# 1 — Node.js 22 LTS (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get update
sudo apt-get install -y nodejs unzip

# 2 — AWS CLI v2
curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip
unzip -q awscliv2.zip
sudo ./aws/install --update
rm -rf aws awscliv2.zip

# 3 — Authenticate for local development with short-lived SSO credentials
aws configure sso
aws sso login

# 4 — Install project dependencies from lock files
(cd frontend       && npm ci)
(cd infrastructure && npm ci)

# 5 — Run CLIs from the project dependencies; avoid unpinned global versions
(cd frontend       && npx ng version)
(cd infrastructure && npx cdk --version)

import * as cdk from 'aws-cdk-lib';
import * as cognito from 'aws-cdk-lib/aws-cognito';
import { Construct } from 'constructs';

export interface CognitoConstructProps {
  readonly domainPrefix: string;
  readonly callbackUrls: string[];
  readonly logoutUrls: string[];
}

export class CognitoConstruct extends Construct {
  readonly userPool: cognito.UserPool;
  readonly userPoolClient: cognito.UserPoolClient;
  readonly domainPrefix: string;
  readonly apiScope = 'ml-api/invoke';

  constructor(scope: Construct, id: string, props: CognitoConstructProps) {
    super(scope, id);

    this.userPool = new cognito.UserPool(this, 'UserPool', {
      selfSignUpEnabled: false,
      signInAliases: { email: true },
      removalPolicy: cdk.RemovalPolicy.RETAIN,
      deletionProtection: true,
      accountRecovery: cognito.AccountRecovery.EMAIL_ONLY,
      mfa: cognito.Mfa.OFF, // Enforce corporate MFA in Entra for federated-only users.
      customAttributes: {
        enterpriseRole: new cognito.StringAttribute({ mutable: true, maxLen: 256 }),
        tenantId: new cognito.StringAttribute({ mutable: true, maxLen: 64 }),
      },
    });

    const entra = new cognito.UserPoolIdentityProviderSaml(this, 'EntraID', {
      userPool: this.userPool,
      name: 'EntraID',
      metadata: cognito.UserPoolIdentityProviderSamlMetadata.url(
        'https://login.microsoftonline.com/<tenant-id>/federationmetadata/2007-06/federationmetadata.xml'
      ),
      attributeMapping: {
        email: cognito.ProviderAttribute.other(
          'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'
        ),
        givenName: cognito.ProviderAttribute.other(
          'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'
        ),
        familyName: cognito.ProviderAttribute.other(
          'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'
        ),
        custom: {
          enterpriseRole: cognito.ProviderAttribute.other(
            'http://schemas.microsoft.com/ws/2008/06/identity/claims/role'
          ),
          tenantId: cognito.ProviderAttribute.other(
            'http://schemas.microsoft.com/identity/claims/tenantid'
          ),
        },
      },
    });

    const invokeScope = new cognito.ResourceServerScope({
      scopeName: 'invoke',
      scopeDescription: 'Invoke approved ML operations',
    });
    const resourceServer = this.userPool.addResourceServer('MlApiResourceServer', {
      identifier: 'ml-api',
      scopes: [invokeScope],
    });

    this.domainPrefix = props.domainPrefix;
    this.userPool.addDomain('ManagedLoginDomain', {
      cognitoDomain: { domainPrefix: props.domainPrefix },
    });

    this.userPoolClient = this.userPool.addClient('SpaClient', {
      generateSecret: false,
      supportedIdentityProviders: [
        cognito.UserPoolClientIdentityProvider.custom('EntraID'),
      ],
      oAuth: {
        flows: { authorizationCodeGrant: true },
        scopes: [
          cognito.OAuthScope.OPENID,
          cognito.OAuthScope.EMAIL,
          cognito.OAuthScope.PROFILE,
          cognito.OAuthScope.resourceServer(resourceServer, invokeScope),
        ],
        callbackUrls: props.callbackUrls,
        logoutUrls: props.logoutUrls,
      },
      readAttributes: new cognito.ClientAttributes()
        .withStandardAttributes({ email: true, givenName: true, familyName: true })
        .withCustomAttributes('enterpriseRole', 'tenantId'),
      writeAttributes: new cognito.ClientAttributes()
        .withStandardAttributes({ email: true, givenName: true, familyName: true })
        .withCustomAttributes('enterpriseRole', 'tenantId'),
      accessTokenValidity: cdk.Duration.minutes(60),
      idTokenValidity: cdk.Duration.minutes(60),
      refreshTokenValidity: cdk.Duration.days(1),
      enableTokenRevocation: true,
      preventUserExistenceErrors: true,
    });

