@reventlessdev/reventless-aws 3.0.0-alpha.319 → 3.0.0-alpha.320

package/scripts/ProvisionIdentity.res.mjs

@@ -0,0 +1,376 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as ClientDynamodb from "@aws-sdk/client-dynamodb";
+import * as DynamoDb_DynamoDb$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DynamoDb.res.mjs";
+import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Schema.res.mjs";
+
+let defaultPoolName = "ReventlessIdentity";
+
+function parseArgs(argv) {
+  let acc = {
+    TAG: "Ok",
+    _0: {
+      poolName: defaultPoolName,
+      providerId: undefined,
+      help: false
+    }
+  };
+  let i = 0;
+  let count = argv.length;
+  while (i < count) {
+    let flag = argv[i];
+    let value = argv[i + 1 | 0];
+    let match = acc;
+    let exit = 0;
+    if (match.TAG === "Ok") {
+      let a = match._0;
+      let exit$1 = 0;
+      switch (flag) {
+        case "--name" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                poolName: value,
+                providerId: a.providerId,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
+        case "--provider-id" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                poolName: a.poolName,
+                providerId: value,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
+        case "--help" :
+        case "-h" :
+          exit$1 = 2;
+          break;
+        default:
+          acc = {
+            TAG: "Error",
+            _0: `unknown argument "` + flag + `"`
+          };
+      }
+      if (exit$1 === 2) {
+        acc = {
+          TAG: "Ok",
+          _0: {
+            poolName: a.poolName,
+            providerId: a.providerId,
+            help: true
+          }
+        };
+        i = i + 1 | 0;
+      }
+    } else {
+      i = count;
+    }
+    if (exit === 1) {
+      acc = {
+        TAG: "Error",
+        _0: flag + ` needs a value`
+      };
+    }
+  };
+  return acc;
+}
+
+let usage = `
+Provision a Reventless identity provider and its active-role store.
+
+  --name <name>          Pool name to create or adopt (default: ` + defaultPoolName + `)
+  --provider-id <id>     Use this existing pool instead of creating one; only the
+                         store is provisioned
+
+Creates nothing that a platform stack owns, and never attaches a trigger.
+Region and credentials come from the environment, as for any AWS SDK call.
+`;
+
+function poolSettings(poolName) {
+  return {
+    PoolName: poolName,
+    UsernameAttributes: ["email"],
+    MfaConfiguration: "OFF",
+    Policies: {
+      PasswordPolicy: {
+        MinimumLength: 12,
+        RequireLowercase: true,
+        RequireUppercase: true,
+        RequireNumbers: true
+      }
+    },
+    AdminCreateUserConfig: {
+      AllowAdminCreateUserOnly: true
+    }
+  };
+}
+
+async function findPoolByName(poolName) {
+  let nextToken;
+  let more = true;
+  let found = [];
+  while (more) {
+    let page = await CognitoIdentityServiceProvider$AwsSdk.ListUserPoolsCommand.send(new ClientCognitoIdentityProvider.ListUserPoolsCommand({
+      MaxResults: 60,
+      NextToken: nextToken
+    }));
+    Stdlib_Option.getOr(page.UserPools, []).forEach(p => {
+      let match = p.Name;
+      let match$1 = p.Id;
+      if (match !== undefined && match$1 !== undefined && match === poolName) {
+        found.push(match$1);
+        return;
+      }
+    });
+    let t = page.NextToken;
+    if (t !== undefined) {
+      nextToken = t;
+    } else {
+      more = false;
+    }
+  };
+  let len = found.length;
+  if (len !== 1) {
+    if (len !== 0) {
+      return {
+        TAG: "Error",
+        _0: found.length.toString() + ` user pools are named "` + poolName + `" (` + found.join(", ") + `). Pass --provider-id to say which one to use; this script will not guess.`
+      };
+    } else {
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    }
+  }
+  let only = found[0];
+  return {
+    TAG: "Ok",
+    _0: only
+  };
