# Project plan — unityAWS

Evidence date: 2026-09-30.

Source repository: `git@bitbucket.org:overdrive/unityaws.git`.

Inspected revision: `master` at `e9f10da` (2019-10-08, siliconoverdrive, "zero out response"). The scan-host path `~/projects/sonar_scan/repos/unityAWS` was not on this machine. The tree below was read from that git revision. The database password in `config.py` is committed in source, in `lambda.zip`, and in `__pycache__/config.cpython-37.pyc`. It is omitted here.

This plan describes what the repository contains. It does not decide what the product should become.

There is no product requirements document in the source repository and no prior Silicon Ark set for this directory. `README.md` is the heading `# unityAWS` and nothing else.

## Product

**Inferred** from the Lambda name `qaFunction`, the database name `unityqa`, and the only action string the handler recognises (`login`).

What the code at `e9f10da` actually does is an AWS Lambda entry point. On action `login` it calls `login()`, which opens no query and always returns a fixed failure object. A MySQL connection to RDS is attempted when `login.py` is imported. If that connection fails, the process exits before the handler runs.

No written statement of product purpose, owner, or audience was found.

**Unknown / Requires Confirmation:** whether `qaFunction` is still deployed, who invokes it, and whether it was meant to be the login path later attempted in Silicon Ark's `unityNodejsApi` (Lambda name `unityAuth`, same RDS host and database name, later commits in November–December 2019). This repository does not mention `unityAuth` or `unitynodejsapi`.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `e9f10da` | 2019-10-08 | Only branch. 10 commits from 2019-10-02 to 2019-10-08 |

No other local or remote branches were present at inspection. Nothing in git is dated after 2019-10-08. Whether the function or the RDS instance is still running is **Unknown / Requires Confirmation**.

Every commit is `jaco@overdrive.co.za`. The first is authored `Jaco Brits`. The other nine are authored `siliconoverdrive`.

| Commit | Date | Subject |
|---|---|---|
| `37be5a8` | 2019-10-02 | Initial commit |
| `437b8c6` | 2019-10-02 | Testing lambda deploy |
| `9a9819c` | 2019-10-02 | update zip locatiom |
| `661f10a` | 2019-10-02 | Update deployment and moved folder |
| `6ac019f` | 2019-10-06 | test response |
| `30c1d6c` | 2019-10-07 | New login file |
| `8c03a71` | 2019-10-07 | new link |
| `9409bbd` | 2019-10-08 | Update major values |
| `9ddf51c` | 2019-10-08 | Json decode and loaded to body |
| `e9f10da` | 2019-10-08 | zero out response |

## Objectives

No objectives file exists. The behaviour the commits introduced:

1. `37be5a8` — README heading only.
2. `437b8c6` — Pipeline image `python:3.5.7` and `atlassian/aws-lambda-deploy:0.2.1` updating function `qaFunction` in `us-east-2`. Handler under `lambda/` connects to MySQL at import and returns the string `Lambda , Unity`. `config.py` is not in this commit; the handler already imports it.
3. `9a9819c` — Zip command changed from `zip -r code.zip -r /lambda/` to `zip -r code.zip lambda/`.
4. `661f10a` — Handler moved from `lambda/lambda_function.py` to `lambda_function.py`. Zip command becomes `zip -r code.zip *`. `config.py` added. `lambda.zip` added in this commit. That zip's `lambda_function.py` is the pre-move handler: it returns `Lambda , Unity` and has no CORS header.
5. `6ac019f` — Root handler gains `Access-Control-Allow-Origin: *`. A new `lambda/lambda_function.py` is added again, still returning `Lambda , Unity` and still connecting to MySQL at import. It has no CORS header.
6. `30c1d6c` — `login.py` added. The root handler uses `import login` and then calls `login(...)` when `event['action']` is `login`. That call passes the module, not the function `login.login`, so a reached call would raise `TypeError`. The MySQL block moves out of the root handler into `login.py`. `login.login` returns `{"success": "false", "reason": "invalid"}` and does not use its arguments or the connection.
7. `8c03a71` — The login call is commented out. The response body becomes the raw event.
8. `9409bbd` — Login call restored, reading `event['action']`. Import style changes to `from login import login`, so the name in the call is the function. `login.py` connection call is reformatted only.
9. `9ddf51c` — `action` is read from `json.loads(event["body"])`. `username` and `password` stay on the event root. `response` is not assigned when the action is not `login`, so `json.dumps(response)` would raise `NameError` on that path.
10. `e9f10da` — `response = ""` before the `if`, so a non-login action returns HTTP 200 and a JSON empty string instead of raising.

