@reventlessdev/reventless-aws 3.0.0-alpha.394 → 3.0.0-alpha.396

package/src/Platform.res

@@ -1287,9 +1287,9 @@ module MakeWithConfig = (
     // door: unlike geocoding, a browser has no business sending mail from the
     // deployment's identity. Unset ⇒ no export, no grant.
     messagingSender?: ReventlessInfra.Platform.messagingSender,
-    // Ignored here: an in-process provider cannot reach a Lambda, and no
-    // pool-backed handle exists yet. The deploy gate refuses a plugin that
-    // declares the need, naming this.
+    // Ignored here: an in-process provider cannot reach a Lambda. Every AWS
+    // platform has a pool, and a plugin whose slice declares the need is handed
+    // a provider over it with no root opt-in — see `deployPlugin`.
     identityProvider?: Reventless.IdentityProvider.t,
     // Optional object store for direct-to-S3 uploads, as returned by
     // `Capability_ObjectStore_S3.make`. When set, the deploy registers it with
@@ -2760,6 +2760,37 @@ module MakeWithConfig = (
     }
     PluginRuntime_Builder.registerCapabilityEnv("MESSAGING_EMAIL_PROVIDER", messagingEmailProvider)
 
+    // The pool and its identity store, read across the same two halves. Every
+    // AWS platform has a pool, so unlike the two above there is no root opt-in:
+    // what a plugin declares decides whether its slices are granted the admin
+    // calls, in the slice runtime's finalizer.
+    let platformOutput = (name: string, ~local: unit => Pulumi.Output.t<string>) =>
+      switch platformStackRef {
+      | Some(stackRef) =>
+        (
+          stackRef->Pulumi.StackReference.getOutput(name): Pulumi.Output.t<option<string>>
+        )->Pulumi.Output.apply(o => o->Option.getOr(""))
+      | None => local()
+      }
+    let identityProviderId = platformOutput("identityProviderId", ~local=() =>
+      Platform_Stack.resolveCognitoUserPool().poolId
+    )
+    PluginRuntime_Builder.registerCapabilityEnv("IDENTITY_PROVIDER_ID", identityProviderId)
+    PluginRuntime_Builder.registerCapabilityEnv(
+      "IDENTITY_STORE_TABLE",
+      platformOutput("identityStore", ~local=() =>
+        Platform_Stack.resolveCognitoUserPool().identityTable.name
+      ),
+    )
+    PluginRuntime_Builder.registerIdentityProvider({
+      poolArn: platformOutput("identityProviderArn", ~local=() =>
+        Platform_Stack.resolveCognitoUserPool().poolArn
+      ),
+      storeArn: platformOutput("identityStoreArn", ~local=() =>
+        Platform_Stack.resolveCognitoUserPool().identityTable.arn
+      ),
+    })
+
     module P = unpack(plugin)
     let pluginComponent = P.make()
     ReventlessCore.Plugin_Helpers.clearOffload()
@@ -2895,10 +2926,17 @@ module MakeWithConfig = (
           stackRef->Pulumi.StackReference.getOutput("objectStores"),
           geocoderPlaceIndex,
           messagingEmailSender,
+          identityProviderId,
         )
-        ->Pulumi.Output.all4
+        ->Pulumi.Output.all5
         ->Pulumi.Output.apply((
-          (structure, objectStores, placeIndex, emailSender): (_, option<JSON.t>, string, string),
+          (structure, objectStores, placeIndex, emailSender, poolId): (
+            _,
+            option<JSON.t>,
+            string,
+            string,
+            string,
+          ),
         ) => {
           // ── Declared capabilities ──────────────────────────────────────────
           //
@@ -2922,10 +2960,11 @@ module MakeWithConfig = (
             // The values the slice Lambdas are actually handed, so this reads
             // what decides the outcome rather than a second record of the same
             // intent. `""` is what an unprovisioned platform exports.
-            ~provisioned=Array.concat(
+            ~provisioned=[
               placeIndex == "" ? [] : [Reventless.CapabilityNeed.Geocoding],
               emailSender == "" ? [] : [Reventless.CapabilityNeed.Messaging],
-            ),
+              poolId == "" ? [] : [Reventless.CapabilityNeed.IdentityProvider],
+            ]->Array.flat,
           ) {
           | [] => ()
           | missing =>
@@ -2942,9 +2981,7 @@ module MakeWithConfig = (
                   `default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or ` ++
                   `REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or ` ++ `\`platform:messagingEmailProvider: log\` to log every message and send none.`
                 | IdentityProvider =>
-                  `\n  IdentityProvider has no backend on any platform yet — the seam and the ` ++
-                  `refusal exist, the Cognito and local implementations do not. A plugin ` ++
-                  `declaring this need cannot be deployed until one lands; nothing about this ` ++ `deployment's configuration will change that.`
+                  `\n  IdentityProvider is the platform's Cognito pool, exported as ` ++ `\`identityProviderId\`. This platform stack exports none — deploy it first.`
                 }
               )
               // One line per capability, not per declaring component: two slices

