✨ feat(auth-microservice, cognito-triggers) [OTP rev 3]: CUSTOM_AUTH sign-in code sent by PRMS (do not merge before the pool triggers are wired) - #40
Merged
Conversation
…gh Cognito CUSTOM_AUTH / CUSTOM_CHALLENGE - start: InitiateAuth CUSTOM_AUTH (no PREFERRED_CHALLENGE, no SELECT_CHALLENGE round-trip), expects CUSTOM_CHALLENGE - verify: RespondToAuthChallenge CUSTOM_CHALLENGE with ANSWER; a wrong code returns 401 CODE_MISMATCH carrying the rotated session; NotAuthorized mapping → ATTEMPTS_EXCEEDED / CODE_EXPIRED / NOT_AUTHORIZED; missing Session → CHALLENGE_NOT_SUPPORTED; empty AuthenticationResult → UPSTREAM_ERROR - Swagger and README contract updated; request-level hygiene test on the 401-with-session path Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…gers package (Define / Create / Verify) with the PRMS-branded code email
- DefineAuthChallenge: one CUSTOM_CHALLENGE per session, tokens on a correct answer, failAuthentication after 3 misses, fake challenge for unknown users
- CreateAuthChallenge: crypto.randomInt 6-digit code, reuse across retries via challengeMetadata, masked destination, email emitted to the notification queue with the auth envelope (from PRMS-No-reply, name "PRMS Reporting Tool"), queue failure → email_failed but the challenge still returns
- VerifyAuthChallengeResponse: timingSafeEqual, always false for unknown users
- amqplib-only runtime dep; confirm channel + waitForConfirms; NestJS event envelope { pattern, data }; logs = allow-listed keys only
- SAM template (Node 22, Timeout 5 s, pool-scoped cognito-idp invoke permission) + README (deploy, pool wiring via before-export, troubleshooting)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Do not merge until
OTP-T-14steps 1–4 are done (Lambdas deployed and wired to poolus-east-1_o9y9Yq5pO,general-clientAuthSessionValidity= 5 min). This PR switches the microservice fromUSER_AUTH/EMAIL_OTPtoCUSTOM_AUTH; merging first would break the Center sign-in on TEST until the triggers exist.What
Pivot decided 2026-09-11 (
OTP-OQ-8, Option B): the sign-in code is generated by PRMS-owned Cognito triggers and emailed through PRMS's notification pipeline fromPRMS-No-reply@cgiar.orgas "PRMS Reporting Tool" — no Cognito default sender, no spam, no 50/day pool quota.cognito-triggers/(new package,da73833):DefineAuthChallenge/CreateAuthChallenge/VerifyAuthChallengeResponse—crypto.randomInt6-digit code, reuse across retries, 3 attempts,timingSafeEqual, fake challenge for unknown users, email via the RabbitMQsendpattern with theauthenvelope (same shapeauth-microserviceuses), SAM template + README (deploy, pool wiring from a before-export, troubleshooting). 111 tests.auth-microservice(dda504f):CognitoServicedrivesCUSTOM_AUTH/CUSTOM_CHALLENGE; a wrong code returns401 CODE_MISMATCHwith the rotatedsession;NotAuthorizedmapping →ATTEMPTS_EXCEEDED/CODE_EXPIRED/NOT_AUTHORIZED; Swagger + README updated. Routes, DTOs, filters, interceptor unchanged. 368 tests.Deploy notes (TEST)
Triggers env:
MS_NOTIFICATION_HOST(orMS_RMQ_HOST/USER/PASSWORD),MS_NOTIFICATION_QUEUE,MS_NOTIFICATION_USER/PASSWORD,EMAIL_SENDER,APP_URL. Pool: attach the three triggers (console or--cli-input-jsonfrom a fresh export — never a bareupdate-user-pool). After go-live, roll back theEMAIL_OTPfirst factor enabled byOTP-T-1.Spec: PRMS
docs/specs/changes/cognito-email-otp-login(design §18, tasks T-11..T-14).🤖 Generated with Claude Code