@reventlessdev/reventless-aws 3.0.0-alpha.295 → 3.0.0-alpha.297

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.297 (2026-08-14)
+
+### Bug Fixes
+
+* **aws:** sweep undirectived fields at the schema assembly choke point ([f0ed736](https://github.com/ReventlessDev/reventless-core/commit/f0ed7369ec4dddfb697a3c93115b12f310a491b0))
+
+
+# 3.0.0-alpha.296 (2026-08-14)
+
+### Features
+
+* **aws:** give every field and type an explicit Cognito directive ([37c1063](https://github.com/ReventlessDev/reventless-core/commit/37c1063560aaa6ee200e74d58b9de4d6881441fd))
+
+
 # 3.0.0-alpha.295 (2026-08-14)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.295",
+  "version": "3.0.0-alpha.297",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -18,12 +18,12 @@
     "@reventlessdev/rescript-node": "2.0.0-alpha.6",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
     "@reventlessdev/reventless-core": "3.0.0-alpha.233",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.140"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/components/Api/AppSync_Adapter.res

@@ -355,6 +355,12 @@ let injectAwsAuth = (
     }
   })
 
+  // A field with no group restriction gets the group-less Cognito directive
+  // rather than no directive at all. Same reachability under `defaultAction:
+  // ALLOW`; the difference only shows once the default is DENY, where an
+  // unstamped field is refused. See AppSync_SdlDecorate.cognitoOpenDirective.
+  let openDirective = AppSync_SdlDecorate.cognitoOpenDirective
+
   let augmentedMutations = parts.mutations->Array.map(field => {
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
     let groups = mutationAuthMap->Dict.get(fieldName)
@@ -363,7 +369,7 @@ let injectAwsAuth = (
     } else {
       switch groups {
       | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
-      | None => field
+      | None => `${field}\n    ${openDirective}`
       }
     }
   })
@@ -379,11 +385,23 @@ let injectAwsAuth = (
     } else {
       switch groups {
       | Some(groups) => `${field} ${_formatGroupsDirective(groups)}`
-      | None => field
+      | None => `${field} ${openDirective}`
       }
     }
   })
 
+  // Subscriptions carried no directive at all on this path — they are reads and
+  // need one for the same reason queries do. A subscription is never IAM-marked
+  // (the deploy caller does not subscribe), so it takes the Cognito arm only:
+  // the mutation's groups where the subscribed field has them, otherwise open.
+  let augmentedSubscriptions = parts.subscriptions->Array.map(field => {
+    let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
+    switch mutationAuthMap->Dict.get(fieldName) {
+    | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
+    | None => `${field}\n    ${openDirective}`
+    }
+  })
+
   // Type-level dual-auth for every type the callable entries' responses reach —
   // the node type, its Connection/Edge wrappers, and nested state types all
   // share the entry's returnTypeName prefix.
@@ -400,6 +418,7 @@ let injectAwsAuth = (
     types: augmentedTypes,
     mutations: augmentedMutations,
     queries: augmentedQueries,
+    subscriptions: augmentedSubscriptions,
   })
 }
 
@@ -441,9 +460,16 @@ let stitchStandaloneWithAwsDirectives = (
     ~baseFragment=fragment,
     ~pluginFragments=[],
   )
+  // Every AWS source-API document assembles through here, so this is the one
+  // place that can guarantee no field or type reaches a deployed schema without
+  // an auth directive — whichever path injected it.
+  let fragment = AppSync_SdlDecorate.stampUndirectivedFields(fragment)
   ReventlessCore.GraphQL_Stitcher.stitchStandalone(~fragment)
   ->AppSync_SdlDecorate.injectAwsSubscribe(~sources)
   ->stampSharedIamTypes
+  // Last: every remaining undirectived type takes the group-less Cognito arm.
+  // After stampSharedIamTypes so the shared traversal types keep `@aws_iam`.
+  ->AppSync_SdlDecorate.stampAllTypesCognito
 }
 
