@reventlessdev/reventless-aws 3.0.0-alpha.346 → 3.0.0-alpha.348

package/scripts/DeployManifest.res

@@ -0,0 +1,84 @@
+/***
+An app's `deploy-manifest.yaml`: the folder holding the platform stack, and the
+folders holding the plugin stacks, in the order they deploy.
+
+The reusable deploy workflow reads it with `yq`; the commands in this folder read
+it here. Paths in the file are relative to the file's own folder.
+
+`stack-defaults` on an entry are the settings `deploy-app` gives a stack it
+creates for that folder — what a new stack of this app cannot deploy without.
+*/
+
+@module("yaml") external parseYaml: string => JSON.t = "parse"
+
+@schema
+type platform = {
+  path: string,
+  name?: string,
+  @as("stack-defaults") stackDefaults?: dict<string>,
+}
+
+@schema
+type plugin = {
+  name: string,
+  path: string,
+  @as("depends-on") dependsOn?: array<string>,
+  @as("stack-defaults") stackDefaults?: dict<string>,
+}
+
+@schema
+type t = {
+  region?: string,
+  platform: platform,
+  plugins?: array<plugin>,
+}
+
+/** One stack folder, with its path made absolute. */
+type project = {name: string, dir: string, stackDefaults: dict<string>}
+
+type resolved = {
+  file: string,
+  region: option<string>,
+  platform: project,
+  plugins: array<project>,
+}
+
+let defaultFile = "deploy-manifest.yaml"
+
+let parseString = (text: string): result<t, string> =>
+  try Ok(S.parseOrThrow(parseYaml(text), ~to=schema)) catch {
+  | JsExn(err) => Error(JsExn.message(err)->Option.getOr("not a deploy manifest"))
+  | _ => Error("not a deploy manifest")
+  }
+
+let resolve = (manifest: t, ~file: string): resolved => {
+  let base = NodePath.dirname(NodePath.resolve([file]))
+  {
+    file,
+    region: manifest.region,
+    platform: {
+      name: manifest.platform.name->Option.getOr("platform"),
+      dir: NodePath.resolve([base, manifest.platform.path]),
+      stackDefaults: manifest.platform.stackDefaults->Option.getOr(Dict.make()),
+    },
+    plugins: manifest.plugins
+    ->Option.getOr([])
+    ->Array.map(p => {
+      name: p.name,
+      dir: NodePath.resolve([base, p.path]),
+      stackDefaults: p.stackDefaults->Option.getOr(Dict.make()),
+    }),
+  }
+}
+
+let load = (file: string): result<resolved, string> =>
+  switch try Ok(NodeFs.readFileSync(file)) catch {
+  | _ => Error(`cannot read ${file}`)
+  } {
+  | Error(_) as e => e
+  | Ok(text) =>
+    switch parseString(text) {
+    | Error(message) => Error(`${file}: ${message}`)
+    | Ok(manifest) => Ok(manifest->resolve(~file))
+    }
+  }

