@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.346

package/tests/AppSync_AdapterTest.res.mjs

@@ -245,6 +245,75 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
       return Stdlib_JsError.throwWithMessage("missing query fields");
     }
   });
+  let refuses = run => {
+    try {
+      run();
+      return false;
+    } catch (exn) {
+      return true;
+    }
+  };
+  let messageOf = run => {
+    try {
+      run();
+      return "";
+    } catch (raw_err) {
+      let err = Primitive_exceptions.internalToException(raw_err);
+      if (err.RE_EXN_ID === "JsExn") {
+        return Stdlib_Option.getOr(Stdlib_JsExn.message(err._1), "");
+      } else {
+        return "";
+      }
+    }
+  };
+  let anonymousMutation = fieldNames => {
+    let fp = Object.fromEntries(fieldNames.map(n => [
+      n,
+      "AllowAnonymous"
+    ]));
+    let entry = mutationEntry(fieldNames, fp);
+    let frag = makeFragment(fieldNames.map(n => n + `(id: ID!): String`), []);
+    return () => AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+  };
+  globalThis.test("AllowAnonymous on a mutation fails the deploy", () => {
+    globalThis.expect(refuses(anonymousMutation(["p_Register"]))).toBe(true);
+  });
+  globalThis.test("AllowAnonymous and AllowAuthenticated do not behave alike", () => {
+    let fp = Object.fromEntries([[
+        "p_Register",
+        "AllowAuthenticated"
+      ]]);
+    let entry = mutationEntry(["p_Register"], fp);
+    let frag = makeFragment(["p_Register(id: ID!): String"], []);
+    let authenticated = () => AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    globalThis.expect(refuses(authenticated)).toBe(false);
+    globalThis.expect(refuses(anonymousMutation(["p_Register"]))).toBe(true);
+  });
+  globalThis.test("the refusal names the offending field, so it can be found", () => {
+    let msg = messageOf(anonymousMutation(["p_Register"]));
+    globalThis.expect(msg).toContain("p_Register");
+    globalThis.expect(msg).toContain("AllowAnonymous");
+  });
+  globalThis.test("every offending field is reported, not just the first", () => {
+    let msg = messageOf(anonymousMutation([
+      "p_Register",
+      "p_Confirm"
+    ]));
+    globalThis.expect(msg).toContain("p_Register");
+    globalThis.expect(msg).toContain("p_Confirm");
+  });
+  globalThis.test("AllowAnonymous on a query names BOTH derived field names", () => {
+    let entry = queryEntry("p_Item", "p_Items", "AllowAnonymous");
+    let frag = makeFragment([], [
+      "p_Item(id: ID!): Item",
+      "p_Items(first: Int, after: String): ItemConnection!"
+    ]);
+    let run = () => AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [entry]);
+    globalThis.expect(refuses(run)).toBe(true);
+    let msg = messageOf(run);
+    globalThis.expect(msg).toContain("p_Item");
+    globalThis.expect(msg).toContain("p_Items");
+  });
   globalThis.test("Spec-level permission wins over legacy authorization field", () => {
     let fp = Object.fromEntries([[
         "p_X",

