@reventlessdev/reventless-aws 3.0.0-alpha.370 → 3.0.0-alpha.371

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.371 (2026-10-01)
+
+### Bug Fixes
+
+* check a plugin's roles against the user pool's groups ([ddb3c42](https://github.com/ReventlessDev/reventless-core/commit/ddb3c422b7226a19800e781abd5f03af18867007))
+
+
 # 3.0.0-alpha.370 (2026-10-01)
 
 * feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.370",
+  "version": "3.0.0-alpha.371",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -21,19 +21,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.27",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.28",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
     "@reventlessdev/rescript-node": "2.0.0-alpha.20",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.22",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.23",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.286",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.38",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.150",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.156",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.184"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.287",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.151",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.157",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.39"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res

@@ -112,11 +112,34 @@ let messagingEmailProviderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.
     resolves roles while it is built, and a mapping stated later is refused. */
 let roleGroups = Reventless.Role.setGroups
 
-/** The groups of a user pool this deployment did not create, which no accounts
-    manifest names. They count as provided by the check that every role a plugin
-    needs has a group. */
+/** Groups a root says its identity provider has, for a provider the platform
+    cannot list. Where it can (`loadProvidedGroups`), the listing decides, and a
+    declared group the pool lacks fails the deploy. */
 let providedGroups = Reventless.Role.provideGroups
 
+/** The platform stack a plugin stack deploys against (`platform:stack`), or
+    `None` in a program that is its own platform. One reference per program:
+    a second with the same name is a duplicate resource. */
+let platformStackRefCache: ref<option<option<Pulumi.StackReference.t>>> = ref(None)
+
+let platformStackReference = (): option<Pulumi.StackReference.t> =>
+  switch platformStackRefCache.contents {
+  | Some(stackRef) => stackRef
+  | None =>
+    let stackRef =
+      Pulumi.Config.make(Some("platform"))
+      ->Pulumi.Config.get("stack")
+      ->Option.map(stack => Pulumi.StackReference.make(stack))
+    platformStackRefCache := Some(stackRef)
+    stackRef
+  }
+
+/** Ask the user pool which groups it has, so the role check compares each
+    plugin's roles with the pool. A plugin's deploy program calls `deployPlugin`
+    once this resolves; see [Platform_ProvidedGroups]. */
+let loadProvidedGroups = (): promise<unit> =>
+  Platform_ProvidedGroups.load(~stackRef=platformStackReference())
+
 /** The group a role resolves to — the name this platform writes into its
     directives, its shell configuration and the elevated groups. For code that
     grants access by group, so it never spells one itself. */
@@ -164,10 +187,10 @@ module MakeWithConfig = (
   // [Reventless.OwnerScope.defaultElevatedGroups].
   Reventless.OwnerScope.defaultElevatedRoles([Reventless.Role.admin])
 
-  // What this deployment provides for the roles its plugins need: the
-  // administrator group the stack declares, and the groups of the accounts
-  // provisioning creates. Read when each plugin is built, after the root has
-  // mapped its roles.
+  // What this deployment provides for the roles its plugins need, where the pool
+  // was not listed (`loadProvidedGroups`): the administrator group the stack
+  // declares, and the groups of the accounts provisioning creates. Read when each
+  // plugin is built, after the root has mapped its roles.
   Reventless.Role.provideGroupsFrom(() =>
     [Reventless.Role.adminGroup()]->Array.concat(Reventless.AccountsManifest.declaredGroups())
   )
@@ -228,10 +251,7 @@ module MakeWithConfig = (
   // Determine API source based on platform:stack config.
   // - Platform/monolithic mode (no config): create a real AppSync API resource.
   // - Plugin mode (config set): reference the platform's shared API via StackReference.
-  let platformStackRef =
-    Pulumi.Config.make(Some("platform"))
-    ->Pulumi.Config.get("stack")
-    ->Option.map(stack => Pulumi.StackReference.make(stack))
+  let platformStackRef = platformStackReference()
 
   // The declared object stores, as the upload claimer needs them: qualified
   // name, physical bucket, served prefix.

package/src/Platform.res.mjs

@@ -80,6 +80,7 @@ import * as EventTopicPublisher_SNS$ReventlessAws from "./adapter/EventTopic/Eve
 import * as ExtensionPointMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionPointMapping.res.mjs";
 import * as PgQueryResolver_Builder$ReventlessAws from "./adapter/QueryDb/PgQueryResolver_Builder.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
+import * as Platform_ProvidedGroups$ReventlessAws from "./Platform_ProvidedGroups.res.mjs";
 import * as UiFragments_Projection$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateView/UiFragments_Projection.res.mjs";
 import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_Builder_Single.res.mjs";
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
@@ -152,6 +153,24 @@ let messagingEmailProviderRef = {
   contents: Pulumi.output("")
 };
 
