@reventlessdev/reventless-aws 3.0.0-alpha.395 → 3.0.0-alpha.396

package/src/Platform.res.mjs

@@ -1412,6 +1412,20 @@ function MakeWithConfig(Config) {
     PluginRuntime_Builder$ReventlessAws.registerMessagingSender(messagingEmailSender);
     let messagingEmailProvider = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailProvider").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailProviderRef.contents;
     PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_PROVIDER", messagingEmailProvider);
+    let platformOutput = (name, local) => {
+      if (platformStackRef !== undefined) {
+        return Primitive_option.valFromOption(platformStackRef).getOutput(name).apply(o => Stdlib_Option.getOr(o, ""));
+      } else {
+        return local();
+      }
+    };
+    let identityProviderId = platformOutput("identityProviderId", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().poolId);
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("IDENTITY_PROVIDER_ID", identityProviderId);
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("IDENTITY_STORE_TABLE", platformOutput("identityStore", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().identityTable.name));
+    PluginRuntime_Builder$ReventlessAws.registerIdentityProvider({
+      poolArn: platformOutput("identityProviderArn", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().poolArn),
+      storeArn: platformOutput("identityStoreArn", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().identityTable.arn)
+    });
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -1469,15 +1483,18 @@ function MakeWithConfig(Config) {
         pluginOutputs.pluginStructure,
         stackRef.getOutput("objectStores"),
         geocoderPlaceIndex,
-        messagingEmailSender
+        messagingEmailSender,
+        identityProviderId
       ]).apply(param => {
         let structure = param[0];
         let missing = CapabilityNeed$Reventless.unmet(Stdlib_Option.getOr(Stdlib_Option.flatMap(structure, s => s.requiredCapabilities), []).map(d => [
           d.capability,
           d.component
-        ]), (
-          param[2] === "" ? [] : ["Geocoding"]
-        ).concat(param[3] === "" ? [] : ["Messaging"]));
+        ]), [
+          param[2] === "" ? [] : ["Geocoding"],
+          param[3] === "" ? [] : ["Messaging"],
+          param[4] === "" ? [] : ["IdentityProvider"]
+        ].flat());
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
@@ -1487,7 +1504,7 @@ function MakeWithConfig(Config) {
               case "Messaging" :
                 return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
               case "IdentityProvider" :
-                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
+                return `\n  IdentityProvider is the platform's Cognito pool, exported as \`identityProviderId\`. This platform stack exports none — deploy it first.`;
             }
           }))).join(""));
         }
@@ -2804,6 +2821,20 @@ function Make($star) {
     PluginRuntime_Builder$ReventlessAws.registerMessagingSender(messagingEmailSender);
     let messagingEmailProvider = platformStackRef !== undefined ? Primitive_option.valFromOption(platformStackRef).getOutput("messagingEmailProvider").apply(o => Stdlib_Option.getOr(o, "")) : messagingEmailProviderRef.contents;
     PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("MESSAGING_EMAIL_PROVIDER", messagingEmailProvider);
+    let platformOutput = (name, local) => {
+      if (platformStackRef !== undefined) {
+        return Primitive_option.valFromOption(platformStackRef).getOutput(name).apply(o => Stdlib_Option.getOr(o, ""));
+      } else {
+        return local();
+      }
+    };
+    let identityProviderId = platformOutput("identityProviderId", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().poolId);
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("IDENTITY_PROVIDER_ID", identityProviderId);
+    PluginRuntime_Builder$ReventlessAws.registerCapabilityEnv("IDENTITY_STORE_TABLE", platformOutput("identityStore", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().identityTable.name));
+    PluginRuntime_Builder$ReventlessAws.registerIdentityProvider({
+      poolArn: platformOutput("identityProviderArn", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().poolArn),
+      storeArn: platformOutput("identityStoreArn", () => Platform_Stack$ReventlessAws.resolveCognitoUserPool().identityTable.arn)
+    });
     let pluginComponent = plugin.make();
     Plugin_Helpers$ReventlessCore.clearOffload();
     currentDeployTarget.contents = "Domain";
@@ -2861,15 +2892,18 @@ function Make($star) {
         pluginOutputs.pluginStructure,
         stackRef.getOutput("objectStores"),
         geocoderPlaceIndex,
-        messagingEmailSender
+        messagingEmailSender,
+        identityProviderId
       ]).apply(param => {
         let structure = param[0];
         let missing = CapabilityNeed$Reventless.unmet(Stdlib_Option.getOr(Stdlib_Option.flatMap(structure, s => s.requiredCapabilities), []).map(d => [
           d.capability,
           d.component
-        ]), (
-          param[2] === "" ? [] : ["Geocoding"]
-        ).concat(param[3] === "" ? [] : ["Messaging"]));
+        ]), [
+          param[2] === "" ? [] : ["Geocoding"],
+          param[3] === "" ? [] : ["Messaging"],
+          param[4] === "" ? [] : ["IdentityProvider"]
+        ].flat());
         if (missing.length !== 0) {
           Stdlib_JsError.throwWithMessage(CapabilityNeed$Reventless.unmetMessage(missing) + Belt_SetString.toArray(Belt_SetString.fromArray(missing.map(u => {
             let match = u.need;
@@ -2879,7 +2913,7 @@ function Make($star) {
               case "Messaging" :
                 return `\n  Messaging is \`Capability_Messaging.make\`, passed to the platform as \`~messagingSender\`. The sender itself is configuration and has no default: set \`platform:messagingEmailSender\` in Pulumi.<stack>.yaml (or REVENTLESS_MESSAGING_EMAIL_SENDER), then verify the address with SES — or \`platform:messagingEmailProvider: log\` to log every message and send none.`;
               case "IdentityProvider" :
-                return `\n  IdentityProvider has no backend on any platform yet — the seam and the refusal exist, the Cognito and local implementations do not. A plugin declaring this need cannot be deployed until one lands; nothing about this deployment's configuration will change that.`;
+                return `\n  IdentityProvider is the platform's Cognito pool, exported as \`identityProviderId\`. This platform stack exports none — deploy it first.`;
             }
           }))).join(""));
         }

