From 65ad13418cd67483468f03f7459bf11b7d5dfefc Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Tue, 17 Oct 2023 16:22:21 +0100
Subject: [PATCH 01/19] handle document-scanned events

---
 Makefile                                    |   3 +
 cmd/event-received/main.go                  |  91 +++++---
 cmd/event-received/main_test.go             | 221 +++++++-------------
 go.sum                                      |  58 +----
 internal/app/donor_store.go                 |  12 +-
 internal/app/donor_store_test.go            |  18 +-
 internal/page/data.go                       |  61 +++++-
 internal/page/data_test.go                  |  13 +-
 internal/page/donor/upload_evidence.go      |   8 +-
 internal/page/donor/upload_evidence_test.go |  23 +-
 web/template/upload_evidence.gohtml         |   4 +-
 11 files changed, 239 insertions(+), 273 deletions(-)

diff --git a/Makefile b/Makefile
index 096d72e201..eb62376064 100644
--- a/Makefile
+++ b/Makefile
@@ -104,5 +104,8 @@ emit-fee-denied: ##@app emits a fee-denied event with the given UID e.g. emit-fe
 emit-more-evidence-required: ##@app emits a more-evidence-required event with the given UID e.g. emit-more-evidence-required UID=abc-123
 	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"more-evidence-required","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(UID)"}}'
 
+emit-document-scanned: ##@app emits a document-scanned event with the given UID, S3 key and result and  e.g. emit-document-scanned UID=abc-123 key=doc/key virus_detected=false
+	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"document-scanned","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(UID)","key":"$(key)","virus_detected":$(virus_detected)}}'
+
 logs: ##@app tails logs for all containers running
 	docker compose -f docker/docker-compose.yml -f docker/docker-compose.dev.yml logs -f
diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index dbb436b2a7..c82d8ad038 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -27,6 +27,12 @@ type uidEvent struct {
 	UID string `json:"uid"`
 }
 
+type documentScannedEvent struct {
+	UID           string `json:"uid"`
+	Key           string `json:"key"`
+	VirusDetected bool   `json:"virus_detected"`
+}
+
 //go:generate mockery --testonly --inpackage --name dynamodbClient --structname mockDynamodbClient
 type dynamodbClient interface {
 	One(ctx context.Context, pk, sk string, v interface{}) error
@@ -95,6 +101,8 @@ func Handler(ctx context.Context, event events.CloudWatchEvent) error {
 		return handleMoreEvidenceRequired(ctx, dynamoClient, event, now)
 	case "fee-denied":
 		return handleFeeDenied(ctx, dynamoClient, event, now)
+	case "document-scanned":
+		return handleDocumentScanned(ctx, dynamoClient, event, now)
 	default:
 		return fmt.Errorf("unknown event received: %s", event.DetailType)
 	}
@@ -128,14 +136,9 @@ func handleFeeApproved(ctx context.Context, dynamoClient dynamodbClient, event e
 		return fmt.Errorf("failed to unmarshal 'fee-approved' detail: %w", err)
 	}
 
-	var key dynamo.Key
-	if err := dynamoClient.OneByUID(ctx, v.UID, &key); err != nil {
-		return fmt.Errorf("failed to resolve uid for 'fee-approved': %w", err)
-	}
-
-	var lpa page.Lpa
-	if err := dynamoClient.One(ctx, key.PK, key.SK, &lpa); err != nil {
-		return fmt.Errorf("failed to get LPA for 'fee-approved': %w", err)
+	lpa, err := getLpaByUID(ctx, dynamoClient, v.UID, "fee-approved")
+	if err != nil {
+		return err
 	}
 
 	lpa.Tasks.PayForLpa = actor.PaymentTaskCompleted
@@ -158,18 +161,9 @@ func handleMoreEvidenceRequired(ctx context.Context, client dynamodbClient, even
 		return fmt.Errorf("failed to unmarshal 'more-evidence-required' detail: %w", err)
 	}
 
-	var key dynamo.Key
-	if err := client.OneByUID(ctx, v.UID, &key); err != nil {
-		return fmt.Errorf("failed to resolve uid for 'more-evidence-required': %w", err)
-	}
-
-	if key.PK == "" {
-		return errors.New("PK missing from LPA in response to 'more-evidence-required'")
-	}
-
-	var lpa page.Lpa
-	if err := client.One(ctx, key.PK, key.SK, &lpa); err != nil {
-		return fmt.Errorf("failed to get LPA for 'more-evidence-required': %w", err)
+	lpa, err := getLpaByUID(ctx, client, v.UID, "more-evidence-required")
+	if err != nil {
+		return err
 	}
 
 	lpa.Tasks.PayForLpa = actor.PaymentTaskMoreEvidenceRequired
@@ -188,30 +182,67 @@ func handleFeeDenied(ctx context.Context, client dynamodbClient, event events.Cl
 		return fmt.Errorf("failed to unmarshal 'fee-denied' detail: %w", err)
 	}
 
-	var key dynamo.Key
-	if err := client.OneByUID(ctx, v.UID, &key); err != nil {
-		return fmt.Errorf("failed to resolve uid for 'fee-denied': %w", err)
+	lpa, err := getLpaByUID(ctx, client, v.UID, "fee-denied")
+	if err != nil {
+		return err
 	}
 
-	if key.PK == "" {
-		return errors.New("PK missing from LPA in response to 'fee-denied'")
+	lpa.Tasks.PayForLpa = actor.PaymentTaskDenied
+	lpa.UpdatedAt = now()
+
+	if err := client.Put(ctx, lpa); err != nil {
+		return fmt.Errorf("failed to update LPA task status for 'fee-denied': %w", err)
 	}
 
-	var lpa page.Lpa
-	if err := client.One(ctx, key.PK, key.SK, &lpa); err != nil {
-		return fmt.Errorf("failed to get LPA for 'fee-denied': %w", err)
+	return nil
+}
+
+func handleDocumentScanned(ctx context.Context, client dynamodbClient, event events.CloudWatchEvent, now func() time.Time) error {
+	var v documentScannedEvent
+	if err := json.Unmarshal(event.Detail, &v); err != nil {
+		return fmt.Errorf("failed to unmarshal 'document-scanned' detail: %w", err)
+	}
+
+	lpa, err := getLpaByUID(ctx, client, v.UID, "document-scanned")
+	if err != nil {
+		return err
+	}
+
+	evidence := lpa.Evidence.GetByKey(v.Key)
+	evidence.Scanned = now()
+	evidence.VirusDetected = v.VirusDetected
+
+	if ok := lpa.Evidence.Update(evidence); !ok {
+		return errors.New("failed to update evidence on LPA for 'document-scanned'")
 	}
 
-	lpa.Tasks.PayForLpa = actor.PaymentTaskDenied
 	lpa.UpdatedAt = now()
 
 	if err := client.Put(ctx, lpa); err != nil {
-		return fmt.Errorf("failed to update LPA task status for 'fee-denied': %w", err)
+		return fmt.Errorf("failed to update LPA for 'document-scanned': %w", err)
 	}
 
 	return nil
 }
 
+func getLpaByUID(ctx context.Context, client dynamodbClient, uid, eventName string) (page.Lpa, error) {
+	var key dynamo.Key
+	if err := client.OneByUID(ctx, uid, &key); err != nil {
+		return page.Lpa{}, fmt.Errorf("failed to resolve uid for '%s': %w", eventName, err)
+	}
+
+	if key.PK == "" {
+		return page.Lpa{}, fmt.Errorf("PK missing from LPA in response to '%s'", eventName)
+	}
+
+	var lpa page.Lpa
+	if err := client.One(ctx, key.PK, key.SK, &lpa); err != nil {
+		return page.Lpa{}, fmt.Errorf("failed to get LPA for '%s': %w", eventName, err)
+	}
+
+	return lpa, nil
+}
+
 func main() {
 	lambda.Start(Handler)
 }
diff --git a/cmd/event-received/main_test.go b/cmd/event-received/main_test.go
index 730c1cfdaa..bcfbc7b9e6 100644
--- a/cmd/event-received/main_test.go
+++ b/cmd/event-received/main_test.go
@@ -18,9 +18,9 @@ import (
 )
 
 var expectedError = errors.New("err")
+var ctx = context.Background()
 
 func TestHandleEvidenceReceived(t *testing.T) {
-	ctx := context.Background()
 	event := events.CloudWatchEvent{
 		DetailType: "evidence-required",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
@@ -46,7 +46,6 @@ func TestHandleEvidenceReceived(t *testing.T) {
 }
 
 func TestHandleEvidenceReceivedWhenClientGetError(t *testing.T) {
-	ctx := context.Background()
 	event := events.CloudWatchEvent{
 		DetailType: "evidence-required",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
@@ -62,7 +61,6 @@ func TestHandleEvidenceReceivedWhenClientGetError(t *testing.T) {
 }
 
 func TestHandleEvidenceReceivedWhenLpaMissingPK(t *testing.T) {
-	ctx := context.Background()
 	event := events.CloudWatchEvent{
 		DetailType: "evidence-required",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
@@ -82,7 +80,6 @@ func TestHandleEvidenceReceivedWhenLpaMissingPK(t *testing.T) {
 }
 
 func TestHandleEvidenceReceivedWhenClientPutError(t *testing.T) {
-	ctx := context.Background()
 	event := events.CloudWatchEvent{
 		DetailType: "evidence-required",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
@@ -108,7 +105,6 @@ func TestHandleEvidenceReceivedWhenClientPutError(t *testing.T) {
 }
 
 func TestHandleFeeApproved(t *testing.T) {
-	ctx := context.Background()
 	event := events.CloudWatchEvent{
 		DetailType: "fee-approved",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
@@ -144,47 +140,7 @@ func TestHandleFeeApproved(t *testing.T) {
 	assert.Nil(t, err)
 }
 
-func TestHandleFeeApprovedWhenDynamoClientOneByUIDError(t *testing.T) {
-	ctx := context.Background()
-	event := events.CloudWatchEvent{
-		DetailType: "fee-approved",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
-	}
-
-	client := newMockDynamodbClient(t)
-	client.
-		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-		Return(expectedError)
-
-	err := handleFeeApproved(ctx, client, event, nil, page.AppData{}, time.Now)
-	assert.Equal(t, fmt.Errorf("failed to resolve uid for 'fee-approved': %w", expectedError), err)
-}
-
-func TestHandleFeeApprovedWhenDynamoClientGetError(t *testing.T) {
-	ctx := context.Background()
-	event := events.CloudWatchEvent{
-		DetailType: "fee-approved",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
-	}
-
-	client := newMockDynamodbClient(t)
-	client.
-		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-		Return(func(ctx context.Context, uid string, v interface{}) error {
-			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
-			json.Unmarshal(b, v)
-			return nil
-		})
-	client.
-		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-		Return(expectedError)
-
-	err := handleFeeApproved(ctx, client, event, nil, page.AppData{}, time.Now)
-	assert.Equal(t, fmt.Errorf("failed to get LPA for 'fee-approved': %w", expectedError), err)
-}
-
 func TestHandleFeeApprovedWhenDynamoClientPutError(t *testing.T) {
-	ctx := context.Background()
 	event := events.CloudWatchEvent{
 		DetailType: "fee-approved",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
@@ -216,7 +172,6 @@ func TestHandleFeeApprovedWhenDynamoClientPutError(t *testing.T) {
 }
 
 func TestHandleFeeApprovedWhenShareCodeSenderError(t *testing.T) {
-	ctx := context.Background()
 	event := events.CloudWatchEvent{
 		DetailType: "fee-approved",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
@@ -253,7 +208,6 @@ func TestHandleFeeApprovedWhenShareCodeSenderError(t *testing.T) {
 }
 
 func TestHandleMoreEvidenceRequired(t *testing.T) {
-	ctx := context.Background()
 	event := events.CloudWatchEvent{
 		DetailType: "more-evidence-required",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
@@ -284,50 +238,45 @@ func TestHandleMoreEvidenceRequired(t *testing.T) {
 	assert.Nil(t, err)
 }
 
-func TestHandleMoreEvidenceRequiredWhenOneByUIDError(t *testing.T) {
-	ctx := context.Background()
+func TestHandleMoreEvidenceRequiredWhenPutError(t *testing.T) {
 	event := events.CloudWatchEvent{
 		DetailType: "more-evidence-required",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
 	}
 
-	client := newMockDynamodbClient(t)
-	client.
-		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-		Return(expectedError)
-
-	err := handleMoreEvidenceRequired(ctx, client, event, time.Now)
-	assert.Equal(t, fmt.Errorf("failed to resolve uid for 'more-evidence-required': %w", expectedError), err)
-}
-
-func TestHandleMoreEvidenceRequiredWhenPKMissing(t *testing.T) {
-	ctx := context.Background()
-	event := events.CloudWatchEvent{
-		DetailType: "more-evidence-required",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
-	}
+	now := time.Now()
 
 	client := newMockDynamodbClient(t)
 	client.
 		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
 		Return(func(ctx context.Context, uid string, v interface{}) error {
-			b, _ := json.Marshal(dynamo.Key{})
+			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
 			json.Unmarshal(b, v)
 			return nil
 		})
+	client.
+		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskPending}})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	client.
+		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskMoreEvidenceRequired}, UpdatedAt: now}).
+		Return(expectedError)
 
-	err := handleMoreEvidenceRequired(ctx, client, event, time.Now)
-
-	assert.Equal(t, errors.New("PK missing from LPA in response to 'more-evidence-required'"), err)
+	err := handleMoreEvidenceRequired(ctx, client, event, func() time.Time { return now })
+	assert.Equal(t, fmt.Errorf("failed to update LPA task status for 'more-evidence-required': %w", expectedError), err)
 }
 
-func TestHandleMoreEvidenceRequiredWhenGetError(t *testing.T) {
-	ctx := context.Background()
+func TestHandleFeeDenied(t *testing.T) {
 	event := events.CloudWatchEvent{
-		DetailType: "more-evidence-required",
+		DetailType: "fee-denied",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
 	}
 
+	now := time.Now()
+
 	client := newMockDynamodbClient(t)
 	client.
 		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
@@ -338,16 +287,22 @@ func TestHandleMoreEvidenceRequiredWhenGetError(t *testing.T) {
 		})
 	client.
 		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-		Return(expectedError)
+		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskPending}})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	client.
+		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskDenied}, UpdatedAt: now}).
+		Return(nil)
 
-	err := handleMoreEvidenceRequired(ctx, client, event, time.Now)
-	assert.Equal(t, fmt.Errorf("failed to get LPA for 'more-evidence-required': %w", expectedError), err)
+	err := handleFeeDenied(ctx, client, event, func() time.Time { return now })
+	assert.Nil(t, err)
 }
 
-func TestHandleMoreEvidenceRequiredWhenPutError(t *testing.T) {
-	ctx := context.Background()
+func TestHandleFeeDeniedWhenPutError(t *testing.T) {
 	event := events.CloudWatchEvent{
-		DetailType: "more-evidence-required",
+		DetailType: "fee-denied",
 		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
 	}
 
@@ -369,18 +324,17 @@ func TestHandleMoreEvidenceRequiredWhenPutError(t *testing.T) {
 			return nil
 		})
 	client.
-		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskMoreEvidenceRequired}, UpdatedAt: now}).
+		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskDenied}, UpdatedAt: now}).
 		Return(expectedError)
 
-	err := handleMoreEvidenceRequired(ctx, client, event, func() time.Time { return now })
-	assert.Equal(t, fmt.Errorf("failed to update LPA task status for 'more-evidence-required': %w", expectedError), err)
+	err := handleFeeDenied(ctx, client, event, func() time.Time { return now })
+	assert.Equal(t, fmt.Errorf("failed to update LPA task status for 'fee-denied': %w", expectedError), err)
 }
 
-func TestHandleFeeDenied(t *testing.T) {
-	ctx := context.Background()
+func TestHandleDocumentScanned(t *testing.T) {
 	event := events.CloudWatchEvent{
-		DetailType: "fee-denied",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
+		DetailType: "document-scanned",
+		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333", "key": "document/key", "virus_detected": false}`),
 	}
 
 	now := time.Now()
@@ -396,87 +350,79 @@ func TestHandleFeeDenied(t *testing.T) {
 	client.
 		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
 		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
-			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskPending}})
+			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+				Documents: []page.Document{{Key: "document/key"}},
+			}})
 			json.Unmarshal(b, v)
 			return nil
 		})
 	client.
-		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskDenied}, UpdatedAt: now}).
+		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
+			Documents: []page.Document{{Key: "document/key", Scanned: now, VirusDetected: false}},
+		}}).
 		Return(nil)
 
-	err := handleFeeDenied(ctx, client, event, func() time.Time { return now })
+	err := handleDocumentScanned(ctx, client, event, func() time.Time { return now })
 	assert.Nil(t, err)
 }
 
-func TestHandleFeeDeniedWhenOneByUIDError(t *testing.T) {
-	ctx := context.Background()
-	event := events.CloudWatchEvent{
-		DetailType: "fee-denied",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
-	}
+func TestGetLpaByUID(t *testing.T) {
+	expectedLpa := page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+		Documents: []page.Document{{Key: "document/key"}},
+	}}
 
 	client := newMockDynamodbClient(t)
 	client.
 		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-		Return(expectedError)
+		Return(func(ctx context.Context, uid string, v interface{}) error {
+			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	client.
+		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+			b, _ := json.Marshal(expectedLpa)
+			json.Unmarshal(b, v)
+			return nil
+		})
 
-	err := handleFeeDenied(ctx, client, event, time.Now)
-	assert.Equal(t, fmt.Errorf("failed to resolve uid for 'fee-denied': %w", expectedError), err)
-}
+	lpa, err := getLpaByUID(ctx, client, "M-1111-2222-3333", "an-event")
 
-func TestHandleFeeDeniedWhenPKMissing(t *testing.T) {
-	ctx := context.Background()
-	event := events.CloudWatchEvent{
-		DetailType: "fee-denied",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
-	}
+	assert.Equal(t, expectedLpa, lpa)
+	assert.Nil(t, err)
+}
 
+func TestGetLpaByUIDWhenClientOneByUidError(t *testing.T) {
 	client := newMockDynamodbClient(t)
 	client.
 		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-		Return(func(ctx context.Context, uid string, v interface{}) error {
-			b, _ := json.Marshal(dynamo.Key{})
-			json.Unmarshal(b, v)
-			return nil
-		})
+		Return(expectedError)
 
-	err := handleFeeDenied(ctx, client, event, time.Now)
+	lpa, err := getLpaByUID(ctx, client, "M-1111-2222-3333", "an-event")
 
-	assert.Equal(t, errors.New("PK missing from LPA in response to 'fee-denied'"), err)
+	assert.Equal(t, page.Lpa{}, lpa)
+	assert.Equal(t, fmt.Errorf("failed to resolve uid for 'an-event': %w", expectedError), err)
 }
 
