@reventlessdev/reventless-seed-aws 1.0.0-alpha.2

package/src/ReventlessSeedAws.res

@@ -0,0 +1,316 @@
+// AWS `connect` for the seed harness: resolve a deployed stack, read its
+// endpoints, and log in with Cognito — returning the same provider-agnostic
+// `Seed.connection` a local run produces.
+//
+// Stack discovery reads the sibling Pulumi project's `Pulumi.<stack>.yaml`
+// files (no `pulumi login` needed to list) and calls `pulumi stack output` for
+// the chosen one. Endpoints come from the host-shell `config.json` when the
+// stack publishes a `hostShellUrl` (the hybrid host-shell shape), or from the
+// stack outputs directly otherwise. Login is Cognito USER_PASSWORD_AUTH over a
+// plain `fetch` — the host UI client has no secret, so there is no SigV4 and no
+// AWS SDK dependency.
+
+open ReventlessSeed
+
+// ── Node bindings ─────────────────────────────────────────────────────────────
+
+@val @scope("process") external processEnv: dict<string> = "env"
+
+type execOptions = {cwd: string, encoding: string, env?: dict<string>}
+@module("node:child_process")
+external execFileSync: (string, array<string>, execOptions) => string = "execFileSync"
+
+type fetchInit = {method: string, headers: dict<string>, body?: string}
+type response
+@val external fetch: (string, fetchInit) => promise<response> = "fetch"
+@send external responseJson: response => promise<JSON.t> = "json"
+@get external responseOk: response => bool = "ok"
+@get external responseStatus: response => int = "status"
+
+// ── JSON helpers ──────────────────────────────────────────────────────────────
+
+let field = (json: JSON.t, key: string): option<JSON.t> =>
+  switch json {
+  | Object(obj) => obj->Dict.get(key)
+  | _ => None
+  }
+
+let asString = (json: JSON.t): option<string> =>
+  switch json {
+  | String(s) => Some(s)
+  | _ => None
+  }
+
+// ── Stack discovery ───────────────────────────────────────────────────────────
+
+// Which Pulumi backend the `pulumi` subprocess reads from. When `backend` is
+// set it is passed as `PULUMI_BACKEND_URL` on a *copy* of the environment, so
+// the operator's persistent `pulumi login` is never mutated — each example pins
+// its own backend (core → Pulumi Cloud, a self-hosted app → its S3/… bucket)
+// regardless of which backend the CLI is currently logged into. When absent, the
+// subprocess inherits the ambient login (or an operator-set PULUMI_BACKEND_URL).
+let envForBackend = (backend: option<string>): option<dict<string>> =>
+  switch backend {
+  | None => None
+  | Some(url) =>
+    let copy = processEnv->Dict.toArray->Dict.fromArray
+    copy->Dict.set("PULUMI_BACKEND_URL", url)
+    Some(copy)
+  }
+
+let pulumi = (~projectDir: string, ~backend: option<string>, args: array<string>): string =>
+  execFileSync("pulumi", args, {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)})
+
+// Stacks that actually exist in the Pulumi backend for this project — the names
+// `pulumi stack output --stack <name>` accepts. A `Pulumi.<stack>.yaml` config
+// file alone is NOT a deployed stack, so discovery must ask the backend (via
+// `pulumi stack ls`), not the filesystem — otherwise it offers phantom stacks
+// that fail with "no stack named …". Empty on any error (pulumi missing / not
+// logged in / no stacks), which `resolveStack` reports as "none found".
