@reventlessdev/reventless-aws 3.0.0-alpha.287 → 3.0.0-alpha.290

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.290 (2026-08-13)
+
+### Bug Fixes
+
+* **aws:** move past a version number that already names other content ([bffba4f](https://github.com/ReventlessDev/reventless-core/commit/bffba4f15eff4a9c30bbf2e28484bb549b865cfc))
+
+
+# 3.0.0-alpha.288 (2026-08-12)
+
+### Bug Fixes
+
+* **aws:** carry the elevated groups into every Lambda ([ced4d92](https://github.com/ReventlessDev/reventless-core/commit/ced4d9211c3cebe70702757ab331c8a1fa773fca))
+
+
 # 3.0.0-alpha.287 (2026-08-12)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.287",
+  "version": "3.0.0-alpha.290",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.7",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.4",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.7",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.71",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.228",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.229",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.137",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.92",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.111"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.111",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.93"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -237,6 +237,13 @@ let makeFromCodeAsset: (
   // `Lambda.Function.make` builders apply the identical policy.
   Util_LambdaLogging.applyLogLevelDefault(variables)
 
+  // Same terms, same reason it is here rather than at each builder: the groups
+  // exempt from owner scoping are decided by the deploy program, and the runtime
+  // that stamps a command has no other way to learn them. Without it a runtime
+  // concludes nobody is elevated and stamps an operator's on-behalf write with
+  // the operator's own id.
+  Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
+
   // ESM self-containment (Option C): every code archive built by
   // Util_Bundle.buildCodeArchive ships register-hook.mjs + layer-resolver.mjs at
   // /var/task. --import registers the resolve hook so the ESM entry point (and the

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -24,6 +24,7 @@ import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/sr
 import * as Util_DcbMetrics$ReventlessAws from "../../util/Util_DcbMetrics.res.mjs";
 import * as RuntimeExtension$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/RuntimeExtension/RuntimeExtension.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
+import * as Util_OwnerScopeEnv$ReventlessAws from "../../util/Util_OwnerScopeEnv.res.mjs";
 import * as ResourceAttribution$ReventlessCore from "@reventlessdev/reventless-core/src/ResourceAttribution.res.mjs";
 
 let additionalEnvVars = {};
@@ -102,6 +103,7 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
     variables[key] = value;
   });
   Util_LambdaLogging$ReventlessAws.applyLogLevelDefault(variables);
+  Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
   variables["NODE_OPTIONS"] = Util_Bundle$ReventlessAws.esmLoaderNodeOptions;
   variables["ESM_FALLBACK_DIRS"] = Util_Bundle$ReventlessAws.esmFallbackDirs;
   if (!RuntimeExtension$ReventlessCore.isEmpty()) {

package/src/util/Util_OwnerScopeEnv.res

@@ -0,0 +1,48 @@
+// Carries the deployment's elevated groups into Lambda runtimes.
+//
+// A cloud deployment is two kinds of process and only one of them is the deploy
+// program: it bakes the owner predicate into generated resolver source, while
+// command stamping (`CommandGenerator_Callback`) and SQL-backed reads
+// (`PgQueryResolver_Lambda`) run later, in function runtimes the deploy never
+// enters. `Reventless.OwnerScope.elevatedGroups()` answers from an explicit
+// `setElevatedGroups` or from the environment, so a value stated in the deploy
+// program reaches those runtimes only if something puts it in their environment.
+//
+// Nothing did, and the two halves fail in opposite directions. A read that
+// believes nobody is elevated shows an operator too little, which is safe and
+// visible. A write that believes it stamps an operator's on-behalf order with
+// the OPERATOR's id — silently, and the row is wrong from then on. The second is
+// why this is a correctness fix rather than a parity one.
+//
+// Scoped deliberately to `RuntimeEnvironment_Lambda.makeFromCodeAsset`, which
+// every command and query runtime is built through. The bespoke builders that
+// append `Util_LambdaLogging.logLevelEntry()` for themselves — dead letters, the
+// state-topic publisher, geocoding, the two upload Lambdas, the platform UI APIs
+// — neither stamp a command nor serve an owner-scoped view, so they sit outside
+// this policy for the same reason they sit outside several others. The
+// serialized-closure `make` path is likewise outside it, and already outside the
+// logging policy.
+
+let key = "REVENTLESS_ELEVATED_GROUPS"
+
+/** The `("REVENTLESS_ELEVATED_GROUPS", "Admin,Support")` entry, or `None` when
+    the deployment named no elevated groups.
+
+    Comma-separated because that is what `OwnerScope.parseElevatedGroups` reads,
+    which trims each part and drops the empties. Absent rather than empty for the
+    empty case: the two mean the same thing there, and writing `""` would suggest
+    a deployment had answered the question when it has not. */
+let entry = (): option<(string, Pulumi.Input.t<string>)> =>
+  switch Reventless.OwnerScope.elevatedGroups() {
+  | [] => None
+  | groups => Some((key, groups->Array.join(",")->Pulumi.Input.make))
+  }
+
+/** Default the elevated groups for a Lambda when the caller has not pinned them.
+    Mutates in place and must run after the caller's own env vars are set, so
+    theirs win — the same contract as `Util_LambdaLogging.applyLogLevelDefault`,
+    which it runs beside. */
+let applyElevatedGroupsDefault = (variables: dict<Pulumi.Input.t<string>>) =>
+  if variables->Dict.get(key)->Option.isNone {
+    entry()->Option.forEach(((k, v)) => variables->Dict.set(k, v))
+  }

