fix(side-effects): keep non-prod off Slack and 3CX

Dev portal actions could still name the production Slack channel and phone queue. Skip those calls unless STAGE is prod, and leave the identifiers empty on non-prod tasks.

src/holiday-router/app.py

@@ -38,6 +38,10 @@ def _deactivate(schedule: ShiftSchedule, date: str) -> dict:
 
 
 def handler(event, context):
+    if os.environ.get("STAGE", "prod") != "prod":
+        logger.info("Skipping holiday router because STAGE is not prod")
+        return {"skipped": "non_prod"}
+
     action = event.get("action")
     date = event.get("date")
     logger.info("Holiday router invoked: action=%s date=%s", action, date)

src/ring-scheduler/app.py

@@ -27,6 +27,10 @@ EASTERN = ZoneInfo("America/New_York")
 
 
 def handler(event, context):
+    if os.environ.get("STAGE", "prod") != "prod":
+        logger.info("Skipping 3CX queue scheduler because STAGE is not prod")
+        return {"skipped": "non_prod"}
+
     now = datetime.now(EASTERN)
     current_hour = now.hour
     day_name = now.strftime("%A")

src/roster-sync/app.py

@@ -24,6 +24,10 @@ EXCLUDE_NAMES = {"Voicemail", "IVR", "Fax"}
 
 
 def handler(event, context):
+    if os.environ.get("STAGE", "prod") != "prod":
+        logger.info("Skipping roster sync because STAGE is not prod")
+        return {"skipped": "non_prod"}
+
     now = datetime.now(EASTERN)
 
     # DST guard — two EventBridge rules fire, only one is at 6am ET

src/server/app.py

@@ -67,6 +67,8 @@ def create_app() -> Flask:
 
     @app.route("/slack/events", methods=["POST"])
     def slack_events():
+        if os.environ.get("STAGE", "prod") != "prod":
+            return jsonify({"error": "slack_disabled"}), 404
         return _get_slack_handler().handle(request)
 
     @app.route("/api/shifts", methods=["GET", "POST", "DELETE", "OPTIONS"])

src/shared/shared/effects.py

@@ -0,0 +1,14 @@
+"""External side effects. Only production may call Slack or 3CX.
+
+A missing STAGE is treated as prod so a task that lost its environment
+variable does not silently drop production notifications. Dev and any
+other named stage skip Slack and 3CX entirely.
+"""
+
+from __future__ import annotations
+
+import os
+
+
+def prod_side_effects_enabled() -> bool:
+    return os.environ.get("STAGE", "prod") == "prod"

src/shared/shared/holiday_flow.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import logging
 import os
 
+from shared.effects import prod_side_effects_enabled
 from shared.schedule import FALLBACK_EXTENSION, ShiftSchedule
 from shared.secrets import get_secret
 from shared.three_cx_client import ThreeCXClient, oauth_client
@@ -28,6 +29,9 @@ def holiday_extensions(holiday: dict) -> list[str]:
 
 
 def activate(schedule: ShiftSchedule, date: str, client_factory=None) -> dict:
+    if not prod_side_effects_enabled():
+        logger.info("Skipping holiday activate because STAGE is not prod")
+        return {"action": "activate", "date": date, "skipped": "non_prod"}
     holiday = schedule.get_holiday(date)
     if holiday is None:
         logger.info("No holiday record for %s — nothing to activate", date)
@@ -77,6 +81,9 @@ def activate(schedule: ShiftSchedule, date: str, client_factory=None) -> dict:
 
 
 def deactivate(schedule: ShiftSchedule, date: str, client_factory=None) -> dict:
+    if not prod_side_effects_enabled():
+        logger.info("Skipping holiday deactivate because STAGE is not prod")
+        return {"action": "deactivate", "date": date, "skipped": "non_prod"}
     holiday = schedule.get_holiday(date)
     if holiday is None:
         logger.info("No holiday record for %s — nothing to deactivate", date)