package/tests/Auth_LoginIdentifierTest.res

@@ -0,0 +1,51 @@
+open JestGlobals
+
+// The sign-in attribute is the one pool setting no later deploy can correct, so
+// what these cover is the parse: absent must mean today's behaviour, and a
+// spelling this build does not know must refuse rather than default.
+
+module LoginIdentifier = Auth_LoginIdentifier
+
+describe("Auth_LoginIdentifier.parse", () => {
+  testSync("absent is email, so an existing stack redeploys unchanged", () =>
+    expect(LoginIdentifier.parse(None))->toEqual(Ok(LoginIdentifier.Email))
+  )
+
+  testSync("every spelling round-trips through its config name", () =>
+    expect(
+      LoginIdentifier.all->Array.map(i => LoginIdentifier.parse(Some(LoginIdentifier.toString(i)))),
+    )->toEqual(LoginIdentifier.all->Array.map(i => Ok(i)))
+  )
+
+  // 🚨 A typo that defaulted would create a pool signing in on the wrong
+  // attribute, and correcting that means replacing the pool and re-registering
+  // every account in it.
+  testSync("an unrecognised spelling refuses", () =>
+    expect(LoginIdentifier.parse(Some("e-mail"))->Result.isError)->toBe(true)
+  )
+
+  testSync("the refusal names what was accepted instead", () =>
+    expect(
+      switch LoginIdentifier.parse(Some("e-mail")) {
+      | Error(message) => message->String.includes("emailOrPhone")
+      | Ok(_) => false
+      },
+    )->toBe(true)
+  )
+
+  // Case matters: Cognito's own attribute names are lowercase, and accepting
+  // "Email" here would leave two spellings meaning one pool.
+  testSync("a differently-cased spelling is not silently accepted", () =>
+    expect(LoginIdentifier.parse(Some("Email"))->Result.isError)->toBe(true)
+  )
+})
+
+describe("Auth_LoginIdentifier.usernameAttributes", () => {
+  testSync("maps onto the attribute names Cognito takes at creation", () =>
+    expect(LoginIdentifier.all->Array.map(LoginIdentifier.usernameAttributes))->toEqual([
+      ["email"],
+      ["phone_number"],
+      ["email", "phone_number"],
+    ])
+  )
+})

package/tests/Auth_LoginIdentifierTest.res.mjs

@@ -0,0 +1,51 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Auth_LoginIdentifier$ReventlessAws from "../src/adapter/Auth/Auth_LoginIdentifier.res.mjs";
+
+globalThis.describe("Auth_LoginIdentifier.parse", () => {
+  globalThis.test("absent is email, so an existing stack redeploys unchanged", () => {
+    globalThis.expect(Auth_LoginIdentifier$ReventlessAws.parse(undefined)).toEqual({
+      TAG: "Ok",
+      _0: "Email"
+    });
+  });
+  globalThis.test("every spelling round-trips through its config name", () => {
+    globalThis.expect(Auth_LoginIdentifier$ReventlessAws.all.map(i => Auth_LoginIdentifier$ReventlessAws.parse(Auth_LoginIdentifier$ReventlessAws.toString(i)))).toEqual(Auth_LoginIdentifier$ReventlessAws.all.map(i => ({
+      TAG: "Ok",
+      _0: i
+    })));
+  });
+  globalThis.test("an unrecognised spelling refuses", () => {
+    globalThis.expect(Stdlib_Result.isError(Auth_LoginIdentifier$ReventlessAws.parse("e-mail"))).toBe(true);
+  });
+  globalThis.test("the refusal names what was accepted instead", () => {
+    let message = Auth_LoginIdentifier$ReventlessAws.parse("e-mail");
+    let tmp;
+    tmp = message.TAG === "Ok" ? false : message._0.includes("emailOrPhone");
+    globalThis.expect(tmp).toBe(true);
+  });
+  globalThis.test("a differently-cased spelling is not silently accepted", () => {
+    globalThis.expect(Stdlib_Result.isError(Auth_LoginIdentifier$ReventlessAws.parse("Email"))).toBe(true);
+  });
+});
+
+globalThis.describe("Auth_LoginIdentifier.usernameAttributes", () => {
+  globalThis.test("maps onto the attribute names Cognito takes at creation", () => {
+    globalThis.expect(Auth_LoginIdentifier$ReventlessAws.all.map(Auth_LoginIdentifier$ReventlessAws.usernameAttributes)).toEqual([
+      ["email"],
+      ["phone_number"],
+      [
+        "email",
+        "phone_number"
+      ]
+    ]);
+  });
+});
+
+let LoginIdentifier;
+
+export {
+  LoginIdentifier,
+}
+/*  Not a pure module */

