[Alexanderamiri]

Why

Heroes whose browser is signed in to a personal Google account cannot switch to their @java.no account at sign-in (javaBin/platform#157). The platform now asks apps on the internal pool to send prompt=select_account (COGNITO_EXTRA_AUTH_PARAMS, javaBin/platform#170).

What

extraQueryParams: { prompt: "select_account" } on the oidc-client-ts UserManager, so it goes with every signinRedirect to Cognito's /oauth2/authorize.

How verified

• pnpm lint and pnpm typecheck pass.
• Live: Cognito's classic hosted UI answers /oauth2/authorize?...&prompt=select_account exactly as it does without the parameter (302 to the IdP), so this is safe to merge before the platform change.

Rollout

Safe to merge any time. It takes effect once the platform's internal pool domain is on managed login (javaBin/platform#171) and the pool signs in with the Google provider (javaBin/platform#172). Sign-in behaviour does not change before then.

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 5 to add, 1 to change, 0 to destroy.

Plan output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place

Terraform will perform the following actions:

  # module.network.aws_security_group.tasks will be created
  + resource "aws_security_group" "tasks" {
      + arn                    = (known after apply)
      + description            = "ECS tasks of cupcake-cupcake; peer rules are managed by javabin-app-peers-sync"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = (known after apply)
      + name                   = "cupcake-cupcake-tasks"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = true
      + tags                   = {
          + "Name"            = "cupcake-cupcake-tasks"
          + "javabin-network" = "app"
        }
      + tags_all               = {
          + "Name"            = "cupcake-cupcake-tasks"
          + "environment"     = "production"
          + "javabin-network" = "app"
          + "managed-by"      = "terraform"
          + "repo"            = "javaBin/frosting"
          + "service"         = "cupcake"
          + "team"            = "cupcake"
        }
      + vpc_id                 = "vpc-0cd3502de2527a310"
    }

  # module.network.aws_service_discovery_service.this will be created
  + resource "aws_service_discovery_service" "this" {
      + arn           = (known after apply)
      + force_destroy = true
      + id            = (known after apply)
      + name          = "cupcake-cupcake"
      + namespace_id  = (known after apply)
      + tags_all      = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + type          = (known after apply)

      + dns_config {
          + namespace_id   = "ns-4qfb7mei2fit4q4b"
          + routing_policy = "MULTIVALUE"

          + dns_records {
              + ttl  = 10
              + type = "A"
            }
        }

      + health_check_custom_config {
          + failure_threshold = 1
        }
    }

  # module.network.aws_ssm_parameter.network will be created
  + resource "aws_ssm_parameter" "network" {
      + arn            = (known after apply)
      + data_type      = (known after apply)
      + description    = "App-to-app request for cupcake-cupcake — read by the platform app-peers-sync Lambda"
      + has_value_wo   = (known after apply)
      + id             = (known after apply)
      + insecure_value = (known after apply)
      + key_id         = (known after apply)
      + name           = "/javabin/apps/cupcake/cupcake/network"
      + tags_all       = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + tier           = (known after apply)
      + type           = "String"
      + value          = (sensitive value)
      + version        = (known after apply)
    }

  # module.network.aws_vpc_security_group_egress_rule.all will be created
  + resource "aws_vpc_security_group_egress_rule" "all" {
      + arn                    = (known after apply)
      + cidr_ipv4              = "0.0.0.0/0"
      + description            = "All outbound"
      + id                     = (known after apply)
      + ip_protocol            = "-1"
      + security_group_id      = (known after apply)
      + security_group_rule_id = (known after apply)
      + tags_all               = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
    }

  # module.network.aws_vpc_security_group_ingress_rule.alb[0] will be created
  + resource "aws_vpc_security_group_ingress_rule" "alb" {
      + arn                          = (known after apply)
      + description                  = "ALB to the app port"
      + from_port                    = 3000
      + id                           = (known after apply)
      + ip_protocol                  = "tcp"
      + referenced_security_group_id = "sg-061000c0fa68a41b7"
      + security_group_id            = (known after apply)
      + security_group_rule_id       = (known after apply)
      + tags_all                     = {
          + "environment" = "production"
          + "managed-by"  = "terraform"
          + "repo"        = "javaBin/frosting"
          + "service"     = "cupcake"
          + "team"        = "cupcake"
        }
      + to_port                      = 3000
    }

  # module.service.aws_ecs_service.this will be updated in-place
  ~ resource "aws_ecs_service" "this" {
        id                                 = "arn:aws:ecs:eu-central-1:553637109631:service/javabin-platform/cupcake-cupcake"
        name                               = "cupcake-cupcake"
        tags                               = {}
        # (17 unchanged attributes hidden)

      ~ network_configuration {
          ~ security_groups  = [
              - "sg-0df9a0a3a22548c62",
            ] -> (known after apply)
            # (2 unchanged attributes hidden)
        }

      + service_registries {
          + registry_arn = (known after apply)
        }

        # (3 unchanged blocks hidden)
    }

Plan: 5 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟡 MEDIUM

Creates 5 networking/discovery resources for the cupcake-cupcake app (security group, ingress/egress rules, Cloud Map service, SSM parameter) and updates the ECS service to replace its security group with a new one, with 0 destroys.

• 🔒 [security] The ECS service's network_configuration drops security group sg-0df9a0a3a22548c62 and (after apply) will use the new cupcake-cupcake-tasks SG. Confirm the old SG is not referenced by other resources or peer rules, and that the new SG is the intended replacement, since the task's effective network access changes on apply.
• 🔒 [security] New SG has an all-outbound rule (0.0.0.0/0, protocol -1) and one ingress rule allowing TCP 3000 only from the ALB security group sg-061000c0fa68a41b7. No internet-open ingress is added. Peer ingress rules are managed externally by javabin-app-peers-sync, so ingress from other apps will be added outside this plan.
• 🔒 [security] SSM parameter /javabin/apps/cupcake/cupcake/network is a plain String whose value is sensitive; it is consumed by the platform app-peers-sync Lambda. Value is network routing info rather than a secret, but confirm it does not contain credentials.
• 💰 [cost] No new billable resources of significant cost (no NAT gateway, RDS, or load balancer). Cloud Map service and SSM standard parameter have negligible cost.
• ✅ [routine] Cloud Map service with force_destroy=true and A-record MULTIVALUE DNS config in namespace ns-4qfb7mei2fit4q4b; the ECS service gains a service_registries block pointing to it. Routine service-discovery wiring, no destruction.