@reventlessdev/reventless-aws 3.0.0-alpha.282 → 3.0.0-alpha.284

package/tests/PgQueryResolver_LambdaTest.res.mjs

@@ -6,29 +6,32 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
 import * as PgQueryResolver_Lambda$ReventlessAws from "../src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs";
 
-function mk(id, status, name) {
+function mk(id, status, name, owner) {
   let o = {};
   o["id"] = id;
   o["status"] = status;
   o["name"] = name;
+  o["owner"] = owner;
   return o;
 }
 
 let store = Object.fromEntries([
   [
     "p-1",
-    mk("p-1", "active", "Alpha")
+    mk("p-1", "active", "Alpha", "u-a")
   ],
   [
     "p-2",
-    mk("p-2", "inactive", "Bravo")
+    mk("p-2", "inactive", "Bravo", "u-b")
   ],
   [
     "p-3",
-    mk("p-3", "active", "Charlie")
+    mk("p-3", "active", "Charlie", "u-a")
   ]
 ]);
 
@@ -44,6 +47,10 @@ let listPageReturn = {
   contents: undefined
 };
 
+let lastOwnerScope = {
+  contents: undefined
+};
+
 async function ops_load(id) {
   return {
     TAG: "Ok",
@@ -69,11 +76,12 @@ async function pushdowns_byIds(param, ids) {
   return Stdlib_Array.filterMap(ids, id => store[id]);
 }
 
-async function pushdowns_listPage(param, param$1, param$2, param$3) {
+async function pushdowns_listPage(param, param$1, param$2, param$3, ownerScope) {
+  lastOwnerScope.contents = ownerScope;
   return listPageReturn.contents;
 }
 
-async function pushdowns_itemsPage(param, param$1, id, param$2) {
+async function pushdowns_itemsPage(param, param$1, id, param$2, param$3) {
   return Object.fromEntries([[
       "itemsFor",
       id
@@ -108,9 +116,10 @@ let capability = {
   sortFields: capability_sortFields
 };
 
-function makeBinding(authorizationOpt, subIdFieldOpt, param) {
+function makeBinding(authorizationOpt, subIdFieldOpt, ownerFieldOpt, param) {
   let authorization = authorizationOpt !== undefined ? authorizationOpt : "AllowAnonymous";
   let subIdField = subIdFieldOpt !== undefined ? Primitive_option.valFromOption(subIdFieldOpt) : undefined;
+  let ownerField = ownerFieldOpt !== undefined ? Primitive_option.valFromOption(ownerFieldOpt) : undefined;
   return {
     ops: ops,
     pushdowns: pushdowns,
@@ -124,18 +133,29 @@ function makeBinding(authorizationOpt, subIdFieldOpt, param) {
     capability: capability,
     labelField: "name",
     includeIdParam: true,
-    authorization: authorization
+    authorization: authorization,
+    ownerField: ownerField
   };
 }
 
-function mkPayload(kind, index, argsOpt, param) {
+function mkPayload(kind, index, argsOpt, identityOpt, param) {
   let args = argsOpt !== undefined ? argsOpt : ({});
+  let identity = identityOpt !== undefined ? identityOpt : Identity$Reventless.anonymous;
   return {
     readModelName: "Things",
     kind: kind,
     index: index,
     arguments: args,
-    identity: Identity$Reventless.anonymous
+    identity: identity
+  };
+}
+
+function cognito(userId, groups) {
+  return {
+    userId: userId,
+    username: userId,
+    groups: groups,
+    provider: "Cognito"
   };
 }
 
