@reventlessdev/reventless-aws 3.0.0-alpha.292 → 3.0.0-alpha.294

package/src/adapter/Auth/Auth_ActiveRoleStore.res.mjs

@@ -0,0 +1,163 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
+import * as AppSync_Resolver_Native$ReventlessAws from "../Api/AppSync_Resolver_Native.res.mjs";
+
+let invokeCode = `import { util } from '@aws-appsync/utils';
+export function request(ctx) {
+  const id = ctx.identity;
+  return {
+    operation: 'Invoke',
+    payload: {
+      arguments: ctx.args,
+      identity: id != null && id.sub != null ? { sub: id.sub } : null
+    }
+  };
+}
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  return ctx.result;
+}
+`;
+
+function makeTable(nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "ActiveRoleStore";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let table = Util_DynamoDb$ReventlessAws.makeTable([{
+      name: "id",
+      type: "S"
+    }], undefined, undefined, undefined, AWS_Tags$ReventlessAws.make(name + "Table", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined), opts$1, name);
+  return {
+    name: table.name,
+    arn: table.arn
+  };
+}
+
+function makeWriteDoor(api, table, cognitoUserPoolId, cognitoUserPoolArn, nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "ActiveRoleStore";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "Lambda", Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  Pulumi.all([
+    table.arn,
+    cognitoUserPoolArn
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "LambdaPolicy", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "LambdaPolicy", [
+        {
+          Sid: "AllowLambdaLogging",
+          Effect: "Allow",
+          Action: [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents"
+          ],
+          Resource: "arn:aws:logs:*:*:*"
+        },
+        {
+          Sid: "AllowActiveRoleRowAccess",
+          Effect: "Allow",
+          Action: [
+            "dynamodb:PutItem",
+            "dynamodb:DeleteItem",
+            "dynamodb:GetItem"
+          ],
+          Resource: param[0]
+        },
+        {
+          Sid: "AllowReadingOwnPoolMembership",
+          Effect: "Allow",
+          Action: "cognito-idp:AdminListGroupsForUser",
+          Resource: param[1]
+        }
+      ])),
+      role: lambdaRole.id
+    }, opts$1);
+  });
+  let packageDirs = Object.fromEntries([[
+      "@reventlessdev/reventless-aws",
+      Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
+    ]]);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs", packageDirs, undefined, false);
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
+  let lambda = new (Aws.lambda.Function)(name + "Lambda", {
+    handler: "index.handler",
+    runtime: "nodejs22.x",
+    code: match.code,
+    role: lambdaRole.arn,
+    memorySize: 256,
+    timeout: 30,
+    layers: layers,
+    tags: AWS_Tags$ReventlessAws.make(name + "Lambda", "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
+    environment: {
+      variables: Object.fromEntries([
+        [
+          "Environment",
+          Pulumi.getStack()
+        ],
+        [
+          "ACTIVE_ROLE_TABLE",
+          table.name
+        ],
+        [
+          "COGNITO_USER_POOL_ID",
+          cognitoUserPoolId
+        ],
+        [
+          "NODE_OPTIONS",
+          Util_Bundle$ReventlessAws.esmLoaderNodeOptions
+        ],
+        [
+          "ESM_FALLBACK_DIRS",
+          Util_Bundle$ReventlessAws.esmFallbackDirs
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
+      ])
+    },
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
+  }, opts$1);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  Pulumi.all([
+    lambda.arn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeLambda",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts$1);
+  });
+  let dataSource = new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambda.arn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts$1);
+  AppSync_Resolver_Native$ReventlessAws.makeUnitJsResolver(name + "SetActiveRole", api, dataSource.name, "Mutation", "Platform_SetActiveRole", invokeCode, opts$1);
+}
+
+export {
+  invokeCode,
+  makeTable,
+  makeWriteDoor,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res

@@ -0,0 +1,148 @@
+// Runtime handler for `Mutation.Platform_SetActiveRole` — compiled, type-checked
+// and Pulumi-free so it ships as an EntryPoint module (`Auth_ActiveRoleStore`
+// bundles it and attaches it as the domain API's Lambda data source). See
+// [Upload_Presign_S3_Ops.res] for why an EntryPoint rather than a serialized
+// closure, and [docs/plans/active-role-narrows-the-token.md] §6 for the design.
