@reventlessdev/reventless-aws 3.0.0-alpha.177 → 3.0.0-alpha.179

package/src/adapter/Postgres/PgConnection.res

@@ -35,6 +35,32 @@ type connectionConfig = {
   secretArn: string,
 }
 
+/** Serialize a resolved `connectionConfig` into the `pgConnection` JSON object
+  the runtime entry points read from `HANDLER_CONFIG` (and `PgRuntime.poolFor`
+  reconstructs). One shared producer so all seven deploy-time builders emit a
+  byte-identical shape — the field set is a cold-start contract with the entry
+  points, so a drift here silently breaks a Lambda. `~lockStrategy` is included
+  only on the DCB command path (the sole Postgres append that takes a lock);
+  omit it everywhere else. Kept pure (no Pulumi) so it is directly unit-testable. */
+let connectionConfigToJson = (
+  ~lockStrategy: option<ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy>=?,
+  cc: connectionConfig,
+): JSON.t => {
+  let fields = [
+    ("host", cc.host->JSON.Encode.string),
+    ("port", cc.port->Int.toFloat->JSON.Encode.float),
+    ("database", cc.database->JSON.Encode.string),
+    ("username", cc.username->JSON.Encode.string),
+    ("secretArn", cc.secretArn->JSON.Encode.string),
+  ]
+  switch lockStrategy {
+  | Some(#AdvisoryLocks) => fields->Array.push(("lockStrategy", "AdvisoryLocks"->JSON.Encode.string))
+  | Some(#RowLocks) => fields->Array.push(("lockStrategy", "RowLocks"->JSON.Encode.string))
+  | None => ()
+  }
+  fields->Dict.fromArray->JSON.Encode.object
+}
+
 type t = {
   /** Deploy-time resources (currently the RDS instance) for dependency wiring —
     e.g. the A3 migration Lambda and the B-phase adapters order after these. */
@@ -46,6 +72,14 @@ type t = {
   /** The DB's private subnets, echoed back for the Lambda `vpcConfig` so
     handlers land in the same subnets as the database. */
   subnetIds: array<Pulumi.Input.t<string>>,
+  /** DCB append lock strategy (C2). `#AdvisoryLocks` (default) is
+    transaction-scoped and lowest-overhead when Lambdas hold a few long-lived
+    pools **directly** against RDS, but it **pins connections on RDS Proxy**
+    (advisory locks are session state Proxy cannot multiplex). Choose
+    `#RowLocks` when fronting the DB with RDS Proxy so the Proxy can share
+    connections across invocations. Threaded to the DCB command Lambda via
+    `DcbBackend`; classic EventLog and QueryDb appends take no such lock. */
+  lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy,
 }
 
 /** Postgres wire port. */
@@ -65,8 +99,13 @@ let make = (
   ~backupRetentionPeriod=7,
   ~deletionProtection=true,
   ~skipFinalSnapshot=false,
+  ~lockStrategy: ReventlessPostgres.DcbEventLogStorage_Postgres.lockStrategy=#AdvisoryLocks,
   ~opts: option<Pulumi.ComponentResource.options>=?,
 ): t => {
+  // Keep the caller's ComponentResource.options for sub-builders that take it
+  // directly (PgMigration_Builder → RuntimeEnvironment_Lambda); the RDS/SG/subnet
+  // resources below want the CustomResourceOptions form.
+  let componentOpts = opts
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
@@ -151,19 +190,40 @@ let make = (
       },
     })
 
