@reventlessdev/reventless-aws 3.0.0-alpha.294 → 3.0.0-alpha.295

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.295 (2026-08-14)
+
+### Bug Fixes
+
+* **aws:** enforce Cognito group gates that AppSync was silently ignoring ([1392638](https://github.com/ReventlessDev/reventless-core/commit/13926388c097500606f75c387630a19ee1a3aa71))
+
+
 # 3.0.0-alpha.294 (2026-08-14)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.294",
+  "version": "3.0.0-alpha.295",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.9",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.5",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.74",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.6",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.232",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.96",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.140"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -6,13 +6,20 @@
 // ([Auth_ActiveRoleTrigger.res] bundles it and attaches it to the user pool).
 //
 // The narrowing has to happen here rather than in our own enforcement code
-// because `@authorize(AllowGroups([...]))` compiles to `@aws_auth`, which AppSync
+// because `@authorize(AllowGroups([...]))` compiles to a field directive AppSync
 // evaluates against `cognito:groups` **before any of our code executes**. A
 // request header we invent could scope reads correctly and still leave every
 // group-gated mutation callable — right about the data, wrong about the writes.
 // Overriding the group claim is the one place every enforcement point already
 // looks.
 //
+// That premise was false for as long as the directive was emitted as the
+// single-mode `@aws_auth(...)`, which AppSync ignores on a multi-auth API — the
+// gate was open and this trigger narrowed a claim nothing read for authorization.
+// The directive is now `@aws_cognito_user_pools(...)`, which the service does
+// enforce, so the reasoning above holds again. See
+// `AppSync_SdlDecorate.formatCognitoGroupsDirective`.
+//
 // **Version 1 of the trigger, deliberately.** Group override and added ID-token
 // claims are `V1_0` capabilities; `V2_0`/`V3_0` buy access-token customisation
 // this does not need and are gated behind the Essentials and Plus feature plans.

package/src/components/Api/AppSync_Adapter.res

@@ -171,9 +171,9 @@ let rec waitForMergeSuccess = async (
   }
 }
 
-// ── @aws_auth directive injection ─────────────────────────────────────────
-// Injects @aws_auth(cognito_groups: [...]) directives into SDL field strings
-// based on authorization metadata from schema entries.
+// ── Cognito group directive injection ─────────────────────────────────────
+// Injects @aws_cognito_user_pools(cognito_groups: [...]) directives into SDL
+// field strings based on authorization metadata from schema entries.
 //
 // Two sources are merged:
 //   1. The legacy `authorization?: {tableName, group}` field — single group
@@ -184,19 +184,22 @@ let rec waitForMergeSuccess = async (
 //
 // When both are present on the same field, the spec-level permission wins
 // (it is more specific). `AllowGroups([g1, g2, ...])` emits
-// `@aws_auth(cognito_groups: ["g1", "g2", ...])`. `AllowAuthenticated` /
-// `AllowAnonymous` emit no directive (with Cognito as primary auth, any
-// reaching request is already authenticated). `AllowGroups([])` and
-// `DenyAll` emit a sentinel `__deny_all__` group that no Cognito user can
+// `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
+// `AllowAuthenticated` / `AllowAnonymous` emit no directive (with Cognito as
+// primary auth, any reaching request is already authenticated). `AllowGroups([])`
+// and `DenyAll` emit a sentinel `__deny_all__` group that no Cognito user can
 // belong to — effectively blocking the field at the API layer.
 //
+// NOT `@aws_auth(...)`: that is the single-mode form, which AppSync ignores on a
+// multi-auth API — which every API this adapter provisions is. See
+// `AppSync_SdlDecorate.formatCognitoGroupsDirective` for the full rationale and
+// the observation that established it.
+//
 // ── Dual-auth (Cognito + IAM) for deploy-time system callers ────────────────
 // A field flagged `systemCallable` (via `mutationSchemaEntry`/`querySchemaEntry`)
 // must be reachable by BOTH the console UI (Cognito) and a deploy-time system
 // caller signing SigV4 with ambient AWS credentials (`Util_AppSync_Caller`,
-// the AWS_IAM additional auth provider). `@aws_auth(...)` is the single-mode
-// directive form and does not admit IAM on a multi-auth API. For these fields
-// we emit the multi-auth form instead:
+// the AWS_IAM additional auth provider). For these fields we append the IAM arm:
 //   @aws_cognito_user_pools(cognito_groups: [...]) @aws_iam
 // The Cognito arm preserves the field's existing group gating (or, when the
 // field carries no Cognito group restriction, a bare `@aws_cognito_user_pools`
@@ -215,24 +218,17 @@ let _permissionToCognitoGroups = (
   | AllowAuthenticated | AllowAnonymous => None
   }
 
