@reventlessdev/reventless-aws 3.0.0-alpha.292 → 3.0.0-alpha.294

package/tests/Auth_ActiveRolePoolAttachmentTest.res

@@ -0,0 +1,285 @@
+open JestGlobals
+
+// 🚨 The test §6 of the plan asks for, and the one that matters most in this
+// feature: `UpdateUserPool` requires "a value for all parameters that you don't
+// want set to a default value". An attach that sends only `LambdaConfig`
+// silently returns every other setting on the pool to its default — on a pool
+// the framework did not create and whose configuration it never described.
+//
+// So the assertions below are all the same assertion: a pool carrying
+// non-default settings still carries them afterwards. The merge is a pure
+// function precisely so this is checkable against a pool the test did not
+// create, which is the case the merge exists for.
+
+module Attachment = Auth_ActiveRolePoolAttachment
+
+let str = JSON.Encode.string
+
+// A pool that is nothing like a fresh one: MFA on, a deletion guard, a custom
+// verification message, two triggers already attached, tags, and a paid tier.
+//
+// The key set mirrors what `DescribeUserPool` actually returns for a live pool,
+// including `IssuerConfiguration` / `KeyConfiguration` — informational fields
+// that are *not* members of `UpdateUserPool`. The merge carries them and the SDK
+// drops them during serialisation, which is why they are harmless; they are here
+// so a future edit that starts filtering on this list has a real shape to filter.
+let describedPool = () =>
+  Dict.fromArray([
+    ("Id", str("eu-west-1_abc123")),
+    ("Name", str("CustomerPool")),
+    ("Arn", str("arn:aws:cognito-idp:eu-west-1:1:userpool/eu-west-1_abc123")),
+    ("Status", str("Enabled")),
+    ("CreationDate", str("2020-01-01T00:00:00Z")),
+    ("LastModifiedDate", str("2024-01-01T00:00:00Z")),
+    ("SchemaAttributes", JSON.Encode.array([str("email")])),
+    ("UsernameAttributes", JSON.Encode.array([str("email")])),
+    ("EstimatedNumberOfUsers", JSON.Encode.int(4200)),
+    ("IssuerConfiguration", Dict.fromArray([("IssuerUri", str("https://x"))])->JSON.Encode.object),
+    ("KeyConfiguration", Dict.fromArray([("KmsKeyId", str("k-1"))])->JSON.Encode.object),
+    // A paid tier silently reverting to Lite would be a billing- and
+    // capability-level regression, and one nothing in the deploy would report.
+    ("UserPoolTier", str("PLUS")),
+    ("MfaConfiguration", str("ON")),
+    ("DeletionProtection", str("ACTIVE")),
+    ("EmailVerificationMessage", str("Your code is {####}, do not share it")),
+    (
+      "Policies",
+      Dict.fromArray([
+        (
+          "PasswordPolicy",
+          Dict.fromArray([("MinimumLength", JSON.Encode.int(24))])->JSON.Encode.object,
+        ),
+      ])->JSON.Encode.object,
+    ),
+    (
+      "UserPoolTags",
+      Dict.fromArray([("CostCentre", str("identity"))])->JSON.Encode.object,
+    ),
+    (
+      "LambdaConfig",
+      Dict.fromArray([
+        ("PreSignUp", str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+        ("CustomMessage", str("arn:aws:lambda:eu-west-1:1:function:TheirCustomMessage")),
+      ])->JSON.Encode.object,
+    ),
+  ])
+
+let merged = (~preTokenGenerationArn) =>
+  Attachment.mergedUpdateInput(
+    ~described=describedPool(),
+    ~userPoolId="eu-west-1_abc123",
+    ~preTokenGenerationArn,
+  )
+
+let triggerArn = "arn:aws:lambda:eu-west-1:1:function:ActiveRoleTrigger"
+
