@reventlessdev/reventless-core 3.0.0-alpha.260 → 3.0.0-alpha.262

package/tests/IdentityTest.res

@@ -1,19 +1,27 @@
 open JestGlobals
 
-
 describe("Identity", () => {
   describe("anonymous", () => {
-    testSync("has userId 'anonymous'", () => {
-      expect(Reventless.Identity.anonymous.userId)->toBe("anonymous")
-    })
-
-    testSync("has empty groups", () => {
-      expect(Reventless.Identity.anonymous.groups)->toEqual([])
-    })
-
-    testSync("has InMemory provider", () => {
-      expect(Reventless.Identity.anonymous.provider)->toEqual(Reventless.Identity.InMemory)
-    })
+    testSync(
+      "has userId 'anonymous'",
+      () => {
+        expect(Reventless.Identity.anonymous.userId)->toBe("anonymous")
+      },
+    )
+
+    testSync(
+      "has empty groups",
+      () => {
+        expect(Reventless.Identity.anonymous.groups)->toEqual([])
+      },
+    )
+
+    testSync(
+      "has InMemory provider",
+      () => {
+        expect(Reventless.Identity.anonymous.provider)->toEqual(Reventless.Identity.InMemory)
+      },
+    )
   })
 
   describe("hasGroup", () => {
@@ -24,13 +32,19 @@ describe("Identity", () => {
       provider: Cognito,
     }
 
-    testSync("returns true when group is present", () => {
-      expect(Reventless.Identity.hasGroup(identity, "admin"))->toBe(true)
-    })
-
-    testSync("returns false when group is absent", () => {
-      expect(Reventless.Identity.hasGroup(identity, "viewers"))->toBe(false)
-    })
+    testSync(
+      "returns true when group is present",
+      () => {
+        expect(Reventless.Identity.hasGroup(identity, "admin"))->toBe(true)
+      },
+    )
+
+    testSync(
+      "returns false when group is absent",
+      () => {
+        expect(Reventless.Identity.hasGroup(identity, "viewers"))->toBe(false)
+      },
+    )
   })
 
   describe("getClaim", () => {
@@ -42,113 +56,152 @@ describe("Identity", () => {
       provider: InMemory,
     }
 
-    testSync("returns Some for existing claim", () => {
-      expect(Reventless.Identity.getClaim(identity, "tenant"))->toEqual(Some("acme"))
-    })
-
-    testSync("returns None for missing claim", () => {
-      expect(Reventless.Identity.getClaim(identity, "missing"))->toEqual(None)
-    })
-
-    testSync("returns None when claims are absent", () => {
-      let noClaims: Reventless.Identity.t = {
-        userId: "user-2",
-        username: "bob",
-        groups: [],
-        provider: InMemory,
-      }
-      expect(Reventless.Identity.getClaim(noClaims, "tenant"))->toEqual(None)
-    })
+    testSync(
+      "returns Some for existing claim",
+      () => {
+        expect(Reventless.Identity.getClaim(identity, "tenant"))->toEqual(Some("acme"))
+      },
+    )
+
+    testSync(
+      "returns None for missing claim",
+      () => {
+        expect(Reventless.Identity.getClaim(identity, "missing"))->toEqual(None)
+      },
+    )
+
+    testSync(
+      "returns None when claims are absent",
+      () => {
+        let noClaims: Reventless.Identity.t = {
+          userId: "user-2",
+          username: "bob",
+          groups: [],
+          provider: InMemory,
+        }
+        expect(Reventless.Identity.getClaim(noClaims, "tenant"))->toEqual(None)
+      },
+    )
   })
 
