Merge branch 'cam/fix-audit' of github.com:WFP-VAM/prism-app into cam/fix-audit

Author: c-mac

api/.env.example

@@ -10,3 +10,10 @@ PRISM_OIDC_CLIENT_SECRET=
 PRISM_SESSION_SECRET=
 # Default one week session time
 PRISM_SESSION_TTL_SECONDS=604800
+
+# Local map export storage (optional — docker-compose.develop.yml sets RustFS defaults).
+# EXPORT_MAP_S3_BUCKET=prism-dev
+# AWS_ACCESS_KEY_ID=rustfsadmin
+# AWS_SECRET_ACCESS_KEY=rustfsadmin
+# AWS_ENDPOINT_URL=http://rustfs:9000          # server-side S3 (Docker network)
+# AWS_PRESIGN_ENDPOINT_URL=http://localhost:9000  # presigned download URLs (browser)

api/README.md

@@ -42,9 +42,33 @@ export KOBO_USERNAME=kobo_user KOBO_PASSWORD=test
 make api
 ```
 
-This starts two containers via `docker-compose.develop.yml`:
+This starts four containers via `docker-compose.develop.yml`:
 - **`db`** — PostGIS (Postgres) on host port **54321**
+- **`rustfs`** — local S3-compatible storage for map export artifacts (API port **9000**, console **9001**)
 - **`api`** — FastAPI (uvicorn with hot reload) on host port **80**
+- **`export_map_worker`** — polls `map_export_jobs`, runs Playwright export, writes artifacts to RustFS
+
+### Local map export storage (RustFS)
+
+Production stores batch and scheduled map exports in **AWS S3** (`EXPORT_MAP_S3_BUCKET`, e.g. `s3://prism-wfp/batch-maps`). Local dev uses **RustFS** so the same code paths run without real AWS credentials for artifacts.
+
+`docker-compose.develop.yml` sets this automatically for **`api`** and **`export_map_worker`**:
+
+| Variable | Local value | Role |
+|---|---|---|
+| `EXPORT_MAP_S3_BUCKET` | `prism-dev` | Bucket created by `rustfs-init` |
+| `AWS_ENDPOINT_URL` | `http://rustfs:9000` | Server-side S3 calls (worker, API inside Docker) |
+| `AWS_PRESIGN_ENDPOINT_URL` | `http://localhost:9000` | Presigned download URLs the browser can reach |
+
+RustFS console: **http://localhost:9001** (login `rustfsadmin` / `rustfsadmin`).
+
+These flows stay aligned with production when `EXPORT_MAP_S3_BUCKET` is set and `EXPORT_MAP_LOCAL_OUTPUT_DIR` is empty (the compose default):
+
+1. **Write** — `export_map_worker`
+2. **Dedupe** — `POST /export-map/jobs` and `scheduled_public_maps` cron
+3. **Download** — `GET /export-map/jobs/{id}` and admin schedule download
+
+The alternative dev mode, `EXPORT_MAP_LOCAL_OUTPUT_DIR`, writes `file://…` URIs to disk instead of S3 and skips the RustFS/prod-aligned path.
 
 ### 3. Run migrations and seed data
 
@@ -55,7 +79,7 @@ make db-migrate
 make db-seed
 ```
 
-`db-migrate` applies Alembic migrations (`upgrade head`). `db-seed` runs migrations first, then inserts sample dev data (Mozambique AA metadata, a `local_dev_user`, and example alert rows).
+`db-migrate` applies Alembic migrations (`upgrade head`). `db-seed` runs migrations first, then inserts sample dev data (Mozambique AA metadata, a `local_dev_user`, example alert rows, and five `[Seed]` map export schedules for cron/download QA).
 
