@reventlessdev/reventless-aws 3.0.0-alpha.394 → 3.0.0-alpha.396

package/src/adapter/Identity/IdentityProvider_Cognito_Backend.res.mjs

@@ -0,0 +1,300 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
+import * as IdentityProvider$Reventless from "@reventlessdev/reventless-spec/src/semantic/IdentityProvider.res.mjs";
+import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
+import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "../Auth/Auth_IdentityStore_Schema.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+
+function codeOf(exn) {
+  return Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), prim => Primitive_option.fromNullable(prim.name));
+}
+
+function messageOf(exn) {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "the identity provider failed");
+}
+
+function failureOf(exn) {
+  let match = codeOf(exn);
+  if (match === undefined) {
+    return {
+      TAG: "Unavailable",
+      _0: messageOf(exn)
+    };
+  }
+  switch (match) {
+    case "InvalidParameterException" :
+    case "InvalidPasswordException" :
+    case "ResourceNotFoundException" :
+    case "UserNotFoundException" :
+      return {
+        TAG: "Refused",
+        _0: messageOf(exn)
+      };
+    case "AliasExistsException" :
+    case "UsernameExistsException" :
+      return "Conflict";
+    default:
+      return {
+        TAG: "Unavailable",
+        _0: messageOf(exn)
+      };
+  }
+}
+
+function usernameOf(contact) {
+  switch (contact.TAG) {
+    case "ToEmail" :
+    case "ToSms" :
+      return {
+        TAG: "Ok",
+        _0: contact._0
+      };
+    case "ToPush" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Refused",
+          _0: "a push address cannot be signed in with"
+        }
+      };
+  }
+}
+
+function attributesOf(contact) {
+  switch (contact.TAG) {
+    case "ToEmail" :
+      return [
+        [
+          "email",
+          contact._0
+        ],
+        [
+          "email_verified",
+          "true"
+        ]
+      ];
+    case "ToSms" :
+      return [
+        [
+          "phone_number",
+          contact._0
+        ],
+        [
+          "phone_number_verified",
+          "true"
+        ]
+      ];
+    case "ToPush" :
+      return [];
+  }
+}
+
+async function attempt(run) {
+  try {
+    return {
+      TAG: "Ok",
+      _0: await run()
+    };
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    return {
+      TAG: "Error",
+      _0: failureOf(exn)
+    };
+  }
+}
+
+function withOps(ops, hasStore) {
+  let complete = async (username, sub, credential, groups) => {
+    let steps = async () => {
+      if (typeof credential === "object") {
+        await ops.setPassword(username, credential._0);
+      }
+      for (let i = 0, i_finish = groups.length; i < i_finish; ++i) {
+        await ops.addToGroup(username, groups[i]);
+      }
+      if (hasStore) {
+        return await ops.putUserId(sub, Auth_UserId$ReventlessCore.mint());
+      }
+    };
+    let failed = await attempt(steps);
+    if (failed.TAG === "Ok") {
+      return {
+        TAG: "Ok",
+        _0: {
+          providerId: username
+        }
+      };
+    }
+    await attempt(() => ops.deleteUser(username));
+    return failed;
+  };
+  let createPrincipal = async (contact, credential, groups) => {
+    let e = usernameOf(contact);
+    if (e.TAG !== "Ok") {
+      return e;
+    }
+    let username = e._0;
+    let e$1 = await attempt(() => ops.createUser(username, attributesOf(contact)));
+    if (e$1.TAG !== "Ok") {
+      return e$1;
+    }
+    let created = e$1._0;
+    let sub = created !== undefined ? created : Stdlib_Result.getOr(await attempt(() => ops.subOf(username)), undefined);
+    if (sub !== undefined) {
+      return await complete(username, sub, credential, groups);
+    } else {
+      await attempt(() => ops.deleteUser(username));
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Unavailable",
+          _0: `the pool created ` + username + ` but named no sub`
+        }
+      };
+    }
+  };
+  let addToGroup = (principal, group) => attempt(() => ops.addToGroup(principal.providerId, group));
+  let removeFromGroup = (principal, group) => attempt(() => ops.removeFromGroup(principal.providerId, group));
+  let deletePrincipal = async principal => {
+    let username = principal.providerId;
