Docs: AppSync identity docstring says OPENID_CONNECT returns None, but the dispatch has no such path

Aberta
  • Algo errado?
#8,704 2 comentários 0 reações 1 responsável Ver no GitHub

Mantenedores costumam responder em até 1 dia

@ShussMiao já está trabalhando nisso.

Desde 30/10/2026.

  • #8705 de @ShussMiao — aberto

Avaliação

Esta issue ainda não foi avaliada.

Descrição

documentation
What were you searching in the docs?

The identity property docstring on AppSyncEventBase (aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py), which is the reference for what object you get back per AppSync authorization mode.

Is this related to an existing documentation section?

https://github.com/aws-powertools/powertools-lambda-python/blob/develop/aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py#L56-L66

How can we improve?

Two of the listed cases cannot be true as written, and they are still marked as unverified in the source.

get_identity_object only returns None when the identity mapping is None:

if identity is None:
    return None
if "sub" in identity:
    return AppSyncIdentityCognito(identity)
return AppSyncIdentityIAM(identity)

There is no path that yields None for a non-null identity. Yet the docstring says:

- AWS_LAMBDA authorization - returns None - NEED TO TEST
- OPENID_CONNECT authorization - returns None - NEED TO TEST

So each line can only hold if AppSync sends no identity object at all for that mode — which the code itself does not model, and which the two "NEED TO TEST" notes admit was never checked.

For OPENID_CONNECT specifically, AppSyncIdentityCognito exposes claims, issuer, groups and default_auth_strategy — those are the OIDC identity fields, so that class is already intended to serve OIDC events. Any OIDC identity carries sub, so it lands on AppSyncIdentityCognito, not on None.

I am deliberately not asserting what AWS_LAMBDA resolves to: its identity mapping is whatever the authorizer returns, there is no fixture for it here, and I have not verified it.

Got a suggestion in mind?

Two parts, both small:

  1. Correct the OPENID_CONNECT line to state that it resolves to AppSyncIdentityCognito, and drop its NEED TO TEST note now that it is settled.
  2. Add a test that pins the dispatch down — a non-null identity containing sub returns AppSyncIdentityCognito, a non-null identity without sub returns AppSyncIdentityIAM, and only None returns None — so the docstring and the behaviour cannot drift apart again.

I would leave the AWS_LAMBDA line as an open question rather than guess at it. Happy to open a PR if this is welcome.

Acknowledgment
  • I understand the final update might be different from my proposed suggestion, or refused.
Linguagem predominante
Python
Estrelas
3.3k
Forks
511
Merge médio
3d 8h
PRs com merge (30d)
92

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de aws-powertools/powertools-lambda-python

Todas as issues de aws-powertools/powertools-lambda-python

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.