# Project plan — unityNodejsApi

Evidence date: 2026-09-30.

Source repository: `git@bitbucket.org:overdrive/unitynodejsapi.git`.

Inspected revision: `master` at `8d9588c` (2019-12-01, siliconoverdrive, "Adding new Mysql2 module for node"). The scan-host path `~/projects/sonar_scan/repos/unityNodejsApi` was not on this machine. The tree below was read from that git revision. Database password, JWT signing secret, and the username/password pair in `test.js` are committed in source and are omitted here.

This plan describes what the repository contains. It does not decide what the product should become.

There is no README, issue export, or prior Silicon Ark set for this repository. Nothing in this tree names `unity-skeleton`, `unity-soft-ui`, or `unity-salestracker`.

## Product

**Inferred.** The Bitbucket Pipelines file updates an AWS Lambda function named `unityAuth` in `us-east-2`. `index.js` exports `handler` and, when `event.module` is `"auth"`, calls `login.js` for `login`, `verify`, or `access-token`. `login.js` reads a MySQL table `users` on an RDS instance whose database name is `unityqa`, hashes a password with MD5, and signs a JSON Web Token.

No document in the repository states a product name, a user, or a goal. The directory name `unityNodejsApi` comes from the onboarding task. The git slug is `unitynodejsapi`.

**Unknown / Requires Confirmation:** whether `unityAuth` is still deployed, who calls it, and whether it was meant to serve any other Unity repository. Silicon Ark's `unity-skeleton` documents Cognito and `localStorage.jwt_access_token`. This repository does not mention Cognito, and `unity-skeleton` does not mention `unityAuth`.

## Branch reality

| Line | Tip | Date | What it is |
|---|---|---|---|
| `master` (default; `origin/HEAD`) | `8d9588c` | 2019-12-01 | Only branch. 5 commits, 2019-11-11 through 2019-12-01 |

No other local or remote branches were present at inspection. Nothing in git is dated after 2019-12-01. Whether anyone still runs the Lambda or the `unityqa` database is **Unknown / Requires Confirmation**.

Every commit is authored by `siliconoverdrive` (`jaco@overdrive.co.za`).

## Objectives

No objectives file exists. The behaviour the commits actually introduced:

1. `e367364` (2019-11-11) — Lambda stub in `index.js` that JSON-encodes `event.key1`. `login.js` is a separate API Gateway authorizer that verifies a Bearer token with RS256 against `process.env.JWKS_URI`. Pipeline image `nodejs:10.x`, function name `unityAuth`.
2. `bd7d5af` (2019-11-11, "update image") — pipeline image changed to `node:10.15.3`. Application code unchanged.
3. `d4602f7` (2019-11-13, "New mysql module") — `login.js` replaced by a `mysql` query of `users`. `index.js` calls `login.loginUser` when `event.action` is `login`.
4. `21214d8` (2019-11-20, "Update the hash md5") — MD5 of the password, JWT sign, and stubs `verify` and `getAccessToken`. `index.js` gates on `event.module == 'auth'`.
5. `8d9588c` (2019-12-01, "Adding new Mysql2 module for node") — `mysql2` pool, `mysql.escape`, switch on `event.module`, and `test.js`.

## Scope

### In scope of `master` at `8d9588c`

1. `index.js` — Lambda entry `exports.handler`.
2. `login.js` — MySQL login, empty `verify`, and `getAccessToken`.
3. `test.js` — script that opens the same pool. Not required by `index.js`.
4. `bitbucket-pipelines.yml` — zip the tree and update Lambda `unityAuth`.
5. `package-lock.json` — npm lockfileVersion 1.
6. `node_modules/` — 500 tracked files. The pipeline zips them. There is no `npm install` step.

505 files are tracked. Five are the application and pipeline files above. The other 500 are under `node_modules/`.

