@reventlessdev/reventless-seed 1.0.0-alpha.20 → 1.0.0-alpha.21

package/lib/ocaml/Seed_Client.res

@@ -21,7 +21,8 @@ type response
 @val external setTimeout: (unit => unit, int) => unit = "setTimeout"
 @scope("Date") @val external nowMs: unit => float = "now"
 
-let sleep = (ms: int): promise<unit> => Promise.make((resolve, _) => setTimeout(() => resolve(), ms))
+let sleep = (ms: int): promise<unit> =>
+  Promise.make((resolve, _) => setTimeout(() => resolve(), ms))
 
 // ── Configuration ───────────────────────────────────────────────────────────
 
@@ -68,6 +69,12 @@ let availableRolesClaim = "availableRoles"
 /** Group claim per provider, tried in order. */
 let groupClaimNames = ["cognito:groups", "groups"]
 
+/** Claim carrying the caller's id, per provider, tried in order. A Cognito JWT
+    says `sub`; the local dev token is a base64url `Identity.t`, whose field is
+    `userId`. Same shape as `groupClaimNames`, for the same reason: this harness
+    depends on no framework package and must not learn who signed the token. */
+let callerIdClaimNames = ["sub", "userId"]
+
 let decodeSegment = (segment: string): option<dict<JSON.t>> =>
   try {
     segment
@@ -79,10 +86,22 @@ let decodeSegment = (segment: string): option<dict<JSON.t>> =>
   | _ => None
   }
 
+/**
+ * A JOSE header rather than a claims set.
+ *
+ * RFC 7515 requires `alg` on the header, and nothing puts it on a payload. The
+ * test matters because a JWT header is base64url JSON exactly as the payload is,
+ * so it decodes just as readily — and it comes first.
+ */
+let isJoseHeader = (obj: dict<JSON.t>): bool => obj->Dict.get("alg")->Option.isSome
+
 /** The bearer's payload, from whichever segment carries it — a Cognito JWT puts
     it second and a local dev token first, so trying each in turn saves this from
     having to know which platform signed the token. A segment that is not a JSON
-    object (a signature) simply does not decode. */
+    object (a signature) simply does not decode, and a JOSE header is skipped:
+    it IS a decodable JSON object, so taking the first one that parsed read a
+    real Cognito token's `{kid, alg}` as its claims and found no groups and no
+    id in it — silently, since an unreadable token is not an error here. */
 let claims = (t: t): option<dict<JSON.t>> =>
   t.token->Option.flatMap(token =>
     token
@@ -90,7 +109,11 @@ let claims = (t: t): option<dict<JSON.t>> =>
     ->Array.reduce(None, (found, segment) =>
       switch found {
       | Some(_) => found
-      | None => decodeSegment(segment)
+      | None =>
+        switch decodeSegment(segment) {
+        | Some(obj) if obj->isJoseHeader => None
+        | decoded => decoded
+        }
       }
     )
   )
@@ -118,6 +141,31 @@ let effectiveGroups = (t: t): option<array<string>> =>
     }
   )
 
