@reventlessdev/reventless-aws 3.0.0-alpha.293 → 3.0.0-alpha.295

package/tests/AppSync_SdlDecorateTest.res

@@ -31,7 +31,7 @@ type Mutation {
 type Subscription {
   onCatalog_AddProduct(id: ID): CommandResult
   onUIFragmentChange: UIFragmentChangeEvent
-    @aws_auth(cognito_groups: ["Admin"])
+    @aws_cognito_user_pools(cognito_groups: ["Admin"])
   onCatalogEventLog_eventAppended: CatalogEventLogEvent
 }`
 
@@ -43,13 +43,13 @@ describe("AppSync_SdlDecorate.injectAwsSubscribe", () => {
     )
   })
 
-  testSync("appends the many-mutations fan-in on a no-arg field, keeping @aws_auth", () => {
+  testSync("appends the many-mutations fan-in on a no-arg field, keeping the group directive", () => {
     let sdl = AppSync_SdlDecorate.injectAwsSubscribe(stitchedSdl, ~sources)
     expect(sdl)->toContain(
       `onUIFragmentChange: UIFragmentChangeEvent\n    @aws_subscribe(mutations: ["Platform_UIFragmentRegistered", "Platform_UIFragmentUpdated", "Platform_UIFragmentDeregistered"])`,
     )
     // The auth directive line appended by injectAwsAuthAll survives.
-    expect(sdl)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(sdl)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
   })
 
   testSync("leaves unmapped fields (Source A) and non-Subscription blocks untouched", () => {
@@ -113,7 +113,7 @@ describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
     expect(parts.mutations->Array.getUnsafe(0))->toContain("@aws_iam")
     // A query NOT in iamFieldNames stays Cognito-only.
     let other = queryField("Other_Query")
-    expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(other)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     expect(other->String.includes("@aws_iam"))->toBe(false)
   })
 })

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -35,7 +35,7 @@ type Mutation {
 type Subscription {
   onCatalog_AddProduct(id: ID): CommandResult
   onUIFragmentChange: UIFragmentChangeEvent
-    @aws_auth(cognito_groups: ["Admin"])
+    @aws_cognito_user_pools(cognito_groups: ["Admin"])
   onCatalogEventLog_eventAppended: CatalogEventLogEvent
 }`;
 
@@ -44,10 +44,10 @@ globalThis.describe("AppSync_SdlDecorate.injectAwsSubscribe", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
     globalThis.expect(sdl).toContain(`onCatalog_AddProduct(id: ID): CommandResult\n    @aws_subscribe(mutations: ["Catalog_AddProduct"])`);
   });
-  globalThis.test("appends the many-mutations fan-in on a no-arg field, keeping @aws_auth", () => {
+  globalThis.test("appends the many-mutations fan-in on a no-arg field, keeping the group directive", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
     globalThis.expect(sdl).toContain(`onUIFragmentChange: UIFragmentChangeEvent\n    @aws_subscribe(mutations: ["Platform_UIFragmentRegistered", "Platform_UIFragmentUpdated", "Platform_UIFragmentDeregistered"])`);
-    globalThis.expect(sdl).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(sdl).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
   });
   globalThis.test("leaves unmapped fields (Source A) and non-Subscription blocks untouched", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
@@ -100,7 +100,7 @@ globalThis.describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
     globalThis.expect(queryField("Platform_ApiFragments")).toContain("@aws_iam");
     globalThis.expect(parts.mutations[0]).toContain("@aws_iam");
     let other = queryField("Other_Query");
-    globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(other).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     globalThis.expect(other.includes("@aws_iam")).toBe(false);
   });
 });

