mirror of
https://github.com/Sea-Haven-Industries/procurement-ingest.git
synced 2026-10-07 16:08:54 +00:00
Adam Moussa
ffa8a625a7
/sh-security-review of PR #105 (5 fresh-context detectors + proof-or-kill verifier) confirmed two diff-introduced findings; both fixed here. F3 (medium, real PII in new fixtures): the harvest scrub replaced header tokens but left real third-party PII in message BODIES -- an Amazon contact's name/phone/personal email in non-coupa-02.eml and an internal t.corp.amazon.com ticket URL in comment-02.eml, plus real submitter/attn names recurring across the new_po corpus. Replaced every personal name, phone, personal email, and internal URL with synthetic placeholders (QP-soft-wrap aware) across both .eml bodies and expected goldens. Extended test_fixture_hygiene to scan BODIES (phone shapes, corp URLs, the leaked tokens), closing the header-only gap that let this through. F1 (medium, cancellation gate): _CANCELLATION_SUBJECT was unanchored and matched with .search(), unlike the anchored new_po pattern -- a subject merely ending with the cancellation phrase could be routed to the sticky- Cancelled write. Fully anchored it and switched to .match, and added a body-corroboration gate (the real Coupa body independently restates 'Purchase Order #<po> ... has been cancelled'); a near-miss/misrouted subject whose body does not corroborate now fails closed to the LLM (new reason code cancellation_body_unconfirmed). Pre-existing (advisory, not this PR): the LLM-fallback else->save_new_po dispatch and undelimited extraction prompt (issue #101 family) are byte-identical to main and unchanged here. 401 tests pass; ruff/format clean; cdk synth po-ingest clean.
49 lines
1.5 KiB
JSON
49 lines
1.5 KiB
JSON
{
|
|
"email_type": "new_po",
|
|
"po_number": "2D-19081183",
|
|
"po_status": "Issued - Created",
|
|
"source_system": "coupa",
|
|
"submitted_by": "Alex Fixtly",
|
|
"on_behalf_of": "Alex Fixtly",
|
|
"order_date": "04/22/26",
|
|
"revision_date": "04/22/26",
|
|
"last_opened": null,
|
|
"acknowledged_at": null,
|
|
"payment_terms": "90 NET",
|
|
"requisition_number": "12380835",
|
|
"department": null,
|
|
"view_order_url": "https://supplier.coupahost.com/orders/19081183?instance_url=https%3A%2F%2Famazon.coupahost.com%2F&supplier_id=485015&",
|
|
"supplier": {
|
|
"name": "SEA HAVEN INDUSTRIES:CORPORATE AP:SERVICES(OK6HE)"
|
|
},
|
|
"site_code": null,
|
|
"ship_to": {
|
|
"name": "Amazon.com Services LLC (ORH5)",
|
|
"address": "Amazon.com Services LLC (ORH5)\n515 Douglas St\nUxbridge, MA 01569\nUnited States",
|
|
"street": "515 Douglas St",
|
|
"city": "Uxbridge",
|
|
"state": "MA",
|
|
"zip": "01569",
|
|
"location_code": "947104437",
|
|
"attn": "Alex Fixtly"
|
|
},
|
|
"total_amount": 1270.0,
|
|
"currency": "USD",
|
|
"fiscal_year": null,
|
|
"trade": null,
|
|
"coupa_category": "Maintenance - Equipment",
|
|
"line_items": [
|
|
{
|
|
"description": "ISOLATE AND DRAIN THE WATER SYSTEM, REPLACE THE VALVE AND INSTALL THE SHOWER HANDLE, THEN RESTORE WATER, CHECK FOR LEAKS, AND VERIFY PROPER OPERATION.",
|
|
"amount": 1270.0,
|
|
"currency": "USD",
|
|
"need_by": "06/30/26",
|
|
"category": "Maintenance - Equipment",
|
|
"account_code": "1D-3G96-9963-76270-0000-0000-0000-0000",
|
|
"period": "2D Standard COA (2026)",
|
|
"quantity": 1.0,
|
|
"unit": "EACH",
|
|
"price": 1270.0
|
|
}
|
|
]
|
|
}
|