CCM-7942: Proof requested event

infrastructure/terraform/components/sbx/README.md

@@ -42,6 +42,7 @@
 | <a name="output_download_bucket_name"></a> [download\_bucket\_name](#output\_download\_bucket\_name) | n/a |
 | <a name="output_events_sns_topic_arn"></a> [events\_sns\_topic\_arn](#output\_events\_sns\_topic\_arn) | n/a |
 | <a name="output_internal_bucket_name"></a> [internal\_bucket\_name](#output\_internal\_bucket\_name) | n/a |
+| <a name="output_proof_requests_table_name"></a> [proof\_requests\_table\_name](#output\_proof\_requests\_table\_name) | n/a |
 | <a name="output_quarantine_bucket_name"></a> [quarantine\_bucket\_name](#output\_quarantine\_bucket\_name) | n/a |
 | <a name="output_request_proof_queue_url"></a> [request\_proof\_queue\_url](#output\_request\_proof\_queue\_url) | n/a |
 | <a name="output_routing_config_table_name"></a> [routing\_config\_table\_name](#output\_routing\_config\_table\_name) | n/a |

infrastructure/terraform/components/sbx/outputs.tf

@@ -73,3 +73,7 @@ output "routing_config_table_name" {
 output "events_sns_topic_arn" {
   value = module.eventpub.sns_topic.arn
 }
+
+output "proof_requests_table_name" {
+  value = module.backend_api.proof_requests_table_name
+}

infrastructure/terraform/modules/backend-api/README.md

@@ -68,6 +68,7 @@ No requirements.
 | <a name="module_s3bucket_internal"></a> [s3bucket\_internal](#module\_s3bucket\_internal) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip | n/a |
 | <a name="module_s3bucket_quarantine"></a> [s3bucket\_quarantine](#module\_s3bucket\_quarantine) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip | n/a |
 | <a name="module_sqs_letter_render"></a> [sqs\_letter\_render](#module\_sqs\_letter\_render) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.28/terraform-sqs.zip | n/a |
+| <a name="module_sqs_proof_requests_table_events_pipe_dlq"></a> [sqs\_proof\_requests\_table\_events\_pipe\_dlq](#module\_sqs\_proof\_requests\_table\_events\_pipe\_dlq) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.28/terraform-sqs.zip | n/a |
 | <a name="module_sqs_routing_config_table_events_pipe_dlq"></a> [sqs\_routing\_config\_table\_events\_pipe\_dlq](#module\_sqs\_routing\_config\_table\_events\_pipe\_dlq) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.28/terraform-sqs.zip | n/a |
 | <a name="module_sqs_sftp_upload"></a> [sqs\_sftp\_upload](#module\_sqs\_sftp\_upload) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.28/terraform-sqs.zip | n/a |
 | <a name="module_sqs_template_mgmt_events"></a> [sqs\_template\_mgmt\_events](#module\_sqs\_template\_mgmt\_events) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.28/terraform-sqs.zip | n/a |
@@ -88,6 +89,7 @@ No requirements.
 | <a name="output_download_bucket_name"></a> [download\_bucket\_name](#output\_download\_bucket\_name) | n/a |
 | <a name="output_download_bucket_regional_domain_name"></a> [download\_bucket\_regional\_domain\_name](#output\_download\_bucket\_regional\_domain\_name) | n/a |
 | <a name="output_internal_bucket_name"></a> [internal\_bucket\_name](#output\_internal\_bucket\_name) | n/a |
+| <a name="output_proof_requests_table_name"></a> [proof\_requests\_table\_name](#output\_proof\_requests\_table\_name) | n/a |
 | <a name="output_quarantine_bucket_name"></a> [quarantine\_bucket\_name](#output\_quarantine\_bucket\_name) | n/a |
 | <a name="output_request_proof_queue_url"></a> [request\_proof\_queue\_url](#output\_request\_proof\_queue\_url) | n/a |
 | <a name="output_routing_config_table_name"></a> [routing\_config\_table\_name](#output\_routing\_config\_table\_name) | n/a |

infrastructure/terraform/modules/backend-api/cloudwatch_log_group_pipe_proof_requests_table_events.tf

