@reventlessdev/reventless-core 3.0.0-alpha.183 → 3.0.0-alpha.185

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.185 (2026-07-27)
+
+### Bug Fixes
+
+* **api:** don't inject id: ID! into multi-variant DCB slice mutations ([03cfaad](https://github.com/ReventlessDev/reventless-core/commit/03cfaadce3bee3d7010835edc10f57ab45ddfa5b))
+
+
+# 3.0.0-alpha.184 (2026-07-27)
+
+### Bug Fixes
+
+* **aws:** grant DCB command Lambda write access to InboundTranslationSlice audit tables ([2c445fa](https://github.com/ReventlessDev/reventless-core/commit/2c445faf9692573d0eab2f0d4a456e8c5d723b41))
+
+
 # 3.0.0-alpha.183 (2026-07-27)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.183",
+  "version": "3.0.0-alpha.185",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -29,16 +29,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.31",
-    "@reventlessdev/rescript-fast-csv": "1.2.0-alpha.14",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.13",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
+    "@reventlessdev/rescript-fast-csv": "1.2.0-alpha.14",
     "@reventlessdev/rescript-node-streams": "1.1.0-alpha.13",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.13",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
-    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
     "@reventlessdev/rescript-ssh2": "1.1.0-alpha.14",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.105",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.81"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.106",
+    "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.81",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.29"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -396,6 +396,12 @@ let generate = (
 
   mutationEntries->Array.forEach(entry => {
     let schema = entry.commandSchema
+    // Aggregates carry the instance id as a separate `id: ID!` argument ahead of
+    // the command payload; DCB slices don't (their key field is part of the
+    // payload). A multi-variant slice command is a sury `Union` just like an
+    // aggregate command, so the injection must key off the entry flag, not the
+    // schema shape — see `mutationSchemaEntry.injectIdArg`.
+    let injectIdArg = entry.injectIdArg->Option.getOr(true)
     switch schema {
     | Union({anyOf}) =>
       // Map each fieldName to its variant in anyOf by matching the constructor
@@ -433,7 +439,9 @@ let generate = (
           variantSchema,
         ) {
         | Some(field) =>
-          let withId = if field->String.includes("(") {
+          let withId = if !injectIdArg {
+            field
+          } else if field->String.includes("(") {
             field->String.replace(`${fieldName}(`, `${fieldName}(id: ID!, `)
           } else {
             field->String.replace(`${fieldName}:`, `${fieldName}(id: ID!):`)
@@ -442,7 +450,10 @@ let generate = (
         | None =>
           // Payload-less variant (S.literal("Ctor")) — no Object fields to
           // derive args from, but still a valid mutation.
-          mutations->Array.push(`  ${fieldName}(id: ID!): CommandResult!`)
+          let field = injectIdArg
+            ? `  ${fieldName}(id: ID!): CommandResult!`
+            : `  ${fieldName}: CommandResult!`
+          mutations->Array.push(field)
         }
       })
     | Object(_) =>

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -319,6 +319,7 @@ function generate(mutationEntries, queryEntries) {
   let constructorNameOf = fieldName => Stdlib_Option.getOr(fieldName.split("_")[fieldName.split("_").length - 1 | 0], fieldName);
   mutationEntries.forEach(entry => {
     let schema = entry.commandSchema;
+    let injectIdArg = Stdlib_Option.getOr(entry.injectIdArg, true);
     switch (schema.type) {
       case "object" :
         let fieldName = Stdlib_Option.getOr(entry.fieldNames[0], "");
@@ -361,11 +362,14 @@ function generate(mutationEntries, queryEntries) {
           let variantSchema = variantIndex >= 0 ? Stdlib_Option.getOr(anyOf[variantIndex], schema) : schema;
           let field = deriveMutationFieldFromObject(fieldName, types, seenTypes, variantSchema);
           if (field !== undefined) {
-            let withId = field.includes("(") ? field.replace(fieldName + `(`, fieldName + `(id: ID!, `) : field.replace(fieldName + `:`, fieldName + `(id: ID!):`);
+            let withId = injectIdArg ? (
+                field.includes("(") ? field.replace(fieldName + `(`, fieldName + `(id: ID!, `) : field.replace(fieldName + `:`, fieldName + `(id: ID!):`)
+              ) : field;
             mutations.push(withId);
             return;
           }
-          mutations.push(`  ` + fieldName + `(id: ID!): CommandResult!`);
+          let field$1 = injectIdArg ? `  ` + fieldName + `(id: ID!): CommandResult!` : `  ` + fieldName + `: CommandResult!`;
+          mutations.push(field$1);
         });
         return;
       default:

package/src/components/Dcb/Dcb_Builder.res

@@ -739,12 +739,19 @@ module Make = (
             composite->Obj.magic
           })
 
