@reventlessdev/reventless-aws 3.0.0-alpha.292 → 3.0.0-alpha.293

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -0,0 +1,201 @@
+// Runtime handler for the Cognito **pre token generation** trigger — the AWS
+// minting point for "acting as one of the roles you hold". See
+// [docs/plans/active-role-narrows-the-token.md] §6.
+//
+// Compiled, type-checked and Pulumi-free so it ships as an EntryPoint module
+// ([Auth_ActiveRoleTrigger.res] bundles it and attaches it to the user pool).
+//
+// The narrowing has to happen here rather than in our own enforcement code
+// because `@authorize(AllowGroups([...]))` compiles to `@aws_auth`, which AppSync
+// evaluates against `cognito:groups` **before any of our code executes**. A
+// request header we invent could scope reads correctly and still leave every
+// group-gated mutation callable — right about the data, wrong about the writes.
+// Overriding the group claim is the one place every enforcement point already
+// looks.
+//
+// **Version 1 of the trigger, deliberately.** Group override and added ID-token
+// claims are `V1_0` capabilities; `V2_0`/`V3_0` buy access-token customisation
+// this does not need and are gated behind the Essentials and Plus feature plans.
+// A deployment on the Lite tier must not be excluded from acting as a role.
+
+open AwsSdk
+
+// ── Environment ─────────────────────────────────────────────────────────────
+
+let getEnv = (k: string): option<string> =>
+  switch NodeProcess.env->Dict.get(k) {
+  | Some("") | None => None
+  | Some(v) => Some(v)
+  }
+
+let tableName = (): string =>
+  switch getEnv("ACTIVE_ROLE_TABLE") {
+  | Some(t) => t
+  | None => JsError.throwWithMessage("ACTIVE_ROLE_TABLE is not configured")
+  }
+
+// ── Cognito pre-token-generation event (V1_0) ───────────────────────────────
+
+type userAttributes = {sub?: string}
+
+/** The groups the pool says the user is really in, supplied by the pool itself.
+  This is why the subset check here needs no lookup and no IAM to perform one:
+  the authority arrives in the payload, and the check is a containment test
+  against it. */
+type groupConfiguration = {
+  groupsToOverride?: array<string>,
+  iamRolesToOverride?: array<string>,
+  preferredRole?: Nullable.t<string>,
+}
+
+type triggerRequest = {
+  userAttributes?: userAttributes,
+  groupConfiguration?: groupConfiguration,
+}
+
+type groupOverrideDetails = {
+  groupsToOverride: array<string>,
+  iamRolesToOverride: array<string>,
+  preferredRole?: Nullable.t<string>,
+}
+
+type claimsOverrideDetails = {
+  claimsToAddOrOverride?: dict<string>,
+  groupOverrideDetails?: groupOverrideDetails,
+}
+
+type triggerResponse = {claimsOverrideDetails?: claimsOverrideDetails}
+
+type event = {
+  request?: triggerRequest,
+  response?: triggerResponse,
+  userName?: string,
+}
+
+// ── The decision ────────────────────────────────────────────────────────────
+
+type decision =
+  /** No stored preference — mint exactly the token that would have been minted
+    before any of this existed. This is the path every existing caller takes. */
+  | Unchanged
+  /** The stored role is one the pool says the caller holds. */
+  | Narrow({role: string, membership: array<string>})
+  /** The row outlived the membership that justified it.
+
+    Resolved by minting the full set rather than narrowing to a group the pool no
+    longer grants — but *decided* here rather than falling out of the code,
+    because the alternative reading is a token scoped to a role the caller has
+    lost. Unlike the write door, this path has no client to refuse: the trigger
+    meets a stale row on an ordinary refresh with nobody asking for anything. It
+    says so on the token instead, so a caller whose chosen role silently stopped
+    applying has something to read. */
+  | Stale({role: string, membership: array<string>})
+
+let decide = (~membership: array<string>, ~storedRole: option<string>): decision =>
+  switch storedRole {
+  | None | Some("") => Unchanged
+  | Some(role) =>
+    membership->Array.includes(role) ? Narrow({role, membership}) : Stale({role, membership})
+  }
+
+/**
+Turn a decision into the trigger's response.
