Merge branch 'main' into feature/prod-smoke-letter

Author: masl2

.github/workflows/cicd-3-deploy.yaml

@@ -103,7 +103,7 @@ jobs:
         run: |
           gh release download ${{steps.get-asset-version.outputs.release_version}} -p jekyll-docs-*.tar --output artifact.tar
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: jekyll-docs-${{steps.get-asset-version.outputs.release_version}}
           path: artifact.tar

.github/workflows/scorecard.yml

@@ -59,7 +59,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: SARIF file
           path: results.sarif
@@ -68,6 +68,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
+        uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
         with:
           sarif_file: results.sarif

.github/workflows/stage-2-test.yaml

@@ -105,14 +105,14 @@ jobs:
         run: |
           make test-unit
       - name: "Save the result of fast test suite"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: unit-tests
           path: "**/.reports/unit"
           include-hidden-files: true
         if: always()
       - name: "Save the result of code coverage"
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: code-coverage-report
           path: ".reports/lcov.info"
@@ -241,7 +241,7 @@ jobs:
         with:
           fetch-depth: 0 # Full history is needed to improving relevancy of reporting
       - name: "Download coverage report for SONAR"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           name: code-coverage-report
       - name: "Perform static analysis"

.github/workflows/stage-5-publish.yaml

@@ -49,50 +49,50 @@ jobs:
         uses: actions/checkout@v5
 
       - name: "Get the artefacts 1"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: ./artifacts/jekyll-docs-${{ inputs.version }}
           name: jekyll-docs-${{ inputs.version }}
 
       - name: "Get the artefacts 2"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: ./artifacts/sdk-html-docs-${{ inputs.version }}
           name: sdk-html-docs-${{ inputs.version }}
 
       - name: "Get the artefacts 3"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: ./artifacts/sdk-swagger-docs-${{ inputs.version }}
           name: sdk-swagger-docs-${{ inputs.version }}
 
       - name: "Get the artefacts 4"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: ./artifacts/sdk-html-${{ inputs.version }}
           name: sdk-html-${{ inputs.version }}
 
       - name: "Get the artefacts 5"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: ./artifacts/sdk-ts-${{ inputs.version }}
           name: sdk-ts-${{ inputs.version }}
 
       - name: "Get the artefacts 6"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: ./artifacts/sdk-python-${{ inputs.version }}
           name: sdk-python-${{ inputs.version }}
 
       - name: "Get the artefacts 7"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: ./artifacts/sdk-csharp-${{ inputs.version }}
           name: sdk-csharp-${{ inputs.version }}
 
       # Take out for now - might add again in the future
       # - name: "Get the artefacts 9"
-      #   uses: actions/download-artifact@v6
+      #   uses: actions/download-artifact@v8
       #   with:
       #     path: ./artifacts/server-csharp-${{ inputs.version }}
       #     name: server-csharp-${{ inputs.version }}
@@ -235,7 +235,7 @@ jobs:
         apimEnv: [internal-dev, int, ref, prod]
     steps:
       - name: "Download OAS spec artifact"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: ./artifacts/api-oas-specification-${{ matrix.apimEnv }}-${{ inputs.version }}
           name: api-oas-specification-${{ matrix.apimEnv }}-${{ inputs.version }}
@@ -266,12 +266,12 @@ jobs:
   #       contents: read
   #     steps:
   #       - name: "Get the artefacts csharp docker"
-  #         uses: actions/download-artifact@v6
+  #         uses: actions/download-artifact@v8
   #         with:
   #           path: .
   #           name: server-csharp-docker-${{ inputs.version }}
   #       - name: "Get the artefacts csharp server"
-  #         uses: actions/download-artifact@v6
+  #         uses: actions/download-artifact@v8
   #         with:
   #           path: ./csharp-server
   #           name: server-csharp-${{ inputs.version }}
@@ -293,7 +293,7 @@ jobs:
       contents: read
     steps:
       - name: "Get the artefacts"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: .
           name: sdk-csharp-${{ inputs.version }}
@@ -349,7 +349,7 @@ jobs:
       contents: read
     steps:
       - name: "Get the artefacts"
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v8
         with:
           path: .
           name: sdk-ts-${{ inputs.version }}
@@ -378,7 +378,7 @@ jobs:
         run: echo "secret_exist=${{ secrets.TEAMS_NOTIFICATION_WEBHOOK_URL != '' }}" >> $GITHUB_OUTPUT
       - name: "Notify on publishing packages"
         if: steps.check.outputs.secret_exist == 'true'
-        uses: nhs-england-tools/notify-msteams-action@v1.0.0
+        uses: nhs-england-tools/notify-msteams-action@v1.0.5
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           teams-webhook-url: ${{ secrets.TEAMS_NOTIFICATION_WEBHOOK_URL }}
@@ -453,7 +453,7 @@ jobs:
   #     contents: read
   #   steps:
   #     - name: "Get the artefacts"
-  #       uses: actions/download-artifact@v6
+  #       uses: actions/download-artifact@v8
   #       with:
   #         path: .
   #         name: libs-letter-${{ inputs.version }}