+let lambdaConfigOf = input =>
+  input->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
+
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
+  let input = merged(~preTokenGenerationArn=Some(triggerArn))
+
+  testSync("MFA stays on rather than defaulting off", () =>
+    expect(input->Dict.get("MfaConfiguration"))->toEqual(Some(str("ON")))
+  )
+
+  testSync("deletion protection stays active", () =>
+    expect(input->Dict.get("DeletionProtection"))->toEqual(Some(str("ACTIVE")))
+  )
+
+  testSync("a customised verification message is not reset", () =>
+    expect(input->Dict.get("EmailVerificationMessage"))->toEqual(
+      Some(str("Your code is {####}, do not share it")),
+    )
+  )
+
+  testSync("the password policy travels whole", () =>
+    expect(
+      input
+      ->Dict.get("Policies")
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(p => p->Dict.get("PasswordPolicy"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(p => p->Dict.get("MinimumLength")),
+    )->toEqual(Some(JSON.Encode.int(24)))
+  )
+
+  testSync("tags are not dropped", () =>
+    expect(
+      input
+      ->Dict.get("UserPoolTags")
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(t => t->Dict.get("CostCentre")),
+    )->toEqual(Some(str("identity")))
+  )
+
+  testSync("a paid tier is not reverted to Lite", () =>
+    expect(input->Dict.get("UserPoolTier"))->toEqual(Some(str("PLUS")))
+  )
+
+  // The reset hazard one level down: replacing the whole `LambdaConfig` with a
+  // single-key object would silently detach every trigger the customer had.
+  testSync("the pool's existing triggers stay attached", () =>
+    expect((
+      lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("PreSignUp")),
+      lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("CustomMessage")),
+    ))->toEqual((
+      Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+      Some(str("arn:aws:lambda:eu-west-1:1:function:TheirCustomMessage")),
+    ))
+  )
+
+  testSync("and ours is added beside them", () =>
+    expect(lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("PreTokenGeneration")))->toEqual(
+      Some(str(triggerArn)),
+    )
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — shaping for the API", () => {
+  let input = merged(~preTokenGenerationArn=Some(triggerArn))
+
+  testSync("UserPoolId names the pool being updated", () =>
+    expect(input->Dict.get("UserPoolId"))->toEqual(Some(str("eu-west-1_abc123")))
+  )
+
+  // DescribeUserPool returns `Name`; UpdateUserPool takes `PoolName`. Sending
+  // `Name` is rejected, and omitting the rename would rename the pool by default.
+  testSync("Name is renamed to PoolName rather than dropped", () =>
+    expect((input->Dict.get("PoolName"), input->Dict.get("Name")))->toEqual((
+      Some(str("CustomerPool")),
+      None,
+    ))
+  )
+
+  testSync("read-only fields UpdateUserPool rejects are not sent", () =>
+    expect(
+      ["Id", "Arn", "Status", "CreationDate", "LastModifiedDate", "SchemaAttributes",
+       "UsernameAttributes", "EstimatedNumberOfUsers"]->Array.filter(k =>
+        input->Dict.get(k)->Option.isSome
+      ),
+    )->toEqual([])
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — detaching", () => {
+  let input = merged(~preTokenGenerationArn=None)
+
+  // Destroy has to detach, or the pool is left pointing at a deleted function and
+  // every sign-in fails — on a pool nothing in this deployment would ever fix.
