Skip to content

Conversation

@queria
Copy link
Contributor

@queria queria commented Dec 10, 2025

When using the OpenAPI (rapidoc) web interface,
for obtaining token it uses /openapi/oauth-receiver.html as target for callback redirect.
(As can be seen also in common/infrastructure/src/app/http.rs#L607)

While Cognito requires each callback page to be specified by full URL,
having just domain or top-level url (as in console-url) is not enough.

So this adds the openapi endpoint directly to allowed CallbackURLs for the fronted client.

Summary by Sourcery

Enhancements:

  • Add the OpenAPI OAuth receiver HTML endpoint to the allowed callback URLs for the frontend Cognito user pool client in the Terraform SSO example configuration.

When using the OpenAPI (rapidoc) web interface, for obtaining token
it uses /openapi/oauth-receiver.html as target for callback redirect.
( as can be seen also in common/infrastructure/src/app/http.rs#L607 )

While Cognito requires each callback page to be specified by full URL,
having just domain or top-level url (as in console-url) is not enough.

So this adds the openapi endpoint directly to allowed CallbackURLs
for the fronted client.
@sourcery-ai
Copy link
Contributor

sourcery-ai bot commented Dec 10, 2025

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the Terraform configuration for the frontend Cognito user pool client so that the OpenAPI (RapiDoc) OAuth callback URL is explicitly whitelisted, ensuring token retrieval via the /openapi/oauth-receiver.html endpoint works correctly.

Sequence diagram for OpenAPI OAuth callback via Cognito

sequenceDiagram
  actor Developer
  participant Browser
  participant OpenAPI_UI as OpenAPI_RapiDoc_UI
  participant Cognito as AWS_Cognito
  participant OAuthReceiver as OpenAPI_OAuth_Receiver_Page

  Developer->>Browser: Open OpenAPI docs URL
  Browser->>OpenAPI_UI: Load OpenAPI UI
  Developer->>OpenAPI_UI: Click authorize to obtain token
  OpenAPI_UI->>Cognito: Redirect to Cognito authorize endpoint
  Developer->>Cognito: Authenticate via SSO
  Cognito-->>OAuthReceiver: Redirect to callback URL /openapi/oauth-receiver.html with tokens
  OAuthReceiver-->>OpenAPI_UI: Expose tokens to OpenAPI UI
  OpenAPI_UI-->>Developer: Authenticated API calls available
Loading

File-Level Changes

Change Details Files
Allow the OpenAPI OAuth callback page as a valid redirect URL for the frontend Cognito client.
  • Extend the aws_cognito_user_pool_client frontend resource callback_urls list to include the fully qualified /openapi/oauth-receiver.html path based on var.console-url
  • Keep existing console root and trailing-slash URLs intact to preserve current behaviour
docs/book/modules/admin/examples/trustify/sso.tf

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey there - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@codecov
Copy link

codecov bot commented Dec 10, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.22%. Comparing base (3d9314c) to head (beacea1).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #2178   +/-   ##
=======================================
  Coverage   68.22%   68.22%           
=======================================
  Files         376      376           
  Lines       21190    21190           
  Branches    21190    21190           
=======================================
+ Hits        14456    14457    +1     
+ Misses       5868     5862    -6     
- Partials      866      871    +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ctron ctron added this pull request to the merge queue Dec 11, 2025
Merged via the queue into guacsec:main with commit 545028c Dec 11, 2025
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants