@reventlessdev/reventless-local 3.0.0-alpha.113

package/src/adapter/Api/LocalGraphQL_Adapter.res

@@ -0,0 +1,29 @@
+// LocalGraphQL_Adapter — implements ReventlessInfra.Api_Adapter.Provider for
+// the in-memory graphql-yoga server.
+//
+// makeApiResource: no-op (server lifecycle is managed by DomainGraphQL_Server.start/rebuildSchema)
+// generateFragment: delegates to ReventlessCore.GraphQL_FragmentGenerator
+// updateSchema: rebuilds the stitched SDL via DomainGraphQL_Server.rebuildSchema
+
+type api = unit
+type role = unit
+
+let makeApiResource = (
+  ~name as _: string,
+  ~opts as _: Pulumi.ComponentResource.options,
+): (Pulumi.Output.t<api>, Pulumi.Output.t<role>) => (Pulumi.Output.make(()), Pulumi.Output.make(()))
+
+let generateFragment = (
+  ~mutationEntries: array<ReventlessInfra.Api.mutationSchemaEntry>,
+  ~queryEntries: array<ReventlessInfra.Api.querySchemaEntry>,
+): Reventless.Plugin.apiSchemaFragment =>
+  ReventlessCore.GraphQL_FragmentGenerator.generate(~mutationEntries, ~queryEntries)
+
+let updateSchema = (
+  ~api as _: Pulumi.Output.t<api>,
+  ~baseFragment: Reventless.Plugin.apiSchemaFragment,
+  ~pluginFragments: array<Reventless.Plugin.apiSchemaFragment>,
+): promise<unit> => {
+  DomainGraphQL_Server.rebuildSchema(~baseFragment, ~pluginFragments)
+  Promise.resolve()
+}

package/src/adapter/Api/LocalGraphQL_Adapter.res.mjs

@@ -0,0 +1,26 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Pulumi from "@pulumi/pulumi";
+import * as DomainGraphQL_Server$ReventlessLocal from "../DomainGraphQL_Server.res.mjs";
+import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
+
+function makeApiResource(param, param$1) {
+  return [
+    Pulumi.output(),
+    Pulumi.output()
+  ];
+}
+
+let generateFragment = GraphQL_FragmentGenerator$ReventlessCore.generate;
+
+function updateSchema(param, baseFragment, pluginFragments) {
+  DomainGraphQL_Server$ReventlessLocal.rebuildSchema(baseFragment, pluginFragments);
+  return Promise.resolve();
+}
+
+export {
+  makeApiResource,
+  generateFragment,
+  updateSchema,
+}
+/* @pulumi/pulumi Not a pure module */