-func TestHandleFeeDeniedWhenGetError(t *testing.T) {
-	ctx := context.Background()
-	event := events.CloudWatchEvent{
-		DetailType: "fee-denied",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
-	}
-
+func TestGetLpaByUIDWhenPKMissing(t *testing.T) {
 	client := newMockDynamodbClient(t)
 	client.
 		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
 		Return(func(ctx context.Context, uid string, v interface{}) error {
-			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+			b, _ := json.Marshal(dynamo.Key{SK: "#DONOR#456"})
 			json.Unmarshal(b, v)
 			return nil
 		})
-	client.
-		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-		Return(expectedError)
 
-	err := handleFeeDenied(ctx, client, event, time.Now)
-	assert.Equal(t, fmt.Errorf("failed to get LPA for 'fee-denied': %w", expectedError), err)
-}
+	lpa, err := getLpaByUID(ctx, client, "M-1111-2222-3333", "an-event")
 
-func TestHandleFeeDeniedWhenPutError(t *testing.T) {
-	ctx := context.Background()
-	event := events.CloudWatchEvent{
-		DetailType: "fee-denied",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333"}`),
-	}
+	assert.Equal(t, page.Lpa{}, lpa)
+	assert.Equal(t, errors.New("PK missing from LPA in response to 'an-event'"), err)
 
-	now := time.Now()
+}
 
+func TestGetLpaByUIDWhenClientOneError(t *testing.T) {
 	client := newMockDynamodbClient(t)
 	client.
 		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
@@ -487,15 +433,10 @@ func TestHandleFeeDeniedWhenPutError(t *testing.T) {
 		})
 	client.
 		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
-			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskPending}})
-			json.Unmarshal(b, v)
-			return nil
-		})
-	client.
-		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Tasks: page.Tasks{PayForLpa: actor.PaymentTaskDenied}, UpdatedAt: now}).
 		Return(expectedError)
 
-	err := handleFeeDenied(ctx, client, event, func() time.Time { return now })
-	assert.Equal(t, fmt.Errorf("failed to update LPA task status for 'fee-denied': %w", expectedError), err)
+	lpa, err := getLpaByUID(ctx, client, "M-1111-2222-3333", "an-event")
+
+	assert.Equal(t, page.Lpa{}, lpa)
+	assert.Equal(t, fmt.Errorf("failed to get LPA for 'an-event': %w", expectedError), err)
 }
diff --git a/go.sum b/go.sum
index 5c3e692404..089f3012ff 100644
--- a/go.sum
+++ b/go.sum
@@ -6,101 +6,57 @@ github.com/MicahParks/keyfunc v1.9.0 h1:lhKd5xrFHLNOWrDc4Tyb/Q1AJ4LCzQ48GVJyVIID
 github.com/MicahParks/keyfunc v1.9.0/go.mod h1:IdnCilugA0O/99dW+/MkvlyrsX8+L8+x95xuVNtM5jw=
 github.com/aws/aws-lambda-go v1.41.0 h1:l/5fyVb6Ud9uYd411xdHZzSf2n86TakxzpvIoz7l+3Y=
 github.com/aws/aws-lambda-go v1.41.0/go.mod h1:jwFe2KmMsHmffA1X2R09hH6lFzJQxzI8qK17ewzbQMM=
-github.com/aws/aws-sdk-go-v2 v1.21.0 h1:gMT0IW+03wtYJhRqTVYn0wLzwdnK9sRMcxmtfGzRdJc=
 github.com/aws/aws-sdk-go-v2 v1.21.0/go.mod h1:/RfNgGmRxI+iFOB1OeJUyxiU+9s88k3pfHvDagGEp0M=
 github.com/aws/aws-sdk-go-v2 v1.21.2 h1:+LXZ0sgo8quN9UOKXXzAWRT3FWd4NxeXWOZom9pE7GA=
 github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13 h1:OPLEkmhXf6xFPiz0bLeDArZIDx1NNS4oJyG4nv3Gct0=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13/go.mod h1:gpAbvyDGQFozTEmlTFO8XcQKHzubdq0LzRyJpG6MiXM=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 h1:Sc82v7tDQ/vdU1WtuSyzZ1I7y/68j//HJ6uozND1IDs=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14/go.mod h1:9NCTOURS8OpxvoAVHq79LK81/zC78hfRWFn+aL0SPcY=
-github.com/aws/aws-sdk-go-v2/config v1.18.43 h1:IgdUtTRvUDC6eiJBqU6vh7bHFNAEBjQ8S+qJ7zVhDOs=
-github.com/aws/aws-sdk-go-v2/config v1.18.43/go.mod h1:NiFev8qlgg8MPzw3fO/EwzMZeZwlJEKGwfpjRPA9Nvw=
 github.com/aws/aws-sdk-go-v2/config v1.18.45 h1:Aka9bI7n8ysuwPeFdm77nfbyHCAKQ3z9ghB3S/38zes=
 github.com/aws/aws-sdk-go-v2/config v1.18.45/go.mod h1:ZwDUgFnQgsazQTnWfeLWk5GjeqTQTL8lMkoE1UXzxdE=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.41 h1:dgbKq1tamtboYAKSXWbqL0lKO9rmEzEhbZFh9JQW/Bg=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.41/go.mod h1:cc3Fn7DkKbJalPtQnudHGZZ8ml9+hwtbc1CJONsYYqk=
 github.com/aws/aws-sdk-go-v2/credentials v1.13.43 h1:LU8vo40zBlo3R7bAvBVy/ku4nxGEyZe9N8MqAeFTzF8=
 github.com/aws/aws-sdk-go-v2/credentials v1.13.43/go.mod h1:zWJBz1Yf1ZtX5NGax9ZdNjhhI4rgjfgsyk6vTY1yfVg=
-github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.40 h1:YS/4hWmEIgAgUcFWPWmeBvyjH1Bttvfn1gHYC3T0Jd0=
-github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.40/go.mod h1:W4jFsOeGAVrQZWgoRY52fjYObqfjletWUlq4cssiBdw=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.42 h1:taACSYOzbwyrJPvzX0ucCkB9gxkIkcYkuXkUhNRsnJ0=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.42/go.mod h1:y4dbQK/yjYJ2HXqx57/G8FvLckKtN61s/IWNVvP5k9E=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11 h1:uDZJF1hu0EVT/4bogChk8DyjSF6fof6uL/0Y26Ma7Fg=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.11/go.mod h1:TEPP4tENqBGO99KwVpV9MlOX4NSrSLP8u3KRy2CDwA8=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13 h1:PIktER+hwIG286DqXyvVENjgLTAwGgoeriLDD5C+YlQ=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13/go.mod h1:f/Ib/qYjhV2/qdsf79H3QP/eRE4AkVyEf6sk7XfZ1tg=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41 h1:22dGT7PneFMx4+b3pz7lMTRyN8ZKH7M2cW4GP9yUS2g=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41/go.mod h1:CrObHAuPneJBlfEJ5T3szXOUkLEThaGfvnhTf33buas=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.43 h1:nFBQlGtkbPzp/NjZLuFxRqmT91rLJkgvsEQs68h962Y=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.43/go.mod h1:auo+PiyLl0n1l8A0e8RIeR8tOzYPfZZH/JNlrJ8igTQ=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35 h1:SijA0mgjV8E+8G45ltVHs0fvKpTj8xmZJ3VwhGKtUSI=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35/go.mod h1:SJC1nEVVva1g3pHAIdCp7QsRIkMmLAgoDquQ9Rr8kYw=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.37 h1:JRVhO25+r3ar2mKGP7E0LDl8K9/G36gjlqca5iQbaqc=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.37/go.mod h1:Qe+2KtKml+FEsQF/DHmDV+xjtche/hwoF75EG4UlHW8=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.43 h1:g+qlObJH4Kn4n21g69DjspU0hKTjWtq7naZ9OLCv0ew=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.43/go.mod h1:rzfdUlfA+jdgLDmPKjd3Chq9V7LVLYo1Nz++Wb91aRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45 h1:hze8YsjSh8Wl1rYa1CJpRmXP21BvOBuc76YhW0HsuQ4=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45/go.mod h1:lD5M20o09/LCuQ2mE62Mb/iSdSlCNuj6H5ci7tW7OsE=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4 h1:6lJvvkQ9HmbHZ4h/IEwclwv2mrTW8Uq1SOB/kXy0mfw=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.4/go.mod h1:1PrKYwxTM+zjpw9Y41KFtoJCQrJ34Z47Y4VgVbfndjo=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6 h1:wmGLw2i8ZTlHLw7a9ULGfQbuccw8uIiNr6sol5bFzc8=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6/go.mod h1:Q0Hq2X/NuL7z8b1Dww8rmOFl+jzusKEcyvkKspwdpyc=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.0 h1:kjsywH3KdJnqo6XgHGE8eCoeZ9GsnVIUBILY93YjzKg=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.0/go.mod h1:X3ThW5RPV19hi7bnQ0RMAiBjZbzxj4rZlj+qdctbMWY=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.2 h1:s7oacej7gZm+Bcq5BxZIlm5HWjEyKiWtOt405QZ+WOA=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.2/go.mod h1:1HkLh8vaL4obF95fne7ZOu7sxomS/+vkBt3/+gqqwE4=
-github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.15.5 h1:xoalM/e1YsT6jkLKl6KA9HUiJANwn2ypJsM9lhW2WP0=
-github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.15.5/go.mod h1:7QtKdGj66zM4g5hPgxHRQgFGLGal4EgwggTw5OZH56c=
 github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.15.7 h1:WCeS9WZbIqEKCbgIkrHB5jw/9mO2QMYTLPF8wee3v4Y=
 github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.15.7/go.mod h1:uT1paW42RVCVEoAEbWKu98gEI0GMBWUsT/H+pI4ODJQ=
-github.com/aws/aws-sdk-go-v2/service/eventbridge v1.22.0 h1:7jKqbCPZ14W7B5qgZBV3KKWW1X0rriF0gEO64QaY02k=
-github.com/aws/aws-sdk-go-v2/service/eventbridge v1.22.0/go.mod h1:NgudPBMWkilaPx7oOPoZ4DXjGn0oa0MuClQRdUthUwg=
 github.com/aws/aws-sdk-go-v2/service/eventbridge v1.22.2 h1:OyuAwr4t1emvQdH+M6BqZR/0a67SUOm6glJ2ot6NQE4=
 github.com/aws/aws-sdk-go-v2/service/eventbridge v1.22.2/go.mod h1:z29eBmJY+MYzdT1gbSdcjXgJ5CMVw3wKcclrxcitLqw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14 h1:m0QTSI6pZYJTk5WSKx3fm5cNW/DCicVzULBgU/6IyD0=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14/go.mod h1:dDilntgHy9WnHXsh7dDtUPgHKEfTJIBUTHM8OWm0f/0=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15 h1:7R8uRYyXzdD71KWVCL78lJZltah6VVznXBazvKjfH58=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15/go.mod h1:26SQUPcTNgV1Tapwdt4a1rOsYRsnBsJHLMPoxK2b0d8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36 h1:eev2yZX7esGRjqRbnVk1UxMLw4CyVZDpZXRCcy75oQk=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.36/go.mod h1:lGnOkH9NJATw0XEPcAknFBj3zzNTEGRHtSw+CwC1YTg=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.38 h1:skaFGzv+3kA+v2BPKhuekeb1Hbb105+44r8ASC+q5SE=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.38/go.mod h1:epIZoRSSbRIwLPJU5F+OldHhwZPBdpDeQkRdCeY3+00=
-github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.35 h1:UKjpIDLVF90RfV88XurdduMoTxPqtGHZMIDYZQM7RO4=
-github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.35/go.mod h1:B3dUg0V6eJesUTi+m27NUkj7n8hdDKYUpxj8f4+TqaQ=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.37 h1:4LoizcvPT9A0tiAFhepxn0bGZXkzvN0pG0epydY3Pno=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.37/go.mod h1:7xBUZyP6LeLc+5Ym9PG7atqw4sR28sBtYcHETik+bPE=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35 h1:CdzPW9kKitgIiLV1+MHobfR5Xg25iYnyzWZhyQuSlDI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35/go.mod h1:QGF2Rs33W5MaN9gYdEQOBBFPLwTZkEhRwI33f7KIG0o=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.37 h1:WWZA/I2K4ptBS1kg0kV1JbBtG/umed0vwHRrmcr9z7k=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.37/go.mod h1:vBmDnwWXWxNPFRMmG2m/3MKOe+xEcMDo1tanpaWCcck=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4 h1:v0jkRigbSD6uOdwcaUQmgEwG1BkPfAPDqaeNt/29ghg=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.4/go.mod h1:LhTyt8J04LL+9cIt7pYJ5lbS/U98ZmXovLOR/4LUsk8=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6 h1:9ulSU5ClouoPIYhDQdg9tpl83d5Yb91PXTKK+17q+ow=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6/go.mod h1:lnc2taBsR9nTlz9meD+lhFZZ9EWY712QHrRflWpTcOA=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.40.0 h1:wl5dxN1NONhTDQD9uaEvNsDRX29cBmGED/nl0jkWlt4=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.40.0/go.mod h1:rDGMZA7f4pbmTtPOk5v5UM2lmX6UAbRnMDJeDvnH7AM=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2 h1:Ll5/YVCOzRB+gxPqs2uD0R7/MyATC0w85626glSKmp4=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2/go.mod h1:Zjfqt7KhQK+PO1bbOsFNzKgaq7TcxzmEoDWN8lM0qzQ=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.3 h1:H6ZipEknzu7RkJW3w2PP75zd8XOdR35AEY5D57YrJtA=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.3/go.mod h1:5W2cYXDPabUmwULErlC92ffLhtTuyv4ai+5HhdbhfNo=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.5 h1:BvRGAAdEHo+0tpyOlKV14Z49O/iyhqiddIntd0KQ3EA=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.5/go.mod h1:A108ijf0IFtqhYApU+Gia80aPSAUfi9dItm+h5fWGJE=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.24.5 h1:RyDpTOMEJO6ycxw1vU/6s0KLFaH3M0z/z9gXHSndPTk=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.24.5/go.mod h1:RZBu4jmYz3Nikzpu/VuVvRnTEJ5a+kf36WT2fcl5Q+Q=
-github.com/aws/aws-sdk-go-v2/service/sso v1.15.0 h1:vuGK1vHNP9zx0PfOrtPumbwR2af0ATQ1Z2H6p75AgRQ=
-github.com/aws/aws-sdk-go-v2/service/sso v1.15.0/go.mod h1:fIAwKQKBFu90pBxx07BFOMJLpRUGu8VOzLJakeY+0K4=
 github.com/aws/aws-sdk-go-v2/service/sso v1.15.2 h1:JuPGc7IkOP4AaqcZSIcyqLpFSqBWK32rM9+a1g6u73k=
 github.com/aws/aws-sdk-go-v2/service/sso v1.15.2/go.mod h1:gsL4keucRCgW+xA85ALBpRFfdSLH4kHOVSnLMSuBECo=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.1 h1:8lKOidPkmSmfUtiTgtdXWgaKItCZ/g75/jEk6Ql6GsA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.1/go.mod h1:yygr8ACQRY2PrEcy3xsUI357stq2AxnFM6DIsR9lij4=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.3 h1:HFiiRkf1SdaAmV3/BHOFZ9DjFynPHj8G/UIO1lQS+fk=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.3/go.mod h1:a7bHA82fyUXOm+ZSWKU6PIoBxrjSprdLoM8xPYvzYVg=
-github.com/aws/aws-sdk-go-v2/service/sts v1.23.0 h1:pyvfUqkNLMipdKNAtu7OVbRxUrR2BMaKccIPpk/Hkak=
-github.com/aws/aws-sdk-go-v2/service/sts v1.23.0/go.mod h1:VC7JDqsqiwXukYEDjoHh9U0fOJtNWh04FPQz4ct4GGU=
 github.com/aws/aws-sdk-go-v2/service/sts v1.23.2 h1:0BkLfgeDjfZnZ+MhB3ONb01u9pwFYTCZVhlsSSBvlbU=
 github.com/aws/aws-sdk-go-v2/service/sts v1.23.2/go.mod h1:Eows6e1uQEsc4ZaHANmsPRzAKcVDrcmjjWiih2+HUUQ=
-github.com/aws/smithy-go v1.14.2 h1:MJU9hqBGbvWZdApzpvoF2WAIJDbtjK2NDJSiJP7HblQ=
 github.com/aws/smithy-go v1.14.2/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/aws/smithy-go v1.15.0 h1:PS/durmlzvAFpQHDs4wi4sNNP9ExsqZh6IlfdHXgKK8=
 github.com/aws/smithy-go v1.15.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
@@ -121,8 +77,6 @@ github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7
 github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
 github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
 github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
 github.com/getyoti/yoti-go-sdk/v3 v3.10.0 h1:uAGXQQQCWoMKpjrVHSK8b110EjC+ORJwAI7yvlNHpr0=
@@ -214,8 +168,6 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/ministryofjustice/opg-go-common v0.0.0-20231002150139-ed6f6387fc7e h1:JLWcj/iVBRSHJNDvCP8WwCEX+1EpsmSymQIxI6/BdFc=
-github.com/ministryofjustice/opg-go-common v0.0.0-20231002150139-ed6f6387fc7e/go.mod h1:1RmCNi6dkAv8umAgNHp8RkuBoSKLlxp1UtfsGYH7ufc=
 github.com/ministryofjustice/opg-go-common v0.0.0-20231009133357-1f236d604316 h1:iuo6s75firLntoOAU+SCaRnXUHlLfTIxru8hBlYsECw=
 github.com/ministryofjustice/opg-go-common v0.0.0-20231009133357-1f236d604316/go.mod h1:1RmCNi6dkAv8umAgNHp8RkuBoSKLlxp1UtfsGYH7ufc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -286,8 +238,6 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
-golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -314,8 +264,8 @@ golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -345,8 +295,6 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200323144430-8dcfad9e016e/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -367,8 +315,6 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.58.2 h1:SXUpjxeVF3FKrTYQI4f4KvbGD5u2xccdYdurwowix5I=
-google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc v1.58.3 h1:BjnpXut1btbtgN/6sp+brB2Kbm2LjNXnidYujAVbSoQ=
 google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
diff --git a/internal/app/donor_store.go b/internal/app/donor_store.go
index 156de864fa..e04092f991 100644
--- a/internal/app/donor_store.go
+++ b/internal/app/donor_store.go
@@ -174,9 +174,9 @@ func (s *donorStore) Put(ctx context.Context, lpa *page.Lpa) error {
 	if lpa.UID != "" && lpa.Tasks.PayForLpa.IsPending() && lpa.HasUnsentReducedFeesEvidence() {
 		var unsentKeys []string
 
-		for _, evidence := range lpa.EvidenceKeys {
-			if evidence.Sent.IsZero() {
-				unsentKeys = append(unsentKeys, evidence.Key)
+		for _, document := range lpa.Evidence.Documents {
+			if document.Sent.IsZero() {
+				unsentKeys = append(unsentKeys, document.Key)
 			}
 		}
 
