@reventlessdev/reventless-aws 3.0.0-alpha.167

package/src/adapter/AWS.res.mjs

@@ -0,0 +1,186 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function toString(service) {
+  switch (service) {
+    case "AppSync" :
+      return "aws:AppSync";
+    case "IAM" :
+      return "aws:IAM";
+    case "CloudwatchEventRule" :
+      return "aws:CloudwatchEventRule";
+    case "DynamoDb" :
+      return "aws:DynamoDb";
+    case "DynamoDbStream" :
+      return "aws:DynamoDbStream";
+    case "SQS" :
+      return "aws:SQS";
+    case "SQS_FIFO" :
+      return "aws:SQS_FIFO";
+    case "SNS" :
+      return "aws:SNS";
+    case "SNS_FIFO" :
+      return "aws:SNS_FIFO";
+    case "Kinesis" :
+      return "aws:Kinesis";
+    case "Lambda" :
+      return "aws:Lambda";
+    case "S3" :
+      return "aws:S3";
+  }
+}
+
+function toPrincipal(service) {
+  switch (service) {
+    case "AppSync" :
+      return "appsync.amazonaws.com";
+    case "IAM" :
+      return "iam.amazonaws.com";
+    case "CloudwatchEventRule" :
+      return "events.amazonaws.com";
+    case "DynamoDb" :
+    case "DynamoDbStream" :
+      return "dynamodb.amazonaws.com";
+    case "SQS" :
+    case "SQS_FIFO" :
+      return "sqs.amazonaws.com";
+    case "SNS" :
+    case "SNS_FIFO" :
+      return "sns.amazonaws.com";
+    case "Kinesis" :
+      return "kinesis.amazonaws.com";
+    case "Lambda" :
+      return "lambda.amazonaws.com";
+    case "S3" :
+      return "s3.amazonaws.com";
+  }
+}
+
+let service = "aws:DynamoDb";
+
+let principal = "dynamodb.amazonaws.com";
+
+let DynamoDb = {
+  service: service,
+  principal: principal
+};
+
+let service$1 = "aws:DynamoDbStream";
+
+let principal$1 = "dynamodb.amazonaws.com";
+
+let DynamoDbStream = {
+  service: service$1,
+  principal: principal$1
+};
+
+let service$2 = "aws:Kinesis";
+
+let principal$2 = "kinesis.amazonaws.com";
+
+let Kinesis = {
+  service: service$2,
+  principal: principal$2
+};
+
+let service$3 = "aws:Lambda";
+
+let principal$3 = "lambda.amazonaws.com";
+
+let Lambda = {
+  service: service$3,
+  principal: principal$3
+};
+
+let service$4 = "aws:SNS";
+
+let principal$4 = "sns.amazonaws.com";
+
+let SNS = {
+  service: service$4,
+  principal: principal$4
+};
+
+let service$5 = "aws:SNS_FIFO";
+
+let principal$5 = "sns.amazonaws.com";
+
+let SNS_FIFO = {
+  service: service$5,
+  principal: principal$5
+};
+
+let service$6 = "aws:SQS";
+
+let principal$6 = "sqs.amazonaws.com";
+
+let SQS = {
+  service: service$6,
+  principal: principal$6
+};
+
+let service$7 = "aws:SQS_FIFO";
+
+let principal$7 = "sqs.amazonaws.com";
+
+let SQS_FIFO = {
+  service: service$7,
+  principal: principal$7
+};
+
+let service$8 = "aws:AppSync";
+
+let principal$8 = "appsync.amazonaws.com";
+
+let AppSync = {
+  service: service$8,
+  principal: principal$8
+};
+
+let service$9 = "aws:IAM";
+
+let principal$9 = "iam.amazonaws.com";
+
+let IAM = {
+  service: service$9,
+  principal: principal$9
+};
+
+let service$10 = "aws:CloudwatchEventRule";
+
+let principal$10 = "events.amazonaws.com";
+
+let CloudwatchEventRule = {
+  service: service$10,
+  principal: principal$10
+};
+
+let service$11 = "aws:S3";
+
+let principal$11 = "s3.amazonaws.com";
+
+let S3 = {
+  service: service$11,
+  principal: principal$11
+};
+
+let Tags;
+
+export {
+  Tags,
+  toString,
+  toPrincipal,
+  DynamoDb,
+  DynamoDbStream,
+  Kinesis,
+  Lambda,
+  SNS,
+  SNS_FIFO,
+  SQS,
+  SQS_FIFO,
+  AppSync,
+  IAM,
+  CloudwatchEventRule,
+  S3,
+}
+/* No side effect */

