@reventlessdev/reventless-aws 3.0.0-alpha.369 → 3.0.0-alpha.370

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.370 (2026-10-01)
+
+* feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))
+
+### BREAKING CHANGES
+
+* AllowGroups and AdminGroup are removed — write AllowRoles over
+the plugin's Roles.t, and use Role.admin / Platform.adminGroup(). Spec module
+types declare `type role`, and their rules are Authorization.rule<role>; a spec
+that writes its own rule declares `type role` (Reventless.Role.name for a rule
+over Authorization.permission). Role.name is a private string: make one from a
+string with Role.make.
+
+
+
 # 3.0.0-alpha.369 (2026-10-01)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.369",
+  "version": "3.0.0-alpha.370",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -22,18 +22,18 @@
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.27",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
     "@reventlessdev/rescript-node": "2.0.0-alpha.20",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.22",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.286",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.183",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.285",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.149",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.38",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.155"
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.150",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.156",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.184"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/scripts/ProvisionAdmin.res

@@ -76,7 +76,7 @@ Make the first administrator of a Reventless deployment.
                        one. The run always names the stack it used.
   --email <address>    The address they sign in with.
 
-Creates the "${Reventless.AdminGroup.name}" group if it is missing, the account if
+Creates the "${Reventless.Role.adminGroup()}" group if it is missing, the account if
 it is missing, a working password, and the membership between them. Provisions
 nothing that a platform stack owns. Region and credentials come from the
 environment, as for any AWS SDK call.
@@ -222,7 +222,7 @@ let run = async ({email, providerId, stack}: request): result<unit, string> =>
     switch await checkPoolAcceptsEmail(~providerId) {
     | Error(_) as e => e
     | Ok() =>
-      let group = Reventless.AdminGroup.name
+      let group = Reventless.Role.adminGroup()
       let password = Reventless.Util_Password.generate()
       await ensureGroup(~providerId, ~group)
       await ensureUser(~providerId, ~email)

package/scripts/ProvisionAdmin.res.mjs

@@ -1,9 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Util_Password$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Password.res.mjs";
 import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
 import * as ProvisionCognito$ReventlessAws from "./ProvisionCognito.res.mjs";
@@ -36,7 +36,7 @@ Make the first administrator of a Reventless deployment.
                        one. The run always names the stack it used.
   --email <address>    The address they sign in with.
 
-Creates the "` + AdminGroup$Reventless.name + `" group if it is missing, the account if
+Creates the "` + Role$Reventless.adminGroup() + `" group if it is missing, the account if
 it is missing, a working password, and the membership between them. Provisions
 nothing that a platform stack owns. Region and credentials come from the
 environment, as for any AWS SDK call.
@@ -156,12 +156,13 @@ async function run(param) {
   if (e$1.TAG !== "Ok") {
     return e$1;
   }
+  let group = Role$Reventless.adminGroup();
   let password = Util_Password$Reventless.generate();
-  await ensureGroup(providerId, AdminGroup$Reventless.name);
+  await ensureGroup(providerId, group);
   await ensureUser(providerId, email);
   await setPassword(providerId, email, password);
-  await addToGroup(providerId, email, AdminGroup$Reventless.name);
-  console.log(signInDetails(providerId, email, password, AdminGroup$Reventless.name));
+  await addToGroup(providerId, email, group);
+  console.log(signInDetails(providerId, email, password, group));
   return {
     TAG: "Ok",
     _0: undefined
@@ -212,4 +213,4 @@ export {
   cli,
   main,
 }
-/* CliArgs-Reventless Not a pure module */
+/* usage Not a pure module */

package/src/Platform.res

@@ -107,6 +107,24 @@ let messagingEmailSenderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.ma
     `""` means the platform named none, which the runtime reads as its default. */
 let messagingEmailProviderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
 
+/** Which group stands for which role, only where the two differ; every other
+    role maps to the group of its own name. Call before `Make()`: the platform
+    resolves roles while it is built, and a mapping stated later is refused. */
+let roleGroups = Reventless.Role.setGroups
+
+/** The groups of a user pool this deployment did not create, which no accounts
+    manifest names. They count as provided by the check that every role a plugin
+    needs has a group. */
+let providedGroups = Reventless.Role.provideGroups
+
+/** The group a role resolves to — the name this platform writes into its
+    directives, its shell configuration and the elevated groups. For code that
+    grants access by group, so it never spells one itself. */
+let groupOf = Reventless.Role.groupOf
+
+/** `groupOf(Role.admin)`. */
+let adminGroup = Reventless.Role.adminGroup
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -144,7 +162,15 @@ module MakeWithConfig = (
   // A default, never a forcing: an explicit `setElevatedGroups` in a platform
   // root — including one naming nobody — means what it says and wins. See
   // [Reventless.OwnerScope.defaultElevatedGroups].
-  Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+  Reventless.OwnerScope.defaultElevatedRoles([Reventless.Role.admin])
+
+  // What this deployment provides for the roles its plugins need: the
+  // administrator group the stack declares, and the groups of the accounts
+  // provisioning creates. Read when each plugin is built, after the root has
+  // mapped its roles.
+  Reventless.Role.provideGroupsFrom(() =>
+    [Reventless.Role.adminGroup()]->Array.concat(Reventless.AccountsManifest.declaredGroups())
+  )
 
