unoverse 0.1.107 → 0.1.109
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/operator/infra/aws/main.tf +10 -2
- package/package.json +1 -1
|
@@ -503,8 +503,16 @@ resource "aws_cognito_user_pool_client" "spa" {
|
|
|
503
503
|
allowed_oauth_flows_user_pool_client = true
|
|
504
504
|
allowed_oauth_flows = ["code"]
|
|
505
505
|
allowed_oauth_scopes = ["openid", "email", "profile"]
|
|
506
|
-
|
|
507
|
-
|
|
506
|
+
# THE APP'S OWN ADDRESS IS ALWAYS ALLOWED. This took the list verbatim, so setting a
|
|
507
|
+
# domain moved Canvas to https://canvas.<domain> and Cognito kept refusing that redirect
|
|
508
|
+
# as unknown — a login that fails with "redirect_mismatch" on a deployment where every
|
|
509
|
+
# other part is correct, fixed by editing a list nobody thinks to look at.
|
|
510
|
+
#
|
|
511
|
+
# canvas_entry is the same expression the invitation email and the canvas_url output use,
|
|
512
|
+
# so the address a person is sent to is by construction an address they may return to.
|
|
513
|
+
# Anything else in the variable (localhost for dev, a second front end) is kept.
|
|
514
|
+
callback_urls = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
|
|
515
|
+
logout_urls = distinct(concat([local.canvas_entry], var.oauth_callback_urls))
|
|
508
516
|
supported_identity_providers = ["COGNITO"]
|
|
509
517
|
}
|
|
510
518
|
|
package/package.json
CHANGED