 // ── Provider implementation ────────────────────────────────────────────────

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -216,7 +216,7 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     } else if (groups !== undefined) {
       return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective(groups);
     } else {
-      return field;
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.cognitoOpenDirective;
     }
   });
   let augmentedQueries = parts.queries.map(field => {
@@ -228,7 +228,16 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     } else if (groups !== undefined) {
       return field + ` ` + AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective(groups);
     } else {
-      return field;
+      return field + ` ` + AppSync_SdlDecorate$ReventlessAws.cognitoOpenDirective;
+    }
+  });
+  let augmentedSubscriptions = parts.subscriptions.map(field => {
+    let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
+    let groups = mutationAuthMap[fieldName];
+    if (groups !== undefined) {
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective(groups);
+    } else {
+      return field + `\n    ` + AppSync_SdlDecorate$ReventlessAws.cognitoOpenDirective;
     }
   });
   let augmentedTypes = parts.types.map(decl => {
@@ -243,7 +252,7 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     types: augmentedTypes,
     mutations: augmentedMutations,
     queries: augmentedQueries,
-    subscriptions: parts.subscriptions,
+    subscriptions: augmentedSubscriptions,
     subscriptionSources: parts.subscriptionSources
   });
 }
@@ -255,7 +264,8 @@ function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
 
 function stitchStandaloneWithAwsDirectives(fragment) {
   let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(fragment, []);
-  return AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment), sources));
+  let fragment$1 = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(fragment);
+  return AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment$1), sources)));
 }
 
 function _makeApiResourceWith(name, schema, userPoolConfig, opts) {

package/src/components/Api/AppSync_SdlDecorate.res

@@ -87,6 +87,18 @@ let formatCognitoGroupsDirective = (groups: array<string>): string => {
   `@aws_cognito_user_pools(cognito_groups: [${quoted}])`
 }
 
+// The group-less Cognito directive: reachable by any authenticated Cognito
+// caller. Emitted where a field or type is deliberately open — `AllowAuthenticated`,
+// `AllowAnonymous`, a field carrying no permission at all, and every object type.
+//
+// Under `userPoolConfig.defaultAction: ALLOW` this is a no-op: an undirectived
+// field is already reachable by any authenticated caller, so stamping it changes
+// nothing. It exists so the default can be flipped to DENY, where "no directive"
+// stops meaning "open" and starts meaning "refused" — at which point anything
+// left unstamped breaks. Stamping first and flipping second is what keeps that
+// flip from being a guess.
+let cognitoOpenDirective = "@aws_cognito_user_pools"
+
 // Multi-auth directive for a field/type that must accept BOTH Cognito and IAM.
 // `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps it
 // open to any authenticated Cognito user. `@aws_iam` admits the deploy-time
@@ -94,7 +106,7 @@ let formatCognitoGroupsDirective = (groups: array<string>): string => {
 let formatDualAuthDirective = (groups: option<array<string>>): string => {
   let cognito = switch groups {
   | Some(g) => formatCognitoGroupsDirective(g)
-  | None => `@aws_cognito_user_pools`
+  | None => cognitoOpenDirective
   }
   `${cognito} @aws_iam`
 }
@@ -150,6 +162,69 @@ let stampSharedIamTypes = (sdl: string): string =>
     acc->String.replace(`type ${name} {`, `type ${name} @aws_cognito_user_pools @aws_iam {`)
   )
 