   // Dispatch per-flavor commandHandlerConfig records to the four runtime
   // builders. Every sub-record is optional; only branches the caller actually
@@ -308,13 +334,16 @@ module MakeWithConfig = (
   // Admin base as a source-API document — auth-decorated (all fields Admin,
   // Cognito-only; the deploy-time SigV4 system-caller fields died with the
   // fragment registry) plus the canonical stamp.
-  let adminSourceSdl = (): string =>
+  let adminSourceSdl = (): string => {
+    // The directive below fixes the administrator's group for this deploy.
+    Reventless.Role.freeze()
     assembleCanonicalSourceSdl(
       ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
         ReventlessCore.Platform_AdminApi.baseFragment(~cloner=Config.cloner),
-        ~group=Reventless.AdminGroup.name,
+        ~group=Reventless.Role.adminGroup(),
       ),
     )
+  }
 
   // Split-mode Domain source document: relay base types + Platform_ping — the
   // Domain merged API's canonical owner (plugin fields come from plugin sources).

package/src/Platform.res.mjs

@@ -13,10 +13,10 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Belt_SetString from "@rescript/runtime/lib/es6/Belt_SetString.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
@@ -34,6 +34,7 @@ import * as Util_Bundle$ReventlessAws from "./util/Util_Bundle.res.mjs";
 import * as Plugin_Stack$ReventlessAws from "./plugin/stack/Plugin_Stack.res.mjs";
 import * as UiFragments$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateView/UiFragments.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 import * as Platform_Casts$ReventlessAws from "./Platform_Casts.res.mjs";
 import * as Platform_Stack$ReventlessAws from "./Platform_Stack.res.mjs";
 import * as QueryDbBackend$ReventlessAws from "./adapter/QueryDb/QueryDbBackend.res.mjs";
@@ -152,7 +153,8 @@ let messagingEmailProviderRef = {
 };
 
 function MakeWithConfig(Config) {
-  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+  OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
+  Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -214,7 +216,8 @@ function MakeWithConfig(Config) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), AdminGroup$Reventless.name, undefined);
+    Role$Reventless.freeze();
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), Role$Reventless.adminGroup(), undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -1566,7 +1569,8 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let commandHandlerConfig = {};
-  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+  OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
+  Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
   Stdlib_Option.forEach(commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -1628,7 +1632,8 @@ function Make($star) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), AdminGroup$Reventless.name, undefined);
+    Role$Reventless.freeze();
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), Role$Reventless.adminGroup(), undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -2958,6 +2963,14 @@ function Make($star) {
   };
 }
 
+let roleGroups = Role$Reventless.setGroups;
+
+let providedGroups = Role$Reventless.provideGroups;
+
+let groupOf = Role$Reventless.groupOf;
+
+let adminGroup = Role$Reventless.adminGroup;
+
 export {
   log,
   apiConfigRef,
@@ -2969,6 +2982,10 @@ export {
   geocoderPlaceIndexRef,
   messagingEmailSenderRef,
   messagingEmailProviderRef,
+  roleGroups,
+  providedGroups,
+  groupOf,
+  adminGroup,
   MakeWithConfig,
   Make,
 }

package/src/Platform_Stack.res

@@ -25,7 +25,7 @@ type cognitoUserPool = {
  *   with SPA-friendly defaults (email sign-in unless `platform:loginIdentifier`
  *   says otherwise, 12-char password policy, no MFA, and admin-only user
  *   creation unless `platform:signUpMode` says otherwise), plus the
- *   administrator group named by [Reventless.AdminGroup] and an elevated-groups
+ *   administrator group named by [Reventless.Role.adminGroup] and an elevated-groups
  *   default naming it. What it does **not** create is the first administrator:
  *   accounts are not stack resources, and a pool full of them is not something a
  *   `pulumi destroy` should be able to empty. `provision-admin` makes that one,
@@ -302,7 +302,7 @@ let _resolveUncached = (): cognitoUserPool => {
     // An ordinary child resource: the pool is ours, so this needs no out-of-band
     // call and Pulumi's state stays the authority for whether it exists.
     let _adminGroup = Util_CognitoGroupUser.addUserGroup(
-      ~name=Reventless.AdminGroup.name,
+      ~name=Reventless.Role.adminGroup(),
       ~userPoolId=pool.id,
     )
 
@@ -400,7 +400,10 @@ let _resolveUncached = (): cognitoUserPool => {
   // name is what a caller needs either way, and an output that appeared in one
   // mode and not the other would read as "there is no administrator group here"
   // rather than "this stack did not create it".
-  Pulumi.Pulumi.export("identityProviderAdminGroup", Pulumi.Output.make(Reventless.AdminGroup.name))
+  Pulumi.Pulumi.export(
+    "identityProviderAdminGroup",
+    Pulumi.Output.make(Reventless.Role.adminGroup()),
+  )
 
   // Exported so an operator can read back the store this provider resolved to —
   // the name is derived, not configured, so this is a convenience for checking

package/src/Platform_Stack.res.mjs

@@ -5,7 +5,7 @@ import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Auth_SignUpMode$ReventlessAws from "./adapter/Auth/Auth_SignUpMode.res.mjs";
@@ -133,7 +133,7 @@ function _resolveUncached() {
       mfaConfiguration: "OFF",
       tags: AWS_Tags$ReventlessAws.make("HostUiPool", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined)
     });
-    Util_CognitoGroupUser$ReventlessAws.addUserGroup(AdminGroup$Reventless.name, pool.id);
+    Util_CognitoGroupUser$ReventlessAws.addUserGroup(Role$Reventless.adminGroup(), pool.id);
     let tokenUnits2_accessToken = "minutes";
     let tokenUnits2_idToken = "minutes";
     let tokenUnits2_refreshToken = "days";
@@ -181,7 +181,7 @@ function _resolveUncached() {
   Pulumi$Pulumi.$$export("cognitoUserPoolArn", result.poolArn);
   Pulumi$Pulumi.$$export("cognitoRegion", regionOutput);
   Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
-  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(AdminGroup$Reventless.name));
+  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(Role$Reventless.adminGroup()));
   Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
   return result;
 }

