@reventlessdev/rescript-pulumi-aws 3.0.0-alpha.3 → 3.0.0-alpha.30

package/src/example/CustomDomainExample.res

@@ -18,9 +18,8 @@ let cert = Acm.Certificate.make(
   ~opts={provider: usEast1},
 )
 
-let firstValidationOption = cert.domainValidationOptions->Pulumi.Output.apply(opts =>
-  opts->Array.getUnsafe(0)
-)
+let firstValidationOption =
+  cert.domainValidationOptions->Pulumi.Output.apply(opts => opts->Array.getUnsafe(0))
 
 let validationRecord = Route53.Record.make(
   ~name="example-cert-validation",

package/src/example/MergedApiExample.res

@@ -8,9 +8,7 @@
 let mergedExecRole = IAM.Role.make(
   ~name="example-merged-exec-role",
   ~args={
-    assumeRolePolicy: Pulumi.Input.make(
-      `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`,
-    ),
+    assumeRolePolicy: Pulumi.Input.make(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`),
   },
 )
 

package/tests/AppSync_Resolver_FunctionsTest.mjs

@@ -148,7 +148,7 @@ describe('listAllItems', () => {
 })
 
 // ---------------------------------------------------------------------------
-// listAllItemsConnection — Phase 3 server-side filter/sort
+// listAllItemsConnection — server-side filter/sort
 // ---------------------------------------------------------------------------
 describe('listAllItemsConnection', () => {
   describe('default (no capability args)', () => {
@@ -158,7 +158,7 @@ describe('listAllItemsConnection', () => {
       const ctx = makeCtx({ args: {} })
       const result = request(ctx)
       expect(result.operation).toBe('Scan')
-      expect(result.limit).toBe(50)
+      expect(result.limit).toBe(51)
       expect(result.nextToken).toBeNull()
       expect(result.filter).toBeUndefined()
     })
@@ -193,13 +193,13 @@ describe('listAllItemsConnection', () => {
       expect(r.edges[0].node).toEqual({ id: 'a' })
       expect(r.pageInfo.hasNextPage).toBe(true)
       expect(r.pageInfo.hasPreviousPage).toBe(false)
-      // Fix 1: the cursor encodes the real nextToken, not a positional index.
-      expect(JSON.parse(util.base64Decode(r.pageInfo.endCursor)).token).toBe('next')
+      // The cursor encodes a real read window, not a positional index. The last row
+      // closed this one, so it names the window that follows.
+      expect(JSON.parse(util.base64Decode(r.pageInfo.endCursor)).t).toBe('next')
     })
 
-    // Fix 1 (docs/plans/done/aws-scan-connection-cursor-roundtrip.md): the cursor the
-    // response emits must decode back to the exact DynamoDB nextToken the request feeds
-    // to the next Scan. This is the round-trip that failed before the fix.
+    // The cursor the response emits must decode back to the DynamoDB nextToken the
+    // request feeds to the next Scan.
     test('endCursor round-trips: response endCursor → request nextToken', () => {
       const page1 = response(makeCtx({
         args: {},
@@ -209,17 +209,23 @@ describe('listAllItemsConnection', () => {
       expect(req2.nextToken).toBe('TOK1')
     })
 
+    // `hasPreviousPage` reports what this door can SERVE, not what exists. This
+    // cursor opens a new window at position 0, so the page before it lies in the
+    // previous window — real, and unreachable, because a continuation token
+    // cannot name the one before it. Claiming it is what drew a Prev button that
+    // always errored.
     test('final page (nextToken null) closes the connection', () => {
+      const after = util.base64Encode(JSON.stringify({ t: 'TOK1', n: -1 }))
       const r = response(makeCtx({
-        args: { after: 'x' },
+        args: { after },
         result: { items: [{ id: 'z' }], nextToken: null },
       }))
       expect(r.pageInfo.hasNextPage).toBe(false)
-      expect(r.pageInfo.hasPreviousPage).toBe(true)
+      expect(r.pageInfo.hasPreviousPage).toBe(false)
     })
 
