Merged in feature/cognito-shared-environments (pull request #211)

cognito and permit shared prod environment support

* code complete

* user creattion tool

test harness

api/queryAPI/adminHandlers.go

@@ -115,9 +115,10 @@ func (ctrl *Controllers) CreateAdminUser(ctx echo.Context) error {
 
 	// Prepare user attributes
 	userAttrs := usermanagement.UserAttributes{
-		Email:     string(req.Email),
-		FirstName: req.FirstName,
-		LastName:  req.LastName,
+		Email:         string(req.Email),
+		FirstName:     req.FirstName,
+		LastName:      req.LastName,
+		EnvironmentID: ctrl.getCognitoEnvironmentID(),
 	}
 
 	// Check if user already exists
@@ -347,6 +348,13 @@ func (ctrl *Controllers) GetAdminUser(ctx echo.Context, email UserEmail) error {
 		})
 	}
 
+	// Check environment ownership - return 404 for users in other environments
+	if err := checkUserEnvironmentOwnership(cognitoUser, ctrl.getCognitoEnvironmentID()); err != nil {
+		return ctx.JSON(http.StatusNotFound, ErrorMessage{
+			Message: fmt.Sprintf("User not found: %s", email),
+		})
+	}
+
 	// Get user roles from Permit.io
 	httpClient := &http.Client{Timeout: 10 * time.Second}
 	permitConfig := ctrl.getPermitConfig()
@@ -401,7 +409,7 @@ func (ctrl *Controllers) CheckAdminUserExists(ctx echo.Context, email UserEmail)
 	}
 
 	// Check if user exists in Cognito (use GetCognitoUser to get detailed error info)
-	_, err = usermanagement.GetCognitoUser(context.Background(), cognitoClient, cognitoConfig.UserPoolID, string(email))
+	cognitoUser, err := usermanagement.GetCognitoUser(context.Background(), cognitoClient, cognitoConfig.UserPoolID, string(email))
 	if err != nil {
 		errInfo := usermanagement.ClassifyCognitoError(err, string(email))
 		// For HEAD requests, we can only return status code and headers
@@ -410,6 +418,11 @@ func (ctrl *Controllers) CheckAdminUserExists(ctx echo.Context, email UserEmail)
 		return ctx.NoContent(errInfo.HTTPStatus)
 	}
 
+	// Check environment ownership - return 404 for users in other environments
+	if err := checkUserEnvironmentOwnership(cognitoUser, ctrl.getCognitoEnvironmentID()); err != nil {
+		return ctx.NoContent(http.StatusNotFound)
+	}
+
 	return ctx.NoContent(http.StatusOK)
 }
 
@@ -461,9 +474,12 @@ func (ctrl *Controllers) ListAdminUsers(ctx echo.Context, params ListAdminUsersP
 		})
 	}
 
+	// Apply environment filtering when COGNITO_ENVIRONMENT_ID is configured
+	filteredUsers := usermanagement.FilterUsersByEnvironmentID(result.Users, ctrl.getCognitoEnvironmentID())
+
 	// Convert to AdminUserDetails format
-	users := make([]AdminUserDetails, 0, len(result.Users))
-	for _, cognitoUser := range result.Users {
+	users := make([]AdminUserDetails, 0, len(filteredUsers))
+	for _, cognitoUser := range filteredUsers {
 		userDetail := AdminUserDetails{
 			CognitoSubjectId: cognitoUser.SubjectID,
 			Email:            types.Email(cognitoUser.Email),
@@ -711,6 +727,13 @@ func (ctrl *Controllers) UpdateAdminUser(ctx echo.Context, email UserEmail) erro
 		})
 	}
 
+	// Check environment ownership - return 404 for users in other environments
+	if err := checkUserEnvironmentOwnership(cognitoUser, ctrl.getCognitoEnvironmentID()); err != nil {
+		return ctx.JSON(http.StatusNotFound, ErrorMessage{
+			Message: fmt.Sprintf("User not found: %s", email),
+		})
+	}
+
 	// Update user attributes in Cognito if provided
 	err = ctrl.updateUserAttributesInCognito(ctx, cognitoClient, cognitoConfig, email, req, adminUser, cognitoUser)
 	if err != nil {
@@ -818,6 +841,13 @@ func (ctrl *Controllers) DeleteAdminUser(ctx echo.Context, email UserEmail, para
 		})
 	}
 
+	// Check environment ownership - return 404 for users in other environments
+	if err := checkUserEnvironmentOwnership(cognitoUser, ctrl.getCognitoEnvironmentID()); err != nil {
+		return ctx.JSON(http.StatusNotFound, ErrorMessage{
+			Message: fmt.Sprintf("User not found: %s", email),
+		})
+	}
+
 	// Delete user from Cognito
 	cognitoDeleted := false
 	err = usermanagement.DeleteCognitoUser(context.Background(), cognitoClient, cognitoConfig.UserPoolID, string(email))
@@ -952,6 +982,13 @@ func (ctrl *Controllers) DisableAdminUser(ctx echo.Context, email UserEmail) err
 		})
 	}
 
+	// Check environment ownership - return 404 for users in other environments
+	if err := checkUserEnvironmentOwnership(cognitoUser, ctrl.getCognitoEnvironmentID()); err != nil {
+		return ctx.JSON(http.StatusNotFound, ErrorMessage{
+			Message: fmt.Sprintf("User not found: %s", email),
+		})
+	}
+
 	// Disable user in Cognito
 	err = usermanagement.DisableCognitoUser(context.Background(), cognitoClient, cognitoConfig.UserPoolID, string(email))
 	if err != nil {
@@ -1056,6 +1093,13 @@ func (ctrl *Controllers) EnableAdminUser(ctx echo.Context, email UserEmail) erro
 		})
 	}
 
+	// Check environment ownership - return 404 for users in other environments
+	if err := checkUserEnvironmentOwnership(cognitoUser, ctrl.getCognitoEnvironmentID()); err != nil {
+		return ctx.JSON(http.StatusNotFound, ErrorMessage{
+			Message: fmt.Sprintf("User not found: %s", email),
+		})
+	}
+
 	// Enable user in Cognito
 	err = usermanagement.EnableCognitoUser(context.Background(), cognitoClient, cognitoConfig.UserPoolID, string(email))
 	if err != nil {