@@ -187,9 +187,9 @@ func (s *donorStore) Put(ctx context.Context, lpa *page.Lpa) error {
 		}); err != nil {
 			s.logger.Print(err)
 		} else {
-			for i, evidence := range lpa.EvidenceKeys {
-				if evidence.Sent.IsZero() {
-					lpa.EvidenceKeys[i].Sent = s.now()
+			for i, document := range lpa.Evidence.Documents {
+				if document.Sent.IsZero() {
+					lpa.Evidence.Documents[i].Sent = s.now()
 				}
 			}
 		}
diff --git a/internal/app/donor_store_test.go b/internal/app/donor_store_test.go
index 22a791984a..637b3793e7 100644
--- a/internal/app/donor_store_test.go
+++ b/internal/app/donor_store_test.go
@@ -476,7 +476,7 @@ func TestDonorStorePutWhenReducedFeeRequested(t *testing.T) {
 			UID:                            "M-1111",
 			UpdatedAt:                      now,
 			FeeType:                        page.HalfFee,
-			EvidenceKeys:                   []page.Evidence{{Key: "lpa-uid-evidence-a-uid", Filename: "whatever.pdf", Sent: now}},
+			Evidence:                       page.Evidence{Documents: []page.Document{{Key: "lpa-uid-evidence-a-uid", Filename: "whatever.pdf", Sent: now}}},
 			Tasks:                          page.Tasks{PayForLpa: actor.PaymentTaskPending},
 			HasSentApplicationUpdatedEvent: true,
 		}).
@@ -499,7 +499,7 @@ func TestDonorStorePutWhenReducedFeeRequested(t *testing.T) {
 		ID:                             "5",
 		UID:                            "M-1111",
 		FeeType:                        page.HalfFee,
-		EvidenceKeys:                   []page.Evidence{{Key: "lpa-uid-evidence-a-uid", Filename: "whatever.pdf"}},
+		Evidence:                       page.Evidence{Documents: []page.Document{{Key: "lpa-uid-evidence-a-uid", Filename: "whatever.pdf"}}},
 		Tasks:                          page.Tasks{PayForLpa: actor.PaymentTaskPending},
 		HasSentApplicationUpdatedEvent: true,
 	})
@@ -519,11 +519,11 @@ func TestDonorStorePutWhenReducedFeeRequestedSentAndUnsentFees(t *testing.T) {
 			UID:       "M-1111",
 			UpdatedAt: now,
 			FeeType:   page.HalfFee,
-			EvidenceKeys: []page.Evidence{
+			Evidence: page.Evidence{Documents: []page.Document{
 				{Key: "lpa-uid-evidence-a-uid-1", Filename: "whatever.pdf", Sent: now},
 				{Key: "lpa-uid-evidence-a-uid-2", Filename: "whenever.pdf", Sent: now},
 				{Key: "lpa-uid-evidence-a-uid-3", Filename: "whoever.pdf", Sent: now},
-			},
+			}},
 			Tasks:                          page.Tasks{PayForLpa: actor.PaymentTaskPending},
 			HasSentApplicationUpdatedEvent: true,
 		}).
@@ -546,11 +546,11 @@ func TestDonorStorePutWhenReducedFeeRequestedSentAndUnsentFees(t *testing.T) {
 		ID:      "5",
 		UID:     "M-1111",
 		FeeType: page.HalfFee,
-		EvidenceKeys: []page.Evidence{
+		Evidence: page.Evidence{Documents: []page.Document{
 			{Key: "lpa-uid-evidence-a-uid-1", Filename: "whatever.pdf"},
 			{Key: "lpa-uid-evidence-a-uid-2", Filename: "whenever.pdf", Sent: now},
 			{Key: "lpa-uid-evidence-a-uid-3", Filename: "whoever.pdf"},
-		},
+		}},
 		Tasks:                          page.Tasks{PayForLpa: actor.PaymentTaskPending},
 		HasSentApplicationUpdatedEvent: true,
 	})
@@ -574,7 +574,7 @@ func TestDonorStorePutWhenReducedFeeRequestedWontResend(t *testing.T) {
 		ID:                             "5",
 		UID:                            "M-1111",
 		Tasks:                          page.Tasks{PayForLpa: actor.PaymentTaskPending},
-		EvidenceKeys:                   []page.Evidence{{Key: "lpa-uid-evidence-a-uid-1", Filename: "whatever.pdf", Sent: now}},
+		Evidence:                       page.Evidence{Documents: []page.Document{{Key: "lpa-uid-evidence-a-uid-1", Filename: "whatever.pdf", Sent: now}}},
 		HasSentApplicationUpdatedEvent: true,
 	})
 	assert.Nil(t, err)
@@ -592,7 +592,7 @@ func TestDonorStorePutWhenReducedFeeRequestedWhenError(t *testing.T) {
 			ID:                             "5",
 			UID:                            "M-1111",
 			Tasks:                          page.Tasks{PayForLpa: actor.PaymentTaskPending},
-			EvidenceKeys:                   []page.Evidence{{Sent: now}, {}},
+			Evidence:                       page.Evidence{Documents: []page.Document{{Sent: now}, {}}},
 			UpdatedAt:                      now,
 			HasSentApplicationUpdatedEvent: true,
 		}).
@@ -615,7 +615,7 @@ func TestDonorStorePutWhenReducedFeeRequestedWhenError(t *testing.T) {
 		ID:                             "5",
 		UID:                            "M-1111",
 		Tasks:                          page.Tasks{PayForLpa: actor.PaymentTaskPending},
-		EvidenceKeys:                   []page.Evidence{{Sent: now}, {}},
+		Evidence:                       page.Evidence{Documents: []page.Document{{Sent: now}, {}}},
 		HasSentApplicationUpdatedEvent: true,
 	})
 	assert.Nil(t, err)
diff --git a/internal/page/data.go b/internal/page/data.go
index cbc64446c6..75f0b0547e 100644
--- a/internal/page/data.go
+++ b/internal/page/data.go
@@ -181,17 +181,64 @@ type Lpa struct {
 
 	// FeeType is the type of fee the user is applying for
 	FeeType FeeType
-	// EvidenceKeys is the S3 keys for uploaded evidence with a record of when it's been sent to caseworkers
-	EvidenceKeys []Evidence
+	// Evidence is the documents uploaded by a donor to apply for non-full fees
+	Evidence Evidence
 
 	HasSentApplicationUpdatedEvent        bool
 	HasSentPreviousApplicationLinkedEvent bool
 }
 
 type Evidence struct {
-	Key      string
-	Filename string
-	Sent     time.Time
+	Documents []Document
+}
+
+func (es *Evidence) Delete(documentKey string) bool {
+	idx := slices.IndexFunc(es.Documents, func(d Document) bool { return d.Key == documentKey })
+	if idx == -1 {
+		return false
+	}
+
+	es.Documents = slices.Delete(es.Documents, idx, idx+1)
+
+	return true
+}
+
+func (es *Evidence) Keys() []string {
+	var keys []string
+
+	for _, d := range es.Documents {
+		keys = append(keys, d.Key)
+	}
+
+	return keys
+}
+
+func (es *Evidence) GetByKey(key string) Document {
+	for _, d := range es.Documents {
+		if d.Key == key {
+			return d
+		}
+	}
+
+	return Document{}
+}
+
+func (es *Evidence) Update(document Document) bool {
+	idx := slices.IndexFunc(es.Documents, func(d Document) bool { return d.Key == document.Key })
+	if idx == -1 {
+		return false
+	} else {
+		es.Documents[idx] = document
+		return true
+	}
+}
+
+type Document struct {
+	Key           string
+	Filename      string
+	Sent          time.Time
+	Scanned       time.Time
+	VirusDetected bool
 }
 
 type Payment struct {
@@ -504,8 +551,8 @@ func (l *Lpa) FeeAmount() int {
 }
 
 func (l *Lpa) HasUnsentReducedFeesEvidence() bool {
-	for _, evidence := range l.EvidenceKeys {
-		if evidence.Sent.IsZero() {
+	for _, document := range l.Evidence.Documents {
+		if document.Sent.IsZero() {
 			return true
 		}
 	}
diff --git a/internal/page/data_test.go b/internal/page/data_test.go
index 5c3c558462..befcddd1f8 100644
--- a/internal/page/data_test.go
+++ b/internal/page/data_test.go
@@ -1102,17 +1102,14 @@ func TestFeeAmount(t *testing.T) {
 }
 
 func TestHasUnsentReducedFeesEvidence(t *testing.T) {
-	lpa := Lpa{EvidenceKeys: []Evidence{
-		{Sent: time.Now()},
-		{},
-		{Sent: time.Now()},
-	}}
+	lpa := Lpa{Evidence: Evidence{Documents: []Document{
+		{Sent: time.Now()}, {}, {Sent: time.Now()}}},
+	}
 
 	assert.True(t, lpa.HasUnsentReducedFeesEvidence())
 
-	lpa.EvidenceKeys = []Evidence{
-		{Sent: time.Now()},
-		{Sent: time.Now()},
+	lpa.Evidence = Evidence{Documents: []Document{
+		{Sent: time.Now()}, {Sent: time.Now()}},
 	}
 
 	assert.False(t, lpa.HasUnsentReducedFeesEvidence())
diff --git a/internal/page/donor/upload_evidence.go b/internal/page/donor/upload_evidence.go
index 20d3b532c8..70c33b1b94 100644
--- a/internal/page/donor/upload_evidence.go
+++ b/internal/page/donor/upload_evidence.go
@@ -53,7 +53,7 @@ type uploadEvidenceData struct {
 	Errors               validation.List
 	NumberOfAllowedFiles int
 	FeeType              page.FeeType
-	Evidence             []page.Evidence
+	Evidence             page.Evidence
 	MimeTypes            []string
 }
 
@@ -63,7 +63,7 @@ func UploadEvidence(tmpl template.Template, payer Payer, donorStore DonorStore,
 			App:                  appData,
 			NumberOfAllowedFiles: numberOfAllowedFiles,
 			FeeType:              lpa.FeeType,
-			Evidence:             lpa.EvidenceKeys,
+			Evidence:             lpa.Evidence,
 			MimeTypes:            acceptedMimeTypes(),
 		}
 
@@ -89,14 +89,14 @@ func UploadEvidence(tmpl template.Template, payer Payer, donorStore DonorStore,
 							return err
 						}
 
-						lpa.EvidenceKeys = append(lpa.EvidenceKeys, page.Evidence{Key: key, Filename: file.Filename})
+						lpa.Evidence.Documents = append(lpa.Evidence.Documents, page.Document{Key: key, Filename: file.Filename})
 					}
 
 					if err := donorStore.Put(r.Context(), lpa); err != nil {
 						return err
 					}
 
-					data.Evidence = lpa.EvidenceKeys
+					data.Evidence = lpa.Evidence
 				} else {
 					return payer.Pay(appData, w, r, lpa)
 				}
diff --git a/internal/page/donor/upload_evidence_test.go b/internal/page/donor/upload_evidence_test.go
index 63d420e221..cd3a665b71 100644
--- a/internal/page/donor/upload_evidence_test.go
+++ b/internal/page/donor/upload_evidence_test.go
@@ -98,10 +98,11 @@ func TestPostUploadEvidenceWithUploadActionAcceptedFileTypes(t *testing.T) {
 				})).
 				Return(nil, nil)
 
-			evidence := []page.Evidence{
+			evidence := page.Evidence{Documents: []page.Document{
 				{Key: "lpa-uid/evidence/a-uid", Filename: filename},
-			}
-			updatedLpa := &page.Lpa{UID: "lpa-uid", EvidenceKeys: evidence, FeeType: page.HalfFee}
+			}}
+
+			updatedLpa := &page.Lpa{UID: "lpa-uid", Evidence: evidence, FeeType: page.HalfFee}
 
 			donorStore := newMockDonorStore(t)
 			donorStore.
@@ -163,11 +164,11 @@ func TestPostUploadEvidenceWithUploadActionMultipleFiles(t *testing.T) {
 		})).
 		Return(nil, nil)
 
-	evidence := []page.Evidence{
+	evidence := page.Evidence{Documents: []page.Document{
 		{Key: "lpa-uid/evidence/a-uid", Filename: "dummy.pdf"},
 		{Key: "lpa-uid/evidence/a-uid", Filename: "dummy.png"},
-	}
-	updatedLpa := &page.Lpa{UID: "lpa-uid", EvidenceKeys: evidence, FeeType: page.HalfFee}
+	}}
+	updatedLpa := &page.Lpa{UID: "lpa-uid", Evidence: evidence, FeeType: page.HalfFee}
 
 	donorStore := newMockDonorStore(t)
 	donorStore.
@@ -228,10 +229,10 @@ func TestPostUploadEvidenceWithUploadActionFilenameSpecialCharactersAreEscaped(t
 		})).
 		Return(nil, nil)
 
-	evidence := []page.Evidence{
+	evidence := page.Evidence{Documents: []page.Document{
 		{Key: "lpa-uid/evidence/a-uid", Filename: "&lt;img src=1 onerror=alert(document.domain)&gt;’ brute.heic"},
-	}
-	updatedLpa := &page.Lpa{UID: "lpa-uid", EvidenceKeys: evidence, FeeType: page.HalfFee}
+	}}
+	updatedLpa := &page.Lpa{UID: "lpa-uid", Evidence: evidence, FeeType: page.HalfFee}
 
 	donorStore := newMockDonorStore(t)
 	donorStore.
@@ -517,8 +518,8 @@ func TestPostUploadEvidenceWhenDonorStoreError(t *testing.T) {
 		})).
 		Return(nil, nil)
 
-	updatedLpa := &page.Lpa{UID: "lpa-uid", EvidenceKeys: []page.Evidence{
-		{Key: "lpa-uid/evidence/a-uid", Filename: "dummy.pdf"},
+	updatedLpa := &page.Lpa{UID: "lpa-uid", Evidence: page.Evidence{
+		Documents: []page.Document{{Key: "lpa-uid/evidence/a-uid", Filename: "dummy.pdf"}},
 	}}
 
 	donorStore := newMockDonorStore(t)
diff --git a/web/template/upload_evidence.gohtml b/web/template/upload_evidence.gohtml
index b96152d644..2a2e4075bd 100644
--- a/web/template/upload_evidence.gohtml
+++ b/web/template/upload_evidence.gohtml
@@ -3,7 +3,7 @@
 {{ define "pageTitle" }}{{ tr .App "uploadYourEvidence" }}{{ end }}
 
 {{ define "main" }}
-  {{ $evidenceCount := (len .Evidence) }}
+  {{ $evidenceCount := (len .Evidence.Documents) }}
   {{ if gt $evidenceCount 0 }}
     <div class="govuk-notification-banner govuk-notification-banner--success" role="alert" aria-labelledby="govuk-notification-banner-title" data-module="govuk-notification-banner">
       <div class="govuk-notification-banner__content">
@@ -54,7 +54,7 @@
             </dt>
             <dd class="govuk-summary-list__actions"></dd>
           </div>
-          {{ range .Evidence }}
+          {{ range .Evidence.Documents }}
             <div class="govuk-summary-list__row">
               <dt class="govuk-summary-list__value">
                 {{ .Filename }}

From 4e9afd36dde57779d1d0fb866a48f64f49f5cf3a Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Tue, 17 Oct 2023 18:09:41 +0100
Subject: [PATCH 02/19] drop unused struct

---
 internal/app/donor_store.go | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/internal/app/donor_store.go b/internal/app/donor_store.go
index e04092f991..62a8781663 100644
--- a/internal/app/donor_store.go
+++ b/internal/app/donor_store.go
@@ -230,13 +230,6 @@ type previousApplicationLinkedEvent struct {
 	PreviousApplicationNumber string `json:"previousApplicationNumber"`
 }
 
-type evidenceFormRequiredEvent struct {
-	UID        string  `json:"uid"`
-	FirstNames string  `json:"firstNames"`
-	LastName   string  `json:"lastName"`
-	Address    address `json:"address"`
-}
-
 type reducedFeeRequestedEvent struct {
 	UID         string   `json:"uid"`
 	RequestType string   `json:"requestType"`

From 34291f8f6d6ca1624f9fdf2ee16c41649fc44164 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Wed, 18 Oct 2023 13:44:52 +0100
Subject: [PATCH 03/19] make clear we are getting a document

---
 cmd/event-received/main.go             | 8 ++++----
 internal/page/data.go                  | 2 +-
 internal/page/data_test.go             | 6 +++---
 internal/page/donor/upload_evidence.go | 2 +-
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index c82d8ad038..af6f02a363 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -208,11 +208,11 @@ func handleDocumentScanned(ctx context.Context, client dynamodbClient, event eve
 		return err
 	}
 
-	evidence := lpa.Evidence.GetByKey(v.Key)
-	evidence.Scanned = now()
-	evidence.VirusDetected = v.VirusDetected
+	document := lpa.Evidence.GetByDocumentKey(v.Key)
+	document.Scanned = now()
+	document.VirusDetected = v.VirusDetected
 
-	if ok := lpa.Evidence.Update(evidence); !ok {
+	if ok := lpa.Evidence.Update(document); !ok {
 		return errors.New("failed to update evidence on LPA for 'document-scanned'")
 	}
 
diff --git a/internal/page/data.go b/internal/page/data.go
index 75f0b0547e..fb46bbc276 100644
--- a/internal/page/data.go
+++ b/internal/page/data.go
@@ -213,7 +213,7 @@ func (es *Evidence) Keys() []string {
 	return keys
 }
 
-func (es *Evidence) GetByKey(key string) Document {
+func (es *Evidence) GetByDocumentKey(key string) Document {
 	for _, d := range es.Documents {
 		if d.Key == key {
 			return d
diff --git a/internal/page/data_test.go b/internal/page/data_test.go
index b4d2890d6a..3a0f74bdc2 100644
--- a/internal/page/data_test.go
+++ b/internal/page/data_test.go
@@ -1147,7 +1147,7 @@ func TestEvidencesGetByKey(t *testing.T) {
 		{Key: "another-key"},
 	}}
 
-	assert.Equal(t, Document{Key: "a-key"}, evidence.GetByKey("a-key"))
-	assert.Equal(t, Document{Key: "another-key"}, evidence.GetByKey("another-key"))
-	assert.Equal(t, Document{}, evidence.GetByKey("not-a-key"))
+	assert.Equal(t, Document{Key: "a-key"}, evidence.GetByDocumentKey("a-key"))
+	assert.Equal(t, Document{Key: "another-key"}, evidence.GetByDocumentKey("another-key"))
+	assert.Equal(t, Document{}, evidence.GetByDocumentKey("not-a-key"))
 }
diff --git a/internal/page/donor/upload_evidence.go b/internal/page/donor/upload_evidence.go
index 02fa2fbec0..b1409bee74 100644
--- a/internal/page/donor/upload_evidence.go
+++ b/internal/page/donor/upload_evidence.go
@@ -97,7 +97,7 @@ func UploadEvidence(tmpl template.Template, payer Payer, donorStore DonorStore,
 					return payer.Pay(appData, w, r, lpa)
 
 				case "delete":
-					evidence := lpa.Evidence.GetByKey(form.DeleteKey)
+					evidence := lpa.Evidence.GetByDocumentKey(form.DeleteKey)
 					if evidence.Key != "" {
 						if err := evidenceS3Client.DeleteObject(r.Context(), evidence.Key); err != nil {
 							return err

