Authoriser lambda

.github/actions/build-docs/action.yml

@@ -11,7 +11,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22
     - name: Npm cli install
       working-directory: .
       run: npm ci

.github/actions/build-libraries/action.yml

@@ -11,7 +11,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
 
     - name: Npm install
       working-directory: .

.github/actions/build-proxies/action.yml

@@ -34,7 +34,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
 
     - name: Npm install
       working-directory: .
@@ -113,4 +113,5 @@ runs:
           --apimEnvironment "${{ env.APIM_ENV }}" \
           --boundedContext "notify-supplier" \
           --targetDomain "$TARGET_DOMAIN" \
-          --version "${{ inputs.version }}"
+          --version "${{ inputs.version }}" \
+          --nodejs_version 22

.github/actions/build-sandbox/action.yml

@@ -12,7 +12,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
 
     - name: Npm install
       working-directory: .

.github/actions/build-sdk/action.yml

@@ -11,7 +11,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22
 
     - name: Npm install
       working-directory: .

.github/actions/build-server/action.yml

@@ -11,7 +11,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
 
     - name: Npm install
       working-directory: .

.github/workflows/manual-proxy-environment-deploy.yaml

@@ -32,7 +32,7 @@ jobs:
 
       - uses: actions/setup-node@v6
         with:
-          node-version: 24
+          node-version: 22
 
       - name: Npm install
         working-directory: .

infrastructure/terraform/components/api/cloudwatch_metric_alarm_apim_auth_cert_expirty.tf

@@ -0,0 +1,22 @@
+resource "aws_cloudwatch_metric_alarm" "alm-apim-client-certificate-near-expiry" {
+  alarm_name        = "${local.csi}-alm-apim-client-certificate-near-expiry"
+  alarm_description = "RELIABILITY: An APIM client certificate is due to expire soon"
+
+  metric_name = "apim-client-certificate-near-expiry"
+  namespace   = "comms-apim-authorizer"
+
+  dimensions = {
+    Environment = var.environment
+  }
+
+  period              = 60 * 60 * 4 //4 hours
+  comparison_operator = "GreaterThanThreshold"
+  threshold           = "0"
+  evaluation_periods  = "1"
+  statistic           = "Sum"
+  treat_missing_data  = "notBreaching"
+
+  actions_enabled = "false"
+  alarm_actions   = []
+  ok_actions      = []
+}

infrastructure/terraform/components/api/ddb_table_suppliers.tf

@@ -0,0 +1,34 @@
+resource "aws_dynamodb_table" "suppliers" {
+  name         = "${local.csi}-suppliers"
+  billing_mode = "PAY_PER_REQUEST"
+
+  hash_key  = "id"
+  range_key = "apimId"
+
+  ttl {
+    attribute_name = "ttl"
+    enabled        = false
+  }
+
+  global_secondary_index {
+    name            = "supplier-apim-index"
+    hash_key        = "apimId"
+    projection_type = "ALL"
+  }
+
+  attribute {
+    name = "id"
+    type = "S"
+  }
+
+  attribute {
+    name = "apimId"
+    type = "S"
+  }
+
+  point_in_time_recovery {
+    enabled = true
+  }
+
+  tags = var.default_tags
+}

infrastructure/terraform/components/api/module_authorizer_lambda.tf

@@ -11,6 +11,10 @@ module "authorizer_lambda" {
   log_retention_in_days = var.log_retention_in_days
   kms_key_arn           = module.kms.key_arn
 
+  iam_policy_document = {
+    body = data.aws_iam_policy_document.authorizer_lambda.json
+  }
+
   function_name = "authorizer"
   description   = "Authorizer for Suppliers API"
 