-let _formatGroupsDirective = (groups: array<string>): string => {
-  let quoted = groups->Array.map(g => `"${g}"`)->Array.join(", ")
-  `@aws_auth(cognito_groups: [${quoted}])`
-}
+// Both directive forms are defined once in the runtime-pure AppSync_SdlDecorate
+// so this deploy path and the bundled AdminEventCollector Lambda's reactive push
+// cannot drift. The Cognito-only arm carries the rationale for why it is
+// `@aws_cognito_user_pools(...)` and never `@aws_auth(...)`.
+let _formatGroupsDirective = AppSync_SdlDecorate.formatCognitoGroupsDirective
 
 // Multi-auth directive for a field that must accept BOTH Cognito and IAM.
 // `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps the
 // field open to any authenticated Cognito user. `@aws_iam` admits the
 // deploy-time SigV4 system caller. See the dual-auth note above.
-let _formatDualAuthDirective = (groups: option<array<string>>): string => {
-  let cognito = switch groups {
-  | Some(g) =>
-    let quoted = g->Array.map(x => `"${x}"`)->Array.join(", ")
-    `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
-  | None => `@aws_cognito_user_pools`
-  }
-  `${cognito} @aws_iam`
-}
+let _formatDualAuthDirective = AppSync_SdlDecorate.formatDualAuthDirective
 
 // ── Type-level dual-auth ─────────────────────────────────────────────────────
 // On a multi-auth API, object TYPES without auth directives are accessible only

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -126,22 +126,6 @@ function _permissionToCognitoGroups(permission) {
   }
 }
 
-function _formatGroupsDirective(groups) {
-  let quoted = groups.map(g => `"` + g + `"`).join(", ");
-  return `@aws_auth(cognito_groups: [` + quoted + `])`;
-}
-
-function _formatDualAuthDirective(groups) {
-  let cognito;
-  if (groups !== undefined) {
-    let quoted = groups.map(x => `"` + x + `"`).join(", ");
-    cognito = `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
-  } else {
-    cognito = `@aws_cognito_user_pools`;
-  }
-  return cognito + ` @aws_iam`;
-}
-
 function _typeDeclName(decl) {
   if (!decl.startsWith("type ")) {
     return;
@@ -228,9 +212,9 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
     let groups = mutationAuthMap[fieldName];
     if (Stdlib_Option.getOr(iamFields[fieldName], false)) {
-      return field + `\n    ` + _formatDualAuthDirective(groups);
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.formatDualAuthDirective(groups);
     } else if (groups !== undefined) {
-      return field + `\n    ` + _formatGroupsDirective(groups);
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective(groups);
     } else {
       return field;
     }
@@ -240,9 +224,9 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     let groups = queryAuthMap[fieldName];
     let isIam = Stdlib_Option.getOr(iamFields[fieldName], false) || iamQueryFieldPrefixes.some(p => fieldName.startsWith(p));
     if (isIam) {
-      return field + ` ` + _formatDualAuthDirective(groups);
+      return field + ` ` + AppSync_SdlDecorate$ReventlessAws.formatDualAuthDirective(groups);
     } else if (groups !== undefined) {
-      return field + ` ` + _formatGroupsDirective(groups);
+      return field + ` ` + AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective(groups);
     } else {
       return field;
     }
@@ -346,6 +330,10 @@ function generateFragment(mutationEntries, queryEntries) {
   return injectAwsAuth(fragment, mutationEntries, queryEntries);
 }
 
