@learncard/lca-api-service 1.4.0 → 1.5.1

package/seedMigrationApp.test.ts

@@ -0,0 +1,145 @@
+import type { Context } from 'aws-lambda';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import type { SeedMigrationResult } from './src/types/seed-migration';
+
+const mocks = vi.hoisted(() => ({
+    connect: vi.fn(),
+    close: vi.fn(),
+    runBatch: vi.fn(),
+    mongodb: {},
+}));
+
+vi.mock('./src/mongo', () => ({
+    client: { connect: mocks.connect, close: mocks.close },
+    mongodb: mocks.mongodb,
+}));
+vi.mock('./src/config/environment', () => ({
+    environment: { SA_SEED_ENCRYPT_WRITES: true },
+}));
+vi.mock('./src/migrations/signingAuthoritySeeds', async importOriginal => ({
+    ...(await importOriginal<typeof import('./src/migrations/signingAuthoritySeeds')>()),
+    runSeedMigrationBatch: mocks.runBatch,
+}));
+
+import { handler } from './seedMigrationApp';
+import { SeedMigrationError } from './src/migrations/signingAuthoritySeeds';
+
+const result: SeedMigrationResult = {
+    phase: 'prepare',
+    done: false,
+    processed: 1,
+    counts: { total: 2, encrypted: 1, legacyOnly: 1, malformed: 0, plaintextRemaining: 2 },
+    countsReconciled: false,
+};
+
+const context = (): Context => ({
+    callbackWaitsForEmptyEventLoop: true,
+    functionName: 'seedMigration',
+    functionVersion: '$LATEST',
+    invokedFunctionArn: 'arn:aws:lambda:us-east-1:123456789012:function:seedMigration',
+    memoryLimitInMB: '1024',
+    awsRequestId: 'test-request',
+    logGroupName: 'test-group',
+    logStreamName: 'test-stream',
+    getRemainingTimeInMillis: () => 60_000,
+    done: vi.fn(),
+    fail: vi.fn(),
+    succeed: vi.fn(),
+});
+
+beforeEach(() => {
+    mocks.connect.mockReset().mockResolvedValue(undefined);
+    mocks.close.mockReset().mockResolvedValue(undefined);
+    mocks.runBatch.mockReset().mockResolvedValue(result);
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+});
+
+afterEach(() => vi.restoreAllMocks());
+
+describe('seed migration Lambda connection lifecycle', () => {
+    it('waits for cleanup before returning the batch result', async () => {
+        let finishClose!: () => void;
+        mocks.close.mockReturnValue(new Promise<void>(resolve => (finishClose = resolve)));
+        const resolved = vi.fn();
+        const lambdaContext = context();
+        const invocation = handler({ phase: 'prepare', batchSize: 1 }, lambdaContext).then(
+            resolved
+        );
+
+        await vi.waitFor(() => expect(mocks.close).toHaveBeenCalledOnce());
+        expect(resolved).not.toHaveBeenCalled();
+        expect(mocks.runBatch).toHaveBeenCalledWith(
+            mocks.mongodb,
+            { phase: 'prepare', batchSize: 1 },
+            { encryptedWritesEnabled: true, remainingTime: expect.any(Function) }
+        );
+        expect(lambdaContext.callbackWaitsForEmptyEventLoop).toBe(false);
+
+        finishClose();
+        await invocation;
+        expect(resolved).toHaveBeenCalledWith(result);
+    });
+
+    it('connects and closes for each sequential warm invocation', async () => {
+        await handler({ phase: 'prepare' }, context());
+        await handler({ phase: 'prepare' }, context());
+        expect(mocks.connect).toHaveBeenCalledTimes(2);
+        expect(mocks.runBatch).toHaveBeenCalledTimes(2);
+        expect(mocks.close).toHaveBeenCalledTimes(2);
+    });
+
+    it('closes after a connection failure without returning connection details', async () => {
+        mocks.connect.mockRejectedValue(new Error('mongodb://user:secret@private-host'));
+        await expect(handler({ phase: 'prepare' }, context())).rejects.toMatchObject({
+            category: 'operation_failed',
+            message: 'Signing authority seed migration stopped: operation_failed',
+        });
+        expect(mocks.runBatch).not.toHaveBeenCalled();
+        expect(mocks.close).toHaveBeenCalledOnce();
+    });
+
+    it('closes after an unexpected batch failure without returning query details', async () => {
+        mocks.runBatch.mockRejectedValue(new Error('sensitive seed query'));
+        await expect(handler({ phase: 'prepare' }, context())).rejects.toMatchObject({
+            category: 'operation_failed',
+            message: 'Signing authority seed migration stopped: operation_failed',
+        });
+        expect(mocks.close).toHaveBeenCalledOnce();
+    });
+
+    it('preserves the migration failure when cleanup also fails', async () => {
+        mocks.runBatch.mockRejectedValue(new SeedMigrationError('verification_required'));
+        mocks.close.mockRejectedValue(new Error('sensitive cleanup detail'));
+        await expect(handler({ phase: 'purge' }, context())).rejects.toMatchObject({
+            category: 'verification_required',
+        });
+        expect(mocks.close).toHaveBeenCalledOnce();
+        expect(console.error).toHaveBeenCalledExactlyOnceWith({
+            event: 'signing_authority_seed_migration_failure',
+            operation: 'migration_connection_cleanup',
+            category: 'operation_failed',
+        });
+    });
+
+    it('sanitizes cleanup errors after an otherwise successful batch', async () => {
+        mocks.close.mockRejectedValue(new Error('mongodb://user:secret@private-host'));
+        await expect(handler({ phase: 'prepare' }, context())).rejects.toMatchObject({
+            category: 'operation_failed',
+            message: 'Signing authority seed migration stopped: operation_failed',
+        });
+        expect(console.error).toHaveBeenCalledExactlyOnceWith({
+            event: 'signing_authority_seed_migration_failure',
+            operation: 'migration_connection_cleanup',
+            category: 'operation_failed',
+        });
+    });
+
+    it('rejects invalid requests before touching the database', async () => {
+        await expect(handler({ phase: 'unknown' }, context())).rejects.toMatchObject({
+            category: 'invalid_request',
+        });
+        expect(mocks.connect).not.toHaveBeenCalled();
+        expect(mocks.runBatch).not.toHaveBeenCalled();
+        expect(mocks.close).not.toHaveBeenCalled();
+    });
+});