+    let e = await attempt(() => ops.subOf(username));
+    if (e.TAG === "Ok") {
+      let sub = e._0;
+      let e$1 = await attempt(() => ops.deleteUser(username));
+      if (e$1.TAG !== "Ok") {
+        let tmp = e$1._0;
+        if (typeof tmp === "object" && tmp.TAG === "Unavailable") {
+          return e$1;
+        }
+      }
+      if (sub !== undefined && hasStore) {
+        await attempt(() => ops.deleteUserId(sub));
+      }
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    }
+    let tmp$1 = e._0;
+    if (typeof tmp$1 !== "object" || tmp$1.TAG === "Unavailable") {
+      return e;
+    } else {
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    }
+  };
+  return IdentityProvider$Reventless.make(createPrincipal, addToGroup, removeFromGroup, deletePrincipal, [
+    "CreatePrincipal",
+    "AddToGroup",
+    "RemoveFromGroup",
+    "DeletePrincipal"
+  ]);
+}
+
+function subFrom(attributes) {
+  return Stdlib_Option.map(Stdlib_Option.getOr(attributes, []).find(a => a.Name === "sub"), a => a.Value);
+}
+
+function sdkOps(poolId, identityStore) {
+  return {
+    createUser: async (username, attributes) => {
+      let out = await CognitoIdentityServiceProvider$AwsSdk.AdminCreateUserCommand.send(new ClientCognitoIdentityProvider.AdminCreateUserCommand({
+        UserPoolId: poolId,
+        Username: username,
+        UserAttributes: attributes.map(param => ({
+          Name: param[0],
+          Value: param[1]
+        })),
+        MessageAction: "SUPPRESS"
+      }));
+      return Stdlib_Option.flatMap(out.User, u => subFrom(u.Attributes));
+    },
+    subOf: async username => {
+      let out = await CognitoIdentityServiceProvider$AwsSdk.AdminGetUserCommand.send(new ClientCognitoIdentityProvider.AdminGetUserCommand({
+        UserPoolId: poolId,
+        Username: username
+      }));
+      return Stdlib_Option.map(Stdlib_Option.getOr(out.UserAttributes, []).find(a => a.Name === "sub"), a => a.Value);
+    },
+    setPassword: (username, password) => CognitoIdentityServiceProvider$AwsSdk.AdminSetUserPasswordCommand.send(new ClientCognitoIdentityProvider.AdminSetUserPasswordCommand({
+      UserPoolId: poolId,
+      Username: username,
+      Password: password,
+      Permanent: true
+    })),
+    addToGroup: (username, group) => CognitoIdentityServiceProvider$AwsSdk.AdminAddUserToGroupCommand.send(new ClientCognitoIdentityProvider.AdminAddUserToGroupCommand({
+      Username: username,
+      GroupName: group,
+      UserPoolId: poolId
+    })),
+    removeFromGroup: (username, group) => CognitoIdentityServiceProvider$AwsSdk.AdminRemoveUserFromGroupCommand.send(new ClientCognitoIdentityProvider.AdminRemoveUserFromGroupCommand({
+      Username: username,
+      GroupName: group,
+      UserPoolId: poolId
+    })),
+    deleteUser: username => CognitoIdentityServiceProvider$AwsSdk.AdminDeleteUserCommand.send(new ClientCognitoIdentityProvider.AdminDeleteUserCommand({
+      UserPoolId: poolId,
+      Username: username
+    })),
+    putUserId: async (sub, userId) => {
+      await DynamoDb_DocumentClient$AwsSdk.PutCommand.send(new LibDynamodb.PutCommand({
+        Item: Object.fromEntries([
+          [
+            Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+            sub
+          ],
+          [
+            Auth_IdentityStore_Schema$ReventlessAws.userIdAttribute,
+            userId
+          ]
+        ]),
+        TableName: identityStore
+      }));
+    },
+    deleteUserId: async sub => {
+      await DynamoDb_DocumentClient$AwsSdk.DeleteCommand.send(new LibDynamodb.DeleteCommand({
+        TableName: identityStore,
+        Key: Object.fromEntries([[
+            Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+            sub
+          ]])
+      }));
+    }
+  };
+}
+
+function provider(poolId, identityStore) {
+  if (poolId === "") {
+    return IdentityProvider$Reventless.unavailable("no identity provider is configured for this platform");
+  } else {
+    return withOps(sdkOps(poolId, identityStore), identityStore !== "");
+  }
+}
+
+let Cognito;
+
+export {
+  codeOf,
+  messageOf,
+  failureOf,
+  usernameOf,
+  attributesOf,
+  attempt,
+  withOps,
+  Cognito,
+  subFrom,
+  sdkOps,
+  provider,
+}
+/* Stdlib_JsExn Not a pure module */

