@reventlessdev/rescript-pulumi-aws 3.0.0-alpha.25 → 3.0.0-alpha.27

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.27 (2026-10-10)
+
+### Bug Fixes
+
+* **pulumi-aws:** a list's last page no longer promises another ([00b141f](https://github.com/ReventlessDev/reventless-core/commit/00b141fbfdbf44544fbea8ab979356831381f48a))
+
+
+# 3.0.0-alpha.26 (2026-10-10)
+
+### Bug Fixes
+
+* an inbound translation is gated alike on every door, and encodes its commands by schema ([6ec3ce6](https://github.com/ReventlessDev/reventless-core/commit/6ec3ce672e53e2c162c64a90d103be691391be5e))
+
+
 # 3.0.0-alpha.25 (2026-10-08)
 
 **Note:** Version bump only for package @reventlessdev/rescript-pulumi-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/rescript-pulumi-aws",
-  "version": "3.0.0-alpha.25",
+  "version": "3.0.0-alpha.27",
   "description": "ReScript bindings for @pulumi/aws",
   "license": "Apache-2.0",
   "jest": {
@@ -22,8 +22,8 @@
     "@pulumi/aws": "~7.19.0",
     "@pulumi/aws-native": "^1.62.0",
     "sury": "11.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.30",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.30",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23"
   },
   "devDependencies": {

package/src/AppSync/AppSync_Resolver_Functions.res

@@ -564,19 +564,24 @@ the survivors serves short — usually empty — pages under a selective filter.
 no loops in APPSYNC_JS the door reads wider instead and addresses the surplus by
 position. 1 MB caps a page anyway, hence 1000; `filtered` is the JS expression
 saying whether a filter was pushed down.
+
+An unfiltered read takes one row past the page. DynamoDB hands back a token
+whenever it stops AT the limit, end of data or not, so a read of exactly the page
+reports a next page that comes back blank; the extra row is what says one exists.
 */
 let pageWindowBudget = (~filtered: string) =>
-  `(${filtered} ? (_first > 1000 ? _first : 1000) : _first + _from)`
+  `(${filtered} ? (_first > 1000 ? _first : 1000) : _first + _from + 1)`
 
 /**
 The same budget for the full-list door, which may also read backward.
 
 A backward page is the slice `[_from, _upTo)` of the window, so the read has to
 reach `_upTo` rows into it — `_first + _from` would stop short and hand back a
-page with its tail missing.
+page with its tail missing. Forward reads one row past the page, for the reason
+`pageWindowBudget` gives; a backward page needs none, as one provably follows it.
 */
 let listPageWindowBudget = {
-  let need = "(_backward ? _upTo : _first + _from)"
+  let need = "(_backward ? _upTo : _first + _from + 1)"
   `(parts.length > 0 ? (${need} > 1000 ? ${need} : 1000) : ${need})`
 }
 
@@ -1671,6 +1676,24 @@ ${resultResponseCode}
 // Lambda invocations
 // ---------------------------------------------------------------------------
 
+// The caller as a command Lambda reads it: a Cognito user, an IAM principal, or null.
+let callerIdentity = `identity: isCognito
+        ? {
+            userId: id.sub,
+            username: id.username,
+            groups: id.claims?.['cognito:groups'] ?? [],
+            claims: id.claims,
+            provider: 'Cognito'
+          }
+        : id != null
+          ? {
+              userArn: id.userArn ?? null,
+              accountId: id.accountId ?? null,
+              username: id.username ?? null,
+              provider: 'IAM'
+            }
+          : null`
+
 /** Invoke a CommandGenerator Lambda. `command` is the Aggregate command name. */
 let invokeCommandGenerator = (command: string) =>
   `${importUtil}
@@ -1687,22 +1710,7 @@ export function request(ctx) {
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ${callerIdentity}
     }
   };
 }
@@ -1725,22 +1733,7 @@ export function request(ctx) {
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ${callerIdentity}
     }
   };
 }
@@ -1751,12 +1744,15 @@ ${resultResponseCode}
 let invokeInboundTranslation = (fieldName: string) =>
   `${importUtil}
 export function request(ctx) {
+  const id = ctx.identity;
+  const isCognito = id != null && id.sub != null;
   return {
     operation: 'Invoke',
     payload: {
       __inboundTranslation: true,
       fieldName: '${fieldName}',
-      arguments: ctx.args
+      arguments: ctx.args,
+      ${callerIdentity}
     }
   };
 }

package/src/AppSync/AppSync_Resolver_Functions.res.mjs

@@ -389,10 +389,10 @@ export function request(ctx) {
 }
 
 function pageWindowBudget(filtered) {
-  return `(` + filtered + ` ? (_first > 1000 ? _first : 1000) : _first + _from)`;
+  return `(` + filtered + ` ? (_first > 1000 ? _first : 1000) : _first + _from + 1)`;
 }
 
