@reventlessdev/reventless-aws 3.0.0-alpha.172 → 3.0.0-alpha.174

package/tests/AppSync_AdapterTest.res.mjs

@@ -27,14 +27,14 @@ let decodeFragment = GraphQL_Stitcher$ReventlessCore.decode;
 globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
   globalThis.test("adds @aws_auth directive to all mutation fields", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
       globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
     });
   });
   globalThis.test("adds @aws_auth directive to all query fields", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.queries.forEach(field => {
       globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
@@ -42,12 +42,12 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   });
   globalThis.test("preserves type definitions unchanged", () => {
     let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     globalThis.expect(parts.types).toEqual(original.types);
   });
   globalThis.test("uses specified group name", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "SuperAdmin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "SuperAdmin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
       globalThis.expect(field).toContain(`cognito_groups: ["SuperAdmin"]`);
@@ -55,7 +55,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   });
   globalThis.test("preserves subscription fields with @aws_auth directive", () => {
     let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     globalThis.expect(parts.subscriptions.length).toBe(original.subscriptions.length);
     globalThis.expect(parts.subscriptions.length).toBeGreaterThan(0);
@@ -64,7 +64,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
     });
   });
   globalThis.test("admin Plugin aggregate subscription fields survive the round-trip", () => {
-    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin");
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     let joined = parts.subscriptions.join("\n");
     globalThis.expect(joined).toContain("onPlatform_Plugin_Activate");
@@ -282,6 +282,182 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
   });
 });
 
+globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
+  let makeFragment = (mutationFields, queryFields) => GraphQL_Stitcher$ReventlessCore.encode({
+    types: [],
+    mutations: mutationFields,
+    queries: queryFields,
+    subscriptions: []
+  });
+  globalThis.test("systemCallable mutation with a group emits @aws_cognito_user_pools + @aws_iam", () => {
+    let entry_fieldNames = ["p_Sync"];
+    let entry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]]);
+    let entry_systemCallable = true;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      systemCallable: entry_systemCallable
+    };
+    let frag = makeFragment(["p_Sync(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let m = GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0];
+    globalThis.expect(m).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+    globalThis.expect(m).toContain("@aws_iam");
+    globalThis.expect(m).not.toContain("@aws_auth");
+  });
+  globalThis.test("systemCallable mutation without a group restriction stays open to Cognito + IAM", () => {
+    let entry_fieldNames = ["p_Sync"];
+    let entry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        "AllowAuthenticated"
+      ]]);
+    let entry_systemCallable = true;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      systemCallable: entry_systemCallable
+    };
+    let frag = makeFragment(["p_Sync(id: ID!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    let m = GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0];
+    globalThis.expect(m).toContain("@aws_cognito_user_pools @aws_iam");
+    globalThis.expect(m).not.toContain("cognito_groups");
+    globalThis.expect(m).not.toContain("@aws_auth");
+  });
+  globalThis.test("a non-systemCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+    let entry_fieldNames = [
+      "p_Sync",
+      "p_Other"
+    ];
+    let entry_fieldPermissions = Object.fromEntries([
+      [
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ],
+      [
