Update old NPM packages

Remove aspnet webpack to make way for .NET 5 upgrade, and hot module
reloading of the site, which is much more difficult in .NET 5. See
this issue for a discussion of the .NET changes that lead to this
dotnet/aspnetcore#12890

Update webpack from verion 4 to 5. This required changing how GOV.UK
assets are made accessible, they are now included using the CopyPlugin.

ntbs-service/README.md

@@ -19,12 +19,15 @@ In this directory, run:
 
 - `git submodule update --init --recursive` to recursively initialise and update submodules, if this was not done as part of the cloning process
 - `dotnet restore` and `npm install` to pull in dependencies
+- `npm run build` to compile frontend assets through webpack
 - `dotnet run` to launch the webserver locally
-- `dotnet watch run` to launch the webserver locally with hot-reloading enabled
+- `dotnet watch run` to launch the webserver locally with hot-reloading of non-webpack-managed changes enabled
 
 Make sure to get the dev secrets from Azure (see [dev mode secrets](#dev-mode-secrets)) to connect to Azure dbs.
 
-The frontend assets are compiled through Webpack, with hot-reload enabled automatically in development mode.
+Hot module reloading was supported until the .NET 5 upgrade (NTBS-2074, #1022) but was removed as part of NTBS-1768.
+This was because in .NET 5 `UseWebpackDevMiddleware` was removed, see [here](https://github.com/dotnet/AspNetCore/issues/12890)
+for a discussion of this change.
 
 ### Debugging
 

ntbs-service/Startup.cs

@@ -20,7 +20,6 @@
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Authorization;
-using Microsoft.AspNetCore.SpaServices.Webpack;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
@@ -57,8 +56,8 @@ public Startup(IConfiguration configuration, IHostingEnvironment env)
  // This method gets called by the runtime. Use this method to add services to the container.
  public void ConfigureServices(IServiceCollection services)
  {
- // This was helpful for identifying issues with ADFS login - but shouldn't be on usually 
- // IdentityModelEventSource.ShowPII = true; 
+ // This was helpful for identifying issues with ADFS login - but shouldn't be on usually
+ // IdentityModelEventSource.ShowPII = true;
  services.Configure<ForwardedHeadersOptions>(options =>
  {
  options.ForwardedHeaders = ForwardedHeaders.All;
@@ -109,7 +108,7 @@ public void ConfigureServices(IServiceCollection services)
 
  Log.Information($"Basic Auth Enabled: {basicAuthEnabled}");
  Log.Information($"Azure Ad Auth Enabled: {azureAdAuthEnabled}");
- 
+
  var baseUserGroupRole = adfsConfig["BaseUserGroup"];
 
 
@@ -121,8 +120,8 @@ public void ConfigureServices(IServiceCollection services)
  }
  else
  UseAdfsAuthentication(services, adfsConfig);
- 
- 
+
+
 
  services.AddMvc(options =>
  {
@@ -153,15 +152,15 @@ public void ConfigureServices(IServiceCollection services)
  services.AddDbContext<NtbsContext>(options =>
  options.UseSqlServer(Configuration.GetConnectionString("ntbsContext"))
  );
- 
+
  services.AddSingleton<NtbsContextDesignTimeFactory>();
 
  var auditDbConnectionString = Configuration.GetConnectionString("auditContext");
 
  services.AddDbContext<AuditDatabaseContext>(options =>
  options.UseSqlServer(auditDbConnectionString)
  );
- 
+
  // Add a DbContext for Data Protection key storage
  services.AddDbContext<KeysContext>(options =>
  options.UseSqlServer(Configuration.GetConnectionString("keysContext")));
@@ -286,7 +285,7 @@ private static void UseAdfsAuthentication(IServiceCollection services, IConfigur
  };
  })
  .AddCookie(options => { options.ForwardAuthenticate = setupDummyAuth ? DummyAuthHandler.Name : null; });
- 
+
 
  if (setupDummyAuth)
  {
@@ -312,9 +311,9 @@ private void UseAzureAdAuthentication(IServiceCollection services, IConfiguratio
  options.CallbackPath = azureAdConfig["CallbackPath"];
  options.CorrelationCookie.SameSite = SameSiteMode.None;
  options.CorrelationCookie.SecurePolicy = CookieSecurePolicy.Always;
- 
+
  options.Events = new OpenIdConnectEvents();
- options.Events.OnTokenValidated += async context => 
+ options.Events.OnTokenValidated += async context =>
  {
  var username = context.Principal.Username();
  if (username == null) {
@@ -396,7 +395,7 @@ private static void UseHttpBasicAuth(IServiceCollection services,
  context.UserName,
  context.Options.ClaimsIssuer),
  new Claim(ClaimTypes.Role, adfsOptions.BaseUserGroup, ClaimValueTypes.String),
- 
+
  new Claim(ClaimTypes.Role, groupAdmin, ClaimValueTypes.String),
  new Claim(ClaimTypes.Role, groupDev, ClaimValueTypes.String)
  };
@@ -440,11 +439,11 @@ private void AddAdImportService(IServiceCollection services)
  {
  services.AddScoped<IAdImportService, AzureAdImportService>();
  }
- else 
+ else
  {
  services.AddScoped<IAdImportService, AdImportService>();
  }
- 
+
  }
 
  private void AddClusterService(IServiceCollection services)
@@ -515,16 +514,12 @@ public void Configure(IApplicationBuilder app, IHostingEnvironment env)
  {
  app.UseForwardedHeaders();
  app.UseDeveloperExceptionPage();
- app.UseWebpackDevMiddleware(new WebpackDevMiddlewareOptions
- {
- HotModuleReplacement = true, ConfigFile = "webpack.dev.js"
- });
  // We only need to turn this on in development, as in production this
  // This behaviour is by default provided by the nginx ingress
  // (see https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#server-side-https-enforcement-through-redirect)
  // (also see HSTS setting below)
  app.UseHttpsRedirection();
- 
+
  }
  else
  {
@@ -551,22 +546,22 @@ Making this conditional is the result of serilog not playing nicely with WebAppl
  // 400s get thrown e.g. on antiforgery token validation failures. In those cases we don't have
  // an exception logged in Sentry, so we want to log at Warning level to make sure we are able to
  // identify and cure false positives.
- // Otherwise setting to Information to prevent duplicated exceptions in sentry. 
+ // Otherwise setting to Information to prevent duplicated exceptions in sentry.
  options.GetLevel = (context, _, __) => context.Response.StatusCode == StatusCodes.Status400BadRequest
- ? LogEventLevel.Warning 
+ ? LogEventLevel.Warning
  : LogEventLevel.Information;
  });
  }
 
  app.UseAuthentication();
  app.UseCookiePolicy();
  app.UseSession();
- 
+
  if (!Env.IsEnvironment("CI"))
  {
  app.UseMiddleware<ActivityDetectionMiddleware>();
  }
- 
+
  if (Configuration.GetValue<bool>(Constants.AuditEnabledConfigValue))
  {
  app.UseMiddleware<AuditGetRequestMiddleWare>();