@reventlessdev/reventless-aws 3.0.0-alpha.395 → 3.0.0-alpha.396

package/src/adapter/Runtime/AutomationSliceEntryPoint_Ops.res.mjs

@@ -13,7 +13,6 @@ import * as DcbDecode$Reventless from "@reventlessdev/reventless-spec/src/compon
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
 import * as Message$ReventlessCore from "@reventlessdev/reventless-core/src/Message.res.mjs";
-import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
 import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
 import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
 import * as Messaging_Ses_Backend$ReventlessAws from "../Messaging/Messaging_Ses_Backend.res.mjs";
@@ -26,6 +25,7 @@ import * as StreamRoutedEntryPoint_Ops$ReventlessAws from "./StreamRoutedEntryPo
 import * as Geocoder_AwsLocation_Backend$ReventlessAws from "../Geocoder/Geocoder_AwsLocation_Backend.res.mjs";
 import * as CommandTopicChannel_SQS_Runtime$ReventlessAws from "../CommandTopic/CommandTopicChannel_SQS_Runtime.res.mjs";
 import * as QueryDbStorage_DynamoDb_Runtime$ReventlessAws from "../QueryDb/QueryDbStorage_DynamoDb_Runtime.res.mjs";
+import * as IdentityProvider_Cognito_Backend$ReventlessAws from "../Identity/IdentityProvider_Cognito_Backend.res.mjs";
 import * as OutboundTranslationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Callback.res.mjs";
 import * as ScheduledPublisher_EventBridgeScheduler_Runtime$ReventlessAws from "../ScheduledPublisher/ScheduledPublisher_EventBridgeScheduler_Runtime.res.mjs";
 
@@ -275,7 +275,7 @@ function capabilities() {
   return {
     geocode: text => Geocoder_AwsLocation_Backend$ReventlessAws.search(Stdlib_Option.getOr(process.env["PLACE_INDEX_NAME"], ""), text, undefined),
     messaging: messagingEmailProvider(),
-    identityProvider: Capabilities$Reventless.none.identityProvider,
+    identityProvider: IdentityProvider_Cognito_Backend$ReventlessAws.provider(Stdlib_Option.getOr(process.env["IDENTITY_PROVIDER_ID"], ""), Stdlib_Option.getOr(process.env["IDENTITY_STORE_TABLE"], "")),
     secrets: Secrets_Node_Backend$ReventlessCore.provider
   };
 }

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res

@@ -54,6 +54,9 @@ type sliceInfo = {
   // The schedules store's table, empty for a slice that maps no `Clock`. Granted to
   // the Lambda with the to-do tables, and named in the slice's handler config.
   schedulesResources: array<ReventlessInfra.Adapter.resource>,
+  // The capabilities the slice's spec declares. Read by grants that must not be
+  // handed to every slice on the shared Lambda for one slice's sake.
+  capabilityNeeds: array<Reventless.CapabilityNeed.t>,
 }
 
 let bundledInfos: dict<sliceInfo> = Dict.make()
@@ -103,6 +106,7 @@ let registerAutomationSlice = (
   ~commandTargetName=?,
   ~schedule=?,
   ~schedulesResources=[],
+  ~capabilityNeeds=[],
 ) =>
   bundledInfos->Dict.set(
     name,
@@ -118,6 +122,7 @@ let registerAutomationSlice = (
       commandTargetName,
       schedule,
       schedulesResources,
+      capabilityNeeds,
     },
   )
 
@@ -334,6 +339,80 @@ let makeMessagingGrant = (~runtime: ReventlessCore.Runtime.environment<runtimePa
     )
   }
 
