@reventlessdev/reventless-aws 3.0.0-alpha.283 → 3.0.0-alpha.284

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.284 (2026-08-12)
+
+### Features
+
+* **platform:** bake a curated component manifest as a static asset ([4f30265](https://github.com/ReventlessDev/reventless-core/commit/4f30265a51fc2c59e69afd8074cf1b2534c06378))
+* **queries:** narrow owner-bearing reads to the caller ([ba9cc3d](https://github.com/ReventlessDev/reventless-core/commit/ba9cc3d58d7914a9e4827bda90a704a74b1b82dd))
+* **spec:** let the environment name the groups exempt from owner scoping ([2de5c51](https://github.com/ReventlessDev/reventless-core/commit/2de5c5118347a46998f9ab603308fca09addf00b))
+
+
 # 3.0.0-alpha.283 (2026-08-11)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.283",
+  "version": "3.0.0-alpha.284",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -14,16 +14,16 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.7",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.70",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.4",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.224",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.88",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.108",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.71",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.4",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.134"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.225",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.135",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.89",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.109",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -1124,18 +1124,6 @@ module MakeWithConfig = (
 
   // In split mode, create a dedicated platform AppSync API and push the platform schema.
   // In unified mode, makePlatform is a no-op (schema stitching handled by events).
-  let makePlatform = (~version, ~plugins: array<module(PluginMaker)>) => {
-    log.info(~comp="Platform", `v${version}`)
-    let _ = plugins
-    // Retired with the merged-API cutover: on AWS the platform deploys with
-    // deployPlatform (staged) and each plugin with deployPlugin — makePlatform
-    // predates the merge path and never gained merged wiring.
-    failwith(
-      "makePlatform is not supported on AWS — deploy the platform with deployPlatform and " ++
-      "each plugin with deployPlugin (merged-API composition).",
-    )
-  }
-
   // Optional host UI shell bundle: a static SPA (e.g. reventless-ui's host-shell)
   // hosted on the platform's CloudFront-fronted S3 bucket. The platform writes a
   // `config.json` next to `index.html` so the shell discovers `apiEndpoint` and
@@ -1154,6 +1142,10 @@ module MakeWithConfig = (
     // written; the shell treats the resulting 404 as "no hints" and boots
     // unchanged. Single-mode shape: one origin-relative file per deployment.
     uiHintsFile?: string,
+    // Optional baked component manifest. Declared here so a deployment can state
+    // it once; the emission that writes the file is not wired on this platform
+    // yet, and a declaration without it writes nothing.
+    bakedManifest?: ReventlessInfra.Platform.bakedManifest,
     // Optional geocoding place index, as returned by
     // `Capability_Geocoding_AwsLocation.make`. When set, the deploy provisions the
     // capability's client door — a Cognito-authenticated `Query.geocode` resolver
@@ -1198,6 +1190,23 @@ module MakeWithConfig = (
     shellConfig?: dict<JSON.t>,
   }
 
+  let makePlatform = (
+    ~version,
+    ~plugins: array<module(PluginMaker)>,
+    ~hostUiBundle as _: option<hostUiBundleConfig>=?,
+  ) => {
+    log.info(~comp="Platform", `v${version}`)
+    let _ = plugins
+    // Retired with the merged-API cutover: on AWS the platform deploys with
+    // deployPlatform (staged) and each plugin with deployPlugin — makePlatform
+    // predates the merge path and never gained merged wiring.
+    failwith(
+      "makePlatform is not supported on AWS — deploy the platform with deployPlatform and " ++
+      "each plugin with deployPlugin (merged-API composition).",
+    )
+  }
+
+
   // Merged-mode outputs of deployPlatform — the merged API(s), plus the
   // deploy-time merge gates (Outputs that resolve on MERGE_SUCCESS and fail
   // the deploy on MERGE_FAILED; folded into the ARN exports so they are

package/src/Platform.res.mjs

@@ -753,7 +753,7 @@ function MakeWithConfig(Config) {
       return;
     }
   };
-  let makePlatform = (version, plugins) => {
+  let makePlatform = (version, plugins, param) => {
     log.info("Platform", undefined, `v` + version);
     return Pervasives.failwith("makePlatform is not supported on AWS — deploy the platform with deployPlatform and each plugin with deployPlugin (merged-API composition).");
   };
@@ -2009,7 +2009,7 @@ function Make($star) {
       return;
     }
   };
-  let makePlatform = (version, plugins) => {
+  let makePlatform = (version, plugins, param) => {
     log.info("Platform", undefined, `v` + version);
     return Pervasives.failwith("makePlatform is not supported on AWS — deploy the platform with deployPlatform and each plugin with deployPlugin (merged-API composition).");
   };

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res

@@ -67,6 +67,7 @@ type pushdowns = {
     ~argsDict: dict<JSON.t>,
     ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
     ~labelField: string,
+    ~ownerScope: (string, string)=?,
   ) => promise<option<JSON.t>>,
   // Sub-id connection ({single}Items) — keyset over sub_key within a partition.
   itemsPage: (
@@ -74,6 +75,7 @@ type pushdowns = {
     ~subIdField: string,
     ~id: string,
     ~argsDict: dict<JSON.t>,
+    ~ownerScope: (string, string)=?,
   ) => promise<JSON.t>,
   // Full materialisation for the list fallback (shapes listPage declines).
   scanAll: (~readModelName: string) => promise<array<JSON.t>>,
@@ -89,6 +91,10 @@ type binding = {
   labelField: string,
   includeIdParam: bool,
   authorization: Reventless.Authorization.permission,
+  /** The state's `@owner` field, when it declares one. Derived at Lambda init
+      from the same schema `capability` comes from, so the two cannot disagree
+      about which fields this read model has. */
+  ownerField: option<string>,
 }
 