package/src/adapter/AWS_Tags.res

@@ -0,0 +1,16 @@
+let make = (~name, componentType) => {
+  let plugin = Pulumi.Pulumi.getProjectName()
+  let kind = componentType->ReventlessCore.ComponentType.toString
+  [
+    ("Name", name),
+    ("Type", kind),
+    ("Environment", Pulumi.Pulumi.getStackName()),
+    ("Plugin", plugin),
+    ("reventless:plugin", plugin),
+    ("reventless:component", name),
+    ("reventless:role", kind),
+    ("reventless:kind", kind),
+  ]
+  ->Dict.fromArray
+  ->Pulumi.Input.make
+}

package/src/adapter/AWS_Tags.res.mjs

@@ -0,0 +1,48 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pulumi from "@pulumi/pulumi";
+import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/src/ComponentType.res.mjs";
+
+function make(name, componentType) {
+  let plugin = Pulumi.getProject();
+  let kind = ComponentType$ReventlessCore.toString(componentType);
+  return Object.fromEntries([
+    [
+      "Name",
+      name
+    ],
+    [
+      "Type",
+      kind
+    ],
+    [
+      "Environment",
+      Pulumi.getStack()
+    ],
+    [
+      "Plugin",
+      plugin
+    ],
+    [
+      "reventless:plugin",
+      plugin
+    ],
+    [
+      "reventless:component",
+      name
+    ],
+    [
+      "reventless:role",
+      kind
+    ],
+    [
+      "reventless:kind",
+      kind
+    ]
+  ]);
+}
+
+export {
+  make,
+}
+/* @pulumi/pulumi Not a pure module */

package/src/adapter/Adapter_Helpers.res

@@ -0,0 +1,19 @@
+let dynamoDbStreamResources = eventTopicResources =>
+  eventTopicResources->ReventlessCore.Util.Adapter.filterSupportedResolvedResources([
+    AWS.DynamoDbStream.service,
+  ])
+let snsResources = resources =>
+  resources->ReventlessCore.Util.Adapter.filterSupportedResolvedResources([
+    AWS.SNS.service,
+    AWS.SNS_FIFO.service,
+  ])
+let sqsResources = resources =>
+  resources->ReventlessCore.Util.Adapter.filterSupportedResolvedResources([
+    AWS.SQS.service,
+    AWS.SQS_FIFO.service,
+  ])
+let dynamoDbResources = resources =>
+  resources->ReventlessCore.Util.Adapter.filterSupportedResolvedResources([
+    AWS.DynamoDb.service,
+    AWS.DynamoDbStream.service,
+  ])

package/src/adapter/Adapter_Helpers.res.mjs

@@ -0,0 +1,37 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as AWS$ReventlessAws from "./AWS.res.mjs";
+import * as Util_Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Adapter.res.mjs";
+
+function dynamoDbStreamResources(eventTopicResources) {
+  return Util_Adapter$ReventlessCore.filterSupportedResolvedResources(eventTopicResources, [AWS$ReventlessAws.DynamoDbStream.service]);
+}
+
+function snsResources(resources) {
+  return Util_Adapter$ReventlessCore.filterSupportedResolvedResources(resources, [
+    AWS$ReventlessAws.SNS.service,
+    AWS$ReventlessAws.SNS_FIFO.service
+  ]);
+}
+
+function sqsResources(resources) {
+  return Util_Adapter$ReventlessCore.filterSupportedResolvedResources(resources, [
+    AWS$ReventlessAws.SQS.service,
+    AWS$ReventlessAws.SQS_FIFO.service
+  ]);
+}
+
+function dynamoDbResources(resources) {
+  return Util_Adapter$ReventlessCore.filterSupportedResolvedResources(resources, [
+    AWS$ReventlessAws.DynamoDb.service,
+    AWS$ReventlessAws.DynamoDbStream.service
+  ]);
+}
+
+export {
+  dynamoDbStreamResources,
+  snsResources,
+  sqsResources,
+  dynamoDbResources,
+}
+/* Util_Adapter-ReventlessCore Not a pure module */

