@reventlessdev/reventless-aws 3.0.0-alpha.368 → 3.0.0-alpha.370

package/tests/ResolveEnvironmentTest.res.mjs

@@ -0,0 +1,128 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Environments$Reventless from "@reventlessdev/reventless-spec/src/types/Environments.res.mjs";
+import * as ResolveEnvironment$ReventlessAws from "../scripts/ResolveEnvironment.res.mjs";
+
+let environments = Environments$Reventless.parseString(`environments:
+  - { name: review,     purpose: review,     pullRequestsInto: dev }
+  - { name: dev,        purpose: dev,        branch: dev }
+  - { name: production, purpose: production, branch: main, tags: "v*", stack: prod }
+`);
+
+let environments$1;
+
+environments$1 = environments.TAG === "Ok" ? environments._0 : Stdlib_JsError.throwWithMessage(environments._0);
+
+globalThis.describe("ResolveEnvironment.parseArgs", () => {
+  globalThis.test("a ref asks about a push", () => {
+    globalThis.expect(Stdlib_Result.map(ResolveEnvironment$ReventlessAws.parseArgs([
+      "--ref",
+      "refs/heads/dev"
+    ]), a => a.request)).toEqual({
+      TAG: "Ok",
+      _0: {
+        TAG: "Push",
+        _0: "refs/heads/dev"
+      }
+    });
+  });
+  globalThis.test("a pull request needs the branch it targets", () => {
+    globalThis.expect(Stdlib_Result.isError(ResolveEnvironment$ReventlessAws.parseArgs([
+      "--pull-request",
+      "7"
+    ]))).toBe(true);
+  });
+  globalThis.test("a pull request with its base and draft state", () => {
+    globalThis.expect(Stdlib_Result.map(ResolveEnvironment$ReventlessAws.parseArgs([
+      "--pull-request",
+      "7",
+      "--base",
+      "dev",
+      "--draft"
+    ]), a => a.request)).toEqual({
+      TAG: "Ok",
+      _0: {
+        TAG: "PullRequest",
+        number: 7,
+        base: "dev",
+        draft: true
+      }
+    });
+  });
+  globalThis.test("a pull request number that is not a number is refused", () => {
+    globalThis.expect(Stdlib_Result.isError(ResolveEnvironment$ReventlessAws.parseArgs([
+      "--pull-request",
+      "seven",
+      "--base",
+      "dev"
+    ]))).toBe(true);
+  });
+  globalThis.test("both questions at once are refused", () => {
+    globalThis.expect(Stdlib_Result.isError(ResolveEnvironment$ReventlessAws.parseArgs([
+      "--ref",
+      "refs/heads/dev",
+      "--pull-request",
+      "7",
+      "--base",
+      "dev"
+    ]))).toBe(true);
+  });
+  globalThis.test("no question is refused", () => {
+    globalThis.expect(Stdlib_Result.isError(ResolveEnvironment$ReventlessAws.parseArgs([]))).toBe(true);
+  });
+});
+
+globalThis.describe("ResolveEnvironment.answer", () => {
+  globalThis.test("a push to a branch prints its environment, stack and purpose", () => {
+    globalThis.expect(ResolveEnvironment$ReventlessAws.answer(environments$1, {
+      TAG: "Push",
+      _0: "refs/heads/main"
+    })).toEqual([
+      "matched=true",
+      "environment=production",
+      "stack=prod",
+      "purpose=production"
+    ]);
+  });
+  globalThis.test("a tag deploys where its pattern says", () => {
+    globalThis.expect(ResolveEnvironment$ReventlessAws.answer(environments$1, {
+        TAG: "Push",
+        _0: "refs/tags/v1.2.0"
+      })[2]).toEqual("stack=prod");
+  });
+  globalThis.test("a pull request into dev gets its review stack", () => {
+    globalThis.expect(ResolveEnvironment$ReventlessAws.answer(environments$1, {
+      TAG: "PullRequest",
+      number: 7,
+      base: "dev",
+      draft: false
+    })).toEqual([
+      "matched=true",
+      "environment=review",
+      "stack=review-pr-7",
+      "purpose=review"
+    ]);
+  });
+  globalThis.test("nothing matched is an answer, not an error", () => {
+    globalThis.expect(ResolveEnvironment$ReventlessAws.answer(environments$1, {
+      TAG: "Push",
+      _0: "refs/heads/feature/x"
+    })).toEqual(["matched=false"]);
+  });
+  globalThis.test("a ref that is neither a branch nor a tag matches nothing", () => {
+    globalThis.expect(ResolveEnvironment$ReventlessAws.answer(environments$1, {
+      TAG: "Push",
+      _0: "refs/pull/7/merge"
+    })).toEqual(["matched=false"]);
+  });
+});
+
+let Resolve;
+
+export {
+  Resolve,
+  environments$1 as environments,
+}
+/* environments Not a pure module */