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -420,10 +420,13 @@ let capabilities = (): Reventless.Capabilities.t => {
       ~text,
     ),
   messaging: messagingEmailProvider(),
-  // Refusing until the Cognito backend lands. The pool is provisioned, but the
-  // store mapping a domain user id to a provider handle is not, and creating a
-  // principal before that exists would write a handle with nowhere to live.
-  identityProvider: Reventless.Capabilities.none.identityProvider,
+  // The platform's pool and identity store, both read per call like the sender
+  // above. An empty pool id is a plugin deployed with no platform to read one
+  // from, and answers `Unavailable` with no operations.
+  identityProvider: IdentityProvider_Cognito_Backend.provider(
+    ~poolId=NodeProcess.env->Dict.get("IDENTITY_PROVIDER_ID")->Option.getOr(""),
+    ~identityStore=NodeProcess.env->Dict.get("IDENTITY_STORE_TABLE")->Option.getOr(""),
+  ),
   secrets: ReventlessCore.Secrets_Node_Backend.provider,
 }
 

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res.mjs

@@ -13,7 +13,6 @@ import * as DcbDecode$Reventless from "@reventlessdev/reventless-spec/src/compon
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
-import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
 import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
 import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
 import * as Messaging_Ses_Backend$ReventlessAws from "../Messaging/Messaging_Ses_Backend.res.mjs";
@@ -26,6 +25,7 @@ import * as StreamRoutedEntryPoint_Ops$ReventlessAws from "./StreamRoutedEntryPo
 import * as Geocoder_AwsLocation_Backend$ReventlessAws from "../Geocoder/Geocoder_AwsLocation_Backend.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 import * as QueryDbStorage_DynamoDb_Runtime$ReventlessAws from "../QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
+import * as IdentityProvider_Cognito_Backend$ReventlessAws from "../Identity/IdentityProvider_Cognito_Backend.res.mjs";
 import * as OutboundTranslationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Callback.res.mjs";
 import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
 
@@ -275,7 +275,7 @@ function capabilities() {
   return {
     geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined),
     messaging: messagingEmailProvider(),
-    identityProvider: Capabilities$Reventless.none.identityProvider,
+    identityProvider: IdentityProvider_Cognito_Backend$ReventlessAws.provider(Stdlib_Option.getOr(process.env["IDENTITY_PROVIDER_ID"], ""), Stdlib_Option.getOr(process.env["IDENTITY_STORE_TABLE"], "")),
     secrets: Secrets_Node_Backend$ReventlessCore.provider
   };
 }

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res

@@ -54,6 +54,9 @@ type sliceInfo = {
   // The schedules store's table, empty for a slice that maps no `Clock`. Granted to
   // the Lambda with the to-do tables, and named in the slice's handler config.
   schedulesResources: array<ReventlessInfra.Adapter.resource>,
+  // The capabilities the slice's spec declares. Read by grants that must not be
+  // handed to every slice on the shared Lambda for one slice's sake.
+  capabilityNeeds: array<Reventless.CapabilityNeed.t>,
 }
 
 let bundledInfos: dict<sliceInfo> = Dict.make()
@@ -103,6 +106,7 @@ let registerAutomationSlice = (
   ~commandTargetName=?,
   ~schedule=?,
   ~schedulesResources=[],
+  ~capabilityNeeds=[],
 ) =>
   bundledInfos->Dict.set(
     name,
@@ -118,6 +122,7 @@ let registerAutomationSlice = (
       commandTargetName,
       schedule,
       schedulesResources,
+      capabilityNeeds,
     },
   )
 
@@ -334,6 +339,80 @@ let makeMessagingGrant = (~runtime: ReventlessCore.Runtime.environment<runtimePa
     )
   }
 
