@reventlessdev/rescript-pulumi-aws 2.4.0-alpha.69 → 2.4.0-alpha.71

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 2.4.0-alpha.71 (2026-08-12)
+
+### Features
+
+* **queries:** narrow owner-bearing reads to the caller ([ba9cc3d](https://github.com/ReventlessDev/reventless-core/commit/ba9cc3d58d7914a9e4827bda90a704a74b1b82dd))
+
+
+# 2.4.0-alpha.70 (2026-08-11)
+
+**Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws
+
+
+
+
+
 # 2.4.0-alpha.69 (2026-08-09)
 
 **Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "2.4.0-alpha.69",
+  "version": "2.4.0-alpha.71",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {
@@ -22,8 +22,8 @@
     "@pulumi/aws": "~7.19.0",
     "@pulumi/aws-native": "^1.62.0",
     "sury": "11.0.0-alpha.4",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.6",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.7"
   },
   "devDependencies": {
     "esbuild": "^0.25.12",

package/src/AppSync/AppSync_Resolver_Functions.res

@@ -438,6 +438,15 @@ let listAllItemsConnection = (
   // rows would otherwise resolve `name`/`status`/`version` to null and violate the
   // non-null GraphQL connection schema, nulling the whole connection.
   ~requireAttribute: option<string>=?,
+  // The state's `@owner` field, when it declares one, plus the groups exempt from
+  // scoping. Baked into the generated source because this resolver runs inside
+  // AppSync with no Lambda in the path — there is nothing here that could read a
+  // configuration value at request time, so the deploy is the only chance to
+  // state it. Changing the elevated-group list therefore requires a redeploy,
+  // which is worth knowing and is why it is a deployment-level setting rather
+  // than a per-request one.
+  ~ownerField: option<string>=?,
+  ~elevatedGroups: array<string>=[],
 ) => {
   let requireAttributeClause = switch requireAttribute {
   | Some(attr) => `
@@ -445,6 +454,32 @@ let listAllItemsConnection = (
   parts.push('attribute_exists(#${attr})');`
   | None => ""
   }
+  // Mirrors `Reventless.OwnerScope.resolve`, in the one place that cannot call
+  // it. The branch ORDER is the part that has to match: provider first, because
+  // an IAM-signed service caller has no `sub` for a reason that has nothing to do
+  // with being anonymous, and must not be refused as though it did.
+  let ownerClause = switch ownerField {
+  | None => ""
+  | Some(field) =>
+    let elevatedLiteral = elevatedGroups->Array.map(g => `'${g}'`)->Array.join(", ")
+    `
+  // ── owner scoping (generated) ──
+  // Not read from ctx.args: a predicate deciding what the caller may see must
+  // arrive on a channel the caller cannot name, and this field is usually absent
+  // from the filter surface anyway.
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [${elevatedLiteral}];
+  // No identity at all, or an identity with no \`sub\`, is the IAM service caller
+  // the API also accepts — inside the trust boundary, and exempt.
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  if (!_exempt) {
+    names['#owner'] = '${field}';
+    values[':owner'] = util.dynamodb.toDynamoDB(_sub);
+    parts.push('#owner = :owner');
+  }`
+  }
   let filterClauses =
     filterFields
     ->Array.map(f => `
@@ -534,7 +569,7 @@ export function request(ctx) {
       return key;
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
-  }${filterClauses}${rangeClauses}${requireAttributeClause}
+  }${filterClauses}${rangeClauses}${requireAttributeClause}${ownerClause}
   // The cursor is base64(JSON({ token, index })); decode the after arg back to the raw
   // DynamoDB continuation token the response side emitted (Fix 1 round-trip).
   let after = null;

package/src/AppSync/AppSync_Resolver_Functions.res.mjs

@@ -360,13 +360,37 @@ export function request(ctx) {
 ` + resultResponseCode + `
 `;
 
-function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sortFieldsOpt, requireAttribute) {
+function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sortFieldsOpt, requireAttribute, ownerField, elevatedGroupsOpt) {
   let filterFields = filterFieldsOpt !== undefined ? filterFieldsOpt : [];
   let rangeFields = rangeFieldsOpt !== undefined ? rangeFieldsOpt : [];
   let sortFields = sortFieldsOpt !== undefined ? sortFieldsOpt : [];
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
   let requireAttributeClause = requireAttribute !== undefined ? `
   names['#` + requireAttribute + `'] = '` + requireAttribute + `';
   parts.push('attribute_exists(#` + requireAttribute + `)');` : "";
+  let ownerClause;
+  if (ownerField !== undefined) {
+    let elevatedLiteral = elevatedGroups.map(g => `'` + g + `'`).join(", ");
+    ownerClause = `
+  // ── owner scoping (generated) ──
+  // Not read from ctx.args: a predicate deciding what the caller may see must
+  // arrive on a channel the caller cannot name, and this field is usually absent
+  // from the filter surface anyway.
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [` + elevatedLiteral + `];
+  // No identity at all, or an identity with no \`sub\`, is the IAM service caller
+  // the API also accepts — inside the trust boundary, and exempt.
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  if (!_exempt) {
+    names['#owner'] = '` + ownerField + `';
+    values[':owner'] = util.dynamodb.toDynamoDB(_sub);
+    parts.push('#owner = :owner');
+  }`;
+  } else {
+    ownerClause = "";
+  }
   let filterClauses = filterFields.map(f => `
   if (filter.` + f + `Eq !== undefined && filter.` + f + `Eq !== null && filter.` + f + `Eq !== '') {
     names['#` + f + `'] = '` + f + `';
@@ -436,7 +460,7 @@ export function request(ctx) {
       return key;
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
-  }` + filterClauses + rangeClauses + requireAttributeClause + `
+  }` + filterClauses + rangeClauses + requireAttributeClause + ownerClause + `
   // The cursor is base64(JSON({ token, index })); decode the after arg back to the raw
   // DynamoDB continuation token the response side emitted (Fix 1 round-trip).
   let after = null;

