fix(auth): confirmSignIn identity pool errors, sign-in log redaction and the access-group signed-out record

.github/workflows/build_amplify_swift_platforms.yml

@@ -82,16 +82,19 @@ jobs:
             echo "build=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # A file an Xcode project copies into a bundle (a host app's README, say) that is missing from the
+          # checkout breaks the copying target's build, which a skipped job can't show: fail here, naming the project.
+          python3 scripts/python/affected_targets.py --check-bundled
           base="$BASE_REF"
           git fetch --no-tags origin "$base" || true
-          # With rename detection a rename lists only its new path; its old path goes to --renamed-from, which
-          # the selector attributes (a bundled file's old path still selects its group) but never fails closed on.
+          # With rename detection a rename lists only its new path. --renames gets each rename's old and new paths;
+          # the selector attributes the old path too, and fails closed on an unknown one unless the new one is attributed.
           mb="$(git merge-base HEAD "origin/$base")"
           git diff --name-only -M "$mb" HEAD > /tmp/changed.txt
-          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2 > /tmp/renamed_from.txt
+          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2- > /tmp/renames.txt
           swift package dump-package > /tmp/package.json
           sel=$(python3 scripts/python/affected_targets.py \
-            --package /tmp/package.json --changed /tmp/changed.txt --renamed-from /tmp/renamed_from.txt \
+            --package /tmp/package.json --changed /tmp/changed.txt --renames /tmp/renames.txt \
             --groups scripts/python/unit_test_groups.json | grep '^selected=' | cut -d= -f2-)
           [ "$sel" = "[]" ] && echo "build=false" >> "$GITHUB_OUTPUT" || echo "build=true" >> "$GITHUB_OUTPUT"
 

.github/workflows/build_minimum_supported_swift_platforms.yml

@@ -51,16 +51,19 @@ jobs:
             echo "build=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # A file an Xcode project copies into a bundle (a host app's README, say) that is missing from the
+          # checkout breaks the copying target's build, which a skipped job can't show: fail here, naming the project.
+          python3 scripts/python/affected_targets.py --check-bundled
           base="$BASE_REF"
           git fetch --no-tags origin "$base" || true
-          # With rename detection a rename lists only its new path; its old path goes to --renamed-from, which
-          # the selector attributes (a bundled file's old path still selects its group) but never fails closed on.
+          # With rename detection a rename lists only its new path. --renames gets each rename's old and new paths;
+          # the selector attributes the old path too, and fails closed on an unknown one unless the new one is attributed.
           mb="$(git merge-base HEAD "origin/$base")"
           git diff --name-only -M "$mb" HEAD > /tmp/changed.txt
-          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2 > /tmp/renamed_from.txt
+          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2- > /tmp/renames.txt
           swift package dump-package > /tmp/package.json
           sel=$(python3 scripts/python/affected_targets.py \
-            --package /tmp/package.json --changed /tmp/changed.txt --renamed-from /tmp/renamed_from.txt \
+            --package /tmp/package.json --changed /tmp/changed.txt --renames /tmp/renames.txt \
             --groups scripts/python/unit_test_groups.json | grep '^selected=' | cut -d= -f2-)
           [ "$sel" = "[]" ] && echo "build=false" >> "$GITHUB_OUTPUT" || echo "build=true" >> "$GITHUB_OUTPUT"
 