+let deployedStacks = (~projectDir: string, ~backend: option<string>): array<string> =>
+  try {
+    switch JSON.parseOrThrow(pulumi(~projectDir, ~backend, ["stack", "ls", "--json"])) {
+    | JSON.Array(items) => items->Array.filterMap(it => it->field("name")->Option.flatMap(asString))
+    | _ => []
+    }
+  } catch {
+  | _ => []
+  }
+
+let stackOutputs = (~projectDir: string, ~backend: option<string>, stack: string): JSON.t => {
+  let raw = try pulumi(~projectDir, ~backend, ["stack", "output", "--stack", stack, "--json"]) catch {
+  | _ =>
+    throw(
+      Seed.Failed(
+        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++
+        "and the stack deployed?",
+      ),
+    )
+  }
+  try JSON.parseOrThrow(raw) catch {
+  | _ => throw(Seed.Failed(`could not parse pulumi stack output for "${stack}"`))
+  }
+}
+
+let backendNote = (~backend: option<string>): string =>
+  switch backend {
+  | Some(url) => ` (backend: ${url})`
+  | None => ""
+  }
+
+let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack: option<string>): string =>
+  switch stack {
+  | Some(s) => s
+  | None =>
+    switch Seed.Prompt.envValue("SEED_STACK") {
+    | Some(s) => s
+    | None =>
+      let stacks = deployedStacks(~projectDir, ~backend)
+      if stacks->Array.length == 0 {
+        throw(
+          Seed.Failed(
+            `no deployed Pulumi stacks for this project (\`pulumi stack ls\` is empty in ${projectDir})${backendNote(
+                ~backend,
+              )}. ` ++
+            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++
+            "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
+          ),
+        )
+      }
+      await Seed.Prompt.select(~title="Stack:", ~options=stacks->Array.map(s => (s, s)))
+    }
+  }
+
+// ── Endpoints ─────────────────────────────────────────────────────────────────
+
+let fetchConfig = async (hostShellUrl: string): JSON.t => {
+  let base = hostShellUrl->String.replaceRegExp(%re("/\/+$/g"), "")
+  let url = `${base}/config.json`
+  let res = try await fetch(url, {method: "GET", headers: Dict.make()}) catch {
+  | _ => throw(Seed.Failed(`cannot reach ${url}`))
+  }
+  if !(res->responseOk) {
+    throw(Seed.Failed(`GET ${url} → HTTP ${(res->responseStatus)->Int.toString}`))
+  }
+  await res->responseJson
+}
+
+// Prefer an explicit env override, else the discovered value, else fail naming
+// what is missing.
+let resolveField = (~envKey: string, ~fromSource: option<string>, ~human: string): string =>
+  switch Seed.Prompt.envValue(envKey) {
+  | Some(v) => v
+  | None =>
+    switch fromSource {
+    | Some(v) => v
+    | None => throw(Seed.Failed(`deployment is missing ${human} (and ${envKey} is unset)`))
+    }
+  }
+
+// Returns (graphqlEndpoint, uploadEndpoint, cognitoRegion, cognitoClientId).
+// `uploadEndpoint` is "" when the deployment publishes none — the data set's
+// upload phase no-ops on empty.
+let resolveEndpoints = async (~projectDir: string, ~backend: option<string>, ~stack: string): (
+  string,
+  string,
+  string,
+  string,
+) => {
+  let outputs = stackOutputs(~projectDir, ~backend, stack)
+  switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
+  | Some(hostShellUrl) =>
+    let cfg = await fetchConfig(hostShellUrl)
+    let fromCfg = key => cfg->field(key)->Option.flatMap(asString)
+    let endpoint = resolveField(
+      ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
+      ~fromSource=fromCfg("apiEndpoint"),
+      ~human="apiEndpoint",
+    )
+    let uploadEndpoint = resolveField(
+      ~envKey="REVENTLESS_UPLOAD_ENDPOINT",
+      ~fromSource=fromCfg("uploadEndpoint"),
+      ~human="uploadEndpoint",
+    )
+    let region = resolveField(
+      ~envKey="AWS_REGION",
+      ~fromSource=fromCfg("region"),
+      ~human="region",
+    )
+    let clientId = resolveField(
+      ~envKey="COGNITO_CLIENT_ID",
+      ~fromSource=fromCfg("cognitoClientId"),
+      ~human="cognitoClientId",
+    )
+    (endpoint, uploadEndpoint, region, clientId)
+  | None =>
+    let out = key => outputs->field(key)->Option.flatMap(asString)
+    let endpoint = switch (
+      Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
+      out("domainMergedApiEndpoint"),
+      out("domainApiEndpoint"),
+    ) {
+    | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
+    | _ =>
+      throw(
+        Seed.Failed(
+          `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
+        ),
+      )
+    }
+    let region = resolveField(
+      ~envKey="AWS_REGION",
+      ~fromSource=out("cognitoRegion"),
+      ~human="cognitoRegion",
+    )
+    let clientId = resolveField(
+      ~envKey="COGNITO_CLIENT_ID",
+      ~fromSource=out("cognitoUserPoolClientId"),
+      ~human="cognitoUserPoolClientId",
+    )
+    // Absent → "" → the data set skips its upload phase.
