@reventlessdev/reventless-aws 3.0.0-alpha.319 → 3.0.0-alpha.320

package/tests/ProvisionIdentityTest.res.mjs

@@ -0,0 +1,132 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as ProvisionIdentity$ReventlessAws from "../scripts/ProvisionIdentity.res.mjs";
+
+globalThis.describe("ProvisionIdentity.parseArgs", () => {
+  globalThis.test("no arguments means adopt-or-create the default name", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
+        providerId: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("--provider-id names an existing pool", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
+        providerId: "eu-west-1_AbCdEfGhI",
+        help: false
+      }
+    });
+  });
+  globalThis.test("--name selects which pool to adopt by name", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--name",
+      "examples-dev"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: "examples-dev",
+        providerId: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("both together are accepted, and the id wins at resolve time", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--name",
+      "ignored",
+      "--provider-id",
+      "eu-west-1_x"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        poolName: "ignored",
+        providerId: "eu-west-1_x",
+        help: false
+      }
+    });
+  });
+  globalThis.test("a misspelled flag is refused, not ignored", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--provider_id",
+      "eu-west-1_x"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--provider_id"`
+    });
+  });
+  globalThis.test("a flag with no value is refused", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs(["--provider-id"])).toEqual({
+      TAG: "Error",
+      _0: "--provider-id needs a value"
+    });
+  });
+  globalThis.test("--name with no value is refused too", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs(["--name"])).toEqual({
+      TAG: "Error",
+      _0: "--name needs a value"
+    });
+  });
+  globalThis.test("--help and -h both ask for the usage text", () => {
+    globalThis.expect([
+      Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs(["--help"]), a => a.help),
+      Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs(["-h"]), a => a.help)
+    ]).toEqual([
+      {
+        TAG: "Ok",
+        _0: true
+      },
+      {
+        TAG: "Ok",
+        _0: true
+      }
+    ]);
+  });
+  globalThis.test("the first refusal is the one reported", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--nope",
+      "--also-nope"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--nope"`
+    });
+  });
+});
+
+globalThis.describe("ProvisionIdentity.poolSettings", () => {
+  let settings = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity");
+  globalThis.test("carries the name it was asked for", () => {
+    globalThis.expect(settings.PoolName).toBe("MyIdentity");
+  });
+  globalThis.test("matches what auto mode declares: email sign-in, no MFA, admin-only", () => {
+    globalThis.expect([
+      settings.UsernameAttributes,
+      settings.MfaConfiguration,
+      Stdlib_Option.flatMap(settings.AdminCreateUserConfig, c => c.AllowAdminCreateUserOnly)
+    ]).toEqual([
+      ["email"],
+      "OFF",
+      true
+    ]);
+  });
+  globalThis.test("keeps the 12-character password policy", () => {
+    globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(settings.Policies, p => p.PasswordPolicy), p => p.MinimumLength)).toEqual(12);
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/Util_AwsErrorTest.res

