@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.347

package/tests/DeployAppTest.res

@@ -0,0 +1,90 @@
+open JestGlobals
+
+// What `deploy-app` decides without AWS or Pulumi: its arguments, the checks
+// that stop it before anything is created, and what a new stack starts with.
+
+describe("DeployApp.parseArgs", () => {
+  testSync("up with the defaults", () =>
+    expect(DeployApp.parseArgs(["up"]))->toEqual(
+      Ok({DeployApp.command: Some(Up), manifest: None, stack: "dev", help: false}),
+    )
+  )
+
+  testSync("down with a manifest and a stack", () =>
+    expect(DeployApp.parseArgs(["down", "--manifest", "../m.yaml", "--stack", "try"]))->toEqual(
+      Ok({DeployApp.command: Some(Down), manifest: Some("../m.yaml"), stack: "try", help: false}),
+    )
+  )
+
+  testSync("a second command is refused", () =>
+    expect(DeployApp.parseArgs(["up", "down"]))->toEqual(Error(`unknown argument "down"`))
+  )
+})
+
+describe("DeployApp checks", () => {
+  testSync("Node 22 and later pass", () => {
+    expect(DeployApp.checkNode("22.17.1"))->toEqual(None)
+    expect(DeployApp.checkNode("24.0.0"))->toEqual(None)
+  })
+
+  testSync("an older Node says which version is needed", () =>
+    expect(DeployApp.checkNode("20.11.0")->Option.getOr(""))->toContain("Node 22 or later")
+  )
+
+  testSync("Pulumi Cloud needs no passphrase", () =>
+    expect(
+      DeployApp.backendNeedsPassphrase(~url=Some("https://app.pulumi.com/me"), ~env=Dict.make()),
+    )->toBe(false)
+  )
+
+  testSync("a local backend needs one, unless it is set", () => {
+    expect(DeployApp.backendNeedsPassphrase(~url=Some("file://~"), ~env=Dict.make()))->toBe(true)
+    expect(
+      DeployApp.backendNeedsPassphrase(
+        ~url=Some("s3://bucket"),
+        ~env=Dict.fromArray([("PULUMI_CONFIG_PASSPHRASE", "")]),
+      ),
+    )->toBe(false)
+  })
+})
+
+describe("DeployApp stacks and layer", () => {
+  let project = {
+    DeployApp.label: "platform",
+    dir: "/app/platform-aws",
+    projectName: "shop-platform-aws",
+    program: "/app/platform-aws/src/Main.res.mjs",
+    stackDefaults: Dict.fromArray([("aws:region", "us-east-1"), ("platform:x", "y")]),
+  }
+
+  // The region and the try-out flag come last, so an app default cannot turn a
+  // try-out into a stack `down` refuses to remove.
+  testSync("a new stack gets the app's defaults, then the region and the try-out flag", () =>
+    expect(DeployApp.newStackConfig(~project, ~region="eu-west-1"))->toEqual([
+      ("aws:region", "us-east-1"),
+      ("platform:x", "y"),
+      ("aws:region", "eu-west-1"),
+      ("aws-native:region", "eu-west-1"),
+      ("reventless:disposable", "true"),
+    ])
+  )
+
+  testSync("the release download is named by the package and version", () =>
+    expect(DeployApp.releaseUrl("3.0.0-alpha.346"))->toBe(
+      "https://github.com/ReventlessDev/reventless-core/releases/download/%40reventlessdev%2Freventless-aws%403.0.0-alpha.346/reventless-layer.zip",
+    )
+  )
+
+  testSync("a layer is marked with the release it was published for", () =>
+    expect(DeployApp.layerDescription("3.0.0"))->toBe("reventless-aws@3.0.0")
+  )
+
+  testSync("sign-ins line up under each other", () =>
+    expect(
+      DeployApp.signInLines([
+        {username: "admin@example.com", password: "", groups: ["Admin"]},
+        {username: "a@example.com", password: "", groups: []},
+      ]),
+    )->toEqual(["    admin@example.com  [Admin]", "    a@example.com      []"])
+  )
+})

package/tests/DeployAppTest.res.mjs

@@ -0,0 +1,133 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as DeployApp$ReventlessAws from "../scripts/DeployApp.res.mjs";
+
+globalThis.describe("DeployApp.parseArgs", () => {
+  globalThis.test("up with the defaults", () => {
+    globalThis.expect(DeployApp$ReventlessAws.parseArgs(["up"])).toEqual({
+      TAG: "Ok",
+      _0: {
+        command: "Up",
+        manifest: undefined,
+        stack: "dev",