package/src/adapter/Api/AppSync_EventsApi.res

@@ -0,0 +1,172 @@
+/** AppSync_EventsApi — creates an IAM-authenticated AppSync Events (Pub/Sub) API
+    with a `default` channel namespace.
+
+    This is a companion to the AppSync GraphQL API. Sources A and B push
+    real-time events here; clients subscribe to channels such as
+    `/default/{topicRoot}/{entityKey}` — see `StateTopic_AppSync.res` for
+    channel layout.
+
+    Usage (in platform/plugin builder after the GraphQL API is created):
+      let eventsApi = AppSync_EventsApi.make(
+        ~name="DomainEventsApi",
+        ~cognitoUserPoolId,
+        ~awsRegion,
+        ~opts,
+      )
+
+    Then pass `eventsApi` to:
+      StateTopic_AppSync.make(~eventsApi, ...)
+      EventLogSubscription_AppSync.make(~eventsApi, ...)
+
+    ## Subscribe-time authorization (extension hook)
+
+    Downstream extensions (e.g. multi-tenancy) can gate WebSocket subscribes
+    by calling `registerSubscribeAuth` BEFORE platform construction:
+
+      AppSync_EventsApi.registerSubscribeAuth({
+        codeHandlers: "export function onSubscribe(ctx) { ... }",
+        dataSourceName: noneDs.name->Pulumi.Output.asInput,
+      })
+
+    The framework wires the namespace's `handlerConfigs.onSubscribe` to the
+    provided JS code; the extension is responsible for creating the AppSync
+    data source (typically NONE-typed) on the Events API. With no hook
+    installed, subscribe goes through the API-level auth modes only
+    (single-tenant open-core case).
+*/
+
+module Api = PulumiAws.AwsNative.AppSync.Api
+module ChannelNamespace = PulumiAws.AwsNative.AppSync.ChannelNamespace
+
+/** Configuration for the namespace's `onSubscribe` handler. The framework
+    enforces this handler is called per subscribe attempt; the JS body decides
+    whether to allow or deny by calling `util.unauthorized()`. */
+type subscribeAuthConfig = {
+  /** JS module body containing `export function onSubscribe(ctx) { ... }`.
+      Runs in AppSync's APPSYNC_JS runtime per subscribe attempt. */
+  codeHandlers: string,
+  /** Name of an AppSync data source on this Events API. Required by
+      CloudFormation even for `CODE` behavior — typically a NONE-typed data
+      source the extension creates separately. */
+  dataSourceName: Pulumi.Input.t<string>,
+}
+
+let subscribeAuthRef: ref<option<subscribeAuthConfig>> = ref(None)
+
+/** Install the subscribe-time auth handler. Call before platform
+    construction. Idempotent — calling twice keeps the most recent value. */
+let registerSubscribeAuth = (config: subscribeAuthConfig) => {
+  subscribeAuthRef.contents = Some(config)
+}
+
+/** Clear any installed subscribe-auth handler (testing / hot-reload). */
+let clearSubscribeAuth = () => {
+  subscribeAuthRef.contents = None
+}
+
+type t = {
+  /** Static Pulumi resource name (e.g. `"DomainEventsApi"`). Stable string for
+      keying per-API registries (see `StateTopic_AppSync.registry`). The
+      underlying `api.name` is `Pulumi.Output.t<string>` and unusable as a key. */
+  name: string,
+  /** Full AppSync Events API output — carry this through the stack. */
+  api: Api.t,
+  /** The `default` channel namespace created on the API. */
+  defaultNamespace: option<ChannelNamespace.t>,
+}
+
+/** Create an AppSync Events API with dual auth (Cognito + AWS_IAM) and a
+    `default` channel namespace.
+
+    `name` is the Pulumi resource name prefix (e.g. `"DomainEventsApi"`).
+    `cognitoUserPoolId` / `awsRegion` configure the Cognito User Pools auth
+    provider the browser host-shell connects/subscribes with.
+    `opts` should set `parent` to the platform component resource. */
