adam/payments-dashboard
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/payments-dashboard.git synced 2026-09-30 12:23:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
67 commits 4 branches 0 tags 1.7 MiB
Commit graph

67 commits

This branch
This branch
All branches
Author SHA1 Message Date
Adam Moussa
3513f5de98 Attach org permissions boundary to all Lambda roles 
Adds seahaven-lambda-execution-boundary to Globals.Function so every
SAM-auto-generated Lambda execution role carries the boundary. Required
for the INFRA-97 github-cfn-execution-role scope-down to safely permit
iam:CreateRole on this stack.

No explicit AWS::IAM::Role resources exist in this template; the
Globals entry covers all six functions.

Refs: INFRA-103
 2026-06-10 13:51:27 -04:00
Adam Moussa
699928116d
INFRA-41: reconcile async-invoke DLQs + error alarms into IaC (#41)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bring the interim CLI-created dead-letter queues, error alarms, and
SendMessage role policies for payments-processPaymentCsv and
payments-processPayrollEmail under CloudFormation control (H-8 drift).

- Add per-function async-invoke OnFailure SQS DLQs (CFN-named
  payments-<fn>-async-dlq, 14d retention to match payments-payroll-batch-dlq)
- Wire EventInvokeConfig OnFailure on both functions (SAM auto-generates the
  scoped sqs:SendMessage policy on each execution role); explicit retry/age
  defaults locked in
- Add ALARM-only Lambda Errors alarms (Sum, threshold>0) -> site-alerts

Interim CLI resources (queues, alarms, role policies, event-invoke-configs)
removed post-deploy after the CFN-managed versions were confirmed live.
 2026-06-08 15:55:00 -04:00
Adam Moussa
ef2dcdccbf
Add dependency-review caller workflow (#39)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
* Add dependency-review caller workflow

Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.

* chore: retrigger checks

* chore: retrigger dep review (post-fix)
 2026-06-05 12:26:45 -04:00
dependabot[bot]
e76d04982a
Bump the minor-and-patch group with 6 updates (#38)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bumps the minor-and-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1059.0` | `3.1061.0` |
| [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1059.0` | `3.1061.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1059.0` | `3.1061.0` |
| [@aws-sdk/client-secrets-manager](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-secrets-manager) | `3.1059.0` | `3.1061.0` |
| [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1059.0` | `3.1061.0` |
| [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) | `3.1059.0` | `3.1061.0` |


Updates `@aws-sdk/client-dynamodb` from 3.1059.0 to 3.1061.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/clients/client-dynamodb)

Updates `@aws-sdk/client-lambda` from 3.1059.0 to 3.1061.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/clients/client-lambda)

Updates `@aws-sdk/client-s3` from 3.1059.0 to 3.1061.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/clients/client-s3)

Updates `@aws-sdk/client-secrets-manager` from 3.1059.0 to 3.1061.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-secrets-manager/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/clients/client-secrets-manager)

Updates `@aws-sdk/client-sqs` from 3.1059.0 to 3.1061.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/clients/client-sqs)

Updates `@aws-sdk/lib-dynamodb` from 3.1059.0 to 3.1061.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1061.0/lib/lib-dynamodb)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1061.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.1061.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1061.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-secrets-manager"
  dependency-version: 3.1061.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1061.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1061.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-04 00:52:30 +00:00
Adam Moussa
a7aa626455
Add S3/DDB gateway endpoints and payroll-batch DLQ (#37)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
Audit M-22: S3 and DynamoDB traffic from the VPC was billed through
the NAT gateway; gateway endpoints are free and keep it on the AWS
backbone.

Audit L-15: payroll-batch messages were silently lost after max
receives. Adds a 14-day DLQ with maxReceiveCount 3 and an ALARM-only
notification to site-alerts so a caught failure is actually seen.
 2026-06-03 15:32:17 -04:00
Adam Moussa
c8a55060a9
Merge pull request #36 from Sea-Haven-Industries/feature/INFRA-5-readme-secrets-manager
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
[INFRA-5] Update README for Secrets Manager migration
 2026-06-02 20:41:46 -04:00
Adam Moussa
4b6c973ac7 Update README for Secrets Manager migration 
Replace the SSM Parameters section with the new Secrets Manager secret
structure (3 grouped secrets) and correct the runtime-config note.

