Merge branch 'main' into feature/CCM-15297_Prevent_MeshDownloader_from_publishing_duplicate_events

Author: simonlabarere

docs/architecture/c4/notifhir/reporting/recorder/index.md

@@ -5,10 +5,10 @@ parent:  Reporting
 nav_order: 1
 has_children: true
 is_not_draft: false
-last_modified_date: 2025-10-24
+last_modified_date: 2026-03-26
 owner: Tom D'Roza
 author: Tom D'Roza
-diagrams: [c4code-mesh-statusreporter-recorder, sequence-nhsapp-callback]
+diagrams: [c4code-mesh-statusreporter-recorder]
 events-raised: []
 events-consumed: [
     mesh-inbox-message-downloaded,

docs/architecture/c4/notifhir/viewer/callback/index.md

@@ -5,10 +5,10 @@ parent:  Viewer Services
 nav_order: 8
 has_children: true
 is_not_draft: false
-last_modified_date: 2024-05-28
+last_modified_date: 2026-03-26
 owner: Ross Buggins
-author: Ross Buggins
-diagrams: [c4code-nhsapp-callback, sequence-nhsapp-callback]
+author: Tom D'Roza
+diagrams: [c4code-nhsapp-status-handler]
 events-raised: [viewer-digital-letter-read]
 events-consumed: []
 c4type: code

docs/collections/_diagrams/c4code-nhsapp-callback.md

@@ -0,0 +1,20 @@
+---
+
+title: c4code-nhsapp-status-handler
+
+---
+
+```mermaid
+architecture-beta
+    group AppStatusHandler(cloud)[NHSAppStatusHandler]
+    service optedOutEvent(aws:res-amazon-eventbridge-event)[channel status PUBLISHED v1 Event]
+    service lambda(logos:aws-lambda)[App Status Handler] in AppStatusHandler
+    service sqs(logos:aws-sqs)[App Status Queue] in AppStatusHandler
+    service ddb(aws:arch-amazon-dynamodb)[Items With TTL] in AppStatusHandler
+    service docReadEvent(aws:res-amazon-eventbridge-event)[DigitalLetterRead Event]
+
+    optedOutEvent:R --> L:sqs
+    sqs:R --> L:lambda
+    lambda:B --> T:ddb
+    lambda:R --> L:docReadEvent
+```

docs/collections/_diagrams/c4code-nhsapp-status-handler.md

@@ -38,6 +38,7 @@ No requirements.
 | <a name="input_force_lambda_code_deploy"></a> [force\_lambda\_code\_deploy](#input\_force\_lambda\_code\_deploy) | If the lambda package in s3 has the same commit id tag as the terraform build branch, the lambda will not update automatically. Set to True if making changes to Lambda code from on the same commit for example during development | `bool` | `false` | no |
 | <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonmous with account short-name) | `string` | n/a | yes |
 | <a name="input_kms_deletion_window"></a> [kms\_deletion\_window](#input\_kms\_deletion\_window) | When a kms key is deleted, how long should it wait in the pending deletion state? | `string` | `"30"` | no |
+| <a name="input_lambda_timeout_seconds"></a> [lambda\_timeout\_seconds](#input\_lambda\_timeout\_seconds) | The timeout of the lambdas that are triggered by SQS. | `string` | `"45"` | no |
 | <a name="input_log_level"></a> [log\_level](#input\_log\_level) | The log level to be used in lambda functions within the component. Any log with a lower severity than the configured value will not be logged: https://docs.python.org/3/library/logging.html#levels | `string` | `"INFO"` | no |
 | <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
 | <a name="input_mesh_poll_schedule"></a> [mesh\_poll\_schedule](#input\_mesh\_poll\_schedule) | Schedule to poll MESH for messages | `string` | `"rate(5 minutes)"` | no |
@@ -55,6 +56,7 @@ No requirements.
 | <a name="input_shared_infra_account_id"></a> [shared\_infra\_account\_id](#input\_shared\_infra\_account\_id) | The AWS Shared Infra Account ID (numeric) | `string` | n/a | yes |
 | <a name="input_sns_success_logging_sample_percent"></a> [sns\_success\_logging\_sample\_percent](#input\_sns\_success\_logging\_sample\_percent) | Enable SNS Delivery Successful Sample Percentage | `number` | `0` | no |
 | <a name="input_sqs_max_receive_count"></a> [sqs\_max\_receive\_count](#input\_sqs\_max\_receive\_count) | Maximum number of times a message can be received before being sent to the DLQ | `string` | `"3"` | no |
+| <a name="input_sqs_visibility_timeout_seconds"></a> [sqs\_visibility\_timeout\_seconds](#input\_sqs\_visibility\_timeout\_seconds) | The visibility timeout of the SQS queues. AWS recommends this timeout to be at least 6 times the function timeout (lambda\_timeout\_seconds), see https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-configure-lambda-function-trigger.html | `string` | `"270"` | no |
 | <a name="input_ttl_poll_schedule"></a> [ttl\_poll\_schedule](#input\_ttl\_poll\_schedule) | Schedule to poll for any overdue TTL records | `string` | `"rate(10 minutes)"` | no |
 ## Modules
 

docs/collections/_diagrams/sequence-nhsapp-callback.md

@@ -0,0 +1,5 @@
+code,description
+DL_PDMV_001,Letter rejected by PDM
+DL_PDMV_002,Timeout waiting for letter storage
+DL_CLIV_003,Attachment contains a virus
+DL_INTE_001,Request rejected by Core API

infrastructure/terraform/components/dl/README.md

@@ -0,0 +1,39 @@
+resource "aws_glue_catalog_table" "failure_code_lookup" {
+  name          = "failure_code_lookup"
+  description   = "Lookup table for failure code descriptions"
+  database_name = aws_glue_catalog_database.reporting.name
+
+  table_type = "EXTERNAL_TABLE"
+
+  storage_descriptor {
+    location = "s3://${module.s3bucket_reporting.bucket}/reference-data/failure_codes/"
+
+    input_format  = "org.apache.hadoop.mapred.TextInputFormat"
+    output_format = "org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat"
+
+    ser_de_info {
+      name                  = "csv"
+      serialization_library = "org.apache.hadoop.hive.serde2.OpenCSVSerde"
+
+      parameters = {
+        "separatorChar"          = ","
+        "skip.header.line.count" = "1"
+      }
+    }
+
+    columns {
+      name = "code"
+      type = "string"
+    }
+
+    columns {
+      name = "description"
+      type = "string"
+    }
+  }
+
+  parameters = {
+    EXTERNAL       = "TRUE"
+    classification = "csv"
+  }
+}

infrastructure/terraform/components/dl/data/failure_codes.csv

@@ -24,8 +24,8 @@ module "lambda_lambda_apim_refresh_token" {
   function_include_common = true
   handler_function_name   = "handler"
   runtime                 = "nodejs22.x"
-  memory                  = 128
-  timeout                 = 5
+  memory                  = 256
+  timeout                 = var.lambda_timeout_seconds
   log_level               = var.log_level
   schedule                = var.apim_auth_token_schedule
 

infrastructure/terraform/components/dl/glue_catalog_table_failure_code_lookup.tf

@@ -24,8 +24,8 @@ module "core_notifier" {
   function_include_common = true
   handler_function_name   = "handler"
   runtime                 = "nodejs22.x"
-  memory                  = 128
-  timeout                 = 60
+  memory                  = 256
+  timeout                 = var.lambda_timeout_seconds
   log_level               = var.log_level
 
   force_lambda_code_deploy = var.force_lambda_code_deploy