@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/adapter/Api/Platform_UIFragments_Lambda.res.mjs

@@ -0,0 +1,245 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
+
+function makeHandlerCode(param) {
+  return `
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+const TABLE = process.env.UI_FRAGMENT_RM_TABLE;
+
+export async function handler() {
+  if (!TABLE) {
+    console.error("Platform_UIFragments: UI_FRAGMENT_RM_TABLE env var not set");
+    return [];
+  }
+  const items = [];
+  let exclusiveStartKey;
+  do {
+    const out = await client.send(new ScanCommand({
+      TableName: TABLE,
+      Limit: 1000,
+      ExclusiveStartKey: exclusiveStartKey,
+    }));
+    if (out.Items) items.push(...out.Items);
+    exclusiveStartKey = out.LastEvaluatedKey;
+  } while (exclusiveStartKey);
+
+  // Platform invariant: one version per plugin at a time, so the UI sees just
+  // the bare plugin name (mirrors ReventlessCore.Plugin.name). UIFragmentRegistry
+  // accumulates one row per deployed plugin version and carries no lifecycle
+  // status of its own, so without deduping a redeployed federation plugin would
+  // surface duplicate fragments. Collapse to the highest version per plugin name
+  // (mirrors ReventlessCore.Plugin.compareVersions).
+  const cmpVer = (a, b) => {
+    const pa = String(a).replace(/[-+]/g, ".").split(".");
+    const pb = String(b).replace(/[-+]/g, ".").split(".");
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+      const sa = pa[i] ?? "", sb = pb[i] ?? "";
+      const na = Number(sa), nb = Number(sb);
+      const bothNum = sa !== "" && sb !== "" && !Number.isNaN(na) && !Number.isNaN(nb);
+      if (bothNum) { if (na !== nb) return na > nb ? 1 : -1; }
+      else if (sa !== sb) return sa > sb ? 1 : -1;
+    }
+    return 0;
+  };
+  const latestByName = new Map();
+  for (const item of items) {
+    if (!item || !item.pluginId || !item.remoteEntryUrl) continue;
+    const name = String(item.pluginId).split("@")[0];
+    const version = String(item.pluginId).split("@")[1] ?? "";
+    const prev = latestByName.get(name);
+    if (!prev || cmpVer(version, prev.version) > 0) {
+      latestByName.set(name, {
+        version,
+        entry: {
+          pluginId: name,
+          remoteEntryUrl: item.remoteEntryUrl,
+          panels: item.panels || [],
+          pages: item.pages || [],
+          registeredAt: item.registeredAt || "",
+          updatedAt: item.updatedAt || "",
+        },
+      });
+    }
+  }
+  return [...latestByName.values()].map(v => v.entry);
+}
+`;
+}
+
+let resolverCode = `
+import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  return { operation: 'Invoke', payload: {} };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function make(api, uiFragmentRegistryTableName, opts) {
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let name = "PlatformUIFragments";
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), opts$1);
+  uiFragmentRegistryTableName.apply(tableName => {
+    new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
+        {
+          Sid: "AllowLambdaLogging",
+          Effect: "Allow",
+          Action: "logs:*",
+          Resource: "arn:aws:logs:*:*:*"
+        },
+        {
+          Sid: "AllowScanUIFragmentRegistryRm",
+          Effect: "Allow",
+          Action: ["dynamodb:Scan"],
+          Resource: "arn:aws:dynamodb:*:*:table/" + tableName
+        }
+      ])),
+      role: lambdaRole.id
+    }, opts$1);
+  });
+  let archiveContents = {};
+  let handlerCodeStub = `
+import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
+import { DynamoDBDocumentClient, ScanCommand } from "@aws-sdk/lib-dynamodb";
+
+const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
+const TABLE = process.env.UI_FRAGMENT_RM_TABLE;
+
+export async function handler() {
+  if (!TABLE) {
+    console.error("Platform_UIFragments: UI_FRAGMENT_RM_TABLE env var not set");
+    return [];
+  }
+  const items = [];
+  let exclusiveStartKey;
+  do {
+    const out = await client.send(new ScanCommand({
+      TableName: TABLE,
+      Limit: 1000,
+      ExclusiveStartKey: exclusiveStartKey,
+    }));
+    if (out.Items) items.push(...out.Items);
+    exclusiveStartKey = out.LastEvaluatedKey;
+  } while (exclusiveStartKey);
+
+  // Platform invariant: one version per plugin at a time, so the UI sees just
+  // the bare plugin name (mirrors ReventlessCore.Plugin.name). UIFragmentRegistry
+  // accumulates one row per deployed plugin version and carries no lifecycle
+  // status of its own, so without deduping a redeployed federation plugin would
+  // surface duplicate fragments. Collapse to the highest version per plugin name
+  // (mirrors ReventlessCore.Plugin.compareVersions).
