@reventlessdev/reventless-aws 3.0.0-alpha.319 → 3.0.0-alpha.321

package/tests/AppSync_RetirementNarrowingTest.res

@@ -1,11 +1,7 @@
-// The DynamoDB backend narrows retirement on every door the rule names, not
-// only on the list.
-//
-// These assert the *generated resolver source*, which is the only artifact that
-// exists before a deploy: the predicate runs inside AppSync's JS runtime, so a
-// unit test cannot execute it against a table, and what can be checked here is
-// that each door carries the guard, in the half of the template its operation
-// allows, and that a view declaring no retirement is untouched.
+// The DynamoDB backend narrows retirement on every door the rule names, not only
+// on the list. These assert the generated resolver source — the only artifact
+// that exists before a deploy — for the guard, the half of the template its
+// operation allows, and a view declaring no retirement staying untouched.
 
 open JestGlobals
 
@@ -210,18 +206,20 @@ describe("the by-index door answers the field it is attached to", () => {
   testSync("returns a Relay connection, not the raw DynamoDB result", () =>
     expect((
       code->String.includes("edges,"),
-      code->String.includes("hasNextPage: !!next"),
+      code->String.includes("hasNextPage: _more || !!_next"),
       code->String.includes("return ctx.result;"),
     ))->Expect.toEqual((true, true, false))
   )
 
   // `first`/`after` are what the field declares; `limit`/`nextToken` were what
-  // the template read, and nothing translated between the two.
+  // the template read, and nothing translated between the two. `limit` counts
+  // rows examined, so a filtered read looks wider than the page it serves.
   testSync("pages on the Relay arguments the field declares", () =>
     expect((
-      code->String.includes("limit: (args.first ?? 50)"),
+      code->String.includes("const _first = args.first ?? 50;"),
+      code->String.includes("expression ? (_first > 1000 ? _first : 1000)"),
       code->String.includes("util.base64Decode(args.after)"),
-    ))->Expect.toEqual((true, true))
+    ))->Expect.toEqual((true, true, true))
   )
 
   // Every declared argument has a job other than matching a column, so each one

package/tests/AppSync_RetirementNarrowingTest.res.mjs

@@ -133,7 +133,7 @@ globalThis.describe("the by-index door answers the field it is attached to", ()
   globalThis.test("returns a Relay connection, not the raw DynamoDB result", () => {
     globalThis.expect([
       code.includes("edges,"),
-      code.includes("hasNextPage: !!next"),
+      code.includes("hasNextPage: _more || !!_next"),
       code.includes("return ctx.result;")
     ]).toEqual([
       true,
@@ -143,9 +143,11 @@ globalThis.describe("the by-index door answers the field it is attached to", ()
   });
   globalThis.test("pages on the Relay arguments the field declares", () => {
     globalThis.expect([
-      code.includes("limit: (args.first ?? 50)"),
+      code.includes("const _first = args.first ?? 50;"),
+      code.includes("expression ? (_first > 1000 ? _first : 1000)"),
       code.includes("util.base64Decode(args.after)")
     ]).toEqual([
+      true,
       true,
       true
     ]);

