@reventlessdev/reventless-aws 3.0.0-alpha.318 → 3.0.0-alpha.320

package/tests/PgQueryResolver_LambdaTest.res.mjs

@@ -629,6 +629,196 @@ globalThis.describe("owner scoping", () => {
   });
 });
 
+function geoRow(id, status) {
+  let geo = {};
+  geo["__typename"] = "GeolocationLocated";
+  geo["lat"] = 48.2082;
+  geo["lng"] = 16.3738;
+  let o = {};
+  o["id"] = id;
+  o["status"] = status;
+  o["name"] = "Geo " + id;
+  o["owner"] = "u-a";
+  o["geolocation"] = geo;
+  return o;
+}
+
+let geoStore = Object.fromEntries([
+  [
+    "g-1",
+    geoRow("g-1", "active")
+  ],
+  [
+    "g-2",
+    geoRow("g-2", "active")
+  ]
+]);
+
+function geoItems() {
+  return Object.values(geoStore);
+}
+
+function geoConnection() {
+  return Object.fromEntries([[
+      "edges",
+      Object.values(geoStore).map(item => Object.fromEntries([
+        [
+          "cursor",
+          "c"
+        ],
+        [
+          "node",
+          item
+        ]
+      ]))
+    ]]);
+}
+
+function geoBinding() {
+  return {
+    ops: {
+      load: async id => ({
+        TAG: "Ok",
+        _0: Stdlib_Option.mapOr(geoStore[id], [], i => [i])
+      }),
+      loadStream: 0,
+      save: 0,
+      saveBatch: 0,
+      count: 0,
+      delete: 0,
+      deleteBatch: 0
+    },
+    pushdowns: {
+      indexLookup: async (param, _field, _value) => Object.values(geoStore),
+      byIds: async (param, ids) => Stdlib_Array.filterMap(ids, id => geoStore[id]),
+      listPage: async (param, param$1, param$2, param$3, param$4, param$5) => geoConnection(),
+      itemsPage: async (param, param$1, param$2, param$3, param$4, param$5) => geoConnection(),
+      scanAll: async param => Object.values(geoStore)
+    },
+    indexes: [{
+        index: "byStatus",
+        type_: "S",
+        idField: "status",
+        projectionType: "ALL"
+      }],
+    subIdField: "lineNo",
+    capability: capability,
+    labelField: "name",
+    includeIdParam: true,
+    authorization: "AllowAnonymous",
+    ownerField: undefined,
+    retiredField: undefined,
+    retiredValues: undefined,
+    namedWhenRetired: false
+  };
+}
+
+function memberOf(r) {
+  let fromRow = row => Stdlib_Option.flatMap(field(row, "geolocation"), g => str(g, "__typename"));
+  let rows = Stdlib_JSON.Decode.array(r);
+  if (rows !== undefined) {
+    return Stdlib_Option.flatMap(rows[0], fromRow);
+  }
+  let edges = Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array);
+  if (edges !== undefined) {
+    return Stdlib_Option.flatMap(Stdlib_Option.flatMap(edges[0], e => field(e, "node")), fromRow);
+  } else {
+    return fromRow(r);
+  }
+}
+
+globalThis.describe("PgQueryResolver — a nested union survives every door", () => {
+  let doors = [
+    [
+      "getById",
+      mkPayload("getById", undefined, Object.fromEntries([[
+          "id",
+          "g-1"
+        ]]), undefined, undefined)
+    ],
+    [
+      "byIds",
+      mkPayload("byIds", undefined, Object.fromEntries([[
+          "ids",
+          ["g-1"]
+        ]]), undefined, undefined)
+    ],
+    [
+      "index",
+      mkPayload("index", "byStatus", Object.fromEntries([[
+          "byStatus",
+          "active"
+        ]]), undefined, undefined)
+    ],
+    [
+      "list",
+      mkPayload("list", undefined, undefined, undefined, undefined)
+    ],
+    [
+      "items",
+      mkPayload("items", undefined, Object.fromEntries([[
+          "id",
+          "g-1"
+        ]]), undefined, undefined)
+    ],
+    [
+      "resolveOne",
+      {
+        readModelName: "Geos",
+        kind: "resolveOne",
+        target: "Geos",
+        source: Object.fromEntries([[
+            "ref",
+            "g-1"
+          ]]),
+        sourceIdField: "ref",
+        multi: false,
+        arguments: Object.fromEntries([]),
+        identity: Identity$Reventless.anonymous
+      }
+    ],
+    [
+      "resolveMany",
+      {
+        readModelName: "Geos",
+        kind: "resolveMany",
+        target: "Geos",
+        source: Object.fromEntries([[
+            "refs",
+            ["g-1"]
+          ]]),
+        sourceIdsField: "refs",
+        arguments: Object.fromEntries([]),
+        identity: Identity$Reventless.anonymous
+      }
+    ]
+  ];
+  doors.forEach(param => {
+    let payload = param[1];
+    globalThis.test(param[0] + " hands the member type back as stored", async () => {
+      let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(geoBinding(), undefined, payload);
+      globalThis.expect(memberOf(r)).toEqual("GeolocationLocated");
+    });
+  });
+  globalThis.test("node stamps the top level without disturbing the member", async () => {
+    PgQueryResolver_Lambda$ReventlessAws.register("Geos", geoBinding());
+    PgQueryResolver_Lambda$ReventlessAws.registerNodeType("Geo", "Geos");
+    let payload_arguments = Object.fromEntries([[
+        "id",
+        btoa("Geo:g-1")
+      ]]);
+    let payload = {
+      readModelName: "",
+      kind: "node",
+      arguments: payload_arguments,
+      identity: Identity$Reventless.anonymous
+    };
+    let r = await PgQueryResolver_Lambda$ReventlessAws.handler(payload, null);
+    globalThis.expect(str(r, "__typename")).toEqual("Geo");
+    globalThis.expect(memberOf(r)).toEqual("GeolocationLocated");
+  });
+});
+
 export {
   mk,
   store,
@@ -647,5 +837,11 @@ export {
   field,
   str,
   ids,
+  geoRow,
+  geoStore,
+  geoItems,
+  geoConnection,
+  geoBinding,
+  memberOf,
 }
 /* store Not a pure module */

