[Alexanderamiri]

Why

App developers should be able to put simple apps and static pages behind a Cognito login with a few lines of app.yaml, and choose per path which groups may see them. This must work for the internal pool (Google Workspace SAML) and the external pool (attendees and other public users). Until now the only option was auth:, where the app has to do OIDC itself.

What

New routing.login in app.yaml:

routing:
  host: wiki.java.no
  priority: 120
  login:
    - paths: ["/admin/*"]
      groups: [styret]
    - paths: ["/assets/*"]
      public: true
    - groups: [helter]      # paths defaults to ["/*"]; pool defaults to internal

Shorthands: login: internal / login: external, or a single mapping.

• Generator (scripts/generate-modules.py): validates the new field (forms, 1-10 rules, 1-4 paths per rule, ALB path characters, no duplicate paths, nothing after a /* rule, public cannot be combined with pool/groups, room below routing.priority, group names). It emits login_rules (p1..pN) at priorities priority-1, priority-2, ... and warns when no rule covers /*, because path patterns are case-sensitive. Apps without login generate exactly the same Terraform as before.

• service-routing: for each protected rule:

  • a Cognito client {team}-{app}.login-N (nested cognito-app-client, slot login-N);
  • a 60 s time_sleep while app-auth-sync creates it (re-armed only when the request changes);
  • reads of the client id and secret from the team's SSM path;
  • an authenticate-oidc + forward listener rule on host and paths. The internal pool goes straight to GoogleSAML. Sessions last 8 h.

  Public rules only forward. The host catch-all rule depends_on the login rules, so a new app fails closed.

• cognito-app-client: new optional slot input. New outputs client_id_parameter_name, client_secret_parameter_name and request_value. The external pool falls back to its prefix domain, which also fixes the empty COGNITO_DOMAIN for auth: external.

• app-auth-sync: accepts /javabin/apps/{team}/{app}/login-N/auth. It names the client {team}-{app}.login-N; . cannot occur in app names, so the name cannot collide with another app's client. Credentials go next to the request, and reconcile handles slots. IAM and the EventBridge pattern already match the deeper paths, because their * covers /.

• identity: the external pool gets:

  • the javabin-external prefix domain (only while no custom domain is configured);
  • a V2 pre-token trigger javabin-auth-claims-external: same zip and role, REGISTRY_GROUPS=false.

  The external pool had no domain and no trigger before. Anyone can sign up there with any email, so registry groups are never granted there; native groups and per-client allowed_groups still apply.

• Docs: app-yaml-reference.md (new routing.login section: what the app receives in x-amzn-oidc-* headers, caveats, and a static-pages recipe using nginx-unprivileged), reusable-modules.md, lambda-functions.md, CLAUDE.md.

Why authenticate-oidc and not authenticate-cognito: the Cognito action needs cognito-idp:DescribeUserPoolClient on the platform pools. The developer boundary denies that, and allowing it would let any team read every team's client secret. Group checks reuse the existing auth-claims allowed_groups refusal. That check works per client, which is why there is one client per rule. Cognito's session means a user still signs in only once.

Design: explore/auth-proxy-design.md (outside the repo).

Review fixes (second commit)

• Internal pool locked to Google Workspace. admin_create_user_config { allow_admin_create_user_only = true } stops self sign-up. app-auth-sync no longer adds COGNITO to internal-pool clients, only the pool's IdPs (GoogleSAML). That matches the live cupcake-cupcake client, which already has only GoogleSAML. Before this, a login: internal rule would have let anyone register with a password through the hosted UI.
• Email spoofing closed. Both pools set attributes_require_verification_before_update = ["email"]. auth-claims grants registry groups only to federated users (cognito:user_status = EXTERNAL_PROVIDER) or users with email_verified = true. Live SAML users have email_verified=false, which is why the federated check is needed.
• ALB session cookie is now javabin-auth-p<N>-<hash of slot, pool, groups>. Tightening groups or reordering rules now forces a fresh sign-in, so an older session from a looser rule no longer works.
• External prefix domain is always created; adding a custom domain later no longer deletes it.
• Bare prefix. On protected rules, /x/* now also covers /x. The warning and the docs now also cover percent-encoding and ...
• Docs:
  • external groups must be created by hand for now;
  • leave room in priorities (multiples of 20);
  • how a refused user sees the denial;
  • login does not proxy to sites hosted off the platform.

Decision for you to confirm

"Reverse proxy" here means a sign-in gate in front of apps running on the platform (any ECS app, or an nginx container for static pages). The ALB cannot forward to upstream URLs outside the platform. Proxying to external sites would need a small proxy container or CloudFront, and is not in this PR.