package/tests/Auth_ActiveRolePoolAttachmentTest.res

@@ -421,4 +421,179 @@ describe("Auth_ActiveRolePoolAttachment.probeEvent", () => {
       ->Option.flatMap(JSON.Decode.array),
     )->toEqual(Some([]))
   )
+
+  // 🚨 The handler keys its row on (subject, app client), and takes the
+  // "nothing to look up" branch when either is missing. A probe without a
+  // `callerContext` would return healthy without the handler ever reaching the
+  // store — proving less than the check appears to prove.
+  testSync("carries the caller context the handler keys its read on", () =>
+    expect(
+      event
+      ->Option.flatMap(o => o->Dict.get("callerContext"))
+      ->Option.flatMap(JSON.Decode.object)
+      ->Option.flatMap(c => c->Dict.get("clientId"))
+      ->Option.flatMap(JSON.Decode.string)
+      ->Option.isSome,
+    )->toBe(true)
+  )
+
+  // Both halves of the key must miss every real row, not just the subject.
+  testSync("the probe's subject and client cannot collide with a real row", () =>
+    expect(
+      Attachment.probeSubject == Attachment.probeClientId,
+    )->toBe(false)
+  )
+})
+
+// 🚨 Whose slot is it. Cognito allows a pool exactly one pre-token-generation
+// trigger, so an unconditional attach is last-writer-wins — it replaces a BYO
+// customer's own trigger silently, and it lets two platform stacks each read a
+// store the other never writes. The describe this resource already performs is
+// read for what is attached, and a slot held by anything else fails the deploy.
+describe("Auth_ActiveRolePoolAttachment.attachedTriggerArn", () => {
+  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken"
+
+  let withConfig = (~version) =>
+    Dict.fromArray([
+      (
+        "LambdaConfig",
+        Dict.fromArray([
+          (
+            "PreTokenGenerationConfig",
+            Dict.fromArray([
+              ("LambdaArn", str(theirArn)),
+              ("LambdaVersion", str(version)),
+            ])->JSON.Encode.object,
+          ),
+        ])->JSON.Encode.object,
+      ),
+    ])
+
+  testSync("an empty pool holds nothing", () =>
+    expect(Attachment.attachedTriggerArn(~described=Dict.fromArray([("Name", str("Bare"))])))
+    ->toEqual(None)
+  )
+
+  testSync("reports the trigger a pool carries", () =>
+    expect(Attachment.attachedTriggerArn(~described=withConfig(~version="V1_0")))->toEqual(
+      Some(theirArn),
+    )
+  )
+
+  // 🚨 The distinction from `attachedTrigger`, and the reason both exist. A
+  // foreign trigger pinned at a version we do not implement is very much
+  // attached; a version-aware read calls it absent, and this resource would then
+  // quietly replace the very trigger it is meant to refuse.
+  testSync("a foreign trigger at another version is still occupying the slot", () =>
+    expect((
+      Attachment.attachedTriggerArn(~described=withConfig(~version="V2_0")),
+      Attachment.attachedTrigger(~described=withConfig(~version="V2_0")),
+    ))->toEqual((Some(theirArn), None))
+  )
+
+  testSync("falls back to the legacy field on a pool carrying only that", () =>
+    expect(
+      Attachment.attachedTriggerArn(
+        ~described=Dict.fromArray([
+          (
+            "LambdaConfig",
+            Dict.fromArray([("PreTokenGeneration", str(theirArn))])->JSON.Encode.object,
+          ),
+        ]),
+      ),
+    )->toEqual(Some(theirArn))
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.classifySlot", () => {
+  let ours = "arn:aws:lambda:eu-west-1:1:function:OurTrigger"
+  let theirs = "arn:aws:lambda:eu-west-1:1:function:OtherStackTrigger"
+  let store = "ReventlessActiveRoleStore-eu-west-1_x"
+
+  let classify = (~attachedArn, ~attachedStore) =>
+    Attachment.classifySlot(~attachedArn, ~ourArn=ours, ~ourStore=store, ~attachedStore)
+
+  testSync("an empty slot is free to take", () =>