+        "p_Other",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]
+    ]);
+    let entry_systemCallable = false;
+    let entry = {
+      fieldNames: entry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: entry_fieldPermissions,
+      systemCallable: entry_systemCallable
+    };
+    let iamEntry_fieldNames = ["p_Sync"];
+    let iamEntry_fieldPermissions = Object.fromEntries([[
+        "p_Sync",
+        {
+          TAG: "AllowGroups",
+          _0: ["Admin"]
+        }
+      ]]);
+    let iamEntry_systemCallable = true;
+    let iamEntry = {
+      fieldNames: iamEntry_fieldNames,
+      commandSchema: S.unknown,
+      fieldPermissions: iamEntry_fieldPermissions,
+      systemCallable: iamEntry_systemCallable
+    };
+    let frag = makeFragment([
+      "p_Sync(id: ID!): String",
+      "p_Other(id: ID!): String"
+    ], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [
+      entry,
+      iamEntry
+    ], []);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let other = parts.mutations.find(f => f.includes("p_Other"));
+    if (other !== undefined) {
+      globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(other).not.toContain("@aws_iam");
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("missing p_Other field");
+    }
+  });
+  globalThis.test("systemCallable query applies dual-auth to BOTH single and list fields", () => {
+    let entry_permission = {
+      TAG: "AllowGroups",
+      _0: ["Admin"]
+    };
+    let entry_systemCallable = true;
+    let entry = {
+      singleFieldName: "p_Item",
+      listFieldName: "p_Items",
+      returnTypeName: "p_Item",
+      stateSchema: S.unknown,
+      authorization: undefined,
+      permission: entry_permission,
+      systemCallable: entry_systemCallable
+    };
+    let frag = makeFragment([], [
+      "p_Item(id: ID!): Item",
+      "p_Items(first: Int, after: String): ItemConnection!"
+    ]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], [entry]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
+    let match = parts.queries.find(f => f.includes("p_Item("));
+    let match$1 = parts.queries.find(f => f.includes("p_Items("));
+    if (match !== undefined && match$1 !== undefined) {
+      globalThis.expect(match).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+      globalThis.expect(match).toContain("@aws_iam");
+      globalThis.expect(match$1).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+      globalThis.expect(match$1).toContain("@aws_iam");
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("missing query fields");
+    }
+  });
+});
+
+globalThis.describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
+  let baseFragment = AdminApi$ReventlessCore.baseFragment(true);
+  globalThis.test("marks only the named field dual-auth, leaving others single-mode", () => {
+    let firstMutationName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(GraphQL_Stitcher$ReventlessCore.decode(baseFragment).mutations[0]);
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", [firstMutationName]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.mutations.forEach(field => {
+      let name = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
+      if (name === firstMutationName) {
+        globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+        globalThis.expect(field).toContain("@aws_iam");
+        globalThis.expect(field).not.toContain("@aws_auth");
+      } else {
+        globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+        globalThis.expect(field).not.toContain("@aws_iam");
+      }
+    });
+  });
+  globalThis.test("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    parts.mutations.forEach(field => {
+      globalThis.expect(field).not.toContain("@aws_iam");
+    });
+    parts.queries.forEach(field => {
+      globalThis.expect(field).not.toContain("@aws_iam");
+    });
+  });
+});
+
 globalThis.describe("Split mode — empty base fragment", () => {
   globalThis.test("empty stitcher encode produces fragment with no fields", () => {
     let emptyFragment = GraphQL_Stitcher$ReventlessCore.encode({

