@reventlessdev/reventless-local 3.0.0-alpha.211 → 3.0.0-alpha.213

package/src/adapter/QueryDb/QueryDbResolvers_GraphQL.res

@@ -85,6 +85,13 @@ module Make = (Bus: LocalBus.T) => {
 
     // Register the Relay node resolver callback once per QueryDb (domain only).
     // Scans all QueryDb instances to resolve node(id: ID!) queries.
+    // `node` is the one door that speaks Relay global ids, on both sides: it needs
+    // the `<Type>:` prefix to know which read model to load, so a storage key alone
+    // could not be resolved here. Every other door — the list, `X(id:)`,
+    // `XsByIds`, `filter.ids` — reports the storage key, which is what a client
+    // reads off a row and passes back. Callers that hold a global id are still
+    // served by the typed doors (see `Api_Ids.alternateKey`); the reverse is not
+    // possible, which is why this door is opt-in rather than the default form.
     switch relay {
     | Some(r) =>
       r.registerNodeResolverCallback(async (~typeName, ~localId) => {
@@ -101,7 +108,10 @@ module Make = (Bus: LocalBus.T) => {
             ->Effect.runPromise
           switch items->Array.get(0) {
           | Some(item) =>
-            let obj = item->JSON.Decode.object->Option.getOr(Dict.make())
+            // Copied: `JSON.Decode.object` hands back the stored object itself, so
+            // setting a field here would rewrite the row inside the QueryDb — the
+            // in-memory backend keeps the very object it returns.
+            let obj = item->JSON.Decode.object->Option.mapOr(Dict.make(), Dict.copy)
             obj->Dict.set("__typename", JSON.Encode.string(typeName))
             obj->Dict.set("id", r.encodeGlobalId(~typeName, ~localId)->JSON.Encode.string)
             Some(JSON.Encode.object(obj))
@@ -127,6 +137,49 @@ module Make = (Bus: LocalBus.T) => {
       }
     }
 
+    // ── Owner scoping ────────────────────────────────────────────────────────
+    // What a caller may see of a view whose state declares an `@owner` field.
+    // Sits beside `runInterceptor` on purpose: these are the two questions every
+    // door has to ask, and a door that forgets one of them is a hole rather than
+    // a degradation. Answering "may they read this at all" and "which rows" in
+    // the same place is what makes the omission visible when reading a resolver.
+    // Read per request rather than captured at registration: a resolver is built
+    // before every plugin's state schema is necessarily registered, and a lookup
+    // that missed here would leave the view unscoped rather than erroring.
+    let ownerFieldOf = () =>
+      Plugin_Helpers.stateSchemaRegistry
+      ->Dict.get(name)
+      ->Option.flatMap(s => Reventless.Owner.fieldNames(s)->Array.get(0))
+
+    // An owner-scoped view with no elevated groups configured scopes EVERYONE,
+    // administrators included. That is the safe direction to be wrong in and it
+    // is still wrong, and it is invisible from outside — an operator's empty list
+    // looks exactly like an operator who owns nothing. Said once per view at
+    // registration, because the alternative is finding out from a support ticket.
+    OwnerScopeDiagnostics.warnIfNoElevatedGroups(
+      ~comp="QueryDbResolvers_GraphQL",
+      ~view=name,
+      ~ownerField=ownerFieldOf(),
+    )
+
+    let ownerDecision = (~ctx) =>
+      extractIdentity(ctx)->Reventless.OwnerScope.decide(~ownerField=ownerFieldOf())
+
+    // Post-read form, for the single-row and by-index doors where there is no
+    // page to narrow — the row is already in hand and either belongs to the
+    // caller or does not.
+    let ownerAllows = (~ctx, item: JSON.t) =>
+      switch ownerDecision(~ctx) {
+      | Unscoped => true
+      | RefuseOwned => false
+      | ScopeTo(field, required) =>
+        item
+        ->JSON.Decode.object
+        ->Option.flatMap(d => d->Dict.get(field))
+        ->Option.flatMap(JSON.Decode.string)
+        ->Option.mapOr(false, v => v == required)
+      }
+
     let cap = s => s->String.charAt(0)->String.toUpperCase ++ s->String.slice(~start=1)
 
