@reventlessdev/reventless-aws 3.0.0-alpha.370 → 3.0.0-alpha.372

package/src/Platform.res.mjs

@@ -80,6 +80,7 @@ import * as EventTopicPublisher_SNS$ReventlessAws from "./adapter/EventTopic/Eve
 import * as ExtensionPointMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionPointMapping.res.mjs";
 import * as PgQueryResolver_Builder$ReventlessAws from "./adapter/QueryDb/PgQueryResolver_Builder.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
+import * as Platform_ProvidedGroups$ReventlessAws from "./Platform_ProvidedGroups.res.mjs";
 import * as UiFragments_Projection$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateView/UiFragments_Projection.res.mjs";
 import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_Builder_Single.res.mjs";
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
@@ -152,6 +153,24 @@ let messagingEmailProviderRef = {
   contents: Pulumi.output("")
 };
 
+let platformStackRefCache = {
+  contents: undefined
+};
+
+function platformStackReference() {
+  let stackRef = platformStackRefCache.contents;
+  if (stackRef !== undefined) {
+    return Primitive_option.valFromOption(stackRef);
+  }
+  let stackRef$1 = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  platformStackRefCache.contents = Primitive_option.some(stackRef$1);
+  return stackRef$1;
+}
+
+function loadProvidedGroups() {
+  return Platform_ProvidedGroups$ReventlessAws.load(platformStackReference());
+}
+
 function MakeWithConfig(Config) {
   OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
   Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
@@ -183,7 +202,7 @@ function MakeWithConfig(Config) {
   let currentDeployTarget = {
     contents: "Domain"
   };
-  let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let platformStackRef = platformStackReference();
   let claimStores = () => {
     if (platformStackRef !== undefined) {
       return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
@@ -1599,7 +1618,7 @@ function Make($star) {
   let currentDeployTarget = {
     contents: "Domain"
   };
-  let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let platformStackRef = platformStackReference();
   let claimStores = () => {
     if (platformStackRef !== undefined) {
       return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
@@ -2984,6 +3003,9 @@ export {
   messagingEmailProviderRef,
   roleGroups,
   providedGroups,
+  platformStackRefCache,
+  platformStackReference,
+  loadProvidedGroups,
   groupOf,
   adminGroup,
   MakeWithConfig,