package/scripts/DeployManifest.res.mjs

@@ -0,0 +1,112 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Sury from "sury";
+import * as Yaml from "yaml";
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+
+let platformSchema = Sury.$schema(s => ({
+  path: s.m(Sury.string),
+  name: s.m(Sury.$option(Sury.string)),
+  "stack-defaults": s.m(Sury.$option(Sury.dict(Sury.string)))
+}));
+
+let pluginSchema = Sury.$schema(s => ({
+  name: s.m(Sury.string),
+  path: s.m(Sury.string),
+  "depends-on": s.m(Sury.$option(Sury.array(Sury.string))),
+  "stack-defaults": s.m(Sury.$option(Sury.dict(Sury.string)))
+}));
+
+let schema = Sury.$schema(s => ({
+  region: s.m(Sury.$option(Sury.string)),
+  platform: s.m(platformSchema),
+  plugins: s.m(Sury.$option(Sury.array(pluginSchema)))
+}));
+
+function parseString(text) {
+  try {
+    return {
+      TAG: "Ok",
+      _0: S.parseOrThrow(Yaml.parse(text), schema)
+    };
+  } catch (raw_err) {
+    let err = Primitive_exceptions.internalToException(raw_err);
+    if (err.RE_EXN_ID === "JsExn") {
+      return {
+        TAG: "Error",
+        _0: Stdlib_Option.getOr(Stdlib_JsExn.message(err._1), "not a deploy manifest")
+      };
+    } else {
+      return {
+        TAG: "Error",
+        _0: "not a deploy manifest"
+      };
+    }
+  }
+}
+
+function resolve(manifest, file) {
+  let base = Nodepath.dirname(Nodepath.resolve(file));
+  return {
+    file: file,
+    region: manifest.region,
+    platform: {
+      name: Stdlib_Option.getOr(manifest.platform.name, "platform"),
+      dir: Nodepath.resolve(base, manifest.platform.path),
+      stackDefaults: Stdlib_Option.getOr(manifest.platform["stack-defaults"], {})
+    },
+    plugins: Stdlib_Option.getOr(manifest.plugins, []).map(p => ({
+      name: p.name,
+      dir: Nodepath.resolve(base, p.path),
+      stackDefaults: Stdlib_Option.getOr(p["stack-defaults"], {})
+    }))
+  };
+}
+
+function load(file) {
+  let e;
+  try {
+    e = {
+      TAG: "Ok",
+      _0: Nodefs.readFileSync(file, "utf8")
+    };
+  } catch (exn) {
+    e = {
+      TAG: "Error",
+      _0: `cannot read ` + file
+    };
+  }
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let message = parseString(e._0);
+  if (message.TAG === "Ok") {
+    return {
+      TAG: "Ok",
+      _0: resolve(message._0, file)
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: file + `: ` + message._0
+    };
+  }
+}
+
+let defaultFile = "deploy-manifest.yaml";
+
+export {
+  platformSchema,
+  pluginSchema,
+  schema,
+  defaultFile,
+  parseString,
+  resolve,
+  load,
+}
+/* platformSchema Not a pure module */

package/scripts/ProvisionAccounts.res

@@ -121,8 +121,8 @@ question is whether the pool will accept *those*. A pool created with
 `UsernameAttributes: [email]` will not, and the accounts it makes instead are
 correctly created and unable to authenticate.
 
-Checked for every entry before anything is created, so a manifest that cannot work
-costs nothing rather than half a cast.
+Checked for every entry before anything is created or written, so a manifest that
+cannot work costs nothing rather than half a cast.
 */
 let checkPoolAcceptsUsernames = async (~providerId: string, ~usernames: array<string>): result<
   unit,
@@ -239,6 +239,58 @@ let manifestNote = (~file: string) =>
    It is gitignored on every platform; keep it that way. These are bootstrap
    credentials for a deployment, not secrets to reuse anywhere real.`
 
