seahaven-ap/README.md

# Sea Haven AP

Internal accounts payable automation for Sea Haven Industries. Local API is `http://127.0.0.1:8787`. Hosted origin on seahaven-dev is the CloudFront default domain after HCP apply; GitHub Environment `dev` deploys the placeholder and API image.

## Workspace layout

npm workspaces:

- `@seahaven-ap/web` — Vite/React SPA (repo root)
- `@seahaven-ap/shared` — payment ladder, invoice helpers, pay-date parsers, CSV constants ([`packages/shared`](packages/shared))
- `@seahaven-ap/api` — Hono API, Drizzle schema, auth/RBAC ([`packages/api`](packages/api))

## Local development

### Frontend (mocks)

```bash
npm ci
cp .env.example .env   # optional; defaults already use mocks
npm run dev
```

App serves at http://localhost:3000. `VITE_USE_MOCKS=true` is the default data path until AP-15 wires live API calls.

### API + data plane (AP-14)

```bash
docker compose up -d
cp .env.example .env
npm run db:migrate
npm run db:seed
npm run dev:api
```

API listens on http://127.0.0.1:8787. Vite proxies `/api` to that port.

Smoke:

```bash
curl -s http://127.0.0.1:8787/api/health
curl -s http://127.0.0.1:8787/api/me
```

`DEV_AUTH_BYPASS=true` is local-only and only allowed when `NODE_ENV` is `development` or `test` (rejected for production, staging, preview, and any other value). Cookie session names are `ap_*` locally and `__Host-ap_*` outside local.

API roles (source of truth): `admin`, `ap_processor`, `approver`, `viewer`. Frontend mocks still use `ap_operator` until AP-15 remaps them.

### OpenAPI / Redocly

Linting uses the same `redocly.yaml` ruleset as `procurement-ingest`.

```bash
npm run lint:api
npm run docs:preview   # builds HTML via redocly build-docs and opens it
```

## Hosted seahaven-dev

HCP Terraform workspace `seahaven-ap-dev` (project `seahaven-dev`) uses working directory `terraform` and a `terraform/**` VCS trigger on `main`. GitHub Environment `dev` holds `DEPLOY_ROLE_ARN` for `githubdeploy-seahaven-ap`.

The first apply creates secret `seahaven-ap/google-oidc` with `client_id` and `client_secret` set to `replace-me`. Replace both values in Secrets Manager, then re-run the HCP apply. A `terraform/**` change on `main` starts that apply. The Google IdP is not registered while the placeholder is still current.

The merge that adds these workflows can start Deploy Web and Deploy API before that apply has written `/seahaven-ap/deploy/*` and before GitHub Environment `dev` has `DEPLOY_ROLE_ARN`. Those runs fail on purpose until both exist. Re-run them after the apply.

- `.github/workflows/deploy-web.yaml` syncs `placeholder/` to the web bucket. It does not run `vite build`.
- `.github/workflows/deploy-api.yaml` builds the API image with `GIT_SHA`, registers the task definition from `/seahaven-ap/deploy/task-environment`, migrates, and checks `GET /api/health`.

Terraform `environment` is `dev` only. Prod hostname and GitHub Environment `prod` are AP-12.

## Verify

```bash
npm run verify
npm run test:e2e
python3 scripts/test-terraform-dev-only.py
bash scripts/test-verify-api-health.sh
```