@reventlessdev/reventless-aws 3.0.0-alpha.343 → 3.0.0-alpha.345

package/tests/Auth_ActiveRolePoolAttachmentTest.res

@@ -51,10 +51,7 @@ let describedPool = () =>
         ),
       ])->JSON.Encode.object,
     ),
-    (
-      "UserPoolTags",
-      Dict.fromArray([("CostCentre", str("identity"))])->JSON.Encode.object,
-    ),
+    ("UserPoolTags", Dict.fromArray([("CostCentre", str("identity"))])->JSON.Encode.object),
     (
       "LambdaConfig",
       Dict.fromArray([
@@ -73,8 +70,7 @@ let merged = (~preTokenGenerationArn) =>
 
 let triggerArn = "arn:aws:lambda:eu-west-1:1:function:ActiveRoleTrigger"
 
-let lambdaConfigOf = input =>
-  input->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
+let lambdaConfigOf = input => input->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
 
 /** The `PreTokenGenerationConfig` an attach is expected to write: our ARN, at the
     only version the trigger handler implements. */
@@ -159,10 +155,16 @@ describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — shaping for the AP
 
   testSync("read-only fields UpdateUserPool rejects are not sent", () =>
     expect(
-      ["Id", "Arn", "Status", "CreationDate", "LastModifiedDate", "SchemaAttributes",
-       "UsernameAttributes", "EstimatedNumberOfUsers"]->Array.filter(k =>
-        input->Dict.get(k)->Option.isSome
-      ),
+      [
+        "Id",
+        "Arn",
+        "Status",
+        "CreationDate",
+        "LastModifiedDate",
+        "SchemaAttributes",
+        "UsernameAttributes",
+        "EstimatedNumberOfUsers",
+      ]->Array.filter(k => input->Dict.get(k)->Option.isSome),
     )->toEqual([])
   )
 })
@@ -211,98 +213,102 @@ describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool with nothin
 // in two fields, and `UpdateUserPool` rejects the call when both are present
 // naming different functions. Nothing in this suite carried a
 // `PreTokenGenerationConfig` before, which is exactly why it shipped.
-describe("Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool already on the V2 field", () => {
-  let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken"
-
-  let describedWithConfig = (~version) =>
-    Dict.fromArray([
-      ("Name", str("CustomerPool")),
-      (
-        "LambdaConfig",
-        Dict.fromArray([
-          ("PreSignUp", str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
-          ("PreTokenGeneration", str(theirArn)),
-          (
-            "PreTokenGenerationConfig",
-            Dict.fromArray([
-              ("LambdaArn", str(theirArn)),
-              ("LambdaVersion", str(version)),
-            ])->JSON.Encode.object,
-          ),
-        ])->JSON.Encode.object,
-      ),
-    ])
-
-  let attachOnto = (~version) =>
-    Attachment.mergedUpdateInput(
-      ~described=describedWithConfig(~version),
-      ~userPoolId="eu-west-1_abc123",
-      ~preTokenGenerationArn=Some(triggerArn),
-    )
-
-  // The property AWS enforces, asserted directly rather than through its error
-  // text: the two fields must name the same function.
-  testSync("both fields name our trigger, and the same one", () => {
-    let config = lambdaConfigOf(attachOnto(~version="V1_0"))
-    expect((
-      config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
-      config
-      ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
-      ->Option.flatMap(JSON.Decode.object)
-      ->Option.flatMap(c => c->Dict.get("LambdaArn")),
-    ))->toEqual((Some(str(triggerArn)), Some(str(triggerArn))))
-  })
+describe(
+  "Auth_ActiveRolePoolAttachment.mergedUpdateInput — a pool already on the V2 field",
+  () => {
+    let theirArn = "arn:aws:lambda:eu-west-1:1:function:TheirOwnPreToken"
 
