@reventlessdev/reventless-aws 3.0.0-alpha.299 → 3.0.0-alpha.301

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.301 (2026-08-15)
+
+### Bug Fixes
+
+* **aws:** ask Cognito about a caller by the name it knows them by ([265f436](https://github.com/ReventlessDev/reventless-core/commit/265f4361f9695a12d1dcc055b256ec72174d428e))
+### Features
+
+* **core:** curate the pages a shell builds across a plugin's views ([589835a](https://github.com/ReventlessDev/reventless-core/commit/589835a1ad428c5e2dea8bf6e4c64e49d2f67e0d))
+
+
+# 3.0.0-alpha.300 (2026-08-14)
+
+### Features
+
+* **core:** one contract for which refusal a platform gave ([7705c13](https://github.com/ReventlessDev/reventless-core/commit/7705c13ec63f41a3a659bc98cfb45b880fd5b222))
+
+
 # 3.0.0-alpha.299 (2026-08-14)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.299",
+  "version": "3.0.0-alpha.301",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,18 +12,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.11",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.10",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.7",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.6",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.75",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.76",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.235",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.113"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.99",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.114",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.142"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -153,6 +153,7 @@ let make = (
         )
       strings("views", sel.views)
       strings("commands", sel.commands)
+      strings("derived", sel.derived)
       entry->JSON.Encode.object
     })
     ->JSON.Encode.array

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -87,9 +87,10 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
       });
       strings("views", sel.views);
       strings("commands", sel.commands);
+      strings("derived", sel.derived);
       return entry;
     })) : "";
-  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, Platform_Admin_Structure$ReventlessCore.structure));
+  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res

@@ -304,6 +304,7 @@ let bakeSelection = (json: JSON.t): option<ReventlessCore.Platform_BakedManifest
       ReventlessCore.Platform_BakedManifest.plugin,
       views: strings(o, "views"),
       commands: strings(o, "commands"),
+      derived: strings(o, "derived"),
     })
   )
 }

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda_Ops.res.mjs

@@ -263,7 +263,8 @@ function bakeSelection(json) {
   return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => Stdlib_Option.map(Stdlib_Option.flatMap(o["plugin"], Stdlib_JSON.Decode.string), plugin => ({
     plugin: plugin,
     views: strings(o, "views"),
-    commands: strings(o, "commands")
+    commands: strings(o, "commands"),
+    derived: strings(o, "derived")
   })));
 }
 

package/src/adapter/Auth/Auth_ActiveRoleStore.res

@@ -40,6 +40,15 @@ type storeTable = {
 // JS resolver code (APPSYNC_JS runtime): forward the caller's arguments and the
 // authorizer-verified identity. `sub` is what keys the row, and it comes from
 // here — the mutation has no `sub` argument for a client to supply.
+//
+// `username` travels with it because the two answer different questions. The row
+// is keyed on `sub`, which is stable across a rename and is what the pre-token
+// trigger looks the row up by; but Cognito's admin API addresses a user by
+// *username*, and a pool with neither `UsernameAttributes` nor `AliasAttributes`
+// does not accept a `sub` there — it answers `UserNotFoundException`, which is
+// how the membership read used to fail for every caller on such a pool. Both
+// fields come from the authorizer, so forwarding the second grants nothing the
+// first did not.
 let invokeCode: Pulumi.Input.t<string> = `import { util } from '@aws-appsync/utils';
 export function request(ctx) {
   const id = ctx.identity;
@@ -47,7 +56,7 @@ export function request(ctx) {
     operation: 'Invoke',
     payload: {
       arguments: ctx.args,
-      identity: id != null && id.sub != null ? { sub: id.sub } : null
+      identity: id != null && id.sub != null ? { sub: id.sub, username: id.username ?? null } : null
     }
   };
 }

package/src/adapter/Auth/Auth_ActiveRoleStore.res.mjs

@@ -22,7 +22,7 @@ export function request(ctx) {
     operation: 'Invoke',
     payload: {
       arguments: ctx.args,
-      identity: id != null && id.sub != null ? { sub: id.sub } : null
+      identity: id != null && id.sub != null ? { sub: id.sub, username: id.username ?? null } : null
     }
   };
 }

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res

@@ -50,16 +50,25 @@ token they hold no longer mentions the role they are asking for. This is the sam
 trap the local path documents on `LocalAuth.Login.reissue`, where membership is
 re-read from the user store rather than from the token's own record of it.
 
