@reventlessdev/reventless-aws 3.0.0-alpha.394 → 3.0.0-alpha.396

package/tests/IdentityProvider_Cognito_BackendTest.res.mjs

@@ -0,0 +1,442 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
+import * as IdentityProvider_Cognito_Backend$ReventlessAws from "../src/adapter/Identity/IdentityProvider_Cognito_Backend.res.mjs";
+import * as AutomationSliceRuntime_Builder_Single$ReventlessAws from "../src/adapter/Runtime/AutomationSliceRuntime_Builder_Single.res.mjs";
+
+function awsError(code) {
+  let e = new Error(code + `: from the fake pool`);
+  e.name = code;
+  return e;
+}
+
+function fakeOps(pool, failOn) {
+  let record = step => {
+    pool.calls.push(step);
+    if (failOn === undefined) {
+      return;
+    }
+    if (failOn[0] !== step) {
+      return;
+    }
+    throw awsError(failOn[1]);
+  };
+  return {
+    createUser: async (username, param) => {
+      record("createUser");
+      if (username in pool.users) {
+        throw awsError("UsernameExistsException");
+      }
+      let sub = `sub-` + username;
+      pool.users[username] = [
+        sub,
+        []
+      ];
+      return sub;
+    },
+    subOf: async username => {
+      record("subOf");
+      let match = pool.users[username];
+      if (match !== undefined) {
+        return match[0];
+      }
+      throw awsError("UserNotFoundException");
+    },
+    setPassword: async (param, param$1) => record("setPassword"),
+    addToGroup: async (username, group) => {
+      record("addToGroup");
+      let match = pool.users[username];
+      if (match !== undefined) {
+        pool.users[username] = [
+          match[0],
+          match[1].concat([group])
+        ];
+        return;
+      }
+      throw awsError("UserNotFoundException");
+    },
+    removeFromGroup: async (username, group) => {
+      record("removeFromGroup");
+      let match = pool.users[username];
+      if (match !== undefined) {
+        pool.users[username] = [
+          match[0],
+          match[1].filter(g => g !== group)
+        ];
+        return;
+      }
+      throw awsError("UserNotFoundException");
+    },
+    deleteUser: async username => {
+      record("deleteUser");
+      if (!(username in pool.users)) {
+        throw awsError("UserNotFoundException");
+      }
+      return Stdlib_Dict.$$delete(pool.users, username);
+    },
+    putUserId: async (sub, userId) => {
+      record("putUserId");
+      pool.rows[sub] = userId;
+    },
+    deleteUserId: async sub => {
+      record("deleteUserId");
+      return Stdlib_Dict.$$delete(pool.rows, sub);
+    }
+  };
+}
+
+function emptyPool() {
+  return {
+    users: {},
+    rows: {},
+    calls: []
+  };
+}
+
+function email(address) {
+  return {
+    TAG: "ToEmail",
+    _0: address
+  };
+}
+
+globalThis.describe("IdentityProvider_Cognito_Backend", () => {
+  globalThis.test("creates the principal, sets its password and groups, and mints its id", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let provider = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), true);
+    let answer = await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "new@example.com"
+    }, {
+      TAG: "Password",
+      _0: "pw"
+    }, ["Shopper"]);
+    globalThis.expect(answer).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "new@example.com"
+      }
+    });
+    globalThis.expect(pool_users["new@example.com"]).toEqual([
+      "sub-new@example.com",
+      ["Shopper"]
+    ]);
+    globalThis.expect(Stdlib_Option.map(pool_rows["sub-new@example.com"], Auth_UserId$ReventlessCore.isMinted)).toEqual(true);
+  });
+  globalThis.test("an existing account is a Conflict, not an outage", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let provider = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), true);
+    let create = () => provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "twice@example.com"
+    }, "NoCredential", []);
+    await create();
+    globalThis.expect(await create()).toEqual({
+      TAG: "Error",
+      _0: "Conflict"
+    });
+  });
+  globalThis.test("a later step failing undoes the account, so a retry starts clean", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let failing = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, [
+      "addToGroup",
+      "TooManyRequestsException"
+    ]), true);
+    let first = await failing.createPrincipal({
+      TAG: "ToEmail",
+      _0: "retry@example.com"
+    }, {
+      TAG: "Password",
+      _0: "pw"
+    }, ["Shopper"]);
+    let tmp;
+    if (first.TAG === "Ok") {
+      tmp = false;
+    } else {
+      let tmp$1 = first._0;
+      tmp = typeof tmp$1 !== "object" ? false : tmp$1.TAG === "Unavailable";
+    }
+    globalThis.expect(tmp).toBe(true);
+    globalThis.expect("retry@example.com" in pool_users).toBe(false);
+    globalThis.expect(Object.keys(pool_rows)).toEqual([]);
+    let healthy = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), true);
+    let second = await healthy.createPrincipal({
+      TAG: "ToEmail",
+      _0: "retry@example.com"
+    }, {
+      TAG: "Password",
+      _0: "pw"
+    }, ["Shopper"]);
+    globalThis.expect(second).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "retry@example.com"
+      }
+    });
+  });
+  globalThis.test("a password the pool's policy rejects is Refused, and undone", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let provider = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, [
+      "setPassword",
+      "InvalidPasswordException"
+    ]), true);
+    let answer = await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "weak@example.com"
+    }, {
+      TAG: "Password",
+      _0: "1"
+    }, []);
+    let tmp;
+    if (answer.TAG === "Ok") {
+      tmp = false;
+    } else {
+      let tmp$1 = answer._0;
+      tmp = typeof tmp$1 !== "object" ? false : tmp$1.TAG !== "Unavailable";
+    }
+    globalThis.expect(tmp).toBe(true);
+    globalThis.expect("weak@example.com" in pool_users).toBe(false);