    this.userPoolClient.node.addDependency(entra);
  }
}

import * as cdk from 'aws-cdk-lib';
import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as cognito from 'aws-cdk-lib/aws-cognito';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as logs from 'aws-cdk-lib/aws-logs';
import * as wafv2 from 'aws-cdk-lib/aws-wafv2';
import { Construct } from 'constructs';

export interface ApiConstructProps {
  readonly userPool: cognito.UserPool;
  readonly processor: lambda.Function;
  readonly allowedOrigin: string;
  readonly authorizationScope: string;
}

export class ApiConstruct extends Construct {
  readonly api: apigateway.RestApi;

  constructor(scope: Construct, id: string, props: ApiConstructProps) {
    super(scope, id);

    const accessLogs = new logs.LogGroup(this, 'AccessLogs', {
      retention: logs.RetentionDays.THIRTY_DAYS,
      removalPolicy: cdk.RemovalPolicy.RETAIN,
    });

    this.api = new apigateway.RestApi(this, 'Api', {
      restApiName: 'ML App API',
      endpointConfiguration: { types: [apigateway.EndpointType.REGIONAL] },
      defaultCorsPreflightOptions: {
        allowOrigins: [props.allowedOrigin],
        allowMethods: ['POST', 'OPTIONS'],
        allowHeaders: ['Content-Type', 'Authorization'],
      },
      deployOptions: {
        stageName: 'prod',
        dataTraceEnabled: false,
        metricsEnabled: true,
        loggingLevel: apigateway.MethodLoggingLevel.ERROR,
        accessLogDestination: new apigateway.LogGroupLogDestination(accessLogs),
        accessLogFormat: apigateway.AccessLogFormat.jsonWithStandardFields(),
      },
    });

    const authorizer = new apigateway.CognitoUserPoolsAuthorizer(
      this,
      'CognitoAuthorizer',
      { cognitoUserPools: [props.userPool] }
    );

    const integration = new apigateway.LambdaIntegration(props.processor, {
      timeout: cdk.Duration.seconds(25),
    });

    const methodOptions: apigateway.MethodOptions = {
      authorizer,
      authorizationType: apigateway.AuthorizationType.COGNITO,
      authorizationScopes: [props.authorizationScope],
    };

    const ml = this.api.root.addResource('ml');
    ml.addResource('sagemaker').addMethod('POST', integration, methodOptions);
    ml.addResource('bedrock').addMethod('POST', integration, methodOptions);

    const webAcl = new wafv2.CfnWebACL(this, 'ApiWebAcl', {
      defaultAction: { allow: {} },
      scope: 'REGIONAL',
      visibilityConfig: {
        cloudWatchMetricsEnabled: true,
        metricName: 'MlApiWebAcl',
        sampledRequestsEnabled: true,
      },
      rules: [
        {
          name: 'AWSManagedCommonRules',
          priority: 0,
          overrideAction: { none: {} },
          statement: {
            managedRuleGroupStatement: {
              vendorName: 'AWS',
              name: 'AWSManagedRulesCommonRuleSet',
            },
          },
          visibilityConfig: {
            cloudWatchMetricsEnabled: true,
            metricName: 'CommonRules',
            sampledRequestsEnabled: true,
          },
        },
        {
          name: 'RateLimit',
          priority: 1,
          action: { block: {} },
          statement: { rateBasedStatement: { aggregateKeyType: 'IP', limit: 2000 } },
          visibilityConfig: {
            cloudWatchMetricsEnabled: true,
            metricName: 'RateLimit',
            sampledRequestsEnabled: true,
          },
        },
      ],
    });

