[Gemini] 5.2: Update Lambda validation for project-based targets

[taariq]

Parent: #28

Workflow Instructions for Gemini

Repo: seren-replicator (/Users/taariqlewis/Projects/Seren_Projects/seren-replicator)

When to Start: After completing Task 5.1 (#42)

Dependencies: #42 (JobSpec must have project identifier fields first)

---

Task

Update Lambda handler validation to accept either target_url OR project identifiers.

File to Modify

aws/lambda/handler.py

What to Change

1. Update validate_job_spec() function

Add validation for the two target modes:

• Mode 1: target_url provided (existing behavior)
• Mode 2: target_project_id + target_branch_id + seren_api_key provided (new)

Validation rules:

• Either target_url OR target_project_id required (not both)
• When using target_project_id:
  • target_branch_id is required
  • seren_api_key is required
  • Validate both IDs are UUIDs

2. Update handle_submit_job() function

Store project identifiers in DynamoDB:

if 'target_project_id' in body:
    item['target_project_id'] = {'S': body['target_project_id']}
    item['target_branch_id'] = {'S': body['target_branch_id']}
    item['target_databases'] = {'S': json.dumps(body.get('target_databases', []))}
    item['seren_api_key_encrypted'] = {'S': encrypt_data(body['seren_api_key'])}

See docs/plans/api-key-flow-implementation.md Task 5.2 for full code.

How to Test

cd /Users/taariqlewis/Projects/Seren_Projects/seren-replicator
# Run Lambda unit tests (if they exist)
python -m pytest aws/lambda/ -v

Commit Message

feat(lambda): Support project-based target in job validation

[taariq]

Implemented Task 5.2 by extending aws/lambda/handler.py: validation now accepts either a traditional target_url or the new project-based identifiers (UUID checks + Seren API key). handle_submit_job encrypts whichever credentials apply and persists target_project_id, target_branch_id, target_databases, and seren_api_key_encrypted to DynamoDB so the worker can resolve the connection string later.