package/tests/AppSync_Resolver_FunctionsTest.mjs

@@ -650,3 +650,96 @@ describe('authorizeIndexedAccess', () => {
     expect(response(ctx)).toEqual({ adminId: 'alice', data: 'secret' })
   })
 })
+
+// ---------------------------------------------------------------------------
+// listAllItemsConnection — @owner scoping
+// ---------------------------------------------------------------------------
+// This is the one read path with no Lambda in it: the predicate lives in
+// generated JS that AppSync runs directly, so it shares no code with the three
+// paths the ReScript suites cover. Evaluating the emitted source here is the
+// strongest check available short of a deployed stack, and the only one that
+// can catch an APPSYNC_JS-hostile construct or a mis-ordered branch.
+describe('listAllItemsConnection — owner scoping', () => {
+  // (labelField, filterFields, rangeFields, sortFields, requireAttribute,
+  //  ownerField, elevatedGroups)
+  const scoped = () =>
+    evalResolver(
+      F.listAllItemsConnection('name', ['status'], [], [], undefined, 'customerId', ['Admin']),
+    )
+
+  const asUser = (sub, groups = []) => ({
+    username: sub,
+    sub,
+    sourceIp: [],
+    claims: { 'cognito:groups': groups },
+  })
+
+  test('a plain caller is narrowed to their own rows', () => {
+    const { request } = scoped()
+    const r = request(makeCtx({ args: {}, identity: asUser('cust-a') }))
+    expect(r.filter.expression).toBe('#owner = :owner')
+    expect(r.filter.expressionNames['#owner']).toBe('customerId')
+    expect(r.filter.expressionValues[':owner']).toEqual({ S: 'cust-a' })
+  })
+
+  test('the owner clause is ANDed with a client filter, not replaced by it', () => {
+    const { request } = scoped()
+    const r = request(
+      makeCtx({ args: { filter: { statusEq: 'Placed' } }, identity: asUser('cust-a') }),
+    )
+    expect(r.filter.expression).toBe('#status = :statusEq AND #owner = :owner')
+  })
+
+  // The caller cannot address the channel the scope arrives on: naming the owner
+  // field in their own filter must not overwrite the value the resolver derived.
+  test('a client filter naming the owner field cannot displace the scope', () => {
+    const { request } = scoped()
+    const r = request(
+      makeCtx({ args: { filter: { customerIdEq: 'cust-b' } }, identity: asUser('cust-a') }),
+    )
+    expect(r.filter.expressionValues[':owner']).toEqual({ S: 'cust-a' })
+    expect(r.filter.expression).toContain('#owner = :owner')
+  })
+
+  test('a caller in an elevated group is not narrowed', () => {
+    const { request } = scoped()
+    const r = request(makeCtx({ args: {}, identity: asUser('ops-1', ['Admin']) }))
+    expect(r.filter).toBeUndefined()
+  })
+
+  // The IAM service caller: present, but with no `sub` and no groups. Ordering
+  // the group test first would classify it as non-elevated and then filter on
+  // `undefined`, so every service read would return nothing.
+  test('an IAM-shaped identity with no sub is exempt, not filtered on undefined', () => {
+    const { request } = scoped()
+    const r = request(
+      makeCtx({
+        args: {},
+        identity: { userArn: 'arn:aws:sts::1:assumed-role/Ingester', username: 'Ingester' },
+      }),
+    )
+    expect(r.filter).toBeUndefined()
+  })
+
+  test('a wholly absent identity is exempt rather than a crash', () => {
+    const { request } = scoped()
+    expect(() => request(makeCtx({ args: {}, identity: null }))).not.toThrow()
+    expect(request(makeCtx({ args: {}, identity: null })).filter).toBeUndefined()
+  })
+
+  // The control: without an owner field nothing changes for anyone, which is
+  // what keeps this from silently altering every existing read model.
+  test('a view with no owner field is never scoped', () => {
+    const { request } = evalResolver(F.listAllItemsConnection('name'))
+    const r = request(makeCtx({ args: {}, identity: asUser('cust-a') }))
+    expect(r.filter).toBeUndefined()
+  })
+
+  test('with no elevated groups configured, an Admin is still narrowed', () => {
+    const { request } = evalResolver(
+      F.listAllItemsConnection('name', [], [], [], undefined, 'customerId', []),
+    )
+    const r = request(makeCtx({ args: {}, identity: asUser('ops-1', ['Admin']) }))
+    expect(r.filter.expressionValues[':owner']).toEqual({ S: 'ops-1' })
+  })
+})