Wire auth: in app.yaml to Cognito app client + injected secrets

[Alexanderamiri]

Summary

Closes the gap where cognito-app-client existed but was unused — apps couldn't actually opt into Cognito via app.yaml.

• App.yaml now accepts auth: internal (shorthand) or the full object form. Generator emits a cognito-app-client module, registers an OAuth client in the chosen pool, and injects pool config + credentials into the ECS task.
• cognito-app-client is now self-contained: looks up its pool by name internally and constructs the OIDC issuer URL itself. No changes to platform-data — apps without auth: are unaffected.
• Widens the shared ECS execution role's SSM policy to cover /javabin/platform-apps/* so the client_id/secret can be fetched at task launch (otherwise tasks fail with ResourceInitializationError).

Schema

# Shorthand
auth: internal

# Full form
auth:
  pool: internal              # 'internal' or 'external' ('both' deferred)
  callback_urls: [...]        # optional, default = [https://{host}/, https://{host}/auth/callback]
  logout_urls: [...]          # optional, default = [https://{host}/]
  scopes: [openid, email, profile]
  groups: [admins, editors]   # reference-only, exposed as COGNITO_GROUPS

Injected env vars

Var	Source
COGNITO_USER_POOL_ID	Looked up from the platform pool
COGNITO_DOMAIN	Hosted-UI FQDN
COGNITO_ISSUER_URL	OIDC issuer for JWT validation
COGNITO_CLIENT_ID	SSM SecureString via ECS task secrets
COGNITO_CLIENT_SECRET	SSM SecureString via ECS task secrets (skipped when generate_secret: false)
COGNITO_GROUPS	Comma-joined list from auth.groups

Out of scope

• auth.pool: both — generator rejects with a clear NotImplementedError. Defer until a concrete app needs it (will inform the env-var naming convention).
• Group creation / membership sync from app.yaml — stays with the team-provisioner Lambda. groups: here is reference-only.

Test plan

• terraform validate clean on terraform/modules/cognito-app-client/ and terraform/platform/iam/
• terraform fmt -recursive -check clean across the repo
• Generator produces valid HCL for: shorthand, full form with groups, external pool with explicit callback_urls + generate_secret: false
• Generator rejects auth.pool: both with NotImplementedError
• Generator rejects auth: without routing.host with ValueError
• auth: none and omitted auth: produce no module "auth" block
• Apply IAM widening (PR landing) before any app sets auth: — order matters; widening is unconditional and a single-line policy change with no resource impact for apps that don't use auth
• First real app (e.g. platform-test-app) sets auth: internal, plan shows only Cognito client + SSM params, apply succeeds, ECS task starts, printenv | grep COGNITO_ shows expected vars
• Identity stack must be deployed before any app uses auth: (currently gated on Google OAuth credentials in the deployment notes — flagged in the existing CLAUDE.md status table)

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 1 to change, 0 to destroy.

Plan output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.iam.aws_iam_role_policy.ecs_execution_secrets will be updated in-place
  ~ resource "aws_iam_role_policy" "ecs_execution_secrets" {
        id     = "javabin-ecs-execution:secrets-read"
        name   = "secrets-read"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = "arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/apps/*" -> [
                          + "arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/apps/*",
                          + "arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/platform-apps/*",
                        ]
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Routine IAM policy update expanding ECS execution role SSM parameter access to include platform-apps namespace.

• ✅ [routine] IAM policy update adds new SSM parameter path (javabin/platform-apps/*) to existing ECS execution role permissions. This is a standard permission expansion for application configuration management.
• ✅ [routine] No resources are being created or destroyed, only a single in-place policy modification affecting one IAM role.
• ✅ [routine] The change maintains backward compatibility by keeping the existing javabin/apps/* path while adding the new platform-apps/* path.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 1 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.iam.aws_iam_role_policy.ecs_execution_secrets will be updated in-place
  ~ resource "aws_iam_role_policy" "ecs_execution_secrets" {
        id     = "javabin-ecs-execution:secrets-read"
        name   = "secrets-read"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Resource = "arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/apps/*" -> [
                          + "arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/apps/*",
                          + "arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/platform-apps/*",
                        ]
                        # (3 unchanged attributes hidden)
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Routine IAM policy update expanding ECS execution role permissions to include platform-apps SSM parameters alongside existing apps parameters.

• ✅ [routine] IAM policy update to ecs_execution_secrets role adding new SSM parameter path: arn:aws:ssm:eu-central-1:553637109631:parameter/javabin/platform-apps/* while retaining existing javabin/apps/* path
• ✅ [routine] Single in-place update with no resource creation, destruction, or replacement - zero infrastructure changes
• ✅ [routine] Permission expansion is additive only - no existing permissions removed, maintains backward compatibility