mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-09-30 14:13:13 +00:00
f67d8b9907
Some checks are pending
Deploy / deploy (push) Waiting to run
* feat(api): add procurement-api stack - read API + OpenAPI docs page Third CDK stack: API Gateway REST API (IAM SigV4) over both pipelines' tables, replacing SHOC's retired SyncController cross-account DynamoDB scan as the reconciliation/backfill path. - lambdas/api/: handler (healthcheck + docs-token gate + router dispatch), router (single route table), pagination (opaque cursor, hostile -> 400), Decimal-safe serialization, wo_repo/po_repo reads. No VendorReplies. - OpenAPI 3.1 spec as source of truth incl. top-level webhooks section documenting the outbound SHOC feed; phase-2 write endpoints x-planned (router answers 501). Self-contained /docs page, no CDN. - Auth: AWS_IAM on data routes + resource policy scoped to exactly arn:aws:iam::396287094661:role/shoc-backend-dev on GET/*; /docs and /openapi.json carve-out is token-gated in the Lambda via shared web_ui_auth (fail-closed, INFRA-74 posture). - KMS: explicit Decrypt/DescribeKey on the DynamoDB CMK from SSM (name-imported table drops the key association - INFRA-104 class). - Alarms: errors/throttles/duration(p99>=22.5s) + gateway 5xx, ALARM-only to site-alerts. No access logging in v1 (docs ?token= shim stays out of logs); cloud_watch_role=False. - Tests: handler auth-seam + routing + Decimal round-trip; moto cursor pagination incl. hostile cursors; spec<->router drift gate; bundle AST pins for the api command; pytest.ini --cov + loader siblings. - Deploy role: third stack DescribeStacks ARN + procurement-api smoke invoke ARN (re-run create-deploy-role.sh before merge). * harden(api): apply sh-security-review findings to procurement-api Fan-out (6 detectors) + review findings resolved: Correctness / DoS: - pagination: require EXACT key-set match (was subset) so a partial/foreign composite cursor can't reach DynamoDB as an inconsistent ExclusiveStartKey -> ValidationException -> 500; comments Query now pins the cursor's work_order_id to the path entity. - handler: map botocore ValidationException to 400 (defense in depth) so a crafted cursor can't drive the zero-threshold 5xx alarm. - web_ui_auth: compare tokens as bytes; a non-ASCII presented token now fails closed (401) instead of crashing hmac.compare_digest into a 500. Resolves the pre-existing xfail(strict) follow-up test; hardens the web UIs too. Docs page: - typeStr() now escapes the one spec-derived string that reached innerHTML. - spec inlined into the docs <script> block escapes "<" -> < (</script> breakout guard); /openapi.json still served byte-faithful. - Cache-Control: no-store + Referrer-Policy: no-referrer on docs responses so the ?token= URL stays out of caches/Referer. - spec-drift test asserts the committed spec carries no "</" / "<!--". IAM / IaC: - resource policy enumerates the 7 data GET resources instead of GET/* so a future GET route can't silently inherit SHOC cross-account reach. - kms:Decrypt grant gains a kms:ViaService=dynamodb condition. - stage throttling (50 rps / 100 burst) bounds the unauthenticated /docs blast radius below the 10k account default. - corrected the PATCH/POST comment (same-account callers aren't blocked by the resource policy; 501 handler + absent write grant are the gate). - documented the RETAIN log-group first-deploy rollback trap and the resource-policy-needs-redeploy gotcha in-stack. Mandatory GPT-4.1 cross-family review of the full policy surface: no BLOCK/FIX. 675 tests pass, ruff clean, cdk synth green.
62 lines
2.2 KiB
Python
62 lines
2.2 KiB
Python
"""Read access to the work-order tables for the procurement API.
|
|
|
|
Listing is a cursor-paginated Scan -- deliberately: the WO tables carry no
|
|
GSIs (removed 2026-06-03 for zero reads), and the API's list consumers
|
|
(SHOC reconciliation/backfill) walk the full table anyway, which is exactly
|
|
the access pattern SHOC's retired SyncController used. Listings are therefore
|
|
UNORDERED across pages; per-work-order comment listing is a cheap Query on
|
|
the partition key.
|
|
"""
|
|
|
|
import os
|
|
|
|
import boto3
|
|
from boto3.dynamodb.conditions import Key
|
|
|
|
from pagination import BadCursor, decode_cursor, encode_cursor
|
|
|
|
dynamodb = boto3.resource("dynamodb")
|
|
|
|
WORK_ORDERS_TABLE = os.environ.get("WORK_ORDERS_TABLE", "WorkOrders")
|
|
COMMENTS_TABLE = os.environ.get("COMMENTS_TABLE", "WorkOrderComments")
|
|
|
|
WO_KEY_ATTRS = frozenset({"work_order_id"})
|
|
COMMENT_KEY_ATTRS = frozenset({"work_order_id", "comment_id"})
|
|
|
|
|
|
def _page(response) -> tuple[list, str | None]:
|
|
items = response.get("Items", [])
|
|
lek = response.get("LastEvaluatedKey")
|
|
return items, (encode_cursor(lek) if lek else None)
|
|
|
|
|
|
def list_work_orders(limit: int, cursor: str | None) -> tuple[list, str | None]:
|
|
table = dynamodb.Table(WORK_ORDERS_TABLE)
|
|
kwargs = {"Limit": limit}
|
|
if cursor:
|
|
kwargs["ExclusiveStartKey"] = decode_cursor(cursor, WO_KEY_ATTRS)
|
|
return _page(table.scan(**kwargs))
|
|
|
|
|
|
def get_work_order(work_order_id: str) -> dict | None:
|
|
table = dynamodb.Table(WORK_ORDERS_TABLE)
|
|
return table.get_item(Key={"work_order_id": work_order_id}).get("Item")
|
|
|
|
|
|
def list_comments(
|
|
work_order_id: str, limit: int, cursor: str | None
|
|
) -> tuple[list, str | None]:
|
|
table = dynamodb.Table(COMMENTS_TABLE)
|
|
kwargs = {
|
|
"KeyConditionExpression": Key("work_order_id").eq(work_order_id),
|
|
"Limit": limit,
|
|
}
|
|
if cursor:
|
|
start_key = decode_cursor(cursor, COMMENT_KEY_ATTRS)
|
|
# Pin the cursor's partition to the path entity: a cursor minted for
|
|
# WO A must never resume WO B's Query (DynamoDB would reject the
|
|
# partition mismatch as a 500; reject it as a 400 here instead).
|
|
if start_key["work_order_id"] != work_order_id:
|
|
raise BadCursor("cursor is not valid")
|
|
kwargs["ExclusiveStartKey"] = start_key
|
|
return _page(table.query(**kwargs))
|