@reventlessdev/reventless-aws 3.0.0-alpha.369 → 3.0.0-alpha.371

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.371 (2026-10-01)
+
+### Bug Fixes
+
+* check a plugin's roles against the user pool's groups ([ddb3c42](https://github.com/ReventlessDev/reventless-core/commit/ddb3c422b7226a19800e781abd5f03af18867007))
+
+
+# 3.0.0-alpha.370 (2026-10-01)
+
+* feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))
+
+### BREAKING CHANGES
+
+* AllowGroups and AdminGroup are removed — write AllowRoles over
+the plugin's Roles.t, and use Role.admin / Platform.adminGroup(). Spec module
+types declare `type role`, and their rules are Authorization.rule<role>; a spec
+that writes its own rule declares `type role` (Reventless.Role.name for a rule
+over Authorization.permission). Role.name is a private string: make one from a
+string with Role.make.
+
+
+
 # 3.0.0-alpha.369 (2026-10-01)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.369",
+  "version": "3.0.0-alpha.371",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -21,19 +21,19 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "yaml": "^2.8.3",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.27",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
-    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.22",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.28",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
+    "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.23",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/rescript-web": "1.0.0-alpha.7",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.183",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.285",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.149",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.38",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.155"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.287",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.151",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.157",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.39"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/scripts/ProvisionAdmin.res

@@ -76,7 +76,7 @@ Make the first administrator of a Reventless deployment.
                        one. The run always names the stack it used.
   --email <address>    The address they sign in with.
 
-Creates the "${Reventless.AdminGroup.name}" group if it is missing, the account if
+Creates the "${Reventless.Role.adminGroup()}" group if it is missing, the account if
 it is missing, a working password, and the membership between them. Provisions
 nothing that a platform stack owns. Region and credentials come from the
 environment, as for any AWS SDK call.
@@ -222,7 +222,7 @@ let run = async ({email, providerId, stack}: request): result<unit, string> =>
     switch await checkPoolAcceptsEmail(~providerId) {
     | Error(_) as e => e
     | Ok() =>
-      let group = Reventless.AdminGroup.name
+      let group = Reventless.Role.adminGroup()
       let password = Reventless.Util_Password.generate()
       await ensureGroup(~providerId, ~group)
       await ensureUser(~providerId, ~email)

package/scripts/ProvisionAdmin.res.mjs

@@ -1,9 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as CliArgs$Reventless from "@reventlessdev/reventless-spec/src/CliArgs.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Util_Password$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Password.res.mjs";
 import * as Util_AwsError$ReventlessAws from "../src/util/Util_AwsError.res.mjs";
 import * as ProvisionCognito$ReventlessAws from "./ProvisionCognito.res.mjs";
@@ -36,7 +36,7 @@ Make the first administrator of a Reventless deployment.
                        one. The run always names the stack it used.
   --email <address>    The address they sign in with.
 
-Creates the "` + AdminGroup$Reventless.name + `" group if it is missing, the account if
+Creates the "` + Role$Reventless.adminGroup() + `" group if it is missing, the account if
 it is missing, a working password, and the membership between them. Provisions
 nothing that a platform stack owns. Region and credentials come from the
 environment, as for any AWS SDK call.
@@ -156,12 +156,13 @@ async function run(param) {
   if (e$1.TAG !== "Ok") {
     return e$1;
   }
+  let group = Role$Reventless.adminGroup();
   let password = Util_Password$Reventless.generate();
-  await ensureGroup(providerId, AdminGroup$Reventless.name);
+  await ensureGroup(providerId, group);
   await ensureUser(providerId, email);
   await setPassword(providerId, email, password);
-  await addToGroup(providerId, email, AdminGroup$Reventless.name);
-  console.log(signInDetails(providerId, email, password, AdminGroup$Reventless.name));
+  await addToGroup(providerId, email, group);
+  console.log(signInDetails(providerId, email, password, group));
   return {
     TAG: "Ok",
     _0: undefined
@@ -212,4 +213,4 @@ export {
   cli,
   main,
 }
-/* CliArgs-Reventless Not a pure module */
+/* usage Not a pure module */

package/src/Platform.res

@@ -107,6 +107,47 @@ let messagingEmailSenderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.ma
     `""` means the platform named none, which the runtime reads as its default. */
 let messagingEmailProviderRef: ref<Pulumi.Output.t<string>> = ref(Pulumi.Output.make(""))
 