docs/Gemfile.lock

@@ -105,10 +105,11 @@ GEM
       jekyll-seo-tag (~> 2.1)
     minitest (5.24.1)
     mutex_m (0.2.0)
-    nokogiri (1.18.9-aarch64-linux-gnu)
+    nokogiri (1.19.1-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.18.9-arm64-darwin)
-    nokogiri (1.18.9-x86_64-linux-gnu)
+    nokogiri (1.19.1-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.1-x86_64-linux-gnu)
       racc (~> 1.4)
     pathutil (0.16.2)
       forwardable-extended (~> 2.6)

infrastructure/terraform/components/api/ddb_table_letter_queue.tf

@@ -3,16 +3,16 @@ resource "aws_dynamodb_table" "letter_queue" {
   billing_mode = "PAY_PER_REQUEST"
 
   hash_key  = "supplierId"
-  range_key = "queueTimestamp"
+  range_key = "letterId"
 
   ttl {
     attribute_name = "ttl"
     enabled        = true
   }
 
   local_secondary_index {
-    name            = "letterId-index"
-    range_key       = "letterId"
+    name            = "queueSortOrder-index"
+    range_key       = "queueTimestamp"
     projection_type = "ALL"
   }
 

infrastructure/terraform/components/api/module_lambda_update_letter_queue.tf

@@ -35,7 +35,7 @@ module "update_letter_queue" {
   log_subscription_role_arn = local.acct.log_subscription_role_arn
 
   lambda_env_vars = merge(local.common_lambda_env_vars, {
-    LETTER_QUEUE_TABLE_NAME = aws_dynamodb_table.letter_queue.name,
+    LETTER_QUEUE_TABLE_NAME = "${local.csi}-letter-queue",
     LETTER_QUEUE_TTL_HOURS  = 168 # 7 days
   })
 }
@@ -47,11 +47,12 @@ data "aws_iam_policy_document" "update_letter_queue_lambda" {
 
     actions = [
       "dynamodb:PutItem",
+      "dynamodb:DeleteItem",
     ]
 
     resources = [
-      aws_dynamodb_table.letter_queue.arn,
-      "${aws_dynamodb_table.letter_queue.arn}/index/*"
+      "arn:aws:dynamodb:${var.region}:${var.aws_account_id}:table/${local.csi}-letter-queue",
+      "arn:aws:dynamodb:${var.region}:${var.aws_account_id}:table/${local.csi}-letter-queue/index/*"
     ]
   }
 

internal/datastore/package.json

@@ -1,7 +1,7 @@
 {
   "dependencies": {
     "@aws-sdk/client-dynamodb": "^3.984.0",
-    "@aws-sdk/lib-dynamodb": "^3.984.0",
+    "@aws-sdk/lib-dynamodb": "^3.1008.0",
     "@internal/helpers": "*",
     "pino": "^10.3.0",
     "zod": "^4.1.11",

internal/datastore/src/__test__/db.ts

@@ -129,7 +129,7 @@ const createLetterQueueTableCommand = new CreateTableCommand({
   ],
   LocalSecondaryIndexes: [
     {
-      IndexName: "timestamp-index",
+      IndexName: "queueSortOrder-index",
       KeySchema: [
         { AttributeName: "supplierId", KeyType: "HASH" }, // Partition key for LSI
         { AttributeName: "queueTimestamp", KeyType: "RANGE" }, // Sort key for LSI