 // -- arg helpers -------------------------------------------------------------
@@ -162,6 +168,16 @@ let dispatch = async (
     | _ => JSON.Encode.array([])
     }
   | Allow =>
+    // Post-read narrowing for the doors that hand back rows rather than a page.
+    // Same decision as the list door takes; applied per row because there is no
+    // query to push it into.
+    let ownerAllows = (item: JSON.t) =>
+      switch payload.identity->Reventless.OwnerScope.decide(~ownerField=binding.ownerField) {
+      | Unscoped => true
+      | RefuseOwned => false
+      | ScopeTo(field, required) =>
+        item->argStr(field)->Option.mapOr(false, v => v == required)
+      }
     switch payload.kind {
     | "getById" =>
       let id = payload.arguments->argStr("id")->Option.getOr("")
@@ -181,6 +197,9 @@ let dispatch = async (
       | (found, _) => (id, found)
       }
       switch found {
+      // A row the caller does not own answers as "not found". Saying "not yours"
+      // instead would make this door an oracle for which ids exist.
+      | Some(item) if !ownerAllows(item) => JSON.Encode.null
       | Some(item) => binding.includeIdParam ? withId(item, resolvedKey) : item
       | None => JSON.Encode.null
       }
@@ -197,7 +216,7 @@ let dispatch = async (
       let extra = missing->Array.length > 0
         ? await binding.pushdowns.byIds(~readModelName=rm, missing)
         : []
-      JSON.Encode.array(Array.concat(found, extra))
+      JSON.Encode.array(Array.concat(found, extra)->Array.filter(ownerAllows))
 
     | "items" =>
       // Sub-id connection: {single}Items(id, filter, first/after/last/before).
@@ -205,12 +224,17 @@ let dispatch = async (
       switch binding.subIdField {
       | Some(subIdField) =>
         let id = payload.arguments->argStr("id")->Option.getOr("")
-        await binding.pushdowns.itemsPage(
-          ~readModelName=rm,
-          ~subIdField,
-          ~id,
-          ~argsDict=payload.arguments->argObj,
-        )
+        switch payload.identity->Reventless.OwnerScope.decide(~ownerField=binding.ownerField) {
+        | RefuseOwned => emptyConnection()
+        | decision =>
+          await binding.pushdowns.itemsPage(
+            ~readModelName=rm,
+            ~subIdField,
+            ~id,
+            ~argsDict=payload.arguments->argObj,
+            ~ownerScope=?Reventless.OwnerScope.scopeOf(decision),
+          )
+        }
       | None => emptyConnection()
       }
 
@@ -248,31 +272,42 @@ let dispatch = async (
       | _ => true
       }
       if authorized {
-        JSON.Encode.array(await binding.pushdowns.indexLookup(~readModelName=rm, field, value))
+        JSON.Encode.array(
+          (await binding.pushdowns.indexLookup(~readModelName=rm, field, value))->Array.filter(
+            ownerAllows,
+          ),
+        )
       } else {
         JSON.Encode.array([])
       }
 
     | "list" =>
       let argsDict = payload.arguments->argObj
-      switch await binding.pushdowns.listPage(
-        ~readModelName=rm,
-        ~argsDict,
-        ~capability=binding.capability,
-        ~labelField=binding.labelField,
-      ) {
-      | Some(conn) => conn
-      | None =>
-        // Shapes listPage declines (search/searchPrefix/ids/backward) → run the
-        // shared spec over the materialised model, which decodes Relay global
-        // ids the same way every other door now does.
-        let items = await binding.pushdowns.scanAll(~readModelName=rm)
-        ReventlessCore.QueryDbListQuery.run(
-          ~items,
+      switch payload.identity->Reventless.OwnerScope.decide(~ownerField=binding.ownerField) {
+      | RefuseOwned => emptyConnection()
+      | decision =>
+        let ownerScope = Reventless.OwnerScope.scopeOf(decision)
+        switch await binding.pushdowns.listPage(
+          ~readModelName=rm,
           ~argsDict,
           ~capability=binding.capability,
           ~labelField=binding.labelField,
-        )
+          ~ownerScope?,
+        ) {
+        | Some(conn) => conn
+        | None =>
+          // Shapes listPage declines (search/searchPrefix/ids/backward) → run the
+          // shared spec over the materialised model, which decodes Relay global
+          // ids the same way every other door now does.
+          let items = await binding.pushdowns.scanAll(~readModelName=rm)
+          ReventlessCore.QueryDbListQuery.run(
+            ~items,
+            ~argsDict,
+            ~capability=binding.capability,
+            ~labelField=binding.labelField,
+            ~ownerScope?,
+          )
+        }
       }
 
