From 6d4c501ce181f1726d1638ddaaa4f11c84208cc0 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Tue, 29 Sep 2026 15:00:23 -0400 Subject: [PATCH] fix(side-effects): keep non-prod off Slack and 3CX Dev portal actions could still name the production Slack channel and phone queue. Skip those calls unless STAGE is prod, and leave the identifiers empty on non-prod tasks. --- src/holiday-router/app.py | 4 +++ src/ring-scheduler/app.py | 4 +++ src/roster-sync/app.py | 4 +++ src/server/app.py | 2 ++ src/shared/shared/effects.py | 14 +++++++++ src/shared/shared/holiday_flow.py | 7 +++++ src/shared/shared/side_effects.py | 11 +++++++ src/weekly-post/app.py | 4 +++ terraform/data.tf | 10 ++++++ terraform/ecs.tf | 8 ++--- tests/shared/test_effects.py | 52 +++++++++++++++++++++++++++++++ 11 files changed, 116 insertions(+), 4 deletions(-) create mode 100644 src/shared/shared/effects.py create mode 100644 tests/shared/test_effects.py diff --git a/src/holiday-router/app.py b/src/holiday-router/app.py index c6c7940..514c848 100644 --- a/src/holiday-router/app.py +++ b/src/holiday-router/app.py @@ -38,6 +38,10 @@ def _deactivate(schedule: ShiftSchedule, date: str) -> dict: def handler(event, context): + if os.environ.get("STAGE", "prod") != "prod": + logger.info("Skipping holiday router because STAGE is not prod") + return {"skipped": "non_prod"} + action = event.get("action") date = event.get("date") logger.info("Holiday router invoked: action=%s date=%s", action, date) diff --git a/src/ring-scheduler/app.py b/src/ring-scheduler/app.py index 77424e7..eb47b0b 100644 --- a/src/ring-scheduler/app.py +++ b/src/ring-scheduler/app.py @@ -27,6 +27,10 @@ EASTERN = ZoneInfo("America/New_York") def handler(event, context): + if os.environ.get("STAGE", "prod") != "prod": + logger.info("Skipping 3CX queue scheduler because STAGE is not prod") + return {"skipped": "non_prod"} + now = datetime.now(EASTERN) current_hour = now.hour day_name = now.strftime("%A") diff --git a/src/roster-sync/app.py b/src/roster-sync/app.py index 1b29d0b..6ba7bee 100644 --- a/src/roster-sync/app.py +++ b/src/roster-sync/app.py @@ -24,6 +24,10 @@ EXCLUDE_NAMES = {"Voicemail", "IVR", "Fax"} def handler(event, context): + if os.environ.get("STAGE", "prod") != "prod": + logger.info("Skipping roster sync because STAGE is not prod") + return {"skipped": "non_prod"} + now = datetime.now(EASTERN) # DST guard — two EventBridge rules fire, only one is at 6am ET diff --git a/src/server/app.py b/src/server/app.py index 493ac0e..f2bf582 100644 --- a/src/server/app.py +++ b/src/server/app.py @@ -67,6 +67,8 @@ def create_app() -> Flask: @app.route("/slack/events", methods=["POST"]) def slack_events(): + if os.environ.get("STAGE", "prod") != "prod": + return jsonify({"error": "slack_disabled"}), 404 return _get_slack_handler().handle(request) @app.route("/api/shifts", methods=["GET", "POST", "DELETE", "OPTIONS"]) diff --git a/src/shared/shared/effects.py b/src/shared/shared/effects.py new file mode 100644 index 0000000..062f647 --- /dev/null +++ b/src/shared/shared/effects.py @@ -0,0 +1,14 @@ +"""External side effects. Only production may call Slack or 3CX. + +A missing STAGE is treated as prod so a task that lost its environment +variable does not silently drop production notifications. Dev and any +other named stage skip Slack and 3CX entirely. +""" + +from __future__ import annotations + +import os + + +def prod_side_effects_enabled() -> bool: + return os.environ.get("STAGE", "prod") == "prod" diff --git a/src/shared/shared/holiday_flow.py b/src/shared/shared/holiday_flow.py index e631837..424a3c3 100644 --- a/src/shared/shared/holiday_flow.py +++ b/src/shared/shared/holiday_flow.py @@ -5,6 +5,7 @@ from __future__ import annotations import logging import os +from shared.effects import prod_side_effects_enabled from shared.schedule import FALLBACK_EXTENSION, ShiftSchedule from shared.secrets