@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.346

package/tests/ProvisionAdminTest.res.mjs

@@ -0,0 +1,66 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as ProvisionAdmin$ReventlessAws from "../scripts/ProvisionAdmin.res.mjs";
+
+globalThis.describe("ProvisionAdmin.parseArgs", () => {
+  globalThis.test("both arguments parse", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI",
+      "--email",
+      "me@example.com"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "eu-west-1_AbCdEfGhI",
+        stack: undefined,
+        email: "me@example.com",
+        help: false
+      }
+    });
+  });
+  globalThis.test("no arguments leaves both unanswered", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        email: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("an unknown flag refuses rather than being ignored", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([
+      "--provider",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--provider"`
+    });
+  });
+  globalThis.test("a flag with no value refuses", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs(["--email"])).toEqual({
+      TAG: "Error",
+      _0: "--email needs a value"
+    });
+  });
+  globalThis.test("-h asks for the usage", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs(["-h"])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        email: undefined,
+        help: true
+      }
+    });
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/ProvisionIdentityTest.res

@@ -16,6 +16,8 @@ describe("ProvisionIdentity.parseArgs", () => {
       Ok({
         Provision.poolName: Provision.defaultPoolName,
         providerId: None,
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
         help: false,
       }),
     )
@@ -26,6 +28,8 @@ describe("ProvisionIdentity.parseArgs", () => {
       Ok({
         Provision.poolName: Provision.defaultPoolName,
         providerId: Some("eu-west-1_AbCdEfGhI"),
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
         help: false,
       }),
     )
@@ -33,13 +37,60 @@ describe("ProvisionIdentity.parseArgs", () => {
 
   testSync("--name selects which pool to adopt by name", () =>
     expect(Provision.parseArgs(["--name", "examples-dev"]))->toEqual(
-      Ok({Provision.poolName: "examples-dev", providerId: None, help: false}),
+      Ok({
+        Provision.poolName: "examples-dev",
+        providerId: None,
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
+        help: false,
+      }),
     )
   )
 
   testSync("both together are accepted, and the id wins at resolve time", () =>
     expect(Provision.parseArgs(["--name", "ignored", "--provider-id", "eu-west-1_x"]))->toEqual(
-      Ok({Provision.poolName: "ignored", providerId: Some("eu-west-1_x"), help: false}),
+      Ok({
+        Provision.poolName: "ignored",
+        providerId: Some("eu-west-1_x"),
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--login-identifier picks the sign-in attribute", () =>
+    expect(
+      Provision.parseArgs(["--login-identifier", "emailOrPhone"])->Result.map(
+        a => a.loginIdentifier,
+      ),
+    )->toEqual(Ok(Auth_LoginIdentifier.EmailOrPhone))
+  )
+
+  // 🚨 The sign-in attribute cannot be changed once the pool exists, so a typo
+  // that fell back to the default would create a pool the operator has to
+  // rebuild — and re-register every account in — to correct.
+  testSync("an unrecognised sign-in attribute is refused, never defaulted", () =>
+    expect(Provision.parseArgs(["--login-identifier", "e-mail"])->Result.isError)->toBe(true)
+  )
+
+  testSync("--sign-up-mode opens the pool to self-registration", () =>
+    expect(
+      Provision.parseArgs(["--sign-up-mode", "selfService"])->Result.map(a => a.signUpMode),
+    )->toEqual(Ok(Auth_SignUpMode.SelfService))
+  )
+
+  // This one IS correctable later, unlike the sign-in attribute — it is refused
+  // because the mistake is silent, not because it is permanent. Defaulting past
+  // a typo leaves a pool that refuses every registration while the command line
+  // reads as though it allows them.
+  testSync("an unrecognised sign-up mode is refused, never defaulted", () =>
+    expect(Provision.parseArgs(["--sign-up-mode", "self-service"])->Result.isError)->toBe(true)
+  )
+
+  testSync("sign-up mode defaults to admin-only, so an existing pool is unchanged", () =>
+    expect(Provision.parseArgs([])->Result.map(a => a.signUpMode))->toEqual(
+      Ok(Auth_SignUpMode.AdminOnly),
     )
   )
 
@@ -62,6 +113,12 @@ describe("ProvisionIdentity.parseArgs", () => {
     expect(Provision.parseArgs(["--name"]))->toEqual(Error("--name needs a value"))
   )
 
