Escalate Cognito auth-disabled log to error in production

[chnnick]

Currently the cognito module implementation throws warnings when there are missing cognito env variables, but still allows the app to run with auth off. This is a potential feature addition for throwing loud errors rather than warnings based on not only the existing variables, but if you are in a prod or dev environment. It was written in the README, but this just builds it out for us.

Stacked on #168. Base is 140-Cognito — it will retarget to main automatically once #168 merges.

Split out of #168 so that branch stays runnable with nothing new to track. This is the piece that asks downstream projects to manage an environment variable, and it is deliberately separate.

What this does

CognitoModule logs the "auth disabled" startup message at error level when NODE_ENV=production, and keeps the warn level otherwise. Running with auth off is a normal local workflow; in a deployed app it is almost always missing secrets.

Why it also touches example.env and the README

The check is inert on its own — nothing in this repo sets NODE_ENV:

• @nx/webpack builds node targets with mode: 'none' specifically so process.env.NODE_ENV is not inlined, so the compiled backend reads it from the runtime environment
• there are no deployment configs in the repo (no Dockerfile/compose/Procfile, ci-cd.yml is entirely commented out, and the build workflows don't set it)

So this introduces the variable: NODE_ENV=development in example.env, and a README section saying to set it in the deploy environment (ECS task definition, EB config, systemd unit) rather than a .env baked into the image.

Tests

Adds cognito.module.spec.ts — the module had no spec at all. Covers auth enabled, disabled in production, disabled in development, disabled with NODE_ENV unset, and partial Cognito config in production.

The unset case matters most: it is the default for every fresh clone, and it must stay a warning rather than an error. Jest sets NODE_ENV='test', so the spec deletes it explicitly.

Verified

Built the backend and booted it with the Cognito vars blank:

• node dist/apps/backend/main.js → WARN [CognitoModule] Cognito auth disabled...
• NODE_ENV=production node dist/apps/backend/main.js → ERROR [CognitoModule] Cognito auth disabled...

nx test backend passes (61 tests, 7 suites); nx lint backend clean.

Not included

CI workflows don't get NODE_ENV — they only build and test, so setting it there would make CI diverge from local runs for no benefit.

The [!WARNING] block in the README still documents the stronger option (throw on boot instead of logging) as the next step for a project that wants a misconfigured deploy to fail rather than run open.

🤖 Generated with Claude Code

[chnnick]

premature push by claude oops

Testing out feature I wrote in the README for requiring you to explicitly be in a dev environment to have a missing cognito env variable disable auth and only warn you. If in production, and by default, it should just fail outright should there be any missing cognito variables.