@reventlessdev/reventless-aws 3.0.0-alpha.395 → 3.0.0-alpha.396

package/src/adapter/Auth/Auth_IdentityStore.res.mjs

@@ -0,0 +1,46 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "./Auth_ActiveRoleStore.res.mjs";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "./Auth_IdentityStore_Schema.res.mjs";
+
+function chooseStore(identityProviderId) {
+  if (identityProviderId !== undefined) {
+    return {
+      TAG: "ProviderScoped",
+      _0: Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName(identityProviderId)
+    };
+  } else {
+    return "StackScoped";
+  }
+}
+
+function makeTable(nameOpt, opts) {
+  let name = nameOpt !== undefined ? nameOpt : "IdentityStore";
+  let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let table = Util_DynamoDb$ReventlessAws.makeTable([{
+      name: Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+      type: "S"
+    }], undefined, undefined, undefined, AWS_Tags$ReventlessAws.make(name + "Table", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined), opts$1, name);
+  return {
+    name: table.name,
+    arn: table.arn
+  };
+}
+
+function resolveTable(choice, opts) {
+  if (typeof choice !== "object") {
+    return makeTable(undefined, opts);
+  } else {
+    return Auth_ActiveRoleStore$ReventlessAws.lookupTable(choice._0);
+  }
+}
+
+export {
+  chooseStore,
+  makeTable,
+  resolveTable,
+}
+/* AWS_Tags-ReventlessAws Not a pure module */

package/src/adapter/Auth/Auth_IdentityStore_Schema.res

@@ -0,0 +1,39 @@
+// The identity store's identity: what it is called, and how its rows are keyed.
+// The mapping from a Cognito `sub` to the domain's own user id — see
+// [ReventlessCore.Auth_UserId] for why the two differ.
+//
+// One definition for the deploy that creates or looks the table up
+// ([Auth_IdentityStore]), the pre-token trigger that reads it
+// ([Auth_ActiveRoleTrigger_Ops]), and the provisioning scripts that write it
+// (`provision-identity`, `provision-accounts`). Free of Pulumi and of the AWS
+// SDK for the reason [Auth_ActiveRoleStore_Schema] gives.
+
+/** Derived from the provider, never configured, for the reason the active-role
+    store's name is: two stacks on one pool cannot name different stores. */
+let derivedStoreName = (~identityProviderId: string): string =>
+  `ReventlessIdentityStore-${identityProviderId}`
+
+/** The Cognito `sub`. The trigger reads by it on every token it mints. */
+let partitionKey = "id"
+
+/** The domain id the row maps that subject to. */
+let userIdAttribute = "userId"
+
+/** Keyed on the subject alone: one identity, one domain id, on every platform
+    the provider serves. The reverse direction, domain id to subject, is an
+    index to add when the first caller for it exists; a global index can be
+    added to a live table. */
+let expectedKeySchema: array<(string, string)> = [(partitionKey, "HASH")]
+
+/** Why an existing table under this name cannot serve, if it cannot. A table
+    with the wrong key is found by the deploy and missed by every read, so the
+    claim is never added and every new account silently keeps its `sub`. */
+let keySchemaRefusal = (~tableName: string, ~actual: array<(string, string)>): option<string> => {
+  let actualKey = Auth_ActiveRoleStore_Schema.describeKeySchema(actual)
+  let wantedKey = Auth_ActiveRoleStore_Schema.describeKeySchema(expectedKeySchema)
+  actualKey == wantedKey
+    ? None
+    : Some(
+        `table "${tableName}" already exists with key schema [${actualKey}], but the identity store needs [${wantedKey}]. A row written under one key is invisible to a read under the other, so every new account would silently keep its provider id. Rename or remove the table; its rows are a mapping the provisioning run rewrites.`,
+      )
+}

package/src/adapter/Auth/Auth_IdentityStore_Schema.res.mjs

@@ -0,0 +1,35 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "./Auth_ActiveRoleStore_Schema.res.mjs";
+
+function derivedStoreName(identityProviderId) {
+  return `ReventlessIdentityStore-` + identityProviderId;
+}
+
+let partitionKey = "id";
+
+let expectedKeySchema = [[
+    partitionKey,
+    "HASH"
+  ]];
+
+function keySchemaRefusal(tableName, actual) {
+  let actualKey = Auth_ActiveRoleStore_Schema$ReventlessAws.describeKeySchema(actual);
+  let wantedKey = Auth_ActiveRoleStore_Schema$ReventlessAws.describeKeySchema(expectedKeySchema);
+  if (actualKey === wantedKey) {
+    return;
+  } else {
+    return `table "` + tableName + `" already exists with key schema [` + actualKey + `], but the identity store needs [` + wantedKey + `]. A row written under one key is invisible to a read under the other, so every new account would silently keep its provider id. Rename or remove the table; its rows are a mapping the provisioning run rewrites.`;
+  }
+}
+
+let userIdAttribute = "userId";
+
+export {
+  derivedStoreName,
+  partitionKey,
+  userIdAttribute,
+  expectedKeySchema,
+  keySchemaRefusal,
+}
+/* No side effect */