package/src/Platform_Stack.res

@@ -12,6 +12,9 @@ type cognitoUserPool = {
     is declared with the trigger's ARN), while the mutation that writes it is
     provisioned after the API — see [Auth_ActiveRoleStore.res]. */
   activeRoleTable: Auth_ActiveRoleStore.storeTable,
+  /** Rows mapping each subject to the domain's own user id, read by the same
+    trigger and written when an account is created — see [Auth_IdentityStore.res]. */
+  identityTable: Auth_IdentityStore.storeTable,
   /** The sign-in attribute this stack created the pool with. `None` in BYO mode:
     the pool's own choice was made elsewhere and no lookup here reads it back,
     so reporting one would be a guess. */
@@ -179,9 +182,16 @@ let _resolveUncached = (): cognitoUserPool => {
     ~choice=Auth_ActiveRoleStore.chooseStore(~identityProviderId=existingPoolId),
     ~opts={},
   )
+  // Same scope rule, same reason: the trigger that reads it is the pool's.
+  let identityTable = Auth_IdentityStore.resolveTable(
+    ~choice=Auth_IdentityStore.chooseStore(~identityProviderId=existingPoolId),
+    ~opts={},
+  )
   let activeRoleTrigger = Auth_ActiveRoleTrigger.make(
     ~activeRoleTableName=activeRoleTable.name->Pulumi.Output.asInput,
     ~activeRoleTableArn=activeRoleTable.arn->Pulumi.Output.asInput,
+    ~identityTableName=identityTable.name->Pulumi.Output.asInput,
+    ~identityTableArn=identityTable.arn->Pulumi.Output.asInput,
     ~opts={},
   )
 
@@ -239,6 +249,7 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: lookup->Pulumi.Output.apply(r => r.arn),
       managed: false,
       activeRoleTable,
+      identityTable,
       loginIdentifier: None,
     }
 
@@ -334,6 +345,7 @@ let _resolveUncached = (): cognitoUserPool => {
       poolArn: pool.arn,
       managed: true,
       activeRoleTable,
+      identityTable,
       loginIdentifier: Some(loginIdentifier),
     }
   }
@@ -409,6 +421,11 @@ let _resolveUncached = (): cognitoUserPool => {
   // the name is derived, not configured, so this is a convenience for checking
   // rather than a value anything is meant to copy into a config.
   Pulumi.Pulumi.export("activeRoleStore", result.activeRoleTable.name)
+  // Read by `provision-accounts` on a stack-owned pool, whose table carries a
+  // generated suffix no derivation can produce.
+  Pulumi.Pulumi.export("identityStore", result.identityTable.name)
+  // What a plugin stack grants its principal-making slices write access to.
+  Pulumi.Pulumi.export("identityStoreArn", result.identityTable.arn)
 
