mirror of
https://github.com/Sea-Haven-Industries/meal-order-manager.git
synced 2026-09-30 06:33:12 +00:00
44c79fdefd
* feat(infra): add lightweight meal-order-manager-dev (PLAT-210) Parameterize the HCP root for seahaven-dev with schedules, PITR, alarms, and Paychex gated off so a second env does not clone production cost or side effects. * fix(infra): drop prod-only authorizer import so dev can create it (PLAT-210) The PLAT-102 import is already in meal-order-manager-prod state. A shared import block fails in seahaven-dev because the permission does not exist there. * fix(iam): allow creating the weekly-menu githubdeploy role in seahaven-dev (PLAT-210) Prod imported that role. A new account needs CreateRole on tf-managed/githubdeploy-meal-order-manager-weekly-menu.
125 lines
4.8 KiB
HCL
125 lines
4.8 KiB
HCL
locals {
|
|
project = "meal-order-manager"
|
|
is_prod = var.environment == "prod"
|
|
account_id = local.is_prod ? "011934824531" : "710827005802"
|
|
hcp_project = "seahaven-${var.environment}"
|
|
hcp_workspace = "${local.project}-${var.environment}"
|
|
|
|
# Lambda execution roles under /tf-managed/ carry the per-workload ceiling
|
|
# (PLAT-52). githubdeploy-meal-order-manager-weekly-menu must not.
|
|
boundary_arn = "arn:aws:iam::${local.account_id}:policy/seahaven-lambda-execution-boundary-meal-order-manager"
|
|
|
|
form_bucket_name = "${local.project}-form-${local.account_id}"
|
|
reports_bucket_name = "${local.project}-reports-${local.account_id}"
|
|
artifacts_bucket_name = "${local.project}-artifacts-${local.account_id}"
|
|
|
|
table_name = "${local.project}-orders"
|
|
# Pre-DNS: use the CloudFront domain. After cutover (attach_custom_domain),
|
|
# use the public custom domain.
|
|
form_url = var.attach_custom_domain ? "https://${var.domain_name}" : "https://${aws_cloudfront_distribution.form.domain_name}"
|
|
|
|
ssm_prefix = "/${local.project}"
|
|
slack_channel_param = "${local.ssm_prefix}/slack-channel-id"
|
|
|
|
# google-client-id is created and rotated out-of-band. Terraform reads it
|
|
# (data.tf) but never owns it.
|
|
google_client_id_param = "${local.ssm_prefix}/google-client-id"
|
|
|
|
portal_cognito_issuer_param = "${local.ssm_prefix}/portal-cognito-issuer"
|
|
portal_cognito_audience_param = "${local.ssm_prefix}/portal-cognito-audience"
|
|
portal_cognito_trust_param = "${local.ssm_prefix}/portal-cognito-trust"
|
|
|
|
# shared/slack.py resolves the token by NAME, while the IAM grant is scoped to
|
|
# the ARN in var.slack_bot_secret_arn. Both must refer to the same secret.
|
|
slack_bot_secret_name = "${local.project}/slack-bot-token"
|
|
|
|
ssm_parameter_arn_wildcard = "arn:aws:ssm:${var.aws_region}:${local.account_id}:parameter${local.ssm_prefix}/*"
|
|
|
|
# Directory names under functions/, which build_packages.sh mirrors into
|
|
# terraform/build/functions/.
|
|
function_packages = toset([
|
|
"admin_authorizer",
|
|
"aggregate_orders",
|
|
"close_form",
|
|
"slack_notifier",
|
|
"submit_order",
|
|
"sync_roster",
|
|
])
|
|
|
|
# SAM Globals.Function.Environment.Variables — every function receives these.
|
|
common_env = {
|
|
TABLE_NAME = local.table_name
|
|
REPORTS_BUCKET = local.reports_bucket_name
|
|
SLACK_CHANNEL_PARAM = local.slack_channel_param
|
|
FORM_URL = local.form_url
|
|
SLACK_BOT_SM_NAME = local.slack_bot_secret_name
|
|
}
|
|
|
|
# AWS managed CachingDisabled / AllViewerExceptHostHeader. Authenticated
|
|
# portal calls must not be cached and must not send the viewer Host to the
|
|
# HTTP API (Forbidden).
|
|
api_cache_policy_id = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad"
|
|
api_origin_request_policy_id = "b689b0a8-53d0-40ab-baf2-68738e2966ac"
|
|
cloudfront_all_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
|
|
|
|
# HTTP API routes, all integrated with submit-order. `authorizer` selects the
|
|
# authorization mode; `permission_source` is the method/path suffix of the
|
|
# per-route lambda:InvokeFunction grant (path parameters become `*`).
|
|
api_routes = {
|
|
submit_order = {
|
|
route_key = "POST /api/submit-order"
|
|
authorizer = "NONE"
|
|
permission_source = "POST/api/submit-order"
|
|
}
|
|
menu = {
|
|
route_key = "GET /api/menu/{week}"
|
|
authorizer = "NONE"
|
|
permission_source = "GET/api/menu/*"
|
|
}
|
|
my_orders = {
|
|
route_key = "GET /api/orders/{week}"
|
|
authorizer = "NONE"
|
|
permission_source = "GET/api/orders/*"
|
|
}
|
|
form_status = {
|
|
route_key = "GET /api/form-status/{week}"
|
|
authorizer = "NONE"
|
|
permission_source = "GET/api/form-status/*"
|
|
}
|
|
roster = {
|
|
route_key = "GET /api/roster"
|
|
authorizer = "NONE"
|
|
permission_source = "GET/api/roster"
|
|
}
|
|
publish_settings = {
|
|
route_key = "GET /api/publish/settings"
|
|
authorizer = "AWS_IAM"
|
|
permission_source = "GET/api/publish/settings"
|
|
}
|
|
publish_menu = {
|
|
route_key = "POST /api/publish/menu"
|
|
authorizer = "AWS_IAM"
|
|
permission_source = "POST/api/publish/menu"
|
|
}
|
|
admin_orders_get = {
|
|
route_key = "GET /api/admin/orders"
|
|
authorizer = "CUSTOM"
|
|
permission_source = "GET/api/admin/orders"
|
|
}
|
|
admin_orders_put = {
|
|
route_key = "PUT /api/admin/orders"
|
|
authorizer = "CUSTOM"
|
|
permission_source = "PUT/api/admin/orders"
|
|
}
|
|
admin_orders_delete = {
|
|
route_key = "DELETE /api/admin/orders"
|
|
authorizer = "CUSTOM"
|
|
permission_source = "DELETE/api/admin/orders"
|
|
}
|
|
admin_summary_pdf = {
|
|
route_key = "GET /api/admin/summary-pdf"
|
|
authorizer = "CUSTOM"
|
|
permission_source = "GET/api/admin/summary-pdf"
|
|
}
|
|
}
|
|
}
|