+    expect(classify(~attachedArn=None, ~attachedStore=None))->toEqual(Attachment.Vacant)
+  )
+
+  // A pool can carry an empty string where a trigger was detached out of band.
+  testSync("an empty ARN is an empty slot, not a foreign trigger", () =>
+    expect(classify(~attachedArn=Some(""), ~attachedStore=None))->toEqual(Attachment.Vacant)
+  )
+
+  testSync("our own trigger is ours to re-attach", () =>
+    expect(classify(~attachedArn=Some(ours), ~attachedStore=None))->toEqual(Attachment.Ours)
+  )
+
+  // 🚨 The case the shared pool exists for: two platform stacks running identical
+  // code over identical rows. Whichever holds the slot serves both, so this is
+  // not a conflict and must not fail a deploy.
+  testSync("another deployment's trigger on the same store serves both", () =>
+    expect(classify(~attachedArn=Some(theirs), ~attachedStore=Some(store)))->toEqual(
+      Attachment.SharedWith(theirs),
+    )
+  )
+
+  // 🚨 The original defect, caught at the only moment anything can see both
+  // halves. Unreachable by configuration now that the store is derived — reachable
+  // by version skew, while an older release is still on its stack-scoped table.
+  testSync("another deployment's trigger on a different store is the defect", () =>
+    expect(classify(~attachedArn=Some(theirs), ~attachedStore=Some("ActiveRoleStore-829c96f")))
+    ->toEqual(Attachment.DifferentStore({arn: theirs, theirStore: "ActiveRoleStore-829c96f"}))
+  )
+
+  // Reading the store rather than matching a name is what makes this a check on
+  // the invariant: a function with no ACTIVE_ROLE_TABLE is not one of ours, and
+  // neither is one we could not read.
+  testSync("a trigger with no store of ours is foreign", () =>
+    expect(classify(~attachedArn=Some(theirs), ~attachedStore=None))->toEqual(
+      Attachment.Foreign(theirs),
+    )
+  )
+})
+
+describe("Auth_ActiveRolePoolAttachment.refusalFor", () => {
+  let store = "ReventlessActiveRoleStore-eu-west-1_x"
+  let refusal = slot => Attachment.refusalFor(~slot, ~userPoolId="eu-west-1_x", ~ourStore=store)
+
+  testSync("the three attachable slots produce no refusal", () =>
+    expect((
+      refusal(Attachment.Vacant),
+      refusal(Attachment.Ours),
+      refusal(Attachment.SharedWith("arn:aws:lambda:eu-west-1:1:function:Other")),
+    ))->toEqual((None, None, None))
+  )
+
+  // Both stores named, because an operator cannot act on this without knowing
+  // which two are in disagreement.
+  testSync("a disagreeing store is refused, naming both stores", () => {
+    let message =
+      refusal(
+        Attachment.DifferentStore({
+          arn: "arn:aws:lambda:eu-west-1:1:function:Other",
+          theirStore: "ActiveRoleStore-829c96f",
+        }),
+      )->Option.getOr("")
+    expect((
+      message->String.includes(store),
+      message->String.includes("ActiveRoleStore-829c96f"),
+      message->String.includes("eu-west-1_x"),
+    ))->toEqual((true, true, true))
+  })
+
+  // 🚨 The trade this file already makes for its denylist, applied to the trigger
+  // slot: a customer's own claims-enrichment trigger is replaced silently today.
+  // Given "a customer's pool quietly loses a trigger" and "the deploy fails
+  // naming what is in the way", the second is the one to design for.
+  testSync("a foreign trigger is refused, naming what is attached", () => {
+    let arn = "arn:aws:lambda:eu-west-1:1:function:TheirClaimsEnrichment"
+    let message = refusal(Attachment.Foreign(arn))->Option.getOr("")
+    expect((
+      message->String.includes(arn),
+      // The likeliest cause of a false Foreign is a missing permission, so the
+      // sentence has to name it or an operator debugs the wrong thing.
+      message->String.includes("lambda:GetFunctionConfiguration"),
+    ))->toEqual((true, true))
+  })
 })

