mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-10-07 16:08:54 +00:00
Adam Moussa
2c2cfcc538
The web UI auth gate correctly fails closed when the shared token cannot be read, but _get_auth_token() swallowed every exception silently. A Secrets Manager permission or config error then made every request 401 with no operational signal, leaving an outage indistinguishable from ordinary unauthenticated traffic. Add a module-level logger to both web_ui handlers and log the fetch failure with logger.exception() in the except block before returning None. Behavior is unchanged (still fails closed); the failure is now visible in CloudWatch. The secret value is never logged. The two handlers stay byte-consistent in the mirrored _get_auth_token() region. The companion finding on the CDK import of the shared procurement-ingest/web-ui-auth-token secret was evaluated and left as-is: the token is a single secret shared by both the PO and WO stacks, so from_secret_name_v2 (which scopes grant_read via the standard 6-char suffix wildcard) is correct; making it a CDK-managed Secret in both stacks would collide the two stacks on the same explicit secret name at deploy time. Refs: INFRA-74
368 lines
15 KiB
Python
368 lines
15 KiB
Python
"""
|
|
Web UI Lambda.
|
|
|
|
Serves a simple HTML dashboard for viewing purchase orders.
|
|
Accessed via Lambda Function URL.
|
|
"""
|
|
|
|
import hmac
|
|
import json
|
|
import logging
|
|
import os
|
|
import time
|
|
from decimal import Decimal
|
|
from html import escape as esc
|
|
|
|
import boto3
|
|
|
|
logger = logging.getLogger()
|
|
logger.setLevel(logging.INFO)
|
|
|
|
dynamodb = boto3.resource("dynamodb")
|
|
|
|
PO_TABLE = os.environ.get("PO_TABLE", "purchase-orders")
|
|
|
|
# Defense-in-depth auth gate. The public Function URL was removed (INFRA-74), but
|
|
# the handler must still refuse unauthenticated requests so any future invocation
|
|
# path (re-attached Function URL, API Gateway, etc.) does not re-expose the whole
|
|
# PO DB. Callers must present the shared secret in the X-Auth-Token header (or
|
|
# Authorization: Bearer <token>). The secret is fetched at runtime from Secrets
|
|
# Manager to keep it out of CloudFormation templates and Lambda env vars. If the
|
|
# ARN is unset or the secret is missing, the handler fails closed and denies every
|
|
# request.
|
|
_WEB_UI_AUTH_TOKEN_SECRET_ARN = os.environ.get("WEB_UI_AUTH_TOKEN_SECRET_ARN")
|
|
# Refresh the cached token this often so a rotated secret propagates without
|
|
# waiting for the execution environment to recycle (emergency-rotation path).
|
|
_AUTH_TOKEN_CACHE_TTL_SECONDS = 300
|
|
_auth_token_cache = None
|
|
_auth_token_cached_at = 0.0
|
|
|
|
|
|
def _get_auth_token() -> str | None:
|
|
"""Fetch the shared web UI auth token from Secrets Manager.
|
|
|
|
Cached in the warm container for a short TTL so we don't hit Secrets Manager
|
|
on every request, while still picking up a rotated secret within the TTL
|
|
rather than only when the execution environment recycles. Returns None when
|
|
not configured or unreadable (the caller then fails closed).
|
|
"""
|
|
global _auth_token_cache, _auth_token_cached_at
|
|
now = time.monotonic()
|
|
if (
|
|
_auth_token_cache is not None
|
|
and now - _auth_token_cached_at < _AUTH_TOKEN_CACHE_TTL_SECONDS
|
|
):
|
|
return _auth_token_cache
|
|
if not _WEB_UI_AUTH_TOKEN_SECRET_ARN:
|
|
return None
|
|
secrets = boto3.client("secretsmanager")
|
|
try:
|
|
secret = secrets.get_secret_value(SecretId=_WEB_UI_AUTH_TOKEN_SECRET_ARN)
|
|
_auth_token_cache = secret["SecretString"]
|
|
_auth_token_cached_at = now
|
|
return _auth_token_cache
|
|
except Exception:
|
|
# Fail closed (return None -> caller 401s) but surface the failure: a
|
|
# Secrets Manager permission/config error would otherwise make every
|
|
# request 401 with no operational signal. The secret value is never
|
|
# logged.
|
|
logger.exception(
|
|
"Failed to fetch web UI auth token from Secrets Manager; "
|
|
"denying request (failing closed)"
|
|
)
|
|
return None
|
|
|
|
|
|
def _header(event: dict, name: str) -> str:
|
|
"""Case-insensitive header lookup from a Lambda Function URL / APIGW event."""
