[Alexanderamiri]

Why

The probe client (#174) showed that Cognito managed login forwards prompt=select_account to Google only when the request also sends identity_provider. auth-doctor.py always adds identity_provider, so an app that sends only prompt passed but would get no account chooser after the Google cutover (#175).

What

• New chooser check (WARN only): an app that renames auth variables via auth.env but doesn't alias COGNITO_IDENTITY_PROVIDER almost certainly doesn't send it. Apps that read the platform variables directly aren't flagged, since the doctor can't see their code.
• The authorize warning and the docstring explain the identity_provider requirement.

How verified

• python3 -m unittest discover -s scripts/tests: 133 tests, OK. There are 4 new tests: aliased without IdP warns, aliased with IdP passes, no aliases passes, and the probe names the IdP.
• python3 -m unittest discover -s terraform/lambda-src/tests: 219 tests, OK.
• Live against the current pool:
  • frosting's app.yaml on main gets WARN chooser.
  • The app.yaml from feat(auth): ask Google for the account chooser at sign-in frosting#258, which aliases COGNITO_IDENTITY_PROVIDER, passes with no warning.

Rollout

Script only, with no Terraform changes. App deploys pick it up from platform main.

🤖 Generated with Claude Code

[github-actions]

Terraform Plan

✅ No changes — infrastructure is up to date.

Plan output

Acquiring state lock. This may take a few moments...
aws_ssm_parameter.atlassian_org_id: Refreshing state... [id=/javabin/platform/atlassian-org-id]
aws_ssm_parameter.atlassian_api_key: Refreshing state... [id=/javabin/platform/atlassian-api-key]

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.