@reventlessdev/rescript-pulumi-aws 3.0.0-alpha.3 → 3.0.0-alpha.4

package/tests/AppSync_Resolver_FunctionsTest.mjs

@@ -148,7 +148,7 @@ describe('listAllItems', () => {
 })
 
 // ---------------------------------------------------------------------------
-// listAllItemsConnection — Phase 3 server-side filter/sort
+// listAllItemsConnection — server-side filter/sort
 // ---------------------------------------------------------------------------
 describe('listAllItemsConnection', () => {
   describe('default (no capability args)', () => {
@@ -193,13 +193,13 @@ describe('listAllItemsConnection', () => {
       expect(r.edges[0].node).toEqual({ id: 'a' })
       expect(r.pageInfo.hasNextPage).toBe(true)
       expect(r.pageInfo.hasPreviousPage).toBe(false)
-      // Fix 1: the cursor encodes the real nextToken, not a positional index.
-      expect(JSON.parse(util.base64Decode(r.pageInfo.endCursor)).token).toBe('next')
+      // The cursor encodes a real read window, not a positional index. The last row
+      // closed this one, so it names the window that follows.
+      expect(JSON.parse(util.base64Decode(r.pageInfo.endCursor)).t).toBe('next')
     })
 
-    // Fix 1 (docs/plans/done/aws-scan-connection-cursor-roundtrip.md): the cursor the
-    // response emits must decode back to the exact DynamoDB nextToken the request feeds
-    // to the next Scan. This is the round-trip that failed before the fix.
+    // The cursor the response emits must decode back to the DynamoDB nextToken the
+    // request feeds to the next Scan.
     test('endCursor round-trips: response endCursor → request nextToken', () => {
       const page1 = response(makeCtx({
         args: {},
@@ -210,16 +210,17 @@ describe('listAllItemsConnection', () => {
     })
 
     test('final page (nextToken null) closes the connection', () => {
+      const after = util.base64Encode(JSON.stringify({ t: 'TOK1', n: -1 }))
       const r = response(makeCtx({
-        args: { after: 'x' },
+        args: { after },
         result: { items: [{ id: 'z' }], nextToken: null },
       }))
       expect(r.pageInfo.hasNextPage).toBe(false)
       expect(r.pageInfo.hasPreviousPage).toBe(true)
     })
 
-    // Fix 3: a filtered Scan can return an empty page while nextToken is still set.
-    // The boundary cursor must let the client resume instead of restarting page 1.
+    // A filtered Scan can return an empty page while nextToken is still set. The
+    // boundary cursor must let the client resume instead of restarting page 1.
     test('empty-but-continuable page yields a resumable boundary cursor', () => {
       const empty = response(makeCtx({
         args: {},
@@ -238,7 +239,7 @@ describe('listAllItemsConnection', () => {
       expect(r.pageInfo.hasNextPage).toBe(false)
     })
 
