thinkwork-cli 0.12.12 → 0.12.16

package/dist/terraform/modules/foundation/cognito/main.tf

@@ -9,12 +9,19 @@
 locals {
   create             = var.create_cognito
   create_pre_signup  = local.create && var.pre_signup_lambda_zip != ""
+  create_custom_auth = local.create && var.custom_auth_lambda_zip != ""
 
-  user_pool_id       = local.create ? aws_cognito_user_pool.main[0].id : var.existing_user_pool_id
-  user_pool_arn      = local.create ? aws_cognito_user_pool.main[0].arn : var.existing_user_pool_arn
-  admin_client_id     = local.create ? aws_cognito_user_pool_client.admin[0].id : var.existing_admin_client_id
+  user_pool_id     = local.create ? aws_cognito_user_pool.main[0].id : var.existing_user_pool_id
+  user_pool_arn    = local.create ? aws_cognito_user_pool.main[0].arn : var.existing_user_pool_arn
+  admin_client_id  = local.create ? aws_cognito_user_pool_client.admin[0].id : var.existing_admin_client_id
   mobile_client_id = local.create ? aws_cognito_user_pool_client.mobile[0].id : var.existing_mobile_client_id
-  identity_pool_id   = local.create ? aws_cognito_identity_pool.main[0].id : var.existing_identity_pool_id
+  identity_pool_id = local.create ? aws_cognito_identity_pool.main[0].id : var.existing_identity_pool_id
+  oidc_identity_providers = {
+    for provider in var.oidc_identity_providers : provider.provider_name => provider
+  }
+  saml_identity_providers = {
+    for provider in var.saml_identity_providers : provider.provider_name => provider
+  }
 }
 
 data "aws_caller_identity" "current" {}
@@ -84,6 +91,64 @@ resource "aws_lambda_permission" "cognito_pre_signup" {
   source_arn    = aws_cognito_user_pool.main[0].arn
 }
 
+################################################################################
+# Custom Auth Challenge Lambda
+################################################################################
+
+resource "aws_iam_role" "custom_auth" {
+  count = local.create_custom_auth ? 1 : 0
+  name  = "thinkwork-${var.stage}-cognito-custom-auth-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "custom_auth_basic" {
+  count      = local.create_custom_auth ? 1 : 0
+  role       = aws_iam_role.custom_auth[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_lambda_function" "custom_auth" {
+  count         = local.create_custom_auth ? 1 : 0
+  function_name = "thinkwork-${var.stage}-cognito-custom-auth"
+  filename      = var.custom_auth_lambda_zip
+  handler       = "index.handler"
+  runtime       = "nodejs20.x"
+  timeout       = 10
+  role          = aws_iam_role.custom_auth[0].arn
+
+  environment {
+    variables = {
+      API_AUTH_SECRET = var.api_auth_secret
+    }
+  }
+
+  source_code_hash = filebase64sha256(var.custom_auth_lambda_zip)
+
+  lifecycle {
+    precondition {
+      condition     = var.api_auth_secret != ""
+      error_message = "custom_auth_lambda_zip requires api_auth_secret so Cognito custom-auth challenges can be verified."
+    }
+  }
+}
+
+resource "aws_lambda_permission" "cognito_custom_auth" {
+  count         = local.create_custom_auth ? 1 : 0
+  statement_id  = "AllowCognitoInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.custom_auth[0].function_name
+  principal     = "cognito-idp.amazonaws.com"
+  source_arn    = aws_cognito_user_pool.main[0].arn
+}
+
 ################################################################################
 # User Pool
 ################################################################################
@@ -95,6 +160,23 @@ resource "aws_cognito_user_pool" "main" {
   username_attributes      = ["email"]
   auto_verified_attributes = ["email"]
 
