agent-friendly #5: ban datetime.utcnow (ruff DTZ)

README.md

@@ -51,6 +51,11 @@ Usa **moto** (sem AWS real). O pacote `lambda/` importa via `importlib` (nome re
 
 CI (GitHub Actions): em todo PR/`push` na `main` — jobs **`lint`** (ruff + mypy), **`test`** (pytest/moto) e **`synth`** (`npx aws-cdk@2 synth`, sem AWS / sem deploy).
 
+### Agent-friendly / hard constraints
+
+- **Timezone-aware datetimes:** ruff `DTZ` (incl. DTZ003) — use `datetime.now(timezone.utc)`, never `datetime.utcnow()`.
+- **CORS:** CDK lab origins are localhost only (no `AllowOrigins: "*"`). Do not reintroduce wildcards in `cdk/`.
+
 ---
 
 ## CDK / Deploy

lambda/app.py

@@ -4,7 +4,7 @@
 
 import json
 import uuid
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 
 from aws_lambda_powertools import Logger, Metrics, Tracer
 from aws_lambda_powertools.event_handler import APIGatewayHttpResolver
@@ -59,8 +59,8 @@ def solicitar_exclusao(event: APIGatewayProxyEvent):
         }
 
     request_id = str(uuid.uuid4())
-    timestamp = datetime.utcnow().isoformat()
-    expires_at = (datetime.utcnow() + timedelta(days=7)).isoformat()
+    timestamp = datetime.now(timezone.utc).isoformat()
+    expires_at = (datetime.now(timezone.utc) + timedelta(days=7)).isoformat()
     qr_code_data = domain.generate_pix_qr_code(cliente_id, domain.PIX_FEE, request_id)
 
     domain.put_solicitacao_with_latest(

lambda/domain_dynamo.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import os
-from datetime import datetime
+from datetime import datetime, timezone
 from decimal import Decimal
 
 import boto3
@@ -64,7 +64,7 @@ def put_solicitacao_with_latest(
 
 def confirm_payment(cliente_id: str, request_id: str) -> None:
     """Mark history + LATEST as PAID when pointer matches request_id."""
-    ts = datetime.utcnow().isoformat()
+    ts = datetime.now(timezone.utc).isoformat()
     table.update_item(
         Key={"cliente_id": cliente_id, "request_id": request_id},
         UpdateExpression="SET #status = :paid, updated_at = :ts",

pyproject.toml

@@ -9,9 +9,12 @@ line-length = 100
 src = ["lambda", "tests", "cdk"]
 
 [tool.ruff.lint]
-# Hard constraints (Lauren/pstack): errors + unused. Import-sort (I) deferred —
+# Hard constraints (Lauren/pstack): errors + unused + timezone-aware datetimes.
+# DTZ bans naive utcnow/utcfromtimestamp (DTZ003 etc.). Import-sort (I) deferred —
 # CDK multi-alias imports fight isort without value; enable in a later PR.
-select = ["E", "F", "W"]
+# CORS AllowOrigins "*" is already avoided in cdk/app.py (localhost only) —
+# do not reintroduce wildcard origins in CDK.
+select = ["E", "F", "W", "DTZ"]
 ignore = ["E501"]
 
 [tool.ruff.lint.per-file-ignores]