@reventlessdev/reventless-aws 3.0.0-alpha.321 → 3.0.0-alpha.323

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.323 (2026-08-23)
+
+### Bug Fixes
+
+* **querydb:** serve the previous page instead of refusing it ([48341c9](https://github.com/ReventlessDev/reventless-core/commit/48341c9f61b5155b441deeb0edc9abf461948346))
+
+
+# 3.0.0-alpha.322 (2026-08-23)
+
+### Bug Fixes
+
+* **aws:** grant the AppSync data source Query on the table's indexes ([0dc5ed2](https://github.com/ReventlessDev/reventless-core/commit/0dc5ed2e783be22af5b418c94c95fc35f4b73851))
+
+
 # 3.0.0-alpha.321 (2026-08-23)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.321",
+  "version": "3.0.0-alpha.323",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -16,17 +16,17 @@
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.13",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.4",
     "@reventlessdev/rescript-node": "2.0.0-alpha.8",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.5",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.151",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.33",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.249",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.113",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.123"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.114",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.250",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.123",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.151"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res

@@ -319,27 +319,47 @@ let make: ReventlessCore.QueryDb_Adapter.resolversMaker<api, role> = (
       )
     | _ => ()
     }
-    // The same class of "works, but scans" mistake as the owner warning above,
-    // and the retirement case degrades the same way: the FilterExpression is
-    // applied after the page is read, so pages shrink as the archive's share of
-    // the table grows.
+    // The same "works, but scans" cost as the owner warning above: the
+    // FilterExpression is applied after the page is read, so pages shrink as the
+    // archive's share of the table grows.
     //
-    // `@scan` deliberately does not satisfy this. It adds no index and removes
-    // no read unit — it only widens the client's filter surface — so accepting it
-    // here would make the warning dismissible by an annotation that changes
-    // nothing about the cost being warned about.
-    switch retiredField {
-    | Some(f) =>
-      if !isIndexed(f) {
-        log.warn(
-          ~comp="QueryDbResolvers_AppSync",
-          `${name}: @retired field "${f}" is not the key of any index on this table. ` ++
-          "Reads that exclude retired rows will Scan and filter, so pages shrink as " ++
-          "the archive's share of the rows grows. Add an @index on that field before " ++
-          "this read model grows.",
-        )
-      }
-    | None => ()
+    // What it must NOT say any more is "add an @index on that field". That was
+    // the same defect the owner warning had — following it changed nothing — and
+    // here it is worse advice, twice over: a GSI partitioned on a two- or
+    // three-valued flag funnels the whole table through one partition, and the
+    // list door reads neither it nor the by-index door it provisions.
+    //
+    // Retirement has no partition key of its own. It is only useful as the
+    // leading component of a sort key INSIDE some other partition, and `@owner`
+    // is what supplies one — see
+    // docs/plans/Backlog/retirement-folded-into-the-owner-index.md. On a view
+    // with no owner there is nothing to fold into, and the honest answer is a
+    // purpose-built view or the constant-PK index in
+    // docs/plans/Backlog/aws-fulllist-ordered-index-promotion.md.
+    //
+    // Fires whatever the field keys, unlike the owner check: an `@index` on the
+    // retirement field does not make this read cheaper, so suppressing on one
+    // would silence a cost that is still being paid. `@scan` does not satisfy it
+    // either — it widens the client's filter surface and removes no read unit.
+    switch (retiredField, ownerField) {
+    | (Some(f), Some(o)) =>
+      log.warn(
+        ~comp="QueryDbResolvers_AppSync",
+        `${name}: @retired field "${f}" is filtered after the page is read, so pages ` ++
+        `shrink as the archive's share of the rows grows. This view is scoped on "${o}", ` ++
+        "so a scoped caller only sifts their own partition and pays in proportion to " ++
+        "their rows; it is the elevated whole-table read that pays in full.",
+      )
+    | (Some(f), None) =>
+      log.warn(
+        ~comp="QueryDbResolvers_AppSync",
+        `${name}: @retired field "${f}" is filtered after the page is read, so pages ` ++
+        "shrink as the archive's share of the rows grows. An @index on that field " ++
+        "would not help — the list read does not use one, and a flag makes a poor " ++
+        "partition key. Reshape the view so the rows you serve are the rows you " ++
+        "keep, or accept the cost while the archive stays small.",
+      )
+    | (None, _) => ()
     }
     let resolverAll = makeQueryResolver(
       ~resolverName=fieldNameForAll->String.capitalize,