   result
 }

package/src/Platform_Stack.res.mjs

@@ -10,6 +10,7 @@ import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Auth_SignUpMode$ReventlessAws from "./adapter/Auth/Auth_SignUpMode.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
+import * as Auth_IdentityStore$ReventlessAws from "./adapter/Auth/Auth_IdentityStore.res.mjs";
 import * as Auth_ActiveRoleStore$ReventlessAws from "./adapter/Auth/Auth_ActiveRoleStore.res.mjs";
 import * as Auth_LoginIdentifier$ReventlessAws from "./adapter/Auth/Auth_LoginIdentifier.res.mjs";
 import * as Util_CognitoGroupUser$ReventlessAws from "./util/Util_CognitoGroupUser.res.mjs";
@@ -66,7 +67,8 @@ function _resolveUncached() {
   let cfg = new Pulumi.Config("platform");
   let existingPoolId = _identityProviderId(cfg);
   let activeRoleTable = Auth_ActiveRoleStore$ReventlessAws.resolveTable(Auth_ActiveRoleStore$ReventlessAws.chooseStore(existingPoolId), {});
-  let activeRoleTrigger = Auth_ActiveRoleTrigger$ReventlessAws.make(activeRoleTable.name, activeRoleTable.arn, undefined, {});
+  let identityTable = Auth_IdentityStore$ReventlessAws.resolveTable(Auth_IdentityStore$ReventlessAws.chooseStore(existingPoolId), {});
+  let activeRoleTrigger = Auth_ActiveRoleTrigger$ReventlessAws.make(activeRoleTable.name, activeRoleTable.arn, identityTable.name, identityTable.arn, undefined, {});
   let result;
   if (existingPoolId !== undefined) {
     let tokenUnits_accessToken = "minutes";
@@ -105,6 +107,7 @@ function _resolveUncached() {
       poolArn: lookup.apply(r => r.arn),
       managed: false,
       activeRoleTable: activeRoleTable,
+      identityTable: identityTable,
       loginIdentifier: undefined
     };
   } else {
@@ -161,6 +164,7 @@ function _resolveUncached() {
       poolArn: pool.arn,
       managed: true,
       activeRoleTable: activeRoleTable,
+      identityTable: identityTable,
       loginIdentifier: loginIdentifier
     };
   }
@@ -183,6 +187,8 @@ function _resolveUncached() {
   Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
   Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(Role$Reventless.adminGroup()));
   Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
+  Pulumi$Pulumi.$$export("identityStore", result.identityTable.name);
+  Pulumi$Pulumi.$$export("identityStoreArn", result.identityTable.arn);
   return result;
 }
 

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res

@@ -30,6 +30,8 @@ type triggerOutputs = {
 let make = (
   ~activeRoleTableName: Pulumi.Input.t<string>,
   ~activeRoleTableArn: Pulumi.Input.t<string>,
+  ~identityTableName: Pulumi.Input.t<string>,
+  ~identityTableArn: Pulumi.Input.t<string>,
   ~name: string="ActiveRoleTrigger",
   ~opts: Pulumi.ComponentResource.options,
 ): triggerOutputs => {
@@ -47,14 +49,14 @@ let make = (
     ~opts,
   )
 
-  // Logs and a single-item read. Nothing else: the trigger needs no Cognito
-  // permission at all, because the membership it checks against arrives in the
-  // event as `request.groupConfiguration.groupsToOverride`. `GetItem` alone —
-  // this function must never be able to write the preference it reads.
+  // Logs and single-item reads of the two stores. Nothing else: the trigger
+  // needs no Cognito permission at all, because the membership it checks
+  // against arrives in the event as `request.groupConfiguration.groupsToOverride`.
+  // `GetItem` alone — this function must never be able to write what it reads.
   let _policy =
-    activeRoleTableArn
-    ->Pulumi.Output.fromInput
-    ->Pulumi.Output.apply(tableArn => {
+    (activeRoleTableArn->Pulumi.Output.fromInput, identityTableArn->Pulumi.Output.fromInput)
+    ->Pulumi.Output.all2
+    ->Pulumi.Output.apply(((tableArn, identityArn)) => {
       let _ = IAM.RolePolicy.make(
         ~name=name ++ "Policy",
         ~args={
@@ -77,6 +79,12 @@ let make = (
                 actions: Action("dynamodb:GetItem"),
                 resources: Resource(tableArn),
               },
+              {
+                sid: "AllowReadingDomainId",
+                effect: Allow,
+                actions: Action("dynamodb:GetItem"),
+                resources: Resource(identityArn),
+              },
             ],
           )
           ->PolicyDocument.toJsonString
@@ -140,6 +148,7 @@ let make = (
           Lambda.Function.variables: Dict.fromArray([
             ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
             ("ACTIVE_ROLE_TABLE", activeRoleTableName),
+            ("IDENTITY_STORE_TABLE", identityTableName),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
             Util_LambdaLogging.logLevelEntry(),

