"""Direct-invoke healthcheck early-return tests for the PO handler. The post-deploy smoke script invokes the Lambda synchronously with ``{"healthcheck": true}`` and asserts the response is ``{"healthcheck": "ok"}``. That branch is pinned to run as the VERY FIRST thing handler() does -- before any S3 fetch, before ses_auth, before the Records loop -- so it neither creates an accept path for mail nor emits any EMF metric / log line that could trip the ``sender_auth_rejected`` substring metric-filter alarm on a deploy. These tests import ``po_handler`` from ``_po_parser_support`` (moto imported first, PO modules loaded by file path under unique names) exactly like the rest of the PO suite, preserving the moto-before-handler import ordering. """ import pytest from _po_parser_support import load_raw, po_enrichment, po_handler, po_persistence class _ExplodingS3: """Any S3 access from the healthcheck path is a contract violation.""" def get_object(self, **kwargs): # noqa: N803 raise AssertionError(f"healthcheck must not touch S3: {kwargs}") def _exploding_auth(*args, **kwargs): raise AssertionError("healthcheck must not call ses_auth") def _exploding_metric(*args, **kwargs): raise AssertionError("healthcheck must not emit any parse metric") # --- (1) healthcheck early-return: ok payload, zero side effects --- def test_healthcheck_returns_ok_with_zero_side_effects( fake_dynamo, monkeypatch, capsys ): monkeypatch.setattr(po_handler, "s3", _ExplodingS3()) monkeypatch.setattr(po_handler, "authenticate_inbound_email", _exploding_auth) monkeypatch.setattr(po_handler, "_emit_parse_method_metric", _exploding_metric) # _emit_derived_agreement_metric is owned by telemetry.py and imported into # enrichment.py (enrich_parsed's binding); patch it on the enrichment module, # which is where enrich_parsed would resolve it -- it is NOT re-exported on # handler (handler never calls it directly). monkeypatch.setattr( po_enrichment, "_emit_derived_agreement_metric", _exploding_metric ) result = po_handler.handler({"healthcheck": True}, None) assert result == {"healthcheck": "ok"} # ZERO DynamoDB writes: no table was ever fetched/updated. assert fake_dynamo.tables == {} # ZERO EMF metric emission: EMF records go to stdout via print(); the branch # must not have printed anything the sender_auth_rejected filter could match. # (Empty stdout subsumes any substring check on it; stderr is checked for # the filter pattern specifically.) captured = capsys.readouterr() assert captured.out == "" assert "sender_auth_rejected" not in captured.err def test_healthcheck_branch_precedes_records_key_lookup(monkeypatch): """The healthcheck return fires even when a hostile payload also carries a top-level ``Records`` key: the branch is ordered before the loop, and the exploding S3/auth prove the loop body never runs.""" monkeypatch.setattr(po_handler, "s3", _ExplodingS3()) monkeypatch.setattr(po_handler, "authenticate_inbound_email", _exploding_auth) event = { "healthcheck": True, "Records": [ {"s3": {"bucket": {"name": "b"}, "object": {"key": "k"}}}, ], } assert po_handler.handler(event, None) == {"healthcheck": "ok"} @pytest.mark.parametrize( "event", [ {"healthcheck": False}, {"healthcheck": "true"}, {"healthcheck": 1}, {"healthcheck": {"nested": True}}, {"Healthcheck": True}, # wrong case: not the contract key {}, ], ) def test_non_healthcheck_payloads_do_not_early_return(event): """Only a top-level ``healthcheck`` that is exactly ``True`` takes the branch; anything else falls through to the (empty) Records loop and returns the normal 200 body.""" assert po_handler.handler(event, None) == {"statusCode": 200, "body": "OK"} # --- (2) a normal S3 mail event is completely unaffected --- class _RecordingS3: def __init__(self, raw): self._raw = raw self.calls = [] def get_object(self, Bucket, Key): # noqa: N803 self.calls.append((Bucket, Key)) class _Body: def __init__(self, data): self._data = data def read(self): return self._data return {"Body": _Body(self._raw)} def _s3_event(): return { "Records": [ { "s3": { "bucket": {"name": "po-ingest-emails-x"}, "object": {"key": "inbound/hc"}, } } ] } def test_normal_mail_event_still_processed(fake_dynamo, monkeypatch): """Golden-path guard: a real S3 ObjectCreated mail event is unaffected by the healthcheck branch -- it still fetches from S3 and upserts the PO.""" recording = _RecordingS3(load_raw("new-po", "new-po-01")) monkeypatch.setattr(po_handler, "s3", recording) monkeypatch.setattr(po_handler, "authenticate_inbound_email", lambda *a: True) result = po_handler.handler(_s3_event(), None) assert result == {"statusCode": 200, "body": "OK"} # The branch was NOT taken: S3 was fetched and the PO was written through. assert recording.calls == [("po-ingest-emails-x", "inbound/hc")] assert fake_dynamo.tables[po_persistence.PO_TABLE].updates def test_healthcheck_string_in_email_body_does_not_take_branch( fake_dynamo, monkeypatch ): """A mail event whose EMAIL BODY contains the string 'healthcheck' must NOT trigger the early return: the trigger is a top-level direct-invoke key that AWS controls, and email content can never set a top-level event key. Proof: S3 is still fetched (the branch would have skipped it).""" raw_email = ( b"From: buyer@amazon.coupahost.com\r\n" b"To: po@seahavenind.com\r\n" b"Subject: FYI healthcheck notes\r\n" b"\r\n" b"Please run a healthcheck on this order. healthcheck healthcheck.\r\n" ) recording = _RecordingS3(raw_email) monkeypatch.setattr(po_handler, "s3", recording) monkeypatch.setattr(po_handler, "authenticate_inbound_email", lambda *a: True) # The synthetic body has no Coupa template match, so parsing would fall to # the Bedrock extractor; stub it (returning no po_number) so the record is # skipped cleanly. What matters here is only that S3 WAS fetched -- i.e. the # healthcheck branch did not short-circuit on the body text. monkeypatch.setattr(po_handler, "extract_with_claude", lambda *a: {}) result = po_handler.handler(_s3_event(), None) # Fell through to the Records loop (no early return): S3 WAS fetched. The # synthetic body has no PO number, so it is skipped -- return is the normal # 200 body, never the {"healthcheck": "ok"} smoke payload. assert result == {"statusCode": 200, "body": "OK"} assert recording.calls == [("po-ingest-emails-x", "inbound/hc")]