package/src/adapter/Api/LocalGraphQL_SubscriptionResolvers.res

@@ -0,0 +1,146 @@
+// LocalGraphQL_SubscriptionResolvers.res
+// WebSocket subscription resolvers for Sources A and B (in-memory / yoga).
+//
+// Source A (raw event stream): subscribes to Bus.subscribeToEvents for each event log
+//   topic and publishes the event envelope to a yoga PubSub channel.
+//
+// Source B (state changes): subscribes to Bus.subscribeToStateChanges for each QueryDb
+//   and publishes saved state items to a yoga PubSub channel.
+//
+// Source C (mutation-triggered): mutation resolvers would need to publish to the PubSub
+//   after each successful command. This is left as future work — currently mutations do
+//   not cross-post to the subscription PubSub in-memory.
+//
+// Usage: call `setup` once per server build, then `registerAll` to wire into the GraphQL
+//   server instance. Both must be called before the server starts.
+//
+// Note: `scalar AWSJSON` is injected here so yoga accepts the AppSync scalar used in
+//   Source A event log types. It serialises as a plain string.
+
+module YG = GraphqlYoga
+
+// ── PubSub instance ───────────────────────────────────────────────────────────
+
+let pubSub: ref<option<YG.pubSub>> = ref(None)
+
+let getPubSub = () =>
+  switch pubSub.contents {
+  | Some(ps) => ps
+  | None =>
+    let ps = YG.createPubSub()
+    pubSub.contents = Some(ps)
+    ps
+  }
+
+// ── Topic naming ──────────────────────────────────────────────────────────────
+// Matches the field names generated by Plugin_SubscriptionSchema:
+//   Source A: on{DisplayName}EventLog_eventAppended
+//   Source B: on{ReturnTypeName}_stateChanged
+
+let sourceATopic = (displayName: string) => `on${displayName}EventLog_eventAppended`
+let sourceBTopic = (returnTypeName: string) => `on${returnTypeName}_stateChanged`
+
+// ── Bridge: Bus → PubSub ──────────────────────────────────────────────────────
+
+/** Wire Source A: subscribe to event bus topic → publish to yoga PubSub channel. */
+let bridgeSourceA = (
+  ~subscribeToEvents: (
+    string,
+    (string, ReventlessCore.Message.meta, JSON.t) => promise<unit>,
+  ) => unit,
+  ~displayName: string,
+  ~busTopicName: string,
+) => {
+  let ps = getPubSub()
+  let yogaTopic = sourceATopic(displayName)
+  // Push the raw event JSON directly — it already contains the event data.
+  // In-memory events don't carry a separate position/originatorSlice envelope.
+  subscribeToEvents(busTopicName, async (_service, _meta, json) => {
+    ps->YG.pubSubPublish(yogaTopic, json)
+  })
+}
+
+/** Wire Source B: subscribe to state-change hook → publish to yoga PubSub channel. */
+let bridgeSourceB = (
+  ~subscribeToStateChanges: (string, JSON.t => unit) => unit,
+  ~readModelName: string,
+  ~returnTypeName: string,
+) => {
+  let ps = getPubSub()
+  let yogaTopic = sourceBTopic(returnTypeName)
+  subscribeToStateChanges(readModelName, state => {
+    ps->YG.pubSubPublish(yogaTopic, state)
+  })
+}
+
+// ── Subscription resolver builder ─────────────────────────────────────────────
+//
+// Builds the yoga subscription resolver object for one field:
+//   { subscribe: (_root, _args) => pubSub.subscribe(topic), resolve: x => x }
+//
+// The resolver dict value is typed as JSON.t (the generic resolverFn) and cast via
+// Obj.magic — yoga's createSchema accepts { subscribe, resolve } objects for the
+// Subscription type, not plain functions. This is safe at runtime.
+
+let makeFieldResolver = (topic: string): YG.resolverFn => {
+  let ps = getPubSub()
+  Obj.magic({
+    "subscribe": (_root: JSON.t, _args: JSON.t, _ctx: JSON.t) => ps->YG.pubSubSubscribe(topic),
+    "resolve": (payload: JSON.t) => payload,
+  })
+}
+
+// ── Public API ────────────────────────────────────────────────────────────────
+
+type subscriptionEntry = {
+  fieldName: string,
+  topic: string,
+}
+
+/**
+ * Register subscriptions with the GraphQL server instance.
+ *
+ * `sourceAEntries`: list of {fieldName, topic} for Source A (event stream).
+ *   Bridge must already be wired via bridgeSourceA before calling this.
+ *
+ * `sourceBEntries`: list of {fieldName, topic} for Source B (state changes).
+ *   Bridge must already be wired via bridgeSourceB before calling this.
+ *
+ * `sdlFields`: the `subscriptions` SDL field strings from the plugin fragment
+ *   (after stripping `@aws_subscribe` directives — not valid in yoga).
+ */
+let registerAll = (
+  ~server: GraphQL_ServerInstance.t,
+  ~sdlFields: array<string>,
+  ~sourceAEntries: array<subscriptionEntry>,
+  ~sourceBEntries: array<subscriptionEntry>,
+) => {
+  // Strip @aws_subscribe directives — only valid in AppSync, not yoga
+  let cleanedFields =
+    sdlFields->Array.map(field =>
+      field->String.split("\n")->Array.filter(line => !(line->String.includes("@aws_subscribe")))->Array.join("\n")
+    )
+
+  let resolvers: dict<YG.resolverFn> = Dict.make()
+
+  sourceAEntries->Array.forEach(({fieldName, topic}) => {
+    resolvers->Dict.set(fieldName, makeFieldResolver(topic))
+  })
+  sourceBEntries->Array.forEach(({fieldName, topic}) => {
+    resolvers->Dict.set(fieldName, makeFieldResolver(topic))
+  })
+
+  server.registerSubscriptions(~sdlFields=cleanedFields, ~resolvers)
+
+  // Inject scalar AWSJSON so yoga accepts it in Source A event log types
+  server.registerTypes(~sdlTypes=["scalar AWSJSON"])
+}
+
+/** Publish a payload to a named PubSub topic (for Source C mutation resolvers). */
+let publish = (topic: string, payload: JSON.t) => {
+  getPubSub()->YG.pubSubPublish(topic, payload)
+}
+
+let reset = () => {
+  pubSub.contents = None
+}

package/src/adapter/Api/LocalGraphQL_SubscriptionResolvers.res.mjs

@@ -0,0 +1,88 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as GraphqlYoga from "graphql-yoga";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+
+let pubSub = {
+  contents: undefined
+};
+
+function getPubSub() {
+  let ps = pubSub.contents;
+  if (ps !== undefined) {
+    return Primitive_option.valFromOption(ps);
+  }
+  let ps$1 = GraphqlYoga.createPubSub();
+  pubSub.contents = Primitive_option.some(ps$1);
+  return ps$1;
+}
+
+function sourceATopic(displayName) {
+  return `on` + displayName + `EventLog_eventAppended`;
+}
+
+function sourceBTopic(returnTypeName) {
+  return `on` + returnTypeName + `_stateChanged`;
+}
+
+function bridgeSourceA(subscribeToEvents, displayName, busTopicName) {
+  let ps = getPubSub();
+  let yogaTopic = sourceATopic(displayName);
+  subscribeToEvents(busTopicName, async (_service, _meta, json) => {
+    ps.publish(yogaTopic, json);
+  });
+}
+
+function bridgeSourceB(subscribeToStateChanges, readModelName, returnTypeName) {
+  let ps = getPubSub();
+  let yogaTopic = sourceBTopic(returnTypeName);
+  subscribeToStateChanges(readModelName, state => {
+    ps.publish(yogaTopic, state);
+  });
+}
+
+function makeFieldResolver(topic) {
+  let ps = getPubSub();
+  return {
+    subscribe: (_root, _args, _ctx) => ps.subscribe(topic),
+    resolve: payload => payload
+  };
+}
+
+function registerAll(server, sdlFields, sourceAEntries, sourceBEntries) {
+  let cleanedFields = sdlFields.map(field => field.split("\n").filter(line => !line.includes("@aws_subscribe")).join("\n"));
+  let resolvers = {};
+  sourceAEntries.forEach(param => {
+    resolvers[param.fieldName] = makeFieldResolver(param.topic);
+  });
+  sourceBEntries.forEach(param => {
+    resolvers[param.fieldName] = makeFieldResolver(param.topic);
+  });
+  server.registerSubscriptions(cleanedFields, resolvers);
+  server.registerTypes(["scalar AWSJSON"]);
+}
+
+function publish(topic, payload) {
+  getPubSub().publish(topic, payload);
+}
+
+function reset() {
+  pubSub.contents = undefined;
+}
+
+let YG;
+
+export {
+  YG,
+  pubSub,
+  getPubSub,
+  sourceATopic,
+  sourceBTopic,
+  bridgeSourceA,
+  bridgeSourceB,
+  makeFieldResolver,
+  registerAll,
+  publish,
+  reset,
+}
+/* graphql-yoga Not a pure module */

