✨ feat(auth-microservice) [OTP]: email one-time-code login routes + passwordless provisioning for CGIAR center domains - #38
Merged
Conversation
… to CognitoService with stable error mapping [SPEC:changes/cognito-email-otp-login] Cognito USER_AUTH + EMAIL_OTP: InitiateAuth (PREFERRED_CHALLENGE), gated SELECT_CHALLENGE round-trip, RespondToAuthChallenge EMAIL_OTP → tokens; pure mapCognitoError (CODE_MISMATCH, CODE_EXPIRED, ATTEMPTS_EXCEEDED, NOT_AUTHORIZED, CHALLENGE_NOT_SUPPORTED, UPSTREAM_ERROR); outcome-only logs. 22 tests. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…users without a temporary password so they land CONFIRMED [SPEC:changes/cognito-email-otp-login] createUser omits TemporaryPassword (SUPPRESS, email_verified) for allow-listed domains and skips the welcome-password email; all other domains byte-identical. README env row. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…d auth/login/otp/verify routes with stable error codes on the wire
- EmailOtpStartDto / EmailOtpVerifyDto, thin AuthService delegates to CognitoService
- route-local OtpHttpExceptionFilter keeps { code, message } in error bodies
- LoggingInterceptor redacts session/tokens/code keys before the response log line (OTP-R-11)
- request-level supertest suite through the real global filter, pipe and interceptor
- README: endpoints, actual error body, 201, telemetry vocabulary
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Third
/loginpath for CGIAR center staff outside AD (@cifor-icraf.org,@icrisat.org): PRMS calls this microservice, which drives the Cognito passwordlessUSER_AUTH/EMAIL_OTPflow. Spec:docs/specs/changes/cognito-email-otp-loginin the PRMS repo.CognitoService.startEmailOtp/verifyEmailOtp—InitiateAuth(PREFERRED_CHALLENGE: EMAIL_OTP) andRespondToAuthChallenge, Cognito errors mapped to stable codes (CODE_MISMATCH,CODE_EXPIRED,ATTEMPTS_EXCEEDED,NOT_AUTHORIZED,CHALLENGE_NOT_SUPPORTED,UPSTREAM_ERROR).POST /auth/login/otp/start{ username }→{ challengeName, session, codeDeliveryDestination };POST /auth/login/otp/verify{ username, code, session }→{ tokens }(same shape aslogin/custom). Sameauthheader /JwtClarisaMiddlewareas every/auth/*route.OtpHttpExceptionFilterso the stablecodesurvives the global filter on the wire.LoggingInterceptornow redactssession/tokens/password-like keys before the response log line (log line only; client body untouched). This also closes the pre-existing token exposure onlogin/custom.PASSWORDLESS_DOMAINS(new env): users registered with an email on a listed domain are created without a temporary password (MessageAction: SUPPRESS) so they landCONFIRMED, and the welcome email is skipped. Non-listed domains are byte-identical to today.Review first
src/api/auth/cognito.service.ts(payloads + error mapping), thensrc/shared/interceptors/logging.interceptor.ts(redaction). Out of scope: any PRMS change (PR in the PRMS repo links here).Deploy notes (TEST)
PASSWORDLESS_DOMAINS=cifor-icraf.org,icrisat.org.EMAIL_OTP;general-clientunchanged).login/custom.Verification
npx jest --silent→ 17 suites / 365 tests;tsc --noEmitclean; eslint clean on touched files. Request-level suite (auth.otp-routes.spec.ts) runs through the real global filter, pipe and interceptor.🤖 Generated with Claude Code