+//
+// What this writes is a *preference*, not a token. Cognito mints the token, and
+// the pre-token-generation trigger ([Auth_ActiveRoleTrigger_Ops.res]) reads this
+// row on the next refresh and narrows the group claim to it. Nothing here can
+// grant anything: the trigger re-checks the stored role against real membership
+// before applying it, so a row is at most a request that the trigger may honour.
+//
+// 🚨 **The subject is taken from the verified identity, never from the arguments.**
+// The row key is `ctx.identity.sub` as the AppSync Cognito authorizer resolved it.
+// There is deliberately no `sub` argument on the mutation — with one, a caller
+// could set another caller's role, and this becomes a privilege-granting surface
+// instead of a preference.
+
+open AwsSdk
+
+// ── Environment ─────────────────────────────────────────────────────────────
+
+let getEnv = (k: string): option<string> =>
+  switch NodeProcess.env->Dict.get(k) {
+  | Some("") | None => None
+  | Some(v) => Some(v)
+  }
+
+let tableName = (): string =>
+  switch getEnv("ACTIVE_ROLE_TABLE") {
+  | Some(t) => t
+  | None => JsError.throwWithMessage("ACTIVE_ROLE_TABLE is not configured")
+  }
+
+let userPoolId = (): string =>
+  switch getEnv("COGNITO_USER_POOL_ID") {
+  | Some(p) => p
+  | None => JsError.throwWithMessage("COGNITO_USER_POOL_ID is not configured")
+  }
+
+// ── Membership ──────────────────────────────────────────────────────────────
+
+/**
+The caller's actual group membership, read from Cognito.
+
+🚨 **Not read from the presented token.** A narrowed token carries exactly one
+group, so judging membership by `ctx.identity.groups` would make the switch
+one-way: a caller who narrowed to `Shopper` could never widen back, because the
+token they hold no longer mentions the role they are asking for. This is the same
+trap the local path documents on `LocalAuth.Login.reissue`, where membership is
+re-read from the user store rather than from the token's own record of it.
+
+Paginated deliberately: `AdminListGroupsForUser` caps a page at 60 groups, and a
+truncated read would silently refuse a role the caller genuinely holds.
+*/
+let membershipOf = async (~sub: string, ~poolId: string): array<string> => {
+  let collected = []
+  let nextToken = ref(None)
+  let more = ref(true)
+  while more.contents {
+    let page = await CognitoIdentityServiceProvider.AdminListGroupsForUserCommand.make({
+      username: sub,
+      userPoolId: poolId,
+      nextToken: ?nextToken.contents,
+    })->CognitoIdentityServiceProvider.AdminListGroupsForUserCommand.send
+    page.groups
+    ->Option.getOr([])
+    ->Array.forEach(g => g.groupName->Option.forEach(n => collected->Array.push(n)))
+    switch page.nextToken {
+    | Some(_) as t => nextToken := t
+    | None => more := false
+    }
+  }
+  collected
+}
+
+// ── The subset rule ─────────────────────────────────────────────────────────
+
+/**
+Whether a requested role may be stored.
+
+Narrowing only, never widening — a client that tampers with the request can only
+ever reduce its own privilege. Pure and exported so the conformance table in
+`ReventlessCore.Auth_ActiveRole` can be driven against it without a Cognito pool
+or a DynamoDB table in existence.