package/src/adapter/Identity/IdentityProvider_Cognito_Backend.res

@@ -0,0 +1,251 @@
+// The identity provider a deployed platform provisions: principals in its
+// Cognito pool, and each new one's domain id in the identity store the pool's
+// pre-token trigger reads. The AWS counterpart of the local platform's
+// `Capability_IdentityProvider_UserStore`, and reached the same way — on the
+// capability record a slice's `translate` receives.
+//
+// Pulumi-free so it ships in the slice Lambda. The pool calls go through an
+// injected `ops` record so the sequencing below — what is undone when a later
+// step fails, which failures are verdicts — is testable without a pool.
+//
+// The principal's handle is the username, and the username is the address the
+// person is reached at, as on the local platform.
+
+open Reventless
+
+/** The calls a provider makes, one per pool or store operation. Each throws the
+    SDK's error on failure; [failureOf] classifies it. */
+type ops = {
+  /** Creates the account and answers its `sub`. */
+  createUser: (~username: string, ~attributes: array<(string, string)>) => promise<option<string>>,
+  subOf: (~username: string) => promise<option<string>>,
+  setPassword: (~username: string, ~password: string) => promise<unit>,
+  addToGroup: (~username: string, ~group: string) => promise<unit>,
+  removeFromGroup: (~username: string, ~group: string) => promise<unit>,
+  deleteUser: (~username: string) => promise<unit>,
+  putUserId: (~sub: string, ~userId: string) => promise<unit>,
+  deleteUserId: (~sub: string) => promise<unit>,
+}
+
+@get @return(nullable) external errorName: JsExn.t => option<string> = "name"
+
+let codeOf = (exn: exn): option<string> => exn->JsExn.fromException->Option.flatMap(errorName)
+
+let messageOf = (exn: exn): string =>
+  exn
+  ->JsExn.fromException
+  ->Option.flatMap(JsExn.message)
+  ->Option.getOr("the identity provider failed")
+
+/**
+A pool failure as the capability's answer.
+
+`Refused` only where the pool has judged the request itself — a password its
+policy rejects, an attribute it will not take, a group that does not exist.
+Everything else is `Unavailable`, retried: throttling, a network blip, a role
+missing its grant. A caller reaching `createPrincipal` has already recorded that
+the address was proven, and treating an outage as a verdict would strand them.
+*/
+let failureOf = (exn: exn): IdentityProvider.failure =>
+  switch codeOf(exn) {
+  | Some("UsernameExistsException" | "AliasExistsException") => Conflict
+  | Some(
+      "InvalidPasswordException"
+      | "InvalidParameterException"
+      | "UserNotFoundException"
+      | "ResourceNotFoundException",
+    ) =>
+    Refused(messageOf(exn))
+  | _ => Unavailable(messageOf(exn))
+  }
+
+let usernameOf = (contact: Messaging.recipient): result<string, IdentityProvider.failure> =>
+  switch contact {
+  | ToEmail(email) => Ok(Email.toString(email))
+  | ToSms(phone) => Ok(Phone.toString(phone))
+  | ToPush(_) => Error(Refused("a push address cannot be signed in with"))
+  }
+
+/** Verified, because a principal is only created after the address was proven —
+    the ordering the registration chapter is built on. */
+let attributesOf = (contact: Messaging.recipient): array<(string, string)> =>
+  switch contact {
+  | ToEmail(email) => [("email", Email.toString(email)), ("email_verified", "true")]
+  | ToSms(phone) => [("phone_number", Phone.toString(phone)), ("phone_number_verified", "true")]