+/**
+The manifest at `file`, applied to the pool `providerId`.
+
+🚨 **The pool is checked before anything is written.** Preparing mints passwords
+into the file; doing that first left a refused run with a manifest offering
+accounts that exist nowhere, which the seed then tried to sign in as. `checkPool`
+is a parameter so a test can refuse without a pool.
+*/
+let provision = async (
+  ~file: string,
+  ~providerId: string,
+  ~checkPool=checkPoolAcceptsUsernames,
+): result<unit, string> =>
+  switch Manifest.parseFile(file) {
+  | Error(message) => Error(`${file}: ${message}`)
+  | Ok([]) => Error(`${file} declares no accounts`)
+  | Ok(declared) =>
+    switch await checkPool(~providerId, ~usernames=declared->Array.map(e => e.username)) {
+    | Error(_) as e => e
+    | Ok() =>
+      switch Manifest.prepare(~path=file) {
+      | Error(message) => Error(`${file}: ${message}`)
+      | Ok(prepared) =>
+        let generated = prepared->Array.filter(p => p.passwordGenerated)->Array.length
+        Console.log(
+          `manifest ${file} (${prepared
+            ->Array.length
+            ->Int.toString} accounts, ${generated->Int.toString} password(s) generated)`,
+        )
+        let entries = prepared->Array.map(p => p.entry)
+        await ensureGroups(~providerId, ~entries)
+        let fills = []
+        for index in 0 to entries->Array.length - 1 {
+          let entry = entries->Array.getUnsafe(index)
+          let userId = await applyEntry(~providerId, ~entry)
+          fills->Array.push({Manifest.index, password: None, userId})
+        }
+        switch Manifest.fillFile(~path=file, ~fills) {
+        | Error(message) => Error(`${file}: ${message}`)
+        | Ok(report) =>
+          let corrected = report->Array.filter(r => r.userIdWritten)->Array.length
+          Console.log(
+            `manifest ${file} (${corrected->Int.toString} id(s) written back)${manifestNote(
+                ~file,
+              )}`,
+          )
+          Ok()
+        }
+      }
+    }
+  }
+
 let run = async (): result<unit, string> =>
   // argv[0] is node, argv[1] this script.
   switch parseArgs(NodeProcess.argv->Array.slice(~start=2, ~end=NodeProcess.argv->Array.length)) {
@@ -255,50 +307,12 @@ let run = async (): result<unit, string> =>
       | SeededFrom(_, template) => Console.log(`manifest ${file} (new, copied from ${template})`)
       | Declared(_) => ()
       }
-      switch Manifest.prepare(~path=file) {
-      | Error(message) => Error(`${file}: ${message}`)
-      | Ok([]) => Error(`${file} declares no accounts`)
-      | Ok(prepared) =>
-        let generated = prepared->Array.filter(p => p.passwordGenerated)->Array.length
-        Console.log(
-          `manifest ${file} (${prepared
-            ->Array.length
-            ->Int.toString} accounts, ${generated->Int.toString} password(s) generated)`,
-        )
-        let entries = prepared->Array.map(p => p.entry)
-        switch ProvisionProvider.resolve(~given=args.providerId, ~stack=args.stack) {
-        | Error(message) =>
-          Error(
-            `${message}. To fill in the manifest without creating anything, run prepare-accounts`,
-          )
-        | Ok((providerId, source)) =>
-          Console.log(`provider ${providerId} (from ${source->ProvisionProvider.describe})`)
-          switch await checkPoolAcceptsUsernames(
-            ~providerId,
-            ~usernames=entries->Array.map(e => e.username),
-          ) {
-          | Error(_) as e => e
-          | Ok() =>
-            await ensureGroups(~providerId, ~entries)
-            let fills = []
-            for index in 0 to entries->Array.length - 1 {
-              let entry = entries->Array.getUnsafe(index)
-              let userId = await applyEntry(~providerId, ~entry)
-              fills->Array.push({Manifest.index, password: None, userId})
-            }
-            switch Manifest.fillFile(~path=file, ~fills) {
-            | Error(message) => Error(`${file}: ${message}`)
-            | Ok(report) =>
-              let corrected = report->Array.filter(r => r.userIdWritten)->Array.length
-              Console.log(
-                `manifest ${file} (${corrected->Int.toString} id(s) written back)${manifestNote(
-                    ~file,
-                  )}`,
-              )
-              Ok()
-            }
-          }
-        }
+      switch ProvisionProvider.resolve(~given=args.providerId, ~stack=args.stack) {
+      | Error(message) =>
+        Error(`${message}. To fill in the manifest without creating anything, run prepare-accounts`)
+      | Ok((providerId, source)) =>
+        Console.log(`provider ${providerId} (from ${source->ProvisionProvider.describe})`)
+        await provision(~file, ~providerId)
       }
     }
   }

package/scripts/ProvisionAccounts.res.mjs

@@ -220,59 +220,37 @@ function manifestNote(file) {
    credentials for a deployment, not secrets to reuse anywhere real.`;
 }
 