@@ -0,0 +1,5 @@
+resource "aws_cloudwatch_log_group" "pipe_proof_requests_table_events" {
+  name              = "/aws/vendedlogs/pipes/${local.csi}-proof-requests-table-events"
+  kms_key_id        = var.kms_key_arn
+  retention_in_days = var.log_retention_in_days
+}

infrastructure/terraform/modules/backend-api/dynamodb_table_proof_requests.tf

@@ -0,0 +1,44 @@
+resource "aws_dynamodb_table" "proof_requests" {
+  name         = "${local.csi}-proof-requests"
+  billing_mode = "PAY_PER_REQUEST"
+
+  hash_key  = "owner"
+  range_key = "id"
+
+  attribute {
+    name = "owner"
+    type = "S"
+  }
+
+  attribute {
+    name = "id"
+    type = "S"
+  }
+
+  ttl {
+    attribute_name = "ttl"
+    enabled        = true
+  }
+
+  point_in_time_recovery {
+    enabled = true
+  }
+
+  server_side_encryption {
+    enabled     = true
+    kms_key_arn = var.kms_key_arn
+  }
+
+  tags = {
+    "NHSE-Enable-Dynamo-Backup" = var.enable_backup ? "True" : "False"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      name, # To support backup and restore which will result in a new name otherwise
+    ]
+  }
+
+  stream_enabled   = true
+  stream_view_type = "NEW_AND_OLD_IMAGES"
+}

infrastructure/terraform/modules/backend-api/module_lambda_event_publisher.tf

@@ -26,6 +26,7 @@ module "lambda_event_publisher" {
 
   lambda_env_vars = {
     EVENT_SOURCE              = "//notify.nhs.uk/${var.component}/${var.group}/${var.environment}"
+    PROOF_REQUEST_TABLE_NAME  = aws_dynamodb_table.proof_requests.name
     ROUTING_CONFIG_TABLE_NAME = aws_dynamodb_table.routing_configuration.name
     SNS_TOPIC_ARN             = coalesce(var.sns_topic_arn, aws_sns_topic.main.arn)
     TEMPLATES_TABLE_NAME      = aws_dynamodb_table.templates.name

infrastructure/terraform/modules/backend-api/module_sqs_proof_requests_table_events_pipe_dlq.tf

@@ -0,0 +1,12 @@
+module "sqs_proof_requests_table_events_pipe_dlq" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.28/terraform-sqs.zip"
+
+  aws_account_id            = var.aws_account_id
+  component                 = var.component
+  environment               = var.environment
+  project                   = var.project
+  region                    = var.region
+  name                      = "proof-requests-table-events-pipe-dead-letter"
+  sqs_kms_key_arn           = var.kms_key_arn
+  message_retention_seconds = 1209600
+}

infrastructure/terraform/modules/backend-api/outputs.tf

@@ -45,3 +45,7 @@ output "quarantine_bucket_name" {
 output "routing_config_table_name" {
   value = aws_dynamodb_table.routing_configuration.name
 }
+
+output "proof_requests_table_name" {
+  value = aws_dynamodb_table.proof_requests.name
+}

infrastructure/terraform/modules/backend-api/pipes_pipe_proof_requests_table_events.tf

