@reventlessdev/rescript-pulumi-aws 2.4.0-alpha.77 → 2.4.0-alpha.78

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 2.4.0-alpha.78 (2026-08-16)
+
+### Bug Fixes
+
+* **aws:** scope by-key reads to the owner, not only lists ([8232fd4](https://github.com/ReventlessDev/reventless-core/commit/8232fd4c09c1098c7265e4a17882ee44884f3bec))
+
+
 # 2.4.0-alpha.77 (2026-08-16)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "2.4.0-alpha.77",
+  "version": "2.4.0-alpha.78",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {
@@ -22,8 +22,8 @@
     "@pulumi/aws": "~7.19.0",
     "@pulumi/aws-native": "^1.62.0",
     "sury": "11.0.0-alpha.4",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11"
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19"
   },
   "devDependencies": {
     "esbuild": "^0.25.12",

package/src/AppSync/AppSync_Resolver_Functions.res

@@ -29,6 +29,69 @@ export function response(ctx) {
 
 let importUtil = `import { util } from '@aws-appsync/utils';`
 
+/**
+The caller-is-exempt test, emitted into a resolver's response.
+
+Mirrors `Reventless.OwnerScope.resolve` — the same branch order for the same
+reason the list predicate gives: an IAM-signed service caller has no `sub`
+because it is inside the trust boundary, not because it is anonymous, so the
+provider question is answered before the identity one.
+
+In the RESPONSE rather than the request, because a `GetItem` has no
+FilterExpression to carry a predicate: the row is fetched by key and the
+decision is made on what came back. A `Query` could filter server-side, and
+deliberately does not — a single-row read that filtered in one place and
+guarded in another would have two implementations of one rule, and the cheaper
+one is the one nobody would remember to change.
+*/
+let ownerGuardPreamble = (~ownerField: string, ~elevatedGroups: array<string>) => {
+  let elevatedLiteral = elevatedGroups->Array.map(g => `'${g}'`)->Array.join(", ")
+  `
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [${elevatedLiteral}];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  const _owns = (row) => row == null || _exempt || row['${ownerField}'] === _sub;`
+}
+
+/**
+A by-key read's response, refusing a row the caller does not own.
+
+**Null, not an error** — which is the opposite of what a first reading suggests,
+since "you may not read this" and "there is nothing here" are different answers
+and only one of them is true. Two things settle it. The in-process platform
+already answers `null` here, and a rule enforced differently per transport is
+the failure mode owner scoping exists to avoid. And an error would confirm the
+row exists to a caller who may not read it, which is a worse leak than the
+ambiguity it removes.
+*/
+let ownerScopedResultResponse = (~ownerField: option<string>, ~elevatedGroups: array<string>) =>
+  switch ownerField {
+  | None => resultResponseCode
+  | Some(field) =>
+    `
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  // ── owner scoping (generated) ──${ownerGuardPreamble(~ownerField=field, ~elevatedGroups)}
+  return _owns(ctx.result) ? ctx.result : null;
+}`
+  }
+
+/** The `queryByIdSort` counterpart — same rule, over the first row of a Query. */
+let ownerScopedFirstResultResponse = (~ownerField: option<string>, ~elevatedGroups: array<string>) =>
+  switch ownerField {
+  | None => firstResultResponseCode
+  | Some(field) =>
+    `
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  // ── owner scoping (generated) ──${ownerGuardPreamble(~ownerField=field, ~elevatedGroups)}
+  const _row = ctx.result.items[0] ?? null;
+  return _owns(_row) ? _row : null;
+}`
+  }
+
 // ---------------------------------------------------------------------------
 // Pipeline resolver pass-through (no before/after processing)
 // ---------------------------------------------------------------------------
@@ -89,7 +152,12 @@ export function response(ctx) {
 // DynamoDB read — by primary key
 // ---------------------------------------------------------------------------
 