+}
+
+async function resolvePool(args) {
+  let id = args.providerId;
+  if (id !== undefined) {
+    await CognitoIdentityServiceProvider$AwsSdk.DescribeUserPoolCommand.send(new ClientCognitoIdentityProvider.DescribeUserPoolCommand({
+      UserPoolId: id
+    }));
+    console.log(`pool     ` + id + ` (given, unchanged)`);
+    return {
+      TAG: "Ok",
+      _0: id
+    };
+  }
+  let e = await findPoolByName(args.poolName);
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let existing = e._0;
+  if (existing !== undefined) {
+    console.log(`pool     ` + existing + ` (adopted, named "` + args.poolName + `")`);
+    return {
+      TAG: "Ok",
+      _0: existing
+    };
+  }
+  let created = await CognitoIdentityServiceProvider$AwsSdk.CreateUserPoolCommand.send(new ClientCognitoIdentityProvider.CreateUserPoolCommand(poolSettings(args.poolName)));
+  let id$1 = Stdlib_Option.flatMap(created.UserPool, p => p.Id);
+  if (id$1 !== undefined) {
+    console.log(`pool     ` + id$1 + ` (created, named "` + args.poolName + `")`);
+    return {
+      TAG: "Ok",
+      _0: id$1
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: "CreateUserPool returned no pool id"
+    };
+  }
+}
+
+let keySchema = [
+  {
+    AttributeName: Auth_ActiveRoleStore_Schema$ReventlessAws.partitionKey,
+    KeyType: "HASH"
+  },
+  {
+    AttributeName: Auth_ActiveRoleStore_Schema$ReventlessAws.sortKey,
+    KeyType: "RANGE"
+  }
+];
+
+function asPairs(elements) {
+  return elements.map(k => [
+    k.AttributeName,
+    k.KeyType
+  ]);
+}
+
+async function describeTable(tableName) {
+  try {
+    return (await DynamoDb_DynamoDb$AwsSdk.DescribeTableCommand.send(new ClientDynamodb.DescribeTableCommand({
+      TableName: tableName
+    }))).Table;
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.isNotFound(exn)) {
+      return;
+    }
+    throw exn;
+  }
+}
+
+async function provisionStore(tableName) {
+  let described = await describeTable(tableName);
+  if (described !== undefined) {
+    let message = Auth_ActiveRoleStore_Schema$ReventlessAws.keySchemaRefusal(tableName, asPairs(Stdlib_Option.getOr(described.KeySchema, [])));
+    if (message !== undefined) {
+      return {
+        TAG: "Error",
+        _0: message
+      };
+    } else {
+      console.log(`store    ` + tableName + ` (adopted)`);
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    }
+  }
+  await DynamoDb_DynamoDb$AwsSdk.CreateTableCommand.send(new ClientDynamodb.CreateTableCommand({
+    TableName: tableName,
+    KeySchema: keySchema,
+    AttributeDefinitions: [
+      {
+        AttributeName: Auth_ActiveRoleStore_Schema$ReventlessAws.partitionKey,
+        AttributeType: "S"
+      },
+      {
+        AttributeName: Auth_ActiveRoleStore_Schema$ReventlessAws.sortKey,
+        AttributeType: "S"
+      }
+    ],
+    BillingMode: "PAY_PER_REQUEST"
+  }));
+  let waited = await DynamoDb_DynamoDb$AwsSdk.TableExistsWaiter.wait(tableName, undefined);
+  if (DynamoDb_DynamoDb$AwsSdk.TableExistsWaiter.succeeded(waited)) {
+    await DynamoDb_DynamoDb$AwsSdk.UpdateContinuousBackupsCommand.send(new ClientDynamodb.UpdateContinuousBackupsCommand({
+      TableName: tableName,
+      PointInTimeRecoverySpecification: {
+        PointInTimeRecoveryEnabled: true
+      }
+    }));
+    console.log(`store    ` + tableName + ` (created)`);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `table "` + tableName + `" was created but did not become ACTIVE (` + waited.state + `). Re-run this script — it adopts what is already there.`
+    };
+  }
+}
+
+function nextSteps(providerId) {
+  return `
+Configure each platform stack that should use this provider:
+
+  pulumi config set platform:identityProviderId ` + providerId + `
+
+or set REVENTLESS_IDENTITY_PROVIDER_ID in CI. Every stack on this provider
+derives the same store, so there is nothing else to configure.
+
+The pre-token-generation trigger is attached by the deploy, not by this script.