Refs: INFRA-5, #3
 2026-06-02 20:39:35 -04:00
Adam Moussa
6794e4950a
Merge pull request #35 from Sea-Haven-Industries/feature/migrate-secrets-to-secrets-manager 
Migrate secrets to Secrets Manager + add samconfig.toml.example
 2026-06-02 20:34:05 -04:00
Adam Moussa
12bd8fdb57 Add samconfig.toml.example for onboarding 
The SAM layout convention requires a committed samconfig.toml.example
template; only the gitignored samconfig.toml existed. Add one with
placeholder deploy parameters (stack name, region, S3, capabilities).

Refs: #5
 2026-06-02 20:29:29 -04:00
Adam Moussa
90accf2f39 Migrate secrets from SSM to Secrets Manager 
API tokens and credentials must live in Secrets Manager per
secrets-and-config.md, but the four original payment Lambdas still
read 10 SecureString SSM params. Move them to three grouped secrets
(slack-bot-token plaintext, boa-check-mgmt and boa-reporting as JSON),
matching the pattern the expense Lambdas already use. IAM is scoped to
secretsmanager:GetSecretValue per secret; the VPC Lambdas reach the
public endpoint over the existing NAT path. Test/reissue scripts and
the client-ssm dependency are updated/removed accordingly.

Refs: #3
 2026-06-02 20:29:18 -04:00
dependabot[bot]
f2d8471cef
Bump the minor-and-patch group across 1 directory with 8 updates (#34) 
Bumps the minor-and-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1050.0` | `3.1059.0` |
| [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1050.0` | `3.1059.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1050.0` | `3.1059.0` |
| [@aws-sdk/client-secrets-manager](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-secrets-manager) | `3.1050.0` | `3.1059.0` |
| [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1050.0` | `3.1059.0` |
| [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) | `3.1050.0` | `3.1059.0` |
| [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) | `3.1050.0` | `3.1059.0` |
| [mailparser](https://github.com/nodemailer/mailparser) | `3.9.8` | `3.9.9` |



Updates `@aws-sdk/client-dynamodb` from 3.1050.0 to 3.1059.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1059.0/clients/client-dynamodb)

Updates `@aws-sdk/client-lambda` from 3.1050.0 to 3.1059.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1059.0/clients/client-lambda)

Updates `@aws-sdk/client-s3` from 3.1050.0 to 3.1059.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1059.0/clients/client-s3)

Updates `@aws-sdk/client-secrets-manager` from 3.1050.0 to 3.1059.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-secrets-manager/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1059.0/clients/client-secrets-manager)

Updates `@aws-sdk/client-sqs` from 3.1050.0 to 3.1059.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1059.0/clients/client-sqs)

Updates `@aws-sdk/client-ssm` from 3.1050.0 to 3.1059.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1059.0/clients/client-ssm)

Updates `@aws-sdk/lib-dynamodb` from 3.1050.0 to 3.1059.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1059.0/lib/lib-dynamodb)

Updates `mailparser` from 3.9.8 to 3.9.9
- [Release notes](https://github.com/nodemailer/mailparser/releases)
- [Changelog](https://github.com/nodemailer/mailparser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/mailparser/compare/v3.9.8...v3.9.9)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1059.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.1059.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1059.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-secrets-manager"
  dependency-version: 3.1059.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1059.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1059.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1059.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mailparser
  dependency-version: 3.9.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-03 00:01:58 +00:00
Adam Moussa
c8dba41e57
Gitignore .env for compliance (#33)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details
2026-06-02 19:56:42 -04:00
Adam Moussa
46cd49766c
Add API access logging + throttling (audit Day 3: M-18) (#32)
Some checks are pending
Deploy / deploy (push) Waiting to run
Details 
Implicit HTTP API: access logging to /aws/apigateway/payments-dashboard (90d) +
default route throttling (100 rps / 50 burst) via Globals.HttpApi.
 2026-06-02 17:36:59 -04:00
dependabot[bot]
a2a7e3f533
Bump the minor-and-patch group with 7 updates (#29)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
Bumps the minor-and-patch group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1045.0` | `3.1050.0` |
| [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-lambda) | `3.1045.0` | `3.1050.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1045.0` | `3.1050.0` |
| [@aws-sdk/client-secrets-manager](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-secrets-manager) | `3.1045.0` | `3.1050.0` |
| [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1045.0` | `3.1050.0` |
| [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) | `3.1045.0` | `3.1050.0` |
| [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) | `3.1045.0` | `3.1050.0` |


Updates `@aws-sdk/client-dynamodb` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/clients/client-dynamodb)

Updates `@aws-sdk/client-lambda` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/clients/client-lambda)