+  email_configuration {
+    email_sending_account  = var.email_source_arn != "" ? "DEVELOPER" : "COGNITO_DEFAULT"
+    source_arn             = var.email_source_arn != "" ? var.email_source_arn : null
+    from_email_address     = var.from_email_address != "" ? var.from_email_address : null
+    reply_to_email_address = var.reply_to_email_address != "" ? var.reply_to_email_address : null
+  }
+
+  admin_create_user_config {
+    allow_admin_create_user_only = false
+
+    invite_message_template {
+      email_subject = var.invite_email_subject
+      email_message = var.invite_email_message
+      sms_message   = var.invite_sms_message
+    }
+  }
+
   schema {
     name                = "email"
     attribute_data_type = "String"
@@ -136,9 +218,12 @@ resource "aws_cognito_user_pool" "main" {
   }
 
   dynamic "lambda_config" {
-    for_each = local.create_pre_signup ? [1] : []
+    for_each = local.create_pre_signup || local.create_custom_auth ? [1] : []
     content {
-      pre_sign_up = aws_lambda_function.pre_signup[0].arn
+      pre_sign_up                    = local.create_pre_signup ? aws_lambda_function.pre_signup[0].arn : null
+      define_auth_challenge          = local.create_custom_auth ? aws_lambda_function.custom_auth[0].arn : null
+      create_auth_challenge          = local.create_custom_auth ? aws_lambda_function.custom_auth[0].arn : null
+      verify_auth_challenge_response = local.create_custom_auth ? aws_lambda_function.custom_auth[0].arn : null
     }
   }
 
@@ -148,6 +233,11 @@ resource "aws_cognito_user_pool" "main" {
 
   lifecycle {
     ignore_changes = [schema]
+
+    precondition {
+      condition     = var.from_email_address == "" || var.email_source_arn != ""
+      error_message = "from_email_address requires email_source_arn so Cognito can use a verified SES identity."
+    }
   }
 }
 
@@ -191,7 +281,57 @@ resource "aws_cognito_identity_provider" "google" {
 }
 
 locals {
-  identity_providers = var.google_oauth_client_id != "" ? ["Google", "COGNITO"] : ["COGNITO"]
+  identity_providers = concat(
+    var.google_oauth_client_id != "" ? ["Google"] : [],
+    keys(local.oidc_identity_providers),
+    keys(local.saml_identity_providers),
+    ["COGNITO"]
+  )
+}
+
+resource "aws_cognito_identity_provider" "oidc" {
+  for_each = local.create ? local.oidc_identity_providers : {}
+
+  user_pool_id  = aws_cognito_user_pool.main[0].id
+  provider_name = each.value.provider_name
+  provider_type = "OIDC"
+
+  provider_details = merge(
+    {
+      client_id                 = each.value.client_id
+      client_secret             = each.value.client_secret
+      authorize_scopes          = each.value.authorize_scopes
+      oidc_issuer               = each.value.issuer_url
+      token_request_method      = "POST"
+      attributes_request_method = "GET"
+    },
+    each.value.authorize_url != "" ? { authorize_url = each.value.authorize_url } : {},
+    each.value.token_url != "" ? { token_url = each.value.token_url } : {},
+    each.value.attributes_url != "" ? { attributes_url = each.value.attributes_url } : {},
+    each.value.jwks_uri != "" ? { jwks_uri = each.value.jwks_uri } : {}
+  )
+
+  attribute_mapping = {
+    email    = each.value.attribute_mapping.email
+    name     = each.value.attribute_mapping.name
+    username = each.value.attribute_mapping.username
+  }
+}
+
+resource "aws_cognito_identity_provider" "saml" {
+  for_each = local.create ? local.saml_identity_providers : {}
+
+  user_pool_id     = aws_cognito_user_pool.main[0].id
+  provider_name    = each.value.provider_name
+  provider_type    = "SAML"
+  idp_identifiers  = each.value.idp_identifiers
+  provider_details = { MetadataURL = each.value.metadata_url }
+
+  attribute_mapping = {
+    email    = each.value.attribute_mapping.email
+    name     = each.value.attribute_mapping.name
+    username = each.value.attribute_mapping.username
+  }
 }
 
 ################################################################################
@@ -207,10 +347,17 @@ resource "aws_cognito_user_pool_client" "admin" {
   allowed_oauth_flows                  = ["code"]
   allowed_oauth_scopes                 = ["openid", "email", "profile"]
 
+  explicit_auth_flows = [
+    "ALLOW_CUSTOM_AUTH",
+    "ALLOW_REFRESH_TOKEN_AUTH",
+    "ALLOW_USER_PASSWORD_AUTH",
+    "ALLOW_USER_SRP_AUTH",
+  ]
+
   supported_identity_providers = local.identity_providers
 
-  callback_urls = var.admin_callback_urls
-  logout_urls   = var.admin_logout_urls
+  callback_urls = distinct(concat(var.admin_callback_urls, var.desktop_callback_urls))
+  logout_urls   = distinct(concat(var.admin_logout_urls, var.desktop_callback_urls))
 
   access_token_validity  = 1
   id_token_validity      = 1
@@ -235,7 +382,11 @@ resource "aws_cognito_user_pool_client" "admin" {
     "custom:tenant_id",
   ]
 
-  depends_on = [aws_cognito_identity_provider.google]
+  depends_on = [
+    aws_cognito_identity_provider.google,
+    aws_cognito_identity_provider.oidc,
+    aws_cognito_identity_provider.saml,
+  ]
 }
 
 ################################################################################
@@ -248,6 +399,7 @@ resource "aws_cognito_user_pool_client" "mobile" {
   user_pool_id = aws_cognito_user_pool.main[0].id
 
   explicit_auth_flows = [
+    "ALLOW_CUSTOM_AUTH",
     "ALLOW_USER_PASSWORD_AUTH",
     "ALLOW_USER_SRP_AUTH",
     "ALLOW_REFRESH_TOKEN_AUTH",
@@ -285,7 +437,11 @@ resource "aws_cognito_user_pool_client" "mobile" {
     "custom:tenant_id",
   ]
 
-  depends_on = [aws_cognito_identity_provider.google]
+  depends_on = [
+    aws_cognito_identity_provider.google,
+    aws_cognito_identity_provider.oidc,
+    aws_cognito_identity_provider.saml,
+  ]
 }
 
 ################################################################################

package/dist/terraform/modules/foundation/cognito/outputs.tf

@@ -27,3 +27,8 @@ output "auth_domain" {
   description = "Cognito hosted UI domain (only available when create_cognito = true)"
   value       = local.create ? aws_cognito_user_pool_domain.main[0].domain : null
 }
+
+output "identity_provider_names" {
+  description = "Supported Cognito identity providers for created app clients."
+  value       = local.identity_providers
+}