package/tests/Auth_SignUpModeTest.res

@@ -0,0 +1,56 @@
+open JestGlobals
+
+// Sign-up mode is correctable on a live pool, unlike the sign-in attribute, so
+// what these cover is not permanence but silence: absent must mean today's
+// behaviour, an unknown spelling must refuse rather than quietly close the pool,
+// and the mapping onto Cognito's inverted field must not be readable backwards.
+
+module SignUpMode = Auth_SignUpMode
+
+describe("Auth_SignUpMode.parse", () => {
+  testSync("absent is adminOnly, so an existing stack redeploys unchanged", () =>
+    expect(SignUpMode.parse(None))->toEqual(Ok(SignUpMode.AdminOnly))
+  )
+
+  testSync("every spelling round-trips through its config name", () =>
+    expect(SignUpMode.all->Array.map(m => SignUpMode.parse(Some(SignUpMode.toString(m)))))->toEqual(
+      SignUpMode.all->Array.map(m => Ok(m)),
+    )
+  )
+
+  // 🚨 Defaulting past a typo fails CLOSED, which is safe and invisible: the
+  // deploy is green, the config reads as though registration is open, and the
+  // only symptom is every registration being refused — far from the cause.
+  testSync("an unrecognised spelling refuses", () =>
+    expect(SignUpMode.parse(Some("self-service"))->Result.isError)->toBe(true)
+  )
+
+  testSync("the refusal names what was accepted instead", () =>
+    expect(
+      switch SignUpMode.parse(Some("self-service")) {
+      | Error(message) => message->String.includes("selfService")
+      | Ok(_) => false
+      },
+    )->toBe(true)
+  )
+
+  testSync("a differently-cased spelling is not silently accepted", () =>
+    expect(SignUpMode.parse(Some("SelfService"))->Result.isError)->toBe(true)
+  )
+})
+
+describe("Auth_SignUpMode.allowAdminCreateUserOnly", () => {
+  // Cognito asks the opposite of what this type asks. Pinning both arms is the
+  // point: an inverted mapping would open a pool meant to stay closed, and on a
+  // shared pool it would open it for every stack using it.
+  testSync("inverts the question Cognito's field asks", () =>
+    expect((
+      SignUpMode.AdminOnly->SignUpMode.allowAdminCreateUserOnly,
+      SignUpMode.SelfService->SignUpMode.allowAdminCreateUserOnly,
+    ))->toEqual((true, false))
+  )
+
+  testSync("the default leaves the pool admin-create-only", () =>
+    expect(SignUpMode.default->SignUpMode.allowAdminCreateUserOnly)->toBe(true)
+  )
+})

package/tests/Auth_SignUpModeTest.res.mjs

@@ -0,0 +1,53 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Auth_SignUpMode$ReventlessAws from "../src/adapter/Auth/Auth_SignUpMode.res.mjs";
+
+globalThis.describe("Auth_SignUpMode.parse", () => {
+  globalThis.test("absent is adminOnly, so an existing stack redeploys unchanged", () => {
+    globalThis.expect(Auth_SignUpMode$ReventlessAws.parse(undefined)).toEqual({
+      TAG: "Ok",
+      _0: "AdminOnly"
+    });
+  });
+  globalThis.test("every spelling round-trips through its config name", () => {
+    globalThis.expect(Auth_SignUpMode$ReventlessAws.all.map(m => Auth_SignUpMode$ReventlessAws.parse(Auth_SignUpMode$ReventlessAws.toString(m)))).toEqual(Auth_SignUpMode$ReventlessAws.all.map(m => ({
+      TAG: "Ok",
+      _0: m
+    })));
+  });
+  globalThis.test("an unrecognised spelling refuses", () => {
+    globalThis.expect(Stdlib_Result.isError(Auth_SignUpMode$ReventlessAws.parse("self-service"))).toBe(true);
+  });
+  globalThis.test("the refusal names what was accepted instead", () => {
+    let message = Auth_SignUpMode$ReventlessAws.parse("self-service");
+    let tmp;
+    tmp = message.TAG === "Ok" ? false : message._0.includes("selfService");
+    globalThis.expect(tmp).toBe(true);
+  });
+  globalThis.test("a differently-cased spelling is not silently accepted", () => {
+    globalThis.expect(Stdlib_Result.isError(Auth_SignUpMode$ReventlessAws.parse("SelfService"))).toBe(true);
+  });
+});
+
+globalThis.describe("Auth_SignUpMode.allowAdminCreateUserOnly", () => {
+  globalThis.test("inverts the question Cognito's field asks", () => {
+    globalThis.expect([
+      Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly("AdminOnly"),
+      Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly("SelfService")
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+  globalThis.test("the default leaves the pool admin-create-only", () => {
+    globalThis.expect(Auth_SignUpMode$ReventlessAws.allowAdminCreateUserOnly(Auth_SignUpMode$ReventlessAws.default)).toBe(true);
+  });
+});
+
+let SignUpMode;
+
+export {
+  SignUpMode,
+}
+/*  Not a pure module */

