@reventlessdev/reventless-local 3.0.0-alpha.212 → 3.0.0-alpha.213

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.213 (2026-08-12)
+
+### Features
+
+* **platform:** bake a curated component manifest as a static asset ([4f30265](https://github.com/ReventlessDev/reventless-core/commit/4f30265a51fc2c59e69afd8074cf1b2534c06378))
+* **queries:** narrow owner-bearing reads to the caller ([ba9cc3d](https://github.com/ReventlessDev/reventless-core/commit/ba9cc3d58d7914a9e4827bda90a704a74b1b82dd))
+
+
 # 3.0.0-alpha.212 (2026-08-11)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.212",
+  "version": "3.0.0-alpha.213",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -34,19 +34,19 @@
     "graphql-yoga": "^5.21.0",
     "sury": "11.0.0-alpha.4",
     "ws": "^8.18.0",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.27",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.21",
     "@reventlessdev/rescript-node": "2.0.0-alpha.4",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.27",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.224",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.72",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.171",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.88",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.134",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.225",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.73",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.172",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.135",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.89",
     "@reventlessdev/reventless-seed": "1.0.0-alpha.11",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.108"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.109"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/BakedManifest.res

@@ -0,0 +1,72 @@
+// Writes the curated component manifest where the local host shell serves its
+// static assets from, so `manifestUrl` discovery works in dev exactly as it does
+// in a deployment.
+//
+// Locally there is no deploy and no bucket: `reventless-host-shell` serves its
+// own `dist/` (that is where the shipped `config.json` and `ui-hints.json` come
+// from), so that is where the file goes. Rewritten on every boot, which also
+// makes it self-healing — a `pnpm install` that replaces the package directory
+// costs one restart, not a debugging session.
+//
+// The curation itself lives in `ReventlessCore.Platform_BakedManifest`, shared
+// with any other platform that bakes: only the destination is local.
+
+let hostShellPackage = "@reventlessdev/reventless-host-shell"
+
+let log = ReventlessCore.Logger.fromEnv()
+
+// Resolved from the running project rather than from this framework module: the
+// bundle is a deploy input the project names in its own package.json, and a
+// framework-rooted lookup would skip that pin (the same distinction
+// `Util_Bundle.resolvePackageRoot(~fromPulumiProject)` draws on AWS).
+let hostShellDistDir = (): option<string> =>
+  try {
+    Some(
+      NodePath.dirname(
+        NodeModule.createRequire(NodeProcess.cwd() ++ "/index.js")->NodeModule.requireResolve(
+          hostShellPackage ++ "/package.json",
+        ),
+      ) ++ "/dist",
+    )
+  } catch {
+  | _ => None
+  }
+
+let defaultKey = "component-manifest.json"
+
+/**
+ A declared bake writes the file or fails loudly. Both failure modes it can hit
+ are the deployment's own mistake — a name that matches no component, or a shell
+ package that is not installed — and both produce the same symptom if swallowed:
+ a shop that renders nothing, with no line in the log saying why.
+ */
+let emit = (
+  ~structures: array<(string, Reventless.Plugin.pluginStructure)>,
+  ~config: ReventlessInfra.Platform.bakedManifest,
+) => {
+  let selections =
+    config.components->Array.map((
+      s
+    ): ReventlessCore.Platform_BakedManifest.selection => {
+      plugin: s.plugin,
+      views: s.views,
+      commands: s.commands,
+    })
+  switch ReventlessCore.Platform_BakedManifest.curate(~structures, ~selections) {
+  | Error(e) => JsError.throwWithMessage(ReventlessCore.Platform_BakedManifest.describe(e))
+  | Ok(manifest) =>
+    switch hostShellDistDir() {
+    | None =>
+      JsError.throwWithMessage(
+        `baked manifest: cannot resolve ${hostShellPackage} from ${NodeProcess.cwd()} — ` ++
+        `the local shell serves the file from that package's dist/, so declaring a bake ` ++
+        `without the package installed would write nothing and render an empty shell.`,
+      )
+    | Some(dir) =>
+      let key = config.key->Option.getOr(defaultKey)
+      let path = NodePath.join([dir, key])
+      NodeFs.writeFileSync(path, JSON.stringify(manifest, ~space=2))
+      log.info(~comp="BakedManifest", `wrote ${key} for ${selections->Array.length->Int.toString} plugin(s): ${path}`)
+    }
+  }
+}

package/src/BakedManifest.res.mjs

@@ -0,0 +1,52 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
+import * as Nodemodule from "node:module";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
+
+let hostShellPackage = "@reventlessdev/reventless-host-shell";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+function hostShellDistDir() {
+  try {
+    return Nodepath.dirname(Nodemodule.createRequire(process.cwd() + "/index.js").resolve(hostShellPackage + "/package.json")) + "/dist";
+  } catch (exn) {
+    return;
+  }
+}
+
+let defaultKey = "component-manifest.json";
+
+function emit(structures, config) {
+  let selections = config.components.map(s => ({
+    plugin: s.plugin,
+    views: s.views,
+    commands: s.commands
+  }));
+  let e = Platform_BakedManifest$ReventlessCore.curate(structures, selections);
+  if (e.TAG !== "Ok") {
+    return Stdlib_JsError.throwWithMessage(Platform_BakedManifest$ReventlessCore.describe(e._0));
+  }
+  let dir = hostShellDistDir();
+  if (dir === undefined) {
+    return Stdlib_JsError.throwWithMessage(`baked manifest: cannot resolve ` + hostShellPackage + ` from ` + process.cwd() + ` — the local shell serves the file from that package's dist/, so declaring a bake without the package installed would write nothing and render an empty shell.`);
+  }
+  let key = Stdlib_Option.getOr(config.key, defaultKey);
+  let path = Nodepath.join(dir, key);
+  Nodefs.writeFileSync(path, JSON.stringify(e._0, undefined, 2), "utf8");
+  log.info("BakedManifest", undefined, `wrote ` + key + ` for ` + selections.length.toString() + ` plugin(s): ` + path);
+}
+
+export {
+  hostShellPackage,
+  log,
+  hostShellDistDir,
+  defaultKey,
+  emit,
+}
+/* log Not a pure module */

package/src/Platform.res

@@ -874,6 +874,35 @@ module MakeWithConfig = (
   // In-memory store for plugin structures, keyed by plugin ID.
   let pluginStructuresStore: ref<dict<Reventless.Plugin.pluginStructure>> = ref(Dict.make())
 
