@ampless/backend 1.0.0-alpha.48 → 1.0.0-alpha.50

package/dist/events/processor-trusted.js

@@ -192,7 +192,7 @@ function createProcessorTrustedHandler(opts) {
           const result = await rawDdb.send(
             new GetItemCommand({
               TableName: PLUGIN_SECRET_TABLE,
-              Key: marshall({ siteId: "default", sk })
+              Key: marshall({ sk })
             })
           );
           if (!result.Item) {

package/dist/functions/plugin-secret-handler.js

@@ -74,13 +74,13 @@ async function handleSet(args) {
   await ddb.send(
     new PutItemCommand({
       TableName: secretTable,
-      Item: marshall({ siteId: "default", sk, value: ciphertext })
+      Item: marshall({ sk, value: ciphertext })
     })
   );
   await ddb.send(
     new PutItemCommand({
       TableName: indicatorTable,
-      Item: marshall({ siteId: "default", sk, lastSetAt: now })
+      Item: marshall({ sk, lastSetAt: now })
     })
   );
   return "ok";
@@ -99,13 +99,13 @@ async function handleClear(args) {
   await ddb.send(
     new DeleteItemCommand({
       TableName: secretTable,
-      Key: marshall({ siteId: "default", sk })
+      Key: marshall({ sk })
     })
   );
   await ddb.send(
     new DeleteItemCommand({
       TableName: indicatorTable,
-      Key: marshall({ siteId: "default", sk })
+      Key: marshall({ sk })
     })
   );
   return "ok";

