@reventlessdev/reventless-aws 3.0.0-alpha.167

package/tests/AppSync_AdapterTest.res.mjs

@@ -0,0 +1,326 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/AdminApi.res.mjs";
+import * as AppSync_Adapter$ReventlessAws from "../src/components/Api/AppSync_Adapter.res.mjs";
+import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as PluginBaseFragment$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/api/PluginBaseFragment.res.mjs";
+
+globalThis.describe("AppSync_Adapter.sha256Hex", () => {
+  globalThis.test("returns a 64-character hex string", () => {
+    let hash = AppSync_Adapter$ReventlessAws.sha256Hex("hello");
+    globalThis.expect(hash.length).toBe(64);
+  });
+  globalThis.test("is stable — same input produces same digest", () => {
+    let sdl = "type Query { ping: String }";
+    globalThis.expect(AppSync_Adapter$ReventlessAws.sha256Hex(sdl)).toBe(AppSync_Adapter$ReventlessAws.sha256Hex(sdl));
+  });
+  globalThis.test("differs for inputs that differ by one character", () => {
+    globalThis.expect(AppSync_Adapter$ReventlessAws.sha256Hex("type Query { ping: String }")).not.toBe(AppSync_Adapter$ReventlessAws.sha256Hex("type Query { pong: String }"));
+  });
+});
+
+let decodeFragment = GraphQL_Stitcher$ReventlessCore.decode;
+
+globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
+  let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
+  globalThis.test("adds @aws_auth directive to all mutation fields", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.mutations.forEach(field => {
+      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    });
+  });
+  globalThis.test("adds @aws_auth directive to all query fields", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.queries.forEach(field => {
+      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    });
+  });
+  globalThis.test("preserves type definitions unchanged", () => {
+    let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    globalThis.expect(parts.types).toEqual(original.types);
+  });
+  globalThis.test("uses specified group name", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "SuperAdmin");
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.mutations.forEach(field => {
+      globalThis.expect(field).toContain(`cognito_groups: ["SuperAdmin"]`);
+    });
+  });
+  globalThis.test("preserves subscription fields with @aws_auth directive", () => {
+    let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    globalThis.expect(parts.subscriptions.length).toBe(original.subscriptions.length);
+    globalThis.expect(parts.subscriptions.length).toBeGreaterThan(0);
+    parts.subscriptions.forEach(field => {
+      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    });
+  });
+  globalThis.test("admin Plugin aggregate subscription fields survive the round-trip", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    let joined = parts.subscriptions.join("\n");
+    globalThis.expect(joined).toContain("onPlatform_Plugin_Activate");
+    globalThis.expect(joined).toContain("onPlatform_Plugin_Deactivate");
+  });
+});
+
+globalThis.describe("AppSync_Adapter.injectAwsAuth", () => {
+  globalThis.test("injects auth only on entries with authorization", () => {
+    let mutationEntries = AdminApi$ReventlessCore.mutationEntries(false);
+    let baseFragment = AdminApi$ReventlessCore.baseFragment(false);
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuth(baseFragment, mutationEntries, PluginBaseFragment$ReventlessCore.queryEntries);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    let queryWithAuth = PluginBaseFragment$ReventlessCore.queryEntries.some(entry => Stdlib_Option.isSome(entry.authorization));
+    if (!queryWithAuth) {
+      return;
+    }
+    let hasAuthQuery = parts.queries.some(field => field.includes("@aws_auth"));
+    globalThis.expect(hasAuthQuery).toBe(true);
+  });
+});
+
+globalThis.describe("AppSync_Adapter.generateFragment", () => {
+  globalThis.test("produces fragment with auth directives from entries", () => {
+    let mutationEntries = AdminApi$ReventlessCore.mutationEntries(false);
