@reventlessdev/reventless-aws 3.0.0-alpha.177 → 3.0.0-alpha.178

package/tests/PgConnectionJsonTest.res

@@ -0,0 +1,84 @@
+// Rung-1 guard for the `pgConnection` HANDLER_CONFIG serialization (A3/B/C).
+//
+// `PgConnection.connectionConfigToJson` is the single producer of the object
+// every Postgres entry point reads at cold start (`config.pgConnection.*` →
+// `PgRuntime.poolFor`). The field set is an untyped cross-language contract — a
+// dropped/renamed/retyped field here only fails at runtime in the deployed
+// Lambda, which no compile catches. These tests pin the exact shape so a drift
+// fails in CI instead. All seven deploy-time builders now route through this
+// helper, so pinning it pins them all.
+
+open JestGlobals
+
+let cc: PgConnection.connectionConfig = {
+  host: "db.example.eu-west-1.rds.amazonaws.com",
+  port: 5432,
+  database: "reventless",
+  username: "reventless_admin",
+  secretArn: "arn:aws:secretsmanager:eu-west-1:123456789012:secret:rds!db-abc-123",
+}
+
+let obj = json => json->JSON.Decode.object->Option.getOrThrow
+let field = (json, key) => json->obj->Dict.get(key)
+
+describe("PgConnection.connectionConfigToJson", () => {
+  testSync("emits exactly the five connection fields with correct types", () => {
+    let json = cc->PgConnection.connectionConfigToJson
+    // Exact key set — no extra keys, none missing (the cold-start contract).
+    expect(json->obj->Dict.keysToArray->Array.toSorted(String.compare))->toEqual([
+      "database",
+      "host",
+      "port",
+      "secretArn",
+      "username",
+    ])
+    expect(json->field("host"))->toEqual(Some(JSON.Encode.string(cc.host)))
+    expect(json->field("database"))->toEqual(Some(JSON.Encode.string(cc.database)))
+    expect(json->field("username"))->toEqual(Some(JSON.Encode.string(cc.username)))
+    expect(json->field("secretArn"))->toEqual(Some(JSON.Encode.string(cc.secretArn)))
+    // port MUST be a JSON number (poolFor reads it as an int), not a string.
+    expect(json->field("port"))->toEqual(Some(JSON.Encode.float(5432.)))
+  })
+
+  testSync("omits lockStrategy when not given (classic / QueryDb / migration paths)", () =>
+    expect(cc->PgConnection.connectionConfigToJson->field("lockStrategy"))->toEqual(None)
+  )
+
+  testSync("adds lockStrategy=\"AdvisoryLocks\" as the polyvariant string name", () =>
+    expect(
+      cc
+      ->PgConnection.connectionConfigToJson(~lockStrategy=#AdvisoryLocks)
+      ->field("lockStrategy"),
+    )->toEqual(Some(JSON.Encode.string("AdvisoryLocks")))
+  )
+
+  testSync("adds lockStrategy=\"RowLocks\" as the polyvariant string name", () =>
+    expect(
+      cc
+      ->PgConnection.connectionConfigToJson(~lockStrategy=#RowLocks)
+      ->field("lockStrategy"),
+    )->toEqual(Some(JSON.Encode.string("RowLocks")))
+  )
+
+  testSync("with lockStrategy the object has exactly six keys", () =>
+    expect(
+      cc
+      ->PgConnection.connectionConfigToJson(~lockStrategy=#RowLocks)
+      ->obj
+      ->Dict.keysToArray
+      ->Array.length,
+    )->toBe(6)
+  )
+
+  testSync("round-trips through JSON.parse as the entry points do", () => {
+    // The entry point does `JSON.parse(HANDLER_CONFIG).pgConnection` — prove the
+    // stringify→parse survives and still exposes the fields poolFor reads.
+    let parsed =
+      `{"pgConnection":${cc->PgConnection.connectionConfigToJson->JSON.stringify}}`
+      ->JSON.parseOrThrow
+      ->field("pgConnection")
+      ->Option.getOrThrow
+    expect(parsed->field("host"))->toEqual(Some(JSON.Encode.string(cc.host)))
+    expect(parsed->field("secretArn"))->toEqual(Some(JSON.Encode.string(cc.secretArn)))
+  })
+})