package/tests/ProvisionAccountsTest.res

@@ -0,0 +1,142 @@
+open JestGlobals
+
+// What can be decided before an AWS call is made: which pool and which manifest
+// the run is about, and which usernames a pool could never authenticate.
+//
+// The applying itself is not covered here — it is four SDK calls in a loop. What
+// is covered is the preflight, because its whole purpose is to fail *before*
+// half a cast exists, and the argument parsing, because getting it wrong
+// provisions the right accounts into the wrong deployment.
+//
+// The manifest's own rules — what a second run does to a password already in the
+// file — live with the format, in `spec`'s `AccountsManifestTest`.
+
+module Provision = ProvisionAccounts
+
+describe("ProvisionAccounts.parseArgs", () => {
+  testSync("no arguments leaves every choice unanswered", () =>
+    expect(Provision.parseArgs([]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, file: None, help: false}),
+    )
+  )
+
+  testSync("a pool and a manifest parse", () =>
+    expect(
+      Provision.parseArgs(["--provider-id", "eu-west-1_AbCdEfGhI", "--file", "cast.yaml"]),
+    )->toEqual(
+      Ok({
+        Provision.providerId: Some("eu-west-1_AbCdEfGhI"),
+        stack: None,
+        file: Some("cast.yaml"),
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--stack picks the deployment to read the pool id from", () =>
+    expect(Provision.parseArgs(["--stack", "beta"]))->toEqual(
+      Ok({Provision.providerId: None, stack: Some("beta"), file: None, help: false}),
+    )
+  )
+
+  // The reason unknown flags refuse rather than being skipped, and it lands
+  // harder here than on the first administrator: a typo'd `--provider-id` falls
+  // through to the environment and creates the whole cast in a different pool
+  // than the operator named.
+  testSync("an unknown flag refuses rather than being ignored", () =>
+    expect(Provision.parseArgs(["--pool", "eu-west-1_AbCdEfGhI"]))->toEqual(
+      Error(`unknown argument "--pool"`),
+    )
+  )
+
+  testSync("a flag with no value refuses", () =>
+    expect(Provision.parseArgs(["--provider-id"]))->toEqual(Error("--provider-id needs a value"))
+  )
+
+  testSync("-h asks for the usage", () =>
+    expect(Provision.parseArgs(["-h"]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, file: None, help: true}),
+    )
+  )
+})
+
+// Which pool a run writes to, which is the one decision that is expensive to get
+// wrong: provisioning a cast into the wrong deployment succeeds, and leaves
+// working accounts somewhere nobody is looking.
+//
+// The stack fallback is not exercised here — it shells out to `pulumi`, and a
+// test that did would depend on a logged-in CLI and a deployed stack. What is
+// covered is the precedence above it, and that every answer says where it came
+// from, which is what makes a wrong-pool run visible rather than silent.
+describe("ProvisionProvider.resolve", () => {
+  let withoutEnv = fn => {
+    let saved = NodeProcess.env->Dict.get(ProvisionProvider.envKey)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    let outcome = fn()