|
|
headers = event.get("headers") or {}
|
|
name_lower = name.lower()
|
|
for key, value in headers.items():
|
|
if key.lower() == name_lower:
|
|
return value or ""
|
|
return ""
|
|
|
|
|
|
def is_authenticated(event: dict) -> bool:
|
|
"""Constant-time check of the request's shared secret against the configured
|
|
token. Fails closed when no token is configured."""
|
|
token = _get_auth_token()
|
|
if not token:
|
|
return False
|
|
presented = _header(event, "x-auth-token")
|
|
if not presented:
|
|
auth = _header(event, "authorization")
|
|
if auth.lower().startswith("bearer "):
|
|
presented = auth[7:].strip()
|
|
if not presented:
|
|
return False
|
|
return hmac.compare_digest(presented, token)
|
|
|
|
|
|
def get_purchase_orders(limit=500):
|
|
table = dynamodb.Table(PO_TABLE)
|
|
items = []
|
|
response = table.scan()
|
|
items.extend(response.get("Items", []))
|
|
while "LastEvaluatedKey" in response:
|
|
response = table.scan(ExclusiveStartKey=response["LastEvaluatedKey"])
|
|
items.extend(response.get("Items", []))
|
|
items.sort(key=lambda x: x.get("processed_at", ""), reverse=True)
|
|
return items[:limit]
|
|
|
|
|
|
def render_badge(value, color_map):
|
|
if not value:
|
|
value = "unknown"
|
|
color = color_map.get(value.lower(), "#9ca3af")
|
|
label = esc(value.replace("_", " ").title())
|
|
return f'<span style="background:{color};color:#fff;padding:2px 10px;border-radius:12px;font-size:12px;font-weight:500;">{label}</span>'
|
|
|
|
|
|
STATUS_COLORS = {
|
|
"issued": "#3b82f6",
|
|
"pending buyer action": "#f59e0b",
|
|
"open": "#3b82f6",
|
|
"closed": "#10b981",
|
|
"cancelled": "#ef4444",
|
|
"soft closed": "#6b7280",
|
|
}
|
|
|
|
EMAIL_TYPE_COLORS = {
|
|
"new_po": "#3b82f6",
|
|
"revision": "#f59e0b",
|
|
"cancellation": "#ef4444",
|
|
}
|
|
|
|
|
|
def fmt_currency(val):
|
|
if val is None:
|
|
return ""
|
|
if isinstance(val, Decimal):
|
|
val = float(val)
|
|
if isinstance(val, (int, float)):
|
|
return f"${val:,.2f}"
|
|
# Non-numeric fallback: a prompt-injected email can make Claude return
|
|
# total_amount/amount as an arbitrary string. Escape it before it is
|
|
# interpolated raw into the HTML to prevent stored XSS.
|
|
return esc(str(val))
|
|
|
|
|
|
def render_po_detail(po):
|
|
po_number = esc(po.get("po_number", ""))
|
|
|
|
fields = [
|
|
("PO Number", po_number),
|
|
("Status", render_badge(po.get("po_status", ""), STATUS_COLORS)),
|
|
("Email Type", render_badge(po.get("email_type", ""), EMAIL_TYPE_COLORS)),
|
|
("Total Amount", fmt_currency(po.get("total_amount"))),
|
|
("Currency", esc(po.get("currency", "")) or None),
|
|
("Supplier", esc((po.get("supplier") or {}).get("name") or "") or None),
|
|
("Site Code", esc(po.get("site_code", "")) or None),
|
|
("State", esc(po.get("state", "")) or None),
|
|
("Trade", esc(po.get("trade", "")) or None),
|
|
("Fiscal Year", esc(po.get("fiscal_year", "")) or None),
|
|
("Coupa Category", esc(po.get("coupa_category", "")) or None),
|
|
("Submitted By", esc(po.get("submitted_by", "")) or None),
|
|
("On Behalf Of", esc(po.get("on_behalf_of", "")) or None),
|
|
("Order Date", esc(po.get("order_date", "")) or None),
|
|
("Revision Date", esc(po.get("revision_date", "")) or None),
|
|
("Payment Terms", esc(po.get("payment_terms", "")) or None),
|
|
("Requisition #", esc(po.get("requisition_number", "")) or None),
|
|
("Department", esc(po.get("department", "")) or None),
|
|
("Data Source", esc(po.get("data_source", "")) or None),
|
|
("Processed At", esc(po.get("processed_at", "")) or None),
|
|
]
|
|
|
|
ship_to = po.get("ship_to") or {}
|
|
if any(ship_to.values()):
|
|
ship_parts = []
|
|
if ship_to.get("name"):