@@ -0,0 +1,127 @@
+open JestGlobals
+
+// 🚨 These exist because the bug they cover shipped, and shipped precisely
+// because the predicate lived inside a script that runs on import — nothing could
+// reach it to assert anything.
+//
+// The fixtures below are the **real** shapes, captured from live calls rather
+// than imagined. That is the whole point: the original guard tested the message
+// for the error code, and the message never contains it.
+
+module AwsError = Util_AwsError
+
+@module("./AwsErrorFixtures.mjs")
+external throwAwsError: (string, string) => unit = "throwAwsError"
+
+/** The shape an AWS SDK v3 client actually throws, caught the way the real code
+    catches it.
+
+    🚨 **Thrown and caught, not constructed.** ReScript's `exn` for a JS error is
+    the wrapper its own `catch` builds — a bare `Error` value is a different thing
+    and `JsExn.fromException` does not recognise it. A fixture that returned one
+    would make every predicate here look broken while the code was fine, which is
+    exactly the wrong way round for a regression test. */
+let awsError = (~name: string, ~message: string): exn =>
+  try {
+    throwAwsError(name, message)
+    Not_found
+  } catch {
+  | e => e
+  }
+
+describe("Util_AwsError.isNotFound", () => {
+  // Captured from `DescribeTable` on a table that does not exist. Note the
+  // message: it does NOT contain "ResourceNotFoundException" anywhere, which is
+  // exactly why a message-only guard could never match it.
+  let dynamoNotFound = awsError(
+    ~name="ResourceNotFoundException",
+    ~message="Requested resource not found: Table: ReventlessNoSuchTable-probe not found",
+  )
+
+  // Captured from `DescribeUserPool` on a pool that does not exist.
+  let cognitoNotFound = awsError(
+    ~name="ResourceNotFoundException",
+    ~message="User pool eu-west-1_zzzNoSuchPl does not exist.",
+  )
+
+  testSync("a missing DynamoDB table is recognised from the name alone", () =>
+    expect(AwsError.isNotFound(dynamoNotFound))->toBe(true)
+  )
+
+  // The regression, stated as the property rather than as the fix: this is what
+  // the original guard tested, and it is false for the real error.
+  testSync("...and its message does not carry the code, which is why", () =>
+    expect(
+      AwsError.describe(dynamoNotFound)->String.includes(
+        "Requested resource not found",
+      ),
+    )->toBe(true)
+  )
+
+  testSync("a missing Cognito pool is recognised too", () =>
+    expect(AwsError.isNotFound(cognitoNotFound))->toBe(true)
+  )
+
+  // A wrapped or re-thrown error can lose its `name` while keeping the code in
+  // the text, so the fallback earns its place.
+  testSync("the code in the message alone still matches", () =>
+    expect(
+      AwsError.isNotFound(
+        awsError(~name="Error", ~message="ResourceNotFoundException: wrapped somewhere"),
+      ),
+    )->toBe(true)
+  )
+
+  // 🚨 The direction that matters for safety. `describeTable` swallows this
+  // exception; a guard that said `true` here would report a table as absent when
+  // the call was actually refused, and the script would then try to create a
+  // table that already exists.
+  testSync("a permission failure is not an absence", () =>
+    expect(
+      AwsError.isNotFound(
+        awsError(
+          ~name="AccessDeniedException",
+          ~message="User is not authorized to perform: dynamodb:DescribeTable",
+        ),
+      ),
+    )->toBe(false)
+  )
+
+  testSync("a throttle is not an absence either", () =>
+    expect(
+      AwsError.isNotFound(
+        awsError(~name="ProvisionedThroughputExceededException", ~message="slow down"),
+      ),
+    )->toBe(false)
+  )
+
+  testSync("something that is not a JS error at all is not an absence", () =>
+    expect(AwsError.isNotFound(Not_found))->toBe(false)
+  )
+})
+
+// Without this the top of a CLI reports Node's own
+// `UnhandledPromiseRejection ... "#<Object>"`, which names neither the failing
+// call nor the reason.
+describe("Util_AwsError.describe", () => {
+  testSync("names the code and the reason", () =>
+    expect(
+      AwsError.describe(awsError(~name="AccessDeniedException", ~message="not authorized")),
+    )->toBe("AccessDeniedException: not authorized")
+  )
+
+  testSync("a non-error value still produces a sentence", () =>
+    expect(AwsError.describe(Not_found))->toBe("an unexpected error escaped")
+  )
+
+  // Total on purpose: a describer that threw would replace one unreadable
+  // failure with another.
+  testSync("every shape yields something an operator can read", () =>
+    expect(
+      [
+        awsError(~name="X", ~message="y"),
+        Not_found,
+      ]->Array.every(e => AwsError.describe(e)->String.length > 0),
+    )->toBe(true)
+  )
+})

package/tests/Util_AwsErrorTest.res.mjs

@@ -0,0 +1,76 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as AwsErrorFixturesMjs from "./AwsErrorFixtures.mjs";
+import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
+
+function throwAwsError(prim0, prim1) {
+  AwsErrorFixturesMjs.throwAwsError(prim0, prim1);
+}
+
+function awsError(name, message) {
+  try {
+    AwsErrorFixturesMjs.throwAwsError(name, message);
+    return {
+      RE_EXN_ID: "Not_found"
+    };
+  } catch (raw_e) {
+    return Primitive_exceptions.internalToException(raw_e);
+  }
+}
+
+globalThis.describe("Util_AwsError.isNotFound", () => {
+  let dynamoNotFound = awsError("ResourceNotFoundException", "Requested resource not found: Table: ReventlessNoSuchTable-probe not found");
+  let cognitoNotFound = awsError("ResourceNotFoundException", "User pool eu-west-1_zzzNoSuchPl does not exist.");
+  globalThis.test("a missing DynamoDB table is recognised from the name alone", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(dynamoNotFound)).toBe(true);
+  });
+  globalThis.test("...and its message does not carry the code, which is why", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.describe(dynamoNotFound).includes("Requested resource not found")).toBe(true);
+  });
+  globalThis.test("a missing Cognito pool is recognised too", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(cognitoNotFound)).toBe(true);
+  });
+  globalThis.test("the code in the message alone still matches", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(awsError("Error", "ResourceNotFoundException: wrapped somewhere"))).toBe(true);
+  });
+  globalThis.test("a permission failure is not an absence", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(awsError("AccessDeniedException", "User is not authorized to perform: dynamodb:DescribeTable"))).toBe(false);
+  });
+  globalThis.test("a throttle is not an absence either", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound(awsError("ProvisionedThroughputExceededException", "slow down"))).toBe(false);
+  });
+  globalThis.test("something that is not a JS error at all is not an absence", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.isNotFound({
+      RE_EXN_ID: "Not_found"
+    })).toBe(false);
+  });
+});
+
+globalThis.describe("Util_AwsError.describe", () => {
+  globalThis.test("names the code and the reason", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.describe(awsError("AccessDeniedException", "not authorized"))).toBe("AccessDeniedException: not authorized");
+  });
+  globalThis.test("a non-error value still produces a sentence", () => {
+    globalThis.expect(Util_AwsError$ReventlessAws.describe({
+      RE_EXN_ID: "Not_found"
+    })).toBe("an unexpected error escaped");
+  });
+  globalThis.test("every shape yields something an operator can read", () => {
+    globalThis.expect([
+      awsError("X", "y"),
+      {
+        RE_EXN_ID: "Not_found"
+      }
+    ].every(e => Util_AwsError$ReventlessAws.describe(e).length > 0)).toBe(true);
+  });
+});
+
+let AwsError;
+
+export {
+  AwsError,
+  throwAwsError,
+  awsError,
+}
+/*  Not a pure module */