+  const cmpVer = (a, b) => {
+    const pa = String(a).replace(/[-+]/g, ".").split(".");
+    const pb = String(b).replace(/[-+]/g, ".").split(".");
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+      const sa = pa[i] ?? "", sb = pb[i] ?? "";
+      const na = Number(sa), nb = Number(sb);
+      const bothNum = sa !== "" && sb !== "" && !Number.isNaN(na) && !Number.isNaN(nb);
+      if (bothNum) { if (na !== nb) return na > nb ? 1 : -1; }
+      else if (sa !== sb) return sa > sb ? 1 : -1;
+    }
+    return 0;
+  };
+  const latestByName = new Map();
+  for (const item of items) {
+    if (!item || !item.pluginId || !item.remoteEntryUrl) continue;
+    const name = String(item.pluginId).split("@")[0];
+    const version = String(item.pluginId).split("@")[1] ?? "";
+    const prev = latestByName.get(name);
+    if (!prev || cmpVer(version, prev.version) > 0) {
+      latestByName.set(name, {
+        version,
+        entry: {
+          pluginId: name,
+          remoteEntryUrl: item.remoteEntryUrl,
+          panels: item.panels || [],
+          pages: item.pages || [],
+          registeredAt: item.registeredAt || "",
+          updatedAt: item.updatedAt || "",
+        },
+      });
+    }
+  }
+  return [...latestByName.values()].map(v => v.entry);
+}
+`;
+  archiveContents["index.mjs"] = new (Pulumi.asset.StringAsset)(handlerCodeStub);
+  let code = new (Pulumi.asset.AssetArchive)(archiveContents);
+  let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(handlerCodeStub);
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let lambda = new (Aws.lambda.Function)(name + "Lambda", {
+    handler: "index.handler",
+    runtime: "nodejs22.x",
+    code: code,
+    role: lambdaRole.arn,
+    memorySize: 512,
+    timeout: 30,
+    layers: layers,
+    tags: AWS_Tags$ReventlessAws.make(name + "Lambda", ReadModel$ReventlessCore.componentType),
+    environment: {
+      variables: Object.fromEntries([
+        [
+          "Environment",
+          Pulumi.getStack()
+        ],
+        [
+          "UI_FRAGMENT_RM_TABLE",
+          uiFragmentRegistryTableName
+        ]
+      ])
+    },
+    sourceCodeHash: sourceCodeHash
+  }, opts$1);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), opts$1);
+  Pulumi.all([
+    lambda.arn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeLambda",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts$1);
+  });
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambda.arn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts$1);
+  AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "Resolver", api, dataSource.name, "Query", "Platform_UIFragments", resolverCode, opts$1);
+}
+
+export {
+  makeHandlerCode,
+  resolverCode,
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/Auth/Auth_Cognito.res

@@ -0,0 +1,209 @@
+// AWS Cognito `Auth_Adapter.Provider` implementation.
+//
+// Two runtime entry points:
+//
+//   * `authenticate` — pure header-driven path (HTTP Lambda Function URL,
+//     API Gateway, MCP). Decodes the JWT claims from the
+//     `Authorization: Bearer <token>` header WITHOUT signature verification.
+//     The Cognito-authenticated AppSync API verifies the JWT before the
+//     resolver Lambda runs, so this path trusts the caller's transport
+//     guarantees.