src/shared/shared/side_effects.py

@@ -19,6 +19,7 @@ from shared.blocks import (
     build_swap_request_blocks,
     build_week_schedule,
 )
+from shared.effects import prod_side_effects_enabled
 from shared.ring_scheduler import update_queue_routing
 from shared.schedule import FALLBACK_EXTENSION, week_start
 from shared.secrets import get_secret
@@ -31,6 +32,8 @@ SLACK_API = "https://slack.com/api"
 
 
 def slack_token() -> str | None:
+    if not prod_side_effects_enabled():
+        return None
     secret_id = os.environ.get("SLACK_BOT_TOKEN_SECRET")
     if not secret_id:
         return None
@@ -42,6 +45,9 @@ def slack_token() -> str | None:
 
 
 def slack_call(method: str, token: str, **payload) -> bool:
+    if not prod_side_effects_enabled():
+        logger.info("Skipping Slack %s because STAGE is not prod", method)
+        return False
     try:
         response = requests.post(
             f"{SLACK_API}/{method}",
@@ -63,6 +69,9 @@ def slack_call(method: str, token: str, **payload) -> bool:
 
 
 def update_3cx_routing(extension: str) -> None:
+    if not prod_side_effects_enabled():
+        logger.info("Skipping 3CX routing because STAGE is not prod")
+        return
     queue_number = os.environ.get("QUEUE_NUMBER")
     secret_prefix = os.environ.get("TCX_SECRET_PREFIX")
     if not queue_number or not secret_prefix:
@@ -89,6 +98,8 @@ def maybe_repoint_today(date_str: str, shift_type: str, extension: str) -> bool:
 
 def make_3cx_client() -> ThreeCXClient | None:
     """Return the process OAuth client, refreshing it when the token or secret changed."""
+    if not prod_side_effects_enabled():
+        return None
     secret_prefix = os.environ.get("TCX_SECRET_PREFIX")
     if not secret_prefix:
         logger.warning("3CX env vars not set — skipping 3CX call")

src/weekly-post/app.py

@@ -289,6 +289,10 @@ def _send_checkcomponents(pay_record: dict) -> bool:
 
 
 def handler(event, context):
+    if os.environ.get("STAGE", "prod") != "prod":
+        logger.info("Skipping weekly post because STAGE is not prod")
+        return {"skipped": "non_prod"}
+
     now = datetime.now(EASTERN)
 
     # DST guard — same pattern as the 3CX scheduler

terraform/data.tf

@@ -10,6 +10,16 @@ check "correct_account" {
   }
 }
 
+check "dev_has_no_external_side_effects" {
+  assert {
+    condition = local.is_prod || alltrue([
+      for name in ["SHIFT_CHANNEL", "QUEUE_NUMBER", "PAY_REPORT_USER", "TCX_SECRET_PREFIX"] :
+      one([for env in local.api_environment : env.value if env.name == name]) == ""
+    ])
+    error_message = "Non-prod must leave SHIFT_CHANNEL, QUEUE_NUMBER, PAY_REPORT_USER, and TCX_SECRET_PREFIX empty so the task cannot post to Slack or move the production phone queue."
+  }
+}
+
 check "dev_has_no_paychex" {
   assert {
     condition     = local.is_prod || var.checkcomponents_queue_url == ""

