# RedTag Mobile App — Production Deployment Status

**Last Updated**: 2026-05-13
**AWS Account**: 489176460030 (tbi-prod)
**Region**: ca-central-1

---

## Current State Summary

| Component | Status |
|-----------|--------|
| Cognito User Pool | ✅ Done |
| Cognito Identity Pool | ✅ Done |
| Lambda Triggers (3) | ✅ Done |
| Google Social Login | ✅ Done |
| Apple Social Login | ⏳ Blocked — needs private key |
| Facebook Social Login | ⏳ Blocked — needs business account access |
| SES Email Config | ⚠️ Partial — `no-reply@redtag.ca` pending verification |
| `custom:phone` Attribute | ✅ Done |
| Backend Services (K8s) | ✅ All running in prod |
| Mobile App Prod Build | ❌ Not started — waiting on blockers |

---

## AWS Resources Created

### Cognito User Pool

| Property | Value |
|----------|-------|
| Name | `tbi-redtag-prod` |
| Pool ID | `ca-central-1_ykbZiSwok` |
| ARN | `arn:aws:cognito-idp:ca-central-1:489176460030:userpool/ca-central-1_ykbZiSwok` |
| Domain | `tbi-redtag-prod.auth.ca-central-1.amazoncognito.com` |
| MFA | Optional |
| Deletion Protection | Active |
| Created | 2026-04-02 |

### Cognito Identity Pool

| Property | Value |
|----------|-------|
| Name | `tbi-redtag-mobile-prod` |
| Identity Pool ID | `ca-central-1:5bb595a9-13d1-4a44-80c4-2c98d4c42388` |
| Unauthenticated Access | Allowed |
| Linked User Pool Client | `2qj2ovsreij61c4on86n1spmjm` |

### App Clients

| Client Name | Client ID | Providers |
|-------------|-----------|-----------|
| `tbi-redtag-mobile-app` | `2qj2ovsreij61c4on86n1spmjm` | COGNITO, Google |
| `tbi-redtag-web-app` | `6c5ot1tijetjf2d2q0vpn2scs3` | COGNITO |

**Mobile App Client Config:**
- OAuth: Authorization Code grant
- Scopes: openid, email, profile, phone, aws.cognito.signin.user.admin
- Callback: `redtagapp://Home`
- Logout: `redtagapp://Splash`
- Token validity: Access 1 day, ID 1 day, Refresh 5 days

### Lambda Triggers

| Function | Trigger | Runtime | Last Modified |
|----------|---------|---------|---------------|
| `tbi-redtag-lambda-pre-signup` | Pre Sign-up | Node.js 20 | 2026-04-02 |
| `tbi-redtag-lambda-custom` | Custom Message | Node.js 20 | 2026-04-02 |
| `tbi-redtag-lambda-post` | Post Confirmation | Node.js 20 | 2026-05-13 |

### Google Identity Provider

| Property | Value |
|----------|-------|
| Provider Name | Google |
| Client ID | `618901938387-fef25k3sqildvm5rfgkn4uof2phaneqh.apps.googleusercontent.com` |
| Scopes | openid email profile |
| Attribute Mapping | email→email, name→name, given_name→given_name, family_name→family_name, username→sub |
| Created | 2026-05-13 |

---

## Backend Services — Production

All backend services the mobile app depends on are running:

| Service | Cluster | Namespace | Replicas | Ingress URL |
|---------|---------|-----------|----------|-------------|
| `tbi-rlv-vacations-bff-service` | redtag-prod | redtag | 3/3 | `tbi-rlv-vacations-bff-service.redtag.ca` |
| `tbi-rlv-attraction-bff-service` | redtag-prod | redtag | 1/1 | `tbi-rlv-bff.redtag.ca` |
| `tbi-rlv-profile-backend-service` | tbi-prod | redtag | 1/1 | `tbi-rlv-profile-backend.prod.tbidevelopment.ca` |
| `tbi-gg-apis` | tbi-prod | gigi | 2/2 | `tbi-gg-apis.prod.tbidevelopment.ca` |

---

## Blockers

### 1. Apple Sign-In Private Key

**What**: The `.p8` private key file for Apple Sign-In.
**Details**: Key ID `GPQ6T9RHZ8`, Team ID `KJ8JA6J8Z4`, Service ID `com.redtag.cognito.apple`
**Who**: Tru team / Apple Developer account holder
**Once provided**, run:
```bash
aws cognito-idp create-identity-provider \
  --user-pool-id ca-central-1_ykbZiSwok \
  --provider-name SignInWithApple \
  --provider-type SignInWithApple \
  --provider-details '{
    "client_id": "com.redtag.cognito.apple",
    "team_id": "KJ8JA6J8Z4",
    "key_id": "GPQ6T9RHZ8",
    "private_key": "<CONTENTS_OF_P8_FILE>",
    "authorize_scopes": "email name"
  }' \
  --attribute-mapping '{
    "email": "email",
    "name": "firstName",
    "given_name": "firstName",
    "family_name": "lastName",
    "username": "sub"
  }' \
  --region ca-central-1 --profile tbi-prod
```
Then update app client:
```bash
aws cognito-idp update-user-pool-client \
  --user-pool-id ca-central-1_ykbZiSwok \
  --client-id 2qj2ovsreij61c4on86n1spmjm \
  --supported-identity-providers "COGNITO" "Google" "SignInWithApple" \
  --callback-urls "https://tbi-redtag-prod.auth.ca-central-1.amazoncognito.com" "redtagapp://Home" \
  --logout-urls "https://tbi-redtag-prod.auth.ca-central-1.amazoncognito.com" "redtagapp://Splash" \
  --allowed-o-auth-flows "code" \
  --allowed-o-auth-scopes "aws.cognito.signin.user.admin" "email" "openid" "phone" "profile" \
  --allowed-o-auth-flows-user-pool-client \
  --explicit-auth-flows "ALLOW_REFRESH_TOKEN_AUTH" "ALLOW_USER_AUTH" "ALLOW_USER_PASSWORD_AUTH" "ALLOW_USER_SRP_AUTH" \
  --access-token-validity 1 --id-token-validity 1 --refresh-token-validity 5 \
  --token-validity-units '{"AccessToken":"days","IdToken":"days","RefreshToken":"days"}' \
  --prevent-user-existence-errors ENABLED --enable-token-revocation --auth-session-validity 3 \
  --region ca-central-1 --profile tbi-prod
```

### 2. Facebook Login

**What**: Facebook App OAuth credentials (App ID + App Secret)
**Who**: Business team to grant Facebook account access
**Once provided**, create provider and update app client similarly.

### 3. SES Email Verification

**What**: Click the verification link sent to `no-reply@redtag.ca`
**Who**: Email/IT admin with mailbox access
**Once verified**, update User Pool email config:
```bash
aws cognito-idp update-user-pool \
  --user-pool-id ca-central-1_ykbZiSwok \
  --email-configuration '{
    "SourceArn": "arn:aws:ses:ca-central-1:489176460030:identity/no-reply@redtag.ca",
    "EmailSendingAccount": "DEVELOPER",
    "From": "RedTag <no-reply@redtag.ca>",
    "ReplyToEmailAddress": "no-reply@redtag.ca"
  }' \
  --region ca-central-1 --profile tbi-prod
```

---

## Jira Ticket Mapping

| Ticket | Task | Actual Status |
|--------|------|---------------|
| RMAP-217 | Create AWS PROD Cognito Identity Pool | ✅ Done |
| RMAP-218 | Configure AWS PROD Cognito User Pool | ✅ Done |
| RMAP-219 | Deploy Cognito Lambda Triggers in PROD | ✅ Done |
| RMAP-220 | Configure Google Login for PROD | ✅ Done |
| RMAP-221 | Configure Apple Login in PROD | ⏳ Blocked |
| RMAP-222 | Configure Facebook Login Integration | ⏳ Blocked |
| RMAP-223 | Configure Cognito Email Settings for PROD | ⚠️ Partial |
| RMAP-224 | Add custom:phone Attribute | ✅ Done |
| RMAP-225 | End-to-End Authentication Testing | ❌ Not started |
| RMAP-226 | Production Deployment Validation | ❌ Not started |