+  // A3: run PgSchema.ensureSchema against the fresh instance via a one-shot
+  // in-VPC migration Lambda invoked during `pulumi up`. Its resources join the
+  // instance's so the B-phase storage adapters can order after the schema exists.
+  // The connection is passed as pre-serialized pieces to avoid a module cycle
+  // (PgMigration_Builder must not reference this module's `connectionConfig`).
+  let migrationHandlerConfig = connectionConfig->Pulumi.Output.apply(cc =>
+    `{"pgConnection":${cc->connectionConfigToJson->JSON.stringify}}`
+  )
+  let migrationResources = PgMigration_Builder.make(
+    ~name=`${name}-pg-migrate`,
+    ~handlerConfig=migrationHandlerConfig,
+    ~secretArn=connectionConfig->Pulumi.Output.apply(cc => cc.secretArn),
+    ~securityGroupId=sg.id,
+    ~subnetIds,
+    ~opts=?componentOpts,
+  )
+
   {
-    resources: [
-      ReventlessInfra.Adapter.make(
-        ~name=name->Pulumi.Output.make,
-        ~id=instance.id,
-        ~urn=instance.arn,
-        ~service="aws:rds"->Pulumi.Output.make,
-        ~role="postgres"->Pulumi.Output.make,
-        ~resourceType="aws:rds:Instance"->Pulumi.Output.make,
-      ),
-    ],
+    resources: Array.concat(
+      [
+        ReventlessInfra.Adapter.make(
+          ~name=name->Pulumi.Output.make,
+          ~id=instance.id,
+          ~urn=instance.arn,
+          ~service="aws:rds"->Pulumi.Output.make,
+          ~role="postgres"->Pulumi.Output.make,
+          ~resourceType="aws:rds:Instance"->Pulumi.Output.make,
+        ),
+      ],
+      migrationResources,
+    ),
     connectionConfig,
     securityGroupId: sg.id,
     subnetIds,
+    lockStrategy,
   }
 }

package/src/adapter/Postgres/PgConnection.res.mjs

@@ -9,6 +9,7 @@ import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js
 import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as EC2_SecurityGroup$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/EC2/EC2_SecurityGroup.res.mjs";
+import * as PgMigration_Builder$ReventlessAws from "./PgMigration_Builder.res.mjs";
 
 let connectionConfigSchema = S.schema(s => ({
   host: s.m(S.string),
@@ -18,7 +19,46 @@ let connectionConfigSchema = S.schema(s => ({
   secretArn: s.m(S.string)
 }));
 
-function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersionOpt, instanceClassOpt, allocatedStorageOpt, multiAzOpt, storageEncryptedOpt, backupRetentionPeriodOpt, deletionProtectionOpt, skipFinalSnapshotOpt, opts) {
+function connectionConfigToJson(lockStrategy, cc) {
+  let fields = [
+    [
+      "host",
+      cc.host
+    ],
+    [
+      "port",
+      cc.port
+    ],
+    [
+      "database",
+      cc.database
+    ],
+    [
+      "username",
+      cc.username
+    ],
+    [
+      "secretArn",
+      cc.secretArn
+    ]
+  ];
+  if (lockStrategy !== undefined) {
+    if (lockStrategy === "AdvisoryLocks") {
+      fields.push([
+        "lockStrategy",
+        "AdvisoryLocks"
+      ]);
+    } else {
+      fields.push([
+        "lockStrategy",
+        "RowLocks"
+      ]);
+    }
+  }
+  return Object.fromEntries(fields);
+}
+
+function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersionOpt, instanceClassOpt, allocatedStorageOpt, multiAzOpt, storageEncryptedOpt, backupRetentionPeriodOpt, deletionProtectionOpt, skipFinalSnapshotOpt, lockStrategyOpt, opts) {
   let databaseName = databaseNameOpt !== undefined ? databaseNameOpt : "reventless";
   let username = usernameOpt !== undefined ? usernameOpt : "reventless_admin";
   let engineVersion = engineVersionOpt !== undefined ? engineVersionOpt : "16";
@@ -29,6 +69,7 @@ function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersio
   let backupRetentionPeriod = backupRetentionPeriodOpt !== undefined ? backupRetentionPeriodOpt : 7;
   let deletionProtection = deletionProtectionOpt !== undefined ? deletionProtectionOpt : true;
   let skipFinalSnapshot = skipFinalSnapshotOpt !== undefined ? skipFinalSnapshotOpt : false;
+  let lockStrategy = lockStrategyOpt !== undefined ? lockStrategyOpt : "AdvisoryLocks";
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
   let tags = Object.fromEntries([
     [
@@ -94,11 +135,14 @@ function make(name, vpcId, subnetIds, databaseNameOpt, usernameOpt, engineVersio
       secretArn: secret !== undefined ? secret.secretArn : Stdlib_JsError.throwWithMessage("RDS instance exposes no master user secret — manageMasterUserPassword must be enabled")
     };
   });
+  let migrationHandlerConfig = connectionConfig.apply(cc => `{"pgConnection":` + JSON.stringify(connectionConfigToJson(undefined, cc)) + `}`);
+  let migrationResources = PgMigration_Builder$ReventlessAws.make(name + `-pg-migrate`, migrationHandlerConfig, connectionConfig.apply(cc => cc.secretArn), sg.id, subnetIds, opts);
   return {
-    resources: [Adapter$ReventlessInfra.make(Pulumi.output(name), instance.id, instance.arn, Pulumi.output("aws:rds"), undefined, Pulumi.output("postgres"), undefined, Pulumi.output("aws:rds:Instance"), undefined, undefined)],
+    resources: [Adapter$ReventlessInfra.make(Pulumi.output(name), instance.id, instance.arn, Pulumi.output("aws:rds"), undefined, Pulumi.output("postgres"), undefined, Pulumi.output("aws:rds:Instance"), undefined, undefined)].concat(migrationResources),
     connectionConfig: connectionConfig,
     securityGroupId: sg.id,
-    subnetIds: subnetIds
+    subnetIds: subnetIds,
+    lockStrategy: lockStrategy
   };
 }
 