     // Cross-table single-ID field resolver (@resolves). `binding` is the TARGET

package/src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
@@ -71,6 +72,14 @@ async function dispatch(binding, lookupBindingOpt, payload) {
   let rm = payload.readModelName;
   let match = await runInterceptor(binding, payload);
   if (typeof match !== "object") {
+    let ownerAllows = item => {
+      let match = OwnerScope$Reventless.decide(payload.identity, binding.ownerField, undefined);
+      if (typeof match !== "object") {
+        return match === "Unscoped";
+      }
+      let required = match._1;
+      return Stdlib_Option.mapOr(argStr(item, match._0), false, v => v === required);
+    };
     let other = payload.kind;
     switch (other) {
       case "byIds" :
@@ -78,7 +87,7 @@ async function dispatch(binding, lookupBindingOpt, payload) {
         let found = await binding.pushdowns.byIds(rm, ids);
         let missing = found.length < ids.length ? Stdlib_Array.filterMap(ids, Api_Ids$ReventlessCore.alternateKey) : [];
         let extra = missing.length !== 0 ? await binding.pushdowns.byIds(rm, missing) : [];
-        return found.concat(extra);
+        return found.concat(extra).filter(ownerAllows);
       case "getById" :
         let id = Stdlib_Option.getOr(argStr(payload.arguments, "id"), "");
         let loadKey = async key => {
@@ -97,7 +106,7 @@ async function dispatch(binding, lookupBindingOpt, payload) {
             await loadKey(match$2)
           ];
         let found$1 = match$3[1];
-        if (found$1 !== undefined) {
+        if (found$1 !== undefined && ownerAllows(found$1)) {
           if (binding.includeIdParam) {
             return withId(found$1, match$3[0]);
           } else {
@@ -125,7 +134,7 @@ async function dispatch(binding, lookupBindingOpt, payload) {
           authorized = true;
         }
         if (authorized) {
-          return await binding.pushdowns.indexLookup(rm, field, value);
+          return (await binding.pushdowns.indexLookup(rm, field, value)).filter(ownerAllows);
         } else {
           return [];
         }
@@ -135,15 +144,26 @@ async function dispatch(binding, lookupBindingOpt, payload) {
           return emptyConnection();
         }
         let id$1 = Stdlib_Option.getOr(argStr(payload.arguments, "id"), "");
-        return await binding.pushdowns.itemsPage(rm, subIdField, id$1, argObj(payload.arguments));
+        let decision = OwnerScope$Reventless.decide(payload.identity, binding.ownerField, undefined);
+        if (typeof decision !== "object" && decision !== "Unscoped") {
+          return emptyConnection();
+        }
+        return await binding.pushdowns.itemsPage(rm, subIdField, id$1, argObj(payload.arguments), OwnerScope$Reventless.scopeOf(decision));
+        break;
       case "list" :
         let argsDict = argObj(payload.arguments);
-        let conn = await binding.pushdowns.listPage(rm, argsDict, binding.capability, binding.labelField);
+        let decision$1 = OwnerScope$Reventless.decide(payload.identity, binding.ownerField, undefined);
+        if (typeof decision$1 !== "object" && decision$1 !== "Unscoped") {
+          return emptyConnection();
+        }
+        let ownerScope = OwnerScope$Reventless.scopeOf(decision$1);
+        let conn = await binding.pushdowns.listPage(rm, argsDict, binding.capability, binding.labelField, ownerScope);
         if (conn !== undefined) {
           return conn;
         }
         let items$1 = await binding.pushdowns.scanAll(rm);
-        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, binding.capability, binding.labelField, undefined);
+        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, binding.capability, binding.labelField, undefined, ownerScope);
+        break;
       case "resolveMany" :
         let target = Stdlib_Option.getOr(payload.target, rm);
         let source = Stdlib_Option.getOr(payload.source, null);

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -238,6 +238,39 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
     // (prefix-agnostic: real plugin rows always carry `name`, internal rows never do).
     // See docs/plans/platform-plugins-admin-connection-null-rows.md.
     let requireAttribute = internalRowRequiredAttr(name)
+    // Derived from the same schema `capability` came from, so the two cannot
+    // disagree about this read model's fields.
+    let ownerField = switch stateSchemaOpt {
+    | Some(s) => Reventless.Owner.fieldNames(s)->Array.get(0)
+    | None => None
+    }
+    // A DynamoDB FilterExpression is applied AFTER the page is read, so a scoped
+    // list over a table with no index on the owner field returns short pages —
+    // correct, but pathological once a caller owns a small fraction of the rows.
+    // Warned rather than refused: the resolver does serve the query, and a
+    // deployment may legitimately accept the cost on a small table. Mirrors the
+    // `@scanSort` alignment warning above, which exists for the same class of
+    // "works, but scans" mistake.
+    ReventlessCore.OwnerScopeDiagnostics.warnIfNoElevatedGroups(
+      ~comp="QueryDbResolvers_AppSync",
+      ~view=name,
+      ~ownerField,
+    )
+    switch ownerField {
+    | Some(f) =>
+      let indexed =
+        indexes->Array.some(ic => ic.idField->Option.getOr(ic.index) == f) ||
+          subIdField->Option.getOr("") == f
+      if !indexed {
+        log.warn(
+          ~comp="QueryDbResolvers_AppSync",
+          `${name}: @owner field "${f}" is not the key of any index on this table. ` ++
+          "Owner-scoped reads will Scan and filter, so pages shrink as the caller's " ++
+          "share of the rows falls. Add an @index on that field before this read model grows.",
+        )
+      }
+    | None => ()
+    }
     let resolverAll = makeQueryResolver(
       ~resolverName=fieldNameForAll->String.capitalize,
       ~field=fieldNameForAll->Pulumi.Input.make,
@@ -248,6 +281,8 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
           ~rangeFields=rangeFieldNames,
           ~sortFields=sortFieldNames,
           ~requireAttribute?,
+          ~ownerField?,
+          ~elevatedGroups=Reventless.OwnerScope.elevatedGroups(),
         )
       } else {
         Resolver.Functions.listAllItems

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -3,7 +3,9 @@
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
 import * as AppSync_Function$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Function.res.mjs";
 import * as Util_AppSync$ReventlessAws from "../../util/Util_AppSync.res.mjs";
@@ -12,6 +14,7 @@ import * as Util_QueryDb$ReventlessCore from "@reventlessdev/reventless-core/src
 import * as AppSync_DataSource$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_DataSource.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
 import * as AppSync_Resolver_Functions$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/AppSync/AppSync_Resolver_Functions.res.mjs";
+import * as OwnerScopeDiagnostics$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/OwnerScopeDiagnostics.res.mjs";
 import * as AppSync_Resolver_Retrying$ReventlessAws from "../Api/AppSync_Resolver_Retrying.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 import * as QueryInterceptor_Provisioning$ReventlessAws from "./QueryInterceptor_Provisioning.res.mjs";
@@ -106,7 +109,15 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
       GraphQL_FragmentGenerator$ReventlessCore.validateScanSortAlignment(stateSchemaOpt, name$1, knownSortFields).forEach(msg => log.warn("QueryDbResolvers_AppSync", undefined, msg));
     }
     let requireAttribute = internalRowRequiredAttr(name$1);
-    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
+    let ownerField = stateSchemaOpt !== undefined ? Owner$Reventless.fieldNames(stateSchemaOpt)[0] : undefined;
+    OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("QueryDbResolvers_AppSync", name$1, ownerField);
+    if (ownerField !== undefined) {
+      let indexed = indexes.some(ic => Stdlib_Option.getOr(ic.idField, ic.index) === ownerField) || Stdlib_Option.getOr(subIdField, "") === ownerField;
+      if (!indexed) {
+        log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @owner field "` + ownerField + `" is not the key of any index on this table. ` + "Owner-scoped reads will Scan and filter, so pages shrink as the caller's share of the rows falls. Add an @index on that field before this read model grows.");
+      }
+    }
+    let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, OwnerScope$Reventless.elevatedGroups()) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
     let resolversByIndex = indexes.map(indexConfig => {
       let index = indexConfig.index;
       let stripLeadingBy = s => {

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res

@@ -150,6 +150,9 @@ let registerBinding = (
       labelField: entry.labelField,
       includeIdParam: entry.includeIdParam,
       authorization: spec.authorization,
+      // From the same schema `capability` is derived from, one line above, so the
+      // two cannot end up disagreeing about this read model's fields.
+      ownerField: Reventless.Owner.fieldNames(spec.stateSchema)->Array.get(0),
     },
   )
   logDebug("registered resolver binding for " ++ entry.readModelName, {comp: "PgQueryResolver"})

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
 import * as HandlerFactoryHelpersMjs from "./HandlerFactoryHelpers.mjs";
 import * as PgQueryResolver_Lambda$ReventlessAws from "../QueryDb/PgQueryResolver_Lambda.res.mjs";
@@ -72,7 +73,8 @@ function registerBinding(pushdowns, pgConnection, entry, spec) {
     capability: GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(entry.readModelName, spec.stateSchema),
     labelField: entry.labelField,
     includeIdParam: entry.includeIdParam,
-    authorization: spec.authorization
+    authorization: spec.authorization,
+    ownerField: Owner$Reventless.fieldNames(spec.stateSchema)[0]
   });
   HandlerFactoryHelpersMjs.log.debug("registered resolver binding for " + entry.readModelName, {
     comp: "PgQueryResolver"
@@ -91,4 +93,4 @@ export {
   makePushdowns,
   registerBinding,
 }
-/* PgRuntime-ReventlessAws Not a pure module */
+/* Owner-Reventless Not a pure module */

package/tests/PgQueryResolver_LambdaTest.res

@@ -11,18 +11,19 @@ open ReventlessCore
 
 @val external btoa: string => string = "btoa"
 
-let mk = (id, status, name) => {
+let mk = (id, status, name, owner) => {
   let o = Dict.make()
   o->Dict.set("id", JSON.Encode.string(id))
   o->Dict.set("status", JSON.Encode.string(status))
   o->Dict.set("name", JSON.Encode.string(name))
+  o->Dict.set("owner", JSON.Encode.string(owner))
   JSON.Encode.object(o)
 }
 
 let store = Dict.fromArray([
-  ("p-1", mk("p-1", "active", "Alpha")),
-  ("p-2", mk("p-2", "inactive", "Bravo")),
-  ("p-3", mk("p-3", "active", "Charlie")),
+  ("p-1", mk("p-1", "active", "Alpha", "u-a")),
+  ("p-2", mk("p-2", "inactive", "Bravo", "u-b")),
+  ("p-3", mk("p-3", "active", "Charlie", "u-a")),
 ])
 let allItems = () => store->Dict.valuesToArray
 
