@reventlessdev/reventless-aws 3.0.0-alpha.293 → 3.0.0-alpha.295

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.295 (2026-08-14)
+
+### Bug Fixes
+
+* **aws:** enforce Cognito group gates that AppSync was silently ignoring ([1392638](https://github.com/ReventlessDev/reventless-core/commit/13926388c097500606f75c387630a19ee1a3aa71))
+
+
+# 3.0.0-alpha.294 (2026-08-14)
+
+### Bug Fixes
+
+* **aws:** provision the active-role write door outside the host-UI branch ([2ffc121](https://github.com/ReventlessDev/reventless-core/commit/2ffc12198dfedd151c298add42fbb9bb0dc95ca6))
+### Features
+
+* **aws:** prove the pre-token-generation trigger before attaching it to a pool ([6e981a4](https://github.com/ReventlessDev/reventless-core/commit/6e981a4f6b4089a140cd7dda7df00177b98d4a65))
+
+
 # 3.0.0-alpha.293 (2026-08-13)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.293",
+  "version": "3.0.0-alpha.295",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.9",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.5",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.74",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.6",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.232",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.96",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.140"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -2107,31 +2107,6 @@ module MakeWithConfig = (
       | _ => ()
       }
 
-      // Where a caller records the role they want to act as
-      // (docs/plans/active-role-narrows-the-token.md §6). The mutation only writes
-      // a preference; the pre-token-generation trigger reads the row and re-checks
-      // it against real membership before narrowing anything, so this door grants
-      // nobody anything on its own.
-      //
-      // The table and the trigger were provisioned with the pool — they have to
-      // be, since the pool is declared carrying the trigger's ARN. Only the write
-      // door waits for the API.
-      //
-      // Split-API only, like the upload and geocode resolvers above:
-      // `Platform_SetActiveRole` lives on the domain base document, which a
-      // unified-mode deployment's single API does not carry. The table and
-      // trigger are provisioned either way — see `Platform_Stack` for why that
-      // is not gated on this flag.
-      if Config.splitApi {
-        Auth_ActiveRoleStore.makeWriteDoor(
-          ~api=domainApi,
-          ~table=cognitoPool.activeRoleTable,
-          ~cognitoUserPoolId=cognitoPool.poolId->Pulumi.Output.asInput,
-          ~cognitoUserPoolArn=cognitoPool.poolArn->Pulumi.Output.asInput,
-          ~opts={},
-        )
-      }
-
       // The place index itself, exported so the unattended slice path can reach the
       // capability: a slice's Lambda signs an SDK call directly and needs the index
       // name, not an endpoint (no proxy hop, no dependence on a public URL). The
@@ -2283,6 +2258,44 @@ module MakeWithConfig = (
       Pulumi.Pulumi.export("hostShellUrl", distributionUrl)
     }
 
+    // Where a caller records the role they want to act as
+    // (docs/plans/active-role-narrows-the-token.md §6). The mutation only writes
+    // a preference; the pre-token-generation trigger reads the row and re-checks
+    // it against real membership before narrowing anything, so this door grants
+    // nobody anything on its own.
+    //
+    // The table and the trigger were provisioned with the pool — they have to be,
+    // since the pool is declared carrying the trigger's ARN. Only the write door
+    // waits for the API, which is why it is here and not there.
+    //
+    // 🚨 **Outside `switch hostUiBundle`, and that is the whole point.** It was
+    // written inside it, where the pool happens to be resolved — and a platform
+    // whose shell ships from its own stack passes no bundle, so the door silently
+    // did not exist there. The table and trigger still appeared, because
+    // `resolveCognitoUserPool` is process-cached and `Auth_Cognito.make` reaches
+    // it first: the feature deployed looking complete, with the trigger attached
+    // to the pool and nothing able to write a row for it to read. Same shape as
+    // the object-store endpoints at the top of this file, which sat in this branch
+    // for the same reason and were moved out for the same one. Nothing that is not
+    // *about* the host UI belongs inside this switch.
+    //
+    // Split-API only, like the upload and geocode resolvers: `Platform_SetActiveRole`
+    // lives on the domain base document, which a unified-mode deployment's single
+    // API does not carry. The table and trigger are provisioned either way — see
+    // `Platform_Stack` for why that is not gated on this flag.
+    if Config.splitApi {
+      // Resolved here rather than reused from the branch above, which may not have
+      // run. The call is process-cached, so this is the same pool either way.
+      let pool = Platform_Stack.resolveCognitoUserPool()
+      Auth_ActiveRoleStore.makeWriteDoor(
+        ~api=domainApi,
+        ~table=pool.activeRoleTable,
+        ~cognitoUserPoolId=pool.poolId->Pulumi.Output.asInput,
+        ~cognitoUserPoolArn=pool.poolArn->Pulumi.Output.asInput,
+        ~opts={},
+      )
+    }
+
     Pulumi.Pulumi.getOutputs()
   }
 

package/src/Platform.res.mjs

@@ -1131,9 +1131,6 @@ function MakeWithConfig(Config) {
       if (index !== undefined && Config.splitApi) {
         Geocoder_AwsLocation_Resolver$ReventlessAws.make(domainApi, index.indexName, undefined, {});
       }
-      if (Config.splitApi) {
-        Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, cognitoPool.activeRoleTable, cognitoPool.poolId, cognitoPool.poolArn, undefined, {});
-      }
       let index$1 = hostUiBundle.geocoderPlaceIndex;
       let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
       Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
@@ -1234,6 +1231,10 @@ function MakeWithConfig(Config) {
       }
       Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
+    if (Config.splitApi) {
+      let pool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
+      Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, pool.activeRoleTable, pool.poolId, pool.poolArn, undefined, {});
+    }
     return Pulumi$Pulumi.getOutputs();
   };
   let startServers = () => {};
@@ -2410,7 +2411,6 @@ function Make($star) {
       if (index !== undefined) {
         Geocoder_AwsLocation_Resolver$ReventlessAws.make(domainApi, index.indexName, undefined, {});
       }
-      Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, cognitoPool.activeRoleTable, cognitoPool.poolId, cognitoPool.poolArn, undefined, {});
       let index$1 = hostUiBundle.geocoderPlaceIndex;
       let geocoderPlaceIndexFlat = index$1 !== undefined ? index$1.indexName : Pulumi.output("");
       Pulumi$Pulumi.$$export("geocoderPlaceIndex", geocoderPlaceIndexFlat);
@@ -2511,6 +2511,8 @@ function Make($star) {
       }
       Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
+    let pool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
+    Auth_ActiveRoleStore$ReventlessAws.makeWriteDoor(domainApi, pool.activeRoleTable, pool.poolId, pool.poolArn, undefined, {});
     return Pulumi$Pulumi.getOutputs();
   };
   let startServers = () => {};

package/src/Platform_Stack.res

@@ -109,10 +109,14 @@ let _resolveUncached = (): cognitoUserPool => {
     // resource that describes the pool, merges into what it finds, and sends the
     // result back whole. Never a hand-run command: that would leave the
     // deployment's behaviour depending on an act no source describes.
+    // The code hash is an input so a new build of the trigger reaches this
+    // resource: the function ARN is stable, so it alone would let a broken
+    // version onto the pool unchecked after the first deploy.
     let _attachment = Auth_ActiveRolePoolAttachment.make(
       ~props={
         userPoolId: Pulumi.Input.make(poolId),
         preTokenGenerationArn: activeRoleTrigger.functionArn->Pulumi.Output.asInput,
+        codeHash: Pulumi.Input.make(activeRoleTrigger.sourceCodeHash),
       },
       ~opts={},
     )

package/src/Platform_Stack.res.mjs

@@ -44,7 +44,8 @@ function _resolveUncached() {
     });
     Auth_ActiveRolePoolAttachment$ReventlessAws.make(undefined, {
       userPoolId: existingPoolId,
-      preTokenGenerationArn: activeRoleTrigger.functionArn
+      preTokenGenerationArn: activeRoleTrigger.functionArn,
+      codeHash: activeRoleTrigger.sourceCodeHash
     }, {});
     result = {
       poolId: Pulumi.output(existingPoolId),

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res

@@ -159,6 +159,54 @@ let getClient = async (): cognitoClient =>
     c
   }
 
+// ── Lambda bindings, for proving the trigger before attaching it ─────────────
+
+type lambdaClient
+type invokeCmd
+
+type lambdaSdkModule = {
+  @as("LambdaClient") clientCtor: unit => lambdaClient,
+  @as("InvokeCommand") invokeCtor: dict<JSON.t> => invokeCmd,
+}
+
+type invokeResult = {
+  @as("FunctionError") functionError?: string,
+  @as("Payload") payload?: JSON.t,
+}
+
+@send external sendInvoke: (lambdaClient, invokeCmd) => promise<invokeResult> = "send"
+@val external dynImportLambda: string => promise<lambdaSdkModule> = "import"
+
+let _lambdaSdk: ref<option<lambdaSdkModule>> = ref(None)
+let _lambdaClient: ref<option<lambdaClient>> = ref(None)
+
+let getLambdaSdk = async (): lambdaSdkModule =>
+  switch _lambdaSdk.contents {
+  | Some(m) => m
+  | None =>
+    let m = await dynImportLambda("@aws-sdk/client-lambda")
+    _lambdaSdk.contents = Some(m)
+    m
+  }
+
+let getLambdaClient = async (): lambdaClient =>
+  switch _lambdaClient.contents {
+  | Some(c) => c
+  | None =>
+    let sdk = await getLambdaSdk()
+    let c = newOf0(sdk.clientCtor)
+    _lambdaClient.contents = Some(c)
+    c
+  }
+
+/** Decodes the SDK's `Payload`, which arrives as a byte array rather than a
+    string. */
+let decodePayload: JSON.t => string = %raw(`(p) => {
+  if (p == null) return "";
+  if (typeof p === "string") return p;
+  try { return new TextDecoder().decode(p); } catch { return String(p); }
+}`)
+
 @get @return(nullable) external exnName: JsExn.t => option<string> = "name"
 
 let isPoolGoneError = (jsErr: JsExn.t): bool =>
@@ -168,6 +216,129 @@ let isPoolGoneError = (jsErr: JsExn.t): bool =>
   | _ => false
   }
 
