@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.347

package/src/Platform.res.mjs

@@ -16,7 +16,9 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
@@ -150,6 +152,7 @@ let messagingEmailProviderRef = {
 };
 
 function MakeWithConfig(Config) {
+  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -211,7 +214,7 @@ function MakeWithConfig(Config) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), "Admin", undefined);
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), AdminGroup$Reventless.name, undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -870,7 +873,7 @@ function MakeWithConfig(Config) {
       }
     });
     PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, Config.cloner, undefined);
-    let offloadProtection = Util_StoreLayout$ReventlessAws.protectionFor(Pulumi.getStack(), undefined);
+    let offloadProtection = Util_StoreLayout$ReventlessAws.protectionOfDeployedStack();
     let offloadBucket = new (Aws.s3.Bucket)("reventless-offload", {
       forceDestroy: offloadProtection === "Unprotected",
       tags: AWS_Tags$ReventlessAws.make("reventless-offload", "Platform", {
@@ -889,6 +892,7 @@ function MakeWithConfig(Config) {
       restrictPublicBuckets: true
     });
     Pulumi$Pulumi.$$export("offloadBucket", offloadBucketName);
+    Pulumi$Pulumi.$$export("platformStack", Pulumi.output(Pulumi.getOrganization() + `/` + Pulumi.getProject() + `/` + Pulumi.getStack()));
     let componentDefinitions = pluginReadModelTableName !== undefined ? (AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName), Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), {})) : undefined;
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
@@ -966,7 +970,7 @@ function MakeWithConfig(Config) {
     });
     let stackName = Pulumi.getStack();
     let storeLayout = Util_StoreLayout$ReventlessAws.layoutFor(stackName, Util_HostUiDomain$ReventlessAws.resolveProdStacks());
-    let storeProtection = Util_StoreLayout$ReventlessAws.protectionFor(stackName, undefined);
+    let storeProtection = Util_StoreLayout$ReventlessAws.protectionOfDeployedStack();
     let declaredStores = Stdlib_Array.reduce(Stdlib_Array.filterMap(capabilities, c => {
       if (typeof c !== "object") {
         return;
@@ -1324,6 +1328,9 @@ function MakeWithConfig(Config) {
   let startServers = () => {};
   let deployPlugin = (plugin, apiTargetOpt) => {
     let apiTarget = apiTargetOpt !== undefined ? apiTargetOpt : "Domain";
+    if (Stdlib_Option.isNone(platformStackRef)) {
+      Stdlib_JsError.throwWithMessage(`This plugin stack has no platform:stack setting, so it cannot find its platform. Set it to the platform's stack: pulumi config set platform:stack ` + (Pulumi.getOrganization() + `/<platform project>/` + Pulumi.getStack()));
+    }
     let tmp;
     tmp = apiTarget === "Domain" ? "Domain" : "Platform";
     log.info("Platform:deployPlugin", undefined, `target=` + tmp);
@@ -1439,10 +1446,13 @@ function MakeWithConfig(Config) {
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
-            if (match === "Geocoding") {
-              return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
-            } else {
-              return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+            switch (match) {
+              case "Geocoding" :
+                return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
+              case "Messaging" :
+                return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+              case "IdentityProvider" :
+                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
             }
           }))).join(""));
         }
@@ -1550,6 +1560,7 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let commandHandlerConfig = {};