package/seedMigrationApp.ts

@@ -0,0 +1,50 @@
+import type { Context } from 'aws-lambda';
+import { z } from 'zod';
+import { environment } from './src/config/environment';
+import { client, mongodb } from './src/mongo';
+import { runSeedMigrationBatch, SeedMigrationError } from './src/migrations/signingAuthoritySeeds';
+import type { SeedMigrationResult } from './src/types/seed-migration';
+
+const requestValidator = z
+    .object({
+        phase: z.enum(['dry-run', 'prepare', 'verify', 'purge']),
+        batchSize: z.number().int().min(1).max(100).optional(),
+    })
+    .strict();
+
+/** IAM invocation only. Never accept seeds, database URLs, key ARNs, or arbitrary queries in events. */
+export const handler = async (event: unknown, context: Context): Promise<SeedMigrationResult> => {
+    const parsed = requestValidator.safeParse(event);
+    if (!parsed.success) throw new SeedMigrationError('invalid_request');
+    context.callbackWaitsForEmptyEventLoop = false;
+    let result: SeedMigrationResult;
+    let cleanupFailed = false;
+    try {
+        await client.connect();
+        result = await runSeedMigrationBatch(mongodb, parsed.data, {
+            encryptedWritesEnabled: environment.SA_SEED_ENCRYPT_WRITES,
+            remainingTime: () => context.getRemainingTimeInMillis(),
+        });
+    } catch (error) {
+        // Mongo connection/lease errors can contain URLs or query values. Never let Lambda serialize them.
+        throw new SeedMigrationError(
+            error instanceof SeedMigrationError ? error.category : 'operation_failed'
+        );
+    } finally {
+        // This private worker releases its pool between batches, including failed connections.
+        // The module-level client reconnects when a warm invocation starts its next batch.
+        try {
+            await client.close();
+        } catch {
+            cleanupFailed = true;
+            console.error({
+                event: 'signing_authority_seed_migration_failure',
+                operation: 'migration_connection_cleanup',
+                category: 'operation_failed',
+            });
+        }
+    }
+    // Reached only after a successful batch; never mask its original failure in finally.
+    if (cleanupFailed) throw new SeedMigrationError('operation_failed');
+    return result;
+};

package/seedMigrationLambda.test.ts

@@ -1,145 +1,40 @@
 import type { Context } from 'aws-lambda';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import type { SeedMigrationResult } from './src/types/seed-migration';
+import { beforeEach, expect, it, vi } from 'vitest';
 