package/dist/terraform/modules/foundation/cognito/variables.tf

@@ -58,6 +58,57 @@ variable "user_pool_name" {
   default     = ""
 }
 
+variable "email_source_arn" {
+  description = "SES identity ARN Cognito should use for user-pool emails. Leave empty to use Cognito's default sender."
+  type        = string
+  default     = ""
+}
+
+variable "from_email_address" {
+  description = "Optional Cognito From header, for example 'ThinkWork <noreply@example.com>'. Requires email_source_arn when set."
+  type        = string
+  default     = ""
+}
+
+variable "reply_to_email_address" {
+  description = "Optional Cognito Reply-To address for user-pool emails."
+  type        = string
+  default     = ""
+}
+
+variable "invite_email_subject" {
+  description = "Subject line for Cognito AdminCreateUser invitation emails."
+  type        = string
+  default     = "You're invited to ThinkWork"
+}
+
+variable "invite_email_message" {
+  description = "HTML invitation body for Cognito AdminCreateUser emails. Must include {username} and {####} so Cognito can send the temporary password."
+  type        = string
+  default     = <<-EOT
+    <p>You have been invited to ThinkWork.</p>
+    <p>Username: <strong>{username}</strong></p>
+    <p>Temporary password: <strong>{####}</strong></p>
+    <p>Sign in to your ThinkWork environment to finish setup.</p>
+  EOT
+
+  validation {
+    condition     = strcontains(var.invite_email_message, "{username}") && strcontains(var.invite_email_message, "{####}")
+    error_message = "invite_email_message must include Cognito placeholders {username} and {####}."
+  }
+}
+
+variable "invite_sms_message" {
+  description = "SMS invitation body for Cognito AdminCreateUser messages. Must include {username} and {####} so Cognito can send the temporary password."
+  type        = string
+  default     = "Your ThinkWork username is {username} and temporary password is {####}."
+
+  validation {
+    condition     = strcontains(var.invite_sms_message, "{username}") && strcontains(var.invite_sms_message, "{####}")
+    error_message = "invite_sms_message must include Cognito placeholders {username} and {####}."
+  }
+}
+
 variable "identity_pool_name" {
   description = "Override the identity pool name (defaults to thinkwork-<stage>-identity-pool)"
   type        = string
@@ -77,12 +128,61 @@ variable "google_oauth_client_secret" {
   default     = ""
 }
 
+variable "oidc_identity_providers" {
+  description = "Additional Cognito OIDC identity providers. Secrets should be sourced from Secrets Manager/SSM by the caller, not committed to tfvars."
+  type = list(object({
+    provider_name    = string
+    client_id        = string
+    client_secret    = string
+    issuer_url       = string
+    authorize_scopes = optional(string, "openid email profile")
+    authorize_url    = optional(string, "")
+    token_url        = optional(string, "")
+    attributes_url   = optional(string, "")
+    jwks_uri         = optional(string, "")
+    attribute_mapping = optional(object({
+      email    = optional(string, "email")
+      name     = optional(string, "name")
+      username = optional(string, "sub")
+    }), {})
+  }))
+  default = []
+}
+
+variable "saml_identity_providers" {
+  description = "Additional Cognito SAML identity providers. Metadata URLs must be public HTTPS endpoints validated before Terraform."
+  type = list(object({
+    provider_name   = string
+    metadata_url    = string
+    idp_identifiers = optional(list(string), [])
+    attribute_mapping = optional(object({
+      email    = optional(string, "email")
+      name     = optional(string, "name")
+      username = optional(string, "NameID")
+    }), {})
+  }))
+  default = []
+}
+
 variable "pre_signup_lambda_zip" {
   description = "Path to the pre-signup Lambda zip file"
   type        = string
   default     = ""
 }
 
+variable "custom_auth_lambda_zip" {
+  description = "Path to the Cognito custom-auth challenge Lambda zip file"
+  type        = string
+  default     = ""
+}
+
+variable "api_auth_secret" {
+  description = "Shared signing secret used by the custom-auth challenge Lambda"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
 # ---------------------------------------------------------------------------
 # Callback URLs (configurable per deployment)
 # ---------------------------------------------------------------------------
@@ -106,6 +206,16 @@ variable "admin_logout_urls" {
   ]
 }
 
+variable "desktop_callback_urls" {
+  description = "OAuth callback and logout URLs for the desktop client that reuses the ThinkworkAdmin public Cognito client."
+  type        = list(string)
+  default = [
+    "thinkwork://oauth/callback",
+    "thinkwork-dev://oauth/callback",
+    "thinkwork-canary://oauth/callback",
+  ]
+}
+
 variable "mobile_callback_urls" {
   description = "OAuth callback URLs for the mobile client. Host apps that embed the SDK register their own deep-link here. Proper per-host app client isolation is 0.3.0 work — this is the stopgap capture of the drift from the CLI-applied URIs."
   type        = list(string)