+  // Bake the curated manifest from the plugin components directly rather than
+  // from `pluginStructuresStore`: a structure only exists once its Output
+  // resolves, so a synchronous read of that store at the end of `makePlatform`
+  // sees an empty dict. Emitting once the last plugin's structure has landed is
+  // both the earliest correct moment and the only one that cannot bake a
+  // half-registered platform.
+  let bakeManifest = (
+    ~pluginComponents: array<ReventlessCore.Plugin.component>,
+    ~config: ReventlessInfra.Platform.bakedManifest,
+  ) => {
+    let resolved: array<(string, Reventless.Plugin.pluginStructure)> = []
+    let expected = pluginComponents->Array.length
+    pluginComponents->Array.forEach(plugin => {
+      let outputs: ReventlessInfra.Plugin.outputs = plugin->ReventlessCore.Component.outputs
+      let _ =
+        (outputs.id, outputs.pluginStructure)
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.apply(((id, ps)) => {
+          switch ps {
+          | Some(def) => resolved->Array.push((id, def))
+          | None => ()
+          }
+          if resolved->Array.length === expected {
+            BakedManifest.emit(~structures=resolved, ~config)
+          }
+        })
+    })
+  }
+
   // The object stores a plugin's fields declared, as `{plugin}.{store}` keys.
   let declaredStoresOf = (structure: Reventless.Plugin.pluginStructure) =>
     structure.requiredStores->Option.getOr([])
@@ -1399,7 +1428,35 @@ module MakeWithConfig = (
       }
     })
 
-  let makePlatform = (~version, ~plugins: array<module(PluginMaker)>) => {
+  // In-memory ignores most of `~hostUiBundle` — the host shell is served by
+  // `vite dev` against the running in-process GraphQL server, not from a CDN,
+  // including `uiHintsFile` (the AWS deploy writes it as a BucketObject; local
+  // dev serves `public/ui-hints.json` directly). `bakedManifest` is the
+  // exception: it is generated content, so there is no hand-authored file for
+  // local dev to serve instead.
+  type hostUiBundleConfig = {
+    assetsDir?: string,
+    bundleVersion?: string,
+    uiHintsFile?: string,
+    // Honoured here, unlike the rest: `makePlatform` writes the curated manifest
+    // where the local host-shell serves its static assets from.
+    bakedManifest?: ReventlessInfra.Platform.bakedManifest,
+    // AWS host-ui deploy knobs — carried to satisfy the shared Platform.T
+    // signature; the in-memory platform provisions no infrastructure and
+    // ignores them.
+    geocoderPlaceIndex?: ReventlessInfra.Platform.geocoderIndex,
+    uploadBucket?: ReventlessInfra.Platform.objectStore,
+    // Same terms: the AWS deploy writes these into the config.json it hosts, and
+    // local dev has no config.json of its own to write — the host-shell package
+    // serves `public/config.json`, which is where local turns a view mode on.
+    viewModes?: array<ReventlessInfra.Platform.viewMode>,
+    shellConfig?: dict<JSON.t>,
+  }
+  let makePlatform = (
+    ~version,
+    ~plugins: array<module(PluginMaker)>,
+    ~hostUiBundle: option<hostUiBundleConfig>=?,
+  ) => {
     log.info(~comp="Platform", `v${version}`)
     log.info(
       ~comp="Platform",
@@ -1549,6 +1606,14 @@ module MakeWithConfig = (
       connectPlugin(~pluginComponents=plugins)
       seedPluginStructuresStore(~pluginComponents=plugins)
     }
+    // Not inside `seedAdminStores`: the bake describes what this deployment
+    // offers, which is settled at composition and owes nothing to projection
+    // catch-up. Every plugin passed to this call is connected by construction
+    // locally, so there is no status or version dedup to apply.
+    switch hostUiBundle->Option.flatMap(cfg => cfg.bakedManifest) {
+    | None => ()
+    | Some(cfg) => bakeManifest(~pluginComponents=plugins, ~config=cfg)
+    }
     switch (projectionCatchup, pgProjectionCatchup) {
     | (Some((db, upperBound, dcbUpperBound)), _) =>
       let _ =
@@ -2031,25 +2096,6 @@ module MakeWithConfig = (
 
   }
 
-  // In-memory ignores `~hostUiBundle` — the host shell is served by `vite dev`
-  // against the running in-process GraphQL server, not from a CDN — including
-  // `uiHintsFile` (the AWS deploy writes it as a BucketObject; local dev serves
-  // `public/ui-hints.json` directly).
-  type hostUiBundleConfig = {
-    assetsDir?: string,
-    bundleVersion?: string,
-    uiHintsFile?: string,
-    // AWS host-ui deploy knobs — carried to satisfy the shared Platform.T
-    // signature; the in-memory platform provisions no infrastructure and
-    // ignores them.
-    geocoderPlaceIndex?: ReventlessInfra.Platform.geocoderIndex,
-    uploadBucket?: ReventlessInfra.Platform.objectStore,
-    // Same terms: the AWS deploy writes these into the config.json it hosts, and
-    // local dev has no config.json of its own to write — the host-shell package
-    // serves `public/config.json`, which is where local turns a view mode on.
-    viewModes?: array<ReventlessInfra.Platform.viewMode>,
-    shellConfig?: dict<JSON.t>,
-  }
   let deployPlatform = (
     ~version,
     ~hostUiBundle as _: option<hostUiBundleConfig>=?,