+/** Whether any slice on the shared Lambda declares the identity provider. The
+    grant below is the one that can create and delete accounts, so it follows a
+    declaration rather than the pool merely existing — which on AWS it always
+    does. */
+let declaresIdentityProvider = (infos: array<sliceInfo>): bool =>
+  infos->Array.some(info => info.capabilityNeeds->Array.includes(IdentityProvider))
+
+/** The admin calls the Cognito provider makes, on the one pool. */
+let identityProviderPoolActions = [
+  "cognito-idp:AdminCreateUser",
+  "cognito-idp:AdminGetUser",
+  "cognito-idp:AdminSetUserPassword",
+  "cognito-idp:AdminAddUserToGroup",
+  "cognito-idp:AdminRemoveUserFromGroup",
+  "cognito-idp:AdminDeleteUser",
+]
+
+// Built like the two grants above: a plain bool decides, the ARNs are Outputs,
+// and the RolePolicy is created at top level rather than inside an `apply`.
+let makeIdentityProviderGrant = (
+  ~runtime: ReventlessCore.Runtime.environment<runtimeParts>,
+  ~opts,
+) =>
+  if (
+    PluginRuntime_Builder.identityProviderProvisioned() &&
+    declaresIdentityProvider(bundledInfos->Dict.valuesToArray)
+  ) {
+    let customOpts =
+      opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
+    let {
+      poolArn,
+      storeArn,
+    }: PluginRuntime_Builder.identityProviderResources = PluginRuntime_Builder.identityProvider()
+    let policyJson = Pulumi.Output.all2((poolArn, storeArn))->Pulumi.Output.apply(((
+      pool,
+      store,
+    )) => {
+      open PulumiAws.PolicyDocument
+      PulumiAws.PolicyDocument.make(
+        ~id="AllAutomationSlicesIdentityProvider",
+        ~statements=Array.concat(
+          [
+            {
+              sid: "AllowManagingPrincipals",
+              effect: Allow,
+              actions: Actions(identityProviderPoolActions),
+              resources: Resource(pool),
+            },
+          ],
+          // A pool provisioned before the store has none, and its principals
+          // keep their `sub`; there is nothing to grant.
+          store == ""
+            ? []
+            : [
+                {
+                  sid: "AllowRecordingDomainIds",
+                  effect: Allow,
+                  actions: Actions(["dynamodb:PutItem", "dynamodb:DeleteItem"]),
+                  resources: Resource(store),
+                },
+              ],
+        ),
+      )->PulumiAws.PolicyDocument.toJsonString
+    })
+    let _ = PulumiAws.IAM.RolePolicy.make(
+      ~name="AllAutomationSlicesIdentityProvider",
+      ~args={
+        policy: policyJson->Pulumi.Output.asInput,
+        role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+      },
+      ~opts=customOpts,
+    )
+  }
+
 // The automations' schedules. The Lambda may manage the schedules in the stack's
 // scheduler group and pass the scheduler role to them; the scheduler role may invoke
 // the Lambda; and each deploy invokes the Lambda to reconcile the declared schedules
@@ -833,6 +912,7 @@ let finishWithDcbEventLog = (
         makeAutomationSchedules(~runtime, ~schedulerRoleArn, ~sourceCodeHash, ~opts)
         makeGeocoderGrant(~runtime, ~opts)
         makeMessagingGrant(~runtime, ~opts)
+        makeIdentityProviderGrant(~runtime, ~opts)
       | None =>
         log.warn(
           ~comp="AutomationSliceRuntime_Builder_Single",

package/src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs

@@ -56,12 +56,13 @@ function getDcbQueueUrl() {
   return dcbQueueUrlRef.contents;
 }
 
-function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackTypeOpt, queryDbTableName, queryDbResourcesOpt, context, sourceTopicsOpt, consumesDcbLogOpt, commandTargetName, schedule, schedulesResourcesOpt) {
+function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackTypeOpt, queryDbTableName, queryDbResourcesOpt, context, sourceTopicsOpt, consumesDcbLogOpt, commandTargetName, schedule, schedulesResourcesOpt, capabilityNeedsOpt) {
   let callbackType = callbackTypeOpt !== undefined ? callbackTypeOpt : "automation";
   let queryDbResources = queryDbResourcesOpt !== undefined ? queryDbResourcesOpt : [];
   let sourceTopics = sourceTopicsOpt !== undefined ? sourceTopicsOpt : ({});
   let consumesDcbLog = consumesDcbLogOpt !== undefined ? consumesDcbLogOpt : true;
   let schedulesResources = schedulesResourcesOpt !== undefined ? schedulesResourcesOpt : [];
+  let capabilityNeeds = capabilityNeedsOpt !== undefined ? capabilityNeedsOpt : [];
   bundledInfos[name] = {
     specModulePath: specModulePath,
     bodyModulePath: bodyModulePath,
@@ -73,7 +74,8 @@ function registerAutomationSlice(name, specModulePath, bodyModulePath, callbackT
     consumesDcbLog: consumesDcbLog,
     commandTargetName: commandTargetName,
     schedule: schedule,
-    schedulesResources: schedulesResources
+    schedulesResources: schedulesResources,
+    capabilityNeeds: capabilityNeeds
   };
 }
 
