adam/afterhours-shift-manager
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git synced 2026-09-30 11:23:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Compare commits

base: adam:main
Branches Tags
adam:main
adam:fix/auto-merge-concurrency
adam:v1.18.0
adam:v1.17.0
adam:v1.15.1
adam:v1.15.0
adam:v1.14.0
adam:v1.13.1
adam:v1.13.0
adam:v1.12.0
adam:v1.11.1
adam:v1.11.0
adam:v1.10.1
adam:v1.10.0
adam:v1.7.19
adam:v1.8.0
adam:v1.9.0
adam:v1.9.1
adam:v1.9.2
adam:v1.7.18
adam:v1.7.17
adam:v1.7.16
adam:v1.7.13
adam:v1.7.12
adam:v1.7.15
adam:v1.7.14
adam:v1.7.11
adam:v1.7.10
adam:v1.7.9
adam:v1.7.8
adam:v1.7.7
adam:v1.7.6
adam:v1.7.5
adam:v1.7.4
adam:v1.7.2
adam:v1.7.0
adam:v1.6.0
..
compare: adam:v1.13.0
Branches Tags
adam:main
adam:fix/auto-merge-concurrency
adam:v1.18.0
adam:v1.17.0
adam:v1.15.1
adam:v1.15.0
adam:v1.14.0
adam:v1.13.1
adam:v1.13.0
adam:v1.12.0
adam:v1.11.1
adam:v1.11.0
adam:v1.10.1
adam:v1.10.0
adam:v1.7.19
adam:v1.8.0
adam:v1.9.0
adam:v1.9.1
adam:v1.9.2
adam:v1.7.18
adam:v1.7.17
adam:v1.7.16
adam:v1.7.13
adam:v1.7.12
adam:v1.7.15
adam:v1.7.14
adam:v1.7.11
adam:v1.7.10
adam:v1.7.9
adam:v1.7.8
adam:v1.7.7
adam:v1.7.6
adam:v1.7.5
adam:v1.7.4
adam:v1.7.2
adam:v1.7.0
adam:v1.6.0

No commits in common. "main" and "v1.13.0" have entirely different histories.
main ... v1.13.0

128 changed files with 2372 additions and 11693 deletions
Show stats Expand all files Collapse all files

12
.dockerignore
View file

@ -1,12 +0,0 @@
.git
.github
.venv
.cursor
terraform
tests
docs
*.md
!src/slack-bot/CHANGELOG.md
__pycache__
.pytest_cache
.mypy_cache

30
.github/dependabot.yml vendored Normal file
View file

@ -0,0 +1,30 @@
version: 2
updates:
- package-ecosystem: "pip"
directories:
- "/src/slack-bot"
- "/src/weekly-post"
- "/src/roster-sync"
- "/src/ring-scheduler"
- "/src/shared"
- "/tests"
schedule:
interval: "weekly"
assignees:
- "amoussa1229"
groups:
minor-and-patch:
update-types:
- "minor"
- "patch"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
assignees:
- "amoussa1229"
groups:
minor-and-patch:
update-types:
- "minor"
- "patch"

38
.github/workflows/changelog-guard.yml vendored Normal file
View file

@ -0,0 +1,38 @@
name: Changelog Guard
# Repo-specific PR check (in addition to the reusable ci.yaml). Enforces that
# CHANGELOG.md drives versioning correctly: a changelog edit must be a clean
# SemVer bump above the latest tag, and the in-package copy must stay in sync.
on:
pull_request:
branches: [main]
permissions:
contents: read
jobs:
guard:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
fetch-tags: true
- uses: actions/setup-python@v6
with:
python-version: "3.12"
- name: Validate CHANGELOG + version bump
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
run: |
if git diff --name-only "$BASE_SHA" HEAD | grep -qx 'CHANGELOG.md'; then
CHANGELOG_CHANGED=true
else
CHANGELOG_CHANGED=false
fi
PREV_TAG=$(git tag -l 'v*' --sort=-v:refname | head -1)
echo "CHANGELOG changed in PR: $CHANGELOG_CHANGED | latest tag: ${PREV_TAG:-none}"
CHANGELOG_CHANGED="$CHANGELOG_CHANGED" PREV_TAG="$PREV_TAG" \
python scripts/check_changelog.py

102
.github/workflows/ci.yaml vendored
View file

@ -1,106 +1,14 @@
name: CI
on:
pull_request:
branches: [main, hotfix/**, release/**]
merge_group:
push:
branches: [hotfix/**, release/**]
branches: [main]
permissions:
contents: read
jobs:
autofix:
if: github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork
uses: Sea-Haven-Industries/.github/.github/workflows/ci-autofix.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19
permissions:
contents: write
secrets: inherit
ci:
uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@main
with:
presets: ruff,terraform
terraform-version: "1.16.0"
lint:
needs: autofix
if: always() && !cancelled() && (needs.autofix.result == 'skipped' || needs.autofix.outputs.committed != 'true')
uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-app.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19
with:
python-version: "3.12"
test:
needs: autofix
if: always() && !cancelled() && (needs.autofix.result == 'skipped' || needs.autofix.outputs.committed != 'true')
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.12"
- name: Install test dependencies
run: |
set -euo pipefail
python -m pip install --upgrade pip
pip install -r tests/requirements.txt
pip install -r src/slack-bot/requirements.txt
pip install -r src/weekly-post/requirements.txt
pip install -r src/shared/requirements.txt
pip install -r src/portal-api/requirements.txt
pip install -r requirements-api.txt
- name: Pytest
run: pytest
terraform:
needs: autofix
if: always() && !cancelled() && (needs.autofix.result == 'skipped' || needs.autofix.outputs.committed != 'true')
uses: Sea-Haven-Industries/.github/.github/workflows/ci-terraform.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19
with:
terraform-version: "1.16.0"
openapi:
name: OpenAPI
needs: autofix
if: always() && !cancelled() && (needs.autofix.result == 'skipped' || needs.autofix.outputs.committed != 'true')
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: "24.19.0"
cache: npm
- name: Install JavaScript tooling
run: npm ci
- name: Lint OpenAPI
run: npm run openapi:lint
ci-complete:
name: ci-complete
needs: [autofix, lint, test, terraform, openapi]
if: always() && !cancelled() && (needs.autofix.result == 'skipped' || needs.autofix.outputs.committed != 'true')
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Require portions
env:
LINT: ${{ needs.lint.result }}
TEST: ${{ needs.test.result }}
TERRAFORM: ${{ needs.terraform.result }}
OPENAPI: ${{ needs.openapi.result }}
run: |
set -euo pipefail
test "${LINT}" = success
test "${TEST}" = success
test "${TERRAFORM}" = success
test "${OPENAPI}" = success
source-dirs: "src/slack-bot src/weekly-post src/roster-sync src/ring-scheduler src/shared/shared tests"
run-tests: true

6
.github/workflows/dependency-review.yml vendored
View file

@ -1,10 +1,6 @@
name: Dependency Review
on:
pull_request:
permissions:
contents: read
jobs:
review:
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19
uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@main

70
.github/workflows/deploy-api.yaml vendored
View file

@ -1,70 +0,0 @@
name: Deploy API
# Fargate image CD (PLAT-216). GitHub Actions builds the Flask image, pushes to ECR,
# and registers a new task definition. Terraform owns the cluster, service,
# ALB, and ignores container_definitions / task_definition.
#
# push to main -> dev, at github.sha
# release: published -> prod, at the release tag
# workflow_dispatch -> chosen environment at a chosen ref
#
# Releases are cut by a human with `gh release create vX.Y.Z --target main`.
# Nothing here creates an HCP run.
on:
push:
branches: [main]
paths-ignore:
- "terraform/**"
- "docs/**"
- "*.md"
- ".github/workflows/ci.yaml"
- ".github/workflows/labeler.yml"
- ".github/workflows/dependency-review.yml"
release:
types: [published]
workflow_dispatch:
inputs:
environment:
description: "Target Environment"
required: true
type: choice
options: [dev, prod]
ref:
description: "Git ref to build and deploy (tag, branch, or SHA). Empty means the workflow ref."
required: false
type: string
default: ""
permissions:
contents: read
jobs:
deploy-dev:
name: Deploy API to dev
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.environment == 'dev')
uses: Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19
permissions:
contents: read
id-token: write
secrets: inherit
with:
environment: dev
ref: ${{ inputs.ref }}
ssm-prefix: /afterhours-shift-manager/deploy
docker-platform: linux/arm64
deploy-prod:
name: Deploy API to prod
if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.environment == 'prod')
uses: Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19
permissions:
contents: read
id-token: write
secrets: inherit
with:
environment: prod
ref: ${{ github.event.release.tag_name || inputs.ref }}
ssm-prefix: /afterhours-shift-manager/deploy
docker-platform: linux/arm64
ship-gate: true

120
.github/workflows/deploy.yaml vendored Normal file
View file

@ -0,0 +1,120 @@
name: Deploy
on:
push:
branches: [main]
permissions:
id-token: write
contents: read
concurrency:
group: deploy
cancel-in-progress: false
jobs:
deploy:
uses: Sea-Haven-Industries/.github/.github/workflows/cd-sam.yaml@main
with:
stack-name: afterhours-shift-manager
cfn-role-arn: arn:aws:iam::328440206208:role/github-cfn-execution-role
secrets:
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
parameter-overrides: ${{ secrets.SAM_PARAMETER_OVERRIDES }}
# Tag + announce a release once the deploy succeeds. This lives in the deploy
# workflow (gated on `needs: deploy`) rather than a separate workflow_run-
# triggered job on purpose: a push-to-main run is a trusted context, so
# checking out and running repo code with write/OIDC is safe here — unlike
# workflow_run, which CodeQL (rightly) flags for untrusted checkout + cache
# poisoning. Gating on `needs: deploy` still guarantees we never announce a
# version that isn't live, and the `deploy` concurrency group serializes
# releases. When the top CHANGELOG version already has a Release, this no-ops.
release:
needs: deploy
runs-on: ubuntu-latest
permissions:
contents: write # create the tag + GitHub Release
id-token: write # OIDC to assume the notifier-invoke role
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
fetch-tags: true
- uses: actions/setup-python@v6
with:
python-version: "3.12"
- name: Determine release
id: rel
env:
GH_TOKEN: ${{ github.token }}
run: |
TOP=$(python scripts/changelog_cli.py top-version CHANGELOG.md)
if [ -z "$TOP" ]; then
echo "No version entry in CHANGELOG.md — nothing to release."
echo "release=false" >> "$GITHUB_OUTPUT"; exit 0
fi
PREV=$(git tag -l 'v*' --sort=-v:refname | head -1)
PREV="${PREV:-v0.0.0}"
KIND=$(python scripts/changelog_cli.py bump-kind CHANGELOG.md "$PREV")
RELEASE_EXISTS=false
gh release view "v$TOP" >/dev/null 2>&1 && RELEASE_EXISTS=true
echo "version=$TOP" >> "$GITHUB_OUTPUT"
echo "kind=$KIND" >> "$GITHUB_OUTPUT"
# Act only on a clean SemVer bump whose Release isn't published yet.
if [ "$KIND" != "none" ] && [ "$RELEASE_EXISTS" = "false" ]; then
echo "release=true" >> "$GITHUB_OUTPUT"
else
echo "release=false" >> "$GITHUB_OUTPUT"
echo "v$TOP: kind=$KIND release_exists=$RELEASE_EXISTS — no action."
fi
- name: Build release notes
if: ${{ steps.rel.outputs.release == 'true' }}
run: |
python scripts/changelog_cli.py payload CHANGELOG.md "${{ steps.rel.outputs.version }}" > payload.json
python -c "import json; print(json.load(open('payload.json'))['notes'])" > notes.md
# Announce BEFORE publishing the Release: the Release is the durable "done"
# marker (the step above skips once it exists), so announcing first keeps
# this retryable. Minor/major only, and only once the invoke-role variable
# has been bootstrapped (see README).
- name: Configure AWS credentials
if: ${{ steps.rel.outputs.release == 'true' && steps.rel.outputs.kind != 'patch' && vars.RELEASE_NOTIFY_INVOKE_ROLE_ARN != '' }}
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ vars.RELEASE_NOTIFY_INVOKE_ROLE_ARN }}
aws-region: us-east-1
- name: Announce in Slack
if: ${{ steps.rel.outputs.release == 'true' && steps.rel.outputs.kind != 'patch' && vars.RELEASE_NOTIFY_INVOKE_ROLE_ARN != '' }}
run: |
aws lambda invoke \
--function-name afterhours-release-notifier \
--cli-binary-format raw-in-base64-out \
--payload file://payload.json \
--output json response.json > invoke-meta.json
# aws lambda invoke only emits a FunctionError key when the handler errored.
if grep -q '"FunctionError"' invoke-meta.json; then
echo "::error::release-notifier returned an error"; cat response.json; exit 1
fi
echo "Announced v${{ steps.rel.outputs.version }}."
- name: Warn if announcement skipped (not bootstrapped)
if: ${{ steps.rel.outputs.release == 'true' && steps.rel.outputs.kind != 'patch' && vars.RELEASE_NOTIFY_INVOKE_ROLE_ARN == '' }}
run: echo "::warning::RELEASE_NOTIFY_INVOKE_ROLE_ARN is unset — tagging + releasing but not announcing. Set the repo variable from the stack output."
- name: Publish GitHub Release
if: ${{ steps.rel.outputs.release == 'true' }}
env:
GH_TOKEN: ${{ github.token }}
run: |
# gh creates the tag at the deployed commit and the Release together.
gh release create "v${{ steps.rel.outputs.version }}" \
--repo "${{ github.repository }}" \
--title "v${{ steps.rel.outputs.version }}" \
--notes-file notes.md \
--target "${{ github.sha }}"

4
.github/workflows/labeler.yml vendored
View file

@ -2,12 +2,10 @@ name: Labeler
on:
pull_request:
branches: [main]
permissions:
contents: read
pull-requests: write
issues: write
jobs:
label:
uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19
uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@main

5
.gitignore vendored
View file

@ -1,4 +1,3 @@
node_modules/
__pycache__/
*.pyc
.aws-sam/
@ -8,7 +7,3 @@ venv/
.env
samconfig.toml
output.json
.idea/
build/
terraform/.terraform/
terraform/build/

32
.redocly.yaml
View file

@ -1,32 +0,0 @@
# Same Redocly recommended ruleset as internal-portal (DEV-223 / DEV-289).
# Recommended operation-2xx-response does not count 302. Login-style redirects
# succeed with 302, so that rule is replaced by operation-2xx-or-3xx-response
# at error. operation-4xx-response is promoted to error so missing 4xx fails CI.
extends:
- recommended
rules:
operation-2xx-response: off
operation-4xx-response: error
rule/operation-2xx-or-3xx-response:
subject:
type: Responses
message: Operation must define a 2XX or 3XX response.
severity: error
assertions:
requireAny:
- "200"
- "201"
- "202"
- "204"
- "301"
- "302"
- "303"
- "307"
- "308"
- "2XX"
- "3XX"
apis:
afterhours@v1:
root: openapi.yaml

18
AGENTS.md
View file

@ -1,18 +0,0 @@
# Sea Haven Governance
## Standards and Authority
- **Handbook**: `engineering-handbook` is the standards authority for all conventions.
- **Jira**: work-status authority. Route product work → DEV, infrastructure/platform → PLAT, security → SEC. Search for duplicates before creating a ticket.
## Branches
Use one of: `feature/`, `fix/`, `hotfix/`, `chore/`, `docs/`, `refactor/`, `release/` + kebab-case description. Do not include a Jira key in the branch name.
## Pull Requests
- **Title format**: `type(scope): description (DEV-123)` — every non-exempt PR must end with its Jira key.
- **Body sections** (exactly, in order): `Summary`, `Validation`, `Tests`, `Notes`. Use "None." under Notes when empty.
- State verifiable facts only. Do not justify changes by citing the handbook. No AI-attribution footers.
## CI and Workflow References
- CI must pass before merge.
- Org-level reusable workflow refs must be pinned to a full commit SHA with a `# vX.Y.Z` comment.

57
CHANGELOG.md
View file

@ -10,63 +10,6 @@ fine and still supported.
---
## v1.17.0 — September 25, 2026
**The work week now runs Sunday through Saturday, matching payroll.** The Monday
7am schedule post and pay summary use that week. A Saturday night shift (5pm
Saturday through 8am Sunday) stays in the Saturday week. Sunday day and Sunday
night open the next week. The first pay close after this change skips any date
already sent to Flex, so that Sunday is not paid twice.
## v1.16.0 — September 21, 2026
**After Hours is available in the employee portal, and Slack still works.** Employees
can pick up, drop, and swap shifts from `internal.seahaven.com`, and admins can
override coverage, open or clear a shift, manage holidays, and approve late
pickups there. Swap and late-pickup still send Slack DMs. Slack App Home admin
modals are unchanged.
Portal identity is the roster email on Paychex `PUT /roster` (optional so existing
syncs keep working). Admin access is still the Slack IDs in `admin_users` after
that lookup. A new `afterhours-portal-api` Lambda serves `GET/POST/DELETE /api/shifts`
on the existing HTTP API with Cognito ID-token auth.
## v1.15.0 — September 2, 2026
**Monday pay totals now queue to Flex payroll posting.** The weekly post still
emails payroll and DMs the pay summary as before. After those go out, it also
sends last week's after-hours dollar lines (by extension, previous Monday
through Sunday) to the paychex-integrations checkcomponents queue. Unassigned
fallback extension 100 and $0 totals are left out. A queue failure does not
block the Monday schedule post. A retry or forced re-run of the same week does
not send the lines twice.
## v1.14.0 — July 2, 2026
**Point-and-click admin actions, right inside Slack.** Admins no longer have to
remember the exact word order of `/oncall admin …` commands for the two most
fiddly tasks:
- **Set an override or add a holiday from a form.** The bot's *Home* tab now has
an **Admin** section with two buttons — *Set override* and *Add holiday* — that
open a small form with a date picker, an employee dropdown, and clearly
labelled fields (the holiday pay multiplier is its own box instead of a
squeezed-in `x2`). Pick the values, submit, and the change lands exactly as the
typed command would — same phone-routing update for same-day changes, same
schedule-post refresh — with mistakes flagged on the field instead of a wall of
usage text. The typed `/oncall admin …` commands still work as before.
- **See what's coming up.** The Admin section also lists the upcoming overrides
and holidays so you can scan the next couple of months at a glance.
## v1.13.1 — June 29, 2026
**Fixed: the weekly pay summary email to payroll is sending again.** A
permissions change had quietly been blocking the Monday pay-summary email to
payroll since mid-June. The Slack pay report and the schedule post were never
affected — only the email to payroll. That's now fixed, the two missed weeks
were re-sent to payroll, and we've added an alert so a future email failure
can't slip by unnoticed.
## v1.13.0 — June 27, 2026
**The two-week schedule post now sticks to the bottom of the channel.** It used

25
Dockerfile
View file

@ -1,25 +0,0 @@
FROM python:3.12-slim@sha256:2f17fc044b579bab302c2e8054d3a686e2cb9a83de48e70534b94cd8ebbe06a9
WORKDIR /app
COPY src/shared/requirements.txt /tmp/shared-requirements.txt
COPY src/slack-bot/requirements.txt /tmp/slack-bot-requirements.txt
COPY src/weekly-post/requirements.txt /tmp/weekly-post-requirements.txt
COPY src/portal-api/requirements.txt /tmp/portal-api-requirements.txt
COPY requirements-api.txt /tmp/requirements-api.txt
RUN pip install --no-cache-dir \
-r /tmp/shared-requirements.txt \
-r /tmp/slack-bot-requirements.txt \
-r /tmp/weekly-post-requirements.txt \
-r /tmp/portal-api-requirements.txt \
-r /tmp/requirements-api.txt
COPY src /app/src
ARG GIT_SHA=dev
ENV PYTHONPATH=/app/src:/app/src/shared:/app/src/slack-bot \
GIT_SHA=${GIT_SHA} \
PYTHONUNBUFFERED=1
WORKDIR /app/src
EXPOSE 8080
CMD ["python", "-m", "server.entrypoint"]