+// Final field sweep, run at the assembly choke point on the FRAGMENT (where each
+// element is one whole field, so "does it already carry a directive?" is a
+// reliable question — on raw SDL text a directive placed on the following line
+// would read as absent).
+//
+// `injectAwsAuth` only decorates fields it can pair with a schema entry, and
+// several surfaces never reach it at all: the domain base document
+// (`Platform_ping`), event-history queries, event-log `…_eventAppended`
+// subscriptions, the upload presign/release mutations, `Platform_SetActiveRole`,
+// and `geocode`. Those deployed with no directive — invisible under
+// `defaultAction: ALLOW`, refused under DENY. Sweeping here rather than at each
+// emission site means a future injected field cannot silently miss the net.
+//
+// Idempotent, and deliberately does not second-guess gating: it only fills in
+// "open to any authenticated Cognito caller", which is what an undirectived
+// field already means today.
+let stampUndirectivedFields = (
+  fragment: Reventless.Plugin.apiSchemaFragment,
+): Reventless.Plugin.apiSchemaFragment => {
+  let parts = ReventlessCore.GraphQL_Stitcher.decode(fragment)
+  let stamp = (field: string): string =>
+    field->String.includes("@aws_") ? field : `${field}\n    ${cognitoOpenDirective}`
+
+  ReventlessCore.GraphQL_Stitcher.encode({
+    ...parts,
+    mutations: parts.mutations->Array.map(stamp),
+    queries: parts.queries->Array.map(stamp),
+    subscriptions: parts.subscriptions->Array.map(stamp),
+  })
+}
+
+// Stamp every object `type` declaration that does not already carry an auth
+// directive with the group-less Cognito arm. Run on the ASSEMBLED SDL, AFTER
+// stampSharedIamTypes so the shared traversal types keep their `@aws_iam` arm
+// (this pass skips anything already carrying an `@aws_` directive).
+//
+// Types, not just fields: on a multi-auth API with `defaultAction: DENY`,
+// AppSync refuses an undirectived TYPE even when the caller passed the field's
+// own gate — response shaping walks `…Connection` → `…Edge` → node → nested
+// state types and dies one level in. Entry gating stays on the fields; a type
+// stamp only restores the accessibility an undirectived type has today.
+//
+// Only `type` declarations take auth directives — `input`, `enum`, `union` and
+// `interface` do not, and stamping them is a schema error.
+let stampAllTypesCognito = (sdl: string): string =>
+  sdl
+  ->String.split("\n")
+  ->Array.map(line =>
+    if line->String.startsWith("type ") && !(line->String.includes("@aws_")) {
+      switch line->String.indexOfOpt("{") {
+      | Some(i) =>
+        line->String.slice(~start=0, ~end=i) ++
+        cognitoOpenDirective ++
+        " " ++
+        line->String.slice(~start=i, ~end=line->String.length)
+      | None => line
+      }
+    } else {
+      line
+    }
+  )
+  ->Array.join("\n")
+
 // ── Merged-API canonical stamping ─────────────────────────────────────────────
 // Under AppSync Merged APIs the admin source API owns the shared traversal
 // types; `@canonical` makes its definition win over every plugin source's copy

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -42,8 +42,10 @@ function formatCognitoGroupsDirective(groups) {
   return `@aws_cognito_user_pools(cognito_groups: [` + quoted + `])`;
 }
 
+let cognitoOpenDirective = "@aws_cognito_user_pools";
+
 function formatDualAuthDirective(groups) {
-  let cognito = groups !== undefined ? formatCognitoGroupsDirective(groups) : `@aws_cognito_user_pools`;
+  let cognito = groups !== undefined ? formatCognitoGroupsDirective(groups) : cognitoOpenDirective;
   return cognito + ` @aws_iam`;
 }
 
@@ -86,6 +88,38 @@ function stampSharedIamTypes(sdl) {
   return Stdlib_Array.reduce(sharedIamTypeNames, sdl, (acc, name) => acc.replace(`type ` + name + ` {`, `type ` + name + ` @aws_cognito_user_pools @aws_iam {`));
 }
 