+    let fragment = AppSync_Adapter$ReventlessAws.generateFragment(mutationEntries, PluginBaseFragment$ReventlessCore.queryEntries);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
+    globalThis.expect(parts.types.length).toBeGreaterThan(0);
+    globalThis.expect(parts.mutations.length).toBeGreaterThan(0);
+    globalThis.expect(parts.queries.length).toBeGreaterThan(0);
+  });
+});
+
+globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () => {
+  let makeFragment = (mutationFields, queryFields) => GraphQL_Stitcher$ReventlessCore.encode({
+    types: [],
+    mutations: mutationFields,
+    queries: queryFields,
+    subscriptions: []
+  });
+  let mutationEntry = (fieldNames, fieldPermissions) => ({
+    fieldNames: fieldNames,
+    commandSchema: S.unknown,
+    fieldPermissions: fieldPermissions
+  });
+  let queryEntry = (single, list, permission) => ({
+    singleFieldName: single,
+    listFieldName: list,
+    returnTypeName: single,
+    stateSchema: S.unknown,
+    authorization: undefined,
+    permission: permission
+  });
+  globalThis.test("AllowGroups([\"Admin\"]) emits cognito_groups: [\"Admin\"] on mutation", () => {
+    let fp = Object.fromEntries([[
+        "catalog_Category_Archive",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]]);
+    let entry = mutationEntry(["catalog_Category_Archive"], fp);
+    let frag = makeFragment(["catalog_Category_Archive(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let m = parts.mutations[0];
+    globalThis.expect(m).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+  });
+  globalThis.test("AllowGroups multi-group emits comma-separated groups", () => {
+    let fp = Object.fromEntries([[
+        "p_X",
+        {
+          TAG: "AllowGroups",
+          _0: [
+            "Admin",
+            "Editor"
+          ]
+        }
+      ]]);
+    let entry = mutationEntry(["p_X"], fp);
+    let frag = makeFragment(["p_X(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    globalThis.expect(parts.mutations[0]).toContain(`@aws_auth(cognito_groups: ["Admin", "Editor"])`);
+  });
+  globalThis.test("AllowAuthenticated emits no directive", () => {
+    let fp = Object.fromEntries([[
+        "p_Add",
+        "AllowAuthenticated"
+      ]]);
+    let entry = mutationEntry(["p_Add"], fp);
+    let frag = makeFragment(["p_Add(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    globalThis.expect(parts.mutations[0]).not.toContain("@aws_auth");
+  });
+  globalThis.test("DenyAll emits sentinel __deny_all__ group", () => {
+    let fp = Object.fromEntries([[
+        "p_Hide",
+        "DenyAll"
+      ]]);
+    let entry = mutationEntry(["p_Hide"], fp);
+    let frag = makeFragment(["p_Hide(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    globalThis.expect(parts.mutations[0]).toContain(`"__deny_all__"`);
+  });
+  globalThis.test("Per-field permissions: only annotated fields get directives", () => {
+    let fp = Object.fromEntries([
+      [
+        "p_Archive",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ],
+      [
+        "p_Add",
+        "AllowAuthenticated"
+      ]
+    ]);
+    let entry = mutationEntry([
+      "p_Archive",
+      "p_Add"
+    ], fp);
+    let frag = makeFragment([
+      "p_Archive(id: ID!): String",
+      "p_Add(name: String!): String"
+    ], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let archive = parts.mutations.find(f => f.includes("p_Archive"));
+    let add = parts.mutations.find(f => f.includes("p_Add"));
+    if (archive !== undefined) {
+      globalThis.expect(archive).toContain(`cognito_groups: ["Admin"]`);
+    } else {
+      Stdlib_JsError.throwWithMessage("missing archive field");
+    }
+    if (add !== undefined) {
+      globalThis.expect(add).not.toContain("@aws_auth");
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("missing add field");
+    }
+  });
+  globalThis.test("Query permission applies to BOTH single and list field names", () => {
+    let entry = queryEntry("p_Item", "p_Items", {
+      TAG: "AllowGroups",
+      _0: ["Manager"]
+    });
+    let frag = makeFragment([], [
+      "p_Item(id: ID!): Item",
+      "p_Items(first: Int, after: String): ItemConnection!"