-    // Fix 3: a filtered Scan can return an empty page while nextToken is still set.
-    // The boundary cursor must let the client resume instead of restarting page 1.
+    // A filtered Scan can return an empty page while nextToken is still set. The
+    // boundary cursor must let the client resume instead of restarting page 1.
     test('empty-but-continuable page yields a resumable boundary cursor', () => {
       const empty = response(makeCtx({
         args: {},
@@ -238,15 +244,173 @@ describe('listAllItemsConnection', () => {
       expect(r.pageInfo.hasNextPage).toBe(false)
     })
 
-    // Fix 2: Scan cannot page backward; last/before must error, not mislead.
-    test('request rejects backward pagination (before)', () => {
-      expect(() => request(makeCtx({ args: { before: 'x' } }))).toThrow(
-        'Backward pagination',
+    // `before` is served by re-reading the window the cursor names and cutting
+    // the page that ends at it. `last` is not: the last N rows of the list needs
+    // the END of the list, which a forward-only cursor cannot reach.
+    test('request rejects `last`, which needs the end of the list', () => {
+      expect(() => request(makeCtx({ args: { last: 5 } }))).toThrow('last is not supported')
+    })
+
+    test('a backward page is the page that precedes it, exactly', () => {
+      const items = Array.from({ length: 25 }, (_, i) => ({ id: 'r' + i }))
+      const page1 = response(makeCtx({ args: { first: 10 }, result: { items, nextToken: null } }))
+      const fwd = { args: { first: 10, after: page1.pageInfo.endCursor } }
+      const page2 = response(makeCtx({ ...fwd, result: { items, nextToken: null } }))
+      expect(page2.edges.map(e => e.node.id)).toEqual(items.slice(10, 20).map(i => i.id))
+
+      const back = { args: { first: 10, before: page2.pageInfo.startCursor } }
+      const prev = response(makeCtx({ ...back, result: { items, nextToken: null } }))
+      expect(prev.edges.map(e => e.node.id)).toEqual(page1.edges.map(e => e.node.id))
+      // Cut from ahead, so a next page provably exists — the one we came from.
+      expect(prev.pageInfo.hasNextPage).toBe(true)
+      expect(prev.pageInfo.hasPreviousPage).toBe(false)
+    })
+
+    // The read must reach `_upTo` rows into the window, not `first + from`, or the
+    // backward slice comes back with its tail missing.
+    test('a backward read examines the window as deep as the page it cuts', () => {
+      const before = util.base64Encode(JSON.stringify({ t: null, n: 30 }))
+      expect(request(makeCtx({ args: { first: 10, before } })).limit).toBe(30)
+    })
+
+    test('the window a backward cursor names is the one re-read', () => {
+      const before = util.base64Encode(JSON.stringify({ t: 'W7', n: 30 }))
+      expect(request(makeCtx({ args: { first: 10, before } })).nextToken).toBe('W7')
+    })
+
+    // The one page still out of reach, and the only case left refused.
+    test('a previous page in an earlier window is refused, and says which limit', () => {
+      const before = util.base64Encode(JSON.stringify({ t: 'W2', n: 0 }))
+      expect(() => request(makeCtx({ args: { first: 10, before } }))).toThrow(
+        'earlier read window',
       )
     })
 