package/dist/index.js

@@ -434,33 +434,40 @@ function amplessSchemaModels(a, opts = {}) {
     // never flows back to the browser.
     //
     // Authorization design:
-    //   - admin / editor: NO direct AppSync access. All writes go
-    //     through the plugin-secret-handler Lambda mutation.
-    //   - `allow.resource(pluginSecretHandlerFunction)`: grants the
-    //     plugin-secret-handler Lambda AppSync access to this model
-    //     (used internally by the mutation's resolver path).
-    //   - trusted-processor Lambda reads directly via DDB SDK with the
-    //     `grantReadData` IAM grant in `backend.ts`, bypassing AppSync
-    //     entirely — no `@auth` rule needed for that path.
-    //   - Fallback (when `pluginSecretHandlerFunction` is not provided
-    //     by the caller): admin-only Cognito group. Encryption renders
-    //     ciphertext meaningless without the env-var key, but the
-    //     feature won't actually work without the handler — this
-    //     fallback only exists to keep CDK synth from failing in a
-    //     partially-wired deployment.
+    //   - admin / editor: NO AppSync access. The model uses a
+    //     placeholder group (`__ampless_internal__`) that no Cognito
+    //     user belongs to. Amplify Gen 2 requires every model to have
+    //     at least one auth rule, and this is the minimum-viable one
+    //     that synthesizes cleanly while denying all AppSync access.
+    //   - plugin-secret-handler Lambda: full DDB access via the
+    //     `grantReadWriteData` IAM grant in `backend.ts`. It calls
+    //     the DDB SDK directly (NOT through AppSync), so the model's
+    //     @auth rule is irrelevant to its actual write path.
+    //   - trusted-processor Lambda: read-only DDB access via the
+    //     `grantReadData` IAM grant in `backend.ts`. Same pattern —
+    //     bypasses AppSync entirely.
+    //   - Lambda `allow.resource(...)` is unavailable at the model
+    //     level in `@aws-amplify/data-schema` (the `resource` helper
+    //     is destructured out of `allow` before model-level callbacks
+    //     run; see line 141 in this file). Schema-level resource auth
+    //     would grant the Lambda AppSync access to ALL models — too
+    //     broad for our needs. The DDB-SDK direct path keeps the
+    //     access scoped to the table the Lambda needs.
     //
     // Storage key convention:
-    //   siteId = 'default'   (single-site architecture)
     //   sk = `plugins.${instanceId ?? name}.${fieldKey}`
     //
+    // Single-site architecture: no `siteId` partition column. The same
+    // single-table convention as KvStore / Post / Page / Media after
+    // the `remove-siteid-from-schema` migration.
+    //
     // DynamoDB auto-encrypts at rest (AWS-managed KMS key). Secrets
     // never flow to the S3 site-settings mirror because the trusted
     // processor only queries KvStore (pk='siteconfig') for that path —
     // PluginSecret is a structurally separate table.
     PluginSecret: a.model({
-      // Single-site architecture: siteId is always 'default'.
-      siteId: a.string().required(),
-      // Composite sort key: `plugins.<instanceId>.<fieldKey>`
+      // Sort key (also the partition key — single-id identifier):
+      // `plugins.<instanceId>.<fieldKey>`
       sk: a.string().required(),
       // The secret value stored as AES-256-GCM ciphertext (base64).
       // Format: base64( IV[12] || ciphertext || authTag[16] ).
@@ -475,17 +482,12 @@ function amplessSchemaModels(a, opts = {}) {
       // / deploy artifact access, NOT defeated for a malicious
       // trusted plugin co-located in the same Lambda.
       value: a.string().required()
-    }).identifier(["siteId", "sk"]).authorization((allow) => {
-      const rules = [];
-      if (opts.pluginSecretHandlerFunction) {
-        rules.push(
-          allow.resource(opts.pluginSecretHandlerFunction).to(["read", "create", "update", "delete"])
-        );
-      } else {
-        rules.push(allow.groups(["ampless-admin"]));
-      }
-      return rules;
-    }),
+    }).identifier(["sk"]).authorization((allow) => [
+      // Deny-all-via-AppSync sentinel. See the comment above this
+      // model for why this is a non-existent group name and how the
+      // real Lambda access path works (DDB SDK + IAM grants).
+      allow.groups(["__ampless_internal__"])
+    ]),
     // Existence-only indicator for PluginSecret rows.
     //
     // Admin/editor Cognito users cannot read from PluginSecret at all
@@ -501,29 +503,22 @@ function amplessSchemaModels(a, opts = {}) {
     // row is at most stale-indicator-but-no-secret, which degrades
     // gracefully as a false "stored" indicator in the UI).
     PluginSecretIndicator: a.model({
-      siteId: a.string().required(),
       // Same sort-key format as PluginSecret:
       //   `plugins.${instanceId ?? name}.${fieldKey}`
       sk: a.string().required(),
       // ISO 8601 datetime string — set by plugin-secret-handler on
       // every write. Admin UI may show this as "last updated" hint.
       lastSetAt: a.datetime().required()
-    }).identifier(["siteId", "sk"]).authorization((allow) => {
-      const rules = [
-        // Admin/editor have AppSync read for `hasPluginSecret` and
-        // direct write+delete as a fallback path (the Lambda is the
-        // normal write path, but allowing admin write here keeps the
-        // indicator and ciphertext aligned if a clear operation is
-        // retried after a partial failure).
-        allow.groups(["ampless-admin", "ampless-editor"])
-      ];
-      if (opts.pluginSecretHandlerFunction) {
-        rules.push(
-          allow.resource(opts.pluginSecretHandlerFunction).to(["read", "create", "update", "delete"])
-        );
-      }
-      return rules;
-    }),
+    }).identifier(["sk"]).authorization((allow) => [
+      // Admin/editor have AppSync read for `hasPluginSecret` and
+      // direct write+delete as a recovery path. The Lambda is the
+      // normal write path (it calls the DDB SDK directly with IAM,
+      // not through AppSync — same pattern as PluginSecret above),
+      // but allowing admin write here lets a clear-retry after a
+      // partial dual-write failure heal the inconsistency from the
+      // admin side without redeploying.
+      allow.groups(["ampless-admin", "ampless-editor"])
+    ]),
     // Custom return type for public post reads. Decoupling from `Post` lets
     // AppSync skip the model-level (admin-only) auth check on fields.
     //

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.48",
+  "version": "1.0.0-alpha.50",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",