package/src/Platform.res.mjs

@@ -1412,6 +1412,20 @@ function MakeWithConfig(Config) {
     PluginRuntime_Builder$ReventlessAws.registerMessagingSender(messagingEmailSender);
     let messagingEmailProvider = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailProvider").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailProviderRef.contents;
     PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_PROVIDER", messagingEmailProvider);
+    let platformOutput = (name, local) => {
+      if (platformStackRef !== undefined) {
+        return Primitive_option.valFromOption(platformStackRef).getOutput(name).apply(o => Stdlib_Option.getOr(o, ""));
+      } else {
+        return local();
+      }
+    };
+    let identityProviderId = platformOutput("identityProviderId", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().poolId);
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("IDENTITY_PROVIDER_ID", identityProviderId);
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("IDENTITY_STORE_TABLE", platformOutput("identityStore", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().identityTable.name));
+    PluginRuntime_Builder$ReventlessAws.registerIdentityProvider({
+      poolArn: platformOutput("identityProviderArn", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().poolArn),
+      storeArn: platformOutput("identityStoreArn", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().identityTable.arn)
+    });
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -1469,15 +1483,18 @@ function MakeWithConfig(Config) {
         pluginOutputs.pluginStructure,
         stackRef.getOutput("objectStores"),
         geocoderPlaceIndex,
-        messagingEmailSender
+        messagingEmailSender,
+        identityProviderId
       ]).apply(param => {
         let structure = param[0];
         let missing = CapabilityNeed$Reventless.unmet(Stdlib_Option.getOr(Stdlib_Option.flatMap(structure, s => s.requiredCapabilities), []).map(d => [
           d.capability,
           d.component
-        ]), (
-          param[2] === "" ? [] : ["Geocoding"]
-        ).concat(param[3] === "" ? [] : ["Messaging"]));
+        ]), [
+          param[2] === "" ? [] : ["Geocoding"],
+          param[3] === "" ? [] : ["Messaging"],
+          param[4] === "" ? [] : ["IdentityProvider"]
+        ].flat());
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
@@ -1487,7 +1504,7 @@ function MakeWithConfig(Config) {
               case "Messaging" :
                 return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
               case "IdentityProvider" :
-                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
+                return `\n  IdentityProvider is the platform's Cognito pool, exported as \`identityProviderId\`. This platform stack exports none — deploy it first.`;
             }
           }))).join(""));
         }
@@ -2804,6 +2821,20 @@ function Make($star) {
     PluginRuntime_Builder$ReventlessAws.registerMessagingSender(messagingEmailSender);
     let messagingEmailProvider = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailProvider").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailProviderRef.contents;
     PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_PROVIDER", messagingEmailProvider);
+    let platformOutput = (name, local) => {
+      if (platformStackRef !== undefined) {
+        return Primitive_option.valFromOption(platformStackRef).getOutput(name).apply(o => Stdlib_Option.getOr(o, ""));
+      } else {
+        return local();
+      }
+    };
+    let identityProviderId = platformOutput("identityProviderId", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().poolId);
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("IDENTITY_PROVIDER_ID", identityProviderId);
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("IDENTITY_STORE_TABLE", platformOutput("identityStore", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().identityTable.name));
+    PluginRuntime_Builder$ReventlessAws.registerIdentityProvider({
+      poolArn: platformOutput("identityProviderArn", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().poolArn),
+      storeArn: platformOutput("identityStoreArn", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().identityTable.arn)
+    });
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -2861,15 +2892,18 @@ function Make($star) {
         pluginOutputs.pluginStructure,
         stackRef.getOutput("objectStores"),
         geocoderPlaceIndex,
-        messagingEmailSender
+        messagingEmailSender,
+        identityProviderId
       ]).apply(param => {
         let structure = param[0];
         let missing = CapabilityNeed$Reventless.unmet(Stdlib_Option.getOr(Stdlib_Option.flatMap(structure, s => s.requiredCapabilities), []).map(d => [
           d.capability,
           d.component
-        ]), (
-          param[2] === "" ? [] : ["Geocoding"]
-        ).concat(param[3] === "" ? [] : ["Messaging"]));
+        ]), [
+          param[2] === "" ? [] : ["Geocoding"],
+          param[3] === "" ? [] : ["Messaging"],
+          param[4] === "" ? [] : ["IdentityProvider"]
+        ].flat());
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
@@ -2879,7 +2913,7 @@ function Make($star) {
               case "Messaging" :
                 return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
               case "IdentityProvider" :
-                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
+                return `\n  IdentityProvider is the platform's Cognito pool, exported as \`identityProviderId\`. This platform stack exports none — deploy it first.`;
             }
           }))).join(""));
         }

