@reventlessdev/reventless-seed 1.0.0-alpha.19 → 1.0.0-alpha.20

package/tests/Seed_ClientTest.res

@@ -57,3 +57,101 @@ describe("Seed_Client.isTransient:", () => {
     expect(Seed_Client.isTransient(JSON.Encode.null))->toBe(false)
   })
 })
+
+// An account's listed groups are not what authorizes it — the token's are. Both
+// platforms narrow a token to the single role the caller last chose, so a seed
+// can log in as an account the user list shows as `[Admin, Shopper]` and present
+// a token carrying `Shopper` alone. The refusal that follows names the field and
+// not the caller, and the account list cannot explain it either. These pin the
+// reading-back that turns that into a sentence.
+
+let b64url = payload =>
+  payload
+  ->NodeBuffer.fromStringUtf8
+  ->NodeBuffer.toStringBase64Url
+
+let jwt = claims =>
+  `header.${b64url(JSON.stringify(JSON.Encode.object(Dict.fromArray(claims))))}.signature`
+
+let localToken = claims =>
+  `${b64url(JSON.stringify(JSON.Encode.object(Dict.fromArray(claims))))}.signature`
+
+let strings = values => JSON.Encode.array(values->Array.map(JSON.Encode.string))
+
+let clientWith = token => {
+  let c = Seed_Client.make(~config={endpoint: "http://example.invalid/graphql"})
+  c->Seed_Client.useToken(token)
+  c
+}
+
+describe("Seed_Client.effectiveGroups:", () => {
+  // A Cognito id token carries its payload in the second segment, a local dev
+  // token in the first. Neither platform should have to announce which it is.
+  testSync("reads the payload wherever the provider put it", () => {
+    expect(
+      clientWith(jwt([("cognito:groups", strings(["Admin", "Shopper"]))]))->Seed_Client.effectiveGroups,
+    )->toEqual(Some(["Admin", "Shopper"]))
+    expect(
+      clientWith(localToken([("groups", strings(["Merchandiser"]))]))->Seed_Client.effectiveGroups,
+    )->toEqual(Some(["Merchandiser"]))
+  })
+
+  // An opaque bearer is not an error — it just means this can add nothing, and
+  // the failure reports what it always did.
+  testSync("says nothing about a token it cannot read", () => {
+    expect(clientWith("not-a-token")->Seed_Client.effectiveGroups)->toEqual(None)
+    expect(
+      Seed_Client.make(~config={endpoint: "http://example.invalid/graphql"})
+      ->Seed_Client.effectiveGroups,
+    )->toEqual(None)
+  })
+})
+
+describe("Seed_Client.identitySummary:", () => {
+  // The case that cost the debugging: eligible in the user list, refused by the
+  // token. Naming what it was narrowed FROM is what points at the role switch.
+  testSync("names the membership a narrowed token gave up", () =>
+    expect(
+      clientWith(
+        jwt([
+          ("cognito:groups", strings(["Shopper"])),
+          ("availableRoles", JSON.Encode.string("Admin,Shopper")),
+        ]),
+      )->Seed_Client.identitySummary,
+    )->toEqual(Some("Shopper — narrowed to this role from Admin, Shopper"))
+  )
+
+  // An ordinary login is not narrowed and has nothing to explain.
+  testSync("stays quiet about an unnarrowed token", () =>
+    expect(
+      clientWith(jwt([("cognito:groups", strings(["Admin", "Shopper"]))]))
+      ->Seed_Client.identitySummary,
+    )->toEqual(Some("Admin, Shopper"))
+  )
+
+  // A token granting nothing reads as a sentence rather than an empty string.
+  testSync("says so when the token carries no groups at all", () =>
+    expect(
+      clientWith(jwt([("cognito:groups", strings([]))]))->Seed_Client.identitySummary,
+    )->toEqual(Some("no groups"))
+  )
+})
+
+describe("Seed_Client.isDenied:", () => {
+  // AppSync types it; the local server carries it in the message.
+  testSync("recognises a refusal in either platform's vocabulary", () => {
+    expect(Seed_Client.isDenied(errors([errorOfType("Unauthorized")])))->toBe(true)
+    expect(
+      Seed_Client.isDenied(
+        errors([Dict.fromArray([("message", JSON.Encode.string("Not Authorized to access X"))])]),
+      ),
+    )->toBe(true)
+  })
+
+  // Attaching an identity to an unrelated failure would point the reader at the
+  // wrong thing.
+  testSync("leaves every other failure alone", () => {
+    expect(Seed_Client.isDenied(errors([errorOfType("ValidationException")])))->toBe(false)
+    expect(Seed_Client.isDenied(errors([])))->toBe(false)
+  })
+})

package/tests/Seed_ClientTest.res.mjs

@@ -57,8 +57,111 @@ globalThis.describe("Seed_Client.isTransient:", () => {
   });
 });
 
