Tradekartauth

TradeKart authentication package for private tools.

System Design

Your service calls one object, TradeKartAuth. It hands the token to TokenVerifier, which checks it against Cognito's public keys. Once the token's confirmed real, rbac.py reads the token's group and answers "which role is this?" and "can this role do X?". ssm_config.py is optional — only used at startup if you'd rather load the pool id/region from AWS SSM instead of hardcoding them.

CDK pipeline: if a stage fails

cdk deploy only creates CodePipeline; failures after that happen inside AWS (Synth, UpdatePipeline, or Publish).

1. Open CodePipeline → TradekartAuthPipeline → click the failed execution → open the failed stage (red).
2. Open Details / View in CodeBuild and read the log tail (the last error line is what matters).

Secret format: TWINE_PASSWORD must be the raw PyPI token (pypi-Ag...). If you stored JSON in Secrets Manager, either switch to plaintext or adjust the pipeline to parse JSON.

After changing infra/lib/pipeline-stack.ts, run cd infra && npm run build && npx cdk deploy ... again to update the pipeline.