-async function run() {
-  let e = parseArgs(process.argv.slice(2, process.argv.length));
-  if (e.TAG !== "Ok") {
-    return e;
-  }
-  let args = e._0;
-  if (args.help) {
-    console.log(usage);
-    return {
-      TAG: "Ok",
-      _0: undefined
-    };
-  }
-  let e$1 = AccountsManifest$Reventless.locate(args.file, undefined);
-  if (e$1.TAG !== "Ok") {
-    return e$1;
-  }
-  let located = e$1._0;
-  let file = AccountsManifest$Reventless.pathOf(located);
-  if (located.TAG !== "Declared") {
-    console.log(`manifest ` + file + ` (new, copied from ` + located._1 + `)`);
-  }
-  let message = AccountsManifest$Reventless.prepare(file);
+async function provision(file, providerId, checkPoolOpt) {
+  let checkPool = checkPoolOpt !== undefined ? checkPoolOpt : checkPoolAcceptsUsernames;
+  let message = AccountsManifest$Reventless.parseFile(file);
   if (message.TAG !== "Ok") {
     return {
       TAG: "Error",
       _0: file + `: ` + message._0
     };
   }
-  let prepared = message._0;
-  if (prepared.length === 0) {
+  let declared = message._0;
+  if (declared.length === 0) {
     return {
       TAG: "Error",
       _0: file + ` declares no accounts`
     };
   }
-  let generated = prepared.filter(p => p.passwordGenerated).length;
-  console.log(`manifest ` + file + ` (` + prepared.length.toString() + ` accounts, ` + generated.toString() + ` password(s) generated)`);
-  let entries = prepared.map(p => p.entry);
-  let message$1 = ProvisionProvider$ReventlessAws.resolve(args.providerId, args.stack);
+  let e = await checkPool(providerId, declared.map(e => e.username));
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let message$1 = AccountsManifest$Reventless.prepare(file);
   if (message$1.TAG !== "Ok") {
     return {
       TAG: "Error",
-      _0: message$1._0 + `. To fill in the manifest without creating anything, run prepare-accounts`
+      _0: file + `: ` + message$1._0
     };
   }
-  let match = message$1._0;
-  let providerId = match[0];
-  console.log(`provider ` + providerId + ` (from ` + ProvisionProvider$ReventlessAws.describe(match[1]) + `)`);
-  let e$2 = await checkPoolAcceptsUsernames(providerId, entries.map(e => e.username));
-  if (e$2.TAG !== "Ok") {
-    return e$2;
-  }
+  let prepared = message$1._0;
+  let generated = prepared.filter(p => p.passwordGenerated).length;
+  console.log(`manifest ` + file + ` (` + prepared.length.toString() + ` accounts, ` + generated.toString() + ` password(s) generated)`);
+  let entries = prepared.map(p => p.entry);
   await ensureGroups(providerId, entries);
   let fills = [];
   for (let index = 0, index_finish = entries.length; index < index_finish; ++index) {
@@ -299,6 +277,41 @@ async function run() {
   };
 }
 
+async function run() {
+  let e = parseArgs(process.argv.slice(2, process.argv.length));
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let args = e._0;
+  if (args.help) {
+    console.log(usage);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  }
+  let e$1 = AccountsManifest$Reventless.locate(args.file, undefined);
+  if (e$1.TAG !== "Ok") {
+    return e$1;
+  }
+  let located = e$1._0;
+  let file = AccountsManifest$Reventless.pathOf(located);
+  if (located.TAG !== "Declared") {
+    console.log(`manifest ` + file + ` (new, copied from ` + located._1 + `)`);
+  }
+  let message = ProvisionProvider$ReventlessAws.resolve(args.providerId, args.stack);
+  if (message.TAG !== "Ok") {
+    return {
+      TAG: "Error",
+      _0: message._0 + `. To fill in the manifest without creating anything, run prepare-accounts`
+    };
+  }
+  let match = message._0;
+  let providerId = match[0];
+  console.log(`provider ` + providerId + ` (from ` + ProvisionProvider$ReventlessAws.describe(match[1]) + `)`);
+  return await provision(file, providerId, undefined);
+}
+
 async function main() {
   let message;
   try {
@@ -331,6 +344,7 @@ export {
   ensureGroups,
   applyEntry,
   manifestNote,
+  provision,
   run,
   main,
 }