     // Resolve query field names: check registry first, fall back to safe defaults.
@@ -169,11 +222,6 @@ module Make = (Bus: LocalBus.T) => {
       }
     }
 
-    let encodeId = switch relay {
-    | Some(r) => (~typeName, ~localId) => r.encodeGlobalId(~typeName, ~localId)
-    | None => (~typeName as _, ~localId) => localId
-    }
-
     // -- Main query: getById ---------------------------------------------------
     let byIdSdl = if includeIdParam {
       switch subIdField {
@@ -191,16 +239,38 @@ module Make = (Bus: LocalBus.T) => {
           args->JSON.Decode.object->Option.flatMap(d => d->Dict.get("id"))->Option.flatMap(JSON.Decode.string)->Option.getOr("")
         switch Bus.getQueryDb(name) {
         | Some(ops) =>
-          let items =
-            await ops.loadStream(id)
+          let load = key =>
+            ops.loadStream(key)
             ->Stream.runCollect
             ->Effect.catchAll(_ => Effect.succeed([]))
             ->Effect.runPromise
+          let firstAttempt = await load(id)
+          // The row advertises a Relay global id, so `X(id: row.id)` arrives here
+          // as one. Retried rather than decoded up front: the raw key is what this
+          // door has always taken, and a key that merely looks like base64 must
+          // keep resolving to its own row.
+          let (resolvedKey, items) = switch (
+            firstAttempt->Array.get(0),
+            Api_Ids.alternateKey(id),
+          ) {
+          | (None, Some(localId)) => (localId, await load(localId))
+          | _ => (id, firstAttempt)
+          }
           switch items->Array.get(0) {
+          // A row the caller does not own answers as though it were not there.
+          // Distinguishing "not yours" from "not found" here would turn this door
+          // into an oracle for which ids exist.
+          | Some(item) if !ownerAllows(~ctx, item) => JSON.Encode.null
           | Some(item) =>
             if includeIdParam {
-              let obj = item->JSON.Decode.object->Option.getOr(Dict.make())
-              obj->Dict.set("id", encodeId(~typeName=returnTypeName, ~localId=id)->JSON.Encode.string)
+              // Copied — `JSON.Decode.object` hands back the stored object itself,
+              // so setting a field here would rewrite the row inside the QueryDb.
+              let obj = item->JSON.Decode.object->Option.mapOr(Dict.make(), Dict.copy)
+              // The storage key, which is what the list answers and what this door
+              // takes back. `resolvedKey`, not the argument: a caller who passed a
+              // Relay global id gets the raw key returned, so a round trip through
+              // this door converges on the one form instead of alternating.
+              obj->Dict.set("id", JSON.Encode.string(resolvedKey))
               JSON.Encode.object(obj)
             } else {
               item
@@ -237,21 +307,30 @@ module Make = (Bus: LocalBus.T) => {
               ->Array.filterMap(JSON.Decode.string)
             switch Bus.getQueryDb(name) {
             | Some(ops) =>
-              let loaded = await ids->Array.map(id =>
-                ops.loadStream(id)
+              let load = key =>
+                ops.loadStream(key)
                 ->Stream.runCollect
                 ->Effect.catchAll(_ => Effect.succeed([]))
                 ->Effect.runPromise
-                ->Promise.thenResolve(items => (id, items->Array.get(0)))
+              // Same either-form rule as the single-id door: raw key first, the
+              // key inside a Relay global id only on a miss.
+              let loaded = await ids->Array.map(async id =>
+                switch (await load(id))->Array.get(0) {
+                | Some(item) => (id, Some(item))
+                | None =>
+                  switch Api_Ids.alternateKey(id) {
+                  | Some(localId) => (localId, (await load(localId))->Array.get(0))
+                  | None => (id, None)
+                  }
+                }
               )->Promise.all
               loaded
               ->Array.filterMap(((id, opt)) =>
-                opt->Option.map(item => {
-                  let obj = item->JSON.Decode.object->Option.getOr(Dict.make())
-                  obj->Dict.set(
-                    "id",
-                    encodeId(~typeName=returnTypeName, ~localId=id)->JSON.Encode.string,
-                  )
+                opt
+                ->Option.filter(item => ownerAllows(~ctx, item))
+                ->Option.map(item => {
+                  let obj = item->JSON.Decode.object->Option.mapOr(Dict.make(), Dict.copy)
+                  obj->Dict.set("id", JSON.Encode.string(id))
                   JSON.Encode.object(obj)
                 })
               )
@@ -279,7 +358,7 @@ module Make = (Bus: LocalBus.T) => {
     // so the resolver derives the same serverCapability the FragmentGenerator emitted.
     let stateSchemaOpt = Plugin_Helpers.stateSchemaRegistry->Dict.get(name)
     let capability = switch stateSchemaOpt {
-    | Some(s) => GraphQL_FragmentGenerator.deriveServerCapability(s)
+    | Some(s) => GraphQL_FragmentGenerator.deriveServerCapability(~entityName=name, s)
     | None => GraphQL_FragmentGenerator.emptyCapability
     }
 
