@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/Platform_Casts.res

@@ -0,0 +1,106 @@
+// Platform_Casts — typed identity coercions used by Platform.MakeWithConfig.
+//
+// Every cast here is a `%identity` external: zero runtime cost, the value passes
+// through unchanged. The coercions are necessary because two independent
+// architectural constraints prevent the type system from expressing the correct
+// concrete type at the boundaries where these values flow.
+//
+// ─────────────────────────────────────────────────────────────────────────────
+// WHY CASTS ARE NEEDED AT ALL
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// The Reventless package hierarchy is:
+//
+//   reventless-spec
+//       └── reventless (core)
+//               └── reventless-aws
+//
+// `reventless-core` defines the platform hook interface (`platformHooks`) that
+// AWS, in-memory, and any future provider all implement. Because `reventless-core`
+// sits *below* `reventless-aws` in the dependency graph, it cannot import AWS
+// types such as `Util.Lambda.runtimeParts`, `DcbEventLog.component`, or
+// `Util.SQS.channelParts`. Hook callbacks therefore use `unknown` (or a generic
+// parameter) at the boundary where `reventless-core` hands values to the
+// provider. The AWS platform is the only caller and always passes the right
+// type, but the type system cannot see through the abstraction layer.
+//
+// The alternative — making `platformHooks` fully generic over every AWS-specific
+// type — would thread extra type parameters through Plugin_Builder, Admin, and
+// every functor that touches hooks. The type noise would dwarf the safety gain.
+//
+// ─────────────────────────────────────────────────────────────────────────────
+// CAST 1 — runtime environment type parameter
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// `inboundAppSyncResolverParams` and `dcbAppSyncResolverParams` (defined in
+// Plugin_Helpers.res) carry:
+//
+//   runtime: Runtime.environment<unknown>
+//
+// The hook boundary erases the concrete parts type to `unknown` because
+// `reventless-core` cannot reference `Util.Lambda.runtimeParts`. At runtime
+// the AWS platform always passes a genuine `Runtime.environment<runtimeParts>`,
+// so narrowing the type parameter is safe.
+//
+// The "proper" fix — `inboundAppSyncResolverParams<'runtimeParts>` — would
+// require propagating `'runtimeParts` through `platformHooks`, `Plugin_Builder`,
+// and `Admin`.
+external asLambdaRuntime: ReventlessCore.Runtime.environment<unknown> => ReventlessCore.Runtime.environment<Util.Lambda.runtimeParts> = "%identity"
+
+// ─────────────────────────────────────────────────────────────────────────────
+// CAST 2 — hook callback arguments (unknown → concrete component types)
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// The deployment lifecycle hooks in `platformHooks`:
+//
+//   onDcbEventLogCreated?:       unknown => unit
+//   onDcbCommandTopicCreated?:   unknown => unit
+//   onDcbSlicesCreated?:         unknown => unit
+//   onHeartbeatEpChannelAvailable?: (unknown, ~pluginId: string) => unit
+//
+// are typed `unknown => unit` for the same dependency-inversion reason as above:
+// `reventless-core` cannot import `DcbEventLog.component`, `CommandTopic.component`,
+// or `CommandTopic_Adapter.remoteChannel`. The AWS platform registers these
+// callbacks and is the only caller, always passing the correct concrete value.
+external asDcbEventLogComponent: unknown => ReventlessCore.Component.t<unit, ReventlessCore.DcbEventLog.outputs, unit> = "%identity"
+external asDcbCommandTopicComponent: unknown => ReventlessCore.CommandTopic.component<unit> = "%identity"
+external asDcbEventLog: unknown => ReventlessCore.DcbEventLog.component = "%identity"
+external asRemoteChannel: unknown => ReventlessCore.CommandTopic_Adapter.remoteChannel = "%identity"
+
+// ─────────────────────────────────────────────────────────────────────────────
+// CAST 3 — generic adapter channel parts
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// `CommandTopic_Adapter.channel` carries:
+//
+//   parts: 'channelParts   (generic — provider fills this in)
+//
+// The adapter interface is provider-agnostic so the field is left generic.
+// The AWS adapter always stores a `Util.SQS.channelParts` value there.
+// Threading `'channelParts` through the adapter interface and all its callers
+// would be a large, noisy change for a single specialisation.
+external asSqsChannelParts: 'a => Util.SQS.channelParts = "%identity"
+
+// ─────────────────────────────────────────────────────────────────────────────
+// CAST 4 — Pulumi Output Proxy vs. ReScript option boxing
+// ─────────────────────────────────────────────────────────────────────────────
+//
+// This cast is categorically different: it is a *runtime hazard*, not a type
+// system limitation.
+//
+// `Pulumi.Output.t<'a>` values are ES6 Proxy objects. ReScript's option encoding
+// uses a sentinel property `BS_PRIVATE_NESTED_SOME_NONE` to distinguish
+// `Some(Some(x))` from `Some(x)`. When a Proxy is placed directly inside
+// `Some(pulumiOutput)`, the Proxy intercepts the sentinel property lookup and
+// can return an unexpected result, silently corrupting the None/Some distinction
+// at runtime.
+//
+// The `{val: x}` wrapper (`hookedValue<unknown>`) avoids this by never placing
+// the Proxy directly in the option slot. The concrete type is recovered via
+// `Obj.magic` in `Plugin_Builder` where the provider-specific type is known.
+//
+// There is no type-level fix because the problem does not exist at the type
+// level — it is a mismatch between ReScript's JS boxing convention and Pulumi's
+// Proxy-based lazy evaluation model.
+external _toUnknown: 'a => unknown = "%identity"
+let wrapHookedValue: 'a => ReventlessCore.Plugin_Helpers.hookedValue<unknown> = x => {val: x->_toUnknown}

