@venturekit/infra 0.0.38 → 0.0.40

package/dist/cdk/app-stack.d.ts

@@ -331,8 +331,24 @@ export interface VentureAppStackProps extends cdk.StackProps {
  * declare only data + messaging.
  */
 export declare class VentureAppStack extends cdk.Stack {
-    /** Shared execution role for every Lambda in this stack. */
+    /**
+     * Shared execution role for every Lambda in this stack — except, when
+     * an auth intent declares `adminRoutes`, the Lambdas that match: those
+     * run as {@link authAdminRole}. This role then carries NO Cognito
+     * admin grants.
+     */
     readonly lambdaRole: iam.Role;
+    /**
+     * Execution role carrying the Cognito admin grants
+     * (`AdminCreateUser`, `AdminSetUserPassword`, …) plus everything
+     * {@link lambdaRole} has. Created only when at least one auth intent
+     * declares `adminRoutes`; attached to the route / function Lambdas
+     * those patterns select. Undefined otherwise — the historical
+     * single-role layout, where the shared role holds the admin grants.
+     */
+    readonly authAdminRole?: iam.Role;
+    /** `adminRoutes` patterns collected across every auth intent. */
+    private readonly adminRoutePatterns;
     /** Shared SG when a VPC is imported; undefined for VPC-less projects. */
     readonly lambdaSecurityGroup?: ec2.SecurityGroup;
     /** Internal HMAC signing secret for Lambda-to-Lambda `invoke()`. */
@@ -453,12 +469,31 @@ export declare class VentureAppStack extends cdk.Stack {
      * cross-stack pattern works the same as in-stack.
      */
     private createRouteFunction;
+    /**
+     * Every execution role in this stack: the shared role, plus the
+     * auth-admin role when one exists. Baseline grants (secrets, S3,
+     * SES, rate-limit table, …) are applied to all of them.
+     */
+    private get executionRoles();
+    /**
+     * Roles that receive the Cognito admin grants: only the auth-admin
+     * role when `adminRoutes` are declared, otherwise the shared role
+     * (historical layout).
+     */
+    private get cognitoAdminRoles();
+    /** Apply one grant to every execution role. */
+    private grantEachRole;
+    /** The role a route Lambda runs as — auth-admin when its API path matches `adminRoutes`. */
+    private roleForRoute;
+    /** The role a standalone / queue / schedule Lambda runs as — auth-admin when `fn:<id>` matches. */
+    private roleForFunction;
     /**
      * Build a Lambda function with the standard app-stack properties
      * (shared role, VPC attachment, base env vars, log retention).
      * Used by `createRouteFunction` (now refactored), `createQueueConsumer`,
      * and `createScheduleHandler` to keep the per-Lambda invariants in
-     * one place.
+     * one place. Pass `role` in `overrides` (see `roleForFunction`) to
+     * run as the auth-admin role.
      */
     private buildLambda;
     /**

package/dist/cdk/app-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/app-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAKH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AAQjD,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAM7D,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAmB1B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AA6CzC;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAEf;;;;OAIG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC;IAE5B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C,sDAAsD;IACtD,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,8BAA8B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErD,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7C,mEAAmE;IACnE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvC,wDAAwD;IACxD,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhD,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtD,6EAA6E;IAC7E,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhD;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExD;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErC;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD,+CAA+C;IAC/C,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,GAAG,CACzB,MAAM,EACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CACjE,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,CAAC,EAAE,GAAG,CAC3B,MAAM,EACN;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAC1C,CAAC;CACH;AAED,MAAM,WAAW,oBAAqB,SAAQ,GAAG,CAAC,UAAU;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IAErB,4EAA4E;IAC5E,cAAc,EAAE,aAAa,CAAC;IAE9B,yEAAyE;IACzE,OAAO,EAAE,eAAe,CAAC;IAEzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,eAAgB,SAAQ,GAAG,CAAC,KAAK;IAC5C,4DAA4D;IAC5D,SAAgB,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;IAErC,yEAAyE;IACzE,SAAgB,mBAAmB,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC;IAExD,oEAAoE;IACpE,SAAgB,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC;IAE1D;;;;;;OAMG;IACH,SAAgB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpD,mEAAmE;IACnE,SAAgB,GAAG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC;IAE5C,kCAAkC;IAClC,SAAgB,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAE/B;;;;;;OAMG;IACH,SAAgB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAEvE,oDAAoD;IACpD,SAAgB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAEvE,sDAAsD;IACtD,SAAgB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE1E,wEAAwE;IACxE,SAAgB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE1E,2DAA2D;IAC3D,SAAgB,uBAAuB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAElF,+DAA+D;IAC/D,SAAgB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE9E;;;;;OAKG;IACH,SAAgB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAEhD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAE/B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAkC;IACtE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAGjC;IAEJ;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAK;IAEnD;;;OAGG;IACH,OAAO,CAAC,uBAAuB;gBAanB,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;IAyvBrE;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAwG3B;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IAgDnB;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,qBAAqB;IAsD7B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,wBAAwB;IAyBhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,wBAAwB;IAqChC;;;;;;;;;OASG;IACH,OAAO,CAAC,eAAe;IA8DvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,gBAAgB;IA2DxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAW/B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,mBAAmB;IAwN3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uBAAuB;CAsKhC"}