+let _formatGroupsDirective = AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective;
+
+let _formatDualAuthDirective = AppSync_SdlDecorate$ReventlessAws.formatDualAuthDirective;
+
 let stampSharedIamTypes = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes;
 
 let primaryAuthenticationType = "AMAZON_COGNITO_USER_POOLS";

package/src/components/Api/AppSync_SdlDecorate.res

@@ -67,26 +67,43 @@ let injectAwsSubscribe = (
 // the deploy path without dragging Pulumi into the runtime graph. AppSync_Adapter
 // delegates its `injectAwsAuthAll` / `stampSharedIamTypes` to these definitions.
 
+// Cognito group gate. `@aws_cognito_user_pools(cognito_groups: [...])` — NOT the
+// single-mode `@aws_auth(cognito_groups: [...])`.
+//
+// `@aws_auth` is honoured only on an API whose sole authorization mode is
+// AMAZON_COGNITO_USER_POOLS. This adapter always configures AWS_IAM as an
+// additional provider (see AppSync_Adapter's api args — the server-to-server
+// lambdas need it), so every API we provision is multi-auth and the service
+// **silently ignores** `@aws_auth`: the schema deploys, the directive shows up
+// in the deployed SDL, and it gates nothing. What is left is
+// `userPoolConfig.defaultAction: ALLOW`, which admits every authenticated
+// Cognito user — a group gate that fails open.
+//
+// Confirmed by observation against a deployed API: a user in no groups read
+// every `@aws_auth`-gated field and reached a gated mutation's handler. See
+// docs/plans/appsync-group-authorization-unenforced.md.
+let formatCognitoGroupsDirective = (groups: array<string>): string => {
+  let quoted = groups->Array.map(g => `"${g}"`)->Array.join(", ")
+  `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
+}
+
 // Multi-auth directive for a field/type that must accept BOTH Cognito and IAM.
 // `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps it
 // open to any authenticated Cognito user. `@aws_iam` admits the deploy-time
 // SigV4 system caller.
 let formatDualAuthDirective = (groups: option<array<string>>): string => {
   let cognito = switch groups {
-  | Some(g) =>
-    let quoted = g->Array.map(x => `"${x}"`)->Array.join(", ")
-    `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
+  | Some(g) => formatCognitoGroupsDirective(g)
   | None => `@aws_cognito_user_pools`
   }
   `${cognito} @aws_iam`
 }
 
-// Injects @aws_auth with the given group on ALL mutation, query, and subscription
-// fields in a fragment. `~iamFieldNames` opts the named mutation/query fields into
-// deploy-time IAM (dual-auth): those fields emit
-// `@aws_cognito_user_pools(cognito_groups: ["<group>"]) @aws_iam` instead of the
-// single-mode `@aws_auth(...)`, keeping the same Cognito gating while also admitting
-// the SigV4 system caller. Subscriptions are never IAM-marked.
+// Injects the Cognito group gate on ALL mutation, query, and subscription fields
+// in a fragment. `~iamFieldNames` opts the named mutation/query fields into
+// deploy-time IAM as well, appending the `@aws_iam` arm. Subscriptions are never
+// IAM-marked (the deploy caller does not subscribe) but still carry the Cognito
+// gate — a subscription is a read.
 let injectAwsAuthAll = (
   fragment: Reventless.Plugin.apiSchemaFragment,
   ~group: string,
@@ -95,19 +112,18 @@ let injectAwsAuthAll = (
   let parts = ReventlessCore.GraphQL_Stitcher.decode(fragment)
   let isIam = (field: string): bool =>
     iamFieldNames->Array.includes(ReventlessCore.GraphQL_Stitcher.extractLeadingName(field))
+  let cognitoOnly = formatCognitoGroupsDirective([group])
 
   let augmentedMutations = parts.mutations->Array.map(field =>
     isIam(field)
       ? `${field}\n    ${formatDualAuthDirective(Some([group]))}`
-      : `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
+      : `${field}\n    ${cognitoOnly}`
   )
   let augmentedQueries = parts.queries->Array.map(field =>
-    isIam(field)
-      ? `${field} ${formatDualAuthDirective(Some([group]))}`
-      : `${field} @aws_auth(cognito_groups: ["${group}"])`
+    isIam(field) ? `${field} ${formatDualAuthDirective(Some([group]))}` : `${field} ${cognitoOnly}`
   )
   let augmentedSubscriptions = parts.subscriptions->Array.map(field =>
-    `${field}\n    @aws_auth(cognito_groups: ["${group}"])`
+    `${field}\n    ${cognitoOnly}`
   )
 
   ReventlessCore.GraphQL_Stitcher.encode({

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -37,35 +37,35 @@ function injectAwsSubscribe(sdl, sources) {
   return before + decorated + after;
 }
 
+function formatCognitoGroupsDirective(groups) {
+  let quoted = groups.map(g => `"` + g + `"`).join(", ");
+  return `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
+}
+
 function formatDualAuthDirective(groups) {
-  let cognito;
-  if (groups !== undefined) {
-    let quoted = groups.map(x => `"` + x + `"`).join(", ");
-    cognito = `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
-  } else {
-    cognito = `@aws_cognito_user_pools`;
-  }
+  let cognito = groups !== undefined ? formatCognitoGroupsDirective(groups) : `@aws_cognito_user_pools`;
   return cognito + ` @aws_iam`;
 }
 
 function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
   let iamFieldNames = iamFieldNamesOpt !== undefined ? iamFieldNamesOpt : [];
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
+  let cognitoOnly = formatCognitoGroupsDirective([group]);
   let augmentedMutations = parts.mutations.map(field => {
     if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
       return field + `\n    ` + formatDualAuthDirective([group]);
     } else {
-      return field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`;
+      return field + `\n    ` + cognitoOnly;
     }
   });
   let augmentedQueries = parts.queries.map(field => {
     if (iamFieldNames.includes(GraphQL_Stitcher$ReventlessCore.extractLeadingName(field))) {
       return field + ` ` + formatDualAuthDirective([group]);
     } else {
-      return field + ` @aws_auth(cognito_groups: ["` + group + `"])`;
+      return field + ` ` + cognitoOnly;
     }
   });
-  let augmentedSubscriptions = parts.subscriptions.map(field => field + `\n    @aws_auth(cognito_groups: ["` + group + `"])`);
+  let augmentedSubscriptions = parts.subscriptions.map(field => field + `\n    ` + cognitoOnly);
   return GraphQL_Stitcher$ReventlessCore.encode({
     types: parts.types,
     mutations: augmentedMutations,
@@ -125,6 +125,7 @@ function stampCanonicalTypes(sdl) {
 
 export {
   injectAwsSubscribe,
+  formatCognitoGroupsDirective,
   formatDualAuthDirective,
   injectAwsAuthAll,
   sharedIamTypeNames,

package/tests/AppSync_AdapterTest.res

@@ -25,19 +25,19 @@ let decodeFragment = (fragment: Reventless.Plugin.apiSchemaFragment) =>
 describe("AppSync_Adapter.injectAwsAuthAll", () => {
   let baseFragment = ReventlessCore.Platform_AdminApi.baseFragment(~cloner=true)
 
-  testSync("adds @aws_auth directive to all mutation fields", () => {
+  testSync("adds the Cognito group directive to all mutation fields", () => {
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
     let parts = decodeFragment(augmented)
     parts.mutations->Array.forEach(field => {
-      expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     })
   })
 
-  testSync("adds @aws_auth directive to all query fields", () => {
+  testSync("adds the Cognito group directive to all query fields", () => {
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
     let parts = decodeFragment(augmented)
     parts.queries->Array.forEach(field => {
-      expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     })
   })
 