    const association = new wafv2.CfnWebACLAssociation(this, 'ApiWebAclAssociation', {
      resourceArn: cdk.Stack.of(this).formatArn({
        service: 'apigateway',
        resource: 'restapis',
        resourceName: `${this.api.restApiId}/stages/${this.api.deploymentStage.stageName}`,
        arnFormat: cdk.ArnFormat.SLASH_RESOURCE_NAME,
      }),
      webAclArn: webAcl.attrArn,
    });
    association.node.addDependency(this.api.deploymentStage);
  }
}

from collections.abc import Mapping
from typing import Any

APPROVED_OPERATIONS = {
    'summarize': {'service': 'bedrock', 'resource_key': 'SUMMARY_MODEL_ARN'},
    'classify': {'service': 'sagemaker', 'resource_key': 'CLASSIFIER_ENDPOINT_NAME'},
}
REQUIRED_SCOPE = 'ml-api/invoke'


def authorize_request(
    claims: Mapping[str, Any],
    body: Mapping[str, Any],
    env: Mapping[str, str],
) -> dict[str, str]:
    scopes = set(str(claims.get('scope', '')).split())
    if REQUIRED_SCOPE not in scopes:
        raise PermissionError('required OAuth scope is missing')

    operation = str(body.get('operation', ''))
    mapping = APPROVED_OPERATIONS.get(operation)
    if mapping is None:
        raise PermissionError('operation is not approved')

    resource = env.get(mapping['resource_key'])
    if not resource:
        raise RuntimeError(f"missing configuration: {mapping['resource_key']}")

    return {
        'service': mapping['service'],
        'resource': resource,
        'subject': str(claims.get('sub', '')),
    }

import { NgModule } from '@angular/core';
import { BrowserModule } from '@angular/platform-browser';
import {
  HttpClientModule,
  HTTP_INTERCEPTORS,
} from '@angular/common/http';
import { ReactiveFormsModule } from '@angular/forms';
import { Amplify } from 'aws-amplify';
import { environment } from '../environments/environment';

import { AppRoutingModule } from './app-routing.module';
import { AppComponent } from './app.component';
import { AuthModule } from './auth/auth.module';
import { MLServicesModule } from './ml-services/ml-services.module';
import { AuthInterceptor } from './auth/auth.interceptor';
import { ErrorInterceptor } from './shared/error.interceptor';

Amplify.configure({
  Auth: {
    Cognito: {
      userPoolId: environment.cognito.userPoolId,
      userPoolClientId: environment.cognito.userPoolWebClientId,
      loginWith: {
        oauth: {
          domain: environment.cognito.domain,
          scopes: ['email', 'openid', 'profile', environment.cognito.apiScope],
          redirectSignIn: [`${window.location.origin}/auth/callback`],
          redirectSignOut: [`${window.location.origin}/auth/logout`],
          responseType: 'code',
        },
      },
    },
  },
});

@NgModule({
  declarations: [AppComponent],
  imports: [
    BrowserModule,
    HttpClientModule,
    ReactiveFormsModule,
    AppRoutingModule,
    AuthModule,
    MLServicesModule,
  ],
  providers: [
    { provide: HTTP_INTERCEPTORS, useClass: AuthInterceptor, multi: true },
    { provide: HTTP_INTERCEPTORS, useClass: ErrorInterceptor, multi: true },
  ],
  bootstrap: [AppComponent],
})
export class AppModule {}

import { Injectable } from '@angular/core';
import { Router } from '@angular/router';
import { BehaviorSubject } from 'rxjs';
import {
  fetchAuthSession,
  getCurrentUser,
  signInWithRedirect,
  signOut as amplifySignOut,
} from 'aws-amplify/auth';

export interface User {
  username: string;
  email: string;
  enterpriseRole: string;
  userId: string;
}

