@reventlessdev/reventless-aws 3.0.0-alpha.297 → 3.0.0-alpha.299

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.299 (2026-08-14)
+
+### Features
+
+* **aws:** refuse to push an AppSync schema that cannot be gated ([18e9279](https://github.com/ReventlessDev/reventless-core/commit/18e92793b1b42b4b94dc61e9e285918c67e62e8a))
+
+
+# 3.0.0-alpha.298 (2026-08-14)
+
+**Note:** Version bump only for package @reventlessdev/reventless-aws
+
+
+
+
+
 # 3.0.0-alpha.297 (2026-08-14)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.297",
+  "version": "3.0.0-alpha.299",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.6",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.113",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.31"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.113"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/components/Api/AppSync_Adapter.res

@@ -470,6 +470,13 @@ let stitchStandaloneWithAwsDirectives = (
   // Last: every remaining undirectived type takes the group-less Cognito arm.
   // After stampSharedIamTypes so the shared traversal types keep `@aws_iam`.
   ->AppSync_SdlDecorate.stampAllTypesCognito
+  // Fields the stitcher injects during assembly (`_noop`) are invisible to the
+  // fragment sweep above, so sweep the assembled document too.
+  ->AppSync_SdlDecorate.stampUndirectivedRootFields
+  // Then refuse to hand back a schema that cannot be gated. `defaultAction: DENY`
+  // is unavailable on a multi-auth API, so this deploy-time check is the only
+  // fail-closed step there is — everything downstream trusts what it returns.
+  ->AppSync_SdlDecorate.assertGateable
 }
 
 // ── Provider implementation ────────────────────────────────────────────────
@@ -533,6 +540,22 @@ let _makeApiResourceWith = (
   // Auth_Cognito (cached inside Platform_Stack, so calling from each API call
   // site — DomainApi, PlatformApi — is safe). A single Output yielding the
   // {userPoolId, awsRegion, defaultAction} record AppSync expects.
+  //
+  // `ALLOW` is forced, not chosen. `DENY` would make a missing directive fail
+  // closed, which is what we want — but AWS refuses the combination outright:
+  //
+  //   BadRequestException: Additional authentication providers cannot be
+  //   specified when setting DENY for top level user pool authentication type.
+  //
+  // Every API here configures AWS_IAM as an additional provider (the
+  // server-to-server lambdas need it), so DENY is unavailable for as long as
+  // that is true. Tried on a deploy 2026-08-14; all four APIs rejected it.
+  //
+  // The protection therefore rests entirely on every field and type carrying an
+  // explicit directive — `stampUndirectivedFields` + `stampAllTypesCognito` at
+  // the assembly choke point — with no backstop underneath. That makes
+  // `scripts/check-appsync-directive-coverage.mjs` load-bearing rather than
+  // advisory: run it against a DEPLOYED api after any change to the decoration.
   let userPoolConfigOut = switch userPoolConfig {
   | Some(config) => config
   | None =>

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -265,7 +265,7 @@ function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
 function stitchStandaloneWithAwsDirectives(fragment) {
   let sources = GraphQL_Stitcher$ReventlessCore.collectSubscriptionSources(fragment, []);
   let fragment$1 = AppSync_SdlDecorate$ReventlessAws.stampUndirectivedFields(fragment);
-  return AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment$1), sources)));
+  return AppSync_SdlDecorate$ReventlessAws.assertGateable(AppSync_SdlDecorate$ReventlessAws.stampUndirectivedRootFields(AppSync_SdlDecorate$ReventlessAws.stampAllTypesCognito(AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes(AppSync_SdlDecorate$ReventlessAws.injectAwsSubscribe(GraphQL_Stitcher$ReventlessCore.stitchStandalone(fragment$1), sources)))));
 }
 
 function _makeApiResourceWith(name, schema, userPoolConfig, opts) {

package/src/components/Api/AppSync_SdlDecorate.res

@@ -93,10 +93,10 @@ let formatCognitoGroupsDirective = (groups: array<string>): string => {
 //
 // Under `userPoolConfig.defaultAction: ALLOW` this is a no-op: an undirectived
 // field is already reachable by any authenticated caller, so stamping it changes
-// nothing. It exists so the default can be flipped to DENY, where "no directive"
-// stops meaning "open" and starts meaning "refused" — at which point anything
-// left unstamped breaks. Stamping first and flipping second is what keeps that
-// flip from being a guess.
+// nothing. It exists so that "carries no directive" becomes a state we can
+// detect and refuse at deploy time (`assertGateable`), rather than one that
+// silently means "open to everyone" — which is exactly how the `@aws_auth`
+// outage stayed invisible for as long as it did.
 let cognitoOpenDirective = "@aws_cognito_user_pools"
 