package/tests/Util_OwnerScopeEnvTest.res

@@ -68,7 +68,7 @@ describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
   testSync("the platform's administrator default reaches a composed environment", () => {
     Reventless.OwnerScope.clearElevatedGroups()
     NodeProcess.env->Dict.delete(Util_OwnerScopeEnv.key)
-    Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+    Reventless.OwnerScope.defaultElevatedRoles([Reventless.Role.admin])
 
     let variables = Dict.make()
     Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
@@ -81,7 +81,53 @@ describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
     // Round-tripped, like the first case above: the runtime reads this back with
     // `parseElevatedGroups`, so the encoding is asserted rather than the spelling.
     expect(Reventless.OwnerScope.parseElevatedGroups(encoded))->toEqual([
-      Reventless.AdminGroup.name,
+      Reventless.Role.adminGroup(),
     ])
   })
+
+  // Runtimes read groups, never roles, so an elevated role travels as the group
+  // the deploy program mapped it to.
+  testSync("an elevated role travels as the group it is mapped to", () => {
+    Reventless.OwnerScope.clearElevatedGroups()
+    Reventless.Role.clearGroups()
+    NodeProcess.env->Dict.delete(Util_OwnerScopeEnv.key)
+    Reventless.Role.setGroups([(Reventless.Role.make("Fulfilment"), "shop-ops")])
+    Reventless.OwnerScope.setElevatedRoles([Reventless.Role.make("Fulfilment")])
+    Reventless.OwnerScope.setElevatedGroups(["Admin"])
+
+    let variables = Dict.make()
+    Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
+    let encoded = switch variables->Dict.get(Util_OwnerScopeEnv.key) {
+    | Some(value) => value->Obj.magic
+    | None => ""
+    }
+    Reventless.OwnerScope.clearElevatedGroups()
+    Reventless.Role.clearGroups()
+
+    expect(Reventless.OwnerScope.parseElevatedGroups(encoded))->toEqual(["Admin", "shop-ops"])
+  })
+})
+
+describe("Util_OwnerScopeEnv.applyRoleGroupsDefault", () => {
+  testSync("carries the renamed roles, and only those", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.make("Merchandiser"), "shop-merch-team")])
+    let variables = Dict.make()
+    Util_OwnerScopeEnv.applyRoleGroupsDefault(variables)
+    Reventless.Role.clearGroups()
+    let encoded = switch variables->Dict.get(Reventless.Role.envKey) {
+    | Some(value) => value->Obj.magic
+    | None => ""
+    }
+    expect(Reventless.Role.parseGroups(encoded))->toEqual([
+      (Reventless.Role.make("Merchandiser"), "shop-merch-team"),
+    ])
+  })
+
+  testSync("adds nothing when no role is renamed", () => {
+    Reventless.Role.clearGroups()
+    let variables = Dict.make()
+    Util_OwnerScopeEnv.applyRoleGroupsDefault(variables)
+    expect(variables->Dict.get(Reventless.Role.envKey)->Option.isNone)->toBe(true)
+  })
 })

package/tests/Util_OwnerScopeEnvTest.res.mjs

@@ -2,7 +2,7 @@
 
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Util_OwnerScopeEnv$ReventlessAws from "../src/util/Util_OwnerScopeEnv.res.mjs";
 
@@ -59,13 +59,59 @@ globalThis.describe("Util_OwnerScopeEnv — the elevated-groups carrier", () =>
   globalThis.test("the platform's administrator default reaches a composed environment", () => {
     OwnerScope$Reventless.clearElevatedGroups();
     Stdlib_Dict.$$delete(process.env, Util_OwnerScopeEnv$ReventlessAws.key);
-    OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+    OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
     let variables = {};
     Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
     let value = variables[Util_OwnerScopeEnv$ReventlessAws.key];
     let encoded = value !== undefined ? value : "";
     OwnerScope$Reventless.clearElevatedGroups();
-    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([AdminGroup$Reventless.name]);
+    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([Role$Reventless.adminGroup()]);
+  });
+  globalThis.test("an elevated role travels as the group it is mapped to", () => {
+    OwnerScope$Reventless.clearElevatedGroups();
+    Role$Reventless.clearGroups();
+    Stdlib_Dict.$$delete(process.env, Util_OwnerScopeEnv$ReventlessAws.key);
+    Role$Reventless.setGroups([[
+        "Fulfilment",
+        "shop-ops"
+      ]]);
+    OwnerScope$Reventless.setElevatedRoles(["Fulfilment"]);
+    OwnerScope$Reventless.setElevatedGroups(["Admin"]);
+    let variables = {};
+    Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
+    let value = variables[Util_OwnerScopeEnv$ReventlessAws.key];
+    let encoded = value !== undefined ? value : "";
+    OwnerScope$Reventless.clearElevatedGroups();
+    Role$Reventless.clearGroups();
+    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([
+      "Admin",
+      "shop-ops"
+    ]);
+  });
+});
+
+globalThis.describe("Util_OwnerScopeEnv.applyRoleGroupsDefault", () => {
+  globalThis.test("carries the renamed roles, and only those", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        "Merchandiser",
+        "shop-merch-team"
+      ]]);
+    let variables = {};
+    Util_OwnerScopeEnv$ReventlessAws.applyRoleGroupsDefault(variables);
+    Role$Reventless.clearGroups();
+    let value = variables[Role$Reventless.envKey];
+    let encoded = value !== undefined ? value : "";
+    globalThis.expect(Role$Reventless.parseGroups(encoded)).toEqual([[
+        "Merchandiser",
+        "shop-merch-team"
+      ]]);
+  });
+  globalThis.test("adds nothing when no role is renamed", () => {
+    Role$Reventless.clearGroups();
+    let variables = {};
+    Util_OwnerScopeEnv$ReventlessAws.applyRoleGroupsDefault(variables);
+    globalThis.expect(Stdlib_Option.isNone(variables[Role$Reventless.envKey])).toBe(true);
   });
 });
 