package/src/Platform_Casts.res.mjs

@@ -0,0 +1,13 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function wrapHookedValue(x) {
+  return {
+    val: x
+  };
+}
+
+export {
+  wrapHookedValue,
+}
+/* No side effect */

package/src/Platform_Stack.res

@@ -0,0 +1,153 @@
+// Platform-level stack helpers — for resources that belong to the platform
+// stack (not per-plugin) such as the Cognito UserPool used by every API.
+
+type cognitoUserPool = {
+  poolId: Pulumi.Output.t<string>,
+  clientId: Pulumi.Output.t<string>,
+  poolArn: Pulumi.Output.t<string>,
+  managed: bool,
+}
+
+/**
+ * Resolve the Cognito UserPool used by AppSync auth. Two modes:
+ *
+ * - **Auto**: no `platform:cognitoUserPoolId` config — create a fresh UserPool
+ *   with SPA-friendly defaults (email username, 12-char password policy, no
+ *   MFA, admin-only user creation). Caller is responsible for creating
+ *   groups (`Admin`, `User`, …) and users via the AWS console / CLI.
+ *
+ * - **BYO**: pool ID provided — skip pool creation, look up the existing
+ *   pool via `aws.cognito.getUserPool` for its ARN. Lookup precedence
+ *   (highest → lowest):
+ *     1. `REVENTLESS_COGNITO_USER_POOL_ID` env var (typically a CI secret).
+ *     2. `Pulumi.local.yaml` sidecar key `cognitoUserPoolId` (gitignored;
+ *        per-dev override).
+ *     3. `platform:cognitoUserPoolId` in the checked-in `Pulumi.<stack>.yaml`.
+ *
+ * In both modes the framework owns the `UserPoolClient` (SPA settings would
+ * not reliably exist on a pre-existing client; the client is a child resource
+ * Pulumi can destroy without touching the parent pool).
+ *
+ * Always exports `cognitoUserPoolId`, `cognitoUserPoolClientId`,
+ * `cognitoUserPoolArn`, `cognitoRegion`, and `cognitoUserPoolManaged` as
+ * stack outputs so downstream stacks (and Stage D AppSync wiring) can read
+ * them via `StackReference`.
+ */
+let _resolveUncached = (): cognitoUserPool => {
+  let cfg = Pulumi.Config.make(Some("platform"))
+  let existingPoolId = switch Util_LocalConfig.get("cognitoUserPoolId") {
+  | Some(_) as v => v
+  | None => cfg->Pulumi.Config.get("cognitoUserPoolId")
+  }
+
+  let result = switch existingPoolId {
+  | Some(poolId) =>
+    let tokenUnits: PulumiAws.Cognito.UserPoolClient.tokenValidityUnits = {
+      accessToken: Pulumi.Input.make("minutes"),
+      idToken: Pulumi.Input.make("minutes"),
+      refreshToken: Pulumi.Input.make("days"),
+    }
+    let client = PulumiAws.Cognito.UserPoolClient.make(
+      ~name="HostUiClient",
+      ~args={
+        userPoolId: Pulumi.Input.make(poolId),
+        generateSecret: Pulumi.Input.make(false),
+        explicitAuthFlows: Pulumi.Input.make([
+          Pulumi.Input.make("ALLOW_USER_PASSWORD_AUTH"),
+          Pulumi.Input.make("ALLOW_REFRESH_TOKEN_AUTH"),
+        ]),
+        preventUserExistenceErrors: Pulumi.Input.make("ENABLED"),
+        idTokenValidity: Pulumi.Input.make(60),
+        accessTokenValidity: Pulumi.Input.make(60),
+        refreshTokenValidity: Pulumi.Input.make(30),
+        tokenValidityUnits: Pulumi.Input.make(tokenUnits),