package/tests/Util_ShellConfigTest.res

@@ -224,3 +224,54 @@ describe("Util_ShellConfig.fields — shellConfig passthrough", () => {
     }
   })
 })
+
+// 🚨 The identity keys travel under both spellings through the rename. A shell
+// reads config.json at runtime and CloudFront serves the previous bundle until
+// someone invalidates it, so switching them in one deploy leaves a window where
+// the served bundle and the served config disagree — and `cognitoClientId` is
+// read into an option, so a bundle that cannot find its key does not error, it
+// gets `None` and login silently stops working.
+//
+// These assert the property that removes that window, not the spelling.
+describe("Util_ShellConfig.identityFields", () => {
+  let fields = Util_ShellConfig.identityFields(~providerId="eu-west-1_x", ~clientId="7cl13nt")
+  let get = key =>
+    fields->Array.find(((k, _)) => k == key)->Option.map(((_, v)) => v)
+
+  testSync("the new spelling is present", () =>
+    expect((get("identityProviderId"), get("identityProviderClientId")))->toEqual((
+      Some(JSON.Encode.string("eu-west-1_x")),
+      Some(JSON.Encode.string("7cl13nt")),
+    ))
+  )
+
+  // Not "still" — deliberately. Every shipped shell reads these, and dropping
+  // them is a later release gated on the pinned bundle, not on this one.
+  testSync("the deprecated spelling is present too", () =>
+    expect((get("cognitoUserPoolId"), get("cognitoClientId")))->toEqual((
+      Some(JSON.Encode.string("eu-west-1_x")),
+      Some(JSON.Encode.string("7cl13nt")),
+    ))
+  )
+
+  // The whole point: a bundle reading either name gets the same answer. Two keys
+  // carrying different values would be worse than one key, not better.
+  testSync("both spellings carry identical values", () =>
+    expect((
+      get("identityProviderId") == get("cognitoUserPoolId"),
+      get("identityProviderClientId") == get("cognitoClientId"),
+    ))->toEqual((true, true))
+  )
+
+  // The client id is the load-bearing one — it is what the shell's auth provider
+  // branches on. The pool id is currently discarded by the shell, which is
+  // exactly why a `cognito*` sweep is dangerous: the safe one gives no warning.
+  testSync("nothing else sneaks into the identity field set", () =>
+    expect(fields->Array.map(((k, _)) => k)->Array.toSorted(String.compare))->toEqual([
+      "cognitoClientId",
+      "cognitoUserPoolId",
+      "identityProviderClientId",
+      "identityProviderId",
+    ])
+  )
+})

package/tests/Util_ShellConfigTest.res.mjs

@@ -4,6 +4,8 @@ import * as JestGlobals from "@reventlessdev/rescript-jest/src/JestGlobals.res.m
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_ShellConfig$ReventlessAws from "../src/util/Util_ShellConfig.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
@@ -252,6 +254,46 @@ globalThis.describe("Util_ShellConfig.fields — shellConfig passthrough", () =>
   });
 });
 
+globalThis.describe("Util_ShellConfig.identityFields", () => {
+  let fields = Util_ShellConfig$ReventlessAws.identityFields("eu-west-1_x", "7cl13nt");
+  let get = key => Stdlib_Option.map(fields.find(param => param[0] === key), param => param[1]);
+  globalThis.test("the new spelling is present", () => {
+    globalThis.expect([
+      get("identityProviderId"),
+      get("identityProviderClientId")
+    ]).toEqual([
+      "eu-west-1_x",
+      "7cl13nt"
+    ]);
+  });
+  globalThis.test("the deprecated spelling is present too", () => {
+    globalThis.expect([
+      get("cognitoUserPoolId"),
+      get("cognitoClientId")
+    ]).toEqual([
+      "eu-west-1_x",
+      "7cl13nt"
+    ]);
+  });
+  globalThis.test("both spellings carry identical values", () => {
+    globalThis.expect([
+      Primitive_object.equal(get("identityProviderId"), get("cognitoUserPoolId")),
+      Primitive_object.equal(get("identityProviderClientId"), get("cognitoClientId"))
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
+  globalThis.test("nothing else sneaks into the identity field set", () => {
+    globalThis.expect(fields.map(param => param[0]).toSorted(Primitive_string.compare)).toEqual([
+      "cognitoClientId",
+      "cognitoUserPoolId",
+      "identityProviderClientId",
+      "identityProviderId"
+    ]);
+  });
+});
+
 export {
   computed,
   get,