+
+🚨 **`groupOverrideDetails` replaces the whole group configuration.** Supplying it
+with only `groupsToOverride` drops the caller's `iamRolesToOverride` and
+`preferredRole` — the same reset-by-omission hazard `UpdateUserPool` has, and just
+as quiet. Both are echoed from the incoming configuration so the override changes
+exactly one thing.
+
+`Unchanged` returns the event untouched rather than an empty override: an empty
+`claimsOverrideDetails` is not the same as none, and the regression line for this
+whole feature is that a caller with no stored role gets byte-identical output.
+*/
+let respond = (~event: event, ~decision: decision): event => {
+  let incoming = event.request->Option.flatMap(r => r.groupConfiguration)
+  let iamRolesToOverride = incoming->Option.flatMap(g => g.iamRolesToOverride)->Option.getOr([])
+  let preferredRole = incoming->Option.flatMap(g => g.preferredRole)
+
+  let overrideWith = (~groups: array<string>, ~claims: dict<string>) => {
+    ...event,
+    response: {
+      claimsOverrideDetails: {
+        claimsToAddOrOverride: claims,
+        groupOverrideDetails: {
+          groupsToOverride: groups,
+          iamRolesToOverride,
+          preferredRole: ?preferredRole,
+        },
+      },
+    },
+  }
+
+  switch decision {
+  | Unchanged => event
+  | Narrow({role, membership}) =>
+    overrideWith(
+      ~groups=[role],
+      ~claims=Dict.fromArray([
+        (ReventlessCore.Auth_ActiveRole.activeRoleClaim, role),
+        (ReventlessCore.Auth_ActiveRole.availableRolesClaim, membership->Array.join(",")),
+      ]),
+    )
+  | Stale({role, membership}) =>
+    // The full set, as the pool granted it — plus the marker that explains why the
+    // stored choice did not apply.
+    overrideWith(
+      ~groups=membership,
+      ~claims=Dict.fromArray([
+        (ReventlessCore.Auth_ActiveRole.staleRoleClaim, role),
+        (ReventlessCore.Auth_ActiveRole.availableRolesClaim, membership->Array.join(",")),
+      ]),
+    )
+  }
+}
+
+// ── Stored preference ───────────────────────────────────────────────────────
+
+/**
+The role this subject last chose, or `None` if they never chose one or cleared it.
+
+A read failure resolves to `None`, not to an error. This trigger sits in the
+critical path of every token Cognito mints for this pool: a throw here fails the
+sign-in outright, and failing a login because a *preference* could not be read
+trades a working session for a cosmetic one. The caller lands on full membership —
+their existing privileges, not more — which is the safe direction to fail.
+*/
+let storedRoleFor = async (~sub: string, ~table: string): option<string> =>
+  try {
+    let out = await DynamoDb_DocumentClient.GetCommand.make({
+      tableName: table,
+      key: Dict.fromArray([("id", JSON.Encode.string(sub))]),
+    })->DynamoDb_DocumentClient.GetCommand.send
+    out.item
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.flatMap(o => o->Dict.get("activeRole"))
+    ->Option.flatMap(JSON.Decode.string)
+  } catch {
+  | _ => None
+  }
+
+// ── Handler ─────────────────────────────────────────────────────────────────
+
+let handler = async (event: event): event => {
+  let membership =
+    event.request
+    ->Option.flatMap(r => r.groupConfiguration)
+    ->Option.flatMap(g => g.groupsToOverride)
+    ->Option.getOr([])
+
+  let sub =
+    event.request->Option.flatMap(r => r.userAttributes)->Option.flatMap(u => u.sub)->Option.getOr("")
+
+  // No subject means no row to look up. Returning the event untouched keeps the
+  // sign-in working on exactly the membership the pool granted.