+      },
+    )
+
+    let lookup = PulumiAws.Cognito.UserPool.getUserPoolOutput(~args={userPoolId: poolId})
+
+    {
+      poolId: Pulumi.Output.make(poolId),
+      clientId: client.id,
+      poolArn: lookup->Pulumi.Output.apply(r => r.arn),
+      managed: false,
+    }
+
+  | None =>
+    let adminConfig: PulumiAws.Cognito.UserPool.adminCreateUserConfig = {
+      allowAdminCreateUserOnly: Pulumi.Input.make(true),
+    }
+    let pwdPolicy: PulumiAws.Cognito.UserPool.passwordPolicy = {
+      minimumLength: Pulumi.Input.make(12),
+      requireLowercase: Pulumi.Input.make(true),
+      requireUppercase: Pulumi.Input.make(true),
+      requireNumbers: Pulumi.Input.make(true),
+    }
+    let pool = PulumiAws.Cognito.UserPool.make(
+      ~name="HostUiPool",
+      ~args={
+        adminCreateUserConfig: Pulumi.Input.make(adminConfig),
+        usernameAttributes: Pulumi.Input.make([Pulumi.Input.make("email")]),
+        passwordPolicy: Pulumi.Input.make(pwdPolicy),
+        mfaConfiguration: Pulumi.Input.make("OFF"),
+      },
+    )
+
+    let tokenUnits2: PulumiAws.Cognito.UserPoolClient.tokenValidityUnits = {
+      accessToken: Pulumi.Input.make("minutes"),
+      idToken: Pulumi.Input.make("minutes"),
+      refreshToken: Pulumi.Input.make("days"),
+    }
+    let client = PulumiAws.Cognito.UserPoolClient.make(
+      ~name="HostUiClient",
+      ~args={
+        userPoolId: pool.id->Pulumi.Output.asInput,
+        generateSecret: Pulumi.Input.make(false),
+        explicitAuthFlows: Pulumi.Input.make([
+          Pulumi.Input.make("ALLOW_USER_PASSWORD_AUTH"),
+          Pulumi.Input.make("ALLOW_REFRESH_TOKEN_AUTH"),
+        ]),
+        preventUserExistenceErrors: Pulumi.Input.make("ENABLED"),
+        idTokenValidity: Pulumi.Input.make(60),
+        accessTokenValidity: Pulumi.Input.make(60),
+        refreshTokenValidity: Pulumi.Input.make(30),
+        tokenValidityUnits: Pulumi.Input.make(tokenUnits2),
+      },
+    )
+
+    {
+      poolId: pool.id,
+      clientId: client.id,
+      poolArn: pool.arn,
+      managed: true,
+    }
+  }
+
+  let regionStr =
+    Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->Option.getOr("unknown")
+
+  Pulumi.Pulumi.export("cognitoUserPoolId", result.poolId)
+  Pulumi.Pulumi.export("cognitoUserPoolClientId", result.clientId)
+  Pulumi.Pulumi.export("cognitoUserPoolArn", result.poolArn)
+  Pulumi.Pulumi.export("cognitoRegion", Pulumi.Output.make(regionStr))
+  Pulumi.Pulumi.export(
+    "cognitoUserPoolManaged",
+    Pulumi.Output.make(result.managed ? "true" : "false"),
+  )
+
+  result
+}
+
+// Process-level cache so multiple callers (Main.res + Auth_Cognito.make from
+// inside Platform.MakeWithConfig) converge on the same pool/client and the
+// stack-export calls happen exactly once per Pulumi run.
+let _cached: ref<option<cognitoUserPool>> = ref(None)
+
+let resolveCognitoUserPool = (): cognitoUserPool =>
+  switch _cached.contents {
+  | Some(p) => p
+  | None =>
+    let p = _resolveUncached()
+    _cached := Some(p)
+    p
+  }