+  });
+  globalThis.test("NoCredential sets no password", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let provider = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), true);
+    await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "later@example.com"
+    }, "NoCredential", []);
+    globalThis.expect(pool_calls.includes("setPassword")).toBe(false);
+  });
+  globalThis.test("without a store, no id is minted", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let provider = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), false);
+    await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "old@example.com"
+    }, "NoCredential", []);
+    globalThis.expect(pool_calls.includes("putUserId")).toBe(false);
+    globalThis.expect("old@example.com" in pool_users).toBe(true);
+  });
+  globalThis.test("a push address is refused before the pool is asked", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let provider = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), true);
+    let answer = await provider.createPrincipal({
+      TAG: "ToPush",
+      _0: {
+        TAG: "Fcm",
+        registrationToken: "tok"
+      }
+    }, "NoCredential", []);
+    let tmp;
+    if (answer.TAG === "Ok") {
+      tmp = false;
+    } else {
+      let tmp$1 = answer._0;
+      tmp = typeof tmp$1 !== "object" ? false : tmp$1.TAG !== "Unavailable";
+    }
+    globalThis.expect(tmp).toBe(true);
+    globalThis.expect(pool_calls).toEqual([]);
+  });
+  globalThis.test("groups change on the pool, and an unknown principal is Refused", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let provider = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), true);
+    let principal = {
+      providerId: "grp@example.com"
+    };
+    await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "grp@example.com"
+    }, "NoCredential", ["Shopper"]);
+    globalThis.expect(await provider.addToGroup(principal, "Reviewer")).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+    globalThis.expect(await provider.removeFromGroup(principal, "Shopper")).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+    globalThis.expect(pool_users["grp@example.com"]).toEqual([
+      "sub-grp@example.com",
+      ["Reviewer"]
+    ]);
+    let match = await provider.addToGroup({
+      providerId: "ghost"
+    }, "Shopper");
+    let tmp;
+    if (match.TAG === "Ok") {
+      tmp = false;
+    } else {
+      let tmp$1 = match._0;
+      tmp = typeof tmp$1 !== "object" ? false : tmp$1.TAG !== "Unavailable";
+    }
+    globalThis.expect(tmp).toBe(true);
+  });
+  globalThis.test("deleting removes the account and its row, and a second delete is Ok", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    let provider = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), true);
+    let principal = {
+      providerId: "gone@example.com"
+    };
+    await provider.createPrincipal({
+      TAG: "ToEmail",
+      _0: "gone@example.com"
+    }, "NoCredential", []);
+    globalThis.expect(await provider.deletePrincipal(principal)).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+    globalThis.expect("gone@example.com" in pool_users).toBe(false);
+    globalThis.expect("sub-gone@example.com" in pool_rows).toBe(false);
+    globalThis.expect(await provider.deletePrincipal(principal)).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+  });
+  globalThis.test("an outage while deleting is retried, not reported as done", async () => {
+    let pool_users = {};
+    let pool_rows = {};
+    let pool_calls = [];
+    let pool = {
+      users: pool_users,
+      rows: pool_rows,
+      calls: pool_calls
+    };
+    await IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, undefined), true).createPrincipal({
+      TAG: "ToEmail",
+      _0: "busy@example.com"
+    }, "NoCredential", []);
+    let failing = IdentityProvider_Cognito_Backend$ReventlessAws.withOps(fakeOps(pool, [
+      "deleteUser",
+      "TooManyRequestsException"
+    ]), true);
+    let match = await failing.deletePrincipal({
+      providerId: "busy@example.com"
+    });
+    let tmp;
+    if (match.TAG === "Ok") {
+      tmp = false;
+    } else {
+      let tmp$1 = match._0;
+      tmp = typeof tmp$1 !== "object" ? false : tmp$1.TAG === "Unavailable";
+    }
+    globalThis.expect(tmp).toBe(true);
+    globalThis.expect("busy@example.com" in pool_users).toBe(true);
+  });
+  globalThis.test("no pool configured answers Unavailable with no operations", () => {
+    globalThis.expect(IdentityProvider_Cognito_Backend$ReventlessAws.provider("", "").operations).toEqual([]);
+  });
+  globalThis.test("a configured pool publishes all four operations", () => {
+    globalThis.expect(IdentityProvider_Cognito_Backend$ReventlessAws.provider("eu-west-1_X", "t").operations).toEqual([
+      "CreatePrincipal",
+      "AddToGroup",
+      "RemoveFromGroup",
+      "DeletePrincipal"
+    ]);
+  });
+});
+
+globalThis.describe("AutomationSliceRuntime_Builder_Single.declaresIdentityProvider", () => {
+  let info = needs => ({
+    specModulePath: "",
+    bodyModulePath: "",
+    callbackType: "outbound",
+    queryDbTableName: Pulumi.output(""),
+    queryDbResources: [],
+    context: undefined,
+    sourceTopics: {},
+    consumesDcbLog: true,
+    commandTargetName: undefined,
+    schedule: undefined,
+    schedulesResources: [],
+    capabilityNeeds: needs
+  });
+  globalThis.test("only a slice declaring the need earns the grant", () => {
+    globalThis.expect(AutomationSliceRuntime_Builder_Single$ReventlessAws.declaresIdentityProvider([
+      info(["Messaging"]),
+      info([])
+    ])).toBe(false);
+    globalThis.expect(AutomationSliceRuntime_Builder_Single$ReventlessAws.declaresIdentityProvider([
+      info(["Messaging"]),
+      info(["IdentityProvider"])
+    ])).toBe(true);
+  });
+});
+
+let Backend;
+
+let IP;
+
+export {
+  Backend,
+  IP,
+  awsError,
+  fakeOps,
+  emptyPool,
+  email,
+}
+/*  Not a pure module */