@@ -106,6 +150,7 @@ let port = 5432;
 
 export {
   connectionConfigSchema,
+  connectionConfigToJson,
   port,
   make,
 }

package/src/adapter/Postgres/PgMigration_Builder.res

@@ -0,0 +1,127 @@
+// Deploy-time builder for the one-shot Postgres schema migration (A3).
+//
+// Provisions an in-VPC Lambda whose only job is to run `PgSchema.ensureSchema`
+// against the freshly-provisioned RDS instance, and an `aws.lambda.Invocation`
+// resource that invokes it once during `pulumi up`. Because the invocation runs
+// the Lambda *inside* the DB's VPC, the deploy runner itself needs no network
+// path to the private instance — the reason the plan (A3) chose a migration
+// Lambda over a Pulumi `command`/dynamic resource that would have to connect
+// from the runner.
+//
+// `PgConnection.make` calls this after creating the instance so every
+// `PgConnection` provisions its own schema; the returned resources are appended
+// to `PgConnection.t.resources` so the B-phase storage adapters order after the
+// migration. `ensureSchema` is idempotent (all `IF NOT EXISTS`), so the
+// invocation re-runs safely whenever the migration code or the Reventless Lambda
+// layer (which ships the DDL) changes.
+
+// Takes the connection as already-serialized pieces rather than the
+// `PgConnection.connectionConfig` record: `PgConnection` calls this builder, so
+// referencing its type here would form a module cycle. The caller passes:
+//   ~handlerConfig — the full HANDLER_CONFIG JSON (`{"pgConnection":{…}}`),
+//   ~secretArn     — the DB's RDS-managed master secret ARN (for the IAM grant).
+// ~securityGroupId: DB-access SG the migration Lambda attaches (PgConnection.securityGroupId).
+// ~subnetIds: private subnets for the in-VPC migration Lambda (PgConnection.subnetIds).
+let make = (
+  ~name: string,
+  ~handlerConfig: Pulumi.Output.t<string>,
+  ~secretArn: Pulumi.Output.t<string>,
+  ~securityGroupId: Pulumi.Output.t<string>,
+  ~subnetIds: array<Pulumi.Input.t<string>>,
+  ~opts: option<Pulumi.ComponentResource.options>=?,
+): array<ReventlessInfra.Adapter.resource> => {
+  open PulumiAws
+
+  let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+    ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Runtime/PgMigrationEntryPoint.mjs",
+    ~packageDirs=Dict.make(),
+  )
+
+  let envVars = Dict.fromArray([("HANDLER_CONFIG", handlerConfig->Pulumi.Output.asInput)])
+
+  let vpcConfig =
+    securityGroupId
+    ->Pulumi.Output.apply(sgId =>
+      (
+        {
+          Lambda.Function.subnetIds: subnetIds->Pulumi.Input.make,
+          securityGroupIds: [sgId->Pulumi.Input.make]->Pulumi.Input.make,
+        }: Lambda.Function.vpcConfig
+      )
+    )
+    ->Pulumi.Output.asInput
+
+  let runtime = RuntimeEnvironment_Lambda.makeFromCodeAsset(
+    ~name,
+    ~code,
+    ~sourceCodeHash,
+    ~envVars,
+    ~vpcConfig,
+    ~opts?,
+  )
+
+  // IAM: GetSecretValue on the DB's RDS-managed master secret. Built outside an
+  // Output.apply so the RolePolicy is a top-level resource the invocation can
+  // `dependsOn` (invoke only after the Lambda can read the secret).
+  let rolePolicy = {
+    open PulumiAws.PolicyDocument
+    IAM.RolePolicy.make(
+      ~name=`${name}MigrationAccess`,
+      ~args={
+        policy: secretArn
+        ->Pulumi.Output.apply(arn =>
+          PulumiAws.PolicyDocument.make(
+            ~id=`${name}MigrationAccessPolicy`,
+            ~statements=[
+              {
+                sid: "AllowGetSecret",
+                effect: Allow,
+                actions: Action("secretsmanager:GetSecretValue"),
+                resources: Resource(arn),
+              },
+            ],
+          )->PulumiAws.PolicyDocument.toJsonString
+        )
+        ->Pulumi.Output.asInput,
+        role: runtime.parts.lambdaRole.id->Pulumi.Output.asInput,
+      },
+    )
+  }
+
+  // Re-invoke whenever the migration code or the Reventless layer (which ships
+  // PgSchema's DDL) changes; idempotent DDL makes an unchanged re-run a no-op.
+  let layerArn = PulumiAws.Lambda.reventlessLayerArn->Option.getOr("no-layer")
+  let inputJson =
+    [("trigger", `${sourceCodeHash}:${layerArn}`->JSON.Encode.string)]
+    ->Dict.fromArray
+    ->JSON.Encode.object
+    ->JSON.stringify
+
+  let invocation = Lambda.Invocation.make(
+    ~name=`${name}Migrate`,
+    ~args={
+      // Ordering: functionName ties to the Lambda, whose env depends on
+      // connectionConfig (the instance's resolved outputs), so the invocation
+      // waits for the DB to be available. dependsOn adds the secret-access policy.
+      functionName: runtime.parts.lambda->Pulumi.Output.flatMap(l => l.name)->Pulumi.Output.asInput,
+      input: inputJson->Pulumi.Input.make,
+    },
+    ~opts={
+      dependsOn: [rolePolicy->Pulumi.Resource.makeFromJs]->Pulumi.Input.make,
+    },
+  )
+
+  Array.concat(
+    runtime.resources,
+    [
+      ReventlessInfra.Adapter.make(
+        ~name=`${name}Migration`->Pulumi.Output.make,
+        ~id=invocation.id,
+        ~urn=invocation.id,
+        ~service="aws:lambda"->Pulumi.Output.make,
+        ~role="postgres-migration"->Pulumi.Output.make,
+        ~resourceType="aws:lambda:Invocation"->Pulumi.Output.make,
+      ),
+    ],
+  )
+}