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res.mjs

@@ -11,11 +11,14 @@ import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 
-function make(activeRoleTableName, activeRoleTableArn, nameOpt, opts) {
+function make(activeRoleTableName, activeRoleTableArn, identityTableName, identityTableArn, nameOpt, opts) {
   let name = nameOpt !== undefined ? nameOpt : "ActiveRoleTrigger";
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
-  activeRoleTableArn.apply(tableArn => {
+  Pulumi.all([
+    activeRoleTableArn,
+    identityTableArn
+  ]).apply(param => {
     new (Aws.iam.RolePolicy)(name + "Policy", {
       policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "Policy", [
         {
@@ -32,7 +35,13 @@ function make(activeRoleTableName, activeRoleTableArn, nameOpt, opts) {
           Sid: "AllowReadingStoredRole",
           Effect: "Allow",
           Action: "dynamodb:GetItem",
-          Resource: tableArn
+          Resource: param[0]
+        },
+        {
+          Sid: "AllowReadingDomainId",
+          Effect: "Allow",
+          Action: "dynamodb:GetItem",
+          Resource: param[1]
         }
       ])),
       role: lambdaRole.id
@@ -65,6 +74,10 @@ function make(activeRoleTableName, activeRoleTableArn, nameOpt, opts) {
           "ACTIVE_ROLE_TABLE",
           activeRoleTableName
         ],
+        [
+          "IDENTITY_STORE_TABLE",
+          identityTableName
+        ],
         [
           "NODE_OPTIONS",
           Util_Bundle$ReventlessAws.esmLoaderNodeOptions

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -41,6 +41,11 @@ let tableName = (): string =>
   | None => JsError.throwWithMessage("ACTIVE_ROLE_TABLE is not configured")
   }
 
+/** The identity store, read for the domain id claim. Optional where the role
+    store is not: a trigger deployed before the store existed must keep minting
+    tokens, and an absent store means exactly what an absent row means. */
+let identityTableName = (): option<string> => getEnv("IDENTITY_STORE_TABLE")
+
 // ── Cognito pre-token-generation event (V1_0) ───────────────────────────────
 
 type userAttributes = {sub?: string}
@@ -124,16 +129,24 @@ exactly one thing.
 `claimsOverrideDetails` is not the same as none, and the regression line for this
 whole feature is that a caller with no stored role gets byte-identical output.
 */
-let respond = (~event: event, ~decision: decision): event => {
+let respond = (~event: event, ~decision: decision, ~userId: option<string>=?): event => {
   let incoming = event.request->Option.flatMap(r => r.groupConfiguration)
   let iamRolesToOverride = incoming->Option.flatMap(g => g.iamRolesToOverride)->Option.getOr([])
   let preferredRole = incoming->Option.flatMap(g => g.preferredRole)
 
+  // The domain id rides on whatever else the mint adds. On its own it adds only
+  // the claim and leaves the group configuration alone, so a caller with a
+  // domain id and no stored role keeps exactly the groups the pool granted.
+  let withUserId = (claims: dict<string>) => {
+    userId->Option.forEach(id => claims->Dict.set(ReventlessCore.Auth_UserId.claim, id))
+    claims
+  }
+
   let overrideWith = (~groups: array<string>, ~claims: dict<string>) => {
     ...event,
     response: {
       claimsOverrideDetails: {
-        claimsToAddOrOverride: claims,
+        claimsToAddOrOverride: withUserId(claims),
         groupOverrideDetails: {
           groupsToOverride: groups,
           iamRolesToOverride,
@@ -143,9 +156,13 @@ let respond = (~event: event, ~decision: decision): event => {
     },
   }
 