+let platformStackRefCache = {
+  contents: undefined
+};
+
+function platformStackReference() {
+  let stackRef = platformStackRefCache.contents;
+  if (stackRef !== undefined) {
+    return Primitive_option.valFromOption(stackRef);
+  }
+  let stackRef$1 = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  platformStackRefCache.contents = Primitive_option.some(stackRef$1);
+  return stackRef$1;
+}
+
+function loadProvidedGroups() {
+  return Platform_ProvidedGroups$ReventlessAws.load(platformStackReference());
+}
+
 function MakeWithConfig(Config) {
   OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
   Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
@@ -183,7 +202,7 @@ function MakeWithConfig(Config) {
   let currentDeployTarget = {
     contents: "Domain"
   };
-  let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let platformStackRef = platformStackReference();
   let claimStores = () => {
     if (platformStackRef !== undefined) {
       return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
@@ -1599,7 +1618,7 @@ function Make($star) {
   let currentDeployTarget = {
     contents: "Domain"
   };
-  let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let platformStackRef = platformStackReference();
   let claimStores = () => {
     if (platformStackRef !== undefined) {
       return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
@@ -2984,6 +3003,9 @@ export {
   messagingEmailProviderRef,
   roleGroups,
   providedGroups,
+  platformStackRefCache,
+  platformStackReference,
+  loadProvidedGroups,
   groupOf,
   adminGroup,
   MakeWithConfig,

package/src/Platform_ProvidedGroups.res

@@ -0,0 +1,97 @@
+/***
+The user pool's groups, read before a plugin is built so the role check compares
+its roles with the pool, not a manifest (`Role.provideListedGroups`). A group the
+pool lacks refuses every caller, which nothing at runtime can tell from a caller
+without the role. Works in a preview: `ListGroups` is a read, and the pool id is
+read outside any `Output.apply`.
+*/
+
+module Cognito = AwsSdk.CognitoIdentityServiceProvider
+
+type pool = {id: string, region: option<string>}
+
+type send = Cognito.ListGroupsCommand.input => promise<Cognito.ListGroupsCommand.output>
+
+/** Every group of the pool, following `NextToken` across pages. */
+let listAll = async (~send: send, ~userPoolId: string): array<string> => {
+  let rec page = async (nextToken, acc) => {
+    let out = await send({userPoolId, limit: 60, ?nextToken})
+    let names = out.groups->Option.getOr([])->Array.filterMap(g => g.groupName)
+    let acc = acc->Array.concat(names)
+    switch out.nextToken {
+    | Some(_) as next => await page(next, acc)
+    | None => acc
+    }
+  }
+  await page(None, [])
+}
+
+/** A plugin stack's pool, from the platform stack's exports. The new key before
+    the old one, and each directly before under `default`, where ESM programs
+    nest their exports. */
+let poolFromExports = (~get: string => option<JSON.t>): option<pool> => {
+  let nested = get("default")->Option.flatMap(JSON.Decode.object)
+  let read = key =>
+    get(key)
+    ->Option.orElse(nested->Option.flatMap(d => d->Dict.get(key)))
+    ->Option.flatMap(JSON.Decode.string)
+  read("identityProviderId")
+  ->Option.orElse(read("cognitoUserPoolId"))
+  ->Option.map(id => {
+    id,
+    region: read("identityProviderRegion")->Option.orElse(read("cognitoRegion")),
+  })
+}
+
+/**
+The pool this program deploys against, or `None` where it cannot be listed yet:
+a pool this program creates does not exist before its first deploy.
+
+A plugin stack reads its platform stack's exports, the same ones its resolvers
+use. A program that is its own platform reads a supplied pool's id from config.
+*/
+let resolvePool = async (~stackRef: option<Pulumi.StackReference.t>): option<pool> =>
+  switch stackRef {
+  | Some(stackRef) =>
+    let keys = [
+      "identityProviderId",
+      "cognitoUserPoolId",
+      "identityProviderRegion",
+      "cognitoRegion",
+      "default",
+    ]
+    let values = await Promise.all(
+      keys->Array.map(key => stackRef->Pulumi.StackReference.getOutputValue(key)),
+    )
+    let exports = Dict.fromArray(
+      keys->Array.mapWithIndex((key, i) => (key, values->Array.getUnsafe(i))),
+    )
+    poolFromExports(~get=key => exports->Dict.get(key)->Option.flatMap(v => v))
+  | None =>
+    Platform_Stack._identityProviderId(
+      ~cfg=Pulumi.Config.make(Some("platform")),
+    )->Option.map(id => {
+      id,
+      region: Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region"),
+    })
+  }
+
+let sendTo = (~region: option<string>): send => {
+  let client = Cognito.Raw.client(~options={region: ?region})
+  input => Cognito.ListGroupsCommand.make(input)->Cognito.ListGroupsCommand.Raw.send(client, _)
+}
+
+/** List the pool's groups and record them for the role check. Leaves the check
+    on its other sources where there is no pool to ask yet. */
+let load = async (~stackRef: option<Pulumi.StackReference.t>): unit =>
+  switch await resolvePool(~stackRef) {
+  | None => ()
+  | Some({id, region}) =>
+    let groups = try await listAll(~send=sendTo(~region), ~userPoolId=id) catch {
+    | exn if exn->Util_AwsError.hasCode(~code="AccessDeniedException") =>
+      JsError.throwWithMessage(
+        `Cannot list the groups of the user pool ${id}: the deploying principal needs ` ++ `cognito-idp:ListGroups on it, so the deploy can check that every role a plugin needs has a group.`,
+      )
+    }
+    Reventless.Role.provideListedGroups(~source=`the user pool ${id}`, groups)
+  }

