# Features — lambda_java

Evidence date: 2026-10-10. Source: `main` at `7055717`.

Status values: **Current** (template event and handler class both exist), **Present, not triggered** (class or function resource exists without an active event), **Mismatch** (template names a class that is not in source), **Stock sample** (AWS SAM readme, not this product).

## Current HTTP features

Default authorizer is `MyAuthorizer` unless a method overrides it. No method in the template sets a different authorizer. CORS origin is `*`.

| Path | Methods | Lambda logical id | Handler | What it does |
|---|---|---|---|---|
| `/gettoken` | GET | `GetToken` | `handlers.GetToken` | **Mismatch.** Class is not in the tree. |
| `/tokencheck` | GET | `TokenCheck` | `TokenCheck` | Echoes query `access_token` or the text `Access token is missing`. Does not call I&M. |
| `/statementdata` | GET, POST, OPTIONS | `StatementData` | `SanlamStatementData` | Sanlam statement data. |
| `/subgroupmembers` | GET | `SubGroupMembers` | `SanlamSubGroupMembers` | POST `http://105.27.230.181:3002/subGroupMembers` via `SubGroupMember`. |
| `/requestotp` | GET, POST, OPTIONS | `RequestOTP` | `OTPRequest` | GET I&M OTP URL from SSM, bearer token from body. |
| `/validateotp` | GET, POST, OPTIONS | `ValidateOTP` | `ValidateOTP` | POST OTP code to I&M. |
| `/accountbalance` | GET | `AccountBalance` | `AccountBalance` | GET a fixed Sanlam UAT balance URL. Request is ignored. Account number is a source literal. |
| `/serviceagreement` | GET, POST, OPTIONS | `ServiceAgreement` | `ServiceAgreement` | I&M service agreement and agreement context. |
| `/profileimage` | POST, OPTIONS | `ProfileImage` | `ProfileImageRetrieval` | I&M profile image URL from SSM. |
| `/createuser` | GET, POST, OPTIONS | `CreateUser` | `UserCreation` | Insert or update `user`; on insert, add `sanlam_link`. |
| `/getuser` | GET, POST, OPTIONS | `GetUser` | `UserRetrieval` | Select user by `user_name`, left join `sanlam_link`. |
| `/transaction` | GET, POST, OPTIONS | `PostTransaction` | `Transaction` | Insert `transaction`, return generated id. |
| `/updatetransaction` | GET, POST, OPTIONS | `PostUpdateTransaction` | `TransactionUpdate` | Set `transaction.process`. |
| `/gettransaction` | GET, POST, OPTIONS | `GetTransactions` | `TransactionsRetrieval` | Select transactions by `im_customer_identifier`. |
| `/usertoken` | GET | `UserToken` | `UserToken` | Sanlam client login, then statement data for member `00638`. |
| `/dailyyield` | GET, POST, OPTIONS | `DailyYield` | `SanlamDailyYield` | Sanlam yield from SSM `Sanlam_Yield`. |
| `/initiatepayment` | GET, POST, OPTIONS | `InitiatePayment` | `InitiatePayment` | I&M utility payment. Timeout 45 seconds. |
| `/preferred2fa` | GET, POST, OPTIONS | `Preferred2FA` | `Preferred2FA` | I&M preferred 2FA URL from SSM. |
| `/imstatement` | GET, POST, OPTIONS | `IMStatement` | `IMStatement` | Statements via SSM `Sanlam_Get_Customer_Statements`. |
| `/sanlamgettoken` | GET | `SanlamGetToken` | `SanlamTokenRetrieval` | Sanlam consumer-key token. Taxable branch only. |
| `/sanlampurchaseflow` | GET, POST, OPTIONS | `SanlamPurchaseFlow` | `SanlamPurchaseFlow` | Allocate member if needed, create Sanlam customer, create purchase, mark transaction `complete`. |
| `/sanlamwithdrawalflow` | GET, POST, OPTIONS | `SanlamWithdrawalFlow` | `SanlamWithdrawalFlow` | Create withdrawal, mark transaction `complete`. |
| `/getsanlammembers` | GET, POST, OPTIONS | `GetSanlamMembers` | `SanlamMembers` | Local member numbers for `user_name`, then Sanlam member details and balance. |
| `/sanlamwitdrawalcharge` | GET, POST, OPTIONS | `GetSanlamWithdrawalCharges` | `SanlamWithdrawalCharges` | Sanlam withdrawal charges. Path spelling is `witdrawal`. |
| `/sanlamaccountbalance` | GET, POST, OPTIONS | `GetSanlamAccountBalance` | `SanlamAccountBalance` | Sanlam balance via SSM `Sanlam_Get_Account_Balance`. Distinct from `/accountbalance`. |
| `/imgetcustomer` | GET, POST, OPTIONS | `IMGetCustomer` | `IMCustomerRetrieval` | I&M customer details. Uses hardcoded hosts in `IMUserDetails`. |
| `/imaccess` | GET, POST, OPTIONS | `IMAccess` | `IMAccess` | I&M access control. CIF substitution is an empty string. |
| `/logerror` | GET, POST, OPTIONS | `LogError` | `ErrorLogger` | HTTP error log. |
| `/checkwhitelist` | GET, POST, OPTIONS | `CheckWhiteList` | `WhiteListChecker` | `white_listed` lookup by CIF. |
| `/getsettings` | GET | `GetSettings` | `SettingRetrieval` | `settings` lookup by query `setting`. |
| `/createsession` | GET, POST, OPTIONS | `CreateSession` | `SessionCreation` | Insert `sessions`. |
| `/updatesession` | GET, POST, OPTIONS | `UpdateSession` | `SessionUpdate` | Set `logout_time`. |
| `/imgetaccounts` | GET, POST, OPTIONS | `IMGetAccounts` | `IMAccountsRetrieval` | I&M accounts and balances from SSM. |