200
README.md
View file

@ -1,7 +1,7 @@
# After-Hours Shift Manager
![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white)
![Terraform](https://img.shields.io/badge/Terraform-844FBA?logo=terraform&logoColor=white)
![AWS SAM](https://img.shields.io/badge/AWS-SAM-FF9900?logo=amazonaws&logoColor=white)
![Slack](https://img.shields.io/badge/Slack-integration-4A154B?logo=slack&logoColor=white)
![CI](https://github.com/Sea-Haven-Industries/afterhours-shift-manager/actions/workflows/ci.yaml/badge.svg)
@ -11,14 +11,10 @@ Slack bot for managing after-hours on-call shifts at Sea Haven Industries. Emplo
A recurring weekly schedule assigns employees to after-hours phone duty. Weekend shifts are split into Day (8am-5pm) and Night (5pm-8am). Any unassigned shift shows as **Available** in Slack with a pickup button. When someone picks up or drops a shift for today, the 3CX queue is updated immediately. Future changes take effect when the ring scheduler runs at 8am daily and 5pm on weekends.
The work week runs Sunday through Saturday, matching payroll. A Saturday night shift (5pm Saturday through 8am Sunday) stays in the Saturday week. Sunday day and Sunday night open the next week. The Monday 7am post shows the week that started the day before, plus the following week, and the pay summary covers the previous Sunday through Saturday.
The weekly schedule post is updated live when shifts change, and the previous week's post is automatically deleted when the new one goes out.
The bot also has an **About** page: open the bot in Slack and click its **Home** tab to see what it does, the full command list, and the latest "What's New" (see [Releases & Versioning](#releases--versioning)).
Employees can do the same pick, drop, swap, and admin work from the internal portal After Hours pages. Slack DMs for swaps and late pickups still go out. App Home admin modals stay as they are.
## Slack Commands
| Command | Description |
@ -30,7 +26,7 @@ Employees can do the same pick, drop, swap, and admin work from the internal por
| `/oncall swap <date> @person` | Request a swap — the other person gets an Accept/Decline DM and the shift only moves once they accept |
| `/oncall register <ext>` | Link your Slack account to your phone extension |
| `/oncall roster` | Show all employees and their link status |
| `/oncall pay` | Show last week's bonus pay summary (Sunday through Saturday) |
| `/oncall pay` | Show last week's bonus pay summary |
| `/oncall rate` | Show current shift pay rates |
| `/oncall rate default <amount>` | Set the default per-shift rate |
| `/oncall rate <ext> <amount>` | Set a per-person shift rate |
@ -60,44 +56,37 @@ Example: `/oncall admin holiday add 2026-07-04 2 x2 Independence Day` schedules
## Architecture
- **Runtime**: Python 3.12 on ECS Fargate (arm64) plus dual-run Lambdas until cutover. seahaven-prod `011934824531`, seahaven-dev `710827005802`
- **VPC**: This stack owns `10.70.0.0/16`. Meals and portal Fargate attach with HCP `existing_vpc_id` / `existing_public_subnet_ids` from outputs `vpc_id` and `public_subnet_ids`.
- **HTTP contract**: `openapi.yaml`, linted in CI with `npm run openapi:lint` (Redocly `extends: recommended`, same as internal-portal and meal-order-manager).
- **Runtime**: Python 3.12 on AWS Lambda (arm64)
- **Data**: DynamoDB single-table (`afterhours-shifts`)
- **IaC**: HCP Terraform workspaces tagged `app:afterhours-shift-manager` (`afterhours-shift-manager-dev` / `-prod`) plus GitHub Actions `deploy-api.yaml` (image). Terraform does not package `src/`.
- **Slack**: Slack Bolt on `POST /slack/events`
- **IaC**: AWS SAM (`template.yaml`) with shared Lambda Layer
- **Slack**: Slack Bolt framework with `/oncall` slash command
- **3CX Integration**: Queue routing updated directly via 3CX Queue XAPI
- **Secrets**: AWS Secrets Manager (`afterhours-shift-manager/*`)
### Leftover zip handlers (packaging only)
### Lambda Functions
Fargate is the live path. These `src/*/app.py` zip sources remain for `scripts/package_lambdas.py` only. Leftover Lambda IAM roles were removed after Paychex dropped AfterhoursWeeklyPostSend (PLAT-218).
| Handler | Former trigger | Purpose |
| Function | Trigger | Purpose |
|---|---|---|
| `afterhours-shift-manager` | API Gateway (POST /slack/events) | Slack bot — handles `/oncall` commands and interactive buttons |
| `afterhours-weekly-post` | EventBridge (Monday 7am ET) | Posts the Sunday-Saturday schedule and the previous week's pay summary |
| `afterhours-weekly-post` | EventBridge (Monday 7am ET) | Posts weekly schedule to Slack, sends pay report email |
| `afterhours-roster-sync` | EventBridge (daily 6am ET) | Syncs employee roster from 3CX |
| `afterhours-portal-api` | API Gateway (ANY /api/shifts, ANY /api/shifts/{proxy+}) | Cognito-authenticated employee/admin shift API for the internal portal |
| `afterhours-ring-scheduler` | EventBridge (daily 8am ET + weekend 5pm ET) | Updates 3CX queue routing based on who's on shift |
| `afterhours-holiday-router` | EventBridge Scheduler (per-holiday one-off: 8am activate / 5pm deactivate ET) | Repoints the IVR to the holiday queue and sets queue agents for a holiday day shift; reverts at 5pm (see [Holidays](#holidays)) |
| `afterhours-release-notifier` | Invoked by the Deploy workflow's release job on minor/major releases | Posts a "What's New" announcement to the shift channel |
### Project Layout
```
src/
server/ Flask + gunicorn + SQS worker (Fargate)
slack-bot/ Slack Bolt app; leftover zip source for packaging; ships CHANGELOG.md for App Home
weekly-post/ Monday 7am schedule post and prior Sunday-Saturday pay (leftover zip source)
roster-sync/ Daily 3CX roster sync (leftover zip source for packaging)
roster-api/ HTTP PUT/DELETE /roster for identity hire/offboard (leftover zip source for packaging)
portal-api/ Cognito employee/admin shift API for the internal portal (leftover zip source for packaging)
ring-scheduler/ 3CX queue routing updates (leftover zip source for packaging)
holiday-router/ 3CX IVR/queue repoint for holiday day shifts (leftover zip source for packaging)
shared/ Bundled into leftover function zips and the Fargate image
terraform/ HCP Terraform (ECS/ALB, API, DDB, IAM, leftover zip packaging locals, schedules)
scripts/ in-package changelog copy sync + cutover
tests/ pytest suite (mirrors src/, one dir per leftover zip handler + shared + server)
slack-bot/ Slack Bolt Lambda (handler + app); ships CHANGELOG.md for App Home
weekly-post/ Monday schedule + pay post
roster-sync/ Daily 3CX roster sync
ring-scheduler/ 3CX queue routing updates
holiday-router/ 3CX IVR/queue repoint for holiday day shifts (activate/deactivate)
release-notifier/ Posts release announcements to Slack
shared/ Lambda Layer (schedule, blocks, changelog, 3CX client, secrets)
scripts/ changelog CLI + CI guard + in-package copy sync
tests/ pytest suite (mirrors src/, one dir per Lambda + shared)
```
### DynamoDB Schema
@ -106,14 +95,14 @@ Single table with `PK` / `SK` keys:
| PK | SK | Description |
|---|---|---|
| `ROSTER` | `<extension>` | Employee: name, extension, slack_user_id, optional email |
| `ROSTER` | `<extension>` | Employee: name, extension, slack_user_id |
| `WEEKLY` | `<DayName>` | Default weekly schedule: extension, name |
| `OVERRIDE` | `<YYYY-MM-DD>` | Date override from pickup/drop (or `OPEN`) |
| `SWAP` | `<YYYY-MM-DD>` | Pending/verified swap request: requester, target, status, `expires_at` (TTL) |
| `HOLIDAY` | `<YYYY-MM-DD>` | Holiday day shift (one per date): `slots` (int), `assignees` (MAP keyed by extension — `{"114": {name, claimed_at}}`), `multiplier` (Decimal, defaults to `CONFIG.holiday_multiplier` = 1.5, overridable per holiday), `label`, `created_at`, `created_by`, `activated` (bool), `schedule_names` (list) |
| `PICKUP_REQUEST` | `<YYYY-MM-DD>[-DAY]#<ext>` | Pending late-pickup awaiting admin approval: `requester_ext`, `requester_name`, `requester_slack`, `shift_type`, `is_holiday`, `status`, `created_at`, `expires_at` (TTL = shift end) |
| `SCHEDULE_POST` | `<channel_id>` | Current schedule message timestamp |
| `PAY` | `<YYYY-MM-DD>` | Weekly pay record (Sunday date key; older rows may use Monday) |
| `PAY` | `<YYYY-MM-DD>` | Weekly pay record (Monday date key) |
| `CONFIG` | `CONFIG` | Settings: shift_rate, fallback_extension, admin_users, `ring_group`, `holiday_multiplier` (default holiday pay multiplier, 1.5), `holiday_queue` (3CX queue repointed during holidays, default 802), `ivr_number` (3CX IVR repointed during holidays, default 800), `captured_ivr_routes` (original IVR routes saved at holiday activation, restored at deactivation) |
Weekend day-shift rows use a `-DAY` suffix on the SK (e.g. `OVERRIDE` / `2026-04-05-DAY`). The table has TTL enabled on `expires_at` so abandoned pending swaps and pickup requests self-clean.
@ -142,7 +131,7 @@ Map updates on the record (see above) so the slot count can't be oversubscribed.
creates two **one-off EventBridge Scheduler** schedules for that date —
`holiday-activate-<YYYYMMDD>` at 08:00 ET and `holiday-deactivate-<YYYYMMDD>` at
17:00 ET — whose names are stored on the record's `schedule_names`. Scheduler
assumes `afterhours-shift-manager-holiday-scheduler` to invoke `afterhours-holiday-router`:
assumes `HolidaySchedulerExecutionRole` to invoke `afterhours-holiday-router`:
- **Activate (08:00):** capture both IVR `ivr_number` (800) routes — key-0 **and**
no-input/timeout — into `CONFIG.captured_ivr_routes` (skipped if they already
@ -188,71 +177,34 @@ A slot claimed after the shift has started always needs an admin to approve it.
| `afterhours-shift-manager/3cx-domain` | 3CX FQDN (e.g. `company.3cx.us`) |
| `afterhours-shift-manager/3cx-client-id` | 3CX OAuth2 client ID |
| `afterhours-shift-manager/3cx-client-secret` | 3CX OAuth2 client secret |
| `afterhours-shift-manager/roster-api-token` | Bearer token for PUT/DELETE `/roster`. Duplicate the same value into the seahaven-prod secret `paychex-integrations/afterhours-roster-token`. |
### Roster HTTP API
Identity hire/offboard in `paychex-integrations` calls this API. It is a separate Lambda on the same HTTP API as Slack (`POST /slack/events` is unchanged).
| Method | Path | Body | Success |
|---|---|---|---|
| PUT | `/roster` | `{"name","extension","slack_user_id"}` plus optional `"email"` | 200 `{"ok":true}` |
| DELETE | `/roster/{extension}` | none | 204 empty body, including when the row is already gone |
Header: `Authorization: Bearer {token}`. Missing or wrong token is 401. Invalid JSON or fields is 400. A secret-read failure is 503.
`email` is optional so existing Paychex syncs keep working. Portal identity looks up that email (case-insensitive) against the signed-in Google account. Without it, the portal shows an unlinked roster message. Admin access is still the Slack IDs in `admin_users` after the email lookup.
### Portal HTTP API
The internal portal SPA calls this API with the Cognito ID token from `GET /api/auth/meals-token`. CORS allows `https://internal.seahaven.com`, `https://internal.dev.seahaven.com`, and local Vite.
| Method | Path | Who |
|---|---|---|
| GET | `/api/shifts?week=this\|next` | Linked employee; unlinked Google accounts get `{linked:false}` |
| POST | `/api/shifts/pick` | Employee |
| POST | `/api/shifts/drop` | Employee |
| POST | `/api/shifts/swap` | Employee |
| POST | `/api/shifts/swaps/{date}/{shiftType}/accept\|decline` | Swap target |
| POST | `/api/shifts/admin/override` | Admin |
| POST | `/api/shifts/admin/open` | Admin |
| POST | `/api/shifts/admin/clear` | Admin |
| POST | `/api/shifts/admin/holidays` | Admin |
| DELETE | `/api/shifts/admin/holidays/{date}` | Admin |
| POST | `/api/shifts/admin/pickups/{date}/{shiftType}/{extension}/approve\|deny` | Admin |
Set portal `VITE_SHIFTS_API_BASE` to Terraform output `api_origin`. Set HCP variables `portal_cognito_issuer` and `portal_cognito_audience` (and `portal_cognito_extra_trust` if the portal has separate dev and prod pools).
Set processor `AFTERHOURS_BASE_URL` to the Terraform output `api_origin` (HCP variable `afterhours_base_url` on `paychex-integrations-prod`). That value is the API origin only. Do not append `/roster`. Flip it at cutover after DynamoDB is copied, not before.
Daily `afterhours-roster-sync` still owns the 3CX `DEFAULT` group at 6am ET: rows absent from that group are deleted. Hire is safe because 3CX create (into `DEFAULT`) happens before the roster PUT. An HTTP-only row that is not in that group will be removed on the next sync. Sync preserves `slack_user_id` on existing rows and does not overwrite a just-created API row's Slack id.
Token rotation is a maintenance-window action. The Lambda caches the token per execution environment. Update `afterhours-shift-manager/roster-api-token` and `paychex-integrations/afterhours-roster-token` together, then recycle `afterhours-roster-api`. Updating only one copy, or recycling environments out of order, causes 401s until both sides match.
## Documentation
The canonical map of Sea Haven's AWS infrastructure lives in Confluence. This project's `afterhours-shift-manager` stack is represented there as a Mermaid subgraph.
- **[AWS Architecture Map](https://seahaven.atlassian.net/wiki/spaces/IT/pages/1540098)** (Confluence, IT space, page 1540098)
## Deployment
Infrastructure is applied by HCP Terraform workspace `afterhours-shift-manager-prod` (VCS on `main`, working directory `terraform/`, file trigger `terraform/**` only). The Flask image is shipped by `.github/workflows/deploy-api.yaml`.
Merges to `main` are automatically deployed via **GitHub Actions** using reusable SAM workflows from the Sea Haven org.
For manual deploys:
```bash
sam build
sam deploy
```
## Monitoring & Alarms
All CloudWatch alarms are defined in `terraform/alarms.tf` and notify the shared
All CloudWatch alarms are defined in `template.yaml` and notify the shared
`site-alerts` SNS topic (→ AWS Chatbot → Slack). None set `OKActions` — recovery
is not paged. Alarm names follow `ALB-<Metric>-afterhours-shift-manager` and
`DDB-<Metric>-afterhours-shifts`.
is not paged. Alarm names follow the in-template convention `Lambda-<Metric>-<fn>`
(e.g. `Lambda-Errors-afterhours-ring-scheduler`).
**ALB alarms**:
**Lambda alarms** (all six functions: `afterhours-shift-manager`,
`afterhours-weekly-post`, `afterhours-roster-sync`, `afterhours-ring-scheduler`,
`afterhours-holiday-router`, `afterhours-release-notifier`):
| Alarm | Metric | Condition |
|---|---|---|
| `ALB-5xx-afterhours-shift-manager` | `HTTPCode_Target_5XX_Count` (Sum) | `> 0` over one 5-min period |
| `ALB-Latency-afterhours-shift-manager` | `TargetResponseTime` (p99, s) | `>= 3` s, 2 of 3 5-min periods |
| `ALB-UnhealthyHost-afterhours-shift-manager` | `UnHealthyHostCount` (Maximum) | `> 0`, 3 of 3 1-min periods |
| Alarm | Metric | Condition | Notes |
|---|---|---|---|
| `Lambda-Errors-<fn>` | `Errors` (Sum) | `>= 1` over one 5-min period | `TreatMissingData: notBreaching` |
| `Lambda-Duration-<fn>` | `Duration` (Maximum, ms) | `>= ~80% of timeout`, 2 of 3 5-min periods | Thresholds: 24000 ms (30s-timeout fns) / 48000 ms (60s-timeout fns) |
| `Lambda-Throttles-<fn>` | `Throttles` (Sum) | `>= 1` over one 5-min period | `TreatMissingData: notBreaching` |
**DynamoDB alarm** (`afterhours-shifts` table):
@ -267,24 +219,54 @@ transition normally. `ThrottledRequests` and `SystemErrors` are intentionally
**not** alarmed: AWS emits them only at `TableName`+`Operation` granularity, so a
`TableName`-only alarm would sit permanently in `INSUFFICIENT_DATA`.
**API Gateway alarms** were removed with the Fargate cutover (PLAT-216).
**API Gateway alarms** (implicit HTTP API `ServerlessHttpApi`, `AWS/ApiGateway`
v2 metrics, `ApiId` dimension):
| Alarm | Metric | Condition |
|---|---|---|
| `ApiGateway-4xx-<apiId>` | `4xx` (Sum) | `>= 5` over one 5-min period |
| `ApiGateway-5xx-<apiId>` | `5xx` (Sum) | `>= 1` over one 5-min period |
| `ApiGateway-Latency-<apiId>` | `Latency` (p99, ms) | `>= 3000` ms, 2 of 3 5-min periods |
> Duration and API latency thresholds are starting points and may be tuned after
> observing real traffic.
## Releases & Versioning
Prod is a human GitHub Release:
The bot is versioned with SemVer, driven entirely by **`CHANGELOG.md`** — it is
the single source of truth for both the version number and the human-readable
notes. There is no separate tagging tool.
```bash
gh release create vX.Y.Z --target main --generate-notes
```
**To cut a release**, in your feature PR add a new `## vX.Y.Z — Month D, YYYY`
section at the top of `CHANGELOG.md` (plain language, written for on-call staff),
bumping per SemVer, then run `python scripts/sync_changelog.py` to update the
in-package copy. The `Changelog Guard` PR check enforces that the bump is a clean
single SemVer step above the latest tag and that the two copies match.
That tag applies prod infra in HCP and queues `deploy-api.yaml` behind the prod
Environment. Merge to `main` deploys **dev**. Nothing in GitHub Actions creates
the Release.
On the **deploy-then-merge** path, once the merge's Deploy succeeds, the Deploy
workflow's `release` job (`needs: deploy`) tags the new version, publishes a
GitHub Release with the notes, and — for **minor and major** bumps only (patches
stay silent) — invokes `afterhours-release-notifier` to post a "What's New"
message in the shift channel. The **App Home** tab ("About" page on the bot)
always shows the current version's notes, read from the CHANGELOG that ships in
the slack-bot package.
**App Home "What's New"** still reads **`CHANGELOG.md`**. That file is product
copy, not the prod tag driver. After editing the root file, run
`python scripts/sync_changelog.py` so `src/slack-bot/CHANGELOG.md` stays in
sync. Pytest fails if the two copies drift.
> The release job lives inside the Deploy workflow (gated on `needs: deploy`)
> rather than a separate `workflow_run`-triggered workflow. A push-to-main run is
> a trusted context, so checking out and running repo code with write/OIDC is safe
> — whereas `workflow_run` is flagged by CodeQL for untrusted checkout. Gating on
> `needs: deploy` still guarantees we never announce a version that isn't live.
**One-time setup (per environment):** after the first deploy creates the
`ReleaseNotifyInvokeRole`, copy its ARN from the `ReleaseNotifyInvokeRoleArn` stack
output into the repo **variable** `RELEASE_NOTIFY_INVOKE_ROLE_ARN` (Settings →
Secrets and variables → Actions → Variables). Until it's set, releases still tag
and publish but skip the Slack announcement (with a warning).
> **Convention note (deliberate deviation).** The Sea Haven handbook says internal
> SAM stacks generally need no versioning and that tags are applied manually. This
> bot is versioned by owner choice (it has staff-facing release notes) and tagged
> automatically by the Deploy workflow's release job. This is intentional — not drift.
## Testing
@ -297,26 +279,12 @@ python -m venv .venv && source .venv/bin/activate
pip install -r tests/requirements.txt # test-only deps
pip install -r src/slack-bot/requirements.txt \
-r src/weekly-post/requirements.txt \
-r src/shared/requirements.txt \
-r src/portal-api/requirements.txt \
-r requirements-api.txt
-r src/shared/requirements.txt # runtime deps the imports need
pytest
```
Each Lambda has its own `app.py`, so the per-package `conftest.py` loads each one
under a unique module name (importlib mode) to avoid collisions. CI runs the same
suite on every PR via pytest plus `terraform fmt` / `init -backend=false` /
`validate` and `npm run openapi:lint`.
Local Fargate process (needs the same DynamoDB table and Secrets Manager names
the Lambdas use, plus `JOBS_QUEUE_URL` to consume jobs):
```bash
export PYTHONPATH=src:src/shared:src/slack-bot
export STAGE=local GIT_SHA=dev
python -m server.entrypoint
```
Health is `GET /api/health` on port 8080.
suite on every PR via the org `ci-python-sam` workflow (`run-tests: true`).
See [SETUP.md](SETUP.md) for full deployment and Slack app creation instructions.

129
SETUP.md
View file

@ -45,89 +45,32 @@ aws secretsmanager create-secret \
aws secretsmanager create-secret \
--name afterhours-shift-manager/3cx-client-secret \
--secret-string "YOUR-3CX-CLIENT-SECRET"
# Roster HTTP API bearer token (plain string). Duplicate the same value into
# seahaven-prod as paychex-integrations/afterhours-roster-token. Generate the
# token into a temp file, pass --secret-string file://..., then delete the file.
# Never paste the value into chat, Terraform, or a PR.
aws secretsmanager create-secret \
--name afterhours-shift-manager/roster-api-token \
--secret-string file://./roster-api-token.tmp
```
Create `afterhours-shift-manager/roster-api-token` **before** the first deploy that
includes `afterhours-roster-api`, or live PUT/DELETE calls return 503.
> The Slack **channel ID** is not a secret — it's passed as the `ShiftChannel`
> deploy parameter in step 3, not stored in Secrets Manager or SSM.
Rotation is coordinated: write the new value to both
`afterhours-shift-manager/roster-api-token` and
`paychex-integrations/afterhours-roster-token`, then recycle
`afterhours-roster-api` so cached execution environments pick it up. Updating
only one copy causes 401s. The identity processor `AFTERHOURS_BASE_URL` is the
Terraform output `api_origin` (origin only, no `/roster` suffix). Flip that HCP
variable on `paychex-integrations-prod` at cutover after DynamoDB is copied.
## 3. Deploy the Stack
Daily roster-sync still removes DynamoDB rows that are not in the 3CX `DEFAULT`
group. Hire stays safe because 3CX create lands the extension in that group
before the identity processor PUTs `/roster`.
```bash
# Build and deploy. ShiftChannel is the Slack channel ID for schedule posts
# (right-click the channel in Slack → Copy link → the ID is the last segment).
sam build
sam deploy --guided \
--stack-name afterhours-shift-manager \
--region us-east-1 \
--parameter-overrides ShiftChannel=C0XXXXXXX QueueNumber=801
> The Slack **channel ID** is not a secret. It is Terraform variable
> `shift_channel` (default `C0APATP612N`), not stored in Secrets Manager.
## 3. HCP Terraform and GitHub Environment
Workspaces tagged `app:afterhours-shift-manager`:
`afterhours-shift-manager-prod` in `seahaven-prod` (account `011934824531`) and
`afterhours-shift-manager-dev` in `seahaven-dev` (account `710827005802`).
Create the dev workspace before any Slack URL flip. HCP variable `environment`
is `prod` or `dev`.
First apply uses the hcptf-bootstrap window (exact `StringEquals` trust, never
`StringLike`). Creating `afterhours-shift-manager-ecs-task-boundary` is
`iam:CreatePolicy` and needs that window.
1. Create the HCP workspace. Auto-apply off. No project-level variable set.
Working directory `terraform`. File trigger prefix `terraform/**` only.
Speculative plans on. VCS on `main`.
2. From `seahaven-org-baseline`:
`scripts/create-hcptf-bootstrap-roles.sh --account prod --allow-workspace afterhours-shift-manager-prod`
3. Point workspace `TFC_AWS_APPLY_ROLE_ARN` / `TFC_AWS_PLAN_ROLE_ARN` at
`hcptf-bootstrap` / `hcptf-bootstrap-plan`. Set `TFC_AWS_PROVIDER_AUTH=true`.
4. One manual apply with `schedules_enabled=false`. This creates the scoped
`hcptf-*` roles, the Lambda boundary, and the rest of the stack. If 3CX
secrets already exist from seahaven-door-unlock-api, import those three
names instead of creating them:
`terraform import 'aws_secretsmanager_secret.this["afterhours-shift-manager/3cx-domain"]' afterhours-shift-manager/3cx-domain`
(and the client-id / client-secret names). Do not overwrite 3CX values.
5. Retarget `TFC_AWS_*` to `hcptf-afterhours-shift-manager` /
`hcptf-afterhours-shift-manager-plan`. Re-run the create script with no
`--allow-workspace`.
6. Second manual apply as the scoped role. Then seal auto-apply on.
GitHub Environment `prod`: reviewers, branch policy `main` and `v*`, Environment
variable `DEPLOY_ROLE_ARN` = Terraform output `github_deploy_role_arn`.
GitHub Environment `dev`: no reviewers, `DEPLOY_ROLE_ARN` from the seahaven-dev
apply of the same output. Set `checkcomponents_queue_url` and
`checkcomponents_queue_arn` empty on the dev workspace.
Function zips: Actions → Deploy on push to `main`, or `workflow_dispatch`.
Image CD: Actions → Deploy API (`deploy-api.yaml`). Keep `schedules_enabled=false`
and `ecs_schedules_enabled=false` until the Fargate cutover below.
HCP outputs to copy: `slack_request_url`, `api_origin`, `fargate_origin`,
`holiday_scheduler_role_arn`, `github_deploy_role_arn`, `jobs_queue_arn`,
`ecs_task_role_arn`. Paychex checkcomponents allows `afterhours-shift-manager-api`;
leftover weekly-post principal is gone.
# Note the SlackBotApiUrl output — you'll need it for step 4
```
## 4. Set the Slack Request URL
Reuse the existing Slack app. After the zip deploy, copy `slack_request_url`
from HCP outputs:
After deploy, copy the `SlackBotApiUrl` from the SAM output. Go back to your Slack app settings:
- **Slash Commands** → edit `/oncall` → set **Request URL** to that URL
- **Slash Commands** → edit `/oncall` → set **Request URL** to the output URL
- **Interactivity & Shortcuts** → set **Request URL** to the same URL
Do this in the cutover window, not before DynamoDB is copied.
## 5. Seed the Schedule
```bash
@ -151,48 +94,6 @@ To have the 3CX scheduler read overrides from DynamoDB (so Slack-driven changes
Without this step, the Slack bot still works — it invokes the 3CX scheduler Lambda directly for same-day changes. Future-date overrides would only take effect if the scheduler reads DynamoDB.
## 8. Prod cutover (PLAT-74)
Avoid Monday 06:00-08:00 ET and any holiday 08:00/17:00 ET window. Dry-run the
scripts first (`--execute` is required for writes).
1. Merge this repo's PR (SAM CD is gone). First HCP apply is the bootstrap
window above with `schedules_enabled=false`.
2. Copy DynamoDB `afterhours-shifts` mgmt → prod. Verify item counts:
`python scripts/cutover/copy_dynamodb.py --src-profile mgmt --dst-profile prod`
then `--execute`.
3. Confirm secrets in prod. `copy_secrets.py` writes Slack bot token, Slack
signing secret, and roster-api-token into empty Terraform shells and skips
dest names that already have a value. It never writes 3CX secrets:
`python scripts/cutover/copy_secrets.py --src-profile mgmt --dst-profile prod`
then `--execute`. Strip trailing newlines is built in.
4. GHA `workflow_dispatch` (or the merge deploy; re-run if it raced apply) to
overwrite stubs.
5. Recreate outstanding future `holiday-activate-*` / `holiday-deactivate-*`
in prod against the new router ARN and scheduler role:
`python scripts/cutover/recreate_holiday_schedules.py --src-profile mgmt --dst-profile prod`
6. Instant cut: Slack Request URL → prod `/slack/events`; Paychex HCP variable
`afterhours_base_url` on `paychex-integrations-prod` → prod `api_origin`;
`schedules_enabled=true` via a terraform-only merge; disable mgmt EventBridge.
Smoke: Slack `/oncall`, roster PUT/DELETE, weekly-post SendMessage (or
simulate-principal-policy plus one smoke message), ring-scheduler invoke,
holiday GetSchedule.
7. Seal auto-apply on. Delete the mgmt SAM stack. Remove the mgmt SQS principal
from `paychex-checkcomponents`. Update Confluence AWS Architecture Map and
check PLAT-71 item 4.
Do not dual-run 3CX writers. Do not flip `afterhours_base_url` before DynamoDB
is copied.
## 9. Fargate cutover (PLAT-216)
Completed 2026-09-21. Live path is ECS Fargate behind
`https://afterhours.seahaven.com` (dev: `https://afterhours.dev.seahaven.com`).
Slack Request URL, Paychex `AFTERHOURS_BASE_URL`, and portal `VITE_SHIFTS_API_BASE`
point at those hosts. Jobs use EventBridge Scheduler → SQS (`ecs_schedules_enabled=true`,
Lambda EventBridge `schedules_enabled=false`). Public DNS is out of band in the
mgmt `seahaven.com` zone and the external-dev `dev.seahaven.com` zone.
## Commands Reference
| Command | Description |

200
docs/admin-ui-evaluation.md
View file

@ -1,200 +0,0 @@
# Evaluation: admin web UI vs. clarifying/expanding in-Slack admin commands
_Spike for issue #136 — decide how to make administration easier: a separate
**admin web UI**, or **clarifying/expanding the in-Slack admin commands** (Block
Kit modals + an App Home admin section). This document records the options, a
recommendation, and the scope of the follow-up build. It is a "decide and
recommend" spike — no admin-surface code ships in this PR. The route is left for
sign-off (see "Decision needed" at the end)._
## Current admin surface
Every admin action is a positional-text subcommand of `/oncall admin …`,
authorized by `is_admin = user_id in schedule.get_admin_users()`
(`src/shared/shared/schedule.py`, `get_admin_users`) and handled in
`_handle_admin()` / `_handle_admin_holiday()` (`src/slack-bot/app.py`):
- `admin override <date> <ext> [day|night]` — assign a shift
- `admin open <date> [day|night]` — mark a shift open
- `admin clear <date> [day|night]` — remove an override (revert to weekly)
- `admin roster add|remove|rename <ext> [name]`
- `admin holiday add <date> <slots> [x<mult>] <label>` / `holiday remove <date>` /
`holiday list`
A same-day `override` / `open` / `clear` also repoints 3CX (`_update_3cx_routing`),
and `holiday add` provisions the 08:00/17:00 one-off schedules and may activate
inline — so these commands have real side effects, which makes a confirmation
preview valuable.
### Pain points (from the issue, confirmed in code)
- **Positional and error-prone.** Order-sensitive args — most acutely
`holiday add <date> <slots> [x<mult>] <label>`, which hand-parses an optional
`x<mult>` token out of the middle of the label (`_admin_holiday_add`). On any
mistake the only feedback is a usage string.
- **Discoverability.** The single source of documentation is the static admin
block in `build_help_blocks(is_admin=True)` (`src/shared/shared/blocks.py`).
No pickers, no validation hints, no previews.
- **No structured input.** No date picker, no roster dropdown, no
confirmation/preview before a change lands (and, same-day, repoints 3CX).
- **No overview.** No calendar/grid of upcoming overrides + holidays to scan.
### What already exists (lowers the cost of the Slack-native path)
- **App Home tab is live.** `home_tab_enabled: true` in
`slack-app-manifest.yaml`; `build_home_view()` renders it and
`app_home_opened` re-publishes it (`src/slack-bot/app.py`). It currently shows
only the non-admin help — there is a natural place to add an admin section.
- **Interactivity is wired.** `settings.interactivity.is_enabled: true`, and the
bot already registers `@app.action(...)` handlers (pickup/swap buttons). Adding
`@app.action(...)` for admin buttons and `@app.view(...)` for modal submits is
the same mechanism — **no new hosting, scope, or reinstall** is required for
modals (`views.open`/`view_submission` ride the existing interactivity URL).
- **All mutations already have typed methods** on the `Schedule` class
(`set_override`, `mark_open`, `remove_override`, `add_roster_entry`,
`remove_roster_entry`, `rename_roster_entry`, `create_holiday`,
`remove_holiday`). Modals and a web API would both call the same methods, so
the authorization and side-effect logic does not get duplicated.
## Options considered
### (a) Expand/clarify inside Slack — **recommended (phase 1)**
Add Block Kit **modals** (`views.open`) for the error-prone, high-value actions,
an **admin section in App Home**, and keep the text subcommands as a fallback.
- **Pros:** reuses existing interactivity + App Home; **no new infra, auth,
hosting, or OAuth scope**; native date pickers / dropdowns / numeric inputs
remove the positional-arg footguns; a confirmation preview before same-day
3CX repoints; one deploy target; the modal handlers call the same `Schedule`
methods the text commands do, so authorization stays in one place.
- **Cons:** still lives in Slack; modal layout is constrained (no true
calendar/grid — an upcoming list is the practical "overview"); a small amount
of new view-state plumbing.
### (b) Full admin web UI
A separate hosted app (following the internal-portal pattern: Google OAuth,
CDK-hosted, SHOC design system) talking to the schedule DynamoDB table through a
new API.
- **Pros:** full calendar/grid, bulk edits, the richest UX; not constrained by
Block Kit.
- **Cons:** significant effort and ongoing cost — a new auth path (Google OAuth),
hosting (CDK), an API surface in front of DynamoDB, a **second deploy target**,
and a security / cross-family review. It also **forks the authorization model**:
`get_admin_users()` holds Slack user IDs, so a Google-OAuth UI needs an
identity mapping (Google account → Slack admin) to keep one source of truth.
Likely overkill unless admin volume is high.
### (c) Status quo — keep text-only commands
- **Pros:** zero work.
- **Cons:** every pain point above persists; the `holiday add` arg order keeps
biting.
## Recommendation: phased — (a) now, (b) only if admin volume grows
Adopt **(a)** as phase 1 and treat **(b)** as a deferred phase 2 gated on real
demand. Rationale:
- **Admin actions are low-frequency and well-bounded.** Overrides, opens, clears,
roster edits, and a handful of holidays a year are individually quick. The cost
today is *correctness/discoverability per action* (getting the positional args
right), not throughput — which is exactly what modals fix, and which a web UI
fixes at far greater cost.
- **(a) reuses everything; (b) builds a new stack.** The Slack-native path needs
no new hosting, scope, auth, or review and lands a large UX win for the effort
of a few modals plus an App Home section. (b) is a new auth + hosting + API +
review surface for a marginal gain at current volume, and it splits the
authorization model.
- **(a) does not block (b).** If admin volume later justifies a calendar/grid or
bulk edits, the `Schedule` methods and `get_admin_users()` authorization are
already the clean seam a web API would sit on. Phase 1 is not throwaway.
Either way, **`get_admin_users()` stays the single authorization source of
truth**, and the **text commands stay as a fallback** so no current workflow
breaks.
## Scope of phase 1 (option a) — for the follow-up build
The phase-1 build is intentionally *not* in this PR. Scoped here so the
follow-up issue can be sized:
### Modals to build (`views.open` + `view_submission`)
Start with the two highest-pain actions, then optionally extend:
1. **Override modal** — replaces/supplements `admin override`.
- `datepicker` for the date, a roster **dropdown** (`static_select` built from
`Schedule.get_roster()` so the extension/name can't be mistyped), and a
day/night `radio_buttons`/`static_select`.
- A confirmation line in the submit response when the date is today (it will
repoint 3CX).
2. **Holiday-add modal** — replaces/supplements `admin holiday add` (the worst
positional offender).
- `datepicker` (date), `number_input`/plain-text **slots**, an explicit
**multiplier** input (its own field instead of a parsed `x<mult>` token),
and a **label** input.
- `view_submission` validates (date not in the past, slots ≥ 1) and surfaces
errors as Block Kit field `errors` instead of a usage string.
Optional follow-ons once the pattern is proven: **open**, **clear**, and
**roster add/remove/rename** modals. These are lower-pain (fewer args) so they
can stay text-only initially.
### Handlers / wiring
- A new `@app.action(...)` per admin button to call `client.views_open(...)` with
the modal view (built by new `build_*_modal()` helpers in
`src/shared/shared/blocks.py`, mirroring the existing `build_*` block builders).
- A new `@app.view(...)` per modal `callback_id` to read `view.state.values`,
**re-check `is_admin` against `get_admin_users()`** (modals can be opened from
Home — never trust the surface), call the same `Schedule` method the text
command uses, run the same 3CX/announce side effects, and `ack()` (with field
`errors` on validation failure).
- Reuse `_refresh_schedule_post(...)` after a successful mutation, exactly as the
text handlers do.
### App Home admin section
- In `build_home_view()`, when the viewer is an admin (look them up via
`get_admin_users()` before publishing), append an **Admin** section:
buttons that open the modals above, plus a compact **upcoming
overrides + holidays** list (the practical substitute for a calendar/grid).
- `publish_home(...)` already runs on `app_home_opened`; it needs the viewer's
user id (it has `event["user"]`) to decide whether to include the admin
section.
### Help / validation
- Keep `build_help_blocks(is_admin=True)` as the text fallback reference, and
point it at the new modals ("or open the Admin tab in Home").
### Manifest / scope impact
- **None.** Modals and App Home interactivity use the **already-enabled**
`interactivity` request URL and the existing `app_home` config. No new OAuth
scope and **no reinstall** are required (unlike the `pins:write` change in the
sibling #135 work).
## Scope of phase 2 (option b) — only if later justified
Recorded so the deferral is a decision, not an omission:
- **Auth:** Google OAuth following the internal-portal pattern, plus a Google →
Slack-admin identity mapping so `get_admin_users()` remains the source of
truth (do **not** introduce a parallel admin list).
- **Hosting:** CDK-hosted app on the SHOC design system, a second deploy target
alongside the SAM stack.
- **Data path:** a thin API in front of the schedule DynamoDB table that calls
the same `Schedule` methods (no direct table writes from the browser).
- **Reviews:** security / cross-family review for the new public surface and
auth path.
## Decision needed
Recommendation is **(a) now, (b) later if volume grows**. The build route — ship
phase 1 (Slack-native modals + App Home admin), commit to the full phased path,
or jump straight to a web UI — is left for sign-off on the issue/PR before any
admin-surface code is written.

12
docs/portal-module-spec.md
View file

@ -1,12 +0,0 @@
# Locked 2026-09-21 against Adam's answers.
Employee self-service plus admin After Hours in `internal-portal`. Slack stays.
Decisions:
- After Hours is a primary nav item (`/shifts`, `/shifts/admin`).
- Identity is roster `email` from Paychex `PUT /roster` (optional for backward compatibility; portal mapping needs it). Admin remains `get_admin_users()` Slack IDs after that lookup.
- Swap and late-pickup are in-portal pending actions and still DM on Slack.
- Slack App Home admin modals stay as-is.
Tickets: DEV-286 (epic), DEV-287 (API), DEV-288 (portal UI).

29
docs/sticky-schedule-post.md
View file

@ -80,16 +80,13 @@ is therefore not a substitute for bottom-stickiness.
### Weekly rollover — `src/weekly-post/app.py`
- **Delete + repost on Monday** — the previous week's stored post is
`chat_delete`d and a fresh schedule is `chat_postMessage`d so the message
lands at the bottom of the channel every Monday regardless of in-week
activity. The delete failure is non-fatal; the handler always reposts.
- **First-run:** when there is no stored post to delete, the handler
`chat_postMessage`s a fresh message and stores its `ts`.
- **Repost rollback:** if the new `ts` can't be persisted after the repost has
landed, the fresh message is `chat_delete`d before the error propagates, so an
async retry (which would read the stale, already-deleted `ts`) can't orphan a
duplicate schedule at the bottom of the channel.
- **Drop the unconditional `chat_delete` + always-repost.** On Monday,
`chat_update` the stored post to roll the two-week window forward, keeping the
same `ts` (the activity bump is what moves it to the bottom; the rollover just
refreshes content).
- **First-run / recovery fallback:** when there is no stored post or the
`chat_update` fails (e.g. the message was deleted manually), `chat_postMessage`
a fresh message and store its `ts`.
- The `pins:write` scope and the `_pin_schedule_post` helper are removed — the
pin is fully replaced by bottom-stickiness.
@ -126,18 +123,16 @@ request URL. On a `message.channels` event in the schedule channel
All three paths converge on the **single stored `ts`** and never fight:
- **Monday rollover** — `chat_delete`s the old stored `ts`, `chat_postMessage`s
a fresh post at the bottom, and saves the new `ts` (clearing `last_bump_ts` so
the next activity is free to bump).
- **In-week shift edits** — `_refresh_schedule_post` `chat_update`s the current
- **Monday rollover** — `chat_update` the stored `ts` (content refresh; same
message), clearing `last_bump_ts` so the next activity is free to bump.
- **In-week shift edits** — `_refresh_schedule_post` `chat_update`s the same
stored `ts`; it does not change the `ts` or touch `last_bump_ts`.
- **Activity bump** — deletes the stored `ts`, reposts the same content at the
bottom, and saves the new `ts`. Subsequent rollovers and edits then operate on
that new `ts`.
Both the rollover and the bump mint a new `ts` on repost and re-save it
immediately, so `_refresh_schedule_post` always reads the current `ts` from the
record.
Because only the bump ever mints a new `ts` (and it always re-saves it
immediately), the other two paths always read the current `ts` from the record.
## Scope / manifest impact

777
openapi.yaml
View file

@ -1,777 +0,0 @@
openapi: 3.1.0
info:
title: After Hours Shift Manager
version: 0.1.0
description: >
Flask HTTP API on ECS Fargate. Slack `/oncall` stays on POST /slack/events
and is not part of this contract. The internal portal SPA calls /api/shifts
with a Cognito ID token from GET /api/auth/meals-token. Paychex calls
PUT/DELETE /roster with a shared bearer token. Error shape for portal
routes is `{ error: { code, message } }`. Health matches the portal BFF
`{ stage, sha }`. Lint with the same Redocly `extends: recommended` config
as internal-portal and meal-order-manager.
contact:
name: Sea Haven Engineering
license:
name: Proprietary
identifier: LicenseRef-SeaHaven
servers:
- url: /
description: After Hours ALB origin (VITE_SHIFTS_API_BASE)
tags:
- name: Runtime
description: Unauthenticated health
- name: Roster
description: Paychex hire and offboard
- name: Shifts
description: Employee and admin After Hours for the portal SPA
security: []
paths:
/api/health:
get:
operationId: getHealth
tags: [Runtime]
summary: Runtime health
security: []
responses:
"200":
description: Process is up
content:
application/json:
schema:
$ref: "#/components/schemas/Health"
"403":
$ref: "#/components/responses/PortalError"
/roster:
put:
operationId: putRoster
tags: [Roster]
summary: Upsert a roster row
security:
- rosterBearer: []
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/RosterUpsert"
responses:
"200":
description: Row written
content:
application/json:
schema:
$ref: "#/components/schemas/RosterOk"
"400":
$ref: "#/components/responses/RosterError"
"401":
$ref: "#/components/responses/RosterError"
"503":
$ref: "#/components/responses/RosterError"
/roster/{extension}:
delete:
operationId: deleteRoster
tags: [Roster]
summary: Remove a roster row
security:
- rosterBearer: []
parameters:
- $ref: "#/components/parameters/Extension"
responses:
"204":
description: Gone, including when the row was already missing
"400":
$ref: "#/components/responses/RosterError"
"401":
$ref: "#/components/responses/RosterError"
"503":
$ref: "#/components/responses/RosterError"
/api/shifts:
get:
operationId: getShifts
tags: [Shifts]
summary: Week snapshot for the signed-in employee
security:
- portalCognito: []
parameters:
- name: week
in: query
schema:
type: string
enum: [this, next]
default: this
responses:
"200":
description: Linked snapshot or unlinked Google account
content:
application/json:
schema:
$ref: "#/components/schemas/ShiftsSnapshot"
"401":
$ref: "#/components/responses/PortalError"
"503":
$ref: "#/components/responses/PortalError"
/api/shifts/pick:
post:
operationId: pickShift
tags: [Shifts]
summary: Pick up a shift or request late pickup
security:
- portalCognito: []
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/ShiftDateBody"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"400":
$ref: "#/components/responses/PortalError"
"401":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
"409":
$ref: "#/components/responses/PortalError"
"503":
$ref: "#/components/responses/PortalError"
/api/shifts/drop:
post:
operationId: dropShift
tags: [Shifts]
summary: Drop a held shift
security:
- portalCognito: []
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/ShiftDateBody"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"400":
$ref: "#/components/responses/PortalError"
"401":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
"409":
$ref: "#/components/responses/PortalError"
/api/shifts/swap:
post:
operationId: requestSwap
tags: [Shifts]
summary: Request a swap
security:
- portalCognito: []
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/SwapBody"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"400":
$ref: "#/components/responses/PortalError"
"401":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
"409":
$ref: "#/components/responses/PortalError"
/api/shifts/swaps/{date}/{shiftType}/accept:
post:
operationId: acceptSwap
tags: [Shifts]
summary: Accept a pending swap
security:
- portalCognito: []
parameters:
- $ref: "#/components/parameters/ShiftDate"
