thinkwork-cli 0.13.1 → 1.0.0

package/dist/terraform/modules/foundation/cognito/variables.tf

@@ -128,6 +128,51 @@ variable "google_oauth_client_secret" {
   default     = ""
 }
 
+variable "microsoft_oauth_client_id" {
+  description = "Microsoft Entra application client ID for the default tenant-specific OIDC route"
+  type        = string
+  default     = ""
+}
+
+variable "microsoft_oauth_client_secret" {
+  description = "Microsoft Entra application client secret for the default tenant-specific OIDC route"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "microsoft_oauth_tenant" {
+  description = "Microsoft Entra directory GUID used to build the exact OIDC issuer for the default Microsoft route"
+  type        = string
+  default     = ""
+
+  validation {
+    condition     = var.microsoft_oauth_tenant == "" || contains(["common", "organizations", "consumers"], var.microsoft_oauth_tenant) || can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", var.microsoft_oauth_tenant))
+    error_message = "microsoft_oauth_tenant must be an Entra directory GUID or one of the Cognito-supported aliases: common, organizations, consumers."
+  }
+}
+
+variable "tenant_entra_connections" {
+  description = "Safe metadata for tenant-specific Entra OIDC providers reconciled before Terraform creates their route clients. Contains no upstream secret values."
+  type = list(object({
+    connection_key = string
+    tenant_id      = string
+    provider_name  = string
+    display_name   = string
+  }))
+  default = []
+
+  validation {
+    condition = alltrue([
+      for connection in var.tenant_entra_connections :
+      can(regex("^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$", connection.tenant_id)) &&
+      can(regex("^Entra_[a-f0-9]{16}_[a-f0-9]{8}$", connection.provider_name)) &&
+      connection.connection_key != "" && connection.display_name != ""
+    ])
+    error_message = "Every tenant Entra connection must use a GUID tenant_id, a deterministic Entra_<tenant>_<hash> provider name, and non-empty safe labels."
+  }
+}
+
 variable "oidc_identity_providers" {
   description = "Additional Cognito OIDC identity providers. Secrets should be sourced from Secrets Manager/SSM by the caller, not committed to tfvars."
   type = list(object({
@@ -170,26 +215,55 @@ variable "pre_signup_lambda_zip" {
   default     = ""
 }
 
+variable "auth_retirement_phase" {
+  description = "Native-auth migration phase. Fresh deployments default to retired; coexistence/cutover are explicit upgrade-only rollback states."
+  type        = string
+  default     = "retired"
+
+  validation {
+    condition     = contains(["coexistence", "cutover", "retired"], var.auth_retirement_phase)
+    error_message = "auth_retirement_phase must be coexistence, cutover, or retired."
+  }
+}
+
 variable "custom_auth_lambda_zip" {
-  description = "Path to the Cognito custom-auth challenge Lambda zip file"
+  description = "Local Cognito custom-auth rollback Lambda artifact used only before the retired phase."
   type        = string
   default     = ""
 }
 
 variable "custom_auth_lambda_s3_bucket" {
-  description = "S3 bucket containing the Cognito custom-auth challenge Lambda release artifact"
+  description = "S3 bucket containing the Cognito custom-auth rollback Lambda artifact."
   type        = string
   default     = ""
 }
 
 variable "custom_auth_lambda_s3_key" {
-  description = "S3 key for the Cognito custom-auth challenge Lambda release artifact"
+  description = "S3 key for the Cognito custom-auth rollback Lambda artifact."
   type        = string
   default     = ""
 }
 
+variable "pre_token_generation_lambda_s3_bucket" {
+  description = "S3 bucket containing the Cognito pre-token client-deny Lambda release artifact"
+  type        = string
+  default     = ""
+}
+
+variable "pre_token_generation_lambda_s3_key" {
+  description = "S3 key for the Cognito pre-token client-deny Lambda release artifact"
+  type        = string
+  default     = ""
+}
+
+variable "denied_app_client_ids" {
+  description = "Cognito app clients denied new and refresh token issuance during auth cutover"
+  type        = list(string)
+  default     = []
+}
+
 variable "api_auth_secret" {
-  description = "Shared signing secret used by the custom-auth challenge Lambda"
+  description = "Shared signing secret used by the pre-retirement custom-auth rollback Lambda"
   type        = string
   sensitive   = true
   default     = ""
@@ -205,6 +279,8 @@ variable "admin_callback_urls" {
   default = [
     "http://localhost:5174",
     "http://localhost:5174/auth/callback",
+    "http://127.0.0.1:5174",
+    "http://127.0.0.1:5174/auth/callback",
     "http://127.0.0.1:42010/callback",
     "http://localhost:42010/callback",
   ]
@@ -215,19 +291,65 @@ variable "admin_logout_urls" {
   type        = list(string)
   default = [
     "http://localhost:5174",
+    "http://127.0.0.1:5174",
   ]
 }
 