+        help: false
+      }
+    });
+  });
+  globalThis.test("down with a manifest and a stack", () => {
+    globalThis.expect(DeployApp$ReventlessAws.parseArgs([
+      "down",
+      "--manifest",
+      "../m.yaml",
+      "--stack",
+      "try"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        command: "Down",
+        manifest: "../m.yaml",
+        stack: "try",
+        help: false
+      }
+    });
+  });
+  globalThis.test("a second command is refused", () => {
+    globalThis.expect(DeployApp$ReventlessAws.parseArgs([
+      "up",
+      "down"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "down"`
+    });
+  });
+});
+
+globalThis.describe("DeployApp checks", () => {
+  globalThis.test("Node 22 and later pass", () => {
+    globalThis.expect(DeployApp$ReventlessAws.checkNode("22.17.1")).toEqual(undefined);
+    globalThis.expect(DeployApp$ReventlessAws.checkNode("24.0.0")).toEqual(undefined);
+  });
+  globalThis.test("an older Node says which version is needed", () => {
+    globalThis.expect(Stdlib_Option.getOr(DeployApp$ReventlessAws.checkNode("20.11.0"), "")).toContain("Node 22 or later");
+  });
+  globalThis.test("Pulumi Cloud needs no passphrase", () => {
+    globalThis.expect(DeployApp$ReventlessAws.backendNeedsPassphrase("https://app.pulumi.com/me", {})).toBe(false);
+  });
+  globalThis.test("a local backend needs one, unless it is set", () => {
+    globalThis.expect(DeployApp$ReventlessAws.backendNeedsPassphrase("file://~", {})).toBe(true);
+    globalThis.expect(DeployApp$ReventlessAws.backendNeedsPassphrase("s3://bucket", Object.fromEntries([[
+        "PULUMI_CONFIG_PASSPHRASE",
+        ""
+      ]]))).toBe(false);
+  });
+});
+
+globalThis.describe("DeployApp stacks and layer", () => {
+  let project_stackDefaults = Object.fromEntries([
+    [
+      "aws:region",
+      "us-east-1"
+    ],
+    [
+      "platform:x",
+      "y"
+    ]
+  ]);
+  let project = {
+    label: "platform",
+    dir: "/app/platform-aws",
+    projectName: "shop-platform-aws",
+    program: "/app/platform-aws/src/Main.res.mjs",
+    stackDefaults: project_stackDefaults
+  };
+  globalThis.test("a new stack gets the app's defaults, then the region and the try-out flag", () => {
+    globalThis.expect(DeployApp$ReventlessAws.newStackConfig(project, "eu-west-1")).toEqual([
+      [
+        "aws:region",
+        "us-east-1"
+      ],
+      [
+        "platform:x",
+        "y"
+      ],
+      [
+        "aws:region",
+        "eu-west-1"
+      ],
+      [
+        "aws-native:region",
+        "eu-west-1"
+      ],
+      [
+        "reventless:disposable",
+        "true"
+      ]
+    ]);
+  });
+  globalThis.test("the release download is named by the package and version", () => {
+    globalThis.expect(DeployApp$ReventlessAws.releaseUrl("3.0.0-alpha.346")).toBe("https://github.com/ReventlessDev/reventless-core/releases/download/%40reventlessdev%2Freventless-aws%403.0.0-alpha.346/reventless-layer.zip");
+  });
+  globalThis.test("a layer is marked with the release it was published for", () => {
+    globalThis.expect(DeployApp$ReventlessAws.layerDescription("3.0.0")).toBe("reventless-aws@3.0.0");
+  });
+  globalThis.test("sign-ins line up under each other", () => {
+    globalThis.expect(DeployApp$ReventlessAws.signInLines([
+      {
+        username: "admin@example.com",
+        password: "",
+        groups: ["Admin"]
+      },
+      {
+        username: "a@example.com",
+        password: "",
+        groups: []
+      }
+    ])).toEqual([
+      "    admin@example.com  [Admin]",
+      "    a@example.com      []"
+    ]);
+  });
+});
+
+/*  Not a pure module */

package/tests/LambdaLayerLookupTest.res

@@ -0,0 +1,104 @@
+open JestGlobals
+
+module Lambda = PulumiAws.Lambda
+
+// A deploy with no layer used to succeed and leave every function failing with
+// "Cannot find package". These pin what the lookup tells apart and what the
+// stopped deploy says.
