Feature/ccm 12952 publish mi events

.github/workflows/stage-2-test.yaml

@@ -75,6 +75,8 @@ jobs:
     name: "Unit tests"
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: "Checkout code"
         uses: actions/checkout@v5
@@ -149,6 +151,8 @@ jobs:
     name: "Linting"
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: "Checkout code"
         uses: actions/checkout@v5
@@ -180,6 +184,8 @@ jobs:
     name: "Typecheck"
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: "Checkout code"
         uses: actions/checkout@v5

infrastructure/terraform/components/api/README.md

@@ -52,6 +52,7 @@ No requirements.
 | <a name="module_letter_status_updates_queue"></a> [letter\_status\_updates\_queue](#module\_letter\_status\_updates\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
 | <a name="module_letter_updates_transformer"></a> [letter\_updates\_transformer](#module\_letter\_updates\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_logging_bucket"></a> [logging\_bucket](#module\_logging\_bucket) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |
+| <a name="module_mi_updates_transformer"></a> [mi\_updates\_transformer](#module\_mi\_updates\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip | n/a |
 | <a name="module_patch_letter"></a> [patch\_letter](#module\_patch\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_post_letters"></a> [post\_letters](#module\_post\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_post_mi"></a> [post\_mi](#module\_post\_mi) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |

infrastructure/terraform/components/api/event_source_mapping_mi_updates.tf

@@ -0,0 +1,11 @@
+resource "aws_lambda_event_source_mapping" "mi_updates_transformer_kinesis" {
+  event_source_arn                     = aws_kinesis_stream.mi_change_stream.arn
+  function_name                        = module.mi_updates_transformer.function_arn
+  starting_position                    = "LATEST"
+  batch_size                           = 10
+  maximum_batching_window_in_seconds   = 1
+
+  depends_on = [
+    module.mi_updates_transformer    # ensures updates transformer exists
+  ]
+}

infrastructure/terraform/components/api/kinesis_mi_change_stream.tf

@@ -0,0 +1,11 @@
+resource "aws_kinesis_stream" "mi_change_stream" {
+  name             = "${local.csi}-mi-change-stream"
+  shard_count      = 1
+  retention_period = 24
+}
+
+resource "aws_dynamodb_kinesis_streaming_destination" "mi_streaming_destination" {
+  stream_arn                               = aws_kinesis_stream.mi_change_stream.arn
+  table_name                               = aws_dynamodb_table.mi.name
+  approximate_creation_date_time_precision = "MILLISECOND"
+}

infrastructure/terraform/components/api/module_lambda_mi_updates_transformer.tf

@@ -0,0 +1,74 @@
+module "mi_updates_transformer" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
+
+  function_name = "mi-updates-transformer"
+  description   = "MI Update Filter/Producer"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  group          = var.group
+
+  log_retention_in_days = var.log_retention_in_days
+  kms_key_arn           = module.kms.key_arn
+
+  iam_policy_document = {
+    body = data.aws_iam_policy_document.mi_updates_transformer_lambda.json
+  }
+
+  function_s3_bucket      = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
+  function_code_base_path = local.aws_lambda_functions_dir_path
+  function_code_dir       = "mi-updates-transformer/dist"
+  function_include_common = true
+  handler_function_name   = "handler"
+  runtime                 = "nodejs22.x"
+  memory                  = 128
+  timeout                 = 29
+  log_level               = var.log_level
+
+  force_lambda_code_deploy = var.force_lambda_code_deploy
+  enable_lambda_insights   = false
+
+  send_to_firehose          = true
+  log_destination_arn       = local.destination_arn
+  log_subscription_role_arn = local.acct.log_subscription_role_arn
+
+  lambda_env_vars = merge(local.common_lambda_env_vars, {
+    EVENTPUB_SNS_TOPIC_ARN = "${module.eventpub.sns_topic.arn}"
+  })
+}
+
+data "aws_iam_policy_document" "mi_updates_transformer_lambda" {
+  statement {
+    sid    = "AllowSNSPublish"
+    effect = "Allow"
+
+    actions = [
+      "sns:Publish"
+    ]
+
+    resources = [
+      module.eventpub.sns_topic.arn
+    ]
+  }
+
+  statement {
+    sid    = "AllowKinesisGet"
+    effect = "Allow"
+
+    actions = [
+      "kinesis:GetRecords",
+      "kinesis:GetShardIterator",
+      "kinesis:DescribeStream",
+      "kinesis:DescribeStreamSummary",
+      "kinesis:ListShards",
+      "kinesis:ListStreams",
+    ]
+
+    resources = [
+      aws_kinesis_stream.mi_change_stream.arn
+    ]
+  }
+}