+let make = (
+  ~name: string,
+  ~cognitoUserPoolId: Pulumi.Input.t<string>,
+  ~awsRegion: string,
+  ~opts: Pulumi.CustomResourceOptions.t,
+): t => {
+  let iamMode: Api.authMode = {authType: Api.awsIam->Pulumi.Input.make}
+  let iamProvider: Api.authProvider = {authType: Api.awsIam->Pulumi.Input.make}
+
+  // Cognito User Pools auth — the browser host-shell (LiveConnection /
+  // EventsClient) connects and subscribes over WebSocket with a Cognito
+  // IdToken bearer. Without a Cognito provider plus matching connection +
+  // subscribe auth modes, AppSync rejects the connection_init and the UI
+  // never receives live descriptors. Lambda publishers keep AWS_IAM (SigV4)
+  // on the publish path.
+  let cognitoMode: Api.authMode = {authType: Api.amazonCognitoUserPools->Pulumi.Input.make}
+  let cognitoProvider: Api.authProvider = {
+    authType: Api.amazonCognitoUserPools->Pulumi.Input.make,
+    cognitoConfig: (
+      {
+        awsRegion: awsRegion->Pulumi.Input.make,
+        userPoolId: cognitoUserPoolId,
+      }: Api.cognitoConfig
+    )->Pulumi.Input.make,
+  }
+
+  let api = Api.make(
+    ~name,
+    ~args={
+      eventConfig: (
+        {
+          authProviders: [
+            iamProvider->Pulumi.Input.make,
+            cognitoProvider->Pulumi.Input.make,
+          ]->Pulumi.Input.make,
+          connectionAuthModes: [
+            cognitoMode->Pulumi.Input.make,
+            iamMode->Pulumi.Input.make,
+          ]->Pulumi.Input.make,
+          // Publish stays IAM-only — only the SigV4-signed Lambda publishers
+          // push to channels; the browser never publishes.
+          defaultPublishAuthModes: [iamMode->Pulumi.Input.make]->Pulumi.Input.make,
+          defaultSubscribeAuthModes: [
+            cognitoMode->Pulumi.Input.make,
+            iamMode->Pulumi.Input.make,
+          ]->Pulumi.Input.make,
+        }: Api.eventConfigArgs
+      )->Pulumi.Input.make,
+    },
+    ~opts=Some(opts),
+  )
+
+  // The `default` namespace is required — channels are addressed as
+  // `/default/{topicRoot}/{entityKey}` in both Lambda publish calls and client
+  // subscriptions. If an extension has installed a subscribe-auth handler via
+  // `registerSubscribeAuth`, wire it as the namespace's `onSubscribe` handler.
+  let subscribeAuth = subscribeAuthRef.contents
+  let codeHandlersInput: option<Pulumi.Input.t<string>> =
+    subscribeAuth->Option.map(c => c.codeHandlers->Pulumi.Input.make)
+  let handlerConfigsInput: option<Pulumi.Input.t<ChannelNamespace.handlerConfigsArgs>> =
+    subscribeAuth->Option.map(c => {
+      ChannelNamespace.onSubscribe: {
+        ChannelNamespace.behavior: ChannelNamespace.handlerBehaviorCode->Pulumi.Input.make,
+        integration: {
+          ChannelNamespace.dataSourceName: c.dataSourceName,
+        }->Pulumi.Input.make,
+      }->Pulumi.Input.make,
+    }->Pulumi.Input.make)
+  let defaultNamespace = ChannelNamespace.make(
+    ~name=name ++ "DefaultNS",
+    ~args={
+      apiId: api.apiId->Pulumi.Output.asInput,
+      name: "default"->Pulumi.Input.make,
+      codeHandlers: ?codeHandlersInput,
+      handlerConfigs: ?handlerConfigsInput,
+    },
+    ~opts=Some({...opts, parent: api->Pulumi.Resource.makeFromJs}),
+  )
+
+  {name, api, defaultNamespace: Some(defaultNamespace)}
+}
+
+/** HTTP endpoint URL for use as Lambda `APPSYNC_ENDPOINT` env var.
+    Constructs `https://{dns.http}` from the raw domain name in the API output. */
+let httpEndpoint = (eventsApi: t): Pulumi.Output.t<string> =>
+  eventsApi.api.dns->Pulumi.Output.apply(dns =>
+    "https://" ++ dns.http->Option.getOr("")
+  )

