fix(csp): allow regional Cognito IdP host so silent token refresh isn't blocked

[gpascucci]

Symptom

Users get signed out mid-session (at the Cognito token TTL) in deployed environments — the "timeouts".

Root cause

frontend/Caddyfile's CSP connect-src allowed only the Cognito Hosted UI domain (used for the OAuth login redirect), not cognito-idp.<region>.amazonaws.com, which Amplify calls to silently refresh the access/id token. The browser blocked the refresh → the token expired at its TTL → the next request 401'd → Amplify's tokenRefresh_failure bounced the user to sign-in, repeating every TTL.

Fix

Add https://cognito-idp.{$COGNITO_REGION:ca-central-1}.amazonaws.com to connect-src. Defaults to ca-central-1 (the FAM pool region for every env), so no deploy change is required; COGNITO_REGION can override if a region ever differs.

Diagnosed from the sibling FAM app nr-csp, which hit and fixed the identical bug (its PR #114).

Verification

• Config-only change to the served CSP header (no app-code/test impact).
• After deploy, confirm the rendered header includes the regional host and that idling past the token TTL then interacting no longer signs the user out:
  curl -sI <sandbox-url>/ | grep -i content-security-policy

🤖 Generated with Claude Code

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Rylan-cgi]

Pull Request Review: PR #329 (bcgov/nr-ilcr)

• Title: fix(csp): allow regional Cognito IdP host so silent token refresh isn't blocked
• Reviewer: Gemini CLI (Adversarial Code Reviewer)
• Target: gpascucci/feat/csp-cognito-idp

---

✅ Review Verdict: APPROVED

This is a clean, precise, and correct configuration fix.

Why it is correct:

1. Accurate Diagnosis: AWS Amplify initiates token refresh calls to cognito-idp.<region>.amazonaws.com rather than the Cognito Hosted UI domain. Without this being explicitly allowed in the connect-src CSP header, the browser correctly blocks the network request, causing silent token refreshing to fail and users to be repeatedly signed out at the token TTL.
2. Robust Configuration: Using the Caddy placeholder {$COGNITO_REGION:ca-central-1} is highly robust. It defaults to the correct FAM user pool region (ca-central-1) so that no immediate deployment or CI variable updates are needed, while still leaving the door open to override it in other environments via an env var if necessary.
3. Excellent Comments: The added comments explain the "why" and "what" beautifully, preventing future developers from accidentally stripping out this crucial entry during header cleanups.

There are no changes needed. This PR is ready to merge!

[SScholefield]

looks good!

[paulushcgcj]

The CSP change addresses the reported Cognito refresh failure without changing application code.
The existing Hosted UI entry remains in place, while the regional IdP endpoint is now allowed for silent token refresh.
The default region preserves current deployments and the override keeps the configuration portable.
The inline note calls out the distinction between OAuth login and token refresh clearly.

[paulushcgcj]

This keeps the existing Hosted UI allow-list entry and adds the regional Cognito IdP host alongside it, which matches the two separate Amplify flows described in the PR. The defaulted region placeholder also avoids requiring a deployment change for the current FAM environments while leaving an explicit override when needed.