+🚨 **Addressed by username, not by `sub`.** `AdminListGroupsForUser` takes a
+`Username`, and a `sub` is only accepted there when the pool makes it one — a
+pool with `UsernameAttributes` (email or phone sign-in), where the generated
+username *is* the subject. On a plain username pool the same call answers
+`UserNotFoundException: User does not exist.`, which fails the whole mutation
+before it reaches the subset check: not "you may not act as that role" but "you
+do not exist", for a caller who is signed in and holds the role. The row is still
+keyed on `sub` — this parameter names the user to Cognito, nothing else.
+
 Paginated deliberately: `AdminListGroupsForUser` caps a page at 60 groups, and a
 truncated read would silently refuse a role the caller genuinely holds.
 */
-let membershipOf = async (~sub: string, ~poolId: string): array<string> => {
+let membershipOf = async (~username: string, ~poolId: string): array<string> => {
   let collected = []
   let nextToken = ref(None)
   let more = ref(true)
   while more.contents {
     let page = await CognitoIdentityServiceProvider.AdminListGroupsForUserCommand.make({
-      username: sub,
+      username,
       userPoolId: poolId,
       nextToken: ?nextToken.contents,
     })->CognitoIdentityServiceProvider.AdminListGroupsForUserCommand.send
@@ -89,13 +98,33 @@ let mayActAs = (~membership: array<string>, ~requested: string): bool =>
 
 // ── AppSync resolver event / result shapes ──────────────────────────────────
 
-type identity = {sub?: string}
+type identity = {sub?: string, username?: Nullable.t<string>}
 type activeRoleArgs = {activeRole?: Nullable.t<string>}
 type appSyncEvent = {
   arguments?: activeRoleArgs,
   identity?: identity,
 }
 
+/**
+The name to address this caller by when asking Cognito what groups they are in.
+
+The username when the authorizer supplied one, the subject otherwise. The
+fallback is not a guess at a username: it is the behaviour this handler had
+before the username was forwarded, kept for the pool shapes where it is correct —
+one whose username *is* the subject — rather than turning a working deployment
+into a hard failure on an absent field. Pure so the choice can be tested without
+a pool.
+*/
+let cognitoLookupName = (~identity: identity): option<string> =>
+  switch identity.username {
+  | Some(Value(name)) if name->String.trim != "" => Some(name)
+  | _ =>
+    switch identity.sub {
+    | Some("") | None => None
+    | Some(sub) => Some(sub)
+    }
+  }
+
 let result = (~activeRole: option<string>, ~availableRoles: array<string>): JSON.t =>
   Dict.fromArray([
     ("activeRole", activeRole->Option.mapOr(JSON.Null, JSON.Encode.string)),
@@ -111,8 +140,14 @@ let handler = async (event: appSyncEvent): JSON.t => {
     // unauthenticated path from ever writing a row keyed on the empty subject.
     JsError.throwWithMessage("unauthenticated")
   }
+  // Two names for one caller, and they are not interchangeable: `sub` keys the
+  // row, the lookup name addresses Cognito. See `membershipOf`.
+  let lookupName = switch event.identity->Option.flatMap(i => cognitoLookupName(~identity=i)) {
+  | Some(name) => name
+  | None => JsError.throwWithMessage("unauthenticated")
+  }
   let table = tableName()
-  let membership = await membershipOf(~sub, ~poolId=userPoolId())
+  let membership = await membershipOf(~username=lookupName, ~poolId=userPoolId())
 