+Users and groups are yours to create.`;
+}
+
+async function run() {
+  let e = parseArgs(process.argv.slice(2, process.argv.length));
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let args = e._0;
+  if (args.help) {
+    console.log(usage);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  }
+  let e$1 = await resolvePool(args);
+  if (e$1.TAG !== "Ok") {
+    return e$1;
+  }
+  let providerId = e$1._0;
+  let tableName = Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName(providerId);
+  let e$2 = await provisionStore(tableName);
+  if (e$2.TAG !== "Ok") {
+    return e$2;
+  }
+  console.log(nextSteps(providerId));
+  return {
+    TAG: "Ok",
+    _0: undefined
+  };
+}
+
+async function main() {
+  let message;
+  try {
+    message = await run();
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    console.error(`provision-identity: ` + Util_AwsError$ReventlessAws.describe(exn));
+    process.exit(1);
+    return;
+  }
+  if (message.TAG === "Ok") {
+    return;
+  }
+  console.error(`provision-identity: ` + message._0);
+  process.exit(1);
+}
+
+let Schema;
+
+export {
+  Schema,
+  defaultPoolName,
+  parseArgs,
+  usage,
+  poolSettings,
+  findPoolByName,
+  resolvePool,
+  keySchema,
+  asPairs,
+  describeTable,
+  provisionStore,
+  nextSteps,
+  run,
+  main,
+}
+/* @aws-sdk/client-dynamodb Not a pure module */

package/src/Platform.res

@@ -309,36 +309,57 @@ module MakeWithConfig = (
     //
     // In ESM mode, Pulumi exports are inside the "default" output.
     // Try top-level field first (CJS), fall back to "default".<field> (ESM).
+    // Read under both spellings: this plugin stack may be deploying against a
+    // platform older than the rename, or newer than a pinned plugin. Neither
+    // direction is the ordinary case, and neither should fail.
     let defaultOutput: Pulumi.Output.t<option<JSON.t>> =
       stackRef->Pulumi.StackReference.getOutput("default")
+    let providerIdOutput: Pulumi.Output.t<option<string>> =
+      stackRef->Pulumi.StackReference.getOutput("identityProviderId")
+    let providerRegionOutput: Pulumi.Output.t<option<string>> =
+      stackRef->Pulumi.StackReference.getOutput("identityProviderRegion")
     let cognitoPoolIdOutput: Pulumi.Output.t<option<string>> =
       stackRef->Pulumi.StackReference.getOutput("cognitoUserPoolId")
     let cognitoRegionOutput: Pulumi.Output.t<option<string>> =
       stackRef->Pulumi.StackReference.getOutput("cognitoRegion")
     let userPoolConfig =
-      (cognitoPoolIdOutput, cognitoRegionOutput, defaultOutput)
+      (
+        (providerIdOutput, providerRegionOutput)->Pulumi.Output.all2,
+        (cognitoPoolIdOutput, cognitoRegionOutput)->Pulumi.Output.all2,
+        defaultOutput,
+      )
       ->Pulumi.Output.all3
-      ->Pulumi.Output.apply(((directPoolId, directRegion, default)) => {
-        let getFromDefault = key =>
-          default
-          ->Option.flatMap(d => d->JSON.Decode.object)
-          ->Option.flatMap(d => d->Dict.get(key))
-          ->Option.flatMap(v => v->JSON.Decode.string)
-        let userPoolId =
-          directPoolId
-          ->Option.orElse(getFromDefault("cognitoUserPoolId"))
-          ->Option.getOrThrow(
-            ~message="Platform stack does not export 'cognitoUserPoolId' — redeploy the platform stack first",
+      ->Pulumi.Output.apply(
+        (((directProviderId, directProviderRegion), (directPoolId, directRegion), default)) => {
+          let getFromDefault = key =>
+            default
+            ->Option.flatMap(d => d->JSON.Decode.object)
+            ->Option.flatMap(d => d->Dict.get(key))
+            ->Option.flatMap(v => v->JSON.Decode.string)
+          // New spelling first at both levels, then the deprecated one. In ESM
+          // mode exports arrive nested under "default", hence each pair.