## Scope

### In scope of `master` at `e9f10da`

- Root `lambda_function.py` — handler that parses `event["body"]` and, for action `login`, calls `login()`.
- `login.py` — import-time MySQL connect, and `login()` which ignores credentials.
- `config.py` — RDS host, database name `unityqa`, username, and password.
- `lambda/lambda_function.py` — second handler that returns `Lambda , Unity` and also connects at import. Nothing in the root handler imports it.
- `bitbucket-pipelines.yml` — zip `*` and update Lambda `qaFunction`.
- Vendored PyMySQL 0.9.3 (`pymysql/`, `PyMySQL-0.9.3.dist-info/`) and committed CPython 3.7 bytecode under `__pycache__/`.
- `lambda.zip` — deployment snapshot from `661f10a`, not rebuilt by later commits.
- `README.md` — title only.

`git ls-files` at this revision lists those paths. There is no `requirements.txt`, test, SQL schema, or infrastructure template.

### Out of scope / not in this repository

- `sonar-project.properties` and `sonarqube_scan.bat`. The onboarding scan listed them beside the git files. They are not in `git ls-files` at `e9f10da` and they do not appear in `git log`.
- API Gateway, Lambda handler property, memory, timeout, VPC, and IAM. The pipeline only updates function code.
- Any SQL. No statement in the application files reads or writes a table. Which tables exist in `unityqa` is **Unknown** from this repository. Silicon Ark's `unityNodejsApi` documents a `users` table on the same host and database name; that statement is about the other repository.
- Who is allowed to invoke `qaFunction`.

## System shape

```text
Caller (unknown)
  → AWS Lambda qaFunction (us-east-2)   [pipeline target; live state unknown]
       lambda_function.lambda_handler     [handler property not in git]
         json.loads(event["body"]).action == "login"
           → login(event["username"], event["password"])
                return {"success": "false", "reason": "invalid"}
         any other action
           → HTTP 200, body JSON ""
       import of login.py
         → PyMySQL connect to RDS unityqa (us-east-2), timeout 5 seconds
            failure → log error and sys.exit()
```

A second file, `lambda/lambda_function.py`, can be the handler only if the Lambda configuration points at it. That configuration is not in git. If it is the handler, import still connects to MySQL, and the return body is the string `Lambda , Unity` with no CORS header.

Bitbucket Pipelines on the default pipeline builds `code.zip` from `*` and pushes it with `atlassian/aws-lambda-deploy:0.2.1`, command `update`. The `lambda.zip` file stored in git is an older snapshot and is not the artifact name the pipeline uploads (`code.zip`).

## Major components

| Component | Role | Evidence |
|---|---|---|
| `lambda_function.lambda_handler` | Parse body, dispatch `login`, always return 200 when it returns | **Implemented** |
| `login.login` | Fixed invalid response. Arguments unused | **Implemented** stub |
| Import-time `pymysql.connect` | Open RDS before any request is handled | **Implemented** in `login.py` and in `lambda/lambda_function.py` |
| `config.py` | Hardcoded RDS settings | **Implemented**. Password omitted from this plan |
| `lambda/lambda_function.py` | Stub body `Lambda , Unity` | **Implemented**. Not referenced by the root handler |
| `lambda.zip` | Zip of the 2019-10-02 tree after the folder move, before `login.py` | **Implemented** artifact, stale relative to HEAD |
| Pipeline | Package and `update` Lambda `qaFunction` | **Implemented** in YAML. Last run result is **Unknown** |

## Milestones

The only milestones are the ten commits in [Objectives](#objectives). There is no roadmap file.

## Dependencies known from the tree

- Python, pipeline image `python:3.5.7`.
- PyMySQL 0.9.3, vendored. Metadata lists Python 2.7 and 3.4–3.7. Committed bytecode is `cpython-37`. The pipeline image is 3.5.7. Which runtime the Lambda uses is **Unknown / Requires Confirmation**.
- `zip` installed with `apt-get` inside the pipeline step.
- Deploy pipe `atlassian/aws-lambda-deploy:0.2.1`.

AWS credentials for the pipe are `${AWS_ACCESS_KEY_ID}` and `${AWS_SECRET_ACCESS_KEY}`. They are not stored in git.

No `requirements.txt` or `pip install` step exists. The pipeline zips the vendored driver that is already in git.

## Current status

The repository stopped on 2019-10-08. The only named action does not check a password and does not query MySQL. The database connection is still required at import, so a failed connect prevents the stub response. The committed `lambda.zip` does not contain `login.py` and still returns `Lambda , Unity`.

**Unknown / Requires Confirmation:**

- Whether Lambda `qaFunction` still exists in `us-east-2`, and what handler, timeout, memory, and trigger it uses.
- Whether the RDS instance and database `unityqa` still exist, and whether the committed database user is still valid. If it is, the password in git should be treated as exposed. This document does not repeat it.
- Whether a pipeline run after `e9f10da` updated the function. Git contains no pipeline result.
- Whether `sonar-project.properties` and `sonarqube_scan.bat` exist only as untracked files on the scan host.
- Whether this function and `unityNodejsApi`'s `unityAuth` were meant to be one product.