@reventlessdev/reventless-aws 3.0.0-alpha.292 → 3.0.0-alpha.294

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs

@@ -0,0 +1,341 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as IndexJs from "@pulumi/pulumi/dynamic/index.js";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+let readOnlyKeys = [
+  "Id",
+  "Name",
+  "Arn",
+  "Status",
+  "CreationDate",
+  "LastModifiedDate",
+  "SchemaAttributes",
+  "AliasAttributes",
+  "UsernameAttributes",
+  "UsernameConfiguration",
+  "EstimatedNumberOfUsers",
+  "Domain",
+  "CustomDomain",
+  "SmsConfigurationFailure",
+  "EmailConfigurationFailure"
+];
+
+function mergedUpdateInput(described, userPoolId, preTokenGenerationArn) {
+  let out = {};
+  Stdlib_Dict.forEachWithKey(described, (value, key) => {
+    if (!readOnlyKeys.includes(key)) {
+      out[key] = value;
+      return;
+    }
+  });
+  Stdlib_Option.forEach(described["Name"], name => {
+    out["PoolName"] = name;
+  });
+  out["UserPoolId"] = userPoolId;
+  let lambdaConfig = Stdlib_Option.mapOr(Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object), {}, existing => Object.fromEntries(Object.entries(existing)));
+  if (preTokenGenerationArn !== undefined) {
+    lambdaConfig["PreTokenGeneration"] = preTokenGenerationArn;
+  } else {
+    Stdlib_Dict.$$delete(lambdaConfig, "PreTokenGeneration");
+  }
+  out["LambdaConfig"] = lambdaConfig;
+  return out;
+}
+
+function attachedTrigger(described) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object), c => c["PreTokenGeneration"]), Stdlib_JSON.Decode.string);
+}
+
+let newOf1 = ((C, x) => new C(x));
+
+let newOf0 = ((C) => new C());
+
+let _sdk = {
+  contents: undefined
+};
+
+let _client = {
+  contents: undefined
+};
+
+async function getSdk() {
+  let m = _sdk.contents;
+  if (m !== undefined) {
+    return m;
+  }
+  let m$1 = await import("@aws-sdk/client-cognito-identity-provider");
+  _sdk.contents = m$1;
+  return m$1;
+}
+
+async function getClient() {
+  let c = _client.contents;
+  if (c !== undefined) {
+    return Primitive_option.valFromOption(c);
+  }
+  let sdk = await getSdk();
+  let c$1 = newOf0(sdk.CognitoIdentityProviderClient);
+  _client.contents = Primitive_option.some(c$1);
+  return c$1;
+}
+
+let _lambdaSdk = {
+  contents: undefined
+};
+
+let _lambdaClient = {
+  contents: undefined
+};
+
+async function getLambdaSdk() {
+  let m = _lambdaSdk.contents;
+  if (m !== undefined) {
+    return m;
+  }
+  let m$1 = await import("@aws-sdk/client-lambda");
+  _lambdaSdk.contents = m$1;
+  return m$1;
+}
+
+async function getLambdaClient() {
+  let c = _lambdaClient.contents;
+  if (c !== undefined) {
+    return Primitive_option.valFromOption(c);
+  }
+  let sdk = await getLambdaSdk();
+  let c$1 = newOf0(sdk.LambdaClient);
+  _lambdaClient.contents = Primitive_option.some(c$1);
+  return c$1;
+}
+
+let decodePayload = ((p) => {
+  if (p == null) return "";
+  if (typeof p === "string") return p;
+  try { return new TextDecoder().decode(p); } catch { return String(p); }
+});
+
+function isPoolGoneError(jsErr) {
+  let match = jsErr.name;
+  let match$1 = Stdlib_JsExn.message(jsErr);
+  if (match == null) {
+    if (match$1 !== undefined) {
+      return match$1.includes("ResourceNotFoundException");
+    } else {
+      return false;
+    }
+  } else if (match === "ResourceNotFoundException") {
+    return true;
+  } else if (match$1 !== undefined) {
+    return match$1.includes("ResourceNotFoundException");
+  } else {
+    return false;
+  }
+}
+
+let probeSubject = "reventless-attachment-probe";
+
+function probeEvent(userPoolId) {
+  let groupConfiguration = {};
+  groupConfiguration["groupsToOverride"] = [];
+  groupConfiguration["iamRolesToOverride"] = [];
+  let userAttributes = {};
+  userAttributes["sub"] = probeSubject;
+  let request = {};
+  request["userAttributes"] = userAttributes;
+  request["groupConfiguration"] = groupConfiguration;
+  let event = {};
+  event["version"] = "1";
+  event["triggerSource"] = "TokenGeneration_Authentication";
+  event["userPoolId"] = userPoolId;
+  event["userName"] = probeSubject;
+  event["request"] = request;
+  event["response"] = {};
+  return event;
+}
+
+function probeVerdict(functionError, payload) {
+  if (functionError !== undefined) {
+    return {
+      TAG: "Crashed",
+      _0: functionError
+    };
+  }
+  let hasRequest;
+  try {
+    hasRequest = Stdlib_Option.isSome(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(JSON.parse(payload)), o => o["request"]));
