fix(bb-auth-cognito): lifecycle slice self-sufficient for getUser group read

getUser is lifecycle-gated but reports group memberships via
AdminListGroupsForUser, which was only in the 'groups' IAM slice. A pool with
admin: { actions: ['lifecycle'] } would grant AdminGetUser but not
AdminListGroupsForUser, so getUser 500'd with IAM AccessDenied only in the
deployed AWS runtime (mock reads groups from memory; the admin:{} sandbox e2e
grants everything — both hid it).

- Add AdminListGroupsForUser to the lifecycle IAM slice (shared with groups).
- Make getUser's group fetch best-effort: swallow AccessDenied and return
  groups: undefined rather than failing the whole read under a hand-narrowed policy.
- Regression tests: CDK lifecycle-only self-sufficiency (AdminGetUser +
  AdminListGroupsForUser both granted) and a mock lifecycle-only getUser path.

Caught in PR review; a self-inflicted gap from the earlier getUser groups fix.

Author: harsh62

packages/bb-auth-cognito/src/admin.test.ts

@@ -239,4 +239,18 @@ describe('auth.admin action-scope runtime gate (Gap 3)', () => {
 		const all = new AuthCognito(ROOT, unique(), { admin: {} });
 		await all.admin.createUser('hugo'); // no actions restriction → no throw
 	});
+
+	test('lifecycle-only getUser still reports groups (no cross-action gate)', async () => {
+		// getUser reports group memberships but is lifecycle-gated. A lifecycle-only
+		// pool must NOT be blocked by the runtime action gate on the group read
+		// (the CDK grant makes AdminListGroupsForUser available to lifecycle too).
+		const auth = new AuthCognito(ROOT, unique(), { groups: ['admins'], admin: { actions: ['lifecycle'] } });
+		await auth.admin.createUser('ivy');
+		// addUserToGroup is a groups action → seed membership via the all-access
+		// instance sharing the same on-disk state would differ; instead assert
+		// getUser works and returns an (empty) groups array without throwing.
+		const user = await auth.admin.getUser('ivy');
+		assert.ok(user);
+		assert.deepStrictEqual(user.groups, []);
+	});
 });

packages/bb-auth-cognito/src/index.aws.ts

@@ -842,22 +842,31 @@ export class AuthCognito<const O extends AuthCognitoOptions = AuthCognitoOptions
 					}
 					// AdminGetUser does not return group memberships, so fetch them
 					// separately to populate AdminUser.groups (matches the mock,
-					// which reads groups from its in-memory state).
-					const groups: string[] = [];
-					let nextToken: string | undefined;
-					do {
-						const g = await this.client.send(new AdminListGroupsForUserCommand({
-							UserPoolId: this.adminUserPoolId(), Username: username, NextToken: nextToken,
-						}));
-						for (const grp of g.Groups ?? []) if (grp.GroupName) groups.push(grp.GroupName);
-						nextToken = g.NextToken;
-					} while (nextToken);
+					// which reads groups from its in-memory state). The lifecycle
+					// IAM slice grants AdminListGroupsForUser for exactly this; if a
+					// hand-narrowed policy omits it, degrade to `groups: undefined`
+					// rather than failing the whole read.
+					let groups: string[] | undefined = [];
+					try {
+						let nextToken: string | undefined;
+						do {
+							const g = await this.client.send(new AdminListGroupsForUserCommand({
+								UserPoolId: this.adminUserPoolId(), Username: username, NextToken: nextToken,
+							}));
+							for (const grp of g.Groups ?? []) if (grp.GroupName) groups!.push(grp.GroupName);
+							nextToken = g.NextToken;
+						} while (nextToken);
+					} catch (e) {
+						// Missing AdminListGroupsForUser grant → report groups as unknown.
+						if (e instanceof Error && /AccessDenied|NotAuthorized/.test(e.name)) groups = undefined;
+						else throw e;
+					}
 					return {
 						username: resp.Username ?? username,
 						userSub: attributes['sub'] ?? '',
 						enabled: resp.Enabled ?? true,
 						attributes,
-						groups: groups as GroupOf<AuthCognitoOptions>[],
+						groups: groups as GroupOf<AuthCognitoOptions>[] | undefined,
 					};
 				} catch (e) {
 					if (e instanceof Error && e.name === AuthCognitoErrors.UserNotFound) return null;