package/src/Platform_ProvidedGroups.res

@@ -0,0 +1,97 @@
+/***
+The user pool's groups, read before a plugin is built so the role check compares
+its roles with the pool, not a manifest (`Role.provideListedGroups`). A group the
+pool lacks refuses every caller, which nothing at runtime can tell from a caller
+without the role. Works in a preview: `ListGroups` is a read, and the pool id is
+read outside any `Output.apply`.
+*/
+
+module Cognito = AwsSdk.CognitoIdentityServiceProvider
+
+type pool = {id: string, region: option<string>}
+
+type send = Cognito.ListGroupsCommand.input => promise<Cognito.ListGroupsCommand.output>
+
+/** Every group of the pool, following `NextToken` across pages. */
+let listAll = async (~send: send, ~userPoolId: string): array<string> => {
+  let rec page = async (nextToken, acc) => {
+    let out = await send({userPoolId, limit: 60, ?nextToken})
+    let names = out.groups->Option.getOr([])->Array.filterMap(g => g.groupName)
+    let acc = acc->Array.concat(names)
+    switch out.nextToken {
+    | Some(_) as next => await page(next, acc)
+    | None => acc
+    }
+  }
+  await page(None, [])
+}
+
+/** A plugin stack's pool, from the platform stack's exports. The new key before
+    the old one, and each directly before under `default`, where ESM programs
+    nest their exports. */
+let poolFromExports = (~get: string => option<JSON.t>): option<pool> => {
+  let nested = get("default")->Option.flatMap(JSON.Decode.object)
+  let read = key =>
+    get(key)
+    ->Option.orElse(nested->Option.flatMap(d => d->Dict.get(key)))
+    ->Option.flatMap(JSON.Decode.string)
+  read("identityProviderId")
+  ->Option.orElse(read("cognitoUserPoolId"))
+  ->Option.map(id => {
+    id,
+    region: read("identityProviderRegion")->Option.orElse(read("cognitoRegion")),
+  })
+}
+
+/**
+The pool this program deploys against, or `None` where it cannot be listed yet:
+a pool this program creates does not exist before its first deploy.
+
+A plugin stack reads its platform stack's exports, the same ones its resolvers
+use. A program that is its own platform reads a supplied pool's id from config.
+*/
+let resolvePool = async (~stackRef: option<Pulumi.StackReference.t>): option<pool> =>
+  switch stackRef {
+  | Some(stackRef) =>
+    let keys = [
+      "identityProviderId",
+      "cognitoUserPoolId",
+      "identityProviderRegion",
+      "cognitoRegion",
+      "default",
+    ]
+    let values = await Promise.all(
+      keys->Array.map(key => stackRef->Pulumi.StackReference.getOutputValue(key)),
+    )
+    let exports = Dict.fromArray(
+      keys->Array.mapWithIndex((key, i) => (key, values->Array.getUnsafe(i))),
+    )
+    poolFromExports(~get=key => exports->Dict.get(key)->Option.flatMap(v => v))
+  | None =>
+    Platform_Stack._identityProviderId(
+      ~cfg=Pulumi.Config.make(Some("platform")),
+    )->Option.map(id => {
+      id,
+      region: Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region"),
+    })
+  }
+
+let sendTo = (~region: option<string>): send => {
+  let client = Cognito.Raw.client(~options={region: ?region})
+  input => Cognito.ListGroupsCommand.make(input)->Cognito.ListGroupsCommand.Raw.send(client, _)
+}
+
+/** List the pool's groups and record them for the role check. Leaves the check
+    on its other sources where there is no pool to ask yet. */
+let load = async (~stackRef: option<Pulumi.StackReference.t>): unit =>
+  switch await resolvePool(~stackRef) {
+  | None => ()
+  | Some({id, region}) =>
+    let groups = try await listAll(~send=sendTo(~region), ~userPoolId=id) catch {
+    | exn if exn->Util_AwsError.hasCode(~code="AccessDeniedException") =>
+      JsError.throwWithMessage(
+        `Cannot list the groups of the user pool ${id}: the deploying principal needs ` ++ `cognito-idp:ListGroups on it, so the deploy can check that every role a plugin needs has a group.`,
+      )
+    }
+    Reventless.Role.provideListedGroups(~source=`the user pool ${id}`, groups)
+  }

package/src/Platform_ProvidedGroups.res.mjs

@@ -0,0 +1,103 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Util_AwsError$ReventlessAws from "./util/Util_AwsError.res.mjs";
+import * as Platform_Stack$ReventlessAws from "./Platform_Stack.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+
+async function listAll(send, userPoolId) {
+  let page = async (nextToken, acc) => {
+    let out = await send({
+      UserPoolId: userPoolId,
+      Limit: 60,
+      NextToken: nextToken
+    });
+    let names = Stdlib_Array.filterMap(Stdlib_Option.getOr(out.Groups, []), g => g.GroupName);
+    let acc$1 = acc.concat(names);
+    let next = out.NextToken;
+    if (next !== undefined) {
+      return await page(next, acc$1);
+    } else {
+      return acc$1;
+    }
+  };
+  return await page(undefined, []);
+}
+
+function poolFromExports(get) {
+  let nested = Stdlib_Option.flatMap(get("default"), Stdlib_JSON.Decode.object);
+  let read = key => Stdlib_Option.flatMap(Stdlib_Option.orElse(get(key), Stdlib_Option.flatMap(nested, d => d[key])), Stdlib_JSON.Decode.string);
+  return Stdlib_Option.map(Stdlib_Option.orElse(read("identityProviderId"), read("cognitoUserPoolId")), id => ({
+    id: id,
+    region: Stdlib_Option.orElse(read("identityProviderRegion"), read("cognitoRegion"))
+  }));
+}
+
+async function resolvePool(stackRef) {
+  if (stackRef === undefined) {
+    return Stdlib_Option.map(Platform_Stack$ReventlessAws._identityProviderId(new Pulumi.Config("platform")), id => ({
+      id: id,
+      region: new Pulumi.Config("aws").get("region")
+    }));
+  }
+  let stackRef$1 = Primitive_option.valFromOption(stackRef);
+  let keys = [
+    "identityProviderId",
+    "cognitoUserPoolId",
+    "identityProviderRegion",
+    "cognitoRegion",
+    "default"
+  ];
+  let values = await Promise.all(keys.map(key => stackRef$1.getOutputValue(key)));
+  let $$exports = Object.fromEntries(keys.map((key, i) => [
+    key,
+    values[i]
+  ]));
+  return poolFromExports(key => Stdlib_Option.flatMap($$exports[key], v => v));
+}
+
+function sendTo(region) {
+  let client = new ClientCognitoIdentityProvider.CognitoIdentityProviderClient({
+    region: region
+  });
+  return input => client.send(new ClientCognitoIdentityProvider.ListGroupsCommand(input));
+}
+
+async function load(stackRef) {
+  let match = await resolvePool(stackRef);
+  if (match === undefined) {
+    return;
+  }
+  let id = match.id;
+  let groups;
+  try {
+    groups = await listAll(sendTo(match.region), id);
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.hasCode(exn, "AccessDeniedException")) {
+      groups = Stdlib_JsError.throwWithMessage(`Cannot list the groups of the user pool ` + id + `: the deploying principal needs cognito-idp:ListGroups on it, so the deploy can check that every role a plugin needs has a group.`);
+    } else {
+      throw exn;
+    }
+  }
+  return Role$Reventless.provideListedGroups(`the user pool ` + id, groups);
+}
+
+let Cognito;
+
+export {
+  Cognito,
+  listAll,
+  poolFromExports,
+  resolvePool,
+  sendTo,
+  load,
+}
+/* @pulumi/pulumi Not a pure module */