+{"version":3,"file":"app-stack.d.ts","sourceRoot":"","sources":["../../src/cdk/app-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAKH,OAAO,KAAK,GAAG,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AAQjD,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAC;AAM7D,OAAO,KAAK,cAAc,MAAM,gCAAgC,CAAC;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAoB1B,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,iCAAiC,CAAC;AA6CzC;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAEf;;;;OAIG;IACH,GAAG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC;IAE5B;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C,sDAAsD;IACtD,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,8BAA8B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErD,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7C,mEAAmE;IACnE,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvC,wDAAwD;IACxD,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhD,oEAAoE;IACpE,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C,uDAAuD;IACvD,+BAA+B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEtD,6EAA6E;IAC7E,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhD;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExD;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE5C;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErC;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElD,+CAA+C;IAC/C,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,GAAG,CACzB,MAAM,EACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CACjE,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,CAAC,EAAE,GAAG,CAC3B,MAAM,EACN;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAC1C,CAAC;CACH;AAED,MAAM,WAAW,oBAAqB,SAAQ,GAAG,CAAC,UAAU;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,SAAS,CAAC;IAErB,4EAA4E;IAC5E,cAAc,EAAE,aAAa,CAAC;IAE9B,yEAAyE;IACzE,OAAO,EAAE,eAAe,CAAC;IAEzB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,eAAgB,SAAQ,GAAG,CAAC,KAAK;IAC5C;;;;;OAKG;IACH,SAAgB,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC;IAErC;;;;;;;OAOG;IACH,SAAgB,aAAa,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAEzC,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAoB;IAEvD,yEAAyE;IACzE,SAAgB,mBAAmB,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC;IAExD,oEAAoE;IACpE,SAAgB,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAC;IAE1D;;;;;;OAMG;IACH,SAAgB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEpD,mEAAmE;IACnE,SAAgB,GAAG,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC;IAE5C,kCAAkC;IAClC,SAAgB,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC;IAE/B;;;;;;OAMG;IACH,SAAgB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAEvE,oDAAoD;IACpD,SAAgB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAEvE,sDAAsD;IACtD,SAAgB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE1E,wEAAwE;IACxE,SAAgB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE1E,2DAA2D;IAC3D,SAAgB,uBAAuB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAElF,+DAA+D;IAC/D,SAAgB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAa;IAE9E;;;;;OAKG;IACH,SAAgB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAEhD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAE/B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAkC;IACtE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAEhD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAEpC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAGjC;IAEJ;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAK;IAEnD;;;OAGG;IACH,OAAO,CAAC,uBAAuB;gBAanB,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;IAmyBrE;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAwG3B;;;;OAIG;IACH,OAAO,KAAK,cAAc,GAEzB;IAED;;;;OAIG;IACH,OAAO,KAAK,iBAAiB,GAE5B;IAED,+CAA+C;IAC/C,OAAO,CAAC,aAAa;IAIrB,4FAA4F;IAC5F,OAAO,CAAC,YAAY;IAOpB,mGAAmG;IACnG,OAAO,CAAC,eAAe;IAOvB;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW;IAgDnB;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAkD3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,qBAAqB;IAuD7B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,wBAAwB;IAqChC;;;;;;;;;OASG;IACH,OAAO,CAAC,eAAe;IA8DvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,OAAO,CAAC,gBAAgB;IA2DxB;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAW/B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,mBAAmB;IAyP3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,uBAAuB;CAsKhC"}

package/dist/cdk/app-stack.js

@@ -87,6 +87,7 @@ import * as cloudwatchActions from 'aws-cdk-lib/aws-cloudwatch-actions';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import * as logs from 'aws-cdk-lib/aws-logs';
 import { DATA_SAFETY_CONFIG, isExternalAuthIntent, } from '@venturekit/core';
+import { collectAdminRoutePatterns, matchesAdminRoute } from './shared/admin-routes.js';
 import { readSsmString } from './shared/cross-stack-refs.js';
 import { grantCustomSenderInvoke, resolveCustomSender } from './shared/custom-sender.js';
 import { networkKeys, edgeKeys, identityKeys } from './shared/ssm-keys.js';
@@ -151,8 +152,24 @@ function fnv1a32(input) {
  * declare only data + messaging.
