@reventlessdev/reventless-aws 3.0.0-alpha.172 → 3.0.0-alpha.174

package/src/components/Api/AppSync_Adapter.res

@@ -266,6 +266,21 @@ let getClient = () =>
 // reaching request is already authenticated). `AllowGroups([])` and
 // `DenyAll` emit a sentinel `__deny_all__` group that no Cognito user can
 // belong to — effectively blocking the field at the API layer.
+//
+// ── Dual-auth (Cognito + IAM) for deploy-time system callers ────────────────
+// A field flagged `systemCallable` (via `mutationSchemaEntry`/`querySchemaEntry`)
+// must be reachable by BOTH the console UI (Cognito) and a deploy-time system
+// caller signing SigV4 with ambient AWS credentials (`Util_AppSync_Caller`,
+// the AWS_IAM additional auth provider). `@aws_auth(...)` is the single-mode
+// directive form and does not admit IAM on a multi-auth API. For these fields
+// we emit the multi-auth form instead:
+//   @aws_cognito_user_pools(cognito_groups: [...]) @aws_iam
+// The Cognito arm preserves the field's existing group gating (or, when the
+// field carries no Cognito group restriction, a bare `@aws_cognito_user_pools`
+// keeps it open to any authenticated Cognito user); the `@aws_iam` arm admits
+// the system caller. IAM access must be constrained by the API resource policy
+// and a least-privilege deploy-role policy — see
+// `docs/guides/appsync-iam-system-caller.md`.
 
 let _permissionToCognitoGroups = (
   permission: Reventless.Authorization.permission,
@@ -282,6 +297,20 @@ let _formatGroupsDirective = (groups: array<string>): string => {
   `@aws_auth(cognito_groups: [${quoted}])`
 }
 
+// Multi-auth directive for a field that must accept BOTH Cognito and IAM.
+// `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps the
+// field open to any authenticated Cognito user. `@aws_iam` admits the
+// deploy-time SigV4 system caller. See the dual-auth note above.
+let _formatDualAuthDirective = (groups: option<array<string>>): string => {
+  let cognito = switch groups {
+  | Some(g) =>
+    let quoted = g->Array.map(x => `"${x}"`)->Array.join(", ")
+    `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
+  | None => `@aws_cognito_user_pools`
+  }
+  `${cognito} @aws_iam`
+}
+
 let injectAwsAuth = (
   fragment: Reventless.Plugin.apiSchemaFragment,
   ~mutationEntries: array<ReventlessInfra.Api.mutationSchemaEntry>,
@@ -292,8 +321,16 @@ let injectAwsAuth = (
   // Build authorization lookup from mutation entries: fieldName -> groups.
   // Spec-level `fieldPermissions` takes precedence over the legacy
   // `authorization.group` per-entry single-group form.
+  // Fields opted into deploy-time IAM invocation (dual-auth). Membership here
+  // switches a field from the single-mode `@aws_auth` form to the multi-auth
+  // `@aws_cognito_user_pools(...) @aws_iam` form.
+  let iamFields: Dict.t<bool> = Dict.make()
+
   let mutationAuthMap: Dict.t<array<string>> = Dict.make()
   mutationEntries->Array.forEach(entry => {
+    if entry.systemCallable->Option.getOr(false) {
+      entry.fieldNames->Array.forEach(fieldName => iamFields->Dict.set(fieldName, true))
+    }
     switch entry.authorization {
     | Some({group}) =>
       entry.fieldNames->Array.forEach(fieldName =>
@@ -319,6 +356,10 @@ let injectAwsAuth = (
   // Spec-level `permission` takes precedence over the legacy authorization.
   let queryAuthMap: Dict.t<array<string>> = Dict.make()
   queryEntries->Array.forEach(entry => {
+    if entry.systemCallable->Option.getOr(false) {
+      iamFields->Dict.set(entry.singleFieldName, true)
+      iamFields->Dict.set(entry.listFieldName, true)
+    }
     switch entry.authorization {
     | Some({group}) =>
       queryAuthMap->Dict.set(entry.singleFieldName, [group])
@@ -341,17 +382,27 @@ let injectAwsAuth = (
 