package/tests/ProvisionIdentityTest.res

@@ -0,0 +1,109 @@
+open JestGlobals
+
+// Argument handling for the operator script. Testable at all only because the
+// module no longer calls `main` at the top level — `run-provision-identity.mjs`
+// does. While it ran itself on import, nothing in here could be reached, and
+// that is how a guard that could never match shipped in the same file.
+//
+// What these cover is the one thing this script does that is hard to undo:
+// deciding whether to *adopt* a user pool or *create* one.
+
+module Provision = ProvisionIdentity
+
+describe("ProvisionIdentity.parseArgs", () => {
+  testSync("no arguments means adopt-or-create the default name", () =>
+    expect(Provision.parseArgs([]))->toEqual(
+      Ok({
+        Provision.poolName: Provision.defaultPoolName,
+        providerId: None,
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--provider-id names an existing pool", () =>
+    expect(Provision.parseArgs(["--provider-id", "eu-west-1_AbCdEfGhI"]))->toEqual(
+      Ok({
+        Provision.poolName: Provision.defaultPoolName,
+        providerId: Some("eu-west-1_AbCdEfGhI"),
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--name selects which pool to adopt by name", () =>
+    expect(Provision.parseArgs(["--name", "examples-dev"]))->toEqual(
+      Ok({Provision.poolName: "examples-dev", providerId: None, help: false}),
+    )
+  )
+
+  testSync("both together are accepted, and the id wins at resolve time", () =>
+    expect(Provision.parseArgs(["--name", "ignored", "--provider-id", "eu-west-1_x"]))->toEqual(
+      Ok({Provision.poolName: "ignored", providerId: Some("eu-west-1_x"), help: false}),
+    )
+  )
+
+  // 🚨 The reason unknown flags are refused rather than skipped. A misspelled
+  // `--provider-id` that parsed as "absent" would silently take the *create* path
+  // and stand up a second user pool beside the one the operator meant to extend.
+  testSync("a misspelled flag is refused, not ignored", () =>
+    expect(Provision.parseArgs(["--provider_id", "eu-west-1_x"]))->toEqual(
+      Error(`unknown argument "--provider_id"`),
+    )
+  )
+
+  // Same hazard from the other direction: a flag whose value was left off must
+  // not read as "no id given".
+  testSync("a flag with no value is refused", () =>
+    expect(Provision.parseArgs(["--provider-id"]))->toEqual(
+      Error("--provider-id needs a value"),
+    )
+  )
+
+  testSync("--name with no value is refused too", () =>
+    expect(Provision.parseArgs(["--name"]))->toEqual(Error("--name needs a value"))
+  )
+
+  testSync("--help and -h both ask for the usage text", () =>
+    expect((
+      Provision.parseArgs(["--help"])->Result.map(a => a.help),
+      Provision.parseArgs(["-h"])->Result.map(a => a.help),
+    ))->toEqual((Ok(true), Ok(true)))
+  )
+
+  // The first error stops the scan rather than the last one winning: an operator
+  // fixing what they are told about should not then meet a second surprise.
+  testSync("the first refusal is the one reported", () =>
+    expect(Provision.parseArgs(["--nope", "--also-nope"]))->toEqual(
+      Error(`unknown argument "--nope"`),
+    )
+  )
+})
+
+// The pool this script creates when it creates one. Asserted because a pool is
+// the one thing here that outlives every stack — nothing in a `pulumi destroy`
+// touches it — so its settings are not a detail an operator can revise cheaply
+// once accounts exist in it.
+describe("ProvisionIdentity.poolSettings", () => {
+  let settings = Provision.poolSettings(~poolName="MyIdentity")
+
+  testSync("carries the name it was asked for", () =>
+    expect(settings.poolName)->toBe("MyIdentity")
+  )
+
+  testSync("matches what auto mode declares: email sign-in, no MFA, admin-only", () =>
+    expect((
+      settings.usernameAttributes,
+      settings.mfaConfiguration,