@@ -315,39 +394,63 @@ module Make = (Bus: LocalBus.T) => {
           ~hasOrderBy,
         ),
       ]
+      let emptyConnection = Obj.magic({
+        "edges": [],
+        "pageInfo": {
+          "hasNextPage": false,
+          "hasPreviousPage": false,
+          "startCursor": Nullable.null,
+          "endCursor": Nullable.null,
+        },
+      })
       let resolver: ReventlessGraphqlServer.GraphQL_ServerInstance.resolverFn = async (_root, args, ctx) => {
         switch await runInterceptor(~ctx, ~args) {
-        | Deny(_) =>
-          Obj.magic({
-            "edges": [],
-            "pageInfo": {
-              "hasNextPage": false,
-              "hasPreviousPage": false,
-              "startCursor": Nullable.null,
-              "endCursor": Nullable.null,
-            },
-          })
+        | Deny(_) => emptyConnection
         | Allow =>
-          let argsDict = args->JSON.Decode.object->Option.getOr(Dict.make())
-          // Prefer a backend list push-down (SQLite builds json_extract predicates
-          // + ORDER BY … LIMIT so it never materialises the whole read model). When
-          // the backend can't serve this query shape it returns None and we fall
-          // back to materialising the full model and running the shared
-          // `QueryDbListQuery` spec over it (the same code the in-memory backend and
-          // the push-down are tested against).
-          let decodeLocalId = id =>
-            DomainGraphQL_Server.decodeGlobalId(id)->Option.map(((_, lid)) => lid)
-          switch Bus.getQueryDbListPage(name) {
-          | Some(listPage) =>
-            switch listPage(~argsDict, ~capability, ~labelField) {
-            | Some(conn) => conn
+          switch ownerDecision(~ctx) {
+          | RefuseOwned => emptyConnection
+          | decision =>
+            let ownerScope = Reventless.OwnerScope.scopeOf(decision)
+            let argsDict = args->JSON.Decode.object->Option.getOr(Dict.make())
+            // Prefer a backend list push-down (SQLite builds json_extract predicates
+            // + ORDER BY … LIMIT so it never materialises the whole read model). When
+            // the backend can't serve this query shape it returns None and we fall
+            // back to materialising the full model and running the shared
+            // `QueryDbListQuery` spec over it (the same code the in-memory backend and
+            // the push-down are tested against).
+            //
+            // `ownerScope` goes to BOTH arms. Passing it only to the fallback would
+            // scope the exceptional path and leave the normal one — the push-down —
+            // returning everything, which is the worst possible place for the gap
+            // because the fallback is what the tests most easily exercise.
+            let decodeLocalId = id =>
+              DomainGraphQL_Server.decodeGlobalId(id)->Option.map(((_, lid)) => lid)
+            switch Bus.getQueryDbListPage(name) {
+            | Some(listPage) =>
+              switch listPage(~argsDict, ~capability, ~labelField, ~ownerScope?) {
+              | Some(conn) => conn
+              | None =>
+                let items = await fetchAllItems()
+                QueryDbListQuery.run(
+                  ~items,
+                  ~argsDict,
+                  ~capability,
+                  ~labelField,
+                  ~decodeLocalId,
+                  ~ownerScope?,
+                )
+              }
             | None =>
               let items = await fetchAllItems()
-              QueryDbListQuery.run(~items, ~argsDict, ~capability, ~labelField, ~decodeLocalId)
+              QueryDbListQuery.run(
+                ~items,
+                ~argsDict,
+                ~capability,
+                ~labelField,
+                ~decodeLocalId,
+                ~ownerScope?,
+              )
             }
-          | None =>
-            let items = await fetchAllItems()
-            QueryDbListQuery.run(~items, ~argsDict, ~capability, ~labelField, ~decodeLocalId)
           }
         }
       }
@@ -359,7 +462,11 @@ module Make = (Bus: LocalBus.T) => {
         switch await runInterceptor(~ctx, ~args) {
         | Deny(_) => Obj.magic({"nextToken": Nullable.null, "scannedCount": 0, "items": []})
         | Allow =>
-          let items = await fetchAllItems()
+          let all = await fetchAllItems()
+          // The legacy shape has no push-down to reach, so the narrowing is a plain
+          // filter here. `scannedCount` counts what is returned, not what was read:
+          // the pre-scoping total would tell a caller how many rows they may not see.
+          let items = all->Array.filter(item => ownerAllows(~ctx, item))
           Obj.magic({"nextToken": Nullable.null, "scannedCount": items->Array.length, "items": items})
         }
       }
@@ -416,11 +523,15 @@ module Make = (Bus: LocalBus.T) => {
           switch Bus.getQueryDb(name) {
           | None => emptyConn
           | Some(ops) =>
-            let allItems =
+            let loaded =
               await ops.loadStream(id)
               ->Stream.runCollect
               ->Effect.catchAll(_ => Effect.succeed([]))
               ->Effect.runPromise
+            // Narrowed here, before the cursor window and the sort-key filter, so
+            // every page this door emits is a page of rows the caller owns. Doing
+            // it after would hand back short pages with valid cursors.
+            let allItems = loaded->Array.filter(item => ownerAllows(~ctx, item))
 