@Injectable({ providedIn: 'root' })
export class AuthService {
  private readonly userSubject = new BehaviorSubject<User | null>(null);
  readonly currentUser$ = this.userSubject.asObservable();

  constructor(private readonly router: Router) {
    void this.initializeAuth();
  }

  private async initializeAuth(): Promise<void> {
    try {
      const { username, userId } = await getCurrentUser();
      const session = await fetchAuthSession();
      const payload = session.tokens?.idToken?.payload;

      this.userSubject.next({
        username,
        userId,
        email: String(payload?.['email'] ?? ''),
        enterpriseRole: String(payload?.['custom:enterpriseRole'] ?? ''),
      });
    } catch {
      this.userSubject.next(null);
    }
  }

  async signInWithSAML(): Promise<void> {
    await signInWithRedirect({ provider: { custom: 'EntraID' } });
  }

  async getAccessToken(): Promise<string> {
    const session = await fetchAuthSession();
    const token = session.tokens?.accessToken?.toString();
    if (!token) {
      throw new Error('No Cognito access token is available');
    }
    return token;
  }

  async signOut(): Promise<void> {
    await amplifySignOut();
    this.userSubject.next(null);
    await this.router.navigate(['/auth/login']);
  }

  isAuthenticated(): boolean {
    return this.userSubject.value !== null;
  }

  hasRole(role: string): boolean {
    return this.userSubject.value?.enterpriseRole === role;
  }
}

import { Injectable } from '@angular/core';
import { HttpClient, HttpHeaders } from '@angular/common/http';
import { Observable, from, map, switchMap } from 'rxjs';
import { AuthService } from '../auth/auth.service';
import { environment } from '../../environments/environment';

export interface ClassifyRequest {
  operation: 'classify';
  inputData: unknown;
  parameters?: Record<string, unknown>;
}

export interface SummarizeRequest {
  operation: 'summarize';
  prompt: string;
  parameters?: Record<string, unknown>;
}

export interface MLResponse {
  success: boolean;
  data?: unknown;
  error?: string;
}

@Injectable({ providedIn: 'root' })
export class MLApiService {
  private readonly base = environment.api.baseUrl.replace(/\/$/, '');

  constructor(
    private readonly http: HttpClient,
    private readonly auth: AuthService,
  ) {}

  private headers$(): Observable<HttpHeaders> {
    return from(this.auth.getAccessToken()).pipe(
      map(token => new HttpHeaders({
        'Content-Type': 'application/json',
        Authorization: `Bearer ${token}`,
      })),
    );
  }

  classify(req: ClassifyRequest): Observable<MLResponse> {
    return this.headers$().pipe(
      switchMap(headers => this.http.post<MLResponse>(
        `${this.base}/ml/sagemaker`,
        req,
        { headers },
      )),
    );
  }

  summarize(req: SummarizeRequest): Observable<MLResponse> {
    return this.headers$().pipe(
      switchMap(headers => this.http.post<MLResponse>(
        `${this.base}/ml/bedrock`,
        req,
        { headers },
      )),
    );
  }
}

import * as cdk from 'aws-cdk-lib';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
import { ApiConstruct } from './api-construct';
import { CognitoConstruct } from './cognito-construct';

export interface MainStackProps extends cdk.StackProps {
  readonly environmentName: string;
  readonly applicationOrigin: string;
  readonly cognitoDomainPrefix: string;
}

export class MainStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: MainStackProps) {
    super(scope, id, props);

    const bedrockModelArn = new cdk.CfnParameter(this, 'ApprovedBedrockModelArn', {
      type: 'String',
      description: 'ARN of the approved Bedrock foundation model or inference profile',
    });
    const classifierEndpointName = new cdk.CfnParameter(this, 'ClassifierEndpointName', {
      type: 'String',
      description: 'Name of the approved SageMaker endpoint',
    });

    const identity = new CognitoConstruct(this, 'Identity', {
      domainPrefix: props.cognitoDomainPrefix,
      callbackUrls: [`${props.applicationOrigin}/auth/callback`],
      logoutUrls: [`${props.applicationOrigin}/auth/logout`],
    });

    const processor = new lambda.Function(this, 'MLProcessor', {
      functionName: `MLProcessorFunction-${props.environmentName}`,
      runtime: lambda.Runtime.PYTHON_3_12,
      handler: 'index.lambda_handler',
      code: lambda.Code.fromAsset('lambda/ml-processor'),
      timeout: cdk.Duration.seconds(25),
      memorySize: 2048,
      environment: {
        SUMMARY_MODEL_ARN: bedrockModelArn.valueAsString,
        CLASSIFIER_ENDPOINT_NAME: classifierEndpointName.valueAsString,
      },
    });