+let parameter = "/reventless/layer-arn/dev"
+
+let cliResult = (~status=?, ~stdout="", ~stderr="", ~error=?) => {
+  NodeChildProcess.status: status->Nullable.fromOption,
+  stdout: Nullable.make(stdout),
+  stderr: Nullable.make(stderr),
+  error: error->Nullable.fromOption,
+}
+
+describe("Lambda.classifySsmLookup", () => {
+  let classify = (~region=Some("eu-west-1"), result) =>
+    Lambda.classifySsmLookup(~parameter, ~region, result)
+
+  testSync("a stored value is the layer", () =>
+    expect(
+      classify(cliResult(~status=0, ~stdout="arn:aws:lambda:eu-west-1:1:layer:reventless:7\n")),
+    )->toEqual(Lambda.Found("arn:aws:lambda:eu-west-1:1:layer:reventless:7"))
+  )
+
+  testSync("ParameterNotFound means there is no layer", () =>
+    expect(
+      classify(
+        cliResult(
+          ~status=254,
+          ~stderr="\nAn error occurred (ParameterNotFound) when calling the GetParameter operation: \n",
+        ),
+      ),
+    )->toEqual(Lambda.NotFound({parameter, region: Some("eu-west-1")}))
+  )
+
+  testSync("a refused call is not mistaken for a missing layer", () =>
+    expect(
+      classify(
+        cliResult(
+          ~status=254,
+          ~stderr="\nAn error occurred (AccessDeniedException) when calling the GetParameter operation: no\n",
+        ),
+      ),
+    )->toEqual(
+      Lambda.CouldNotLook({
+        parameter,
+        region: Some("eu-west-1"),
+        reason: "An error occurred (AccessDeniedException) when calling the GetParameter operation: no",
+      }),
+    )
+  )
+
+  testSync("a CLI that cannot be started is not mistaken for a missing layer", () => {
+    let error = JsError.make("spawnSync aws ENOENT")->JsError.toJsExn
+    let reason = switch classify(
+      ~region=None,
+      {...cliResult(~error), stdout: Nullable.null, stderr: Nullable.null},
+    ) {
+    | CouldNotLook({reason}) => Some(reason)
+    | _ => None
+    }
+    expect(reason)->toEqual(Some("the AWS CLI could not be run (spawnSync aws ENOENT)"))
+  })
+})
+
+describe("Lambda.missingLayerMessage", () => {
+  testSync("names the parameter and the region it looked in", () => {
+    let message =
+      Lambda.NotFound({parameter, region: Some("eu-west-1")})
+      ->Lambda.missingLayerMessage
+      ->Option.getOr("")
+    expect(message)->toContain(parameter)
+    expect(message)->toContain("region eu-west-1")
+    expect(message)->toContain("REVENTLESS_LAYER_ARN")
+  })
+
+  testSync("says when the CLI's default region was asked", () =>
+    expect(
+      Lambda.NotFound({parameter, region: None})->Lambda.missingLayerMessage->Option.getOr(""),
+    )->toContain("the AWS CLI's default region")
+  )
+
+  testSync("carries the reason a lookup could not be made", () =>
+    expect(
+      Lambda.CouldNotLook({parameter, region: None, reason: "no credentials"})
+      ->Lambda.missingLayerMessage
+      ->Option.getOr(""),
+    )->toContain("no credentials")
+  )
+
+  testSync("is silent when the layer was found", () =>
+    expect(Lambda.Found("arn")->Lambda.missingLayerMessage)->toEqual(None)
+  )
+})
+
+describe("Lambda.reventlessLayerArn", () => {
+  testSync("REVENTLESS_LAYER_ARN wins without asking AWS", () =>
+    expect(Lambda.reventlessLayerArn())->toBe(
+      "arn:aws:lambda:eu-central-1:000000000000:layer:reventless-test:1",
+    )
+  )
+})

package/tests/LambdaLayerLookupTest.res.mjs

@@ -0,0 +1,117 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+
+let parameter = "/reventless/layer-arn/dev";
+
+function cliResult(status, stdoutOpt, stderrOpt, error) {
+  let stdout = stdoutOpt !== undefined ? stdoutOpt : "";
+  let stderr = stderrOpt !== undefined ? stderrOpt : "";
+  return {
+    status: Stdlib_Nullable.fromOption(status),
+    stdout: stdout,
+    stderr: stderr,
+    error: Stdlib_Nullable.fromOption(error)
+  };
+}
+
+globalThis.describe("Lambda.classifySsmLookup", () => {
+  let classify = (regionOpt, result) => {
