# Features — unity-lambda-api

Evidence date: 2026-09-30.

Source: `git@bitbucket.org:overdrive/unity-lambda-api.git`, `master` at `fe4b095` (2021-03-17).

"Current" means declared in `serverless.yml` or executed by a handler that file points at. A `.js` file that is not a function there is listed under not deployed. There is no issue tracker or roadmap in the repository, so nothing is marked planned unless a comment describes behaviour the code does not perform.

## Current features

### F-01 — AWS IAM on the HTTP API

Every event in `serverless.yml` sets `authorizer: aws_iam` and `cors: true`. Gateway 4XX and 5XX responses add `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Headers: *` (`resources/api-gateway-errors.yml`).

Status: **current** (template). Confidence: high.

### F-02 — Create a note in DynamoDB

`POST /unity/create` → `create.main`. Stores `content` and `attachment` with `userId` = Cognito identity id and `noteId` = time-based UUID. Table name `loging`.

Origin: starter code in `6cebfe4`, path moved from `POST /unity` to `POST /unity/create` in `19d769f`.

Status: **current**. Confidence: high.

### F-03 — Get a note in DynamoDB

`GET /unity/{id}` → `get.main`. Key is Cognito identity id plus path `id`. Missing item throws `Item not found.`

Origin: `6cebfe4`. Status: **current**. Confidence: high.

### F-04 — Generic SQL action

`POST /unity` → `global.main`. Action `s` selects `data.c` from `data.t`. Action `u` updates that table's columns from `data.c`. Action `i` produces `INSERT INTO ` only. Other actions return the failure payload. Optional join and where append `data.con` after a `.length()` call.

Origin: `19d769f`. Status: **current**, and incomplete relative to its own comment. Confidence: high.

### F-05 — Import endpoint

`POST /unity/import` → `saveimport.main`. Logs the raw body. Does not write to MySQL.

Origin: `19d769f`. Status: **current** as a stub. Confidence: high.

### F-06 — Get one system user by id

`GET /unity/user/{id}` → `getuser.main`. `SELECT * FROM sysUser WHERE UserID = {id}`.

Origin: `6cebfe4`. Status: **current**. Confidence: high.

### F-07 — List system users

`POST /unity/getusers/{id}` → `getusers.main`. `SELECT * FROM sysUser`. Path id is unused. The YAML comment says GET `/unity/users`.

Origin: `646ab62`. Status: **current**. Confidence: high.

### F-08 — Get system user from a JSON body

`POST /unity/getdetails` → `getdetails.main`. `SELECT * FROM sysUser WHERE UserID = {body.id}`.

Origin: `646ab62`. Status: **current**. Confidence: high.

### F-09 — Get system user by Cognito uuid

`GET /unity/uuid/{id}` → `getuseruuid.main`. Filters `sysUser.strCognitoUuid`. Comment says Cognito must be logged in. The route authorizer is `aws_iam`. The handler does not read `cognitoIdentityId`.

Origin: `6cebfe4`. Status: **current**. Confidence: high.

### F-10 — Select all rows of a named table

`POST /unity/tableall` → `tableall.main`. `SELECT * FROM {body.table} WHERE {body.where}`.

Origin: `b4599f0`. Status: **current**. Confidence: high.

### F-11 — Calendar create, read, update, delete

Four POST routes:

- `/unity/addcalendarevent` → `addcalendarevent.js`
- `/unity/getcalendarevents` → `getcalendarevents.js`
- `/unity/updatecalendarevent` → `updatecalendarevent.js`
- `/unity/removecalendarevent` → `removecalendarevent.js`

Table `crmCalendar`. Fields: `txtDescription`, `txtNotes`, `dtStartDate`, `dtEndDate`, `CalendarID`, and since `fe4b095` optional `strFirstUser` and `refSysUserID`. List also reads `userID`. All of those are read from `pathParameters`. The routes do not declare path parameters.

Origin: `b4599f0`, optional columns in `fe4b095`. Status: **current** in source. HTTP reachability of the fields: **requires confirmation**. Confidence: high for the code, low for a live POST.

### F-12 — Request audit log

`logging.js` writes the API event, the SQL, and the result to DynamoDB table `loging`. Called by the routed MySQL handlers other than `saveimport`. Not awaited.

Origin: `6cebfe4`. Status: **current**. Confidence: high.

### F-13 — Local invoke and offline tooling

`serverless-offline` and `serverless-dotenv-plugin` are dev dependencies. The README documents `serverless offline start`, `serverless invoke local`, and `serverless deploy`. Mocks under `mocks/` are Lambda event fixtures (path parameters and/or a string `body`, plus `requestContext.identity.cognitoIdentityId`).