package/src/util/Util_OwnerScopeEnv.res.mjs

@@ -0,0 +1,31 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+
+let key = "REVENTLESS_ELEVATED_GROUPS";
+
+function entry() {
+  let groups = OwnerScope$Reventless.elevatedGroups();
+  if (groups.length !== 0) {
+    return [
+      key,
+      groups.join(",")
+    ];
+  }
+}
+
+function applyElevatedGroupsDefault(variables) {
+  if (Stdlib_Option.isNone(variables[key])) {
+    return Stdlib_Option.forEach(entry(), param => {
+      variables[param[0]] = param[1];
+    });
+  }
+}
+
+export {
+  key,
+  entry,
+  applyElevatedGroupsDefault,
+}
+/* OwnerScope-Reventless Not a pure module */

package/tests/Util_OwnerScopeEnvTest.res

@@ -0,0 +1,60 @@
+open JestGlobals
+
+// Guards the carrier that tells a Lambda runtime which groups are exempt from
+// owner scoping. The deploy program bakes the read predicate itself, but
+// stamping and SQL-backed reads run in function runtimes it never enters, so
+// without this entry those runtimes conclude nobody is elevated — and an
+// operator's on-behalf write is then stamped with the operator's own id.
+//
+// The encoding is load-bearing in both directions: what is written here is read
+// back by `OwnerScope.parseElevatedGroups`, so the two are asserted together
+// rather than each against a literal.
+
+let withElevated = (groups, f) => {
+  Reventless.OwnerScope.setElevatedGroups(groups)
+  let result = f()
+  Reventless.OwnerScope.clearElevatedGroups()
+  result
+}
+
+describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
+  testSync("writes what OwnerScope reads back", () => {
+    let encoded = withElevated(["Admin", "Support"], () =>
+      switch Util_OwnerScopeEnv.entry() {
+      | Some((_, value)) => value->Obj.magic
+      | None => ""
+      }
+    )
+    // The round trip, not the spelling: a separator change on either side fails.
+    expect(Reventless.OwnerScope.parseElevatedGroups(encoded))->toEqual(["Admin", "Support"])
+  })
+
+  testSync("names the variable the runtime actually reads", () => {
+    expect(Util_OwnerScopeEnv.key)->toBe("REVENTLESS_ELEVATED_GROUPS")
+  })
+
+  testSync("no elevated groups means no variable, not an empty one", () => {
+    let entry = withElevated([], () => Util_OwnerScopeEnv.entry())
+    expect(entry->Option.isNone)->toBe(true)
+  })
+
+  testSync("defaults the variable when the caller pinned nothing", () => {
+    let variables = Dict.make()
+    withElevated(["Admin"], () => Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables))
+    expect(variables->Dict.get(Util_OwnerScopeEnv.key)->Option.isSome)->toBe(true)
+  })
+
+  testSync("a caller that pinned the variable wins", () => {
+    let variables = Dict.fromArray([(Util_OwnerScopeEnv.key, "Pinned"->Obj.magic)])
+    withElevated(["Admin"], () => Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables))
+    expect(variables->Dict.get(Util_OwnerScopeEnv.key)->Option.getOr(""->Obj.magic)->Obj.magic)->toBe(
+      "Pinned",
+    )
+  })
+
+  testSync("adds nothing when the deployment named no elevated groups", () => {
+    let variables = Dict.make()
+    withElevated([], () => Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables))
+    expect(variables->Dict.get(Util_OwnerScopeEnv.key)->Option.isNone)->toBe(true)
+  })
+})

package/tests/Util_OwnerScopeEnvTest.res.mjs

@@ -0,0 +1,62 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as Util_OwnerScopeEnv$ReventlessAws from "../src/util/Util_OwnerScopeEnv.res.mjs";
+
+function withElevated(groups, f) {
+  OwnerScope$Reventless.setElevatedGroups(groups);
+  let result = f();
+  OwnerScope$Reventless.clearElevatedGroups();
+  return result;
+}
+
+globalThis.describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
+  globalThis.test("writes what OwnerScope reads back", () => {
+    let encoded = withElevated([
+      "Admin",
+      "Support"
+    ], () => {
+      let match = Util_OwnerScopeEnv$ReventlessAws.entry();
+      if (match !== undefined) {
+        return match[1];
+      } else {
+        return "";
+      }
+    });
+    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([
+      "Admin",
+      "Support"
+    ]);
+  });
+  globalThis.test("names the variable the runtime actually reads", () => {
+    globalThis.expect(Util_OwnerScopeEnv$ReventlessAws.key).toBe("REVENTLESS_ELEVATED_GROUPS");
+  });
+  globalThis.test("no elevated groups means no variable, not an empty one", () => {
+    let entry = withElevated([], () => Util_OwnerScopeEnv$ReventlessAws.entry());
+    globalThis.expect(Stdlib_Option.isNone(entry)).toBe(true);
+  });
+  globalThis.test("defaults the variable when the caller pinned nothing", () => {
+    let variables = {};
+    withElevated(["Admin"], () => Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables));
+    globalThis.expect(Stdlib_Option.isSome(variables[Util_OwnerScopeEnv$ReventlessAws.key])).toBe(true);
+  });
+  globalThis.test("a caller that pinned the variable wins", () => {
+    let variables = Object.fromEntries([[
+        Util_OwnerScopeEnv$ReventlessAws.key,
+        "Pinned"
+      ]]);
+    withElevated(["Admin"], () => Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables));
+    globalThis.expect(Stdlib_Option.getOr(variables[Util_OwnerScopeEnv$ReventlessAws.key], "")).toBe("Pinned");
+  });
+  globalThis.test("adds nothing when the deployment named no elevated groups", () => {
+    let variables = {};
+    withElevated([], () => Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables));
+    globalThis.expect(Stdlib_Option.isNone(variables[Util_OwnerScopeEnv$ReventlessAws.key])).toBe(true);
+  });
+});
+
+export {
+  withElevated,
+}
+/*  Not a pure module */