package/src/adapter/QueryDb/QueryDbResolvers_AppSync.res.mjs

@@ -136,8 +136,12 @@ function make(name, api, apiRole, dataSourceName, indexes, subIdField, idResolve
     if (ownerField !== undefined && !(ownerIndex !== undefined || isIndexed(ownerField))) {
       log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @owner field "` + ownerField + `" keys no index on this table, so owner-scoped ` + "reads Scan the table and filter after the page is read — cost grows with the table while the answer shrinks with the caller's share of it. Drop `@owner({index: false})` to let the framework derive the index, or accept the cost on a view that stays small.");
     }
-    if (retiredField !== undefined && !isIndexed(retiredField)) {
-      log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is not the key of any index on this table. ` + "Reads that exclude retired rows will Scan and filter, so pages shrink as the archive's share of the rows grows. Add an @index on that field before this read model grows.");
+    if (retiredField !== undefined) {
+      if (ownerField !== undefined) {
+        log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is filtered after the page is read, so pages ` + (`shrink as the archive's share of the rows grows. This view is scoped on "` + ownerField + `", `) + "so a scoped caller only sifts their own partition and pays in proportion to their rows; it is the elevated whole-table read that pays in full.");
+      } else {
+        log.warn("QueryDbResolvers_AppSync", undefined, name$1 + `: @retired field "` + retiredField + `" is filtered after the page is read, so pages ` + "shrink as the archive's share of the rows grows. An @index on that field would not help — the list read does not use one, and a flag makes a poor partition key. Reshape the view so the rows you serve are the rows you keep, or accept the cost while the archive stays small.");
+      }
     }
     let resolverAll = makeQueryResolver(Stdlib_String.capitalize(fieldNameForAll), fieldNameForAll, connectionSpec ? AppSync_Resolver_Functions$PulumiAws.listAllItemsConnection(labelField, filterFieldNames, rangeFieldNames, sortFieldNames, requireAttribute, ownerField, elevatedGroups, retiredField, retiredValues, ownerIndex, ownerIndexSortField) : AppSync_Resolver_Functions$PulumiAws.listAllItems);
     let resolversByIndex = indexes.filter(ic => !ReadModel$Reventless.isDerivedIndex(ic)).map(indexConfig => {

package/src/adapter/QueryDb/QueryDbStorage_DynamoDb.res

@@ -59,26 +59,39 @@ let attributes = (sortField, indexes: array<Reventless.ReadModel.indexConfig>) =
   )
 }
 
+/**
+The DynamoDB grant the AppSync data source assumes.
+
+An index is a SEPARATE IAM resource (`<table>/index/<name>`), so a grant naming
+only the table permits `Scan` and `GetItem` and denies every `Query` against a
+GSI — silently at deploy time, loudly at the first request. Two doors read one:
+the by-index door, and the list door's owner-scoped branch.
+
+Pure and named so the resource list is assertable without a deploy; the failure
+it guards has no other artifact to check.
+*/
+let dataSourcePolicyDocument = (~name: string, ~tableArn: string): string => {
+  open PolicyDocument
+  PolicyDocument.make(
+    ~id=name ++ "DataSourcePolicy",
+    ~statements=[
+      {
+        sid: "AllowDynamoDbActions",
+        effect: Allow,
+        actions: Action("dynamodb:*"),
+        resources: Resources([tableArn, tableArn ++ "/index/*"]),
+      },
+    ],
+  )->toJsonString
+}
+
 let dataSource = (name, table, api, apiRole, opts) => {
   let _dataSourceRolePolicy = {
     IAM.RolePolicy.make(
       ~name,
       ~args={
         IAM.RolePolicy.policy: table.arn
-        ->Pulumi.Output.apply(tableArn => {
-          open PolicyDocument
-          PolicyDocument.make(
-            ~id=name ++ "DataSourcePolicy",
-            ~statements=[
-              {
-                sid: "AllowDynamoDbActions",
-                effect: Allow,
-                actions: Action("dynamodb:*"),
-                resources: Resource(tableArn),
-              },
-            ],
-          )->toJsonString
-        })
+        ->Pulumi.Output.apply(tableArn => dataSourcePolicyDocument(~name, ~tableArn))
         ->Pulumi.Output.asInput,
         role: apiRole
         ->Pulumi.Output.flatMap((role: PulumiAws.IAM.Role.t) => role.id)