-variable "desktop_callback_urls" {
-  description = "OAuth callback and logout URLs for the desktop client that reuses the ThinkworkAdmin public Cognito client."
+variable "cli_callback_urls" {
+  description = "OAuth loopback callbacks reserved for the CLI client family."
   type        = list(string)
   default = [
-    "thinkwork://oauth/callback",
-    "thinkwork-dev://oauth/callback",
-    "thinkwork-canary://oauth/callback",
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
+  ]
+}
+
+variable "cli_logout_urls" {
+  description = "OAuth loopback logout destinations reserved for the CLI client family."
+  type        = list(string)
+  default = [
+    "http://127.0.0.1:42010/callback",
+    "http://localhost:42010/callback",
   ]
 }
 
+# ---------------------------------------------------------------------------
+# Company Brain console client (U13 — ship-inert, default off)
+# ---------------------------------------------------------------------------
+
+variable "console_client_enabled" {
+  description = "Create the optional Company Brain console app client. Default false = no client, console_client_id output is null (ship-inert until Eric reviews the console app)."
+  type        = bool
+  default     = false
+}
+
+variable "console_callback_urls" {
+  description = "OAuth callback URLs for the console client. MUST include the console's CloudFront/custom-domain URL BEFORE first login — Cognito rejects unregistered origins with redirect_mismatch. Required non-empty when console_client_enabled."
+  type        = list(string)
+  default     = []
+}
+
+variable "console_logout_urls" {
+  description = "OAuth logout URLs for the console client"
+  type        = list(string)
+  default     = []
+}
+
+variable "existing_auth_route_clients" {
+  description = "Safe route-client manifest when using a BYO Cognito pool. Keys use <family>:<route>."
+  type = map(object({
+    client_id           = string
+    route_key           = string
+    client_family       = string
+    provider_names      = list(string)
+    explicit_auth_flows = list(string)
+    callback_urls       = list(string)
+    logout_urls         = list(string)
+    lifecycle_state     = string
+  }))
+  default = {}
+}
+
 variable "mobile_callback_urls" {
   description = "OAuth callback URLs for the mobile client. Host apps that embed the SDK register their own deep-link here. Proper per-host app client isolation is 0.3.0 work — this is the stopgap capture of the drift from the CLI-applied URIs."
   type        = list(string)

package/dist/terraform/modules/thinkwork/README.md

@@ -56,7 +56,11 @@ feature flags:
 | `customer_domain`                | `""`    | Customer-namespace domain (e.g. `tei.thinkwork.ai`). Empty = skip. |
 | `customer_domain_delegated`      | `false` | Phase-two gate — flip once NS delegation resolves.                 |
 | `customer_domain_legacy_retired` | `false` | Retirement gate — removes legacy Cognito callbacks after cutover.  |
-| `enable_hindsight`               | `true`  | Provisions Hindsight canonical user and Space memory.              |
+| `enable_hindsight`               | `false` | Deprecated no-op (THINK-407) — accepted and ignored.               |
+| `deployment_runner_in_vpc`       | `false` | Deployment runner CodeBuild runs in the VPC; DB access by security group (turns on NAT). See `modules/app/deployment-control-plane/README.md`. |
+| `api_lambdas_in_vpc`             | `false` | Every DB-connected Lambda (api handlers, agentcore-admin, Pi, broker) runs in the VPC behind `thinkwork-<stage>-api-lambda-sg`; DB access by security group (turns on NAT). See `modules/app/deployment-control-plane/README.md`, "Closing the database port". |
+| `db_publicly_accessible`         | `true`  | Aurora public endpoint. `false` only after the Lambdas and runner are in the VPC. |
+| `db_public_ingress_cidrs`        | `["0.0.0.0/0"]` | tcp/5432 CIDR ingress seeded on a new DB security group; `[]` = none. Does not revoke a live rule (the group ignores ingress drift). |
 | `www_domain`                     | `""`    | Public website apex domain. Empty = CloudFront URL only.           |
 
 ## Outputs