package/tests/ProvisionAccountsTest.res.mjs

@@ -162,7 +162,7 @@ globalThis.describe("ProvisionAccounts.provision", () => {
       TAG: "Error",
       _0: "pool signs in on email"
     });
-    let outcome = await ProvisionAccounts$ReventlessAws.provision(file, "eu-west-1_Refuses", refuse);
+    let outcome = await ProvisionAccounts$ReventlessAws.provision(file, "eu-west-1_Refuses", undefined, refuse);
     let after = Nodefs.readFileSync(file, "utf8");
     Nodefs.rmSync(dir, {
       recursive: true,

package/tests/Util_ShellConfigTest.res.mjs

@@ -5,7 +5,6 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
-import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as Util_ShellConfig$ReventlessAws from "../src/util/Util_ShellConfig.res.mjs";
@@ -351,7 +350,7 @@ globalThis.describe("Util_ShellConfig.fields — shellConfig passthrough", () =>
 globalThis.describe("Util_ShellConfig.identityFields", () => {
   let fields = Util_ShellConfig$ReventlessAws.identityFields("eu-west-1_x", "7cl13nt");
   let get = key => Stdlib_Option.map(fields.find(param => param[0] === key), param => param[1]);
-  globalThis.test("the new spelling is present", () => {
+  globalThis.test("the identity keys carry the pool and the client", () => {
     globalThis.expect([
       get("identityProviderId"),
       get("identityProviderClientId")
@@ -360,28 +359,8 @@ globalThis.describe("Util_ShellConfig.identityFields", () => {
       "7cl13nt"
     ]);
   });
-  globalThis.test("the deprecated spelling is present too", () => {
-    globalThis.expect([
-      get("cognitoUserPoolId"),
-      get("cognitoClientId")
-    ]).toEqual([
-      "eu-west-1_x",
-      "7cl13nt"
-    ]);
-  });
-  globalThis.test("both spellings carry identical values", () => {
-    globalThis.expect([
-      Primitive_object.equal(get("identityProviderId"), get("cognitoUserPoolId")),
-      Primitive_object.equal(get("identityProviderClientId"), get("cognitoClientId"))
-    ]).toEqual([
-      true,
-      true
-    ]);
-  });
   globalThis.test("nothing else sneaks into the identity field set", () => {
     globalThis.expect(fields.map(param => param[0]).toSorted(Primitive_string.compare)).toEqual([
-      "cognitoClientId",
-      "cognitoUserPoolId",
       "identityProviderClientId",
       "identityProviderId"
     ]);