@reventlessdev/reventless-local 3.0.0-alpha.113

package/src/adapter/Auth/LocalAuth.res.mjs

@@ -0,0 +1,247 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+
+let defaultUser_groups = ["User"];
+
+let defaultUser = {
+  userId: "local-user",
+  username: "user",
+  groups: defaultUser_groups,
+  provider: "InMemory"
+};
+
+let adminUser_groups = [
+  "Admin",
+  "User"
+];
+
+let adminUser = {
+  userId: "local-admin",
+  username: "admin",
+  groups: adminUser_groups,
+  provider: "InMemory"
+};
+
+function initialUsers() {
+  return Object.fromEntries([
+    [
+      "user",
+      defaultUser
+    ],
+    [
+      "admin",
+      adminUser
+    ]
+  ]);
+}
+
+let users = {
+  contents: initialUsers()
+};
+
+function registerUser(username, identity) {
+  users.contents[username] = identity;
+}
+
+function resetUsers() {
+  users.contents = initialUsers();
+}
+
+function lookupUser(username) {
+  return users.contents[username];
+}
+
+function parseGroups(s) {
+  return s.split(",").map(g => g.trim()).filter(g => g !== "");
+}
+
+function getHeader(headers, name) {
+  return headers[name.toLowerCase()];
+}
+
+let store = {
+  contents: {}
+};
+
+function setCredentials(username, password, identity) {
+  store.contents[username] = {
+    password: password,
+    identity: identity
+  };
+  users.contents[username] = identity;
+}
+
+function resetStore() {
+  store.contents = {};
+}
+
+let _secret = {
+  contents: undefined
+};
+
+function _getSecret() {
+  let s = _secret.contents;
+  if (s !== undefined) {
+    return s;
+  }
+  let envSecret = process.env["REVENTLESS_INMEMORY_TOKEN_SECRET"];
+  let s$1 = envSecret !== undefined && envSecret.length >= 16 ? envSecret : Nodecrypto.randomBytes(32).toString("hex");
+  _secret.contents = s$1;
+  return s$1;
+}
+
+function setTokenSecret(s) {
+  _secret.contents = s;
+}
+
+function _sign(payload) {
+  return Nodecrypto.createHmac("sha256", _getSecret()).update(payload).digest("base64url");
+}
+
+function _b64urlEncode(s) {
+  return btoa(s).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+
+function _b64urlDecode(s) {
+  let padLen = (4 - s.length % 4 | 0) % 4;
+  let padded = s + "=".repeat(padLen);
+  let std = padded.replaceAll("-", "+").replaceAll("_", "/");
+  try {
+    return atob(std);
+  } catch (exn) {
+    return;
+  }
+}
+
+async function issue(username, password) {
+  let match = store.contents[username];
+  if (match === undefined) {
+    return {
+      TAG: "Error",
+      _0: "Invalid credentials"
+    };
+  }
+  if (match.password !== password) {
+    return {
+      TAG: "Error",
+      _0: "Invalid credentials"
+    };
+  }
+  let json = JSON.stringify(S.reverseConvertToJsonOrThrow(match.identity, Identity$Reventless.schema));
+  let payload = _b64urlEncode(json);
+  let sig = _sign(payload);
+  return {
+    TAG: "Ok",
+    _0: payload + `.` + sig
+  };
+}
+
+function verifyAndDecode(token) {
+  let parts = token.split(".");
+  let match = parts[0];
+  let match$1 = parts[1];
+  if (match !== undefined && match$1 !== undefined && _sign(match) === match$1) {
+    return Stdlib_Option.flatMap(_b64urlDecode(match), json => {
+      try {
+        return S.parseOrThrow(JSON.parse(json), Identity$Reventless.schema);
+      } catch (exn) {
+        return;
+      }
+    });
+  }
+}
+
+let Login = {
+  store: store,
+  setCredentials: setCredentials,
+  resetStore: resetStore,
+  _secret: _secret,
+  _getSecret: _getSecret,
+  setTokenSecret: setTokenSecret,
+  _sign: _sign,
+  _b64urlEncode: _b64urlEncode,
+  _b64urlDecode: _b64urlDecode,
+  issue: issue,
+  verifyAndDecode: verifyAndDecode
+};
+
+function _bearerToken(header) {
+  if (header.startsWith("Bearer ")) {
+    return header.slice(7, header.length).trim();
+  }
+}
+
+async function authenticate(ctx) {
+  let bearerHeader = Stdlib_Option.flatMap(ctx.headers["Authorization".toLowerCase()], _bearerToken);
+  if (bearerHeader !== undefined) {
+    let identity = verifyAndDecode(bearerHeader);
+    if (identity !== undefined) {
+      return {
+        TAG: "Authenticated",
+        _0: identity
+      };
+    } else {
+      return {
+        TAG: "AuthError",
+        _0: "Invalid bearer token"
+      };
+    }
+  }
+  let userHeader = ctx.headers["X-User".toLowerCase()];
+  let groupsHeader = ctx.headers["X-Groups".toLowerCase()];
+  if (userHeader !== undefined) {
+    let identity$1 = users.contents[userHeader];
+    if (identity$1 === undefined) {
+      return "Anonymous";
+    }
+    let withGroups;
+    if (groupsHeader !== undefined) {
+      let newrecord = {...identity$1};
+      newrecord.groups = parseGroups(groupsHeader);
+      withGroups = newrecord;
+    } else {
+      withGroups = identity$1;
+    }
+    return {
+      TAG: "Authenticated",
+      _0: withGroups
+    };
+  }
+  if (groupsHeader === undefined) {
+    return {
+      TAG: "Authenticated",
+      _0: defaultUser
+    };
+  }
+  let newrecord$1 = {...defaultUser};
+  return {
+    TAG: "Authenticated",
+    _0: (newrecord$1.groups = parseGroups(groupsHeader), newrecord$1)
+  };
+}
+
+function make(param, param$1) {
+  return Pulumi.output();
+}
+
+export {
+  defaultUser,
+  adminUser,
+  initialUsers,
+  users,
+  registerUser,
+  resetUsers,
+  lookupUser,
+  parseGroups,
+  getHeader,
+  Login,
+  _bearerToken,
+  authenticate,
+  make,
+}
+/* users Not a pure module */

