procurement-ingest/lambdas/wo/email_processor/tests/test_comment_id.py
Adam Moussa ff368beaa4
test: consolidate test roots — one loader, shared support, enforced CI floor (phase 8) (#118)
* test: consolidate test roots — one repo-root loader, shared support package, missing-scenario suites, enforced ruff/coverage floor (refactor phase 8)

tests/conftest.py only loads for the tests/ root, not a standalone
`pytest lambdas/po/email_processor/tests` run, so it could never carry
session invariants like the dummy AWS env or the moto stubber
registration. Add a single repo-root conftest.py (pytest.ini pins
rootdir there, so it loads for every invocation) that sets the dummy
AWS credentials/region, imports moto BEFORE any handler module so
boto3 sessions pick up its stubber hook (carrying the explanatory
comment verbatim from the old _po_parser_support.py), and exposes one
load_lambda_module(pipeline, name) — the sys.modules save/restore
dance stays, since template_parser is still a duplicated bare name
across pipelines needing per-exec sibling binding.

Add tests/support/ as the shared package both pipelines' local
_*_parser_support.py modules delegate to: a superset FakeTable (PO's
update_item recording + WO's put_item and keyed single-row store),
FakeDynamoResource, load_email, and load_golden with parse_float=Decimal
kept (load-bearing for exact money comparison at PO magnitudes — WO's
prior load_golden had no parse_float and must not regress PO by losing
it). Rewrite _wo_parser_support.py off the bare `import handler` /
`from handler import parse_raw_email` strategy that was the source of
the bare-name sys.modules collision the other two loaders defend
against.

Move test_po_merge.py and test_pad_zip.py into
lambdas/po/email_processor/tests/ (PO-specific, belongs beside the
code) via git mv so history follows; test_parse_raw_email.py and
test_ses_auth.py stay at the repo root since they're genuinely
cross-pipeline, parameterized over both handlers. Delete
tests/test_local.py: it globs a nonexistent samples/ dir, is WO-only,
and imports a handler at collection time, bypassing the loader gate
entirely — the golden suites already cover its role. Its pytest.ini
exclusion comment goes with it.

New scenario coverage, all built on the single loader + support
package:
- PO+WO Bedrock transport errors (ThrottlingException, missing
  'content' key, empty content list, non-JSON model text), asserting
  PO's pre-call ai_fallback metric survives with no partial write and
  the exception propagates; WO's no-datapoint-on-throttle behavior is
  pinned with a documenting test rather than "fixed" by reordering.
- Handler-level SES-auth reject seam per pipeline: no auth
  monkeypatch + empty ALLOWED_DKIM_DOMAINS asserts zero Bedrock calls,
  zero writes, no raise — closing the hole where deleting the gate
  line today still passes every test.
- web_ui coverage for both PO and WO (0% before this): fail-closed on
  unset ARN and on a Secrets Manager exception, TTL cache refresh,
  Bearer/X-Auth-Token/header-case-insensitivity, wrong-token 401 with
  no table scan, non-ASCII token, and a hostile-field-escaping
  regression lock. PO web_ui has no __init__.py, so these go through
  the loader rather than package imports.
- A moto-backed mirror of test_po_merge for WO merge semantics
  (table 'WorkOrders'): null-status never clobbers wo_status,
  created_at immutable via if_not_exists, status->wo_status mapping,
  None fields absent from SET, record_type only-when-present.
- Small pins: the PO-DC-02 64-char EMF clamp regression and
  per-pipeline multi-record failure-isolation (all-or-retry contract).
  The reprocess.py synthetic-event-shape contract test already landed
  in Phase 7, so it isn't duplicated here.

Two WO product-code fixes ride along, since this is the phase that
exercises them: (a) the invalid_status reason-code fix in
template_parser.py's status check, which previously returned
malformed_site_code for the same failure validate_ai_fallback already
labels invalid_status, making one failure surface two codes depending
on path (grepped the dashboards/metric filters for
malformed_site_code first — no external references found, safe to
diverge the two codes); (b) wrapping the WO Bedrock call in
handler.py so a transport failure emits ai_fallback/bedrock_error in
an except-and-reraise. This is deliberately not a naive reorder: the
emit sits in the except block, not pre-call, so a gate-rejected email
still emits only ai_fallback_rejected and wo_stack's "a rejected
email emits nothing else" alarm contract doesn't double-count. A test
computes the emitted series by hand to pin the no-double-count
behavior. Neither change touches the handler event/return contract.