package/src/adapter/Auth/Auth_GraphqlContext.res

@@ -0,0 +1,83 @@
+// Yoga context factory that translates the incoming Fetch Request into an
+// `identity` attached to resolver context. Shared between
+// `DomainGraphQL_Server` (data API) and `GraphQL_ServerInstance` (split-mode
+// admin API) so both endpoints enforce identical bearer-token rules:
+//   - Valid `Authorization: Bearer <token>` → signed-in identity
+//   - Missing header                       → `defaultUser`
+//   - Invalid bearer is rejected at HTTP level before this runs (see
+//     `DomainGraphQL_Server._dispatch`); on the admin server there is no
+//     dispatch layer, so an invalid bearer falls through to `defaultUser`
+//     too. AppSync enforces the same `@aws_auth(cognito_groups: ["Admin"])`
+//     directive at the schema layer in production.
+
+module YG = GraphqlYoga
+
+type fetchHeaders
+type fetchRequest = {headers: fetchHeaders}
+type yogaInitialCtx = {request: fetchRequest}
+
+@send
+external headersForEach: (fetchHeaders, (string, string) => unit) => unit = "forEach"
+
+let extractHeaders = (headers: fetchHeaders): dict<string> => {
+  let acc = Dict.make()
+  headers->headersForEach((value, key) => acc->Dict.set(key->String.toLowerCase, value))
+  acc
+}
+
+let identityFromAuthResult = (result: Reventless.Identity.authResult): Reventless.Identity.t =>
+  switch result {
+  | Authenticated(id) => id
+  | Anonymous => Reventless.Identity.anonymous
+  | AuthError(_) => Reventless.Identity.anonymous
+  }
+
+let buildAuthContext = async (initial: YG.initialContext): JSON.t => {
+  let ctx: yogaInitialCtx = Obj.magic(initial)
+  let headers = extractHeaders(ctx.request.headers)
+  let requestContext: ReventlessCore.Auth_Adapter.requestContext = {headers: headers}
+  let result = await LocalAuth.authenticate(requestContext)
+  let identity = identityFromAuthResult(result)
+  Obj.magic({"identity": identity})
+}
+
+// Read the identity attached by `buildAuthContext` from the resolver context.
+// Falls back to `anonymous` if the context is malformed or the server wasn't
+// started with `~contextFactory`.
+let extractIdentity = (ctx: JSON.t): Reventless.Identity.t =>
+  try {
+    switch (ctx->Obj.magic)["identity"]->Nullable.toOption {
+    | Some(id) => (id: Reventless.Identity.t)
+    | None => Reventless.Identity.anonymous
+    }
+  } catch {
+  | _ => Reventless.Identity.anonymous
+  }
+
+// Throw a `GraphQLError` from the `graphql` package — yoga's `maskedErrors`
+// option preserves these (only opaque thrown values get masked as
+// "Unexpected error / INTERNAL_SERVER_ERROR"). Mirrors the directive-level
+// `@aws_auth` rejection that AppSync surfaces in production.
+@new @module("graphql")
+external makeGraphqlError: (string, {"extensions": {"code": string}}) => exn = "GraphQLError"
+
+let unauthorizedError = (~group: string): exn =>
+  makeGraphqlError(
+    `Unauthorized: requires group "${group}"`,
+    {"extensions": {"code": "UNAUTHORIZED"}},
+  )
+
+// Wrap a resolver so it raises a GraphQL "Unauthorized" error when the
+// requesting identity lacks the required group. Mirrors AppSync's
+// `@aws_auth(cognito_groups: [...])` semantics for admin fields on the
+// in-memory adapter. Use for fields whose corresponding read-model entry
+// carries `authorization: Some({group, ...})` — pass the group string here.
+let requireGroup = (~group: string, resolver: YG.resolverFn): YG.resolverFn =>
+  async (root, args, ctx) => {
+    let identity = extractIdentity(ctx)
+    if identity.groups->Array.includes(group) {
+      await resolver(root, args, ctx)
+    } else {
+      throw(unauthorizedError(~group))
+    }
+  }

