@reventlessdev/reventless-aws 3.0.0-alpha.393 → 3.0.0-alpha.395

package/CHANGELOG.md

@@ -3,6 +3,27 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.395 (2026-10-22)
+
+* feat(aws)!: the host shell's config.json names the identity provider under the neutral keys only ([6ce24ba](https://github.com/ReventlessDev/reventless-core/commit/6ce24ba7dde27da02f76f7f9f6284ad09a48f15a))
+### Features
+
+* **local:** the local platform provisions an identity provider over the accounts file ([1a46867](https://github.com/ReventlessDev/reventless-core/commit/1a46867ac391b3b4a2d6973606d782547190dcb8))
+
+### BREAKING CHANGES
+
+* a reader of the host shell's config.json that only knows cognitoClientId
+or cognitoUserPoolId finds neither; read identityProviderClientId and identityProviderId.
+
+
+
+# 3.0.0-alpha.394 (2026-10-22)
+
+### Features
+
+* **local:** the local platform provisions an identity provider over the accounts file ([1a46867](https://github.com/ReventlessDev/reventless-core/commit/1a46867ac391b3b4a2d6973606d782547190dcb8))
+
+
 # 3.0.0-alpha.393 (2026-10-21)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.393",
+  "version": "3.0.0-alpha.395",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -23,18 +23,18 @@
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.33",
+    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
-    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.31",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-web": "1.0.0-alpha.8",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.201",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.168",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.306",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.173",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.304"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.175",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.203",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.170"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res

@@ -1287,6 +1287,10 @@ module MakeWithConfig = (
     // door: unlike geocoding, a browser has no business sending mail from the
     // deployment's identity. Unset ⇒ no export, no grant.
     messagingSender?: ReventlessInfra.Platform.messagingSender,
+    // Ignored here: an in-process provider cannot reach a Lambda, and no
+    // pool-backed handle exists yet. The deploy gate refuses a plugin that
+    // declares the need, naming this.
+    identityProvider?: Reventless.IdentityProvider.t,
     // Optional object store for direct-to-S3 uploads, as returned by
     // `Capability_ObjectStore_S3.make`. When set, the deploy registers it with
     // the platform's one Upload service (`Upload_Presign_S3`) under the `uploads`
@@ -2375,7 +2379,7 @@ module MakeWithConfig = (
         ->Pulumi.Output.apply((((domainEp, platformEp, poolId, clientId), eventsEpOpt)) => {
           // `authMode` stays `"cognito"`: it is a value naming which provider
           // authenticates this deployment, and that is true. The identity *keys*
-          // travel under both spellings — see [Util_ShellConfig.identityFields].
+          // are provider-neutral — see [Util_ShellConfig.identityFields].
           let computed =
             [
               ("apiEndpoint", JSON.Encode.string(domainEp)),

package/src/util/Util_ShellConfig.res

@@ -32,31 +32,20 @@ let modeOptions = (mode: Platform.viewMode): array<(string, JSON.t)> =>
   }
 
 /**
-The identity fields a shell reads, under **both** spellings.
+The identity fields a shell reads. The concept is not AWS-specific, so a second
+cloud's adapter meets the same names.
 
-🚨 **Both, and not as a sequenced rename.** `identityProvider*` is what these
-become — the concept is not AWS-specific, so a second cloud's adapter should meet
-the same names. `cognito*` is what every shipped shell reads today.
+The `cognitoUserPoolId` / `cognitoClientId` pair travelled beside these through
+the rename, because a shell reads `config.json` at runtime and a bundle that
+cannot find its client id gets `None` and a login that silently fails. It went
+once every pinned shell read these names (host shell 3.0.0-alpha.122 and later).
 
-A shell reads `config.json` at runtime and CloudFront serves the previous bundle
-until someone invalidates it, so switching the keys in one deploy leaves a window
-where the served bundle and the served config disagree. `cognitoClientId` is read
-into an `option`: a bundle that cannot find its key does not error, it gets
-`None`, and login, silent refresh and token refresh all quietly fall through —
-the window is a total auth outage that reports nothing.
-
-Writing both removes the ordering dependency rather than managing it: any bundle,
-old or new or stale in a CDN, finds one it understands. The `cognito*` pair goes
-once the shell that prefers the other is the pinned one.
-
-Here rather than inline at the call site so the pairing is one fact in one place,
-and so the property can be asserted without a deploy.
+Here rather than inline at the call site so the key set is one fact in one place,
+and so it can be asserted without a deploy.
 */
 let identityFields = (~providerId: string, ~clientId: string): array<(string, JSON.t)> => [
   ("identityProviderId", JSON.Encode.string(providerId)),
   ("identityProviderClientId", JSON.Encode.string(clientId)),
-  ("cognitoUserPoolId", JSON.Encode.string(providerId)),
-  ("cognitoClientId", JSON.Encode.string(clientId)),
 ]
 