+  | ToPush(_) => []
+  }
+
+let attempt = async (run: unit => promise<'a>): result<'a, IdentityProvider.failure> =>
+  try Ok(await run()) catch {
+  | exn => Error(failureOf(exn))
+  }
+
+let withOps = (ops: ops, ~hasStore: bool): IdentityProvider.t => {
+  // Everything after the account exists, in order. A failure here undoes the
+  // account before answering, so a retry starts from nothing: left in place, the
+  // retry would meet `UsernameExistsException` and report a `Conflict` for a
+  // person whose first attempt merely timed out.
+  let complete = async (~username, ~sub, ~credential: IdentityProvider.credential, ~groups) => {
+    let steps = async () => {
+      switch credential {
+      | Password(password) => await ops.setPassword(~username, ~password)
+      | NoCredential => ()
+      }
+      for i in 0 to groups->Array.length - 1 {
+        await ops.addToGroup(~username, ~group=groups->Array.getUnsafe(i))
+      }
+
+      // Minted here and only here: an account the pool made before the store
+      // existed keeps its `sub`, and nothing re-keys it.
+      if hasStore {
+        await ops.putUserId(~sub, ~userId=ReventlessCore.Auth_UserId.mint())
+      }
+    }
+    switch await attempt(steps) {
+    | Ok() => Ok({IdentityProvider.providerId: username})
+    | Error(_) as failed =>
+      let _ = await attempt(() => ops.deleteUser(~username))
+      failed
+    }
+  }
+
+  let createPrincipal = async (~contact, ~credential, ~groups) =>
+    switch usernameOf(contact) {
+    | Error(_) as e => e
+    | Ok(username) =>
+      switch await attempt(() => ops.createUser(~username, ~attributes=attributesOf(contact))) {
+      | Error(_) as e => e
+      | Ok(created) =>
+        let sub = switch created {
+        | Some(_) => created
+        | None => (await attempt(() => ops.subOf(~username)))->Result.getOr(None)
+        }
+        switch sub {
+        | None =>
+          let _ = await attempt(() => ops.deleteUser(~username))
+          Error(IdentityProvider.Unavailable(`the pool created ${username} but named no sub`))
+        | Some(sub) => await complete(~username, ~sub, ~credential, ~groups)
+        }
+      }
+    }
+
+  let addToGroup = (~principal: IdentityProvider.principal, ~group) =>
+    attempt(() => ops.addToGroup(~username=principal.providerId, ~group))
+
+  let removeFromGroup = (~principal: IdentityProvider.principal, ~group) =>
+    attempt(() => ops.removeFromGroup(~username=principal.providerId, ~group))
+
+  // Deleting what is gone is the retry of a delete that happened, so a missing
+  // account answers `Ok`. The mapping row goes last, best effort: a row whose
+  // principal is gone is never read on the request path, since no token is
+  // minted for it.
+  let deletePrincipal = async (~principal: IdentityProvider.principal) => {
+    let username = principal.providerId
+    switch await attempt(() => ops.subOf(~username)) {
+    | Error(Refused(_)) => Ok()
+    | Error(_) as e => e
+    | Ok(sub) =>
+      switch await attempt(() => ops.deleteUser(~username)) {
+      | Error(Unavailable(_)) as e => e
+      | Error(_) | Ok() =>
+        switch (sub, hasStore) {
+        | (Some(sub), true) =>
+          let _ = await attempt(() => ops.deleteUserId(~sub))
+        | _ => ()
+        }
+        Ok()
+      }
+    }
+  }
+
+  IdentityProvider.make(
+    ~createPrincipal,
+    ~addToGroup,
+    ~removeFromGroup,
+    ~deletePrincipal,