package/src/adapter/Postgres/PgMigration_Builder.res.mjs

@@ -0,0 +1,51 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
+import * as Adapter$ReventlessInfra from "@reventlessdev/reventless-infra/src/adapter/Adapter.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+
+function make(name, handlerConfig, secretArn, securityGroupId, subnetIds, opts) {
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/PgMigrationEntryPoint.mjs", {}, undefined);
+  let sourceCodeHash = match.sourceCodeHash;
+  let envVars = Object.fromEntries([[
+      "HANDLER_CONFIG",
+      handlerConfig
+    ]]);
+  let vpcConfig = securityGroupId.apply(sgId => ({
+    subnetIds: subnetIds,
+    securityGroupIds: [sgId]
+  }));
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, match.code, sourceCodeHash, envVars, undefined, undefined, undefined, undefined, undefined, undefined, vpcConfig, opts);
+  let rolePolicy = new (Aws.iam.RolePolicy)(name + `MigrationAccess`, {
+    policy: secretArn.apply(arn => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `MigrationAccessPolicy`, [{
+        Sid: "AllowGetSecret",
+        Effect: "Allow",
+        Action: "secretsmanager:GetSecretValue",
+        Resource: arn
+      }]))),
+    role: runtime.parts.lambdaRole.id
+  });
+  let layerArn = Stdlib_Option.getOr(Lambda$PulumiAws.reventlessLayerArn, "no-layer");
+  let inputJson = JSON.stringify(Object.fromEntries([[
+      "trigger",
+      sourceCodeHash + `:` + layerArn
+    ]]));
+  let invocation = new (Aws.lambda.Invocation)(name + `Migrate`, {
+    functionName: Output$Pulumi.flatMap(runtime.parts.lambda, l => l.name),
+    input: inputJson
+  }, {
+    dependsOn: [rolePolicy]
+  });
+  return runtime.resources.concat([Adapter$ReventlessInfra.make(Pulumi.output(name + `Migration`), invocation.id, invocation.id, Pulumi.output("aws:lambda"), undefined, Pulumi.output("postgres-migration"), undefined, Pulumi.output("aws:lambda:Invocation"), undefined, undefined)]);
+}
+
+export {
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/QueryDb/PgQueryResolver_Builder.res