+    ]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [entry]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let item = parts.queries.find(f => f.includes("p_Item("));
+    let items = parts.queries.find(f => f.includes("p_Items("));
+    if (item !== undefined && items !== undefined) {
+      globalThis.expect(item).toContain(`cognito_groups: ["Manager"]`);
+      globalThis.expect(items).toContain(`cognito_groups: ["Manager"]`);
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("missing query fields");
+    }
+  });
+  globalThis.test("Spec-level permission wins over legacy authorization field", () => {
+    let fp = Object.fromEntries([[
+        "p_X",
+        {
+          TAG: "AllowGroups",
+          _0: ["Manager"]
+        }
+      ]]);
+    let entry_fieldNames = ["p_X"];
+    let entry_authorization = {
+      tableName: "Tbl",
+      group: "Admin"
+    };
+    let entry_fieldPermissions = fp;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      authorization: entry_authorization,
+      fieldPermissions: entry_fieldPermissions
+    };
+    let frag = makeFragment(["p_X(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let m = parts.mutations[0];
+    globalThis.expect(m).toContain(`cognito_groups: ["Manager"]`);
+    globalThis.expect(m).not.toContain(`"Admin"`);
+  });
+  globalThis.test("AllowAuthenticated on a field overrides the legacy authorization (removes directive)", () => {
+    let fp = Object.fromEntries([[
+        "p_X",
+        "AllowAuthenticated"
+      ]]);
+    let entry_fieldNames = ["p_X"];
+    let entry_authorization = {
+      tableName: "Tbl",
+      group: "Admin"
+    };
+    let entry_fieldPermissions = fp;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      authorization: entry_authorization,
+      fieldPermissions: entry_fieldPermissions
+    };
+    let frag = makeFragment(["p_X(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    globalThis.expect(parts.mutations[0]).not.toContain("@aws_auth");
+  });
+});
+
+globalThis.describe("Split mode — empty base fragment", () => {
+  globalThis.test("empty stitcher encode produces fragment with no fields", () => {
+    let emptyFragment = GraphQL_Stitcher$ReventlessCore.encode({
+      types: [],
+      mutations: [],
+      queries: [],
+      subscriptions: []
+    });
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(emptyFragment);
+    globalThis.expect(parts.types).toHaveLength(0);
+    globalThis.expect(parts.mutations).toHaveLength(0);
+    globalThis.expect(parts.queries).toHaveLength(0);
+  });
+  globalThis.test("stitching with empty base produces only plugin fields", () => {
+    let emptyBase = GraphQL_Stitcher$ReventlessCore.encode({
+      types: [],
+      mutations: [],
+      queries: [],
+      subscriptions: []
+    });
+    let pluginFragment = GraphQL_Stitcher$ReventlessCore.encode({
+      types: [`type MyPlugin_Item { id: ID! }`],
+      mutations: [`MyPlugin_Item_Create(id: ID!): String`],
+      queries: [`MyPlugin_Item(id: ID!): MyPlugin_Item`],
+      subscriptions: []
+    });
+    let sdl = GraphQL_Stitcher$ReventlessCore.stitch(emptyBase, [pluginFragment]);
+    globalThis.expect(sdl).toContain("MyPlugin_Item_Create");
+    globalThis.expect(sdl).toContain("MyPlugin_Item");
+    globalThis.expect(sdl).not.toContain("Platform_Plugin");
+  });
+  globalThis.test("stitching admin base without plugins produces only admin fields", () => {
+    let adminBase = AdminApi$ReventlessCore.baseFragment(false);
+    let sdl = GraphQL_Stitcher$ReventlessCore.stitch(adminBase, []);
+    globalThis.expect(sdl).toContain("Platform_Plugin");
+  });
+});
+
+export {
+  decodeFragment,
+}
+/*  Not a pure module */

package/tests/AppSync_Resolver_RetryingTest.res

@@ -0,0 +1,59 @@
+open JestGlobals
+
+// Helper: build a plain JS object shaped like a JS Error / SDK exception.
+// Obj.magic casts the ReScript record (which compiles to a plain JS object)
+// to JsExn.t so we can call isFieldNotFoundError without a real throw/catch.
