thinkwork-cli 0.13.1 → 0.13.2

package/dist/terraform/modules/app/lambda-api/variables.tf

@@ -13,6 +13,30 @@ variable "region" {
   type        = string
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired; WorkOS callback/bridge routes exist only for explicitly configured upgrade rollback windows."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
+variable "auth_migration_recovery_deadline" {
+  description = "RFC3339 deadline for completing legacy-session identity migration. Required while auth_retirement_phase is coexistence."
+  type        = string
+  default     = ""
+
+  validation {
+    condition = trimspace(var.auth_migration_recovery_deadline) == "" || (
+      can(timecmp(var.auth_migration_recovery_deadline, var.auth_migration_recovery_deadline))
+    )
+    error_message = "auth_migration_recovery_deadline must be empty or an RFC3339 timestamp."
+  }
+}
+
 variable "lambda_artifact_bucket" {
   description = "S3 bucket containing Lambda deployment artifacts"
   type        = string
@@ -135,10 +159,9 @@ variable "appsync_api_url" {
   type        = string
 }
 
-variable "appsync_api_key" {
-  description = "AppSync API key"
+variable "appsync_api_id" {
+  description = "AppSync subscriptions API ID used as the subscription-ticket audience"
   type        = string
-  sensitive   = true
 }
 
 variable "kb_service_role_arn" {
@@ -147,7 +170,65 @@ variable "kb_service_role_arn" {
 }
 
 variable "agentcore_harness_execution_role_arn" {
-  description = "AgentCore Harness execution role ARN (THINK-311 U4). Empty string (harness module disabled) omits the Harness invoker grants from the grouped ai policy."
+  description = "Legacy Harness execution-role input retained for module compatibility. Request-path PassRole/control-plane grants were removed by THINK-316 U2."
+  type        = string
+  default     = ""
+}
+
+variable "enable_agentcore_harness_invocation" {
+  description = "Grant only the Harness data-plane invocation actions to the request path. Harness control-plane permissions remain outside Lambda."
+  type        = bool
+  default     = false
+}
+
+variable "enable_agentcore_multiplayer_proof" {
+  description = "Enable the non-production THINK-316 AgentCore Identity/Gateway/Harness proof surfaces. Defaults off and never changes ordinary Pi routing."
+  type        = bool
+  default     = false
+}
+
+variable "agentcore_turn_assertion_key_versions" {
+  description = "One or two published AgentCore assertion KMS key versions. Use two only during the bounded rotation overlap."
+  type        = list(string)
+  default     = ["v1"]
+
+  validation {
+    condition = (
+      length(var.agentcore_turn_assertion_key_versions) >= 1 &&
+      length(var.agentcore_turn_assertion_key_versions) <= 2 &&
+      length(distinct(var.agentcore_turn_assertion_key_versions)) == length(var.agentcore_turn_assertion_key_versions) &&
+      alltrue([for version in var.agentcore_turn_assertion_key_versions : can(regex("^[a-z0-9][a-z0-9-]{0,15}$", version))])
+    )
+    error_message = "agentcore_turn_assertion_key_versions must contain one or two unique lowercase version labels."
+  }
+}
+
+variable "agentcore_turn_assertion_active_key_version" {
+  description = "Published AgentCore assertion key version used for new signatures."
+  type        = string
+  default     = "v1"
+
+  validation {
+    condition     = contains(var.agentcore_turn_assertion_key_versions, var.agentcore_turn_assertion_active_key_version)
+    error_message = "agentcore_turn_assertion_active_key_version must be present in agentcore_turn_assertion_key_versions."
+  }
+}
+
+variable "agentcore_proof_oauth_client_id" {
+  description = "Synthetic OAuth client id used only by the THINK-316 proof provider."
+  type        = string
+  default     = ""
+}
+
+variable "agentcore_proof_oauth_client_secret" {
+  description = "Synthetic OAuth client secret used only by the THINK-316 proof provider and boundary target."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "agentcore_proof_owner_allowlist" {
+  description = "Comma-separated synthetic subjects used by the THINK-316 manual authorization-code and mixed-disclosure fixtures. Signed OBO turn participants do not require registration here."
   type        = string
   default     = ""
 }
@@ -244,18 +325,6 @@ variable "brain_dream_state_schedule_expression" {
   default     = "cron(0 5 * * ? *)"
 }
 
