@reventlessdev/reventless-aws 3.0.0-alpha.296 → 3.0.0-alpha.298

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.298 (2026-08-14)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
+# 3.0.0-alpha.297 (2026-08-14)
+
+### Bug Fixes
+
+* **aws:** sweep undirectived fields at the schema assembly choke point ([f0ed736](https://github.com/ReventlessDev/reventless-core/commit/f0ed7369ec4dddfb697a3c93115b12f310a491b0))
+
+
 # 3.0.0-alpha.296 (2026-08-14)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.296",
+  "version": "3.0.0-alpha.298",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -13,14 +13,14 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.6",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
     "@reventlessdev/reventless-core": "3.0.0-alpha.233",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31"

package/src/Platform.res

@@ -335,7 +335,7 @@ module MakeWithConfig = (
           {
             userPoolId,
             ?awsRegion,
-            defaultAction: PulumiAws.AppSync.GraphQLApi.ALLOW,
+            defaultAction: PulumiAws.AppSync.GraphQLApi.DENY,
           }: PulumiAws.AppSync.GraphQLApi.userPoolConfig
         )
       })

package/src/Platform.res.mjs

@@ -220,7 +220,7 @@ function MakeWithConfig(Config) {
       let awsRegion = Stdlib_Option.orElse(param[1], getFromDefault("cognitoRegion"));
       return {
         userPoolId: userPoolId,
-        defaultAction: "ALLOW",
+        defaultAction: "DENY",
         awsRegion: awsRegion
       };
     });
@@ -1523,7 +1523,7 @@ function Make($star) {
       let awsRegion = Stdlib_Option.orElse(param[1], getFromDefault("cognitoRegion"));
       return {
         userPoolId: userPoolId,
-        defaultAction: "ALLOW",
+        defaultAction: "DENY",
         awsRegion: awsRegion
       };
     });

package/src/components/Api/AppSync_Adapter.res

@@ -460,6 +460,10 @@ let stitchStandaloneWithAwsDirectives = (
     ~baseFragment=fragment,
     ~pluginFragments=[],
   )
+  // Every AWS source-API document assembles through here, so this is the one
+  // place that can guarantee no field or type reaches a deployed schema without
+  // an auth directive — whichever path injected it.
+  let fragment = AppSync_SdlDecorate.stampUndirectivedFields(fragment)
   ReventlessCore.GraphQL_Stitcher.stitchStandalone(~fragment)
   ->AppSync_SdlDecorate.injectAwsSubscribe(~sources)
   ->stampSharedIamTypes
@@ -529,6 +533,17 @@ let _makeApiResourceWith = (
   // Auth_Cognito (cached inside Platform_Stack, so calling from each API call
   // site — DomainApi, PlatformApi — is safe). A single Output yielding the
   // {userPoolId, awsRegion, defaultAction} record AppSync expects.
+  //
+  // `DENY`, not `ALLOW`: an undirectived field or type is refused rather than
+  // served to any authenticated Cognito caller. This is what makes a missing
+  // directive fail closed — under `ALLOW` the group gate that was inert for the
+  // whole of `@aws_auth`'s life produced no symptom at all, because "no
+  // effective directive" and "open to everyone" were the same thing.
+  //
+  // Safe only because every field and type now carries an explicit directive
+  // (`stampUndirectivedFields` + `stampAllTypesCognito` at the assembly choke
+  // point). Verify with `scripts/check-appsync-directive-coverage.mjs` against a
+  // DEPLOYED api — it must report zero before this value is trusted.
   let userPoolConfigOut = switch userPoolConfig {
   | Some(config) => config
   | None =>
@@ -537,7 +552,7 @@ let _makeApiResourceWith = (
         {
           userPoolId: c.userPoolId,
           awsRegion: c.region,
-          defaultAction: AppSync.GraphQLApi.ALLOW,
+          defaultAction: AppSync.GraphQLApi.DENY,
         }: AppSync.GraphQLApi.userPoolConfig
       )
     )

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -264,7 +264,8 @@ function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
 
 function stitchStandaloneWithAwsDirectives(fragment) {
   let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(fragment, []);
-  return AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment), sources)));
+  let fragment$1 = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(fragment);
+  return AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment$1), sources)));
 }
 
 function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
@@ -287,7 +288,7 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   };
   let userPoolConfigOut = userPoolConfig !== undefined ? userPoolConfig : Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined).apply(c => ({
       userPoolId: c.userPoolId,
-      defaultAction: "ALLOW",
+      defaultAction: "DENY",
       awsRegion: c.region
     }));
   let apiArgs_schema = Stdlib_Option.map(schema, prim => prim);

package/src/components/Api/AppSync_MergedApi.res

@@ -100,7 +100,7 @@ let make = (~name: string, ~opts: Pulumi.ComponentResource.options): t => {
     ): AppSync.GraphQLApi.userPoolConfig => {
       userPoolId: c.userPoolId,
       awsRegion: c.region,
-      defaultAction: AppSync.GraphQLApi.ALLOW,
+      defaultAction: AppSync.GraphQLApi.DENY,
     })
 