+type testError = {name: string, message: string}
+
+let mkErr = (~name, ~message): JsExn.t =>
+  Obj.magic(({name, message}: testError))
+
+describe("AppSync_Resolver_Retrying.isFieldNotFoundError", () => {
+  describe("returns true", () => {
+    testSync("NotFoundException with 'No field named' message", () => {
+      let err = mkErr(
+        ~name="NotFoundException",
+        ~message="No field named createFoo found on type Mutation",
+      )
+      expect(AppSync_Resolver_Retrying.isFieldNotFoundError(err))->toBe(true)
+    })
+
+    testSync("NotFoundException with 'No field named' on Query type", () => {
+      let err = mkErr(
+        ~name="NotFoundException",
+        ~message="No field named bar found on type Query",
+      )
+      expect(AppSync_Resolver_Retrying.isFieldNotFoundError(err))->toBe(true)
+    })
+  })
+
+  describe("returns false", () => {
+    testSync("NotFoundException with 'No resolver found' (delete-path — must not retry)", () => {
+      let err = mkErr(
+        ~name="NotFoundException",
+        ~message="No resolver found for type Query field foo",
+      )
+      expect(AppSync_Resolver_Retrying.isFieldNotFoundError(err))->toBe(false)
+    })
+
+    testSync("ThrottlingException", () => {
+      let err = mkErr(~name="ThrottlingException", ~message="Rate exceeded")
+      expect(AppSync_Resolver_Retrying.isFieldNotFoundError(err))->toBe(false)
+    })
+
+    testSync("NotFoundException with unrelated message", () => {
+      let err = mkErr(~name="NotFoundException", ~message="API not found")
+      expect(AppSync_Resolver_Retrying.isFieldNotFoundError(err))->toBe(false)
+    })
+
+    testSync("non-exception value (integer)", () => {
+      let notErr: JsExn.t = Obj.magic(42)
+      expect(AppSync_Resolver_Retrying.isFieldNotFoundError(notErr))->toBe(false)
+    })
+
+    testSync("non-exception value (plain object without name)", () => {
+      let notErr: JsExn.t = Obj.magic({"message": "something went wrong"})
+      expect(AppSync_Resolver_Retrying.isFieldNotFoundError(notErr))->toBe(false)
+    })
+  })
+})

package/tests/AppSync_Resolver_RetryingTest.res.mjs

@@ -0,0 +1,66 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as AppSync_Resolver_Retrying$ReventlessAws from "../src/adapter/Api/AppSync_Resolver_Retrying.res.mjs";
+
+function mkErr(name, message) {
+  return {
+    name: name,
+    message: message
+  };
+}
+
+globalThis.describe("AppSync_Resolver_Retrying.isFieldNotFoundError", () => {
+  globalThis.describe("returns true", () => {
+    globalThis.test("NotFoundException with 'No field named' message", () => {
+      let err = {
+        name: "NotFoundException",
+        message: "No field named createFoo found on type Mutation"
+      };
+      globalThis.expect(AppSync_Resolver_Retrying$ReventlessAws.isFieldNotFoundError(err)).toBe(true);
+    });
+    globalThis.test("NotFoundException with 'No field named' on Query type", () => {
+      let err = {
+        name: "NotFoundException",
+        message: "No field named bar found on type Query"
+      };
+      globalThis.expect(AppSync_Resolver_Retrying$ReventlessAws.isFieldNotFoundError(err)).toBe(true);
+    });
+  });
+  globalThis.describe("returns false", () => {
+    globalThis.test("NotFoundException with 'No resolver found' (delete-path — must not retry)", () => {
+      let err = {
+        name: "NotFoundException",
+        message: "No resolver found for type Query field foo"
+      };
+      globalThis.expect(AppSync_Resolver_Retrying$ReventlessAws.isFieldNotFoundError(err)).toBe(false);
+    });
+    globalThis.test("ThrottlingException", () => {
+      let err = {
+        name: "ThrottlingException",
+        message: "Rate exceeded"
+      };
+      globalThis.expect(AppSync_Resolver_Retrying$ReventlessAws.isFieldNotFoundError(err)).toBe(false);
+    });
+    globalThis.test("NotFoundException with unrelated message", () => {
+      let err = {
+        name: "NotFoundException",
+        message: "API not found"
+      };
+      globalThis.expect(AppSync_Resolver_Retrying$ReventlessAws.isFieldNotFoundError(err)).toBe(false);
+    });
+    globalThis.test("non-exception value (integer)", () => {
+      globalThis.expect(AppSync_Resolver_Retrying$ReventlessAws.isFieldNotFoundError(42)).toBe(false);
+    });
+    globalThis.test("non-exception value (plain object without name)", () => {
+      let notErr = {
+        message: "something went wrong"
+      };
+      globalThis.expect(AppSync_Resolver_Retrying$ReventlessAws.isFieldNotFoundError(notErr)).toBe(false);
+    });
+  });
+});
+
+export {
+  mkErr,
+}
+/*  Not a pure module */

package/tests/Auth_CognitoTest.res

@@ -0,0 +1,203 @@
+// Auth_Cognito unit tests — runtime identity extraction matrix.