-  switch decision {
-  | Unchanged => event
-  | Narrow({role, membership}) =>
+  switch (decision, userId) {
+  | (Unchanged, None) => event
+  | (Unchanged, Some(_)) => {
+      ...event,
+      response: {claimsOverrideDetails: {claimsToAddOrOverride: withUserId(Dict.make())}},
+    }
+  | (Narrow({role, membership}), _) =>
     overrideWith(
       ~groups=[role],
       ~claims=Dict.fromArray([
@@ -153,7 +170,7 @@ let respond = (~event: event, ~decision: decision): event => {
         (ReventlessCore.Auth_ActiveRole.availableRolesClaim, membership->Array.join(",")),
       ]),
     )
-  | Stale({role, membership}) =>
+  | (Stale({role, membership}), _) =>
     // The full set, as the pool granted it — plus the marker that explains why the
     // stored choice did not apply.
     overrideWith(
@@ -194,6 +211,33 @@ let storedRoleFor = async (~sub: string, ~clientId: string, ~table: string): opt
   | _ => None
   }
 
+/**
+The domain id minted for this subject, or `None` for an account created before
+the store existed — whose id is its `sub`, and must stay so: every row it has
+written is keyed by it.
+
+Fails to `None` for the reason [storedRoleFor] does: a claim this trigger could
+not read is a login that must still succeed, and a caller without the claim
+lands on the fallback every older account already uses.
+*/
+let userIdFor = async (~sub: string, ~table: option<string>): option<string> =>
+  switch table {
+  | None => None
+  | Some(table) =>
+    try {
+      let out = await DynamoDb_DocumentClient.GetCommand.make({
+        tableName: table,
+        key: Dict.fromArray([(Auth_IdentityStore_Schema.partitionKey, JSON.Encode.string(sub))]),
+      })->DynamoDb_DocumentClient.GetCommand.send
+      out.item
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(o => o->Dict.get(Auth_IdentityStore_Schema.userIdAttribute))
+      ->Option.flatMap(JSON.Decode.string)
+    } catch {
+    | _ => None
+    }
+  }
+
 // ── Handler ─────────────────────────────────────────────────────────────────
 
 let handler = async (event: event): event => {
@@ -216,10 +260,16 @@ let handler = async (event: event): event => {
   // granted — the safe direction, and the same one a read failure takes. An
   // absent client id is not worth failing a login over: the caller lands on their
   // full membership, which is their existing privileges and not more.
-  if sub == "" || clientId == "" {
+  if sub == "" {
     event
+  } else if clientId == "" {
+    respond(~event, ~decision=Unchanged, ~userId=?await userIdFor(~sub, ~table=identityTableName()))
   } else {
-    let storedRole = await storedRoleFor(~sub, ~clientId, ~table=tableName())
-    respond(~event, ~decision=decide(~membership, ~storedRole))
+    // Both reads at once: this function is a login's latency.
+    let (storedRole, userId) = await Promise.all2((
+      storedRoleFor(~sub, ~clientId, ~table=tableName()),
+      userIdFor(~sub, ~table=identityTableName()),
+    ))
+    respond(~event, ~decision=decide(~membership, ~storedRole), ~userId?)
   }
 }

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs

@@ -4,8 +4,10 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "./Auth_IdentityStore_Schema.res.mjs";
 import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "./Auth_ActiveRoleStore_Schema.res.mjs";
 
 function getEnv(k) {
@@ -24,6 +26,10 @@ function tableName() {
   }
 }
 
+function identityTableName() {
+  return getEnv("IDENTITY_STORE_TABLE");
+}
+
 function decide(membership, storedRole) {
   if (storedRole !== undefined && storedRole !== "") {
     if (membership.includes(storedRole)) {
@@ -44,15 +50,21 @@ function decide(membership, storedRole) {
   }
 }
 