+    switch saved {
+    | Some(value) => NodeProcess.env->Dict.set(ProvisionProvider.envKey, value)
+    | None => ()
+    }
+    outcome
+  }
+
+  testSync("an explicit id wins, and says so", () =>
+    expect(
+      withoutEnv(
+        () => ProvisionProvider.resolve(~given=Some("eu-west-1_Explicit"), ~stack=Some("alpha")),
+      ),
+    )->toEqual(Ok(("eu-west-1_Explicit", ProvisionProvider.Flag)))
+  )
+
+  // The flag beats the variable rather than the other way round: a CI shell that
+  // exports one for every stack must still be overridable for a single run.
+  testSync("an explicit id beats the environment", () => {
+    NodeProcess.env->Dict.set(ProvisionProvider.envKey, "eu-west-1_FromEnv")
+    let resolved = ProvisionProvider.resolve(~given=Some("eu-west-1_Explicit"), ~stack=None)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    expect(resolved)->toEqual(Ok(("eu-west-1_Explicit", ProvisionProvider.Flag)))
+  })
+
+  testSync("the environment answers when no flag does", () => {
+    NodeProcess.env->Dict.set(ProvisionProvider.envKey, "eu-west-1_FromEnv")
+    let resolved = ProvisionProvider.resolve(~given=None, ~stack=None)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    expect(resolved)->toEqual(Ok(("eu-west-1_FromEnv", ProvisionProvider.Environment)))
+  })
+
+  // An empty variable is not an answer. Exporting it unset is the ordinary shape
+  // of a CI script whose earlier step did not run, and reading "" as the pool id
+  // would fail much later with a message about Cognito rather than about setup.
+  testSync("an empty environment variable is not an answer", () =>
+    expect({
+      NodeProcess.env->Dict.set(ProvisionProvider.envKey, "   ")
+      let resolved = ProvisionProvider.resolve(~given=None, ~stack=Some("no-such-stack-here"))
+      NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+      resolved->Result.isError
+    })->toBe(true)
+  )
+
+  testSync("each source describes itself", () => {
+    expect(ProvisionProvider.describe(Flag))->toBe("--provider-id")
+    expect(ProvisionProvider.describe(Environment))->toBe("REVENTLESS_IDENTITY_PROVIDER_ID")
+    expect(ProvisionProvider.describe(Stack("beta")))->toBe("stack beta")
+  })
+})
+
+// A manifest usually names plain usernames — `shopper`, `merch` — and a pool
+// created with `UsernameAttributes: [email]` will not take them. The accounts it
+// makes instead are correctly created and cannot authenticate, which is a symptom
+// that arrives at a login screen far from the run that caused it.
+describe("ProvisionAccounts.looksLikeEmail", () => {
+  testSync("an address is one", () =>
+    expect(Provision.looksLikeEmail("me@example.com"))->toBe(true)
+  )
+
+  testSync("a demo username is not", () => expect(Provision.looksLikeEmail("shopper"))->toBe(false))
+
+  // Not a validator — Cognito owns that. It answers one question: would this pool
+  // accept this string as a sign-in name. A local part with no domain would not.
+  testSync("an @ with no domain dot is not", () =>
+    expect(Provision.looksLikeEmail("admin@localhost"))->toBe(false)
+  )
+})