package/src/adapter/QueryDb/QueryDbStorage_DynamoDb.res.mjs

@@ -70,14 +70,21 @@ function attributes(sortField, indexes) {
   });
 }
 
+function dataSourcePolicyDocument(name, tableArn) {
+  return PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+      Sid: "AllowDynamoDbActions",
+      Effect: "Allow",
+      Action: "dynamodb:*",
+      Resource: [
+        tableArn,
+        tableArn + "/index/*"
+      ]
+    }]));
+}
+
 function dataSource(name, table, api, apiRole, opts) {
   new (Aws.iam.RolePolicy)(name, {
-    policy: table.arn.apply(tableArn => PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
-        Sid: "AllowDynamoDbActions",
-        Effect: "Allow",
-        Action: "dynamodb:*",
-        Resource: tableArn
-      }]))),
+    policy: table.arn.apply(tableArn => dataSourcePolicyDocument(name, tableArn)),
     role: Output$Pulumi.flatMap(apiRole, role => role.id)
   }, opts);
   return AppSync_DataSource$PulumiAws.makeDynamoDBDataSource(name, api, table, apiRole, opts);
@@ -104,6 +111,7 @@ function make(name, indexes, subIdField, ttl, api, apiRole, owner, opts) {
 export {
   globalSecondaryIndexes,
   attributes,
+  dataSourcePolicyDocument,
   dataSource,
   make,
 }

package/tests/QueryDbOwnerIndexTableTest.res

@@ -51,3 +51,40 @@ describe("the derived owner index", () => {
     expect(names)->toEqual(["id", "placedAt", "customerId"])
   })
 })
+
+// Provisioning the index is half of it. An index is a separate IAM resource, so
+// a grant naming only the table lets every Scan through and denies every Query
+// against a GSI — which is how the owner-scoped branch reached production
+// deniable: nothing in the generated resolver, the table config or the SDL says
+// anything about it, and the first request is where it surfaces.
+describe("the data source's DynamoDB grant", () => {
+  let tableArn = "arn:aws:dynamodb:eu-west-1:123456789012:table/Orders-10f6a39"
+  let policy =
+    QueryDbStorage_DynamoDb.dataSourcePolicyDocument(~name="Orders", ~tableArn)->JSON.parseOrThrow
+
+  let field = (json, key) => json->JSON.Decode.object->Option.flatMap(o => o->Dict.get(key))
+  let statement =
+    policy
+    ->field("Statement")
+    ->Option.flatMap(JSON.Decode.array)
+    ->Option.getOr([])
+    ->Array.get(0)
+    ->Option.getOr(JSON.Encode.null)
+  let resources =
+    statement
+    ->field("Resource")
+    ->Option.flatMap(JSON.Decode.array)
+    ->Option.getOr([])
+    ->Array.filterMap(JSON.Decode.string)
+
+  testSync("covers the table's indexes, not only the table", () =>
+    expect(resources)->toEqual([tableArn, tableArn ++ "/index/*"])
+  )
+
+  // Dropping the table itself would break Scan — the elevated branch — while the
+  // scoped branch kept working, so both halves are asserted rather than just the
+  // one that was missing.
+  testSync("still covers the table itself", () =>
+    expect(resources->Array.includes(tableArn))->toBe(true)
+  )
+})

package/tests/QueryDbOwnerIndexTableTest.res.mjs

@@ -1,5 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as QueryDbStorage_DynamoDb$ReventlessAws from "../src/adapter/QueryDb/QueryDbStorage_DynamoDb.res.mjs";
 
 let ownerIndex = {
@@ -44,6 +47,23 @@ globalThis.describe("the derived owner index", () => {
   });
 });
 
+globalThis.describe("the data source's DynamoDB grant", () => {
+  let tableArn = "arn:aws:dynamodb:eu-west-1:123456789012:table/Orders-10f6a39";
+  let policy = JSON.parse(QueryDbStorage_DynamoDb$ReventlessAws.dataSourcePolicyDocument("Orders", tableArn));
+  let field = (json, key) => Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(json), o => o[key]);
+  let statement = Stdlib_Option.getOr(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(policy, "Statement"), Stdlib_JSON.Decode.array), [])[0], null);
+  let resources = Stdlib_Array.filterMap(Stdlib_Option.getOr(Stdlib_Option.flatMap(field(statement, "Resource"), Stdlib_JSON.Decode.array), []), Stdlib_JSON.Decode.string);
+  globalThis.test("covers the table's indexes, not only the table", () => {
+    globalThis.expect(resources).toEqual([
+      tableArn,
+      tableArn + "/index/*"
+    ]);
+  });
+  globalThis.test("still covers the table itself", () => {
+    globalThis.expect(resources.includes(tableArn)).toBe(true);
+  });
+});
+
 export {
   ownerIndex,
 }

