mirror of
https://github.com/Sea-Haven-Industries/afterhours-shift-manager.git
synced 2026-09-30 07:53:11 +00:00
969ebf90de
Some checks are pending
Deploy / Deploy to prod (push) Waiting to run
* feat(portal-api): add Cognito shift API for the employee portal (DEV-287) Employees and admins can pick, drop, swap, and manage coverage through GET/POST/DELETE /api/shifts. Roster PUT accepts optional email for portal identity. Slack slash commands and App Home admin modals stay in place. Co-authored-by: adam <adam@seahavenind.com> * fix(portal-api): preserve shift and deployment invariants (DEV-287) Co-authored-by: adam <adam@seahavenind.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
108 lines
3.6 KiB
Python
108 lines
3.6 KiB
Python
"""Contracts for the HCP Terraform seam (PLAT-74)."""
|
|
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
TERRAFORM = ROOT / "terraform"
|
|
LAMBDA_TF = (TERRAFORM / "lambda.tf").read_text()
|
|
HCP_IAM = (TERRAFORM / "hcp_iam.tf").read_text()
|
|
DEPLOY = (ROOT / ".github" / "workflows" / "deploy.yaml").read_text()
|
|
CI = (ROOT / ".github" / "workflows" / "ci.yaml").read_text()
|
|
LOCALS = (TERRAFORM / "locals.tf").read_text()
|
|
VARIABLES = (TERRAFORM / "variables.tf").read_text()
|
|
|
|
|
|
def test_sam_template_removed():
|
|
assert not (ROOT / "template.yaml").exists()
|
|
assert not (ROOT / "samconfig.toml.example").exists()
|
|
|
|
|
|
def test_lambda_ignore_changes_includes_code_attributes():
|
|
for attr in (
|
|
"filename",
|
|
"s3_bucket",
|
|
"s3_key",
|
|
"s3_object_version",
|
|
"source_code_hash",
|
|
):
|
|
assert attr in LAMBDA_TF
|
|
assert "lifecycle" in LAMBDA_TF
|
|
assert "ignore_changes" in LAMBDA_TF
|
|
|
|
|
|
def test_schedules_disabled_by_default():
|
|
chunk = (TERRAFORM / "variables.tf").read_text().split('variable "schedules_enabled"')[1]
|
|
chunk = chunk.split("variable ")[0]
|
|
assert "default = false" in chunk or "default = false" in chunk
|
|
|
|
|
|
def test_prod_only_workspace():
|
|
versions = (TERRAFORM / "versions.tf").read_text()
|
|
assert "afterhours-shift-manager-prod" in versions
|
|
assert "afterhours-shift-manager-dev" not in versions
|
|
assert 'environment = "prod"' in LOCALS
|
|
assert "seahaven-dev" not in LOCALS
|
|
|
|
|
|
def test_in_repo_hcptf_roles():
|
|
assert 'apply_role = "hcptf-afterhours-shift-manager"' in LOCALS
|
|
assert 'plan_role = "hcptf-afterhours-shift-manager-plan"' in LOCALS
|
|
assert "hcptf_apply" in HCP_IAM
|
|
assert "DenyCreatePolicy" in HCP_IAM
|
|
|
|
|
|
def test_deploy_workflow_is_prod_zip_cd():
|
|
assert "release: published" not in DEPLOY
|
|
assert "cd-sam" not in DEPLOY
|
|
assert "environment: prod" in DEPLOY
|
|
assert "deploy-afterhours-prod" in DEPLOY
|
|
assert "gh release create" not in DEPLOY
|
|
assert "package_lambdas.py" in DEPLOY
|
|
assert "update-function-code" in DEPLOY
|
|
|
|
|
|
def test_ci_runs_pytest_and_terraform_validate():
|
|
assert "ci-python-sam" not in CI
|
|
assert "pytest" in CI
|
|
assert "terraform fmt -check" in CI
|
|
assert "terraform init -backend=false" in CI
|
|
assert "terraform validate" in CI
|
|
|
|
|
|
def test_checkcomponents_queue_arn_variable_matches_iam_references():
|
|
assert 'variable "checkcomponents_queue_arn"' in VARIABLES
|
|
assert "var.checkcomponents_queue_arn" in LAMBDA_TF
|
|
boundary = (TERRAFORM / "lambda_boundary.tf").read_text()
|
|
assert "var.checkcomponents_queue_arn" in boundary
|
|
|
|
|
|
def test_eight_functions_named():
|
|
for name in (
|
|
"afterhours-shift-manager",
|
|
"afterhours-weekly-post",
|
|
"afterhours-roster-sync",
|
|
"afterhours-roster-api",
|
|
"afterhours-ring-scheduler",
|
|
"afterhours-holiday-router",
|
|
"afterhours-release-notifier",
|
|
"afterhours-portal-api",
|
|
):
|
|
assert name in LOCALS
|
|
|
|
|
|
def test_weekly_post_role_is_tf_managed_name():
|
|
assert 'role_name = "afterhours-shift-manager-weekly-post"' in LOCALS
|
|
|
|
|
|
def test_github_deploy_trust_is_environment_prod():
|
|
iam = (TERRAFORM / "iam_github_deploy.tf").read_text()
|
|
assert "environment:prod" in iam or "environment:prod" in LOCALS
|
|
assert "deploy.yaml@refs/heads/${var.github_deploy_branch}" in iam
|
|
assert "deploy.yaml@*" not in iam
|
|
assert "refs/tags/v*" not in iam
|
|
|
|
|
|
def test_plan_refresh_includes_provider6_s3_gets():
|
|
assert "s3:GetLifecycleConfiguration" in HCP_IAM
|
|
assert "s3:GetReplicationConfiguration" in HCP_IAM
|
|
assert "s3:GetBucketReplication" in HCP_IAM
|