Updates `@aws-sdk/client-s3` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/clients/client-s3)

Updates `@aws-sdk/client-secrets-manager` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-secrets-manager/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/clients/client-secrets-manager)

Updates `@aws-sdk/client-sqs` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/clients/client-sqs)

Updates `@aws-sdk/client-ssm` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/clients/client-ssm)

Updates `@aws-sdk/lib-dynamodb` from 3.1045.0 to 3.1050.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1050.0/lib/lib-dynamodb)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1050.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-lambda"
  dependency-version: 3.1050.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1050.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-secrets-manager"
  dependency-version: 3.1050.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1050.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1050.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1050.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-20 04:29:26 +00:00
Adam Moussa
5330c3f88a
Merge expense-approval-bot into payments-dashboard (#28)
Some checks failed
Deploy / deploy (push) Has been cancelled
Details 
* Merge expense-approval-bot into payments-dashboard

Port the Slack reaction-driven expense routing workflow (receiver +
processor) from expense-approval-bot into this stack as JavaScript ESM.
Secrets copied to payments-dashboard/ prefix in Secrets Manager.

* Fix review findings from PR #28

- Add length check before timingSafeEqual to prevent RangeError on
  malformed signatures (returns 401 instead of 500)
- Check event.type === reaction_added to prevent reaction_removed
  from advancing expenses
- Move getPermalink call behind isOrigin check to skip unnecessary
  API call on non-origin stage transitions
 2026-05-12 13:08:42 -04:00
dependabot[bot]
7268c21a2a
Bump the minor-and-patch group with 5 updates (#23) 
Bumps the minor-and-patch group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) | `3.1043.0` | `3.1045.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1044.0` | `3.1045.0` |
| [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) | `3.1041.0` | `3.1045.0` |
| [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) | `3.1044.0` | `3.1045.0` |
| [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) | `3.1043.0` | `3.1045.0` |


Updates `@aws-sdk/client-dynamodb` from 3.1043.0 to 3.1045.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/clients/client-dynamodb)

Updates `@aws-sdk/client-s3` from 3.1044.0 to 3.1045.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/clients/client-s3)

Updates `@aws-sdk/client-sqs` from 3.1041.0 to 3.1045.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/clients/client-sqs)

Updates `@aws-sdk/client-ssm` from 3.1044.0 to 3.1045.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/clients/client-ssm)

Updates `@aws-sdk/lib-dynamodb` from 3.1043.0 to 3.1045.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/lib/lib-dynamodb)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1045.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1045.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1045.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1045.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1045.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 22:27:19 +00:00
dependabot[bot]
fba8fb195d
Bump fast-xml-builder from 1.1.5 to 1.2.0 (#25) 
Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.5 to 1.2.0.
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-builder/compare/v1.1.5...v1.2.0)

---
updated-dependencies:
- dependency-name: fast-xml-builder
  dependency-version: 1.2.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-08 22:25:38 +00:00
Adam Moussa
208e90a23f
Add GitHub Actions deploy workflow (#26) 
* Add GitHub Actions deploy workflow (OIDC)

* Add permissions block for OIDC token exchange

* Add concurrency control to prevent parallel deploys
 2026-05-08 17:08:06 -04:00
Adam Moussa
d813e76a78
Add CI workflow (#24) 2026-05-08 15:49:44 -04:00
Adam Moussa
36c9ad7d52
Update Dependabot: remove assignees, group minor/patch updates (#20) 2026-05-08 14:24:17 -04:00
Adam Moussa
b7feb4a914
Collapsible dashboard sections and clean up BoA audit log (#22) 
* Make dashboard sections collapsible and clean up BoA audit log

- Scheduled Checks, Scheduled ACH, and Outstanding Checks sections
  default to collapsed with summary line; Expand/Collapse button
  toggles detail view via private_metadata state
- Filter backfill failure records from BoA submissions display
- Limit Recent BoA Submissions to 5 most recent entries

* Share Slack home publish pipeline

Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
 2026-05-08 11:24:32 -04:00
Adam Moussa
491d29de1e
Fix BoA CashPro batch limit for large CSV exports (#21) 
* Fix BoA CashPro API rejection when CSV has >100 checks

BoA check-issues endpoint has a 100-item limit per call. Large Stampli
exports were failing with error 10102. Batch submissions into chunks of
100 for both add_Issue and cancel_Issue actions.