+// ── Prove the trigger before attaching it ────────────────────────────────────
+
+/** The subject the probe presents. It is not a real user and must never match
+    one: the handler looks the id up in the role table, and a probe that
+    collided with a real row would exercise a different branch than the one it
+    is here to check. */
+let probeSubject = "reventless-attachment-probe"
+
+/** A minimal `V1_0` pre-token-generation event.
+
+    Empty membership on purpose — with no groups and no stored role there is
+    nothing to narrow, so a healthy handler returns the event unchanged. The
+    probe is checking that the function *runs*, not what it decides; what it
+    decides has unit tests, and they do not need a deployed pool. */
+let probeEvent = (~userPoolId: string): JSON.t => {
+  let groupConfiguration = Dict.make()
+  groupConfiguration->Dict.set("groupsToOverride", JSON.Encode.array([]))
+  groupConfiguration->Dict.set("iamRolesToOverride", JSON.Encode.array([]))
+
+  let userAttributes = Dict.make()
+  userAttributes->Dict.set("sub", JSON.Encode.string(probeSubject))
+
+  let request = Dict.make()
+  request->Dict.set("userAttributes", JSON.Encode.object(userAttributes))
+  request->Dict.set("groupConfiguration", JSON.Encode.object(groupConfiguration))
+
+  let event = Dict.make()
+  event->Dict.set("version", JSON.Encode.string("1"))
+  event->Dict.set("triggerSource", JSON.Encode.string("TokenGeneration_Authentication"))
+  event->Dict.set("userPoolId", JSON.Encode.string(userPoolId))
+  event->Dict.set("userName", JSON.Encode.string(probeSubject))
+  event->Dict.set("request", JSON.Encode.object(request))
+  event->Dict.set("response", JSON.Encode.object(Dict.make()))
+  JSON.Encode.object(event)
+}
+
+/** What one probe invocation proved.
+
+    A variant rather than a bool so the two failures stay distinguishable: they
+    have different causes and want different sentences. */
+type probeVerdict =
+  | Healthy
+  | Crashed(string)
+  | NotAnEvent
+
+/** The verdict for a given invoke result.
+
+    Pure and total, so every branch is checkable without a deployed function —
+    the same reason [mergedUpdateInput] is. A payload that is not JSON at all
+    counts as not an event rather than throwing: the point here is to produce a
+    verdict, and a parse error escaping would fail the deploy with a message
+    about JSON instead of about the trigger. */
+let probeVerdict = (~functionError: option<string>, ~payload: string): probeVerdict =>
+  switch functionError {
+  | Some(kind) => Crashed(kind)
+  | None =>
+    // A trigger must hand the event back for Cognito to mint anything from. A
+    // function that returns 200 with something else shaped is as fatal as one
+    // that throws, and rather harder to notice.
+    let hasRequest = try {
+      payload
+      ->JSON.parseOrThrow
+      ->JSON.Decode.object
+      ->Option.flatMap(o => o->Dict.get("request"))
+      ->Option.isSome
+    } catch {
+    | _ => false
+    }
+    hasRequest ? Healthy : NotAnEvent
+  }
+
+/**
+ Invoke the trigger once and refuse to attach it if it cannot answer.
+
+ 🚨 **This is the check that keeps a broken trigger off a live pool.** Cognito
+ runs this function on every token it mints, and a function that throws fails the
+ sign-in — so a trigger that cannot start does not degrade the feature, it takes
+ authentication away from every user of the pool. Nothing downstream notices: the
+ deploy reports success, and the first report is a person unable to log in.
+
+ A trigger cannot make itself fail open. It dies at module load, before any
+ handler code runs, so no `try` inside the handler can catch it. The only place
+ that can refuse a broken function is the thing about to point a pool at it, and
+ that is here.
+
+ So: broken function → this throws → the deploy fails with the function's own
+ error → **the pool is never touched**. That is the same trade [readOnlyKeys]
+ already makes deliberately, where a loud failure beats a quiet reset.
+
+ Needs `lambda:InvokeFunction` on the deploying principal.
+ */
+let verifyTrigger = async (~userPoolId: string, ~preTokenGenerationArn: string): unit => {
+  let sdk = await getLambdaSdk()
+  let client = await getLambdaClient()
+
+  let input = Dict.make()
+  input->Dict.set("FunctionName", JSON.Encode.string(preTokenGenerationArn))
+  input->Dict.set("InvocationType", JSON.Encode.string("RequestResponse"))
+  input->Dict.set("Payload", JSON.Encode.string(probeEvent(~userPoolId)->JSON.stringify))
+
+  let result = await client->sendInvoke(newOf1(sdk.invokeCtor, input))
+  let payload = result.payload->Option.mapOr("", decodePayload)
+
+  // The payload carries the runtime's own error — module-resolution failures, a
+  // missing environment variable, an unhandled throw. Surfaced verbatim because
+  // it is the most useful sentence anyone debugging this will read.
+  switch probeVerdict(~functionError=result.functionError, ~payload) {
+  | Crashed(kind) =>
+    JsError.throwWithMessage(
+      `active-role trigger ${preTokenGenerationArn} failed its pre-attach check (${kind}) and was NOT attached to user pool ${userPoolId}. Attaching it would have failed every sign-in on that pool. The function reported: ${payload}`,
+    )
+  | NotAnEvent =>
+    JsError.throwWithMessage(
+      `active-role trigger ${preTokenGenerationArn} answered its pre-attach check with something that is not a pre-token-generation event, so it was NOT attached to user pool ${userPoolId}. Cognito would have failed every sign-in. It returned: ${payload}`,
+    )
+  | Healthy =>
+    log.info(
+      ~comp="Auth_ActiveRolePoolAttachment",
+      `trigger ${preTokenGenerationArn} answered the pre-attach check; attaching to ${userPoolId}`,
+    )
+  }
+}
+
 // ── Describe → merge → update ────────────────────────────────────────────────
 