-    test('request rejects backward pagination (last)', () => {
-      expect(() => request(makeCtx({ args: { last: 5 } }))).toThrow('Backward pagination')
+    // At the very start there is no earlier window to be unable to name, so a
+    // short backward page is served rather than refused.
+    test('a backward page at the start of the first window is served, not refused', () => {
+      const items = Array.from({ length: 10 }, (_, i) => ({ id: 'r' + i }))
+      const before = util.base64Encode(JSON.stringify({ t: null, n: 3 }))
+      const r = response(makeCtx({ args: { first: 10, before }, result: { items, nextToken: null } }))
+      expect(r.edges.map(e => e.node.id)).toEqual(['r0', 'r1', 'r2'])
+    })
+
+    // Cursors minted before the read window existed named the following window.
+    test('a pre-window { token, index } cursor still resumes', () => {
+      const legacy = util.base64Encode(JSON.stringify({ token: 'TOK9', index: 3 }))
+      const req = request(makeCtx({ args: { after: legacy } }))
+      expect(req.nextToken).toBe('TOK9')
+      const r = response(makeCtx({
+        args: { after: legacy },
+        result: { items: [{ id: 'a' }], nextToken: null },
+      }))
+      expect(r.edges).toHaveLength(1)
+    })
+  })
+
+  // The defect a selective filter turns into a visibly broken list: DynamoDB
+  // applies Limit before the FilterExpression, so reading `first` rows and
+  // returning the survivors spreads one matching row over several pages, most of
+  // them blank under a live Next button.
+  describe('reads a window, serves a page', () => {
+    const { request, response } = evalResolver(
+      F.listAllItemsConnection('name', [], [], [], undefined, 'customerId', ['Admin']),
+    )
+
+    // One row past the page: it is what says a next page exists.
+    test('an unfiltered read examines one row past the page it serves', () => {
+      const req = request(makeCtx({ args: { first: 25 }, identity: null }))
+      expect(req.filter).toBeUndefined()
+      expect(req.limit).toBe(26)
+    })
+
+    test('a filtered read examines a wider window than the page', () => {
+      const req = request(makeCtx({ args: { first: 25 } }))
+      expect(req.filter.expression).toBe('#owner = :owner')
+      expect(req.limit).toBe(1000)
+    })
+
+    test('a caller asking for more than the window gets what it asked for', () => {
+      expect(request(makeCtx({ args: { first: 5000 } })).limit).toBe(5001)
+    })
+
+    // The user-visible bug: one matching row must be one page, not three.
+    test('the matches of an exhausted window are a single closed page', () => {
+      const r = response(makeCtx({
+        args: { first: 50 },
+        result: { items: [{ id: 'mine' }], nextToken: null },
+      }))
+      expect(r.edges).toHaveLength(1)
+      expect(r.pageInfo.hasNextPage).toBe(false)
+    })
+
+    test('a window holding more matches than the page pages within itself', () => {
+      const items = [{ id: 'a' }, { id: 'b' }, { id: 'c' }, { id: 'd' }, { id: 'e' }]
+      const page1 = response(makeCtx({
+        args: { first: 2 },
+        result: { items, nextToken: 'W2' },
+      }))
+      expect(page1.edges.map(e => e.node.id)).toEqual(['a', 'b'])
+      expect(page1.pageInfo.hasNextPage).toBe(true)
+
+      // Same window, resumed past the rows already served — not the next window.
+      const req2 = request(makeCtx({ args: { first: 2, after: page1.pageInfo.endCursor } }))
+      expect(req2.nextToken).toBeNull()
+      const page2 = response(makeCtx({
+        args: { first: 2, after: page1.pageInfo.endCursor },
+        result: { items, nextToken: 'W2' },
+      }))
+      expect(page2.edges.map(e => e.node.id)).toEqual(['c', 'd'])
+
+      // The row that closes the window hands the next request the window after it.
+      const page3 = response(makeCtx({
+        args: { first: 2, after: page2.pageInfo.endCursor },
+        result: { items, nextToken: 'W2' },
+      }))
+      expect(page3.edges.map(e => e.node.id)).toEqual(['e'])
+      expect(page3.pageInfo.hasNextPage).toBe(true)
+      expect(
+        request(makeCtx({ args: { first: 2, after: page3.pageInfo.endCursor } })).nextToken,
+      ).toBe('W2')
+    })
+
+    // DynamoDB hands back a token whenever a read stops AT its limit, whether or
+    // not anything follows. A read of exactly the page therefore claimed a next
+    // page after the last full one, and it came back blank — found on a deployed
+    // list paged one row at a time. The mock pages a table the way DynamoDB does.
+    test('paging to the end serves no blank page, whatever the page size', () => {
+      const rows = ['a', 'b', 'c', 'd'].map(id => ({ id }))
+      const dynamo = req => {
+        const start = req.nextToken === null ? 0 : +req.nextToken
+        const items = rows.slice(start, start + req.limit)
+        const stoppedAtLimit = items.length === req.limit
+        return { items, nextToken: stoppedAtLimit ? String(start + req.limit) : null }
+      }
+      ;[1, 2, 4].map(first => {
+        const pages = []
+        let after
+        for (let i = 0; i < 10; i++) {
+          const args = after === undefined ? { first } : { first, after }
+          const r = response(makeCtx({ args, result: dynamo(request(makeCtx({ args, identity: null }))) }))
+          pages.push(r.edges.map(e => e.node.id))
+          if (!r.pageInfo.hasNextPage) break
+          after = r.pageInfo.endCursor
+        }
+        expect(pages.flat()).toEqual(['a', 'b', 'c', 'd'])
+        expect(pages.every(p => p.length > 0)).toBe(true)
+        expect(pages).toHaveLength(Math.ceil(4 / first))
+      })
+    })
+
+    // Without this the final row of a window resumes into a window with nothing
+    // left in it, which is the blank page again one step later.
+    test('the last row of a page that closes its window names the next window', () => {
+      const r = response(makeCtx({
+        args: { first: 2 },
+        result: { items: [{ id: 'a' }, { id: 'b' }], nextToken: 'W2' },
+      }))
+      expect(JSON.parse(util.base64Decode(r.edges[1].cursor))).toEqual({ t: 'W2', n: -1 })
+      expect(JSON.parse(util.base64Decode(r.edges[0].cursor))).toEqual({ t: null, n: 0 })
     })
   })
 
