@reventlessdev/reventless-aws 3.0.0-alpha.175 → 3.0.0-alpha.177

package/src/adapter/Postgres/PgProjectionFeed.res.mjs

@@ -0,0 +1,54 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as SQS_Queue$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/SQS/SQS_Queue.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_DeadLetterQueue$ReventlessAws from "../../util/Util_DeadLetterQueue.res.mjs";
+import * as Util_EventSourceMapping$ReventlessAws from "../../util/Util_EventSourceMapping.res.mjs";
+
+let feedQueues = [];
+
+function getFeedQueues() {
+  return feedQueues;
+}
+
+function makeQueue(name, scope, includeClassic, includeDcb, opts) {
+  let queue = new (Aws.sqs.Queue)(name, {
+    redrivePolicy: Util_DeadLetterQueue$ReventlessAws.queue.arn.apply(dlqArn => SQS_Queue$PulumiAws.RedrivePolicy.make(dlqArn, 5)),
+    visibilityTimeoutSeconds: 120,
+    sqsManagedSseEnabled: false
+  }, opts);
+  feedQueues.push({
+    scope: scope,
+    includeClassic: includeClassic,
+    includeDcb: includeDcb,
+    url: queue.id,
+    arn: queue.arn
+  });
+  return queue;
+}
+
+function connect(name, queue, lambda, lambdaRole, opts) {
+  Util_EventSourceMapping$ReventlessAws.subscribeSqs(lambda, name, queue, undefined, opts);
+  queue.arn.apply(queueArn => new (Aws.iam.RolePolicy)(name + `Receive`, {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `ReceivePolicy`, [{
+        Sid: "AllowReceiveFeedQueue",
+        Effect: "Allow",
+        Action: [
+          "sqs:ReceiveMessage",
+          "sqs:DeleteMessage",
+          "sqs:GetQueueAttributes"
+        ],
+        Resource: queueArn
+      }])),
+    role: lambdaRole.id
+  }, opts));
+}
+
+export {
+  feedQueues,
+  getFeedQueues,
+  makeQueue,
+  connect,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/QueryDb/PgQueryResolver_Builder.res

@@ -0,0 +1,281 @@
+// Deploy-time provisioner for the shared Postgres GraphQL-read Lambda (B3.2b).
+//
+// Postgres-backed read models have no per-table AppSync data source, so instead
+// of the direct DynamoDB resolvers there is ONE in-VPC "PgQueryResolver" Lambda
+// (PgQueryResolverEntryPoint.mjs → PgQueryResolver_Lambda.dispatch) registered
+// as a single AppSync Lambda data source. Every Postgres read model's resolvers
+// (QueryDbResolvers_Lambda) are thin APPSYNC_JS `Invoke` templates pointing at
+// this one data source.
+//
+// Ordering wrinkle: `QueryDbStorage_Postgres.make` runs DURING construct and
+// must return the data source name, but the Lambda's code bundle needs the set
+// of Postgres read models (their spec packages), known only AFTER construct. So
+// the data source name is a DEFERRED Output (`dataSourceName`), fulfilled by
+// `provision` — which the platform calls in makePlatform once every plugin is
+// built (alongside provisionPgChangeFeedRelay). The resolvers themselves are
+// created even later (inside the schema-pushed `resourcesMaker`), so they read
+// the name after `provision` has resolved it.
+
+open PulumiAws
+
+let log = ReventlessCore.Logger.fromEnv()
+
+// -- Deferred data source name ----------------------------------------------
+// Created once at module load. `QueryDbStorage_Postgres.make` returns this for
+// every Postgres read model (one shared data source); `provision` resolves it.
+let resolveDataSourceName: ref<string => unit> = ref(_ => ())
+let dataSourceNamePromise: promise<string> = Promise.make((resolve, _reject) =>
+  resolveDataSourceName := resolve
+)
+let dataSourceName: Pulumi.Output.t<string> = Pulumi.Output.fromPromise(dataSourceNamePromise)
+
+// -- Resolver-binding registry ----------------------------------------------
+// Populated by QueryDbResolvers_Lambda.make during construct (per Postgres read
+// model): the bits `provision` bakes into the Lambda env config that the entry
+// point can't get from the spec module (they come from the deploy-time
+// queryFieldNamesRegistry). specModulePath is looked up from
+// EventCollectorRuntime_Builder_Single.readModelInfos at provision time.
+type resolverEntry = {
+  readModelName: string,
+  labelField: string,
+  includeIdParam: bool,
+}
+let entries: dict<resolverEntry> = Dict.make()
+let register = (entry: resolverEntry): unit =>
+  entries->Dict.set(entry.readModelName, entry)
+
+// Relay node type → read-model-name, populated per RM by QueryDbResolvers_Lambda.