+    ~operations=[CreatePrincipal, AddToGroup, RemoveFromGroup, DeletePrincipal],
+  )
+}
+
+// ── The SDK ──────────────────────────────────────────────────────────────────
+
+module Cognito = AwsSdk.CognitoIdentityServiceProvider
+
+let subFrom = (attributes: option<array<Cognito.AdminCreateUserCommand.attributeType>>) =>
+  attributes->Option.getOr([])->Array.find(a => a.name == "sub")->Option.map(a => a.value)
+
+let sdkOps = (~poolId: string, ~identityStore: string): ops => {
+  createUser: async (~username, ~attributes) => {
+    let out = await Cognito.AdminCreateUserCommand.make({
+      userPoolId: poolId,
+      username,
+      userAttributes: attributes->Array.map(((name, value)) => {
+        Cognito.AdminCreateUserCommand.name,
+        value,
+      }),
+      // No invitation: the person has proven the address already, and the
+      // invitation would carry a temporary password nobody should use.
+      messageAction: "SUPPRESS",
+    })->Cognito.AdminCreateUserCommand.send
+    out.user->Option.flatMap(u => subFrom(u.attributes))
+  },
+  subOf: async (~username) => {
+    let out = await Cognito.AdminGetUserCommand.make({
+      userPoolId: poolId,
+      username,
+    })->Cognito.AdminGetUserCommand.send
+    out.userAttributes->Option.getOr([])->Array.find(a => a.name == "sub")->Option.map(a => a.value)
+  },
+  setPassword: (~username, ~password) =>
+    Cognito.AdminSetUserPasswordCommand.make({
+      userPoolId: poolId,
+      username,
+      password,
+      permanent: true,
+    })->Cognito.AdminSetUserPasswordCommand.send,
+  addToGroup: (~username, ~group) =>
+    Cognito.AdminAddUserToGroupCommand.make({
+      userPoolId: poolId,
+      username,
+      groupName: group,
+    })->Cognito.AdminAddUserToGroupCommand.send,
+  removeFromGroup: (~username, ~group) =>
+    Cognito.AdminRemoveUserFromGroupCommand.make({
+      userPoolId: poolId,
+      username,
+      groupName: group,
+    })->Cognito.AdminRemoveUserFromGroupCommand.send,
+  deleteUser: (~username) =>
+    Cognito.AdminDeleteUserCommand.make({
+      userPoolId: poolId,
+      username,
+    })->Cognito.AdminDeleteUserCommand.send,
+  putUserId: async (~sub, ~userId) => {
+    let _ = await AwsSdk.DynamoDb_DocumentClient.PutCommand.make({
+      tableName: identityStore,
+      item: JSON.Encode.object(
+        Dict.fromArray([
+          (Auth_IdentityStore_Schema.partitionKey, JSON.Encode.string(sub)),
+          (Auth_IdentityStore_Schema.userIdAttribute, JSON.Encode.string(userId)),
+        ]),
+      ),
+    })->AwsSdk.DynamoDb_DocumentClient.PutCommand.send
+  },
+  deleteUserId: async (~sub) => {
+    let _ = await AwsSdk.DynamoDb_DocumentClient.DeleteCommand.make({
+      tableName: identityStore,
+      key: Dict.fromArray([(Auth_IdentityStore_Schema.partitionKey, JSON.Encode.string(sub))]),
+    })->AwsSdk.DynamoDb_DocumentClient.DeleteCommand.send
+  },
+}
+
+/**
+The provider a slice Lambda is handed, from the two values the deploy put in its
+environment. No pool is the deployment gap it always was, answered `Unavailable`
+with no operations. No store means the pool predates it: principals are still
+made, and each keeps its `sub` as its id, as every account before the store did.
+*/
+let provider = (~poolId: string, ~identityStore: string): IdentityProvider.t =>
+  poolId == ""
+    ? IdentityProvider.unavailable(~reason="no identity provider is configured for this platform")
+    : withOps(sdkOps(~poolId, ~identityStore), ~hasStore=identityStore != "")