    processor.addToRolePolicy(new iam.PolicyStatement({
      actions: ['bedrock:InvokeModel'],
      resources: [bedrockModelArn.valueAsString],
    }));

    processor.addToRolePolicy(new iam.PolicyStatement({
      actions: ['sagemaker:InvokeEndpoint'],
      resources: [cdk.Stack.of(this).formatArn({
        service: 'sagemaker',
        resource: 'endpoint',
        resourceName: classifierEndpointName.valueAsString,
      })],
    }));

    const api = new ApiConstruct(this, 'Api', {
      userPool: identity.userPool,
      processor,
      allowedOrigin: props.applicationOrigin,
      authorizationScope: identity.apiScope,
    });

    new cdk.CfnOutput(this, 'UserPoolId', {
      value: identity.userPool.userPoolId,
    });
    new cdk.CfnOutput(this, 'UserPoolClientId', {
      value: identity.userPoolClient.userPoolClientId,
    });
    new cdk.CfnOutput(this, 'CognitoDomain', {
      value: `${identity.domainPrefix}.auth.${this.region}.amazoncognito.com`,
    });
    new cdk.CfnOutput(this, 'CognitoApiScope', {
      value: identity.apiScope,
    });
    new cdk.CfnOutput(this, 'ApiGatewayUrl', {
      value: api.api.url,
    });
  }
}

#!/usr/bin/env node
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { MainStack } from '../lib/main-stack';

const app = new cdk.App();
const environmentName = String(
  app.node.tryGetContext('environment') ?? process.env.ENVIRONMENT ?? 'dev'
).toLowerCase();

const suffix: Record<string, string> = {
  dev: 'Dev',
  staging: 'Staging',
  prod: 'Prod',
};
if (!(environmentName in suffix)) {
  throw new Error('environment must be dev, staging, or prod');
}

const region = process.env.CDK_DEFAULT_REGION ?? 'us-east-1';
const account = process.env.CDK_DEFAULT_ACCOUNT;
const applicationOrigin = String(
  app.node.tryGetContext('applicationOrigin') ?? 'https://your-domain.example'
);
const cognitoDomainPrefix = String(
  app.node.tryGetContext('cognitoDomainPrefix') ??
  `ml-app-${environmentName}-${account ?? 'local'}-${region}`
).toLowerCase();

new MainStack(app, `MLAppStack-${suffix[environmentName]}`, {
  environmentName,
  applicationOrigin,
  cognitoDomainPrefix,
  env: { account, region },
  tags: {
    Project: 'ML-App',
    Environment: environmentName,
  },
});

version: 1
applications:
  - appRoot: frontend
    frontend:
      phases:
        preBuild:
          commands:
            - npm ci
        build:
          commands:
            - npm run build:prod
      artifacts:
        # Angular's current application builder normally emits browser assets here.
        # Confirm the project/outputPath values in angular.json.
        baseDirectory: dist/ml-app/browser
        files:
          - '**/*'
      cache:
        paths:
          - node_modules/**/*

name: Deploy ML App

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  id-token: write

env:
  AWS_REGION: us-east-1
  NODE_VERSION: '22'

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      CDK_DEFAULT_ACCOUNT: '111111111111'
      CDK_DEFAULT_REGION: us-east-1
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: |
            frontend/package-lock.json
            infrastructure/package-lock.json
      - run: cd frontend && npm ci && npm run lint && npm run test:ci && npm run build:prod
      - run: cd infrastructure && npm ci && npm run build && npx cdk synth MLAppStack-Prod -c environment=prod

  deploy-infrastructure:
    needs: test
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    environment: production
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}
          role-session-name: github-ml-app-${{ github.run_id }}
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
          cache-dependency-path: infrastructure/package-lock.json
      - run: cd infrastructure && npm ci && npm run build
      - name: Deploy CDK stack
        run: |
          cd infrastructure
          npx cdk deploy MLAppStack-Prod \
            -c environment=prod \
            -c applicationOrigin='${{ vars.APPLICATION_ORIGIN }}' \
            -c cognitoDomainPrefix='${{ vars.COGNITO_DOMAIN_PREFIX }}' \
            --parameters ApprovedBedrockModelArn='${{ vars.APPROVED_BEDROCK_MODEL_ARN }}' \
            --parameters ClassifierEndpointName='${{ vars.CLASSIFIER_ENDPOINT_NAME }}' \
            --require-approval never

  release-frontend:
    needs: deploy-infrastructure
    environment: production
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_AMPLIFY_RELEASE_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}
      - run: >-
          aws amplify start-job
          --app-id '${{ vars.AMPLIFY_APP_ID }}'
          --branch-name main
          --job-type RELEASE