- $ref: "#/components/parameters/ShiftType"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"401":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
"409":
$ref: "#/components/responses/PortalError"
/api/shifts/swaps/{date}/{shiftType}/decline:
post:
operationId: declineSwap
tags: [Shifts]
summary: Decline a pending swap
security:
- portalCognito: []
parameters:
- $ref: "#/components/parameters/ShiftDate"
- $ref: "#/components/parameters/ShiftType"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"401":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
/api/shifts/admin/override:
post:
operationId: adminOverride
tags: [Shifts]
summary: Assign a shift
security:
- portalCognito: []
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/AdminOverrideBody"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"400":
$ref: "#/components/responses/PortalError"
"401":
$ref: "#/components/responses/PortalError"
"403":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
/api/shifts/admin/open:
post:
operationId: adminOpen
tags: [Shifts]
summary: Mark a shift open
security:
- portalCognito: []
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/ShiftDateBody"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"400":
$ref: "#/components/responses/PortalError"
"401":
$ref: "#/components/responses/PortalError"
"403":
$ref: "#/components/responses/PortalError"
/api/shifts/admin/clear:
post:
operationId: adminClear
tags: [Shifts]
summary: Clear an override
security:
- portalCognito: []
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/ShiftDateBody"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"400":
$ref: "#/components/responses/PortalError"
"401":
$ref: "#/components/responses/PortalError"
"403":
$ref: "#/components/responses/PortalError"
/api/shifts/admin/holidays:
post:
operationId: adminHolidayAdd
tags: [Shifts]
summary: Schedule a holiday day shift
security:
- portalCognito: []
requestBody:
required: true
content:
application/json:
schema:
$ref: "#/components/schemas/HolidayBody"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"400":
$ref: "#/components/responses/PortalError"
"401":
$ref: "#/components/responses/PortalError"
"403":
$ref: "#/components/responses/PortalError"
"409":
$ref: "#/components/responses/PortalError"
/api/shifts/admin/holidays/{date}:
delete:
operationId: adminHolidayRemove
tags: [Shifts]
summary: Remove a holiday
security:
- portalCognito: []
parameters:
- $ref: "#/components/parameters/ShiftDate"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"401":
$ref: "#/components/responses/PortalError"
"403":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
/api/shifts/admin/pickups/{date}/{shiftType}/{extension}/approve:
post:
operationId: adminPickupApprove
tags: [Shifts]
summary: Approve a late pickup
security:
- portalCognito: []
parameters:
- $ref: "#/components/parameters/ShiftDate"
- $ref: "#/components/parameters/ShiftType"
- $ref: "#/components/parameters/Extension"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"401":
$ref: "#/components/responses/PortalError"
"403":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
"409":
$ref: "#/components/responses/PortalError"
/api/shifts/admin/pickups/{date}/{shiftType}/{extension}/deny:
post:
operationId: adminPickupDeny
tags: [Shifts]
summary: Deny a late pickup
security:
- portalCognito: []
parameters:
- $ref: "#/components/parameters/ShiftDate"
- $ref: "#/components/parameters/ShiftType"
- $ref: "#/components/parameters/Extension"
responses:
"200":
$ref: "#/components/responses/MutationOk"
"401":
$ref: "#/components/responses/PortalError"
"403":
$ref: "#/components/responses/PortalError"
"404":
$ref: "#/components/responses/PortalError"
components:
securitySchemes:
portalCognito:
type: http
scheme: bearer
bearerFormat: JWT
description: Portal Cognito ID token
rosterBearer:
type: http
scheme: bearer
description: Shared Paychex roster token
parameters:
ShiftDate:
name: date
in: path
required: true
schema:
type: string
format: date
ShiftType:
name: shiftType
in: path
required: true
schema:
type: string
enum: [day, night]
Extension:
name: extension
in: path
required: true
schema:
type: string
minLength: 1
responses:
MutationOk:
description: Mutation applied
content:
application/json:
schema:
$ref: "#/components/schemas/MutationResult"
PortalError:
description: Portal JSON error
content:
application/json:
schema:
$ref: "#/components/schemas/PortalErrorEnvelope"
RosterError:
description: Roster string error
content:
application/json:
schema:
$ref: "#/components/schemas/RosterErrorBody"
schemas:
Health:
type: object
additionalProperties: false
required: [stage, sha]
properties:
stage:
type: string
minLength: 1
description: Workspace stage (`dev`, `prod`, or `local`)
sha:
type: string
minLength: 1
description: Git SHA or `unknown` locally
PortalErrorEnvelope:
type: object
additionalProperties: false
required: [error]
properties:
error:
type: object
additionalProperties: false
required: [code, message]
properties:
code:
type: string
minLength: 1
message:
type: string
minLength: 1
RosterErrorBody:
type: object
additionalProperties: false
required: [error]
properties:
error:
type: string
minLength: 1
RosterUpsert:
type: object
additionalProperties: false
required: [name, extension, slack_user_id]
properties:
name:
type: string
minLength: 1
extension:
type: string
minLength: 1
slack_user_id:
type: string
minLength: 1
email:
type: string
format: email
RosterOk:
type: object
additionalProperties: false
required: [ok]
properties:
ok:
type: boolean
const: true
ShiftDateBody:
type: object
additionalProperties: false
required: [date]
properties:
date:
type: string
format: date
shiftType:
type: string
enum: [day, night, holiday]
SwapBody:
type: object
additionalProperties: false
required: [date, targetExtension]
properties:
date:
type: string
format: date
shiftType:
type: string
enum: [day, night]
targetExtension:
type: string
minLength: 1
note:
type: string
description: Optional. Stored after trim, and the trimmed value must be 500 characters or fewer.
AdminOverrideBody:
type: object
additionalProperties: false
required: [date, extension]
properties:
date:
type: string
format: date
extension:
type: string
minLength: 1
shiftType:
type: string
enum: [day, night]
HolidayBody:
type: object
additionalProperties: false
required: [date, slots, label]
properties:
date:
type: string
format: date
slots:
type: integer
minimum: 1
label:
type: string
minLength: 1
multiplier:
type: [number, string, "null"]
MutationResult:
type: object
additionalProperties: false
required: [ok]
properties:
ok:
type: boolean
message:
type: string
latePickup:
type: boolean
repointed:
type: boolean
RosterPerson:
type: object
additionalProperties: false
required: [extension, name, email]
properties:
extension:
type: string
name:
type: string
email:
type: string
slackUserId:
type: string
ShiftAssignee:
type: object
additionalProperties: false
required: [extension, name]
properties:
extension:
type: string
name:
type: string
ShiftSlot:
type: object
additionalProperties: false
required:
- kind
- shiftType
- label
- slots
- openSlots
- multiplier
- assignees
- mine
- canPick
- canDrop
- latePickup
properties:
kind:
type: string
enum: [holiday, override, available, weekly]
shiftType:
type: string
enum: [day, night]
label:
type: string
slots:
type: integer
openSlots:
type: integer
multiplier:
type: number
assignees:
type: array
items:
$ref: "#/components/schemas/ShiftAssignee"
mine:
type: boolean
canPick:
type: boolean
canDrop:
type: boolean
latePickup:
type: boolean
ShiftDay:
type: object
additionalProperties: false
required: [date, dayName, slots]
properties:
date:
type: string
format: date
dayName:
type: string
slots:
type: array
items:
$ref: "#/components/schemas/ShiftSlot"
PendingSwap:
type: object
additionalProperties: false
required:
- date
- shiftType
- requesterExt
- requesterName
- targetExt
- targetName
- incoming
properties:
date:
type: string
shiftType:
type: string
enum: [day, night]
requesterExt:
type: string
requesterName:
type: string
targetExt:
type: string
targetName:
type: string
incoming:
type: boolean
note:
type: string
maxLength: 500
PendingPickup:
type: object
additionalProperties: false
required: [date, shiftType, requesterExt, requesterName, isHoliday]
properties:
date:
type: string
shiftType:
type: string
enum: [day, night]
requesterExt:
type: string
requesterName:
type: string
isHoliday:
type: boolean
HolidaySummary:
type: object
additionalProperties: false
required: [date, label, slots, multiplier]
properties:
date:
type: string
label:
type: string
slots:
type: integer
multiplier:
type: number
ShiftsSnapshot:
type: object
additionalProperties: false
required: [linked, isAdmin]
properties:
linked:
type: boolean
email:
type: string
week:
type: string
enum: [this, next]
weekStart:
type: string
format: date
me:
$ref: "#/components/schemas/RosterPerson"
isAdmin:
type: boolean
days:
type: array
items:
$ref: "#/components/schemas/ShiftDay"
pendingSwaps:
type: array
items:
$ref: "#/components/schemas/PendingSwap"
pendingPickups:
type: array
items:
$ref: "#/components/schemas/PendingPickup"
upcomingHolidays:
type: array
items:
$ref: "#/components/schemas/HolidaySummary"
roster:
type: array
items:
$ref: "#/components/schemas/RosterPerson"

30
package-lock.json generated
View file

@ -1,30 +0,0 @@
{
"name": "afterhours-shift-manager",
"version": "1.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "afterhours-shift-manager",
"version": "1.0.0",
"devDependencies": {
"@redocly/cli": "2.54.2"
}
},
"node_modules/@redocly/cli": {
"version": "2.54.2",
"resolved": "https://registry.npmjs.org/@redocly/cli/-/cli-2.54.2.tgz",
"integrity": "sha512-YQ53kSQV/zpYSdY3WiQvf7JxuVLD8jTEX37YOY6MS+G3tyHDCeONpUkAt6qr9n2/nmGm6m+A+PB/mGFvhkt1uQ==",
"dev": true,
"license": "MIT",
"bin": {
"openapi": "bin/cli.js",
"redocly": "bin/cli.js"
},
"engines": {
"node": ">=22.12.0 || >=20.19.0 <21.0.0",
"npm": ">=10"
}
}
}
}

11
package.json
View file

@ -1,11 +0,0 @@
{
"name": "afterhours-shift-manager",
"version": "1.0.0",
"private": true,
"scripts": {
"openapi:lint": "redocly lint --config .redocly.yaml openapi.yaml"
},
"devDependencies": {
"@redocly/cli": "2.54.2"
}
}

2
pyproject.toml
View file

@ -2,6 +2,6 @@
# `src/shared` on the path makes the `shared` layer package importable as it is at
# runtime. Each Lambda's own `app.py` is loaded under a unique name by the
# per-package conftest (importlib mode) to avoid the four-`app.py` collision.
pythonpath = ["src", "src/shared"]
pythonpath = ["src/shared"]
testpaths = ["tests"]
addopts = "--import-mode=importlib"

2
requirements-api.txt
View file

@ -1,2 +0,0 @@
flask==3.1.3
gunicorn==26.2.0

9
samconfig.toml.example Normal file
View file

@ -0,0 +1,9 @@
version = 0.1
[default.deploy.parameters]
stack_name = "afterhours-shift-manager"
resolve_s3 = true
s3_prefix = "afterhours-shift-manager"
region = "us-east-1"
capabilities = "CAPABILITY_IAM"
confirm_changeset = true

52
scripts/changelog_cli.py Normal file
View file

@ -0,0 +1,52 @@
#!/usr/bin/env python3
"""Thin CLI over ``shared.changelog`` for the release workflow.
Keeps all changelog parsing in one tested module instead of inline shell/Python
in the workflow. Reads the changelog file given as an argument.
Usage:
changelog_cli.py top-version <file> # newest entry's version
changelog_cli.py bump-kind <file> <prev> # major|minor|patch|none vs <prev>
changelog_cli.py payload <file> <version> # JSON {version, notes, date_label}
"""
import json
import pathlib
import sys
sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1] / "src" / "shared"))
from shared.changelog import bump_kind, entry_for, top_version # noqa: E402
def main(argv: list[str]) -> int:
if len(argv) < 3:
sys.exit(__doc__)
cmd, path = argv[1], argv[2]
text = pathlib.Path(path).read_text()
if cmd == "top-version":
sys.stdout.write(top_version(text) or "")
elif cmd == "bump-kind":
prev = argv[3].lstrip("v")
top = top_version(text)
sys.stdout.write((bump_kind(top, prev) or "none") if top else "none")
elif cmd == "payload":
version = argv[3].lstrip("v")
entry = entry_for(text, version)
sys.stdout.write(
json.dumps(
{
"version": version,
"notes": entry.body if entry else "",
"date_label": entry.date_label if entry else "",
}
)
)
else:
sys.exit(f"unknown command: {cmd}")
return 0
if __name__ == "__main__":
raise SystemExit(main(sys.argv))

72
scripts/check_changelog.py Normal file
View file

@ -0,0 +1,72 @@
#!/usr/bin/env python3
"""CI guard: validate CHANGELOG.md versioning and the in-package copy.
Run on pull requests. Two checks:
1. If CHANGELOG.md changed in the PR, its top version must be a clean
single-step SemVer bump above the latest ``v*`` tag. (Non-changing PRs —
dependabot bumps, docs — are not version-checked, so they don't release.)
2. ``src/slack-bot/CHANGELOG.md`` (the copy that ships with the bot and feeds the
App Home "What's New" tab) must match the canonical root CHANGELOG.md.
The workflow passes context via env: ``PREV_TAG`` (latest tag) and
``CHANGELOG_CHANGED`` ("true"/"false"). Run locally it assumes the changelog
changed so the bump is validated.
"""
import os
import pathlib
import sys
sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1] / "src" / "shared"))
from shared.changelog import bump_kind, top_version # noqa: E402
ROOT = pathlib.Path(__file__).resolve().parents[1]
PKG_COPY = ROOT / "src" / "slack-bot" / "CHANGELOG.md"
def evaluate(
top: str | None, prev_tag: str, changelog_changed: bool, copies_match: bool
) -> list[str]:
"""Return a list of problems (empty == pass). Pure, for unit testing."""
problems = []
if not copies_match:
problems.append(
"src/slack-bot/CHANGELOG.md is out of sync with CHANGELOG.md — "
"run scripts/sync_changelog.py"
)
if changelog_changed:
if top is None:
problems.append("CHANGELOG.md changed but has no version entry at the top")
else:
prev = (prev_tag or "v0.0.0").lstrip("v")
if bump_kind(top, prev) is None:
problems.append(
f"top version v{top} is not a clean single-step SemVer bump "
f"above the latest tag v{prev} (expected one of "
f"inc-major / inc-minor / inc-patch)"
)
return problems
def main() -> int:
root_text = (ROOT / "CHANGELOG.md").read_text()
copies_match = PKG_COPY.exists() and PKG_COPY.read_text() == root_text
problems = evaluate(
top=top_version(root_text),
prev_tag=os.environ.get("PREV_TAG", ""),
changelog_changed=os.environ.get("CHANGELOG_CHANGED", "true") == "true",
copies_match=copies_match,
)
if problems:
for problem in problems:
print(f"::error::{problem}")
return 1
print("CHANGELOG guard passed.")
return 0
if __name__ == "__main__":
raise SystemExit(main())

101
scripts/cutover/copy_dynamodb.py
View file

@ -1,101 +0,0 @@
#!/usr/bin/env python3
"""Copy afterhours-shifts from mgmt to prod. Dry-run unless --execute."""
from __future__ import annotations
import argparse
import sys
import time
import boto3
TABLE = "afterhours-shifts"
SRC_ACCOUNT = "328440206208"
DST_ACCOUNT = "011934824531"
def _client(profile: str, region: str):
session = boto3.Session(profile_name=profile, region_name=region)
return session.client("dynamodb")
def _scan_all(client, *, consistent: bool = False):
items = []
kwargs = {"TableName": TABLE, "ConsistentRead": consistent}
while True:
resp = client.scan(**kwargs)
items.extend(resp.get("Items", []))
start = resp.get("LastEvaluatedKey")
if not start:
return items
kwargs["ExclusiveStartKey"] = start
def _batch_write_all(client, items, *, sleep=time.sleep, max_attempts: int = 8) -> int:
"""Put every item. Retry UnprocessedItems with backoff. Raise if they remain."""
pending = [{"PutRequest": {"Item": item}} for item in items]
written = 0
while pending:
chunk, pending = pending[:25], pending[25:]
to_send = chunk
attempts = 0
while to_send:
attempts += 1
if attempts > max_attempts:
raise RuntimeError(
f"batch_write_item left {len(to_send)} unprocessed after {max_attempts} attempts"
)
resp = client.batch_write_item(RequestItems={TABLE: to_send})
unprocessed = resp.get("UnprocessedItems", {}).get(TABLE, [])
written += len(to_send) - len(unprocessed)
to_send = unprocessed
if to_send:
sleep(min(0.1 * (2 ** (attempts - 1)), 5.0))
return written
def main() -> int:
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("--src-profile", required=True)
parser.add_argument("--dst-profile", required=True)
parser.add_argument("--region", default="us-east-1")
parser.add_argument("--execute", action="store_true")
args = parser.parse_args()
src = _client(args.src_profile, args.region)
dst = _client(args.dst_profile, args.region)
src_id = (
boto3.Session(profile_name=args.src_profile)
.client("sts")
.get_caller_identity()["Account"]
)
dst_id = (
boto3.Session(profile_name=args.dst_profile)
.client("sts")
.get_caller_identity()["Account"]
)
if src_id != SRC_ACCOUNT:
print(f"src account {src_id} is not mgmt {SRC_ACCOUNT}", file=sys.stderr)
return 2
if dst_id != DST_ACCOUNT:
print(f"dst account {dst_id} is not prod {DST_ACCOUNT}", file=sys.stderr)
return 2
items = _scan_all(src, consistent=True)
dst_count = dst.describe_table(TableName=TABLE)["Table"]["ItemCount"]
print(f"src items={len(items)} dst describe ItemCount={dst_count}")
if not args.execute:
print("dry-run; pass --execute to BatchWriteItem")
return 0
written = _batch_write_all(dst, items)
after = _scan_all(dst, consistent=True)
print(f"wrote={written} dst_scan={len(after)}")
if len(after) != len(items):
print("item counts differ after copy", file=sys.stderr)
return 1
return 0
if __name__ == "__main__":
raise SystemExit(main())

141
scripts/cutover/copy_secrets.py
View file

@ -1,141 +0,0 @@
#!/usr/bin/env python3
"""Copy afterhours secrets mgmt → prod. Dry-run unless --execute.
Terraform creates empty secret shells. Slack, signing, and roster tokens are
written into those shells when the dest has no current string value. Populated
dest values are left alone. 3CX secrets are verified only and never written.
Strips trailing newlines. Never prints secret values.
"""
from __future__ import annotations
import argparse
import sys
import boto3
from botocore.exceptions import ClientError
SRC_ACCOUNT = "328440206208"
DST_ACCOUNT = "011934824531"
COPY = [
"afterhours-shift-manager/slack-bot-token",
"afterhours-shift-manager/slack-signing-secret",
"afterhours-shift-manager/roster-api-token",
]
VERIFY_ONLY = [
"afterhours-shift-manager/3cx-domain",
"afterhours-shift-manager/3cx-client-id",
"afterhours-shift-manager/3cx-client-secret",
]
# Describe succeeds on a Terraform shell; GetSecretValue fails until a version exists.
_NO_VALUE_CODES = frozenset({"ResourceNotFoundException", "InvalidRequestException"})
def _client(profile: str, region: str):
return boto3.Session(profile_name=profile, region_name=region).client(
"secretsmanager"
)
def _account(profile: str) -> str:
return (
boto3.Session(profile_name=profile)
.client("sts")
.get_caller_identity()["Account"]
)
def secret_string(client, name: str) -> str | None:
"""Return the current SecretString, or None if the secret does not exist.
An empty string means the secret exists (Terraform shell) but has no usable
current version.
"""
try:
client.describe_secret(SecretId=name)
except ClientError as exc:
if exc.response["Error"]["Code"] == "ResourceNotFoundException":
return None
raise
try:
payload = client.get_secret_value(SecretId=name)
except ClientError as exc:
if exc.response["Error"]["Code"] in _NO_VALUE_CODES:
return ""
raise
value = payload.get("SecretString")
if value is None:
return ""
return value
def copy_secrets(src, dst, *, execute: bool) -> int:
rc = 0
for name in VERIFY_ONLY:
value = secret_string(dst, name)
if value is None:
print(
f"missing prod secret {name} (expected from PLAT-76)", file=sys.stderr
)
rc = 1
elif not value.strip():
print(
f"empty prod 3cx secret {name} (do not overwrite from mgmt)",
file=sys.stderr,
)
rc = 1
else:
print(f"keep existing prod secret {name}")
for name in COPY:
src_value = secret_string(src, name)
if src_value is None or not src_value.strip():
print(f"missing mgmt secret {name}", file=sys.stderr)
rc = 1
continue
dest_value = secret_string(dst, name)
if dest_value is None:
print(f"missing prod secret shell {name}", file=sys.stderr)
rc = 1
continue
if dest_value.strip():
print(f"skip populated prod secret {name}")
continue
print(f"would copy {name}")
if not execute:
continue
value = src_value.rstrip("\n")
dst.put_secret_value(SecretId=name, SecretString=value)
print(f"wrote {name} ({len(value)} chars)")
if not execute:
print("dry-run; pass --execute to PutSecretValue")
return rc
def main() -> int:
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("--src-profile", required=True)
parser.add_argument("--dst-profile", required=True)
parser.add_argument("--region", default="us-east-1")
parser.add_argument("--execute", action="store_true")
args = parser.parse_args()
if _account(args.src_profile) != SRC_ACCOUNT:
print("src profile is not mgmt", file=sys.stderr)
return 2
if _account(args.dst_profile) != DST_ACCOUNT:
print("dst profile is not prod", file=sys.stderr)
return 2
src = _client(args.src_profile, args.region)
dst = _client(args.dst_profile, args.region)
return copy_secrets(src, dst, execute=args.execute)
if __name__ == "__main__":
raise SystemExit(main())

149
scripts/cutover/recreate_holiday_schedules.py
View file

@ -1,149 +0,0 @@
#!/usr/bin/env python3
"""Recreate future holiday-* EventBridge Scheduler schedules in prod.
Reads outstanding holiday-activate-* / holiday-deactivate-* from mgmt and
creates the same names in prod targeting the prod router ARN and scheduler
role. Dry-run unless --execute.
"""
from __future__ import annotations
import argparse
import re
import sys
from datetime import datetime, timezone
from zoneinfo import ZoneInfo
import boto3
from botocore.exceptions import ClientError
SRC_ACCOUNT = "328440206208"
DST_ACCOUNT = "011934824531"
PROD_ROUTER_ARN = (
"arn:aws:lambda:us-east-1:011934824531:function:afterhours-holiday-router"
)
PROD_ROLE_ARN = "arn:aws:iam::011934824531:role/tf-managed/afterhours-shift-manager-holiday-scheduler"
PREFIXES = ("holiday-activate-", "holiday-deactivate-")
_AT = re.compile(r"^at\((\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})\)$")
def _client(profile: str, region: str):
return boto3.Session(profile_name=profile, region_name=region).client("scheduler")
def _account(profile: str) -> str:
return (
boto3.Session(profile_name=profile)
.client("sts")
.get_caller_identity()["Account"]
)
def schedule_when(detail: dict) -> datetime | None:
"""UTC instant the one-off schedule fires, or None if it cannot be parsed."""
expr = (detail.get("ScheduleExpression") or "").strip()
tzname = detail.get("ScheduleExpressionTimezone") or "America/New_York"
match = _AT.match(expr)
if match:
naive = datetime.strptime(match.group(1), "%Y-%m-%dT%H:%M:%S")
return naive.replace(tzinfo=ZoneInfo(tzname)).astimezone(timezone.utc)
at = detail.get("EndDate") or detail.get("StartDate")
if at is None:
return None
if at.tzinfo is None:
return at.replace(tzinfo=timezone.utc)
return at.astimezone(timezone.utc)
def _list_holiday(client):
names = []
token = None
while True:
kwargs = {"GroupName": "default"}
if token:
kwargs["NextToken"] = token
resp = client.list_schedules(**kwargs)
for item in resp.get("Schedules", []):
name = item.get("Name", "")
if name.startswith(PREFIXES):
names.append(name)
token = resp.get("NextToken")
if not token:
return names
def main() -> int:
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("--src-profile", required=True)
parser.add_argument("--dst-profile", required=True)
parser.add_argument("--region", default="us-east-1")
parser.add_argument("--execute", action="store_true")
args = parser.parse_args()
if _account(args.src_profile) != SRC_ACCOUNT:
print("src profile is not mgmt", file=sys.stderr)
return 2
if _account(args.dst_profile) != DST_ACCOUNT:
print("dst profile is not prod", file=sys.stderr)
return 2
src = _client(args.src_profile, args.region)
dst = _client(args.dst_profile, args.region)
now = datetime.now(timezone.utc)
created = 0
skipped = 0
failed = 0
for name in _list_holiday(src):
detail = src.get_schedule(Name=name, GroupName="default")
expr = detail.get("ScheduleExpression", "")
tzname = detail.get("ScheduleExpressionTimezone", "America/New_York")
when = schedule_when(detail)
if when is not None and when < now:
print(f"skip past {name} expr={expr}")
skipped += 1
continue
payload = {
"Name": name,
"GroupName": "default",
"ScheduleExpression": expr,
"ScheduleExpressionTimezone": tzname,
"FlexibleTimeWindow": {"Mode": "OFF"},
"Target": {
"Arn": PROD_ROUTER_ARN,
"RoleArn": PROD_ROLE_ARN,
"Input": detail.get("Target", {}).get("Input", ""),
},
"ActionAfterCompletion": detail.get("ActionAfterCompletion", "DELETE"),
}
if detail.get("EndDate"):
payload["EndDate"] = detail["EndDate"]
print(f"would create {name} expr={expr} tz={tzname}")
if not args.execute:
continue
try:
dst.create_schedule(**payload)
created += 1
except ClientError as exc:
code = exc.response["Error"]["Code"]
if code == "ConflictException":
print(f"exists {name}")
elif code == "ValidationException":
print(
f"skip invalid {name}: {exc.response['Error'].get('Message', code)}"
)
skipped += 1
else:
print(f"failed {name}: {code}", file=sys.stderr)
failed += 1
print(
f"created={created} skipped_past={skipped} failed={failed} execute={args.execute}"
)
if not args.execute:
print("dry-run; pass --execute to CreateSchedule")
return 1 if failed else 0
if __name__ == "__main__":
raise SystemExit(main())

181
scripts/cutover/retarget_holiday_schedules_to_sqs.py
View file

@ -1,181 +0,0 @@
#!/usr/bin/env python3
"""Retarget outstanding holiday-* Scheduler one-offs from Lambda to jobs SQS.
Lists holiday-activate-* / holiday-deactivate-* in the destination account and
updates Target to the jobs queue with Input
``{"event":"holiday","action":"activate|deactivate","date":"YYYY-MM-DD"}``.
Dry-run unless --execute. Does not create schedules that are already past.
"""
from __future__ import annotations
import argparse
import json
import re
import sys
from datetime import datetime, timezone
from zoneinfo import ZoneInfo
import boto3
from botocore.exceptions import ClientError
PROD_ACCOUNT = "011934824531"
DEV_ACCOUNT = "710827005802"
HOLIDAY_SCHEDULER_ROLE = "afterhours-shift-manager-holiday-scheduler"
PREFIXES = ("holiday-activate-", "holiday-deactivate-")
_AT = re.compile(r"^at\((\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})\)$")
_DATE = re.compile(r"(\d{4}-\d{2}-\d{2})")
def _client(profile: str, region: str):
return boto3.Session(profile_name=profile, region_name=region).client("scheduler")
def _account(profile: str) -> str:
return (
boto3.Session(profile_name=profile)
.client("sts")
.get_caller_identity()["Account"]
)
def schedule_when(detail: dict) -> datetime | None:
expr = (detail.get("ScheduleExpression") or "").strip()
tzname = detail.get("ScheduleExpressionTimezone") or "America/New_York"
match = _AT.match(expr)
if match:
naive = datetime.strptime(match.group(1), "%Y-%m-%dT%H:%M:%S")
return naive.replace(tzinfo=ZoneInfo(tzname)).astimezone(timezone.utc)
at = detail.get("EndDate") or detail.get("StartDate")
if at is None:
return None
if at.tzinfo is None:
return at.replace(tzinfo=timezone.utc)
return at.astimezone(timezone.utc)
def action_and_date(name: str, existing_input: str) -> tuple[str, str]:
action = "deactivate" if name.startswith("holiday-deactivate-") else "activate"
date = ""
if existing_input:
try:
parsed = json.loads(existing_input)
except json.JSONDecodeError:
parsed = {}
if isinstance(parsed, dict):
date = str(parsed.get("date") or "")
if parsed.get("action") in {"activate", "deactivate"}:
action = parsed["action"]
if not date:
compact = name.split("-")[-1]
if len(compact) == 8 and compact.isdigit():
date = f"{compact[0:4]}-{compact[4:6]}-{compact[6:8]}"
if not date:
match = _DATE.search(existing_input or "")
if match:
date = match.group(1)
if not date:
raise ValueError(f"cannot derive date from {name}")
return action, date
def holiday_scheduler_role_arn(account: str) -> str:
return f"arn:aws:iam::{account}:role/tf-managed/{HOLIDAY_SCHEDULER_ROLE}"
def holiday_sqs_input(action: str, date: str) -> str:
return json.dumps({"event": "holiday", "action": action, "date": date})
def _list_holiday(client):
names = []
token = None
while True:
kwargs = {"GroupName": "default"}
if token:
kwargs["NextToken"] = token
resp = client.list_schedules(**kwargs)
for item in resp.get("Schedules", []):
name = item.get("Name", "")
if name.startswith(PREFIXES):
names.append(name)
token = resp.get("NextToken")
if not token:
return names
def main() -> int:
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("--profile", required=True)
parser.add_argument("--region", default="us-east-1")
parser.add_argument("--queue-arn", required=True)
parser.add_argument(
"--role-arn",
default="",
help="Scheduler execution role. Empty uses the tf-managed holiday role in the caller account.",
)
parser.add_argument("--execute", action="store_true")
args = parser.parse_args()
account = _account(args.profile)
if account not in {PROD_ACCOUNT, DEV_ACCOUNT}:
print("profile is not seahaven-prod or seahaven-dev", file=sys.stderr)
return 2
role_arn = args.role_arn.strip() or holiday_scheduler_role_arn(account)
client = _client(args.profile, args.region)
now = datetime.now(timezone.utc)
updated = 0
skipped = 0
failed = 0
for name in _list_holiday(client):
detail = client.get_schedule(Name=name, GroupName="default")
expr = detail.get("ScheduleExpression", "")
when = schedule_when(detail)
if when is not None and when < now:
print(f"skip past {name} expr={expr}")
skipped += 1
continue
try:
action, date = action_and_date(
name, detail.get("Target", {}).get("Input", "")
)
except ValueError as exc:
print(f"skip {exc}", file=sys.stderr)
skipped += 1
continue
payload = holiday_sqs_input(action, date)
print(f"would retarget {name} action={action} date={date}")
if not args.execute:
continue
try:
client.update_schedule(
Name=name,
GroupName="default",
ScheduleExpression=expr,
ScheduleExpressionTimezone=detail.get(
"ScheduleExpressionTimezone", "America/New_York"
),
FlexibleTimeWindow={"Mode": "OFF"},
ActionAfterCompletion=detail.get("ActionAfterCompletion", "DELETE"),
Target={
"Arn": args.queue_arn,
"RoleArn": role_arn,
"Input": payload,
},
)
updated += 1
except ClientError as exc:
code = exc.response["Error"]["Code"]
print(f"failed {name}: {code}", file=sys.stderr)
failed += 1
print(f"updated={updated} skipped={skipped} failed={failed} execute={args.execute}")
if not args.execute:
print("dry-run; pass --execute to UpdateSchedule")
return 1 if failed else 0
if __name__ == "__main__":
raise SystemExit(main())

142
scripts/package_lambdas.py
View file

@ -1,142 +0,0 @@
#!/usr/bin/env python3
"""Build Lambda zips with src/shared bundled in. Used by deploy.yaml.
Each zip is functions/<name>/<sha>.zip on S3. GIT_SHA is written to
shared/build_info.py inside the zip so Sentry release is the commit, not a
runtime env var Terraform would own.
"""
from __future__ import annotations
import argparse
import os
import shutil
import subprocess
import sys
import tempfile
import zipfile
from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
# Keys match terraform/locals.tf local.functions.
FUNCTIONS = {
"slack_bot": ROOT / "src" / "slack-bot",
"weekly_post": ROOT / "src" / "weekly-post",
"roster_sync": ROOT / "src" / "roster-sync",
"roster_api": ROOT / "src" / "roster-api",
"ring_scheduler": ROOT / "src" / "ring-scheduler",
"holiday_router": ROOT / "src" / "holiday-router",
"portal_api": ROOT / "src" / "portal-api",
}
SKIP_INSTALL_PREFIXES = ("boto3", "botocore")
SKIP_COPY_NAMES = {"requirements.txt", "__pycache__"}
def _req_lines(path: Path) -> list[str]:
lines: list[str] = []
if not path.is_file():
return lines
for raw in path.read_text().splitlines():
line = raw.strip()
if not line or line.startswith("#"):
continue
lower = line.lower()
if any(lower.startswith(prefix) for prefix in SKIP_INSTALL_PREFIXES):
continue
lines.append(line)
return lines
def _copy_tree(src: Path, dest: Path) -> None:
dest.mkdir(parents=True, exist_ok=True)
for item in src.iterdir():
if item.name in SKIP_COPY_NAMES or item.name.endswith(".pyc"):
continue
target = dest / item.name
if item.is_dir():
if item.name == "__pycache__":
continue
shutil.copytree(
item, target, ignore=shutil.ignore_patterns("__pycache__", "*.pyc")
)
else:
shutil.copy2(item, target)
def build_function(name: str, src: Path, git_sha: str, out_dir: Path) -> Path:
with tempfile.TemporaryDirectory(prefix=f"afterhours-{name}-") as tmp:
dest = Path(tmp)
_copy_tree(src, dest)
shared_src = ROOT / "src" / "shared" / "shared"
_copy_tree(shared_src, dest / "shared")
(dest / "shared" / "build_info.py").write_text(
f'"""Pinned at zip time by scripts/package_lambdas.py."""\n\nGIT_SHA = "{git_sha}"\n',
encoding="utf-8",
)
reqs = _req_lines(src / "requirements.txt") + _req_lines(
ROOT / "src" / "shared" / "requirements.txt"
)
# Preserve order, drop duplicates.
seen: set[str] = set()
unique: list[str] = []
for line in reqs:
if line not in seen:
seen.add(line)
unique.append(line)
if unique:
cmd = [
sys.executable,
"-m",
"pip",
"install",
"--disable-pip-version-check",
"--no-compile",
"--python-version",
"3.12",
"--platform",
"manylinux2014_aarch64",
"--only-binary=:all:",
"--target",
str(dest),
*unique,
]
subprocess.run(cmd, check=True)
out_dir.mkdir(parents=True, exist_ok=True)
zip_path = out_dir / f"{name}.zip"
if zip_path.exists():
zip_path.unlink()
with zipfile.ZipFile(zip_path, "w", compression=zipfile.ZIP_DEFLATED) as zf:
for dirpath, dirnames, filenames in os.walk(dest):
dirnames[:] = [d for d in dirnames if d != "__pycache__"]
for filename in filenames:
if filename.endswith(".pyc"):
continue
full = Path(dirpath) / filename
rel = full.relative_to(dest)
zf.write(full, rel.as_posix())
return zip_path
def main() -> int:
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("--git-sha", required=True)
parser.add_argument("--out-dir", type=Path, default=ROOT / "build" / "packages")
parser.add_argument("--only", nargs="*", default=())
args = parser.parse_args()
selected = args.only or list(FUNCTIONS)
missing = [name for name in selected if name not in FUNCTIONS]
if missing:
print(f"unknown function keys: {missing}", file=sys.stderr)
return 2
for name in selected:
path = build_function(name, FUNCTIONS[name], args.git_sha, args.out_dir)
print(path)
return 0
if __name__ == "__main__":
raise SystemExit(main())

7
scripts/sync_changelog.py
View file

@ -1,9 +1,10 @@
#!/usr/bin/env python3
"""Copy the canonical root CHANGELOG.md into the slack-bot package.
The bot's App Home "What's New" tab reads CHANGELOG.md next to app.py in the
Fargate image, so a copy must live under src/slack-bot/. The root file is the
single source of truth; run this after editing it. Pytest fails if the two drift.
The bot's App Home "What's New" tab reads CHANGELOG.md from its own deployment
package ($LAMBDA_TASK_ROOT), so a copy must live under src/slack-bot/ (the
function's CodeUri). The root file is the single source of truth; run this after
editing it. CI's check_changelog.py fails if the two drift.
"""
import pathlib

139
src/holiday-router/app.py
View file

@ -3,15 +3,31 @@
A holiday is a day-only shift (08:00-17:00 ET), one HOLIDAY record per date.
At 08:00 this Lambda is invoked with ``{"action": "activate", "date": ...}`` and
at 17:00 with ``{"action": "deactivate", ...}``.
Activate:
* Capture both IVR 800 routes (key-0 and no-input/timeout) into
``CONFIG.captured_ivr_routes`` — but only if they are NOT already pointed at
the holiday queue (so a re-run never overwrites the real originals).
* Set queue 802's agents to the holiday's assignees, or ``[FALLBACK_EXTENSION]``
("100") when no slots are filled. Membership is set ONCE here.
* Repoint BOTH IVR 800 routes to the holiday queue (802).
* Mark the holiday ``activated = True``.
Idempotent: no-op if the record is gone or already activated.
Deactivate:
* Restore both IVR routes from ``CONFIG.captured_ivr_routes`` — only the routes
that currently point at the queue are reverted (defensive against manual
changes); clear the captured routes afterwards.
* Clear queue 802's agents.
* Mark the holiday ``activated = False``.
Idempotent: no-op if the record is gone or not activated.
"""
import json
import logging
import os
import shared.sentry_init # noqa: F401
from shared.holiday_flow import activate, deactivate
from shared.schedule import ShiftSchedule
from shared.schedule import FALLBACK_EXTENSION, ShiftSchedule
from shared.secrets import get_secret
from shared.three_cx_client import ThreeCXClient
@ -29,19 +45,124 @@ def _make_client() -> ThreeCXClient:
)
def _holiday_extensions(holiday: dict) -> list[str]:
"""Assignee extensions for the holiday, or the fallback when none claimed."""
assignees = holiday.get("assignees", {}) or {}
extensions = list(assignees.keys())
return extensions or [FALLBACK_EXTENSION]
def _activate(schedule: ShiftSchedule, date: str) -> dict:
return activate(schedule, date, client_factory=_make_client)
holiday = schedule.get_holiday(date)
if holiday is None:
logger.info("No holiday record for %s — nothing to activate", date)
return {"action": "activate", "date": date, "skipped": "no_record"}
if holiday.get("activated"):
logger.info("Holiday %s already activated — no-op", date)
return {"action": "activate", "date": date, "skipped": "already_active"}
queue_number = schedule.get_holiday_queue()
ivr_number = schedule.get_ivr_number()
extensions = _holiday_extensions(holiday)
client = _make_client()
# Capture the live IVR routes BEFORE repointing — but guard against storing
# holiday-state routes: if both routes already target the queue, a prior
# activation is in effect, so keep whatever originals we already captured.
ivr = client.get_ivr(ivr_number)
ivr_id = ivr["Id"]
current = client.extract_ivr_routes(ivr)
already_queue = str(current.get("key0")) == str(queue_number) and str(
current.get("timeout")
) == str(queue_number)
if already_queue:
logger.info(
"IVR %s already points at queue %s — not re-capturing routes",
ivr_number,
queue_number,
)
else:
schedule.set_captured_ivr_routes(current)
# Set queue membership ONCE, then repoint both IVR routes to the queue.
queue = client.get_queue(queue_number)
client.set_queue_agents(queue["Id"], extensions)
client.set_ivr_routes(ivr_id, key0_dn=queue_number, timeout_dn=queue_number)
schedule.set_holiday_activated(date, True)
logger.info(
"Activated holiday %s: queue %s agents=%s, IVR %s -> queue",
date,
queue_number,
extensions,
ivr_number,
)
return {
"action": "activate",
"date": date,
"queue": str(queue_number),
"ivr": str(ivr_number),
"agents": extensions,
}
def _deactivate(schedule: ShiftSchedule, date: str) -> dict:
return deactivate(schedule, date, client_factory=_make_client)
holiday = schedule.get_holiday(date)
if holiday is None:
logger.info("No holiday record for %s — nothing to deactivate", date)
return {"action": "deactivate", "date": date, "skipped": "no_record"}
if not holiday.get("activated"):
logger.info("Holiday %s not activated — no-op", date)
return {"action": "deactivate", "date": date, "skipped": "not_active"}
queue_number = schedule.get_holiday_queue()
ivr_number = schedule.get_ivr_number()
captured = schedule.get_captured_ivr_routes() or {}
client = _make_client()
ivr = client.get_ivr(ivr_number)
ivr_id = ivr["Id"]
live = client.extract_ivr_routes(ivr)
# Only restore a route if it currently points at the queue; otherwise leave
# whatever destination it has now (it was changed outside this flow).
def _restore(which: str) -> str | None:
live_dn = live.get(which)
if str(live_dn) == str(queue_number):
# Restore the captured pre-holiday DN; if it was lost, keep the live
# value rather than blanking the IVR destination.
return captured.get(which) or live_dn
return None # not pointing at the holiday queue — leave it untouched
client.set_ivr_routes(
ivr_id,
key0_dn=_restore("key0"),
timeout_dn=_restore("timeout"),
)
queue = client.get_queue(queue_number)
client.set_queue_agents(queue["Id"], [])
schedule.set_captured_ivr_routes(None)
schedule.set_holiday_activated(date, False)
logger.info(
"Deactivated holiday %s: restored IVR %s, cleared queue %s",
date,
ivr_number,
queue_number,
)
return {
"action": "deactivate",
"date": date,
"queue": str(queue_number),
"ivr": str(ivr_number),
}
def handler(event, context):
if os.environ.get("STAGE", "prod") != "prod":
logger.info("Skipping holiday router because STAGE is not prod")
return {"skipped": "non_prod"}
action = event.get("action")
date = event.get("date")
logger.info("Holiday router invoked: action=%s date=%s", action, date)

2
src/holiday-router/requirements.txt
View file

@ -1,2 +1,2 @@
boto3>=1.43.99
boto3>=1.43.27
requests>=2.34.2

93
src/portal-api/app.py
View file

@ -1,93 +0,0 @@
"""HTTP API v2 handler — Cognito-authenticated employee/admin shift API."""
from __future__ import annotations
import base64
import logging
import shared.sentry_init # noqa: F401
from shared.portal_http import cors_headers, encode_body, handle
from shared.portal_ops import ActionError
logger = logging.getLogger()
logger.setLevel(logging.INFO)
CORS_ORIGINS = {
"https://internal.seahaven.com",
"https://internal.dev.seahaven.com",
"http://localhost:5173",
"http://localhost:4173",
}
def _header(event: dict, name: str) -> str:
headers = event.get("headers") or {}
if not isinstance(headers, dict):
return ""
target = name.lower()
for key, value in headers.items():
if str(key).lower() == target:
return "" if value is None else str(value)
return ""
def _route(event: dict) -> tuple[str, str]:
request_context = event.get("requestContext") or {}
http = request_context.get("http") or {}
method = str(http.get("method") or event.get("httpMethod") or "").upper()
path = str(event.get("rawPath") or http.get("path") or event.get("path") or "")
route_key = event.get("routeKey")
if isinstance(route_key, str) and " " in route_key:
rk_method, rk_path = route_key.split(" ", 1)
method = method or rk_method.upper()
path = path or rk_path
return method, path.rstrip("/") or "/"
def _raw_body(event: dict) -> bytes | str | None:
body = event.get("body")
if body is None:
return None
if event.get("isBase64Encoded"):
if isinstance(body, bytes):
body = body.decode("ascii")
return base64.b64decode(body)
return body
def handler(event, context):
try:
method, path = _route(event)
status, headers, payload = handle(
method=method,
path=path,
origin=_header(event, "origin"),
authorization=_header(event, "authorization"),
query=event.get("queryStringParameters")
if isinstance(event.get("queryStringParameters"), dict)
else {},
body=_raw_body(event),
)
if status == 204:
return {"statusCode": 204, "headers": headers, "body": ""}
return {
"statusCode": status,
"headers": headers,
"body": encode_body(payload),
}
except ActionError as exc:
logger.exception("portal api action error")
return {
"statusCode": exc.status,
"headers": cors_headers(_header(event, "origin")),
"body": encode_body({"error": {"code": exc.code, "message": exc.message}}),
}
except Exception:
logger.exception("portal api unexpected failure")
return {
"statusCode": 500,
"headers": cors_headers(_header(event, "origin")),
"body": encode_body(
{"error": {"code": "INTERNAL", "message": "Internal error"}}
),
}

3
src/portal-api/requirements.txt
View file

@ -1,3 +0,0 @@
PyJWT[crypto]==2.14.0
boto3>=1.43.99
requests>=2.34.2

45
src/release-notifier/app.py Normal file
View file

@ -0,0 +1,45 @@
"""Lambda handler — announces a new release to the shift channel.
Invoked by the release workflow (``.github/workflows/release.yaml``) once a
minor or major version has been tagged *and* the new code has deployed
successfully. The event carries the version and notes already extracted from
CHANGELOG.md by the workflow, so this function never reads the changelog file
itself (it ships only in the slack-bot package, not here).
Event shape (the frozen contract between release.yaml and this function):
{"version": "1.10.0", "notes": "<markdown>", "date_label": "June 11, 2026"}
"""
import logging
import os
from slack_sdk import WebClient
from shared.blocks import build_release_announcement_blocks
from shared.secrets import get_secret
logger = logging.getLogger()
logger.setLevel(logging.INFO)
def handler(event, context):
event = event or {}
version = event.get("version")
notes = event.get("notes")
date_label = event.get("date_label", "")
if not version or not notes:
raise ValueError("event requires non-empty 'version' and 'notes'")
bot_token = get_secret(os.environ["SLACK_BOT_TOKEN_SECRET"])
channel_id = os.environ["SHIFT_CHANNEL"]
slack = WebClient(token=bot_token)
blocks = build_release_announcement_blocks(version, notes, date_label)
result = slack.chat_postMessage(
channel=channel_id,
blocks=blocks,
text=f"What's New — v{version}",
)
logger.info("Announced v%s to %s (ts=%s)", version, channel_id, result["ts"])
return {"announced": True, "version": version, "ts": result["ts"]}

2
src/release-notifier/requirements.txt Normal file
View file

@ -0,0 +1,2 @@
slack_sdk>=3.42.0,<4.0
boto3>=1.43.27

5
src/ring-scheduler/app.py
View file

@ -10,7 +10,6 @@ import os
from datetime import datetime
from zoneinfo import ZoneInfo
import shared.sentry_init # noqa: F401
from shared.ring_scheduler import update_queue_routing
from shared.schedule import (
