@auth-craft/aws-cf-stack 1.5.0 → 1.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/.env.example +4 -2
  2. package/README.md +2 -2
  3. package/assets/admin/cli.mjs +16 -16
  4. package/lib/create-admin.sh +11 -7
  5. package/lib/deploy-gateway.sh +12 -3
  6. package/package.json +1 -1
package/.env.example CHANGED
@@ -165,8 +165,10 @@ LAMBDA_FACEBOOK_CLIENT_ID=
165
165
  LAMBDA_FACEBOOK_CLIENT_SECRET=
166
166
  LAMBDA_FACEBOOK_REDIRECT_URI=
167
167
 
168
- # ─── Super-admin bootstrap (optional — skipped if any are unset) ─────────────
168
+ # ─── Super-admin bootstrap (optional — the `admin` stage is skipped unless BOTH ───
169
+ # EMAIL and PASSWORD are set; the skip message names which are missing). The admin CLI
170
+ # talks to DynamoDB DIRECTLY and is idempotent: if an active owner already exists in the
171
+ # system tenant it's a no-op, so re-runs are safe. No setup token is needed.
169
172
  LAMBDA_SUPER_ADMIN_EMAIL=
170
173
  LAMBDA_SUPER_ADMIN_PASSWORD=
171
174
  LAMBDA_SUPER_ADMIN_NAME=Super Admin
172
- LAMBDA_AUTH_SETUP_TOKEN=
package/README.md CHANGED
@@ -65,7 +65,7 @@ all point at the single worker.
65
65
  | Command | Does |
66
66
  |---------|------|
67
67
  | `lambda` | Deploy the DynamoDB + Lambda CDK stacks. `--outputs-file <p>` writes the raw CDK outputs JSON. Runs a best-effort `/health` check. |
68
- | `admin` | Create the super-admin (idempotent; **skips** if `LAMBDA_SUPER_ADMIN_*` / `LAMBDA_AUTH_SETUP_TOKEN` unset; "already exists" = success). |
68
+ | `admin` | Create the super-admin (idempotent; **skips** if `LAMBDA_SUPER_ADMIN_EMAIL`/`LAMBDA_SUPER_ADMIN_PASSWORD` unset; "already exists" = success). |
69
69
  | `gateway` | Deploy the gateway worker(s) — 3 (`multi`, default) or 1 (`CF_GATEWAY_MODE=shared`). Re-reads the Lambda outputs from CloudFormation if run as a separate invocation. |
70
70
  | `all` | `lambda` → `admin` → `gateway`, one run. |
71
71
  | `outputs` | Print the live api-stack outputs as JSON (no deploy): `backendUrl`, `apiBasePath`, `dynamodbTable`, and the auth keys read **from the live Lambda config** (`jwtPublicKey`, `jwtIssuer`, `jwtAlgorithm`, `serviceJwtPublicKey`) + `gatewayUrls`/`routePrefixes`. Self-contained — works standalone (no env), so an orchestrator can auto-fill its `*_AUTH_*` vars. |
@@ -98,7 +98,7 @@ Inputs come from **flags or environment variables** (flag wins, then env, then
98
98
  | Stage | Required |
99
99
  |-------|----------|
100
100
  | `lambda` | `LAMBDA_JWT_PRIVATE_KEY`, `LAMBDA_JWT_PUBLIC_KEY`, and `LAMBDA_GATEWAY_SECRET` (required for staging/prod; optional in dev). AWS creds in env. |
101
- | `admin` | `LAMBDA_SUPER_ADMIN_EMAIL`, `LAMBDA_SUPER_ADMIN_PASSWORD`, `LAMBDA_AUTH_SETUP_TOKEN` (else skipped). AWS creds. |
101
+ | `admin` | `LAMBDA_SUPER_ADMIN_EMAIL`, `LAMBDA_SUPER_ADMIN_PASSWORD` (else skipped). AWS creds. |
102
102
  | `gateway` | Hard-required: `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`. Needed in practice (pushed as worker secrets; empty ones are skipped but the gateway then rejects clients / can't reach the backend): `CF_EDGE_GATE_SECRET`, `LAMBDA_GATEWAY_SECRET`, `LAMBDA_JWT_PUBLIC_KEY`. |
103
103
 
104
104
  Set `LAMBDA_APP_BASE_PATH` to a **stable** value — if unset, a random base path is generated