@reventlessdev/reventless-aws 3.0.0-alpha.176 → 3.0.0-alpha.178

package/tests/PgQueryResolver_LambdaTest.res

@@ -9,6 +9,8 @@
 open JestGlobals
 open ReventlessCore
 
+@val external btoa: string => string = "btoa"
+
 let mk = (id, status, name) => {
   let o = Dict.make()
   o->Dict.set("id", JSON.Encode.string(id))
@@ -51,6 +53,9 @@ let pushdowns: PgQueryResolver_Lambda.pushdowns = {
     ids->Array.filterMap(id => store->Dict.get(id)),
   listPage: async (~readModelName as _, ~argsDict as _, ~capability as _, ~labelField as _) =>
     listPageReturn.contents,
+  itemsPage: async (~readModelName as _, ~subIdField as _, ~id, ~argsDict as _) =>
+    // Sentinel echoing the requested id, so the dispatch routing is observable.
+    JSON.Encode.object(Dict.fromArray([("itemsFor", JSON.Encode.string(id))])),
   scanAll: async (~readModelName as _) => allItems(),
 }
 
@@ -59,14 +64,18 @@ let capability: GraphQL_FragmentGenerator.serverCapability = {
   sortFields: ["name", "status"],
 }
 
-let makeBinding = (~authorization=Reventless.Authorization.AllowAnonymous, ()): PgQueryResolver_Lambda.binding => {
+let makeBinding = (
+  ~authorization=Reventless.Authorization.AllowAnonymous,
+  ~subIdField=None,
+  (),
+): PgQueryResolver_Lambda.binding => {
   ops,
   pushdowns,
   // "byStatus" index stored on the `status` field.
   indexes: [
     {index: "byStatus", type_: "S", idField: "status", projectionType: Reventless.ReadModel.ALL},
   ],
-  subIdField: None,
+  subIdField,
   capability,
   labelField: "name",
   includeIdParam: true,
@@ -163,6 +172,22 @@ describe("PgQueryResolver_Lambda.dispatch", () => {
     expect(edgeIds)->toEqual(["p-1", "p-2", "p-3"])
   })
 
+  testPromise("items with subId routes to itemsPage (id echoed)", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(~subIdField=Some("seq"), ()),
+      ~payload=mkPayload(~kind="items", ~args=objArgs([("id", JSON.Encode.string("p-2"))]), ()),
+    )
+    expect(r->str("itemsFor"))->toEqual(Some("p-2"))
+  })
+
+  testPromise("items without subId → empty connection", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~payload=mkPayload(~kind="items", ~args=objArgs([("id", JSON.Encode.string("p-2"))]), ()),
+    )
+    expect(r->field("edges")->Option.flatMap(JSON.Decode.array)->Option.getOr([])->Array.length)->toBe(0)
+  })
+
   testPromise("authorization DenyAll → empty shape per kind", async () => {
     let b = makeBinding(~authorization=DenyAll, ())
     let single = await PgQueryResolver_Lambda.dispatch(
@@ -191,6 +216,142 @@ describe("PgQueryResolver_Lambda.dispatch", () => {
     expect(r)->toBe(JSON.Encode.null)
   })
 