+  if sub == "" {
+    event
+  } else {
+    let storedRole = await storedRoleFor(~sub, ~table=tableName())
+    respond(~event, ~decision=decide(~membership, ~storedRole))
+  }
+}

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs

@@ -0,0 +1,126 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
+import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
+
+function getEnv(k) {
+  let v = process.env[k];
+  if (v !== undefined && v !== "") {
+    return v;
+  }
+}
+
+function tableName() {
+  let t = getEnv("ACTIVE_ROLE_TABLE");
+  if (t !== undefined) {
+    return t;
+  } else {
+    return Stdlib_JsError.throwWithMessage("ACTIVE_ROLE_TABLE is not configured");
+  }
+}
+
+function decide(membership, storedRole) {
+  if (storedRole !== undefined && storedRole !== "") {
+    if (membership.includes(storedRole)) {
+      return {
+        TAG: "Narrow",
+        role: storedRole,
+        membership: membership
+      };
+    } else {
+      return {
+        TAG: "Stale",
+        role: storedRole,
+        membership: membership
+      };
+    }
+  } else {
+    return "Unchanged";
+  }
+}
+
+function respond(event, decision) {
+  let incoming = Stdlib_Option.flatMap(event.request, r => r.groupConfiguration);
+  let iamRolesToOverride = Stdlib_Option.getOr(Stdlib_Option.flatMap(incoming, g => g.iamRolesToOverride), []);
+  let preferredRole = Stdlib_Option.flatMap(incoming, g => g.preferredRole);
+  let overrideWith = (groups, claims) => {
+    let newrecord = {...event};
+    newrecord.response = {
+      claimsOverrideDetails: {
+        claimsToAddOrOverride: claims,
+        groupOverrideDetails: {
+          groupsToOverride: groups,
+          iamRolesToOverride: iamRolesToOverride,
+          preferredRole: preferredRole
+        }
+      }
+    };
+    return newrecord;
+  };
+  if (typeof decision !== "object") {
+    return event;
+  }
+  if (decision.TAG === "Narrow") {
+    let role = decision.role;
+    return overrideWith([role], Object.fromEntries([
+      [
+        Auth_ActiveRole$ReventlessCore.activeRoleClaim,
+        role
+      ],
+      [
+        Auth_ActiveRole$ReventlessCore.availableRolesClaim,
+        decision.membership.join(",")
+      ]
+    ]));
+  }
+  let membership = decision.membership;
+  return overrideWith(membership, Object.fromEntries([
+    [
+      Auth_ActiveRole$ReventlessCore.staleRoleClaim,
+      decision.role
+    ],
+    [
+      Auth_ActiveRole$ReventlessCore.availableRolesClaim,
+      membership.join(",")
+    ]
+  ]));
+}
+
+async function storedRoleFor(sub, table) {
+  try {
+    let out = await DynamoDb_DocumentClient$AwsSdk.GetCommand.send(new LibDynamodb.GetCommand({
+      TableName: table,
+      Key: Object.fromEntries([[
+          "id",
+          sub
+        ]])
+    }));
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(out.Item, Stdlib_JSON.Decode.object), o => o["activeRole"]), Stdlib_JSON.Decode.string);
+  } catch (exn) {
+    return;
+  }
+}
+
+async function handler(event) {
+  let membership = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event.request, r => r.groupConfiguration), g => g.groupsToOverride), []);
+  let sub = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event.request, r => r.userAttributes), u => u.sub), "");
+  if (sub === "") {
+    return event;
+  }
+  let storedRole = await storedRoleFor(sub, tableName());
+  return respond(event, decide(membership, storedRole));
+}
+
+export {
+  getEnv,
+  tableName,
+  decide,
+  respond,
+  storedRoleFor,
+  handler,
+}
+/* @aws-sdk/lib-dynamodb Not a pure module */

package/tests/Auth_ActiveRolePoolAttachmentTest.res

@@ -0,0 +1,211 @@
+open JestGlobals
+
+// 🚨 The test §6 of the plan asks for, and the one that matters most in this
+// feature: `UpdateUserPool` requires "a value for all parameters that you don't
+// want set to a default value". An attach that sends only `LambdaConfig`
+// silently returns every other setting on the pool to its default — on a pool
+// the framework did not create and whose configuration it never described.