import get_secret from shared.three_cx_client import ThreeCXClient, oauth_client @@ -28,6 +29,9 @@ def holiday_extensions(holiday: dict) -> list[str]: def activate(schedule: ShiftSchedule, date: str, client_factory=None) -> dict: + if not prod_side_effects_enabled(): + logger.info("Skipping holiday activate because STAGE is not prod") + return {"action": "activate", "date": date, "skipped": "non_prod"} holiday = schedule.get_holiday(date) if holiday is None: logger.info("No holiday record for %s — nothing to activate", date) @@ -77,6 +81,9 @@ def activate(schedule: ShiftSchedule, date: str, client_factory=None) -> dict: def deactivate(schedule: ShiftSchedule, date: str, client_factory=None) -> dict: + if not prod_side_effects_enabled(): + logger.info("Skipping holiday deactivate because STAGE is not prod") + return {"action": "deactivate", "date": date, "skipped": "non_prod"} holiday = schedule.get_holiday(date) if holiday is None: logger.info("No holiday record for %s — nothing to deactivate", date) diff --git a/src/shared/shared/side_effects.py b/src/shared/shared/side_effects.py index 8f5fd51..100198d 100644 --- a/src/shared/shared/side_effects.py +++ b/src/shared/shared/side_effects.py @@ -19,6 +19,7 @@ from shared.blocks import ( build_swap_request_blocks, build_week_schedule, ) +from shared.effects import prod_side_effects_enabled from shared.ring_scheduler import update_queue_routing from shared.schedule import FALLBACK_EXTENSION, week_start from shared.secrets import get_secret @@ -31,6 +32,8 @@ SLACK_API = "https://slack.com/api" def slack_token() -> str | None: + if not prod_side_effects_enabled(): + return None secret_id = os.environ.get("SLACK_BOT_TOKEN_SECRET") if not secret_id: return None @@ -42,6 +45,9 @@ def slack_token() -> str | None: def slack_call(method: str, token: str, **payload) -> bool: + if not prod_side_effects_enabled(): + logger.info("Skipping Slack %s because STAGE is not prod", method) + return False try: response = requests.post( f"{SLACK_API}/{method}", @@ -63,6 +69,9 @@ def slack_call(method: str, token: str, **payload) -> bool: def update_3cx_routing(extension: str) -> None: + if not prod_side_effects_enabled(): + logger.info("Skipping 3CX routing because STAGE is not prod") + return queue_number = os.environ.get("QUEUE_NUMBER") secret_prefix = os.environ.get("TCX_SECRET_PREFIX") if not queue_number or not secret_prefix: @@ -89,6 +98,8 @@ def maybe_repoint_today(date_str: str, shift_type: str, extension: str) -> bool: def make_3cx_client() -> ThreeCXClient | None: """Return the process OAuth client, refreshing it when the token or secret changed.""" + if not prod_side_effects_enabled(): + return None secret_prefix = os.environ.get("TCX_SECRET_PREFIX") if not secret_prefix: logger.warning("3CX env vars not set — skipping 3CX call") diff --git a/src/weekly-post/app.py b/src/weekly-post/app.py index 7c89d36..da31143 100644 --- a/src/weekly-post/app.py +++ b/src/weekly-post/app.py @@ -289,6 +289,10 @@ def _send_checkcomponents(pay_record: dict) -> bool: def handler(event, context): + if os.environ.get("STAGE", "prod") != "prod": + logger.info("Skipping weekly post because STAGE is not prod") + return {"skipped": "non_prod"} + now = datetime.now(EASTERN) # DST guard — same pattern as the 3CX scheduler diff --git a/terraform/data.tf b/terraform/data.tf index 8ad9897..f971220 100644 --- a/terraform/data.tf +++ b/terraform/data.tf @@ -10,6 +10,16 @@ check "correct_account" { } } +check "dev_has_no_external_side_effects" { + assert { + condition = local.is_prod || alltrue([ + for name in ["SHIFT_CHANNEL", "QUEUE_NUMBER", "PAY_REPORT_USER", "TCX_SECRET_PREFIX"] : + one([for env in local.api_environment : env.value if env.name == name]) == "" + ]) + error_message = "Non-prod must leave SHIFT_CHANNEL, QUEUE_NUMBER, PAY_REPORT_USER, and TCX_SECRET_PREFIX empty so the task cannot post to Slack or move the