package/src/Platform.res.mjs

@@ -31,6 +31,7 @@ import * as BackendState$ReventlessLocal from "./adapter/BackendState.res.mjs";
 import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/src/ComponentType.res.mjs";
 import * as SqliteDriver$ReventlessLocal from "./adapter/SqliteDriver.res.mjs";
 import * as Task_Builder$ReventlessLocal from "./components/Task_Builder.res.mjs";
+import * as BakedManifest$ReventlessLocal from "./BakedManifest.res.mjs";
 import * as Platform_Admin$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin.res.mjs";
 import * as PluginBehavior$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginBehavior.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
@@ -832,6 +833,28 @@ function MakeWithConfig(Config) {
   let pluginStructuresStore = {
     contents: {}
   };
+  let bakeManifest = (pluginComponents, config) => {
+    let resolved = [];
+    let expected = pluginComponents.length;
+    pluginComponents.forEach(plugin => {
+      let outputs = Component$ReventlessCore.outputs(plugin);
+      Pulumi.all([
+        outputs.id,
+        outputs.pluginStructure
+      ]).apply(param => {
+        let ps = param[1];
+        if (ps !== undefined) {
+          resolved.push([
+            param[0],
+            ps
+          ]);
+        }
+        if (resolved.length === expected) {
+          return BakedManifest$ReventlessLocal.emit(resolved, config);
+        }
+      });
+    });
+  };
   let seedPluginStructuresStore = pluginComponents => {
     pluginComponents.forEach(plugin => {
       let outputs = Component$ReventlessCore.outputs(plugin);
@@ -1183,7 +1206,7 @@ function MakeWithConfig(Config) {
       }
     });
   };
-  let makePlatform = (version, plugins) => {
+  let makePlatform = (version, plugins, hostUiBundle) => {
     log.info("Platform", undefined, `v` + version);
     log.info("Platform", undefined, `silent: ` + Stdlib_Bool.toString(Config.silent) + `, splitApi: ` + Stdlib_Bool.toString(Config.splitApi) + `, cloner: ` + Stdlib_Bool.toString(Config.cloner));
     let match = Config.backend;
@@ -1262,6 +1285,10 @@ function MakeWithConfig(Config) {
       adminResources: []
     });
     subscribeToPluginEvents();
+    let cfg = Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest);
+    if (cfg !== undefined) {
+      bakeManifest(plugins$1, cfg);
+    }
     if (projectionCatchup !== undefined) {
       Stdlib_Promise.$$catch(ProjectionCheckpoint$ReventlessLocal.startupCatchup(projectionCatchup[0], projectionCatchup[1], projectionCatchup[2], () => Bus.projectionCatchupHandlers()), e => {
         console.error("[Platform] projection catch-up failed:", e);
@@ -2529,6 +2556,28 @@ function Make($star) {
   let pluginStructuresStore = {
     contents: {}
   };
+  let bakeManifest = (pluginComponents, config) => {
+    let resolved = [];
+    let expected = pluginComponents.length;
+    pluginComponents.forEach(plugin => {
+      let outputs = Component$ReventlessCore.outputs(plugin);
+      Pulumi.all([
+        outputs.id,
+        outputs.pluginStructure
+      ]).apply(param => {
+        let ps = param[1];
+        if (ps !== undefined) {
+          resolved.push([
+            param[0],
+            ps
+          ]);
+        }
+        if (resolved.length === expected) {
+          return BakedManifest$ReventlessLocal.emit(resolved, config);
+        }
+      });
+    });
+  };
   let seedPluginStructuresStore = pluginComponents => {
     pluginComponents.forEach(plugin => {
       let outputs = Component$ReventlessCore.outputs(plugin);
@@ -2876,7 +2925,7 @@ function Make($star) {
       }
     });
   };
-  let makePlatform = (version, plugins) => {
+  let makePlatform = (version, plugins, hostUiBundle) => {
     log.info("Platform", undefined, `v` + version);
     log.info("Platform", undefined, `silent: ` + Stdlib_Bool.toString(false) + `, splitApi: ` + Stdlib_Bool.toString(true) + `, cloner: ` + Stdlib_Bool.toString(false));
     let tmp;
@@ -2954,6 +3003,10 @@ function Make($star) {
       adminResources: []
     });
     subscribeToPluginEvents();
+    let cfg = Stdlib_Option.flatMap(hostUiBundle, cfg => cfg.bakedManifest);
+    if (cfg !== undefined) {
+      bakeManifest(plugins$1, cfg);
+    }
     if (projectionCatchup !== undefined) {
       Stdlib_Promise.$$catch(ProjectionCheckpoint$ReventlessLocal.startupCatchup(projectionCatchup[0], projectionCatchup[1], projectionCatchup[2], () => Bus.projectionCatchupHandlers()), e => {
         console.error("[Platform] projection catch-up failed:", e);

package/src/adapter/LocalBus.res

@@ -132,6 +132,7 @@ module type T = {
       ~argsDict: dict<JSON.t>,
       ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
       ~labelField: string,
+      ~ownerScope: (string, string)=?,
     ) => option<JSON.t>,
   ) => unit
   let getQueryDbListPage: string => option<
@@ -139,6 +140,7 @@ module type T = {
       ~argsDict: dict<JSON.t>,
       ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
       ~labelField: string,
+      ~ownerScope: (string, string)=?,
     ) => option<JSON.t>,
   >
 
@@ -235,6 +237,7 @@ module Impl = (C: BusConfig): T => {
         ~argsDict: dict<JSON.t>,
         ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
         ~labelField: string,
+        ~ownerScope: (string, string)=?,
       ) => option<JSON.t>,
     >,
   > = ref(Dict.make())

package/src/adapter/QueryDb/QueryDbResolvers_GraphQL.res

@@ -137,6 +137,49 @@ module Make = (Bus: LocalBus.T) => {
       }
     }
 
+    // ── Owner scoping ────────────────────────────────────────────────────────
+    // What a caller may see of a view whose state declares an `@owner` field.
+    // Sits beside `runInterceptor` on purpose: these are the two questions every
+    // door has to ask, and a door that forgets one of them is a hole rather than
+    // a degradation. Answering "may they read this at all" and "which rows" in
+    // the same place is what makes the omission visible when reading a resolver.
+    // Read per request rather than captured at registration: a resolver is built
+    // before every plugin's state schema is necessarily registered, and a lookup
+    // that missed here would leave the view unscoped rather than erroring.
+    let ownerFieldOf = () =>
+      Plugin_Helpers.stateSchemaRegistry
+      ->Dict.get(name)
+      ->Option.flatMap(s => Reventless.Owner.fieldNames(s)->Array.get(0))
+
+    // An owner-scoped view with no elevated groups configured scopes EVERYONE,
+    // administrators included. That is the safe direction to be wrong in and it
+    // is still wrong, and it is invisible from outside — an operator's empty list
+    // looks exactly like an operator who owns nothing. Said once per view at
+    // registration, because the alternative is finding out from a support ticket.
+    OwnerScopeDiagnostics.warnIfNoElevatedGroups(
+      ~comp="QueryDbResolvers_GraphQL",
+      ~view=name,
+      ~ownerField=ownerFieldOf(),
+    )
+
+    let ownerDecision = (~ctx) =>
+      extractIdentity(ctx)->Reventless.OwnerScope.decide(~ownerField=ownerFieldOf())
+
+    // Post-read form, for the single-row and by-index doors where there is no
+    // page to narrow — the row is already in hand and either belongs to the
+    // caller or does not.
+    let ownerAllows = (~ctx, item: JSON.t) =>
+      switch ownerDecision(~ctx) {
+      | Unscoped => true
+      | RefuseOwned => false
+      | ScopeTo(field, required) =>
+        item
+        ->JSON.Decode.object
+        ->Option.flatMap(d => d->Dict.get(field))
+        ->Option.flatMap(JSON.Decode.string)
+        ->Option.mapOr(false, v => v == required)
+      }
+
     let cap = s => s->String.charAt(0)->String.toUpperCase ++ s->String.slice(~start=1)
 
