mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-09-30 09:33:15 +00:00
30112cc680
Some checks are pending
Deploy / deploy (push) Waiting to run
Four modules move into the handbook-mandated lambdas/shared/ location, collapsing duplicated logic that had to be kept in sync by hand across the PO and WO pipelines: - ses_auth.py: the PO and WO copies were verified sha256-identical against the feature/phase-7-ops-recovery baseline before the move (no drift since the last audit). shared/ses_auth.py is the exact bytes of that one copy; both originals are git rm'd (the PO copy via rename, the WO copy as a straight delete). Bundling lands the module flat in /asset-output for both email processors, so the handlers keep `from ses_auth import authenticate_inbound_email` unchanged — zero handler diff for this move, which is what keeps fail-closed auth byte-identical through the change. - web_ui_auth.py: extracts the byte-identical _get_auth_token / _header / is_authenticated block plus the four token-cache globals out of both web_ui handlers. The per-stack INFRA-74 comments stay in each handler as-is (deliberately drifted wording, stack-specific) rather than being unified into the shared module. Fail-closed semantics (unset ARN or Secrets Manager exception -> deny) are unchanged. - email_parsing.py: parse_raw_email ships as the superset version that returns cc unconditionally. WO's output is bit-identical to before; PO simply ignores the cc field rather than being "cleaned up" to consume it. No second variant is kept. - emf.py: a generic emitter parameterized by namespace, dimension sets, and properties. Every call site's emitted EMF envelope is unchanged, including the load-bearing [["ParseMethod"],["ParseMethod","TemplateId"]] dimension-set shape the alarms and metric filters depend on. Emission ordering is untouched: PO still emits ai_fallback before the Bedrock call, WO still emits its mutually-exclusive ai_fallback/ai_fallback_rejected after its gate. The deliberate-double-count comments survive. _emit_derived_agreement_metric was found living inside derived_fields.py, so per the DERIVED-FIELDS exception it is left as a third, unconverted copy (derived_fields.py and the shadow DerivedFieldAgreement telemetry stay untouchable while that bake runs) — a comment there points at shared/emf.py for the eventual follow-up. Bundling: both email-processor cdk bundling commands gain a trailing `cp shared/*.py /asset-output/` (they were already cp-only post-Phase 7, so no pip step or manylinux pin is reintroduced). Both web_ui functions gain the same widened-root staging so web_ui_auth.py ships beside their handler; site_extractor's from_asset is untouched. Tests: PO_EXPECTED_TOP_LEVEL_MODULES gains the shared modules that now ship, the AST sibling-import check resolves imports whose source now lives under shared/, and the new shared cp line has its own revert/mutation detection. _SIBLING_MODULES resolution and _po_parser_support.py now load ses_auth/email_parsing/emf from shared/; the two-copy ses_auth byte-identity fixture-hygiene test is retired as obsolete now that there is one copy, and the ses_auth fixture parameterization over two identical copies is dropped. The sys.modules save/restore dance for template_parser (still duplicated per-pipeline) is left in place.
77 lines
2.6 KiB
Python
77 lines
2.6 KiB
Python
import hmac
|
|
import logging
|
|
import os
|
|
import time
|
|
|
|
import boto3
|
|
|
|
logger = logging.getLogger()
|
|
|
|
|
|
_WEB_UI_AUTH_TOKEN_SECRET_ARN = os.environ.get("WEB_UI_AUTH_TOKEN_SECRET_ARN")
|
|
# Refresh the cached token this often so a rotated secret propagates without
|
|
# waiting for the execution environment to recycle (emergency-rotation path).
|
|
_AUTH_TOKEN_CACHE_TTL_SECONDS = 300
|
|
_auth_token_cache = None
|
|
_auth_token_cached_at = 0.0
|
|
|
|
|
|
def _get_auth_token() -> str | None:
|
|
"""Fetch the shared web UI auth token from Secrets Manager.
|
|
|
|
Cached in the warm container for a short TTL so we don't hit Secrets Manager
|
|
on every request, while still picking up a rotated secret within the TTL
|
|
rather than only when the execution environment recycles. Returns None when
|
|
not configured or unreadable (the caller then fails closed).
|
|
"""
|
|
global _auth_token_cache, _auth_token_cached_at
|
|
now = time.monotonic()
|
|
if (
|
|
_auth_token_cache is not None
|
|
and now - _auth_token_cached_at < _AUTH_TOKEN_CACHE_TTL_SECONDS
|
|
):
|
|
return _auth_token_cache
|
|
if not _WEB_UI_AUTH_TOKEN_SECRET_ARN:
|
|
return None
|
|
secrets = boto3.client("secretsmanager")
|
|
try:
|
|
secret = secrets.get_secret_value(SecretId=_WEB_UI_AUTH_TOKEN_SECRET_ARN)
|
|
_auth_token_cache = secret["SecretString"]
|
|
_auth_token_cached_at = now
|
|
return _auth_token_cache
|
|
except Exception:
|
|
# Fail closed (return None -> caller 401s) but surface the failure: a
|
|
# Secrets Manager permission/config error would otherwise make every
|
|
# request 401 with no operational signal. The secret value is never
|
|
# logged.
|
|
logger.exception(
|
|
"Failed to fetch web UI auth token from Secrets Manager; "
|
|
"denying request (failing closed)"
|
|
)
|
|
return None
|
|
|
|
|
|
def _header(event: dict, name: str) -> str:
|
|
"""Case-insensitive header lookup from a Lambda Function URL / APIGW event."""
|
|
headers = event.get("headers") or {}
|
|
name_lower = name.lower()
|
|
for key, value in headers.items():
|
|
if key.lower() == name_lower:
|
|
return value or ""
|
|
return ""
|
|
|
|
|
|
def is_authenticated(event: dict) -> bool:
|
|
"""Constant-time check of the request's shared secret against the configured
|
|
token. Fails closed when no token is configured."""
|
|
token = _get_auth_token()
|
|
if not token:
|
|
return False
|
|
presented = _header(event, "x-auth-token")
|
|
if not presented:
|
|
auth = _header(event, "authorization")
|
|
if auth.lower().startswith("bearer "):
|
|
presented = auth[7:].strip()
|
|
if not presented:
|
|
return False
|
|
return hmac.compare_digest(presented, token)
|