@reventlessdev/reventless-aws 3.0.0-alpha.291 → 3.0.0-alpha.293

package/tests/Auth_ActiveRolePoolAttachmentTest.res.mjs

@@ -0,0 +1,232 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
+
+function str(prim) {
+  return prim;
+}
+
+function describedPool() {
+  return Object.fromEntries([
+    [
+      "Id",
+      "eu-west-1_abc123"
+    ],
+    [
+      "Name",
+      "CustomerPool"
+    ],
+    [
+      "Arn",
+      "arn:aws:cognito-idp:eu-west-1:1:userpool/eu-west-1_abc123"
+    ],
+    [
+      "Status",
+      "Enabled"
+    ],
+    [
+      "CreationDate",
+      "2020-01-01T00:00:00Z"
+    ],
+    [
+      "LastModifiedDate",
+      "2024-01-01T00:00:00Z"
+    ],
+    [
+      "SchemaAttributes",
+      ["email"]
+    ],
+    [
+      "UsernameAttributes",
+      ["email"]
+    ],
+    [
+      "EstimatedNumberOfUsers",
+      4200
+    ],
+    [
+      "IssuerConfiguration",
+      Object.fromEntries([[
+          "IssuerUri",
+          "https://x"
+        ]])
+    ],
+    [
+      "KeyConfiguration",
+      Object.fromEntries([[
+          "KmsKeyId",
+          "k-1"
+        ]])
+    ],
+    [
+      "UserPoolTier",
+      "PLUS"
+    ],
+    [
+      "MfaConfiguration",
+      "ON"
+    ],
+    [
+      "DeletionProtection",
+      "ACTIVE"
+    ],
+    [
+      "EmailVerificationMessage",
+      "Your code is {####}, do not share it"
+    ],
+    [
+      "Policies",
+      Object.fromEntries([[
+          "PasswordPolicy",
+          Object.fromEntries([[
+              "MinimumLength",
+              24
+            ]])
+        ]])
+    ],
+    [
+      "UserPoolTags",
+      Object.fromEntries([[
+          "CostCentre",
+          "identity"
+        ]])
+    ],
+    [
+      "LambdaConfig",
+      Object.fromEntries([
+        [
+          "PreSignUp",
+          "arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp"
+        ],
+        [
+          "CustomMessage",
+          "arn:aws:lambda:eu-west-1:1:function:TheirCustomMessage"
+        ]
+      ])
+    ]
+  ]);
+}
+
+function merged(preTokenGenerationArn) {
+  return Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(describedPool(), "eu-west-1_abc123", preTokenGenerationArn);
+}
+
+let triggerArn = "arn:aws:lambda:eu-west-1:1:function:ActiveRoleTrigger";
+
+function lambdaConfigOf(input) {
+  return Stdlib_Option.flatMap(input["LambdaConfig"], Stdlib_JSON.Decode.object);
+}
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
+  let input = merged(triggerArn);
+  globalThis.test("MFA stays on rather than defaulting off", () => {
+    globalThis.expect(input["MfaConfiguration"]).toEqual("ON");
+  });
+  globalThis.test("deletion protection stays active", () => {
+    globalThis.expect(input["DeletionProtection"]).toEqual("ACTIVE");
+  });
+  globalThis.test("a customised verification message is not reset", () => {
+    globalThis.expect(input["EmailVerificationMessage"]).toEqual("Your code is {####}, do not share it");
+  });
+  globalThis.test("the password policy travels whole", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(input["Policies"], Stdlib_JSON.Decode.object), p => p["PasswordPolicy"]), Stdlib_JSON.Decode.object), p => p["MinimumLength"])).toEqual(24);
+  });
+  globalThis.test("tags are not dropped", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(input["UserPoolTags"], Stdlib_JSON.Decode.object), t => t["CostCentre"])).toEqual("identity");
+  });
+  globalThis.test("a paid tier is not reverted to Lite", () => {
+    globalThis.expect(input["UserPoolTier"]).toEqual("PLUS");
+  });
+  globalThis.test("the pool's existing triggers stay attached", () => {
+    globalThis.expect([
+      Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["PreSignUp"]),
+      Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["CustomMessage"])
+    ]).toEqual([