+  testSync("clearing removes our trigger", () =>
+    expect(lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("PreTokenGeneration")))->toEqual(
+      None,
+    )
+  )
+
+  testSync("clearing leaves the customer's own triggers alone", () =>
+    expect(lambdaConfigOf(input)->Option.flatMap(c => c->Dict.get("PreSignUp")))->toEqual(
+      Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+    )
+  )
+
+  testSync("clearing still sends the rest of the pool back whole", () =>
+    expect(input->Dict.get("MfaConfiguration"))->toEqual(Some(str("ON")))
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool with nothing set", () => {
+  testSync("a pool with no LambdaConfig gains one holding only our trigger", () => {
+    let input = Attachment.mergedUpdateInput(
+      ~described=Dict.fromArray([("Name", str("Bare"))]),
+      ~userPoolId="eu-west-1_bare",
+      ~preTokenGenerationArn=Some(triggerArn),
+    )
+    expect(lambdaConfigOf(input))->toEqual(
+      Some(Dict.fromArray([("PreTokenGeneration", str(triggerArn))])),
+    )
+  })
+})
+
+describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
+  testSync("reports the trigger a described pool carries", () =>
+    expect(Attachment.attachedTrigger(~described=merged(~preTokenGenerationArn=Some(triggerArn))))
+    ->toEqual(Some(triggerArn))
+  )
+
+  testSync("reports none when the pool carries no trigger", () =>
+    expect(Attachment.attachedTrigger(~described=Dict.fromArray([("Name", str("Bare"))])))->toEqual(
+      None,
+    )
+  )
+})
+
+// The pre-attach check. Its whole job is to keep a trigger that cannot run off a
+// live pool, because a pre-token-generation trigger that throws does not degrade
+// the feature — it fails every sign-in for every user of that pool.
+describe("Auth_ActiveRolePoolAttachment.probeVerdict", () => {
+  // The real payload from the outage this check exists to prevent: the function
+  // could not resolve a package at module load, so it died during init and never
+  // reached its handler. Nothing inside the handler could have caught this.
+  let initFailurePayload = `{"errorType":"Error","errorMessage":"Cannot find package '@reventlessdev/reventless-core' imported from /var/task/node_modules/@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs","code":"ERR_MODULE_NOT_FOUND"}`
+
+  testSync("refuses a function that died before reaching its handler", () =>
+    expect(
+      Attachment.probeVerdict(~functionError=Some("Unhandled"), ~payload=initFailurePayload),
+    )->toEqual(Attachment.Crashed("Unhandled"))
+  )
+
+  testSync("accepts a function that hands the event back", () =>
+    expect(
+      Attachment.probeVerdict(
+        ~functionError=None,
+        ~payload=`{"request":{"groupConfiguration":{"groupsToOverride":[]}},"response":{}}`,
+      ),
+    )->toEqual(Attachment.Healthy)
+  )
+
+  // A 200 carrying the wrong shape is as fatal to sign-in as a throw, and far
+  // easier to mistake for success.
+  testSync("refuses a successful call that returns something else", () =>
+    expect(Attachment.probeVerdict(~functionError=None, ~payload=`{"ok":true}`))->toEqual(
+      Attachment.NotAnEvent,
+    )
+  )
+
+  // Produces a verdict rather than escaping: a parse error here would fail the
+  // deploy with a message about JSON instead of about the trigger.
+  testSync("treats an unparseable payload as not an event", () =>
+    expect(Attachment.probeVerdict(~functionError=None, ~payload="<html>502</html>"))->toEqual(
+      Attachment.NotAnEvent,
+    )
+  )
+
+  testSync("treats an empty payload as not an event", () =>
+    expect(Attachment.probeVerdict(~functionError=None, ~payload=""))->toEqual(
+      Attachment.NotAnEvent,
+    )
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.probeEvent", () => {
+  let event = Attachment.probeEvent(~userPoolId="eu-west-1_Example")->JSON.Decode.object
+
+  testSync("is shaped like the V1_0 event Cognito sends", () =>
+    expect(
+      event
+      ->Option.flatMap(o => o->Dict.get("request"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.isSome,
+    )->toBe(true)
+  )
+
+  // Empty membership and a subject that cannot exist: the probe checks that the
+  // function runs, not what it decides, and must not collide with a real row.
+  testSync("presents no groups to narrow", () =>
+    expect(
+      event
+      ->Option.flatMap(o => o->Dict.get("request"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(r => r->Dict.get("groupConfiguration"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(g => g->Dict.get("groupsToOverride"))
+      ->Option.flatMap(JSON.Decode.array),
+    )->toEqual(Some([]))
+  )
+})

package/tests/Auth_ActiveRolePoolAttachmentTest.res.mjs

@@ -0,0 +1,263 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_ActiveRolePoolAttachment$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRolePoolAttachment.res.mjs";
+
+function str(prim) {
+  return prim;
+}
+
+function describedPool() {
+  return Object.fromEntries([
+    [
+      "Id",
+      "eu-west-1_abc123"
+    ],
+    [
+      "Name",
+      "CustomerPool"
+    ],
+    [
+      "Arn",
+      "arn:aws:cognito-idp:eu-west-1:1:userpool/eu-west-1_abc123"
+    ],
+    [
+      "Status",
+      "Enabled"
+    ],
+    [
+      "CreationDate",
+      "2020-01-01T00:00:00Z"
+    ],
+    [
+      "LastModifiedDate",
+      "2024-01-01T00:00:00Z"
+    ],
+    [
+      "SchemaAttributes",
+      ["email"]
+    ],
+    [
+      "UsernameAttributes",
+      ["email"]
+    ],
+    [
+      "EstimatedNumberOfUsers",
+      4200
+    ],
+    [
+      "IssuerConfiguration",
+      Object.fromEntries([[
+          "IssuerUri",
+          "https://x"
+        ]])
+    ],
+    [
+      "KeyConfiguration",
+      Object.fromEntries([[
+          "KmsKeyId",
+          "k-1"
+        ]])
+    ],
+    [
+      "UserPoolTier",
+      "PLUS"
+    ],
+    [
+      "MfaConfiguration",
+      "ON"
+    ],
+    [
+      "DeletionProtection",
+      "ACTIVE"
+    ],
+    [
+      "EmailVerificationMessage",
+      "Your code is {####}, do not share it"
+    ],
+    [
+      "Policies",
+      Object.fromEntries([[
+          "PasswordPolicy",
+          Object.fromEntries([[
+              "MinimumLength",
+              24
+            ]])
+        ]])
+    ],
+    [
+      "UserPoolTags",
+      Object.fromEntries([[
+          "CostCentre",
+          "identity"
+        ]])
+    ],
+    [
+      "LambdaConfig",
+      Object.fromEntries([
+        [
+          "PreSignUp",
+          "arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp"
+        ],
+        [
+          "CustomMessage",
+          "arn:aws:lambda:eu-west-1:1:function:TheirCustomMessage"
+        ]
+      ])
+    ]
+  ]);
+}
+
+function merged(preTokenGenerationArn) {
+  return Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(describedPool(), "eu-west-1_abc123", preTokenGenerationArn);
+}
+
+let triggerArn = "arn:aws:lambda:eu-west-1:1:function:ActiveRoleTrigger";
+
+function lambdaConfigOf(input) {
+  return Stdlib_Option.flatMap(input["LambdaConfig"], Stdlib_JSON.Decode.object);
+}
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
+  let input = merged(triggerArn);
+  globalThis.test("MFA stays on rather than defaulting off", () => {
+    globalThis.expect(input["MfaConfiguration"]).toEqual("ON");
+  });
+  globalThis.test("deletion protection stays active", () => {
+    globalThis.expect(input["DeletionProtection"]).toEqual("ACTIVE");
+  });
+  globalThis.test("a customised verification message is not reset", () => {
+    globalThis.expect(input["EmailVerificationMessage"]).toEqual("Your code is {####}, do not share it");
+  });
+  globalThis.test("the password policy travels whole", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(input["Policies"], Stdlib_JSON.Decode.object), p => p["PasswordPolicy"]), Stdlib_JSON.Decode.object), p => p["MinimumLength"])).toEqual(24);
+  });
+  globalThis.test("tags are not dropped", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(input["UserPoolTags"], Stdlib_JSON.Decode.object), t => t["CostCentre"])).toEqual("identity");
+  });
+  globalThis.test("a paid tier is not reverted to Lite", () => {
+    globalThis.expect(input["UserPoolTier"]).toEqual("PLUS");
+  });
+  globalThis.test("the pool's existing triggers stay attached", () => {
+    globalThis.expect([
+      Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["PreSignUp"]),
+      Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["CustomMessage"])
+    ]).toEqual([
+      "arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp",
+      "arn:aws:lambda:eu-west-1:1:function:TheirCustomMessage"
+    ]);
+  });
+  globalThis.test("and ours is added beside them", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["PreTokenGeneration"])).toEqual(triggerArn);
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — shaping for the API", () => {
+  let input = merged(triggerArn);