+function stampUndirectivedFields(fragment) {
+  let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
+  let stamp = field => {
+    if (field.includes("@aws_")) {
+      return field;
+    } else {
+      return field + `\n    ` + cognitoOpenDirective;
+    }
+  };
+  return GraphQL_Stitcher$ReventlessCore.encode({
+    types: parts.types,
+    mutations: parts.mutations.map(stamp),
+    queries: parts.queries.map(stamp),
+    subscriptions: parts.subscriptions.map(stamp),
+    subscriptionSources: parts.subscriptionSources
+  });
+}
+
+function stampAllTypesCognito(sdl) {
+  return sdl.split("\n").map(line => {
+    if (!(line.startsWith("type ") && !line.includes("@aws_"))) {
+      return line;
+    }
+    let i = Stdlib_String.indexOfOpt(line, "{");
+    if (i !== undefined) {
+      return line.slice(0, i) + cognitoOpenDirective + " " + line.slice(i, line.length);
+    } else {
+      return line;
+    }
+  }).join("\n");
+}
+
 let canonicalTypeNames = [
   "PageInfo",
   "CommandAccepted",
@@ -126,10 +160,13 @@ function stampCanonicalTypes(sdl) {
 export {
   injectAwsSubscribe,
   formatCognitoGroupsDirective,
+  cognitoOpenDirective,
   formatDualAuthDirective,
   injectAwsAuthAll,
   sharedIamTypeNames,
   stampSharedIamTypes,
+  stampUndirectivedFields,
+  stampAllTypesCognito,
   canonicalTypeNames,
   stampCanonicalTypes,
 }

package/tests/AppSync_AdapterTest.res

@@ -218,7 +218,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     )
   })
 
-  testSync("AllowAuthenticated emits no directive", () => {
+  testSync("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Dict.fromArray([(
       "p_Add",
       Reventless.Authorization.AllowAuthenticated,
@@ -231,7 +231,11 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
       ~queryEntries=[],
     )
     let parts = decodeFragment(aug)
-    expect(parts.mutations->Array.getUnsafe(0))->not_->toContain("@aws_cognito_user_pools")
+    // Open, not ungated: the field carries the group-less directive so it stays
+    // reachable once defaultAction flips to DENY, but names no group.
+    let m = parts.mutations->Array.getUnsafe(0)
+    expect(m)->toContain("@aws_cognito_user_pools")
+    expect(m)->not_->toContain("cognito_groups")
   })
 
   testSync("DenyAll emits sentinel __deny_all__ group", () => {
@@ -273,7 +277,9 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     | None => JsError.throwWithMessage("missing archive field")
     }
     switch add {
-    | Some(f) => expect(f)->not_->toContain("@aws_cognito_user_pools")
+    | Some(f) =>
+      expect(f)->toContain("@aws_cognito_user_pools")
+      expect(f)->not_->toContain("cognito_groups")
     | None => JsError.throwWithMessage("missing add field")
     }
   })
@@ -338,7 +344,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     expect(m)->not_->toContain(`"Admin"`)
   })
 
-  testSync("AllowAuthenticated on a field overrides the legacy authorization (removes directive)", () => {
+  testSync("AllowAuthenticated on a field overrides the legacy authorization (drops the group)", () => {
     let fp = Dict.fromArray([(
       "p_X",
       Reventless.Authorization.AllowAuthenticated,
@@ -359,7 +365,11 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
       ~queryEntries=[],
     )
     let parts = decodeFragment(aug)
-    expect(parts.mutations->Array.getUnsafe(0))->not_->toContain("@aws_cognito_user_pools")
+    // The spec-level AllowAuthenticated wins over the legacy `authorization.group`:
+    // the field keeps a directive, but no longer names a group.
+    let m = parts.mutations->Array.getUnsafe(0)
+    expect(m)->toContain("@aws_cognito_user_pools")
+    expect(m)->not_->toContain("cognito_groups")
   })
 })
 
