Let chapter 7's read-side run against the deployment

[alukach]

Targets feat/stac-auth-proxy-lambda (#49), not main.

Chapter 7 says it needs docker-compose. Only half of it does — sections 7.4 to 7.5.1 just read, and the deployed proxy already runs the same filter against the seeded private-alice-demo and private-bob-demo collections. This makes that half actually runnable, and narrows the warning to match.

Two things were in the way

A notebook could not sign in to Cognito without a browser. Confirmed against the live pool:

InvalidParameterException: USER_PASSWORD_AUTH flow not enabled for this client

Now enabled on the app client. It does not weaken the write protection: Cognito issues USER_PASSWORD_AUTH tokens scoped aws.cognito.signin.user.admin and never the custom stac/* scopes, so such a token still fails the scope check in PRIVATE_ENDPOINTS. It carries username, which is all the row-level filter reads.

user_srp is named alongside it deliberately — specifying any flow replaces Cognito's implicit defaults, and silently dropping SRP would be an unintended narrowing of the client.

The narrowed warning would have been a half-truth without a way to act on it. The notebook calls require_local_auth_stack(), which hard-fails without MOCK_OIDC_ENDPOINT. So docs/stac_auth.py gains deployed_auth() and get_cognito_token(), and §7.3.3 gains a short snippet showing the swap — the setup cell, the seeded collection ids, and where to stop.

Verification

deployed_auth() exercised against the live config endpoint: returns the proxy endpoint, client id, the region parsed out of the discovery URL, and the shared password.

get_cognito_token() currently fails with exactly the USER_PASSWORD_AUTH flow not enabled error above — which is the redeploy and nothing else. Worth confirming after deploy that a token really does come back carrying username; the scope claim is documented Cognito behaviour rather than something I could test pre-deploy.

Also ran: cdk synth (OK, ExplicitAuthFlows now ['ALLOW_USER_PASSWORD_AUTH', 'ALLOW_USER_SRP_AUTH', 'ALLOW_REFRESH_TOKEN_AUTH']), the filter self-check, notebook JSON validity, ruff.

Why 7.6 stays local

Not only because writes are disabled. These tokens carry no stac/write scope, so the write-rejection demo would fail at route-level auth rather than demonstrating row-level auth — the right answer for the wrong reason, which is worse than not showing it.

On the related question of getting custom scopes at all: stac/read and stac/write are only issuable from the OAuth token endpoint (/oauth2/token), via authorization_code (needs a browser redirect) or client_credentials (needs a client secret and has no user identity, so no username claim). The InitiateAuth flows don't take a scope parameter at all. So a headless token carrying both a user identity and a custom scope isn't reachable through Cognito's supported APIs — which is the constraint that shapes this split.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P1CCcrx5fDKuAGsNh8DUFG

[review-notebook-app]

Check out this pull request on 

See visual diffs & provide feedback on Jupyter Notebooks.

---

Powered by ReviewNB