compileNotifications.test.js

'use strict';

const _ = require('lodash');
const expect = require('chai').expect;
const sinon = require('sinon');
const createServerless = require('../../test/createServerless');
const ServerlessStepFunctions = require('../..');

describe('#compileNotifications', () => {
  let consoleLogSpy;
  let serverless;
  let serverlessStepFunctions;

  beforeEach(() => {
    consoleLogSpy = sinon.spy();
    serverless = createServerless();
    serverless.servicePath = true;
    serverless.service.service = 'step-functions';
    serverless.service.provider.compiledCloudFormationTemplate = { Resources: {} };
    serverless.cli = { consoleLog: consoleLogSpy };
    const options = {
      stage: 'dev',
      region: 'ap-northeast-1',
    };
    serverlessStepFunctions = new ServerlessStepFunctions(serverless, options);
  });

  const validateCloudWatchEvent = (resources, logicalId, status, targetsCount) => {
    expect(resources).to.haveOwnProperty(logicalId);
    const event = resources[logicalId];
    expect(event.Type).to.equal('AWS::Events::Rule');
    expect(event.Properties.EventPattern.source).to.deep.equal(['aws.states']);
    expect(event.Properties.EventPattern.detail.status).to.deep.equal([status]);
    expect(event.Properties.Targets).to.have.lengthOf(targetsCount);

    for (const target of event.Properties.Targets) {
      const isStringOrFn = _.isString(target.Arn)
        || (target.Arn.Ref && _.isString(target.Arn.Ref))
        || (target.Arn['Fn::GetAtt'] && _.isArray(target.Arn['Fn::GetAtt']));

      expect(isStringOrFn).to.equal(true);
    }

    const sqsWithParam = event.Properties.Targets.find((t) => t.SqsParameters);
    expect(sqsWithParam).to.not.equal(undefined);
    const kinesisWithParam = event.Properties.Targets.find((t) => t.KinesisParameters);
    expect(kinesisWithParam).to.not.equal(undefined);
  };

  const validateHasPermission = (iamRole, action, resource) => {
    const policies = iamRole.Properties.Policies;
    const matchedPolicy = policies.find((policy) => {
      const statement = policy.PolicyDocument.Statement[0];
      return statement.Action === action && _.isEqual(statement.Resource, resource);
    });
    expect(matchedPolicy).to.not.equal(
      undefined,
      `IAM Role is expected to have policy for [${action}] on [${resource}]`,
    );
  };

  const validateHasSnsPolicy = (resources, topicArn) => {
    const snsPolicies = _.values(resources).filter((resource) => resource.Type === 'AWS::SNS::TopicPolicy');
    const matchedPolicy = snsPolicies.find((policy) => _.isEqual(
      policy.Properties.Topics[0],
      topicArn,
    ));
    expect(matchedPolicy).to.not.equal(
      undefined,
      `SNS topic policy is missing for [${topicArn}]`,
    );
  };

  const validateHasSqsPolicy = (resources, queueUrl) => {
    const sqsPolicies = _.values(resources).filter((resource) => resource.Type === 'AWS::SQS::QueuePolicy');
    const matchedPolicy = sqsPolicies.find((policy) => _.isEqual(
      policy.Properties.Queues[0],
      queueUrl,
    ));
    expect(matchedPolicy).to.not.equal(
      undefined,
      `SQS queue policy is missing for [${queueUrl}]`,
    );
  };

  const validateHasLambdaPermission = (resources, lambdaArn) => {
    const lambdaPolicies = _.values(resources).filter((resource) => resource.Type === 'AWS::Lambda::Permission');
    const matchedPolicy = lambdaPolicies.find((policy) => _.isEqual(
      policy.Properties.FunctionName,
      lambdaArn,
    ));
    expect(matchedPolicy).to.not.equal(
      undefined,
      `Lambda permission is missing for [${lambdaArn}]`,
    );
  };

  const genStateMachineWithTargets = (name, targets) => ({
    id: name,
    name,
    definition: {
      StartAt: 'A',
      States: {
        A: {
          Type: 'Pass',
          End: true,
        },
      },
    },
    notifications: {
      ABORTED: targets,
      FAILED: targets,
      RUNNING: targets,
      SUCCEEDED: targets,
      TIMED_OUT: targets,
    },
  });

