@ampless/backend 1.0.0-alpha.55 → 1.0.0-alpha.57

package/dist/events/processor-trusted.js

@@ -73,6 +73,9 @@ function safeParse(s) {
   }
 }
 function createProcessorTrustedHandler(opts) {
+  const privilegedHookedPlugins = (opts.plugins ?? []).filter(
+    (p) => typeof p === "object" && p.trust_level === "privileged" && !!p.hooks && Object.keys(p.hooks).length > 0
+  );
   const trustedPlugins = (opts.plugins ?? []).filter(
     (p) => typeof p === "object" && p.trust_level === "trusted"
   ).filter((p) => {
@@ -323,6 +326,13 @@ function createProcessorTrustedHandler(opts) {
           throw err;
         }
       }
+      for (const plugin of privilegedHookedPlugins) {
+        if (plugin.hooks?.[parsed.type]) {
+          console.warn(
+            `[trusted-processor] privileged plugin "${plugin.name}" declares ${parsed.type} hook but no privileged Lambda is provisioned yet \u2014 hook will not execute. See docs/architecture/08-plugin-architecture.md.`
+          );
+        }
+      }
       for (const plugin of trustedPlugins) {
         const hook = plugin.hooks?.[parsed.type];
         if (!hook) continue;

package/dist/events/processor-untrusted.js

@@ -3,6 +3,9 @@ function createProcessorUntrustedHandler(opts) {
   const untrustedPlugins = (opts.plugins ?? []).filter(
     (p) => typeof p === "object" && p.trust_level === "untrusted"
   );
+  const privilegedHookedPlugins = (opts.plugins ?? []).filter(
+    (p) => typeof p === "object" && p.trust_level === "privileged" && !!p.hooks && Object.keys(p.hooks).length > 0
+  );
   function makeContext() {
     return {
       site: opts.site,
@@ -15,7 +18,7 @@ function createProcessorUntrustedHandler(opts) {
     };
   }
   return async (event) => {
-    if (untrustedPlugins.length === 0) return;
+    if (untrustedPlugins.length === 0 && privilegedHookedPlugins.length === 0) return;
     for (const record of event.Records) {
       let parsed;
       try {
@@ -24,6 +27,13 @@ function createProcessorUntrustedHandler(opts) {
         console.error("[untrusted-processor] bad message", record.body, err);
         continue;
       }
+      for (const plugin of privilegedHookedPlugins) {
+        if (plugin.hooks?.[parsed.type]) {
+          console.warn(
+            `[untrusted-processor] privileged plugin "${plugin.name}" declares ${parsed.type} hook but no privileged Lambda is provisioned yet \u2014 hook will not execute. See docs/architecture/08-plugin-architecture.md.`
+          );
+        }
+      }
       for (const plugin of untrustedPlugins) {
         const hook = plugin.hooks?.[parsed.type];
         if (!hook) continue;

package/dist/index.js

@@ -61,7 +61,7 @@ function defineAmplessBackend(opts) {
     new PolicyStatement({
       effect: Effect.ALLOW,
       actions: ["cognito-idp:AdminAddUserToGroup", "cognito-idp:ListUsersInGroup"],
-      resources: [backend.auth.resources.userPool.userPoolArn]
+      resources: ["arn:aws:cognito-idp:*:*:userpool/*"]
     })
   );
   backend.userAdmin.resources.lambda.addToRolePolicy(
@@ -73,7 +73,7 @@ function defineAmplessBackend(opts) {
         "cognito-idp:AdminAddUserToGroup",
         "cognito-idp:AdminRemoveUserFromGroup"
       ],
-      resources: [backend.auth.resources.userPool.userPoolArn]
+      resources: ["arn:aws:cognito-idp:*:*:userpool/*"]
     })
   );
   backend.userAdmin.resources.lambda.addEnvironment(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ampless/backend",
-  "version": "1.0.0-alpha.55",
+  "version": "1.0.0-alpha.57",
   "description": "Amplify Gen 2 backend factories for ampless: auth, data, storage, event processors, API key renewer",
   "license": "MIT",
   "type": "module",
@@ -69,8 +69,8 @@
     "@smithy/protocol-http": "^5.4.4",
     "@smithy/signature-v4": "^5.4.4",
     "fflate": "^0.8.3",
-    "@ampless/mcp-server": "1.0.0-alpha.40",
-    "ampless": "1.0.0-alpha.34"
+    "@ampless/mcp-server": "1.0.0-alpha.41",
+    "ampless": "1.0.0-alpha.35"
   },
   "peerDependencies": {
     "@aws-amplify/backend": "^1",