-function respond(event, decision) {
+function respond(event, decision, userId) {
   let incoming = Stdlib_Option.flatMap(event.request, r => r.groupConfiguration);
   let iamRolesToOverride = Stdlib_Option.getOr(Stdlib_Option.flatMap(incoming, g => g.iamRolesToOverride), []);
   let preferredRole = Stdlib_Option.flatMap(incoming, g => g.preferredRole);
+  let withUserId = claims => {
+    Stdlib_Option.forEach(userId, id => {
+      claims[Auth_UserId$ReventlessCore.claim] = id;
+    });
+    return claims;
+  };
   let overrideWith = (groups, claims) => {
     let newrecord = {...event};
     newrecord.response = {
       claimsOverrideDetails: {
-        claimsToAddOrOverride: claims,
+        claimsToAddOrOverride: withUserId(claims),
         groupOverrideDetails: {
           groupsToOverride: groups,
           iamRolesToOverride: iamRolesToOverride,
@@ -63,7 +75,16 @@ function respond(event, decision) {
     return newrecord;
   };
   if (typeof decision !== "object") {
-    return event;
+    if (userId === undefined) {
+      return event;
+    }
+    let newrecord = {...event};
+    newrecord.response = {
+      claimsOverrideDetails: {
+        claimsToAddOrOverride: withUserId({})
+      }
+    };
+    return newrecord;
   }
   if (decision.TAG === "Narrow") {
     let role = decision.role;
@@ -112,23 +133,49 @@ async function storedRoleFor(sub, clientId, table) {
   }
 }
 
+async function userIdFor(sub, table) {
+  if (table === undefined) {
+    return;
+  }
+  try {
+    let out = await DynamoDb_DocumentClient$AwsSdk.GetCommand.send(new LibDynamodb.GetCommand({
+      TableName: table,
+      Key: Object.fromEntries([[
+          Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+          sub
+        ]])
+    }));
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(out.Item, Stdlib_JSON.Decode.object), o => o[Auth_IdentityStore_Schema$ReventlessAws.userIdAttribute]), Stdlib_JSON.Decode.string);
+  } catch (exn) {
+    return;
+  }
+}
+
 async function handler(event) {
   let membership = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event.request, r => r.groupConfiguration), g => g.groupsToOverride), []);
   let sub = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event.request, r => r.userAttributes), u => u.sub), "");
   let clientId = Stdlib_Option.getOr(Stdlib_Option.flatMap(event.callerContext, c => c.clientId), "");
-  if (sub === "" || clientId === "") {
+  if (sub === "") {
     return event;
   }
-  let storedRole = await storedRoleFor(sub, clientId, tableName());
-  return respond(event, decide(membership, storedRole));
+  if (clientId === "") {
+    return respond(event, "Unchanged", await userIdFor(sub, getEnv("IDENTITY_STORE_TABLE")));
+  }
+  let match = await Promise.all([
+    storedRoleFor(sub, clientId, tableName()),
+    userIdFor(sub, getEnv("IDENTITY_STORE_TABLE"))
+  ]);
+  return respond(event, decide(membership, match[0]), match[1]);
 }
 
 export {
   getEnv,
   tableName,
+  identityTableName,
   decide,
   respond,
   storedRoleFor,
+  userIdFor,
   handler,
 }
 /* @aws-sdk/lib-dynamodb Not a pure module */

package/src/adapter/Auth/Auth_Cognito.res

@@ -58,13 +58,24 @@ let _getHeader = (headers: dict<string>, name: string): option<string> =>
   | None => headers->Dict.get(name)
   }
 
+// The domain id when the token carries one, else the `sub`. The fallback is
+// what every account created before the identity store existed relies on: its
+// rows are keyed by the `sub`, and a different answer here would orphan them.
+let _userIdOf = (~claims: dict<JSON.t>, ~sub: string): string =>
+  claims
+  ->Dict.get(ReventlessCore.Auth_UserId.claim)
+  ->Option.flatMap(JSON.Decode.string)
+  ->Option.filter(id => id != "")
+  ->Option.getOr(sub)
+
 let _identityFromClaims = (claims: 'a): Identity.t => {
   let claimsDict: dict<JSON.t> = claims->Obj.magic
-  let userId =
+  let sub =
     claimsDict
     ->Dict.get("sub")
     ->Option.flatMap(JSON.Decode.string)
     ->Option.getOr("anonymous")
+  let userId = _userIdOf(~claims=claimsDict, ~sub)
   let username =
     claimsDict
     ->Dict.get("cognito:username")
@@ -154,7 +165,7 @@ let fromAppSyncIdentity = (id: option<appSyncIdentity>): Identity.authResult =>
         ->Array.map(((k, v)) => (k, v->JSON.Decode.string->Option.getOr(v->JSON.stringify)))
         ->Dict.fromArray
       Authenticated({
-        userId: sub,
+        userId: _userIdOf(~claims=rawClaims, ~sub),
         username,
         groups,
         claims,

package/src/adapter/Auth/Auth_Cognito.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as Platform_Stack$ReventlessAws from "../../Platform_Stack.res.mjs";
 
 let _decodeJwtClaims = (function(token) {
@@ -31,8 +32,13 @@ function _getHeader(headers, name) {
   }
 }
 
