feat(infra): register the iOS app's sign-in callback on the phone client

[Lokesh7025]

What

Registers the iOS app's sign-in callback, ai.observal.axl://auth/callback, on the phone page's Cognito app client, next to the page's own https://<domain>/remote/.

Why

An iOS app for remote control is being built. Google refuses OAuth inside an embedded web view (disallowed_useragent), so the app has to sign in through ASWebAuthenticationSession, which returns to the app's own URL scheme. Cognito rejects any redirect that is not registered on the client.

The app uses the same client as the page rather than a new one, because the control plane recognises phone tokens by that client ID and grants them the phone scope only (pairing, device enrollment, device relay tickets, the witness). A separate client would need control-plane changes and would be a second phone identity to review.

What does not change

• No new client, scope, flow, or identity provider. Still authorization code with PKCE, public client, no secret.
• Token lifetimes, revocation, and the remote group opt-in are unchanged. An app sign-in by someone outside the group is refused exactly as on the page.
• The daemon client and its loopback callback are untouched.

Deploy

deploy.sh updates the phone client in place (callback_urls and logout_urls). Existing page sign-ins and refresh tokens keep working.

Checks

• terraform fmt -check passes.
• README's production-mode section names the new callback.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: cff7b7a5-9015-45a0-88ae-cb46a4cb4ddb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None