+//
+// So the assertions below are all the same assertion: a pool carrying
+// non-default settings still carries them afterwards. The merge is a pure
+// function precisely so this is checkable against a pool the test did not
+// create, which is the case the merge exists for.
+
+module Attachment = Auth_ActiveRolePoolAttachment
+
+let str = JSON.Encode.string
+
+// A pool that is nothing like a fresh one: MFA on, a deletion guard, a custom
+// verification message, two triggers already attached, tags, and a paid tier.
+//
+// The key set mirrors what `DescribeUserPool` actually returns for a live pool,
+// including `IssuerConfiguration` / `KeyConfiguration` — informational fields
+// that are *not* members of `UpdateUserPool`. The merge carries them and the SDK
+// drops them during serialisation, which is why they are harmless; they are here
+// so a future edit that starts filtering on this list has a real shape to filter.
+let describedPool = () =>
+  Dict.fromArray([
+    ("Id", str("eu-west-1_abc123")),
+    ("Name", str("CustomerPool")),
+    ("Arn", str("arn:aws:cognito-idp:eu-west-1:1:userpool/eu-west-1_abc123")),
+    ("Status", str("Enabled")),
+    ("CreationDate", str("2020-01-01T00:00:00Z")),
+    ("LastModifiedDate", str("2024-01-01T00:00:00Z")),
+    ("SchemaAttributes", JSON.Encode.array([str("email")])),
+    ("UsernameAttributes", JSON.Encode.array([str("email")])),
+    ("EstimatedNumberOfUsers", JSON.Encode.int(4200)),
+    ("IssuerConfiguration", Dict.fromArray([("IssuerUri", str("https://x"))])->JSON.Encode.object),
+    ("KeyConfiguration", Dict.fromArray([("KmsKeyId", str("k-1"))])->JSON.Encode.object),
+    // A paid tier silently reverting to Lite would be a billing- and
+    // capability-level regression, and one nothing in the deploy would report.
+    ("UserPoolTier", str("PLUS")),
+    ("MfaConfiguration", str("ON")),
+    ("DeletionProtection", str("ACTIVE")),
+    ("EmailVerificationMessage", str("Your code is {####}, do not share it")),
+    (
+      "Policies",
+      Dict.fromArray([
+        (
+          "PasswordPolicy",
+          Dict.fromArray([("MinimumLength", JSON.Encode.int(24))])->JSON.Encode.object,
+        ),
+      ])->JSON.Encode.object,
+    ),
+    (
+      "UserPoolTags",
+      Dict.fromArray([("CostCentre", str("identity"))])->JSON.Encode.object,
+    ),
+    (
+      "LambdaConfig",
+      Dict.fromArray([
+        ("PreSignUp", str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+        ("CustomMessage", str("arn:aws:lambda:eu-west-1:1:function:TheirCustomMessage")),
+      ])->JSON.Encode.object,
+    ),
+  ])
+
+let merged = (~preTokenGenerationArn) =>
+  Attachment.mergedUpdateInput(
+    ~described=describedPool(),
+    ~userPoolId="eu-west-1_abc123",
+    ~preTokenGenerationArn,
+  )
+
+let triggerArn = "arn:aws:lambda:eu-west-1:1:function:ActiveRoleTrigger"
+
+let lambdaConfigOf = input =>
+  input->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
+
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
+  let input = merged(~preTokenGenerationArn=Some(triggerArn))
+
+  testSync("MFA stays on rather than defaulting off", () =>
+    expect(input->Dict.get("MfaConfiguration"))->toEqual(Some(str("ON")))
+  )
+
+  testSync("deletion protection stays active", () =>
+    expect(input->Dict.get("DeletionProtection"))->toEqual(Some(str("ACTIVE")))
+  )
+
+  testSync("a customised verification message is not reset", () =>
+    expect(input->Dict.get("EmailVerificationMessage"))->toEqual(
+      Some(str("Your code is {####}, do not share it")),
+    )
+  )
+
+  testSync("the password policy travels whole", () =>
+    expect(
+      input
+      ->Dict.get("Policies")
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(p => p->Dict.get("PasswordPolicy"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(p => p->Dict.get("MinimumLength")),
+    )->toEqual(Some(JSON.Encode.int(24)))
+  )
+
+  testSync("tags are not dropped", () =>
+    expect(
+      input
+      ->Dict.get("UserPoolTags")
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(t => t->Dict.get("CostCentre")),
+    )->toEqual(Some(str("identity")))
+  )
+
+  testSync("a paid tier is not reverted to Lite", () =>
+    expect(input->Dict.get("UserPoolTier"))->toEqual(Some(str("PLUS")))
+  )
+
+  // The reset hazard one level down: replacing the whole `LambdaConfig` with a
+  // single-key object would silently detach every trigger the customer had.
