Merged in feature/cognito-shared-environments (pull request #211)

cognito and permit shared prod environment support

* code complete

* user creattion tool

test harness

internal/server/api/listener.go

@@ -17,12 +17,14 @@ import (
 	"queryorchestration/internal/cognitoauth"
 	"queryorchestration/internal/document/batch"
 	documentupload "queryorchestration/internal/document/upload"
+	awsc "queryorchestration/internal/serviceconfig/aws"
 	"queryorchestration/internal/serviceconfig/build"
 	"queryorchestration/internal/serviceconfig/objectstore"
 	"queryorchestration/internal/serviceconfig/ratelimit"
 
 	"queryorchestration/internal/server"
 
+	"github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider"
 	"github.com/getkin/kin-openapi/openapi3"
 	"github.com/getkin/kin-openapi/openapi3filter"
 	"github.com/google/uuid"
@@ -290,12 +292,16 @@ func New(ctx context.Context, cfg Config) (*Server, error) {
 
 	// Health endpoint with version information
 	e.GET("/health", func(c echo.Context) error {
-		return c.JSON(http.StatusOK, map[string]interface{}{
+		healthResponse := map[string]interface{}{
 			"status":    "healthy",
 			"version":   build.GetVersion(),
 			"buildTime": build.GetBuildTime(),
 			"commit":    build.GetGitCommit(),
-		})
+		}
+		if envID := cfg.GetCognitoEnvironmentID(); envID != "" {
+			healthResponse["cognitoEnvironmentId"] = envID
+		}
+		return c.JSON(http.StatusOK, healthResponse)
 	})
 
 	e.Use(getSlogCustomEchoMiddleware(cfg.GetLogger()))
@@ -328,9 +334,20 @@ func New(ctx context.Context, cfg Config) (*Server, error) {
 		"overrides_count", len(rateLimitConfig.EndpointOverrides),
 	)
 
+	// Create Cognito client for environment access control in auth middleware
+	var cognitoClient *cognitoidentityprovider.Client
+	if envID := cfg.GetCognitoEnvironmentID(); envID != "" {
+		awsCfg, awsErr := awsc.GetAWSConfig(ctx)
+		if awsErr != nil {
+			logger.Warn("Failed to create AWS config for environment access control", "error", awsErr)
+		} else {
+			cognitoClient = cognitoidentityprovider.NewFromConfig(awsCfg)
+		}
+	}
+
 	// NOW register auth routes (after rate limiting to protect auth endpoints)
 	// auth start - using Permit.io for authorization
-	cognitoauth.RegisterRoutes(cfg.GetRouter(), cfg)
+	cognitoauth.RegisterRoutes(cfg.GetRouter(), cfg, cognitoClient)
 	// auth end
 
 	// Test user injection middleware - only active when DISABLE_AUTH=true

internal/server/api/listener_test.go

@@ -268,6 +268,86 @@ func TestHealthEndpointWithVersionInfo(t *testing.T) {
 	assert.Equal(t, build.GetGitCommit(), response["commit"], "Commit should match build.GetGitCommit()")
 }
 
+// TestHealthEndpoint_IncludesEnvIDWhenConfigured verifies that the health endpoint
+// includes the cognitoEnvironmentId field in the JSON response when
+// COGNITO_ENVIRONMENT_ID is configured. This matches the conditional logic at
+// listener.go:301-303.
+func TestHealthEndpoint_IncludesEnvIDWhenConfigured(t *testing.T) {
+	e := echo.New()
+
+	cfg := &BaseConfig{}
+	_ = serviceconfig.InitializeConfig(cfg)
+	cfg.CognitoEnvironmentID = "acmehealth"
+
+	// Register health handler matching the real listener.go implementation
+	e.GET("/health", func(c echo.Context) error {
+		healthResponse := map[string]interface{}{
+			"status":    "healthy",
+			"version":   build.GetVersion(),
+			"buildTime": build.GetBuildTime(),
+			"commit":    build.GetGitCommit(),
+		}
+		if envID := cfg.GetCognitoEnvironmentID(); envID != "" {
+			healthResponse["cognitoEnvironmentId"] = envID
+		}
+		return c.JSON(http.StatusOK, healthResponse)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/health", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+
+	var response map[string]interface{}
+	err := json.Unmarshal(rec.Body.Bytes(), &response)
+	require.NoError(t, err)
+
+	assert.Equal(t, "acmehealth", response["cognitoEnvironmentId"],
+		"Health response should include cognitoEnvironmentId when configured")
+	assert.Equal(t, "healthy", response["status"])
+}
+
+// TestHealthEndpoint_OmitsEnvIDWhenNotConfigured verifies that the health endpoint
+// does NOT include the cognitoEnvironmentId field when COGNITO_ENVIRONMENT_ID is
+// empty (the default). This matches the conditional logic at listener.go:301-303.
+func TestHealthEndpoint_OmitsEnvIDWhenNotConfigured(t *testing.T) {
+	e := echo.New()
+
+	cfg := &BaseConfig{}
+	_ = serviceconfig.InitializeConfig(cfg)
+	cfg.CognitoEnvironmentID = "" // explicitly empty
+
+	// Register health handler matching the real listener.go implementation
+	e.GET("/health", func(c echo.Context) error {
+		healthResponse := map[string]interface{}{
+			"status":    "healthy",
+			"version":   build.GetVersion(),
+			"buildTime": build.GetBuildTime(),
+			"commit":    build.GetGitCommit(),
+		}
+		if envID := cfg.GetCognitoEnvironmentID(); envID != "" {
+			healthResponse["cognitoEnvironmentId"] = envID
+		}
+		return c.JSON(http.StatusOK, healthResponse)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/health", nil)
+	rec := httptest.NewRecorder()
+	e.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+
+	var response map[string]interface{}
+	err := json.Unmarshal(rec.Body.Bytes(), &response)
+	require.NoError(t, err)
+
+	_, hasCognitoEnvID := response["cognitoEnvironmentId"]
+	assert.False(t, hasCognitoEnvID,
+		"Health response should NOT include cognitoEnvironmentId when not configured")
+	assert.Equal(t, "healthy", response["status"])
+}
+
 func TestGetSlogCustomEchoMiddleware(t *testing.T) {
 	l := &logger.TestLogger{
 		T: t,