@reventlessdev/rescript-pulumi-aws 2.4.0-alpha.76 → 2.4.0-alpha.78

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 2.4.0-alpha.78 (2026-08-16)
+
+### Bug Fixes
+
+* **aws:** scope by-key reads to the owner, not only lists ([8232fd4](https://github.com/ReventlessDev/reventless-core/commit/8232fd4c09c1098c7265e4a17882ee44884f3bec))
+
+
+# 2.4.0-alpha.77 (2026-08-16)
+
+### Features
+
+* **core:** exclude retired rows from reads a caller may not widen ([662f31a](https://github.com/ReventlessDev/reventless-core/commit/662f31abb717bda5154199d349da6dcf8e2d3e78))
+* **core:** let [@retired](https://github.com/retired) name a lifecycle state, not only a boolean ([6bb346b](https://github.com/ReventlessDev/reventless-core/commit/6bb346b4f6a5f33826fc24537953482a76067177))
+* **core:** mark the state that retires a row, and allow more than one ([cb1461f](https://github.com/ReventlessDev/reventless-core/commit/cb1461f024d3ca3b53fd9c8b010a054e3fcc4555))
+
+
 # 2.4.0-alpha.76 (2026-08-15)
 
 **Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "2.4.0-alpha.76",
+  "version": "2.4.0-alpha.78",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {

package/src/AppSync/AppSync_Resolver_Functions.res

@@ -29,6 +29,69 @@ export function response(ctx) {
 
 let importUtil = `import { util } from '@aws-appsync/utils';`
 
+/**
+The caller-is-exempt test, emitted into a resolver's response.
+
+Mirrors `Reventless.OwnerScope.resolve` — the same branch order for the same
+reason the list predicate gives: an IAM-signed service caller has no `sub`
+because it is inside the trust boundary, not because it is anonymous, so the
+provider question is answered before the identity one.
+
+In the RESPONSE rather than the request, because a `GetItem` has no
+FilterExpression to carry a predicate: the row is fetched by key and the
+decision is made on what came back. A `Query` could filter server-side, and
+deliberately does not — a single-row read that filtered in one place and
+guarded in another would have two implementations of one rule, and the cheaper
+one is the one nobody would remember to change.
+*/
+let ownerGuardPreamble = (~ownerField: string, ~elevatedGroups: array<string>) => {
+  let elevatedLiteral = elevatedGroups->Array.map(g => `'${g}'`)->Array.join(", ")
+  `
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [${elevatedLiteral}];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  const _owns = (row) => row == null || _exempt || row['${ownerField}'] === _sub;`
+}
+
+/**
+A by-key read's response, refusing a row the caller does not own.
+
+**Null, not an error** — which is the opposite of what a first reading suggests,
+since "you may not read this" and "there is nothing here" are different answers
+and only one of them is true. Two things settle it. The in-process platform
+already answers `null` here, and a rule enforced differently per transport is
+the failure mode owner scoping exists to avoid. And an error would confirm the
+row exists to a caller who may not read it, which is a worse leak than the
+ambiguity it removes.
+*/
+let ownerScopedResultResponse = (~ownerField: option<string>, ~elevatedGroups: array<string>) =>
+  switch ownerField {
+  | None => resultResponseCode
+  | Some(field) =>
+    `
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  // ── owner scoping (generated) ──${ownerGuardPreamble(~ownerField=field, ~elevatedGroups)}
+  return _owns(ctx.result) ? ctx.result : null;
+}`
+  }
+
+/** The `queryByIdSort` counterpart — same rule, over the first row of a Query. */
+let ownerScopedFirstResultResponse = (~ownerField: option<string>, ~elevatedGroups: array<string>) =>
+  switch ownerField {
+  | None => firstResultResponseCode
+  | Some(field) =>
+    `
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  // ── owner scoping (generated) ──${ownerGuardPreamble(~ownerField=field, ~elevatedGroups)}
+  const _row = ctx.result.items[0] ?? null;
+  return _owns(_row) ? _row : null;
+}`
+  }
+
 // ---------------------------------------------------------------------------
 // Pipeline resolver pass-through (no before/after processing)
 // ---------------------------------------------------------------------------
@@ -89,7 +152,12 @@ export function response(ctx) {
 // DynamoDB read — by primary key
 // ---------------------------------------------------------------------------
 