@@ -35,6 +36,11 @@ let fieldEq = (item, field, value) =>
 
 // Records whether listPage was consulted, and what it returns (sentinel or None).
 let listPageReturn: ref<option<JSON.t>> = ref(None)
+// The `ownerScope` the dispatcher handed the push-down on the last list call.
+// The push-down's own SQL is covered by the engine's parity harness; what this
+// file has to establish is that the dispatcher computes the scope from the
+// caller and actually passes it on.
+let lastOwnerScope: ref<option<(string, string)>> = ref(None)
 
 let ops: QueryDb_Adapter.operations = {
   load: async id => Ok(store->Dict.get(id)->Option.mapOr([], i => [i])),
@@ -51,9 +57,17 @@ let pushdowns: PgQueryResolver_Lambda.pushdowns = {
     allItems()->Array.filter(i => fieldEq(i, field, value)),
   byIds: async (~readModelName as _, ids) =>
     ids->Array.filterMap(id => store->Dict.get(id)),
-  listPage: async (~readModelName as _, ~argsDict as _, ~capability as _, ~labelField as _) =>
-    listPageReturn.contents,
-  itemsPage: async (~readModelName as _, ~subIdField as _, ~id, ~argsDict as _) =>
+  listPage: async (
+    ~readModelName as _,
+    ~argsDict as _,
+    ~capability as _,
+    ~labelField as _,
+    ~ownerScope: option<(string, string)>=?,
+  ) => {
+    lastOwnerScope := ownerScope
+    listPageReturn.contents
+  },
+  itemsPage: async (~readModelName as _, ~subIdField as _, ~id, ~argsDict as _, ~ownerScope as _=?) =>
     // Sentinel echoing the requested id, so the dispatch routing is observable.
     JSON.Encode.object(Dict.fromArray([("itemsFor", JSON.Encode.string(id))])),
   scanAll: async (~readModelName as _) => allItems(),
@@ -67,6 +81,7 @@ let capability: GraphQL_FragmentGenerator.serverCapability = {
 let makeBinding = (
   ~authorization=Reventless.Authorization.AllowAnonymous,
   ~subIdField=None,
+  ~ownerField=None,
   (),
 ): PgQueryResolver_Lambda.binding => {
   ops,
@@ -80,16 +95,28 @@ let makeBinding = (
   labelField: "name",
   includeIdParam: true,
   authorization,
+  ownerField,
 }
 
-let mkPayload = (~kind, ~index=?, ~args=JSON.Encode.object(Dict.make()), ()): PgQueryResolver_Lambda.payload => {
+let mkPayload = (
+  ~kind,
+  ~index=?,
+  ~args=JSON.Encode.object(Dict.make()),
+  ~identity=Reventless.Identity.anonymous,
+  (),
+): PgQueryResolver_Lambda.payload => {
   readModelName: "Things",
   kind,
   ?index,
   arguments: args,
-  identity: Reventless.Identity.anonymous,
+  identity,
 }
 
+external asIdentity: 'a => Reventless.Identity.t = "%identity"
+
+let cognito = (~userId, ~groups): Reventless.Identity.t =>
+  asIdentity({"userId": userId, "username": userId, "groups": groups, "provider": "Cognito"})
+
 let objArgs = pairs => JSON.Encode.object(Dict.fromArray(pairs))
 let field = (j, k) => j->JSON.Decode.object->Option.flatMap(d => d->Dict.get(k))
 let str = (j, k) => j->field(k)->Option.flatMap(JSON.Decode.string)
@@ -455,3 +482,116 @@ describe("id form — the typed doors take either", () => {
     expect(r->ids)->toEqual(["p-1", "p-3"])
   })
 })
+
+// ── Owner scoping ───────────────────────────────────────────────────────────
+// The push-down's SQL is the engine's business and is covered by its parity
+// harness. What has to hold HERE is that the dispatcher derives the scope from
+// the caller and hands it on — a push-down that supports scoping and a
+// dispatcher that never passes one produces a fully unscoped deployment while
+// every SQL test stays green.
+describe("owner scoping", () => {
+  let ownedBinding = () => makeBinding(~ownerField=Some("owner"), ())
+  let shopper = cognito(~userId="u-a", ~groups=["User"])
+
+  let listWith = async (~binding, ~identity) => {
+    lastOwnerScope := None
+    listPageReturn := Some(JSON.Encode.string("pushed"))
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding,
+      ~payload=mkPayload(~kind="list", ~identity, ()),
+    )
+    (r, lastOwnerScope.contents)
+  }
+
+  testPromise("a shopper's list is scoped to their own id", async () => {
+    let (_, scope) = await listWith(~binding=ownedBinding(), ~identity=shopper)
+    expect(scope)->toEqual(Some(("owner", "u-a")))
+  })
+
+  testPromise("an elevated caller's list is not scoped", async () => {
+    Reventless.OwnerScope.setElevatedGroups(["Admin"])
+    let (_, scope) = await listWith(
+      ~binding=ownedBinding(),
+      ~identity=cognito(~userId="ops-1", ~groups=["Admin"]),
+    )
+    Reventless.OwnerScope.setElevatedGroups([])
+    expect(scope)->toBe(None)
+  })
+
+  // The control that keeps this from being vacuous: a view with no `@owner`
+  // field must reach the push-down with no scope at all, for every caller.
+  testPromise("a view with no owner field is never scoped", async () => {
+    let (_, scope) = await listWith(~binding=makeBinding(), ~identity=shopper)
+    expect(scope)->toBe(None)
+  })
+
+  testPromise("an unidentified caller is refused before the push-down runs", async () => {
+    lastOwnerScope := None
+    listPageReturn := Some(JSON.Encode.string("pushed"))
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=ownedBinding(),
+      ~payload=mkPayload(~kind="list", ~identity=Reventless.Identity.anonymous, ()),
+    )
+    // Not the sentinel, and the push-down was never consulted — the refusal
+    // happens above it rather than by handing it a value nobody holds.
+    expect((r->field("edges"), lastOwnerScope.contents))->toEqual((
+      Some(JSON.Encode.array([])),
+      None,
+    ))
+  })
+
+  testPromise("getById hides a row the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=ownedBinding(),
+      ~payload=mkPayload(
+        ~kind="getById",
+        ~args=objArgs([("id", JSON.Encode.string("p-2"))]),
+        ~identity=shopper,
+        (),
+      ),
+    )
+    expect(r)->toBe(JSON.Encode.null)
+  })
+
+  testPromise("getById still returns a row the caller does own", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=ownedBinding(),
+      ~payload=mkPayload(
+        ~kind="getById",
+        ~args=objArgs([("id", JSON.Encode.string("p-1"))]),
+        ~identity=shopper,
+        (),
+      ),
+    )
+    expect(r->str("id"))->toEqual(Some("p-1"))
+  })
+
+  testPromise("byIds drops rows the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=ownedBinding(),
+      ~payload=mkPayload(
+        ~kind="byIds",
+        ~args=objArgs([
+          ("ids", JSON.Encode.array(["p-1", "p-2", "p-3"]->Array.map(JSON.Encode.string))),
+        ]),
+        ~identity=shopper,
+        (),
+      ),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+
+  testPromise("an index query drops rows the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda.dispatch(
+      ~binding=ownedBinding(),
+      ~payload=mkPayload(
+        ~kind="index",
+        ~index="byStatus",
+        ~args=objArgs([("byStatus", JSON.Encode.string("active"))]),
+        ~identity=shopper,
+        (),
+      ),
+    )
+    expect(r->ids)->toEqual(["p-1", "p-3"])
+  })
+})