+    let region = regionOpt !== undefined ? Primitive_option.valFromOption(regionOpt) : "eu-west-1";
+    return Lambda$PulumiAws.classifySsmLookup(parameter, region, result);
+  };
+  globalThis.test("a stored value is the layer", () => {
+    globalThis.expect(classify(undefined, cliResult(0, "arn:aws:lambda:eu-west-1:1:layer:reventless:7\n", undefined, undefined))).toEqual({
+      TAG: "Found",
+      _0: "arn:aws:lambda:eu-west-1:1:layer:reventless:7"
+    });
+  });
+  globalThis.test("ParameterNotFound means there is no layer", () => {
+    globalThis.expect(classify(undefined, cliResult(254, undefined, "\nAn error occurred (ParameterNotFound) when calling the GetParameter operation: \n", undefined))).toEqual({
+      TAG: "NotFound",
+      parameter: parameter,
+      region: "eu-west-1"
+    });
+  });
+  globalThis.test("a refused call is not mistaken for a missing layer", () => {
+    globalThis.expect(classify(undefined, cliResult(254, undefined, "\nAn error occurred (AccessDeniedException) when calling the GetParameter operation: no\n", undefined))).toEqual({
+      TAG: "CouldNotLook",
+      parameter: parameter,
+      region: "eu-west-1",
+      reason: "An error occurred (AccessDeniedException) when calling the GetParameter operation: no"
+    });
+  });
+  globalThis.test("a CLI that cannot be started is not mistaken for a missing layer", () => {
+    let error = new Error("spawnSync aws ENOENT");
+    let init = cliResult(undefined, undefined, undefined, Primitive_option.some(error));
+    let match = classify(Primitive_option.some(undefined), {
+      status: init.status,
+      stdout: null,
+      stderr: null,
+      error: init.error
+    });
+    let reason;
+    switch (match.TAG) {
+      case "Found" :
+      case "NotFound" :
+        reason = undefined;
+        break;
+      case "CouldNotLook" :
+        reason = match.reason;
+        break;
+    }
+    globalThis.expect(reason).toEqual("the AWS CLI could not be run (spawnSync aws ENOENT)");
+  });
+});
+
+globalThis.describe("Lambda.missingLayerMessage", () => {
+  globalThis.test("names the parameter and the region it looked in", () => {
+    let message = Stdlib_Option.getOr(Lambda$PulumiAws.missingLayerMessage({
+      TAG: "NotFound",
+      parameter: parameter,
+      region: "eu-west-1"
+    }), "");
+    globalThis.expect(message).toContain(parameter);
+    globalThis.expect(message).toContain("region eu-west-1");
+    globalThis.expect(message).toContain("REVENTLESS_LAYER_ARN");
+  });
+  globalThis.test("says when the CLI's default region was asked", () => {
+    globalThis.expect(Stdlib_Option.getOr(Lambda$PulumiAws.missingLayerMessage({
+      TAG: "NotFound",
+      parameter: parameter,
+      region: undefined
+    }), "")).toContain("the AWS CLI's default region");
+  });
+  globalThis.test("carries the reason a lookup could not be made", () => {
+    globalThis.expect(Stdlib_Option.getOr(Lambda$PulumiAws.missingLayerMessage({
+      TAG: "CouldNotLook",
+      parameter: parameter,
+      region: undefined,
+      reason: "no credentials"
+    }), "")).toContain("no credentials");
+  });
+  globalThis.test("is silent when the layer was found", () => {
+    globalThis.expect(Lambda$PulumiAws.missingLayerMessage({
+      TAG: "Found",
+      _0: "arn"
+    })).toEqual(undefined);
+  });
+});
+
+globalThis.describe("Lambda.reventlessLayerArn", () => {
+  globalThis.test("REVENTLESS_LAYER_ARN wins without asking AWS", () => {
+    globalThis.expect(Lambda$PulumiAws.reventlessLayerArn()).toBe("arn:aws:lambda:eu-central-1:000000000000:layer:reventless-test:1");
+  });
+});
+
+let Lambda;
+
+export {
+  Lambda,
+  parameter,
+  cliResult,
+}
+/*  Not a pure module */

package/tests/ProvisionAccountsTest.res

@@ -0,0 +1,168 @@
+open JestGlobals
+
+// What can be decided before an AWS call is made: which pool and which manifest
+// the run is about, and which usernames a pool could never authenticate.
