mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-09-30 13:03:14 +00:00
Adam Moussa
2f2fc83a82
GPT-4.1 cross-family review of the policy surface (no BLOCK): FIX applied to the cross-account shoc-backend-dev Decrypt statement and both Lambda role KMS grants (the key is only ever used via Secrets Manager); its invariant-enforcement QUESTION answered durably with tests/test_cross_account_principal_pin.py (any new foreign IAM principal in cdk/ fails CI). Scanner mediums fixed: delivery.py and the replay script now refuse non-https URLs (urllib follows file:// and http://). SQS metadata-action and dynamodb:ListStreams NITs skipped: standard CDK grant shapes; ListStreams has no resource-level scoping. The 4 gitleaks HIGHs on docs/shoc-webhook-test-vectors.json are deliberate non-secrets (shared receiver-verification vectors) suppressed machine-level with justification. |
||
|---|---|---|
| .. | ||
| support | ||
| requirements.txt | ||
| test_api_handlers.py | ||
| test_api_pagination_moto.py | ||
| test_api_spec_drift.py | ||
| test_bundle_consistency.py | ||
| test_cross_account_principal_pin.py | ||
| test_handler_auth_seam.py | ||
| test_parse_raw_email.py | ||
| test_replay_shoc_webhooks_contract.py | ||
| test_reprocess_contract.py | ||
| test_ses_auth.py | ||
| test_shoc_emitter_delivery.py | ||
| test_shoc_emitter_envelope.py | ||
| test_shoc_emitter_handler.py | ||
| test_shoc_hmac_rotator.py | ||
| test_web_ui_auth.py | ||
| test_web_ui_handlers.py | ||