             // Cursor-keyed filtering: exclude items on the cursor side of the boundary
             let cursorFiltered = if isBackward {
@@ -509,11 +620,16 @@ module Make = (Bus: LocalBus.T) => {
           | Allow =>
             let value =
               args->JSON.Decode.object->Option.flatMap(d => d->Dict.get(index))->Option.flatMap(JSON.Decode.string)->Option.getOr("")
+            // Applied to whichever arm answers, rather than inside one of them: the
+            // push-down and the scan are two ways to reach the same rows, and a
+            // narrowing that lives in only one is a hole that appears when a
+            // backend gains or loses an index.
+            let scoped = rows => rows->Array.filter(item => ownerAllows(~ctx, item))
             // Prefer the pushed-down equality lookup (SQLite rides the GSI index;
             // in-memory reuses its lazy snapshot). Fall back to scan+filter only
             // if no lookup is registered for this QueryDb.
             switch Bus.getQueryDbIndexLookup(name) {
-            | Some(lookup) => lookup(filterField, value)->JSON.Encode.array
+            | Some(lookup) => lookup(filterField, value)->scoped->JSON.Encode.array
             | None =>
               switch Bus.getQueryDbScan(name) {
               | Some(scanAll) =>
@@ -526,6 +642,7 @@ module Make = (Bus: LocalBus.T) => {
                   ->Option.map(v => v == value)
                   ->Option.getOr(false)
                 )
+                ->scoped
                 ->JSON.Encode.array
               | None => []->JSON.Encode.array
               }

package/src/adapter/QueryDb/QueryDbResolvers_GraphQL.res.mjs

@@ -6,13 +6,17 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
 import * as SortKey_Filter$ReventlessLocal from "./SortKey_Filter.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
 import * as DomainGraphQL_Server$ReventlessLocal from "../DomainGraphQL_Server.res.mjs";
+import * as OwnerScopeDiagnostics$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/OwnerScopeDiagnostics.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
 function encodeCursor(value) {
@@ -63,7 +67,7 @@ function Make(Bus) {
         if (item === undefined) {
           return;
         }
-        let obj = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(item), {});
+        let obj = Stdlib_Option.mapOr(Stdlib_JSON.Decode.object(item), {}, prim => Object.assign({}, prim));
         obj["__typename"] = typeName;
         obj["id"] = relay.encodeGlobalId(typeName, localId);
         return obj;
@@ -84,6 +88,18 @@ function Make(Bus) {
         return "Allow";
       }
     };
+    let ownerFieldOf = () => Stdlib_Option.flatMap(Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name], s => Owner$Reventless.fieldNames(s)[0]);
+    OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("QueryDbResolvers_GraphQL", name, ownerFieldOf());
+    let ownerDecision = ctx => OwnerScope$Reventless.decide(extractIdentity(ctx), ownerFieldOf(), undefined);
+    let ownerAllows = (ctx, item) => {
+      let match = ownerDecision(ctx);
+      if (typeof match !== "object") {
+        return match === "Unscoped";
+      }
+      let required = match._1;
+      let field = match._0;
+      return Stdlib_Option.mapOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[field]), Stdlib_JSON.Decode.string), false, v => v === required);
+    };
     let cap = s => s.charAt(0).toUpperCase() + s.slice(1);
     let registryEntry = Plugin_Helpers$ReventlessCore.queryFieldNamesRegistry[name];
     let singleQueryName = registryEntry !== undefined ? registryEntry.singleFieldName : name.charAt(0).toLowerCase() + name.slice(1);
@@ -95,7 +111,6 @@ function Make(Bus) {
     if (includeIdParam && relay !== undefined) {
       relay.registerNodeType(returnTypeName, name);
     }
-    let encodeId = relay !== undefined ? (typeName, localId) => relay.encodeGlobalId(typeName, localId) : (param, localId) => localId;
     let byIdSdl = includeIdParam ? (
         subIdField !== undefined ? `  ` + singleQueryName + `(id: ID!, ` + subIdField + `: String): ` + returnTypeName : `  ` + singleQueryName + `(id: ID!): ` + returnTypeName
       ) : `  ` + singleQueryName + `: ` + returnTypeName;
@@ -109,16 +124,29 @@ function Make(Bus) {
       if (ops === undefined) {
         return null;
       }
-      let items = await Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(id)), param => Effect.succeed([])));
-      let item = items[0];
+      let load = key => Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(key)), param => Effect.succeed([])));
+      let firstAttempt = await load(id);
+      let match$1 = firstAttempt[0];
+      let match$2 = Api_Ids$ReventlessCore.alternateKey(id);
+      let match$3 = match$1 !== undefined || match$2 === undefined ? [
+          id,
+          firstAttempt
+        ] : [
+          match$2,
+          await load(match$2)
+        ];
+      let item = match$3[1][0];
       if (item === undefined) {
         return null;
       }
+      if (!ownerAllows(ctx, item)) {
+        return null;
+      }
       if (!includeIdParam) {
         return item;
       }
-      let obj = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(item), {});
-      obj["id"] = encodeId(returnTypeName, id);
+      let obj = Stdlib_Option.mapOr(Stdlib_JSON.Decode.object(item), {}, prim => Object.assign({}, prim));
+      obj["id"] = match$3[0];
       return obj;
     };
     let byIdsSdl = includeIdParam && subIdField === undefined ? [GraphQL_FragmentGenerator$ReventlessCore.deriveByIdsQueryField(listQueryName, returnTypeName)] : [];
@@ -134,15 +162,33 @@ function Make(Bus) {
         if (ops === undefined) {
           return [];
         }
-        let loaded = await Promise.all(ids.map(id => Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(id)), param => Effect.succeed([]))).then(items => [
-          id,
-          items[0]
-        ])));
+        let load = key => Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(key)), param => Effect.succeed([])));
+        let loaded = await Promise.all(ids.map(async id => {
+          let item = (await load(id))[0];
+          if (item !== undefined) {
+            return [
+              id,
+              item
+            ];
+          }
+          let localId = Api_Ids$ReventlessCore.alternateKey(id);
+          if (localId !== undefined) {
+            return [
+              localId,
+              (await load(localId))[0]
+            ];
+          } else {
+            return [
+              id,
+              undefined
+            ];
+          }
+        }));
         return Stdlib_Array.filterMap(loaded, param => {
           let id = param[0];
-          return Stdlib_Option.map(param[1], item => {
-            let obj = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(item), {});
-            obj["id"] = encodeId(returnTypeName, id);