@@ -0,0 +1,113 @@
+resource "aws_pipes_pipe" "proof_requests_table_events" {
+  depends_on = [module.sqs_proof_requests_table_events_pipe_dlq]
+
+  name               = "${local.csi}-proof-requests-table-events"
+  role_arn           = aws_iam_role.pipe_proof_requests_table_events.arn
+  source             = aws_dynamodb_table.proof_requests.stream_arn
+  target             = module.sqs_template_mgmt_events.sqs_queue_arn
+  desired_state      = "RUNNING"
+  kms_key_identifier = var.kms_key_arn
+
+  source_parameters {
+    dynamodb_stream_parameters {
+      starting_position                  = "TRIM_HORIZON"
+      on_partial_batch_item_failure      = "AUTOMATIC_BISECT"
+      batch_size                         = 10
+      maximum_batching_window_in_seconds = 5
+      maximum_retry_attempts             = 5
+      maximum_record_age_in_seconds      = -1
+
+      dead_letter_config {
+        arn = module.sqs_proof_requests_table_events_pipe_dlq.sqs_queue_arn
+      }
+    }
+  }
+
+  target_parameters {
+    input_template = <<-EOF
+      {
+        "dynamodb": <$.dynamodb>,
+        "eventID": <$.eventID>,
+        "eventName": <$.eventName>,
+        "eventSource": <$.eventSource>,
+        "tableName": "${aws_dynamodb_table.proof_requests.name}"
+      }
+    EOF
+
+    sqs_queue_parameters {
+      message_group_id         = "$.dynamodb.Keys.id.S"
+      message_deduplication_id = "$.eventID"
+    }
+  }
+
+  log_configuration {
+    level                  = "ERROR"
+    include_execution_data = ["ALL"]
+
+    cloudwatch_logs_log_destination {
+      log_group_arn = aws_cloudwatch_log_group.pipe_proof_requests_table_events.arn
+    }
+  }
+}
+
+resource "aws_iam_role" "pipe_proof_requests_table_events" {
+  name               = "${local.csi}-pipe-proof-requests-table-events"
+  description        = "IAM Role for Pipe to forward proof requests table stream events to SQS"
+  assume_role_policy = data.aws_iam_policy_document.pipes_proof_requests_trust_policy.json
+}
+
+data "aws_iam_policy_document" "pipes_proof_requests_trust_policy" {
+  statement {
+    sid     = "PipesAssumeRole"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["pipes.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role_policy" "pipe_proof_requests_table_events" {
+  name   = "${local.csi}-pipe-proof-requests-table-events"
+  role   = aws_iam_role.pipe_proof_requests_table_events.id
+  policy = data.aws_iam_policy_document.pipe_proof_requests_table_events.json
+}
+
+data "aws_iam_policy_document" "pipe_proof_requests_table_events" {
+  version = "2012-10-17"
+
+  statement {
+    sid    = "AllowDynamoStreamRead"
+    effect = "Allow"
+    actions = [
+      "dynamodb:DescribeStream",
+      "dynamodb:GetRecords",
+      "dynamodb:GetShardIterator",
+      "dynamodb:ListStreams",
+    ]
+    resources = [aws_dynamodb_table.proof_requests.stream_arn]
+  }
+
+  statement {
+    sid     = "AllowSqsSendMessage"
+    effect  = "Allow"
+    actions = ["sqs:SendMessage"]
+    resources = [
+      module.sqs_template_mgmt_events.sqs_queue_arn,
+      module.sqs_proof_requests_table_events_pipe_dlq.sqs_queue_arn,
+    ]
+  }
+
+  statement {
+    sid    = "AllowKmsUsage"
+    effect = "Allow"
+    actions = [
+      "kms:Decrypt",
+      "kms:Encrypt",
+      "kms:GenerateDataKey*"
+    ]
+    resources = [var.kms_key_arn]
+  }
+}

lambdas/event-publisher/src/__tests__/domain/event-builder.test.ts

@@ -23,11 +23,13 @@ const { logger: mockLogger } = createMockLogger();
 const tables = {
   templates: 'templates-table',
   routing: 'routing-config-table',
+  proofRequests: 'proof-request-table',
 };
 
 const eventBuilder = new EventBuilder(
   tables.templates,
   tables.routing,
+  tables.proofRequests,
   'event-source',
   mockLogger
 );
@@ -378,6 +380,67 @@ const expectedRoutingConfigEvent = (
   },
 });
 