-variable "retry_dispatcher_enabled" {
-  description = "Enable the recurring retry-dispatcher schedule (THINK-307). Never enable on a stage before THINK-305, THINK-308, and THINK-309 are live there (parent plan deploy ordering); manual invokes work regardless."
-  type        = bool
-  default     = false
-}
-
-variable "stall_threshold_minutes" {
-  description = "Minutes of turn inactivity before the stall monitor marks a running turn timed_out; the retry dispatcher reads the same knob as its origin-freshness guard (THINK-306/THINK-307 — one knob, two consumers)."
-  type        = number
-  default     = 5
-}
-
 variable "extension_proxy_signing_secret" {
   description = "Shared HMAC secret used by the generic Admin extension proxy to sign actor context for extension backends."
   type        = string
@@ -549,6 +618,12 @@ variable "knowledge_graph_observations_ingest_enabled" {
   default     = false
 }
 
+variable "ontology_scan_sweep_enabled" {
+  description = "Enable the recurring per-tenant ontology suggestion scan sweep (THINK-320 U4/KTD-3). Ships disabled; enabled per stage once the Living Map review surfaces land."
+  type        = bool
+  default     = false
+}
+
 variable "wiki_source" {
   description = "Wiki pipeline source dispatch (plan 2026-06-09-004 U10). 'planner' (default) runs the original LLM compile path; 'graph' runs the deterministic graph→wiki materializer over the knowledge-graph mirror and makes successful observation-ingest runs the compile trigger. Variable-ized (not hardcoded) per the wiki-compile env precedent so unrelated deploys don't reset the flag; the Lambda reads it verbatim from env and treats any value other than 'graph' as 'planner'."
   type        = string
@@ -800,6 +875,24 @@ variable "capability_signing_private_key_secret" {
   default     = ""
 }
 
+variable "subscription_ticket_signing_key_id" {
+  description = "Active Ed25519 subscription-ticket signing key ID."
+  type        = string
+  default     = ""
+}
+
+variable "subscription_ticket_public_keys" {
+  description = "JSON verifier keyring for AppSync subscription tickets; contains public material only."
+  type        = string
+  default     = "[]"
+}
+
+variable "subscription_ticket_private_key_secret" {
+  description = "Secrets Manager name holding the isolated subscription-ticket Ed25519 private key."
+  type        = string
+  default     = ""
+}
+
 # ---------------------------------------------------------------------------
 # THINK-228 U3 — analyst query broker runtime config
 # ---------------------------------------------------------------------------