package/src/adapter/Api/AppSync_EventsApi.res.mjs

@@ -0,0 +1,96 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as AwsNative from "@pulumi/aws-native";
+import * as AwsNative_AppSync_Api$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AwsNative/AppSync/AwsNative_AppSync_Api.res.mjs";
+import * as AwsNative_AppSync_ChannelNamespace$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AwsNative/AppSync/AwsNative_AppSync_ChannelNamespace.res.mjs";
+
+let subscribeAuthRef = {
+  contents: undefined
+};
+
+function registerSubscribeAuth(config) {
+  subscribeAuthRef.contents = config;
+}
+
+function clearSubscribeAuth() {
+  subscribeAuthRef.contents = undefined;
+}
+
+function make(name, cognitoUserPoolId, awsRegion, opts) {
+  let iamMode = {
+    authType: AwsNative_AppSync_Api$PulumiAws.awsIam
+  };
+  let iamProvider = {
+    authType: AwsNative_AppSync_Api$PulumiAws.awsIam
+  };
+  let cognitoMode = {
+    authType: AwsNative_AppSync_Api$PulumiAws.amazonCognitoUserPools
+  };
+  let cognitoProvider_cognitoConfig = {
+    awsRegion: awsRegion,
+    userPoolId: cognitoUserPoolId
+  };
+  let cognitoProvider = {
+    authType: AwsNative_AppSync_Api$PulumiAws.amazonCognitoUserPools,
+    cognitoConfig: cognitoProvider_cognitoConfig
+  };
+  let api = new (AwsNative.appsync.Api)(name, {
+    eventConfig: {
+      authProviders: [
+        iamProvider,
+        cognitoProvider
+      ],
+      connectionAuthModes: [
+        cognitoMode,
+        iamMode
+      ],
+      defaultPublishAuthModes: [iamMode],
+      defaultSubscribeAuthModes: [
+        cognitoMode,
+        iamMode
+      ]
+    }
+  }, opts);
+  let subscribeAuth = subscribeAuthRef.contents;
+  let codeHandlersInput = Stdlib_Option.map(subscribeAuth, c => c.codeHandlers);
+  let handlerConfigsInput = Stdlib_Option.map(subscribeAuth, c => ({
+    onSubscribe: {
+      behavior: AwsNative_AppSync_ChannelNamespace$PulumiAws.handlerBehaviorCode,
+      integration: {
+        dataSourceName: c.dataSourceName
+      }
+    }
+  }));
+  let newrecord = {...opts};
+  let defaultNamespace = new (AwsNative.appsync.ChannelNamespace)(name + "DefaultNS", {
+    apiId: api.apiId,
+    name: "default",
+    codeHandlers: codeHandlersInput,
+    handlerConfigs: handlerConfigsInput
+  }, (newrecord.parent = api, newrecord));
+  return {
+    name: name,
+    api: api,
+    defaultNamespace: defaultNamespace
+  };
+}
+
+function httpEndpoint(eventsApi) {
+  return eventsApi.api.dns.apply(dns => "https://" + Stdlib_Option.getOr(dns.http, ""));
+}
+
+let Api;
+
+let ChannelNamespace;
+
+export {
+  Api,
+  ChannelNamespace,
+  subscribeAuthRef,
+  registerSubscribeAuth,
+  clearSubscribeAuth,
+  make,
+  httpEndpoint,
+}
+/* @pulumi/aws-native Not a pure module */