package/src/adapter/Identity/IdentityProvider_Cognito_Backend.res.mjs

@@ -0,0 +1,300 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as LibDynamodb from "@aws-sdk/lib-dynamodb";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
+import * as IdentityProvider$Reventless from "@reventlessdev/reventless-spec/src/semantic/IdentityProvider.res.mjs";
+import * as DynamoDb_DocumentClient$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DocumentClient.res.mjs";
+import * as CognitoIdentityServiceProvider$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/CognitoIdentityServiceProvider.res.mjs";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "../Auth/Auth_IdentityStore_Schema.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+
+function codeOf(exn) {
+  return Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), prim => Primitive_option.fromNullable(prim.name));
+}
+
+function messageOf(exn) {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "the identity provider failed");
+}
+
+function failureOf(exn) {
+  let match = codeOf(exn);
+  if (match === undefined) {
+    return {
+      TAG: "Unavailable",
+      _0: messageOf(exn)
+    };
+  }
+  switch (match) {
+    case "InvalidParameterException" :
+    case "InvalidPasswordException" :
+    case "ResourceNotFoundException" :
+    case "UserNotFoundException" :
+      return {
+        TAG: "Refused",
+        _0: messageOf(exn)
+      };
+    case "AliasExistsException" :
+    case "UsernameExistsException" :
+      return "Conflict";
+    default:
+      return {
+        TAG: "Unavailable",
+        _0: messageOf(exn)
+      };
+  }
+}
+
+function usernameOf(contact) {
+  switch (contact.TAG) {
+    case "ToEmail" :
+    case "ToSms" :
+      return {
+        TAG: "Ok",
+        _0: contact._0
+      };
+    case "ToPush" :
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Refused",
+          _0: "a push address cannot be signed in with"
+        }
+      };
+  }
+}
+
+function attributesOf(contact) {
+  switch (contact.TAG) {
+    case "ToEmail" :
+      return [
+        [
+          "email",
+          contact._0
+        ],
+        [
+          "email_verified",
+          "true"
+        ]
+      ];
+    case "ToSms" :
+      return [
+        [
+          "phone_number",
+          contact._0
+        ],
+        [
+          "phone_number_verified",
+          "true"
+        ]
+      ];
+    case "ToPush" :
+      return [];
+  }
+}
+
+async function attempt(run) {
+  try {
+    return {
+      TAG: "Ok",
+      _0: await run()
+    };
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    return {
+      TAG: "Error",
+      _0: failureOf(exn)
+    };
+  }
+}
+
+function withOps(ops, hasStore) {
+  let complete = async (username, sub, credential, groups) => {
+    let steps = async () => {
+      if (typeof credential === "object") {
+        await ops.setPassword(username, credential._0);
+      }
+      for (let i = 0, i_finish = groups.length; i < i_finish; ++i) {
+        await ops.addToGroup(username, groups[i]);
+      }
+      if (hasStore) {
+        return await ops.putUserId(sub, Auth_UserId$ReventlessCore.mint());
+      }
+    };
+    let failed = await attempt(steps);
+    if (failed.TAG === "Ok") {
+      return {
+        TAG: "Ok",
+        _0: {
+          providerId: username
+        }
+      };
+    }
+    await attempt(() => ops.deleteUser(username));
+    return failed;
+  };
+  let createPrincipal = async (contact, credential, groups) => {
+    let e = usernameOf(contact);
+    if (e.TAG !== "Ok") {
+      return e;
+    }
+    let username = e._0;
+    let e$1 = await attempt(() => ops.createUser(username, attributesOf(contact)));
+    if (e$1.TAG !== "Ok") {
+      return e$1;
+    }
+    let created = e$1._0;
+    let sub = created !== undefined ? created : Stdlib_Result.getOr(await attempt(() => ops.subOf(username)), undefined);
+    if (sub !== undefined) {
+      return await complete(username, sub, credential, groups);
+    } else {
+      await attempt(() => ops.deleteUser(username));
+      return {
+        TAG: "Error",
+        _0: {
+          TAG: "Unavailable",
+          _0: `the pool created ` + username + ` but named no sub`
+        }
+      };
+    }
+  };
+  let addToGroup = (principal, group) => attempt(() => ops.addToGroup(principal.providerId, group));
+  let removeFromGroup = (principal, group) => attempt(() => ops.removeFromGroup(principal.providerId, group));
+  let deletePrincipal = async principal => {
+    let username = principal.providerId;
+    let e = await attempt(() => ops.subOf(username));
+    if (e.TAG === "Ok") {
+      let sub = e._0;
+      let e$1 = await attempt(() => ops.deleteUser(username));
+      if (e$1.TAG !== "Ok") {
+        let tmp = e$1._0;
+        if (typeof tmp === "object" && tmp.TAG === "Unavailable") {
+          return e$1;
+        }
+      }
+      if (sub !== undefined && hasStore) {
