# Project plan — DoctorX_lambda_api_Josh

Evidence date: 2026-10-16.

Source repository: `git@bitbucket.org:overdrive/doctorx_lambda_api_josh.git`.

Inspected revision: `master` at `40da799` (2021-04-30, Jaco Brits, "Merge branch 'master' of https://bitbucket.org/overdrive/doctorx_lambda_api_josh"). The scan-host path `~/projects/sonar_scan/repos/DoctorX_lambda_api_Josh` was not on this machine. The tree below was read from that git revision. No database password is stored in git. Mock files contain a `requestContext`; those identity values are omitted here.

This plan describes what the repository contains. It does not decide what the product should become.

There is no product requirements document in the source repository and no prior Silicon Ark set for this directory. The first line of `README.md` is "DoctorX lambda api (josh)". The rest of `README.md`, `package.json` (name `serverless-nodejs-starter`, version `1.1.0`), and `LICENSE` (MIT, copyright 2017 Anomaly Innovations) are the upstream [Serverless Node.js Starter](https://github.com/AnomalyInnovations/serverless-nodejs-starter). They describe a `hello` demo that is not in this tree.

Silicon Ark already documents `unity-lambda-api`. The first full commit of this repository (`7a24423`) was that Unity service (`service: unity-lambda-api`, Unity routes). Current `serverless.yml` names the service `josh-lambda-api` and still sets AWS profile `unity`. Whether the two repositories share an AWS account, a database, or a product owner is **Unknown / Requires Confirmation**.

## Product

**Documented** only by the README title and by comments in `serverless.yml`.

**Inferred** from the table `crmDoctors` and the routes under `/josh`: an AWS API that creates, lists, reads, and updates doctor rows in MySQL, writes an audit item to DynamoDB, and exposes one diagnose route that does not read the database.

**Implemented.** Six HTTP functions in `serverless.yml`. `global.js` is in the tree and is not a function in that file.

No written statement of product purpose, owner, audience, or success criteria was found.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `40da799` | 2021-04-30 | Only branch. 28 commits from 2021-03-17 to 2021-04-30 |

No other local or remote branches were present at inspection. Nothing in git is dated after 2021-04-30. Whether the API is still deployed is **Unknown / Requires Confirmation**.

Authors on that history: Joshua Gatley-Dewing and Jaco Brits.

| Commit | Date | Author | Subject | What it changed for this plan |
|---|---|---|---|---|
| `c337587` | 2021-03-17 | Joshua Gatley-Dewing | Initial commit | `.gitignore` only |
| `7a24423` | 2021-03-17 | Joshua Gatley-Dewing | Initial commit | Unity lambda tree: service `unity-lambda-api`, notes, `sysUser`, calendar, permissions, generic SQL |
| `df3b05d` | 2021-03-29 | Joshua Gatley-Dewing | Lambda cleanup and initial code | Removed the Unity handlers. `removecalendarevent.js` became `postxray.js`. `adduser.js` and `updateuser.js` kept |
| `ddd3f2a` | 2021-03-31 | Joshua Gatley-Dewing | API changes | Paths move from `/unity/...` to `/josh/...`. Service name still `unity-lambda-api` |
| `2f894ba` | 2021-04-01 | Joshua Gatley-Dewing | Mocks cleanup and API Fixes | Unity mocks and `tests/handler.test.js` deleted |
| `d7aa39d` | 2021-04-06 | Joshua Gatley-Dewing | Fix table name | SQL table `crmdoctors` renamed to `crmDoctors` |
| `1e5f62e` | 2021-04-06 | Joshua Gatley-Dewing | Lambda changes | Create path becomes `josh/create`. Diagnose path becomes `josh/diagnose` |
| `576ae9d` | 2021-04-06 | Jaco Brits | updates to yarn and serverless | `global` removed from `serverless.yml`. Yarn lockfile touched |
| `e6d1255` | 2021-04-13 | Joshua Gatley-Dewing | change uuid route | `global.js` added back. UUID path becomes `josh/getuuid/{id}` |
| `bc2666e` | 2021-04-14 | Joshua Gatley-Dewing | Lambda changes | `global` removed from the template again. Path parameters dropped from update, get, and getuuid |
| `414737d` | 2021-04-30 | Jaco Brits | old changes | Service renamed `josh-lambda-api`. `getuseruuid.js` rewritten to filter `strEmail` |
| `40da799` | 2021-04-30 | Jaco Brits | Merge branch 'master' | Tip. Same six routes as `414737d` |

## Objectives

No objectives file exists. The behaviour the later commits left in place:

1. Insert, list, read, and update rows in `crmDoctors`.
2. Accept AWS IAM on every HTTP event.
3. Record the event, the SQL string, and the query result in DynamoDB table name `loging`.
4. Answer `POST /josh/diagnose` with a fixed string. The MySQL client in `postxray.js` is commented out.

