feat(notification): enable production publisher

Preserve production broker definitions and allow bounded SMTP delivery.

Ref: IT-1508

docker/kubernetes/shared-notification/tests/test_notification.py

@@ -1,6 +1,7 @@
 import argparse
 import base64
 import copy
+import hashlib
 import importlib.util
 import json
 from pathlib import Path
@@ -186,6 +187,27 @@ class ContractTests(unittest.TestCase):
             self.assertIsNotNone(re.fullmatch(permissions["write"], "amq.default"))
             self.assertIsNone(re.fullmatch(permissions["write"], "unreviewed.exchange"))
 
+    def test_production_boot_definitions_keep_result_publish_permission(self):
+        config, _ = fixture()
+        credentials = {}
+        for key in ("rabbitAdminPassword", "rabbitWorkerPassword", "rabbitPublisherPassword"):
+            credentials[key] = "staging-test-value"
+            credentials[key + "Salt"] = base64.b64encode(b"salt").decode()
+        password = "production-test-value"
+        password_hash = base64.b64encode(b"prod" + hashlib.sha256(b"prod" + password.encode()).digest()).decode()
+        definitions = ns.rabbit_definitions(config, credentials, password_hash)
+        self.assertEqual([q["name"] for q in definitions["queues"]],
+                         ["notification.send-email", "invemory.staging.notification-results",
+                          "invemory.production.notification-results"])
+        production = next(x for x in definitions["users"] if x["name"] == "invemory_production")
+        self.assertEqual(production["password_hash"], password_hash)
+        self.assertNotIn(password, json.dumps(definitions))
+        worker = next(x for x in definitions["permissions"] if x["user"] == "notification_worker")
+        self.assertIsNotNone(re.fullmatch(worker["configure"], "invemory.production.notification-results"))
+        self.assertIsNotNone(re.fullmatch(worker["configure"], "invemory.staging.notification-results"))
+        self.assertIsNotNone(re.fullmatch(worker["write"], "amq.default"))
+        self.assertEqual(worker["read"], r"^notification\.send\-email$")
+
     def test_secrets_not_present_in_rendered_resources(self):
         config, artifacts = fixture()
         self.assertFalse(any(x["kind"] == "Secret" for x in ns.manifest(config, artifacts)))