@reventlessdev/reventless-aws 3.0.0-alpha.394 → 3.0.0-alpha.396

package/src/adapter/Auth/Auth_Cognito.res

@@ -58,13 +58,24 @@ let _getHeader = (headers: dict<string>, name: string): option<string> =>
   | None => headers->Dict.get(name)
   }
 
+// The domain id when the token carries one, else the `sub`. The fallback is
+// what every account created before the identity store existed relies on: its
+// rows are keyed by the `sub`, and a different answer here would orphan them.
+let _userIdOf = (~claims: dict<JSON.t>, ~sub: string): string =>
+  claims
+  ->Dict.get(ReventlessCore.Auth_UserId.claim)
+  ->Option.flatMap(JSON.Decode.string)
+  ->Option.filter(id => id != "")
+  ->Option.getOr(sub)
+
 let _identityFromClaims = (claims: 'a): Identity.t => {
   let claimsDict: dict<JSON.t> = claims->Obj.magic
-  let userId =
+  let sub =
     claimsDict
     ->Dict.get("sub")
     ->Option.flatMap(JSON.Decode.string)
     ->Option.getOr("anonymous")
+  let userId = _userIdOf(~claims=claimsDict, ~sub)
   let username =
     claimsDict
     ->Dict.get("cognito:username")
@@ -154,7 +165,7 @@ let fromAppSyncIdentity = (id: option<appSyncIdentity>): Identity.authResult =>
         ->Array.map(((k, v)) => (k, v->JSON.Decode.string->Option.getOr(v->JSON.stringify)))
         ->Dict.fromArray
       Authenticated({
-        userId: sub,
+        userId: _userIdOf(~claims=rawClaims, ~sub),
         username,
         groups,
         claims,

package/src/adapter/Auth/Auth_Cognito.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as Platform_Stack$ReventlessAws from "../../Platform_Stack.res.mjs";
 
 let _decodeJwtClaims = (function(token) {
@@ -31,8 +32,13 @@ function _getHeader(headers, name) {
   }
 }
 
+function _userIdOf(claims, sub) {
+  return Stdlib_Option.getOr(Stdlib_Option.filter(Stdlib_Option.flatMap(claims[Auth_UserId$ReventlessCore.claim], Stdlib_JSON.Decode.string), id => id !== ""), sub);
+}
+
 function _identityFromClaims(claims) {
-  let userId = Stdlib_Option.getOr(Stdlib_Option.flatMap(claims["sub"], Stdlib_JSON.Decode.string), "anonymous");
+  let sub = Stdlib_Option.getOr(Stdlib_Option.flatMap(claims["sub"], Stdlib_JSON.Decode.string), "anonymous");
+  let userId = _userIdOf(claims, sub);
   let username = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.orElse(claims["cognito:username"], claims["username"]), Stdlib_JSON.Decode.string), userId);
   let groups = Stdlib_Option.getOr(Stdlib_Option.map(claims["cognito:groups"], g => g), []);
   return {
@@ -81,7 +87,7 @@ function fromAppSyncIdentity(id) {
     return {
       TAG: "Authenticated",
       _0: {
-        userId: sub,
+        userId: _userIdOf(rawClaims, sub),
         username: username,
         groups: groups,
         claims: claims,
@@ -127,6 +133,7 @@ export {
   _decodeJwtClaims,
   _bearerToken,
   _getHeader,
+  _userIdOf,
   _identityFromClaims,
   authenticate,
   fromAppSyncIdentity,