package/scripts/PulumiCli.res

@@ -0,0 +1,43 @@
+/***
+Reading deployed stacks through the `pulumi` CLI, so a command follows whatever
+backend the CLI is logged into.
+
+stderr goes to the caller's terminal: a Pulumi failure is legible where it
+happens rather than re-reported here as a vaguer message.
+*/
+
+let run = (~cwd: string, args: array<string>): string =>
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args->Array.concat(["--cwd", cwd, "--non-interactive"]),
+    {encoding: "utf8", stdio: ["ignore", "pipe", "inherit"], maxBuffer: 64 * 1024 * 1024},
+  )->String.trim
+
+/** Whether the project in `dir` keeps settings for `stack` — how the deploy
+    workflow tells a stack that was never deployed from one that was. */
+let hasStackFile = (~dir: string, ~stack: string): bool =>
+  NodeFs.existsSync(NodePath.join([dir, `Pulumi.${stack}.yaml`]))
+
+let stackOutputs = (~dir: string, ~stack: string): result<dict<JSON.t>, string> =>
+  switch run(~cwd=dir, ["stack", "output", "--json", "--stack", stack]) {
+  | text =>
+    switch text->JSON.parseOrThrow->JSON.Decode.object {
+    | Some(outputs) => Ok(outputs)
+    | None => Error(`stack "${stack}" in ${dir} returned outputs that are not an object`)
+    | exception _ => Error(`stack "${stack}" in ${dir} returned outputs that are not JSON`)
+    }
+  | exception _ => Error(`could not read the outputs of stack "${stack}" in ${dir}`)
+  }
+
+let selectedStack = (~dir: string): option<string> =>
+  switch run(~cwd=dir, ["stack", "--show-name"]) {
+  | "" => None
+  | name => Some(name)
+  | exception _ => None
+  }
+
+let stringOutput = (outputs: dict<JSON.t>, name: string): option<string> =>
+  switch outputs->Dict.get(name)->Option.flatMap(JSON.Decode.string) {
+  | Some("") | None => None
+  | value => value
+  }