+  // ── cross-table (@resolves / @resolvesMany / node) ────────────────────────
+  // For resolveOne/resolveMany the dispatch binding IS the target binding
+  // (the handler selects it); source carries the parent object's key(s).
+  testPromise("resolveOne loads target by parent's id field", async () => {
+    let payload: PgQueryResolver_Lambda.payload = {
+      readModelName: "Things",
+      kind: "resolveOne",
+      target: "Things",
+      source: objArgs([("ref", JSON.Encode.string("p-2"))]),
+      sourceIdField: "ref",
+      multi: false,
+      arguments: objArgs([]),
+      identity: Reventless.Identity.anonymous,
+    }
+    let r = await PgQueryResolver_Lambda.dispatch(~binding=makeBinding(), ~payload)
+    expect(r->str("id"))->toEqual(Some("p-2"))
+  })
+
+  testPromise("resolveOne multi via target index → array", async () => {
+    let payload: PgQueryResolver_Lambda.payload = {
+      readModelName: "Things",
+      kind: "resolveOne",
+      target: "Things",
+      source: objArgs([("st", JSON.Encode.string("active"))]),
+      sourceIdField: "st",
+      targetIndex: "byStatus",
+      targetIndexIdField: "status",
+      multi: true,
+      arguments: objArgs([]),
+      identity: Reventless.Identity.anonymous,
+    }
+    let r = await PgQueryResolver_Lambda.dispatch(~binding=makeBinding(), ~payload)
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
+  testPromise("resolveMany batch-loads target by parent's ids field", async () => {
+    let payload: PgQueryResolver_Lambda.payload = {
+      readModelName: "Things",
+      kind: "resolveMany",
+      target: "Things",
+      source: objArgs([
+        ("refs", JSON.Encode.array(["p-1", "x", "p-3"]->Array.map(JSON.Encode.string))),
+      ]),
+      sourceIdsField: "refs",
+      arguments: objArgs([]),
+      identity: Reventless.Identity.anonymous,
+    }
+    let r = await PgQueryResolver_Lambda.dispatch(~binding=makeBinding(), ~payload)
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
+  testPromise("node decodes global id → __typename + item", async () => {
+    // Register a binding + node type in the module-level registries.
+    PgQueryResolver_Lambda.register(~readModelName="Things", makeBinding())
+    PgQueryResolver_Lambda.registerNodeType(~typeName="Thing", ~readModelName="Things")
+    let payload: PgQueryResolver_Lambda.payload = {
+      readModelName: "",
+      kind: "node",
+      arguments: objArgs([("id", JSON.Encode.string(btoa("Thing:p-2")))]),
+      identity: Reventless.Identity.anonymous,
+    }
+    let r = await PgQueryResolver_Lambda.handler(payload, Obj.magic(Nullable.null))
+    expect(r->str("__typename"))->toEqual(Some("Thing"))
+    expect(r->str("name"))->toEqual(Some("Bravo"))
+  })
+
+  testPromise("node with unknown type → null", async () => {
+    let payload: PgQueryResolver_Lambda.payload = {
+      readModelName: "",
+      kind: "node",
+      arguments: objArgs([("id", JSON.Encode.string(btoa("Nope:p-1")))]),
+      identity: Reventless.Identity.anonymous,
+    }
+    let r = await PgQueryResolver_Lambda.handler(payload, Obj.magic(Nullable.null))
+    expect(r)->toBe(JSON.Encode.null)
+  })
+
+  // ── auth-table pipeline (group-restricted index) ──────────────────────────
+  // Auth table (another read model) maps index value → { ownerId: <username> }.
+  let authStore = Dict.fromArray([
+    ("active", JSON.Encode.object(Dict.fromArray([("ownerId", JSON.Encode.string("alice"))]))),
+  ])
+  let authOps: QueryDb_Adapter.operations = {
+    load: async id => Ok(authStore->Dict.get(id)->Option.mapOr([], r => [r])),
+    loadStream: Obj.magic(0),
+    save: Obj.magic(0),
+    saveBatch: Obj.magic(0),
+    count: Obj.magic(0),
+    delete: Obj.magic(0),
+    deleteBatch: Obj.magic(0),
+  }
+  let authBinding = {...makeBinding(), PgQueryResolver_Lambda.ops: authOps}
+  let lookupAuth = name => name == "AuthTable" ? Some(authBinding) : None
+  let ident = (~username, ~groups): Reventless.Identity.t => {
+    userId: username,
+    username,
+    groups,
+    provider: InMemory,
+  }
+  let authIndexPayload = (~username, ~groups): PgQueryResolver_Lambda.payload => {
+    readModelName: "Things",
+    kind: "index",
+    index: "byStatus",
+    authTable: "AuthTable",
+    authGroup: "Owner",
+    arguments: objArgs([("byStatus", JSON.Encode.string("active"))]),
+    identity: ident(~username, ~groups),
+  }
+
+  testPromise("auth index: group member who owns → results", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~lookupBinding=lookupAuth,
+      ~payload=authIndexPayload(~username="alice", ~groups=["Owner"]),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
+  testPromise("auth index: group member who does NOT own → empty", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~lookupBinding=lookupAuth,
+      ~payload=authIndexPayload(~username="bob", ~groups=["Owner"]),
+    )
+    expect(r->JSON.Decode.array->Option.getOr([])->Array.length)->toBe(0)
+  })
+
+  testPromise("auth index: non-member passes through → results", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~lookupBinding=lookupAuth,
+      ~payload=authIndexPayload(~username="bob", ~groups=[]),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
   testPromise("unmapped kind throws", async () => {
     let threw = try {
       let _ = await PgQueryResolver_Lambda.dispatch(

package/tests/PgQueryResolver_LambdaTest.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
@@ -72,6 +73,13 @@ async function pushdowns_listPage(param, param$1, param$2, param$3) {
   return listPageReturn.contents;
 }
 
+async function pushdowns_itemsPage(param, param$1, id, param$2) {
+  return Object.fromEntries([[
+      "itemsFor",
+      id
+    ]]);
+}
+
 async function pushdowns_scanAll(param) {
   return Object.values(store);
 }
@@ -80,6 +88,7 @@ let pushdowns = {
   indexLookup: pushdowns_indexLookup,
   byIds: pushdowns_byIds,
   listPage: pushdowns_listPage,
+  itemsPage: pushdowns_itemsPage,
   scanAll: pushdowns_scanAll
 };
 