@@ -851,3 +861,56 @@ describe("AppSync_Adapter.waitForMergeSuccess", () => {
     expect(message.contents)->toContain("MERGE_IN_PROGRESS")
   })
 })
+
+// ── Subscription stamping ───────────────────────────────────────────────────
+//
+// `injectAwsAuth` re-encoded `subscriptions` untouched, so every plugin
+// subscription reached the deployed SDL with no auth directive at all — 22 of
+// them on the hybrid domain API. Harmless under `defaultAction: ALLOW`, refused
+// under DENY. A subscription is a read and takes the Cognito arm; it is never
+// IAM-marked, because the deploy-time caller does not subscribe.
+
+describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
+  let makeFragment = subscriptionFields =>
+    ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations: ["p_Ship(id: ID!): CommandResult!"],
+      queries: [],
+      subscriptions: subscriptionFields,
+      subscriptionSources: [],
+    })
+
+  let entry = (~fieldNames, ~fieldPermissions): ReventlessInfra.Api.mutationSchemaEntry => {
+    fieldNames,
+    commandSchema: S.unknown,
+    fieldPermissions,
+  }
+
+  testSync("an unannotated subscription gets the group-less Cognito directive", () => {
+    let frag = makeFragment(["onSomething: CommandResult"])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[])
+    let s = decodeFragment(aug).subscriptions->Array.getUnsafe(0)
+    expect(s)->toContain("@aws_cognito_user_pools")
+    expect(s)->not_->toContain("cognito_groups")
+    expect(s)->not_->toContain("@aws_iam")
+  })
+
+  testSync("a subscription named like a gated mutation inherits its groups", () => {
+    let fp = Dict.fromArray([("p_Ship", Reventless.Authorization.AllowGroups(["Fulfilment"]))])
+    let frag = makeFragment(["p_Ship: CommandResult"])
+    let aug = AppSync_Adapter.injectAwsAuth(
+      frag,
+      ~mutationEntries=[entry(~fieldNames=["p_Ship"], ~fieldPermissions=fp)],
+      ~queryEntries=[],
+    )
+    let s = decodeFragment(aug).subscriptions->Array.getUnsafe(0)
+    expect(s)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Fulfilment"])`)
+    expect(s)->not_->toContain("@aws_iam")
+  })
+
+  testSync("subscription fields survive the round-trip", () => {
+    let frag = makeFragment(["onA: CommandResult", "onB: CommandResult"])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[], ~queryEntries=[])
+    expect(decodeFragment(aug).subscriptions->Array.length)->toBe(2)
+  })
+})

package/tests/AppSync_AdapterTest.res.mjs

@@ -161,7 +161,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
     globalThis.expect(parts.mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`);
   });
-  globalThis.test("AllowAuthenticated emits no directive", () => {
+  globalThis.test("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Object.fromEntries([[
         "p_Add",
         "AllowAuthenticated"
@@ -170,7 +170,9 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let frag = makeFragment(["p_Add(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).not.toContain("@aws_cognito_user_pools");
+    let m = parts.mutations[0];
+    globalThis.expect(m).toContain("@aws_cognito_user_pools");
+    globalThis.expect(m).not.toContain("cognito_groups");
   });
   globalThis.test("DenyAll emits sentinel __deny_all__ group", () => {
     let fp = Object.fromEntries([[
@@ -215,7 +217,8 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
       Stdlib_JsError.throwWithMessage("missing archive field");
     }
     if (add !== undefined) {
-      globalThis.expect(add).not.toContain("@aws_cognito_user_pools");
+      globalThis.expect(add).toContain("@aws_cognito_user_pools");
+      globalThis.expect(add).not.toContain("cognito_groups");
       return;
     } else {
       return Stdlib_JsError.throwWithMessage("missing add field");
@@ -269,7 +272,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     globalThis.expect(m).toContain(`cognito_groups: ["Manager"]`);
     globalThis.expect(m).not.toContain(`"Admin"`);
   });
-  globalThis.test("AllowAuthenticated on a field overrides the legacy authorization (removes directive)", () => {
+  globalThis.test("AllowAuthenticated on a field overrides the legacy authorization (drops the group)", () => {
     let fp = Object.fromEntries([[
         "p_X",
         "AllowAuthenticated"
@@ -289,7 +292,9 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let frag = makeFragment(["p_X(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).not.toContain("@aws_cognito_user_pools");
+    let m = parts.mutations[0];
+    globalThis.expect(m).toContain("@aws_cognito_user_pools");
+    globalThis.expect(m).not.toContain("cognito_groups");
   });
 });
 