-    // Fix 2: Scan cannot page backward; last/before must error, not mislead.
+    // Scan cannot page backward; last/before must error, not mislead.
     test('request rejects backward pagination (before)', () => {
       expect(() => request(makeCtx({ args: { before: 'x' } }))).toThrow(
         'Backward pagination',
@@ -248,6 +249,95 @@ describe('listAllItemsConnection', () => {
     test('request rejects backward pagination (last)', () => {
       expect(() => request(makeCtx({ args: { last: 5 } }))).toThrow('Backward pagination')
     })
+
+    // Cursors minted before the read window existed named the following window.
+    test('a pre-window { token, index } cursor still resumes', () => {
+      const legacy = util.base64Encode(JSON.stringify({ token: 'TOK9', index: 3 }))
+      const req = request(makeCtx({ args: { after: legacy } }))
+      expect(req.nextToken).toBe('TOK9')
+      const r = response(makeCtx({
+        args: { after: legacy },
+        result: { items: [{ id: 'a' }], nextToken: null },
+      }))
+      expect(r.edges).toHaveLength(1)
+    })
+  })
+
+  // The defect a selective filter turns into a visibly broken list: DynamoDB
+  // applies Limit before the FilterExpression, so reading `first` rows and
+  // returning the survivors spreads one matching row over several pages, most of
+  // them blank under a live Next button.
+  describe('reads a window, serves a page', () => {
+    const { request, response } = evalResolver(
+      F.listAllItemsConnection('name', [], [], [], undefined, 'customerId', ['Admin']),
+    )
+
+    test('an unfiltered read examines exactly the page it serves', () => {
+      const req = request(makeCtx({ args: { first: 25 }, identity: null }))
+      expect(req.filter).toBeUndefined()
+      expect(req.limit).toBe(25)
+    })
+
+    test('a filtered read examines a wider window than the page', () => {
+      const req = request(makeCtx({ args: { first: 25 } }))
+      expect(req.filter.expression).toBe('#owner = :owner')
+      expect(req.limit).toBe(1000)
+    })
+
+    test('a caller asking for more than the window gets what it asked for', () => {
+      expect(request(makeCtx({ args: { first: 5000 } })).limit).toBe(5000)
+    })
+
+    // The user-visible bug: one matching row must be one page, not three.
+    test('the matches of an exhausted window are a single closed page', () => {
+      const r = response(makeCtx({
+        args: { first: 50 },
+        result: { items: [{ id: 'mine' }], nextToken: null },
+      }))
+      expect(r.edges).toHaveLength(1)
+      expect(r.pageInfo.hasNextPage).toBe(false)
+    })
+
+    test('a window holding more matches than the page pages within itself', () => {
+      const items = [{ id: 'a' }, { id: 'b' }, { id: 'c' }, { id: 'd' }, { id: 'e' }]
+      const page1 = response(makeCtx({
+        args: { first: 2 },
+        result: { items, nextToken: 'W2' },
+      }))
+      expect(page1.edges.map(e => e.node.id)).toEqual(['a', 'b'])
+      expect(page1.pageInfo.hasNextPage).toBe(true)
+
+      // Same window, resumed past the rows already served — not the next window.
+      const req2 = request(makeCtx({ args: { first: 2, after: page1.pageInfo.endCursor } }))
+      expect(req2.nextToken).toBeNull()
+      const page2 = response(makeCtx({
+        args: { first: 2, after: page1.pageInfo.endCursor },
+        result: { items, nextToken: 'W2' },
+      }))
+      expect(page2.edges.map(e => e.node.id)).toEqual(['c', 'd'])
+
+      // The row that closes the window hands the next request the window after it.
+      const page3 = response(makeCtx({
+        args: { first: 2, after: page2.pageInfo.endCursor },
+        result: { items, nextToken: 'W2' },
+      }))
+      expect(page3.edges.map(e => e.node.id)).toEqual(['e'])
+      expect(page3.pageInfo.hasNextPage).toBe(true)
+      expect(
+        request(makeCtx({ args: { first: 2, after: page3.pageInfo.endCursor } })).nextToken,
+      ).toBe('W2')
+    })
+
+    // Without this the final row of a window resumes into a window with nothing
+    // left in it, which is the blank page again one step later.
+    test('the last row of a page that closes its window names the next window', () => {
+      const r = response(makeCtx({
+        args: { first: 2 },
+        result: { items: [{ id: 'a' }, { id: 'b' }], nextToken: 'W2' },
+      }))
+      expect(JSON.parse(util.base64Decode(r.edges[1].cursor))).toEqual({ t: 'W2', n: -1 })
+      expect(JSON.parse(util.base64Decode(r.edges[0].cursor))).toEqual({ t: null, n: 0 })
+    })
   })
 