-        // Resources the sync Lambda needs access to
+        // Resources the sync Lambda needs access to. An InboundTranslationSlice
+        // exposes its audit table under `queryDb.resources` — its top-level
+        // `resources` is empty — and the sync DCB command Lambda is the Route 0
+        // target that writes those audit rows. Granting only `outputs.resources`
+        // left the Lambda role without `PutItem` on the audit table, so every
+        // audit write failed with AccessDenied (swallowed at the write site,
+        // surfacing only as a permanently empty audit view). Include the audit
+        // table's resources so the role can write it.
         let dcbResources = Array.concat(
           stateChangeSlicesOutputs->Dict.valuesToArray->Array.flatMap(outputs => outputs.resources),
           inboundTranslationSlicesOutputs
           ->Dict.valuesToArray
-          ->Array.flatMap(outputs => outputs.resources),
+          ->Array.flatMap(outputs => Array.concat(outputs.resources, outputs.queryDb.resources)),
         )
 
         // Resources the async Lambda needs access to
@@ -907,6 +914,10 @@ module Make = (
                 ReventlessInfra.Api.fieldNames: fieldSpecs->Array.map(((f, _)) => f),
                 commandSchema,
                 fieldPermissions,
+                // Slice key fields (e.g. `orderId`) are payload args; there is no
+                // separate aggregate `id`. A multi-variant slice command is a sury
+                // `Union`, so without this the generator would inject `id: ID!`.
+                injectIdArg: false,
                 systemCallable: systemCallableComponents->Array.includes(S.Spec.name),
                 linkedViews: ?sliceDef->Option.map(d => d.linkedViews),
                 consistencyRead: ?sliceDef->Option.flatMap(d => d.consistencyRead),
@@ -931,6 +942,7 @@ module Make = (
               ReventlessInfra.Api.fieldNames: [fieldName],
               commandSchema: ITS.Spec.externalInputSchema->S.castToUnknown,
               fieldPermissions,
+              injectIdArg: false,
             }
           })
 

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -398,7 +398,7 @@ function Make(DcbEventLogStorage) {
           }
         };
       });
-      let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources));
+      let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources.concat(outputs.queryDb.resources)));
       let asyncDcbResources = Object.values(asyncStateChangeSlicesOutputs).flatMap(outputs => outputs.resources);
       let inboundFieldNames = inboundTranslationSliceData.map(param => param[1]);
       let inboundSchemas = inboundTranslationSliceData.map(param => param[3]);
@@ -484,6 +484,7 @@ function Make(DcbEventLogStorage) {
           commandSchema: commandSchema,
           fieldPermissions: fieldPermissions,
           systemCallable: systemCallableComponents.includes(S.Spec.name),
+          injectIdArg: false,
           linkedViews: Stdlib_Option.map(sliceDef, d => d.linkedViews),
           consistencyRead: Stdlib_Option.flatMap(sliceDef, d => d.consistencyRead)
         };
@@ -498,7 +499,8 @@ function Make(DcbEventLogStorage) {
         return {
           fieldNames: [fieldName],
           commandSchema: ITS.Spec.externalInputSchema,
-          fieldPermissions: fieldPermissions
+          fieldPermissions: fieldPermissions,
+          injectIdArg: false
         };
       });
       let stateViewEntries = stateViewSlices.map(V => {