@@ -746,6 +751,51 @@ globalThis.describe("AppSync_Adapter.waitForMergeSuccess", () => {
   });
 });
 
+globalThis.describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
+  let makeFragment = subscriptionFields => GraphQL_Stitcher$ReventlessCore.encode({
+    types: [],
+    mutations: ["p_Ship(id: ID!): CommandResult!"],
+    queries: [],
+    subscriptions: subscriptionFields,
+    subscriptionSources: []
+  });
+  let entry = (fieldNames, fieldPermissions) => ({
+    fieldNames: fieldNames,
+    commandSchema: S.unknown,
+    fieldPermissions: fieldPermissions
+  });
+  globalThis.test("an unannotated subscription gets the group-less Cognito directive", () => {
+    let frag = makeFragment(["onSomething: CommandResult"]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], []);
+    let s = GraphQL_Stitcher$ReventlessCore.decode(aug).subscriptions[0];
+    globalThis.expect(s).toContain("@aws_cognito_user_pools");
+    globalThis.expect(s).not.toContain("cognito_groups");
+    globalThis.expect(s).not.toContain("@aws_iam");
+  });
+  globalThis.test("a subscription named like a gated mutation inherits its groups", () => {
+    let fp = Object.fromEntries([[
+        "p_Ship",
+        {
+          TAG: "AllowGroups",
+          _0: ["Fulfilment"]
+        }
+      ]]);
+    let frag = makeFragment(["p_Ship: CommandResult"]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry(["p_Ship"], fp)], []);
+    let s = GraphQL_Stitcher$ReventlessCore.decode(aug).subscriptions[0];
+    globalThis.expect(s).toContain(`@aws_cognito_user_pools(cognito_groups: ["Fulfilment"])`);
+    globalThis.expect(s).not.toContain("@aws_iam");
+  });
+  globalThis.test("subscription fields survive the round-trip", () => {
+    let frag = makeFragment([
+      "onA: CommandResult",
+      "onB: CommandResult"
+    ]);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], []);
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(aug).subscriptions.length).toBe(2);
+  });
+});
+
 export {
   decodeFragment,
 }