package/dist/terraform/modules/foundation/vpc/main.tf

@@ -6,9 +6,12 @@
 ################################################################################
 
 locals {
-  vpc_id             = var.create_vpc ? aws_vpc.main[0].id : var.existing_vpc_id
-  public_subnet_ids  = var.create_vpc ? [aws_subnet.public[0].id, aws_subnet.public[1].id] : var.existing_public_subnet_ids
-  private_subnet_ids = var.create_vpc ? [aws_subnet.private[0].id, aws_subnet.private[1].id] : var.existing_private_subnet_ids
+  vpc_id                  = var.create_vpc ? aws_vpc.main[0].id : var.existing_vpc_id
+  public_subnet_ids       = var.create_vpc ? [aws_subnet.public[0].id, aws_subnet.public[1].id] : var.existing_public_subnet_ids
+  private_subnet_ids      = var.create_vpc ? [aws_subnet.private[0].id, aws_subnet.private[1].id] : var.existing_private_subnet_ids
+  public_route_table_ids  = var.create_vpc ? aws_route_table.public[*].id : var.existing_public_route_table_ids
+  private_route_table_ids = var.create_vpc ? aws_route_table.private[*].id : var.existing_private_route_table_ids
+  nat_gateway_enabled     = var.enable_nat_gateway && length(local.public_subnet_ids) > 0 && length(local.private_route_table_ids) > 0
 }
 
 ################################################################################
@@ -122,6 +125,45 @@ resource "aws_route_table_association" "private" {
   route_table_id = aws_route_table.private[count.index].id
 }
 
+################################################################################
+# Optional NAT Gateway
+################################################################################
+
+resource "aws_eip" "nat" {
+  count = local.nat_gateway_enabled ? 1 : 0
+
+  domain = "vpc"
+
+  tags = {
+    Name = "thinkwork-${var.stage}-nat-eip"
+  }
+}
+
+resource "aws_nat_gateway" "main" {
+  count = local.nat_gateway_enabled ? 1 : 0
+
+  allocation_id = aws_eip.nat[0].id
+  subnet_id     = local.public_subnet_ids[0]
+
+  tags = {
+    Name = "thinkwork-${var.stage}-nat"
+  }
+
+  depends_on = [aws_internet_gateway.main]
+}
+
+resource "aws_route" "private_nat" {
+  # Keyed by static index, not route-table ID: created-in-this-apply IDs are
+  # unknown at plan time and break the FIRST apply in a fresh account
+  # ("Invalid for_each argument" — THINK-118 harness cycle 4). Existing states
+  # re-address these routes on the next apply (brief default-route recreate).
+  count = local.nat_gateway_enabled ? (var.create_vpc ? length(var.availability_zones) : length(var.existing_private_route_table_ids)) : 0
+
+  route_table_id         = local.private_route_table_ids[count.index]
+  destination_cidr_block = "0.0.0.0/0"
+  nat_gateway_id         = aws_nat_gateway.main[0].id
+}
+
 ################################################################################
 # Default Route Table
 ################################################################################

package/dist/terraform/modules/foundation/vpc/outputs.tf

@@ -12,3 +12,23 @@ output "private_subnet_ids" {
   description = "IDs of the private subnets (created or existing)"
   value       = local.private_subnet_ids
 }
+
+output "public_route_table_ids" {
+  description = "IDs of the public route tables (created or existing)"
+  value       = local.public_route_table_ids
+}
+
+output "private_route_table_ids" {
+  description = "IDs of the private route tables (created or existing)"
+  value       = local.private_route_table_ids
+}
+
+output "nat_gateway_id" {
+  description = "NAT Gateway ID when enable_nat_gateway is true and route tables are available"
+  value       = local.nat_gateway_enabled ? aws_nat_gateway.main[0].id : null
+}
+
+output "vpc_cidr_block" {
+  description = "The VPC's CIDR block (for endpoint/SG rules that must admit the whole VPC)"
+  value       = var.cidr_block
+}

package/dist/terraform/modules/foundation/vpc/variables.tf

@@ -27,6 +27,24 @@ variable "existing_private_subnet_ids" {
   default     = []
 }
 