+      settings.adminCreateUserConfig->Option.flatMap(c => c.allowAdminCreateUserOnly),
+    ))->toEqual((Some(["email"]), Some("OFF"), Some(true)))
+  )
+
+  testSync("keeps the 12-character password policy", () =>
+    expect(
+      settings.policies
+      ->Option.flatMap(p => p.passwordPolicy)
+      ->Option.flatMap(p => p.minimumLength),
+    )->toEqual(Some(12))
+  )
+})

package/tests/ProvisionIdentityTest.res.mjs

@@ -0,0 +1,132 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as ProvisionIdentity$ReventlessAws from "../scripts/ProvisionIdentity.res.mjs";
+
+globalThis.describe("ProvisionIdentity.parseArgs", () => {
+  globalThis.test("no arguments means adopt-or-create the default name", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
+        providerId: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("--provider-id names an existing pool", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
+        providerId: "eu-west-1_AbCdEfGhI",
+        help: false
+      }
+    });
+  });
+  globalThis.test("--name selects which pool to adopt by name", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--name",
+      "examples-dev"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: "examples-dev",
+        providerId: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("both together are accepted, and the id wins at resolve time", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--name",
+      "ignored",
+      "--provider-id",
+      "eu-west-1_x"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: "ignored",
+        providerId: "eu-west-1_x",
+        help: false
+      }
+    });
+  });
+  globalThis.test("a misspelled flag is refused, not ignored", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--provider_id",
+      "eu-west-1_x"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--provider_id"`
+    });
+  });
+  globalThis.test("a flag with no value is refused", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs(["--provider-id"])).toEqual({
+      TAG: "Error",
+      _0: "--provider-id needs a value"
+    });
+  });
+  globalThis.test("--name with no value is refused too", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs(["--name"])).toEqual({
+      TAG: "Error",
+      _0: "--name needs a value"
+    });
+  });
+  globalThis.test("--help and -h both ask for the usage text", () => {
+    globalThis.expect([
+      Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs(["--help"]), a => a.help),
+      Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs(["-h"]), a => a.help)
+    ]).toEqual([
+      {
+        TAG: "Ok",
+        _0: true
+      },
+      {
+        TAG: "Ok",
+        _0: true
+      }
+    ]);
+  });
+  globalThis.test("the first refusal is the one reported", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--nope",
+      "--also-nope"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--nope"`
+    });
+  });
+});
+
+globalThis.describe("ProvisionIdentity.poolSettings", () => {
+  let settings = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity");
+  globalThis.test("carries the name it was asked for", () => {
+    globalThis.expect(settings.PoolName).toBe("MyIdentity");
+  });
+  globalThis.test("matches what auto mode declares: email sign-in, no MFA, admin-only", () => {
+    globalThis.expect([
+      settings.UsernameAttributes,
+      settings.MfaConfiguration,
+      Stdlib_Option.flatMap(settings.AdminCreateUserConfig, c => c.AllowAdminCreateUserOnly)
+    ]).toEqual([
+      ["email"],
+      "OFF",
+      true
+    ]);
+  });
+  globalThis.test("keeps the 12-character password policy", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(settings.Policies, p => p.PasswordPolicy), p => p.MinimumLength)).toEqual(12);
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/Util_AwsErrorTest.res