+*/
+let mayActAs = (~membership: array<string>, ~requested: string): bool =>
+  membership->Array.includes(requested)
+
+// ── AppSync resolver event / result shapes ──────────────────────────────────
+
+type identity = {sub?: string}
+type activeRoleArgs = {activeRole?: Nullable.t<string>}
+type appSyncEvent = {
+  arguments?: activeRoleArgs,
+  identity?: identity,
+}
+
+let result = (~activeRole: option<string>, ~availableRoles: array<string>): JSON.t =>
+  Dict.fromArray([
+    ("activeRole", activeRole->Option.mapOr(JSON.Null, JSON.Encode.string)),
+    ("availableRoles", availableRoles->Array.map(JSON.Encode.string)->JSON.Encode.array),
+  ])->JSON.Encode.object
+
+// ── Handler ─────────────────────────────────────────────────────────────────
+
+let handler = async (event: appSyncEvent): JSON.t => {
+  let sub = event.identity->Option.flatMap(i => i.sub)->Option.getOr("")
+  if sub == "" {
+    // The authorizer should have refused first; this is the guard that keeps an
+    // unauthenticated path from ever writing a row keyed on the empty subject.
+    JsError.throwWithMessage("unauthenticated")
+  }
+  let table = tableName()
+  let membership = await membershipOf(~sub, ~poolId=userPoolId())
+
+  // An absent argument and an explicit `null` mean the same thing — clear the
+  // preference and go back to full membership on the next refresh. That is not an
+  // escalation: the set being widened to is the one Cognito says the caller holds.
+  let requested = switch event.arguments->Option.flatMap(a => a.activeRole) {
+  | Some(Value(role)) => Some(role)
+  | Some(Null) | Some(Undefined) | None => None
+  }
+
+  switch requested {
+  | None =>
+    let _ = await DynamoDb_DocumentClient.deleteById(~tableName=table, ~id=sub)
+    result(~activeRole=None, ~availableRoles=membership)
+  | Some(role) =>
+    // Refused, specifically — not ignored and stored anyway. A client asking for
+    // something it cannot have is either confused or hostile, and both are better
+    // served by an error than by a stored role that quietly never takes effect.
+    if !mayActAs(~membership, ~requested=role) {
+      JsError.throwWithMessage(`Cannot act as "${role}": not a group this user holds`)
+    }
+    let item =
+      Dict.fromArray([
+        ("id", JSON.Encode.string(sub)),
+        ("activeRole", JSON.Encode.string(role)),
+        ("updatedAt", JSON.Encode.string(Date.make()->Date.toISOString)),
+      ])->JSON.Encode.object
+    let _ = await DynamoDb_DocumentClient.PutCommand.make({
+      tableName: table,
+      item,
+    })->DynamoDb_DocumentClient.PutCommand.send
+    result(~activeRole=Some(role), ~availableRoles=membership)
+  }
+}

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs

@@ -0,0 +1,128 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
+import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+
+function getEnv(k) {
+  let v = process.env[k];
+  if (v !== undefined && v !== "") {
+    return v;
+  }
+}
+
+function tableName() {
+  let t = getEnv("ACTIVE_ROLE_TABLE");
+  if (t !== undefined) {
+    return t;
+  } else {
+    return Stdlib_JsError.throwWithMessage("ACTIVE_ROLE_TABLE is not configured");
+  }
+}
+
+function userPoolId() {
+  let p = getEnv("COGNITO_USER_POOL_ID");
+  if (p !== undefined) {
+    return p;
+  } else {
+    return Stdlib_JsError.throwWithMessage("COGNITO_USER_POOL_ID is not configured");
+  }
+}
+
+async function membershipOf(sub, poolId) {
+  let collected = [];
+  let nextToken;
+  let more = true;
+  while (more) {
+    let page = await CognitoIdentityServiceProvider$AwsSdk.AdminListGroupsForUserCommand.send(new ClientCognitoIdentityProvider.AdminListGroupsForUserCommand({
+      Username: sub,
+      UserPoolId: poolId,
+      NextToken: nextToken
+    }));
+    Stdlib_Option.getOr(page.Groups, []).forEach(g => Stdlib_Option.forEach(g.GroupName, n => {
+      collected.push(n);
+    }));
+    let t = page.NextToken;
+    if (t !== undefined) {
+      nextToken = t;
+    } else {
+      more = false;
+    }
+  };
+  return collected;
+}
+
+function mayActAs(membership, requested) {
