@reventlessdev/reventless-aws 3.0.0-alpha.306 → 3.0.0-alpha.307

package/tests/AppSync_RetirementNarrowingTest.res

@@ -0,0 +1,272 @@
+// The DynamoDB backend narrows retirement on every door the rule names, not
+// only on the list.
+//
+// These assert the *generated resolver source*, which is the only artifact that
+// exists before a deploy: the predicate runs inside AppSync's JS runtime, so a
+// unit test cannot execute it against a table, and what can be checked here is
+// that each door carries the guard, in the half of the template its operation
+// allows, and that a view declaring no retirement is untouched.
+
+open JestGlobals
+
+module F = AppSync_Resolver_Retrying.Functions
+
+// The templates are `Pulumi.Input.t<string>` — a string at rest, wrapped for the
+// provider. Read it back as one so the assertions can be about text.
+external asString: Pulumi.Input.t<string> => string = "%identity"
+
+let elevated = ["Admin"]
+
+// A product view: retired by two states of its lifecycle, unowned.
+let shelf = (~includeOwner: bool) =>
+  F.getItemById(
+    ~ownerField=?includeOwner ? Some("customerId") : None,
+    ~elevatedGroups=elevated,
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived", "Discontinued"],
+  )->asString
+
+describe("the single-entity door", () => {
+  testSync("withholds a retired row until an exempt caller asks", () => {
+    let code = shelf(~includeOwner=false)
+    expect(code->String.includes("const _wantsRetired = _exempt && ctx.args.includeRetired === true"))
+    ->Expect.toBe(true)
+    expect(code->String.includes("_live(ctx.result) ? ctx.result : null"))->Expect.toBe(true)
+  })
+
+  // Absent attribute keeps the row: a row written before the annotation existed
+  // is not retired, which is what stops a view emptying the day it lands.
+  testSync("reads a missing attribute as not retired", () =>
+    expect(shelf(~includeOwner=false)->String.includes("row['shelfStatus'] == null"))->Expect.toBe(true)
+  )
+
+  testSync("tests membership of the retiring states, not equality with one", () =>
+    expect(
+      shelf(~includeOwner=false)->String.includes(
+        "['Archived', 'Discontinued'].indexOf(row['shelfStatus']) >= 0",
+      ),
+    )->Expect.toBe(true)
+  )
+
+  // Two `const _exempt` in one function body is a syntax error, so the owner
+  // preamble's copy is the only one when both guards are present.
+  testSync("declares the exemption test once when owner scoping is also on", () => {
+    let code = shelf(~includeOwner=true)
+    let occurrences =
+      code->String.split("const _exempt =")->Array.length - 1
+    expect((occurrences, code->String.includes("_owns(ctx.result) && _live(ctx.result)")))
+    ->Expect.toEqual((1, true))
+  })
+
+  testSync("is unchanged for a view that declares no retirement", () => {
+    let code = F.getItemById(~elevatedGroups=elevated)->asString
+    expect((code->String.includes("_wantsRetired"), code->String.includes("includeRetired")))
+    ->Expect.toEqual((false, false))
+  })
+})
+
+describe("the by-ids door", () => {
+  let code = F.batchGetItemsByIds(
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived"],
+    ~elevatedGroups=elevated,
+  )("ProductsTable")
+
+  // BatchGetItem has no FilterExpression, so the predicate is a filter over what
+  // came back — beside the null-drop the non-null list type already needs.
+  testSync("drops retired rows from the returned array", () =>
+    expect(code->String.includes("item !== null && _live(item)"))->Expect.toBe(true)
+  )
+
+  testSync("still names the table it batches against", () =>
+    expect(code->String.includes("ctx.result?.data?.['ProductsTable']"))->Expect.toBe(true)
+  )
+
+  testSync("is unchanged for a view that declares no retirement", () =>
+    expect(F.batchGetItemsByIds()("ProductsTable")->String.includes("_live"))
+    ->Expect.toBe(false)
+  )
+})
+
+describe("the by-index door", () => {
+  let code = F.queryByIndexFiltered(
+    ~index="byCategory",
+    ~idField="categoryId",
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived", "Discontinued"],
+    ~elevatedGroups=elevated,
+  )->asString
+
+  // A Query takes a FilterExpression, so the predicate is pushed into the read.