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -194,7 +194,7 @@ let make = (
   let adminEntryJson =
     ReventlessCore.Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
       ~pluginId=ReventlessCore.Platform_Admin_Structure.pluginId,
-      ReventlessCore.Platform_Admin_Structure.structure,
+      ReventlessCore.Platform_Admin_Structure.structure(),
     )->JSON.stringify
 
   // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -107,7 +107,7 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
         encodeSelections(j.selections)
       ]
     ]))) : "";
-  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure));
+  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure()));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -6,7 +6,7 @@
 // ([Auth_ActiveRoleTrigger.res] bundles it and attaches it to the user pool).
 //
 // The narrowing has to happen here rather than in our own enforcement code
-// because `@authorize(AllowGroups([...]))` compiles to a field directive AppSync
+// because `@authorize(AllowRoles([...]))` compiles to a field directive AppSync
 // evaluates against `cognito:groups` **before any of our code executes**. A
 // request header we invent could scope reads correctly and still leave every
 // group-gated mutation callable — right about the data, wrong about the writes.

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res

@@ -150,7 +150,7 @@ let registerBinding = (
       ),
       labelField: entry.labelField,
       includeIdParam: entry.includeIdParam,
-      authorization: spec.authorization,
+      authorization: spec.authorization->Reventless.Authorization.named,
       // From the same schema `capability` is derived from, one line above, so the
       // two cannot end up disagreeing about this read model's fields.
       ownerField: Reventless.Owner.fieldNames(spec.stateSchema)->Array.get(0),

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as RowImage$Reventless from "@reventlessdev/reventless-spec/src/semantic/RowImage.res.mjs";
 import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as HandlerFactoryHelpersMjs from "./HandlerFactoryHelpers.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
 import * as PgQueryResolver_Lambda$ReventlessAws from "../QueryDb/PgQueryResolver_Lambda.res.mjs";
@@ -75,7 +76,7 @@ function registerBinding(pushdowns, pgConnection, entry, spec) {
     capability: GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(entry.readModelName, spec.stateSchema),
     labelField: entry.labelField,
     includeIdParam: entry.includeIdParam,
-    authorization: spec.authorization,
+    authorization: Authorization$Reventless.named(spec.authorization),
     ownerField: Owner$Reventless.fieldNames(spec.stateSchema)[0],
     retiredField: Stdlib_Option.map(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.field),
     retiredValues: Stdlib_Option.flatMap(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.values),

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -246,6 +246,7 @@ let makeFromCodeAsset: (
   // concludes nobody is elevated and stamps an operator's on-behalf write with
   // the operator's own id.
   Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
+  Util_OwnerScopeEnv.applyRoleGroupsDefault(variables)
 
   // ESM self-containment (Option C): every code archive built by
   // Util_Bundle.buildCodeArchive ships register-hook.mjs + layer-resolver.mjs at

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -104,6 +104,7 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
   });
   Util_LambdaLogging$ReventlessAws.applyLogLevelDefault(variables);
   Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
+  Util_OwnerScopeEnv$ReventlessAws.applyRoleGroupsDefault(variables);
   variables["NODE_OPTIONS"] = Util_Bundle$ReventlessAws.esmLoaderNodeOptions;
   variables["ESM_FALLBACK_DIRS"] = Util_Bundle$ReventlessAws.esmFallbackDirs;
   if (!RuntimeExtension$ReventlessCore.isEmpty()) {

package/src/components/Api/AppSync_Adapter.res

@@ -181,12 +181,13 @@ let rec waitForMergeSuccess = async (
 //      from `@@reventless.authorize` / `@authorize` PPX annotations.
 //
 // When both are present on the same field, the spec-level permission wins
-// (it is more specific). `AllowGroups([g1, g2, ...])` emits
-// `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
+// (it is more specific). `AllowRoles([r1, r2, ...])` emits
+// `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`, each `g` the group
+// the deployment maps that role to.
 // `AllowAuthenticated` emits the group-less `@aws_cognito_user_pools` — the same
 // reachability an undirectived field already has, but stated rather than left
 // implicit, so `assertGateable` can tell "deliberately open" from "nobody
-// stamped this". `AllowGroups([])` and `DenyAll` emit a sentinel `__deny_all__`
+// stamped this". `AllowRoles([])` and `DenyAll` emit a sentinel `__deny_all__`
 // group that no Cognito user can belong to — effectively blocking the field at
 // the API layer.
 //

package/src/components/Api/AppSync_SdlDecorate.res

@@ -136,8 +136,12 @@ type fieldGate =
 
 let permissionToGate = (permission: Reventless.Authorization.permission): fieldGate =>
   switch permission {
-  | AllowGroups([]) => Groups(["__deny_all__"])
-  | AllowGroups(groups) => Groups(groups)
+  // The groups the roles map to: the deploy program is where the mapping is known.
+  | AllowRoles(_) =>
+    switch Reventless.Authorization.groupsOf(permission) {
+    | [] => Groups(["__deny_all__"])
+    | groups => Groups(groups)
+    }
   | DenyAll => Groups(["__deny_all__"])
   | AllowAuthenticated => AnyAuthenticated
   | AllowAnonymous => Anonymous
@@ -165,7 +169,7 @@ let refuseAnonymousFields = (fieldNames: array<string>): 'a =>
     `Anonymous fields on AWS are deferred. When they land it will be as a separate\n` ++
     `API carrying only the unauthenticated fields. Do not add API_KEY to this one:\n` ++
     `every field here would then have to say whether the key reaches it, and one\n` ++
-    `that forgot would be open. Until then, declare the field AllowAuthenticated\n` ++ `(or AllowGroups) and mean it.`,
+    `that forgot would be open. Until then, declare the field AllowAuthenticated\n` ++ `(or AllowRoles) and mean it.`,
   )
 