+  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
   Stdlib_Option.forEach(commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -1611,7 +1622,7 @@ function Make($star) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), "Admin", undefined);
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), AdminGroup$Reventless.name, undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -2253,7 +2264,7 @@ function Make($star) {
       }
     });
     PluginRuntime_Builder$ReventlessAws.registerConfig(pluginEpEventTopicArn, pluginReadModelTableName, hooks_schedulerRoleUrn.contents, undefined, undefined, domainApiId, false, undefined);
-    let offloadProtection = Util_StoreLayout$ReventlessAws.protectionFor(Pulumi.getStack(), undefined);
+    let offloadProtection = Util_StoreLayout$ReventlessAws.protectionOfDeployedStack();
     let offloadBucket = new (Aws.s3.Bucket)("reventless-offload", {
       forceDestroy: offloadProtection === "Unprotected",
       tags: AWS_Tags$ReventlessAws.make("reventless-offload", "Platform", {
@@ -2272,6 +2283,7 @@ function Make($star) {
       restrictPublicBuckets: true
     });
     Pulumi$Pulumi.$$export("offloadBucket", offloadBucketName);
+    Pulumi$Pulumi.$$export("platformStack", Pulumi.output(Pulumi.getOrganization() + `/` + Pulumi.getProject() + `/` + Pulumi.getStack()));
     let componentDefinitions = pluginReadModelTableName !== undefined ? (AggregateRuntime_Builder_Single$ReventlessAws.setPluginReadModelTable(pluginReadModelTableName), Platform_ComponentDefinitions_Lambda$ReventlessAws.make(platformApi, pluginReadModelTableName, offloadBucketName, admin.adminSchemaPushed, Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest), {})) : undefined;
     let rm = admin.stateViewSlicesOutputs["UiFragments"];
     if (rm !== undefined) {
@@ -2343,7 +2355,7 @@ function Make($star) {
     });
     let stackName = Pulumi.getStack();
     let storeLayout = Util_StoreLayout$ReventlessAws.layoutFor(stackName, Util_HostUiDomain$ReventlessAws.resolveProdStacks());
-    let storeProtection = Util_StoreLayout$ReventlessAws.protectionFor(stackName, undefined);
+    let storeProtection = Util_StoreLayout$ReventlessAws.protectionOfDeployedStack();
     let declaredStores = Stdlib_Array.reduce(Stdlib_Array.filterMap(capabilities, c => {
       if (typeof c !== "object") {
         return;
@@ -2699,6 +2711,9 @@ function Make($star) {
   let startServers = () => {};
   let deployPlugin = (plugin, apiTargetOpt) => {
     let apiTarget = apiTargetOpt !== undefined ? apiTargetOpt : "Domain";
+    if (Stdlib_Option.isNone(platformStackRef)) {
+      Stdlib_JsError.throwWithMessage(`This plugin stack has no platform:stack setting, so it cannot find its platform. Set it to the platform's stack: pulumi config set platform:stack ` + (Pulumi.getOrganization() + `/<platform project>/` + Pulumi.getStack()));
+    }
     let tmp;
     tmp = apiTarget === "Domain" ? "Domain" : "Platform";
     log.info("Platform:deployPlugin", undefined, `target=` + tmp);
@@ -2814,10 +2829,13 @@ function Make($star) {
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
-            if (match === "Geocoding") {
-              return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
-            } else {
-              return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+            switch (match) {
+              case "Geocoding" :
+                return `\n  Geocoding is \`Capability_Geocoding_AwsLocation.make\`, passed to the platform as \`~geocoderPlaceIndex\`.`;
+              case "Messaging" :
+                return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
+              case "IdentityProvider" :
+                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
             }
           }))).join(""));
         }