Source of the route table: `IM-CAPITAL-BACKEND-SERVICE/template.yaml`.

## Current non-HTTP features

| Feature | Trigger | Code | Status |
|---|---|---|---|
| Request authorizer | API Gateway REQUEST authorizer, header `Authorization` | `handlers/Authorizer` | **Current** |
| Hourly SQS drain to S3 | `rate(1 hour)` on `SQSLogToFile` | `SQSLogToFile` → `SQSLog.getLog` | **Current** |
| Enqueue error log | Called from `UserCreation` and `Transaction` catch blocks | `SQSLogCreation`, queue `log_queue` | **Current** as a side effect, not its own route |
| MySQL connection | Every DB handler | `ConnectionRetriever`, `Secret` | **Current** |
| SSM lookup | Integration helpers | `Parameter` | **Current** |
| Payment checksum | Inside payment initiation | `CheckSum` | **Current** |

## Present, not triggered

| Item | Evidence | Notes |
|---|---|---|
| `WriteLogs` / `WriteS3Logs` | Template resource exists. `Events` schedule is commented out. | Function would exist after deploy and would not run on a timer. |
| `LogS3Error` / `ErrorLoggerS3` | Template resource, no `Events`. | Same. |
| `handlers/SQSLogCreate` | No template resource. | Not an API. |
| `handlers/SanlamCustomerCreation` | No template resource. | Purchase flow uses `function/SanlamCustomerCreation` instead. |
| `handlers/TokenRetrieval` | No template resource. `GetToken` points at a missing class. | `TokenRetrieval` calls `AccessToken` (Keycloak password/client grant in `AccessToken.java`). |
| `function/SanlamUserCreation` | Hardcoded `http://api-uat.sanlameastafrica.com/im/api/customer`. | Not referenced by the purchase flow, which uses SSM `Sanlam_Create_Customer`. |
| `function/IMPaymentInitiation` | SSM `IM_Initiate_payment`. | `/initiatepayment` uses `PaymentInitiation` and SSM `Initiate_Payment`. |
| `function/Logs` | `SELECT * FROM log`. | Different table name from `logs`. No handler found that calls it. |
| `io/AuthPolicy`, `io/TokenAuthorizerContext` | Classes only. | `Authorizer` builds its own policy map. |
| `entity/Customer`, `OutputCustomer`, `PostalAddress` | Jackson fields for an I&M customer. | Used by customer parsing. Not an API of their own. |
| Application Insights | Commented YAML at the bottom of `template.yaml`. | Not deployed by this template. |

## Stock sample, not a product feature

| Item | Evidence |
|---|---|
| Hello World deploy guide | `IM-CAPITAL-BACKEND-SERVICE/README.md` |
| Commented outputs `HelloWorldApi`, `HelloWorldFunction` | End of `template.yaml` |
| IntelliJ module `HelloWorldFunction/IM-CAPITAL.iml` | Under `.aws-sam/build` |

## Planned

The only future-tense notes in code:

| Note | Where | Status |
|---|---|---|
| "will change depending on user type" next to `boolean taxable = true` | `SanlamTokenRetrieval` | **Planned** only as a comment. The flag does not read the user. |
| "this will need to change to the account that is provided by I&M" | `PaymentInitiation` biller account | **Planned** only as a comment. |
| "replace when resp works" on empty CIF | `IMAccessControl` | **Planned** only as a comment. |
| "Replace with actual account number" | `AccountBalance` | The replacement is not implemented. A literal remains. |

No issue tracker, roadmap, or TODO file was found.

## Recently changed

Git has no commits after 2024-06-24. The only product change is `7055717` (`init`), which added the service in one commit. There is no removed-feature history inside the Java tree.

## Deprecated / removed

Nothing in git deletes a previous IM Capital feature. The hello-world README and commented SAM outputs are leftovers of the SAM sample, not a removed product feature.

## Tests as features

JUnit tests exist beside almost every handler and function (`src/test/java/co/ke/imcapital`). They mock collaborators. They were not executed for this document. The README test command (`cd HelloWorldFunction && mvn test`) does not match the module path `IM-CAPITAL-BACKEND-SERVICE/IM-CAPITAL-BACKEND-SERVICE`.

`events/event.json` and `src/test/java/resources/event.json` are sample API Gateway events. They contain bearer tokens and personal identifiers. Those values are omitted from Silicon Ark.