@@ -61,15 +61,15 @@ describe("AppSync_Adapter.injectAwsAuthAll", () => {
   // admin base. That caused AppSync to reject the auto-generated resolver for
   // `Subscription.onPlatform_Plugin_Activate` (and Deactivate) with "Type not
   // found" at deploy time. The subscription fields must survive the round-trip
-  // and pick up the same @aws_auth group as mutations/queries.
-  testSync("preserves subscription fields with @aws_auth directive", () => {
+  // and pick up the same Cognito group directive as mutations/queries.
+  testSync("preserves subscription fields with the Cognito group directive", () => {
     let original = decodeFragment(baseFragment)
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
     let parts = decodeFragment(augmented)
     expect(parts.subscriptions->Array.length)->toBe(original.subscriptions->Array.length)
     expect(parts.subscriptions->Array.length)->toBeGreaterThan(0)
     parts.subscriptions->Array.forEach(field => {
-      expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     })
   })
 
@@ -80,6 +80,21 @@ describe("AppSync_Adapter.injectAwsAuthAll", () => {
     expect(joined)->toContain("onPlatform_Plugin_Activate")
     expect(joined)->toContain("onPlatform_Plugin_Deactivate")
   })
+
+  // Regression: the admin base was stamped with the single-mode
+  // `@aws_auth(cognito_groups: [...])`, which AppSync IGNORES on a multi-auth API
+  // — and every API this adapter provisions is multi-auth. A deployed probe found
+  // a Cognito user in no groups reading every admin field. The directive must be
+  // `@aws_cognito_user_pools(...)`, the form the service actually enforces.
+  // See docs/plans/appsync-group-authorization-unenforced.md.
+  testSync("never emits the single-mode @aws_auth form on any field", () => {
+    let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
+    let parts = decodeFragment(augmented)
+    let everyField =
+      Array.concatMany(parts.mutations, [parts.queries, parts.subscriptions])->Array.join("\n")
+    expect(everyField)->not_->toContain("@aws_auth")
+    expect(everyField)->toContain("@aws_cognito_user_pools")
+  })
 })
 
 describe("AppSync_Adapter.injectAwsAuth", () => {
@@ -97,12 +112,12 @@ describe("AppSync_Adapter.injectAwsAuth", () => {
     )
     let parts = decodeFragment(augmented)
 
-    // Query entries have authorization → should have @aws_auth
+    // Query entries have authorization → should carry the directive
     let queryWithAuth =
       queryEntries->Array.some(entry => entry.authorization->Option.isSome)
     if queryWithAuth {
       let hasAuthQuery = parts.queries->Array.some(field =>
-        field->String.includes("@aws_auth")
+        field->String.includes("@aws_cognito_user_pools")
       )
       expect(hasAuthQuery)->toBe(true)
     }
@@ -124,11 +139,11 @@ describe("AppSync_Adapter.generateFragment", () => {
   })
 })
 
-// ── Stage E2: spec-level permission → @aws_auth directive ───────────────
+// ── Stage E2: spec-level permission → Cognito group directive ───────────────
 //
 // Verifies that `injectAwsAuth` lifts the `Authorization.permission` values
 // (set by Plugin_Builder / Dcb_Builder from `@@reventless.authorize` /
-// `@authorize` PPX annotations) into `@aws_auth(cognito_groups: [...])`
+// `@authorize` PPX annotations) into `@aws_cognito_user_pools(cognito_groups: [...])`
 // directives on the corresponding SDL fields.
 
 describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () => {
@@ -182,7 +197,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     )
     let parts = decodeFragment(aug)
     let m = parts.mutations->Array.getUnsafe(0)
-    expect(m)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(m)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
   })
 
   testSync("AllowGroups multi-group emits comma-separated groups", () => {
@@ -199,7 +214,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     )
     let parts = decodeFragment(aug)
     expect(parts.mutations->Array.getUnsafe(0))->toContain(
-      `@aws_auth(cognito_groups: ["Admin", "Editor"])`,
+      `@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`,
     )
   })
 