package/dist/terraform/modules/foundation/cognito/main.tf

@@ -9,15 +9,21 @@
 locals {
   create                          = var.create_cognito
   create_pre_signup               = local.create && var.pre_signup_lambda_zip != ""
+  create_pre_token_generation     = local.create && trimspace(var.pre_token_generation_lambda_s3_bucket) != "" && trimspace(var.pre_token_generation_lambda_s3_key) != ""
+  workos_rollback_enabled         = var.auth_retirement_phase != "retired"
   use_local_custom_auth_artifact  = trimspace(var.custom_auth_lambda_zip) != ""
   use_remote_custom_auth_artifact = trimspace(var.custom_auth_lambda_s3_bucket) != ""
   custom_auth_artifact_count      = (local.use_local_custom_auth_artifact ? 1 : 0) + (local.use_remote_custom_auth_artifact ? 1 : 0)
-  create_custom_auth              = local.create && local.custom_auth_artifact_count == 1
-
-  user_pool_id     = local.create ? aws_cognito_user_pool.main[0].id : var.existing_user_pool_id
-  user_pool_arn    = local.create ? aws_cognito_user_pool.main[0].arn : var.existing_user_pool_arn
-  admin_client_id  = local.create ? aws_cognito_user_pool_client.admin[0].id : var.existing_admin_client_id
-  mobile_client_id = local.create ? aws_cognito_user_pool_client.mobile[0].id : var.existing_mobile_client_id
+  create_custom_auth              = local.create && local.workos_rollback_enabled && local.custom_auth_artifact_count == 1
+
+  user_pool_id  = local.create ? aws_cognito_user_pool.main[0].id : var.existing_user_pool_id
+  user_pool_arn = local.create ? aws_cognito_user_pool.main[0].arn : var.existing_user_pool_arn
+  admin_client_id = local.create ? (
+    local.workos_rollback_enabled ? aws_cognito_user_pool_client.admin[0].id : aws_cognito_user_pool_client.auth_route["web:local"].id
+  ) : var.existing_admin_client_id
+  mobile_client_id = local.create ? (
+    local.workos_rollback_enabled ? aws_cognito_user_pool_client.mobile[0].id : aws_cognito_user_pool_client.auth_route["mobile:local"].id
+  ) : var.existing_mobile_client_id
   identity_pool_id = local.create ? aws_cognito_identity_pool.main[0].id : var.existing_identity_pool_id
   oidc_identity_providers = {
     for provider in var.oidc_identity_providers : provider.provider_name => provider
@@ -25,10 +31,84 @@ locals {
   saml_identity_providers = {
     for provider in var.saml_identity_providers : provider.provider_name => provider
   }
+  auth_client_families = {
+    web = {
+      callback_urls      = [for url in var.admin_callback_urls : url if !strcontains(url, ":42010/")]
+      logout_urls        = var.admin_logout_urls
+      refresh_token_days = 30
+    }
+    mobile = {
+      callback_urls      = var.mobile_callback_urls
+      logout_urls        = var.mobile_logout_urls
+      refresh_token_days = 90
+    }
+    desktop = {
+      callback_urls      = var.desktop_callback_urls
+      logout_urls        = var.desktop_callback_urls
+      refresh_token_days = 30
+    }
+    cli = {
+      callback_urls      = var.cli_callback_urls
+      logout_urls        = var.cli_logout_urls
+      refresh_token_days = 30
+    }
+  }
+  static_auth_routes = merge(
+    {
+      for family, config in local.auth_client_families : "${family}:local" => {
+        route_key           = "local"
+        client_family       = family
+        provider_names      = ["COGNITO"]
+        explicit_auth_flows = ["ALLOW_USER_PASSWORD_AUTH", "ALLOW_USER_SRP_AUTH", "ALLOW_REFRESH_TOKEN_AUTH"]
+        callback_urls       = config.callback_urls
+        logout_urls         = config.logout_urls
+        refresh_token_days  = config.refresh_token_days
+      }
+    },
+    var.google_oauth_client_id != "" ? {
+      for family, config in local.auth_client_families : "${family}:google" => {
+        route_key           = "google"
+        client_family       = family
+        provider_names      = ["Google"]
+        explicit_auth_flows = ["ALLOW_REFRESH_TOKEN_AUTH"]
+        callback_urls       = config.callback_urls
+        logout_urls         = config.logout_urls
+        refresh_token_days  = config.refresh_token_days
+      }
+    } : {},
+    var.microsoft_oauth_client_id != "" ? {
+      for family, config in local.auth_client_families : "${family}:microsoft" => {
+        route_key           = "microsoft"
+        client_family       = family
+        provider_names      = ["MicrosoftOrganizations"]
+        explicit_auth_flows = ["ALLOW_REFRESH_TOKEN_AUTH"]
+        callback_urls       = config.callback_urls
+        logout_urls         = config.logout_urls
+        refresh_token_days  = config.refresh_token_days
+      }
+    } : {},
+  )
+  tenant_auth_routes = merge({}, [
+    for connection in var.tenant_entra_connections : {
+      for family, config in local.auth_client_families : "${family}:entra:${lower(connection.tenant_id)}" => {
+        route_key           = "entra-${replace(lower(connection.tenant_id), "-", "")}"
+        client_family       = family
+        provider_names      = [connection.provider_name]
+        explicit_auth_flows = ["ALLOW_REFRESH_TOKEN_AUTH"]
+        callback_urls       = config.callback_urls
+        logout_urls         = config.logout_urls
+        refresh_token_days  = config.refresh_token_days
+      }
+    }
+  ]...)
+  auth_routes = merge(local.static_auth_routes, local.tenant_auth_routes)
 }
 
