@reventlessdev/reventless-aws 3.0.0-alpha.344 → 3.0.0-alpha.346

package/tests/ProvisionAccountsTest.res

@@ -0,0 +1,142 @@
+open JestGlobals
+
+// What can be decided before an AWS call is made: which pool and which manifest
+// the run is about, and which usernames a pool could never authenticate.
+//
+// The applying itself is not covered here — it is four SDK calls in a loop. What
+// is covered is the preflight, because its whole purpose is to fail *before*
+// half a cast exists, and the argument parsing, because getting it wrong
+// provisions the right accounts into the wrong deployment.
+//
+// The manifest's own rules — what a second run does to a password already in the
+// file — live with the format, in `spec`'s `AccountsManifestTest`.
+
+module Provision = ProvisionAccounts
+
+describe("ProvisionAccounts.parseArgs", () => {
+  testSync("no arguments leaves every choice unanswered", () =>
+    expect(Provision.parseArgs([]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, file: None, help: false}),
+    )
+  )
+
+  testSync("a pool and a manifest parse", () =>
+    expect(
+      Provision.parseArgs(["--provider-id", "eu-west-1_AbCdEfGhI", "--file", "cast.yaml"]),
+    )->toEqual(
+      Ok({
+        Provision.providerId: Some("eu-west-1_AbCdEfGhI"),
+        stack: None,
+        file: Some("cast.yaml"),
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--stack picks the deployment to read the pool id from", () =>
+    expect(Provision.parseArgs(["--stack", "beta"]))->toEqual(
+      Ok({Provision.providerId: None, stack: Some("beta"), file: None, help: false}),
+    )
+  )
+
+  // The reason unknown flags refuse rather than being skipped, and it lands
+  // harder here than on the first administrator: a typo'd `--provider-id` falls
+  // through to the environment and creates the whole cast in a different pool
+  // than the operator named.
+  testSync("an unknown flag refuses rather than being ignored", () =>
+    expect(Provision.parseArgs(["--pool", "eu-west-1_AbCdEfGhI"]))->toEqual(
+      Error(`unknown argument "--pool"`),
+    )
+  )
+
+  testSync("a flag with no value refuses", () =>
+    expect(Provision.parseArgs(["--provider-id"]))->toEqual(Error("--provider-id needs a value"))
+  )
+
+  testSync("-h asks for the usage", () =>
+    expect(Provision.parseArgs(["-h"]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, file: None, help: true}),
+    )
+  )
+})
+
+// Which pool a run writes to, which is the one decision that is expensive to get
+// wrong: provisioning a cast into the wrong deployment succeeds, and leaves
+// working accounts somewhere nobody is looking.
+//
+// The stack fallback is not exercised here — it shells out to `pulumi`, and a
+// test that did would depend on a logged-in CLI and a deployed stack. What is
+// covered is the precedence above it, and that every answer says where it came
+// from, which is what makes a wrong-pool run visible rather than silent.
+describe("ProvisionProvider.resolve", () => {
+  let withoutEnv = fn => {
+    let saved = NodeProcess.env->Dict.get(ProvisionProvider.envKey)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    let outcome = fn()
