feat(discord): add Terraform-managed base allowlist and admins

[CoderCoco]

Summary

Introduces a Terraform-managed baseline for Discord allowlists and admin lists that cannot be removed via the management UI. This allows operators to enforce a permanent floor of allowed guilds and admins while still permitting the UI to manage additional entries.

Key Changes

• New BaseDiscordConfig type in shared types representing the read-only Terraform baseline (allowedGuilds and admins)

• New DynamoDB row BASE#discord written by Terraform on every apply when any base list is non-empty, with three new Terraform variables:

  • base_allowed_guilds: Guild IDs permanently allowlisted
  • base_admin_user_ids: User IDs with permanent admin privileges
  • base_admin_role_ids: Role IDs with permanent admin privileges

• New getBaseDiscordConfig() function reads the BASE#discord row with strongly consistent reads, returning an empty base when absent

• New getEffectiveDiscordConfig() function merges the Terraform base and dynamic CONFIG#discord rows, deduplicating entries. This is now used by both Lambda handlers for permission checks

• Updated DiscordConfigService to:

  • Cache and load the base config separately with coalesced concurrent reads
  • Expose getBaseConfig() method for retrieving the base config
  • Prevent removal of guilds/admins that exist in the Terraform base (returns error with explanation)
  • Include base lists in the redacted config sent to the web client

• Updated REST API endpoints to return both dynamic and base lists:

  • GET /discord/guilds and GET /discord/admins now include baseGuilds and baseAdmins
  • DELETE /discord/guilds/:guildId returns 400 if the guild is in the base config
  • All mutation endpoints return the updated base lists alongside dynamic lists

• Updated Lambda handlers (interactions and followup) to use getEffectiveDiscordConfig() instead of getDiscordConfig() for permission checks, ensuring base entries are always enforced

Implementation Details

• Base config is cached in DiscordConfigService and invalidated alongside the dynamic config
• Terraform resource uses count to skip creation when all base lists are empty (UI-only deployments)
• Defensive parsing sanitizes malformed base data without throwing
• Web client can render base entries as locked/non-removable based on the new baseAllowedGuilds and baseAdmins fields in the redacted config

https://claude.ai/code/session_01GxkgH9sABMbHDCQqXehHP1

[Copilot]

Pull request overview

Adds a Terraform-managed “base” Discord configuration (immutable via UI) that is merged with the app-managed dynamic Discord config, so allowlisted guilds/admins can have an operator-enforced floor while still supporting UI-managed additions.

Changes:

• Introduces new Terraform variables and a DynamoDB BASE#discord row to persist base allowlist/admins on each terraform apply.
• Adds shared code to read the base row and produce an “effective” merged config, and updates Lambdas to use it for permission checks.
• Updates the management server/service/controller + shared types to surface base lists to the UI and prevent deleting base allowlisted guilds.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
terraform/variables.tf	Adds Terraform variables for base allowed guilds/admin user IDs/admin role IDs.
terraform/discord_store.tf	Writes the BASE#discord DynamoDB item (conditionally) from Terraform.
app/packages/shared/src/types.ts	Adds BaseDiscordConfig and extends RedactedDiscordConfig with base fields.
app/packages/shared/src/ddb/configStore.ts	Adds getBaseDiscordConfig() + getEffectiveDiscordConfig() to read/merge base + dynamic config.
app/packages/shared/src/ddb/configStore.test.ts	Adds coverage for base config parsing and effective merge behavior.
app/packages/server/src/services/DiscordConfigService.ts	Adds base config loading/caching, includes base in redacted config, blocks deleting base guilds.
app/packages/server/src/services/DiscordConfigService.test.ts	Updates mocks/tests for base config inclusion + base guild deletion refusal.
app/packages/server/src/controllers/discord.controller.ts	Extends guild/admin endpoints to return base lists; returns 400 on delete of base guild.
app/packages/lambda/interactions/src/handler.ts	Switches permission-read path to getEffectiveDiscordConfig().
app/packages/lambda/interactions/src/handler.test.ts	Updates mocks to match getEffectiveDiscordConfig() usage.
app/packages/lambda/followup/src/handler.ts	Switches permission-read path to getEffectiveDiscordConfig().
app/packages/lambda/followup/src/handler.test.ts	Updates mocks to match getEffectiveDiscordConfig() usage.

[Copilot]

PR title doesn't follow the required Conventional Commits format. Per CONTRIBUTING.md, the title becomes the squash-merge commit subject; please rename it to something like "feat(terraform): add Terraform-managed Discord base config" (optionally include a scope) and keep it under ~70 chars.

[CoderCoco]

Fixed — title updated to feat(discord): add Terraform-managed base allowlist and admins.

---

Generated by Claude Code

[Copilot]

DiscordConfigService caches the BASE#discord row indefinitely (until invalidateCache), but the base config can change via terraform apply without any app-side invalidation. This can leave the UI (and removeAllowedGuild's base check) using stale base lists until a server restart; consider not caching the base row, or adding a short TTL/refresh mechanism so it eventually reflects Terraform updates.

[CoderCoco]

Declined — the dynamic CONFIG#discord row has identical caching behaviour (cached until a write invalidates it) and the same stale-after-out-of-band-edit risk. The base config changes only on terraform apply, which is a deliberate infrastructure operation; an operator who just ran apply would restart the app or wait for the next natural invalidation. Adding TTL complexity for an event that happens a handful of times over the lifetime of a deployment isn't warranted.

---

Generated by Claude Code