package/src/adapter/Auth/Auth_GraphqlContext.res.mjs

@@ -0,0 +1,76 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Graphql from "graphql";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as LocalAuth$ReventlessLocal from "./LocalAuth.res.mjs";
+
+function extractHeaders(headers) {
+  let acc = {};
+  headers.forEach((value, key) => {
+    acc[key.toLowerCase()] = value;
+  });
+  return acc;
+}
+
+function identityFromAuthResult(result) {
+  if (typeof result !== "object" || result.TAG !== "Authenticated") {
+    return Identity$Reventless.anonymous;
+  } else {
+    return result._0;
+  }
+}
+
+async function buildAuthContext(initial) {
+  let headers = extractHeaders(initial.request.headers);
+  let requestContext = {
+    headers: headers
+  };
+  let result = await LocalAuth$ReventlessLocal.authenticate(requestContext);
+  return {
+    identity: identityFromAuthResult(result)
+  };
+}
+
+function extractIdentity(ctx) {
+  try {
+    let id = ctx.identity;
+    if (id == null) {
+      return Identity$Reventless.anonymous;
+    } else {
+      return id;
+    }
+  } catch (exn) {
+    return Identity$Reventless.anonymous;
+  }
+}
+
+function unauthorizedError(group) {
+  return new Graphql.GraphQLError(`Unauthorized: requires group "` + group + `"`, {
+    extensions: {
+      code: "UNAUTHORIZED"
+    }
+  });
+}
+
+function requireGroup(group, resolver) {
+  return async (root, args, ctx) => {
+    let identity = extractIdentity(ctx);
+    if (identity.groups.includes(group)) {
+      return await resolver(root, args, ctx);
+    }
+    throw unauthorizedError(group);
+  };
+}
+
+let YG;
+
+export {
+  YG,
+  extractHeaders,
+  identityFromAuthResult,
+  buildAuthContext,
+  extractIdentity,
+  unauthorizedError,
+  requireGroup,
+}
+/* graphql Not a pure module */

package/src/adapter/Auth/LocalAuth.res

@@ -0,0 +1,239 @@
+// In-memory `Auth_Adapter.Provider` implementation. Designed for local
+// development and integration tests.
+//
+// Header semantics (host-ui-login-core stages A2 + A4):
+//   Authorization: Bearer <token>  → decode + HMAC-verify a Login-issued token
+//   X-User: <username>             → resolve identity from the user store
+//   X-Groups: A,B,C                → override the resolved identity's groups
+//   none of the above              → Authenticated(defaultUser) (dev default)
+//
+// Stage A4 adds the `Login` submodule (token issuance + verification) and
+// the companion `UserStore` module (YAML hydration).
+
+open Reventless
+
+// ── Built-in identities ────────────────────────────────────────────────────
+
+let defaultUser: Identity.t = {
+  userId: "local-user",
+  username: "user",
+  groups: ["User"],
+  provider: InMemory,
+}
+
+let adminUser: Identity.t = {
+  userId: "local-admin",
+  username: "admin",
+  groups: ["Admin", "User"],
+  provider: InMemory,
+}
+
+// ── User registry ─────────────────────────────────────────────────────────
+//
+// A `dict<Identity.t>` keyed by `username`. A4 hydrates this from
+// `.reventless/users.yaml`; tests inject via `registerUser`.
+
+let initialUsers = () =>
+  Dict.fromArray([("user", defaultUser), ("admin", adminUser)])
+
+let users: ref<dict<Identity.t>> = ref(initialUsers())
+
+let registerUser = (~username: string, ~identity: Identity.t): unit =>
+  users.contents->Dict.set(username, identity)
+
+let resetUsers = (): unit => users := initialUsers()
+
+let lookupUser = (username: string): option<Identity.t> =>
+  users.contents->Dict.get(username)
+
+// ── Header parsing ────────────────────────────────────────────────────────
+
+let parseGroups = (s: string): array<string> =>
+  s
+  ->String.split(",")
+  ->Array.map(g => g->String.trim)
+  ->Array.filter(g => g !== "")
+
+// HTTP headers are case-insensitive; the context factory in
+// DomainGraphQL_Server normalises keys to lower-case before calling
+// authenticate.
+let getHeader = (headers: dict<string>, name: string): option<string> =>
+  headers->Dict.get(name->String.toLowerCase)
+
+// ── Login (Stage A4 — token issuance) ──────────────────────────────────────
+//
+// Issues opaque tokens of the form `<base64url-payload>.<base64url-sig>` where
+// payload = JSON(Identity.t) and sig = HMAC-SHA256(payload, secret). The
+// secret is process-local (random 32-byte hex at first use) and can be pinned
+// for tests via `Login.setTokenSecret`.
+//
+// Not security-grade — local dev only. AWS deployments verify Cognito-issued
+// JWTs at AppSync (Stage D) and never see these tokens.
+
+module Login = {
+  type credentials = {password: string, identity: Identity.t}
+
+  // Hydrated by `UserStore` at platform start; tests can inject directly.
+  let store: ref<dict<credentials>> = ref(Dict.make())
+
+  let setCredentials = (~username: string, ~password: string, ~identity: Identity.t): unit => {
+    store.contents->Dict.set(username, {password, identity})
+    // Mirror into the authenticate-side user registry so X-User flows still
+    // resolve a Login-registered user.
+    users.contents->Dict.set(username, identity)
+  }
+
+  let resetStore = (): unit => {
+    store := Dict.make()
+  }
+
+  // ── HMAC secret (lazy) ──
+  //
+  // Reads `REVENTLESS_INMEMORY_TOKEN_SECRET` once on first use. When the env
+  // var is set (≥16 chars) the issued tokens survive process restarts, which
+  // matches the dev loop's expectation that a logged-in tab keeps working
+  // after a backend reload. When unset, falls back to a random per-process
+  // secret — secure for ephemeral test runs but invalidates every previously
+  // issued token on every restart.
+  type buf
+  @module("node:crypto") external _randomBytes: int => buf = "randomBytes"
+  @send external _bufToString: (buf, string) => string = "toString"
+  type hmac
+  @module("node:crypto") external _createHmac: (string, string) => hmac = "createHmac"
+  @send external _update: (hmac, string) => hmac = "update"
+  @send external _digest: (hmac, string) => string = "digest"
+
+  @val external _processEnv: Dict.t<string> = "process.env"
+
+  let _secret: ref<option<string>> = ref(None)
+  let _getSecret = (): string =>
+    switch _secret.contents {
+    | Some(s) => s
+    | None =>
+      let s = switch _processEnv->Dict.get("REVENTLESS_INMEMORY_TOKEN_SECRET") {
+      | Some(envSecret) if String.length(envSecret) >= 16 => envSecret
+      | _ => _randomBytes(32)->_bufToString("hex")
+      }
+      _secret := Some(s)
