@reventlessdev/reventless-aws 3.0.0-alpha.344 → 3.0.0-alpha.346

package/scripts/ProvisionIdentity.res

@@ -38,6 +38,8 @@ module Schema = Auth_ActiveRoleStore_Schema
 type args = {
   poolName: string,
   providerId: option<string>,
+  loginIdentifier: Auth_LoginIdentifier.t,
+  signUpMode: Auth_SignUpMode.t,
   help: bool,
 }
 
@@ -47,7 +49,15 @@ let defaultPoolName = "ReventlessIdentity"
   `--provider-id` that parsed as "absent" would create a *second* pool beside the
   one the operator meant to extend. */
 let parseArgs = (argv: array<string>): result<args, string> => {
-  let acc = ref(Ok({poolName: defaultPoolName, providerId: None, help: false}))
+  let acc = ref(
+    Ok({
+      poolName: defaultPoolName,
+      providerId: None,
+      loginIdentifier: Auth_LoginIdentifier.default,
+      signUpMode: Auth_SignUpMode.default,
+      help: false,
+    }),
+  )
   let i = ref(0)
   let count = argv->Array.length
   while i.contents < count {
@@ -61,10 +71,23 @@ let parseArgs = (argv: array<string>): result<args, string> => {
     | (Ok(a), "--provider-id", Some(v)) =>
       acc := Ok({...a, providerId: Some(v)})
       i := i.contents + 2
+    | (Ok(a), "--login-identifier", Some(v)) =>
+      acc :=
+        Auth_LoginIdentifier.parse(Some(v))->Result.map(loginIdentifier => {
+          ...a,
+          loginIdentifier,
+        })
+      i := i.contents + 2
+    | (Ok(a), "--sign-up-mode", Some(v)) =>
+      acc := Auth_SignUpMode.parse(Some(v))->Result.map(signUpMode => {...a, signUpMode})
+      i := i.contents + 2
     | (Ok(a), "--help", _) | (Ok(a), "-h", _) =>
       acc := Ok({...a, help: true})
       i := i.contents + 1
-    | (Ok(_), "--name", None) | (Ok(_), "--provider-id", None) =>
+    | (Ok(_), "--name", None)
+    | (Ok(_), "--provider-id", None)
+    | (Ok(_), "--login-identifier", None)
+    | (Ok(_), "--sign-up-mode", None) =>
       acc := Error(`${flag} needs a value`)
     | (Ok(_), unknown, _) => acc := Error(`unknown argument "${unknown}"`)
     }
@@ -72,12 +95,28 @@ let parseArgs = (argv: array<string>): result<args, string> => {
   acc.contents
 }
 
+let _loginIdentifiers =
+  Auth_LoginIdentifier.all->Array.map(Auth_LoginIdentifier.toString)->Array.join(" | ")
+
+let _defaultLoginIdentifier = Auth_LoginIdentifier.toString(Auth_LoginIdentifier.default)
+
+let _signUpModes = Auth_SignUpMode.all->Array.map(Auth_SignUpMode.toString)->Array.join(" | ")
+
+let _defaultSignUpMode = Auth_SignUpMode.toString(Auth_SignUpMode.default)
+
 let usage = `
 Provision a Reventless identity provider and its active-role store.
 
   --name <name>          Pool name to create or adopt (default: ${defaultPoolName})
   --provider-id <id>     Use this existing pool instead of creating one; only the
                          store is provisioned
+  --login-identifier <a> Sign-in attribute for a pool this creates: ${_loginIdentifiers}
+                         (default: ${_defaultLoginIdentifier}). Fixed at creation —
+                         no later change is possible without replacing the pool
+                         and losing every account in it.
+  --sign-up-mode <m>     Whether a stranger may register themselves: ${_signUpModes}
+                         (default: ${_defaultSignUpMode}). Correctable later, but on a
+                         pool shared between stacks it applies to all of them.
 
 Creates nothing that a platform stack owns, and never attaches a trigger.
 Region and credentials come from the environment, as for any AWS SDK call.
@@ -85,15 +124,28 @@ Region and credentials come from the environment, as for any AWS SDK call.
 
 // ── The pool ─────────────────────────────────────────────────────────────────
 
-/** SPA-friendly defaults, matching what auto mode declares: email sign-in, a
-  12-character password policy, no MFA, admin-only user creation. An operator
-  wanting something else edits the pool afterwards rather than having this script
-  grow a flag per Cognito setting. */
-let poolSettings = (~poolName: string): CognitoIdentityServiceProvider.CreateUserPoolCommand.input => {
+/** SPA-friendly defaults, matching what auto mode declares: a 12-character
+  password policy, no MFA, admin-only user creation. An operator wanting
+  something else edits the pool afterwards rather than having this script grow a
+  flag per Cognito setting.
+
+  Two settings are exceptions and have flags, for two different reasons. The
+  sign-in attribute, because it is the one setting no later edit can reach —
+  Cognito offers no update for it. Sign-up mode, because a stack pointed at a
+  supplied pool holds no handle to set it on, so "edit it afterwards" is the only
+  other answer and it leaves the pool's two identity choices in two places. Both
+  describe the pool itself rather than a policy detail. */
+let poolSettings = (
+  ~poolName: string,
+  ~loginIdentifier: Auth_LoginIdentifier.t,
+  ~signUpMode: Auth_SignUpMode.t,
+): CognitoIdentityServiceProvider.CreateUserPoolCommand.input => {
   poolName,
-  usernameAttributes: ["email"],
+  usernameAttributes: loginIdentifier->Auth_LoginIdentifier.usernameAttributes,
   mfaConfiguration: "OFF",
-  adminCreateUserConfig: {allowAdminCreateUserOnly: true},
+  adminCreateUserConfig: {
+    allowAdminCreateUserOnly: signUpMode->Auth_SignUpMode.allowAdminCreateUserOnly,
+  },
   policies: {
     passwordPolicy: {
       minimumLength: 12,
@@ -140,7 +192,9 @@ let findPoolByName = async (~poolName: string): result<option<string>, string> =
   | [only] => Ok(Some(only))
   | several =>
     Error(
-      `${several->Array.length->Int.toString} user pools are named "${poolName}" (${several->Array.join(
+      `${several
+        ->Array.length
+        ->Int.toString} user pools are named "${poolName}" (${several->Array.join(
           ", ",
         )}). Pass --provider-id to say which one to use; this script will not guess.`,
     )
@@ -165,12 +219,20 @@ let resolvePool = async (~args: args): result<string, string> =>
       Ok(existing)
     | Ok(None) =>
       let created = await CognitoIdentityServiceProvider.CreateUserPoolCommand.make(
-        poolSettings(~poolName=args.poolName),
+        poolSettings(
+          ~poolName=args.poolName,
+          ~loginIdentifier=args.loginIdentifier,
+          ~signUpMode=args.signUpMode,
+        ),
       )->CognitoIdentityServiceProvider.CreateUserPoolCommand.send
       switch created.userPool->Option.flatMap(p => p.id) {
       | None => Error("CreateUserPool returned no pool id")
       | Some(id) =>
-        Console.log(`pool     ${id} (created, named "${args.poolName}")`)
+        Console.log(
+          `pool     ${id} (created, named "${args.poolName}", sign-in on ${Auth_LoginIdentifier.toString(
+              args.loginIdentifier,
+            )}, sign-up ${Auth_SignUpMode.toString(args.signUpMode)})`,
+        )
         Ok(id)
       }
     }
@@ -246,7 +308,8 @@ let provisionStore = async (~tableName: string): result<unit, string> =>
 
 /** Printed rather than assumed: nothing here owns these resources, so nothing
   here can wire them up either. */
-let nextSteps = (~providerId: string) => `
+let nextSteps = (~providerId: string) =>
+  `
 Configure each platform stack that should use this provider:
 
   pulumi config set platform:identityProviderId ${providerId}
@@ -255,7 +318,14 @@ or set REVENTLESS_IDENTITY_PROVIDER_ID in CI. Every stack on this provider
 derives the same store, so there is nothing else to configure.
 
 The pre-token-generation trigger is attached by the deploy, not by this script.
-Users and groups are yours to create.`
+
+Once a stack has deployed against this provider, make the first administrator:
+
+  pnpm exec provision-admin --provider-id ${providerId} --email you@example.com
+
+That is a separate bin because it provisions nothing a stack owns, and because it
+is needed on a pool created here and on one a stack created for itself alike. See
+[ProvisionAdmin].`
 
 let run = async (): result<unit, string> =>
   // argv[0] is node, argv[1] this script.

package/scripts/ProvisionIdentity.res.mjs

@@ -1,10 +1,13 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as ClientDynamodb from "@aws-sdk/client-dynamodb";
 import * as DynamoDb_DynamoDb$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DynamoDb.res.mjs";
 import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as Auth_SignUpMode$ReventlessAws from "../src/adapter/Auth/Auth_SignUpMode.res.mjs";
+import * as Auth_LoginIdentifier$ReventlessAws from "../src/adapter/Auth/Auth_LoginIdentifier.res.mjs";
 import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
 import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
 import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Schema.res.mjs";
@@ -17,6 +20,8 @@ function parseArgs(argv) {
     _0: {
       poolName: defaultPoolName,
       providerId: undefined,
+      loginIdentifier: Auth_LoginIdentifier$ReventlessAws.default,
+      signUpMode: Auth_SignUpMode$ReventlessAws.default,
       help: false
     }
   };
@@ -31,6 +36,20 @@ function parseArgs(argv) {
       let a = match._0;
       let exit$1 = 0;
       switch (flag) {
+        case "--login-identifier" :
+          if (value !== undefined) {
+            acc = Stdlib_Result.map(Auth_LoginIdentifier$ReventlessAws.parse(value), loginIdentifier => ({
+              poolName: a.poolName,
+              providerId: a.providerId,
+              loginIdentifier: loginIdentifier,
+              signUpMode: a.signUpMode,
+              help: a.help
+            }));
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
         case "--name" :
           if (value !== undefined) {
             acc = {
@@ -38,6 +57,8 @@ function parseArgs(argv) {
               _0: {
                 poolName: value,
                 providerId: a.providerId,
+                loginIdentifier: a.loginIdentifier,
+                signUpMode: a.signUpMode,
                 help: a.help
               }
             };
@@ -53,6 +74,8 @@ function parseArgs(argv) {
               _0: {
                 poolName: a.poolName,
                 providerId: value,
+                loginIdentifier: a.loginIdentifier,
+                signUpMode: a.signUpMode,
                 help: a.help
               }
             };
@@ -61,6 +84,20 @@ function parseArgs(argv) {
             exit = 1;
           }
           break;
+        case "--sign-up-mode" :
+          if (value !== undefined) {
+            acc = Stdlib_Result.map(Auth_SignUpMode$ReventlessAws.parse(value), signUpMode => ({
+              poolName: a.poolName,
+              providerId: a.providerId,
+              loginIdentifier: a.loginIdentifier,
+              signUpMode: signUpMode,
+              help: a.help
+            }));
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
         case "--help" :
         case "-h" :
           exit$1 = 2;
@@ -77,6 +114,8 @@ function parseArgs(argv) {
           _0: {
             poolName: a.poolName,
             providerId: a.providerId,
+            loginIdentifier: a.loginIdentifier,
+            signUpMode: a.signUpMode,
             help: true
           }
         };
@@ -95,21 +134,36 @@ function parseArgs(argv) {
   return acc;
 }
 
+let _loginIdentifiers = Auth_LoginIdentifier$ReventlessAws.all.map(Auth_LoginIdentifier$ReventlessAws.toString).join(" | ");
+
+let _defaultLoginIdentifier = Auth_LoginIdentifier$ReventlessAws.toString(Auth_LoginIdentifier$ReventlessAws.default);
+
+let _signUpModes = Auth_SignUpMode$ReventlessAws.all.map(Auth_SignUpMode$ReventlessAws.toString).join(" | ");
+
+let _defaultSignUpMode = Auth_SignUpMode$ReventlessAws.toString(Auth_SignUpMode$ReventlessAws.default);
+
 let usage = `
 Provision a Reventless identity provider and its active-role store.
 
   --name <name>          Pool name to create or adopt (default: ` + defaultPoolName + `)
   --provider-id <id>     Use this existing pool instead of creating one; only the
                          store is provisioned
+  --login-identifier <a> Sign-in attribute for a pool this creates: ` + _loginIdentifiers + `
+                         (default: ` + _defaultLoginIdentifier + `). Fixed at creation —
+                         no later change is possible without replacing the pool
+                         and losing every account in it.
+  --sign-up-mode <m>     Whether a stranger may register themselves: ` + _signUpModes + `
+                         (default: ` + _defaultSignUpMode + `). Correctable later, but on a
+                         pool shared between stacks it applies to all of them.
 
 Creates nothing that a platform stack owns, and never attaches a trigger.
 Region and credentials come from the environment, as for any AWS SDK call.
 `;
 
-function poolSettings(poolName) {
+function poolSettings(poolName, loginIdentifier, signUpMode) {
   return {
     PoolName: poolName,
-    UsernameAttributes: ["email"],
+    UsernameAttributes: Auth_LoginIdentifier$ReventlessAws.usernameAttributes(loginIdentifier),
     MfaConfiguration: "OFF",
     Policies: {
       PasswordPolicy: {
@@ -120,7 +174,7 @@ function poolSettings(poolName) {
       }
     },
     AdminCreateUserConfig: {
-      AllowAdminCreateUserOnly: true
+      AllowAdminCreateUserOnly: Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly(signUpMode)
     }
   };
 }
@@ -194,10 +248,10 @@ async function resolvePool(args) {
       _0: existing
     };
   }
-  let created = await CognitoIdentityServiceProvider$AwsSdk.CreateUserPoolCommand.send(new ClientCognitoIdentityProvider.CreateUserPoolCommand(poolSettings(args.poolName)));
+  let created = await CognitoIdentityServiceProvider$AwsSdk.CreateUserPoolCommand.send(new ClientCognitoIdentityProvider.CreateUserPoolCommand(poolSettings(args.poolName, args.loginIdentifier, args.signUpMode)));
   let id$1 = Stdlib_Option.flatMap(created.UserPool, p => p.Id);
   if (id$1 !== undefined) {
-    console.log(`pool     ` + id$1 + ` (created, named "` + args.poolName + `")`);
+    console.log(`pool     ` + id$1 + ` (created, named "` + args.poolName + `", sign-in on ` + Auth_LoginIdentifier$ReventlessAws.toString(args.loginIdentifier) + `, sign-up ` + Auth_SignUpMode$ReventlessAws.toString(args.signUpMode) + `)`);
     return {
       TAG: "Ok",
       _0: id$1
@@ -305,7 +359,14 @@ or set REVENTLESS_IDENTITY_PROVIDER_ID in CI. Every stack on this provider
 derives the same store, so there is nothing else to configure.
 
 The pre-token-generation trigger is attached by the deploy, not by this script.
-Users and groups are yours to create.`;
+
+Once a stack has deployed against this provider, make the first administrator:
+
+  pnpm exec provision-admin --provider-id ` + providerId + ` --email you@example.com
+
+That is a separate bin because it provisions nothing a stack owns, and because it
+is needed on a pool created here and on one a stack created for itself alike. See
+[ProvisionAdmin].`;
 }
 
 async function run() {
@@ -361,6 +422,10 @@ export {
   Schema,
   defaultPoolName,
   parseArgs,
+  _loginIdentifiers,
+  _defaultLoginIdentifier,
+  _signUpModes,
+  _defaultSignUpMode,
   usage,
   poolSettings,
   findPoolByName,
@@ -373,4 +438,4 @@ export {
   run,
   main,
 }
-/* @aws-sdk/client-dynamodb Not a pure module */
+/* _loginIdentifiers Not a pure module */

package/scripts/ProvisionProvider.res

@@ -0,0 +1,104 @@
+/***
+Which identity provider a provisioning run is about.
+
+Both bins ask the same question and neither should make the operator answer it
+twice. The docs used to say `--provider-id $(pulumi stack output
+identityProviderId)`, which is a command substitution a tool can perform.
+
+🚨 **Three sources, in this order, and the last is a fallback rather than the
+path.** An explicit `--provider-id` wins, then `REVENTLESS_IDENTITY_PROVIDER_ID`
+— the variable [Platform_Stack] reads for the same value, so a CI shell that
+already exports it needs no second spelling — and only then the stack.
+
+Reading the stack works in *both* modes, which is the fact that makes this worth
+doing rather than a convenience for auto deployments only: [Platform_Stack]
+exports `identityProviderId` whether it created the pool or was handed one, so a
+BYO deployment re-exports the provider it was given.
+
+🚨 **It always reports which source answered, and which stack.** `pulumi stack
+output` with no `--stack` reads whichever stack happens to be selected, so a run
+against `alpha` while the operator believes they are on `beta` would succeed —
+in the wrong pool, leaving working accounts somewhere nobody is looking. That is
+worse than failing. So the stack is resolved by name, named in the output, and
+overridable with `--stack`.
+*/
+
+/** Where an id came from, so a run can say so rather than leave it inferred. */
+type source =
+  | Flag
+  | Environment
+  | Stack(string)
+
+let describe = (source: source): string =>
+  switch source {
+  | Flag => "--provider-id"
+  | Environment => "REVENTLESS_IDENTITY_PROVIDER_ID"
+  | Stack(stack) => `stack ${stack}`
+  }
+
+/** The same variable [Platform_Stack] reads for the same value. */
+let envKey = "REVENTLESS_IDENTITY_PROVIDER_ID"
+
+/** `stdio` leaves stderr to the caller's terminal but keeps stdout, so a Pulumi
+  failure is legible where it happens instead of being swallowed and re-reported
+  as a vaguer message here. */
+let pulumi = (args: array<string>): string =>
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args,
+    {encoding: "utf8", stdio: ["ignore", "pipe", "ignore"]},
+  )->String.trim
+
+/** The stack the working directory currently has selected. `None` when there is
+  no Pulumi project here, no stack selected, or no `pulumi` on the PATH — all of
+  which are ordinary for someone running against a BYO pool, and none of which
+  should be an error until the id is actually needed. */
+let selectedStack = (): option<string> =>
+  switch pulumi(["stack", "--show-name"]) {
+  | "" => None
+  | name => Some(name)
+  | exception _ => None
+  }
+
+/**
+The provider id a stack exports.
+
+`--stack` is passed explicitly even when it names the already-selected stack, so
+the value read and the name reported cannot drift apart between the two calls.
+*/
+let fromStack = (~stack: string): result<string, string> =>
+  switch pulumi(["stack", "output", "identityProviderId", "--stack", stack]) {
+  | "" =>
+    Error(
+      `stack "${stack}" exports no identityProviderId — deploy the platform stack first, or pass --provider-id`,
+    )
+  | id => Ok(id)
+  | exception _ =>
+    Error(
+      `could not read identityProviderId from stack "${stack}" — is pulumi installed, logged in, and the stack deployed? Pass --provider-id to skip this lookup`,
+    )
+  }
+
+/**
+The provider this run is about, and where the answer came from.
+
+The error names all three sources rather than only the one that was tried last:
+someone who has no Pulumi project here needs to be told about the flag, and
+someone who has one needs to be told it was consulted and came back empty.
+*/
+let resolve = (~given: option<string>, ~stack: option<string>): result<(string, source), string> =>
+  switch given {
+  | Some(id) => Ok((id, Flag))
+  | None =>
+    switch NodeProcess.env->Dict.get(envKey) {
+    | Some(id) if id->String.trim != "" => Ok((id, Environment))
+    | _ =>
+      switch stack->Option.orElse(selectedStack()) {
+      | None =>
+        Error(
+          `--provider-id is required (or set ${envKey}). It is also read from a deployed stack, but no Pulumi stack is selected here — run this from the platform package, or pass --stack`,
+        )
+      | Some(stack) => fromStack(~stack)->Result.map(id => (id, Stack(stack)))
+      }
+    }
+  }

package/scripts/ProvisionProvider.res.mjs

@@ -0,0 +1,123 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Nodechild_process from "node:child_process";
+
+function describe(source) {
+  if (typeof source !== "object") {
+    if (source === "Flag") {
+      return "--provider-id";
+    } else {
+      return "REVENTLESS_IDENTITY_PROVIDER_ID";
+    }
+  } else {
+    return `stack ` + source._0;
+  }
+}
+
+let envKey = "REVENTLESS_IDENTITY_PROVIDER_ID";
+
+function pulumi(args) {
+  return Nodechild_process.execFileSync("pulumi", args, {
+    encoding: "utf8",
+    stdio: [
+      "ignore",
+      "pipe",
+      "ignore"
+    ]
+  }).trim();
+}
+
+function selectedStack() {
+  let name;
+  try {
+    name = pulumi([
+      "stack",
+      "--show-name"
+    ]);
+  } catch (exn) {
+    return;
+  }
+  if (name === "") {
+    return;
+  } else {
+    return name;
+  }
+}
+
+function fromStack(stack) {
+  let id;
+  try {
+    id = pulumi([
+      "stack",
+      "output",
+      "identityProviderId",
+      "--stack",
+      stack
+    ]);
+  } catch (exn) {
+    return {
+      TAG: "Error",
+      _0: `could not read identityProviderId from stack "` + stack + `" — is pulumi installed, logged in, and the stack deployed? Pass --provider-id to skip this lookup`
+    };
+  }
+  if (id === "") {
+    return {
+      TAG: "Error",
+      _0: `stack "` + stack + `" exports no identityProviderId — deploy the platform stack first, or pass --provider-id`
+    };
+  } else {
+    return {
+      TAG: "Ok",
+      _0: id
+    };
+  }
+}
+
+function resolve(given, stack) {
+  if (given !== undefined) {
+    return {
+      TAG: "Ok",
+      _0: [
+        given,
+        "Flag"
+      ]
+    };
+  }
+  let id = process.env[envKey];
+  if (id !== undefined && id.trim() !== "") {
+    return {
+      TAG: "Ok",
+      _0: [
+        id,
+        "Environment"
+      ]
+    };
+  }
+  let stack$1 = Stdlib_Option.orElse(stack, selectedStack());
+  if (stack$1 !== undefined) {
+    return Stdlib_Result.map(fromStack(stack$1), id => [
+      id,
+      {
+        TAG: "Stack",
+        _0: stack$1
+      }
+    ]);
+  } else {
+    return {
+      TAG: "Error",
+      _0: `--provider-id is required (or set ` + envKey + `). It is also read from a deployed stack, but no Pulumi stack is selected here — run this from the platform package, or pass --stack`
+    };
+  }
+}
+
+export {
+  describe,
+  envKey,
+  pulumi,
+  selectedStack,
+  fromStack,
+  resolve,
+}
+/* node:child_process Not a pure module */