+  // Narrowing after it would hand back fewer rows than `limit` asked for and say
+  // nothing about why.
+  testSync("pushes the predicate into the FilterExpression", () => {
+    expect(code->String.includes("names['#retired'] = 'shelfStatus'"))->Expect.toBe(true)
+    expect(
+      code->String.includes(
+        "attribute_not_exists(#retired) OR (#retired <> :retiredValue0 AND #retired <> :retiredValue1)",
+      ),
+    )->Expect.toBe(true)
+  })
+
+  // It composes with the caller's own filter arguments rather than replacing them.
+  testSync("ANDs onto an expression the caller may already have built", () =>
+    expect(code->String.includes("if (expression) expression += ' AND '"))->Expect.toBe(true)
+  )
+
+  testSync("is unchanged for a view that declares no retirement", () =>
+    expect(
+      F.queryByIndexFiltered(~index="byCategory", ~idField="categoryId")
+      ->asString
+      ->String.includes("#retired"),
+    )->Expect.toBe(false)
+  )
+})
+
+describe("the boolean form", () => {
+  testSync("tests the flag rather than a set of states", () => {
+    let code =
+      F.getItemById(~elevatedGroups=elevated, ~retiredField="archived")->asString
+    expect((
+      code->String.includes("row['archived'] === true"),
+      code->String.includes("indexOf(row["),
+    ))->Expect.toEqual((true, false))
+  })
+})
+
+// ── Ownership, on the two doors that never had it ────────────────────────────
+
+describe("the by-ids door's owner scoping", () => {
+  let code = F.batchGetItemsByIds(
+    ~ownerField="customerId",
+    ~retiredField="shelfStatus",
+    ~retiredValues=["Archived"],
+    ~elevatedGroups=elevated,
+  )("Orders")
+
+  // Dropped from the array rather than refused, for the reason the single-key
+  // door answers null: telling "not yours" apart from "not there" makes the door
+  // an oracle for which ids exist.
+  testSync("drops a row the caller does not own", () =>
+    expect(code->String.includes("item !== null && _owns(item) && _live(item)"))->Expect.toBe(true)
+  )
+
+  testSync("declares the exemption test once, shared with the retirement guard", () =>
+    expect(code->String.split("const _exempt =")->Array.length - 1)->Expect.toBe(1)
+  )
+
+  testSync("is unchanged for a view with neither rule", () => {
+    let plain = F.batchGetItemsByIds()("Orders")
+    expect((plain->String.includes("_owns"), plain->String.includes("_live")))
+    ->Expect.toEqual((false, false))
+  })
+})
+
+describe("the by-index door's owner scoping", () => {
+  let code = F.queryByIndexFiltered(
+    ~index="byCategory",
+    ~idField="categoryId",
+    ~ownerField="customerId",
+    ~elevatedGroups=elevated,
+  )->asString
+
+  testSync("pushes the owner predicate into the read", () =>
+    expect(code->String.includes("names['#owner'] = 'customerId'"))->Expect.toBe(true)
+  )
+
+  // The predicate must not be readable off the arguments: a rule about what the
+  // caller may see cannot arrive on a channel the caller controls.
+  testSync("reads the owner from the identity, never from ctx.args", () =>
+    expect(code->String.includes("values[':owner'] = _osub"))->Expect.toBe(true)
+  )
+
+  testSync("exempts an elevated caller and an IAM service call", () =>
+    expect(
+      code->String.includes("if (!(_osub == null || _ogroups.some(g => _oelevated.indexOf(g) >= 0)))"),
+    )->Expect.toBe(true)
+  )
+
+  // The generic argument loop turns an unrecognised arg into a `contains` filter.
+  // `includeRetired` is a request to lift a restriction, and filtering on it
+  // would match no row at all.