+// Deploy-time `make` (Pulumi UserPool + UserPoolClient construction) is
+// exercised by `pulumi up` in Stage C; not covered here.
+
+open JestGlobals
+
+// ── Helpers ───────────────────────────────────────────────────────────────
+
+let buildContext = (
+  headers: array<(string, string)>,
+): ReventlessCore.Auth_Adapter.requestContext => {
+  headers: Dict.fromArray(headers),
+}
+
+@val external btoa: string => string = "btoa"
+let b64urlEncode = (s: string): string =>
+  btoa(s)
+  ->String.replaceAll("+", "-")
+  ->String.replaceAll("/", "_")
+  ->String.replaceAll("=", "")
+
+// Build a JWT-shaped string with a real (non-verified) payload. Signature is
+// a placeholder — Auth_Cognito.authenticate does not verify, AppSync does
+// upstream of the resolver.
+let buildJwt = (claims: dict<JSON.t>): string => {
+  let header = b64urlEncode(`{"alg":"HS256","typ":"JWT"}`)
+  let payload = b64urlEncode(claims->JSON.Encode.object->JSON.stringify)
+  let sig = "sig"
+  `${header}.${payload}.${sig}`
+}
+
+// ── authenticate (header-driven path) ─────────────────────────────────────
+
+describe("Auth_Cognito.authenticate", () => {
+  testAsync("no Authorization header → Anonymous", async () => {
+    let r = await Auth_Cognito.authenticate(buildContext([]))
+    switch r {
+    | Anonymous => ()
+    | _ => JsError.throwWithMessage("expected Anonymous")
+    }
+  })
+
+  testAsync("non-Bearer Authorization header → Anonymous", async () => {
+    let r = await Auth_Cognito.authenticate(
+      buildContext([("authorization", "Basic dXNlcjpwYXNz")]),
+    )
+    switch r {
+    | Anonymous => ()
+    | _ => JsError.throwWithMessage("expected Anonymous")
+    }
+  })
+
+  testAsync("malformed Bearer token → AuthError", async () => {
+    let r = await Auth_Cognito.authenticate(
+      buildContext([("authorization", "Bearer not-a-jwt")]),
+    )
+    switch r {
+    | AuthError(_) => ()
+    | _ => JsError.throwWithMessage("expected AuthError")
+    }
+  })
+
+  testAsync("valid Cognito JWT → Authenticated with sub/groups/username", async () => {
+    let claims = Dict.fromArray([
+      ("sub", JSON.Encode.string("c3741234-aaaa-bbbb-cccc-ddddeeee1234")),
+      ("cognito:username", JSON.Encode.string("alice@example.com")),
+      (
+        "cognito:groups",
+        ["Admin", "User"]->Array.map(JSON.Encode.string)->JSON.Encode.array,
+      ),
+    ])
+    let token = buildJwt(claims)
+    let r = await Auth_Cognito.authenticate(
+      buildContext([("authorization", "Bearer " ++ token)]),
+    )
+    switch r {
+    | Authenticated(identity) =>
+      expect(identity.userId)->toBe("c3741234-aaaa-bbbb-cccc-ddddeeee1234")
+      expect(identity.username)->toBe("alice@example.com")
+      expect(identity.groups)->toEqual(["Admin", "User"])
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testAsync("JWT without cognito:groups → empty groups", async () => {
+    let claims = Dict.fromArray([
+      ("sub", JSON.Encode.string("user-1")),
+      ("cognito:username", JSON.Encode.string("bob")),
+    ])
+    let token = buildJwt(claims)
+    let r = await Auth_Cognito.authenticate(
+      buildContext([("authorization", "Bearer " ++ token)]),
+    )
+    switch r {
+    | Authenticated(identity) =>
+      expect(identity.groups)->toEqual([])
+      expect(identity.username)->toBe("bob")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testAsync("header lookup is case-insensitive (Authorization)", async () => {
