afterhours-shift-manager/template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: After-Hours Shift Manager — Slack bot for managing on-call shifts with 3CX integration

Parameters:
  Timezone:
    Type: String
    Default: "America/New_York"
  SchedulerFunctionName:
    Type: String
    Default: "3cx-ring-group-scheduler"
    Description: Name of the existing 3CX ring group scheduler Lambda

Globals:
  Function:
    Runtime: python3.12
    Timeout: 30
    MemorySize: 1024
    Architectures:
      - arm64

Resources:
  # --- Shared Lambda Layer ---
  SharedLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: afterhours-shared
      ContentUri: src/shared/
      CompatibleRuntimes:
        - python3.12
      CompatibleArchitectures:
        - arm64
    Metadata:
      BuildMethod: python3.12
      BuildArchitecture: arm64

  # --- DynamoDB ---
  ShiftTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: afterhours-shifts
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: PK
          AttributeType: S
        - AttributeName: SK
          AttributeType: S
      KeySchema:
        - AttributeName: PK
          KeyType: HASH
        - AttributeName: SK
          KeyType: RANGE

  # --- Slack Bot Lambda ---
  SlackBotFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: afterhours-shift-manager
      Handler: handler.handler
      CodeUri: src/slack-bot/
      Layers:
        - !Ref SharedLayer
      Environment:
        Variables:
          SHIFT_TABLE: !Ref ShiftTable
          SLACK_BOT_TOKEN_PARAM: /afterhours-shift-manager/slack-bot-token
          SLACK_SIGNING_SECRET_PARAM: /afterhours-shift-manager/slack-signing-secret
          SHIFT_CHANNEL_PARAM: /afterhours-shift-manager/channel-id
          SCHEDULER_FUNCTION_NAME: !Ref SchedulerFunctionName
          TZ: !Ref Timezone
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ShiftTable
        - Statement:
            - Effect: Allow
              Action:
                - ssm:GetParameter
              Resource:
                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/afterhours-shift-manager/*"
            - Effect: Allow
              Action:
                - kms:Decrypt
              Resource: "*"
              Condition:
                StringEquals:
                  "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource:
                - !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${SchedulerFunctionName}"
      Events:
        SlackEvents:
          Type: HttpApi
          Properties:
            Path: /slack/events
            Method: POST

  # --- Weekly Schedule Post (Monday 7am ET) ---
  WeeklyPostFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: afterhours-weekly-post
      Handler: app.handler
      CodeUri: src/weekly-post/
      Layers:
        - !Ref SharedLayer
      Environment:
        Variables:
          SHIFT_TABLE: !Ref ShiftTable
          SLACK_BOT_TOKEN_PARAM: /afterhours-shift-manager/slack-bot-token
          SHIFT_CHANNEL_PARAM: /afterhours-shift-manager/channel-id
          SES_SENDER: noreply@seahaven.com
          PAYROLL_RECIPIENTS: payroll@seahaven.com
          PAY_REPORT_USER: U0A3SC48T47
          TZ: !Ref Timezone
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ShiftTable
        - Statement:
            - Effect: Allow
              Action:
                - ssm:GetParameter
              Resource:
                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/afterhours-shift-manager/*"
            - Effect: Allow
              Action:
                - kms:Decrypt
              Resource: "*"
              Condition:
                StringEquals:
                  "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
            - Effect: Allow
              Action:
                - ses:SendEmail
              Resource:
                - !Sub "arn:aws:ses:${AWS::Region}:${AWS::AccountId}:identity/*"
      Events:
        # EST: 7am ET = 12:00 UTC (Nov-Mar)
        WeeklyPostEST:
          Type: Schedule
          Properties:
            Schedule: cron(0 12 ? * MON *)
            Description: "Post weekly schedule Monday 7am EST"
            Enabled: true
        # EDT: 7am ET = 11:00 UTC (Mar-Nov)
        WeeklyPostEDT:
          Type: Schedule
          Properties:
            Schedule: cron(0 11 ? * MON *)
            Description: "Post weekly schedule Monday 7am EDT"
            Enabled: true

  # --- Roster Sync Lambda (daily sync from 3CX) ---
  RosterSyncFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: afterhours-roster-sync
      Handler: app.handler
      CodeUri: src/roster-sync/
      Layers:
        - !Ref SharedLayer
      Timeout: 60
      Environment:
        Variables:
          SHIFT_TABLE: !Ref ShiftTable
          TCX_SSM_PREFIX: /3cx-scheduler
          SYNC_GROUP: DEFAULT
          TZ: !Ref Timezone
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref ShiftTable
        - Statement:
            - Effect: Allow
              Action:
                - ssm:GetParametersByPath
                - ssm:GetParameter
                - ssm:GetParameters
              Resource:
                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/3cx-scheduler"
                - !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/3cx-scheduler/*"
            - Effect: Allow
              Action:
                - kms:Decrypt
              Resource: "*"
              Condition:
                StringEquals:
                  "kms:ViaService": !Sub "ssm.${AWS::Region}.amazonaws.com"
      Events:
        # Daily at 6am ET (before the 7am schedule post and 8am 3CX scheduler)
        # EST: 6am ET = 11:00 UTC (Nov-Mar)
        RosterSyncEST:
          Type: Schedule
          Properties:
            Schedule: cron(0 11 ? * * *)
            Description: "Sync roster from 3CX at 6am EST"
            Enabled: true
        # EDT: 6am ET = 10:00 UTC (Mar-Nov)
        RosterSyncEDT:
          Type: Schedule
          Properties:
            Schedule: cron(0 10 ? * * *)
            Description: "Sync roster from 3CX at 6am EDT"
            Enabled: true

  # --- CloudWatch Log Groups (explicit 60-day retention) ---
  SlackBotLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${SlackBotFunction}"
      RetentionInDays: 60

  WeeklyPostLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${WeeklyPostFunction}"
      RetentionInDays: 60

  RosterSyncLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/lambda/${RosterSyncFunction}"
      RetentionInDays: 60

Outputs:
  SlackBotApiUrl:
    Description: URL for Slack app Request URL configuration
    Value: !Sub "https://${ServerlessHttpApi}.execute-api.${AWS::Region}.amazonaws.com/slack/events"
  ShiftTableName:
    Value: !Ref ShiftTable
  SlackBotFunctionArn:
    Value: !GetAtt SlackBotFunction.Arn
  WeeklyPostFunctionArn:
    Value: !GetAtt WeeklyPostFunction.Arn
  RosterSyncFunctionArn:
    Value: !GetAtt RosterSyncFunction.Arn