package/src/Platform_Stack.res

@@ -12,6 +12,9 @@ type cognitoUserPool = {
     is declared with the trigger's ARN), while the mutation that writes it is
     provisioned after the API — see [Auth_ActiveRoleStore.res]. */
   activeRoleTable: Auth_ActiveRoleStore.storeTable,
+  /** Rows mapping each subject to the domain's own user id, read by the same
+    trigger and written when an account is created — see [Auth_IdentityStore.res]. */
+  identityTable: Auth_IdentityStore.storeTable,
   /** The sign-in attribute this stack created the pool with. `None` in BYO mode:
     the pool's own choice was made elsewhere and no lookup here reads it back,
     so reporting one would be a guess. */
@@ -179,9 +182,16 @@ let _resolveUncached = (): cognitoUserPool => {
     ~choice=Auth_ActiveRoleStore.chooseStore(~identityProviderId=existingPoolId),
     ~opts={},
   )
+  // Same scope rule, same reason: the trigger that reads it is the pool's.
+  let identityTable = Auth_IdentityStore.resolveTable(
+    ~choice=Auth_IdentityStore.chooseStore(~identityProviderId=existingPoolId),
+    ~opts={},
+  )
   let activeRoleTrigger = Auth_ActiveRoleTrigger.make(
     ~activeRoleTableName=activeRoleTable.name->Pulumi.Output.asInput,
     ~activeRoleTableArn=activeRoleTable.arn->Pulumi.Output.asInput,
+    ~identityTableName=identityTable.name->Pulumi.Output.asInput,
+    ~identityTableArn=identityTable.arn->Pulumi.Output.asInput,
     ~opts={},
   )
 
@@ -239,6 +249,7 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: lookup->Pulumi.Output.apply(r => r.arn),
       managed: false,
       activeRoleTable,
+      identityTable,
       loginIdentifier: None,
     }
 