FALLBACK_EXTENSION,
@ -27,10 +26,6 @@ EASTERN = ZoneInfo("America/New_York")
def handler(event, context):
if os.environ.get("STAGE", "prod") != "prod":
logger.info("Skipping 3CX queue scheduler because STAGE is not prod")
return {"skipped": "non_prod"}
now = datetime.now(EASTERN)
current_hour = now.hour
day_name = now.strftime("%A")

2
src/ring-scheduler/requirements.txt
View file

@ -1,2 +1,2 @@
boto3>=1.43.99
boto3>=1.43.36
requests>=2.34.2

124
src/roster-api/app.py
View file

@ -1,124 +0,0 @@
"""HTTP API v2 handler — Bearer-authenticated roster PUT/DELETE.
PUT /roster upsert name, extension, slack_user_id, optional email
DELETE /roster/{extension} delete the row (204 even if it was already gone)
Auth is an app-level Bearer token stored in Secrets Manager. Do not log the
Authorization header, the token, or the request body.
"""
from __future__ import annotations
import base64
import json
import logging
from typing import Any
import shared.sentry_init # noqa: F401
from shared.roster_http import (
AuthError,
SecretUnavailable,
authorize_bearer,
remove,
upsert,
validate_extension,
)
logger = logging.getLogger()
logger.setLevel(logging.INFO)
def _json_response(status: int, body: dict[str, Any] | None = None) -> dict:
if status == 204:
return {"statusCode": 204, "headers": {}, "body": ""}
payload = {} if body is None else body
return {
"statusCode": status,
"headers": {"Content-Type": "application/json"},
"body": json.dumps(payload, separators=(",", ":")),
}
def _header(event: dict, name: str) -> str:
headers = event.get("headers") or {}
if not isinstance(headers, dict):
return ""
target = name.lower()
for key, value in headers.items():
if str(key).lower() == target:
return "" if value is None else str(value)
return ""
def _route(event: dict) -> tuple[str, str]:
request_context = event.get("requestContext") or {}
http = request_context.get("http") or {}
method = str(http.get("method") or event.get("httpMethod") or "").upper()
path = str(event.get("rawPath") or http.get("path") or event.get("path") or "")
route_key = event.get("routeKey")
if isinstance(route_key, str) and " " in route_key:
rk_method, rk_path = route_key.split(" ", 1)
method = method or rk_method.upper()
path = path or rk_path
return method, path
def _raw_body(event: dict) -> bytes | None:
body = event.get("body")
if body is None:
return b""
try:
if event.get("isBase64Encoded"):
if isinstance(body, bytes):
body = body.decode("ascii")
return base64.b64decode(body, validate=True)
if isinstance(body, bytes):
return body
return str(body).encode("utf-8")
except (ValueError, UnicodeError):
return None
def _delete_extension(event: dict) -> str:
params = event.get("pathParameters") or {}
if not isinstance(params, dict):
raise TypeError("extension")
raw = params.get("extension")
if not isinstance(raw, str):
raise TypeError("extension")
return validate_extension(raw)
def handler(event, context):
try:
method, path = _route(event)
logger.info("roster api %s %s", method, path)
try:
authorize_bearer(_header(event, "authorization"))
except AuthError:
return _json_response(401, {"error": "unauthorized"})
except SecretUnavailable:
return _json_response(503, {"error": "service unavailable"})
if method == "PUT" and (path == "/roster" or path.rstrip("/") == "/roster"):
raw = _raw_body(event)
if raw is None:
return _json_response(400, {"error": "invalid request"})
try:
upsert(raw)
except (TypeError, ValueError):
return _json_response(400, {"error": "invalid request"})
return _json_response(200, {"ok": True})
if method == "DELETE" and path.startswith("/roster/"):
try:
extension = _delete_extension(event)
except (TypeError, ValueError):
return _json_response(400, {"error": "invalid request"})
remove(extension)
return _json_response(204)
return _json_response(405, {"error": "method not allowed"})
except Exception:
logger.exception("roster api unexpected failure")
return _json_response(500, {"error": "internal error"})

1
src/roster-api/requirements.txt
View file

@ -1 +0,0 @@
boto3>=1.43.99

40
src/roster-sync/app.py
View file

@ -2,7 +2,7 @@
Runs daily via EventBridge. Pulls members from the configured 3CX group,
filters to Extension type only (excludes RingGroups, IVRs, Voicemail, etc.),
and syncs to DynamoDB. Preserves existing slack_user_id and email links.
and syncs to DynamoDB. Preserves existing slack_user_id links.
"""
import logging
@ -10,10 +10,9 @@ import os
from datetime import datetime
from zoneinfo import ZoneInfo
import shared.sentry_init # noqa: F401
from shared.three_cx_client import ThreeCXClient
from shared.schedule import ShiftSchedule
from shared.secrets import get_secret
from shared.three_cx_client import ThreeCXClient
logger = logging.getLogger()
logger.setLevel(logging.INFO)
@ -24,10 +23,6 @@ EXCLUDE_NAMES = {"Voicemail", "IVR", "Fax"}
def handler(event, context):
if os.environ.get("STAGE", "prod") != "prod":
logger.info("Skipping roster sync because STAGE is not prod")
return {"skipped": "non_prod"}
now = datetime.now(EASTERN)
# DST guard — two EventBridge rules fire, only one is at 6am ET
@ -93,20 +88,14 @@ def handler(event, context):
)
updated.append(f"Ext {number}: {existing['name']} -> {name}")
else:
# UpdateItem so a stale get_roster snapshot cannot PutItem-overwrite
# a roster-API row that landed after the read and wipe its Slack id.
schedule.table.update_item(
Key={"PK": "ROSTER", "SK": number},
UpdateExpression=(
"SET #n = :name, extension = :ext, "
"slack_user_id = if_not_exists(slack_user_id, :empty)"
),
ExpressionAttributeNames={"#n": "name"},
ExpressionAttributeValues={
":name": name,
":ext": number,
":empty": "",
},
schedule.table.put_item(
Item={
"PK": "ROSTER",
"SK": number,
"name": name,
"extension": number,
"slack_user_id": "",
}
)
added.append(f"Ext {number}: {name}")
@ -130,12 +119,5 @@ def handler(event, context):
"updated": updated,
"removed": removed,
}
logger.info(
"Roster sync complete: group=%s total_3cx=%d added=%d updated=%d removed=%d",
group_name,
len(threecx_extensions),
len(added),
len(updated),
len(removed),
)
logger.info("Roster sync complete: %s", result)
return result

2
src/roster-sync/requirements.txt
View file

@ -1,2 +1,2 @@
boto3>=1.43.99
boto3>=1.43.36
requests>=2.34.2

1
src/server/__init__.py
View file

@ -1 +0,0 @@
"""Always-on Flask process for afterhours-shift-manager."""

134
src/server/app.py
View file

@ -1,134 +0,0 @@
"""Production Flask app for afterhours-shift-manager.
Local: PYTHONPATH=src:src/shared python3 -m server.app
Prod: gunicorn server.wsgi:app
"""
from __future__ import annotations
import logging
import os
import sys
from pathlib import Path
from flask import Flask, Response, jsonify, request
import shared.sentry_init # noqa: F401
from shared.portal_http import encode_body, handle as portal_handle
from shared.roster_http import (
AuthError,
SecretUnavailable,
authorize_bearer,
remove,
upsert,
validate_extension,
)
from shared.secrets import get_secret
logger = logging.getLogger(__name__)
_SLACK_BOT_DIR = Path(__file__).resolve().parents[1] / "slack-bot"
if str(_SLACK_BOT_DIR) not in sys.path:
sys.path.insert(0, str(_SLACK_BOT_DIR))
def _slack_handler():
from slack_bolt.adapter.flask import SlackRequestHandler
from app import create_app as create_bolt_app
bot_token = get_secret(os.environ["SLACK_BOT_TOKEN_SECRET"])
signing_secret = get_secret(os.environ["SLACK_SIGNING_SECRET"])
schedule_channel = os.environ["SHIFT_CHANNEL"]
bolt_app = create_bolt_app(
bot_token, signing_secret, schedule_channel=schedule_channel
)
return SlackRequestHandler(bolt_app)
def create_app() -> Flask:
app = Flask(__name__)
slack_handler = None
def _get_slack_handler():
nonlocal slack_handler
if slack_handler is None:
slack_handler = _slack_handler()
return slack_handler
@app.route("/api/health")
def health():
return jsonify(
{
"stage": os.environ.get("STAGE", "local"),
"sha": os.environ.get("GIT_SHA", "dev"),
}
)
@app.route("/slack/events", methods=["POST"])
def slack_events():
if os.environ.get("STAGE", "prod") != "prod":
return jsonify({"error": "slack_disabled"}), 404
return _get_slack_handler().handle(request)
@app.route("/api/shifts", methods=["GET", "POST", "DELETE", "OPTIONS"])
@app.route("/api/shifts/<path:rest>", methods=["GET", "POST", "DELETE", "OPTIONS"])
def portal(rest: str | None = None):
status, headers, payload = portal_handle(
method=request.method,
path=request.path,
origin=request.headers.get("Origin", ""),
authorization=request.headers.get("Authorization", ""),
query=request.args.to_dict(flat=True),
body=request.get_data(),
)
if status == 204:
return Response(b"", status=204, headers=headers)
return Response(
encode_body(payload),
status=status,
headers=headers,
mimetype="application/json",
content_type="application/json",
)
@app.route("/roster", methods=["PUT"])
def roster_put():
try:
authorize_bearer(request.headers.get("Authorization", ""))
except AuthError:
return jsonify({"error": "unauthorized"}), 401
except SecretUnavailable:
return jsonify({"error": "service unavailable"}), 503
try:
upsert(request.get_data())
except (TypeError, ValueError):
return jsonify({"error": "invalid request"}), 400
return jsonify({"ok": True}), 200
@app.route("/roster/<extension>", methods=["DELETE"])
def roster_delete(extension: str):
try:
authorize_bearer(request.headers.get("Authorization", ""))
except AuthError:
return jsonify({"error": "unauthorized"}), 401
except SecretUnavailable:
return jsonify({"error": "service unavailable"}), 503
try:
remove(validate_extension(extension))
except (TypeError, ValueError):
return jsonify({"error": "invalid request"}), 400
return Response(b"", status=204)
return app
app = create_app()
def main():
app.run(host="0.0.0.0", port=int(os.environ.get("PORT", "8080")))
if __name__ == "__main__":
main()

71
src/server/entrypoint.py
View file

@ -1,71 +0,0 @@
"""Gunicorn + SQS worker in one task. Stay a parent so SIGTERM reaches both."""
from __future__ import annotations
import os
import signal
import subprocess
import sys
import time
def main() -> None:
env = os.environ.copy()
worker = subprocess.Popen(
[sys.executable, "-m", "server.worker"],
env=env,
)
gunicorn = subprocess.Popen(
[
"gunicorn",
"--bind",
"0.0.0.0:8080",
"--workers",
os.environ.get("GUNICORN_WORKERS", "2"),
"--threads",
"2",
"--timeout",
"120",
"--graceful-timeout",
"30",
"--access-logfile",
"-",
"--error-logfile",
"-",
"server.wsgi:app",
],
env=env,
)
def shutdown(signum: int, _frame) -> None:
for proc in (gunicorn, worker):
if proc.poll() is None:
proc.send_signal(signum)
signal.signal(signal.SIGTERM, shutdown)
signal.signal(signal.SIGINT, shutdown)
while True:
g_code = gunicorn.poll()
w_code = worker.poll()
if g_code is not None:
if worker.poll() is None:
worker.terminate()
try:
worker.wait(timeout=30)
except subprocess.TimeoutExpired:
worker.kill()
sys.exit(g_code)
if w_code is not None:
if gunicorn.poll() is None:
gunicorn.terminate()
try:
gunicorn.wait(timeout=30)
except subprocess.TimeoutExpired:
gunicorn.kill()
sys.exit(w_code or 1)
time.sleep(1)
if __name__ == "__main__":
main()

79
src/server/jobs.py
View file

@ -1,79 +0,0 @@
"""In-process job dispatch. SQS when JOBS_QUEUE_URL is set; otherwise run inline."""
from __future__ import annotations
import importlib.util
import json
import logging
import os
import sys
from pathlib import Path
import boto3
from shared.holiday_flow import activate, deactivate
from shared.schedule import ShiftSchedule
logger = logging.getLogger(__name__)
_SRC = Path(__file__).resolve().parents[1]
_sqs = None
_handlers: dict[str, object] = {}
def _client():
global _sqs
if _sqs is None:
_sqs = boto3.client("sqs")
return _sqs
def _load_lambda_app(dirname: str):
if dirname in _handlers:
return _handlers[dirname]
path = _SRC / dirname / "app.py"
name = f"afterhours_{dirname.replace('-', '_')}"
spec = importlib.util.spec_from_file_location(name, path)
if spec is None or spec.loader is None:
raise ImportError(f"cannot load {path}")
mod = importlib.util.module_from_spec(spec)
sys.modules[name] = mod
spec.loader.exec_module(mod)
_handlers[dirname] = mod
return mod
def enqueue_job(payload: dict) -> None:
queue_url = os.environ.get("JOBS_QUEUE_URL", "").strip()
body = json.dumps(payload, default=str)
if not queue_url:
run_job(payload)
return
_client().send_message(QueueUrl=queue_url, MessageBody=body)
def _run_holiday(payload: dict) -> dict:
action = payload.get("action")
date = payload.get("date")
if not date:
return {"error": True, "reason": "missing_date"}
schedule = ShiftSchedule()
if action == "activate":
return activate(schedule, date)
if action == "deactivate":
return deactivate(schedule, date)
return {"error": True, "reason": "unknown_action", "action": action}
def run_job(payload: dict) -> dict:
event_type = payload.get("event", "")
if event_type == "holiday":
return _run_holiday(payload)
forced = {**payload, "force": True}
if event_type == "weekly_post":
return _load_lambda_app("weekly-post").handler(forced, None)
if event_type == "roster_sync":
return _load_lambda_app("roster-sync").handler(forced, None)
if event_type in {"ring_scheduler_daily", "ring_scheduler_weekend"}:
return _load_lambda_app("ring-scheduler").handler(forced, None)
raise ValueError(f"unknown job event {event_type!r}")

58
src/server/worker.py
View file

@ -1,58 +0,0 @@
"""SQS long-poll consumer. One process per task, not per gunicorn worker."""
from __future__ import annotations
import json
import logging
import os
import signal
import sys
import time
import boto3
from server.jobs import run_job
logger = logging.getLogger(__name__)
logging.basicConfig(level=logging.INFO, stream=sys.stderr)
_running = True
def _stop(_signum, _frame) -> None:
global _running
_running = False
def main() -> None:
signal.signal(signal.SIGTERM, _stop)
signal.signal(signal.SIGINT, _stop)
queue_url = os.environ.get("JOBS_QUEUE_URL", "").strip()
if not queue_url:
logger.info("JOBS_QUEUE_URL unset; worker idle")
while _running:
time.sleep(1)
return
sqs = boto3.client("sqs")
logger.info("Polling jobs queue")
while _running:
resp = sqs.receive_message(
QueueUrl=queue_url,
MaxNumberOfMessages=1,
WaitTimeSeconds=20,
VisibilityTimeout=180,
)
for msg in resp.get("Messages", []):
receipt = msg["ReceiptHandle"]
try:
payload = json.loads(msg["Body"])
result = run_job(payload)
logger.info("job result %s", result)
sqs.delete_message(QueueUrl=queue_url, ReceiptHandle=receipt)
except Exception:
logger.exception("job failed; leaving message for retry")
if __name__ == "__main__":
main()

5
src/server/wsgi.py
View file

@ -1,5 +0,0 @@
"""Gunicorn entrypoint."""
from server.app import app
__all__ = ["app"]

4
src/shared/requirements.txt
View file

@ -1,4 +1,2 @@
boto3>=1.43.99
boto3>=1.43.36
requests>=2.34.2
sentry-sdk==2.69.2

269
src/shared/shared/blocks.py
View file

@ -4,7 +4,7 @@ import re
from datetime import datetime, timedelta
from zoneinfo import ZoneInfo
from shared.schedule import WEEKEND_DAYS, week_start
from shared.schedule import WEEKEND_DAYS
EASTERN = ZoneInfo("America/New_York")
@ -32,6 +32,39 @@ def markdown_to_mrkdwn(text: str) -> str:
return text
def build_release_announcement_blocks(
version: str, notes: str, date_label: str = ""
) -> list[dict]:
"""Build the channel post announcing a new minor/major release.
Args:
version: SemVer string without the ``v`` prefix, e.g. ``"1.10.0"``.
notes: the changelog entry body in Markdown.
date_label: human date, e.g. ``"June 11, 2026"`` (optional).
"""
body = markdown_to_mrkdwn(notes.strip())
if len(body) > _SECTION_LIMIT:
body = (
body[:_SECTION_LIMIT].rstrip() + "\n\n_…see the full changelog for more._"
)
blocks: list[dict] = [
{
"type": "header",
"text": {"type": "plain_text", "text": f"What's New — v{version}"},
}
]
if date_label:
blocks.append(
{
"type": "context",
"elements": [{"type": "mrkdwn", "text": f"Released {date_label}"}],
}
)
blocks.append({"type": "section", "text": {"type": "mrkdwn", "text": body}})
return blocks
SHIFT_LABELS = {
"day": "Day (8am–5pm)",
"night": "Night (5pm–8am)",
@ -116,11 +149,11 @@ def build_week_schedule(schedule, start_date: datetime | None = None) -> list[di
Args:
schedule: ShiftSchedule instance
start_date: Sunday of the first week to show. Defaults to current week's Sunday.
start_date: Monday of the first week to show. Defaults to current week's Monday.
"""
now = datetime.now(EASTERN)
if start_date is None:
start_date = week_start(now)
start_date = now - timedelta(days=now.weekday()) # Monday of this week
start_date = start_date.replace(hour=0, minute=0, second=0, microsecond=0)
today_str = now.strftime("%Y-%m-%d")
@ -245,7 +278,7 @@ def build_shift_change_message(
if action == "picked_up":
text = f":white_check_mark: <@{user_id}> picked up the *{day_label}*{type_label} shift (Ext {ext})"
elif action == "dropped":
text = f"Boo, :warning: <@{user_id}> dropped the *{day_label}*{type_label} shift — it's now *Available*"
text = f":warning: <@{user_id}> dropped the *{day_label}*{type_label} shift — it's now *Available*"
elif action == "swapped":
text = f":arrows_counterclockwise: <@{user_id}> swapped into the *{day_label}*{type_label} shift (Ext {ext})"
else:
@ -254,15 +287,8 @@ def build_shift_change_message(
return [{"type": "section", "text": {"type": "mrkdwn", "text": text}}]
def _mrkdwn_text(value: str) -> str:
return value.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;")
def build_swap_request_blocks(
requester_slack: str,
date_str: str,
shift_type: str = "night",
note: str | None = None,
requester_slack: str, date_str: str, shift_type: str = "night"
) -> list[dict]:
"""Build the interactive Accept / Decline message DMed to a swap target."""
dt = datetime.strptime(date_str, "%Y-%m-%d")
@ -273,18 +299,15 @@ def build_swap_request_blocks(
else ""
)
action_suffix = "_day" if shift_type == "day" else ""
text = (
f"<@{requester_slack}> wants you to cover the "
f"*{day_label}*{type_label} shift. Accept to take it on."
)
if note:
text += f"\n\nNote: {_mrkdwn_text(note)}"
return [
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": text,
"text": (
f"<@{requester_slack}> wants you to cover the "
f"*{day_label}*{type_label} shift. Accept to take it on."
),
},
},
{
@ -321,9 +344,9 @@ def build_holiday_added_blocks(
) -> list[dict]:
"""Build the channel post announcing a newly scheduled holiday.
A header, an optional context line, then a section describing the holiday
day-shift (08:00–17:00 ET), its open slots, and the pay multiplier so people
know to pick it up.
Mirrors :func:`build_release_announcement_blocks`: a header, an optional
context line, then a section describing the holiday day-shift (08:00–17:00
ET), its open slots, and the pay multiplier so people know to pick it up.
Args:
date_str: the holiday date, ``YYYY-MM-DD``.
@ -424,165 +447,6 @@ def build_pickup_resolved_blocks(text: str) -> list[dict]:
return [{"type": "section", "text": {"type": "mrkdwn", "text": text}}]
# ── Admin modals + App Home admin section ───────────────────────────────
#
# These ids are read back from ``view.state.values`` in the slack-bot's
# ``@app.view`` handlers, so the builders here and the readers there must agree.
OPEN_OVERRIDE_MODAL_ACTION = "admin_open_override_modal"
OPEN_HOLIDAY_MODAL_ACTION = "admin_open_holiday_modal"
OVERRIDE_MODAL_CALLBACK = "admin_override_submit"
HOLIDAY_ADD_MODAL_CALLBACK = "admin_holiday_add_submit"
def _shift_option(value: str) -> dict:
return {"text": {"type": "plain_text", "text": value.capitalize()}, "value": value}
def build_override_modal(roster: list[dict]) -> dict:
"""Block Kit modal for setting a date override (admin only).
The employee picker is a ``static_select`` built from the roster so the
extension can't be mistyped. Block/action ids ('date', 'extension',
'shift_type') are read back in the ``view_submission`` handler.
"""
options = [
{
"text": {
"type": "plain_text",
"text": f"{e.get('name') or e['extension']} (Ext {e['extension']})",
},
"value": e["extension"],
}
for e in sorted(roster, key=lambda e: (e.get("name") or "").lower())
]
extension_element = {
"type": "static_select",
"action_id": "extension",
"placeholder": {"type": "plain_text", "text": "Choose an employee"},
}
if options:
extension_element["options"] = options
return {
"type": "modal",
"callback_id": OVERRIDE_MODAL_CALLBACK,
"title": {"type": "plain_text", "text": "Set Override"},
"submit": {"type": "plain_text", "text": "Set override"},
"close": {"type": "plain_text", "text": "Cancel"},
"blocks": [
{
"type": "input",
"block_id": "date",
"label": {"type": "plain_text", "text": "Date"},
"element": {"type": "datepicker", "action_id": "date"},
},
{
"type": "input",
"block_id": "extension",
"label": {"type": "plain_text", "text": "Employee"},
"element": extension_element,
},
{
"type": "input",
"block_id": "shift_type",
"label": {"type": "plain_text", "text": "Shift"},
"element": {
"type": "static_select",
"action_id": "shift_type",
"initial_option": _shift_option("night"),
"options": [_shift_option("night"), _shift_option("day")],
},
},
],
}
def build_holiday_add_modal() -> dict:
"""Block Kit modal for scheduling a holiday day shift (admin only).
The multiplier is its own optional field (not a parsed ``x<mult>`` token).
Block/action ids ('date', 'slots', 'multiplier', 'label') are read back in
the ``view_submission`` handler.
"""
return {
"type": "modal",
"callback_id": HOLIDAY_ADD_MODAL_CALLBACK,
"title": {"type": "plain_text", "text": "Add Holiday"},
"submit": {"type": "plain_text", "text": "Add holiday"},
"close": {"type": "plain_text", "text": "Cancel"},
"blocks": [
{
"type": "input",
"block_id": "date",
"label": {"type": "plain_text", "text": "Date"},
"element": {"type": "datepicker", "action_id": "date"},
},
{
"type": "input",
"block_id": "slots",
"label": {"type": "plain_text", "text": "Slots"},
"element": {
"type": "plain_text_input",
"action_id": "slots",
"placeholder": {"type": "plain_text", "text": "e.g. 2"},
},
},
{
"type": "input",
"block_id": "multiplier",
"optional": True,
"label": {"type": "plain_text", "text": "Pay multiplier"},
"element": {
"type": "plain_text_input",
"action_id": "multiplier",
"placeholder": {"type": "plain_text", "text": "Defaults to 1.5"},
},
},
{
"type": "input",
"block_id": "label",
"label": {"type": "plain_text", "text": "Label"},
"element": {
"type": "plain_text_input",
"action_id": "label",
"placeholder": {
"type": "plain_text",
"text": "e.g. Independence Day",
},
},
},
],
}
def build_admin_overview(
upcoming_overrides: list[dict], upcoming_holidays: list[dict]
) -> dict:
"""A compact 'upcoming overrides + holidays' section for the App Home admin tab."""
lines = ["*Upcoming overrides & holidays*"]
if not upcoming_overrides and not upcoming_holidays:
lines.append("_Nothing scheduled in the next 60 days._")
for o in upcoming_overrides:
dt = datetime.strptime(o["date"], "%Y-%m-%d")
shift = "Day" if o["shift_type"] == "day" else "Night"
who = (
"Open"
if o.get("extension") == "OPEN"
else f"{o.get('name') or o['extension']} (Ext {o['extension']})"
)
lines.append(f"• {dt.strftime('%a %b %-d')} ({shift}) — {who}")
for h in upcoming_holidays:
dt = datetime.strptime(h["SK"], "%Y-%m-%d")
slots = int(h.get("slots", 0))
filled = len(h.get("assignees", {}) or {})
mult = f"{float(h.get('multiplier', 1.5)):g}x"
lines.append(
f"• {dt.strftime('%a %b %-d')} — _{h.get('label', 'Holiday')}_ "
f"({filled}/{slots} filled, {mult})"
)
return {"type": "section", "text": {"type": "mrkdwn", "text": "\n".join(lines)}}
def build_help_blocks(is_admin: bool = False) -> list[dict]:
"""Build help message blocks."""
text = (
@ -613,28 +477,19 @@ def build_help_blocks(is_admin: bool = False) -> list[dict]:
"`/oncall admin holiday add <date> <slots> <label>` — Schedule a holiday day shift (8am–5pm)\n"
"`/oncall admin holiday add <date> <slots> x<mult> <label>` — …with a custom pay multiplier\n"
"`/oncall admin holiday remove <date>` — Remove a scheduled holiday\n"
"`/oncall admin holiday list` — List upcoming holidays\n\n"
"_Tip: open the *Admin* section of the bot's Home tab to set overrides "
"and add holidays with pickers instead of positional arguments._"
"`/oncall admin holiday list` — List upcoming holidays"
)
return [{"type": "section", "text": {"type": "mrkdwn", "text": text}}]
def build_home_view(
version: str | None = None,
notes: str = "",
date_label: str = "",
*,
is_admin: bool = False,
upcoming_overrides: list[dict] | None = None,
upcoming_holidays: list[dict] | None = None,
version: str | None = None, notes: str = "", date_label: str = ""
) -> dict:
"""Build the App Home tab: what the bot does, the commands, and what's new.
``version``/``notes``/``date_label`` come from the newest CHANGELOG entry; when
absent (e.g. the changelog could not be read) the "What's New" section is
simply omitted. When ``is_admin`` is set, an Admin section with the override /
holiday modal buttons and an upcoming overview is appended.
simply omitted.
"""
blocks: list[dict] = [
{
@ -653,35 +508,9 @@ def build_home_view(
),
},
},
*build_help_blocks(is_admin=is_admin),
*build_help_blocks(is_admin=False),
]
if is_admin:
blocks.append({"type": "divider"})
blocks.append(
{"type": "header", "text": {"type": "plain_text", "text": "Admin"}}
)
blocks.append(
{
"type": "actions",
"elements": [
{
"type": "button",
"text": {"type": "plain_text", "text": "Set override"},
"action_id": OPEN_OVERRIDE_MODAL_ACTION,
},
{
"type": "button",
"text": {"type": "plain_text", "text": "Add holiday"},
"action_id": OPEN_HOLIDAY_MODAL_ACTION,
},
],
}
)
blocks.append(
build_admin_overview(upcoming_overrides or [], upcoming_holidays or [])
)
if version:
blocks.append({"type": "divider"})
blocks.append(

55
src/shared/shared/changelog.py
View file

@ -1,9 +1,11 @@
"""Parse CHANGELOG.md for Slack App Home "What's New".
"""Parse CHANGELOG.md — the single source of truth for version and release notes.
The root CHANGELOG.md is the source of truth. ``scripts/sync_changelog.py``
copies it into ``src/slack-bot/CHANGELOG.md`` so the Fargate image can read it
next to ``app.py``. GitHub Releases are cut separately with
``gh release create``; the changelog is not the prod tag driver.
These are pure, text-in helpers shared by three consumers so the parsing rules
live in exactly one place:
* the Slack App Home tab — renders the newest entry ("What's New in vX.Y.Z"),
* the release workflow — pulls the notes for the tag it is about to create,
* the CI changelog guard — validates the top version is a clean SemVer bump.
The parser tolerates the file's leading preamble (prose before the first ``##``
header), date-only historical headers like ``## May 1, 2026 — …`` (no version),
@ -47,6 +49,10 @@ def _version_key(version: str) -> tuple[int, int, int]:
return (int(match.group(1)), int(match.group(2)), int(match.group(3)))
def _normalize(version: str) -> str:
return version.lstrip("v")
def _strip_rules(body: str) -> str:
"""Drop ``---`` thematic-break lines from the body's edges.
@ -89,3 +95,42 @@ def latest_entry(text: str) -> Entry | None:
if entry.versions:
return entry
return None
def top_version(text: str) -> str | None:
"""The version of the newest entry — what a new release tags against."""
entry = latest_entry(text)
return entry.version if entry else None
def entry_for(text: str, version: str) -> Entry | None:
"""The entry whose header includes ``version`` (``v`` prefix optional)."""
target = _normalize(version)
for entry in parse_changelog(text):
if any(_normalize(v) == target for v in entry.versions):
return entry
return None
def bump_kind(new: str, prev: str) -> str | None:
"""Classify ``new`` relative to ``prev`` as a single clean SemVer step.
Returns ``"major"``, ``"minor"``, or ``"patch"`` for an exact one-step
increment, or None for anything else (skip, multi-step, or downgrade). Note a
minor bump resets patch to 0 (``1.9.2 -> 1.10.0``), so this compares whole
tuples rather than counting changed components.
"""
nmaj, nmin, npat = _version_key(new)
pmaj, pmin, ppat = _version_key(prev)
if (nmaj, nmin, npat) == (pmaj + 1, 0, 0):
return "major"
if (nmaj, nmin, npat) == (pmaj, pmin + 1, 0):
return "minor"
if (nmaj, nmin, npat) == (pmaj, pmin, ppat + 1):
return "patch"
return None
def is_valid_bump(new: str, prev: str) -> bool:
"""True iff ``new`` is exactly one SemVer step above ``prev``."""
return bump_kind(new, prev) is not None

175
src/shared/shared/cognito.py
View file

@ -1,175 +0,0 @@
"""Verification for portal Cognito ID tokens (environment-configured trust)."""
from __future__ import annotations
import json
import logging
import os
import re
from functools import lru_cache
import jwt
from jwt import PyJWKClient
from jwt.exceptions import PyJWKClientConnectionError, PyJWKClientError, PyJWTError
logger = logging.getLogger(__name__)
ALLOWED_EMAIL_DOMAINS = {"seahavenind.com", "seahaven.com"}
_COGNITO_ISSUER_RE = re.compile(
r"^https://cognito-idp\.[a-z0-9-]+\.amazonaws\.com/[A-Za-z0-9_-]+$"
)
_UNVERIFIED_DECODE = {
"verify_signature": False,
"verify_exp": False,
"verify_aud": False,
}
class CognitoVerificationUnavailable(RuntimeError):
"""Trusted Cognito configuration or JWKS could not be loaded."""
def looks_like_cognito_token(token: str) -> bool:
try:
claims = jwt.decode(
token,
options=_UNVERIFIED_DECODE,
algorithms=["RS256"],
)
except PyJWTError:
return False
issuer = claims.get("iss")
return (
isinstance(issuer, str)
and bool(_COGNITO_ISSUER_RE.fullmatch(issuer.rstrip("/")))
and claims.get("token_use") == "id"
)
@lru_cache(maxsize=4)
def _jwk_client(issuer: str) -> PyJWKClient:
return PyJWKClient(
f"{issuer}/.well-known/jwks.json",
cache_keys=True,
lifespan=300,
timeout=5,
)
def verify_cognito_id_token(token: str) -> dict | None:
"""Verify a portal token and return trusted identity claims."""
if not token:
return None
try:
trusted = _trusted_clients()
except CognitoVerificationUnavailable:
raise
except Exception as exc:
logger.error("Failed to load Cognito verification configuration: %s", exc)
raise CognitoVerificationUnavailable from exc
if not trusted:
logger.error("Cognito verification is not configured")
return None
try:
unverified = jwt.decode(
token,
options=_UNVERIFIED_DECODE,
algorithms=["RS256"],
)
except PyJWTError as exc:
logger.warning("Cognito token rejected: %s", type(exc).__name__)
return None
issuer = unverified.get("iss")
if not isinstance(issuer, str):
logger.warning("Cognito token rejected: missing issuer")
return None
issuer = issuer.rstrip("/")
audience = trusted.get(issuer)
if not audience:
logger.warning("Cognito token rejected: untrusted issuer")
return None
try:
signing_key = _jwk_client(issuer).get_signing_key_from_jwt(token)
claims = jwt.decode(
token,
signing_key.key,
algorithms=["RS256"],
audience=audience,
issuer=issuer,
options={
"require": [
"aud",
"email",
"exp",
"iat",
"iss",
"token_use",
]
},
)
except PyJWKClientConnectionError as exc:
logger.error("Cognito JWKS is unavailable: %s", type(exc).__name__)
raise CognitoVerificationUnavailable from exc
except OSError as exc:
logger.error("Cognito JWKS is unavailable: %s", type(exc).__name__)
raise CognitoVerificationUnavailable from exc
except (PyJWKClientError, PyJWTError, TypeError, ValueError) as exc:
logger.warning("Cognito token rejected: %s", type(exc).__name__)
return None
return _identity_from_claims(claims)
def _trusted_clients() -> dict[str, str]:
trusted: dict[str, str] = {}
raw_trust = os.environ.get("PORTAL_COGNITO_TRUST", "").strip()
if raw_trust:
items = json.loads(raw_trust)
if not isinstance(items, list):
raise CognitoVerificationUnavailable
for item in items:
if not isinstance(item, dict):
continue
issuer = str(item.get("issuer", "")).rstrip("/")
audience = str(item.get("audience", "")).strip()
if _COGNITO_ISSUER_RE.fullmatch(issuer) and audience:
trusted[issuer] = audience
issuer = os.environ.get("PORTAL_COGNITO_ISSUER", "").rstrip("/")
audience = os.environ.get("PORTAL_COGNITO_AUDIENCE", "").strip()
if issuer and audience:
if not _COGNITO_ISSUER_RE.fullmatch(issuer):
if not trusted:
logger.error("Cognito issuer is invalid")
raise CognitoVerificationUnavailable
else:
trusted.setdefault(issuer, audience)
return trusted
def _identity_from_claims(claims: dict) -> dict | None:
if claims.get("token_use") != "id":
return None
email = claims.get("email")
if not isinstance(email, str) or not email.strip() or "@" not in email:
return None
email = email.strip()
if email.rsplit("@", 1)[1].lower() not in ALLOWED_EMAIL_DOMAINS:
return None
name = _display_name(claims, email)
if not name:
return None
return {"name": name, "email": email}
def _display_name(claims: dict, email: str) -> str | None:
for key in ("name", "given_name"):
value = claims.get(key)
if isinstance(value, str) and value.strip():
return value.strip()
local = email.split("@", 1)[0].strip()
return local or None

14
src/shared/shared/effects.py
View file

@ -1,14 +0,0 @@
"""External side effects. Only production may call Slack or 3CX.
A missing STAGE is treated as prod so a task that lost its environment
variable does not silently drop production notifications. Dev and any
other named stage skip Slack and 3CX entirely.
"""
from __future__ import annotations
import os
def prod_side_effects_enabled() -> bool:
return os.environ.get("STAGE", "prod") == "prod"

130
src/shared/shared/holiday_flow.py
View file

@ -1,130 +0,0 @@
"""Holiday activate/deactivate. Shared by the Lambda router and the Fargate worker."""
from __future__ import annotations
import logging
import os
from shared.effects import prod_side_effects_enabled
from shared.schedule import FALLBACK_EXTENSION, ShiftSchedule
from shared.secrets import get_secret
from shared.three_cx_client import ThreeCXClient, oauth_client
logger = logging.getLogger(__name__)
def make_client() -> ThreeCXClient:
secret_prefix = os.environ["TCX_SECRET_PREFIX"]
return oauth_client(
domain=get_secret(f"{secret_prefix}domain"),
client_id=get_secret(f"{secret_prefix}client-id"),
client_secret=get_secret(f"{secret_prefix}client-secret"),
)
def holiday_extensions(holiday: dict) -> list[str]:
assignees = holiday.get("assignees", {}) or {}
extensions = list(assignees.keys())
return extensions or [FALLBACK_EXTENSION]
def activate(schedule: ShiftSchedule, date: str, client_factory=None) -> dict:
if not prod_side_effects_enabled():
logger.info("Skipping holiday activate because STAGE is not prod")
return {"action": "activate", "date": date, "skipped": "non_prod"}
holiday = schedule.get_holiday(date)
if holiday is None:
logger.info("No holiday record for %s — nothing to activate", date)
return {"action": "activate", "date": date, "skipped": "no_record"}
if holiday.get("activated"):
logger.info("Holiday %s already activated — no-op", date)
return {"action": "activate", "date": date, "skipped": "already_active"}
queue_number = schedule.get_holiday_queue()
ivr_number = schedule.get_ivr_number()
extensions = holiday_extensions(holiday)
client = (client_factory or make_client)()
ivr = client.get_ivr(ivr_number)
ivr_id = ivr["Id"]
current = client.extract_ivr_routes(ivr)
already_queue = str(current.get("key0")) == str(queue_number) and str(
current.get("timeout")
) == str(queue_number)
if already_queue:
logger.info(
"IVR %s already points at queue %s — not re-capturing routes",
ivr_number,
queue_number,
)
else:
schedule.set_captured_ivr_routes(current)
queue = client.get_queue(queue_number)
client.set_queue_agents(queue["Id"], extensions)
client.set_ivr_routes(ivr_id, key0_dn=queue_number, timeout_dn=queue_number)
schedule.set_holiday_activated(date, True)
logger.info(
"Activated holiday %s: queue %s agents=%s, IVR %s -> queue",
date,
queue_number,
extensions,
ivr_number,
)
return {
"action": "activate",
"date": date,
"queue": str(queue_number),
"ivr": str(ivr_number),
"agents": extensions,
}
def deactivate(schedule: ShiftSchedule, date: str, client_factory=None) -> dict:
if not prod_side_effects_enabled():
logger.info("Skipping holiday deactivate because STAGE is not prod")
return {"action": "deactivate", "date": date, "skipped": "non_prod"}
holiday = schedule.get_holiday(date)
if holiday is None:
logger.info("No holiday record for %s — nothing to deactivate", date)
return {"action": "deactivate", "date": date, "skipped": "no_record"}
if not holiday.get("activated"):
logger.info("Holiday %s not activated — no-op", date)
return {"action": "deactivate", "date": date, "skipped": "not_active"}
queue_number = schedule.get_holiday_queue()
ivr_number = schedule.get_ivr_number()
captured = schedule.get_captured_ivr_routes() or {}
client = (client_factory or make_client)()
ivr = client.get_ivr(ivr_number)
ivr_id = ivr["Id"]
live = client.extract_ivr_routes(ivr)
def _restore(which: str) -> str | None:
live_dn = live.get(which)
if str(live_dn) == str(queue_number):
return captured.get(which) or live_dn
return None
client.set_ivr_routes(
ivr_id,
key0_dn=_restore("key0"),
timeout_dn=_restore("timeout"),
)
queue = client.get_queue(queue_number)
client.set_queue_agents(queue["Id"], [])
schedule.set_captured_ivr_routes(None)
schedule.set_holiday_activated(date, False)
logger.info(
"Deactivated holiday %s: restored IVR %s, cleared queue %s",
date,
ivr_number,
queue_number,
)
return {
"action": "deactivate",
"date": date,
"queue": str(queue_number),
"ivr": str(ivr_number),
}

223
src/shared/shared/portal_http.py
View file

@ -1,223 +0,0 @@
"""Cognito portal HTTP dispatch shared by Lambda and Flask."""
from __future__ import annotations
import json
import logging
from decimal import Decimal
from typing import Any
from urllib.parse import unquote
from shared.cognito import CognitoVerificationUnavailable, verify_cognito_id_token
from shared.portal_ops import ActionError, snapshot
from shared.schedule import ShiftSchedule
from shared import portal_ops as ops
logger = logging.getLogger(__name__)
CORS_ORIGINS = {
"https://internal.seahaven.com",
"https://internal.dev.seahaven.com",
"http://localhost:5173",
"http://localhost:4173",
}
class DecimalEncoder(json.JSONEncoder):
def default(self, o):
if isinstance(o, Decimal):
return float(o)
return super().default(o)
def cors_headers(origin: str) -> dict[str, str]:
out = {
"Content-Type": "application/json",
"Vary": "Origin",
}
if origin in CORS_ORIGINS:
out["Access-Control-Allow-Origin"] = origin
out["Access-Control-Allow-Headers"] = "Authorization,Content-Type"
out["Access-Control-Allow-Methods"] = "GET,POST,DELETE,OPTIONS"
return out
def identity_from_authorization(presented: str) -> dict:
parts = presented.split(None, 1)
if len(parts) != 2 or parts[0].lower() != "bearer" or not parts[1].strip():
raise ActionError(401, "UNAUTHORIZED", "Sign in to continue.")
try:
identity = verify_cognito_id_token(parts[1].strip())
except CognitoVerificationUnavailable as exc:
raise ActionError(
503, "AUTH_UNAVAILABLE", "Sign-in verification is unavailable."
) from exc
if not identity:
raise ActionError(401, "UNAUTHORIZED", "Sign in to continue.")
return identity
def parse_json_object(raw: bytes | str | None) -> dict:
if raw in (None, "", b""):
return {}
if isinstance(raw, bytes):
raw = raw.decode("utf-8")
try:
parsed = json.loads(raw)
except json.JSONDecodeError as exc:
raise ActionError(400, "INVALID_JSON", "Invalid JSON body.") from exc
if not isinstance(parsed, dict):
raise ActionError(400, "INVALID_JSON", "JSON body must be an object.")
return parsed
def encode_body(body: dict[str, Any] | None) -> str:
return json.dumps(
{} if body is None else body, cls=DecimalEncoder, separators=(",", ":")
)
def dispatch(
method: str,
path: str,
schedule: ShiftSchedule,
employee: dict,
body: dict,
) -> tuple[int, dict]:
parts = [p for p in path.split("/") if p]
if method == "POST" and path == "/api/shifts/pick":
return 200, ops.pick(
schedule, employee, body.get("date", ""), body.get("shiftType")
)
if method == "POST" and path == "/api/shifts/drop":
return 200, ops.drop(
schedule, employee, body.get("date", ""), body.get("shiftType")
)
if method == "POST" and path == "/api/shifts/swap":
return 200, ops.swap(
schedule,
employee,
body.get("date", ""),
body.get("targetExtension", ""),
body.get("shiftType"),
note=body.get("note"),
)
if (
method == "POST"
and len(parts) == 6
and parts[:3] == ["api", "shifts", "swaps"]
and parts[5]
in (
"accept",
"decline",
)
):
return 200, ops.respond_swap(
schedule,
employee,
unquote(parts[3]),
unquote(parts[4]),
accept=parts[5] == "accept",
)
if method == "POST" and path == "/api/shifts/admin/override":
return 200, ops.admin_override(
schedule,
employee,
body.get("date", ""),
body.get("extension", ""),
body.get("shiftType"),
)
if method == "POST" and path == "/api/shifts/admin/open":
return 200, ops.admin_open(
schedule, employee, body.get("date", ""), body.get("shiftType")
)
if method == "POST" and path == "/api/shifts/admin/clear":
return 200, ops.admin_clear(
schedule, employee, body.get("date", ""), body.get("shiftType")
)
if method == "POST" and path == "/api/shifts/admin/holidays":
return 200, ops.admin_holiday_add(
schedule,
employee,
body.get("date", ""),
body.get("slots"),
body.get("label", ""),
body.get("multiplier"),
)
if (
method == "DELETE"
and len(parts) == 5
and parts[:4] == ["api", "shifts", "admin", "holidays"]
):
return 200, ops.admin_holiday_remove(schedule, employee, unquote(parts[4]))
if (
method == "POST"
and len(parts) == 8
and parts[:4] == ["api", "shifts", "admin", "pickups"]
and parts[7] in ("approve", "deny")
):
return 200, ops.admin_pickup(
schedule,
employee,
unquote(parts[4]),
unquote(parts[5]),
unquote(parts[6]),
approve=parts[7] == "approve",
)
return 405, {"error": {"code": "METHOD", "message": "Method not allowed"}}
def handle(
*,
method: str,
path: str,
origin: str,
authorization: str,
query: dict | None,
body: bytes | str | None,
) -> tuple[int, dict[str, str], dict | None]:
headers = cors_headers(origin)
path = path.rstrip("/") or "/"
method = method.upper()
try:
if method == "OPTIONS":
return 204, headers, {}
identity = identity_from_authorization(authorization)
schedule = ShiftSchedule()
if method == "GET" and path == "/api/shifts":
employee = schedule.get_employee_by_email(identity["email"])
if not employee:
return (
200,
headers,
{
"linked": False,
"email": identity["email"],
"isAdmin": False,
},
)
week = (query or {}).get("week") or "this"
return 200, headers, snapshot(schedule, employee, week)
employee = schedule.get_employee_by_email(identity["email"])
if not employee:
raise ActionError(
404,
"UNLINKED",
"Your Google account is not on the after-hours roster yet.",
)
parsed = parse_json_object(body) if method in {"POST", "PUT", "PATCH"} else {}
status, payload = dispatch(method, path, schedule, employee, parsed)
return status, headers, payload
except ActionError as exc:
return (
exc.status,
headers,
{"error": {"code": exc.code, "message": exc.message}},
)
except Exception:
logger.exception("portal http unexpected failure")
return (
500,
headers,
{"error": {"code": "INTERNAL", "message": "Internal error"}},
)

764
src/shared/shared/portal_ops.py
View file

@ -1,764 +0,0 @@
"""Employee and admin shift mutations for the portal API."""
from __future__ import annotations
import re
from datetime import datetime, timedelta
from decimal import Decimal
from shared.schedule import FALLBACK_EXTENSION, WEEKEND_DAYS, ShiftSchedule, week_start
from shared.shift_clock import (
EASTERN,
holiday_window_active,
shift_end,
shift_ended,
shift_start,
shift_started,
within_drop_lock,
)
from shared import side_effects as effects
DATE_FMT = "%Y-%m-%d"
class ActionError(Exception):
def __init__(self, status: int, code: str, message: str):
super().__init__(message)
self.status = status
self.code = code
self.message = message
def _parse_date(date_str: str) -> datetime:
try:
return datetime.strptime(date_str, DATE_FMT).replace(tzinfo=EASTERN)
except ValueError as exc:
raise ActionError(400, "INVALID_DATE", "Date must be YYYY-MM-DD.") from exc
def _shift_type(value: str | None) -> str:
shift_type = (value or "night").strip().lower()
if shift_type not in ("day", "night"):
raise ActionError(400, "INVALID_SHIFT", "Shift type must be day or night.")
return shift_type
def is_admin(schedule: ShiftSchedule, employee: dict) -> bool:
slack_id = employee.get("slack_user_id") or ""
return bool(slack_id) and slack_id in schedule.get_admin_users()
def require_admin(schedule: ShiftSchedule, employee: dict) -> None:
if not is_admin(schedule, employee):
raise ActionError(403, "FORBIDDEN", "Admin access required.")
def public_employee(item: dict) -> dict:
return {
"extension": item.get("extension") or item.get("SK", ""),
"name": item.get("name", ""),
"email": item.get("email") or "",
"slackUserId": item.get("slack_user_id") or "",
}
def _json_safe(value):
if isinstance(value, Decimal):
return float(value)
return value
def _slot_payload(
schedule: ShiftSchedule, date_str: str, day_name: str, shift_type: str, my_ext: str
) -> dict:
ctx = schedule.get_shift_context(date_str, day_name, shift_type)
assignees = [
{"extension": a["extension"], "name": a["name"]} for a in ctx["assignees"]
]
mine = any(a["extension"] == my_ext for a in assignees)
open_slots = int(ctx["open_slots"])
return {
"kind": ctx["kind"],
"shiftType": shift_type,
"label": ctx.get("label") or "",
"slots": int(ctx["slots"]),
"openSlots": open_slots,
"multiplier": _json_safe(ctx.get("multiplier") or 1),
"assignees": assignees,
"mine": mine,
"canPick": (not mine)
and open_slots > 0
and not shift_ended(date_str, shift_type),
"canDrop": mine