+/** Which group stands for which role, only where the two differ; every other
+    role maps to the group of its own name. Call before `Make()`: the platform
+    resolves roles while it is built, and a mapping stated later is refused. */
+let roleGroups = Reventless.Role.setGroups
+
+/** Groups a root says its identity provider has, for a provider the platform
+    cannot list. Where it can (`loadProvidedGroups`), the listing decides, and a
+    declared group the pool lacks fails the deploy. */
+let providedGroups = Reventless.Role.provideGroups
+
+/** The platform stack a plugin stack deploys against (`platform:stack`), or
+    `None` in a program that is its own platform. One reference per program:
+    a second with the same name is a duplicate resource. */
+let platformStackRefCache: ref<option<option<Pulumi.StackReference.t>>> = ref(None)
+
+let platformStackReference = (): option<Pulumi.StackReference.t> =>
+  switch platformStackRefCache.contents {
+  | Some(stackRef) => stackRef
+  | None =>
+    let stackRef =
+      Pulumi.Config.make(Some("platform"))
+      ->Pulumi.Config.get("stack")
+      ->Option.map(stack => Pulumi.StackReference.make(stack))
+    platformStackRefCache := Some(stackRef)
+    stackRef
+  }
+
+/** Ask the user pool which groups it has, so the role check compares each
+    plugin's roles with the pool. A plugin's deploy program calls `deployPlugin`
+    once this resolves; see [Platform_ProvidedGroups]. */
+let loadProvidedGroups = (): promise<unit> =>
+  Platform_ProvidedGroups.load(~stackRef=platformStackReference())
+
+/** The group a role resolves to — the name this platform writes into its
+    directives, its shell configuration and the elevated groups. For code that
+    grants access by group, so it never spells one itself. */
+let groupOf = Reventless.Role.groupOf
+
+/** `groupOf(Role.admin)`. */
+let adminGroup = Reventless.Role.adminGroup
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -144,7 +185,15 @@ module MakeWithConfig = (
   // A default, never a forcing: an explicit `setElevatedGroups` in a platform
   // root — including one naming nobody — means what it says and wins. See
   // [Reventless.OwnerScope.defaultElevatedGroups].
-  Reventless.OwnerScope.defaultElevatedGroups([Reventless.AdminGroup.name])
+  Reventless.OwnerScope.defaultElevatedRoles([Reventless.Role.admin])
+
+  // What this deployment provides for the roles its plugins need, where the pool
+  // was not listed (`loadProvidedGroups`): the administrator group the stack
+  // declares, and the groups of the accounts provisioning creates. Read when each
+  // plugin is built, after the root has mapped its roles.
+  Reventless.Role.provideGroupsFrom(() =>
+    [Reventless.Role.adminGroup()]->Array.concat(Reventless.AccountsManifest.declaredGroups())
+  )
 
   // Dispatch per-flavor commandHandlerConfig records to the four runtime
   // builders. Every sub-record is optional; only branches the caller actually
@@ -202,10 +251,7 @@ module MakeWithConfig = (
   // Determine API source based on platform:stack config.
   // - Platform/monolithic mode (no config): create a real AppSync API resource.
   // - Plugin mode (config set): reference the platform's shared API via StackReference.
-  let platformStackRef =
-    Pulumi.Config.make(Some("platform"))
-    ->Pulumi.Config.get("stack")
-    ->Option.map(stack => Pulumi.StackReference.make(stack))
+  let platformStackRef = platformStackReference()
 
