sfn-saga-compensation-orchestrator

import os
import time
import boto3
from botocore.exceptions import ClientError

TABLE_INVENTORY = os.environ["TABLE_INVENTORY"]
TABLE_IDEM = os.environ["TABLE_IDEM"]

ddb = boto3.resource("dynamodb")
inv = ddb.Table(TABLE_INVENTORY)
idem = ddb.Table(TABLE_IDEM)

STEP = "reserve"


def handler(event, context):
    sku = event["sku"]
    qty = int(event["qty"])
    key = f"{STEP}:{event['idempotency_key']}"

    existing = idem.get_item(Key={"idempotency_key": key}).get("Item")
    if existing:
        return {"status": "already_reserved", "sku": sku, "qty": qty}

    inv.update_item(
        Key={"sku": sku},
        UpdateExpression="ADD reserved_qty :q",
        ExpressionAttributeValues={":q": qty},
    )

    try:
        idem.put_item(
            Item={
                "idempotency_key": key,
                "step": STEP,
                "sku": sku,
                "qty": qty,
                "ttl": int(time.time()) + 86400,
            },
            ConditionExpression="attribute_not_exists(idempotency_key)",
        )
    except ClientError as e:
        if e.response["Error"]["Code"] != "ConditionalCheckFailedException":
            raise

    return {"status": "reserved", "sku": sku, "qty": qty}

import os
import time
import boto3
from botocore.exceptions import ClientError

TABLE_PAYMENTS = os.environ["TABLE_PAYMENTS"]
TABLE_IDEM = os.environ["TABLE_IDEM"]
SECRET_ID = os.environ["SECRET_ID"]

ddb = boto3.resource("dynamodb")
payments = ddb.Table(TABLE_PAYMENTS)
idem = ddb.Table(TABLE_IDEM)
sm = boto3.client("secretsmanager")

STEP = "charge"


def handler(event, context):
    if event.get("force_failure"):
        raise RuntimeError("forced payment failure for compensation test")

    order_id = event["order_id"]
    amount = event["amount"]
    key = f"{STEP}:{event['idempotency_key']}"
    payment_id = f"pay-{order_id}"

    existing = idem.get_item(Key={"idempotency_key": key}).get("Item")
    if existing:
        return {"status": "already_captured", "payment_id": payment_id}

    secret = sm.get_secret_value(SecretId=SECRET_ID)
    api_key_present = bool(secret.get("SecretString"))
    print(f"charge-payment: loaded gateway api key ok={api_key_present} order={order_id}")

    payments.put_item(
        Item={
            "payment_id": payment_id,
            "order_id": order_id,
            "amount": amount,
            "status": "CAPTURED",
            "captured_at": int(time.time()),
        }
    )

    try:
        idem.put_item(
            Item={
                "idempotency_key": key,
                "step": STEP,
                "payment_id": payment_id,
                "ttl": int(time.time()) + 86400,
            },
            ConditionExpression="attribute_not_exists(idempotency_key)",
        )
    except ClientError as e:
        if e.response["Error"]["Code"] != "ConditionalCheckFailedException":
            raise

    return {"status": "CAPTURED", "payment_id": payment_id}

import os
import time
import boto3
from botocore.exceptions import ClientError

TABLE_SHIPMENTS = os.environ["TABLE_SHIPMENTS"]
TABLE_IDEM = os.environ["TABLE_IDEM"]

ddb = boto3.resource("dynamodb")
shipments = ddb.Table(TABLE_SHIPMENTS)
idem = ddb.Table(TABLE_IDEM)

STEP = "ship"


def handler(event, context):
    if event.get("force_ship_failure"):
        raise RuntimeError("forced shipment failure")

    order_id = event["order_id"]
    key = f"{STEP}:{event['idempotency_key']}"
    shipment_id = f"ship-{order_id}"

    existing = idem.get_item(Key={"idempotency_key": key}).get("Item")
    if existing:
        return {"status": "already_shipped", "shipment_id": shipment_id}

    shipments.put_item(
        Item={
            "shipment_id": shipment_id,
            "order_id": order_id,
            "status": "CREATED",
            "created_at": int(time.time()),
        }
    )

    try:
        idem.put_item(
            Item={
                "idempotency_key": key,
                "step": STEP,
                "shipment_id": shipment_id,
                "ttl": int(time.time()) + 86400,
            },
            ConditionExpression="attribute_not_exists(idempotency_key)",
        )
    except ClientError as e:
        if e.response["Error"]["Code"] != "ConditionalCheckFailedException":
            raise

    return {"status": "CREATED", "shipment_id": shipment_id}

import os
import time
import boto3
from botocore.exceptions import ClientError

TABLE_INVENTORY = os.environ["TABLE_INVENTORY"]
TABLE_IDEM = os.environ["TABLE_IDEM"]

ddb = boto3.resource("dynamodb")
inv = ddb.Table(TABLE_INVENTORY)
idem = ddb.Table(TABLE_IDEM)