package/tests/Auth_ActiveRolePoolAttachmentTest.res.mjs

@@ -362,6 +362,142 @@ globalThis.describe("Auth_ActiveRolePoolAttachment.probeEvent", () => {
   globalThis.test("presents no groups to narrow", () => {
     globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event, o => o["request"]), Stdlib_JSON.Decode.object), r => r["groupConfiguration"]), Stdlib_JSON.Decode.object), g => g["groupsToOverride"]), Stdlib_JSON.Decode.array)).toEqual([]);
   });
+  globalThis.test("carries the caller context the handler keys its read on", () => {
+    globalThis.expect(Stdlib_Option.isSome(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_Option.flatMap(event, o => o["callerContext"]), Stdlib_JSON.Decode.object), c => c["clientId"]), Stdlib_JSON.Decode.string))).toBe(true);
+  });
+  globalThis.test("the probe's subject and client cannot collide with a real row", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.probeSubject === Auth_ActiveRolePoolAttachment$ReventlessAws.probeClientId).toBe(false);
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.attachedTriggerArn", () => {
+  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken";
+  let withConfig = version => Object.fromEntries([[
+      "LambdaConfig",
+      Object.fromEntries([[
+          "PreTokenGenerationConfig",
+          Object.fromEntries([
+            [
+              "LambdaArn",
+              theirArn
+            ],
+            [
+              "LambdaVersion",
+              version
+            ]
+          ])
+        ]])
+    ]]);
+  globalThis.test("an empty pool holds nothing", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTriggerArn(Object.fromEntries([[
+        "Name",
+        "Bare"
+      ]]))).toEqual(undefined);
+  });
+  globalThis.test("reports the trigger a pool carries", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTriggerArn(withConfig("V1_0"))).toEqual(theirArn);
+  });
+  globalThis.test("a foreign trigger at another version is still occupying the slot", () => {
+    globalThis.expect([
+      Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTriggerArn(withConfig("V2_0")),
+      Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTrigger(withConfig("V2_0"))
+    ]).toEqual([
+      theirArn,
+      undefined
+    ]);
+  });
+  globalThis.test("falls back to the legacy field on a pool carrying only that", () => {
+    globalThis.expect(Auth_ActiveRolePoolAttachment$ReventlessAws.attachedTriggerArn(Object.fromEntries([[
+        "LambdaConfig",
+        Object.fromEntries([[
+            "PreTokenGeneration",
+            theirArn
+          ]])
+      ]]))).toEqual(theirArn);
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.classifySlot", () => {
+  let ours = "arn:aws:lambda:eu-west-1:1:function:OurTrigger";
+  let theirs = "arn:aws:lambda:eu-west-1:1:function:OtherStackTrigger";
+  let store = "ReventlessActiveRoleStore-eu-west-1_x";
+  let classify = (attachedArn, attachedStore) => Auth_ActiveRolePoolAttachment$ReventlessAws.classifySlot(attachedArn, ours, store, attachedStore);
+  globalThis.test("an empty slot is free to take", () => {
+    globalThis.expect(classify(undefined, undefined)).toEqual("Vacant");
+  });
+  globalThis.test("an empty ARN is an empty slot, not a foreign trigger", () => {
+    globalThis.expect(classify("", undefined)).toEqual("Vacant");
+  });
+  globalThis.test("our own trigger is ours to re-attach", () => {
+    globalThis.expect(classify(ours, undefined)).toEqual("Ours");
+  });
+  globalThis.test("another deployment's trigger on the same store serves both", () => {
+    globalThis.expect(classify(theirs, store)).toEqual({
+      TAG: "SharedWith",
+      _0: theirs
+    });
+  });
+  globalThis.test("another deployment's trigger on a different store is the defect", () => {
+    globalThis.expect(classify(theirs, "ActiveRoleStore-829c96f")).toEqual({
+      TAG: "DifferentStore",
+      arn: theirs,
+      theirStore: "ActiveRoleStore-829c96f"
+    });
+  });
+  globalThis.test("a trigger with no store of ours is foreign", () => {
+    globalThis.expect(classify(theirs, undefined)).toEqual({
+      TAG: "Foreign",
+      _0: theirs
+    });
+  });
+});
+
+globalThis.describe("Auth_ActiveRolePoolAttachment.refusalFor", () => {
+  let store = "ReventlessActiveRoleStore-eu-west-1_x";
+  globalThis.test("the three attachable slots produce no refusal", () => {
+    globalThis.expect([
+      Auth_ActiveRolePoolAttachment$ReventlessAws.refusalFor("Vacant", "eu-west-1_x", store),
+      Auth_ActiveRolePoolAttachment$ReventlessAws.refusalFor("Ours", "eu-west-1_x", store),
+      Auth_ActiveRolePoolAttachment$ReventlessAws.refusalFor({
+        TAG: "SharedWith",
+        _0: "arn:aws:lambda:eu-west-1:1:function:Other"
+      }, "eu-west-1_x", store)
+    ]).toEqual([
+      undefined,
+      undefined,
+      undefined
+    ]);
+  });
+  globalThis.test("a disagreeing store is refused, naming both stores", () => {
+    let message = Stdlib_Option.getOr(Auth_ActiveRolePoolAttachment$ReventlessAws.refusalFor({
+      TAG: "DifferentStore",
+      arn: "arn:aws:lambda:eu-west-1:1:function:Other",
+      theirStore: "ActiveRoleStore-829c96f"
+    }, "eu-west-1_x", store), "");
+    globalThis.expect([
+      message.includes(store),
+      message.includes("ActiveRoleStore-829c96f"),
+      message.includes("eu-west-1_x")
+    ]).toEqual([
+      true,
+      true,
+      true
+    ]);
+  });
+  globalThis.test("a foreign trigger is refused, naming what is attached", () => {
+    let arn = "arn:aws:lambda:eu-west-1:1:function:TheirClaimsEnrichment";
+    let message = Stdlib_Option.getOr(Auth_ActiveRolePoolAttachment$ReventlessAws.refusalFor({
+      TAG: "Foreign",
+      _0: arn
+    }, "eu-west-1_x", store), "");
+    globalThis.expect([
+      message.includes(arn),
+      message.includes("lambda:GetFunctionConfiguration")
+    ]).toEqual([
+      true,
+      true
+    ]);
+  });
 });
 