     // Resolve query field names: check registry first, fall back to safe defaults.
@@ -214,6 +257,10 @@ module Make = (Bus: LocalBus.T) => {
           | _ => (id, firstAttempt)
           }
           switch items->Array.get(0) {
+          // A row the caller does not own answers as though it were not there.
+          // Distinguishing "not yours" from "not found" here would turn this door
+          // into an oracle for which ids exist.
+          | Some(item) if !ownerAllows(~ctx, item) => JSON.Encode.null
           | Some(item) =>
             if includeIdParam {
               // Copied — `JSON.Decode.object` hands back the stored object itself,
@@ -279,7 +326,9 @@ module Make = (Bus: LocalBus.T) => {
               )->Promise.all
               loaded
               ->Array.filterMap(((id, opt)) =>
-                opt->Option.map(item => {
+                opt
+                ->Option.filter(item => ownerAllows(~ctx, item))
+                ->Option.map(item => {
                   let obj = item->JSON.Decode.object->Option.mapOr(Dict.make(), Dict.copy)
                   obj->Dict.set("id", JSON.Encode.string(id))
                   JSON.Encode.object(obj)
@@ -345,39 +394,63 @@ module Make = (Bus: LocalBus.T) => {
           ~hasOrderBy,
         ),
       ]
+      let emptyConnection = Obj.magic({
+        "edges": [],
+        "pageInfo": {
+          "hasNextPage": false,
+          "hasPreviousPage": false,
+          "startCursor": Nullable.null,
+          "endCursor": Nullable.null,
+        },
+      })
       let resolver: ReventlessGraphqlServer.GraphQL_ServerInstance.resolverFn = async (_root, args, ctx) => {
         switch await runInterceptor(~ctx, ~args) {
-        | Deny(_) =>
-          Obj.magic({
-            "edges": [],
-            "pageInfo": {
-              "hasNextPage": false,
-              "hasPreviousPage": false,
-              "startCursor": Nullable.null,
-              "endCursor": Nullable.null,
-            },
-          })
+        | Deny(_) => emptyConnection
         | Allow =>
-          let argsDict = args->JSON.Decode.object->Option.getOr(Dict.make())
-          // Prefer a backend list push-down (SQLite builds json_extract predicates
-          // + ORDER BY … LIMIT so it never materialises the whole read model). When
-          // the backend can't serve this query shape it returns None and we fall
-          // back to materialising the full model and running the shared
-          // `QueryDbListQuery` spec over it (the same code the in-memory backend and
-          // the push-down are tested against).
-          let decodeLocalId = id =>
-            DomainGraphQL_Server.decodeGlobalId(id)->Option.map(((_, lid)) => lid)
-          switch Bus.getQueryDbListPage(name) {
-          | Some(listPage) =>
-            switch listPage(~argsDict, ~capability, ~labelField) {
-            | Some(conn) => conn
+          switch ownerDecision(~ctx) {
+          | RefuseOwned => emptyConnection
+          | decision =>
+            let ownerScope = Reventless.OwnerScope.scopeOf(decision)
+            let argsDict = args->JSON.Decode.object->Option.getOr(Dict.make())
+            // Prefer a backend list push-down (SQLite builds json_extract predicates
+            // + ORDER BY … LIMIT so it never materialises the whole read model). When
+            // the backend can't serve this query shape it returns None and we fall
+            // back to materialising the full model and running the shared
+            // `QueryDbListQuery` spec over it (the same code the in-memory backend and
+            // the push-down are tested against).
+            //
+            // `ownerScope` goes to BOTH arms. Passing it only to the fallback would
+            // scope the exceptional path and leave the normal one — the push-down —
+            // returning everything, which is the worst possible place for the gap
+            // because the fallback is what the tests most easily exercise.
+            let decodeLocalId = id =>
+              DomainGraphQL_Server.decodeGlobalId(id)->Option.map(((_, lid)) => lid)
+            switch Bus.getQueryDbListPage(name) {
+            | Some(listPage) =>
+              switch listPage(~argsDict, ~capability, ~labelField, ~ownerScope?) {
+              | Some(conn) => conn
+              | None =>
+                let items = await fetchAllItems()
+                QueryDbListQuery.run(
+                  ~items,
+                  ~argsDict,
+                  ~capability,
+                  ~labelField,
+                  ~decodeLocalId,
+                  ~ownerScope?,
+                )
+              }
             | None =>
               let items = await fetchAllItems()
-              QueryDbListQuery.run(~items, ~argsDict, ~capability, ~labelField, ~decodeLocalId)
+              QueryDbListQuery.run(
+                ~items,
+                ~argsDict,
+                ~capability,
+                ~labelField,
+                ~decodeLocalId,
+                ~ownerScope?,
+              )
             }
-          | None =>
-            let items = await fetchAllItems()
-            QueryDbListQuery.run(~items, ~argsDict, ~capability, ~labelField, ~decodeLocalId)
           }
         }
       }
@@ -389,7 +462,11 @@ module Make = (Bus: LocalBus.T) => {
         switch await runInterceptor(~ctx, ~args) {
         | Deny(_) => Obj.magic({"nextToken": Nullable.null, "scannedCount": 0, "items": []})
         | Allow =>
-          let items = await fetchAllItems()
+          let all = await fetchAllItems()
+          // The legacy shape has no push-down to reach, so the narrowing is a plain
+          // filter here. `scannedCount` counts what is returned, not what was read:
+          // the pre-scoping total would tell a caller how many rows they may not see.
+          let items = all->Array.filter(item => ownerAllows(~ctx, item))
           Obj.magic({"nextToken": Nullable.null, "scannedCount": items->Array.length, "items": items})
         }
       }
@@ -446,11 +523,15 @@ module Make = (Bus: LocalBus.T) => {
           switch Bus.getQueryDb(name) {
           | None => emptyConn
           | Some(ops) =>
-            let allItems =
+            let loaded =
               await ops.loadStream(id)
               ->Stream.runCollect
               ->Effect.catchAll(_ => Effect.succeed([]))
               ->Effect.runPromise
+            // Narrowed here, before the cursor window and the sort-key filter, so
+            // every page this door emits is a page of rows the caller owns. Doing
+            // it after would hand back short pages with valid cursors.
+            let allItems = loaded->Array.filter(item => ownerAllows(~ctx, item))
 