package/src/adapter/Auth/UserStore.res

@@ -0,0 +1,134 @@
+// In-memory user store loader. Hydrates `LocalAuth.Login.store` from
+// three resolution paths (first match wins):
+//   1. `~users` arg — explicit list passed by the caller
+//   2. `~usersFile` arg — explicit YAML path
+//   3. `.reventless/users.yaml` (relative to process.cwd()) — auto-discovery
+//
+// All three are silent on absence: when no path is provided and no default
+// file exists, the store stays empty and `LocalAuth.Login.issue` rejects
+// every credential. A one-line stdout hint is printed so developers know to
+// either set the file or pass `~users` programmatically.
+
+open Reventless
+
+/**
+ * One YAML entry. `groups` is required (use `[]` for an unprivileged user);
+ * `userId` defaults to the username when omitted.
+ */
+@schema
+type entry = {
+  username: string,
+  password: string,
+  groups: array<string>,
+  userId?: string,
+}
+
+// ── YAML parsing (eemeli/yaml) ──────────────────────────────────────────────
+
+@module("yaml") external _yamlParse: string => unknown = "parse"
+@module("node:fs") external _readFileSync: (string, string) => string = "readFileSync"
+@module("node:fs") external _existsSync: string => bool = "existsSync"
+@module("node:path") external _join: (string, string) => string = "join"
+@val external _processCwd: unit => string = "process.cwd"
+
+let _entriesSchema = S.array(entrySchema)
+
+/** Parses a YAML document string into entries (best-effort). */
+let parseString = (yamlText: string): result<array<entry>, string> =>
+  try {
+    let json = _yamlParse(yamlText)->Obj.magic
+    Ok(S.parseOrThrow(json, _entriesSchema))
+  } catch {
+  | JsExn(err) => Error(JsExn.message(err)->Option.getOr("YAML parse error"))
+  | _ => Error("YAML parse error")
+  }
+
+/** Reads + parses a YAML file. */
+let parseFile = (path: string): result<array<entry>, string> =>
+  try {
+    let text = _readFileSync(path, "utf8")
+    parseString(text)
+  } catch {
+  | JsExn(err) => Error(JsExn.message(err)->Option.getOr(`Cannot read ${path}`))
+  | _ => Error(`Cannot read ${path}`)
+  }
+
+// ── Resolution & loading ────────────────────────────────────────────────────
+
+let _registerEntries = (entries: array<entry>): unit =>
+  entries->Array.forEach(({username, password, groups, ?userId}) => {
+    let id: Identity.t = {
+      userId: userId->Option.getOr(username),
+      username,
+      groups,
+      provider: InMemory,
+    }
+    LocalAuth.Login.setCredentials(~username, ~password, ~identity=id)
+  })
+
+let _defaultPath = (): string => _join(_processCwd(), ".reventless/users.yaml")
+
+/**
+ * Hydrates the Login store. Returns the resolution path actually used
+ * (`InlineUsers`, `UsersFile(path)`, `DefaultFile(path)`, or `Empty`).
+ * Errors from a *resolved* path are returned as `Error`; absence of the
+ * auto-discovered default file is silent.
+ */
+type resolution =
+  | InlineUsers
+  | UsersFile(string)
+  | DefaultFile(string)
+  | Empty
+
+// Set on the first `load` call so `autoLoadOnce()` is a no-op once a caller
+// has explicitly provided users. Tests can also flip it manually to suppress
+// auto-discovery before `Platform.startServers`.
+let resolved: ref<bool> = ref(false)
+
+let resetResolution = (): unit => resolved := false
+
+let load = (
+  ~users: option<array<entry>>=?,
+  ~usersFile: option<string>=?,
+  (),
+): result<resolution, string> => {
+  resolved := true
+  switch users {
+  | Some(entries) =>
+    _registerEntries(entries)
+    Ok(InlineUsers)
+  | None =>
+    switch usersFile {
+    | Some(path) =>
+      parseFile(path)->Result.map(entries => {
+        _registerEntries(entries)
+        UsersFile(path)
+      })
+    | None =>
+      let defaultPath = _defaultPath()
+      if _existsSync(defaultPath) {
+        parseFile(defaultPath)->Result.map(entries => {
+          _registerEntries(entries)
+          DefaultFile(defaultPath)
+        })
+      } else {
+        Console.log(
+          "[LocalAuth] no users configured — POST /__inmemory/login will reject all. " ++
+          "Provide ~users / ~usersFile or create .reventless/users.yaml relative to cwd.",
+        )
+        Ok(Empty)
+      }
+    }
+  }
+}
+
+/**
+ * Idempotent auto-discovery. Platform.startServers calls this before
+ * `DomainGraphQL_Server.start`, so a `.reventless/users.yaml` in cwd
+ * hydrates the Login store automatically. No-op once `load` has been
+ * called from anywhere.
+ */
+let autoLoadOnce = (): unit =>
+  if !resolved.contents {
+    let _ = load()
+  }