and not within_drop_lock(
date_str, "day" if ctx["kind"] == "holiday" else shift_type
),
"latePickup": (not mine)
and open_slots > 0
and shift_started(date_str, shift_type)
and not shift_ended(date_str, shift_type),
}
def week_range(which: str) -> tuple[datetime, str]:
"""Sunday–Saturday window. ``next`` is the following Sunday."""
now = datetime.now(EASTERN)
start = week_start(now)
if which == "next":
start = start + timedelta(days=7)
label = "this" if which != "next" else "next"
return start, label
def snapshot(schedule: ShiftSchedule, employee: dict, week: str = "this") -> dict:
start, label = week_range(week)
my_ext = employee["extension"]
days = []
for offset in range(7):
day = start + timedelta(days=offset)
date_str = day.strftime(DATE_FMT)
day_name = day.strftime("%A")
slots = []
if day_name in WEEKEND_DAYS or schedule.get_holiday(date_str) is not None:
slots.append(_slot_payload(schedule, date_str, day_name, "day", my_ext))
slots.append(_slot_payload(schedule, date_str, day_name, "night", my_ext))
days.append(
{
"date": date_str,
"dayName": day_name,
"slots": slots,
}
)
pending_swaps = [
_swap_payload(item, my_ext)
for item in schedule.list_pending_swaps()
if item.get("target_ext") == my_ext or item.get("requester_ext") == my_ext
]
payload = {
"linked": True,
"week": label,
"weekStart": start.strftime(DATE_FMT),
"me": public_employee(employee),
"isAdmin": is_admin(schedule, employee),
"days": days,
"pendingSwaps": pending_swaps,
"roster": [public_employee(item) for item in schedule.get_roster()],
}
if payload["isAdmin"]:
payload["pendingPickups"] = [
_pickup_payload(item) for item in schedule.list_pending_pickup_requests()
]
payload["upcomingHolidays"] = [
{
"date": item["SK"],
"label": item.get("label", ""),
"slots": int(item.get("slots", 0)),
"multiplier": _json_safe(item.get("multiplier") or 1.5),
}
for item in schedule.list_holidays(datetime.now(EASTERN).strftime(DATE_FMT))
]
return payload
NOTE_MAX = 500
def _clean_swap_note(note: str | None) -> str | None:
if note is None:
return None
if not isinstance(note, str):
raise ActionError(400, "INVALID_NOTE", "Note must be text.")
cleaned = note.strip()
if not cleaned:
return None
if len(cleaned) > NOTE_MAX:
raise ActionError(400, "NOTE_TOO_LONG", "Note must be 500 characters or fewer.")
return cleaned
def _swap_payload(item: dict, my_ext: str) -> dict:
date_str, shift_type = _sk_to_date_shift(item.get("SK", ""))
payload = {
"date": date_str,
"shiftType": item.get("shift_type") or shift_type,
"requesterExt": item.get("requester_ext", ""),
"requesterName": item.get("requester_name", ""),
"targetExt": item.get("target_ext", ""),
"targetName": item.get("target_name", ""),
"incoming": item.get("target_ext") == my_ext,
}
note = item.get("note")
if isinstance(note, str) and note.strip():
payload["note"] = note.strip()
return payload
def _pickup_payload(item: dict) -> dict:
sk = item.get("SK", "")
date_str, shift_type, ext = _pickup_sk_parts(sk)
return {
"date": date_str,
"shiftType": item.get("shift_type") or shift_type,
"requesterExt": item.get("requester_ext") or ext,
"requesterName": item.get("requester_name", ""),
"isHoliday": bool(item.get("is_holiday")),
}
def _sk_to_date_shift(sk: str) -> tuple[str, str]:
if sk.endswith("-DAY"):
return sk[:-4], "day"
return sk, "night"
def _pickup_sk_parts(sk: str) -> tuple[str, str, str]:
prefix, _, ext = sk.partition("#")
date_str, shift_type = _sk_to_date_shift(prefix)
return date_str, shift_type, ext
def pick(
schedule: ShiftSchedule, employee: dict, date_str: str, shift_type: str | None
) -> dict:
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
if date_str < datetime.now(EASTERN).strftime(DATE_FMT):
raise ActionError(400, "PAST_SHIFT", "You can't pick up a shift in the past.")
day_name = date.strftime("%A")
shift_type = _resolve_pick_type(schedule, date_str, day_name, shift_type)
ctx = schedule.get_shift_context(date_str, day_name, shift_type)
token = effects.slack_token()
if ctx["kind"] == "holiday":
return _pick_holiday(schedule, employee, date, date_str, ctx, token)
return _pick_regular(
schedule, employee, date, date_str, day_name, shift_type, ctx, token
)
def _resolve_pick_type(schedule, date_str, day_name, explicit) -> str:
if explicit:
return _shift_type(explicit)
if schedule.get_shift_context(date_str, day_name, "day")["kind"] == "holiday":
return "day"
if day_name in WEEKEND_DAYS:
for st in ("day", "night"):
_ext, _name, source = schedule.resolve_shift(date_str, day_name, st)
if source == "available":
return st
return "night"
def _pick_regular(
schedule, employee, date, date_str, day_name, shift_type, ctx, token
) -> dict:
assignees = ctx["assignees"]
if assignees and assignees[0]["extension"] != employee["extension"]:
raise ActionError(
409,
"COVERED",
f"That shift is already covered by {assignees[0]['name']}.",
)
if shift_ended(date_str, shift_type):
raise ActionError(400, "ENDED", "That shift has already ended.")
if shift_started(date_str, shift_type):
return _request_late_pickup(
schedule, employee, date_str, shift_type, False, token
)
already_mine = (
bool(assignees) and assignees[0]["extension"] == employee["extension"]
)
if not already_mine:
claimed = schedule.claim_open_shift(
date_str, employee["extension"], employee["name"], shift_type
)
if not claimed:
raise ActionError(
409, "TAKEN", "That shift was just picked up by someone else."
)
effects.maybe_repoint_today(date_str, shift_type, employee["extension"])
effects.post_shift_change(
token,
employee.get("slack_user_id", ""),
date_str,
"picked_up",
employee["extension"],
employee["name"],
shift_type,
)
effects.refresh_schedule_post(schedule, token)
return {"ok": True, "latePickup": False, "message": "Shift picked up."}
def _pick_holiday(schedule, employee, date, date_str, ctx, token) -> dict:
ext = employee["extension"]
if any(a["extension"] == ext for a in ctx["assignees"]):
raise ActionError(409, "ALREADY_ON", "You're already on that holiday shift.")
if shift_ended(date_str, "day"):
raise ActionError(400, "ENDED", "That holiday shift has already ended.")
if shift_started(date_str, "day"):
return _request_late_pickup(schedule, employee, date_str, "day", True, token)
claimed = schedule.claim_holiday_slot(date_str, ext, employee["name"])
if not claimed:
raise ActionError(409, "FULL", "Couldn't claim a holiday slot.")
if holiday_window_active(date_str):
effects.set_holiday_queue_agents(schedule, date_str)
effects.post_shift_change(
token,
employee.get("slack_user_id", ""),
date_str,
"picked_up",
ext,
employee["name"],
"day",
)
effects.refresh_schedule_post(schedule, token)
return {"ok": True, "latePickup": False, "message": "Holiday slot claimed."}
def _request_late_pickup(
schedule, employee, date_str, shift_type, is_holiday, token
) -> dict:
schedule.create_pickup_request(
date_str,
shift_type,
employee,
expires_at=int(shift_end(date_str, shift_type).timestamp()),
is_holiday=is_holiday,
)
delivered = effects.dm_late_pickup_admins(
schedule, token, employee, date_str, shift_type, is_holiday
)
if delivered == 0:
schedule.clear_pickup_request(date_str, shift_type, employee["extension"])
raise ActionError(
503,
"NO_ADMIN",
"That shift has started and needs admin approval, but no admin could be reached.",
)
return {
"ok": True,
"latePickup": True,
"message": "Pickup needs admin approval. Admins were notified in Slack and will see it here.",
}
def drop(
schedule: ShiftSchedule, employee: dict, date_str: str, shift_type: str | None
) -> dict:
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
if date_str < datetime.now(EASTERN).strftime(DATE_FMT):
raise ActionError(400, "PAST_SHIFT", "You can't drop a shift in the past.")
day_name = date.strftime("%A")
held = _droppable(schedule, date_str, day_name, employee["extension"])
if shift_type:
target = shift_type.strip().lower()
if target == "holiday":
target = "holiday"
elif target in ("day", "night"):
target = target
else:
raise ActionError(
400, "INVALID_SHIFT", "Shift type must be day, night, or holiday."
)
if target == "day" and "holiday" in held:
target = "holiday"
if target not in held:
raise ActionError(409, "NOT_YOURS", "You don't hold that shift.")
elif not held:
raise ActionError(409, "NOT_YOURS", "That's not your shift.")
elif len(held) > 1:
raise ActionError(
409,
"AMBIGUOUS",
"You hold more than one shift that day. Specify day, night, or holiday.",
)
else:
target = held[0]
token = effects.slack_token()
if target == "holiday":
if within_drop_lock(date_str, "day"):
raise ActionError(
409,
"DROP_LOCK",
"This shift starts in under 24 hours. Swap it or ask an admin.",
)
released = schedule.release_holiday_slot(date_str, employee["extension"])
if not released:
raise ActionError(409, "NOT_YOURS", "You don't hold that holiday slot.")
effects.post_shift_change(
token,
employee.get("slack_user_id", ""),
date_str,
"dropped",
employee["extension"],
employee["name"],
"day",
)
effects.refresh_schedule_post(schedule, token)
return {"ok": True, "message": "Holiday slot dropped."}
if within_drop_lock(date_str, target):
raise ActionError(
409,
"DROP_LOCK",
"This shift starts in under 24 hours. Swap it or ask an admin.",
)
schedule.mark_open(date_str, target)
effects.post_shift_change(
token,
employee.get("slack_user_id", ""),
date_str,
"dropped",
employee["extension"],
employee["name"],
target,
)
effects.refresh_schedule_post(schedule, token)
return {"ok": True, "message": "Shift dropped."}
def _droppable(schedule, date_str, day_name, employee_ext) -> list[str]:
held = []
holiday_ctx = schedule.get_shift_context(date_str, day_name, "day")
if holiday_ctx["kind"] == "holiday":
if any(a["extension"] == employee_ext for a in holiday_ctx["assignees"]):
held.append("holiday")
elif day_name in WEEKEND_DAYS:
ext, _name, _source = schedule.resolve_shift(date_str, day_name, "day")
if ext == employee_ext:
held.append("day")
ext, _name, _source = schedule.resolve_shift(date_str, day_name, "night")
if ext == employee_ext:
held.append("night")
return held
def swap(
schedule: ShiftSchedule,
employee: dict,
date_str: str,
target_extension: str,
shift_type: str | None,
note: str | None = None,
) -> dict:
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
if date_str < datetime.now(EASTERN).strftime(DATE_FMT):
raise ActionError(400, "PAST_SHIFT", "You can't swap a shift in the past.")
day_name = date.strftime("%A")
holiday_ctx = schedule.get_shift_context(date_str, day_name, "day")
holiday_swap = holiday_ctx["kind"] == "holiday" and any(
a["extension"] == employee["extension"] for a in holiday_ctx["assignees"]
)
if holiday_swap:
resolved = "day"
else:
found = None
if day_name in WEEKEND_DAYS:
for st in ("day", "night"):
ext, _name, _source = schedule.resolve_shift(date_str, day_name, st)
if ext == employee["extension"]:
found = st
break
else:
ext, _name, _source = schedule.resolve_shift(date_str, day_name, "night")
if ext == employee["extension"]:
found = "night"
if not found:
raise ActionError(409, "NOT_YOURS", "You can only swap your own shifts.")
resolved = found
if shift_type and _shift_type(shift_type) != resolved and not holiday_swap:
if _shift_type(shift_type) != resolved:
raise ActionError(409, "NOT_YOURS", "You don't hold that shift type.")
target = schedule.get_employee_by_extension((target_extension or "").strip())
if not target:
raise ActionError(400, "UNKNOWN_TARGET", "That extension is not on the roster.")
if target["extension"] == employee["extension"]:
raise ActionError(400, "SELF_SWAP", "That shift is already yours.")
cleaned_note = _clean_swap_note(note)
expires_at = int(shift_start(date_str, resolved).timestamp())
schedule.create_pending_swap(
date_str, resolved, employee, target, expires_at, note=cleaned_note
)
token = effects.slack_token()
if target.get("slack_user_id"):
effects.dm_swap_request(
token,
employee.get("slack_user_id", ""),
target["slack_user_id"],
date_str,
resolved,
employee["name"],
note=cleaned_note,
)
return {
"ok": True,
"message": f"Swap request sent to {target['name']}. They can accept here or in Slack.",
}
def respond_swap(
schedule: ShiftSchedule,
employee: dict,
date_str: str,
shift_type: str,
accept: bool,
) -> dict:
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
shift_type = _shift_type(shift_type)
swap_row = schedule.get_swap(date_str, shift_type)
if (
not swap_row
or swap_row.get("status") != "pending"
or swap_row.get("target_ext") != employee["extension"]
):
raise ActionError(404, "NOT_FOUND", "This swap request is no longer valid.")
token = effects.slack_token()
if not accept:
schedule.clear_swap(date_str, shift_type)
if swap_row.get("requester_slack"):
effects.dm_text(
token,
swap_row["requester_slack"],
f"{employee['name']} declined your swap for {date_str}.",
)
return {"ok": True, "message": "Swap declined."}
if shift_started(date_str, shift_type):
schedule.clear_swap(date_str, shift_type)
raise ActionError(
409, "EXPIRED", "This swap expired because the shift has started."
)
is_holiday = shift_type == "day" and schedule.get_holiday(date_str) is not None
if is_holiday:
moved = schedule.swap_holiday_assignee(
date_str,
swap_row["requester_ext"],
swap_row["target_ext"],
employee["name"],
)
if not moved:
schedule.clear_swap(date_str, shift_type)
raise ActionError(409, "CONFLICT", "Couldn't move that holiday slot.")
if holiday_window_active(date_str):
effects.set_holiday_queue_agents(schedule, date_str)
else:
current_ext, _name, _source = schedule.resolve_shift(
date_str, date.strftime("%A"), shift_type
)
if current_ext != swap_row["requester_ext"]:
schedule.clear_swap(date_str, shift_type)
raise ActionError(
409,
"CONFLICT",
"The shift is no longer assigned to the person who requested the swap.",
)
moved = schedule.reassign_if_held_by(
date_str,
swap_row["requester_ext"],
employee["extension"],
employee["name"],
shift_type,
)
if not moved:
schedule.clear_swap(date_str, shift_type)
raise ActionError(409, "CONFLICT", "Couldn't move that shift.")
effects.maybe_repoint_today(date_str, shift_type, employee["extension"])
schedule.mark_swap_verified(date_str, shift_type)
if swap_row.get("requester_slack"):
effects.dm_text(
token,
swap_row["requester_slack"],
f"{employee['name']} accepted your swap for {date_str}.",
)
effects.post_shift_change(
token,
employee.get("slack_user_id", ""),
date_str,
"swapped",
employee["extension"],
employee["name"],
shift_type,
)
effects.refresh_schedule_post(schedule, token)
return {"ok": True, "message": "Swap accepted."}
def admin_override(schedule, employee, date_str, extension, shift_type) -> dict:
require_admin(schedule, employee)
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
shift_type = _shift_type(shift_type)
target = schedule.get_employee_by_extension((extension or "").strip())
if not target:
raise ActionError(400, "UNKNOWN_TARGET", "That extension is not on the roster.")
schedule.set_override(date_str, target["extension"], target["name"], shift_type)
repointed = effects.maybe_repoint_today(date_str, shift_type, target["extension"])
effects.refresh_schedule_post(schedule, effects.slack_token())
return {
"ok": True,
"repointed": repointed,
"message": f"Override set for {target['name']}.",
}
def admin_open(schedule, employee, date_str, shift_type) -> dict:
require_admin(schedule, employee)
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
shift_type = _shift_type(shift_type)
schedule.mark_open(date_str, shift_type)
repointed = effects.maybe_repoint_today(date_str, shift_type, FALLBACK_EXTENSION)
effects.refresh_schedule_post(schedule, effects.slack_token())
return {
"ok": True,
"repointed": repointed,
"message": "Shift marked open.",
}
def admin_clear(schedule, employee, date_str, shift_type) -> dict:
require_admin(schedule, employee)
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
shift_type = _shift_type(shift_type)
schedule.remove_override(date_str, shift_type)
resolved_ext, _name, _source = schedule.resolve_shift(
date_str, date.strftime("%A"), shift_type
)
repointed = effects.maybe_repoint_today(date_str, shift_type, resolved_ext)
effects.refresh_schedule_post(schedule, effects.slack_token())
return {
"ok": True,
"repointed": repointed,
"message": "Override cleared.",
}
def admin_holiday_add(schedule, employee, date_str, slots, label, multiplier) -> dict:
require_admin(schedule, employee)
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
if date_str < datetime.now(EASTERN).strftime(DATE_FMT):
raise ActionError(
400, "PAST_SHIFT", "You can't schedule a holiday in the past."
)
try:
slot_count = int(slots)
except (TypeError, ValueError) as exc:
raise ActionError(
400, "INVALID_SLOTS", "Slots must be a whole number."
) from exc
if slot_count < 1:
raise ActionError(400, "INVALID_SLOTS", "Slots must be at least 1.")
name = (label or "").strip()
if not name:
raise ActionError(400, "INVALID_LABEL", "A holiday label is required.")
multiplier_value = None
if multiplier is not None and str(multiplier).strip():
match = re.fullmatch(r"x?([0-9]+(?:\.[0-9]+)?)", str(multiplier).strip(), re.I)
if not match:
raise ActionError(
400,
"INVALID_MULTIPLIER",
"Multiplier must be a number like 2 or 1.5.",
)
multiplier_value = Decimal(match.group(1))
token = effects.slack_token()
names = effects.create_holiday_schedules(date_str)
created = schedule.create_holiday(
date_str,
slots=slot_count,
label=name,
created_by=employee.get("slack_user_id") or employee.get("email") or "",
multiplier=multiplier_value,
schedule_names=names,
)
if not created:
effects.delete_holiday_schedules(names)
raise ActionError(409, "EXISTS", "A holiday already exists on that date.")
if holiday_window_active(date_str):
effects.activate_holiday_inline(schedule, date_str)
holiday = schedule.get_holiday(date_str)
effects.post_holiday_added(
token,
date_str,
name,
slot_count,
holiday["multiplier"] if holiday else multiplier,
)
effects.refresh_schedule_post(schedule, token)
return {"ok": True, "message": f"Scheduled {name}."}
def admin_holiday_remove(schedule, employee, date_str) -> dict:
require_admin(schedule, employee)
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
holiday = schedule.get_holiday(date_str)
if not holiday:
raise ActionError(404, "NOT_FOUND", "No holiday on that date.")
effects.delete_holiday_schedules(list(holiday.get("schedule_names") or []))
schedule.remove_holiday(date_str)
effects.refresh_schedule_post(schedule, effects.slack_token())
return {"ok": True, "message": "Holiday removed."}
def admin_pickup(
schedule, employee, date_str, shift_type, extension, approve: bool
) -> dict:
require_admin(schedule, employee)
date = _parse_date(date_str)
date_str = date.strftime(DATE_FMT)
shift_type = _shift_type(shift_type)
ext = (extension or "").strip()
req = schedule.get_pickup_request(date_str, shift_type, ext)
if not req or req.get("status") != "pending":
raise ActionError(404, "NOT_FOUND", "This pickup request is no longer pending.")
token = effects.slack_token()
if not approve:
schedule.clear_pickup_request(date_str, shift_type, ext)
if req.get("requester_slack"):
effects.dm_text(
token,
req["requester_slack"],
f"Your late pickup for {date_str} was denied.",
)
return {"ok": True, "message": "Pickup denied."}
if shift_ended(date_str, shift_type):
schedule.clear_pickup_request(date_str, shift_type, ext)
raise ActionError(409, "EXPIRED", "This pickup request expired.")
if not schedule.approve_pickup_request(date_str, shift_type, ext):
raise ActionError(409, "NOT_FOUND", "This pickup request is no longer pending.")
requester_name = req.get("requester_name", ext)
if req.get("is_holiday"):
claimed = schedule.claim_holiday_slot(date_str, ext, requester_name)
if not claimed:
schedule.clear_pickup_request(date_str, shift_type, ext)
raise ActionError(409, "FULL", "Couldn't assign the holiday slot.")
if holiday_window_active(date_str):
effects.set_holiday_queue_agents(schedule, date_str)
else:
claimed = schedule.claim_open_shift(date_str, ext, requester_name, shift_type)
if not claimed:
schedule.clear_pickup_request(date_str, shift_type, ext)
raise ActionError(409, "COVERED", "Couldn't assign the shift.")
effects.maybe_repoint_today(date_str, shift_type, ext)
schedule.clear_pickup_request(date_str, shift_type, ext)
if req.get("requester_slack"):
effects.dm_text(
token,
req["requester_slack"],
f"Your late pickup for {date_str} was approved.",
)
effects.post_shift_change(
token,
req.get("requester_slack", ""),
date_str,
"picked_up",
ext,
requester_name,
shift_type,
)
effects.refresh_schedule_post(schedule, token)
return {"ok": True, "message": "Pickup approved."}

9
src/shared/shared/ring_scheduler.py
View file

@ -2,7 +2,7 @@
import logging
from shared.three_cx_client import oauth_client
from shared.three_cx_client import ThreeCXClient
logger = logging.getLogger(__name__)
@ -15,7 +15,12 @@ def update_queue_routing(
client_secret: str,
) -> dict:
"""Update 3CX queue forwarding to route calls to the given extension."""
client = oauth_client(domain, client_id, client_secret)
client = ThreeCXClient(
domain=domain,
auth_mode="oauth",
client_id=client_id,
client_secret=client_secret,
)
queue = client.get_queue(queue_number)
client.update_queue_forwarding(
queue_id=queue["Id"],

165
src/shared/shared/roster_http.py
View file

@ -1,165 +0,0 @@
"""Roster PUT/DELETE helpers shared by Lambda and Flask."""
from __future__ import annotations
import hmac
import json
import logging
import os
import unicodedata
from shared.schedule import ShiftSchedule
from shared.secrets import get_secret
logger = logging.getLogger(__name__)
PUT_FIELDS = ("name", "extension", "slack_user_id")
OPTIONAL_PUT_FIELDS = ("email",)
MAX_BODY_BYTES = 4096
MAX_NAME_LEN = 128
MAX_EXTENSION_LEN = 16
MAX_SLACK_ID_LEN = 64
MAX_EMAIL_LEN = 254
ALLOWED_EMAIL_DOMAINS = {"seahaven.com", "seahavenind.com"}
_cached_token: str | None = None
class AuthError(Exception):
"""Missing or wrong Bearer token."""
class SecretUnavailable(Exception):
"""Token secret could not be read."""
def has_disallowed_chars(value: str, *, allow_space: bool) -> bool:
for char in value:
if char == " " and allow_space:
continue
if char.isspace() or unicodedata.category(char).startswith("C"):
return True
return False
def expected_token() -> str:
global _cached_token
if _cached_token:
return _cached_token
secret_id = os.environ["ROSTER_API_TOKEN_SECRET"]
try:
token = get_secret(secret_id)
except Exception:
logger.exception("roster api token secret read failed")
raise SecretUnavailable from None
if not isinstance(token, str):
raise SecretUnavailable
token = token.strip()
if not token:
raise SecretUnavailable
_cached_token = token
return token
def authorize_bearer(presented: str) -> None:
if not presented:
raise AuthError
parts = presented.split(None, 1)
if len(parts) != 2 or parts[0].lower() != "bearer" or not parts[1].strip():
raise AuthError
token = parts[1].strip()
expected = expected_token()
try:
matched = hmac.compare_digest(token, expected)
except (TypeError, ValueError):
raise AuthError from None
if not matched:
raise AuthError
def validate_email(value: str) -> str:
if (
len(value) > MAX_EMAIL_LEN
or "@" not in value
or has_disallowed_chars(value, allow_space=False)
):
raise ValueError("fields")
local, _, domain = value.partition("@")
if not local or domain.lower() not in ALLOWED_EMAIL_DOMAINS:
raise ValueError("fields")
return value.lower()
def validate_put(raw: bytes) -> tuple[str, str, str, str | None]:
if len(raw) > MAX_BODY_BYTES:
raise ValueError("oversized")
try:
parsed = json.loads(raw.decode("utf-8"))
except (UnicodeDecodeError, json.JSONDecodeError):
raise ValueError("invalid json") from None
if not isinstance(parsed, dict):
raise TypeError("invalid json")
allowed = set(PUT_FIELDS) | set(OPTIONAL_PUT_FIELDS)
if not set(PUT_FIELDS).issubset(parsed) or not set(parsed).issubset(allowed):
raise ValueError("fields")
values: dict[str, str] = {}
for field in PUT_FIELDS:
value = parsed[field]
if not isinstance(value, str):
raise TypeError("fields")
trimmed = value.strip()
if not trimmed:
raise ValueError("fields")
values[field] = trimmed
name = values["name"]
extension = values["extension"]
slack_user_id = values["slack_user_id"]
email = None
if "email" in parsed:
raw_email = parsed["email"]
if not isinstance(raw_email, str):
raise TypeError("fields")
trimmed_email = raw_email.strip()
if not trimmed_email:
raise ValueError("fields")
email = validate_email(trimmed_email)
if len(name) > MAX_NAME_LEN or has_disallowed_chars(name, allow_space=True):
raise ValueError("fields")
if (
len(extension) > MAX_EXTENSION_LEN
or not extension.isdigit()
or has_disallowed_chars(extension, allow_space=False)
):
raise ValueError("fields")
if (
len(slack_user_id) > MAX_SLACK_ID_LEN
or not slack_user_id.isalnum()
or has_disallowed_chars(slack_user_id, allow_space=False)
):
raise ValueError("fields")
return name, extension, slack_user_id, email
def validate_extension(raw: str) -> str:
extension = raw.strip()
if (
not extension
or len(extension) > MAX_EXTENSION_LEN
or not extension.isdigit()
or has_disallowed_chars(extension, allow_space=False)
):
raise ValueError("extension")
return extension
def upsert(raw: bytes) -> None:
name, extension, slack_user_id, email = validate_put(raw)
ShiftSchedule().upsert_roster_entry(extension, name, slack_user_id, email=email)
logger.info("roster upserted extension=%s", extension)
def remove(extension: str) -> None:
ShiftSchedule().remove_roster_entry(extension)
logger.info("roster deleted extension=%s", extension)

162
src/shared/shared/schedule.py
View file

@ -10,7 +10,7 @@ Single-table design:
"""
import os
from datetime import datetime, timedelta
from datetime import datetime
from decimal import Decimal
from zoneinfo import ZoneInfo
@ -36,21 +36,6 @@ DEFAULT_HOLIDAY_QUEUE = "802"
DEFAULT_IVR_NUMBER = "800"
def week_start(when: datetime) -> datetime:
"""Sunday 00:00 Eastern of the Sun–Sat work week that contains ``when``.
Shifts belong to the week of their start date. A Saturday night shift
(5pm Saturday through 8am Sunday) stays in the week that ends Saturday.
Sunday day and Sunday night open the next week.
"""
if when.tzinfo is None:
when = when.replace(tzinfo=EASTERN)
else:
when = when.astimezone(EASTERN)
when = when.replace(hour=0, minute=0, second=0, microsecond=0)
return when - timedelta(days=(when.weekday() + 1) % 7)
def determine_shift_type(now: datetime | None = None) -> str:
"""Return the currently active shift type: 'day' or 'night'.
@ -85,17 +70,6 @@ class ShiftSchedule:
return item
return None
def get_employee_by_email(self, email: str) -> dict | None:
"""Match a roster row by email, case-insensitive."""
wanted = email.strip().lower()
if not wanted:
return None
for item in self.get_roster():
stored = item.get("email")
if isinstance(stored, str) and stored.strip().lower() == wanted:
return item
return None
def register_user(self, slack_user_id: str, extension: str) -> dict | None:
"""Link a Slack user to a roster extension.
@ -223,35 +197,6 @@ class ShiftSchedule:
sk = f"{date_str}-DAY" if shift_type == "day" else date_str
self.table.delete_item(Key={"PK": "OVERRIDE", "SK": sk})
def list_overrides(self, start_date_str: str, end_date_str: str) -> list[dict]:
"""Return overrides in the inclusive date range, ordered by date/shift.
A bounded SK range query (not a full scan): night overrides key on
``<date>`` and day overrides on ``<date>-DAY``, both of which sort within
``[start, end-DAY]``. Each result carries ``date``, ``shift_type``
('day'/'night'), ``extension`` ('OPEN' for an open shift), and ``name``.
"""
resp = self.table.query(
KeyConditionExpression=Key("PK").eq("OVERRIDE")
& Key("SK").between(start_date_str, f"{end_date_str}-DAY")
)
results = []
for item in sorted(resp.get("Items", []), key=lambda x: x["SK"]):
sk = item["SK"]
if sk.endswith("-DAY"):
date_str, shift_type = sk[:-4], "day"
else:
date_str, shift_type = sk, "night"
results.append(
{
"date": date_str,
"shift_type": shift_type,
"extension": item.get("extension", ""),
"name": item.get("name", ""),
}
)
return results
# ── Swap requests ───────────────────────────────────────────────────
def create_pending_swap(
@ -261,32 +206,29 @@ class ShiftSchedule:
requester: dict,
target: dict,
expires_at: int,
note: str | None = None,
) -> None:
"""Create (or supersede) a pending swap request for a shift.
One swap per shift (unique SK), so a new request overwrites any prior
pending one. ``expires_at`` is an epoch timestamp used for DynamoDB TTL.
``note`` is omitted when empty so Slack ``/oncall swap`` stays unchanged.
"""
sk = f"{date_str}-DAY" if shift_type == "day" else date_str
item = {
"PK": "SWAP",
"SK": sk,
"shift_type": shift_type,
"status": "pending",
"requester_ext": requester["extension"],
"requester_name": requester["name"],
"requester_slack": requester.get("slack_user_id", ""),
"target_ext": target["extension"],
"target_name": target["name"],
"target_slack": target.get("slack_user_id", ""),
"created_at": datetime.now(EASTERN).isoformat(),
"expires_at": expires_at,
}
if note:
item["note"] = note
self.table.put_item(Item=item)
self.table.put_item(
Item={
"PK": "SWAP",
"SK": sk,
"shift_type": shift_type,
"status": "pending",
"requester_ext": requester["extension"],
"requester_name": requester["name"],
"requester_slack": requester.get("slack_user_id", ""),
"target_ext": target["extension"],
"target_name": target["name"],
"target_slack": target.get("slack_user_id", ""),
"created_at": datetime.now(EASTERN).isoformat(),
"expires_at": expires_at,
}
)
def get_swap(self, date_str: str, shift_type: str = "night") -> dict | None:
sk = f"{date_str}-DAY" if shift_type == "day" else date_str
@ -309,12 +251,6 @@ class ShiftSchedule:
sk = f"{date_str}-DAY" if shift_type == "day" else date_str
self.table.delete_item(Key={"PK": "SWAP", "SK": sk})
def list_pending_swaps(self) -> list[dict]:
resp = self.table.query(KeyConditionExpression=Key("PK").eq("SWAP"))
return [
item for item in resp.get("Items", []) if item.get("status") == "pending"
]
# ── Late-pickup requests ─────────────────────────────────────────────
@staticmethod
@ -399,12 +335,6 @@ class ShiftSchedule:
except self.table.meta.client.exceptions.ConditionalCheckFailedException:
return False
def list_pending_pickup_requests(self) -> list[dict]:
resp = self.table.query(KeyConditionExpression=Key("PK").eq("PICKUP_REQUEST"))
return [
item for item in resp.get("Items", []) if item.get("status") == "pending"
]
# ── Holidays ────────────────────────────────────────────────────────
def get_holiday(self, date_str: str) -> dict | None:
@ -457,14 +387,6 @@ class ShiftSchedule:
def remove_holiday(self, date_str: str) -> None:
self.table.delete_item(Key={"PK": "HOLIDAY", "SK": date_str})
def list_holidays(self, start_date_str: str) -> list[dict]:
"""Return holiday records on or after ``start_date_str``, ordered by date."""
resp = self.table.query(
KeyConditionExpression=Key("PK").eq("HOLIDAY")
& Key("SK").gte(start_date_str)
)
return sorted(resp.get("Items", []), key=lambda x: x["SK"])
def claim_holiday_slot(self, date_str: str, extension: str, name: str) -> bool:
"""Atomically add an assignee to a holiday slot.
@ -661,27 +583,12 @@ class ShiftSchedule:
# ── Pay records ─────────────────────────────────────────────────────
def get_pay_record(self, week_key: str) -> dict | None:
"""Get a pay record by week key (the Sunday that opens the week)."""
"""Get a pay record by week key (e.g. '2026-04-06')."""
resp = self.table.get_item(Key={"PK": "PAY", "SK": week_key})
return resp.get("Item")
def list_pay_records(self) -> list[dict]:
"""Return every PAY row, including legacy Monday-keyed weeks."""
items: list[dict] = []
kwargs: dict = {"KeyConditionExpression": Key("PK").eq("PAY")}
while True:
resp = self.table.query(**kwargs)
items.extend(resp.get("Items", []))
last = resp.get("LastEvaluatedKey")
if not last:
return items
kwargs["ExclusiveStartKey"] = last
def save_pay_record(self, week_key: str, record: dict) -> None:
"""Save a weekly pay summary. week_key is the Sunday date string.
Older rows may still be keyed by Monday. New writes use Sunday.
"""
"""Save a weekly pay summary. week_key is the Monday date string."""
self.table.put_item(Item={"PK": "PAY", "SK": week_key, **record})
# ── Config ──────────────────────────────────────────────────────────
@ -756,37 +663,6 @@ class ShiftSchedule:
except self.table.meta.client.exceptions.ConditionalCheckFailedException:
return False
def upsert_roster_entry(
self,
extension: str,
name: str,
slack_user_id: str,
email: str | None = None,
) -> None:
"""Create or update a roster row without clobbering unrelated attributes.
Always writes ``name``, ``extension``, and ``slack_user_id``. ``email`` is
written when provided and left untouched when omitted. An existing
``shift_rate`` (and any other attributes) survive. Unlike
:meth:`add_roster_entry`, this is an upsert and writes the Slack id.
"""
names = {"#n": "name"}
values = {
":name": name,
":ext": extension,
":sid": slack_user_id,
}
expression = "SET #n = :name, extension = :ext, slack_user_id = :sid"
if email is not None:
expression += ", email = :email"
values[":email"] = email
self.table.update_item(
Key={"PK": "ROSTER", "SK": extension},
UpdateExpression=expression,
ExpressionAttributeNames=names,
ExpressionAttributeValues=values,
)
def remove_roster_entry(self, extension: str) -> None:
self.table.delete_item(Key={"PK": "ROSTER", "SK": extension})

161
src/shared/shared/sentry_init.py
View file

@ -1,161 +0,0 @@
"""Shared Sentry SDK init for every afterhours-shift-manager Lambda.
Imported for side effect from each handler. ``init_sentry()`` is a no-op when
``SENTRY_DSN`` is unset so pytest, local invokes, and a missing SAM parameter
never talk to Sentry. ``before_send`` strips auth and Slack signing headers,
drops request/extra keys that can hold Slack payloads or 3CX credential
material, and removes exception stack-frame locals.
``include_local_variables=False`` keeps those locals out of the event in the
first place.
"""
import os
import sentry_sdk
from sentry_sdk.integrations.aws_lambda import AwsLambdaIntegration
_HEADER_DROP_NAMES = frozenset(
{
"authorization",
"x-auth-token",
"cookie",
"x-amz-security-token",
"x-slack-signature",
}
)
_DROP_REQUEST_KEYS = frozenset(
{
"body",
"Body",
"data",
"cookies",
"raw_email",
"prompt",
"secret",
"SecretString",
"hmac",
"keys",
}
)
_DROP_EXTRA_NEEDLES = (
"body",
"email",
"prompt",
"secret",
"hmac",
"token",
"mime",
"raw_email",
"password",
"signing",
)
def _drop_header(name):
lower = str(name).lower()
return lower in _HEADER_DROP_NAMES or lower.startswith("x-amz-")
def _scrub_headers(headers):
if isinstance(headers, dict):
return {k: v for k, v in headers.items() if not _drop_header(k)}
if isinstance(headers, list):
kept = []
for pair in headers:
if isinstance(pair, (list, tuple)) and pair and _drop_header(pair[0]):
continue
kept.append(pair)
return kept
return headers
def _stacktraces(event):
traces = []
stacktrace = event.get("stacktrace")
if isinstance(stacktrace, dict):
traces.append(stacktrace)
for section in ("exception", "threads"):
container = event.get(section)
if not isinstance(container, dict):
continue
values = container.get("values")
if not isinstance(values, list):
continue
for item in values:
if not isinstance(item, dict):
continue
inner = item.get("stacktrace")
if isinstance(inner, dict):
traces.append(inner)
return traces
def _strip_stack_locals(event):
"""Drop frame locals. Names like ``raw``/``item`` still hold secrets."""
for stacktrace in _stacktraces(event):
frames = stacktrace.get("frames")
if not isinstance(frames, list):
continue
for frame in frames:
if isinstance(frame, dict):
frame.pop("vars", None)
def _before_send(event, _hint):
request = event.get("request")
if isinstance(request, dict):
headers = request.get("headers")
if headers is not None:
request["headers"] = _scrub_headers(headers)
for key in list(request):
if key in _DROP_REQUEST_KEYS or str(key).lower() in {"body", "data"}:
request.pop(key, None)
extra = event.get("extra")
if isinstance(extra, dict):
for key in list(extra):
lower = str(key).lower()
if any(needle in lower for needle in _DROP_EXTRA_NEEDLES):
extra.pop(key, None)
_strip_stack_locals(event)
return event
def _git_sha():
try:
from shared.build_info import GIT_SHA
except ImportError:
return os.environ.get("GIT_SHA", "").strip()
return str(GIT_SHA or "").strip()
def _integrations():
if os.environ.get("AWS_LAMBDA_FUNCTION_NAME"):
return [AwsLambdaIntegration(timeout_warning=True)]
try:
from sentry_sdk.integrations.flask import FlaskIntegration
return [FlaskIntegration()]
except Exception:
return [AwsLambdaIntegration(timeout_warning=True)]
def init_sentry():
dsn = os.environ.get("SENTRY_DSN")
if not dsn:
return
kwargs = {
"dsn": dsn,
"integrations": _integrations(),
"send_default_pii": False,
"include_local_variables": False,
"enable_logs": False,
"traces_sample_rate": 0.0,
"before_send": _before_send,
}
sha = _git_sha()
if sha:
kwargs["release"] = sha
sentry_sdk.init(**kwargs)
init_sentry()

47
src/shared/shared/shift_clock.py
View file

@ -1,47 +0,0 @@
"""Eastern-time shift window helpers shared by Slack and the portal API."""
from datetime import datetime, timedelta
from zoneinfo import ZoneInfo
from shared.schedule import determine_shift_type
EASTERN = ZoneInfo("America/New_York")
def is_today(date_str: str) -> bool:
return date_str == datetime.now(EASTERN).strftime("%Y-%m-%d")
def is_active_shift_type(shift_type: str) -> bool:
return determine_shift_type() == shift_type
def shift_start(date_str: str, shift_type: str) -> datetime:
d = datetime.strptime(date_str, "%Y-%m-%d").replace(tzinfo=EASTERN)
return d.replace(hour=8 if shift_type == "day" else 17)
def shift_started(date_str: str, shift_type: str) -> bool:
return datetime.now(EASTERN) >= shift_start(date_str, shift_type)
def shift_end(date_str: str, shift_type: str) -> datetime:
d = datetime.strptime(date_str, "%Y-%m-%d").replace(tzinfo=EASTERN)
if shift_type == "day":
return d.replace(hour=17)
return d.replace(hour=8) + timedelta(days=1)
def shift_ended(date_str: str, shift_type: str) -> bool:
return datetime.now(EASTERN) >= shift_end(date_str, shift_type)
def holiday_window_active(date_str: str) -> bool:
now = datetime.now(EASTERN)
return shift_start(date_str, "day") <= now < shift_end(date_str, "day")
def within_drop_lock(date_str: str, shift_type: str) -> bool:
return datetime.now(EASTERN) >= shift_start(date_str, shift_type) - timedelta(
hours=24
)

349
src/shared/shared/side_effects.py
View file

@ -1,349 +0,0 @@
"""3CX, holiday scheduler, and Slack channel side effects for portal mutations."""
from __future__ import annotations
import json
import logging
import os
from datetime import datetime, timedelta
from zoneinfo import ZoneInfo
import boto3
import requests
from shared.blocks import (
build_holiday_added_blocks,
build_pickup_request_blocks,
build_shift_change_message,
_mrkdwn_text,
build_swap_request_blocks,
build_week_schedule,
)
from shared.effects import prod_side_effects_enabled
from shared.ring_scheduler import update_queue_routing
from shared.schedule import FALLBACK_EXTENSION, week_start
from shared.secrets import get_secret
from shared.shift_clock import is_active_shift_type, is_today
from shared.three_cx_client import ThreeCXClient, oauth_client
logger = logging.getLogger(__name__)
EASTERN = ZoneInfo("America/New_York")
SLACK_API = "https://slack.com/api"
def slack_token() -> str | None:
if not prod_side_effects_enabled():
return None
secret_id = os.environ.get("SLACK_BOT_TOKEN_SECRET")
if not secret_id:
return None
try:
return get_secret(secret_id)
except Exception:
logger.exception("Failed to read Slack bot token")
return None
def slack_call(method: str, token: str, **payload) -> bool:
if not prod_side_effects_enabled():
logger.info("Skipping Slack %s because STAGE is not prod", method)
return False
try:
response = requests.post(
f"{SLACK_API}/{method}",
headers={
"Authorization": f"Bearer {token}",
"Content-Type": "application/json; charset=utf-8",
},
json=payload,
timeout=8,
)
body = response.json()
except Exception:
logger.exception("Slack %s failed", method)
return False
if not body.get("ok"):
logger.warning("Slack %s error: %s", method, body.get("error"))
return False
return True
def update_3cx_routing(extension: str) -> None:
if not prod_side_effects_enabled():
logger.info("Skipping 3CX routing because STAGE is not prod")
return
queue_number = os.environ.get("QUEUE_NUMBER")
secret_prefix = os.environ.get("TCX_SECRET_PREFIX")
if not queue_number or not secret_prefix:
logger.warning("3CX env vars not set — skipping queue update")
return
try:
update_queue_routing(
extension=extension,
queue_number=queue_number,
domain=get_secret(f"{secret_prefix}domain"),
client_id=get_secret(f"{secret_prefix}client-id"),
client_secret=get_secret(f"{secret_prefix}client-secret"),
)
except Exception:
logger.exception("Failed to update 3CX queue")
def maybe_repoint_today(date_str: str, shift_type: str, extension: str) -> bool:
if is_today(date_str) and is_active_shift_type(shift_type):
update_3cx_routing(extension)
return True
return False
def make_3cx_client() -> ThreeCXClient | None:
"""Return the process OAuth client, refreshing it when the token or secret changed."""
if not prod_side_effects_enabled():
return None
secret_prefix = os.environ.get("TCX_SECRET_PREFIX")
if not secret_prefix:
logger.warning("3CX env vars not set — skipping 3CX call")
return None
return oauth_client(
domain=get_secret(f"{secret_prefix}domain"),
client_id=get_secret(f"{secret_prefix}client-id"),
client_secret=get_secret(f"{secret_prefix}client-secret"),
)
def set_holiday_queue_agents(schedule, date_str: str) -> None:
holiday = schedule.get_holiday(date_str)
if holiday is None:
return
assignees = holiday.get("assignees", {}) or {}
extensions = list(assignees.keys()) or [FALLBACK_EXTENSION]
try:
client = make_3cx_client()
if client is None:
return
queue_number = schedule.get_holiday_queue()
queue = client.get_queue(queue_number)
client.set_queue_agents(queue["Id"], extensions)
except Exception:
logger.exception("Failed to set holiday queue agents for %s", date_str)
def activate_holiday_inline(schedule, date_str: str) -> None:
if os.environ.get("JOBS_QUEUE_URL", "").strip():
from shared.holiday_flow import activate
try:
activate(schedule, date_str)
except Exception:
logger.exception("Failed in-process holiday activate for %s", date_str)
return
router_arn = os.environ.get("HOLIDAY_ROUTER_ARN")
if not router_arn:
logger.warning("HOLIDAY_ROUTER_ARN not set — skipping inline activation")
return
try:
boto3.client("lambda").invoke(
FunctionName=router_arn,
InvocationType="Event",
Payload=json.dumps({"action": "activate", "date": date_str}).encode(),
)
except Exception:
logger.exception("Failed to invoke holiday router for %s", date_str)
def holiday_schedule_names(date_str: str) -> tuple[str, str]:
compact = date_str.replace("-", "")
return f"holiday-activate-{compact}", f"holiday-deactivate-{compact}"
def _holiday_schedule_target(action: str, date_str: str) -> dict | None:
role_arn = os.environ.get("HOLIDAY_SCHEDULER_ROLE_ARN")
queue_arn = os.environ.get("JOBS_QUEUE_ARN", "").strip()
if queue_arn and role_arn:
return {
"Arn": queue_arn,
"RoleArn": role_arn,
"Input": json.dumps(
{"event": "holiday", "action": action, "date": date_str}
),
}
router_arn = os.environ.get("HOLIDAY_ROUTER_ARN")
if router_arn and role_arn:
return {
"Arn": router_arn,
"RoleArn": role_arn,
"Input": json.dumps({"action": action, "date": date_str}),
}
return None
def create_holiday_schedules(date_str: str) -> list[str]:
group = os.environ.get("HOLIDAY_SCHEDULE_GROUP", "default")
target = _holiday_schedule_target("activate", date_str)
if target is None:
logger.warning(
"HOLIDAY_SCHEDULER_ROLE_ARN plus JOBS_QUEUE_ARN or HOLIDAY_ROUTER_ARN "
"not set — skipping schedules"
)
return []
activate_name, deactivate_name = holiday_schedule_names(date_str)
client = boto3.client("scheduler")
created: list[str] = []
for name, action, at_time in (
(activate_name, "activate", "08:00:00"),
(deactivate_name, "deactivate", "17:00:00"),
):
try:
client.create_schedule(
Name=name,
GroupName=group,
ScheduleExpression=f"at({date_str}T{at_time})",
ScheduleExpressionTimezone="America/New_York",
FlexibleTimeWindow={"Mode": "OFF"},
ActionAfterCompletion="DELETE",
Target=_holiday_schedule_target(action, date_str),
)
created.append(name)
except Exception:
logger.exception("Failed to create %s schedule for %s", action, date_str)
return created
def delete_holiday_schedules(schedule_names: list[str]) -> None:
if not schedule_names:
return
group = os.environ.get("HOLIDAY_SCHEDULE_GROUP", "default")
try:
client = boto3.client("scheduler")
except Exception:
logger.exception("Could not create scheduler client to delete schedules")
return
for name in schedule_names:
try:
client.delete_schedule(Name=name, GroupName=group)
except client.exceptions.ResourceNotFoundException:
logger.info("Holiday schedule %s already gone", name)
except Exception:
logger.exception("Failed to delete holiday schedule %s", name)
def schedule_fallback_text() -> str:
now = datetime.now(EASTERN)
start = week_start(now)
end_date = start + timedelta(days=13)
return (
f"After-Hours Schedule — {start.strftime('%b %-d')} "
f"to {end_date.strftime('%b %-d')}"
)
def refresh_schedule_post(schedule, token: str | None) -> None:
channel = os.environ.get("SHIFT_CHANNEL")
if not channel or not token:
