[Alexanderamiri]

Why

Heroes whose browser is signed in to a personal Google account cannot pick their @java.no account (#157). The Google provider's authorize_url was meant to carry prompt=select_account, but Cognito drops the query string (describe-identity-provider returns the plain URL; every plan shows a perpetual diff), and the classic hosted UI ignores a prompt sent by apps. Managed login (domain ManagedLoginVersion 2) forwards prompt to the IdP, but it has no working sign-in page for an app client without a branding style.

This is PR 1 of 2 and changes no sign-in behaviour: it creates the branding styles, while the domain stays on the classic UI. PR 2 flips the domain.

What

• app-auth-sync: after the credentials, ensure_branding checks DescribeManagedLoginBrandingByClient and only if there is no style calls CreateManagedLoginBranding(UseCognitoProvidedValues=True). An existing style, default or customised, is never touched. ManagedLoginBrandingExistsException counts as already done. Every client delete path (request gone, pool switch, client_type change, orphan cleanup) now goes through delete_client, which deletes the style first. Reconcile, queued by platform CI after every apply, backfills existing clients, login-N slot clients included. auth-status gains branding: created|exists. A branding failure comes after the credentials are written, so a client that works on the classic UI is not held back, but the sync is still marked error and raises the alarm.
• IAM: the app-auth-sync role gets cognito-idp:{Create,DescribeManagedLoginBrandingByClient,Delete}ManagedLoginBranding, scoped to the internal and external pool ARNs.
• identity: the Google authorize_url is plain and google_authorize_url_params is removed (this ends the perpetual diff). New internal_managed_login_version (default 1, validated 1|2) is set on aws_cognito_user_pool_domain.internal. The external pool's domains are unchanged and stay classic. Its clients get styles too, so it could move later with the same one-line change.
• service-routing: ALB authenticate_oidc rules on the internal pool send authentication_request_extra_params = { prompt = "select_account" }.
• generate-modules: internal-pool apps with a client get COGNITO_EXTRA_AUTH_PARAMS=prompt=select_account (it can be aliased via auth.env). auth-doctor sends the same parameters in its authorize probe.
• Docs: in cognito-google-setup.md, the "fallback" is replaced by the actual setup in step 3, with the order, a check loop and the probe. The cutover steps are kept. app-yaml-reference.md gets the new env var and an "Account chooser" section (oidc-client-ts / Spring / Auth.js snippets). lambda-functions.md documents the branding.

Terraform-managed clients: none exist (aws_cognito_user_pool_client is not used anywhere in Terraform), so Terraform creates no branding. aws_cognito_managed_login_branding also only exists in AWS provider 6.x, and the platform pins ~> 5.0.

How verified

• python3 -m unittest discover -s terraform/lambda-src/tests: 214 OK. The new ManagedLoginBrandingTest covers: create; slot client; a customised style is kept; reconcile backfill; the concurrent-create race; delete, orphan, pool-switch and type-change cleanup; a branding failure after the credentials are written.
• python3 -m unittest discover -s scripts/tests: 129 OK, with new generate-modules and auth-doctor tests.
• terraform fmt -check -recursive terraform, plus terraform validate on terraform/platform and terraform/modules/service-routing (aws provider 5.100.0, which has managed_login_version).
• Live, read-only (eu-central-1):
  • Internal domain javabin-internal: ManagedLoginVersion 1. External: 1.
  • Both pools are on the ESSENTIALS tier.
  • The internal pool has one client, cupcake-cupcake, and no login-N clients. The only /auth request is cupcake's.
  • cupcake-cupcake already has a style, created manually on 2026-10-24 with UseCognitoProvidedValues=false. This PR keeps it.
  • Google authorize_url live is plain .../v2/auth.
  • The classic UI answers /oauth2/authorize?...&prompt=select_account exactly as it does without the parameter (302 to the SAML IdP), so sending prompt before PR 2 is harmless.

Rollout

1. Merge this PR. The plan should show updates only: the Google IdP authorize_url (the perpetual diff, now gone), the app-auth-sync Lambda code and IAM policy, and no change to aws_cognito_user_pool_domain.internal (it is already version 1). After the apply, the CI reconcile creates the missing styles. Check with the loop in docs/cognito-google-setup.md step 3.
2. PR 2 (stacked): internal_managed_login_version = 2. This is an in-place update of the domain.
3. Apps: frosting adds prompt: 'select_account' (separate PR in javaBin/frosting). ALB sign-in apps get the parameter on their next deploy that picks up the module.
4. The IdP cutover (["Google"]) is a separate draft PR.

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 2 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.lambdas.aws_iam_role_policy.app_auth_sync will be updated in-place
  ~ resource "aws_iam_role_policy" "app_auth_sync" {
        id     = "javabin-app-auth-sync:javabin-app-auth-sync"
        name   = "javabin-app-auth-sync"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    {
                        Action   = [
                            "cognito-idp:CreateUserPoolClient",
                            "cognito-idp:UpdateUserPoolClient",
                            "cognito-idp:DeleteUserPoolClient",
                            "cognito-idp:DescribeUserPoolClient",
                            "cognito-idp:ListUserPoolClients",
                            "cognito-idp:ListIdentityProviders",
                        ]
                        Effect   = "Allow"
                        Resource = [
                            "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_Icikv3dtD",
                            "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_gdFOsE4EM",
                        ]
                        Sid      = "ManageAppClients"
                    },
                  + {
                      + Action   = [
                          + "cognito-idp:CreateManagedLoginBranding",
                          + "cognito-idp:DescribeManagedLoginBrandingByClient",
                          + "cognito-idp:DeleteManagedLoginBranding",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_Icikv3dtD",
                          + "arn:aws:cognito-idp:eu-central-1:553637109631:userpool/eu-central-1_gdFOsE4EM",
                        ]
                      + Sid      = "ManageAppClientBranding"
                    },
                    {
                        Action   = "cognito-idp:ListUserPools"
                        Effect   = "Allow"
                        Resource = "*"
                        Sid      = "FindPools"
                    },
                    # (3 unchanged elements hidden)
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

  # module.lambdas.aws_lambda_function.app_auth_sync will be updated in-place
  ~ resource "aws_lambda_function" "app_auth_sync" {
        id                             = "javabin-app-auth-sync"
      ~ last_modified                  = "2026-10-26T14:01:56.000+0000" -> (known after apply)
      ~ source_code_hash               = "GvhzSxolQGY8f4/fMAxElLFmKIXk8607SS3v89Em3x4=" -> "HKStd1VAWlTHRUFr+guun1HqV1RHui7nc1qw1cRONzY="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟡 MEDIUM

In-place update of the app-auth-sync Lambda's code and its IAM role policy, adding Cognito managed login branding permissions on the two existing user pools; no creates or destroys.