package/src/Platform_ProvidedGroups.res.mjs

@@ -0,0 +1,103 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Util_AwsError$ReventlessAws from "./util/Util_AwsError.res.mjs";
+import * as Platform_Stack$ReventlessAws from "./Platform_Stack.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+
+async function listAll(send, userPoolId) {
+  let page = async (nextToken, acc) => {
+    let out = await send({
+      UserPoolId: userPoolId,
+      Limit: 60,
+      NextToken: nextToken
+    });
+    let names = Stdlib_Array.filterMap(Stdlib_Option.getOr(out.Groups, []), g => g.GroupName);
+    let acc$1 = acc.concat(names);
+    let next = out.NextToken;
+    if (next !== undefined) {
+      return await page(next, acc$1);
+    } else {
+      return acc$1;
+    }
+  };
+  return await page(undefined, []);
+}
+
+function poolFromExports(get) {
+  let nested = Stdlib_Option.flatMap(get("default"), Stdlib_JSON.Decode.object);
+  let read = key => Stdlib_Option.flatMap(Stdlib_Option.orElse(get(key), Stdlib_Option.flatMap(nested, d => d[key])), Stdlib_JSON.Decode.string);
+  return Stdlib_Option.map(Stdlib_Option.orElse(read("identityProviderId"), read("cognitoUserPoolId")), id => ({
+    id: id,
+    region: Stdlib_Option.orElse(read("identityProviderRegion"), read("cognitoRegion"))
+  }));
+}
+
+async function resolvePool(stackRef) {
+  if (stackRef === undefined) {
+    return Stdlib_Option.map(Platform_Stack$ReventlessAws._identityProviderId(new Pulumi.Config("platform")), id => ({
+      id: id,
+      region: new Pulumi.Config("aws").get("region")
+    }));
+  }
+  let stackRef$1 = Primitive_option.valFromOption(stackRef);
+  let keys = [
+    "identityProviderId",
+    "cognitoUserPoolId",
+    "identityProviderRegion",
+    "cognitoRegion",
+    "default"
+  ];
+  let values = await Promise.all(keys.map(key => stackRef$1.getOutputValue(key)));
+  let $$exports = Object.fromEntries(keys.map((key, i) => [
+    key,
+    values[i]
+  ]));
+  return poolFromExports(key => Stdlib_Option.flatMap($$exports[key], v => v));
+}
+
+function sendTo(region) {
+  let client = new ClientCognitoIdentityProvider.CognitoIdentityProviderClient({
+    region: region
+  });
+  return input => client.send(new ClientCognitoIdentityProvider.ListGroupsCommand(input));
+}
+
+async function load(stackRef) {
+  let match = await resolvePool(stackRef);
+  if (match === undefined) {
+    return;
+  }
+  let id = match.id;
+  let groups;
+  try {
+    groups = await listAll(sendTo(match.region), id);
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.hasCode(exn, "AccessDeniedException")) {
+      groups = Stdlib_JsError.throwWithMessage(`Cannot list the groups of the user pool ` + id + `: the deploying principal needs cognito-idp:ListGroups on it, so the deploy can check that every role a plugin needs has a group.`);
+    } else {
+      throw exn;
+    }
+  }
+  return Role$Reventless.provideListedGroups(`the user pool ` + id, groups);
+}
+
+let Cognito;
+
+export {
+  Cognito,
+  listAll,
+  poolFromExports,
+  resolvePool,
+  sendTo,
+  load,
+}
+/* @pulumi/pulumi Not a pure module */

