@reventlessdev/reventless-aws 3.0.0-alpha.291 → 3.0.0-alpha.293

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs

@@ -0,0 +1,230 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as IndexJs from "@pulumi/pulumi/dynamic/index.js";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let readOnlyKeys = [
+  "Id",
+  "Name",
+  "Arn",
+  "Status",
+  "CreationDate",
+  "LastModifiedDate",
+  "SchemaAttributes",
+  "AliasAttributes",
+  "UsernameAttributes",
+  "UsernameConfiguration",
+  "EstimatedNumberOfUsers",
+  "Domain",
+  "CustomDomain",
+  "SmsConfigurationFailure",
+  "EmailConfigurationFailure"
+];
+
+function mergedUpdateInput(described, userPoolId, preTokenGenerationArn) {
+  let out = {};
+  Stdlib_Dict.forEachWithKey(described, (value, key) => {
+    if (!readOnlyKeys.includes(key)) {
+      out[key] = value;
+      return;
+    }
+  });
+  Stdlib_Option.forEach(described["Name"], name => {
+    out["PoolName"] = name;
+  });
+  out["UserPoolId"] = userPoolId;
+  let lambdaConfig = Stdlib_Option.mapOr(Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object), {}, existing => Object.fromEntries(Object.entries(existing)));
+  if (preTokenGenerationArn !== undefined) {
+    lambdaConfig["PreTokenGeneration"] = preTokenGenerationArn;
+  } else {
+    Stdlib_Dict.$$delete(lambdaConfig, "PreTokenGeneration");
+  }
+  out["LambdaConfig"] = lambdaConfig;
+  return out;
+}
+
+function attachedTrigger(described) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object), c => c["PreTokenGeneration"]), Stdlib_JSON.Decode.string);
+}
+
+let newOf1 = ((C, x) => new C(x));
+
+let newOf0 = ((C) => new C());
+
+let _sdk = {
+  contents: undefined
+};
+
+let _client = {
+  contents: undefined
+};
+
+async function getSdk() {
+  let m = _sdk.contents;
+  if (m !== undefined) {
+    return m;
+  }
+  let m$1 = await import("@aws-sdk/client-cognito-identity-provider");
+  _sdk.contents = m$1;
+  return m$1;
+}
+
+async function getClient() {
+  let c = _client.contents;
+  if (c !== undefined) {
+    return Primitive_option.valFromOption(c);
+  }
+  let sdk = await getSdk();
+  let c$1 = newOf0(sdk.CognitoIdentityProviderClient);
+  _client.contents = Primitive_option.some(c$1);
+  return c$1;
+}
+
+function isPoolGoneError(jsErr) {
+  let match = jsErr.name;
+  let match$1 = Stdlib_JsExn.message(jsErr);
+  if (match == null) {
+    if (match$1 !== undefined) {
+      return match$1.includes("ResourceNotFoundException");
+    } else {
+      return false;
+    }
+  } else if (match === "ResourceNotFoundException") {
+    return true;
+  } else if (match$1 !== undefined) {
+    return match$1.includes("ResourceNotFoundException");
+  } else {
+    return false;
+  }
+}
+
+async function describePool(userPoolId) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  let result = await client.send(newOf1(sdk.DescribeUserPoolCommand, {
+    UserPoolId: userPoolId
+  }));
+  return Stdlib_Option.flatMap(result.UserPool, Stdlib_JSON.Decode.object);
+}
+
+async function applyTrigger(userPoolId, preTokenGenerationArn) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  let described = await describePool(userPoolId);
+  if (described === undefined) {
+    return Stdlib_JsError.throwWithMessage(`DescribeUserPool returned no pool for "` + userPoolId + `"; refusing to send an UpdateUserPool that would reset it`);
+  }
+  let input = mergedUpdateInput(described, userPoolId, preTokenGenerationArn);
+  return await client.send(newOf1(sdk.UpdateUserPoolCommand, input));
+}
+
+async function create(inputs) {
+  await applyTrigger(inputs.userPoolId, inputs.preTokenGenerationArn);
+  return {
+    id: inputs.userPoolId,
+    outs: {
+      userPoolId: inputs.userPoolId,
+      preTokenGenerationArn: inputs.preTokenGenerationArn
+    }
+  };
+}
+
+async function update(_id, _olds, news) {
+  await applyTrigger(news.userPoolId, news.preTokenGenerationArn);
+  return {
+    outs: {
+      userPoolId: news.userPoolId,
