@reventlessdev/reventless-seed 1.0.0-alpha.19 → 1.0.0-alpha.20

package/lib/ocaml/Seed_Client.res

@@ -52,6 +52,87 @@ let endpoint = (t: t): string => t.config.endpoint
     token is a valid bearer for `endpoint`. */
 let useToken = (t: t, token: string): unit => t.token = Some(token)
 
+// ── What the bearer actually grants ─────────────────────────────────────────
+//
+// An account's listed groups are not necessarily the ones its token carries:
+// both platforms narrow a token to the single role the caller last chose to act
+// as. So a seed can log in as an account that looks eligible and be refused, and
+// the account list cannot explain it — only the token can.
+
+/** Claim names a narrowed token carries. These mirror the cross-provider
+    contract in `ReventlessCore.Auth_ActiveRole`; spelled out rather than
+    imported because this harness deliberately depends on no framework package. */
+let activeRoleClaim = "activeRole"
+let availableRolesClaim = "availableRoles"
+
+/** Group claim per provider, tried in order. */
+let groupClaimNames = ["cognito:groups", "groups"]
+
+let decodeSegment = (segment: string): option<dict<JSON.t>> =>
+  try {
+    segment
+    ->NodeBuffer.fromStringBase64Url
+    ->NodeBuffer.toStringUtf8
+    ->JSON.parseOrThrow
+    ->JSON.Decode.object
+  } catch {
+  | _ => None
+  }
+
+/** The bearer's payload, from whichever segment carries it — a Cognito JWT puts
+    it second and a local dev token first, so trying each in turn saves this from
+    having to know which platform signed the token. A segment that is not a JSON
+    object (a signature) simply does not decode. */
+let claims = (t: t): option<dict<JSON.t>> =>
+  t.token->Option.flatMap(token =>
+    token
+    ->String.split(".")
+    ->Array.reduce(None, (found, segment) =>
+      switch found {
+      | Some(_) => found
+      | None => decodeSegment(segment)
+      }
+    )
+  )
+
+// Arrays on the group claim, comma-joined on `availableRoles`.
+let asStrings = (value: JSON.t): option<array<string>> =>
+  switch value {
+  | Array(entries) => Some(entries->Array.filterMap(JSON.Decode.string))
+  | String(joined) =>
+    Some(joined->String.split(",")->Array.map(String.trim)->Array.filter(s => s != ""))
+  | _ => None
+  }
+
+let claimStrings = (t: t, name: string): option<array<string>> =>
+  t->claims->Option.flatMap(c => c->Dict.get(name))->Option.flatMap(asStrings)
+
+/** The groups the bearer actually presents — what every enforcement point reads.
+    `None` when the token is opaque to us, which is not an error: it just means
+    this cannot add anything. */
+let effectiveGroups = (t: t): option<array<string>> =>
+  groupClaimNames->Array.reduce(None, (found, name) =>
+    switch found {
+    | Some(_) => found
+    | None => t->claimStrings(name)
+    }
+  )
+
+/** One line naming the identity the bearer carries, and — when it was narrowed —
+    the membership it was narrowed from. The second half is the point: without it
+    a refusal looks like a misconfigured grant rather than a role switch. */
+let identitySummary = (t: t): option<string> =>
+  t
+  ->effectiveGroups
+  ->Option.map(groups => {
+    let held = groups->Array.length == 0 ? "no groups" : groups->Array.join(", ")
+    switch t->claimStrings(availableRolesClaim) {
+    | Some(available) if available->Array.length > 0 =>
+      `${held} — narrowed to this role from ${available->Array.join(", ")}`
+    | _ => held
+    }
+  })
+
 // ── JSON helpers ────────────────────────────────────────────────────────────
 
 let field = (json: JSON.t, key: string): option<JSON.t> =>
@@ -138,6 +219,21 @@ let isTransient = (errors: JSON.t): bool =>
     )
   }
 
+/** An authorization refusal, in either platform's vocabulary — AppSync answers
+    `errorType: "Unauthorized"`, the local server carries it in the message. */
+let isDenied = (errors: JSON.t): bool =>
+  switch errors->JSON.Decode.array {
+  | None => false
+  | Some(entries) =>
+    entries->Array.some(e =>
+      switch (e->nodeString("errorType"), e->nodeString("message")) {
+      | (Some(errorType), _) if errorType->String.includes("Unauthorized") => true
+      | (_, Some(message)) => message->String.includes("Not Authorized")
+      | _ => false
+      }
+    )
+  }
+
 let attempts = 4
 
