mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-10-07 16:08:54 +00:00
Adam Moussa
5746de001e
Triaged all 29 Open SWE findings (6 posted + 23 below-threshold). Fixed the three genuine ones; the rest are refuted/unreachable/intentional (details replied on the PR). - #0/#22 (high): SHOC_WEBHOOK_URL now has NO hardcoded default. A dropped env var previously fell back to the dev endpoint and would ship prod work-order data there; deliver() now fails closed (retryable) on an unset/non-https URL. The CDK env var is the single source. - #9/#26 (high): capture record["dynamodb"]["SequenceNumber"] once, safely, before delivery. The catch-all exists so an exception can't re-deliver the whole batch — it must not itself KeyError on the subscript. A record without a SequenceNumber (unreachable for real streams) is logged + skipped. - #16/#17: bound the Secrets Manager + SQS client timeouts (botocore Config: 3s connect / 5s read / 2 retries) so a slow AWS call can't hang the invocation toward its 60s timeout and re-deliver the batch. Dismissed (confirmed sound): HMAC scope is contract-pinned + golden-vector shared (changing it is a breaking cross-party change); the replay script's hardcoded prod account is a deliberate fail-closed guard, and its required --url + dry-run-default + https-only are its intended operator-runbook design. 753 pytest / 85.7%, ruff, cdk synth green. No IAM/auth/Lambda-signature change, so the mandatory cross-family gates are unaffected. |
||
|---|---|---|
| .. | ||
| api | ||
| po | ||
| shared | ||
| wo | ||