@reventlessdev/reventless-aws 3.0.0-alpha.383 → 3.0.0-alpha.384

package/CHANGELOG.md

@@ -3,6 +3,19 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.384 (2026-10-16)
+
+* fix(auth)!: only operators read the framework's own stores ([a2fd202](https://github.com/ReventlessDev/reventless-core/commit/a2fd2022b6876dae855b185df7f8263353fc971d))
+
+### BREAKING CHANGES
+
+* a caller outside the elevated groups is refused the
+framework's to-do, schedule and audit stores. On AWS, a roles-gated
+view's …ByIds, …Refs, …Items and …By<Index> fields refuse callers
+outside its roles.
+
+
+
 # 3.0.0-alpha.383 (2026-10-16)
 
 * feat!(automation): schedules set by events ([53bc436](https://github.com/ReventlessDev/reventless-core/commit/53bc4363dffce81ef36475728bf0dae704716021))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.383",
+  "version": "3.0.0-alpha.384",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -23,18 +23,18 @@
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.32",
-    "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.29",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.29",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
+    "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.193",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.297",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.194",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.161",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.40",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.296",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.160",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.165"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.166"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/components/Api/AppSync_Adapter.res

@@ -309,21 +309,18 @@ let injectAwsAuth = (
       iamQueryFieldPrefixes->Array.push(entry.listFieldName)
       iamTypePrefixes->Array.push(entry.returnTypeName)
     }
+    // Every door the entry emits: the resolvers here do not check the rule, so a
+    // by-ids or by-index field left to the open directive reads the gated rows.
+    let fieldNames = ReventlessCore.GraphQL_FragmentGenerator.queryFieldNamesOf(entry)
     switch entry.authorization {
-    | Some({group}) =>
-      queryAuthMap->Dict.set(entry.singleFieldName, [group])
-      queryAuthMap->Dict.set(entry.listFieldName, [group])
+    | Some({group}) => fieldNames->Array.forEach(f => queryAuthMap->Dict.set(f, [group]))
     | None => ()
     }
     switch entry.permission {
     | Some(permission) =>
       switch AppSync_SdlDecorate.permissionToGate(permission) {
-      | Groups(groups) =>
-        queryAuthMap->Dict.set(entry.singleFieldName, groups)
-        queryAuthMap->Dict.set(entry.listFieldName, groups)
-      | AnyAuthenticated =>
-        queryAuthMap->Dict.delete(entry.singleFieldName)
-        queryAuthMap->Dict.delete(entry.listFieldName)
+      | Groups(groups) => fieldNames->Array.forEach(f => queryAuthMap->Dict.set(f, groups))
+      | AnyAuthenticated => fieldNames->Array.forEach(f => queryAuthMap->Dict.delete(f))
       | Anonymous =>
         // Both derived field names, because the spec declares one permission and
         // the generator emits two fields from it; naming only one would send the

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -154,11 +154,13 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
       iamQueryFieldPrefixes.push(entry.listFieldName);
       iamTypePrefixes.push(entry.returnTypeName);
     }
+    let fieldNames = GraphQL_FragmentGenerator$ReventlessCore.queryFieldNamesOf(entry);
     let match = entry.authorization;
     if (match !== undefined) {
       let group = match.group;
-      queryAuthMap[entry.singleFieldName] = [group];
-      queryAuthMap[entry.listFieldName] = [group];
+      fieldNames.forEach(f => {
+        queryAuthMap[f] = [group];
+      });
     }
     let permission = entry.permission;
     if (permission === undefined) {
@@ -167,16 +169,17 @@ function injectAwsAuth(fragment, mutationEntries, queryEntries) {
     let groups = AppSync_SdlDecorate$ReventlessAws.permissionToGate(permission);
     if (typeof groups !== "object") {
       if (groups === "AnyAuthenticated") {
-        Stdlib_Dict.$$delete(queryAuthMap, entry.singleFieldName);
-        return Stdlib_Dict.$$delete(queryAuthMap, entry.listFieldName);
+        fieldNames.forEach(f => Stdlib_Dict.$$delete(queryAuthMap, f));
+        return;
       }
       anonymousFields.push(entry.singleFieldName);
       anonymousFields.push(entry.listFieldName);
       return;
     } else {
       let groups$1 = groups._0;
-      queryAuthMap[entry.singleFieldName] = groups$1;
-      queryAuthMap[entry.listFieldName] = groups$1;
+      fieldNames.forEach(f => {
+        queryAuthMap[f] = groups$1;
+      });
       return;
     }
   });