+    switch saved {
+    | Some(value) => NodeProcess.env->Dict.set(ProvisionProvider.envKey, value)
+    | None => ()
+    }
+    outcome
+  }
+
+  testSync("an explicit id wins, and says so", () =>
+    expect(
+      withoutEnv(
+        () => ProvisionProvider.resolve(~given=Some("eu-west-1_Explicit"), ~stack=Some("alpha")),
+      ),
+    )->toEqual(Ok(("eu-west-1_Explicit", ProvisionProvider.Flag)))
+  )
+
+  // The flag beats the variable rather than the other way round: a CI shell that
+  // exports one for every stack must still be overridable for a single run.
+  testSync("an explicit id beats the environment", () => {
+    NodeProcess.env->Dict.set(ProvisionProvider.envKey, "eu-west-1_FromEnv")
+    let resolved = ProvisionProvider.resolve(~given=Some("eu-west-1_Explicit"), ~stack=None)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    expect(resolved)->toEqual(Ok(("eu-west-1_Explicit", ProvisionProvider.Flag)))
+  })
+
+  testSync("the environment answers when no flag does", () => {
+    NodeProcess.env->Dict.set(ProvisionProvider.envKey, "eu-west-1_FromEnv")
+    let resolved = ProvisionProvider.resolve(~given=None, ~stack=None)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    expect(resolved)->toEqual(Ok(("eu-west-1_FromEnv", ProvisionProvider.Environment)))
+  })
+
+  // An empty variable is not an answer. Exporting it unset is the ordinary shape
+  // of a CI script whose earlier step did not run, and reading "" as the pool id
+  // would fail much later with a message about Cognito rather than about setup.
+  testSync("an empty environment variable is not an answer", () =>
+    expect({
+      NodeProcess.env->Dict.set(ProvisionProvider.envKey, "   ")
+      let resolved = ProvisionProvider.resolve(~given=None, ~stack=Some("no-such-stack-here"))
+      NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+      resolved->Result.isError
+    })->toBe(true)
+  )
+
+  testSync("each source describes itself", () => {
+    expect(ProvisionProvider.describe(Flag))->toBe("--provider-id")
+    expect(ProvisionProvider.describe(Environment))->toBe("REVENTLESS_IDENTITY_PROVIDER_ID")
+    expect(ProvisionProvider.describe(Stack("beta")))->toBe("stack beta")
+  })
+})
+
+// A manifest usually names plain usernames — `shopper`, `merch` — and a pool
+// created with `UsernameAttributes: [email]` will not take them. The accounts it
+// makes instead are correctly created and cannot authenticate, which is a symptom
+// that arrives at a login screen far from the run that caused it.
+describe("ProvisionAccounts.looksLikeEmail", () => {
+  testSync("an address is one", () =>
+    expect(Provision.looksLikeEmail("me@example.com"))->toBe(true)
+  )
+
+  testSync("a demo username is not", () => expect(Provision.looksLikeEmail("shopper"))->toBe(false))
+
+  // Not a validator — Cognito owns that. It answers one question: would this pool
+  // accept this string as a sign-in name. A local part with no domain would not.
+  testSync("an @ with no domain dot is not", () =>
+    expect(Provision.looksLikeEmail("admin@localhost"))->toBe(false)
+  )
+})

