@reventlessdev/rescript-pulumi-aws 3.0.0-alpha.24 → 3.0.0-alpha.26

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.26 (2026-10-10)
+
+### Bug Fixes
+
+* an inbound translation is gated alike on every door, and encodes its commands by schema ([6ec3ce6](https://github.com/ReventlessDev/reventless-core/commit/6ec3ce672e53e2c162c64a90d103be691391be5e))
+
+
+# 3.0.0-alpha.25 (2026-10-08)
+
+**Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws
+
+
+
+
+
 # 3.0.0-alpha.24 (2026-10-06)
 
 **Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "3.0.0-alpha.24",
+  "version": "3.0.0-alpha.26",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {
@@ -22,9 +22,9 @@
     "@pulumi/aws": "~7.19.0",
     "@pulumi/aws-native": "^1.62.0",
     "sury": "11.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.29",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.21",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23"
+    "@reventlessdev/rescript-node": "2.0.0-alpha.22",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.30"
   },
   "devDependencies": {
     "esbuild": "^0.25.12",

package/src/AppSync/AppSync_Resolver_Functions.res

@@ -1671,6 +1671,24 @@ ${resultResponseCode}
 // Lambda invocations
 // ---------------------------------------------------------------------------
 
+// The caller as a command Lambda reads it: a Cognito user, an IAM principal, or null.
+let callerIdentity = `identity: isCognito
+        ? {
+            userId: id.sub,
+            username: id.username,
+            groups: id.claims?.['cognito:groups'] ?? [],
+            claims: id.claims,
+            provider: 'Cognito'
+          }
+        : id != null
+          ? {
+              userArn: id.userArn ?? null,
+              accountId: id.accountId ?? null,
+              username: id.username ?? null,
+              provider: 'IAM'
+            }
+          : null`
+
 /** Invoke a CommandGenerator Lambda. `command` is the Aggregate command name. */
 let invokeCommandGenerator = (command: string) =>
   `${importUtil}
@@ -1687,22 +1705,7 @@ export function request(ctx) {
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ${callerIdentity}
     }
   };
 }
@@ -1725,22 +1728,7 @@ export function request(ctx) {
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ${callerIdentity}
     }
   };
 }
@@ -1751,12 +1739,15 @@ ${resultResponseCode}
 let invokeInboundTranslation = (fieldName: string) =>
   `${importUtil}
 export function request(ctx) {
+  const id = ctx.identity;
+  const isCognito = id != null && id.sub != null;
   return {
     operation: 'Invoke',
     payload: {
       __inboundTranslation: true,
       fieldName: '${fieldName}',
-      arguments: ctx.args
+      arguments: ctx.args,
+      ${callerIdentity}
     }
   };
 }

package/src/AppSync/AppSync_Resolver_Functions.res.mjs

@@ -1140,6 +1140,23 @@ export function request(ctx) {
 ` + resultResponseCode + `
 `;
 
+let callerIdentity = `identity: isCognito
+        ? {
+            userId: id.sub,
+            username: id.username,
+            groups: id.claims?.['cognito:groups'] ?? [],
+            claims: id.claims,
+            provider: 'Cognito'
+          }
+        : id != null
+          ? {
+              userArn: id.userArn ?? null,
+              accountId: id.accountId ?? null,
+              username: id.username ?? null,
+              provider: 'IAM'
+            }
+          : null`;
+
 function invokeCommandGenerator(command) {
   return importUtil + `
 export function request(ctx) {
@@ -1155,22 +1172,7 @@ export function request(ctx) {
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ` + callerIdentity + `
     }
   };
 }
@@ -1193,22 +1195,7 @@ export function request(ctx) {
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ` + callerIdentity + `
     }
   };
 }
@@ -1219,12 +1206,15 @@ export function request(ctx) {
 function invokeInboundTranslation(fieldName) {
   return importUtil + `
 export function request(ctx) {
+  const id = ctx.identity;
+  const isCognito = id != null && id.sub != null;
   return {
     operation: 'Invoke',
     payload: {
       __inboundTranslation: true,
       fieldName: '` + fieldName + `',
-      arguments: ctx.args
+      arguments: ctx.args,
+      ` + callerIdentity + `
     }
   };
 }
@@ -1355,6 +1345,7 @@ export {
   putItem,
   addItemToList,
   deleteItem,
+  callerIdentity,
   invokeCommandGenerator,
   invokeDcbMutation,
   invokeInboundTranslation,

package/tests/AppSync_Resolver_FunctionsTest.mjs

@@ -757,6 +757,28 @@ describe('invokeInboundTranslation', () => {
     expect(result.payload.fieldName).toBe('importProduct')
     expect(result.payload.arguments).toEqual({ csv: 'data' })
   })
+
+  // The Lambda checks each translated command against the caller's groups.
+  test('request carries the Cognito caller and its groups', () => {
+    const ctx = makeCtx({
+      identity: { username: 'alice', sub: 's1', sourceIp: [], claims: { 'cognito:groups': ['Merchandiser'] } },
+    })
+    const { payload } = request(ctx)
+    expect(payload.identity.userId).toBe('s1')
+    expect(payload.identity.groups).toEqual(['Merchandiser'])
+    expect(payload.identity.provider).toBe('Cognito')
+  })
+
+  test('request carries an IAM caller as IAM', () => {
+    const ctx = makeCtx({ identity: { userArn: 'arn:aws:iam::123:role/Sync', accountId: '123' } })
+    const { payload } = request(ctx)
+    expect(payload.identity.provider).toBe('IAM')
+  })
+
+  test('request emits null identity when ctx.identity is null', () => {
+    const { payload } = request(makeCtx({ identity: null }))
+    expect(payload.identity).toBeNull()
+  })
 })
 
 // ---------------------------------------------------------------------------