 /**

package/src/util/Util_ShellConfig.res.mjs

@@ -43,14 +43,6 @@ function identityFields(providerId, clientId) {
     [
       "identityProviderClientId",
       clientId
-    ],
-    [
-      "cognitoUserPoolId",
-      providerId
-    ],
-    [
-      "cognitoClientId",
-      clientId
     ]
   ];
 }

package/tests/Util_ShellConfigTest.res

@@ -298,50 +298,25 @@ describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
   })
 })
 
-// 🚨 The identity keys travel under both spellings through the rename. A shell
-// reads config.json at runtime and CloudFront serves the previous bundle until
-// someone invalidates it, so switching them in one deploy leaves a window where
-// the served bundle and the served config disagree — and `cognitoClientId` is
-// read into an option, so a bundle that cannot find its key does not error, it
-// gets `None` and login silently stops working.
-//
-// These assert the property that removes that window, not the spelling.
+// A shell reads config.json at runtime, and `identityProviderClientId` is read
+// into an option: a bundle that cannot find it gets `None` and a login that
+// silently stops working. These assert the key set, so a rename cannot slip out
+// in a refactor without a test naming it.
 describe("Util_ShellConfig.identityFields", () => {
   let fields = Util_ShellConfig.identityFields(~providerId="eu-west-1_x", ~clientId="7cl13nt")
   let get = key => fields->Array.find(((k, _)) => k == key)->Option.map(((_, v)) => v)
 
-  testSync("the new spelling is present", () =>
+  testSync("the identity keys carry the pool and the client", () =>
     expect((get("identityProviderId"), get("identityProviderClientId")))->toEqual((
       Some(JSON.Encode.string("eu-west-1_x")),
       Some(JSON.Encode.string("7cl13nt")),
     ))
   )
 
-  // Not "still" — deliberately. Every shipped shell reads these, and dropping
-  // them is a later release gated on the pinned bundle, not on this one.
-  testSync("the deprecated spelling is present too", () =>
-    expect((get("cognitoUserPoolId"), get("cognitoClientId")))->toEqual((
-      Some(JSON.Encode.string("eu-west-1_x")),
-      Some(JSON.Encode.string("7cl13nt")),
-    ))
-  )
-
-  // The whole point: a bundle reading either name gets the same answer. Two keys
-  // carrying different values would be worse than one key, not better.
-  testSync("both spellings carry identical values", () =>
-    expect((
-      get("identityProviderId") == get("cognitoUserPoolId"),
-      get("identityProviderClientId") == get("cognitoClientId"),
-    ))->toEqual((true, true))
-  )
-
-  // The client id is the load-bearing one — it is what the shell's auth provider
-  // branches on. The pool id is currently discarded by the shell, which is
-  // exactly why a `cognito*` sweep is dangerous: the safe one gives no warning.
+  // The transitional `cognito*` pair is gone: every pinned shell reads the
+  // names above, and a reader that still wants the old ones is the defect.
   testSync("nothing else sneaks into the identity field set", () =>
     expect(fields->Array.map(((k, _)) => k)->Array.toSorted(String.compare))->toEqual([
-      "cognitoClientId",
-      "cognitoUserPoolId",
       "identityProviderClientId",
       "identityProviderId",
     ])

package/tests/Util_ShellConfigTest.res.mjs

@@ -5,7 +5,6 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
-import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_ShellConfig$ReventlessAws from "../src/util/Util_ShellConfig.res.mjs";
@@ -351,7 +350,7 @@ globalThis.describe("Util_ShellConfig.fields — shellConfig passthrough", () =>
 globalThis.describe("Util_ShellConfig.identityFields", () => {
   let fields = Util_ShellConfig$ReventlessAws.identityFields("eu-west-1_x", "7cl13nt");
   let get = key => Stdlib_Option.map(fields.find(param => param[0] === key), param => param[1]);
-  globalThis.test("the new spelling is present", () => {
+  globalThis.test("the identity keys carry the pool and the client", () => {
     globalThis.expect([
       get("identityProviderId"),
       get("identityProviderClientId")
@@ -360,28 +359,8 @@ globalThis.describe("Util_ShellConfig.identityFields", () => {
       "7cl13nt"
     ]);
   });
-  globalThis.test("the deprecated spelling is present too", () => {
-    globalThis.expect([
-      get("cognitoUserPoolId"),
-      get("cognitoClientId")
-    ]).toEqual([
-      "eu-west-1_x",
-      "7cl13nt"
-    ]);
-  });
-  globalThis.test("both spellings carry identical values", () => {
-    globalThis.expect([
-      Primitive_object.equal(get("identityProviderId"), get("cognitoUserPoolId")),
-      Primitive_object.equal(get("identityProviderClientId"), get("cognitoClientId"))
-    ]).toEqual([
-      true,
-      true
-    ]);
-  });
   globalThis.test("nothing else sneaks into the identity field set", () => {
     globalThis.expect(fields.map(param => param[0]).toSorted(Primitive_string.compare)).toEqual([
-      "cognitoClientId",
-      "cognitoUserPoolId",
       "identityProviderClientId",
       "identityProviderId"
     ]);