+  globalThis.test("UserPoolId names the pool being updated", () => {
+    globalThis.expect(input["UserPoolId"]).toEqual("eu-west-1_abc123");
+  });
+  globalThis.test("Name is renamed to PoolName rather than dropped", () => {
+    globalThis.expect([
+      input["PoolName"],
+      input["Name"]
+    ]).toEqual([
+      "CustomerPool",
+      undefined
+    ]);
+  });
+  globalThis.test("read-only fields UpdateUserPool rejects are not sent", () => {
+    globalThis.expect([
+      "Id",
+      "Arn",
+      "Status",
+      "CreationDate",
+      "LastModifiedDate",
+      "SchemaAttributes",
+      "UsernameAttributes",
+      "EstimatedNumberOfUsers"
+    ].filter(k => Stdlib_Option.isSome(input[k]))).toEqual([]);
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — detaching", () => {
+  let input = merged(undefined);
+  globalThis.test("clearing removes our trigger", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["PreTokenGeneration"])).toEqual(undefined);
+  });
+  globalThis.test("clearing leaves the customer's own triggers alone", () => {
+    globalThis.expect(Stdlib_Option.flatMap(lambdaConfigOf(input), c => c["PreSignUp"])).toEqual("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp");
+  });
+  globalThis.test("clearing still sends the rest of the pool back whole", () => {
+    globalThis.expect(input["MfaConfiguration"]).toEqual("ON");
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool with nothing set", () => {
+  globalThis.test("a pool with no LambdaConfig gains one holding only our trigger", () => {
+    let input = Auth_ActiveRolePoolAttachment$ReventlessAws.mergedUpdateInput(Object.fromEntries([[
+        "Name",
+        "Bare"
+      ]]), "eu-west-1_bare", triggerArn);
+    globalThis.expect(lambdaConfigOf(input)).toEqual(Object.fromEntries([[
+        "PreTokenGeneration",
+        triggerArn
+      ]]));
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
+  globalThis.test("reports the trigger a described pool carries", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(merged(triggerArn))).toEqual(triggerArn);
+  });
+  globalThis.test("reports none when the pool carries no trigger", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(Object.fromEntries([[
+        "Name",
+        "Bare"
+      ]]))).toEqual(undefined);
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.probeVerdict", () => {
+  globalThis.test("refuses a function that died before reaching its handler", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict("Unhandled", `{"errorType":"Error","errorMessage":"Cannot find package '@reventlessdev/reventless-core' imported from /var/task/node_modules/@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs","code":"ERR_MODULE_NOT_FOUND"}`)).toEqual({
+      TAG: "Crashed",
+      _0: "Unhandled"
+    });
+  });
+  globalThis.test("accepts a function that hands the event back", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict(undefined, `{"request":{"groupConfiguration":{"groupsToOverride":[]}},"response":{}}`)).toEqual("Healthy");
+  });
+  globalThis.test("refuses a successful call that returns something else", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict(undefined, `{"ok":true}`)).toEqual("NotAnEvent");
+  });
+  globalThis.test("treats an unparseable payload as not an event", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict(undefined, "<html>502</html>")).toEqual("NotAnEvent");
+  });
+  globalThis.test("treats an empty payload as not an event", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict(undefined, "")).toEqual("NotAnEvent");
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.probeEvent", () => {
+  let event = Stdlib_JSON.Decode.object(Auth_ActiveRolePoolAttachment$ReventlessAws.probeEvent("eu-west-1_Example"));
+  globalThis.test("is shaped like the V1_0 event Cognito sends", () => {
+    globalThis.expect(Stdlib_Option.isSome(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event, o => o["request"]), Stdlib_JSON.Decode.object))).toBe(true);
+  });
+  globalThis.test("presents no groups to narrow", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event, o => o["request"]), Stdlib_JSON.Decode.object), r => r["groupConfiguration"]), Stdlib_JSON.Decode.object), g => g["groupsToOverride"]), Stdlib_JSON.Decode.array)).toEqual([]);
+  });
+});
+
+let Attachment;
+
+export {
+  Attachment,
+  str,
+  describedPool,
+  merged,
+  triggerArn,
+  lambdaConfigOf,
+}
+/*  Not a pure module */

package/tests/Auth_ActiveRoleStoreTest.res

@@ -0,0 +1,42 @@
+open JestGlobals
+
+// The subset rule on the Cognito path's write door, driven by the conformance
+// table in `ReventlessCore.Auth_ActiveRole`.
