@reventlessdev/reventless-aws 3.0.0-alpha.318 → 3.0.0-alpha.320

package/tests/Util_ShellConfigTest.res

@@ -224,3 +224,54 @@ describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
     }
   })
 })
+
+// 🚨 The identity keys travel under both spellings through the rename. A shell
+// reads config.json at runtime and CloudFront serves the previous bundle until
+// someone invalidates it, so switching them in one deploy leaves a window where
+// the served bundle and the served config disagree — and `cognitoClientId` is
+// read into an option, so a bundle that cannot find its key does not error, it
+// gets `None` and login silently stops working.
+//
+// These assert the property that removes that window, not the spelling.
+describe("Util_ShellConfig.identityFields", () => {
+  let fields = Util_ShellConfig.identityFields(~providerId="eu-west-1_x", ~clientId="7cl13nt")
+  let get = key =>
+    fields->Array.find(((k, _)) => k == key)->Option.map(((_, v)) => v)
+
+  testSync("the new spelling is present", () =>
+    expect((get("identityProviderId"), get("identityProviderClientId")))->toEqual((
+      Some(JSON.Encode.string("eu-west-1_x")),
+      Some(JSON.Encode.string("7cl13nt")),
+    ))
+  )
+
+  // Not "still" — deliberately. Every shipped shell reads these, and dropping
+  // them is a later release gated on the pinned bundle, not on this one.
+  testSync("the deprecated spelling is present too", () =>
+    expect((get("cognitoUserPoolId"), get("cognitoClientId")))->toEqual((
+      Some(JSON.Encode.string("eu-west-1_x")),
+      Some(JSON.Encode.string("7cl13nt")),
+    ))
+  )
+
+  // The whole point: a bundle reading either name gets the same answer. Two keys
+  // carrying different values would be worse than one key, not better.
+  testSync("both spellings carry identical values", () =>
+    expect((
+      get("identityProviderId") == get("cognitoUserPoolId"),
+      get("identityProviderClientId") == get("cognitoClientId"),
+    ))->toEqual((true, true))
+  )
+
+  // The client id is the load-bearing one — it is what the shell's auth provider
+  // branches on. The pool id is currently discarded by the shell, which is
+  // exactly why a `cognito*` sweep is dangerous: the safe one gives no warning.
+  testSync("nothing else sneaks into the identity field set", () =>
+    expect(fields->Array.map(((k, _)) => k)->Array.toSorted(String.compare))->toEqual([
+      "cognitoClientId",
+      "cognitoUserPoolId",
+      "identityProviderClientId",
+      "identityProviderId",
+    ])
+  )
+})

package/tests/Util_ShellConfigTest.res.mjs

@@ -4,6 +4,8 @@ import * as JestGlobals from "@reventlessdev/rescript-jest/src/JestGlobals.res.m
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_ShellConfig$ReventlessAws from "../src/util/Util_ShellConfig.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
@@ -252,6 +254,46 @@ globalThis.describe("Util_ShellConfig.fields — shellConfig passthrough", () =>
   });
 });
 
+globalThis.describe("Util_ShellConfig.identityFields", () => {
+  let fields = Util_ShellConfig$ReventlessAws.identityFields("eu-west-1_x", "7cl13nt");
+  let get = key => Stdlib_Option.map(fields.find(param => param[0] === key), param => param[1]);
+  globalThis.test("the new spelling is present", () => {
+    globalThis.expect([
+      get("identityProviderId"),
+      get("identityProviderClientId")
+    ]).toEqual([
+      "eu-west-1_x",
+      "7cl13nt"
+    ]);
+  });
+  globalThis.test("the deprecated spelling is present too", () => {
+    globalThis.expect([
+      get("cognitoUserPoolId"),
+      get("cognitoClientId")
+    ]).toEqual([
+      "eu-west-1_x",
+      "7cl13nt"
+    ]);
+  });
+  globalThis.test("both spellings carry identical values", () => {
+    globalThis.expect([
+      Primitive_object.equal(get("identityProviderId"), get("cognitoUserPoolId")),
+      Primitive_object.equal(get("identityProviderClientId"), get("cognitoClientId"))
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
+  globalThis.test("nothing else sneaks into the identity field set", () => {
+    globalThis.expect(fields.map(param => param[0]).toSorted(Primitive_string.compare)).toEqual([
+      "cognitoClientId",
+      "cognitoUserPoolId",
+      "identityProviderClientId",
+      "identityProviderId"
+    ]);
+  });
+});
+
 export {
   computed,
   get,