@ampless/backend 1.0.0-alpha.48 → 1.0.0-alpha.49

package/dist/index.js

@@ -434,20 +434,25 @@ function amplessSchemaModels(a, opts = {}) {
     // never flows back to the browser.
     //
     // Authorization design:
-    //   - admin / editor: NO direct AppSync access. All writes go
-    //     through the plugin-secret-handler Lambda mutation.
-    //   - `allow.resource(pluginSecretHandlerFunction)`: grants the
-    //     plugin-secret-handler Lambda AppSync access to this model
-    //     (used internally by the mutation's resolver path).
-    //   - trusted-processor Lambda reads directly via DDB SDK with the
-    //     `grantReadData` IAM grant in `backend.ts`, bypassing AppSync
-    //     entirely — no `@auth` rule needed for that path.
-    //   - Fallback (when `pluginSecretHandlerFunction` is not provided
-    //     by the caller): admin-only Cognito group. Encryption renders
-    //     ciphertext meaningless without the env-var key, but the
-    //     feature won't actually work without the handler — this
-    //     fallback only exists to keep CDK synth from failing in a
-    //     partially-wired deployment.
+    //   - admin / editor: NO AppSync access. The model uses a
+    //     placeholder group (`__ampless_internal__`) that no Cognito
+    //     user belongs to. Amplify Gen 2 requires every model to have
+    //     at least one auth rule, and this is the minimum-viable one
+    //     that synthesizes cleanly while denying all AppSync access.
+    //   - plugin-secret-handler Lambda: full DDB access via the
+    //     `grantReadWriteData` IAM grant in `backend.ts`. It calls
+    //     the DDB SDK directly (NOT through AppSync), so the model's
+    //     @auth rule is irrelevant to its actual write path.
+    //   - trusted-processor Lambda: read-only DDB access via the
+    //     `grantReadData` IAM grant in `backend.ts`. Same pattern —
+    //     bypasses AppSync entirely.
+    //   - Lambda `allow.resource(...)` is unavailable at the model
+    //     level in `@aws-amplify/data-schema` (the `resource` helper
+    //     is destructured out of `allow` before model-level callbacks
+    //     run; see line 141 in this file). Schema-level resource auth
+    //     would grant the Lambda AppSync access to ALL models — too
+    //     broad for our needs. The DDB-SDK direct path keeps the
+    //     access scoped to the table the Lambda needs.
     //
     // Storage key convention:
     //   siteId = 'default'   (single-site architecture)
@@ -475,17 +480,12 @@ function amplessSchemaModels(a, opts = {}) {
       // / deploy artifact access, NOT defeated for a malicious
       // trusted plugin co-located in the same Lambda.
       value: a.string().required()
-    }).identifier(["siteId", "sk"]).authorization((allow) => {
-      const rules = [];
-      if (opts.pluginSecretHandlerFunction) {
-        rules.push(
-          allow.resource(opts.pluginSecretHandlerFunction).to(["read", "create", "update", "delete"])
-        );
-      } else {
-        rules.push(allow.groups(["ampless-admin"]));
-      }
-      return rules;
-    }),
+    }).identifier(["siteId", "sk"]).authorization((allow) => [
+      // Deny-all-via-AppSync sentinel. See the comment above this
+      // model for why this is a non-existent group name and how the
+      // real Lambda access path works (DDB SDK + IAM grants).
+      allow.groups(["__ampless_internal__"])
+    ]),
     // Existence-only indicator for PluginSecret rows.
     //
     // Admin/editor Cognito users cannot read from PluginSecret at all
@@ -508,22 +508,16 @@ function amplessSchemaModels(a, opts = {}) {
       // ISO 8601 datetime string — set by plugin-secret-handler on
       // every write. Admin UI may show this as "last updated" hint.
       lastSetAt: a.datetime().required()
-    }).identifier(["siteId", "sk"]).authorization((allow) => {
-      const rules = [
-        // Admin/editor have AppSync read for `hasPluginSecret` and
-        // direct write+delete as a fallback path (the Lambda is the
-        // normal write path, but allowing admin write here keeps the
-        // indicator and ciphertext aligned if a clear operation is
-        // retried after a partial failure).
-        allow.groups(["ampless-admin", "ampless-editor"])
-      ];
-      if (opts.pluginSecretHandlerFunction) {
-        rules.push(
-          allow.resource(opts.pluginSecretHandlerFunction).to(["read", "create", "update", "delete"])
-        );
-      }
-      return rules;
-    }),
+    }).identifier(["siteId", "sk"]).authorization((allow) => [
+      // Admin/editor have AppSync read for `hasPluginSecret` and
+      // direct write+delete as a recovery path. The Lambda is the
+      // normal write path (it calls the DDB SDK directly with IAM,
+      // not through AppSync — same pattern as PluginSecret above),
+      // but allowing admin write here lets a clear-retry after a
+      // partial dual-write failure heal the inconsistency from the
+      // admin side without redeploying.
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
     // Custom return type for public post reads. Decoupling from `Post` lets
     // AppSync skip the model-level (admin-only) auth check on fields.
     //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.48",
+  "version": "1.0.0-alpha.49",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",