  it('should generate CloudWatch Event Rules with string ARNs', () => {
    const targets = [
      { sns: 'SNS_TOPIC_ARN' },
      { sqs: 'SQS_QUEUE_ARN' },
      { sqs: 'arn:aws:sqs:#{AWS::Region}:#{AWS::AccountId}:MyQueue' },
      { sqs: { arn: 'SQS_QUEUE_NESTED_ARN', messageGroupId: '12345' } },
      { lambda: 'LAMBDA_FUNCTION_ARN' },
      { kinesis: 'KINESIS_STREAM_ARN' },
      { kinesis: { arn: 'KINESIS_STREAM_NESTED_ARN', partitionKeyPath: '$.id' } },
      { firehose: 'FIREHOSE_STREAM_ARN' },
      { stepFunctions: 'STATE_MACHINE_ARN' },
    ];

    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachineWithTargets('Beta1', targets),
        beta2: genStateMachineWithTargets('Beta2', targets),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const count = targets.length;
    const validateCloudWatchEvents = (prefix) => {
      validateCloudWatchEvent(resources, `${prefix}NotificationsABORTEDEventRule`, 'ABORTED', count);
      validateCloudWatchEvent(resources, `${prefix}NotificationsFAILEDEventRule`, 'FAILED', count);
      validateCloudWatchEvent(resources, `${prefix}NotificationsRUNNINGEventRule`, 'RUNNING', count);
      validateCloudWatchEvent(resources, `${prefix}NotificationsSUCCEEDEDEventRule`, 'SUCCEEDED', count);
      validateCloudWatchEvent(resources, `${prefix}NotificationsTIMEDOUTEventRule`, 'TIMED_OUT', count);
    };

    validateCloudWatchEvents('Beta1');
    validateCloudWatchEvents('Beta2');

    const validateIamRole = (iamRole) => {
      // 4 targets (excluding sns, sqs, lambda), 5 event rules = 5 * 4 = 20 policies
      expect(iamRole.Properties.Policies).to.have.lengthOf(20);
      validateHasPermission(iamRole, 'kinesis:PutRecord', 'KINESIS_STREAM_ARN');
      validateHasPermission(iamRole, 'kinesis:PutRecord', 'KINESIS_STREAM_NESTED_ARN');
      validateHasPermission(iamRole, 'firehose:PutRecord', 'FIREHOSE_STREAM_ARN');
      validateHasPermission(iamRole, 'states:StartExecution', 'STATE_MACHINE_ARN');
    };

    validateIamRole(resources.Beta1NotificationsIamRole);
    validateIamRole(resources.Beta2NotificationsIamRole);

    const toQueueUrl = (queueName) => ({
      'Fn::Sub': [
        'https://sqs.${AWS::Region}.amazonaws.com/${AWS::AccountId}/${QueueName}',
        { QueueName: queueName },
      ],
    });

    validateHasSnsPolicy(resources, 'SNS_TOPIC_ARN');
    validateHasSqsPolicy(resources, toQueueUrl('SQS_QUEUE_ARN'));
    validateHasSqsPolicy(resources, toQueueUrl('MyQueue'));
    validateHasSqsPolicy(resources, toQueueUrl('SQS_QUEUE_NESTED_ARN'));
    validateHasLambdaPermission(resources, 'LAMBDA_FUNCTION_ARN');

    expect(consoleLogSpy.callCount).equal(0);
  });