@@ -452,7 +616,7 @@ describe('queryByIndexSortFiltered', () => {
     expect(result.query.expression).toBe('#ownerId = :ownerId')
     expect(result.filter).toBeUndefined()
     expect(result.index).toBe('ownerId')
-    expect(result.limit).toBe(50)
+    expect(result.limit).toBe(51)
   })
 
   test('query includes sortField when present', () => {
@@ -622,6 +786,28 @@ describe('invokeInboundTranslation', () => {
     expect(result.payload.fieldName).toBe('importProduct')
     expect(result.payload.arguments).toEqual({ csv: 'data' })
   })
+
+  // The Lambda checks each translated command against the caller's groups.
+  test('request carries the Cognito caller and its groups', () => {
+    const ctx = makeCtx({
+      identity: { username: 'alice', sub: 's1', sourceIp: [], claims: { 'cognito:groups': ['Merchandiser'] } },
+    })
+    const { payload } = request(ctx)
+    expect(payload.identity.userId).toBe('s1')
+    expect(payload.identity.groups).toEqual(['Merchandiser'])
+    expect(payload.identity.provider).toBe('Cognito')
+  })
+
+  test('request carries an IAM caller as IAM', () => {
+    const ctx = makeCtx({ identity: { userArn: 'arn:aws:iam::123:role/Sync', accountId: '123' } })
+    const { payload } = request(ctx)
+    expect(payload.identity.provider).toBe('IAM')
+  })
+
+  test('request emits null identity when ctx.identity is null', () => {
+    const { payload } = request(makeCtx({ identity: null }))
+    expect(payload.identity).toBeNull()
+  })
 })
 