 resource "terraform_data" "custom_auth_artifact_validation" {
-  input = local.custom_auth_artifact_count
+  input = {
+    phase          = var.auth_retirement_phase
+    artifact_count = local.custom_auth_artifact_count
+  }
 
   lifecycle {
     precondition {
@@ -40,6 +120,16 @@ resource "terraform_data" "custom_auth_artifact_validation" {
       condition     = !local.use_remote_custom_auth_artifact || trimspace(var.custom_auth_lambda_s3_key) != ""
       error_message = "custom_auth_lambda_s3_key must be set when custom_auth_lambda_s3_bucket is set."
     }
+
+    precondition {
+      condition     = !local.create_custom_auth || var.api_auth_secret != ""
+      error_message = "The WorkOS rollback custom-auth Lambda requires api_auth_secret until auth_retirement_phase is retired."
+    }
+
+    precondition {
+      condition     = var.microsoft_oauth_client_id == "" || var.microsoft_oauth_tenant != ""
+      error_message = "microsoft_oauth_tenant is required when microsoft_oauth_client_id is configured because Cognito requires an exact tenant issuer."
+    }
   }
 }
 
@@ -69,26 +159,6 @@ resource "aws_iam_role_policy_attachment" "pre_signup_basic" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
-resource "aws_iam_role_policy" "pre_signup_cognito" {
-  count = local.create_pre_signup ? 1 : 0
-  name  = "cognito-access"
-  role  = aws_iam_role.pre_signup[0].id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect = "Allow"
-      Action = [
-        "cognito-idp:ListUsers",
-        "cognito-idp:AdminLinkProviderForUser",
-        "cognito-idp:AdminCreateUser",
-        "cognito-idp:AdminSetUserPassword"
-      ]
-      Resource = aws_cognito_user_pool.main[0].arn
-    }]
-  })
-}
-
 resource "aws_lambda_function" "pre_signup" {
   count         = local.create_pre_signup ? 1 : 0
   function_name = "thinkwork-${var.stage}-cognito-pre-signup"
@@ -111,15 +181,62 @@ resource "aws_lambda_permission" "cognito_pre_signup" {
 }
 
 ################################################################################
-# Custom Auth Challenge Lambda
+# Pre Token Generation Client Cutoff Lambda
+################################################################################
+
+resource "aws_iam_role" "pre_token_generation" {
+  count = local.create_pre_token_generation ? 1 : 0
+  name  = "thinkwork-${var.stage}-cognito-pre-token-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Effect    = "Allow"
+      Principal = { Service = "lambda.amazonaws.com" }
+      Action    = "sts:AssumeRole"
+    }]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "pre_token_generation_basic" {
+  count      = local.create_pre_token_generation ? 1 : 0
+  role       = aws_iam_role.pre_token_generation[0].name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_lambda_function" "pre_token_generation" {
+  count         = local.create_pre_token_generation ? 1 : 0
+  function_name = "thinkwork-${var.stage}-cognito-pre-token-client-deny"
+  s3_bucket     = var.pre_token_generation_lambda_s3_bucket
+  s3_key        = var.pre_token_generation_lambda_s3_key
+  handler       = "index.handler"
+  runtime       = "nodejs20.x"
+  timeout       = 5
+  role          = aws_iam_role.pre_token_generation[0].arn
+
+  environment {
+    variables = {
+      COGNITO_DENIED_APP_CLIENT_IDS = join(",", var.denied_app_client_ids)
+    }
+  }
+}
+
+resource "aws_lambda_permission" "cognito_pre_token_generation" {
+  count         = local.create_pre_token_generation ? 1 : 0
+  statement_id  = "AllowCognitoInvoke"
+  action        = "lambda:InvokeFunction"
+  function_name = aws_lambda_function.pre_token_generation[0].function_name
+  principal     = "cognito-idp.amazonaws.com"
+  source_arn    = aws_cognito_user_pool.main[0].arn
+}
+
+################################################################################
+# Legacy WorkOS Custom Auth Challenge Lambda (rollback runtime only)
 ################################################################################
 