package/scripts/PulumiCli.res.mjs

@@ -0,0 +1,106 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Nodechild_process from "node:child_process";
+
+function run(cwd, args) {
+  return Nodechild_process.execFileSync("pulumi", args.concat([
+    "--cwd",
+    cwd,
+    "--non-interactive"
+  ]), {
+    encoding: "utf8",
+    stdio: [
+      "ignore",
+      "pipe",
+      "inherit"
+    ],
+    maxBuffer: 67108864
+  }).trim();
+}
+
+function hasStackFile(dir, stack) {
+  return Nodefs.existsSync(Nodepath.join(dir, `Pulumi.` + stack + `.yaml`));
+}
+
+function stackOutputs(dir, stack) {
+  let exit = 0;
+  let text;
+  try {
+    text = run(dir, [
+      "stack",
+      "output",
+      "--json",
+      "--stack",
+      stack
+    ]);
+    exit = 1;
+  } catch (exn) {
+    return {
+      TAG: "Error",
+      _0: `could not read the outputs of stack "` + stack + `" in ` + dir
+    };
+  }
+  if (exit === 1) {
+    let exit$1 = 0;
+    let outputs;
+    try {
+      outputs = Stdlib_JSON.Decode.object(JSON.parse(text));
+      exit$1 = 2;
+    } catch (exn$1) {
+      return {
+        TAG: "Error",
+        _0: `stack "` + stack + `" in ` + dir + ` returned outputs that are not JSON`
+      };
+    }
+    if (exit$1 === 2) {
+      if (outputs !== undefined) {
+        return {
+          TAG: "Ok",
+          _0: outputs
+        };
+      } else {
+        return {
+          TAG: "Error",
+          _0: `stack "` + stack + `" in ` + dir + ` returned outputs that are not an object`
+        };
+      }
+    }
+  }
+}
+
+function selectedStack(dir) {
+  let name;
+  try {
+    name = run(dir, [
+      "stack",
+      "--show-name"
+    ]);
+  } catch (exn) {
+    return;
+  }
+  if (name === "") {
+    return;
+  } else {
+    return name;
+  }
+}
+
+function stringOutput(outputs, name) {
+  let value = Stdlib_Option.flatMap(outputs[name], Stdlib_JSON.Decode.string);
+  if (value !== undefined && value !== "") {
+    return value;
+  }
+}
+
+export {
+  run,
+  hasStackFile,
+  stackOutputs,
+  selectedStack,
+  stringOutput,
+}
+/* node:fs Not a pure module */

package/src/Platform.res

@@ -1492,7 +1492,7 @@ module MakeWithConfig = (
     // GETs from it to resolve an offloaded `structure`. Kept out of the declared
     // `@storageRef` stores and their pending-claim/expiry machinery: offload
     // objects are written durably up front and are never "pending".
-    let offloadProtection = Util_StoreLayout.protectionFor(~stack=Pulumi.Pulumi.getStackName())
+    let offloadProtection = Util_StoreLayout.protectionOfDeployedStack()
     let offloadBucket = PulumiAws.S3.Bucket.make(
       ~name="reventless-offload",
       ~args={
@@ -1518,6 +1518,14 @@ module MakeWithConfig = (
       },
     )
     Pulumi.Pulumi.export("offloadBucket", offloadBucketName)
+    // What a plugin stack's `platform:stack` names, fully qualified so it holds on
+    // every backend. `deploy-app` reads it to point the plugin stacks it creates.
+    Pulumi.Pulumi.export(
+      "platformStack",
+      Pulumi.Output.make(
+        `${Pulumi.Pulumi.getOrganization()}/${Pulumi.Pulumi.getProjectName()}/${Pulumi.Pulumi.getStackName()}`,
+      ),
+    )
 
     // Mount the Platform_ComponentDefinitions Lambda resolver on the Platform API
     // (split mode) or Domain API (unified mode — platformApi == domainApi above).
@@ -1774,7 +1782,7 @@ module MakeWithConfig = (
       ~stack=stackName,
       ~prodStacks=Util_HostUiDomain.resolveProdStacks(),
     )
-    let storeProtection = Util_StoreLayout.protectionFor(~stack=stackName)
+    let storeProtection = Util_StoreLayout.protectionOfDeployedStack()
 
     // Dedup by `(plugin, store)` — that pair is a store's identity, and many
     // fields legitimately name one store.
@@ -2529,6 +2537,15 @@ module MakeWithConfig = (
   let startServers = () => ()
 
   let deployPlugin = (~plugin: module(PluginMaker), ~apiTarget=Domain) => {
+    // Without the setting the plugin used to deploy as a platform of its own,
+    // with no error, and never register with the real one.
+    if platformStackRef->Option.isNone {
+      JsError.throwWithMessage(
+        `This plugin stack has no platform:stack setting, so it cannot find its platform. ` ++
+        `Set it to the platform's stack: pulumi config set platform:stack ` ++
+        `${Pulumi.Pulumi.getOrganization()}/<platform project>/${Pulumi.Pulumi.getStackName()}`,
+      )
+    }
     log.info(
       ~comp="Platform:deployPlugin",
       `target=${switch apiTarget {