   describe("schema roundtrip", () => {
-    testSync("encode then decode preserves identity", () => {
-      let identity: Reventless.Identity.t = {
-        userId: "user-1",
-        username: "alice",
-        groups: ["admin"],
-        claims: Dict.fromArray([("tenant", "acme")]),
-        provider: Cognito,
-      }
-      let json = identity->Reventless.Util_Sury.toJson(Reventless.Identity.schema)
-      let decoded = json->Reventless.Util_Sury.fromJson(Reventless.Identity.schema)
-      expect(decoded)->toEqual(identity)
-    })
-
-    testSync("roundtrip with Custom provider", () => {
-      let identity: Reventless.Identity.t = {
-        userId: "ext-1",
-        username: "external",
-        groups: [],
-        provider: Custom("oauth2"),
-      }
-      let json = identity->Reventless.Util_Sury.toJson(Reventless.Identity.schema)
-      let decoded = json->Reventless.Util_Sury.fromJson(Reventless.Identity.schema)
-      expect(decoded)->toEqual(identity)
-    })
-
-    testSync("roundtrip without optional claims", () => {
-      let identity: Reventless.Identity.t = {
-        userId: "user-3",
-        username: "charlie",
-        groups: [],
-        provider: InMemory,
-      }
-      let json = identity->Reventless.Util_Sury.toJson(Reventless.Identity.schema)
-      let decoded = json->Reventless.Util_Sury.fromJson(Reventless.Identity.schema)
-      expect(decoded.userId)->toBe("user-3")->ignore
-      expect(decoded.provider)->toEqual(Reventless.Identity.InMemory)
-    })
+    testSync(
+      "encode then decode preserves identity",
+      () => {
+        let identity: Reventless.Identity.t = {
+          userId: "user-1",
+          username: "alice",
+          groups: ["admin"],
+          claims: Dict.fromArray([("tenant", "acme")]),
+          provider: Cognito,
+        }
+        let json = identity->Reventless.Util_Sury.toJson(Reventless.Identity.schema)
+        let decoded = json->Reventless.Util_Sury.fromJson(Reventless.Identity.schema)
+        expect(decoded)->toEqual(identity)
+      },
+    )
+
+    testSync(
+      "roundtrip with Custom provider",
+      () => {
+        let identity: Reventless.Identity.t = {
+          userId: "ext-1",
+          username: "external",
+          groups: [],
+          provider: Custom("oauth2"),
+        }
+        let json = identity->Reventless.Util_Sury.toJson(Reventless.Identity.schema)
+        let decoded = json->Reventless.Util_Sury.fromJson(Reventless.Identity.schema)
+        expect(decoded)->toEqual(identity)
+      },
+    )
+
+    testSync(
+      "roundtrip without optional claims",
+      () => {
+        let identity: Reventless.Identity.t = {
+          userId: "user-3",
+          username: "charlie",
+          groups: [],
+          provider: InMemory,
+        }
+        let json = identity->Reventless.Util_Sury.toJson(Reventless.Identity.schema)
+        let decoded = json->Reventless.Util_Sury.fromJson(Reventless.Identity.schema)
+        expect(decoded.userId)->toBe("user-3")->ignore
+        expect(decoded.provider)->toEqual(Reventless.Identity.InMemory)
+      },
+    )
   })
 })
 
 describe("RequestContext", () => {
   describe("test() constructor", () => {
-    testSync("defaults to anonymous identity", () => {
-      let ctx = RequestContext.test()
-      expect(ctx.identity.userId)->toBe("anonymous")
-    })
-
-    testSync("accepts custom identity", () => {
-      let identity: Reventless.Identity.t = {
-        userId: "user-1",
-        username: "alice",
-        groups: ["admin"],
-        provider: Cognito,
-      }
-      let ctx = RequestContext.test(~identity)
-      expect(ctx.identity.userId)->toBe("user-1")
-    })
-
-    testSync("defaults to empty claims", () => {
-      let ctx = RequestContext.test()
-      expect(ctx.claims->Dict.keysToArray)->toEqual([])
-    })
+    testSync(
+      "defaults to anonymous identity",
+      () => {
+        let ctx = RequestContext.test()
+        expect(ctx.identity.userId)->toBe("anonymous")
+      },
+    )
+
+    testSync(
+      "accepts custom identity",
+      () => {
+        let identity: Reventless.Identity.t = {
+          userId: "user-1",
+          username: "alice",
+          groups: ["admin"],
+          provider: Cognito,
+        }
+        let ctx = RequestContext.test(~identity)
+        expect(ctx.identity.userId)->toBe("user-1")
+      },
+    )
+
+    testSync(
+      "defaults to empty claims",
+      () => {
+        let ctx = RequestContext.test()
+        expect(ctx.claims->Dict.keysToArray)->toEqual([])
+      },
+    )
   })
 