-  // A pool left on V2_0 does not fail — the handler answers in V1_0 shape and
-  // Cognito ignores it, so tokens mint un-narrowed and nothing reports it.
-  testSync("a pool that arrived on V2_0 is pinned back to the version we implement", () =>
-    expect(
-      lambdaConfigOf(attachOnto(~version="V2_0"))
-      ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
-      ->Option.flatMap(JSON.Decode.object)
-      ->Option.flatMap(c => c->Dict.get("LambdaVersion")),
-    )->toEqual(Some(str("V1_0")))
-  )
-
-  testSync("the customer's other triggers still survive", () =>
-    expect(
-      lambdaConfigOf(attachOnto(~version="V1_0"))->Option.flatMap(c => c->Dict.get("PreSignUp")),
-    )->toEqual(Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")))
-  )
+    let describedWithConfig = (~version) =>
+      Dict.fromArray([
+        ("Name", str("CustomerPool")),
+        (
+          "LambdaConfig",
+          Dict.fromArray([
+            ("PreSignUp", str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")),
+            ("PreTokenGeneration", str(theirArn)),
+            (
+              "PreTokenGenerationConfig",
+              Dict.fromArray([
+                ("LambdaArn", str(theirArn)),
+                ("LambdaVersion", str(version)),
+              ])->JSON.Encode.object,
+            ),
+          ])->JSON.Encode.object,
+        ),
+      ])
 
-  testSync("detaching removes both fields, not just the legacy one", () => {
-    let config = lambdaConfigOf(
+    let attachOnto = (~version) =>
       Attachment.mergedUpdateInput(
-        ~described=describedWithConfig(~version="V1_0"),
+        ~described=describedWithConfig(~version),
         ~userPoolId="eu-west-1_abc123",
-        ~preTokenGenerationArn=None,
-      ),
+        ~preTokenGenerationArn=Some(triggerArn),
+      )
+
+    // The property AWS enforces, asserted directly rather than through its error
+    // text: the two fields must name the same function.
+    testSync("both fields name our trigger, and the same one", () => {
+      let config = lambdaConfigOf(attachOnto(~version="V1_0"))
+      expect((
+        config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
+        config
+        ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+        ->Option.flatMap(JSON.Decode.object)
+        ->Option.flatMap(c => c->Dict.get("LambdaArn")),
+      ))->toEqual((Some(str(triggerArn)), Some(str(triggerArn))))
+    })
+
+    // A pool left on V2_0 does not fail — the handler answers in V1_0 shape and
+    // Cognito ignores it, so tokens mint un-narrowed and nothing reports it.
+    testSync("a pool that arrived on V2_0 is pinned back to the version we implement", () =>
+      expect(
+        lambdaConfigOf(attachOnto(~version="V2_0"))
+        ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+        ->Option.flatMap(JSON.Decode.object)
+        ->Option.flatMap(c => c->Dict.get("LambdaVersion")),
+      )->toEqual(Some(str("V1_0")))
     )
-    expect((
-      config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
-      config->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig")),
-    ))->toEqual((None, None))
-  })
 
-  // The fixpoint property, and the one that would have caught this: AWS
-  // materialises whichever field the merge did not write, so the merge has to
-  // accept its own output unchanged or a later deploy fails with nothing altered
-  // but the service normalising its own record.
-  testSync("feeding the merge its own output back changes nothing", () => {
-    let once = attachOnto(~version="V1_0")
-    let twice = Attachment.mergedUpdateInput(
-      ~described=once,
-      ~userPoolId="eu-west-1_abc123",
-      ~preTokenGenerationArn=Some(triggerArn),
+    testSync("the customer's other triggers still survive", () =>
+      expect(
+        lambdaConfigOf(attachOnto(~version="V1_0"))->Option.flatMap(c => c->Dict.get("PreSignUp")),
+      )->toEqual(Some(str("arn:aws:lambda:eu-west-1:1:function:TheirPreSignUp")))
     )
-    expect(lambdaConfigOf(twice))->toEqual(lambdaConfigOf(once))
-  })
-})
+
+    testSync("detaching removes both fields, not just the legacy one", () => {
+      let config = lambdaConfigOf(
+        Attachment.mergedUpdateInput(
+          ~described=describedWithConfig(~version="V1_0"),
+          ~userPoolId="eu-west-1_abc123",
+          ~preTokenGenerationArn=None,
+        ),
+      )
+      expect((
+        config->Option.flatMap(c => c->Dict.get("PreTokenGeneration")),
+        config->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig")),
+      ))->toEqual((None, None))
+    })
+
+    // The fixpoint property, and the one that would have caught this: AWS
+    // materialises whichever field the merge did not write, so the merge has to
+    // accept its own output unchanged or a later deploy fails with nothing altered
+    // but the service normalising its own record.
+    testSync("feeding the merge its own output back changes nothing", () => {
+      let once = attachOnto(~version="V1_0")
+      let twice = Attachment.mergedUpdateInput(
+        ~described=once,
+        ~userPoolId="eu-west-1_abc123",
+        ~preTokenGenerationArn=Some(triggerArn),
+      )
+      expect(lambdaConfigOf(twice))->toEqual(lambdaConfigOf(once))
+    })
+  },
+)
 
 describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
   testSync("reports the trigger a described pool carries", () =>
-    expect(Attachment.attachedTrigger(~described=merged(~preTokenGenerationArn=Some(triggerArn))))
-    ->toEqual(Some(triggerArn))
+    expect(
+      Attachment.attachedTrigger(~described=merged(~preTokenGenerationArn=Some(triggerArn))),
+    )->toEqual(Some(triggerArn))
   )
 
   testSync("reports none when the pool carries no trigger", () =>
@@ -317,7 +323,9 @@ describe("Auth_ActiveRolePoolAttachment.attachedTrigger", () => {
         ~described=Dict.fromArray([
           (
             "LambdaConfig",
-            Dict.fromArray([("PreTokenGenerationConfig", v1Config(triggerArn))])->JSON.Encode.object,
+            Dict.fromArray([
+              ("PreTokenGenerationConfig", v1Config(triggerArn)),
+            ])->JSON.Encode.object,
           ),
         ]),
       ),
@@ -439,9 +447,7 @@ describe("Auth_ActiveRolePoolAttachment.probeEvent", () => {
 
   // Both halves of the key must miss every real row, not just the subject.
   testSync("the probe's subject and client cannot collide with a real row", () =>
-    expect(
-      Attachment.probeSubject == Attachment.probeClientId,
-    )->toBe(false)
+    expect(Attachment.probeSubject == Attachment.probeClientId)->toBe(false)
   )
 })
 
@@ -470,8 +476,9 @@ describe("Auth_ActiveRolePoolAttachment.attachedTriggerArn", () => {
     ])
 
   testSync("an empty pool holds nothing", () =>
-    expect(Attachment.attachedTriggerArn(~described=Dict.fromArray([("Name", str("Bare"))])))
-    ->toEqual(None)
+    expect(
+      Attachment.attachedTriggerArn(~described=Dict.fromArray([("Name", str("Bare"))])),
+    )->toEqual(None)
   )
 
   testSync("reports the trigger a pool carries", () =>
@@ -539,8 +546,9 @@ describe("Auth_ActiveRolePoolAttachment.classifySlot", () => {
   // halves. Unreachable by configuration now that the store is derived — reachable
   // by version skew, while an older release is still on its stack-scoped table.
   testSync("another deployment's trigger on a different store is the defect", () =>
-    expect(classify(~attachedArn=Some(theirs), ~attachedStore=Some("ActiveRoleStore-829c96f")))
-    ->toEqual(Attachment.DifferentStore({arn: theirs, theirStore: "ActiveRoleStore-829c96f"}))
+    expect(
+      classify(~attachedArn=Some(theirs), ~attachedStore=Some("ActiveRoleStore-829c96f")),
+    )->toEqual(Attachment.DifferentStore({arn: theirs, theirStore: "ActiveRoleStore-829c96f"}))
   )
 