             // Cursor-keyed filtering: exclude items on the cursor side of the boundary
             let cursorFiltered = if isBackward {
@@ -539,11 +620,16 @@ module Make = (Bus: LocalBus.T) => {
           | Allow =>
             let value =
               args->JSON.Decode.object->Option.flatMap(d => d->Dict.get(index))->Option.flatMap(JSON.Decode.string)->Option.getOr("")
+            // Applied to whichever arm answers, rather than inside one of them: the
+            // push-down and the scan are two ways to reach the same rows, and a
+            // narrowing that lives in only one is a hole that appears when a
+            // backend gains or loses an index.
+            let scoped = rows => rows->Array.filter(item => ownerAllows(~ctx, item))
             // Prefer the pushed-down equality lookup (SQLite rides the GSI index;
             // in-memory reuses its lazy snapshot). Fall back to scan+filter only
             // if no lookup is registered for this QueryDb.
             switch Bus.getQueryDbIndexLookup(name) {
-            | Some(lookup) => lookup(filterField, value)->JSON.Encode.array
+            | Some(lookup) => lookup(filterField, value)->scoped->JSON.Encode.array
             | None =>
               switch Bus.getQueryDbScan(name) {
               | Some(scanAll) =>
@@ -556,6 +642,7 @@ module Make = (Bus: LocalBus.T) => {
                   ->Option.map(v => v == value)
                   ->Option.getOr(false)
                 )
+                ->scoped
                 ->JSON.Encode.array
               | None => []->JSON.Encode.array
               }

package/src/adapter/QueryDb/QueryDbResolvers_GraphQL.res.mjs

@@ -6,7 +6,9 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Api_Ids$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Ids.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
@@ -14,6 +16,7 @@ import * as SortKey_Filter$ReventlessLocal from "./SortKey_Filter.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
 import * as DomainGraphQL_Server$ReventlessLocal from "../DomainGraphQL_Server.res.mjs";
+import * as OwnerScopeDiagnostics$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/OwnerScopeDiagnostics.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
 function encodeCursor(value) {
@@ -85,6 +88,18 @@ function Make(Bus) {
         return "Allow";
       }
     };
+    let ownerFieldOf = () => Stdlib_Option.flatMap(Plugin_Helpers$ReventlessCore.stateSchemaRegistry[name], s => Owner$Reventless.fieldNames(s)[0]);
+    OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("QueryDbResolvers_GraphQL", name, ownerFieldOf());
+    let ownerDecision = ctx => OwnerScope$Reventless.decide(extractIdentity(ctx), ownerFieldOf(), undefined);
+    let ownerAllows = (ctx, item) => {
+      let match = ownerDecision(ctx);
+      if (typeof match !== "object") {
+        return match === "Unscoped";
+      }
+      let required = match._1;
+      let field = match._0;
+      return Stdlib_Option.mapOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[field]), Stdlib_JSON.Decode.string), false, v => v === required);
+    };
     let cap = s => s.charAt(0).toUpperCase() + s.slice(1);
     let registryEntry = Plugin_Helpers$ReventlessCore.queryFieldNamesRegistry[name];
     let singleQueryName = registryEntry !== undefined ? registryEntry.singleFieldName : name.charAt(0).toLowerCase() + name.slice(1);
@@ -124,6 +139,9 @@ function Make(Bus) {
       if (item === undefined) {
         return null;
       }
+      if (!ownerAllows(ctx, item)) {
+        return null;
+      }
       if (!includeIdParam) {
         return item;
       }
@@ -168,7 +186,7 @@ function Make(Bus) {
         }));
         return Stdlib_Array.filterMap(loaded, param => {
           let id = param[0];
-          return Stdlib_Option.map(param[1], item => {
+          return Stdlib_Option.map(Stdlib_Option.filter(param[1], item => ownerAllows(ctx, item)), item => {
             let obj = Stdlib_Option.mapOr(Stdlib_JSON.Decode.object(item), {}, prim => Object.assign({}, prim));
             obj["id"] = id;
             return obj;
@@ -205,32 +223,38 @@ function Make(Bus) {
       let typesToRegister = [GraphQL_FragmentGenerator$ReventlessCore.deriveConnectionFilterType(filterTypeName, capability)].concat(orderByTypes);
       server.registerTypes(typesToRegister);
       let sdl = [GraphQL_FragmentGenerator$ReventlessCore.deriveConnectionQueryField(listQueryName, returnTypeName, filterTypeName, hasOrderBy)];
+      let emptyConnection = {
+        edges: [],
+        pageInfo: {
+          hasNextPage: false,
+          hasPreviousPage: false,
+          startCursor: null,
+          endCursor: null
+        }
+      };
       let resolver$1 = async (_root, args, ctx) => {
         let match = await runInterceptor(ctx, args);
         if (typeof match === "object") {
-          return {
-            edges: [],
-            pageInfo: {
-              hasNextPage: false,
-              hasPreviousPage: false,
-              startCursor: null,
-              endCursor: null
-            }
-          };
+          return emptyConnection;
+        }
+        let decision = ownerDecision(ctx);
+        if (typeof decision !== "object" && decision !== "Unscoped") {
+          return emptyConnection;
         }
+        let ownerScope = OwnerScope$Reventless.scopeOf(decision);
         let argsDict = Stdlib_Option.getOr(Stdlib_JSON.Decode.object(args), {});
         let decodeLocalId = id => Stdlib_Option.map(DomainGraphQL_Server$ReventlessLocal.decodeGlobalId(id), param => param[1]);
         let listPage = Bus.getQueryDbListPage(name);
         if (listPage !== undefined) {
-          let conn = listPage(argsDict, capability, labelField);
+          let conn = listPage(argsDict, capability, labelField, ownerScope);
           if (conn !== undefined) {
             return conn;
           }
           let items = await fetchAllItems();
-          return QueryDbListQuery$ReventlessCore.run(items, argsDict, capability, labelField, decodeLocalId);
+          return QueryDbListQuery$ReventlessCore.run(items, argsDict, capability, labelField, decodeLocalId, ownerScope);
         }
         let items$1 = await fetchAllItems();
-        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, capability, labelField, decodeLocalId);
+        return QueryDbListQuery$ReventlessCore.run(items$1, argsDict, capability, labelField, decodeLocalId, ownerScope);
       };
       match = [
         sdl,
@@ -247,7 +271,8 @@ function Make(Bus) {
             items: []
           };
         }
-        let items = await fetchAllItems();
+        let all = await fetchAllItems();
+        let items = all.filter(item => ownerAllows(ctx, item));
         return {
           nextToken: null,
           scannedCount: items.length,
@@ -305,7 +330,8 @@ function Make(Bus) {
         if (ops === undefined) {
           return emptyConn;
         }
-        let allItems = await Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(id)), param => Effect.succeed([])));
+        let loaded = await Effect.runPromise(Effect.catchAll(Stream.runCollect(ops.loadStream(id)), param => Effect.succeed([])));
+        let allItems = loaded.filter(item => ownerAllows(ctx, item));
         let cursorFiltered;
         if (isBackward) {
           let beforeKey = Stdlib_Option.map(before, decodeCursor);
@@ -382,13 +408,14 @@ function Make(Bus) {
           return [];
         }
         let value = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(args), d => d[index]), Stdlib_JSON.Decode.string), "");
+        let scoped = rows => rows.filter(item => ownerAllows(ctx, item));
         let lookup = Bus.getQueryDbIndexLookup(name);
         if (lookup !== undefined) {
-          return lookup(filterField, value);
+          return scoped(lookup(filterField, value));
         }
         let scanAll = Bus.getQueryDbScan(name);
         if (scanAll !== undefined) {
-          return scanAll().filter(item => Stdlib_Option.getOr(Stdlib_Option.map(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[filterField]), Stdlib_JSON.Decode.string), v => v === value), false));
+          return scoped(scanAll().filter(item => Stdlib_Option.getOr(Stdlib_Option.map(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(item), d => d[filterField]), Stdlib_JSON.Decode.string), v => v === value), false)));
         } else {
           return [];
         }