packages/bb-auth-cognito/src/index.cdk.test.ts

@@ -568,9 +568,17 @@ const LIFECYCLE_ADMIN_ACTIONS = [
 	'cognito-idp:AdminResetUserPassword',
 	'cognito-idp:AdminSetUserPassword',
 	'cognito-idp:AdminGetUser',
+	// Shared with the group slice — getUser reports group memberships, so the
+	// lifecycle slice must be self-sufficient for that read.
+	'cognito-idp:AdminListGroupsForUser',
 	'cognito-idp:ListUsers',
 	'cognito-idp:AdminUserGlobalSignOut',
 ];
+// Actions granted by BOTH slices — excluded from the "does not grant the other
+// slice's actions" cross-checks below.
+const SHARED_ADMIN_ACTIONS = ['cognito-idp:AdminListGroupsForUser'];
+const groupOnlyActions = GROUP_ADMIN_ACTIONS.filter((a) => !SHARED_ADMIN_ACTIONS.includes(a));
+const lifecycleOnlyActions = LIFECYCLE_ADMIN_ACTIONS.filter((a) => !SHARED_ADMIN_ACTIONS.includes(a));
 
 describe('AuthCognito (CDK) — admin IAM grant', () => {
 	test('no admin option → NO Admin* actions granted (least privilege)', () => {
@@ -593,21 +601,33 @@ describe('AuthCognito (CDK) — admin IAM grant', () => {
 		}
 	});
 
-	test("actions: ['groups'] → grants group actions only", () => {
+	test("actions: ['groups'] → grants group actions, not lifecycle-only actions", () => {
 		const template = synth((stack) => {
 			new AuthCognito(scope(stack), 'auth', { groups: ['admins'], admin: { actions: ['groups'] } });
 		});
 		const actions = grantedActions(template);
 		for (const a of GROUP_ADMIN_ACTIONS) assert.ok(actions.has(a), `missing group action ${a}`);
-		for (const a of LIFECYCLE_ADMIN_ACTIONS) assert.ok(!actions.has(a), `unexpected lifecycle action ${a}`);
+		for (const a of lifecycleOnlyActions) assert.ok(!actions.has(a), `unexpected lifecycle action ${a}`);
 	});
 
-	test("actions: ['lifecycle'] → grants lifecycle actions only", () => {
+	test("actions: ['lifecycle'] → grants lifecycle actions, not group-only actions", () => {
 		const template = synth((stack) => {
 			new AuthCognito(scope(stack), 'auth', { groups: ['admins'], admin: { actions: ['lifecycle'] } });
 		});
 		const actions = grantedActions(template);
 		for (const a of LIFECYCLE_ADMIN_ACTIONS) assert.ok(actions.has(a), `missing lifecycle action ${a}`);
-		for (const a of GROUP_ADMIN_ACTIONS) assert.ok(!actions.has(a), `unexpected group action ${a}`);
+		for (const a of groupOnlyActions) assert.ok(!actions.has(a), `unexpected group action ${a}`);
+	});
+
+	test("actions: ['lifecycle'] is self-sufficient for getUser's group read (regression)", () => {
+		// getUser is lifecycle-gated but reports group memberships via
+		// AdminListGroupsForUser. A lifecycle-only pool must therefore grant that
+		// action, or getUser 500s with IAM AccessDenied in the deployed runtime.
+		const template = synth((stack) => {
+			new AuthCognito(scope(stack), 'auth', { groups: ['admins'], admin: { actions: ['lifecycle'] } });
+		});
+		const actions = grantedActions(template);
+		assert.ok(actions.has('cognito-idp:AdminGetUser'), 'lifecycle must grant AdminGetUser');
+		assert.ok(actions.has('cognito-idp:AdminListGroupsForUser'), 'lifecycle must grant AdminListGroupsForUser for getUser groups');
 	});
 });

packages/bb-auth-cognito/src/index.cdk.ts

@@ -388,6 +388,10 @@ function adminIamActions(actions?: readonly ('groups' | 'lifecycle')[]): string[
 		'cognito-idp:AdminResetUserPassword',
 		'cognito-idp:AdminSetUserPassword',
 		'cognito-idp:AdminGetUser',
+		// getUser also reports the user's group memberships (AdminGetUser does
+		// not return them), so the lifecycle slice must be self-sufficient for
+		// that read. Shared with the `groups` slice, which also grants it.
+		'cognito-idp:AdminListGroupsForUser',
 		'cognito-idp:ListUsers',
 		'cognito-idp:AdminUserGlobalSignOut',
 	];