  */
 export class VentureAppStack extends cdk.Stack {
-    /** Shared execution role for every Lambda in this stack. */
+    /**
+     * Shared execution role for every Lambda in this stack — except, when
+     * an auth intent declares `adminRoutes`, the Lambdas that match: those
+     * run as {@link authAdminRole}. This role then carries NO Cognito
+     * admin grants.
+     */
     lambdaRole;
+    /**
+     * Execution role carrying the Cognito admin grants
+     * (`AdminCreateUser`, `AdminSetUserPassword`, …) plus everything
+     * {@link lambdaRole} has. Created only when at least one auth intent
+     * declares `adminRoutes`; attached to the route / function Lambdas
+     * those patterns select. Undefined otherwise — the historical
+     * single-role layout, where the shared role holds the admin grants.
+     */
+    authAdminRole;
+    /** `adminRoutes` patterns collected across every auth intent. */
+    adminRoutePatterns;
     /** Shared SG when a VPC is imported; undefined for VPC-less projects. */
     lambdaSecurityGroup;
     /** Internal HMAC signing secret for Lambda-to-Lambda `invoke()`. */
@@ -307,11 +324,38 @@ export class VentureAppStack extends cdk.Stack {
                 iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
             ],
         });
+        // ─── Auth-admin execution role (opt-in) ────────────────────
+        // Cognito admin actions (create users, set passwords, edit
+        // attributes) are the most powerful grants any route Lambda gets.
+        // On the single shared role, an SSRF / RCE in ANY public route
+        // yields them. When an auth intent names the Lambdas that need them
+        // (`adminRoutes`), they move to this second role and the shared
+        // role keeps everything else. Two roles, not one per Lambda —
+        // CFN's 500-resource limit on large projects is the reason the
+        // per-function layout was never adopted.
+        this.adminRoutePatterns = collectAdminRoutePatterns(infrastructure.auth ?? []);
+        if (this.adminRoutePatterns.length > 0) {
+            this.authAdminRole = new iam.Role(this, 'AuthAdminRole', {
+                assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
+                description: `Execution role for ${projectName}-${stage} Lambdas allowed to call Cognito admin APIs (auth[].adminRoutes)`,
+                managedPolicies: [
+                    iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole'),
+                ],
+            });
+        }
+        else if ((infrastructure.auth ?? []).length > 0) {
+            cdk.Annotations.of(this).addWarning(`[venturekit] auth intents declare no 'adminRoutes': every Lambda in ${projectName}/${stage} ` +
+                `shares one role that can create users, set passwords and edit attributes on the user pool. ` +
+                `List the routes that call @venturekit/auth/server admin flows (e.g. adminRoutes: ['/auth/**']) ` +
+                `to confine those grants to them.`);
+        }
         if (this.vpc) {
             // VPC-attached Lambdas need ENI-creation rights on cold start.
             // Bolted on conditionally so VPC-less projects don't carry the
             // unused managed policy.