How verified

• python3 -m unittest discover scripts/tests (50) and terraform/lambda-src/tests (81): all pass. New tests cover:
  • generator: the three forms, priorities, every validation error, the warning, unchanged output without login, terraform fmt clean;
  • app-auth-sync: slot names, credential paths, sync/delete/reconcile with slots, invalid slots ignored;
  • auth-claims: REGISTRY_GROUPS=false; unverified native emails get no registry groups;
  • app-auth-sync: internal clients (main and slot) get no COGNITO;
  • generator: the bare prefix is added and counted toward the 4-path limit.
• terraform fmt -recursive -check passes. terraform validate passes for modules/service-routing, modules/cognito-app-client and a generated sample app (internal + external + public rules, module sources pointed at this branch).
• Read-only terraform plan of that sample app against the account (local state, nothing applied):
  • one SSM request per protected rule (/javabin/apps/core/wiki/login-N/auth);
  • listener rules at 119/118/117/116 plus the host rule at 120;
  • internal rules point at javabin-internal with identity_provider=GoogleSAML; the external rule points at javabin-external.auth... and the external pool's issuer;
  • credential reads deferred until after the wait.
• Expected platform plan:
  • identity adds the external pool's lambda_config, auth_claims_external + permission and the prefix domain;
  • in-place updates to both pools (admin-only create on internal, email verification before update on both);
  • the app-auth-sync and auth-claims zips;
  • no ALB or app changes until an app opts in.

Follow-ups

• Opt one app in (a tiny nginx app or the test app) and check end to end: anonymous user is redirected to Google, a member gets the page, a non-member is refused by Cognito.
• Native groups in the external pool have no management path yet; until one exists, an admin creates them by hand (documented). The external pool also has no social or other IdPs yet, so attendees use email/password for now.
• Optional defence in depth: a pre-sign-up trigger that rejects native sign-ups on the internal pool. Not added: admin-only create plus no COGNITO provider already close sign-up.
• Overlap: the security workstream has an uncommitted fix/cognito-internal-lockdown that does a broader version of the internal-pool lockdown (per-pool IdP list, @java.no domain check). Whichever PR merges second needs a rebase in app_auth_sync/handler.py, auth_claims/handler.py and identity/main.tf.
• Security workstream: the ALB client secret ends up in app Terraform state and in the binary plan artifact. The text plan masks it. The plan-artifacts bucket is exempt from DenyXTeam.
• Rule priorities can collide with a neighbouring app; this only shows up at apply as PriorityInUse. The docs tell developers to leave room. A registry check that reserves [priority-10, priority] per app is the proper fix (registry follow-up). Today cupcake-backend (101) cannot add rules because cupcake holds 100.

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 3 to add, 3 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.identity.aws_cognito_user_pool.external will be updated in-place
  ~ resource "aws_cognito_user_pool" "external" {
        id                        = "eu-central-1_gdFOsE4EM"
        name                      = "javabin-external"
        tags                      = {
            "Name" = "javabin-external"
        }
        # (11 unchanged attributes hidden)

      + lambda_config {
          + pre_token_generation_config {
              + lambda_arn     = (known after apply)
              + lambda_version = "V2_0"
            }
        }

        # (7 unchanged blocks hidden)
    }

  # module.identity.aws_cognito_user_pool_domain.external_prefix[0] will be created
  + resource "aws_cognito_user_pool_domain" "external_prefix" {
      + aws_account_id                  = (known after apply)
      + cloudfront_distribution         = (known after apply)
      + cloudfront_distribution_arn     = (known after apply)
      + cloudfront_distribution_zone_id = (known after apply)
      + domain                          = "javabin-external"
      + id                              = (known after apply)
      + managed_login_version           = (known after apply)
      + s3_bucket                       = (known after apply)
      + user_pool_id                    = "eu-central-1_gdFOsE4EM"
      + version                         = (known after apply)
    }

  # module.identity.aws_lambda_function.auth_claims will be updated in-place
  ~ resource "aws_lambda_function" "auth_claims" {
        id                             = "javabin-auth-claims"
      ~ last_modified                  = "2026-10-23T15:36:35.282+0000" -> (known after apply)
      ~ source_code_hash               = "T0XK8BQ05sxP5MVCsIGH+JuY++sBeQohaGTkvMdm81M=" -> "G7CVVKTKcWux3uaInvJ/HPm9sjCf6hpfYCpAgutj0Z0="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.identity.aws_lambda_function.auth_claims_external will be created
  + resource "aws_lambda_function" "auth_claims_external" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + code_sha256                    = (known after apply)
      + filename                       = "identity/builds/auth_claims.zip"
      + function_name                  = "javabin-auth-claims-external"
      + handler                        = "handler.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 256
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + reserved_concurrent_executions = -1
      + role                           = "arn:aws:iam::553637109631:role/javabin-auth-claims"
      + runtime                        = "python3.12"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + skip_destroy                   = false
      + source_code_hash               = "G7CVVKTKcWux3uaInvJ/HPm9sjCf6hpfYCpAgutj0Z0="
      + source_code_size               = (known after apply)
      + tags_all                       = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/platform"
          + "service"     = "platform"
          + "team"        = "platform"
        }
      + timeout                        = 5
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "MEMBERSHIPS_TABLE" = "javabin-auth-memberships"
              + "REGISTRY_GROUPS"   = "false"
            }
        }
    }