package/src/adapter/QueryDb/QueryDbStorage_Sqlite.res

@@ -146,6 +146,7 @@ type busCallbacks = {
       ~argsDict: dict<JSON.t>,
       ~capability: GraphQL_FragmentGenerator.serverCapability,
       ~labelField: string,
+      ~ownerScope: (string, string)=?,
     ) => option<JSON.t>,
   ) => unit,
 }
@@ -426,6 +427,7 @@ let makeStorage = (
     ~argsDict: dict<JSON.t>,
     ~capability: GraphQL_FragmentGenerator.serverCapability,
     ~labelField as _,
+    ~ownerScope: option<(string, string)>=?,
   ): option<JSON.t> => {
     let filterDict =
       argsDict->Dict.get("filter")->Option.flatMap(JSON.Decode.object)->Option.getOr(Dict.make())
@@ -440,6 +442,15 @@ let makeStorage = (
     } else {
       let whereParts = [notExpiredClause]
       let params = []
+      // Pushed into the SQL rather than applied to the returned page, because the
+      // LIMIT below is what makes a page: narrowing afterwards would return fewer
+      // rows than asked for while still reporting a next page.
+      switch ownerScope {
+      | Some((field, required)) =>
+        whereParts->Array.push(`${jsonText(field)} = ?`)
+        params->Array.push(JSON.Encode.string(required))
+      | None => ()
+      }
       let valString = v =>
         switch v->JSON.Decode.string {
         | Some(s) => Some(s)

package/src/adapter/QueryDb/QueryDbStorage_Sqlite.res.mjs

@@ -337,7 +337,7 @@ function makeStorage(db, bus, name, indexes, subIdField) {
   };
   let jsonText = field => `CAST(json_extract(item, '$.` + field.replaceAll("'", "''") + `') AS TEXT)`;
   let idExpr = "COALESCE(json_extract(item, '$.id'), partition_key)";
-  let listPage = (argsDict, capability, param) => {
+  let listPage = (argsDict, capability, param, ownerScope) => {
     let filterDict = Stdlib_Option.getOr(Stdlib_Option.flatMap(argsDict["filter"], Stdlib_JSON.Decode.object), {});
     let strNonEmpty = k => Stdlib_Option.mapOr(Stdlib_Option.flatMap(filterDict[k], Stdlib_JSON.Decode.string), false, s => s.length > 0);
     let hasIds = Stdlib_Option.mapOr(Stdlib_Option.flatMap(filterDict["ids"], Stdlib_JSON.Decode.array), false, a => a.length !== 0);
@@ -348,6 +348,10 @@ function makeStorage(db, bus, name, indexes, subIdField) {
     }
     let whereParts = [notExpiredClause];
     let params = [];
+    if (ownerScope !== undefined) {
+      whereParts.push(jsonText(ownerScope[0]) + ` = ?`);
+      params.push(ownerScope[1]);
+    }
     let valString = v => {
       let s = Stdlib_JSON.Decode.string(v);
       if (s !== undefined) {

package/tests/adapter/QueryDbListPushdownParityTest.res

@@ -21,23 +21,30 @@ let capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability = {
   sortFields: ["name", "qty", "status"],
 }
 
-let mk = (id, status, name, qty) => {
+let mk = (id, status, name, qty, owner) => {
   let o = Dict.make()
   o->Dict.set("id", JSON.Encode.string(id))
   o->Dict.set("status", JSON.Encode.string(status))
   o->Dict.set("name", JSON.Encode.string(name))
   o->Dict.set("qty", JSON.Encode.int(qty))
+  o->Dict.set("owner", JSON.Encode.string(owner))
   JSON.Encode.object(o)
 }
 
 // Names differ from id-order; status has duplicates (tiebreak); qty exercises the
-// numeric-field-as-string comparison the push-down must match.
+// numeric-field-as-string comparison the push-down must match. `owner` is split
+// so that no owner holds all the rows and none holds none — a scoped read that
+// returned everything and one that returned nothing would both stand out.
+//
+// Note `owner` is deliberately absent from `capability` below: owner scoping has
+// to work on a field the client-visible filter surface does not admit, which is
+// the normal case and the reason the predicate travels separately.
 let rows = [
-  ("p-1", "active", "Charlie", 3),
-  ("p-2", "active", "Alpha", 1),
-  ("p-3", "inactive", "Echo", 5),
-  ("p-4", "active", "Bravo", 2),
-  ("p-5", "inactive", "Delta", 4),
+  ("p-1", "active", "Charlie", 3, "u-a"),
+  ("p-2", "active", "Alpha", 1, "u-b"),
+  ("p-3", "inactive", "Echo", 5, "u-a"),
+  ("p-4", "active", "Bravo", 2, "u-c"),
+  ("p-5", "inactive", "Delta", 4, "u-a"),
 ]
 
 type setup = {
@@ -45,6 +52,7 @@ type setup = {
     ~argsDict: dict<JSON.t>,
     ~capability: ReventlessCore.GraphQL_FragmentGenerator.serverCapability,
     ~labelField: string,
+    ~ownerScope: (string, string)=?,
   ) => option<JSON.t>,
   fullScan: unit => array<JSON.t>,
 }
@@ -58,8 +66,8 @@ let build = async (): setup => {
   let s = Storage.make(~name="items", ~indexes=[], ~api=(), ~apiRole=(), ~owner=None, ~opts)
   let ops = await s.operations->TestRunner.resolve
   for i in 0 to rows->Array.length - 1 {
-    let (id, status, name, qty) = rows->Array.getUnsafe(i)
-    let _ = await ops.save(id, mk(id, status, name, qty), ReventlessCore.QueryDb.Any, None)
+    let (id, status, name, qty, owner) = rows->Array.getUnsafe(i)
+    let _ = await ops.save(id, mk(id, status, name, qty, owner), ReventlessCore.QueryDb.Any, None)
   }
   {
     listPage: TestBus.getQueryDbListPage("items")->Option.getOrThrow,
@@ -110,7 +118,7 @@ let orderBy = (f, dir) =>
 let cur = ReventlessCore.QueryDbListQuery.encodeCursor
 
