unoverse 0.1.105 → 0.1.107

package/operator/infra/aws/main.tf

@@ -109,6 +109,9 @@ locals {
   # no cert, the ALB speaks plain HTTP on its DNS name. Setting domain later and
   # re-applying upgrades the SAME ALB in place — ACM cert, HTTPS listener, redirect.
   has_domain = var.domain != ""
+  # Where a person actually goes. Shared by the invitation email and the canvas_url output
+  # so the address in the email can never drift from the address in the deploy summary.
+  canvas_entry = var.domain != "" ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001"
   api_host   = "api.${var.domain}"
   dns_auto   = local.has_domain && var.route53_zone_id != ""
 }
@@ -419,6 +422,35 @@ resource "aws_cognito_user_pool" "pool" {
       lambda_version = "V2_0"
     }
   }
+
+  # THE INVITATION HAS TO SAY WHERE TO GO. Cognito's default message is a username and a
+  # temporary password and no address: the first administrator of a brand new universe
+  # receives credentials for a login page they have never been told the name of, and the
+  # hosted UI URL is buried in a terraform output they have no reason to read.
+  #
+  # The domain is built from the same random_id the domain resource uses, so this can name
+  # the URL without depending on that resource and creating a cycle back to this pool.
+  admin_create_user_config {
+    allow_admin_create_user_only = true
+    invite_message_template {
+      # LINK TO THE APP, NOT TO COGNITO. The hosted sign-in page needs a client_id, and the
+      # client is created FROM this pool — referencing it here is a dependency cycle. Canvas
+      # is also simply the better destination: it redirects to Cognito itself, and the
+      # administrator ends up where they were trying to go rather than on a login screen with
+      # nowhere to land afterwards.
+      # SMS IS REQUIRED EVEN WHEN ONLY EMAIL IS USED. Cognito validates the whole template:
+      # omit sms_message and UpdateUserPool rejects it for an empty value that must be at
+      # least six characters. It must contain {username} and {####} or the API refuses it.
+      sms_message   = "Your ${var.name} universe: {username}, temporary password {####}"
+      email_subject = "Your ${var.name} universe is ready"
+      email_message = <<-MSG
+        <p>Your universe is deployed, and this account administers it.</p>
+        <p><b>Open it:</b> <a href="${local.canvas_entry}">${local.canvas_entry}</a></p>
+        <p>Username: <b>{username}</b><br/>Temporary password: <b>{####}</b></p>
+        <p>You will be asked to choose a new password the first time you sign in.</p>
+      MSG
+    }
+  }
 }
 
 # Groups ARE the RBAC surface: membership becomes the `roles`/`permissions`

package/operator/infra/aws/outputs.tf

@@ -24,7 +24,7 @@ output "acm_validation_records" {
 
 output "canvas_url" {
   description = "Public Canvas URL (canvas_public = true only) — add it to the client origins."
-  value       = var.canvas_public ? (local.has_domain ? "https://canvas.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
+  value       = var.canvas_public ? local.canvas_entry : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
 }
 
 output "api_url" {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.105",
+  "version": "0.1.107",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",