@reventlessdev/reventless-aws 3.0.0-alpha.251 → 3.0.0-alpha.252

package/src/adapter/Geocoder/Geocoder_AwsLocation_Ops.res.mjs

@@ -12,25 +12,11 @@ function getEnv(k) {
   }
 }
 
-function corsHeaders() {
-  return Object.fromEntries([
-    [
+function jsonHeaders() {
+  return Object.fromEntries([[
       "content-type",
       "application/json"
-    ],
-    [
-      "access-control-allow-origin",
-      "*"
-    ],
-    [
-      "access-control-allow-methods",
-      "GET,OPTIONS"
-    ],
-    [
-      "access-control-allow-headers",
-      "*"
-    ]
-  ]);
+    ]]);
 }
 
 function readQueryParam(event) {
@@ -59,7 +45,10 @@ async function handler(event) {
     if (indexName === "" || q === "") {
       return {
         statusCode: 200,
-        headers: corsHeaders(),
+        headers: Object.fromEntries([[
+            "content-type",
+            "application/json"
+          ]]),
         body: "[]"
       };
     }
@@ -101,7 +90,10 @@ async function handler(event) {
     });
     return {
       statusCode: 200,
-      headers: corsHeaders(),
+      headers: Object.fromEntries([[
+          "content-type",
+          "application/json"
+        ]]),
       body: JSON.stringify(results)
     };
   } catch (raw_exn) {
@@ -109,7 +101,10 @@ async function handler(event) {
     console.error("Geocoder: search failed", exn);
     return {
       statusCode: 200,
-      headers: corsHeaders(),
+      headers: Object.fromEntries([[
+          "content-type",
+          "application/json"
+        ]]),
       body: "[]"
     };
   }
@@ -117,7 +112,7 @@ async function handler(event) {
 
 export {
   getEnv,
-  corsHeaders,
+  jsonHeaders,
   readQueryParam,
   handler,
 }

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -1,93 +1,119 @@
-// Direct-to-S3 upload presign service behind a public Lambda Function URL.
+// Direct-to-S3 upload service, mounted on the platform GraphQL API.
 //
-// Deploy-time only: `make` provisions a compiled-EntryPoint Lambda (a plain
+// Deploy-time only: `make` provisions one compiled-EntryPoint Lambda (a plain
 // `Lambda.Function` whose code archive re-exports `handler` from the compiled,
 // type-checked runtime module `Upload_Presign_S3_Ops` and ships the shared ESM
 // resolve-hook loader), an IAM execution role scoped to CloudWatch Logs +
-// `s3:PutObject` on the target bucket, and a Function URL (no auth) so a browser
-// can request a presigned PUT.
+// `s3:PutObject`/`s3:DeleteObject`/`s3:GetObject` on the declared stores' prefixes,
+// an AppSync Lambda data source, and two resolvers — `Mutation.Upload_Presign` and
+// `Mutation.Upload_Release` — on the platform API.
 //
-// Why an EntryPoint and not a Pulumi `CallbackFunction`: the handler needs the
-// AWS SDK v3 S3 presigner. A serialized closure bakes the deploy machine's
-// version-specific SDK internals into the archive but then resolves `@smithy/*`
-// and `@aws-sdk/*` transitives from independently-versioned layer/runtime sources
-// that disagree at cold start (an inlined `client-s3` against a newer
-// `@smithy/smithy-client` base whose constructor no longer sets `middlewareStack`
-// → `new S3Client()` throws). Shipping the compiled `_Ops` module with bare
-// `@aws-sdk/*` imports, resolved through the resolve-hook (`@aws-sdk/*` from the
-// runtime, `@smithy/*`/`@reventlessdev/*` from the layer), loads one internally
-// consistent SDK instead. The runtime logic lives in [Upload_Presign_S3_Ops.res].
+// There is no Function URL and no anonymous surface: authentication is the platform
+// API's Cognito authorizer, and the verified caller identity reaches the handler in
+// the resolver payload (see the JS resolver code below). This is route B of
+// [docs/plans/upload-release-path.md]; the anonymous Function URL and the unverified
+// `decodeJwtSub` the mint side used to carry are gone.
+//
+// Why an EntryPoint and not a Pulumi `CallbackFunction`: the handler needs the AWS
+// SDK v3 S3 presigner. A serialized closure bakes the deploy machine's
+// version-specific SDK internals into the archive but then resolves `@smithy/*` and
+// `@aws-sdk/*` transitives from independently-versioned layer/runtime sources that
+// disagree at cold start. Shipping the compiled `_Ops` module with bare `@aws-sdk/*`
+// imports, resolved through the resolve-hook, loads one internally consistent SDK.
+// The runtime logic lives in [Upload_Presign_S3_Ops.res].
 
