@reventlessdev/reventless-aws 3.0.0-alpha.250 → 3.0.0-alpha.252

package/src/adapter/Geocoder/Geocoder_AwsLocation_Ops.res.mjs

@@ -12,25 +12,11 @@ function getEnv(k) {
   }
 }
 
-function corsHeaders() {
-  return Object.fromEntries([
-    [
+function jsonHeaders() {
+  return Object.fromEntries([[
       "content-type",
       "application/json"
-    ],
-    [
-      "access-control-allow-origin",
-      "*"
-    ],
-    [
-      "access-control-allow-methods",
-      "GET,OPTIONS"
-    ],
-    [
-      "access-control-allow-headers",
-      "*"
-    ]
-  ]);
+    ]]);
 }
 
 function readQueryParam(event) {
@@ -59,7 +45,10 @@ async function handler(event) {
     if (indexName === "" || q === "") {
       return {
         statusCode: 200,
-        headers: corsHeaders(),
+        headers: Object.fromEntries([[
+            "content-type",
+            "application/json"
+          ]]),
         body: "[]"
       };
     }
@@ -101,7 +90,10 @@ async function handler(event) {
     });
     return {
       statusCode: 200,
-      headers: corsHeaders(),
+      headers: Object.fromEntries([[
+          "content-type",
+          "application/json"
+        ]]),
       body: JSON.stringify(results)
     };
   } catch (raw_exn) {
@@ -109,7 +101,10 @@ async function handler(event) {
     console.error("Geocoder: search failed", exn);
     return {
       statusCode: 200,
-      headers: corsHeaders(),
+      headers: Object.fromEntries([[
+          "content-type",
+          "application/json"
+        ]]),
       body: "[]"
     };
   }
@@ -117,7 +112,7 @@ async function handler(event) {
 
 export {
   getEnv,
-  corsHeaders,
+  jsonHeaders,
   readQueryParam,
   handler,
 }

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res

@@ -260,9 +260,9 @@ let buildInboundReceiver = (
     let result = await callback.receive(publishJsons, args)
     switch auditQueryDbOps {
     | Some(ops) =>
-      let rows = callback.auditLog->Dict.toArray
-      let _ = await rows->Array.reduce(Promise.resolve(), async (prev, (id, row)) => {
-        let _ = await prev
+      let id = result->ReventlessCore.InboundTranslationSlice_Callback.requestIdOf
+      switch callback.auditLog->ReventlessCore.InboundTranslationSlice_Callback.takeAuditRow(id) {
+      | Some(row) =>
         let json = row->S.reverseConvertToJsonOrThrow(
           ReventlessCore.InboundTranslationSlice_Callback.auditRowSchema,
         )
@@ -291,7 +291,8 @@ let buildInboundReceiver = (
             `failed to persist audit row ${id}: ${detail}`,
           )->Effect.runSync
         }
-      })
+      | None => ()
+      }
     | None => ()
     }
     result

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res.mjs

@@ -1,7 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as S from "sury/src/S.res.mjs";
-import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
@@ -107,24 +106,21 @@ function buildInboundReceiver(spec, translation, publishJsons, auditQueryDbOps)
   return async args => {
     let result = await callback.receive(publishJsons, args);
     if (auditQueryDbOps !== undefined) {
-      let rows = Object.entries(callback.auditLog);
-      await Stdlib_Array.reduce(rows, Promise.resolve(), async (prev, param) => {
-        let id = param[0];
-        await prev;
-        let json = S.reverseConvertToJsonOrThrow(param[1], InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema);
+      let id = InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result);
+      let row = InboundTranslationSlice_Callback$ReventlessCore.takeAuditRow(callback.auditLog, id);
+      if (row !== undefined) {
+        let json = S.reverseConvertToJsonOrThrow(row, InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema);
         try {
           let err = await auditQueryDbOps.save(id, json, "Overwrite", undefined);
-          if (err.TAG === "Ok") {
-            return;
-          } else {
-            return Effect.runSync(EffectLogger$ReventlessCore.logError("InboundTranslationSlice.audit", undefined, `failed to persist audit row ` + id + `: ` + QueryDb$ReventlessCore.storageErrorToString(err._0)));
+          if (err.TAG !== "Ok") {
+            Effect.runSync(EffectLogger$ReventlessCore.logError("InboundTranslationSlice.audit", undefined, `failed to persist audit row ` + id + `: ` + QueryDb$ReventlessCore.storageErrorToString(err._0)));
           }
         } catch (raw_exn) {
           let exn = Primitive_exceptions.internalToException(raw_exn);
           let detail = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown error");
-          return Effect.runSync(EffectLogger$ReventlessCore.logError("InboundTranslationSlice.audit", undefined, `failed to persist audit row ` + id + `: ` + detail));
+          Effect.runSync(EffectLogger$ReventlessCore.logError("InboundTranslationSlice.audit", undefined, `failed to persist audit row ` + id + `: ` + detail));
         }
-      });
+      }
     }
     return CommandTopic_Helpers$ReventlessCore.commandOutcomeToJson(InboundTranslationSlice_Callback$ReventlessCore.receiveResultToOutcome(result));
   };

