@reventlessdev/reventless-aws 3.0.0-alpha.395 → 3.0.0-alpha.397

package/tests/Auth_ActiveRoleTrigger_OpsTest.res

@@ -171,3 +171,43 @@ describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
     )->toEqual(Some(["arn:aws:iam::1:role/Shopper"]))
   })
 })
+
+// ── The domain id claim ─────────────────────────────────────────────────────
+//
+// Rides on whatever else the mint adds. The regression line above still holds
+// for every account created before the identity store existed, because such an
+// account has no row and so no `userId` arrives here.
+
+describe("Auth_ActiveRoleTrigger_Ops.respond with a domain id", () => {
+  testSync("no stored role and a domain id adds the claim and nothing else", () => {
+    let input = eventFor(~membership=["Admin", "Shopper"])
+    let event = Trigger.respond(~event=input, ~decision=Unchanged, ~userId="u_abc")
+    expect(claimOf(event, ReventlessCore.Auth_UserId.claim))->toEqual(Some("u_abc"))
+    expect(groupsOf(event))->toEqual(None)
+  })
+
+  testSync("narrowing and a domain id carry both", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Admin", "Shopper"]),
+      ~decision=Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}),
+      ~userId="u_abc",
+    )
+    expect(groupsOf(event))->toEqual(Some(["Shopper"]))
+    expect((
+      claimOf(event, Contract.activeRoleClaim),
+      claimOf(event, ReventlessCore.Auth_UserId.claim),
+    ))->toEqual((Some("Shopper"), Some("u_abc")))
+  })
+
+  testSync("no domain id leaves a narrowed token without the claim", () => {
+    let event = Trigger.respond(
+      ~event=eventFor(~membership=["Admin", "Shopper"]),
+      ~decision=Narrow({role: "Shopper", membership: ["Admin", "Shopper"]}),
+    )
+    expect(claimOf(event, ReventlessCore.Auth_UserId.claim))->toEqual(None)
+  })
+
+  testPromise("no identity store configured reads as no row", async () =>
+    expect(await Trigger.userIdFor(~sub="u-carol", ~table=None))->toEqual(None)
+  )
+})

package/tests/Auth_ActiveRoleTrigger_OpsTest.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 import * as Auth_ActiveRoleTrigger_Ops$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res.mjs";
 
@@ -43,7 +44,7 @@ globalThis.describe("the conformance table, minted by the trigger", () => {
     let requested = param.requested;
     let membership = param.membership;
     globalThis.test(param.label, () => {
-      let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor(membership, undefined, undefined), Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide(membership, requested));
+      let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor(membership, undefined, undefined), Auth_ActiveRoleTrigger_Ops$ReventlessAws.decide(membership, requested), undefined);
       globalThis.expect(Stdlib_Option.getOr(groupsOf(event), membership)).toEqual(Stdlib_Option.getOr(expected, membership));
     });
   });
@@ -84,7 +85,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
       "Admin",
       "Shopper"
     ], undefined, undefined);
-    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(input, "Unchanged")).toEqual(input);
+    globalThis.expect(Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(input, "Unchanged", undefined)).toEqual(input);
   });
   globalThis.test("narrowing puts the chosen role alone in the group claim", () => {
     let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
@@ -97,7 +98,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
         "Admin",
         "Shopper"
       ]
-    });
+    }, undefined);
     globalThis.expect(groupsOf(event)).toEqual(["Shopper"]);
   });
   globalThis.test("a narrowed token records the choice and what it gave up", () => {
@@ -111,7 +112,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
         "Admin",
         "Shopper"
       ]
-    });
+    }, undefined);
     globalThis.expect([
       claimOf(event, Auth_ActiveRole$ReventlessCore.activeRoleClaim),
       claimOf(event, Auth_ActiveRole$ReventlessCore.availableRolesClaim)
@@ -125,7 +126,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
       TAG: "Stale",
       role: "Admin",
       membership: ["Shopper"]
-    });
+    }, undefined);
     globalThis.expect([
       groupsOf(event),
       claimOf(event, Auth_ActiveRole$ReventlessCore.staleRoleClaim)
@@ -139,7 +140,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
       TAG: "Stale",
       role: "Admin",
       membership: ["Shopper"]
-    });
+    }, undefined);
     globalThis.expect(claimOf(event, Auth_ActiveRole$ReventlessCore.activeRoleClaim)).toEqual(undefined);
   });
   globalThis.test("narrowing carries the caller's IAM roles through untouched", () => {
@@ -153,7 +154,7 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
         "Admin",
         "Shopper"
       ]
-    });
+    }, undefined);
     let details = Stdlib_Option.flatMap(overrideOf(event), c => c.groupOverrideDetails);
     globalThis.expect([
       Stdlib_Option.map(details, d => d.iamRolesToOverride),
@@ -168,11 +169,61 @@ globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond", () => {
       TAG: "Stale",
       role: "Admin",
       membership: ["Shopper"]
-    });
+    }, undefined);
     globalThis.expect(Stdlib_Option.map(Stdlib_Option.flatMap(overrideOf(event), c => c.groupOverrideDetails), d => d.iamRolesToOverride)).toEqual(["arn:aws:iam::1:role/Shopper"]);
   });
 });
 