 // ---------------------------------------------------------------------------
@@ -669,11 +855,9 @@ describe('authorizeIndexedAccess', () => {
 // ---------------------------------------------------------------------------
 // listAllItemsConnection — @owner scoping
 // ---------------------------------------------------------------------------
-// This is the one read path with no Lambda in it: the predicate lives in
-// generated JS that AppSync runs directly, so it shares no code with the three
-// paths the ReScript suites cover. Evaluating the emitted source here is the
-// strongest check available short of a deployed stack, and the only one that
-// can catch an APPSYNC_JS-hostile construct or a mis-ordered branch.
+// The one read path with no Lambda in it — the predicate is generated JS that
+// AppSync runs directly, sharing no code with the paths the ReScript suites
+// cover. Evaluating the emitted source is the strongest check short of a deploy.
 describe('listAllItemsConnection — owner scoping', () => {
   // (labelField, filterFields, rangeFields, sortFields, requireAttribute,
   //  ownerField, elevatedGroups)
@@ -757,16 +941,225 @@ describe('listAllItemsConnection — owner scoping', () => {
     const r = request(makeCtx({ args: {}, identity: asUser('ops-1', ['Admin']) }))
     expect(r.filter.expressionValues[':owner']).toEqual({ S: 'ops-1' })
   })
+
+  // ── The same identities, once the scope has an index to read ──────────────
+  //
+  // The predicate moves from the FilterExpression to a key condition, so who is
+  // narrowed and who is not now selects a different PHYSICAL READ. The defect
+  // class this guards against was invisible precisely because each path was
+  // individually correct — so the identity table runs over both, rather than a
+  // parallel suite growing beside it.
+  //
+  // (labelField, filterFields, rangeFields, sortFields, requireAttribute,
+  //  ownerField, elevatedGroups, retiredField, retiredValues,
+  //  ownerIndex, ownerIndexSortField)
+  const indexed = () =>
+    evalResolver(
+      F.listAllItemsConnection(
+        'name', ['status'], [], [], undefined, 'customerId', ['Admin'],
+        undefined, undefined, '_owner', 'id',
+      ),
+    )
+
+  const identities = [
+    ['a plain caller', asUser('cust-a'), 'Query'],
+    ['a caller in an elevated group', asUser('ops-1', ['Admin']), 'Scan'],
+    ['an IAM-shaped identity with no sub', { userArn: 'arn:aws:sts::1:x', username: 'Ing' }, 'Scan'],
+    ['a wholly absent identity', null, 'Scan'],
+  ]
+
+  test.each(identities)('%s reads through the operation its scope implies', (_, identity, op) => {
+    const { request } = indexed()
+    expect(request(makeCtx({ args: {}, identity })).operation).toBe(op)
+  })
+
+  test('a scoped caller is keyed on their own id, not filtered on it', () => {
+    const { request } = indexed()
+    const r = request(makeCtx({ args: {}, identity: asUser('cust-a') }))
+    expect(r.index).toBe('_owner')
+    expect(r.query.expression).toBe('#owner = :owner')
+    expect(r.query.expressionNames['#owner']).toBe('customerId')
+    expect(r.query.expressionValues[':owner']).toEqual({ S: 'cust-a' })
+    // The whole point: no owner clause survives anywhere in the filter. A copy
+    // left there would be a second, redundant predicate — and an expressionName
+    // the filter no longer references is a ValidationException.
+    expect(r.filter).toBeUndefined()
+  })
+
+  // The elevated read is the one that must not have changed: it is the same
+  // request the unindexed resolver builds, argument for argument.
+  test.each([
+    ['an elevated caller', asUser('ops-1', ['Admin'])],
+    ['an IAM service caller', { userArn: 'arn:aws:sts::1:x', username: 'Ing' }],
+  ])("%s's read is unchanged by the index existing", (_, identity) => {
+    const before = evalResolver(
+      F.listAllItemsConnection('name', ['status'], [], [], undefined, 'customerId', ['Admin']),