+      "arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp",
+      "arn:aws:lambda:eu-west-1:1:function:TheirCustomMessage"
+    ]);
+  });
+  globalThis.test("and ours is added beside them", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["PreTokenGeneration"])).toEqual(triggerArn);
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — shaping for the API", () => {
+  let input = merged(triggerArn);
+  globalThis.test("UserPoolId names the pool being updated", () => {
+    globalThis.expect(input["UserPoolId"]).toEqual("eu-west-1_abc123");
+  });
+  globalThis.test("Name is renamed to PoolName rather than dropped", () => {
+    globalThis.expect([
+      input["PoolName"],
+      input["Name"]
+    ]).toEqual([
+      "CustomerPool",
+      undefined
+    ]);
+  });
+  globalThis.test("read-only fields UpdateUserPool rejects are not sent", () => {
+    globalThis.expect([
+      "Id",
+      "Arn",
+      "Status",
+      "CreationDate",
+      "LastModifiedDate",
+      "SchemaAttributes",
+      "UsernameAttributes",
+      "EstimatedNumberOfUsers"
+    ].filter(k => Stdlib_Option.isSome(input[k]))).toEqual([]);
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — detaching", () => {
+  let input = merged(undefined);
+  globalThis.test("clearing removes our trigger", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["PreTokenGeneration"])).toEqual(undefined);
+  });
+  globalThis.test("clearing leaves the customer's own triggers alone", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["PreSignUp"])).toEqual("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp");
+  });
+  globalThis.test("clearing still sends the rest of the pool back whole", () => {
+    globalThis.expect(input["MfaConfiguration"]).toEqual("ON");
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool with nothing set", () => {
+  globalThis.test("a pool with no LambdaConfig gains one holding only our trigger", () => {
+    let input = Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(Object.fromEntries([[
+        "Name",
+        "Bare"
+      ]]), "eu-west-1_bare", triggerArn);
+    globalThis.expect(lambdaConfigOf(input)).toEqual(Object.fromEntries([[
+        "PreTokenGeneration",
+        triggerArn
+      ]]));
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
+  globalThis.test("reports the trigger a described pool carries", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(merged(triggerArn))).toEqual(triggerArn);
+  });
+  globalThis.test("reports none when the pool carries no trigger", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(Object.fromEntries([[
+        "Name",
+        "Bare"
+      ]]))).toEqual(undefined);
+  });
+});
+
+let Attachment;
+
+export {
+  Attachment,
+  str,
+  describedPool,
+  merged,
+  triggerArn,
+  lambdaConfigOf,
+}
+/*  Not a pure module */

package/tests/Auth_ActiveRoleStoreTest.res

@@ -0,0 +1,42 @@
+open JestGlobals
+
+// The subset rule on the Cognito path's write door, driven by the conformance
+// table in `ReventlessCore.Auth_ActiveRole`.
+//
+// That table is the shared artifact §6 of the plan calls for: the check itself is
+// written twice (this one runs in a resolver Lambda against an AppSync event, the
+// trigger's runs in Cognito's runtime against Cognito's event shape), so the cases
+// are what keeps the two from drifting on the question that carries the security.
+
+module Ops = Auth_ActiveRoleStore_Ops
+module Contract = ReventlessCore.Auth_ActiveRole
+
+describe("Auth_ActiveRoleStore_Ops.mayActAs — the conformance table", () => {
+  Contract.conformanceCases->Array.forEach(({label, membership, requested, expected}) =>
+    switch requested {
+    // "no role requested" has no subset decision to make — it is the clearing
+    // path, exercised against the handler rather than the predicate.
