@reventlessdev/reventless-aws 3.0.0-alpha.305 → 3.0.0-alpha.307

package/tests/AppSync_RetirementNarrowingTest.res

@@ -0,0 +1,272 @@
+// The DynamoDB backend narrows retirement on every door the rule names, not
+// only on the list.
+//
+// These assert the *generated resolver source*, which is the only artifact that
+// exists before a deploy: the predicate runs inside AppSync's JS runtime, so a
+// unit test cannot execute it against a table, and what can be checked here is
+// that each door carries the guard, in the half of the template its operation
+// allows, and that a view declaring no retirement is untouched.
+
+open JestGlobals
+
+module F = AppSync_Resolver_Retrying.Functions
+
+// The templates are `Pulumi.Input.t<string>` — a string at rest, wrapped for the
+// provider. Read it back as one so the assertions can be about text.
+external asString: Pulumi.Input.t<string> => string = "%identity"
+
+let elevated = ["Admin"]
+
+// A product view: retired by two states of its lifecycle, unowned.
+let shelf = (~includeOwner: bool) =>
+  F.getItemById(
+    ~ownerField=?includeOwner ? Some("customerId") : None,
+    ~elevatedGroups=elevated,
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived", "Discontinued"],
+  )->asString
+
+describe("the single-entity door", () => {
+  testSync("withholds a retired row until an exempt caller asks", () => {
+    let code = shelf(~includeOwner=false)
+    expect(code->String.includes("const _wantsRetired = _exempt && ctx.args.includeRetired === true"))
+    ->Expect.toBe(true)
+    expect(code->String.includes("_live(ctx.result) ? ctx.result : null"))->Expect.toBe(true)
+  })
+
+  // Absent attribute keeps the row: a row written before the annotation existed
+  // is not retired, which is what stops a view emptying the day it lands.
+  testSync("reads a missing attribute as not retired", () =>
+    expect(shelf(~includeOwner=false)->String.includes("row['shelfStatus'] == null"))->Expect.toBe(true)
+  )
+
+  testSync("tests membership of the retiring states, not equality with one", () =>
+    expect(
+      shelf(~includeOwner=false)->String.includes(
+        "['Archived', 'Discontinued'].indexOf(row['shelfStatus']) >= 0",
+      ),
+    )->Expect.toBe(true)
+  )
+
+  // Two `const _exempt` in one function body is a syntax error, so the owner
+  // preamble's copy is the only one when both guards are present.
+  testSync("declares the exemption test once when owner scoping is also on", () => {
+    let code = shelf(~includeOwner=true)
+    let occurrences =
+      code->String.split("const _exempt =")->Array.length - 1
+    expect((occurrences, code->String.includes("_owns(ctx.result) && _live(ctx.result)")))
+    ->Expect.toEqual((1, true))
+  })
+
+  testSync("is unchanged for a view that declares no retirement", () => {
+    let code = F.getItemById(~elevatedGroups=elevated)->asString
+    expect((code->String.includes("_wantsRetired"), code->String.includes("includeRetired")))
+    ->Expect.toEqual((false, false))
+  })
+})
+
+describe("the by-ids door", () => {
+  let code = F.batchGetItemsByIds(
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived"],
+    ~elevatedGroups=elevated,
+  )("ProductsTable")
+
+  // BatchGetItem has no FilterExpression, so the predicate is a filter over what
+  // came back — beside the null-drop the non-null list type already needs.
+  testSync("drops retired rows from the returned array", () =>
+    expect(code->String.includes("item !== null && _live(item)"))->Expect.toBe(true)
+  )
+
+  testSync("still names the table it batches against", () =>
+    expect(code->String.includes("ctx.result?.data?.['ProductsTable']"))->Expect.toBe(true)
+  )
+
+  testSync("is unchanged for a view that declares no retirement", () =>
+    expect(F.batchGetItemsByIds()("ProductsTable")->String.includes("_live"))
+    ->Expect.toBe(false)
+  )
+})
+
+describe("the by-index door", () => {
+  let code = F.queryByIndexFiltered(
+    ~index="byCategory",
+    ~idField="categoryId",
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived", "Discontinued"],
+    ~elevatedGroups=elevated,
+  )->asString
+
+  // A Query takes a FilterExpression, so the predicate is pushed into the read.