lambdas/api-handler/package.json

@@ -19,7 +19,8 @@
     "jest": "^30.2.0",
     "jest-mock-extended": "^4.0.0",
     "ts-jest": "^29.4.0",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "zod": "^4.1.11"
   },
   "name": "nhs-notify-supplier-api-handler",
   "private": true,

lambdas/mi-updates-transformer/jest.config.ts

@@ -0,0 +1,60 @@
+import type { Config } from "jest";
+
+export const baseJestConfig: Config = {
+  preset: "ts-jest",
+
+  // Automatically clear mock calls, instances, contexts and results before every test
+  clearMocks: true,
+
+  // Indicates whether the coverage information should be collected while executing the test
+  collectCoverage: true,
+
+  // The directory where Jest should output its coverage files
+  coverageDirectory: "./.reports/unit/coverage",
+
+  // Indicates which provider should be used to instrument code for coverage
+  coverageProvider: "babel",
+
+  coverageThreshold: {
+    global: {
+      branches: 100,
+      functions: 100,
+      lines: 100,
+      statements: -10,
+    },
+  },
+
+  coveragePathIgnorePatterns: ["/__tests__/"],
+  transform: { "^.+\\.ts$": "ts-jest" },
+  testPathIgnorePatterns: [".build"],
+  testMatch: ["**/?(*.)+(spec|test).[jt]s?(x)"],
+
+  // Use this configuration option to add custom reporters to Jest
+  reporters: [
+    "default",
+    [
+      "jest-html-reporter",
+      {
+        pageTitle: "Test Report",
+        outputPath: "./.reports/unit/test-report.html",
+        includeFailureMsg: true,
+      },
+    ],
+  ],
+
+  // The test environment that will be used for testing
+  testEnvironment: "jsdom",
+};
+
+const utilsJestConfig = {
+  ...baseJestConfig,
+
+  testEnvironment: "node",
+
+  coveragePathIgnorePatterns: [
+    ...(baseJestConfig.coveragePathIgnorePatterns ?? []),
+    "zod-validators.ts",
+  ],
+};
+
+export default utilsJestConfig;

lambdas/mi-updates-transformer/package.json

@@ -0,0 +1,30 @@
+{
+  "dependencies": {
+    "@aws-sdk/client-sns": "^3.954.0",
+    "@aws-sdk/util-dynamodb": "^3.943.0",
+    "@internal/datastore": "^0.1.0",
+    "@nhsdigital/nhs-notify-event-schemas-supplier-api": "*",
+    "aws-lambda": "^1.0.7",
+    "esbuild": "^0.24.0",
+    "pino": "^10.1.0",
+    "zod": "^4.1.13"
+  },
+  "devDependencies": {
+    "@tsconfig/node22": "^22.0.2",
+    "@types/aws-lambda": "^8.10.148",
+    "@types/jest": "^30.0.0",
+    "jest": "^30.2.0",
+    "jest-mock-extended": "^4.0.0",
+    "typescript": "^5.8.3"
+  },
+  "name": "nhs-notify-supplier-api-mi-updates-transformer",
+  "private": true,
+  "scripts": {
+    "lambda-build": "rm -rf dist && npx esbuild --bundle --minify --sourcemap --target=es2020 --platform=node --loader:.node=file --entry-names=[name] --outdir=dist src/index.ts",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "test:unit": "jest",
+    "typecheck": "tsc --noEmit"
+  },
+  "version": "0.0.1"
+}