Docs: AppSync identity docstring says OPENID_CONNECT returns None, but the dispatch has no such path

オープン
  • 何か問題がありますか？
#8,704 コメント 2 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@ShussMiao がすでに取り組んでいます。

2026年10月30日 から。

  • #8705 @ShussMiao による — オープン

評価

この issue はまだ評価されていません。

説明

documentation
What were you searching in the docs?

The identity property docstring on AppSyncEventBase (aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py), which is the reference for what object you get back per AppSync authorization mode.

Is this related to an existing documentation section?

https://github.com/aws-powertools/powertools-lambda-python/blob/develop/aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py#L56-L66

How can we improve?

Two of the listed cases cannot be true as written, and they are still marked as unverified in the source.

get_identity_object only returns None when the identity mapping is None:

if identity is None:
    return None
if "sub" in identity:
    return AppSyncIdentityCognito(identity)
return AppSyncIdentityIAM(identity)

There is no path that yields None for a non-null identity. Yet the docstring says:

- AWS_LAMBDA authorization - returns None - NEED TO TEST
- OPENID_CONNECT authorization - returns None - NEED TO TEST

So each line can only hold if AppSync sends no identity object at all for that mode — which the code itself does not model, and which the two "NEED TO TEST" notes admit was never checked.

For OPENID_CONNECT specifically, AppSyncIdentityCognito exposes claims, issuer, groups and default_auth_strategy — those are the OIDC identity fields, so that class is already intended to serve OIDC events. Any OIDC identity carries sub, so it lands on AppSyncIdentityCognito, not on None.

I am deliberately not asserting what AWS_LAMBDA resolves to: its identity mapping is whatever the authorizer returns, there is no fixture for it here, and I have not verified it.

Got a suggestion in mind?

Two parts, both small:

  1. Correct the OPENID_CONNECT line to state that it resolves to AppSyncIdentityCognito, and drop its NEED TO TEST note now that it is settled.
  2. Add a test that pins the dispatch down — a non-null identity containing sub returns AppSyncIdentityCognito, a non-null identity without sub returns AppSyncIdentityIAM, and only None returns None — so the docstring and the behaviour cannot drift apart again.

I would leave the AWS_LAMBDA line as an open question rather than guess at it. Happy to open a PR if this is welcome.

Acknowledgment
  • I understand the final update might be different from my proposed suggestion, or refused.
主要言語
Python
スター
3.3k
フォーク
511
平均マージ
3日 8時間
マージ済み PR（30日）
92

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

aws-powertools/powertools-lambda-python のほかの issue

aws-powertools/powertools-lambda-python の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。