@reventlessdev/rescript-pulumi-aws 3.0.0-alpha.4 → 3.0.0-alpha.40

package/src/example/MergedApiExample.res

@@ -8,9 +8,7 @@
 let mergedExecRole = IAM.Role.make(
   ~name="example-merged-exec-role",
   ~args={
-    assumeRolePolicy: Pulumi.Input.make(
-      `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`,
-    ),
+    assumeRolePolicy: Pulumi.Input.make(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`),
   },
 )
 

package/tests/AppSync_Resolver_FunctionsTest.mjs

@@ -158,7 +158,7 @@ describe('listAllItemsConnection', () => {
       const ctx = makeCtx({ args: {} })
       const result = request(ctx)
       expect(result.operation).toBe('Scan')
-      expect(result.limit).toBe(50)
+      expect(result.limit).toBe(51)
       expect(result.nextToken).toBeNull()
       expect(result.filter).toBeUndefined()
     })
@@ -209,6 +209,11 @@ describe('listAllItemsConnection', () => {
       expect(req2.nextToken).toBe('TOK1')
     })
 
+    // `hasPreviousPage` reports what this door can SERVE, not what exists. This
+    // cursor opens a new window at position 0, so the page before it lies in the
+    // previous window — real, and unreachable, because a continuation token
+    // cannot name the one before it. Claiming it is what drew a Prev button that
+    // always errored.
     test('final page (nextToken null) closes the connection', () => {
       const after = util.base64Encode(JSON.stringify({ t: 'TOK1', n: -1 }))
       const r = response(makeCtx({
@@ -216,7 +221,7 @@ describe('listAllItemsConnection', () => {
         result: { items: [{ id: 'z' }], nextToken: null },
       }))
       expect(r.pageInfo.hasNextPage).toBe(false)
-      expect(r.pageInfo.hasPreviousPage).toBe(true)
+      expect(r.pageInfo.hasPreviousPage).toBe(false)
     })
 
     // A filtered Scan can return an empty page while nextToken is still set. The
@@ -239,15 +244,55 @@ describe('listAllItemsConnection', () => {
       expect(r.pageInfo.hasNextPage).toBe(false)
     })
 
-    // Scan cannot page backward; last/before must error, not mislead.
-    test('request rejects backward pagination (before)', () => {
-      expect(() => request(makeCtx({ args: { before: 'x' } }))).toThrow(
-        'Backward pagination',
+    // `before` is served by re-reading the window the cursor names and cutting
+    // the page that ends at it. `last` is not: the last N rows of the list needs
+    // the END of the list, which a forward-only cursor cannot reach.
+    test('request rejects `last`, which needs the end of the list', () => {
+      expect(() => request(makeCtx({ args: { last: 5 } }))).toThrow('last is not supported')
+    })
+
+    test('a backward page is the page that precedes it, exactly', () => {
+      const items = Array.from({ length: 25 }, (_, i) => ({ id: 'r' + i }))
+      const page1 = response(makeCtx({ args: { first: 10 }, result: { items, nextToken: null } }))
+      const fwd = { args: { first: 10, after: page1.pageInfo.endCursor } }
+      const page2 = response(makeCtx({ ...fwd, result: { items, nextToken: null } }))
+      expect(page2.edges.map(e => e.node.id)).toEqual(items.slice(10, 20).map(i => i.id))
+
+      const back = { args: { first: 10, before: page2.pageInfo.startCursor } }
+      const prev = response(makeCtx({ ...back, result: { items, nextToken: null } }))
+      expect(prev.edges.map(e => e.node.id)).toEqual(page1.edges.map(e => e.node.id))
+      // Cut from ahead, so a next page provably exists — the one we came from.
+      expect(prev.pageInfo.hasNextPage).toBe(true)
+      expect(prev.pageInfo.hasPreviousPage).toBe(false)
+    })
+
+    // The read must reach `_upTo` rows into the window, not `first + from`, or the
+    // backward slice comes back with its tail missing.
+    test('a backward read examines the window as deep as the page it cuts', () => {
+      const before = util.base64Encode(JSON.stringify({ t: null, n: 30 }))
+      expect(request(makeCtx({ args: { first: 10, before } })).limit).toBe(30)
+    })
+
+    test('the window a backward cursor names is the one re-read', () => {
+      const before = util.base64Encode(JSON.stringify({ t: 'W7', n: 30 }))
+      expect(request(makeCtx({ args: { first: 10, before } })).nextToken).toBe('W7')
+    })
+
+    // The one page still out of reach, and the only case left refused.
+    test('a previous page in an earlier window is refused, and says which limit', () => {
+      const before = util.base64Encode(JSON.stringify({ t: 'W2', n: 0 }))
+      expect(() => request(makeCtx({ args: { first: 10, before } }))).toThrow(
+        'earlier read window',
       )
     })
 