   // Reading the store rather than matching a name is what makes this a check on
@@ -568,13 +576,12 @@ describe("Auth_ActiveRolePoolAttachment.refusalFor", () => {
   // Both stores named, because an operator cannot act on this without knowing
   // which two are in disagreement.
   testSync("a disagreeing store is refused, naming both stores", () => {
-    let message =
-      refusal(
-        Attachment.DifferentStore({
-          arn: "arn:aws:lambda:eu-west-1:1:function:Other",
-          theirStore: "ActiveRoleStore-829c96f",
-        }),
-      )->Option.getOr("")
+    let message = refusal(
+      Attachment.DifferentStore({
+        arn: "arn:aws:lambda:eu-west-1:1:function:Other",
+        theirStore: "ActiveRoleStore-829c96f",
+      }),
+    )->Option.getOr("")
     expect((
       message->String.includes(store),
       message->String.includes("ActiveRoleStore-829c96f"),

package/tests/Auth_ActiveRoleStoreTest.res

@@ -18,8 +18,9 @@ describe("Auth_ActiveRoleStore_Ops.mayActAs — the conformance table", () => {
     // path, exercised against the handler rather than the predicate.
     | None => ()
     | Some(role) =>
-      testSync(label, () =>
-        expect(Ops.mayActAs(~membership, ~requested=role))->toBe(expected->Option.isSome)
+      testSync(
+        label,
+        () => expect(Ops.mayActAs(~membership, ~requested=role))->toBe(expected->Option.isSome),
       )
     }
   )
@@ -48,7 +49,9 @@ describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () => {
 describe("Auth_ActiveRoleStore_Ops.cognitoLookupName", () => {
   testSync("the username is what addresses Cognito when the authorizer sent one", () =>
     expect(
-      Ops.cognitoLookupName(~identity={sub: "d265d464-2091-706a-e5f9-3afafe7be29c", username: Value("merch")}),
+      Ops.cognitoLookupName(
+        ~identity={sub: "d265d464-2091-706a-e5f9-3afafe7be29c", username: Value("merch")},
+      ),
     )->toEqual(Some("merch"))
   )
 
@@ -85,10 +88,9 @@ describe("Auth_ActiveRoleStore.chooseStore", () => {
   )
 
   testSync("a stack given a provider reads that provider's derived store", () =>
-    expect(Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_CQTwafSeX")))
-    ->toEqual(
-      Auth_ActiveRoleStore.ProviderScoped("ReventlessActiveRoleStore-eu-west-1_CQTwafSeX"),
-    )
+    expect(
+      Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_CQTwafSeX")),
+    )->toEqual(Auth_ActiveRoleStore.ProviderScoped("ReventlessActiveRoleStore-eu-west-1_CQTwafSeX"))
   )
 
   // 🚨 The defect, expressed as the property that now prevents it. Two platform
@@ -97,8 +99,9 @@ describe("Auth_ActiveRoleStore.chooseStore", () => {
   // doing nothing. There is no configuration either could carry that would make
   // them disagree.
   testSync("two deployments on one provider cannot choose different stores", () =>
-    expect(Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_Shared")))
-    ->toEqual(Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_Shared")))
+    expect(Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_Shared")))->toEqual(
+      Auth_ActiveRoleStore.chooseStore(~identityProviderId=Some("eu-west-1_Shared")),
+    )
   )
 })
 

package/tests/Auth_ActiveRoleStore_SchemaTest.res

@@ -73,7 +73,8 @@ describe("Auth_ActiveRoleStore_Schema.keySchemaRefusal", () => {
   )
 
   testSync("the refusal names the table, what it found, and what is needed", () => {
-    let message = Schema.keySchemaRefusal(~tableName=store, ~actual=[("id", "HASH")])->Option.getOr("")
+    let message =
+      Schema.keySchemaRefusal(~tableName=store, ~actual=[("id", "HASH")])->Option.getOr("")
     expect((
       message->String.includes(store),
       message->String.includes("id:HASH"),

package/tests/Auth_ActiveRoleTrigger_OpsTest.res

@@ -18,14 +18,13 @@ let eventFor = (
     groupConfiguration: {
       groupsToOverride: membership,
       iamRolesToOverride: iamRoles,
-      preferredRole: ?preferredRole->Option.map(Nullable.make),
+      preferredRole: ?(preferredRole->Option.map(Nullable.make)),
     },
   },
   userName: "carol",
 }
 
-let overrideOf = (e: Trigger.event) =>
-  e.response->Option.flatMap(r => r.claimsOverrideDetails)
+let overrideOf = (e: Trigger.event) => e.response->Option.flatMap(r => r.claimsOverrideDetails)
 
 let groupsOf = (e: Trigger.event) =>
   overrideOf(e)->Option.flatMap(c => c.groupOverrideDetails)->Option.map(g => g.groupsToOverride)
@@ -51,18 +50,20 @@ let claimOf = (e: Trigger.event, key) =>
 // the same token. That an absent override really is absent (rather than an empty
 // one, which is not the same thing) is asserted separately below.
 