   // The declared object stores, as the upload claimer needs them: qualified
   // name, physical bucket, served prefix.
@@ -308,13 +354,16 @@ module MakeWithConfig = (
   // Admin base as a source-API document — auth-decorated (all fields Admin,
   // Cognito-only; the deploy-time SigV4 system-caller fields died with the
   // fragment registry) plus the canonical stamp.
-  let adminSourceSdl = (): string =>
+  let adminSourceSdl = (): string => {
+    // The directive below fixes the administrator's group for this deploy.
+    Reventless.Role.freeze()
     assembleCanonicalSourceSdl(
       ~baseFragment=AppSync_Adapter.injectAwsAuthAll(
         ReventlessCore.Platform_AdminApi.baseFragment(~cloner=Config.cloner),
-        ~group=Reventless.AdminGroup.name,
+        ~group=Reventless.Role.adminGroup(),
       ),
     )
+  }
 
   // Split-mode Domain source document: relay base types + Platform_ping — the
   // Domain merged API's canonical owner (plugin fields come from plugin sources).

package/src/Platform.res.mjs

@@ -13,10 +13,10 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Belt_SetString from "@rescript/runtime/lib/es6/Belt_SetString.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Plugin$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin.res.mjs";
@@ -34,6 +34,7 @@ import * as Util_Bundle$ReventlessAws from "./util/Util_Bundle.res.mjs";
 import * as Plugin_Stack$ReventlessAws from "./plugin/stack/Plugin_Stack.res.mjs";
 import * as UiFragments$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateView/UiFragments.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 import * as Platform_Casts$ReventlessAws from "./Platform_Casts.res.mjs";
 import * as Platform_Stack$ReventlessAws from "./Platform_Stack.res.mjs";
 import * as QueryDbBackend$ReventlessAws from "./adapter/QueryDb/QueryDbBackend.res.mjs";
@@ -79,6 +80,7 @@ import * as EventTopicPublisher_SNS$ReventlessAws from "./adapter/EventTopic/Eve
 import * as ExtensionPointMapping$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/ExtensionPointMapping.res.mjs";
 import * as PgQueryResolver_Builder$ReventlessAws from "./adapter/QueryDb/PgQueryResolver_Builder.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
+import * as Platform_ProvidedGroups$ReventlessAws from "./Platform_ProvidedGroups.res.mjs";
 import * as UiFragments_Projection$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateView/UiFragments_Projection.res.mjs";
 import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_Builder_Single.res.mjs";
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
@@ -151,8 +153,27 @@ let messagingEmailProviderRef = {
   contents: Pulumi.output("")
 };
 