+  } catch (exn) {
+    hasRequest = false;
+  }
+  if (hasRequest) {
+    return "Healthy";
+  } else {
+    return "NotAnEvent";
+  }
+}
+
+async function verifyTrigger(userPoolId, preTokenGenerationArn) {
+  let sdk = await getLambdaSdk();
+  let client = await getLambdaClient();
+  let input = {};
+  input["FunctionName"] = preTokenGenerationArn;
+  input["InvocationType"] = "RequestResponse";
+  input["Payload"] = JSON.stringify(probeEvent(userPoolId));
+  let result = await client.send(newOf1(sdk.InvokeCommand, input));
+  let payload = Stdlib_Option.mapOr(result.Payload, "", decodePayload);
+  let kind = probeVerdict(result.FunctionError, payload);
+  if (typeof kind !== "object") {
+    if (kind === "Healthy") {
+      return log.info("Auth_ActiveRolePoolAttachment", undefined, `trigger ` + preTokenGenerationArn + ` answered the pre-attach check; attaching to ` + userPoolId);
+    } else {
+      return Stdlib_JsError.throwWithMessage(`active-role trigger ` + preTokenGenerationArn + ` answered its pre-attach check with something that is not a pre-token-generation event, so it was NOT attached to user pool ` + userPoolId + `. Cognito would have failed every sign-in. It returned: ` + payload);
+    }
+  } else {
+    return Stdlib_JsError.throwWithMessage(`active-role trigger ` + preTokenGenerationArn + ` failed its pre-attach check (` + kind._0 + `) and was NOT attached to user pool ` + userPoolId + `. Attaching it would have failed every sign-in on that pool. The function reported: ` + payload);
+  }
+}
+
+async function describePool(userPoolId) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  let result = await client.send(newOf1(sdk.DescribeUserPoolCommand, {
+    UserPoolId: userPoolId
+  }));
+  return Stdlib_Option.flatMap(result.UserPool, Stdlib_JSON.Decode.object);
+}
+
+async function applyTrigger(userPoolId, preTokenGenerationArn) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  let described = await describePool(userPoolId);
+  if (described === undefined) {
+    return Stdlib_JsError.throwWithMessage(`DescribeUserPool returned no pool for "` + userPoolId + `"; refusing to send an UpdateUserPool that would reset it`);
+  }
+  let input = mergedUpdateInput(described, userPoolId, preTokenGenerationArn);
+  return await client.send(newOf1(sdk.UpdateUserPoolCommand, input));
+}
+
+async function create(inputs) {
+  await verifyTrigger(inputs.userPoolId, inputs.preTokenGenerationArn);
+  await applyTrigger(inputs.userPoolId, inputs.preTokenGenerationArn);
+  return {
+    id: inputs.userPoolId,
+    outs: {
+      userPoolId: inputs.userPoolId,
+      preTokenGenerationArn: inputs.preTokenGenerationArn,
+      codeHash: inputs.codeHash
+    }
+  };
+}
+
+async function update(_id, _olds, news) {
+  await verifyTrigger(news.userPoolId, news.preTokenGenerationArn);
+  await applyTrigger(news.userPoolId, news.preTokenGenerationArn);
+  return {
+    outs: {
+      userPoolId: news.userPoolId,
+      preTokenGenerationArn: news.preTokenGenerationArn,
+      codeHash: news.codeHash
+    }
+  };
+}
+
+async function delete_(_id, props) {
+  try {
+    return await applyTrigger(props.userPoolId, undefined);
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Stdlib_Option.mapOr(Stdlib_JsExn.fromException(exn), false, isPoolGoneError)) {
+      return log.info("Auth_ActiveRolePoolAttachment", undefined, `user pool ` + props.userPoolId + ` is gone; nothing to detach`);
+    }
+    throw exn;
+  }
+}
+
+function diff_(_id, olds, news) {
+  let poolChanged = olds.userPoolId !== news.userPoolId;
+  return {
+    changes: poolChanged || olds.preTokenGenerationArn !== news.preTokenGenerationArn || olds.codeHash !== news.codeHash,
+    replaces: poolChanged ? ["userPoolId"] : [],
+    deleteBeforeReplace: true
+  };
+}
+
+async function read_(id, props) {
+  try {
+    let described = await describePool(props.userPoolId);
+    if (described !== undefined) {
+      return {
+        id: id,
+        props: {
+          userPoolId: props.userPoolId,
+          preTokenGenerationArn: Stdlib_Option.getOr(attachedTrigger(described), ""),
+          codeHash: props.codeHash
+        }
+      };
+    } else {
+      return {};
+    }
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Stdlib_Option.mapOr(Stdlib_JsExn.fromException(exn), false, isPoolGoneError)) {
+      return {};
+    }
+    throw exn;
+  }
+}
+
+let provider = {
+  create: create,
+  update: update,
+  delete: delete_,
+  diff: diff_,
+  read: read_
+};
+
