@reventlessdev/reventless-aws 3.0.0-alpha.396 → 3.0.0-alpha.397

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.397 (2026-10-23)
+
+### Bug Fixes
+
+* **aws:** a supplied pool without an identity store deploys, and its accounts keep their pool id ([49695ef](https://github.com/ReventlessDev/reventless-core/commit/49695ef79de89925c1e718ee9afa9a6ad7abd1f9))
+
+
 # 3.0.0-alpha.396 (2026-10-23)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.396",
+  "version": "3.0.0-alpha.397",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -22,19 +22,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.34",
-    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.35",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.13",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.32",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.33",
+    "@reventlessdev/rescript-effect": "1.0.0-alpha.1",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-web": "1.0.0-alpha.8",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.307",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.204",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.42",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.204",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.171",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.175"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.175",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.307"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res

@@ -64,7 +64,7 @@ let make = (
             ~id=name ++ "Policy",
             ~statements=[
               {
-                sid: "AllowLambdaLogging",
+                PolicyDocument.sid: "AllowLambdaLogging",
                 effect: Allow,
                 actions: Actions([
                   "logs:CreateLogGroup",
@@ -79,13 +79,20 @@ let make = (
                 actions: Action("dynamodb:GetItem"),
                 resources: Resource(tableArn),
               },
-              {
-                sid: "AllowReadingDomainId",
-                effect: Allow,
-                actions: Action("dynamodb:GetItem"),
-                resources: Resource(identityArn),
-              },
-            ],
+            ]->Array.concat(
+              // A supplied pool with no identity store yet: nothing to read, and
+              // an empty resource would make the policy invalid.
+              identityArn == ""
+                ? []
+                : [
+                    {
+                      sid: "AllowReadingDomainId",
+                      effect: Allow,
+                      actions: Action("dynamodb:GetItem"),
+                      resources: Resource(identityArn),
+                    },
+                  ],
+            ),
           )
           ->PolicyDocument.toJsonString
           ->Pulumi.Input.make,

package/src/adapter/Auth/Auth_ActiveRoleTrigger.res.mjs

@@ -19,6 +19,7 @@ function make(activeRoleTableName, activeRoleTableArn, identityTableName, identi
     activeRoleTableArn,
     identityTableArn
   ]).apply(param => {
+    let identityArn = param[1];
     new (Aws.iam.RolePolicy)(name + "Policy", {
       policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "Policy", [
         {
@@ -36,14 +37,13 @@ function make(activeRoleTableName, activeRoleTableArn, identityTableName, identi
           Effect: "Allow",
           Action: "dynamodb:GetItem",
           Resource: param[0]
-        },
-        {
-          Sid: "AllowReadingDomainId",
-          Effect: "Allow",
-          Action: "dynamodb:GetItem",
-          Resource: param[1]
         }
-      ])),
+      ].concat(identityArn === "" ? [] : [{
+            Sid: "AllowReadingDomainId",
+            Effect: "Allow",
+            Action: "dynamodb:GetItem",
+            Resource: identityArn
+          }]))),
       role: lambdaRole.id
     }, opts$1);
   });