+function _userIdOf(claims, sub) {
+  return Stdlib_Option.getOr(Stdlib_Option.filter(Stdlib_Option.flatMap(claims[Auth_UserId$ReventlessCore.claim], Stdlib_JSON.Decode.string), id => id !== ""), sub);
+}
+
 function _identityFromClaims(claims) {
-  let userId = Stdlib_Option.getOr(Stdlib_Option.flatMap(claims["sub"], Stdlib_JSON.Decode.string), "anonymous");
+  let sub = Stdlib_Option.getOr(Stdlib_Option.flatMap(claims["sub"], Stdlib_JSON.Decode.string), "anonymous");
+  let userId = _userIdOf(claims, sub);
   let username = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.orElse(claims["cognito:username"], claims["username"]), Stdlib_JSON.Decode.string), userId);
   let groups = Stdlib_Option.getOr(Stdlib_Option.map(claims["cognito:groups"], g => g), []);
   return {
@@ -81,7 +87,7 @@ function fromAppSyncIdentity(id) {
     return {
       TAG: "Authenticated",
       _0: {
-        userId: sub,
+        userId: _userIdOf(rawClaims, sub),
         username: username,
         groups: groups,
         claims: claims,
@@ -127,6 +133,7 @@ export {
   _decodeJwtClaims,
   _bearerToken,
   _getHeader,
+  _userIdOf,
   _identityFromClaims,
   authenticate,
   fromAppSyncIdentity,

package/src/adapter/Auth/Auth_IdentityStore.res

@@ -0,0 +1,52 @@
+// The rows mapping a Cognito `sub` to the domain's own user id, and where they
+// live. Read by the pre-token-generation trigger on every mint, written only
+// when an account is created (`provision-accounts`, and the Cognito identity
+// provider when it exists).
+//
+// 🚨 **The rows follow the identity provider, not the stack**, exactly as the
+// active-role store's do and for the same reason: a pool holds one pre-token
+// trigger, so two stacks sharing a pool with a table each would have the winning
+// trigger reading rows the other stack wrote nowhere near. A stack that owns its
+// pool owns this table; a stack handed an `identityProviderId` looks it up at
+// [Auth_IdentityStore_Schema.derivedStoreName] and never creates it.
+
+type storeTable = Auth_ActiveRoleStore.storeTable
+
+/** Which store a deployment's trigger reads. Total and pure, like the active-role
+    store's: whether the provider is ours decides it, and nothing else. */
+let chooseStore = (~identityProviderId: option<string>): Auth_ActiveRoleStore.storeChoice =>
+  switch identityProviderId {
+  | None => StackScoped
+  | Some(id) => ProviderScoped(Auth_IdentityStore_Schema.derivedStoreName(~identityProviderId=id))
+  }
+
+/** One row per subject — the key schema is [Auth_IdentityStore_Schema]'s — plus
+    `userId`, the domain id minted for it. */
+let makeTable = (
+  ~name: string="IdentityStore",
+  ~opts: Pulumi.ComponentResource.options,
+): storeTable => {
+  let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+  let table = Util_DynamoDb.makeTable(
+    ~attributes=[{name: Auth_IdentityStore_Schema.partitionKey, type_: "S"}],
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "Table",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Auth,
+      ~scope=Platform,
+    ),
+    ~opts,
+    name,
+  )
+  {name: table.name, arn: table.arn}
+}
+
+/** The store a resolved provider calls for — created or looked up. */
+let resolveTable = (
+  ~choice: Auth_ActiveRoleStore.storeChoice,
+  ~opts: Pulumi.ComponentResource.options,
+): storeTable =>
+  switch choice {
+  | StackScoped => makeTable(~opts)
+  | ProviderScoped(tableName) => Auth_ActiveRoleStore.lookupTable(~tableName)
+  }