# Project plan — intersect_lambda

Evidence date: 2026-10-12.

Source repository: `git@bitbucket.org:overdrive/intersect_lambda.git`, branch `main` at `5f2193a` (2024-12-13, "updated code"). `origin/HEAD` points at `main`. No other branches exist on the remote.

This plan describes what the repository contains. It does not decide what the product should become.

There is no prior Silicon Ark directory for this project. `Lambda/README.md` and `prod/README.md` are the AWS SAM hello-world starter. They describe a `HelloWorldFunction`, a `hello-world/` folder, and Mocha tests. None of those exist. Where a README disagrees with the templates or handlers, the templates and handlers are the implemented behaviour.

## Product

**Inferred.** A serverless email sender for Simpleflow / Intersect Cloud. It reads unsent rows from a Supabase table named `send_que` and delivers them through Amazon SES. A second function accepts an HTTP request and sends one HTML email immediately.

The CloudFormation description on the `Lambda/` stack is `Simpleflow`. The direct-send function uses the sender `no-reply@simpleflowhub.app`. Parameter names use the prefix `intersectcloud`. The repository name is `intersect_lambda`. No product brief in the repository ties those three names together.

**Unknown / Requires Confirmation:** whether this repository is still the live mailer, which product inserts `send_que` rows, and whether `Lambda/` and `prod/` are development and production or two unrelated stacks.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `main` | `5f2193a` | 2024-12-13 | Only branch. Nine commits from `57d0999` (2024-09-30, "Initial commit") |

Authors recorded in git: Jaco Brits (`26005da`, `d20b7f4`, `57d0999`, `8eb500d`) and Dirk `dirk@overdrive.co.za` (`0cf1d2f`, `54dcc1c`, `ff6800d`, `0b5cd27`, `5f2193a`).

The task-creation scan (2026-09-28) listed `sonarqube_scan.bat` at the repository root. That file is not in `main`, and `git log --all -- sonarqube_scan.bat` is empty. Provenance: **Unknown** — it may have been an untracked file on the scan host.

## Scope in the repository

In scope of what is implemented on `main`:

- Two AWS SAM applications: `Lambda/` (stack name `Simpleflow`) and `prod/` (stack name `prod`).
- `SendMailFunction` in `Lambda/` only: `POST /sendmail` and `OPTIONS /sendmail`, sending one HTML message through the SES API.
- `SendQueFunction` in both stacks: read up to 15 `send_que` rows with `status` 0, send them by SES SMTP, write `status` and `result` back.
- A one-minute EventBridge schedule on both queue functions. The `Lambda/` queue function also has `POST /sendque` and `OPTIONS /sendque`. The `prod/` queue function does not.
- IAM permission to read named SSM parameters and `AmazonSESFullAccess`.
- Bitbucket Pipelines running a SonarQube scan on `main`. No deploy step.

Out of scope of this repository (not present in the tree):

- The Supabase project, the `send_que` table definition, and whatever inserts rows.
- SES domain identity, SMTP credentials, and the verified sender.
- The caller of `POST /sendmail`.
- Infrastructure as code for the VPC, API custom domain, alarms, or a deployment pipeline.
- Unit tests. `package.json` points at `tests/unit/`, `.npmignore` ignores `tests/*`, and no `tests/` directory is committed.

## System architecture

```text
Caller (unknown)                EventBridge rate(1 minute)
        |                                  |
        | POST /sendmail                   |  (and, on Lambda/ only, POST /sendque)
        v                                  v
 API Gateway (implicit, Lambda/ stack)   SendQueFunction
        |                                  |
        v                                  | SSM GetParameter (eu-west-1)
 SendMailFunction                          v
        |                          Supabase  -- table send_que
        | SES API SendEmail                 |
        v                                   | SES SMTP :587
 Amazon SES (eu-west-1) <------------------+
```

`prod/` has no API Gateway resources. Its only trigger is the schedule.

Both templates set JSON Lambda logs. Neither template creates a database, a queue, an S3 bucket, or a custom domain.

Account IDs are embedded in the SSM resource ARNs:

| Stack | Folder | Stack name in `samconfig.toml` | Account in the ARNs |
|---|---|---|---|
| Simpleflow | `Lambda/` | `Simpleflow` | `021891581915` |
| prod | `prod/` | `prod` | `761018868594` |

Region is not set in either `samconfig.toml`. Every region literal in the handlers and every SSM ARN is `eu-west-1`. **Inferred** deploy region: `eu-west-1`. **Requires confirmation** of the account and region actually used at deploy time.