package/tests/PgQueryResolver_LambdaTest.res.mjs

@@ -6,30 +6,32 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
 import * as PgQueryResolver_Lambda$ReventlessAws from "../src/adapter/QueryDb/PgQueryResolver_Lambda.res.mjs";
 
-function mk(id, status, name) {
+function mk(id, status, name, owner) {
   let o = {};
   o["id"] = id;
   o["status"] = status;
   o["name"] = name;
+  o["owner"] = owner;
   return o;
 }
 
 let store = Object.fromEntries([
   [
     "p-1",
-    mk("p-1", "active", "Alpha")
+    mk("p-1", "active", "Alpha", "u-a")
   ],
   [
     "p-2",
-    mk("p-2", "inactive", "Bravo")
+    mk("p-2", "inactive", "Bravo", "u-b")
   ],
   [
     "p-3",
-    mk("p-3", "active", "Charlie")
+    mk("p-3", "active", "Charlie", "u-a")
   ]
 ]);
 
@@ -45,6 +47,10 @@ let listPageReturn = {
   contents: undefined
 };
 
+let lastOwnerScope = {
+  contents: undefined
+};
+
 async function ops_load(id) {
   return {
     TAG: "Ok",
@@ -70,11 +76,12 @@ async function pushdowns_byIds(param, ids) {
   return Stdlib_Array.filterMap(ids, id => store[id]);
 }
 
-async function pushdowns_listPage(param, param$1, param$2, param$3) {
+async function pushdowns_listPage(param, param$1, param$2, param$3, ownerScope) {
+  lastOwnerScope.contents = ownerScope;
   return listPageReturn.contents;
 }
 
-async function pushdowns_itemsPage(param, param$1, id, param$2) {
+async function pushdowns_itemsPage(param, param$1, id, param$2, param$3) {
   return Object.fromEntries([[
       "itemsFor",
       id
@@ -109,9 +116,10 @@ let capability = {
   sortFields: capability_sortFields
 };
 
-function makeBinding(authorizationOpt, subIdFieldOpt, param) {
+function makeBinding(authorizationOpt, subIdFieldOpt, ownerFieldOpt, param) {
   let authorization = authorizationOpt !== undefined ? authorizationOpt : "AllowAnonymous";
   let subIdField = subIdFieldOpt !== undefined ? Primitive_option.valFromOption(subIdFieldOpt) : undefined;
+  let ownerField = ownerFieldOpt !== undefined ? Primitive_option.valFromOption(ownerFieldOpt) : undefined;
   return {
     ops: ops,
     pushdowns: pushdowns,
@@ -125,18 +133,29 @@ function makeBinding(authorizationOpt, subIdFieldOpt, param) {
     capability: capability,
     labelField: "name",
     includeIdParam: true,
-    authorization: authorization
+    authorization: authorization,
+    ownerField: ownerField
   };
 }
 
-function mkPayload(kind, index, argsOpt, param) {
+function mkPayload(kind, index, argsOpt, identityOpt, param) {
   let args = argsOpt !== undefined ? argsOpt : ({});
+  let identity = identityOpt !== undefined ? identityOpt : Identity$Reventless.anonymous;
   return {
     readModelName: "Things",
     kind: kind,
     index: index,
     arguments: args,
-    identity: Identity$Reventless.anonymous
+    identity: identity
+  };
+}
+
+function cognito(userId, groups) {
+  return {
+    userId: userId,
+    username: userId,
+    groups: groups,
+    provider: "Cognito"
   };
 }
 