Status: **current** as project tooling from the starter. Confidence: high that the files exist. Confidence unknown that they were used after the starter was forked.

## Changed

| When | What changed |
|---|---|
| `19d769f` (2020-10-14) | `POST /unity` handler changed from `create` to `global`. Create moved to `POST /unity/create`. Import route added |
| `646ab62` (2021-03-11) | `getuserdetails.js` renamed to `getuserdetails_example.js` with no behaviour change in the file (`git` records a pure rename). `getusers` and `getdetails` routes added. `adduser.js` and `updateuser.js` added and not routed |
| `b4599f0` (2021-03-15) | Calendar routes and `tableall` added |
| `fe4b095` (2021-03-17) | Calendar insert and update can include `strFirstUser` and `refSysUserID`. List and delete queries no longer end with a comma inside the statement |

## Not deployed

Present in git, absent from `serverless.yml` `functions`.

| Feature | File | Notes |
|---|---|---|
| Add system user | `adduser.js` | Inserts `strUser` and hard-codes `refSecurityGroupID` to `1`. Mock: `mocks/adduser.json` |
| Rename system user | `updateuser.js` | Sets `strUser` where `strCognitoUuid` matches. Mock: `mocks/updateuser.json` |
| Member roles | `getrole.js` | `tbl_member_role` by `MemberGroupID` |
| Member profile | `getuserdetails_example.js` | Joins member, role, gender, ethnicity, organisation, status, countries, city, identity type, relationship, sports code, positions, address lookups, next of kin, Facebook/Twitter/Instagram, extra member info, media hub, medical aid. Builds profile image URLs on bucket `footprint-reboot-qa-zaf`. S3 `getObject` is commented out. Secondary position join uses `pripos.PositionID` for both joins |
| Save group permissions | `savepermissions.js` | Insert into `tbl_permissions_group`. SQL as written is missing a comma |
| Update group permissions | `updatepermissions.js` | Five flags plus `ModifiedDateTime` and `ModifiedUserID` |
| Upsert member permissions | `updatecustompermissions.js` | Update `tbl_permissions_member` when a row exists, else insert. Insert SQL is not valid as written |
| Set member Cognito uuid | `updateuuid.js` | `UPDATE tbl_member SET CognitoUuid` |
| Starter hello | `handler.js`, `handler copy.js` | Duplicate files. Tested by `tests/handler.test.js`. Not routed |
| Image helper | `libs/images-lib.js` | Empty file since `6cebfe4` |

## Not implemented

Mocks that have no handler. These names show work that was anticipated and not added. They are not features of the running template.

| Mock | Payload shape (values omitted) |
|---|---|
| `mocks/deletepermission.json` | path `id` number |
| `mocks/getallcardpermissions.json` | path `id` string |
| `mocks/getalltypes.json` | path `id` string |
| `mocks/getbyemail.json` | path `id` is an email address |
| `mocks/getfilteredusers.json` | body `union`, `group`, `role`, `search` |
| `mocks/getmoduledetails.json` | body `group`, `module` |
| `mocks/getpermissionmodules.json` | path `id` number |
| `mocks/getpermissions.json` | body `GroupID`, `ModulePermission` |
| `mocks/getuserpermissions.json` | body `GroupID`, `ModulePermission`, `personId` |
| `mocks/listAll.json` | path `id` string |
| `mocks/Untitled-1.json` | Same client/account spreadsheet shape as `mocks/saveimport.json` |

`global.js` comment lists Delete, group, having, and order. The function has no case for them.

`saveimport.js` comment sketches a permissions insert. The function does not run it.

## Removed

Nothing in git history deletes a feature file. The only removal of behaviour is the route move in `19d769f`: `create` stopped owning `POST /unity`. The create behaviour remained on `POST /unity/create`.

`getuserdetails.js` was renamed, not deleted.

## Planned

No roadmap, TODO issue list, or "coming soon" document exists.

The block comment in `global.js` describes a query builder (select, update, insert, delete, columns, values, table, where, joins, group, having, order, user id) that the function does not implement. Treat that comment as **unconfirmed intent**, not as a planned release.

## Deprecated

No file or comment marks a feature deprecated.

`getuserdetails_example.js` is the renamed member query. The `_example` suffix and the fact it was dropped from any route (it was never in `serverless.yml`) indicate it is sample code. That reading is **inferred** from the rename commit message "clean up all apis".

`handler copy.js` is a duplicate of `handler.js`. **Inferred** leftover. Not referenced.

## Recently changed

The last product change is `fe4b095` (2021-03-17): optional calendar columns `strFirstUser` and `refSysUserID`, and small SQL punctuation fixes on list and delete. No commit since that date.