 let Attachment;

package/tests/Auth_ActiveRoleStoreTest.res

@@ -72,3 +72,68 @@ describe("Auth_ActiveRoleStore_Ops.cognitoLookupName", () => {
     expect(Ops.cognitoLookupName(~identity={}))->toEqual(None)
   )
 })
+
+// Which store this deployment reads and writes. Two cases and no third: a stack
+// that creates its own provider owns everything attached to it, and a stack given
+// a provider owns none of it. See
+// [docs/plans/active-role-store-scoped-to-the-pool.md].
+describe("Auth_ActiveRoleStore.chooseStore", () => {
+  testSync("a stack that creates its own provider keeps its own table", () =>
+    expect(Auth_ActiveRoleStore.chooseStore(~identityProviderId=None))->toEqual(
+      Auth_ActiveRoleStore.StackScoped,
+    )
+  )
+
+  testSync("a stack given a provider reads that provider's derived store", () =>
+    expect(Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_CQTwafSeX")))
+    ->toEqual(
+      Auth_ActiveRoleStore.ProviderScoped("ReventlessActiveRoleStore-eu-west-1_CQTwafSeX"),
+    )
+  )
+
+  // 🚨 The defect, expressed as the property that now prevents it. Two platform
+  // stacks on one provider previously deployed a table each, so the pool's single
+  // trigger read rows the other's resolver wrote — every switch succeeding and
+  // doing nothing. There is no configuration either could carry that would make
+  // them disagree.
+  testSync("two deployments on one provider cannot choose different stores", () =>
+    expect(Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_Shared")))
+    ->toEqual(Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_Shared")))
+  )
+})
+
+// The second half of the row key. Every other absent field in this handler has a
+// defensible default; this one does not, and the test that matters is the one
+// asserting it refuses rather than substituting something.
+describe("Auth_ActiveRoleStore_Ops.appClientId", () => {
+  testSync("the app client the authorizer resolved is the one used", () =>
+    expect(Ops.appClientId(~identity={sub: "sub-1", clientId: Value("7cl13nt")}))->toEqual(
+      Some("7cl13nt"),
+    )
+  )
+
+  // 🚨 The trigger keys its read on the client id Cognito hands it, so a write
+  // under any substitute — a constant, the subject, the empty string — is a row
+  // the trigger never finds. Refusing is the only answer that does not recreate
+  // the defect one level down.
+  testSync("an absent client id yields nothing to key a row on", () =>
+    expect(Ops.appClientId(~identity={sub: "sub-1"}))->toEqual(None)
+  )
+
+  // The resolver sends `appClientId(id)`, which returns null when the claims are
+  // not there to read — so null is the shape that actually arrives, not a missing
+  // field.
+  testSync("an explicitly null client id is not a client id", () =>
+    expect(Ops.appClientId(~identity={sub: "sub-1", clientId: Null}))->toEqual(None)
+  )
+
+  testSync("a blank client id is not a client id either", () =>
+    expect(Ops.appClientId(~identity={sub: "sub-1", clientId: Value("   ")}))->toEqual(None)
+  )
+
+  // The subject is deliberately not a fallback: it would key every platform's row
+  // identically and undo the per-platform narrowing the pair key exists for.
+  testSync("the subject is never substituted for the app client", () =>
+    expect(Ops.appClientId(~identity={sub: "sub-1", clientId: Null}))->toEqual(None)
+  )
+})