+// Baked into the env config so the entry point can serve the shared node(id).
+let nodeTypes: dict<string> = Dict.make()
+let registerNodeType = (~typeName: string, ~readModelName: string): unit =>
+  nodeTypes->Dict.set(typeName, readModelName)
+
+// -- Provision --------------------------------------------------------------
+let bool = b => b ? "true" : "false"
+
+// One `node(id: ID!)` resolver on the shared data source → Invoke {kind:"node"}.
+let nodeResolverCode =
+  `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '',
+      kind: 'node',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
+        : id != null
+          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
+          : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+// Serialize the shared connection config into the env-config JSON (same shape
+// EventCollectorRuntime_Builder_Single bakes into HANDLER_CONFIG).
+let pgConnectionJson = (cc: PgConnection.connectionConfig): string =>
+  [
+    ("host", cc.host->JSON.Encode.string),
+    ("port", cc.port->Int.toFloat->JSON.Encode.float),
+    ("database", cc.database->JSON.Encode.string),
+    ("username", cc.username->JSON.Encode.string),
+    ("secretArn", cc.secretArn->JSON.Encode.string),
+  ]
+  ->Dict.fromArray
+  ->JSON.Encode.object
+  ->JSON.stringify
+
+let provision = (
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~selection: QueryDbBackend.selection,
+  ~opts: Pulumi.ComponentResource.options,
+): unit => {
+  // Join the resolver-binding registry (labelField/includeIdParam) with the
+  // ReadModel runtime registry (specModulePath, pgBacked). Only read models
+  // that both got Lambda resolvers AND are Postgres-backed are handled here.
+  let handlers =
+    entries
+    ->Dict.valuesToArray
+    ->Array.filterMap(entry =>
+      switch EventCollectorRuntime_Builder_Single.readModelInfos->Dict.get(entry.readModelName) {
+      | Some(info) if info.pgBacked => Some((entry, info.specModulePath))
+      | _ => None
+      }
+    )
+  if handlers->Array.length == 0 {
+    // No Postgres read models with Lambda resolvers — nothing to provision.
+    ()
+  } else {
+    // makeFromCodeAsset takes ComponentResource.options (the original); the raw
+    // IAM / DataSource resources take the CustomResourceOptions projection.
+    let customOpts =
+      opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+    let name = "PgQueryResolver"
+
+    // Bundle the entry point plus each read model's spec package (imported at
+    // Lambda init for indexes / subIdField / schema → capability).
+    let packageDirs: dict<string> = Dict.make()
+    handlers->Array.forEach(((_entry, specModulePath)) => {
+      let pkg = Util_Bundle.extractPackageName(specModulePath)
+      packageDirs->Dict.set(pkg, Util_Bundle.resolvePackageRoot(pkg))
+    })
+
+    // Env config: shared pgConnection + one handler per read model. Sorted for
+    // deploy-stable output. specModule/labelField/includeIdParam are baked;
+    // indexes/subIdField/authorization come from the imported spec at runtime.
+    let handlerJsons =
+      handlers
+      ->Array.toSorted(((a, _), (b, _)) => String.compare(a.readModelName, b.readModelName))
+      ->Array.map(((entry, specModulePath)) => {
+        let specModule = specModulePath->JSON.stringifyAny->Option.getOr(`""`)
+        `{"readModelName":"${entry.readModelName}","specModule":${specModule},"labelField":"${entry.labelField}","includeIdParam":${bool(
+            entry.includeIdParam,
+          )}}`
+      })
+
+    // Relay node type → read-model map, baked so the entry point can serve node(id).
+    let nodeTypesJson =
+      nodeTypes
+      ->Dict.toArray
+      ->Array.toSorted(((a, _), (b, _)) => String.compare(a, b))
+      ->Array.map(((typeName, rm)) => `"${typeName}":"${rm}"`)
+      ->Array.join(",")
+
+    let queryResolverConfig =
+      selection.connectionConfig->Pulumi.Output.apply(cc =>
+        `{"pgConnection":${pgConnectionJson(cc)},"handlers":[${handlerJsons->Array.join(
+            ",",
+          )}],"nodeTypes":{${nodeTypesJson}}}`
+      )
+
+    let envVars: dict<Pulumi.Input.t<string>> = Dict.make()
+    envVars->Dict.set("QUERY_RESOLVER_CONFIG", queryResolverConfig->Pulumi.Output.asInput)
+    envVars->Dict.set("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make)
+
+    let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+      ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs",
+      ~packageDirs,
+    )
+
+    // In-VPC on the DB-access security group + private subnets (reach RDS).
