@reventlessdev/reventless-aws 3.0.0-alpha.200 → 3.0.0-alpha.201

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.201 (2026-07-13)
+
+### Bug Fixes
+
+* **api:** dual-auth arg-less IAM fields — extractLeadingName dropped the trailing colon ([ea34da2](https://github.com/ReventlessDev/reventless-core/commit/ea34da229164db63988ad035138c17ba9134ac55))
+
+
 # 3.0.0-alpha.200 (2026-07-12)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.200",
+  "version": "3.0.0-alpha.201",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -8,17 +8,17 @@
     "@aws-sdk/client-cloudfront": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.21",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.27",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.50",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.15",
+    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.21",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.7",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.15",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.50",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.15",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.159",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.160",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.98",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.26",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.76",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.23"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.24"
   },
   "devDependencies": {
     "rescript": "^12.3.0",

package/tests/AppSync_SdlDecorateTest.res

@@ -94,6 +94,38 @@ describe("AppSync_Adapter.stitchWithAwsDirectives", () => {
   })
 })
 
+describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
+  // Regression: an ARG-LESS field named in iamFieldNames must still get @aws_iam.
+  // extractLeadingName used to return `Platform_ApiFragments:` (trailing colon) for
+  // arg-less fields, so isIam missed it and the field stayed Cognito-only — which
+  // 401'd the deploy waiter's SigV4 poll of Platform_ApiFragments on real AWS.
+  testSync("dual-auths an arg-less query field named in iamFieldNames", () => {
+    let base = ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations: [`  Platform_RegisterApiFragment(input: In): CommandResult`],
+      queries: [`  Platform_ApiFragments: [Entry!]!`, `  Other_Query: Int`],
+      subscriptions: [],
+      subscriptionSources: [],
+    })
+    let decorated = AppSync_SdlDecorate.injectAwsAuthAll(
+      base,
+      ~group="Admin",
+      ~iamFieldNames=["Platform_RegisterApiFragment", "Platform_ApiFragments"],
+    )
+    let parts = ReventlessCore.GraphQL_Stitcher.decode(decorated)
+    let queryField = name =>
+      parts.queries->Array.find(q => q->String.includes(name))->Option.getOrThrow
+    // The arg-less IAM query gets dual-auth.
+    expect(queryField("Platform_ApiFragments"))->toContain("@aws_iam")
+    // The arg-full IAM mutation still does too.
+    expect(parts.mutations->Array.getUnsafe(0))->toContain("@aws_iam")
+    // A query NOT in iamFieldNames stays Cognito-only.
+    let other = queryField("Other_Query")
+    expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(other->String.includes("@aws_iam"))->toBe(false)
+  })
+})
+
 describe("AppSync_SdlDecorate.planAwsPushes", () => {
   // Neutral admin base: a system-callable mutation + a shared traversal type.
   let rawAdminBase = ReventlessCore.GraphQL_Stitcher.encode({

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -89,6 +89,32 @@ globalThis.describe("AppSync_Adapter.stitchWithAwsDirectives", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
+  globalThis.test("dual-auths an arg-less query field named in iamFieldNames", () => {
+    let base = GraphQL_Stitcher$ReventlessCore.encode({
+      types: [],
+      mutations: [`  Platform_RegisterApiFragment(input: In): CommandResult`],
+      queries: [
+        `  Platform_ApiFragments: [Entry!]!`,
+        `  Other_Query: Int`
+      ],
+      subscriptions: [],
+      subscriptionSources: []
+    });
+    let decorated = AppSync_SdlDecorate$ReventlessAws.injectAwsAuthAll(base, "Admin", [
+      "Platform_RegisterApiFragment",
+      "Platform_ApiFragments"
+    ]);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(decorated);
+    let queryField = name => Stdlib_Option.getOrThrow(parts.queries.find(q => q.includes(name)), undefined);
+    globalThis.expect(queryField("Platform_ApiFragments")).toContain("@aws_iam");
+    globalThis.expect(parts.mutations[0]).toContain("@aws_iam");
+    let other = queryField("Other_Query");
+    globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(other.includes("@aws_iam")).toBe(false);
+  });
+});
+
 globalThis.describe("AppSync_SdlDecorate.planAwsPushes", () => {
   let rawAdminBase = GraphQL_Stitcher$ReventlessCore.encode({
     types: [`type CommandAccepted {\n  id: ID!\n}`],