 // Assert the push-down serves this shape AND matches the spec exactly.
-let checkPushed = async (~label, args) => {
+let checkPushed = async (~label, ~ownerScope=?, args) => {
   let s = await build()
   let argsDict = argsOf(args)
   let expected =
@@ -120,8 +128,9 @@ let checkPushed = async (~label, args) => {
       ~capability,
       ~labelField="name",
       ~decodeLocalId=_ => None,
+      ~ownerScope?,
     )->norm
-  switch s.listPage(~argsDict, ~capability, ~labelField="name") {
+  switch s.listPage(~argsDict, ~capability, ~labelField="name", ~ownerScope?) {
   | Some(actual) => expect(actual->norm)->toEqual(expected)
   | None => expect("push-down for " ++ label)->toBe("returned None")
   }
@@ -133,6 +142,20 @@ let checkFallback = async args => {
   expect(s.listPage(~argsDict=argsOf(args), ~capability, ~labelField="name")->Option.isSome)->toBe(false)
 }
 
+// The ids a scoped read actually returns, from the push-down.
+let scopedIds = async (~owner, args) => {
+  let s = await build()
+  switch s.listPage(
+    ~argsDict=argsOf(args),
+    ~capability,
+    ~labelField="name",
+    ~ownerScope=("owner", owner),
+  ) {
+  | Some(conn) => (conn->norm).edges->Array.map(e => e.id)
+  | None => []
+  }
+}
+
 describe("QueryDb list push-down parity (SQLite ≡ QueryDbListQuery spec)", () => {
   testPromise("bare page", () => checkPushed(~label="bare", []))
   testPromise("first:2", () => checkPushed(~label="first", [("first", JSON.Encode.int(2))]))
@@ -194,4 +217,62 @@ describe("QueryDb list push-down parity (SQLite ≡ QueryDbListQuery spec)", ()
   testPromise("backward (last/before) → fallback", () =>
     checkFallback([("last", JSON.Encode.int(2)), ("before", JSON.Encode.string(cur("p-4")))])
   )
+
+  // ── Owner scoping ─────────────────────────────────────────────────────────
+  // Parity matters more here than anywhere else in this file. The push-down is
+  // the path a deployment actually takes; the spec is the path the tests most
+  // easily reach. A predicate implemented in only one of them is a hole that
+  // every fallback-based test would still call green.
+  describe("owner scoping", () => {
+    testPromise("bare page, scoped", () =>
+      checkPushed(~label="owner-bare", ~ownerScope=("owner", "u-a"), [])
+    )
+    testPromise("scoped + orderBy", () =>
+      checkPushed(
+        ~label="owner-order",
+        ~ownerScope=("owner", "u-a"),
+        [("orderBy", orderBy("name", "DESC"))],
+      )
+    )
+    // The client's own filter must survive alongside the scope, not be replaced
+    // by it — a scoped read is still a filtered read.
+    testPromise("scoped + client filter compose", () =>
+      checkPushed(
+        ~label="owner-and-filter",
+        ~ownerScope=("owner", "u-a"),
+        [("filter", filterOf([("statusEq", JSON.Encode.string("inactive"))]))],
+      )
+    )
+
+    testPromise("a scoped read returns exactly that owner's rows", async () =>
+      expect(await scopedIds(~owner="u-a", []))->toEqual(["p-1", "p-3", "p-5"])
+    )
+
+    // The control: a different owner sees a different, also non-empty, set. An
+    // implementation that scoped to nothing would pass an "is not everything"
+    // assertion and fail this one.
+    testPromise("a second owner sees their own rows, not the first's", async () =>
+      expect(await scopedIds(~owner="u-b", []))->toEqual(["p-2"])
+    )
+
+    // The case that catches a predicate applied AFTER the page rather than
+    // inside the SQL: u-a owns 3 of 5 rows, so a LIMIT 2 taken before scoping
+    // would return p-1 alone (p-2 belongs to u-b and would be dropped), not the
+    // two rows actually asked for.
+    testPromise("paging a scoped read fills each page from owned rows only", async () =>
+      expect(await scopedIds(~owner="u-a", [("first", JSON.Encode.int(2))]))->toEqual([
+        "p-1",
+        "p-3",
+      ])
+    )
+
+    testPromise("the second page continues the scoped sequence", async () =>
+      expect(
+        await scopedIds(
+          ~owner="u-a",
+          [("first", JSON.Encode.int(2)), ("after", JSON.Encode.string(cur("p-3")))],
+        ),
+      )->toEqual(["p-5"])
+    )
+  })
 })

package/tests/adapter/QueryDbListPushdownParityTest.res.mjs

@@ -36,12 +36,13 @@ let capability = {
   sortFields: capability_sortFields
 };
 
-function mk(id, status, name, qty) {
+function mk(id, status, name, qty, owner) {
   let o = {};
   o["id"] = id;
   o["status"] = status;
   o["name"] = name;
   o["qty"] = qty;
+  o["owner"] = owner;
   return o;
 }
 
@@ -50,31 +51,36 @@ let rows = [
     "p-1",
     "active",
     "Charlie",
-    3
+    3,
+    "u-a"
   ],
   [
     "p-2",
     "active",
     "Alpha",
-    1
+    1,
+    "u-b"
   ],
   [
     "p-3",
     "inactive",
     "Echo",
-    5
+    5,
+    "u-a"
   ],
   [
     "p-4",
     "active",
     "Bravo",
-    2
+    2,
+    "u-c"
   ],
   [
     "p-5",
     "inactive",
     "Delta",
-    4
+    4,
+    "u-a"
   ]
 ];
 
@@ -90,7 +96,7 @@ async function build() {
   for (let i = 0, i_finish = rows.length; i < i_finish; ++i) {
     let match = rows[i];
     let id = match[0];
-    await ops.save(id, mk(id, match[1], match[2], match[3]), "Any", undefined);
+    await ops.save(id, mk(id, match[1], match[2], match[3], match[4]), "Any", undefined);
   }
   return {
     listPage: Stdlib_Option.getOrThrow(TestBus.getQueryDbListPage("items"), undefined),
@@ -142,11 +148,11 @@ function orderBy(f, dir) {
   ]);
 }
 
