feat: Onboarding CSP - OIDC Client

[gpascucci]

Title
Add CSP Cognito OIDC Terraform clients

Description

Summary

This PR adds Terraform configuration for CSP OIDC clients in the LZA server infrastructure.

Changes

• adds a new oidc_clients_csp.tf file under lza-infrastructure/terraform/server
• creates Cognito user pool clients for CSP in:
  • dev
  • test
  • prod
• configures environment-specific callback and logout URLs for each CSP client
• wires the new CSP client IDs into flyway.tf so they are available to downstream migration/configuration logic

Details

The new clients follow the existing OIDC client pattern:

• OAuth authorization code flow
• scopes: openid, profile, email
• refresh token auth enabled
• token revocation enabled
• minimum OIDC attribute list for read/write attributes
• environment-specific IDIR identity provider mapping

Testing

• Terraform changes reviewed against existing OIDC client patterns
• No application code changes
• No runtime testing performed in this branch

Notes

This branch also includes CHANGELOG.md and version.txt updates from the merge with main; the functional change in this PR is the CSP Terraform
addition.

[Copilot]

Pull request overview

This PR adds Terraform-managed Amazon Cognito User Pool OIDC clients for the CSP application across dev/test/prod in the LZA server infrastructure, and exposes the new client IDs to the Flyway migration invocation as placeholders.

Changes:

• Added aws_cognito_user_pool_client resources for CSP in dev/test/prod with environment-specific callback and logout URLs.
• Added CSP client IDs to the Flyway Lambda invocation placeholder map so migrations/config can reference them.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
lza-infrastructure/terraform/server/oidc_clients_csp.tf	Defines new Cognito User Pool clients for CSP (dev/test/prod) following existing OIDC client patterns.
lza-infrastructure/terraform/server/flyway.tf	Wires CSP Cognito client IDs into Flyway placeholder inputs for downstream use.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ianliuwk1019]

Hello @gpascucci and @kamal-mohammed !
Thanks for the PR.
I wondering if you have all the information to onboard "CSP"? If possible, better do it in one PR for all the scripts. Please reference to recent closed pr for onboarding to FAM: https://github.com/bcgov/nr-forests-access-management/pull/2144/changes .

If still needs some clarification from business, please contact Olga or maybe Ann-Marie I guess she can discuss with Olga as well; sometimes they will need to finalize some changes from Business, that's my understanding.

ps: If application and its roles information is still not clear yet, can do it later but then you won't be able to use it to grant a user.

I fixed the PR title, you can also follow previous PR convention.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (2)

lza-infrastructure/terraform/server/oidc_clients_csp.tf:51

• The test client allows both /int/csp and /pub/csp callback URLs, but the logout allow-list only includes the /pub/csp/logout URL. Existing INT/PUB clients in this directory include both logout URLs, so sign-out redirects from the INT CSP route would be rejected by Cognito.

  logout_urls                                   = [
    var.oidc_sso_playground_url,
    "${var.cognito_app_client_logout_chain_url.test}https://testapps.nrs.gov.bc.ca/pub/csp/logout"

lza-infrastructure/terraform/server/oidc_clients_csp.tf:87

• The prod client allows both /int/csp and /pub/csp callback URLs, but the logout allow-list only includes the /pub/csp/logout URL. Existing INT/PUB clients in this directory include both logout URLs, so sign-out redirects from the INT CSP route would be rejected by Cognito.

  logout_urls                                   = [
    var.oidc_sso_playground_url,
    "${var.cognito_app_client_logout_chain_url.prod}https://apps.nrs.gov.bc.ca/pub/csp/logout"

[sonarqubecloud]

Quality Gate passed for 'nr-forests-access-management_admin'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud