@reventlessdev/reventless-aws 3.0.0-alpha.369 → 3.0.0-alpha.371

package/src/adapter/Runtime/PgQueryResolverEntryPoint_Ops.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as RowImage$Reventless from "@reventlessdev/reventless-spec/src/semantic/RowImage.res.mjs";
 import * as PgRuntime$ReventlessAws from "../Postgres/PgRuntime.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as HandlerFactoryHelpersMjs from "./HandlerFactoryHelpers.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
 import * as PgQueryResolver_Lambda$ReventlessAws from "../QueryDb/PgQueryResolver_Lambda.res.mjs";
@@ -75,7 +76,7 @@ function registerBinding(pushdowns, pgConnection, entry, spec) {
     capability: GraphQL_FragmentGenerator$ReventlessCore.deriveServerCapability(entry.readModelName, spec.stateSchema),
     labelField: entry.labelField,
     includeIdParam: entry.includeIdParam,
-    authorization: spec.authorization,
+    authorization: Authorization$Reventless.named(spec.authorization),
     ownerField: Owner$Reventless.fieldNames(spec.stateSchema)[0],
     retiredField: Stdlib_Option.map(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.field),
     retiredValues: Stdlib_Option.flatMap(Stdlib_Option.flatMap(StateAnnotations$Reventless.getSpec(spec.stateSchema), a => a.retired), r => r.values),

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -246,6 +246,7 @@ let makeFromCodeAsset: (
   // concludes nobody is elevated and stamps an operator's on-behalf write with
   // the operator's own id.
   Util_OwnerScopeEnv.applyElevatedGroupsDefault(variables)
+  Util_OwnerScopeEnv.applyRoleGroupsDefault(variables)
 
   // ESM self-containment (Option C): every code archive built by
   // Util_Bundle.buildCodeArchive ships register-hook.mjs + layer-resolver.mjs at

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -104,6 +104,7 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
   });
   Util_LambdaLogging$ReventlessAws.applyLogLevelDefault(variables);
   Util_OwnerScopeEnv$ReventlessAws.applyElevatedGroupsDefault(variables);
+  Util_OwnerScopeEnv$ReventlessAws.applyRoleGroupsDefault(variables);
   variables["NODE_OPTIONS"] = Util_Bundle$ReventlessAws.esmLoaderNodeOptions;
   variables["ESM_FALLBACK_DIRS"] = Util_Bundle$ReventlessAws.esmFallbackDirs;
   if (!RuntimeExtension$ReventlessCore.isEmpty()) {

package/src/components/Api/AppSync_Adapter.res

@@ -181,12 +181,13 @@ let rec waitForMergeSuccess = async (
 //      from `@@reventless.authorize` / `@authorize` PPX annotations.
 //
 // When both are present on the same field, the spec-level permission wins
-// (it is more specific). `AllowGroups([g1, g2, ...])` emits
-// `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`.
+// (it is more specific). `AllowRoles([r1, r2, ...])` emits
+// `@aws_cognito_user_pools(cognito_groups: ["g1", "g2", ...])`, each `g` the group
+// the deployment maps that role to.
 // `AllowAuthenticated` emits the group-less `@aws_cognito_user_pools` — the same
 // reachability an undirectived field already has, but stated rather than left
 // implicit, so `assertGateable` can tell "deliberately open" from "nobody
-// stamped this". `AllowGroups([])` and `DenyAll` emit a sentinel `__deny_all__`
+// stamped this". `AllowRoles([])` and `DenyAll` emit a sentinel `__deny_all__`
 // group that no Cognito user can belong to — effectively blocking the field at
 // the API layer.
 //

package/src/components/Api/AppSync_SdlDecorate.res

@@ -136,8 +136,12 @@ type fieldGate =
 
 let permissionToGate = (permission: Reventless.Authorization.permission): fieldGate =>
   switch permission {
-  | AllowGroups([]) => Groups(["__deny_all__"])
-  | AllowGroups(groups) => Groups(groups)
+  // The groups the roles map to: the deploy program is where the mapping is known.
+  | AllowRoles(_) =>
+    switch Reventless.Authorization.groupsOf(permission) {
+    | [] => Groups(["__deny_all__"])
+    | groups => Groups(groups)
+    }
   | DenyAll => Groups(["__deny_all__"])
   | AllowAuthenticated => AnyAuthenticated
   | AllowAnonymous => Anonymous
@@ -165,7 +169,7 @@ let refuseAnonymousFields = (fieldNames: array<string>): 'a =>
     `Anonymous fields on AWS are deferred. When they land it will be as a separate\n` ++
     `API carrying only the unauthenticated fields. Do not add API_KEY to this one:\n` ++
     `every field here would then have to say whether the key reaches it, and one\n` ++
-    `that forgot would be open. Until then, declare the field AllowAuthenticated\n` ++ `(or AllowGroups) and mean it.`,
+    `that forgot would be open. Until then, declare the field AllowAuthenticated\n` ++ `(or AllowRoles) and mean it.`,
   )
 
 // Injects the Cognito group gate on ALL mutation, query, and subscription fields

package/src/components/Api/AppSync_SdlDecorate.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
 
 function injectAwsSubscribe(sdl, sources) {
@@ -65,7 +66,7 @@ function permissionToGate(permission) {
         };
     }
   } else {
-    let groups = permission._0;
+    let groups = Authorization$Reventless.groupsOf(permission);
     if (groups.length !== 0) {
       return {
         TAG: "Groups",
@@ -81,7 +82,7 @@ function permissionToGate(permission) {
 }
 
 function refuseAnonymousFields(fieldNames) {
-  return Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` + (`  ` + fieldNames.length.toString() + ` field(s) declare AllowAnonymous:\n`) + (`    ` + fieldNames.join(", ") + `\n\n`) + `AppSync has no anonymous authorization mode. This API is provisioned with\nAMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\ndirective available is @aws_cognito_user_pools — which means ANY\nAUTHENTICATED caller, the opposite of what the spec declares. Mutations have\nno runtime authorization check to correct it: on this platform the directive\nis the whole enforcement.\n\nThe local platform DOES honour AllowAnonymous (its resolvers call\nAuthorization.isAllowed), so a spec that passes locally can still not be\ndeployable here. That divergence is the reason this refuses instead of\nemitting a directive that reads as gated and is not.\n\nAnonymous fields on AWS are deferred. When they land it will be as a separate\nAPI carrying only the unauthenticated fields. Do not add API_KEY to this one:\nevery field here would then have to say whether the key reaches it, and one\nthat forgot would be open. Until then, declare the field AllowAuthenticated\n(or AllowGroups) and mean it.`);
+  return Stdlib_JsError.throwWithMessage(`Refusing to push an AppSync schema that cannot honour AllowAnonymous.\n\n` + (`  ` + fieldNames.length.toString() + ` field(s) declare AllowAnonymous:\n`) + (`    ` + fieldNames.join(", ") + `\n\n`) + `AppSync has no anonymous authorization mode. This API is provisioned with\nAMAZON_COGNITO_USER_POOLS primary and AWS_IAM additional, so the only\ndirective available is @aws_cognito_user_pools — which means ANY\nAUTHENTICATED caller, the opposite of what the spec declares. Mutations have\nno runtime authorization check to correct it: on this platform the directive\nis the whole enforcement.\n\nThe local platform DOES honour AllowAnonymous (its resolvers call\nAuthorization.isAllowed), so a spec that passes locally can still not be\ndeployable here. That divergence is the reason this refuses instead of\nemitting a directive that reads as gated and is not.\n\nAnonymous fields on AWS are deferred. When they land it will be as a separate\nAPI carrying only the unauthenticated fields. Do not add API_KEY to this one:\nevery field here would then have to say whether the key reaches it, and one\nthat forgot would be open. Until then, declare the field AllowAuthenticated\n(or AllowRoles) and mean it.`);
 }
 
 function injectAwsAuthAll(fragment, group, iamFieldNamesOpt) {
@@ -388,4 +389,4 @@ export {
   canonicalTypeNames,
   stampCanonicalTypes,
 }
-/* GraphQL_Stitcher-ReventlessCore Not a pure module */
+/* Authorization-Reventless Not a pure module */

package/src/util/Util_OwnerScopeEnv.res

@@ -46,3 +46,12 @@ let applyElevatedGroupsDefault = (variables: dict<Pulumi.Input.t<string>>) =>
   if variables->Dict.get(key)->Option.isNone {
     entry()->Option.forEach(((k, v)) => variables->Dict.set(k, v))
   }
+
+/** The renamed roles, for the same two-process reason: a runtime that evaluates
+    a rule (the SQL-backed view reads) never runs the root that stated the
+    mapping. Only the renamed ones travel; every other role is its own group. */
+let applyRoleGroupsDefault = (variables: dict<Pulumi.Input.t<string>>) =>
+  switch (variables->Dict.get(Reventless.Role.envKey), Reventless.Role.envValue()) {
+  | (None, Some(value)) => variables->Dict.set(Reventless.Role.envKey, value->Pulumi.Input.make)
+  | _ => ()
+  }

package/src/util/Util_OwnerScopeEnv.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 
 let key = "REVENTLESS_ELEVATED_GROUPS";
@@ -23,9 +24,21 @@ function applyElevatedGroupsDefault(variables) {
   }
 }
 
+function applyRoleGroupsDefault(variables) {
+  let match = variables[Role$Reventless.envKey];
+  let match$1 = Role$Reventless.envValue();
+  if (match !== undefined || match$1 === undefined) {
+    return;
+  } else {
+    variables[Role$Reventless.envKey] = match$1;
+    return;
+  }
+}
+
 export {
   key,
   entry,
   applyElevatedGroupsDefault,
+  applyRoleGroupsDefault,
 }
-/* OwnerScope-Reventless Not a pure module */
+/* Role-Reventless Not a pure module */

package/src/util/Util_ShellConfig.res

@@ -98,6 +98,10 @@ let fields = (
 ): dict<JSON.t> => {
   let out = computed->Dict.fromArray
 
+  // Computed, like the endpoints: the group the admin API is gated on, from the
+  // deploy's own role mapping.
+  ReventlessCore.Platform_AdminGroup.configEntry()->Option.forEach(((k, v)) => out->Dict.set(k, v))
+
   // The shell imports the module this key names, and imports nothing when the
   // key is absent — so writing the object without naming it here would ship a
   // file nothing fetches. Computed rather than left to `shellConfig` for the

package/src/util/Util_ShellConfig.res.mjs

@@ -5,6 +5,7 @@ import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Platform$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/Platform.res.mjs";
 import * as Platform_UiSlots$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_UiSlots.res.mjs";
+import * as Platform_AdminGroup$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminGroup.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 let journeyManifestsKey = "journeyManifestUrls";
@@ -59,6 +60,9 @@ function subscriptionEndpoint(httpsEndpoint) {
 
 function fields(computed, viewModes, bakedManifest, uiSlotsFile, shellConfig) {
   let out = Object.fromEntries(computed);
+  Stdlib_Option.forEach(Platform_AdminGroup$ReventlessCore.configEntry(), param => {
+    out[param[0]] = param[1];
+  });
   Stdlib_Option.forEach(uiSlotsFile, param => {
     out[Platform_UiSlots$ReventlessCore.configKey] = Platform_UiSlots$ReventlessCore.url;
   });
@@ -103,4 +107,4 @@ export {
   subscriptionEndpoint,
   fields,
 }
-/* No side effect */
+/* Platform_AdminGroup-ReventlessCore Not a pure module */

package/tests/AppSync_AdapterTest.res

@@ -183,20 +183,16 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     ?permission,
   }
 
-  testSync("AllowGroups([\"Admin\"]) emits cognito_groups: [\"Admin\"] on mutation", () => {
+  testSync("AllowRoles with several roles emits comma-separated groups", () => {
     let fp = Dict.fromArray([
-      ("catalog_Category_Archive", Reventless.Authorization.AllowGroups(["Admin"])),
+      (
+        "p_X",
+        Reventless.Authorization.AllowRoles([
+          Reventless.Role.make("Admin"),
+          Reventless.Role.make("Editor"),
+        ]),
+      ),
     ])
-    let entry = mutationEntry(~fieldNames=["catalog_Category_Archive"], ~fieldPermissions=fp)
-    let frag = makeFragment(["catalog_Category_Archive(id: ID!): String"], [])
-    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
-    let parts = decodeFragment(aug)
-    let m = parts.mutations->Array.getUnsafe(0)
-    expect(m)->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`)
-  })
-
-  testSync("AllowGroups multi-group emits comma-separated groups", () => {
-    let fp = Dict.fromArray([("p_X", Reventless.Authorization.AllowGroups(["Admin", "Editor"]))])
     let entry = mutationEntry(~fieldNames=["p_X"], ~fieldPermissions=fp)
     let frag = makeFragment(["p_X(id: ID!): String"], [])
     let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
@@ -206,6 +202,29 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     )->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`)
   })
 
+  // The deploy program knows the mapping, so the directive carries the group a
+  // role maps to — never the role, which no token carries.
+  testSync("AllowRoles emits the groups its roles map to", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.make("Merchandiser"), "shop-merch-team")])
+    let fp = Dict.fromArray([
+      (
+        "p_Rename",
+        Reventless.Authorization.AllowRoles([
+          Reventless.Role.make("Admin"),
+          Reventless.Role.make("Merchandiser"),
+        ]),
+      ),
+    ])
+    let entry = mutationEntry(~fieldNames=["p_Rename"], ~fieldPermissions=fp)
+    let frag = makeFragment(["p_Rename(id: ID!): String"], [])
+    let aug = AppSync_Adapter.injectAwsAuth(frag, ~mutationEntries=[entry], ~queryEntries=[])
+    Reventless.Role.clearGroups()
+    expect(
+      decodeFragment(aug).mutations->Array.getUnsafe(0),
+    )->toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "shop-merch-team"])`)
+  })
+
   testSync("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Dict.fromArray([("p_Add", Reventless.Authorization.AllowAuthenticated)])
     let entry = mutationEntry(~fieldNames=["p_Add"], ~fieldPermissions=fp)
@@ -230,7 +249,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
 
   testSync("Per-field permissions: only annotated fields get directives", () => {
     let fp = Dict.fromArray([
-      ("p_Archive", Reventless.Authorization.AllowGroups(["Admin"])),
+      ("p_Archive", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
       ("p_Add", Reventless.Authorization.AllowAuthenticated),
     ])
     let entry = mutationEntry(~fieldNames=["p_Archive", "p_Add"], ~fieldPermissions=fp)
@@ -255,7 +274,7 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
     let entry = queryEntry(
       ~single="p_Item",
       ~list="p_Items",
-      ~permission=Some(Reventless.Authorization.AllowGroups(["Manager"])),
+      ~permission=Some(Reventless.Authorization.AllowRoles([Reventless.Role.make("Manager")])),
     )
     // Production query SDL emitted by GraphQL_FragmentGenerator always has an
     // arg list (Relay pagination on the list field), so extractLeadingName's
@@ -362,7 +381,9 @@ describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifting", () =>
   testSync("Spec-level permission wins over legacy authorization field", () => {
     // Legacy {tableName, group} says "Admin"; spec-level says "Manager".
     // Spec-level must win.
-    let fp = Dict.fromArray([("p_X", Reventless.Authorization.AllowGroups(["Manager"]))])
+    let fp = Dict.fromArray([
+      ("p_X", Reventless.Authorization.AllowRoles([Reventless.Role.make("Manager")])),
+    ])
     let entry: ReventlessInfra.Api.mutationSchemaEntry = {
       fieldNames: ["p_X"],
       commandSchema: S.unknown,
@@ -427,7 +448,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       fieldNames: ["p_Sync"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([
-        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Sync", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
       ]),
       systemCallable: true,
     }
@@ -464,8 +485,8 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       fieldNames: ["p_Sync", "p_Other"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([
-        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
-        ("p_Other", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Sync", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
+        ("p_Other", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
       ]),
       // systemCallable applies to every field in the entry; split the fields so only
       // p_Sync opts in.
@@ -475,7 +496,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       fieldNames: ["p_Sync"],
       commandSchema: S.unknown,
       fieldPermissions: Dict.fromArray([
-        ("p_Sync", Reventless.Authorization.AllowGroups(["Admin"])),
+        ("p_Sync", Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")])),
       ]),
       systemCallable: true,
     }
@@ -501,7 +522,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
       returnTypeName: "p_Item",
       stateSchema: S.unknown,
       authorization: None,
-      permission: Reventless.Authorization.AllowGroups(["Admin"]),
+      permission: Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")]),
       systemCallable: true,
     }
     let frag = makeFragment(
@@ -532,7 +553,7 @@ describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth", () => {
         returnTypeName: "p_Item",
         stateSchema: S.unknown,
         authorization: None,
-        permission: Reventless.Authorization.AllowGroups(["Admin"]),
+        permission: Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")]),
         systemCallable: true,
       }
       let frag = makeFragment(
@@ -583,7 +604,7 @@ describe("AppSync_Adapter — type-level dual-auth", () => {
     returnTypeName: "p_Item",
     stateSchema: S.unknown,
     authorization: None,
-    permission: Reventless.Authorization.AllowGroups(["Admin"]),
+    permission: Reventless.Authorization.AllowRoles([Reventless.Role.make("Admin")]),
     systemCallable: true,
   }
 
@@ -958,7 +979,9 @@ describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
   })
 
   testSync("a subscription named like a gated mutation inherits its groups", () => {
-    let fp = Dict.fromArray([("p_Ship", Reventless.Authorization.AllowGroups(["Fulfilment"]))])
+    let fp = Dict.fromArray([
+      ("p_Ship", Reventless.Authorization.AllowRoles([Reventless.Role.make("Fulfilment")])),
+    ])
     let frag = makeFragment(["p_Ship: CommandResult"])
     let aug = AppSync_Adapter.injectAwsAuth(
       frag,

package/tests/AppSync_AdapterTest.res.mjs

@@ -4,6 +4,7 @@ import * as Sury from "sury";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as AppSync_Adapter$ReventlessAws from "../src/components/Api/AppSync_Adapter.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
@@ -129,37 +130,44 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     authorization: undefined,
     permission: permission
   });
-  globalThis.test("AllowGroups([\"Admin\"]) emits cognito_groups: [\"Admin\"] on mutation", () => {
+  globalThis.test("AllowRoles with several roles emits comma-separated groups", () => {
     let fp = Object.fromEntries([[
-        "catalog_Category_Archive",
+        "p_X",
         {
-          TAG: "AllowGroups",
-          _0: ["Admin"]
+          TAG: "AllowRoles",
+          _0: [
+            "Admin",
+            "Editor"
+          ]
         }
       ]]);
-    let entry = mutationEntry(["catalog_Category_Archive"], fp);
-    let frag = makeFragment(["catalog_Category_Archive(id: ID!): String"], []);
+    let entry = mutationEntry(["p_X"], fp);
+    let frag = makeFragment(["p_X(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
     let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    let m = parts.mutations[0];
-    globalThis.expect(m).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin"])`);
+    globalThis.expect(parts.mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`);
   });
-  globalThis.test("AllowGroups multi-group emits comma-separated groups", () => {
+  globalThis.test("AllowRoles emits the groups its roles map to", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        "Merchandiser",
+        "shop-merch-team"
+      ]]);
     let fp = Object.fromEntries([[
-        "p_X",
+        "p_Rename",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: [
             "Admin",
-            "Editor"
+            "Merchandiser"
           ]
         }
       ]]);
-    let entry = mutationEntry(["p_X"], fp);
-    let frag = makeFragment(["p_X(id: ID!): String"], []);
+    let entry = mutationEntry(["p_Rename"], fp);
+    let frag = makeFragment(["p_Rename(id: ID!): String"], []);
     let aug = AppSync_Adapter$ReventlessAws.injectAwsAuth(frag, [entry], []);
-    let parts = GraphQL_Stitcher$ReventlessCore.decode(aug);
-    globalThis.expect(parts.mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "Editor"])`);
+    Role$Reventless.clearGroups();
+    globalThis.expect(GraphQL_Stitcher$ReventlessCore.decode(aug).mutations[0]).toContain(`@aws_cognito_user_pools(cognito_groups: ["Admin", "shop-merch-team"])`);
   });
   globalThis.test("AllowAuthenticated emits the group-less Cognito directive", () => {
     let fp = Object.fromEntries([[
@@ -190,7 +198,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
       [
         "p_Archive",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ],
@@ -226,7 +234,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
   });
   globalThis.test("Query permission applies to BOTH single and list field names", () => {
     let entry = queryEntry("p_Item", "p_Items", {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Manager"]
     });
     let frag = makeFragment([], [
@@ -318,7 +326,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — Stage E2 permission lifti
     let fp = Object.fromEntries([[
         "p_X",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Manager"]
         }
       ]]);
@@ -380,7 +388,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
     let entry_fieldPermissions = Object.fromEntries([[
         "p_Sync",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ]]);
@@ -427,14 +435,14 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
       [
         "p_Sync",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ],
       [
         "p_Other",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ]
@@ -450,7 +458,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
     let iamEntry_fieldPermissions = Object.fromEntries([[
         "p_Sync",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Admin"]
         }
       ]]);
@@ -481,7 +489,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
   });
   globalThis.test("systemCallable query applies dual-auth to BOTH single and list fields", () => {
     let entry_permission = {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Admin"]
     };
     let entry_systemCallable = true;
@@ -514,7 +522,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — systemCallable dual-auth"
   });
   globalThis.test("systemCallable dual-auth extends to derived query fields (Items/ByIds/By<Index>)", () => {
     let entry_permission = {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Admin"]
     };
     let entry_systemCallable = true;
@@ -554,7 +562,7 @@ globalThis.describe("AppSync_Adapter — type-level dual-auth", () => {
     subscriptionSources: []
   });
   let callableEntry_permission = {
-    TAG: "AllowGroups",
+    TAG: "AllowRoles",
     _0: ["Admin"]
   };
   let callableEntry_systemCallable = true;
@@ -845,7 +853,7 @@ globalThis.describe("AppSync_Adapter.injectAwsAuth — subscriptions", () => {
     let fp = Object.fromEntries([[
         "p_Ship",
         {
-          TAG: "AllowGroups",
+          TAG: "AllowRoles",
           _0: ["Fulfilment"]
         }
       ]]);

package/tests/PgPipeline_IntegrationTest.res

@@ -35,7 +35,8 @@ module OrdersSpec = {
 
   let config = Reventless.ReadModel.config()
   let subIdConfig = None
-  let authorization: Reventless.Authorization.permission = AllowAuthenticated
+  type role = Reventless.Role.name
+  let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
   let visibility: Reventless.Visibility.t = Public
 }
 

package/tests/PgQueryDbUnion_IntegrationTest.res

@@ -30,7 +30,8 @@ module CustomersSpec = {
 
   let config = Reventless.ReadModel.config()
   let subIdConfig = None
-  let authorization: Reventless.Authorization.permission = AllowAuthenticated
+  type role = Reventless.Role.name
+  let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
   let visibility: Reventless.Visibility.t = Public
 }
 

package/tests/Platform_ProvidedGroupsTest.res

@@ -0,0 +1,52 @@
+open JestGlobals
+
+// What the role check compares a plugin's roles with on AWS: the groups the user
+// pool reports, found through the platform stack's exports.
+
+module Cognito = AwsSdk.CognitoIdentityServiceProvider
+
+let group = (name): Cognito.ListGroupsCommand.group => {groupName: name}
+
+describe("Platform_ProvidedGroups.listAll", () => {
+  test("follows NextToken until the last page", async () => {
+    let seen = []
+    let send = async (input: Cognito.ListGroupsCommand.input): Cognito.ListGroupsCommand.output => {
+      seen->Array.push(input.nextToken)
+      switch input.nextToken {
+      | None => {groups: [group("Admin"), group("Shopper")], nextToken: "p2"}
+      | Some(_) => {groups: [group("Merchandiser")]}
+      }
+    }
+    let groups = await Platform_ProvidedGroups.listAll(~send, ~userPoolId="p1")
+    expect((groups, seen))->toEqual((["Admin", "Shopper", "Merchandiser"], [None, Some("p2")]))
+  })
+})
+
+describe("Platform_ProvidedGroups.poolFromExports", () => {
+  let from = (pairs: array<(string, JSON.t)>) => {
+    let exports = Dict.fromArray(pairs)
+    Platform_ProvidedGroups.poolFromExports(~get=key => exports->Dict.get(key))
+  }
+
+  testSync("reads the pool id and region", () =>
+    expect(
+      from([
+        ("identityProviderId", JSON.Encode.string("p1")),
+        ("identityProviderRegion", JSON.Encode.string("eu-west-1")),
+      ]),
+    )->toEqual(Some({Platform_ProvidedGroups.id: "p1", region: Some("eu-west-1")}))
+  )
+
+  testSync("reads them nested under default, as an ESM platform exports them", () =>
+    expect(
+      from([
+        (
+          "default",
+          JSON.Encode.object(Dict.fromArray([("cognitoUserPoolId", JSON.Encode.string("p-old"))])),
+        ),
+      ]),
+    )->toEqual(Some({Platform_ProvidedGroups.id: "p-old", region: None}))
+  )
+
+  testSync("no pool id is no pool to list", () => expect(from([]))->toEqual(None))
+})