package/src/Platform_Stack.res

@@ -12,15 +12,24 @@ type cognitoUserPool = {
     is declared with the trigger's ARN), while the mutation that writes it is
     provisioned after the API — see [Auth_ActiveRoleStore.res]. */
   activeRoleTable: Auth_ActiveRoleStore.storeTable,
+  /** The sign-in attribute this stack created the pool with. `None` in BYO mode:
+    the pool's own choice was made elsewhere and no lookup here reads it back,
+    so reporting one would be a guess. */
+  loginIdentifier: option<Auth_LoginIdentifier.t>,
 }
 
 /**
  * Resolve the Cognito UserPool used by AppSync auth. Two modes:
  *
  * - **Auto**: no `platform:identityProviderId` config — create a fresh UserPool
- *   with SPA-friendly defaults (email username, 12-char password policy, no
- *   MFA, admin-only user creation). Caller is responsible for creating
- *   groups (`Admin`, `User`, …) and users via the AWS console / CLI.
+ *   with SPA-friendly defaults (email sign-in unless `platform:loginIdentifier`
+ *   says otherwise, 12-char password policy, no MFA, and admin-only user
+ *   creation unless `platform:signUpMode` says otherwise), plus the
+ *   administrator group named by [Reventless.AdminGroup] and an elevated-groups
+ *   default naming it. What it does **not** create is the first administrator:
+ *   accounts are not stack resources, and a pool full of them is not something a
+ *   `pulumi destroy` should be able to empty. `provision-admin` makes that one,
+ *   and no step of this needs the AWS console.
  *
  * - **BYO**: provider ID provided — skip pool creation, look up the existing
  *   pool via `aws.cognito.getUserPool` for its ARN. Lookup precedence
@@ -38,10 +47,21 @@ type cognitoUserPool = {
  * Pulumi can destroy without touching the parent pool).
  *
  * Always exports `identityProviderId`, `identityProviderClientId`,
- * `identityProviderArn`, `identityProviderRegion`, `identityProviderManaged` and
- * `activeRoleStore` as stack outputs so downstream stacks (and Stage D AppSync
- * wiring) can read them via `StackReference` — plus, for one release, the
- * deprecated `cognito*` spellings of the first five.
+ * `identityProviderArn`, `identityProviderRegion`, `identityProviderManaged`,
+ * `identityProviderLoginIdentifier`, `identityProviderAdminGroup` and
+ * `activeRoleStore` as stack outputs so
+ * downstream stacks (and Stage D AppSync wiring) can read them via
+ * `StackReference` — plus, for one release, the deprecated `cognito*` spellings
+ * of the first five.
+ *
+ * 🚨 In auto mode `platform:loginIdentifier` picks the sign-in attribute, and it
+ * is the one setting no later deploy can correct: changing it replaces the pool
+ * and empties it. Absent means `email`. See [Auth_LoginIdentifier].
+ *
+ * `platform:signUpMode` decides whether a stranger may register themselves.
+ * Absent means `adminOnly`. It is the opposite kind of setting — an ordinary
+ * in-place update, free and reversible on a pool full of accounts — but on a
+ * pool shared between stacks the flip is pool-wide. See [Auth_SignUpMode].
  *
  * Also provisions the role-state table and the pre-token-generation trigger that
  * narrows `cognito:groups` to a caller's chosen role. They belong here rather
@@ -86,6 +106,42 @@ let _identityProviderId = (~cfg: Pulumi.Config.t): option<string> => {
   }
 }
 
+/** The sign-in attribute for a pool this stack creates, from
+  `platform:loginIdentifier` (or `REVENTLESS_LOGIN_IDENTIFIER` / the sidecar).
+
+  Absent means `email`, which is what every pool so far was created with. An
+  unrecognised spelling fails the deploy — see [Auth_LoginIdentifier] for why
+  defaulting past a typo here is unrecoverable. */
+let _loginIdentifier = (~cfg: Pulumi.Config.t): Auth_LoginIdentifier.t => {
+  let raw = switch Util_LocalConfig.get("loginIdentifier") {
+  | Some(_) as v => v
+  | None => cfg->Pulumi.Config.get("loginIdentifier")
+  }
+  switch Auth_LoginIdentifier.parse(raw) {
+  | Ok(identifier) => identifier
+  | Error(message) => JsError.throwWithMessage(message)
+  }
+}
+
+/** Whether a stranger may create their own account in a pool this stack creates,
+  from `platform:signUpMode` (or `REVENTLESS_SIGN_UP_MODE` / the sidecar).
+
+  Absent means `adminOnly`, which is what every pool so far was created with, so
+  an existing stack redeploys unchanged. Unlike the sign-in attribute this is an
+  ordinary in-place update on a live pool — but an unrecognised spelling still
+  fails the deploy, because defaulting past it would refuse every registration
+  while the config read as if it allowed them. See [Auth_SignUpMode]. */
+let _signUpMode = (~cfg: Pulumi.Config.t): Auth_SignUpMode.t => {
+  let raw = switch Util_LocalConfig.get("signUpMode") {
+  | Some(_) as v => v
+  | None => cfg->Pulumi.Config.get("signUpMode")
+  }
+  switch Auth_SignUpMode.parse(raw) {
+  | Ok(mode) => mode
+  | Error(message) => JsError.throwWithMessage(message)
+  }
+}
+
 let _resolveUncached = (): cognitoUserPool => {
   let cfg = Pulumi.Config.make(Some("platform"))
   let existingPoolId = _identityProviderId(~cfg)
@@ -183,11 +239,19 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: lookup->Pulumi.Output.apply(r => r.arn),
       managed: false,
       activeRoleTable,
+      loginIdentifier: None,
     }
 
