@ampless/backend 1.0.0-alpha.47 → 1.0.0-alpha.49

package/dist/index.js

@@ -434,11 +434,25 @@ function amplessSchemaModels(a, opts = {}) {
     // never flows back to the browser.
     //
     // Authorization design:
-    //   - admin / editor: NO direct AppSync access. All writes go
-    //     through the plugin-secret-handler Lambda mutation.
-    //   - IAM (Lambda): full read+write. Both the plugin-secret-handler
-    //     (writes ciphertext) and the trusted-processor (reads +
-    //     decrypts) use IAM-signed DDB SDK calls.
+    //   - admin / editor: NO AppSync access. The model uses a
+    //     placeholder group (`__ampless_internal__`) that no Cognito
+    //     user belongs to. Amplify Gen 2 requires every model to have
+    //     at least one auth rule, and this is the minimum-viable one
+    //     that synthesizes cleanly while denying all AppSync access.
+    //   - plugin-secret-handler Lambda: full DDB access via the
+    //     `grantReadWriteData` IAM grant in `backend.ts`. It calls
+    //     the DDB SDK directly (NOT through AppSync), so the model's
+    //     @auth rule is irrelevant to its actual write path.
+    //   - trusted-processor Lambda: read-only DDB access via the
+    //     `grantReadData` IAM grant in `backend.ts`. Same pattern —
+    //     bypasses AppSync entirely.
+    //   - Lambda `allow.resource(...)` is unavailable at the model
+    //     level in `@aws-amplify/data-schema` (the `resource` helper
+    //     is destructured out of `allow` before model-level callbacks
+    //     run; see line 141 in this file). Schema-level resource auth
+    //     would grant the Lambda AppSync access to ALL models — too
+    //     broad for our needs. The DDB-SDK direct path keeps the
+    //     access scoped to the table the Lambda needs.
     //
     // Storage key convention:
     //   siteId = 'default'   (single-site architecture)
@@ -467,11 +481,10 @@ function amplessSchemaModels(a, opts = {}) {
       // trusted plugin co-located in the same Lambda.
       value: a.string().required()
     }).identifier(["siteId", "sk"]).authorization((allow) => [
-      // IAM only — no Cognito group has any AppSync access.
-      // plugin-secret-handler Lambda writes (PutItem / DeleteItem).
-      // trusted-processor Lambda reads (GetItem, read-only grant
-      // in backend.ts via grantReadData).
-      allow.authenticated("iam").to(["read", "create", "update", "delete"])
+      // Deny-all-via-AppSync sentinel. See the comment above this
+      // model for why this is a non-existent group name and how the
+      // real Lambda access path works (DDB SDK + IAM grants).
+      allow.groups(["__ampless_internal__"])
     ]),
     // Existence-only indicator for PluginSecret rows.
     //
@@ -496,10 +509,14 @@ function amplessSchemaModels(a, opts = {}) {
       // every write. Admin UI may show this as "last updated" hint.
       lastSetAt: a.datetime().required()
     }).identifier(["siteId", "sk"]).authorization((allow) => [
-      // Admin/editor can read and write (write needed for clear).
-      allow.groups(["ampless-admin", "ampless-editor"]),
-      // plugin-secret-handler Lambda also writes via IAM.
-      allow.authenticated("iam").to(["read", "create", "update", "delete"])
+      // Admin/editor have AppSync read for `hasPluginSecret` and
+      // direct write+delete as a recovery path. The Lambda is the
+      // normal write path (it calls the DDB SDK directly with IAM,
+      // not through AppSync — same pattern as PluginSecret above),
+      // but allowing admin write here lets a clear-retry after a
+      // partial dual-write failure heal the inconsistency from the
+      // admin side without redeploying.
+      allow.groups(["ampless-admin", "ampless-editor"])
     ]),
     // Custom return type for public post reads. Decoupling from `Post` lets
     // AppSync skip the model-level (admin-only) auth check on fields.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.47",
+  "version": "1.0.0-alpha.49",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",