 // Multi-auth directive for a field/type that must accept BOTH Cognito and IAM.
@@ -171,9 +171,12 @@ let stampSharedIamTypes = (sdl: string): string =>
 // several surfaces never reach it at all: the domain base document
 // (`Platform_ping`), event-history queries, event-log `…_eventAppended`
 // subscriptions, the upload presign/release mutations, `Platform_SetActiveRole`,
-// and `geocode`. Those deployed with no directive — invisible under
-// `defaultAction: ALLOW`, refused under DENY. Sweeping here rather than at each
-// emission site means a future injected field cannot silently miss the net.
+// and `geocode`. Those deployed with no directive at all — reachable by any
+// authenticated Cognito caller, and invisible, since `defaultAction: ALLOW` makes
+// "no directive" and "open" the same thing. Sweeping here rather than at each
+// emission site means a future injected field cannot silently miss the net;
+// `assertGateable` below turns a miss into a failed deploy rather than an open
+// field.
 //
 // Idempotent, and deliberately does not second-guess gating: it only fills in
 // "open to any authenticated Cognito caller", which is what an undirectived
@@ -198,11 +201,10 @@ let stampUndirectivedFields = (
 // stampSharedIamTypes so the shared traversal types keep their `@aws_iam` arm
 // (this pass skips anything already carrying an `@aws_` directive).
 //
-// Types, not just fields: on a multi-auth API with `defaultAction: DENY`,
-// AppSync refuses an undirectived TYPE even when the caller passed the field's
-// own gate — response shaping walks `…Connection` → `…Edge` → node → nested
-// state types and dies one level in. Entry gating stays on the fields; a type
-// stamp only restores the accessibility an undirectived type has today.
+// Types, not just fields: response shaping walks `…Connection` → `…Edge` → node
+// → nested state types, so a type that cannot be traversed fails a request that
+// passed the field's own gate. Entry gating stays on the fields; a type stamp
+// only restores the accessibility an undirectived type has today.
 //
 // Only `type` declarations take auth directives — `input`, `enum`, `union` and
 // `interface` do not, and stamping them is a schema error.
@@ -225,6 +227,202 @@ let stampAllTypesCognito = (sdl: string): string =>
   )
   ->Array.join("\n")
 