@@ -30,4 +34,40 @@ module "authorizer_lambda" {
   send_to_firehose          = true
   log_destination_arn       = local.destination_arn
   log_subscription_role_arn = local.acct.log_subscription_role_arn
+
+  lambda_env_vars = {
+    CLOUDWATCH_NAMESPACE                     = "/aws/api-gateway/supplier/alarms",
+    CLIENT_CERTIFICATE_EXPIRATION_ALERT_DAYS = 14,
+    APIM_SUPPLIER_ID_HEADER               = "NHSD-Supplier-ID",
+    SUPPLIERS_TABLE_NAME                     = aws_dynamodb_table.suppliers.name
+  }
+}
+
+data "aws_iam_policy_document" "authorizer_lambda" {
+  statement {
+    sid    = "AllowPutMetricData"
+    effect = "Allow"
+
+    actions = [
+      "cloudwatch:PutMetricData"
+    ]
+
+    resources = [
+      "*"
+    ]
+  }
+
+  statement {
+    sid    = "AllowDynamoDBAccess"
+    effect = "Allow"
+
+    actions = [
+      "dynamodb:Query"
+    ]
+
+    resources = [
+      aws_dynamodb_table.suppliers.arn,
+      "${aws_dynamodb_table.suppliers.arn}/index/supplier-apim-index"
+    ]
+  }
 }

internal/datastore/src/__test__/db.ts

@@ -31,6 +31,7 @@ export async function setupDynamoDBContainer() {
     endpoint,
     lettersTableName: 'letters',
     miTableName: 'management-info',
+    suppliersTableName: 'suppliers',
     lettersTtlHours: 1,
     miTtlHours: 1
   };
@@ -94,6 +95,29 @@ const createMITableCommand = new CreateTableCommand({
     ]
   });
 
+const createSupplierTableCommand = new CreateTableCommand({
+    TableName: 'suppliers',
+    BillingMode: 'PAY_PER_REQUEST',
+    KeySchema: [
+      { AttributeName: 'id', KeyType: 'HASH' }  // Partition key
+    ],
+    GlobalSecondaryIndexes: [
+      {
+        IndexName: 'supplier-apim-index',
+        KeySchema: [
+          { AttributeName: 'apimId', KeyType: 'HASH' } // Partition key for GSI
+        ],
+        Projection: {
+          ProjectionType: 'ALL'
+        }
+      }
+    ],
+    AttributeDefinitions: [
+      { AttributeName: 'id', AttributeType: 'S' },
+      { AttributeName: 'apimId', AttributeType: 'S' }
+    ]
+  });
+
 
 export async function createTables(context: DBContext) {
   const { ddbClient } = context;
@@ -102,6 +126,7 @@ export async function createTables(context: DBContext) {
   await ddbClient.send(updateTimeToLiveCommand);
 
   await ddbClient.send(createMITableCommand);
+  await ddbClient.send(createSupplierTableCommand);
 }
 
 
@@ -115,4 +140,8 @@ export async function deleteTables(context: DBContext) {
   await ddbClient.send(new DeleteTableCommand({
     TableName: 'management-info'
   }));
+
+  await ddbClient.send(new DeleteTableCommand({
+    TableName: 'suppliers'
+  }));
 }