package/tests/AppSync_SdlDecorateTest.res

@@ -152,3 +152,100 @@ describe("AppSync_SdlDecorate.stampCanonicalTypes", () => {
     expect(AppSync_SdlDecorate.stampCanonicalTypes(once))->toBe(once)
   })
 })
+
+// ── Type-level Cognito stamping (defaultAction: DENY groundwork) ─────────────
+//
+// With `defaultAction: ALLOW` an undirectived type is reachable by any
+// authenticated Cognito caller, so this pass changes nothing observable. It
+// exists so the default can be flipped to DENY, where an undirectived type is
+// refused mid-traversal even for a caller who passed the field's own gate.
+
+describe("AppSync_SdlDecorate.stampAllTypesCognito", () => {
+  testSync("stamps an undirectived object type", () => {
+    let sdl = AppSync_SdlDecorate.stampAllTypesCognito("type Product {\n  id: ID!\n}")
+    expect(sdl)->toContain("type Product @aws_cognito_user_pools {")
+  })
+
+  testSync("leaves an already-directived type alone, keeping its @aws_iam arm", () => {
+    let sdl =
+      AppSync_SdlDecorate.stampSharedIamTypes(
+        "type PageInfo {\n  hasNextPage: Boolean!\n}",
+      )->AppSync_SdlDecorate.stampAllTypesCognito
+    expect(sdl)->toContain("type PageInfo @aws_cognito_user_pools @aws_iam {")
+    // Not double-stamped.
+    expect(sdl->String.includes("@aws_cognito_user_pools @aws_cognito_user_pools"))->toBe(false)
+  })
+
+  testSync("does not stamp input, enum, union or interface declarations", () => {
+    let sdl = AppSync_SdlDecorate.stampAllTypesCognito(
+      "input ProductFilter {\n  id: ID\n}\n\nenum Status {\n  Active\n}\n\nunion CommandResult = CommandAccepted | CommandRejected\n\ninterface Node {\n  id: ID!\n}",
+    )
+    expect(sdl->String.includes("@aws_cognito_user_pools"))->toBe(false)
+  })
+
+  testSync("is idempotent", () => {
+    let once = AppSync_SdlDecorate.stampAllTypesCognito("type Product {\n  id: ID!\n}")
+    expect(AppSync_SdlDecorate.stampAllTypesCognito(once))->toBe(once)
+  })
+})
+
+// ── Final field sweep ───────────────────────────────────────────────────────
+//
+// `injectAwsAuth` only decorates fields it can pair with a schema entry. Several
+// surfaces never reach it: the domain base (`Platform_ping`), event-history
+// queries, `…_eventAppended` subscriptions, upload mutations,
+// `Platform_SetActiveRole`, `geocode`. A deployed-SDL count after the first
+// sweep found 11 such fields still bare on the domain API. This pass is the net.
+
+describe("AppSync_SdlDecorate.stampUndirectivedFields", () => {
+  let frag = (~mutations=[], ~queries=[], ~subscriptions=[], ()) =>
+    ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations,
+      queries,
+      subscriptions,
+      subscriptionSources: [],
+    })
+
+  testSync("stamps a query no schema entry ever paired with", () => {
+    let out = AppSync_SdlDecorate.stampUndirectivedFields(
+      frag(~queries=["  Platform_ping: String"], ()),
+    )
+    let q = ReventlessCore.GraphQL_Stitcher.decode(out).queries->Array.getUnsafe(0)
+    expect(q)->toContain("@aws_cognito_user_pools")
+    expect(q)->not_->toContain("cognito_groups")
+  })
+
+  testSync("stamps an event-log subscription", () => {
+    let out = AppSync_SdlDecorate.stampUndirectivedFields(
+      frag(~subscriptions=["  onFoo_eventAppended: FooEvent"], ()),
+    )
+    expect(
+      ReventlessCore.GraphQL_Stitcher.decode(out).subscriptions->Array.getUnsafe(0),
+    )->toContain("@aws_cognito_user_pools")
+  })
+
+  testSync("leaves an already-gated field untouched, group and all", () => {
+    let gated = `  Secret_Read: String\n    @aws_cognito_user_pools(cognito_groups: ["Admin"])`
+    let out = AppSync_SdlDecorate.stampUndirectivedFields(frag(~queries=[gated], ()))
+    let q = ReventlessCore.GraphQL_Stitcher.decode(out).queries->Array.getUnsafe(0)
+    expect(q)->toContain(`cognito_groups: ["Admin"]`)
+    expect(q->String.includes("@aws_cognito_user_pools @aws_cognito_user_pools"))->toBe(false)
+  })
+
+  testSync("does not strip an @aws_iam arm", () => {
+    let dual = "  Sys_Sync: String\n    @aws_cognito_user_pools @aws_iam"
+    let out = AppSync_SdlDecorate.stampUndirectivedFields(frag(~mutations=[dual], ()))
+    expect(
+      ReventlessCore.GraphQL_Stitcher.decode(out).mutations->Array.getUnsafe(0),
+    )->toContain("@aws_iam")
+  })
+
+  testSync("is idempotent", () => {
+    let once = AppSync_SdlDecorate.stampUndirectivedFields(frag(~queries=["  a: String"], ()))
+    let twice = AppSync_SdlDecorate.stampUndirectivedFields(once)
+    expect(ReventlessCore.GraphQL_Stitcher.decode(twice).queries->Array.getUnsafe(0))->toBe(
+      ReventlessCore.GraphQL_Stitcher.decode(once).queries->Array.getUnsafe(0),
+    )
+  })
+})