+//
+// That table is the shared artifact §6 of the plan calls for: the check itself is
+// written twice (this one runs in a resolver Lambda against an AppSync event, the
+// trigger's runs in Cognito's runtime against Cognito's event shape), so the cases
+// are what keeps the two from drifting on the question that carries the security.
+
+module Ops = Auth_ActiveRoleStore_Ops
+module Contract = ReventlessCore.Auth_ActiveRole
+
+describe("Auth_ActiveRoleStore_Ops.mayActAs — the conformance table", () => {
+  Contract.conformanceCases->Array.forEach(({label, membership, requested, expected}) =>
+    switch requested {
+    // "no role requested" has no subset decision to make — it is the clearing
+    // path, exercised against the handler rather than the predicate.
+    | None => ()
+    | Some(role) =>
+      testSync(label, () =>
+        expect(Ops.mayActAs(~membership, ~requested=role))->toBe(expected->Option.isSome)
+      )
+    }
+  )
+})
+
+// The table above is the contract; these are the properties it encodes, asserted
+// directly so a future edit that weakens a case is visible as a failure here too.
+describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () => {
+  testSync("a role outside membership is never permitted", () =>
+    expect(Ops.mayActAs(~membership=["Shopper"], ~requested="Admin"))->toBe(false)
+  )
+
+  testSync("membership is matched exactly, so no case folding widens it", () =>
+    expect(Ops.mayActAs(~membership=["Admin"], ~requested="ADMIN"))->toBe(false)
+  )
+
+  testSync("an empty membership permits nothing at all", () =>
+    expect(Ops.mayActAs(~membership=[], ~requested="Shopper"))->toBe(false)
+  )
+})

package/tests/Auth_ActiveRoleStoreTest.res.mjs

@@ -0,0 +1,41 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
+import * as Auth_ActiveRoleStore_Ops$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs";
+
+globalThis.describe("Auth_ActiveRoleStore_Ops.mayActAs — the conformance table", () => {
+  Auth_ActiveRole$ReventlessCore.conformanceCases.forEach(param => {
+    let requested = param.requested;
+    if (requested === undefined) {
+      return;
+    }
+    let expected = param.expected;
+    let membership = param.membership;
+    globalThis.test(param.label, () => {
+      globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.mayActAs(membership, requested)).toBe(Stdlib_Option.isSome(expected));
+    });
+  });
+});
+
+globalThis.describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () => {
+  globalThis.test("a role outside membership is never permitted", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.mayActAs(["Shopper"], "Admin")).toBe(false);
+  });
+  globalThis.test("membership is matched exactly, so no case folding widens it", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.mayActAs(["Admin"], "ADMIN")).toBe(false);
+  });
+  globalThis.test("an empty membership permits nothing at all", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.mayActAs([], "Shopper")).toBe(false);
+  });
+});
+
+let Ops;
+
+let Contract;
+
+export {
+  Ops,
+  Contract,
+}
+/*  Not a pure module */