[JCC] - Add custom CloudWatch metrics for SSN corrections

[landonshumway-ia]

Given that we are providing states with the ability to self-correct SSNs for their license records, we need visibility into how many SSN corrections are performed as well as alerts to notify us when a SSN correction occurs. This adds custom metrics/alerts for those specific events.

In addition, during smoke testing it was found that when the military documents were copied over from one bucket to another, it triggers the event processor lambda which failed to process the copy events. This adds a check for that
to ignore the copy events since there is no action that needs to be performed for those events.

Testing List

• yarn test:unit:all should run without errors or warnings
• yarn serve should run without errors or warnings
• yarn build should run without errors or warnings
• For API configuration changes: CDK tests added/updated in backend/compact-connect/tests/unit/test_api.py
• For API endpoint changes: OpenAPI spec updated to show latest endpoint configuration run compact-connect/bin/download_oas30.py
• Code review

Closes #1725

Summary by CodeRabbit

• Documentation

  • Clarified guidance for correcting incorrect SSNs and re-uploading licenses.
  • Added instructions to contact support before using the last-resort correction process.
  • Explained that corrections update an existing practitioner account rather than creating a duplicate.

• Bug Fixes

  • Prevented document-copy events during SSN corrections from triggering unrelated processing.

• Monitoring

  • Added alerts for successful, partial, and unsuccessful SSN-correction migrations.

[coderabbitai]

Warning

Review limit reached

@landonshumway-ia, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 93aad2d1-c2b7-437f-9716-6dd8f0b9ef06

📥 Commits

Reviewing files that changed from the base of the PR and between 60918dc and 9cef2f0.

📒 Files selected for processing (4)

• backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py
• backend/compact-connect/lambdas/python/provider-data-v1/handlers/ingest.py
• backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_s3_events.py
• backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py

📝 Walkthrough

Walkthrough

The PR documents previousSSN correction guidance, adds SSN-correction migration metrics and CloudWatch alarms, ignores migration-generated S3 copy events, logs completed S3 moves, adds related tests, and updates PostCSS in three package manifests.

Changes

SSN correction observability

Layer / File(s)	Summary
Migration guidance backend/compact-connect/docs/README.md	Documentation clarifies previousSSN support escalation, last-resort usage, and account migration behavior.
Migration outcome telemetry backend/compact-connect/lambdas/python/provider-data-v1/handlers/ingest.py, backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py	The migration handler emits full, partial, and no-migration counters, with tests asserting metric names, units, and values.
Copy-event handling and migration logging backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py, backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_s3_events.py, backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_s3_events.py	Completed S3 moves are logged, migration-generated copy events are skipped, and tests verify normal processing is not invoked.
Migration alarm wiring backend/compact-connect/stacks/ingest_stack.py, backend/compact-connect/tests/app/test_ingest_stack.py	Three one-day CloudWatch alarms monitor migration outcomes and use the shared alarm topic; CDK tests validate their properties and actions.

PostCSS dependency updates

Layer / File(s)	Summary
PostCSS version bumps backend/compact-connect/lambdas/nodejs/package.json, backend/cosmetology-app/lambdas/nodejs/package.json, backend/social-work-app/lambdas/nodejs/package.json	PostCSS is updated from 8.5.10 to 8.5.12 in three Lambda package manifests.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant IngestHandler
  participant Metrics
  participant CloudWatchAlarm
  participant SharedAlarmTopic
  IngestHandler->>Metrics: Emit migration outcome counter
  Metrics->>CloudWatchAlarm: Provide outcome metric
  CloudWatchAlarm->>SharedAlarmTopic: Publish alarm action

Loading

Possibly related PRs

• csg-org/CompactConnect#1726: Introduces the previousSSN-driven migration flow extended by these observability changes.

Suggested reviewers: jlkravitz

🚥 Pre-merge checks | ✅ 1 | ❌ 4

❌ Failed checks (4 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description omits the required Requirements List and Description List sections from the template.	Add the missing sections and summarize the concrete changes and affected areas in the repository template format.
Linked Issues check	⚠️ Warning	The PR covers monitoring and docs, but not the required previousSSN API/migration behavior or record relocation and deletion from #1725.	Implement and document the previousSSN upload field plus the migration logic that moves related records and deletes the old duplicates.
Out of Scope Changes check	⚠️ Warning	The postcss version bumps in the three package.json files are unrelated to the SSN-correction work.	Move the dependency-only version bumps to a separate PR unless they are required for the SSN-correction changes.
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: SSN-correction metrics and alarms.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py`:
- Line 3195: Stop logging raw provider-document S3 keys in the moved-document
log near data_client.py lines 3195-3195; replace old_key and new_key with
redacted or irreversible correlation values. In provider_s3_events.py lines
27-31, remove s3_url from the copy-event log and retain only safe event
metadata.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f1491a67-a62e-43c6-a998-a45922f72948

📥 Commits

Reviewing files that changed from the base of the PR and between f0d0106 and 60918dc.

⛔ Files ignored due to path filters (3)

• backend/compact-connect/lambdas/nodejs/yarn.lock is excluded by !**/yarn.lock, !**/*.lock
• backend/cosmetology-app/lambdas/nodejs/yarn.lock is excluded by !**/yarn.lock, !**/*.lock
• backend/social-work-app/lambdas/nodejs/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (11)

• backend/compact-connect/docs/README.md
• backend/compact-connect/lambdas/nodejs/package.json
• backend/compact-connect/lambdas/python/common/cc_common/data_model/data_client.py
• backend/compact-connect/lambdas/python/provider-data-v1/handlers/ingest.py
• backend/compact-connect/lambdas/python/provider-data-v1/handlers/provider_s3_events.py
• backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_ingest.py
• backend/compact-connect/lambdas/python/provider-data-v1/tests/function/test_handlers/test_provider_s3_events.py
• backend/compact-connect/stacks/ingest_stack.py
• backend/compact-connect/tests/app/test_ingest_stack.py
• backend/cosmetology-app/lambdas/nodejs/package.json
• backend/social-work-app/lambdas/nodejs/package.json

[landonshumway-ia]

@jlkravitz This is now ready for your review. Thanks

[jlkravitz]

Looks good– Appreciate the doc updates!

@isabeleliassen Good to merge!