seahaven-ap/README.md

# Sea Haven AP

Internal accounts payable automation for Sea Haven Industries. Local API is `http://127.0.0.1:8787`. Hosted origin on seahaven-dev is the CloudFront default domain after HCP apply; GitHub Environment `dev` deploys the placeholder and API image.

## Workspace layout

npm workspaces:

- `@seahaven-ap/web` — Vite/React SPA (repo root)
- `@seahaven-ap/shared` — payment ladder, invoice helpers, pay-date parsers, CSV constants ([`packages/shared`](packages/shared))
- `@seahaven-ap/api` — Hono API, Drizzle schema, auth/RBAC ([`packages/api`](packages/api))

## Local development

### Frontend (mocks)

```bash
npm ci
cp .env.example .env   # optional; defaults already use mocks
npm run dev
```

App serves at http://localhost:3000. `VITE_USE_MOCKS=true` is the default data path until AP-15 wires live API calls.

### API + data plane (AP-14)

```bash
docker compose up -d
cp .env.example .env
npm run db:migrate
npm run db:seed
npm run dev:api
```

API listens on http://127.0.0.1:8787. Vite proxies `/api` to that port.

Smoke:

```bash
curl -s http://127.0.0.1:8787/api/health
curl -s http://127.0.0.1:8787/api/me
```

`DEV_AUTH_BYPASS=true` is local-only and only allowed when `NODE_ENV` is `development` or `test` (rejected for production, staging, preview, and any other value). Cookie session names are `ap_*` locally and `__Host-ap_*` outside local.

API roles (source of truth): `admin`, `ap_processor`, `approver`, `viewer`. Frontend mocks still use `ap_operator` until AP-15 remaps them.

### OpenAPI / Redocly

Linting uses the same `redocly.yaml` ruleset as `procurement-ingest`.

```bash
npm run lint:api
npm run docs:preview   # builds HTML via redocly build-docs and opens it
```

## Hosted seahaven-dev

HCP Terraform workspace `seahaven-ap-dev` (project `seahaven-dev`) uses working directory `terraform` and a `terraform/**` VCS trigger on `main`. GitHub Environment `dev` holds `DEPLOY_ROLE_ARN` for `githubdeploy-seahaven-ap`.

The first apply creates secret `seahaven-ap/google-oidc` with `client_id` and `client_secret` set to `replace-me`. Replace both values in Secrets Manager, then re-run the HCP apply. A `terraform/**` change on `main` starts that apply. The Google IdP is not registered while the placeholder is still current.

- `.github/workflows/deploy-web.yaml` syncs `placeholder/` to the web bucket. It does not run `vite build`.
- `.github/workflows/deploy-api.yaml` builds the API image with `GIT_SHA`, registers the task definition from `/seahaven-ap/deploy/task-environment`, migrates, and checks `GET /api/health`.

Terraform `environment` is `dev` only. Prod hostname and GitHub Environment `prod` are AP-12.

## Verify

```bash
npm run verify
npm run test:e2e
python3 scripts/test-terraform-dev-only.py
bash scripts/test-verify-api-health.sh
```