 open PulumiAws
 
-type serviceOutputs = {
-  url: Pulumi.Output.t<string>,
-  resources: array<Pulumi.Output.t<string>>,
+type serviceOutputs = {resources: array<Pulumi.Output.t<string>>}
+
+// A store the service can presign into and release from. `qualified` is the
+// `{plugin}.{store}` name the caller passes as the mutation's `store` argument;
+// `bucketName` is the physical bucket; `servedPrefix` is the prefix keys are rooted
+// at (and therefore the prefix IAM is scoped to).
+type uploadStore = {
+  qualified: string,
+  bucketName: Pulumi.Input.t<string>,
+  servedPrefix: string,
 }
 
 /**
-The prefix presigned object keys are rooted at, and therefore the prefix the
-store must be served under for the returned `/{key}` ref to resolve.
-
-Exported so the serve side reads the same constant the mint side writes. The two
-have to agree exactly: a mismatch deploys green and 404s every object, because
-nothing at deploy time compares a minted key against a cache behavior.
+The prefix presigned object keys are rooted at, and therefore the prefix the store
+must be served under for the returned `/{key}` ref to resolve. Exported so the serve
+side reads the same constant the mint side writes.
 */
 let defaultServedPrefix = "uploads"
 
+// JS resolver code (APPSYNC_JS runtime): pass the caller's arguments and the
+// authorizer-verified identity to the Lambda, tagging the operation so one Lambda
+// serves both mutations. CORS and auth belong to the API, not to this code.
+let invokeCode = (operation: string): Pulumi.Input.t<string> =>
+  `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      operation: '${operation}',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { sub: id.sub, username: id.username, claims: id.claims }
+        : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
 let make = (
-  ~bucketName: Pulumi.Input.t<string>,
-  ~corsOrigins: array<string>=["*"],
-  // Prefix the presigned object keys are rooted at; must match the served
-  // bucket's CloudFront `{prefix}/*` behavior so the returned `/{key}` ref
-  // resolves.
-  ~servedPrefix: string=defaultServedPrefix,
-  // Resource-name stem. Defaults to the single-service name this adapter had
-  // when a deployment could only have one store, so the existing service keeps
-  // its identity; declared stores each pass their own, because there is one
-  // service per store.
-  //
-  // One service per store rather than one service with wildcard write across
-  // stores: a single wide-scoped presigner reintroduces exactly the blast radius
-  // the per-store split exists to remove, and it does so invisibly — every
-  // upload still works.
-  ~name: string="UploadPresignService",
-  ~opts=?,
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~stores: array<uploadStore>,
+  ~releaseWindowSeconds: int=900,
+  ~name: string="UploadService",
+  ~opts: Pulumi.ComponentResource.options,
 ): serviceOutputs => {
-  let serviceName = name
-  let opts =
-    opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
 
   let lambdaRole = IAM.Role.makeWithDefaultPolicy(
-    ~name=serviceName,
+    ~name=name ++ "Lambda",
     ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
     ~tags=AWS.Tags.make(
-      ~name=serviceName,
+      ~name=name ++ "Lambda",
       ~kind=ReventlessCore.ComponentType.Platform,
       ~role=Identity,
       ~scope=Platform,
     ),
-    ~opts?,
+    ~opts,
   )
 