  # module.identity.aws_lambda_permission.auth_claims_external_cognito will be created
  + resource "aws_lambda_permission" "auth_claims_external_cognito" {
      + action              = "lambda:InvokeFunction"
      + function_name       = "javabin-auth-claims-external"
      + id                  = (known after apply)
      + principal           = "cognito-idp.amazonaws.com"
      + source_arn          = "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_gdFOsE4EM"
      + statement_id        = "AllowCognitoExternalPool"
      + statement_id_prefix = (known after apply)
    }

  # module.lambdas.aws_lambda_function.app_auth_sync will be updated in-place
  ~ resource "aws_lambda_function" "app_auth_sync" {
        id                             = "javabin-app-auth-sync"
      ~ last_modified                  = "2026-10-23T15:31:34.000+0000" -> (known after apply)
      ~ source_code_hash               = "sIha3Wb5dyMLBep00WQdQ/yhswtf4SXSuDzJX076WoE=" -> "K4tkidVltbXKluS15V/Z20AuRxysldUSX0uibNFSj+0="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 3 to add, 3 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Plan adds an external Cognito user pool domain, a new external auth-claims Lambda with its Cognito invoke permission, and updates the Cognito user pool (pre-token-generation hook) plus two existing Lambdas' code; 0 destroys, no database or network changes.

• 💥 [destruction] No resources are destroyed (Plan: 3 to add, 3 to change, 0 to destroy). The Cognito user pool is updated in-place, not replaced, so existing user pool ID and users are preserved.
• 🔒 [security] Cognito user pool gains a pre_token_generation lambda trigger (V2_0) that invokes the new javabin-auth-claims-external Lambda. This Lambda controls token claims, so its code and IAM role (javabin-auth-claims, shared with the existing auth_claims function) should be reviewed. The Lambda permission is scoped to the specific user pool ARN, which is good.
• 🔒 [security] The new Lambda reuses the existing role arn:aws:iam::553637109631:role/javabin-auth-claims rather than a dedicated role. Confirm that role's permissions are least-privilege for the external pool, since it reads the javabin-auth-memberships table. The REGISTRY_GROUPS variable is set to false in the new function; verify this is intended.
• 💰 [cost] New billable resources are limited to a Lambda function (256 MB, 5s timeout, invoked per token issuance) and a Cognito user pool domain. Cost impact is expected to be low.
• ✅ [routine] Code updates to aws_lambda_function.auth_claims and module.lambdas app_auth_sync (source_code_hash changes) are routine deployments. The new external Lambda is built from identity/builds/auth_claims.zip, the same artifact as the existing function, so its code hash matches.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 3 to add, 4 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.identity.aws_cognito_user_pool.external will be updated in-place
  ~ resource "aws_cognito_user_pool" "external" {
        id                        = "eu-central-1_gdFOsE4EM"
        name                      = "javabin-external"
        tags                      = {
            "Name" = "javabin-external"
        }
        # (11 unchanged attributes hidden)

      + lambda_config {
          + pre_token_generation_config {
              + lambda_arn     = (known after apply)
              + lambda_version = "V2_0"
            }
        }

      + user_attribute_update_settings {
          + attributes_require_verification_before_update = [
              + "email",
            ]
        }

        # (7 unchanged blocks hidden)
    }

  # module.identity.aws_cognito_user_pool.internal will be updated in-place
  ~ resource "aws_cognito_user_pool" "internal" {
        id                        = "eu-central-1_Icikv3dtD"
        name                      = "javabin-internal"
        tags                      = {
            "Name" = "javabin-internal"
        }
        # (12 unchanged attributes hidden)

      ~ admin_create_user_config {
          ~ allow_admin_create_user_only = false -> true
        }

      + user_attribute_update_settings {
          + attributes_require_verification_before_update = [
              + "email",
            ]
        }