STEP = "release"


def handler(event, context):
    sku = event["sku"]
    qty = int(event["qty"])
    key = f"{STEP}:{event['idempotency_key']}"

    existing = idem.get_item(Key={"idempotency_key": key}).get("Item")
    if existing:
        return {"status": "already_released", "sku": sku}

    try:
        inv.update_item(
            Key={"sku": sku},
            UpdateExpression="ADD reserved_qty :nq",
            ConditionExpression="attribute_exists(sku) AND reserved_qty >= :q",
            ExpressionAttributeValues={":nq": -qty, ":q": qty},
        )
    except ClientError as e:
        if e.response["Error"]["Code"] != "ConditionalCheckFailedException":
            raise
        print(f"release-inventory: nothing to release for sku={sku} (reserve likely failed)")

    try:
        idem.put_item(
            Item={
                "idempotency_key": key,
                "step": STEP,
                "sku": sku,
                "qty": qty,
                "ttl": int(time.time()) + 86400,
            },
            ConditionExpression="attribute_not_exists(idempotency_key)",
        )
    except ClientError as e:
        if e.response["Error"]["Code"] != "ConditionalCheckFailedException":
            raise

    return {"status": "released", "sku": sku, "qty": qty}

import os
import time
import boto3
from botocore.exceptions import ClientError

TABLE_PAYMENTS = os.environ["TABLE_PAYMENTS"]
TABLE_IDEM = os.environ["TABLE_IDEM"]

ddb = boto3.resource("dynamodb")
payments = ddb.Table(TABLE_PAYMENTS)
idem = ddb.Table(TABLE_IDEM)

STEP = "refund"


def handler(event, context):
    order_id = event["order_id"]
    key = f"{STEP}:{event['idempotency_key']}"
    payment_id = f"pay-{order_id}"

    existing = idem.get_item(Key={"idempotency_key": key}).get("Item")
    if existing:
        return {"status": "already_refunded", "payment_id": payment_id}

    try:
        payments.update_item(
            Key={"payment_id": payment_id},
            UpdateExpression="SET #s = :r, refunded_at = :t",
            ConditionExpression="attribute_exists(payment_id)",
            ExpressionAttributeNames={"#s": "status"},
            ExpressionAttributeValues={":r": "REFUNDED", ":t": int(time.time())},
        )
        status = "REFUNDED"
    except ClientError as e:
        if e.response["Error"]["Code"] != "ConditionalCheckFailedException":
            raise
        status = "NOOP_NO_PAYMENT"
        print(f"refund-payment: nothing to refund for order={order_id}")

    try:
        idem.put_item(
            Item={
                "idempotency_key": key,
                "step": STEP,
                "payment_id": payment_id,
                "ttl": int(time.time()) + 86400,
            },
            ConditionExpression="attribute_not_exists(idempotency_key)",
        )
    except ClientError as e:
        if e.response["Error"]["Code"] != "ConditionalCheckFailedException":
            raise

    return {"status": status, "payment_id": payment_id}

import json


def handler(event, context):
    detail_type = event.get("detail-type") or event.get("detailType") or "Unknown"
    detail = event.get("detail", {})
    print(f"saga-terminal:{detail_type} detail={json.dumps(detail)}")
    return {"logged": True, "detail_type": detail_type}

{
  "query": "select:TodoWrite",
  "max_results": 1
}

, output, 
{"type": "tool_reference", "tool_name": "TodoWrite"}

#!/usr/bin/env bash
set -euo pipefail

REGION="us-east-1"
ACCOUNT="000000000000"
ROOT="/app/saga"

echo "==> KMS CMK + alias"
CMK_ID=$(aws kms create-key \
  --description "saga customer-managed key" \
  --key-usage ENCRYPT_DECRYPT \
  --query 'KeyMetadata.KeyId' --output text)
echo "CMK_ID=$CMK_ID"