package/src/adapter/Auth/UserStore.res.mjs

@@ -0,0 +1,146 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Yaml from "yaml";
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as LocalAuth$ReventlessLocal from "./LocalAuth.res.mjs";
+
+let entrySchema = S.schema(s => ({
+  username: s.m(S.string),
+  password: s.m(S.string),
+  groups: s.m(S.array(S.string)),
+  userId: s.m(S.option(S.string))
+}));
+
+let _entriesSchema = S.array(entrySchema);
+
+function parseString(yamlText) {
+  try {
+    let json = Yaml.parse(yamlText);
+    return {
+      TAG: "Ok",
+      _0: S.parseOrThrow(json, _entriesSchema)
+    };
+  } catch (raw_err) {
+    let err = Primitive_exceptions.internalToException(raw_err);
+    if (err.RE_EXN_ID === "JsExn") {
+      return {
+        TAG: "Error",
+        _0: Stdlib_Option.getOr(Stdlib_JsExn.message(err._1), "YAML parse error")
+      };
+    } else {
+      return {
+        TAG: "Error",
+        _0: "YAML parse error"
+      };
+    }
+  }
+}
+
+function parseFile(path) {
+  try {
+    return parseString(Nodefs.readFileSync(path, "utf8"));
+  } catch (raw_err) {
+    let err = Primitive_exceptions.internalToException(raw_err);
+    if (err.RE_EXN_ID === "JsExn") {
+      return {
+        TAG: "Error",
+        _0: Stdlib_Option.getOr(Stdlib_JsExn.message(err._1), `Cannot read ` + path)
+      };
+    } else {
+      return {
+        TAG: "Error",
+        _0: `Cannot read ` + path
+      };
+    }
+  }
+}
+
+function _registerEntries(entries) {
+  entries.forEach(param => {
+    let username = param.username;
+    let id_userId = Stdlib_Option.getOr(param.userId, username);
+    let id_groups = param.groups;
+    let id = {
+      userId: id_userId,
+      username: username,
+      groups: id_groups,
+      provider: "InMemory"
+    };
+    LocalAuth$ReventlessLocal.Login.setCredentials(username, param.password, id);
+  });
+}
+
+function _defaultPath() {
+  return Nodepath.join(process.cwd(), ".reventless/users.yaml");
+}
+
+let resolved = {
+  contents: false
+};
+
+function resetResolution() {
+  resolved.contents = false;
+}
+
+function load(users, usersFile, param) {
+  resolved.contents = true;
+  if (users !== undefined) {
+    _registerEntries(users);
+    return {
+      TAG: "Ok",
+      _0: "InlineUsers"
+    };
+  }
+  if (usersFile !== undefined) {
+    return Stdlib_Result.map(parseFile(usersFile), entries => {
+      _registerEntries(entries);
+      return {
+        TAG: "UsersFile",
+        _0: usersFile
+      };
+    });
+  }
+  let defaultPath = Nodepath.join(process.cwd(), ".reventless/users.yaml");
+  if (Nodefs.existsSync(defaultPath)) {
+    return Stdlib_Result.map(parseFile(defaultPath), entries => {
+      _registerEntries(entries);
+      return {
+        TAG: "DefaultFile",
+        _0: defaultPath
+      };
+    });
+  } else {
+    console.log("[LocalAuth] no users configured — POST /__inmemory/login will reject all. Provide ~users / ~usersFile or create .reventless/users.yaml relative to cwd.");
+    return {
+      TAG: "Ok",
+      _0: "Empty"
+    };
+  }
+}
+
+function autoLoadOnce() {
+  if (!resolved.contents) {
+    load(undefined, undefined, undefined);
+    return;
+  }
+}
+
+export {
+  entrySchema,
+  _entriesSchema,
+  parseString,
+  parseFile,
+  _registerEntries,
+  _defaultPath,
+  resolved,
+  resetResolution,
+  load,
+  autoLoadOnce,
+}
+/* entrySchema Not a pure module */

