Conversation
- Split first/last name (given_name/family_name) on sign-up and account page; keep combined `name` for JWT claim compatibility - New PhoneInput component (+XX code input + formatted local number, E.164 output) used on sign-up, account page, and forgot-email phone step - Forgot flow: searchAccount icon on choice screen, chatVerify on phone step, envelopVerifyEmail on email code steps — all with in-reveal → hover animation - Sign-in: move "Forgot something?" above submit button - SecurityInfo tilt reduced from 4 → 1.5 - Header: swap "Building Better Algorithms" → "B.B.A." at ≤52rem - Infra: add given_name/family_name schema to Cognito user pool (forces pool replacement) - Backend: fix smart-quote syntax error in schema.ts; add findEmailByPhone mutation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The existing DEV pool has only verified_email in account recovery, causing Cognito to reject SetUserPoolMfaConfig with email_mfa_configuration. A fresh pool created with all settings at once (including verified_phone_number recovery) accepts the config. Uses replace_triggered_by to trigger recreation on next apply. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The terraform_data resource now exists in state; changing its value triggers replace_triggered_by on the user pool, forcing destroy+create so the new pool is created with all settings at once (fixing the email MFA config constraint). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Email OTP MFA requires SES (DEVELOPER sending account) which Cognito rejects on COGNITO_DEFAULT. Switching to OPTIONAL: users without TOTP enrolled sign in with email+password only; users who enroll TOTP in settings get the TOTP challenge. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Routes all Cognito SMS (phone verify, MFA codes) through the existing GraphQL Lambda + Twilio REST API instead of SNS, avoiding the US carrier registration requirement. One shared KMS key across all environments ($1/month vs $3/month). - backend/src/smsSender.ts: decrypt Cognito OTP via KMS, deliver via Twilio - backend/src/handler.ts: detect CustomSMSSender_* trigger and route accordingly - infra/auth.tf: KMS key (dev-only, shared alias), lambda_config on user pool - infra/backend.tf: KMS decrypt + SSM Twilio read permissions on Lambda role - infra/secrets.tf + variables.tf: Twilio Account SID, Auth Token, from-number - deploy workflows: pass TWILIO_* GitHub secrets as TF_VAR_* to Terraform Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Cognito lambda_config referenced aws_lambda_function.graphql.arn while Lambda env vars referenced Cognito pool/client IDs, creating a cycle. Use a computed ARN string for lambda_config to remove the TF dependency. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ZAP baseline action tries to create a GitHub Issue with scan results; without issues:write permission the step errors even when fail_action=false. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Cognito encrypts the OTP with the AWS Encryption SDK (not raw KMS), so KMSClient.DecryptCommand throws InvalidCiphertextException. Switch to @aws-crypto/client-node with a KmsKeyringNode. The KMS key ARN is now passed to the Lambda as COGNITO_SMS_KEY_ARN env var set by Terraform. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add COEP (unsafe-none) and COOP headers to CloudFront security policy - Create .zap/rules.tsv to acknowledge accepted findings: Server header (CloudFront, uncontrollable), CSP unsafe-eval (Google Charts required), non-storable index.html (intentional), timestamps in Vite bundles, third-party JS comments, Modern Web App informational - Checkout repo before ZAP so rules file is available to the scanner - Fix artifact name (zap-scan-dev / zap-scan-qa, dash not underscore) - Add continue-on-error on ZAP step since fail_action=false already Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add PhoneConsentForm step after email verification — shows TCPA/CTIA disclosure, acknowledgement checkbox, and Verify/Verify later button. No SMS sent until user explicitly acknowledges and clicks Verify. - Add optional totpEnroll step post-phone-consent so new users can set up their authenticator app (or skip to settings later). - Add email OTP as MFA fallback: email_mfa_configuration on Cognito pool + bump recreate trigger so pool is rebuilt with both TOTP and email MFA. Users with TOTP now see a SELECT_MFA_TYPE choice on sign-in. - Remove broken "Use email instead" button that called confirmSignIn against an active TOTP challenge (Cognito rejected it as invalid code). - Fix SmsConsent modal transparency: render via createPortal to escape the auth card's 3-D transform stacking context. Widen to 52rem. - Ignore backend/scripts/test-*.ts (local Twilio debug scripts). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.