return
post = schedule.get_schedule_post(channel)
if not post or not post.get("message_ts"):
return
slack_call(
"chat.update",
token,
channel=channel,
ts=post["message_ts"],
blocks=build_week_schedule(schedule),
text=schedule_fallback_text(),
)
def post_shift_change(
token: str | None,
user_id: str,
date_str: str,
action: str,
ext: str,
name: str,
shift_type: str,
) -> None:
channel = os.environ.get("SHIFT_CHANNEL")
if not channel or not token:
return
slack_call(
"chat.postMessage",
token,
channel=channel,
blocks=build_shift_change_message(
user_id, date_str, action, ext, name, shift_type=shift_type
),
text=f"Shift {action.replace('_', ' ')} for {date_str}",
)
def dm_swap_request(
token: str | None,
requester_slack: str,
target_slack: str,
date_str: str,
shift_type: str,
requester_name: str,
note: str | None = None,
) -> bool:
if not token or not target_slack:
return False
text = f"{requester_name} wants to swap you the {date_str} shift"
if note:
text += f"\nNote: {_mrkdwn_text(note)}"
return slack_call(
"chat.postMessage",
token,
channel=target_slack,
blocks=build_swap_request_blocks(requester_slack, date_str, shift_type, note),
text=text,
)
def dm_text(token: str | None, user_id: str, text: str) -> None:
if not token or not user_id:
return
slack_call("chat.postMessage", token, channel=user_id, text=text)
def dm_late_pickup_admins(
schedule,
token: str | None,
employee: dict,
date_str: str,
shift_type: str,
is_holiday: bool,
) -> int:
if not token:
return 0
blocks = build_pickup_request_blocks(
requester_slack=employee.get("slack_user_id", ""),
requester_name=employee["name"],
date_str=date_str,
shift_type=shift_type,
requester_ext=employee["extension"],
is_holiday=is_holiday,
)
text = f"{employee['name']} wants to pick up the already-started {date_str} shift"
delivered = 0
for admin_id in schedule.get_admin_users():
if slack_call(
"chat.postMessage", token, channel=admin_id, blocks=blocks, text=text
):
delivered += 1
return delivered
def post_holiday_added(
token: str | None, date_str: str, label: str, slots: int, multiplier
) -> None:
channel = os.environ.get("SHIFT_CHANNEL")
if not channel or not token:
return
slack_call(
"chat.postMessage",
token,
channel=channel,
blocks=build_holiday_added_blocks(date_str, label, slots, multiplier),
text=f"Holiday added: {label} on {date_str}",
)

122
src/shared/shared/three_cx_client.py
View file

@ -1,37 +1,8 @@
import logging
import threading
import time
import requests
logger = logging.getLogger(__name__)
_oauth_clients: dict[tuple[str, str], "ThreeCXClient"] = {}
# Refresh this long before 3CX's expires_in, so a job does not start on a token
# that dies mid-call. 3CX client-credentials tokens last 3600 seconds.
_TOKEN_SKEW_SECONDS = 60
def oauth_client(domain: str, client_id: str, client_secret: str) -> "ThreeCXClient":
"""Reuse one OAuth client per (domain, client_id) in this process.
Re-authenticates when the access token is near expiry, and immediately when
``client_secret`` differs from the one the cached client logged in with.
"""
key = (domain, client_id)
client = _oauth_clients.get(key)
if client is None:
client = ThreeCXClient(
domain=domain,
auth_mode="oauth",
client_id=client_id,
client_secret=client_secret,
)
_oauth_clients[key] = client
return client
client.use_client_secret(client_secret)
return client
class ThreeCXClient:
"""Client for 3CX V20 cloud-hosted management API (XAPI)."""
@ -44,14 +15,7 @@ class ThreeCXClient:
auth_kwargs: credentials — see _authenticate_user / _authenticate_oauth
"""
self.base_url = f"https://{domain}"
self._auth_mode = auth_mode
self._client_id = auth_kwargs.get("client_id")
self._client_secret = auth_kwargs.get("client_secret")
self._token_expires_at = 0.0
self._auth_lock = threading.RLock()
self.session = requests.Session()
self._raw_request = self.session.request
self.session.request = self._request
self.session.headers.update(
{
"OData-Version": "4.0",
@ -60,66 +24,12 @@ class ThreeCXClient:
)
if auth_mode == "oauth":
self._authenticate_oauth(self._client_id, self._client_secret)
self._authenticate_oauth(
auth_kwargs["client_id"], auth_kwargs["client_secret"]
)
else:
self._authenticate_user(auth_kwargs["username"], auth_kwargs["password"])
def use_client_secret(self, client_secret: str) -> None:
"""Point this client at ``client_secret`` and log in again if needed.
A different secret is logged in with before it replaces the current one.
A candidate that 3CX rejects leaves the working secret in place, so a
slower caller still holding a revoked secret cannot clobber a good one,
and a later revert to a secret 3CX accepts still takes effect.
"""
with self._auth_lock:
if client_secret == self._client_secret:
self._refresh_expired_token()
return
try:
self._authenticate_oauth(self._client_id, client_secret)
except Exception:
logger.warning(
"3CX login with a new client secret failed; keeping the current secret"
)
self._refresh_expired_token()
return
self._client_secret = client_secret
def ensure_fresh_token(self) -> None:
"""Fetch a new access token when the current one is missing or near expiry."""
if self._auth_mode != "oauth":
return
if time.monotonic() < self._token_expires_at:
return
with self._auth_lock:
self._refresh_expired_token()
def _refresh_expired_token(self) -> None:
"""Log in again when the token is due. Caller holds ``_auth_lock``."""
if self._auth_mode != "oauth":
return
if time.monotonic() < self._token_expires_at:
return
self._authenticate_oauth(self._client_id, self._client_secret)
def _request(self, method, url, **kwargs):
if self._auth_mode == "oauth":
self.ensure_fresh_token()
response = self._raw_request(method, url, **kwargs)
if self._auth_mode == "oauth" and response.status_code == 401:
try:
with self._auth_lock:
self._token_expires_at = 0.0
self._authenticate_oauth(self._client_id, self._client_secret)
except Exception:
logger.warning(
"3CX re-login after 401 failed; returning the original response"
)
return response
response = self._raw_request(method, url, **kwargs)
return response
def _authenticate_user(self, username: str, password: str):
"""Authenticate via extension/user credentials (any license tier)."""
resp = self.session.post(
@ -137,29 +47,17 @@ class ThreeCXClient:
def _authenticate_oauth(self, client_id: str, client_secret: str):
"""Authenticate via OAuth2 client credentials (Enterprise license required).
API client must be created in 3CX Admin > Integrations > API."""
# Drop the session bearer. A refresh otherwise sends the expired
# access token to /connect/token, and 3CX answers 400.
resp = self._raw_request(
"POST",
resp = self.session.post(
f"{self.base_url}/connect/token",
data={
"client_id": client_id,
"client_secret": client_secret,
"grant_type": "client_credentials",
},
headers={
"Content-Type": "application/x-www-form-urlencoded",
"Authorization": None,
},
headers={"Content-Type": "application/x-www-form-urlencoded"},
)
resp.raise_for_status()
body = resp.json()
token = body.get("access_token")
if not token:
raise ValueError("Failed to get access token from 3CX OAuth response")
expires_in = int(body.get("expires_in") or 3600)
skew = min(_TOKEN_SKEW_SECONDS, expires_in // 10)
self._token_expires_at = time.monotonic() + max(expires_in - skew, 0)
token = resp.json()["access_token"]
self.session.headers.update({"Authorization": f"Bearer {token}"})
logger.info("Authenticated to 3CX via OAuth2 client credentials")
@ -204,7 +102,7 @@ class ThreeCXClient:
json=payload,
)
resp.raise_for_status()
logger.info("Updated %s forwarding", resource)
logger.info("Updated %s %s forwarding", resource, resource_id)
return resp.status_code
def get_ring_group(self, extension_number: str) -> dict:
@ -244,7 +142,7 @@ class ThreeCXClient:
json=payload,
)
resp.raise_for_status()
logger.info("Set queue agents to %s", extensions)
logger.info("Set queue %s agents to %s", queue_id, extensions)
return resp.status_code
# ── IVR (auto-attendant) routing ─────────────────────────────────────
@ -309,7 +207,9 @@ class ThreeCXClient:
json=payload,
)
resp.raise_for_status()
logger.info("Set IVR (Receptionist) key-0=%s timeout=%s", key0_dn, timeout_dn)
logger.info(
"Set IVR (Receptionist) %s key-0=%s timeout=%s", ivr_id, key0_dn, timeout_dn
)
return resp.status_code
@staticmethod

57
src/slack-bot/CHANGELOG.md
View file

@ -10,63 +10,6 @@ fine and still supported.
---
## v1.17.0 — September 25, 2026
**The work week now runs Sunday through Saturday, matching payroll.** The Monday
7am schedule post and pay summary use that week. A Saturday night shift (5pm
Saturday through 8am Sunday) stays in the Saturday week. Sunday day and Sunday
night open the next week. The first pay close after this change skips any date
already sent to Flex, so that Sunday is not paid twice.
## v1.16.0 — September 21, 2026
**After Hours is available in the employee portal, and Slack still works.** Employees
can pick up, drop, and swap shifts from `internal.seahaven.com`, and admins can
override coverage, open or clear a shift, manage holidays, and approve late
pickups there. Swap and late-pickup still send Slack DMs. Slack App Home admin
modals are unchanged.
Portal identity is the roster email on Paychex `PUT /roster` (optional so existing
syncs keep working). Admin access is still the Slack IDs in `admin_users` after
that lookup. A new `afterhours-portal-api` Lambda serves `GET/POST/DELETE /api/shifts`
on the existing HTTP API with Cognito ID-token auth.
## v1.15.0 — September 2, 2026
**Monday pay totals now queue to Flex payroll posting.** The weekly post still
emails payroll and DMs the pay summary as before. After those go out, it also
sends last week's after-hours dollar lines (by extension, previous Monday
through Sunday) to the paychex-integrations checkcomponents queue. Unassigned
fallback extension 100 and $0 totals are left out. A queue failure does not
block the Monday schedule post. A retry or forced re-run of the same week does
not send the lines twice.
## v1.14.0 — July 2, 2026
**Point-and-click admin actions, right inside Slack.** Admins no longer have to
remember the exact word order of `/oncall admin …` commands for the two most
fiddly tasks:
- **Set an override or add a holiday from a form.** The bot's *Home* tab now has
an **Admin** section with two buttons — *Set override* and *Add holiday* — that
open a small form with a date picker, an employee dropdown, and clearly
labelled fields (the holiday pay multiplier is its own box instead of a
squeezed-in `x2`). Pick the values, submit, and the change lands exactly as the
typed command would — same phone-routing update for same-day changes, same
schedule-post refresh — with mistakes flagged on the field instead of a wall of
usage text. The typed `/oncall admin …` commands still work as before.
- **See what's coming up.** The Admin section also lists the upcoming overrides
and holidays so you can scan the next couple of months at a glance.
## v1.13.1 — June 29, 2026
**Fixed: the weekly pay summary email to payroll is sending again.** A
permissions change had quietly been blocking the Monday pay-summary email to
payroll since mid-June. The Slack pay report and the schedule post were never
affected — only the email to payroll. That's now fixed, the two missed weeks
were re-sent to payroll, and we've added an alert so a future email failure
can't slip by unnoticed.
## v1.13.0 — June 27, 2026
**The two-week schedule post now sticks to the bottom of the channel.** It used

548
src/slack-bot/app.py
View file

@ -7,6 +7,7 @@ is a thin wiring layer that registers the Bolt routes and delegates to them.
"""
import functools
import json
import logging
import os
import re
@ -15,18 +16,13 @@ from datetime import datetime, timedelta
from zoneinfo import ZoneInfo
import boto3
from boto3.dynamodb.conditions import Key
from slack_bolt import App
from shared.blocks import (
HOLIDAY_ADD_MODAL_CALLBACK,
OPEN_HOLIDAY_MODAL_ACTION,
OPEN_OVERRIDE_MODAL_ACTION,
OVERRIDE_MODAL_CALLBACK,
build_help_blocks,
build_holiday_add_modal,
build_holiday_added_blocks,
build_home_view,
build_override_modal,
build_pay_summary_blocks,
build_pickup_request_blocks,
build_pickup_resolved_blocks,
@ -44,7 +40,6 @@ from shared.schedule import (
ExtensionAlreadyRegistered,
ShiftSchedule,
determine_shift_type,
week_start,
)
from shared.secrets import get_secret
from shared.three_cx_client import ThreeCXClient
@ -191,24 +186,85 @@ def _set_holiday_queue_agents(schedule, date_str: str) -> None:
def _activate_holiday_inline(schedule, date_str: str) -> None:
"""Activate a late-added holiday in-process or via the holiday-router Lambda."""
from shared.side_effects import activate_holiday_inline
"""Invoke the holiday router's activate path now, for a holiday added late.
activate_holiday_inline(schedule, date_str)
When an admin schedules a holiday whose window is already open (08:00 ≤ now <
17:00 ET), the 08:00 activation schedule has already passed, so the call flow
must be repointed immediately. We invoke the holiday-router Lambda
asynchronously so the (idempotent) activate logic — IVR capture/repoint,
queue membership, ``activated`` flag — runs exactly as it would at 08:00.
Best-effort: a missing ARN or invoke failure is logged, not raised.
"""
router_arn = os.environ.get("HOLIDAY_ROUTER_ARN")
if not router_arn:
logger.warning("HOLIDAY_ROUTER_ARN not set — skipping inline activation")
return
try:
boto3.client("lambda").invoke(
FunctionName=router_arn,
InvocationType="Event",
Payload=json.dumps({"action": "activate", "date": date_str}).encode(),
)
logger.info("Invoked holiday router inline activate for %s", date_str)
except Exception:
logger.exception("Failed to invoke holiday router for %s", date_str)
def _holiday_schedule_names(date_str: str) -> tuple[str, str]:
"""The (activate, deactivate) one-off schedule names for a holiday date."""
from shared.side_effects import holiday_schedule_names
return holiday_schedule_names(date_str)
compact = date_str.replace("-", "")
return f"holiday-activate-{compact}", f"holiday-deactivate-{compact}"
def _create_holiday_schedules(date_str: str) -> list[str]:
"""Create the two one-off EventBridge schedules for a holiday and return names."""
from shared.side_effects import create_holiday_schedules
"""Create the two one-off EventBridge schedules for a holiday and return names.
return create_holiday_schedules(date_str)
One schedule fires the holiday router's ``activate`` at 08:00 ET on the
date, the other its ``deactivate`` at 17:00 ET. Both use a flexible
one-time ``at(...)`` expression in ``America/New_York``,
``ActionAfterCompletion=DELETE`` (self-cleanup once fired), and target the
holiday-router Lambda via the passed scheduler execution role.
Returns the created schedule names (stored on the HOLIDAY record so a later
``remove`` can delete any that have not yet fired). Best-effort: returns the
names it managed to create; missing config short-circuits to ``[]``.
"""
router_arn = os.environ.get("HOLIDAY_ROUTER_ARN")
role_arn = os.environ.get("HOLIDAY_SCHEDULER_ROLE_ARN")
group = os.environ.get("HOLIDAY_SCHEDULE_GROUP", "default")
if not router_arn or not role_arn:
logger.warning(
"HOLIDAY_ROUTER_ARN/HOLIDAY_SCHEDULER_ROLE_ARN not set — "
"skipping schedule creation"
)
return []
activate_name, deactivate_name = _holiday_schedule_names(date_str)
client = boto3.client("scheduler")
created: list[str] = []
specs = [
(activate_name, "activate", "08:00:00"),
(deactivate_name, "deactivate", "17:00:00"),
]
for name, action, at_time in specs:
try:
client.create_schedule(
Name=name,
GroupName=group,
ScheduleExpression=f"at({date_str}T{at_time})",
ScheduleExpressionTimezone="America/New_York",
FlexibleTimeWindow={"Mode": "OFF"},
ActionAfterCompletion="DELETE",
Target={
"Arn": router_arn,
"RoleArn": role_arn,
"Input": json.dumps({"action": action, "date": date_str}),
},
)
created.append(name)
except Exception:
logger.exception("Failed to create %s schedule for %s", action, date_str)
return created
def _delete_holiday_schedules(schedule_names: list[str]) -> None:
@ -346,10 +402,10 @@ def _droppable_shifts(schedule, date_str, day_name, employee_ext) -> list[str]:
def _schedule_fallback_text() -> str:
"""Notification fallback text for the two-week schedule post."""
now = datetime.now(EASTERN)
start = week_start(now)
end_date = start + timedelta(days=13)
this_monday = now - timedelta(days=now.weekday())
end_date = this_monday + timedelta(days=13)
return (
f"After-Hours Schedule — {start.strftime('%b %-d')} "
f"After-Hours Schedule — {this_monday.strftime('%b %-d')} "
f"to {end_date.strftime('%b %-d')}"
)
@ -400,25 +456,15 @@ def handle_channel_message(event, client, schedule, schedule_channel, retry_num=
logger.info("Ignoring retried message event (retry %s)", retry_num)
return
if not schedule_channel or event.get("channel") != schedule_channel:
logger.info(
"Skipping bump — channel mismatch (expected %s, got %s)",
schedule_channel,
event.get("channel"),
)
return
# Ignore the bot's own posts and non-user message events (edits, deletes,
# joins, …), plus thread replies — a threaded reply doesn't push the
# schedule down the main timeline, so it isn't worth a delete+repost.
if event.get("bot_id") or event.get("subtype") or event.get("thread_ts"):
logger.info(
"Skipping bump — bot message, subtype %s, or thread reply",
event.get("subtype"),
)
return
post = schedule.get_schedule_post(schedule_channel)
if not post or not post.get("message_ts"):
logger.info("Skipping bump — no stored schedule post for %s", schedule_channel)
return
now = time.time()
@ -427,11 +473,6 @@ def handle_channel_message(event, client, schedule, schedule_channel, retry_num=
last_bump is not None
and now - float(last_bump) < SCHEDULE_BUMP_DEBOUNCE_SECONDS
):
logger.info(
"Skipping bump — debounced (last bump %.0fs ago, window %ds)",
now - float(last_bump),
SCHEDULE_BUMP_DEBOUNCE_SECONDS,
)
return
# Optimistically stamp the debounce window *before* the delete/repost, so a
@ -642,50 +683,25 @@ def _show_schedule(respond, schedule):
def _show_next_week(respond, schedule):
now = datetime.now(EASTERN)
# The default view is already two weeks, so "next" starts two Sundays ahead.
next_start = week_start(now) + timedelta(days=14)
# Jump 2 weeks ahead from this week's Monday
this_monday = now - timedelta(days=now.weekday())
next_start = this_monday + timedelta(days=14)
blocks = build_week_schedule(schedule, start_date=next_start)
respond(blocks=blocks)
def _pay_week_bounds(pay_record: dict) -> tuple[datetime, datetime]:
"""Label bounds for a pay record.
New rows are Sunday–Saturday. A cutover row may store a shorter
``window_start``/``window_end``. Legacy rows are Monday–Sunday via
``week_start`` plus six days.
"""
start = datetime.strptime(
pay_record.get("window_start") or pay_record["week_start"], "%Y-%m-%d"
)
if pay_record.get("window_end"):
end = datetime.strptime(pay_record["window_end"], "%Y-%m-%d")
else:
end = start + timedelta(days=6)
return start, end
def _show_pay(respond, schedule):
now = datetime.now(EASTERN)
# The Monday 7am close writes the Sun–Sat week that ended Saturday. On
# Sunday, and on Monday before that close, that row is not written yet, so
# also try the prior week's Sunday key and the legacy Monday keys.
prev_start = week_start(now) - timedelta(days=7)
pay_record = None
for start in (
prev_start,
prev_start + timedelta(days=1),
prev_start - timedelta(days=7),
prev_start - timedelta(days=6),
):
record = schedule.get_pay_record(start.strftime("%Y-%m-%d"))
if record and record.get("breakdown"):
pay_record = record
break
# Show last completed week's pay (previous Monday–Sunday)
this_monday = now - timedelta(days=now.weekday())
prev_monday = this_monday - timedelta(days=7)
week_key = prev_monday.strftime("%Y-%m-%d")
pay_record = schedule.get_pay_record(week_key)
if pay_record and pay_record.get("breakdown"):
label_start, label_end = _pay_week_bounds(pay_record)
prev_sunday = prev_monday + timedelta(days=6)
week_label = (
f"{label_start.strftime('%b %-d')} to {label_end.strftime('%b %-d')}"
f"{prev_monday.strftime('%b %-d')} to {prev_sunday.strftime('%b %-d')}"
)
blocks = build_pay_summary_blocks(
week_label, pay_record["breakdown"], pay_record["totals"]
@ -693,7 +709,7 @@ def _show_pay(respond, schedule):
respond(blocks=blocks)
else:
respond(
text=f"No pay record found for the week of {prev_start.strftime('%b %-d')}."
text=f"No pay record found for the week of {prev_monday.strftime('%b %-d')}."
)
@ -1794,130 +1810,6 @@ def handle_pickup_deny(body, respond, client, schedule, schedule_channel):
logger.exception("Failed to DM late-pickup requester on deny")
# ── Shared admin validation + side-effect helpers ───────────────────────
#
# These are the single source of the admin mutation rules and side effects, so
# the text subcommands and the Block Kit modal ``view_submission`` handlers can't
# drift. Validators return an error string (or ``None``); apply helpers run the
# ``Schedule`` mutation plus the same 3CX / schedule-post side effects.
def _resolve_roster_employee(schedule, extension):
"""Return (employee, error). ``error`` is set when the extension is unknown."""
employee = schedule.get_employee_by_extension(extension)
if not employee:
return None, f"Extension `{extension}` not found in the roster."
return employee, None
def _validate_holiday_date(date_str: str) -> str | None:
"""Error message if a holiday date is in the past, else None."""
if date_str < datetime.now(EASTERN).strftime("%Y-%m-%d"):
return "You can't schedule a holiday in the past."
return None
def _parse_slots(raw):
"""Parse a holiday slot count. Returns (slots, error)."""
try:
slots = int(raw)
except (ValueError, TypeError):
return None, f"Slots must be a whole number, got `{raw}`."
if slots < 1:
return None, "Slots must be at least 1."
return slots, None
def _parse_multiplier(raw):
"""Parse an optional pay multiplier (`2`, `2.0`, or `x2`). Returns (value, error)."""
if raw is None:
return None, None
token = raw.strip()
if not token:
return None, None
match = re.fullmatch(r"x?([0-9]+(?:\.[0-9]+)?)", token, re.IGNORECASE)
if not match:
return None, f"Multiplier must be a number like `2` or `x1.5`, got `{raw}`."
return match.group(1), None
def _validate_label(label: str) -> str | None:
if not label.strip():
return "A holiday label is required."
return None
def _apply_override(schedule, date_str, employee, shift_type, client, schedule_channel):
"""Set the override + same-day 3CX repoint + post refresh.
Returns (message, repointed_3cx). Shared by the text command and the modal.
"""
schedule.set_override(date_str, employee["extension"], employee["name"], shift_type)
repointed = False
if is_today(date_str) and _is_active_shift_type(shift_type):
_update_3cx_routing(employee["extension"])
repointed = True
_refresh_schedule_post(schedule, schedule_channel, client)
date = datetime.strptime(date_str, "%Y-%m-%d")
label = "Day" if shift_type == "day" else "Night"
message = (
f"Override set: *{date.strftime('%A, %b %-d')}* ({label}) → "
f"{employee['name']} (Ext {employee['extension']})"
)
return message, repointed
def _apply_holiday_add(
schedule, date_str, slots, multiplier, label, client, schedule_channel
):
"""Create the holiday record + one-off schedules + side effects.
Returns (created, message). Shared by the text command and the modal.
"""
schedule_names = _create_holiday_schedules(date_str)
created = schedule.create_holiday(
date_str,
slots=slots,
label=label,
created_by=schedule_channel or "",
multiplier=multiplier,
schedule_names=schedule_names,
)
date = datetime.strptime(date_str, "%Y-%m-%d")
if not created:
# Roll back the schedules we just made for a date that already has one.
_delete_holiday_schedules(schedule_names)
return False, (
f"A holiday already exists on *{date.strftime('%A, %b %-d')}*. "
"Remove it first to recreate."
)
# If the window is already open (admin added it mid-day), the 08:00 schedule
# has passed, so repoint the call flow now via the holiday router.
if _holiday_window_active(date_str):
_activate_holiday_inline(schedule, date_str)
holiday = schedule.get_holiday(date_str)
multiplier_value = holiday["multiplier"] if holiday else (multiplier or "1.5")
if schedule_channel:
try:
client.chat_postMessage(
channel=schedule_channel,
blocks=build_holiday_added_blocks(
date_str, label, slots, multiplier_value
),
text=f"Holiday added: {label} on {date_str}",
)
except Exception:
logger.exception("Failed to post holiday-added notification to channel")
_refresh_schedule_post(schedule, schedule_channel, client)
return True, (
f"Scheduled *{label}* holiday on *{date.strftime('%A, %b %-d')}* — "
f"{slots} slot{'s' if slots != 1 else ''} at {float(multiplier_value):g}x pay."
)
def _handle_admin(respond, schedule, user_id, text, is_admin, client, schedule_channel):
if not is_admin:
respond(text="Admin commands are restricted. Contact an administrator.")
@ -1957,15 +1849,21 @@ def _handle_admin(respond, schedule, user_id, text, is_admin, client, schedule_c
shift_type = (
parts[4] if len(parts) > 4 and parts[4] in ("day", "night") else "night"
)
employee, error = _resolve_roster_employee(schedule, ext)
if error:
respond(text=error)
employee = schedule.get_employee_by_extension(ext)
if not employee:
respond(text=f"Extension `{ext}` not found in the roster.")
return
date_str = date.strftime("%Y-%m-%d")
message, _repointed = _apply_override(
schedule, date_str, employee, shift_type, client, schedule_channel
schedule.set_override(
date_str, employee["extension"], employee["name"], shift_type
)
respond(text=message)
if is_today(date_str) and _is_active_shift_type(shift_type):
_update_3cx_routing(employee["extension"])
label = "Day" if shift_type == "day" else "Night"
respond(
text=f"Override set: *{date.strftime('%A, %b %-d')}* ({label}) → {employee['name']} (Ext {ext})"
)
_refresh_schedule_post(schedule, schedule_channel, client)
elif subcmd == "open":
if len(parts) < 3:
@ -2112,14 +2010,17 @@ def _admin_holiday_add(respond, schedule, parts, client, schedule_channel):
respond(text=f"Couldn't parse date: `{parts[3]}`")
return
date_str = date.strftime("%Y-%m-%d")
date_error = _validate_holiday_date(date_str)
if date_error:
respond(text=date_error)
if date_str < datetime.now(EASTERN).strftime("%Y-%m-%d"):
respond(text="You can't schedule a holiday in the past.")
return
slots, slots_error = _parse_slots(parts[4])
if slots_error:
respond(text=slots_error)
try:
slots = int(parts[4])
except ValueError:
respond(text=f"Slots must be a whole number, got `{parts[4]}`.")
return
if slots < 1:
respond(text="Slots must be at least 1.")
return
# Optional ``x<mult>`` token before the label.
@ -2129,15 +2030,54 @@ def _admin_holiday_add(respond, schedule, parts, client, schedule_channel):
multiplier = rest[0][1:]
rest = rest[1:]
label = " ".join(rest).strip()
label_error = _validate_label(label)
if label_error:
respond(text=label_error)
if not label:
respond(text="A holiday label is required.")
return
_created, message = _apply_holiday_add(
schedule, date_str, slots, multiplier, label, client, schedule_channel
schedule_names = _create_holiday_schedules(date_str)
created = schedule.create_holiday(
date_str,
slots=slots,
label=label,
created_by=schedule_channel or "",
multiplier=multiplier,
schedule_names=schedule_names,
)
respond(text=message)
if not created:
# Roll back the schedules we just made for a date that already has one.
_delete_holiday_schedules(schedule_names)
respond(
text=f"A holiday already exists on *{date.strftime('%A, %b %-d')}*. "
"Remove it first to recreate."
)
return
# If the window is already open (admin added it mid-day), the 08:00 schedule
# has passed, so repoint the call flow now via the holiday router.
if _holiday_window_active(date_str):
_activate_holiday_inline(schedule, date_str)
holiday = schedule.get_holiday(date_str)
multiplier_value = holiday["multiplier"] if holiday else (multiplier or "1.5")
respond(
text=(
f"Scheduled *{label}* holiday on *{date.strftime('%A, %b %-d')}* — "
f"{slots} slot{'s' if slots != 1 else ''} at {float(multiplier_value):g}x pay."
)
)
if schedule_channel:
try:
client.chat_postMessage(
channel=schedule_channel,
blocks=build_holiday_added_blocks(
date_str, label, slots, multiplier_value
),
text=f"Holiday added: {label} on {date_str}",
)
except Exception:
logger.exception("Failed to post holiday-added notification to channel")
_refresh_schedule_post(schedule, schedule_channel, client)
def _admin_holiday_remove(respond, schedule, parts, client, schedule_channel):
@ -2170,13 +2110,16 @@ def _admin_holiday_remove(respond, schedule, parts, client, schedule_channel):
def _admin_holiday_list(respond, schedule):
"""`admin holiday list` — show today-and-future scheduled holidays."""
today_str = datetime.now(EASTERN).strftime("%Y-%m-%d")
items = schedule.list_holidays(today_str)
resp = schedule.table.query(
KeyConditionExpression=Key("PK").eq("HOLIDAY") & Key("SK").gte(today_str)
)
items = resp.get("Items", [])
if not items:
respond(text="No upcoming holidays scheduled.")
return
lines = ["*Upcoming Holidays*\n"]
for item in items:
for item in sorted(items, key=lambda x: x["SK"]):
date_str = item["SK"]
dt = datetime.strptime(date_str, "%Y-%m-%d")
slots = int(item.get("slots", 0))
@ -2194,159 +2137,32 @@ def _admin_holiday_list(respond, schedule):
@functools.lru_cache(maxsize=1)
def _changelog_text() -> str:
"""Read the CHANGELOG shipped next to this module.
"""Read the CHANGELOG shipped in this function's package.
Lazy (never at import) and tolerant of a missing file, so the App Home tab
degrades to "no What's New section" rather than erroring. Lambda zips and
the Fargate image both keep ``CHANGELOG.md`` beside ``app.py``.
``LAMBDA_TASK_ROOT`` remains a fallback for the zip layout.
degrades to "no What's New section" rather than erroring. The copy lives at
``$LAMBDA_TASK_ROOT/CHANGELOG.md`` (synced from the repo root).
"""
tried = []
for path in _changelog_paths():
tried.append(path)
try:
with open(path, encoding="utf-8") as fh:
return fh.read()
except OSError:
continue
logger.warning("CHANGELOG.md not found at %s — App Home omits What's New", tried)
return ""
path = os.path.join(os.environ.get("LAMBDA_TASK_ROOT", "."), "CHANGELOG.md")
try:
with open(path, encoding="utf-8") as fh:
return fh.read()
except OSError:
logger.warning("CHANGELOG.md not found at %s — App Home omits What's New", path)
return ""
def _changelog_paths() -> list[str]:
paths = [os.path.join(os.path.dirname(os.path.abspath(__file__)), "CHANGELOG.md")]
task_root = os.environ.get("LAMBDA_TASK_ROOT", "").strip()
if task_root:
paths.append(os.path.join(task_root, "CHANGELOG.md"))
return paths
_HOME_OVERVIEW_DAYS = 60
def publish_home(client, user_id: str, changelog_text: str, schedule=None) -> None:
"""Render and publish the App Home view for ``user_id``.
When ``schedule`` is provided and the viewer is an admin (looked up via
``get_admin_users()`` — never trust the surface), the admin section with the
override/holiday modal buttons and an upcoming overview is included.
"""
def publish_home(client, user_id: str, changelog_text: str) -> None:
"""Render and publish the App Home view for ``user_id``."""
entry = latest_entry(changelog_text)
is_admin = False
upcoming_overrides = None
upcoming_holidays = None
if schedule is not None and user_id in schedule.get_admin_users():
is_admin = True
today = datetime.now(EASTERN)
start = today.strftime("%Y-%m-%d")
end = (today + timedelta(days=_HOME_OVERVIEW_DAYS)).strftime("%Y-%m-%d")
upcoming_overrides = schedule.list_overrides(start, end)
upcoming_holidays = schedule.list_holidays(start)
view = build_home_view(
version=entry.version if entry else None,
notes=entry.body if entry else "",
date_label=entry.date_label if entry else "",
is_admin=is_admin,
upcoming_overrides=upcoming_overrides,
upcoming_holidays=upcoming_holidays,
)
client.views_publish(user_id=user_id, view=view)
# ── Admin modals (views.open + view_submission) ─────────────────────────
def _notify_admin(client, user_id: str, text: str) -> None:
"""DM the admin a confirmation of a modal-driven change (best-effort)."""
try:
client.chat_postMessage(channel=user_id, text=text)
except Exception:
logger.exception("Failed to send admin modal confirmation DM")
def open_override_modal(body, client, schedule) -> None:
"""Open the override modal — admins only (re-check, never trust the surface)."""
user_id = body["user"]["id"]
if user_id not in schedule.get_admin_users():
return
client.views_open(
trigger_id=body["trigger_id"],
view=build_override_modal(schedule.get_roster()),
)
def open_holiday_add_modal(body, client, schedule) -> None:
"""Open the holiday-add modal — admins only (re-check, never trust surface)."""
user_id = body["user"]["id"]
if user_id not in schedule.get_admin_users():
return
client.views_open(trigger_id=body["trigger_id"], view=build_holiday_add_modal())
def handle_override_submission(ack, body, view, client, schedule, schedule_channel):
"""``view_submission`` for the override modal."""
user_id = body["user"]["id"]
if user_id not in schedule.get_admin_users():
ack(response_action="errors", errors={"date": "Admin access required."})
return
values = view["state"]["values"]
date_str = values["date"]["date"]["selected_date"]
ext = values["extension"]["extension"]["selected_option"]["value"]
shift_type = values["shift_type"]["shift_type"]["selected_option"]["value"]
employee, error = _resolve_roster_employee(schedule, ext)
if error:
ack(response_action="errors", errors={"extension": error})
return
ack()
message, repointed = _apply_override(
schedule, date_str, employee, shift_type, client, schedule_channel
)
if repointed:
message += (
"\n:telephone_receiver: This is today — the phone routing has been "
"repointed now."
)
_notify_admin(client, user_id, message)
def handle_holiday_add_submission(ack, body, view, client, schedule, schedule_channel):
"""``view_submission`` for the holiday-add modal."""
user_id = body["user"]["id"]
if user_id not in schedule.get_admin_users():
ack(response_action="errors", errors={"date": "Admin access required."})
return
values = view["state"]["values"]
date_str = values["date"]["date"]["selected_date"]
slots_raw = values["slots"]["slots"].get("value")
mult_raw = values["multiplier"]["multiplier"].get("value")
label = values["label"]["label"].get("value") or ""
errors = {}
if date_error := _validate_holiday_date(date_str):
errors["date"] = date_error
slots, slots_error = _parse_slots(slots_raw)
if slots_error:
errors["slots"] = slots_error
multiplier, mult_error = _parse_multiplier(mult_raw)
if mult_error:
errors["multiplier"] = mult_error
if label_error := _validate_label(label):
errors["label"] = label_error
if errors:
ack(response_action="errors", errors=errors)
return
ack()
_created, message = _apply_holiday_add(
schedule, date_str, slots, multiplier, label.strip(), client, schedule_channel
)
_notify_admin(client, user_id, message)
# ── App factory ─────────────────────────────────────────────────────────
@ -2393,34 +2209,12 @@ def create_app(
ack()
handle_swap_decline(body, respond, client, schedule, schedule_channel)
# Admin App Home buttons → open the corresponding Block Kit modal.
@app.action(OPEN_OVERRIDE_MODAL_ACTION)
def handle_open_override_modal(ack, body, client):
ack()
open_override_modal(body, client, schedule)
@app.action(OPEN_HOLIDAY_MODAL_ACTION)
def handle_open_holiday_modal(ack, body, client):
ack()
open_holiday_add_modal(body, client, schedule)
# Admin modal submissions (ack is handled inside, with field errors).
@app.view(OVERRIDE_MODAL_CALLBACK)
def handle_override_view(ack, body, view, client):
handle_override_submission(ack, body, view, client, schedule, schedule_channel)
@app.view(HOLIDAY_ADD_MODAL_CALLBACK)
def handle_holiday_add_view(ack, body, view, client):
handle_holiday_add_submission(
ack, body, view, client, schedule, schedule_channel
)
@app.event("app_home_opened")
def handle_app_home_opened(event, client):
# Fires for the Messages tab too; only (re)publish the Home tab.
if event.get("tab") != "home":
return
publish_home(client, event["user"], _changelog_text(), schedule)
publish_home(client, event["user"], _changelog_text())
@app.event("message")
def handle_message_event(event, client, request):

8
src/slack-bot/handler.py
View file

@ -1,12 +1,10 @@
"""Lambda handler — Slack Bolt app entry point."""
import json
import logging
import os
from slack_bolt.adapter.aws_lambda import SlackRequestHandler
import shared.sentry_init # noqa: F401
from app import create_app
from shared.secrets import get_secret
@ -34,8 +32,4 @@ def _get_handler() -> SlackRequestHandler:
def handler(event, context):
try:
return _get_handler().handle(event, context)
except json.JSONDecodeError:
logger.warning("rejecting malformed slack request body")
return {"statusCode": 400, "body": "invalid request"}
return _get_handler().handle(event, context)

4
src/slack-bot/requirements.txt
View file

@ -1,2 +1,2 @@
slack_bolt>=1.30.0,<2.0
boto3>=1.43.99
slack_bolt>=1.28.0,<2.0
boto3>=1.43.36

364
src/weekly-post/app.py
View file

@ -1,8 +1,6 @@
"""Lambda handler — posts the two-week on-call schedule and the previous
Sunday–Saturday pay summary to Slack every Monday at 7am ET, and enqueues
after-hours dollars for Flex."""
"""Lambda handler — posts the weekly on-call schedule and previous week's pay summary
to Slack every Monday at 7am ET, and emails the pay summary to payroll."""
import json
import logging
import os
from datetime import datetime, timedelta
@ -12,16 +10,24 @@ from zoneinfo import ZoneInfo
import boto3
from slack_sdk import WebClient
import shared.sentry_init # noqa: F401
from shared.blocks import build_pay_summary_blocks, build_week_schedule
from shared.schedule import FALLBACK_EXTENSION, WEEKEND_DAYS, ShiftSchedule, week_start
from shared.schedule import FALLBACK_EXTENSION, WEEKEND_DAYS, ShiftSchedule
from shared.secrets import get_secret
logger = logging.getLogger()
logger.setLevel(logging.INFO)
EASTERN = ZoneInfo("America/New_York")
KIND_AFTER_HOURS = "after_hours"
DAY_ORDER = [
"Monday",
"Tuesday",
"Wednesday",
"Thursday",
"Friday",
"Saturday",
"Sunday",
]
def _record_pay_line(
@ -127,20 +133,15 @@ def _add_shift_to_pay(schedule, breakdown, totals, date, day_name, shift_type="n
)
def _calculate_weekly_pay(schedule: ShiftSchedule, week_start_dt: datetime) -> dict:
"""Calculate pay for a Sun–Sat week. Returns pay record dict.
``week_start_dt`` is the Sunday that opens the week. Each shift is attributed
by its start date, so Saturday night stays in this week and the following
Sunday does not.
"""
def _calculate_weekly_pay(schedule: ShiftSchedule, week_start: datetime) -> dict:
"""Calculate pay for a Mon–Sun week. Returns pay record dict."""
default_rate = schedule.get_shift_rate()
breakdown = []
totals = {}
for i in range(7):
date = week_start_dt + timedelta(days=i)
day_name = date.strftime("%A")
date = week_start + timedelta(days=i)
day_name = DAY_ORDER[i]
date_str = date.strftime("%Y-%m-%d")
# Day shifts (8am–5pm) exist on weekends and on holidays. Holidays are
@ -153,146 +154,100 @@ def _calculate_weekly_pay(schedule: ShiftSchedule, week_start_dt: datetime) -> d
_add_shift_to_pay(schedule, breakdown, totals, date, day_name, "night")
return {
"week_start": week_start_dt.strftime("%Y-%m-%d"),
"week_start": week_start.strftime("%Y-%m-%d"),
"default_rate": str(default_rate),
"breakdown": breakdown,
"totals": totals,
}
def _already_sent_dates(schedule: ShiftSchedule, week_key: str) -> set[str]:
"""Dates already included in some other pay row that Flex has received.
def _build_pay_email_html(week_label: str, pay_record: dict) -> str:
"""Build an HTML email body for the weekly pay summary.
The current week's own row is ignored so a retry can rebuild it.
Holiday shifts are rendered distinctly: a per-shift breakdown section
highlights holiday rows (shaded, showing the multiplier and label) and the
totals table flags any employee who worked a holiday during the week.
"""
sent: set[str] = set()
for record in schedule.list_pay_records():
if record.get("SK") == week_key:
continue
if not record.get("checkcomponents_sent"):
continue
for line in record.get("breakdown") or []:
date = line.get("date")
if date:
sent.add(str(date))
return sent
breakdown = pay_record.get("breakdown", [])
totals = pay_record.get("totals", {})
holiday_names = {line["name"] for line in breakdown if line.get("is_holiday")}
def _rebuild_totals(breakdown: list[dict]) -> dict:
totals: dict = {}
for line in breakdown:
name = line["name"]
if name not in totals:
totals[name] = {
"shifts": 0,
"total": Decimal("0"),
"extension": line["extension"],
"rate": line.get("base_rate", line["rate"]),
"holiday_shifts": 0,
}
totals[name]["shifts"] += 1
totals[name]["total"] += Decimal(str(line["amount"]))
if line.get("is_holiday"):
totals[name]["holiday_shifts"] += 1
return totals
def _exclude_sent_dates(
schedule: ShiftSchedule, pay_record: dict, week_key: str
) -> dict:
"""Drop dates Flex already received, and shrink the reported window.
The PAY key stays the Sunday that opened the computed week. When the
leading Sunday (or any other day) was in a sent Monday–Sunday row, the
Flex window becomes the remaining span, often Monday–Saturday once.
"""
sent = _already_sent_dates(schedule, week_key)
if not sent:
return pay_record
start = datetime.strptime(pay_record["week_start"], "%Y-%m-%d").date()
kept_days = []
omitted = False
for offset in range(7):
day = start + timedelta(days=offset)
if day.isoformat() in sent:
omitted = True
else:
kept_days.append(day)
if not omitted:
return pay_record
pay_record["breakdown"] = [
line for line in pay_record["breakdown"] if str(line.get("date")) not in sent
]
pay_record["totals"] = _rebuild_totals(pay_record["breakdown"])
if kept_days and len(kept_days) < 7:
pay_record["window_start"] = kept_days[0].isoformat()
pay_record["window_end"] = kept_days[-1].isoformat()
return pay_record
def _pay_week_label(pay_record: dict) -> str:
start = datetime.strptime(
pay_record.get("window_start") or pay_record["week_start"], "%Y-%m-%d"
)
if pay_record.get("window_end"):
end = datetime.strptime(pay_record["window_end"], "%Y-%m-%d")
else:
end = start + timedelta(days=6)
return f"{start.strftime('%b %-d')} to {end.strftime('%b %-d')}"
def build_checkcomponents_payload(pay_record: dict) -> dict:
"""Sibling dollar lines only. No Flex OAuth, no payPeriodId invention."""
week_start_date = datetime.strptime(pay_record["week_start"], "%Y-%m-%d").date()
window_end = week_start_date + timedelta(days=6)
if pay_record.get("window_start"):
week_start_date = datetime.strptime(
pay_record["window_start"], "%Y-%m-%d"
).date()
if pay_record.get("window_end"):
window_end = datetime.strptime(pay_record["window_end"], "%Y-%m-%d").date()
lines = []
for info in pay_record.get("totals", {}).values():
ext = str(info.get("extension") or "").strip()
if not ext or ext == FALLBACK_EXTENSION:
continue
amount = Decimal(str(info.get("total") or 0))
if amount <= 0:
continue
lines.append(
{
"extension": ext,
"amount": format(amount.quantize(Decimal("0.01")), "f"),
}
totals_rows = ""
for name, info in sorted(totals.items()):
holiday_tag = (
' <span style="color:#b8860b;">&#9733; holiday</span>'
if name in holiday_names
else ""
)
return {
"type": "checkcomponents",
"kind": KIND_AFTER_HOURS,
"windowStart": week_start_date.isoformat(),
"windowEnd": window_end.isoformat(),
"lines": lines,
}
totals_rows += (
f"<tr><td>{name}{holiday_tag}</td>"
f"<td>${info.get('rate', 0):.2f}</td><td><strong>${info['total']:.2f}</strong></td></tr>\n"
)
breakdown_rows = ""
for line in breakdown:
if line.get("is_holiday"):
mult = line.get("multiplier", Decimal("1"))
label = line.get("holiday_label", "") or "Holiday"
base = line.get("base_rate", line["rate"])
row_style = ' style="background:#fff8e1;"'
detail = f"{label} &mdash; ${base:.2f} &times; {mult:.2f}x"
else:
row_style = ""
detail = f"${line['rate']:.2f}"
breakdown_rows += (
f"<tr{row_style}><td>{line['date_label']}</td>"
f"<td>{line['day']}</td>"
f"<td>{line['name']}</td>"
f"<td>{detail}</td>"
f"<td><strong>${line['amount']:.2f}</strong></td></tr>\n"
)
return f"""<html>
<body style="font-family: Arial, sans-serif; color: #333;">
<h2>Bonus Pay Summary &mdash; {week_label}</h2>
<table border="1" cellpadding="6" cellspacing="0" style="border-collapse: collapse;">
<tr style="background: #f0f0f0;"><th>Name</th><th>Rate</th><th>Total</th></tr>
{totals_rows}</table>
<h3>Shift Breakdown</h3>
<table border="1" cellpadding="6" cellspacing="0" style="border-collapse: collapse;">
<tr style="background: #f0f0f0;"><th>Date</th><th>Day</th><th>Name</th><th>Detail</th><th>Amount</th></tr>
{breakdown_rows}</table>
<p style="color: #888; font-size: 12px;">Holiday shifts are shaded and paid at the listed multiplier.</p>
<p style="color: #888; font-size: 12px;">This is an automated report from Sea Haven Industries.</p>
</body>
</html>"""
def _send_checkcomponents(pay_record: dict) -> bool:
"""Enqueue sibling dollar lines. Returns True if a message was sent."""
queue_url = os.environ.get("CHECKCOMPONENTS_QUEUE_URL", "").strip()
if not queue_url:
return False
payload = build_checkcomponents_payload(pay_record)
if not payload["lines"]:
return False
boto3.client("sqs").send_message(
QueueUrl=queue_url, MessageBody=json.dumps(payload)
def _send_pay_email(week_label: str, pay_record: dict) -> None:
