mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-10-07 16:08:54 +00:00
Adam Moussa
5746de001e
Triaged all 29 Open SWE findings (6 posted + 23 below-threshold). Fixed the three genuine ones; the rest are refuted/unreachable/intentional (details replied on the PR). - #0/#22 (high): SHOC_WEBHOOK_URL now has NO hardcoded default. A dropped env var previously fell back to the dev endpoint and would ship prod work-order data there; deliver() now fails closed (retryable) on an unset/non-https URL. The CDK env var is the single source. - #9/#26 (high): capture record["dynamodb"]["SequenceNumber"] once, safely, before delivery. The catch-all exists so an exception can't re-deliver the whole batch — it must not itself KeyError on the subscript. A record without a SequenceNumber (unreachable for real streams) is logged + skipped. - #16/#17: bound the Secrets Manager + SQS client timeouts (botocore Config: 3s connect / 5s read / 2 retries) so a slow AWS call can't hang the invocation toward its 60s timeout and re-deliver the batch. Dismissed (confirmed sound): HMAC scope is contract-pinned + golden-vector shared (changing it is a breaking cross-party change); the replay script's hardcoded prod account is a deliberate fail-closed guard, and its required --url + dry-run-default + https-only are its intended operator-runbook design. 753 pytest / 85.7%, ruff, cdk synth green. No IAM/auth/Lambda-signature change, so the mandatory cross-family gates are unaffected. |
||
|---|---|---|
| .. | ||
| support | ||
| requirements.txt | ||
| test_api_handlers.py | ||
| test_api_pagination_moto.py | ||
| test_api_spec_drift.py | ||
| test_bundle_consistency.py | ||
| test_cross_account_principal_pin.py | ||
| test_handler_auth_seam.py | ||
| test_parse_raw_email.py | ||
| test_replay_shoc_webhooks_contract.py | ||
| test_reprocess_contract.py | ||
| test_ses_auth.py | ||
| test_shoc_emitter_delivery.py | ||
| test_shoc_emitter_envelope.py | ||
| test_shoc_emitter_handler.py | ||
| test_shoc_hmac_rotator.py | ||
| test_web_ui_auth.py | ||
| test_web_ui_handlers.py | ||