From fc82ddea0a8ea7d3b840ba2123fd362bc39bd756 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Wed, 18 Oct 2023 18:27:22 +0100
Subject: [PATCH 04/19] add object tags added event commands

---
 Makefile | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/Makefile b/Makefile
index eb62376064..9ac0d3901d 100644
--- a/Makefile
+++ b/Makefile
@@ -84,28 +84,37 @@ run-structurizr-export:
 scan-lpas: ##@app dumps all entries in the lpas dynamodb table
 	docker compose -f docker/docker-compose.yml exec localstack awslocal dynamodb scan --table-name lpas
 
-get-lpa:  ##@app dumps all entries in the lpas dynamodb table that are related to the LPA id supplied e.g. get-lpa ID=abc-123
+get-lpa:  ##@app dumps all entries in the lpas dynamodb table that are related to the LPA id supplied e.g. get-lpa id=abc-123
 	docker compose -f docker/docker-compose.yml exec localstack awslocal dynamodb \
-		query --table-name lpas --key-condition-expression 'PK = :pk' --expression-attribute-values '{":pk": {"S": "LPA#$(ID)"}}'
+		query --table-name lpas --key-condition-expression 'PK = :pk' --expression-attribute-values '{":pk": {"S": "LPA#$(id)"}}'
 
-get-evidence:  ##@app dumps all fee evidence in the lpas dynamodb table that are related to the LPA id supplied e.g. get-evidence ID=abc-123
+get-evidence:  ##@app dumps all fee evidence in the lpas dynamodb table that are related to the LPA id supplied e.g. get-evidence id=abc-123
 	docker compose -f docker/docker-compose.yml exec localstack awslocal dynamodb \
-		query --table-name lpas --key-condition-expression 'PK = :pk' --expression-attribute-values '{":pk": {"S": "LPA#$(ID)"}}' --projection-expression "EvidenceKeys"
+		query --table-name lpas --key-condition-expression 'PK = :pk' --expression-attribute-values '{":pk": {"S": "LPA#$(id)"}}' --projection-expression "Evidence"
 
-emit-evidence-received: ##@app emits an evidence-received event with the given UID e.g. emit-evidence-received UID=abc-123
-	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"evidence-received","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(UID)"}}'
+emit-evidence-received: ##@app emits an evidence-received event with the given UID e.g. emit-evidence-received uid=abc-123
+	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"evidence-received","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(uid)"}}'
 
-emit-fee-approved: ##@app emits a fee-approved event with the given UID e.g. emit-fee-approved UID=abc-123
-	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"fee-approved","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(UID)"}}'
+emit-fee-approved: ##@app emits a fee-approved event with the given UID e.g. emit-fee-approved uid=abc-123
+	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"fee-approved","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(uid)"}}'
 
-emit-fee-denied: ##@app emits a fee-denied event with the given UID e.g. emit-fee-denied UID=abc-123
-	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"fee-denied","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(UID)"}}'
+emit-fee-denied: ##@app emits a fee-denied event with the given UID e.g. emit-fee-denied uid=abc-123
+	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"fee-denied","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(uid)"}}'
 
-emit-more-evidence-required: ##@app emits a more-evidence-required event with the given UID e.g. emit-more-evidence-required UID=abc-123
-	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"more-evidence-required","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(UID)"}}'
+emit-more-evidence-required: ##@app emits a more-evidence-required event with the given UID e.g. emit-more-evidence-required uid=abc-123
+	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"more-evidence-required","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(uid)"}}'
 
-emit-document-scanned: ##@app emits a document-scanned event with the given UID, S3 key and result and  e.g. emit-document-scanned UID=abc-123 key=doc/key virus_detected=false
-	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"document-scanned","source":"opg.poas.sirius","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"UID":"$(UID)","key":"$(key)","virus_detected":$(virus_detected)}}'
+emit-object-tags-added-with-virus: ##@app emits a Object Tags Added event with the given S3 key e.g. emit-object-tags-added-with-virus key=doc/key. Also ensures a tag with virus-scan-status exists on an existing object set to infected
+	docker compose -f docker/docker-compose.yml exec localstack awslocal s3api \
+		put-object-tagging --bucket evidence --key $(key) --tagging '{"TagSet": [{ "Key": "virus-scan-status", "Value": "infected" }]}'
+
+	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"Object Tags Added","source":"aws.s3","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"object":{"key":"$(key)"}}}'
+
+emit-object-tags-added-without-virus: ##@app emits a Object Tags Added event with the given S3 key e.g. emit-object-tags-added-with-virus key=doc/key. Also ensures a tag with virus-scan-status exists on an existing object set to ok
+	docker compose -f docker/docker-compose.yml exec localstack awslocal s3api \
+		put-object-tagging --bucket evidence --key $(key) --tagging '{"TagSet": [{ "Key": "virus-scan-status", "Value": "ok" }]}'
+
+	curl "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{"version":"0","id":"63eb7e5f-1f10-4744-bba9-e16d327c3b98","detail-type":"Object Tags Added","source":"aws.s3","account":"653761790766","time":"2023-08-30T13:40:30Z","region":"eu-west-1","resources":[],"detail":{"object":{"key":"$(key)"}}}'
 
 logs: ##@app tails logs for all containers running
 	docker compose -f docker/docker-compose.yml -f docker/docker-compose.dev.yml logs -f

From a4c2609a882b6a825acab1a66cc907dff0a031d3 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Wed, 18 Oct 2023 18:28:06 +0100
Subject: [PATCH 05/19] ignore all but app main.go in air (as we dont rebuild
 them)

---
 .air.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.air.toml b/.air.toml
index b4fef138ad..accc9ee16f 100644
--- a/.air.toml
+++ b/.air.toml
@@ -4,7 +4,7 @@ root = "."
 tmp_dir = "tmp"
 
 [build]
-exclude_dir = ["cypress", "docs", "tmp", "web/assets", "web/static", "node_modules", "scripts", "terraform"]
+exclude_dir = ["cypress", "docs", "tmp", "web/assets", "web/static", "node_modules", "scripts", "terraform", "cmd/event-received", "cmd/enumerator", "cmd/event-mock-notify", "cmd/mock.onelogin", "cmd/mock-os-api"]
 cmd = "cd cmd/mlpa && go build -ldflags='-X main.Tag=${TAG}' -gcflags='all=-N -l' -o /tmp/mlpa ."
 full_bin = "pkill -9 'dlv|mlpa'; sleep 0.1; dlv exec --accept-multiclient --log --headless --continue --listen :2345 --api-version 2 /tmp/mlpa"
 include_ext = ["go", "gohtml", "json"]

From 5fe0827e899fdb894c1a9674200a7ba6b727765e Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Wed, 18 Oct 2023 18:28:42 +0100
Subject: [PATCH 06/19] handle objectTagsAdded events

---
 cmd/event-received/main.go               | 115 +++++++++++++-----
 cmd/event-received/main_test.go          | 147 +++++++++++++++++++++--
 cmd/event-received/mock_s3Client_test.go |  56 +++++++++
 docker/docker-compose.dev.yml            |   1 +
 internal/s3/client.go                    |  14 +++
 internal/s3/mock_s3Service_test.go       |  33 +++++
 6 files changed, 322 insertions(+), 44 deletions(-)
 create mode 100644 cmd/event-received/mock_s3Client_test.go

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index af6f02a363..cfe21bcdff 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -3,16 +3,18 @@ package main
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
+	"log"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-lambda-go/events"
 	"github.com/aws/aws-lambda-go/lambda"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/actor"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/app"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/dynamo"
@@ -20,17 +22,27 @@ import (
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/notify"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/page"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/random"
+	"github.com/ministryofjustice/opg-modernising-lpa/internal/s3"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/secrets"
 )
 
+const (
+	virusFound                    = "infected"
+	evidenceReceivedEventName     = "evidence-received"
+	feeApprovedEventName          = "fee-approved"
+	feeDeniedEventName            = "fee-denied"
+	moreEvidenceRequiredEventName = "more-evidence-required"
+	objectTagsAddedEventName      = "Object Tags Added"
+)
+
 type uidEvent struct {
 	UID string `json:"uid"`
 }
 
-type documentScannedEvent struct {
-	UID           string `json:"uid"`
-	Key           string `json:"key"`
-	VirusDetected bool   `json:"virus_detected"`
+type objectTagsAddedEvent struct {
+	Object struct {
+		Key string `json:"key"`
+	} `json:"object"`
 }
 
 //go:generate mockery --testonly --inpackage --name dynamodbClient --structname mockDynamodbClient
@@ -40,6 +52,11 @@ type dynamodbClient interface {
 	Put(ctx context.Context, v interface{}) error
 }
 
+//go:generate mockery --testonly --inpackage --name s3Client --structname mockS3Client
+type s3Client interface {
+	GetObjectTags(ctx context.Context, key string) ([]types.Tag, error)
+}
+
 //go:generate mockery --testonly --inpackage --name shareCodeSender --structname mockShareCodeSender
 type shareCodeSender interface {
 	SendCertificateProvider(context.Context, notify.Template, page.AppData, bool, *page.Lpa) error
@@ -51,6 +68,7 @@ func Handler(ctx context.Context, event events.CloudWatchEvent) error {
 	appPublicURL := os.Getenv("APP_PUBLIC_URL")
 	awsBaseURL := os.Getenv("AWS_BASE_URL")
 	notifyBaseURL := os.Getenv("GOVUK_NOTIFY_BASE_URL")
+	evidenceBucketName := os.Getenv("UPLOADS_S3_BUCKET_NAME")
 
 	cfg, err := config.LoadDefaultConfig(ctx)
 	if err != nil {
@@ -67,6 +85,8 @@ func Handler(ctx context.Context, event events.CloudWatchEvent) error {
 		})
 	}
 
+	s3Client := s3.NewClient(cfg, evidenceBucketName)
+
 	dynamoClient, err := dynamo.NewClient(cfg, tableName)
 	if err != nil {
 		return fmt.Errorf("failed to create dynamodb client: %w", err)
@@ -93,16 +113,16 @@ func Handler(ctx context.Context, event events.CloudWatchEvent) error {
 	now := time.Now
 
 	switch event.DetailType {
-	case "evidence-received":
+	case evidenceReceivedEventName:
 		return handleEvidenceReceived(ctx, dynamoClient, event)
-	case "fee-approved":
+	case feeApprovedEventName:
 		return handleFeeApproved(ctx, dynamoClient, event, shareCodeSender, appData, now)
-	case "more-evidence-required":
+	case moreEvidenceRequiredEventName:
 		return handleMoreEvidenceRequired(ctx, dynamoClient, event, now)
-	case "fee-denied":
+	case feeDeniedEventName:
 		return handleFeeDenied(ctx, dynamoClient, event, now)
-	case "document-scanned":
-		return handleDocumentScanned(ctx, dynamoClient, event, now)
+	case objectTagsAddedEventName:
+		return handleObjectTagsAdded(ctx, dynamoClient, event, now, s3Client)
 	default:
 		return fmt.Errorf("unknown event received: %s", event.DetailType)
 	}
@@ -111,20 +131,20 @@ func Handler(ctx context.Context, event events.CloudWatchEvent) error {
 func handleEvidenceReceived(ctx context.Context, client dynamodbClient, event events.CloudWatchEvent) error {
 	var v uidEvent
 	if err := json.Unmarshal(event.Detail, &v); err != nil {
-		return fmt.Errorf("failed to unmarshal 'evidence-received' detail: %w", err)
+		return fmt.Errorf("failed to unmarshal '%s' detail: %w", evidenceReceivedEventName, err)
 	}
 
 	var key dynamo.Key
 	if err := client.OneByUID(ctx, v.UID, &key); err != nil {
-		return fmt.Errorf("failed to resolve uid for 'evidence-received': %w", err)
+		return fmt.Errorf("failed to resolve uid for '%s': %w", evidenceReceivedEventName, err)
 	}
 
 	if key.PK == "" {
-		return errors.New("PK missing from LPA in response to 'evidence-received'")
+		return fmt.Errorf("PK missing from LPA in response to '%s'", evidenceReceivedEventName)
 	}
 
 	if err := client.Put(ctx, map[string]string{"PK": key.PK, "SK": "#EVIDENCE_RECEIVED"}); err != nil {
-		return fmt.Errorf("failed to persist evidence received for 'evidence-received': %w", err)
+		return fmt.Errorf("failed to persist evidence received for '%s': %w", evidenceReceivedEventName, err)
 	}
 
 	return nil
@@ -133,10 +153,10 @@ func handleEvidenceReceived(ctx context.Context, client dynamodbClient, event ev
 func handleFeeApproved(ctx context.Context, dynamoClient dynamodbClient, event events.CloudWatchEvent, shareCodeSender shareCodeSender, appData page.AppData, now func() time.Time) error {
 	var v uidEvent
 	if err := json.Unmarshal(event.Detail, &v); err != nil {
-		return fmt.Errorf("failed to unmarshal 'fee-approved' detail: %w", err)
+		return fmt.Errorf("failed to unmarshal '%s' detail: %w", feeApprovedEventName, err)
 	}
 
-	lpa, err := getLpaByUID(ctx, dynamoClient, v.UID, "fee-approved")
+	lpa, err := getLpaByUID(ctx, dynamoClient, v.UID, feeApprovedEventName)
 	if err != nil {
 		return err
 	}
@@ -145,11 +165,11 @@ func handleFeeApproved(ctx context.Context, dynamoClient dynamodbClient, event e
 	lpa.UpdatedAt = now()
 
 	if err := dynamoClient.Put(ctx, lpa); err != nil {
-		return fmt.Errorf("failed to update LPA task status for 'fee-approved': %w", err)
+		return fmt.Errorf("failed to update LPA task status for '%s': %w", feeApprovedEventName, err)
 	}
 
 	if err := shareCodeSender.SendCertificateProvider(ctx, notify.CertificateProviderInviteEmail, appData, false, &lpa); err != nil {
-		return fmt.Errorf("failed to send share code to certificate provider for 'fee-approved': %w", err)
+		return fmt.Errorf("failed to send share code to certificate provider for '%s': %w", feeApprovedEventName, err)
 	}
 
 	return nil
@@ -158,10 +178,10 @@ func handleFeeApproved(ctx context.Context, dynamoClient dynamodbClient, event e
 func handleMoreEvidenceRequired(ctx context.Context, client dynamodbClient, event events.CloudWatchEvent, now func() time.Time) error {
 	var v uidEvent
 	if err := json.Unmarshal(event.Detail, &v); err != nil {
-		return fmt.Errorf("failed to unmarshal 'more-evidence-required' detail: %w", err)
+		return fmt.Errorf("failed to unmarshal '%s' detail: %w", moreEvidenceRequiredEventName, err)
 	}
 
-	lpa, err := getLpaByUID(ctx, client, v.UID, "more-evidence-required")
+	lpa, err := getLpaByUID(ctx, client, v.UID, moreEvidenceRequiredEventName)
 	if err != nil {
 		return err
 	}
@@ -170,7 +190,7 @@ func handleMoreEvidenceRequired(ctx context.Context, client dynamodbClient, even
 	lpa.UpdatedAt = now()
 
 	if err := client.Put(ctx, lpa); err != nil {
-		return fmt.Errorf("failed to update LPA task status for 'more-evidence-required': %w", err)
+		return fmt.Errorf("failed to update LPA task status for '%s': %w", moreEvidenceRequiredEventName, err)
 	}
 
 	return nil
@@ -179,10 +199,10 @@ func handleMoreEvidenceRequired(ctx context.Context, client dynamodbClient, even
 func handleFeeDenied(ctx context.Context, client dynamodbClient, event events.CloudWatchEvent, now func() time.Time) error {
 	var v uidEvent
 	if err := json.Unmarshal(event.Detail, &v); err != nil {
-		return fmt.Errorf("failed to unmarshal 'fee-denied' detail: %w", err)
+		return fmt.Errorf("failed to unmarshal '%s' detail: %w", feeDeniedEventName, err)
 	}
 
-	lpa, err := getLpaByUID(ctx, client, v.UID, "fee-denied")
+	lpa, err := getLpaByUID(ctx, client, v.UID, feeDeniedEventName)
 	if err != nil {
 		return err
 	}
@@ -191,35 +211,64 @@ func handleFeeDenied(ctx context.Context, client dynamodbClient, event events.Cl
 	lpa.UpdatedAt = now()
 
 	if err := client.Put(ctx, lpa); err != nil {
-		return fmt.Errorf("failed to update LPA task status for 'fee-denied': %w", err)
+		return fmt.Errorf("failed to update LPA task status for '%s': %w", feeDeniedEventName, err)
 	}
 
 	return nil
 }
 
-func handleDocumentScanned(ctx context.Context, client dynamodbClient, event events.CloudWatchEvent, now func() time.Time) error {
-	var v documentScannedEvent
+func handleObjectTagsAdded(ctx context.Context, client dynamodbClient, event events.CloudWatchEvent, now func() time.Time, s3Client s3Client) error {
+	var v objectTagsAddedEvent
 	if err := json.Unmarshal(event.Detail, &v); err != nil {
-		return fmt.Errorf("failed to unmarshal 'document-scanned' detail: %w", err)
+		return fmt.Errorf("failed to unmarshal '%s' detail: %w", objectTagsAddedEventName, err)
+	}
+
+	log.Println(v)
+
+	objectKey := v.Object.Key
+
+	tags, err := s3Client.GetObjectTags(ctx, objectKey)
+	if err != nil {
+		return fmt.Errorf("failed to get tags for object in '%s': %w", objectTagsAddedEventName, err)
 	}
 
-	lpa, err := getLpaByUID(ctx, client, v.UID, "document-scanned")
+	hasScannedTag := false
+	var tagIndex int
+
+	for i, tag := range tags {
+		if *tag.Key == "virus-scan-status" {
+			hasScannedTag = true
+			tagIndex = i
+		}
+	}
+
+	if !hasScannedTag {
+		return nil
+	}
+
+	uid := strings.Split(objectKey, "/")
+
+	lpa, err := getLpaByUID(ctx, client, uid[0], objectTagsAddedEventName)
 	if err != nil {
 		return err
 	}
 
-	document := lpa.Evidence.GetByDocumentKey(v.Key)
+	document := lpa.Evidence.GetByDocumentKey(objectKey)
+	if document.Key == "" {
+		return fmt.Errorf("LPA did not contain a document with key %s for '%s'", objectKey, objectTagsAddedEventName)
+	}
+
 	document.Scanned = now()
-	document.VirusDetected = v.VirusDetected
+	document.VirusDetected = *tags[tagIndex].Value == virusFound
 
 	if ok := lpa.Evidence.Update(document); !ok {
-		return errors.New("failed to update evidence on LPA for 'document-scanned'")
+		return fmt.Errorf("failed to update evidence on LPA for '%s'", objectTagsAddedEventName)
 	}
 
 	lpa.UpdatedAt = now()
 
 	if err := client.Put(ctx, lpa); err != nil {
-		return fmt.Errorf("failed to update LPA for 'document-scanned': %w", err)
+		return fmt.Errorf("failed to update LPA for '%s': %w", objectTagsAddedEventName, err)
 	}
 
 	return nil
diff --git a/cmd/event-received/main_test.go b/cmd/event-received/main_test.go
index bcfbc7b9e6..d3a8d2a6e3 100644
--- a/cmd/event-received/main_test.go
+++ b/cmd/event-received/main_test.go
@@ -9,6 +9,8 @@ import (
 	"time"
 