-    test('request rejects backward pagination (last)', () => {
-      expect(() => request(makeCtx({ args: { last: 5 } }))).toThrow('Backward pagination')
+    // At the very start there is no earlier window to be unable to name, so a
+    // short backward page is served rather than refused.
+    test('a backward page at the start of the first window is served, not refused', () => {
+      const items = Array.from({ length: 10 }, (_, i) => ({ id: 'r' + i }))
+      const before = util.base64Encode(JSON.stringify({ t: null, n: 3 }))
+      const r = response(makeCtx({ args: { first: 10, before }, result: { items, nextToken: null } }))
+      expect(r.edges.map(e => e.node.id)).toEqual(['r0', 'r1', 'r2'])
     })
 
     // Cursors minted before the read window existed named the following window.
@@ -272,10 +317,11 @@ describe('listAllItemsConnection', () => {
       F.listAllItemsConnection('name', [], [], [], undefined, 'customerId', ['Admin']),
     )
 
-    test('an unfiltered read examines exactly the page it serves', () => {
+    // One row past the page: it is what says a next page exists.
+    test('an unfiltered read examines one row past the page it serves', () => {
       const req = request(makeCtx({ args: { first: 25 }, identity: null }))
       expect(req.filter).toBeUndefined()
-      expect(req.limit).toBe(25)
+      expect(req.limit).toBe(26)
     })
 
     test('a filtered read examines a wider window than the page', () => {
@@ -285,7 +331,7 @@ describe('listAllItemsConnection', () => {
     })
 
     test('a caller asking for more than the window gets what it asked for', () => {
-      expect(request(makeCtx({ args: { first: 5000 } })).limit).toBe(5000)
+      expect(request(makeCtx({ args: { first: 5000 } })).limit).toBe(5001)
     })
 
     // The user-visible bug: one matching row must be one page, not three.
@@ -328,6 +374,34 @@ describe('listAllItemsConnection', () => {
       ).toBe('W2')
     })
 
+    // DynamoDB hands back a token whenever a read stops AT its limit, whether or
+    // not anything follows. A read of exactly the page therefore claimed a next
+    // page after the last full one, and it came back blank — found on a deployed
+    // list paged one row at a time. The mock pages a table the way DynamoDB does.
+    test('paging to the end serves no blank page, whatever the page size', () => {
+      const rows = ['a', 'b', 'c', 'd'].map(id => ({ id }))
+      const dynamo = req => {
+        const start = req.nextToken === null ? 0 : +req.nextToken
+        const items = rows.slice(start, start + req.limit)
+        const stoppedAtLimit = items.length === req.limit
+        return { items, nextToken: stoppedAtLimit ? String(start + req.limit) : null }
+      }
+      ;[1, 2, 4].map(first => {
+        const pages = []
+        let after
+        for (let i = 0; i < 10; i++) {
+          const args = after === undefined ? { first } : { first, after }
+          const r = response(makeCtx({ args, result: dynamo(request(makeCtx({ args, identity: null }))) }))
+          pages.push(r.edges.map(e => e.node.id))
+          if (!r.pageInfo.hasNextPage) break
+          after = r.pageInfo.endCursor
+        }
+        expect(pages.flat()).toEqual(['a', 'b', 'c', 'd'])
+        expect(pages.every(p => p.length > 0)).toBe(true)
+        expect(pages).toHaveLength(Math.ceil(4 / first))
+      })
+    })
+
     // Without this the final row of a window resumes into a window with nothing
     // left in it, which is the blank page again one step later.
     test('the last row of a page that closes its window names the next window', () => {
@@ -542,7 +616,7 @@ describe('queryByIndexSortFiltered', () => {
     expect(result.query.expression).toBe('#ownerId = :ownerId')
     expect(result.filter).toBeUndefined()
     expect(result.index).toBe('ownerId')
-    expect(result.limit).toBe(50)
+    expect(result.limit).toBe(51)
   })
 
   test('query includes sortField when present', () => {
@@ -655,7 +729,8 @@ describe('invokeCommandGenerator', () => {
     expect(payload.identity.userArn).toBe('arn:aws:iam::123:role/SyncRole')
     expect(payload.identity.accountId).toBe('123')
     expect(payload.identity.username).toBe('AROAEXAMPLE:caller')
-    expect(payload.meta.ip).toEqual(['10.0.0.1'])
+    // The caller's address is personal data and never reaches the command.
+    expect(payload.meta).not.toHaveProperty('ip')
     expect(payload.meta.user).toBe('AROAEXAMPLE:caller')
   })
 
