serverless-plugin-module-registry 1.0.12 → 1.0.13

package/src/internal-infrastructure/__tests__/role-updater.test.ts

@@ -0,0 +1,781 @@
+/**
+ * Role Updater Handler Tests
+ * Tests for the SQS-triggered Lambda that updates IAM role tags and policies
+ */
+
+// Mock AWS SDK before imports
+const mockDynamoSend = jest.fn()
+const mockIAMSend = jest.fn()
+const mockCloudWatchSend = jest.fn()
+
+jest.mock('@aws-sdk/client-dynamodb', () => ({
+  DynamoDBClient: jest.fn(() => ({
+    send: mockDynamoSend,
+  })),
+  QueryCommand: jest.fn((input) => input),
+}))
+
+jest.mock('@aws-sdk/client-iam', () => ({
+  IAMClient: jest.fn(() => ({
+    send: mockIAMSend,
+  })),
+  ListRolesCommand: jest.fn((input) => input),
+  GetRoleCommand: jest.fn((input) => input),
+  TagRoleCommand: jest.fn((input) => input),
+  ListAttachedRolePoliciesCommand: jest.fn((input) => input),
+  AttachRolePolicyCommand: jest.fn((input) => input),
+  ListPoliciesCommand: jest.fn((input) => input),
+}))
+
+jest.mock('@aws-sdk/client-cloudwatch', () => ({
+  CloudWatchClient: jest.fn(() => ({
+    send: mockCloudWatchSend,
+  })),
+  PutMetricDataCommand: jest.fn((input) => input),
+}))
+
+import { SQSEvent } from 'aws-lambda'
+import { handler } from '../handlers/role-updater'
+
+describe('Role Updater Handler', () => {
+  const originalEnv = process.env
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockDynamoSend.mockReset()
+    mockIAMSend.mockReset()
+    mockCloudWatchSend.mockReset()
+    process.env = {
+      ...originalEnv,
+      DYNAMODB_TABLE_NAME: 'test-table',
+      POLICY_PREFIX: 'api',
+      AWS_ACCOUNT_ID: '123456789012',
+    }
+  })
+
+  afterAll(() => {
+    process.env = originalEnv
+  })
+
+  describe('DynamoDB feature query', () => {
+    it('should query all features for a role+module', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock DynamoDB query response
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+          },
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#fkpvztwW' },
+          },
+        ],
+      })
+
+      // Mock IAM ListRoles (no matching roles)
+      mockIAMSend.mockResolvedValueOnce({
+        Roles: [],
+      })
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      expect(mockDynamoSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          TableName: 'test-table',
+          KeyConditionExpression: 'PK = :pk AND begins_with(SK, :sk)',
+          ExpressionAttributeValues: {
+            ':pk': { S: 'ROLE#authenticated' },
+            ':sk': { S: 'MODULE#sign#' },
+          },
+        })
+      )
+    })
+  })
+
+  describe('Tag value building', () => {
+    it('should sort feature IDs alphabetically and join with colon', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock DynamoDB with unsorted features
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+          },
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#fkpvztwW' },
+          },
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#7tmARMbS' },
+          },
+        ],
+      })
+
+      // Mock IAM ListRoles
+      mockIAMSend.mockResolvedValueOnce({
+        Roles: [
+          { RoleName: 'api-acme-authenticated' },
+        ],
+      })
+
+      // Mock GetRole
+      mockIAMSend.mockResolvedValueOnce({
+        Role: {
+          Tags: [],
+        },
+      })
+
+      // Mock TagRole
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock ListAttachedPolicies
+      mockIAMSend.mockResolvedValueOnce({
+        AttachedPolicies: [],
+      })
+
+      // Mock ListPolicies
+      mockIAMSend.mockResolvedValueOnce({
+        Policies: [
+          {
+            PolicyName: 'api-sign',
+            Arn: 'arn:aws:iam::123456789012:policy/api-sign',
+          },
+        ],
+      })
+
+      // Mock AttachRolePolicy
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // Check TagRole was called with sorted IDs
+      const tagRoleCall = mockIAMSend.mock.calls.find(
+        (call) => call[0].Tags
+      )
+      expect(tagRoleCall[0].Tags[0]).toEqual({
+        Key: 'signFeatures',
+        Value: '7tmARMbS:fkpvztwW:jSiJIIpP', // Alphabetically sorted
+      })
+    })
+  })
+
+  describe('IAM role discovery', () => {
+    it('should find all tenant roles matching pattern', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock DynamoDB
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+          },
+        ],
+      })
+
+      // Mock IAM ListRoles with pagination
+      mockIAMSend
+        .mockResolvedValueOnce({
+          Roles: [
+            { RoleName: 'api-acme-authenticated' },
+            { RoleName: 'api-globex-authenticated' },
+            { RoleName: 'api-acme-unauthenticated' }, // Should not match
+          ],
+          Marker: 'next-page',
+        })
+        .mockResolvedValueOnce({
+          Roles: [
+            { RoleName: 'api-vault-authenticated' },
+          ],
+        })
+
+      // Mock GetRole (3 times - for matching roles)
+      mockIAMSend.mockResolvedValue({ Role: { Tags: [] } })
+
+      // Mock TagRole
+      mockIAMSend.mockResolvedValue({})
+
+      // Mock ListAttachedPolicies
+      mockIAMSend.mockResolvedValue({ AttachedPolicies: [] })
+
+      // Mock ListPolicies
+      mockIAMSend.mockResolvedValue({
+        Policies: [
+          {
+            PolicyName: 'api-sign',
+            Arn: 'arn:aws:iam::123456789012:policy/api-sign',
+          },
+        ],
+      })
+
+      // Mock AttachRolePolicy
+      mockIAMSend.mockResolvedValue({})
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // Should update 3 matching roles (authenticated suffix)
+      // Verify by checking TagRole calls (one per role)
+      const tagRoleCalls = mockIAMSend.mock.calls.filter(
+        (call) => call[0].Tags
+      )
+
+      expect(tagRoleCalls.length).toBe(3)
+    })
+  })
+
+  describe('Idempotent tag updates', () => {
+    it('should skip tag update if value unchanged', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock DynamoDB
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+          },
+        ],
+      })
+
+      // Mock IAM ListRoles
+      mockIAMSend.mockResolvedValueOnce({
+        Roles: [{ RoleName: 'api-acme-authenticated' }],
+      })
+
+      // Mock GetRole - tag already exists with same value
+      mockIAMSend.mockResolvedValueOnce({
+        Role: {
+          Tags: [
+            { Key: 'signFeatures', Value: 'jSiJIIpP' },
+          ],
+        },
+      })
+
+      // Mock ListAttachedPolicies
+      mockIAMSend.mockResolvedValueOnce({ AttachedPolicies: [] })
+
+      // Mock ListPolicies
+      mockIAMSend.mockResolvedValueOnce({
+        Policies: [
+          {
+            PolicyName: 'api-sign',
+            Arn: 'arn:aws:iam::123456789012:policy/api-sign',
+          },
+        ],
+      })
+
+      // Mock AttachRolePolicy
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // TagRole should NOT be called
+      const tagRoleCalls = mockIAMSend.mock.calls.filter(
+        (call) => call[0].Tags
+      )
+      expect(tagRoleCalls.length).toBe(0)
+    })
+
+    it('should update tag if value changed', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock DynamoDB
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+          },
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#fkpvztwW' },
+          },
+        ],
+      })
+
+      // Mock IAM ListRoles
+      mockIAMSend.mockResolvedValueOnce({
+        Roles: [{ RoleName: 'api-acme-authenticated' }],
+      })
+
+      // Mock GetRole - tag exists with different value
+      mockIAMSend.mockResolvedValueOnce({
+        Role: {
+          Tags: [
+            { Key: 'signFeatures', Value: 'jSiJIIpP' }, // Old value
+          ],
+        },
+      })
+
+      // Mock TagRole
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock ListAttachedPolicies
+      mockIAMSend.mockResolvedValueOnce({ AttachedPolicies: [] })
+
+      // Mock ListPolicies
+      mockIAMSend.mockResolvedValueOnce({
+        Policies: [
+          {
+            PolicyName: 'api-sign',
+            Arn: 'arn:aws:iam::123456789012:policy/api-sign',
+          },
+        ],
+      })
+
+      // Mock AttachRolePolicy
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // TagRole should be called with new value
+      const tagRoleCalls = mockIAMSend.mock.calls.filter(
+        (call) => call[0].Tags
+      )
+      expect(tagRoleCalls.length).toBe(1)
+      expect(tagRoleCalls[0][0].Tags[0].Value).toBe('fkpvztwW:jSiJIIpP')
+    })
+  })
+
+  describe('Idempotent policy attachment', () => {
+    it('should skip policy attachment if already attached', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock DynamoDB
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+          },
+        ],
+      })
+
+      // Mock IAM ListRoles
+      mockIAMSend.mockResolvedValueOnce({
+        Roles: [{ RoleName: 'api-acme-authenticated' }],
+      })
+
+      // Mock GetRole
+      mockIAMSend.mockResolvedValueOnce({
+        Role: { Tags: [] },
+      })
+
+      // Mock TagRole
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock ListAttachedPolicies - policy already attached
+      mockIAMSend.mockResolvedValueOnce({
+        AttachedPolicies: [
+          {
+            PolicyName: 'api-sign',
+            PolicyArn: 'arn:aws:iam::123456789012:policy/api-sign',
+          },
+        ],
+      })
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // AttachRolePolicy should NOT be called
+      const attachPolicyCalls = mockIAMSend.mock.calls.filter(
+        (call) => call[0].PolicyArn && call[0].RoleName
+      )
+      expect(attachPolicyCalls.length).toBe(0)
+    })
+
+    it('should attach policy if not attached', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock DynamoDB