.github/workflows/build_xcode_preview.yml

@@ -65,16 +65,19 @@ jobs:
             echo "build=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # A file an Xcode project copies into a bundle (a host app's README, say) that is missing from the
+          # checkout breaks the copying target's build, which a skipped job can't show: fail here, naming the project.
+          python3 scripts/python/affected_targets.py --check-bundled
           base="$BASE_REF"
           git fetch --no-tags origin "$base" || true
-          # With rename detection a rename lists only its new path; its old path goes to --renamed-from, which
-          # the selector attributes (a bundled file's old path still selects its group) but never fails closed on.
+          # With rename detection a rename lists only its new path. --renames gets each rename's old and new paths;
+          # the selector attributes the old path too, and fails closed on an unknown one unless the new one is attributed.
           mb="$(git merge-base HEAD "origin/$base")"
           git diff --name-only -M "$mb" HEAD > /tmp/changed.txt
-          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2 > /tmp/renamed_from.txt
+          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2- > /tmp/renames.txt
           swift package dump-package > /tmp/package.json
           sel=$(python3 scripts/python/affected_targets.py \
-            --package /tmp/package.json --changed /tmp/changed.txt --renamed-from /tmp/renamed_from.txt \
+            --package /tmp/package.json --changed /tmp/changed.txt --renames /tmp/renames.txt \
             --groups scripts/python/unit_test_groups.json | grep '^selected=' | cut -d= -f2-)
           [ "$sel" = "[]" ] && echo "build=false" >> "$GITHUB_OUTPUT" || echo "build=true" >> "$GITHUB_OUTPUT"
 

.github/workflows/ci_script_self_tests.yml

@@ -5,9 +5,9 @@
 #   integration-test jobs run it, with BSD find.
 # - scripts/cognito-engine/check_fixture_lock.sh: the plugin behavior snapshot lock's self-file check
 #   (test_check_fixture_lock.sh, in a scratch repository built from this checkout).
-# - scripts/python/affected_targets.py: the test selector the unit and integration workflows run, over the real
-#   group files, this checkout's Xcode projects (the READMEs host apps bundle) and a stub package dump
-#   (test_affected_targets.py), so it needs no Swift toolchain. A project change runs it too.
+#
+# The test selector's self-test is in ci_selector_self_tests.yml, so that a project change, which it reads, starts
+# only that one.
 #
 # No AWS call is made, and the jobs need no credentials and no secrets.
 
@@ -20,9 +20,6 @@ on:
       - 'scripts/cognito-engine/check_fixture_lock.sh'
       - 'scripts/cognito-engine/test_check_fixture_lock.sh'
       - '.github/workflows/auth_golden_fixture_lock.yml'
-      - 'scripts/python/**'
-      # The selector's self-test reads the host apps' Copy Bundle Resources from the real Xcode projects.
-      - '**/*.xcodeproj/project.pbxproj'
       - '.github/workflows/ci_script_self_tests.yml'
   push:
     branches:
@@ -32,9 +29,6 @@ on:
       - 'scripts/cognito-engine/check_fixture_lock.sh'
       - 'scripts/cognito-engine/test_check_fixture_lock.sh'
       - '.github/workflows/auth_golden_fixture_lock.yml'
-      - 'scripts/python/**'
-      # The selector's self-test reads the host apps' Copy Bundle Resources from the real Xcode projects.
-      - '**/*.xcodeproj/project.pbxproj'
       - '.github/workflows/ci_script_self_tests.yml'
 
 permissions:
@@ -64,15 +58,3 @@ jobs:
 
       - name: Run the self-test
         run: bash scripts/cognito-engine/test_check_fixture_lock.sh
-
-  test-selector:
-    name: Test selector
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
-        with:
-          persist-credentials: false
-
-      - name: Run the self-test
-        run: python3 -m unittest discover -s scripts/python -p 'test_*.py'

.github/workflows/ci_selector_self_tests.yml

@@ -0,0 +1,39 @@
+# Offline self-test of scripts/python/affected_targets.py, the test selector and bundled-file check the unit,
+# integration and build workflows' detect steps run (test_affected_targets.py). It runs over the real group files, a
+# stub package dump and this checkout's Xcode projects (the files host apps copy into bundles), so it needs no Swift
+# toolchain. A project change runs it too, since the check reads the projects; the other script self-tests are in
+# ci_script_self_tests.yml, which a project change doesn't start.
+#
+# No AWS call is made, and the job needs no credentials and no secrets.
+
+name: CI | Test Selector Self-Tests
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/python/**'
+      - '**/*.xcodeproj/project.pbxproj'
+      - '.github/workflows/ci_selector_self_tests.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'scripts/python/**'
+      - '**/*.xcodeproj/project.pbxproj'
+      - '.github/workflows/ci_selector_self_tests.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  test-selector:
+    name: Test selector
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
+        with:
+          persist-credentials: false
+
+      - name: Run the self-test
+        run: python3 -m unittest discover -s scripts/python -p 'test_*.py'