-let effectiveGroups = (e: Trigger.event, ~membership) =>
-  groupsOf(e)->Option.getOr(membership)
+let effectiveGroups = (e: Trigger.event, ~membership) => groupsOf(e)->Option.getOr(membership)
 
 describe("the conformance table, minted by the trigger", () => {
   Contract.conformanceCases->Array.forEach(({label, membership, requested, expected}) =>
-    testSync(label, () => {
-      let event = Trigger.respond(
-        ~event=eventFor(~membership),
-        ~decision=Trigger.decide(~membership, ~storedRole=requested),
-      )
-      expect(effectiveGroups(event, ~membership))->toEqual(expected->Option.getOr(membership))
-    })
+    testSync(
+      label,
+      () => {
+        let event = Trigger.respond(
+          ~event=eventFor(~membership),
+          ~decision=Trigger.decide(~membership, ~storedRole=requested),
+        )
+        expect(effectiveGroups(event, ~membership))->toEqual(expected->Option.getOr(membership))
+      },
+    )
   )
 })
 
@@ -76,9 +77,9 @@ describe("Auth_ActiveRoleTrigger_Ops.decide", () => {
   )
 
   testSync("a held role narrows", () =>
-    expect(
-      Trigger.decide(~membership=["Admin", "Shopper"], ~storedRole=Some("Shopper")),
-    )->toEqual(Trigger.Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}))
+    expect(Trigger.decide(~membership=["Admin", "Shopper"], ~storedRole=Some("Shopper")))->toEqual(
+      Trigger.Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}),
+    )
   )
 
   // The case the local path never had to answer: the row outlives the membership.
@@ -152,7 +153,10 @@ describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
     expect((
       details->Option.map(d => d.iamRolesToOverride),
       details->Option.flatMap(d => d.preferredRole),
-    ))->toEqual((Some(["arn:aws:iam::1:role/Shopper"]), Some(Nullable.make("arn:aws:iam::1:role/Shopper"))))
+    ))->toEqual((
+      Some(["arn:aws:iam::1:role/Shopper"]),
+      Some(Nullable.make("arn:aws:iam::1:role/Shopper")),
+    ))
   })
 
   testSync("a stale mint carries them through too", () => {

package/tests/Auth_CognitoTest.res

@@ -41,9 +41,7 @@ describe("Auth_Cognito.authenticate", () => {
   })
 
   testAsync("non-Bearer Authorization header → Anonymous", async () => {
-    let r = await Auth_Cognito.authenticate(
-      buildContext([("authorization", "Basic dXNlcjpwYXNz")]),
-    )
+    let r = await Auth_Cognito.authenticate(buildContext([("authorization", "Basic dXNlcjpwYXNz")]))
     switch r {
     | Anonymous => ()
     | _ => JsError.throwWithMessage("expected Anonymous")
@@ -51,9 +49,7 @@ describe("Auth_Cognito.authenticate", () => {
   })
 