+    | None => ()
+    | Some(role) =>
+      testSync(label, () =>
+        expect(Ops.mayActAs(~membership, ~requested=role))->toBe(expected->Option.isSome)
+      )
+    }
+  )
+})
+
+// The table above is the contract; these are the properties it encodes, asserted
+// directly so a future edit that weakens a case is visible as a failure here too.
+describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () => {
+  testSync("a role outside membership is never permitted", () =>
+    expect(Ops.mayActAs(~membership=["Shopper"], ~requested="Admin"))->toBe(false)
+  )
+
+  testSync("membership is matched exactly, so no case folding widens it", () =>
+    expect(Ops.mayActAs(~membership=["Admin"], ~requested="ADMIN"))->toBe(false)
+  )
+
+  testSync("an empty membership permits nothing at all", () =>
+    expect(Ops.mayActAs(~membership=[], ~requested="Shopper"))->toBe(false)
+  )
+})

package/tests/Auth_ActiveRoleStoreTest.res.mjs

@@ -0,0 +1,41 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
+import * as Auth_ActiveRoleStore_Ops$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs";
+
+globalThis.describe("Auth_ActiveRoleStore_Ops.mayActAs — the conformance table", () => {
+  Auth_ActiveRole$ReventlessCore.conformanceCases.forEach(param => {
+    let requested = param.requested;
+    if (requested === undefined) {
+      return;
+    }
+    let expected = param.expected;
+    let membership = param.membership;
+    globalThis.test(param.label, () => {
+      globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.mayActAs(membership, requested)).toBe(Stdlib_Option.isSome(expected));
+    });
+  });
+});
+
+globalThis.describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () => {
+  globalThis.test("a role outside membership is never permitted", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.mayActAs(["Shopper"], "Admin")).toBe(false);
+  });
+  globalThis.test("membership is matched exactly, so no case folding widens it", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.mayActAs(["Admin"], "ADMIN")).toBe(false);
+  });
+  globalThis.test("an empty membership permits nothing at all", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.mayActAs([], "Shopper")).toBe(false);
+  });
+});
+
+let Ops;
+
+let Contract;
+
+export {
+  Ops,
+  Contract,
+}
+/*  Not a pure module */

package/tests/Auth_ActiveRoleTrigger_OpsTest.res

@@ -0,0 +1,169 @@
+open JestGlobals
+
+// The Cognito minting point, unit-tested with no pool attached to it. The
+// pre-token-generation event shape is fixed and documented, so the decision and
+// the response it produces are checkable before any pool exists — which is what
+// makes the attach step the only unknown left when it runs.
+
+module Trigger = Auth_ActiveRoleTrigger_Ops
+module Contract = ReventlessCore.Auth_ActiveRole
+
+let eventFor = (
+  ~membership: array<string>,
+  ~iamRoles: array<string>=[],
+  ~preferredRole: option<string>=?,
+): Trigger.event => {
+  request: {
+    userAttributes: {sub: "u-carol"},
+    groupConfiguration: {
+      groupsToOverride: membership,
+      iamRolesToOverride: iamRoles,
+      preferredRole: ?preferredRole->Option.map(Nullable.make),
+    },
+  },
+  userName: "carol",
+}
+
+let overrideOf = (e: Trigger.event) =>
+  e.response->Option.flatMap(r => r.claimsOverrideDetails)
+
+let groupsOf = (e: Trigger.event) =>
+  overrideOf(e)->Option.flatMap(c => c.groupOverrideDetails)->Option.map(g => g.groupsToOverride)
+
+let claimOf = (e: Trigger.event, key) =>
+  overrideOf(e)->Option.flatMap(c => c.claimsToAddOrOverride)->Option.flatMap(c => c->Dict.get(key))
+
+// ── The shared conformance table ──────────────────────────────────────────
+//
+// The same cases the local minting path runs (`LocalAuthLoginTest`). The two
+// implementations cannot be shared across a process boundary, so the table is
+// what keeps them from drifting.