+// ── Deploy-time gate invariant ──────────────────────────────────────────────
+//
+// Refuse to push a schema that cannot be gated. This is the fail-closed
+// property `userPoolConfig.defaultAction: DENY` would have provided at REQUEST
+// time — AWS rejects DENY alongside an additional auth provider
+// ("Additional authentication providers cannot be specified when setting DENY
+// for top level user pool authentication type", reproduced on create and
+// update alike), and every API here configures AWS_IAM unconditionally. So the
+// check moves one layer earlier, into our own deploy, where nothing can veto it.
+//
+// Two conditions, and the second is the one that matters:
+//
+//   1. A root field or object type carrying NO directive AppSync honours here
+//      is reachable by any authenticated Cognito caller under `ALLOW`.
+//   2. ANY `@aws_auth` at all. It is the single-mode form, silently ignored on
+//      a multi-auth API — so its presence means something believes it is gated
+//      and is not.
+//
+// Condition 2 is why this is not merely "does it have a directive?". The
+// original outage had `@aws_auth(cognito_groups: ["Admin"])` present on all 18
+// admin fields for its entire life; a presence check would have passed it every
+// single time. Only a check that knows WHICH directive the service honours
+// would have failed that deploy.
+let enforcedDirectives = ["@aws_cognito_user_pools", "@aws_iam"]
+
+let hasEnforcedDirective = (s: string): bool =>
+  enforcedDirectives->Array.some(d => s->String.includes(d))
+
+let rootOperationTypes = ["Query", "Mutation", "Subscription"]
+
+let typeDeclNameOf = (line: string): option<string> =>
+  if line->String.startsWith("type ") {
+    let rest = line->String.slice(~start=5, ~end=line->String.length)
+    switch rest->String.search(%re("/[\s{]/")) {
+    | -1 => Some(rest)
+    | i => Some(rest->String.slice(~start=0, ~end=i))
+    }
+  } else {
+    None
+  }
+
+// A root-operation field line: exactly two spaces of indent then a name. Deeper
+// indents are directive continuations of the field above.
+let fieldNameOf = (line: string): option<string> =>
+  switch line->String.match(%re("/^ {2}(\w+)/")) {
+  | Some(groups) => groups->Array.get(1)->Option.flatMap(x => x)
+  | None => None
+  }
+
+// Field sweep on the ASSEMBLED SDL, for fields the fragment sweep cannot see
+// because the stitcher injects them during assembly — `_noop`, the placeholder
+// mutation added to keep a mutation-less schema valid, is the standing example
+// and was live on three deployed APIs.
+//
+// Groups continuation lines into field entries the way `assertGateable` does, so
+// a directive already sitting on the following line counts as present.
+let stampUndirectivedRootFields = (sdl: string): string => {
+  let out = []
+  let currentRoot = ref(None)
+  let buffer = ref([])
+
+  let flush = () => {
+    let entry = buffer.contents
+    if entry->Array.length > 0 {
+      entry->Array.forEach(l => out->Array.push(l))
+      if !hasEnforcedDirective(entry->Array.join("\n")) {
+        out->Array.push(`    ${cognitoOpenDirective}`)
+      }
+      buffer.contents = []
+    }
+  }
+
+  sdl
+  ->String.split("\n")
+  ->Array.forEach(line =>
+    switch typeDeclNameOf(line) {
+    | Some(name) =>
+      flush()
+      currentRoot.contents = rootOperationTypes->Array.includes(name) ? Some(name) : None
+      out->Array.push(line)
+    | None =>
+      if line->String.startsWith("}") {
+        flush()
+        currentRoot.contents = None
+        out->Array.push(line)
+      } else if currentRoot.contents->Option.isSome {
+        switch fieldNameOf(line) {
+        | Some(_) =>
+          flush()