 let describePool = async (~userPoolId: string): option<dict<JSON.t>> => {
@@ -200,11 +371,20 @@ let applyTrigger = async (~userPoolId: string, ~preTokenGenerationArn: option<st
 type providerInputs = {
   userPoolId: string,
   preTokenGenerationArn: string,
+  /** The deployed function's code hash.
+
+      Carried purely so a code change reaches this resource. The function ARN is
+      stable across deploys, so without this the attachment sees identical inputs
+      every time and never runs again — meaning [verifyTrigger] would prove the
+      function once, on the deploy that created it, and never for any version
+      shipped afterwards. A check that only ever runs once is not a check. */
+  codeHash: string,
 }
 
 type createOuts = {
   userPoolId: string,
   preTokenGenerationArn: string,
+  codeHash: string,
 }
 
 type createResult = {id: string, outs: createOuts}
@@ -213,22 +393,43 @@ type diffResult = {changes: bool, replaces: array<string>, deleteBeforeReplace:
 type readResult = {id?: string, props?: createOuts}
 
 let create = async (inputs: providerInputs): createResult => {
+  await verifyTrigger(
+    ~userPoolId=inputs.userPoolId,
+    ~preTokenGenerationArn=inputs.preTokenGenerationArn,
+  )
   await applyTrigger(
     ~userPoolId=inputs.userPoolId,
     ~preTokenGenerationArn=Some(inputs.preTokenGenerationArn),
   )
   {
     id: inputs.userPoolId,
-    outs: {userPoolId: inputs.userPoolId, preTokenGenerationArn: inputs.preTokenGenerationArn},
+    outs: {
+      userPoolId: inputs.userPoolId,
+      preTokenGenerationArn: inputs.preTokenGenerationArn,
+      codeHash: inputs.codeHash,
+    },
   }
 }
 
 let update = async (_id: string, _olds: createOuts, news: providerInputs): updateResult => {
+  // Re-proved on every update, not only on create: the usual reason this runs is
+  // that the function's code changed, which is exactly when it might have stopped
+  // working. The pool keeps the trigger it already has until this succeeds.
+  await verifyTrigger(
+    ~userPoolId=news.userPoolId,
+    ~preTokenGenerationArn=news.preTokenGenerationArn,
+  )
   await applyTrigger(
     ~userPoolId=news.userPoolId,
     ~preTokenGenerationArn=Some(news.preTokenGenerationArn),
   )
-  {outs: {userPoolId: news.userPoolId, preTokenGenerationArn: news.preTokenGenerationArn}}
+  {
+    outs: {
+      userPoolId: news.userPoolId,
+      preTokenGenerationArn: news.preTokenGenerationArn,
+      codeHash: news.codeHash,
+    },
+  }
 }
 
 /** Detaching on destroy is not optional. The Lambda is torn down with the rest
@@ -253,7 +454,9 @@ let delete_ = async (_id: string, props: createOuts): unit =>
 let diff_ = (_id: string, olds: createOuts, news: providerInputs): diffResult => {
   let poolChanged = olds.userPoolId != news.userPoolId
   {
-    changes: poolChanged || olds.preTokenGenerationArn != news.preTokenGenerationArn,
+    changes: poolChanged ||
+    olds.preTokenGenerationArn != news.preTokenGenerationArn ||
+    olds.codeHash != news.codeHash,
     replaces: poolChanged ? ["userPoolId"] : [],
     deleteBeforeReplace: true,
   }
@@ -271,6 +474,10 @@ let read_ = async (id: string, props: createOuts): readResult =>
         props: {
           userPoolId: props.userPoolId,
           preTokenGenerationArn: attachedTrigger(~described)->Option.getOr(""),
+          // The pool cannot report what code the function is running, so the
+          // recorded hash is carried through unchanged. Refresh answers "is the
+          // right function attached", which is what the pool actually knows.
+          codeHash: props.codeHash,
         },
       }
     }
@@ -295,6 +502,7 @@ type t = {id: Pulumi.Output.t<string>}
 type constructorProps = {
   userPoolId: Pulumi.Input.t<string>,
   preTokenGenerationArn: Pulumi.Input.t<string>,
+  codeHash: Pulumi.Input.t<string>,
 }
 