# If an alias with this name exists (from a previous run), delete and recreate pointing at the new key.
if aws kms list-aliases --query "Aliases[?AliasName=='alias/saga-cmk'].AliasName" --output text | grep -q saga-cmk; then
  aws kms delete-alias --alias-name alias/saga-cmk
fi
aws kms create-alias --alias-name alias/saga-cmk --target-key-id "$CMK_ID"

CMK_ARN=$(aws kms describe-key --key-id alias/saga-cmk --query 'KeyMetadata.Arn' --output text)
echo "CMK_ARN=$CMK_ARN"

echo "==> Secrets Manager secret encrypted with CMK"
if aws secretsmanager describe-secret --secret-id payment/gateway-apikey >/dev/null 2>&1; then
  aws secretsmanager delete-secret --secret-id payment/gateway-apikey --force-delete-without-recovery >/dev/null
  sleep 1
fi
SECRET_ARN=$(aws secretsmanager create-secret \
  --name payment/gateway-apikey \
  --description "fake payment gateway api key" \
  --secret-string '{"api_key":"sk_live_fake_gateway_key_123"}' \
  --kms-key-id "$CMK_ARN" \
  --query 'ARN' --output text)
echo "SECRET_ARN=$SECRET_ARN"

echo "==> DynamoDB tables"
create_table() {
  local name=$1 pk=$2
  if aws dynamodb describe-table --table-name "$name" >/dev/null 2>&1; then
    aws dynamodb delete-table --table-name "$name" >/dev/null
    aws dynamodb wait table-not-exists --table-name "$name"
  fi
  aws dynamodb create-table \
    --table-name "$name" \
    --attribute-definitions AttributeName=$pk,AttributeType=S \
    --key-schema AttributeName=$pk,KeyType=HASH \
    --billing-mode PAY_PER_REQUEST >/dev/null
  aws dynamodb wait table-exists --table-name "$name"
}
create_table inventory sku
create_table payments payment_id
create_table shipments shipment_id
create_table saga-idempotency idempotency_key

aws dynamodb update-time-to-live \
  --table-name saga-idempotency \
  --time-to-live-specification "Enabled=true, AttributeName=ttl" >/dev/null
echo "tables ready"

echo "==> Writing ARNs file"
cat > "$ROOT/arns.env" <<EOF
CMK_ARN=$CMK_ARN
SECRET_ARN=$SECRET_ARN
REGION=$REGION
ACCOUNT=$ACCOUNT
EOF
echo "done"

#!/usr/bin/env bash
set -euo pipefail
source /app/saga/arns.env
ROOT=/app/saga
mkdir -p "$ROOT/iam-tmp"
cd "$ROOT/iam-tmp"

INV_ARN="arn:aws:dynamodb:${REGION}:${ACCOUNT}:table/inventory"
PAY_ARN="arn:aws:dynamodb:${REGION}:${ACCOUNT}:table/payments"
SHIP_ARN="arn:aws:dynamodb:${REGION}:${ACCOUNT}:table/shipments"
IDEM_ARN="arn:aws:dynamodb:${REGION}:${ACCOUNT}:table/saga-idempotency"
BUS_ARN="arn:aws:events:${REGION}:${ACCOUNT}:event-bus/saga-events"

cat > trust-lambda.json <<'J'
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}
J

cat > trust-states.json <<'J'
{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"states.amazonaws.com"},"Action":"sts:AssumeRole"}]}
J

logs_stmt() {
cat <<EOF
{"Effect":"Allow","Action":["logs:CreateLogGroup","logs:CreateLogStream","logs:PutLogEvents"],"Resource":"arn:aws:logs:${REGION}:${ACCOUNT}:*"}
EOF
}

create_role() {
  local name=$1 trust=$2
  if aws iam get-role --role-name "$name" >/dev/null 2>&1; then
    for p in $(aws iam list-role-policies --role-name "$name" --query 'PolicyNames[]' --output text); do
      aws iam delete-role-policy --role-name "$name" --policy-name "$p" >/dev/null
    done
    aws iam delete-role --role-name "$name" >/dev/null
  fi
  aws iam create-role --role-name "$name" --assume-role-policy-document "file://$trust" >/dev/null
}

attach_inline() {
  local role=$1 policy_name=$2 file=$3
  aws iam put-role-policy --role-name "$role" --policy-name "$policy_name" --policy-document "file://$file" >/dev/null
}

