fix: use ALL3_ANY in preprod and prod

chrimesdev · chrimesdev · commit a0019e880e47 · 2025-09-25T16:31:58.000+01:00
diff --git a/application/CohortManager/src/Web/app/lib/auth.ts b/application/CohortManager/src/Web/app/lib/auth.ts
@@ -15,7 +15,7 @@ const NHS_CIS2: OAuthConfig<Profile> = {
   clientSecret: process.env.AUTH_CIS2_CLIENT_SECRET,
   authorization: {
     params: {
-      acr_values: "AAL2_OR_AAL3_ANY",
+      acr_values: process.env.AUTH_CIS2_ACR_VALUES || "AAL2_OR_AAL3_ANY",
       scope: "openid profile nationalrbacaccess",
       response_type: "code",
       max_age: 240, // 4 minutes [Required by CIS2]
diff --git a/infrastructure/tf-core/environments/preprod.tfvars b/infrastructure/tf-core/environments/preprod.tfvars
@@ -1204,6 +1204,7 @@ linux_web_app = {
           AUTH_TRUST_HOST      = "true"
           NEXTAUTH_URL         = "https://cohort-pre.screening.nhs.uk/api/auth"
           SERVICE_NAME         = "Cohort Manager"
+          AUTH_CIS2_ACR_VALUES = "AAL3_ANY"
         }
         from_key_vault = {
           # env_var_name           = "key_vault_secret_name"
diff --git a/infrastructure/tf-core/environments/production.tfvars b/infrastructure/tf-core/environments/production.tfvars
@@ -1240,6 +1240,7 @@ linux_web_app = {
           AUTH_TRUST_HOST      = "true"
           NEXTAUTH_URL         = "https://cohort.screening.nhs.uk/api/auth"
           SERVICE_NAME         = "Cohort Manager"
+          AUTH_CIS2_ACR_VALUES = "AAL3_ANY"
         }
         from_key_vault = {
           # env_var_name           = "key_vault_secret_name"

Original file line number	Diff line number	Diff line change
`@@ -1204,6 +1204,7 @@ linux_web_app = {`
`1204`	`1204`	`AUTH_TRUST_HOST = "true"`
`1205`	`1205`	`NEXTAUTH_URL = "https://cohort-pre.screening.nhs.uk/api/auth"`
`1206`	`1206`	`SERVICE_NAME = "Cohort Manager"`
	`1207`	`+ AUTH_CIS2_ACR_VALUES = "AAL3_ANY"`
`1207`	`1208`	`}`
`1208`	`1209`	`from_key_vault = {`
`1209`	`1210`	`# env_var_name = "key_vault_secret_name"`
Original file line number	Diff line number	Diff line change
`@@ -1240,6 +1240,7 @@ linux_web_app = {`
`1240`	`1240`	`AUTH_TRUST_HOST = "true"`
`1241`	`1241`	`NEXTAUTH_URL = "https://cohort.screening.nhs.uk/api/auth"`
`1242`	`1242`	`SERVICE_NAME = "Cohort Manager"`
	`1243`	`+ AUTH_CIS2_ACR_VALUES = "AAL3_ANY"`
`1243`	`1244`	`}`
`1244`	`1245`	`from_key_vault = {`
`1245`	`1246`	`# env_var_name = "key_vault_secret_name"`