### Out of scope / not in this repository

- `package.json`. The lockfile has no companion manifest. `npm install` cannot be reproduced from a manifest in git.
- README, SQL schema, migration, Dockerfile, `.gitignore`, unit-test runner, or infrastructure template.
- `jwks-rsa`. `login.js` required it at `e367364` and `bd7d5af`. No commit adds that package.
- `sonar-project.properties` and `sonarqube_scan.bat`. The onboarding scan listed them beside the git files. They are not in git history.
- API Gateway, Lambda handler configuration, VPC, and IAM. The pipeline only updates function code. The handler name, memory, timeout, and trigger are **Unknown / Requires Confirmation**.
- The `users` table definition. Column names appear only inside SQL strings.

## System shape

```text
Caller (unknown)
  → AWS Lambda unityAuth (us-east-2)  [pipeline target; live state unknown]
       index.handler(event)
         module "auth"
           action "login"         → login.loginUser
           action "verify"        → login.verify          (empty)
           action "access-token"  → login.getAccessToken  (throws into its own catch)
         any other module         → context.fail          (context is not declared)
       → MySQL database unityqa on RDS (us-east-2), table users
       → JWT signed in process (jsonwebtoken), expiry string "2 days"
```

Bitbucket Pipelines on the default pipeline builds `codeNodejs.zip` from the working tree and pushes it with `atlassian/aws-lambda-deploy:0.2.1`, command `update`.

## Major components

| Component | Role | Evidence |
|---|---|---|
| `index.js` | Choose module and action, always build `statusCode: 200` when the switch does not throw | **Implemented** |
| `login.loginUser` | Pool, MD5, select from `users`, sign JWT inside the query callback | **Implemented**. The value returned to `index.js` is the tuple built before the callback runs |
| `login.verify` | Empty function. Parameter `event.token` is ignored | **Implemented** stub |
| `login.getAccessToken` | `jwt.verify` then re-sign. `jwtConfig` is not in this function's scope | **Implemented** as a function that returns 401 from its `catch` |
| `test.js` | Same query path as login, with `passwordin` defined in that file | **Implemented** script |
| Pipeline | Package and `update` Lambda `unityAuth` | **Implemented** in YAML. Last run result is **Unknown** |
| Removed authorizer | JWKS Bearer check and IAM Allow policy | **Removed** at `d4602f7`. Was `login.js` `exports.handler` |

## Milestones

The only milestones are the five commits in [Objectives](#objectives). There is no roadmap file.

## Dependencies known from the tree

Application `require` calls at `8d9588c`:

- `jsonwebtoken` — lockfile version 8.5.1
- `mysql2` — lockfile version 2.0.1
- `crypto` — Node's built-in module (`require('crypto')` resolves to the core module)

Also in the lockfile, not required by `index.js` at HEAD:

- `mysql` 2.17.1 — required by `login.js` from `d4602f7` through `21214d8`, replaced in the application by `mysql2` at `8d9588c`. The package remains in `node_modules`.
- npm package `crypto` 1.0.1 — present in the lockfile. The application call is the Node core module.

Pipeline image: `node:10.15.3`. Deploy pipe: `atlassian/aws-lambda-deploy:0.2.1`.

AWS credentials for the pipe are `${AWS_ACCESS_KEY_ID}` and `${AWS_SECRET_ACCESS_KEY}`. They are not stored in git.

## Current status

The repository is a short-lived experiment that stopped on 2019-12-01. The login path that the Lambda handler calls does not wait for MySQL and refers to `passwordin`, which `login.js` does not define. `verify` does nothing. `getAccessToken` does not have the JWT config in scope. The earlier JWKS authorizer was deleted in the same file that gained the MySQL query.

**Unknown / Requires Confirmation:**

- Whether Lambda `unityAuth` still exists in `us-east-2`, and what handler, timeout, and trigger it uses.
- Whether the RDS instance and the `users` table still exist, and whether the committed database user is still valid. If it is, the password in git should be treated as exposed. This document does not repeat it.
- Whether the JWT secret in `login.js` and `test.js` is still accepted by any caller. This document does not repeat it.
- Who the caller is, and which event shape they send.
- Whether `test.js` was ever run against a live database. It contains a hardcoded username and password. Those values are omitted here.
- Why `sonar-project.properties` and `sonarqube_scan.bat` were on the scan host and not in git.
- Any relationship to other Unity repositories.