+  testSync("never treats includeRetired as a column to match on", () =>
+    expect(code->String.includes("key === 'includeRetired'"))->Expect.toBe(true)
+  )
+})
+
+// The by-index door was, until this landed, unreachable rather than merely
+// un-widenable: the SDL declared `id` while the template below read the index
+// key, and the template answered with DynamoDB's `{items, nextToken}` against a
+// field that promised a Connection. These assert the two halves that were wrong,
+// beside the paging arguments the field actually offers.
+describe("the by-index door answers the field it is attached to", () => {
+  let code =
+    F.queryByIndexFiltered(~index="byCategory", ~idField="categoryId")->asString
+
+  testSync("keys the read on the index column the SDL offers", () =>
+    expect(code->String.includes("util.dynamodb.toDynamoDB(args.categoryId)"))->Expect.toBe(true)
+  )
+
+  testSync("returns a Relay connection, not the raw DynamoDB result", () =>
+    expect((
+      code->String.includes("edges,"),
+      code->String.includes("hasNextPage: !!next"),
+      code->String.includes("return ctx.result;"),
+    ))->Expect.toEqual((true, true, false))
+  )
+
+  // `first`/`after` are what the field declares; `limit`/`nextToken` were what
+  // the template read, and nothing translated between the two.
+  testSync("pages on the Relay arguments the field declares", () =>
+    expect((
+      code->String.includes("limit: (args.first ?? 50)"),
+      code->String.includes("util.base64Decode(args.after)"),
+    ))->Expect.toEqual((true, true))
+  )
+
+  // Every declared argument has a job other than matching a column, so each one
+  // reaching the generic filter loop would filter on an attribute no row has.
+  testSync("keeps every paging argument out of the filter loop", () =>
+    expect(
+      ["first", "after", "last", "before", "includeRetired"]->Array.every(arg =>
+        code->String.includes(`key === '${arg}'`)
+      ),
+    )->Expect.toBe(true)
+  )
+})
+
+// Backward paging is refused rather than ignored. The cursor is DynamoDB's own
+// continuation token, which walks one way, so `last: 2` could only ever be
+// answered with the first two rows — a different question, answered silently.
+// `listAllItemsConnection` set this rule; the local backend refuses with the
+// same sentence, so the door reads the same either side of a deploy.
+describe("the by-index door's backward paging", () => {
+  let refusal = "Backward pagination (last/before) is not supported on by-index connections"
+
+  testSync("refuses last/before on the plain index read", () =>
+    expect(
+      F.queryByIndexFiltered(~index="byCategory", ~idField="categoryId")
+      ->asString
+      ->String.includes(refusal),
+    )->Expect.toBe(true)
+  )
+
+  testSync("refuses them on the sort-key index read too", () =>
+    expect(
+      F.queryByIndexSortFiltered(~index="byCustomer", ~idField="customerId", ~sortField="placedAt")
+      ->asString
+      ->String.includes(refusal),
+    )->Expect.toBe(true)
+  )
+
+  // Before the key condition is built, so a refused request never reaches the
+  // read — and `util.error` is what AppSync returns to the caller as the field
+  // error, rather than an empty page that looks like an answer.
