fix: cross-runtime consistency fixes (#179)

* fix(approvals_service): Remove unused imports and replace InternalServerError

- Remove unused datetime import and current_date variable calculation
- Replace InternalServerError with EnvironmentError for environment variable validation
- Simplify error handling for SERVICE_NAMESPACE and CONTRACT_STATUS_TABLE checks
- InternalServerError is not appropriate for environment configuration issues that occur at module initialization

* fix(publication_manager_service): Add evaluation result validation and remove unused metric

- Add validation for evaluation_result to ensure only "APPROVED" or "DECLINED" values are processed
- Return early with skip message when unknown evaluation result is encountered
- Log warning when evaluation result is invalid for debugging purposes
- Remove unused PropertiesAdded metric that was not being utilized
- Improve robustness by preventing invalid data from being written to DynamoDB

* fix(contracts_service): Improve datetime handling and add contract metrics

- Import timezone from datetime module for UTC timestamp generation
- Import MetricUnit from aws_lambda_powertools.metrics for proper metric typing
- Replace strftime formatting with isoformat() for ISO 8601 compliant timestamps in create_contract and update_contract functions
- Add metric tracking for successful contract creation events
- Rename UpdateExpression attribute from modified_date to contract_last_modified_on for consistency
- Ensures timestamps are timezone-aware and use UTC for consistency across distributed systems

* chore(deps): bump dependencies to latest versions

* ci: Add explicit permissions to workflow jobs

- Add actions: read permission for workflow execution access
- Add contents: read permission for repository content access
- Scope down GitHub Token permissions following security best practices

Author: sliedig

.github/workflows/on_merged_pr.yml

@@ -7,6 +7,8 @@ on:
       - completed
 
 permissions:
+  actions: read
+  contents: read
   issues: write
 
 jobs:

unicorn_approvals/src/approvals_service/contract_status_changed_event_handler.py

@@ -2,20 +2,18 @@
 # SPDX-License-Identifier: MIT-0
 
 import os
-from datetime import datetime
 
 import boto3
 from aws_lambda_powertools.logging import Logger
 from aws_lambda_powertools.metrics import Metrics
 from aws_lambda_powertools.tracing import Tracer
-from aws_lambda_powertools.event_handler.exceptions import InternalServerError
 from schema.unicorn_contracts.contractstatuschanged import AWSEvent, ContractStatusChanged, Marshaller
 
 # Initialise Environment variables
 if (SERVICE_NAMESPACE := os.environ.get("SERVICE_NAMESPACE")) is None:
-    raise InternalServerError("SERVICE_NAMESPACE environment variable is undefined")
+    raise EnvironmentError("SERVICE_NAMESPACE environment variable is undefined")
 if (CONTRACT_STATUS_TABLE := os.environ.get("CONTRACT_STATUS_TABLE")) is None:
-    raise InternalServerError("CONTRACT_STATUS_TABLE environment variable is undefined")
+    raise EnvironmentError("CONTRACT_STATUS_TABLE environment variable is undefined")
 
 # Initialise PowerTools
 logger: Logger = Logger()
@@ -26,10 +24,6 @@
 dynamodb = boto3.resource("dynamodb")
 table = dynamodb.Table(CONTRACT_STATUS_TABLE)  # type: ignore
 
-# Get current date
-now = datetime.now()
-current_date = now.strftime("%d/%m/%Y %H:%M:%S")
-
 
 @logger.inject_lambda_context(log_event=True)  # type: ignore
 @metrics.log_metrics(capture_cold_start_metric=True)  # type: ignore

unicorn_contracts/src/contracts_service/contract_event_handler.py

@@ -3,14 +3,14 @@
 
 import os
 import uuid
-from datetime import datetime
+from datetime import datetime, timezone
 
 import boto3
 from boto3.dynamodb.conditions import Attr
 from botocore.exceptions import ClientError
 
 from aws_lambda_powertools.logging import Logger
-from aws_lambda_powertools.metrics import Metrics
+from aws_lambda_powertools.metrics import Metrics, MetricUnit
 from aws_lambda_powertools.tracing import Tracer
 from aws_lambda_powertools.utilities.data_classes import event_source, SQSEvent
 from aws_lambda_powertools.utilities.typing import LambdaContext
@@ -76,7 +76,7 @@ def create_contract(event: dict) -> None:
         DynamoDB put Item response
     """
 
-    current_date = datetime.now().strftime("%d/%m/%Y %H:%M:%S")
+    current_date = datetime.now(timezone.utc).isoformat()
     contract = {
         "property_id": event["property_id"],  # PK
         "address": event["address"],
@@ -105,6 +105,7 @@ def create_contract(event: dict) -> None:
 
         # Annotate trace with contract status
         tracer.put_annotation(key="ContractStatus", value=contract["contract_status"])
+        metrics.add_metric(name="ContractCreated", unit=MetricUnit.Count, value=1)
 
     except ClientError as e:
         code = e.response["Error"]["Code"]
@@ -147,13 +148,13 @@ def update_contract(contract: dict) -> None:
 
     try:
         contract["contract_status"] = ContractStatus.APPROVED.name
-        current_date = datetime.now().strftime("%d/%m/%Y %H:%M:%S")
+        current_date = datetime.now(timezone.utc).isoformat()
 
         response = table.update_item(
             Key={
                 "property_id": contract["property_id"],
             },
-            UpdateExpression="set contract_status=:t, modified_date=:m",
+            UpdateExpression="set contract_status=:t, contract_last_modified_on=:m",
             ConditionExpression=Attr("property_id").exists()
             & Attr("contract_status").is_in([ContractStatus.DRAFT.name]),
             ExpressionAttributeValues={

unicorn_contracts/uv.lock

@@ -74,14 +74,18 @@ def publication_approved(event_detail, errors):
 
     property_id = event_detail.property_id
     evaluation_result = event_detail.evaluation_result
+
+    valid_results = {"APPROVED", "DECLINED"}
+    if evaluation_result.upper() not in valid_results:
+        logger.warning(f"Unknown evaluation_result '{evaluation_result}'; skipping DynamoDB update")
+        return {"result": "Skipped — unknown evaluation result"}
+
     country, city, street, number = property_id.split("/")
 
     pk_details = f"{country}#{city}".replace(" ", "-").lower()
     pk = f"PROPERTY#{pk_details}"
     sk = f"{street}#{str(number)}".replace(" ", "-").lower()
 
-    metrics.add_metric(name="PropertiesAdded", unit=MetricUnit.Count, value=1)
-
     logger.info(f"Storing new property in DynamoDB with PK {pk} and SK {sk}")
     dynamodb_response = table.update_item(
         Key={