   | None =>
+    let loginIdentifier = _loginIdentifier(~cfg)
+    let signUpMode = _signUpMode(~cfg)
+    // In place, unlike the sign-in attribute below: `AdminCreateUserConfig` is a
+    // member of `UpdateUserPoolRequest`, so flipping this on a pool full of
+    // accounts is an ordinary update rather than a replacement.
     let adminConfig: PulumiAws.Cognito.UserPool.adminCreateUserConfig = {
-      allowAdminCreateUserOnly: Pulumi.Input.make(true),
+      allowAdminCreateUserOnly: Pulumi.Input.make(
+        signUpMode->Auth_SignUpMode.allowAdminCreateUserOnly,
+      ),
     }
     let pwdPolicy: PulumiAws.Cognito.UserPool.passwordPolicy = {
       minimumLength: Pulumi.Input.make(12),
@@ -204,7 +268,13 @@ let _resolveUncached = (): cognitoUserPool => {
       ~name="HostUiPool",
       ~args={
         adminCreateUserConfig: Pulumi.Input.make(adminConfig),
-        usernameAttributes: Pulumi.Input.make([Pulumi.Input.make("email")]),
+        // 🚨 Changing this on a live stack replaces the pool and empties it —
+        // Cognito has no update for the sign-in attribute. Chosen once, here.
+        usernameAttributes: Pulumi.Input.make(
+          loginIdentifier
+          ->Auth_LoginIdentifier.usernameAttributes
+          ->Array.map(Pulumi.Input.make),
+        ),
         passwordPolicy: Pulumi.Input.make(pwdPolicy),
         mfaConfiguration: Pulumi.Input.make("OFF"),
         lambdaConfig: Pulumi.Input.make({
@@ -219,6 +289,23 @@ let _resolveUncached = (): cognitoUserPool => {
       },
     )
 
+    // The administrator group, declared beside the pool that holds it.
+    //
+    // Auto mode only, and the restriction is the point: a group is a pool-level
+    // fact, and on a pool this stack does not own those are not this stack's to
+    // declare. Two stacks pointed at one shared provider would each declare this
+    // group, and the second would fail on a name that already exists — the same
+    // split, for the same reason, as [Auth_SignUpMode] and the active-role store.
+    // The BYO half is `provision-admin`, which creates the group beside the first
+    // administrator who needs it.
+    //
+    // An ordinary child resource: the pool is ours, so this needs no out-of-band
+    // call and Pulumi's state stays the authority for whether it exists.
+    let _adminGroup = Util_CognitoGroupUser.addUserGroup(
+      ~name=Reventless.AdminGroup.name,
+      ~userPoolId=pool.id,
+    )
+
     let tokenUnits2: PulumiAws.Cognito.UserPoolClient.tokenValidityUnits = {
       accessToken: Pulumi.Input.make("minutes"),
       idToken: Pulumi.Input.make("minutes"),
@@ -247,6 +334,7 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: pool.arn,
       managed: true,
       activeRoleTable,
+      loginIdentifier: Some(loginIdentifier),
     }
   }
 
@@ -279,11 +367,23 @@ let _resolveUncached = (): cognitoUserPool => {
   let managedStr = Pulumi.Output.make(result.managed ? "true" : "false")
   let regionOutput = Pulumi.Output.make(regionStr)
 
+  // The sign-in attribute is unchangeable after creation, so the value a pool was
+  // born with has to be readable somewhere other than the source that has since
+  // moved on. `unknown` for a BYO pool: this stack did not choose it and does not
+  // read it back.
+  let loginIdentifierStr = Pulumi.Output.make(
+    switch result.loginIdentifier {
+    | Some(identifier) => Auth_LoginIdentifier.toString(identifier)
+    | None => "unknown"
+    },
+  )
+
   Pulumi.Pulumi.export("identityProviderId", result.poolId)
   Pulumi.Pulumi.export("identityProviderClientId", result.clientId)
   Pulumi.Pulumi.export("identityProviderArn", result.poolArn)
   Pulumi.Pulumi.export("identityProviderRegion", regionOutput)
   Pulumi.Pulumi.export("identityProviderManaged", managedStr)
+  Pulumi.Pulumi.export("identityProviderLoginIdentifier", loginIdentifierStr)
 
   // Deprecated spellings — see above.
   Pulumi.Pulumi.export("cognitoUserPoolId", result.poolId)
@@ -292,6 +392,16 @@ let _resolveUncached = (): cognitoUserPool => {
   Pulumi.Pulumi.export("cognitoRegion", regionOutput)
   Pulumi.Pulumi.export("cognitoUserPoolManaged", managedStr)
 