-  // CloudWatch Logs (so failures are observable) plus least-privilege
-  // `s3:PutObject` on this store's own keys.
+  // Resolve every store's physical bucket name once; both the env map the handler
+  // reads and the IAM the presign/release grant needs are built from it.
+  let resolvedStores =
+    stores
+    ->Array.map(s =>
+      s.bucketName
+      ->Pulumi.Output.fromInput
+      ->Pulumi.Output.apply(b => (s.qualified, b, s.servedPrefix))
+    )
+    ->Pulumi.Output.all
+
+  // CloudWatch Logs plus least-privilege S3 on each declared store's own keys.
   //
-  // Scoped to `{bucket}/{servedPrefix}/*`, not to the whole bucket. Because keys
-  // are rooted at the store's prefix in *both* layouts, this one expression is
-  // least-privilege in both: a dedicated bucket's service still cannot write
-  // outside its prefix, and a shared bucket's services cannot write into each
-  // other's stores. The layouts stay one model — even the policy does not fork.
+  // Scoped to `{bucket}/{servedPrefix}/*` per store, never the whole bucket:
+  // `PutObject` presigns the upload, `DeleteObject` performs the release, and
+  // `GetObject` backs the `HeadObject` the age check reads. One Lambda covers every
+  // declared store (route B1) — but its reach is still the union of those prefixes,
+  // not a wildcard, so it cannot touch a key outside a declared store.
   let _policy =
-    bucketName
-    ->Pulumi.Output.fromInput
-    ->Pulumi.Output.apply(b => {
-      let arn = `arn:aws:s3:::${b}/${servedPrefix}/*`
+    resolvedStores->Pulumi.Output.apply(list => {
+      let arns = list->Array.map(((_, bucket, prefix)) => `arn:aws:s3:::${bucket}/${prefix}/*`)
       let _ = IAM.RolePolicy.make(
-        ~name=`${serviceName}Policy`,
+        ~name=name ++ "LambdaPolicy",
         ~args={
           policy: PolicyDocument.make(
-            ~id=`${serviceName}Policy`,
+            ~id=name ++ "LambdaPolicy",
             ~statements=[
               {
                 sid: "AllowLambdaLogging",
@@ -96,10 +122,10 @@ let make = (
                 resources: Resource("arn:aws:logs:*:*:*"),
               },
               {
-                sid: "AllowUploadPut",
+                sid: "AllowUploadObjectAccess",
                 effect: Allow,
-                actions: Action("s3:PutObject"),
-                resources: Resource(arn),
+                actions: Actions(["s3:PutObject", "s3:DeleteObject", "s3:GetObject"]),
+                resources: Resources(arns),
               },
             ],
           )
@@ -107,10 +133,27 @@ let make = (
           ->Pulumi.Input.make,
           role: lambdaRole.id->Pulumi.Output.asInput,
         },
-        ~opts?,
+        ~opts,
       )
     })
 
+  // `UPLOAD_STORES` — the qualified-name → {bucket, prefix} map the handler resolves
+  // the caller's `store` argument against.
+  let uploadStoresJson =
+    resolvedStores->Pulumi.Output.apply(list =>
+      list
+      ->Array.map(((qualified, bucket, prefix)) => (
+        qualified,
+        Dict.fromArray([
+          ("bucket", JSON.Encode.string(bucket)),
+          ("prefix", JSON.Encode.string(prefix)),
+        ])->JSON.Encode.object,
+      ))
+      ->Dict.fromArray
+      ->JSON.Encode.object
+      ->JSON.stringify
+    )
+
   // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and
   // re-export its `handler`; buildCodeArchive also ships the ESM resolve-hook.
   let packageDirs = Dict.fromArray([
@@ -131,7 +174,7 @@ let make = (
     ->Pulumi.Input.make
 