   let augmentedMutations = parts.mutations->Array.map(field => {
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
-    switch mutationAuthMap->Dict.get(fieldName) {
-    | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
-    | None => field
+    let groups = mutationAuthMap->Dict.get(fieldName)
+    if iamFields->Dict.get(fieldName)->Option.getOr(false) {
+      `${field}\n    ${_formatDualAuthDirective(groups)}`
+    } else {
+      switch groups {
+      | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
+      | None => field
+      }
     }
   })
 
   let augmentedQueries = parts.queries->Array.map(field => {
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
-    switch queryAuthMap->Dict.get(fieldName) {
-    | Some(groups) => `${field} ${_formatGroupsDirective(groups)}`
-    | None => field
+    let groups = queryAuthMap->Dict.get(fieldName)
+    if iamFields->Dict.get(fieldName)->Option.getOr(false) {
+      `${field} ${_formatDualAuthDirective(groups)}`
+    } else {
+      switch groups {
+      | Some(groups) => `${field} ${_formatGroupsDirective(groups)}`
+      | None => field
+      }
     }
   })
 
@@ -374,17 +425,30 @@ let injectAwsAuth = (
 // Injects @aws_auth with the given group on ALL mutation, query, and subscription
 // fields in a fragment. Used for the base fragment where all fields share the
 // same authorization group.
+//
+// `~iamFieldNames` opts the named mutation/query fields into deploy-time IAM
+// (dual-auth): those fields emit `@aws_cognito_user_pools(cognito_groups:
+// ["<group>"]) @aws_iam` instead of the single-mode `@aws_auth(...)`, keeping
+// the same Cognito group gating while also admitting the SigV4 system caller.
+// Subscriptions are never IAM-marked (the deploy caller does not subscribe).
 let injectAwsAuthAll = (
   fragment: Reventless.Plugin.apiSchemaFragment,
   ~group: string,
+  ~iamFieldNames: array<string>=[],
 ): Reventless.Plugin.apiSchemaFragment => {
   let parts = ReventlessCore.GraphQL_Stitcher.decode(fragment)
+  let isIam = (field: string): bool =>
+    iamFieldNames->Array.includes(ReventlessCore.GraphQL_Stitcher.extractLeadingName(field))
 
   let augmentedMutations = parts.mutations->Array.map(field =>
-    `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
+    isIam(field)
+      ? `${field}\n    ${_formatDualAuthDirective(Some([group]))}`
+      : `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
   )
   let augmentedQueries = parts.queries->Array.map(field =>
-    `${field} @aws_auth(cognito_groups: ["${group}"])`
+    isIam(field)
+      ? `${field} ${_formatDualAuthDirective(Some([group]))}`
+      : `${field} @aws_auth(cognito_groups: ["${group}"])`
   )
   let augmentedSubscriptions = parts.subscriptions->Array.map(field =>
     `${field}\n    @aws_auth(cognito_groups: ["${group}"])`

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -204,10 +204,27 @@ function _formatGroupsDirective(groups) {
   return `@aws_auth(cognito_groups: [` + quoted + `])`;
 }
 