   describe('with filterFields (per-field Eq)', () => {
@@ -669,11 +759,9 @@ describe('authorizeIndexedAccess', () => {
 // ---------------------------------------------------------------------------
 // listAllItemsConnection — @owner scoping
 // ---------------------------------------------------------------------------
-// This is the one read path with no Lambda in it: the predicate lives in
-// generated JS that AppSync runs directly, so it shares no code with the three
-// paths the ReScript suites cover. Evaluating the emitted source here is the
-// strongest check available short of a deployed stack, and the only one that
-// can catch an APPSYNC_JS-hostile construct or a mis-ordered branch.
+// The one read path with no Lambda in it — the predicate is generated JS that
+// AppSync runs directly, sharing no code with the paths the ReScript suites
+// cover. Evaluating the emitted source is the strongest check short of a deploy.
 describe('listAllItemsConnection — owner scoping', () => {
   // (labelField, filterFields, rangeFields, sortFields, requireAttribute,
   //  ownerField, elevatedGroups)
@@ -757,16 +845,204 @@ describe('listAllItemsConnection — owner scoping', () => {
     const r = request(makeCtx({ args: {}, identity: asUser('ops-1', ['Admin']) }))
     expect(r.filter.expressionValues[':owner']).toEqual({ S: 'ops-1' })
   })
+
+  // ── The same identities, once the scope has an index to read ──────────────
+  //
+  // The predicate moves from the FilterExpression to a key condition, so who is
+  // narrowed and who is not now selects a different PHYSICAL READ. The defect
+  // class this guards against was invisible precisely because each path was
+  // individually correct — so the identity table runs over both, rather than a
+  // parallel suite growing beside it.
+  //
+  // (labelField, filterFields, rangeFields, sortFields, requireAttribute,
+  //  ownerField, elevatedGroups, retiredField, retiredValues,
+  //  ownerIndex, ownerIndexSortField)
+  const indexed = () =>
+    evalResolver(
+      F.listAllItemsConnection(
+        'name', ['status'], [], [], undefined, 'customerId', ['Admin'],
+        undefined, undefined, '_owner', 'id',
+      ),
+    )
+
+  const identities = [
+    ['a plain caller', asUser('cust-a'), 'Query'],
+    ['a caller in an elevated group', asUser('ops-1', ['Admin']), 'Scan'],
+    ['an IAM-shaped identity with no sub', { userArn: 'arn:aws:sts::1:x', username: 'Ing' }, 'Scan'],
+    ['a wholly absent identity', null, 'Scan'],
+  ]
+
+  test.each(identities)('%s reads through the operation its scope implies', (_, identity, op) => {
+    const { request } = indexed()
+    expect(request(makeCtx({ args: {}, identity })).operation).toBe(op)
+  })
+
+  test('a scoped caller is keyed on their own id, not filtered on it', () => {
+    const { request } = indexed()
+    const r = request(makeCtx({ args: {}, identity: asUser('cust-a') }))
+    expect(r.index).toBe('_owner')
+    expect(r.query.expression).toBe('#owner = :owner')
+    expect(r.query.expressionNames['#owner']).toBe('customerId')
+    expect(r.query.expressionValues[':owner']).toEqual({ S: 'cust-a' })
+    // The whole point: no owner clause survives anywhere in the filter. A copy
+    // left there would be a second, redundant predicate — and an expressionName
+    // the filter no longer references is a ValidationException.
+    expect(r.filter).toBeUndefined()
+  })
+
+  // The elevated read is the one that must not have changed: it is the same
+  // request the unindexed resolver builds, argument for argument.
+  test.each([
+    ['an elevated caller', asUser('ops-1', ['Admin'])],
+    ['an IAM service caller', { userArn: 'arn:aws:sts::1:x', username: 'Ing' }],
+  ])("%s's read is unchanged by the index existing", (_, identity) => {
+    const before = evalResolver(
+      F.listAllItemsConnection('name', ['status'], [], [], undefined, 'customerId', ['Admin']),
+    ).request(makeCtx({ args: { first: 20, filter: { statusEq: 'Placed' } }, identity }))
+    const after = indexed().request(
+      makeCtx({ args: { first: 20, filter: { statusEq: 'Placed' } }, identity }),
+    )
+    expect(after).toEqual(before)
+  })
+
+  // The read window exists because a FilterExpression cuts rows AFTER `Limit`.
+  // A key condition does not, so a scoped caller with no filter of their own
+  // examines exactly the page they asked for — the arithmetic the window was
+  // hiding, gone rather than papered over.
+  test('a scoped caller with no filter examines exactly the page', () => {
+    const { request } = indexed()
+    expect(request(makeCtx({ args: { first: 25 }, identity: asUser('cust-a') })).limit).toBe(25)
+  })
+
+  test("a scoped caller's own filter still widens the window", () => {
+    const { request } = indexed()
+    const r = request(
+      makeCtx({ args: { first: 25, filter: { statusEq: 'Placed' } }, identity: asUser('cust-a') }),
+    )
+    expect(r.limit).toBe(1000)
+    expect(r.filter.expression).toBe('#status = :statusEq')
+  })
+
+  // Both branches are reachable by the SAME caller across requests — an active
+  // role switch mid-pagination flips `_exempt`. A `nextToken` continues the
+  // operation that minted it, so replaying one on the other branch would answer
+  // a different question in silence.
+  describe('the cursor path tag', () => {
+    const { request, response } = indexed()
+    const pageFor = identity =>
+      response(makeCtx({