+  // The group that administers this deployment, readable without reading source.
+  // `provision-admin` puts its first user in it, and a deployment overriding who
+  // is elevated needs to know which name it is overriding.
+  //
+  // Exported in both pool modes although only auto mode *declares* the group: the
+  // name is what a caller needs either way, and an output that appeared in one
+  // mode and not the other would read as "there is no administrator group here"
+  // rather than "this stack did not create it".
+  Pulumi.Pulumi.export("identityProviderAdminGroup", Pulumi.Output.make(Reventless.AdminGroup.name))
+
   // Exported so an operator can read back the store this provider resolved to —
   // the name is derived, not configured, so this is a convenience for checking
   // rather than a value anything is meant to copy into a config.

package/src/Platform_Stack.res.mjs

@@ -4,10 +4,15 @@ import * as Aws from "@pulumi/aws";
 import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
+import * as Auth_SignUpMode$ReventlessAws from "./adapter/Auth/Auth_SignUpMode.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
 import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
+import * as Auth_LoginIdentifier$ReventlessAws from "./adapter/Auth/Auth_LoginIdentifier.res.mjs";
+import * as Util_CognitoGroupUser$ReventlessAws from "./util/Util_CognitoGroupUser.res.mjs";
 import * as Auth_ActiveRoleTrigger$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleTrigger.res.mjs";
 import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "./adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
 
@@ -35,6 +40,28 @@ function _identityProviderId(cfg) {
   }
 }
 
+function _loginIdentifier(cfg) {
+  let v = Util_LocalConfig$ReventlessAws.get("loginIdentifier");
+  let raw = v !== undefined ? v : cfg.get("loginIdentifier");
+  let identifier = Auth_LoginIdentifier$ReventlessAws.parse(raw);
+  if (identifier.TAG === "Ok") {
+    return identifier._0;
+  } else {
+    return Stdlib_JsError.throwWithMessage(identifier._0);
+  }
+}
+
+function _signUpMode(cfg) {
+  let v = Util_LocalConfig$ReventlessAws.get("signUpMode");
+  let raw = v !== undefined ? v : cfg.get("signUpMode");
+  let mode = Auth_SignUpMode$ReventlessAws.parse(raw);
+  if (mode.TAG === "Ok") {
+    return mode._0;
+  } else {
+    return Stdlib_JsError.throwWithMessage(mode._0);
+  }
+}
+
 function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
   let existingPoolId = _identityProviderId(cfg);
@@ -77,11 +104,14 @@ function _resolveUncached() {
       clientId: client.id,
       poolArn: lookup.apply(r => r.arn),
       managed: false,
-      activeRoleTable: activeRoleTable
+      activeRoleTable: activeRoleTable,
+      loginIdentifier: undefined
     };
   } else {
+    let loginIdentifier = _loginIdentifier(cfg);
+    let signUpMode = _signUpMode(cfg);
     let adminConfig = {
-      allowAdminCreateUserOnly: true
+      allowAdminCreateUserOnly: Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly(signUpMode)
     };
     let pwdPolicy_minimumLength = 12;
     let pwdPolicy_requireLowercase = true;
@@ -98,11 +128,12 @@ function _resolveUncached() {
         preTokenGeneration: activeRoleTrigger.functionArn
       },
       adminCreateUserConfig: adminConfig,
-      usernameAttributes: ["email"],
+      usernameAttributes: Auth_LoginIdentifier$ReventlessAws.usernameAttributes(loginIdentifier).map(prim => prim),
       passwordPolicy: pwdPolicy,
       mfaConfiguration: "OFF",
       tags: AWS_Tags$ReventlessAws.make("HostUiPool", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined)
     });
+    Util_CognitoGroupUser$ReventlessAws.addUserGroup(AdminGroup$Reventless.name, pool.id);
     let tokenUnits2_accessToken = "minutes";
     let tokenUnits2_idToken = "minutes";
     let tokenUnits2_refreshToken = "days";
@@ -129,23 +160,28 @@ function _resolveUncached() {
       clientId: client$1.id,
       poolArn: pool.arn,
       managed: true,
-      activeRoleTable: activeRoleTable
+      activeRoleTable: activeRoleTable,
+      loginIdentifier: loginIdentifier
     };
   }
   Auth_ActiveRoleTrigger$ReventlessAws.grantInvoke(activeRoleTrigger, result.poolArn, undefined, {});
   let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
   let managedStr = Pulumi.output(result.managed ? "true" : "false");
   let regionOutput = Pulumi.output(regionStr);
+  let identifier = result.loginIdentifier;
+  let loginIdentifierStr = Pulumi.output(identifier !== undefined ? Auth_LoginIdentifier$ReventlessAws.toString(identifier) : "unknown");
   Pulumi$Pulumi.$$export("identityProviderId", result.poolId);
   Pulumi$Pulumi.$$export("identityProviderClientId", result.clientId);
   Pulumi$Pulumi.$$export("identityProviderArn", result.poolArn);
   Pulumi$Pulumi.$$export("identityProviderRegion", regionOutput);
   Pulumi$Pulumi.$$export("identityProviderManaged", managedStr);
+  Pulumi$Pulumi.$$export("identityProviderLoginIdentifier", loginIdentifierStr);
   Pulumi$Pulumi.$$export("cognitoUserPoolId", result.poolId);
   Pulumi$Pulumi.$$export("cognitoUserPoolClientId", result.clientId);
   Pulumi$Pulumi.$$export("cognitoUserPoolArn", result.poolArn);
   Pulumi$Pulumi.$$export("cognitoRegion", regionOutput);
   Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
+  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(AdminGroup$Reventless.name));
   Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
   return result;
 }
@@ -168,6 +204,8 @@ export {
   log,
   _deprecatedPoolIdKey,
   _identityProviderId,
+  _loginIdentifier,
+  _signUpMode,
   _resolveUncached,
   _cached,
   resolveCognitoUserPool,