+//
+//   * `fromAppSyncIdentity` — AppSync-resolver path. Reads the
+//     already-validated identity context attached by AppSync to the
+//     resolver event (`event.identity`). Recognises both the Cognito
+//     UserPool shape (`sub`, `username`, `claims['cognito:groups']`) and
+//     the AWS_IAM additional-provider shape (`userArn`, `accountId`) used
+//     by server-to-server lambdas signed via the existing IAM role.
+//
+// Deploy-time `make` delegates to `Platform_Stack.resolveCognitoUserPool`
+// (cached internally so multiple callers — e.g. a future direct invocation
+// from `Platform.MakeWithConfig` plus the existing call from app
+// `Main.res` — converge on the same resource set).
+
+open Reventless
+
+// ── Shared JWT claims decode ──────────────────────────────────────────────
+//
+// AppSync's userPoolConfig verifies the JWT signature on every request
+// before invoking the resolver Lambda, so the runtime path only needs to
+// read the claims. MCP_Lambda's `extractIdentity` follows the same
+// pattern; this implementation is kept compatible.
+
+let _decodeJwtClaims: string => option<'a> = %raw(`
+  function(token) {
+    try {
+      var parts = token.split(".");
+      if (parts.length < 2) return undefined;
+      var base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+      var json = Buffer.from(base64, "base64").toString("utf8");
+      return JSON.parse(json);
+    } catch(_) { return undefined; }
+  }
+`)
+
+let _bearerToken = (header: string): option<string> =>
+  if header->String.startsWith("Bearer ") {
+    Some(header->String.slice(~start=7, ~end=header->String.length)->String.trim)
+  } else {
+    None
+  }
+
+let _getHeader = (headers: dict<string>, name: string): option<string> =>
+  // Headers are normalised to lowercase by transport adapters before reaching
+  // the provider (graphql-yoga and AppSync Lambda integration both do this).
+  // We tolerate either case here.
+  switch headers->Dict.get(name->String.toLowerCase) {
+  | Some(v) => Some(v)
+  | None => headers->Dict.get(name)
+  }
+
+let _identityFromClaims = (claims: 'a): Identity.t => {
+  let claimsDict: dict<JSON.t> = claims->Obj.magic
+  let userId =
+    claimsDict
+    ->Dict.get("sub")
+    ->Option.flatMap(JSON.Decode.string)
+    ->Option.getOr("anonymous")
+  let username =
+    claimsDict
+    ->Dict.get("cognito:username")
+    ->Option.orElse(claimsDict->Dict.get("username"))
+    ->Option.flatMap(JSON.Decode.string)
+    ->Option.getOr(userId)
+  let groups: array<string> =
+    claimsDict
+    ->Dict.get("cognito:groups")
+    ->Option.map(g => g->Obj.magic)
+    ->Option.getOr([])
+  {
+    Identity.userId,
+    username,
+    groups,
+    provider: Cognito,
+  }
+}
+
+// ── Provider implementation ───────────────────────────────────────────────
+
+type authConfig = {
+  userPoolId: string,
+  userPoolArn: string,
+  clientId: string,
+  region: string,
+}
+
+let authenticate = async (
+  ctx: ReventlessCore.Auth_Adapter.requestContext,
+): Identity.authResult => {
+  let token =
+    _getHeader(ctx.headers, "Authorization")->Option.flatMap(_bearerToken)
+  switch token {
+  | None => Anonymous
+  | Some(t) =>
+    switch _decodeJwtClaims(t) {
+    | None => AuthError("malformed bearer token")
+    | Some(claims) => Authenticated(_identityFromClaims(claims))
+    }
+  }
+}
+
+// ── AppSync resolver-event path ───────────────────────────────────────────
+//
+// AppSync resolver Lambdas receive `event.identity` already populated with
+// validated identity data. For the Cognito User Pools auth path the shape is
+// `{sub, username, claims, issuer, sourceIp, defaultAuthStrategy, groups?}`.
+// For the AWS_IAM additional-provider path the shape is
+// `{userArn, accountId, cognitoIdentityPoolId?, cognitoIdentityId?, sourceIp,
+// username, userArn}`. The two are disambiguated by the presence of `sub`.
