@reventlessdev/reventless-aws 3.0.0-alpha.319 → 3.0.0-alpha.320

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs

@@ -59,6 +59,16 @@ function mergedUpdateInput(described, userPoolId, preTokenGenerationArn) {
   return out;
 }
 
+function attachedTriggerArn(described) {
+  let lambdaConfig = Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object);
+  let arn = Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfig, c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object), config => config["LambdaArn"]), Stdlib_JSON.Decode.string);
+  if (arn !== undefined) {
+    return arn;
+  } else {
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfig, c => c["PreTokenGeneration"]), Stdlib_JSON.Decode.string);
+  }
+}
+
 function attachedTrigger(described) {
   let lambdaConfig = Stdlib_Option.flatMap(described["LambdaConfig"], Stdlib_JSON.Decode.object);
   let config = Stdlib_Option.flatMap(Stdlib_Option.flatMap(lambdaConfig, c => c["PreTokenGenerationConfig"]), Stdlib_JSON.Decode.object);
@@ -73,6 +83,48 @@ function attachedTrigger(described) {
   }
 }
 
+function classifySlot(attachedArn, ourArn, ourStore, attachedStore) {
+  if (attachedArn !== undefined && attachedArn !== "") {
+    if (attachedArn === ourArn) {
+      return "Ours";
+    } else if (attachedStore !== undefined) {
+      if (attachedStore === ourStore) {
+        return {
+          TAG: "SharedWith",
+          _0: attachedArn
+        };
+      } else {
+        return {
+          TAG: "DifferentStore",
+          arn: attachedArn,
+          theirStore: attachedStore
+        };
+      }
+    } else {
+      return {
+        TAG: "Foreign",
+        _0: attachedArn
+      };
+    }
+  } else {
+    return "Vacant";
+  }
+}
+
+function refusalFor(slot, userPoolId, ourStore) {
+  if (typeof slot !== "object") {
+    return;
+  }
+  switch (slot.TAG) {
+    case "DifferentStore" :
+      return `user pool ` + userPoolId + ` already carries the active-role trigger ` + slot.arn + `, which reads "` + slot.theirStore + `" — but this deployment's Platform_SetActiveRole writes "` + ourStore + `". A pool holds one pre-token-generation trigger, so attaching would leave one of the two stacks writing rows nothing reads and every role switch silently doing nothing. Point both stacks at one store with platform:activeRoleStore, or give them separate user pools.`;
+    case "Foreign" :
+      return `user pool ` + userPoolId + ` already carries the pre-token-generation trigger ` + slot._0 + `, which is not an active-role trigger of this framework — attaching would silently replace it, and Cognito allows a pool only one. Detach it deliberately if it is obsolete, or give this deployment its own user pool. (If it *is* a Reventless trigger, this deployment could not read its configuration: the deploying principal needs lambda:GetFunctionConfiguration on it.)`;
+    default:
+      return;
+  }
+}
+
 let newOf1 = ((C, x) => new C(x));
 
 let newOf0 = ((C) => new C());
@@ -135,6 +187,19 @@ async function getLambdaClient() {
   return c$1;
 }
 
+async function activeRoleStoreOf(functionArn) {
+  try {
+    let sdk = await getLambdaSdk();
+    let client = await getLambdaClient();
+    let input = {};
+    input["FunctionName"] = functionArn;
+    let result = await client.send(newOf1(sdk.GetFunctionConfigurationCommand, input));
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(result.Environment, Stdlib_JSON.Decode.object), env => env["Variables"]), Stdlib_JSON.Decode.object), vars => vars["ACTIVE_ROLE_TABLE"]), Stdlib_JSON.Decode.string);
+  } catch (exn) {
+    return;
+  }
+}
+
 let decodePayload = ((p) => {
   if (p == null) return "";
   if (typeof p === "string") return p;
@@ -161,6 +226,8 @@ function isPoolGoneError(jsErr) {
 
 let probeSubject = "reventless-attachment-probe";
 