_validate_new_po_values in the PO template_parser.py is split into
per-rule helpers, and the V4 anchor-frame dataclass now carries
summary_matches/price so V13 can consume them; extract_new_po
(C901=35) is included in the split. Add ruff.toml enabling C901/PLR
so the mccabe/complexity suppressions scattered through the tree stop
being decorative; derived_fields.py is under the shadow-bake freeze
so its violations are silenced via a per-file ignore with a
justification comment instead of an in-file edit, and the handful of
other pre-existing violations surfaced by turning the config on get
the same per-file-ignore treatment with a reason, or a fix where the
file isn't frozen. scripts/ is added to the CI lint scope.

CI gains an explicit --cov module list (lambdas/po and wo
email_processor + web_ui, po/site_extractor, lambdas/shared) plus
--cov-fail-under=80, since web_ui and site_extractor lack __init__.py
markers and a bare --cov=lambdas silently skips them for the missing
package marker; .coveragerc omits the test dirs themselves from the
count. The Phase 0 AST bundle-consistency test stays in the standard
pytest run. .gitignore picks up the resulting .coverage data file.

docs/po-template-parser.md gets a small correction: the EXTRACTION_PROMPT
declares quantity/price as "number or null", not JSON strings, so
parse_float=Decimal already handles a conforming Bedrock response —
the doc previously implied the coercion path was the primary
mechanism rather than a defensive net for non-conforming responses.

* test: lock attribute-context quote escaping in web_ui hostile-field test

The escaping regression lock asserted only the element-context vector
(raw <script> absent, &lt;script&gt; present) while its docstring claimed
quotes were covered -- the payload's " and ' were never asserted on, so
a quote-escaping regression on the onclick row-link sink (attribute
breakout -> event-handler injection) would have passed green.
/sh-security-review finding WC-01 (confirmed medium, test-integrity).

Add assertions that the onclick sink's JSON string renders its opening
quote as &quot; (raw " after window.location= fails), that the
payload's quote characters appear only entity-escaped, and that the
raw payload never appears anywhere in the body. Mutation-verified: the
test now fails when the sink's quote-escaping is dropped.

* test: address Open SWE review — xfail the web_ui non-ASCII auth pin, document subset coverage-floor override

- tests/test_web_ui_auth.py: replace the TypeError characterization pin with an
  xfail(strict, raises=TypeError) asserting the DESIRED fail-closed (False)
  behavior. Documents the intended fix and auto-fails (xpass) once web_ui_auth is
  corrected, instead of requiring a passing test to be knowingly deleted. The
  module stays frozen this phase; the underlying hmac.compare_digest ASCII-only
  defect is tracked as a follow-up.
- pytest.ini: document that the aggregate 80% floor (enforced in CI via the
  reusable workflow's bare pytest) red-exits local subset runs by design, with the
  --cov-fail-under=0 override for iteration. Floor stays in addopts because the
  centralized ci-python-sam workflow exposes no per-run test command.
2026-07-20 16:19:15 -04:00