+function _formatDualAuthDirective(groups) {
+  let cognito;
+  if (groups !== undefined) {
+    let quoted = groups.map(x => `"` + x + `"`).join(", ");
+    cognito = `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
+  } else {
+    cognito = `@aws_cognito_user_pools`;
+  }
+  return cognito + ` @aws_iam`;
+}
+
 function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
+  let iamFields = {};
   let mutationAuthMap = {};
   mutationEntries.forEach(entry => {
+    if (Stdlib_Option.getOr(entry.systemCallable, false)) {
+      entry.fieldNames.forEach(fieldName => {
+        iamFields[fieldName] = true;
+      });
+    }
     let match = entry.authorization;
     if (match !== undefined) {
       let group = match.group;
@@ -232,6 +249,10 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   });
   let queryAuthMap = {};
   queryEntries.forEach(entry => {
+    if (Stdlib_Option.getOr(entry.systemCallable, false)) {
+      iamFields[entry.singleFieldName] = true;
+      iamFields[entry.listFieldName] = true;
+    }
     let match = entry.authorization;
     if (match !== undefined) {
       let group = match.group;
@@ -255,7 +276,9 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let augmentedMutations = parts.mutations.map(field => {
     let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
     let groups = mutationAuthMap[fieldName];
-    if (groups !== undefined) {
+    if (Stdlib_Option.getOr(iamFields[fieldName], false)) {
+      return field + `\n    ` + _formatDualAuthDirective(groups);
+    } else if (groups !== undefined) {
       return field + `\n    ` + _formatGroupsDirective(groups);
     } else {
       return field;
@@ -264,7 +287,9 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let augmentedQueries = parts.queries.map(field => {
     let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
     let groups = queryAuthMap[fieldName];
-    if (groups !== undefined) {
+    if (Stdlib_Option.getOr(iamFields[fieldName], false)) {
+      return field + ` ` + _formatDualAuthDirective(groups);
+    } else if (groups !== undefined) {
       return field + ` ` + _formatGroupsDirective(groups);
     } else {
       return field;
@@ -294,10 +319,23 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   };
 }
 
-function injectAwsAuthAll(fragment, group) {
+function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
+  let iamFieldNames = iamFieldNamesOpt !== undefined ? iamFieldNamesOpt : [];
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
-  let augmentedMutations = parts.mutations.map(field => field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`);
-  let augmentedQueries = parts.queries.map(field => field + ` @aws_auth(cognito_groups: ["` + group + `"])`);
+  let augmentedMutations = parts.mutations.map(field => {
+    if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
+      return field + `\n    ` + _formatDualAuthDirective([group]);
+    } else {
+      return field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`;
+    }
+  });
+  let augmentedQueries = parts.queries.map(field => {
+    if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
+      return field + ` ` + _formatDualAuthDirective([group]);
+    } else {
+      return field + ` @aws_auth(cognito_groups: ["` + group + `"])`;
+    }
+  });
   let augmentedSubscriptions = parts.subscriptions.map(field => field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`);
   let encoded = JSON.stringify(Object.fromEntries([
     [
@@ -359,7 +397,7 @@ function generateFragment(mutationEntries, queryEntries) {
 }
 
 function updateSchema(api, baseFragment, pluginFragments) {
-  let augmentedBaseFragment = injectAwsAuthAll(baseFragment, "Admin");
+  let augmentedBaseFragment = injectAwsAuthAll(baseFragment, "Admin", undefined);
   let sdl = GraphQL_Stitcher$ReventlessCore.stitch(augmentedBaseFragment, pluginFragments);
   let resultPromise = {
     contents: Promise.resolve()
@@ -387,6 +425,7 @@ export {
   getClient,
   _permissionToCognitoGroups,
   _formatGroupsDirective,
+  _formatDualAuthDirective,
   injectAwsAuth,
   injectAwsAuthAll,
   makeApiResource,

package/src/components/Plugin.res

@@ -21,7 +21,7 @@ module Make = (HooksConfig: ReventlessCore.Plugin_Helpers.HooksConfig) => {
     CommandTopicRemoteChannel.SQS,
     HeartbeatRunner.CloudwatchEvents,
     PluginRuntime_Builder.Make(EventCollectorChannel),
-    DcbEventLogStorage.DynamoDb,
+    DcbEventLogStorage.Selectable,
     EventTopicPublisher.DynamoDbStream,
     CommandTopicChannel.SQS_Sync,
     CommandTopicChannel.SQS_Async,