-const mocks = vi.hoisted(() => ({
-    connect: vi.fn(),
-    close: vi.fn(),
-    runBatch: vi.fn(),
-    mongodb: {},
-}));
+const mocks = vi.hoisted(() => ({ bootstrap: vi.fn(), getApp: vi.fn(), handler: vi.fn() }));
 
-vi.mock('./src/mongo', () => ({
-    client: { connect: mocks.connect, close: mocks.close },
-    mongodb: mocks.mongodb,
-}));
-vi.mock('./src/config/environment', () => ({
-    environment: { SA_SEED_ENCRYPT_WRITES: true },
-}));
-vi.mock('./src/migrations/signingAuthoritySeeds', async importOriginal => ({
-    ...(await importOriginal<typeof import('./src/migrations/signingAuthoritySeeds')>()),
-    runSeedMigrationBatch: mocks.runBatch,
-}));
-
-import { handler } from './seedMigrationLambda';
-import { SeedMigrationError } from './src/migrations/signingAuthoritySeeds';
-
-const result: SeedMigrationResult = {
-    phase: 'prepare',
-    done: false,
-    processed: 1,
-    counts: { total: 2, encrypted: 1, legacyOnly: 1, malformed: 0, plaintextRemaining: 2 },
-    countsReconciled: false,
-};
-
-const context = (): Context => ({
-    callbackWaitsForEmptyEventLoop: true,
-    functionName: 'seedMigration',
-    functionVersion: '$LATEST',
-    invokedFunctionArn: 'arn:aws:lambda:us-east-1:123456789012:function:seedMigration',
-    memoryLimitInMB: '1024',
-    awsRequestId: 'test-request',
-    logGroupName: 'test-group',
-    logStreamName: 'test-stream',
-    getRemainingTimeInMillis: () => 60_000,
-    done: vi.fn(),
-    fail: vi.fn(),
-    succeed: vi.fn(),
-});
+vi.mock('@learncard/service-config', () => ({ bootstrapLambda: mocks.bootstrap }));
+vi.mock('./src/config/stageConfig', () => ({ base: {}, stages: { dev: {}, production: {} } }));
+vi.mock('./seedMigrationApp', () => ({ handler: mocks.handler }));
 
 beforeEach(() => {
-    mocks.connect.mockReset().mockResolvedValue(undefined);
-    mocks.close.mockReset().mockResolvedValue(undefined);
-    mocks.runBatch.mockReset().mockResolvedValue(result);
-    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    vi.resetModules();
+    vi.clearAllMocks();
+    mocks.bootstrap.mockReturnValue(mocks.getApp);
+    mocks.getApp.mockResolvedValue({ handler: mocks.handler });
+    mocks.handler.mockResolvedValue({ phase: 'prepare', done: true });
 });
 