174 lines
5.9 KiB
Python

"""Issue #23: comment_id (WorkOrderComments range key) must be unique per source
email AND byte-identical across Lambda async retries of the same S3 object, with
wall-clock now() kept OUT of the key.
Advisory A1: on the ai_fallback path the parsed comment_time is model output and
not retry-stable, so it must never enter the key -- the time segment derives
from the (deterministic) email Date header instead.
"""
from _wo_parser_support import ( # noqa: F401 (handler loads WO siblings)
wo_handler as handler,
wo_persistence as persistence,
)
DATE_HEADER = "Mon, 27 Apr 2026 23:57:49 +0000 (UTC)"
def _parsed(wo="11144580730", comment_time="2026-04-27T23:51:48"):
return {
"work_order_id": wo,
"email_type": "comment",
"commenter": "jdoe",
"comment_text": "a comment",
"comment_time": comment_time,
}
def _comment_ids(table):
return [item["comment_id"] for item in table.puts]
def test_same_object_key_retry_is_idempotent(fake_dynamo):
parsed = _parsed()
persistence.save_event(
parsed, "s3://bucket/inbound/obj-a", "inbound/obj-a", "template", DATE_HEADER
)
persistence.save_event(
parsed, "s3://bucket/inbound/obj-a", "inbound/obj-a", "template", DATE_HEADER
)
table = fake_dynamo.tables[persistence.COMMENTS_TABLE]
ids = _comment_ids(table)
# Two put_item calls with an identical key -> one logical row (overwrite).
assert ids[0] == ids[1]
assert len(table.store) == 1
def test_distinct_emails_same_wo_and_time_are_distinct_rows(fake_dynamo):
parsed = _parsed()
persistence.save_event(
parsed, "s3://bucket/inbound/obj-a", "inbound/obj-a", "template", DATE_HEADER
)
persistence.save_event(
parsed, "s3://bucket/inbound/obj-b", "inbound/obj-b", "template", DATE_HEADER
)
table = fake_dynamo.tables[persistence.COMMENTS_TABLE]
ids = _comment_ids(table)
assert ids[0] != ids[1]
assert len(table.store) == 2
def test_absent_comment_time_is_stable_across_retries(fake_dynamo):
parsed = _parsed(comment_time=None)
persistence.save_event(
parsed, "s3://bucket/inbound/obj-c", "inbound/obj-c", "template", DATE_HEADER
)
persistence.save_event(
parsed, "s3://bucket/inbound/obj-c", "inbound/obj-c", "template", DATE_HEADER
)
table = fake_dynamo.tables[persistence.COMMENTS_TABLE]
ids = _comment_ids(table)
assert ids[0] == ids[1] # 'nocomment' segment, not now()
assert "#nocomment#" in ids[0]
assert len(table.store) == 1
def test_event_id_independent_of_now(fake_dynamo, monkeypatch):
"""Freezing / advancing the clock must not change the range key."""
parsed = _parsed(comment_time=None)
class FrozenDT:
offset = 0
@classmethod
def now(cls, tz=None):
import datetime as _dt
return _dt.datetime(2020, 1, 1, tzinfo=tz) + _dt.timedelta(
seconds=cls.offset
)
monkeypatch.setattr(persistence, "datetime", FrozenDT)
persistence.save_event(
parsed, "s3://b/inbound/obj-d", "inbound/obj-d", "template", DATE_HEADER
)
FrozenDT.offset = 999999 # simulate a later retry
persistence.save_event(
parsed, "s3://b/inbound/obj-d", "inbound/obj-d", "template", DATE_HEADER
)
table = fake_dynamo.tables[persistence.COMMENTS_TABLE]
ids = _comment_ids(table)
assert ids[0] == ids[1]
# created_at (display) may differ, but the KEY must not.
assert len(table.store) == 1
def test_comment_id_format_shape(fake_dynamo):
parsed = _parsed()
persistence.save_event(
parsed, "s3://bucket/inbound/obj-e", "inbound/obj-e", "template", DATE_HEADER
)
table = fake_dynamo.tables[persistence.COMMENTS_TABLE]
cid = _comment_ids(table)[0]
wo, time_part, suffix = cid.split("#")
assert wo == "11144580730"
assert time_part == "2026-04-27T23:51:48"
assert len(suffix) == 12 and all(c in "0123456789abcdef" for c in suffix)
# --- Advisory A1: ai_fallback path ---
def test_ai_path_retry_with_drifted_comment_time_is_idempotent(fake_dynamo):
"""A retry where the model returns a DIFFERENT comment_time must still map
to the same range key (the model output never enters the key)."""
persistence.save_event(
_parsed(comment_time="2026-04-27T23:51:48"),
"s3://bucket/inbound/obj-f",
"inbound/obj-f",
"ai_fallback",
DATE_HEADER,
)
persistence.save_event(
_parsed(comment_time="2026-04-27T23:52:03"), # model drifted on retry
"s3://bucket/inbound/obj-f",
"inbound/obj-f",
"ai_fallback",
DATE_HEADER,
)
table = fake_dynamo.tables[persistence.COMMENTS_TABLE]
ids = _comment_ids(table)
assert ids[0] == ids[1]
assert len(table.store) == 1
def test_ai_path_key_uses_date_header_not_model_output(fake_dynamo):
persistence.save_event(
_parsed(),
"s3://bucket/inbound/obj-g",
"inbound/obj-g",
"ai_fallback",
DATE_HEADER,
)
table = fake_dynamo.tables[persistence.COMMENTS_TABLE]
cid = _comment_ids(table)[0]
_, time_part, _ = cid.split("#")
assert time_part == "2026-04-27T23:57:49+00:00" # Date header, UTC ISO
assert "23:51:48" not in cid # parsed comment_time kept out of the key
def test_ai_path_missing_date_header_falls_back_to_nocomment(fake_dynamo):
# 'Fri, 31 Dec 9999' parses but overflows on UTC conversion (OverflowError,
# not ValueError) -- _header_date_iso must swallow it, never raise.
for header in (None, "", "not a date", "Fri, 31 Dec 9999 23:59:59 -1400"):
persistence.save_event(
_parsed(),
"s3://bucket/inbound/obj-h",
"inbound/obj-h",
"ai_fallback",
header,
)
table = fake_dynamo.tables[persistence.COMMENTS_TABLE]
ids = _comment_ids(table)
assert all("#nocomment#" in cid for cid in ids)
assert len(set(ids)) == 1 # stable regardless of header garbage