package/tests/PgConnectionJsonTest.res.mjs

@@ -0,0 +1,68 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+import * as PgConnection$ReventlessAws from "../src/adapter/Postgres/PgConnection.res.mjs";
+
+let cc = {
+  host: "db.example.eu-west-1.rds.amazonaws.com",
+  port: 5432,
+  database: "reventless",
+  username: "reventless_admin",
+  secretArn: "arn:aws:secretsmanager:eu-west-1:123456789012:secret:rds!db-abc-123"
+};
+
+function obj(json) {
+  return Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(json), undefined);
+}
+
+function field(json, key) {
+  return obj(json)[key];
+}
+
+globalThis.describe("PgConnection.connectionConfigToJson", () => {
+  globalThis.test("emits exactly the five connection fields with correct types", () => {
+    let json = PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc);
+    globalThis.expect(Object.keys(obj(json)).toSorted(Primitive_string.compare)).toEqual([
+      "database",
+      "host",
+      "port",
+      "secretArn",
+      "username"
+    ]);
+    globalThis.expect(obj(json)["host"]).toEqual("db.example.eu-west-1.rds.amazonaws.com");
+    globalThis.expect(obj(json)["database"]).toEqual("reventless");
+    globalThis.expect(obj(json)["username"]).toEqual("reventless_admin");
+    globalThis.expect(obj(json)["secretArn"]).toEqual("arn:aws:secretsmanager:eu-west-1:123456789012:secret:rds!db-abc-123");
+    globalThis.expect(obj(json)["port"]).toEqual(5432);
+  });
+  globalThis.test("omits lockStrategy when not given (classic / QueryDb / migration paths)", () => {
+    let json = PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc);
+    globalThis.expect(obj(json)["lockStrategy"]).toEqual(undefined);
+  });
+  globalThis.test("adds lockStrategy=\"AdvisoryLocks\" as the polyvariant string name", () => {
+    let json = PgConnection$ReventlessAws.connectionConfigToJson("AdvisoryLocks", cc);
+    globalThis.expect(obj(json)["lockStrategy"]).toEqual("AdvisoryLocks");
+  });
+  globalThis.test("adds lockStrategy=\"RowLocks\" as the polyvariant string name", () => {
+    let json = PgConnection$ReventlessAws.connectionConfigToJson("RowLocks", cc);
+    globalThis.expect(obj(json)["lockStrategy"]).toEqual("RowLocks");
+  });
+  globalThis.test("with lockStrategy the object has exactly six keys", () => {
+    globalThis.expect(Object.keys(obj(PgConnection$ReventlessAws.connectionConfigToJson("RowLocks", cc))).length).toBe(6);
+  });
+  globalThis.test("round-trips through JSON.parse as the entry points do", () => {
+    let json = JSON.parse(`{"pgConnection":` + JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc)) + `}`);
+    let parsed = Stdlib_Option.getOrThrow(obj(json)["pgConnection"], undefined);
+    globalThis.expect(obj(parsed)["host"]).toEqual("db.example.eu-west-1.rds.amazonaws.com");
+    globalThis.expect(obj(parsed)["secretArn"]).toEqual("arn:aws:secretsmanager:eu-west-1:123456789012:secret:rds!db-abc-123");
+  });
+});
+
+export {
+  cc,
+  obj,
+  field,
+}
+/*  Not a pure module */