 	"github.com/aws/aws-lambda-go/events"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/actor"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/dynamo"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/notify"
@@ -331,41 +333,165 @@ func TestHandleFeeDeniedWhenPutError(t *testing.T) {
 	assert.Equal(t, fmt.Errorf("failed to update LPA task status for 'fee-denied': %w", expectedError), err)
 }
 
-func TestHandleDocumentScanned(t *testing.T) {
+func TestHandleObjectTagsAdded(t *testing.T) {
 	event := events.CloudWatchEvent{
-		DetailType: "document-scanned",
-		Detail:     json.RawMessage(`{"uid":"M-1111-2222-3333", "key": "document/key", "virus_detected": false}`),
+		DetailType: "Object Tags Added",
+		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
 	}
 
 	now := time.Now()
 
-	client := newMockDynamodbClient(t)
-	client.
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+		}, nil)
+
+	dynamoClient := newMockDynamodbClient(t)
+	dynamoClient.
 		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
 		Return(func(ctx context.Context, uid string, v interface{}) error {
 			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
 			json.Unmarshal(b, v)
 			return nil
 		})
-	client.
+	dynamoClient.
 		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
 		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
 			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
-				Documents: []page.Document{{Key: "document/key"}},
+				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
 			}})
 			json.Unmarshal(b, v)
 			return nil
 		})
-	client.
+	dynamoClient.
 		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
-			Documents: []page.Document{{Key: "document/key", Scanned: now, VirusDetected: false}},
+			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
 		}}).
 		Return(nil)
 
-	err := handleDocumentScanned(ctx, client, event, func() time.Time { return now })
+	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
 	assert.Nil(t, err)
 }
 
+func TestHandleObjectTagsAddedWhenGetObjectTagsError(t *testing.T) {
+	event := events.CloudWatchEvent{
+		DetailType: "Object Tags Added",
+		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+		}, expectedError)
+
+	err := handleObjectTagsAdded(ctx, nil, event, func() time.Time { return now }, s3Client)
+	assert.Equal(t, fmt.Errorf("failed to get tags for object in 'Object Tags Added': %w", expectedError), err)
+}
+
+func TestHandleObjectTagsAddedWhenDoesNotContainVirusScanTag(t *testing.T) {
+	event := events.CloudWatchEvent{
+		DetailType: "Object Tags Added",
+		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("not-virus-scan-status")},
+		}, nil)
+
+	err := handleObjectTagsAdded(ctx, nil, event, func() time.Time { return now }, s3Client)
+	assert.Nil(t, err)
+}
+
+func TestHandleObjectTagsAddedWhenLpaEvidenceDoesNotContainDocument(t *testing.T) {
+	event := events.CloudWatchEvent{
+		DetailType: "Object Tags Added",
+		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+		}, nil)
+
+	dynamoClient := newMockDynamodbClient(t)
+	dynamoClient.
+		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
+		Return(func(ctx context.Context, uid string, v interface{}) error {
+			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	dynamoClient.
+		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-different-uid"}},
+			}})
+			json.Unmarshal(b, v)
+			return nil
+		})
+
+	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
+	assert.Equal(t, fmt.Errorf("LPA did not contain a document with key %s for 'Object Tags Added'", "M-1111-2222-3333/evidence/a-uid"), err)
+}
+
+func TestHandleObjectTagsAddedWhenDynamoPutError(t *testing.T) {
+	event := events.CloudWatchEvent{
+		DetailType: "Object Tags Added",
+		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+		}, nil)
+
+	dynamoClient := newMockDynamodbClient(t)
+	dynamoClient.
+		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
+		Return(func(ctx context.Context, uid string, v interface{}) error {
+			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	dynamoClient.
+		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
+			}})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	dynamoClient.
+		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
+			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
+		}}).
+		Return(expectedError)
+
+	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
+	assert.Equal(t, fmt.Errorf("failed to update LPA for 'Object Tags Added': %w", expectedError), err)
+}
+
 func TestGetLpaByUID(t *testing.T) {
 	expectedLpa := page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
 		Documents: []page.Document{{Key: "document/key"}},
@@ -419,7 +545,6 @@ func TestGetLpaByUIDWhenPKMissing(t *testing.T) {
 
 	assert.Equal(t, page.Lpa{}, lpa)
 	assert.Equal(t, errors.New("PK missing from LPA in response to 'an-event'"), err)
-
 }
 
 func TestGetLpaByUIDWhenClientOneError(t *testing.T) {
diff --git a/cmd/event-received/mock_s3Client_test.go b/cmd/event-received/mock_s3Client_test.go
new file mode 100644
index 0000000000..a9456db432
--- /dev/null
+++ b/cmd/event-received/mock_s3Client_test.go
@@ -0,0 +1,56 @@
+// Code generated by mockery v2.20.0. DO NOT EDIT.
+
+package main
+
+import (
+	context "context"
+
+	types "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// mockS3Client is an autogenerated mock type for the s3Client type
+type mockS3Client struct {
+	mock.Mock
+}
+
+// GetObjectTags provides a mock function with given fields: ctx, key
+func (_m *mockS3Client) GetObjectTags(ctx context.Context, key string) ([]types.Tag, error) {
+	ret := _m.Called(ctx, key)
+
+	var r0 []types.Tag
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string) ([]types.Tag, error)); ok {
+		return rf(ctx, key)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string) []types.Tag); ok {
+		r0 = rf(ctx, key)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]types.Tag)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string) error); ok {
+		r1 = rf(ctx, key)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+type mockConstructorTestingTnewMockS3Client interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// newMockS3Client creates a new instance of mockS3Client. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func newMockS3Client(t mockConstructorTestingTnewMockS3Client) *mockS3Client {
+	mock := &mockS3Client{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/docker/docker-compose.dev.yml b/docker/docker-compose.dev.yml
index b807303ad2..a92d83c71d 100644
--- a/docker/docker-compose.dev.yml
+++ b/docker/docker-compose.dev.yml
@@ -38,6 +38,7 @@ services:
       - GOVUK_NOTIFY_IS_PRODUCTION=0
       - APP_PUBLIC_URL=http://localhost:5050
       - GOVUK_NOTIFY_BASE_URL=http://mock-notify:8080
+      - UPLOADS_S3_BUCKET_NAME=evidence
     ports:
       - "9000:8080"
     entrypoint: aws-lambda-rie /var/task/event-received
diff --git a/internal/s3/client.go b/internal/s3/client.go
index d20904e16b..8309322e4a 100644
--- a/internal/s3/client.go
+++ b/internal/s3/client.go
@@ -14,6 +14,7 @@ type s3Service interface {
 	PutObject(context.Context, *s3.PutObjectInput, ...func(*s3.Options)) (*s3.PutObjectOutput, error)
 	PutObjectTagging(context.Context, *s3.PutObjectTaggingInput, ...func(*s3.Options)) (*s3.PutObjectTaggingOutput, error)
 	DeleteObject(context.Context, *s3.DeleteObjectInput, ...func(*s3.Options)) (*s3.DeleteObjectOutput, error)
+	GetObjectTagging(ctx context.Context, params *s3.GetObjectTaggingInput, optFns ...func(*s3.Options)) (*s3.GetObjectTaggingOutput, error)
 }
 
 type Client struct {
@@ -36,6 +37,19 @@ func (c *Client) DeleteObject(ctx context.Context, key string) error {
 	return err
 }
 
+func (c *Client) GetObjectTags(ctx context.Context, key string) ([]types.Tag, error) {
+	output, err := c.svc.GetObjectTagging(ctx, &s3.GetObjectTaggingInput{
+		Bucket: aws.String(c.bucket),
+		Key:    aws.String(key),
+	})
+
+	if err != nil {
+		return []types.Tag{}, err
+	}
+
+	return output.TagSet, nil
+}
+
 func (c *Client) PutObjectTagging(ctx context.Context, key string, tagSet []types.Tag) error {
 	_, err := c.svc.PutObjectTagging(ctx, &s3.PutObjectTaggingInput{
 		Bucket:  aws.String(c.bucket),
diff --git a/internal/s3/mock_s3Service_test.go b/internal/s3/mock_s3Service_test.go
index c562f8130b..faec27971b 100644
--- a/internal/s3/mock_s3Service_test.go
+++ b/internal/s3/mock_s3Service_test.go
@@ -47,6 +47,39 @@ func (_m *mockS3Service) DeleteObject(_a0 context.Context, _a1 *services3.Delete
 	return r0, r1
 }
 
+// GetObjectTagging provides a mock function with given fields: ctx, params, optFns
+func (_m *mockS3Service) GetObjectTagging(ctx context.Context, params *services3.GetObjectTaggingInput, optFns ...func(*services3.Options)) (*services3.GetObjectTaggingOutput, error) {
+	_va := make([]interface{}, len(optFns))
+	for _i := range optFns {
+		_va[_i] = optFns[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, params)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 *services3.GetObjectTaggingOutput
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *services3.GetObjectTaggingInput, ...func(*services3.Options)) (*services3.GetObjectTaggingOutput, error)); ok {
+		return rf(ctx, params, optFns...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *services3.GetObjectTaggingInput, ...func(*services3.Options)) *services3.GetObjectTaggingOutput); ok {
+		r0 = rf(ctx, params, optFns...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*services3.GetObjectTaggingOutput)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *services3.GetObjectTaggingInput, ...func(*services3.Options)) error); ok {
+		r1 = rf(ctx, params, optFns...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // PutObject provides a mock function with given fields: _a0, _a1, _a2
 func (_m *mockS3Service) PutObject(_a0 context.Context, _a1 *services3.PutObjectInput, _a2 ...func(*services3.Options)) (*services3.PutObjectOutput, error) {
 	_va := make([]interface{}, len(_a2))

From cc06e4ed82cecdd20426e8b149ca0934f63a9795 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Wed, 18 Oct 2023 18:54:57 +0100
Subject: [PATCH 07/19] cov bump

---
 internal/page/data_test.go | 20 +++++++++++++++++---
 internal/s3/client_test.go | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/internal/page/data_test.go b/internal/page/data_test.go
index 3a0f74bdc2..169e0d25d9 100644
--- a/internal/page/data_test.go
+++ b/internal/page/data_test.go
@@ -1115,7 +1115,7 @@ func TestHasUnsentReducedFeesEvidence(t *testing.T) {
 	assert.False(t, lpa.HasUnsentReducedFeesEvidence())
 }
 
-func TestEvidencesDelete(t *testing.T) {
+func TestEvidenceDelete(t *testing.T) {
 	evidence := Evidence{Documents: []Document{
 		{Key: "a-key"},
 		{Key: "another-key"},
@@ -1132,7 +1132,7 @@ func TestEvidencesDelete(t *testing.T) {
 	assert.False(t, evidence.Delete("not-a-key"))
 }
 
-func TestEvidencesKeys(t *testing.T) {
+func TestEvidenceKeys(t *testing.T) {
 	evidence := Evidence{Documents: []Document{
 		{Key: "a-key"},
 		{Key: "another-key"},
@@ -1141,7 +1141,7 @@ func TestEvidencesKeys(t *testing.T) {
 	assert.Equal(t, []string{"a-key", "another-key"}, evidence.Keys())
 }
 
-func TestEvidencesGetByKey(t *testing.T) {
+func TestEvidenceGetByKey(t *testing.T) {
 	evidence := Evidence{Documents: []Document{
 		{Key: "a-key"},
 		{Key: "another-key"},
@@ -1151,3 +1151,17 @@ func TestEvidencesGetByKey(t *testing.T) {
 	assert.Equal(t, Document{Key: "another-key"}, evidence.GetByDocumentKey("another-key"))
 	assert.Equal(t, Document{}, evidence.GetByDocumentKey("not-a-key"))
 }
+
+func TestEvidenceUpdate(t *testing.T) {
+	evidence := Evidence{Documents: []Document{
+		{Key: "a-key", Filename: "a-filename"},
+		{Key: "another-key", Filename: "another-filename"},
+	}}
+
+	assert.True(t, evidence.Update(Document{Key: "a-key", Filename: "a-new-filename"}))
+
+	assert.Equal(t, Document{Key: "a-key", Filename: "a-new-filename"}, evidence.Documents[0])
+	assert.Equal(t, Document{Key: "another-key", Filename: "another-filename"}, evidence.Documents[1])
+
+	assert.False(t, evidence.Update(Document{Key: "not-a-key"}))
+}
diff --git a/internal/s3/client_test.go b/internal/s3/client_test.go
index e36d4ccc52..ee1524ee05 100644
--- a/internal/s3/client_test.go
+++ b/internal/s3/client_test.go
@@ -119,3 +119,41 @@ func TestPutObjectOnServiceError(t *testing.T) {
 
 	assert.Equal(t, expectedError, err)
 }
+
+func TestGetObjectTags(t *testing.T) {
+	expectedTagSet := []types.Tag{
+		{Key: aws.String("a-tag-key"), Value: aws.String("a-value")},
+		{Key: aws.String("another-tag-key"), Value: aws.String("another-value")},
+	}
+
+	s3Service := newMockS3Service(t)
+	s3Service.
+		On("GetObjectTagging", context.Background(), &s3.GetObjectTaggingInput{
+			Bucket: aws.String("a-bucket"),
+			Key:    aws.String("a-object-key"),
+		}).
+		Return(&s3.GetObjectTaggingOutput{
+			TagSet: expectedTagSet,
+		}, nil)
+
+	client := Client{bucket: "a-bucket", svc: s3Service}
+	tags, err := client.GetObjectTags(context.Background(), "a-object-key")
+
+	assert.Nil(t, err)
+	assert.Equal(t, expectedTagSet, tags)
+}
+
+func TestGetObjectTagsOnServiceError(t *testing.T) {
+	s3Service := newMockS3Service(t)
+	s3Service.
+		On("GetObjectTagging", context.Background(), &s3.GetObjectTaggingInput{
+			Bucket: aws.String("a-bucket"),
+			Key:    aws.String("a-object-key"),
+		}).
+		Return(&s3.GetObjectTaggingOutput{}, expectedError)
+
+	client := Client{bucket: "a-bucket", svc: s3Service}
+	_, err := client.GetObjectTags(context.Background(), "a-object-key")
+
+	assert.Equal(t, expectedError, err)
+}

From d128bb720e9df35cd75aac77a65dea1782ac8906 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Thu, 19 Oct 2023 09:22:07 +0100
Subject: [PATCH 08/19] tidy

---
 cmd/event-received/main.go |  3 ---
 internal/page/data.go      | 20 ++++++++++----------
 2 files changed, 10 insertions(+), 13 deletions(-)

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index cfe21bcdff..4274ddf2df 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"log"
 	"net/http"
 	"os"
 	"strings"
@@ -223,8 +222,6 @@ func handleObjectTagsAdded(ctx context.Context, client dynamodbClient, event eve
 		return fmt.Errorf("failed to unmarshal '%s' detail: %w", objectTagsAddedEventName, err)
 	}
 
-	log.Println(v)
-
 	objectKey := v.Object.Key
 
 	tags, err := s3Client.GetObjectTags(ctx, objectKey)
diff --git a/internal/page/data.go b/internal/page/data.go
index fb46bbc276..09d4e015e6 100644
--- a/internal/page/data.go
+++ b/internal/page/data.go
@@ -192,29 +192,29 @@ type Evidence struct {
 	Documents []Document
 }
 
-func (es *Evidence) Delete(documentKey string) bool {
-	idx := slices.IndexFunc(es.Documents, func(d Document) bool { return d.Key == documentKey })
+func (e *Evidence) Delete(documentKey string) bool {
+	idx := slices.IndexFunc(e.Documents, func(d Document) bool { return d.Key == documentKey })
 	if idx == -1 {
 		return false
 	}
 
-	es.Documents = slices.Delete(es.Documents, idx, idx+1)
+	e.Documents = slices.Delete(e.Documents, idx, idx+1)
 
 	return true
 }
 
-func (es *Evidence) Keys() []string {
+func (e *Evidence) Keys() []string {
 	var keys []string
 
-	for _, d := range es.Documents {
+	for _, d := range e.Documents {
 		keys = append(keys, d.Key)
 	}
 
 	return keys
 }
 
-func (es *Evidence) GetByDocumentKey(key string) Document {
-	for _, d := range es.Documents {
+func (e *Evidence) GetByDocumentKey(key string) Document {
+	for _, d := range e.Documents {
 		if d.Key == key {
 			return d
 		}
@@ -223,12 +223,12 @@ func (es *Evidence) GetByDocumentKey(key string) Document {
 	return Document{}
 }
 
-func (es *Evidence) Update(document Document) bool {
-	idx := slices.IndexFunc(es.Documents, func(d Document) bool { return d.Key == document.Key })
+func (e *Evidence) Update(document Document) bool {
+	idx := slices.IndexFunc(e.Documents, func(d Document) bool { return d.Key == document.Key })
 	if idx == -1 {
 		return false
 	} else {
-		es.Documents[idx] = document
+		e.Documents[idx] = document
 		return true
 	}
 }

From 7974d9fb55713febc5da7ea0aadd8a759c984091 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Fri, 20 Oct 2023 10:46:25 +0100
Subject: [PATCH 09/19] simplify tag checking, bring Evidence funcs in line
 with other collections

---
 cmd/event-received/main.go             | 16 +++++++---------
 internal/page/data.go                  |  9 ++++-----
 internal/page/data_test.go             | 15 +++++++--------
 internal/page/donor/upload_evidence.go |  2 +-
 4 files changed, 19 insertions(+), 23 deletions(-)

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index 4274ddf2df..eac46c4aa8 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -230,12 +230,13 @@ func handleObjectTagsAdded(ctx context.Context, client dynamodbClient, event eve
 	}
 
 	hasScannedTag := false
-	var tagIndex int
+	hasVirus := false
 
-	for i, tag := range tags {
+	for _, tag := range tags {
 		if *tag.Key == "virus-scan-status" {
 			hasScannedTag = true
-			tagIndex = i
+			hasVirus = *tag.Value == virusFound
+			break
 		}
 	}
 
@@ -250,18 +251,15 @@ func handleObjectTagsAdded(ctx context.Context, client dynamodbClient, event eve
 		return err
 	}
 
-	document := lpa.Evidence.GetByDocumentKey(objectKey)
+	document := lpa.Evidence.Get(objectKey)
 	if document.Key == "" {
 		return fmt.Errorf("LPA did not contain a document with key %s for '%s'", objectKey, objectTagsAddedEventName)
 	}
 
 	document.Scanned = now()
-	document.VirusDetected = *tags[tagIndex].Value == virusFound
-
-	if ok := lpa.Evidence.Update(document); !ok {
-		return fmt.Errorf("failed to update evidence on LPA for '%s'", objectTagsAddedEventName)
-	}
+	document.VirusDetected = hasVirus
 