+          return Stdlib_Option.map(Stdlib_Option.filter(param[1], item => ownerAllows(ctx, item)), item => {
+            let obj = Stdlib_Option.mapOr(Stdlib_JSON.Decode.object(item), {}, prim => Object.assign({}, prim));
+            obj["id"] = id;
             return obj;
           });
         });
@@ -156,7 +202,7 @@ function Make(Bus) {
     }
     let labelField = registryEntry !== undefined ? Stdlib_Option.getOr(registryEntry.labelField, "id") : "id";
     let stateSchemaOpt = Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name];
-    let capability = stateSchemaOpt !== undefined ? GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(stateSchemaOpt) : GraphQL_FragmentGenerator$ReventlessCore.emptyCapability;
+    let capability = stateSchemaOpt !== undefined ? GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(name, stateSchemaOpt) : GraphQL_FragmentGenerator$ReventlessCore.emptyCapability;
     let fetchAllItems = async () => {
       let makeStream = Bus.getQueryDbStream(name);
       if (makeStream !== undefined) {
@@ -177,32 +223,38 @@ function Make(Bus) {
       let typesToRegister = [GraphQL_FragmentGenerator$ReventlessCore.deriveConnectionFilterType(filterTypeName, capability)].concat(orderByTypes);
       server.registerTypes(typesToRegister);
       let sdl = [GraphQL_FragmentGenerator$ReventlessCore.deriveConnectionQueryField(listQueryName, returnTypeName, filterTypeName, hasOrderBy)];
+      let emptyConnection = {
+        edges: [],
+        pageInfo: {
+          hasNextPage: false,
+          hasPreviousPage: false,
+          startCursor: null,
+          endCursor: null
+        }
+      };
       let resolver$1 = async (_root, args, ctx) => {
         let match = await runInterceptor(ctx, args);
         if (typeof match === "object") {
-          return {
-            edges: [],
-            pageInfo: {
-              hasNextPage: false,
-              hasPreviousPage: false,
-              startCursor: null,
-              endCursor: null
-            }
-          };
+          return emptyConnection;
+        }
+        let decision = ownerDecision(ctx);
+        if (typeof decision !== "object" && decision !== "Unscoped") {
+          return emptyConnection;
         }
+        let ownerScope = OwnerScope$Reventless.scopeOf(decision);
         let argsDict = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(args), {});
         let decodeLocalId = id => Stdlib_Option.map(DomainGraphQL_Server$ReventlessLocal.decodeGlobalId(id), param => param[1]);
         let listPage = Bus.getQueryDbListPage(name);
         if (listPage !== undefined) {
-          let conn = listPage(argsDict, capability, labelField);
+          let conn = listPage(argsDict, capability, labelField, ownerScope);
           if (conn !== undefined) {
             return conn;
           }
           let items = await fetchAllItems();
-          return QueryDbListQuery$ReventlessCore.run(items, argsDict, capability, labelField, decodeLocalId);
+          return QueryDbListQuery$ReventlessCore.run(items, argsDict, capability, labelField, decodeLocalId, ownerScope);
         }
         let items$1 = await fetchAllItems();
-        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, capability, labelField, decodeLocalId);
+        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, capability, labelField, decodeLocalId, ownerScope);
       };
       match = [
         sdl,
@@ -219,7 +271,8 @@ function Make(Bus) {
             items: []
           };
         }
-        let items = await fetchAllItems();
+        let all = await fetchAllItems();
+        let items = all.filter(item => ownerAllows(ctx, item));
         return {
           nextToken: null,
           scannedCount: items.length,
@@ -277,7 +330,8 @@ function Make(Bus) {
         if (ops === undefined) {
           return emptyConn;
         }
-        let allItems = await Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(id)), param => Effect.succeed([])));
+        let loaded = await Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(id)), param => Effect.succeed([])));
+        let allItems = loaded.filter(item => ownerAllows(ctx, item));
         let cursorFiltered;
         if (isBackward) {
           let beforeKey = Stdlib_Option.map(before, decodeCursor);
@@ -354,13 +408,14 @@ function Make(Bus) {
           return [];
         }
         let value = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(args), d => d[index]), Stdlib_JSON.Decode.string), "");
+        let scoped = rows => rows.filter(item => ownerAllows(ctx, item));
         let lookup = Bus.getQueryDbIndexLookup(name);
         if (lookup !== undefined) {
-          return lookup(filterField, value);
+          return scoped(lookup(filterField, value));
         }
         let scanAll = Bus.getQueryDbScan(name);
         if (scanAll !== undefined) {
-          return scanAll().filter(item => Stdlib_Option.getOr(Stdlib_Option.map(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[filterField]), Stdlib_JSON.Decode.string), v => v === value), false));
+          return scoped(scanAll().filter(item => Stdlib_Option.getOr(Stdlib_Option.map(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[filterField]), Stdlib_JSON.Decode.string), v => v === value), false)));
         } else {
           return [];
         }