 // Injects the Cognito group gate on ALL mutation, query, and subscription fields

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
 
 function injectAwsSubscribe(sdl, sources) {
@@ -65,7 +66,7 @@ function permissionToGate(permission) {
         };
     }
   } else {
-    let groups = permission._0;
+    let groups = Authorization$Reventless.groupsOf(permission);
     if (groups.length !== 0) {
       return {
         TAG: "Groups",
@@ -81,7 +82,7 @@ function permissionToGate(permission) {
 }
 
 function refuseAnonymousFields(fieldNames) {
-  return Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` + (`  ` + fieldNames.length.toString() + ` field(s) declare AllowAnonymous:\n`) + (`    ` + fieldNames.join(", ") + `\n\n`) + `AppSync has no anonymous authorization mode. This API is provisioned with\nAMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\ndirective available is @aws_cognito_user_pools — which means ANY\nAUTHENTICATED caller, the opposite of what the spec declares. Mutations have\nno runtime authorization check to correct it: on this platform the directive\nis the whole enforcement.\n\nThe local platform DOES honour AllowAnonymous (its resolvers call\nAuthorization.isAllowed), so a spec that passes locally can still not be\ndeployable here. That divergence is the reason this refuses instead of\nemitting a directive that reads as gated and is not.\n\nAnonymous fields on AWS are deferred. When they land it will be as a separate\nAPI carrying only the unauthenticated fields. Do not add API_KEY to this one:\nevery field here would then have to say whether the key reaches it, and one\nthat forgot would be open. Until then, declare the field AllowAuthenticated\n(or AllowGroups) and mean it.`);
+  return Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` + (`  ` + fieldNames.length.toString() + ` field(s) declare AllowAnonymous:\n`) + (`    ` + fieldNames.join(", ") + `\n\n`) + `AppSync has no anonymous authorization mode. This API is provisioned with\nAMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\ndirective available is @aws_cognito_user_pools — which means ANY\nAUTHENTICATED caller, the opposite of what the spec declares. Mutations have\nno runtime authorization check to correct it: on this platform the directive\nis the whole enforcement.\n\nThe local platform DOES honour AllowAnonymous (its resolvers call\nAuthorization.isAllowed), so a spec that passes locally can still not be\ndeployable here. That divergence is the reason this refuses instead of\nemitting a directive that reads as gated and is not.\n\nAnonymous fields on AWS are deferred. When they land it will be as a separate\nAPI carrying only the unauthenticated fields. Do not add API_KEY to this one:\nevery field here would then have to say whether the key reaches it, and one\nthat forgot would be open. Until then, declare the field AllowAuthenticated\n(or AllowRoles) and mean it.`);
 }
 
 function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
@@ -388,4 +389,4 @@ export {
   canonicalTypeNames,
   stampCanonicalTypes,
 }
-/* GraphQL_Stitcher-ReventlessCore Not a pure module */
+/* Authorization-Reventless Not a pure module */

package/src/util/Util_OwnerScopeEnv.res

@@ -46,3 +46,12 @@ let applyElevatedGroupsDefault = (variables: dict<Pulumi.Input.t<string>>) =>
   if variables->Dict.get(key)->Option.isNone {
     entry()->Option.forEach(((k, v)) => variables->Dict.set(k, v))
   }
+
+/** The renamed roles, for the same two-process reason: a runtime that evaluates
+    a rule (the SQL-backed view reads) never runs the root that stated the
+    mapping. Only the renamed ones travel; every other role is its own group. */
+let applyRoleGroupsDefault = (variables: dict<Pulumi.Input.t<string>>) =>
+  switch (variables->Dict.get(Reventless.Role.envKey), Reventless.Role.envValue()) {
+  | (None, Some(value)) => variables->Dict.set(Reventless.Role.envKey, value->Pulumi.Input.make)
+  | _ => ()
+  }

package/src/util/Util_OwnerScopeEnv.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 
 let key = "REVENTLESS_ELEVATED_GROUPS";
@@ -23,9 +24,21 @@ function applyElevatedGroupsDefault(variables) {
   }
 }
 
+function applyRoleGroupsDefault(variables) {
+  let match = variables[Role$Reventless.envKey];
+  let match$1 = Role$Reventless.envValue();
+  if (match !== undefined || match$1 === undefined) {
+    return;
+  } else {
+    variables[Role$Reventless.envKey] = match$1;
+    return;
+  }
+}
+
 export {
   key,
   entry,
   applyElevatedGroupsDefault,
+  applyRoleGroupsDefault,
 }
-/* OwnerScope-Reventless Not a pure module */
+/* Role-Reventless Not a pure module */

package/src/util/Util_ShellConfig.res

@@ -98,6 +98,10 @@ let fields = (
 ): dict<JSON.t> => {
   let out = computed->Dict.fromArray
 