   let mergedApi = AppSync.GraphQLApi.make(

package/src/components/Api/AppSync_MergedApi.res.mjs

@@ -55,7 +55,7 @@ function make(name, opts) {
   let authConfigOut = Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined);
   let userPoolConfigOut = authConfigOut.apply(c => ({
     userPoolId: c.userPoolId,
-    defaultAction: "ALLOW",
+    defaultAction: "DENY",
     awsRegion: c.region
   }));
   let mergedApi = new (Aws.appsync.GraphQLApi)(name, {

package/src/components/Api/AppSync_SdlDecorate.res

@@ -162,6 +162,37 @@ let stampSharedIamTypes = (sdl: string): string =>
     acc->String.replace(`type ${name} {`, `type ${name} @aws_cognito_user_pools @aws_iam {`)
   )
 
+// Final field sweep, run at the assembly choke point on the FRAGMENT (where each
+// element is one whole field, so "does it already carry a directive?" is a
+// reliable question — on raw SDL text a directive placed on the following line
+// would read as absent).
+//
+// `injectAwsAuth` only decorates fields it can pair with a schema entry, and
+// several surfaces never reach it at all: the domain base document
+// (`Platform_ping`), event-history queries, event-log `…_eventAppended`
+// subscriptions, the upload presign/release mutations, `Platform_SetActiveRole`,
+// and `geocode`. Those deployed with no directive — invisible under
+// `defaultAction: ALLOW`, refused under DENY. Sweeping here rather than at each
+// emission site means a future injected field cannot silently miss the net.
+//
+// Idempotent, and deliberately does not second-guess gating: it only fills in
+// "open to any authenticated Cognito caller", which is what an undirectived
+// field already means today.
+let stampUndirectivedFields = (
+  fragment: Reventless.Plugin.apiSchemaFragment,
+): Reventless.Plugin.apiSchemaFragment => {
+  let parts = ReventlessCore.GraphQL_Stitcher.decode(fragment)
+  let stamp = (field: string): string =>
+    field->String.includes("@aws_") ? field : `${field}\n    ${cognitoOpenDirective}`
+
+  ReventlessCore.GraphQL_Stitcher.encode({
+    ...parts,
+    mutations: parts.mutations->Array.map(stamp),
+    queries: parts.queries->Array.map(stamp),
+    subscriptions: parts.subscriptions->Array.map(stamp),
+  })
+}
+
 // Stamp every object `type` declaration that does not already carry an auth
 // directive with the group-less Cognito arm. Run on the ASSEMBLED SDL, AFTER
 // stampSharedIamTypes so the shared traversal types keep their `@aws_iam` arm

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -88,6 +88,24 @@ function stampSharedIamTypes(sdl) {
   return Stdlib_Array.reduce(sharedIamTypeNames, sdl, (acc, name) => acc.replace(`type ` + name + ` {`, `type ` + name + ` @aws_cognito_user_pools @aws_iam {`));
 }
 
+function stampUndirectivedFields(fragment) {
+  let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
+  let stamp = field => {
+    if (field.includes("@aws_")) {
+      return field;
+    } else {
+      return field + `\n    ` + cognitoOpenDirective;
+    }
+  };
+  return GraphQL_Stitcher$ReventlessCore.encode({
+    types: parts.types,
+    mutations: parts.mutations.map(stamp),
+    queries: parts.queries.map(stamp),
+    subscriptions: parts.subscriptions.map(stamp),
+    subscriptionSources: parts.subscriptionSources
+  });
+}
+
 function stampAllTypesCognito(sdl) {
   return sdl.split("\n").map(line => {
     if (!(line.startsWith("type ") && !line.includes("@aws_"))) {
@@ -147,6 +165,7 @@ export {
   injectAwsAuthAll,
   sharedIamTypeNames,
   stampSharedIamTypes,
+  stampUndirectivedFields,
   stampAllTypesCognito,
   canonicalTypeNames,
   stampCanonicalTypes,

package/tests/AppSync_SdlDecorateTest.res

@@ -188,3 +188,64 @@ describe("AppSync_SdlDecorate.stampAllTypesCognito", () => {
     expect(AppSync_SdlDecorate.stampAllTypesCognito(once))->toBe(once)
   })
 })
+
+// ── Final field sweep ───────────────────────────────────────────────────────
+//
+// `injectAwsAuth` only decorates fields it can pair with a schema entry. Several
+// surfaces never reach it: the domain base (`Platform_ping`), event-history
+// queries, `…_eventAppended` subscriptions, upload mutations,
+// `Platform_SetActiveRole`, `geocode`. A deployed-SDL count after the first
+// sweep found 11 such fields still bare on the domain API. This pass is the net.
+
+describe("AppSync_SdlDecorate.stampUndirectivedFields", () => {
+  let frag = (~mutations=[], ~queries=[], ~subscriptions=[], ()) =>
+    ReventlessCore.GraphQL_Stitcher.encode({
+      types: [],
+      mutations,
+      queries,
+      subscriptions,
+      subscriptionSources: [],
+    })
+
+  testSync("stamps a query no schema entry ever paired with", () => {
+    let out = AppSync_SdlDecorate.stampUndirectivedFields(
+      frag(~queries=["  Platform_ping: String"], ()),
+    )
+    let q = ReventlessCore.GraphQL_Stitcher.decode(out).queries->Array.getUnsafe(0)
+    expect(q)->toContain("@aws_cognito_user_pools")
+    expect(q)->not_->toContain("cognito_groups")
+  })
+
+  testSync("stamps an event-log subscription", () => {
+    let out = AppSync_SdlDecorate.stampUndirectivedFields(
+      frag(~subscriptions=["  onFoo_eventAppended: FooEvent"], ()),
+    )
+    expect(
+      ReventlessCore.GraphQL_Stitcher.decode(out).subscriptions->Array.getUnsafe(0),
+    )->toContain("@aws_cognito_user_pools")
+  })
+
+  testSync("leaves an already-gated field untouched, group and all", () => {
+    let gated = `  Secret_Read: String\n    @aws_cognito_user_pools(cognito_groups: ["Admin"])`
+    let out = AppSync_SdlDecorate.stampUndirectivedFields(frag(~queries=[gated], ()))
+    let q = ReventlessCore.GraphQL_Stitcher.decode(out).queries->Array.getUnsafe(0)
+    expect(q)->toContain(`cognito_groups: ["Admin"]`)
+    expect(q->String.includes("@aws_cognito_user_pools @aws_cognito_user_pools"))->toBe(false)
+  })
+
+  testSync("does not strip an @aws_iam arm", () => {
+    let dual = "  Sys_Sync: String\n    @aws_cognito_user_pools @aws_iam"
+    let out = AppSync_SdlDecorate.stampUndirectivedFields(frag(~mutations=[dual], ()))
+    expect(
+      ReventlessCore.GraphQL_Stitcher.decode(out).mutations->Array.getUnsafe(0),
+    )->toContain("@aws_iam")
+  })
+
+  testSync("is idempotent", () => {
+    let once = AppSync_SdlDecorate.stampUndirectivedFields(frag(~queries=["  a: String"], ()))
+    let twice = AppSync_SdlDecorate.stampUndirectivedFields(once)
+    expect(ReventlessCore.GraphQL_Stitcher.decode(twice).queries->Array.getUnsafe(0))->toBe(
+      ReventlessCore.GraphQL_Stitcher.decode(once).queries->Array.getUnsafe(0),
+    )
+  })
+})

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -152,6 +152,46 @@ globalThis.describe("AppSync_SdlDecorate.stampAllTypesCognito", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.stampUndirectivedFields", () => {
+  let frag = (mutationsOpt, queriesOpt, subscriptionsOpt, param) => {
+    let mutations = mutationsOpt !== undefined ? mutationsOpt : [];
+    let queries = queriesOpt !== undefined ? queriesOpt : [];
+    let subscriptions = subscriptionsOpt !== undefined ? subscriptionsOpt : [];
+    return GraphQL_Stitcher$ReventlessCore.encode({
+      types: [],
+      mutations: mutations,
+      queries: queries,
+      subscriptions: subscriptions,
+      subscriptionSources: []
+    });
+  };
+  globalThis.test("stamps a query no schema entry ever paired with", () => {
+    let out = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(undefined, ["  Platform_ping: String"], undefined, undefined));
+    let q = GraphQL_Stitcher$ReventlessCore.decode(out).queries[0];
+    globalThis.expect(q).toContain("@aws_cognito_user_pools");
+    globalThis.expect(q).not.toContain("cognito_groups");
+  });
+  globalThis.test("stamps an event-log subscription", () => {
+    let out = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(undefined, undefined, ["  onFoo_eventAppended: FooEvent"], undefined));
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(out).subscriptions[0]).toContain("@aws_cognito_user_pools");
+  });
+  globalThis.test("leaves an already-gated field untouched, group and all", () => {
+    let out = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(undefined, [`  Secret_Read: String\n    @aws_cognito_user_pools(cognito_groups: ["Admin"])`], undefined, undefined));
+    let q = GraphQL_Stitcher$ReventlessCore.decode(out).queries[0];
+    globalThis.expect(q).toContain(`cognito_groups: ["Admin"]`);
+    globalThis.expect(q.includes("@aws_cognito_user_pools @aws_cognito_user_pools")).toBe(false);
+  });
+  globalThis.test("does not strip an @aws_iam arm", () => {
+    let out = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(["  Sys_Sync: String\n    @aws_cognito_user_pools @aws_iam"], undefined, undefined, undefined));
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(out).mutations[0]).toContain("@aws_iam");
+  });
+  globalThis.test("is idempotent", () => {
+    let once = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(frag(undefined, ["  a: String"], undefined, undefined));
+    let twice = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(once);
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(twice).queries[0]).toBe(GraphQL_Stitcher$ReventlessCore.decode(once).queries[0]);
+  });
+});
+
 export {
   sources,
   stitchedSdl,