package/src/components/Plugin.res.mjs

@@ -4,13 +4,13 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as AppSync_Adapter$ReventlessAws from "./Api/AppSync_Adapter.res.mjs";
 import * as Plugin_Builder$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Builder.res.mjs";
+import * as DcbEventLogStorage$ReventlessAws from "../adapter/DcbEventLog/DcbEventLogStorage.res.mjs";
 import * as Util_ResourceNaming$ReventlessAws from "../util/Util_ResourceNaming.res.mjs";
 import * as QueryEngine_DynamoDb$ReventlessAws from "../adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "../plugin/runtime/PluginRuntime_Builder.res.mjs";
 import * as PluginRuntimeOperations$ReventlessAws from "../plugin/runtime/PluginRuntimeOperations.res.mjs";
 import * as EventCollectorChannel_SQS$ReventlessAws from "../adapter/EventCollector/EventCollectorChannel_SQS.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "../adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs";
-import * as DcbEventLogStorage_DynamoDb$ReventlessAws from "../adapter/DcbEventLog/DcbEventLogStorage_DynamoDb.res.mjs";
 import * as CommandTopicChannel_SQS_Sync$ReventlessAws from "../adapter/CommandTopic/CommandTopicChannel_SQS_Sync.res.mjs";
 import * as CommandTopicChannel_SQS_Async$ReventlessAws from "../adapter/CommandTopic/CommandTopicChannel_SQS_Async.res.mjs";
 import * as CommandTopicRemoteChannel_SQS$ReventlessAws from "../adapter/CommandTopic/CommandTopicRemoteChannel_SQS.res.mjs";
@@ -44,7 +44,7 @@ function Make(HooksConfig) {
   })(CommandTopicRemoteChannel_SQS$ReventlessAws)(HeartbeatRunner_CloudWatchEvents$ReventlessAws)(PluginRuntime_Builder$ReventlessAws.Make({
     make: EventCollectorChannel_SQS$ReventlessAws.make,
     connect: EventCollectorChannel_SQS$ReventlessAws.connect
-  }))(DcbEventLogStorage_DynamoDb$ReventlessAws)(EventTopicPublisher_DynamoDbStream$ReventlessAws)({
+  }))(DcbEventLogStorage$ReventlessAws.Selectable)(EventTopicPublisher_DynamoDbStream$ReventlessAws)({
     make: CommandTopicChannel_SQS_Sync$ReventlessAws.make
   })({
     make: CommandTopicChannel_SQS_Async$ReventlessAws.make

package/src/plugin/runtime/PluginExtensionPointRuntime_Builder.res.mjs

@@ -66,7 +66,7 @@ function forCommandTopic(param, connect, memorySizeOpt, timeoutOpt, param$1, par
   });
   envVars["HANDLER_CONFIG"] = handlerConfigJson;
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PluginExtensionPointEntryPoint.mjs", {}, undefined);
-  return connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts));
+  return connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts));
 }
 
 function finish() {

package/src/plugin/runtime/PluginRuntime_Builder.res

@@ -196,6 +196,26 @@ module Make = (
     let channelParts: Util.SQS.channelParts = Obj.magic(channel.parts)
     let queue = channelParts.queue
 
+    // B2.3d: if this plugin's DCB log is Postgres-backed, hand its EventCollector
+    // SQS queue to the change-feed relay registry. `resource.name` is the plugin
+    // component name (`<plugin>Plugin`), so the canonical log_name is
+    // `<plugin>DcbEventLog` — the key DcbEventLogStorage_Postgres registered under.
+    if DcbBackend.isPostgres() {
+      switch resource.name {
+      | Some(compName) =>
+        let pluginName =
+          compName->String.endsWith("Plugin")
+            ? compName->String.slice(~start=0, ~end=compName->String.length - 6)
+            : compName
+        DcbBackend.attachCollectorQueue(
+          ~logName=pluginName ++ "DcbEventLog",
+          ~url=queue.id,
+          ~arn=queue.arn,
+        )
+      | None => ()
+      }
+    }
+
     // Pull the per-EventCollector context registered by Plugin_Helpers.connect
     // (plugins) or synthesise an admin one if none registered.
     let context: ReventlessCore.Plugin_Helpers.eventCollectorContext =