+let platformStackRefCache = {
+  contents: undefined
+};
+
+function platformStackReference() {
+  let stackRef = platformStackRefCache.contents;
+  if (stackRef !== undefined) {
+    return Primitive_option.valFromOption(stackRef);
+  }
+  let stackRef$1 = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  platformStackRefCache.contents = Primitive_option.some(stackRef$1);
+  return stackRef$1;
+}
+
+function loadProvidedGroups() {
+  return Platform_ProvidedGroups$ReventlessAws.load(platformStackReference());
+}
+
 function MakeWithConfig(Config) {
-  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+  OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
+  Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -181,7 +202,7 @@ function MakeWithConfig(Config) {
   let currentDeployTarget = {
     contents: "Domain"
   };
-  let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let platformStackRef = platformStackReference();
   let claimStores = () => {
     if (platformStackRef !== undefined) {
       return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
@@ -214,7 +235,8 @@ function MakeWithConfig(Config) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), AdminGroup$Reventless.name, undefined);
+    Role$Reventless.freeze();
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(Config.cloner), Role$Reventless.adminGroup(), undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -1566,7 +1588,8 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let commandHandlerConfig = {};
-  OwnerScope$Reventless.defaultElevatedGroups([AdminGroup$Reventless.name]);
+  OwnerScope$Reventless.defaultElevatedRoles([Role$Reventless.admin]);
+  Role$Reventless.provideGroupsFrom(() => [Role$Reventless.adminGroup()].concat(AccountsManifest$Reventless.declaredGroups()));
   Stdlib_Option.forEach(commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
     Stdlib_Option.forEach(param.async, AggregateRuntime_Builder_Single_Async$ReventlessAws.setConfig);
@@ -1595,7 +1618,7 @@ function Make($star) {
   let currentDeployTarget = {
     contents: "Domain"
   };
-  let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let platformStackRef = platformStackReference();
   let claimStores = () => {
     if (platformStackRef !== undefined) {
       return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
@@ -1628,7 +1651,8 @@ function Make($star) {
     subscriptionSources: []
   });
   let adminSourceSdl = () => {
-    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), AdminGroup$Reventless.name, undefined);
+    Role$Reventless.freeze();
+    let baseFragment = AppSync_Adapter$ReventlessAws.injectAwsAuthAll(Platform_AdminApi$ReventlessCore.baseFragment(false), Role$Reventless.adminGroup(), undefined);
     return AppSync_SdlDecorate$ReventlessAws.stampCanonicalTypes(AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(baseFragment));
   };
   let match;
@@ -2958,6 +2982,14 @@ function Make($star) {
   };
 }
 
+let roleGroups = Role$Reventless.setGroups;
+
+let providedGroups = Role$Reventless.provideGroups;
+
+let groupOf = Role$Reventless.groupOf;
+
+let adminGroup = Role$Reventless.adminGroup;
+
 export {
   log,
   apiConfigRef,
@@ -2969,6 +3001,13 @@ export {
   geocoderPlaceIndexRef,
   messagingEmailSenderRef,
   messagingEmailProviderRef,
+  roleGroups,
+  providedGroups,
+  platformStackRefCache,
+  platformStackReference,
+  loadProvidedGroups,
+  groupOf,
+  adminGroup,
   MakeWithConfig,
   Make,
 }

package/src/Platform_ProvidedGroups.res

@@ -0,0 +1,97 @@
+/***
+The user pool's groups, read before a plugin is built so the role check compares
+its roles with the pool, not a manifest (`Role.provideListedGroups`). A group the
+pool lacks refuses every caller, which nothing at runtime can tell from a caller
+without the role. Works in a preview: `ListGroups` is a read, and the pool id is
+read outside any `Output.apply`.
+*/
+
+module Cognito = AwsSdk.CognitoIdentityServiceProvider
+
+type pool = {id: string, region: option<string>}
+
+type send = Cognito.ListGroupsCommand.input => promise<Cognito.ListGroupsCommand.output>
+
+/** Every group of the pool, following `NextToken` across pages. */
+let listAll = async (~send: send, ~userPoolId: string): array<string> => {
+  let rec page = async (nextToken, acc) => {
+    let out = await send({userPoolId, limit: 60, ?nextToken})
+    let names = out.groups->Option.getOr([])->Array.filterMap(g => g.groupName)
+    let acc = acc->Array.concat(names)
+    switch out.nextToken {
+    | Some(_) as next => await page(next, acc)
+    | None => acc
+    }
+  }
+  await page(None, [])
+}
+
+/** A plugin stack's pool, from the platform stack's exports. The new key before
+    the old one, and each directly before under `default`, where ESM programs
+    nest their exports. */
+let poolFromExports = (~get: string => option<JSON.t>): option<pool> => {
+  let nested = get("default")->Option.flatMap(JSON.Decode.object)
+  let read = key =>
+    get(key)
+    ->Option.orElse(nested->Option.flatMap(d => d->Dict.get(key)))
+    ->Option.flatMap(JSON.Decode.string)
+  read("identityProviderId")
+  ->Option.orElse(read("cognitoUserPoolId"))
+  ->Option.map(id => {
+    id,
+    region: read("identityProviderRegion")->Option.orElse(read("cognitoRegion")),
+  })
+}
+
+/**
+The pool this program deploys against, or `None` where it cannot be listed yet:
+a pool this program creates does not exist before its first deploy.
+
+A plugin stack reads its platform stack's exports, the same ones its resolvers
+use. A program that is its own platform reads a supplied pool's id from config.
+*/
+let resolvePool = async (~stackRef: option<Pulumi.StackReference.t>): option<pool> =>
+  switch stackRef {
+  | Some(stackRef) =>
+    let keys = [
+      "identityProviderId",
+      "cognitoUserPoolId",
+      "identityProviderRegion",
+      "cognitoRegion",
+      "default",
+    ]
+    let values = await Promise.all(
+      keys->Array.map(key => stackRef->Pulumi.StackReference.getOutputValue(key)),
+    )
+    let exports = Dict.fromArray(
+      keys->Array.mapWithIndex((key, i) => (key, values->Array.getUnsafe(i))),
+    )
+    poolFromExports(~get=key => exports->Dict.get(key)->Option.flatMap(v => v))
+  | None =>
+    Platform_Stack._identityProviderId(
+      ~cfg=Pulumi.Config.make(Some("platform")),
+    )->Option.map(id => {
+      id,
+      region: Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region"),
+    })
+  }
+
+let sendTo = (~region: option<string>): send => {
+  let client = Cognito.Raw.client(~options={region: ?region})
+  input => Cognito.ListGroupsCommand.make(input)->Cognito.ListGroupsCommand.Raw.send(client, _)
+}
+
+/** List the pool's groups and record them for the role check. Leaves the check
+    on its other sources where there is no pool to ask yet. */
+let load = async (~stackRef: option<Pulumi.StackReference.t>): unit =>
+  switch await resolvePool(~stackRef) {
+  | None => ()
+  | Some({id, region}) =>
+    let groups = try await listAll(~send=sendTo(~region), ~userPoolId=id) catch {
+    | exn if exn->Util_AwsError.hasCode(~code="AccessDeniedException") =>
+      JsError.throwWithMessage(
+        `Cannot list the groups of the user pool ${id}: the deploying principal needs ` ++ `cognito-idp:ListGroups on it, so the deploy can check that every role a plugin needs has a group.`,
+      )
+    }
+    Reventless.Role.provideListedGroups(~source=`the user pool ${id}`, groups)
+  }

package/src/Platform_ProvidedGroups.res.mjs

@@ -0,0 +1,103 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Util_AwsError$ReventlessAws from "./util/Util_AwsError.res.mjs";
+import * as Platform_Stack$ReventlessAws from "./Platform_Stack.res.mjs";
+import * as ClientCognitoIdentityProvider from "@aws-sdk/client-cognito-identity-provider";
+
+async function listAll(send, userPoolId) {
+  let page = async (nextToken, acc) => {
+    let out = await send({
+      UserPoolId: userPoolId,
+      Limit: 60,
+      NextToken: nextToken
+    });
+    let names = Stdlib_Array.filterMap(Stdlib_Option.getOr(out.Groups, []), g => g.GroupName);
+    let acc$1 = acc.concat(names);
+    let next = out.NextToken;
+    if (next !== undefined) {
+      return await page(next, acc$1);
+    } else {
+      return acc$1;
+    }
+  };
+  return await page(undefined, []);
+}
+
+function poolFromExports(get) {
+  let nested = Stdlib_Option.flatMap(get("default"), Stdlib_JSON.Decode.object);
+  let read = key => Stdlib_Option.flatMap(Stdlib_Option.orElse(get(key), Stdlib_Option.flatMap(nested, d => d[key])), Stdlib_JSON.Decode.string);
+  return Stdlib_Option.map(Stdlib_Option.orElse(read("identityProviderId"), read("cognitoUserPoolId")), id => ({
+    id: id,
+    region: Stdlib_Option.orElse(read("identityProviderRegion"), read("cognitoRegion"))
+  }));
+}
+
+async function resolvePool(stackRef) {
+  if (stackRef === undefined) {
+    return Stdlib_Option.map(Platform_Stack$ReventlessAws._identityProviderId(new Pulumi.Config("platform")), id => ({
+      id: id,
+      region: new Pulumi.Config("aws").get("region")
+    }));
+  }
+  let stackRef$1 = Primitive_option.valFromOption(stackRef);
+  let keys = [
+    "identityProviderId",
+    "cognitoUserPoolId",
+    "identityProviderRegion",
+    "cognitoRegion",
+    "default"
+  ];
+  let values = await Promise.all(keys.map(key => stackRef$1.getOutputValue(key)));
+  let $$exports = Object.fromEntries(keys.map((key, i) => [
+    key,
+    values[i]
+  ]));
+  return poolFromExports(key => Stdlib_Option.flatMap($$exports[key], v => v));
+}
+
+function sendTo(region) {
+  let client = new ClientCognitoIdentityProvider.CognitoIdentityProviderClient({
+    region: region
+  });
+  return input => client.send(new ClientCognitoIdentityProvider.ListGroupsCommand(input));
+}
+
+async function load(stackRef) {
+  let match = await resolvePool(stackRef);
+  if (match === undefined) {
+    return;
+  }
+  let id = match.id;
+  let groups;
+  try {
+    groups = await listAll(sendTo(match.region), id);
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Util_AwsError$ReventlessAws.hasCode(exn, "AccessDeniedException")) {
+      groups = Stdlib_JsError.throwWithMessage(`Cannot list the groups of the user pool ` + id + `: the deploying principal needs cognito-idp:ListGroups on it, so the deploy can check that every role a plugin needs has a group.`);
+    } else {
+      throw exn;
+    }
+  }
+  return Role$Reventless.provideListedGroups(`the user pool ` + id, groups);
+}
+
+let Cognito;
+
+export {
+  Cognito,
+  listAll,
+  poolFromExports,
+  resolvePool,
+  sendTo,
+  load,
+}
+/* @pulumi/pulumi Not a pure module */

package/src/Platform_Stack.res

@@ -25,7 +25,7 @@ type cognitoUserPool = {
  *   with SPA-friendly defaults (email sign-in unless `platform:loginIdentifier`
  *   says otherwise, 12-char password policy, no MFA, and admin-only user
  *   creation unless `platform:signUpMode` says otherwise), plus the
- *   administrator group named by [Reventless.AdminGroup] and an elevated-groups
+ *   administrator group named by [Reventless.Role.adminGroup] and an elevated-groups
  *   default naming it. What it does **not** create is the first administrator:
  *   accounts are not stack resources, and a pool full of them is not something a
  *   `pulumi destroy` should be able to empty. `provision-admin` makes that one,
@@ -302,7 +302,7 @@ let _resolveUncached = (): cognitoUserPool => {
     // An ordinary child resource: the pool is ours, so this needs no out-of-band
     // call and Pulumi's state stays the authority for whether it exists.
     let _adminGroup = Util_CognitoGroupUser.addUserGroup(
-      ~name=Reventless.AdminGroup.name,
+      ~name=Reventless.Role.adminGroup(),
       ~userPoolId=pool.id,
     )
 
@@ -400,7 +400,10 @@ let _resolveUncached = (): cognitoUserPool => {
   // name is what a caller needs either way, and an output that appeared in one
   // mode and not the other would read as "there is no administrator group here"
   // rather than "this stack did not create it".
-  Pulumi.Pulumi.export("identityProviderAdminGroup", Pulumi.Output.make(Reventless.AdminGroup.name))
+  Pulumi.Pulumi.export(
+    "identityProviderAdminGroup",
+    Pulumi.Output.make(Reventless.Role.adminGroup()),
+  )
 
