@reventlessdev/reventless-aws 3.0.0-alpha.345 → 3.0.0-alpha.347

package/tests/ProvisionAccountsTest.res.mjs

@@ -0,0 +1,184 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodeos from "node:os";
+import * as Nodepath from "node:path";
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as ProvisionAccounts$ReventlessAws from "../scripts/ProvisionAccounts.res.mjs";
+import * as ProvisionProvider$ReventlessAws from "../scripts/ProvisionProvider.res.mjs";
+
+globalThis.describe("ProvisionAccounts.parseArgs", () => {
+  globalThis.test("no arguments leaves every choice unanswered", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        file: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("a pool and a manifest parse", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI",
+      "--file",
+      "cast.yaml"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "eu-west-1_AbCdEfGhI",
+        stack: undefined,
+        file: "cast.yaml",
+        help: false
+      }
+    });
+  });
+  globalThis.test("--stack picks the deployment to read the pool id from", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--stack",
+      "beta"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: "beta",
+        file: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("an unknown flag refuses rather than being ignored", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs([
+      "--pool",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--pool"`
+    });
+  });
+  globalThis.test("a flag with no value refuses", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs(["--provider-id"])).toEqual({
+      TAG: "Error",
+      _0: "--provider-id needs a value"
+    });
+  });
+  globalThis.test("-h asks for the usage", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.parseArgs(["-h"])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        file: undefined,
+        help: true
+      }
+    });
+  });
+});
+
+globalThis.describe("ProvisionProvider.resolve", () => {
+  let withoutEnv = fn => {
+    let saved = process.env[ProvisionProvider$ReventlessAws.envKey];
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    let outcome = fn();
+    if (saved !== undefined) {
+      process.env[ProvisionProvider$ReventlessAws.envKey] = saved;
+    }
+    return outcome;
+  };
+  globalThis.test("an explicit id wins, and says so", () => {
+    globalThis.expect(withoutEnv(() => ProvisionProvider$ReventlessAws.resolve("eu-west-1_Explicit", "alpha"))).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_Explicit",
+        "Flag"
+      ]
+    });
+  });
+  globalThis.test("an explicit id beats the environment", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "eu-west-1_FromEnv";
+    let resolved = ProvisionProvider$ReventlessAws.resolve("eu-west-1_Explicit", undefined);
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    globalThis.expect(resolved).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_Explicit",
+        "Flag"
+      ]
+    });
+  });
+  globalThis.test("the environment answers when no flag does", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "eu-west-1_FromEnv";
+    let resolved = ProvisionProvider$ReventlessAws.resolve(undefined, undefined);
+    Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey);
+    globalThis.expect(resolved).toEqual({
+      TAG: "Ok",
+      _0: [
+        "eu-west-1_FromEnv",
+        "Environment"
+      ]
+    });
+  });
+  globalThis.test("an empty environment variable is not an answer", () => {
+    process.env[ProvisionProvider$ReventlessAws.envKey] = "   ";
+    let resolved = ProvisionProvider$ReventlessAws.resolve(undefined, "no-such-stack-here");
+    globalThis.expect((Stdlib_Dict.$$delete(process.env, ProvisionProvider$ReventlessAws.envKey), Stdlib_Result.isError(resolved))).toBe(true);
+  });
+  globalThis.test("each source describes itself", () => {
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe("Flag")).toBe("--provider-id");
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe("Environment")).toBe("REVENTLESS_IDENTITY_PROVIDER_ID");
+    globalThis.expect(ProvisionProvider$ReventlessAws.describe({
+      TAG: "Stack",
+      _0: "beta"
+    })).toBe("stack beta");
+  });
+});
+
+globalThis.describe("ProvisionAccounts.looksLikeEmail", () => {
+  globalThis.test("an address is one", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("me@example.com")).toBe(true);
+  });
+  globalThis.test("a demo username is not", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("shopper")).toBe(false);
+  });
+  globalThis.test("an @ with no domain dot is not", () => {
+    globalThis.expect(ProvisionAccounts$ReventlessAws.looksLikeEmail("admin@localhost")).toBe(false);
+  });
+});
+
+globalThis.describe("ProvisionAccounts.provision", () => {
+  let manifest = `# the cast
+- username: shopper
+  password: ""
+  groups: [Shopper]
+`;
+  globalThis.test("a refused pool leaves the manifest untouched", async () => {
+    let dir = Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), "provision-accounts-"));
+    let file = Nodepath.join(dir, "users.yaml");
+    Nodefs.writeFileSync(file, manifest, "utf8");
+    let refuse = async (param, param$1) => ({
+      TAG: "Error",
+      _0: "pool signs in on email"
+    });
+    let outcome = await ProvisionAccounts$ReventlessAws.provision(file, "eu-west-1_Refuses", refuse);
+    let after = Nodefs.readFileSync(file, "utf8");
+    Nodefs.rmSync(dir, {
+      recursive: true,
+      force: true
+    });
+    globalThis.expect(outcome).toEqual({
+      TAG: "Error",
+      _0: "pool signs in on email"
+    });
+    globalThis.expect(after).toBe(manifest);
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/ProvisionAdminTest.res

@@ -0,0 +1,55 @@
+open JestGlobals
+
+// The bootstrap script's decidable part: which pool and which person the run is
+// about. Reachable at all only because the module defines `main` without calling
+// it — `run-provision-admin.mjs` does that — which is the same reason its sibling
+// is testable.
+//
+// The AWS calls themselves are not covered here; what is covered is everything
+// that can be wrong *before* one is made. The credential this script hands out is
+// no longer its own — the generator moved to `spec` so the manifest's
+// platform-neutral half could reach it, and `Util_PasswordTest` holds the policy
+// it has to satisfy.
+
+module Provision = ProvisionAdmin
+
+describe("ProvisionAdmin.parseArgs", () => {
+  testSync("both arguments parse", () =>
+    expect(
+      Provision.parseArgs(["--provider-id", "eu-west-1_AbCdEfGhI", "--email", "me@example.com"]),
+    )->toEqual(
+      Ok({
+        Provision.providerId: Some("eu-west-1_AbCdEfGhI"),
+        stack: None,
+        email: Some("me@example.com"),
+        help: false,
+      }),
+    )
+  )
+
+  testSync("no arguments leaves both unanswered", () =>
+    expect(Provision.parseArgs([]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, email: None, help: false}),
+    )
+  )
+
+  // The reason unknown flags refuse rather than being skipped: a typo'd
+  // `--provider-id` would fall through to the environment and make the
+  // administrator in a different pool than the operator named — a successful run
+  // against the wrong deployment, which is worse than a failed one.
+  testSync("an unknown flag refuses rather than being ignored", () =>
+    expect(Provision.parseArgs(["--provider", "eu-west-1_AbCdEfGhI"]))->toEqual(
+      Error(`unknown argument "--provider"`),
+    )
+  )
+
+  testSync("a flag with no value refuses", () =>
+    expect(Provision.parseArgs(["--email"]))->toEqual(Error("--email needs a value"))
+  )
+
+  testSync("-h asks for the usage", () =>
+    expect(Provision.parseArgs(["-h"]))->toEqual(
+      Ok({Provision.providerId: None, stack: None, email: None, help: true}),
+    )
+  )
+})

package/tests/ProvisionAdminTest.res.mjs

@@ -0,0 +1,66 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as ProvisionAdmin$ReventlessAws from "../scripts/ProvisionAdmin.res.mjs";
+
+globalThis.describe("ProvisionAdmin.parseArgs", () => {
+  globalThis.test("both arguments parse", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([
+      "--provider-id",
+      "eu-west-1_AbCdEfGhI",
+      "--email",
+      "me@example.com"
+    ])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: "eu-west-1_AbCdEfGhI",
+        stack: undefined,
+        email: "me@example.com",
+        help: false
+      }
+    });
+  });
+  globalThis.test("no arguments leaves both unanswered", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        email: undefined,
+        help: false
+      }
+    });
+  });
+  globalThis.test("an unknown flag refuses rather than being ignored", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs([
+      "--provider",
+      "eu-west-1_AbCdEfGhI"
+    ])).toEqual({
+      TAG: "Error",
+      _0: `unknown argument "--provider"`
+    });
+  });
+  globalThis.test("a flag with no value refuses", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs(["--email"])).toEqual({
+      TAG: "Error",
+      _0: "--email needs a value"
+    });
+  });
+  globalThis.test("-h asks for the usage", () => {
+    globalThis.expect(ProvisionAdmin$ReventlessAws.parseArgs(["-h"])).toEqual({
+      TAG: "Ok",
+      _0: {
+        providerId: undefined,
+        stack: undefined,
+        email: undefined,
+        help: true
+      }
+    });
+  });
+});
+
+let Provision;
+
+export {
+  Provision,
+}
+/*  Not a pure module */

package/tests/ProvisionIdentityTest.res

@@ -16,6 +16,8 @@ describe("ProvisionIdentity.parseArgs", () => {
       Ok({
         Provision.poolName: Provision.defaultPoolName,
         providerId: None,
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
         help: false,
       }),
     )
@@ -26,6 +28,8 @@ describe("ProvisionIdentity.parseArgs", () => {
       Ok({
         Provision.poolName: Provision.defaultPoolName,
         providerId: Some("eu-west-1_AbCdEfGhI"),
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
         help: false,
       }),
     )
@@ -33,13 +37,60 @@ describe("ProvisionIdentity.parseArgs", () => {
 
   testSync("--name selects which pool to adopt by name", () =>
     expect(Provision.parseArgs(["--name", "examples-dev"]))->toEqual(
-      Ok({Provision.poolName: "examples-dev", providerId: None, help: false}),
+      Ok({
+        Provision.poolName: "examples-dev",
+        providerId: None,
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
+        help: false,
+      }),
     )
   )
 
   testSync("both together are accepted, and the id wins at resolve time", () =>
     expect(Provision.parseArgs(["--name", "ignored", "--provider-id", "eu-west-1_x"]))->toEqual(
-      Ok({Provision.poolName: "ignored", providerId: Some("eu-west-1_x"), help: false}),
+      Ok({
+        Provision.poolName: "ignored",
+        providerId: Some("eu-west-1_x"),
+        loginIdentifier: Auth_LoginIdentifier.Email,
+        signUpMode: Auth_SignUpMode.AdminOnly,
+        help: false,
+      }),
+    )
+  )
+
+  testSync("--login-identifier picks the sign-in attribute", () =>
+    expect(
+      Provision.parseArgs(["--login-identifier", "emailOrPhone"])->Result.map(
+        a => a.loginIdentifier,
+      ),
+    )->toEqual(Ok(Auth_LoginIdentifier.EmailOrPhone))
+  )
+
+  // 🚨 The sign-in attribute cannot be changed once the pool exists, so a typo
+  // that fell back to the default would create a pool the operator has to
+  // rebuild — and re-register every account in — to correct.
+  testSync("an unrecognised sign-in attribute is refused, never defaulted", () =>
+    expect(Provision.parseArgs(["--login-identifier", "e-mail"])->Result.isError)->toBe(true)
+  )
+
+  testSync("--sign-up-mode opens the pool to self-registration", () =>
+    expect(
+      Provision.parseArgs(["--sign-up-mode", "selfService"])->Result.map(a => a.signUpMode),
+    )->toEqual(Ok(Auth_SignUpMode.SelfService))
+  )
+
+  // This one IS correctable later, unlike the sign-in attribute — it is refused
+  // because the mistake is silent, not because it is permanent. Defaulting past
+  // a typo leaves a pool that refuses every registration while the command line
+  // reads as though it allows them.
+  testSync("an unrecognised sign-up mode is refused, never defaulted", () =>
+    expect(Provision.parseArgs(["--sign-up-mode", "self-service"])->Result.isError)->toBe(true)
+  )
+
+  testSync("sign-up mode defaults to admin-only, so an existing pool is unchanged", () =>
+    expect(Provision.parseArgs([])->Result.map(a => a.signUpMode))->toEqual(
+      Ok(Auth_SignUpMode.AdminOnly),
     )
   )
 
@@ -62,6 +113,12 @@ describe("ProvisionIdentity.parseArgs", () => {
     expect(Provision.parseArgs(["--name"]))->toEqual(Error("--name needs a value"))
   )
 
