@reventlessdev/reventless-aws 3.0.0-alpha.292 → 3.0.0-alpha.294

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.294 (2026-08-14)
+
+### Bug Fixes
+
+* **aws:** provision the active-role write door outside the host-UI branch ([2ffc121](https://github.com/ReventlessDev/reventless-core/commit/2ffc12198dfedd151c298add42fbb9bb0dc95ca6))
+### Features
+
+* **aws:** prove the pre-token-generation trigger before attaching it to a pool ([6e981a4](https://github.com/ReventlessDev/reventless-core/commit/6e981a4f6b4089a140cd7dda7df00177b98d4a65))
+
+
+# 3.0.0-alpha.293 (2026-08-13)
+
+### Features
+
+* **aws:** narrow the token to the role a caller chose to act as ([194332f](https://github.com/ReventlessDev/reventless-core/commit/194332fa0af8e13417f72d57904e2ed469747dde))
+
+
 # 3.0.0-alpha.292 (2026-08-13)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.292",
+  "version": "3.0.0-alpha.294",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,17 +12,17 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.8",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.9",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.73",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.5",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.74",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.231",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.232",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.96",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.95",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
   },
   "devDependencies": {

package/src/Platform.res

@@ -245,11 +245,12 @@ module MakeWithConfig = (
   // unified mode carries the admin base here instead; it declares no stores in practice,
   // so the upload resolvers below are never created there.)
   let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
-    types: Array.concat(
-      ReventlessCore.Platform_AdminApi.uploadTypes,
-      ReventlessCore.Platform_AdminApi.geocodeTypes,
+    types: ReventlessCore.Platform_AdminApi.uploadTypes
+    ->Array.concat(ReventlessCore.Platform_AdminApi.geocodeTypes)
+    ->Array.concat(ReventlessCore.Platform_AdminApi.activeRoleTypes),
+    mutations: ReventlessCore.Platform_AdminApi.uploadMutationFields->Array.concat(
+      ReventlessCore.Platform_AdminApi.activeRoleMutationFields,
     ),
-    mutations: ReventlessCore.Platform_AdminApi.uploadMutationFields,
     queries: Array.concat(
       ["  Platform_ping: String"],
       ReventlessCore.Platform_AdminApi.geocodeQueryFields,
@@ -2257,6 +2258,44 @@ module MakeWithConfig = (
       Pulumi.Pulumi.export("hostShellUrl", distributionUrl)
     }
 
+    // Where a caller records the role they want to act as
+    // (docs/plans/active-role-narrows-the-token.md §6). The mutation only writes
+    // a preference; the pre-token-generation trigger reads the row and re-checks
+    // it against real membership before narrowing anything, so this door grants
+    // nobody anything on its own.
+    //
+    // The table and the trigger were provisioned with the pool — they have to be,
+    // since the pool is declared carrying the trigger's ARN. Only the write door
+    // waits for the API, which is why it is here and not there.
+    //
+    // 🚨 **Outside `switch hostUiBundle`, and that is the whole point.** It was
+    // written inside it, where the pool happens to be resolved — and a platform
+    // whose shell ships from its own stack passes no bundle, so the door silently
+    // did not exist there. The table and trigger still appeared, because
+    // `resolveCognitoUserPool` is process-cached and `Auth_Cognito.make` reaches
+    // it first: the feature deployed looking complete, with the trigger attached
+    // to the pool and nothing able to write a row for it to read. Same shape as
+    // the object-store endpoints at the top of this file, which sat in this branch
+    // for the same reason and were moved out for the same one. Nothing that is not
+    // *about* the host UI belongs inside this switch.
+    //
+    // Split-API only, like the upload and geocode resolvers: `Platform_SetActiveRole`
+    // lives on the domain base document, which a unified-mode deployment's single
+    // API does not carry. The table and trigger are provisioned either way — see
+    // `Platform_Stack` for why that is not gated on this flag.
+    if Config.splitApi {
+      // Resolved here rather than reused from the branch above, which may not have
+      // run. The call is process-cached, so this is the same pool either way.
+      let pool = Platform_Stack.resolveCognitoUserPool()
+      Auth_ActiveRoleStore.makeWriteDoor(
+        ~api=domainApi,
+        ~table=pool.activeRoleTable,
+        ~cognitoUserPoolId=pool.poolId->Pulumi.Output.asInput,
+        ~cognitoUserPoolArn=pool.poolArn->Pulumi.Output.asInput,
+        ~opts={},
+      )
+    }
+
     Pulumi.Pulumi.getOutputs()
   }
 