 /**
@@ -180,8 +276,19 @@ let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
         await attempt(n + 1)
       } else {
         let tried = n > 1 ? `\n  gave up after ${n->Int.toString} attempts` : ""
+        // A refusal is the one failure the response cannot explain on its own:
+        // it names the field, never the caller. The account list can't either —
+        // it holds membership, and a narrowed token carries less.
+        let identity = switch isDenied(errors) ? t->identitySummary : None {
+        | Some(summary) => `\n  identity: ${summary}`
+        | None => ""
+        }
         throw(
-          Failed(`${label} failed\n  query: ${query}\n  response: ${JSON.stringify(errors)}${tried}`),
+          Failed(
+            `${label} failed\n  query: ${query}\n  response: ${JSON.stringify(
+                errors,
+              )}${identity}${tried}`,
+          ),
         )
       }
     | None => json->field("data")->Option.getOr(JSON.Encode.null)

package/lib/ocaml/Seed_ClientTest.res

@@ -57,3 +57,101 @@ describe("Seed_Client.isTransient:", () => {
     expect(Seed_Client.isTransient(JSON.Encode.null))->toBe(false)
   })
 })
+
+// An account's listed groups are not what authorizes it — the token's are. Both
+// platforms narrow a token to the single role the caller last chose, so a seed
+// can log in as an account the user list shows as `[Admin, Shopper]` and present
+// a token carrying `Shopper` alone. The refusal that follows names the field and
+// not the caller, and the account list cannot explain it either. These pin the
+// reading-back that turns that into a sentence.
+
+let b64url = payload =>
+  payload
+  ->NodeBuffer.fromStringUtf8
+  ->NodeBuffer.toStringBase64Url
+
+let jwt = claims =>
+  `header.${b64url(JSON.stringify(JSON.Encode.object(Dict.fromArray(claims))))}.signature`
+
+let localToken = claims =>
+  `${b64url(JSON.stringify(JSON.Encode.object(Dict.fromArray(claims))))}.signature`
+
+let strings = values => JSON.Encode.array(values->Array.map(JSON.Encode.string))
+
+let clientWith = token => {
+  let c = Seed_Client.make(~config={endpoint: "http://example.invalid/graphql"})
+  c->Seed_Client.useToken(token)
+  c
+}
+
+describe("Seed_Client.effectiveGroups:", () => {
+  // A Cognito id token carries its payload in the second segment, a local dev
+  // token in the first. Neither platform should have to announce which it is.
+  testSync("reads the payload wherever the provider put it", () => {
+    expect(
+      clientWith(jwt([("cognito:groups", strings(["Admin", "Shopper"]))]))->Seed_Client.effectiveGroups,
+    )->toEqual(Some(["Admin", "Shopper"]))
+    expect(
+      clientWith(localToken([("groups", strings(["Merchandiser"]))]))->Seed_Client.effectiveGroups,
+    )->toEqual(Some(["Merchandiser"]))
+  })
+
+  // An opaque bearer is not an error — it just means this can add nothing, and
+  // the failure reports what it always did.
+  testSync("says nothing about a token it cannot read", () => {
+    expect(clientWith("not-a-token")->Seed_Client.effectiveGroups)->toEqual(None)
+    expect(
+      Seed_Client.make(~config={endpoint: "http://example.invalid/graphql"})
+      ->Seed_Client.effectiveGroups,
+    )->toEqual(None)
+  })
+})
+
+describe("Seed_Client.identitySummary:", () => {
+  // The case that cost the debugging: eligible in the user list, refused by the
+  // token. Naming what it was narrowed FROM is what points at the role switch.
+  testSync("names the membership a narrowed token gave up", () =>
+    expect(
+      clientWith(
+        jwt([
+          ("cognito:groups", strings(["Shopper"])),
+          ("availableRoles", JSON.Encode.string("Admin,Shopper")),
+        ]),
+      )->Seed_Client.identitySummary,
+    )->toEqual(Some("Shopper — narrowed to this role from Admin, Shopper"))
+  )
+
+  // An ordinary login is not narrowed and has nothing to explain.
+  testSync("stays quiet about an unnarrowed token", () =>
+    expect(
+      clientWith(jwt([("cognito:groups", strings(["Admin", "Shopper"]))]))
+      ->Seed_Client.identitySummary,
+    )->toEqual(Some("Admin, Shopper"))
+  )
+
+  // A token granting nothing reads as a sentence rather than an empty string.
+  testSync("says so when the token carries no groups at all", () =>
+    expect(
+      clientWith(jwt([("cognito:groups", strings([]))]))->Seed_Client.identitySummary,
+    )->toEqual(Some("no groups"))
+  )
+})
+
+describe("Seed_Client.isDenied:", () => {
+  // AppSync types it; the local server carries it in the message.
+  testSync("recognises a refusal in either platform's vocabulary", () => {
+    expect(Seed_Client.isDenied(errors([errorOfType("Unauthorized")])))->toBe(true)
+    expect(
+      Seed_Client.isDenied(
+        errors([Dict.fromArray([("message", JSON.Encode.string("Not Authorized to access X"))])]),
+      ),
+    )->toBe(true)
+  })
+
+  // Attaching an identity to an unrelated failure would point the reader at the
+  // wrong thing.
+  testSync("leaves every other failure alone", () => {
+    expect(Seed_Client.isDenied(errors([errorOfType("ValidationException")])))->toBe(false)
+    expect(Seed_Client.isDenied(errors([])))->toBe(false)
+  })
+})