package/tests/api/GraphQL_FragmentGeneratorTest.res

@@ -0,0 +1,49 @@
+open JestGlobals
+
+// A multi-variant command union serializes as a sury `Union`, the same shape an
+// aggregate command produces. The generator must decide whether to inject the
+// aggregate-style `id: ID!` argument from the entry's `injectIdArg` flag, not
+// from the schema shape — otherwise a multi-variant DCB slice (e.g. CancelOrder
+// + @noApi ReopenOrder) wrongly inherits a spurious `id: ID!` and callers that
+// send only the slice's own key field get `MissingFieldArgument: id`.
+module OrderSliceCmd = {
+  @schema
+  type command =
+    | CancelOrder({orderId: string})
+    | ReopenOrder({orderId: string})
+}
+
+let mutationFor = (fragment, needle) =>
+  GraphQL_Stitcher.decode(fragment).mutations->Array.find(m => m->String.includes(needle))
+
+describe("GraphQL_FragmentGenerator.generate mutation id injection", () => {
+  testSync("multi-variant slice entry (injectIdArg: false) omits the id argument", () => {
+    let fragment = GraphQL_FragmentGenerator.generate(
+      ~mutationEntries=[
+        {
+          ReventlessInfra.Api.fieldNames: ["Ordering_CancelOrder"],
+          commandSchema: OrderSliceCmd.commandSchema->S.castToUnknown,
+          injectIdArg: false,
+        },
+      ],
+      ~queryEntries=[],
+    )
+    let field = mutationFor(fragment, "Ordering_CancelOrder")->Option.getOr("")
+    expect(field->String.includes("orderId"))->toBe(true)
+    expect(field->String.includes("id: ID!"))->toBe(false)
+  })
+
+  testSync("aggregate-style entry (default) injects id: ID! ahead of the payload", () => {
+    let fragment = GraphQL_FragmentGenerator.generate(
+      ~mutationEntries=[
+        {
+          ReventlessInfra.Api.fieldNames: ["Ordering_CancelOrder"],
+          commandSchema: OrderSliceCmd.commandSchema->S.castToUnknown,
+        },
+      ],
+      ~queryEntries=[],
+    )
+    let field = mutationFor(fragment, "Ordering_CancelOrder")->Option.getOr("")
+    expect(field->String.includes("id: ID!, orderId"))->toBe(true)
+  })
+})

package/tests/api/GraphQL_FragmentGeneratorTest.res.mjs

@@ -0,0 +1,57 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as GraphQL_Stitcher$ReventlessCore from "../../src/components/Api/GraphQL_Stitcher.res.mjs";
+import * as GraphQL_FragmentGenerator$ReventlessCore from "../../src/components/Api/GraphQL_FragmentGenerator.res.mjs";
+
+let commandSchema = S.union([
+  S.schema(s => ({
+    TAG: "CancelOrder",
+    orderId: s.m(S.string)
+  })),
+  S.schema(s => ({
+    TAG: "ReopenOrder",
+    orderId: s.m(S.string)
+  }))
+]);
+
+function commandAuthorization(param) {
+  return "AllowAuthenticated";
+}
+
+let OrderSliceCmd = {
+  commandSchema: commandSchema,
+  commandAuthorization: commandAuthorization
+};
+
+function mutationFor(fragment, needle) {
+  return GraphQL_Stitcher$ReventlessCore.decode(fragment).mutations.find(m => m.includes(needle));
+}
+
+globalThis.describe("GraphQL_FragmentGenerator.generate mutation id injection", () => {
+  globalThis.test("multi-variant slice entry (injectIdArg: false) omits the id argument", () => {
+    let fragment = GraphQL_FragmentGenerator$ReventlessCore.generate([{
+        fieldNames: ["Ordering_CancelOrder"],
+        commandSchema: commandSchema,
+        injectIdArg: false
+      }], []);
+    let field = Stdlib_Option.getOr(mutationFor(fragment, "Ordering_CancelOrder"), "");
+    globalThis.expect(field.includes("orderId")).toBe(true);
+    globalThis.expect(field.includes("id: ID!")).toBe(false);
+  });
+  globalThis.test("aggregate-style entry (default) injects id: ID! ahead of the payload", () => {
+    let fragment = GraphQL_FragmentGenerator$ReventlessCore.generate([{
+        fieldNames: ["Ordering_CancelOrder"],
+        commandSchema: commandSchema
+      }], []);
+    let field = Stdlib_Option.getOr(mutationFor(fragment, "Ordering_CancelOrder"), "");
+    globalThis.expect(field.includes("id: ID!, orderId")).toBe(true);
+  });
+});
+
+export {
+  OrderSliceCmd,
+  mutationFor,
+}
+/* commandSchema Not a pure module */