+  // Narrowing after it would hand back fewer rows than `limit` asked for and say
+  // nothing about why.
+  testSync("pushes the predicate into the FilterExpression", () => {
+    expect(code->String.includes("names['#retired'] = 'shelfStatus'"))->Expect.toBe(true)
+    expect(
+      code->String.includes(
+        "attribute_not_exists(#retired) OR (#retired <> :retiredValue0 AND #retired <> :retiredValue1)",
+      ),
+    )->Expect.toBe(true)
+  })
+
+  // It composes with the caller's own filter arguments rather than replacing them.
+  testSync("ANDs onto an expression the caller may already have built", () =>
+    expect(code->String.includes("if (expression) expression += ' AND '"))->Expect.toBe(true)
+  )
+
+  testSync("is unchanged for a view that declares no retirement", () =>
+    expect(
+      F.queryByIndexFiltered(~index="byCategory", ~idField="categoryId")
+      ->asString
+      ->String.includes("#retired"),
+    )->Expect.toBe(false)
+  )
+})
+
+describe("the boolean form", () => {
+  testSync("tests the flag rather than a set of states", () => {
+    let code =
+      F.getItemById(~elevatedGroups=elevated, ~retiredField="archived")->asString
+    expect((
+      code->String.includes("row['archived'] === true"),
+      code->String.includes("indexOf(row["),
+    ))->Expect.toEqual((true, false))
+  })
+})
+
+// ── Ownership, on the two doors that never had it ────────────────────────────
+
+describe("the by-ids door's owner scoping", () => {
+  let code = F.batchGetItemsByIds(
+    ~ownerField="customerId",
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived"],
+    ~elevatedGroups=elevated,
+  )("Orders")
+
+  // Dropped from the array rather than refused, for the reason the single-key
+  // door answers null: telling "not yours" apart from "not there" makes the door
+  // an oracle for which ids exist.
+  testSync("drops a row the caller does not own", () =>
+    expect(code->String.includes("item !== null && _owns(item) && _live(item)"))->Expect.toBe(true)
+  )
+
+  testSync("declares the exemption test once, shared with the retirement guard", () =>
+    expect(code->String.split("const _exempt =")->Array.length - 1)->Expect.toBe(1)
+  )
+
+  testSync("is unchanged for a view with neither rule", () => {
+    let plain = F.batchGetItemsByIds()("Orders")
+    expect((plain->String.includes("_owns"), plain->String.includes("_live")))
+    ->Expect.toEqual((false, false))
+  })
+})
+
+describe("the by-index door's owner scoping", () => {
+  let code = F.queryByIndexFiltered(
+    ~index="byCategory",
+    ~idField="categoryId",
+    ~ownerField="customerId",
+    ~elevatedGroups=elevated,
+  )->asString
+
+  testSync("pushes the owner predicate into the read", () =>
+    expect(code->String.includes("names['#owner'] = 'customerId'"))->Expect.toBe(true)
+  )
+
+  // The predicate must not be readable off the arguments: a rule about what the
+  // caller may see cannot arrive on a channel the caller controls.
+  testSync("reads the owner from the identity, never from ctx.args", () =>
+    expect(code->String.includes("values[':owner'] = _osub"))->Expect.toBe(true)
+  )
+
+  testSync("exempts an elevated caller and an IAM service call", () =>
+    expect(
+      code->String.includes("if (!(_osub == null || _ogroups.some(g => _oelevated.indexOf(g) >= 0)))"),
+    )->Expect.toBe(true)
+  )
+
+  // The generic argument loop turns an unrecognised arg into a `contains` filter.
+  // `includeRetired` is a request to lift a restriction, and filtering on it
+  // would match no row at all.
+  testSync("never treats includeRetired as a column to match on", () =>
+    expect(code->String.includes("key === 'includeRetired'"))->Expect.toBe(true)
+  )
+})
+
+// The by-index door was, until this landed, unreachable rather than merely
+// un-widenable: the SDL declared `id` while the template below read the index
+// key, and the template answered with DynamoDB's `{items, nextToken}` against a
+// field that promised a Connection. These assert the two halves that were wrong,
+// beside the paging arguments the field actually offers.