-let getItemById =
+// `~ownerField` / `~elevatedGroups` carry the same meaning as on
+// `listAllItemsConnection`, and are optional for the same reason: a state that
+// declares no owner emits exactly the source it emitted before scoping existed.
+// A list that scopes beside a by-id read that does not is not a partial
+// delivery — it is a hole, reachable by anyone who can name a row.
+let getItemById = (~ownerField: option<string>=?, ~elevatedGroups: array<string>=[]) =>
   `${importUtil}
 export function request(ctx) {
   return {
@@ -97,7 +165,7 @@ export function request(ctx) {
     key: { id: util.dynamodb.toDynamoDB(ctx.args.id) }
   };
 }
-${resultResponseCode}
+${ownerScopedResultResponse(~ownerField, ~elevatedGroups)}
 `->Pulumi.Input.make
 
 let queryById =
@@ -119,7 +187,39 @@ ${resultResponseCode}
     Relay pagination: `first`/`after` (forward) or `last`/`before` (backward).
     Cursor is base64 of the sort key value.
     Returns a Relay `{ edges, pageInfo }` shape reusing the entity's `Connection` type. */
-let queryItemsWithSortConditions = (sortField: string) =>
+// A list in everything but its name, so it scopes the way `listAllItemsConnection`
+// does — a FilterExpression on the request, not a guard on the response. The
+// response is where the page is cut, and narrowing after that cut would report
+// `hasNextPage` from a count the caller was never allowed to see.
+let queryItemsWithSortConditions = (
+  sortField: string,
+  ~ownerField: option<string>=?,
+  ~elevatedGroups: array<string>=[],
+) => {
+  let ownerFilter = switch ownerField {
+  | None => ""
+  | Some(field) =>
+    let elevatedLiteral = elevatedGroups->Array.map(g => `'${g}'`)->Array.join(", ")
+    `
+  // ── owner scoping (generated) ──
+  // Not read from ctx.args, for the reason the list resolver gives: a predicate
+  // deciding what the caller may see must arrive on a channel they cannot name.
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [${elevatedLiteral}];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  const _ownerFilter = _exempt ? undefined : {
+    expression: '#owner = :owner',
+    expressionNames: { '#owner': '${field}' },
+    expressionValues: { ':owner': util.dynamodb.toDynamoDB(_sub) },
+  };`
+  }
+  let ownerFilterField = switch ownerField {
+  | None => ""
+  | Some(_) => `
+    filter: _ownerFilter,`
+  }
   `${importUtil}
 const encodeCursor = (skValue) => util.base64Encode(skValue);
 const decodeCursor = (cursor) => util.base64Decode(cursor);
@@ -162,10 +262,10 @@ export function request(ctx) {
   const expression = skCondition ? \`#id = :id AND \${skCondition}\` : '#id = :id';
   const orderDesc = filter.order === 'DESC';
   const scanForward = isBackward ? orderDesc : !orderDesc;
-  const pageSize = isBackward ? (args.last ?? 50) : (args.first ?? 50);
+  const pageSize = isBackward ? (args.last ?? 50) : (args.first ?? 50);${ownerFilter}
   return {
     operation: 'Query',
-    query: { expression, expressionNames, expressionValues },
+    query: { expression, expressionNames, expressionValues },${ownerFilterField}
     scanIndexForward: scanForward,
     limit: pageSize + 1,
   };
@@ -194,8 +294,13 @@ export function response(ctx) {
   };
 }
 `->Pulumi.Input.make
+}
 
-let queryByIdSort = (sortField: string) =>
+let queryByIdSort = (
+  sortField: string,
+  ~ownerField: option<string>=?,
+  ~elevatedGroups: array<string>=[],
+) =>
   `${importUtil}
 export function request(ctx) {
   return {
@@ -210,7 +315,7 @@ export function request(ctx) {
     }
   };
 }
-${firstResultResponseCode}
+${ownerScopedFirstResultResponse(~ownerField, ~elevatedGroups)}
 `->Pulumi.Input.make
 
 // ---------------------------------------------------------------------------

package/src/AppSync/AppSync_Resolver_Functions.res.mjs

@@ -21,6 +21,44 @@ export function response(ctx) {
 
 let importUtil = `import { util } from '@aws-appsync/utils';`;
 
+function ownerGuardPreamble(ownerField, elevatedGroups) {
+  let elevatedLiteral = elevatedGroups.map(g => `'` + g + `'`).join(", ");
+  return `
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [` + elevatedLiteral + `];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  const _owns = (row) => row == null || _exempt || row['` + ownerField + `'] === _sub;`;
+}
+
+function ownerScopedResultResponse(ownerField, elevatedGroups) {
+  if (ownerField !== undefined) {
+    return `
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  // ── owner scoping (generated) ──` + ownerGuardPreamble(ownerField, elevatedGroups) + `
+  return _owns(ctx.result) ? ctx.result : null;
+}`;
+  } else {
+    return resultResponseCode;
+  }
+}
+
+function ownerScopedFirstResultResponse(ownerField, elevatedGroups) {
+  if (ownerField !== undefined) {
+    return `
+export function response(ctx) {
+  if (ctx.error) util.error(ctx.error.message, ctx.error.type);
+  // ── owner scoping (generated) ──` + ownerGuardPreamble(ownerField, elevatedGroups) + `
+  const _row = ctx.result.items[0] ?? null;
+  return _owns(_row) ? _row : null;
+}`;
+  } else {
+    return firstResultResponseCode;
+  }
+}
+
 let pipelinePassThrough = importUtil + `
 export function request(ctx) { return {}; }
 ` + resultResponseCode + `
@@ -64,15 +102,18 @@ export function response(ctx) {
 `;
 }
 
-let getItemById = importUtil + `
+function getItemById(ownerField, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
+  return importUtil + `
 export function request(ctx) {
   return {
     operation: 'GetItem',
     key: { id: util.dynamodb.toDynamoDB(ctx.args.id) }
   };
 }
-` + resultResponseCode + `
+` + ownerScopedResultResponse(ownerField, elevatedGroups) + `
 `;
+}
 
 let queryById = importUtil + `
 export function request(ctx) {
@@ -87,7 +128,30 @@ export function request(ctx) {
 ` + resultResponseCode + `
 `;
 
-function queryItemsWithSortConditions(sortField) {
+function queryItemsWithSortConditions(sortField, ownerField, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
+  let ownerFilter;
+  if (ownerField !== undefined) {
+    let elevatedLiteral = elevatedGroups.map(g => `'` + g + `'`).join(", ");
+    ownerFilter = `
+  // ── owner scoping (generated) ──
+  // Not read from ctx.args, for the reason the list resolver gives: a predicate
+  // deciding what the caller may see must arrive on a channel they cannot name.
+  const _id = ctx.identity;
+  const _sub = _id == null ? null : _id.sub;
+  const _groups = (_id != null && _id.claims != null && _id.claims['cognito:groups']) || [];
+  const _elevated = [` + elevatedLiteral + `];
+  const _exempt = _sub == null || _groups.some(g => _elevated.indexOf(g) >= 0);
+  const _ownerFilter = _exempt ? undefined : {
+    expression: '#owner = :owner',
+    expressionNames: { '#owner': '` + ownerField + `' },
+    expressionValues: { ':owner': util.dynamodb.toDynamoDB(_sub) },
+  };`;
+  } else {
+    ownerFilter = "";
+  }
+  let ownerFilterField = ownerField !== undefined ? `
+    filter: _ownerFilter,` : "";
   return importUtil + `
 const encodeCursor = (skValue) => util.base64Encode(skValue);
 const decodeCursor = (cursor) => util.base64Decode(cursor);
@@ -130,10 +194,10 @@ export function request(ctx) {
   const expression = skCondition ? \`#id = :id AND \${skCondition}\` : '#id = :id';
   const orderDesc = filter.order === 'DESC';
   const scanForward = isBackward ? orderDesc : !orderDesc;
-  const pageSize = isBackward ? (args.last ?? 50) : (args.first ?? 50);
+  const pageSize = isBackward ? (args.last ?? 50) : (args.first ?? 50);` + ownerFilter + `
   return {
     operation: 'Query',
-    query: { expression, expressionNames, expressionValues },
+    query: { expression, expressionNames, expressionValues },` + ownerFilterField + `
     scanIndexForward: scanForward,
     limit: pageSize + 1,
   };
@@ -164,7 +228,8 @@ export function response(ctx) {
 `;
 }
 
-function queryByIdSort(sortField) {
+function queryByIdSort(sortField, ownerField, elevatedGroupsOpt) {
+  let elevatedGroups = elevatedGroupsOpt !== undefined ? elevatedGroupsOpt : [];
   return importUtil + `
 export function request(ctx) {
   return {
@@ -179,7 +244,7 @@ export function request(ctx) {
     }
   };
 }
-` + firstResultResponseCode + `
+` + ownerScopedFirstResultResponse(ownerField, elevatedGroups) + `
 `;
 }
 