+  testSync("--login-identifier with no value is refused too", () =>
+    expect(Provision.parseArgs(["--login-identifier"]))->toEqual(
+      Error("--login-identifier needs a value"),
+    )
+  )
+
   testSync("--help and -h both ask for the usage text", () =>
     expect((
       Provision.parseArgs(["--help"])->Result.map(a => a.help),
@@ -83,7 +140,11 @@ describe("ProvisionIdentity.parseArgs", () => {
 // touches it — so its settings are not a detail an operator can revise cheaply
 // once accounts exist in it.
 describe("ProvisionIdentity.poolSettings", () => {
-  let settings = Provision.poolSettings(~poolName="MyIdentity")
+  let settings = Provision.poolSettings(
+    ~poolName="MyIdentity",
+    ~loginIdentifier=Auth_LoginIdentifier.default,
+    ~signUpMode=Auth_SignUpMode.default,
+  )
 
   testSync("carries the name it was asked for", () => expect(settings.poolName)->toBe("MyIdentity"))
 
@@ -95,6 +156,31 @@ describe("ProvisionIdentity.poolSettings", () => {
     ))->toEqual((Some(["email"]), Some("OFF"), Some(true)))
   )
 
+  testSync("a phone pool is created signing in on phone_number", () =>
+    expect(
+      Provision.poolSettings(
+        ~poolName="MyIdentity",
+        ~loginIdentifier=Auth_LoginIdentifier.Phone,
+        ~signUpMode=Auth_SignUpMode.default,
+      ).usernameAttributes,
+    )->toEqual(Some(["phone_number"]))
+  )
+
+  // The negation is the part worth pinning: this type asks who may sign up, and
+  // Cognito's field asks the opposite question. Reading it backwards would open a
+  // pool that was meant to stay closed.
+  testSync("selfService clears allowAdminCreateUserOnly, adminOnly sets it", () => {
+    let openPool = Provision.poolSettings(
+      ~poolName="MyIdentity",
+      ~loginIdentifier=Auth_LoginIdentifier.default,
+      ~signUpMode=Auth_SignUpMode.SelfService,
+    )
+    expect((
+      openPool.adminCreateUserConfig->Option.flatMap(c => c.allowAdminCreateUserOnly),
+      settings.adminCreateUserConfig->Option.flatMap(c => c.allowAdminCreateUserOnly),
+    ))->toEqual((Some(false), Some(true)))
+  })
+
   testSync("keeps the 12-character password policy", () =>
     expect(
       settings.policies

package/tests/ProvisionIdentityTest.res.mjs

@@ -2,7 +2,9 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Auth_SignUpMode$ReventlessAws from "../src/adapter/Auth/Auth_SignUpMode.res.mjs";
 import * as ProvisionIdentity$ReventlessAws from "../scripts/ProvisionIdentity.res.mjs";
+import * as Auth_LoginIdentifier$ReventlessAws from "../src/adapter/Auth/Auth_LoginIdentifier.res.mjs";
 