   let lambda = Lambda.Function.make(
-    ~name=serviceName,
+    ~name=name ++ "Lambda",
     ~args={
       handler: "index.handler"->Pulumi.Input.make,
       runtime: "nodejs22.x"->Pulumi.Input.make,
@@ -142,7 +185,7 @@ let make = (
       timeout: 30->Pulumi.Input.make,
       layers,
       tags: AWS.Tags.make(
-        ~name=serviceName,
+        ~name=name ++ "Lambda",
         ~kind=ReventlessCore.ComponentType.Platform,
         ~role=Runtime,
         ~scope=Platform,
@@ -151,43 +194,87 @@ let make = (
         {
           Lambda.Function.variables: Dict.fromArray([
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
-            ("UPLOAD_BUCKET", bucketName),
-            ("SERVED_PREFIX", Pulumi.Input.make(servedPrefix)),
+            ("UPLOAD_STORES", uploadStoresJson->Pulumi.Output.asInput),
+            ("RELEASE_WINDOW_SECONDS", releaseWindowSeconds->Int.toString->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
     },
-    ~opts?,
+    ~opts,
   )
 
-  let functionUrl = FunctionUrl.make(
-    ~name=`${serviceName}Url`,
-    ~args={
-      authorizationType: FunctionUrl.None,
-      functionName: lambda.name->Pulumi.Output.asInput,
-      cors: (
-        {
-          allowMethods: ["POST"]->Array.map(Pulumi.Input.make)->Pulumi.Input.make,
-          allowOrigins: corsOrigins->Array.map(Pulumi.Input.make)->Pulumi.Input.make,
-          // `content-type` and `authorization` named explicitly rather than `*`:
-          // `Access-Control-Allow-Headers: *` is a wildcard that, per the Fetch
-          // spec, does NOT cover `Authorization`. The presign POST carries a
-          // bearer token, so a wildcard fails its preflight and the browser
-          // rejects the request before it is sent — a silent break for every
-          // authenticated upload.
-          allowHeaders: ["content-type", "authorization"]
-          ->Array.map(Pulumi.Input.make)
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "DataSource",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
+    ~opts,
+  )
+
+  let _ =
+    (lambda.arn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeLambda",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
           ->Pulumi.Input.make,
-        }: FunctionUrl.cors
-      )->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambda.arn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
     },
-    ~opts?,
+    ~opts=Some(opts),
+  )
+
+  let _presignResolver = AppSync_Resolver_Native.makeUnitJsResolver(
+    ~name=name ++ "Presign",
+    ~api,
+    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+    ~type_="Mutation"->Pulumi.Input.make,
+    ~field="Upload_Presign"->Pulumi.Input.make,
+    ~code=invokeCode("presign"),
+    ~opts,
+  )
+
+  let _releaseResolver = AppSync_Resolver_Native.makeUnitJsResolver(
+    ~name=name ++ "Release",
+    ~api,
+    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+    ~type_="Mutation"->Pulumi.Input.make,
+    ~field="Upload_Release"->Pulumi.Input.make,
+    ~code=invokeCode("release"),
+    ~opts,
   )
 
-  {
-    url: functionUrl.functionUrl,
-    resources: [lambda.arn, functionUrl.functionArn],
-  }
+  {resources: [lambda.arn]}
 }

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -2,28 +2,53 @@
 
 import * as Aws from "@pulumi/aws";
 import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
-import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
 import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AppSync_Resolver_Native$ReventlessAws from "../Api/AppSync_Resolver_Native.res.mjs";
 
-let defaultServedPrefix = "uploads";
+function invokeCode(operation) {
+  return `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      operation: '` + operation + `',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { sub: id.sub, username: id.username, claims: id.claims }
+        : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+}
 