+describe("the by-index door answers the field it is attached to", () => {
+  let code =
+    F.queryByIndexFiltered(~index="byCategory", ~idField="categoryId")->asString
+
+  testSync("keys the read on the index column the SDL offers", () =>
+    expect(code->String.includes("util.dynamodb.toDynamoDB(args.categoryId)"))->Expect.toBe(true)
+  )
+
+  testSync("returns a Relay connection, not the raw DynamoDB result", () =>
+    expect((
+      code->String.includes("edges,"),
+      code->String.includes("hasNextPage: !!next"),
+      code->String.includes("return ctx.result;"),
+    ))->Expect.toEqual((true, true, false))
+  )
+
+  // `first`/`after` are what the field declares; `limit`/`nextToken` were what
+  // the template read, and nothing translated between the two.
+  testSync("pages on the Relay arguments the field declares", () =>
+    expect((
+      code->String.includes("limit: (args.first ?? 50)"),
+      code->String.includes("util.base64Decode(args.after)"),
+    ))->Expect.toEqual((true, true))
+  )
+
+  // Every declared argument has a job other than matching a column, so each one
+  // reaching the generic filter loop would filter on an attribute no row has.
+  testSync("keeps every paging argument out of the filter loop", () =>
+    expect(
+      ["first", "after", "last", "before", "includeRetired"]->Array.every(arg =>
+        code->String.includes(`key === '${arg}'`)
+      ),
+    )->Expect.toBe(true)
+  )
+})
+
+// Backward paging is refused rather than ignored. The cursor is DynamoDB's own
+// continuation token, which walks one way, so `last: 2` could only ever be
+// answered with the first two rows — a different question, answered silently.
+// `listAllItemsConnection` set this rule; the local backend refuses with the
+// same sentence, so the door reads the same either side of a deploy.
+describe("the by-index door's backward paging", () => {
+  let refusal = "Backward pagination (last/before) is not supported on by-index connections"
+
+  testSync("refuses last/before on the plain index read", () =>
+    expect(
+      F.queryByIndexFiltered(~index="byCategory", ~idField="categoryId")
+      ->asString
+      ->String.includes(refusal),
+    )->Expect.toBe(true)
+  )
+
+  testSync("refuses them on the sort-key index read too", () =>
+    expect(
+      F.queryByIndexSortFiltered(~index="byCustomer", ~idField="customerId", ~sortField="placedAt")
+      ->asString
+      ->String.includes(refusal),
+    )->Expect.toBe(true)
+  )
+
+  // Before the key condition is built, so a refused request never reaches the
+  // read — and `util.error` is what AppSync returns to the caller as the field
+  // error, rather than an empty page that looks like an answer.
+  testSync("refuses before doing any work, and says so to the caller", () => {
+    let code = F.queryByIndexFiltered(~index="byCategory", ~idField="categoryId")->asString
+    let guardAt = code->String.indexOf("args.before != null")
+    let queryAt = code->String.indexOf("expressionValues")
+    expect((guardAt >= 0 && guardAt < queryAt, code->String.includes("'UnsupportedPagination'")))
+    ->Expect.toEqual((true, true))
+  })
+})

package/tests/AppSync_RetirementNarrowingTest.res.mjs

@@ -0,0 +1,193 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
+
+let elevated = ["Admin"];
+
+function shelf(includeOwner) {
+  return AppSync_Resolver_Functions$PulumiAws.getItemById(includeOwner ? "customerId" : undefined, elevated, "shelfStatus", [
+    "Archived",
+    "Discontinued"
+  ]);
+}
+
+globalThis.describe("the single-entity door", () => {
+  globalThis.test("withholds a retired row until an exempt caller asks", () => {
+    let code = shelf(false);
+    globalThis.expect(code.includes("const _wantsRetired = _exempt && ctx.args.includeRetired === true")).toBe(true);
+    globalThis.expect(code.includes("_live(ctx.result) ? ctx.result : null")).toBe(true);
+  });
+  globalThis.test("reads a missing attribute as not retired", () => {
+    globalThis.expect(shelf(false).includes("row['shelfStatus'] == null")).toBe(true);
+  });
+  globalThis.test("tests membership of the retiring states, not equality with one", () => {