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -1,93 +1,119 @@
-// Direct-to-S3 upload presign service behind a public Lambda Function URL.
+// Direct-to-S3 upload service, mounted on the platform GraphQL API.
 //
-// Deploy-time only: `make` provisions a compiled-EntryPoint Lambda (a plain
+// Deploy-time only: `make` provisions one compiled-EntryPoint Lambda (a plain
 // `Lambda.Function` whose code archive re-exports `handler` from the compiled,
 // type-checked runtime module `Upload_Presign_S3_Ops` and ships the shared ESM
 // resolve-hook loader), an IAM execution role scoped to CloudWatch Logs +
-// `s3:PutObject` on the target bucket, and a Function URL (no auth) so a browser
-// can request a presigned PUT.
+// `s3:PutObject`/`s3:DeleteObject`/`s3:GetObject` on the declared stores' prefixes,
+// an AppSync Lambda data source, and two resolvers — `Mutation.Upload_Presign` and
+// `Mutation.Upload_Release` — on the platform API.
 //
-// Why an EntryPoint and not a Pulumi `CallbackFunction`: the handler needs the
-// AWS SDK v3 S3 presigner. A serialized closure bakes the deploy machine's
-// version-specific SDK internals into the archive but then resolves `@smithy/*`
-// and `@aws-sdk/*` transitives from independently-versioned layer/runtime sources
-// that disagree at cold start (an inlined `client-s3` against a newer
-// `@smithy/smithy-client` base whose constructor no longer sets `middlewareStack`
-// → `new S3Client()` throws). Shipping the compiled `_Ops` module with bare
-// `@aws-sdk/*` imports, resolved through the resolve-hook (`@aws-sdk/*` from the
-// runtime, `@smithy/*`/`@reventlessdev/*` from the layer), loads one internally
-// consistent SDK instead. The runtime logic lives in [Upload_Presign_S3_Ops.res].
+// There is no Function URL and no anonymous surface: authentication is the platform
+// API's Cognito authorizer, and the verified caller identity reaches the handler in
+// the resolver payload (see the JS resolver code below). This is route B of
+// [docs/plans/upload-release-path.md]; the anonymous Function URL and the unverified
+// `decodeJwtSub` the mint side used to carry are gone.
+//
+// Why an EntryPoint and not a Pulumi `CallbackFunction`: the handler needs the AWS
+// SDK v3 S3 presigner. A serialized closure bakes the deploy machine's
+// version-specific SDK internals into the archive but then resolves `@smithy/*` and
+// `@aws-sdk/*` transitives from independently-versioned layer/runtime sources that
+// disagree at cold start. Shipping the compiled `_Ops` module with bare `@aws-sdk/*`
+// imports, resolved through the resolve-hook, loads one internally consistent SDK.
+// The runtime logic lives in [Upload_Presign_S3_Ops.res].
 
 open PulumiAws
 
-type serviceOutputs = {
-  url: Pulumi.Output.t<string>,
-  resources: array<Pulumi.Output.t<string>>,
+type serviceOutputs = {resources: array<Pulumi.Output.t<string>>}
+
+// A store the service can presign into and release from. `qualified` is the
+// `{plugin}.{store}` name the caller passes as the mutation's `store` argument;
+// `bucketName` is the physical bucket; `servedPrefix` is the prefix keys are rooted
+// at (and therefore the prefix IAM is scoped to).
+type uploadStore = {
+  qualified: string,
+  bucketName: Pulumi.Input.t<string>,
+  servedPrefix: string,
 }
 
 /**
-The prefix presigned object keys are rooted at, and therefore the prefix the
-store must be served under for the returned `/{key}` ref to resolve.
-
-Exported so the serve side reads the same constant the mint side writes. The two
-have to agree exactly: a mismatch deploys green and 404s every object, because
-nothing at deploy time compares a minted key against a cache behavior.
+The prefix presigned object keys are rooted at, and therefore the prefix the store
+must be served under for the returned `/{key}` ref to resolve. Exported so the serve
+side reads the same constant the mint side writes.
 */
 let defaultServedPrefix = "uploads"
 