+
+type appSyncIdentity = {
+  sub?: string,
+  username?: string,
+  claims?: dict<JSON.t>,
+  issuer?: string,
+  userArn?: string,
+  accountId?: string,
+}
+
+/** Build an `Identity.authResult` from the AppSync resolver event identity
+    block. Pass `event.identity` directly (or `None` if absent). */
+let fromAppSyncIdentity = (id: option<appSyncIdentity>): Identity.authResult =>
+  switch id {
+  | None => Anonymous
+  | Some(identity) =>
+    switch identity.sub {
+    | Some(sub) =>
+      // Cognito User Pools — read claims, fall back to top-level fields when
+      // the gateway omitted `claims` (e.g. APPSYNC_JS pipelined invocations).
+      let rawClaims = identity.claims->Option.getOr(Dict.make())
+      let username =
+        rawClaims
+        ->Dict.get("cognito:username")
+        ->Option.orElse(rawClaims->Dict.get("username"))
+        ->Option.flatMap(JSON.Decode.string)
+        ->Option.orElse(identity.username)
+        ->Option.getOr(sub)
+      let groups: array<string> =
+        rawClaims
+        ->Dict.get("cognito:groups")
+        ->Option.map(g => g->Obj.magic)
+        ->Option.getOr([])
+      // Identity.claims is `dict<string>` — stringify any non-string JSON
+      // value so the shape downstream consumers see is uniform.
+      let claims =
+        rawClaims
+        ->Dict.toArray
+        ->Array.map(((k, v)) => (
+          k,
+          v->JSON.Decode.string->Option.getOr(v->JSON.stringify),
+        ))
+        ->Dict.fromArray
+      Authenticated({
+        userId: sub,
+        username,
+        groups,
+        claims,
+        provider: Cognito,
+      })
+    | None =>
+      switch identity.userArn {
+      | Some(arn) =>
+        // AWS_IAM additional-provider — server-to-server. Encode the role
+        // ARN as userId and tag with a `Custom("aws-iam")` provider so
+        // downstream authorization can distinguish from human Cognito users.
+        Authenticated({
+          userId: arn,
+          username: identity.username->Option.getOr(arn),
+          groups: [],
+          provider: Custom("aws-iam"),
+        })
+      | None => Anonymous
+      }
+    }
+  }
+
+// ── Deploy-time wiring ────────────────────────────────────────────────────
+//
+// `Platform_Stack.resolveCognitoUserPool` performs the actual UserPool +
+// UserPoolClient provisioning and exports the resulting ids/arn/region as
+// stack outputs. It caches its result internally so this can be called from
+// both `Main.res` and `Auth_Cognito.make` (e.g. Stage D2 AppSync wiring)
+// without re-running resource registration or duplicating exports.
+
+let make = (
+  ~name as _: string,
+  ~opts as _: option<Pulumi.ComponentResource.options>=?,
+): Pulumi.Output.t<authConfig> => {
+  let pool = Platform_Stack.resolveCognitoUserPool()
+  let regionStr =
+    Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->Option.getOr("unknown")
+  (pool.poolId, pool.poolArn, pool.clientId)
+  ->Pulumi.Output.all3
+  ->Pulumi.Output.apply(((userPoolId, userPoolArn, clientId)) => {
+    userPoolId,
+    userPoolArn,
+    clientId,
+    region: regionStr,
+  })
+}

package/src/adapter/Auth/Auth_Cognito.res.mjs

@@ -0,0 +1,135 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Platform_Stack$ReventlessAws from "../../Platform_Stack.res.mjs";
+
+let _decodeJwtClaims = (function(token) {
+    try {
+      var parts = token.split(".");
+      if (parts.length < 2) return undefined;
+      var base64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+      var json = Buffer.from(base64, "base64").toString("utf8");
+      return JSON.parse(json);
+    } catch(_) { return undefined; }