+function make(nameOpt, props, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "ActiveRolePoolAttachment";
+  return new IndexJs.Resource(provider, name, props, opts);
+}
+
+export {
+  log,
+  readOnlyKeys,
+  mergedUpdateInput,
+  attachedTrigger,
+  newOf1,
+  newOf0,
+  _sdk,
+  _client,
+  getSdk,
+  getClient,
+  _lambdaSdk,
+  _lambdaClient,
+  getLambdaSdk,
+  getLambdaClient,
+  decodePayload,
+  isPoolGoneError,
+  probeSubject,
+  probeEvent,
+  probeVerdict,
+  verifyTrigger,
+  describePool,
+  applyTrigger,
+  create,
+  update,
+  delete_,
+  diff_,
+  read_,
+  provider,
+  make,
+}
+/* log Not a pure module */

package/src/adapter/Auth/Auth_ActiveRoleStore.res

@@ -0,0 +1,280 @@
+// The role a caller chose to act as, as server-side state — and the one door
+// that writes it. See [docs/plans/active-role-narrows-the-token.md] §6.
+//
+// Why state rather than a parameter on the token request: Cognito "doesn't
+// include data from the ClientMetadata parameter in AdminInitiateAuth and
+// InitiateAuth API operations in the request that it passes to the pre token
+// generation function", and a role switch is a `REFRESH_TOKEN_AUTH` flow — an
+// `InitiateAuth` one. The channel that looks purpose-built for carrying the
+// choice is closed on exactly the path that needs it, so the choice is stored
+// here and the trigger reads it on the next refresh.
+//
+// Why not a `custom:activeRole` attribute on the user, which was the first
+// design: a Cognito custom attribute is a one-way door — it can never be removed
+// or retyped once added to a pool. A table avoids permanently amending a
+// customer's user pool to hold a preference.
+//
+// Split in two because the pieces are needed at different points in the deploy
+// graph, and the order is forced rather than chosen:
+//
+//   makeTable      the rows. Depends on nothing.
+//   ↓
+//   trigger        needs the table to read from ([Auth_ActiveRoleTrigger.res])
+//   ↓
+//   user pool      needs the trigger's ARN as `lambdaConfig.preTokenGeneration`
+//   ↓
+//   GraphQL API    needs the pool as its authorizer
+//   ↓
+//   makeWriteDoor  needs the API to hang a resolver on, and the table to write
+//
+// Provisioning the table with the write door instead would close that chain into
+// a cycle, so the table is hoisted to where the pool is resolved.
+
+open PulumiAws
+
+type storeTable = {
+  name: Pulumi.Output.t<string>,
+  arn: Pulumi.Output.t<string>,
+}
+
+// JS resolver code (APPSYNC_JS runtime): forward the caller's arguments and the
+// authorizer-verified identity. `sub` is what keys the row, and it comes from
+// here — the mutation has no `sub` argument for a client to supply.
+let invokeCode: Pulumi.Input.t<string> = `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      arguments: ctx.args,
+      identity: id != null && id.sub != null ? { sub: id.sub } : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`->Pulumi.Input.make
+
+/** One row per subject: `id` is the caller's Cognito `sub`, `activeRole` the
+  group they chose, `updatedAt` an operational breadcrumb. No sort key — a caller
+  acts as exactly one role at a time, so the row is the whole state. */
+let makeTable = (
+  ~name: string="ActiveRoleStore",
+  ~opts: Pulumi.ComponentResource.options,
+): storeTable => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+  let table = Util_DynamoDb.makeTable(
+    ~attributes=[{name: "id", type_: "S"}],
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "Table",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Auth,
+      ~scope=Platform,
+    ),
+    ~opts,
+    name,
+  )
+  {name: table.name, arn: table.arn}
+}
+
+/** The Lambda behind `Mutation.Platform_SetActiveRole` and its resolver: an
+  execution role scoped to Logs + the one table + `AdminListGroupsForUser` on the
+  one pool, an AppSync Lambda data source, and the resolver itself. */
+let makeWriteDoor = (
+  ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
+  ~table: storeTable,
+  ~cognitoUserPoolId: Pulumi.Input.t<string>,
+  ~cognitoUserPoolArn: Pulumi.Input.t<string>,
+  ~name: string="ActiveRoleStore",
+  ~opts: Pulumi.ComponentResource.options,
+): unit => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+
+  let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "Lambda",
+    ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "Lambda",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
+    ~opts,
+  )
+
+  // Logs, the one table, and group membership on the one pool.