+	lpa.Evidence.Put(document)
 	lpa.UpdatedAt = now()
 
 	if err := client.Put(ctx, lpa); err != nil {
diff --git a/internal/page/data.go b/internal/page/data.go
index 09d4e015e6..26e6a9b360 100644
--- a/internal/page/data.go
+++ b/internal/page/data.go
@@ -213,9 +213,9 @@ func (e *Evidence) Keys() []string {
 	return keys
 }
 
-func (e *Evidence) GetByDocumentKey(key string) Document {
+func (e *Evidence) Get(documentKey string) Document {
 	for _, d := range e.Documents {
-		if d.Key == key {
+		if d.Key == documentKey {
 			return d
 		}
 	}
@@ -223,13 +223,12 @@ func (e *Evidence) GetByDocumentKey(key string) Document {
 	return Document{}
 }
 
-func (e *Evidence) Update(document Document) bool {
+func (e *Evidence) Put(document Document) {
 	idx := slices.IndexFunc(e.Documents, func(d Document) bool { return d.Key == document.Key })
 	if idx == -1 {
-		return false
+		e.Documents = append(e.Documents, document)
 	} else {
 		e.Documents[idx] = document
-		return true
 	}
 }
 
diff --git a/internal/page/data_test.go b/internal/page/data_test.go
index 169e0d25d9..021fcf03b5 100644
--- a/internal/page/data_test.go
+++ b/internal/page/data_test.go
@@ -1147,21 +1147,20 @@ func TestEvidenceGetByKey(t *testing.T) {
 		{Key: "another-key"},
 	}}
 
-	assert.Equal(t, Document{Key: "a-key"}, evidence.GetByDocumentKey("a-key"))
-	assert.Equal(t, Document{Key: "another-key"}, evidence.GetByDocumentKey("another-key"))
-	assert.Equal(t, Document{}, evidence.GetByDocumentKey("not-a-key"))
+	assert.Equal(t, Document{Key: "a-key"}, evidence.Get("a-key"))
+	assert.Equal(t, Document{Key: "another-key"}, evidence.Get("another-key"))
+	assert.Equal(t, Document{}, evidence.Get("not-a-key"))
 }
 
-func TestEvidenceUpdate(t *testing.T) {
+func TestEvidencePut(t *testing.T) {
 	evidence := Evidence{Documents: []Document{
 		{Key: "a-key", Filename: "a-filename"},
 		{Key: "another-key", Filename: "another-filename"},
 	}}
 
-	assert.True(t, evidence.Update(Document{Key: "a-key", Filename: "a-new-filename"}))
-
+	evidence.Put(Document{Key: "a-key", Filename: "a-new-filename"})
 	assert.Equal(t, Document{Key: "a-key", Filename: "a-new-filename"}, evidence.Documents[0])
-	assert.Equal(t, Document{Key: "another-key", Filename: "another-filename"}, evidence.Documents[1])
 
-	assert.False(t, evidence.Update(Document{Key: "not-a-key"}))
+	evidence.Put(Document{Key: "new-key", Filename: "a-filename"})
+	assert.Equal(t, Document{Key: "new-key", Filename: "a-filename"}, evidence.Documents[2])
 }
diff --git a/internal/page/donor/upload_evidence.go b/internal/page/donor/upload_evidence.go
index b1409bee74..041306d262 100644
--- a/internal/page/donor/upload_evidence.go
+++ b/internal/page/donor/upload_evidence.go
@@ -97,7 +97,7 @@ func UploadEvidence(tmpl template.Template, payer Payer, donorStore DonorStore,
 					return payer.Pay(appData, w, r, lpa)
 
 				case "delete":
-					evidence := lpa.Evidence.GetByDocumentKey(form.DeleteKey)
+					evidence := lpa.Evidence.Get(form.DeleteKey)
 					if evidence.Key != "" {
 						if err := evidenceS3Client.DeleteObject(r.Context(), evidence.Key); err != nil {
 							return err

From 12a2a229a1f98c2e0370f8d77178f707dc25efa8 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Fri, 20 Oct 2023 12:14:12 +0100
Subject: [PATCH 10/19] allow s3:ObjectTagging:Put events to be seen in
 EventBridge

---
 .../region/modules/s3_bucket_event_notifications/variables.tf    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/terraform/account/region/modules/s3_bucket_event_notifications/variables.tf b/terraform/account/region/modules/s3_bucket_event_notifications/variables.tf
index 1b091e5431..edd777efae 100644
--- a/terraform/account/region/modules/s3_bucket_event_notifications/variables.tf
+++ b/terraform/account/region/modules/s3_bucket_event_notifications/variables.tf
@@ -4,6 +4,7 @@ variable "s3_bucket_event_types" {
   default = [
     "s3:ObjectRemoved:*",
     "s3:ObjectAcl:Put",
+    "s3:ObjectTagging:Put",
   ]
 }
 

From 7a25379ebed3984d9eb9c6fe4729f807fb15db4a Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Fri, 20 Oct 2023 13:13:37 +0100
Subject: [PATCH 11/19] actually add event to to the real resource

---
 terraform/account/region/s3_lb_access_logs.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/terraform/account/region/s3_lb_access_logs.tf b/terraform/account/region/s3_lb_access_logs.tf
index 61d7da5186..31b2308757 100644
--- a/terraform/account/region/s3_lb_access_logs.tf
+++ b/terraform/account/region/s3_lb_access_logs.tf
@@ -187,6 +187,7 @@ module "s3_event_notifications" {
   s3_bucket_event_types = [
     "s3:ObjectRemoved:*",
     "s3:ObjectAcl:Put",
+    "s3:ObjectTagging:Put",
   ]
   sns_kms_key_alias             = var.sns_kms_key_alias
   s3_bucket_id                  = aws_s3_bucket.access_log.id

From a9d6c76b333506d8f78e41fa6320ad3446844751 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Fri, 20 Oct 2023 14:41:37 +0100
Subject: [PATCH 12/19] debug

---
 cmd/event-received/main.go                                  | 4 ++++
 .../s3_bucket_event_notifications/s3_bucket_notification.tf | 1 +
 .../environment/region/modules/event_received/lambda.tf     | 6 ++++--
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index eac46c4aa8..1b734c8ec5 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/http"
 	"os"
 	"strings"
@@ -111,6 +112,9 @@ func Handler(ctx context.Context, event events.CloudWatchEvent) error {
 	shareCodeSender := page.NewShareCodeSender(app.NewShareCodeStore(dynamoClient), notifyClient, appPublicURL, random.String)
 	now := time.Now
 
+	eJson, _ := json.Marshal(event)
+	log.Println(string(eJson))
+
 	switch event.DetailType {
 	case evidenceReceivedEventName:
 		return handleEvidenceReceived(ctx, dynamoClient, event)
diff --git a/terraform/account/region/modules/s3_bucket_event_notifications/s3_bucket_notification.tf b/terraform/account/region/modules/s3_bucket_event_notifications/s3_bucket_notification.tf
index d7cd2df5b3..77935d9c8b 100644
--- a/terraform/account/region/modules/s3_bucket_event_notifications/s3_bucket_notification.tf
+++ b/terraform/account/region/modules/s3_bucket_event_notifications/s3_bucket_notification.tf
@@ -5,4 +5,5 @@ resource "aws_s3_bucket_notification" "bucket_notification" {
     events        = var.s3_bucket_event_types
     filter_suffix = ".log"
   }
+  eventbridge = true
 }
diff --git a/terraform/environment/region/modules/event_received/lambda.tf b/terraform/environment/region/modules/event_received/lambda.tf
index 61edb97974..88e8411c0e 100644
--- a/terraform/environment/region/modules/event_received/lambda.tf
+++ b/terraform/environment/region/modules/event_received/lambda.tf
@@ -45,9 +45,11 @@ resource "aws_cloudwatch_event_rule" "s3_object_tags_added" {
 
   event_pattern = jsonencode({
     source      = ["aws.s3"],
-    detail-type = ["Object Tags Added"],
+    detail-type = ["Object Tags Added", "s3:ObjectTagging:Put"],
     detail = {
-      bucketName = [var.uploads_bucket.bucket]
+      bucket = {
+        name = var.uploads_bucket.bucket
+      }
     }
   })
   provider = aws.region

From b91790a290aac44e01e9050f7c6942f3ea97f3b4 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Mon, 23 Oct 2023 11:40:41 +0100
Subject: [PATCH 13/19] revert terraform changes

---
 .../s3_bucket_event_notifications/s3_bucket_notification.tf | 1 -
 .../modules/s3_bucket_event_notifications/variables.tf      | 1 -
 terraform/account/region/s3_lb_access_logs.tf               | 1 -
 .../environment/region/modules/event_received/lambda.tf     | 6 ++----
 4 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/terraform/account/region/modules/s3_bucket_event_notifications/s3_bucket_notification.tf b/terraform/account/region/modules/s3_bucket_event_notifications/s3_bucket_notification.tf
index 77935d9c8b..d7cd2df5b3 100644
--- a/terraform/account/region/modules/s3_bucket_event_notifications/s3_bucket_notification.tf
+++ b/terraform/account/region/modules/s3_bucket_event_notifications/s3_bucket_notification.tf
@@ -5,5 +5,4 @@ resource "aws_s3_bucket_notification" "bucket_notification" {
     events        = var.s3_bucket_event_types
     filter_suffix = ".log"
   }
-  eventbridge = true
 }
diff --git a/terraform/account/region/modules/s3_bucket_event_notifications/variables.tf b/terraform/account/region/modules/s3_bucket_event_notifications/variables.tf
index edd777efae..1b091e5431 100644
--- a/terraform/account/region/modules/s3_bucket_event_notifications/variables.tf
+++ b/terraform/account/region/modules/s3_bucket_event_notifications/variables.tf
@@ -4,7 +4,6 @@ variable "s3_bucket_event_types" {
   default = [
     "s3:ObjectRemoved:*",
     "s3:ObjectAcl:Put",
-    "s3:ObjectTagging:Put",
   ]
 }
 
diff --git a/terraform/account/region/s3_lb_access_logs.tf b/terraform/account/region/s3_lb_access_logs.tf
index 31b2308757..61d7da5186 100644
--- a/terraform/account/region/s3_lb_access_logs.tf
+++ b/terraform/account/region/s3_lb_access_logs.tf
@@ -187,7 +187,6 @@ module "s3_event_notifications" {
   s3_bucket_event_types = [
     "s3:ObjectRemoved:*",
     "s3:ObjectAcl:Put",
-    "s3:ObjectTagging:Put",
   ]
   sns_kms_key_alias             = var.sns_kms_key_alias
   s3_bucket_id                  = aws_s3_bucket.access_log.id
diff --git a/terraform/environment/region/modules/event_received/lambda.tf b/terraform/environment/region/modules/event_received/lambda.tf
index 88e8411c0e..61edb97974 100644
--- a/terraform/environment/region/modules/event_received/lambda.tf
+++ b/terraform/environment/region/modules/event_received/lambda.tf
@@ -45,11 +45,9 @@ resource "aws_cloudwatch_event_rule" "s3_object_tags_added" {
 
   event_pattern = jsonencode({
     source      = ["aws.s3"],
-    detail-type = ["Object Tags Added", "s3:ObjectTagging:Put"],
+    detail-type = ["Object Tags Added"],
     detail = {
-      bucket = {
-        name = var.uploads_bucket.bucket
-      }
+      bucketName = [var.uploads_bucket.bucket]
     }
   })
   provider = aws.region

From f41af2332349ca3ff5fd04a49ce1e73fa8e3c183 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Mon, 23 Oct 2023 16:24:55 +0100
Subject: [PATCH 14/19] see the event

---
 cmd/event-received/main.go      | 116 ++++++------
 cmd/event-received/main_test.go | 318 ++++++++++++++++----------------
 go.sum                          |  22 +--
 3 files changed, 222 insertions(+), 234 deletions(-)

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index 1b734c8ec5..0a3ce8f546 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -7,7 +7,6 @@ import (
 	"log"
 	"net/http"
 	"os"
-	"strings"
 	"time"
 
 	"github.com/aws/aws-lambda-go/events"
@@ -62,7 +61,12 @@ type shareCodeSender interface {
 	SendCertificateProvider(context.Context, notify.Template, page.AppData, bool, *page.Lpa) error
 }
 
-func Handler(ctx context.Context, event events.CloudWatchEvent) error {
+type Event struct {
+	events.S3Event
+	events.CloudWatchEvent
+}
+
+func Handler(ctx context.Context, event Event) error {
 	tableName := os.Getenv("LPAS_TABLE")
 	notifyIsProduction := os.Getenv("GOVUK_NOTIFY_IS_PRODUCTION") == "1"
 	appPublicURL := os.Getenv("APP_PUBLIC_URL")
@@ -117,15 +121,15 @@ func Handler(ctx context.Context, event events.CloudWatchEvent) error {
 
 	switch event.DetailType {
 	case evidenceReceivedEventName:
-		return handleEvidenceReceived(ctx, dynamoClient, event)
+		return handleEvidenceReceived(ctx, dynamoClient, event.CloudWatchEvent)
 	case feeApprovedEventName:
-		return handleFeeApproved(ctx, dynamoClient, event, shareCodeSender, appData, now)
+		return handleFeeApproved(ctx, dynamoClient, event.CloudWatchEvent, shareCodeSender, appData, now)
 	case moreEvidenceRequiredEventName:
-		return handleMoreEvidenceRequired(ctx, dynamoClient, event, now)
+		return handleMoreEvidenceRequired(ctx, dynamoClient, event.CloudWatchEvent, now)
 	case feeDeniedEventName:
-		return handleFeeDenied(ctx, dynamoClient, event, now)
+		return handleFeeDenied(ctx, dynamoClient, event.CloudWatchEvent, now)
 	case objectTagsAddedEventName:
-		return handleObjectTagsAdded(ctx, dynamoClient, event, now, s3Client)
+		return handleObjectTagsAdded(ctx, dynamoClient, event.S3Event, now, s3Client)
 	default:
 		return fmt.Errorf("unknown event received: %s", event.DetailType)
 	}
@@ -220,55 +224,55 @@ func handleFeeDenied(ctx context.Context, client dynamodbClient, event events.Cl
 	return nil
 }
 
-func handleObjectTagsAdded(ctx context.Context, client dynamodbClient, event events.CloudWatchEvent, now func() time.Time, s3Client s3Client) error {
-	var v objectTagsAddedEvent
-	if err := json.Unmarshal(event.Detail, &v); err != nil {
-		return fmt.Errorf("failed to unmarshal '%s' detail: %w", objectTagsAddedEventName, err)
-	}
-
-	objectKey := v.Object.Key
-
-	tags, err := s3Client.GetObjectTags(ctx, objectKey)
-	if err != nil {
-		return fmt.Errorf("failed to get tags for object in '%s': %w", objectTagsAddedEventName, err)
-	}
-
-	hasScannedTag := false
-	hasVirus := false
-
-	for _, tag := range tags {
-		if *tag.Key == "virus-scan-status" {
-			hasScannedTag = true
-			hasVirus = *tag.Value == virusFound
-			break
-		}
-	}
-
-	if !hasScannedTag {
-		return nil
-	}
-
-	uid := strings.Split(objectKey, "/")
-
-	lpa, err := getLpaByUID(ctx, client, uid[0], objectTagsAddedEventName)
-	if err != nil {
-		return err
-	}
-
-	document := lpa.Evidence.Get(objectKey)
-	if document.Key == "" {
-		return fmt.Errorf("LPA did not contain a document with key %s for '%s'", objectKey, objectTagsAddedEventName)
-	}
-
-	document.Scanned = now()
-	document.VirusDetected = hasVirus
-
-	lpa.Evidence.Put(document)
-	lpa.UpdatedAt = now()
-
-	if err := client.Put(ctx, lpa); err != nil {
-		return fmt.Errorf("failed to update LPA for '%s': %w", objectTagsAddedEventName, err)
-	}
+func handleObjectTagsAdded(ctx context.Context, client dynamodbClient, event events.S3Event, now func() time.Time, s3Client s3Client) error {
+	//var v objectTagsAddedEvent
+	//if err := json.Unmarshal(event.Detail, &v); err != nil {
+	//	return fmt.Errorf("failed to unmarshal '%s' detail: %w", objectTagsAddedEventName, err)
+	//}
+	//
+	//objectKey := v.Object.Key
+	//
+	//tags, err := s3Client.GetObjectTags(ctx, objectKey)
+	//if err != nil {
+	//	return fmt.Errorf("failed to get tags for object in '%s': %w", objectTagsAddedEventName, err)
+	//}
+	//
+	//hasScannedTag := false
+	//hasVirus := false
+	//
+	//for _, tag := range tags {
+	//	if *tag.Key == "virus-scan-status" {
+	//		hasScannedTag = true
+	//		hasVirus = *tag.Value == virusFound
+	//		break
+	//	}
+	//}
+	//
+	//if !hasScannedTag {
+	//	return nil
+	//}
+	//
+	//uid := strings.Split(objectKey, "/")
+	//
+	//lpa, err := getLpaByUID(ctx, client, uid[0], objectTagsAddedEventName)
+	//if err != nil {
+	//	return err
+	//}
+	//
+	//document := lpa.Evidence.Get(objectKey)
+	//if document.Key == "" {
+	//	return fmt.Errorf("LPA did not contain a document with key %s for '%s'", objectKey, objectTagsAddedEventName)
+	//}
+	//
+	//document.Scanned = now()
+	//document.VirusDetected = hasVirus
+	//
+	//lpa.Evidence.Put(document)
+	//lpa.UpdatedAt = now()
+	//
+	//if err := client.Put(ctx, lpa); err != nil {
+	//	return fmt.Errorf("failed to update LPA for '%s': %w", objectTagsAddedEventName, err)
+	//}
 
 	return nil
 }
diff --git a/cmd/event-received/main_test.go b/cmd/event-received/main_test.go
index d3a8d2a6e3..16c8c3aa26 100644
--- a/cmd/event-received/main_test.go
+++ b/cmd/event-received/main_test.go
@@ -9,8 +9,6 @@ import (
 	"time"
 
 	"github.com/aws/aws-lambda-go/events"
-	"github.com/aws/aws-sdk-go-v2/aws"
-	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/actor"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/dynamo"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/notify"
@@ -333,164 +331,164 @@ func TestHandleFeeDeniedWhenPutError(t *testing.T) {
 	assert.Equal(t, fmt.Errorf("failed to update LPA task status for 'fee-denied': %w", expectedError), err)
 }
 