@@ -0,0 +1,127 @@
+open JestGlobals
+
+// 🚨 These exist because the bug they cover shipped, and shipped precisely
+// because the predicate lived inside a script that runs on import — nothing could
+// reach it to assert anything.
+//
+// The fixtures below are the **real** shapes, captured from live calls rather
+// than imagined. That is the whole point: the original guard tested the message
+// for the error code, and the message never contains it.
+
+module AwsError = Util_AwsError
+
+@module("./AwsErrorFixtures.mjs")
+external throwAwsError: (string, string) => unit = "throwAwsError"
+
+/** The shape an AWS SDK v3 client actually throws, caught the way the real code
+    catches it.
+
+    🚨 **Thrown and caught, not constructed.** ReScript's `exn` for a JS error is
+    the wrapper its own `catch` builds — a bare `Error` value is a different thing
+    and `JsExn.fromException` does not recognise it. A fixture that returned one
+    would make every predicate here look broken while the code was fine, which is
+    exactly the wrong way round for a regression test. */
+let awsError = (~name: string, ~message: string): exn =>
+  try {
+    throwAwsError(name, message)
+    Not_found
+  } catch {
+  | e => e
+  }
+
+describe("Util_AwsError.isNotFound", () => {
+  // Captured from `DescribeTable` on a table that does not exist. Note the
+  // message: it does NOT contain "ResourceNotFoundException" anywhere, which is
+  // exactly why a message-only guard could never match it.
+  let dynamoNotFound = awsError(
+    ~name="ResourceNotFoundException",
+    ~message="Requested resource not found: Table: ReventlessNoSuchTable-probe not found",
+  )
+
+  // Captured from `DescribeUserPool` on a pool that does not exist.
+  let cognitoNotFound = awsError(
+    ~name="ResourceNotFoundException",
+    ~message="User pool eu-west-1_zzzNoSuchPl does not exist.",
+  )
+
+  testSync("a missing DynamoDB table is recognised from the name alone", () =>
+    expect(AwsError.isNotFound(dynamoNotFound))->toBe(true)
+  )
+
+  // The regression, stated as the property rather than as the fix: this is what
+  // the original guard tested, and it is false for the real error.
+  testSync("...and its message does not carry the code, which is why", () =>
+    expect(
+      AwsError.describe(dynamoNotFound)->String.includes(
+        "Requested resource not found",
+      ),
+    )->toBe(true)
+  )
+
+  testSync("a missing Cognito pool is recognised too", () =>
+    expect(AwsError.isNotFound(cognitoNotFound))->toBe(true)
+  )
+
+  // A wrapped or re-thrown error can lose its `name` while keeping the code in
+  // the text, so the fallback earns its place.
+  testSync("the code in the message alone still matches", () =>
+    expect(
+      AwsError.isNotFound(
+        awsError(~name="Error", ~message="ResourceNotFoundException: wrapped somewhere"),
+      ),
+    )->toBe(true)
+  )
+
+  // 🚨 The direction that matters for safety. `describeTable` swallows this
+  // exception; a guard that said `true` here would report a table as absent when
+  // the call was actually refused, and the script would then try to create a
+  // table that already exists.
+  testSync("a permission failure is not an absence", () =>
+    expect(
+      AwsError.isNotFound(
+        awsError(
+          ~name="AccessDeniedException",
+          ~message="User is not authorized to perform: dynamodb:DescribeTable",
+        ),
+      ),
+    )->toBe(false)
+  )
+
+  testSync("a throttle is not an absence either", () =>
+    expect(
+      AwsError.isNotFound(
+        awsError(~name="ProvisionedThroughputExceededException", ~message="slow down"),
+      ),
+    )->toBe(false)
+  )
+
+  testSync("something that is not a JS error at all is not an absence", () =>
+    expect(AwsError.isNotFound(Not_found))->toBe(false)
+  )
+})
+
+// Without this the top of a CLI reports Node's own
+// `UnhandledPromiseRejection ... "#<Object>"`, which names neither the failing
+// call nor the reason.
+describe("Util_AwsError.describe", () => {
+  testSync("names the code and the reason", () =>
+    expect(
+      AwsError.describe(awsError(~name="AccessDeniedException", ~message="not authorized")),
+    )->toBe("AccessDeniedException: not authorized")
+  )
+
+  testSync("a non-error value still produces a sentence", () =>
+    expect(AwsError.describe(Not_found))->toBe("an unexpected error escaped")
+  )
+
+  // Total on purpose: a describer that threw would replace one unreadable
+  // failure with another.
+  testSync("every shape yields something an operator can read", () =>
+    expect(
+      [
+        awsError(~name="X", ~message="y"),
+        Not_found,
+      ]->Array.every(e => AwsError.describe(e)->String.length > 0),
+    )->toBe(true)
+  )
+})