package/src/adapter/Backend.res

@@ -0,0 +1,46 @@
+// Selects which storage backend the in-memory Platform uses.
+//
+// Memory   — pure in-memory dicts/refs, current default behaviour, wiped on restart.
+// Sqlite   — opt-in on-disk SQLite file via SqliteDriver. Survives process restart.
+//             resetOnStart=true wipes the file when the Platform is constructed.
+
+type t =
+  | Memory
+  | Sqlite({path: string, resetOnStart: bool})
+
+let memory = Memory
+let sqlite = (~path, ~resetOnStart=false) => Sqlite({path, resetOnStart})
+
+@val external processEnv: dict<string> = "process.env"
+
+// Deletes a file if it exists. No-op if the path is missing.
+@module("node:fs") external _unlinkSync: string => unit = "unlinkSync"
+
+let removeFileIfExists = (path: string) =>
+  try _unlinkSync(path) catch {
+  | _ => ()
+  }
+
+// Parses REVENTLESS_LOCAL_BACKEND. Recognised forms:
+//   sqlite:./local.db        — Sqlite backend, no reset on start
+//   sqlite:./local.db?reset  — Sqlite backend, wipes file at Platform.Make time
+//   memory                   — explicit Memory selector
+// Anything else (including unset) yields Memory.
+let fromEnv = () =>
+  switch processEnv->Dict.get("REVENTLESS_LOCAL_BACKEND") {
+  | None => Memory
+  | Some(raw) =>
+    let trimmed = raw->String.trim
+    if trimmed == "" || trimmed == "memory" {
+      Memory
+    } else if trimmed->String.startsWith("sqlite:") {
+      let rest = trimmed->String.slice(~start=String.length("sqlite:"), ~end=String.length(trimmed))
+      let (path, resetOnStart) = switch rest->String.split("?") {
+      | [p, q] => (p, q->String.split("&")->Array.includes("reset"))
+      | _ => (rest, false)
+      }
+      Sqlite({path, resetOnStart})
+    } else {
+      Memory
+    }
+  }

package/src/adapter/Backend.res.mjs

@@ -0,0 +1,66 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+
+function sqlite(path, resetOnStartOpt) {
+  let resetOnStart = resetOnStartOpt !== undefined ? resetOnStartOpt : false;
+  return {
+    TAG: "Sqlite",
+    path: path,
+    resetOnStart: resetOnStart
+  };
+}
+
+function removeFileIfExists(path) {
+  try {
+    Nodefs.unlinkSync(path);
+    return;
+  } catch (exn) {
+    return;
+  }
+}
+
+function fromEnv() {
+  let raw = process.env["REVENTLESS_LOCAL_BACKEND"];
+  if (raw === undefined) {
+    return "Memory";
+  }
+  let trimmed = raw.trim();
+  if (trimmed === "" || trimmed === "memory") {
+    return "Memory";
+  }
+  if (!trimmed.startsWith("sqlite:")) {
+    return "Memory";
+  }
+  let rest = trimmed.slice("sqlite:".length, trimmed.length);
+  let match = rest.split("?");
+  let match$1;
+  if (match.length !== 2) {
+    match$1 = [
+      rest,
+      false
+    ];
+  } else {
+    let p = match[0];
+    let q = match[1];
+    match$1 = [
+      p,
+      q.split("&").includes("reset")
+    ];
+  }
+  return {
+    TAG: "Sqlite",
+    path: match$1[0],
+    resetOnStart: match$1[1]
+  };
+}
+
+let memory = "Memory";
+
+export {
+  memory,
+  sqlite,
+  removeFileIfExists,
+  fromEnv,
+}
+/* node:fs Not a pure module */

package/src/adapter/BackendState.res

@@ -0,0 +1,34 @@
+// Module-level state for the active storage backend.
+//
+// Platform.MakeWithConfig sets this once at construction based on Backend.t.
+// Downstream adapters (EventLogStorage_InMemory, QueryDbStorage_InMemory, ...)
+// read it inside their `make` to decide whether to allocate an in-memory dict
+// or delegate to the SQLite-backed implementation.
+//
+// This trick exists because the core builder functors accept a single
+// storageMaker module; we dispatch at runtime instead of at functor-application
+// time so callers don't need to pick a builder per backend.
+
+type active =
+  | Memory
+  | Sqlite({db: SqliteDriver.t, path: string})
+
+let current: ref<active> = ref(Memory)
+
+let setMemory = () => current := Memory
+
+let setSqlite = (~db, ~path) => current := Sqlite({db, path})
+
+let getDb = () =>
+  switch current.contents {
+  | Sqlite({db}) => Some(db)
+  | Memory => None
+  }
+
+// True when the active backend is SQLite — used by adapters that want to swap
+// their implementation entirely, not just their data access.
+let isSqlite = () =>
+  switch current.contents {
+  | Sqlite(_) => true
+  | Memory => false
+  }