@@ -99,8 +108,9 @@ let capability = {
   sortFields: capability_sortFields
 };
 
-function makeBinding(authorizationOpt, param) {
+function makeBinding(authorizationOpt, subIdFieldOpt, param) {
   let authorization = authorizationOpt !== undefined ? authorizationOpt : "AllowAnonymous";
+  let subIdField = subIdFieldOpt !== undefined ? Primitive_option.valFromOption(subIdFieldOpt) : undefined;
   return {
     ops: ops,
     pushdowns: pushdowns,
@@ -110,7 +120,7 @@ function makeBinding(authorizationOpt, param) {
         idField: "status",
         projectionType: "ALL"
       }],
-    subIdField: undefined,
+    subIdField: subIdField,
     capability: capability,
     labelField: "name",
     includeIdParam: true,
@@ -147,7 +157,7 @@ function ids(arr) {
 
 globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   globalThis.test("getById returns the item (id-carrying)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined), mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-2"
       ]]), undefined));
@@ -155,14 +165,14 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById miss → null", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined), mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "absent"
       ]]), undefined));
     globalThis.expect(r).toBe(null);
   });
   globalThis.test("byIds returns matches, drops missing", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined), mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
@@ -176,7 +186,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     ]);
   });
   globalThis.test("index routes to indexLookup on the idField", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined), mkPayload("index", "byStatus", Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
         "byStatus",
         "active"
       ]]), undefined));
@@ -187,13 +197,13 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   });
   globalThis.test("list with push-down → returns the connection listPage gives", async () => {
     listPageReturn.contents = "PUSHED";
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined), mkPayload("list", undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined));
     listPageReturn.contents = undefined;
     globalThis.expect(r).toEqual("PUSHED");
   });
   globalThis.test("list without push-down → falls back to the shared spec", async () => {
     listPageReturn.contents = undefined;
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined), mkPayload("list", undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined));
     let edgeIds = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []), e => Stdlib_Option.flatMap(field(e, "node"), n => str(n, "id")));
     globalThis.expect(edgeIds).toEqual([
       "p-1",
@@ -201,16 +211,30 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       "p-3"
     ]);
   });
+  globalThis.test("items with subId routes to itemsPage (id echoed)", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
+        "id",
+        "p-2"
+      ]]), undefined));
+    globalThis.expect(str(r, "itemsFor")).toEqual("p-2");
+  });
+  globalThis.test("items without subId → empty connection", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
+        "id",
+        "p-2"
+      ]]), undefined));
+    globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []).length).toBe(0);
+  });
   globalThis.test("authorization DenyAll → empty shape per kind", async () => {
-    let b = makeBinding("DenyAll", undefined);
-    let single = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, mkPayload("getById", undefined, Object.fromEntries([[
+    let b = makeBinding("DenyAll", undefined, undefined);
+    let single = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
       ]]), undefined));
     globalThis.expect(single).toBe(null);
-    let list = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, mkPayload("list", undefined, undefined, undefined));
+    let list = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("list", undefined, undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(list, "edges"), Stdlib_JSON.Decode.array), []).length).toBe(0);
-    let byIds = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, mkPayload("byIds", undefined, Object.fromEntries([[
+    let byIds = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         []
       ]]), undefined));
@@ -221,17 +245,205 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       TAG: "Deny",
       _0: "nope"
     }));
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined), mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
       ]]), undefined));
     QueryDb_Callback$ReventlessCore.clearQueryInterceptor();
     globalThis.expect(r).toBe(null);
   });
+  globalThis.test("resolveOne loads target by parent's id field", async () => {
+    let payload_target = "Things";
+    let payload_source = Object.fromEntries([[
+        "ref",
+        "p-2"
+      ]]);
+    let payload_sourceIdField = "ref";
+    let payload_multi = false;
+    let payload_arguments = Object.fromEntries([]);
+    let payload = {
+      readModelName: "Things",
+      kind: "resolveOne",
+      target: payload_target,
+      source: payload_source,
+      sourceIdField: payload_sourceIdField,
+      multi: payload_multi,
+      arguments: payload_arguments,
+      identity: Identity$Reventless.anonymous
+    };
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    globalThis.expect(str(r, "id")).toEqual("p-2");
+  });