package/tests/ProvisionAccountsTest.res.mjs

@@ -0,0 +1,153 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as ProvisionAccounts$ReventlessAws from "../scripts/ProvisionAccounts.res.mjs";
+import * as ProvisionProvider$ReventlessAws from "../scripts/ProvisionProvider.res.mjs";
+
+globalThis.describe("ProvisionAccounts.parseArgs", () => {
+  globalThis.test("no arguments leaves every choice unanswered", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        file: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("a pool and a manifest parse", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI",
+      "--file",
+      "cast.yaml"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "eu-west-1_AbCdEfGhI",
+        stack: undefined,
+        file: "cast.yaml",
+        help: false
+      }
+    });
+  });
+  globalThis.test("--stack picks the deployment to read the pool id from", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--stack",
+      "beta"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: "beta",
+        file: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("an unknown flag refuses rather than being ignored", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--pool",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--pool"`
+    });
+  });
+  globalThis.test("a flag with no value refuses", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs(["--provider-id"])).toEqual({
+      TAG: "Error",
+      _0: "--provider-id needs a value"
+    });
+  });
+  globalThis.test("-h asks for the usage", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs(["-h"])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        file: undefined,
+        help: true
+      }
+    });
+  });
+});
+
+globalThis.describe("ProvisionProvider.resolve", () => {
+  let withoutEnv = fn => {
+    let saved = process.env[ProvisionProvider$ReventlessAws.envKey];
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    let outcome = fn();
+    if (saved !== undefined) {
+      process.env[ProvisionProvider$ReventlessAws.envKey] = saved;
+    }
+    return outcome;
+  };
+  globalThis.test("an explicit id wins, and says so", () => {
+    globalThis.expect(withoutEnv(() => ProvisionProvider$ReventlessAws.resolve("eu-west-1_Explicit", "alpha"))).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_Explicit",
+        "Flag"
+      ]
+    });
+  });
+  globalThis.test("an explicit id beats the environment", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "eu-west-1_FromEnv";
+    let resolved = ProvisionProvider$ReventlessAws.resolve("eu-west-1_Explicit", undefined);
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    globalThis.expect(resolved).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_Explicit",
+        "Flag"
+      ]
+    });
+  });
+  globalThis.test("the environment answers when no flag does", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "eu-west-1_FromEnv";
+    let resolved = ProvisionProvider$ReventlessAws.resolve(undefined, undefined);
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    globalThis.expect(resolved).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_FromEnv",
+        "Environment"
+      ]
+    });
+  });
+  globalThis.test("an empty environment variable is not an answer", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "   ";
+    let resolved = ProvisionProvider$ReventlessAws.resolve(undefined, "no-such-stack-here");
+    globalThis.expect((Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey), Stdlib_Result.isError(resolved))).toBe(true);
+  });
+  globalThis.test("each source describes itself", () => {
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe("Flag")).toBe("--provider-id");
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe("Environment")).toBe("REVENTLESS_IDENTITY_PROVIDER_ID");
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe({
+      TAG: "Stack",
+      _0: "beta"
+    })).toBe("stack beta");
+  });
+});
+
+globalThis.describe("ProvisionAccounts.looksLikeEmail", () => {
+  globalThis.test("an address is one", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("me@example.com")).toBe(true);
+  });
+  globalThis.test("a demo username is not", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("shopper")).toBe(false);
+  });
+  globalThis.test("an @ with no domain dot is not", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("admin@localhost")).toBe(false);
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/ProvisionAdminTest.res

@@ -0,0 +1,55 @@
+open JestGlobals
+
+// The bootstrap script's decidable part: which pool and which person the run is
+// about. Reachable at all only because the module defines `main` without calling
+// it — `run-provision-admin.mjs` does that — which is the same reason its sibling
+// is testable.
+//
+// The AWS calls themselves are not covered here; what is covered is everything
+// that can be wrong *before* one is made. The credential this script hands out is
+// no longer its own — the generator moved to `spec` so the manifest's
+// platform-neutral half could reach it, and `Util_PasswordTest` holds the policy
+// it has to satisfy.
+
+module Provision = ProvisionAdmin
+
+describe("ProvisionAdmin.parseArgs", () => {
+  testSync("both arguments parse", () =>
+    expect(
+      Provision.parseArgs(["--provider-id", "eu-west-1_AbCdEfGhI", "--email", "me@example.com"]),
+    )->toEqual(
+      Ok({
+        Provision.providerId: Some("eu-west-1_AbCdEfGhI"),
+        stack: None,
+        email: Some("me@example.com"),
+        help: false,
+      }),
+    )
+  )
+
+  testSync("no arguments leaves both unanswered", () =>
+    expect(Provision.parseArgs([]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, email: None, help: false}),
+    )
+  )
+
+  // The reason unknown flags refuse rather than being skipped: a typo'd
+  // `--provider-id` would fall through to the environment and make the
+  // administrator in a different pool than the operator named — a successful run
+  // against the wrong deployment, which is worse than a failed one.
+  testSync("an unknown flag refuses rather than being ignored", () =>
+    expect(Provision.parseArgs(["--provider", "eu-west-1_AbCdEfGhI"]))->toEqual(
+      Error(`unknown argument "--provider"`),
+    )
+  )
+
+  testSync("a flag with no value refuses", () =>
+    expect(Provision.parseArgs(["--email"]))->toEqual(Error("--email needs a value"))
+  )
+
+  testSync("-h asks for the usage", () =>
+    expect(Provision.parseArgs(["-h"]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, email: None, help: true}),
+    )
+  )
+})