-            this.lambdaRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'));
+            for (const role of this.executionRoles) {
+                role.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'));
+            }
             this.lambdaSecurityGroup = new ec2.SecurityGroup(this, 'LambdaSg', {
                 vpc: this.vpc,
                 description: `Shared SG for ${projectName}-${stage} Lambdas`,
@@ -404,10 +448,21 @@ export class VentureAppStack extends cdk.Stack {
             // UpdateItem is denied at runtime and every rate-limited route
             // fails closed.
             VENTURE_RATE_LIMIT_TABLE: `${projectName}-rate-limits-${stage}`,
-            // Inline value, not ARN. Lambdas read it directly from
-            // env without hitting Secrets Manager — zero cold-start cost
-            // for HMAC verification.
-            VENTURE_INTERNAL_HMAC_SECRET: this.internalHmacSecret.secretValue.unsafeUnwrap(),
+            // ARN, not the inline value. `@venturekit/runtime` fetches the
+            // key once per container (`primeInternalHmacSecret`) and caches
+            // it in memory — one Secrets Manager call per cold start, same
+            // as the DB credentials. Inlining the value (the former
+            // `secretValue.unsafeUnwrap()`) put the signing key in every
+            // function's environment block, readable by anyone with
+            // `lambda:GetFunctionConfiguration`. The matching
+            // `secretsmanager:GetSecretValue` grant is in applyImportedGrants.
+            VENTURE_INTERNAL_HMAC_SECRET_ARN: this.internalHmacSecret.secretArn,
+            // The runtime tables the data stack always provisions, named by
+            // the same `${project}-<suffix>-${stage}` convention the runtime
+            // reconstructs when the env var is absent. Injected explicitly so
+            // resolution never depends on the fallback.
+            VENTURE_IDEMPOTENCY_TABLE: `${projectName}-idempotency-${stage}`,
+            VENTURE_SAGA_TABLE: `${projectName}-sagas-${stage}`,
             // `--enable-source-maps` makes thrown errors point to the
             // .ts source instead of bundled .js. Free win in CloudWatch.
             NODE_OPTIONS: '--enable-source-maps',
@@ -1013,7 +1068,7 @@ export class VentureAppStack extends cdk.Stack {
                 ? lambda.Tracing.ACTIVE
                 : lambda.Tracing.DISABLED,
             reservedConcurrentExecutions: lambdaConfig.reservedConcurrency,
-            role: this.lambdaRole,
+            role: this.roleForRoute(route.apiPath),
             // Attach to the VPC iff one exists. Route Lambdas without a VPC
             // can't reach RDS, but the free preset and DB-less projects
             // don't need one — paying ENI cold-start tax there would be
@@ -1043,12 +1098,48 @@ export class VentureAppStack extends cdk.Stack {
             integration: new apigatewayv2Integrations.HttpLambdaIntegration(`${resourceId}-integration`, fn),
         });
     }
+    /**
+     * Every execution role in this stack: the shared role, plus the
+     * auth-admin role when one exists. Baseline grants (secrets, S3,
+     * SES, rate-limit table, …) are applied to all of them.
+     */
+    get executionRoles() {
+        return this.authAdminRole ? [this.lambdaRole, this.authAdminRole] : [this.lambdaRole];
+    }
+    /**
+     * Roles that receive the Cognito admin grants: only the auth-admin
+     * role when `adminRoutes` are declared, otherwise the shared role
+     * (historical layout).
+     */
+    get cognitoAdminRoles() {
+        return this.authAdminRole ? [this.authAdminRole] : [this.lambdaRole];
+    }
+    /** Apply one grant to every execution role. */
+    grantEachRole(grant) {
+        for (const role of this.executionRoles)
+            grant(role);
+    }
+    /** The role a route Lambda runs as — auth-admin when its API path matches `adminRoutes`. */
+    roleForRoute(apiPath) {
+        if (this.authAdminRole && matchesAdminRoute(this.adminRoutePatterns, { apiPath })) {
+            return this.authAdminRole;
+        }
+        return this.lambdaRole;
+    }
+    /** The role a standalone / queue / schedule Lambda runs as — auth-admin when `fn:<id>` matches. */
+    roleForFunction(id) {
+        if (this.authAdminRole && matchesAdminRoute(this.adminRoutePatterns, { functionId: id })) {
+            return this.authAdminRole;
+        }
+        return this.lambdaRole;
+    }
     /**
      * Build a Lambda function with the standard app-stack properties
      * (shared role, VPC attachment, base env vars, log retention).