+      preTokenGenerationArn: news.preTokenGenerationArn
+    }
+  };
+}
+
+async function delete_(_id, props) {
+  try {
+    return await applyTrigger(props.userPoolId, undefined);
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Stdlib_Option.mapOr(Stdlib_JsExn.fromException(exn), false, isPoolGoneError)) {
+      return log.info("Auth_ActiveRolePoolAttachment", undefined, `user pool ` + props.userPoolId + ` is gone; nothing to detach`);
+    }
+    throw exn;
+  }
+}
+
+function diff_(_id, olds, news) {
+  let poolChanged = olds.userPoolId !== news.userPoolId;
+  return {
+    changes: poolChanged || olds.preTokenGenerationArn !== news.preTokenGenerationArn,
+    replaces: poolChanged ? ["userPoolId"] : [],
+    deleteBeforeReplace: true
+  };
+}
+
+async function read_(id, props) {
+  try {
+    let described = await describePool(props.userPoolId);
+    if (described !== undefined) {
+      return {
+        id: id,
+        props: {
+          userPoolId: props.userPoolId,
+          preTokenGenerationArn: Stdlib_Option.getOr(attachedTrigger(described), "")
+        }
+      };
+    } else {
+      return {};
+    }
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Stdlib_Option.mapOr(Stdlib_JsExn.fromException(exn), false, isPoolGoneError)) {
+      return {};
+    }
+    throw exn;
+  }
+}
+
+let provider = {
+  create: create,
+  update: update,
+  delete: delete_,
+  diff: diff_,
+  read: read_
+};
+
+function make(nameOpt, props, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "ActiveRolePoolAttachment";
+  return new IndexJs.Resource(provider, name, props, opts);
+}
+
+export {
+  log,
+  readOnlyKeys,
+  mergedUpdateInput,
+  attachedTrigger,
+  newOf1,
+  newOf0,
+  _sdk,
+  _client,
+  getSdk,
+  getClient,
+  isPoolGoneError,
+  describePool,
+  applyTrigger,
+  create,
+  update,
+  delete_,
+  diff_,
+  read_,
+  provider,
+  make,
+}
+/* log Not a pure module */

package/src/adapter/Auth/Auth_ActiveRoleStore.res

@@ -0,0 +1,280 @@
+// The role a caller chose to act as, as server-side state — and the one door
+// that writes it. See [docs/plans/active-role-narrows-the-token.md] §6.
+//
+// Why state rather than a parameter on the token request: Cognito "doesn't
+// include data from the ClientMetadata parameter in AdminInitiateAuth and
+// InitiateAuth API operations in the request that it passes to the pre token
+// generation function", and a role switch is a `REFRESH_TOKEN_AUTH` flow — an
+// `InitiateAuth` one. The channel that looks purpose-built for carrying the
+// choice is closed on exactly the path that needs it, so the choice is stored
+// here and the trigger reads it on the next refresh.
+//
+// Why not a `custom:activeRole` attribute on the user, which was the first
+// design: a Cognito custom attribute is a one-way door — it can never be removed
+// or retyped once added to a pool. A table avoids permanently amending a
+// customer's user pool to hold a preference.
+//
+// Split in two because the pieces are needed at different points in the deploy
+// graph, and the order is forced rather than chosen:
+//
+//   makeTable      the rows. Depends on nothing.
+//   ↓
+//   trigger        needs the table to read from ([Auth_ActiveRoleTrigger.res])
+//   ↓
+//   user pool      needs the trigger's ARN as `lambdaConfig.preTokenGeneration`
+//   ↓
+//   GraphQL API    needs the pool as its authorizer
+//   ↓
+//   makeWriteDoor  needs the API to hang a resolver on, and the table to write
+//
+// Provisioning the table with the write door instead would close that chain into
+// a cycle, so the table is hoisted to where the pool is resolved.
+
+open PulumiAws
+
+type storeTable = {
+  name: Pulumi.Output.t<string>,
+  arn: Pulumi.Output.t<string>,
+}
+
+// JS resolver code (APPSYNC_JS runtime): forward the caller's arguments and the
+// authorizer-verified identity. `sub` is what keys the row, and it comes from
+// here — the mutation has no `sub` argument for a client to supply.