* Add backfill handler and filter invalid check numbers

- Add backfill mode (event.backfill=true) that scans DDB for checks not
  yet submitted to BoA and submits them in batches, handling duplicates
  gracefully by retrying without already-submitted items
- Skip check numbers > 10 digits (BoA rejects them with 10092)

* Handle non-JSON BoA backfill errors

Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>

* Handle numeric BoA duplicate statuses

Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
 2026-05-07 20:44:14 -04:00
Adam Moussa
0c951840b9
Remove wrapper workflow — using required workflow via org ruleset (#19) 2026-05-06 19:59:15 -04:00
dependabot[bot]
67e6f7739b
Bump csv-parse from 5.6.0 to 6.2.1 (#11) 
Bumps [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse) from 5.6.0 to 6.2.1.
- [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md)
- [Commits](https://github.com/adaltas/node-csv/commits/csv-parse@6.2.1/packages/csv-parse)

---
updated-dependencies:
- dependency-name: csv-parse
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:43:05 -04:00
dependabot[bot]
ef21e5e2eb
Bump @aws-sdk/client-s3 from 3.1027.0 to 3.1044.0 (#17) 
Bumps [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) from 3.1027.0 to 3.1044.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1044.0/clients/client-s3)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1043.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:23:51 -04:00
dependabot[bot]
d089a70df1
Bump @aws-sdk/client-ssm from 3.1041.0 to 3.1044.0 (#16) 
Bumps [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) from 3.1041.0 to 3.1044.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1044.0/clients/client-ssm)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1043.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:23:48 -04:00
dependabot[bot]
0ee5dbaeab
Bump @aws-sdk/client-dynamodb from 3.1041.0 to 3.1043.0 (#15) 
Bumps [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) from 3.1041.0 to 3.1043.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1043.0/clients/client-dynamodb)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1043.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:21:44 -04:00
dependabot[bot]
f88ec2bcbf
Bump @aws-sdk/lib-dynamodb from 3.1027.0 to 3.1043.0 (#14) 
Bumps [@aws-sdk/lib-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-dynamodb) from 3.1027.0 to 3.1043.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1043.0/lib/lib-dynamodb)

---
updated-dependencies:
- dependency-name: "@aws-sdk/lib-dynamodb"
  dependency-version: 3.1043.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-05-06 18:21:40 -04:00
Adam Moussa
f70acc1ee6
Add Claude Code review workflow (#18) 2026-05-06 18:12:04 -04:00
Adam Moussa
bc7510499d
Merge pull request #12 from Sea-Haven-Industries/feature/dependabot-auto-assign 
Auto-assign Dependabot PRs
 2026-05-02 17:28:12 -04:00
Adam Moussa
740d7e490e Auto-assign Dependabot PRs to amoussa1229 2026-05-02 17:26:21 -04:00
Adam Moussa
17c100a41f
Merge pull request #9 from Sea-Haven-Industries/dependabot/npm_and_yarn/aws-sdk/client-ssm-3.1041.0 
Bump @aws-sdk/client-ssm from 3.1027.0 to 3.1041.0
 2026-05-02 17:25:42 -04:00
dependabot[bot]
f425157391
Bump @aws-sdk/client-ssm from 3.1027.0 to 3.1041.0 
Bumps [@aws-sdk/client-ssm](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ssm) from 3.1027.0 to 3.1041.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-ssm/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1041.0/clients/client-ssm)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-ssm"
  dependency-version: 3.1041.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-02 21:24:35 +00:00
Adam Moussa
600cbb66f1
Merge pull request #10 from Sea-Haven-Industries/dependabot/npm_and_yarn/aws-sdk/client-dynamodb-3.1041.0 
Bump @aws-sdk/client-dynamodb from 3.1027.0 to 3.1041.0
 2026-05-02 17:23:14 -04:00
Adam Moussa
efb6278b1f
Merge pull request #8 from Sea-Haven-Industries/dependabot/npm_and_yarn/aws-sdk/client-sqs-3.1041.0 
Bump @aws-sdk/client-sqs from 3.1039.0 to 3.1041.0
 2026-05-02 17:23:11 -04:00
dependabot[bot]
757a3d48f2
Bump @aws-sdk/client-dynamodb from 3.1027.0 to 3.1041.0 
Bumps [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb) from 3.1027.0 to 3.1041.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1041.0/clients/client-dynamodb)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-dynamodb"
  dependency-version: 3.1041.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-02 21:18:12 +00:00
dependabot[bot]
24e49b2a8b
Bump @aws-sdk/client-sqs from 3.1039.0 to 3.1041.0 
Bumps [@aws-sdk/client-sqs](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sqs) from 3.1039.0 to 3.1041.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sqs/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1041.0/clients/client-sqs)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sqs"
  dependency-version: 3.1041.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-02 21:17:30 +00:00
Adam Moussa
c8b09b1ea9
Merge pull request #6 from Sea-Haven-Industries/feature/add-dependabot-config 
Add Dependabot version update configuration
 2026-05-02 17:15:47 -04:00
Adam Moussa
d9cc89c7e9 Add Dependabot version update configuration 2026-05-02 17:14:26 -04:00
Adam Moussa
df14849dbb Update README with payroll email pipeline documentation 2026-04-30 14:19:06 -04:00
Adam Moussa
5bebd954bd Fix Lambda compliance and rename SQS queue 
- Switch runtime to nodejs22.x and architecture to arm64
- Add explicit CloudWatch log groups with 60-day retention for all Lambdas
- Rename SQS queue from payments-contractor-batch to payments-payroll-batch
  (now handles both employee and contractor batching)
- Remove stale comment
 2026-04-30 14:15:05 -04:00
Adam Moussa
fe7c9cebca Replace Dataddo/Aurora payroll pipeline with email-triggered notifications 
SES receives Gusto payroll emails at payroll@int.seahaven.com, stores
to S3, Lambda parses and posts a combined Slack notification (employee
payroll + contractor payments in one message) after a 10-minute SQS
batching window.

