unoverse 0.1.104 → 0.1.106

package/operator/ansible/playbooks/test-connectivity.yml

@@ -167,15 +167,28 @@
     # PACKAGES_PATH any more and docker-compose.yml has no such volume, so the check could
     # only ever report 0 and tell the operator to run a command that would not fix it.
 
+    # SINCE THE SERVICES RESTARTED, NOT SINCE FIVE MINUTES AGO.
+    #
+    # A first setup necessarily boots the services before the schema exists — migrations run
+    # THROUGH the unoverse container, so there is nothing to run them in until it is up — and
+    # db-setup restarts everything afterwards. A fixed five-minute window straddles that
+    # restart and reports the pre-migration errors as if they were current: every first
+    # deploy ended with 'relation "memories" does not exist' in red, describing a state that
+    # had already been fixed two minutes earlier by this very playbook.
+    #
+    # The question is "is anything wrong NOW", so the window starts when the services did.
     - name: "[12/14] Check for errors in service logs"
       shell: |
         cd /opt/gravity
-        ERRORS=$(docker compose logs --tail=50 --since=5m 2>&1 | grep -iE 'error|fatal|panic|does not exist|ECONNREFUSED' | grep -v 'NOGROUP' | tail -10)
+        # Newest container start: everything before it belongs to a previous run.
+        SINCE=$(docker compose ps -q 2>/dev/null | xargs -r docker inspect -f '{{.State.StartedAt}}' 2>/dev/null | sort | tail -1)
+        [ -n "$SINCE" ] || SINCE=5m
+        ERRORS=$(docker compose logs --tail=50 --since="$SINCE" 2>&1 | grep -iE 'error|fatal|panic|does not exist|ECONNREFUSED' | grep -v 'NOGROUP' | tail -10)
         if [ -n "$ERRORS" ]; then
           echo "$ERRORS"
           exit 1
         else
-          echo "No recent errors"
+          echo "No errors since the services started"
         fi
       register: log_errors
       ignore_errors: yes

package/operator/infra/aws/main.tf

@@ -109,6 +109,9 @@ locals {
   # no cert, the ALB speaks plain HTTP on its DNS name. Setting domain later and
   # re-applying upgrades the SAME ALB in place — ACM cert, HTTPS listener, redirect.
   has_domain = var.domain != ""
+  # Where a person actually goes. Shared by the invitation email and the canvas_url output
+  # so the address in the email can never drift from the address in the deploy summary.
+  canvas_entry = var.domain != "" ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001"
   api_host   = "api.${var.domain}"
   dns_auto   = local.has_domain && var.route53_zone_id != ""
 }
@@ -419,6 +422,31 @@ resource "aws_cognito_user_pool" "pool" {
       lambda_version = "V2_0"
     }
   }
+
+  # THE INVITATION HAS TO SAY WHERE TO GO. Cognito's default message is a username and a
+  # temporary password and no address: the first administrator of a brand new universe
+  # receives credentials for a login page they have never been told the name of, and the
+  # hosted UI URL is buried in a terraform output they have no reason to read.
+  #
+  # The domain is built from the same random_id the domain resource uses, so this can name
+  # the URL without depending on that resource and creating a cycle back to this pool.
+  admin_create_user_config {
+    allow_admin_create_user_only = true
+    invite_message_template {
+      # LINK TO THE APP, NOT TO COGNITO. The hosted sign-in page needs a client_id, and the
+      # client is created FROM this pool — referencing it here is a dependency cycle. Canvas
+      # is also simply the better destination: it redirects to Cognito itself, and the
+      # administrator ends up where they were trying to go rather than on a login screen with
+      # nowhere to land afterwards.
+      email_subject = "Your ${var.name} universe is ready"
+      email_message = <<-MSG
+        <p>Your universe is deployed, and this account administers it.</p>
+        <p><b>Open it:</b> <a href="${local.canvas_entry}">${local.canvas_entry}</a></p>
+        <p>Username: <b>{username}</b><br/>Temporary password: <b>{####}</b></p>
+        <p>You will be asked to choose a new password the first time you sign in.</p>
+      MSG
+    }
+  }
 }
 
 # Groups ARE the RBAC surface: membership becomes the `roles`/`permissions`

package/operator/infra/aws/outputs.tf

@@ -24,7 +24,7 @@ output "acm_validation_records" {
 
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the client origins."
-  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
+  value       = var.canvas_public ? local.canvas_entry : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
 }
 
 output "api_url" {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.104",
+  "version": "0.1.106",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",