Fix auth config check and URL escaping in form

- _google_auth_configured() now checks env var presence (intent), not
  the fetched SSM value — prevents silent auth bypass if SSM param is
  deleted
- Add </script> escaping to URL values in generate_form.py for
  consistency with other injected values

functions/submit_order/handler.py

@@ -65,7 +65,7 @@ def _get_discount_settings() -> tuple[Decimal, Decimal]:
 
 
 def _google_auth_configured() -> bool:
-    return bool(_get_google_client_id())
+    return bool(os.environ.get("GOOGLE_CLIENT_ID_PARAM", ""))
 
 
 def _is_parameter_not_found(exc: Exception) -> bool:
@@ -204,15 +204,7 @@ def handle_submit(event):
     # If SSM fetch fails for any other reason, fail closed (503).
     google_token = body.get("google_id_token")
 
-    try:
-        google_auth_configured = _google_auth_configured()
-    except Exception as exc:
-        logger.error("SSM fetch failed for Google client ID: %s", exc)
-        return response(
-            503, {"error": "Authentication service temporarily unavailable"}
-        )
-
-    if google_auth_configured:
+    if _google_auth_configured():
         try:
             client_id = _get_google_client_id()
         except Exception as exc:

src/server/generate_form.py

@@ -48,11 +48,15 @@ def generate_form(
     deadline = config.get("order_deadline", "Thursday 11:59 PM")
     week = datetime.now().strftime("%Y-W%U")
     scraped_at = menu.get("scraped_at", "unknown")
-    submit_url = f"{api_url}/api/submit-order" if api_url else "/api/submit-order"
+    submit_url = (
+        f"{api_url}/api/submit-order" if api_url else "/api/submit-order"
+    ).replace("</", "<\\/")
     status_url = (
         f"{api_url}/api/form-status/{week}" if api_url else f"/api/form-status/{week}"
+    ).replace("</", "<\\/")
+    roster_url = (f"{api_url}/api/roster" if api_url else "/api/roster").replace(
+        "</", "<\\/"
     )
-    roster_url = f"{api_url}/api/roster" if api_url else "/api/roster"
     api_key_json = json.dumps(api_key).replace("</", "<\\/")
     has_discount = bulk_discount > 0 or company_subsidy > 0
     use_google_auth = bool(google_client_id)

tests/test_submit_order.py

@@ -420,7 +420,7 @@ def test_total_summation_multiple_items(
 @patch("submit_order_handler.get_secret", return_value=TEST_API_KEY)
 @patch("submit_order_handler.get_parameter")
 @patch("submit_order_handler.get_menu")
-def test_missing_google_client_id_param_allows_manual_submission(
+def test_missing_ssm_param_with_env_var_fails_closed(
     mock_get_menu,
     mock_get_parameter,
     mock_secret,
@@ -430,7 +430,7 @@ def test_missing_google_client_id_param_allows_manual_submission(
     mock_put,
     mock_lam,
 ):
-    """Missing Google client ID SSM parameter means auth is not configured."""
+    """Env var set but SSM param missing -> 503 (fail closed, not silent manual fallback)."""
     from submit_order_handler import lambda_handler
 
     class ParameterNotFoundError(Exception):
@@ -448,10 +448,8 @@ def test_missing_google_client_id_param_allows_manual_submission(
 
     status, body = _parse_response(result)
 
-    assert status == 200, f"Expected 200, got {status}: {body}"
-    saved_order = mock_put.call_args[0][2]
-    assert saved_order["employee_name"] == "Test User"
-    assert saved_order["employee_email"] == "test.user@seahavenind.com"
+    assert status == 503, f"Expected 503 (fail closed), got {status}: {body}"
+    mock_put.assert_not_called()
 
 
 @patch("submit_order_handler._lambda")