-afterEach(() => vi.restoreAllMocks());
-
-describe('seed migration Lambda connection lifecycle', () => {
-    it('waits for cleanup before returning the batch result', async () => {
-        let finishClose!: () => void;
-        mocks.close.mockReturnValue(new Promise<void>(resolve => (finishClose = resolve)));
-        const resolved = vi.fn();
-        const lambdaContext = context();
-        const invocation = handler({ phase: 'prepare', batchSize: 1 }, lambdaContext).then(
-            resolved
-        );
-
-        await vi.waitFor(() => expect(mocks.close).toHaveBeenCalledOnce());
-        expect(resolved).not.toHaveBeenCalled();
-        expect(mocks.runBatch).toHaveBeenCalledWith(
-            mocks.mongodb,
-            { phase: 'prepare', batchSize: 1 },
-            { encryptedWritesEnabled: true, remainingTime: expect.any(Function) }
-        );
-        expect(lambdaContext.callbackWaitsForEmptyEventLoop).toBe(false);
-
-        finishClose();
-        await invocation;
-        expect(resolved).toHaveBeenCalledWith(result);
-    });
-
-    it('connects and closes for each sequential warm invocation', async () => {
-        await handler({ phase: 'prepare' }, context());
-        await handler({ phase: 'prepare' }, context());
-        expect(mocks.connect).toHaveBeenCalledTimes(2);
-        expect(mocks.runBatch).toHaveBeenCalledTimes(2);
-        expect(mocks.close).toHaveBeenCalledTimes(2);
-    });
-
-    it('closes after a connection failure without returning connection details', async () => {
-        mocks.connect.mockRejectedValue(new Error('mongodb://user:secret@private-host'));
-        await expect(handler({ phase: 'prepare' }, context())).rejects.toMatchObject({
-            category: 'operation_failed',
-            message: 'Signing authority seed migration stopped: operation_failed',
-        });
-        expect(mocks.runBatch).not.toHaveBeenCalled();
-        expect(mocks.close).toHaveBeenCalledOnce();
-    });
-
-    it('closes after an unexpected batch failure without returning query details', async () => {
-        mocks.runBatch.mockRejectedValue(new Error('sensitive seed query'));
-        await expect(handler({ phase: 'prepare' }, context())).rejects.toMatchObject({
-            category: 'operation_failed',
-            message: 'Signing authority seed migration stopped: operation_failed',
-        });
-        expect(mocks.close).toHaveBeenCalledOnce();
-    });
-
-    it('preserves the migration failure when cleanup also fails', async () => {
-        mocks.runBatch.mockRejectedValue(new SeedMigrationError('verification_required'));
-        mocks.close.mockRejectedValue(new Error('sensitive cleanup detail'));
-        await expect(handler({ phase: 'purge' }, context())).rejects.toMatchObject({
-            category: 'verification_required',
-        });
-        expect(mocks.close).toHaveBeenCalledOnce();
-        expect(console.error).toHaveBeenCalledExactlyOnceWith({
-            event: 'signing_authority_seed_migration_failure',
-            operation: 'migration_connection_cleanup',
-            category: 'operation_failed',
-        });
-    });
-
-    it('sanitizes cleanup errors after an otherwise successful batch', async () => {
-        mocks.close.mockRejectedValue(new Error('mongodb://user:secret@private-host'));
-        await expect(handler({ phase: 'prepare' }, context())).rejects.toMatchObject({
-            category: 'operation_failed',
-            message: 'Signing authority seed migration stopped: operation_failed',
-        });
-        expect(console.error).toHaveBeenCalledExactlyOnceWith({
-            event: 'signing_authority_seed_migration_failure',
-            operation: 'migration_connection_cleanup',
-            category: 'operation_failed',
-        });
+it('bootstraps the migration app with checked-in stage config and the deploy stage', async () => {
+    vi.stubEnv('AWS_LAMBDA_FUNCTION_NAME', 'lca-api-production-seedMigration');
+    vi.stubEnv('LAMBDA_STAGE', 'production');
+    await import('./seedMigrationLambda');
+    expect(mocks.bootstrap).toHaveBeenCalledTimes(1);
+    expect(mocks.bootstrap).toHaveBeenCalledWith({
+        base: {},
+        stages: { dev: {}, production: {} },
+        stage: 'production',
+        importApp: expect.any(Function),
     });
+    vi.unstubAllEnvs();
+});
 
-    it('rejects invalid requests before touching the database', async () => {
-        await expect(handler({ phase: 'unknown' }, context())).rejects.toMatchObject({
-            category: 'invalid_request',
-        });
-        expect(mocks.connect).not.toHaveBeenCalled();
-        expect(mocks.runBatch).not.toHaveBeenCalled();
-        expect(mocks.close).not.toHaveBeenCalled();
-    });
+it('resolves the app once per cold start and forwards every argument', async () => {
+    const { handler } = await import('./seedMigrationLambda');
+    const event = { phase: 'prepare' };
+    const context = {} as Context;
+    await expect(handler(event, context)).resolves.toEqual({ phase: 'prepare', done: true });
+    await handler(event, context);
+    expect(mocks.getApp).toHaveBeenCalledTimes(2);
+    expect(mocks.handler).toHaveBeenLastCalledWith(event, context);
 });

package/seedMigrationLambda.ts

@@ -1,50 +1,19 @@
 import type { Context } from 'aws-lambda';
-import { z } from 'zod';
-import { environment } from './src/config/environment';
-import { client, mongodb } from './src/mongo';
-import { runSeedMigrationBatch, SeedMigrationError } from './src/migrations/signingAuthoritySeeds';
+import { bootstrapLambda } from '@learncard/service-config';
+
+import { base, stages } from './src/config/stageConfig';
 import type { SeedMigrationResult } from './src/types/seed-migration';
 