+        args: {},
+        identity,
+        result: { items: [{ id: 'a' }], nextToken: 'TOK' },
+      })).pageInfo.endCursor
+
+    test('a Scan cursor replayed on the Query branch is refused', () => {
+      const scanCursor = pageFor(asUser('ops-1', ['Admin']))
+      expect(() =>
+        request(makeCtx({ args: { after: scanCursor }, identity: asUser('cust-a') })),
+      ).toThrow('different read of this list')
+    })
+
+    test('a Query cursor replayed on the Scan branch is refused', () => {
+      const queryCursor = pageFor(asUser('cust-a'))
+      expect(() =>
+        request(makeCtx({ args: { after: queryCursor }, identity: asUser('ops-1', ['Admin']) })),
+      ).toThrow('different read of this list')
+    })
+
+    test('each branch resumes its own cursor', () => {
+      expect(
+        request(makeCtx({ args: { after: pageFor(asUser('cust-a')) }, identity: asUser('cust-a') }))
+          .nextToken,
+      ).toBe('TOK')
+      const ops = asUser('ops-1', ['Admin'])
+      expect(request(makeCtx({ args: { after: pageFor(ops) }, identity: ops })).nextToken).toBe('TOK')
+    })
+
+    // Cursors minted before the tag existed all came off a Scan, and the callers
+    // holding one are the exempt callers whose read did not change.
+    test('an untagged cursor still resumes the Scan branch', () => {
+      const legacy = util.base64Encode(JSON.stringify({ t: 'TOK9', n: 2 }))
+      const ops = asUser('ops-1', ['Admin'])
+      expect(request(makeCtx({ args: { after: legacy }, identity: ops })).nextToken).toBe('TOK9')
+    })
+  })
+
+  // Ordering on the index's own sort key is `ScanIndexForward`'s job across the
+  // caller's whole partition. Re-sorting the page in JS afterwards is the one
+  // way to BREAK that order — a sort over a page is not a sort over the rows.
+  describe('orderBy on the index sort key', () => {
+    const sorted = () =>
+      evalResolver(
+        F.listAllItemsConnection(
+          'name', [], [], ['id', 'placedAt'], undefined, 'customerId', ['Admin'],
+          undefined, undefined, '_owner', 'id',
+        ),
+      )
+    const items = [{ id: 'c' }, { id: 'a' }, { id: 'b' }]
+    const scoped = asUser('cust-a')
+
+    test('DESC flips scanIndexForward instead of reversing a page', () => {
+      const { request } = sorted()
+      const args = { orderBy: { field: 'id', direction: 'DESC' } }
+      expect(request(makeCtx({ args, identity: scoped })).scanIndexForward).toBe(false)
+      expect(
+        request(makeCtx({ args: { orderBy: { field: 'id', direction: 'ASC' } }, identity: scoped }))
+          .scanIndexForward,
+      ).toBe(true)
+    })
+
+    test('the page DynamoDB ordered is handed back untouched', () => {
+      const { response } = sorted()
+      const r = response(makeCtx({
+        args: { orderBy: { field: 'id', direction: 'ASC' } },
+        identity: scoped,
+        result: { items, nextToken: null },
+      }))
+      expect(r.edges.map(e => e.node.id)).toEqual(['c', 'a', 'b'])
+    })
+
+    test('any other sort field still sorts in JS', () => {
+      const { response } = sorted()
+      const r = response(makeCtx({
+        args: { orderBy: { field: 'placedAt', direction: 'ASC' } },
+        identity: scoped,
+        result: { items: [{ placedAt: 'z' }, { placedAt: 'a' }], nextToken: null },
+      }))
+      expect(r.edges.map(e => e.node.placedAt)).toEqual(['a', 'z'])
+    })
+
+    // The exempt caller Scans, which has no ordering of its own, so the per-page
+    // sort is still the only order they get.
+    test('an exempt caller keeps the per-page sort on the same field', () => {
+      const { response } = sorted()
+      const r = response(makeCtx({
+        args: { orderBy: { field: 'id', direction: 'ASC' } },
+        identity: asUser('ops-1', ['Admin']),
+        result: { items, nextToken: null },
+      }))
+      expect(r.edges.map(e => e.node.id)).toEqual(['a', 'b', 'c'])
+    })
+  })
+
+  // Backward paging stays refused on both branches: a Query can walk backward,
+  // but the `{t, n}` cursor is DynamoDB's forward-only continuation token, and a
+  // door must not advertise what its cursor cannot honour.
+  test.each([['scoped', asUser('cust-a')], ['exempt', asUser('ops-1', ['Admin'])]])(
+    'a %s caller is still refused backward paging',
+    (_, identity) => {
+      const { request } = indexed()
+      expect(() => request(makeCtx({ args: { last: 5 }, identity }))).toThrow('Backward pagination')
+    },
+  )
 })
 
 // ---------------------------------------------------------------------------
 // By-key reads — owner scoping
 // ---------------------------------------------------------------------------
-// The list resolver above carried the predicate while these did not, so a caller
-// narrowed to their own rows could still read any row they could name. These
-// cases pin the guard in the place it has to live: the response, since a GetItem
-// has no FilterExpression, and null rather than an error, which is what the
-// in-process platform answers and what does not confirm the row exists.
+// The list resolver carried the predicate while these did not, so a caller
+// narrowed to their own rows could still read any row they could name. The guard
+// belongs in the response — GetItem has no FilterExpression — and answers null.
 describe('getItemById / queryByIdSort — owner scoping', () => {
   const asUser = (sub, groups = []) => ({
     username: sub,