+    let claims = Dict.fromArray([
+      ("sub", JSON.Encode.string("user-mixed-case")),
+    ])
+    let token = buildJwt(claims)
+    let r = await Auth_Cognito.authenticate(
+      buildContext([("Authorization", "Bearer " ++ token)]),
+    )
+    switch r {
+    | Authenticated(identity) => expect(identity.userId)->toBe("user-mixed-case")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+})
+
+// ── fromAppSyncIdentity (resolver-event path) ─────────────────────────────
+
+describe("Auth_Cognito.fromAppSyncIdentity", () => {
+  testSync("None → Anonymous", () => {
+    switch Auth_Cognito.fromAppSyncIdentity(None) {
+    | Anonymous => ()
+    | _ => JsError.throwWithMessage("expected Anonymous")
+    }
+  })
+
+  testSync("Cognito identity: sub + claims.cognito:groups → Authenticated with Cognito provider", () => {
+    let claims = Dict.fromArray([
+      ("cognito:username", JSON.Encode.string("alice@example.com")),
+      (
+        "cognito:groups",
+        ["Admin"]->Array.map(JSON.Encode.string)->JSON.Encode.array,
+      ),
+    ])
+    let id: Auth_Cognito.appSyncIdentity = {
+      sub: "c3741234-aaaa",
+      username: "alice@example.com",
+      claims,
+    }
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) =>
+      expect(identity.userId)->toBe("c3741234-aaaa")
+      expect(identity.username)->toBe("alice@example.com")
+      expect(identity.groups)->toEqual(["Admin"])
+      switch identity.provider {
+      | Cognito => ()
+      | _ => JsError.throwWithMessage("expected Cognito provider")
+      }
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("Cognito identity: missing claims.cognito:groups → empty groups", () => {
+    let id: Auth_Cognito.appSyncIdentity = {
+      sub: "user-no-groups",
+      claims: Dict.make(),
+    }
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) =>
+      expect(identity.groups)->toEqual([])
+      // username falls back to sub when no claim is present
+      expect(identity.username)->toBe("user-no-groups")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("IAM identity: no sub but userArn present → Custom(\"aws-iam\") provider", () => {
+    let id: Auth_Cognito.appSyncIdentity = {
+      userArn: "arn:aws:iam::123456789012:role/heartbeat-lambda",
+      accountId: "123456789012",
+      username: "heartbeat-lambda",
+    }
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) =>
+      expect(identity.userId)->toBe("arn:aws:iam::123456789012:role/heartbeat-lambda")
+      expect(identity.username)->toBe("heartbeat-lambda")
+      expect(identity.groups)->toEqual([])
+      switch identity.provider {
+      | Custom("aws-iam") => ()
+      | _ => JsError.throwWithMessage("expected Custom(\"aws-iam\") provider")
+      }
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("IAM identity: userArn alone (no username) → username falls back to ARN", () => {
+    let id: Auth_Cognito.appSyncIdentity = {
+      userArn: "arn:aws:iam::123:role/x",
+    }
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) => expect(identity.username)->toBe("arn:aws:iam::123:role/x")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("Neither sub nor userArn → Anonymous", () => {
+    let id: Auth_Cognito.appSyncIdentity = {accountId: "123"}
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Anonymous => ()
+    | _ => JsError.throwWithMessage("expected Anonymous")
+    }
+  })
+})