renovate[bot]
67014c954a
chore(deps): update pip minor and patch ( #189 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-21 15:41:24 +00:00
Adam Moussa
12f1eb881f
fix(auth): accept federated portal Cognito tokens for meals admin (DEV-283) ( #194 )
...
Build Lambda Layer / build (push) Has been cancelled
* fix(auth): accept federated portal Cognito tokens for meals admin
Google Workspace federation stores email_verified=false, which 403'd the
portal Admin probe while the public menu still loaded.
* fix(iam): grant plan role CloudFront DescribeFunction
2026-09-18 15:31:17 +00:00
Adam Moussa
26a92a2f62
feat(auth): accept portal Cognito ID tokens (DEV-238) ( #192 )
...
Build Lambda Layer / build (push) Has been cancelled
* feat(auth): accept portal Cognito ID tokens
* fix(auth): distinguish portal verification outages
* docs(auth): document Cognito workspace variables
2026-09-15 22:12:01 +00:00
renovate[bot]
432203f04d
chore(deps): update dependency boto3 to v1.43.78 ( #168 )
2026-08-24 20:32:21 +00:00
Adam Moussa
9407a3e6d7
chore(deps): batch minor and patch updates ( #165 )
Build Lambda Layer / build (push) Waiting to run
2026-08-24 19:47:00 +00:00
dependabot[bot]
861f959adf
chore(deps): bump boto3 ( #140 )
...
Bumps the minor-and-patch group in /functions/admin_authorizer with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.66 to 1.43.71
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.66...1.43.71 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.71
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-17 18:33:21 +00:00
dependabot[bot]
710927d836
chore(deps): bump boto3 ( #126 )
...
Bumps the minor-and-patch group in /functions/admin_authorizer with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.62 to 1.43.66
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.62...1.43.66 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.66
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-10 12:43:00 -04:00
dependabot[bot]
68382e60e7
chore(deps): bump boto3 ( #115 )
...
Bumps the minor-and-patch group in /functions/admin_authorizer with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.60 to 1.43.62
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.60...1.43.62 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.62
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-04 17:47:28 -04:00
dependabot[bot]
4584b8fe50
chore(deps): bump boto3 ( #99 )
...
Bumps the minor-and-patch group in /functions/admin_authorizer with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.56 to 1.43.60
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.56...1.43.60 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.60
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 13:28:21 -04:00
Adam Moussa
03e902da6c
chore(deps): bump boto3 from 1.43.51 to 1.43.56 in multiple files ( #68 )
...
* chore(deps): bump boto3
Bumps the minor-and-patch group in /functions/admin_authorizer with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.51 to 1.43.56
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.51...1.43.56 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.56
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): bump boto3
Bumps the minor-and-patch group in /functions/aggregate_orders with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.51 to 1.43.56
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.51...1.43.56 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.56
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): bump boto3
Bumps the minor-and-patch group in /functions/close_form with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.51 to 1.43.56
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.51...1.43.56 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.56
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): bump boto3
Bumps the minor-and-patch group in /functions/email_report with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.51 to 1.43.56
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.51...1.43.56 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.56
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): bump boto3
Bumps the minor-and-patch group in /functions/slack_notifier with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.51 to 1.43.56
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.51...1.43.56 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.56
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): bump boto3
Bumps the minor-and-patch group in /functions/submit_order with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.51 to 1.43.56
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.51...1.43.56 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.56
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* chore(deps): bump boto3 in /src/shared in the minor-and-patch group
Bumps the minor-and-patch group in /src/shared with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.51 to 1.43.56
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.51...1.43.56 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.56
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 15:03:46 +00:00
Adam Moussa
4079d57757
chore: Bump boto3 from 1.43.41 and 1.43.46 to 1.43.51 ( #56 )
Deploy / deploy (push) Has been cancelled
2026-07-20 16:56:49 +00:00
dependabot[bot]
1f76e8980e
Bump boto3 in /functions/admin_authorizer in the minor-and-patch group ( #40 )
...
Bumps the minor-and-patch group in /functions/admin_authorizer with 1 update: [boto3](https://github.com/boto/boto3 ).
Updates `boto3` from 1.43.41 to 1.43.46
- [Release notes](https://github.com/boto/boto3/releases )
- [Commits](https://github.com/boto/boto3/compare/1.43.41...1.43.46 )
---
updated-dependencies:
- dependency-name: boto3
dependency-version: 1.43.46
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Adam Moussa <166072409+amoussa1229@users.noreply.github.com>
2026-07-13 16:28:06 +00:00
Adam Moussa
b8fef8b4f4
chore(deps): pin Python requirements to == for reproducible builds (INFRA-62) ( #36 )
2026-07-06 18:27:02 -04:00
Adam Moussa
75fb3280f5
Add gateway-level authorizer to admin API (INFRA-100) ( #24 )
...
Deploy / deploy (push) Has been cancelled
The /api/admin/* routes (GET/PUT/DELETE /api/admin/orders and
GET /api/admin/summary-pdf) were AuthorizationType NONE, relying entirely on
the in-handler _verify_admin Google-token + admin-email check. This adds an
HTTP API Lambda authorizer that enforces the same check at the gateway, so
unauthenticated requests are rejected before reaching the integration.
- New admin_authorizer Lambda: validates the Authorization: Bearer Google ID
token (aud + allowed Workspace domain) and the admin_emails allow-list from
DynamoDB, returning the HTTP API simple response {isAuthorized}. Fails closed
on missing config, unavailable client ID, bad token, or DynamoDB error.
- OrderApi gains an AdminGoogleAuthorizer with result caching disabled
(AuthorizerResultTtlInSeconds: 0) so expired tokens / removed admins can't be
served from cache. Wired onto all four admin events; no DefaultAuthorizer, so
public routes (submit-order, form-status, roster) stay NONE.
- IAM role for API Gateway to invoke the authorizer; 60-day log group.
- 10 unit tests for the authorizer.
No client change: the admin panel already sends Authorization: Bearer
<google_id_token>. The in-handler _verify_admin check stays as defense-in-depth.
Cross-reviewed by GPT-4.1 (APPROVE-WITH-FIXES); both BLOCK items applied
(disable authorizer caching, fail-closed on DynamoDB error).
2026-06-08 18:05:09 -04:00