terraform/ecs.tf

@@ -182,9 +182,9 @@ locals {
     { name = "SHIFT_TABLE", value = aws_dynamodb_table.shifts.name },
     { name = "SLACK_BOT_TOKEN_SECRET", value = "afterhours-shift-manager/slack-bot-token" },
     { name = "SLACK_SIGNING_SECRET", value = "afterhours-shift-manager/slack-signing-secret" },
-    { name = "SHIFT_CHANNEL", value = var.shift_channel },
-    { name = "TCX_SECRET_PREFIX", value = "afterhours-shift-manager/3cx-" },
-    { name = "QUEUE_NUMBER", value = var.queue_number },
+    { name = "SHIFT_CHANNEL", value = local.is_prod ? var.shift_channel : "" },
+    { name = "TCX_SECRET_PREFIX", value = local.is_prod ? "afterhours-shift-manager/3cx-" : "" },
+    { name = "QUEUE_NUMBER", value = local.is_prod ? var.queue_number : "" },
     { name = "TZ", value = var.timezone },
     { name = "HOLIDAY_SCHEDULER_ROLE_ARN", value = local.holiday_scheduler_role_arn },
     { name = "HOLIDAY_SCHEDULE_GROUP", value = "default" },
@@ -195,7 +195,7 @@ locals {
       var.portal_cognito_issuer != "" && var.portal_cognito_audience != "" ? [{ issuer = var.portal_cognito_issuer, audience = var.portal_cognito_audience }] : [],
       var.portal_cognito_extra_trust,
     )) },
-    { name = "PAY_REPORT_USER", value = var.pay_report_user },
+    { name = "PAY_REPORT_USER", value = local.is_prod ? var.pay_report_user : "" },
     { name = "CHECKCOMPONENTS_QUEUE_URL", value = var.checkcomponents_queue_url },
     { name = "ROSTER_API_TOKEN_SECRET", value = "afterhours-shift-manager/roster-api-token" },
     { name = "SYNC_GROUP", value = "DEFAULT" },

tests/shared/test_effects.py

@@ -0,0 +1,52 @@
+"""Non-prod must not call Slack or 3CX."""
+
+from unittest.mock import MagicMock
+
+from shared.effects import prod_side_effects_enabled
+from shared.holiday_flow import activate
+from shared.side_effects import slack_call, slack_token, update_3cx_routing
+
+
+def test_missing_stage_keeps_prod_effects(monkeypatch):
+    monkeypatch.delenv("STAGE", raising=False)
+    assert prod_side_effects_enabled() is True
+
+
+def test_dev_stage_disables_effects(monkeypatch):
+    monkeypatch.setenv("STAGE", "dev")
+    assert prod_side_effects_enabled() is False
+
+
+def test_dev_slack_token_does_not_read_secrets(monkeypatch):
+    monkeypatch.setenv("STAGE", "dev")
+    monkeypatch.setenv("SLACK_BOT_TOKEN_SECRET", "afterhours-shift-manager/slack-bot-token")
+    read = MagicMock(side_effect=AssertionError("secret read"))
+    monkeypatch.setattr("shared.side_effects.get_secret", read)
+    assert slack_token() is None
+    read.assert_not_called()
+
+
+def test_dev_slack_call_does_not_post(monkeypatch):
+    monkeypatch.setenv("STAGE", "dev")
+    post = MagicMock(side_effect=AssertionError("slack post"))
+    monkeypatch.setattr("shared.side_effects.requests.post", post)
+    assert slack_call("chat.postMessage", "xoxb-token", channel="C0APATP612N") is False
+    post.assert_not_called()
+
+
+def test_dev_skips_3cx_even_when_queue_is_configured(monkeypatch):
+    monkeypatch.setenv("STAGE", "dev")
+    monkeypatch.setenv("QUEUE_NUMBER", "801")
+    monkeypatch.setenv("TCX_SECRET_PREFIX", "afterhours-shift-manager/3cx-")
+    route = MagicMock(side_effect=AssertionError("3cx"))
+    monkeypatch.setattr("shared.side_effects.update_queue_routing", route)
+    update_3cx_routing("101")
+    route.assert_not_called()
+
+
+def test_dev_holiday_activate_does_not_build_a_client(monkeypatch):
+    monkeypatch.setenv("STAGE", "dev")
+    factory = MagicMock(side_effect=AssertionError("3cx client"))
+    result = activate(MagicMock(), "2026-07-04", client_factory=factory)
+    assert result["skipped"] == "non_prod"
+    factory.assert_not_called()