package/lib/ocaml/Seed_Connect.res

@@ -38,6 +38,13 @@ let make = async (
   let token = await login(~username, ~password)
   let client = Seed_Client.make(~config={endpoint: endpoint})
   client->Seed_Client.useToken(token)
+  // What the bearer grants, which is not always what the account list showed: a
+  // token narrowed to one role presents that role alone. Said at login so the
+  // run starts from the identity it will actually be refused or served under.
+  switch Seed_Client.identitySummary(client) {
+  | Some(summary) => Console.log(`Acting as: ${summary}`)
+  | None => ()
+  }
   {client, uploadsSkipped, label}
 }
 

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@reventlessdev/reventless-seed",
-  "version": "1.0.0-alpha.19",
+  "version": "1.0.0-alpha.20",
   "description": "Reusable harness for seeding a Reventless platform through its public GraphQL command API",
   "license": "Apache-2.0",
   "dependencies": {
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.9"
+    "@reventlessdev/rescript-node": "2.0.0-alpha.10"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Seed_Client.res

@@ -52,6 +52,87 @@ let endpoint = (t: t): string => t.config.endpoint
     token is a valid bearer for `endpoint`. */
 let useToken = (t: t, token: string): unit => t.token = Some(token)
 
+// ── What the bearer actually grants ─────────────────────────────────────────
+//
+// An account's listed groups are not necessarily the ones its token carries:
+// both platforms narrow a token to the single role the caller last chose to act
+// as. So a seed can log in as an account that looks eligible and be refused, and
+// the account list cannot explain it — only the token can.
+
+/** Claim names a narrowed token carries. These mirror the cross-provider
+    contract in `ReventlessCore.Auth_ActiveRole`; spelled out rather than
+    imported because this harness deliberately depends on no framework package. */
+let activeRoleClaim = "activeRole"
+let availableRolesClaim = "availableRoles"
+
+/** Group claim per provider, tried in order. */
+let groupClaimNames = ["cognito:groups", "groups"]
+
+let decodeSegment = (segment: string): option<dict<JSON.t>> =>
+  try {
+    segment
+    ->NodeBuffer.fromStringBase64Url
+    ->NodeBuffer.toStringUtf8
+    ->JSON.parseOrThrow
+    ->JSON.Decode.object
+  } catch {
+  | _ => None
+  }
+
+/** The bearer's payload, from whichever segment carries it — a Cognito JWT puts
+    it second and a local dev token first, so trying each in turn saves this from
+    having to know which platform signed the token. A segment that is not a JSON
+    object (a signature) simply does not decode. */
+let claims = (t: t): option<dict<JSON.t>> =>
+  t.token->Option.flatMap(token =>
+    token
+    ->String.split(".")
+    ->Array.reduce(None, (found, segment) =>
+      switch found {
+      | Some(_) => found
+      | None => decodeSegment(segment)
+      }
+    )
+  )
+
+// Arrays on the group claim, comma-joined on `availableRoles`.
+let asStrings = (value: JSON.t): option<array<string>> =>
+  switch value {
+  | Array(entries) => Some(entries->Array.filterMap(JSON.Decode.string))
+  | String(joined) =>
+    Some(joined->String.split(",")->Array.map(String.trim)->Array.filter(s => s != ""))
+  | _ => None
+  }
+
+let claimStrings = (t: t, name: string): option<array<string>> =>
+  t->claims->Option.flatMap(c => c->Dict.get(name))->Option.flatMap(asStrings)
+
+/** The groups the bearer actually presents — what every enforcement point reads.
+    `None` when the token is opaque to us, which is not an error: it just means
+    this cannot add anything. */
+let effectiveGroups = (t: t): option<array<string>> =>
+  groupClaimNames->Array.reduce(None, (found, name) =>
+    switch found {
+    | Some(_) => found
+    | None => t->claimStrings(name)
+    }
+  )
+
+/** One line naming the identity the bearer carries, and — when it was narrowed —
+    the membership it was narrowed from. The second half is the point: without it
+    a refusal looks like a misconfigured grant rather than a role switch. */
+let identitySummary = (t: t): option<string> =>
+  t
+  ->effectiveGroups
+  ->Option.map(groups => {
+    let held = groups->Array.length == 0 ? "no groups" : groups->Array.join(", ")
+    switch t->claimStrings(availableRolesClaim) {
+    | Some(available) if available->Array.length > 0 =>
+      `${held} — narrowed to this role from ${available->Array.join(", ")}`
+    | _ => held
+    }
+  })
+
 // ── JSON helpers ────────────────────────────────────────────────────────────
 