-let need = "(_backward ? _upTo : _first + _from)";
+let need = "(_backward ? _upTo : _first + _from + 1)";
 
 let listPageWindowBudget = `(parts.length > 0 ? (` + need + ` > 1000 ? ` + need + ` : 1000) : ` + need + `)`;
 
@@ -528,7 +528,7 @@ export function request(ctx) {
     operation: 'Query',
     query,
     index: '` + index + `',
-    limit: ` + (`(` + "expression" + ` ? (_first > 1000 ? _first : 1000) : _first + _from)`) + `,
+    limit: ` + (`(` + "expression" + ` ? (_first > 1000 ? _first : 1000) : _first + _from + 1)`) + `,
     nextToken: _window,
     scanIndexForward: (args.forward ?? true)
   };
@@ -585,7 +585,7 @@ export function request(ctx) {
     operation: 'Query',
     query,
     index: '` + index + `',
-    limit: ` + (`(` + "expression" + ` ? (_first > 1000 ? _first : 1000) : _first + _from)`) + `,
+    limit: ` + (`(` + "expression" + ` ? (_first > 1000 ? _first : 1000) : _first + _from + 1)`) + `,
     nextToken: _window,
     scanIndexForward: (args.forward ?? true)
   };
@@ -1140,6 +1140,23 @@ export function request(ctx) {
 ` + resultResponseCode + `
 `;
 
+let callerIdentity = `identity: isCognito
+        ? {
+            userId: id.sub,
+            username: id.username,
+            groups: id.claims?.['cognito:groups'] ?? [],
+            claims: id.claims,
+            provider: 'Cognito'
+          }
+        : id != null
+          ? {
+              userArn: id.userArn ?? null,
+              accountId: id.accountId ?? null,
+              username: id.username ?? null,
+              provider: 'IAM'
+            }
+          : null`;
+
 function invokeCommandGenerator(command) {
   return importUtil + `
 export function request(ctx) {
@@ -1155,22 +1172,7 @@ export function request(ctx) {
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ` + callerIdentity + `
     }
   };
 }
@@ -1193,22 +1195,7 @@ export function request(ctx) {
         user: id?.username ?? null,
         info: ctx.info.parentTypeName + '.' + ctx.info.fieldName
       },
-      identity: isCognito
-        ? {
-            userId: id.sub,
-            username: id.username,
-            groups: id.claims?.['cognito:groups'] ?? [],
-            claims: id.claims,
-            provider: 'Cognito'
-          }
-        : id != null
-          ? {
-              userArn: id.userArn ?? null,
-              accountId: id.accountId ?? null,
-              username: id.username ?? null,
-              provider: 'IAM'
-            }
-          : null
+      ` + callerIdentity + `
     }
   };
 }
@@ -1219,12 +1206,15 @@ export function request(ctx) {
 function invokeInboundTranslation(fieldName) {
   return importUtil + `
 export function request(ctx) {
+  const id = ctx.identity;
+  const isCognito = id != null && id.sub != null;
   return {
     operation: 'Invoke',
     payload: {
       __inboundTranslation: true,
       fieldName: '` + fieldName + `',
-      arguments: ctx.args
+      arguments: ctx.args,
+      ` + callerIdentity + `
     }
   };
 }
@@ -1355,6 +1345,7 @@ export {
   putItem,
   addItemToList,
   deleteItem,
+  callerIdentity,
   invokeCommandGenerator,
   invokeDcbMutation,
   invokeInboundTranslation,

package/tests/AppSync_Resolver_FunctionsTest.mjs

@@ -158,7 +158,7 @@ describe('listAllItemsConnection', () => {
       const ctx = makeCtx({ args: {} })
       const result = request(ctx)
       expect(result.operation).toBe('Scan')
-      expect(result.limit).toBe(50)
+      expect(result.limit).toBe(51)
       expect(result.nextToken).toBeNull()
       expect(result.filter).toBeUndefined()
     })
@@ -317,10 +317,11 @@ describe('listAllItemsConnection', () => {
       F.listAllItemsConnection('name', [], [], [], undefined, 'customerId', ['Admin']),
     )
 
-    test('an unfiltered read examines exactly the page it serves', () => {
+    // One row past the page: it is what says a next page exists.
+    test('an unfiltered read examines one row past the page it serves', () => {
       const req = request(makeCtx({ args: { first: 25 }, identity: null }))
       expect(req.filter).toBeUndefined()
-      expect(req.limit).toBe(25)
+      expect(req.limit).toBe(26)
     })
 
     test('a filtered read examines a wider window than the page', () => {
@@ -330,7 +331,7 @@ describe('listAllItemsConnection', () => {
     })
 
     test('a caller asking for more than the window gets what it asked for', () => {
-      expect(request(makeCtx({ args: { first: 5000 } })).limit).toBe(5000)
+      expect(request(makeCtx({ args: { first: 5000 } })).limit).toBe(5001)
     })
 
