thinkwork-cli 0.13.0 → 0.13.2

package/dist/terraform/modules/foundation/cognito/variables.tf

@@ -128,6 +128,51 @@ variable "google_oauth_client_secret" {
   default     = ""
 }
 
+variable "microsoft_oauth_client_id" {
+  description = "Microsoft Entra application client ID for the default tenant-specific OIDC route"
+  type        = string
+  default     = ""
+}
+
+variable "microsoft_oauth_client_secret" {
+  description = "Microsoft Entra application client secret for the default tenant-specific OIDC route"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "microsoft_oauth_tenant" {
+  description = "Microsoft Entra directory GUID used to build the exact OIDC issuer for the default Microsoft route"
+  type        = string
+  default     = ""
+
+  validation {
+    condition     = var.microsoft_oauth_tenant == "" || can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", var.microsoft_oauth_tenant))
+    error_message = "microsoft_oauth_tenant must be an Entra directory GUID."
+  }
+}
+
+variable "tenant_entra_connections" {
+  description = "Safe metadata for tenant-specific Entra OIDC providers reconciled before Terraform creates their route clients. Contains no upstream secret values."
+  type = list(object({
+    connection_key = string
+    tenant_id      = string
+    provider_name  = string
+    display_name   = string
+  }))
+  default = []
+
+  validation {
+    condition = alltrue([
+      for connection in var.tenant_entra_connections :
+      can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", connection.tenant_id)) &&
+      can(regex("^Entra_[a-f0-9]{16}_[a-f0-9]{8}$", connection.provider_name)) &&
+      connection.connection_key != "" && connection.display_name != ""
+    ])
+    error_message = "Every tenant Entra connection must use a GUID tenant_id, a deterministic Entra_<tenant>_<hash> provider name, and non-empty safe labels."
+  }
+}
+
 variable "oidc_identity_providers" {
   description = "Additional Cognito OIDC identity providers. Secrets should be sourced from Secrets Manager/SSM by the caller, not committed to tfvars."
   type = list(object({
@@ -170,14 +215,55 @@ variable "pre_signup_lambda_zip" {
   default     = ""
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired; coexistence/cutover are explicit upgrade-only rollback states."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
 variable "custom_auth_lambda_zip" {
-  description = "Path to the Cognito custom-auth challenge Lambda zip file"
+  description = "Local Cognito custom-auth rollback Lambda artifact used only before the retired phase."
+  type        = string
+  default     = ""
+}
+
+variable "custom_auth_lambda_s3_bucket" {
+  description = "S3 bucket containing the Cognito custom-auth rollback Lambda artifact."
+  type        = string
+  default     = ""
+}
+
+variable "custom_auth_lambda_s3_key" {
+  description = "S3 key for the Cognito custom-auth rollback Lambda artifact."
+  type        = string
+  default     = ""
+}
+
+variable "pre_token_generation_lambda_s3_bucket" {
+  description = "S3 bucket containing the Cognito pre-token client-deny Lambda release artifact"
   type        = string
   default     = ""
 }
 
+variable "pre_token_generation_lambda_s3_key" {
+  description = "S3 key for the Cognito pre-token client-deny Lambda release artifact"
+  type        = string
+  default     = ""
+}
+
+variable "denied_app_client_ids" {
+  description = "Cognito app clients denied new and refresh token issuance during auth cutover"
+  type        = list(string)
+  default     = []
+}
+
 variable "api_auth_secret" {
-  description = "Shared signing secret used by the custom-auth challenge Lambda"
+  description = "Shared signing secret used by the pre-retirement custom-auth rollback Lambda"
   type        = string
   sensitive   = true
   default     = ""
@@ -193,6 +279,8 @@ variable "admin_callback_urls" {
   default = [
     "http://localhost:5174",
     "http://localhost:5174/auth/callback",
+    "http://127.0.0.1:5174",
+    "http://127.0.0.1:5174/auth/callback",
     "http://127.0.0.1:42010/callback",
     "http://localhost:42010/callback",
   ]
@@ -203,6 +291,7 @@ variable "admin_logout_urls" {
   type        = list(string)
   default = [
     "http://localhost:5174",
+    "http://127.0.0.1:5174",
   ]
 }
 
@@ -216,6 +305,39 @@ variable "desktop_callback_urls" {
   ]
 }
 
+variable "cli_callback_urls" {
+  description = "OAuth loopback callbacks reserved for the CLI client family."
+  type        = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
+variable "cli_logout_urls" {
+  description = "OAuth loopback logout destinations reserved for the CLI client family."
+  type        = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
+variable "existing_auth_route_clients" {
+  description = "Safe route-client manifest when using a BYO Cognito pool. Keys use <family>:<route>."
+  type = map(object({
+    client_id           = string
+    route_key           = string
+    client_family       = string
+    provider_names      = list(string)
+    explicit_auth_flows = list(string)
+    callback_urls       = list(string)
+    logout_urls         = list(string)
+    lifecycle_state     = string
+  }))
+  default = {}
+}
+
 variable "mobile_callback_urls" {
   description = "OAuth callback URLs for the mobile client. Host apps that embed the SDK register their own deep-link here. Proper per-host app client isolation is 0.3.0 work — this is the stopgap capture of the drift from the CLI-applied URIs."
   type        = list(string)

package/dist/terraform/modules/foundation/vpc/outputs.tf

@@ -28,6 +28,11 @@ output "nat_gateway_id" {
   value       = local.nat_gateway_enabled ? aws_nat_gateway.main[0].id : null
 }
 
+output "nat_gateway_public_ip" {
+  description = "Public EIP of the NAT gateway — the stable egress IP of every VPC-attached workload (what external IP allowlists must admit)"
+  value       = local.nat_gateway_enabled ? aws_nat_gateway.main[0].public_ip : null
+}
+
 output "vpc_cidr_block" {
   description = "The VPC's CIDR block (for endpoint/SG rules that must admit the whole VPC)"
   value       = var.cidr_block