@@ -175,6 +177,51 @@ function makeMessagingGrant(runtime, opts) {
   }, customOpts);
 }
 
+function declaresIdentityProvider(infos) {
+  return infos.some(info => info.capabilityNeeds.includes("IdentityProvider"));
+}
+
+let identityProviderPoolActions = [
+  "cognito-idp:AdminCreateUser",
+  "cognito-idp:AdminGetUser",
+  "cognito-idp:AdminSetUserPassword",
+  "cognito-idp:AdminAddUserToGroup",
+  "cognito-idp:AdminRemoveUserFromGroup",
+  "cognito-idp:AdminDeleteUser"
+];
+
+function makeIdentityProviderGrant(runtime, opts) {
+  if (!(PluginRuntime_Builder$ReventlessAws.identityProviderProvisioned() && declaresIdentityProvider(Object.values(bundledInfos)))) {
+    return;
+  }
+  let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let match = PluginRuntime_Builder$ReventlessAws.identityProvider();
+  let policyJson = Pulumi.all([
+    match.poolArn,
+    match.storeArn
+  ]).apply(param => {
+    let store = param[1];
+    return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, "AllAutomationSlicesIdentityProvider", [{
+        Sid: "AllowManagingPrincipals",
+        Effect: "Allow",
+        Action: identityProviderPoolActions,
+        Resource: param[0]
+      }].concat(store === "" ? [] : [{
+          Sid: "AllowRecordingDomainIds",
+          Effect: "Allow",
+          Action: [
+            "dynamodb:PutItem",
+            "dynamodb:DeleteItem"
+          ],
+          Resource: store
+        }])));
+  });
+  new (Aws.iam.RolePolicy)("AllAutomationSlicesIdentityProvider", {
+    policy: policyJson,
+    role: runtime.parts.lambdaRole.id
+  }, customOpts);
+}
+
 function makeAutomationSchedules(runtime, schedulerRoleArn, sourceCodeHash, opts) {
   let name = "AllAutomationSlices";
   let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
@@ -452,6 +499,7 @@ function finishWithDcbEventLog(schedulerRoleArn, dcbEventLog) {
       makeAutomationSchedules(runtime, schedulerRoleArn, sourceCodeHash, opts);
       makeGeocoderGrant(runtime, opts);
       makeMessagingGrant(runtime, opts);
+      makeIdentityProviderGrant(runtime, opts);
     } else {
       log.warn("AutomationSliceRuntime_Builder_Single", undefined, "finishWithDcbEventLog: DCB EventLog has no parent");
     }
@@ -483,6 +531,9 @@ export {
   makeSweepSchedule,
   makeGeocoderGrant,
   makeMessagingGrant,
+  declaresIdentityProvider,
+  identityProviderPoolActions,
+  makeIdentityProviderGrant,
   makeAutomationSchedules,
   finished,
   finish,

package/src/components/AutomationSlice_Builder.res.mjs

@@ -62,7 +62,7 @@ function Make(Api) {
       let queryDbTableName = tableResource.name;
       let sourceTopics = EventTopic$ReventlessCore.filter(allEventTopics, Belt_SetString.fromArray(sourceNames));
       let consumesDcbLog = sourceNames.length === 0 || sourceNames.some(name => !(name in allEventTopics));
-      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Automation.moduleUrl), "automation", queryDbTableName, queryDbOutputs.resources, context, sourceTopics, consumesDcbLog, undefined, Spec.schedule, Stdlib_Option.mapOr(Component$ReventlessCore.outputs(as_).schedulesDb, [], db => db.resources));
+      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Automation.moduleUrl), "automation", queryDbTableName, queryDbOutputs.resources, context, sourceTopics, consumesDcbLog, undefined, Spec.schedule, Stdlib_Option.mapOr(Component$ReventlessCore.outputs(as_).schedulesDb, [], db => db.resources), undefined);
       return as_;
     };
     return {