      * Used by `createRouteFunction` (now refactored), `createQueueConsumer`,
      * and `createScheduleHandler` to keep the per-Lambda invariants in
-     * one place.
+     * one place. Pass `role` in `overrides` (see `roleForFunction`) to
+     * run as the auth-admin role.
      */
     buildLambda(resourceId, functionName, handlerFile, description, overrides) {
         const lambdaConfig = this.envConfig.lambda;
@@ -1114,6 +1205,7 @@ export class VentureAppStack extends cdk.Stack {
         const fn = this.buildLambda(resourceId, functionName, handlerFile, intent?.description ?? `Queue consumer: ${name}`, {
             memorySize: intent?.memorySize ?? this.envConfig.lambda.memoryMb,
             timeout: cdk.Duration.seconds(intent?.timeout ?? this.envConfig.lambda.timeoutSec),
+            role: this.roleForFunction(name),
         });
         this.queueLambdas.set(name, fn);
         // `Queue.fromQueueArn` produces an `IQueue` that supports
@@ -1157,6 +1249,7 @@ export class VentureAppStack extends cdk.Stack {
             timeout: cdk.Duration.seconds(intent?.timeout ?? 60),
             deadLetterQueue: dlq,
             deadLetterQueueEnabled: true,
+            role: this.roleForFunction(name),
         });
         this.scheduleLambdas.set(name, fn);
         // Optional EventBridge rule. When `intent` is undefined the
@@ -1195,6 +1288,7 @@ export class VentureAppStack extends cdk.Stack {
         const fn = this.buildLambda(resourceId, functionName, handlerFile, intent?.description ?? `Standalone function: ${name}`, {
             memorySize: intent?.memorySize ?? this.envConfig.lambda.memoryMb,
             timeout: cdk.Duration.seconds(intent?.timeout ?? this.envConfig.lambda.timeoutSec),
+            role: this.roleForFunction(name),
         });
         this.functionLambdas.set(name, fn);
     }
@@ -1458,14 +1552,27 @@ export class VentureAppStack extends cdk.Stack {
         // `AccessDeniedException: not authorized to perform
         // dynamodb:UpdateItem` and every rate-limited route fails closed.
         const rateLimitTable = dynamodb.Table.fromTableName(this, 'imported-rate-limit-table', `${this.projectName}-rate-limits-${this.stage}`);
-        rateLimitTable.grantReadWriteData(this.lambdaRole);
+        this.grantEachRole((role) => rateLimitTable.grantReadWriteData(role));
+        // ── Idempotency + saga DDB tables (ALWAYS, same rationale) ─
+        // Provisioned by the data stack beside the rate-limits table;
+        // `VENTURE_IDEMPOTENCY_TABLE` / `VENTURE_SAGA_TABLE` in baseEnvVars
+        // name them.
+        const idempotencyTable = dynamodb.Table.fromTableName(this, 'imported-idempotency-table', `${this.projectName}-idempotency-${this.stage}`);
+        this.grantEachRole((role) => idempotencyTable.grantReadWriteData(role));
+        const sagaTable = dynamodb.Table.fromTableName(this, 'imported-saga-table', `${this.projectName}-sagas-${this.stage}`);
+        this.grantEachRole((role) => sagaTable.grantReadWriteData(role));
+        // ── Internal HMAC signing key (ALWAYS) ─────────────────────
+        // `@venturekit/runtime` resolves `VENTURE_INTERNAL_HMAC_SECRET_ARN`
+        // once per container; without read access it fails closed and
+        // treats every call as external.