package/tests/ProvisionAccountsTest.res.mjs

@@ -0,0 +1,153 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as ProvisionAccounts$ReventlessAws from "../scripts/ProvisionAccounts.res.mjs";
+import * as ProvisionProvider$ReventlessAws from "../scripts/ProvisionProvider.res.mjs";
+
+globalThis.describe("ProvisionAccounts.parseArgs", () => {
+  globalThis.test("no arguments leaves every choice unanswered", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        file: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("a pool and a manifest parse", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI",
+      "--file",
+      "cast.yaml"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "eu-west-1_AbCdEfGhI",
+        stack: undefined,
+        file: "cast.yaml",
+        help: false
+      }
+    });
+  });
+  globalThis.test("--stack picks the deployment to read the pool id from", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--stack",
+      "beta"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: "beta",
+        file: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("an unknown flag refuses rather than being ignored", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--pool",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--pool"`
+    });
+  });
+  globalThis.test("a flag with no value refuses", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs(["--provider-id"])).toEqual({
+      TAG: "Error",
+      _0: "--provider-id needs a value"
+    });
+  });
+  globalThis.test("-h asks for the usage", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs(["-h"])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        file: undefined,
+        help: true
+      }
+    });
+  });
+});
+
+globalThis.describe("ProvisionProvider.resolve", () => {
+  let withoutEnv = fn => {
+    let saved = process.env[ProvisionProvider$ReventlessAws.envKey];
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    let outcome = fn();
+    if (saved !== undefined) {
+      process.env[ProvisionProvider$ReventlessAws.envKey] = saved;
+    }
+    return outcome;
+  };
+  globalThis.test("an explicit id wins, and says so", () => {
+    globalThis.expect(withoutEnv(() => ProvisionProvider$ReventlessAws.resolve("eu-west-1_Explicit", "alpha"))).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_Explicit",
+        "Flag"
+      ]
+    });
+  });
+  globalThis.test("an explicit id beats the environment", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "eu-west-1_FromEnv";
+    let resolved = ProvisionProvider$ReventlessAws.resolve("eu-west-1_Explicit", undefined);
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    globalThis.expect(resolved).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_Explicit",
+        "Flag"
+      ]
+    });
+  });
+  globalThis.test("the environment answers when no flag does", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "eu-west-1_FromEnv";
+    let resolved = ProvisionProvider$ReventlessAws.resolve(undefined, undefined);
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    globalThis.expect(resolved).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_FromEnv",
+        "Environment"
+      ]
+    });
+  });
+  globalThis.test("an empty environment variable is not an answer", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "   ";
+    let resolved = ProvisionProvider$ReventlessAws.resolve(undefined, "no-such-stack-here");
+    globalThis.expect((Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey), Stdlib_Result.isError(resolved))).toBe(true);
+  });
+  globalThis.test("each source describes itself", () => {
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe("Flag")).toBe("--provider-id");
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe("Environment")).toBe("REVENTLESS_IDENTITY_PROVIDER_ID");
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe({
+      TAG: "Stack",
+      _0: "beta"
+    })).toBe("stack beta");
+  });
+});
+
+globalThis.describe("ProvisionAccounts.looksLikeEmail", () => {
+  globalThis.test("an address is one", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("me@example.com")).toBe(true);
+  });
+  globalThis.test("a demo username is not", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("shopper")).toBe(false);
+  });
+  globalThis.test("an @ with no domain dot is not", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("admin@localhost")).toBe(false);
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/ProvisionAdminTest.res

@@ -0,0 +1,55 @@
+open JestGlobals
+
+// The bootstrap script's decidable part: which pool and which person the run is
+// about. Reachable at all only because the module defines `main` without calling
+// it — `run-provision-admin.mjs` does that — which is the same reason its sibling
+// is testable.
+//
+// The AWS calls themselves are not covered here; what is covered is everything
+// that can be wrong *before* one is made. The credential this script hands out is
+// no longer its own — the generator moved to `spec` so the manifest's
+// platform-neutral half could reach it, and `Util_PasswordTest` holds the policy
+// it has to satisfy.
+
+module Provision = ProvisionAdmin
+
+describe("ProvisionAdmin.parseArgs", () => {
+  testSync("both arguments parse", () =>
+    expect(
+      Provision.parseArgs(["--provider-id", "eu-west-1_AbCdEfGhI", "--email", "me@example.com"]),
+    )->toEqual(
+      Ok({
+        Provision.providerId: Some("eu-west-1_AbCdEfGhI"),
+        stack: None,
+        email: Some("me@example.com"),
+        help: false,
+      }),
+    )
+  )
+
+  testSync("no arguments leaves both unanswered", () =>
+    expect(Provision.parseArgs([]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, email: None, help: false}),
+    )
+  )
+
+  // The reason unknown flags refuse rather than being skipped: a typo'd
+  // `--provider-id` would fall through to the environment and make the
+  // administrator in a different pool than the operator named — a successful run
+  // against the wrong deployment, which is worse than a failed one.
+  testSync("an unknown flag refuses rather than being ignored", () =>
+    expect(Provision.parseArgs(["--provider", "eu-west-1_AbCdEfGhI"]))->toEqual(
+      Error(`unknown argument "--provider"`),
+    )
+  )
+
+  testSync("a flag with no value refuses", () =>
+    expect(Provision.parseArgs(["--email"]))->toEqual(Error("--email needs a value"))
+  )
+
+  testSync("-h asks for the usage", () =>
+    expect(Provision.parseArgs(["-h"]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, email: None, help: true}),
+    )
+  )
+})

