@auth-craft/aws-cf-stack 1.6.4 → 1.7.1

package/cdk/lib/lambda-stack.ts

@@ -154,12 +154,23 @@ export class LambdaStack extends cdk.Stack {
         ...(process.env.LAMBDA_REFRESH_TOKEN_COOKIE_MAX_AGE && {
           REFRESH_TOKEN_COOKIE_MAX_AGE: process.env.LAMBDA_REFRESH_TOKEN_COOKIE_MAX_AGE,
         }),
+        // Per-scope refresh cookie names — browser isolation across scopes.
+        // Defaults MUST match apps/auth-hono-dynamodb-lambda src/config.ts.
+        REFRESH_COOKIE_CUSTOMER: process.env.LAMBDA_REFRESH_COOKIE_CUSTOMER || 'refresh_token',
+        REFRESH_COOKIE_TENANT: process.env.LAMBDA_REFRESH_COOKIE_TENANT || 'refresh_token_tenant',
+        REFRESH_COOKIE_SYSTEM: process.env.LAMBDA_REFRESH_COOKIE_SYSTEM || 'refresh_token_system',
         // Security (CI/CD: LAMBDA_MAX_LOGIN_* → app: MAX_LOGIN_*)
         MAX_LOGIN_ATTEMPTS: process.env.LAMBDA_MAX_LOGIN_ATTEMPTS || '5',
         LOCKOUT_DURATION_MINUTES: process.env.LAMBDA_LOCKOUT_DURATION_MINUTES || '30',
         REQUIRE_VERIFIED_IDENTITY: process.env.LAMBDA_REQUIRE_VERIFIED_IDENTITY || 'false',
         VERIFY_SESSION_ON_AUTH: process.env.LAMBDA_VERIFY_SESSION_ON_AUTH || 'false',
         SYSTEM_TENANT_ID: process.env.LAMBDA_SYSTEM_TENANT_ID || '__system__',
+        // Context-dependent JWT audience (resolved from tenant context at sign time).
+        // Values MUST equal the gateway AUTH_SCOPE names so the gateway can enforce
+        // scope-binding by comparing token aud === scope. Defaults match config.ts.
+        TOKEN_AUD_CUSTOMER: process.env.LAMBDA_TOKEN_AUD_CUSTOMER || 'customer',
+        TOKEN_AUD_TENANT: process.env.LAMBDA_TOKEN_AUD_TENANT || 'tenant',
+        TOKEN_AUD_SYSTEM: process.env.LAMBDA_TOKEN_AUD_SYSTEM || 'system',
         // Feature flags
         AUDIT_ENABLED: process.env.LAMBDA_AUDIT_ENABLED || 'false',
         DEVICE_TRACKING: process.env.LAMBDA_DEVICE_TRACKING || 'true',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.6.4",
+  "version": "1.7.1",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {