@ampless/backend 1.0.0-alpha.47 → 1.0.0-alpha.48

package/dist/index.js

@@ -436,9 +436,18 @@ function amplessSchemaModels(a, opts = {}) {
     // Authorization design:
     //   - admin / editor: NO direct AppSync access. All writes go
     //     through the plugin-secret-handler Lambda mutation.
-    //   - IAM (Lambda): full read+write. Both the plugin-secret-handler
-    //     (writes ciphertext) and the trusted-processor (reads +
-    //     decrypts) use IAM-signed DDB SDK calls.
+    //   - `allow.resource(pluginSecretHandlerFunction)`: grants the
+    //     plugin-secret-handler Lambda AppSync access to this model
+    //     (used internally by the mutation's resolver path).
+    //   - trusted-processor Lambda reads directly via DDB SDK with the
+    //     `grantReadData` IAM grant in `backend.ts`, bypassing AppSync
+    //     entirely — no `@auth` rule needed for that path.
+    //   - Fallback (when `pluginSecretHandlerFunction` is not provided
+    //     by the caller): admin-only Cognito group. Encryption renders
+    //     ciphertext meaningless without the env-var key, but the
+    //     feature won't actually work without the handler — this
+    //     fallback only exists to keep CDK synth from failing in a
+    //     partially-wired deployment.
     //
     // Storage key convention:
     //   siteId = 'default'   (single-site architecture)
@@ -466,13 +475,17 @@ function amplessSchemaModels(a, opts = {}) {
       // / deploy artifact access, NOT defeated for a malicious
       // trusted plugin co-located in the same Lambda.
       value: a.string().required()
-    }).identifier(["siteId", "sk"]).authorization((allow) => [
-      // IAM only — no Cognito group has any AppSync access.
-      // plugin-secret-handler Lambda writes (PutItem / DeleteItem).
-      // trusted-processor Lambda reads (GetItem, read-only grant
-      // in backend.ts via grantReadData).
-      allow.authenticated("iam").to(["read", "create", "update", "delete"])
-    ]),
+    }).identifier(["siteId", "sk"]).authorization((allow) => {
+      const rules = [];
+      if (opts.pluginSecretHandlerFunction) {
+        rules.push(
+          allow.resource(opts.pluginSecretHandlerFunction).to(["read", "create", "update", "delete"])
+        );
+      } else {
+        rules.push(allow.groups(["ampless-admin"]));
+      }
+      return rules;
+    }),
     // Existence-only indicator for PluginSecret rows.
     //
     // Admin/editor Cognito users cannot read from PluginSecret at all
@@ -495,12 +508,22 @@ function amplessSchemaModels(a, opts = {}) {
       // ISO 8601 datetime string — set by plugin-secret-handler on
       // every write. Admin UI may show this as "last updated" hint.
       lastSetAt: a.datetime().required()
-    }).identifier(["siteId", "sk"]).authorization((allow) => [
-      // Admin/editor can read and write (write needed for clear).
-      allow.groups(["ampless-admin", "ampless-editor"]),
-      // plugin-secret-handler Lambda also writes via IAM.
-      allow.authenticated("iam").to(["read", "create", "update", "delete"])
-    ]),
+    }).identifier(["siteId", "sk"]).authorization((allow) => {
+      const rules = [
+        // Admin/editor have AppSync read for `hasPluginSecret` and
+        // direct write+delete as a fallback path (the Lambda is the
+        // normal write path, but allowing admin write here keeps the
+        // indicator and ciphertext aligned if a clear operation is
+        // retried after a partial failure).
+        allow.groups(["ampless-admin", "ampless-editor"])
+      ];
+      if (opts.pluginSecretHandlerFunction) {
+        rules.push(
+          allow.resource(opts.pluginSecretHandlerFunction).to(["read", "create", "update", "delete"])
+        );
+      }
+      return rules;
+    }),
     // Custom return type for public post reads. Decoupling from `Post` lets
     // AppSync skip the model-level (admin-only) auth check on fields.
     //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.47",
+  "version": "1.0.0-alpha.48",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",