package/tests/BakeManifestTest.res

@@ -21,6 +21,8 @@ plugins:
     depends-on: []
   - name: ordering
     path: ordering-aws
+    region: eu-central-1
+    review: false
 `
 
   testSync("resolves every folder against the manifest's own folder", () => {
@@ -36,10 +38,21 @@ plugins:
           name: "shop-platform",
           dir: "/repo/shop/platform-aws",
           stackDefaults: Dict.fromArray([("platform:messagingEmailProvider", "log")]),
+          region: None,
         },
         plugins: [
-          {name: "catalog", dir: "/repo/shop/catalog-aws", stackDefaults: Dict.make()},
-          {name: "ordering", dir: "/repo/shop/ordering-aws", stackDefaults: Dict.make()},
+          {
+            name: "catalog",
+            dir: "/repo/shop/catalog-aws",
+            stackDefaults: Dict.make(),
+            region: None,
+          },
+          {
+            name: "ordering",
+            dir: "/repo/shop/ordering-aws",
+            stackDefaults: Dict.make(),
+            region: Some("eu-central-1"),
+          },
         ],
       }),
     )

package/tests/BakeManifestTest.res.mjs

@@ -25,6 +25,8 @@ plugins:
     depends-on: []
   - name: ordering
     path: ordering-aws
+    region: eu-central-1
+    review: false
 `), m => DeployManifest$ReventlessAws.resolve(m, "/repo/shop/deploy-manifest.yaml"));
     globalThis.expect(resolved).toEqual({
       TAG: "Ok",
@@ -37,18 +39,21 @@ plugins:
           stackDefaults: Object.fromEntries([[
               "platform:messagingEmailProvider",
               "log"
-            ]])
+            ]]),
+          region: undefined
         },
         plugins: [
           {
             name: "catalog",
             dir: "/repo/shop/catalog-aws",
-            stackDefaults: {}
+            stackDefaults: {},
+            region: undefined
           },
           {
             name: "ordering",
             dir: "/repo/shop/ordering-aws",
-            stackDefaults: {}
+            stackDefaults: {},
+            region: "eu-central-1"
           }
         ]
       }