+    let uploadEndpoint = Seed.Prompt.envValue("REVENTLESS_UPLOAD_ENDPOINT")->Option.getOr("")
+    (endpoint, uploadEndpoint, region, clientId)
+  }
+}
+
+// ── Cognito login ─────────────────────────────────────────────────────────────
+
+let cognito = (~region: string, ~clientId: string) => async (
+  ~username: string,
+  ~password: string,
+): string => {
+  let body = JSON.stringify(
+    JSON.Encode.object(
+      Dict.fromArray([
+        ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
+        ("ClientId", JSON.Encode.string(clientId)),
+        (
+          "AuthParameters",
+          JSON.Encode.object(
+            Dict.fromArray([
+              ("USERNAME", JSON.Encode.string(username)),
+              ("PASSWORD", JSON.Encode.string(password)),
+            ]),
+          ),
+        ),
+      ]),
+    ),
+  )
+  let headers = Dict.fromArray([
+    ("content-type", "application/x-amz-json-1.1"),
+    ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
+  ])
+  let res = try await fetch(`https://cognito-idp.${region}.amazonaws.com/`, {
+    method: "POST",
+    headers,
+    body,
+  }) catch {
+  | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
+  }
+  let json = await res->responseJson
+  if !(res->responseOk) {
+    let detail =
+      json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
+    throw(
+      Seed.Failed(
+        `Cognito InitiateAuth failed (HTTP ${(res->responseStatus)->Int.toString}): ${detail}`,
+      ),
+    )
+  }
+  switch json->field("ChallengeName")->Option.flatMap(asString) {
+  | Some(challenge) =>
+    throw(
+      Seed.Failed(
+        `Cognito returned challenge ${challenge} — set a permanent password first ` ++
+        "(aws cognito-idp admin-set-user-password … --permanent).",
+      ),
+    )
+  | None => ()
+  }
+  switch json
+  ->field("AuthenticationResult")
+  ->Option.flatMap(ar => ar->field("IdToken"))
+  ->Option.flatMap(asString) {
+  | Some(token) => token
+  | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
+  }
+}
+
+// ── connect ───────────────────────────────────────────────────────────────────
+
+/**
+ * A `connect` thunk for a deployed AWS stack, ready to pass to `Seed.Runner.seed`.
+ *
+ * `projectDir` is where the Pulumi stacks live (relative to the seed's cwd);
+ * `stack` fixes the stack, else `SEED_STACK` or a menu chooses it. Resolves the
+ * endpoints, then prompts credentials and mints a Cognito id token.
+ *
+ * `backend` pins the Pulumi backend the stack lives in — Pulumi Cloud
+ * (`https://api.pulumi.com`, needs `PULUMI_ACCESS_TOKEN`) for a CI-deployed
+ * example, or a self-hosted store (`s3://…?region=…`, needs AWS creds) for a
+ * self-hosted app. It is passed to the pulumi subprocess as `PULUMI_BACKEND_URL`
+ * on a copy of the environment, so the operator's persistent `pulumi login` is
+ * untouched and each example seeds its own backend regardless of the current
+ * login. `SEED_PULUMI_BACKEND` overrides it; omit both to use the ambient login.
+ */
+let connect = (~projectDir: string=".", ~stack=?, ~backend=?, ()): (
+  unit => promise<Seed.connection>
+) =>
+  async () => {
+    let backend = switch Seed.Prompt.envValue("SEED_PULUMI_BACKEND") {
+    | Some(url) => Some(url)
+    | None => backend
+    }
+    let stackName = await resolveStack(~projectDir, ~backend, ~stack)
+    let (endpoint, uploadEndpoint, region, clientId) = await resolveEndpoints(
+      ~projectDir,
+      ~backend,
+      ~stack=stackName,
+    )
+    await Seed.Connect.make(
+      ~label=stackName,
+      ~endpoint,
+      ~uploadEndpoint,
+      ~login=cognito(~region, ~clientId),
+    )
+  }

package/src/ReventlessSeedAws.res.mjs

@@ -0,0 +1,305 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Nodechild_process from "node:child_process";
+import * as Seed$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed.res.mjs";
+import * as Seed_Prompt$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Prompt.res.mjs";
+import * as Seed_Connect$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Connect.res.mjs";
+
+function field(json, key) {
+  if (typeof json === "object" && json !== null && !Array.isArray(json)) {
