@reventlessdev/reventless-aws 3.0.0-alpha.319 → 3.0.0-alpha.321

package/src/Platform_Stack.res

@@ -17,39 +17,78 @@ type cognitoUserPool = {
 /**
  * Resolve the Cognito UserPool used by AppSync auth. Two modes:
  *
- * - **Auto**: no `platform:cognitoUserPoolId` config — create a fresh UserPool
+ * - **Auto**: no `platform:identityProviderId` config — create a fresh UserPool
  *   with SPA-friendly defaults (email username, 12-char password policy, no
  *   MFA, admin-only user creation). Caller is responsible for creating
  *   groups (`Admin`, `User`, …) and users via the AWS console / CLI.
  *
- * - **BYO**: pool ID provided — skip pool creation, look up the existing
+ * - **BYO**: provider ID provided — skip pool creation, look up the existing
  *   pool via `aws.cognito.getUserPool` for its ARN. Lookup precedence
  *   (highest → lowest):
- *     1. `REVENTLESS_COGNITO_USER_POOL_ID` env var (typically a CI secret).
- *     2. `Pulumi.local.yaml` sidecar key `cognitoUserPoolId` (gitignored;
+ *     1. `REVENTLESS_IDENTITY_PROVIDER_ID` env var (typically a CI secret).
+ *     2. `Pulumi.local.yaml` sidecar key `identityProviderId` (gitignored;
  *        per-dev override).
- *     3. `platform:cognitoUserPoolId` in the checked-in `Pulumi.<stack>.yaml`.
+ *     3. `platform:identityProviderId` in the checked-in `Pulumi.<stack>.yaml`.
+ *
+ *   The former `cognitoUserPoolId` spelling is still read at every level, and
+ *   warns — see `_deprecatedPoolIdKey` for why dropping it is its own act.
  *
  * In both modes the framework owns the `UserPoolClient` (SPA settings would
  * not reliably exist on a pre-existing client; the client is a child resource
  * Pulumi can destroy without touching the parent pool).
  *
- * Always exports `cognitoUserPoolId`, `cognitoUserPoolClientId`,
- * `cognitoUserPoolArn`, `cognitoRegion`, and `cognitoUserPoolManaged` as
- * stack outputs so downstream stacks (and Stage D AppSync wiring) can read
- * them via `StackReference`.
+ * Always exports `identityProviderId`, `identityProviderClientId`,
+ * `identityProviderArn`, `identityProviderRegion`, `identityProviderManaged` and
+ * `activeRoleStore` as stack outputs so downstream stacks (and Stage D AppSync
+ * wiring) can read them via `StackReference` — plus, for one release, the
+ * deprecated `cognito*` spellings of the first five.
  *
  * Also provisions the role-state table and the pre-token-generation trigger that
  * narrows `cognito:groups` to a caller's chosen role. They belong here rather
  * than beside the mutation that writes the table because the pool must be
  * declared carrying the trigger's ARN — see the ordering note below.
+ *
+ * In BYO mode the store follows the provider rather than the stack: its name is
+ * derived from the provider id, it is looked up rather than created, and it is
+ * provisioned outside every stack alongside the pool. Either lookup finding
+ * nothing fails the deploy — the provider and its store exist together or not
+ * at all.
  */
-let _resolveUncached = (): cognitoUserPool => {
-  let cfg = Pulumi.Config.make(Some("platform"))
-  let existingPoolId = switch Util_LocalConfig.get("cognitoUserPoolId") {
+let log = ReventlessCore.Logger.fromEnv()
+
+/** The key that was `cognitoUserPoolId` before the concept was named for what it
+  is rather than for the service implementing it.
+
+  🚨 **Still read, and it must stay read until every caller has moved.** An absent
+  provider id is not an error here — it is auto mode, and auto mode *creates a
+  user pool*. So a caller left on the old key after this stopped reading it would
+  not fail: it would deploy green, mint a fresh pool, and orphan every account in
+  the old one. Dropping this fallback is a separate act, done once the callers are
+  known to have moved, not a tidy-up. */
+let _deprecatedPoolIdKey = "cognitoUserPoolId"
+
+let _identityProviderId = (~cfg: Pulumi.Config.t): option<string> => {
+  let read = key =>
+    switch Util_LocalConfig.get(key) {
+    | Some(_) as v => v
+    | None => cfg->Pulumi.Config.get(key)
+    }
+  switch read("identityProviderId") {
   | Some(_) as v => v
-  | None => cfg->Pulumi.Config.get("cognitoUserPoolId")
+  | None =>
+    read(_deprecatedPoolIdKey)->Option.map(id => {
+      log.warn(
+        ~comp="Platform_Stack",
+        `platform:${_deprecatedPoolIdKey} (REVENTLESS_COGNITO_USER_POOL_ID) is deprecated — rename it to platform:identityProviderId (REVENTLESS_IDENTITY_PROVIDER_ID). Still honoured, because dropping it silently would deploy in auto mode and create a NEW user pool.`,
+      )
+      id
+    })
   }
+}
+
+let _resolveUncached = (): cognitoUserPool => {
+  let cfg = Pulumi.Config.make(Some("platform"))
+  let existingPoolId = _identityProviderId(~cfg)
 
   // Provisioned ahead of the pool in both pool modes: the pre-token-generation
   // trigger reads these rows, and in auto mode the pool is declared carrying the
@@ -71,7 +110,19 @@ let _resolveUncached = (): cognitoUserPool => {
   // Saving one GetItem in a legacy mode is not worth a switch whose failure mode
   // is a feature that quietly is not there. If the cost ever matters, the fix is
   // a design that does not hinge on call order — not this parameter again.
-  let activeRoleTable = Auth_ActiveRoleStore.makeTable(~opts={})
+  //
+  // 🚨 **On a provider we do not own, the rows do not belong to this stack.** A
+  // pool holds one pre-token-generation trigger, so two stacks sharing a pool with
+  // a table each have the winning trigger reading rows the serving resolver never
+  // wrote — every role switch succeeds and does nothing. So the store follows the
+  // provider: named by derivation from the provider id, looked up rather than
+  // created, and provisioned outside every stack alongside the pool itself. See
+  // [Auth_ActiveRoleStore.chooseStore] and
+  // [docs/plans/active-role-store-scoped-to-the-pool.md].
+  let activeRoleTable = Auth_ActiveRoleStore.resolveTable(
+    ~choice=Auth_ActiveRoleStore.chooseStore(~identityProviderId=existingPoolId),
+    ~opts={},
+  )
   let activeRoleTrigger = Auth_ActiveRoleTrigger.make(
     ~activeRoleTableName=activeRoleTable.name->Pulumi.Output.asInput,
     ~activeRoleTableArn=activeRoleTable.arn->Pulumi.Output.asInput,
@@ -112,11 +163,16 @@ let _resolveUncached = (): cognitoUserPool => {
     // The code hash is an input so a new build of the trigger reaches this
     // resource: the function ARN is stable, so it alone would let a broken
     // version onto the pool unchecked after the first deploy.
+    //
+    // The store travels with it because the pool has one trigger slot: the
+    // resource compares this against the store read by whatever already holds the
+    // slot, and refuses rather than taking it from a trigger that disagrees.
     let _attachment = Auth_ActiveRolePoolAttachment.make(
       ~props={
         userPoolId: Pulumi.Input.make(poolId),
         preTokenGenerationArn: activeRoleTrigger.functionArn->Pulumi.Output.asInput,
         codeHash: Pulumi.Input.make(activeRoleTrigger.sourceCodeHash),
+        activeRoleStore: activeRoleTable.name->Pulumi.Output.asInput,
       },
       ~opts={},
     )
@@ -205,14 +261,41 @@ let _resolveUncached = (): cognitoUserPool => {
   let regionStr =
     Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->Option.getOr("unknown")
 
+  // 🚨 **Both spellings, deliberately, and for one release only.**
+  //
+  // The `cognito*` names are what every consumer reads today; the
+  // `identityProvider*` names are what they are becoming, for the reason the
+  // config key changed — the concept is not AWS-specific. A stack that exported
+  // only the new ones would break any plugin stack pinned to an older
+  // `reventless-aws`, which reads the old names through `StackReference`.
+  //
+  // Exporting both costs nothing and removes the ordering problem entirely
+  // rather than managing it: every consumer, old or new, finds a name it knows.
+  // The old set goes in a later release, once no pinned consumer reads them.
+  //
+  // `Arn` survives the rename on purpose — the value *is* an ARN, and `urn` in a
+  // Pulumi codebase already means the Pulumi URN every resource carries. See
+  // [docs/plans/active-role-store-scoped-to-the-pool.md] step 7.
+  let managedStr = Pulumi.Output.make(result.managed ? "true" : "false")
+  let regionOutput = Pulumi.Output.make(regionStr)
+
+  Pulumi.Pulumi.export("identityProviderId", result.poolId)
+  Pulumi.Pulumi.export("identityProviderClientId", result.clientId)
+  Pulumi.Pulumi.export("identityProviderArn", result.poolArn)
+  Pulumi.Pulumi.export("identityProviderRegion", regionOutput)
+  Pulumi.Pulumi.export("identityProviderManaged", managedStr)
+
+  // Deprecated spellings — see above.
   Pulumi.Pulumi.export("cognitoUserPoolId", result.poolId)
   Pulumi.Pulumi.export("cognitoUserPoolClientId", result.clientId)
   Pulumi.Pulumi.export("cognitoUserPoolArn", result.poolArn)
-  Pulumi.Pulumi.export("cognitoRegion", Pulumi.Output.make(regionStr))
-  Pulumi.Pulumi.export(
-    "cognitoUserPoolManaged",
-    Pulumi.Output.make(result.managed ? "true" : "false"),
-  )
+  Pulumi.Pulumi.export("cognitoRegion", regionOutput)
+  Pulumi.Pulumi.export("cognitoUserPoolManaged", managedStr)
+
+  // Exported so an operator can read back the store this provider resolved to —
+  // the name is derived, not configured, so this is a convenience for checking
+  // rather than a value anything is meant to copy into a config.
+  Pulumi.Pulumi.export("activeRoleStore", result.activeRoleTable.name)
 
   result
 }

package/src/Platform_Stack.res.mjs

@@ -4,17 +4,41 @@ import * as Aws from "@pulumi/aws";
 import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
 import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
 import * as Auth_ActiveRoleTrigger$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleTrigger.res.mjs";
 import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "./adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
 
+let log = Logger$ReventlessCore.fromEnv();
+
+let _deprecatedPoolIdKey = "cognitoUserPoolId";
+
+function _identityProviderId(cfg) {
+  let read = key => {
+    let v = Util_LocalConfig$ReventlessAws.get(key);
+    if (v !== undefined) {
+      return v;
+    } else {
+      return cfg.get(key);
+    }
+  };
+  let v = read("identityProviderId");
+  if (v !== undefined) {
+    return v;
+  } else {
+    return Stdlib_Option.map(read(_deprecatedPoolIdKey), id => {
+      log.warn("Platform_Stack", undefined, `platform:` + _deprecatedPoolIdKey + ` (REVENTLESS_COGNITO_USER_POOL_ID) is deprecated — rename it to platform:identityProviderId (REVENTLESS_IDENTITY_PROVIDER_ID). Still honoured, because dropping it silently would deploy in auto mode and create a NEW user pool.`);
+      return id;
+    });
+  }
+}
+
 function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
-  let v = Util_LocalConfig$ReventlessAws.get("cognitoUserPoolId");
-  let existingPoolId = v !== undefined ? v : cfg.get("cognitoUserPoolId");
-  let activeRoleTable = Auth_ActiveRoleStore$ReventlessAws.makeTable(undefined, {});
+  let existingPoolId = _identityProviderId(cfg);
+  let activeRoleTable = Auth_ActiveRoleStore$ReventlessAws.resolveTable(Auth_ActiveRoleStore$ReventlessAws.chooseStore(existingPoolId), {});
   let activeRoleTrigger = Auth_ActiveRoleTrigger$ReventlessAws.make(activeRoleTable.name, activeRoleTable.arn, undefined, {});
   let result;
   if (existingPoolId !== undefined) {
@@ -45,7 +69,8 @@ function _resolveUncached() {
     Auth_ActiveRolePoolAttachment$ReventlessAws.make(undefined, {
       userPoolId: existingPoolId,
       preTokenGenerationArn: activeRoleTrigger.functionArn,
-      codeHash: activeRoleTrigger.sourceCodeHash
+      codeHash: activeRoleTrigger.sourceCodeHash,
+      activeRoleStore: activeRoleTable.name
     }, {});
     result = {
       poolId: Pulumi.output(existingPoolId),
@@ -109,11 +134,19 @@ function _resolveUncached() {
   }
   Auth_ActiveRoleTrigger$ReventlessAws.grantInvoke(activeRoleTrigger, result.poolArn, undefined, {});
   let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
+  let managedStr = Pulumi.output(result.managed ? "true" : "false");
+  let regionOutput = Pulumi.output(regionStr);
+  Pulumi$Pulumi.$$export("identityProviderId", result.poolId);
+  Pulumi$Pulumi.$$export("identityProviderClientId", result.clientId);
+  Pulumi$Pulumi.$$export("identityProviderArn", result.poolArn);
+  Pulumi$Pulumi.$$export("identityProviderRegion", regionOutput);
+  Pulumi$Pulumi.$$export("identityProviderManaged", managedStr);
   Pulumi$Pulumi.$$export("cognitoUserPoolId", result.poolId);
   Pulumi$Pulumi.$$export("cognitoUserPoolClientId", result.clientId);
   Pulumi$Pulumi.$$export("cognitoUserPoolArn", result.poolArn);
-  Pulumi$Pulumi.$$export("cognitoRegion", Pulumi.output(regionStr));
-  Pulumi$Pulumi.$$export("cognitoUserPoolManaged", Pulumi.output(result.managed ? "true" : "false"));
+  Pulumi$Pulumi.$$export("cognitoRegion", regionOutput);
+  Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
+  Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
   return result;
 }
 
@@ -132,8 +165,11 @@ function resolveCognitoUserPool() {
 }
 
 export {
+  log,
+  _deprecatedPoolIdKey,
+  _identityProviderId,
   _resolveUncached,
   _cached,
   resolveCognitoUserPool,
 }
-/* @pulumi/aws Not a pure module */
+/* log Not a pure module */