Removes Aurora Serverless, notifyPayroll Lambda, and @aws-sdk/client-rds-data.
Adds mailparser, SQS delay queue, and processPayrollEmail Lambda.
 2026-04-30 14:04:48 -04:00
Adam Moussa
8f409d0e63 Add .claude configuration directory 2026-04-27 19:14:54 -04:00
Adam Moussa
3583e2fc11 Add payroll notification Lambda for Gusto payroll via Dataddo 
Queries Aurora for new payroll runs and contractor payments, sends
formatted Slack message with gross pay breakdown and total bank
withdrawal amount. Runs weekdays at 2pm ET, tracks notified payrolls
in DynamoDB to avoid duplicates.
 2026-04-24 16:39:50 -04:00
Adam Moussa
c9163e9f60 Add Aurora Serverless v2 PostgreSQL for Gusto payroll ingestion via Dataddo 
Adds public subnet in second AZ, Aurora security group, DB subnet group,
and Serverless v2 cluster with Data API enabled and Secrets Manager credentials.
 2026-04-24 15:05:43 -04:00
Adam Moussa
b242df15b5 Log BoA submissions to DDB and surface in Slack App Home 
Capture response headers, body, and transactionId on every check-issue
API call; persist as boa_txn#<ts>#<action> records with 90-day TTL.
Add "Recent BoA Submissions" section to App Home showing the last 10
with click-to-copy transactionId.

Motivation: BoA support asked for a transactionId from a past
successful call and we had no way to recover it from CloudWatch
summary logs alone.

Also adds simulate-csv.cjs (dry-run preview) and stampli-uploader.sh
(launchd-invoked S3 uploader), and gitignores debug artifacts.
 2026-04-20 17:40:55 -04:00
Adam Moussa
e6fbd3de1b
Merge pull request #2 from Sea-Haven-Industries/feature/boa-api-integration 
Add BoA CashPro API integration
 2026-04-14 20:18:33 -04:00
Adam Moussa
c849280705 Improve BoA API error logging and update .gitignore 
Read response as text before JSON parsing to capture non-JSON error
responses from BoA API. Add .DS_Store, BofA API Resources, and CSV
files to .gitignore.
 2026-04-14 20:15:41 -04:00
Adam Moussa
ffd46c4bda Fix BoA transaction matching, add status progression protection, enable daily schedule 
- Fix transaction code mapping (475=Cleared, 255=Returned) in fetchBoaTransactions
- Match on customerReference instead of bankReference for check number matching
- Add bank-confirmed protection: CSV cannot override status once bank confirms Cleared
- Add status progression guard: CSV cannot regress status backward in lifecycle
- Cleared status is permanent — cannot be voided, cancelled, or changed
- Enable daily fetchBoaTransactions schedule (9am ET weekdays)
- Add production test script and dry run simulation script
 2026-04-14 17:43:13 -04:00
Adam Moussa
d065b320eb Merge master into feature/boa-api-integration 
Brings in dashboard UI improvements (drill-down modals, redesign,
ACH reference labels) while preserving BoA OAuth integration code.
 2026-04-13 16:28:17 -04:00