   describe("getClaim", () => {
-    testSync("returns claim value when present", () => {
-      let ctx = RequestContext.test(~claims=Dict.fromArray([("tenant", "acme")]))
-      expect(RequestContext.getClaim(ctx, "tenant"))->toEqual(Some("acme"))
-    })
-
-    testSync("returns None when absent", () => {
-      let ctx = RequestContext.test()
-      expect(RequestContext.getClaim(ctx, "missing"))->toEqual(None)
-    })
+    testSync(
+      "returns claim value when present",
+      () => {
+        let ctx = RequestContext.test(~claims=Dict.fromArray([("tenant", "acme")]))
+        expect(RequestContext.getClaim(ctx, "tenant"))->toEqual(Some("acme"))
+      },
+    )
+
+    testSync(
+      "returns None when absent",
+      () => {
+        let ctx = RequestContext.test()
+        expect(RequestContext.getClaim(ctx, "missing"))->toEqual(None)
+      },
+    )
   })
 
   describe("withClaim", () => {
-    testSync("adds a claim to the context", () => {
-      let ctx = RequestContext.test()
-      let updated = RequestContext.withClaim(ctx, "tenant", "acme")
-      expect(RequestContext.getClaim(updated, "tenant"))->toEqual(Some("acme"))
-    })
-
-    testSync("does not mutate the original context", () => {
-      let ctx = RequestContext.test()
-      let _updated = RequestContext.withClaim(ctx, "tenant", "acme")
-      expect(RequestContext.getClaim(ctx, "tenant"))->toEqual(None)
-    })
+    testSync(
+      "adds a claim to the context",
+      () => {
+        let ctx = RequestContext.test()
+        let updated = RequestContext.withClaim(ctx, "tenant", "acme")
+        expect(RequestContext.getClaim(updated, "tenant"))->toEqual(Some("acme"))
+      },
+    )
+
+    testSync(
+      "does not mutate the original context",
+      () => {
+        let ctx = RequestContext.test()
+        let _updated = RequestContext.withClaim(ctx, "tenant", "acme")
+        expect(RequestContext.getClaim(ctx, "tenant"))->toEqual(None)
+      },
+    )
   })
 })

package/tests/ResourceAttributionTest.res

@@ -104,15 +104,15 @@ describe("ResourceAttribution — carrying the context into deferred work", () =
   testSync("two plugins deferred from one apply are each attributed to themselves", () => {
     let outer = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
     let catalogSaw = ref(None)
-    let catalogFinish = Attribution.deferred(() =>
-      catalogSaw := Attribution.current.contents.plugin
+    let catalogFinish = Attribution.deferred(
+      () => catalogSaw := Attribution.current.contents.plugin,
     )
     Attribution.restore(outer)
 
     let previous = Attribution.enter(~platform="online-shop", ~plugin="Ordering")
     let orderingSaw = ref(None)
-    let orderingFinish = Attribution.deferred(() =>
-      orderingSaw := Attribution.current.contents.plugin
+    let orderingFinish = Attribution.deferred(
+      () => orderingSaw := Attribution.current.contents.plugin,
     )
     Attribution.restore(previous)
 
