@reventlessdev/reventless-aws 3.0.0-alpha.344 → 3.0.0-alpha.346

package/src/capability/Capability_Geocoding_AwsLocation.res

@@ -25,7 +25,10 @@ let defaultIntendedUse = "SingleUse"
 
 /** Create a place index with framework attribution tags and config-driven
     provider/retention settings. */
-let make = (~name: string, ~opts: option<Pulumi.CustomResourceOptions.t>=?): ReventlessInfra.Platform.geocoderIndex => {
+let make = (
+  ~name: string,
+  ~opts: option<Pulumi.CustomResourceOptions.t>=?,
+): ReventlessInfra.Platform.geocoderIndex => {
   let dataSource = Util_LocalConfig.get("geocoderDataSource")->Option.getOr(defaultDataSource)
   let intendedUse = Util_LocalConfig.get("geocoderIntendedUse")->Option.getOr(defaultIntendedUse)
 

package/src/capability/Capability_Messaging.res

@@ -80,8 +80,7 @@ let parseEmailProvider = (raw: string): emailProvider =>
   | other =>
     JsError.throwWithMessage(
       `platform:${emailProviderKey} is "${other}", which is not an email provider.\n` ++
-      `  Known values: "ses" (default — a verified SES identity) and "log" ` ++
-      `(writes each message to the log, sends nothing).`,
+      `  Known values: "ses" (default — a verified SES identity) and "log" ` ++ `(writes each message to the log, sends nothing).`,
     )
   }
 
@@ -121,11 +120,11 @@ let make = (
   // Asked for SES and named no address. Nothing is provisioned, and the deploy
   // gate refuses this the moment a plugin declares it needs messaging — here
   // rather than there because this module has no view of what the plugins want.
-  | (Ses, None) => {emailProvider: providerInput, smsSender: ?smsSender}
+  | (Ses, None) => {emailProvider: providerInput, ?smsSender}
   | (Ses, Some(address)) => {
       emailSender: Capability_Messaging_Ses.emailSender(~name, ~address, ~displayName, ~opts?),
       emailProvider: providerInput,
-      smsSender: ?smsSender,
+      ?smsSender,
     }
   | (Log, address) => {
       emailSender: Pulumi.Input.make(
@@ -135,7 +134,7 @@ let make = (
         ),
       ),
       emailProvider: providerInput,
-      smsSender: ?smsSender,
+      ?smsSender,
     }
   }
 }

package/src/capability/Capability_Messaging_Ses.res

@@ -39,6 +39,8 @@ let emailSender = (
 ): Pulumi.Input.t<string> => {
   let identity = SES.EmailIdentity.make(~name, ~args={email: address}, ~opts?)
   identity.email
-  ->Pulumi.Output.apply(verified => Reventless.Messaging.fromHeader(~displayName, ~address=verified))
+  ->Pulumi.Output.apply(verified =>
+    Reventless.Messaging.fromHeader(~displayName, ~address=verified)
+  )
   ->Pulumi.Output.asInput
 }

package/src/capability/Capability_ObjectStore_S3.res

@@ -138,13 +138,7 @@ let make = (
       corsRules: corsRules->Pulumi.Input.make,
       forceDestroy: forceDestroy->Pulumi.Input.make,
       lifecycleRules: lifecycleRules->Pulumi.Input.make,
-      tags: AWS.Tags.make(
-        ~name,
-        ~kind,
-        ~role=Other("ObjectStore"),
-        ~scope,
-        ~plugin?,
-      ),
+      tags: AWS.Tags.make(~name, ~kind, ~role=Other("ObjectStore"), ~scope, ~plugin?),
     },
     ~opts,
   )

package/src/components/Api/AppSync_Adapter.res

@@ -45,13 +45,11 @@ let startSchemaCreation = (client: appSyncClient, input: startSchemaCreationInpu
 // jittered exponential backoff so a losing call can wait for the in-progress
 // schema to finish and try again. Permanent errors (e.g. invalid SDL) are not
 // retried — see AppSync_Error.classify.
-let startSchemaCreationRetrying = (
-  client: appSyncClient,
-  input: startSchemaCreationInput,
-): promise<unit> => {
-  Effect.tryPromise(
-    ~catch=AppSync_Error.classify,
-    () => startSchemaCreation(client, input)->Promise.then(_ => Promise.resolve()),
+let startSchemaCreationRetrying = (client: appSyncClient, input: startSchemaCreationInput): promise<
+  unit,
+> => {
+  Effect.tryPromise(~catch=AppSync_Error.classify, () =>
+    startSchemaCreation(client, input)->Promise.then(_ => Promise.resolve())
   )
   ->Effect.retry(AppSync_Error.retrySchedule)
   ->Effect.runPromise
@@ -67,13 +65,13 @@ external makeGetSchemaCreationStatusCommand: getSchemaCreationStatusInput => get
   "GetSchemaCreationStatusCommand"
 
 @send
-external sendGetStatus: (appSyncClient, getSchemaCreationStatusCommand) => promise<getSchemaCreationStatusResult> =
-  "send"
+external sendGetStatus: (
+  appSyncClient,
+  getSchemaCreationStatusCommand,
+) => promise<getSchemaCreationStatusResult> = "send"
 
 let rec waitForSchemaActive = async (client, apiId, ~maxAttempts=30, ~attempt=0) => {
-  let result = await client->sendGetStatus(
-    {apiId: apiId}->makeGetSchemaCreationStatusCommand,
-  )
+  let result = await client->sendGetStatus({apiId: apiId}->makeGetSchemaCreationStatusCommand)
   switch result.status {
   | "ACTIVE" | "SUCCESS" => ()
   | "FAILED" =>
@@ -185,14 +183,32 @@ let rec waitForMergeSuccess = async (
 // When both are present on the same field, the spec-level permission wins
 // (it is more specific). `AllowGroups([g1, g2, ...])` emits
 // `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
-// `AllowAuthenticated` / `AllowAnonymous` emit the group-less
-// `@aws_cognito_user_pools` — same reachability (with Cognito as primary auth
-// any reaching request is already authenticated), but stated rather than left
+// `AllowAuthenticated` emits the group-less `@aws_cognito_user_pools` — the same
+// reachability an undirectived field already has, but stated rather than left
 // implicit, so `assertGateable` can tell "deliberately open" from "nobody
 // stamped this". `AllowGroups([])` and `DenyAll` emit a sentinel `__deny_all__`
 // group that no Cognito user can belong to — effectively blocking the field at
 // the API layer.
 //
+// `AllowAnonymous` is REFUSED at deploy time, and this used to be the bug:
+// it shared `AllowAuthenticated`'s arm and emitted the same group-less
+// directive, which on a Cognito-primary API means *any authenticated caller* —
+// the opposite of what the spec says. AppSync has no anonymous mode to emit
+// instead (`authenticationType` is API_KEY | AWS_IAM | AMAZON_COGNITO_USER_POOLS
+// | OPENID_CONNECT, and this adapter provisions Cognito primary with AWS_IAM
+// additional), so there is no directive that means "no auth". The old behaviour
+// deployed green, passed `assertGateable`, worked on the local platform — whose
+// resolvers call `Authorization.isAllowed` and honour the rule — and refused
+// anonymous callers only on AWS. It failed CLOSED, which is why nothing
+// surfaced it.
+//
+// Refusing follows `Auth_LoginIdentifier`'s rule for an unrecognised spelling:
+// a silent contradiction of the source is worse than a stopped deploy, because
+// only one of the two is discoverable. AppSync mutations have no runtime
+// authorization check to fall back on — the only `Authorization.isAllowed` call
+// in this package is on the Postgres query path — so the directive is the whole
+// enforcement, and a directive that cannot say this must not pretend to.
+//
 // NOT `@aws_auth(...)`: that is the single-mode form, which AppSync ignores on a
 // multi-auth API — which every API this adapter provisions is. See
 // `AppSync_SdlDecorate.formatCognitoGroupsDirective` for the full rationale and
@@ -211,62 +227,13 @@ let rec waitForMergeSuccess = async (
 // and a least-privilege deploy-role policy — see
 // `docs/guides/appsync-iam-system-caller.md`.
 
-let _permissionToCognitoGroups = (
-  permission: Reventless.Authorization.permission,
-): option<array<string>> =>
-  switch permission {
-  | AllowGroups([]) => Some(["__deny_all__"])
-  | AllowGroups(groups) => Some(groups)
-  | DenyAll => Some(["__deny_all__"])
-  | AllowAuthenticated | AllowAnonymous => None
-  }
-
-// Both directive forms are defined once in the runtime-pure AppSync_SdlDecorate
-// so this deploy path and the bundled AdminEventCollector Lambda's reactive push
-// cannot drift. The Cognito-only arm carries the rationale for why it is
-// `@aws_cognito_user_pools(...)` and never `@aws_auth(...)`.
-let _formatGroupsDirective = AppSync_SdlDecorate.formatCognitoGroupsDirective
-
-// Multi-auth directive for a field that must accept BOTH Cognito and IAM.
-// `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps the
-// field open to any authenticated Cognito user. `@aws_iam` admits the
-// deploy-time SigV4 system caller. See the dual-auth note above.
-let _formatDualAuthDirective = AppSync_SdlDecorate.formatDualAuthDirective
-
-// ── Type-level dual-auth ─────────────────────────────────────────────────────
-// On a multi-auth API, object TYPES without auth directives are accessible only
-// via the default auth mode — a field-level `@aws_iam` admits the system caller
-// to the top-level field, but response shaping then walks the return types
-// (`…Connection` → `…Edge` → node type → nested state types) and dies with
-// "Not Authorized to access <field> on type <T>" one level in. Types reachable
-// from a systemCallable field therefore carry the bare multi-auth pair: the
-// group-less Cognito arm matches the pre-existing accessibility of an
-// undirectived type (any authenticated user; entry gating stays on the fields),
-// the IAM arm admits the traversal. Only `type` declarations take auth
-// directives (inputs/enums/interfaces do not).
-
-// The declared name of a `type …` SDL declaration; None for input/enum/union/etc.
-let _typeDeclName = (decl: string): option<string> =>
-  if decl->String.startsWith("type ") {
-    let rest = decl->String.slice(~start=5, ~end=decl->String.length)
-    let end = switch rest->String.search(%re("/[\s{]/")) {
-    | -1 => rest->String.length
-    | i => i
-    }
-    Some(rest->String.slice(~start=0, ~end))
-  } else {
-    None
-  }
-
-// Insert the multi-auth pair into a type declaration header (before its `{`).
-let _stampTypeDualAuth = (decl: string): string =>
-  switch decl->String.indexOfOpt("{") {
-  | Some(i) =>
-    decl->String.slice(~start=0, ~end=i) ++
-    "@aws_cognito_user_pools @aws_iam " ++
-    decl->String.slice(~start=i, ~end=decl->String.length)
-  | None => decl
-  }
+// Everything this file needs to decide what a directive says — the two directive
+// formats, the permission → gate mapping, the `AllowAnonymous` refusal, the type
+// header stampers and `typeDeclNameOf` — lives in the runtime-pure
+// AppSync_SdlDecorate, so this deploy path and the bundled AdminEventCollector
+// Lambda's reactive push cannot drift. The Cognito-only arm carries the rationale
+// for why it is `@aws_cognito_user_pools(...)` and never `@aws_auth(...)`.
+// This file is left with resource creation, which is what it is for.
 
 // Shared traversal types every callable surface reaches — `PageInfo` (relay
 // connections, injected by the stitcher) and the `CommandResult` members
@@ -301,6 +268,10 @@ let injectAwsAuth = (
   let iamQueryFieldPrefixes: array<string> = []
   let iamTypePrefixes: array<string> = []
 
+  // Collected across both entry kinds and refused once, so a deploy reports
+  // every offending field rather than the first one found.
+  let anonymousFields: array<string> = []
+
   let mutationAuthMap: Dict.t<array<string>> = Dict.make()
   mutationEntries->Array.forEach(entry => {
     if entry.systemCallable->Option.getOr(false) {
@@ -308,9 +279,7 @@ let injectAwsAuth = (
     }
     switch entry.authorization {
     | Some({group}) =>
-      entry.fieldNames->Array.forEach(fieldName =>
-        mutationAuthMap->Dict.set(fieldName, [group])
-      )
+      entry.fieldNames->Array.forEach(fieldName => mutationAuthMap->Dict.set(fieldName, [group]))
     | None => ()
     }
     switch entry.fieldPermissions {
@@ -318,9 +287,10 @@ let injectAwsAuth = (
       fp
       ->Dict.toArray
       ->Array.forEach(((fieldName, permission)) => {
-        switch _permissionToCognitoGroups(permission) {
-        | Some(groups) => mutationAuthMap->Dict.set(fieldName, groups)
-        | None => mutationAuthMap->Dict.delete(fieldName)
+        switch AppSync_SdlDecorate.permissionToGate(permission) {
+        | Groups(groups) => mutationAuthMap->Dict.set(fieldName, groups)
+        | AnyAuthenticated => mutationAuthMap->Dict.delete(fieldName)
+        | Anonymous => anonymousFields->Array.push(fieldName)
         }
       })
     | None => ()
@@ -346,18 +316,28 @@ let injectAwsAuth = (
     }
     switch entry.permission {
     | Some(permission) =>
-      switch _permissionToCognitoGroups(permission) {
-      | Some(groups) =>
+      switch AppSync_SdlDecorate.permissionToGate(permission) {
+      | Groups(groups) =>
         queryAuthMap->Dict.set(entry.singleFieldName, groups)
         queryAuthMap->Dict.set(entry.listFieldName, groups)
-      | None =>
+      | AnyAuthenticated =>
         queryAuthMap->Dict.delete(entry.singleFieldName)
         queryAuthMap->Dict.delete(entry.listFieldName)
+      | Anonymous =>
+        // Both derived field names, because the spec declares one permission and
+        // the generator emits two fields from it; naming only one would send the
+        // author looking for a second declaration that does not exist.
+        anonymousFields->Array.push(entry.singleFieldName)
+        anonymousFields->Array.push(entry.listFieldName)
       }
     | None => ()
     }
   })
 
+  if anonymousFields->Array.length > 0 {
+    AppSync_SdlDecorate.refuseAnonymousFields(anonymousFields)
+  }
+
   // A field with no group restriction gets the group-less Cognito directive
   // rather than no directive at all. Same reachability under `defaultAction:
   // ALLOW`; the difference only shows once the default is DENY, where an
@@ -368,10 +348,10 @@ let injectAwsAuth = (
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
     let groups = mutationAuthMap->Dict.get(fieldName)
     if iamFields->Dict.get(fieldName)->Option.getOr(false) {
-      `${field}\n    ${_formatDualAuthDirective(groups)}`
+      `${field}\n    ${AppSync_SdlDecorate.formatDualAuthDirective(groups)}`
     } else {
       switch groups {
-      | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
+      | Some(groups) => `${field}\n    ${AppSync_SdlDecorate.formatCognitoGroupsDirective(groups)}`
       | None => `${field}\n    ${openDirective}`
       }
     }
@@ -384,10 +364,10 @@ let injectAwsAuth = (
       iamFields->Dict.get(fieldName)->Option.getOr(false) ||
         iamQueryFieldPrefixes->Array.some(p => fieldName->String.startsWith(p))
     if isIam {
-      `${field} ${_formatDualAuthDirective(groups)}`
+      `${field} ${AppSync_SdlDecorate.formatDualAuthDirective(groups)}`
     } else {
       switch groups {
-      | Some(groups) => `${field} ${_formatGroupsDirective(groups)}`
+      | Some(groups) => `${field} ${AppSync_SdlDecorate.formatCognitoGroupsDirective(groups)}`
       | None => `${field} ${openDirective}`
       }
     }
@@ -400,7 +380,7 @@ let injectAwsAuth = (
   let augmentedSubscriptions = parts.subscriptions->Array.map(field => {
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
     switch mutationAuthMap->Dict.get(fieldName) {
-    | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
+    | Some(groups) => `${field}\n    ${AppSync_SdlDecorate.formatCognitoGroupsDirective(groups)}`
     | None => `${field}\n    ${openDirective}`
     }
   })
@@ -409,9 +389,9 @@ let injectAwsAuth = (
   // the node type, its Connection/Edge wrappers, and nested state types all
   // share the entry's returnTypeName prefix.
   let augmentedTypes = parts.types->Array.map(decl =>
-    switch _typeDeclName(decl) {
+    switch AppSync_SdlDecorate.typeDeclNameOf(decl) {
     | Some(name) if iamTypePrefixes->Array.some(p => name->String.startsWith(p)) =>
-      _stampTypeDualAuth(decl)
+      AppSync_SdlDecorate.stampTypeDualAuth(decl)
     | _ => decl
     }
   )
@@ -507,8 +487,7 @@ let _makeApiResourceWith = (
   let iamRole = IAM.Role.make(
     ~name=`${name}-appsync-role`,
     ~args={
-      assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`
-        ->Pulumi.Input.make,
+      assumeRolePolicy: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"appsync.amazonaws.com"},"Action":"sts:AssumeRole"}]}`->Pulumi.Input.make,
       tags: AWS.Tags.make(
         ~name=`${name}-appsync-role`,
         ~kind=ReventlessCore.ComponentType.Platform,
@@ -562,15 +541,13 @@ let _makeApiResourceWith = (
   let userPoolConfigOut = switch userPoolConfig {
   | Some(config) => config
   | None =>
-    Auth_Cognito.make(~name=`${name}-auth`)->Pulumi.Output.apply((c: Auth_Cognito.authConfig) =>
-      (
-        {
-          userPoolId: c.userPoolId,
-          awsRegion: c.region,
-          defaultAction: AppSync.GraphQLApi.ALLOW,
-        }: AppSync.GraphQLApi.userPoolConfig
-      )
-    )
+    Auth_Cognito.make(
+      ~name=`${name}-auth`,
+    )->Pulumi.Output.apply((c: Auth_Cognito.authConfig): AppSync.GraphQLApi.userPoolConfig => {
+      userPoolId: c.userPoolId,
+      awsRegion: c.region,
+      defaultAction: AppSync.GraphQLApi.ALLOW,
+    })
   }
 
   // Cognito as primary auth, AWS_IAM as additional provider for
@@ -588,12 +565,7 @@ let _makeApiResourceWith = (
     ]->Pulumi.Input.make,
     schema: ?(schema->Option.map(Pulumi.Input.make)),
     logConfig: appsyncLogConfig->Pulumi.Input.make,
-    tags: AWS.Tags.make(
-      ~name,
-      ~kind=ReventlessCore.ComponentType.Plugin,
-      ~role=Api,
-      ~scope=Plugin,
-    ),
+    tags: AWS.Tags.make(~name, ~kind=ReventlessCore.ComponentType.Plugin, ~role=Api, ~scope=Plugin),
   }
   let graphQLApi = AppSync.GraphQLApi.make(~name, ~args=apiArgs, ~opts=Some(customOpts))
 
@@ -640,11 +612,10 @@ let _makeApiResourceWith = (
   (graphQLApi->Pulumi.Output.make, iamRole->Pulumi.Output.make)
 }
 
-let makeApiResource = (
-  ~name: string,
-  ~opts: Pulumi.ComponentResource.options,
-): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) =>
-  _makeApiResourceWith(~name, ~schema=None, ~userPoolConfig=None, ~opts)
+let makeApiResource = (~name: string, ~opts: Pulumi.ComponentResource.options): (
+  Pulumi.Output.t<api>,
+  Pulumi.Output.t<role>,
+) => _makeApiResourceWith(~name, ~schema=None, ~userPoolConfig=None, ~opts)
 
 // Merged-mode source API: same auth shape as makeApiResource but with a
 // DECLARATIVE inline schema — the provider runs StartSchemaCreation + poll

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -6,7 +6,6 @@ import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
-import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Effect$1 from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
@@ -107,49 +106,12 @@ async function waitForMergeSuccess(client, associationId, mergedApiIdentifier, m
   return Stdlib_JsError.throwWithMessage(`Source API association ` + associationId + ` on ` + mergedApiIdentifier + ` failed to merge (` + status + `): ` + detail);
 }
 
-function _permissionToCognitoGroups(permission) {
-  if (typeof permission !== "object") {
-    switch (permission) {
-      case "AllowAuthenticated" :
-      case "AllowAnonymous" :
-        return;
-      case "DenyAll" :
-        return ["__deny_all__"];
-    }
-  } else {
-    let groups = permission._0;
-    if (groups.length !== 0) {
-      return groups;
-    } else {
-      return ["__deny_all__"];
-    }
-  }
-}
-
-function _typeDeclName(decl) {
-  if (!decl.startsWith("type ")) {
-    return;
-  }
-  let rest = decl.slice(5, decl.length);
-  let i = rest.search(/[\s{]/);
-  let end = i !== -1 ? i : rest.length;
-  return rest.slice(0, end);
-}
-
-function _stampTypeDualAuth(decl) {
-  let i = Stdlib_String.indexOfOpt(decl, "{");
-  if (i !== undefined) {
-    return decl.slice(0, i) + "@aws_cognito_user_pools @aws_iam " + decl.slice(i, decl.length);
-  } else {
-    return decl;
-  }
-}
-
 function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
   let iamFields = {};
   let iamQueryFieldPrefixes = [];
   let iamTypePrefixes = [];
+  let anonymousFields = [];
   let mutationAuthMap = {};
   mutationEntries.forEach(entry => {
     if (Stdlib_Option.getOr(entry.systemCallable, false)) {
@@ -168,12 +130,16 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     if (fp !== undefined) {
       Object.entries(fp).forEach(param => {
         let fieldName = param[0];
-        let groups = _permissionToCognitoGroups(param[1]);
-        if (groups !== undefined) {
-          mutationAuthMap[fieldName] = groups;
+        let groups = AppSync_SdlDecorate$ReventlessAws.permissionToGate(param[1]);
+        if (typeof groups !== "object") {
+          if (groups === "AnyAuthenticated") {
+            return Stdlib_Dict.$$delete(mutationAuthMap, fieldName);
+          }
+          anonymousFields.push(fieldName);
           return;
         } else {
-          return Stdlib_Dict.$$delete(mutationAuthMap, fieldName);
+          mutationAuthMap[fieldName] = groups._0;
+          return;
         }
       });
       return;
@@ -198,16 +164,25 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     if (permission === undefined) {
       return;
     }
-    let groups = _permissionToCognitoGroups(permission);
-    if (groups !== undefined) {
-      queryAuthMap[entry.singleFieldName] = groups;
-      queryAuthMap[entry.listFieldName] = groups;
+    let groups = AppSync_SdlDecorate$ReventlessAws.permissionToGate(permission);
+    if (typeof groups !== "object") {
+      if (groups === "AnyAuthenticated") {
+        Stdlib_Dict.$$delete(queryAuthMap, entry.singleFieldName);
+        return Stdlib_Dict.$$delete(queryAuthMap, entry.listFieldName);
+      }
+      anonymousFields.push(entry.singleFieldName);
+      anonymousFields.push(entry.listFieldName);
       return;
     } else {
-      Stdlib_Dict.$$delete(queryAuthMap, entry.singleFieldName);
-      return Stdlib_Dict.$$delete(queryAuthMap, entry.listFieldName);
+      let groups$1 = groups._0;
+      queryAuthMap[entry.singleFieldName] = groups$1;
+      queryAuthMap[entry.listFieldName] = groups$1;
+      return;
     }
   });
+  if (anonymousFields.length !== 0) {
+    AppSync_SdlDecorate$ReventlessAws.refuseAnonymousFields(anonymousFields);
+  }
   let augmentedMutations = parts.mutations.map(field => {
     let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
     let groups = mutationAuthMap[fieldName];
@@ -241,9 +216,9 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     }
   });
   let augmentedTypes = parts.types.map(decl => {
-    let name = _typeDeclName(decl);
+    let name = AppSync_SdlDecorate$ReventlessAws.typeDeclNameOf(decl);
     if (name !== undefined && iamTypePrefixes.some(p => name.startsWith(p))) {
-      return _stampTypeDualAuth(decl);
+      return AppSync_SdlDecorate$ReventlessAws.stampTypeDualAuth(decl);
     } else {
       return decl;
     }
@@ -340,10 +315,6 @@ function generateFragment(mutationEntries, queryEntries) {
   return injectAwsAuth(fragment, mutationEntries, queryEntries);
 }
 
-let _formatGroupsDirective = AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective;
-
-let _formatDualAuthDirective = AppSync_SdlDecorate$ReventlessAws.formatDualAuthDirective;
-
 let stampSharedIamTypes = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes;
 
 let primaryAuthenticationType = "AMAZON_COGNITO_USER_POOLS";
@@ -357,11 +328,6 @@ export {
   _client,
   getClient,
   waitForMergeSuccess,
-  _permissionToCognitoGroups,
-  _formatGroupsDirective,
-  _formatDualAuthDirective,
-  _typeDeclName,
-  _stampTypeDualAuth,
   stampSharedIamTypes,
   injectAwsAuth,
   injectAwsAuthAll,