internal/datastore/src/__test__/letter-queue-repository.test.ts

@@ -1,3 +1,4 @@
+import { GetCommand } from "@aws-sdk/lib-dynamodb";
 import { Logger } from "pino";
 import {
   DBContext,
@@ -7,8 +8,9 @@ import {
 } from "./db";
 import LetterQueueRepository from "../letter-queue-repository";
 import { InsertPendingLetter } from "../types";
-import { LetterAlreadyExistsError } from "../errors";
+import { LetterAlreadyExistsError } from "../letter-already-exists-error";
 import { createTestLogger } from "./logs";
+import { LetterDoesNotExistError } from "../letter-does-not-exist-error";
 
 function createLetter(letterId = "letter1"): InsertPendingLetter {
   return {
@@ -51,32 +53,19 @@ describe("LetterQueueRepository", () => {
     await db.container.stop();
   });
 
-  function assertTtl(ttl: number, before: number, after: number) {
-    const expectedLower = Math.floor(
-      before / 1000 + 60 * 60 * db.config.letterQueueTtlHours,
-    );
-    const expectedUpper = Math.floor(
-      after / 1000 + 60 * 60 * db.config.lettersTtlHours,
-    );
-    expect(ttl).toBeGreaterThanOrEqual(expectedLower);
-    expect(ttl).toBeLessThanOrEqual(expectedUpper);
-  }
-
   describe("putLetter", () => {
     it("adds a letter to the database", async () => {
-      const before = Date.now();
+      jest.useFakeTimers().setSystemTime(new Date("2026-03-04T13:15:45.000Z"));
 
       const pendingLetter =
         await letterQueueRepository.putLetter(createLetter());
 
-      const after = Date.now();
-
-      const timestampInMillis = new Date(
-        pendingLetter.queueTimestamp,
-      ).valueOf();
-      expect(timestampInMillis).toBeGreaterThanOrEqual(before);
-      expect(timestampInMillis).toBeLessThanOrEqual(after);
-      assertTtl(pendingLetter.ttl, before, after);
+      expect(pendingLetter.queueTimestamp).toBe("2026-03-04T13:15:45.000Z");
+      expect(pendingLetter.visibilityTimestamp).toBe(
+        "2026-03-04T13:15:45.000Z",
+      );
+      expect(pendingLetter.ttl).toBe(1_772_633_745);
+      expect(await letterExists(db, "supplier1", "letter1")).toBe(true);
     });
 
     it("throws LetterAlreadyExistsError when creating a letter which already exists", async () => {
@@ -101,4 +90,48 @@ describe("LetterQueueRepository", () => {
       ).rejects.toThrow("Cannot do operations on a non-existent table");
     });
   });
+
+  describe("deleteLetter", () => {
+    it("deletes a letter from the database", async () => {
+      await letterQueueRepository.putLetter(createLetter());
+
+      await letterQueueRepository.deleteLetter("supplier1", "letter1");
+
+      expect(await letterExists(db, "supplier1", "letter1")).toBe(false);
+    });
+
+    it("throws an error when the letter does not exist", async () => {
+      await expect(
+        letterQueueRepository.deleteLetter("supplier1", "letter1"),
+      ).rejects.toThrow(LetterDoesNotExistError);
+    });
+
+    it("rethrows errors from DynamoDB when deleting a letter", async () => {
+      const misconfiguredRepository = new LetterQueueRepository(
+        db.docClient,
+        logger,
+        {
+          ...db.config,
+          letterQueueTableName: "nonexistent-table",
+        },
+      );
+      await expect(
+        misconfiguredRepository.deleteLetter("supplier1", "letter1"),
+      ).rejects.toThrow("Cannot do operations on a non-existent table");
+    });
+  });
 });
+
+async function letterExists(
+  db: DBContext,
+  supplierId: string,
+  letterId: string,
+): Promise<boolean> {
+  const result = await db.docClient.send(
+    new GetCommand({
+      TableName: db.config.letterQueueTableName,
+      Key: { supplierId, letterId },
+    }),
+  );
+  return result.Item !== undefined;
+}