@@ -216,7 +231,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
       ~queryEntries=[],
     )
     let parts = decodeFragment(aug)
-    expect(parts.mutations->Array.getUnsafe(0))->not_->toContain("@aws_auth")
+    expect(parts.mutations->Array.getUnsafe(0))->not_->toContain("@aws_cognito_user_pools")
   })
 
   testSync("DenyAll emits sentinel __deny_all__ group", () => {
@@ -258,7 +273,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     | None => JsError.throwWithMessage("missing archive field")
     }
     switch add {
-    | Some(f) => expect(f)->not_->toContain("@aws_auth")
+    | Some(f) => expect(f)->not_->toContain("@aws_cognito_user_pools")
     | None => JsError.throwWithMessage("missing add field")
     }
   })
@@ -344,7 +359,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
       ~queryEntries=[],
     )
     let parts = decodeFragment(aug)
-    expect(parts.mutations->Array.getUnsafe(0))->not_->toContain("@aws_auth")
+    expect(parts.mutations->Array.getUnsafe(0))->not_->toContain("@aws_cognito_user_pools")
   })
 })
 
@@ -397,7 +412,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
     expect(m)->not_->toContain("@aws_auth")
   })
 
-  testSync("a non-systemCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+  testSync("a non-systemCallable sibling stays Cognito-only (no @aws_iam)", () => {
     let entry: ReventlessInfra.Api.mutationSchemaEntry = {
       fieldNames: ["p_Sync", "p_Other"],
       commandSchema: S.unknown,
@@ -420,7 +435,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
     let parts = decodeFragment(aug)
     switch parts.mutations->Array.find(f => f->String.includes("p_Other")) {
     | Some(other) =>
-      expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+      expect(other)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
       expect(other)->not_->toContain("@aws_iam")
     | None => JsError.throwWithMessage("missing p_Other field")
     }
@@ -588,13 +603,13 @@ describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () => {
         expect(field)->toContain("@aws_iam")
         expect(field)->not_->toContain("@aws_auth")
       } else {
-        expect(field)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+        expect(field)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
         expect(field)->not_->toContain("@aws_iam")
       }
     })
   })
 
-  testSync("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+  testSync("default (no ~iamFieldNames) leaves every field Cognito-only", () => {
     let augmented = AppSync_Adapter.injectAwsAuthAll(baseFragment, ~group="Admin")
     let parts = decodeFragment(augmented)
     parts.mutations->Array.forEach(field => expect(field)->not_->toContain("@aws_iam"))

package/tests/AppSync_AdapterTest.res.mjs

@@ -29,18 +29,18 @@ let decodeFragment = GraphQL_Stitcher$ReventlessCore.decode;
 
 globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
   let baseFragment = Platform_AdminApi$ReventlessCore.baseFragment(true);
-  globalThis.test("adds @aws_auth directive to all mutation fields", () => {
+  globalThis.test("adds the Cognito group directive to all mutation fields", () => {
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {
-      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     });
   });
-  globalThis.test("adds @aws_auth directive to all query fields", () => {
+  globalThis.test("adds the Cognito group directive to all query fields", () => {
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.queries.forEach(field => {
-      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     });
   });
   globalThis.test("preserves type definitions unchanged", () => {
@@ -56,14 +56,14 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
       globalThis.expect(field).toContain(`cognito_groups: ["SuperAdmin"]`);
     });
   });
-  globalThis.test("preserves subscription fields with @aws_auth directive", () => {
+  globalThis.test("preserves subscription fields with the Cognito group directive", () => {
     let original = GraphQL_Stitcher$ReventlessCore.decode(baseFragment);
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     globalThis.expect(parts.subscriptions.length).toBe(original.subscriptions.length);
     globalThis.expect(parts.subscriptions.length).toBeGreaterThan(0);
     parts.subscriptions.forEach(field => {
-      globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     });
   });
   globalThis.test("admin Plugin aggregate subscription fields survive the round-trip", () => {
@@ -73,6 +73,13 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll", () => {
     globalThis.expect(joined).toContain("onPlatform_Plugin_Activate");
     globalThis.expect(joined).toContain("onPlatform_Plugin_Deactivate");
   });
+  globalThis.test("never emits the single-mode @aws_auth form on any field", () => {
+    let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
+    let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
+    let everyField = parts.mutations.concat(parts.queries, parts.subscriptions).join("\n");
+    globalThis.expect(everyField).not.toContain("@aws_auth");
+    globalThis.expect(everyField).toContain("@aws_cognito_user_pools");
+  });
 });
 