@@ -334,6 +345,7 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: pool.arn,
       managed: true,
       activeRoleTable,
+      identityTable,
       loginIdentifier: Some(loginIdentifier),
     }
   }
@@ -409,6 +421,11 @@ let _resolveUncached = (): cognitoUserPool => {
   // the name is derived, not configured, so this is a convenience for checking
   // rather than a value anything is meant to copy into a config.
   Pulumi.Pulumi.export("activeRoleStore", result.activeRoleTable.name)
+  // Read by `provision-accounts` on a stack-owned pool, whose table carries a
+  // generated suffix no derivation can produce.
+  Pulumi.Pulumi.export("identityStore", result.identityTable.name)
+  // What a plugin stack grants its principal-making slices write access to.
+  Pulumi.Pulumi.export("identityStoreArn", result.identityTable.arn)
 
   result
 }

package/src/Platform_Stack.res.mjs

@@ -10,6 +10,7 @@ import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Auth_SignUpMode$ReventlessAws from "./adapter/Auth/Auth_SignUpMode.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
+import * as Auth_IdentityStore$ReventlessAws from "./adapter/Auth/Auth_IdentityStore.res.mjs";
 import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
 import * as Auth_LoginIdentifier$ReventlessAws from "./adapter/Auth/Auth_LoginIdentifier.res.mjs";
 import * as Util_CognitoGroupUser$ReventlessAws from "./util/Util_CognitoGroupUser.res.mjs";
@@ -66,7 +67,8 @@ function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
   let existingPoolId = _identityProviderId(cfg);
   let activeRoleTable = Auth_ActiveRoleStore$ReventlessAws.resolveTable(Auth_ActiveRoleStore$ReventlessAws.chooseStore(existingPoolId), {});
-  let activeRoleTrigger = Auth_ActiveRoleTrigger$ReventlessAws.make(activeRoleTable.name, activeRoleTable.arn, undefined, {});
+  let identityTable = Auth_IdentityStore$ReventlessAws.resolveTable(Auth_IdentityStore$ReventlessAws.chooseStore(existingPoolId), {});
+  let activeRoleTrigger = Auth_ActiveRoleTrigger$ReventlessAws.make(activeRoleTable.name, activeRoleTable.arn, identityTable.name, identityTable.arn, undefined, {});
   let result;
   if (existingPoolId !== undefined) {
     let tokenUnits_accessToken = "minutes";
@@ -105,6 +107,7 @@ function _resolveUncached() {
       poolArn: lookup.apply(r => r.arn),
       managed: false,
       activeRoleTable: activeRoleTable,
+      identityTable: identityTable,
       loginIdentifier: undefined
     };
   } else {
@@ -161,6 +164,7 @@ function _resolveUncached() {
       poolArn: pool.arn,
       managed: true,
       activeRoleTable: activeRoleTable,
+      identityTable: identityTable,
       loginIdentifier: loginIdentifier
     };
   }
@@ -183,6 +187,8 @@ function _resolveUncached() {
   Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
   Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(Role$Reventless.adminGroup()));
   Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
+  Pulumi$Pulumi.$$export("identityStore", result.identityTable.name);
+  Pulumi$Pulumi.$$export("identityStoreArn", result.identityTable.arn);
   return result;
 }
 

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res

@@ -30,6 +30,8 @@ type triggerOutputs = {
 let make = (
   ~activeRoleTableName: Pulumi.Input.t<string>,
   ~activeRoleTableArn: Pulumi.Input.t<string>,
+  ~identityTableName: Pulumi.Input.t<string>,
+  ~identityTableArn: Pulumi.Input.t<string>,
   ~name: string="ActiveRoleTrigger",
   ~opts: Pulumi.ComponentResource.options,
 ): triggerOutputs => {
@@ -47,14 +49,14 @@ let make = (
     ~opts,
   )
 