+      s
+    }
+
+  let setTokenSecret = (s: string): unit => _secret := Some(s)
+
+  let _sign = (payload: string): string =>
+    _createHmac("sha256", _getSecret())->_update(payload)->_digest("base64url")
+
+  // base64url over arbitrary JSON strings: btoa-encode + URL-safe alphabet,
+  // strip `=` padding. Avoids pulling in Buffer for a single-line conversion.
+  @val external _btoa: string => string = "btoa"
+  @val external _atob: string => string = "atob"
+
+  let _b64urlEncode = (s: string): string =>
+    _btoa(s)
+    ->String.replaceAll("+", "-")
+    ->String.replaceAll("/", "_")
+    ->String.replaceAll("=", "")
+
+  let _b64urlDecode = (s: string): option<string> => {
+    let padLen = mod(4 - mod(s->String.length, 4), 4)
+    let padded = s ++ String.repeat("=", padLen)
+    let std = padded->String.replaceAll("-", "+")->String.replaceAll("_", "/")
+    try {
+      Some(_atob(std))
+    } catch {
+    | _ => None
+    }
+  }
+
+  /** Verifies credentials and returns a signed token (or an error string). */
+  let issue = async (~username: string, ~password: string): result<string, string> =>
+    switch store.contents->Dict.get(username) {
+    | Some({password: stored, identity}) if stored === password =>
+      let json = identity->S.reverseConvertToJsonOrThrow(Identity.schema)->JSON.stringify
+      let payload = _b64urlEncode(json)
+      let sig = _sign(payload)
+      Ok(`${payload}.${sig}`)
+    | _ => Error("Invalid credentials")
+    }
+
+  /**
+   * Returns the embedded Identity if signature verifies and the payload
+   * decodes; `None` for any tampered, malformed, or unsigned token.
+   */
+  let verifyAndDecode = (token: string): option<Identity.t> => {
+    let parts = token->String.split(".")
+    switch (parts->Array.get(0), parts->Array.get(1)) {
+    | (Some(payload), Some(sig)) if _sign(payload) === sig =>
+      _b64urlDecode(payload)->Option.flatMap(json =>
+        try {
+          Some(json->JSON.parseOrThrow->S.parseOrThrow(Identity.schema))
+        } catch {
+        | _ => None
+        }
+      )
+    | _ => None
+    }
+  }
+}
+
+// ── Provider implementation ───────────────────────────────────────────────
+
+type authConfig = unit
+
+let _bearerToken = (header: string): option<string> =>
+  if header->String.startsWith("Bearer ") {
+    Some(header->String.slice(~start=7, ~end=header->String.length)->String.trim)
+  } else {
+    None
+  }
+
+let authenticate = async (
+  ctx: ReventlessCore.Auth_Adapter.requestContext,
+): Identity.authResult => {
+  // Decoding order: Bearer (when signature valid) → X-User/X-Groups → default.
+  // A *present* Bearer that fails verification is rejected (AuthError) rather
+  // than falling through to defaultUser — otherwise a client whose token was
+  // invalidated (e.g. process-local HMAC secret rotated on restart) would
+  // silently keep working as defaultUser, and the host-shell `on401` logout
+  // path would never fire. No-Authorization stays permissive (defaultUser)
+  // so anonymous dev flows still work.
+  let bearerHeader = getHeader(ctx.headers, "Authorization")->Option.flatMap(_bearerToken)
+  switch bearerHeader {
+  | Some(token) =>
+    switch Login.verifyAndDecode(token) {
+    | Some(identity) => Authenticated(identity)
+    | None => AuthError("Invalid bearer token")
+    }
+  | None =>
+    let userHeader = getHeader(ctx.headers, "X-User")
+    let groupsHeader = getHeader(ctx.headers, "X-Groups")
+    switch userHeader {
+    | None =>
+      switch groupsHeader {
+      | None =>
+        // No headers: in-memory mode defaults to defaultUser so local dev
+        // against an AllowAuthenticated-defaulted backend "just works" without
+        // setting headers. Anonymous behaviour is reachable only by building
+        // an Identity.anonymous explicitly in code.
+        Authenticated(defaultUser)
+      | Some(g) =>
+        // X-Groups without X-User: defaultUser identity with the requested
+        // groups. Useful for tests that exercise group-only authorization paths.
+        Authenticated({...defaultUser, groups: parseGroups(g)})
+      }
+    | Some(username) =>
+      switch lookupUser(username) {
+      | None => Anonymous
+      | Some(identity) =>
+        let withGroups = switch groupsHeader {
+        | Some(g) => {...identity, groups: parseGroups(g)}
+        | None => identity
+        }
+        Authenticated(withGroups)
+      }
+    }
+  }
+}
+
+let make = (~name as _: string, ~opts as _: option<Pulumi.ComponentResource.options>=?): Pulumi.Output.t<authConfig> =>
+  Pulumi.Output.make()