package/tests/PgMigrationEntryPoint_IntegrationTest.res

@@ -0,0 +1,82 @@
+// Rung-1 integration guard for the A3 schema-migration Lambda entry point.
+//
+// Drives the real `PgMigrationEntryPoint.runMigration` — the orchestration the
+// deployed one-shot migration Lambda runs (parse HANDLER_CONFIG → build pool →
+// PgSchema.ensureSchema). The pool source is injected so this exercises the
+// whole path against a real Postgres WITHOUT the Secrets Manager round-trip
+// (that AWS boundary is the only remaining unvalidated piece). Proves the
+// migration leaves a queryable schema and is safely re-runnable.
+//
+// Run via `pnpm run test:integration:pg` (boots a Postgres sidecar, runs the PG
+// suites serially, tears down). Excluded from the default parallel `pnpm test`.
+// The guard test (no pgConnection → throws) needs no DB; the live path is
+// skipped unless PG_URL is set (the script exports it).
+
+open JestGlobals
+
+@val external processEnv: dict<string> = "process.env"
+
+// Import the .mjs entry point and call runMigration with the pool injected.
+// Returns "ok" on success. A minimal pgConnection satisfies the guard; the real
+// fields are ignored because `makePool` is injected.
+let runMigrationWithPool: (
+  ReventlessPostgres.PgDriver.pool,
+) => promise<string> = %raw(`
+  async (pool) => {
+    const { runMigration } = await import(
+      "@reventlessdev/reventless-aws/src/adapter/Runtime/PgMigrationEntryPoint.mjs"
+    );
+    const config = {
+      pgConnection: {
+        host: "ignored", port: 5432, database: "ignored",
+        username: "ignored", secretArn: "ignored",
+      },
+    };
+    return await runMigration(config, { makePool: () => pool });
+  }
+`)
+
+// runMigration with an empty config — the guard must reject a HANDLER_CONFIG
+// that carries no pgConnection (a misconfigured deploy), rather than silently
+// building a bad pool.
+let runMigrationMissingConfigThrows: unit => promise<bool> = %raw(`
+  async () => {
+    const { runMigration } = await import(
+      "@reventlessdev/reventless-aws/src/adapter/Runtime/PgMigrationEntryPoint.mjs"
+    );
+    try { await runMigration({}, {}); return false; }
+    catch { return true; }
+  }
+`)
+
+describe("PgMigrationEntryPoint.runMigration", () => {
+  testPromise("rejects a HANDLER_CONFIG with no pgConnection", async () => {
+    let threw = await runMigrationMissingConfigThrows()
+    expect(threw)->toBe(true)
+  })
+
+  switch processEnv->Dict.get("PG_URL") {
+  | None =>
+    testSync("live migration (skipped — set PG_URL to run)", () => expect(true)->toBe(true))
+  | Some(url) =>
+    let pool = ReventlessPostgres.PgDriver.makePool({connectionString: url})
+    afterAll(() => {
+      let _ = pool->ReventlessPostgres.PgDriver.endPool
+    })
+
+    testPromise("runs ensureSchema, leaving both event logs queryable", async () => {
+      let _ = await runMigrationWithPool(pool)
+      // countAll queries the tables ensureSchema creates — it resolves (>= 0)
+      // only if `event_log` / `dcb_event` exist, and throws otherwise.
+      let classicCount = await ReventlessPostgres.EventLogStorage_Postgres.countAll(pool)
+      let dcbCount = await ReventlessPostgres.DcbEventLogStorage_Postgres.countAll(pool)
+      expect(classicCount >= 0 && dcbCount >= 0)->toBe(true)
+    })
+
+    testPromise("is idempotent — a second run does not throw", async () => {
+      let _ = await runMigrationWithPool(pool)
+      let again = await runMigrationWithPool(pool)
+      expect(again)->toBe("ok")
+    })
+  }
+})

package/tests/PgMigrationEntryPoint_IntegrationTest.res.mjs

@@ -0,0 +1,63 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as PgDriver$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/PgDriver.res.mjs";
+import * as EventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/EventLogStorage_Postgres.res.mjs";
+import * as DcbEventLogStorage_Postgres$ReventlessPostgres from "@reventlessdev/reventless-postgres/src/DcbEventLogStorage_Postgres.res.mjs";
+
+let runMigrationWithPool = (async (pool) => {
+    const { runMigration } = await import(
+      "@reventlessdev/reventless-aws/src/adapter/Runtime/PgMigrationEntryPoint.mjs"
+    );
+    const config = {
+      pgConnection: {
+        host: "ignored", port: 5432, database: "ignored",
+        username: "ignored", secretArn: "ignored",
+      },
+    };
+    return await runMigration(config, { makePool: () => pool });
+  });
+
+let runMigrationMissingConfigThrows = (async () => {
+    const { runMigration } = await import(
+      "@reventlessdev/reventless-aws/src/adapter/Runtime/PgMigrationEntryPoint.mjs"
+    );
+    try { await runMigration({}, {}); return false; }
+    catch { return true; }
+  });
+
+globalThis.describe("PgMigrationEntryPoint.runMigration", () => {
+  globalThis.test("rejects a HANDLER_CONFIG with no pgConnection", async () => {
+    let threw = await runMigrationMissingConfigThrows();
+    globalThis.expect(threw).toBe(true);
+  });
+  let url = process.env["PG_URL"];
+  if (url !== undefined) {
+    let pool = PgDriver$ReventlessPostgres.makePool({
+      connectionString: url
+    });
+    globalThis.afterAll(() => {
+      PgDriver$ReventlessPostgres.endPool(pool);
+    });
+    globalThis.test("runs ensureSchema, leaving both event logs queryable", async () => {
+      await runMigrationWithPool(pool);
+      let classicCount = await EventLogStorage_Postgres$ReventlessPostgres.countAll(pool);
+      let dcbCount = await DcbEventLogStorage_Postgres$ReventlessPostgres.countAll(pool);
+      globalThis.expect(classicCount >= 0 && dcbCount >= 0).toBe(true);
+    });
+    globalThis.test("is idempotent — a second run does not throw", async () => {
+      await runMigrationWithPool(pool);
+      let again = await runMigrationWithPool(pool);
+      globalThis.expect(again).toBe("ok");
+    });
+    return;
+  }
+  globalThis.test("live migration (skipped — set PG_URL to run)", () => {
+    globalThis.expect(true).toBe(true);
+  });
+});
+
+export {
+  runMigrationWithPool,
+  runMigrationMissingConfigThrows,
+}
+/* runMigrationWithPool Not a pure module */

package/tests/PgPipeline_IntegrationTest.res

@@ -1,6 +1,8 @@
 // End-to-end Postgres projection pipeline (B1 + B3.0 + B3.1 composed), minus AWS.
 //
-// Skipped unless PG_URL is set. Exercises the full deployed classic path against
+// Run via `pnpm run test:integration:pg` (boots a Postgres sidecar, runs the PG
+// suites serially, tears down). Excluded from the default parallel `pnpm test`;
+// self-skips unless PG_URL is set. Exercises the full deployed classic path against
 // a real database:
 //   classic append (`event_log`) → change-feed relay (`relayClassicWithPool`,
 //   emitting the EventCollector `{id, meta, event}` bodies) → feed-queue SQS

package/tests/PgQueryResolver_LambdaTest.res

@@ -293,6 +293,65 @@ describe("PgQueryResolver_Lambda.dispatch", () => {
     expect(r)->toBe(JSON.Encode.null)
   })
 
+  // ── auth-table pipeline (group-restricted index) ──────────────────────────
+  // Auth table (another read model) maps index value → { ownerId: <username> }.
+  let authStore = Dict.fromArray([
+    ("active", JSON.Encode.object(Dict.fromArray([("ownerId", JSON.Encode.string("alice"))]))),
+  ])
+  let authOps: QueryDb_Adapter.operations = {
+    load: async id => Ok(authStore->Dict.get(id)->Option.mapOr([], r => [r])),
+    loadStream: Obj.magic(0),
+    save: Obj.magic(0),
+    saveBatch: Obj.magic(0),
+    count: Obj.magic(0),
+    delete: Obj.magic(0),
+    deleteBatch: Obj.magic(0),
+  }
+  let authBinding = {...makeBinding(), PgQueryResolver_Lambda.ops: authOps}
+  let lookupAuth = name => name == "AuthTable" ? Some(authBinding) : None
+  let ident = (~username, ~groups): Reventless.Identity.t => {
+    userId: username,
+    username,
+    groups,
+    provider: InMemory,
+  }
+  let authIndexPayload = (~username, ~groups): PgQueryResolver_Lambda.payload => {
+    readModelName: "Things",
+    kind: "index",
+    index: "byStatus",
+    authTable: "AuthTable",
+    authGroup: "Owner",
+    arguments: objArgs([("byStatus", JSON.Encode.string("active"))]),
+    identity: ident(~username, ~groups),
+  }
+
+  testPromise("auth index: group member who owns → results", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~lookupBinding=lookupAuth,
+      ~payload=authIndexPayload(~username="alice", ~groups=["Owner"]),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
+  testPromise("auth index: group member who does NOT own → empty", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~lookupBinding=lookupAuth,
+      ~payload=authIndexPayload(~username="bob", ~groups=["Owner"]),
+    )
+    expect(r->JSON.Decode.array->Option.getOr([])->Array.length)->toBe(0)
+  })
+
+  testPromise("auth index: non-member passes through → results", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=makeBinding(),
+      ~lookupBinding=lookupAuth,
+      ~payload=authIndexPayload(~username="bob", ~groups=[]),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
   testPromise("unmapped kind throws", async () => {
     let threw = try {
       let _ = await PgQueryResolver_Lambda.dispatch(