+    globalThis.expect(shelf(false).includes("['Archived', 'Discontinued'].indexOf(row['shelfStatus']) >= 0")).toBe(true);
+  });
+  globalThis.test("declares the exemption test once when owner scoping is also on", () => {
+    let code = shelf(true);
+    let occurrences = code.split("const _exempt =").length - 1 | 0;
+    globalThis.expect([
+      occurrences,
+      code.includes("_owns(ctx.result) && _live(ctx.result)")
+    ]).toEqual([
+      1,
+      true
+    ]);
+  });
+  globalThis.test("is unchanged for a view that declares no retirement", () => {
+    let code = AppSync_Resolver_Functions$PulumiAws.getItemById(undefined, elevated, undefined, undefined);
+    globalThis.expect([
+      code.includes("_wantsRetired"),
+      code.includes("includeRetired")
+    ]).toEqual([
+      false,
+      false
+    ]);
+  });
+});
+
+globalThis.describe("the by-ids door", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds(undefined, "shelfStatus", ["Archived"], elevated)("ProductsTable");
+  globalThis.test("drops retired rows from the returned array", () => {
+    globalThis.expect(code.includes("item !== null && _live(item)")).toBe(true);
+  });
+  globalThis.test("still names the table it batches against", () => {
+    globalThis.expect(code.includes("ctx.result?.data?.['ProductsTable']")).toBe(true);
+  });
+  globalThis.test("is unchanged for a view that declares no retirement", () => {
+    globalThis.expect(AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds(undefined, undefined, undefined, undefined)("ProductsTable").includes("_live")).toBe(false);
+  });
+});
+
+globalThis.describe("the by-index door", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, "shelfStatus", [
+    "Archived",
+    "Discontinued"
+  ], elevated);
+  globalThis.test("pushes the predicate into the FilterExpression", () => {
+    globalThis.expect(code.includes("names['#retired'] = 'shelfStatus'")).toBe(true);
+    globalThis.expect(code.includes("attribute_not_exists(#retired) OR (#retired <> :retiredValue0 AND #retired <> :retiredValue1)")).toBe(true);
+  });
+  globalThis.test("ANDs onto an expression the caller may already have built", () => {
+    globalThis.expect(code.includes("if (expression) expression += ' AND '")).toBe(true);
+  });
+  globalThis.test("is unchanged for a view that declares no retirement", () => {
+    globalThis.expect(AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, undefined, undefined, undefined).includes("#retired")).toBe(false);
+  });
+});
+
+globalThis.describe("the boolean form", () => {
+  globalThis.test("tests the flag rather than a set of states", () => {
+    let code = AppSync_Resolver_Functions$PulumiAws.getItemById(undefined, elevated, "archived", undefined);
+    globalThis.expect([
+      code.includes("row['archived'] === true"),
+      code.includes("indexOf(row[")
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+});
+
+globalThis.describe("the by-ids door's owner scoping", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds("customerId", "shelfStatus", ["Archived"], elevated)("Orders");
+  globalThis.test("drops a row the caller does not own", () => {
+    globalThis.expect(code.includes("item !== null && _owns(item) && _live(item)")).toBe(true);
+  });
+  globalThis.test("declares the exemption test once, shared with the retirement guard", () => {
+    globalThis.expect(code.split("const _exempt =").length - 1 | 0).toBe(1);
+  });
+  globalThis.test("is unchanged for a view with neither rule", () => {
+    let plain = AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds(undefined, undefined, undefined, undefined)("Orders");
+    globalThis.expect([
+      plain.includes("_owns"),
+      plain.includes("_live")
+    ]).toEqual([
+      false,
+      false
+    ]);
+  });
+});
+
+globalThis.describe("the by-index door's owner scoping", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", "customerId", undefined, undefined, elevated);
+  globalThis.test("pushes the owner predicate into the read", () => {
+    globalThis.expect(code.includes("names['#owner'] = 'customerId'")).toBe(true);
+  });
+  globalThis.test("reads the owner from the identity, never from ctx.args", () => {
+    globalThis.expect(code.includes("values[':owner'] = _osub")).toBe(true);