+function b64url(payload) {
+  return Buffer.from(payload, "utf8").toString("base64url");
+}
+
+function jwt(claims) {
+  let payload = JSON.stringify(Object.fromEntries(claims));
+  return `header.` + Buffer.from(payload, "utf8").toString("base64url") + `.signature`;
+}
+
+function localToken(claims) {
+  let payload = JSON.stringify(Object.fromEntries(claims));
+  return Buffer.from(payload, "utf8").toString("base64url") + `.signature`;
+}
+
+function strings(values) {
+  return values.map(prim => prim);
+}
+
+function clientWith(token) {
+  let c = Seed_Client$ReventlessSeed.make({
+    endpoint: "http://example.invalid/graphql"
+  });
+  Seed_Client$ReventlessSeed.useToken(c, token);
+  return c;
+}
+
+globalThis.describe("Seed_Client.effectiveGroups:", () => {
+  globalThis.test("reads the payload wherever the provider put it", () => {
+    globalThis.expect(Seed_Client$ReventlessSeed.effectiveGroups(clientWith(jwt([[
+        "cognito:groups",
+        [
+          "Admin",
+          "Shopper"
+        ].map(prim => prim)
+      ]])))).toEqual([
+      "Admin",
+      "Shopper"
+    ]);
+    globalThis.expect(Seed_Client$ReventlessSeed.effectiveGroups(clientWith(localToken([[
+        "groups",
+        ["Merchandiser"].map(prim => prim)
+      ]])))).toEqual(["Merchandiser"]);
+  });
+  globalThis.test("says nothing about a token it cannot read", () => {
+    globalThis.expect(Seed_Client$ReventlessSeed.effectiveGroups(clientWith("not-a-token"))).toEqual(undefined);
+    globalThis.expect(Seed_Client$ReventlessSeed.effectiveGroups(Seed_Client$ReventlessSeed.make({
+      endpoint: "http://example.invalid/graphql"
+    }))).toEqual(undefined);
+  });
+});
+
+globalThis.describe("Seed_Client.identitySummary:", () => {
+  globalThis.test("names the membership a narrowed token gave up", () => {
+    globalThis.expect(Seed_Client$ReventlessSeed.identitySummary(clientWith(jwt([
+      [
+        "cognito:groups",
+        ["Shopper"].map(prim => prim)
+      ],
+      [
+        "availableRoles",
+        "Admin,Shopper"
+      ]
+    ])))).toEqual("Shopper — narrowed to this role from Admin, Shopper");
+  });
+  globalThis.test("stays quiet about an unnarrowed token", () => {
+    globalThis.expect(Seed_Client$ReventlessSeed.identitySummary(clientWith(jwt([[
+        "cognito:groups",
+        [
+          "Admin",
+          "Shopper"
+        ].map(prim => prim)
+      ]])))).toEqual("Admin, Shopper");
+  });
+  globalThis.test("says so when the token carries no groups at all", () => {
+    globalThis.expect(Seed_Client$ReventlessSeed.identitySummary(clientWith(jwt([[
+        "cognito:groups",
+        [].map(prim => prim)
+      ]])))).toEqual("no groups");
+  });
+});
+
+globalThis.describe("Seed_Client.isDenied:", () => {
+  globalThis.test("recognises a refusal in either platform's vocabulary", () => {
+    let entries = [errorOfType("Unauthorized")];
+    globalThis.expect(Seed_Client$ReventlessSeed.isDenied(entries.map(prim => prim))).toBe(true);
+    let entries$1 = [Object.fromEntries([[
+          "message",
+          "Not Authorized to access X"
+        ]])];
+    globalThis.expect(Seed_Client$ReventlessSeed.isDenied(entries$1.map(prim => prim))).toBe(true);
+  });
+  globalThis.test("leaves every other failure alone", () => {
+    let entries = [errorOfType("ValidationException")];
+    globalThis.expect(Seed_Client$ReventlessSeed.isDenied(entries.map(prim => prim))).toBe(false);
+    globalThis.expect(Seed_Client$ReventlessSeed.isDenied([].map(prim => prim))).toBe(false);
+  });
+});
+
 export {
   errors,
   errorOfType,
+  b64url,
+  jwt,
+  localToken,
+  strings,
+  clientWith,
 }
 /*  Not a pure module */