"""Send the weekly pay summary email via SES."""
sender = os.environ.get("SES_SENDER", "noreply@seahaven.com")
recipients = os.environ.get("PAYROLL_RECIPIENTS", "").split(",")
recipients = [r.strip() for r in recipients if r.strip()]
if not recipients:
logger.warning("No PAYROLL_RECIPIENTS configured — skipping email")
return
ses = boto3.client("ses")
html_body = _build_pay_email_html(week_label, pay_record)
ses.send_email(
Source=sender,
Destination={"ToAddresses": recipients},
Message={
"Subject": {"Data": f"Bonus Pay Summary — {week_label}"},
"Body": {"Html": {"Data": html_body}},
},
)
return True
logger.info("Sent pay email to %s", recipients)
def handler(event, context):
if os.environ.get("STAGE", "prod") != "prod":
logger.info("Skipping weekly post because STAGE is not prod")
return {"skipped": "non_prod"}
now = datetime.now(EASTERN)
# DST guard — same pattern as the 3CX scheduler
@ -309,22 +264,21 @@ def handler(event, context):
schedule = ShiftSchedule()
slack = WebClient(token=bot_token)
# --- Previous completed Sun–Sat pay summary ---
# Monday 7am is after Saturday night ends (Sunday 8am), so this week is closed.
prev_sunday = week_start(now) - timedelta(days=7)
pay_record = _calculate_weekly_pay(schedule, prev_sunday)
# --- Previous week's pay summary ---
prev_monday = now - timedelta(days=7)
prev_monday = prev_monday.replace(hour=0, minute=0, second=0, microsecond=0)
pay_record = _calculate_weekly_pay(schedule, prev_monday)
pay_dm_user = os.environ.get("PAY_REPORT_USER")
week_key = prev_sunday.strftime("%Y-%m-%d")
pay_record = _exclude_sent_dates(schedule, pay_record, week_key)
if pay_record["breakdown"]:
existing = schedule.get_pay_record(week_key)
if existing and existing.get("checkcomponents_sent"):
pay_record["checkcomponents_sent"] = True
week_key = prev_monday.strftime("%Y-%m-%d")
schedule.save_pay_record(week_key, pay_record)
week_label = _pay_week_label(pay_record)
prev_sunday = prev_monday + timedelta(days=6)
week_label = (
f"{prev_monday.strftime('%b %-d')} to {prev_sunday.strftime('%b %-d')}"
)
pay_blocks = build_pay_summary_blocks(
week_label, pay_record["breakdown"], pay_record["totals"]
)
@ -342,89 +296,63 @@ def handler(event, context):
else:
logger.warning("PAY_REPORT_USER not set — skipping Slack pay summary")
# --- Two-week schedule (starts on Sunday of this Sun–Sat week) ---
this_sunday = week_start(now)
schedule_week = this_sunday.strftime("%Y-%m-%d")
blocks = build_week_schedule(schedule, start_date=this_sunday)
# Email pay summary to payroll. Isolated so a delivery failure (e.g.
# an SES permission/identity issue) can never abort the rest of the
# handler — the Slack schedule post below must still go out.
try:
_send_pay_email(week_label, pay_record)
except Exception:
logger.exception(
"Failed to send pay summary email to payroll for week of %s",
week_key,
)
end_date = this_sunday + timedelta(days=13)
# --- Two-week schedule (always starts on Monday of this week) ---
this_monday = now - timedelta(days=now.weekday())
week_start = this_monday.strftime("%Y-%m-%d")
blocks = build_week_schedule(schedule, start_date=this_monday)
end_date = this_monday + timedelta(days=13)
fallback_text = (
f"After-Hours Schedule — {this_sunday.strftime('%b %-d')} "
f"After-Hours Schedule — {this_monday.strftime('%b %-d')} "
f"to {end_date.strftime('%b %-d')}"
)
# Delete the previous week's schedule post + repost a fresh one so the
# message lands at the bottom of the channel every Monday. The activity
# bump (handle_channel_message) handles in-week bottom-stickiness; this
# ensures the rollover itself re-places the post at the bottom.
# Roll the two-week window forward by editing the stored message in place
# (same ts) so the Monday rollover, in-week shift edits, and the activity
# bump all converge on a single stored ts. Fall back to a fresh post when
# there is no stored message or the edit fails (e.g. it was deleted).
old_post = schedule.get_schedule_post(channel_id)
message_ts = None
if old_post and old_post.get("message_ts"):
try:
slack.chat_delete(channel=channel_id, ts=old_post["message_ts"])
slack.chat_update(
channel=channel_id,
ts=old_post["message_ts"],
blocks=blocks,
text=fallback_text,
)
message_ts = old_post["message_ts"]
logger.info(
"Deleted previous schedule post %s for weekly rollover",
old_post["message_ts"],
)
except Exception:
logger.warning(
"Could not delete old schedule post for rollover; continuing",
exc_info=True,
)
result = slack.chat_postMessage(
channel=channel_id, blocks=blocks, text=fallback_text
)
message_ts = result["ts"]
logger.info(
"Posted new weekly schedule to channel %s (ts=%s)", channel_id, message_ts
)
# Persist the new ts immediately. If the write fails after the post has
# already landed, roll the fresh message back before letting the error
# propagate — an async retry would otherwise read the stale (already
# deleted) ts, no-op its delete, and post a *second* schedule, orphaning
# this one at the bottom of the channel.
try:
schedule.save_schedule_post(channel_id, message_ts, schedule_week)
except Exception:
logger.warning(
"Failed to persist schedule post %s; rolling it back to avoid an "
"orphaned duplicate on retry",
message_ts,
exc_info=True,
)
try:
slack.chat_delete(channel=channel_id, ts=message_ts)
except Exception:
logger.warning(
"Could not roll back orphaned schedule post %s",
"Rolled schedule post %s forward to week of %s",
message_ts,
exc_info=True,
week_start,
)
raise
# Enqueue after the schedule post is persisted so an EventBridge retry
# caused by save_schedule_post cannot send the same week twice. A sent
# flag on the pay record covers a later timeout or a forced re-run.
if pay_record["breakdown"] and not pay_record.get("checkcomponents_sent"):
sent = False
try:
sent = _send_checkcomponents(pay_record)
except Exception:
logger.exception(
"checkcomponents send failed week=%s",
week_key,
logger.warning(
"Could not update existing schedule post; reposting", exc_info=True
)
if sent:
try:
pay_record["checkcomponents_sent"] = True
schedule.save_pay_record(week_key, pay_record)
except Exception:
logger.exception(
"checkcomponents sent flag failed week=%s",
week_key,
)
if message_ts is None:
result = slack.chat_postMessage(
channel=channel_id, blocks=blocks, text=fallback_text
)
message_ts = result["ts"]
logger.info(
"Posted new weekly schedule to channel %s (ts=%s)", channel_id, message_ts
)
schedule.save_schedule_post(channel_id, message_ts, week_start)
return {
"posted": True,
"channel": channel_id,

4
src/weekly-post/requirements.txt
View file

@ -1,2 +1,2 @@
boto3>=1.43.99
slack_sdk>=3.44.1,<4.0
slack_sdk>=3.42.0,<4.0
boto3>=1.43.36

959
template.yaml Normal file
View file

@ -0,0 +1,959 @@
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: After-Hours Shift Manager — Slack bot for managing on-call shifts with 3CX integration
Parameters:
Timezone:
Type: String
Default: "America/New_York"
ShiftChannel:
Type: String
Description: Slack channel ID for schedule posts and shift notifications
QueueNumber:
Type: String
Default: "801"
Description: 3CX queue extension number to update
Globals:
Function:
Runtime: python3.12
Timeout: 30
MemorySize: 1024
Architectures:
- arm64
PermissionsBoundary: arn:aws:iam::328440206208:policy/seahaven-lambda-execution-boundary
# Access logging + default throttling on the implicit HTTP API (audit M-18).
HttpApi:
AccessLogSettings:
DestinationArn: !GetAtt ApiAccessLogGroup.Arn
Format: '{"requestId":"$context.requestId","ip":"$context.identity.sourceIp","requestTime":"$context.requestTime","method":"$context.httpMethod","routeKey":"$context.routeKey","status":"$context.status","protocol":"$context.protocol","responseLength":"$context.responseLength","integrationError":"$context.integrationErrorMessage"}'
DefaultRouteSettings:
ThrottlingBurstLimit: 50
ThrottlingRateLimit: 100
Resources:
ApiAccessLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: /aws/apigateway/afterhours-shift-manager
RetentionInDays: 90
# --- Shared Lambda Layer ---
SharedLayer:
Type: AWS::Serverless::LayerVersion
Properties:
LayerName: afterhours-shared
ContentUri: src/shared/
CompatibleRuntimes:
- python3.12
CompatibleArchitectures:
- arm64
Metadata:
BuildMethod: python3.12
BuildArchitecture: arm64
# --- DynamoDB ---
ShiftTable:
Type: AWS::DynamoDB::Table
Properties:
TableName: afterhours-shifts
BillingMode: PAY_PER_REQUEST
AttributeDefinitions:
- AttributeName: PK
AttributeType: S
- AttributeName: SK
AttributeType: S
KeySchema:
- AttributeName: PK
KeyType: HASH
- AttributeName: SK
KeyType: RANGE
TimeToLiveSpecification:
AttributeName: expires_at
Enabled: true
# --- Slack Bot Lambda ---
SlackBotFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: afterhours-shift-manager
Handler: handler.handler
CodeUri: src/slack-bot/
Layers:
- !Ref SharedLayer
Environment:
Variables:
SHIFT_TABLE: !Ref ShiftTable
SLACK_BOT_TOKEN_SECRET: afterhours-shift-manager/slack-bot-token
SLACK_SIGNING_SECRET: afterhours-shift-manager/slack-signing-secret
SHIFT_CHANNEL: !Ref ShiftChannel
TCX_SECRET_PREFIX: afterhours-shift-manager/3cx-
QUEUE_NUMBER: !Ref QueueNumber
TZ: !Ref Timezone
# Holiday scheduling: per-holiday one-off schedules target the router,
# passing the scheduler exec role; inline activation invokes it directly.
HOLIDAY_ROUTER_ARN: !GetAtt HolidayRouterFunction.Arn
HOLIDAY_SCHEDULER_ROLE_ARN: !GetAtt HolidaySchedulerExecutionRole.Arn
Policies:
- DynamoDBCrudPolicy:
TableName: !Ref ShiftTable
- Statement:
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource:
- !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/*"
# Manage the per-holiday EventBridge Scheduler one-off schedules
# (08:00 activate / 17:00 deactivate of the holiday router).
- Effect: Allow
Action:
- scheduler:CreateSchedule
- scheduler:DeleteSchedule
- scheduler:GetSchedule
# Predictable names (holiday-activate-/holiday-deactivate-<date>)
# in the default group — scope to those rather than all schedules.
Resource:
- !Sub "arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/default/holiday-*"
# PassRole only for the holiday scheduler exec role, and only when
# handed to EventBridge Scheduler.
- Effect: Allow
Action: iam:PassRole
Resource: !GetAtt HolidaySchedulerExecutionRole.Arn
Condition:
StringEquals:
iam:PassedToService: scheduler.amazonaws.com
# Inline activation (holiday added mid-window) invokes the router now.
# Unqualified ARN only — we invoke the base function, no alias/version.
- Effect: Allow
Action: lambda:InvokeFunction
Resource: !GetAtt HolidayRouterFunction.Arn
Events:
SlackEvents:
Type: HttpApi
Properties:
Path: /slack/events
Method: POST
# --- Weekly Schedule Post (Monday 7am ET) ---
WeeklyPostFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: afterhours-weekly-post
Handler: app.handler
CodeUri: src/weekly-post/
Layers:
- !Ref SharedLayer
Environment:
Variables:
SHIFT_TABLE: !Ref ShiftTable
SLACK_BOT_TOKEN_SECRET: afterhours-shift-manager/slack-bot-token
SHIFT_CHANNEL: !Ref ShiftChannel
SES_SENDER: noreply@seahaven.com
PAYROLL_RECIPIENTS: payroll@seahaven.com
PAY_REPORT_USER: U0A3SC48T47
TZ: !Ref Timezone
Policies:
- DynamoDBCrudPolicy:
TableName: !Ref ShiftTable
- Statement:
# Least privilege: only the Slack bot token, not the whole namespace.
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource:
- !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/slack-bot-token-*"
- Effect: Allow
Action:
- ses:SendEmail
Resource:
# Only the single sending identity (noreply@seahaven.com), not
# every identity in the account.
- !Sub "arn:aws:ses:${AWS::Region}:${AWS::AccountId}:identity/noreply@seahaven.com"
# The sending identity has a default configuration set
# (seahaven-email-events); SES authorizes SendEmail against the
# config-set resource too, so it must be granted alongside the
# identity or the send is denied. Scoped to the known set name.
- !Sub "arn:aws:ses:${AWS::Region}:${AWS::AccountId}:configuration-set/seahaven-email-events"
Events:
# EST: 7am ET = 12:00 UTC (Nov-Mar)
WeeklyPostEST:
Type: Schedule
Properties:
Schedule: cron(0 12 ? * MON *)
Description: "Post weekly schedule Monday 7am EST"
Enabled: true
# EDT: 7am ET = 11:00 UTC (Mar-Nov)
WeeklyPostEDT:
Type: Schedule
Properties:
Schedule: cron(0 11 ? * MON *)
Description: "Post weekly schedule Monday 7am EDT"
Enabled: true
# --- Roster Sync Lambda (daily sync from 3CX) ---
RosterSyncFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: afterhours-roster-sync
Handler: app.handler
CodeUri: src/roster-sync/
Layers:
- !Ref SharedLayer
Timeout: 60
Environment:
Variables:
SHIFT_TABLE: !Ref ShiftTable
TCX_SECRET_PREFIX: afterhours-shift-manager/3cx-
SYNC_GROUP: DEFAULT
TZ: !Ref Timezone
Policies:
- DynamoDBCrudPolicy:
TableName: !Ref ShiftTable
- Statement:
# Least privilege: only the 3cx-* secrets this function reads.
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource:
- !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/3cx-*"
Events:
# Daily at 6am ET (before the 7am schedule post and 8am 3CX scheduler)
# EST: 6am ET = 11:00 UTC (Nov-Mar)
RosterSyncEST:
Type: Schedule
Properties:
Schedule: cron(0 11 ? * * *)
Description: "Sync roster from 3CX at 6am EST"
Enabled: true
# EDT: 6am ET = 10:00 UTC (Mar-Nov)
RosterSyncEDT:
Type: Schedule
Properties:
Schedule: cron(0 10 ? * * *)
Description: "Sync roster from 3CX at 6am EDT"
Enabled: true
# --- Ring Scheduler (daily 3CX queue routing updates) ---
RingSchedulerFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: afterhours-ring-scheduler
Handler: app.handler
CodeUri: src/ring-scheduler/
Layers:
- !Ref SharedLayer
Timeout: 60
Environment:
Variables:
SHIFT_TABLE: !Ref ShiftTable
TCX_SECRET_PREFIX: afterhours-shift-manager/3cx-
QUEUE_NUMBER: !Ref QueueNumber
TZ: !Ref Timezone
Policies:
- DynamoDBReadPolicy:
TableName: !Ref ShiftTable
- Statement:
# Least privilege: only the 3cx-* secrets this function reads.
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource:
- !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/3cx-*"
Events:
# Daily at 8am ET — update after-hours routing
DailyScheduleEST:
Type: Schedule
Properties:
Schedule: cron(0 13 ? * * *)
Description: "Update 3CX queue at 8am EST"
Enabled: true
DailyScheduleEDT:
Type: Schedule
Properties:
Schedule: cron(0 12 ? * * *)
Description: "Update 3CX queue at 8am EDT"
Enabled: true
# Weekends at 5pm ET — switch to night shift person
WeekendEveningEST:
Type: Schedule
Properties:
Schedule: cron(0 22 ? * SAT,SUN *)
Description: "Update 3CX queue at 5pm EST weekends"
Enabled: true
WeekendEveningEDT:
Type: Schedule
Properties:
Schedule: cron(0 21 ? * SAT,SUN *)
Description: "Update 3CX queue at 5pm EDT weekends"
Enabled: true
# Lambda error alarm for the ring scheduler. Mirrors the account-wide
# operational convention (Lambda-Errors-<fn>, threshold 1 over one 5-min
# period, Sum, missing=notBreaching) and pages the same site-alerts SNS topic
# → AWS Chatbot → Slack as the other afterhours-* functions.
RingSchedulerErrorAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Errors-${RingSchedulerFunction}"
AlarmDescription: "Ring scheduler Lambda reported one or more errors"
Namespace: AWS/Lambda
MetricName: Errors
Dimensions:
- Name: FunctionName
Value: !Ref RingSchedulerFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# --- Holiday Router (repoints 3CX IVR/queue for a holiday day-shift) ---
# Invoked with {"action": "activate"|"deactivate", "date": "<YYYY-MM-DD>"} at
# 08:00 ET (activate) and 17:00 ET (deactivate) for each holiday date. Both
# operations are idempotent. No standing schedule here — invocation is driven
# per-holiday-date (the holiday record gates the work; off-days are no-ops).
HolidayRouterFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: afterhours-holiday-router
Handler: app.handler
CodeUri: src/holiday-router/
Layers:
- !Ref SharedLayer
Timeout: 60
Environment:
Variables:
SHIFT_TABLE: !Ref ShiftTable
TCX_SECRET_PREFIX: afterhours-shift-manager/3cx-
TZ: !Ref Timezone
Policies:
- DynamoDBCrudPolicy:
TableName: !Ref ShiftTable
- Statement:
# Least privilege: only the 3cx-* secrets this function reads.
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource:
- !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/3cx-*"
# Lambda error alarm for the holiday router. Mirrors the account-wide
# operational convention (Lambda-Errors-<fn>, threshold 1 over one 5-min
# period, Sum, missing=notBreaching) and pages the same site-alerts SNS topic
# → AWS Chatbot → Slack as the other afterhours-* functions.
HolidayRouterErrorAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Errors-${HolidayRouterFunction}"
AlarmDescription: "Holiday router Lambda reported one or more errors"
Namespace: AWS/Lambda
MetricName: Errors
Dimensions:
- Name: FunctionName
Value: !Ref HolidayRouterFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# EventBridge Scheduler execution role. The slack-bot creates one-off
# schedules per holiday date (08:00 activate / 17:00 deactivate); Scheduler
# assumes this role to invoke the holiday router. Auto-named (no RoleName) so
# the deploy's CAPABILITY_IAM suffices — cd-sam does not pass
# CAPABILITY_NAMED_IAM. The permissions boundary is REQUIRED: the scoped
# github-cfn-execution-role gates iam:CreateRole/PutRolePolicy on roles
# carrying exactly this boundary, so the CI deploy is denied without it.
HolidaySchedulerExecutionRole:
Type: AWS::IAM::Role
Properties:
PermissionsBoundary: arn:aws:iam::328440206208:policy/seahaven-lambda-execution-boundary
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service: scheduler.amazonaws.com
Action: sts:AssumeRole
Condition:
StringEquals:
aws:SourceAccount: !Ref AWS::AccountId
# Only schedules this stack creates (holiday-* in the default group)
# may assume the role — not any schedule in the account.
ArnLike:
aws:SourceArn: !Sub "arn:aws:scheduler:${AWS::Region}:${AWS::AccountId}:schedule/default/holiday-*"
Policies:
- PolicyName: invoke-holiday-router
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: lambda:InvokeFunction
Resource: !GetAtt HolidayRouterFunction.Arn
# --- Release Notifier (invoked by release.yaml on minor/major releases) ---
ReleaseNotifierFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: afterhours-release-notifier
Handler: app.handler
CodeUri: src/release-notifier/
Layers:
- !Ref SharedLayer
Environment:
Variables:
SLACK_BOT_TOKEN_SECRET: afterhours-shift-manager/slack-bot-token
SHIFT_CHANNEL: !Ref ShiftChannel
TZ: !Ref Timezone
Policies:
# Least privilege: only the Slack bot token, not the whole namespace.
- Statement:
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource:
- !Sub "arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:afterhours-shift-manager/slack-bot-token-*"
# GitHub-OIDC role assumed by release.yaml to invoke the notifier. Auto-named
# (no RoleName) so the deploy's CAPABILITY_IAM is sufficient — cd-sam does not
# pass CAPABILITY_NAMED_IAM. Trust + permission are scoped to the minimum: this
# repo's main ref + release workflow, and InvokeFunction on the notifier alone.
# Its ARN is surfaced as a stack output and set once as the
# RELEASE_NOTIFY_INVOKE_ROLE_ARN repo variable (see README).
#
# The permissions boundary is REQUIRED, not optional: the scoped
# github-cfn-execution-role's IAM policy gates iam:CreateRole/PutRolePolicy on
# the role carrying exactly this boundary, so the CI deploy is denied without
# it. The boundary itself permits lambda:InvokeFunction (Sid LambdaInvoke), so
# it does not restrict this role's one job.
ReleaseNotifyInvokeRole:
Type: AWS::IAM::Role
Properties:
PermissionsBoundary: arn:aws:iam::328440206208:policy/seahaven-lambda-execution-boundary
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Federated: !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com"
Action: sts:AssumeRoleWithWebIdentity
Condition:
StringEquals:
token.actions.githubusercontent.com:aud: sts.amazonaws.com
StringLike:
token.actions.githubusercontent.com:sub: "repo:Sea-Haven-Industries/afterhours-shift-manager:ref:refs/heads/main"
# Defense-in-depth: only the Deploy workflow's release job may assume
# this role, not any workflow running on main. (The release job lives
# in deploy.yaml; this must match that workflow's path.)
token.actions.githubusercontent.com:job_workflow_ref: "Sea-Haven-Industries/afterhours-shift-manager/.github/workflows/deploy.yaml@refs/heads/main"
Policies:
- PolicyName: invoke-release-notifier
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: lambda:InvokeFunction
Resource: !GetAtt ReleaseNotifierFunction.Arn
# ===========================================================================
# CloudWatch alarm coverage (Wave 1 PR A). All alarms page the same
# site-alerts SNS topic → AWS Chatbot → Slack as the existing Errors alarms.
# No OKActions by design (the existing Errors alarms have none either).
# Naming follows the in-template convention: Lambda-<Metric>-${Fn}.
# ===========================================================================
# --- Lambda Errors alarms (clone of HolidayRouterErrorAlarm) ---
# Errors for ring-scheduler + holiday-router already exist above.
RosterSyncErrorAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Errors-${RosterSyncFunction}"
AlarmDescription: "Roster sync Lambda reported one or more errors"
Namespace: AWS/Lambda
MetricName: Errors
Dimensions:
- Name: FunctionName
Value: !Ref RosterSyncFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
ReleaseNotifierErrorAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Errors-${ReleaseNotifierFunction}"
AlarmDescription: "Release notifier Lambda reported one or more errors"
Namespace: AWS/Lambda
MetricName: Errors
Dimensions:
- Name: FunctionName
Value: !Ref ReleaseNotifierFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# ORPHAN ADOPTION: live alarms named Lambda-Errors-afterhours-shift-manager
# and Lambda-Errors-afterhours-weekly-post already exist OUTSIDE the stack.
# They MUST be deleted immediately before this stack deploys, or CloudFormation
# will fail to create these resources (AlarmName collision). See PR body.
SlackBotErrorAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Errors-${SlackBotFunction}"
AlarmDescription: "Slack bot Lambda reported one or more errors"
Namespace: AWS/Lambda
MetricName: Errors
Dimensions:
- Name: FunctionName
Value: !Ref SlackBotFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
WeeklyPostErrorAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Errors-${WeeklyPostFunction}"
AlarmDescription: "Weekly post Lambda reported one or more errors"
Namespace: AWS/Lambda
MetricName: Errors
Dimensions:
- Name: FunctionName
Value: !Ref WeeklyPostFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# --- Lambda Duration alarms (Maximum, ms; 2-of-3 evaluation) ---
# Thresholds set to ~80% of each function's timeout, with 2-of-3 evaluation.
# Timeouts: slack-bot/weekly-post/release-notifier = 30s (global default);
# roster-sync/ring-scheduler/holiday-router = 60s.
SlackBotDurationAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Duration-${SlackBotFunction}"
AlarmDescription: "Slack bot Lambda duration approaching its 30s timeout (>=24s)"
Namespace: AWS/Lambda
MetricName: Duration
Dimensions:
- Name: FunctionName
Value: !Ref SlackBotFunction
Statistic: Maximum
Period: 300
EvaluationPeriods: 3
DatapointsToAlarm: 2
Threshold: 24000
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
WeeklyPostDurationAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Duration-${WeeklyPostFunction}"
AlarmDescription: "Weekly post Lambda duration approaching its 30s timeout (>=24s)"
Namespace: AWS/Lambda
MetricName: Duration
Dimensions:
- Name: FunctionName
Value: !Ref WeeklyPostFunction
Statistic: Maximum
Period: 300
EvaluationPeriods: 3
DatapointsToAlarm: 2
Threshold: 24000
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
RosterSyncDurationAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Duration-${RosterSyncFunction}"
AlarmDescription: "Roster sync Lambda duration approaching its 60s timeout (>=48s)"
Namespace: AWS/Lambda
MetricName: Duration
Dimensions:
- Name: FunctionName
Value: !Ref RosterSyncFunction
Statistic: Maximum
Period: 300
EvaluationPeriods: 3
DatapointsToAlarm: 2
Threshold: 48000
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
RingSchedulerDurationAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Duration-${RingSchedulerFunction}"
AlarmDescription: "Ring scheduler Lambda duration approaching its 60s timeout (>=48s)"
Namespace: AWS/Lambda
MetricName: Duration
Dimensions:
- Name: FunctionName
Value: !Ref RingSchedulerFunction
Statistic: Maximum
Period: 300
EvaluationPeriods: 3
DatapointsToAlarm: 2
Threshold: 48000
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
HolidayRouterDurationAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Duration-${HolidayRouterFunction}"
AlarmDescription: "Holiday router Lambda duration approaching its 60s timeout (>=48s)"
Namespace: AWS/Lambda
MetricName: Duration
Dimensions:
- Name: FunctionName
Value: !Ref HolidayRouterFunction
Statistic: Maximum
Period: 300
EvaluationPeriods: 3
DatapointsToAlarm: 2
Threshold: 48000
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
ReleaseNotifierDurationAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Duration-${ReleaseNotifierFunction}"
AlarmDescription: "Release notifier Lambda duration approaching its 30s timeout (>=24s)"
Namespace: AWS/Lambda
MetricName: Duration
Dimensions:
- Name: FunctionName
Value: !Ref ReleaseNotifierFunction
Statistic: Maximum
Period: 300
EvaluationPeriods: 3
DatapointsToAlarm: 2
Threshold: 24000
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# --- Lambda Throttles alarms (Sum; threshold 1 over one 5-min period) ---
SlackBotThrottlesAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Throttles-${SlackBotFunction}"
AlarmDescription: "Slack bot Lambda was throttled (concurrency limit hit)"
Namespace: AWS/Lambda
MetricName: Throttles
Dimensions:
- Name: FunctionName
Value: !Ref SlackBotFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
WeeklyPostThrottlesAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Throttles-${WeeklyPostFunction}"
AlarmDescription: "Weekly post Lambda was throttled (concurrency limit hit)"
Namespace: AWS/Lambda
MetricName: Throttles
Dimensions:
- Name: FunctionName
Value: !Ref WeeklyPostFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
RosterSyncThrottlesAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Throttles-${RosterSyncFunction}"
AlarmDescription: "Roster sync Lambda was throttled (concurrency limit hit)"
Namespace: AWS/Lambda
MetricName: Throttles
Dimensions:
- Name: FunctionName
Value: !Ref RosterSyncFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
RingSchedulerThrottlesAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Throttles-${RingSchedulerFunction}"
AlarmDescription: "Ring scheduler Lambda was throttled (concurrency limit hit)"
Namespace: AWS/Lambda
MetricName: Throttles
Dimensions:
- Name: FunctionName
Value: !Ref RingSchedulerFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
HolidayRouterThrottlesAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Throttles-${HolidayRouterFunction}"
AlarmDescription: "Holiday router Lambda was throttled (concurrency limit hit)"
Namespace: AWS/Lambda
MetricName: Throttles
Dimensions:
- Name: FunctionName
Value: !Ref HolidayRouterFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
ReleaseNotifierThrottlesAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "Lambda-Throttles-${ReleaseNotifierFunction}"
AlarmDescription: "Release notifier Lambda was throttled (concurrency limit hit)"
Namespace: AWS/Lambda
MetricName: Throttles
Dimensions:
- Name: FunctionName
Value: !Ref ReleaseNotifierFunction
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# --- DynamoDB alarms (afterhours-shifts table) ---
# ReadThrottleEvents / WriteThrottleEvents are the table-level throttle
# signals: AWS/DynamoDB emits them at the TableName dimension, so these
# alarms transition normally. (ThrottledRequests and SystemErrors are NOT
# emitted at TableName-only granularity — only at TableName+Operation — so
# alarms on them sit permanently in INSUFFICIENT_DATA and never fire.)
ShiftTableReadThrottleAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "DDB-ReadThrottle-${ShiftTable}"
AlarmDescription: "afterhours-shifts table had one or more read throttle events"
Namespace: AWS/DynamoDB
MetricName: ReadThrottleEvents
Dimensions:
- Name: TableName
Value: !Ref ShiftTable
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 0
ComparisonOperator: GreaterThanThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
ShiftTableWriteThrottleAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "DDB-WriteThrottle-${ShiftTable}"
AlarmDescription: "afterhours-shifts table had one or more write throttle events"
Namespace: AWS/DynamoDB
MetricName: WriteThrottleEvents
Dimensions:
- Name: TableName
Value: !Ref ShiftTable
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 0
ComparisonOperator: GreaterThanThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# --- API Gateway v2 (HTTP API) alarms on the implicit ServerlessHttpApi ---
# AWS::ApiGatewayV2 metric names: 4xx, 5xx, Latency; dimension ApiId.
ApiGateway4xxAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "ApiGateway-4xx-${ServerlessHttpApi}"
AlarmDescription: "Elevated 4xx responses on the Slack events HTTP API"
Namespace: AWS/ApiGateway
MetricName: 4xx
Dimensions:
- Name: ApiId
Value: !Ref ServerlessHttpApi
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 5
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
ApiGateway5xxAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "ApiGateway-5xx-${ServerlessHttpApi}"
AlarmDescription: "5xx responses on the Slack events HTTP API"
Namespace: AWS/ApiGateway
MetricName: 5xx
Dimensions:
- Name: ApiId
Value: !Ref ServerlessHttpApi
Statistic: Sum
Period: 300
EvaluationPeriods: 1
Threshold: 1
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# Latency p99 via ExtendedStatistic. ~3000ms target chosen alongside the
# Lambda Duration thresholds (Slack requires a fast 3s ack).
ApiGatewayLatencyAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmName: !Sub "ApiGateway-Latency-${ServerlessHttpApi}"
AlarmDescription: "p99 latency on the Slack events HTTP API exceeded 3s"
Namespace: AWS/ApiGateway
MetricName: Latency
Dimensions:
- Name: ApiId
Value: !Ref ServerlessHttpApi
ExtendedStatistic: p99
Period: 300
EvaluationPeriods: 3
DatapointsToAlarm: 2
Threshold: 3000
ComparisonOperator: GreaterThanOrEqualToThreshold
TreatMissingData: notBreaching
AlarmActions:
- !Sub "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:site-alerts"
# --- CloudWatch Log Groups (explicit 60-day retention) ---
SlackBotLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Sub "/aws/lambda/${SlackBotFunction}"
RetentionInDays: 60
WeeklyPostLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Sub "/aws/lambda/${WeeklyPostFunction}"
RetentionInDays: 60
RosterSyncLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Sub "/aws/lambda/${RosterSyncFunction}"
RetentionInDays: 60
RingSchedulerLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Sub "/aws/lambda/${RingSchedulerFunction}"
RetentionInDays: 60
HolidayRouterLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Sub "/aws/lambda/${HolidayRouterFunction}"
RetentionInDays: 60
ReleaseNotifierLogGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Sub "/aws/lambda/${ReleaseNotifierFunction}"
RetentionInDays: 60
Outputs:
SlackBotApiUrl:
Description: URL for Slack app Request URL configuration
Value: !Sub "https://${ServerlessHttpApi}.execute-api.${AWS::Region}.amazonaws.com/slack/events"
ShiftTableName:
Value: !Ref ShiftTable
SlackBotFunctionArn:
Value: !GetAtt SlackBotFunction.Arn
WeeklyPostFunctionArn:
Value: !GetAtt WeeklyPostFunction.Arn
RosterSyncFunctionArn:
Value: !GetAtt RosterSyncFunction.Arn
RingSchedulerFunctionArn:
Value: !GetAtt RingSchedulerFunction.Arn
HolidayRouterFunctionArn:
Value: !GetAtt HolidayRouterFunction.Arn
HolidaySchedulerExecutionRoleArn:
Description: Role EventBridge Scheduler assumes to invoke the holiday router; the slack-bot passes this when creating per-holiday schedules
Value: !GetAtt HolidaySchedulerExecutionRole.Arn
ReleaseNotifierFunctionArn:
Value: !GetAtt ReleaseNotifierFunction.Arn
ReleaseNotifyInvokeRoleArn:
Description: Set this as the RELEASE_NOTIFY_INVOKE_ROLE_ARN repo variable for release.yaml
Value: !GetAtt ReleaseNotifyInvokeRole.Arn

61
terraform/.terraform.lock.hcl generated
View file

@ -1,61 +0,0 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/archive" {
version = "2.8.1"
constraints = "~> 2.8"
hashes = [
"h1:aLNmq6dc3cDcqZc8s/8eKtn0I+UQXyJMGrmo4rRFtNw=",
"zh:03de290604114a89fcd45c2e5bc7787d5a1ebfc5f964fb5989306bea7a4c79ec",
"zh:0a7d69dc9fbbc48960bc2f04588c8fb1bd92c78a8f306566b7fb17fc4a4f2058",
"zh:4df1f3981379c35f1757da957470f7f7724496b57219da3485177cf1647bdf59",
"zh:50f0e72ba53bfe6e11b03b7fc899e1f72536354381d302a743a274ae2a3f45f4",
"zh:5c4e15a04c98e2a8cafb1cd9632b48ad318051e8462d105b1153006277985c35",
"zh:66069e604bcf5c4af0278e15997d9e6bd755c54fb3801d78885838b889729c5f",
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
"zh:979765db3f42601870ab377104ba70befb029547b278337ec4ada980e3582de6",
"zh:b165254da774f49945a73fbccc3ef1b63d70ea00a98fa9e14716665ba80ecaad",
"zh:c0bb2697b525da9fec4511f569ed2bd2b42f25d5c1f9fa00f8f3645b50cfc2e9",
"zh:c48f6695d12df0d0fa5231f7c1b8d518a4feae91a733fdd35a5804af3a303831",
"zh:d589954c93f075180c9f4e2ce91780d5edcb56dfd0d3cda8ba08e13c10b52249",
"zh:f5792ed06da65d0daf7ca3711f5399ff78c7cb4400afe53fbce9a926fbde4477",
]
}
provider "registry.terraform.io/hashicorp/aws" {
version = "6.66.0"
constraints = "~> 6.66"
hashes = [
"h1:/yJhdVJVyi5k1KA4z1lDoYWQlTOPjR3NIAh/v4cLgLo=",
"h1:5COqw8J20qkGI2ao1u8RTTguYEgiE3LJSbToD5fYUg4=",
"h1:5t1vkYwqDYRN27RliDkyWRmQfQCnNHFqWxC2UDVCK78=",
"h1:7Qtd6MjgS/ymociMyFCG9EKK6Jy5kGOy7EfXngFwsl4=",
"h1:LgU7nnuiiD9m9YuYBNMArIgHex/RZqe4VFevYb/1kJU=",
"h1:OnLj4nhqJnEcUzyyRKUjp1FgWG00Y8maikJEYSf9Zjw=",
"h1:RhHqC2ugIjXrVhSu/Q6WYd/WOjjQ6rH27bh7LZuIW1w=",
"h1:Rx4Ktpqk2eSvoPEIWB240IC67BkQxEXGmY/eRu6PIGk=",
"h1:S8gYRM7I6/ufvF4dhBaAAGHm3f3+FKBUnEKR93Wcprs=",
"h1:ZbkpwuEfpWTZDKdJnEZSDKN5tGEQTUYRkKuK6Cz2wcc=",
"h1:c9A3yNQ0xB0wlJfG1XK3pfEHOEYx3HyJaQ56WnNv190=",
"h1:cXBw4chYKvv6XlSvyVGAfSGKCAXwC0/fOAuq7xv7hME=",
"h1:hBEaeBm9nm7A/u1nnD0nfolTPP55/BoKRFWk8zG8/fk=",
"h1:mIolsCn33slp3F7Zd4KCTScXAWuUQsjtIzA/a6TFG6Q=",
"h1:xehZnyesOrJ1/R9tmnRSu7FRkwoDDKelEHI3WdnJ72g=",
"zh:156fe7164a3d26ef6b35734c43e99fb198df90575ed897d1182b8e930b8cd523",
"zh:1af52b22b35be00f8d16e3ebebff9fa699ec4db2ef69e6032ba5c536f80c03d9",
"zh:2545a8478bd551fdc9694f6cc1a1ad24617f6736f8bde0ad6cae90987c65380f",
"zh:4070db1ee369ccb41cb610bfd887386bc0a9b9ecad60aeb4dbce58443d2519dd",
"zh:53da7d3c1840ef875c7d34e967732502a64fe677af0e78824773d4c15a8fe740",
"zh:576a93a28bf611a4de2a2e6ced697a41d5126b8fd31d30782b16797e410a9706",
"zh:58fed5fa9a033355b9d4f3092c817b70d934100e0d8678d6e4c93f3c9493d4e4",
"zh:6a9ca2f24e2ee9156dd785d159a850b35d190e9cf7eca21cb9582970c2db80cd",
"zh:729edd30f99cc16009deba5c013265b0c81eda261a3d0821cbd011d3287fd230",
"zh:7ae460049b75bd4aefee465ef7c53a01ac2df46d4d3e3ac00824afa8b5cb83fb",
"zh:9051fa85c8034ade8a57a5c6f232fd33da28f3800bb5aa40bc8625dbc5e27632",
"zh:906547e4319805e7acf7fbdf2bac28a4b1a7370790a2a430c7adb1b29bb934eb",
"zh:998f27410a66158a35ee5ed142c27e5b21fe8601941da55da2157f8042d6dcca",
"zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
"zh:9c1804eff1dda0446dc2d215231015bb65a2fc6c3b7ba24584fe45f1ddd3fa9f",
"zh:b03ff5efdee310502aaaeb460144dc059bce72a0d8217e6b989099ef8aef9283",
]
}

14
terraform/acm.tf
View file

@ -1,14 +0,0 @@
# ACM certificate for ALB HTTPS. Lookup only; do not mint. The issued wildcard
# already exists in the account (portal pattern).
#
# Bootstrap order if the listener is ever rebuilt from nothing:
# 1. Confirm an ISSUED certificate for local.acm_wildcard_domain exists.
# 2. Set attach_custom_domain=true and apply. Until the lookup finds ISSUED,
# the plan fails closed.
data "aws_acm_certificate" "wildcard" {
count = var.attach_custom_domain ? 1 : 0
domain = local.acm_wildcard_domain
statuses = ["ISSUED"]
most_recent = true
}

79
terraform/alarms.tf
View file

@ -1,79 +0,0 @@
resource "aws_cloudwatch_metric_alarm" "ddb_read_throttle" {
alarm_name = "DDB-ReadThrottle-${local.table_name}"
alarm_description = "afterhours-shifts table had one or more read throttle events"
namespace = "AWS/DynamoDB"
metric_name = "ReadThrottleEvents"
dimensions = { TableName = aws_dynamodb_table.shifts.name }
statistic = "Sum"
period = 300
evaluation_periods = 1
threshold = 0
comparison_operator = "GreaterThanThreshold"
treat_missing_data = "notBreaching"
alarm_actions = [local.site_alerts_arn]
}
resource "aws_cloudwatch_metric_alarm" "ddb_write_throttle" {
alarm_name = "DDB-WriteThrottle-${local.table_name}"
alarm_description = "afterhours-shifts table had one or more write throttle events"
namespace = "AWS/DynamoDB"
metric_name = "WriteThrottleEvents"
dimensions = { TableName = aws_dynamodb_table.shifts.name }
statistic = "Sum"
period = 300
evaluation_periods = 1
threshold = 0
comparison_operator = "GreaterThanThreshold"
treat_missing_data = "notBreaching"
alarm_actions = [local.site_alerts_arn]
}
resource "aws_cloudwatch_metric_alarm" "alb_5xx" {
alarm_name = "ALB-5xx-${local.project}"
alarm_description = "ALB 5xx from afterhours-shift-manager"
namespace = "AWS/ApplicationELB"
metric_name = "HTTPCode_Target_5XX_Count"
dimensions = { LoadBalancer = aws_lb.api.arn_suffix }
statistic = "Sum"
period = 300
evaluation_periods = 1
threshold = 0
comparison_operator = "GreaterThanThreshold"
treat_missing_data = "notBreaching"
alarm_actions = [local.site_alerts_arn]
}
resource "aws_cloudwatch_metric_alarm" "alb_latency" {
alarm_name = "ALB-Latency-${local.project}"
alarm_description = "p99 target response time on the afterhours ALB exceeded 3s"
namespace = "AWS/ApplicationELB"
metric_name = "TargetResponseTime"
dimensions = { LoadBalancer = aws_lb.api.arn_suffix }
extended_statistic = "p99"
period = 300
evaluation_periods = 3
datapoints_to_alarm = 2
threshold = 3
comparison_operator = "GreaterThanOrEqualToThreshold"
treat_missing_data = "notBreaching"
alarm_actions = [local.site_alerts_arn]
}
resource "aws_cloudwatch_metric_alarm" "alb_unhealthy_hosts" {
alarm_name = "ALB-UnhealthyHost-${local.project}"
alarm_description = "Unhealthy Fargate targets on the afterhours ALB"
namespace = "AWS/ApplicationELB"
metric_name = "UnHealthyHostCount"
dimensions = {
LoadBalancer = aws_lb.api.arn_suffix
TargetGroup = aws_lb_target_group.api.arn_suffix
}
statistic = "Maximum"
period = 60
evaluation_periods = 3
datapoints_to_alarm = 3
threshold = 0
comparison_operator = "GreaterThanThreshold"
treat_missing_data = "notBreaching"
alarm_actions = [local.site_alerts_arn]
}

118
terraform/artifacts.tf
View file

@ -1,118 +0,0 @@
# Lambda artifacts bucket. Terraform ships only the bootstrap stub.
# .github/workflows/deploy.yaml uploads functions/<name>/<sha>.zip and calls
# update-function-code. Functions ignore code attributes afterwards.
resource "aws_s3_bucket" "artifacts" {
bucket = local.artifacts_bucket_name
tags = {
Purpose = "Lambda deployment packages for afterhours-shift-manager"
}
}
resource "aws_s3_bucket_public_access_block" "artifacts" {
bucket = aws_s3_bucket.artifacts.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
resource "aws_s3_bucket_ownership_controls" "artifacts" {
bucket = aws_s3_bucket.artifacts.id
rule {
object_ownership = "BucketOwnerEnforced"
}
}
resource "aws_s3_bucket_server_side_encryption_configuration" "artifacts" {
bucket = aws_s3_bucket.artifacts.id
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "AES256"
}
}
}
resource "aws_s3_bucket_versioning" "artifacts" {
bucket = aws_s3_bucket.artifacts.id
versioning_configuration {
status = "Enabled"
}
}
resource "aws_s3_bucket_lifecycle_configuration" "artifacts" {
bucket = aws_s3_bucket.artifacts.id
rule {
id = "expire-noncurrent-packages"
status = "Enabled"
filter {}
noncurrent_version_expiration {
noncurrent_days = 180
}
}
rule {
id = "abort-incomplete-multipart"
status = "Enabled"
filter {}
abort_incomplete_multipart_upload {
days_after_initiation = 7
}
}
depends_on = [aws_s3_bucket_versioning.artifacts]
}
data "aws_iam_policy_document" "artifacts" {
statement {
sid = "DenyInsecureTransport"
effect = "Deny"
principals {
type = "*"
identifiers = ["*"]
}
actions = ["s3:*"]
resources = [
aws_s3_bucket.artifacts.arn,
"${aws_s3_bucket.artifacts.arn}/*",
]
condition {
test = "Bool"
variable = "aws:SecureTransport"
values = ["false"]
}
}
}
resource "aws_s3_bucket_policy" "artifacts" {
bucket = aws_s3_bucket.artifacts.id
policy = data.aws_iam_policy_document.artifacts.json
depends_on = [aws_s3_bucket_public_access_block.artifacts]
}
data "archive_file" "bootstrap_stub" {
type = "zip"
source_dir = "${path.module}/bootstrap/stub"
output_path = "${path.module}/build/packages/bootstrap-stub.zip"
}
resource "aws_s3_object" "bootstrap_stub" {
bucket = aws_s3_bucket.artifacts.id
key = "functions/bootstrap-stub.zip"
content_base64 = filebase64(data.archive_file.bootstrap_stub.output_path)
source_hash = data.archive_file.bootstrap_stub.output_base64sha256
}

9
terraform/bootstrap/stub/handler.py
View file

@ -1,9 +0,0 @@
"""Bootstrap stub. GitHub Actions replaces this zip via update-function-code."""
def handler(event, context):
return {
"statusCode": 503,
"headers": {"content-type": "application/json"},
"body": '{"error":{"code":"NOT_DEPLOYED","message":"Function code has not been deployed yet."}}',
}

35
terraform/data.tf
View file

@ -1,35 +0,0 @@
data "aws_caller_identity" "current" {}
# Resource names in locals.tf embed the account ID. If the workspace is ever
# pointed at another account, fail the plan here rather than creating a parallel
# set of oddly-named resources somewhere else.
check "correct_account" {
assert {
condition = data.aws_caller_identity.current.account_id == local.account_id
error_message = "This configuration targets account ${local.account_id} (${var.environment}), but the credentials resolve to ${data.aws_caller_identity.current.account_id}."
}
}
check "dev_has_no_external_side_effects" {
assert {
condition = local.is_prod || alltrue([
for name in ["SHIFT_CHANNEL", "QUEUE_NUMBER", "PAY_REPORT_USER", "TCX_SECRET_PREFIX"] :
one([for env in local.api_environment : env.value if env.name == name]) == ""
])
error_message = "Non-prod must leave SHIFT_CHANNEL, QUEUE_NUMBER, PAY_REPORT_USER, and TCX_SECRET_PREFIX empty so the task cannot post to Slack or move the production phone queue."
}
}
check "dev_has_no_paychex" {
assert {
condition = local.is_prod || var.checkcomponents_queue_url == ""
error_message = "checkcomponents_queue_url must be empty in non-prod so weekly_post cannot send to the prod Paychex queue."
}
}
check "checkcomponents_pair" {
assert {
condition = (var.checkcomponents_queue_url == "") == (var.checkcomponents_queue_arn == "")
error_message = "checkcomponents_queue_url and checkcomponents_queue_arn must both be set or both be empty."
}
}

21
terraform/dynamodb.tf
View file

@ -1,21 +0,0 @@
resource "aws_dynamodb_table" "shifts" {
name = local.table_name
billing_mode = "PAY_PER_REQUEST"
hash_key = "PK"
range_key = "SK"
attribute {
name = "PK"
type = "S"
}
attribute {
name = "SK"
type = "S"
}
ttl {
attribute_name = "expires_at"
enabled = true
}
}

293
terraform/ecs.tf
View file

@ -1,293 +0,0 @@
# Always-on afterhours API: Fargate behind an ALB. GitHub Actions owns the
# image; Terraform ignores container_definitions after the bootstrap task
# definition. Dual-run with API Gateway until the Fargate cutover.
resource "aws_ecr_repository" "api" {
name = local.project
image_tag_mutability = "MUTABLE"
force_delete = !local.is_prod
image_scanning_configuration {
scan_on_push = true
}
encryption_configuration {
encryption_type = "AES256"
}
}
resource "aws_ecr_lifecycle_policy" "api" {
repository = aws_ecr_repository.api.name
policy = jsonencode({
rules = [
{
rulePriority = 1
description = "Keep the last 20 images"
selection = {
tagStatus = "any"
countType = "imageCountMoreThan"
countNumber = 20
}
action = {
type = "expire"
}
}
]
})
}
resource "aws_security_group" "alb" {
name = "${local.project}-alb"
description = "Public ALB for afterhours-shift-manager"
vpc_id = aws_vpc.this.id
ingress {
description = "HTTP from the internet (health and pre-DNS)"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
dynamic "ingress" {
for_each = var.attach_custom_domain ? [1] : []
content {
description = "HTTPS from the internet"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_security_group" "api" {
name = "${local.project}-api"
description = "Fargate tasks for afterhours-shift-manager"
vpc_id = aws_vpc.this.id
ingress {
description = "From ALB"
from_port = 8080
to_port = 8080
protocol = "tcp"
security_groups = [aws_security_group.alb.id]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_lb" "api" {
name = local.project
load_balancer_type = "application"
idle_timeout = 120
security_groups = [aws_security_group.alb.id]
subnets = aws_subnet.public[*].id
drop_invalid_header_fields = true
}
resource "aws_lb_target_group" "api" {