@@ -81,21 +81,19 @@ export function response(ctx) {
 // Serialize the shared connection config into the env-config JSON (same shape
 // EventCollectorRuntime_Builder_Single bakes into HANDLER_CONFIG).
 let pgConnectionJson = (cc: PgConnection.connectionConfig): string =>
-  [
-    ("host", cc.host->JSON.Encode.string),
-    ("port", cc.port->Int.toFloat->JSON.Encode.float),
-    ("database", cc.database->JSON.Encode.string),
-    ("username", cc.username->JSON.Encode.string),
-    ("secretArn", cc.secretArn->JSON.Encode.string),
-  ]
-  ->Dict.fromArray
-  ->JSON.Encode.object
-  ->JSON.stringify
+  cc->PgConnection.connectionConfigToJson->JSON.stringify
 
 let provision = (
   ~api: Pulumi.Output.t<AppSync.GraphQLApi.t>,
   ~selection: QueryDbBackend.selection,
   ~opts: Pulumi.ComponentResource.options,
+  // The shared node(id) resolver is a single resolver on the API's Query.node
+  // field. In plugin-stack mode each plugin stack deploys independently onto one
+  // shared API, so only ONE stack may own that field — and a per-plugin node
+  // resolver only knows its own plugin's types anyway. So node is provisioned in
+  // monolithic mode only; plugin stacks pass false. (Node is not wired on the
+  // DynamoDB path either — it stays a monolithic-only capability for now.)
+  ~createNodeResolver: bool=true,
 ): unit => {
   // Join the resolver-binding registry (labelField/includeIdParam) with the
   // ReadModel runtime registry (specModulePath, pgBacked). Only read models
@@ -260,9 +258,9 @@ let provision = (
 
     // Shared node(id) resolver (B3.2c) — one for the whole API, dispatched by
     // typeName in the Lambda. Only when some entity registered a node type
-    // (else the `node` field isn't in the schema). Mirrors NodeResolver_AppSync,
-    // which likewise creates the node resolver directly at deploy time.
-    if nodeTypes->Dict.toArray->Array.length > 0 {
+    // (else the `node` field isn't in the schema) AND in monolithic mode
+    // (plugin stacks would collide on the single Query.node field).
+    if createNodeResolver && nodeTypes->Dict.toArray->Array.length > 0 {
       let _nodeResolver = AppSync_Resolver_Retrying.makeUnitJsResolver(
         ~name=name ++ "NodeResolver",
         ~api,

package/src/adapter/QueryDb/PgQueryResolver_Builder.res.mjs

@@ -11,6 +11,7 @@ import * as AWS$ReventlessAws from "../AWS.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as PgConnection$ReventlessAws from "../Postgres/PgConnection.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
@@ -70,31 +71,11 @@ export function response(ctx) {
 `;
 
 function pgConnectionJson(cc) {
-  return JSON.stringify(Object.fromEntries([
-    [
-      "host",
-      cc.host
-    ],
-    [
-      "port",
-      cc.port
-    ],
-    [
-      "database",
-      cc.database
-    ],
-    [
-      "username",
-      cc.username
-    ],
-    [
-      "secretArn",
-      cc.secretArn
-    ]
-  ]));
+  return JSON.stringify(PgConnection$ReventlessAws.connectionConfigToJson(undefined, cc));
 }
 
-function provision(api, selection, opts) {
+function provision(api, selection, opts, createNodeResolverOpt) {
+  let createNodeResolver = createNodeResolverOpt !== undefined ? createNodeResolverOpt : true;
   let handlers = Stdlib_Array.filterMap(Object.values(entries), entry => {
     let info = EventCollectorRuntime_Builder_Single$ReventlessAws.readModelInfos[entry.readModelName];
     if (info !== undefined && info.pgBacked) {
@@ -163,7 +144,7 @@ function provision(api, selection, opts) {
     },
     serviceRoleArn: dataSourceRole.arn
   }, customOpts);
-  if (Object.entries(nodeTypes).length !== 0) {
+  if (createNodeResolver && Object.entries(nodeTypes).length !== 0) {
     AppSync_Resolver_Retrying$ReventlessAws.makeUnitJsResolver(name + "NodeResolver", api, dataSource.name, "Query", "node", nodeResolverCode, customOpts);
   }
   dataSource.name.apply(n => resolveDataSourceName.contents(n));