+  return membership.includes(requested);
+}
+
+function result(activeRole, availableRoles) {
+  return Object.fromEntries([
+    [
+      "activeRole",
+      Stdlib_Option.mapOr(activeRole, null, prim => prim)
+    ],
+    [
+      "availableRoles",
+      availableRoles.map(prim => prim)
+    ]
+  ]);
+}
+
+async function handler(event) {
+  let sub = Stdlib_Option.getOr(Stdlib_Option.flatMap(event.identity, i => i.sub), "");
+  if (sub === "") {
+    Stdlib_JsError.throwWithMessage("unauthenticated");
+  }
+  let table = tableName();
+  let membership = await membershipOf(sub, userPoolId());
+  let match = Stdlib_Option.flatMap(event.arguments, a => a.activeRole);
+  let requested;
+  if (match !== undefined) {
+    let role = Primitive_option.valFromOption(match);
+    requested = (role == null) ? undefined : role;
+  } else {
+    requested = undefined;
+  }
+  if (requested !== undefined) {
+    if (!membership.includes(requested)) {
+      Stdlib_JsError.throwWithMessage(`Cannot act as "` + requested + `": not a group this user holds`);
+    }
+    let item = Object.fromEntries([
+      [
+        "id",
+        sub
+      ],
+      [
+        "activeRole",
+        requested
+      ],
+      [
+        "updatedAt",
+        new Date().toISOString()
+      ]
+    ]);
+    await DynamoDb_DocumentClient$AwsSdk.PutCommand.send(new LibDynamodb.PutCommand({
+      Item: item,
+      TableName: table
+    }));
+    return result(requested, membership);
+  }
+  await DynamoDb_DocumentClient$AwsSdk.deleteById(table, sub);
+  return result(undefined, membership);
+}
+
+export {
+  getEnv,
+  tableName,
+  userPoolId,
+  membershipOf,
+  mayActAs,
+  result,
+  handler,
+}
+/* @aws-sdk/lib-dynamodb Not a pure module */

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res

@@ -0,0 +1,185 @@
+// Deploy-time half of the Cognito pre-token-generation trigger — the Lambda that
+// narrows `cognito:groups` to the role a caller chose. Runtime logic lives in
+// [Auth_ActiveRoleTrigger_Ops.res]; see
+// [docs/plans/active-role-narrows-the-token.md] §6.
+//
+// `make` provisions the function and its execution role (Logs + a read of the
+// one role-state table). It does **not** attach itself to a user pool, and does
+// not grant Cognito permission to invoke it: both need the pool, and in auto
+// mode the pool needs this function's ARN first — the pool cannot be declared
+// with a trigger that does not exist yet. So `make` runs before the pool, and
+// [grantInvoke] runs after it.
+//
+// Attaching is a separate step again ([Auth_ActiveRolePoolAttachment.res] in BYO
+// mode, `lambdaConfig` on the declared pool in auto mode), kept apart because it
+// is the only part of this feature that can damage something that already
+// exists.
+
+open PulumiAws
+
+type triggerOutputs = {
+  functionArn: Pulumi.Output.t<string>,
+  functionName: Pulumi.Output.t<string>,
+  /** The archive's hash, exposed so whoever attaches this trigger to a pool can
+      tell that the code changed. The function ARN does not move when the code
+      does, so without this an attachment sees identical inputs across deploys
+      and never re-checks a function it proved once. */
+  sourceCodeHash: string,
+}
+
+let make = (
+  ~activeRoleTableName: Pulumi.Input.t<string>,
+  ~activeRoleTableArn: Pulumi.Input.t<string>,
+  ~name: string="ActiveRoleTrigger",
+  ~opts: Pulumi.ComponentResource.options,
+): triggerOutputs => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+
+  let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+    ~name,
+    ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+    ~tags=AWS.Tags.make(
+      ~name,
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Identity,
+      ~scope=Platform,
+    ),
+    ~opts,
+  )
+
+  // Logs and a single-item read. Nothing else: the trigger needs no Cognito
+  // permission at all, because the membership it checks against arrives in the
+  // event as `request.groupConfiguration.groupsToOverride`. `GetItem` alone —
+  // this function must never be able to write the preference it reads.
