@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.346

package/src/Platform_Stack.res

@@ -12,15 +12,24 @@ type cognitoUserPool = {
     is declared with the trigger's ARN), while the mutation that writes it is
     provisioned after the API — see [Auth_ActiveRoleStore.res]. */
   activeRoleTable: Auth_ActiveRoleStore.storeTable,
+  /** The sign-in attribute this stack created the pool with. `None` in BYO mode:
+    the pool's own choice was made elsewhere and no lookup here reads it back,
+    so reporting one would be a guess. */
+  loginIdentifier: option<Auth_LoginIdentifier.t>,
 }
 
 /**
  * Resolve the Cognito UserPool used by AppSync auth. Two modes:
  *
  * - **Auto**: no `platform:identityProviderId` config — create a fresh UserPool
- *   with SPA-friendly defaults (email username, 12-char password policy, no
- *   MFA, admin-only user creation). Caller is responsible for creating
- *   groups (`Admin`, `User`, …) and users via the AWS console / CLI.
+ *   with SPA-friendly defaults (email sign-in unless `platform:loginIdentifier`
+ *   says otherwise, 12-char password policy, no MFA, and admin-only user
+ *   creation unless `platform:signUpMode` says otherwise), plus the
+ *   administrator group named by [Reventless.AdminGroup] and an elevated-groups
+ *   default naming it. What it does **not** create is the first administrator:
+ *   accounts are not stack resources, and a pool full of them is not something a
+ *   `pulumi destroy` should be able to empty. `provision-admin` makes that one,
+ *   and no step of this needs the AWS console.
  *
  * - **BYO**: provider ID provided — skip pool creation, look up the existing
  *   pool via `aws.cognito.getUserPool` for its ARN. Lookup precedence
@@ -38,10 +47,21 @@ type cognitoUserPool = {
  * Pulumi can destroy without touching the parent pool).
  *
  * Always exports `identityProviderId`, `identityProviderClientId`,
- * `identityProviderArn`, `identityProviderRegion`, `identityProviderManaged` and
- * `activeRoleStore` as stack outputs so downstream stacks (and Stage D AppSync
- * wiring) can read them via `StackReference` — plus, for one release, the
- * deprecated `cognito*` spellings of the first five.
+ * `identityProviderArn`, `identityProviderRegion`, `identityProviderManaged`,
+ * `identityProviderLoginIdentifier`, `identityProviderAdminGroup` and
+ * `activeRoleStore` as stack outputs so
+ * downstream stacks (and Stage D AppSync wiring) can read them via
+ * `StackReference` — plus, for one release, the deprecated `cognito*` spellings
+ * of the first five.
+ *
+ * 🚨 In auto mode `platform:loginIdentifier` picks the sign-in attribute, and it
+ * is the one setting no later deploy can correct: changing it replaces the pool
+ * and empties it. Absent means `email`. See [Auth_LoginIdentifier].
+ *
+ * `platform:signUpMode` decides whether a stranger may register themselves.
+ * Absent means `adminOnly`. It is the opposite kind of setting — an ordinary
+ * in-place update, free and reversible on a pool full of accounts — but on a
+ * pool shared between stacks the flip is pool-wide. See [Auth_SignUpMode].
  *
  * Also provisions the role-state table and the pre-token-generation trigger that
  * narrows `cognito:groups` to a caller's chosen role. They belong here rather
@@ -86,6 +106,42 @@ let _identityProviderId = (~cfg: Pulumi.Config.t): option<string> => {
   }
 }
 
+/** The sign-in attribute for a pool this stack creates, from
+  `platform:loginIdentifier` (or `REVENTLESS_LOGIN_IDENTIFIER` / the sidecar).
+
+  Absent means `email`, which is what every pool so far was created with. An
+  unrecognised spelling fails the deploy — see [Auth_LoginIdentifier] for why
+  defaulting past a typo here is unrecoverable. */
+let _loginIdentifier = (~cfg: Pulumi.Config.t): Auth_LoginIdentifier.t => {
+  let raw = switch Util_LocalConfig.get("loginIdentifier") {
+  | Some(_) as v => v
+  | None => cfg->Pulumi.Config.get("loginIdentifier")
+  }
+  switch Auth_LoginIdentifier.parse(raw) {
+  | Ok(identifier) => identifier
+  | Error(message) => JsError.throwWithMessage(message)
+  }
+}
+
+/** Whether a stranger may create their own account in a pool this stack creates,
+  from `platform:signUpMode` (or `REVENTLESS_SIGN_UP_MODE` / the sidecar).
+
+  Absent means `adminOnly`, which is what every pool so far was created with, so
+  an existing stack redeploys unchanged. Unlike the sign-in attribute this is an
+  ordinary in-place update on a live pool — but an unrecognised spelling still
+  fails the deploy, because defaulting past it would refuse every registration
+  while the config read as if it allowed them. See [Auth_SignUpMode]. */
+let _signUpMode = (~cfg: Pulumi.Config.t): Auth_SignUpMode.t => {
+  let raw = switch Util_LocalConfig.get("signUpMode") {
+  | Some(_) as v => v
+  | None => cfg->Pulumi.Config.get("signUpMode")
+  }
+  switch Auth_SignUpMode.parse(raw) {
+  | Ok(mode) => mode
+  | Error(message) => JsError.throwWithMessage(message)
+  }
+}
+
 let _resolveUncached = (): cognitoUserPool => {
   let cfg = Pulumi.Config.make(Some("platform"))
   let existingPoolId = _identityProviderId(~cfg)
@@ -183,11 +239,19 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: lookup->Pulumi.Output.apply(r => r.arn),
       managed: false,
       activeRoleTable,
+      loginIdentifier: None,
     }
 
   | None =>
+    let loginIdentifier = _loginIdentifier(~cfg)
+    let signUpMode = _signUpMode(~cfg)
+    // In place, unlike the sign-in attribute below: `AdminCreateUserConfig` is a
+    // member of `UpdateUserPoolRequest`, so flipping this on a pool full of
+    // accounts is an ordinary update rather than a replacement.
     let adminConfig: PulumiAws.Cognito.UserPool.adminCreateUserConfig = {
-      allowAdminCreateUserOnly: Pulumi.Input.make(true),
+      allowAdminCreateUserOnly: Pulumi.Input.make(
+        signUpMode->Auth_SignUpMode.allowAdminCreateUserOnly,
+      ),
     }
     let pwdPolicy: PulumiAws.Cognito.UserPool.passwordPolicy = {
       minimumLength: Pulumi.Input.make(12),
@@ -204,7 +268,13 @@ let _resolveUncached = (): cognitoUserPool => {
       ~name="HostUiPool",
       ~args={
         adminCreateUserConfig: Pulumi.Input.make(adminConfig),
-        usernameAttributes: Pulumi.Input.make([Pulumi.Input.make("email")]),
+        // 🚨 Changing this on a live stack replaces the pool and empties it —
+        // Cognito has no update for the sign-in attribute. Chosen once, here.
+        usernameAttributes: Pulumi.Input.make(
+          loginIdentifier
+          ->Auth_LoginIdentifier.usernameAttributes
+          ->Array.map(Pulumi.Input.make),
+        ),
         passwordPolicy: Pulumi.Input.make(pwdPolicy),
         mfaConfiguration: Pulumi.Input.make("OFF"),
         lambdaConfig: Pulumi.Input.make({
@@ -219,6 +289,23 @@ let _resolveUncached = (): cognitoUserPool => {
       },
     )
 
+    // The administrator group, declared beside the pool that holds it.
+    //
+    // Auto mode only, and the restriction is the point: a group is a pool-level
+    // fact, and on a pool this stack does not own those are not this stack's to
+    // declare. Two stacks pointed at one shared provider would each declare this
+    // group, and the second would fail on a name that already exists — the same
+    // split, for the same reason, as [Auth_SignUpMode] and the active-role store.
+    // The BYO half is `provision-admin`, which creates the group beside the first
+    // administrator who needs it.
+    //
+    // An ordinary child resource: the pool is ours, so this needs no out-of-band
+    // call and Pulumi's state stays the authority for whether it exists.
+    let _adminGroup = Util_CognitoGroupUser.addUserGroup(
+      ~name=Reventless.AdminGroup.name,
+      ~userPoolId=pool.id,
+    )
+
     let tokenUnits2: PulumiAws.Cognito.UserPoolClient.tokenValidityUnits = {
       accessToken: Pulumi.Input.make("minutes"),
       idToken: Pulumi.Input.make("minutes"),
@@ -247,6 +334,7 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: pool.arn,
       managed: true,
       activeRoleTable,
+      loginIdentifier: Some(loginIdentifier),
     }
   }
 
@@ -279,11 +367,23 @@ let _resolveUncached = (): cognitoUserPool => {
   let managedStr = Pulumi.Output.make(result.managed ? "true" : "false")
   let regionOutput = Pulumi.Output.make(regionStr)
 
+  // The sign-in attribute is unchangeable after creation, so the value a pool was
+  // born with has to be readable somewhere other than the source that has since
+  // moved on. `unknown` for a BYO pool: this stack did not choose it and does not
+  // read it back.
+  let loginIdentifierStr = Pulumi.Output.make(
+    switch result.loginIdentifier {
+    | Some(identifier) => Auth_LoginIdentifier.toString(identifier)
+    | None => "unknown"
+    },
+  )
+
   Pulumi.Pulumi.export("identityProviderId", result.poolId)
   Pulumi.Pulumi.export("identityProviderClientId", result.clientId)
   Pulumi.Pulumi.export("identityProviderArn", result.poolArn)
   Pulumi.Pulumi.export("identityProviderRegion", regionOutput)
   Pulumi.Pulumi.export("identityProviderManaged", managedStr)
+  Pulumi.Pulumi.export("identityProviderLoginIdentifier", loginIdentifierStr)
 
   // Deprecated spellings — see above.
   Pulumi.Pulumi.export("cognitoUserPoolId", result.poolId)
@@ -292,6 +392,16 @@ let _resolveUncached = (): cognitoUserPool => {
   Pulumi.Pulumi.export("cognitoRegion", regionOutput)
   Pulumi.Pulumi.export("cognitoUserPoolManaged", managedStr)
 
+  // The group that administers this deployment, readable without reading source.
+  // `provision-admin` puts its first user in it, and a deployment overriding who
+  // is elevated needs to know which name it is overriding.
+  //
+  // Exported in both pool modes although only auto mode *declares* the group: the
+  // name is what a caller needs either way, and an output that appeared in one
+  // mode and not the other would read as "there is no administrator group here"
+  // rather than "this stack did not create it".
+  Pulumi.Pulumi.export("identityProviderAdminGroup", Pulumi.Output.make(Reventless.AdminGroup.name))
+
   // Exported so an operator can read back the store this provider resolved to —
   // the name is derived, not configured, so this is a convenience for checking
   // rather than a value anything is meant to copy into a config.

package/src/Platform_Stack.res.mjs

@@ -4,10 +4,15 @@ import * as Aws from "@pulumi/aws";
 import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
+import * as Auth_SignUpMode$ReventlessAws from "./adapter/Auth/Auth_SignUpMode.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
 import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
+import * as Auth_LoginIdentifier$ReventlessAws from "./adapter/Auth/Auth_LoginIdentifier.res.mjs";
+import * as Util_CognitoGroupUser$ReventlessAws from "./util/Util_CognitoGroupUser.res.mjs";
 import * as Auth_ActiveRoleTrigger$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleTrigger.res.mjs";
 import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "./adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
 
@@ -35,6 +40,28 @@ function _identityProviderId(cfg) {
   }
 }
 
+function _loginIdentifier(cfg) {
+  let v = Util_LocalConfig$ReventlessAws.get("loginIdentifier");
+  let raw = v !== undefined ? v : cfg.get("loginIdentifier");
+  let identifier = Auth_LoginIdentifier$ReventlessAws.parse(raw);
+  if (identifier.TAG === "Ok") {
+    return identifier._0;
+  } else {
+    return Stdlib_JsError.throwWithMessage(identifier._0);
+  }
+}
+
+function _signUpMode(cfg) {
+  let v = Util_LocalConfig$ReventlessAws.get("signUpMode");
+  let raw = v !== undefined ? v : cfg.get("signUpMode");
+  let mode = Auth_SignUpMode$ReventlessAws.parse(raw);
+  if (mode.TAG === "Ok") {
+    return mode._0;
+  } else {
+    return Stdlib_JsError.throwWithMessage(mode._0);
+  }
+}
+
 function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
   let existingPoolId = _identityProviderId(cfg);
@@ -77,11 +104,14 @@ function _resolveUncached() {
       clientId: client.id,
       poolArn: lookup.apply(r => r.arn),
       managed: false,
-      activeRoleTable: activeRoleTable
+      activeRoleTable: activeRoleTable,
+      loginIdentifier: undefined
     };
   } else {
+    let loginIdentifier = _loginIdentifier(cfg);
+    let signUpMode = _signUpMode(cfg);
     let adminConfig = {
-      allowAdminCreateUserOnly: true
+      allowAdminCreateUserOnly: Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly(signUpMode)
     };
     let pwdPolicy_minimumLength = 12;
     let pwdPolicy_requireLowercase = true;
@@ -98,11 +128,12 @@ function _resolveUncached() {
         preTokenGeneration: activeRoleTrigger.functionArn
       },
       adminCreateUserConfig: adminConfig,
-      usernameAttributes: ["email"],
+      usernameAttributes: Auth_LoginIdentifier$ReventlessAws.usernameAttributes(loginIdentifier).map(prim => prim),
       passwordPolicy: pwdPolicy,
       mfaConfiguration: "OFF",
       tags: AWS_Tags$ReventlessAws.make("HostUiPool", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined)
     });
+    Util_CognitoGroupUser$ReventlessAws.addUserGroup(AdminGroup$Reventless.name, pool.id);
     let tokenUnits2_accessToken = "minutes";
     let tokenUnits2_idToken = "minutes";
     let tokenUnits2_refreshToken = "days";
@@ -129,23 +160,28 @@ function _resolveUncached() {
       clientId: client$1.id,
       poolArn: pool.arn,
       managed: true,
-      activeRoleTable: activeRoleTable
+      activeRoleTable: activeRoleTable,
+      loginIdentifier: loginIdentifier
     };
   }
   Auth_ActiveRoleTrigger$ReventlessAws.grantInvoke(activeRoleTrigger, result.poolArn, undefined, {});
   let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
   let managedStr = Pulumi.output(result.managed ? "true" : "false");
   let regionOutput = Pulumi.output(regionStr);
+  let identifier = result.loginIdentifier;
+  let loginIdentifierStr = Pulumi.output(identifier !== undefined ? Auth_LoginIdentifier$ReventlessAws.toString(identifier) : "unknown");
   Pulumi$Pulumi.$$export("identityProviderId", result.poolId);
   Pulumi$Pulumi.$$export("identityProviderClientId", result.clientId);
   Pulumi$Pulumi.$$export("identityProviderArn", result.poolArn);
   Pulumi$Pulumi.$$export("identityProviderRegion", regionOutput);
   Pulumi$Pulumi.$$export("identityProviderManaged", managedStr);
+  Pulumi$Pulumi.$$export("identityProviderLoginIdentifier", loginIdentifierStr);
   Pulumi$Pulumi.$$export("cognitoUserPoolId", result.poolId);
   Pulumi$Pulumi.$$export("cognitoUserPoolClientId", result.clientId);
   Pulumi$Pulumi.$$export("cognitoUserPoolArn", result.poolArn);
   Pulumi$Pulumi.$$export("cognitoRegion", regionOutput);
   Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
+  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(AdminGroup$Reventless.name));
   Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
   return result;
 }
@@ -168,6 +204,8 @@ export {
   log,
   _deprecatedPoolIdKey,
   _identityProviderId,
+  _loginIdentifier,
+  _signUpMode,
   _resolveUncached,
   _cached,
   resolveCognitoUserPool,

package/src/adapter/Auth/Auth_LoginIdentifier.res

@@ -0,0 +1,66 @@
+// The attribute a person signs in with. One definition, two consumers: the auto
+// pool the platform stack declares, and the provisioning script that makes a
+// pool no stack owns. Free of Pulumi and of the AWS SDK so both can import it.
+
+/**
+Which attribute identifies a person at sign-in.
+
+🚨 **Fixed at pool creation, and no later deploy can change it.** `CreateUserPool`
+accepts `UsernameAttributes`; `UpdateUserPool` has no such member, so nothing can
+change it in place and every provider replaces the pool instead. A replaced pool
+is an empty one — Cognito exports no password material, so every account
+re-registers. A deployment that will ever want phone sign-in has to say so on its
+first deploy.
+*/
+type t =
+  | Email
+  | Phone
+  | EmailOrPhone
+
+/** What every pool has been created with so far, so an existing stack redeploys
+  unchanged. */
+let default = Email
+
+let all: array<t> = [Email, Phone, EmailOrPhone]
+
+/** The config spelling, and the stack output. */
+let toString = (identifier: t): string =>
+  switch identifier {
+  | Email => "email"
+  | Phone => "phone"
+  | EmailOrPhone => "emailOrPhone"
+  }
+
+let fromString = (value: string): option<t> => all->Array.find(i => toString(i) == value)
+
+/** Cognito's `usernameAttributes`. */
+let usernameAttributes = (identifier: t): array<string> =>
+  switch identifier {
+  | Email => ["email"]
+  | Phone => ["phone_number"]
+  | EmailOrPhone => ["email", "phone_number"]
+  }
+
+/**
+The deploy-time choice, or why the deploy cannot proceed.
+
+An unrecognised spelling refuses rather than falling back to the default: a typo
+that defaulted would create a pool signing in on the wrong attribute, which is
+the one property no later deploy can correct.
+*/
+let parse = (value: option<string>): result<t, string> =>
+  switch value {
+  | None => Ok(default)
+  | Some(raw) =>
+    switch fromString(raw) {
+    | Some(identifier) => Ok(identifier)
+    | None =>
+      Error(
+        `loginIdentifier "${raw}" is not one of ${all
+          ->Array.map(toString)
+          ->Array.join(
+            ", ",
+          )}. It fixes the sign-in attribute at pool creation and no later deploy can change it, so an unrecognised spelling refuses rather than defaulting.`,
+      )
+    }
+  }

package/src/adapter/Auth/Auth_LoginIdentifier.res.mjs

@@ -0,0 +1,70 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let all = [
+  "Email",
+  "Phone",
+  "EmailOrPhone"
+];
+
+function toString(identifier) {
+  switch (identifier) {
+    case "Email" :
+      return "email";
+    case "Phone" :
+      return "phone";
+    case "EmailOrPhone" :
+      return "emailOrPhone";
+  }
+}
+
+function fromString(value) {
+  return all.find(i => toString(i) === value);
+}
+
+function usernameAttributes(identifier) {
+  switch (identifier) {
+    case "Email" :
+      return ["email"];
+    case "Phone" :
+      return ["phone_number"];
+    case "EmailOrPhone" :
+      return [
+        "email",
+        "phone_number"
+      ];
+  }
+}
+
+function parse(value) {
+  if (value === undefined) {
+    return {
+      TAG: "Ok",
+      _0: "Email"
+    };
+  }
+  let identifier = fromString(value);
+  if (identifier !== undefined) {
+    return {
+      TAG: "Ok",
+      _0: identifier
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `loginIdentifier "` + value + `" is not one of ` + all.map(toString).join(", ") + `. It fixes the sign-in attribute at pool creation and no later deploy can change it, so an unrecognised spelling refuses rather than defaulting.`
+    };
+  }
+}
+
+let $$default = "Email";
+
+export {
+  $$default as default,
+  all,
+  toString,
+  fromString,
+  usernameAttributes,
+  parse,
+}
+/* No side effect */

package/src/adapter/Auth/Auth_SignUpMode.res

@@ -0,0 +1,78 @@
+// Whether a stranger can create their own account. One definition, two consumers:
+// the auto pool the platform stack declares, and the provisioning script that
+// makes a pool no stack owns. Free of Pulumi and of the AWS SDK so both can
+// import it — the same shape, and the same drift it prevents, as
+// [Auth_LoginIdentifier].
+
+/**
+Who may create a principal in this pool.
+
+Unlike the sign-in attribute, this **is** updatable in place: `AdminCreateUserConfig`
+is a member of `UpdateUserPoolRequest`, so a pool full of accounts can be flipped
+either way at any time, for free and reversibly. It is a setting, not a
+first-deploy-or-never decision.
+
+🚨 **On a shared pool the flip is pool-wide, not stack-wide.** The setting belongs
+to the pool and the pool has one of it, so every stack pointed at that pool gets
+self-service the moment one deployment turns it on. A deployment that must never
+self-register cannot rely on its own config to prevent it, and should not share a
+pool with one that does.
+*/
+type t =
+  /** Only an administrator creates principals — what every pool so far was
+      created with, and what a deployment with no registration flow wants. */
+  | AdminOnly
+  /** A stranger can register themselves. */
+  | SelfService
+
+/** What every pool has been created with so far, so an existing stack redeploys
+  unchanged. Closed is also the right default on its own terms: a deployment that
+  has not asked for self-registration should not acquire it by upgrading. */
+let default = AdminOnly
+
+let all: array<t> = [AdminOnly, SelfService]
+
+/** The config spelling. */
+let toString = (mode: t): string =>
+  switch mode {
+  | AdminOnly => "adminOnly"
+  | SelfService => "selfService"
+  }
+
+let fromString = (value: string): option<t> => all->Array.find(m => toString(m) == value)
+
+/** Cognito's `allowAdminCreateUserOnly`, which asks the negative of what this
+  type asks. Converting in one place is the point: a bool named for the negative
+  is easy to read backwards at a call site. */
+let allowAdminCreateUserOnly = (mode: t): bool =>
+  switch mode {
+  | AdminOnly => true
+  | SelfService => false
+  }
+
+/**
+The deploy-time choice, or why the deploy cannot proceed.
+
+An unrecognised spelling refuses rather than falling back to the default, and the
+reason is *not* [Auth_LoginIdentifier]'s — this setting is correctable at any
+time. It is that the mistake would be silent. The default is closed, so a typo
+fails safe, but it fails safe *invisibly*: the deploy is green, the config says
+what the operator meant, and the symptom is every registration being refused,
+which surfaces far from the misspelling that caused it.
+*/
+let parse = (value: option<string>): result<t, string> =>
+  switch value {
+  | None => Ok(default)
+  | Some(raw) =>
+    switch fromString(raw) {
+    | Some(mode) => Ok(mode)
+    | None =>
+      Error(
+        `signUpMode "${raw}" is not one of ${all
+          ->Array.map(toString)
+          ->Array.join(
+            ", ",
+          )}. It decides whether a stranger can create an account. An unrecognised spelling refuses rather than defaulting, because defaulting would deploy green and refuse every registration, with nothing pointing back at the spelling.`,
+      )
+    }
+  }

package/src/adapter/Auth/Auth_SignUpMode.res.mjs

@@ -0,0 +1,56 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let all = [
+  "AdminOnly",
+  "SelfService"
+];
+
+function toString(mode) {
+  if (mode === "AdminOnly") {
+    return "adminOnly";
+  } else {
+    return "selfService";
+  }
+}
+
+function fromString(value) {
+  return all.find(m => toString(m) === value);
+}
+
+function allowAdminCreateUserOnly(mode) {
+  return mode === "AdminOnly";
+}
+
+function parse(value) {
+  if (value === undefined) {
+    return {
+      TAG: "Ok",
+      _0: "AdminOnly"
+    };
+  }
+  let mode = fromString(value);
+  if (mode !== undefined) {
+    return {
+      TAG: "Ok",
+      _0: mode
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `signUpMode "` + value + `" is not one of ` + all.map(toString).join(", ") + `. It decides whether a stranger can create an account. An unrecognised spelling refuses rather than defaulting, because defaulting would deploy green and refuse every registration, with nothing pointing back at the spelling.`
+    };
+  }
+}
+
+let $$default = "AdminOnly";
+
+export {
+  $$default as default,
+  all,
+  toString,
+  fromString,
+  allowAdminCreateUserOnly,
+  parse,
+}
+/* No side effect */

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -328,6 +328,11 @@ let capabilities = (): Reventless.Capabilities.t => {
       ~text,
     ),
   messaging: messagingEmailProvider(),
+  // Refusing until the Cognito backend lands. The pool is provisioned, but the
+  // store mapping a domain user id to a provider handle is not, and creating a
+  // principal before that exists would write a handle with nowhere to live.
+  identityProvider: Reventless.Capabilities.none.identityProvider,
+  secrets: ReventlessCore.Secrets_Node_Backend.provider,
 }
 
 // ── Phase-1/phase-2 pipelines ───────────────────────────────────────────────

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res.mjs

@@ -12,9 +12,11 @@ import * as DcbDecode$Reventless from "@reventlessdev/reventless-spec/src/compon
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
+import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
 import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
 import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
 import * as Messaging_Ses_Backend$ReventlessAws from "../Messaging/Messaging_Ses_Backend.res.mjs";
+import * as Secrets_Node_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Secrets/Secrets_Node_Backend.res.mjs";
 import * as Util_DynamoDb_Runtime$ReventlessAws from "../../util/Util_DynamoDb_Runtime.res.mjs";
 import * as Messaging_Log_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Messaging/Messaging_Log_Backend.res.mjs";
 import * as AutomationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/AutomationSlice/AutomationSlice_Callback.res.mjs";
@@ -199,7 +201,9 @@ function messagingEmailProvider() {
 function capabilities() {
   return {
     geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined),
-    messaging: messagingEmailProvider()
+    messaging: messagingEmailProvider(),
+    identityProvider: Capabilities$Reventless.none.identityProvider,
+    secrets: Secrets_Node_Backend$ReventlessCore.provider
   };
 }