#!/usr/bin/env bash
# Usage: ./scripts/deploy.sh [dev|staging|prod] [region]
set -euo pipefail

ENVIRONMENT=${1:-dev}
REGION=${2:-us-east-1}

case "$ENVIRONMENT" in
  dev)     STACK_NAME='MLAppStack-Dev';     AMPLIFY_BRANCH='dev' ;;
  staging) STACK_NAME='MLAppStack-Staging'; AMPLIFY_BRANCH='staging' ;;
  prod)    STACK_NAME='MLAppStack-Prod';    AMPLIFY_BRANCH='main' ;;
  *) echo 'Error: environment must be dev, staging, or prod' >&2; exit 1 ;;
esac

: "${AMPLIFY_APP_ID:?Set AMPLIFY_APP_ID}"
: "${APPLICATION_ORIGIN:?Set APPLICATION_ORIGIN}"
: "${COGNITO_DOMAIN_PREFIX:?Set COGNITO_DOMAIN_PREFIX}"
: "${APPROVED_BEDROCK_MODEL_ARN:?Set APPROVED_BEDROCK_MODEL_ARN}"
: "${CLASSIFIER_ENDPOINT_NAME:?Set CLASSIFIER_ENDPOINT_NAME}"

export AWS_REGION="$REGION"
export CDK_DEFAULT_REGION="$REGION"

(
  cd infrastructure
  npm ci
  npm run build
  npx cdk deploy "$STACK_NAME" \
    -c environment="$ENVIRONMENT" \
    -c applicationOrigin="$APPLICATION_ORIGIN" \
    -c cognitoDomainPrefix="$COGNITO_DOMAIN_PREFIX" \
    --parameters ApprovedBedrockModelArn="$APPROVED_BEDROCK_MODEL_ARN" \
    --parameters ClassifierEndpointName="$CLASSIFIER_ENDPOINT_NAME" \
    --require-approval never
)

query_output() {
  aws cloudformation describe-stacks \
    --stack-name "$STACK_NAME" \
    --query "Stacks[0].Outputs[?OutputKey==\`$1\`].OutputValue | [0]" \
    --output text
}

API_URL=$(query_output ApiGatewayUrl)
USER_POOL_ID=$(query_output UserPoolId)
CLIENT_ID=$(query_output UserPoolClientId)
COGNITO_DOMAIN=$(query_output CognitoDomain)
API_SCOPE=$(query_output CognitoApiScope)

case "$ENVIRONMENT" in
  prod) ENV_FILE='frontend/src/environments/environment.prod.ts' ;;
  *)    ENV_FILE="frontend/src/environments/environment.${ENVIRONMENT}.ts" ;;
esac

IS_PROD=false
[[ "$ENVIRONMENT" == 'prod' ]] && IS_PROD=true

cat > "$ENV_FILE" <<EOF
export const environment = {
  production: ${IS_PROD},
  cognito: {
    userPoolId: '${USER_POOL_ID}',
    userPoolWebClientId: '${CLIENT_ID}',
    domain: '${COGNITO_DOMAIN}',
    region: '${REGION}',
    apiScope: '${API_SCOPE}',
  },
  api: {
    baseUrl: '${API_URL}',
    region: '${REGION}',
  },
} as const;
EOF

(
  cd frontend
  npm ci
  npm run "build:${ENVIRONMENT}"
)

aws amplify start-job \
  --app-id "$AMPLIFY_APP_ID" \
  --branch-name "$AMPLIFY_BRANCH" \
  --job-type RELEASE

echo "Deployment complete: $STACK_NAME"
echo "API URL: $API_URL"
echo "User pool: $USER_POOL_ID"