package/src/plugin/runtime/PluginRuntime_Builder.res.mjs

@@ -7,6 +7,7 @@ import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
+import * as DcbBackend$ReventlessAws from "../../adapter/DcbEventLog/DcbBackend.res.mjs";
 import * as Heartbeat$ReventlessCore from "@reventlessdev/reventless-core/src/components/Heartbeat/Heartbeat.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
@@ -166,6 +167,13 @@ function Make(EventCollectorChannel) {
     let channel = eventCollector.channel;
     let channelParts = channel.parts;
     let queue = channelParts.queue;
+    if (DcbBackend$ReventlessAws.isPostgres()) {
+      let compName = resource.__name;
+      if (compName !== undefined) {
+        let pluginName = compName.endsWith("Plugin") ? compName.slice(0, compName.length - 6 | 0) : compName;
+        DcbBackend$ReventlessAws.attachCollectorQueue(pluginName + "DcbEventLog", queue.id, queue.arn);
+      }
+    }
     let ctx = Plugin_Helpers$ReventlessCore.eventCollectorContextRef.contents[name];
     let context = ctx !== undefined ? ctx : synthesizeAdminContext();
     let envVars = {};
@@ -300,7 +308,7 @@ function Make(EventCollectorChannel) {
     });
     let codeOutput = bundleOutput.apply(b => b.code);
     let sourceCodeHashOutput = bundleOutput.apply(b => b.sourceCodeHash);
-    let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, codeOutput, sourceCodeHashOutput, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts);
+    let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, codeOutput, sourceCodeHashOutput, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts);
     EventCollectorChannel.connect(name, [{
         channel: eventCollector.channel,
         eventTopics: eventTopics,
@@ -422,7 +430,7 @@ function Make(EventCollectorChannel) {
     envVars["PLUGIN_ID"] = Pulumi.output(hbConfig.pluginId);
     envVars["HEARTBEAT_TIMEOUT"] = Pulumi.output(hbConfig.heartbeatTimeout.toString());
     let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/HeartbeatEntryPoint.mjs", {}, undefined);
-    connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, opts));
+    connect(RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, match.sourceCodeHash, envVars, memorySize, timeout, undefined, undefined, undefined, undefined, undefined, opts));
   };
   let forDcbCommandTopic = (param, connect, $staropt$star, $staropt$star$1, dcbCommandTopic) => {
     $staropt$star !== undefined;

package/tests/AppSync_AdapterTest.res

@@ -347,6 +347,146 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
   })
 })
 