  it('should generate CloudWatch Event Rules with Ref ang Fn::GetAtt', () => {
    const snsArn = { Ref: 'MyTopic' };
    const sqsArn = { 'Fn::GetAtt': ['MyQueue', 'Arn'] };
    const sqsNestedArn = { 'Fn::GetAtt': ['MyNestedQueue', 'Arn'] };
    const lambdaArn = { 'Fn::GetAtt': ['MyFunction', 'Arn'] };
    const kinesisArn = { 'Fn::GetAtt': ['MyStream', 'Arn'] };
    const kinesisNestedArn = { 'Fn::GetAtt': ['MyNestedStream', 'Arn'] };
    const firehoseArn = { 'Fn::GetAtt': ['MyDeliveryStream', 'Arn'] };
    const stepFunctionsArn = { Ref: 'MyStateMachine' };
    const targets = [
      { sns: snsArn },
      { sqs: sqsArn },
      { sqs: { arn: sqsNestedArn, messageGroupId: '12345' } },
      { lambda: lambdaArn },
      { kinesis: kinesisArn },
      { kinesis: { arn: kinesisNestedArn, partitionKeyPath: '$.id' } },
      { firehose: firehoseArn },
      { stepFunctions: stepFunctionsArn },
    ];

    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachineWithTargets('Beta1', targets),
        beta2: genStateMachineWithTargets('Beta2', targets),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const count = targets.length;
    const validateCloudWatchEvents = (prefix) => {
      validateCloudWatchEvent(resources, `${prefix}NotificationsABORTEDEventRule`, 'ABORTED', count);
      validateCloudWatchEvent(resources, `${prefix}NotificationsFAILEDEventRule`, 'FAILED', count);
      validateCloudWatchEvent(resources, `${prefix}NotificationsRUNNINGEventRule`, 'RUNNING', count);
      validateCloudWatchEvent(resources, `${prefix}NotificationsSUCCEEDEDEventRule`, 'SUCCEEDED', count);
      validateCloudWatchEvent(resources, `${prefix}NotificationsTIMEDOUTEventRule`, 'TIMED_OUT', count);
    };

    validateCloudWatchEvents('Beta1');
    validateCloudWatchEvents('Beta2');

    const validateIamRole = (iamRole) => {
      // 4 targets (excluding sns, sqs, lambda), 5 event rules = 5 * 4 = 20 policies
      expect(iamRole.Properties.Policies).to.have.lengthOf(20);
      validateHasPermission(iamRole, 'kinesis:PutRecord', kinesisArn);
      validateHasPermission(iamRole, 'kinesis:PutRecord', kinesisNestedArn);
      validateHasPermission(iamRole, 'firehose:PutRecord', firehoseArn);
      validateHasPermission(iamRole, 'states:StartExecution', stepFunctionsArn);
    };

    validateIamRole(resources.Beta1NotificationsIamRole);
    validateIamRole(resources.Beta2NotificationsIamRole);

    validateHasSnsPolicy(resources, snsArn);
    validateHasSqsPolicy(resources, { Ref: 'MyQueue' });
    validateHasSqsPolicy(resources, { Ref: 'MyNestedQueue' });
    validateHasLambdaPermission(resources, lambdaArn);

    expect(consoleLogSpy.callCount).equal(0);
  });

  it('should do deterministic compilation of CloudWatch Event Rules', () => {
    const snsArn = { Ref: 'MyTopic' };
    const sqsArn = { 'Fn::GetAtt': ['MyQueue', 'Arn'] };
    const sqsNestedArn = { 'Fn::GetAtt': ['MyNestedQueue', 'Arn'] };
    const lambdaArn = { 'Fn::GetAtt': ['MyFunction', 'Arn'] };
    const kinesisArn = { 'Fn::GetAtt': ['MyStream', 'Arn'] };
    const kinesisNestedArn = { 'Fn::GetAtt': ['MyNestedStream', 'Arn'] };
    const firehoseArn = { 'Fn::GetAtt': ['MyDeliveryStream', 'Arn'] };
    const stepFunctionsArn = { Ref: 'MyStateMachine' };
    const targets = [
      { sns: snsArn },
      { sqs: sqsArn },
      { sqs: { arn: sqsNestedArn, messageGroupId: '12345' } },
      { lambda: lambdaArn },
      { kinesis: kinesisArn },
      { kinesis: { arn: kinesisNestedArn, partitionKeyPath: '$.id' } },
      { firehose: firehoseArn },
      { stepFunctions: stepFunctionsArn },
      { sns: 'SNS_TOPIC_ARN' },
      { sqs: 'SQS_QUEUE_ARN' },
      { sqs: 'arn:aws:sqs:#{AWS::Region}:#{AWS::AccountId}:MyQueue' },
      { sqs: { arn: 'SQS_QUEUE_NESTED_ARN', messageGroupId: '12345' } },
      { lambda: 'LAMBDA_FUNCTION_ARN' },
      { kinesis: 'KINESIS_STREAM_ARN' },
      { kinesis: { arn: 'KINESIS_STREAM_NESTED_ARN', partitionKeyPath: '$.id' } },
      { firehose: 'FIREHOSE_STREAM_ARN' },
      { stepFunctions: 'STATE_MACHINE_ARN' },
    ];

    const definition = {
      stateMachines: {
        beta1: genStateMachineWithTargets('Beta1', targets),
        beta2: genStateMachineWithTargets('Beta2', targets),
      },
    };

    serverless.service.stepFunctions = _.cloneDeep(definition);
    serverlessStepFunctions.compileNotifications();
    const resources1 = _.cloneDeep(serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources);

    serverless.service.stepFunctions = _.cloneDeep(definition);
    serverlessStepFunctions.compileNotifications();
    const resources2 = _.cloneDeep(serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources);

    expect(resources1).to.deep.equal(resources2);
  });

  it('should not generate resources when no notifications are defined', () => {
    const genStateMachine = (name) => ({
      name,
      definition: {
        StartAt: 'A',
        States: {
          A: {
            Type: 'Pass',
            End: true,
          },
        },
      },
    });

    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachine('Beta1'),
        beta2: genStateMachine('Beta2'),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;
    expect(_.keys(resources)).to.have.lengthOf(0);

    expect(consoleLogSpy.callCount).equal(0);
  });

  it('should not generate resources when notifications is empty', () => {
    const genStateMachine = (name) => ({
      name,
      definition: {
        StartAt: 'A',
        States: {
          A: {
            Type: 'Pass',
            End: true,
          },
        },
      },
      notifications: {},
    });

    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachine('Beta1'),
        beta2: genStateMachine('Beta2'),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;
    expect(_.keys(resources)).to.have.lengthOf(0);

    expect(consoleLogSpy.callCount).equal(0);
  });

  it('should not generate resources when targets are empty', () => {
    const genStateMachine = (name) => ({
      name,
      definition: {
        StartAt: 'A',
        States: {
          A: {
            Type: 'Pass',
            End: true,
          },
        },
      },
      notifications: {
        ABORTED: [],
        FAILED: [],
        RUNNING: [],
        SUCCEEDED: [],
        TIMED_OUT: [],
      },
    });

    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachine('Beta1'),
        beta2: genStateMachine('Beta2'),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;
    expect(_.keys(resources)).to.have.lengthOf(0);

    expect(consoleLogSpy.callCount).equal(0);
  });

  it('should log the validation errors if notifications contains non-existent status', () => {
    const targets = [
      { sns: 'SNS_TOPIC_ARN' },
    ];
    const genStateMachine = (name) => ({
      id: name,
      name,
      definition: {
        StartAt: 'A',
        States: {
          A: {
            Type: 'Pass',
            End: true,
          },
        },
      },
      notifications: {
        ABORTED: targets,
        FAILURE: targets, // wrong name
      },
    });

    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachine('Beta1'),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;
    expect(_.keys(resources)).to.have.lengthOf(0);

    expect(consoleLogSpy.callCount).equal(1);
    const { args } = consoleLogSpy.lastCall;
    const [logMessage] = args;
    expect(logMessage.startsWith('State machine [Beta1] : notifications config is malformed.'))
      .to.equal(true);
  });

  it('should log the validation errors if notifications contains non-existent target type', () => {
    const wrongTargets = [
      { sns: 'SNS_TOPIC_ARN' },
      { sqqs: 'SQS_QUEUE_ARN' },
    ];
    const genStateMachine = (name) => ({
      id: name,
      name,
      definition: {
        StartAt: 'A',
        States: {
          A: {
            Type: 'Pass',
            End: true,
          },
        },
      },
      notifications: {
        ABORTED: wrongTargets,
      },
    });

    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachine('Beta1'),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;
    expect(_.keys(resources)).to.have.lengthOf(0);

    expect(consoleLogSpy.callCount).equal(1);
    const { args } = consoleLogSpy.lastCall;
    const [logMessage] = args;
    expect(logMessage.startsWith('State machine [Beta1] : notifications config is malformed.'))
      .to.equal(true);
  });

  it('should log the validation errors if state machine is an Express Workflow', () => {
    const genStateMachine = (name) => ({
      name,
      type: 'EXPRESS',
      definition: {
        StartAt: 'A',
        States: {
          A: {
            Type: 'Pass',
            End: true,
          },
        },
      },
      notifications: {
        ABORTED: [{ sns: 'SNS_TOPIC_ARN' }],
      },
    });

    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachine('Beta1'),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;
    expect(_.keys(resources)).to.have.lengthOf(0);

    expect(consoleLogSpy.callCount).equal(1);
    const { args } = consoleLogSpy.lastCall;
    const [logMessage] = args;
    expect(logMessage.startsWith('State machine [Beta1] : notifications are not supported on Express Workflows.'))
      .to.equal(true);
  });

  it('should resolve local function names via Fn::GetAtt in notifications to CloudFormation logical IDs', () => {
    serverless.service.functions = {
      'send-email-on-failure': { handler: 'path/to/file.handler' },
    };

    const lambdaArn = { 'Fn::GetAtt': ['send-email-on-failure', 'Arn'] };
    const targets = [{ lambda: lambdaArn }];

    serverless.service.stepFunctions = {
      stateMachines: {
        myWorkflow: genStateMachineWithTargets('MyWorkflow', targets),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const expectedLogicalId = 'SendDashemailDashonDashfailureLambdaFunction';
    const expectedArn = { 'Fn::GetAtt': [expectedLogicalId, 'Arn'] };

    // The EventRule target Arn should use the normalized logical ID
    const eventRule = resources.MyWorkflowNotificationsFAILEDEventRule;
    expect(eventRule.Properties.Targets[0].Arn).to.deep.equal(expectedArn);

    // The Lambda permission should also use the normalized logical ID
    validateHasLambdaPermission(resources, expectedArn);
  });

  it('should resolve local function names via Ref in notifications to CloudFormation logical IDs', () => {
    serverless.service.functions = {
      'send-email-on-failure': { handler: 'path/to/file.handler' },
    };

    const lambdaRef = { Ref: 'send-email-on-failure' };
    const targets = [{ lambda: lambdaRef }];

    serverless.service.stepFunctions = {
      stateMachines: {
        myWorkflow: genStateMachineWithTargets('MyWorkflow', targets),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const expectedLogicalId = 'SendDashemailDashonDashfailureLambdaFunction';
    const expectedRef = { Ref: expectedLogicalId };

    const eventRule = resources.MyWorkflowNotificationsFAILEDEventRule;
    expect(eventRule.Properties.Targets[0].Arn).to.deep.equal(expectedRef);

    validateHasLambdaPermission(resources, expectedRef);
  });

  it('should support inputPath on notification targets', () => {
    const targets = [
      { sns: 'SNS_TOPIC_ARN', inputPath: '$.detail' },
      { sqs: 'SQS_QUEUE_ARN', inputPath: '$.detail' },
    ];

    serverless.service.stepFunctions = {
      stateMachines: {
        myWorkflow: genStateMachineWithTargets('MyWorkflow', targets),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const eventRule = resources.MyWorkflowNotificationsABORTEDEventRule;
    expect(eventRule.Properties.Targets[0].InputPath).to.equal('$.detail');
    expect(eventRule.Properties.Targets[1].InputPath).to.equal('$.detail');
  });

  it('should support inputTransformer on notification targets', () => {
    const targets = [
      {
        sns: 'SNS_TOPIC_ARN',
        inputTransformer: {
          inputPathsMap: { status: '$.detail.status', name: '$.detail.name' },
          inputTemplate: '"State machine <name> finished with status <status>"',
        },
      },
    ];