package/tests/ClearPendingCreatesTest.res

@@ -0,0 +1,93 @@
+open JestGlobals
+
+// Which pending operations the deploy workflow's recovery step drops and which
+// stop it. The pulumi calls around them are checked against a real backend by
+// hand; what is tested here is the decision.
+
+module Clear = ClearPendingCreates
+
+let export = (operations: string) =>
+  JSON.parseOrThrow(
+    `{"version": 3, "deployment": {"resources": [], "pending_operations": ${operations}}}`,
+  )
+
+let operation = (~urn, ~type_) =>
+  `{"resource": {"urn": "${urn}", "type": "${type_}"}, "type": "creating"}`
+
+let validation = operation(
+  ~urn="urn:pulumi:alpha::app::aws:acm/certificateValidation:CertificateValidation::cert",
+  ~type_="aws:acm/certificateValidation:CertificateValidation",
+)
+let lambda = operation(
+  ~urn="urn:pulumi:alpha::app::aws:lambda/function:Function::handler",
+  ~type_="aws:lambda/function:Function",
+)
+
+let refused = (state: JSON.t) =>
+  state
+  ->Clear.pendingOperations
+  ->Array.filter(p => !Clear.isSafe(p))
+  ->Array.map(p => p.resourceType)
+
+describe("ClearPendingCreates.pendingOperations", () => {
+  testSync("a stack with none, or with no deployment yet, has none", () => {
+    expect(Clear.pendingOperations(export("[]")))->toEqual([])
+    expect(
+      Clear.pendingOperations(JSON.parseOrThrow(`{"version": 3, "deployment": {}}`)),
+    )->toEqual([])
+    expect(Clear.pendingOperations(JSON.parseOrThrow(`{"version": 3}`)))->toEqual([])
+  })
+
+  testSync("each operation with its resource and kind", () =>
+    expect(Clear.pendingOperations(export(`[${lambda}]`)))->toEqual([
+      {
+        Clear.urn: "urn:pulumi:alpha::app::aws:lambda/function:Function::handler",
+        resourceType: "aws:lambda/function:Function",
+        operation: "creating",
+      },
+    ])
+  )
+})
+
+describe("ClearPendingCreates.isSafe", () => {
+  testSync("a certificate validation is dropped", () =>
+    expect(refused(export(`[${validation}]`)))->toEqual([])
+  )
+
+  testSync("a resource that may exist in AWS stops the deploy", () =>
+    expect(refused(export(`[${lambda}]`)))->toEqual(["aws:lambda/function:Function"])
+  )
+
+  testSync("in a mix, only the unsafe one is refused", () =>
+    expect(refused(export(`[${validation}, ${lambda}]`)))->toEqual(["aws:lambda/function:Function"])
+  )
+
+  testSync("the type must match whole, not as a prefix", () =>
+    expect(
+      refused(
+        export(
+          `[${operation(~urn="u", ~type_="aws:acm/certificateValidation:CertificateValidationX")}]`,
+        ),
+      ),
+    )->toEqual(["aws:acm/certificateValidation:CertificateValidationX"])
+  )
+})
+
+describe("ClearPendingCreates.parseArgs", () => {
+  testSync("the stack, and the project directory", () =>
+    expect(Clear.parseArgs(["--stack", "alpha", "--cwd", "platform-aws"]))->toEqual(
+      Ok({Clear.stack: "alpha", cwd: "platform-aws"}),
+    )
+  )
+
+  testSync("the project directory defaults to the working directory", () =>
+    expect(Clear.parseArgs(["--stack", "alpha"])->Result.map(a => a.cwd))->toEqual(
+      Ok(NodeProcess.cwd()),
+    )
+  )
+
+  test("no stack is a usage mistake", async () => {
+    let observed = await Reventless.CliArgs.observe(Clear.cli, [])
+    expect((observed.exitCode, observed.reachedMain))->toEqual((Some(2), false))
+  })
+})