+  });
+
+function _bearerToken(header) {
+  if (header.startsWith("Bearer ")) {
+    return header.slice(7, header.length).trim();
+  }
+}
+
+function _getHeader(headers, name) {
+  let v = headers[name.toLowerCase()];
+  if (v !== undefined) {
+    return v;
+  } else {
+    return headers[name];
+  }
+}
+
+function _identityFromClaims(claims) {
+  let userId = Stdlib_Option.getOr(Stdlib_Option.flatMap(claims["sub"], Stdlib_JSON.Decode.string), "anonymous");
+  let username = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.orElse(claims["cognito:username"], claims["username"]), Stdlib_JSON.Decode.string), userId);
+  let groups = Stdlib_Option.getOr(Stdlib_Option.map(claims["cognito:groups"], g => g), []);
+  return {
+    userId: userId,
+    username: username,
+    groups: groups,
+    provider: "Cognito"
+  };
+}
+
+async function authenticate(ctx) {
+  let token = Stdlib_Option.flatMap(_getHeader(ctx.headers, "Authorization"), _bearerToken);
+  if (token === undefined) {
+    return "Anonymous";
+  }
+  let claims = _decodeJwtClaims(token);
+  if (claims !== undefined) {
+    return {
+      TAG: "Authenticated",
+      _0: _identityFromClaims(Primitive_option.valFromOption(claims))
+    };
+  } else {
+    return {
+      TAG: "AuthError",
+      _0: "malformed bearer token"
+    };
+  }
+}
+
+function fromAppSyncIdentity(id) {
+  if (id === undefined) {
+    return "Anonymous";
+  }
+  let sub = id.sub;
+  if (sub !== undefined) {
+    let rawClaims = Stdlib_Option.getOr(id.claims, {});
+    let username = Stdlib_Option.getOr(Stdlib_Option.orElse(Stdlib_Option.flatMap(Stdlib_Option.orElse(rawClaims["cognito:username"], rawClaims["username"]), Stdlib_JSON.Decode.string), id.username), sub);
+    let groups = Stdlib_Option.getOr(Stdlib_Option.map(rawClaims["cognito:groups"], g => g), []);
+    let claims = Object.fromEntries(Object.entries(rawClaims).map(param => {
+      let v = param[1];
+      return [
+        param[0],
+        Stdlib_Option.getOr(Stdlib_JSON.Decode.string(v), JSON.stringify(v))
+      ];
+    }));
+    return {
+      TAG: "Authenticated",
+      _0: {
+        userId: sub,
+        username: username,
+        groups: groups,
+        claims: claims,
+        provider: "Cognito"
+      }
+    };
+  }
+  let arn = id.userArn;
+  if (arn !== undefined) {
+    return {
+      TAG: "Authenticated",
+      _0: {
+        userId: arn,
+        username: Stdlib_Option.getOr(id.username, arn),
+        groups: [],
+        provider: {
+          TAG: "Custom",
+          _0: "aws-iam"
+        }
+      }
+    };
+  } else {
+    return "Anonymous";
+  }
+}
+
+function make(param, param$1) {
+  let pool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
+  let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
+  return Pulumi.all([
+    pool.poolId,
+    pool.poolArn,
+    pool.clientId
+  ]).apply(param => ({
+    userPoolId: param[0],
+    userPoolArn: param[1],
+    clientId: param[2],
+    region: regionStr
+  }));
+}
+
+export {
+  _decodeJwtClaims,
+  _bearerToken,
+  _getHeader,
+  _identityFromClaims,
+  authenticate,
+  fromAppSyncIdentity,
+  make,
+}
+/* @pulumi/pulumi Not a pure module */

package/src/adapter/CommandGenerator/CommandGeneratorResolvers.res

@@ -0,0 +1,2 @@
+module AppSync = CommandGeneratorResolvers_AppSync
+module AppSync_Runtime = CommandGeneratorResolvers_AppSync_Runtime

package/src/adapter/CommandGenerator/CommandGeneratorResolvers.res.mjs

@@ -0,0 +1,12 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let AppSync;
+
+let AppSync_Runtime;
+
+export {
+  AppSync,
+  AppSync_Runtime,
+}
+/* No side effect */