+/** The id the bearer presents — what an `@owner` field is stamped with, and so
+    the only id a seed can key owner-scoped rows to and have an account read them
+    back. `None` when the token is opaque to us or names no id. */
+let callerId = (t: t): option<string> =>
+  callerIdClaimNames->Array.reduce(None, (found, name) =>
+    switch found {
+    | Some(_) => found
+    | None => t->claims->Option.flatMap(c => c->Dict.get(name))->Option.flatMap(JSON.Decode.string)
+    }
+  )
+
+/**
+ * The membership a narrowed token was reduced *from*, or `None` when the bearer
+ * is not narrowed.
+ *
+ * `availableRoles` is only written when a role was chosen, so its presence is
+ * the narrowing — the group claim alone cannot tell you, since a token carrying
+ * one group looks identical whether the account holds one or five.
+ */
+let narrowedFrom = (t: t): option<array<string>> =>
+  switch t->claimStrings(availableRolesClaim) {
+  | Some(available) if available->Array.length > 0 => Some(available)
+  | _ => None
+  }
+
 /** One line naming the identity the bearer carries, and — when it was narrowed —
     the membership it was narrowed from. The second half is the point: without it
     a refusal looks like a misconfigured grant rather than a role switch. */
@@ -178,8 +226,9 @@ let login = async (t: t): unit => {
     let detail = await res->responseText
     throw(
       Failed(
-        `login as "${username}" failed with HTTP ${(res->responseStatus)
-            ->Int.toString}: ${detail}`,
+        `login as "${username}" failed with HTTP ${res
+          ->responseStatus
+          ->Int.toString}: ${detail}`,
       ),
     )
   }
@@ -254,7 +303,19 @@ let attempts = 4
  * fixed delay would have the whole batch retry in lockstep and rebuild the same
  * burst that provoked the fault.
  */
-let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
+/** What a document came back as. `Errors` carries both the raw array — so a
+    caller can classify it, e.g. as a refusal — and the message `gql` would have
+    thrown, so the two paths cannot describe the same failure differently. */
+type failure = {errors: JSON.t, message: string}
+type outcome = Data(JSON.t) | Errors(failure)
+
+/**
+ * Sends one document and reports what came back, resending a transient fault
+ * along the way. Returning the errors rather than throwing is what lets a caller
+ * treat a refusal as an *answer* — which the authorization probe needs and
+ * seeding must never do.
+ */
+let gqlOutcome = async (t: t, ~query: string, ~label: string): outcome => {
   let headers = Dict.fromArray([("content-type", "application/json")])
   switch t.token {
   | Some(token) => headers->Dict.set("authorization", `Bearer ${token}`)
@@ -263,10 +324,9 @@ let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
   let body = JSON.stringify(
     JSON.Encode.object(Dict.fromArray([("query", JSON.Encode.string(query))])),
   )
-  let rec attempt = async (n: int): JSON.t => {
+  let rec attempt = async (n: int): outcome => {
     let res = try await fetch(t.config.endpoint, {method: "POST", headers, body}) catch {
-    | _ =>
-      throw(Failed(`${label}: cannot reach ${t.config.endpoint} — is the platform running?`))
+    | _ => throw(Failed(`${label}: cannot reach ${t.config.endpoint} — is the platform running?`))
     }
     let json = await res->responseJson
     switch json->field("errors") {
@@ -283,20 +343,52 @@ let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
         | Some(summary) => `\n  identity: ${summary}`
         | None => ""
         }
-        throw(
-          Failed(
-            `${label} failed\n  query: ${query}\n  response: ${JSON.stringify(
-                errors,
-              )}${identity}${tried}`,
-          ),
-        )
+        Errors({
+          errors,
+          message: `${label} failed\n  query: ${query}\n  response: ${JSON.stringify(
+              errors,
+            )}${identity}${tried}`,
+        })
       }
-    | None => json->field("data")->Option.getOr(JSON.Encode.null)
+    | None => Data(json->field("data")->Option.getOr(JSON.Encode.null))
     }
   }
   await attempt(1)
 }
 
+let gql = async (t: t, ~query: string, ~label: string): JSON.t =>
+  switch await gqlOutcome(t, ~query, ~label) {
+  | Data(data) => data
+  | Errors({message}) => throw(Failed(message))
+  }
+
+/**
+ * Whether the endpoint let this caller through, for a probe that means to find
+ * out rather than to succeed.
+ *
+ * Three outcomes and not two: "not refused" and "worked" are different claims,
+ * and collapsing them would let a misspelled field name read as a passing
+ * authorization check. `Granted` covers a domain rejection too — a
+ * `CommandRejected` arrives inside `data` with no GraphQL error, which is
+ * precisely how a probe confirms access without writing anything.
+ */
+type access =
+  | Granted
+  | Refused
+  | // Served, and carrying nothing. Its own case because the two platforms deny a
+  // read differently: AppSync answers `Unauthorized`, while the local resolver's
+  // interceptor returns an empty connection — so on local an unauthorized read
+  // and an empty view are the same response, and no caller can tell them apart.
+  // Naming it lets a probe say "consistent with a denial" instead of guessing.
+  Empty
+  | Broke(string)
+
+let checkAccess = async (t: t, ~query: string, ~label: string): access =>
+  switch await gqlOutcome(t, ~query, ~label) {
+  | Data(_) => Granted
+  | Errors({errors, message}) => errors->isDenied ? Refused : Broke(message)
+  }
+
 // ── Commands ────────────────────────────────────────────────────────────────
 
 let commandResultSelection = `__typename
@@ -328,6 +420,61 @@ let send = async (t: t, m: mutation, ~tolerate: array<string>=[]): option<string
   }
 }
 