package/tests/PgChangeFeedRelay_RuntimeTest.res

@@ -0,0 +1,75 @@
+open JestGlobals
+
+// A realistic DCB feed event as PgChangeFeed.readBatch would surface it.
+let sampleEvent: ReventlessCore.DcbEventLog_Adapter.rawSequencedEvent = {
+  position: "00000000000000000042:00000000000000000007",
+  eventType: "OrderCreated",
+  data: [("customerId", JSON.Encode.string("c-1"))]->Dict.fromArray->JSON.Encode.object,
+  tags: [{key: "orderId", value: "o-1"}],
+  meta: {
+    service: "Orders",
+    time: "2026-07-05T10:00:00.000Z",
+    msgId: "m-1",
+    correlationId: "m-1",
+  },
+  recordedAt: "2026-07-05T10:00:00.000Z",
+}
+
+describe("PgChangeFeedRelay_Runtime.toEventCollectorJson", () => {
+  testSync("produces the EventCollector {id, meta, event} body from a feed event", () => {
+    let json = PgChangeFeedRelay_Runtime.toEventCollectorJson(sampleEvent)->Option.getOrThrow
+    let obj = json->JSON.Decode.object->Option.getOrThrow
+
+    // id = derivePartitionKey with no partitionTag → "<firstTag.key>:<value>"
+    expect(obj->Dict.get("id"))->toEqual(Some(JSON.Encode.string("orderId:o-1")))
+
+    // event carries the event type + payload (combineMessage encodes a
+    // payload-bearing variant as an object, e.g. {"OrderCreated": {...}})
+    let eventJson = obj->Dict.get("event")->Option.getOrThrow
+    expect(eventJson->JSON.stringify->String.includes("OrderCreated"))->toBe(true)
+    expect(eventJson->JSON.stringify->String.includes("c-1"))->toBe(true)
+
+    // meta round-trips the producing service
+    let metaObj =
+      obj->Dict.get("meta")->Option.flatMap(JSON.Decode.object)->Option.getOrThrow
+    expect(metaObj->Dict.get("service"))->toEqual(Some(JSON.Encode.string("Orders")))
+  })
+
+  testSync("derives the 'dcb' id when the event carries no tags", () => {
+    let noTags = {...sampleEvent, tags: []}
+    let json = PgChangeFeedRelay_Runtime.toEventCollectorJson(noTags)->Option.getOrThrow
+    let obj = json->JSON.Decode.object->Option.getOrThrow
+    expect(obj->Dict.get("id"))->toEqual(Some(JSON.Encode.string("dcb")))
+  })
+})
+
+describe("PgChangeFeedRelay_Runtime partitionTag (B2.3d)", () => {
+  let multiTagEvent = {
+    ...sampleEvent,
+    tags: [{key: "orderId", value: "o-1"}, {key: "customerId", value: "c-9"}],
+  }
+
+  testSync("a Simple partitionTag selects its tag for the id, not just the first", () => {
+    let pt = Reventless.DcbTag.Simple({key: "customerId"})
+    let json =
+      PgChangeFeedRelay_Runtime.toEventCollectorJson(multiTagEvent, ~partitionTag=pt)->Option.getOrThrow
+    let obj = json->JSON.Decode.object->Option.getOrThrow
+    // Without partitionTag the id would be "orderId:o-1" (first tag); the tag
+    // pins it to "customerId:c-9".
+    expect(obj->Dict.get("id"))->toEqual(Some(JSON.Encode.string("customerId:c-9")))
+  })
+
+  testSync("derivedPartitionTag round-trips through the sury schema (relay wire-format)", () => {
+    // The relay builder serialises partitionTag with this schema into HANDLER_CONFIG
+    // and PgChangeFeedRelay_Runtime.relay parses it back the same way. Guard the
+    // round-trip so a schema change can't silently break the id derivation.
+    let simple = Reventless.DcbTag.Simple({key: "courseId"})
+    let composite =
+      Reventless.DcbTag.Composite({keys: ["studentId", "courseId"], seps: [":"]})
+    [simple, composite]->Array.forEach(pt => {
+      let wire = pt->S.reverseConvertToJsonOrThrow(Reventless.DcbTag.derivedPartitionTagSchema)
+      let back = wire->S.parseJsonOrThrow(Reventless.DcbTag.derivedPartitionTagSchema)
+      expect(back)->toEqual(pt)
+    })
+  })
+})

