From a4cb5918a680e8cd8f830fc9fed02c563e38e087 Mon Sep 17 00:00:00 2001
From: Conan Scott <conanscott@gmail.com>
Date: Wed, 1 Jul 2026 04:55:58 +0000
Subject: [PATCH] Add seed script for customers + optional demo vault token

---
 seed/seed.py | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 seed/seed.py

diff --git a/seed/seed.py b/seed/seed.py
new file mode 100644
index 0000000..cfd3742
--- /dev/null
+++ b/seed/seed.py
@@ -0,0 +1,53 @@
+"""
+Seed the demo tables.
+
+- writes the raw customer record into the customers table (this is the data that
+  must never leave the "on-prem" zone)
+- OPTIONALLY writes a demo vault mapping (CUST_000123 -> cust-0001) so you can
+  test the RAG Lambda on its own, before Fusion is wired in.
+
+In the real flow Fusion mints a fresh, random token per request and writes the
+vault entry itself; the --with-demo-token entry is only a standalone test aid.
+
+Usage:
+  VAULT_TABLE=hncb-deid-demo-vault CUSTOMERS_TABLE=hncb-deid-demo-customers \
+    python seed.py --with-demo-token
+"""
+import argparse
+import json
+import os
+import time
+import boto3
+
+ddb = boto3.resource("dynamodb")
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--customers-table", default=os.environ.get("CUSTOMERS_TABLE"))
+    ap.add_argument("--vault-table", default=os.environ.get("VAULT_TABLE"))
+    ap.add_argument("--with-demo-token", action="store_true")
+    args = ap.parse_args()
+
+    here = os.path.dirname(__file__)
+    with open(os.path.join(here, "customers.json"), encoding="utf-8") as f:
+        customers = json.load(f)
+
+    ct = ddb.Table(args.customers_table)
+    for c in customers:
+        ct.put_item(Item=c)
+        print(f"seeded customer {c['customer_id']} ({c['name']})")
+
+    if args.with_demo_token:
+        vt = ddb.Table(args.vault_table)
+        vt.put_item(Item={
+            "token": "CUST_000123",
+            "type": "CUSTOMER",
+            "value": "cust-0001",
+            "expires_at": int(time.time()) + 3600,
+        })
+        print("seeded demo vault mapping CUST_000123 -> cust-0001 (test aid only)")
+
+
+if __name__ == "__main__":
+    main()