+          let userPoolId =
+            directProviderId
+            ->Option.orElse(getFromDefault("identityProviderId"))
+            ->Option.orElse(directPoolId)
+            ->Option.orElse(getFromDefault("cognitoUserPoolId"))
+            ->Option.getOrThrow(
+              ~message="Platform stack exports neither 'identityProviderId' nor 'cognitoUserPoolId' — redeploy the platform stack first",
+            )
+          let awsRegion =
+            directProviderRegion
+            ->Option.orElse(getFromDefault("identityProviderRegion"))
+            ->Option.orElse(directRegion)
+            ->Option.orElse(getFromDefault("cognitoRegion"))
+          (
+            {
+              userPoolId,
+              ?awsRegion,
+              defaultAction: PulumiAws.AppSync.GraphQLApi.ALLOW,
+            }: PulumiAws.AppSync.GraphQLApi.userPoolConfig
           )
-        let awsRegion = directRegion->Option.orElse(getFromDefault("cognitoRegion"))
-        (
-          {
-            userPoolId,
-            ?awsRegion,
-            defaultAction: PulumiAws.AppSync.GraphQLApi.ALLOW,
-          }: PulumiAws.AppSync.GraphQLApi.userPoolConfig
-        )
-      })
+        },
+      )
     let (api, role) = AppSync_Adapter.makePluginSourceApiResource(
       ~name="PluginSourceApi",
       ~userPoolConfig,
@@ -2137,15 +2158,18 @@ module MakeWithConfig = (
         )
         ->Pulumi.Output.all2
         ->Pulumi.Output.apply((((domainEp, platformEp, poolId, clientId), eventsEpOpt)) => {
-          let computed = [
-            ("apiEndpoint", JSON.Encode.string(domainEp)),
-            ("platformApiEndpoint", JSON.Encode.string(platformEp)),
-            ("region", JSON.Encode.string(regionStr)),
-            ("authMode", JSON.Encode.string("cognito")),
-            ("cognitoUserPoolId", JSON.Encode.string(poolId)),
-            ("cognitoClientId", JSON.Encode.string(clientId)),
-            ("liveUpdates", JSON.Encode.bool(true)),
-          ]
+          // `authMode` stays `"cognito"`: it is a value naming which provider
+          // authenticates this deployment, and that is true. The identity *keys*
+          // travel under both spellings — see [Util_ShellConfig.identityFields].
+          let computed =
+            [
+              ("apiEndpoint", JSON.Encode.string(domainEp)),
+              ("platformApiEndpoint", JSON.Encode.string(platformEp)),
+              ("region", JSON.Encode.string(regionStr)),
+              ("authMode", JSON.Encode.string("cognito")),
+            ]
+            ->Array.concat(Util_ShellConfig.identityFields(~providerId=poolId, ~clientId))
+            ->Array.concat([("liveUpdates", JSON.Encode.bool(true))])
           let withEvents = switch eventsEpOpt {
           | Some(ep) =>
             Array.concat(

package/src/Platform.res.mjs

@@ -207,17 +207,27 @@ function MakeWithConfig(Config) {
   if (platformStackRef !== undefined) {
     let stackRef = Primitive_option.valFromOption(platformStackRef);
     let defaultOutput = stackRef.getOutput("default");
+    let providerIdOutput = stackRef.getOutput("identityProviderId");
+    let providerRegionOutput = stackRef.getOutput("identityProviderRegion");
     let cognitoPoolIdOutput = stackRef.getOutput("cognitoUserPoolId");
     let cognitoRegionOutput = stackRef.getOutput("cognitoRegion");
     let userPoolConfig = Pulumi.all([
-      cognitoPoolIdOutput,
-      cognitoRegionOutput,
+      Pulumi.all([
+        providerIdOutput,
+        providerRegionOutput
+      ]),
+      Pulumi.all([
+        cognitoPoolIdOutput,
+        cognitoRegionOutput
+      ]),
       defaultOutput
     ]).apply(param => {
       let $$default = param[2];
+      let match = param[1];
+      let match$1 = param[0];
       let getFromDefault = key => Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap($$default, d => Stdlib_JSON.Decode.object(d)), d => d[key]), v => Stdlib_JSON.Decode.string(v));