package/tests/Util_AwsErrorTest.res.mjs

@@ -0,0 +1,76 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as AwsErrorFixturesMjs from "./AwsErrorFixtures.mjs";
+import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+
+function throwAwsError(prim0, prim1) {
+  AwsErrorFixturesMjs.throwAwsError(prim0, prim1);
+}
+
+function awsError(name, message) {
+  try {
+    AwsErrorFixturesMjs.throwAwsError(name, message);
+    return {
+      RE_EXN_ID: "Not_found"
+    };
+  } catch (raw_e) {
+    return Primitive_exceptions.internalToException(raw_e);
+  }
+}
+
+globalThis.describe("Util_AwsError.isNotFound", () => {
+  let dynamoNotFound = awsError("ResourceNotFoundException", "Requested resource not found: Table: ReventlessNoSuchTable-probe not found");
+  let cognitoNotFound = awsError("ResourceNotFoundException", "User pool eu-west-1_zzzNoSuchPl does not exist.");
+  globalThis.test("a missing DynamoDB table is recognised from the name alone", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(dynamoNotFound)).toBe(true);
+  });
+  globalThis.test("...and its message does not carry the code, which is why", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.describe(dynamoNotFound).includes("Requested resource not found")).toBe(true);
+  });
+  globalThis.test("a missing Cognito pool is recognised too", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(cognitoNotFound)).toBe(true);
+  });
+  globalThis.test("the code in the message alone still matches", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(awsError("Error", "ResourceNotFoundException: wrapped somewhere"))).toBe(true);
+  });
+  globalThis.test("a permission failure is not an absence", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(awsError("AccessDeniedException", "User is not authorized to perform: dynamodb:DescribeTable"))).toBe(false);
+  });
+  globalThis.test("a throttle is not an absence either", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(awsError("ProvisionedThroughputExceededException", "slow down"))).toBe(false);
+  });
+  globalThis.test("something that is not a JS error at all is not an absence", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound({
+      RE_EXN_ID: "Not_found"
+    })).toBe(false);
+  });
+});
+
+globalThis.describe("Util_AwsError.describe", () => {
+  globalThis.test("names the code and the reason", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.describe(awsError("AccessDeniedException", "not authorized"))).toBe("AccessDeniedException: not authorized");
+  });
+  globalThis.test("a non-error value still produces a sentence", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.describe({
+      RE_EXN_ID: "Not_found"
+    })).toBe("an unexpected error escaped");
+  });
+  globalThis.test("every shape yields something an operator can read", () => {
+    globalThis.expect([
+      awsError("X", "y"),
+      {
+        RE_EXN_ID: "Not_found"
+      }
+    ].every(e => Util_AwsError$ReventlessAws.describe(e).length > 0)).toBe(true);
+  });
+});
+
+let AwsError;
+
+export {
+  AwsError,
+  throwAwsError,
+  awsError,
+}
+/*  Not a pure module */