# Features — unityNodejsApi

Evidence date: 2026-09-30. Revision: `master` `8d9588c` (2019-12-01).

There is no feature list in the source repository. Status below is from `index.js`, `login.js`, `test.js`, `bitbucket-pipelines.yml`, `package-lock.json`, and git history. Secret values are omitted.

## Current features

| Feature | Status | Where |
|---|---|---|
| Lambda entry `exports.handler` | Current | `index.js` |
| Dispatch on `event.module === "auth"` | Current | `index.js` switch, added in `8d9588c` (the `== 'auth'` gate was `21214d8`) |
| Action `login` | Current. Calls `login.loginUser(event.email, event.password)` | `index.js` |
| Action `verify` | Current as a call. The function does nothing | `index.js`, `login.js` |
| Action `access-token` | Current as a call. Returns the catch payload | `index.js`, `login.js` |
| Reject any other module | Current. Throws because `context` is not defined | `index.js` default |
| Lambda response `statusCode: 200` and JSON body | Current when the handler returns | `index.js` |
| `mysql2` connection pool to RDS database `unityqa` | Current. New pool on every `loginUser` call and on load of `test.js` | `login.js`, `test.js` |
| MD5 password digest | Current inside the query callback | `login.js`, `test.js`. Commit `21214d8` |
| Parameterised username and digest via `mysql.escape` | Current | `login.js`, `test.js`. Replaces string concatenation from `21214d8` |
| Select `users` columns `strUuid`, `strUsername`, `strPassword`, `strRole`, `txtPreference` | Current in the SQL string | `login.js`, `test.js` |
| JWT sign `{ id: user.uuid }`, expiry `"2 days"` | Current inside the query callback | `login.js`, `test.js` |
| Fixed login error strings "Check your username/email" and "Check your password" | Current on the synchronous return | `login.js` |
| Invalid-token string "Invalid access token detected" | Current as the `catch` message in `getAccessToken` | `login.js` |
| Manual script that runs the query on load | Current. Not a test runner | `test.js`, added `8d9588c` |
| Vendored `node_modules` (500 files) | Current. Includes `jsonwebtoken` 8.5.1, `mysql2` 2.0.1, and leftover `mysql` 2.17.1 | `node_modules/`, `package-lock.json` |
| Pipeline zip `codeNodejs.zip` | Current | `bitbucket-pipelines.yml` |
| Pipeline update of Lambda `unityAuth` in `us-east-2` | Current in YAML | `bitbucket-pipelines.yml` |
| Pipeline image `node:10.15.3` | Current since `bd7d5af` | `bitbucket-pipelines.yml` |

## Removed

| Feature | When | Evidence |
|---|---|---|
| Echo `event.key1` with status 200 and comment `// TODO implement` | Replaced in `d4602f7` | `index.js` at `e367364` |
| Login only when `event.action == 'login'`, with no module check | Replaced in `21214d8` by the `auth` module gate | `index.js` at `d4602f7` |
| `if (event.module == 'auth')` without a default arm | Replaced in `8d9588c` by `switch` / `default` | `index.js` at `21214d8` |
| `mysql` `createConnection`, `SELECT * from users`, log rows, `connection.end()` | Replaced in `21214d8` | `login.js` at `d4602f7`. `loginUser` took no arguments and returned `[200, rows]` before the query callback |
| SQL concatenation of email and MD5 into the query string | Replaced in `8d9588c` by `mysql.escape` | `login.js` at `21214d8` |
| Select list `userID as uuid`, `strUsername as email`, `strPassword as password` | Replaced in `8d9588c` | `login.js` at `21214d8` |
| Active `_.cloneDeep(authDB.users.find(...))` inside `getAccessToken` | Commented out in `8d9588c`. `_` and `authDB` were never defined | `login.js` at `21214d8` |
| API Gateway authorizer: Bearer token, `jwks-rsa`, RS256, IAM Allow policy, `exports.handler` on `login.js` | Deleted in `d4602f7` | `login.js` at `e367364` and `bd7d5af` |
| Pipeline image `nodejs:10.x` | Replaced the same day in `bd7d5af` | `bitbucket-pipelines.yml` at `e367364` |

`func2` existed as an empty export at `d4602f7` and was renamed `verify` in `21214d8`. The comment inside `verify` is still `// func2 impl`.

## Not implemented

| Item | Evidence |
|---|---|
| Token verification | `verify` is empty. The JWKS authorizer was removed and its package was never vendored |
| Issuing a refreshed access token from a stored user | `getAccessToken` throws on `jwtConfig` and returns the catch tuple. The user lookup is a comment |
| Waiting for the MySQL result before responding | `loginUser` returns `[200, error]` before the callback. `index.js` does not `await` a promise. The login functions do not return promises |
| Closing the pool, or setting `callbackWaitsForEmptyEventLoop` | The assignment is commented out in `login.js` and `test.js` |
| Role-based allow or deny | `strRole` is selected and not read |
| `package.json` and an install step | Absent from every commit. The pipeline zips committed `node_modules` |
| Automated tests | `test.js` has no assertions and is not invoked by the pipeline |
| README or schema | No such files in history |

## Not in git

The onboarding scan listed `sonar-project.properties` and `sonarqube_scan.bat` at the repository root. Neither name appears in git history. They are not features of `master` at `8d9588c`.

## Planned

No issue tracker, TODO that names a future behaviour, or branch besides `master` describes planned work. The `// TODO implement` comment was only on the original `index.js` stub and was removed in `d4602f7`.

`verify` and the commented preference-trim line (`user.data.substr(1).slice(0, -1)`) show unfinished edits. They are not a written plan. **Unknown / Requires Confirmation** what they were supposed to do.