+const publishableProofRequestEventRecord = (): PublishableEventRecord => ({
+  dynamodb: {
+    SequenceNumber: '4',
+    NewImage: {
+      id: {
+        S: '92b676e9-470f-4d04-ab14-965ef145e15d',
+      },
+      templateId: {
+        S: 'bed3398c-bbe3-435d-80c1-58154d4bf7dd',
+      },
+      templateType: {
+        S: 'SMS',
+      },
+      testPatientNhsNumber: {
+        S: '9000000009',
+      },
+      contactDetails: {
+        M: {
+          sms: {
+            S: '07700900000',
+          },
+        },
+      },
+      personalisation: {
+        M: {
+          firstName: {
+            S: 'Jane',
+          },
+        },
+      },
+    },
+  },
+  eventID: '7f2ae4b0-82c2-4911-9b84-8997d7f3f40d',
+  tableName: tables.proofRequests,
+});
+
+const expectedProofRequestedEvent = () => ({
+  id: '7f2ae4b0-82c2-4911-9b84-8997d7f3f40d',
+  datacontenttype: 'application/json',
+  time: '2022-01-01T09:00:00.000Z',
+  source: 'event-source',
+  type: 'uk.nhs.notify.template-management.ProofRequested.v1',
+  specversion: '1.0',
+  dataschema: 'https://notify.nhs.uk/events/schemas/ProofRequested/v1.json',
+  dataschemaversion: VERSION,
+  plane: 'data',
+  subject: '92b676e9-470f-4d04-ab14-965ef145e15d',
+  data: {
+    id: '92b676e9-470f-4d04-ab14-965ef145e15d',
+    templateId: 'bed3398c-bbe3-435d-80c1-58154d4bf7dd',
+    templateType: 'SMS',
+    testPatientNhsNumber: '9000000009',
+    contactDetails: {
+      sms: '07700900000',
+    },
+    personalisation: {
+      firstName: 'Jane',
+    },
+  },
+});
+
 test('errors on unrecognised event table source', () => {
   const invalidpublishableTemplateEventRecord = {
     ...publishableTemplateEventRecord('SUBMITTED'),
@@ -634,3 +697,55 @@ describe('routing config events', () => {
     expect(event).toEqual(undefined);
   });
 });
+
+describe('proof request events', () => {
+  test('builds proof requested event', () => {
+    const event = eventBuilder.buildEvent(publishableProofRequestEventRecord());
+
+    expect(event).toEqual(expectedProofRequestedEvent());
+  });
+
+  test('errors on output schema validation failure after input parsing', () => {
+    const valid = publishableProofRequestEventRecord();
+
+    const invalidDomainEventRecord: PublishableEventRecord = {
+      ...valid,
+      dynamodb: {
+        ...valid.dynamodb,
+        NewImage: {
+          ...valid.dynamodb.NewImage,
+          templateType: { S: 'LETTER' },
+        },
+      },
+    };
+
+    expect(() => eventBuilder.buildEvent(invalidDomainEventRecord)).toThrow(
+      expect.objectContaining({
+        name: 'ZodError',
+        issues: [
+          expect.objectContaining({
+            code: 'invalid_value',
+            values: ['NHS_APP', 'SMS', 'EMAIL'],
+            path: ['data', 'templateType'],
+          }),
+        ],
+      })
+    );
+  });
+
+  test('does not build proof request event on hard delete', () => {
+    const hardDeletePublishableProofRequestEventRecord = {
+      ...publishableProofRequestEventRecord(),
+      dynamodb: {
+        SequenceNumber: '4',
+        NewImage: undefined,
+      },
+    };
+
+    const event = eventBuilder.buildEvent(
+      hardDeletePublishableProofRequestEventRecord
+    );
+
+    expect(event).toEqual(undefined);
+  });
+});

lambdas/event-publisher/src/config.ts

@@ -5,6 +5,7 @@ const $Config = z.object({
   ROUTING_CONFIG_TABLE_NAME: z.string(),
   SNS_TOPIC_ARN: z.string(),
   TEMPLATES_TABLE_NAME: z.string(),
+  PROOF_REQUEST_TABLE_NAME: z.string(),
 });
 
 export const loadConfig = () => {

lambdas/event-publisher/src/container.ts

@@ -11,6 +11,7 @@ export const createContainer = () => {
     ROUTING_CONFIG_TABLE_NAME,
     SNS_TOPIC_ARN,
     TEMPLATES_TABLE_NAME,
+    PROOF_REQUEST_TABLE_NAME,
   } = loadConfig();
 
   const snsClient = new SNSClient({ region: 'eu-west-2' });
@@ -20,6 +21,7 @@ export const createContainer = () => {
   const eventBuilder = new EventBuilder(
     TEMPLATES_TABLE_NAME,
     ROUTING_CONFIG_TABLE_NAME,
+    PROOF_REQUEST_TABLE_NAME,
     EVENT_SOURCE,
     logger
   );