@@ -126,8 +126,8 @@ describe("ResourceAttribution — carrying the context into deferred work", () =
 
   testSync("a throwing callback still puts the context back", () => {
     let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
-    let finish: unit => unit = Attribution.deferred(() =>
-      JsError.throwWithMessage("finish blew up")
+    let finish: unit => unit = Attribution.deferred(
+      () => JsError.throwWithMessage("finish blew up"),
     )
     Attribution.restore(previous)
 
@@ -164,22 +164,25 @@ describe("ResourceAttribution — carrying the context into deferred work", () =
 // exercises the production choke point: a task side-effect handler registered
 // during construct, then run the way `finishTasks` runs it — from an apply,
 // with nothing attributed.
-describe("Builder_Helpers.registerTaskSideEffectHandler — attribution survives the deferral", () => {
-  testSync("the registered finish sees the plugin that registered it", () => {
-    let before = Builder_Helpers.taskSideEffectFinishFns->Array.length
-    let observed = ref(None)
-
-    let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
-    Builder_Helpers.registerTaskSideEffectHandler(
-      ~gate=Pulumi.Output.make(),
-      ~finish=() => observed := Attribution.current.contents.plugin,
-    )
-    Attribution.restore(previous)
-
-    switch Builder_Helpers.taskSideEffectFinishFns->Array.get(before) {
-    | Some(finish) => finish()
-    | None => JsError.throwWithMessage("handler was not registered")
-    }
-    expect(observed.contents)->toEqual(Some("Catalog"))
-  })
-})
+describe(
+  "Builder_Helpers.registerTaskSideEffectHandler — attribution survives the deferral",
+  () => {
+    testSync("the registered finish sees the plugin that registered it", () => {
+      let before = Builder_Helpers.taskSideEffectFinishFns->Array.length
+      let observed = ref(None)
+
+      let previous = Attribution.enter(~platform="online-shop", ~plugin="Catalog")
+      Builder_Helpers.registerTaskSideEffectHandler(
+        ~gate=Pulumi.Output.make(),
+        ~finish=() => observed := Attribution.current.contents.plugin,
+      )
+      Attribution.restore(previous)
+
+      switch Builder_Helpers.taskSideEffectFinishFns->Array.get(before) {
+      | Some(finish) => finish()
+      | None => JsError.throwWithMessage("handler was not registered")
+      }
+      expect(observed.contents)->toEqual(Some("Catalog"))
+    })
+  },
+)