+    let vpcConfig =
+      selection.securityGroupId
+      ->Pulumi.Output.apply(sgId =>
+        (
+          {
+            Lambda.Function.subnetIds: selection.subnetIds->Pulumi.Input.make,
+            securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+          }: Lambda.Function.vpcConfig
+        )
+      )
+      ->Pulumi.Output.asInput
+
+    let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+      ~name,
+      ~code,
+      ~sourceCodeHash,
+      ~envVars,
+      ~memorySize=512,
+      ~timeout=30,
+      ~vpcConfig,
+      ~opts,
+    )
+
+    // Read the RDS-managed secret so PgRuntime can resolve the DB password.
+    let _ = selection.connectionConfig->Pulumi.Output.apply(cc => {
+      open PolicyDocument
+      IAM.RolePolicy.make(
+        ~name=name ++ "-pgSecret",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "-pgSecretPolicy",
+            ~statements=[
+              {
+                sid: "AllowGetPgSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resource(cc.secretArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+        },
+      )
+    })
+
+    // AppSync → Lambda data source (one, shared by every Postgres RM's resolvers).
+    let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+      ~name=name ++ "DataSource",
+      ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+      ~opts=customOpts,
+    )
+    let lambdaArn = runtime.parts.lambda->Pulumi.Output.flatMap(l => l.arn)
+    let _ =
+      (lambdaArn, dataSourceRole.id)
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((arn, dsRoleId)) => {
+        open PolicyDocument
+        IAM.RolePolicy.make(
+          ~name=name ++ "DataSourceInvoke",
+          ~args={
+            policy: PolicyDocument.make(
+              ~id=name ++ "DataSourceInvokePolicy",
+              ~statements=[
+                {
+                  sid: "AllowDataSourceInvokeLambda",
+                  effect: Allow,
+                  actions: Action("lambda:InvokeFunction"),
+                  resources: Resource(arn),
+                },
+              ],
+            )
+            ->PolicyDocument.toJsonString
+            ->Pulumi.Input.make,
+            role: dsRoleId->Pulumi.Input.make,
+          },
+        )
+      })
+
+    let dataSource = AppSync.DataSource.make(
+      ~name=name ++ "DataSource",
+      ~args={
+        type_: AWS_LAMBDA,
+        apiId: api->Pulumi.Output.flatMap(a => a.id)->Pulumi.Output.asInput,
+        lambdaConfig: {
+          AppSync.DataSource.functionArn: lambdaArn->Pulumi.Output.asInput,
+        }->Pulumi.Input.make,
+        serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+      },
+      ~opts=Some(customOpts),
+    )
+
+    // Shared node(id) resolver (B3.2c) — one for the whole API, dispatched by
+    // typeName in the Lambda. Only when some entity registered a node type
+    // (else the `node` field isn't in the schema). Mirrors NodeResolver_AppSync,
+    // which likewise creates the node resolver directly at deploy time.
+    if nodeTypes->Dict.toArray->Array.length > 0 {
+      let _nodeResolver = AppSync_Resolver_Retrying.makeUnitJsResolver(
+        ~name=name ++ "NodeResolver",
+        ~api,
+        ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+        ~type_="Query"->Pulumi.Input.make,
+        ~field="node"->Pulumi.Input.make,
+        ~code=nodeResolverCode,
+        ~opts=customOpts,
+      )
+    }
+
+    // Fulfil the deferred name the Postgres storage maker handed to resolvers.