production phone queue." + } +} + check "dev_has_no_paychex" { assert { condition = local.is_prod || var.checkcomponents_queue_url == "" diff --git a/terraform/ecs.tf b/terraform/ecs.tf index 0951ff7..f898721 100644 --- a/terraform/ecs.tf +++ b/terraform/ecs.tf @@ -182,9 +182,9 @@ locals { { name = "SHIFT_TABLE", value = aws_dynamodb_table.shifts.name }, { name = "SLACK_BOT_TOKEN_SECRET", value = "afterhours-shift-manager/slack-bot-token" }, { name = "SLACK_SIGNING_SECRET", value = "afterhours-shift-manager/slack-signing-secret" }, - { name = "SHIFT_CHANNEL", value = var.shift_channel }, - { name = "TCX_SECRET_PREFIX", value = "afterhours-shift-manager/3cx-" }, - { name = "QUEUE_NUMBER", value = var.queue_number }, + { name = "SHIFT_CHANNEL", value = local.is_prod ? var.shift_channel : "" }, + { name = "TCX_SECRET_PREFIX", value = local.is_prod ? "afterhours-shift-manager/3cx-" : "" }, + { name = "QUEUE_NUMBER", value = local.is_prod ? var.queue_number : "" }, { name = "TZ", value = var.timezone }, { name = "HOLIDAY_SCHEDULER_ROLE_ARN", value = local.holiday_scheduler_role_arn }, { name = "HOLIDAY_SCHEDULE_GROUP", value = "default" }, @@ -195,7 +195,7 @@ locals { var.portal_cognito_issuer != "" && var.portal_cognito_audience != "" ? [{ issuer = var.portal_cognito_issuer, audience = var.portal_cognito_audience }] : [], var.portal_cognito_extra_trust, )) }, - { name = "PAY_REPORT_USER", value = var.pay_report_user }, + { name = "PAY_REPORT_USER", value = local.is_prod ? var.pay_report_user : "" }, { name = "CHECKCOMPONENTS_QUEUE_URL", value = var.checkcomponents_queue_url }, { name = "ROSTER_API_TOKEN_SECRET", value = "afterhours-shift-manager/roster-api-token" }, { name = "SYNC_GROUP", value = "DEFAULT" }, diff --git a/tests/shared/test_effects.py b/tests/shared/test_effects.py new file mode 100644 index 0000000..2837296 --- /dev/null +++ b/tests/shared/test_effects.py @@ -0,0 +1,52 @@ +"""Non-prod must not call Slack or 3CX.""" + +from unittest.mock import MagicMock + +from shared.effects import prod_side_effects_enabled +from shared.holiday_flow import activate +from shared.side_effects import slack_call, slack_token, update_3cx_routing + + +def test_missing_stage_keeps_prod_effects(monkeypatch): + monkeypatch.delenv("STAGE", raising=False) + assert prod_side_effects_enabled() is True + + +def test_dev_stage_disables_effects(monkeypatch): + monkeypatch.setenv("STAGE", "dev") + assert prod_side_effects_enabled() is False + + +def test_dev_slack_token_does_not_read_secrets(monkeypatch): + monkeypatch.setenv("STAGE", "dev") + monkeypatch.setenv("SLACK_BOT_TOKEN_SECRET", "afterhours-shift-manager/slack-bot-token") + read = MagicMock(side_effect=AssertionError("secret read")) + monkeypatch.setattr("shared.side_effects.get_secret", read) + assert slack_token() is None + read.assert_not_called() + + +def test_dev_slack_call_does_not_post(monkeypatch): + monkeypatch.setenv("STAGE", "dev") + post = MagicMock(side_effect=AssertionError("slack post")) + monkeypatch.setattr("shared.side_effects.requests.post", post) + assert slack_call("chat.postMessage", "xoxb-token", channel="C0APATP612N") is False + post.assert_not_called() + + +def test_dev_skips_3cx_even_when_queue_is_configured(monkeypatch): + monkeypatch.setenv("STAGE", "dev") + monkeypatch.setenv("QUEUE_NUMBER", "801") + monkeypatch.setenv("TCX_SECRET_PREFIX", "afterhours-shift-manager/3cx-") + route = MagicMock(side_effect=AssertionError("3cx")) + monkeypatch.setattr("shared.side_effects.update_queue_routing", route) + update_3cx_routing("101") + route.assert_not_called() + + +def test_dev_holiday_activate_does_not_build_a_client(monkeypatch): + monkeypatch.setenv("STAGE", "dev") + factory = MagicMock(side_effect=AssertionError("3cx client")) + result = activate(MagicMock(), "2026-07-04", client_factory=factory) + assert result["skipped"] == "non_prod" + factory.assert_not_called()