 globalThis.describe("ProvisionIdentity.parseArgs", () => {
   globalThis.test("no arguments means adopt-or-create the default name", () => {
@@ -11,6 +13,8 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: {
         poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
         providerId: undefined,
+        loginIdentifier: "Email",
+        signUpMode: "AdminOnly",
         help: false
       }
     });
@@ -24,6 +28,8 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: {
         poolName: ProvisionIdentity$ReventlessAws.defaultPoolName,
         providerId: "eu-west-1_AbCdEfGhI",
+        loginIdentifier: "Email",
+        signUpMode: "AdminOnly",
         help: false
       }
     });
@@ -37,6 +43,8 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: {
         poolName: "examples-dev",
         providerId: undefined,
+        loginIdentifier: "Email",
+        signUpMode: "AdminOnly",
         help: false
       }
     });
@@ -52,10 +60,48 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: {
         poolName: "ignored",
         providerId: "eu-west-1_x",
+        loginIdentifier: "Email",
+        signUpMode: "AdminOnly",
         help: false
       }
     });
   });
+  globalThis.test("--login-identifier picks the sign-in attribute", () => {
+    globalThis.expect(Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--login-identifier",
+      "emailOrPhone"
+    ]), a => a.loginIdentifier)).toEqual({
+      TAG: "Ok",
+      _0: "EmailOrPhone"
+    });
+  });
+  globalThis.test("an unrecognised sign-in attribute is refused, never defaulted", () => {
+    globalThis.expect(Stdlib_Result.isError(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--login-identifier",
+      "e-mail"
+    ]))).toBe(true);
+  });
+  globalThis.test("--sign-up-mode opens the pool to self-registration", () => {
+    globalThis.expect(Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--sign-up-mode",
+      "selfService"
+    ]), a => a.signUpMode)).toEqual({
+      TAG: "Ok",
+      _0: "SelfService"
+    });
+  });
+  globalThis.test("an unrecognised sign-up mode is refused, never defaulted", () => {
+    globalThis.expect(Stdlib_Result.isError(ProvisionIdentity$ReventlessAws.parseArgs([
+      "--sign-up-mode",
+      "self-service"
+    ]))).toBe(true);
+  });
+  globalThis.test("sign-up mode defaults to admin-only, so an existing pool is unchanged", () => {
+    globalThis.expect(Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs([]), a => a.signUpMode)).toEqual({
+      TAG: "Ok",
+      _0: "AdminOnly"
+    });
+  });
   globalThis.test("a misspelled flag is refused, not ignored", () => {
     globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs([
       "--provider_id",
@@ -77,6 +123,12 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
       _0: "--name needs a value"
     });
   });
+  globalThis.test("--login-identifier with no value is refused too", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.parseArgs(["--login-identifier"])).toEqual({
+      TAG: "Error",
+      _0: "--login-identifier needs a value"
+    });
+  });
   globalThis.test("--help and -h both ask for the usage text", () => {
     globalThis.expect([
       Stdlib_Result.map(ProvisionIdentity$ReventlessAws.parseArgs(["--help"]), a => a.help),
@@ -104,7 +156,7 @@ globalThis.describe("ProvisionIdentity.parseArgs", () => {
 });
 
 globalThis.describe("ProvisionIdentity.poolSettings", () => {
-  let settings = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity");
+  let settings = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity", Auth_LoginIdentifier$ReventlessAws.default, Auth_SignUpMode$ReventlessAws.default);
   globalThis.test("carries the name it was asked for", () => {
     globalThis.expect(settings.PoolName).toBe("MyIdentity");
   });
@@ -119,6 +171,19 @@ globalThis.describe("ProvisionIdentity.poolSettings", () => {
       true
     ]);
   });
+  globalThis.test("a phone pool is created signing in on phone_number", () => {
+    globalThis.expect(ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity", "Phone", Auth_SignUpMode$ReventlessAws.default).UsernameAttributes).toEqual(["phone_number"]);
+  });
+  globalThis.test("selfService clears allowAdminCreateUserOnly, adminOnly sets it", () => {
+    let openPool = ProvisionIdentity$ReventlessAws.poolSettings("MyIdentity", Auth_LoginIdentifier$ReventlessAws.default, "SelfService");
+    globalThis.expect([
+      Stdlib_Option.flatMap(openPool.AdminCreateUserConfig, c => c.AllowAdminCreateUserOnly),
+      Stdlib_Option.flatMap(settings.AdminCreateUserConfig, c => c.AllowAdminCreateUserOnly)
+    ]).toEqual([
+      false,
+      true
+    ]);
+  });
   globalThis.test("keeps the 12-character password policy", () => {
     globalThis.expect(Stdlib_Option.flatMap(Stdlib_Option.flatMap(settings.Policies, p => p.PasswordPolicy), p => p.MinimumLength)).toEqual(12);
   });