   // An absent argument and an explicit `null` mean the same thing — clear the
   // preference and go back to full membership on the next refresh. That is not an

package/src/adapter/Auth/Auth_ActiveRoleStore_Ops.res.mjs

@@ -33,13 +33,13 @@ function userPoolId() {
   }
 }
 
-async function membershipOf(sub, poolId) {
+async function membershipOf(username, poolId) {
   let collected = [];
   let nextToken;
   let more = true;
   while (more) {
     let page = await CognitoIdentityServiceProvider$AwsSdk.AdminListGroupsForUserCommand.send(new ClientCognitoIdentityProvider.AdminListGroupsForUserCommand({
-      Username: sub,
+      Username: username,
       UserPoolId: poolId,
       NextToken: nextToken
     }));
@@ -60,6 +60,22 @@ function mayActAs(membership, requested) {
   return membership.includes(requested);
 }
 
+function cognitoLookupName(identity) {
+  let match = identity.username;
+  if (match !== undefined) {
+    let name = Primitive_option.valFromOption(match);
+    if (name == null) {
+      name === null;
+    } else if (name.trim() !== "") {
+      return name;
+    }
+  }
+  let sub = identity.sub;
+  if (sub !== undefined && sub !== "") {
+    return sub;
+  }
+}
+
 function result(activeRole, availableRoles) {
   return Object.fromEntries([
     [
@@ -78,8 +94,10 @@ async function handler(event) {
   if (sub === "") {
     Stdlib_JsError.throwWithMessage("unauthenticated");
   }
+  let name = Stdlib_Option.flatMap(event.identity, cognitoLookupName);
+  let lookupName = name !== undefined ? name : Stdlib_JsError.throwWithMessage("unauthenticated");
   let table = tableName();
-  let membership = await membershipOf(sub, userPoolId());
+  let membership = await membershipOf(lookupName, userPoolId());
   let match = Stdlib_Option.flatMap(event.arguments, a => a.activeRole);
   let requested;
   if (match !== undefined) {
@@ -122,6 +140,7 @@ export {
   userPoolId,
   membershipOf,
   mayActAs,
+  cognitoLookupName,
   result,
   handler,
 }

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -68,7 +68,7 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
   ~subIdField,
   ~idResolverConfigs: array<idResolverConfig>,
   ~idsResolverConfigs: array<idsResolverConfig>,
-  // AWS path enforces authorization via `@aws_auth(cognito_groups: …)` on the
+  // AWS path enforces authorization via `@aws_cognito_user_pools(cognito_groups: …)` on the
   // SDL fields (see Stage E in docs/plans/host-ui-login-core.md). Accepted but
   // ignored here so the in-memory and AWS resolver maker signatures stay aligned.
   ~authorization as _: Reventless.Authorization.permission,

package/src/components/Api/AppSync_Adapter.res

@@ -185,10 +185,13 @@ let rec waitForMergeSuccess = async (
 // When both are present on the same field, the spec-level permission wins
 // (it is more specific). `AllowGroups([g1, g2, ...])` emits
 // `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
-// `AllowAuthenticated` / `AllowAnonymous` emit no directive (with Cognito as
-// primary auth, any reaching request is already authenticated). `AllowGroups([])`
-// and `DenyAll` emit a sentinel `__deny_all__` group that no Cognito user can
-// belong to — effectively blocking the field at the API layer.
+// `AllowAuthenticated` / `AllowAnonymous` emit the group-less
+// `@aws_cognito_user_pools` — same reachability (with Cognito as primary auth
+// any reaching request is already authenticated), but stated rather than left
+// implicit, so `assertGateable` can tell "deliberately open" from "nobody
+// stamped this". `AllowGroups([])` and `DenyAll` emit a sentinel `__deny_all__`
+// group that no Cognito user can belong to — effectively blocking the field at
+// the API layer.
 //
 // NOT `@aws_auth(...)`: that is the single-mode form, which AppSync ignores on a
 // multi-auth API — which every API this adapter provisions is. See
@@ -422,14 +425,14 @@ let injectAwsAuth = (
   })
 }
 