-      let userPoolId = Stdlib_Option.getOrThrow(Stdlib_Option.orElse(param[0], getFromDefault("cognitoUserPoolId")), "Platform stack does not export 'cognitoUserPoolId' — redeploy the platform stack first");
-      let awsRegion = Stdlib_Option.orElse(param[1], getFromDefault("cognitoRegion"));
+      let userPoolId = Stdlib_Option.getOrThrow(Stdlib_Option.orElse(Stdlib_Option.orElse(Stdlib_Option.orElse(match$1[0], getFromDefault("identityProviderId")), match[0]), getFromDefault("cognitoUserPoolId")), "Platform stack exports neither 'identityProviderId' nor 'cognitoUserPoolId' — redeploy the platform stack first");
+      let awsRegion = Stdlib_Option.orElse(Stdlib_Option.orElse(Stdlib_Option.orElse(match$1[1], getFromDefault("identityProviderRegion")), match[1]), getFromDefault("cognitoRegion"));
       return {
         userPoolId: userPoolId,
         defaultAction: "ALLOW",
@@ -1162,20 +1172,11 @@ function MakeWithConfig(Config) {
           [
             "authMode",
             "cognito"
-          ],
-          [
-            "cognitoUserPoolId",
-            match[2]
-          ],
-          [
-            "cognitoClientId",
-            match[3]
-          ],
-          [
+          ]
+        ].concat(Util_ShellConfig$ReventlessAws.identityFields(match[2], match[3])).concat([[
             "liveUpdates",
             true
-          ]
-        ];
+          ]]);
         let withEvents = eventsEpOpt !== undefined ? computed.concat([
             [
               "domainApiEventsEndpoint",
@@ -1520,17 +1521,27 @@ function Make($star) {
   if (platformStackRef !== undefined) {
     let stackRef = Primitive_option.valFromOption(platformStackRef);
     let defaultOutput = stackRef.getOutput("default");
+    let providerIdOutput = stackRef.getOutput("identityProviderId");
+    let providerRegionOutput = stackRef.getOutput("identityProviderRegion");
     let cognitoPoolIdOutput = stackRef.getOutput("cognitoUserPoolId");
     let cognitoRegionOutput = stackRef.getOutput("cognitoRegion");
     let userPoolConfig = Pulumi.all([
-      cognitoPoolIdOutput,
-      cognitoRegionOutput,
+      Pulumi.all([
+        providerIdOutput,
+        providerRegionOutput
+      ]),
+      Pulumi.all([
+        cognitoPoolIdOutput,
+        cognitoRegionOutput
+      ]),
       defaultOutput
     ]).apply(param => {
       let $$default = param[2];
+      let match = param[1];
+      let match$1 = param[0];
       let getFromDefault = key => Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap($$default, d => Stdlib_JSON.Decode.object(d)), d => d[key]), v => Stdlib_JSON.Decode.string(v));
-      let userPoolId = Stdlib_Option.getOrThrow(Stdlib_Option.orElse(param[0], getFromDefault("cognitoUserPoolId")), "Platform stack does not export 'cognitoUserPoolId' — redeploy the platform stack first");
-      let awsRegion = Stdlib_Option.orElse(param[1], getFromDefault("cognitoRegion"));
+      let userPoolId = Stdlib_Option.getOrThrow(Stdlib_Option.orElse(Stdlib_Option.orElse(Stdlib_Option.orElse(match$1[0], getFromDefault("identityProviderId")), match[0]), getFromDefault("cognitoUserPoolId")), "Platform stack exports neither 'identityProviderId' nor 'cognitoUserPoolId' — redeploy the platform stack first");
+      let awsRegion = Stdlib_Option.orElse(Stdlib_Option.orElse(Stdlib_Option.orElse(match$1[1], getFromDefault("identityProviderRegion")), match[1]), getFromDefault("cognitoRegion"));
       return {
         userPoolId: userPoolId,
         defaultAction: "ALLOW",
@@ -2452,20 +2463,11 @@ function Make($star) {
           [
             "authMode",
             "cognito"
-          ],
-          [
-            "cognitoUserPoolId",
-            match[2]
-          ],
-          [
-            "cognitoClientId",
-            match[3]
-          ],
-          [
+          ]
+        ].concat(Util_ShellConfig$ReventlessAws.identityFields(match[2], match[3])).concat([[
             "liveUpdates",
             true
-          ]
-        ];
+          ]]);
         let withEvents = eventsEpOpt !== undefined ? computed.concat([
             [
               "domainApiEventsEndpoint",