        # (7 unchanged blocks hidden)
    }

  # module.identity.aws_cognito_user_pool_domain.external_prefix will be created
  + resource "aws_cognito_user_pool_domain" "external_prefix" {
      + aws_account_id                  = (known after apply)
      + cloudfront_distribution         = (known after apply)
      + cloudfront_distribution_arn     = (known after apply)
      + cloudfront_distribution_zone_id = (known after apply)
      + domain                          = "javabin-external"
      + id                              = (known after apply)
      + managed_login_version           = (known after apply)
      + s3_bucket                       = (known after apply)
      + user_pool_id                    = "eu-central-1_gdFOsE4EM"
      + version                         = (known after apply)
    }

  # module.identity.aws_lambda_function.auth_claims will be updated in-place
  ~ resource "aws_lambda_function" "auth_claims" {
        id                             = "javabin-auth-claims"
      ~ last_modified                  = "2026-10-23T15:36:35.282+0000" -> (known after apply)
      ~ source_code_hash               = "T0XK8BQ05sxP5MVCsIGH+JuY++sBeQohaGTkvMdm81M=" -> "smiN/WS0Z1s5c2TZHz7NkB7TpwSvdsVfB3YBq7ScYXw="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.identity.aws_lambda_function.auth_claims_external will be created
  + resource "aws_lambda_function" "auth_claims_external" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + code_sha256                    = (known after apply)
      + filename                       = "identity/builds/auth_claims.zip"
      + function_name                  = "javabin-auth-claims-external"
      + handler                        = "handler.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 256
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + reserved_concurrent_executions = -1
      + role                           = "arn:aws:iam::553637109631:role/javabin-auth-claims"
      + runtime                        = "python3.12"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + skip_destroy                   = false
      + source_code_hash               = "smiN/WS0Z1s5c2TZHz7NkB7TpwSvdsVfB3YBq7ScYXw="
      + source_code_size               = (known after apply)
      + tags_all                       = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/platform"
          + "service"     = "platform"
          + "team"        = "platform"
        }
      + timeout                        = 5
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "MEMBERSHIPS_TABLE" = "javabin-auth-memberships"
              + "REGISTRY_GROUPS"   = "false"
            }
        }
    }

  # module.identity.aws_lambda_permission.auth_claims_external_cognito will be created
  + resource "aws_lambda_permission" "auth_claims_external_cognito" {
      + action              = "lambda:InvokeFunction"
      + function_name       = "javabin-auth-claims-external"
      + id                  = (known after apply)
      + principal           = "cognito-idp.amazonaws.com"
      + source_arn          = "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_gdFOsE4EM"
      + statement_id        = "AllowCognitoExternalPool"
      + statement_id_prefix = (known after apply)
    }

  # module.lambdas.aws_lambda_function.app_auth_sync will be updated in-place
  ~ resource "aws_lambda_function" "app_auth_sync" {
        id                             = "javabin-app-auth-sync"
      ~ last_modified                  = "2026-10-23T15:31:34.000+0000" -> (known after apply)
      ~ source_code_hash               = "sIha3Wb5dyMLBep00WQdQ/yhswtf4SXSuDzJX076WoE=" -> "KWro4WgUzrH9qadMzlFpjzqXpOZyWEUl6a9x6xziRTg="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 3 to add, 4 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟡 MEDIUM

Plan adds 3 resources (external Cognito domain, external auth-claims Lambda and its Cognito invoke permission) and updates 4 existing resources (two Cognito user pools, auth-claims Lambda code, app-auth-sync Lambda code); nothing is destroyed.

• 🔒 [security] The internal Cognito user pool (javabin-internal) changes allow_admin_create_user_only from false to true. This means only admins can create users, so self-signup is disabled. This is intended hardening but should be confirmed as deliberate, since it may break any self-registration flow that relies on the internal pool.
• 🔒 [security] The new aws_lambda_permission lets cognito-idp.amazonaws.com invoke javabin-auth-claims-external, scoped by source_arn to the external user pool (eu-central-1_gdFOsE4EM). This is correctly scoped. The external pool's pre-token-generation trigger is also wired to this Lambda, which can modify token claims, so its code and IAM role should be reviewed.
• 🔒 [security] The new external Lambda reuses the existing execution role arn:aws:iam::553637109631:role/javabin-auth-claims, so it inherits that role's permissions, including read access to the memberships table. Confirm the role is least-privilege for the external use case.
• ✅ [routine] The Lambda code for javabin-auth-claims and javabin-app-auth-sync is updated in place with new source_code_hash values, and the external pool gets a new lambda_config and user_attribute_update_settings (email verification before update). These are routine code deployments with no infrastructure replacement.
• 💰 [cost] New billable resources are limited to one Lambda function (256 MB, 5s timeout, invoked per Cognito auth event) and one Cognito user pool domain. Cost impact should be minimal.
• 💥 [destruction] The plan has 0 destroys and no force-replacements. All changes are create or in-place update.