+  testSync("--login-identifier with no value is refused too", () =>
+    expect(Provision.parseArgs(["--login-identifier"]))->toEqual(
+      Error("--login-identifier needs a value"),
+    )
+  )
+
   testSync("--help and -h both ask for the usage text", () =>
     expect((
       Provision.parseArgs(["--help"])->Result.map(a => a.help),
@@ -83,7 +140,11 @@ describe("ProvisionIdentity.parseArgs", () => {
 // touches it — so its settings are not a detail an operator can revise cheaply
 // once accounts exist in it.
 describe("ProvisionIdentity.poolSettings", () => {
-  let settings = Provision.poolSettings(~poolName="MyIdentity")
+  let settings = Provision.poolSettings(
+    ~poolName="MyIdentity",
+    ~loginIdentifier=Auth_LoginIdentifier.default,
+    ~signUpMode=Auth_SignUpMode.default,
+  )
 
   testSync("carries the name it was asked for", () => expect(settings.poolName)->toBe("MyIdentity"))
 
@@ -95,6 +156,31 @@ describe("ProvisionIdentity.poolSettings", () => {
     ))->toEqual((Some(["email"]), Some("OFF"), Some(true)))
   )
 
+  testSync("a phone pool is created signing in on phone_number", () =>
+    expect(
+      Provision.poolSettings(
+        ~poolName="MyIdentity",
+        ~loginIdentifier=Auth_LoginIdentifier.Phone,
+        ~signUpMode=Auth_SignUpMode.default,
+      ).usernameAttributes,
+    )->toEqual(Some(["phone_number"]))
+  )
+
+  // The negation is the part worth pinning: this type asks who may sign up, and
+  // Cognito's field asks the opposite question. Reading it backwards would open a
+  // pool that was meant to stay closed.
+  testSync("selfService clears allowAdminCreateUserOnly, adminOnly sets it", () => {
+    let openPool = Provision.poolSettings(
+      ~poolName="MyIdentity",
+      ~loginIdentifier=Auth_LoginIdentifier.default,
+      ~signUpMode=Auth_SignUpMode.SelfService,
+    )
+    expect((
+      openPool.adminCreateUserConfig->Option.flatMap(c => c.allowAdminCreateUserOnly),
+      settings.adminCreateUserConfig->Option.flatMap(c => c.allowAdminCreateUserOnly),
+    ))->toEqual((Some(false), Some(true)))
+  })
+
   testSync("keeps the 12-character password policy", () =>
     expect(
       settings.policies

package/tests/ProvisionIdentityTest.res.mjs

@@ -2,7 +2,9 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Auth_SignUpMode$ReventlessAws from "../src/adapter/Auth/Auth_SignUpMode.res.mjs";
 import * as ProvisionIdentity$ReventlessAws from "../scripts/ProvisionIdentity.res.mjs";
+import * as Auth_LoginIdentifier$ReventlessAws from "../src/adapter/Auth/Auth_LoginIdentifier.res.mjs";
 
 globalThis.describe("ProvisionIdentity.parseArgs", () => {
   globalThis.test("no arguments means adopt-or-create the default name", () => {
@@ -11,6 +13,8 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: {
         poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
         providerId: undefined,
+        loginIdentifier: "Email",
+        signUpMode: "AdminOnly",
         help: false
       }
     });
@@ -24,6 +28,8 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: {
         poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
         providerId: "eu-west-1_AbCdEfGhI",
+        loginIdentifier: "Email",
+        signUpMode: "AdminOnly",
         help: false
       }
     });
@@ -37,6 +43,8 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: {
         poolName: "examples-dev",
         providerId: undefined,
+        loginIdentifier: "Email",
+        signUpMode: "AdminOnly",
         help: false
       }
     });
@@ -52,10 +60,48 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: {
         poolName: "ignored",
         providerId: "eu-west-1_x",
+        loginIdentifier: "Email",
+        signUpMode: "AdminOnly",
         help: false
       }
     });
   });
+  globalThis.test("--login-identifier picks the sign-in attribute", () => {
+    globalThis.expect(Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--login-identifier",
+      "emailOrPhone"
+    ]), a => a.loginIdentifier)).toEqual({
+      TAG: "Ok",
+      _0: "EmailOrPhone"
+    });
+  });
+  globalThis.test("an unrecognised sign-in attribute is refused, never defaulted", () => {
+    globalThis.expect(Stdlib_Result.isError(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--login-identifier",
+      "e-mail"
+    ]))).toBe(true);
+  });
+  globalThis.test("--sign-up-mode opens the pool to self-registration", () => {
+    globalThis.expect(Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--sign-up-mode",
+      "selfService"
+    ]), a => a.signUpMode)).toEqual({
+      TAG: "Ok",
+      _0: "SelfService"
+    });
+  });
+  globalThis.test("an unrecognised sign-up mode is refused, never defaulted", () => {
+    globalThis.expect(Stdlib_Result.isError(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--sign-up-mode",
+      "self-service"
+    ]))).toBe(true);
+  });
+  globalThis.test("sign-up mode defaults to admin-only, so an existing pool is unchanged", () => {
+    globalThis.expect(Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs([]), a => a.signUpMode)).toEqual({
+      TAG: "Ok",
+      _0: "AdminOnly"
+    });
+  });
   globalThis.test("a misspelled flag is refused, not ignored", () => {
     globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
       "--provider_id",
@@ -77,6 +123,12 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: "--name needs a value"
     });
   });
+  globalThis.test("--login-identifier with no value is refused too", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs(["--login-identifier"])).toEqual({
+      TAG: "Error",
+      _0: "--login-identifier needs a value"
+    });
+  });
   globalThis.test("--help and -h both ask for the usage text", () => {
     globalThis.expect([
       Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs(["--help"]), a => a.help),
@@ -104,7 +156,7 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
 });
 
