# PDP Backfill API

FastAPI backend service for uploading files to S3 buckets to trigger PDP (Permissions Platform) backfill operations.

## Prerequisites

- Python 3.11+
- [uv](https://github.com/astral-sh/uv) for dependency management
- AWS CLI with awsume for credential management

## Local Development

### 1. Install dependencies

```bash
cd api
uv sync
```

### 2. Assume AWS role

```bash
# For QA environment
awsume permissions-platform-qa-generic

# For Production environment
awsume permissions-platform-prod-generic
```

### 3. Start the development server

```bash
make dev
```

The API will be available at:
- http://localhost:8888
- API Docs: http://localhost:8888/docs

## Available Commands

```bash
make dev              # Start development server with hot-reload
make lint             # Run ruff linter
make fmt              # Format code with ruff
make test_unit        # Run unit tests
make clean            # Clean up build artifacts
```

## Environment Variables

Configure in `.env` file (optional, defaults shown):

```bash
AWS_REGION=us-east-1
QA_BUCKET=qa-pdp-backfill
PROD_BUCKET=prod-pdp-backfill
```

## API Endpoints

### Health Check

```bash
GET /hello/
```

### Upload Files

```bash
POST /upload/
```

Request (multipart/form-data):
- `csv_files`: Multiple CSV files containing permission data
- `manifest_file`: Single manifest.json file
- `folder_path`: S3 folder path (e.g., "PP-1055")
- `environment`: Target environment ("qa" or "prod")

Response:
```json
{
  "status": "success",
  "message": "Successfully uploaded 3 file(s) to S3",
  "uploaded_files": [
    "PP-1055/permissions.csv",
    "PP-1055/roles.csv",
    "PP-1055/manifest.json"
  ]
}
```

## AWS Credentials

The backend uses boto3 to upload files to S3. Credentials are read from the environment using the standard AWS credential chain:

1. Environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`)
2. AWS credentials file (`~/.aws/credentials`)
3. IAM role (when running on EC2/ECS)

For local development, use `awsume` to set credentials in your environment before starting the server.

## Docker Development

For Docker development, use the docker-compose.yml at the project root:

```bash
cd ..  # Go to project root
docker-compose up backend
```

## Troubleshooting

### Error: "AWS credentials not found"

Make sure you've run `awsume` before starting the server:

```bash
awsume permissions-platform-qa-generic
make dev
```

### Credentials Expired

Awsume credentials typically expire after 1-12 hours. Run `awsume` again and restart the server.

### Port Already in Use

If port 8888 is already in use, you can change it in the Makefile or kill the existing process:

```bash
lsof -ti:8888 | xargs kill -9
```