+          buffer.contents = [line]
+        | None =>
+          if buffer.contents->Array.length > 0 {
+            buffer.contents = buffer.contents->Array.concat([line])
+          } else {
+            out->Array.push(line)
+          }
+        }
+      } else {
+        out->Array.push(line)
+      }
+    }
+  )
+  flush()
+  out->Array.join("\n")
+}
+
+let assertGateable = (sdl: string): string => {
+  let bareFields = []
+  let bareTypes = []
+  let inertDirectives = []
+
+  let currentRoot = ref(None)
+  // (fieldName, accumulated text incl. continuation lines)
+  let pending = ref(None)
+
+  let flush = () =>
+    switch pending.contents {
+    | Some((name, text)) =>
+      if !hasEnforcedDirective(text) {
+        bareFields->Array.push(name)
+      }
+      pending.contents = None
+    | None => ()
+    }
+
+  sdl
+  ->String.split("\n")
+  ->Array.forEach(line => {
+    if line->String.includes("@aws_auth") {
+      inertDirectives->Array.push(line->String.trim)
+    }
+    switch typeDeclNameOf(line) {
+    | Some(name) =>
+      flush()
+      if !hasEnforcedDirective(line) {
+        bareTypes->Array.push(name)
+      }
+      currentRoot.contents = rootOperationTypes->Array.includes(name) ? Some(name) : None
+    | None =>
+      if line->String.startsWith("}") {
+        flush()
+        currentRoot.contents = None
+      } else if currentRoot.contents->Option.isSome {
+        switch fieldNameOf(line) {
+        | Some(fieldName) =>
+          flush()
+          pending.contents = Some((fieldName, line))
+        | None =>
+          switch pending.contents {
+          | Some((n, text)) => pending.contents = Some((n, text ++ "\n" ++ line))
+          | None => ()
+          }
+        }
+      }
+    }
+  })
+  flush()
+
+  let problems = []
+  if inertDirectives->Array.length > 0 {
+    problems->Array.push(
+      `  ${inertDirectives->Array.length->Int.toString} field(s) carry @aws_auth, which AppSync IGNORES on a\n` ++
+      `  multi-auth API (this adapter always adds AWS_IAM as an additional provider).\n` ++
+      `  They are gated by nothing. Emit @aws_cognito_user_pools(cognito_groups: [...])\n` ++
+      `  instead — see AppSync_SdlDecorate.formatCognitoGroupsDirective.\n` ++
+      `    ${inertDirectives->Array.slice(~start=0, ~end=8)->Array.join("\n    ")}`,
+    )
+  }
+  if bareFields->Array.length > 0 {
+    problems->Array.push(
+      `  ${bareFields->Array.length->Int.toString} root field(s) carry no enforced auth directive, so they are\n` ++
+      `  reachable by ANY authenticated Cognito caller:\n` ++
+      `    ${bareFields->Array.join(", ")}`,
+    )
+  }
+  if bareTypes->Array.length > 0 {
+    problems->Array.push(
+      `  ${bareTypes->Array.length->Int.toString} object type(s) carry no enforced auth directive:\n` ++
+      `    ${bareTypes->Array.join(", ")}`,
+    )
+  }
+
+  if problems->Array.length > 0 {
+    JsError.throwWithMessage(
+      `Refusing to push an AppSync schema that cannot be gated.\n\n` ++
+      problems->Array.join("\n\n") ++
+      `\n\nEvery field and type must carry @aws_cognito_user_pools (optionally with\n` ++
+      `cognito_groups) and/or @aws_iam. The sweep in stampUndirectivedFields /\n` ++
+      `stampAllTypesCognito should have covered this — a failure here means a schema\n` ++
+      `reached assembly by a path that bypasses them.\n` ++
+      `See docs/plans/appsync-group-authorization-unenforced.md.`,
+    )
+  }
+  sdl
+}
+
 // ── Merged-API canonical stamping ─────────────────────────────────────────────
 // Under AppSync Merged APIs the admin source API owns the shared traversal
 // types; `@canonical` makes its definition win over every plugin source's copy

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -1,7 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
 
 function injectAwsSubscribe(sdl, sources) {
@@ -120,6 +122,170 @@ function stampAllTypesCognito(sdl) {
   }).join("\n");
 }
 
+let enforcedDirectives = [
+  "@aws_cognito_user_pools",
+  "@aws_iam"
+];
+
+function hasEnforcedDirective(s) {
+  return enforcedDirectives.some(d => s.includes(d));
+}
+
+let rootOperationTypes = [
+  "Query",
+  "Mutation",
+  "Subscription"
+];
+
+function typeDeclNameOf(line) {
+  if (!line.startsWith("type ")) {
+    return;
+  }
+  let rest = line.slice(5, line.length);
+  let i = rest.search(/[\s{]/);
+  if (i !== -1) {
+    return rest.slice(0, i);
+  } else {
+    return rest;
+  }
+}
+
+function fieldNameOf(line) {
+  let groups = line.match(/^ {2}(\w+)/);
+  if (!(groups == null)) {
+    return Stdlib_Option.flatMap(groups[1], x => x);
+  }
+}
+
+function stampUndirectivedRootFields(sdl) {
+  let out = [];
+  let currentRoot = {
+    contents: undefined
+  };
+  let buffer = {
+    contents: []
+  };
+  let flush = () => {
+    let entry = buffer.contents;
+    if (entry.length !== 0) {
+      entry.forEach(l => {
+        out.push(l);
+      });
+      if (!hasEnforcedDirective(entry.join("\n"))) {
+        out.push(`    ` + cognitoOpenDirective);
+      }
+      buffer.contents = [];
+      return;
+    }
+  };
+  sdl.split("\n").forEach(line => {
+    let name = typeDeclNameOf(line);
+    if (name !== undefined) {
+      flush();
+      currentRoot.contents = rootOperationTypes.includes(name) ? name : undefined;
+      out.push(line);
+      return;
+    }
+    if (line.startsWith("}")) {
+      flush();
+      currentRoot.contents = undefined;
+      out.push(line);
+      return;
+    }
+    if (Stdlib_Option.isSome(currentRoot.contents)) {
+      let match = fieldNameOf(line);
+      if (match !== undefined) {
+        flush();
+        buffer.contents = [line];
+      } else if (buffer.contents.length !== 0) {
+        buffer.contents = buffer.contents.concat([line]);
+      } else {
+        out.push(line);
+      }
+      return;
+    }
+    out.push(line);
+  });
+  flush();
+  return out.join("\n");
+}
+
+function assertGateable(sdl) {
+  let bareFields = [];
+  let bareTypes = [];
+  let inertDirectives = [];
+  let currentRoot = {
+    contents: undefined
+  };
+  let pending = {
+    contents: undefined
+  };
+  let flush = () => {
+    let match = pending.contents;
+    if (match !== undefined) {
+      if (!hasEnforcedDirective(match[1])) {
+        bareFields.push(match[0]);
+      }
+      pending.contents = undefined;
+      return;
+    }
+  };
+  sdl.split("\n").forEach(line => {
+    if (line.includes("@aws_auth")) {
+      inertDirectives.push(line.trim());
+    }
+    let name = typeDeclNameOf(line);
+    if (name !== undefined) {
+      flush();
+      if (!hasEnforcedDirective(line)) {
+        bareTypes.push(name);
+      }
+      currentRoot.contents = rootOperationTypes.includes(name) ? name : undefined;
+      return;
+    }
+    if (line.startsWith("}")) {
+      flush();
+      currentRoot.contents = undefined;
+      return;
+    }
+    if (!Stdlib_Option.isSome(currentRoot.contents)) {
+      return;
+    }
+    let fieldName = fieldNameOf(line);
+    if (fieldName !== undefined) {
+      flush();
+      pending.contents = [
+        fieldName,
+        line
+      ];
+      return;
+    }
+    let match = pending.contents;
+    if (match !== undefined) {
+      pending.contents = [
+        match[0],
+        match[1] + "\n" + line
+      ];
+      return;
+    }
+  });
+  flush();
+  let problems = [];
+  if (inertDirectives.length !== 0) {
+    problems.push(`  ` + inertDirectives.length.toString() + ` field(s) carry @aws_auth, which AppSync IGNORES on a\n  multi-auth API (this adapter always adds AWS_IAM as an additional provider).\n  They are gated by nothing. Emit @aws_cognito_user_pools(cognito_groups: [...])\n  instead — see AppSync_SdlDecorate.formatCognitoGroupsDirective.\n    ` + inertDirectives.slice(0, 8).join("\n    "));
+  }
+  if (bareFields.length !== 0) {
+    problems.push(`  ` + bareFields.length.toString() + ` root field(s) carry no enforced auth directive, so they are\n  reachable by ANY authenticated Cognito caller:\n    ` + bareFields.join(", "));
+  }
+  if (bareTypes.length !== 0) {
+    problems.push(`  ` + bareTypes.length.toString() + ` object type(s) carry no enforced auth directive:\n    ` + bareTypes.join(", "));
+  }
+  if (problems.length !== 0) {
+    Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot be gated.\n\n` + problems.join("\n\n") + `\n\nEvery field and type must carry @aws_cognito_user_pools (optionally with\ncognito_groups) and/or @aws_iam. The sweep in stampUndirectivedFields /\nstampAllTypesCognito should have covered this — a failure here means a schema\nreached assembly by a path that bypasses them.\nSee docs/plans/appsync-group-authorization-unenforced.md.`);
+  }
+  return sdl;
+}
+
 let canonicalTypeNames = [
   "PageInfo",
   "CommandAccepted",
@@ -167,6 +333,13 @@ export {
   stampSharedIamTypes,
   stampUndirectivedFields,
   stampAllTypesCognito,
+  enforcedDirectives,
+  hasEnforcedDirective,
+  rootOperationTypes,
+  typeDeclNameOf,
+  fieldNameOf,
+  stampUndirectivedRootFields,
+  assertGateable,
   canonicalTypeNames,
   stampCanonicalTypes,
 }