+  // Computed, like the endpoints: the group the admin API is gated on, from the
+  // deploy's own role mapping.
+  ReventlessCore.Platform_AdminGroup.configEntry()->Option.forEach(((k, v)) => out->Dict.set(k, v))
+
   // The shell imports the module this key names, and imports nothing when the
   // key is absent — so writing the object without naming it here would ship a
   // file nothing fetches. Computed rather than left to `shellConfig` for the

package/src/util/Util_ShellConfig.res.mjs

@@ -5,6 +5,7 @@ import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Platform$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/Platform.res.mjs";
 import * as Platform_UiSlots$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_UiSlots.res.mjs";
+import * as Platform_AdminGroup$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminGroup.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 let journeyManifestsKey = "journeyManifestUrls";
@@ -59,6 +60,9 @@ function subscriptionEndpoint(httpsEndpoint) {
 
 function fields(computed, viewModes, bakedManifest, uiSlotsFile, shellConfig) {
   let out = Object.fromEntries(computed);
+  Stdlib_Option.forEach(Platform_AdminGroup$ReventlessCore.configEntry(), param => {
+    out[param[0]] = param[1];
+  });
   Stdlib_Option.forEach(uiSlotsFile, param => {
     out[Platform_UiSlots$ReventlessCore.configKey] = Platform_UiSlots$ReventlessCore.url;
   });
@@ -103,4 +107,4 @@ export {
   subscriptionEndpoint,
   fields,
 }
-/* No side effect */
+/* Platform_AdminGroup-ReventlessCore Not a pure module */

package/tests/AppSync_AdapterTest.res

@@ -183,20 +183,16 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     ?permission,
   }
 
-  testSync("AllowGroups([\"Admin\"]) emits cognito_groups: [\"Admin\"] on mutation", () => {
+  testSync("AllowRoles with several roles emits comma-separated groups", () => {
     let fp = Dict.fromArray([
-      ("catalog_Category_Archive", Reventless.Authorization.AllowGroups(["Admin"])),
+      (
+        "p_X",
+        Reventless.Authorization.AllowRoles([
+          Reventless.Role.make("Admin"),
+          Reventless.Role.make("Editor"),
+        ]),
+      ),
     ])
-    let entry = mutationEntry(~fieldNames=["catalog_Category_Archive"], ~fieldPermissions=fp)
-    let frag = makeFragment(["catalog_Category_Archive(id: ID!): String"], [])
-    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
-    let parts = decodeFragment(aug)
-    let m = parts.mutations->Array.getUnsafe(0)
-    expect(m)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
-  })
-
-  testSync("AllowGroups multi-group emits comma-separated groups", () => {
-    let fp = Dict.fromArray([("p_X", Reventless.Authorization.AllowGroups(["Admin", "Editor"]))])
     let entry = mutationEntry(~fieldNames=["p_X"], ~fieldPermissions=fp)
     let frag = makeFragment(["p_X(id: ID!): String"], [])
     let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
@@ -206,6 +202,29 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     )->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`)
   })
 
+  // The deploy program knows the mapping, so the directive carries the group a
+  // role maps to — never the role, which no token carries.
+  testSync("AllowRoles emits the groups its roles map to", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.make("Merchandiser"), "shop-merch-team")])
+    let fp = Dict.fromArray([
+      (
+        "p_Rename",
+        Reventless.Authorization.AllowRoles([
+          Reventless.Role.make("Admin"),
+          Reventless.Role.make("Merchandiser"),
+        ]),
+      ),
+    ])
+    let entry = mutationEntry(~fieldNames=["p_Rename"], ~fieldPermissions=fp)
+    let frag = makeFragment(["p_Rename(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    Reventless.Role.clearGroups()
+    expect(
+      decodeFragment(aug).mutations->Array.getUnsafe(0),
+    )->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "shop-merch-team"])`)
+  })
+
   testSync("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Dict.fromArray([("p_Add", Reventless.Authorization.AllowAuthenticated)])
     let entry = mutationEntry(~fieldNames=["p_Add"], ~fieldPermissions=fp)
@@ -230,7 +249,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
 
   testSync("Per-field permissions: only annotated fields get directives", () => {
     let fp = Dict.fromArray([
-      ("p_Archive", Reventless.Authorization.AllowGroups(["Admin"])),
+      ("p_Archive", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
       ("p_Add", Reventless.Authorization.AllowAuthenticated),
     ])
     let entry = mutationEntry(~fieldNames=["p_Archive", "p_Add"], ~fieldPermissions=fp)
@@ -255,7 +274,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     let entry = queryEntry(
       ~single="p_Item",
       ~list="p_Items",
-      ~permission=Some(Reventless.Authorization.AllowGroups(["Manager"])),
+      ~permission=Some(Reventless.Authorization.AllowRoles([Reventless.Role.make("Manager")])),
     )
     // Production query SDL emitted by GraphQL_FragmentGenerator always has an
     // arg list (Relay pagination on the list field), so extractLeadingName's
@@ -362,7 +381,9 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
   testSync("Spec-level permission wins over legacy authorization field", () => {
     // Legacy {tableName, group} says "Admin"; spec-level says "Manager".
     // Spec-level must win.
-    let fp = Dict.fromArray([("p_X", Reventless.Authorization.AllowGroups(["Manager"]))])
+    let fp = Dict.fromArray([
+      ("p_X", Reventless.Authorization.AllowRoles([Reventless.Role.make("Manager")])),
+    ])
     let entry: ReventlessInfra.Api.mutationSchemaEntry = {
       fieldNames: ["p_X"],
       commandSchema: S.unknown,
@@ -427,7 +448,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       fieldNames: ["p_Sync"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([
-        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Sync", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
       ]),
       systemCallable: true,
     }
@@ -464,8 +485,8 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       fieldNames: ["p_Sync", "p_Other"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([
-        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
-        ("p_Other", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Sync", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
+        ("p_Other", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
       ]),
       // systemCallable applies to every field in the entry; split the fields so only
       // p_Sync opts in.
@@ -475,7 +496,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       fieldNames: ["p_Sync"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([
-        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Sync", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
       ]),
       systemCallable: true,
     }
@@ -501,7 +522,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       returnTypeName: "p_Item",
       stateSchema: S.unknown,
       authorization: None,
-      permission: Reventless.Authorization.AllowGroups(["Admin"]),
+      permission: Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")]),
       systemCallable: true,
     }
     let frag = makeFragment(
@@ -532,7 +553,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
         returnTypeName: "p_Item",
         stateSchema: S.unknown,
         authorization: None,
-        permission: Reventless.Authorization.AllowGroups(["Admin"]),
+        permission: Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")]),
         systemCallable: true,
       }
       let frag = makeFragment(
@@ -583,7 +604,7 @@ describe("AppSync_Adapter — type-level dual-auth", () => {
     returnTypeName: "p_Item",
     stateSchema: S.unknown,
     authorization: None,
-    permission: Reventless.Authorization.AllowGroups(["Admin"]),
+    permission: Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")]),
     systemCallable: true,
   }
 