 ### 4. Verify
 

api/docker-compose.develop.yml

@@ -16,13 +16,56 @@ services:
       retries: 12
       start_period: 30s
 
+  # Local S3-compatible storage for map export artifacts (dev only).
+  rustfs:
+    image: rustfs/rustfs:latest
+    ports:
+      - "9000:9000"
+      - "9001:9001"
+    environment:
+      RUSTFS_ACCESS_KEY: rustfsadmin
+      RUSTFS_SECRET_KEY: rustfsadmin
+      RUSTFS_CONSOLE_ENABLE: "true"
+      RUSTFS_ADDRESS: 0.0.0.0:9000
+      RUSTFS_CONSOLE_ADDRESS: 0.0.0.0:9001
+    volumes:
+      - rustfs_data:/data
+    command: ["/data"]
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:9000/health || exit 1"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+      start_period: 40s
+
+  rustfs-init:
+    image: amazon/aws-cli:2.27.50
+    depends_on:
+      rustfs:
+        condition: service_healthy
+    environment:
+      AWS_ACCESS_KEY_ID: rustfsadmin
+      AWS_SECRET_ACCESS_KEY: rustfsadmin
+      AWS_DEFAULT_REGION: us-east-1
+    entrypoint: /bin/sh
+    command:
+      - -c
+      - |
+        until aws --endpoint-url http://rustfs:9000 s3 ls >/dev/null 2>&1; do
+          echo "waiting for rustfs..."
+          sleep 2
+        done
+        aws --endpoint-url http://rustfs:9000 s3 mb s3://prism-dev 2>/dev/null || true
+
   api:
     env_file:
       - path: .env
         required: false
     depends_on:
       db:
         condition: service_healthy
+      rustfs-init:
+        condition: service_completed_successfully
     volumes:
       - ./prism_app:/prism_app
       - ./pyproject.toml:/pyproject.toml
@@ -52,18 +95,27 @@ services:
       - VECTOR_STORE_ACCESS_KEY_ID=${VECTOR_STORE_ACCESS_KEY_ID}
       - VECTOR_STORE_SECRET_ACCESS_KEY=${VECTOR_STORE_SECRET_ACCESS_KEY}
       - VECTOR_STORE_DEFAULT_REGION=${VECTOR_STORE_DEFAULT_REGION}
+      # Map export artifacts → local RustFS
+      - EXPORT_MAP_S3_BUCKET=prism-dev
+      - EXPORT_MAP_LOCAL_OUTPUT_DIR=
+      - AWS_ACCESS_KEY_ID=rustfsadmin
+      - AWS_SECRET_ACCESS_KEY=rustfsadmin
+      - AWS_DEFAULT_REGION=us-east-1
+      - AWS_ENDPOINT_URL=http://rustfs:9000
+      - AWS_PRESIGN_ENDPOINT_URL=http://localhost:9000
     command: uvicorn prism_app.main:app --host 0.0.0.0 --port 80 --reload
     # Infinite loop, to keep it alive, for debugging
     # command: bash -c "while true; do echo 'sleeping...' && sleep 10; done"
-  
+
   export_map_worker:
     shm_size: "2gb"
     depends_on:
       db:
         condition: service_healthy
+      rustfs-init:
+        condition: service_completed_successfully
     volumes:
       - ./prism_app:/prism_app
-      - ./cache:/cache:rw
     build:
       context: ./
       dockerfile: ./Dockerfile.export-map-worker
@@ -74,14 +126,16 @@ services:
       - POSTGRES_DB=postgres
       - POSTGRES_PORT=5432
       - POSTGRES_PASSWORD=!ChangeMe!
-      - EXPORT_MAP_S3_BUCKET=${EXPORT_MAP_S3_BUCKET:-}
-      - EXPORT_MAP_LOCAL_OUTPUT_DIR=${EXPORT_MAP_LOCAL_OUTPUT_DIR:-/cache/map_exports}
-      - AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION:-}
-      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
-      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
+      - EXPORT_MAP_S3_BUCKET=prism-dev
+      - EXPORT_MAP_LOCAL_OUTPUT_DIR=
+      - AWS_ACCESS_KEY_ID=rustfsadmin
+      - AWS_SECRET_ACCESS_KEY=rustfsadmin
+      - AWS_DEFAULT_REGION=us-east-1
+      - AWS_ENDPOINT_URL=http://rustfs:9000
       - BROWSER_POOL_SIZE=1
     working_dir: /prism_app
     command: [ "python", "-m", "prism_app.workers.export_map_worker" ]
 
 volumes:
   db_data:
+  rustfs_data: