@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.347

package/scripts/ProvisionAdmin.res.mjs

@@ -0,0 +1,289 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Util_Password$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Password.res.mjs";
+import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as ProvisionCognito$ReventlessAws from "./ProvisionCognito.res.mjs";
+import * as ProvisionProvider$ReventlessAws from "./ProvisionProvider.res.mjs";
+
+function parseArgs(argv) {
+  let acc = {
+    TAG: "Ok",
+    _0: {
+      providerId: undefined,
+      stack: undefined,
+      email: undefined,
+      help: false
+    }
+  };
+  let i = 0;
+  let count = argv.length;
+  while (i < count) {
+    let flag = argv[i];
+    let value = argv[i + 1 | 0];
+    let match = acc;
+    let exit = 0;
+    if (match.TAG === "Ok") {
+      let a = match._0;
+      let exit$1 = 0;
+      switch (flag) {
+        case "--email" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                providerId: a.providerId,
+                stack: a.stack,
+                email: value,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
+        case "--provider-id" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                providerId: value,
+                stack: a.stack,
+                email: a.email,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
+        case "--stack" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                providerId: a.providerId,
+                stack: value,
+                email: a.email,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            exit = 1;
+          }
+          break;
+        case "--help" :
+        case "-h" :
+          exit$1 = 2;
+          break;
+        default:
+          acc = {
+            TAG: "Error",
+            _0: `unknown argument "` + flag + `"`
+          };
+      }
+      if (exit$1 === 2) {
+        acc = {
+          TAG: "Ok",
+          _0: {
+            providerId: a.providerId,
+            stack: a.stack,
+            email: a.email,
+            help: true
+          }
+        };
+        i = i + 1 | 0;
+      }
+    } else {
+      i = count;
+    }
+    if (exit === 1) {
+      acc = {
+        TAG: "Error",
+        _0: flag + ` needs a value`
+      };
+    }
+  };
+  return acc;
+}
+
+let usage = `
+Make the first administrator of a Reventless deployment.
+
+  --provider-id <id>   The identity provider to create the account in. Usually
+                       omitted: it falls back to ` + ProvisionProvider$ReventlessAws.envKey + `,
+                       then to the identityProviderId exported by the selected
+                       Pulumi stack — which every deployment exports, whether it
+                       created the pool or was handed one.
+  --stack <name>       Read that output from this stack instead of the selected
+                       one. The run always names the stack it used.
+  --email <address>    The address they sign in with.
+
+Creates the "` + AdminGroup$Reventless.name + `" group if it is missing, the account if
+it is missing, a working password, and the membership between them. Provisions
+nothing that a platform stack owns. Region and credentials come from the
+environment, as for any AWS SDK call.
+`;
+
+async function checkPoolAcceptsEmail(providerId) {
+  let e = await ProvisionCognito$ReventlessAws.usernameAttributes(providerId);
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let attributes = e._0;
+  if (attributes.length === 0 || attributes.includes("email")) {
+    console.log(`pool     ` + providerId);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `pool "` + providerId + `" signs in on ` + attributes.join(", ") + `, not email, so an account created from --email could never authenticate. The sign-in attribute is fixed at pool creation and no update can change it.`
+    };
+  }
+}
+
+function describe(outcome) {
+  if (outcome === "Created") {
+    return "created";
+  } else {
+    return "already present";
+  }
+}
+
+async function ensureGroup(providerId, group) {
+  let outcome = await ProvisionCognito$ReventlessAws.ensureGroup(providerId, group, "Reventless administrators");
+  console.log(`group    ` + group + ` (` + describe(outcome) + `)`);
+}
+
+async function ensureUser(providerId, email) {
+  let attributes = [
+    {
+      Name: "email",
+      Value: email
+    },
+    {
+      Name: "email_verified",
+      Value: "true"
+    }
+  ];
+  let outcome = await ProvisionCognito$ReventlessAws.ensureUser(providerId, email, attributes);
+  console.log(`user     ` + email + ` (` + describe(outcome) + `)`);
+}
+
+async function setPassword(providerId, email, password) {
+  await ProvisionCognito$ReventlessAws.setPassword(providerId, email, password);
+  console.log(`password (set, permanent)`);
+}
+
+async function addToGroup(providerId, email, group) {
+  await ProvisionCognito$ReventlessAws.addToGroup(providerId, email, group);
+  console.log(`member   ` + email + ` in ` + group);
+}
+
+let passwordNote = `
+🚨 This is a bootstrap credential and it is printed above because that is the only
+   place it exists — Cognito keeps no recoverable copy. It is now in this
+   terminal's scrollback. Sign in, change it, and do not paste it where logs are
+   kept. Running this again mints a new one.`;
+
+function signInDetails(providerId, email, password, group) {
+  return `
+The first administrator is ready.
+
+  provider   ` + providerId + `
+  sign in as ` + email + `
+  password   ` + password + `
+  group      ` + group + `
+` + passwordNote + `
+
+This script bootstraps the first account only, which is the one that cannot be
+made through a signed-in session because there is no signed-in session yet. The
+rest of the cast is a list rather than a command: declare it in
+.reventless/users.yaml and run \`pnpm exec provision-accounts\`.`;
+}
+
+async function run() {
+  let e = parseArgs(process.argv.slice(2, process.argv.length));
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let args = e._0;
+  if (args.help) {
+    console.log(usage);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  }
+  let email = args.email;
+  if (email === undefined) {
+    return {
+      TAG: "Error",
+      _0: "--email is required — it is the address the administrator signs in with"
+    };
+  }
+  let e$1 = ProvisionProvider$ReventlessAws.resolve(args.providerId, args.stack);
+  if (e$1.TAG !== "Ok") {
+    return e$1;
+  }
+  let match = e$1._0;
+  let providerId = match[0];
+  console.log(`provider ` + providerId + ` (from ` + ProvisionProvider$ReventlessAws.describe(match[1]) + `)`);
+  let e$2 = await checkPoolAcceptsEmail(providerId);
+  if (e$2.TAG !== "Ok") {
+    return e$2;
+  }
+  let password = Util_Password$Reventless.generate();
+  await ensureGroup(providerId, AdminGroup$Reventless.name);
+  await ensureUser(providerId, email);
+  await setPassword(providerId, email, password);
+  await addToGroup(providerId, email, AdminGroup$Reventless.name);
+  console.log(signInDetails(providerId, email, password, AdminGroup$Reventless.name));
+  return {
+    TAG: "Ok",
+    _0: undefined
+  };
+}
+
+async function main() {
+  let message;
+  try {
+    message = await run();
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    console.error(`provision-admin: ` + Util_AwsError$ReventlessAws.describe(exn));
+    process.exit(1);
+    return;
+  }
+  if (message.TAG === "Ok") {
+    return;
+  }
+  console.error(`provision-admin: ` + message._0);
+  process.exit(1);
+}
+
+let Cognito;
+
+export {
+  Cognito,
+  parseArgs,
+  usage,
+  checkPoolAcceptsEmail,
+  describe,
+  ensureGroup,
+  ensureUser,
+  setPassword,
+  addToGroup,
+  passwordNote,
+  signInDetails,
+  run,
+  main,
+}
+/* Util_Password-Reventless Not a pure module */

package/scripts/ProvisionCognito.res

@@ -0,0 +1,149 @@
+/***
+The Cognito operations a provisioning run performs, once.
+
+Two bins now do the same four things — ensure a group, ensure an account, set a
+permanent password, apply a membership — and `provision-admin` did them first.
+Extracted here rather than copied for the reason [Auth_LoginIdentifier] and
+[Auth_SignUpMode] were: a second copy drifts, and the half that drifts is
+whichever one nobody re-reads.
+
+🚨 **These report rather than print.** `provision-admin` has a line format its
+tests and its docs both describe, and an extraction that took the printing with it
+would have changed that script's output while claiming to change nothing. Each
+caller phrases its own run; what is shared is what the API does.
+
+The password generator that used to sit beside these moved further, to
+[Util_Password] in `spec` — the manifest's platform-neutral half needs it, and
+that half must not reach into this package.
+*/
+
+open AwsSdk
+
+module Cognito = CognitoIdentityServiceProvider
+
+/** Whether the call made the thing or found it. Both are success; the difference
+  is only worth a word in the output, and a caller that treats "already there" as
+  a failure makes the second run of a provisioning script an error. */
+type outcome =
+  | Created
+  | AlreadyPresent
+
+/**
+The sign-in attributes a pool was created with.
+
+Fixed at pool creation and unchangeable — see [Auth_LoginIdentifier] — so this is
+the one pool fact a provisioning run must read before it writes. An empty list
+means the pool signs in on a plain username, which takes an email-shaped one
+happily; a list naming `email` means a plain username can never authenticate.
+
+Described rather than assumed because the symptom of getting it wrong is a
+correctly-created account that simply cannot log in, arriving at a login screen
+far from the run that caused it.
+*/
+let usernameAttributes = async (~providerId: string): result<array<string>, string> => {
+  let described = await Cognito.DescribeUserPoolCommand.make({
+    userPoolId: providerId,
+  })->Cognito.DescribeUserPoolCommand.send
+  switch described.userPool {
+  | None => Error(`DescribeUserPool returned nothing for "${providerId}"`)
+  | Some(pool) => Ok(pool.usernameAttributes->Option.getOr([]))
+  }
+}
+
+/** The group, where a stack has not already declared it.
+
+  In auto mode the platform stack declares the administrator group as an ordinary
+  child of the pool it owns, so this is a no-op. On a supplied pool no stack does,
+  because two stacks sharing a provider would both declare it and the second would
+  fail on a name that already exists. Every other group a manifest names is in the
+  same position: nothing else creates it. */
+let ensureGroup = async (~providerId: string, ~group: string, ~description: string): outcome =>
+  try {
+    let _ = await Cognito.CreateGroupCommand.make({
+      groupName: group,
+      userPoolId: providerId,
+      description,
+    })->Cognito.CreateGroupCommand.send
+    Created
+  } catch {
+  | exn if exn->Util_AwsError.hasCode(~code="GroupExistsException") => AlreadyPresent
+  }
+
+/**
+The account, where it is not already there.
+
+`MessageAction: "SUPPRESS"` stops Cognito emailing an invitation. The invitation
+carries the temporary password the run is about to replace, so sending it would
+tell the new account holder to sign in with a credential that no longer works —
+and on an admin-create-only pool these accounts may carry no deliverable address
+at all.
+
+Attributes are the caller's: an administrator created from an email address wants
+`email` and `email_verified` stamped, and a demo account called `shopper` has
+neither and needs none.
+*/
+let ensureUser = async (
+  ~providerId: string,
+  ~username: string,
+  ~attributes: array<Cognito.AdminCreateUserCommand.attributeType>,
+): outcome =>
+  try {
+    let _ = await Cognito.AdminCreateUserCommand.make({
+      userPoolId: providerId,
+      username,
+      userAttributes: attributes,
+      messageAction: "SUPPRESS",
+    })->Cognito.AdminCreateUserCommand.send
+    Created
+  } catch {
+  | exn if exn->Util_AwsError.hasCode(~code="UsernameExistsException") => AlreadyPresent
+  }
+
+/**
+A password the account can actually be used with.
+
+🚨 **The step it is easiest to leave out, and leaving it out reproduces the defect
+these scripts exist to remove.** An administrator-created account holds a
+*temporary* password and lands in `FORCE_CHANGE_PASSWORD`: the first sign-in meets
+a `NEW_PASSWORD_REQUIRED` challenge, which the host UI is not known to handle and
+which the seed client rejects outright — it gets a `ChallengeName` where it
+expects a token. So this sets a permanent password, and the account is `CONFIRMED`
+when it returns.
+*/
+let setPassword = async (~providerId: string, ~username: string, ~password: string): unit =>
+  await Cognito.AdminSetUserPasswordCommand.make({
+    userPoolId: providerId,
+    username,
+    password,
+    permanent: true,
+  })->Cognito.AdminSetUserPasswordCommand.send
+
+/** Idempotent at the API: adding a user already in the group is not an error, so
+  this needs no existence check of its own. */
+let addToGroup = async (~providerId: string, ~username: string, ~group: string): unit =>
+  await Cognito.AdminAddUserToGroupCommand.make({
+    username,
+    groupName: group,
+    userPoolId: providerId,
+  })->Cognito.AdminAddUserToGroupCommand.send
+
+/**
+The id the pool minted for an account.
+
+No request supplies it and `AdminCreateUser` does not return it, so it is read
+back — the same way for an account this run just made and one that was already
+there, which is what lets a re-run correct a manifest written by hand.
+
+`None` when the pool answers without a `sub`, which should not happen; the caller
+reports it rather than writing a blank id into a file that is read as authority.
+*/
+let subOf = async (~providerId: string, ~username: string): option<string> => {
+  let user = await Cognito.AdminGetUserCommand.make({
+    userPoolId: providerId,
+    username,
+  })->Cognito.AdminGetUserCommand.send
+  user.userAttributes
+  ->Option.getOr([])
+  ->Array.find(attribute => attribute.name == "sub")
+  ->Option.map(attribute => attribute.value)
+}

package/scripts/ProvisionCognito.res.mjs

@@ -0,0 +1,98 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+
+async function usernameAttributes(providerId) {
+  let described = await CognitoIdentityServiceProvider$AwsSdk.DescribeUserPoolCommand.send(new ClientCognitoIdentityProvider.DescribeUserPoolCommand({
+    UserPoolId: providerId
+  }));
+  let pool = described.UserPool;
+  if (pool !== undefined) {
+    return {
+      TAG: "Ok",
+      _0: Stdlib_Option.getOr(pool.UsernameAttributes, [])
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: `DescribeUserPool returned nothing for "` + providerId + `"`
+    };
+  }
+}
+
+async function ensureGroup(providerId, group, description) {
+  try {
+    await CognitoIdentityServiceProvider$AwsSdk.CreateGroupCommand.send(new ClientCognitoIdentityProvider.CreateGroupCommand({
+      GroupName: group,
+      UserPoolId: providerId,
+      Description: description
+    }));
+    return "Created";
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.hasCode(exn, "GroupExistsException")) {
+      return "AlreadyPresent";
+    }
+    throw exn;
+  }
+}
+
+async function ensureUser(providerId, username, attributes) {
+  try {
+    await CognitoIdentityServiceProvider$AwsSdk.AdminCreateUserCommand.send(new ClientCognitoIdentityProvider.AdminCreateUserCommand({
+      UserPoolId: providerId,
+      Username: username,
+      UserAttributes: attributes,
+      MessageAction: "SUPPRESS"
+    }));
+    return "Created";
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.hasCode(exn, "UsernameExistsException")) {
+      return "AlreadyPresent";
+    }
+    throw exn;
+  }
+}
+
+async function setPassword(providerId, username, password) {
+  return await CognitoIdentityServiceProvider$AwsSdk.AdminSetUserPasswordCommand.send(new ClientCognitoIdentityProvider.AdminSetUserPasswordCommand({
+    UserPoolId: providerId,
+    Username: username,
+    Password: password,
+    Permanent: true
+  }));
+}
+
+async function addToGroup(providerId, username, group) {
+  return await CognitoIdentityServiceProvider$AwsSdk.AdminAddUserToGroupCommand.send(new ClientCognitoIdentityProvider.AdminAddUserToGroupCommand({
+    Username: username,
+    GroupName: group,
+    UserPoolId: providerId
+  }));
+}
+
+async function subOf(providerId, username) {
+  let user = await CognitoIdentityServiceProvider$AwsSdk.AdminGetUserCommand.send(new ClientCognitoIdentityProvider.AdminGetUserCommand({
+    UserPoolId: providerId,
+    Username: username
+  }));
+  return Stdlib_Option.map(Stdlib_Option.getOr(user.UserAttributes, []).find(attribute => attribute.Name === "sub"), attribute => attribute.Value);
+}
+
+let Cognito;
+
+export {
+  Cognito,
+  usernameAttributes,
+  ensureGroup,
+  ensureUser,
+  setPassword,
+  addToGroup,
+  subOf,
+}
+/* Util_AwsError-ReventlessAws Not a pure module */

package/scripts/ProvisionIdentity.res

@@ -38,6 +38,8 @@ module Schema = Auth_ActiveRoleStore_Schema
 type args = {
   poolName: string,
   providerId: option<string>,
+  loginIdentifier: Auth_LoginIdentifier.t,
+  signUpMode: Auth_SignUpMode.t,
   help: bool,
 }
 
@@ -47,7 +49,15 @@ let defaultPoolName = "ReventlessIdentity"
   `--provider-id` that parsed as "absent" would create a *second* pool beside the
   one the operator meant to extend. */
 let parseArgs = (argv: array<string>): result<args, string> => {
-  let acc = ref(Ok({poolName: defaultPoolName, providerId: None, help: false}))
+  let acc = ref(
+    Ok({
+      poolName: defaultPoolName,
+      providerId: None,
+      loginIdentifier: Auth_LoginIdentifier.default,
+      signUpMode: Auth_SignUpMode.default,
+      help: false,
+    }),
+  )
   let i = ref(0)
   let count = argv->Array.length
   while i.contents < count {
@@ -61,10 +71,23 @@ let parseArgs = (argv: array<string>): result<args, string> => {
     | (Ok(a), "--provider-id", Some(v)) =>
       acc := Ok({...a, providerId: Some(v)})
       i := i.contents + 2
+    | (Ok(a), "--login-identifier", Some(v)) =>
+      acc :=
+        Auth_LoginIdentifier.parse(Some(v))->Result.map(loginIdentifier => {
+          ...a,
+          loginIdentifier,
+        })
+      i := i.contents + 2
+    | (Ok(a), "--sign-up-mode", Some(v)) =>
+      acc := Auth_SignUpMode.parse(Some(v))->Result.map(signUpMode => {...a, signUpMode})
+      i := i.contents + 2
     | (Ok(a), "--help", _) | (Ok(a), "-h", _) =>
       acc := Ok({...a, help: true})
       i := i.contents + 1
-    | (Ok(_), "--name", None) | (Ok(_), "--provider-id", None) =>
+    | (Ok(_), "--name", None)
+    | (Ok(_), "--provider-id", None)
+    | (Ok(_), "--login-identifier", None)
+    | (Ok(_), "--sign-up-mode", None) =>
       acc := Error(`${flag} needs a value`)
     | (Ok(_), unknown, _) => acc := Error(`unknown argument "${unknown}"`)
     }
@@ -72,12 +95,28 @@ let parseArgs = (argv: array<string>): result<args, string> => {
   acc.contents
 }
 
+let _loginIdentifiers =
+  Auth_LoginIdentifier.all->Array.map(Auth_LoginIdentifier.toString)->Array.join(" | ")
+
+let _defaultLoginIdentifier = Auth_LoginIdentifier.toString(Auth_LoginIdentifier.default)
+
+let _signUpModes = Auth_SignUpMode.all->Array.map(Auth_SignUpMode.toString)->Array.join(" | ")
+
+let _defaultSignUpMode = Auth_SignUpMode.toString(Auth_SignUpMode.default)
+
 let usage = `
 Provision a Reventless identity provider and its active-role store.
 
   --name <name>          Pool name to create or adopt (default: ${defaultPoolName})
   --provider-id <id>     Use this existing pool instead of creating one; only the
                          store is provisioned
+  --login-identifier <a> Sign-in attribute for a pool this creates: ${_loginIdentifiers}
+                         (default: ${_defaultLoginIdentifier}). Fixed at creation —
+                         no later change is possible without replacing the pool
+                         and losing every account in it.
+  --sign-up-mode <m>     Whether a stranger may register themselves: ${_signUpModes}
+                         (default: ${_defaultSignUpMode}). Correctable later, but on a
+                         pool shared between stacks it applies to all of them.
 
 Creates nothing that a platform stack owns, and never attaches a trigger.
 Region and credentials come from the environment, as for any AWS SDK call.
@@ -85,17 +124,28 @@ Region and credentials come from the environment, as for any AWS SDK call.
 
 // ── The pool ─────────────────────────────────────────────────────────────────
 
-/** SPA-friendly defaults, matching what auto mode declares: email sign-in, a
-  12-character password policy, no MFA, admin-only user creation. An operator
-  wanting something else edits the pool afterwards rather than having this script
-  grow a flag per Cognito setting. */
+/** SPA-friendly defaults, matching what auto mode declares: a 12-character
+  password policy, no MFA, admin-only user creation. An operator wanting
+  something else edits the pool afterwards rather than having this script grow a
+  flag per Cognito setting.
+
+  Two settings are exceptions and have flags, for two different reasons. The
+  sign-in attribute, because it is the one setting no later edit can reach —
+  Cognito offers no update for it. Sign-up mode, because a stack pointed at a
+  supplied pool holds no handle to set it on, so "edit it afterwards" is the only
+  other answer and it leaves the pool's two identity choices in two places. Both
+  describe the pool itself rather than a policy detail. */
 let poolSettings = (
   ~poolName: string,
+  ~loginIdentifier: Auth_LoginIdentifier.t,
+  ~signUpMode: Auth_SignUpMode.t,
 ): CognitoIdentityServiceProvider.CreateUserPoolCommand.input => {
   poolName,
-  usernameAttributes: ["email"],
+  usernameAttributes: loginIdentifier->Auth_LoginIdentifier.usernameAttributes,
   mfaConfiguration: "OFF",
-  adminCreateUserConfig: {allowAdminCreateUserOnly: true},
+  adminCreateUserConfig: {
+    allowAdminCreateUserOnly: signUpMode->Auth_SignUpMode.allowAdminCreateUserOnly,
+  },
   policies: {
     passwordPolicy: {
       minimumLength: 12,
@@ -169,12 +219,20 @@ let resolvePool = async (~args: args): result<string, string> =>
       Ok(existing)
     | Ok(None) =>
       let created = await CognitoIdentityServiceProvider.CreateUserPoolCommand.make(
-        poolSettings(~poolName=args.poolName),
+        poolSettings(
+          ~poolName=args.poolName,
+          ~loginIdentifier=args.loginIdentifier,
+          ~signUpMode=args.signUpMode,
+        ),
       )->CognitoIdentityServiceProvider.CreateUserPoolCommand.send
       switch created.userPool->Option.flatMap(p => p.id) {
       | None => Error("CreateUserPool returned no pool id")
       | Some(id) =>
-        Console.log(`pool     ${id} (created, named "${args.poolName}")`)
+        Console.log(
+          `pool     ${id} (created, named "${args.poolName}", sign-in on ${Auth_LoginIdentifier.toString(
+              args.loginIdentifier,
+            )}, sign-up ${Auth_SignUpMode.toString(args.signUpMode)})`,
+        )
         Ok(id)
       }
     }
@@ -260,7 +318,14 @@ or set REVENTLESS_IDENTITY_PROVIDER_ID in CI. Every stack on this provider
 derives the same store, so there is nothing else to configure.
 
 The pre-token-generation trigger is attached by the deploy, not by this script.
-Users and groups are yours to create.`
+
+Once a stack has deployed against this provider, make the first administrator:
+
+  pnpm exec provision-admin --provider-id ${providerId} --email you@example.com
+
+That is a separate bin because it provisions nothing a stack owns, and because it
+is needed on a pool created here and on one a stack created for itself alike. See
+[ProvisionAdmin].`
 
 let run = async (): result<unit, string> =>
   // argv[0] is node, argv[1] this script.