+//
+// The applying itself is not covered here — it is four SDK calls in a loop. What
+// is covered is the preflight, because its whole purpose is to fail *before*
+// half a cast exists, and the argument parsing, because getting it wrong
+// provisions the right accounts into the wrong deployment.
+//
+// The manifest's own rules — what a second run does to a password already in the
+// file — live with the format, in `spec`'s `AccountsManifestTest`.
+
+module Provision = ProvisionAccounts
+
+describe("ProvisionAccounts.parseArgs", () => {
+  testSync("no arguments leaves every choice unanswered", () =>
+    expect(Provision.parseArgs([]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, file: None, help: false}),
+    )
+  )
+
+  testSync("a pool and a manifest parse", () =>
+    expect(
+      Provision.parseArgs(["--provider-id", "eu-west-1_AbCdEfGhI", "--file", "cast.yaml"]),
+    )->toEqual(
+      Ok({
+        Provision.providerId: Some("eu-west-1_AbCdEfGhI"),
+        stack: None,
+        file: Some("cast.yaml"),
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--stack picks the deployment to read the pool id from", () =>
+    expect(Provision.parseArgs(["--stack", "beta"]))->toEqual(
+      Ok({Provision.providerId: None, stack: Some("beta"), file: None, help: false}),
+    )
+  )
+
+  // The reason unknown flags refuse rather than being skipped, and it lands
+  // harder here than on the first administrator: a typo'd `--provider-id` falls
+  // through to the environment and creates the whole cast in a different pool
+  // than the operator named.
+  testSync("an unknown flag refuses rather than being ignored", () =>
+    expect(Provision.parseArgs(["--pool", "eu-west-1_AbCdEfGhI"]))->toEqual(
+      Error(`unknown argument "--pool"`),
+    )
+  )
+
+  testSync("a flag with no value refuses", () =>
+    expect(Provision.parseArgs(["--provider-id"]))->toEqual(Error("--provider-id needs a value"))
+  )
+
+  testSync("-h asks for the usage", () =>
+    expect(Provision.parseArgs(["-h"]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, file: None, help: true}),
+    )
+  )
+})
+
+// Which pool a run writes to, which is the one decision that is expensive to get
+// wrong: provisioning a cast into the wrong deployment succeeds, and leaves
+// working accounts somewhere nobody is looking.
+//
+// The stack fallback is not exercised here — it shells out to `pulumi`, and a
+// test that did would depend on a logged-in CLI and a deployed stack. What is
+// covered is the precedence above it, and that every answer says where it came
+// from, which is what makes a wrong-pool run visible rather than silent.