# ---- reserve-inventory-role ----
create_role reserve-inventory-role trust-lambda.json
cat > reserve-policy.json <<EOF
{"Version":"2012-10-17","Statement":[
$(logs_stmt),
{"Effect":"Allow","Action":["dynamodb:UpdateItem","dynamodb:GetItem","dynamodb:PutItem"],"Resource":["$INV_ARN","$IDEM_ARN"]}
]}
EOF
attach_inline reserve-inventory-role reserve-inventory-policy reserve-policy.json

# ---- charge-payment-role ----
create_role charge-payment-role trust-lambda.json
cat > charge-policy.json <<EOF
{"Version":"2012-10-17","Statement":[
$(logs_stmt),
{"Effect":"Allow","Action":["dynamodb:PutItem","dynamodb:GetItem","dynamodb:UpdateItem"],"Resource":["$PAY_ARN","$IDEM_ARN"]},
{"Effect":"Allow","Action":["secretsmanager:GetSecretValue","secretsmanager:DescribeSecret"],"Resource":"$SECRET_ARN"},
{"Effect":"Allow","Action":["kms:Decrypt","kms:DescribeKey"],"Resource":"$CMK_ARN"}
]}
EOF
attach_inline charge-payment-role charge-payment-policy charge-policy.json

# ---- create-shipment-role ----
create_role create-shipment-role trust-lambda.json
cat > ship-policy.json <<EOF
{"Version":"2012-10-17","Statement":[
$(logs_stmt),
{"Effect":"Allow","Action":["dynamodb:PutItem","dynamodb:GetItem","dynamodb:UpdateItem"],"Resource":["$SHIP_ARN","$IDEM_ARN"]}
]}
EOF
attach_inline create-shipment-role create-shipment-policy ship-policy.json

# ---- release-inventory-role ----
create_role release-inventory-role trust-lambda.json
cat > release-policy.json <<EOF
{"Version":"2012-10-17","Statement":[
$(logs_stmt),
{"Effect":"Allow","Action":["dynamodb:UpdateItem","dynamodb:GetItem","dynamodb:PutItem"],"Resource":["$INV_ARN","$IDEM_ARN"]}
]}
EOF
attach_inline release-inventory-role release-inventory-policy release-policy.json

# ---- refund-payment-role ----
create_role refund-payment-role trust-lambda.json
cat > refund-policy.json <<EOF
{"Version":"2012-10-17","Statement":[
$(logs_stmt),
{"Effect":"Allow","Action":["dynamodb:UpdateItem","dynamodb:GetItem","dynamodb:PutItem"],"Resource":["$PAY_ARN","$IDEM_ARN"]}
]}
EOF
attach_inline refund-payment-role refund-payment-policy refund-policy.json

# ---- saga-notifier-role ----
create_role saga-notifier-role trust-lambda.json
cat > notifier-policy.json <<EOF
{"Version":"2012-10-17","Statement":[
$(logs_stmt),
{"Effect":"Allow","Action":["events:PutEvents"],"Resource":"$BUS_ARN"}
]}
EOF
attach_inline saga-notifier-role saga-notifier-policy notifier-policy.json

# ---- order-saga-role ----
# Cannot compute lambda ARNs by function-name alone; they're deterministic in localstack: arn:aws:lambda:region:acct:function:name
RES_LAMBDA="arn:aws:lambda:${REGION}:${ACCOUNT}:function:reserve-inventory"
CHG_LAMBDA="arn:aws:lambda:${REGION}:${ACCOUNT}:function:charge-payment"
SHP_LAMBDA="arn:aws:lambda:${REGION}:${ACCOUNT}:function:create-shipment"
REL_LAMBDA="arn:aws:lambda:${REGION}:${ACCOUNT}:function:release-inventory"
REF_LAMBDA="arn:aws:lambda:${REGION}:${ACCOUNT}:function:refund-payment"

create_role order-saga-role trust-states.json
cat > saga-policy.json <<EOF
{"Version":"2012-10-17","Statement":[
$(logs_stmt),
{"Effect":"Allow","Action":["lambda:InvokeFunction"],"Resource":["$RES_LAMBDA","$CHG_LAMBDA","$SHP_LAMBDA","$REL_LAMBDA","$REF_LAMBDA"]},
{"Effect":"Allow","Action":["events:PutEvents"],"Resource":"$BUS_ARN"}
]}
EOF
attach_inline order-saga-role order-saga-policy saga-policy.json

echo "roles ready"