@@ -958,7 +979,9 @@ describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
   })
 
   testSync("a subscription named like a gated mutation inherits its groups", () => {
-    let fp = Dict.fromArray([("p_Ship", Reventless.Authorization.AllowGroups(["Fulfilment"]))])
+    let fp = Dict.fromArray([
+      ("p_Ship", Reventless.Authorization.AllowRoles([Reventless.Role.make("Fulfilment")])),
+    ])
     let frag = makeFragment(["p_Ship: CommandResult"])
     let aug = AppSync_Adapter.injectAwsAuth(
       frag,

package/tests/AppSync_AdapterTest.res.mjs

@@ -4,6 +4,7 @@ import * as Sury from "sury";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as AppSync_Adapter$ReventlessAws from "../src/components/Api/AppSync_Adapter.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
@@ -129,37 +130,44 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     authorization: undefined,
     permission: permission
   });
-  globalThis.test("AllowGroups([\"Admin\"]) emits cognito_groups: [\"Admin\"] on mutation", () => {
+  globalThis.test("AllowRoles with several roles emits comma-separated groups", () => {
     let fp = Object.fromEntries([[
-        "catalog_Category_Archive",
+        "p_X",
         {
-          TAG: "AllowGroups",
-          _0: ["Admin"]
+          TAG: "AllowRoles",
+          _0: [
+            "Admin",
+            "Editor"
+          ]
         }
       ]]);
-    let entry = mutationEntry(["catalog_Category_Archive"], fp);
-    let frag = makeFragment(["catalog_Category_Archive(id: ID!): String"], []);
+    let entry = mutationEntry(["p_X"], fp);
+    let frag = makeFragment(["p_X(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    let m = parts.mutations[0];
-    globalThis.expect(m).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+    globalThis.expect(parts.mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`);
   });
-  globalThis.test("AllowGroups multi-group emits comma-separated groups", () => {
+  globalThis.test("AllowRoles emits the groups its roles map to", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        "Merchandiser",
+        "shop-merch-team"
+      ]]);
     let fp = Object.fromEntries([[
-        "p_X",
+        "p_Rename",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: [
             "Admin",
-            "Editor"
+            "Merchandiser"
           ]
         }
       ]]);
-    let entry = mutationEntry(["p_X"], fp);
-    let frag = makeFragment(["p_X(id: ID!): String"], []);
+    let entry = mutationEntry(["p_Rename"], fp);
+    let frag = makeFragment(["p_Rename(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
-    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`);
+    Role$Reventless.clearGroups();
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "shop-merch-team"])`);
   });
   globalThis.test("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Object.fromEntries([[
@@ -190,7 +198,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
       [
         "p_Archive",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ],
@@ -226,7 +234,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
   });
   globalThis.test("Query permission applies to BOTH single and list field names", () => {
     let entry = queryEntry("p_Item", "p_Items", {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Manager"]
     });
     let frag = makeFragment([], [
@@ -318,7 +326,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let fp = Object.fromEntries([[
         "p_X",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Manager"]
         }
       ]]);
@@ -380,7 +388,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
     let entry_fieldPermissions = Object.fromEntries([[
         "p_Sync",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ]]);
@@ -427,14 +435,14 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
       [
         "p_Sync",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ],
       [
         "p_Other",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ]
@@ -450,7 +458,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
     let iamEntry_fieldPermissions = Object.fromEntries([[
         "p_Sync",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ]]);
@@ -481,7 +489,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
   });
   globalThis.test("systemCallable query applies dual-auth to BOTH single and list fields", () => {
     let entry_permission = {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Admin"]
     };
     let entry_systemCallable = true;
@@ -514,7 +522,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
   });
   globalThis.test("systemCallable dual-auth extends to derived query fields (Items/ByIds/By<Index>)", () => {
     let entry_permission = {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Admin"]
     };
     let entry_systemCallable = true;
@@ -554,7 +562,7 @@ globalThis.describe("AppSync_Adapter — type-level dual-auth", () => {
     subscriptionSources: []
   });
   let callableEntry_permission = {
-    TAG: "AllowGroups",
+    TAG: "AllowRoles",
     _0: ["Admin"]
   };
   let callableEntry_systemCallable = true;
@@ -845,7 +853,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
     let fp = Object.fromEntries([[
         "p_Ship",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Fulfilment"]
         }
       ]]);