package/tests/Auth_ActiveRolePoolAttachmentTest.res

@@ -209,3 +209,77 @@ describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
     )
   )
 })
+
+// The pre-attach check. Its whole job is to keep a trigger that cannot run off a
+// live pool, because a pre-token-generation trigger that throws does not degrade
+// the feature — it fails every sign-in for every user of that pool.
+describe("Auth_ActiveRolePoolAttachment.probeVerdict", () => {
+  // The real payload from the outage this check exists to prevent: the function
+  // could not resolve a package at module load, so it died during init and never
+  // reached its handler. Nothing inside the handler could have caught this.
+  let initFailurePayload = `{"errorType":"Error","errorMessage":"Cannot find package '@reventlessdev/reventless-core' imported from /var/task/node_modules/@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs","code":"ERR_MODULE_NOT_FOUND"}`
+
+  testSync("refuses a function that died before reaching its handler", () =>
+    expect(
+      Attachment.probeVerdict(~functionError=Some("Unhandled"), ~payload=initFailurePayload),
+    )->toEqual(Attachment.Crashed("Unhandled"))
+  )
+
+  testSync("accepts a function that hands the event back", () =>
+    expect(
+      Attachment.probeVerdict(
+        ~functionError=None,
+        ~payload=`{"request":{"groupConfiguration":{"groupsToOverride":[]}},"response":{}}`,
+      ),
+    )->toEqual(Attachment.Healthy)
+  )
+
+  // A 200 carrying the wrong shape is as fatal to sign-in as a throw, and far
+  // easier to mistake for success.
+  testSync("refuses a successful call that returns something else", () =>
+    expect(Attachment.probeVerdict(~functionError=None, ~payload=`{"ok":true}`))->toEqual(
+      Attachment.NotAnEvent,
+    )
+  )
+
+  // Produces a verdict rather than escaping: a parse error here would fail the
+  // deploy with a message about JSON instead of about the trigger.
+  testSync("treats an unparseable payload as not an event", () =>
+    expect(Attachment.probeVerdict(~functionError=None, ~payload="<html>502</html>"))->toEqual(
+      Attachment.NotAnEvent,
+    )
+  )
+
+  testSync("treats an empty payload as not an event", () =>
+    expect(Attachment.probeVerdict(~functionError=None, ~payload=""))->toEqual(
+      Attachment.NotAnEvent,
+    )
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.probeEvent", () => {
+  let event = Attachment.probeEvent(~userPoolId="eu-west-1_Example")->JSON.Decode.object
+
+  testSync("is shaped like the V1_0 event Cognito sends", () =>
+    expect(
+      event
+      ->Option.flatMap(o => o->Dict.get("request"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.isSome,
+    )->toBe(true)
+  )
+
+  // Empty membership and a subject that cannot exist: the probe checks that the
+  // function runs, not what it decides, and must not collide with a real row.
+  testSync("presents no groups to narrow", () =>
+    expect(
+      event
+      ->Option.flatMap(o => o->Dict.get("request"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(r => r->Dict.get("groupConfiguration"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(g => g->Dict.get("groupsToOverride"))
+      ->Option.flatMap(JSON.Decode.array),
+    )->toEqual(Some([]))
+  )
+})

package/tests/Auth_ActiveRolePoolAttachmentTest.res.mjs

@@ -219,6 +219,37 @@ globalThis.describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
   });
 });
 
+globalThis.describe("Auth_ActiveRolePoolAttachment.probeVerdict", () => {
+  globalThis.test("refuses a function that died before reaching its handler", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict("Unhandled", `{"errorType":"Error","errorMessage":"Cannot find package '@reventlessdev/reventless-core' imported from /var/task/node_modules/@reventlessdev/reventless-aws/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs","code":"ERR_MODULE_NOT_FOUND"}`)).toEqual({
+      TAG: "Crashed",
+      _0: "Unhandled"
+    });
+  });
+  globalThis.test("accepts a function that hands the event back", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict(undefined, `{"request":{"groupConfiguration":{"groupsToOverride":[]}},"response":{}}`)).toEqual("Healthy");
+  });
+  globalThis.test("refuses a successful call that returns something else", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict(undefined, `{"ok":true}`)).toEqual("NotAnEvent");
+  });
+  globalThis.test("treats an unparseable payload as not an event", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict(undefined, "<html>502</html>")).toEqual("NotAnEvent");
+  });
+  globalThis.test("treats an empty payload as not an event", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeVerdict(undefined, "")).toEqual("NotAnEvent");
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.probeEvent", () => {
+  let event = Stdlib_JSON.Decode.object(Auth_ActiveRolePoolAttachment$ReventlessAws.probeEvent("eu-west-1_Example"));
+  globalThis.test("is shaped like the V1_0 event Cognito sends", () => {
+    globalThis.expect(Stdlib_Option.isSome(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event, o => o["request"]), Stdlib_JSON.Decode.object))).toBe(true);
+  });
+  globalThis.test("presents no groups to narrow", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event, o => o["request"]), Stdlib_JSON.Decode.object), r => r["groupConfiguration"]), Stdlib_JSON.Decode.object), g => g["groupsToOverride"]), Stdlib_JSON.Decode.array)).toEqual([]);
+  });
+});
+
 let Attachment;
 
 export {