package/src/adapter/Auth/Auth_IdentityStore.res

@@ -0,0 +1,52 @@
+// The rows mapping a Cognito `sub` to the domain's own user id, and where they
+// live. Read by the pre-token-generation trigger on every mint, written only
+// when an account is created (`provision-accounts`, and the Cognito identity
+// provider when it exists).
+//
+// 🚨 **The rows follow the identity provider, not the stack**, exactly as the
+// active-role store's do and for the same reason: a pool holds one pre-token
+// trigger, so two stacks sharing a pool with a table each would have the winning
+// trigger reading rows the other stack wrote nowhere near. A stack that owns its
+// pool owns this table; a stack handed an `identityProviderId` looks it up at
+// [Auth_IdentityStore_Schema.derivedStoreName] and never creates it.
+
+type storeTable = Auth_ActiveRoleStore.storeTable
+
+/** Which store a deployment's trigger reads. Total and pure, like the active-role
+    store's: whether the provider is ours decides it, and nothing else. */
+let chooseStore = (~identityProviderId: option<string>): Auth_ActiveRoleStore.storeChoice =>
+  switch identityProviderId {
+  | None => StackScoped
+  | Some(id) => ProviderScoped(Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=id))
+  }
+
+/** One row per subject — the key schema is [Auth_IdentityStore_Schema]'s — plus
+    `userId`, the domain id minted for it. */
+let makeTable = (
+  ~name: string="IdentityStore",
+  ~opts: Pulumi.ComponentResource.options,
+): storeTable => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+  let table = Util_DynamoDb.makeTable(
+    ~attributes=[{name: Auth_IdentityStore_Schema.partitionKey, type_: "S"}],
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "Table",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Auth,
+      ~scope=Platform,
+    ),
+    ~opts,
+    name,
+  )
+  {name: table.name, arn: table.arn}
+}
+
+/** The store a resolved provider calls for — created or looked up. */
+let resolveTable = (
+  ~choice: Auth_ActiveRoleStore.storeChoice,
+  ~opts: Pulumi.ComponentResource.options,
+): storeTable =>
+  switch choice {
+  | StackScoped => makeTable(~opts)
+  | ProviderScoped(tableName) => Auth_ActiveRoleStore.lookupTable(~tableName)
+  }

package/src/adapter/Auth/Auth_IdentityStore.res.mjs

@@ -0,0 +1,46 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "./Auth_ActiveRoleStore.res.mjs";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "./Auth_IdentityStore_Schema.res.mjs";
+
+function chooseStore(identityProviderId) {
+  if (identityProviderId !== undefined) {
+    return {
+      TAG: "ProviderScoped",
+      _0: Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(identityProviderId)
+    };
+  } else {
+    return "StackScoped";
+  }
+}
+
+function makeTable(nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "IdentityStore";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let table = Util_DynamoDb$ReventlessAws.makeTable([{
+      name: Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+      type: "S"
+    }], undefined, undefined, undefined, AWS_Tags$ReventlessAws.make(name + "Table", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined), opts$1, name);
+  return {
+    name: table.name,
+    arn: table.arn
+  };
+}
+
+function resolveTable(choice, opts) {
+  if (typeof choice !== "object") {
+    return makeTable(undefined, opts);
+  } else {
+    return Auth_ActiveRoleStore$ReventlessAws.lookupTable(choice._0);
+  }
+}
+
+export {
+  chooseStore,
+  makeTable,
+  resolveTable,
+}
+/* AWS_Tags-ReventlessAws Not a pure module */

package/src/adapter/Auth/Auth_IdentityStore_Schema.res

@@ -0,0 +1,39 @@
+// The identity store's identity: what it is called, and how its rows are keyed.
+// The mapping from a Cognito `sub` to the domain's own user id — see
+// [ReventlessCore.Auth_UserId] for why the two differ.
+//
+// One definition for the deploy that creates or looks the table up
+// ([Auth_IdentityStore]), the pre-token trigger that reads it
+// ([Auth_ActiveRoleTrigger_Ops]), and the provisioning scripts that write it
+// (`provision-identity`, `provision-accounts`). Free of Pulumi and of the AWS
+// SDK for the reason [Auth_ActiveRoleStore_Schema] gives.
+
+/** Derived from the provider, never configured, for the reason the active-role
+    store's name is: two stacks on one pool cannot name different stores. */
+let derivedStoreName = (~identityProviderId: string): string =>
+  `ReventlessIdentityStore-${identityProviderId}`
+
+/** The Cognito `sub`. The trigger reads by it on every token it mints. */
+let partitionKey = "id"
+
+/** The domain id the row maps that subject to. */
+let userIdAttribute = "userId"
+
+/** Keyed on the subject alone: one identity, one domain id, on every platform
+    the provider serves. The reverse direction, domain id to subject, is an
+    index to add when the first caller for it exists; a global index can be
+    added to a live table. */
+let expectedKeySchema: array<(string, string)> = [(partitionKey, "HASH")]
+
+/** Why an existing table under this name cannot serve, if it cannot. A table
+    with the wrong key is found by the deploy and missed by every read, so the
+    claim is never added and every new account silently keeps its `sub`. */
+let keySchemaRefusal = (~tableName: string, ~actual: array<(string, string)>): option<string> => {
+  let actualKey = Auth_ActiveRoleStore_Schema.describeKeySchema(actual)
+  let wantedKey = Auth_ActiveRoleStore_Schema.describeKeySchema(expectedKeySchema)
+  actualKey == wantedKey
+    ? None
+    : Some(
+        `table "${tableName}" already exists with key schema [${actualKey}], but the identity store needs [${wantedKey}]. A row written under one key is invisible to a read under the other, so every new account would silently keep its provider id. Rename or remove the table; its rows are a mapping the provisioning run rewrites.`,
+      )
+}