package/tests/PgPipeline_IntegrationTest.res

@@ -35,7 +35,8 @@ module OrdersSpec = {
 
   let config = Reventless.ReadModel.config()
   let subIdConfig = None
-  let authorization: Reventless.Authorization.permission = AllowAuthenticated
+  type role = Reventless.Role.name
+  let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
   let visibility: Reventless.Visibility.t = Public
 }
 

package/tests/PgQueryDbUnion_IntegrationTest.res

@@ -30,7 +30,8 @@ module CustomersSpec = {
 
   let config = Reventless.ReadModel.config()
   let subIdConfig = None
-  let authorization: Reventless.Authorization.permission = AllowAuthenticated
+  type role = Reventless.Role.name
+  let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
   let visibility: Reventless.Visibility.t = Public
 }
 

package/tests/Util_OwnerScopeEnvTest.res

@@ -68,7 +68,7 @@ describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
   testSync("the platform's administrator default reaches a composed environment", () => {
     Reventless.OwnerScope.clearElevatedGroups()
     NodeProcess.env->Dict.delete(Util_OwnerScopeEnv.key)
-    Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+    Reventless.OwnerScope.defaultElevatedRoles([Reventless.Role.admin])
 
     let variables = Dict.make()
     Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
@@ -81,7 +81,53 @@ describe("Util_OwnerScopeEnv — the elevated-groups carrier", () => {
     // Round-tripped, like the first case above: the runtime reads this back with
     // `parseElevatedGroups`, so the encoding is asserted rather than the spelling.
     expect(Reventless.OwnerScope.parseElevatedGroups(encoded))->toEqual([
-      Reventless.AdminGroup.name,
+      Reventless.Role.adminGroup(),
     ])
   })
+
+  // Runtimes read groups, never roles, so an elevated role travels as the group
+  // the deploy program mapped it to.
+  testSync("an elevated role travels as the group it is mapped to", () => {
+    Reventless.OwnerScope.clearElevatedGroups()
+    Reventless.Role.clearGroups()
+    NodeProcess.env->Dict.delete(Util_OwnerScopeEnv.key)
+    Reventless.Role.setGroups([(Reventless.Role.make("Fulfilment"), "shop-ops")])
+    Reventless.OwnerScope.setElevatedRoles([Reventless.Role.make("Fulfilment")])
+    Reventless.OwnerScope.setElevatedGroups(["Admin"])
+
+    let variables = Dict.make()
+    Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
+    let encoded = switch variables->Dict.get(Util_OwnerScopeEnv.key) {
+    | Some(value) => value->Obj.magic
+    | None => ""
+    }
+    Reventless.OwnerScope.clearElevatedGroups()
+    Reventless.Role.clearGroups()
+
+    expect(Reventless.OwnerScope.parseElevatedGroups(encoded))->toEqual(["Admin", "shop-ops"])
+  })
+})
+
+describe("Util_OwnerScopeEnv.applyRoleGroupsDefault", () => {
+  testSync("carries the renamed roles, and only those", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.make("Merchandiser"), "shop-merch-team")])
+    let variables = Dict.make()
+    Util_OwnerScopeEnv.applyRoleGroupsDefault(variables)
+    Reventless.Role.clearGroups()
+    let encoded = switch variables->Dict.get(Reventless.Role.envKey) {
+    | Some(value) => value->Obj.magic
+    | None => ""
+    }
+    expect(Reventless.Role.parseGroups(encoded))->toEqual([
+      (Reventless.Role.make("Merchandiser"), "shop-merch-team"),
+    ])
+  })
+
+  testSync("adds nothing when no role is renamed", () => {
+    Reventless.Role.clearGroups()
+    let variables = Dict.make()
+    Util_OwnerScopeEnv.applyRoleGroupsDefault(variables)
+    expect(variables->Dict.get(Reventless.Role.envKey)->Option.isNone)->toBe(true)
+  })
 })

package/tests/Util_OwnerScopeEnvTest.res.mjs

@@ -2,7 +2,7 @@
 
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Util_OwnerScopeEnv$ReventlessAws from "../src/util/Util_OwnerScopeEnv.res.mjs";
 