 resource "aws_iam_role" "custom_auth" {
   count = local.create_custom_auth ? 1 : 0
-  # Release deployments use a distinct managed name so the first convergent
-  # apply does not collide with custom-auth Lambdas created during the legacy
-  # manual rollout. Local source deployments retain the original name.
-  name = local.use_remote_custom_auth_artifact ? "thinkwork-${var.stage}-cognito-custom-auth-release-role" : "thinkwork-${var.stage}-cognito-custom-auth-role"
+  name  = local.use_remote_custom_auth_artifact ? "thinkwork-${var.stage}-cognito-custom-auth-release-role" : "thinkwork-${var.stage}-cognito-custom-auth-role"
 
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
@@ -155,13 +272,6 @@ resource "aws_lambda_function" "custom_auth" {
   }
 
   source_code_hash = local.use_local_custom_auth_artifact ? filebase64sha256(var.custom_auth_lambda_zip) : null
-
-  lifecycle {
-    precondition {
-      condition     = var.api_auth_secret != ""
-      error_message = "A Cognito custom-auth Lambda artifact requires api_auth_secret so custom-auth challenges can be verified."
-    }
-  }
 }
 
 resource "aws_lambda_permission" "cognito_custom_auth" {
@@ -213,6 +323,30 @@ resource "aws_cognito_user_pool" "main" {
     }
   }
 
+  schema {
+    name                = "entra_tenant_id"
+    attribute_data_type = "String"
+    required            = false
+    mutable             = true
+
+    string_attribute_constraints {
+      min_length = 0
+      max_length = 36
+    }
+  }
+
+  schema {
+    name                = "entra_object_id"
+    attribute_data_type = "String"
+    required            = false
+    mutable             = true
+
+    string_attribute_constraints {
+      min_length = 0
+      max_length = 36
+    }
+  }
+
   schema {
     name                = "tenant_id"
     attribute_data_type = "String"
@@ -242,12 +376,19 @@ resource "aws_cognito_user_pool" "main" {
   }
 
   dynamic "lambda_config" {
-    for_each = local.create_pre_signup || local.create_custom_auth ? [1] : []
+    for_each = local.create_pre_signup || local.create_pre_token_generation || local.create_custom_auth ? [1] : []
     content {
       pre_sign_up                    = local.create_pre_signup ? aws_lambda_function.pre_signup[0].arn : null
       define_auth_challenge          = local.create_custom_auth ? aws_lambda_function.custom_auth[0].arn : null
       create_auth_challenge          = local.create_custom_auth ? aws_lambda_function.custom_auth[0].arn : null
       verify_auth_challenge_response = local.create_custom_auth ? aws_lambda_function.custom_auth[0].arn : null
+      dynamic "pre_token_generation_config" {
+        for_each = local.create_pre_token_generation ? [1] : []
+        content {
+          lambda_arn     = aws_lambda_function.pre_token_generation[0].arn
+          lambda_version = "V2_0"
+        }
+      }
     }
   }
 