package/src/adapter/Auth/Auth_IdentityStore_Schema.res.mjs

@@ -0,0 +1,35 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "./Auth_ActiveRoleStore_Schema.res.mjs";
+
+function derivedStoreName(identityProviderId) {
+  return `ReventlessIdentityStore-` + identityProviderId;
+}
+
+let partitionKey = "id";
+
+let expectedKeySchema = [[
+    partitionKey,
+    "HASH"
+  ]];
+
+function keySchemaRefusal(tableName, actual) {
+  let actualKey = Auth_ActiveRoleStore_Schema$ReventlessAws.describeKeySchema(actual);
+  let wantedKey = Auth_ActiveRoleStore_Schema$ReventlessAws.describeKeySchema(expectedKeySchema);
+  if (actualKey === wantedKey) {
+    return;
+  } else {
+    return `table "` + tableName + `" already exists with key schema [` + actualKey + `], but the identity store needs [` + wantedKey + `]. A row written under one key is invisible to a read under the other, so every new account would silently keep its provider id. Rename or remove the table; its rows are a mapping the provisioning run rewrites.`;
+  }
+}
+
+let userIdAttribute = "userId";
+
+export {
+  derivedStoreName,
+  partitionKey,
+  userIdAttribute,
+  expectedKeySchema,
+  keySchemaRefusal,
+}
+/* No side effect */