+let invokeCode: Pulumi.Input.t<string> = `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      arguments: ctx.args,
+      identity: id != null && id.sub != null ? { sub: id.sub } : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+/** One row per subject: `id` is the caller's Cognito `sub`, `activeRole` the
+  group they chose, `updatedAt` an operational breadcrumb. No sort key — a caller
+  acts as exactly one role at a time, so the row is the whole state. */
+let makeTable = (
+  ~name: string="ActiveRoleStore",
+  ~opts: Pulumi.ComponentResource.options,
+): storeTable => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+  let table = Util_DynamoDb.makeTable(
+    ~attributes=[{name: "id", type_: "S"}],
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "Table",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Auth,
+      ~scope=Platform,
+    ),
+    ~opts,
+    name,
+  )
+  {name: table.name, arn: table.arn}
+}
+
+/** The Lambda behind `Mutation.Platform_SetActiveRole` and its resolver: an
+  execution role scoped to Logs + the one table + `AdminListGroupsForUser` on the
+  one pool, an AppSync Lambda data source, and the resolver itself. */
+let makeWriteDoor = (
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~table: storeTable,
+  ~cognitoUserPoolId: Pulumi.Input.t<string>,
+  ~cognitoUserPoolArn: Pulumi.Input.t<string>,
+  ~name: string="ActiveRoleStore",
+  ~opts: Pulumi.ComponentResource.options,
+): unit => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+
+  let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "Lambda",
+    ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "Lambda",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
+    ~opts,
+  )
+
+  // Logs, the one table, and group membership on the one pool.
+  //
+  // `AdminListGroupsForUser` is what makes the refusal in the handler real: a
+  // narrowed token carries a single group, so membership has to come from
+  // Cognito rather than from the token, or a caller who narrowed once could
+  // never widen back. Scoped to this pool's ARN, and it is a read — this role
+  // cannot add anyone to a group, only observe who is in one.
+  let _policy =
+    (table.arn, cognitoUserPoolArn->Pulumi.Output.fromInput)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((tableArn, poolArn)) => {
+      let _ = IAM.RolePolicy.make(
+        ~name=name ++ "LambdaPolicy",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "LambdaPolicy",
+            ~statements=[
+              {
+                sid: "AllowLambdaLogging",
+                effect: Allow,
+                actions: Actions([
+                  "logs:CreateLogGroup",
+                  "logs:CreateLogStream",
+                  "logs:PutLogEvents",
+                ]),
+                resources: Resource("arn:aws:logs:*:*:*"),
+              },
+              {
+                sid: "AllowActiveRoleRowAccess",
+                effect: Allow,
+                actions: Actions(["dynamodb:PutItem", "dynamodb:DeleteItem", "dynamodb:GetItem"]),
+                resources: Resource(tableArn),
+              },
+              {
+                sid: "AllowReadingOwnPoolMembership",
+                effect: Allow,
+                actions: Action("cognito-idp:AdminListGroupsForUser"),
+                resources: Resource(poolArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts,
+      )
+    })
+
+  let packageDirs = Dict.fromArray([
+    (
+      "@reventlessdev/reventless-aws",
+      Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws"),
+    ),
+  ])
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs",
+    ~packageDirs,
+    ~bundleRuntimeExtensions=false,
+  )
+
+  let layers =
+    Lambda.reventlessLayerArn
+    ->Option.map(arn => [arn->Pulumi.Input.make])
+    ->Option.getOr([])
+    ->Pulumi.Input.make
+
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
+  let lambda = Lambda.Function.make(
+    ~name=name ++ "Lambda",
+    ~args={
+      handler: "index.handler"->Pulumi.Input.make,
+      runtime: "nodejs22.x"->Pulumi.Input.make,
+      code: code->Pulumi.Input.make,
+      sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+      role: lambdaRole.arn->Pulumi.Output.asInput,
+      memorySize: 256->Pulumi.Input.make,
+      timeout: 30->Pulumi.Input.make,
+      layers,
+      tags: AWS.Tags.make(
+        ~name=name ++ "Lambda",
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Runtime,
+        ~scope=Platform,
+      ),
+      environment: (
+        {
+          Lambda.Function.variables: Dict.fromArray([
+            ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+            ("ACTIVE_ROLE_TABLE", table.name->Pulumi.Output.asInput),