name = "${local.project}-api"
port = 8080
protocol = "HTTP"
vpc_id = aws_vpc.this.id
target_type = "ip"
health_check {
enabled = true
path = "/api/health"
matcher = "200"
interval = 30
timeout = 5
healthy_threshold = 2
unhealthy_threshold = 3
}
}
resource "aws_lb_listener" "http" {
load_balancer_arn = aws_lb.api.arn
port = 80
protocol = "HTTP"
dynamic "default_action" {
for_each = var.attach_custom_domain ? [1] : []
content {
type = "redirect"
redirect {
port = "443"
protocol = "HTTPS"
status_code = "HTTP_301"
}
}
}
dynamic "default_action" {
for_each = var.attach_custom_domain ? [] : [1]
content {
type = "forward"
target_group_arn = aws_lb_target_group.api.arn
}
}
}
resource "aws_lb_listener" "https" {
count = var.attach_custom_domain ? 1 : 0
load_balancer_arn = aws_lb.api.arn
port = 443
protocol = "HTTPS"
ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
certificate_arn = data.aws_acm_certificate.wildcard[0].arn
default_action {
type = "forward"
target_group_arn = aws_lb_target_group.api.arn
}
}
resource "aws_ecs_cluster" "api" {
name = local.project
setting {
name = "containerInsights"
value = local.is_prod ? "enabled" : "disabled"
}
}
locals {
api_container_name = "api"
bootstrap_command = [
"python",
"-c",
"from http.server import ThreadingHTTPServer, BaseHTTPRequestHandler\nclass H(BaseHTTPRequestHandler):\n def do_GET(self):\n body = b'{\"stage\":\"bootstrap\",\"sha\":\"bootstrap\"}'\n self.send_response(200)\n self.send_header('Content-Type', 'application/json')\n self.send_header('Content-Length', str(len(body)))\n self.end_headers()\n self.wfile.write(body)\nThreadingHTTPServer(('0.0.0.0', 8080), H).serve_forever()",
]
api_environment = [
{ name = "STAGE", value = var.environment },
{ name = "GIT_SHA", value = "bootstrap" },
{ name = "SHIFT_TABLE", value = aws_dynamodb_table.shifts.name },
{ name = "SLACK_BOT_TOKEN_SECRET", value = "afterhours-shift-manager/slack-bot-token" },
{ name = "SLACK_SIGNING_SECRET", value = "afterhours-shift-manager/slack-signing-secret" },
{ name = "SHIFT_CHANNEL", value = local.is_prod ? var.shift_channel : "" },
{ name = "TCX_SECRET_PREFIX", value = local.is_prod ? "afterhours-shift-manager/3cx-" : "" },
{ name = "QUEUE_NUMBER", value = local.is_prod ? var.queue_number : "" },
{ name = "TZ", value = var.timezone },
{ name = "HOLIDAY_SCHEDULER_ROLE_ARN", value = local.holiday_scheduler_role_arn },
{ name = "HOLIDAY_SCHEDULE_GROUP", value = "default" },
{ name = "SENTRY_DSN", value = var.sentry_dsn },
{ name = "PORTAL_COGNITO_ISSUER", value = var.portal_cognito_issuer },
{ name = "PORTAL_COGNITO_AUDIENCE", value = var.portal_cognito_audience },
{ name = "PORTAL_COGNITO_TRUST", value = jsonencode(concat(
var.portal_cognito_issuer != "" && var.portal_cognito_audience != "" ? [{ issuer = var.portal_cognito_issuer, audience = var.portal_cognito_audience }] : [],
var.portal_cognito_extra_trust,
)) },
{ name = "PAY_REPORT_USER", value = local.is_prod ? var.pay_report_user : "" },
{ name = "CHECKCOMPONENTS_QUEUE_URL", value = var.checkcomponents_queue_url },
{ name = "ROSTER_API_TOKEN_SECRET", value = "afterhours-shift-manager/roster-api-token" },
{ name = "SYNC_GROUP", value = "DEFAULT" },
{ name = "JOBS_QUEUE_URL", value = aws_sqs_queue.jobs.id },
{ name = "JOBS_QUEUE_ARN", value = aws_sqs_queue.jobs.arn },
{ name = "AWS_DEFAULT_REGION", value = var.aws_region },
]
}
resource "aws_ecs_task_definition" "api" {
family = local.project
requires_compatibilities = ["FARGATE"]
network_mode = "awsvpc"
cpu = "512"
memory = "1024"
execution_role_arn = aws_iam_role.ecs_execution.arn
task_role_arn = aws_iam_role.ecs_task.arn
runtime_platform {
operating_system_family = "LINUX"
cpu_architecture = "ARM64"
}
container_definitions = jsonencode([
{
name = local.api_container_name
image = "public.ecr.aws/docker/library/python:3.12-slim"
essential = true
command = local.bootstrap_command
portMappings = [
{
containerPort = 8080
protocol = "tcp"
}
]
environment = local.api_environment
logConfiguration = {
logDriver = "awslogs"
options = {
"awslogs-group" = aws_cloudwatch_log_group.api.name
"awslogs-region" = var.aws_region
"awslogs-stream-prefix" = "ecs"
}
}
}
])
lifecycle {
ignore_changes = [container_definitions]
}
}
resource "aws_ecs_service" "api" {
name = local.project
cluster = aws_ecs_cluster.api.id
task_definition = aws_ecs_task_definition.api.arn
desired_count = local.is_prod ? 2 : 1
launch_type = "FARGATE"
health_check_grace_period_seconds = 60
deployment_minimum_healthy_percent = local.is_prod ? 50 : 0
deployment_maximum_percent = 200
network_configuration {
subnets = aws_subnet.public[*].id
security_groups = [aws_security_group.api.id]
assign_public_ip = true
}
load_balancer {
target_group_arn = aws_lb_target_group.api.arn
container_name = local.api_container_name
container_port = 8080
}
lifecycle {
ignore_changes = [task_definition, desired_count]
}
depends_on = [aws_lb_listener.http]
}
resource "aws_sqs_queue" "jobs_dlq" {
name = "${local.project}-jobs-dlq"
message_retention_seconds = 1209600
}
resource "aws_sqs_queue" "jobs" {
name = "${local.project}-jobs"
visibility_timeout_seconds = 180
receive_wait_time_seconds = 20
redrive_policy = jsonencode({
deadLetterTargetArn = aws_sqs_queue.jobs_dlq.arn
maxReceiveCount = 3
})
}

1134
terraform/hcp_iam.tf
View file

File diff suppressed because it is too large Load diff

194
terraform/iam.tf
View file

@ -1,194 +0,0 @@
# Execution, task, and EventBridge Scheduler roles for the Fargate API.
data "aws_iam_policy_document" "ecs_assume" {
statement {
effect = "Allow"
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["ecs-tasks.amazonaws.com"]
}
}
}
data "aws_iam_policy_document" "jobs_scheduler_assume" {
statement {
effect = "Allow"
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["scheduler.amazonaws.com"]
}
}
}
data "aws_iam_policy_document" "ecs_task_boundary" {
statement {
sid = "DdbCrud"
effect = "Allow"
actions = [
"dynamodb:BatchGetItem",
"dynamodb:BatchWriteItem",
"dynamodb:ConditionCheckItem",
"dynamodb:DeleteItem",
"dynamodb:DescribeTable",
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:UpdateItem",
]
resources = [
"arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}",
"arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}/index/*",
]
}
statement {
sid = "Secrets"
effect = "Allow"
actions = ["secretsmanager:GetSecretValue"]
resources = ["arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/*"]
}
statement {
sid = "HolidaySchedules"
effect = "Allow"
actions = [
"scheduler:CreateSchedule",
"scheduler:DeleteSchedule",
"scheduler:GetSchedule",
]
resources = ["arn:aws:scheduler:${var.aws_region}:${local.account_id}:schedule/default/holiday-*"]
}
statement {
sid = "PassHolidayScheduler"
effect = "Allow"
actions = ["iam:PassRole"]
resources = [local.holiday_scheduler_role_arn]
condition {
test = "StringEquals"
variable = "iam:PassedToService"
values = ["scheduler.amazonaws.com"]
}
}
statement {
sid = "InvokeHolidayRouter"
effect = "Allow"
actions = ["lambda:InvokeFunction"]
resources = [local.holiday_router_arn]
}
statement {
sid = "JobsQueue"
effect = "Allow"
actions = [
"sqs:SendMessage",
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes",
]
resources = ["arn:aws:sqs:${var.aws_region}:${local.account_id}:${local.project}-jobs"]
}
dynamic "statement" {
for_each = var.checkcomponents_queue_arn == "" ? [] : [1]
content {
sid = "CheckcomponentsSend"
effect = "Allow"
actions = ["sqs:SendMessage"]
resources = [var.checkcomponents_queue_arn]
}
}
statement {
sid = "EcrAuth"
effect = "Allow"
actions = ["ecr:GetAuthorizationToken"]
resources = ["*"]
}
statement {
sid = "EcrPull"
effect = "Allow"
actions = [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:GetDownloadUrlForLayer",
]
resources = ["arn:aws:ecr:${var.aws_region}:${local.account_id}:repository/${local.project}"]
}
statement {
sid = "TaskLogs"
effect = "Allow"
actions = [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:CreateLogGroup",
]
resources = [
"arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}",
"arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/ecs/${local.project}:*",
]
}
}
resource "aws_iam_policy" "ecs_task_boundary" {
name = "${local.project}-ecs-task-boundary"
path = "/tf-managed/"
description = "Permissions boundary for the afterhours-shift-manager ECS task role"
policy = data.aws_iam_policy_document.ecs_task_boundary.json
}
resource "aws_iam_role" "ecs_execution" {
name = "${local.project}-ecs-exec"
path = "/tf-managed/"
assume_role_policy = data.aws_iam_policy_document.ecs_assume.json
permissions_boundary = aws_iam_policy.ecs_task_boundary.arn
}
resource "aws_iam_role_policy_attachment" "ecs_execution" {
role = aws_iam_role.ecs_execution.name
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}
resource "aws_iam_role" "ecs_task" {
name = "${local.project}-api"
path = "/tf-managed/"
assume_role_policy = data.aws_iam_policy_document.ecs_assume.json
permissions_boundary = aws_iam_policy.ecs_task_boundary.arn
}
resource "aws_iam_role_policy" "ecs_task" {
name = "api-runtime"
role = aws_iam_role.ecs_task.id
policy = data.aws_iam_policy_document.ecs_task_boundary.json
}
resource "aws_iam_role" "jobs_scheduler" {
name = "${local.project}-scheduler"
path = "/tf-managed/"
assume_role_policy = data.aws_iam_policy_document.jobs_scheduler_assume.json
permissions_boundary = aws_iam_policy.ecs_task_boundary.arn
}
data "aws_iam_policy_document" "jobs_scheduler" {
statement {
sid = "SendJobs"
effect = "Allow"
actions = ["sqs:SendMessage"]
resources = [aws_sqs_queue.jobs.arn]
}
}
resource "aws_iam_role_policy" "jobs_scheduler" {
name = "enqueue-jobs"
role = aws_iam_role.jobs_scheduler.id
policy = data.aws_iam_policy_document.jobs_scheduler.json
}

116
terraform/iam_github_deploy.tf
View file

@ -1,116 +0,0 @@
# GitHub Actions OIDC role for the thin deploy-api.yaml caller of
# org reusable cd-hcp-fargate.yaml.
#
# One role: GitHub Environments have a single DEPLOY_ROLE_ARN. Trust is pinned
# to Environments dev and prod. job_workflow_ref matches the reusable at any ref.
# AWS STS GitHub condition keys include job_workflow_ref, not workflow_ref.
data "aws_iam_policy_document" "github_deploy_assume" {
statement {
sid = "GithubDeployOidc"
effect = "Allow"
actions = ["sts:AssumeRoleWithWebIdentity"]
principals {
type = "Federated"
identifiers = [local.github_oidc_provider_arn]
}
condition {
test = "StringEquals"
variable = "token.actions.githubusercontent.com:aud"
values = ["sts.amazonaws.com"]
}
condition {
test = "StringEquals"
variable = "token.actions.githubusercontent.com:sub"
values = local.github_oidc_subs
}
condition {
test = "StringLike"
variable = "token.actions.githubusercontent.com:job_workflow_ref"
values = [
"Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*",
]
}
}
}
resource "aws_iam_role" "github_deploy" {
name = local.deploy_role
path = "/tf-managed/"
description = "GitHub Actions image deploy role for ${var.github_repo}"
assume_role_policy = data.aws_iam_policy_document.github_deploy_assume.json
max_session_duration = 3600
}
data "aws_iam_policy_document" "github_deploy" {
statement {
sid = "EcrAuth"
effect = "Allow"
actions = [
"ecr:GetAuthorizationToken",
]
resources = ["*"]
}
statement {
sid = "EcrPush"
effect = "Allow"
actions = [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:CompleteLayerUpload",
"ecr:GetDownloadUrlForLayer",
"ecr:InitiateLayerUpload",
"ecr:PutImage",
"ecr:UploadLayerPart",
"ecr:DescribeRepositories",
"ecr:DescribeImages",
]
resources = [aws_ecr_repository.api.arn]
}
statement {
sid = "EcsDeploy"
effect = "Allow"
actions = [
"ecs:DescribeServices",
"ecs:DescribeTaskDefinition",
"ecs:DescribeTasks",
"ecs:ListTasks",
"ecs:RegisterTaskDefinition",
"ecs:UpdateService",
]
resources = ["*"]
}
statement {
sid = "PassTaskRoles"
effect = "Allow"
actions = ["iam:PassRole"]
resources = [
aws_iam_role.ecs_task.arn,
aws_iam_role.ecs_execution.arn,
]
}
statement {
sid = "DeployParams"
effect = "Allow"
actions = [
"ssm:GetParameter",
]
resources = [
"arn:aws:ssm:${var.aws_region}:${local.account_id}:parameter${local.ssm_prefix}/deploy/*",
]
}
}
resource "aws_iam_role_policy" "github_deploy" {
name = "afterhours-shift-manager-deploy"
role = aws_iam_role.github_deploy.id
policy = data.aws_iam_policy_document.github_deploy.json
}

3
terraform/lambda.tf
View file

@ -1,3 +0,0 @@
# Leftover Lambda execution roles were removed after Paychex dropped
# AfterhoursWeeklyPostSend (PLAT-218). Zip handlers in src/*/app.py remain for
# packaging via scripts/package_lambdas.py.

144
terraform/lambda_boundary.tf
View file

@ -1,144 +0,0 @@
# Per-workload Lambda permissions boundary. Created on the first (bootstrap)
# apply. The scoped apply role denies iam:CreatePolicy / CreatePolicyVersion,
# so later edits to this document need the hcptf-bootstrap window.
data "aws_iam_policy_document" "lambda_boundary" {
statement {
sid = "CloudWatchLogsWrite"
effect = "Allow"
actions = [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogStreams",
]
resources = [
"arn:aws:logs:${var.aws_region}:${local.account_id}:log-group:/aws/lambda*",
]
}
statement {
sid = "CloudWatchLogsDescribe"
effect = "Allow"
actions = ["logs:DescribeLogGroups"]
resources = ["*"]
}
statement {
sid = "XRay"
effect = "Allow"
actions = [
"xray:PutTraceSegments",
"xray:PutTelemetryRecords",
]
resources = ["*"]
}
statement {
sid = "Ec2Eni"
effect = "Allow"
actions = [
"ec2:CreateNetworkInterface",
"ec2:DescribeNetworkInterfaces",
"ec2:DeleteNetworkInterface",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeVpcs",
]
resources = ["*"]
}
statement {
sid = "AfterhoursSecrets"
effect = "Allow"
actions = [
"secretsmanager:GetSecretValue",
]
resources = [
"arn:aws:secretsmanager:${var.aws_region}:${local.account_id}:secret:afterhours-shift-manager/*",
]
}
statement {
sid = "AfterhoursDynamoDB"
effect = "Allow"
actions = [
"dynamodb:GetItem",
"dynamodb:PutItem",
"dynamodb:UpdateItem",
"dynamodb:DeleteItem",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:BatchGetItem",
"dynamodb:BatchWriteItem",
"dynamodb:DescribeTable",
"dynamodb:ConditionCheckItem",
]
resources = [
"arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}",
"arn:aws:dynamodb:${var.aws_region}:${local.account_id}:table/${local.table_name}/*",
]
}
statement {
sid = "AfterhoursScheduler"
effect = "Allow"
actions = [
"scheduler:CreateSchedule",
"scheduler:DeleteSchedule",
"scheduler:GetSchedule",
]
resources = [
"arn:aws:scheduler:${var.aws_region}:${local.account_id}:schedule/default/holiday-*",
]
}
statement {
sid = "AfterhoursPassRoleScheduler"
effect = "Allow"
actions = [
"iam:PassRole",
]
resources = [
"arn:aws:iam::${local.account_id}:role/tf-managed/afterhours-shift-manager-holiday-scheduler",
]
condition {
test = "StringEquals"
variable = "iam:PassedToService"
values = ["scheduler.amazonaws.com"]
}
}
statement {
sid = "AfterhoursInvokeHolidayRouter"
effect = "Allow"
actions = [
"lambda:InvokeFunction",
]
resources = [
"arn:aws:lambda:${var.aws_region}:${local.account_id}:function:afterhours-holiday-router",
]
}
dynamic "statement" {
for_each = var.checkcomponents_queue_arn == "" ? [] : [1]
content {
sid = "AfterhoursCheckcomponentsSend"
effect = "Allow"
actions = [
"sqs:SendMessage",
]
resources = [
var.checkcomponents_queue_arn,
]
}
}
}
resource "aws_iam_policy" "lambda_boundary" {
name = "afterhours-shift-manager-lambda-boundary"
path = "/tf-managed/"
description = "Per-workload Lambda permissions boundary for afterhours-shift-manager (PLAT-74)."
policy = data.aws_iam_policy_document.lambda_boundary.json
}

102
terraform/locals.tf
View file

@ -1,102 +0,0 @@
locals {
project = "afterhours-shift-manager"
is_prod = var.environment == "prod"
account_id = local.is_prod ? "011934824531" : "710827005802"
environment = var.environment
hcp_project = "seahaven-${var.environment}"
hcp_workspace = "${local.project}-${var.environment}"
apply_role = "hcptf-afterhours-shift-manager"
plan_role = "hcptf-afterhours-shift-manager-plan"
deploy_role = "githubdeploy-afterhours-shift-manager"
stack_name = local.project
stack_prefix = "afterhours-shift-manager-"
artifacts_bucket_name = "afterhours-shift-manager-artifacts-${local.account_id}"
ssm_prefix = "/afterhours-shift-manager"
# Prod has no default VPC. This stack owns 10.70. Meals attaches with
# existing_vpc_id. Portal Fargate (PLAT-217) should too. Do not mint 10.62.
vpc_cidr = "10.70.0.0/16"
public_subnet_cidrs = ["10.70.0.0/24", "10.70.1.0/24"]
table_name = "afterhours-shifts"
site_alerts_arn = "arn:aws:sns:${var.aws_region}:${local.account_id}:site-alerts"
github_oidc_provider_arn = "arn:aws:iam::${local.account_id}:oidc-provider/token.actions.githubusercontent.com"
# Org has Actions OIDC use_immutable_subject=true.
github_oidc_subs = [
"repo:${var.github_repo}:environment:dev",
"repo:${var.github_repo}:environment:prod",
"repo:Sea-Haven-Industries@183236204/afterhours-shift-manager@1200846448:environment:dev",
"repo:Sea-Haven-Industries@183236204/afterhours-shift-manager@1200846448:environment:prod",
]
domain_name = var.domain_name != "" ? var.domain_name : (local.is_prod ? "afterhours.seahaven.com" : "afterhours.dev.seahaven.com")
acm_wildcard_domain = local.is_prod ? "*.seahaven.com" : "*.dev.seahaven.com"
api_url = var.attach_custom_domain ? "https://${local.domain_name}" : "http://${aws_lb.api.dns_name}"
secret_names = [
"afterhours-shift-manager/slack-bot-token",
"afterhours-shift-manager/slack-signing-secret",
"afterhours-shift-manager/3cx-domain",
"afterhours-shift-manager/3cx-client-id",
"afterhours-shift-manager/3cx-client-secret",
"afterhours-shift-manager/roster-api-token",
]
holiday_router_arn = "arn:aws:lambda:${var.aws_region}:${local.account_id}:function:afterhours-holiday-router"
holiday_scheduler_role_name = "afterhours-shift-manager-holiday-scheduler"
holiday_scheduler_role_arn = "arn:aws:iam::${local.account_id}:role/tf-managed/${local.holiday_scheduler_role_name}"
functions = {
slack_bot = {
function_name = "afterhours-shift-manager"
role_name = "afterhours-shift-manager-slack-bot"
handler = "handler.handler"
timeout = 30
duration_ms = 24000
}
weekly_post = {
function_name = "afterhours-weekly-post"
role_name = "afterhours-shift-manager-weekly-post"
handler = "app.handler"
timeout = 30
duration_ms = 24000
}
roster_sync = {
function_name = "afterhours-roster-sync"
role_name = "afterhours-shift-manager-roster-sync"
handler = "app.handler"
timeout = 60
duration_ms = 48000
}
roster_api = {
function_name = "afterhours-roster-api"
role_name = "afterhours-shift-manager-roster-api"
handler = "app.handler"
timeout = 30
duration_ms = 24000
}
ring_scheduler = {
function_name = "afterhours-ring-scheduler"
role_name = "afterhours-shift-manager-ring-scheduler"
handler = "app.handler"
timeout = 60
duration_ms = 48000
}
holiday_router = {
function_name = "afterhours-holiday-router"
role_name = "afterhours-shift-manager-holiday-router"
handler = "app.handler"
timeout = 60
duration_ms = 48000
}
portal_api = {
function_name = "afterhours-portal-api"
role_name = "afterhours-shift-manager-portal-api"
handler = "app.handler"
timeout = 30
duration_ms = 24000
}
}
}

4
terraform/logs.tf
View file

@ -1,4 +0,0 @@
resource "aws_cloudwatch_log_group" "api" {
name = "/ecs/${local.project}"
retention_in_days = local.is_prod ? 60 : 14
}

69
terraform/outputs.tf
View file

@ -1,69 +0,0 @@
output "slack_request_url" {
description = "Slack app Request URL (slash command and interactivity)."
value = "${local.api_url}/slack/events"
}
output "api_origin" {
description = "HTTP origin for Paychex AFTERHOURS_BASE_URL and portal VITE_SHIFTS_API_BASE. No /roster suffix."
value = local.api_url
}
output "shift_table_name" {
description = "DynamoDB table name."
value = aws_dynamodb_table.shifts.name
}
output "holiday_scheduler_role_arn" {
description = "Role EventBridge Scheduler assumes to enqueue holiday jobs."
value = aws_iam_role.holiday_scheduler.arn
}
output "github_deploy_role_arn" {
description = "OIDC role ARN for deploy-api.yaml (GitHub Environment variable DEPLOY_ROLE_ARN)."
value = aws_iam_role.github_deploy.arn
}
output "artifacts_bucket_name" {
description = "Leftover Lambda artifacts bucket from dual-run zip CD."
value = aws_s3_bucket.artifacts.id
}
output "alb_dns_name" {
description = "ALB DNS name. Public DNS for afterhours.seahaven.com is out of band."
value = aws_lb.api.dns_name
}
output "fargate_origin" {
description = "Fargate origin for Slack/Paychex/portal cutover. HTTPS after attach_custom_domain."
value = local.api_url
}
output "jobs_queue_arn" {
description = "SQS ARN EventBridge Scheduler holiday one-offs target after cutover."
value = aws_sqs_queue.jobs.arn
}
output "ecs_task_role_arn" {
description = "ECS task role. Paychex already allows this ARN."
value = aws_iam_role.ecs_task.arn
}
output "hcptf_apply_role_arn" {
description = "HCP apply role ARN. Set TFC_AWS_APPLY_ROLE_ARN after the bootstrap window."
value = aws_iam_role.hcptf_apply.arn
}
output "hcptf_plan_role_arn" {
description = "HCP plan role ARN. Set TFC_AWS_PLAN_ROLE_ARN after the bootstrap window."
value = aws_iam_role.hcptf_plan.arn
}
output "vpc_id" {
description = "VPC that meals already attaches to. Portal Fargate prod sets existing_vpc_id to this value."
value = aws_vpc.this.id
}
output "public_subnet_ids" {
description = "Public subnet IDs for ALB and Fargate. Portal HCP existing_public_subnet_ids."
value = aws_subnet.public[*].id
}

12
terraform/providers.tf
View file

@ -1,12 +0,0 @@
provider "aws" {
region = var.aws_region
default_tags {
tags = {
Project = local.project
Environment = var.environment
ManagedBy = "terraform"
Workspace = local.hcp_workspace
}
}
}

100
terraform/scheduler.tf
View file

@ -1,100 +0,0 @@
# EventBridge Scheduler execution role. slack-bot creates one-off holiday-*
# schedules at runtime; Terraform does not create those schedules.
# Recurring jobs use America/New_York Scheduler -> SQS (not dual EST/EDT rules).
data "aws_iam_policy_document" "holiday_scheduler_assume" {
statement {
sid = "SchedulerAssume"
effect = "Allow"
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["scheduler.amazonaws.com"]
}
condition {
test = "StringEquals"
variable = "aws:SourceAccount"
values = [local.account_id]
}
condition {
test = "ArnLike"
variable = "aws:SourceArn"
values = ["arn:aws:scheduler:${var.aws_region}:${local.account_id}:schedule/default/holiday-*"]
}
}
}
resource "aws_iam_role" "holiday_scheduler" {
name = local.holiday_scheduler_role_name
path = "/tf-managed/"
description = "EventBridge Scheduler assumes this role to enqueue holiday jobs or invoke afterhours-holiday-router"
assume_role_policy = data.aws_iam_policy_document.holiday_scheduler_assume.json
permissions_boundary = aws_iam_policy.ecs_task_boundary.arn
}
data "aws_iam_policy_document" "holiday_scheduler" {
statement {
sid = "SendHolidayJobs"
effect = "Allow"
actions = ["sqs:SendMessage"]
resources = [aws_sqs_queue.jobs.arn]
}
}
resource "aws_iam_role_policy" "holiday_scheduler" {
name = "invoke-holiday-router"
role = aws_iam_role.holiday_scheduler.id
policy = data.aws_iam_policy_document.holiday_scheduler.json
}
locals {
job_schedules = {
weekly-post = {
description = "Post weekly schedule Monday 7am Eastern; closes the Sun-Sat pay week"
schedule = "cron(0 7 ? * MON *)"
event = "weekly_post"
}
roster-sync = {
description = "Sync roster from 3CX at 6am Eastern"
schedule = "cron(0 6 ? * * *)"
event = "roster_sync"
}
ring-scheduler-daily = {
description = "Update 3CX queue at 8am Eastern"
schedule = "cron(0 8 ? * * *)"
event = "ring_scheduler_daily"
}
ring-scheduler-weekend = {
description = "Update 3CX queue at 5pm Eastern weekends"
schedule = "cron(0 17 ? * SAT,SUN *)"
event = "ring_scheduler_weekend"
}
}
}
resource "aws_scheduler_schedule_group" "jobs" {
name = local.project
}
resource "aws_scheduler_schedule" "jobs" {
for_each = local.job_schedules
name = "${local.project}-${each.key}"
group_name = aws_scheduler_schedule_group.jobs.name
description = each.value.description
schedule_expression = each.value.schedule
schedule_expression_timezone = "America/New_York"
state = var.ecs_schedules_enabled ? "ENABLED" : "DISABLED"
flexible_time_window {
mode = "OFF"
}
target {
arn = aws_sqs_queue.jobs.arn
role_arn = aws_iam_role.jobs_scheduler.arn
input = jsonencode({ event = each.value.event })
}
}

15
terraform/secrets.tf
View file

@ -1,15 +0,0 @@
# Secret shells only. Values are set outside Terraform. 3CX secrets may already
# exist in prod from seahaven-door-unlock-api (PLAT-76); import those names
# rather than recreating:
# terraform import 'aws_secretsmanager_secret.this["afterhours-shift-manager/3cx-domain"]' afterhours-shift-manager/3cx-domain
resource "aws_secretsmanager_secret" "this" {
for_each = toset(local.secret_names)
name = each.value
recovery_window_in_days = 30
tags = {
Purpose = "afterhours-shift-manager secret shell"
}
}

48
terraform/ssm.tf
View file

@ -1,48 +0,0 @@
resource "aws_ssm_parameter" "deploy_artifacts_bucket" {
name = "${local.ssm_prefix}/deploy/artifacts-bucket"
type = "String"
value = aws_s3_bucket.artifacts.id
description = "Unused leftover Lambda artifacts bucket from the dual-run zip path."
}
resource "aws_ssm_parameter" "deploy_api_url" {
name = "${local.ssm_prefix}/deploy/api-url"
type = "String"
value = local.api_url
description = "API origin for deploy-api.yaml health check"
}
resource "aws_ssm_parameter" "deploy_cluster" {
name = "${local.ssm_prefix}/deploy/cluster"
type = "String"
value = aws_ecs_cluster.api.name
description = "ECS cluster name for deploy-api.yaml"
}
resource "aws_ssm_parameter" "deploy_service" {
name = "${local.ssm_prefix}/deploy/service"
type = "String"
value = aws_ecs_service.api.name
description = "ECS service name for deploy-api.yaml"
}
resource "aws_ssm_parameter" "deploy_task_family" {
name = "${local.ssm_prefix}/deploy/task-family"
type = "String"
value = aws_ecs_task_definition.api.family
description = "ECS task definition family for deploy-api.yaml"
}
resource "aws_ssm_parameter" "deploy_ecr_repository" {
name = "${local.ssm_prefix}/deploy/ecr-repository"
type = "String"
value = aws_ecr_repository.api.repository_url
description = "ECR repository URL for deploy-api.yaml"
}
resource "aws_ssm_parameter" "deploy_container_name" {
name = "${local.ssm_prefix}/deploy/container-name"
type = "String"
value = local.api_container_name
description = "Container name in the ECS task definition"
}

110
terraform/variables.tf
View file

@ -1,110 +0,0 @@
variable "aws_region" {
description = "Region every resource in this configuration is created in."
type = string
default = "us-east-1"
}
variable "shift_channel" {
description = "Slack channel ID for schedule posts and shift notifications. Not a secret."
type = string
default = "C0APATP612N"
}
variable "queue_number" {
description = "3CX queue extension number the ring scheduler updates."
type = string
default = "801"
}
variable "timezone" {
description = "IANA timezone for schedule math and EventBridge cron comments."
type = string
default = "America/New_York"
}
variable "pay_report_user" {
description = "Slack user ID that receives the weekly pay DM."
type = string
default = "U0A3SC48T47"
}
variable "sentry_dsn" {
description = "Sentry DSN. Empty disables the SDK. Set in HCP, never in git."
type = string
sensitive = true
default = ""
}
variable "environment" {
description = "HCP workspace stage. Selects account and workspace name."
type = string
default = "prod"
validation {
condition = contains(["dev", "prod"], var.environment)
error_message = "environment must be \"dev\" or \"prod\"."
}
}
variable "domain_name" {
description = "Public hostname on the ALB when attach_custom_domain is true. Empty selects afterhours.seahaven.com or afterhours.dev.seahaven.com from environment."
type = string
default = ""
}
variable "attach_custom_domain" {
description = "When true, attach an HTTPS listener using the issued wildcard ACM certificate. Keep false until public DNS points at the ALB."
type = bool
default = false
}
variable "schedules_enabled" {
description = "When false, EventBridge Lambda rules exist but do not fire. Keep false until Slack and Paychex point at this stack, and after Fargate jobs are enabled."
type = bool
default = false
}
variable "ecs_schedules_enabled" {
description = "When false, EventBridge Scheduler jobs exist but do not fire. Enable at Fargate cutover after the image is healthy; keep Lambda EventBridge rules disabled."
type = bool
default = false
}
variable "github_repo" {
description = "GitHub owner/name for the deploy OIDC trust."
type = string
default = "Sea-Haven-Industries/afterhours-shift-manager"
}
variable "checkcomponents_queue_url" {
description = "paychex-checkcomponents SQS URL. Empty skips the weekly SendMessage."
type = string
default = "https://sqs.us-east-1.amazonaws.com/011934824531/paychex-checkcomponents"
}
variable "checkcomponents_queue_arn" {
description = "paychex-checkcomponents SQS ARN for WeeklyPost SendMessage."
type = string
default = "arn:aws:sqs:us-east-1:011934824531:paychex-checkcomponents"
}
variable "portal_cognito_issuer" {
description = "Trusted portal Cognito user-pool issuer for ID-token verification. Empty disables portal auth."
type = string
default = ""
}
variable "portal_cognito_audience" {
description = "Trusted portal Cognito app client ID for ID-token verification."
type = string
default = ""
}
variable "portal_cognito_extra_trust" {
description = "Additional portal Cognito issuer/audience pairs (dev+prod)."
type = list(object({
issuer = string
audience = string
}))
default = []
}

22
terraform/versions.tf
View file

@ -1,22 +0,0 @@
terraform {
required_version = ">= 1.14.0"
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 6.66"
}
archive = {
source = "hashicorp/archive"
version = "~> 2.8"
}
}
cloud {
organization = "seahaven"
workspaces {
tags = ["app:afterhours-shift-manager"]
}
}
}

61
terraform/vpc.tf
View file

@ -1,61 +0,0 @@
data "aws_availability_zones" "available" {
state = "available"
}
resource "aws_vpc" "this" {
cidr_block = local.vpc_cidr
enable_dns_support = true
enable_dns_hostnames = true
tags = {
Name = "${local.project}-vpc"
}
# First apply updates the live hcptf apply role before CreateVpc.
depends_on = [
aws_iam_role_policy.hcptf_apply_services,
aws_iam_role_policy_attachments_exclusive.hcptf_apply,
]
}
resource "aws_internet_gateway" "this" {
vpc_id = aws_vpc.this.id
tags = {
Name = "${local.project}-igw"
}
}
resource "aws_subnet" "public" {
count = length(local.public_subnet_cidrs)
vpc_id = aws_vpc.this.id
cidr_block = local.public_subnet_cidrs[count.index]
availability_zone = data.aws_availability_zones.available.names[count.index]
map_public_ip_on_launch = true
tags = {
Name = "${local.project}-public-${count.index}"
}
}
resource "aws_route_table" "public" {
vpc_id = aws_vpc.this.id
tags = {
Name = "${local.project}-public"
}
}
resource "aws_route" "public_default" {
route_table_id = aws_route_table.public.id
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.this.id
}
resource "aws_route_table_association" "public" {
count = length(local.public_subnet_cidrs)
subnet_id = aws_subnet.public[count.index].id
route_table_id = aws_route_table.public.id
}

3
tests/conftest.py
View file

@ -25,9 +25,6 @@ def aws_env(monkeypatch):
monkeypatch.setenv("SHIFT_CHANNEL", "C_TEST")
monkeypatch.delenv("QUEUE_NUMBER", raising=False)
monkeypatch.delenv("TCX_SECRET_PREFIX", raising=False)
monkeypatch.delenv("SENTRY_DSN", raising=False)
monkeypatch.delenv("JOBS_QUEUE_URL", raising=False)
monkeypatch.delenv("JOBS_QUEUE_ARN", raising=False)
def _create_table(dynamodb):

226
tests/infra/test_hcp_contract.py
View file

@ -1,226 +0,0 @@
"""Contracts for the HCP Terraform seam (PLAT-74 / PLAT-216)."""
from pathlib import Path
ROOT = Path(__file__).resolve().parents[2]
TERRAFORM = ROOT / "terraform"
HCP_IAM = (TERRAFORM / "hcp_iam.tf").read_text()
CI = (ROOT / ".github" / "workflows" / "ci.yaml").read_text()
LOCALS = (TERRAFORM / "locals.tf").read_text()
VARIABLES = (TERRAFORM / "variables.tf").read_text()
def _tf_without_comments(text: str) -> str:
return "\n".join(line.split("#", 1)[0] for line in text.splitlines())
def test_sam_template_removed():
assert not (ROOT / "template.yaml").exists()
assert not (ROOT / "samconfig.toml.example").exists()
def test_zip_cd_removed():
assert not (ROOT / ".github" / "workflows" / "deploy.yaml").exists()
for path in TERRAFORM.glob("*.tf"):
assert 'resource "aws_lambda_function"' not in path.read_text()
assert not (TERRAFORM / "apigateway.tf").exists()
assert not (TERRAFORM / "events.tf").exists()
def test_schedules_disabled_by_default():
chunk = (
(TERRAFORM / "variables.tf")
.read_text()
.split('variable "schedules_enabled"')[1]
)
chunk = chunk.split("variable ")[0]
assert "default = false" in chunk or "default = false" in chunk
def test_ecs_schedules_disabled_by_default():
chunk = (
(TERRAFORM / "variables.tf")
.read_text()
.split('variable "ecs_schedules_enabled"')[1]
)
chunk = chunk.split("variable ")[0]
assert "default = false" in chunk or "default = false" in chunk
def test_workspaces_use_app_tag():
versions = (TERRAFORM / "versions.tf").read_text()
assert 'tags = ["app:afterhours-shift-manager"]' in versions
assert 'name = "afterhours-shift-manager-prod"' not in versions
assert 'hcp_workspace = "${local.project}-${var.environment}"' in LOCALS
assert "seahaven-${var.environment}" in LOCALS
def test_ecs_ignore_changes_and_task_size():
ecs = (TERRAFORM / "ecs.tf").read_text()
assert "ignore_changes = [container_definitions]" in ecs
assert "ignore_changes = [task_definition, desired_count]" in ecs
assert 'cpu = "512"' in ecs
assert 'memory = "1024"' in ecs
assert 'cpu_architecture = "ARM64"' in ecs
assert 'path = "/api/health"' in ecs
def test_stack_owns_a_vpc_instead_of_looking_up_default():
vpc = (TERRAFORM / "vpc.tf").read_text()
ecs = (TERRAFORM / "ecs.tf").read_text()
assert 'resource "aws_vpc" "this"' in vpc
assert "cidr_block = local.vpc_cidr" in vpc
assert 'vpc_cidr = "10.70.0.0/16"' in LOCALS
assert 'data "aws_vpc" "default"' not in ecs
assert "data.aws_vpc.default" not in ecs
assert "data.aws_subnets.default" not in ecs
assert "aws_vpc.this.id" in ecs
assert "aws_subnet.public[*].id" in ecs
assert "ec2:CreateVpc" in HCP_IAM
assert 'sid = "RefreshVpc"' in HCP_IAM
assert "afterhours-shift-manager-ecs" in HCP_IAM
assert "hcptf_apply_ecs" in HCP_IAM
assert 'resource "aws_iam_policy" "hcptf_apply_ecs"' in HCP_IAM
assert 'resource "aws_iam_role_policy" "hcptf_apply_ecs"' not in HCP_IAM
assert "aws_iam_policy.hcptf_apply_ecs.arn" in HCP_IAM
assert 'sid = "CreateElbAndEcsServiceLinkedRoles"' in HCP_IAM
assert "iam:CreateServiceLinkedRole" in HCP_IAM
def test_ecs_task_boundary_uses_static_arns():
iam = (TERRAFORM / "iam.tf").read_text()
chunk = iam.split('data "aws_iam_policy_document" "ecs_task_boundary"')[1]
chunk = chunk.split("resource ")[0]
assert "aws_dynamodb_table.shifts" not in chunk
assert "aws_sqs_queue.jobs" not in chunk
assert "aws_ecr_repository.api" not in chunk
assert "aws_cloudwatch_log_group.api" not in chunk
assert "table/${local.table_name}" in chunk
assert "log-group:/ecs/${local.project}" in chunk
def test_deploy_api_workflow_exists():
deploy_api = (ROOT / ".github" / "workflows" / "deploy-api.yaml").read_text()
pin = "cd-hcp-fargate.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19"
assert deploy_api.count(pin) == 2
assert "ssm-prefix: /afterhours-shift-manager/deploy" in deploy_api
assert "docker-platform: linux/arm64" in deploy_api
assert "ship-gate: true" in deploy_api
assert "gh release create" in deploy_api
assert "needs.target.outputs.environment" not in deploy_api
def test_in_repo_hcptf_roles():
assert 'apply_role = "hcptf-afterhours-shift-manager"' in LOCALS
assert 'plan_role = "hcptf-afterhours-shift-manager-plan"' in LOCALS
assert "hcptf_apply" in HCP_IAM
assert "DenyCreatePolicy" in HCP_IAM
def test_ci_runs_pytest_and_terraform_validate():
assert "ci-python-sam" not in CI
assert "ci-python-app.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19" in CI
assert "ci-terraform.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19" in CI
assert "ci-autofix.yaml@0a1010e63248c9ca9f042c870eb2c579ba6b9455 # v1.0.19" in CI
assert "name: ci-complete" in CI
assert "pytest" in CI
assert "terraform fmt -check" not in CI
assert "openapi:lint" in CI
assert "npm ci" in CI
def test_openapi_uses_redocly_recommended():
redocly = (ROOT / ".redocly.yaml").read_text()
package = (ROOT / "package.json").read_text()
spec = (ROOT / "openapi.yaml").read_text()
assert "extends:" in redocly
assert "- recommended" in redocly
assert "operation-2xx-response: off" in redocly
assert "operation-4xx-response: error" in redocly
assert "rule/operation-2xx-or-3xx-response" in redocly
assert "severity: error" in redocly
assert "optionsShifts" not in spec
health = spec.split("/api/health:", 1)[1].split("\n /", 1)[0]
assert '"403":' in health
assert '"400":' not in health
assert "root: openapi.yaml" in redocly
assert '"openapi:lint"' in package
assert '"@redocly/cli":' in package
assert "openapi: 3.1.0" in spec
assert "required: [stage, sha]" in spec
def test_checkcomponents_queue_arn_variable_matches_iam_references():
assert 'variable "checkcomponents_queue_arn"' in VARIABLES
iam = (TERRAFORM / "iam.tf").read_text()
assert "var.checkcomponents_queue_arn" in iam
boundary = (TERRAFORM / "lambda_boundary.tf").read_text()
assert "var.checkcomponents_queue_arn" in boundary
data_tf = (TERRAFORM / "data.tf").read_text()
assert "dev_has_no_paychex" in data_tf
assert "checkcomponents_pair" in data_tf
def test_leftover_lambda_iam_roles_removed():
for path in TERRAFORM.glob("*.tf"):
body = _tf_without_comments(path.read_text())
assert 'resource "aws_iam_role" "lambda"' not in body
assert 'resource "aws_iam_role_policy" "lambda"' not in body
assert 'resource "aws_iam_role_policy_attachment" "lambda_basic"' not in body
assert 'data "aws_iam_policy_document" "lambda_assume"' not in body
def test_lambda_boundary_policy_remains():
boundary = (TERRAFORM / "lambda_boundary.tf").read_text()
assert 'resource "aws_iam_policy" "lambda_boundary"' in boundary
assert "afterhours-shift-manager-lambda-boundary" in boundary
def test_local_functions_still_lists_packaging_keys():
for name in (
"afterhours-shift-manager",
"afterhours-weekly-post",
"afterhours-roster-sync",
"afterhours-roster-api",
"afterhours-ring-scheduler",
"afterhours-holiday-router",
"afterhours-portal-api",
):
assert name in LOCALS
assert "afterhours-release-notifier" not in LOCALS
assert "weekly_post" in LOCALS
def test_github_deploy_trust_covers_image_only():
iam = (TERRAFORM / "iam_github_deploy.tf").read_text()
assert "environment:prod" in iam or "environment:prod" in LOCALS
assert "environment:dev" in iam or "environment:dev" in LOCALS
assert "deploy.yaml@" not in iam
assert "deploy-api.yaml@" not in iam
assert "Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@*" in iam
assert "ecs:ListTasks" in iam
def test_plan_refresh_includes_provider6_s3_gets():
assert "s3:GetLifecycleConfiguration" in HCP_IAM
assert "s3:GetReplicationConfiguration" in HCP_IAM
assert "s3:GetBucketReplication" in HCP_IAM
def test_origins_use_fargate_url():
outputs = (TERRAFORM / "outputs.tf").read_text()
assert "aws_apigatewayv2_api.http" not in outputs
assert "${local.api_url}/slack/events" in outputs
assert "value = local.api_url" in outputs
assert 'output "vpc_id"' in outputs
assert 'output "public_subnet_ids"' in outputs
assert "aws_vpc.this.id" in outputs
def test_alb_alarms_remain():
alarms = (TERRAFORM / "alarms.tf").read_text()
assert "ALB-5xx-" in alarms
assert "ALB-Latency-" in alarms
assert "ALB-UnhealthyHost-" in alarms
assert "ApiGateway-" not in alarms
assert "Lambda-" not in alarms

101
tests/portal_api/test_handler.py
View file

@ -1,101 +0,0 @@
"""Tests for the portal shift API handler."""
import json
import pytest
def _event(method="GET", path="/api/shifts", body=None, token="id-token", origin=None):
headers = {"authorization": f"Bearer {token}"}
if origin:
headers["origin"] = origin
payload = None
if body is not None:
payload = json.dumps(body)
return {
"version": "2.0",
"routeKey": f"{method} {path}",
"rawPath": path,
"headers": headers,
"queryStringParameters": {},
"requestContext": {"http": {"method": method, "path": path}},
"body": payload,
"isBase64Encoded": False,
}
@pytest.fixture
def identity(portalapi_app, monkeypatch):
monkeypatch.setattr(
"shared.portal_http.verify_cognito_id_token",
lambda _token: {"name": "Alice", "email": "alice@seahavenind.com"},
)
def test_unlinked_email_returns_linked_false(portalapi_app, schedule, identity):
result = portalapi_app.handler(_event(), None)
assert result["statusCode"] == 200
body = json.loads(result["body"])
assert body["linked"] is False
assert body["email"] == "alice@seahavenind.com"
def test_401_without_bearer(portalapi_app, schedule):
event = _event()
event["headers"] = {}
result = portalapi_app.handler(event, None)
assert result["statusCode"] == 401
def test_linked_snapshot_and_admin_flag(portalapi_app, schedule, seed, identity):
seed.roster(
"114",
"Alice",
slack_user_id="U_ADMIN",
email="alice@seahavenind.com",
)
seed.config(admin_users=["U_ADMIN"])
seed.weekly("Monday", "114", "Alice")
result = portalapi_app.handler(_event(), None)
assert result["statusCode"] == 200
body = json.loads(result["body"])
assert body["linked"] is True
assert body["isAdmin"] is True
assert body["me"]["extension"] == "114"
assert len(body["days"]) == 7
def test_non_admin_cannot_override(portalapi_app, schedule, seed, identity):
seed.roster("114", "Alice", slack_user_id="U_ALICE", email="alice@seahavenind.com")
seed.config(admin_users=["U_OTHER"])
result = portalapi_app.handler(
_event(
method="POST",
path="/api/shifts/admin/override",
body={"date": "2026-06-10", "extension": "114", "shiftType": "night"},
),
None,
)
assert result["statusCode"] == 403
def test_cors_header_for_portal_origin(portalapi_app, schedule, identity):
result = portalapi_app.handler(_event(origin="https://internal.seahaven.com"), None)
assert (
result["headers"]["Access-Control-Allow-Origin"]
== "https://internal.seahaven.com"
)
def test_unexpected_failure_keeps_cors(portalapi_app, identity, monkeypatch):
monkeypatch.setattr(
"shared.portal_http.ShiftSchedule",
lambda: (_ for _ in ()).throw(RuntimeError("ddb down")),
)
result = portalapi_app.handler(_event(origin="https://internal.seahaven.com"), None)
assert result["statusCode"] == 500
assert (
result["headers"]["Access-Control-Allow-Origin"]
== "https://internal.seahaven.com"
)
assert json.loads(result["body"])["error"]["code"] == "INTERNAL"

6
tests/portal_api/conftest.py → tests/release_notifier/conftest.py
View file

@ -1,4 +1,4 @@
"""Load src/portal-api/app.py under a unique module name."""
"""Load src/release-notifier/app.py under a unique module name."""
import importlib.util
import pathlib
@ -18,5 +18,5 @@ def _load(name, relpath):
@pytest.fixture
def portalapi_app():
return _load("portalapi_app", "src/portal-api/app.py")
def notifier_app():
return _load("release_notifier_app", "src/release-notifier/app.py")

67
tests/release_notifier/test_handler.py Normal file
View file

@ -0,0 +1,67 @@
"""Tests for the release-notifier Lambda handler."""
from unittest.mock import MagicMock
import pytest
@pytest.fixture
def slack(notifier_app, monkeypatch):
"""Fake Slack WebClient; chat_postMessage returns a message ts."""
fake = MagicMock(name="slack")
fake.chat_postMessage.return_value = {"ts": "111.222"}
monkeypatch.setattr(notifier_app, "WebClient", MagicMock(return_value=fake))
monkeypatch.setattr(notifier_app, "get_secret", lambda _id: "xoxb-test")
return fake
@pytest.fixture
def env(monkeypatch):
monkeypatch.setenv(
"SLACK_BOT_TOKEN_SECRET", "afterhours-shift-manager/slack-bot-token"
)
monkeypatch.setenv("SHIFT_CHANNEL", "C_RELEASES")
def test_posts_announcement_to_channel(notifier_app, slack, env):
result = notifier_app.handler(
{
"version": "1.10.0",
"notes": "**Release notes** now self-announce.",
"date_label": "June 11, 2026",
},
None,
)
assert result == {"announced": True, "version": "1.10.0", "ts": "111.222"}
slack.chat_postMessage.assert_called_once()
kwargs = slack.chat_postMessage.call_args.kwargs
assert kwargs["channel"] == "C_RELEASES"
assert kwargs["text"] == "What's New — v1.10.0"
# Markdown was converted to Slack mrkdwn in the rendered blocks.
rendered = str(kwargs["blocks"])
assert "*Release notes*" in rendered
def test_uses_the_slack_bot_token_secret(notifier_app, slack, env, monkeypatch):
seen = {}
monkeypatch.setattr(
notifier_app, "get_secret", lambda sid: seen.setdefault("id", sid) or "xoxb"
)
notifier_app.handler({"version": "2.0.0", "notes": "Big."}, None)
assert seen["id"] == "afterhours-shift-manager/slack-bot-token"
@pytest.mark.parametrize(
"event",
[
{},
{"version": "1.10.0"}, # missing notes
{"notes": "x"}, # missing version
{"version": "", "notes": "x"}, # empty version
],
)
def test_rejects_incomplete_event(notifier_app, slack, env, event):
with pytest.raises(ValueError):
notifier_app.handler(event, None)
slack.chat_postMessage.assert_not_called()

Some files were not shown because too many files have changed in this diff Show more