+//
+// The cases expecting a **refusal** read differently here, and deliberately:
+// this path has no client to refuse — it is reading stored state on an ordinary
+// refresh with nobody asking for anything. It mints the full set instead. What
+// both paths must satisfy is the rule underneath: a role outside membership
+// never ends up in the group claim, and what the caller is left holding is
+// exactly what the pool granted.
+//
+// So the assertion is on the groups the token *ends up* carrying, not on how the
+// trigger got there — an absent override and an override naming the full set are
+// the same token. That an absent override really is absent (rather than an empty
+// one, which is not the same thing) is asserted separately below.
+
+let effectiveGroups = (e: Trigger.event, ~membership) =>
+  groupsOf(e)->Option.getOr(membership)
+
+describe("the conformance table, minted by the trigger", () => {
+  Contract.conformanceCases->Array.forEach(({label, membership, requested, expected}) =>
+    testSync(label, () => {
+      let event = Trigger.respond(
+        ~event=eventFor(~membership),
+        ~decision=Trigger.decide(~membership, ~storedRole=requested),
+      )
+      expect(effectiveGroups(event, ~membership))->toEqual(expected->Option.getOr(membership))
+    })
+  )
+})
+
+describe("Auth_ActiveRoleTrigger_Ops.decide", () => {
+  testSync("no stored role leaves the token alone", () =>
+    expect(Trigger.decide(~membership=["Admin"], ~storedRole=None))->toEqual(Trigger.Unchanged)
+  )
+
+  testSync("an empty stored role is the same as none, not a request for nothing", () =>
+    expect(Trigger.decide(~membership=["Admin"], ~storedRole=Some("")))->toEqual(Trigger.Unchanged)
+  )
+
+  testSync("a held role narrows", () =>
+    expect(
+      Trigger.decide(~membership=["Admin", "Shopper"], ~storedRole=Some("Shopper")),
+    )->toEqual(Trigger.Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}))
+  )
+
+  // The case the local path never had to answer: the row outlives the membership.
+  testSync("a role the pool no longer grants is stale, not applied", () =>
+    expect(Trigger.decide(~membership=["Shopper"], ~storedRole=Some("Admin")))->toEqual(
+      Trigger.Stale({role: "Admin", membership: ["Shopper"]}),
+    )
+  )
+})
+
+describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
+  // The regression line for the whole feature.
+  testSync("an unnarrowed refresh mints exactly what it minted before", () => {
+    let input = eventFor(~membership=["Admin", "Shopper"])
+    expect(Trigger.respond(~event=input, ~decision=Unchanged))->toEqual(input)
+  })
+
+  testSync("narrowing puts the chosen role alone in the group claim", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Admin", "Shopper"]),
+      ~decision=Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}),
+    )
+    expect(groupsOf(event))->toEqual(Some(["Shopper"]))
+  })
+
+  testSync("a narrowed token records the choice and what it gave up", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Admin", "Shopper"]),
+      ~decision=Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}),
+    )
+    expect((
+      claimOf(event, Contract.activeRoleClaim),
+      claimOf(event, Contract.availableRolesClaim),
+    ))->toEqual((Some("Shopper"), Some("Admin,Shopper")))
+  })
+
+  // "…and says so where it can be seen": without this the caller is silently
+  // un-narrowed with nothing to explain why their chosen role stopped applying.
+  testSync("a stale role mints the full set and marks itself as stale", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Shopper"]),
+      ~decision=Stale({role: "Admin", membership: ["Shopper"]}),
+    )
+    expect((groupsOf(event), claimOf(event, Contract.staleRoleClaim)))->toEqual((
+      Some(["Shopper"]),
+      Some("Admin"),
+    ))
+  })
+
+  testSync("a stale role is never the active role", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Shopper"]),
+      ~decision=Stale({role: "Admin", membership: ["Shopper"]}),
+    )
+    expect(claimOf(event, Contract.activeRoleClaim))->toEqual(None)
+  })
+
+  // 🚨 `groupOverrideDetails` replaces the whole group configuration. An override
+  // that names only `groupsToOverride` silently drops the other two — the same
+  // reset-by-omission shape `UpdateUserPool` has, and just as quiet.