+  testSync("the pool's existing triggers stay attached", () =>
+    expect((
+      lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("PreSignUp")),
+      lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("CustomMessage")),
+    ))->toEqual((
+      Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+      Some(str("arn:aws:lambda:eu-west-1:1:function:TheirCustomMessage")),
+    ))
+  )
+
+  testSync("and ours is added beside them", () =>
+    expect(lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("PreTokenGeneration")))->toEqual(
+      Some(str(triggerArn)),
+    )
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — shaping for the API", () => {
+  let input = merged(~preTokenGenerationArn=Some(triggerArn))
+
+  testSync("UserPoolId names the pool being updated", () =>
+    expect(input->Dict.get("UserPoolId"))->toEqual(Some(str("eu-west-1_abc123")))
+  )
+
+  // DescribeUserPool returns `Name`; UpdateUserPool takes `PoolName`. Sending
+  // `Name` is rejected, and omitting the rename would rename the pool by default.
+  testSync("Name is renamed to PoolName rather than dropped", () =>
+    expect((input->Dict.get("PoolName"), input->Dict.get("Name")))->toEqual((
+      Some(str("CustomerPool")),
+      None,
+    ))
+  )
+
+  testSync("read-only fields UpdateUserPool rejects are not sent", () =>
+    expect(
+      ["Id", "Arn", "Status", "CreationDate", "LastModifiedDate", "SchemaAttributes",
+       "UsernameAttributes", "EstimatedNumberOfUsers"]->Array.filter(k =>
+        input->Dict.get(k)->Option.isSome
+      ),
+    )->toEqual([])
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — detaching", () => {
+  let input = merged(~preTokenGenerationArn=None)
+
+  // Destroy has to detach, or the pool is left pointing at a deleted function and
+  // every sign-in fails — on a pool nothing in this deployment would ever fix.
+  testSync("clearing removes our trigger", () =>
+    expect(lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("PreTokenGeneration")))->toEqual(
+      None,
+    )
+  )
+
+  testSync("clearing leaves the customer's own triggers alone", () =>
+    expect(lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("PreSignUp")))->toEqual(
+      Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+    )
+  )
+
+  testSync("clearing still sends the rest of the pool back whole", () =>
+    expect(input->Dict.get("MfaConfiguration"))->toEqual(Some(str("ON")))
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool with nothing set", () => {
+  testSync("a pool with no LambdaConfig gains one holding only our trigger", () => {
+    let input = Attachment.mergedUpdateInput(
+      ~described=Dict.fromArray([("Name", str("Bare"))]),
+      ~userPoolId="eu-west-1_bare",
+      ~preTokenGenerationArn=Some(triggerArn),
+    )
+    expect(lambdaConfigOf(input))->toEqual(
+      Some(Dict.fromArray([("PreTokenGeneration", str(triggerArn))])),
+    )
+  })
+})
+
+describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
+  testSync("reports the trigger a described pool carries", () =>
+    expect(Attachment.attachedTrigger(~described=merged(~preTokenGenerationArn=Some(triggerArn))))
+    ->toEqual(Some(triggerArn))
+  )
+
+  testSync("reports none when the pool carries no trigger", () =>
+    expect(Attachment.attachedTrigger(~described=Dict.fromArray([("Name", str("Bare"))])))->toEqual(
+      None,
+    )
+  )
+})