+  });
+  globalThis.test("exempts an elevated caller and an IAM service call", () => {
+    globalThis.expect(code.includes("if (!(_osub == null || _ogroups.some(g => _oelevated.indexOf(g) >= 0)))")).toBe(true);
+  });
+  globalThis.test("never treats includeRetired as a column to match on", () => {
+    globalThis.expect(code.includes("key === 'includeRetired'")).toBe(true);
+  });
+});
+
+globalThis.describe("the by-index door answers the field it is attached to", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, undefined, undefined, undefined);
+  globalThis.test("keys the read on the index column the SDL offers", () => {
+    globalThis.expect(code.includes("util.dynamodb.toDynamoDB(args.categoryId)")).toBe(true);
+  });
+  globalThis.test("returns a Relay connection, not the raw DynamoDB result", () => {
+    globalThis.expect([
+      code.includes("edges,"),
+      code.includes("hasNextPage: !!next"),
+      code.includes("return ctx.result;")
+    ]).toEqual([
+      true,
+      true,
+      false
+    ]);
+  });
+  globalThis.test("pages on the Relay arguments the field declares", () => {
+    globalThis.expect([
+      code.includes("limit: (args.first ?? 50)"),
+      code.includes("util.base64Decode(args.after)")
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
+  globalThis.test("keeps every paging argument out of the filter loop", () => {
+    globalThis.expect([
+      "first",
+      "after",
+      "last",
+      "before",
+      "includeRetired"
+    ].every(arg => code.includes(`key === '` + arg + `'`))).toBe(true);
+  });
+});
+
+globalThis.describe("the by-index door's backward paging", () => {
+  let refusal = "Backward pagination (last/before) is not supported on by-index connections";
+  globalThis.test("refuses last/before on the plain index read", () => {
+    globalThis.expect(AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, undefined, undefined, undefined).includes(refusal)).toBe(true);
+  });
+  globalThis.test("refuses them on the sort-key index read too", () => {
+    globalThis.expect(AppSync_Resolver_Functions$PulumiAws.queryByIndexSortFiltered("byCustomer", "customerId", undefined, "placedAt", undefined, undefined, undefined).includes(refusal)).toBe(true);
+  });
+  globalThis.test("refuses before doing any work, and says so to the caller", () => {
+    let code = AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, undefined, undefined, undefined);
+    let guardAt = code.indexOf("args.before != null");
+    let queryAt = code.indexOf("expressionValues");
+    globalThis.expect([
+      guardAt >= 0 && guardAt < queryAt,
+      code.includes("'UnsupportedPagination'")
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
+});
+
+let F;
+
+export {
+  F,
+  elevated,
+  shelf,
+}
+/*  Not a pure module */

package/tests/Auth_ActiveRolePoolAttachmentTest.res

@@ -76,6 +76,11 @@ let triggerArn = "arn:aws:lambda:eu-west-1:1:function:ActiveRoleTrigger"
 let lambdaConfigOf = input =>
   input->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
 
+/** The `PreTokenGenerationConfig` an attach is expected to write: our ARN, at the
+    only version the trigger handler implements. */
+let v1Config = arn =>
+  Dict.fromArray([("LambdaArn", str(arn)), ("LambdaVersion", str("V1_0"))])->JSON.Encode.object
+
 describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — settings survive the attach", () => {
   let input = merged(~preTokenGenerationArn=Some(triggerArn))
 
@@ -192,8 +197,105 @@ describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool with nothin
       ~preTokenGenerationArn=Some(triggerArn),
     )
     expect(lambdaConfigOf(input))->toEqual(
-      Some(Dict.fromArray([("PreTokenGeneration", str(triggerArn))])),
+      Some(
+        Dict.fromArray([
+          ("PreTokenGeneration", str(triggerArn)),
+          ("PreTokenGenerationConfig", v1Config(triggerArn)),
+        ]),
+      ),
+    )
+  })
+})
+
+// 🚨 The pool shape that took the deploy down. Cognito carries this one trigger
+// in two fields, and `UpdateUserPool` rejects the call when both are present
+// naming different functions. Nothing in this suite carried a
+// `PreTokenGenerationConfig` before, which is exactly why it shipped.
+describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool already on the V2 field", () => {
+  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken"
+
+  let describedWithConfig = (~version) =>
+    Dict.fromArray([
+      ("Name", str("CustomerPool")),
+      (
+        "LambdaConfig",
+        Dict.fromArray([
+          ("PreSignUp", str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+          ("PreTokenGeneration", str(theirArn)),
+          (
+            "PreTokenGenerationConfig",
+            Dict.fromArray([
+              ("LambdaArn", str(theirArn)),
+              ("LambdaVersion", str(version)),
+            ])->JSON.Encode.object,
+          ),
+        ])->JSON.Encode.object,
+      ),
+    ])
+
+  let attachOnto = (~version) =>
+    Attachment.mergedUpdateInput(
+      ~described=describedWithConfig(~version),
+      ~userPoolId="eu-west-1_abc123",
+      ~preTokenGenerationArn=Some(triggerArn),
+    )
+
+  // The property AWS enforces, asserted directly rather than through its error
+  // text: the two fields must name the same function.
+  testSync("both fields name our trigger, and the same one", () => {
+    let config = lambdaConfigOf(attachOnto(~version="V1_0"))
+    expect((
+      config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
+      config
+      ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(c => c->Dict.get("LambdaArn")),
+    ))->toEqual((Some(str(triggerArn)), Some(str(triggerArn))))
+  })
+
+  // A pool left on V2_0 does not fail — the handler answers in V1_0 shape and
+  // Cognito ignores it, so tokens mint un-narrowed and nothing reports it.
+  testSync("a pool that arrived on V2_0 is pinned back to the version we implement", () =>
+    expect(
+      lambdaConfigOf(attachOnto(~version="V2_0"))
+      ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(c => c->Dict.get("LambdaVersion")),
+    )->toEqual(Some(str("V1_0")))
+  )
+
+  testSync("the customer's other triggers still survive", () =>
+    expect(
+      lambdaConfigOf(attachOnto(~version="V1_0"))->Option.flatMap(c => c->Dict.get("PreSignUp")),
+    )->toEqual(Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")))
+  )
+
+  testSync("detaching removes both fields, not just the legacy one", () => {
+    let config = lambdaConfigOf(
+      Attachment.mergedUpdateInput(
+        ~described=describedWithConfig(~version="V1_0"),
+        ~userPoolId="eu-west-1_abc123",
+        ~preTokenGenerationArn=None,
+      ),
+    )
+    expect((
+      config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
+      config->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig")),
+    ))->toEqual((None, None))
+  })
+
+  // The fixpoint property, and the one that would have caught this: AWS
+  // materialises whichever field the merge did not write, so the merge has to
+  // accept its own output unchanged or a later deploy fails with nothing altered
+  // but the service normalising its own record.
+  testSync("feeding the merge its own output back changes nothing", () => {
+    let once = attachOnto(~version="V1_0")
+    let twice = Attachment.mergedUpdateInput(
+      ~described=once,
+      ~userPoolId="eu-west-1_abc123",
+      ~preTokenGenerationArn=Some(triggerArn),
     )
+    expect(lambdaConfigOf(twice))->toEqual(lambdaConfigOf(once))
   })
 })
 
@@ -208,6 +310,43 @@ describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
       None,
     )
   )
+
+  testSync("reads the V2 field on a pool that only carries that one", () =>
+    expect(
+      Attachment.attachedTrigger(
+        ~described=Dict.fromArray([
+          (
+            "LambdaConfig",
+            Dict.fromArray([("PreTokenGenerationConfig", v1Config(triggerArn))])->JSON.Encode.object,
+          ),
+        ]),
+      ),
+    )->toEqual(Some(triggerArn))
+  )
+
+  // Our own ARN, at a version the handler does not speak. Reporting it as
+  // attached would leave a pool minting un-narrowed tokens looking correct
+  // forever; reporting none makes it drift the next `up` repairs.
+  testSync("reports none for our trigger held at a version we do not implement", () =>
+    expect(
+      Attachment.attachedTrigger(
+        ~described=Dict.fromArray([
+          (
+            "LambdaConfig",
+            Dict.fromArray([
+              (
+                "PreTokenGenerationConfig",
+                Dict.fromArray([
+                  ("LambdaArn", str(triggerArn)),
+                  ("LambdaVersion", str("V2_0")),
+                ])->JSON.Encode.object,
+              ),
+            ])->JSON.Encode.object,
+          ),
+        ]),
+      ),
+    )->toEqual(None)
+  )
 })
 
 // The pre-attach check. Its whole job is to keep a trigger that cannot run off a