 globalThis.describe("AppSync_Adapter.injectAwsAuth", () => {
@@ -85,7 +92,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth", () => {
     if (!queryWithAuth) {
       return;
     }
-    let hasAuthQuery = parts.queries.some(field => field.includes("@aws_auth"));
+    let hasAuthQuery = parts.queries.some(field => field.includes("@aws_cognito_user_pools"));
     globalThis.expect(hasAuthQuery).toBe(true);
   });
 });
@@ -135,7 +142,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
     let m = parts.mutations[0];
-    globalThis.expect(m).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(m).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
   });
   globalThis.test("AllowGroups multi-group emits comma-separated groups", () => {
     let fp = Object.fromEntries([[
@@ -152,7 +159,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let frag = makeFragment(["p_X(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).toContain(`@aws_auth(cognito_groups: ["Admin", "Editor"])`);
+    globalThis.expect(parts.mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`);
   });
   globalThis.test("AllowAuthenticated emits no directive", () => {
     let fp = Object.fromEntries([[
@@ -163,7 +170,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let frag = makeFragment(["p_Add(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).not.toContain("@aws_auth");
+    globalThis.expect(parts.mutations[0]).not.toContain("@aws_cognito_user_pools");
   });
   globalThis.test("DenyAll emits sentinel __deny_all__ group", () => {
     let fp = Object.fromEntries([[
@@ -208,7 +215,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
       Stdlib_JsError.throwWithMessage("missing archive field");
     }
     if (add !== undefined) {
-      globalThis.expect(add).not.toContain("@aws_auth");
+      globalThis.expect(add).not.toContain("@aws_cognito_user_pools");
       return;
     } else {
       return Stdlib_JsError.throwWithMessage("missing add field");
@@ -282,7 +289,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let frag = makeFragment(["p_X(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).not.toContain("@aws_auth");
+    globalThis.expect(parts.mutations[0]).not.toContain("@aws_cognito_user_pools");
   });
 });
 
@@ -337,7 +344,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
     globalThis.expect(m).not.toContain("cognito_groups");
     globalThis.expect(m).not.toContain("@aws_auth");
   });
-  globalThis.test("a non-systemCallable sibling keeps single-mode @aws_auth (no @aws_iam)", () => {
+  globalThis.test("a non-systemCallable sibling stays Cognito-only (no @aws_iam)", () => {
     let entry_fieldNames = [
       "p_Sync",
       "p_Other"
@@ -391,7 +398,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
     let other = parts.mutations.find(f => f.includes("p_Other"));
     if (other !== undefined) {
-      globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+      globalThis.expect(other).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
       globalThis.expect(other).not.toContain("@aws_iam");
       return;
     } else {
@@ -548,12 +555,12 @@ globalThis.describe("AppSync_Adapter.injectAwsAuthAll — ~iamFieldNames", () =>
         globalThis.expect(field).toContain("@aws_iam");
         globalThis.expect(field).not.toContain("@aws_auth");
       } else {
-        globalThis.expect(field).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+        globalThis.expect(field).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
         globalThis.expect(field).not.toContain("@aws_iam");
       }
     });
   });
-  globalThis.test("default (no ~iamFieldNames) leaves every field single-mode @aws_auth", () => {
+  globalThis.test("default (no ~iamFieldNames) leaves every field Cognito-only", () => {
     let augmented = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(baseFragment, "Admin", undefined);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(augmented);
     parts.mutations.forEach(field => {