 // Explicit /index.js path because @pulumi/pulumi/dynamic is a directory import

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs

@@ -89,6 +89,41 @@ async function getClient() {
   return c$1;
 }
 
+let _lambdaSdk = {
+  contents: undefined
+};
+
+let _lambdaClient = {
+  contents: undefined
+};
+
+async function getLambdaSdk() {
+  let m = _lambdaSdk.contents;
+  if (m !== undefined) {
+    return m;
+  }
+  let m$1 = await import("@aws-sdk/client-lambda");
+  _lambdaSdk.contents = m$1;
+  return m$1;
+}
+
+async function getLambdaClient() {
+  let c = _lambdaClient.contents;
+  if (c !== undefined) {
+    return Primitive_option.valFromOption(c);
+  }
+  let sdk = await getLambdaSdk();
+  let c$1 = newOf0(sdk.LambdaClient);
+  _lambdaClient.contents = Primitive_option.some(c$1);
+  return c$1;
+}
+
+let decodePayload = ((p) => {
+  if (p == null) return "";
+  if (typeof p === "string") return p;
+  try { return new TextDecoder().decode(p); } catch { return String(p); }
+});
+
 function isPoolGoneError(jsErr) {
   let match = jsErr.name;
   let match$1 = Stdlib_JsExn.message(jsErr);
@@ -107,6 +142,68 @@ function isPoolGoneError(jsErr) {
   }
 }
 
+let probeSubject = "reventless-attachment-probe";
+
+function probeEvent(userPoolId) {
+  let groupConfiguration = {};
+  groupConfiguration["groupsToOverride"] = [];
+  groupConfiguration["iamRolesToOverride"] = [];
+  let userAttributes = {};
+  userAttributes["sub"] = probeSubject;
+  let request = {};
+  request["userAttributes"] = userAttributes;
+  request["groupConfiguration"] = groupConfiguration;
+  let event = {};
+  event["version"] = "1";
+  event["triggerSource"] = "TokenGeneration_Authentication";
+  event["userPoolId"] = userPoolId;
+  event["userName"] = probeSubject;
+  event["request"] = request;
+  event["response"] = {};
+  return event;
+}
+
+function probeVerdict(functionError, payload) {
+  if (functionError !== undefined) {
+    return {
+      TAG: "Crashed",
+      _0: functionError
+    };
+  }
+  let hasRequest;
+  try {
+    hasRequest = Stdlib_Option.isSome(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(JSON.parse(payload)), o => o["request"]));
+  } catch (exn) {
+    hasRequest = false;
+  }
+  if (hasRequest) {
+    return "Healthy";
+  } else {
+    return "NotAnEvent";
+  }
+}
+
+async function verifyTrigger(userPoolId, preTokenGenerationArn) {
+  let sdk = await getLambdaSdk();
+  let client = await getLambdaClient();
+  let input = {};
+  input["FunctionName"] = preTokenGenerationArn;
+  input["InvocationType"] = "RequestResponse";
+  input["Payload"] = JSON.stringify(probeEvent(userPoolId));
+  let result = await client.send(newOf1(sdk.InvokeCommand, input));
+  let payload = Stdlib_Option.mapOr(result.Payload, "", decodePayload);
+  let kind = probeVerdict(result.FunctionError, payload);
+  if (typeof kind !== "object") {
+    if (kind === "Healthy") {
+      return log.info("Auth_ActiveRolePoolAttachment", undefined, `trigger ` + preTokenGenerationArn + ` answered the pre-attach check; attaching to ` + userPoolId);
+    } else {
+      return Stdlib_JsError.throwWithMessage(`active-role trigger ` + preTokenGenerationArn + ` answered its pre-attach check with something that is not a pre-token-generation event, so it was NOT attached to user pool ` + userPoolId + `. Cognito would have failed every sign-in. It returned: ` + payload);
+    }
+  } else {
+    return Stdlib_JsError.throwWithMessage(`active-role trigger ` + preTokenGenerationArn + ` failed its pre-attach check (` + kind._0 + `) and was NOT attached to user pool ` + userPoolId + `. Attaching it would have failed every sign-in on that pool. The function reported: ` + payload);
+  }
+}
+
 async function describePool(userPoolId) {
   let sdk = await getSdk();
   let client = await getClient();
@@ -128,22 +225,26 @@ async function applyTrigger(userPoolId, preTokenGenerationArn) {
 }
 
