@reventlessdev/reventless-aws 3.0.0-alpha.292 → 3.0.0-alpha.294

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res.mjs

@@ -0,0 +1,107 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
+
+function make(activeRoleTableName, activeRoleTableArn, nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "ActiveRoleTrigger";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  activeRoleTableArn.apply(tableArn => {
+    new (Aws.iam.RolePolicy)(name + "Policy", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "Policy", [
+        {
+          Sid: "AllowLambdaLogging",
+          Effect: "Allow",
+          Action: [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:PutLogEvents"
+          ],
+          Resource: "arn:aws:logs:*:*:*"
+        },
+        {
+          Sid: "AllowReadingStoredRole",
+          Effect: "Allow",
+          Action: "dynamodb:GetItem",
+          Resource: tableArn
+        }
+      ])),
+      role: lambdaRole.id
+    }, opts$1);
+  });
+  let packageDirs = Object.fromEntries([[
+      "@reventlessdev/reventless-aws",
+      Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
+    ]]);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs", packageDirs, undefined, false);
+  let sourceCodeHash = match.sourceCodeHash;
+  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, undefined, AWS_Tags$ReventlessAws.make(name + "LogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
+  let lambda = new (Aws.lambda.Function)(name, {
+    handler: "index.handler",
+    runtime: "nodejs22.x",
+    code: match.code,
+    role: lambdaRole.arn,
+    memorySize: 256,
+    timeout: 5,
+    layers: layers,
+    tags: AWS_Tags$ReventlessAws.make(name, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
+    environment: {
+      variables: Object.fromEntries([
+        [
+          "Environment",
+          Pulumi.getStack()
+        ],
+        [
+          "ACTIVE_ROLE_TABLE",
+          activeRoleTableName
+        ],
+        [
+          "NODE_OPTIONS",
+          Util_Bundle$ReventlessAws.esmLoaderNodeOptions
+        ],
+        [
+          "ESM_FALLBACK_DIRS",
+          Util_Bundle$ReventlessAws.esmFallbackDirs
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
+      ])
+    },
+    sourceCodeHash: sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
+  }, opts$1);
+  return {
+    functionArn: lambda.arn,
+    functionName: lambda.name,
+    sourceCodeHash: sourceCodeHash
+  };
+}
+
+function grantInvoke(trigger, cognitoUserPoolArn, nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "ActiveRoleTrigger";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  trigger.functionName.apply(functionName => {
+    new (Aws.lambda.Permission)(name + "Invoke", {
+      action: "lambda:InvokeFunction",
+      function: functionName,
+      principal: "cognito-idp.amazonaws.com",
+      sourceArn: cognitoUserPoolArn
+    }, opts$1);
+  });
+}
+
+export {
+  make,
+  grantInvoke,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -0,0 +1,201 @@
+// Runtime handler for the Cognito **pre token generation** trigger — the AWS
+// minting point for "acting as one of the roles you hold". See
+// [docs/plans/active-role-narrows-the-token.md] §6.
+//
+// Compiled, type-checked and Pulumi-free so it ships as an EntryPoint module
+// ([Auth_ActiveRoleTrigger.res] bundles it and attaches it to the user pool).
+//
+// The narrowing has to happen here rather than in our own enforcement code
+// because `@authorize(AllowGroups([...]))` compiles to `@aws_auth`, which AppSync
+// evaluates against `cognito:groups` **before any of our code executes**. A
+// request header we invent could scope reads correctly and still leave every
+// group-gated mutation callable — right about the data, wrong about the writes.
+// Overriding the group claim is the one place every enforcement point already
+// looks.
+//
+// **Version 1 of the trigger, deliberately.** Group override and added ID-token
+// claims are `V1_0` capabilities; `V2_0`/`V3_0` buy access-token customisation
+// this does not need and are gated behind the Essentials and Plus feature plans.
+// A deployment on the Lite tier must not be excluded from acting as a role.
+
+open AwsSdk
+
+// ── Environment ─────────────────────────────────────────────────────────────
+
+let getEnv = (k: string): option<string> =>
+  switch NodeProcess.env->Dict.get(k) {
+  | Some("") | None => None
+  | Some(v) => Some(v)
+  }
+
+let tableName = (): string =>
+  switch getEnv("ACTIVE_ROLE_TABLE") {
+  | Some(t) => t
+  | None => JsError.throwWithMessage("ACTIVE_ROLE_TABLE is not configured")
+  }
+
+// ── Cognito pre-token-generation event (V1_0) ───────────────────────────────
+
+type userAttributes = {sub?: string}
+
+/** The groups the pool says the user is really in, supplied by the pool itself.
