# Features — DoctorX_lambda_api_Josh

Evidence date: 2026-10-16.

Source: `git@bitbucket.org:overdrive/doctorx_lambda_api_josh.git`, `master` at `40da799` (2021-04-30).

"Current" means declared in `serverless.yml` or executed by a handler that file points at. A `.js` file that is not a function there is listed under not deployed. There is no issue tracker or roadmap in the repository, so nothing is marked planned unless a comment describes behaviour the code does not perform.

## Current features

### F-01 — AWS IAM on the HTTP API

Every event in `serverless.yml` sets `authorizer: aws_iam` and `cors: true`. Gateway 4XX and 5XX responses add `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Headers: *` (`resources/api-gateway-errors.yml`).

Status: **current** (template). Confidence: high.

### F-02 — Create a doctor

`POST /josh/create` → `adduser.main`. Inserts into `crmDoctors` the columns listed in the PRD workflow WF-1. `dtCreated` is set in the function. Optional columns: `DoctorID`, `strUserCreatedName`, `strCity`, `refUserID`.

Origin: `adduser.js` kept and edited in `df3b05d`. Path became `josh/create` in `1e5f62e`. Table spelling `crmDoctors` in `d7aa39d`. Optional fields expanded in `ee3e70e` and `358b75a`.

Status: **current**. Confidence: high.

### F-03 — List doctors

`POST /josh/getusers` → `getusers.main`. `SELECT * FROM crmDoctors`. No `WHERE`, no limit. The mock path `id` is unused.

Origin: present as a Josh route by `ddd3f2a`. Path parameter `{id}` removed by `1e5f62e`.

Status: **current**. Confidence: high.

### F-04 — Get a doctor by id

`POST /josh/get` → `getdetails.main`. `SELECT * FROM crmDoctors WHERE DoctorID = {parameters.id}` with the id not quoted.

Origin: path moved from `josh/getdetails` to `josh/get/{id}` in `1e5f62e`, then to `josh/get` in `bc2666e`.

Status: **current**. Confidence: high.

### F-05 — Get doctors by email

`POST /josh/getuuid` → `getuseruuid.main`. `SELECT * FROM crmDoctors WHERE strEmail = "{parameters.strEmail}"`.

The Serverless comment still says Cognito must be logged in and that the path is `/josh/getuseruuid`. The handler does not read the Cognito identity and does not filter a uuid column.

Origin: route renamed to `josh/getuuid` in `e6d1255` (then still `/{id}`). Path parameter removed in `bc2666e`. Email filter written in `414737d`.

Status: **current**. The name and the filter disagree. Confidence: high.

### F-06 — Update a doctor

`POST /josh/update` → `updateuser.main`. Sets any of `DoctorID`, `strName`, `strSurname`, `strEmail`, `strCity`, `strRole`, `dtLastLoggedIn`, `refUserID` that were sent. `id` is copied to `DoctorID` before that. The `WHERE` uses `strEmail` when email was sent, otherwise `DoctorID`.

The query result is shadowed by an inner `let`, so the HTTP wrapper returns the failure payload `false` after a query that did not throw. See PRD WF-5.

Origin: path `josh/update/{id}` in `1e5f62e`, path parameter removed in `bc2666e`. Field list expanded in `ee3e70e`.

Status: **current**. Confidence: high.

### F-07 — Diagnose stub

`POST /josh/diagnose` → `postxray.main`. Returns one fixed `result` string. Does not open MySQL. Does not read `type`, `model`, or `xray` from the mock.

Origin: `removecalendarevent.js` renamed to `postxray.js` in `df3b05d`. Path changed from `josh/postxray` to `josh/diagnose` in `1e5f62e`.

Status: **current** as a stub. Confidence: high.

### F-08 — DynamoDB audit put

`logging.js` puts `userID`, `logID`, `event`, `query`, `result`, and `createdAt` on table name `loging`. Each routed handler calls it. The call is not awaited.

Status: **current**. Confidence: high.

### F-09 — Local invoke mocks

`mocks/adduser.json`, `getdetails.json`, `getusers.json`, `getuseruuid.json`, `updateuser.json`, and `postxray.json` each have `pathParameters` and `requestContext` and no `body`.

Path keys:

| Mock | Path keys |
|---|---|
| `adduser.json` | `strName`, `strSurname`, `strEmail`, `strRole` |
| `getdetails.json` | `id` |
| `getusers.json` | `id` |
| `getuseruuid.json` | `strEmail` |
| `updateuser.json` | `strName`, `DoctorID` |
| `postxray.json` | `type`, `model`, `xray` |

The live routes at the tip do not declare `{id}` or other path parameters, so these files match `serverless invoke local` more closely than API Gateway path mapping.

Status: **current** files. Confidence: high.

### F-10 — Placeholder unit test

`tests/adduser.test.js` asserts that the number `4000` equals `4000`. It does not import `adduser.js`. A local `storage` variable is unused. `package.json` script `test` is `serverless-bundle test`.

`tests/handler.test.js` (starter hello test) was deleted in `2f894ba`.

Status: **current** file, not a test of the API. Confidence: high.

## Not deployed

### F-11 — Generic SQL action

`global.js` implements action codes `s`, `u`, and `i` as described in PRD WF-7. It is not a function in `serverless.yml` at `40da799`.

It was on `POST /josh` in `e6d1255` and removed from the template in `bc2666e`. The file stayed.

Status: **not deployed**. Confidence: high.

### F-12 — Unused libraries

`libs/dynamodb-lib.js` exports get, put, query, update, and delete. No file imports it. `logging.js` constructs its own document client.

`libs/images-lib.js` is an empty file.

Status: **not deployed**. Confidence: high.

## Removed features

Removed in `df3b05d` (2021-03-29) from the Unity tree that `7a24423` committed. They are not on `master` now.

| Removed | What it was in `7a24423` |
|---|---|
| `create.js`, `get.js` | DynamoDB note create and get |
| `handler.js` | Starter `hello` |
| `saveimport.js` | Import route that logged the body |
| `getuser.js`, `getrole.js`, `getuserdetails_example.js` | `sysUser` / role / example details |
| `tableall.js` | Caller-named table select |
| `addcalendarevent.js`, `getcalendarevents.js`, `updatecalendarevent.js` | `crmCalendar` |
| `removecalendarevent.js` | Renamed to `postxray.js`, not kept as calendar delete |
| `savepermissions.js`, `updatepermissions.js`, `updatecustompermissions.js`, `updateuuid.js` | Permission and uuid updates |
| `env.example` | Starter sample environment file |
| Unity mocks and `tests/handler.test.js` | Deleted in `2f894ba` |

`global.js` was deleted in `df3b05d` and added again in `e6d1255`. The file is present. The route is not.

## Planned

No roadmap, TODO issue list, or commented future route was found.

The comment `//evaluate upload here` in `postxray.js` describes work the function does not do. That is a discrepancy, not a scheduled feature.

## Recently changed

Relative to the Unity-shaped tree at `7a24423`, the tip has the six Josh routes, service name `josh-lambda-api`, and table `crmDoctors`. The last behaviour edits are `414737d` (service rename and email lookup) and `358b75a` (small `adduser.js` change) on 2021-04-29 and 2021-04-30. Nothing in git is newer.

## Deprecated

Nothing is marked deprecated in code or docs. The README `hello` demo and the YAML comments that still name `/josh/adduser`, GET, and `/josh/postxray` are stale labels on current routes, not separate deprecated endpoints.