## Scope

### In scope of `master` at `40da799`

- `serverless.yml` service `josh-lambda-api`: Node.js 12.x, stage `prod`, region `eu-west-1`, AWS CLI profile `unity`, 512 MB, IAM authorizer on every HTTP event, CORS enabled.
- Six functions declared in that file (see the route table in `technical-documentation.md`).
- MySQL connection settings from environment names `DBHOST`, `DBUSERNAME`, `DBPASSWORD`, `DBNAME`, mapped to `databaseHost`, `databaseUser`, `databasePass`, `databaseName`.
- DynamoDB IAM for `arn:aws:dynamodb:eu-west-1:*:*` and table name `loging`.
- `global.js`, which is not declared as a function.
- `mocks/` for local invoke. `tests/adduser.test.js`, which does not call `adduser.js`.
- API Gateway 4XX/5XX CORS responses in `resources/api-gateway-errors.yml`.

### Out of scope / not in this repository

- The MySQL server, schema, and migrations. Table and column names appear only inside SQL strings.
- The DynamoDB table resource. No `AWS::DynamoDB::Table` is defined.
- Cognito user pool or identity pool. Comments on `getuseruuid` and `diagnose` say "cognito must be logged in". The authorizer in YAML is `aws_iam`. No Cognito resource is in the template.
- VPC. The security-group and subnet block is commented out.
- A pipeline, Dockerfile, or custom domain.
- The caller (web app or other service). Not named in this tree.
- Real `.env` values. `.env` and `env.yml` are gitignored. `env.example` was deleted in `df3b05d` and is not at the tip.
- `sonar-project.properties` and `sonarqube_scan.bat`. The onboarding issue listed both in the scan-host working tree on 2026-09-28. Neither file is in `git ls-files` at `40da799`. They were not read.

## System shape

```text
Caller (unknown)
    |  AWS IAM (authorizer: aws_iam)
    v
API Gateway   service josh-lambda-api
stage prod    region eu-west-1    memory 512 MB    runtime nodejs12.x
    |
    +-- adduser, getusers, updateuser, getdetails, getuseruuid --> MySQL table crmDoctors
    +-- postxray (diagnose) ------------------------------------> fixed string, no SQL
    |
    +-- logging.js (from every routed handler) --> DynamoDB table name "loging"
         put is not awaited
```

`global.js` can build a SQL string and is not on this diagram as a route.

## Milestones

There is no milestone document. The history above is the implementation record. No open branch continues it.

## Implementation plan

No forward plan is in the repository. The current implementation, as the code stands, is the six POST routes, the MySQL statements in those handlers, and the DynamoDB audit put.

## Known dependencies

| Dependency | Where | Role |
|---|---|---|
| Serverless Framework | `serverless.yml`, README | Package and deploy. The CLI version is not pinned in the repo |
| `serverless-bundle` `^1.2.5` | devDependency | Webpack package, ESLint, Jest via `npm test` |
| `serverless-offline` `^5.3.3` | devDependency | Local API Gateway |
| `serverless-dotenv-plugin` `^2.1.1` | devDependency | Load `.env` |
| `serverless-mysql` `^1.5.4` | dependency | MySQL |
| `uuid` `^7.0.3` | dependency | `logID` in `logging.js` (`uuid.v1`) |
| `aws-sdk` `^2.706.0` | devDependency | DynamoDB document client in `logging.js` and `libs/dynamodb-lib.js`. The Node.js 12 Lambda runtime also supplies `aws-sdk` |
| API Gateway, Lambda, IAM, DynamoDB | `serverless.yml` | Runtime platform |
| MySQL | handlers | `crmDoctors`. Host is not in git |

Both `package-lock.json` and `yarn.lock` are committed. Which installer this team used last is **Unknown / Requires Confirmation**. `576ae9d` says "updates to yarn and serverless".

## Current project status

**Implemented** as a Serverless service whose last commit is 2021-04-30. Source of that status: git history and `serverless.yml`.

**Not established:** deployment, the public URL, the database host, whether `crmDoctors` still exists, who calls the API, and whether the diagnose stub was ever replaced outside this repository.

## Human confirmation

1. Is `josh-lambda-api` still deployed, and what is the public base URL?
2. Is this the DoctorX product, a Josh experiment, or a fork of `unity-lambda-api` that should be retired?
3. Does AWS profile `unity` mean the Unity account?
4. What is the `crmDoctors` schema (primary key, unique email, other columns)?
5. What does `refUserID` point at?
6. Should `POST /josh/diagnose` stay a stub?
7. Were `sonar-project.properties` and `sonarqube_scan.bat` local-only files on the scan host?