 let field = (json: JSON.t, key: string): option<JSON.t> =>
@@ -138,6 +219,21 @@ let isTransient = (errors: JSON.t): bool =>
     )
   }
 
+/** An authorization refusal, in either platform's vocabulary — AppSync answers
+    `errorType: "Unauthorized"`, the local server carries it in the message. */
+let isDenied = (errors: JSON.t): bool =>
+  switch errors->JSON.Decode.array {
+  | None => false
+  | Some(entries) =>
+    entries->Array.some(e =>
+      switch (e->nodeString("errorType"), e->nodeString("message")) {
+      | (Some(errorType), _) if errorType->String.includes("Unauthorized") => true
+      | (_, Some(message)) => message->String.includes("Not Authorized")
+      | _ => false
+      }
+    )
+  }
+
 let attempts = 4
 
 /**
@@ -180,8 +276,19 @@ let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
         await attempt(n + 1)
       } else {
         let tried = n > 1 ? `\n  gave up after ${n->Int.toString} attempts` : ""
+        // A refusal is the one failure the response cannot explain on its own:
+        // it names the field, never the caller. The account list can't either —
+        // it holds membership, and a narrowed token carries less.
+        let identity = switch isDenied(errors) ? t->identitySummary : None {
+        | Some(summary) => `\n  identity: ${summary}`
+        | None => ""
+        }
         throw(
-          Failed(`${label} failed\n  query: ${query}\n  response: ${JSON.stringify(errors)}${tried}`),
+          Failed(
+            `${label} failed\n  query: ${query}\n  response: ${JSON.stringify(
+                errors,
+              )}${identity}${tried}`,
+          ),
         )
       }
     | None => json->field("data")->Option.getOr(JSON.Encode.null)