package/tests/PgChangeFeedRelay_RuntimeTest.res.mjs

@@ -0,0 +1,135 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as PgChangeFeedRelay_Runtime$ReventlessAws from "../src/adapter/Postgres/PgChangeFeedRelay_Runtime.res.mjs";
+
+let sampleEvent_data = Object.fromEntries([[
+    "customerId",
+    "c-1"
+  ]]);
+
+let sampleEvent_tags = [{
+    key: "orderId",
+    value: "o-1"
+  }];
+
+let sampleEvent_meta = {
+  service: "Orders",
+  time: "2026-07-05T10:00:00.000Z",
+  msgId: "m-1",
+  correlationId: "m-1"
+};
+
+let sampleEvent = {
+  position: "00000000000000000042:00000000000000000007",
+  eventType: "OrderCreated",
+  data: sampleEvent_data,
+  tags: sampleEvent_tags,
+  meta: sampleEvent_meta,
+  recordedAt: "2026-07-05T10:00:00.000Z"
+};
+
+globalThis.describe("PgChangeFeedRelay_Runtime.toEventCollectorJson", () => {
+  globalThis.test("produces the EventCollector {id, meta, event} body from a feed event", () => {
+    let json = Stdlib_Option.getOrThrow(PgChangeFeedRelay_Runtime$ReventlessAws.toEventCollectorJson(sampleEvent, undefined), undefined);
+    let obj = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(json), undefined);
+    globalThis.expect(obj["id"]).toEqual("orderId:o-1");
+    let eventJson = Stdlib_Option.getOrThrow(obj["event"], undefined);
+    globalThis.expect(JSON.stringify(eventJson).includes("OrderCreated")).toBe(true);
+    globalThis.expect(JSON.stringify(eventJson).includes("c-1")).toBe(true);
+    let metaObj = Stdlib_Option.getOrThrow(Stdlib_Option.flatMap(obj["meta"], Stdlib_JSON.Decode.object), undefined);
+    globalThis.expect(metaObj["service"]).toEqual("Orders");
+  });
+  globalThis.test("derives the 'dcb' id when the event carries no tags", () => {
+    let noTags_data = sampleEvent_data;
+    let noTags_tags = [];
+    let noTags_meta = {
+      service: "Orders",
+      time: "2026-07-05T10:00:00.000Z",
+      msgId: "m-1",
+      correlationId: "m-1"
+    };
+    let noTags = {
+      position: "00000000000000000042:00000000000000000007",
+      eventType: "OrderCreated",
+      data: noTags_data,
+      tags: noTags_tags,
+      meta: noTags_meta,
+      recordedAt: "2026-07-05T10:00:00.000Z"
+    };
+    let json = Stdlib_Option.getOrThrow(PgChangeFeedRelay_Runtime$ReventlessAws.toEventCollectorJson(noTags, undefined), undefined);
+    let obj = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(json), undefined);
+    globalThis.expect(obj["id"]).toEqual("dcb");
+  });
+});
+
+globalThis.describe("PgChangeFeedRelay_Runtime partitionTag (B2.3d)", () => {
+  let multiTagEvent_data = sampleEvent_data;
+  let multiTagEvent_tags = [
+    {
+      key: "orderId",
+      value: "o-1"
+    },
+    {
+      key: "customerId",
+      value: "c-9"
+    }
+  ];
+  let multiTagEvent_meta = {
+    service: "Orders",
+    time: "2026-07-05T10:00:00.000Z",
+    msgId: "m-1",
+    correlationId: "m-1"
+  };
+  let multiTagEvent = {
+    position: "00000000000000000042:00000000000000000007",
+    eventType: "OrderCreated",
+    data: multiTagEvent_data,
+    tags: multiTagEvent_tags,
+    meta: multiTagEvent_meta,
+    recordedAt: "2026-07-05T10:00:00.000Z"
+  };
+  globalThis.test("a Simple partitionTag selects its tag for the id, not just the first", () => {
+    let json = Stdlib_Option.getOrThrow(PgChangeFeedRelay_Runtime$ReventlessAws.toEventCollectorJson(multiTagEvent, {
+      TAG: "Simple",
+      _0: {
+        key: "customerId"
+      }
+    }), undefined);
+    let obj = Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(json), undefined);
+    globalThis.expect(obj["id"]).toEqual("customerId:c-9");
+  });
+  globalThis.test("derivedPartitionTag round-trips through the sury schema (relay wire-format)", () => {
+    let composite = {
+      TAG: "Composite",
+      _0: {
+        keys: [
+          "studentId",
+          "courseId"
+        ],
+        seps: [":"]
+      }
+    };
+    [
+      {
+        TAG: "Simple",
+        _0: {
+          key: "courseId"
+        }
+      },
+      composite
+    ].forEach(pt => {
+      let wire = S.reverseConvertToJsonOrThrow(pt, DcbTag$Reventless.derivedPartitionTagSchema);
+      let back = S.parseJsonOrThrow(wire, DcbTag$Reventless.derivedPartitionTagSchema);
+      globalThis.expect(back).toEqual(pt);
+    });
+  });
+});
+
+export {
+  sampleEvent,
+}
+/* sampleEvent Not a pure module */