+/**
+ * Whether this caller may issue one command — asked with the very document
+ * `send` would have sent, so what the probe tests is what the seed actually
+ * uses rather than a hand-built lookalike.
+ *
+ * Pair it with a payload the domain would refuse anyway. Then `Granted` arrives
+ * as a `CommandRejected` inside `data`, which appends nothing: the probe learns
+ * that the door opened without walking through it, and a regression that wrongly
+ * opens a door still writes no events.
+ */
+/** Refusal codes a command result carries. The two platforms answer a refused
+    command differently — AppSync rejects at the field and produces a GraphQL
+    `Unauthorized` error, while the local resolver runs the command handler and
+    answers `CommandRejected { errorCode: "Forbidden" }` inside `data`. Reading
+    only the first reports the second as allowed. */
+let deniedCommandCodes = ["Forbidden", "Unauthorized", "AccessDenied"]
+
+let isDeniedResult = (result: JSON.t): bool =>
+  switch (result->nodeString("errorCode"), result->nodeString("errorDetail")) {
+  | (Some(code), _) if deniedCommandCodes->Array.includes(code) => true
+  | (_, Some(detail)) => detail->String.toLowerCase->String.includes("not authorized")
+  | _ => false
+  }
+
+let checkCommandAccess = async (t: t, m: mutation): access =>
+  switch await gqlOutcome(
+    t,
+    ~query=`mutation { r: ${m.field}(${m.args->renderArgs}) { ${commandResultSelection} } }`,
+    ~label=m->describe,
+  ) {
+  | Errors({errors, message}) => errors->isDenied ? Refused : Broke(message)
+  // No GraphQL error is not yet a grant: the local platform's refusal lives in
+  // the command result, so the domain's own answer has to be read too. Any other
+  // rejection IS a grant — the door opened and the domain refused what came
+  // through it, which is exactly the outcome a non-writing probe wants.
+  | Data(data) =>
+    data->field("r")->Option.getOr(JSON.Encode.null)->isDeniedResult ? Refused : Granted
+  }
+
+/** Whether this caller may read one connection field. One row is enough: the
+    door is answered by the first request, not by the page behind it — but
+    whether a row came back is what separates a grant from a silent denial. */
+let checkQueryAccess = async (t: t, ~field as fieldName: string): access => {
+  let query = `{ ${fieldName}(first: 1) { edges { node { id } } } }`
+  switch await gqlOutcome(t, ~query, ~label=fieldName) {
+  | Errors({errors, message}) => errors->isDenied ? Refused : Broke(message)
+  | Data(data) =>
+    let edges = switch data->field(fieldName)->Option.flatMap(c => c->field("edges")) {
+    | Some(Array(rows)) => rows->Array.length
+    | _ => 0
+    }
+    edges > 0 ? Granted : Empty
+  }
+}
+
 let sendAll = async (t: t, mutations: array<mutation>): unit =>
   for i in 0 to mutations->Array.length - 1 {
     switch mutations->Array.get(i) {
@@ -342,12 +489,12 @@ let sendAll = async (t: t, mutations: array<mutation>): unit =>
  * Walks a Relay-style connection to the end. Connections page at 50 by default,
  * so any count taken from a single request silently truncates.
  */
-// `~args` is spliced into the connection's argument list — `"includeRetired: true"`
+let // `~args` is spliced into the connection's argument list — `"includeRetired: true"`
 // is the case it exists for, and the only way to read rows the resolvers withhold
 // by default. Literal GraphQL rather than a typed argument list because a seed
 // writes the query it means; the alternative is a builder that has to grow a case
 // per argument the platform adds.
-let queryAllNodes = async (
+queryAllNodes = async (
   t: t,
   ~field as fieldName: string,
   ~selection: string,
@@ -463,8 +610,9 @@ let waitForIds = async (
         missing->Array.length > 10 ? ` (+${(missing->Array.length - 10)->Int.toString} more)` : ""
       throw(
         Failed(
-          `only ${(found->Array.length)->Int.toString}/${(ids->Array.length)
-              ->Int.toString} ids reached ${fieldName} within ${timeoutMs->Int.toString}ms.\n  missing: ${shown}${extra}`,
+          `only ${found->Array.length->Int.toString}/${ids
+            ->Array.length
+            ->Int.toString} ids reached ${fieldName} within ${timeoutMs->Int.toString}ms.\n  missing: ${shown}${extra}`,
         ),
       )
     } else {

package/lib/ocaml/Seed_ClientTest.res

@@ -15,15 +15,16 @@ open JestGlobals
 
 let errors = entries => JSON.Encode.array(entries->Array.map(JSON.Encode.object))
 
-let errorOfType = errorType =>
-  Dict.fromArray([("errorType", JSON.Encode.string(errorType))])
+let errorOfType = errorType => Dict.fromArray([("errorType", JSON.Encode.string(errorType))])
 
 describe("Seed_Client.isTransient:", () => {
   testSync("resends a fault on the endpoint's own side", () =>
-    ["InternalFailure", "ServiceUnavailable", "Throttling", "TooManyRequestsException"]
-    ->Array.forEach(t =>
-      expect(Seed_Client.isTransient(errors([errorOfType(t)])))->toBe(true)
-    )
+    [
+      "InternalFailure",
+      "ServiceUnavailable",
+      "Throttling",
+      "TooManyRequestsException",
+    ]->Array.forEach(t => expect(Seed_Client.isTransient(errors([errorOfType(t)])))->toBe(true))
   )
 
   // The exact payload the seed aborted on.
@@ -33,8 +34,8 @@ describe("Seed_Client.isTransient:", () => {
   })
 
   testSync("fails fast on an error that is an answer", () =>
-    ["ValidationException", "Unauthorized", "FieldUndefined"]->Array.forEach(t =>
-      expect(Seed_Client.isTransient(errors([errorOfType(t)])))->toBe(false)
+    ["ValidationException", "Unauthorized", "FieldUndefined"]->Array.forEach(
+      t => expect(Seed_Client.isTransient(errors([errorOfType(t)])))->toBe(false),
     )
   )
 
@@ -52,8 +53,9 @@ describe("Seed_Client.isTransient:", () => {
   // endpoint said errors but named none" into an endless resend.
   testSync("treats an empty or untyped error list as final", () => {
     expect(Seed_Client.isTransient(errors([])))->toBe(false)
-    expect(Seed_Client.isTransient(errors([Dict.fromArray([("message", JSON.Encode.string("boom"))])])))
-    ->toBe(false)
+    expect(
+      Seed_Client.isTransient(errors([Dict.fromArray([("message", JSON.Encode.string("boom"))])])),
+    )->toBe(false)
     expect(Seed_Client.isTransient(JSON.Encode.null))->toBe(false)
   })
 })
@@ -70,8 +72,15 @@ let b64url = payload =>
   ->NodeBuffer.fromStringUtf8
   ->NodeBuffer.toStringBase64Url
 
+// A REAL JOSE header, not the literal string "header". The difference is the
+// whole bug: `{"kid":…,"alg":"RS256"}` is base64url JSON and decodes exactly as
+// the payload does, so `claims` took it as the claims set and found no groups
+// and no id in any Cognito token ever issued. A fake header that happened not to
+// decode is what let every assertion below pass against broken code.
+let joseHeader = b64url(`{"kid":"abc123","alg":"RS256"}`)
+
 let jwt = claims =>
-  `header.${b64url(JSON.stringify(JSON.Encode.object(Dict.fromArray(claims))))}.signature`
+  `${joseHeader}.${b64url(JSON.stringify(JSON.Encode.object(Dict.fromArray(claims))))}.signature`
 
 let localToken = claims =>
   `${b64url(JSON.stringify(JSON.Encode.object(Dict.fromArray(claims))))}.signature`
@@ -84,12 +93,41 @@ let clientWith = token => {
   c
 }
 