+  testSync("narrowing carries the caller's IAM roles through untouched", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(
+        ~membership=["Admin", "Shopper"],
+        ~iamRoles=["arn:aws:iam::1:role/Shopper"],
+        ~preferredRole="arn:aws:iam::1:role/Shopper",
+      ),
+      ~decision=Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}),
+    )
+    let details = overrideOf(event)->Option.flatMap(c => c.groupOverrideDetails)
+    expect((
+      details->Option.map(d => d.iamRolesToOverride),
+      details->Option.flatMap(d => d.preferredRole),
+    ))->toEqual((Some(["arn:aws:iam::1:role/Shopper"]), Some(Nullable.make("arn:aws:iam::1:role/Shopper"))))
+  })
+
+  testSync("a stale mint carries them through too", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Shopper"], ~iamRoles=["arn:aws:iam::1:role/Shopper"]),
+      ~decision=Stale({role: "Admin", membership: ["Shopper"]}),
+    )
+    expect(
+      overrideOf(event)
+      ->Option.flatMap(c => c.groupOverrideDetails)
+      ->Option.map(d => d.iamRolesToOverride),
+    )->toEqual(Some(["arn:aws:iam::1:role/Shopper"]))
+  })
+})

package/tests/Auth_ActiveRoleTrigger_OpsTest.res.mjs

@@ -0,0 +1,189 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
+import * as Auth_ActiveRoleTrigger_Ops$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs";
+
+function eventFor(membership, iamRolesOpt, preferredRole) {
+  let iamRoles = iamRolesOpt !== undefined ? iamRolesOpt : [];
+  return {
+    request: {
+      userAttributes: {
+        sub: "u-carol"
+      },
+      groupConfiguration: {
+        groupsToOverride: membership,
+        iamRolesToOverride: iamRoles,
+        preferredRole: Stdlib_Option.map(preferredRole, prim => prim)
+      }
+    },
+    userName: "carol"
+  };
+}
+
+function overrideOf(e) {
+  return Stdlib_Option.flatMap(e.response, r => r.claimsOverrideDetails);
+}
+
+function groupsOf(e) {
+  return Stdlib_Option.map(Stdlib_Option.flatMap(overrideOf(e), c => c.groupOverrideDetails), g => g.groupsToOverride);
+}
+
+function claimOf(e, key) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(overrideOf(e), c => c.claimsToAddOrOverride), c => c[key]);
+}
+
+function effectiveGroups(e, membership) {
+  return Stdlib_Option.getOr(groupsOf(e), membership);
+}
+
+globalThis.describe("the conformance table, minted by the trigger", () => {
+  Auth_ActiveRole$ReventlessCore.conformanceCases.forEach(param => {
+    let expected = param.expected;
+    let requested = param.requested;
+    let membership = param.membership;
+    globalThis.test(param.label, () => {
+      let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor(membership, undefined, undefined), Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide(membership, requested));
+      globalThis.expect(Stdlib_Option.getOr(groupsOf(event), membership)).toEqual(Stdlib_Option.getOr(expected, membership));
+    });
+  });
+});
+
+globalThis.describe("Auth_ActiveRoleTrigger_Ops.decide", () => {
+  globalThis.test("no stored role leaves the token alone", () => {
+    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide(["Admin"], undefined)).toEqual("Unchanged");
+  });
+  globalThis.test("an empty stored role is the same as none, not a request for nothing", () => {
+    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide(["Admin"], "")).toEqual("Unchanged");
+  });
+  globalThis.test("a held role narrows", () => {
+    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide([
+      "Admin",
+      "Shopper"
+    ], "Shopper")).toEqual({
+      TAG: "Narrow",
+      role: "Shopper",
+      membership: [