package/src/Seed_Client.res.mjs

@@ -30,6 +30,69 @@ function useToken(t, token) {
   t.token = token;
 }
 
+let availableRolesClaim = "availableRoles";
+
+let groupClaimNames = [
+  "cognito:groups",
+  "groups"
+];
+
+function decodeSegment(segment) {
+  try {
+    return Stdlib_JSON.Decode.object(JSON.parse(Buffer.from(segment, "base64url").toString("utf8")));
+  } catch (exn) {
+    return;
+  }
+}
+
+function claims(t) {
+  return Stdlib_Option.flatMap(t.token, token => Stdlib_Array.reduce(token.split("."), undefined, (found, segment) => {
+    if (found !== undefined) {
+      return found;
+    } else {
+      return decodeSegment(segment);
+    }
+  }));
+}
+
+function asStrings(value) {
+  if (Array.isArray(value)) {
+    return Stdlib_Array.filterMap(value, Stdlib_JSON.Decode.string);
+  }
+  switch (typeof value) {
+    case "string" :
+      return value.split(",").map(prim => prim.trim()).filter(s => s !== "");
+    default:
+      return;
+  }
+}
+
+function claimStrings(t, name) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(claims(t), c => c[name]), asStrings);
+}
+
+function effectiveGroups(t) {
+  return Stdlib_Array.reduce(groupClaimNames, undefined, (found, name) => {
+    if (found !== undefined) {
+      return found;
+    } else {
+      return claimStrings(t, name);
+    }
+  });
+}
+
+function identitySummary(t) {
+  return Stdlib_Option.map(effectiveGroups(t), groups => {
+    let held = groups.length === 0 ? "no groups" : groups.join(", ");
+    let available = claimStrings(t, availableRolesClaim);
+    if (available !== undefined && available.length !== 0) {
+      return held + ` — narrowed to this role from ` + available.join(", ");
+    } else {
+      return held;
+    }
+  });
+}
+
 function field(json, key) {
   if (typeof json === "object" && json !== null && !Array.isArray(json)) {
     return json[key];
@@ -125,6 +188,31 @@ function isTransient(errors) {
   }
 }
 
+function isDenied(errors) {
+  let entries = Stdlib_JSON.Decode.array(errors);
+  if (entries !== undefined) {
+    return entries.some(e => {
+      let match = nodeString(e, "errorType");
+      let match$1 = nodeString(e, "message");
+      if (match !== undefined) {
+        if (match.includes("Unauthorized")) {
+          return true;
+        } else if (match$1 !== undefined) {
+          return match$1.includes("Not Authorized");
+        } else {
+          return false;
+        }
+      } else if (match$1 !== undefined) {
+        return match$1.includes("Not Authorized");
+      } else {
+        return false;
+      }
+    });
+  } else {
+    return false;
+  }
+}
+
 async function gql(t, query, label) {
   let headers = Object.fromEntries([[
       "content-type",
@@ -163,9 +251,11 @@ async function gql(t, query, label) {
       return await attempt(n + 1 | 0);
     }
     let tried = n > 1 ? `\n  gave up after ` + n.toString() + ` attempts` : "";
+    let summary = isDenied(errors) ? identitySummary(t) : undefined;
+    let identity = summary !== undefined ? `\n  identity: ` + summary : "";
     throw {
       RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
-      _1: label + ` failed\n  query: ` + query + `\n  response: ` + JSON.stringify(errors) + tried,
+      _1: label + ` failed\n  query: ` + query + `\n  response: ` + JSON.stringify(errors) + identity + tried,
       Error: new Error()
     };
   };
@@ -304,6 +394,8 @@ async function waitForIds(t, fieldName, ids, timeoutMsOpt) {
   return Stdlib_Option.getOr(result, 0);
 }
 
+let activeRoleClaim = "activeRole";
+
 let attempts = 4;
 
 export {
@@ -312,12 +404,22 @@ export {
   currentToken,
   endpoint,
   useToken,
+  activeRoleClaim,
+  availableRolesClaim,
+  groupClaimNames,
+  decodeSegment,
+  claims,
+  asStrings,
+  claimStrings,
+  effectiveGroups,
+  identitySummary,
   field,
   asString,
   nodeString,
   login,
   transientErrorTypes,
   isTransient,
+  isDenied,
   attempts,
   gql,
   commandResultSelection,

package/src/Seed_Connect.res

@@ -38,6 +38,13 @@ let make = async (
   let token = await login(~username, ~password)
   let client = Seed_Client.make(~config={endpoint: endpoint})
   client->Seed_Client.useToken(token)
+  // What the bearer grants, which is not always what the account list showed: a
+  // token narrowed to one role presents that role alone. Said at login so the
+  // run starts from the identity it will actually be refused or served under.
+  switch Seed_Client.identitySummary(client) {
+  | Some(summary) => Console.log(`Acting as: ${summary}`)
+  | None => ()
+  }
   {client, uploadsSkipped, label}
 }
 

package/src/Seed_Connect.res.mjs

@@ -15,6 +15,10 @@ async function make(label, endpoint, login, localDefaultsOpt) {
     endpoint: endpoint
   });
   Seed_Client$ReventlessSeed.useToken(client, token);
+  let summary = Seed_Client$ReventlessSeed.identitySummary(client);
+  if (summary !== undefined) {
+    console.log(`Acting as: ` + summary);
+  }
   return {
     client: client,
     uploadsSkipped: uploadsSkipped,