package/tests/Secrets_Node_BackendTest.res

@@ -0,0 +1,141 @@
+open JestGlobals
+
+// The secret source. What matters here is not that it produces characters, but
+// that it produces them uniformly — a token drawn from a skewed distribution is
+// guessable in a way that no other test would notice.
+
+module Secrets = Reventless.Secrets
+module Backend = Secrets_Node_Backend
+
+let token = (~length, ~alphabet) =>
+  Backend.provider.randomToken(~length, ~alphabet)->Result.getOr("")
+
+describe("randomToken", () => {
+  testSync("draws the requested length", () =>
+    expect(
+      [1, 6, 32, 64]->Array.map(length => token(~length, ~alphabet=Digits)->String.length),
+    )->toEqual([1, 6, 32, 64])
+  )
+
+  testSync("draws only from the alphabet it was given", () => {
+    let allowed = Secrets.characters(UrlSafe)
+    expect(
+      token(~length=512, ~alphabet=UrlSafe)
+      ->String.split("")
+      ->Array.every(c => allowed->String.includes(c)),
+    )->toBe(true)
+  })
+
+  testSync("digits are digits", () =>
+    expect(
+      token(~length=512, ~alphabet=Digits)
+      ->String.split("")
+      ->Array.every(c => "0123456789"->String.includes(c)),
+    )->toBe(true)
+  )
+
+  // Not proof of randomness — it is proof the source is not a constant, which is
+  // the failure a fixed or broken binding would produce.
+  testSync("two draws differ", () =>
+    expect(token(~length=32, ~alphabet=UrlSafe) == token(~length=32, ~alphabet=UrlSafe))->toBe(
+      false,
+    )
+  )
+
+  // A zero-length token would compare equal to nothing and settle every
+  // challenge presented against it, so it is refused rather than clamped.
+  testSync("a non-positive length is refused, not clamped", () =>
+    expect(
+      [0, -1]->Array.map(
+        length => Backend.provider.randomToken(~length, ~alphabet=Digits)->Result.isError,
+      ),
+    )->toEqual([true, true])
+  )
+})
+
+// 🚨 Checked over every byte value rather than by sampling the output, and the
+// first attempt here got that wrong. `byte % 10` skews the low six digits by
+// about four percent each — roughly 0.609 of draws landing in the low half
+// against 0.600 for a fair source. At any sample size a test can afford that
+// gap is a couple of standard errors, so a sampled assertion either flakes or,
+// as the first version did, passes happily with the defence deleted.
+describe("accepts — the rejection rule", () => {
+  let rejected = size =>
+    Array.fromInitializer(~length=256, i => i)->Array.filter(byte => !Backend.accepts(~byte, ~size))
+
+  testSync("rejects exactly the bytes that would skew a 10-character alphabet", () =>
+    expect(rejected(10))->toEqual([250, 251, 252, 253, 254, 255])
+  )
+
+  // 64 divides 256 exactly, so nothing needs discarding and a url-safe token
+  // costs no extra draws.
+  testSync("rejects nothing when the alphabet divides evenly", () =>
+    expect(rejected(64))->toEqual([])
+  )
+
+  // What survives always folds onto a whole number of cycles, which is the
+  // property that makes every character equally likely.
+  testSync("what it accepts is a whole multiple of the alphabet", () =>
+    expect(
+      [2, 3, 7, 10, 16, 26, 62, 64]->Array.map(
+        size => mod(256 - rejected(size)->Array.length, size),
+      ),
+    )->toEqual([0, 0, 0, 0, 0, 0, 0, 0])
+  )
+
+  testSync("never discards more than one cycle's worth", () =>
+    expect([3, 7, 10, 26, 62]->Array.map(size => rejected(size)->Array.length < size))->toEqual([
+      true,
+      true,
+      true,
+      true,
+      true,
+    ])
+  )
+})
+
+describe("hash", () => {
+  testSync("is deterministic, which is what lets a proof be compared", () =>
+    expect(Backend.provider.hash("a-secret") == Backend.provider.hash("a-secret"))->toBe(true)
+  )
+
+  testSync("separates different inputs", () =>
+    expect(Backend.provider.hash("a-secret") == Backend.provider.hash("a-secret "))->toBe(false)
+  )
+
+  // One-way: the digest must not carry the secret it was made from.
+  testSync("does not contain its input", () =>
+    expect(
+      Backend.provider.hash("a-secret")
+      ->Result.getOr("")
+      ->String.includes("a-secret"),
+    )->toBe(false)
+  )
+})
+
+describe("Capabilities.none.secrets", () => {
+  // Refusing rather than degrading: there is no weaker token that would be safe
+  // to hand back, so an unwired platform must fail rather than produce one.
+  testSync("refuses both operations", () =>
+    expect((
+      Reventless.Capabilities.none.secrets.randomToken(
+        ~length=32,
+        ~alphabet=UrlSafe,
+      )->Result.isError,
+      Reventless.Capabilities.none.secrets.hash("x")->Result.isError,
+    ))->toEqual((true, true))
+  )
+})
+
+describe("Secrets.fixed", () => {
+  // What a consumer's suite uses to know the secret before presenting it.
+  let provider = Secrets.fixed(~token="known", ~hash=input => `hashed:${input}`)
+
+  testSync("hands back the token it was built with", () =>
+    expect(provider.randomToken(~length=32, ~alphabet=UrlSafe))->toEqual(Ok("known"))
+  )
+
+  testSync("hashes through the function it was given", () =>
+    expect(provider.hash("known"))->toEqual(Ok("hashed:known"))
+  )
+})