 async function create(inputs) {
+  await verifyTrigger(inputs.userPoolId, inputs.preTokenGenerationArn);
   await applyTrigger(inputs.userPoolId, inputs.preTokenGenerationArn);
   return {
     id: inputs.userPoolId,
     outs: {
       userPoolId: inputs.userPoolId,
-      preTokenGenerationArn: inputs.preTokenGenerationArn
+      preTokenGenerationArn: inputs.preTokenGenerationArn,
+      codeHash: inputs.codeHash
     }
   };
 }
 
 async function update(_id, _olds, news) {
+  await verifyTrigger(news.userPoolId, news.preTokenGenerationArn);
   await applyTrigger(news.userPoolId, news.preTokenGenerationArn);
   return {
     outs: {
       userPoolId: news.userPoolId,
-      preTokenGenerationArn: news.preTokenGenerationArn
+      preTokenGenerationArn: news.preTokenGenerationArn,
+      codeHash: news.codeHash
     }
   };
 }
@@ -163,7 +264,7 @@ async function delete_(_id, props) {
 function diff_(_id, olds, news) {
   let poolChanged = olds.userPoolId !== news.userPoolId;
   return {
-    changes: poolChanged || olds.preTokenGenerationArn !== news.preTokenGenerationArn,
+    changes: poolChanged || olds.preTokenGenerationArn !== news.preTokenGenerationArn || olds.codeHash !== news.codeHash,
     replaces: poolChanged ? ["userPoolId"] : [],
     deleteBeforeReplace: true
   };
@@ -177,7 +278,8 @@ async function read_(id, props) {
         id: id,
         props: {
           userPoolId: props.userPoolId,
-          preTokenGenerationArn: Stdlib_Option.getOr(attachedTrigger(described), "")
+          preTokenGenerationArn: Stdlib_Option.getOr(attachedTrigger(described), ""),
+          codeHash: props.codeHash
         }
       };
     } else {
@@ -216,7 +318,16 @@ export {
   _client,
   getSdk,
   getClient,
+  _lambdaSdk,
+  _lambdaClient,
+  getLambdaSdk,
+  getLambdaClient,
+  decodePayload,
   isPoolGoneError,
+  probeSubject,
+  probeEvent,
+  probeVerdict,
+  verifyTrigger,
   describePool,
   applyTrigger,
   create,

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res

@@ -20,6 +20,11 @@ open PulumiAws
 type triggerOutputs = {
   functionArn: Pulumi.Output.t<string>,
   functionName: Pulumi.Output.t<string>,
+  /** The archive's hash, exposed so whoever attaches this trigger to a pool can
+      tell that the code changed. The function ARN does not move when the code
+      does, so without this an attachment sees identical inputs across deploys
+      and never re-checks a function it proved once. */
+  sourceCodeHash: string,
 }
 
 let make = (
@@ -150,7 +155,7 @@ let make = (
     ~opts,
   )
 
-  {functionArn: lambda.arn, functionName: lambda.name}
+  {functionArn: lambda.arn, functionName: lambda.name, sourceCodeHash}
 }
 
 /** Let Cognito invoke the trigger — scoped to one pool, so a function attached