-  // Logs and a single-item read. Nothing else: the trigger needs no Cognito
-  // permission at all, because the membership it checks against arrives in the
-  // event as `request.groupConfiguration.groupsToOverride`. `GetItem` alone —
-  // this function must never be able to write the preference it reads.
+  // Logs and single-item reads of the two stores. Nothing else: the trigger
+  // needs no Cognito permission at all, because the membership it checks
+  // against arrives in the event as `request.groupConfiguration.groupsToOverride`.
+  // `GetItem` alone — this function must never be able to write what it reads.
   let _policy =
-    activeRoleTableArn
-    ->Pulumi.Output.fromInput
-    ->Pulumi.Output.apply(tableArn => {
+    (activeRoleTableArn->Pulumi.Output.fromInput, identityTableArn->Pulumi.Output.fromInput)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((tableArn, identityArn)) => {
       let _ = IAM.RolePolicy.make(
         ~name=name ++ "Policy",
         ~args={
@@ -77,6 +79,12 @@ let make = (
                 actions: Action("dynamodb:GetItem"),
                 resources: Resource(tableArn),
               },
+              {
+                sid: "AllowReadingDomainId",
+                effect: Allow,
+                actions: Action("dynamodb:GetItem"),
+                resources: Resource(identityArn),
+              },
             ],
           )
           ->PolicyDocument.toJsonString
@@ -140,6 +148,7 @@ let make = (
           Lambda.Function.variables: Dict.fromArray([
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("ACTIVE_ROLE_TABLE", activeRoleTableName),
+            ("IDENTITY_STORE_TABLE", identityTableName),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
             Util_LambdaLogging.logLevelEntry(),

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res.mjs

@@ -11,11 +11,14 @@ import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 
-function make(activeRoleTableName, activeRoleTableArn, nameOpt, opts) {
+function make(activeRoleTableName, activeRoleTableArn, identityTableName, identityTableArn, nameOpt, opts) {
   let name = nameOpt !== undefined ? nameOpt : "ActiveRoleTrigger";
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
-  activeRoleTableArn.apply(tableArn => {
+  Pulumi.all([
+    activeRoleTableArn,
+    identityTableArn
+  ]).apply(param => {
     new (Aws.iam.RolePolicy)(name + "Policy", {
       policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "Policy", [
         {
@@ -32,7 +35,13 @@ function make(activeRoleTableName, activeRoleTableArn, nameOpt, opts) {
           Sid: "AllowReadingStoredRole",
           Effect: "Allow",
           Action: "dynamodb:GetItem",
-          Resource: tableArn
+          Resource: param[0]
+        },
+        {
+          Sid: "AllowReadingDomainId",
+          Effect: "Allow",
+          Action: "dynamodb:GetItem",
+          Resource: param[1]
         }
       ])),
       role: lambdaRole.id
@@ -65,6 +74,10 @@ function make(activeRoleTableName, activeRoleTableArn, nameOpt, opts) {
           "ACTIVE_ROLE_TABLE",
           activeRoleTableName
         ],
+        [
+          "IDENTITY_STORE_TABLE",
+          identityTableName
+        ],
         [
           "NODE_OPTIONS",
           Util_Bundle$ReventlessAws.esmLoaderNodeOptions

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -41,6 +41,11 @@ let tableName = (): string =>
   | None => JsError.throwWithMessage("ACTIVE_ROLE_TABLE is not configured")
   }
 
+/** The identity store, read for the domain id claim. Optional where the role
+    store is not: a trigger deployed before the store existed must keep minting
+    tokens, and an absent store means exactly what an absent row means. */
+let identityTableName = (): option<string> => getEnv("IDENTITY_STORE_TABLE")
+
 // ── Cognito pre-token-generation event (V1_0) ───────────────────────────────
 
 type userAttributes = {sub?: string}
@@ -124,16 +129,24 @@ exactly one thing.
 `claimsOverrideDetails` is not the same as none, and the regression line for this
 whole feature is that a caller with no stored role gets byte-identical output.
 */
-let respond = (~event: event, ~decision: decision): event => {
+let respond = (~event: event, ~decision: decision, ~userId: option<string>=?): event => {
   let incoming = event.request->Option.flatMap(r => r.groupConfiguration)
   let iamRolesToOverride = incoming->Option.flatMap(g => g.iamRolesToOverride)->Option.getOr([])
   let preferredRole = incoming->Option.flatMap(g => g.preferredRole)
 
