Docs: AppSync identity docstring says OPENID_CONNECT returns None, but the dispatch has no such path

Offen
  • Stimmt etwas nicht?
#8,704 2 Kommentare 0 Reaktionen 1 zugewiesene Person Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

@ShussMiao arbeitet bereits daran.

Seit 30.10.2026.

  • #8705 von @ShussMiao — offen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Beschreibung

documentation
What were you searching in the docs?

The identity property docstring on AppSyncEventBase (aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py), which is the reference for what object you get back per AppSync authorization mode.

Is this related to an existing documentation section?

https://github.com/aws-powertools/powertools-lambda-python/blob/develop/aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py#L56-L66

How can we improve?

Two of the listed cases cannot be true as written, and they are still marked as unverified in the source.

get_identity_object only returns None when the identity mapping is None:

if identity is None:
    return None
if "sub" in identity:
    return AppSyncIdentityCognito(identity)
return AppSyncIdentityIAM(identity)

There is no path that yields None for a non-null identity. Yet the docstring says:

- AWS_LAMBDA authorization - returns None - NEED TO TEST
- OPENID_CONNECT authorization - returns None - NEED TO TEST

So each line can only hold if AppSync sends no identity object at all for that mode — which the code itself does not model, and which the two "NEED TO TEST" notes admit was never checked.

For OPENID_CONNECT specifically, AppSyncIdentityCognito exposes claims, issuer, groups and default_auth_strategy — those are the OIDC identity fields, so that class is already intended to serve OIDC events. Any OIDC identity carries sub, so it lands on AppSyncIdentityCognito, not on None.

I am deliberately not asserting what AWS_LAMBDA resolves to: its identity mapping is whatever the authorizer returns, there is no fixture for it here, and I have not verified it.

Got a suggestion in mind?

Two parts, both small:

  1. Correct the OPENID_CONNECT line to state that it resolves to AppSyncIdentityCognito, and drop its NEED TO TEST note now that it is settled.
  2. Add a test that pins the dispatch down — a non-null identity containing sub returns AppSyncIdentityCognito, a non-null identity without sub returns AppSyncIdentityIAM, and only None returns None — so the docstring and the behaviour cannot drift apart again.

I would leave the AWS_LAMBDA line as an open question rather than guess at it. Happy to open a PR if this is welcome.

Acknowledgment
  • I understand the final update might be different from my proposed suggestion, or refused.
Vorherrschende Sprache
Python
Sterne
3.3k
Forks
511
Ø Merge
3 T. 8 Std.
Gemergte PRs (30 T.)
92

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus aws-powertools/powertools-lambda-python

Alle Issues in aws-powertools/powertools-lambda-python

Ähnliche Issues

Weitere Issues zu Python

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.