+// JS resolver code (APPSYNC_JS runtime): pass the caller's arguments and the
+// authorizer-verified identity to the Lambda, tagging the operation so one Lambda
+// serves both mutations. CORS and auth belong to the API, not to this code.
+let invokeCode = (operation: string): Pulumi.Input.t<string> =>
+  `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      operation: '${operation}',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { sub: id.sub, username: id.username, claims: id.claims }
+        : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
 let make = (
-  ~bucketName: Pulumi.Input.t<string>,
-  ~corsOrigins: array<string>=["*"],
-  // Prefix the presigned object keys are rooted at; must match the served
-  // bucket's CloudFront `{prefix}/*` behavior so the returned `/{key}` ref
-  // resolves.
-  ~servedPrefix: string=defaultServedPrefix,
-  // Resource-name stem. Defaults to the single-service name this adapter had
-  // when a deployment could only have one store, so the existing service keeps
-  // its identity; declared stores each pass their own, because there is one
-  // service per store.
-  //
-  // One service per store rather than one service with wildcard write across
-  // stores: a single wide-scoped presigner reintroduces exactly the blast radius
-  // the per-store split exists to remove, and it does so invisibly — every
-  // upload still works.
-  ~name: string="UploadPresignService",
-  ~opts=?,
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~stores: array<uploadStore>,
+  ~releaseWindowSeconds: int=900,
+  ~name: string="UploadService",
+  ~opts: Pulumi.ComponentResource.options,
 ): serviceOutputs => {
-  let serviceName = name
-  let opts =
-    opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
 
   let lambdaRole = IAM.Role.makeWithDefaultPolicy(
-    ~name=serviceName,
+    ~name=name ++ "Lambda",
     ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
     ~tags=AWS.Tags.make(
-      ~name=serviceName,
+      ~name=name ++ "Lambda",
       ~kind=ReventlessCore.ComponentType.Platform,
       ~role=Identity,
       ~scope=Platform,
     ),
-    ~opts?,
+    ~opts,
   )
 
-  // CloudWatch Logs (so failures are observable) plus least-privilege
-  // `s3:PutObject` on this store's own keys.
+  // Resolve every store's physical bucket name once; both the env map the handler
+  // reads and the IAM the presign/release grant needs are built from it.
+  let resolvedStores =
+    stores
+    ->Array.map(s =>
+      s.bucketName
+      ->Pulumi.Output.fromInput
+      ->Pulumi.Output.apply(b => (s.qualified, b, s.servedPrefix))
+    )
+    ->Pulumi.Output.all
+
+  // CloudWatch Logs plus least-privilege S3 on each declared store's own keys.
   //
-  // Scoped to `{bucket}/{servedPrefix}/*`, not to the whole bucket. Because keys
-  // are rooted at the store's prefix in *both* layouts, this one expression is
-  // least-privilege in both: a dedicated bucket's service still cannot write
-  // outside its prefix, and a shared bucket's services cannot write into each
-  // other's stores. The layouts stay one model — even the policy does not fork.
+  // Scoped to `{bucket}/{servedPrefix}/*` per store, never the whole bucket:
+  // `PutObject` presigns the upload, `DeleteObject` performs the release, and
+  // `GetObject` backs the `HeadObject` the age check reads. One Lambda covers every
+  // declared store (route B1) — but its reach is still the union of those prefixes,
+  // not a wildcard, so it cannot touch a key outside a declared store.
   let _policy =
-    bucketName
-    ->Pulumi.Output.fromInput
-    ->Pulumi.Output.apply(b => {
-      let arn = `arn:aws:s3:::${b}/${servedPrefix}/*`
+    resolvedStores->Pulumi.Output.apply(list => {
+      let arns = list->Array.map(((_, bucket, prefix)) => `arn:aws:s3:::${bucket}/${prefix}/*`)
       let _ = IAM.RolePolicy.make(
-        ~name=`${serviceName}Policy`,
+        ~name=name ++ "LambdaPolicy",
         ~args={
           policy: PolicyDocument.make(
-            ~id=`${serviceName}Policy`,
+            ~id=name ++ "LambdaPolicy",
             ~statements=[
               {
                 sid: "AllowLambdaLogging",
@@ -96,10 +122,10 @@ let make = (
                 resources: Resource("arn:aws:logs:*:*:*"),
               },
               {
-                sid: "AllowUploadPut",
+                sid: "AllowUploadObjectAccess",
                 effect: Allow,
-                actions: Action("s3:PutObject"),
-                resources: Resource(arn),
+                actions: Actions(["s3:PutObject", "s3:DeleteObject", "s3:GetObject"]),
+                resources: Resources(arns),
               },
             ],
           )
@@ -107,10 +133,27 @@ let make = (
           ->Pulumi.Input.make,
           role: lambdaRole.id->Pulumi.Output.asInput,
         },
-        ~opts?,
+        ~opts,
       )
     })
 