package/src/components/OutboundTranslationSlice_Builder.res

@@ -94,6 +94,8 @@ module Make = (
         ~consumesDcbLog,
         // Only the name: the target Aggregate's CommandTopic does not exist yet.
         ~commandTargetName=?Spec.targetName,
+        // What decides whether the shared Lambda may create and delete accounts.
+        ~capabilityNeeds=Spec.capabilityNeeds,
       )
 
       ots

package/src/components/OutboundTranslationSlice_Builder.res.mjs

@@ -63,7 +63,7 @@ function Make(Api) {
       let declaredSources = Spec.sourceNames;
       let sourceTopics = EventTopic$ReventlessCore.filter(allEventTopics, Belt_SetString.fromArray(declaredSources));
       let consumesDcbLog = declaredSources.length === 0 || declaredSources.some(name => !(name in allEventTopics));
-      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl), "outbound", queryDbTableName, queryDbOutputs.resources, undefined, sourceTopics, consumesDcbLog, Spec.targetName, undefined, undefined);
+      AutomationSliceRuntime_Builder_Single$ReventlessAws.registerAutomationSlice(Spec.name, Util_Bundle$ReventlessAws.getModuleSpecifier(Spec.moduleUrl), Util_Bundle$ReventlessAws.getModuleSpecifier(Translation.moduleUrl), "outbound", queryDbTableName, queryDbOutputs.resources, undefined, sourceTopics, consumesDcbLog, Spec.targetName, undefined, undefined, Spec.capabilityNeeds);
       return ots;
     };
     return {

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -91,6 +91,29 @@ let registerMessagingSender = (sender: Pulumi.Output.t<string>) => {
 let messagingSender = () => messagingSenderRef.contents
 let messagingProvisioned = () => messagingProvisionedRef.contents
 
+/** The pool and the identity store, carried for the grant: a slice making
+    principals needs Cognito's admin calls on the one pool and writes on the one
+    store. Granted only to a plugin with a slice that declares the need — see
+    `AutomationSliceRuntime_Builder_Single.makeIdentityProviderGrant`. */
+type identityProviderResources = {
+  poolArn: Pulumi.Output.t<string>,
+  storeArn: Pulumi.Output.t<string>,
+}
+
+let identityProviderRef: ref<identityProviderResources> = ref({
+  poolArn: Pulumi.Output.make(""),
+  storeArn: Pulumi.Output.make(""),
+})
+let identityProviderProvisionedRef = ref(false)
+
+let registerIdentityProvider = (resources: identityProviderResources) => {
+  identityProviderRef := resources
+  identityProviderProvisionedRef := true
+}
+
+let identityProvider = () => identityProviderRef.contents
+let identityProviderProvisioned = () => identityProviderProvisionedRef.contents
+
 type sliceModulePaths = {
   specPath: string,
   decisionPath: string,

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -91,6 +91,30 @@ function messagingProvisioned() {
   return messagingProvisionedRef.contents;
 }
 
+let identityProviderRef = {
+  contents: {
+    poolArn: Pulumi.output(""),
+    storeArn: Pulumi.output("")
+  }
+};
+
+let identityProviderProvisionedRef = {
+  contents: false
+};
+
+function registerIdentityProvider(resources) {
+  identityProviderRef.contents = resources;
+  identityProviderProvisionedRef.contents = true;
+}
+
+function identityProvider() {
+  return identityProviderRef.contents;
+}
+
+function identityProviderProvisioned() {
+  return identityProviderProvisionedRef.contents;
+}
+
 let dcbConfigRef = {
   contents: {
     pluginName: "",
@@ -591,6 +615,11 @@ export {
   registerMessagingSender,
   messagingSender,
   messagingProvisioned,
+  identityProviderRef,
+  identityProviderProvisionedRef,
+  registerIdentityProvider,
+  identityProvider,
+  identityProviderProvisioned,
   dcbConfigRef,
   registeredSliceModulePaths,
   registerStateChangeSliceSpec,

