Consider adding a top level route at `/Privileges`. This has a few advantages:
- Gives the main app nav router-link a parent path so the nav item can stay highlighted throughout the workflow
- Act...
`tokens.staff.AUTH_TYPE` and `tokens.licensee.AUTH_TYPE` both evaluate to the constant `auth_type`.
This is a bit obfuscated with the current set up. Would the fix mentioned above "It might also...
I could do that get once, save it to a variable and then refer to that variable. I could add a comment too explaining that they are the same value.
It might also make more sense to move the auth...
Ok, Ill create a readme documenting the nuances of cognito, how our two user pool set up meshes with those nuances and explaining our mitigation efforts.
Got it. This is unintuitive enough that I think it might warrant documenting in a README. I think it might also make sense to document something on your other comment re: being logged in remotely v...
See [this sprint PR comment](https://github.com/csg-org/CompactConnect/pull/401#discussion_r1890640689) for details. It appears there are some holes in how the API is handling cases around when use...
Actually yes, the way `auth_storage` is evaluated `tokens.staff.AUTH_TYPE` and `tokens.licensee.AUTH_TYPE` are actually stored in exactly the same place as each other in session / local storage.
...
Logged out from the perspective of cognito, not just locally. Local logout would be deleting the tokens. Remote logout would be making the tokens invalid / revoking them + removing http only cookies.
We retain the access token from both user pools to maintain an indicator that we are still logged in to that user pool remotely. We need this indicator so that the app knows to remotely log the use...
In the `logout_url` query param we specify where we want to be redirected to after visiting the hosted logout page. But, the `logout_url` we put there must be one of the allowed `logout_urls` liste...
### Description List
- Added minor improvements to API/Lambda logging to make tracing requests easier
- Moved SSN/provider_id association records into a separate DynamoDB table
- Encrypted that ...