package/tests/ClearPendingCreatesTest.res.mjs

@@ -0,0 +1,99 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
+import * as ClearPendingCreates$ReventlessAws from "../scripts/ClearPendingCreates.res.mjs";
+
+function $$export(operations) {
+  return JSON.parse(`{"version": 3, "deployment": {"resources": [], "pending_operations": ` + operations + `}}`);
+}
+
+function operation(urn, type_) {
+  return `{"resource": {"urn": "` + urn + `", "type": "` + type_ + `"}, "type": "creating"}`;
+}
+
+let validation = `{"resource": {"urn": "` + "urn:pulumi:alpha::app::aws:acm/certificateValidation:CertificateValidation::cert" + `", "type": "` + "aws:acm/certificateValidation:CertificateValidation" + `"}, "type": "creating"}`;
+
+let lambda = `{"resource": {"urn": "` + "urn:pulumi:alpha::app::aws:lambda/function:Function::handler" + `", "type": "` + "aws:lambda/function:Function" + `"}, "type": "creating"}`;
+
+function refused(state) {
+  return ClearPendingCreates$ReventlessAws.pendingOperations(state).filter(p => !ClearPendingCreates$ReventlessAws.isSafe(p)).map(p => p.resourceType);
+}
+
+globalThis.describe("ClearPendingCreates.pendingOperations", () => {
+  globalThis.test("a stack with none, or with no deployment yet, has none", () => {
+    globalThis.expect(ClearPendingCreates$ReventlessAws.pendingOperations($$export("[]"))).toEqual([]);
+    globalThis.expect(ClearPendingCreates$ReventlessAws.pendingOperations(JSON.parse(`{"version": 3, "deployment": {}}`))).toEqual([]);
+    globalThis.expect(ClearPendingCreates$ReventlessAws.pendingOperations(JSON.parse(`{"version": 3}`))).toEqual([]);
+  });
+  globalThis.test("each operation with its resource and kind", () => {
+    globalThis.expect(ClearPendingCreates$ReventlessAws.pendingOperations($$export(`[` + lambda + `]`))).toEqual([{
+        urn: "urn:pulumi:alpha::app::aws:lambda/function:Function::handler",
+        resourceType: "aws:lambda/function:Function",
+        operation: "creating"
+      }]);
+  });
+});
+
+globalThis.describe("ClearPendingCreates.isSafe", () => {
+  globalThis.test("a certificate validation is dropped", () => {
+    globalThis.expect(refused($$export(`[` + validation + `]`))).toEqual([]);
+  });
+  globalThis.test("a resource that may exist in AWS stops the deploy", () => {
+    globalThis.expect(refused($$export(`[` + lambda + `]`))).toEqual(["aws:lambda/function:Function"]);
+  });
+  globalThis.test("in a mix, only the unsafe one is refused", () => {
+    globalThis.expect(refused($$export(`[` + validation + `, ` + lambda + `]`))).toEqual(["aws:lambda/function:Function"]);
+  });
+  globalThis.test("the type must match whole, not as a prefix", () => {
+    globalThis.expect(refused($$export(`[` + (`{"resource": {"urn": "` + "u" + `", "type": "` + "aws:acm/certificateValidation:CertificateValidationX" + `"}, "type": "creating"}`) + `]`))).toEqual(["aws:acm/certificateValidation:CertificateValidationX"]);
+  });
+});
+
+globalThis.describe("ClearPendingCreates.parseArgs", () => {
+  globalThis.test("the stack, and the project directory", () => {
+    globalThis.expect(ClearPendingCreates$ReventlessAws.parseArgs([
+      "--stack",
+      "alpha",
+      "--cwd",
+      "platform-aws"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        stack: "alpha",
+        cwd: "platform-aws"
+      }
+    });
+  });
+  globalThis.test("the project directory defaults to the working directory", () => {
+    globalThis.expect(Stdlib_Result.map(ClearPendingCreates$ReventlessAws.parseArgs([
+      "--stack",
+      "alpha"
+    ]), a => a.cwd)).toEqual({
+      TAG: "Ok",
+      _0: process.cwd()
+    });
+  });
+  globalThis.test("no stack is a usage mistake", async () => {
+    let observed = await CliArgs$Reventless.observe(ClearPendingCreates$ReventlessAws.cli, []);
+    globalThis.expect([
+      observed.exitCode,
+      observed.reachedMain
+    ]).toEqual([
+      2,
+      false
+    ]);
+  });
+});
+
+let Clear;
+
+export {
+  Clear,
+  $$export,
+  operation,
+  validation,
+  lambda,
+  refused,
+}
+/*  Not a pure module */

package/tests/DeployAppTest.res

@@ -55,8 +55,19 @@ describe("DeployApp stacks and layer", () => {
     projectName: "shop-platform-aws",
     program: "/app/platform-aws/src/Main.res.mjs",
     stackDefaults: Dict.fromArray([("aws:region", "us-east-1"), ("platform:x", "y")]),
+    region: None,
   }
 