package/src/Platform_Stack.res.mjs

@@ -0,0 +1,121 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
+
+function _resolveUncached() {
+  let cfg = new Pulumi.Config("platform");
+  let v = Util_LocalConfig$ReventlessAws.get("cognitoUserPoolId");
+  let existingPoolId = v !== undefined ? v : cfg.get("cognitoUserPoolId");
+  let result;
+  if (existingPoolId !== undefined) {
+    let tokenUnits_accessToken = "minutes";
+    let tokenUnits_idToken = "minutes";
+    let tokenUnits_refreshToken = "days";
+    let tokenUnits = {
+      accessToken: tokenUnits_accessToken,
+      idToken: tokenUnits_idToken,
+      refreshToken: tokenUnits_refreshToken
+    };
+    let client = new (Aws.cognito.UserPoolClient)("HostUiClient", {
+      userPoolId: existingPoolId,
+      generateSecret: false,
+      explicitAuthFlows: [
+        "ALLOW_USER_PASSWORD_AUTH",
+        "ALLOW_REFRESH_TOKEN_AUTH"
+      ],
+      preventUserExistenceErrors: "ENABLED",
+      idTokenValidity: 60,
+      accessTokenValidity: 60,
+      refreshTokenValidity: 30,
+      tokenValidityUnits: tokenUnits
+    });
+    let lookup = Aws.cognito.getUserPoolOutput({
+      userPoolId: existingPoolId
+    });
+    result = {
+      poolId: Pulumi.output(existingPoolId),
+      clientId: client.id,
+      poolArn: lookup.apply(r => r.arn),
+      managed: false
+    };
+  } else {
+    let adminConfig = {
+      allowAdminCreateUserOnly: true
+    };
+    let pwdPolicy_minimumLength = 12;
+    let pwdPolicy_requireLowercase = true;
+    let pwdPolicy_requireNumbers = true;
+    let pwdPolicy_requireUppercase = true;
+    let pwdPolicy = {
+      minimumLength: pwdPolicy_minimumLength,
+      requireLowercase: pwdPolicy_requireLowercase,
+      requireNumbers: pwdPolicy_requireNumbers,
+      requireUppercase: pwdPolicy_requireUppercase
+    };
+    let pool = new (Aws.cognito.UserPool)("HostUiPool", {
+      adminCreateUserConfig: adminConfig,
+      usernameAttributes: ["email"],
+      passwordPolicy: pwdPolicy,
+      mfaConfiguration: "OFF"
+    });
+    let tokenUnits2_accessToken = "minutes";
+    let tokenUnits2_idToken = "minutes";
+    let tokenUnits2_refreshToken = "days";
+    let tokenUnits2 = {
+      accessToken: tokenUnits2_accessToken,
+      idToken: tokenUnits2_idToken,
+      refreshToken: tokenUnits2_refreshToken
+    };
+    let client$1 = new (Aws.cognito.UserPoolClient)("HostUiClient", {
+      userPoolId: pool.id,
+      generateSecret: false,
+      explicitAuthFlows: [
+        "ALLOW_USER_PASSWORD_AUTH",
+        "ALLOW_REFRESH_TOKEN_AUTH"
+      ],
+      preventUserExistenceErrors: "ENABLED",
+      idTokenValidity: 60,
+      accessTokenValidity: 60,
+      refreshTokenValidity: 30,
+      tokenValidityUnits: tokenUnits2
+    });
+    result = {
+      poolId: pool.id,
+      clientId: client$1.id,
+      poolArn: pool.arn,
+      managed: true
+    };
+  }
+  let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
+  Pulumi$Pulumi.$$export("cognitoUserPoolId", result.poolId);
+  Pulumi$Pulumi.$$export("cognitoUserPoolClientId", result.clientId);
+  Pulumi$Pulumi.$$export("cognitoUserPoolArn", result.poolArn);
+  Pulumi$Pulumi.$$export("cognitoRegion", Pulumi.output(regionStr));
+  Pulumi$Pulumi.$$export("cognitoUserPoolManaged", Pulumi.output(result.managed ? "true" : "false"));
+  return result;
+}
+
+let _cached = {
+  contents: undefined
+};
+
+function resolveCognitoUserPool() {
+  let p = _cached.contents;
+  if (p !== undefined) {
+    return p;
+  }
+  let p$1 = _resolveUncached();
+  _cached.contents = p$1;
+  return p$1;
+}
+
+export {
+  _resolveUncached,
+  _cached,
+  resolveCognitoUserPool,
+}
+/* @pulumi/aws Not a pure module */