package/tests/Auth_ActiveRoleStoreTest.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
+import * as Auth_ActiveRoleStore$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore.res.mjs";
 import * as Auth_ActiveRoleStore_Ops$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs";
 
 globalThis.describe("Auth_ActiveRoleStore_Ops.mayActAs — the conformance table", () => {
@@ -59,6 +60,53 @@ globalThis.describe("Auth_ActiveRoleStore_Ops.cognitoLookupName", () => {
   });
 });
 
+globalThis.describe("Auth_ActiveRoleStore.chooseStore", () => {
+  globalThis.test("a stack that creates its own provider keeps its own table", () => {
+    globalThis.expect(Auth_ActiveRoleStore$ReventlessAws.chooseStore(undefined)).toEqual("StackScoped");
+  });
+  globalThis.test("a stack given a provider reads that provider's derived store", () => {
+    globalThis.expect(Auth_ActiveRoleStore$ReventlessAws.chooseStore("eu-west-1_CQTwafSeX")).toEqual({
+      TAG: "ProviderScoped",
+      _0: "ReventlessActiveRoleStore-eu-west-1_CQTwafSeX"
+    });
+  });
+  globalThis.test("two deployments on one provider cannot choose different stores", () => {
+    globalThis.expect(Auth_ActiveRoleStore$ReventlessAws.chooseStore("eu-west-1_Shared")).toEqual(Auth_ActiveRoleStore$ReventlessAws.chooseStore("eu-west-1_Shared"));
+  });
+});
+
+globalThis.describe("Auth_ActiveRoleStore_Ops.appClientId", () => {
+  globalThis.test("the app client the authorizer resolved is the one used", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.appClientId({
+      sub: "sub-1",
+      clientId: "7cl13nt"
+    })).toEqual("7cl13nt");
+  });
+  globalThis.test("an absent client id yields nothing to key a row on", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.appClientId({
+      sub: "sub-1"
+    })).toEqual(undefined);
+  });
+  globalThis.test("an explicitly null client id is not a client id", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.appClientId({
+      sub: "sub-1",
+      clientId: null
+    })).toEqual(undefined);
+  });
+  globalThis.test("a blank client id is not a client id either", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.appClientId({
+      sub: "sub-1",
+      clientId: "   "
+    })).toEqual(undefined);
+  });
+  globalThis.test("the subject is never substituted for the app client", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.appClientId({
+      sub: "sub-1",
+      clientId: null
+    })).toEqual(undefined);
+  });
+});
+
 let Ops;
 
 let Contract;