@@ -158,39 +177,39 @@ function ids(arr) {
 
 globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   globalThis.test("getById returns the item (id-carrying)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-2"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(str(r, "id")).toEqual("p-2");
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById miss → null", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "absent"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(r).toBe(null);
   });
   globalThis.test("byIds returns matches, drops missing", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
           "absent",
           "p-3"
         ].map(prim => prim)
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("index routes to indexLookup on the idField", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
         "byStatus",
         "active"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -198,13 +217,13 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   });
   globalThis.test("list with push-down → returns the connection listPage gives", async () => {
     listPageReturn.contents = "PUSHED";
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined, undefined));
     listPageReturn.contents = undefined;
     globalThis.expect(r).toEqual("PUSHED");
   });
   globalThis.test("list without push-down → falls back to the shared spec", async () => {
     listPageReturn.contents = undefined;
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("list", undefined, undefined, undefined, undefined));
     let edgeIds = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []), e => Stdlib_Option.flatMap(field(e, "node"), n => str(n, "id")));
     globalThis.expect(edgeIds).toEqual([
       "p-1",
@@ -213,32 +232,32 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     ]);
   });
   globalThis.test("items with subId routes to itemsPage (id echoed)", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, "seq", undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
         "id",
         "p-2"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(str(r, "itemsFor")).toEqual("p-2");
   });
   globalThis.test("items without subId → empty connection", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("items", undefined, Object.fromEntries([[
         "id",
         "p-2"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(r, "edges"), Stdlib_JSON.Decode.array), []).length).toBe(0);
   });
   globalThis.test("authorization DenyAll → empty shape per kind", async () => {
-    let b = makeBinding("DenyAll", undefined, undefined);
+    let b = makeBinding("DenyAll", undefined, undefined, undefined);
     let single = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(single).toBe(null);
-    let list = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("list", undefined, undefined, undefined));
+    let list = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("list", undefined, undefined, undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(list, "edges"), Stdlib_JSON.Decode.array), []).length).toBe(0);
     let byIds = await PgQueryResolver_Lambda$ReventlessAws.dispatch(b, undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         []
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(byIds), []).length).toBe(0);
   });
   globalThis.test("queryInterceptor hook Deny → empty shape (auth allowed)", async () => {
@@ -246,10 +265,10 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       TAG: "Deny",
       _0: "nope"
     }));
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-1"
-      ]]), undefined));
+      ]]), undefined, undefined));
     QueryDb_Callback$ReventlessCore.clearQueryInterceptor();
     globalThis.expect(r).toBe(null);
   });
@@ -272,7 +291,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(str(r, "id")).toEqual("p-2");
   });
   globalThis.test("resolveOne multi via target index → array", async () => {
@@ -298,7 +317,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -325,14 +344,14 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
       arguments: payload_arguments,
       identity: Identity$Reventless.anonymous
     };
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, payload);
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, payload);
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("node decodes global id → __typename + item", async () => {
-    PgQueryResolver_Lambda$ReventlessAws.register("Things", makeBinding(undefined, undefined, undefined));
+    PgQueryResolver_Lambda$ReventlessAws.register("Things", makeBinding(undefined, undefined, undefined, undefined));
     PgQueryResolver_Lambda$ReventlessAws.registerNodeType("Thing", "Things");
     let payload_arguments = Object.fromEntries([[
         "id",
@@ -382,7 +401,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     delete: 0,
     deleteBatch: 0
   };
-  let init = makeBinding(undefined, undefined, undefined);
+  let init = makeBinding(undefined, undefined, undefined, undefined);
   let authBinding_pushdowns = init.pushdowns;
   let authBinding_indexes = init.indexes;
   let authBinding_subIdField = init.subIdField;
@@ -390,6 +409,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   let authBinding_labelField = init.labelField;
   let authBinding_includeIdParam = init.includeIdParam;
   let authBinding_authorization = init.authorization;
+  let authBinding_ownerField = init.ownerField;
   let authBinding = {
     ops: authOps,
     pushdowns: authBinding_pushdowns,
@@ -398,7 +418,8 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     capability: authBinding_capability,
     labelField: authBinding_labelField,
     includeIdParam: authBinding_includeIdParam,
-    authorization: authBinding_authorization
+    authorization: authBinding_authorization,
+    ownerField: authBinding_ownerField
   };
   let lookupAuth = name => {
     if (name === "AuthTable") {
@@ -424,18 +445,18 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
     identity: ident(username, groups)
   });
   globalThis.test("auth index: group member who owns → results", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("alice", ["Owner"]));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("alice", ["Owner"]));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("auth index: group member who does NOT own → empty", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", ["Owner"]));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", ["Owner"]));
     globalThis.expect(Stdlib_Option.getOr(Stdlib_JSON.Decode.array(r), []).length).toBe(0);
   });
   globalThis.test("auth index: non-member passes through → results", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", []));
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), lookupAuth, authIndexPayload("bob", []));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -444,7 +465,7 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
   globalThis.test("unmapped kind throws", async () => {
     let threw;
     try {
-      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("frobnicate", undefined, undefined, undefined));
+      await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("frobnicate", undefined, undefined, undefined, undefined));
       threw = false;
     } catch (exn) {
       threw = true;
@@ -455,54 +476,135 @@ globalThis.describe("PgQueryResolver_Lambda.dispatch", () => {
 
