4 commits

Author	SHA1	Message	Date
Adam Moussa	5c040bf55c	Fix PR review findings: auth, rounding, and close-form guard ... - Remove dead elif branch in submit_order auth (always returned 403) - Catch HTTPError before URLError so expired tokens return 403 not 503 - Wrap SSM get_parameter in try/except for fresh deployments - Add wall-clock guard to close_form handler (Friday >= 11 PM ET) - Add epsilon nudge to JS employeePrice for IEEE 754 boundary match - Switch Flask dev server from round() to Decimal ROUND_HALF_UP - Add tests for HTTPError handling and close_form guard (6 new tests)	2026-05-13 13:39:18 -04:00
Adam Moussa	fa8f19660d	Apply ruff formatting	2026-05-13 13:25:40 -04:00
Adam Moussa	406aa9b95d	Use full email as order slug for defense-in-depth ... Replace email-prefix slug with full lowercase email to eliminate any possibility of cross-domain collisions, per senior review sign-off.	2026-05-13 13:21:52 -04:00
Adam Moussa	fa2b4b7616	Add unit tests for submit, notify, and aggregate handlers ... 50 tests covering pricing pipeline (Decimal rounding, clamping, totals), Google auth (enforcement, bypass prevention, audience/domain validation, 503 on outage), email slug generation, form status with reopen_at, input validation, Slack failure resilience, reminder dedup guards, order confirmation DMs, aggregated summaries, CSV generation, and mrkdwn escaping.	2026-05-13 12:59:22 -04:00