package/src/Platform.res.mjs

@@ -60,6 +60,7 @@ import * as StateTopic_AppSync$ReventlessAws from "./adapter/StateTopic/StateTop
 import * as AppSync_SdlDecorate$ReventlessAws from "./components/Api/AppSync_SdlDecorate.res.mjs";
 import * as UiFragmentRegistry$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateChangeSlice/UiFragmentRegistry.res.mjs";
 import * as Util_ResourceNaming$ReventlessAws from "./util/Util_ResourceNaming.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
 import * as ClonerRunner_Fargate$ReventlessAws from "./plugin/cloner/ClonerRunner_Fargate.res.mjs";
 import * as QueryEngine_DynamoDb$ReventlessAws from "./adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "./plugin/runtime/PluginRuntime_Builder.res.mjs";
@@ -192,8 +193,8 @@ function MakeWithConfig(Config) {
     }
   };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
-    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes),
-    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
+    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes).concat(Platform_AdminApi$ReventlessCore.activeRoleTypes),
+    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields.concat(Platform_AdminApi$ReventlessCore.activeRoleMutationFields),
     queries: ["  Platform_ping: String"].concat(Platform_AdminApi$ReventlessCore.geocodeQueryFields),
     subscriptions: [],
     subscriptionSources: []
@@ -1230,6 +1231,10 @@ function MakeWithConfig(Config) {
       }
       Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
+    if (Config.splitApi) {
+      let pool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
+      Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, pool.activeRoleTable, pool.poolId, pool.poolArn, undefined, {});
+    }
     return Pulumi$Pulumi.getOutputs();
   };
   let startServers = () => {};
@@ -1491,8 +1496,8 @@ function Make($star) {
     }
   };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
-    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes),
-    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
+    types: Platform_AdminApi$ReventlessCore.uploadTypes.concat(Platform_AdminApi$ReventlessCore.geocodeTypes).concat(Platform_AdminApi$ReventlessCore.activeRoleTypes),
+    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields.concat(Platform_AdminApi$ReventlessCore.activeRoleMutationFields),
     queries: ["  Platform_ping: String"].concat(Platform_AdminApi$ReventlessCore.geocodeQueryFields),
     subscriptions: [],
     subscriptionSources: []
@@ -2506,6 +2511,8 @@ function Make($star) {
       }
       Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
+    let pool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
+    Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, pool.activeRoleTable, pool.poolId, pool.poolArn, undefined, {});
     return Pulumi$Pulumi.getOutputs();
   };
   let startServers = () => {};

package/src/Platform_Stack.res

@@ -6,6 +6,12 @@ type cognitoUserPool = {
   clientId: Pulumi.Output.t<string>,
   poolArn: Pulumi.Output.t<string>,
   managed: bool,
+  /** Rows holding the role each caller chose to act as, read by the pool's
+    pre-token-generation trigger. Carried on the resolved pool because the table
+    has to be provisioned *before* the pool (the trigger reads it, and the pool
+    is declared with the trigger's ARN), while the mutation that writes it is
+    provisioned after the API — see [Auth_ActiveRoleStore.res]. */
+  activeRoleTable: Auth_ActiveRoleStore.storeTable,
 }
 
 /**
@@ -32,6 +38,11 @@ type cognitoUserPool = {
  * `cognitoUserPoolArn`, `cognitoRegion`, and `cognitoUserPoolManaged` as
  * stack outputs so downstream stacks (and Stage D AppSync wiring) can read
  * them via `StackReference`.
+ *
+ * Also provisions the role-state table and the pre-token-generation trigger that
+ * narrows `cognito:groups` to a caller's chosen role. They belong here rather
+ * than beside the mutation that writes the table because the pool must be
+ * declared carrying the trigger's ARN — see the ordering note below.
  */
 let _resolveUncached = (): cognitoUserPool => {
   let cfg = Pulumi.Config.make(Some("platform"))
@@ -40,6 +51,33 @@ let _resolveUncached = (): cognitoUserPool => {
   | None => cfg->Pulumi.Config.get("cognitoUserPoolId")
   }
 
