Docs: AppSync identity docstring says OPENID_CONNECT returns None, but the dispatch has no such path

未关闭
  • 哪里不对？
#8,704 2 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@ShussMiao 已经在做这个了。

开始于 2026年10月30日。

  • #8705 来自 @ShussMiao —— 未关闭

评估

这个 Issue 还没有评估数据。

描述

documentation
What were you searching in the docs?

The identity property docstring on AppSyncEventBase (aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py), which is the reference for what object you get back per AppSync authorization mode.

Is this related to an existing documentation section?

https://github.com/aws-powertools/powertools-lambda-python/blob/develop/aws_lambda_powertools/utilities/data_classes/appsync_resolver_event.py#L56-L66

How can we improve?

Two of the listed cases cannot be true as written, and they are still marked as unverified in the source.

get_identity_object only returns None when the identity mapping is None:

if identity is None:
    return None
if "sub" in identity:
    return AppSyncIdentityCognito(identity)
return AppSyncIdentityIAM(identity)

There is no path that yields None for a non-null identity. Yet the docstring says:

- AWS_LAMBDA authorization - returns None - NEED TO TEST
- OPENID_CONNECT authorization - returns None - NEED TO TEST

So each line can only hold if AppSync sends no identity object at all for that mode — which the code itself does not model, and which the two "NEED TO TEST" notes admit was never checked.

For OPENID_CONNECT specifically, AppSyncIdentityCognito exposes claims, issuer, groups and default_auth_strategy — those are the OIDC identity fields, so that class is already intended to serve OIDC events. Any OIDC identity carries sub, so it lands on AppSyncIdentityCognito, not on None.

I am deliberately not asserting what AWS_LAMBDA resolves to: its identity mapping is whatever the authorizer returns, there is no fixture for it here, and I have not verified it.

Got a suggestion in mind?

Two parts, both small:

  1. Correct the OPENID_CONNECT line to state that it resolves to AppSyncIdentityCognito, and drop its NEED TO TEST note now that it is settled.
  2. Add a test that pins the dispatch down — a non-null identity containing sub returns AppSyncIdentityCognito, a non-null identity without sub returns AppSyncIdentityIAM, and only None returns None — so the docstring and the behaviour cannot drift apart again.

I would leave the AWS_LAMBDA line as an open question rather than guess at it. Happy to open a PR if this is welcome.

Acknowledgment
  • I understand the final update might be different from my proposed suggestion, or refused.
主要语言
Python
星标
3.3k
派生
511
平均合并
3 天 8 小时
30 天内合并 PR
92

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

aws-powertools/powertools-lambda-python 的其他 Issue

查看 aws-powertools/powertools-lambda-python 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。