package/tests/Util_OwnerScopeEnvTest.res

@@ -59,4 +59,29 @@ describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
     withElevated([], () => Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables))
     expect(variables->Dict.get(Util_OwnerScopeEnv.key)->Option.isNone)->toBe(true)
   })
+
+  // The whole path the "administrator sees empty screens" trap ran through: the
+  // platform entry point defaults the list, and this composes it into a Lambda's
+  // environment. Asserted end to end rather than at either half, because both
+  // halves were already correct while the trap was open — the pipe was laid and
+  // nothing ever put a value in.
+  testSync("the platform's administrator default reaches a composed environment", () => {
+    Reventless.OwnerScope.clearElevatedGroups()
+    NodeProcess.env->Dict.delete(Util_OwnerScopeEnv.key)
+    Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+
+    let variables = Dict.make()
+    Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
+    let encoded = switch variables->Dict.get(Util_OwnerScopeEnv.key) {
+    | Some(value) => value->Obj.magic
+    | None => ""
+    }
+    Reventless.OwnerScope.clearElevatedGroups()
+
+    // Round-tripped, like the first case above: the runtime reads this back with
+    // `parseElevatedGroups`, so the encoding is asserted rather than the spelling.
+    expect(Reventless.OwnerScope.parseElevatedGroups(encoded))->toEqual([
+      Reventless.AdminGroup.name,
+    ])
+  })
 })

package/tests/Util_OwnerScopeEnvTest.res.mjs

@@ -1,6 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Util_OwnerScopeEnv$ReventlessAws from "../src/util/Util_OwnerScopeEnv.res.mjs";
 
@@ -54,6 +56,17 @@ globalThis.describe("Util_OwnerScopeEnv — the elevated-groups carrier", () =>
     withElevated([], () => Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables));
     globalThis.expect(Stdlib_Option.isNone(variables[Util_OwnerScopeEnv$ReventlessAws.key])).toBe(true);
   });
+  globalThis.test("the platform's administrator default reaches a composed environment", () => {
+    OwnerScope$Reventless.clearElevatedGroups();
+    Stdlib_Dict.$$delete(process.env, Util_OwnerScopeEnv$ReventlessAws.key);
+    OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+    let variables = {};
+    Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
+    let value = variables[Util_OwnerScopeEnv$ReventlessAws.key];
+    let encoded = value !== undefined ? value : "";
+    OwnerScope$Reventless.clearElevatedGroups();
+    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([AdminGroup$Reventless.name]);
+  });
 });
 
 export {

package/tests/Util_StoreLayoutTest.res

@@ -179,6 +179,12 @@ describe("Util_StoreLayout.protectionFor", () => {
   testSync("'prepare' is not a PR stack — the prefix is 'pr-', not 'pr'", () =>
     expect(Util_StoreLayout.protectionFor(~stack="prepare"))->toEqual(Util_StoreLayout.Protected)
   )
+
+  testSync("a stack declared disposable is unprotected whatever its name", () =>
+    expect(Util_StoreLayout.protectionFor(~stack="dev", ~disposable=true))->toEqual(
+      Util_StoreLayout.Unprotected,
+    )
+  )
 })
 
 describe("Util_StoreLayout.bucketNameFor", () => {

package/tests/Util_StoreLayoutTest.res.mjs

@@ -87,16 +87,19 @@ globalThis.describe("Util_StoreLayout.coverageFor", () => {
 globalThis.describe("Util_StoreLayout.protectionFor", () => {
   globalThis.test("alpha shares a bucket and is still protected", () => {
     globalThis.expect(Util_StoreLayout$ReventlessAws.layoutFor("alpha", Util_HostUiDomain$ReventlessAws.defaultProdStacks)).toEqual("SharedBucket");
-    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("alpha", undefined)).toEqual("Protected");
+    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("alpha", undefined, undefined)).toEqual("Protected");
   });
   globalThis.test("prod is protected", () => {
-    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("prod", undefined)).toEqual("Protected");
+    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("prod", undefined, undefined)).toEqual("Protected");
   });
   globalThis.test("a PR stack is unprotected so teardown does not leak buckets", () => {
-    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("pr-42", undefined)).toEqual("Unprotected");
+    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("pr-42", undefined, undefined)).toEqual("Unprotected");
   });
   globalThis.test("'prepare' is not a PR stack — the prefix is 'pr-', not 'pr'", () => {
-    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("prepare", undefined)).toEqual("Protected");
+    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("prepare", undefined, undefined)).toEqual("Protected");
+  });
+  globalThis.test("a stack declared disposable is unprotected whatever its name", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.protectionFor("dev", true, undefined)).toEqual("Unprotected");
   });
 });