@reventlessdev/reventless-aws 3.0.0-alpha.297 → 3.0.0-alpha.298

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.298 (2026-08-14)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
 # 3.0.0-alpha.297 (2026-08-14)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.297",
+  "version": "3.0.0-alpha.298",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -17,9 +17,9 @@
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.6",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.113",

package/src/Platform.res

@@ -335,7 +335,7 @@ module MakeWithConfig = (
           {
             userPoolId,
             ?awsRegion,
-            defaultAction: PulumiAws.AppSync.GraphQLApi.ALLOW,
+            defaultAction: PulumiAws.AppSync.GraphQLApi.DENY,
           }: PulumiAws.AppSync.GraphQLApi.userPoolConfig
         )
       })

package/src/Platform.res.mjs

@@ -220,7 +220,7 @@ function MakeWithConfig(Config) {
       let awsRegion = Stdlib_Option.orElse(param[1], getFromDefault("cognitoRegion"));
       return {
         userPoolId: userPoolId,
-        defaultAction: "ALLOW",
+        defaultAction: "DENY",
         awsRegion: awsRegion
       };
     });
@@ -1523,7 +1523,7 @@ function Make($star) {
       let awsRegion = Stdlib_Option.orElse(param[1], getFromDefault("cognitoRegion"));
       return {
         userPoolId: userPoolId,
-        defaultAction: "ALLOW",
+        defaultAction: "DENY",
         awsRegion: awsRegion
       };
     });

package/src/components/Api/AppSync_Adapter.res

@@ -533,6 +533,17 @@ let _makeApiResourceWith = (
   // Auth_Cognito (cached inside Platform_Stack, so calling from each API call
   // site — DomainApi, PlatformApi — is safe). A single Output yielding the
   // {userPoolId, awsRegion, defaultAction} record AppSync expects.
+  //
+  // `DENY`, not `ALLOW`: an undirectived field or type is refused rather than
+  // served to any authenticated Cognito caller. This is what makes a missing
+  // directive fail closed — under `ALLOW` the group gate that was inert for the
+  // whole of `@aws_auth`'s life produced no symptom at all, because "no
+  // effective directive" and "open to everyone" were the same thing.
+  //
+  // Safe only because every field and type now carries an explicit directive
+  // (`stampUndirectivedFields` + `stampAllTypesCognito` at the assembly choke
+  // point). Verify with `scripts/check-appsync-directive-coverage.mjs` against a
+  // DEPLOYED api — it must report zero before this value is trusted.
   let userPoolConfigOut = switch userPoolConfig {
   | Some(config) => config
   | None =>
@@ -541,7 +552,7 @@ let _makeApiResourceWith = (
         {
           userPoolId: c.userPoolId,
           awsRegion: c.region,
-          defaultAction: AppSync.GraphQLApi.ALLOW,
+          defaultAction: AppSync.GraphQLApi.DENY,
         }: AppSync.GraphQLApi.userPoolConfig
       )
     )

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -288,7 +288,7 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   };
   let userPoolConfigOut = userPoolConfig !== undefined ? userPoolConfig : Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined).apply(c => ({
       userPoolId: c.userPoolId,
-      defaultAction: "ALLOW",
+      defaultAction: "DENY",
       awsRegion: c.region
     }));
   let apiArgs_schema = Stdlib_Option.map(schema, prim => prim);

package/src/components/Api/AppSync_MergedApi.res

@@ -100,7 +100,7 @@ let make = (~name: string, ~opts: Pulumi.ComponentResource.options): t => {
     ): AppSync.GraphQLApi.userPoolConfig => {
       userPoolId: c.userPoolId,
       awsRegion: c.region,
-      defaultAction: AppSync.GraphQLApi.ALLOW,
+      defaultAction: AppSync.GraphQLApi.DENY,
     })
 
   let mergedApi = AppSync.GraphQLApi.make(

package/src/components/Api/AppSync_MergedApi.res.mjs

@@ -55,7 +55,7 @@ function make(name, opts) {
   let authConfigOut = Auth_Cognito$ReventlessAws.make(name + `-auth`, undefined);
   let userPoolConfigOut = authConfigOut.apply(c => ({
     userPoolId: c.userPoolId,
-    defaultAction: "ALLOW",
+    defaultAction: "DENY",
     awsRegion: c.region
   }));
   let mergedApi = new (Aws.appsync.GraphQLApi)(name, {