.github/workflows/integ_test.yml

@@ -63,16 +63,19 @@ jobs:
             done
             exit 0
           fi
+          # A file an Xcode project copies into a bundle (a host app's README, say) that is missing from the
+          # checkout breaks the copying target's build, which a skipped job can't show: fail here, naming the project.
+          python3 scripts/python/affected_targets.py --check-bundled
           base="$BASE_REF"
           git fetch --no-tags origin "$base" || true
-          # With rename detection a rename lists only its new path; its old path goes to --renamed-from, which
-          # the selector attributes (a bundled file's old path still selects its group) but never fails closed on.
+          # With rename detection a rename lists only its new path. --renames gets each rename's old and new paths;
+          # the selector attributes the old path too, and fails closed on an unknown one unless the new one is attributed.
           mb="$(git merge-base HEAD "origin/$base")"
           git diff --name-only -M "$mb" HEAD > /tmp/changed.txt
-          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2 > /tmp/renamed_from.txt
+          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2- > /tmp/renames.txt
           swift package dump-package > /tmp/package.json
           python3 scripts/python/affected_targets.py \
-            --package /tmp/package.json --changed /tmp/changed.txt --renamed-from /tmp/renamed_from.txt \
+            --package /tmp/package.json --changed /tmp/changed.txt --renames /tmp/renames.txt \
             --groups scripts/python/integ_test_groups.json | tee -a "$GITHUB_OUTPUT"
 
   analytics-test:

.github/workflows/integ_test_api.yml

@@ -50,16 +50,19 @@ jobs:
             echo "api=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # A file an Xcode project copies into a bundle (a host app's README, say) that is missing from the
+          # checkout breaks the copying target's build, which a skipped job can't show: fail here, naming the project.
+          python3 scripts/python/affected_targets.py --check-bundled
           base="$BASE_REF"
           git fetch --no-tags origin "$base" || true
-          # With rename detection a rename lists only its new path; its old path goes to --renamed-from, which
-          # the selector attributes (a bundled file's old path still selects its group) but never fails closed on.
+          # With rename detection a rename lists only its new path. --renames gets each rename's old and new paths;
+          # the selector attributes the old path too, and fails closed on an unknown one unless the new one is attributed.
           mb="$(git merge-base HEAD "origin/$base")"
           git diff --name-only -M "$mb" HEAD > /tmp/changed.txt
-          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2 > /tmp/renamed_from.txt
+          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2- > /tmp/renames.txt
           swift package dump-package > /tmp/package.json
           python3 scripts/python/affected_targets.py \
-            --package /tmp/package.json --changed /tmp/changed.txt --renamed-from /tmp/renamed_from.txt \
+            --package /tmp/package.json --changed /tmp/changed.txt --renames /tmp/renames.txt \
             --groups scripts/python/integ_test_groups.json | tee -a "$GITHUB_OUTPUT"
 
   functional-test:

.github/workflows/integ_test_datastore.yml

@@ -50,16 +50,19 @@ jobs:
             echo "datastore=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # A file an Xcode project copies into a bundle (a host app's README, say) that is missing from the
+          # checkout breaks the copying target's build, which a skipped job can't show: fail here, naming the project.
+          python3 scripts/python/affected_targets.py --check-bundled
           base="$BASE_REF"
           git fetch --no-tags origin "$base" || true
-          # With rename detection a rename lists only its new path; its old path goes to --renamed-from, which
-          # the selector attributes (a bundled file's old path still selects its group) but never fails closed on.
+          # With rename detection a rename lists only its new path. --renames gets each rename's old and new paths;
+          # the selector attributes the old path too, and fails closed on an unknown one unless the new one is attributed.
           mb="$(git merge-base HEAD "origin/$base")"
           git diff --name-only -M "$mb" HEAD > /tmp/changed.txt
-          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2 > /tmp/renamed_from.txt
+          git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2- > /tmp/renames.txt
           swift package dump-package > /tmp/package.json
           python3 scripts/python/affected_targets.py \
-            --package /tmp/package.json --changed /tmp/changed.txt --renamed-from /tmp/renamed_from.txt \
+            --package /tmp/package.json --changed /tmp/changed.txt --renames /tmp/renames.txt \
             --groups scripts/python/integ_test_groups.json | tee -a "$GITHUB_OUTPUT"
 
   datastore-base-test:

.github/workflows/unit_test.yml

@@ -85,16 +85,19 @@ jobs:
           if [ -n "$IDENTIFIER" ] || [ "$EVENT_NAME" != "push" ] || [ "$GITHUB_REF_NAME" = "main" ]; then
             sel=$(jq -c 'keys' scripts/python/unit_test_groups.json)
           else
+            # A file an Xcode project copies into a bundle (a host app's README, say) that is missing from the
+            # checkout breaks the copying target's build, which a skipped job can't show: fail here, naming the project.
+            python3 scripts/python/affected_targets.py --check-bundled
             base="$BASE_REF"
             git fetch --no-tags origin "$base" || true
-            # With rename detection a rename lists only its new path; its old path goes to --renamed-from, which
-            # the selector attributes (a bundled file's old path still selects its group) but never fails closed on.
+            # With rename detection a rename lists only its new path. --renames gets each rename's old and new paths;
+            # the selector attributes the old path too, and fails closed on an unknown one unless the new one is attributed.
             mb="$(git merge-base HEAD "origin/$base")"
             git diff --name-only -M "$mb" HEAD > /tmp/changed.txt
-            git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2 > /tmp/renamed_from.txt
+            git diff --name-status -M --diff-filter=R "$mb" HEAD | cut -f2- > /tmp/renames.txt
             swift package dump-package > /tmp/package.json
             sel=$(python3 scripts/python/affected_targets.py \
-              --package /tmp/package.json --changed /tmp/changed.txt --renamed-from /tmp/renamed_from.txt \
+              --package /tmp/package.json --changed /tmp/changed.txt --renames /tmp/renames.txt \
               --groups scripts/python/unit_test_groups.json | grep '^selected=' | cut -d= -f2-)
           fi
           echo "selected: $sel"

Amplify/Categories/Auth/Models/AuthSignUpStep.swift

@@ -27,3 +27,39 @@ public enum AuthSignUpStep {
 }
 
 extension AuthSignUpStep: Sendable { }
+
+extension AuthSignUpStep: CustomStringConvertible, CustomDebugStringConvertible, CustomReflectable {
+
+    /// The default enum printing, with the auto sign-in session redacted: the step is logged as part of a sign-up
+    /// result, and the session, with the username, signs the user in. Match `.completeAutoSignIn(let session)` for the
+    /// value.
+    public var description: String {
+        switch self {
+        case .confirmUser(let details, let additionalInfo, let userId):
+            return "confirmUser(\(String(reflecting: details)), \(String(reflecting: additionalInfo)), "
+                + "\(String(reflecting: userId)))"
+        case .completeAutoSignIn:
+            return "completeAutoSignIn(\(String(reflecting: Self.redactedSession)))"
+        case .done:
+            return "done"
+        }
+    }
+
+    public var debugDescription: String {
+        "\(String(reflecting: Self.self)).\(description)"
+    }
+
+    /// For `dump` and debuggers: the auto sign-in session redacted.
+    public var customMirror: Mirror {
+        switch self {
+        case .confirmUser(let details, let additionalInfo, let userId):
+            return Mirror(self, children: ["confirmUser": (details, additionalInfo, userId)], displayStyle: .enum)
+        case .completeAutoSignIn:
+            return Mirror(self, children: ["completeAutoSignIn": Self.redactedSession], displayStyle: .enum)
+        case .done:
+            return Mirror(self, children: [:], displayStyle: .enum)
+        }
+    }
+
+    private static let redactedSession = "<REDACTED>"
+}