@reventlessdev/reventless-aws 3.0.0-alpha.344 → 3.0.0-alpha.346

package/scripts/ProvisionAdmin.res.mjs

@@ -0,0 +1,289 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Util_Password$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Password.res.mjs";
+import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as ProvisionCognito$ReventlessAws from "./ProvisionCognito.res.mjs";
+import * as ProvisionProvider$ReventlessAws from "./ProvisionProvider.res.mjs";
+
+function parseArgs(argv) {
+  let acc = {
+    TAG: "Ok",
+    _0: {
+      providerId: undefined,
+      stack: undefined,
+      email: undefined,
+      help: false
+    }
+  };
+  let i = 0;
+  let count = argv.length;
+  while (i < count) {
+    let flag = argv[i];
+    let value = argv[i + 1 | 0];
+    let match = acc;
+    let exit = 0;
+    if (match.TAG === "Ok") {
+      let a = match._0;
+      let exit$1 = 0;
+      switch (flag) {
+        case "--email" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                providerId: a.providerId,
+                stack: a.stack,
+                email: value,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
+        case "--provider-id" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                providerId: value,
+                stack: a.stack,
+                email: a.email,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
+        case "--stack" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                providerId: a.providerId,
+                stack: value,
+                email: a.email,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
+        case "--help" :
+        case "-h" :
+          exit$1 = 2;
+          break;
+        default:
+          acc = {
+            TAG: "Error",
+            _0: `unknown argument "` + flag + `"`
+          };
+      }
+      if (exit$1 === 2) {
+        acc = {
+          TAG: "Ok",
+          _0: {
+            providerId: a.providerId,
+            stack: a.stack,
+            email: a.email,
+            help: true
+          }
+        };
+        i = i + 1 | 0;
+      }
+    } else {
+      i = count;
+    }
+    if (exit === 1) {
+      acc = {
+        TAG: "Error",
+        _0: flag + ` needs a value`
+      };
+    }
+  };
+  return acc;
+}
+
+let usage = `
+Make the first administrator of a Reventless deployment.
+
+  --provider-id <id>   The identity provider to create the account in. Usually
+                       omitted: it falls back to ` + ProvisionProvider$ReventlessAws.envKey + `,
+                       then to the identityProviderId exported by the selected
+                       Pulumi stack — which every deployment exports, whether it
+                       created the pool or was handed one.
+  --stack <name>       Read that output from this stack instead of the selected
+                       one. The run always names the stack it used.
+  --email <address>    The address they sign in with.
+
+Creates the "` + AdminGroup$Reventless.name + `" group if it is missing, the account if
+it is missing, a working password, and the membership between them. Provisions
+nothing that a platform stack owns. Region and credentials come from the
+environment, as for any AWS SDK call.
+`;
+
+async function checkPoolAcceptsEmail(providerId) {
+  let e = await ProvisionCognito$ReventlessAws.usernameAttributes(providerId);
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let attributes = e._0;
+  if (attributes.length === 0 || attributes.includes("email")) {
+    console.log(`pool     ` + providerId);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `pool "` + providerId + `" signs in on ` + attributes.join(", ") + `, not email, so an account created from --email could never authenticate. The sign-in attribute is fixed at pool creation and no update can change it.`
+    };
+  }
+}
+
+function describe(outcome) {
+  if (outcome === "Created") {
+    return "created";
+  } else {
+    return "already present";
+  }
+}
+
+async function ensureGroup(providerId, group) {
+  let outcome = await ProvisionCognito$ReventlessAws.ensureGroup(providerId, group, "Reventless administrators");
+  console.log(`group    ` + group + ` (` + describe(outcome) + `)`);
+}
+
+async function ensureUser(providerId, email) {
+  let attributes = [
+    {
+      Name: "email",
+      Value: email
+    },
+    {
+      Name: "email_verified",
+      Value: "true"
+    }
+  ];
+  let outcome = await ProvisionCognito$ReventlessAws.ensureUser(providerId, email, attributes);
+  console.log(`user     ` + email + ` (` + describe(outcome) + `)`);
+}
+
+async function setPassword(providerId, email, password) {
+  await ProvisionCognito$ReventlessAws.setPassword(providerId, email, password);
+  console.log(`password (set, permanent)`);
+}
+
+async function addToGroup(providerId, email, group) {
+  await ProvisionCognito$ReventlessAws.addToGroup(providerId, email, group);
+  console.log(`member   ` + email + ` in ` + group);
+}
+
+let passwordNote = `
+🚨 This is a bootstrap credential and it is printed above because that is the only
+   place it exists — Cognito keeps no recoverable copy. It is now in this
+   terminal's scrollback. Sign in, change it, and do not paste it where logs are
+   kept. Running this again mints a new one.`;
+
+function signInDetails(providerId, email, password, group) {
+  return `
+The first administrator is ready.
+
+  provider   ` + providerId + `
+  sign in as ` + email + `
+  password   ` + password + `
+  group      ` + group + `
+` + passwordNote + `
+
+This script bootstraps the first account only, which is the one that cannot be
+made through a signed-in session because there is no signed-in session yet. The
+rest of the cast is a list rather than a command: declare it in
+.reventless/users.yaml and run \`pnpm exec provision-accounts\`.`;
+}
+
+async function run() {
+  let e = parseArgs(process.argv.slice(2, process.argv.length));
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let args = e._0;
+  if (args.help) {
+    console.log(usage);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  }
+  let email = args.email;
+  if (email === undefined) {
+    return {
+      TAG: "Error",
+      _0: "--email is required — it is the address the administrator signs in with"
+    };
+  }
+  let e$1 = ProvisionProvider$ReventlessAws.resolve(args.providerId, args.stack);
+  if (e$1.TAG !== "Ok") {
+    return e$1;
+  }
+  let match = e$1._0;
+  let providerId = match[0];
+  console.log(`provider ` + providerId + ` (from ` + ProvisionProvider$ReventlessAws.describe(match[1]) + `)`);
+  let e$2 = await checkPoolAcceptsEmail(providerId);
+  if (e$2.TAG !== "Ok") {
+    return e$2;
+  }
+  let password = Util_Password$Reventless.generate();
+  await ensureGroup(providerId, AdminGroup$Reventless.name);
+  await ensureUser(providerId, email);
+  await setPassword(providerId, email, password);
+  await addToGroup(providerId, email, AdminGroup$Reventless.name);
+  console.log(signInDetails(providerId, email, password, AdminGroup$Reventless.name));
+  return {
+    TAG: "Ok",
+    _0: undefined
+  };
+}
+
+async function main() {
+  let message;
+  try {
+    message = await run();
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    console.error(`provision-admin: ` + Util_AwsError$ReventlessAws.describe(exn));
+    process.exit(1);
+    return;
+  }
+  if (message.TAG === "Ok") {
+    return;
+  }
+  console.error(`provision-admin: ` + message._0);
+  process.exit(1);
+}
+
+let Cognito;
+
+export {
+  Cognito,
+  parseArgs,
+  usage,
+  checkPoolAcceptsEmail,
+  describe,
+  ensureGroup,
+  ensureUser,
+  setPassword,
+  addToGroup,
+  passwordNote,
+  signInDetails,
+  run,
+  main,
+}
+/* Util_Password-Reventless Not a pure module */

package/scripts/ProvisionCognito.res

@@ -0,0 +1,149 @@
+/***
+The Cognito operations a provisioning run performs, once.
+
+Two bins now do the same four things — ensure a group, ensure an account, set a
+permanent password, apply a membership — and `provision-admin` did them first.
+Extracted here rather than copied for the reason [Auth_LoginIdentifier] and
+[Auth_SignUpMode] were: a second copy drifts, and the half that drifts is
+whichever one nobody re-reads.
+
+🚨 **These report rather than print.** `provision-admin` has a line format its
+tests and its docs both describe, and an extraction that took the printing with it
+would have changed that script's output while claiming to change nothing. Each
+caller phrases its own run; what is shared is what the API does.
+
+The password generator that used to sit beside these moved further, to
+[Util_Password] in `spec` — the manifest's platform-neutral half needs it, and
+that half must not reach into this package.
+*/
+
+open AwsSdk
+
+module Cognito = CognitoIdentityServiceProvider
+
+/** Whether the call made the thing or found it. Both are success; the difference
+  is only worth a word in the output, and a caller that treats "already there" as
+  a failure makes the second run of a provisioning script an error. */
+type outcome =
+  | Created
+  | AlreadyPresent
+
+/**
+The sign-in attributes a pool was created with.
+
+Fixed at pool creation and unchangeable — see [Auth_LoginIdentifier] — so this is
+the one pool fact a provisioning run must read before it writes. An empty list
+means the pool signs in on a plain username, which takes an email-shaped one
+happily; a list naming `email` means a plain username can never authenticate.
+
+Described rather than assumed because the symptom of getting it wrong is a
+correctly-created account that simply cannot log in, arriving at a login screen
+far from the run that caused it.
+*/
+let usernameAttributes = async (~providerId: string): result<array<string>, string> => {
+  let described = await Cognito.DescribeUserPoolCommand.make({
+    userPoolId: providerId,
+  })->Cognito.DescribeUserPoolCommand.send
+  switch described.userPool {
+  | None => Error(`DescribeUserPool returned nothing for "${providerId}"`)
+  | Some(pool) => Ok(pool.usernameAttributes->Option.getOr([]))
+  }
+}
+
+/** The group, where a stack has not already declared it.
+
+  In auto mode the platform stack declares the administrator group as an ordinary
+  child of the pool it owns, so this is a no-op. On a supplied pool no stack does,
+  because two stacks sharing a provider would both declare it and the second would
+  fail on a name that already exists. Every other group a manifest names is in the
+  same position: nothing else creates it. */
+let ensureGroup = async (~providerId: string, ~group: string, ~description: string): outcome =>
+  try {
+    let _ = await Cognito.CreateGroupCommand.make({
+      groupName: group,
+      userPoolId: providerId,
+      description,
+    })->Cognito.CreateGroupCommand.send
+    Created
+  } catch {
+  | exn if exn->Util_AwsError.hasCode(~code="GroupExistsException") => AlreadyPresent
+  }
+
+/**
+The account, where it is not already there.
+
+`MessageAction: "SUPPRESS"` stops Cognito emailing an invitation. The invitation
+carries the temporary password the run is about to replace, so sending it would
+tell the new account holder to sign in with a credential that no longer works —
+and on an admin-create-only pool these accounts may carry no deliverable address
+at all.
+
+Attributes are the caller's: an administrator created from an email address wants
+`email` and `email_verified` stamped, and a demo account called `shopper` has
+neither and needs none.
+*/
+let ensureUser = async (
+  ~providerId: string,
+  ~username: string,
+  ~attributes: array<Cognito.AdminCreateUserCommand.attributeType>,
+): outcome =>
+  try {
+    let _ = await Cognito.AdminCreateUserCommand.make({
+      userPoolId: providerId,
+      username,
+      userAttributes: attributes,
+      messageAction: "SUPPRESS",
+    })->Cognito.AdminCreateUserCommand.send
+    Created
+  } catch {
+  | exn if exn->Util_AwsError.hasCode(~code="UsernameExistsException") => AlreadyPresent
+  }
+
+/**
+A password the account can actually be used with.
+
+🚨 **The step it is easiest to leave out, and leaving it out reproduces the defect
+these scripts exist to remove.** An administrator-created account holds a
+*temporary* password and lands in `FORCE_CHANGE_PASSWORD`: the first sign-in meets
+a `NEW_PASSWORD_REQUIRED` challenge, which the host UI is not known to handle and
+which the seed client rejects outright — it gets a `ChallengeName` where it
+expects a token. So this sets a permanent password, and the account is `CONFIRMED`
+when it returns.
+*/
+let setPassword = async (~providerId: string, ~username: string, ~password: string): unit =>
+  await Cognito.AdminSetUserPasswordCommand.make({
+    userPoolId: providerId,
+    username,
+    password,
+    permanent: true,
+  })->Cognito.AdminSetUserPasswordCommand.send
+
+/** Idempotent at the API: adding a user already in the group is not an error, so
+  this needs no existence check of its own. */
+let addToGroup = async (~providerId: string, ~username: string, ~group: string): unit =>
+  await Cognito.AdminAddUserToGroupCommand.make({
+    username,
+    groupName: group,
+    userPoolId: providerId,
+  })->Cognito.AdminAddUserToGroupCommand.send
+
+/**
+The id the pool minted for an account.
+
+No request supplies it and `AdminCreateUser` does not return it, so it is read
+back — the same way for an account this run just made and one that was already
+there, which is what lets a re-run correct a manifest written by hand.
+
+`None` when the pool answers without a `sub`, which should not happen; the caller
+reports it rather than writing a blank id into a file that is read as authority.
+*/
+let subOf = async (~providerId: string, ~username: string): option<string> => {
+  let user = await Cognito.AdminGetUserCommand.make({
+    userPoolId: providerId,
+    username,
+  })->Cognito.AdminGetUserCommand.send
+  user.userAttributes
+  ->Option.getOr([])
+  ->Array.find(attribute => attribute.name == "sub")
+  ->Option.map(attribute => attribute.value)
+}

package/scripts/ProvisionCognito.res.mjs

@@ -0,0 +1,98 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+
+async function usernameAttributes(providerId) {
+  let described = await CognitoIdentityServiceProvider$AwsSdk.DescribeUserPoolCommand.send(new ClientCognitoIdentityProvider.DescribeUserPoolCommand({
+    UserPoolId: providerId
+  }));
+  let pool = described.UserPool;
+  if (pool !== undefined) {
+    return {
+      TAG: "Ok",
+      _0: Stdlib_Option.getOr(pool.UsernameAttributes, [])
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `DescribeUserPool returned nothing for "` + providerId + `"`
+    };
+  }
+}
+
+async function ensureGroup(providerId, group, description) {
+  try {
+    await CognitoIdentityServiceProvider$AwsSdk.CreateGroupCommand.send(new ClientCognitoIdentityProvider.CreateGroupCommand({
+      GroupName: group,
+      UserPoolId: providerId,
+      Description: description
+    }));
+    return "Created";
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.hasCode(exn, "GroupExistsException")) {
+      return "AlreadyPresent";
+    }
+    throw exn;
+  }
+}
+
+async function ensureUser(providerId, username, attributes) {
+  try {
+    await CognitoIdentityServiceProvider$AwsSdk.AdminCreateUserCommand.send(new ClientCognitoIdentityProvider.AdminCreateUserCommand({
+      UserPoolId: providerId,
+      Username: username,
+      UserAttributes: attributes,
+      MessageAction: "SUPPRESS"
+    }));
+    return "Created";
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.hasCode(exn, "UsernameExistsException")) {
+      return "AlreadyPresent";
+    }
+    throw exn;
+  }
+}
+
+async function setPassword(providerId, username, password) {
+  return await CognitoIdentityServiceProvider$AwsSdk.AdminSetUserPasswordCommand.send(new ClientCognitoIdentityProvider.AdminSetUserPasswordCommand({
+    UserPoolId: providerId,
+    Username: username,
+    Password: password,
+    Permanent: true
+  }));
+}
+
+async function addToGroup(providerId, username, group) {
+  return await CognitoIdentityServiceProvider$AwsSdk.AdminAddUserToGroupCommand.send(new ClientCognitoIdentityProvider.AdminAddUserToGroupCommand({
+    Username: username,
+    GroupName: group,
+    UserPoolId: providerId
+  }));
+}
+
+async function subOf(providerId, username) {
+  let user = await CognitoIdentityServiceProvider$AwsSdk.AdminGetUserCommand.send(new ClientCognitoIdentityProvider.AdminGetUserCommand({
+    UserPoolId: providerId,
+    Username: username
+  }));
+  return Stdlib_Option.map(Stdlib_Option.getOr(user.UserAttributes, []).find(attribute => attribute.Name === "sub"), attribute => attribute.Value);
+}
+
+let Cognito;
+
+export {
+  Cognito,
+  usernameAttributes,
+  ensureGroup,
+  ensureUser,
+  setPassword,
+  addToGroup,
+  subOf,
+}
+/* Util_AwsError-ReventlessAws Not a pure module */