-const requestValidator = z
-    .object({
-        phase: z.enum(['dry-run', 'prepare', 'verify', 'purge']),
-        batchSize: z.number().int().min(1).max(100).optional(),
-    })
-    .strict();
+type SeedMigrationApp = typeof import('./seedMigrationApp');
+
+const getApplication = bootstrapLambda<SeedMigrationApp>({
+    base,
+    stages,
+    stage: process.env.AWS_LAMBDA_FUNCTION_NAME
+        ? process.env.LAMBDA_STAGE
+        : process.env.CONFIG_STAGE,
+    importApp: () => import('./seedMigrationApp'),
+});
 
-/** IAM invocation only. Never accept seeds, database URLs, key ARNs, or arbitrary queries in events. */
-export const handler = async (event: unknown, context: Context): Promise<SeedMigrationResult> => {
-    const parsed = requestValidator.safeParse(event);
-    if (!parsed.success) throw new SeedMigrationError('invalid_request');
-    context.callbackWaitsForEmptyEventLoop = false;
-    let result: SeedMigrationResult;
-    let cleanupFailed = false;
-    try {
-        await client.connect();
-        result = await runSeedMigrationBatch(mongodb, parsed.data, {
-            encryptedWritesEnabled: environment.SA_SEED_ENCRYPT_WRITES,
-            remainingTime: () => context.getRemainingTimeInMillis(),
-        });
-    } catch (error) {
-        // Mongo connection/lease errors can contain URLs or query values. Never let Lambda serialize them.
-        throw new SeedMigrationError(
-            error instanceof SeedMigrationError ? error.category : 'operation_failed'
-        );
-    } finally {
-        // This private worker releases its pool between batches, including failed connections.
-        // The module-level client reconnects when a warm invocation starts its next batch.
-        try {
-            await client.close();
-        } catch {
-            cleanupFailed = true;
-            console.error({
-                event: 'signing_authority_seed_migration_failure',
-                operation: 'migration_connection_cleanup',
-                category: 'operation_failed',
-            });
-        }
-    }
-    // Reached only after a successful batch; never mask its original failure in finally.
-    if (cleanupFailed) throw new SeedMigrationError('operation_failed');
-    return result;
-};
+export const handler = async (event: unknown, context: Context): Promise<SeedMigrationResult> =>
+    (await getApplication()).handler(event, context);

package/serverless-local.yml

@@ -36,7 +36,8 @@ provider:
     stage: ${opt:stage, "dev"}
     region: ${opt:region, "us-east-1"}
     environment:
-        LAMBDA_STAGE: ${opt:stage, "dev"}
+        # serverless-offline sets AWS_LAMBDA_FUNCTION_NAME; stage config stays opt-in locally.
+        LAMBDA_STAGE: ${env:CONFIG_STAGE, ''}
         SEED: ${env:SEED}
         SA_SEED_LOCAL_KEK: ${env:SA_SEED_LOCAL_KEK, ''}
         SA_SEED_ENCRYPT_WRITES: ${env:SA_SEED_ENCRYPT_WRITES, 'false'}
@@ -54,6 +55,16 @@ provider:
         MONGO_DB_NAME: ${env:MONGO_DB_NAME}
         AUTHORIZED_DIDS: ${env:AUTHORIZED_DIDS}
         GOOGLE_APPLICATION_CREDENTIAL: ${env:GOOGLE_APPLICATION_CREDENTIAL, ""}
+        KEYCLOAK_ISSUERS: ${env:KEYCLOAK_ISSUERS, ""}
+        KEYCLOAK_AUDIENCES: ${env:KEYCLOAK_AUDIENCES, ""}
+        KEYCLOAK_JWKS_URL_OVERRIDES: ${env:KEYCLOAK_JWKS_URL_OVERRIDES, ""}
+        OIDC_ISSUER: ${env:OIDC_ISSUER, ""}
+        OIDC_SIGNING_KEY_JWK: ${env:OIDC_SIGNING_KEY_JWK, ""}
+        OIDC_CLIENT_ID: ${env:OIDC_CLIENT_ID, ""}
+        OIDC_CLIENT_SECRET: ${env:OIDC_CLIENT_SECRET, ""}
+        OIDC_REDIRECT_URIS: ${env:OIDC_REDIRECT_URIS, ""}
+        GOOGLE_OAUTH_CLIENT_IDS: ${env:GOOGLE_OAUTH_CLIENT_IDS, ""}
+        APPLE_OAUTH_CLIENT_IDS: ${env:APPLE_OAUTH_CLIENT_IDS, ""}
         REDIS_HOST:
             'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Address]
         REDIS_PORT:
@@ -101,6 +112,17 @@ functions:
         url:
             cors: true
 