+    return json[key];
+  }
+}
+
+function asString(json) {
+  if (typeof json === "string") {
+    return json;
+  }
+}
+
+function envForBackend(backend) {
+  if (backend === undefined) {
+    return;
+  }
+  let copy = Object.fromEntries(Object.entries(process.env));
+  copy["PULUMI_BACKEND_URL"] = backend;
+  return copy;
+}
+
+function pulumi(projectDir, backend, args) {
+  return Nodechild_process.execFileSync("pulumi", args, {
+    cwd: projectDir,
+    encoding: "utf8",
+    env: envForBackend(backend)
+  });
+}
+
+function deployedStacks(projectDir, backend) {
+  try {
+    let items = JSON.parse(pulumi(projectDir, backend, [
+      "stack",
+      "ls",
+      "--json"
+    ]));
+    if (Array.isArray(items)) {
+      return Stdlib_Array.filterMap(items, it => Stdlib_Option.flatMap(field(it, "name"), asString));
+    } else {
+      return [];
+    }
+  } catch (exn) {
+    return [];
+  }
+}
+
+function stackOutputs(projectDir, backend, stack) {
+  let raw;
+  try {
+    raw = pulumi(projectDir, backend, [
+      "stack",
+      "output",
+      "--stack",
+      stack,
+      "--json"
+    ]);
+  } catch (exn) {
+    throw {
+      RE_EXN_ID: Seed$ReventlessSeed.Failed,
+      _1: `pulumi stack output --stack ` + stack + ` failed — is pulumi installed, logged in, ` + "and the stack deployed?",
+      Error: new Error()
+    };
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (exn$1) {
+    throw {
+      RE_EXN_ID: Seed$ReventlessSeed.Failed,
+      _1: `could not parse pulumi stack output for "` + stack + `"`,
+      Error: new Error()
+    };
+  }
+}
+
+function backendNote(backend) {
+  if (backend !== undefined) {
+    return ` (backend: ` + backend + `)`;
+  } else {
+    return "";
+  }
+}
+
+async function resolveStack(projectDir, backend, stack) {
+  if (stack !== undefined) {
+    return stack;
+  }
+  let s = Seed_Prompt$ReventlessSeed.envValue("SEED_STACK");
+  if (s !== undefined) {
+    return s;
+  }
+  let stacks = deployedStacks(projectDir, backend);
+  if (stacks.length === 0) {
+    throw {
+      RE_EXN_ID: Seed$ReventlessSeed.Failed,
+      _1: `no deployed Pulumi stacks for this project (\`pulumi stack ls\` is empty in ` + projectDir + `)` + backendNote(backend) + `. ` + "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
+      Error: new Error()
+    };
+  }
+  return await Seed_Prompt$ReventlessSeed.select("Stack:", stacks.map(s => [
+    s,
+    s
+  ]), undefined);
+}
+
+async function fetchConfig(hostShellUrl) {
+  let base = hostShellUrl.replace(/\/+$/g, "");
+  let url = base + `/config.json`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "GET",
+      headers: {}
+    });
+  } catch (exn) {
+    throw {
+      RE_EXN_ID: Seed$ReventlessSeed.Failed,
+      _1: `cannot reach ` + url,
+      Error: new Error()
+    };
+  }
+  if (!res.ok) {
+    throw {
+      RE_EXN_ID: Seed$ReventlessSeed.Failed,
+      _1: `GET ` + url + ` → HTTP ` + res.status.toString(),
+      Error: new Error()
+    };
+  }
+  return await res.json();
+}
+
+function resolveField(envKey, fromSource, human) {
+  let v = Seed_Prompt$ReventlessSeed.envValue(envKey);
+  if (v !== undefined) {
+    return v;
+  }
+  if (fromSource !== undefined) {
+    return fromSource;
+  }
+  throw {
+    RE_EXN_ID: Seed$ReventlessSeed.Failed,
+    _1: `deployment is missing ` + human + ` (and ` + envKey + ` is unset)`,
+    Error: new Error()
+  };
+}
+
+async function resolveEndpoints(projectDir, backend, stack) {
+  let outputs = stackOutputs(projectDir, backend, stack);
+  let hostShellUrl = Stdlib_Option.flatMap(field(outputs, "hostShellUrl"), asString);
+  if (hostShellUrl !== undefined) {
+    let cfg = await fetchConfig(hostShellUrl);
+    let fromCfg = key => Stdlib_Option.flatMap(field(cfg, key), asString);
+    let endpoint = resolveField("REVENTLESS_GRAPHQL_ENDPOINT", fromCfg("apiEndpoint"), "apiEndpoint");
+    let uploadEndpoint = resolveField("REVENTLESS_UPLOAD_ENDPOINT", fromCfg("uploadEndpoint"), "uploadEndpoint");
+    let region = resolveField("AWS_REGION", fromCfg("region"), "region");
+    let clientId = resolveField("COGNITO_CLIENT_ID", fromCfg("cognitoClientId"), "cognitoClientId");
+    return [