+  testSync("refuses before doing any work, and says so to the caller", () => {
+    let code = F.queryByIndexFiltered(~index="byCategory", ~idField="categoryId")->asString
+    let guardAt = code->String.indexOf("args.before != null")
+    let queryAt = code->String.indexOf("expressionValues")
+    expect((guardAt >= 0 && guardAt < queryAt, code->String.includes("'UnsupportedPagination'")))
+    ->Expect.toEqual((true, true))
+  })
+})

package/tests/AppSync_RetirementNarrowingTest.res.mjs

@@ -0,0 +1,193 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
+
+let elevated = ["Admin"];
+
+function shelf(includeOwner) {
+  return AppSync_Resolver_Functions$PulumiAws.getItemById(includeOwner ? "customerId" : undefined, elevated, "shelfStatus", [
+    "Archived",
+    "Discontinued"
+  ]);
+}
+
+globalThis.describe("the single-entity door", () => {
+  globalThis.test("withholds a retired row until an exempt caller asks", () => {
+    let code = shelf(false);
+    globalThis.expect(code.includes("const _wantsRetired = _exempt && ctx.args.includeRetired === true")).toBe(true);
+    globalThis.expect(code.includes("_live(ctx.result) ? ctx.result : null")).toBe(true);
+  });
+  globalThis.test("reads a missing attribute as not retired", () => {
+    globalThis.expect(shelf(false).includes("row['shelfStatus'] == null")).toBe(true);
+  });
+  globalThis.test("tests membership of the retiring states, not equality with one", () => {
+    globalThis.expect(shelf(false).includes("['Archived', 'Discontinued'].indexOf(row['shelfStatus']) >= 0")).toBe(true);
+  });
+  globalThis.test("declares the exemption test once when owner scoping is also on", () => {
+    let code = shelf(true);
+    let occurrences = code.split("const _exempt =").length - 1 | 0;
+    globalThis.expect([
+      occurrences,
+      code.includes("_owns(ctx.result) && _live(ctx.result)")
+    ]).toEqual([
+      1,
+      true
+    ]);
+  });
+  globalThis.test("is unchanged for a view that declares no retirement", () => {
+    let code = AppSync_Resolver_Functions$PulumiAws.getItemById(undefined, elevated, undefined, undefined);
+    globalThis.expect([
+      code.includes("_wantsRetired"),
+      code.includes("includeRetired")
+    ]).toEqual([
+      false,
+      false
+    ]);
+  });
+});
+
+globalThis.describe("the by-ids door", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds(undefined, "shelfStatus", ["Archived"], elevated)("ProductsTable");
+  globalThis.test("drops retired rows from the returned array", () => {
+    globalThis.expect(code.includes("item !== null && _live(item)")).toBe(true);
+  });
+  globalThis.test("still names the table it batches against", () => {
+    globalThis.expect(code.includes("ctx.result?.data?.['ProductsTable']")).toBe(true);
+  });
+  globalThis.test("is unchanged for a view that declares no retirement", () => {
+    globalThis.expect(AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds(undefined, undefined, undefined, undefined)("ProductsTable").includes("_live")).toBe(false);
+  });
+});
+
+globalThis.describe("the by-index door", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, "shelfStatus", [
+    "Archived",
+    "Discontinued"
+  ], elevated);
+  globalThis.test("pushes the predicate into the FilterExpression", () => {
+    globalThis.expect(code.includes("names['#retired'] = 'shelfStatus'")).toBe(true);
+    globalThis.expect(code.includes("attribute_not_exists(#retired) OR (#retired <> :retiredValue0 AND #retired <> :retiredValue1)")).toBe(true);
+  });
+  globalThis.test("ANDs onto an expression the caller may already have built", () => {
+    globalThis.expect(code.includes("if (expression) expression += ' AND '")).toBe(true);
+  });
+  globalThis.test("is unchanged for a view that declares no retirement", () => {
+    globalThis.expect(AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, undefined, undefined, undefined).includes("#retired")).toBe(false);
+  });
+});
+
+globalThis.describe("the boolean form", () => {
+  globalThis.test("tests the flag rather than a set of states", () => {
+    let code = AppSync_Resolver_Functions$PulumiAws.getItemById(undefined, elevated, "archived", undefined);
+    globalThis.expect([
+      code.includes("row['archived'] === true"),
+      code.includes("indexOf(row[")
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+});
+
+globalThis.describe("the by-ids door's owner scoping", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds("customerId", "shelfStatus", ["Archived"], elevated)("Orders");
