@reventlessdev/reventless-aws 3.0.0-alpha.377 → 3.0.0-alpha.378

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.378 (2026-10-10)
+
+### Bug Fixes
+
+* an inbound translation is gated alike on every door, and encodes its commands by schema ([6ec3ce6](https://github.com/ReventlessDev/reventless-core/commit/6ec3ce672e53e2c162c64a90d103be691391be5e))
+
+
 # 3.0.0-alpha.377 (2026-10-08)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.377",
+  "version": "3.0.0-alpha.378",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -24,17 +24,17 @@
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.30",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.25",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.291",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.22",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.26",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.188",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.155",
+    "@reventlessdev/rescript-web": "1.0.0-alpha.7",
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.292",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.156",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.39",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.160"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.189",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.161"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/adapter/Runtime/DcbCommandTopicEntryPoint.mjs

@@ -168,7 +168,7 @@ export async function buildHandlersForConfig(config, opts = {}) {
 
   // Route 0 registry: InboundTranslationSlice receive handlers keyed by their
   // AppSync mutation field name. The resolver invokes this Lambda with
-  // {__inboundTranslation, fieldName, arguments}; the field name is
+  // {__inboundTranslation, fieldName, arguments, identity}; the field name is
   // `<pluginName>_<sliceName>` (Api_Naming.sliceMutationField — the deploy side
   // uses the same `name` that HANDLER_CONFIG.pluginName carries). The spec +
   // translation modules are the one untyped seam (dynamic import); the typed
@@ -316,11 +316,8 @@ export async function handler(event, context) {
   const [sqsHandler, cmdGenHandler, comp, plugin, inboundReceivers] = await initPromise;
 
   // Route 0: InboundTranslationSlice mutation — the AppSync resolver invokes this
-  // Lambda with `{__inboundTranslation: true, fieldName, arguments}` (no `command`,
-  // no `Records`). Dispatch to the field's receive handler, which translates +
-  // publishes and returns a commandOutcome JSON byte-compatible with Route 1's
-  // `commandOutcomeToJson`. Without this branch the payload fell through to Route 2
-  // and crashed on `event.records` being undefined.
+  // Lambda with `{__inboundTranslation: true, fieldName, arguments, identity}`.
+  // The field's receiver checks each translated command against `identity`.
   if (event.__inboundTranslation === true) {
     const fieldName = event.fieldName;
     const receiver = (inboundReceivers || {})[fieldName];
@@ -329,7 +326,7 @@ export async function handler(event, context) {
       throw new Error("no inbound translation receiver for field: " + fieldName);
     }
     log.debug("InboundTranslation invocation (" + fieldName + ")", { comp: "DcbCommandTopicRuntime" });
-    return await receiver(event.arguments);
+    return await receiver(event.arguments, event.identity ?? null);
   }
 
   // Route 1: AppSync direct invocation — payload carries the CommandGenerator.payload

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res

@@ -246,13 +246,8 @@ let buildSliceHandler = (
 }
 
 // ── Inbound translation receiver wiring (Route 0) ───────────────────────────
-// The DCB command Lambda is also the target of every InboundTranslationSlice
-// mutation on the plugin's API — its AppSync resolver invokes this Lambda with an
-// `{__inboundTranslation, fieldName, arguments}` payload. Building the per-field
-// `receive` here keeps the curried `InboundTranslationSlice_Callback.Make` functor
-// call compiler-checked (same rationale as `buildSliceHandler`) and mirrors the
-// in-process composite handler in `Dcb_Builder.res`, so the deployed surface and
-// the local surface encode the same `commandOutcome`.
+// Every inbound mutation's resolver invokes this Lambda with a `doorInvocation`.
+// The functor call lives here to be compiler-checked, as in `buildSliceHandler`.
 
 // The dynamically-imported Translation module — opaque; a clean pass-through to
 // the functor (only `translate` is read, inside the compiled callback).
@@ -262,6 +257,7 @@ type inboundCallback = {
   receive: (
     ReventlessInfra.CommandTopic.publishJsons,
     JSON.t,
+    ~caller: Reventless.Identity.t=?,
   ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>,
   auditLog: dict<ReventlessCore.InboundTranslationSlice_Callback.auditRow>,
 }
@@ -270,12 +266,9 @@ type inboundCallback = {
 )
 external makeInboundCallback: specModule => translationModule => inboundCallback = "Make"
 
-// Builds the inbound receive handler: run the slice's `receive` (which validates
-// the external input against the spec schema, translates, and publishes the mapped
-// commands via `publishJsons`), then — when an audit table name was threaded —
-// drain the in-memory audit log to that table (best-effort, matching
-// `InboundTranslationSlice_Builder`'s inline `syncToQueryDb`). Returns the
-// `commandOutcome` JSON, byte-compatible with the AppSync direct-invocation route.
+// Builds the inbound receive handler: `receive` for the resolver's caller, then
+// the request's audit row to its table when one was threaded. Answers the
+// `commandOutcome` JSON the AppSync direct-invocation route answers with.
 let buildInboundReceiver = (
   spec: specModule,
   translation: translationModule,
@@ -283,8 +276,12 @@ let buildInboundReceiver = (
   ~auditQueryDbOps: option<ReventlessCore.QueryDb_Adapter.operations>,
 ) => {
   let callback = makeInboundCallback(spec)(translation)
-  async (args: JSON.t): JSON.t => {
-    let result = await callback.receive(publishJsons, args)
+  async (args: JSON.t, identity: Nullable.t<Reventless.Identity.t>): JSON.t => {
+    let result = await callback.receive(
+      publishJsons,
+      args,
+      ~caller=ReventlessCore.InboundTranslationSlice_Callback.doorCaller(identity),
+    )
     switch auditQueryDbOps {
     | Some(ops) =>
       let id = result->ReventlessCore.InboundTranslationSlice_Callback.requestIdOf
@@ -294,12 +291,8 @@ let buildInboundReceiver = (
           row->Reventless.Util_Sury.toJson(
             ReventlessCore.InboundTranslationSlice_Callback.auditRowSchema,
           )
-        // A failed audit write must not fail the mutation (the command was
-        // already published), but it must not vanish either. `save` RESOLVES
-        // with `Error(_)` on a storage failure (it does not throw), so the
-        // result must be inspected — a bare `let _ = await ops.save(...)` would
-        // swallow the failure and leave the audit view permanently, silently
-        // empty. `try` still guards an unexpected reject.
+        // A failed audit write is logged, not raised: the commands are published.
+        // `save` resolves `Error(_)` rather than throwing, so its result is read.
         try {
           switch await ops.save(id, json, ReventlessCore.QueryDb.Overwrite, None) {
           | Ok() => ()
@@ -324,9 +317,7 @@ let buildInboundReceiver = (
     }
     result
     ->ReventlessCore.InboundTranslationSlice_Callback.receiveResultToOutcome
-    // `CommandTopic_Helpers`, not `CommandTopic`: the latter imports `Adapter`
-    // (→ `@pulumi/pulumi`) for a deploy-time helper, which would crash this
-    // runtime Lambda's cold start. The encoder itself lives in the pure Helpers.
+    // `CommandTopic_Helpers`, not `CommandTopic`, which imports `@pulumi/pulumi`.
     ->ReventlessCore.CommandTopic_Helpers.commandOutcomeToJson
   }
 }

package/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res.mjs

@@ -120,8 +120,8 @@ function buildSliceHandler(spec, behavior, scope, dcbEventLog) {
 
 function buildInboundReceiver(spec, translation, publishJsons, auditQueryDbOps) {
   let callback = InboundTranslationSlice_CallbackResMjs.Make(spec)(translation);
-  return async args => {
-    let result = await callback.receive(publishJsons, args);
+  return async (args, identity) => {
+    let result = await callback.receive(publishJsons, args, InboundTranslationSlice_Callback$ReventlessCore.doorCaller(identity));
     if (auditQueryDbOps !== undefined) {
       let id = InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result);
       let row = InboundTranslationSlice_Callback$ReventlessCore.takeAuditRow(callback.auditLog, id);

package/tests/AppSync_AdapterTest.res

@@ -149,6 +149,20 @@ describe("AppSync_Adapter.generateFragment", () => {
 // `@authorize` PPX annotations) into `@aws_cognito_user_pools(cognito_groups: [...])`
 // directives on the corresponding SDL fields.
 
+// Two constructors under different roles, the case one field gate must widen for.
+module TwoRuleFeed = {
+  @schema
+  type command = AddProduct({sku: string}) | AddCategory({sku: string})
+
+  let commandAuthorization = (command: command): Reventless.Authorization.rule<
+    Reventless.Role.name,
+  > =>
+    switch command {
+    | AddProduct(_) => AllowRoles([Reventless.Role.make("Merchandiser")])
+    | AddCategory(_) => AllowRoles([Reventless.Role.make("Admin")])
+    }
+}
+
 describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () => {
   // Minimal mutation fragment with two fields. Field names must match what
   // the entries declare so the stitcher's extractLeadingName can pair them.
@@ -225,6 +239,22 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     )->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "shop-merch-team"])`)
   })
 
+  // An inbound slice has one field for every constructor, so its gate admits any
+  // constructor's roles; each command is checked against its own in `receive`.
+  testSync("an inbound slice's field carries every constructor's groups", () => {
+    let permission = ReventlessCore.Dcb_Builder.inboundDoorPermission(
+      TwoRuleFeed.commandSchema,
+      TwoRuleFeed.commandAuthorization,
+    )
+    let fp = Dict.fromArray(permission->Option.mapOr([], p => [("p_TwoRuleFeed", p)]))
+    let entry = mutationEntry(~fieldNames=["p_TwoRuleFeed"], ~fieldPermissions=fp)
+    let frag = makeFragment(["p_TwoRuleFeed(sku: String!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    expect(
+      decodeFragment(aug).mutations->Array.getUnsafe(0),
+    )->toContain(`@aws_cognito_user_pools(cognito_groups: ["Merchandiser", "Admin"])`)
+  })
+
   testSync("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Dict.fromArray([("p_Add", Reventless.Authorization.AllowAuthenticated)])
     let entry = mutationEntry(~fieldNames=["p_Add"], ~fieldPermissions=fp)

package/tests/AppSync_AdapterTest.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Dcb_Builder$ReventlessCore from "@reventlessdev/reventless-core/src/components/Dcb/Dcb_Builder.res.mjs";
 import * as AppSync_Adapter$ReventlessAws from "../src/components/Api/AppSync_Adapter.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
 import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
@@ -109,6 +110,36 @@ globalThis.describe("AppSync_Adapter.generateFragment", () => {
   });
 });
 
+let commandSchema = Sury.union([
+  Sury.$schema(s => ({
+    TAG: "AddProduct",
+    sku: s.m(Sury.string)
+  })),
+  Sury.$schema(s => ({
+    TAG: "AddCategory",
+    sku: s.m(Sury.string)
+  }))
+]);
+
+function commandAuthorization(command) {
+  if (command.TAG === "AddProduct") {
+    return {
+      TAG: "AllowRoles",
+      _0: ["Merchandiser"]
+    };
+  } else {
+    return {
+      TAG: "AllowRoles",
+      _0: ["Admin"]
+    };
+  }
+}
+
+let TwoRuleFeed = {
+  commandSchema: commandSchema,
+  commandAuthorization: commandAuthorization
+};
+
 globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () => {
   let makeFragment = (mutationFields, queryFields) => GraphQL_Stitcher$ReventlessCore.encode({
     types: [],
@@ -169,6 +200,17 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     Role$Reventless.clearGroups();
     globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "shop-merch-team"])`);
   });
+  globalThis.test("an inbound slice's field carries every constructor's groups", () => {
+    let permission = Dcb_Builder$ReventlessCore.inboundDoorPermission(commandSchema, commandAuthorization);
+    let fp = Object.fromEntries(Stdlib_Option.mapOr(permission, [], p => [[
+        "p_TwoRuleFeed",
+        p
+      ]]));
+    let entry = mutationEntry(["p_TwoRuleFeed"], fp);
+    let frag = makeFragment(["p_TwoRuleFeed(sku: String!): String"], []);
+    let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Merchandiser", "Admin"])`);
+  });
   globalThis.test("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Object.fromEntries([[
         "p_Add",
@@ -875,5 +917,6 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
 
 export {
   decodeFragment,
+  TwoRuleFeed,
 }
 /*  Not a pure module */

package/tests/DcbInboundReceiverStub.mjs

@@ -0,0 +1,12 @@
+// `buildInboundReceiver` over the EpInboundTestSlice fixture, publishing into an
+// array. Answers `[outcome, publishedCount]`.
+import { buildInboundReceiver } from "@reventlessdev/reventless-aws/src/adapter/Runtime/DcbCommandTopicEntryPoint_Ops.res.mjs";
+import * as spec from "./EpInboundTestSlice.res.mjs";
+import * as translation from "./EpInboundTestSliceTranslation.res.mjs";
+
+export async function receiveWithStubPublish(args, identity) {
+  const published = [];
+  const receive = buildInboundReceiver(spec, translation, async (cmds) => { published.push(...cmds); }, undefined);
+  const outcome = await receive(args, identity);
+  return [outcome, published.length];
+}

package/tests/DcbInboundTranslationRoutingTest.res

@@ -39,10 +39,33 @@ let routeInbound: JSON.t => promise<JSON.t> = %raw(`
     // Mirror handler's Route 0 dispatch.
     const receiver = (inboundReceivers || {})[event.fieldName];
     if (receiver === undefined) throw new Error("no inbound receiver for " + event.fieldName);
-    return await receiver(event.arguments);
+    return await receiver(event.arguments, event.identity ?? null);
   }
 `)
 
+// The receiver over the fixture modules with a publish that records, so an
+// admitted caller's commands are seen without SQS.
+@module("./DcbInboundReceiverStub.mjs")
+external receiveWithStubPublish: (
+  JSON.t,
+  Nullable.t<Reventless.Identity.t>,
+) => promise<(JSON.t, int)> = "receiveWithStubPublish"
+
+let usdArguments: JSON.t =
+  Dict.fromArray([
+    ("sku", "SKU-1"->JSON.Encode.string),
+    ("currency", "USD"->JSON.Encode.string),
+  ])->JSON.Encode.object
+
+let cognito = (groups): Reventless.Identity.t => {
+  userId: "u-1",
+  username: "alice",
+  groups,
+  provider: Cognito,
+}
+
+let typenameOf = (outcome: JSON.t) => outcome->JSON.stringify
+
 let inboundEvent = (~fieldName, ~currency): JSON.t => {
   let arguments = Dict.fromArray([
     ("sku", "SKU-1"->JSON.Encode.string),
@@ -70,4 +93,29 @@ describe("DcbCommandTopicEntryPoint Route 0 (InboundTranslation)", () => {
       expect(s->String.includes("Unsupported currency"))->toBe(true)
     },
   )
+
+  test("the payload's caller reaches the per-command check", async () => {
+    let (outcome, count) = await receiveWithStubPublish(
+      usdArguments,
+      Nullable.make(cognito(["Ops"])),
+    )
+    expect(typenameOf(outcome)->String.includes("Forbidden"))->toBe(true)
+    expect(count)->toBe(0)
+  })
+
+  test("a caller holding the command's role publishes", async () => {
+    let (outcome, count) = await receiveWithStubPublish(
+      usdArguments,
+      Nullable.make(cognito(["Admin"])),
+    )
+    expect(typenameOf(outcome)->String.includes("CommandAccepted"))->toBe(true)
+    expect(count)->toBe(1)
+  })
+
+  // A resolver that identified nobody must not be taken for the platform itself.
+  test("a payload with no identity is refused", async () => {
+    let (outcome, count) = await receiveWithStubPublish(usdArguments, Nullable.null)
+    expect(typenameOf(outcome)->String.includes("Forbidden"))->toBe(true)
+    expect(count)->toBe(0)
+  })
 })

package/tests/DcbInboundTranslationRoutingTest.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as DcbInboundReceiverStubMjs from "./DcbInboundReceiverStub.mjs";
 
 let routeInbound = (async (event) => {
     const { buildHandlersForConfig } = await import(
@@ -24,9 +25,37 @@ let routeInbound = (async (event) => {
     // Mirror handler's Route 0 dispatch.
     const receiver = (inboundReceivers || {})[event.fieldName];
     if (receiver === undefined) throw new Error("no inbound receiver for " + event.fieldName);
-    return await receiver(event.arguments);
+    return await receiver(event.arguments, event.identity ?? null);
   });
 
+function receiveWithStubPublish(prim0, prim1) {
+  return DcbInboundReceiverStubMjs.receiveWithStubPublish(prim0, prim1);
+}
+
+let usdArguments = Object.fromEntries([
+  [
+    "sku",
+    "SKU-1"
+  ],
+  [
+    "currency",
+    "USD"
+  ]
+]);
+
+function cognito(groups) {
+  return {
+    userId: "u-1",
+    username: "alice",
+    groups: groups,
+    provider: "Cognito"
+  };
+}
+
+function typenameOf(outcome) {
+  return JSON.stringify(outcome);
+}
+
 function inboundEvent(fieldName, currency) {
   let $$arguments = Object.fromEntries([
     [
@@ -62,10 +91,29 @@ globalThis.describe("DcbCommandTopicEntryPoint Route 0 (InboundTranslation)", ()
     globalThis.expect(s.includes("CommandRejected")).toBe(true);
     globalThis.expect(s.includes("Unsupported currency")).toBe(true);
   });
+  globalThis.test("the payload's caller reaches the per-command check", async () => {
+    let match = await DcbInboundReceiverStubMjs.receiveWithStubPublish(usdArguments, cognito(["Ops"]));
+    globalThis.expect(JSON.stringify(match[0]).includes("Forbidden")).toBe(true);
+    globalThis.expect(match[1]).toBe(0);
+  });
+  globalThis.test("a caller holding the command's role publishes", async () => {
+    let match = await DcbInboundReceiverStubMjs.receiveWithStubPublish(usdArguments, cognito(["Admin"]));
+    globalThis.expect(JSON.stringify(match[0]).includes("CommandAccepted")).toBe(true);
+    globalThis.expect(match[1]).toBe(1);
+  });
+  globalThis.test("a payload with no identity is refused", async () => {
+    let match = await DcbInboundReceiverStubMjs.receiveWithStubPublish(usdArguments, null);
+    globalThis.expect(JSON.stringify(match[0]).includes("Forbidden")).toBe(true);
+    globalThis.expect(match[1]).toBe(0);
+  });
 });
 
 export {
   routeInbound,
+  receiveWithStubPublish,
+  usdArguments,
+  cognito,
+  typenameOf,
   inboundEvent,
 }
 /* routeInbound Not a pure module */

package/tests/EpInboundTestSlice.res

@@ -1,7 +1,5 @@
-// Minimal InboundTranslationSlice spec fixture for the DCB entry-point Route 0
-// routing test (DcbInboundTranslationRoutingTest). Hand-written — not a plugin
-// component, so no folder-based ppx; only the fields
-// InboundTranslationSlice_Callback.Make reads at runtime are provided.
+// Inbound spec fixture for DcbInboundTranslationRoutingTest. Hand-written, so it
+// declares the members the PPX would otherwise inject.
 
 let name = "EpInboundTest"
 let moduleUrl = "ep-inbound-test://spec"
@@ -17,3 +15,8 @@ type command = AddThing({thingId: string})
 
 let targetName = "AddThing"
 let externalSystem: option<string> = Some("TestFeed")
+
+type role = Reventless.Role.name
+let commandAuthorization = (_: command): Reventless.Authorization.rule<role> => AllowRoles([
+  Reventless.Role.make("Admin"),
+])

package/tests/EpInboundTestSlice.res.mjs

@@ -12,6 +12,13 @@ let commandSchema = Sury.$schema(s => ({
   thingId: s.m(Sury.string)
 }));
 
+function commandAuthorization(param) {
+  return {
+    TAG: "AllowRoles",
+    _0: ["Admin"]
+  };
+}
+
 let name = "EpInboundTest";
 
 let moduleUrl = "ep-inbound-test://spec";
@@ -27,5 +34,6 @@ export {
   commandSchema,
   targetName,
   externalSystem,
+  commandAuthorization,
 }
 /* externalInputSchema Not a pure module */