#!/usr/bin/env bash
set -euo pipefail
source /app/saga/arns.env
ROOT=/app/saga
LD=$ROOT/lambdas
BUILD=$ROOT/build
mkdir -p "$BUILD"

package() {
  local src=$1 out=$2
  (cd "$LD" && zip -q -j "$BUILD/$out" "$src")
}

package reserve_inventory.py reserve_inventory.zip
package charge_payment.py charge_payment.zip
package create_shipment.py create_shipment.zip
package release_inventory.py release_inventory.zip
package refund_payment.py refund_payment.zip
package saga_notifier.py saga_notifier.zip

deploy() {
  local name=$1 zipfile=$2 handler=$3 role=$4 env_vars=$5
  if aws lambda get-function --function-name "$name" >/dev/null 2>&1; then
    aws lambda delete-function --function-name "$name" >/dev/null
  fi
  aws lambda create-function \
    --function-name "$name" \
    --runtime python3.11 \
    --handler "$handler" \
    --role "arn:aws:iam::${ACCOUNT}:role/${role}" \
    --zip-file "fileb://$BUILD/$zipfile" \
    --timeout 30 \
    --environment "Variables=$env_vars" >/dev/null
  aws lambda wait function-active --function-name "$name"
  echo "deployed $name"
}

deploy reserve-inventory reserve_inventory.zip reserve_inventory.handler reserve-inventory-role \
  "{TABLE_INVENTORY=inventory,TABLE_IDEM=saga-idempotency}"

deploy charge-payment charge_payment.zip charge_payment.handler charge-payment-role \
  "{TABLE_PAYMENTS=payments,TABLE_IDEM=saga-idempotency,SECRET_ID=payment/gateway-apikey}"

deploy create-shipment create_shipment.zip create_shipment.handler create-shipment-role \
  "{TABLE_SHIPMENTS=shipments,TABLE_IDEM=saga-idempotency}"

deploy release-inventory release_inventory.zip release_inventory.handler release-inventory-role \
  "{TABLE_INVENTORY=inventory,TABLE_IDEM=saga-idempotency}"

deploy refund-payment refund_payment.zip refund_payment.handler refund-payment-role \
  "{TABLE_PAYMENTS=payments,TABLE_IDEM=saga-idempotency}"

deploy saga-notifier saga_notifier.zip saga_notifier.handler saga-notifier-role \
  "{DUMMY=1}"

#!/usr/bin/env bash
set -euo pipefail
source /app/saga/arns.env

BUS=saga-events
RULE=on-saga-terminal
NOTIFIER_ARN="arn:aws:lambda:${REGION}:${ACCOUNT}:function:saga-notifier"

if aws events describe-event-bus --name "$BUS" >/dev/null 2>&1; then
  # clean rules + targets first if bus exists
  for r in $(aws events list-rules --event-bus-name "$BUS" --query 'Rules[].Name' --output text 2>/dev/null); do
    ids=$(aws events list-targets-by-rule --rule "$r" --event-bus-name "$BUS" --query 'Targets[].Id' --output text)
    if [ -n "$ids" ]; then
      aws events remove-targets --rule "$r" --event-bus-name "$BUS" --ids $ids >/dev/null
    fi
    aws events delete-rule --name "$r" --event-bus-name "$BUS" >/dev/null
  done
  aws events delete-event-bus --name "$BUS" >/dev/null
fi

aws events create-event-bus --name "$BUS" >/dev/null
echo "bus $BUS created"

aws events put-rule \
  --name "$RULE" \
  --event-bus-name "$BUS" \
  --event-pattern '{"source":["order.saga"],"detail-type":["OrderCompleted","OrderFailed"]}' \
  --state ENABLED >/dev/null
echo "rule $RULE created"

aws events put-targets \
  --rule "$RULE" \
  --event-bus-name "$BUS" \
  --targets "Id=notifier,Arn=$NOTIFIER_ARN" >/dev/null
echo "target wired to notifier"

# lambda resource policy so eventbridge can invoke it
RULE_ARN="arn:aws:events:${REGION}:${ACCOUNT}:rule/${BUS}/${RULE}"
aws lambda remove-permission --function-name saga-notifier --statement-id allow-eventbridge 2>/dev/null || true
aws lambda add-permission \
  --function-name saga-notifier \
  --statement-id allow-eventbridge \
  --action lambda:InvokeFunction \
  --principal events.amazonaws.com \
  --source-arn "$RULE_ARN" >/dev/null
echo "lambda permission added"