+let probeClientId = "reventless-attachment-probe-client";
+
 function probeEvent(userPoolId) {
   let groupConfiguration = {};
   groupConfiguration["groupsToOverride"] = [];
@@ -170,11 +237,14 @@ function probeEvent(userPoolId) {
   let request = {};
   request["userAttributes"] = userAttributes;
   request["groupConfiguration"] = groupConfiguration;
+  let callerContext = {};
+  callerContext["clientId"] = probeClientId;
   let event = {};
   event["version"] = "1";
   event["triggerSource"] = "TokenGeneration_Authentication";
   event["userPoolId"] = userPoolId;
   event["userName"] = probeSubject;
+  event["callerContext"] = callerContext;
   event["request"] = request;
   event["response"] = {};
   return event;
@@ -230,45 +300,77 @@ async function describePool(userPoolId) {
   return Stdlib_Option.flatMap(result.UserPool, Stdlib_JSON.Decode.object);
 }
 
-async function applyTrigger(userPoolId, preTokenGenerationArn) {
+async function sendMerged(described, userPoolId, preTokenGenerationArn) {
   let sdk = await getSdk();
   let client = await getClient();
+  let input = mergedUpdateInput(described, userPoolId, preTokenGenerationArn);
+  return await client.send(newOf1(sdk.UpdateUserPoolCommand, input));
+}
+
+function throwOnEmptyDescribe(userPoolId) {
+  return Stdlib_JsError.throwWithMessage(`DescribeUserPool returned no pool for "` + userPoolId + `"; refusing to send an UpdateUserPool that would reset it`);
+}
+
+async function attachTrigger(userPoolId, preTokenGenerationArn, activeRoleStore) {
   let described = await describePool(userPoolId);
   if (described === undefined) {
-    return Stdlib_JsError.throwWithMessage(`DescribeUserPool returned no pool for "` + userPoolId + `"; refusing to send an UpdateUserPool that would reset it`);
+    return throwOnEmptyDescribe(userPoolId);
   }
-  let input = mergedUpdateInput(described, userPoolId, preTokenGenerationArn);
-  return await client.send(newOf1(sdk.UpdateUserPoolCommand, input));
+  let attachedArn = attachedTriggerArn(described);
+  let attachedStore = attachedArn !== undefined && attachedArn !== preTokenGenerationArn && attachedArn !== "" ? await activeRoleStoreOf(attachedArn) : undefined;
+  let slot = classifySlot(attachedArn, preTokenGenerationArn, activeRoleStore, attachedStore);
+  let message = refusalFor(slot, userPoolId, activeRoleStore);
+  if (message !== undefined) {
+    Stdlib_JsError.throwWithMessage(message);
+  }
+  if (typeof slot === "object" && slot.TAG === "SharedWith") {
+    log.info("Auth_ActiveRolePoolAttachment", undefined, `user pool ` + userPoolId + ` carries active-role trigger ` + slot._0 + ` from another deployment, reading the same store "` + activeRoleStore + `" — taking the slot serves both`);
+  }
+  await verifyTrigger(userPoolId, preTokenGenerationArn);
+  return await sendMerged(described, userPoolId, preTokenGenerationArn);
 }
 
 async function create(inputs) {
-  await verifyTrigger(inputs.userPoolId, inputs.preTokenGenerationArn);
-  await applyTrigger(inputs.userPoolId, inputs.preTokenGenerationArn);
+  await attachTrigger(inputs.userPoolId, inputs.preTokenGenerationArn, inputs.activeRoleStore);
   return {
     id: inputs.userPoolId,
     outs: {
       userPoolId: inputs.userPoolId,
       preTokenGenerationArn: inputs.preTokenGenerationArn,
-      codeHash: inputs.codeHash
+      codeHash: inputs.codeHash,
+      activeRoleStore: inputs.activeRoleStore
     }
   };
 }
 