package/src/adapter/QueryDb/QueryDbStorage_Sqlite.res

@@ -146,6 +146,7 @@ type busCallbacks = {
       ~argsDict: dict<JSON.t>,
       ~capability: GraphQL_FragmentGenerator.serverCapability,
       ~labelField: string,
+      ~ownerScope: (string, string)=?,
     ) => option<JSON.t>,
   ) => unit,
 }
@@ -426,6 +427,7 @@ let makeStorage = (
     ~argsDict: dict<JSON.t>,
     ~capability: GraphQL_FragmentGenerator.serverCapability,
     ~labelField as _,
+    ~ownerScope: option<(string, string)>=?,
   ): option<JSON.t> => {
     let filterDict =
       argsDict->Dict.get("filter")->Option.flatMap(JSON.Decode.object)->Option.getOr(Dict.make())
@@ -440,6 +442,15 @@ let makeStorage = (
     } else {
       let whereParts = [notExpiredClause]
       let params = []
+      // Pushed into the SQL rather than applied to the returned page, because the
+      // LIMIT below is what makes a page: narrowing afterwards would return fewer
+      // rows than asked for while still reporting a next page.
+      switch ownerScope {
+      | Some((field, required)) =>
+        whereParts->Array.push(`${jsonText(field)} = ?`)
+        params->Array.push(JSON.Encode.string(required))
+      | None => ()
+      }
       let valString = v =>
         switch v->JSON.Decode.string {
         | Some(s) => Some(s)

package/src/adapter/QueryDb/QueryDbStorage_Sqlite.res.mjs

@@ -337,7 +337,7 @@ function makeStorage(db, bus, name, indexes, subIdField) {
   };
   let jsonText = field => `CAST(json_extract(item, '$.` + field.replaceAll("'", "''") + `') AS TEXT)`;
   let idExpr = "COALESCE(json_extract(item, '$.id'), partition_key)";
-  let listPage = (argsDict, capability, param) => {
+  let listPage = (argsDict, capability, param, ownerScope) => {
     let filterDict = Stdlib_Option.getOr(Stdlib_Option.flatMap(argsDict["filter"], Stdlib_JSON.Decode.object), {});
     let strNonEmpty = k => Stdlib_Option.mapOr(Stdlib_Option.flatMap(filterDict[k], Stdlib_JSON.Decode.string), false, s => s.length > 0);
     let hasIds = Stdlib_Option.mapOr(Stdlib_Option.flatMap(filterDict["ids"], Stdlib_JSON.Decode.array), false, a => a.length !== 0);
@@ -348,6 +348,10 @@ function makeStorage(db, bus, name, indexes, subIdField) {
     }
     let whereParts = [notExpiredClause];
     let params = [];
+    if (ownerScope !== undefined) {
+      whereParts.push(jsonText(ownerScope[0]) + ` = ?`);
+      params.push(ownerScope[1]);
+    }
     let valString = v => {
       let s = Stdlib_JSON.Decode.string(v);
       if (s !== undefined) {