+    ).request(makeCtx({ args: { first: 20, filter: { statusEq: 'Placed' } }, identity }))
+    const after = indexed().request(
+      makeCtx({ args: { first: 20, filter: { statusEq: 'Placed' } }, identity }),
+    )
+    expect(after).toEqual(before)
+  })
+
+  // The read window exists because a FilterExpression cuts rows AFTER `Limit`.
+  // A key condition does not, so a scoped caller with no filter of their own
+  // examines the page they asked for and the one row that says whether another
+  // follows — the arithmetic the window was hiding, gone rather than papered over.
+  test('a scoped caller with no filter examines only the page, plus one', () => {
+    const { request } = indexed()
+    expect(request(makeCtx({ args: { first: 25 }, identity: asUser('cust-a') })).limit).toBe(26)
+  })
+
+  test("a scoped caller's own filter still widens the window", () => {
+    const { request } = indexed()
+    const r = request(
+      makeCtx({ args: { first: 25, filter: { statusEq: 'Placed' } }, identity: asUser('cust-a') }),
+    )
+    expect(r.limit).toBe(1000)
+    expect(r.filter.expression).toBe('#status = :statusEq')
+  })
+
+  // Both branches are reachable by the SAME caller across requests — an active
+  // role switch mid-pagination flips `_exempt`. A `nextToken` continues the
+  // operation that minted it, so replaying one on the other branch would answer
+  // a different question in silence.
+  describe('the cursor path tag', () => {
+    const { request, response } = indexed()
+    const pageFor = identity =>
+      response(makeCtx({
+        args: {},
+        identity,
+        result: { items: [{ id: 'a' }], nextToken: 'TOK' },
+      })).pageInfo.endCursor
+
+    test('a Scan cursor replayed on the Query branch is refused', () => {
+      const scanCursor = pageFor(asUser('ops-1', ['Admin']))
+      expect(() =>
+        request(makeCtx({ args: { after: scanCursor }, identity: asUser('cust-a') })),
+      ).toThrow('different read of this list')
+    })
+
+    test('a Query cursor replayed on the Scan branch is refused', () => {
+      const queryCursor = pageFor(asUser('cust-a'))
+      expect(() =>
+        request(makeCtx({ args: { after: queryCursor }, identity: asUser('ops-1', ['Admin']) })),
+      ).toThrow('different read of this list')
+    })
+
+    test('each branch resumes its own cursor', () => {
+      expect(
+        request(makeCtx({ args: { after: pageFor(asUser('cust-a')) }, identity: asUser('cust-a') }))
+          .nextToken,
+      ).toBe('TOK')
+      const ops = asUser('ops-1', ['Admin'])
+      expect(request(makeCtx({ args: { after: pageFor(ops) }, identity: ops })).nextToken).toBe('TOK')
+    })
+
+    // Cursors minted before the tag existed all came off a Scan, and the callers
+    // holding one are the exempt callers whose read did not change.
+    test('an untagged cursor still resumes the Scan branch', () => {
+      const legacy = util.base64Encode(JSON.stringify({ t: 'TOK9', n: 2 }))
+      const ops = asUser('ops-1', ['Admin'])
+      expect(request(makeCtx({ args: { after: legacy }, identity: ops })).nextToken).toBe('TOK9')
+    })
+  })
+
+  // Ordering on the index's own sort key is `ScanIndexForward`'s job across the
+  // caller's whole partition. Re-sorting the page in JS afterwards is the one
+  // way to BREAK that order — a sort over a page is not a sort over the rows.
+  describe('orderBy on the index sort key', () => {
+    const sorted = () =>
+      evalResolver(
+        F.listAllItemsConnection(
+          'name', [], [], ['id', 'placedAt'], undefined, 'customerId', ['Admin'],
+          undefined, undefined, '_owner', 'id',
+        ),
+      )
+    const items = [{ id: 'c' }, { id: 'a' }, { id: 'b' }]
+    const scoped = asUser('cust-a')
+
+    test('DESC flips scanIndexForward instead of reversing a page', () => {
+      const { request } = sorted()
+      const args = { orderBy: { field: 'id', direction: 'DESC' } }