+  testSync("a stack the manifest puts in another region is refused", () => {
+    let ingest = {...project, label: "ingest", region: Some("eu-central-1")}
+    expect(
+      DeployApp.regionProblems(~projects=[project, ingest], ~region="eu-west-1")->Array.length,
+    )->toBe(1)
+    expect(
+      DeployApp.regionProblems(~projects=[project, ingest], ~region="eu-central-1"),
+    )->toEqual([])
+  })
+
   // The region and the try-out flag come last, so an app default cannot turn a
   // try-out into a stack `down` refuses to remove.
   testSync("a new stack gets the app's defaults, then the region and the try-out flag", () =>

package/tests/DeployAppTest.res.mjs

@@ -79,8 +79,29 @@ globalThis.describe("DeployApp stacks and layer", () => {
     dir: "/app/platform-aws",
     projectName: "shop-platform-aws",
     program: "/app/platform-aws/src/Main.res.mjs",
-    stackDefaults: project_stackDefaults
+    stackDefaults: project_stackDefaults,
+    region: undefined
   };
+  globalThis.test("a stack the manifest puts in another region is refused", () => {
+    let ingest_stackDefaults = project_stackDefaults;
+    let ingest_region = "eu-central-1";
+    let ingest = {
+      label: "ingest",
+      dir: "/app/platform-aws",
+      projectName: "shop-platform-aws",
+      program: "/app/platform-aws/src/Main.res.mjs",
+      stackDefaults: ingest_stackDefaults,
+      region: ingest_region
+    };
+    globalThis.expect(DeployApp$ReventlessAws.regionProblems([
+      project,
+      ingest
+    ], "eu-west-1").length).toBe(1);
+    globalThis.expect(DeployApp$ReventlessAws.regionProblems([
+      project,
+      ingest
+    ], "eu-central-1")).toEqual([]);
+  });
   globalThis.test("a new stack gets the app's defaults, then the region and the try-out flag", () => {
     globalThis.expect(DeployApp$ReventlessAws.newStackConfig(project, "eu-west-1")).toEqual([
       [

package/tests/Platform_ProvidedGroupsTest.res

@@ -0,0 +1,52 @@
+open JestGlobals
+
+// What the role check compares a plugin's roles with on AWS: the groups the user
+// pool reports, found through the platform stack's exports.
+
+module Cognito = AwsSdk.CognitoIdentityServiceProvider
+
+let group = (name): Cognito.ListGroupsCommand.group => {groupName: name}
+
+describe("Platform_ProvidedGroups.listAll", () => {
+  test("follows NextToken until the last page", async () => {
+    let seen = []
+    let send = async (input: Cognito.ListGroupsCommand.input): Cognito.ListGroupsCommand.output => {
+      seen->Array.push(input.nextToken)
+      switch input.nextToken {
+      | None => {groups: [group("Admin"), group("Shopper")], nextToken: "p2"}
+      | Some(_) => {groups: [group("Merchandiser")]}
+      }
+    }
+    let groups = await Platform_ProvidedGroups.listAll(~send, ~userPoolId="p1")
+    expect((groups, seen))->toEqual((["Admin", "Shopper", "Merchandiser"], [None, Some("p2")]))
+  })
+})
+
+describe("Platform_ProvidedGroups.poolFromExports", () => {
+  let from = (pairs: array<(string, JSON.t)>) => {
+    let exports = Dict.fromArray(pairs)
+    Platform_ProvidedGroups.poolFromExports(~get=key => exports->Dict.get(key))
+  }
+
+  testSync("reads the pool id and region", () =>
+    expect(
+      from([
+        ("identityProviderId", JSON.Encode.string("p1")),
+        ("identityProviderRegion", JSON.Encode.string("eu-west-1")),
+      ]),
+    )->toEqual(Some({Platform_ProvidedGroups.id: "p1", region: Some("eu-west-1")}))
+  )
+
+  testSync("reads them nested under default, as an ESM platform exports them", () =>
+    expect(
+      from([
+        (
+          "default",
+          JSON.Encode.object(Dict.fromArray([("cognitoUserPoolId", JSON.Encode.string("p-old"))])),
+        ),
+      ]),
+    )->toEqual(Some({Platform_ProvidedGroups.id: "p-old", region: None}))
+  )
+
+  testSync("no pool id is no pool to list", () => expect(from([]))->toEqual(None))
+})