+        await attempt(() => ops.deleteUserId(sub));
+      }
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    }
+    let tmp$1 = e._0;
+    if (typeof tmp$1 !== "object" || tmp$1.TAG === "Unavailable") {
+      return e;
+    } else {
+      return {
+        TAG: "Ok",
+        _0: undefined
+      };
+    }
+  };
+  return IdentityProvider$Reventless.make(createPrincipal, addToGroup, removeFromGroup, deletePrincipal, [
+    "CreatePrincipal",
+    "AddToGroup",
+    "RemoveFromGroup",
+    "DeletePrincipal"
+  ]);
+}
+
+function subFrom(attributes) {
+  return Stdlib_Option.map(Stdlib_Option.getOr(attributes, []).find(a => a.Name === "sub"), a => a.Value);
+}
+
+function sdkOps(poolId, identityStore) {
+  return {
+    createUser: async (username, attributes) => {
+      let out = await CognitoIdentityServiceProvider$AwsSdk.AdminCreateUserCommand.send(new ClientCognitoIdentityProvider.AdminCreateUserCommand({
+        UserPoolId: poolId,
+        Username: username,
+        UserAttributes: attributes.map(param => ({
+          Name: param[0],
+          Value: param[1]
+        })),
+        MessageAction: "SUPPRESS"
+      }));
+      return Stdlib_Option.flatMap(out.User, u => subFrom(u.Attributes));
+    },
+    subOf: async username => {
+      let out = await CognitoIdentityServiceProvider$AwsSdk.AdminGetUserCommand.send(new ClientCognitoIdentityProvider.AdminGetUserCommand({
+        UserPoolId: poolId,
+        Username: username
+      }));
+      return Stdlib_Option.map(Stdlib_Option.getOr(out.UserAttributes, []).find(a => a.Name === "sub"), a => a.Value);
+    },
+    setPassword: (username, password) => CognitoIdentityServiceProvider$AwsSdk.AdminSetUserPasswordCommand.send(new ClientCognitoIdentityProvider.AdminSetUserPasswordCommand({
+      UserPoolId: poolId,
+      Username: username,
+      Password: password,
+      Permanent: true
+    })),
+    addToGroup: (username, group) => CognitoIdentityServiceProvider$AwsSdk.AdminAddUserToGroupCommand.send(new ClientCognitoIdentityProvider.AdminAddUserToGroupCommand({
+      Username: username,
+      GroupName: group,
+      UserPoolId: poolId
+    })),
+    removeFromGroup: (username, group) => CognitoIdentityServiceProvider$AwsSdk.AdminRemoveUserFromGroupCommand.send(new ClientCognitoIdentityProvider.AdminRemoveUserFromGroupCommand({
+      Username: username,
+      GroupName: group,
+      UserPoolId: poolId
+    })),
+    deleteUser: username => CognitoIdentityServiceProvider$AwsSdk.AdminDeleteUserCommand.send(new ClientCognitoIdentityProvider.AdminDeleteUserCommand({
+      UserPoolId: poolId,
+      Username: username
+    })),
+    putUserId: async (sub, userId) => {
+      await DynamoDb_DocumentClient$AwsSdk.PutCommand.send(new LibDynamodb.PutCommand({
+        Item: Object.fromEntries([
+          [
+            Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+            sub
+          ],
+          [
+            Auth_IdentityStore_Schema$ReventlessAws.userIdAttribute,
+            userId
+          ]
+        ]),
+        TableName: identityStore
+      }));
+    },
+    deleteUserId: async sub => {
+      await DynamoDb_DocumentClient$AwsSdk.DeleteCommand.send(new LibDynamodb.DeleteCommand({
+        TableName: identityStore,
+        Key: Object.fromEntries([[
+            Auth_IdentityStore_Schema$ReventlessAws.partitionKey,
+            sub
+          ]])
+      }));
+    }
+  };
+}
+
+function provider(poolId, identityStore) {
+  if (poolId === "") {
+    return IdentityProvider$Reventless.unavailable("no identity provider is configured for this platform");
+  } else {
+    return withOps(sdkOps(poolId, identityStore), identityStore !== "");
+  }
+}
+
+let Cognito;
+
+export {
+  codeOf,
+  messageOf,
+  failureOf,
+  usernameOf,
+  attributesOf,
+  attempt,
+  withOps,
+  Cognito,
+  subFrom,
+  sdkOps,
+  provider,
+}
+/* Stdlib_JsExn Not a pure module */

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res

@@ -420,10 +420,13 @@ let capabilities = (): Reventless.Capabilities.t => {
       ~text,
     ),
   messaging: messagingEmailProvider(),
-  // Refusing until the Cognito backend lands. The pool is provisioned, but the
-  // store mapping a domain user id to a provider handle is not, and creating a
-  // principal before that exists would write a handle with nowhere to live.
-  identityProvider: Reventless.Capabilities.none.identityProvider,
+  // The platform's pool and identity store, both read per call like the sender
+  // above. An empty pool id is a plugin deployed with no platform to read one
+  // from, and answers `Unavailable` with no operations.
+  identityProvider: IdentityProvider_Cognito_Backend.provider(
+    ~poolId=NodeProcess.env->Dict.get("IDENTITY_PROVIDER_ID")->Option.getOr(""),
+    ~identityStore=NodeProcess.env->Dict.get("IDENTITY_STORE_TABLE")->Option.getOr(""),
+  ),
   secrets: ReventlessCore.Secrets_Node_Backend.provider,
 }