feat: Add AWS Cognito as OIDC Identity Provider (#325)

[TamarW0]

No description provided.

[vbelouso]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[zvigrinberg]

@TamarW0 LGTM Approved.
Don't forget tests in a follow up PR.

[tmihalac]

Code Review — 8 findings

Critical / High (must fix before merge)

1. Missing wildcard case in get_auth_header match statement — cve_http_output.py:308

The match handles "basic", "keycloak", "bearer", "cognito", and None, but has no case "disabled": and no case _: wildcard. A typo like AUTH_TYPE=Cognito (capital C) or AUTH_TYPE=coginto silently returns None with zero log output, causing all requests to go out unauthenticated.

Fix: Add explicit "disabled" case and a wildcard:

case "disabled" | None:
    return None
case _:
    logger.error(
        "Unrecognized auth_type '%s'. Valid values: basic, bearer, keycloak, cognito, disabled",
        http_config.auth_type,
    )
    return None

---

2. http_auth_header_context(None) silently falls back to SA token — credential_client.py:197

When Cognito token fetch fails, get_auth_header() returns None. Callers pass None into http_auth_header_context(None). Inside fetch_and_decrypt_credential, _http_auth_header_ctx.get() returns None — indistinguishable from "never set" — so it silently falls back to SA token auth. If the credential backend rejects SA tokens, the error says status=401 with no mention that Cognito was the intended auth method.

Fix: Log a warning at call sites when auth was configured but returned None:

auth_header = get_auth_header(http_output_config)
if auth_header is None and http_output_config.auth_type not in ("disabled", None):
    logger.warning(
        "Auth type is '%s' but get_auth_header returned None — "
        "credential backend calls will fall back to SA token",
        http_output_config.auth_type,
    )

---

3. cognito_domain field description shows bare domain, but code needs https:// — cve_http_output.py:103, 287

The field description says "Cognito domain (e.g. myapp.auth.us-east-1.amazoncognito.com)" — no scheme. But _fetch_cognito_token does f"{http_config.cognito_domain}/oauth2/token", so deployers following the docs will get requests.exceptions.MissingSchema. Compare with keycloak_server which documents "https://keycloak.example.com".

Fix: Either prepend https:// in code (safer, since Cognito always uses HTTPS):

domain = http_config.cognito_domain.rstrip("/")
if not domain.startswith("https://"):
    domain = f"https://{domain}"
token_url = f"{domain}/oauth2/token"

Or update the field description to require the scheme.

---

4. get_auth_header(None) crashes with AttributeError — cve_http_output.py:308-309

The type signature accepts None but the first line does match http_config.auth_type:. The 3 new callers all pass builder.get_function_config(HTTP_OUTPUT_AGENT_CONFIG) which returns None if the config key is missing.

Fix:

def get_auth_header(http_config: CVEHttpOutputConfig | None) -> str | None:
    if http_config is None:
        return None
    match http_config.auth_type:
        ...

---

High (should fix)

5. No warning when configured auth fails — cve_http_output.py:194-196

When get_auth_header returns None, the Authorization header is silently omitted. The backend returns 401, but the log says "Unable to send output response" with no indication that auth was configured and failed.

Fix: Add an else branch logging a warning when auth_type is not "disabled" but no header was obtained.

---

6. Broad except Exception in _fetch_cognito_token — cve_http_output.py:299-305

Catches ConnectionError, Timeout, SSLError, HTTPError, KeyError, JSONDecodeError identically. A KeyError('access_token') (wrong scope config) looks identical to a network timeout. At minimum, separate requests.RequestException from KeyError/ValueError.

---

Medium (recommended)

7. Token fetched 4× per pipeline run — cve_clone_and_deps.py:105, cve_generate_vdbs.py:224, cve_segmentation.py:228, cve_http_output.py:194

Each pipeline node independently calls get_auth_header() → _fetch_cognito_token(). Cognito M2M tokens have ~1hr TTL; one fetch could serve the entire run. Not a bug, but adds latency and could trigger rate limiting under load.

---

8. Zero test coverage for new code paths

_fetch_cognito_token, get_auth_header with "cognito", http_auth_header_context, and the None fallback path are all untested. Given the edge cases above (case sensitivity, None handling, missing scheme), tests would catch these.