package/tests/Util_ShellConfigTest.res

@@ -328,3 +328,20 @@ describe("the subscription endpoint", () => {
     )
   )
 })
+
+// The shell gates its admin discovery on this group; a mirror of the server's
+// own resolution, so a renamed administrator role reaches the browser too.
+describe("Util_ShellConfig.fields — adminGroup", () => {
+  testSync("is absent while the administrator role keeps its own name", () => {
+    Reventless.Role.clearGroups()
+    expect(Util_ShellConfig.fields(~computed)->Dict.get("adminGroup")->Option.isNone)->toBe(true)
+  })
+
+  testSync("carries the group a renamed administrator role maps to", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.admin, "shop-admins")])
+    let out = Util_ShellConfig.fields(~computed)
+    Reventless.Role.clearGroups()
+    expect(out->get("adminGroup"))->toEqual(JSON.Encode.string("shop-admins"))
+  })
+})

package/tests/Util_ShellConfigTest.res.mjs

@@ -4,6 +4,7 @@ import * as JestGlobals from "@reventlessdev/rescript-jest/src/JestGlobals.res.m
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
@@ -341,6 +342,23 @@ globalThis.describe("the subscription endpoint", () => {
   });
 });
 
+globalThis.describe("Util_ShellConfig.fields — adminGroup", () => {
+  globalThis.test("is absent while the administrator role keeps its own name", () => {
+    Role$Reventless.clearGroups();
+    globalThis.expect(Stdlib_Option.isNone(Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, undefined, undefined)["adminGroup"])).toBe(true);
+  });
+  globalThis.test("carries the group a renamed administrator role maps to", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        Role$Reventless.admin,
+        "shop-admins"
+      ]]);
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, undefined, undefined);
+    Role$Reventless.clearGroups();
+    globalThis.expect(get(out, "adminGroup")).toEqual("shop-admins");
+  });
+});
+
 export {
   computed,
   get,

package/tests/integration/AggTestAggregate.res

@@ -18,6 +18,7 @@ type error = AlreadyExists
 
 let name = "AggTestAggregate"
 let moduleUrl = "agg-test://AggTestAggregate"
-let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type role = Reventless.Role.name
+let commandAuthorization = (_: command): Reventless.Authorization.rule<role> => AllowAnonymous
 type lifecycleState = unit
 let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted

package/tests/integration/EpCompositeSlice.res

@@ -63,7 +63,8 @@ type event =
 
 let name = "EpCompositeSlice"
 let moduleUrl = "ep-test://EpCompositeSlice"
-let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type role = Reventless.Role.name
+let commandAuthorization = (_: command): Reventless.Authorization.rule<role> => AllowAnonymous
 type lifecycleState = unit
 let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted
 let readConsistency = Reventless.ReadConsistency.EscalateOnRetry

package/tests/integration/EpTestSlice.res

@@ -21,7 +21,8 @@ type event = WidgetAdded({widgetId: @s.matches(Reventless.DcbTag.partition) stri
 
 let name = "EpTestSlice"
 let moduleUrl = "ep-test://EpTestSlice"
-let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type role = Reventless.Role.name
+let commandAuthorization = (_: command): Reventless.Authorization.rule<role> => AllowAnonymous
 type lifecycleState = unit
 let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted
 let readConsistency = Reventless.ReadConsistency.EscalateOnRetry

package/tests/integration/QueryDbUnion_DynamoDb_IntegrationTest.res

@@ -32,7 +32,8 @@ module CustomersSpec = {
 
   let config = Reventless.ReadModel.config()
   let subIdConfig = None
-  let authorization: Reventless.Authorization.permission = AllowAuthenticated
+  type role = Reventless.Role.name
+  let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
   let visibility: Reventless.Visibility.t = Public
 }