+globalThis.describe("Auth_ActiveRoleTrigger_Ops.respond with a domain id", () => {
+  globalThis.test("no stored role and a domain id adds the claim and nothing else", () => {
+    let input = eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined);
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(input, "Unchanged", "u_abc");
+    globalThis.expect(claimOf(event, Auth_UserId$ReventlessCore.claim)).toEqual("u_abc");
+    globalThis.expect(groupsOf(event)).toEqual(undefined);
+  });
+  globalThis.test("narrowing and a domain id carry both", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined), {
+      TAG: "Narrow",
+      role: "Shopper",
+      membership: [
+        "Admin",
+        "Shopper"
+      ]
+    }, "u_abc");
+    globalThis.expect(groupsOf(event)).toEqual(["Shopper"]);
+    globalThis.expect([
+      claimOf(event, Auth_ActiveRole$ReventlessCore.activeRoleClaim),
+      claimOf(event, Auth_UserId$ReventlessCore.claim)
+    ]).toEqual([
+      "Shopper",
+      "u_abc"
+    ]);
+  });
+  globalThis.test("no domain id leaves a narrowed token without the claim", () => {
+    let event = Auth_ActiveRoleTrigger_Ops$ReventlessAws.respond(eventFor([
+      "Admin",
+      "Shopper"
+    ], undefined, undefined), {
+      TAG: "Narrow",
+      role: "Shopper",
+      membership: [
+        "Admin",
+        "Shopper"
+      ]
+    }, undefined);
+    globalThis.expect(claimOf(event, Auth_UserId$ReventlessCore.claim)).toEqual(undefined);
+  });
+  globalThis.test("no identity store configured reads as no row", async () => {
+    globalThis.expect(await Auth_ActiveRoleTrigger_Ops$ReventlessAws.userIdFor("u-carol", undefined)).toEqual(undefined);
+  });
+});
+
 let Trigger;
 
 let Contract;