@@ -157,39 +177,39 @@ function ids(arr) {
 
 globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   globalThis.test("getById returns the item (id-carrying)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-2"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(str(r, "id")).toEqual("p-2");
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById miss → null", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "absent"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(r).toBe(null);
   });
   globalThis.test("byIds returns matches, drops missing", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
           "absent",
           "p-3"
         ].map(prim => prim)
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("index routes to indexLookup on the idField", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
         "byStatus",
         "active"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -197,13 +217,13 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   });
   globalThis.test("list with push-down → returns the connection listPage gives", async () => {
     listPageReturn.contents = "PUSHED";
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined, undefined));
     listPageReturn.contents = undefined;
     globalThis.expect(r).toEqual("PUSHED");
   });
   globalThis.test("list without push-down → falls back to the shared spec", async () => {
     listPageReturn.contents = undefined;
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined, undefined));
     let edgeIds = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []), e => Stdlib_Option.flatMap(field(e, "node"), n => str(n, "id")));
     globalThis.expect(edgeIds).toEqual([
       "p-1",
@@ -212,32 +232,32 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     ]);
   });
   globalThis.test("items with subId routes to itemsPage (id echoed)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
         "id",
         "p-2"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(str(r, "itemsFor")).toEqual("p-2");
   });
   globalThis.test("items without subId → empty connection", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
         "id",
         "p-2"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []).length).toBe(0);
   });
   globalThis.test("authorization DenyAll → empty shape per kind", async () => {
-    let b = makeBinding("DenyAll", undefined, undefined);
+    let b = makeBinding("DenyAll", undefined, undefined, undefined);
     let single = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(single).toBe(null);
-    let list = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("list", undefined, undefined, undefined));
+    let list = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("list", undefined, undefined, undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(list, "edges"), Stdlib_JSON.Decode.array), []).length).toBe(0);
     let byIds = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         []
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(byIds), []).length).toBe(0);
   });
   globalThis.test("queryInterceptor hook Deny → empty shape (auth allowed)", async () => {
@@ -245,10 +265,10 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       TAG: "Deny",
       _0: "nope"
     }));
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
-      ]]), undefined));
+      ]]), undefined, undefined));
     QueryDb_Callback$ReventlessCore.clearQueryInterceptor();
     globalThis.expect(r).toBe(null);
   });
@@ -271,7 +291,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(str(r, "id")).toEqual("p-2");
   });
   globalThis.test("resolveOne multi via target index → array", async () => {
@@ -297,7 +317,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -324,14 +344,14 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("node decodes global id → __typename + item", async () => {
-    PgQueryResolver_Lambda$ReventlessAws.register("Things", makeBinding(undefined, undefined, undefined));
+    PgQueryResolver_Lambda$ReventlessAws.register("Things", makeBinding(undefined, undefined, undefined, undefined));
     PgQueryResolver_Lambda$ReventlessAws.registerNodeType("Thing", "Things");
     let payload_arguments = Object.fromEntries([[
         "id",
@@ -381,7 +401,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     delete: 0,
     deleteBatch: 0
   };
-  let init = makeBinding(undefined, undefined, undefined);
+  let init = makeBinding(undefined, undefined, undefined, undefined);
   let authBinding_pushdowns = init.pushdowns;
   let authBinding_indexes = init.indexes;
   let authBinding_subIdField = init.subIdField;
@@ -389,6 +409,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   let authBinding_labelField = init.labelField;
   let authBinding_includeIdParam = init.includeIdParam;
   let authBinding_authorization = init.authorization;
+  let authBinding_ownerField = init.ownerField;
   let authBinding = {
     ops: authOps,
     pushdowns: authBinding_pushdowns,
@@ -397,7 +418,8 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     capability: authBinding_capability,
     labelField: authBinding_labelField,
     includeIdParam: authBinding_includeIdParam,
-    authorization: authBinding_authorization
+    authorization: authBinding_authorization,
+    ownerField: authBinding_ownerField
   };
   let lookupAuth = name => {
     if (name === "AuthTable") {
@@ -423,18 +445,18 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     identity: ident(username, groups)
   });
   globalThis.test("auth index: group member who owns → results", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("alice", ["Owner"]));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("alice", ["Owner"]));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("auth index: group member who does NOT own → empty", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", ["Owner"]));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", ["Owner"]));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(r), []).length).toBe(0);
   });
   globalThis.test("auth index: non-member passes through → results", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", []));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", []));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -443,7 +465,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   globalThis.test("unmapped kind throws", async () => {
     let threw;
     try {
-      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("frobnicate", undefined, undefined, undefined));
+      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("frobnicate", undefined, undefined, undefined, undefined));
       threw = false;
     } catch (exn) {
       threw = true;
@@ -452,17 +474,157 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   });
 });
 