package/src/adapter/Api/AppSync_Resolver_Native.res

@@ -0,0 +1,93 @@
+/** AppSync_Resolver_Native — drop-in replacement for
+    `PulumiAws.AppSync.Resolver` that uses `@pulumi/aws-native` (Cloud Control
+    API) so the CFN handler can internally wait out schema -> resolver
+    propagation. See docs/plans/appsync-resolver-aws-native.md. */
+
+module Native = PulumiAws.AwsNative.AppSync.Resolver
+module Functions = PulumiAws.AppSync.Resolver.Functions
+
+type t = Native.t
+
+let makeUnitJsResolver = (
+  ~name,
+  ~api: Pulumi.Output.t<PulumiAws.AppSync.GraphQLApi.t>,
+  ~dataSourceName,
+  ~type_,
+  ~field,
+  ~code,
+  ~opts: option<Pulumi.CustomResourceOptions.t>=?,
+) =>
+  Native.make(
+    ~name,
+    ~args={
+      apiId: api->Pulumi.Output.flatMap(a => a.id)->Pulumi.Output.asInput,
+      typeName: type_,
+      fieldName: field,
+      dataSourceName,
+      kind: "UNIT"->Pulumi.Input.make,
+      code,
+      runtime: Native.appsyncJs->Pulumi.Input.make,
+    },
+    ~opts=opts,
+  )
+
+let makeSubscriptionResolverCode = (~filter: option<string>): string => {
+  let filterLine = switch filter {
+  | None => ""
+  | Some(f) => `\n  ctx.extensions.setSubscriptionFilter(${f});`
+  }
+  `export function request(ctx) {${filterLine}
+  return { payload: null };
+}
+
+export function response(ctx) {
+  return ctx.result;
+}`
+}
+
+let makeSubscriptionResolver = (
+  ~name,
+  ~api: Pulumi.Output.t<PulumiAws.AppSync.GraphQLApi.t>,
+  ~field,
+  ~subscriptionFilter: option<string>=?,
+  ~opts: option<Pulumi.CustomResourceOptions.t>=?,
+) =>
+  Native.make(
+    ~name,
+    ~args={
+      apiId: api->Pulumi.Output.flatMap(a => a.id)->Pulumi.Output.asInput,
+      typeName: "Subscription"->Pulumi.Input.make,
+      fieldName: field->Pulumi.Input.make,
+      kind: "UNIT"->Pulumi.Input.make,
+      code: makeSubscriptionResolverCode(~filter=subscriptionFilter)->Pulumi.Input.make,
+      runtime: Native.appsyncJs->Pulumi.Input.make,
+    },
+    ~opts=opts,
+  )
+
+let makePipelineJsResolver = (
+  ~name,
+  ~api: Pulumi.Output.t<PulumiAws.AppSync.GraphQLApi.t>,
+  ~type_,
+  ~field,
+  ~code,
+  ~functions: array<PulumiAws.AppSync.Function.t>,
+  ~opts: option<Pulumi.CustomResourceOptions.t>=?,
+) =>
+  Native.make(
+    ~name,
+    ~args={
+      apiId: api->Pulumi.Output.flatMap(a => a.id)->Pulumi.Output.asInput,
+      typeName: type_,
+      fieldName: field,
+      kind: "PIPELINE"->Pulumi.Input.make,
+      code,
+      runtime: Native.appsyncJs->Pulumi.Input.make,
+      pipelineConfig: (
+        {
+          functions: functions->Array.map(f => f.functionId->Pulumi.Output.asInput),
+        }: Native.pipelineConfig
+      )->Pulumi.Input.make,
+    },
+    ~opts=opts,
+  )