+  let _policy =
+    activeRoleTableArn
+    ->Pulumi.Output.fromInput
+    ->Pulumi.Output.apply(tableArn => {
+      let _ = IAM.RolePolicy.make(
+        ~name=name ++ "Policy",
+        ~args={
+          policy: PolicyDocument.make(
+            ~id=name ++ "Policy",
+            ~statements=[
+              {
+                sid: "AllowLambdaLogging",
+                effect: Allow,
+                actions: Actions([
+                  "logs:CreateLogGroup",
+                  "logs:CreateLogStream",
+                  "logs:PutLogEvents",
+                ]),
+                resources: Resource("arn:aws:logs:*:*:*"),
+              },
+              {
+                sid: "AllowReadingStoredRole",
+                effect: Allow,
+                actions: Action("dynamodb:GetItem"),
+                resources: Resource(tableArn),
+              },
+            ],
+          )
+          ->PolicyDocument.toJsonString
+          ->Pulumi.Input.make,
+          role: lambdaRole.id->Pulumi.Output.asInput,
+        },
+        ~opts,
+      )
+    })
+
+  let packageDirs = Dict.fromArray([
+    (
+      "@reventlessdev/reventless-aws",
+      Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws"),
+    ),
+  ])
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs",
+    ~packageDirs,
+    ~bundleRuntimeExtensions=false,
+  )
+
+  let layers =
+    Lambda.reventlessLayerArn
+    ->Option.map(arn => [arn->Pulumi.Input.make])
+    ->Option.getOr([])
+    ->Pulumi.Input.make
+
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
+  // This function sits in the critical path of every token the pool mints, so a
+  // cold start is a login's latency and a timeout is a failed sign-in. One
+  // `GetItem` needs neither much memory nor much time; 5s is well inside
+  // Cognito's own 5s trigger budget, so the function fails before Cognito gives
+  // up on it rather than after.
+  let lambda = Lambda.Function.make(
+    ~name,
+    ~args={
+      handler: "index.handler"->Pulumi.Input.make,
+      runtime: "nodejs22.x"->Pulumi.Input.make,
+      code: code->Pulumi.Input.make,
+      sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+      role: lambdaRole.arn->Pulumi.Output.asInput,
+      memorySize: 256->Pulumi.Input.make,
+      timeout: 5->Pulumi.Input.make,
+      layers,
+      tags: AWS.Tags.make(
+        ~name,
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Runtime,
+        ~scope=Platform,
+      ),
+      environment: (
+        {
+          Lambda.Function.variables: Dict.fromArray([
+            ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+            ("ACTIVE_ROLE_TABLE", activeRoleTableName),
+            ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+            ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
+          ]),
+        }: Lambda.Function.functionEnvironment
+      )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
+    },
+    ~opts,
+  )
+
+  {functionArn: lambda.arn, functionName: lambda.name, sourceCodeHash}
+}
+
+/** Let Cognito invoke the trigger — scoped to one pool, so a function attached
+  to a pool nobody declared still cannot be invoked by it.
+
+  Separate from [make] because the pool's ARN is not known until the pool exists,
+  and in auto mode the pool is declared *with* the function's ARN. */
+let grantInvoke = (
+  ~trigger: triggerOutputs,
+  ~cognitoUserPoolArn: Pulumi.Input.t<string>,
+  ~name: string="ActiveRoleTrigger",
+  ~opts: Pulumi.ComponentResource.options,
+): unit => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+  let _permission = trigger.functionName->Pulumi.Output.apply(functionName => {
+    let _ = Lambda.Permission.make(
+      ~name=name ++ "Invoke",
+      ~args={
+        action: "lambda:InvokeFunction",
+        function: functionName->Pulumi.Input.make,
+        principal: "cognito-idp.amazonaws.com",
+        sourceArn: cognitoUserPoolArn,
+      },
+      ~opts,
+    )
+  })
+}