+            ("COGNITO_USER_POOL_ID", cognitoUserPoolId),
+            ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+            ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
+          ]),
+        }: Lambda.Function.functionEnvironment
+      )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
+    },
+    ~opts,
+  )
+
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "DataSource",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
+    ~opts,
+  )
+
+  let _ =
+    (lambda.arn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeLambda",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambda.arn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
+
+  let _resolver = AppSync_Resolver_Native.makeUnitJsResolver(
+    ~name=name ++ "SetActiveRole",
+    ~api,
+    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+    ~type_="Mutation"->Pulumi.Input.make,
+    ~field="Platform_SetActiveRole"->Pulumi.Input.make,
+    ~code=invokeCode,
+    ~opts,
+  )
+}

package/src/adapter/Auth/Auth_ActiveRoleStore.res.mjs

@@ -0,0 +1,163 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
+import * as AppSync_Resolver_Native$ReventlessAws from "../Api/AppSync_Resolver_Native.res.mjs";
+
+let invokeCode = `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      arguments: ctx.args,
+      identity: id != null && id.sub != null ? { sub: id.sub } : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function makeTable(nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "ActiveRoleStore";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let table = Util_DynamoDb$ReventlessAws.makeTable([{
+      name: "id",
+      type: "S"
+    }], undefined, undefined, undefined, AWS_Tags$ReventlessAws.make(name + "Table", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined), opts$1, name);
+  return {
+    name: table.name,
+    arn: table.arn
+  };
+}
+
+function makeWriteDoor(api, table, cognitoUserPoolId, cognitoUserPoolArn, nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "ActiveRoleStore";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  Pulumi.all([
+    table.arn,
+    cognitoUserPoolArn
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
+        {
+          Sid: "AllowLambdaLogging",
+          Effect: "Allow",
+          Action: [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents"
+          ],
+          Resource: "arn:aws:logs:*:*:*"
+        },
+        {
+          Sid: "AllowActiveRoleRowAccess",
+          Effect: "Allow",
+          Action: [
+            "dynamodb:PutItem",
+            "dynamodb:DeleteItem",
+            "dynamodb:GetItem"
+          ],
+          Resource: param[0]
+        },
+        {
+          Sid: "AllowReadingOwnPoolMembership",
+          Effect: "Allow",
+          Action: "cognito-idp:AdminListGroupsForUser",
+          Resource: param[1]
+        }
+      ])),
+      role: lambdaRole.id
+    }, opts$1);
+  });
+  let packageDirs = Object.fromEntries([[
+      "@reventlessdev/reventless-aws",
+      Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
+    ]]);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs", packageDirs, undefined, false);
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
+  let lambda = new (Aws.lambda.Function)(name + "Lambda", {
+    handler: "index.handler",
+    runtime: "nodejs22.x",
+    code: match.code,
+    role: lambdaRole.arn,
+    memorySize: 256,
+    timeout: 30,
+    layers: layers,
+    tags: AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
+    environment: {
+      variables: Object.fromEntries([
+        [
+          "Environment",
+          Pulumi.getStack()
+        ],
+        [
+          "ACTIVE_ROLE_TABLE",
+          table.name
+        ],
+        [
+          "COGNITO_USER_POOL_ID",
+          cognitoUserPoolId
+        ],
+        [
+          "NODE_OPTIONS",
+          Util_Bundle$ReventlessAws.esmLoaderNodeOptions
+        ],
+        [
+          "ESM_FALLBACK_DIRS",
+          Util_Bundle$ReventlessAws.esmFallbackDirs
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
+      ])
+    },
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
+  }, opts$1);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  Pulumi.all([
+    lambda.arn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeLambda",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts$1);
+  });
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambda.arn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts$1);
+  AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "SetActiveRole", api, dataSource.name, "Mutation", "Platform_SetActiveRole", invokeCode, opts$1);
+}
+
+export {
+  invokeCode,
+  makeTable,
+  makeWriteDoor,
+}
+/* @pulumi/aws Not a pure module */