    serverless.service.stepFunctions = {
      stateMachines: {
        myWorkflow: genStateMachineWithTargets('MyWorkflow', targets),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const eventRule = resources.MyWorkflowNotificationsABORTEDEventRule;
    const cfnTarget = eventRule.Properties.Targets[0];
    expect(cfnTarget.InputTransformer).to.deep.equal({
      InputPathsMap: { status: '$.detail.status', name: '$.detail.name' },
      InputTemplate: '"State machine <name> finished with status <status>"',
    });
  });

  it('should apply provider.iam.role.path to notifications IAM role', () => {
    serverless.service.stepFunctions = {
      stateMachines: {
        beta1: genStateMachineWithTargets('Beta1', [{ stepFunctions: 'STATE_MACHINE_ARN' }]),
      },
    };
    serverless.service.provider.iam = { role: { path: '/teamA/' } };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    expect(resources.Beta1NotificationsIamRole.Properties.Path).to.equal('/teamA/');
  });

  it('should produce a single SNS topic policy when multiple state machines share the same topic', () => {
    // Reproduces issue #275: each state machine generates its own AWS::SNS::TopicPolicy
    // for the shared topic. CloudFormation applies them sequentially — the second
    // overwrites the first, leaving the first machine's notifications unauthorised.
    // The fix merges policies for the same topic into a single resource with combined
    // statements so CloudFormation only sets the policy once, correctly.
    serverless.service.stepFunctions = {
      stateMachines: {
        machine1: genStateMachineWithTargets('Machine1', [{ sns: 'arn:aws:sns:us-east-1:123:shared-topic' }]),
        machine2: genStateMachineWithTargets('Machine2', [{ sns: 'arn:aws:sns:us-east-1:123:shared-topic' }]),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const snsPolicies = _.values(resources).filter((r) => r.Type === 'AWS::SNS::TopicPolicy');
    const policiesForSharedTopic = snsPolicies.filter((p) => _.isEqual(
      p.Properties.Topics[0],
      'arn:aws:sns:us-east-1:123:shared-topic',
    ));

    expect(policiesForSharedTopic).to.have.lengthOf(1);

    // Both machines × 5 statuses = 10 statements in the merged policy
    const statements = [].concat(policiesForSharedTopic[0].Properties.PolicyDocument.Statement);
    expect(statements.length).to.equal(10);
  });

  it('should produce a single SQS queue policy when multiple state machines share the same queue', () => {
    serverless.service.stepFunctions = {
      stateMachines: {
        machine1: genStateMachineWithTargets('Machine1', [{ sqs: 'arn:aws:sqs:us-east-1:123:shared-queue' }]),
        machine2: genStateMachineWithTargets('Machine2', [{ sqs: 'arn:aws:sqs:us-east-1:123:shared-queue' }]),
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const sqsPolicies = _.values(resources).filter((r) => r.Type === 'AWS::SQS::QueuePolicy');
    expect(sqsPolicies).to.have.lengthOf(1);

    const statements = [].concat(sqsPolicies[0].Properties.PolicyDocument.Statement);
    expect(statements.length).to.equal(10);
  });

  it('should merge SNS policies when same topic is used for multiple statuses in one state machine', () => {
    serverless.service.stepFunctions = {
      stateMachines: {
        machine1: {
          id: 'Machine1',
          name: 'Machine1',
          definition: { StartAt: 'A', States: { A: { Type: 'Pass', End: true } } },
          notifications: {
            SUCCEEDED: [{ sns: 'arn:aws:sns:us-east-1:123:shared-topic' }],
            FAILED: [{ sns: 'arn:aws:sns:us-east-1:123:shared-topic' }],
          },
        },
      },
    };

    serverlessStepFunctions.compileNotifications();
    const resources = serverlessStepFunctions.serverless.service
      .provider.compiledCloudFormationTemplate.Resources;

    const snsPolicies = _.values(resources).filter((r) => r.Type === 'AWS::SNS::TopicPolicy');
    expect(snsPolicies).to.have.lengthOf(1);

    const statements = [].concat(snsPolicies[0].Properties.PolicyDocument.Statement);
    expect(statements.length).to.equal(2);
  });
});