package/tests/AppSync_AdapterTest.res

@@ -606,6 +606,58 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       )
     },
   )
+
+  // The resolvers check no rule, so a door the gate misses reads the gated rows.
+  // Run through the real generator, so a door it adds later is covered too.
+  testSync("a roles-gated entry's every generated door carries its groups", () => {
+    let byCategory: Reventless.ReadModel.indexConfig = {
+      index: "byCategory",
+      type_: "S",
+      idField: "categoryId",
+      projectionType: ALL,
+    }
+    let gated = (
+      ~single,
+      ~list,
+      ~subIdField=?,
+      ~indexQueries=?,
+    ): ReventlessInfra.Api.querySchemaEntry => {
+      singleFieldName: single,
+      listFieldName: list,
+      returnTypeName: single,
+      stateSchema: S.unknown,
+      authorization: None,
+      permission: AllowRoles([Reventless.Role.make("Admin")]),
+      ?subIdField,
+      ?indexQueries,
+    }
+    let entries = [
+      gated(~single="p_Item", ~list="p_Items", ~indexQueries=[byCategory]),
+      gated(~single="p_Line", ~list="p_Lines", ~subIdField="lineId"),
+    ]
+    let frag = ReventlessCore.GraphQL_FragmentGenerator.generate(
+      ~mutationEntries=[],
+      ~queryEntries=entries,
+    )
+    let queries = (
+      AppSync_Adapter.injectAwsAuth(
+        frag,
+        ~mutationEntries=[],
+        ~queryEntries=entries,
+      )->decodeFragment
+    ).queries
+    let names = queries->Array.map(ReventlessCore.GraphQL_Stitcher.extractLeadingName)
+    expect(
+      ["p_ItemsByIds", "p_ItemsRefs", "p_ItemByCategory", "p_LineItems"]->Array.every(
+        door => names->Array.includes(door),
+      ),
+    )->toBe(true)
+    expect(
+      queries->Array.filter(
+        field => !(field->String.includes(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)),
+      ),
+    )->toEqual([])
+  })
 })
 
 // ── Type-level dual-auth ─────────────────────────────────────────────────────

package/tests/AppSync_AdapterTest.res.mjs

@@ -12,6 +12,7 @@ import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core
 import * as Platform_AdminApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminApi.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "../src/components/Api/AppSync_SdlDecorate.res.mjs";
 import * as PluginBaseFragment$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/api/PluginBaseFragment.res.mjs";
+import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
 globalThis.describe("AppSync_Adapter.sha256Hex", () => {
   globalThis.test("returns a 64-character hex string", () => {
@@ -596,6 +597,40 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
       }
     });
   });
+  globalThis.test("a roles-gated entry's every generated door carries its groups", () => {
+    let gated = (single, list, subIdField, indexQueries) => ({
+      singleFieldName: single,
+      listFieldName: list,
+      returnTypeName: single,
+      stateSchema: Sury.unknown,
+      authorization: undefined,
+      permission: {
+        TAG: "AllowRoles",
+        _0: ["Admin"]
+      },
+      subIdField: subIdField,
+      indexQueries: indexQueries
+    });
+    let entries = [
+      gated("p_Item", "p_Items", undefined, [{
+          index: "byCategory",
+          type_: "S",
+          idField: "categoryId",
+          projectionType: "ALL"
+        }]),
+      gated("p_Line", "p_Lines", "lineId", undefined)
+    ];
+    let frag = GraphQL_FragmentGenerator$ReventlessCore.generate([], entries);
+    let queries = GraphQL_Stitcher$ReventlessCore.decode(AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [], entries)).queries;
+    let names = queries.map(GraphQL_Stitcher$ReventlessCore.extractLeadingName);
+    globalThis.expect([
+      "p_ItemsByIds",
+      "p_ItemsRefs",
+      "p_ItemByCategory",
+      "p_LineItems"
+    ].every(door => names.includes(door))).toBe(true);
+    globalThis.expect(queries.filter(field => !field.includes(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`))).toEqual([]);
+  });
 });
 
 globalThis.describe("AppSync_Adapter — type-level dual-auth", () => {