+        "Admin",
+        "Shopper"
+      ]
+    });
+  });
+  globalThis.test("a role the pool no longer grants is stale, not applied", () => {
+    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide(["Shopper"], "Admin")).toEqual({
+      TAG: "Stale",
+      role: "Admin",
+      membership: ["Shopper"]
+    });
+  });
+});
+
+globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
+  globalThis.test("an unnarrowed refresh mints exactly what it minted before", () => {
+    let input = eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined);
+    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(input, "Unchanged")).toEqual(input);
+  });
+  globalThis.test("narrowing puts the chosen role alone in the group claim", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined), {
+      TAG: "Narrow",
+      role: "Shopper",
+      membership: [
+        "Admin",
+        "Shopper"
+      ]
+    });
+    globalThis.expect(groupsOf(event)).toEqual(["Shopper"]);
+  });
+  globalThis.test("a narrowed token records the choice and what it gave up", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined), {
+      TAG: "Narrow",
+      role: "Shopper",
+      membership: [
+        "Admin",
+        "Shopper"
+      ]
+    });
+    globalThis.expect([
+      claimOf(event, Auth_ActiveRole$ReventlessCore.activeRoleClaim),
+      claimOf(event, Auth_ActiveRole$ReventlessCore.availableRolesClaim)
+    ]).toEqual([
+      "Shopper",
+      "Admin,Shopper"
+    ]);
+  });
+  globalThis.test("a stale role mints the full set and marks itself as stale", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor(["Shopper"], undefined, undefined), {
+      TAG: "Stale",
+      role: "Admin",
+      membership: ["Shopper"]
+    });
+    globalThis.expect([
+      groupsOf(event),
+      claimOf(event, Auth_ActiveRole$ReventlessCore.staleRoleClaim)
+    ]).toEqual([
+      ["Shopper"],
+      "Admin"
+    ]);
+  });
+  globalThis.test("a stale role is never the active role", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor(["Shopper"], undefined, undefined), {
+      TAG: "Stale",
+      role: "Admin",
+      membership: ["Shopper"]
+    });
+    globalThis.expect(claimOf(event, Auth_ActiveRole$ReventlessCore.activeRoleClaim)).toEqual(undefined);
+  });
+  globalThis.test("narrowing carries the caller's IAM roles through untouched", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
+      "Admin",
+      "Shopper"
+    ], ["arn:aws:iam::1:role/Shopper"], "arn:aws:iam::1:role/Shopper"), {
+      TAG: "Narrow",
+      role: "Shopper",
+      membership: [
+        "Admin",
+        "Shopper"
+      ]
+    });
+    let details = Stdlib_Option.flatMap(overrideOf(event), c => c.groupOverrideDetails);
+    globalThis.expect([
+      Stdlib_Option.map(details, d => d.iamRolesToOverride),
+      Stdlib_Option.flatMap(details, d => d.preferredRole)
+    ]).toEqual([
+      ["arn:aws:iam::1:role/Shopper"],
+      "arn:aws:iam::1:role/Shopper"
+    ]);
+  });
+  globalThis.test("a stale mint carries them through too", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor(["Shopper"], ["arn:aws:iam::1:role/Shopper"], undefined), {
+      TAG: "Stale",
+      role: "Admin",
+      membership: ["Shopper"]
+    });
+    globalThis.expect(Stdlib_Option.map(Stdlib_Option.flatMap(overrideOf(event), c => c.groupOverrideDetails), d => d.iamRolesToOverride)).toEqual(["arn:aws:iam::1:role/Shopper"]);
+  });
+});
+
+let Trigger;
+
+let Contract;
+
+export {
+  Trigger,
+  Contract,
+  eventFor,
+  overrideOf,
+  groupsOf,
+  claimOf,
+  effectiveGroups,
+}
+/*  Not a pure module */