package/tests/AppSync_SdlDecorateTest.res

@@ -249,3 +249,58 @@ describe("AppSync_SdlDecorate.stampUndirectivedFields", () => {
     )
   })
 })
+
+// ── Deploy-time gate invariant ──────────────────────────────────────────────
+//
+// `defaultAction: DENY` — the request-time fail-closed switch — is unavailable:
+// AWS refuses it alongside an additional auth provider, and every API here has
+// AWS_IAM. So this check moves fail-closed into the deploy, where nothing can
+// veto it: a schema that cannot be gated is never pushed.
+
+describe("AppSync_SdlDecorate.assertGateable", () => {
+  let refuses = (sdl: string): bool =>
+    switch AppSync_SdlDecorate.assertGateable(sdl) {
+    | _ => false
+    | exception _ => true
+    }
+
+  // The original outage, exactly. A "does it have a directive?" check passes
+  // this — @aws_auth was present on all 18 admin fields the whole time it was
+  // inert. Only knowing WHICH directive the service honours catches it.
+  testSync("refuses @aws_auth, the directive AppSync ignores here", () => {
+    let sdl = `type Query @aws_cognito_user_pools {\n  Admin_Thing: String @aws_auth(cognito_groups: ["Admin"])\n}`
+    expect(refuses(sdl))->toBe(true)
+  })
+
+  testSync("refuses a root field carrying no enforced directive", () => {
+    expect(refuses("type Query @aws_cognito_user_pools {\n  Platform_ping: String\n}"))->toBe(true)
+  })
+
+  testSync("refuses an object type carrying no enforced directive", () => {
+    let sdl =
+      "type Query @aws_cognito_user_pools {\n  a: String @aws_cognito_user_pools\n}\ntype Product {\n  id: ID!\n}"
+    expect(refuses(sdl))->toBe(true)
+  })
+
+  // Our real emission shape puts a mutation's directive on the FOLLOWING line.
+  testSync("accepts a directive on the line after the field", () => {
+    let sdl = "type Query @aws_cognito_user_pools {\n  Platform_ping: String\n    @aws_cognito_user_pools\n}"
+    expect(refuses(sdl))->toBe(false)
+  })
+
+  testSync("accepts a group-gated field and an @aws_iam-only field", () => {
+    let sdl =
+      `type Mutation @aws_cognito_user_pools {\n  Gated: String\n    @aws_cognito_user_pools(cognito_groups: ["Admin"])\n  Sys: String\n    @aws_cognito_user_pools @aws_iam\n}`
+    expect(refuses(sdl))->toBe(false)
+  })
+
+  // The whole pipeline must satisfy its own invariant on the real admin base.
+  testSync("the assembled admin base passes", () => {
+    let decorated = AppSync_Adapter.injectAwsAuthAll(
+      ReventlessCore.Platform_AdminApi.baseFragment(~cloner=true),
+      ~group="Admin",
+    )
+    let sdl = AppSync_Adapter.stitchStandaloneWithAwsDirectives(~fragment=decorated)
+    expect(sdl->String.includes("@aws_cognito_user_pools"))->toBe(true)
+  })
+})

package/tests/AppSync_SdlDecorateTest.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AppSync_Adapter$ReventlessAws from "../src/components/Api/AppSync_Adapter.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "../src/components/Api/AppSync_SdlDecorate.res.mjs";
 
 let sources = [
@@ -192,6 +193,37 @@ globalThis.describe("AppSync_SdlDecorate.stampUndirectivedFields", () => {
   });
 });
 
+globalThis.describe("AppSync_SdlDecorate.assertGateable", () => {
+  let refuses = sdl => {
+    try {
+      AppSync_SdlDecorate$ReventlessAws.assertGateable(sdl);
+      return false;
+    } catch (exn) {
+      return true;
+    }
+  };
+  globalThis.test("refuses @aws_auth, the directive AppSync ignores here", () => {
+    globalThis.expect(refuses(`type Query @aws_cognito_user_pools {\n  Admin_Thing: String @aws_auth(cognito_groups: ["Admin"])\n}`)).toBe(true);
+  });
+  globalThis.test("refuses a root field carrying no enforced directive", () => {
+    globalThis.expect(refuses("type Query @aws_cognito_user_pools {\n  Platform_ping: String\n}")).toBe(true);
+  });
+  globalThis.test("refuses an object type carrying no enforced directive", () => {
+    globalThis.expect(refuses("type Query @aws_cognito_user_pools {\n  a: String @aws_cognito_user_pools\n}\ntype Product {\n  id: ID!\n}")).toBe(true);
+  });
+  globalThis.test("accepts a directive on the line after the field", () => {
+    globalThis.expect(refuses("type Query @aws_cognito_user_pools {\n  Platform_ping: String\n    @aws_cognito_user_pools\n}")).toBe(false);
+  });
+  globalThis.test("accepts a group-gated field and an @aws_iam-only field", () => {
+    globalThis.expect(refuses(`type Mutation @aws_cognito_user_pools {\n  Gated: String\n    @aws_cognito_user_pools(cognito_groups: ["Admin"])\n  Sys: String\n    @aws_cognito_user_pools @aws_iam\n}`)).toBe(false);
+  });
+  globalThis.test("the assembled admin base passes", () => {
+    let decorated = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(true), "Admin", undefined);
+    let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(decorated);
+    globalThis.expect(sdl.includes("@aws_cognito_user_pools")).toBe(true);
+  });
+});
+
 export {
   sources,
   stitchedSdl,