+  globalThis.test("resolveOne multi via target index → array", async () => {
+    let payload_target = "Things";
+    let payload_source = Object.fromEntries([[
+        "st",
+        "active"
+      ]]);
+    let payload_sourceIdField = "st";
+    let payload_targetIndex = "byStatus";
+    let payload_targetIndexIdField = "status";
+    let payload_multi = true;
+    let payload_arguments = Object.fromEntries([]);
+    let payload = {
+      readModelName: "Things",
+      kind: "resolveOne",
+      target: payload_target,
+      source: payload_source,
+      sourceIdField: payload_sourceIdField,
+      targetIndex: payload_targetIndex,
+      targetIndexIdField: payload_targetIndexIdField,
+      multi: payload_multi,
+      arguments: payload_arguments,
+      identity: Identity$Reventless.anonymous
+    };
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+  globalThis.test("resolveMany batch-loads target by parent's ids field", async () => {
+    let payload_target = "Things";
+    let payload_source = Object.fromEntries([[
+        "refs",
+        [
+          "p-1",
+          "x",
+          "p-3"
+        ].map(prim => prim)
+      ]]);
+    let payload_sourceIdsField = "refs";
+    let payload_arguments = Object.fromEntries([]);
+    let payload = {
+      readModelName: "Things",
+      kind: "resolveMany",
+      target: payload_target,
+      source: payload_source,
+      sourceIdsField: payload_sourceIdsField,
+      arguments: payload_arguments,
+      identity: Identity$Reventless.anonymous
+    };
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+  globalThis.test("node decodes global id → __typename + item", async () => {
+    PgQueryResolver_Lambda$ReventlessAws.register("Things", makeBinding(undefined, undefined, undefined));
+    PgQueryResolver_Lambda$ReventlessAws.registerNodeType("Thing", "Things");
+    let payload_arguments = Object.fromEntries([[
+        "id",
+        btoa("Thing:p-2")
+      ]]);
+    let payload = {
+      readModelName: "",
+      kind: "node",
+      arguments: payload_arguments,
+      identity: Identity$Reventless.anonymous
+    };
+    let r = await PgQueryResolver_Lambda$ReventlessAws.handler(payload, null);
+    globalThis.expect(str(r, "__typename")).toEqual("Thing");
+    globalThis.expect(str(r, "name")).toEqual("Bravo");
+  });
+  globalThis.test("node with unknown type → null", async () => {
+    let payload_arguments = Object.fromEntries([[
+        "id",
+        btoa("Nope:p-1")
+      ]]);
+    let payload = {
+      readModelName: "",
+      kind: "node",
+      arguments: payload_arguments,
+      identity: Identity$Reventless.anonymous
+    };
+    let r = await PgQueryResolver_Lambda$ReventlessAws.handler(payload, null);
+    globalThis.expect(r).toBe(null);
+  });
+  let authStore = Object.fromEntries([[
+      "active",
+      Object.fromEntries([[
+          "ownerId",
+          "alice"
+        ]])
+    ]]);
+  let authOps_load = async id => ({
+    TAG: "Ok",
+    _0: Stdlib_Option.mapOr(authStore[id], [], r => [r])
+  });
+  let authOps = {
+    load: authOps_load,
+    loadStream: 0,
+    save: 0,
+    saveBatch: 0,
+    count: 0,
+    delete: 0,
+    deleteBatch: 0
+  };
+  let init = makeBinding(undefined, undefined, undefined);
+  let authBinding_pushdowns = init.pushdowns;
+  let authBinding_indexes = init.indexes;
+  let authBinding_subIdField = init.subIdField;
+  let authBinding_capability = init.capability;
+  let authBinding_labelField = init.labelField;
+  let authBinding_includeIdParam = init.includeIdParam;
+  let authBinding_authorization = init.authorization;
+  let authBinding = {
+    ops: authOps,
+    pushdowns: authBinding_pushdowns,
+    indexes: authBinding_indexes,
+    subIdField: authBinding_subIdField,
+    capability: authBinding_capability,
+    labelField: authBinding_labelField,
+    includeIdParam: authBinding_includeIdParam,
+    authorization: authBinding_authorization
+  };
+  let lookupAuth = name => {
+    if (name === "AuthTable") {
+      return authBinding;
+    }
+  };
+  let ident = (username, groups) => ({
+    userId: username,
+    username: username,
+    groups: groups,
+    provider: "InMemory"
+  });
+  let authIndexPayload = (username, groups) => ({
+    readModelName: "Things",
+    kind: "index",
+    index: "byStatus",
+    authTable: "AuthTable",
+    authGroup: "Owner",
+    arguments: Object.fromEntries([[
+        "byStatus",
+        "active"
+      ]]),
+    identity: ident(username, groups)
+  });
+  globalThis.test("auth index: group member who owns → results", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("alice", ["Owner"]));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+  globalThis.test("auth index: group member who does NOT own → empty", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", ["Owner"]));
+    globalThis.expect(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(r), []).length).toBe(0);
+  });
+  globalThis.test("auth index: non-member passes through → results", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", []));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
   globalThis.test("unmapped kind throws", async () => {
     let threw;
     try {
-      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined), mkPayload("frobnicate", undefined, undefined, undefined));
+      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("frobnicate", undefined, undefined, undefined));
       threw = false;
     } catch (exn) {
       threw = true;