Add self-service password-set flow for new hero accounts#56
Merged
Conversation
Google Workspace 2FA enforcement blocks forgot-password for new accounts. New flow: team provisioner generates HMAC-signed link → hero clicks → sets password via Lambda Function URL → team provisioner updates Google Admin SDK. - New Lambda `javabin-password-set` with Function URL (GET/POST /set-password) - HMAC-SHA256 tokens with 48h expiry and single-use enforcement via DynamoDB - Welcome email updated with "Sett passord" button instead of forgot-password - `resend_password_link` action for expired links - `set_password` action delegated from password-set Lambda to team provisioner - Security Hub alerts: DynamoDB dedup retained, button changed to console link
Terraform PlanChanges detected — review required. Plan output |
LLM Plan ReviewRisk: 🟢 LOW Adding a new password-set Lambda function with supporting infrastructure and updating existing Lambda function code.
|
1 task
Alexanderamiri
added a commit
that referenced
this pull request
Mar 13, 2026
## Summary - v6 of `aws-actions/configure-aws-credentials` breaks OIDC `AssumeRoleWithWebIdentity` on the `javabin-ci-infra` role (main-only trust condition) - The `ci-infra-plan` role (any-ref trust) works fine with v6, so only the apply and drift detection jobs are pinned back to v5 - This unblocks the apply that failed for PR #56 ## Test plan - [ ] Merge → apply job succeeds with v5
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary - New `javabin-password-set` Lambda with Function URL for self-service password setting - Replaces forgot-password flow in welcome email with HMAC-signed "Sett passord" link (48h expiry, single-use) - Password-set Lambda validates token, delegates to team-provisioner for Google Admin SDK password update - Added `resend_password_link` action to team-provisioner for expired links - Security Hub alerts: kept DynamoDB dedup, changed button to "View in Security Hub" console link (no Slack→AWS write path) - Dedicated signing key at `/javabin/platform/password-token-signing-key`, function URL stored at `/javabin/platform/password-set-function-url` ## Test plan - [ ] `terraform apply` deploys password-set Lambda + function URL + SSM parameter - [ ] Invoke `resend_password_link` with test user → email arrives with "Sett passord" button - [ ] Click link → form renders with password validation rules - [ ] Submit password → Google Workspace password updated → success page shown - [ ] Reuse same link → "already been used" error - [ ] Wait for expiry (or tamper with token) → "expired" / "invalid" error
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary - v6 of `aws-actions/configure-aws-credentials` breaks OIDC `AssumeRoleWithWebIdentity` on the `javabin-ci-infra` role (main-only trust condition) - The `ci-infra-plan` role (any-ref trust) works fine with v6, so only the apply and drift detection jobs are pinned back to v5 - This unblocks the apply that failed for PR #56 ## Test plan - [ ] Merge → apply job succeeds with v5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
javabin-password-setLambda with Function URL for self-service password settingresend_password_linkaction to team-provisioner for expired links/javabin/platform/password-token-signing-key, function URL stored at/javabin/platform/password-set-function-urlTest plan
terraform applydeploys password-set Lambda + function URL + SSM parameterresend_password_linkwith test user → email arrives with "Sett passord" button