@@ -59,13 +59,59 @@ globalThis.describe("Util_OwnerScopeEnv — the elevated-groups carrier", () =>
   globalThis.test("the platform's administrator default reaches a composed environment", () => {
     OwnerScope$Reventless.clearElevatedGroups();
     Stdlib_Dict.$$delete(process.env, Util_OwnerScopeEnv$ReventlessAws.key);
-    OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+    OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
     let variables = {};
     Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
     let value = variables[Util_OwnerScopeEnv$ReventlessAws.key];
     let encoded = value !== undefined ? value : "";
     OwnerScope$Reventless.clearElevatedGroups();
-    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([AdminGroup$Reventless.name]);
+    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([Role$Reventless.adminGroup()]);
+  });
+  globalThis.test("an elevated role travels as the group it is mapped to", () => {
+    OwnerScope$Reventless.clearElevatedGroups();
+    Role$Reventless.clearGroups();
+    Stdlib_Dict.$$delete(process.env, Util_OwnerScopeEnv$ReventlessAws.key);
+    Role$Reventless.setGroups([[
+        "Fulfilment",
+        "shop-ops"
+      ]]);
+    OwnerScope$Reventless.setElevatedRoles(["Fulfilment"]);
+    OwnerScope$Reventless.setElevatedGroups(["Admin"]);
+    let variables = {};
+    Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
+    let value = variables[Util_OwnerScopeEnv$ReventlessAws.key];
+    let encoded = value !== undefined ? value : "";
+    OwnerScope$Reventless.clearElevatedGroups();
+    Role$Reventless.clearGroups();
+    globalThis.expect(OwnerScope$Reventless.parseElevatedGroups(encoded)).toEqual([
+      "Admin",
+      "shop-ops"
+    ]);
+  });
+});
+
+globalThis.describe("Util_OwnerScopeEnv.applyRoleGroupsDefault", () => {
+  globalThis.test("carries the renamed roles, and only those", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        "Merchandiser",
+        "shop-merch-team"
+      ]]);
+    let variables = {};
+    Util_OwnerScopeEnv$ReventlessAws.applyRoleGroupsDefault(variables);
+    Role$Reventless.clearGroups();
+    let value = variables[Role$Reventless.envKey];
+    let encoded = value !== undefined ? value : "";
+    globalThis.expect(Role$Reventless.parseGroups(encoded)).toEqual([[
+        "Merchandiser",
+        "shop-merch-team"
+      ]]);
+  });
+  globalThis.test("adds nothing when no role is renamed", () => {
+    Role$Reventless.clearGroups();
+    let variables = {};
+    Util_OwnerScopeEnv$ReventlessAws.applyRoleGroupsDefault(variables);
+    globalThis.expect(Stdlib_Option.isNone(variables[Role$Reventless.envKey])).toBe(true);
   });
 });
 

package/tests/Util_ShellConfigTest.res

@@ -328,3 +328,20 @@ describe("the subscription endpoint", () => {
     )
   )
 })
+
+// The shell gates its admin discovery on this group; a mirror of the server's
+// own resolution, so a renamed administrator role reaches the browser too.
+describe("Util_ShellConfig.fields — adminGroup", () => {
+  testSync("is absent while the administrator role keeps its own name", () => {
+    Reventless.Role.clearGroups()
+    expect(Util_ShellConfig.fields(~computed)->Dict.get("adminGroup")->Option.isNone)->toBe(true)
+  })
+
+  testSync("carries the group a renamed administrator role maps to", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.admin, "shop-admins")])
+    let out = Util_ShellConfig.fields(~computed)
+    Reventless.Role.clearGroups()
+    expect(out->get("adminGroup"))->toEqual(JSON.Encode.string("shop-admins"))
+  })
+})

package/tests/Util_ShellConfigTest.res.mjs

@@ -4,6 +4,7 @@ import * as JestGlobals from "@reventlessdev/rescript-jest/src/JestGlobals.res.m
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
@@ -341,6 +342,23 @@ globalThis.describe("the subscription endpoint", () => {
   });
 });
 
+globalThis.describe("Util_ShellConfig.fields — adminGroup", () => {
+  globalThis.test("is absent while the administrator role keeps its own name", () => {
+    Role$Reventless.clearGroups();
+    globalThis.expect(Stdlib_Option.isNone(Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, undefined, undefined)["adminGroup"])).toBe(true);
+  });
+  globalThis.test("carries the group a renamed administrator role maps to", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        Role$Reventless.admin,
+        "shop-admins"
+      ]]);
+    let out = Util_ShellConfig$ReventlessAws.fields(computed, undefined, undefined, undefined, undefined);
+    Role$Reventless.clearGroups();
+    globalThis.expect(get(out, "adminGroup")).toEqual("shop-admins");
+  });
+});
+
 export {
   computed,
   get,

package/tests/integration/AggTestAggregate.res

@@ -18,6 +18,7 @@ type error = AlreadyExists
 
 let name = "AggTestAggregate"
 let moduleUrl = "agg-test://AggTestAggregate"
-let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type role = Reventless.Role.name
+let commandAuthorization = (_: command): Reventless.Authorization.rule<role> => AllowAnonymous
 type lifecycleState = unit
 let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted

package/tests/integration/EpCompositeSlice.res

@@ -63,7 +63,8 @@ type event =
 
 let name = "EpCompositeSlice"
 let moduleUrl = "ep-test://EpCompositeSlice"
-let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type role = Reventless.Role.name
+let commandAuthorization = (_: command): Reventless.Authorization.rule<role> => AllowAnonymous
 type lifecycleState = unit
 let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted
 let readConsistency = Reventless.ReadConsistency.EscalateOnRetry

package/tests/integration/EpTestSlice.res

@@ -21,7 +21,8 @@ type event = WidgetAdded({widgetId: @s.matches(Reventless.DcbTag.partition) stri
 
 let name = "EpTestSlice"
 let moduleUrl = "ep-test://EpTestSlice"
-let commandAuthorization = (_: command): Reventless.Authorization.permission => AllowAnonymous
+type role = Reventless.Role.name
+let commandAuthorization = (_: command): Reventless.Authorization.rule<role> => AllowAnonymous
 type lifecycleState = unit
 let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted
 let readConsistency = Reventless.ReadConsistency.EscalateOnRetry

package/tests/integration/QueryDbUnion_DynamoDb_IntegrationTest.res

@@ -32,7 +32,8 @@ module CustomersSpec = {
 
   let config = Reventless.ReadModel.config()
   let subIdConfig = None
-  let authorization: Reventless.Authorization.permission = AllowAuthenticated
+  type role = Reventless.Role.name
+  let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
   let visibility: Reventless.Visibility.t = Public
 }