   // Exported so an operator can read back the store this provider resolved to —
   // the name is derived, not configured, so this is a convenience for checking

package/src/Platform_Stack.res.mjs

@@ -5,7 +5,7 @@ import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as AWS_Tags$ReventlessAws from "./adapter/AWS_Tags.res.mjs";
 import * as Auth_SignUpMode$ReventlessAws from "./adapter/Auth/Auth_SignUpMode.res.mjs";
@@ -133,7 +133,7 @@ function _resolveUncached() {
       mfaConfiguration: "OFF",
       tags: AWS_Tags$ReventlessAws.make("HostUiPool", "Platform", "Auth", "Platform", undefined, undefined, undefined, undefined)
     });
-    Util_CognitoGroupUser$ReventlessAws.addUserGroup(AdminGroup$Reventless.name, pool.id);
+    Util_CognitoGroupUser$ReventlessAws.addUserGroup(Role$Reventless.adminGroup(), pool.id);
     let tokenUnits2_accessToken = "minutes";
     let tokenUnits2_idToken = "minutes";
     let tokenUnits2_refreshToken = "days";
@@ -181,7 +181,7 @@ function _resolveUncached() {
   Pulumi$Pulumi.$$export("cognitoUserPoolArn", result.poolArn);
   Pulumi$Pulumi.$$export("cognitoRegion", regionOutput);
   Pulumi$Pulumi.$$export("cognitoUserPoolManaged", managedStr);
-  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(AdminGroup$Reventless.name));
+  Pulumi$Pulumi.$$export("identityProviderAdminGroup", Pulumi.output(Role$Reventless.adminGroup()));
   Pulumi$Pulumi.$$export("activeRoleStore", result.activeRoleTable.name);
   return result;
 }

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -194,7 +194,7 @@ let make = (
   let adminEntryJson =
     ReventlessCore.Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
       ~pluginId=ReventlessCore.Platform_Admin_Structure.pluginId,
-      ReventlessCore.Platform_Admin_Structure.structure,
+      ReventlessCore.Platform_Admin_Structure.structure(),
     )->JSON.stringify
 
   // Bundle reventless-aws (the compiled `_Ops` handler lives inside it) and

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -107,7 +107,7 @@ function make(api, pluginReadModelTableName, offloadBucketName, schemaReady, bak
         encodeSelections(j.selections)
       ]
     ]))) : "";
-  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure));
+  let adminEntryJson = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry(Platform_Admin_Structure$ReventlessCore.pluginId, undefined, Platform_Admin_Structure$ReventlessCore.structure()));
   let packageDirs = Object.fromEntries([[
       "@reventlessdev/reventless-aws",
       Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")

package/src/adapter/Auth/Auth_ActiveRoleTrigger_Ops.res

@@ -6,7 +6,7 @@
 // ([Auth_ActiveRoleTrigger.res] bundles it and attaches it to the user pool).
 //
 // The narrowing has to happen here rather than in our own enforcement code
-// because `@authorize(AllowGroups([...]))` compiles to a field directive AppSync
+// because `@authorize(AllowRoles([...]))` compiles to a field directive AppSync
 // evaluates against `cognito:groups` **before any of our code executes**. A
 // request header we invent could scope reads correctly and still leave every
 // group-gated mutation callable — right about the data, wrong about the writes.

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res

@@ -150,7 +150,7 @@ let registerBinding = (
       ),
       labelField: entry.labelField,
       includeIdParam: entry.includeIdParam,
-      authorization: spec.authorization,
+      authorization: spec.authorization->Reventless.Authorization.named,
       // From the same schema `capability` is derived from, one line above, so the
       // two cannot end up disagreeing about this read model's fields.
       ownerField: Reventless.Owner.fieldNames(spec.stateSchema)->Array.get(0),