-func TestHandleObjectTagsAdded(t *testing.T) {
-	event := events.CloudWatchEvent{
-		DetailType: "Object Tags Added",
-		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-	}
-
-	now := time.Now()
-
-	s3Client := newMockS3Client(t)
-	s3Client.
-		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-		Return([]types.Tag{
-			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
-		}, nil)
-
-	dynamoClient := newMockDynamodbClient(t)
-	dynamoClient.
-		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-		Return(func(ctx context.Context, uid string, v interface{}) error {
-			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
-			json.Unmarshal(b, v)
-			return nil
-		})
-	dynamoClient.
-		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
-			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
-				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
-			}})
-			json.Unmarshal(b, v)
-			return nil
-		})
-	dynamoClient.
-		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
-			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
-		}}).
-		Return(nil)
-
-	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
-	assert.Nil(t, err)
-}
-
-func TestHandleObjectTagsAddedWhenGetObjectTagsError(t *testing.T) {
-	event := events.CloudWatchEvent{
-		DetailType: "Object Tags Added",
-		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-	}
-
-	now := time.Now()
-
-	s3Client := newMockS3Client(t)
-	s3Client.
-		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-		Return([]types.Tag{
-			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
-		}, expectedError)
-
-	err := handleObjectTagsAdded(ctx, nil, event, func() time.Time { return now }, s3Client)
-	assert.Equal(t, fmt.Errorf("failed to get tags for object in 'Object Tags Added': %w", expectedError), err)
-}
-
-func TestHandleObjectTagsAddedWhenDoesNotContainVirusScanTag(t *testing.T) {
-	event := events.CloudWatchEvent{
-		DetailType: "Object Tags Added",
-		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-	}
-
-	now := time.Now()
-
-	s3Client := newMockS3Client(t)
-	s3Client.
-		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-		Return([]types.Tag{
-			{Key: aws.String("not-virus-scan-status")},
-		}, nil)
-
-	err := handleObjectTagsAdded(ctx, nil, event, func() time.Time { return now }, s3Client)
-	assert.Nil(t, err)
-}
-
-func TestHandleObjectTagsAddedWhenLpaEvidenceDoesNotContainDocument(t *testing.T) {
-	event := events.CloudWatchEvent{
-		DetailType: "Object Tags Added",
-		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-	}
-
-	now := time.Now()
-
-	s3Client := newMockS3Client(t)
-	s3Client.
-		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-		Return([]types.Tag{
-			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
-		}, nil)
-
-	dynamoClient := newMockDynamodbClient(t)
-	dynamoClient.
-		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-		Return(func(ctx context.Context, uid string, v interface{}) error {
-			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
-			json.Unmarshal(b, v)
-			return nil
-		})
-	dynamoClient.
-		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
-			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
-				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-different-uid"}},
-			}})
-			json.Unmarshal(b, v)
-			return nil
-		})
-
-	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
-	assert.Equal(t, fmt.Errorf("LPA did not contain a document with key %s for 'Object Tags Added'", "M-1111-2222-3333/evidence/a-uid"), err)
-}
-
-func TestHandleObjectTagsAddedWhenDynamoPutError(t *testing.T) {
-	event := events.CloudWatchEvent{
-		DetailType: "Object Tags Added",
-		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-	}
-
-	now := time.Now()
-
-	s3Client := newMockS3Client(t)
-	s3Client.
-		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-		Return([]types.Tag{
-			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
-		}, nil)
-
-	dynamoClient := newMockDynamodbClient(t)
-	dynamoClient.
-		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-		Return(func(ctx context.Context, uid string, v interface{}) error {
-			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
-			json.Unmarshal(b, v)
-			return nil
-		})
-	dynamoClient.
-		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
-			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
-				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
-			}})
-			json.Unmarshal(b, v)
-			return nil
-		})
-	dynamoClient.
-		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
-			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
-		}}).
-		Return(expectedError)
-
-	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
-	assert.Equal(t, fmt.Errorf("failed to update LPA for 'Object Tags Added': %w", expectedError), err)
-}
+//func TestHandleObjectTagsAdded(t *testing.T) {
+//	event := events.CloudWatchEvent{
+//		DetailType: "Object Tags Added",
+//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+//	}
+//
+//	now := time.Now()
+//
+//	s3Client := newMockS3Client(t)
+//	s3Client.
+//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+//		Return([]types.Tag{
+//			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+//		}, nil)
+//
+//	dynamoClient := newMockDynamodbClient(t)
+//	dynamoClient.
+//		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
+//		Return(func(ctx context.Context, uid string, v interface{}) error {
+//			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+//			json.Unmarshal(b, v)
+//			return nil
+//		})
+//	dynamoClient.
+//		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+//		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+//			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+//				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
+//			}})
+//			json.Unmarshal(b, v)
+//			return nil
+//		})
+//	dynamoClient.
+//		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
+//			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
+//		}}).
+//		Return(nil)
+//
+//	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
+//	assert.Nil(t, err)
+//}
+//
+//func TestHandleObjectTagsAddedWhenGetObjectTagsError(t *testing.T) {
+//	event := events.CloudWatchEvent{
+//		DetailType: "Object Tags Added",
+//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+//	}
+//
+//	now := time.Now()
+//
+//	s3Client := newMockS3Client(t)
+//	s3Client.
+//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+//		Return([]types.Tag{
+//			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+//		}, expectedError)
+//
+//	err := handleObjectTagsAdded(ctx, nil, event, func() time.Time { return now }, s3Client)
+//	assert.Equal(t, fmt.Errorf("failed to get tags for object in 'Object Tags Added': %w", expectedError), err)
+//}
+//
+//func TestHandleObjectTagsAddedWhenDoesNotContainVirusScanTag(t *testing.T) {
+//	event := events.CloudWatchEvent{
+//		DetailType: "Object Tags Added",
+//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+//	}
+//
+//	now := time.Now()
+//
+//	s3Client := newMockS3Client(t)
+//	s3Client.
+//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+//		Return([]types.Tag{
+//			{Key: aws.String("not-virus-scan-status")},
+//		}, nil)
+//
+//	err := handleObjectTagsAdded(ctx, nil, event, func() time.Time { return now }, s3Client)
+//	assert.Nil(t, err)
+//}
+//
+//func TestHandleObjectTagsAddedWhenLpaEvidenceDoesNotContainDocument(t *testing.T) {
+//	event := events.CloudWatchEvent{
+//		DetailType: "Object Tags Added",
+//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+//	}
+//
+//	now := time.Now()
+//
+//	s3Client := newMockS3Client(t)
+//	s3Client.
+//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+//		Return([]types.Tag{
+//			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+//		}, nil)
+//
+//	dynamoClient := newMockDynamodbClient(t)
+//	dynamoClient.
+//		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
+//		Return(func(ctx context.Context, uid string, v interface{}) error {
+//			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+//			json.Unmarshal(b, v)
+//			return nil
+//		})
+//	dynamoClient.
+//		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+//		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+//			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+//				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-different-uid"}},
+//			}})
+//			json.Unmarshal(b, v)
+//			return nil
+//		})
+//
+//	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
+//	assert.Equal(t, fmt.Errorf("LPA did not contain a document with key %s for 'Object Tags Added'", "M-1111-2222-3333/evidence/a-uid"), err)
+//}
+//
+//func TestHandleObjectTagsAddedWhenDynamoPutError(t *testing.T) {
+//	event := events.CloudWatchEvent{
+//		DetailType: "Object Tags Added",
+//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
+//	}
+//
+//	now := time.Now()
+//
+//	s3Client := newMockS3Client(t)
+//	s3Client.
+//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+//		Return([]types.Tag{
+//			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+//		}, nil)
+//
+//	dynamoClient := newMockDynamodbClient(t)
+//	dynamoClient.
+//		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
+//		Return(func(ctx context.Context, uid string, v interface{}) error {
+//			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+//			json.Unmarshal(b, v)
+//			return nil
+//		})
+//	dynamoClient.
+//		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+//		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+//			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+//				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
+//			}})
+//			json.Unmarshal(b, v)
+//			return nil
+//		})
+//	dynamoClient.
+//		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
+//			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
+//		}}).
+//		Return(expectedError)
+//
+//	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
+//	assert.Equal(t, fmt.Errorf("failed to update LPA for 'Object Tags Added': %w", expectedError), err)
+//}
 
 func TestGetLpaByUID(t *testing.T) {
 	expectedLpa := page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
diff --git a/go.sum b/go.sum
index 8ae9ed14a4..40fc60f29f 100644
--- a/go.sum
+++ b/go.sum
@@ -11,14 +11,10 @@ github.com/aws/aws-sdk-go-v2 v1.21.2 h1:+LXZ0sgo8quN9UOKXXzAWRT3FWd4NxeXWOZom9pE
 github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 h1:Sc82v7tDQ/vdU1WtuSyzZ1I7y/68j//HJ6uozND1IDs=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14/go.mod h1:9NCTOURS8OpxvoAVHq79LK81/zC78hfRWFn+aL0SPcY=
-github.com/aws/aws-sdk-go-v2/config v1.18.45 h1:Aka9bI7n8ysuwPeFdm77nfbyHCAKQ3z9ghB3S/38zes=
-github.com/aws/aws-sdk-go-v2/config v1.18.45/go.mod h1:ZwDUgFnQgsazQTnWfeLWk5GjeqTQTL8lMkoE1UXzxdE=
 github.com/aws/aws-sdk-go-v2/config v1.19.0 h1:AdzDvwH6dWuVARCl3RTLGRc4Ogy+N7yLFxVxXe1ClQ0=
 github.com/aws/aws-sdk-go-v2/config v1.19.0/go.mod h1:ZwDUgFnQgsazQTnWfeLWk5GjeqTQTL8lMkoE1UXzxdE=
 github.com/aws/aws-sdk-go-v2/credentials v1.13.43 h1:LU8vo40zBlo3R7bAvBVy/ku4nxGEyZe9N8MqAeFTzF8=
 github.com/aws/aws-sdk-go-v2/credentials v1.13.43/go.mod h1:zWJBz1Yf1ZtX5NGax9ZdNjhhI4rgjfgsyk6vTY1yfVg=
-github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.42 h1:taACSYOzbwyrJPvzX0ucCkB9gxkIkcYkuXkUhNRsnJ0=
-github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.42/go.mod h1:y4dbQK/yjYJ2HXqx57/G8FvLckKtN61s/IWNVvP5k9E=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.43 h1:jlR1Rwjb3z5d1p0sqhNcuCaqdp73H+1O/X8Lc2kBDrY=
 github.com/aws/aws-sdk-go-v2/feature/dynamodb/attributevalue v1.10.43/go.mod h1:X1HGecFASboCkBt1GJRM4a/FDYYogu9AciUoXVsbr4U=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13 h1:PIktER+hwIG286DqXyvVENjgLTAwGgoeriLDD5C+YlQ=
@@ -33,8 +29,6 @@ github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45 h1:hze8YsjSh8Wl1rYa1CJpRmXP21B
 github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45/go.mod h1:lD5M20o09/LCuQ2mE62Mb/iSdSlCNuj6H5ci7tW7OsE=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6 h1:wmGLw2i8ZTlHLw7a9ULGfQbuccw8uIiNr6sol5bFzc8=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6/go.mod h1:Q0Hq2X/NuL7z8b1Dww8rmOFl+jzusKEcyvkKspwdpyc=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.2 h1:s7oacej7gZm+Bcq5BxZIlm5HWjEyKiWtOt405QZ+WOA=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.22.2/go.mod h1:1HkLh8vaL4obF95fne7ZOu7sxomS/+vkBt3/+gqqwE4=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.23.0 h1:xmSAn14nM6IdHyuWO/bsrAagOQtnqzuUCLxdVmj9nhg=
 github.com/aws/aws-sdk-go-v2/service/dynamodb v1.23.0/go.mod h1:1HkLh8vaL4obF95fne7ZOu7sxomS/+vkBt3/+gqqwE4=
 github.com/aws/aws-sdk-go-v2/service/dynamodbstreams v1.15.7 h1:WCeS9WZbIqEKCbgIkrHB5jw/9mO2QMYTLPF8wee3v4Y=
@@ -53,8 +47,6 @@ github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6 h1:9ulSU5ClouoPIY
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6/go.mod h1:lnc2taBsR9nTlz9meD+lhFZZ9EWY712QHrRflWpTcOA=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2 h1:Ll5/YVCOzRB+gxPqs2uD0R7/MyATC0w85626glSKmp4=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2/go.mod h1:Zjfqt7KhQK+PO1bbOsFNzKgaq7TcxzmEoDWN8lM0qzQ=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.5 h1:BvRGAAdEHo+0tpyOlKV14Z49O/iyhqiddIntd0KQ3EA=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.5/go.mod h1:A108ijf0IFtqhYApU+Gia80aPSAUfi9dItm+h5fWGJE=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.6 h1:y3n83jEM6EuawrD5HZCh3eMj9RsfxniVLcXlyFMNITM=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.6/go.mod h1:A108ijf0IFtqhYApU+Gia80aPSAUfi9dItm+h5fWGJE=
 github.com/aws/aws-sdk-go-v2/service/sqs v1.24.5 h1:RyDpTOMEJO6ycxw1vU/6s0KLFaH3M0z/z9gXHSndPTk=
@@ -108,8 +100,8 @@ github.com/golang-jwt/jwt/v4 v4.4.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.1.0 h1:/d3pCKDPWNnvIWe0vVUpNP32qc8U3PDVxySP/y360qE=
-github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
+github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
+github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -312,21 +304,15 @@ google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98 h1:Z0hjGZePRE0ZBWotvtrwxFNrNE9CUAGtplaDK5NNI/g=
-google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98/go.mod h1:S7mY02OqCJTD0E1OiQy1F72PWFB4bZJ87cAtLPYgDR0=
-google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98 h1:FmF5cCW94Ij59cfpoLiwTgodWmm60eEV0CjlsVg2fuw=
-google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ=
+google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d h1:VBu5YqKPv6XiJ199exd8Br+Aetz+o08F+PLMnwJQHAY=
+google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d/go.mod h1:yZTlhN0tQnXo3h00fuXNCxJdLdIdnVFVBaRJ5LWBbw4=
 google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d h1:DoPTO70H+bcDXcd39vOqb2viZxgqeBeSGtZ55yZU4/Q=
 google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d/go.mod h1:KjSP20unUpOx5kyQUFa7k4OJg0qeJ7DEZflGDu2p6Bk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 h1:bVf09lpb+OJbByTj913DRJioFFAjf/ZGxEz7MajTp2U=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d h1:uvYuEyMHKNt+lT4K3bN6fGswmK8qSvcreM3BwjDh+y4=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.58.3 h1:BjnpXut1btbtgN/6sp+brB2Kbm2LjNXnidYujAVbSoQ=
-google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
 google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=

From 90ad9bf2f9315952d401cc88f7d9ae532208671b Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Mon, 23 Oct 2023 17:17:25 +0100
Subject: [PATCH 15/19] handle S3Events

---
 cmd/event-received/main.go | 111 ++++++++++++++++++-------------------
 1 file changed, 55 insertions(+), 56 deletions(-)

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index 0a3ce8f546..a8bcf91bb3 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -7,6 +7,7 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-lambda-go/events"
@@ -38,12 +39,6 @@ type uidEvent struct {
 	UID string `json:"uid"`
 }
 
-type objectTagsAddedEvent struct {
-	Object struct {
-		Key string `json:"key"`
-	} `json:"object"`
-}
-
 //go:generate mockery --testonly --inpackage --name dynamodbClient --structname mockDynamodbClient
 type dynamodbClient interface {
 	One(ctx context.Context, pk, sk string, v interface{}) error
@@ -66,6 +61,10 @@ type Event struct {
 	events.CloudWatchEvent
 }
 
+func (e Event) isS3Event() bool {
+	return len(e.Records) > 0
+}
+
 func Handler(ctx context.Context, event Event) error {
 	tableName := os.Getenv("LPAS_TABLE")
 	notifyIsProduction := os.Getenv("GOVUK_NOTIFY_IS_PRODUCTION") == "1"
@@ -119,6 +118,10 @@ func Handler(ctx context.Context, event Event) error {
 	eJson, _ := json.Marshal(event)
 	log.Println(string(eJson))
 
+	if event.isS3Event() {
+		return handleObjectTagsAdded(ctx, dynamoClient, event.S3Event, now, s3Client)
+	}
+
 	switch event.DetailType {
 	case evidenceReceivedEventName:
 		return handleEvidenceReceived(ctx, dynamoClient, event.CloudWatchEvent)
@@ -128,8 +131,6 @@ func Handler(ctx context.Context, event Event) error {
 		return handleMoreEvidenceRequired(ctx, dynamoClient, event.CloudWatchEvent, now)
 	case feeDeniedEventName:
 		return handleFeeDenied(ctx, dynamoClient, event.CloudWatchEvent, now)
-	case objectTagsAddedEventName:
-		return handleObjectTagsAdded(ctx, dynamoClient, event.S3Event, now, s3Client)
 	default:
 		return fmt.Errorf("unknown event received: %s", event.DetailType)
 	}
@@ -225,54 +226,52 @@ func handleFeeDenied(ctx context.Context, client dynamodbClient, event events.Cl
 }
 
 func handleObjectTagsAdded(ctx context.Context, client dynamodbClient, event events.S3Event, now func() time.Time, s3Client s3Client) error {
-	//var v objectTagsAddedEvent
-	//if err := json.Unmarshal(event.Detail, &v); err != nil {
-	//	return fmt.Errorf("failed to unmarshal '%s' detail: %w", objectTagsAddedEventName, err)
-	//}
-	//
-	//objectKey := v.Object.Key
-	//
-	//tags, err := s3Client.GetObjectTags(ctx, objectKey)
-	//if err != nil {
-	//	return fmt.Errorf("failed to get tags for object in '%s': %w", objectTagsAddedEventName, err)
-	//}
-	//
-	//hasScannedTag := false
-	//hasVirus := false
-	//
-	//for _, tag := range tags {
-	//	if *tag.Key == "virus-scan-status" {
-	//		hasScannedTag = true
-	//		hasVirus = *tag.Value == virusFound
-	//		break
-	//	}
-	//}
-	//
-	//if !hasScannedTag {
-	//	return nil
-	//}
-	//
-	//uid := strings.Split(objectKey, "/")
-	//
-	//lpa, err := getLpaByUID(ctx, client, uid[0], objectTagsAddedEventName)
-	//if err != nil {
-	//	return err
-	//}
-	//
-	//document := lpa.Evidence.Get(objectKey)
-	//if document.Key == "" {
-	//	return fmt.Errorf("LPA did not contain a document with key %s for '%s'", objectKey, objectTagsAddedEventName)
-	//}
-	//
-	//document.Scanned = now()
-	//document.VirusDetected = hasVirus
-	//
-	//lpa.Evidence.Put(document)
-	//lpa.UpdatedAt = now()
-	//
-	//if err := client.Put(ctx, lpa); err != nil {
-	//	return fmt.Errorf("failed to update LPA for '%s': %w", objectTagsAddedEventName, err)
-	//}
+	objectKey := event.Records[0].S3.Object.Key
+	if objectKey == "" {
+		return fmt.Errorf("object key missing in event in '%s'", objectTagsAddedEventName)
+	}
+
+	tags, err := s3Client.GetObjectTags(ctx, objectKey)
+	if err != nil {
+		return fmt.Errorf("failed to get tags for object in '%s': %w", objectTagsAddedEventName, err)
+	}
+
+	hasScannedTag := false
+	hasVirus := false
+
+	for _, tag := range tags {
+		if *tag.Key == "virus-scan-status" {
+			hasScannedTag = true
+			hasVirus = *tag.Value == virusFound
+			break
+		}
+	}
+
+	if !hasScannedTag {
+		return nil
+	}
+
+	uid := strings.Split(objectKey, "/")
+
+	lpa, err := getLpaByUID(ctx, client, uid[0], objectTagsAddedEventName)
+	if err != nil {
+		return err
+	}
+
+	document := lpa.Evidence.Get(objectKey)
+	if document.Key == "" {
+		return fmt.Errorf("LPA did not contain a document with key %s for '%s'", objectKey, objectTagsAddedEventName)
+	}
+
+	document.Scanned = now()
+	document.VirusDetected = hasVirus
+
+	lpa.Evidence.Put(document)
+	lpa.UpdatedAt = now()
+
+	if err := client.Put(ctx, lpa); err != nil {
+		return fmt.Errorf("failed to update LPA for '%s': %w", objectTagsAddedEventName, err)
+	}
 
 	return nil
 }

From f6a70d02f2bbe425e05f936c1959c5ad935e9b51 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Mon, 23 Oct 2023 17:34:47 +0100
Subject: [PATCH 16/19] update tests