     // The user-visible bug: one matching row must be one page, not three.
@@ -373,6 +374,34 @@ describe('listAllItemsConnection', () => {
       ).toBe('W2')
     })
 
+    // DynamoDB hands back a token whenever a read stops AT its limit, whether or
+    // not anything follows. A read of exactly the page therefore claimed a next
+    // page after the last full one, and it came back blank — found on a deployed
+    // list paged one row at a time. The mock pages a table the way DynamoDB does.
+    test('paging to the end serves no blank page, whatever the page size', () => {
+      const rows = ['a', 'b', 'c', 'd'].map(id => ({ id }))
+      const dynamo = req => {
+        const start = req.nextToken === null ? 0 : +req.nextToken
+        const items = rows.slice(start, start + req.limit)
+        const stoppedAtLimit = items.length === req.limit
+        return { items, nextToken: stoppedAtLimit ? String(start + req.limit) : null }
+      }
+      ;[1, 2, 4].map(first => {
+        const pages = []
+        let after
+        for (let i = 0; i < 10; i++) {
+          const args = after === undefined ? { first } : { first, after }
+          const r = response(makeCtx({ args, result: dynamo(request(makeCtx({ args, identity: null }))) }))
+          pages.push(r.edges.map(e => e.node.id))
+          if (!r.pageInfo.hasNextPage) break
+          after = r.pageInfo.endCursor
+        }
+        expect(pages.flat()).toEqual(['a', 'b', 'c', 'd'])
+        expect(pages.every(p => p.length > 0)).toBe(true)
+        expect(pages).toHaveLength(Math.ceil(4 / first))
+      })
+    })
+
     // Without this the final row of a window resumes into a window with nothing
     // left in it, which is the blank page again one step later.
     test('the last row of a page that closes its window names the next window', () => {
@@ -587,7 +616,7 @@ describe('queryByIndexSortFiltered', () => {
     expect(result.query.expression).toBe('#ownerId = :ownerId')
     expect(result.filter).toBeUndefined()
     expect(result.index).toBe('ownerId')
-    expect(result.limit).toBe(50)
+    expect(result.limit).toBe(51)
   })
 
   test('query includes sortField when present', () => {
@@ -757,6 +786,28 @@ describe('invokeInboundTranslation', () => {
     expect(result.payload.fieldName).toBe('importProduct')
     expect(result.payload.arguments).toEqual({ csv: 'data' })
   })
+
+  // The Lambda checks each translated command against the caller's groups.
+  test('request carries the Cognito caller and its groups', () => {
+    const ctx = makeCtx({
+      identity: { username: 'alice', sub: 's1', sourceIp: [], claims: { 'cognito:groups': ['Merchandiser'] } },
+    })
+    const { payload } = request(ctx)
+    expect(payload.identity.userId).toBe('s1')
+    expect(payload.identity.groups).toEqual(['Merchandiser'])
+    expect(payload.identity.provider).toBe('Cognito')
+  })
+
+  test('request carries an IAM caller as IAM', () => {
+    const ctx = makeCtx({ identity: { userArn: 'arn:aws:iam::123:role/Sync', accountId: '123' } })
+    const { payload } = request(ctx)
+    expect(payload.identity.provider).toBe('IAM')
+  })
+
+  test('request emits null identity when ctx.identity is null', () => {
+    const { payload } = request(makeCtx({ identity: null }))
+    expect(payload.identity).toBeNull()
+  })
 })
 
 // ---------------------------------------------------------------------------
@@ -952,11 +1003,11 @@ describe('listAllItemsConnection — owner scoping', () => {
 
   // The read window exists because a FilterExpression cuts rows AFTER `Limit`.
   // A key condition does not, so a scoped caller with no filter of their own
-  // examines exactly the page they asked for — the arithmetic the window was
-  // hiding, gone rather than papered over.
-  test('a scoped caller with no filter examines exactly the page', () => {
+  // examines the page they asked for and the one row that says whether another
+  // follows — the arithmetic the window was hiding, gone rather than papered over.
+  test('a scoped caller with no filter examines only the page, plus one', () => {
     const { request } = indexed()
-    expect(request(makeCtx({ args: { first: 25 }, identity: asUser('cust-a') })).limit).toBe(25)
+    expect(request(makeCtx({ args: { first: 25 }, identity: asUser('cust-a') })).limit).toBe(26)
   })
 
   test("a scoped caller's own filter still widens the window", () => {