 globalThis.describe("ProvisionIdentity.poolSettings", () => {
-  let settings = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity");
+  let settings = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity", Auth_LoginIdentifier$ReventlessAws.default, Auth_SignUpMode$ReventlessAws.default);
   globalThis.test("carries the name it was asked for", () => {
     globalThis.expect(settings.PoolName).toBe("MyIdentity");
   });
@@ -119,6 +171,19 @@ globalThis.describe("ProvisionIdentity.poolSettings", () => {
       true
     ]);
   });
+  globalThis.test("a phone pool is created signing in on phone_number", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity", "Phone", Auth_SignUpMode$ReventlessAws.default).UsernameAttributes).toEqual(["phone_number"]);
+  });
+  globalThis.test("selfService clears allowAdminCreateUserOnly, adminOnly sets it", () => {
+    let openPool = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity", Auth_LoginIdentifier$ReventlessAws.default, "SelfService");
+    globalThis.expect([
+      Stdlib_Option.flatMap(openPool.AdminCreateUserConfig, c => c.AllowAdminCreateUserOnly),
+      Stdlib_Option.flatMap(settings.AdminCreateUserConfig, c => c.AllowAdminCreateUserOnly)
+    ]).toEqual([
+      false,
+      true
+    ]);
+  });
   globalThis.test("keeps the 12-character password policy", () => {
     globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(settings.Policies, p => p.PasswordPolicy), p => p.MinimumLength)).toEqual(12);
   });

package/tests/Util_OwnerScopeEnvTest.res

@@ -59,4 +59,29 @@ describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
     withElevated([], () => Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables))
     expect(variables->Dict.get(Util_OwnerScopeEnv.key)->Option.isNone)->toBe(true)
   })
+
+  // The whole path the "administrator sees empty screens" trap ran through: the
+  // platform entry point defaults the list, and this composes it into a Lambda's
+  // environment. Asserted end to end rather than at either half, because both
+  // halves were already correct while the trap was open — the pipe was laid and
+  // nothing ever put a value in.
+  testSync("the platform's administrator default reaches a composed environment", () => {
+    Reventless.OwnerScope.clearElevatedGroups()
+    NodeProcess.env->Dict.delete(Util_OwnerScopeEnv.key)
+    Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+
+    let variables = Dict.make()
+    Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
+    let encoded = switch variables->Dict.get(Util_OwnerScopeEnv.key) {
+    | Some(value) => value->Obj.magic
+    | None => ""
+    }
+    Reventless.OwnerScope.clearElevatedGroups()
+
+    // Round-tripped, like the first case above: the runtime reads this back with
+    // `parseElevatedGroups`, so the encoding is asserted rather than the spelling.
+    expect(Reventless.OwnerScope.parseElevatedGroups(encoded))->toEqual([
+      Reventless.AdminGroup.name,
+    ])
+  })
 })

package/tests/Util_OwnerScopeEnvTest.res.mjs

@@ -1,6 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Util_OwnerScopeEnv$ReventlessAws from "../src/util/Util_OwnerScopeEnv.res.mjs";
 
@@ -54,6 +56,17 @@ globalThis.describe("Util_OwnerScopeEnv — the elevated-groups carrier", () =>
     withElevated([], () => Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables));
     globalThis.expect(Stdlib_Option.isNone(variables[Util_OwnerScopeEnv$ReventlessAws.key])).toBe(true);
   });
+  globalThis.test("the platform's administrator default reaches a composed environment", () => {
+    OwnerScope$Reventless.clearElevatedGroups();
+    Stdlib_Dict.$$delete(process.env, Util_OwnerScopeEnv$ReventlessAws.key);
+    OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+    let variables = {};
+    Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
+    let value = variables[Util_OwnerScopeEnv$ReventlessAws.key];
+    let encoded = value !== undefined ? value : "";
+    OwnerScope$Reventless.clearElevatedGroups();
+    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([AdminGroup$Reventless.name]);
+  });
 });
 
 export {