+/** Whether any slice on the shared Lambda declares the identity provider. The
+    grant below is the one that can create and delete accounts, so it follows a
+    declaration rather than the pool merely existing — which on AWS it always
+    does. */
+let declaresIdentityProvider = (infos: array<sliceInfo>): bool =>
+  infos->Array.some(info => info.capabilityNeeds->Array.includes(IdentityProvider))
+
+/** The admin calls the Cognito provider makes, on the one pool. */
+let identityProviderPoolActions = [
+  "cognito-idp:AdminCreateUser",
+  "cognito-idp:AdminGetUser",
+  "cognito-idp:AdminSetUserPassword",
+  "cognito-idp:AdminAddUserToGroup",
+  "cognito-idp:AdminRemoveUserFromGroup",
+  "cognito-idp:AdminDeleteUser",
+]
+
+// Built like the two grants above: a plain bool decides, the ARNs are Outputs,
+// and the RolePolicy is created at top level rather than inside an `apply`.
+let makeIdentityProviderGrant = (
+  ~runtime: ReventlessCore.Runtime.environment<runtimeParts>,
+  ~opts,
+) =>
+  if (
+    PluginRuntime_Builder.identityProviderProvisioned() &&
+    declaresIdentityProvider(bundledInfos->Dict.valuesToArray)
+  ) {
+    let customOpts =
+      opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+    let {
+      poolArn,
+      storeArn,
+    }: PluginRuntime_Builder.identityProviderResources = PluginRuntime_Builder.identityProvider()
+    let policyJson = Pulumi.Output.all2((poolArn, storeArn))->Pulumi.Output.apply(((
+      pool,
+      store,
+    )) => {
+      open PulumiAws.PolicyDocument
+      PulumiAws.PolicyDocument.make(
+        ~id="AllAutomationSlicesIdentityProvider",
+        ~statements=Array.concat(
+          [
+            {
+              sid: "AllowManagingPrincipals",
+              effect: Allow,
+              actions: Actions(identityProviderPoolActions),
+              resources: Resource(pool),
+            },
+          ],
+          // A pool provisioned before the store has none, and its principals
+          // keep their `sub`; there is nothing to grant.
+          store == ""
+            ? []
+            : [
+                {
+                  sid: "AllowRecordingDomainIds",
+                  effect: Allow,
+                  actions: Actions(["dynamodb:PutItem", "dynamodb:DeleteItem"]),
+                  resources: Resource(store),
+                },
+              ],
+        ),
+      )->PulumiAws.PolicyDocument.toJsonString
+    })
+    let _ = PulumiAws.IAM.RolePolicy.make(
+      ~name="AllAutomationSlicesIdentityProvider",
+      ~args={
+        policy: policyJson->Pulumi.Output.asInput,
+        role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+      },
+      ~opts=customOpts,
+    )
+  }
+
 // The automations' schedules. The Lambda may manage the schedules in the stack's
 // scheduler group and pass the scheduler role to them; the scheduler role may invoke
 // the Lambda; and each deploy invokes the Lambda to reconcile the declared schedules
@@ -833,6 +912,7 @@ let finishWithDcbEventLog = (
         makeAutomationSchedules(~runtime, ~schedulerRoleArn, ~sourceCodeHash, ~opts)
         makeGeocoderGrant(~runtime, ~opts)
         makeMessagingGrant(~runtime, ~opts)
+        makeIdentityProviderGrant(~runtime, ~opts)
       | None =>
         log.warn(
           ~comp="AutomationSliceRuntime_Builder_Single",

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs

@@ -56,12 +56,13 @@ function getDcbQueueUrl() {
   return dcbQueueUrlRef.contents;
 }
 