+  // Provisioned ahead of the pool in both pool modes: the pre-token-generation
+  // trigger reads these rows, and in auto mode the pool is declared carrying the
+  // trigger's ARN — so table → trigger → pool is a forced order, not a choice.
+  // See [docs/plans/active-role-narrows-the-token.md] §6.
+  //
+  // Unconditional, including for a unified-API platform that mounts no
+  // `Platform_SetActiveRole` and so can never write a row.
+  //
+  // This was briefly gated on whether a write door would exist, to save a
+  // DynamoDB read per sign-in in that mode. The gate was a parameter on this
+  // function — and because the result is process-cached, it made the feature's
+  // existence depend on *which caller resolved the pool first*. `Auth_Cognito.make`
+  // reaches this through an adapter record and gets there before the platform
+  // does, so the whole feature silently vanished from the deploy: no error, no
+  // resource, nothing to notice. A local `pulumi preview` was the only thing that
+  // caught it.
+  //
+  // Saving one GetItem in a legacy mode is not worth a switch whose failure mode
+  // is a feature that quietly is not there. If the cost ever matters, the fix is
+  // a design that does not hinge on call order — not this parameter again.
+  let activeRoleTable = Auth_ActiveRoleStore.makeTable(~opts={})
+  let activeRoleTrigger = Auth_ActiveRoleTrigger.make(
+    ~activeRoleTableName=activeRoleTable.name->Pulumi.Output.asInput,
+    ~activeRoleTableArn=activeRoleTable.arn->Pulumi.Output.asInput,
+    ~opts={},
+  )
+
   let result = switch existingPoolId {
   | Some(poolId) =>
     let tokenUnits: PulumiAws.Cognito.UserPoolClient.tokenValidityUnits = {
@@ -66,11 +104,29 @@ let _resolveUncached = (): cognitoUserPool => {
 
     let lookup = PulumiAws.Cognito.UserPool.getUserPoolOutput(~args={userPoolId: poolId})
 
+    // BYO: we hold no handle to set `lambdaConfig` on, and Cognito offers no
+    // separate attachment resource — so the trigger is attached by a declared
+    // resource that describes the pool, merges into what it finds, and sends the
+    // result back whole. Never a hand-run command: that would leave the
+    // deployment's behaviour depending on an act no source describes.
+    // The code hash is an input so a new build of the trigger reaches this
+    // resource: the function ARN is stable, so it alone would let a broken
+    // version onto the pool unchecked after the first deploy.
+    let _attachment = Auth_ActiveRolePoolAttachment.make(
+      ~props={
+        userPoolId: Pulumi.Input.make(poolId),
+        preTokenGenerationArn: activeRoleTrigger.functionArn->Pulumi.Output.asInput,
+        codeHash: Pulumi.Input.make(activeRoleTrigger.sourceCodeHash),
+      },
+      ~opts={},
+    )
+
     {
       poolId: Pulumi.Output.make(poolId),
       clientId: client.id,
       poolArn: lookup->Pulumi.Output.apply(r => r.arn),
       managed: false,
+      activeRoleTable,
     }
 
   | None =>
@@ -83,6 +139,11 @@ let _resolveUncached = (): cognitoUserPool => {
       requireUppercase: Pulumi.Input.make(true),
       requireNumbers: Pulumi.Input.make(true),
     }
+    // Auto: the pool is ours, so the trigger is an ordinary declared property and
+    // no out-of-band `UpdateUserPool` is involved. Declaring it here rather than
+    // attaching it afterwards also keeps Pulumi's own state the authority — an
+    // attachment made behind the resource's back would read as drift on the next
+    // refresh and be reverted.
     let pool = PulumiAws.Cognito.UserPool.make(
       ~name="HostUiPool",
       ~args={
@@ -90,6 +151,9 @@ let _resolveUncached = (): cognitoUserPool => {
         usernameAttributes: Pulumi.Input.make([Pulumi.Input.make("email")]),
         passwordPolicy: Pulumi.Input.make(pwdPolicy),
         mfaConfiguration: Pulumi.Input.make("OFF"),
+        lambdaConfig: Pulumi.Input.make({
+          PulumiAws.Cognito.UserPool.preTokenGeneration: activeRoleTrigger.functionArn->Pulumi.Output.asInput,
+        }),
         tags: AWS.Tags.make(
           ~name="HostUiPool",
           ~kind=ReventlessCore.ComponentType.Platform,
@@ -126,9 +190,18 @@ let _resolveUncached = (): cognitoUserPool => {
       clientId: client.id,
       poolArn: pool.arn,
       managed: true,
+      activeRoleTable,
     }
   }
 