+describe("ProvisionProvider.resolve", () => {
+  let withoutEnv = fn => {
+    let saved = NodeProcess.env->Dict.get(ProvisionProvider.envKey)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    let outcome = fn()
+    switch saved {
+    | Some(value) => NodeProcess.env->Dict.set(ProvisionProvider.envKey, value)
+    | None => ()
+    }
+    outcome
+  }
+
+  testSync("an explicit id wins, and says so", () =>
+    expect(
+      withoutEnv(
+        () => ProvisionProvider.resolve(~given=Some("eu-west-1_Explicit"), ~stack=Some("alpha")),
+      ),
+    )->toEqual(Ok(("eu-west-1_Explicit", ProvisionProvider.Flag)))
+  )
+
+  // The flag beats the variable rather than the other way round: a CI shell that
+  // exports one for every stack must still be overridable for a single run.
+  testSync("an explicit id beats the environment", () => {
+    NodeProcess.env->Dict.set(ProvisionProvider.envKey, "eu-west-1_FromEnv")
+    let resolved = ProvisionProvider.resolve(~given=Some("eu-west-1_Explicit"), ~stack=None)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    expect(resolved)->toEqual(Ok(("eu-west-1_Explicit", ProvisionProvider.Flag)))
+  })
+
+  testSync("the environment answers when no flag does", () => {
+    NodeProcess.env->Dict.set(ProvisionProvider.envKey, "eu-west-1_FromEnv")
+    let resolved = ProvisionProvider.resolve(~given=None, ~stack=None)
+    NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+    expect(resolved)->toEqual(Ok(("eu-west-1_FromEnv", ProvisionProvider.Environment)))
+  })
+
+  // An empty variable is not an answer. Exporting it unset is the ordinary shape
+  // of a CI script whose earlier step did not run, and reading "" as the pool id
+  // would fail much later with a message about Cognito rather than about setup.
+  testSync("an empty environment variable is not an answer", () =>
+    expect({
+      NodeProcess.env->Dict.set(ProvisionProvider.envKey, "   ")
+      let resolved = ProvisionProvider.resolve(~given=None, ~stack=Some("no-such-stack-here"))
+      NodeProcess.env->Dict.delete(ProvisionProvider.envKey)
+      resolved->Result.isError
+    })->toBe(true)
+  )
+
+  testSync("each source describes itself", () => {
+    expect(ProvisionProvider.describe(Flag))->toBe("--provider-id")
+    expect(ProvisionProvider.describe(Environment))->toBe("REVENTLESS_IDENTITY_PROVIDER_ID")
+    expect(ProvisionProvider.describe(Stack("beta")))->toBe("stack beta")
+  })
+})
+
+// A manifest usually names plain usernames — `shopper`, `merch` — and a pool
+// created with `UsernameAttributes: [email]` will not take them. The accounts it
+// makes instead are correctly created and cannot authenticate, which is a symptom
+// that arrives at a login screen far from the run that caused it.
+describe("ProvisionAccounts.looksLikeEmail", () => {
+  testSync("an address is one", () =>
+    expect(Provision.looksLikeEmail("me@example.com"))->toBe(true)
+  )
+
+  testSync("a demo username is not", () => expect(Provision.looksLikeEmail("shopper"))->toBe(false))
+
+  // Not a validator — Cognito owns that. It answers one question: would this pool
+  // accept this string as a sign-in name. A local part with no domain would not.
+  testSync("an @ with no domain dot is not", () =>
+    expect(Provision.looksLikeEmail("admin@localhost"))->toBe(false)
+  )
+})
+
+// A refused pool used to leave generated passwords in the file, and the seed then
+// offered accounts that exist nowhere.
+describe("ProvisionAccounts.provision", () => {
+  let manifest = `# the cast
+- username: shopper
+  password: ""
+  groups: [Shopper]
+`
+
+  test("a refused pool leaves the manifest untouched", async () => {
+    let dir = NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), "provision-accounts-"]))
+    let file = NodePath.join([dir, "users.yaml"])
+    NodeFs.writeFileSync(file, manifest)
+    let refuse = async (~providerId as _, ~usernames as _) => Error("pool signs in on email")
+    let outcome = await Provision.provision(
+      ~file,
+      ~providerId="eu-west-1_Refuses",
+      ~checkPool=refuse,
+    )
+    let after = NodeFs.readFileSync(file)
+    NodeFs.rmSync(dir, {recursive: true, force: true})
+    expect(outcome)->toEqual(Error("pool signs in on email"))
+    expect(after)->toBe(manifest)
+  })
+})