 async function update(_id, _olds, news) {
-  await verifyTrigger(news.userPoolId, news.preTokenGenerationArn);
-  await applyTrigger(news.userPoolId, news.preTokenGenerationArn);
+  await attachTrigger(news.userPoolId, news.preTokenGenerationArn, news.activeRoleStore);
   return {
     outs: {
       userPoolId: news.userPoolId,
       preTokenGenerationArn: news.preTokenGenerationArn,
-      codeHash: news.codeHash
+      codeHash: news.codeHash,
+      activeRoleStore: news.activeRoleStore
     }
   };
 }
 
 async function delete_(_id, props) {
   try {
-    return await applyTrigger(props.userPoolId, undefined);
+    let described = await describePool(props.userPoolId);
+    if (described === undefined) {
+      return throwOnEmptyDescribe(props.userPoolId);
+    }
+    let arn = attachedTriggerArn(described);
+    if (arn !== undefined) {
+      if (arn === props.preTokenGenerationArn) {
+        return await sendMerged(described, props.userPoolId, undefined);
+      } else {
+        return log.info("Auth_ActiveRolePoolAttachment", undefined, `user pool ` + props.userPoolId + ` carries ` + arn + `, not this deployment's trigger; leaving it attached`);
+      }
+    } else {
+      return;
+    }
   } catch (raw_exn) {
     let exn = Primitive_exceptions.internalToException(raw_exn);
     if (Stdlib_Option.mapOr(Stdlib_JsExn.fromException(exn), false, isPoolGoneError)) {
@@ -281,7 +383,7 @@ async function delete_(_id, props) {
 function diff_(_id, olds, news) {
   let poolChanged = olds.userPoolId !== news.userPoolId;
   return {
-    changes: poolChanged || olds.preTokenGenerationArn !== news.preTokenGenerationArn || olds.codeHash !== news.codeHash,
+    changes: poolChanged || olds.preTokenGenerationArn !== news.preTokenGenerationArn || olds.codeHash !== news.codeHash || olds.activeRoleStore !== news.activeRoleStore,
     replaces: poolChanged ? ["userPoolId"] : [],
     deleteBeforeReplace: true
   };
@@ -296,7 +398,8 @@ async function read_(id, props) {
         props: {
           userPoolId: props.userPoolId,
           preTokenGenerationArn: Stdlib_Option.getOr(attachedTrigger(described), ""),
-          codeHash: props.codeHash
+          codeHash: props.codeHash,
+          activeRoleStore: props.activeRoleStore
         }
       };
     } else {
@@ -329,7 +432,10 @@ export {
   readOnlyKeys,
   triggerVersion,
   mergedUpdateInput,
+  attachedTriggerArn,
   attachedTrigger,
+  classifySlot,
+  refusalFor,
   newOf1,
   newOf0,
   _sdk,
@@ -340,14 +446,18 @@ export {
   _lambdaClient,
   getLambdaSdk,
   getLambdaClient,
+  activeRoleStoreOf,
   decodePayload,
   isPoolGoneError,
   probeSubject,
+  probeClientId,
   probeEvent,
   probeVerdict,
   verifyTrigger,
   describePool,
-  applyTrigger,
+  sendMerged,
+  throwOnEmptyDescribe,
+  attachTrigger,
   create,
   update,
   delete_,

package/src/adapter/Auth/Auth_ActiveRoleStore.res

@@ -29,6 +29,18 @@
 //
 // Provisioning the table with the write door instead would close that chain into
 // a cycle, so the table is hoisted to where the pool is resolved.
+//
+// 🚨 **The rows follow the identity provider, not the stack** — see
+// [ReventlessCore.Auth_ActiveRole] for the contract and
+// [docs/plans/active-role-store-scoped-to-the-pool.md] for the defect that
+// produced it. A pool holds one pre-token-generation trigger, so two stacks
+// sharing a pool with a table each have the winning trigger reading rows the
+// serving resolver never wrote: every switch succeeds and does nothing.
+//
+// So there are two cases and no third. A stack that creates its own pool owns
+// everything attached to it, this table included. A stack handed an
+// `identityProviderId` owns none of it: the pool exists outside every stack, and
+// so does the store, at the name [derivedStoreName] gives. See [chooseStore].
 