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -217,11 +217,7 @@ let make = (
     ~bundleRuntimeExtensions=false,
   )
 
-  let layers =
-    Lambda.reventlessLayerArn
-    ->Option.map(arn => [arn->Pulumi.Input.make])
-    ->Option.getOr([])
-    ->Pulumi.Input.make
+  let layers = Lambda.reventlessLayers()
 
   // Created before the function that writes to it — see
   // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -116,7 +116,7 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
       "adminEntry.json",
       adminEntryJson
     ]]), false);
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",

package/src/adapter/Api/Platform_UIFragments_Lambda.res

@@ -89,11 +89,7 @@ let make = (
     ~bundleRuntimeExtensions=false,
   )
 
-  let layers =
-    Lambda.reventlessLayerArn
-    ->Option.map(arn => [arn->Pulumi.Input.make])
-    ->Option.getOr([])
-    ->Pulumi.Input.make
+  let layers = Lambda.reventlessLayers()
 
   // Created before the function that writes to it — see
   // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.

package/src/adapter/Api/Platform_UIFragments_Lambda.res.mjs

@@ -3,7 +3,6 @@
 import * as Aws from "@pulumi/aws";
 import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
@@ -53,7 +52,7 @@ function make(api, uiFragmentRegistryTableName, schemaReady, opts) {
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Api/Platform_UIFragments_Lambda_Ops.res.mjs", packageDirs, undefined, false);
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",

package/src/adapter/Auth/Auth_ActiveRoleStore.res

@@ -261,11 +261,7 @@ let makeWriteDoor = (
     ~bundleRuntimeExtensions=false,
   )
 
-  let layers =
-    Lambda.reventlessLayerArn
-    ->Option.map(arn => [arn->Pulumi.Input.make])
-    ->Option.getOr([])
-    ->Pulumi.Input.make
+  let layers = Lambda.reventlessLayers()
 
   let logGroup = Util_LambdaLogging.makeManagedLogGroup(
     ~name=name ++ "Lambda",

package/src/adapter/Auth/Auth_ActiveRoleStore.res.mjs

@@ -3,7 +3,6 @@
 import * as Aws from "@pulumi/aws";
 import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
 import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
@@ -136,7 +135,7 @@ function makeWriteDoor(api, table, cognitoUserPoolId, cognitoUserPoolArn, nameOp
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs", packageDirs, undefined, false);
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res

@@ -99,11 +99,7 @@ let make = (
     ~bundleRuntimeExtensions=false,
   )
 
-  let layers =
-    Lambda.reventlessLayerArn
-    ->Option.map(arn => [arn->Pulumi.Input.make])
-    ->Option.getOr([])
-    ->Pulumi.Input.make
+  let layers = Lambda.reventlessLayers()
 
   let logGroup = Util_LambdaLogging.makeManagedLogGroup(
     ~name,

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res.mjs

@@ -2,7 +2,6 @@
 
 import * as Aws from "@pulumi/aws";
 import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../AWS.res.mjs";
@@ -45,7 +44,7 @@ function make(activeRoleTableName, activeRoleTableArn, nameOpt, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs", packageDirs, undefined, false);
   let sourceCodeHash = match.sourceCodeHash;
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, undefined, AWS_Tags$ReventlessAws.make(name + "LogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",