v2_notifications_sms.py::test_send_sms[Short w/ optional properties] PASSED                                                                               [ 77%]
tests/test_v2_notifications_sms.py::test_send_sms[Short w/ alternate SMS Sender ID] PASSED                                                                           [ 80%]
tests/test_v2_notifications_sms.py::test_send_sms[Short w/ BIRLSID recipient ID] PASSED                                                                              [ 83%]
tests/test_v2_notifications_sms.py::test_send_sms[Short w/ ICN recipient ID] PASSED                                                                                  [ 87%]
tests/test_v2_notifications_sms.py::test_send_sms[Short with VAPROFILEID recipient ID] PASSED                                                                        [ 90%]
tests/test_v2_notifications_sms.py::test_send_sms[Short with VAPROFILEID recipient ID w/ optional properties] PASSED                                                 [ 93%]
tests/test_v2_notifications_sms.py::test_send_sms[Short with VAPROFILEID recipient ID w/ alternate SMS Sender ID] PASSED                                             [ 96%]
tests/test_v2_notifications_z_notification_id.py::test_get_notification_statuses PASSED                                                                              [100%]

====================================================================== 31 passed in 108.81s (0:01:48) ======================================================================
(notification-api-qa-py3.10)  ~/git-repos/notification-api-qa/ [add-delay*] 

All other testing deferred until I have time (not today).

[cris-oddball]

ROUTES tested that pass

GET /_status POST v2/notifications/sms POST v2/notifications/email GET v2/notifications/:notification-id GET v2/notifications/ GET /service GET /service/:service-id GET /service/find-services-by-name?service_name=:service-name GET /service/:service-id/job GET /service/:service-id/sms-sender POST /service/:service-id/sms-sender POST service/:service-id/callback POST service/:service-id/callback/:callback-id DEL service/:service-id/callback/:callback-id GET service/:service-id/callback - ticket created GET service/:service-id/callback/:callback-id GET /service/:service-id/api-keys POST /service/:service-id/api-keys POST /service/:service-id/api-keys/revoke/:api-key-id GET /inbound-number GET /inbound-number/available GET /inbound-number/service/:service-id POST /inbound-number POST /inbound-number/:inbound_number_id GET /organisations GET /provider-details GET /provider-details::provider-detail-id POST /provider-details/:provider-detail-id GET /communication-item PUT /service/:service-id/whitelist - ticket created GET /service/:service-id/whitelist ticket created

Big Query passes perf-billing perf-stats

[cris-oddball]

Spoke with team,

• Dave re-based the Strike DB migration into his branch,
• I am cutting a new tag for that branch to send the Flask Upgrade to perf.
• Will immediately pre-release to Staging and
• once deployed, delete the Prerelease from the UI so that no one accidentally deploys it to Prod
• @ldraney to monitor staging next week for any anomalies

[cris-oddball]

Of course the pre-release failed (this is now deleted). Using Deploy to Dev to send the Flask branch up to staging.

[cris-oddball]

Increased resource usage in the Fargate task definition for staging - the code has now successfully deployed. We plan to let it sit there are a few days while @ldraney monitors it in Datadog or we hear from anyone experiencing issues on staging.

[cris-oddball]

Smoke test passes on staging.

[cris-oddball]

Push passes on staging!

Next steps:

• We need to determine when to merge this branch to Master NOTE: Twilio work takes priority and Twilio is expected to be sent to Perf on Thursday, Mar 30.
• Deploy code to Dev
• Cris needs to change all the Twistlock rules to expire last month and then cut a tag for this and send it perf, watch Twistlock, close any Twisty tickets for vulnerabilities that are not detected, reset the expiration for vulnerabilities still found, and prioritize those tickets.
• Final test in Perf and close ticket if it passes.
• Do we want this and Twisty in next week's deploy?

cc/ @tabinda-syed @k-macmillan @kalbfled @mjones-oddball

[cris-oddball]

Unable to update a template to change the provider_id

Route: https://sandbox-api.va.gov/vanotify/service/e024930e-a56d-45dc-ba96-7c34929db954/template/e024930e-a56d-45dc-ba96-7c34929db954 Payload { "provider_id": "0f03d378-796c-4fb8-8c20-c3e99d43e8fd" }

1st attempt: 500 Internal Server Error 2nd attempt: 404 Not found 3rd attempt: 500 Internal server Error

Log of note (full stacktrace split across multiple logs)

{
    "name": "app",
    "levelname": "ERROR",
    "message": "__init__() takes 1 positional argument but 2 were given",
    "pathname": "/app/app/dao/dao_utils.py",
    "lineno": 20,
    "time": "2023-03-30T16:30:24",
    "requestId": null,
    "application": "app",
    "logType": "application"
}

@kalbfled

[cris-oddball]

Just another data point, I was able to update the provider_id on that template in Perf with Master deployed, so this is strictly related to the Flask Upgrade.

[kalbfled]

I audited the use of the schema classes defined in app/schema.py after @cris-oddball discovered that updating a template with a "provider_id" value (and probably others) failed. Rather than testing every route, I looked for schemas used in endpoints used to update models, but I didn't discover any additional problems.

[cris-oddball]

724 branch merged into master. Will start the twistlock stuff now and deploy it to Perf.

[cris-oddball]

Got the twistlock data, checking existing tickets. This upgrade resolved the following : PRISMA-2021-0090 PRISMA-2021-0020 PRISMA-2022-0168 CVE-2022-38533 CVE-2023-0286 CVE-2023-23931 CVE-2023-25577 CVE-2023-23934 CVE-2022-34749 CVE-2023-28858 CVE-2023-28859

[cris-oddball]

QA Suite passes in Perf (except for the 429 known error issue). Will do more testing tomorrow.

[cris-oddball]

Will deploy to staging after prod deploy. Dave to create the pre-release from tag v1.6.0