+describe("Seed_Client.claims:", () => {
+  // The regression this file could not previously express. A JWT header is a
+  // decodable JSON object sitting in front of the payload, so "the first segment
+  // that parses" is the header on every real token — and the seed then reported
+  // no groups, printed no `Acting as:` line, and attached no identity to a
+  // refusal, which is exactly the diagnosis it exists to give.
+  testSync("skips the JOSE header and reads the payload behind it", () =>
+    expect(
+      clientWith(jwt([("sub", JSON.Encode.string("real-sub"))]))
+      ->Seed_Client.claims
+      ->Option.flatMap(c => c->Dict.get("sub"))
+      ->Option.flatMap(JSON.Decode.string),
+    )->toEqual(Some("real-sub"))
+  )
+
+  // The header is identified by `alg`, not by position — a two-segment local dev
+  // token has no header at all, and its payload must not be mistaken for one.
+  testSync("takes the first segment when there is no header", () =>
+    expect(
+      clientWith(localToken([("userId", JSON.Encode.string("local-shopper"))]))
+      ->Seed_Client.claims
+      ->Option.flatMap(c => c->Dict.get("userId"))
+      ->Option.flatMap(JSON.Decode.string),
+    )->toEqual(Some("local-shopper"))
+  )
+})
+
 describe("Seed_Client.effectiveGroups:", () => {
   // A Cognito id token carries its payload in the second segment, a local dev
   // token in the first. Neither platform should have to announce which it is.
   testSync("reads the payload wherever the provider put it", () => {
     expect(
-      clientWith(jwt([("cognito:groups", strings(["Admin", "Shopper"]))]))->Seed_Client.effectiveGroups,
+      clientWith(
+        jwt([("cognito:groups", strings(["Admin", "Shopper"]))]),
+      )->Seed_Client.effectiveGroups,
     )->toEqual(Some(["Admin", "Shopper"]))
     expect(
       clientWith(localToken([("groups", strings(["Merchandiser"]))]))->Seed_Client.effectiveGroups,
@@ -101,12 +139,64 @@ describe("Seed_Client.effectiveGroups:", () => {
   testSync("says nothing about a token it cannot read", () => {
     expect(clientWith("not-a-token")->Seed_Client.effectiveGroups)->toEqual(None)
     expect(
-      Seed_Client.make(~config={endpoint: "http://example.invalid/graphql"})
-      ->Seed_Client.effectiveGroups,
+      Seed_Client.make(
+        ~config={endpoint: "http://example.invalid/graphql"},
+      )->Seed_Client.effectiveGroups,
     )->toEqual(None)
   })
 })
 