package/tests/ProvisionAdminTest.res.mjs

@@ -0,0 +1,66 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as ProvisionAdmin$ReventlessAws from "../scripts/ProvisionAdmin.res.mjs";
+
+globalThis.describe("ProvisionAdmin.parseArgs", () => {
+  globalThis.test("both arguments parse", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI",
+      "--email",
+      "me@example.com"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "eu-west-1_AbCdEfGhI",
+        stack: undefined,
+        email: "me@example.com",
+        help: false
+      }
+    });
+  });
+  globalThis.test("no arguments leaves both unanswered", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        email: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("an unknown flag refuses rather than being ignored", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([
+      "--provider",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--provider"`
+    });
+  });
+  globalThis.test("a flag with no value refuses", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs(["--email"])).toEqual({
+      TAG: "Error",
+      _0: "--email needs a value"
+    });
+  });
+  globalThis.test("-h asks for the usage", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs(["-h"])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        email: undefined,
+        help: true
+      }
+    });
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/ProvisionIdentityTest.res

@@ -16,6 +16,8 @@ describe("ProvisionIdentity.parseArgs", () => {
       Ok({
         Provision.poolName: Provision.defaultPoolName,
         providerId: None,
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
         help: false,
       }),
     )
@@ -26,6 +28,8 @@ describe("ProvisionIdentity.parseArgs", () => {
       Ok({
         Provision.poolName: Provision.defaultPoolName,
         providerId: Some("eu-west-1_AbCdEfGhI"),
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
         help: false,
       }),
     )
@@ -33,13 +37,60 @@ describe("ProvisionIdentity.parseArgs", () => {
 
   testSync("--name selects which pool to adopt by name", () =>
     expect(Provision.parseArgs(["--name", "examples-dev"]))->toEqual(
-      Ok({Provision.poolName: "examples-dev", providerId: None, help: false}),
+      Ok({
+        Provision.poolName: "examples-dev",
+        providerId: None,
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
+        help: false,
+      }),
     )
   )
 
   testSync("both together are accepted, and the id wins at resolve time", () =>
     expect(Provision.parseArgs(["--name", "ignored", "--provider-id", "eu-west-1_x"]))->toEqual(
-      Ok({Provision.poolName: "ignored", providerId: Some("eu-west-1_x"), help: false}),
+      Ok({
+        Provision.poolName: "ignored",
+        providerId: Some("eu-west-1_x"),
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--login-identifier picks the sign-in attribute", () =>
+    expect(
+      Provision.parseArgs(["--login-identifier", "emailOrPhone"])->Result.map(
+        a => a.loginIdentifier,
+      ),
+    )->toEqual(Ok(Auth_LoginIdentifier.EmailOrPhone))
+  )
+
+  // 🚨 The sign-in attribute cannot be changed once the pool exists, so a typo
+  // that fell back to the default would create a pool the operator has to
+  // rebuild — and re-register every account in — to correct.
+  testSync("an unrecognised sign-in attribute is refused, never defaulted", () =>
+    expect(Provision.parseArgs(["--login-identifier", "e-mail"])->Result.isError)->toBe(true)
+  )
+
+  testSync("--sign-up-mode opens the pool to self-registration", () =>
+    expect(
+      Provision.parseArgs(["--sign-up-mode", "selfService"])->Result.map(a => a.signUpMode),
+    )->toEqual(Ok(Auth_SignUpMode.SelfService))
+  )
+
+  // This one IS correctable later, unlike the sign-in attribute — it is refused
+  // because the mistake is silent, not because it is permanent. Defaulting past
+  // a typo leaves a pool that refuses every registration while the command line
+  // reads as though it allows them.
+  testSync("an unrecognised sign-up mode is refused, never defaulted", () =>
+    expect(Provision.parseArgs(["--sign-up-mode", "self-service"])->Result.isError)->toBe(true)
+  )
+
+  testSync("sign-up mode defaults to admin-only, so an existing pool is unchanged", () =>
+    expect(Provision.parseArgs([])->Result.map(a => a.signUpMode))->toEqual(
+      Ok(Auth_SignUpMode.AdminOnly),
     )
   )
 