@@ -298,21 +439,108 @@ resource "aws_cognito_identity_provider" "google" {
   }
 
   attribute_mapping = {
-    email    = "email"
-    name     = "name"
-    username = "sub"
+    email          = "email"
+    email_verified = "email_verified"
+    name           = "name"
+    username       = "sub"
+  }
+}
+
+resource "aws_cognito_identity_provider" "microsoft_organizations" {
+  count         = local.create && var.microsoft_oauth_client_id != "" ? 1 : 0
+  user_pool_id  = aws_cognito_user_pool.main[0].id
+  provider_name = "MicrosoftOrganizations"
+  provider_type = "OIDC"
+
+  provider_details = {
+    client_id                 = var.microsoft_oauth_client_id
+    client_secret             = var.microsoft_oauth_client_secret
+    authorize_scopes          = "openid email profile"
+    oidc_issuer               = "https://login.microsoftonline.com/${lower(var.microsoft_oauth_tenant)}/v2.0"
+    attributes_request_method = "GET"
+  }
+
+  attribute_mapping = {
+    # Entra v2 does not guarantee an `email` claim for every work/school
+    # account. `preferred_username` is the supported sign-in hint and keeps
+    # Cognito's required email attribute populated as a stable normalized
+    # correlation value. ThinkWork only consults it after
+    # Cognito validates this exact Entra route; ongoing admission uses the
+    # immutable Cognito issuer/subject binding created by that first login.
+    email                    = "preferred_username"
+    name                     = "name"
+    username                 = "sub"
+    "custom:entra_tenant_id" = "tid"
+    "custom:entra_object_id" = "oid"
   }
 }
 
 locals {
   identity_providers = concat(
     var.google_oauth_client_id != "" ? ["Google"] : [],
+    var.microsoft_oauth_client_id != "" ? ["MicrosoftOrganizations"] : [],
     keys(local.oidc_identity_providers),
     keys(local.saml_identity_providers),
     ["COGNITO"]
   )
 }
 
+################################################################################
+# Route-specific public app clients
+################################################################################
+
+resource "aws_cognito_user_pool_client" "auth_route" {
+  for_each = local.create ? local.auth_routes : {}
+
+  name         = "Thinkwork-${title(each.value.client_family)}-${title(each.value.route_key)}"
+  user_pool_id = aws_cognito_user_pool.main[0].id
+
+  generate_secret                      = false
+  allowed_oauth_flows_user_pool_client = true
+  allowed_oauth_flows                  = ["code"]
+  allowed_oauth_scopes                 = ["openid", "email", "profile"]
+  explicit_auth_flows                  = each.value.explicit_auth_flows
+  supported_identity_providers         = each.value.provider_names
+  callback_urls                        = distinct(each.value.callback_urls)
+  logout_urls                          = distinct(each.value.logout_urls)
+  enable_token_revocation              = true
+  prevent_user_existence_errors        = "ENABLED"
+  access_token_validity                = 1
+  id_token_validity                    = 1
+  refresh_token_validity               = each.value.refresh_token_days
+
+  token_validity_units {
+    access_token  = "hours"
+    id_token      = "hours"
+    refresh_token = "days"
+  }
+
+  read_attributes = [
+    "email",
+    "email_verified",
+    "name",
+    "custom:tenant_id",
+    "custom:entra_tenant_id",
+    "custom:entra_object_id",
+  ]
+
+  write_attributes = [
+    "email",
+    "email_verified",
+    "name",
+    "custom:tenant_id",
+    "custom:entra_tenant_id",
+    "custom:entra_object_id",
+  ]
+
+  depends_on = [
+    aws_cognito_identity_provider.google,
+    aws_cognito_identity_provider.microsoft_organizations,
+    aws_cognito_identity_provider.oidc,
+    aws_cognito_identity_provider.saml,
+  ]
+}
+
 resource "aws_cognito_identity_provider" "oidc" {
   for_each = local.create ? local.oidc_identity_providers : {}
 