+  This is why the subset check here needs no lookup and no IAM to perform one:
+  the authority arrives in the payload, and the check is a containment test
+  against it. */
+type groupConfiguration = {
+  groupsToOverride?: array<string>,
+  iamRolesToOverride?: array<string>,
+  preferredRole?: Nullable.t<string>,
+}
+
+type triggerRequest = {
+  userAttributes?: userAttributes,
+  groupConfiguration?: groupConfiguration,
+}
+
+type groupOverrideDetails = {
+  groupsToOverride: array<string>,
+  iamRolesToOverride: array<string>,
+  preferredRole?: Nullable.t<string>,
+}
+
+type claimsOverrideDetails = {
+  claimsToAddOrOverride?: dict<string>,
+  groupOverrideDetails?: groupOverrideDetails,
+}
+
+type triggerResponse = {claimsOverrideDetails?: claimsOverrideDetails}
+
+type event = {
+  request?: triggerRequest,
+  response?: triggerResponse,
+  userName?: string,
+}
+
+// ── The decision ────────────────────────────────────────────────────────────
+
+type decision =
+  /** No stored preference — mint exactly the token that would have been minted
+    before any of this existed. This is the path every existing caller takes. */
+  | Unchanged
+  /** The stored role is one the pool says the caller holds. */
+  | Narrow({role: string, membership: array<string>})
+  /** The row outlived the membership that justified it.
+
+    Resolved by minting the full set rather than narrowing to a group the pool no
+    longer grants — but *decided* here rather than falling out of the code,
+    because the alternative reading is a token scoped to a role the caller has
+    lost. Unlike the write door, this path has no client to refuse: the trigger
+    meets a stale row on an ordinary refresh with nobody asking for anything. It
+    says so on the token instead, so a caller whose chosen role silently stopped
+    applying has something to read. */
+  | Stale({role: string, membership: array<string>})
+
+let decide = (~membership: array<string>, ~storedRole: option<string>): decision =>
+  switch storedRole {
+  | None | Some("") => Unchanged
+  | Some(role) =>
+    membership->Array.includes(role) ? Narrow({role, membership}) : Stale({role, membership})
+  }
+
+/**
+Turn a decision into the trigger's response.
+
+🚨 **`groupOverrideDetails` replaces the whole group configuration.** Supplying it
+with only `groupsToOverride` drops the caller's `iamRolesToOverride` and
+`preferredRole` — the same reset-by-omission hazard `UpdateUserPool` has, and just
+as quiet. Both are echoed from the incoming configuration so the override changes
+exactly one thing.
+
+`Unchanged` returns the event untouched rather than an empty override: an empty
+`claimsOverrideDetails` is not the same as none, and the regression line for this
+whole feature is that a caller with no stored role gets byte-identical output.
+*/
+let respond = (~event: event, ~decision: decision): event => {
+  let incoming = event.request->Option.flatMap(r => r.groupConfiguration)
+  let iamRolesToOverride = incoming->Option.flatMap(g => g.iamRolesToOverride)->Option.getOr([])
+  let preferredRole = incoming->Option.flatMap(g => g.preferredRole)
+
+  let overrideWith = (~groups: array<string>, ~claims: dict<string>) => {
+    ...event,
+    response: {
+      claimsOverrideDetails: {
+        claimsToAddOrOverride: claims,
+        groupOverrideDetails: {
+          groupsToOverride: groups,
+          iamRolesToOverride,
+          preferredRole: ?preferredRole,
+        },
+      },
+    },
+  }
+
+  switch decision {
+  | Unchanged => event
+  | Narrow({role, membership}) =>
+    overrideWith(
+      ~groups=[role],
+      ~claims=Dict.fromArray([
+        (ReventlessCore.Auth_ActiveRole.activeRoleClaim, role),
+        (ReventlessCore.Auth_ActiveRole.availableRolesClaim, membership->Array.join(",")),
+      ]),
+    )
+  | Stale({role, membership}) =>
+    // The full set, as the pool granted it — plus the marker that explains why the
+    // stored choice did not apply.
+    overrideWith(
+      ~groups=membership,
+      ~claims=Dict.fromArray([
+        (ReventlessCore.Auth_ActiveRole.staleRoleClaim, role),
+        (ReventlessCore.Auth_ActiveRole.availableRolesClaim, membership->Array.join(",")),
+      ]),
+    )
+  }
+}
+
+// ── Stored preference ───────────────────────────────────────────────────────
+
+/**
+The role this subject last chose, or `None` if they never chose one or cleared it.
+
+A read failure resolves to `None`, not to an error. This trigger sits in the
+critical path of every token Cognito mints for this pool: a throw here fails the
+sign-in outright, and failing a login because a *preference* could not be read
+trades a working session for a cosmetic one. The caller lands on full membership —
+their existing privileges, not more — which is the safe direction to fail.