internal/datastore/src/__test__/supplier-repository.test.ts

@@ -0,0 +1,127 @@
+import { Logger } from "pino";
+import { createTables, DBContext, deleteTables, setupDynamoDBContainer } from "./db";
+import { createTestLogger, LogStream } from "./logs";
+import { SupplierRepository } from "../supplier-repository";
+import { Supplier } from "../types";
+import { v4 as uuidv4 } from 'uuid';
+
+function createSupplier(status: 'ENABLED' | 'DISABLED', apimId = uuidv4()): Omit<Supplier, 'updatedAt'> {
+    return {
+        id: uuidv4(),
+        name: 'Supplier One',
+        apimId,
+        status
+    }
+}
+
+// Database tests can take longer, especially with setup and teardown
+jest.setTimeout(30000);
+
+describe('SupplierRepository', () => {
+    let db: DBContext;
+    let supplierRepository: SupplierRepository;
+    let logStream: LogStream;
+    let logger: Logger;
+
+    beforeAll(async () => {
+        db = await setupDynamoDBContainer();
+    });
+
+    beforeEach(async () => {
+        await createTables(db);
+        (
+            { logStream, logger } = createTestLogger()
+        );
+
+        supplierRepository = new SupplierRepository(db.docClient, logger, db.config);
+    });
+
+    afterEach(async () => {
+        await deleteTables(db);
+        jest.useRealTimers();
+    });
+
+    afterAll(async () => {
+        await db.container.stop();
+    });
+
+    test('creates an enabled supplier with provided values and timestamps', async () => {
+        jest.useFakeTimers();
+        // Month is zero-indexed in JS Date
+        jest.setSystemTime(new Date(2020, 1, 1));
+
+        const supplier = createSupplier('ENABLED');
+
+        const persistedSupplier = await supplierRepository.putSupplier(supplier);
+
+        expect(persistedSupplier).toEqual(expect.objectContaining({
+            ...supplier,
+            updatedAt: '2020-02-01T00:00:00.000Z',
+        }));
+    });
+
+    test('fetches a supplier by its ID', async () => {
+        const supplier = createSupplier('DISABLED')
+        await supplierRepository.putSupplier(supplier);
+
+        const fetched = await supplierRepository.getSupplierById(supplier.id);
+
+        expect(fetched).toEqual(expect.objectContaining({
+            ...supplier
+        }));
+    });
+
+    test('throws an error fetching a supplier that does not exist', async () => {
+        await expect(supplierRepository.getSupplierById('non-existent-id'))
+        .rejects.toThrow('Supplier with id non-existent-id not found');
+    });
+
+    test('overwrites an existing supplier entry', async () => {
+        const supplier = createSupplier('DISABLED');
+
+        const original = await supplierRepository.putSupplier(supplier);
+        expect(original.status).toBe('DISABLED');
+
+        supplier.status = 'ENABLED';
+        const updated = await supplierRepository.putSupplier(supplier);
+        expect(updated.status).toBe('ENABLED');
+    });
+
+    test('rethrows errors from DynamoDB when creating a letter', async () => {
+        const misconfiguredRepository = new SupplierRepository(db.docClient, logger, {
+            ...db.config,
+            suppliersTableName: 'nonexistent-table'
+        });
+        await expect(misconfiguredRepository.putSupplier(createSupplier('ENABLED')))
+        .rejects.toThrow('Cannot do operations on a non-existent table');
+    });
+
+    test('fetches a supplier by apimId', async () => {
+        const supplier = createSupplier('ENABLED');
+
+        await supplierRepository.putSupplier(supplier);
+
+        const fetched = await supplierRepository.getSupplierByApimId(supplier.apimId);
+        expect(fetched).toEqual(expect.objectContaining({
+            ...supplier
+        }));
+    });
+
+    test('throws an error fetching a supplier by apimId that does not exist', async () => {
+        await expect(supplierRepository.getSupplierByApimId('non-existent-apim-id'))
+        .rejects.toThrow('Supplier with apimId non-existent-apim-id not found');
+    });
+
+    test('throws an error fetching a supplier by apimId when multiple exist', async () => {
+        const apimId = 'duplicate-apim-id';
+        const supplier1 = createSupplier('ENABLED', apimId);
+        const supplier2 = createSupplier('DISABLED', apimId);
+
+        await supplierRepository.putSupplier(supplier1);
+        await supplierRepository.putSupplier(supplier2);
+
+        await expect(supplierRepository.getSupplierByApimId(apimId))
+        .rejects.toThrow(`Multiple suppliers found with apimId ${apimId}`);
+    });
+
+});

internal/datastore/src/config.ts

@@ -3,6 +3,7 @@ export type DatastoreConfig = {
   endpoint?: string,
   lettersTableName: string,
   miTableName: string,
+  suppliersTableName: string,
   lettersTtlHours: number,
   miTtlHours: number
 }

internal/datastore/src/index.ts

@@ -1,4 +1,5 @@
 export * from './types';
 export * from './mi-repository';
 export * from './letter-repository';
+export * from './supplier-repository';
 export * from './types';