-let getItemById =
+// `~ownerField` / `~elevatedGroups` carry the same meaning as on
+// `listAllItemsConnection`, and are optional for the same reason: a state that
+// declares no owner emits exactly the source it emitted before scoping existed.
+// A list that scopes beside a by-id read that does not is not a partial
+// delivery — it is a hole, reachable by anyone who can name a row.
+let getItemById = (~ownerField: option<string>=?, ~elevatedGroups: array<string>=[]) =>
   `${importUtil}
 export function request(ctx) {
   return {
@@ -97,7 +165,7 @@ export function request(ctx) {
     key: { id: util.dynamodb.toDynamoDB(ctx.args.id) }
   };
 }
-${resultResponseCode}
+${ownerScopedResultResponse(~ownerField, ~elevatedGroups)}
 `->Pulumi.Input.make
 
 let queryById =
@@ -119,7 +187,39 @@ ${resultResponseCode}
     Relay pagination: `first`/`after` (forward) or `last`/`before` (backward).
     Cursor is base64 of the sort key value.
     Returns a Relay `{ edges, pageInfo }` shape reusing the entity's `Connection` type. */
-let queryItemsWithSortConditions = (sortField: string) =>
+// A list in everything but its name, so it scopes the way `listAllItemsConnection`
+// does — a FilterExpression on the request, not a guard on the response. The
+// response is where the page is cut, and narrowing after that cut would report
+// `hasNextPage` from a count the caller was never allowed to see.
+let queryItemsWithSortConditions = (
+  sortField: string,
+  ~ownerField: option<string>=?,
+  ~elevatedGroups: array<string>=[],
+) => {
+  let ownerFilter = switch ownerField {
+  | None => ""
+  | Some(field) =>
+    let elevatedLiteral = elevatedGroups->Array.map(g => `'${g}'`)->Array.join(", ")
+    `
+  // ── owner scoping (generated) ──
+  // Not read from ctx.args, for the reason the list resolver gives: a predicate
+  // deciding what the caller may see must arrive on a channel they cannot name.
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [${elevatedLiteral}];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  const _ownerFilter = _exempt ? undefined : {
+    expression: '#owner = :owner',
+    expressionNames: { '#owner': '${field}' },
+    expressionValues: { ':owner': util.dynamodb.toDynamoDB(_sub) },
+  };`
+  }
+  let ownerFilterField = switch ownerField {
+  | None => ""
+  | Some(_) => `
+    filter: _ownerFilter,`
+  }
   `${importUtil}
 const encodeCursor = (skValue) => util.base64Encode(skValue);
 const decodeCursor = (cursor) => util.base64Decode(cursor);
@@ -162,10 +262,10 @@ export function request(ctx) {
   const expression = skCondition ? \`#id = :id AND \${skCondition}\` : '#id = :id';
   const orderDesc = filter.order === 'DESC';
   const scanForward = isBackward ? orderDesc : !orderDesc;
-  const pageSize = isBackward ? (args.last ?? 50) : (args.first ?? 50);
+  const pageSize = isBackward ? (args.last ?? 50) : (args.first ?? 50);${ownerFilter}
   return {
     operation: 'Query',
-    query: { expression, expressionNames, expressionValues },
+    query: { expression, expressionNames, expressionValues },${ownerFilterField}
     scanIndexForward: scanForward,
     limit: pageSize + 1,
   };
@@ -194,8 +294,13 @@ export function response(ctx) {
   };
 }
 `->Pulumi.Input.make
+}
 
-let queryByIdSort = (sortField: string) =>
+let queryByIdSort = (
+  sortField: string,
+  ~ownerField: option<string>=?,
+  ~elevatedGroups: array<string>=[],
+) =>
   `${importUtil}
 export function request(ctx) {
   return {
@@ -210,7 +315,7 @@ export function request(ctx) {
     }
   };
 }
-${firstResultResponseCode}
+${ownerScopedFirstResultResponse(~ownerField, ~elevatedGroups)}
 `->Pulumi.Input.make
 
 // ---------------------------------------------------------------------------
@@ -447,6 +552,13 @@ let listAllItemsConnection = (
   // than a per-request one.
   ~ownerField: option<string>=?,
   ~elevatedGroups: array<string>=[],
+  // The state's `@retired` field, when it declares one. Baked in for the same
+  // reason `ownerField` is: there is no Lambda in this path to read it at
+  // request time.
+  ~retiredField: option<string>=?,
+  // The states that retire the row, for the state form of the annotation.
+  // Absent is the boolean form, where the value is always `true`.
+  ~retiredValues: option<array<string>>=?,
 ) => {
   let requireAttributeClause = switch requireAttribute {
   | Some(attr) => `
@@ -480,6 +592,70 @@ let listAllItemsConnection = (
     parts.push('#owner = :owner');
   }`
   }
+  // ── retirement narrowing (generated) ──
+  // Reuses `_exempt` when the owner clause already computed it, and computes its
+  // own when it did not — the two clauses are independently optional and either
+  // may be the only one present.
+  //
+  // `includeRetired` IS read from ctx.args, unlike the owner predicate, and the
+  // difference is deliberate: this argument does not say which rows the caller
+  // wants, it asks to lift a restriction, and it is honoured only inside the
+  // `_exempt` branch. A non-exempt caller passing it changes nothing.
+  //
+  // `attribute_not_exists OR = false` rather than `<> true`: a row written before
+  // the annotation existed carries no such attribute, and DynamoDB's `<>` does
+  // not match a missing one — the whole view would come back empty on the day
+  // the annotation lands.
+  //
+  // The state form compares `<>` against the retiring state instead, under the
+  // same `attribute_not_exists` guard and for the same reason. An equality
+  // predicate over an enum-valued attribute indexes exactly as a boolean one
+  // does, so the warning about an unindexed retirement field carries over
+  // unchanged.
+  let retiredClause = switch retiredField {
+  | None => ""
+  | Some(field) =>
+    let elevatedLiteral = elevatedGroups->Array.map(g => `'${g}'`)->Array.join(", ")
+    let exemptPrelude = switch ownerField {
+    | Some(_) => ""
+    | None => `
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [${elevatedLiteral}];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);`
+    }
+    `${exemptPrelude}
+  // ── retirement narrowing (generated) ──
+  const _wantsRetired = _exempt && ctx.args.includeRetired === true;
+  if (!_wantsRetired) {
+    names['#retired'] = '${field}';
+${switch retiredValues {
+      | None => `    values[':retiredFalse'] = util.dynamodb.toDynamoDB(false);
+    parts.push('(attribute_not_exists(#retired) OR #retired = :retiredFalse)');`
+      // One `<>` per state, ANDed, rather than `NOT IN`: DynamoDB's `IN` needs a
+      // parenthesised operand list built from the same placeholders anyway, and
+      // the conjunction keeps `attribute_not_exists` covering the absent case
+      // once for the whole clause — a row that states no lifecycle is not
+      // retired, the same reading every other adapter takes.
+      | Some(states) =>
+        let placeholders = states->Array.mapWithIndex((state, i) => (`:retiredValue${Int.toString(i)}`, state))
+        let assignments =
+          placeholders
+          ->Array.map(((ph, state)) => `    values['${ph}'] = util.dynamodb.toDynamoDB('${state}');`)
+          ->Array.join("\n")
+        let comparisons =
+          placeholders->Array.map(((ph, _)) => `#retired <> ${ph}`)->Array.join(" AND ")
+        // A set naming nothing withdraws nothing, so it pushes no predicate down.
+        switch placeholders {
+        | [] => ""
+        | _ =>
+          `${assignments}
+    parts.push('(attribute_not_exists(#retired) OR (${comparisons}))');`
+        }
+      }}
+  }`
+  }
   let filterClauses =
     filterFields
     ->Array.map(f => `
@@ -569,7 +745,7 @@ export function request(ctx) {
       return key;
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
-  }${filterClauses}${rangeClauses}${requireAttributeClause}${ownerClause}
+  }${filterClauses}${rangeClauses}${requireAttributeClause}${ownerClause}${retiredClause}
   // The cursor is base64(JSON({ token, index })); decode the after arg back to the raw
   // DynamoDB continuation token the response side emitted (Fix 1 round-trip).
   let after = null;

package/src/AppSync/AppSync_Resolver_Functions.res.mjs

@@ -21,6 +21,44 @@ export function response(ctx) {
 
 let importUtil = `import { util } from '@aws-appsync/utils';`;
 
+function ownerGuardPreamble(ownerField, elevatedGroups) {
+  let elevatedLiteral = elevatedGroups.map(g => `'` + g + `'`).join(", ");
+  return `
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [` + elevatedLiteral + `];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  const _owns = (row) => row == null || _exempt || row['` + ownerField + `'] === _sub;`;
+}
+
+function ownerScopedResultResponse(ownerField, elevatedGroups) {
+  if (ownerField !== undefined) {
+    return `
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  // ── owner scoping (generated) ──` + ownerGuardPreamble(ownerField, elevatedGroups) + `
+  return _owns(ctx.result) ? ctx.result : null;
+}`;
+  } else {
+    return resultResponseCode;
+  }
+}
+
+function ownerScopedFirstResultResponse(ownerField, elevatedGroups) {
+  if (ownerField !== undefined) {
+    return `
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  // ── owner scoping (generated) ──` + ownerGuardPreamble(ownerField, elevatedGroups) + `
+  const _row = ctx.result.items[0] ?? null;
+  return _owns(_row) ? _row : null;
+}`;
+  } else {
+    return firstResultResponseCode;
+  }
+}
+
 let pipelinePassThrough = importUtil + `
 export function request(ctx) { return {}; }
 ` + resultResponseCode + `
@@ -64,15 +102,18 @@ export function response(ctx) {
 `;
 }
 
-let getItemById = importUtil + `
+function getItemById(ownerField, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
+  return importUtil + `
 export function request(ctx) {
   return {
     operation: 'GetItem',
     key: { id: util.dynamodb.toDynamoDB(ctx.args.id) }
   };
 }
-` + resultResponseCode + `
+` + ownerScopedResultResponse(ownerField, elevatedGroups) + `
 `;
+}
 
 let queryById = importUtil + `
 export function request(ctx) {
@@ -87,7 +128,30 @@ export function request(ctx) {
 ` + resultResponseCode + `
 `;
 
-function queryItemsWithSortConditions(sortField) {
+function queryItemsWithSortConditions(sortField, ownerField, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
+  let ownerFilter;
+  if (ownerField !== undefined) {
+    let elevatedLiteral = elevatedGroups.map(g => `'` + g + `'`).join(", ");
+    ownerFilter = `
+  // ── owner scoping (generated) ──
+  // Not read from ctx.args, for the reason the list resolver gives: a predicate
+  // deciding what the caller may see must arrive on a channel they cannot name.
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [` + elevatedLiteral + `];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  const _ownerFilter = _exempt ? undefined : {
+    expression: '#owner = :owner',
+    expressionNames: { '#owner': '` + ownerField + `' },
+    expressionValues: { ':owner': util.dynamodb.toDynamoDB(_sub) },
+  };`;
+  } else {
+    ownerFilter = "";
+  }
+  let ownerFilterField = ownerField !== undefined ? `
+    filter: _ownerFilter,` : "";
   return importUtil + `
 const encodeCursor = (skValue) => util.base64Encode(skValue);
 const decodeCursor = (cursor) => util.base64Decode(cursor);
@@ -130,10 +194,10 @@ export function request(ctx) {
   const expression = skCondition ? \`#id = :id AND \${skCondition}\` : '#id = :id';
   const orderDesc = filter.order === 'DESC';
   const scanForward = isBackward ? orderDesc : !orderDesc;
-  const pageSize = isBackward ? (args.last ?? 50) : (args.first ?? 50);
+  const pageSize = isBackward ? (args.last ?? 50) : (args.first ?? 50);` + ownerFilter + `
   return {
     operation: 'Query',
-    query: { expression, expressionNames, expressionValues },
+    query: { expression, expressionNames, expressionValues },` + ownerFilterField + `
     scanIndexForward: scanForward,
     limit: pageSize + 1,
   };
@@ -164,7 +228,8 @@ export function response(ctx) {
 `;
 }
 