|
|
ship_parts.append(esc(ship_to["name"]))
|
|
if ship_to.get("address"):
|
|
ship_parts.append(esc(ship_to["address"]))
|
|
if ship_to.get("location_code"):
|
|
ship_parts.append(f"Location: {esc(ship_to['location_code'])}")
|
|
if ship_to.get("attn"):
|
|
ship_parts.append(f"Attn: {esc(ship_to['attn'])}")
|
|
fields.append(("Ship To", "<br>".join(ship_parts)))
|
|
|
|
view_url = po.get("view_order_url")
|
|
if view_url and view_url.startswith(("https://", "http://")):
|
|
escaped_url = esc(view_url, quote=True)
|
|
fields.append(
|
|
(
|
|
"Coupa Link",
|
|
f'<a href="{escaped_url}" target="_blank" style="color:#3b82f6;">View in Coupa</a>',
|
|
)
|
|
)
|
|
|
|
details_html = ""
|
|
for label, value in fields:
|
|
if value:
|
|
details_html += f"""
|
|
<div style="display:flex;padding:8px 0;border-bottom:1px solid #f1f5f9;">
|
|
<div style="width:140px;font-size:13px;color:#64748b;font-weight:500;">{label}</div>
|
|
<div style="flex:1;font-size:14px;color:#1e293b;">{value}</div>
|
|
</div>"""
|
|
|
|
# Line items
|
|
line_items = po.get("line_items") or []
|
|
items_html = ""
|
|
if line_items:
|
|
rows = ""
|
|
for item in line_items:
|
|
qty = esc(str(item.get("quantity", "") or ""))
|
|
unit = esc(str(item.get("unit", "") or ""))
|
|
price = esc(str(item.get("price", "") or ""))
|
|
rows += f"""
|
|
<tr style="border-bottom:1px solid #f1f5f9;">
|
|
<td style="padding:10px;font-size:14px;">{esc(str(item.get("description", "")))}</td>
|
|
<td style="padding:10px;font-size:13px;text-align:right;">{qty}</td>
|
|
<td style="padding:10px;font-size:13px;">{unit}</td>
|
|
<td style="padding:10px;font-size:13px;text-align:right;">{price}</td>
|
|
<td style="padding:10px;font-size:14px;text-align:right;">{fmt_currency(item.get("amount"))}</td>
|
|
<td style="padding:10px;font-size:13px;color:#64748b;">{esc(str(item.get("need_by", "") or ""))}</td>
|
|
</tr>"""
|
|
|
|
items_html = f"""
|
|
<div style="background:#fff;border-radius:10px;padding:24px;box-shadow:0 1px 3px rgba(0,0,0,0.08);">
|
|
<h2 style="font-size:16px;margin-bottom:16px;">Line Items ({len(line_items)})</h2>
|
|
<table style="width:100%;border-collapse:collapse;">
|
|
<thead>
|
|
<tr>
|
|
<th style="text-align:left;padding:10px;font-size:12px;text-transform:uppercase;color:#64748b;border-bottom:2px solid #e2e8f0;">Description</th>
|
|
<th style="text-align:right;padding:10px;font-size:12px;text-transform:uppercase;color:#64748b;border-bottom:2px solid #e2e8f0;">Qty</th>
|
|
<th style="text-align:left;padding:10px;font-size:12px;text-transform:uppercase;color:#64748b;border-bottom:2px solid #e2e8f0;">Unit</th>
|
|
<th style="text-align:right;padding:10px;font-size:12px;text-transform:uppercase;color:#64748b;border-bottom:2px solid #e2e8f0;">Price</th>
|
|
<th style="text-align:right;padding:10px;font-size:12px;text-transform:uppercase;color:#64748b;border-bottom:2px solid #e2e8f0;">Amount</th>
|
|
<th style="text-align:left;padding:10px;font-size:12px;text-transform:uppercase;color:#64748b;border-bottom:2px solid #e2e8f0;">Need By</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>{rows}</tbody>
|
|
</table>
|
|
</div>"""
|
|
|
|
return f"""<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>PO {po_number} - Sea Haven</title>
|
|
<style>
|
|
* {{ margin: 0; padding: 0; box-sizing: border-box; }}
|
|
body {{ font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: #f1f5f9; color: #1e293b; }}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div style="max-width:800px;margin:0 auto;padding:20px;">
|
|
<div style="margin-bottom:20px;">
|
|
<a href="/" style="color:#3b82f6;text-decoration:none;font-size:14px;">← All Purchase Orders</a>