+    let _ = dataSource.name->Pulumi.Output.apply(n => resolveDataSourceName.contents(n))
+    log.info(~comp="PgQueryResolver_Builder", `provisioned for ${handlers->Array.length->Int.toString} read model(s)`)
+  }
+}

package/src/adapter/QueryDb/PgQueryResolver_Builder.res.mjs

@@ -0,0 +1,189 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+import * as EventCollectorRuntime_Builder_Single$ReventlessAws from "../Runtime/EventCollectorRuntime_Builder_Single.res.mjs";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let resolveDataSourceName = {
+  contents: param => {}
+};
+
+let dataSourceNamePromise = new Promise((resolve, _reject) => {
+  resolveDataSourceName.contents = resolve;
+});
+
+let entries = {};
+
+function register(entry) {
+  entries[entry.readModelName] = entry;
+}
+
+let nodeTypes = {};
+
+function registerNodeType(typeName, readModelName) {
+  nodeTypes[typeName] = readModelName;
+}
+
+function bool(b) {
+  if (b) {
+    return "true";
+  } else {
+    return "false";
+  }
+}
+
+let nodeResolverCode = `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      readModelName: '',
+      kind: 'node',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { userId: id.sub, username: id.username, groups: id.claims?.['cognito:groups'] ?? [], claims: id.claims, provider: 'Cognito' }
+        : id != null
+          ? { userArn: id.userArn ?? null, accountId: id.accountId ?? null, username: id.username ?? null, provider: 'IAM' }
+          : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function pgConnectionJson(cc) {
+  return JSON.stringify(Object.fromEntries([
+    [
+      "host",
+      cc.host
+    ],
+    [
+      "port",
+      cc.port
+    ],
+    [
+      "database",
+      cc.database
+    ],
+    [
+      "username",
+      cc.username
+    ],
+    [
+      "secretArn",
+      cc.secretArn
+    ]
+  ]));
+}
+
+function provision(api, selection, opts) {
+  let handlers = Stdlib_Array.filterMap(Object.values(entries), entry => {
+    let info = EventCollectorRuntime_Builder_Single$ReventlessAws.readModelInfos[entry.readModelName];
+    if (info !== undefined && info.pgBacked) {
+      return [
+        entry,
+        info.specModulePath
+      ];
+    }
+  });
+  if (handlers.length === 0) {
+    return;
+  }
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let name = "PgQueryResolver";
+  let packageDirs = {};
+  handlers.forEach(param => {
+    let pkg = Util_Bundle$ReventlessAws.extractPackageName(param[1]);
+    packageDirs[pkg] = Util_Bundle$ReventlessAws.resolvePackageRoot(pkg);
+  });
+  let handlerJsons = handlers.toSorted((param, param$1) => Primitive_string.compare(param[0].readModelName, param$1[0].readModelName)).map(param => {
+    let entry = param[0];
+    let specModule = Stdlib_Option.getOr(JSON.stringify(param[1]), `""`);
+    return `{"readModelName":"` + entry.readModelName + `","specModule":` + specModule + `,"labelField":"` + entry.labelField + `","includeIdParam":` + (
+      entry.includeIdParam ? "true" : "false"
+    ) + `}`;
+  });
+  let nodeTypesJson = Object.entries(nodeTypes).toSorted((param, param$1) => Primitive_string.compare(param[0], param$1[0])).map(param => `"` + param[0] + `":"` + param[1] + `"`).join(",");
+  let queryResolverConfig = selection.connectionConfig.apply(cc => `{"pgConnection":` + pgConnectionJson(cc) + `,"handlers":[` + handlerJsons.join(",") + `],"nodeTypes":{` + nodeTypesJson + `}}`);
+  let envVars = {};
+  envVars["QUERY_RESOLVER_CONFIG"] = queryResolverConfig;
+  envVars["Environment"] = Pulumi.getStack();
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PgQueryResolverEntryPoint.mjs", packageDirs, undefined);
+  let vpcConfig = selection.securityGroupId.apply(sgId => ({
+    subnetIds: selection.subnetIds,
+    securityGroupIds: [sgId]
+  }));
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, 512, 30, undefined, undefined, undefined, undefined, vpcConfig, opts);
+  selection.connectionConfig.apply(cc => new (Aws.iam.RolePolicy)(name + "-pgSecret", {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "-pgSecretPolicy", [{
+        Sid: "AllowGetPgSecret",
+        Effect: "Allow",
+        Action: "secretsmanager:GetSecretValue",
+        Resource: cc.secretArn
+      }])),
+    role: runtime.parts.lambdaRole.id
+  }));
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), customOpts);
+  let lambdaArn = Output$Pulumi.flatMap(runtime.parts.lambda, l => l.arn);
+  Pulumi.all([
+    lambdaArn,
+    dataSourceRole.id
+  ]).apply(param => new (Aws.iam.RolePolicy)(name + "DataSourceInvoke", {
+    policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourceInvokePolicy", [{
+        Sid: "AllowDataSourceInvokeLambda",
+        Effect: "Allow",
+        Action: "lambda:InvokeFunction",
+        Resource: param[0]
+      }])),
+    role: param[1]
+  }));
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, a => a.id),
+    lambdaConfig: {
+      functionArn: lambdaArn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, customOpts);
+  if (Object.entries(nodeTypes).length !== 0) {
+    AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name + "NodeResolver", api, dataSource.name, "Query", "node", nodeResolverCode, customOpts);
+  }
+  dataSource.name.apply(n => resolveDataSourceName.contents(n));
+  log.info("PgQueryResolver_Builder", undefined, `provisioned for ` + handlers.length.toString() + ` read model(s)`);
+}
+
+let dataSourceName = dataSourceNamePromise;
+
+export {
+  log,
+  resolveDataSourceName,
+  dataSourceNamePromise,
+  dataSourceName,
+  entries,
+  register,
+  nodeTypes,
+  registerNodeType,
+  bool,
+  nodeResolverCode,
+  pgConnectionJson,
+  provision,
+}
+/* log Not a pure module */