+        this.grantEachRole((role) => this.internalHmacSecret.grantRead(role));
         // ── DB secrets ────────────────────────────────────────────
         if (imports.databaseEndpointsById) {
             for (const [id, db] of imports.databaseEndpointsById) {
                 if (!db.secretArn)
                     continue;
                 const importedSecret = secretsmanager.Secret.fromSecretCompleteArn(this, `imported-db-secret-${id}`, db.secretArn);
-                importedSecret.grantRead(this.lambdaRole);
+                this.grantEachRole((role) => importedSecret.grantRead(role));
             }
         }
         // ── Federated provider secrets ────────────────────────────
@@ -1473,7 +1580,7 @@ export class VentureAppStack extends cdk.Stack {
             for (const [authId, providers] of imports.federatedSecretArnsByAuthId) {
                 for (const [provider, arn] of Object.entries(providers)) {
                     const importedSecret = secretsmanager.Secret.fromSecretCompleteArn(this, `imported-fed-secret-${authId}-${provider}`, arn);
-                    importedSecret.grantRead(this.lambdaRole);
+                    this.grantEachRole((role) => importedSecret.grantRead(role));
                 }
             }
         }
@@ -1487,33 +1594,33 @@ export class VentureAppStack extends cdk.Stack {
         // import — an SSM-fallback ARN is a deploy-time token that renders
         // as the parameter's value in the resulting IAM statement.
         for (const [authId, keyArn] of this.customSenderKeyArns) {
-            kms.Key.fromKeyArn(this, `imported-custom-sender-key-${authId}`, keyArn)
-                .grantDecrypt(this.lambdaRole);
+            const key = kms.Key.fromKeyArn(this, `imported-custom-sender-key-${authId}`, keyArn);
+            this.grantEachRole((role) => key.grantDecrypt(role));
         }
         // ── WhatsApp token + webhook secrets ───────────────────────
         if (imports.whatsappTokenSecretArnsById) {
             for (const [id, arn] of imports.whatsappTokenSecretArnsById) {
                 const importedSecret = secretsmanager.Secret.fromSecretCompleteArn(this, `imported-whatsapp-secret-${id}`, arn);
-                importedSecret.grantRead(this.lambdaRole);
+                this.grantEachRole((role) => importedSecret.grantRead(role));
             }
         }
         if (imports.whatsappAppSecretArnsById) {
             for (const [id, arn] of imports.whatsappAppSecretArnsById) {
                 const importedSecret = secretsmanager.Secret.fromSecretCompleteArn(this, `imported-whatsapp-app-secret-${id}`, arn);
-                importedSecret.grantRead(this.lambdaRole);
+                this.grantEachRole((role) => importedSecret.grantRead(role));
             }
         }
         if (imports.whatsappVerifyTokenSecretArnsById) {
             for (const [id, arn] of imports.whatsappVerifyTokenSecretArnsById) {
                 const importedSecret = secretsmanager.Secret.fromSecretCompleteArn(this, `imported-whatsapp-verify-token-${id}`, arn);
-                importedSecret.grantRead(this.lambdaRole);
+                this.grantEachRole((role) => importedSecret.grantRead(role));
             }
         }
         // ── Billing provider credential secrets ───────────────
         if (imports.billingSecretArnsById) {
             for (const [id, arn] of imports.billingSecretArnsById) {
                 const importedSecret = secretsmanager.Secret.fromSecretCompleteArn(this, `imported-billing-secret-${id}`, arn);
-                importedSecret.grantRead(this.lambdaRole);
+                this.grantEachRole((role) => importedSecret.grantRead(role));
             }
         }
         // ── Operator-managed secrets (secrets intents) ────────
@@ -1523,38 +1630,42 @@ export class VentureAppStack extends cdk.Stack {
         if (imports.secretArnsById) {
             for (const [id, arn] of imports.secretArnsById) {
                 const importedSecret = secretsmanager.Secret.fromSecretCompleteArn(this, `imported-config-secret-${id}`, arn);
-                importedSecret.grantRead(this.lambdaRole);
+                this.grantEachRole((role) => importedSecret.grantRead(role));
             }
         }
         // ── S3 buckets (read+write) ──────────────────────────────
         if (imports.storageBucketNamesById) {
             for (const [id, bucketName] of imports.storageBucketNamesById) {
                 const bucket = s3.Bucket.fromBucketName(this, `imported-bucket-${id}`, bucketName);
-                bucket.grantReadWrite(this.lambdaRole);
+                this.grantEachRole((role) => bucket.grantReadWrite(role));
             }
         }
         // ── Cognito admin actions per user pool ──────────────────
+        // Attached to the auth-admin role only when `adminRoutes` are
+        // declared (see the constructor), otherwise to the shared role.
         if (imports.userPoolArnsByAuthId) {
             for (const [, poolArn] of imports.userPoolArnsByAuthId) {
                 // Scope to specific Cognito admin actions used by
                 // `@venturekit/auth/server`'s federated sign-in path.