+  // `UPLOAD_STORES` — the qualified-name → {bucket, prefix} map the handler resolves
+  // the caller's `store` argument against.
+  let uploadStoresJson =
+    resolvedStores->Pulumi.Output.apply(list =>
+      list
+      ->Array.map(((qualified, bucket, prefix)) => (
+        qualified,
+        Dict.fromArray([
+          ("bucket", JSON.Encode.string(bucket)),
+          ("prefix", JSON.Encode.string(prefix)),
+        ])->JSON.Encode.object,
+      ))
+      ->Dict.fromArray
+      ->JSON.Encode.object
+      ->JSON.stringify
+    )
+
   // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and
   // re-export its `handler`; buildCodeArchive also ships the ESM resolve-hook.
   let packageDirs = Dict.fromArray([
@@ -131,7 +174,7 @@ let make = (
     ->Pulumi.Input.make
 
   let lambda = Lambda.Function.make(
-    ~name=serviceName,
+    ~name=name ++ "Lambda",
     ~args={
       handler: "index.handler"->Pulumi.Input.make,
       runtime: "nodejs22.x"->Pulumi.Input.make,
@@ -142,7 +185,7 @@ let make = (
       timeout: 30->Pulumi.Input.make,
       layers,
       tags: AWS.Tags.make(
-        ~name=serviceName,
+        ~name=name ++ "Lambda",
         ~kind=ReventlessCore.ComponentType.Platform,
         ~role=Runtime,
         ~scope=Platform,
@@ -151,43 +194,87 @@ let make = (
         {
           Lambda.Function.variables: Dict.fromArray([
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
-            ("UPLOAD_BUCKET", bucketName),
-            ("SERVED_PREFIX", Pulumi.Input.make(servedPrefix)),
+            ("UPLOAD_STORES", uploadStoresJson->Pulumi.Output.asInput),
+            ("RELEASE_WINDOW_SECONDS", releaseWindowSeconds->Int.toString->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
     },
-    ~opts?,
+    ~opts,
   )
 
-  let functionUrl = FunctionUrl.make(
-    ~name=`${serviceName}Url`,
-    ~args={
-      authorizationType: FunctionUrl.None,
-      functionName: lambda.name->Pulumi.Output.asInput,
-      cors: (
-        {
-          allowMethods: ["POST"]->Array.map(Pulumi.Input.make)->Pulumi.Input.make,
-          allowOrigins: corsOrigins->Array.map(Pulumi.Input.make)->Pulumi.Input.make,
-          // `content-type` and `authorization` named explicitly rather than `*`:
-          // `Access-Control-Allow-Headers: *` is a wildcard that, per the Fetch
-          // spec, does NOT cover `Authorization`. The presign POST carries a
-          // bearer token, so a wildcard fails its preflight and the browser
-          // rejects the request before it is sent — a silent break for every
-          // authenticated upload.
-          allowHeaders: ["content-type", "authorization"]
-          ->Array.map(Pulumi.Input.make)
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "DataSource",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
+    ~opts,
+  )
+
+  let _ =
+    (lambda.arn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeLambda",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
           ->Pulumi.Input.make,
-        }: FunctionUrl.cors
-      )->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambda.arn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
     },
-    ~opts?,
+    ~opts=Some(opts),
+  )
+
+  let _presignResolver = AppSync_Resolver_Native.makeUnitJsResolver(
+    ~name=name ++ "Presign",
+    ~api,
+    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+    ~type_="Mutation"->Pulumi.Input.make,
+    ~field="Upload_Presign"->Pulumi.Input.make,
+    ~code=invokeCode("presign"),
+    ~opts,
+  )
+
+  let _releaseResolver = AppSync_Resolver_Native.makeUnitJsResolver(
+    ~name=name ++ "Release",
+    ~api,
+    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+    ~type_="Mutation"->Pulumi.Input.make,
+    ~field="Upload_Release"->Pulumi.Input.make,
+    ~code=invokeCode("release"),
+    ~opts,
   )
 
-  {
-    url: functionUrl.functionUrl,
-    resources: [lambda.arn, functionUrl.functionArn],
-  }
+  {resources: [lambda.arn]}
 }