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res

@@ -41,10 +41,22 @@ type payload = {
   targetIndex?: string,
   targetIndexIdField?: string,
   multi?: bool,
+  // Auth-table pipeline (B3.2c): a group-restricted index. Group members must
+  // own the resource (the auth table maps index value → {<group>Id: username});
+  // non-members pass through (mirrors the DynamoDB pipeline's earlyReturn).
+  authTable?: string,
+  authGroup?: string,
   arguments: JSON.t,
   identity: Reventless.Identity.t,
 }
 
+// "Owner" → "ownerId" (auth-table owner field name, matching authorizeIndexedAccess).
+let authIdField = (group: string): string =>
+  switch group->String.get(0) {
+  | Some(c) => c->String.toLowerCase ++ group->String.slice(~start=1, ~end=group->String.length) ++ "Id"
+  | None => "Id"
+  }
+
 // The Postgres query push-downs a binding needs (QueryEnginePostgres.Make
 // provides these; the mock in tests provides in-memory equivalents).
 type pushdowns = {
@@ -130,7 +142,14 @@ let runInterceptor = async (~binding, ~payload): ReventlessCore.QueryDb_Callback
   }
 }
 
-let dispatch = async (~binding: binding, ~payload: payload): JSON.t => {
+// `lookupBinding` resolves another read model's binding by key — needed only for
+// the auth-table pipeline (the auth table is another read model, loaded by the
+// index value). The handler passes the module-level registry; tests pass a mock.
+let dispatch = async (
+  ~binding: binding,
+  ~lookupBinding: string => option<binding>=_ => None,
+  ~payload: payload,
+): JSON.t => {
   let rm = payload.readModelName
   switch await runInterceptor(~binding, ~payload) {
   | Deny(_) =>
@@ -183,7 +202,35 @@ let dispatch = async (~binding: binding, ~payload: payload): JSON.t => {
         ->Option.flatMap(ic => ic.idField)
         ->Option.getOr(indexName)
       let value = payload.arguments->argStr(indexName)->Option.getOr("")
-      JSON.Encode.array(await binding.pushdowns.indexLookup(~readModelName=rm, field, value))
+      // Auth-table pipeline: a group-restricted index. Non-members pass through;
+      // members must own the resource (auth table maps index value →
+      // {<group>Id: username}). Auth table is another read model, loaded via the
+      // registry (unsupported → deny if it isn't Postgres-registered).
+      let authorized = switch (payload.authGroup, payload.authTable) {
+      | (Some(group), Some(authTable)) =>
+        if !Reventless.Identity.hasGroup(payload.identity, group) {
+          true
+        } else {
+          switch lookupBinding(authTable) {
+          | Some(authBinding) =>
+            switch await authBinding.ops.load(value) {
+            | Ok(items) =>
+              items
+              ->Array.get(0)
+              ->Option.flatMap(row => row->argStr(authIdField(group)))
+              ->Option.mapOr(false, owner => owner == payload.identity.username)
+            | Error(_) => false
+            }
+          | None => false
+          }
+        }
+      | _ => true
+      }
+      if authorized {
+        JSON.Encode.array(await binding.pushdowns.indexLookup(~readModelName=rm, field, value))
+      } else {
+        JSON.Encode.array([])
+      }
 
     | "list" =>
       let argsDict = payload.arguments->argObj
@@ -327,7 +374,8 @@ let handler = async (payload: payload, _context) => {
   | "node" => await handleNode(~payload)
   | _ =>
     switch bindings->Dict.get(bindingKey) {
-    | Some(binding) => await dispatch(~binding, ~payload)
+    | Some(binding) =>
+      await dispatch(~binding, ~lookupBinding=name => bindings->Dict.get(name), ~payload)
     | None =>
       JsError.throwWithMessage("PgQueryResolver: no binding registered for read model " ++ bindingKey)
     }