@@ -55,15 +106,19 @@ describe("ProvisionIdentity.parseArgs", () => {
   // Same hazard from the other direction: a flag whose value was left off must
   // not read as "no id given".
   testSync("a flag with no value is refused", () =>
-    expect(Provision.parseArgs(["--provider-id"]))->toEqual(
-      Error("--provider-id needs a value"),
-    )
+    expect(Provision.parseArgs(["--provider-id"]))->toEqual(Error("--provider-id needs a value"))
   )
 
   testSync("--name with no value is refused too", () =>
     expect(Provision.parseArgs(["--name"]))->toEqual(Error("--name needs a value"))
   )
 
+  testSync("--login-identifier with no value is refused too", () =>
+    expect(Provision.parseArgs(["--login-identifier"]))->toEqual(
+      Error("--login-identifier needs a value"),
+    )
+  )
+
   testSync("--help and -h both ask for the usage text", () =>
     expect((
       Provision.parseArgs(["--help"])->Result.map(a => a.help),
@@ -85,12 +140,14 @@ describe("ProvisionIdentity.parseArgs", () => {
 // touches it — so its settings are not a detail an operator can revise cheaply
 // once accounts exist in it.
 describe("ProvisionIdentity.poolSettings", () => {
-  let settings = Provision.poolSettings(~poolName="MyIdentity")
-
-  testSync("carries the name it was asked for", () =>
-    expect(settings.poolName)->toBe("MyIdentity")
+  let settings = Provision.poolSettings(
+    ~poolName="MyIdentity",
+    ~loginIdentifier=Auth_LoginIdentifier.default,
+    ~signUpMode=Auth_SignUpMode.default,
   )
 
+  testSync("carries the name it was asked for", () => expect(settings.poolName)->toBe("MyIdentity"))
+
   testSync("matches what auto mode declares: email sign-in, no MFA, admin-only", () =>
     expect((
       settings.usernameAttributes,
@@ -99,6 +156,31 @@ describe("ProvisionIdentity.poolSettings", () => {
     ))->toEqual((Some(["email"]), Some("OFF"), Some(true)))
   )
 
+  testSync("a phone pool is created signing in on phone_number", () =>
+    expect(
+      Provision.poolSettings(
+        ~poolName="MyIdentity",
+        ~loginIdentifier=Auth_LoginIdentifier.Phone,
+        ~signUpMode=Auth_SignUpMode.default,
+      ).usernameAttributes,
+    )->toEqual(Some(["phone_number"]))
+  )
+
+  // The negation is the part worth pinning: this type asks who may sign up, and
+  // Cognito's field asks the opposite question. Reading it backwards would open a
+  // pool that was meant to stay closed.
+  testSync("selfService clears allowAdminCreateUserOnly, adminOnly sets it", () => {
+    let openPool = Provision.poolSettings(
+      ~poolName="MyIdentity",
+      ~loginIdentifier=Auth_LoginIdentifier.default,
+      ~signUpMode=Auth_SignUpMode.SelfService,
+    )
+    expect((
+      openPool.adminCreateUserConfig->Option.flatMap(c => c.allowAdminCreateUserOnly),
+      settings.adminCreateUserConfig->Option.flatMap(c => c.allowAdminCreateUserOnly),
+    ))->toEqual((Some(false), Some(true)))
+  })
+
   testSync("keeps the 12-character password policy", () =>
     expect(
       settings.policies