+  // The domain id rides on whatever else the mint adds. On its own it adds only
+  // the claim and leaves the group configuration alone, so a caller with a
+  // domain id and no stored role keeps exactly the groups the pool granted.
+  let withUserId = (claims: dict<string>) => {
+    userId->Option.forEach(id => claims->Dict.set(ReventlessCore.Auth_UserId.claim, id))
+    claims
+  }
+
   let overrideWith = (~groups: array<string>, ~claims: dict<string>) => {
     ...event,
     response: {
       claimsOverrideDetails: {
-        claimsToAddOrOverride: claims,
+        claimsToAddOrOverride: withUserId(claims),
         groupOverrideDetails: {
           groupsToOverride: groups,
           iamRolesToOverride,
@@ -143,9 +156,13 @@ let respond = (~event: event, ~decision: decision): event => {
     },
   }
 
-  switch decision {
-  | Unchanged => event
-  | Narrow({role, membership}) =>
+  switch (decision, userId) {
+  | (Unchanged, None) => event
+  | (Unchanged, Some(_)) => {
+      ...event,
+      response: {claimsOverrideDetails: {claimsToAddOrOverride: withUserId(Dict.make())}},
+    }
+  | (Narrow({role, membership}), _) =>
     overrideWith(
       ~groups=[role],
       ~claims=Dict.fromArray([
@@ -153,7 +170,7 @@ let respond = (~event: event, ~decision: decision): event => {
         (ReventlessCore.Auth_ActiveRole.availableRolesClaim, membership->Array.join(",")),
       ]),
     )
-  | Stale({role, membership}) =>
+  | (Stale({role, membership}), _) =>
     // The full set, as the pool granted it — plus the marker that explains why the
     // stored choice did not apply.
     overrideWith(
@@ -194,6 +211,33 @@ let storedRoleFor = async (~sub: string, ~clientId: string, ~table: string): opt
   | _ => None
   }
 
+/**
+The domain id minted for this subject, or `None` for an account created before
+the store existed — whose id is its `sub`, and must stay so: every row it has
+written is keyed by it.
+
+Fails to `None` for the reason [storedRoleFor] does: a claim this trigger could
+not read is a login that must still succeed, and a caller without the claim
+lands on the fallback every older account already uses.
+*/
+let userIdFor = async (~sub: string, ~table: option<string>): option<string> =>
+  switch table {
+  | None => None
+  | Some(table) =>
+    try {
+      let out = await DynamoDb_DocumentClient.GetCommand.make({
+        tableName: table,
+        key: Dict.fromArray([(Auth_IdentityStore_Schema.partitionKey, JSON.Encode.string(sub))]),
+      })->DynamoDb_DocumentClient.GetCommand.send
+      out.item
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(o => o->Dict.get(Auth_IdentityStore_Schema.userIdAttribute))
+      ->Option.flatMap(JSON.Decode.string)
+    } catch {
+    | _ => None
+    }
+  }
+
 // ── Handler ─────────────────────────────────────────────────────────────────
 
 let handler = async (event: event): event => {
@@ -216,10 +260,16 @@ let handler = async (event: event): event => {
   // granted — the safe direction, and the same one a read failure takes. An
   // absent client id is not worth failing a login over: the caller lands on their
   // full membership, which is their existing privileges and not more.
-  if sub == "" || clientId == "" {
+  if sub == "" {
     event
+  } else if clientId == "" {
+    respond(~event, ~decision=Unchanged, ~userId=?await userIdFor(~sub, ~table=identityTableName()))
   } else {
-    let storedRole = await storedRoleFor(~sub, ~clientId, ~table=tableName())
-    respond(~event, ~decision=decide(~membership, ~storedRole))
+    // Both reads at once: this function is a login's latency.
+    let (storedRole, userId) = await Promise.all2((
+      storedRoleFor(~sub, ~clientId, ~table=tableName()),
+      userIdFor(~sub, ~table=identityTableName()),
+    ))
+    respond(~event, ~decision=decide(~membership, ~storedRole), ~userId?)
   }
 }