+// The id an `@owner` field is stamped with. A seed that cannot read it can only
+// key owner-scoped rows to a literal, and a literal matches one platform's
+// accounts at most — which is how a demo shopper came to be registered on a
+// deployment where nobody can ever be that shopper.
+
+describe("Seed_Client.callerId:", () => {
+  // A Cognito id token says `sub`; the local dev token is a base64url
+  // `Identity.t`, whose field is `userId`. Neither platform announces which.
+  testSync("reads the id under whichever name the provider gave it", () => {
+    expect(
+      clientWith(jwt([("sub", JSON.Encode.string("4275e4a4-00c1-70e1"))]))->Seed_Client.callerId,
+    )->toEqual(Some("4275e4a4-00c1-70e1"))
+    expect(
+      clientWith(
+        localToken([("userId", JSON.Encode.string("local-shopper"))]),
+      )->Seed_Client.callerId,
+    )->toEqual(Some("local-shopper"))
+  })
+
+  // `sub` first, so a token carrying both is read the way the pool that minted
+  // it means it.
+  testSync("prefers sub when a token carries both names", () =>
+    expect(
+      clientWith(
+        jwt([
+          ("sub", JSON.Encode.string("f215e4b4-30f1-700c")),
+          ("userId", JSON.Encode.string("local-shopper")),
+        ]),
+      )->Seed_Client.callerId,
+    )->toEqual(Some("f215e4b4-30f1-700c"))
+  )
+
+  // `None` is not an error — it means this cannot add anything, and the caller
+  // falls back to whatever the accounts file declared.
+  testSync("says nothing about a token it cannot read, or one naming no id", () => {
+    expect(clientWith("not-a-token")->Seed_Client.callerId)->toEqual(None)
+    expect(
+      clientWith(jwt([("cognito:groups", strings(["Admin"]))]))->Seed_Client.callerId,
+    )->toEqual(None)
+    expect(
+      Seed_Client.make(~config={endpoint: "http://example.invalid/graphql"})->Seed_Client.callerId,
+    )->toEqual(None)
+  })
+
+  // A claim of the wrong shape is not an id. Taking the array's first element
+  // would be a guess, and a guessed owner id seeds rows nobody can read.
+  testSync("refuses a claim that is not a single string", () =>
+    expect(clientWith(jwt([("sub", strings(["a", "b"]))]))->Seed_Client.callerId)->toEqual(None)
+  )
+})
+
 describe("Seed_Client.identitySummary:", () => {
   // The case that cost the debugging: eligible in the user list, refused by the
   // token. Naming what it was narrowed FROM is what points at the role switch.
@@ -124,8 +214,9 @@ describe("Seed_Client.identitySummary:", () => {
   // An ordinary login is not narrowed and has nothing to explain.
   testSync("stays quiet about an unnarrowed token", () =>
     expect(
-      clientWith(jwt([("cognito:groups", strings(["Admin", "Shopper"]))]))
-      ->Seed_Client.identitySummary,
+      clientWith(
+        jwt([("cognito:groups", strings(["Admin", "Shopper"]))]),
+      )->Seed_Client.identitySummary,
     )->toEqual(Some("Admin, Shopper"))
   )
 
@@ -137,6 +228,45 @@ describe("Seed_Client.identitySummary:", () => {
   )
 })
 
+// Whether a token is narrowed cannot be read off the group claim: a bearer
+// carrying one group looks identical whether the account holds one role or five.
+// `availableRoles` is written only when a role was chosen, so its presence IS
+// the narrowing — and that is what decides whether the seed has anything to ask.
+
+describe("Seed_Client.narrowedFrom:", () => {
+  testSync("names the membership a narrowed token was reduced from", () =>
+    expect(
+      clientWith(
+        jwt([
+          ("cognito:groups", strings(["Shopper"])),
+          ("availableRoles", JSON.Encode.string("Admin,Shopper")),
+        ]),
+      )->Seed_Client.narrowedFrom,
+    )->toEqual(Some(["Admin", "Shopper"]))
+  )
+
+  // The case that must NOT prompt: a single-role account is not narrowed, it is
+  // simply small. Asking it to choose would put a question in every run.
+  testSync("says nothing about an unnarrowed token", () => {
+    expect(
+      clientWith(jwt([("cognito:groups", strings(["Shopper"]))]))->Seed_Client.narrowedFrom,
+    )->toEqual(None)
+    expect(
+      clientWith(
+        jwt([("cognito:groups", strings(["Admin", "Shopper"]))]),
+      )->Seed_Client.narrowedFrom,
+    )->toEqual(None)
+  })
+
+  // An empty claim is not a narrowing to nothing — it is a claim carrying no
+  // information, and offering a menu of no roles would be a dead end.
+  testSync("treats an empty availableRoles as not narrowed", () =>
+    expect(
+      clientWith(jwt([("availableRoles", JSON.Encode.string(""))]))->Seed_Client.narrowedFrom,
+    )->toEqual(None)
+  )
+})
+
 describe("Seed_Client.isDenied:", () => {
   // AppSync types it; the local server carries it in the message.
   testSync("recognises a refusal in either platform's vocabulary", () => {