package/src/adapter/Auth/Auth_IdentityStore.res

@@ -41,12 +41,51 @@ let makeTable = (
   {name: table.name, arn: table.arn}
 }
 
-/** The store a resolved provider calls for — created or looked up. */
+let log = ReventlessCore.Logger.fromEnv()
+
+/**
+The [ProviderScoped] table if `provision-identity` has created it, else an empty
+name and ARN.
+
+🚨 **Absent is a supported state, not a failed lookup** — unlike the active-role
+store, which a supplied pool has always had. A pool provisioned before this store
+existed has no table, and its deployments must keep deploying: the trigger then
+adds no claim and every account keeps its `sub`, which is exactly what each one
+did before. Running `provision-identity` again creates the table, and the next
+deploy picks it up. A Pulumi `getTable` fails the whole program on a missing
+table, so this asks DynamoDB directly.
+*/
+let lookupTableIfPresent = (~tableName: string): storeTable => {
+  let arn = Pulumi.Output.make(tableName)->Pulumi.Output.flatMap(name =>
+    (
+      async () =>
+        try {
+          let out = await AwsSdk.DynamoDb_DynamoDb.DescribeTableCommand.make({
+            tableName: name,
+          })->AwsSdk.DynamoDb_DynamoDb.DescribeTableCommand.send
+          out.table->Option.flatMap(t => t.tableArn)->Option.getOr("")
+        } catch {
+        | exn if Util_AwsError.isNotFound(exn) =>
+          log.warn(
+            ~comp="IdentityStore",
+            `no identity store "${name}" on this provider — accounts keep their pool id. Run provision-identity to create it.`,
+          )
+          ""
+        }
+    )()->Pulumi.Output.fromPromise
+  )
+  {
+    name: arn->Pulumi.Output.apply(found => found == "" ? "" : tableName),
+    arn,
+  }
+}
+
+/** The store a resolved provider calls for — created, or looked up if present. */
 let resolveTable = (
   ~choice: Auth_ActiveRoleStore.storeChoice,
   ~opts: Pulumi.ComponentResource.options,
 ): storeTable =>
   switch choice {
   | StackScoped => makeTable(~opts)
-  | ProviderScoped(tableName) => Auth_ActiveRoleStore.lookupTable(~tableName)
+  | ProviderScoped(tableName) => lookupTableIfPresent(~tableName)
   }

package/src/adapter/Auth/Auth_IdentityStore.res.mjs

@@ -1,9 +1,16 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as ClientDynamodb from "@aws-sdk/client-dynamodb";
+import * as DynamoDb_DynamoDb$AwsSdk from "@reventlessdev/rescript-aws-sdk/src/DynamoDb_DynamoDb.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_AwsError$ReventlessAws from "../../util/Util_AwsError.res.mjs";
 import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
-import * as Auth_ActiveRoleStore$ReventlessAws from "./Auth_ActiveRoleStore.res.mjs";
 import * as Auth_IdentityStore_Schema$ReventlessAws from "./Auth_IdentityStore_Schema.res.mjs";
 
 function chooseStore(identityProviderId) {
@@ -30,17 +37,49 @@ function makeTable(nameOpt, opts) {
   };
 }
 
+let log = Logger$ReventlessCore.fromEnv();
+
+function lookupTableIfPresent(tableName) {
+  let arn = Output$Pulumi.flatMap(Pulumi.output(tableName), name => (async () => {
+    try {
+      let out = await DynamoDb_DynamoDb$AwsSdk.DescribeTableCommand.send(new ClientDynamodb.DescribeTableCommand({
+        TableName: name
+      }));
+      return Stdlib_Option.getOr(Stdlib_Option.flatMap(out.Table, t => t.TableArn), "");
+    } catch (raw_exn) {
+      let exn = Primitive_exceptions.internalToException(raw_exn);
+      if (Util_AwsError$ReventlessAws.isNotFound(exn)) {
+        log.warn("IdentityStore", undefined, `no identity store "` + name + `" on this provider — accounts keep their pool id. Run provision-identity to create it.`);
+        return "";
+      }
+      throw exn;
+    }
+  })());
+  return {
+    name: arn.apply(found => {
+      if (found === "") {
+        return "";
+      } else {
+        return tableName;
+      }
+    }),
+    arn: arn
+  };
+}
+
 function resolveTable(choice, opts) {
   if (typeof choice !== "object") {
     return makeTable(undefined, opts);
   } else {
-    return Auth_ActiveRoleStore$ReventlessAws.lookupTable(choice._0);
+    return lookupTableIfPresent(choice._0);
   }
 }
 
 export {
   chooseStore,
   makeTable,
+  log,
+  lookupTableIfPresent,
   resolveTable,
 }
-/* AWS_Tags-ReventlessAws Not a pure module */
+/* log Not a pure module */