+    oidc:
+        handler: lambda.oidcHandler
+        vpc:
+            securityGroupIds:
+                - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+            subnetIds:
+                - Ref: PrivateSubnetA
+        events:
+            - httpApi: GET /.well-known/openid-configuration
+            - httpApi: ANY /oidc/{proxy+}
+
     swagger:
         handler: lambda.swaggerUiHandler
         package:
@@ -226,6 +248,8 @@ resources:
             Properties:
                 AutoMinorVersionUpgrade: true
                 Engine: redis
+                # GETDEL (login codes/tickets/auth codes) needs Redis >= 6.2
+                EngineVersion: '7.0'
                 CacheNodeType: ${self:custom.config.CACHE_INSTANCE_SIZE}
                 NumCacheNodes: 1
                 VpcSecurityGroupIds:

package/serverless.function-env.cjs

@@ -0,0 +1,58 @@
+const { functionEnvironment, pickNonEmpty } = require('@learncard/service-config/function-env.cjs');
+
+const PROVIDER_SECRETS = [
+    'SEED',
+    'MONGO_URI',
+    'MONGO_DB_NAME',
+    'AUTHORIZED_DIDS',
+    'METABASE_SECRET_KEY',
+    'OPENAI_API_KEY',
+    'POSTMARK_SERVER_TOKEN',
+    'SCOUTS_SSO_CLIENT_SECRET',
+    'SENTRY_DSN',
+    'LEARN_CLOUD_URL',
+];
+
+const API_SECRETS = [
+    'GOOGLE_APPLICATION_CREDENTIAL',
+    'POSTHOG_API_KEY',
+    'ESCROW_RELAY_URL',
+    'ESCROW_RELAY_AUTH_TOKEN',
+    'ESCROW_ENCLAVE_SOFTWARE_PRIVATE_KEYS_JSON',
+    'ESCROW_ENCLAVE_REMOTE_URL',
+    'ESCROW_ENCLAVE_REMOTE_TOKEN',
+    'KEYCLOAK_JWKS_URL_OVERRIDES',
+];
+
+// Non-secret operator toggles forwarded in bundle mode too, so enabling RUNTIME_SECRETS_ID
+// can never silently change them: escrow stays off unless ESCROW_ENCLAVE_MODE is set, and
+// ESCROW_RELEASE_KILL_SWITCH must be flippable without editing the bundle.
+const API_TOGGLES = ['ESCROW_ENCLAVE_MODE', 'ESCROW_RELEASE_KILL_SWITCH'];
+
+// Serverless v3 supplies CLI options to file functions and preserves CF intrinsics.
+// No stage-file values are forwarded from the deployment environment.
+exports.provider = ({ options = {} } = {}) => ({
+    LAMBDA_STAGE: options.stage || 'dev',
+    // Non-secret product selector for the shared stage files (config.<tenant>.<stage>.json).
+    CONFIG_TENANT: process.env.CONFIG_TENANT || 'learncard',
+    PORT: String(options.httpPort || '3000'),
+    SA_SEED_KMS_KEY_ARN: { 'Fn::GetAtt': ['SigningAuthoritySeedKey', 'Arn'] },
+    REDIS_HOST: { 'Fn::GetAtt': ['ElasticCacheCluster', 'RedisEndpoint.Address'] },
+    REDIS_PORT: { 'Fn::GetAtt': ['ElasticCacheCluster', 'RedisEndpoint.Port'] },
+    ...functionEnvironment({ always: [], fallback: PROVIDER_SECRETS }),
+});
+
+// API/migration and the default-role didWeb/swagger functions get the bundle pointer.
+// Reading the bundle does not grant the default role signing-authority KMS access.
+exports.api = () =>
+    functionEnvironment({
+        always: ['RUNTIME_SECRETS_ID', ...API_TOGGLES],
+        fallback: API_SECRETS,
+    });
+
+// Scheduled escrow jobs load the full app (Mongo, Postmark, seed) through lambda.ts, so they
+// need the same bundle pointer and escrow settings as the API functions.
+exports.escrow = exports.api;
+
+// OIDC has its own signing-key secret and cannot read the runtime bundle.
+exports.oidc = () => pickNonEmpty(['OIDC_CLIENT_SECRET', 'OIDC_REDIRECT_URIS']);