mirror of
https://github.com/whekin/household-bot.git
synced 2026-03-31 19:24:03 +00:00
60 lines
1.8 KiB
Markdown
60 lines
1.8 KiB
Markdown
# HOUSEBOT-030: Cloud Scheduler Reminder Jobs
|
|
|
|
## Summary
|
|
|
|
Provision dedicated Cloud Scheduler jobs for the three reminder flows and align runtime auth with Cloud Scheduler OIDC tokens.
|
|
|
|
## Goals
|
|
|
|
- Provision separate scheduler jobs for utilities, rent warning, and rent due reminders.
|
|
- Target the runtime reminder endpoints added in `HOUSEBOT-031`.
|
|
- Keep first rollout safe with paused and dry-run controls.
|
|
|
|
## Non-goals
|
|
|
|
- Final live Telegram reminder delivery content.
|
|
- Per-household scheduler customization beyond cron variables.
|
|
|
|
## Scope
|
|
|
|
- In: Terraform scheduler resources, runtime OIDC config, runbook updates.
|
|
- Out: production cutover checklist and final enablement procedure.
|
|
|
|
## Interfaces and Contracts
|
|
|
|
- Cloud Scheduler jobs:
|
|
- `/jobs/reminder/utilities`
|
|
- `/jobs/reminder/rent-warning`
|
|
- `/jobs/reminder/rent-due`
|
|
- Runtime env:
|
|
- `SCHEDULER_OIDC_ALLOWED_EMAILS`
|
|
|
|
## Domain Rules
|
|
|
|
- Utility reminder defaults to day 4 at 09:00 `Asia/Tbilisi`, but remains cron-configurable.
|
|
- Rent warning defaults to day 17 at 09:00 `Asia/Tbilisi`.
|
|
- Rent due defaults to day 20 at 09:00 `Asia/Tbilisi`.
|
|
- Initial rollout should support dry-run mode.
|
|
|
|
## Security and Privacy
|
|
|
|
- Cloud Scheduler uses OIDC token auth with the scheduler service account.
|
|
- Runtime verifies the OIDC audience and the allowed service account email.
|
|
- Shared secret auth remains available for manual/dev invocation.
|
|
|
|
## Observability
|
|
|
|
- Scheduler request payloads include a stable `jobId`.
|
|
- Runtime logs include `jobId`, `dedupeKey`, and outcome.
|
|
|
|
## Test Plan
|
|
|
|
- Runtime auth unit tests for shared-secret and OIDC paths.
|
|
- Terraform validation for reminder job resources.
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] Three scheduler jobs are provisioned with distinct schedules.
|
|
- [ ] Runtime accepts Cloud Scheduler OIDC calls for those jobs.
|
|
- [ ] Initial rollout can remain paused and dry-run.
|