Fix SSM env params fallback for optional env variables

[lukaszgryglicki]

Fallback to missing if not avail in SSM - those are optional env variables cc @mlehotskylf @ahmedomosanya

Signed-off-by: Lukasz Gryglicki [email protected]

Assisted by OpenAI

Assisted by GitHub Copilot

[coderabbitai]

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Three Auth0 claim environment variables in two serverless configurations now accept runtime environment overrides with empty-string defaults. A new Bash script adds production Auth0 claim values into AWS SSM (two regions) and then invokes an existing retrieval script.

Changes

Cohort / File(s)	Summary
Serverless configuration updates cla-backend-go/serverless.yml, cla-backend/serverless.yml	Three Auth0 claim env entries (AUTH0_USERNAME_CLAIM_CLI, AUTH0_EMAIL_CLAIM_CLI, AUTH0_NAME_CLAIM_CLI) updated to include env:<VAR_NAME>, '' allowing runtime env overrides with empty-string fallback.
Production claims configuration script utils/set_prod_claims.sh	New Bash script that writes Auth0 claim endpoints into AWS SSM parameters in us-east-1 and us-east-2 using the lfproduct-prod profile, then calls ./utils/get_prod_claims.sh.

Sequence Diagram(s)

sequenceDiagram
    participant Dev as Operator (run script)
    participant SSM1 as AWS SSM (us-east-1)
    participant SSM2 as AWS SSM (us-east-2)
    participant Get as ./utils/get_prod_claims.sh

    rect rgb(223,240,216)
      Dev->>SSM1: put-parameter username/email/name (lfproduct-prod)
      Dev->>SSM2: put-parameter username/email/name (lfproduct-prod)
    end

    Dev->>Get: invoke get_prod_claims.sh

Loading

sequenceDiagram
    participant Runtime as Lambda / Service
    participant Env as OS Env
    participant Provider as serverless.yml provider env

    rect rgb(232,242,254)
      note right of Provider: provider env entries now include env:<VAR>, ''\n(fallback to empty string)
    end

    Runtime->>Provider: resolve env var
    alt env var set
      Provider->>Runtime: use OS Env value
    else not set
      Provider->>Runtime: use '' (empty string)
    end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Small, consistent config edits across two files and one short script.
• Review focus: correct SSM parameter names/regions, AWS profile usage, and whether the script needs error handling or set -e/validation.

Possibly related PRs

• Try to fix broken V3 token handling #4845 — Modifies the same Auth0 claim configuration entries and alters/introduces scripts managing SSM claim parameters.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: adding SSM environment parameter fallbacks for optional environment variables across the serverless configurations and supporting scripts.
Description check	✅ Passed	The PR description is related to the changeset, explaining that it implements fallback to 'missing' for optional environment variables when not available in SSM.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch unicron-fix-serverless-env-vars-fallback

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between cb556c6 and 0c667eb.

📒 Files selected for processing (1)

• cla-backend/serverless.yml (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• cla-backend/serverless.yml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: cypress-functional
• GitHub Check: build-test-lint

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull Request Overview

This PR adds fallback configuration for Auth0 CLI claims and creates a utility script for setting production Auth0 claim parameters in AWS SSM.

• Adds environment variable and empty string fallbacks to Auth0 CLI claim variables in serverless configurations
• Creates a new set_prod_claims.sh utility script to populate Auth0 CLI claim SSM parameters for production
• Adds extra whitespace alignment to Auth0 CLI claim variables in cla-backend/serverless.yml

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
utils/set_prod_claims.sh	New utility script to set Auth0 CLI claims in AWS SSM for production environment (both us-east-1 and us-east-2 regions)
cla-backend/serverless.yml	Updated AUTH0 CLI claim environment variables to include env variable and empty string fallbacks, with aligned spacing
cla-backend-go/serverless.yml	Updated AUTH0 CLI claim environment variables to include env variable and empty string fallbacks

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 2

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between fbdb340 and cb556c6.

📒 Files selected for processing (3)

• cla-backend-go/serverless.yml (1 hunks)
• cla-backend/serverless.yml (1 hunks)
• utils/set_prod_claims.sh (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: build-test-lint
• GitHub Check: cypress-functional

🔇 Additional comments (2)

cla-backend/serverless.yml (1)

315-317: Consistent fallback pattern for optional AUTH0 CLI claim variables.

The changes correctly implement the fallback chain (env.json → SSM → environment variable → empty string) for optional environment variables. This allows CLI claims to be configured at runtime via environment variables while maintaining backward compatibility with SSM and local env.json configurations.

cla-backend-go/serverless.yml (1)

226-228: Consistent environment variable fallback across Go backend.

The changes mirror the Python backend updates with appropriate use of opt:stage parameter syntax. Both backends now support optional AUTH0 CLI claim variables with environment variable overrides and empty-string fallback.