                 // Avoid `cognito-idp:*` — overly broad, includes pool
                 // delete/update which Lambdas should never do.
-                this.lambdaRole.addToPrincipalPolicy(new iam.PolicyStatement({
-                    effect: iam.Effect.ALLOW,
-                    actions: [
-                        'cognito-idp:AdminCreateUser',
-                        'cognito-idp:AdminDeleteUser',
-                        'cognito-idp:AdminGetUser',
-                        'cognito-idp:AdminConfirmSignUp',
-                        'cognito-idp:AdminInitiateAuth',
-                        'cognito-idp:AdminSetUserPassword',
-                        'cognito-idp:AdminUpdateUserAttributes',
-                        'cognito-idp:AdminLinkProviderForUser',
-                        'cognito-idp:ListUsers',
-                    ],
-                    resources: [poolArn],
-                }));
+                for (const role of this.cognitoAdminRoles) {
+                    role.addToPrincipalPolicy(new iam.PolicyStatement({
+                        effect: iam.Effect.ALLOW,
+                        actions: [
+                            'cognito-idp:AdminCreateUser',
+                            'cognito-idp:AdminDeleteUser',
+                            'cognito-idp:AdminGetUser',
+                            'cognito-idp:AdminConfirmSignUp',
+                            'cognito-idp:AdminInitiateAuth',
+                            'cognito-idp:AdminSetUserPassword',
+                            'cognito-idp:AdminUpdateUserAttributes',
+                            'cognito-idp:AdminLinkProviderForUser',
+                            'cognito-idp:ListUsers',
+                        ],
+                        resources: [poolArn],
+                    }));
+                }
             }
         }
         // ── SES send ─────────────────────────────────────────────
@@ -1564,11 +1675,11 @@ export class VentureAppStack extends cdk.Stack {
         // because SES doesn't support resource-level scoping for
         // SendEmail.
         if (imports.notifyConfigurationSetNamesById && imports.notifyConfigurationSetNamesById.size > 0) {
-            this.lambdaRole.addToPrincipalPolicy(new iam.PolicyStatement({
+            this.grantEachRole((role) => role.addToPrincipalPolicy(new iam.PolicyStatement({
                 effect: iam.Effect.ALLOW,
                 actions: ['ses:SendEmail', 'ses:SendRawEmail'],
                 resources: ['*'],
-            }));
+            })));
         }
         // ── SNS publish on notify events topics ─────────────────
         // Used by the dispatcher to publish synthetic events when an
@@ -1579,11 +1690,11 @@ export class VentureAppStack extends cdk.Stack {
         if (imports.notifyEventsTopicArnsById) {
             const topicArns = [...imports.notifyEventsTopicArnsById.values()];
             if (topicArns.length > 0) {
-                this.lambdaRole.addToPrincipalPolicy(new iam.PolicyStatement({
+                this.grantEachRole((role) => role.addToPrincipalPolicy(new iam.PolicyStatement({
                     effect: iam.Effect.ALLOW,
                     actions: ['sns:Publish'],
                     resources: topicArns,
-                }));
+                })));
             }
         }
         // ── EventBridge PutEvents on OWNED buses ─────────────────
@@ -1595,11 +1706,11 @@ export class VentureAppStack extends cdk.Stack {
         if (imports.eventBusArnsById) {
             const busArns = [...imports.eventBusArnsById.values()];
             if (busArns.length > 0) {
-                this.lambdaRole.addToPrincipalPolicy(new iam.PolicyStatement({
+                this.grantEachRole((role) => role.addToPrincipalPolicy(new iam.PolicyStatement({
                     effect: iam.Effect.ALLOW,
                     actions: ['events:PutEvents'],
                     resources: busArns,
-                }));
+                })));
             }
         }
     }