+globalThis.describe("id form — the typed doors take either", () => {
+  globalThis.test("getById resolves a Relay global id", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        Api_Ids$ReventlessCore.encode("Thing", "p-2")
+      ]]), undefined, undefined));
+    globalThis.expect(str(r, "name")).toEqual("Bravo");
+  });
+  globalThis.test("getById reports the storage key it resolved to", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        Api_Ids$ReventlessCore.encode("Thing", "p-2")
+      ]]), undefined, undefined));
+    globalThis.expect(str(r, "id")).toEqual("p-2");
+  });
+  globalThis.test("getById still resolves a plain storage key", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        "p-2"
+      ]]), undefined, undefined));
+    globalThis.expect(str(r, "name")).toEqual("Bravo");
+  });
+  globalThis.test("getById on a global id for a row that does not exist is still null", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        Api_Ids$ReventlessCore.encode("Thing", "absent")
+      ]]), undefined, undefined));
+    globalThis.expect(r).toBe(null);
+  });
+  globalThis.test("byIds accepts the two forms mixed in one call", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+        "ids",
+        [
+          "p-1",
+          Api_Ids$ReventlessCore.encode("Thing", "p-3")
+        ]
+      ]]), undefined, undefined));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+  globalThis.test("byIds with every id found does not double-count", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+        "ids",
+        [
+          "p-1",
+          "p-3"
+        ].map(prim => prim)
+      ]]), undefined, undefined));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+});
+
+globalThis.describe("owner scoping", () => {
+  let ownedBinding = () => makeBinding(undefined, undefined, "owner", undefined);
+  let shopper = cognito("u-a", ["User"]);
+  let listWith = async (binding, identity) => {
+    lastOwnerScope.contents = undefined;
+    listPageReturn.contents = "pushed";
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(binding, undefined, mkPayload("list", undefined, undefined, identity, undefined));
+    return [
+      r,
+      lastOwnerScope.contents
+    ];
+  };
+  globalThis.test("a shopper's list is scoped to their own id", async () => {
+    let match = await listWith(ownedBinding(), shopper);
+    globalThis.expect(match[1]).toEqual([
+      "owner",
+      "u-a"
+    ]);
+  });
+  globalThis.test("an elevated caller's list is not scoped", async () => {
+    OwnerScope$Reventless.setElevatedGroups(["Admin"]);
+    let match = await listWith(ownedBinding(), cognito("ops-1", ["Admin"]));
+    OwnerScope$Reventless.setElevatedGroups([]);
+    globalThis.expect(match[1]).toBe(undefined);
+  });
+  globalThis.test("a view with no owner field is never scoped", async () => {
+    let match = await listWith(makeBinding(undefined, undefined, undefined, undefined), shopper);
+    globalThis.expect(match[1]).toBe(undefined);
+  });
+  globalThis.test("an unidentified caller is refused before the push-down runs", async () => {
+    lastOwnerScope.contents = undefined;
+    listPageReturn.contents = "pushed";
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("list", undefined, undefined, Identity$Reventless.anonymous, undefined));
+    globalThis.expect([
+      field(r, "edges"),
+      lastOwnerScope.contents
+    ]).toEqual([
+      [],
+      undefined
+    ]);
+  });
+  globalThis.test("getById hides a row the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        "p-2"
+      ]]), shopper, undefined));
+    globalThis.expect(r).toBe(null);
+  });
+  globalThis.test("getById still returns a row the caller does own", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        "p-1"
+      ]]), shopper, undefined));
+    globalThis.expect(str(r, "id")).toEqual("p-1");
+  });
+  globalThis.test("byIds drops rows the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+        "ids",
+        [
+          "p-1",
+          "p-2",
+          "p-3"
+        ].map(prim => prim)
+      ]]), shopper, undefined));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+  globalThis.test("an index query drops rows the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
+        "byStatus",
+        "active"
+      ]]), shopper, undefined));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+});
+
 export {
   mk,
   store,
   allItems,
   fieldEq,
   listPageReturn,
+  lastOwnerScope,
   ops,
   pushdowns,
   capability,
   makeBinding,
   mkPayload,
+  cognito,
   objArgs,
   field,
   str,

package/tests/QueryDbResolvers_AppSyncTest.res.mjs

@@ -19,18 +19,18 @@ globalThis.describe("QueryDbResolvers_AppSync.internalRowRequiredAttr", () => {
 
 globalThis.describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   globalThis.test("with ~requireAttribute emits an attribute_exists filter that excludes internal rows", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name");
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name", undefined, undefined);
     globalThis.expect(code.includes("attribute_exists(#name)")).toBe(true);
     globalThis.expect(code.includes("names['#name'] = 'name'")).toBe(true);
   });
   globalThis.test("without ~requireAttribute emits no attribute_exists filter (default read models unchanged)", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined);
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined);
     globalThis.expect(code.includes("attribute_exists")).toBe(false);
   });
 });
 
 globalThis.describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
-  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined);
+  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined);
   globalThis.test("Fix 1: response encodes the real nextToken as the cursor", () => {
     globalThis.expect(code.includes("const next = ctx.result?.nextToken ?? null;")).toBe(true);
     globalThis.expect(code.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))")).toBe(true);