@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.347

package/src/components/Api/AppSync_Adapter.res

@@ -183,14 +183,32 @@ let rec waitForMergeSuccess = async (
 // When both are present on the same field, the spec-level permission wins
 // (it is more specific). `AllowGroups([g1, g2, ...])` emits
 // `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
-// `AllowAuthenticated` / `AllowAnonymous` emit the group-less
-// `@aws_cognito_user_pools` — same reachability (with Cognito as primary auth
-// any reaching request is already authenticated), but stated rather than left
+// `AllowAuthenticated` emits the group-less `@aws_cognito_user_pools` — the same
+// reachability an undirectived field already has, but stated rather than left
 // implicit, so `assertGateable` can tell "deliberately open" from "nobody
 // stamped this". `AllowGroups([])` and `DenyAll` emit a sentinel `__deny_all__`
 // group that no Cognito user can belong to — effectively blocking the field at
 // the API layer.
 //
+// `AllowAnonymous` is REFUSED at deploy time, and this used to be the bug:
+// it shared `AllowAuthenticated`'s arm and emitted the same group-less
+// directive, which on a Cognito-primary API means *any authenticated caller* —
+// the opposite of what the spec says. AppSync has no anonymous mode to emit
+// instead (`authenticationType` is API_KEY | AWS_IAM | AMAZON_COGNITO_USER_POOLS
+// | OPENID_CONNECT, and this adapter provisions Cognito primary with AWS_IAM
+// additional), so there is no directive that means "no auth". The old behaviour
+// deployed green, passed `assertGateable`, worked on the local platform — whose
+// resolvers call `Authorization.isAllowed` and honour the rule — and refused
+// anonymous callers only on AWS. It failed CLOSED, which is why nothing
+// surfaced it.
+//
+// Refusing follows `Auth_LoginIdentifier`'s rule for an unrecognised spelling:
+// a silent contradiction of the source is worse than a stopped deploy, because
+// only one of the two is discoverable. AppSync mutations have no runtime
+// authorization check to fall back on — the only `Authorization.isAllowed` call
+// in this package is on the Postgres query path — so the directive is the whole
+// enforcement, and a directive that cannot say this must not pretend to.
+//
 // NOT `@aws_auth(...)`: that is the single-mode form, which AppSync ignores on a
 // multi-auth API — which every API this adapter provisions is. See
 // `AppSync_SdlDecorate.formatCognitoGroupsDirective` for the full rationale and
@@ -209,62 +227,13 @@ let rec waitForMergeSuccess = async (
 // and a least-privilege deploy-role policy — see
 // `docs/guides/appsync-iam-system-caller.md`.
 
-let _permissionToCognitoGroups = (permission: Reventless.Authorization.permission): option<
-  array<string>,
-> =>
-  switch permission {
-  | AllowGroups([]) => Some(["__deny_all__"])
-  | AllowGroups(groups) => Some(groups)
-  | DenyAll => Some(["__deny_all__"])
-  | AllowAuthenticated | AllowAnonymous => None
-  }
-
-// Both directive forms are defined once in the runtime-pure AppSync_SdlDecorate
-// so this deploy path and the bundled AdminEventCollector Lambda's reactive push
-// cannot drift. The Cognito-only arm carries the rationale for why it is
-// `@aws_cognito_user_pools(...)` and never `@aws_auth(...)`.
-let _formatGroupsDirective = AppSync_SdlDecorate.formatCognitoGroupsDirective
-
-// Multi-auth directive for a field that must accept BOTH Cognito and IAM.
-// `groups=Some([...])` preserves Cognito group gating; `groups=None` keeps the
-// field open to any authenticated Cognito user. `@aws_iam` admits the
-// deploy-time SigV4 system caller. See the dual-auth note above.
-let _formatDualAuthDirective = AppSync_SdlDecorate.formatDualAuthDirective
-
-// ── Type-level dual-auth ─────────────────────────────────────────────────────
-// On a multi-auth API, object TYPES without auth directives are accessible only
-// via the default auth mode — a field-level `@aws_iam` admits the system caller
-// to the top-level field, but response shaping then walks the return types
-// (`…Connection` → `…Edge` → node type → nested state types) and dies with
-// "Not Authorized to access <field> on type <T>" one level in. Types reachable
-// from a systemCallable field therefore carry the bare multi-auth pair: the
-// group-less Cognito arm matches the pre-existing accessibility of an
-// undirectived type (any authenticated user; entry gating stays on the fields),
-// the IAM arm admits the traversal. Only `type` declarations take auth
-// directives (inputs/enums/interfaces do not).
-
-// The declared name of a `type …` SDL declaration; None for input/enum/union/etc.
-let _typeDeclName = (decl: string): option<string> =>
-  if decl->String.startsWith("type ") {
-    let rest = decl->String.slice(~start=5, ~end=decl->String.length)
-    let end = switch rest->String.search(/[\s{]/) {
-    | -1 => rest->String.length
-    | i => i
-    }
-    Some(rest->String.slice(~start=0, ~end))
-  } else {
-    None
-  }
-
-// Insert the multi-auth pair into a type declaration header (before its `{`).
-let _stampTypeDualAuth = (decl: string): string =>
-  switch decl->String.indexOfOpt("{") {
-  | Some(i) =>
-    decl->String.slice(~start=0, ~end=i) ++
-    "@aws_cognito_user_pools @aws_iam " ++
-    decl->String.slice(~start=i, ~end=decl->String.length)
-  | None => decl
-  }
+// Everything this file needs to decide what a directive says — the two directive
+// formats, the permission → gate mapping, the `AllowAnonymous` refusal, the type
+// header stampers and `typeDeclNameOf` — lives in the runtime-pure
+// AppSync_SdlDecorate, so this deploy path and the bundled AdminEventCollector
+// Lambda's reactive push cannot drift. The Cognito-only arm carries the rationale
+// for why it is `@aws_cognito_user_pools(...)` and never `@aws_auth(...)`.
+// This file is left with resource creation, which is what it is for.
 
 // Shared traversal types every callable surface reaches — `PageInfo` (relay
 // connections, injected by the stitcher) and the `CommandResult` members
@@ -299,6 +268,10 @@ let injectAwsAuth = (
   let iamQueryFieldPrefixes: array<string> = []
   let iamTypePrefixes: array<string> = []
 
+  // Collected across both entry kinds and refused once, so a deploy reports
+  // every offending field rather than the first one found.
+  let anonymousFields: array<string> = []
+
   let mutationAuthMap: Dict.t<array<string>> = Dict.make()
   mutationEntries->Array.forEach(entry => {
     if entry.systemCallable->Option.getOr(false) {
@@ -314,9 +287,10 @@ let injectAwsAuth = (
       fp
       ->Dict.toArray
       ->Array.forEach(((fieldName, permission)) => {
-        switch _permissionToCognitoGroups(permission) {
-        | Some(groups) => mutationAuthMap->Dict.set(fieldName, groups)
-        | None => mutationAuthMap->Dict.delete(fieldName)
+        switch AppSync_SdlDecorate.permissionToGate(permission) {
+        | Groups(groups) => mutationAuthMap->Dict.set(fieldName, groups)
+        | AnyAuthenticated => mutationAuthMap->Dict.delete(fieldName)
+        | Anonymous => anonymousFields->Array.push(fieldName)
         }
       })
     | None => ()
@@ -342,18 +316,28 @@ let injectAwsAuth = (
     }
     switch entry.permission {
     | Some(permission) =>
-      switch _permissionToCognitoGroups(permission) {
-      | Some(groups) =>
+      switch AppSync_SdlDecorate.permissionToGate(permission) {
+      | Groups(groups) =>
         queryAuthMap->Dict.set(entry.singleFieldName, groups)
         queryAuthMap->Dict.set(entry.listFieldName, groups)
-      | None =>
+      | AnyAuthenticated =>
         queryAuthMap->Dict.delete(entry.singleFieldName)
         queryAuthMap->Dict.delete(entry.listFieldName)
+      | Anonymous =>
+        // Both derived field names, because the spec declares one permission and
+        // the generator emits two fields from it; naming only one would send the
+        // author looking for a second declaration that does not exist.
+        anonymousFields->Array.push(entry.singleFieldName)
+        anonymousFields->Array.push(entry.listFieldName)
       }
     | None => ()
     }
   })
 
+  if anonymousFields->Array.length > 0 {
+    AppSync_SdlDecorate.refuseAnonymousFields(anonymousFields)
+  }
+
   // A field with no group restriction gets the group-less Cognito directive
   // rather than no directive at all. Same reachability under `defaultAction:
   // ALLOW`; the difference only shows once the default is DENY, where an
@@ -364,10 +348,10 @@ let injectAwsAuth = (
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
     let groups = mutationAuthMap->Dict.get(fieldName)
     if iamFields->Dict.get(fieldName)->Option.getOr(false) {
-      `${field}\n    ${_formatDualAuthDirective(groups)}`
+      `${field}\n    ${AppSync_SdlDecorate.formatDualAuthDirective(groups)}`
     } else {
       switch groups {
-      | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
+      | Some(groups) => `${field}\n    ${AppSync_SdlDecorate.formatCognitoGroupsDirective(groups)}`
       | None => `${field}\n    ${openDirective}`
       }
     }
@@ -380,10 +364,10 @@ let injectAwsAuth = (
       iamFields->Dict.get(fieldName)->Option.getOr(false) ||
         iamQueryFieldPrefixes->Array.some(p => fieldName->String.startsWith(p))
     if isIam {
-      `${field} ${_formatDualAuthDirective(groups)}`
+      `${field} ${AppSync_SdlDecorate.formatDualAuthDirective(groups)}`
     } else {
       switch groups {
-      | Some(groups) => `${field} ${_formatGroupsDirective(groups)}`
+      | Some(groups) => `${field} ${AppSync_SdlDecorate.formatCognitoGroupsDirective(groups)}`
       | None => `${field} ${openDirective}`
       }
     }
@@ -396,7 +380,7 @@ let injectAwsAuth = (
   let augmentedSubscriptions = parts.subscriptions->Array.map(field => {
     let fieldName = ReventlessCore.GraphQL_Stitcher.extractLeadingName(field)
     switch mutationAuthMap->Dict.get(fieldName) {
-    | Some(groups) => `${field}\n    ${_formatGroupsDirective(groups)}`
+    | Some(groups) => `${field}\n    ${AppSync_SdlDecorate.formatCognitoGroupsDirective(groups)}`
     | None => `${field}\n    ${openDirective}`
     }
   })
@@ -405,9 +389,9 @@ let injectAwsAuth = (
   // the node type, its Connection/Edge wrappers, and nested state types all
   // share the entry's returnTypeName prefix.
   let augmentedTypes = parts.types->Array.map(decl =>
-    switch _typeDeclName(decl) {
+    switch AppSync_SdlDecorate.typeDeclNameOf(decl) {
     | Some(name) if iamTypePrefixes->Array.some(p => name->String.startsWith(p)) =>
-      _stampTypeDualAuth(decl)
+      AppSync_SdlDecorate.stampTypeDualAuth(decl)
     | _ => decl
     }
   )

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -6,7 +6,6 @@ import * as Aws from "@pulumi/aws";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Nodecrypto from "node:crypto";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
-import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Effect$1 from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
@@ -107,49 +106,12 @@ async function waitForMergeSuccess(client, associationId, mergedApiIdentifier, m
   return Stdlib_JsError.throwWithMessage(`Source API association ` + associationId + ` on ` + mergedApiIdentifier + ` failed to merge (` + status + `): ` + detail);
 }
 
-function _permissionToCognitoGroups(permission) {
-  if (typeof permission !== "object") {
-    switch (permission) {
-      case "AllowAuthenticated" :
-      case "AllowAnonymous" :
-        return;
-      case "DenyAll" :
-        return ["__deny_all__"];
-    }
-  } else {
-    let groups = permission._0;
-    if (groups.length !== 0) {
-      return groups;
-    } else {
-      return ["__deny_all__"];
-    }
-  }
-}
-
-function _typeDeclName(decl) {
-  if (!decl.startsWith("type ")) {
-    return;
-  }
-  let rest = decl.slice(5, decl.length);
-  let i = rest.search(/[\s{]/);
-  let end = i !== -1 ? i : rest.length;
-  return rest.slice(0, end);
-}
-
-function _stampTypeDualAuth(decl) {
-  let i = Stdlib_String.indexOfOpt(decl, "{");
-  if (i !== undefined) {
-    return decl.slice(0, i) + "@aws_cognito_user_pools @aws_iam " + decl.slice(i, decl.length);
-  } else {
-    return decl;
-  }
-}
-
 function injectAwsAuth(fragment, mutationEntries, queryEntries) {
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
   let iamFields = {};
   let iamQueryFieldPrefixes = [];
   let iamTypePrefixes = [];
+  let anonymousFields = [];
   let mutationAuthMap = {};
   mutationEntries.forEach(entry => {
     if (Stdlib_Option.getOr(entry.systemCallable, false)) {
@@ -168,12 +130,16 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     if (fp !== undefined) {
       Object.entries(fp).forEach(param => {
         let fieldName = param[0];
-        let groups = _permissionToCognitoGroups(param[1]);
-        if (groups !== undefined) {
-          mutationAuthMap[fieldName] = groups;
+        let groups = AppSync_SdlDecorate$ReventlessAws.permissionToGate(param[1]);
+        if (typeof groups !== "object") {
+          if (groups === "AnyAuthenticated") {
+            return Stdlib_Dict.$$delete(mutationAuthMap, fieldName);
+          }
+          anonymousFields.push(fieldName);
           return;
         } else {
-          return Stdlib_Dict.$$delete(mutationAuthMap, fieldName);
+          mutationAuthMap[fieldName] = groups._0;
+          return;
         }
       });
       return;
@@ -198,16 +164,25 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     if (permission === undefined) {
       return;
     }
-    let groups = _permissionToCognitoGroups(permission);
-    if (groups !== undefined) {
-      queryAuthMap[entry.singleFieldName] = groups;
-      queryAuthMap[entry.listFieldName] = groups;
+    let groups = AppSync_SdlDecorate$ReventlessAws.permissionToGate(permission);
+    if (typeof groups !== "object") {
+      if (groups === "AnyAuthenticated") {
+        Stdlib_Dict.$$delete(queryAuthMap, entry.singleFieldName);
+        return Stdlib_Dict.$$delete(queryAuthMap, entry.listFieldName);
+      }
+      anonymousFields.push(entry.singleFieldName);
+      anonymousFields.push(entry.listFieldName);
       return;
     } else {
-      Stdlib_Dict.$$delete(queryAuthMap, entry.singleFieldName);
-      return Stdlib_Dict.$$delete(queryAuthMap, entry.listFieldName);
+      let groups$1 = groups._0;
+      queryAuthMap[entry.singleFieldName] = groups$1;
+      queryAuthMap[entry.listFieldName] = groups$1;
+      return;
     }
   });
+  if (anonymousFields.length !== 0) {
+    AppSync_SdlDecorate$ReventlessAws.refuseAnonymousFields(anonymousFields);
+  }
   let augmentedMutations = parts.mutations.map(field => {
     let fieldName = GraphQL_Stitcher$ReventlessCore.extractLeadingName(field);
     let groups = mutationAuthMap[fieldName];
@@ -241,9 +216,9 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     }
   });
   let augmentedTypes = parts.types.map(decl => {
-    let name = _typeDeclName(decl);
+    let name = AppSync_SdlDecorate$ReventlessAws.typeDeclNameOf(decl);
     if (name !== undefined && iamTypePrefixes.some(p => name.startsWith(p))) {
-      return _stampTypeDualAuth(decl);
+      return AppSync_SdlDecorate$ReventlessAws.stampTypeDualAuth(decl);
     } else {
       return decl;
     }
@@ -340,10 +315,6 @@ function generateFragment(mutationEntries, queryEntries) {
   return injectAwsAuth(fragment, mutationEntries, queryEntries);
 }
 
-let _formatGroupsDirective = AppSync_SdlDecorate$ReventlessAws.formatCognitoGroupsDirective;
-
-let _formatDualAuthDirective = AppSync_SdlDecorate$ReventlessAws.formatDualAuthDirective;
-
 let stampSharedIamTypes = AppSync_SdlDecorate$ReventlessAws.stampSharedIamTypes;
 
 let primaryAuthenticationType = "AMAZON_COGNITO_USER_POOLS";
@@ -357,11 +328,6 @@ export {
   _client,
   getClient,
   waitForMergeSuccess,
-  _permissionToCognitoGroups,
-  _formatGroupsDirective,
-  _formatDualAuthDirective,
-  _typeDeclName,
-  _stampTypeDualAuth,
   stampSharedIamTypes,
   injectAwsAuth,
   injectAwsAuthAll,

package/src/components/Api/AppSync_SdlDecorate.res

@@ -90,7 +90,11 @@ let formatCognitoGroupsDirective = (groups: array<string>): string => {
 
 // The group-less Cognito directive: reachable by any authenticated Cognito
 // caller. Emitted where a field or type is deliberately open — `AllowAuthenticated`,
-// `AllowAnonymous`, a field carrying no permission at all, and every object type.
+// a field carrying no permission at all, and every object type.
+//
+// NOT for `AllowAnonymous`: "any authenticated caller" is the inverse of what
+// that declares, and emitting this for it is the defect `permissionToGate` and
+// `refuseAnonymousFields` above exist to prevent.
 //
 // Under `userPoolConfig.defaultAction: ALLOW` this is a no-op: an undirectived
 // field is already reachable by any authenticated caller, so stamping it changes
@@ -112,6 +116,58 @@ let formatDualAuthDirective = (groups: option<array<string>>): string => {
   `${cognito} @aws_iam`
 }
 
+// ── What a declared permission asks this API to enforce ─────────────────────
+//
+// Lives here rather than beside the Pulumi resources because it is the same
+// concern as the directive vocabulary above: reading a spec-level rule and
+// deciding what the schema says. Keeping the mapping next to the strings it
+// maps onto is what stops a fourth spelling of a directive appearing.
+
+/** Three arms rather than an `option<array<string>>`, which is the shape this
+    had while it was wrong: the option form could not hold `AllowAuthenticated`
+    and `AllowAnonymous` apart, so both became `None` and emitted one directive.
+    AppSync can enforce the first and cannot express the second at all. */
+type fieldGate =
+  | Groups(array<string>)
+  | AnyAuthenticated
+  /** No directive can express this; the deploy is refused rather than gated
+      into its opposite. See `refuseAnonymousFields`. */
+  | Anonymous
+
+let permissionToGate = (permission: Reventless.Authorization.permission): fieldGate =>
+  switch permission {
+  | AllowGroups([]) => Groups(["__deny_all__"])
+  | AllowGroups(groups) => Groups(groups)
+  | DenyAll => Groups(["__deny_all__"])
+  | AllowAuthenticated => AnyAuthenticated
+  | AllowAnonymous => Anonymous
+  }
+
+/** The deploy-time refusal for fields declared `AllowAnonymous`, and the
+    sibling of `assertGateable` below: both refuse a schema that would claim a
+    gate it does not have. This one fires earlier, while the permission is still
+    a value — by SDL time the two permissions are indistinguishable. */
+let refuseAnonymousFields = (fieldNames: array<string>): 'a =>
+  JsError.throwWithMessage(
+    `Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` ++
+    `  ${fieldNames->Array.length->Int.toString} field(s) declare AllowAnonymous:\n` ++
+    `    ${fieldNames->Array.join(", ")}\n\n` ++
+    `AppSync has no anonymous authorization mode. This API is provisioned with\n` ++
+    `AMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\n` ++
+    `directive available is @aws_cognito_user_pools — which means ANY\n` ++
+    `AUTHENTICATED caller, the opposite of what the spec declares. Mutations have\n` ++
+    `no runtime authorization check to correct it: on this platform the directive\n` ++
+    `is the whole enforcement.\n\n` ++
+    `The local platform DOES honour AllowAnonymous (its resolvers call\n` ++
+    `Authorization.isAllowed), so a spec that passes locally can still not be\n` ++
+    `deployable here. That divergence is the reason this refuses instead of\n` ++
+    `emitting a directive that reads as gated and is not.\n\n` ++
+    `Anonymous fields on AWS are deferred. When they land it will be as a separate\n` ++
+    `API carrying only the unauthenticated fields. Do not add API_KEY to this one:\n` ++
+    `every field here would then have to say whether the key reaches it, and one\n` ++
+    `that forgot would be open. Until then, declare the field AllowAuthenticated\n` ++ `(or AllowGroups) and mean it.`,
+  )
+
 // Injects the Cognito group gate on ALL mutation, query, and subscription fields
 // in a fragment. `~iamFieldNames` opts the named mutation/query fields into
 // deploy-time IAM as well, appending the `@aws_iam` arm. Subscriptions are never
@@ -226,6 +282,31 @@ let stampAllTypesCognito = (sdl: string): string =>
   )
   ->Array.join("\n")
 
+// Insert the multi-auth pair into ONE type declaration's header, before its `{`.
+//
+// The sibling of `stampAllTypesCognito` and deliberately not folded into it:
+// that one sweeps a whole assembled SDL and fills in the Cognito-only arm for
+// anything undirectived, this one is applied to a declaration already chosen by
+// its caller and adds the IAM arm the traversal needs. Different input, different
+// directive, same header surgery.
+//
+// On a multi-auth API, object TYPES without auth directives are reachable only
+// via the default auth mode: a field-level `@aws_iam` admits the system caller to
+// the top-level field, but response shaping then walks the return types
+// (`…Connection` → `…Edge` → node → nested state types) and dies with "Not
+// Authorized to access <field> on type <T>" one level in. The group-less Cognito
+// arm matches the accessibility an undirectived type already has (entry gating
+// stays on the fields); the IAM arm admits the traversal.
+let stampTypeDualAuth = (decl: string): string =>
+  switch decl->String.indexOfOpt("{") {
+  | Some(i) =>
+    decl->String.slice(~start=0, ~end=i) ++
+    formatDualAuthDirective(None) ++
+    " " ++
+    decl->String.slice(~start=i, ~end=decl->String.length)
+  | None => decl
+  }
+
 // ── Deploy-time gate invariant ──────────────────────────────────────────────
 //
 // Refuse to push a schema that cannot be gated. This is the fail-closed

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -51,6 +51,39 @@ function formatDualAuthDirective(groups) {
   return cognito + ` @aws_iam`;
 }
 
+function permissionToGate(permission) {
+  if (typeof permission !== "object") {
+    switch (permission) {
+      case "AllowAuthenticated" :
+        return "AnyAuthenticated";
+      case "AllowAnonymous" :
+        return "Anonymous";
+      case "DenyAll" :
+        return {
+          TAG: "Groups",
+          _0: ["__deny_all__"]
+        };
+    }
+  } else {
+    let groups = permission._0;
+    if (groups.length !== 0) {
+      return {
+        TAG: "Groups",
+        _0: groups
+      };
+    } else {
+      return {
+        TAG: "Groups",
+        _0: ["__deny_all__"]
+      };
+    }
+  }
+}
+
+function refuseAnonymousFields(fieldNames) {
+  return Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` + (`  ` + fieldNames.length.toString() + ` field(s) declare AllowAnonymous:\n`) + (`    ` + fieldNames.join(", ") + `\n\n`) + `AppSync has no anonymous authorization mode. This API is provisioned with\nAMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\ndirective available is @aws_cognito_user_pools — which means ANY\nAUTHENTICATED caller, the opposite of what the spec declares. Mutations have\nno runtime authorization check to correct it: on this platform the directive\nis the whole enforcement.\n\nThe local platform DOES honour AllowAnonymous (its resolvers call\nAuthorization.isAllowed), so a spec that passes locally can still not be\ndeployable here. That divergence is the reason this refuses instead of\nemitting a directive that reads as gated and is not.\n\nAnonymous fields on AWS are deferred. When they land it will be as a separate\nAPI carrying only the unauthenticated fields. Do not add API_KEY to this one:\nevery field here would then have to say whether the key reaches it, and one\nthat forgot would be open. Until then, declare the field AllowAuthenticated\n(or AllowGroups) and mean it.`);
+}
+
 function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
   let iamFieldNames = iamFieldNamesOpt !== undefined ? iamFieldNamesOpt : [];
   let parts = GraphQL_Stitcher$ReventlessCore.decode(fragment);
@@ -122,6 +155,15 @@ function stampAllTypesCognito(sdl) {
   }).join("\n");
 }
 
+function stampTypeDualAuth(decl) {
+  let i = Stdlib_String.indexOfOpt(decl, "{");
+  if (i !== undefined) {
+    return decl.slice(0, i) + formatDualAuthDirective(undefined) + " " + decl.slice(i, decl.length);
+  } else {
+    return decl;
+  }
+}
+
 let enforcedDirectives = [
   "@aws_cognito_user_pools",
   "@aws_iam"
@@ -328,11 +370,14 @@ export {
   formatCognitoGroupsDirective,
   cognitoOpenDirective,
   formatDualAuthDirective,
+  permissionToGate,
+  refuseAnonymousFields,
   injectAwsAuthAll,
   sharedIamTypeNames,
   stampSharedIamTypes,
   stampUndirectivedFields,
   stampAllTypesCognito,
+  stampTypeDualAuth,
   enforcedDirectives,
   hasEnforcedDirective,
   rootOperationTypes,

package/src/plugin/cloner/ClonerRunner_Fargate.res

@@ -141,11 +141,7 @@ export const handler = async (event) => {
   let code = Pulumi.Archive.assetArchive(clonerArchiveContents)
   let sourceCodeHash = Util_Bundle.hashString(entryPointCode ++ "\n---\n" ++ loaderHash)
 
-  let layers =
-    Lambda.reventlessLayerArn
-    ->Option.map(arn => [arn->Pulumi.Input.make])
-    ->Option.getOr([])
-    ->Pulumi.Input.make
+  let layers = Lambda.reventlessLayers()
 
   let vpcStackName = Pulumi.Config.make(Some("vpc"))->Pulumi.Config.get("stack")->Option.getOrThrow
   let vpcConfig = Util_Vpc.getVpcConfig(~stackName=vpcStackName, ~outputName="vpc")

package/src/plugin/cloner/ClonerRunner_Fargate.res.mjs

@@ -87,7 +87,7 @@ export const handler = async (event) => {
   let loaderHash = Util_Bundle$ReventlessAws.addEsmLoaderAssets(clonerArchiveContents);
   let code = new (Pulumi.asset.AssetArchive)(clonerArchiveContents);
   let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(entryPointCode + "\n---\n" + loaderHash);
-  let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let layers = Lambda$PulumiAws.reventlessLayers();
   let vpcStackName = Stdlib_Option.getOrThrow(new Pulumi.Config("vpc").get("stack"), undefined);
   let vpcConfig = Util_Vpc$ReventlessAws.getVpcConfig(vpcStackName, "vpc");
   let secrets = Pulumi.all(secretUrns.map(urn => GetSecretVersion$PulumiAws.getSecretNames(urn).apply(names => names.map(name => ({

package/src/plugin/stack/Plugin_Stack.res

@@ -157,9 +157,13 @@ let makeUiBundleDistribution = (
   // shell, where blue/green between versions is wanted.
   let name = stableName ? pluginId : pluginId ++ "-" ++ bundleVersion
 
+  // Emptied on removal from a disposable stack: the manifest bake writes files
+  // here outside Pulumi, which would otherwise fail the destroy.
   let bucket = PulumiAws.S3.Bucket.make(
     ~name=name ++ "-bundle",
     ~args={
+      forceDestroy: (Util_StoreLayout.protectionOfDeployedStack() == Unprotected)
+        ->Pulumi.Input.make,
       tags: AWS.Tags.make(
         ~name=name ++ "-bundle",
         ~kind=ReventlessCore.ComponentType.Plugin,

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -11,6 +11,7 @@ import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_excep
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "../../adapter/AWS_Tags.res.mjs";
 import * as ClientCloudfront from "@aws-sdk/client-cloudfront";
+import * as Util_StoreLayout$ReventlessAws from "../../util/Util_StoreLayout.res.mjs";
 import * as Util_StaticBundle$ReventlessAws from "../../util/Util_StaticBundle.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
@@ -76,6 +77,7 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
   let servedBuckets = servedBucketsOpt !== undefined ? servedBucketsOpt : [];
   let name = stableName ? pluginId : pluginId + "-" + bundleVersion;
   let bucket = new (Aws.s3.Bucket)(name + "-bundle", {
+    forceDestroy: Util_StoreLayout$ReventlessAws.protectionOfDeployedStack() === "Unprotected",
     tags: AWS_Tags$ReventlessAws.make(name + "-bundle", "Plugin", "Hosting", "Plugin", undefined, undefined, pluginId, undefined)
   });
   new (Aws.s3.BucketPublicAccessBlock)(name + "-bundle-pab", {

package/src/util/Util_DeadLetterQueue.res

@@ -123,11 +123,7 @@ archiveContents->Dict.set(
 let code = Pulumi.Archive.assetArchive(archiveContents)
 let sourceCodeHash = Util_Bundle.hashString(entryPointCode)
 
-let layers =
-  Lambda.reventlessLayerArn
-  ->Option.map(arn => [arn->Pulumi.Input.make])
-  ->Option.getOr([])
-  ->Pulumi.Input.make
+let layers = Lambda.reventlessLayers()
 
 // This is the one Lambda in the framework built by hand rather than through
 // `RuntimeEnvironment_Lambda`, and it was the one Lambda whose logs Lambda

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -2,7 +2,6 @@
 
 import * as Aws from "@pulumi/aws";
 import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
-import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Lambda$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/Lambda/Lambda.res.mjs";
 import * as AWS$ReventlessAws from "../adapter/AWS.res.mjs";
@@ -76,7 +75,7 @@ let code = new (Pulumi.asset.AssetArchive)(archiveContents);
 
 let sourceCodeHash = Util_Bundle$ReventlessAws.hashString(entryPointCode);
 
-let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+let layers = Lambda$PulumiAws.reventlessLayers();
 
 let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, undefined, AWS_Tags$ReventlessAws.make(name + `LogGroup`, "Plugin", "Logs", "Plugin", undefined, undefined, undefined, undefined), opts, undefined);
 

package/src/util/Util_StoreLayout.res

@@ -86,13 +86,26 @@ Destroy semantics follow disposability, **not** layout.
 `reventless:wipeable`, but that authorises the reset tool to empty stores
 *deliberately*, after a scope prompt and a typed confirmation. It does not say a
 field rename may destroy a bucket by accident. Only stacks that are routinely
-torn down are unprotected.
+torn down are unprotected: a `pr-*` stack, or one that declares
+`reventless:disposable: "true"` — a try-out meant to be removed whole.
 */
 let protectionFor = (
   ~stack: string,
+  ~disposable: bool=false,
   ~ephemeralPrefixes: array<string>=defaultEphemeralPrefixes,
 ): protection =>
-  ephemeralPrefixes->Array.some(p => stack->String.startsWith(p)) ? Unprotected : Protected
+  disposable || ephemeralPrefixes->Array.some(p => stack->String.startsWith(p))
+    ? Unprotected
+    : Protected
+
+/** `protectionFor` the stack being deployed, reading its `reventless:disposable`
+    setting. The one function here that touches Pulumi. */
+let protectionOfDeployedStack = (): protection =>
+  protectionFor(
+    ~stack=Pulumi.Pulumi.getStackName(),
+    ~disposable=Pulumi.Config.make(Some("reventless"))->Pulumi.Config.get("disposable") ==
+      Some("true"),
+  )
 
 /**
 The bucket a store's objects live in.