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+          },
+        ],
+      })
+
+      // Mock IAM ListRoles
+      mockIAMSend.mockResolvedValueOnce({
+        Roles: [{ RoleName: 'api-acme-authenticated' }],
+      })
+
+      // Mock GetRole
+      mockIAMSend.mockResolvedValueOnce({
+        Role: { Tags: [] },
+      })
+
+      // Mock TagRole
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock ListAttachedPolicies - no policies attached
+      mockIAMSend.mockResolvedValueOnce({
+        AttachedPolicies: [],
+      })
+
+      // Mock ListPolicies
+      mockIAMSend.mockResolvedValueOnce({
+        Policies: [
+          {
+            PolicyName: 'api-sign',
+            Arn: 'arn:aws:iam::123456789012:policy/api-sign',
+          },
+        ],
+      })
+
+      // Mock AttachRolePolicy
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // AttachRolePolicy should be called
+      const attachPolicyCalls = mockIAMSend.mock.calls.filter(
+        (call) => call[0].PolicyArn && call[0].RoleName
+      )
+      expect(attachPolicyCalls.length).toBe(1)
+    })
+  })
+
+  describe('Error handling', () => {
+    it('should throw error if DYNAMODB_TABLE_NAME not set', async () => {
+      delete process.env.DYNAMODB_TABLE_NAME
+
+      const event: SQSEvent = {
+        Records: [],
+      }
+
+      await expect(handler(event)).rejects.toThrow(
+        'DYNAMODB_TABLE_NAME environment variable not set'
+      )
+    })
+
+    it('should continue processing other messages if one fails', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+          {
+            messageId: '2',
+            receiptHandle: 'receipt-2',
+            body: JSON.stringify({
+              roleName: 'unauthenticated',
+              moduleName: 'workflow',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // First message fails
+      mockDynamoSend.mockRejectedValueOnce(new Error('DynamoDB error'))
+
+      // Second message succeeds
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [],
+      })
+
+      // Mock IAM for second message
+      mockIAMSend.mockResolvedValueOnce({
+        Roles: [],
+      })
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // Should process second message despite first failing
+      expect(mockDynamoSend).toHaveBeenCalledTimes(2)
+    })
+
+    it('should handle policy not found gracefully', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock DynamoDB
+      mockDynamoSend.mockResolvedValueOnce({
+        Items: [
+          {
+            PK: { S: 'ROLE#authenticated' },
+            SK: { S: 'MODULE#sign#FEATURE#jSiJIIpP' },
+          },
+        ],
+      })
+
+      // Mock IAM ListRoles
+      mockIAMSend.mockResolvedValueOnce({
+        Roles: [{ RoleName: 'api-acme-authenticated' }],
+      })
+
+      // Mock GetRole
+      mockIAMSend.mockResolvedValueOnce({
+        Role: { Tags: [] },
+      })
+
+      // Mock TagRole
+      mockIAMSend.mockResolvedValueOnce({})
+
+      // Mock ListAttachedPolicies
+      mockIAMSend.mockResolvedValueOnce({
+        AttachedPolicies: [],
+      })
+
+      // Mock ListPolicies - no matching policy
+      mockIAMSend.mockResolvedValueOnce({
+        Policies: [],
+      })
+
+      // Mock CloudWatch
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      // Should not throw, should continue processing
+      expect(mockCloudWatchSend).toHaveBeenCalled()
+    })
+  })
+
+  describe('CloudWatch metrics', () => {
+    it('should publish metrics after processing', async () => {
+      const event: SQSEvent = {
+        Records: [
+          {
+            messageId: '1',
+            receiptHandle: 'receipt-1',
+            body: JSON.stringify({
+              roleName: 'authenticated',
+              moduleName: 'sign',
+              eventType: 'INSERT',
+              timestamp: '2024-01-01T00:00:00Z',
+            }),
+            attributes: {} as any,
+            messageAttributes: {},
+            md5OfBody: 'hash',
+            eventSource: 'aws:sqs',
+            eventSourceARN: 'arn:aws:sqs:us-east-1:123456789012:queue',
+            awsRegion: 'us-east-1',
+          },
+        ],
+      }
+
+      // Mock all AWS calls
+      mockDynamoSend.mockResolvedValueOnce({ Items: [] })
+      mockIAMSend.mockResolvedValueOnce({ Roles: [] })
+      mockCloudWatchSend.mockResolvedValueOnce({})
+
+      await handler(event)
+
+      expect(mockCloudWatchSend).toHaveBeenCalledWith(
+        expect.objectContaining({
+          Namespace: 'ModuleRegistry/RoleAutomation',
+          MetricData: expect.arrayContaining([
+            expect.objectContaining({ MetricName: 'SQSMessagesProcessed' }),
+            expect.objectContaining({ MetricName: 'RoleUpdatesProcessed' }),
+            expect.objectContaining({ MetricName: 'Errors' }),
+            expect.objectContaining({ MetricName: 'ProcessingDuration' }),
+          ]),
+        })
+      )
+    })
+  })
+})