---
 cmd/event-received/main.go      |   2 +-
 cmd/event-received/main_test.go | 323 ++++++++++++++++----------------
 2 files changed, 166 insertions(+), 159 deletions(-)

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index a8bcf91bb3..25688b7735 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -32,7 +32,7 @@ const (
 	feeApprovedEventName          = "fee-approved"
 	feeDeniedEventName            = "fee-denied"
 	moreEvidenceRequiredEventName = "more-evidence-required"
-	objectTagsAddedEventName      = "Object Tags Added"
+	objectTagsAddedEventName      = "ObjectTagging:Put"
 )
 
 type uidEvent struct {
diff --git a/cmd/event-received/main_test.go b/cmd/event-received/main_test.go
index 16c8c3aa26..09cdec4068 100644
--- a/cmd/event-received/main_test.go
+++ b/cmd/event-received/main_test.go
@@ -9,6 +9,8 @@ import (
 	"time"
 
 	"github.com/aws/aws-lambda-go/events"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/actor"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/dynamo"
 	"github.com/ministryofjustice/opg-modernising-lpa/internal/notify"
@@ -331,164 +333,169 @@ func TestHandleFeeDeniedWhenPutError(t *testing.T) {
 	assert.Equal(t, fmt.Errorf("failed to update LPA task status for 'fee-denied': %w", expectedError), err)
 }
 
-//func TestHandleObjectTagsAdded(t *testing.T) {
-//	event := events.CloudWatchEvent{
-//		DetailType: "Object Tags Added",
-//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-//	}
-//
-//	now := time.Now()
-//
-//	s3Client := newMockS3Client(t)
-//	s3Client.
-//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-//		Return([]types.Tag{
-//			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
-//		}, nil)
-//
-//	dynamoClient := newMockDynamodbClient(t)
-//	dynamoClient.
-//		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-//		Return(func(ctx context.Context, uid string, v interface{}) error {
-//			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
-//			json.Unmarshal(b, v)
-//			return nil
-//		})
-//	dynamoClient.
-//		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-//		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
-//			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
-//				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
-//			}})
-//			json.Unmarshal(b, v)
-//			return nil
-//		})
-//	dynamoClient.
-//		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
-//			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
-//		}}).
-//		Return(nil)
-//
-//	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
-//	assert.Nil(t, err)
-//}
-//
-//func TestHandleObjectTagsAddedWhenGetObjectTagsError(t *testing.T) {
-//	event := events.CloudWatchEvent{
-//		DetailType: "Object Tags Added",
-//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-//	}
-//
-//	now := time.Now()
-//
-//	s3Client := newMockS3Client(t)
-//	s3Client.
-//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-//		Return([]types.Tag{
-//			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
-//		}, expectedError)
-//
-//	err := handleObjectTagsAdded(ctx, nil, event, func() time.Time { return now }, s3Client)
-//	assert.Equal(t, fmt.Errorf("failed to get tags for object in 'Object Tags Added': %w", expectedError), err)
-//}
-//
-//func TestHandleObjectTagsAddedWhenDoesNotContainVirusScanTag(t *testing.T) {
-//	event := events.CloudWatchEvent{
-//		DetailType: "Object Tags Added",
-//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-//	}
-//
-//	now := time.Now()
-//
-//	s3Client := newMockS3Client(t)
-//	s3Client.
-//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-//		Return([]types.Tag{
-//			{Key: aws.String("not-virus-scan-status")},
-//		}, nil)
-//
-//	err := handleObjectTagsAdded(ctx, nil, event, func() time.Time { return now }, s3Client)
-//	assert.Nil(t, err)
-//}
-//
-//func TestHandleObjectTagsAddedWhenLpaEvidenceDoesNotContainDocument(t *testing.T) {
-//	event := events.CloudWatchEvent{
-//		DetailType: "Object Tags Added",
-//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-//	}
-//
-//	now := time.Now()
-//
-//	s3Client := newMockS3Client(t)
-//	s3Client.
-//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-//		Return([]types.Tag{
-//			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
-//		}, nil)
-//
-//	dynamoClient := newMockDynamodbClient(t)
-//	dynamoClient.
-//		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-//		Return(func(ctx context.Context, uid string, v interface{}) error {
-//			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
-//			json.Unmarshal(b, v)
-//			return nil
-//		})
-//	dynamoClient.
-//		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-//		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
-//			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
-//				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-different-uid"}},
-//			}})
-//			json.Unmarshal(b, v)
-//			return nil
-//		})
-//
-//	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
-//	assert.Equal(t, fmt.Errorf("LPA did not contain a document with key %s for 'Object Tags Added'", "M-1111-2222-3333/evidence/a-uid"), err)
-//}
-//
-//func TestHandleObjectTagsAddedWhenDynamoPutError(t *testing.T) {
-//	event := events.CloudWatchEvent{
-//		DetailType: "Object Tags Added",
-//		Detail:     json.RawMessage(`{"object": {"key": "M-1111-2222-3333/evidence/a-uid"}}`),
-//	}
-//
-//	now := time.Now()
-//
-//	s3Client := newMockS3Client(t)
-//	s3Client.
-//		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
-//		Return([]types.Tag{
-//			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
-//		}, nil)
-//
-//	dynamoClient := newMockDynamodbClient(t)
-//	dynamoClient.
-//		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
-//		Return(func(ctx context.Context, uid string, v interface{}) error {
-//			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
-//			json.Unmarshal(b, v)
-//			return nil
-//		})
-//	dynamoClient.
-//		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
-//		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
-//			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
-//				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
-//			}})
-//			json.Unmarshal(b, v)
-//			return nil
-//		})
-//	dynamoClient.
-//		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
-//			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
-//		}}).
-//		Return(expectedError)
-//
-//	err := handleObjectTagsAdded(ctx, dynamoClient, event, func() time.Time { return now }, s3Client)
-//	assert.Equal(t, fmt.Errorf("failed to update LPA for 'Object Tags Added': %w", expectedError), err)
-//}
+func TestHandleObjectTagsAdded(t *testing.T) {
+	event := Event{
+		S3Event: events.S3Event{Records: []events.S3EventRecord{
+			{S3: events.S3Entity{Object: events.S3Object{Key: "M-1111-2222-3333/evidence/a-uid"}}},
+		}},
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+		}, nil)
+
+	dynamoClient := newMockDynamodbClient(t)
+	dynamoClient.
+		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
+		Return(func(ctx context.Context, uid string, v interface{}) error {
+			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	dynamoClient.
+		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
+			}})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	dynamoClient.
+		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
+			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
+		}}).
+		Return(nil)
+
+	err := handleObjectTagsAdded(ctx, dynamoClient, event.S3Event, func() time.Time { return now }, s3Client)
+	assert.Nil(t, err)
+}
+
+func TestHandleObjectTagsAddedWhenGetObjectTagsError(t *testing.T) {
+	event := Event{
+		S3Event: events.S3Event{Records: []events.S3EventRecord{
+			{S3: events.S3Entity{Object: events.S3Object{Key: "M-1111-2222-3333/evidence/a-uid"}}},
+		}},
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+		}, expectedError)
+
+	err := handleObjectTagsAdded(ctx, nil, event.S3Event, func() time.Time { return now }, s3Client)
+	assert.Equal(t, fmt.Errorf("failed to get tags for object in 'ObjectTagging:Put': %w", expectedError), err)
+}
+
+func TestHandleObjectTagsAddedWhenDoesNotContainVirusScanTag(t *testing.T) {
+	event := Event{
+		S3Event: events.S3Event{Records: []events.S3EventRecord{
+			{S3: events.S3Entity{Object: events.S3Object{Key: "M-1111-2222-3333/evidence/a-uid"}}},
+		}},
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("not-virus-scan-status")},
+		}, nil)
+
+	err := handleObjectTagsAdded(ctx, nil, event.S3Event, func() time.Time { return now }, s3Client)
+	assert.Nil(t, err)
+}
+
+func TestHandleObjectTagsAddedWhenLpaEvidenceDoesNotContainDocument(t *testing.T) {
+	event := Event{
+		S3Event: events.S3Event{Records: []events.S3EventRecord{
+			{S3: events.S3Entity{Object: events.S3Object{Key: "M-1111-2222-3333/evidence/a-uid"}}},
+		}},
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+		}, nil)
+
+	dynamoClient := newMockDynamodbClient(t)
+	dynamoClient.
+		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
+		Return(func(ctx context.Context, uid string, v interface{}) error {
+			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	dynamoClient.
+		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-different-uid"}},
+			}})
+			json.Unmarshal(b, v)
+			return nil
+		})
+
+	err := handleObjectTagsAdded(ctx, dynamoClient, event.S3Event, func() time.Time { return now }, s3Client)
+	assert.Equal(t, fmt.Errorf("LPA did not contain a document with key %s for 'ObjectTagging:Put'", "M-1111-2222-3333/evidence/a-uid"), err)
+}
+
+func TestHandleObjectTagsAddedWhenDynamoPutError(t *testing.T) {
+	event := Event{
+		S3Event: events.S3Event{Records: []events.S3EventRecord{
+			{S3: events.S3Entity{Object: events.S3Object{Key: "M-1111-2222-3333/evidence/a-uid"}}},
+		}},
+	}
+
+	now := time.Now()
+
+	s3Client := newMockS3Client(t)
+	s3Client.
+		On("GetObjectTags", ctx, "M-1111-2222-3333/evidence/a-uid").
+		Return([]types.Tag{
+			{Key: aws.String("virus-scan-status"), Value: aws.String("ok")},
+		}, nil)
+
+	dynamoClient := newMockDynamodbClient(t)
+	dynamoClient.
+		On("OneByUID", ctx, "M-1111-2222-3333", mock.Anything).
+		Return(func(ctx context.Context, uid string, v interface{}) error {
+			b, _ := json.Marshal(dynamo.Key{PK: "LPA#123", SK: "#DONOR#456"})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	dynamoClient.
+		On("One", ctx, "LPA#123", "#DONOR#456", mock.Anything).
+		Return(func(ctx context.Context, pk, sk string, v interface{}) error {
+			b, _ := json.Marshal(page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{
+				Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid"}},
+			}})
+			json.Unmarshal(b, v)
+			return nil
+		})
+	dynamoClient.
+		On("Put", ctx, page.Lpa{PK: "LPA#123", SK: "#DONOR#456", UpdatedAt: now, Evidence: page.Evidence{
+			Documents: []page.Document{{Key: "M-1111-2222-3333/evidence/a-uid", Scanned: now, VirusDetected: false}},
+		}}).
+		Return(expectedError)
+
+	err := handleObjectTagsAdded(ctx, dynamoClient, event.S3Event, func() time.Time { return now }, s3Client)
+	assert.Equal(t, fmt.Errorf("failed to update LPA for 'ObjectTagging:Put': %w", expectedError), err)
+}
 
 func TestGetLpaByUID(t *testing.T) {
 	expectedLpa := page.Lpa{PK: "LPA#123", SK: "#DONOR#456", Evidence: page.Evidence{

From c1eb0ee26a11b3e442a0d3794a3f1f96e707dff3 Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Mon, 23 Oct 2023 19:55:00 +0100
Subject: [PATCH 17/19] set bucket name

---
 cmd/event-received/main.go                    | 35 +++++++++++--------
 .../region/modules/event_received/lambda.tf   |  1 +
 2 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/cmd/event-received/main.go b/cmd/event-received/main.go
index 25688b7735..ace122da42 100644
--- a/cmd/event-received/main.go
+++ b/cmd/event-received/main.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"log"
 	"net/http"
 	"os"
 	"strings"
@@ -65,6 +64,10 @@ func (e Event) isS3Event() bool {
 	return len(e.Records) > 0
 }
 
+func (e Event) isCloudWatchEvent() bool {
+	return e.Source == "aws.cloudwatch"
+}
+
 func Handler(ctx context.Context, event Event) error {
 	tableName := os.Getenv("LPAS_TABLE")
 	notifyIsProduction := os.Getenv("GOVUK_NOTIFY_IS_PRODUCTION") == "1"
@@ -115,25 +118,27 @@ func Handler(ctx context.Context, event Event) error {
 	shareCodeSender := page.NewShareCodeSender(app.NewShareCodeStore(dynamoClient), notifyClient, appPublicURL, random.String)
 	now := time.Now
 
-	eJson, _ := json.Marshal(event)
-	log.Println(string(eJson))
-
 	if event.isS3Event() {
 		return handleObjectTagsAdded(ctx, dynamoClient, event.S3Event, now, s3Client)
 	}
 
-	switch event.DetailType {
-	case evidenceReceivedEventName:
-		return handleEvidenceReceived(ctx, dynamoClient, event.CloudWatchEvent)
-	case feeApprovedEventName:
-		return handleFeeApproved(ctx, dynamoClient, event.CloudWatchEvent, shareCodeSender, appData, now)
-	case moreEvidenceRequiredEventName:
-		return handleMoreEvidenceRequired(ctx, dynamoClient, event.CloudWatchEvent, now)
-	case feeDeniedEventName:
-		return handleFeeDenied(ctx, dynamoClient, event.CloudWatchEvent, now)
-	default:
-		return fmt.Errorf("unknown event received: %s", event.DetailType)
+	if event.isCloudWatchEvent() {
+		switch event.DetailType {
+		case evidenceReceivedEventName:
+			return handleEvidenceReceived(ctx, dynamoClient, event.CloudWatchEvent)
+		case feeApprovedEventName:
+			return handleFeeApproved(ctx, dynamoClient, event.CloudWatchEvent, shareCodeSender, appData, now)
+		case moreEvidenceRequiredEventName:
+			return handleMoreEvidenceRequired(ctx, dynamoClient, event.CloudWatchEvent, now)
+		case feeDeniedEventName:
+			return handleFeeDenied(ctx, dynamoClient, event.CloudWatchEvent, now)
+		default:
+			return fmt.Errorf("unknown event received: %s", event.DetailType)
+		}
 	}
+
+	eJson, _ := json.Marshal(event)
+	return fmt.Errorf("unknown event type received: %s", string(eJson))
 }
 
 func handleEvidenceReceived(ctx context.Context, client dynamodbClient, event events.CloudWatchEvent) error {
diff --git a/terraform/environment/region/modules/event_received/lambda.tf b/terraform/environment/region/modules/event_received/lambda.tf
index 9e21178f68..833f5625e7 100644
--- a/terraform/environment/region/modules/event_received/lambda.tf
+++ b/terraform/environment/region/modules/event_received/lambda.tf
@@ -6,6 +6,7 @@ module "event_received" {
     LPAS_TABLE                 = var.lpas_table.name
     GOVUK_NOTIFY_IS_PRODUCTION = data.aws_default_tags.current.tags.environment-name == "production" ? "1" : "0"
     APP_PUBLIC_URL             = "https://${var.app_public_url}"
+    UPLOADS_S3_BUCKET_NAME     = var.uploads_bucket.name
   }
   image_uri   = "${var.lambda_function_image_ecr_url}:${var.lambda_function_image_tag}"
   ecr_arn     = var.lambda_function_image_ecr_arn

From 4c73416727759cfa208eca59816deb306482c41d Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Mon, 23 Oct 2023 20:14:45 +0100
Subject: [PATCH 18/19] allow getting tags for objects rather than bucket

---
 terraform/environment/region/modules/event_received/lambda.tf | 2 +-
 terraform/environment/region/uploads_s3_bucket.tf             | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/terraform/environment/region/modules/event_received/lambda.tf b/terraform/environment/region/modules/event_received/lambda.tf
index 833f5625e7..93efafa5fd 100644
--- a/terraform/environment/region/modules/event_received/lambda.tf
+++ b/terraform/environment/region/modules/event_received/lambda.tf
@@ -136,7 +136,7 @@ data "aws_iam_policy_document" "event_received" {
     effect = "Allow"
 
     resources = [
-      var.uploads_bucket.arn
+      "${var.uploads_bucket.arn}/*"
     ]
 
     actions = [
diff --git a/terraform/environment/region/uploads_s3_bucket.tf b/terraform/environment/region/uploads_s3_bucket.tf
index de3f5f6821..fcb9b4f368 100644
--- a/terraform/environment/region/uploads_s3_bucket.tf
+++ b/terraform/environment/region/uploads_s3_bucket.tf
@@ -13,7 +13,6 @@ data "aws_ecr_repository" "s3_create_batch_replication_jobs" {
   provider = aws.management
 }
 
-
 module "uploads_s3_bucket" {
   source = "./modules/uploads_s3_bucket"
 

From 60cc1c920050b4230eb813fdefc557edee58edaf Mon Sep 17 00:00:00 2001
From: Alex Saunders <acsauk@gmail.com>
Date: Mon, 23 Oct 2023 21:40:17 +0100
Subject: [PATCH 19/19] use bucket name

---
 terraform/environment/region/modules/event_received/lambda.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/environment/region/modules/event_received/lambda.tf b/terraform/environment/region/modules/event_received/lambda.tf
index 93efafa5fd..1b86df9dee 100644
--- a/terraform/environment/region/modules/event_received/lambda.tf
+++ b/terraform/environment/region/modules/event_received/lambda.tf
@@ -6,7 +6,7 @@ module "event_received" {
     LPAS_TABLE                 = var.lpas_table.name
     GOVUK_NOTIFY_IS_PRODUCTION = data.aws_default_tags.current.tags.environment-name == "production" ? "1" : "0"
     APP_PUBLIC_URL             = "https://${var.app_public_url}"
-    UPLOADS_S3_BUCKET_NAME     = var.uploads_bucket.name
+    UPLOADS_S3_BUCKET_NAME     = var.uploads_bucket.bucket
   }
   image_uri   = "${var.lambda_function_image_ecr_url}:${var.lambda_function_image_tag}"
   ecr_arn     = var.lambda_function_image_ecr_arn