-// Injects @aws_auth with the given group on ALL mutation, query, and subscription
+// Injects the Cognito group directive on ALL mutation, query, and subscription
 // fields in a fragment. Used for the base fragment where all fields share the
 // same authorization group.
 //
 // `~iamFieldNames` opts the named mutation/query fields into deploy-time IAM
 // (dual-auth): those fields emit `@aws_cognito_user_pools(cognito_groups:
-// ["<group>"]) @aws_iam` instead of the single-mode `@aws_auth(...)`, keeping
-// the same Cognito group gating while also admitting the SigV4 system caller.
+// ["<group>"]) @aws_iam`, keeping the same Cognito group gating while also
+// admitting the SigV4 system caller.
 // Subscriptions are never IAM-marked (the deploy caller does not subscribe).
 // Canonical definition lives in the runtime-pure AppSync_SdlDecorate so the
 // bundled AdminEventCollector Lambda's reactive push decorates the admin base

package/tests/Auth_ActiveRoleStoreTest.res

@@ -40,3 +40,35 @@ describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () => {
     expect(Ops.mayActAs(~membership=[], ~requested="Shopper"))->toBe(false)
   )
 })
+
+// Which name goes to Cognito. `sub` keys the row and `AdminListGroupsForUser`
+// takes a username, and a pool that makes neither an alias of the other answers
+// `UserNotFoundException` when handed the wrong one — a signed-in caller holding
+// the role they asked for, told they do not exist.
+describe("Auth_ActiveRoleStore_Ops.cognitoLookupName", () => {
+  testSync("the username is what addresses Cognito when the authorizer sent one", () =>
+    expect(
+      Ops.cognitoLookupName(~identity={sub: "d265d464-2091-706a-e5f9-3afafe7be29c", username: Value("merch")}),
+    )->toEqual(Some("merch"))
+  )
+
+  testSync("an absent username falls back to the subject, as before it was forwarded", () =>
+    expect(Ops.cognitoLookupName(~identity={sub: "sub-1"}))->toEqual(Some("sub-1"))
+  )
+
+  // The resolver sends `id.username ?? null`, so null is the shape an authorizer
+  // that names no username actually produces — not a missing field.
+  testSync("an explicitly null username falls back too", () =>
+    expect(Ops.cognitoLookupName(~identity={sub: "sub-1", username: Null}))->toEqual(Some("sub-1"))
+  )
+
+  testSync("a blank username is not a name to look anyone up by", () =>
+    expect(Ops.cognitoLookupName(~identity={sub: "sub-1", username: Value("   ")}))->toEqual(
+      Some("sub-1"),
+    )
+  )
+
+  testSync("neither name means there is nobody to ask about", () =>
+    expect(Ops.cognitoLookupName(~identity={}))->toEqual(None)
+  )
+})

package/tests/Auth_ActiveRoleStoreTest.res.mjs

@@ -30,6 +30,35 @@ globalThis.describe("Auth_ActiveRoleStore_Ops.mayActAs — narrowing only", () =
   });
 });
 
+globalThis.describe("Auth_ActiveRoleStore_Ops.cognitoLookupName", () => {
+  globalThis.test("the username is what addresses Cognito when the authorizer sent one", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({
+      sub: "d265d464-2091-706a-e5f9-3afafe7be29c",
+      username: "merch"
+    })).toEqual("merch");
+  });
+  globalThis.test("an absent username falls back to the subject, as before it was forwarded", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({
+      sub: "sub-1"
+    })).toEqual("sub-1");
+  });
+  globalThis.test("an explicitly null username falls back too", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({
+      sub: "sub-1",
+      username: null
+    })).toEqual("sub-1");
+  });
+  globalThis.test("a blank username is not a name to look anyone up by", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({
+      sub: "sub-1",
+      username: "   "
+    })).toEqual("sub-1");
+  });
+  globalThis.test("neither name means there is nobody to ask about", () => {
+    globalThis.expect(Auth_ActiveRoleStore_Ops$ReventlessAws.cognitoLookupName({})).toEqual(undefined);
+  });
+});
+
 let Ops;
 
 let Contract;