+  globalThis.test("drops a row the caller does not own", () => {
+    globalThis.expect(code.includes("item !== null && _owns(item) && _live(item)")).toBe(true);
+  });
+  globalThis.test("declares the exemption test once, shared with the retirement guard", () => {
+    globalThis.expect(code.split("const _exempt =").length - 1 | 0).toBe(1);
+  });
+  globalThis.test("is unchanged for a view with neither rule", () => {
+    let plain = AppSync_Resolver_Functions$PulumiAws.batchGetItemsByIds(undefined, undefined, undefined, undefined)("Orders");
+    globalThis.expect([
+      plain.includes("_owns"),
+      plain.includes("_live")
+    ]).toEqual([
+      false,
+      false
+    ]);
+  });
+});
+
+globalThis.describe("the by-index door's owner scoping", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", "customerId", undefined, undefined, elevated);
+  globalThis.test("pushes the owner predicate into the read", () => {
+    globalThis.expect(code.includes("names['#owner'] = 'customerId'")).toBe(true);
+  });
+  globalThis.test("reads the owner from the identity, never from ctx.args", () => {
+    globalThis.expect(code.includes("values[':owner'] = _osub")).toBe(true);
+  });
+  globalThis.test("exempts an elevated caller and an IAM service call", () => {
+    globalThis.expect(code.includes("if (!(_osub == null || _ogroups.some(g => _oelevated.indexOf(g) >= 0)))")).toBe(true);
+  });
+  globalThis.test("never treats includeRetired as a column to match on", () => {
+    globalThis.expect(code.includes("key === 'includeRetired'")).toBe(true);
+  });
+});
+
+globalThis.describe("the by-index door answers the field it is attached to", () => {
+  let code = AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, undefined, undefined, undefined);
+  globalThis.test("keys the read on the index column the SDL offers", () => {
+    globalThis.expect(code.includes("util.dynamodb.toDynamoDB(args.categoryId)")).toBe(true);
+  });
+  globalThis.test("returns a Relay connection, not the raw DynamoDB result", () => {
+    globalThis.expect([
+      code.includes("edges,"),
+      code.includes("hasNextPage: !!next"),
+      code.includes("return ctx.result;")
+    ]).toEqual([
+      true,
+      true,
+      false
+    ]);
+  });
+  globalThis.test("pages on the Relay arguments the field declares", () => {
+    globalThis.expect([
+      code.includes("limit: (args.first ?? 50)"),
+      code.includes("util.base64Decode(args.after)")
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
+  globalThis.test("keeps every paging argument out of the filter loop", () => {
+    globalThis.expect([
+      "first",
+      "after",
+      "last",
+      "before",
+      "includeRetired"
+    ].every(arg => code.includes(`key === '` + arg + `'`))).toBe(true);
+  });
+});
+
+globalThis.describe("the by-index door's backward paging", () => {
+  let refusal = "Backward pagination (last/before) is not supported on by-index connections";
+  globalThis.test("refuses last/before on the plain index read", () => {
+    globalThis.expect(AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, undefined, undefined, undefined).includes(refusal)).toBe(true);
+  });
+  globalThis.test("refuses them on the sort-key index read too", () => {
+    globalThis.expect(AppSync_Resolver_Functions$PulumiAws.queryByIndexSortFiltered("byCustomer", "customerId", undefined, "placedAt", undefined, undefined, undefined).includes(refusal)).toBe(true);
+  });
+  globalThis.test("refuses before doing any work, and says so to the caller", () => {
+    let code = AppSync_Resolver_Functions$PulumiAws.queryByIndexFiltered("byCategory", "categoryId", undefined, undefined, undefined, undefined);
+    let guardAt = code.indexOf("args.before != null");
+    let queryAt = code.indexOf("expressionValues");
+    globalThis.expect([
+      guardAt >= 0 && guardAt < queryAt,
+      code.includes("'UnsupportedPagination'")
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
+});
+
+let F;
+
+export {
+  F,
+  elevated,
+  shelf,
+}
+/*  Not a pure module */

package/tests/PgQueryResolver_LambdaTest.res

@@ -95,6 +95,7 @@ let makeBinding = (
   ~ownerField=None,
   ~retiredField=None,
   ~retiredValues=None,
+  ~namedWhenRetired=false,
   (),
 ): PgQueryResolver_Lambda.binding => {
   ops,
@@ -111,6 +112,7 @@ let makeBinding = (
   ownerField,
   retiredField,
   retiredValues,
+  namedWhenRetired,
 }
 
 let mkPayload = (