+  //
+  // `AdminListGroupsForUser` is what makes the refusal in the handler real: a
+  // narrowed token carries a single group, so membership has to come from
+  // Cognito rather than from the token, or a caller who narrowed once could
+  // never widen back. Scoped to this pool's ARN, and it is a read — this role
+  // cannot add anyone to a group, only observe who is in one.
+  let _policy =
+    (table.arn, cognitoUserPoolArn->Pulumi.Output.fromInput)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((tableArn, poolArn)) => {
+      let _ = IAM.RolePolicy.make(
+        ~name=name ++ "LambdaPolicy",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "LambdaPolicy",
+            ~statements=[
+              {
+                sid: "AllowLambdaLogging",
+                effect: Allow,
+                actions: Actions([
+                  "logs:CreateLogGroup",
+                  "logs:CreateLogStream",
+                  "logs:PutLogEvents",
+                ]),
+                resources: Resource("arn:aws:logs:*:*:*"),
+              },
+              {
+                sid: "AllowActiveRoleRowAccess",
+                effect: Allow,
+                actions: Actions(["dynamodb:PutItem", "dynamodb:DeleteItem", "dynamodb:GetItem"]),
+                resources: Resource(tableArn),
+              },
+              {
+                sid: "AllowReadingOwnPoolMembership",
+                effect: Allow,
+                actions: Action("cognito-idp:AdminListGroupsForUser"),
+                resources: Resource(poolArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts,
+      )
+    })
+
+  let packageDirs = Dict.fromArray([
+    (
+      "@reventlessdev/reventless-aws",
+      Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws"),
+    ),
+  ])
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs",
+    ~packageDirs,
+    ~bundleRuntimeExtensions=false,
+  )
+
+  let layers =
+    Lambda.reventlessLayerArn
+    ->Option.map(arn => [arn->Pulumi.Input.make])
+    ->Option.getOr([])
+    ->Pulumi.Input.make
+
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
+  let lambda = Lambda.Function.make(
+    ~name=name ++ "Lambda",
+    ~args={
+      handler: "index.handler"->Pulumi.Input.make,
+      runtime: "nodejs22.x"->Pulumi.Input.make,
+      code: code->Pulumi.Input.make,
+      sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+      role: lambdaRole.arn->Pulumi.Output.asInput,
+      memorySize: 256->Pulumi.Input.make,
+      timeout: 30->Pulumi.Input.make,
+      layers,
+      tags: AWS.Tags.make(
+        ~name=name ++ "Lambda",
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Runtime,
+        ~scope=Platform,
+      ),
+      environment: (
+        {
+          Lambda.Function.variables: Dict.fromArray([
+            ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+            ("ACTIVE_ROLE_TABLE", table.name->Pulumi.Output.asInput),
+            ("COGNITO_USER_POOL_ID", cognitoUserPoolId),
+            ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+            ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
+          ]),
+        }: Lambda.Function.functionEnvironment
+      )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
+    },
+    ~opts,
+  )
+
+  let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
+    ~name=name ++ "DataSource",
+    ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "DataSource",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
+    ~opts,
+  )
+
+  let _ =
+    (lambda.arn, dataSourceRole.id)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((lambdaArn, dataSourceRoleId)) => {
+      let _attach = IAM.RolePolicy.make(
+        ~name=name ++ "DataSource",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "DataSourcePolicy",
+            ~statements=[
+              {
+                sid: "AllowDataSourceInvokeLambda",
+                effect: Allow,
+                actions: Action("lambda:InvokeFunction"),
+                resources: Resource(lambdaArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: dataSourceRoleId->Pulumi.Input.make,
+        },
+        ~opts,
+      )
+    })
+
+  let dataSource = AppSync.DataSource.make(
+    ~name=name ++ "DataSource",
+    ~args={
+      type_: AWS_LAMBDA,
+      apiId: api->Pulumi.Output.flatMap(api => api.id)->Pulumi.Output.asInput,
+      lambdaConfig: {
+        AppSync.DataSource.functionArn: lambda.arn->Pulumi.Output.asInput,
+      }->Pulumi.Input.make,
+      serviceRoleArn: dataSourceRole.arn->Pulumi.Output.asInput,
+    },
+    ~opts=Some(opts),
+  )
+
+  let _resolver = AppSync_Resolver_Native.makeUnitJsResolver(
+    ~name=name ++ "SetActiveRole",
+    ~api,
+    ~dataSourceName=dataSource.name->Pulumi.Output.asInput,
+    ~type_="Mutation"->Pulumi.Input.make,
+    ~field="Platform_SetActiveRole"->Pulumi.Input.make,
+    ~code=invokeCode,
+    ~opts,
+  )
+}