package/tests/Platform_ProvidedGroupsTest.res

@@ -0,0 +1,52 @@
+open JestGlobals
+
+// What the role check compares a plugin's roles with on AWS: the groups the user
+// pool reports, found through the platform stack's exports.
+
+module Cognito = AwsSdk.CognitoIdentityServiceProvider
+
+let group = (name): Cognito.ListGroupsCommand.group => {groupName: name}
+
+describe("Platform_ProvidedGroups.listAll", () => {
+  test("follows NextToken until the last page", async () => {
+    let seen = []
+    let send = async (input: Cognito.ListGroupsCommand.input): Cognito.ListGroupsCommand.output => {
+      seen->Array.push(input.nextToken)
+      switch input.nextToken {
+      | None => {groups: [group("Admin"), group("Shopper")], nextToken: "p2"}
+      | Some(_) => {groups: [group("Merchandiser")]}
+      }
+    }
+    let groups = await Platform_ProvidedGroups.listAll(~send, ~userPoolId="p1")
+    expect((groups, seen))->toEqual((["Admin", "Shopper", "Merchandiser"], [None, Some("p2")]))
+  })
+})
+
+describe("Platform_ProvidedGroups.poolFromExports", () => {
+  let from = (pairs: array<(string, JSON.t)>) => {
+    let exports = Dict.fromArray(pairs)
+    Platform_ProvidedGroups.poolFromExports(~get=key => exports->Dict.get(key))
+  }
+
+  testSync("reads the pool id and region", () =>
+    expect(
+      from([
+        ("identityProviderId", JSON.Encode.string("p1")),
+        ("identityProviderRegion", JSON.Encode.string("eu-west-1")),
+      ]),
+    )->toEqual(Some({Platform_ProvidedGroups.id: "p1", region: Some("eu-west-1")}))
+  )
+
+  testSync("reads them nested under default, as an ESM platform exports them", () =>
+    expect(
+      from([
+        (
+          "default",
+          JSON.Encode.object(Dict.fromArray([("cognitoUserPoolId", JSON.Encode.string("p-old"))])),
+        ),
+      ]),
+    )->toEqual(Some({Platform_ProvidedGroups.id: "p-old", region: None}))
+  )
+
+  testSync("no pool id is no pool to list", () => expect(from([]))->toEqual(None))
+})

package/tests/Platform_ProvidedGroupsTest.res.mjs

@@ -0,0 +1,98 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Platform_ProvidedGroups$ReventlessAws from "../src/Platform_ProvidedGroups.res.mjs";
+
+function group(name) {
+  return {
+    GroupName: name
+  };
+}
+
+globalThis.describe("Platform_ProvidedGroups.listAll", () => {
+  globalThis.test("follows NextToken until the last page", async () => {
+    let seen = [];
+    let send = async input => {
+      seen.push(input.NextToken);
+      let match = input.NextToken;
+      if (match !== undefined) {
+        return {
+          Groups: [{
+              GroupName: "Merchandiser"
+            }]
+        };
+      } else {
+        return {
+          Groups: [
+            {
+              GroupName: "Admin"
+            },
+            {
+              GroupName: "Shopper"
+            }
+          ],
+          NextToken: "p2"
+        };
+      }
+    };
+    let groups = await Platform_ProvidedGroups$ReventlessAws.listAll(send, "p1");
+    globalThis.expect([
+      groups,
+      seen
+    ]).toEqual([
+      [
+        "Admin",
+        "Shopper",
+        "Merchandiser"
+      ],
+      [
+        undefined,
+        "p2"
+      ]
+    ]);
+  });
+});
+
+globalThis.describe("Platform_ProvidedGroups.poolFromExports", () => {
+  let from = pairs => {
+    let $$exports = Object.fromEntries(pairs);
+    return Platform_ProvidedGroups$ReventlessAws.poolFromExports(key => $$exports[key]);
+  };
+  globalThis.test("reads the pool id and region", () => {
+    globalThis.expect(from([
+      [
+        "identityProviderId",
+        "p1"
+      ],
+      [
+        "identityProviderRegion",
+        "eu-west-1"
+      ]
+    ])).toEqual({
+      id: "p1",
+      region: "eu-west-1"
+    });
+  });
+  globalThis.test("reads them nested under default, as an ESM platform exports them", () => {
+    globalThis.expect(from([[
+        "default",
+        Object.fromEntries([[
+            "cognitoUserPoolId",
+            "p-old"
+          ]])
+      ]])).toEqual({
+      id: "p-old",
+      region: undefined
+    });
+  });
+  globalThis.test("no pool id is no pool to list", () => {
+    globalThis.expect(from([])).toEqual(undefined);
+  });
+});
+
+let Cognito;
+
+export {
+  Cognito,
+  group,
+}
+/*  Not a pure module */