package/src/Types.res

@@ -0,0 +1,39 @@
+/** Central type definitions for AWS resources used by ReventlessCore.
+  * 
+  * All AWS-specific types should be defined here and imported from 
+  * this module rather than directly from PulumiAws.
+  * 
+  * Usage: Since we're in the same package, use types directly:
+  *   type api = Types.AppSync.api
+  *   type role = Types.AppSync.role
+  */
+open PulumiAws
+
+module AppSync = {
+  // Base Pulumi types first
+  type graphQLApi = AppSync.GraphQLApi.t
+  type resolver = AppSync.Resolver.t
+  type dataSource = AppSync.DataSource.t
+  type function_ = AppSync.Function.t
+
+  // Then types that use the base types (Output-wrapped)
+  type api = Pulumi.Output.t<graphQLApi>
+  type role = Pulumi.Output.t<IAM.Role.t>
+}
+
+module DynamoDb = {
+  type table = DynamoDb.Table.t
+}
+
+module SQS = {
+  type queue = SQS.Queue.t
+}
+
+module SNS = {
+  type topic = SNS.Topic.t
+}
+
+module Lambda = {
+  type function_ = Lambda.Function.t
+  type role = IAM.Role.t
+}

package/src/Types.res.mjs

@@ -0,0 +1,21 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let AppSync = {};
+
+let DynamoDb = {};
+
+let SQS = {};
+
+let SNS = {};
+
+let Lambda = {};
+
+export {
+  AppSync,
+  DynamoDb,
+  SQS,
+  SNS,
+  Lambda,
+}
+/* No side effect */

package/src/adapter/AWS.res

@@ -0,0 +1,96 @@
+module Tags = AWS_Tags
+
+type service =
+  | AppSync
+  | IAM
+  | CloudwatchEventRule
+  | DynamoDb
+  | DynamoDbStream
+  | SQS
+  | SQS_FIFO
+  | SNS
+  | SNS_FIFO
+  | Kinesis
+  | Lambda
+  | S3
+
+let toString: service => string = service =>
+  switch service {
+  | DynamoDb => "aws:DynamoDb"
+  | DynamoDbStream => "aws:DynamoDbStream"
+  | SQS => "aws:SQS"
+  | SQS_FIFO => "aws:SQS_FIFO"
+  | SNS => "aws:SNS"
+  | SNS_FIFO => "aws:SNS_FIFO"
+  | Kinesis => "aws:Kinesis"
+  | Lambda => "aws:Lambda"
+  | AppSync => "aws:AppSync"
+  | IAM => "aws:IAM"
+  | CloudwatchEventRule => "aws:CloudwatchEventRule"
+  | S3 => "aws:S3"
+  }
+
+let toPrincipal: service => string = service =>
+  switch service {
+  | DynamoDb => "dynamodb.amazonaws.com"
+  | DynamoDbStream => "dynamodb.amazonaws.com"
+  | SQS => "sqs.amazonaws.com"
+  | SQS_FIFO => "sqs.amazonaws.com"
+  | SNS => "sns.amazonaws.com"
+  | SNS_FIFO => "sns.amazonaws.com"
+  | Kinesis => "kinesis.amazonaws.com"
+  | Lambda => "lambda.amazonaws.com"
+  | AppSync => "appsync.amazonaws.com"
+  | IAM => "iam.amazonaws.com"
+  | CloudwatchEventRule => "events.amazonaws.com"
+  | S3 => "s3.amazonaws.com"
+  }
+
+module DynamoDb = {
+  let service = DynamoDb->toString
+  let principal = DynamoDb->toPrincipal
+}
+module DynamoDbStream = {
+  let service = DynamoDbStream->toString
+  let principal = DynamoDbStream->toPrincipal
+}
+module Kinesis = {
+  let service = Kinesis->toString
+  let principal = Kinesis->toPrincipal
+}
+module Lambda = {
+  let service = Lambda->toString
+  let principal = Lambda->toPrincipal
+}
+module SNS = {
+  let service = SNS->toString
+  let principal = SNS->toPrincipal
+}
+module SNS_FIFO = {
+  let service = SNS_FIFO->toString
+  let principal = SNS_FIFO->toPrincipal
+}
+module SQS = {
+  let service = SQS->toString
+  let principal = SQS->toPrincipal
+}
+module SQS_FIFO = {
+  let service = SQS_FIFO->toString
+  let principal = SQS_FIFO->toPrincipal
+}
+module AppSync = {
+  let service = AppSync->toString
+  let principal = AppSync->toPrincipal
+}
+module IAM = {
+  let service = IAM->toString
+  let principal = IAM->toPrincipal
+}
+module CloudwatchEventRule = {
+  let service = CloudwatchEventRule->toString
+  let principal = CloudwatchEventRule->toPrincipal
+}
+module S3 = {
+  let service = S3->toString
+  let principal = S3->toPrincipal
+}