unoverse 0.1.106 → 0.1.108

package/operator/infra/aws/main.tf

@@ -438,6 +438,10 @@ resource "aws_cognito_user_pool" "pool" {
       # is also simply the better destination: it redirects to Cognito itself, and the
       # administrator ends up where they were trying to go rather than on a login screen with
       # nowhere to land afterwards.
+      # SMS IS REQUIRED EVEN WHEN ONLY EMAIL IS USED. Cognito validates the whole template:
+      # omit sms_message and UpdateUserPool rejects it for an empty value that must be at
+      # least six characters. It must contain {username} and {####} or the API refuses it.
+      sms_message   = "Your ${var.name} universe: {username}, temporary password {####}"
       email_subject = "Your ${var.name} universe is ready"
       email_message = <<-MSG
         <p>Your universe is deployed, and this account administers it.</p>
@@ -499,8 +503,16 @@ resource "aws_cognito_user_pool_client" "spa" {
   allowed_oauth_flows_user_pool_client = true
   allowed_oauth_flows                  = ["code"]
   allowed_oauth_scopes                 = ["openid", "email", "profile"]
-  callback_urls                        = var.oauth_callback_urls
-  logout_urls                          = var.oauth_callback_urls
+  # THE APP'S OWN ADDRESS IS ALWAYS ALLOWED. This took the list verbatim, so setting a
+  # domain moved Canvas to https://canvas.<domain> and Cognito kept refusing that redirect
+  # as unknown — a login that fails with "redirect_mismatch" on a deployment where every
+  # other part is correct, fixed by editing a list nobody thinks to look at.
+  #
+  # canvas_entry is the same expression the invitation email and the canvas_url output use,
+  # so the address a person is sent to is by construction an address they may return to.
+  # Anything else in the variable (localhost for dev, a second front end) is kept.
+  callback_urls                        = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
+  logout_urls                          = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
   supported_identity_providers         = ["COGNITO"]
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.106",
+  "version": "0.1.108",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",