+      expect(request(makeCtx({ args, identity: scoped })).scanIndexForward).toBe(false)
+      expect(
+        request(makeCtx({ args: { orderBy: { field: 'id', direction: 'ASC' } }, identity: scoped }))
+          .scanIndexForward,
+      ).toBe(true)
+    })
+
+    test('the page DynamoDB ordered is handed back untouched', () => {
+      const { response } = sorted()
+      const r = response(makeCtx({
+        args: { orderBy: { field: 'id', direction: 'ASC' } },
+        identity: scoped,
+        result: { items, nextToken: null },
+      }))
+      expect(r.edges.map(e => e.node.id)).toEqual(['c', 'a', 'b'])
+    })
+
+    test('any other sort field still sorts in JS', () => {
+      const { response } = sorted()
+      const r = response(makeCtx({
+        args: { orderBy: { field: 'placedAt', direction: 'ASC' } },
+        identity: scoped,
+        result: { items: [{ placedAt: 'z' }, { placedAt: 'a' }], nextToken: null },
+      }))
+      expect(r.edges.map(e => e.node.placedAt)).toEqual(['a', 'z'])
+    })
+
+    // The exempt caller Scans, which has no ordering of its own, so the per-page
+    // sort is still the only order they get.
+    test('an exempt caller keeps the per-page sort on the same field', () => {
+      const { response } = sorted()
+      const r = response(makeCtx({
+        args: { orderBy: { field: 'id', direction: 'ASC' } },
+        identity: asUser('ops-1', ['Admin']),
+        result: { items, nextToken: null },
+      }))
+      expect(r.edges.map(e => e.node.id)).toEqual(['a', 'b', 'c'])
+    })
+  })
+
+  // Backward paging works the same way on both branches, and for the same reason:
+  // it re-reads the window the cursor names and cuts the page ending at it, which
+  // is operation-agnostic. `last` stays refused on both — it needs the end of the
+  // list, which neither a Scan nor this Query's cursor can reach.
+  test.each([['scoped', asUser('cust-a')], ['exempt', asUser('ops-1', ['Admin'])]])(
+    'a %s caller is still refused `last`',
+    (_, identity) => {
+      const { request } = indexed()
+      expect(() => request(makeCtx({ args: { last: 5 }, identity }))).toThrow(
+        'last is not supported',
+      )
+    },
+  )
+
+  // The path tag has to survive the direction change: a backward cursor still
+  // names the read that minted it, and replaying it on the other branch is the
+  // same mistake as replaying a forward one.
+  test('a backward cursor is path-checked like a forward one', () => {
+    const { request, response } = indexed()
+    const scopedPage = response(makeCtx({
+      args: { first: 10 },
+      identity: asUser('cust-a'),
+      result: { items: Array.from({ length: 10 }, (_, i) => ({ id: 'r' + i })), nextToken: null },
+    }))
+    expect(() =>
+      request(makeCtx({
+        args: { first: 10, before: scopedPage.pageInfo.endCursor },
+        identity: asUser('ops-1', ['Admin']),
+      })),
+    ).toThrow('different read of this list')
+  })
 })
 
 // ---------------------------------------------------------------------------
 // By-key reads — owner scoping
 // ---------------------------------------------------------------------------
-// The list resolver above carried the predicate while these did not, so a caller
-// narrowed to their own rows could still read any row they could name. These
-// cases pin the guard in the place it has to live: the response, since a GetItem
-// has no FilterExpression, and null rather than an error, which is what the
-// in-process platform answers and what does not confirm the row exists.
+// The list resolver carried the predicate while these did not, so a caller
+// narrowed to their own rows could still read any row they could name. The guard
+// belongs in the response — GetItem has no FilterExpression — and answers null.
 describe('getItemById / queryByIdSort — owner scoping', () => {
   const asUser = (sub, groups = []) => ({
     username: sub,