Merge branch 'main' into feature/CCM-13148_fix-manual-proxy

Author: masl2

.github/CODEOWNERS

@@ -5,7 +5,7 @@
 /.github/                   @NHSDigital/nhs-notify-supplier-api-admins
 *.code-workspace            @NHSDigital/nhs-notify-supplier-api-admins
 /docs/                      @NHSDigital/nhs-notify-supplier-api
-/infrastructure/terraform/  @NHSDigital/nhs-notify-platform
+/infrastructure/terraform/  @NHSDigital/nhs-notify-platform @NHSDigital/nhs-notify-supplier-api-admins
 
 # Codeowners must be final check
 /.github/CODEOWNERS         @NHSDigital/nhs-notify-code-owners

.github/actions/build-docs/action.yml

@@ -11,7 +11,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22
     - name: Npm cli install
       working-directory: .
       run: npm ci

.github/actions/build-libraries/action.yml

@@ -11,7 +11,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
 
     - name: Npm install
       working-directory: .

.github/actions/build-sandbox/action.yml

@@ -12,7 +12,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
 
     - name: Npm install
       working-directory: .

.github/actions/build-sdk/action.yml

@@ -11,7 +11,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 18
+        node-version: 22
 
     - name: Npm install
       working-directory: .

.github/actions/build-server/action.yml

@@ -11,7 +11,7 @@ runs:
       uses: actions/checkout@v4
     - uses: actions/setup-node@v4
       with:
-        node-version: 24
+        node-version: 22
 
     - name: Npm install
       working-directory: .

infrastructure/terraform/components/api/README.md

@@ -37,9 +37,13 @@ No requirements.
 | <a name="module_get_letter"></a> [get\_letter](#module\_get\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
 | <a name="module_get_letter_data"></a> [get\_letter\_data](#module\_get\_letter\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
 | <a name="module_get_letters"></a> [get\_letters](#module\_get\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
+| <a name="module_get_status"></a> [get\_status](#module\_get\_status) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
 | <a name="module_kms"></a> [kms](#module\_kms) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-kms.zip | n/a |
+| <a name="module_letter_status_update"></a> [letter\_status\_update](#module\_letter\_status\_update) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
+| <a name="module_letter_status_updates_queue"></a> [letter\_status\_updates\_queue](#module\_letter\_status\_updates\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
 | <a name="module_logging_bucket"></a> [logging\_bucket](#module\_logging\_bucket) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip | n/a |
 | <a name="module_patch_letter"></a> [patch\_letter](#module\_patch\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
+| <a name="module_post_letters"></a> [post\_letters](#module\_post\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
 | <a name="module_post_mi"></a> [post\_mi](#module\_post\_mi) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
 | <a name="module_s3bucket_test_letters"></a> [s3bucket\_test\_letters](#module\_s3bucket\_test\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip | n/a |
 | <a name="module_supplier_ssl"></a> [supplier\_ssl](#module\_supplier\_ssl) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-ssl.zip | n/a |

infrastructure/terraform/components/api/cloudwatch_metric_alarm_apim_auth_cert_expirty.tf

@@ -0,0 +1,22 @@
+resource "aws_cloudwatch_metric_alarm" "alm-apim-client-certificate-near-expiry" {
+  alarm_name        = "${local.csi}-alm-apim-client-certificate-near-expiry"
+  alarm_description = "RELIABILITY: An APIM client certificate is due to expire soon"
+
+  metric_name = "apim-client-certificate-near-expiry"
+  namespace   = "comms-apim-authorizer"
+
+  dimensions = {
+    Environment = var.environment
+  }
+
+  period              = 60 * 60 * 4 //4 hours
+  comparison_operator = "GreaterThanThreshold"
+  threshold           = "0"
+  evaluation_periods  = "1"
+  statistic           = "Sum"
+  treat_missing_data  = "notBreaching"
+
+  actions_enabled = "false"
+  alarm_actions   = []
+  ok_actions      = []
+}

infrastructure/terraform/components/api/ddb_table_suppliers.tf

@@ -0,0 +1,34 @@
+resource "aws_dynamodb_table" "suppliers" {
+  name         = "${local.csi}-suppliers"
+  billing_mode = "PAY_PER_REQUEST"
+
+  hash_key  = "id"
+  range_key = "apimId"
+
+  ttl {
+    attribute_name = "ttl"
+    enabled        = false
+  }
+
+  global_secondary_index {
+    name            = "supplier-apim-index"
+    hash_key        = "apimId"
+    projection_type = "ALL"
+  }
+
+  attribute {
+    name = "id"
+    type = "S"
+  }
+
+  attribute {
+    name = "apimId"
+    type = "S"
+  }
+
+  point_in_time_recovery {
+    enabled = true
+  }
+
+  tags = var.default_tags
+}

infrastructure/terraform/components/api/event_source_mapping_status_updates_to_handler.tf

@@ -0,0 +1,12 @@
+resource "aws_lambda_event_source_mapping" "status_updates_sqs_to_status_update_handler" {
+  event_source_arn                   = module.letter_status_updates_queue.sqs_queue_arn
+  function_name                      = module.letter_status_update.function_arn
+  batch_size                         = 10
+  maximum_batching_window_in_seconds = 1
+  scaling_config { maximum_concurrency = 10 }
+
+  depends_on = [
+    module.letter_status_updates_queue,         # ensures queue exists
+    module.letter_status_update                 # ensures update handler exists
+  ]
+}