+      endpoint,
+      uploadEndpoint,
+      region,
+      clientId
+    ];
+  }
+  let out = key => Stdlib_Option.flatMap(field(outputs, key), asString);
+  let match = Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_GRAPHQL_ENDPOINT");
+  let match$1 = out("domainMergedApiEndpoint");
+  let match$2 = out("domainApiEndpoint");
+  let endpoint$1;
+  if (match !== undefined) {
+    endpoint$1 = match;
+  } else if (match$1 !== undefined) {
+    endpoint$1 = match$1;
+  } else if (match$2 !== undefined) {
+    endpoint$1 = match$2;
+  } else {
+    throw {
+      RE_EXN_ID: Seed$ReventlessSeed.Failed,
+      _1: `stack "` + stack + `" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
+      Error: new Error()
+    };
+  }
+  let region$1 = resolveField("AWS_REGION", out("cognitoRegion"), "cognitoRegion");
+  let clientId$1 = resolveField("COGNITO_CLIENT_ID", out("cognitoUserPoolClientId"), "cognitoUserPoolClientId");
+  let uploadEndpoint$1 = Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_UPLOAD_ENDPOINT"), "");
+  return [
+    endpoint$1,
+    uploadEndpoint$1,
+    region$1,
+    clientId$1
+  ];
+}
+
+function cognito(region, clientId) {
+  return async (username, password) => {
+    let body = JSON.stringify(Object.fromEntries([
+      [
+        "AuthFlow",
+        "USER_PASSWORD_AUTH"
+      ],
+      [
+        "ClientId",
+        clientId
+      ],
+      [
+        "AuthParameters",
+        Object.fromEntries([
+          [
+            "USERNAME",
+            username
+          ],
+          [
+            "PASSWORD",
+            password
+          ]
+        ])
+      ]
+    ]));
+    let headers = Object.fromEntries([
+      [
+        "content-type",
+        "application/x-amz-json-1.1"
+      ],
+      [
+        "x-amz-target",
+        "AWSCognitoIdentityProviderService.InitiateAuth"
+      ]
+    ]);
+    let res;
+    try {
+      res = await fetch(`https://cognito-idp.` + region + `.amazonaws.com/`, {
+        method: "POST",
+        headers: headers,
+        body: body
+      });
+    } catch (exn) {
+      throw {
+        RE_EXN_ID: Seed$ReventlessSeed.Failed,
+        _1: `cannot reach Cognito in ` + region,
+        Error: new Error()
+      };
+    }
+    let json = await res.json();
+    if (!res.ok) {
+      let detail = Stdlib_Option.getOr(Stdlib_Option.flatMap(field(json, "message"), asString), JSON.stringify(json));
+      throw {
+        RE_EXN_ID: Seed$ReventlessSeed.Failed,
+        _1: `Cognito InitiateAuth failed (HTTP ` + res.status.toString() + `): ` + detail,
+        Error: new Error()
+      };
+    }
+    let challenge = Stdlib_Option.flatMap(field(json, "ChallengeName"), asString);
+    if (challenge !== undefined) {
+      throw {
+        RE_EXN_ID: Seed$ReventlessSeed.Failed,
+        _1: `Cognito returned challenge ` + challenge + ` — set a permanent password first ` + "(aws cognito-idp admin-set-user-password … --permanent).",
+        Error: new Error()
+      };
+    }
+    let token = Stdlib_Option.flatMap(Stdlib_Option.flatMap(field(json, "AuthenticationResult"), ar => field(ar, "IdToken")), asString);
+    if (token !== undefined) {
+      return token;
+    }
+    throw {
+      RE_EXN_ID: Seed$ReventlessSeed.Failed,
+      _1: `Cognito response carried no IdToken: ` + JSON.stringify(json),
+      Error: new Error()
+    };
+  };
+}
+
+function connect($staropt$star, stack, backend, param) {
+  return async () => {
+    let projectDir = $staropt$star !== undefined ? $staropt$star : ".";
+    let url = Seed_Prompt$ReventlessSeed.envValue("SEED_PULUMI_BACKEND");
+    let backend$1 = url !== undefined ? url : backend;
+    let stackName = await resolveStack(projectDir, backend$1, stack);
+    let match = await resolveEndpoints(projectDir, backend$1, stackName);
+    return await Seed_Connect$ReventlessSeed.make(stackName, match[0], match[1], cognito(match[2], match[3]), undefined);
+  };
+}
+
+export {
+  field,
+  asString,
+  envForBackend,
+  pulumi,
+  deployedStacks,
+  stackOutputs,
+  backendNote,
+  resolveStack,
+  fetchConfig,
+  resolveField,
+  resolveEndpoints,
+  cognito,
+  connect,
+}
+/* node:child_process Not a pure module */