{
  "Comment": "Order saga with reverse-order compensations",
  "StartAt": "ReserveInventory",
  "States": {
    "ReserveInventory": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:000000000000:function:reserve-inventory",
      "ResultPath": "$.reserveResult",
      "Next": "ChargePayment",
      "Catch": [
        {
          "ErrorEquals": ["States.ALL"],
          "ResultPath": "$.error",
          "Next": "PublishOrderFailed"
        }
      ]
    },
    "ChargePayment": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:000000000000:function:charge-payment",
      "ResultPath": "$.chargeResult",
      "Next": "CreateShipment",
      "Catch": [
        {
          "ErrorEquals": ["States.ALL"],
          "ResultPath": "$.error",
          "Next": "CompensateAfterChargeFail"
        }
      ]
    },
    "CreateShipment": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:000000000000:function:create-shipment",
      "ResultPath": "$.shipResult",
      "Next": "PublishOrderCompleted",
      "Catch": [
        {
          "ErrorEquals": ["States.ALL"],
          "ResultPath": "$.error",
          "Next": "CompensateAfterShipFail"
        }
      ]
    },
    "CompensateAfterShipFail": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:000000000000:function:refund-payment",
      "ResultPath": "$.refundResult",
      "Next": "ReleaseInventoryAfterShipFail"
    },
    "ReleaseInventoryAfterShipFail": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:000000000000:function:release-inventory",
      "ResultPath": "$.releaseResult",
      "Next": "PublishOrderFailed"
    },
    "CompensateAfterChargeFail": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:000000000000:function:refund-payment",
      "ResultPath": "$.refundResult",
      "Next": "ReleaseInventoryAfterChargeFail"
    },
    "ReleaseInventoryAfterChargeFail": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:000000000000:function:release-inventory",
      "ResultPath": "$.releaseResult",
      "Next": "PublishOrderFailed"
    },
    "PublishOrderCompleted": {
      "Type": "Task",
      "Resource": "arn:aws:states:::events:putEvents",
      "Parameters": {
        "Entries": [
          {
            "EventBusName": "saga-events",
            "Source": "order.saga",
            "DetailType": "OrderCompleted",
            "Detail": {
              "order_id.$": "$.order_id"
            }
          }
        ]
      },
      "ResultPath": "$.publishResult",
      "End": true
    },
    "PublishOrderFailed": {
      "Type": "Task",
      "Resource": "arn:aws:states:::events:putEvents",
      "Parameters": {
        "Entries": [
          {
            "EventBusName": "saga-events",
            "Source": "order.saga",
            "DetailType": "OrderFailed",
            "Detail": {
              "order_id.$": "$.order_id"
            }
          }
        ]
      },
      "ResultPath": "$.publishResult",
      "End": true
    }
  }
}

#!/usr/bin/env bash
set -euo pipefail
source /app/saga/arns.env

SM_ROLE_ARN="arn:aws:iam::${ACCOUNT}:role/order-saga-role"

# If already exists, delete
EXIST=$(aws stepfunctions list-state-machines --query "stateMachines[?name=='order-saga'].stateMachineArn" --output text)
if [ -n "$EXIST" ]; then
  aws stepfunctions delete-state-machine --state-machine-arn "$EXIST" >/dev/null
  sleep 2
fi

ARN=$(aws stepfunctions create-state-machine \
  --name order-saga \
  --definition "file:///app/saga/state_machine.json" \
  --role-arn "$SM_ROLE_ARN" \
  --type STANDARD \
  --query 'stateMachineArn' --output text)

echo "SM_ARN=$ARN"
echo "SM_ARN=$ARN" >> /app/saga/arns.env

#!/usr/bin/env bash
set -euo pipefail

trunc() {
  local tbl=$1 pk=$2
  local keys
  keys=$(aws dynamodb scan --table-name "$tbl" \
    --projection-expression "#k" \
    --expression-attribute-names "{\"#k\":\"$pk\"}" \
    --query "Items[].$pk.S" --output text)
  for k in $keys; do
    aws dynamodb delete-item --table-name "$tbl" \
      --key "{\"$pk\":{\"S\":\"$k\"}}" >/dev/null
  done
}

trunc inventory sku
trunc payments payment_id
trunc shipments shipment_id
trunc saga-idempotency idempotency_key
echo "tables truncated"