@@ -953,6 +1018,9 @@ export {
   firstResultResponseCode,
   resultListResponseCode,
   importUtil,
+  ownerGuardPreamble,
+  ownerScopedResultResponse,
+  ownerScopedFirstResultResponse,
   pipelinePassThrough,
   nodeDecodeGlobalId,
   nodeGetItemForType,

package/tests/AppSync_Resolver_FunctionsTest.mjs

@@ -16,7 +16,7 @@ describe('Resolver code structure', () => {
   // Labeled ReScript args compile to positional JS args in declaration order.
   const codeValues = [
     ['pipelinePassThrough', F.pipelinePassThrough],
-    ['getItemById', F.getItemById],
+    ['getItemById', F.getItemById(undefined, undefined)],
     ['queryById', F.queryById],
     ['queryByIdSort(sortField)', F.queryByIdSort('status')],
     ['queryByIndex(index)', F.queryByIndex('userId')],
@@ -54,7 +54,7 @@ describe('Resolver code structure', () => {
 // getItemById
 // ---------------------------------------------------------------------------
 describe('getItemById', () => {
-  const { request, response } = evalResolver(F.getItemById)
+  const { request, response } = evalResolver(F.getItemById(undefined, undefined))
 
   test('request returns GetItem with id key', () => {
     const ctx = makeCtx({ args: { id: 'abc123' } })
@@ -743,3 +743,80 @@ describe('listAllItemsConnection — owner scoping', () => {
     expect(r.filter.expressionValues[':owner']).toEqual({ S: 'ops-1' })
   })
 })
+
+// ---------------------------------------------------------------------------
+// By-key reads — owner scoping
+// ---------------------------------------------------------------------------
+// The list resolver above carried the predicate while these did not, so a caller
+// narrowed to their own rows could still read any row they could name. These
+// cases pin the guard in the place it has to live: the response, since a GetItem
+// has no FilterExpression, and null rather than an error, which is what the
+// in-process platform answers and what does not confirm the row exists.
+describe('getItemById / queryByIdSort — owner scoping', () => {
+  const asUser = (sub, groups = []) => ({
+    username: sub,
+    sub,
+    sourceIp: [],
+    claims: { 'cognito:groups': groups },
+  })
+  const row = { id: 'ord-1', customerId: 'cust-a', total: 10 }
+
+  const getScoped = () => evalResolver(F.getItemById('customerId', ['Admin']))
+  const sortScoped = () => evalResolver(F.queryByIdSort('status', 'customerId', ['Admin']))
+
+  test('an owner reads their own row', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: row, identity: asUser('cust-a') }))).toEqual(row)
+  })
+
+  test('a foreign row reads as null, not as an error', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: row, identity: asUser('cust-b') }))).toBeNull()
+  })
+
+  test('an elevated caller reads any row', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: row, identity: asUser('ops-1', ['Admin']) }))).toEqual(row)
+  })
+
+  test('an IAM-shaped identity with no sub is exempt, not compared against undefined', () => {
+    const { response } = getScoped()
+    const iam = { username: 'svc', userArn: 'arn:aws:iam::1:role/r', sourceIp: [] }
+    expect(response(makeCtx({ result: row, identity: iam }))).toEqual(row)
+  })
+
+  test('a wholly absent identity is exempt rather than a crash', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: row, identity: null }))).toEqual(row)
+  })
+
+  test('a missing row stays null and does not fall into the ownership branch', () => {
+    const { response } = getScoped()
+    expect(response(makeCtx({ result: null, identity: asUser('cust-b') }))).toBeNull()
+  })
+
+  test('a view with no owner field is never scoped', () => {
+    const { response } = evalResolver(F.getItemById(undefined, []))
+    expect(response(makeCtx({ result: row, identity: asUser('cust-b') }))).toEqual(row)
+  })
+
+  test('queryByIdSort narrows its first row the same way', () => {
+    const { response } = sortScoped()
+    const ctxFor = sub => makeCtx({ result: { items: [row] }, identity: asUser(sub) })
+    expect(response(ctxFor('cust-a'))).toEqual(row)
+    expect(response(ctxFor('cust-b'))).toBeNull()
+  })
+
+  test('queryItemsWithSortConditions scopes in the REQUEST, so the page is cut after narrowing', () => {
+    const { request } = evalResolver(
+      F.queryItemsWithSortConditions('createdAt', 'customerId', ['Admin']),
+    )
+    const scoped = request(makeCtx({ args: { id: 'ord-1' }, identity: asUser('cust-a') }))
+    expect(scoped.filter.expression).toBe('#owner = :owner')
+    expect(scoped.filter.expressionValues[':owner']).toEqual({ S: 'cust-a' })
+    const elevated = request(
+      makeCtx({ args: { id: 'ord-1' }, identity: asUser('ops-1', ['Admin']) }),
+    )
+    expect(elevated.filter).toBeUndefined()
+  })
+})