package/tests/Auth_CognitoTest.res

@@ -186,3 +186,65 @@ describe("Auth_Cognito.fromAppSyncIdentity", () => {
     }
   })
 })
+
+// ── The domain id claim ─────────────────────────────────────────────────────
+//
+// Both arms, on both entry points. The second arm is the one that will look
+// redundant to a later reader and is not: every `@owner` field written before
+// the identity store existed holds a `sub`, and it keeps matching only while a
+// token without the claim produces exactly that `sub`.
+
+describe("Auth_Cognito and the domain id claim", () => {
+  let claimName = ReventlessCore.Auth_UserId.claim
+
+  testAsync("authenticate: a token carrying the claim yields it, not the sub", async () => {
+    let token = buildJwt(
+      Dict.fromArray([
+        ("sub", JSON.Encode.string("c3741234-aaaa")),
+        (claimName, JSON.Encode.string("u_0123")),
+      ]),
+    )
+    switch await Auth_Cognito.authenticate(buildContext([("authorization", "Bearer " ++ token)])) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("u_0123")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testAsync("authenticate: a token without the claim yields exactly the sub", async () => {
+    let token = buildJwt(Dict.fromArray([("sub", JSON.Encode.string("c3741234-aaaa"))]))
+    switch await Auth_Cognito.authenticate(buildContext([("authorization", "Bearer " ++ token)])) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("c3741234-aaaa")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("fromAppSyncIdentity: the claim wins over the sub", () => {
+    let id: Auth_Cognito.appSyncIdentity = {
+      sub: "c3741234-aaaa",
+      claims: Dict.fromArray([(claimName, JSON.Encode.string("u_0123"))]),
+    }
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("u_0123")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("fromAppSyncIdentity: no claim is exactly the sub", () => {
+    let id: Auth_Cognito.appSyncIdentity = {sub: "c3741234-aaaa", claims: Dict.make()}
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("c3741234-aaaa")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+
+  testSync("an empty claim is treated as absent", () => {
+    let id: Auth_Cognito.appSyncIdentity = {
+      sub: "c3741234-aaaa",
+      claims: Dict.fromArray([(claimName, JSON.Encode.string(""))]),
+    }
+    switch Auth_Cognito.fromAppSyncIdentity(Some(id)) {
+    | Authenticated(identity) => expect(identity.userId)->toBe("c3741234-aaaa")
+    | _ => JsError.throwWithMessage("expected Authenticated")
+    }
+  })
+})

package/tests/Auth_CognitoTest.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Auth_Cognito$ReventlessAws from "../src/adapter/Auth/Auth_Cognito.res.mjs";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 
 function buildContext(headers) {
   return {
@@ -240,6 +241,103 @@ globalThis.describe("Auth_Cognito.fromAppSyncIdentity", () => {
   });
 });
 
+globalThis.describe("Auth_Cognito and the domain id claim", () => {
+  globalThis.test("authenticate: a token carrying the claim yields it, not the sub", async () => {
+    let token = buildJwt(Object.fromEntries([
+      [
+        "sub",
+        "c3741234-aaaa"
+      ],
+      [
+        Auth_UserId$ReventlessCore.claim,
+        "u_0123"
+      ]
+    ]));
+    let identity = await Auth_Cognito$ReventlessAws.authenticate(buildContext([[
+        "authorization",
+        "Bearer " + token
+      ]]));
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    globalThis.expect(identity._0.userId).toBe("u_0123");
+  });
+  globalThis.test("authenticate: a token without the claim yields exactly the sub", async () => {
+    let token = buildJwt(Object.fromEntries([[
+        "sub",
+        "c3741234-aaaa"
+      ]]));
+    let identity = await Auth_Cognito$ReventlessAws.authenticate(buildContext([[
+        "authorization",
+        "Bearer " + token
+      ]]));
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    globalThis.expect(identity._0.userId).toBe("c3741234-aaaa");
+  });
+  globalThis.test("fromAppSyncIdentity: the claim wins over the sub", () => {
+    let id_sub = "c3741234-aaaa";
+    let id_claims = Object.fromEntries([[
+        Auth_UserId$ReventlessCore.claim,
+        "u_0123"
+      ]]);
+    let id = {
+      sub: id_sub,
+      claims: id_claims
+    };
+    let identity = Auth_Cognito$ReventlessAws.fromAppSyncIdentity(id);
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    globalThis.expect(identity._0.userId).toBe("u_0123");
+  });
+  globalThis.test("fromAppSyncIdentity: no claim is exactly the sub", () => {
+    let id_sub = "c3741234-aaaa";
+    let id_claims = {};
+    let id = {
+      sub: id_sub,
+      claims: id_claims
+    };
+    let identity = Auth_Cognito$ReventlessAws.fromAppSyncIdentity(id);
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    globalThis.expect(identity._0.userId).toBe("c3741234-aaaa");
+  });
+  globalThis.test("an empty claim is treated as absent", () => {
+    let id_sub = "c3741234-aaaa";
+    let id_claims = Object.fromEntries([[
+        Auth_UserId$ReventlessCore.claim,
+        ""
+      ]]);
+    let id = {
+      sub: id_sub,
+      claims: id_claims
+    };
+    let identity = Auth_Cognito$ReventlessAws.fromAppSyncIdentity(id);
+    if (typeof identity !== "object") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    if (identity.TAG !== "Authenticated") {
+      return Stdlib_JsError.throwWithMessage("expected Authenticated");
+    }
+    globalThis.expect(identity._0.userId).toBe("c3741234-aaaa");
+  });
+});
+
 export {
   buildContext,
   b64urlEncode,