-function make(bucketName, corsOriginsOpt, servedPrefixOpt, nameOpt, opts) {
-  let corsOrigins = corsOriginsOpt !== undefined ? corsOriginsOpt : ["*"];
-  let servedPrefix = servedPrefixOpt !== undefined ? servedPrefixOpt : defaultServedPrefix;
-  let name = nameOpt !== undefined ? nameOpt : "UploadPresignService";
-  let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
-  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
-  bucketName.apply(b => {
-    let arn = `arn:aws:s3:::` + b + `/` + servedPrefix + `/*`;
-    new (Aws.iam.RolePolicy)(name + `Policy`, {
-      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `Policy`, [
+function make(api, stores, releaseWindowSecondsOpt, nameOpt, opts) {
+  let releaseWindowSeconds = releaseWindowSecondsOpt !== undefined ? releaseWindowSecondsOpt : 900;
+  let name = nameOpt !== undefined ? nameOpt : "UploadService";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  let resolvedStores = Pulumi.all(stores.map(s => s.bucketName.apply(b => [
+    s.qualified,
+    b,
+    s.servedPrefix
+  ])));
+  resolvedStores.apply(list => {
+    let arns = list.map(param => `arn:aws:s3:::` + param[1] + `/` + param[2] + `/*`);
+    new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
         {
           Sid: "AllowLambdaLogging",
           Effect: "Allow",
@@ -35,22 +60,39 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, nameOpt, opts) {
           Resource: "arn:aws:logs:*:*:*"
         },
         {
-          Sid: "AllowUploadPut",
+          Sid: "AllowUploadObjectAccess",
           Effect: "Allow",
-          Action: "s3:PutObject",
-          Resource: arn
+          Action: [
+            "s3:PutObject",
+            "s3:DeleteObject",
+            "s3:GetObject"
+          ],
+          Resource: arns
         }
       ])),
       role: lambdaRole.id
-    }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+    }, opts$1);
   });
+  let uploadStoresJson = resolvedStores.apply(list => JSON.stringify(Object.fromEntries(list.map(param => [
+    param[0],
+    Object.fromEntries([
+      [
+        "bucket",
+        param[1]
+      ],
+      [
+        "prefix",
+        param[2]
+      ]
+    ])
+  ]))));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs", packageDirs, undefined);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
-  let lambda = new (Aws.lambda.Function)(name, {
+  let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
     runtime: "nodejs22.x",
     code: match.code,
@@ -58,7 +100,7 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, nameOpt, opts) {
     memorySize: 256,
     timeout: 30,
     layers: layers,
-    tags: AWS_Tags$ReventlessAws.make(name, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
+    tags: AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
     environment: {
       variables: Object.fromEntries([
         [
@@ -66,12 +108,12 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, nameOpt, opts) {
           Pulumi.getStack()
         ],
         [
-          "UPLOAD_BUCKET",
-          bucketName
+          "UPLOAD_STORES",
+          uploadStoresJson
         ],
         [
-          "SERVED_PREFIX",
-          servedPrefix
+          "RELEASE_WINDOW_SECONDS",
+          releaseWindowSeconds.toString()
         ],
         [
           "NODE_OPTIONS",
@@ -84,30 +126,78 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, nameOpt, opts) {
       ])
     },
     sourceCodeHash: match.sourceCodeHash
-  }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
-  let functionUrl = new (Aws.lambda.FunctionUrl)(name + `Url`, {
-    authorizationType: "NONE",
-    functionName: lambda.name,
-    cors: {
-      allowHeaders: [
-        "content-type",
-        "authorization"
-      ].map(prim => prim),
-      allowMethods: ["POST"].map(prim => prim),
-      allowOrigins: corsOrigins.map(prim => prim)
+  }, opts$1);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  Pulumi.all([
+    lambda.arn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeLambda",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts$1);
+  });
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambda.arn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts$1);
+  AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "Presign", api, dataSource.name, "Mutation", "Upload_Presign", `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      operation: '` + "presign" + `',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { sub: id.sub, username: id.username, claims: id.claims }
+        : null
     }
-  }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`, opts$1);
+  AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "Release", api, dataSource.name, "Mutation", "Upload_Release", `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
   return {
-    url: functionUrl.functionUrl,
-    resources: [
-      lambda.arn,
-      functionUrl.functionArn
-    ]
+    operation: 'Invoke',
+    payload: {
+      operation: '` + "release" + `',
+      arguments: ctx.args,
+      identity: id != null && id.sub != null
+        ? { sub: id.sub, username: id.username, claims: id.claims }
+        : null
+    }
   };
 }
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`, opts$1);
+  return {
+    resources: [lambda.arn]
+  };
+}
+
+let defaultServedPrefix = "uploads";
 
 export {
   defaultServedPrefix,
+  invokeCode,
   make,
 }
 /* @pulumi/aws Not a pure module */