+// ── Dual-auth (Cognito + IAM) for deploy-time system callers ────────────────
+//
+// A field flagged `systemCallable` must be reachable by BOTH the console UI
+// (Cognito) and the deploy-time SigV4 system caller (AWS_IAM). It switches from
+// the single-mode `@aws_auth(...)` form to the multi-auth
+// `@aws_cognito_user_pools(...) @aws_iam` form.
+
+describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
+  let makeFragment = (mutationFields, queryFields) =>
+    ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations: mutationFields,
+      queries: queryFields,
+      subscriptions: [],
+    })
+
+  testSync("systemCallable mutation with a group emits @aws_cognito_user_pools + @aws_iam", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowGroups(["Admin"]))]),
+      systemCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    let m = decodeFragment(aug).mutations->Array.getUnsafe(0)
+    expect(m)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+    expect(m)->toContain("@aws_iam")
+    // Must NOT emit the single-mode form, which does not admit IAM.
+    expect(m)->not_->toContain("@aws_auth")
+  })
+
+  testSync("systemCallable mutation without a group restriction stays open to Cognito + IAM", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowAuthenticated)]),
+      systemCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    let m = decodeFragment(aug).mutations->Array.getUnsafe(0)
+    // Bare @aws_cognito_user_pools (any authenticated Cognito user) + IAM.
+    expect(m)->toContain("@aws_cognito_user_pools @aws_iam")
+    expect(m)->not_->toContain("cognito_groups")
+    expect(m)->not_->toContain("@aws_auth")
+  })
+
+  testSync("a non-systemCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+    let entry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync", "p_Other"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([
+        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Other", Reventless.Authorization.AllowGroups(["Admin"])),
+      ]),
+      // systemCallable applies to every field in the entry; split the fields so only
+      // p_Sync opts in.
+      systemCallable: false,
+    }
+    let iamEntry: ReventlessInfra.Api.mutationSchemaEntry = {
+      fieldNames: ["p_Sync"],
+      commandSchema: S.unknown,
+      fieldPermissions: Dict.fromArray([("p_Sync", Reventless.Authorization.AllowGroups(["Admin"]))]),
+      systemCallable: true,
+    }
+    let frag = makeFragment(["p_Sync(id: ID!): String", "p_Other(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry, iamEntry], ~queryEntries=[])
+    let parts = decodeFragment(aug)
+    switch parts.mutations->Array.find(f => f->String.includes("p_Other")) {
+    | Some(other) =>
+      expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(other)->not_->toContain("@aws_iam")
+    | None => JsError.throwWithMessage("missing p_Other field")
+    }
+  })
+
+  testSync("systemCallable query applies dual-auth to BOTH single and list fields", () => {
+    let entry: ReventlessInfra.Api.querySchemaEntry = {
+      singleFieldName: "p_Item",
+      listFieldName: "p_Items",
+      returnTypeName: "p_Item",
+      stateSchema: S.unknown,
+      authorization: None,
+      permission: Reventless.Authorization.AllowGroups(["Admin"]),
+      systemCallable: true,
+    }
+    let frag = makeFragment(
+      [],
+      ["p_Item(id: ID!): Item", "p_Items(first: Int, after: String): ItemConnection!"],
+    )
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[entry])
+    let parts = decodeFragment(aug)
+    switch (
+      parts.queries->Array.find(f => f->String.includes("p_Item(")),
+      parts.queries->Array.find(f => f->String.includes("p_Items(")),
+    ) {
+    | (Some(single), Some(list)) =>
+      expect(single)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+      expect(single)->toContain("@aws_iam")
+      expect(list)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+      expect(list)->toContain("@aws_iam")
+    | _ => JsError.throwWithMessage("missing query fields")
+    }
+  })
+})
+
+describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
+  let baseFragment = ReventlessCore.AdminApi.baseFragment(~cloner=true)
+
+  testSync("marks only the named field dual-auth, leaving others single-mode", () => {
+    // Pick a real mutation field name from the admin base fragment.
+    let firstMutationName =
+      decodeFragment(baseFragment).mutations
+      ->Array.getUnsafe(0)
+      ->ReventlessCore.GraphQL_Stitcher.extractLeadingName
+    let augmented =
+      AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin", ~iamFieldNames=[firstMutationName])
+    let parts = decodeFragment(augmented)
+    parts.mutations->Array.forEach(field => {
+      let name = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
+      if name == firstMutationName {
+        expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
+        expect(field)->toContain("@aws_iam")
+        expect(field)->not_->toContain("@aws_auth")
+      } else {
+        expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+        expect(field)->not_->toContain("@aws_iam")
+      }
+    })
+  })
+
+  testSync("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+    let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
+    let parts = decodeFragment(augmented)
+    parts.mutations->Array.forEach(field => expect(field)->not_->toContain("@aws_iam"))
+    parts.queries->Array.forEach(field => expect(field)->not_->toContain("@aws_iam"))
+  })
+})
+
 describe("Split mode — empty base fragment", () => {
   testSync("empty stitcher encode produces fragment with no fields", () => {
     let emptyFragment = ReventlessCore.GraphQL_Stitcher.encode({