@@ -363,8 +591,8 @@ resource "aws_cognito_identity_provider" "saml" {
 ################################################################################
 
 resource "aws_cognito_user_pool_client" "admin" {
-  count        = local.create ? 1 : 0
-  name         = "ThinkworkAdmin"
+  count        = local.create && local.workos_rollback_enabled ? 1 : 0
+  name         = "ThinkworkAdminLegacy"
   user_pool_id = aws_cognito_user_pool.main[0].id
 
   allowed_oauth_flows_user_pool_client = true
@@ -380,8 +608,8 @@ resource "aws_cognito_user_pool_client" "admin" {
 
   supported_identity_providers = local.identity_providers
 
-  callback_urls = distinct(concat(var.admin_callback_urls, var.desktop_callback_urls))
-  logout_urls   = distinct(concat(var.admin_logout_urls, var.desktop_callback_urls))
+  callback_urls = distinct(concat(var.admin_callback_urls, var.desktop_callback_urls, var.cli_callback_urls))
+  logout_urls   = distinct(concat(var.admin_logout_urls, var.desktop_callback_urls, var.cli_logout_urls))
 
   access_token_validity  = 1
   id_token_validity      = 1
@@ -418,8 +646,8 @@ resource "aws_cognito_user_pool_client" "admin" {
 ################################################################################
 
 resource "aws_cognito_user_pool_client" "mobile" {
-  count        = local.create ? 1 : 0
-  name         = "ThinkworkMobile"
+  count        = local.create && local.workos_rollback_enabled ? 1 : 0
+  name         = "ThinkworkMobileLegacy"
   user_pool_id = aws_cognito_user_pool.main[0].id
 
   explicit_auth_flows = [
@@ -477,16 +705,25 @@ resource "aws_cognito_identity_pool" "main" {
   identity_pool_name               = var.identity_pool_name != "" ? var.identity_pool_name : "thinkwork-${var.stage}-identity-pool"
   allow_unauthenticated_identities = false
 
-  cognito_identity_providers {
-    client_id               = aws_cognito_user_pool_client.admin[0].id
-    provider_name           = "cognito-idp.${var.region}.amazonaws.com/${aws_cognito_user_pool.main[0].id}"
-    server_side_token_check = false
+  dynamic "cognito_identity_providers" {
+    for_each = local.workos_rollback_enabled ? {
+      admin  = aws_cognito_user_pool_client.admin[0].id
+      mobile = aws_cognito_user_pool_client.mobile[0].id
+    } : {}
+    content {
+      client_id               = cognito_identity_providers.value
+      provider_name           = "cognito-idp.${var.region}.amazonaws.com/${aws_cognito_user_pool.main[0].id}"
+      server_side_token_check = false
+    }
   }
 
-  cognito_identity_providers {
-    client_id               = aws_cognito_user_pool_client.mobile[0].id
-    provider_name           = "cognito-idp.${var.region}.amazonaws.com/${aws_cognito_user_pool.main[0].id}"
-    server_side_token_check = false
+  dynamic "cognito_identity_providers" {
+    for_each = aws_cognito_user_pool_client.auth_route
+    content {
+      client_id               = cognito_identity_providers.value.id
+      provider_name           = "cognito-idp.${var.region}.amazonaws.com/${aws_cognito_user_pool.main[0].id}"
+      server_side_token_check = true
+    }
   }
 
   tags = {
@@ -520,21 +757,6 @@ resource "aws_iam_role" "authenticated" {
   })
 }
 
-resource "aws_iam_role_policy" "authenticated_appsync" {
-  count = local.create ? 1 : 0
-  name  = "appsync-access"
-  role  = aws_iam_role.authenticated[0].id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = "appsync:GraphQL"
-      Resource = "*"
-    }]
-  })
-}
-
 resource "aws_cognito_identity_pool_roles_attachment" "main" {
   count            = local.create ? 1 : 0
   identity_pool_id = aws_cognito_identity_pool.main[0].id