package/tests/QueryDbResolvers_AppSyncTest.res

@@ -51,16 +51,32 @@ describe("listAllItemsConnection — paging", () => {
   })
 
   testSync("a filtered read examines more rows than it serves", () => {
-    expect(code->String.includes("parts.length > 0 ? (_first > 1000 ? _first : 1000)"))->toBe(true)
-    expect(code->String.includes("const _page = _rest.slice(0, _first);"))->toBe(true)
+    // The budget reads as deep as the page needs, which for a backward cut is
+    // `_upTo` rather than `_first + _from`.
+    expect(
+      code->String.includes("parts.length > 0 ? ((_backward ? _upTo : _first + _from) > 1000"),
+    )->toBe(true)
+    expect(code->String.includes("const _page = _backward ? _rest : _rest.slice(0, _first);"))
+    ->toBe(true)
     expect(code->String.includes("hasNextPage: _more || !!_next,"))->toBe(true)
   })
 
-  testSync("backward paging (last/before) is rejected, not silently mishandled", () => {
-    expect(code->String.includes("ctx.args.before != null || ctx.args.last != null"))->toBe(true)
+  // `before` is served by re-reading the window the cursor names; only a previous
+  // page lying in an EARLIER window is out of reach, and `last` — which needs the
+  // end of the list — stays refused.
+  testSync("backward paging is served, and its one limit is named", () => {
+    expect(code->String.includes("ctx.args.before != null && ctx.args.before !== ''"))->toBe(true)
+    expect(code->String.includes("_backward && _upTo <= 0 && _window !== null"))->toBe(true)
     expect(code->String.includes("UnsupportedPagination"))->toBe(true)
   })
 
+  // The door must not advertise a previous page it cannot serve — that is what
+  // put a live Prev button in front of an error.
+  testSync("only a reachable previous page is advertised", () => {
+    expect(code->String.includes("hasPreviousPage: _from > 0,"))->toBe(true)
+    expect(code->String.includes("hasPreviousPage: !!ctx.args.after,"))->toBe(false)
+  })
+
   testSync("a window emptied by the filter still yields a resumable boundary cursor", () => {
     expect(
       code->String.includes(

package/tests/QueryDbResolvers_AppSyncTest.res.mjs

@@ -37,14 +37,19 @@ globalThis.describe("listAllItemsConnection — paging", () => {
     globalThis.expect(code.includes("ctx.args.after + '_' + i")).toBe(false);
   });
   globalThis.test("a filtered read examines more rows than it serves", () => {
-    globalThis.expect(code.includes("parts.length > 0 ? (_first > 1000 ? _first : 1000)")).toBe(true);
-    globalThis.expect(code.includes("const _page = _rest.slice(0, _first);")).toBe(true);
+    globalThis.expect(code.includes("parts.length > 0 ? ((_backward ? _upTo : _first + _from) > 1000")).toBe(true);
+    globalThis.expect(code.includes("const _page = _backward ? _rest : _rest.slice(0, _first);")).toBe(true);
     globalThis.expect(code.includes("hasNextPage: _more || !!_next,")).toBe(true);
   });
-  globalThis.test("backward paging (last/before) is rejected, not silently mishandled", () => {
-    globalThis.expect(code.includes("ctx.args.before != null || ctx.args.last != null")).toBe(true);
+  globalThis.test("backward paging is served, and its one limit is named", () => {
+    globalThis.expect(code.includes("ctx.args.before != null && ctx.args.before !== ''")).toBe(true);
+    globalThis.expect(code.includes("_backward && _upTo <= 0 && _window !== null")).toBe(true);
     globalThis.expect(code.includes("UnsupportedPagination")).toBe(true);
   });
+  globalThis.test("only a reachable previous page is advertised", () => {
+    globalThis.expect(code.includes("hasPreviousPage: _from > 0,")).toBe(true);
+    globalThis.expect(code.includes("hasPreviousPage: !!ctx.args.after,")).toBe(false);
+  });
   globalThis.test("a window emptied by the filter still yields a resumable boundary cursor", () => {
     globalThis.expect(code.includes("const _boundary = _next ? util.base64Encode(JSON.stringify({ t: _next, n: -1 })) : null;")).toBe(true);
     globalThis.expect(code.includes("edges.length > 0 ? edges[edges.length - 1].cursor : _boundary")).toBe(true);