-function queryByIdSort(sortField) {
+function queryByIdSort(sortField, ownerField, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
   return importUtil + `
 export function request(ctx) {
   return {
@@ -179,7 +244,7 @@ export function request(ctx) {
     }
   };
 }
-` + firstResultResponseCode + `
+` + ownerScopedFirstResultResponse(ownerField, elevatedGroups) + `
 `;
 }
 
@@ -360,7 +425,7 @@ export function request(ctx) {
 ` + resultResponseCode + `
 `;
 
-function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sortFieldsOpt, requireAttribute, ownerField, elevatedGroupsOpt) {
+function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sortFieldsOpt, requireAttribute, ownerField, elevatedGroupsOpt, retiredField, retiredValues) {
   let filterFields = filterFieldsOpt !== undefined ? filterFieldsOpt : [];
   let rangeFields = rangeFieldsOpt !== undefined ? rangeFieldsOpt : [];
   let sortFields = sortFieldsOpt !== undefined ? sortFieldsOpt : [];
@@ -391,6 +456,39 @@ function listAllItemsConnection(labelField, filterFieldsOpt, rangeFieldsOpt, sor
   } else {
     ownerClause = "";
   }
+  let retiredClause;
+  if (retiredField !== undefined) {
+    let elevatedLiteral$1 = elevatedGroups.map(g => `'` + g + `'`).join(", ");
+    let exemptPrelude = ownerField !== undefined ? "" : `
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [` + elevatedLiteral$1 + `];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);`;
+    let tmp;
+    if (retiredValues !== undefined) {
+      let placeholders = retiredValues.map((state, i) => [
+        `:retiredValue` + i.toString(),
+        state
+      ]);
+      let assignments = placeholders.map(param => `    values['` + param[0] + `'] = util.dynamodb.toDynamoDB('` + param[1] + `');`).join("\n");
+      let comparisons = placeholders.map(param => `#retired <> ` + param[0]).join(" AND ");
+      tmp = placeholders.length !== 0 ? assignments + `
+    parts.push('(attribute_not_exists(#retired) OR (` + comparisons + `))');` : "";
+    } else {
+      tmp = `    values[':retiredFalse'] = util.dynamodb.toDynamoDB(false);
+    parts.push('(attribute_not_exists(#retired) OR #retired = :retiredFalse)');`;
+    }
+    retiredClause = exemptPrelude + `
+  // ── retirement narrowing (generated) ──
+  const _wantsRetired = _exempt && ctx.args.includeRetired === true;
+  if (!_wantsRetired) {
+    names['#retired'] = '` + retiredField + `';
+` + tmp + `
+  }`;
+  } else {
+    retiredClause = "";
+  }
   let filterClauses = filterFields.map(f => `
   if (filter.` + f + `Eq !== undefined && filter.` + f + `Eq !== null && filter.` + f + `Eq !== '') {
     names['#` + f + `'] = '` + f + `';
@@ -460,7 +558,7 @@ export function request(ctx) {
       return key;
     });
     parts.push('#id IN (' + placeholders.join(', ') + ')');
-  }` + filterClauses + rangeClauses + requireAttributeClause + ownerClause + `
+  }` + filterClauses + rangeClauses + requireAttributeClause + ownerClause + retiredClause + `
   // The cursor is base64(JSON({ token, index })); decode the after arg back to the raw
   // DynamoDB continuation token the response side emitted (Fix 1 round-trip).
   let after = null;
@@ -920,6 +1018,9 @@ export {
   firstResultResponseCode,
   resultListResponseCode,
   importUtil,
+  ownerGuardPreamble,
+  ownerScopedResultResponse,
+  ownerScopedFirstResultResponse,
   pipelinePassThrough,
   nodeDecodeGlobalId,
   nodeGetItemForType,

package/tests/AppSync_Resolver_FunctionsTest.mjs

@@ -16,7 +16,7 @@ describe('Resolver code structure', () => {
   // Labeled ReScript args compile to positional JS args in declaration order.
   const codeValues = [
     ['pipelinePassThrough', F.pipelinePassThrough],
-    ['getItemById', F.getItemById],
+    ['getItemById', F.getItemById(undefined, undefined)],
     ['queryById', F.queryById],
     ['queryByIdSort(sortField)', F.queryByIdSort('status')],
     ['queryByIndex(index)', F.queryByIndex('userId')],
@@ -54,7 +54,7 @@ describe('Resolver code structure', () => {
 // getItemById
 // ---------------------------------------------------------------------------
 describe('getItemById', () => {
-  const { request, response } = evalResolver(F.getItemById)
+  const { request, response } = evalResolver(F.getItemById(undefined, undefined))
 
   test('request returns GetItem with id key', () => {
     const ctx = makeCtx({ args: { id: 'abc123' } })
@@ -743,3 +743,80 @@ describe('listAllItemsConnection — owner scoping', () => {
     expect(r.filter.expressionValues[':owner']).toEqual({ S: 'ops-1' })
   })
 })
+
+// ---------------------------------------------------------------------------
+// By-key reads — owner scoping
+// ---------------------------------------------------------------------------
+// The list resolver above carried the predicate while these did not, so a caller
+// narrowed to their own rows could still read any row they could name. These
+// cases pin the guard in the place it has to live: the response, since a GetItem
+// has no FilterExpression, and null rather than an error, which is what the
+// in-process platform answers and what does not confirm the row exists.
+describe('getItemById / queryByIdSort — owner scoping', () => {
+  const asUser = (sub, groups = []) => ({
+    username: sub,
+    sub,
+    sourceIp: [],
+    claims: { 'cognito:groups': groups },
+  })
+  const row = { id: 'ord-1', customerId: 'cust-a', total: 10 }
+
+  const getScoped = () => evalResolver(F.getItemById('customerId', ['Admin']))
+  const sortScoped = () => evalResolver(F.queryByIdSort('status', 'customerId', ['Admin']))
+
+  test('an owner reads their own row', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: row, identity: asUser('cust-a') }))).toEqual(row)
+  })
+
+  test('a foreign row reads as null, not as an error', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: row, identity: asUser('cust-b') }))).toBeNull()
+  })
+
+  test('an elevated caller reads any row', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: row, identity: asUser('ops-1', ['Admin']) }))).toEqual(row)
+  })
+
+  test('an IAM-shaped identity with no sub is exempt, not compared against undefined', () => {
+    const { response } = getScoped()
+    const iam = { username: 'svc', userArn: 'arn:aws:iam::1:role/r', sourceIp: [] }
+    expect(response(makeCtx({ result: row, identity: iam }))).toEqual(row)
+  })
+
+  test('a wholly absent identity is exempt rather than a crash', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: row, identity: null }))).toEqual(row)
+  })
+
+  test('a missing row stays null and does not fall into the ownership branch', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: null, identity: asUser('cust-b') }))).toBeNull()
+  })
+
+  test('a view with no owner field is never scoped', () => {
+    const { response } = evalResolver(F.getItemById(undefined, []))
+    expect(response(makeCtx({ result: row, identity: asUser('cust-b') }))).toEqual(row)
+  })
+
+  test('queryByIdSort narrows its first row the same way', () => {
+    const { response } = sortScoped()
+    const ctxFor = sub => makeCtx({ result: { items: [row] }, identity: asUser(sub) })
+    expect(response(ctxFor('cust-a'))).toEqual(row)
+    expect(response(ctxFor('cust-b'))).toBeNull()
+  })
+
+  test('queryItemsWithSortConditions scopes in the REQUEST, so the page is cut after narrowing', () => {
+    const { request } = evalResolver(
+      F.queryItemsWithSortConditions('createdAt', 'customerId', ['Admin']),
+    )
+    const scoped = request(makeCtx({ args: { id: 'ord-1' }, identity: asUser('cust-a') }))
+    expect(scoped.filter.expression).toBe('#owner = :owner')
+    expect(scoped.filter.expressionValues[':owner']).toEqual({ S: 'cust-a' })
+    const elevated = request(
+      makeCtx({ args: { id: 'ord-1' }, identity: asUser('ops-1', ['Admin']) }),
+    )
+    expect(elevated.filter).toBeUndefined()
+  })
+})