feat(auth): use platform public Cognito client with helter group gate

CLAUDE.md

@@ -54,8 +54,8 @@ There are no unit tests in this project.
 |----------|---------|-------------|
 | `CUPCAKE_BACKEND` | `http://127.0.0.1:8080` (dev) / `https://cupcake-backend.java.no` (prod) | Backend URL for server-side proxy |
 | `CUPCAKE_FRONTEND` | `localhost` | Hostname for Vite `allowedHosts` |
-| `NUXT_PUBLIC_OIDC_AUTHORITY` | `https://auth.home.chrissearle.org/realms/HA12` | Keycloak realm URL |
-| `NUXT_PUBLIC_OIDC_CLIENT_ID` | `cupcake-client` | OIDC client ID |
+| `NUXT_PUBLIC_OIDC_AUTHORITY` | Cognito internal pool issuer | OIDC issuer URL |
+| `NUXT_PUBLIC_OIDC_CLIENT_ID` | empty | OIDC client ID |
 
 For local dev against the Cupcake backend with `JWT_ENABLED=false`, no OIDC config overrides are needed.
 

Dockerfile

@@ -23,8 +23,9 @@ ENV NODE_ENV=production
 WORKDIR /app
 
 COPY --from=build /app/.output ./
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
 
-ENTRYPOINT ["/entrypoint.sh"]
+# uid 1000 (node), matching the platform's compute.user default.
+USER node
+
+CMD ["node", "/app/server/index.mjs"]
 

README.md

@@ -41,7 +41,7 @@ pnpm dev
 
 The cupcake backend must be running locally unless you override `CUPCAKE_BACKEND`. With `JWT_ENABLED=false` on the backend, no auth configuration is needed.
 
-The frontend OIDC defaults point to the development Keycloak realm, so no `NUXT_PUBLIC_OIDC_*` overrides are needed for local dev against that environment.
+The frontend OIDC authority defaults to the Cognito internal pool. To log in locally, set `NUXT_PUBLIC_OIDC_CLIENT_ID` (see Configuration).
 
 ## Preview a production build
 
@@ -65,10 +65,10 @@ ESLint and Prettier are also enforced via pre-commit hooks (lint-staged).
 | ---------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------ |
 | `CUPCAKE_BACKEND`            | Backend base URL for the server-side proxy           | `http://127.0.0.1:8080` (dev) / `https://cupcake-backend.java.no` (prod) |
 | `CUPCAKE_FRONTEND`           | Hostname the dev server allows (Vite `allowedHosts`) | `localhost`                                                              |
-| `NUXT_PUBLIC_OIDC_AUTHORITY` | OIDC authority URL (e.g. Keycloak realm URL)         | `https://auth.home.chrissearle.org/realms/HA12`                          |
-| `NUXT_PUBLIC_OIDC_CLIENT_ID` | OIDC client ID                                       | `cupcake-client`                                                         |
+| `NUXT_PUBLIC_OIDC_AUTHORITY` | OIDC authority (issuer) URL                          | Cognito internal pool issuer                                             |
+| `NUXT_PUBLIC_OIDC_CLIENT_ID` | OIDC client ID                                       | empty                                                                    |
 
-`NUXT_PUBLIC_OIDC_AUTHORITY` and `NUXT_PUBLIC_OIDC_CLIENT_ID` must match the `OIDC_WELL_KNOWN_URL` and `OIDC_EXPECTED_AZP` values configured on the backend.
+In the platform deployment both are injected via `auth.env` in `app.yaml` (aliases of `COGNITO_ISSUER_URL` and `COGNITO_CLIENT_ID` for the platform-created public Cognito client). For local login against Cognito, set `NUXT_PUBLIC_OIDC_CLIENT_ID` to that client ID; `http://localhost:3000/` is a registered callback.
 
 ## Proxy middleware
 

app.yaml

@@ -13,11 +13,19 @@ routing:
 
 auth:
   pool: internal
+  client: public
   callback_urls:
     - https://cupcake.javazone.no/
     - https://cupcake.javazone.no/auth/callback
+    - http://localhost:3000/
   logout_urls:
     - https://cupcake.javazone.no/
+    - http://localhost:3000/
+  groups:
+    - helter
+  env:
+    COGNITO_CLIENT_ID: NUXT_PUBLIC_OIDC_CLIENT_ID
+    COGNITO_ISSUER_URL: NUXT_PUBLIC_OIDC_AUTHORITY
 
 environment:
   CUPCAKE_BACKEND: https://cupcake-backend.javazone.no

app/composables/useAuth.ts

@@ -36,7 +36,7 @@ function getUserManager(): UserManager {
       client_id: oidcClientId,
       redirect_uri: `${origin}/`,
       response_type: "code",
-      scope: "openid profile email offline_access",
+      scope: "openid profile email",
       userStore: new WebStorageStateStore({ store: window.sessionStorage }),
       automaticSilentRenew: false,
       loadUserInfo: false,

terraform/main.tf

@@ -4,6 +4,7 @@ module "platform" {
 
   project = "javabin"
   domain  = "javazone.no"
+  team    = "cupcake"
 }
 
 module "ecr" {
@@ -34,12 +35,14 @@ module "routing" {
 module "auth" {
   source = "git::https://github.com/javaBin/platform//terraform/modules/cognito-app-client?ref=main"
 
-  app_name      = "cupcake"
-  team          = "cupcake"
-  pool          = "internal"
-  callback_urls = ["https://cupcake.javazone.no/", "https://cupcake.javazone.no/auth/callback"]
-  logout_urls   = ["https://cupcake.javazone.no/"]
-  project       = "javabin"
+  app_name       = "cupcake"
+  team           = "cupcake"
+  pool           = "internal"
+  client_type    = "public"
+  project        = "javabin"
+  callback_urls  = ["https://cupcake.javazone.no/", "https://cupcake.javazone.no/auth/callback", "http://localhost:3000/"]
+  logout_urls    = ["https://cupcake.javazone.no/", "http://localhost:3000/"]
+  allowed_groups = ["helter"]
 }
 
 module "task_role" {
@@ -73,14 +76,17 @@ module "service" {
   readonly_root_filesystem = true
   target_group_arn         = module.routing.target_group_arn
   environment = {
-    CUPCAKE_BACKEND      = "https://cupcake-backend.javazone.no"
-    COGNITO_USER_POOL_ID = module.auth.user_pool_id
-    COGNITO_DOMAIN       = module.auth.user_pool_domain
-    COGNITO_ISSUER_URL   = module.auth.issuer_url
+    CUPCAKE_BACKEND            = "https://cupcake-backend.javazone.no"
+    COGNITO_USER_POOL_ID       = module.auth.user_pool_id
+    COGNITO_DOMAIN             = module.auth.user_pool_domain
+    COGNITO_ISSUER_URL         = module.auth.issuer_url
+    COGNITO_WELL_KNOWN_URL     = module.auth.well_known_url
+    COGNITO_GROUPS             = "helter"
+    NUXT_PUBLIC_OIDC_AUTHORITY = module.auth.issuer_url
   }
   secrets = {
-    COGNITO_CLIENT_ID     = module.auth.client_id_arn
-    COGNITO_CLIENT_SECRET = module.auth.client_secret_arn
+    COGNITO_CLIENT_ID          = module.auth.client_id_arn
+    NUXT_PUBLIC_OIDC_CLIENT_ID = module.auth.client_id_arn
   }
 }