@@ -663,7 +738,7 @@ describe('invokeCommandGenerator', () => {
     const ctx = makeCtx({ identity: null })
     const { payload } = request(ctx)
     expect(payload.identity).toBeNull()
-    expect(payload.meta.ip).toBeNull()
+    expect(payload.meta).not.toHaveProperty('ip')
     expect(payload.meta.user).toBeNull()
     expect(payload.command).toBe('CreateProduct')
   })
@@ -712,6 +787,28 @@ describe('invokeInboundTranslation', () => {
     expect(result.payload.fieldName).toBe('importProduct')
     expect(result.payload.arguments).toEqual({ csv: 'data' })
   })
+
+  // The Lambda checks each translated command against the caller's groups.
+  test('request carries the Cognito caller and its groups', () => {
+    const ctx = makeCtx({
+      identity: { username: 'alice', sub: 's1', sourceIp: [], claims: { 'cognito:groups': ['Merchandiser'] } },
+    })
+    const { payload } = request(ctx)
+    expect(payload.identity.userId).toBe('s1')
+    expect(payload.identity.groups).toEqual(['Merchandiser'])
+    expect(payload.identity.provider).toBe('Cognito')
+  })
+
+  test('request carries an IAM caller as IAM', () => {
+    const ctx = makeCtx({ identity: { userArn: 'arn:aws:iam::123:role/Sync', accountId: '123' } })
+    const { payload } = request(ctx)
+    expect(payload.identity.provider).toBe('IAM')
+  })
+
+  test('request emits null identity when ctx.identity is null', () => {
+    const { payload } = request(makeCtx({ identity: null }))
+    expect(payload.identity).toBeNull()
+  })
 })
 
 // ---------------------------------------------------------------------------
@@ -907,11 +1004,11 @@ describe('listAllItemsConnection — owner scoping', () => {
 
   // The read window exists because a FilterExpression cuts rows AFTER `Limit`.
   // A key condition does not, so a scoped caller with no filter of their own
-  // examines exactly the page they asked for — the arithmetic the window was
-  // hiding, gone rather than papered over.
-  test('a scoped caller with no filter examines exactly the page', () => {
+  // examines the page they asked for and the one row that says whether another
+  // follows — the arithmetic the window was hiding, gone rather than papered over.
+  test('a scoped caller with no filter examines only the page, plus one', () => {
     const { request } = indexed()
-    expect(request(makeCtx({ args: { first: 25 }, identity: asUser('cust-a') })).limit).toBe(25)
+    expect(request(makeCtx({ args: { first: 25 }, identity: asUser('cust-a') })).limit).toBe(26)
   })
 
   test("a scoped caller's own filter still widens the window", () => {
@@ -1025,16 +1122,37 @@ describe('listAllItemsConnection — owner scoping', () => {
     })
   })
 
-  // Backward paging stays refused on both branches: a Query can walk backward,
-  // but the `{t, n}` cursor is DynamoDB's forward-only continuation token, and a
-  // door must not advertise what its cursor cannot honour.
+  // Backward paging works the same way on both branches, and for the same reason:
+  // it re-reads the window the cursor names and cuts the page ending at it, which
+  // is operation-agnostic. `last` stays refused on both — it needs the end of the
+  // list, which neither a Scan nor this Query's cursor can reach.
   test.each([['scoped', asUser('cust-a')], ['exempt', asUser('ops-1', ['Admin'])]])(
-    'a %s caller is still refused backward paging',
+    'a %s caller is still refused `last`',
     (_, identity) => {
       const { request } = indexed()
-      expect(() => request(makeCtx({ args: { last: 5 }, identity }))).toThrow('Backward pagination')
+      expect(() => request(makeCtx({ args: { last: 5 }, identity }))).toThrow(
+        'last is not supported',
+      )
     },
   )
+
+  // The path tag has to survive the direction change: a backward cursor still
+  // names the read that minted it, and replaying it on the other branch is the
+  // same mistake as replaying a forward one.
+  test('a backward cursor is path-checked like a forward one', () => {
+    const { request, response } = indexed()
+    const scopedPage = response(makeCtx({
+      args: { first: 10 },
+      identity: asUser('cust-a'),
+      result: { items: Array.from({ length: 10 }, (_, i) => ({ id: 'r' + i })), nextToken: null },
+    }))
+    expect(() =>
+      request(makeCtx({
+        args: { first: 10, before: scopedPage.pageInfo.endCursor },
+        identity: asUser('ops-1', ['Admin']),
+      })),
+    ).toThrow('different read of this list')
+  })
 })
 
 // ---------------------------------------------------------------------------