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -132,6 +132,66 @@ globalThis.describe("AppSync_SdlDecorate.stampCanonicalTypes", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.stampAllTypesCognito", () => {
+  globalThis.test("stamps an undirectived object type", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito("type Product {\n  id: ID!\n}");
+    globalThis.expect(sdl).toContain("type Product @aws_cognito_user_pools {");
+  });
+  globalThis.test("leaves an already-directived type alone, keeping its @aws_iam arm", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes("type PageInfo {\n  hasNextPage: Boolean!\n}"));
+    globalThis.expect(sdl).toContain("type PageInfo @aws_cognito_user_pools @aws_iam {");
+    globalThis.expect(sdl.includes("@aws_cognito_user_pools @aws_cognito_user_pools")).toBe(false);
+  });
+  globalThis.test("does not stamp input, enum, union or interface declarations", () => {
+    let sdl = AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito("input ProductFilter {\n  id: ID\n}\n\nenum Status {\n  Active\n}\n\nunion CommandResult = CommandAccepted | CommandRejected\n\ninterface Node {\n  id: ID!\n}");
+    globalThis.expect(sdl.includes("@aws_cognito_user_pools")).toBe(false);
+  });
+  globalThis.test("is idempotent", () => {
+    let once = AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito("type Product {\n  id: ID!\n}");
+    globalThis.expect(AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(once)).toBe(once);
+  });
+});
+
+globalThis.describe("AppSync_SdlDecorate.stampUndirectivedFields", () => {
+  let frag = (mutationsOpt, queriesOpt, subscriptionsOpt, param) => {
+    let mutations = mutationsOpt !== undefined ? mutationsOpt : [];
+    let queries = queriesOpt !== undefined ? queriesOpt : [];
+    let subscriptions = subscriptionsOpt !== undefined ? subscriptionsOpt : [];
+    return GraphQL_Stitcher$ReventlessCore.encode({
+      types: [],
+      mutations: mutations,
+      queries: queries,
+      subscriptions: subscriptions,
+      subscriptionSources: []
+    });
+  };
+  globalThis.test("stamps a query no schema entry ever paired with", () => {
+    let out = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(undefined, ["  Platform_ping: String"], undefined, undefined));
+    let q = GraphQL_Stitcher$ReventlessCore.decode(out).queries[0];
+    globalThis.expect(q).toContain("@aws_cognito_user_pools");
+    globalThis.expect(q).not.toContain("cognito_groups");
+  });
+  globalThis.test("stamps an event-log subscription", () => {
+    let out = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(undefined, undefined, ["  onFoo_eventAppended: FooEvent"], undefined));
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(out).subscriptions[0]).toContain("@aws_cognito_user_pools");
+  });
+  globalThis.test("leaves an already-gated field untouched, group and all", () => {
+    let out = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(undefined, [`  Secret_Read: String\n    @aws_cognito_user_pools(cognito_groups: ["Admin"])`], undefined, undefined));
+    let q = GraphQL_Stitcher$ReventlessCore.decode(out).queries[0];
+    globalThis.expect(q).toContain(`cognito_groups: ["Admin"]`);
+    globalThis.expect(q.includes("@aws_cognito_user_pools @aws_cognito_user_pools")).toBe(false);
+  });
+  globalThis.test("does not strip an @aws_iam arm", () => {
+    let out = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(["  Sys_Sync: String\n    @aws_cognito_user_pools @aws_iam"], undefined, undefined, undefined));
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(out).mutations[0]).toContain("@aws_iam");
+  });
+  globalThis.test("is idempotent", () => {
+    let once = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(undefined, ["  a: String"], undefined, undefined));
+    let twice = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(once);
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(twice).queries[0]).toBe(GraphQL_Stitcher$ReventlessCore.decode(once).queries[0]);
+  });
+});
+
 export {
   sources,
   stitchedSdl,