|
|
</div>
|
|
<div style="background:#fff;border-radius:10px;padding:24px;box-shadow:0 1px 3px rgba(0,0,0,0.08);margin-bottom:20px;">
|
|
<h1 style="font-size:20px;margin-bottom:16px;">Purchase Order {po_number}</h1>
|
|
{details_html}
|
|
</div>
|
|
{items_html}
|
|
</div>
|
|
</body>
|
|
</html>"""
|
|
|
|
|
|
def render_po_list(purchase_orders):
|
|
rows = ""
|
|
for po in purchase_orders:
|
|
po_number = esc(po.get("po_number", ""))
|
|
supplier = esc((po.get("supplier") or {}).get("name", ""))
|
|
site_code = esc(po.get("site_code", ""))
|
|
trade = esc(po.get("trade", ""))
|
|
status = po.get("po_status", "")
|
|
total = fmt_currency(po.get("total_amount"))
|
|
processed = esc((po.get("processed_at") or "")[:16])
|
|
|
|
rows += f"""
|
|
<tr style="border-bottom:1px solid #f1f5f9;cursor:pointer;" onclick="window.location={esc(json.dumps(f"/po?id={po.get("po_number", "")}"), quote=True)}">
|
|
<td style="padding:12px;font-weight:500;color:#3b82f6;">{po_number}</td>
|
|
<td style="padding:12px;">{supplier}</td>
|
|
<td style="padding:12px;font-weight:500;">{site_code}</td>
|
|
<td style="padding:12px;font-size:13px;">{trade}</td>
|
|
<td style="padding:12px;">{render_badge(status, STATUS_COLORS)}</td>
|
|
<td style="padding:12px;text-align:right;">{total}</td>
|
|
<td style="padding:12px;color:#64748b;font-size:13px;">{processed}</td>
|
|
</tr>"""
|
|
|
|
return f"""<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Purchase Orders - Sea Haven</title>
|
|
<style>
|
|
* {{ margin: 0; padding: 0; box-sizing: border-box; }}
|
|
body {{ font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: #f1f5f9; color: #1e293b; }}
|
|
table {{ width: 100%; border-collapse: collapse; }}
|
|
tr:hover {{ background: #f8fafc; }}
|
|
th {{ text-align: left; padding: 12px; font-size: 12px; text-transform: uppercase; color: #64748b; border-bottom: 2px solid #e2e8f0; }}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div style="max-width:1100px;margin:0 auto;padding:20px;">
|
|
<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:20px;">
|
|
<h1 style="font-size:22px;">Purchase Orders</h1>
|
|
<span style="color:#64748b;font-size:14px;">{len(purchase_orders)} most recent</span>
|
|
</div>
|
|
<div style="background:#fff;border-radius:10px;box-shadow:0 1px 3px rgba(0,0,0,0.08);overflow:hidden;">
|
|
<table>
|
|
<thead>
|
|
<tr>
|
|
<th>PO #</th>
|
|
<th>Supplier</th>
|
|
<th>Site</th>
|
|
<th>Trade</th>
|
|
<th>Status</th>
|
|
<th style="text-align:right;">Amount</th>
|
|
<th>Processed</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{rows if rows else '<tr><td colspan="7" style="padding:40px;text-align:center;color:#94a3b8;">No purchase orders yet.</td></tr>'}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html>"""
|
|
|
|
|
|
def handler(event, context):
|
|
if not is_authenticated(event):
|
|
return {
|
|
"statusCode": 401,
|
|
"headers": {"Content-Type": "text/html"},
|
|
"body": "<h1>401 Unauthorized</h1>",
|
|
}
|
|
|
|
path = event.get("rawPath", "/")
|
|
qs = event.get("queryStringParameters") or {}
|
|
|
|
if path == "/po" and "id" in qs:
|
|
po_number = qs["id"]
|
|
table = dynamodb.Table(PO_TABLE)
|
|
result = table.get_item(Key={"po_number": po_number})
|
|
po = result.get("Item")
|
|
if not po:
|
|
return {
|
|
"statusCode": 404,
|
|
"headers": {"Content-Type": "text/html"},
|
|
"body": "<h1>Purchase order not found</h1>",
|
|
}
|
|
html = render_po_detail(po)
|
|
else:
|
|
purchase_orders = get_purchase_orders()
|
|
html = render_po_list(purchase_orders)
|
|
|
|
return {
|
|
"statusCode": 200,
|
|
"headers": {"Content-Type": "text/html"},
|
|
"body": html,
|
|
}
|