package/src/adapter/Identity/IdentityProvider_Cognito_Backend.res

@@ -0,0 +1,251 @@
+// The identity provider a deployed platform provisions: principals in its
+// Cognito pool, and each new one's domain id in the identity store the pool's
+// pre-token trigger reads. The AWS counterpart of the local platform's
+// `Capability_IdentityProvider_UserStore`, and reached the same way — on the
+// capability record a slice's `translate` receives.
+//
+// Pulumi-free so it ships in the slice Lambda. The pool calls go through an
+// injected `ops` record so the sequencing below — what is undone when a later
+// step fails, which failures are verdicts — is testable without a pool.
+//
+// The principal's handle is the username, and the username is the address the
+// person is reached at, as on the local platform.
+
+open Reventless
+
+/** The calls a provider makes, one per pool or store operation. Each throws the
+    SDK's error on failure; [failureOf] classifies it. */
+type ops = {
+  /** Creates the account and answers its `sub`. */
+  createUser: (~username: string, ~attributes: array<(string, string)>) => promise<option<string>>,
+  subOf: (~username: string) => promise<option<string>>,
+  setPassword: (~username: string, ~password: string) => promise<unit>,
+  addToGroup: (~username: string, ~group: string) => promise<unit>,
+  removeFromGroup: (~username: string, ~group: string) => promise<unit>,
+  deleteUser: (~username: string) => promise<unit>,
+  putUserId: (~sub: string, ~userId: string) => promise<unit>,
+  deleteUserId: (~sub: string) => promise<unit>,
+}
+
+@get @return(nullable) external errorName: JsExn.t => option<string> = "name"
+
+let codeOf = (exn: exn): option<string> => exn->JsExn.fromException->Option.flatMap(errorName)
+
+let messageOf = (exn: exn): string =>
+  exn
+  ->JsExn.fromException
+  ->Option.flatMap(JsExn.message)
+  ->Option.getOr("the identity provider failed")
+
+/**
+A pool failure as the capability's answer.
+
+`Refused` only where the pool has judged the request itself — a password its
+policy rejects, an attribute it will not take, a group that does not exist.
+Everything else is `Unavailable`, retried: throttling, a network blip, a role
+missing its grant. A caller reaching `createPrincipal` has already recorded that
+the address was proven, and treating an outage as a verdict would strand them.
+*/
+let failureOf = (exn: exn): IdentityProvider.failure =>
+  switch codeOf(exn) {
+  | Some("UsernameExistsException" | "AliasExistsException") => Conflict
+  | Some(
+      "InvalidPasswordException"
+      | "InvalidParameterException"
+      | "UserNotFoundException"
+      | "ResourceNotFoundException",
+    ) =>
+    Refused(messageOf(exn))
+  | _ => Unavailable(messageOf(exn))
+  }
+
+let usernameOf = (contact: Messaging.recipient): result<string, IdentityProvider.failure> =>
+  switch contact {
+  | ToEmail(email) => Ok(Email.toString(email))
+  | ToSms(phone) => Ok(Phone.toString(phone))
+  | ToPush(_) => Error(Refused("a push address cannot be signed in with"))
+  }
+
+/** Verified, because a principal is only created after the address was proven —
+    the ordering the registration chapter is built on. */
+let attributesOf = (contact: Messaging.recipient): array<(string, string)> =>
+  switch contact {
+  | ToEmail(email) => [("email", Email.toString(email)), ("email_verified", "true")]
+  | ToSms(phone) => [("phone_number", Phone.toString(phone)), ("phone_number_verified", "true")]
+  | ToPush(_) => []
+  }
+
+let attempt = async (run: unit => promise<'a>): result<'a, IdentityProvider.failure> =>
+  try Ok(await run()) catch {
+  | exn => Error(failureOf(exn))
+  }
+
+let withOps = (ops: ops, ~hasStore: bool): IdentityProvider.t => {
+  // Everything after the account exists, in order. A failure here undoes the
+  // account before answering, so a retry starts from nothing: left in place, the
+  // retry would meet `UsernameExistsException` and report a `Conflict` for a
+  // person whose first attempt merely timed out.
+  let complete = async (~username, ~sub, ~credential: IdentityProvider.credential, ~groups) => {
+    let steps = async () => {
+      switch credential {
+      | Password(password) => await ops.setPassword(~username, ~password)
+      | NoCredential => ()
+      }
+      for i in 0 to groups->Array.length - 1 {
+        await ops.addToGroup(~username, ~group=groups->Array.getUnsafe(i))
+      }
+
+      // Minted here and only here: an account the pool made before the store
+      // existed keeps its `sub`, and nothing re-keys it.
+      if hasStore {
+        await ops.putUserId(~sub, ~userId=ReventlessCore.Auth_UserId.mint())
+      }
+    }
+    switch await attempt(steps) {
+    | Ok() => Ok({IdentityProvider.providerId: username})
+    | Error(_) as failed =>
+      let _ = await attempt(() => ops.deleteUser(~username))
+      failed
+    }
+  }
+
+  let createPrincipal = async (~contact, ~credential, ~groups) =>
+    switch usernameOf(contact) {
+    | Error(_) as e => e
+    | Ok(username) =>
+      switch await attempt(() => ops.createUser(~username, ~attributes=attributesOf(contact))) {
+      | Error(_) as e => e
+      | Ok(created) =>
+        let sub = switch created {