   testAsync("malformed Bearer token → AuthError", async () => {
-    let r = await Auth_Cognito.authenticate(
-      buildContext([("authorization", "Bearer not-a-jwt")]),
-    )
+    let r = await Auth_Cognito.authenticate(buildContext([("authorization", "Bearer not-a-jwt")]))
     switch r {
     | AuthError(_) => ()
     | _ => JsError.throwWithMessage("expected AuthError")
@@ -64,15 +60,10 @@ describe("Auth_Cognito.authenticate", () => {
     let claims = Dict.fromArray([
       ("sub", JSON.Encode.string("c3741234-aaaa-bbbb-cccc-ddddeeee1234")),
       ("cognito:username", JSON.Encode.string("alice@example.com")),
-      (
-        "cognito:groups",
-        ["Admin", "User"]->Array.map(JSON.Encode.string)->JSON.Encode.array,
-      ),
+      ("cognito:groups", ["Admin", "User"]->Array.map(JSON.Encode.string)->JSON.Encode.array),
     ])
     let token = buildJwt(claims)
-    let r = await Auth_Cognito.authenticate(
-      buildContext([("authorization", "Bearer " ++ token)]),
-    )
+    let r = await Auth_Cognito.authenticate(buildContext([("authorization", "Bearer " ++ token)]))
     switch r {
     | Authenticated(identity) =>
       expect(identity.userId)->toBe("c3741234-aaaa-bbbb-cccc-ddddeeee1234")
@@ -88,9 +79,7 @@ describe("Auth_Cognito.authenticate", () => {
       ("cognito:username", JSON.Encode.string("bob")),
     ])
     let token = buildJwt(claims)
-    let r = await Auth_Cognito.authenticate(
-      buildContext([("authorization", "Bearer " ++ token)]),
-    )
+    let r = await Auth_Cognito.authenticate(buildContext([("authorization", "Bearer " ++ token)]))
     switch r {
     | Authenticated(identity) =>
       expect(identity.groups)->toEqual([])
@@ -100,13 +89,9 @@ describe("Auth_Cognito.authenticate", () => {
   })
 
   testAsync("header lookup is case-insensitive (Authorization)", async () => {
-    let claims = Dict.fromArray([
-      ("sub", JSON.Encode.string("user-mixed-case")),
-    ])
+    let claims = Dict.fromArray([("sub", JSON.Encode.string("user-mixed-case"))])
     let token = buildJwt(claims)
-    let r = await Auth_Cognito.authenticate(
-      buildContext([("Authorization", "Bearer " ++ token)]),
-    )
+    let r = await Auth_Cognito.authenticate(buildContext([("Authorization", "Bearer " ++ token)]))
     switch r {
     | Authenticated(identity) => expect(identity.userId)->toBe("user-mixed-case")
     | _ => JsError.throwWithMessage("expected Authenticated")
@@ -124,31 +109,31 @@ describe("Auth_Cognito.fromAppSyncIdentity", () => {
     }
   })
 
-  testSync("Cognito identity: sub + claims.cognito:groups → Authenticated with Cognito provider", () => {
-    let claims = Dict.fromArray([
-      ("cognito:username", JSON.Encode.string("alice@example.com")),
-      (
-        "cognito:groups",
-        ["Admin"]->Array.map(JSON.Encode.string)->JSON.Encode.array,
-      ),
-    ])
-    let id: Auth_Cognito.appSyncIdentity = {
-      sub: "c3741234-aaaa",
-      username: "alice@example.com",
-      claims,
-    }
-    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
-    | Authenticated(identity) =>
-      expect(identity.userId)->toBe("c3741234-aaaa")
-      expect(identity.username)->toBe("alice@example.com")
-      expect(identity.groups)->toEqual(["Admin"])
-      switch identity.provider {
-      | Cognito => ()
-      | _ => JsError.throwWithMessage("expected Cognito provider")
+  testSync(
+    "Cognito identity: sub + claims.cognito:groups → Authenticated with Cognito provider",
+    () => {
+      let claims = Dict.fromArray([
+        ("cognito:username", JSON.Encode.string("alice@example.com")),
+        ("cognito:groups", ["Admin"]->Array.map(JSON.Encode.string)->JSON.Encode.array),
+      ])
+      let id: Auth_Cognito.appSyncIdentity = {
+        sub: "c3741234-aaaa",
+        username: "alice@example.com",
+        claims,
       }
-    | _ => JsError.throwWithMessage("expected Authenticated")
-    }
-  })
+      switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+      | Authenticated(identity) =>
+        expect(identity.userId)->toBe("c3741234-aaaa")
+        expect(identity.username)->toBe("alice@example.com")
+        expect(identity.groups)->toEqual(["Admin"])
+        switch identity.provider {
+        | Cognito => ()
+        | _ => JsError.throwWithMessage("expected Cognito provider")
+        }
+      | _ => JsError.throwWithMessage("expected Authenticated")
+      }
+    },
+  )
 
   testSync("Cognito identity: missing claims.cognito:groups → empty groups", () => {
     let id: Auth_Cognito.appSyncIdentity = {