-function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackTypeOpt, queryDbTableName, queryDbResourcesOpt, context, sourceTopicsOpt, consumesDcbLogOpt, commandTargetName, schedule, schedulesResourcesOpt) {
+function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackTypeOpt, queryDbTableName, queryDbResourcesOpt, context, sourceTopicsOpt, consumesDcbLogOpt, commandTargetName, schedule, schedulesResourcesOpt, capabilityNeedsOpt) {
   let callbackType = callbackTypeOpt !== undefined ? callbackTypeOpt : "automation";
   let queryDbResources = queryDbResourcesOpt !== undefined ? queryDbResourcesOpt : [];
   let sourceTopics = sourceTopicsOpt !== undefined ? sourceTopicsOpt : ({});
   let consumesDcbLog = consumesDcbLogOpt !== undefined ? consumesDcbLogOpt : true;
   let schedulesResources = schedulesResourcesOpt !== undefined ? schedulesResourcesOpt : [];
+  let capabilityNeeds = capabilityNeedsOpt !== undefined ? capabilityNeedsOpt : [];
   bundledInfos[name] = {
     specModulePath: specModulePath,
     bodyModulePath: bodyModulePath,
@@ -73,7 +74,8 @@ function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackT
     consumesDcbLog: consumesDcbLog,
     commandTargetName: commandTargetName,
     schedule: schedule,
-    schedulesResources: schedulesResources
+    schedulesResources: schedulesResources,
+    capabilityNeeds: capabilityNeeds
   };
 }
 
@@ -175,6 +177,51 @@ function makeMessagingGrant(runtime, opts) {
   }, customOpts);
 }
 
+function declaresIdentityProvider(infos) {
+  return infos.some(info => info.capabilityNeeds.includes("IdentityProvider"));
+}
+
+let identityProviderPoolActions = [
+  "cognito-idp:AdminCreateUser",
+  "cognito-idp:AdminGetUser",
+  "cognito-idp:AdminSetUserPassword",
+  "cognito-idp:AdminAddUserToGroup",
+  "cognito-idp:AdminRemoveUserFromGroup",
+  "cognito-idp:AdminDeleteUser"
+];
+
+function makeIdentityProviderGrant(runtime, opts) {
+  if (!(PluginRuntime_Builder$ReventlessAws.identityProviderProvisioned() && declaresIdentityProvider(Object.values(bundledInfos)))) {
+    return;
+  }
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let match = PluginRuntime_Builder$ReventlessAws.identityProvider();
+  let policyJson = Pulumi.all([
+    match.poolArn,
+    match.storeArn
+  ]).apply(param => {
+    let store = param[1];
+    return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllAutomationSlicesIdentityProvider", [{
+        Sid: "AllowManagingPrincipals",
+        Effect: "Allow",
+        Action: identityProviderPoolActions,
+        Resource: param[0]
+      }].concat(store === "" ? [] : [{
+          Sid: "AllowRecordingDomainIds",
+          Effect: "Allow",
+          Action: [
+            "dynamodb:PutItem",
+            "dynamodb:DeleteItem"
+          ],
+          Resource: store
+        }])));
+  });
+  new (Aws.iam.RolePolicy)("AllAutomationSlicesIdentityProvider", {
+    policy: policyJson,
+    role: runtime.parts.lambdaRole.id
+  }, customOpts);
+}
+
 function makeAutomationSchedules(runtime, schedulerRoleArn, sourceCodeHash, opts) {
   let name = "AllAutomationSlices";
   let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
@@ -452,6 +499,7 @@ function finishWithDcbEventLog(schedulerRoleArn, dcbEventLog) {
       makeAutomationSchedules(runtime, schedulerRoleArn, sourceCodeHash, opts);
       makeGeocoderGrant(runtime, opts);
       makeMessagingGrant(runtime, opts);
+      makeIdentityProviderGrant(runtime, opts);
     } else {
       log.warn("AutomationSliceRuntime_Builder_Single", undefined, "finishWithDcbEventLog: DCB EventLog has no parent");
     }
@@ -483,6 +531,9 @@ export {
   makeSweepSchedule,
   makeGeocoderGrant,
   makeMessagingGrant,
+  declaresIdentityProvider,
+  identityProviderPoolActions,
+  makeIdentityProviderGrant,
   makeAutomationSchedules,
   finished,
   finish,