-async function checkPushed(label, args) {
+async function checkPushed(label, ownerScope, args) {
   let s = await build();
   let argsDict = Object.fromEntries(args);
-  let expected = norm(QueryDbListQuery$ReventlessCore.run(s.fullScan(), argsDict, capability, "name", param => {}));
-  let actual = s.listPage(argsDict, capability, "name");
+  let expected = norm(QueryDbListQuery$ReventlessCore.run(s.fullScan(), argsDict, capability, "name", param => {}, ownerScope));
+  let actual = s.listPage(argsDict, capability, "name", ownerScope);
   if (actual !== undefined) {
     globalThis.expect(norm(actual)).toEqual(expected);
   } else {
@@ -156,16 +162,29 @@ async function checkPushed(label, args) {
 
 async function checkFallback(args) {
   let s = await build();
-  globalThis.expect(Stdlib_Option.isSome(s.listPage(Object.fromEntries(args), capability, "name"))).toBe(false);
+  globalThis.expect(Stdlib_Option.isSome(s.listPage(Object.fromEntries(args), capability, "name", undefined))).toBe(false);
+}
+
+async function scopedIds(owner, args) {
+  let s = await build();
+  let conn = s.listPage(Object.fromEntries(args), capability, "name", [
+    "owner",
+    owner
+  ]);
+  if (conn !== undefined) {
+    return norm(conn).edges.map(e => e.id);
+  } else {
+    return [];
+  }
 }
 
 globalThis.describe("QueryDb list push-down parity (SQLite ≡ QueryDbListQuery spec)", () => {
-  globalThis.test("bare page", () => checkPushed("bare", []));
-  globalThis.test("first:2", () => checkPushed("first", [[
+  globalThis.test("bare page", () => checkPushed("bare", undefined, []));
+  globalThis.test("first:2", () => checkPushed("first", undefined, [[
       "first",
       2
     ]]));
-  globalThis.test("first:2 + after", () => checkPushed("after", [
+  globalThis.test("first:2 + after", () => checkPushed("after", undefined, [
     [
       "first",
       2
@@ -175,14 +194,14 @@ globalThis.describe("QueryDb list push-down parity (SQLite ≡ QueryDbListQuery
       QueryDbListQuery$ReventlessCore.encodeCursor("p-2")
     ]
   ]));
-  globalThis.test("statusEq active", () => checkPushed("eq", [[
+  globalThis.test("statusEq active", () => checkPushed("eq", undefined, [[
       "filter",
       Object.fromEntries([[
           "statusEq",
           "active"
         ]])
     ]]));
-  globalThis.test("statusEq active + first:2", () => checkPushed("eq+first", [
+  globalThis.test("statusEq active + first:2", () => checkPushed("eq+first", undefined, [
     [
       "filter",
       Object.fromEntries([[
@@ -195,15 +214,15 @@ globalThis.describe("QueryDb list push-down parity (SQLite ≡ QueryDbListQuery
       2
     ]
   ]));
-  globalThis.test("orderBy name ASC", () => checkPushed("order-asc", [[
+  globalThis.test("orderBy name ASC", () => checkPushed("order-asc", undefined, [[
       "orderBy",
       orderBy("name", "ASC")
     ]]));
-  globalThis.test("orderBy name DESC", () => checkPushed("order-desc", [[
+  globalThis.test("orderBy name DESC", () => checkPushed("order-desc", undefined, [[
       "orderBy",
       orderBy("name", "DESC")
     ]]));
-  globalThis.test("orderBy name DESC + first:2 + after", () => checkPushed("order-desc-after", [
+  globalThis.test("orderBy name DESC + first:2 + after", () => checkPushed("order-desc-after", undefined, [
     [
       "orderBy",
       orderBy("name", "DESC")
@@ -217,11 +236,11 @@ globalThis.describe("QueryDb list push-down parity (SQLite ≡ QueryDbListQuery
       QueryDbListQuery$ReventlessCore.encodeCursor("Delta")
     ]
   ]));
-  globalThis.test("orderBy status ASC (tiebreak by id)", () => checkPushed("order-tiebreak", [[
+  globalThis.test("orderBy status ASC (tiebreak by id)", () => checkPushed("order-tiebreak", undefined, [[
       "orderBy",
       orderBy("status", "ASC")
     ]]));
-  globalThis.test("qty range From/To (numeric-as-string)", () => checkPushed("range", [[
+  globalThis.test("qty range From/To (numeric-as-string)", () => checkPushed("range", undefined, [[
       "filter",
       Object.fromEntries([
         [
@@ -234,7 +253,7 @@ globalThis.describe("QueryDb list push-down parity (SQLite ≡ QueryDbListQuery
         ]
       ])
     ]]));
-  globalThis.test("orderBy qty ASC (numeric-as-string sort)", () => checkPushed("order-qty", [[
+  globalThis.test("orderBy qty ASC (numeric-as-string sort)", () => checkPushed("order-qty", undefined, [[
       "orderBy",
       orderBy("qty", "ASC")
     ]]));
@@ -269,6 +288,60 @@ globalThis.describe("QueryDb list push-down parity (SQLite ≡ QueryDbListQuery
       QueryDbListQuery$ReventlessCore.encodeCursor("p-4")
     ]
   ]));
+  globalThis.describe("owner scoping", () => {
+    globalThis.test("bare page, scoped", () => checkPushed("owner-bare", [
+      "owner",
+      "u-a"
+    ], []));
+    globalThis.test("scoped + orderBy", () => checkPushed("owner-order", [
+      "owner",
+      "u-a"
+    ], [[
+        "orderBy",
+        orderBy("name", "DESC")
+      ]]));
+    globalThis.test("scoped + client filter compose", () => checkPushed("owner-and-filter", [
+      "owner",
+      "u-a"
+    ], [[
+        "filter",
+        Object.fromEntries([[
+            "statusEq",
+            "inactive"
+          ]])
+      ]]));
+    globalThis.test("a scoped read returns exactly that owner's rows", async () => {
+      globalThis.expect(await scopedIds("u-a", [])).toEqual([
+        "p-1",
+        "p-3",
+        "p-5"
+      ]);
+    });
+    globalThis.test("a second owner sees their own rows, not the first's", async () => {
+      globalThis.expect(await scopedIds("u-b", [])).toEqual(["p-2"]);
+    });
+    globalThis.test("paging a scoped read fills each page from owned rows only", async () => {
+      globalThis.expect(await scopedIds("u-a", [[
+          "first",
+          2
+        ]])).toEqual([
+        "p-1",
+        "p-3"
+      ]);
+    });
+    globalThis.test("the second page continues the scoped sequence", async () => {
+      globalThis.expect(await scopedIds("u-a", [
+        [
+          "first",
+          2
+        ],
+        [
+          "after",
+          QueryDbListQuery$ReventlessCore.encodeCursor("p-3")
+        ]
+      ])).toEqual(["p-5"]);
+    });
+  });
 });
 
 let cur = QueryDbListQuery$ReventlessCore.encodeCursor;
@@ -288,5 +361,6 @@ export {
   cur,
   checkPushed,
   checkFallback,
+  scopedIds,
 }
 /*  Not a pure module */