+variable "existing_public_route_table_ids" {
+  description = "IDs of existing public route tables (recommended when create_vpc = false)"
+  type        = list(string)
+  default     = []
+}
+
+variable "existing_private_route_table_ids" {
+  description = "IDs of existing private route tables (recommended when create_vpc = false)"
+  type        = list(string)
+  default     = []
+}
+
+variable "enable_nat_gateway" {
+  description = "Create a NAT Gateway and default routes from private route tables for private subnet egress."
+  type        = bool
+  default     = false
+}
+
 variable "cidr_block" {
   description = "CIDR block for the VPC (only used when create_vpc = true)"
   type        = string

package/dist/terraform/modules/thinkwork/README.md

@@ -0,0 +1,71 @@
+# `thinkwork` — Composite Root Module
+
+Wires the three tiers (foundation → data → app) together with sensible defaults.
+Published to the Terraform Registry as `thinkwork-ai/thinkwork/aws`.
+
+For advanced composition, use the sub-modules directly:
+
+```hcl
+source = "thinkwork-ai/thinkwork/aws//modules/foundation/vpc"
+```
+
+## Breaking change — required provider alias
+
+**As of the customer-domain namespace feature**, this module unconditionally declares:
+
+```hcl
+configuration_aliases = [aws.us_east_1]
+```
+
+Every root module that calls `thinkwork-ai/thinkwork/aws` **must** declare the aliased
+provider and pass it through, even when `customer_domain` is left empty:
+
+```hcl
+provider "aws" {
+  alias  = "us_east_1"
+  region = "us-east-1"
+}
+
+module "thinkwork" {
+  source = "thinkwork-ai/thinkwork/aws"
+
+  providers = {
+    aws.us_east_1 = aws.us_east_1
+  }
+
+  # ... other inputs ...
+}
+```
+
+**Rationale:** CloudFront ACM certificates must be created in `us-east-1` regardless
+of the deployment region. Because `configuration_aliases` is declared unconditionally,
+Terraform validates the alias at `init`/`plan` time for all callers — not only those
+who set `customer_domain`.
+
+## Usage
+
+See `terraform/examples/greenfield/` for a full working example.
+
+## Inputs
+
+See `variables.tf` for the full list with descriptions and defaults. Key optional
+feature flags:
+
+| Variable                         | Default | Purpose                                                            |
+| -------------------------------- | ------- | ------------------------------------------------------------------ |
+| `customer_domain`                | `""`    | Customer-namespace domain (e.g. `tei.thinkwork.ai`). Empty = skip. |
+| `customer_domain_delegated`      | `false` | Phase-two gate — flip once NS delegation resolves.                 |
+| `customer_domain_legacy_retired` | `false` | Retirement gate — removes legacy Cognito callbacks after cutover.  |
+| `enable_hindsight`               | `true`  | Provisions Hindsight canonical user and Space memory.              |
+| `enable_cognee`                  | `false` | Provisions optional Cognee Brain ontology/graph infrastructure.    |
+| `www_domain`                     | `""`    | Public website apex domain. Empty = CloudFront URL only.           |
+
+## Outputs
+
+See `outputs.tf` for the full list. Key customer-domain outputs:
+
+| Output                            | Purpose                                                               |
+| --------------------------------- | --------------------------------------------------------------------- |
+| `customer_domain_name_servers`    | Route53 NS records to publish via `claim --set-targets` (phase two).  |
+| `customer_domain_zone_id`         | Route53 hosted zone ID for the customer domain.                       |
+| `customer_domain_certificate_arn` | Validated ACM cert ARN (populated after `customer_domain_delegated`). |