package/tests/Auth_ActiveRoleStore_SchemaTest.res

@@ -0,0 +1,98 @@
+open JestGlobals
+
+// The store's identity — its name and its key — is shared by four things that
+// cannot see each other: the deploy, the write door, the pre-token trigger, and
+// the provisioning script an operator runs by hand. Any two of them disagreeing
+// produces one symptom, and it is the symptom this whole area exists to end: a
+// row written where nothing looks for it, so a role switch reports success and
+// changes nothing.
+//
+// These assert the contract itself rather than any one consumer's use of it.
+
+module Schema = Auth_ActiveRoleStore_Schema
+
+describe("Auth_ActiveRoleStore_Schema.derivedStoreName", () => {
+  testSync("names the store after the provider whose trigger reads it", () =>
+    expect(Schema.derivedStoreName(~identityProviderId="eu-west-1_CQTwafSeX"))->toBe(
+      "ReventlessActiveRoleStore-eu-west-1_CQTwafSeX",
+    )
+  )
+
+  // The property the whole design turns on: two platforms on one provider cannot
+  // name different stores, so the defect stops being something to detect and
+  // becomes something that cannot be expressed.
+  testSync("two deployments on one provider derive the same store", () =>
+    expect(Schema.derivedStoreName(~identityProviderId="eu-west-1_Shared"))->toBe(
+      Schema.derivedStoreName(~identityProviderId="eu-west-1_Shared"),
+    )
+  )
+
+  testSync("different providers do not collide", () =>
+    expect(
+      Schema.derivedStoreName(~identityProviderId="eu-west-1_A") ==
+        Schema.derivedStoreName(~identityProviderId="eu-west-1_B"),
+    )->toBe(false)
+  )
+
+  // A pool id carries an underscore and a hyphen; DynamoDB accepts both, and a
+  // name that needed escaping would make the script and the deploy disagree about
+  // what "the same name" is.
+  testSync("the derived name is a legal DynamoDB table name", () => {
+    let name = Schema.derivedStoreName(~identityProviderId="eu-west-1_CQTwafSeX")
+    expect((
+      RegExp.test(RegExp.fromString("^[A-Za-z0-9_.-]+$"), name),
+      name->String.length >= 3 && name->String.length <= 255,
+    ))->toEqual((true, true))
+  })
+})
+
+describe("Auth_ActiveRoleStore_Schema.keySchemaRefusal", () => {
+  let store = "ReventlessActiveRoleStore-eu-west-1_x"
+
+  testSync("the expected pair is adopted without complaint", () =>
+    expect(
+      Schema.keySchemaRefusal(~tableName=store, ~actual=[("id", "HASH"), ("clientId", "RANGE")]),
+    )->toEqual(None)
+  )
+
+  // DescribeTable promises no ordering, and a refusal that depended on one would
+  // reject a table that is perfectly correct.
+  testSync("order is not part of the comparison", () =>
+    expect(
+      Schema.keySchemaRefusal(~tableName=store, ~actual=[("clientId", "RANGE"), ("id", "HASH")]),
+    )->toEqual(None)
+  )
+
+  // 🚨 The upgrade case. A store keyed on the subject alone is what every
+  // deployment had before the active role became per-platform, and adopting it
+  // silently would write rows under a two-part key that nothing reads.
+  testSync("the pre-clientId store is refused rather than adopted", () =>
+    expect(
+      Schema.keySchemaRefusal(~tableName=store, ~actual=[("id", "HASH")])->Option.isSome,
+    )->toBe(true)
+  )
+
+  testSync("the refusal names the table, what it found, and what is needed", () => {
+    let message = Schema.keySchemaRefusal(~tableName=store, ~actual=[("id", "HASH")])->Option.getOr("")
+    expect((
+      message->String.includes(store),
+      message->String.includes("id:HASH"),
+      message->String.includes("clientId:RANGE"),
+    ))->toEqual((true, true, true))
+  })
+
+  testSync("a table keyed on something else entirely is refused", () =>
+    expect(
+      Schema.keySchemaRefusal(
+        ~tableName=store,
+        ~actual=[("pk", "HASH"), ("sk", "RANGE")],
+      )->Option.isSome,
+    )->toBe(true)
+  )
+
+  // Not a table anyone would build on purpose — but `DescribeTable`'s KeySchema is
+  // optional in the SDK's types, and the caller resolves an absent one to this.
+  testSync("an empty key schema is refused, not treated as a match", () =>
+    expect(Schema.keySchemaRefusal(~tableName=store, ~actual=[])->Option.isSome)->toBe(true)
+  )
+})