[ShussMiao]

Issue number: closes #8704

Summary

Changes

AppSyncEventBase.identity documented OPENID_CONNECT as returning None. It cannot: get_identity_object returns None only when the identity mapping itself is None, and an OIDC identity always carries sub, so it resolves to AppSyncIdentityCognito — the class that already exposes the OIDC fields (claims, issuer, groups, default_auth_strategy).

The existing suite already relied on this: test_appsync_resolver_event.py:48 asserts isinstance(parsed_event.identity, AppSyncIdentityCognito) for appSyncResolverEvent.json, whose identity is OIDC-shaped. The docstring was the outlier, and carried a NEED TO TEST note.

• Corrects the OPENID_CONNECT line and removes its NEED TO TEST note.
• Fixes the typo in the line above (type of identify found → type of identity found).
• Adds two tests that pin the dispatch: OIDC identity → AppSyncIdentityCognito with its fields reachable, and "only a None identity maps to None".
• Leaves AWS_LAMBDA explicitly marked unverified rather than guessing, since its mapping is whatever the authorizer returns and there is no fixture for it.

User experience

No behavioural change — the docstring now matches what already happens, so anyone reading identity to decide which class to expect for an OIDC-authorized API no longer gets told it will be None.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[leandrodamascena]

Thanks @ShussMiao, that's exactly what I asked for in the issue, and the two tests pin the dispatch so the docstring can't drift again. The AWS_LAMBDA case you left open is real: that identity lands on AppSyncIdentityIAM today and shouldn't. I opened #8718 for it.

I'm approving now. This goes out in 3.40.0, so it will sit here for a while before I merge it. No rebase needed in the meantime, and you'll be credited in the release notes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.00%. Comparing base (523504d) to head (0aefa91).
⚠️ Report is 3 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #8705      +/-   ##
===========================================
+ Coverage    96.99%   97.00%   +0.01%     
===========================================
  Files          321      321              
  Lines        16332    16415      +83     
  Branches      1473     1482       +9     
===========================================
+ Hits         15841    15924      +83     
  Misses         350      350              
  Partials       141      141              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.