 open PulumiAws
 
@@ -37,6 +49,31 @@ type storeTable = {
   arn: Pulumi.Output.t<string>,
 }
 
+/** Which store a deployment's trigger reads and its write door writes. */
+type storeChoice =
+  /** The stack creates and owns the table, because it also creates and owns the
+    pool: nothing else can be attached to that pool, so there is nothing to
+    share. */
+  | StackScoped
+  /** The provider's own store, looked up at [derivedStoreName] and never created.
+    Every stack on that provider resolves the same table. */
+  | ProviderScoped(string)
+
+/**
+The store a resolved provider calls for.
+
+Total and pure, so the rule is checkable without a stack — and total is the point:
+there is no configuration here that can be wrong, because there is no second key
+to disagree with the first. Whether the provider is ours decides the store, and
+nothing else is consulted.
+*/
+let chooseStore = (~identityProviderId: option<string>): storeChoice =>
+  switch identityProviderId {
+  | None => StackScoped
+  | Some(id) =>
+    ProviderScoped(Auth_ActiveRoleStore_Schema.derivedStoreName(~identityProviderId=id))
+  }
+
 // JS resolver code (APPSYNC_JS runtime): forward the caller's arguments and the
 // authorizer-verified identity. `sub` is what keys the row, and it comes from
 // here — the mutation has no `sub` argument for a client to supply.
@@ -49,14 +86,35 @@ type storeTable = {
 // how the membership read used to fail for every caller on such a pool. Both
 // fields come from the authorizer, so forwarding the second grants nothing the
 // first did not.
+//
+// 🚨 **`clientId` completes the row key, and it comes from the token's own
+// claims** — `aud` on an ID token, `client_id` on an access token, since AppSync
+// accepts either. It is what makes the active role per-platform on a provider
+// serving several. `aud` is a string on a Cognito ID token but an array in OIDC
+// generally, so the first element is taken rather than assuming.
+//
+// Forwarded as `null` when the claims are not there to read: the handler refuses
+// rather than inventing a key. A guessed client id would write a row under one
+// key that the trigger reads under another — the very defect this feature was
+// repaired for, rebuilt one level down.
 let invokeCode: Pulumi.Input.t<string> = `import { util } from '@aws-appsync/utils';
+function appClientId(id) {
+  const claims = id.claims;
+  if (claims == null) return null;
+  const aud = claims.aud;
+  const picked = Array.isArray(aud) ? aud[0] : aud;
+  const value = picked ?? claims.client_id;
+  return typeof value === 'string' && value !== '' ? value : null;
+}
 export function request(ctx) {
   const id = ctx.identity;
   return {
     operation: 'Invoke',
     payload: {
       arguments: ctx.args,
-      identity: id != null && id.sub != null ? { sub: id.sub, username: id.username ?? null } : null
+      identity: id != null && id.sub != null
+        ? { sub: id.sub, username: id.username ?? null, clientId: appClientId(id) }
+        : null
     }
   };
 }
@@ -66,16 +124,22 @@ export function response(ctx) {
 }
 `->Pulumi.Input.make
 
-/** One row per subject: `id` is the caller's Cognito `sub`, `activeRole` the
-  group they chose, `updatedAt` an operational breadcrumb. No sort key — a caller
-  acts as exactly one role at a time, so the row is the whole state. */
+/** One row per (subject, app client) — the key schema is
+  [Auth_ActiveRoleStore_Schema]'s, shared with both handlers and the provisioning
+  script — plus `activeRole`, the group they chose, and `updatedAt`, an
+  operational breadcrumb. A caller acts as exactly one role at a time *per
+  platform*, so the row is the whole state. */
 let makeTable = (
   ~name: string="ActiveRoleStore",
   ~opts: Pulumi.ComponentResource.options,
 ): storeTable => {
   let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
   let table = Util_DynamoDb.makeTable(
-    ~attributes=[{name: "id", type_: "S"}],
+    ~attributes=[
+      {name: Auth_ActiveRoleStore_Schema.partitionKey, type_: "S"},
+      {name: Auth_ActiveRoleStore_Schema.sortKey, type_: "S"},
+    ],
+    ~rangeKey=Auth_ActiveRoleStore_Schema.sortKey,
     ~tags=AWS.Tags.make(
       ~name=name ++ "Table",
       ~kind=ReventlessCore.ComponentType.Platform,
@@ -88,6 +152,30 @@ let makeTable = (
   {name: table.name, arn: table.arn}
 }
 
+/** The [ProviderScoped] table: looked up, never created.
+
+  Looked up for the same reason a BYO pool is — the operator owns the identity,
+  and these rows are part of that identity's state. Creating it here would put
+  every stack on the provider in a race to own one resource.
+
+  A name that resolves to nothing fails the deploy, which is the second half of
+  "the provider and its store must both exist". The failure names the table it
+  looked for, which is also the table the provisioning script creates. */
+let lookupTable = (~tableName: string): storeTable => {
+  let found = DynamoDb.Table.Get.output(~args={name: tableName})
+  {
+    name: found->Pulumi.Output.apply(t => t.name),
+    arn: found->Pulumi.Output.apply(t => t.arn),
+  }
+}
+
+/** The store a resolved provider calls for — created or looked up. */
+let resolveTable = (~choice: storeChoice, ~opts: Pulumi.ComponentResource.options): storeTable =>
+  switch choice {
+  | StackScoped => makeTable(~opts)
+  | ProviderScoped(tableName) => lookupTable(~tableName)
+  }
+
 /** The Lambda behind `Mutation.Platform_SetActiveRole` and its resolver: an
   execution role scoped to Logs + the one table + `AdminListGroupsForUser` on the
   one pool, an AppSync Lambda data source, and the resolver itself. */

package/src/adapter/Auth/Auth_ActiveRoleStore.res.mjs

@@ -14,15 +14,37 @@ import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/
 import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as AppSync_Resolver_Native$ReventlessAws from "../Api/AppSync_Resolver_Native.res.mjs";
+import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "./Auth_ActiveRoleStore_Schema.res.mjs";
+
+function chooseStore(identityProviderId) {
+  if (identityProviderId !== undefined) {
+    return {
+      TAG: "ProviderScoped",
+      _0: Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName(identityProviderId)
+    };
+  } else {
+    return "StackScoped";
+  }
+}
 
 let invokeCode = `import { util } from '@aws-appsync/utils';
+function appClientId(id) {
+  const claims = id.claims;
+  if (claims == null) return null;
+  const aud = claims.aud;
+  const picked = Array.isArray(aud) ? aud[0] : aud;
+  const value = picked ?? claims.client_id;
+  return typeof value === 'string' && value !== '' ? value : null;
+}
 export function request(ctx) {
   const id = ctx.identity;
   return {
     operation: 'Invoke',
     payload: {
       arguments: ctx.args,
-      identity: id != null && id.sub != null ? { sub: id.sub, username: id.username ?? null } : null
+      identity: id != null && id.sub != null
+        ? { sub: id.sub, username: id.username ?? null, clientId: appClientId(id) }
+        : null
     }
   };
 }
@@ -35,16 +57,40 @@ export function response(ctx) {
 function makeTable(nameOpt, opts) {
   let name = nameOpt !== undefined ? nameOpt : "ActiveRoleStore";
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
-  let table = Util_DynamoDb$ReventlessAws.makeTable([{
-      name: "id",
+  let table = Util_DynamoDb$ReventlessAws.makeTable([
+    {
+      name: Auth_ActiveRoleStore_Schema$ReventlessAws.partitionKey,
       type: "S"
-    }], undefined, undefined, undefined, AWS_Tags$ReventlessAws.make(name + "Table", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined), opts$1, name);
+    },
+    {
+      name: Auth_ActiveRoleStore_Schema$ReventlessAws.sortKey,
+      type: "S"
+    }
+  ], undefined, undefined, Auth_ActiveRoleStore_Schema$ReventlessAws.sortKey, AWS_Tags$ReventlessAws.make(name + "Table", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined), opts$1, name);
   return {
     name: table.name,
     arn: table.arn
   };
 }
 
+function lookupTable(tableName) {
+  let found = Aws.dynamodb.getTableOutput({
+    name: tableName
+  });
+  return {
+    name: found.apply(t => t.name),
+    arn: found.apply(t => t.arn)
+  };
+}
+
+function resolveTable(choice, opts) {
+  if (typeof choice !== "object") {
+    return makeTable(undefined, opts);
+  } else {
+    return lookupTable(choice._0);
+  }
+}
+
 function makeWriteDoor(api, table, cognitoUserPoolId, cognitoUserPoolArn, nameOpt, opts) {
   let name = nameOpt !== undefined ? nameOpt : "ActiveRoleStore";
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
@@ -156,8 +202,11 @@ function makeWriteDoor(api, table, cognitoUserPoolId, cognitoUserPoolArn, nameOp
 }
 
 export {
+  chooseStore,
   invokeCode,
   makeTable,
+  lookupTable,
+  resolveTable,
   makeWriteDoor,
 }
 /* @pulumi/aws Not a pure module */

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res

@@ -98,7 +98,13 @@ let mayActAs = (~membership: array<string>, ~requested: string): bool =>
 
 // ── AppSync resolver event / result shapes ──────────────────────────────────
 
-type identity = {sub?: string, username?: Nullable.t<string>}
+type identity = {
+  sub?: string,
+  username?: Nullable.t<string>,
+  /** The app client the caller's token was minted for — the second half of the
+    row key. `Null` when the resolver could not read it from the claims. */
+  clientId?: Nullable.t<string>,
+}
 type activeRoleArgs = {activeRole?: Nullable.t<string>}
 type appSyncEvent = {
   arguments?: activeRoleArgs,
@@ -125,6 +131,28 @@ let cognitoLookupName = (~identity: identity): option<string> =>
     }
   }
 
+/**
+The app client this row belongs to, completing the key alongside the subject.
+
+🚨 **No fallback, deliberately — this refuses instead of guessing.** Every other
+absent field in this handler has a defensible default; this one does not. The
+pre-token trigger keys its read on the client id Cognito hands it, so a write
+under any substitute — a constant, the subject, the empty string — is a row the
+trigger will never find: a switch that reports success and does nothing, which is
+the exact defect this store was repaired for. A caller told "we could not
+determine which application you are signed in to" has something to act on; a
+caller whose switch silently fails does not.
+
+Reachable when the authorizer omits `claims`, which happens on some APPSYNC_JS
+invocation shapes — see `Auth_Cognito.fromAppSyncIdentity`, which documents the
+same gap and falls back for fields where falling back is safe.
+*/
+let appClientId = (~identity: identity): option<string> =>
+  switch identity.clientId {
+  | Some(Value(id)) if id->String.trim != "" => Some(id)
+  | _ => None
+  }
+
 let result = (~activeRole: option<string>, ~availableRoles: array<string>): JSON.t =>
   Dict.fromArray([
     ("activeRole", activeRole->Option.mapOr(JSON.Null, JSON.Encode.string)),
@@ -146,6 +174,15 @@ let handler = async (event: appSyncEvent): JSON.t => {
   | Some(name) => name
   | None => JsError.throwWithMessage("unauthenticated")
   }
+  // Refused rather than defaulted — see `appClientId`. The row is keyed on the
+  // pair, and half a key is not a key.
+  let clientId = switch event.identity->Option.flatMap(i => appClientId(~identity=i)) {
+  | Some(id) => id
+  | None =>
+    JsError.throwWithMessage(
+      "Cannot determine which application this session belongs to, so the active role cannot be stored where the token minter will look for it",
+    )
+  }
   let table = tableName()
   let membership = await membershipOf(~username=lookupName, ~poolId=userPoolId())
 
@@ -159,7 +196,15 @@ let handler = async (event: appSyncEvent): JSON.t => {
 
   switch requested {
   | None =>
-    let _ = await DynamoDb_DocumentClient.deleteById(~tableName=table, ~id=sub)
+    // Clears this platform's preference only. A caller acting as a role in
+    // another platform on the same provider keeps it — which is the point of the
+    // pair key, and would be surprising if the clear were pool-wide.
+    let _ = await DynamoDb_DocumentClient.deleteByIdSort(
+      ~tableName=table,
+      ~id=sub,
+      ~sortField=Auth_ActiveRoleStore_Schema.sortKey,
+      ~sortKey=clientId,
+    )
     result(~activeRole=None, ~availableRoles=membership)
   | Some(role) =>
     // Refused, specifically — not ignored and stored anyway. A client asking for
@@ -170,8 +215,9 @@ let handler = async (event: appSyncEvent): JSON.t => {
     }
     let item =
       Dict.fromArray([
-        ("id", JSON.Encode.string(sub)),
-        ("activeRole", JSON.Encode.string(role)),
+        (Auth_ActiveRoleStore_Schema.partitionKey, JSON.Encode.string(sub)),
+        (Auth_ActiveRoleStore_Schema.sortKey, JSON.Encode.string(clientId)),
+        (Auth_ActiveRoleStore_Schema.roleAttribute, JSON.Encode.string(role)),
         ("updatedAt", JSON.Encode.string(Date.make()->Date.toISOString)),
       ])->JSON.Encode.object
     let _ = await DynamoDb_DocumentClient.PutCommand.make({

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs

@@ -7,6 +7,7 @@ import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
 import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
 import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
 import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "./Auth_ActiveRoleStore_Schema.res.mjs";
 
 function getEnv(k) {
   let v = process.env[k];
@@ -76,6 +77,19 @@ function cognitoLookupName(identity) {
   }
 }
 
+function appClientId(identity) {
+  let match = identity.clientId;
+  if (match === undefined) {
+    return;
+  }
+  let id = Primitive_option.valFromOption(match);
+  if ((id == null) || id.trim() === "") {
+    return;
+  } else {
+    return id;
+  }
+}
+
 function result(activeRole, availableRoles) {
   return Object.fromEntries([
     [
@@ -96,6 +110,8 @@ async function handler(event) {
   }
   let name = Stdlib_Option.flatMap(event.identity, cognitoLookupName);
   let lookupName = name !== undefined ? name : Stdlib_JsError.throwWithMessage("unauthenticated");
+  let id = Stdlib_Option.flatMap(event.identity, appClientId);
+  let clientId = id !== undefined ? id : Stdlib_JsError.throwWithMessage("Cannot determine which application this session belongs to, so the active role cannot be stored where the token minter will look for it");
   let table = tableName();
   let membership = await membershipOf(lookupName, userPoolId());
   let match = Stdlib_Option.flatMap(event.arguments, a => a.activeRole);
@@ -112,11 +128,15 @@ async function handler(event) {
     }
     let item = Object.fromEntries([
       [
-        "id",
+        Auth_ActiveRoleStore_Schema$ReventlessAws.partitionKey,
         sub
       ],
       [
-        "activeRole",
+        Auth_ActiveRoleStore_Schema$ReventlessAws.sortKey,
+        clientId
+      ],
+      [
+        Auth_ActiveRoleStore_Schema$ReventlessAws.roleAttribute,
         requested
       ],
       [
@@ -130,7 +150,7 @@ async function handler(event) {
     }));
     return result(requested, membership);
   }
-  await DynamoDb_DocumentClient$AwsSdk.deleteById(table, sub);
+  await DynamoDb_DocumentClient$AwsSdk.deleteByIdSort(table, sub, Auth_ActiveRoleStore_Schema$ReventlessAws.sortKey, clientId);
   return result(undefined, membership);
 }
 
@@ -141,6 +161,7 @@ export {
   membershipOf,
   mayActAs,
   cognitoLookupName,
+  appClientId,
   result,
   handler,
 }