package/tests/Auth_IdentityStore_SchemaTest.res

@@ -0,0 +1,35 @@
+open JestGlobals
+
+// The identity store's name and key, shared by the deploy, the trigger and the
+// provisioning scripts. The symptom of any two disagreeing is quiet: the claim
+// is never added, and every new account silently keeps its `sub`.
+
+module Schema = Auth_IdentityStore_Schema
+
+describe("Auth_IdentityStore_Schema", () => {
+  testSync("names the store after the provider whose trigger reads it", () =>
+    expect(Schema.derivedStoreName(~identityProviderId="eu-west-1_CQTwafSeX"))->toBe(
+      "ReventlessIdentityStore-eu-west-1_CQTwafSeX",
+    )
+  )
+
+  testSync("does not collide with the active-role store on the same provider", () =>
+    expect(
+      Schema.derivedStoreName(~identityProviderId="eu-west-1_A") ==
+        Auth_ActiveRoleStore_Schema.derivedStoreName(~identityProviderId="eu-west-1_A"),
+    )->toBe(false)
+  )
+
+  testSync("is keyed on the subject alone", () =>
+    expect(Schema.expectedKeySchema)->toEqual([("id", "HASH")])
+  )
+
+  testSync("adopts a table with the right key and refuses one with another", () => {
+    expect(Schema.keySchemaRefusal(~tableName="t", ~actual=[("id", "HASH")]))->toEqual(None)
+    expect(
+      Schema.keySchemaRefusal(~tableName="t", ~actual=[("id", "HASH"), ("clientId", "RANGE")])
+      ->Option.map(m => m->String.includes("identity store needs [id:HASH]"))
+      ->Option.getOr(false),
+    )->toBe(true)
+  })
+})

package/tests/Auth_IdentityStore_SchemaTest.res.mjs

@@ -0,0 +1,43 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Auth_IdentityStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_IdentityStore_Schema.res.mjs";
+import * as Auth_ActiveRoleStore_Schema$ReventlessAws from "../src/adapter/Auth/Auth_ActiveRoleStore_Schema.res.mjs";
+
+globalThis.describe("Auth_IdentityStore_Schema", () => {
+  globalThis.test("names the store after the provider whose trigger reads it", () => {
+    globalThis.expect(Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_CQTwafSeX")).toBe("ReventlessIdentityStore-eu-west-1_CQTwafSeX");
+  });
+  globalThis.test("does not collide with the active-role store on the same provider", () => {
+    globalThis.expect(Auth_IdentityStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_A") === Auth_ActiveRoleStore_Schema$ReventlessAws.derivedStoreName("eu-west-1_A")).toBe(false);
+  });
+  globalThis.test("is keyed on the subject alone", () => {
+    globalThis.expect(Auth_IdentityStore_Schema$ReventlessAws.expectedKeySchema).toEqual([[
+        "id",
+        "HASH"
+      ]]);
+  });
+  globalThis.test("adopts a table with the right key and refuses one with another", () => {
+    globalThis.expect(Auth_IdentityStore_Schema$ReventlessAws.keySchemaRefusal("t", [[
+        "id",
+        "HASH"
+      ]])).toEqual(undefined);
+    globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.map(Auth_IdentityStore_Schema$ReventlessAws.keySchemaRefusal("t", [
+      [
+        "id",
+        "HASH"
+      ],
+      [
+        "clientId",
+        "RANGE"
+      ]
+    ]), m => m.includes("identity store needs [id:HASH]")), false)).toBe(true);
+  });
+});
+
+let Schema;
+
+export {
+  Schema,
+}
+/*  Not a pure module */