package/tests/PgQueryResolver_LambdaTest.res.mjs

@@ -157,7 +157,7 @@ function ids(arr) {
 
 globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   globalThis.test("getById returns the item (id-carrying)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-2"
       ]]), undefined));
@@ -165,14 +165,14 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById miss → null", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "absent"
       ]]), undefined));
     globalThis.expect(r).toBe(null);
   });
   globalThis.test("byIds returns matches, drops missing", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
@@ -186,7 +186,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     ]);
   });
   globalThis.test("index routes to indexLookup on the idField", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("index", "byStatus", Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
         "byStatus",
         "active"
       ]]), undefined));
@@ -197,13 +197,13 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   });
   globalThis.test("list with push-down → returns the connection listPage gives", async () => {
     listPageReturn.contents = "PUSHED";
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("list", undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined));
     listPageReturn.contents = undefined;
     globalThis.expect(r).toEqual("PUSHED");
   });
   globalThis.test("list without push-down → falls back to the shared spec", async () => {
     listPageReturn.contents = undefined;
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("list", undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined));
     let edgeIds = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []), e => Stdlib_Option.flatMap(field(e, "node"), n => str(n, "id")));
     globalThis.expect(edgeIds).toEqual([
       "p-1",
@@ -212,14 +212,14 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     ]);
   });
   globalThis.test("items with subId routes to itemsPage (id echoed)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined), mkPayload("items", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
         "id",
         "p-2"
       ]]), undefined));
     globalThis.expect(str(r, "itemsFor")).toEqual("p-2");
   });
   globalThis.test("items without subId → empty connection", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("items", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
         "id",
         "p-2"
       ]]), undefined));
@@ -227,14 +227,14 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   });
   globalThis.test("authorization DenyAll → empty shape per kind", async () => {
     let b = makeBinding("DenyAll", undefined, undefined);
-    let single = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, mkPayload("getById", undefined, Object.fromEntries([[
+    let single = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
       ]]), undefined));
     globalThis.expect(single).toBe(null);
-    let list = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, mkPayload("list", undefined, undefined, undefined));
+    let list = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("list", undefined, undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(list, "edges"), Stdlib_JSON.Decode.array), []).length).toBe(0);
-    let byIds = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, mkPayload("byIds", undefined, Object.fromEntries([[
+    let byIds = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         []
       ]]), undefined));
@@ -245,7 +245,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       TAG: "Deny",
       _0: "nope"
     }));
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
       ]]), undefined));
@@ -271,7 +271,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
     globalThis.expect(str(r, "id")).toEqual("p-2");
   });
   globalThis.test("resolveOne multi via target index → array", async () => {
@@ -297,7 +297,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -324,7 +324,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -361,10 +361,89 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     let r = await PgQueryResolver_Lambda$ReventlessAws.handler(payload, null);
     globalThis.expect(r).toBe(null);
   });
+  let authStore = Object.fromEntries([[
+      "active",
+      Object.fromEntries([[
+          "ownerId",
+          "alice"
+        ]])
+    ]]);
+  let authOps_load = async id => ({
+    TAG: "Ok",
+    _0: Stdlib_Option.mapOr(authStore[id], [], r => [r])
+  });
+  let authOps = {
+    load: authOps_load,
+    loadStream: 0,
+    save: 0,
+    saveBatch: 0,
+    count: 0,
+    delete: 0,
+    deleteBatch: 0
+  };
+  let init = makeBinding(undefined, undefined, undefined);
+  let authBinding_pushdowns = init.pushdowns;
+  let authBinding_indexes = init.indexes;
+  let authBinding_subIdField = init.subIdField;
+  let authBinding_capability = init.capability;
+  let authBinding_labelField = init.labelField;
+  let authBinding_includeIdParam = init.includeIdParam;
+  let authBinding_authorization = init.authorization;
+  let authBinding = {
+    ops: authOps,
+    pushdowns: authBinding_pushdowns,
+    indexes: authBinding_indexes,
+    subIdField: authBinding_subIdField,
+    capability: authBinding_capability,
+    labelField: authBinding_labelField,
+    includeIdParam: authBinding_includeIdParam,
+    authorization: authBinding_authorization
+  };
+  let lookupAuth = name => {
+    if (name === "AuthTable") {
+      return authBinding;
+    }
+  };
+  let ident = (username, groups) => ({
+    userId: username,
+    username: username,
+    groups: groups,
+    provider: "InMemory"
+  });
+  let authIndexPayload = (username, groups) => ({
+    readModelName: "Things",
+    kind: "index",
+    index: "byStatus",
+    authTable: "AuthTable",
+    authGroup: "Owner",
+    arguments: Object.fromEntries([[
+        "byStatus",
+        "active"
+      ]]),
+    identity: ident(username, groups)
+  });
+  globalThis.test("auth index: group member who owns → results", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("alice", ["Owner"]));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+  globalThis.test("auth index: group member who does NOT own → empty", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", ["Owner"]));
+    globalThis.expect(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(r), []).length).toBe(0);
+  });
+  globalThis.test("auth index: non-member passes through → results", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", []));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
   globalThis.test("unmapped kind throws", async () => {
     let threw;
     try {
-      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), mkPayload("frobnicate", undefined, undefined, undefined));
+      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("frobnicate", undefined, undefined, undefined));
       threw = false;
     } catch (exn) {
       threw = true;