package/tests/AppSync_SdlDecorateTest.res

@@ -31,7 +31,7 @@ type Mutation {
 type Subscription {
   onCatalog_AddProduct(id: ID): CommandResult
   onUIFragmentChange: UIFragmentChangeEvent
-    @aws_auth(cognito_groups: ["Admin"])
+    @aws_cognito_user_pools(cognito_groups: ["Admin"])
   onCatalogEventLog_eventAppended: CatalogEventLogEvent
 }`
 
@@ -43,13 +43,13 @@ describe("AppSync_SdlDecorate.injectAwsSubscribe", () => {
     )
   })
 
-  testSync("appends the many-mutations fan-in on a no-arg field, keeping @aws_auth", () => {
+  testSync("appends the many-mutations fan-in on a no-arg field, keeping the group directive", () => {
     let sdl = AppSync_SdlDecorate.injectAwsSubscribe(stitchedSdl, ~sources)
     expect(sdl)->toContain(
       `onUIFragmentChange: UIFragmentChangeEvent\n    @aws_subscribe(mutations: ["Platform_UIFragmentRegistered", "Platform_UIFragmentUpdated", "Platform_UIFragmentDeregistered"])`,
     )
     // The auth directive line appended by injectAwsAuthAll survives.
-    expect(sdl)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(sdl)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
   })
 
   testSync("leaves unmapped fields (Source A) and non-Subscription blocks untouched", () => {
@@ -113,7 +113,7 @@ describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
     expect(parts.mutations->Array.getUnsafe(0))->toContain("@aws_iam")
     // A query NOT in iamFieldNames stays Cognito-only.
     let other = queryField("Other_Query")
-    expect(other)->toContain(`@aws_auth(cognito_groups: ["Admin"])`)
+    expect(other)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
     expect(other->String.includes("@aws_iam"))->toBe(false)
   })
 })

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -35,7 +35,7 @@ type Mutation {
 type Subscription {
   onCatalog_AddProduct(id: ID): CommandResult
   onUIFragmentChange: UIFragmentChangeEvent
-    @aws_auth(cognito_groups: ["Admin"])
+    @aws_cognito_user_pools(cognito_groups: ["Admin"])
   onCatalogEventLog_eventAppended: CatalogEventLogEvent
 }`;
 
@@ -44,10 +44,10 @@ globalThis.describe("AppSync_SdlDecorate.injectAwsSubscribe", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
     globalThis.expect(sdl).toContain(`onCatalog_AddProduct(id: ID): CommandResult\n    @aws_subscribe(mutations: ["Catalog_AddProduct"])`);
   });
-  globalThis.test("appends the many-mutations fan-in on a no-arg field, keeping @aws_auth", () => {
+  globalThis.test("appends the many-mutations fan-in on a no-arg field, keeping the group directive", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
     globalThis.expect(sdl).toContain(`onUIFragmentChange: UIFragmentChangeEvent\n    @aws_subscribe(mutations: ["Platform_UIFragmentRegistered", "Platform_UIFragmentUpdated", "Platform_UIFragmentDeregistered"])`);
-    globalThis.expect(sdl).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(sdl).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
   });
   globalThis.test("leaves unmapped fields (Source A) and non-Subscription blocks untouched", () => {
     let sdl = AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(stitchedSdl, sources);
@@ -100,7 +100,7 @@ globalThis.describe("AppSync_SdlDecorate.injectAwsAuthAll", () => {
     globalThis.expect(queryField("Platform_ApiFragments")).toContain("@aws_iam");
     globalThis.expect(parts.mutations[0]).toContain("@aws_iam");
     let other = queryField("Other_Query");
-    globalThis.expect(other).toContain(`@aws_auth(cognito_groups: ["Admin"])`);
+    globalThis.expect(other).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
     globalThis.expect(other.includes("@aws_iam")).toBe(false);
   });
 });