From 9bdb62c74349893e19f8e3cef8d4347d9fe574ad Mon Sep 17 00:00:00 2001 From: Alexanderamiri Date: Fri, 23 Oct 2026 18:08:41 +0200 Subject: [PATCH 1/2] feat(auth): validate tokens against the platform pool with a validate-only client - app.yaml auth: pool internal, client none. cupcake-backend only verifies tokens issued to frosting's client, so it needs no Cognito client of its own. - auth.env aliases COGNITO_WELL_KNOWN_URL to OIDC_WELL_KNOWN_URL, so the hardcoded pool URL is removed from environment. Co-Authored-By: Claude Opus 5.5 (1M context) --- app.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/app.yaml b/app.yaml index 883cf00..89bf82f 100644 --- a/app.yaml +++ b/app.yaml @@ -22,8 +22,11 @@ resources: - name: bring_api_key env: BRING_API_KEY -auth: internal +auth: + pool: internal + client: none + env: + COGNITO_WELL_KNOWN_URL: OIDC_WELL_KNOWN_URL environment: SP_BASE_URL: https://sleepingpill.javazone.no - OIDC_WELL_KNOWN_URL: https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_Icikv3dtD/.well-known/openid-configuration From ceda2cf4642e78657d5a29e5d434dc0f270bff22 Mon Sep 17 00:00:00 2001 From: "javabin-platform[bot]" Date: Fri, 23 Oct 2026 16:23:10 +0000 Subject: [PATCH 2/2] [skip ci] Update generated Terraform from app.yaml --- terraform/main.tf | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/terraform/main.tf b/terraform/main.tf index 0248ff6..9108b58 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -4,6 +4,7 @@ module "platform" { project = "javabin" domain = "javazone.no" + team = "cupcake" } module "ecr" { @@ -74,12 +75,11 @@ module "secret_bring_api_key" { module "auth" { source = "git::https://github.com/javaBin/platform//terraform/modules/cognito-app-client?ref=main" - app_name = "cupcake-backend" - team = "cupcake" - pool = "internal" - callback_urls = ["https://cupcake-backend.javazone.no/", "https://cupcake-backend.javazone.no/auth/callback"] - logout_urls = ["https://cupcake-backend.javazone.no/"] - project = "javabin" + app_name = "cupcake-backend" + team = "cupcake" + pool = "internal" + client_type = "none" + project = "javabin" } module "task_role" { @@ -118,19 +118,18 @@ module "service" { readonly_root_filesystem = true target_group_arn = module.routing.target_group_arn environment = { - SP_BASE_URL = "https://sleepingpill.javazone.no" - OIDC_WELL_KNOWN_URL = "https://cognito-idp.eu-central-1.amazonaws.com/eu-central-1_Icikv3dtD/.well-known/openid-configuration" - COGNITO_USER_POOL_ID = module.auth.user_pool_id - COGNITO_DOMAIN = module.auth.user_pool_domain - COGNITO_ISSUER_URL = module.auth.issuer_url + SP_BASE_URL = "https://sleepingpill.javazone.no" + COGNITO_USER_POOL_ID = module.auth.user_pool_id + COGNITO_DOMAIN = module.auth.user_pool_domain + COGNITO_ISSUER_URL = module.auth.issuer_url + COGNITO_WELL_KNOWN_URL = module.auth.well_known_url + OIDC_WELL_KNOWN_URL = module.auth.well_known_url } secrets = { - SP_USER = module.secret_sp_user.parameter_arn - SP_PASSWORD = module.secret_sp_password.parameter_arn - BRING_API_USER = module.secret_bring_api_user.parameter_arn - BRING_API_KEY = module.secret_bring_api_key.parameter_arn - COGNITO_CLIENT_ID = module.auth.client_id_arn - COGNITO_CLIENT_SECRET = module.auth.client_secret_arn + SP_USER = module.secret_sp_user.parameter_arn + SP_PASSWORD = module.secret_sp_password.parameter_arn + BRING_API_USER = module.secret_bring_api_user.parameter_arn + BRING_API_KEY = module.secret_bring_api_key.parameter_arn } }