backend api unit test pass

Author: alexnuttall

infrastructure/terraform/modules/backend-api/module_delete_template_lambda.tf

@@ -48,19 +48,6 @@ data "aws_iam_policy_document" "delete_template_lambda_policy" {
     ]
   }
 
-  statement {
-    sid    = "AllowDynamoGSIAccess"
-    effect = "Allow"
-
-    actions = [
-      "dynamodb:Query",
-    ]
-
-    resources = [
-      "${aws_dynamodb_table.templates.arn}/index/QueryById",
-    ]
-  }
-
   statement {
     sid    = "AllowKMSAccess"
     effect = "Allow"

infrastructure/terraform/modules/backend-api/module_get_template_lambda.tf

@@ -40,7 +40,7 @@ data "aws_iam_policy_document" "get_template_lambda_policy" {
     effect = "Allow"
 
     actions = [
-      "dynamodb:BatchGetItem",
+      "dynamodb:GetItem",
     ]
 
     resources = [

infrastructure/terraform/modules/backend-api/module_lambda_process_proof.tf

@@ -51,19 +51,6 @@ data "aws_iam_policy_document" "process_proof" {
     ]
   }
 
-  statement {
-    sid    = "AllowDynamoGSIAccess"
-    effect = "Allow"
-
-    actions = [
-      "dynamodb:Query",
-    ]
-
-    resources = [
-      "${aws_dynamodb_table.templates.arn}/index/QueryById",
-    ]
-  }
-
   statement {
     sid    = "AllowKMSAccess"
     effect = "Allow"

infrastructure/terraform/modules/backend-api/module_lambda_validate_letter_template_files.tf

@@ -55,7 +55,7 @@ data "aws_iam_policy_document" "validate_letter_template_files" {
     effect = "Allow"
 
     actions = [
-      "dynamodb:BatchGetItem",
+      "dynamodb:GetItem",
       "dynamodb:UpdateItem",
     ]
 

infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf

@@ -48,19 +48,6 @@ data "aws_iam_policy_document" "submit_template_lambda_policy" {
     ]
   }
 
-  statement {
-    sid    = "AllowDynamoGSIAccess"
-    effect = "Allow"
-
-    actions = [
-      "dynamodb:Query",
-    ]
-
-    resources = [
-      "${aws_dynamodb_table.templates.arn}/index/QueryById",
-    ]
-  }
-
   statement {
     sid    = "AllowKMSAccess"
     effect = "Allow"

infrastructure/terraform/modules/backend-api/module_update_template_lambda.tf

@@ -48,19 +48,6 @@ data "aws_iam_policy_document" "update_template_lambda_policy" {
     ]
   }
 
-  statement {
-    sid    = "AllowDynamoGSIAccess"
-    effect = "Allow"
-
-    actions = [
-      "dynamodb:Query",
-    ]
-
-    resources = [
-      "${aws_dynamodb_table.templates.arn}/index/QueryById",
-    ]
-  }
-
   statement {
     sid    = "AllowKMSAccess"
     effect = "Allow"

infrastructure/terraform/modules/backend-api/module_upload_letter_template_lambda.tf

@@ -48,20 +48,7 @@ data "aws_iam_policy_document" "upload_letter_template_lambda_policy" {
       aws_dynamodb_table.templates.arn,
     ]
   }
-
-  statement {
-    sid    = "AllowDynamoGSIAccess"
-    effect = "Allow"
-
-    actions = [
-      "dynamodb:Query",
-    ]
-
-    resources = [
-      "${aws_dynamodb_table.templates.arn}/index/QueryById",
-    ]
-  }
-
+  
   statement {
     sid    = "AllowKMSAccess"
     effect = "Allow"

lambdas/backend-api/src/__tests__/templates/infra/template-repository.test.ts

@@ -1,7 +1,6 @@
 import 'aws-sdk-client-mock-jest';
 import { randomUUID } from 'node:crypto';
 import {
-  BatchGetCommand,
   DynamoDBDocumentClient,
   GetCommand,
   PutCommand,
@@ -1162,20 +1161,20 @@ describe('templateRepository', () => {
       expect(owner).toEqual('template-owner');
     });
 
-    it('gets clientId', async () => {
+    it('errors if owner does not start with CLIENT#', async () => {
       const { templateRepository, mocks } = setup();
 
       mocks.ddbDocClient.on(QueryCommand).resolves({
         Items: [
           {
-            owner: 'CLIENT#template-owner',
+            owner: 'NOTCLIENT#template-owner',
           },
         ],
       });
 
-      const owner = await templateRepository.getClientId('template-id');
-
-      expect(owner).toEqual('template-owner');
+      await expect(() =>
+        templateRepository.getClientId('template-id')
+      ).rejects.toThrow('Unexpected owner format NOTCLIENT#template-owner');
     });
 
     it('errors when owner cannot be found', async () => {

lambdas/backend-api/src/templates/infra/template-repository.ts

@@ -311,6 +311,7 @@ export class TemplateRepository {
         const { Items = [], LastEvaluatedKey } = await this.client.send(
           new QueryCommand(input)
         );
+
         input.ExclusiveStartKey = LastEvaluatedKey;
         items.push(...(Items as DatabaseTemplate[]));
       } while (input.ExclusiveStartKey);