## Major components

| Component | Where | Role |
|---|---|---|
| `SendMailFunction` | `Lambda/send-mail/app.mjs`, `Lambda/template.yaml` | Immediate HTML email. Not in `prod/` |
| `SendQueFunction` | `Lambda/send-que/app.mjs` and `prod/sendque/app.mjs` | Drain `send_que`. The two copies are not the same |
| SAM templates | `Lambda/template.yaml`, `prod/template.yaml` | Functions, API events, schedule, IAM |
| Stale copies | `Lambda/send-que/app copy.mjs`, `prod/template copy.yaml` | Not referenced by SAM. See features |
| SonarQube pipeline | `bitbucket-pipelines.yml`, `sonar-project.properties` | Scan on push to `main`. Does not deploy |

## Milestones visible in git

| Date | Commit | What changed |
|---|---|---|
| 2024-09-30 | `57d0999`, `d20b7f4`, `26005da` | Empty initial commit, Sonar project key, Bitbucket Pipelines Sonar step |
| 2024-09-30 | `0cf1d2f` | `SendMailFunction`, `POST` and `OPTIONS /sendmail`, stack description Simpleflow |
| 2024-09-30 | `54dcc1c` | VPC config added under `Lambda/` globals, commented out. Comment says the security group needs to be created |
| 2024-10-01 | `8eb500d` | `SendQueFunction` on the Simpleflow stack: Supabase, SES SMTP, `POST`/`OPTIONS /sendque`, schedule `rate(1 minute)`, batch of 15 |
| 2024-11-15 | `ff6800d` | `prod/` stack added. Schedule only. Application Insights resources and hello-world outputs included |
| 2024-11-15 | `0b5cd27` | Those Application Insights resources and hello-world outputs commented out the same day |
| 2024-12-13 | `5f2193a` | Simpleflow queue reads the no-reply address from SSM and sets `status` 2 when send throws. Prod queue switches its Supabase service-role parameter to `/Supabase-Simpleflow-Production/JwtSecret/ServiceRoleKey` |

No commits after 2024-12-13. There is no roadmap, milestone list, or open-issue file in the repository.

## Implementation plan

There is no forward plan in the repository. The sequence above is the history of what was committed. Nothing in git describes a next release.

The VPC block, Application Insights resources, and hello-world outputs are commented. That is not evidence of a dated plan to turn them back on.

## Known dependencies

Runtime libraries, from the three `package.json` files:

- `@aws-sdk/client-ses` on all three functions. Only `send-mail/app.mjs` imports it.
- `@supabase/supabase-js` `^2.0.0`, `nodemailer` `^6.7.0`, and `aws-sdk` `^2.1691.0` on both queue functions.
- `@aws-sdk/client-ssm` is listed on both queue functions. The handlers call SSM through `aws-sdk` v2, not this client.
- `axios` is listed on all three functions. No handler imports it.
- `mocha` and `chai` are devDependencies. No test files are committed.

External systems the handlers call: Amazon SES, AWS SSM Parameter Store, Supabase, and (on `Lambda/` only) API Gateway plus EventBridge. EventBridge is also the `prod/` trigger.

Tooling named by the starter READMEs: SAM CLI, Node.js 20, Docker. The READMEs are starter text. `samconfig.toml` in both apps shows `sam deploy` has been configured (`CAPABILITY_IAM`, `confirm_changeset = true`, `resolve_s3 = true`). Whether a deploy succeeded is not in git.

## Current project status

**Implemented** in git, last changed 2024-12-13. Single branch `main`. No deployment workflow. No tests. Two stacks that implement the same queue with different failure behaviour and different Supabase keys.

**Unknown / Requires Confirmation:** whether either CloudFormation stack is still deployed, and whether anyone still writes to `send_que`.

## Human confirmation

1. Are `Lambda/` (account `021891581915`, stack `Simpleflow`) and `prod/` (account `761018868594`, stack `prod`) the intended non-production and production stacks, and are they deployed?
2. Which system inserts `send_que` rows, and which status values does that system understand?
3. Is the prod behaviour of leaving a failed send at `status` 0 intentional? The Simpleflow queue sets `status` 2.
4. Should `POST /sendmail` and `POST /sendque` stay unauthenticated?
5. Is `sonarqube_scan.bat` expected? It is not in git.