+*/
+let storedRoleFor = async (~sub: string, ~table: string): option<string> =>
+  try {
+    let out = await DynamoDb_DocumentClient.GetCommand.make({
+      tableName: table,
+      key: Dict.fromArray([("id", JSON.Encode.string(sub))]),
+    })->DynamoDb_DocumentClient.GetCommand.send
+    out.item
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.flatMap(o => o->Dict.get("activeRole"))
+    ->Option.flatMap(JSON.Decode.string)
+  } catch {
+  | _ => None
+  }
+
+// ── Handler ─────────────────────────────────────────────────────────────────
+
+let handler = async (event: event): event => {
+  let membership =
+    event.request
+    ->Option.flatMap(r => r.groupConfiguration)
+    ->Option.flatMap(g => g.groupsToOverride)
+    ->Option.getOr([])
+
+  let sub =
+    event.request->Option.flatMap(r => r.userAttributes)->Option.flatMap(u => u.sub)->Option.getOr("")
+
+  // No subject means no row to look up. Returning the event untouched keeps the
+  // sign-in working on exactly the membership the pool granted.
+  if sub == "" {
+    event
+  } else {
+    let storedRole = await storedRoleFor(~sub, ~table=tableName())
+    respond(~event, ~decision=decide(~membership, ~storedRole))
+  }
+}

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs

@@ -0,0 +1,126 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
+import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
+
+function getEnv(k) {
+  let v = process.env[k];
+  if (v !== undefined && v !== "") {
+    return v;
+  }
+}
+
+function tableName() {
+  let t = getEnv("ACTIVE_ROLE_TABLE");
+  if (t !== undefined) {
+    return t;
+  } else {
+    return Stdlib_JsError.throwWithMessage("ACTIVE_ROLE_TABLE is not configured");
+  }
+}
+
+function decide(membership, storedRole) {
+  if (storedRole !== undefined && storedRole !== "") {
+    if (membership.includes(storedRole)) {
+      return {
+        TAG: "Narrow",
+        role: storedRole,
+        membership: membership
+      };
+    } else {
+      return {
+        TAG: "Stale",
+        role: storedRole,
+        membership: membership
+      };
+    }
+  } else {
+    return "Unchanged";
+  }
+}
+
+function respond(event, decision) {
+  let incoming = Stdlib_Option.flatMap(event.request, r => r.groupConfiguration);
+  let iamRolesToOverride = Stdlib_Option.getOr(Stdlib_Option.flatMap(incoming, g => g.iamRolesToOverride), []);
+  let preferredRole = Stdlib_Option.flatMap(incoming, g => g.preferredRole);
+  let overrideWith = (groups, claims) => {
+    let newrecord = {...event};
+    newrecord.response = {
+      claimsOverrideDetails: {
+        claimsToAddOrOverride: claims,
+        groupOverrideDetails: {
+          groupsToOverride: groups,
+          iamRolesToOverride: iamRolesToOverride,
+          preferredRole: preferredRole
+        }
+      }
+    };
+    return newrecord;
+  };
+  if (typeof decision !== "object") {
+    return event;
+  }
+  if (decision.TAG === "Narrow") {
+    let role = decision.role;
+    return overrideWith([role], Object.fromEntries([
+      [
+        Auth_ActiveRole$ReventlessCore.activeRoleClaim,
+        role
+      ],
+      [
+        Auth_ActiveRole$ReventlessCore.availableRolesClaim,
+        decision.membership.join(",")
+      ]
+    ]));
+  }
+  let membership = decision.membership;
+  return overrideWith(membership, Object.fromEntries([
+    [
+      Auth_ActiveRole$ReventlessCore.staleRoleClaim,
+      decision.role
+    ],
+    [
+      Auth_ActiveRole$ReventlessCore.availableRolesClaim,
+      membership.join(",")
+    ]
+  ]));
+}
+
+async function storedRoleFor(sub, table) {
+  try {
+    let out = await DynamoDb_DocumentClient$AwsSdk.GetCommand.send(new LibDynamodb.GetCommand({
+      TableName: table,
+      Key: Object.fromEntries([[
+          "id",
+          sub
+        ]])
+    }));
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(out.Item, Stdlib_JSON.Decode.object), o => o["activeRole"]), Stdlib_JSON.Decode.string);
+  } catch (exn) {
+    return;
+  }
+}
+
+async function handler(event) {
+  let membership = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event.request, r => r.groupConfiguration), g => g.groupsToOverride), []);
+  let sub = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event.request, r => r.userAttributes), u => u.sub), "");
+  if (sub === "") {
+    return event;
+  }
+  let storedRole = await storedRoleFor(sub, tableName());
+  return respond(event, decide(membership, storedRole));
+}
+
+export {
+  getEnv,
+  tableName,
+  decide,
+  respond,
+  storedRoleFor,
+  handler,
+}
+/* @aws-sdk/lib-dynamodb Not a pure module */