package/src/components/AutomationSlice_Builder.res.mjs

@@ -62,7 +62,7 @@ function Make(Api) {
       let queryDbTableName = tableResource.name;
       let sourceTopics = EventTopic$ReventlessCore.filter(allEventTopics, Belt_SetString.fromArray(sourceNames));
       let consumesDcbLog = sourceNames.length === 0 || sourceNames.some(name => !(name in allEventTopics));
-      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Automation.moduleUrl), "automation", queryDbTableName, queryDbOutputs.resources, context, sourceTopics, consumesDcbLog, undefined, Spec.schedule, Stdlib_Option.mapOr(Component$ReventlessCore.outputs(as_).schedulesDb, [], db => db.resources));
+      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Automation.moduleUrl), "automation", queryDbTableName, queryDbOutputs.resources, context, sourceTopics, consumesDcbLog, undefined, Spec.schedule, Stdlib_Option.mapOr(Component$ReventlessCore.outputs(as_).schedulesDb, [], db => db.resources), undefined);
       return as_;
     };
     return {

package/src/components/OutboundTranslationSlice_Builder.res

@@ -94,6 +94,8 @@ module Make = (
         ~consumesDcbLog,
         // Only the name: the target Aggregate's CommandTopic does not exist yet.
         ~commandTargetName=?Spec.targetName,
+        // What decides whether the shared Lambda may create and delete accounts.
+        ~capabilityNeeds=Spec.capabilityNeeds,
       )
 
       ots

package/src/components/OutboundTranslationSlice_Builder.res.mjs

@@ -63,7 +63,7 @@ function Make(Api) {
       let declaredSources = Spec.sourceNames;
       let sourceTopics = EventTopic$ReventlessCore.filter(allEventTopics, Belt_SetString.fromArray(declaredSources));
       let consumesDcbLog = declaredSources.length === 0 || declaredSources.some(name => !(name in allEventTopics));
-      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl), "outbound", queryDbTableName, queryDbOutputs.resources, undefined, sourceTopics, consumesDcbLog, Spec.targetName, undefined, undefined);
+      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl), "outbound", queryDbTableName, queryDbOutputs.resources, undefined, sourceTopics, consumesDcbLog, Spec.targetName, undefined, undefined, Spec.capabilityNeeds);
       return ots;
     };
     return {

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -91,6 +91,29 @@ let registerMessagingSender = (sender: Pulumi.Output.t<string>) => {
 let messagingSender = () => messagingSenderRef.contents
 let messagingProvisioned = () => messagingProvisionedRef.contents
 
+/** The pool and the identity store, carried for the grant: a slice making
+    principals needs Cognito's admin calls on the one pool and writes on the one
+    store. Granted only to a plugin with a slice that declares the need — see
+    `AutomationSliceRuntime_Builder_Single.makeIdentityProviderGrant`. */
+type identityProviderResources = {
+  poolArn: Pulumi.Output.t<string>,
+  storeArn: Pulumi.Output.t<string>,
+}
+
+let identityProviderRef: ref<identityProviderResources> = ref({
+  poolArn: Pulumi.Output.make(""),
+  storeArn: Pulumi.Output.make(""),
+})
+let identityProviderProvisionedRef = ref(false)
+
+let registerIdentityProvider = (resources: identityProviderResources) => {
+  identityProviderRef := resources
+  identityProviderProvisionedRef := true
+}
+
+let identityProvider = () => identityProviderRef.contents
+let identityProviderProvisioned = () => identityProviderProvisionedRef.contents
+
 type sliceModulePaths = {
   specPath: string,
   decisionPath: string,

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -91,6 +91,30 @@ function messagingProvisioned() {
   return messagingProvisionedRef.contents;
 }
 
+let identityProviderRef = {
+  contents: {
+    poolArn: Pulumi.output(""),
+    storeArn: Pulumi.output("")
+  }
+};
+
+let identityProviderProvisionedRef = {
+  contents: false
+};
+
+function registerIdentityProvider(resources) {
+  identityProviderRef.contents = resources;
+  identityProviderProvisionedRef.contents = true;
+}
+
+function identityProvider() {
+  return identityProviderRef.contents;
+}
+
+function identityProviderProvisioned() {
+  return identityProviderProvisionedRef.contents;
+}
+
 let dcbConfigRef = {
   contents: {
     pluginName: "",
@@ -591,6 +615,11 @@ export {
   registerMessagingSender,
   messagingSender,
   messagingProvisioned,
+  identityProviderRef,
+  identityProviderProvisionedRef,
+  registerIdentityProvider,
+  identityProvider,
+  identityProviderProvisioned,
   dcbConfigRef,
   registeredSliceModulePaths,
   registerStateChangeSliceSpec,