package/tests/Auth_ActiveRoleTrigger_OpsTest.res

@@ -171,3 +171,43 @@ describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
     )->toEqual(Some(["arn:aws:iam::1:role/Shopper"]))
   })
 })
+
+// ── The domain id claim ─────────────────────────────────────────────────────
+//
+// Rides on whatever else the mint adds. The regression line above still holds
+// for every account created before the identity store existed, because such an
+// account has no row and so no `userId` arrives here.
+
+describe("Auth_ActiveRoleTrigger_Ops.respond with a domain id", () => {
+  testSync("no stored role and a domain id adds the claim and nothing else", () => {
+    let input = eventFor(~membership=["Admin", "Shopper"])
+    let event = Trigger.respond(~event=input, ~decision=Unchanged, ~userId="u_abc")
+    expect(claimOf(event, ReventlessCore.Auth_UserId.claim))->toEqual(Some("u_abc"))
+    expect(groupsOf(event))->toEqual(None)
+  })
+
+  testSync("narrowing and a domain id carry both", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Admin", "Shopper"]),
+      ~decision=Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}),
+      ~userId="u_abc",
+    )
+    expect(groupsOf(event))->toEqual(Some(["Shopper"]))
+    expect((
+      claimOf(event, Contract.activeRoleClaim),
+      claimOf(event, ReventlessCore.Auth_UserId.claim),
+    ))->toEqual((Some("Shopper"), Some("u_abc")))
+  })
+
+  testSync("no domain id leaves a narrowed token without the claim", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Admin", "Shopper"]),
+      ~decision=Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}),
+    )
+    expect(claimOf(event, ReventlessCore.Auth_UserId.claim))->toEqual(None)
+  })
+
+  testPromise("no identity store configured reads as no row", async () =>
+    expect(await Trigger.userIdFor(~sub="u-carol", ~table=None))->toEqual(None)
+  )
+})

package/tests/Auth_ActiveRoleTrigger_OpsTest.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 import * as Auth_ActiveRoleTrigger_Ops$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs";
 
@@ -43,7 +44,7 @@ globalThis.describe("the conformance table, minted by the trigger", () => {
     let requested = param.requested;
     let membership = param.membership;
     globalThis.test(param.label, () => {
-      let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor(membership, undefined, undefined), Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide(membership, requested));
+      let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor(membership, undefined, undefined), Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide(membership, requested), undefined);
       globalThis.expect(Stdlib_Option.getOr(groupsOf(event), membership)).toEqual(Stdlib_Option.getOr(expected, membership));
     });
   });
@@ -84,7 +85,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
       "Admin",
       "Shopper"
     ], undefined, undefined);
-    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(input, "Unchanged")).toEqual(input);
+    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(input, "Unchanged", undefined)).toEqual(input);
   });
   globalThis.test("narrowing puts the chosen role alone in the group claim", () => {
     let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
@@ -97,7 +98,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
         "Admin",
         "Shopper"
       ]
-    });
+    }, undefined);
     globalThis.expect(groupsOf(event)).toEqual(["Shopper"]);
   });
   globalThis.test("a narrowed token records the choice and what it gave up", () => {
@@ -111,7 +112,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
         "Admin",
         "Shopper"
       ]
-    });
+    }, undefined);
     globalThis.expect([
       claimOf(event, Auth_ActiveRole$ReventlessCore.activeRoleClaim),
       claimOf(event, Auth_ActiveRole$ReventlessCore.availableRolesClaim)
@@ -125,7 +126,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
       TAG: "Stale",
       role: "Admin",
       membership: ["Shopper"]
-    });
+    }, undefined);
     globalThis.expect([
       groupsOf(event),
       claimOf(event, Auth_ActiveRole$ReventlessCore.staleRoleClaim)
@@ -139,7 +140,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
       TAG: "Stale",
       role: "Admin",
       membership: ["Shopper"]
-    });
+    }, undefined);
     globalThis.expect(claimOf(event, Auth_ActiveRole$ReventlessCore.activeRoleClaim)).toEqual(undefined);
   });
   globalThis.test("narrowing carries the caller's IAM roles through untouched", () => {
@@ -153,7 +154,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
         "Admin",
         "Shopper"
       ]
-    });
+    }, undefined);
     let details = Stdlib_Option.flatMap(overrideOf(event), c => c.groupOverrideDetails);
     globalThis.expect([
       Stdlib_Option.map(details, d => d.iamRolesToOverride),
@@ -168,11 +169,61 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
       TAG: "Stale",
       role: "Admin",
       membership: ["Shopper"]
-    });
+    }, undefined);
     globalThis.expect(Stdlib_Option.map(Stdlib_Option.flatMap(overrideOf(event), c => c.groupOverrideDetails), d => d.iamRolesToOverride)).toEqual(["arn:aws:iam::1:role/Shopper"]);
   });
 });
 
+globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond with a domain id", () => {
+  globalThis.test("no stored role and a domain id adds the claim and nothing else", () => {
+    let input = eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined);
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(input, "Unchanged", "u_abc");
+    globalThis.expect(claimOf(event, Auth_UserId$ReventlessCore.claim)).toEqual("u_abc");
+    globalThis.expect(groupsOf(event)).toEqual(undefined);
+  });
+  globalThis.test("narrowing and a domain id carry both", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined), {
+      TAG: "Narrow",
+      role: "Shopper",
+      membership: [
+        "Admin",
+        "Shopper"
+      ]
+    }, "u_abc");
+    globalThis.expect(groupsOf(event)).toEqual(["Shopper"]);
+    globalThis.expect([
+      claimOf(event, Auth_ActiveRole$ReventlessCore.activeRoleClaim),
+      claimOf(event, Auth_UserId$ReventlessCore.claim)
+    ]).toEqual([
+      "Shopper",
+      "u_abc"
+    ]);
+  });
+  globalThis.test("no domain id leaves a narrowed token without the claim", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined), {
+      TAG: "Narrow",
+      role: "Shopper",
+      membership: [
+        "Admin",
+        "Shopper"
+      ]
+    }, undefined);
+    globalThis.expect(claimOf(event, Auth_UserId$ReventlessCore.claim)).toEqual(undefined);
+  });
+  globalThis.test("no identity store configured reads as no row", async () => {
+    globalThis.expect(await Auth_ActiveRoleTrigger_Ops$ReventlessAws.userIdFor("u-carol", undefined)).toEqual(undefined);
+  });
+});
+
 let Trigger;
 
 let Contract;

package/tests/Auth_CognitoTest.res

@@ -186,3 +186,65 @@ describe("Auth_Cognito.fromAppSyncIdentity", () => {
     }
   })
 })
+
+// ── The domain id claim ─────────────────────────────────────────────────────
+//
+// Both arms, on both entry points. The second arm is the one that will look
+// redundant to a later reader and is not: every `@owner` field written before
+// the identity store existed holds a `sub`, and it keeps matching only while a
+// token without the claim produces exactly that `sub`.
+
+describe("Auth_Cognito and the domain id claim", () => {
+  let claimName = ReventlessCore.Auth_UserId.claim
+
+  testAsync("authenticate: a token carrying the claim yields it, not the sub", async () => {
+    let token = buildJwt(
+      Dict.fromArray([
+        ("sub", JSON.Encode.string("c3741234-aaaa")),
+        (claimName, JSON.Encode.string("u_0123")),
+      ]),
+    )
+    switch await Auth_Cognito.authenticate(buildContext([("authorization", "Bearer " ++ token)])) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("u_0123")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testAsync("authenticate: a token without the claim yields exactly the sub", async () => {
+    let token = buildJwt(Dict.fromArray([("sub", JSON.Encode.string("c3741234-aaaa"))]))
+    switch await Auth_Cognito.authenticate(buildContext([("authorization", "Bearer " ++ token)])) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("c3741234-aaaa")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("fromAppSyncIdentity: the claim wins over the sub", () => {
+    let id: Auth_Cognito.appSyncIdentity = {
+      sub: "c3741234-aaaa",
+      claims: Dict.fromArray([(claimName, JSON.Encode.string("u_0123"))]),
+    }
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("u_0123")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("fromAppSyncIdentity: no claim is exactly the sub", () => {
+    let id: Auth_Cognito.appSyncIdentity = {sub: "c3741234-aaaa", claims: Dict.make()}
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("c3741234-aaaa")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("an empty claim is treated as absent", () => {
+    let id: Auth_Cognito.appSyncIdentity = {
+      sub: "c3741234-aaaa",
+      claims: Dict.fromArray([(claimName, JSON.Encode.string(""))]),
+    }
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("c3741234-aaaa")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+})