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs

@@ -4,8 +4,10 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "./Auth_IdentityStore_Schema.res.mjs";
 import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "./Auth_ActiveRoleStore_Schema.res.mjs";
 
 function getEnv(k) {
@@ -24,6 +26,10 @@ function tableName() {
   }
 }
 
+function identityTableName() {
+  return getEnv("IDENTITY_STORE_TABLE");
+}
+
 function decide(membership, storedRole) {
   if (storedRole !== undefined && storedRole !== "") {
     if (membership.includes(storedRole)) {
@@ -44,15 +50,21 @@ function decide(membership, storedRole) {
   }
 }
 
-function respond(event, decision) {
+function respond(event, decision, userId) {
   let incoming = Stdlib_Option.flatMap(event.request, r => r.groupConfiguration);
   let iamRolesToOverride = Stdlib_Option.getOr(Stdlib_Option.flatMap(incoming, g => g.iamRolesToOverride), []);
   let preferredRole = Stdlib_Option.flatMap(incoming, g => g.preferredRole);
+  let withUserId = claims => {
+    Stdlib_Option.forEach(userId, id => {
+      claims[Auth_UserId$ReventlessCore.claim] = id;
+    });
+    return claims;
+  };
   let overrideWith = (groups, claims) => {
     let newrecord = {...event};
     newrecord.response = {
       claimsOverrideDetails: {
-        claimsToAddOrOverride: claims,
+        claimsToAddOrOverride: withUserId(claims),
         groupOverrideDetails: {
           groupsToOverride: groups,
           iamRolesToOverride: iamRolesToOverride,
@@ -63,7 +75,16 @@ function respond(event, decision) {
     return newrecord;
   };
   if (typeof decision !== "object") {
-    return event;
+    if (userId === undefined) {
+      return event;
+    }
+    let newrecord = {...event};
+    newrecord.response = {
+      claimsOverrideDetails: {
+        claimsToAddOrOverride: withUserId({})
+      }
+    };
+    return newrecord;
   }
   if (decision.TAG === "Narrow") {
     let role = decision.role;
@@ -112,23 +133,49 @@ async function storedRoleFor(sub, clientId, table) {
   }
 }
 
+async function userIdFor(sub, table) {
+  if (table === undefined) {
+    return;
+  }
+  try {
+    let out = await DynamoDb_DocumentClient$AwsSdk.GetCommand.send(new LibDynamodb.GetCommand({
+      TableName: table,
+      Key: Object.fromEntries([[
+          Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+          sub
+        ]])
+    }));
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(out.Item, Stdlib_JSON.Decode.object), o => o[Auth_IdentityStore_Schema$ReventlessAws.userIdAttribute]), Stdlib_JSON.Decode.string);
+  } catch (exn) {
+    return;
+  }
+}
+
 async function handler(event) {
   let membership = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event.request, r => r.groupConfiguration), g => g.groupsToOverride), []);
   let sub = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event.request, r => r.userAttributes), u => u.sub), "");
   let clientId = Stdlib_Option.getOr(Stdlib_Option.flatMap(event.callerContext, c => c.clientId), "");
-  if (sub === "" || clientId === "") {
+  if (sub === "") {
     return event;
   }
-  let storedRole = await storedRoleFor(sub, clientId, tableName());
-  return respond(event, decide(membership, storedRole));
+  if (clientId === "") {
+    return respond(event, "Unchanged", await userIdFor(sub, getEnv("IDENTITY_STORE_TABLE")));
+  }
+  let match = await Promise.all([
+    storedRoleFor(sub, clientId, tableName()),
+    userIdFor(sub, getEnv("IDENTITY_STORE_TABLE"))
+  ]);
+  return respond(event, decide(membership, match[0]), match[1]);
 }
 
 export {
   getEnv,
   tableName,
+  identityTableName,
   decide,
   respond,
   storedRoleFor,
+  userIdFor,
   handler,
 }
 /* @aws-sdk/lib-dynamodb Not a pure module */