+  // After the branch, because the permission is scoped to the pool's ARN and the
+  // pool is what the branch produces.
+  Auth_ActiveRoleTrigger.grantInvoke(
+    ~trigger=activeRoleTrigger,
+    ~cognitoUserPoolArn=result.poolArn->Pulumi.Output.asInput,
+    ~opts={},
+  )
+
   let regionStr =
     Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->Option.getOr("unknown")
 
@@ -149,6 +222,15 @@ let _resolveUncached = (): cognitoUserPool => {
 // stack-export calls happen exactly once per Pulumi run.
 let _cached: ref<option<cognitoUserPool>> = ref(None)
 
+/**
+ 🚨 **Takes no arguments, and must not grow any.** Everything here is provisioned
+ on the *first* call and every later caller gets that same result — so a
+ parameter would not configure the pool, it would configure whichever caller
+ happened to arrive first. `Auth_Cognito.make` reaches this through an adapter
+ record and gets here before the platform's own call does, which is not obvious
+ from any call site. Anything that needs to vary belongs in [_resolveUncached],
+ read from config or environment where every caller sees the same answer.
+ */
 let resolveCognitoUserPool = (): cognitoUserPool =>
   switch _cached.contents {
   | Some(p) => p

package/src/Platform_Stack.res.mjs

@@ -6,11 +6,16 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
+import * as Auth_ActiveRoleTrigger$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleTrigger.res.mjs";
+import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "./adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
 
 function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
   let v = Util_LocalConfig$ReventlessAws.get("cognitoUserPoolId");
   let existingPoolId = v !== undefined ? v : cfg.get("cognitoUserPoolId");
+  let activeRoleTable = Auth_ActiveRoleStore$ReventlessAws.makeTable(undefined, {});
+  let activeRoleTrigger = Auth_ActiveRoleTrigger$ReventlessAws.make(activeRoleTable.name, activeRoleTable.arn, undefined, {});
   let result;
   if (existingPoolId !== undefined) {
     let tokenUnits_accessToken = "minutes";
@@ -37,11 +42,17 @@ function _resolveUncached() {
     let lookup = Aws.cognito.getUserPoolOutput({
       userPoolId: existingPoolId
     });
+    Auth_ActiveRolePoolAttachment$ReventlessAws.make(undefined, {
+      userPoolId: existingPoolId,
+      preTokenGenerationArn: activeRoleTrigger.functionArn,
+      codeHash: activeRoleTrigger.sourceCodeHash
+    }, {});
     result = {
       poolId: Pulumi.output(existingPoolId),
       clientId: client.id,
       poolArn: lookup.apply(r => r.arn),
-      managed: false
+      managed: false,
+      activeRoleTable: activeRoleTable
     };
   } else {
     let adminConfig = {
@@ -58,6 +69,9 @@ function _resolveUncached() {
       requireUppercase: pwdPolicy_requireUppercase
     };
     let pool = new (Aws.cognito.UserPool)("HostUiPool", {
+      lambdaConfig: {
+        preTokenGeneration: activeRoleTrigger.functionArn
+      },
       adminCreateUserConfig: adminConfig,
       usernameAttributes: ["email"],
       passwordPolicy: pwdPolicy,
@@ -89,9 +103,11 @@ function _resolveUncached() {
       poolId: pool.id,
       clientId: client$1.id,
       poolArn: pool.arn,
-      managed: true
+      managed: true,
+      activeRoleTable: activeRoleTable
     };
   }
+  Auth_ActiveRoleTrigger$ReventlessAws.grantInvoke(activeRoleTrigger, result.poolArn, undefined, {});
   let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
   Pulumi$Pulumi.$$export("cognitoUserPoolId", result.poolId);
   Pulumi$Pulumi.$$export("cognitoUserPoolClientId", result.clientId);