+        | Some(_) => created
+        | None => (await attempt(() => ops.subOf(~username)))->Result.getOr(None)
+        }
+        switch sub {
+        | None =>
+          let _ = await attempt(() => ops.deleteUser(~username))
+          Error(IdentityProvider.Unavailable(`the pool created ${username} but named no sub`))
+        | Some(sub) => await complete(~username, ~sub, ~credential, ~groups)
+        }
+      }
+    }
+
+  let addToGroup = (~principal: IdentityProvider.principal, ~group) =>
+    attempt(() => ops.addToGroup(~username=principal.providerId, ~group))
+
+  let removeFromGroup = (~principal: IdentityProvider.principal, ~group) =>
+    attempt(() => ops.removeFromGroup(~username=principal.providerId, ~group))
+
+  // Deleting what is gone is the retry of a delete that happened, so a missing
+  // account answers `Ok`. The mapping row goes last, best effort: a row whose
+  // principal is gone is never read on the request path, since no token is
+  // minted for it.
+  let deletePrincipal = async (~principal: IdentityProvider.principal) => {
+    let username = principal.providerId
+    switch await attempt(() => ops.subOf(~username)) {
+    | Error(Refused(_)) => Ok()
+    | Error(_) as e => e
+    | Ok(sub) =>
+      switch await attempt(() => ops.deleteUser(~username)) {
+      | Error(Unavailable(_)) as e => e
+      | Error(_) | Ok() =>
+        switch (sub, hasStore) {
+        | (Some(sub), true) =>
+          let _ = await attempt(() => ops.deleteUserId(~sub))
+        | _ => ()
+        }
+        Ok()
+      }
+    }
+  }
+
+  IdentityProvider.make(
+    ~createPrincipal,
+    ~addToGroup,
+    ~removeFromGroup,
+    ~deletePrincipal,
+    ~operations=[CreatePrincipal, AddToGroup, RemoveFromGroup, DeletePrincipal],
+  )
+}
+
+// ── The SDK ──────────────────────────────────────────────────────────────────
+
+module Cognito = AwsSdk.CognitoIdentityServiceProvider
+
+let subFrom = (attributes: option<array<Cognito.AdminCreateUserCommand.attributeType>>) =>
+  attributes->Option.getOr([])->Array.find(a => a.name == "sub")->Option.map(a => a.value)
+
+let sdkOps = (~poolId: string, ~identityStore: string): ops => {
+  createUser: async (~username, ~attributes) => {
+    let out = await Cognito.AdminCreateUserCommand.make({
+      userPoolId: poolId,
+      username,
+      userAttributes: attributes->Array.map(((name, value)) => {
+        Cognito.AdminCreateUserCommand.name,
+        value,
+      }),
+      // No invitation: the person has proven the address already, and the
+      // invitation would carry a temporary password nobody should use.
+      messageAction: "SUPPRESS",
+    })->Cognito.AdminCreateUserCommand.send
+    out.user->Option.flatMap(u => subFrom(u.attributes))
+  },
+  subOf: async (~username) => {
+    let out = await Cognito.AdminGetUserCommand.make({
+      userPoolId: poolId,
+      username,
+    })->Cognito.AdminGetUserCommand.send
+    out.userAttributes->Option.getOr([])->Array.find(a => a.name == "sub")->Option.map(a => a.value)
+  },
+  setPassword: (~username, ~password) =>
+    Cognito.AdminSetUserPasswordCommand.make({
+      userPoolId: poolId,
+      username,
+      password,
+      permanent: true,
+    })->Cognito.AdminSetUserPasswordCommand.send,
+  addToGroup: (~username, ~group) =>
+    Cognito.AdminAddUserToGroupCommand.make({
+      userPoolId: poolId,
+      username,
+      groupName: group,
+    })->Cognito.AdminAddUserToGroupCommand.send,
+  removeFromGroup: (~username, ~group) =>
+    Cognito.AdminRemoveUserFromGroupCommand.make({
+      userPoolId: poolId,
+      username,
+      groupName: group,
+    })->Cognito.AdminRemoveUserFromGroupCommand.send,
+  deleteUser: (~username) =>
+    Cognito.AdminDeleteUserCommand.make({
+      userPoolId: poolId,
+      username,
+    })->Cognito.AdminDeleteUserCommand.send,
+  putUserId: async (~sub, ~userId) => {
+    let _ = await AwsSdk.DynamoDb_DocumentClient.PutCommand.make({
+      tableName: identityStore,
+      item: JSON.Encode.object(
+        Dict.fromArray([
+          (Auth_IdentityStore_Schema.partitionKey, JSON.Encode.string(sub)),
+          (Auth_IdentityStore_Schema.userIdAttribute, JSON.Encode.string(userId)),
+        ]),
+      ),
+    })->AwsSdk.DynamoDb_DocumentClient.PutCommand.send
+  },
+  deleteUserId: async (~sub) => {
+    let _ = await AwsSdk.DynamoDb_DocumentClient.DeleteCommand.make({
+      tableName: identityStore,
+      key: Dict.fromArray([(Auth_IdentityStore_Schema.partitionKey, JSON.Encode.string(sub))]),
+    })->AwsSdk.DynamoDb_DocumentClient.DeleteCommand.send
+  },
+}
+
+/**
+The provider a slice Lambda is handed, from the two values the deploy put in its
+environment. No pool is the deployment gap it always was, answered `Unavailable`
+with no operations. No store means the pool predates it: principals are still
+made, and each keeps its `sub` as its id, as every account before the store did.
+*/
+let provider = (~poolId: string, ~identityStore: string): IdentityProvider.t =>
+  poolId == ""
+    ? IdentityProvider.unavailable(~reason="no identity provider is configured for this platform")
+    : withOps(sdkOps(~poolId, ~identityStore), ~hasStore=identityStore != "")