 globalThis.describe("id form — the typed doors take either", () => {
   globalThis.test("getById resolves a Relay global id", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         Api_Ids$ReventlessCore.encode("Thing", "p-2")
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById reports the storage key it resolved to", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         Api_Ids$ReventlessCore.encode("Thing", "p-2")
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(str(r, "id")).toEqual("p-2");
   });
   globalThis.test("getById still resolves a plain storage key", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         "p-2"
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(str(r, "name")).toEqual("Bravo");
   });
   globalThis.test("getById on a global id for a row that does not exist is still null", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("getById", undefined, Object.fromEntries([[
         "id",
         Api_Ids$ReventlessCore.encode("Thing", "absent")
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(r).toBe(null);
   });
   globalThis.test("byIds accepts the two forms mixed in one call", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
           Api_Ids$ReventlessCore.encode("Thing", "p-3")
         ]
-      ]]), undefined));
+      ]]), undefined, undefined));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
     ]);
   });
   globalThis.test("byIds with every id found does not double-count", async () => {
-    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(makeBinding(undefined, undefined, undefined, undefined), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
         "ids",
         [
           "p-1",
           "p-3"
         ].map(prim => prim)
-      ]]), undefined));
+      ]]), undefined, undefined));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+});
+
+globalThis.describe("owner scoping", () => {
+  let ownedBinding = () => makeBinding(undefined, undefined, "owner", undefined);
+  let shopper = cognito("u-a", ["User"]);
+  let listWith = async (binding, identity) => {
+    lastOwnerScope.contents = undefined;
+    listPageReturn.contents = "pushed";
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(binding, undefined, mkPayload("list", undefined, undefined, identity, undefined));
+    return [
+      r,
+      lastOwnerScope.contents
+    ];
+  };
+  globalThis.test("a shopper's list is scoped to their own id", async () => {
+    let match = await listWith(ownedBinding(), shopper);
+    globalThis.expect(match[1]).toEqual([
+      "owner",
+      "u-a"
+    ]);
+  });
+  globalThis.test("an elevated caller's list is not scoped", async () => {
+    OwnerScope$Reventless.setElevatedGroups(["Admin"]);
+    let match = await listWith(ownedBinding(), cognito("ops-1", ["Admin"]));
+    OwnerScope$Reventless.setElevatedGroups([]);
+    globalThis.expect(match[1]).toBe(undefined);
+  });
+  globalThis.test("a view with no owner field is never scoped", async () => {
+    let match = await listWith(makeBinding(undefined, undefined, undefined, undefined), shopper);
+    globalThis.expect(match[1]).toBe(undefined);
+  });
+  globalThis.test("an unidentified caller is refused before the push-down runs", async () => {
+    lastOwnerScope.contents = undefined;
+    listPageReturn.contents = "pushed";
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("list", undefined, undefined, Identity$Reventless.anonymous, undefined));
+    globalThis.expect([
+      field(r, "edges"),
+      lastOwnerScope.contents
+    ]).toEqual([
+      [],
+      undefined
+    ]);
+  });
+  globalThis.test("getById hides a row the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        "p-2"
+      ]]), shopper, undefined));
+    globalThis.expect(r).toBe(null);
+  });
+  globalThis.test("getById still returns a row the caller does own", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("getById", undefined, Object.fromEntries([[
+        "id",
+        "p-1"
+      ]]), shopper, undefined));
+    globalThis.expect(str(r, "id")).toEqual("p-1");
+  });
+  globalThis.test("byIds drops rows the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("byIds", undefined, Object.fromEntries([[
+        "ids",
+        [
+          "p-1",
+          "p-2",
+          "p-3"
+        ].map(prim => prim)
+      ]]), shopper, undefined));
+    globalThis.expect(ids(r)).toEqual([
+      "p-1",
+      "p-3"
+    ]);
+  });
+  globalThis.test("an index query drops rows the caller does not own", async () => {
+    let r = await PgQueryResolver_Lambda$ReventlessAws.dispatch(ownedBinding(), undefined, mkPayload("index", "byStatus", Object.fromEntries([[
+        "byStatus",
+        "active"
+      ]]), shopper, undefined));
     globalThis.expect(ids(r)).toEqual([
       "p-1",
       "p-3"
@@ -516,11 +618,13 @@ export {
   allItems,
   fieldEq,
   listPageReturn,
+  lastOwnerScope,
   ops,
   pushdowns,
   capability,
   makeBinding,
   mkPayload,
+  cognito,
   objArgs,
   field,
   str,

package/tests/QueryDbResolvers_AppSyncTest.res.mjs

@@ -19,18 +19,18 @@ globalThis.describe("QueryDbResolvers_AppSync.internalRowRequiredAttr", () => {
 
 globalThis.describe("AppSync_Resolver_Retrying.Functions.listAllItemsConnection", () => {
   globalThis.test("with ~requireAttribute emits an attribute_exists filter that excludes internal rows", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name");
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, "name", undefined, undefined);
     globalThis.expect(code.includes("attribute_exists(#name)")).toBe(true);
     globalThis.expect(code.includes("names['#name'] = 'name'")).toBe(true);
   });
   globalThis.test("without ~requireAttribute emits no attribute_exists filter (default read models unchanged)", () => {
-    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined);
+    let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined);
     globalThis.expect(code.includes("attribute_exists")).toBe(false);
   });
 });
 
 globalThis.describe("listAllItemsConnection — Scan cursor round-trip (paging fixes 1–3)", () => {
-  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined);
+  let code = AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection("name", undefined, undefined, undefined, undefined, undefined, undefined);
   globalThis.test("Fix 1: response encodes the real nextToken as the cursor", () => {
     globalThis.expect(code.includes("const next = ctx.result?.nextToken ?? null;")).toBe(true);
     globalThis.expect(code.includes("util.base64Encode(JSON.stringify({ token: next, index: i }))")).toBe(true);