@reventlessdev/reventless-local 3.0.0-alpha.216 → 3.0.0-alpha.218

package/tests/adapter/CommandAuthorizationTest.res

@@ -198,3 +198,89 @@ describe("CommandGeneratorResolvers_GraphQL — per-constructor authorization",
     },
   )
 })
+
+// ── Caller-fault errors reach the caller ─────────────────────────────────────
+//
+// graphql-yoga masks every thrown value that is not a `GraphQLError` as
+// "Unexpected error / INTERNAL_SERVER_ERROR". That is right for an internal
+// failure and wrong for the failures that describe the caller's own request —
+// a payload that does not decode, a caller who cannot be identified. Core marks
+// those; this is the half that acts on the mark.
+
+@get external errorExtensions: JsExn.t => option<{"code": string}> = "extensions"
+
+let failingFixture = (~namespace: string, ~failWith: unit => unit) => {
+  let server = DomainGraphQL_Server.asInterface
+  let field = `${namespace}_Add`
+  CommandGeneratorResolvers_GraphQL.register(
+    ~fields=[field],
+    ~commandSchema=commandSchema->S.castToUnknown,
+    ~commandAuthorization,
+    ~server,
+  )
+  let generateCommand: ReventlessCore.CommandGenerator.commandGenerator = _payload =>
+    Effect.promise(() => {
+      failWith()
+      Promise.resolve(ReventlessCore.CommandTopic.Accepted({msgId: "unreachable", eventCount: 0}))
+    })
+  CommandGeneratorResolvers_GraphQL.bindHandler(~field, ~generateCommand)
+  switch server.getMutationResolver(field) {
+  | Some(r) => r
+  | None => JsError.throwWithMessage("resolver not registered: " ++ field)
+  }
+}
+
+let invoke = async resolver =>
+  switch await resolver(
+    JSON.Encode.null,
+    JSON.Encode.object(Dict.fromArray([("name", JSON.Encode.string("Books"))])),
+    ctxFor(adminIdentity),
+  ) {
+  | _ => None
+  | exception e => e->JsExn.fromException
+  }
+
+describe("CommandGeneratorResolvers_GraphQL — a failure the caller may read", () => {
+  beforeEach(() => {
+    DomainGraphQL_Server.asInterface.reset()
+  })
+
+  testPromise("a caller-fault failure is rethrown as an unmasked GraphQL error", async () => {
+    let resolver = failingFixture(~namespace="Fault1", ~failWith=() =>
+      ReventlessCore.Plugin_ResolverError.throwCallerFault(
+        `Error: Couldn't decode: Expected string | undefined, received null`,
+      )
+    )
+    let caught = await invoke(resolver)
+    expect((
+      caught->Option.flatMap(JsExn.name),
+      caught->Option.flatMap(errorExtensions)->Option.map(e => e["code"]),
+    ))->toEqual((Some("GraphQLError"), Some("BAD_USER_INPUT")))
+  })
+
+  // The reason is the point: masked, the caller learns only that something
+  // went wrong on a request that is theirs to fix.
+  testPromise("and carries the reason it was given", async () => {
+    let resolver = failingFixture(~namespace="Fault2", ~failWith=() =>
+      ReventlessCore.Plugin_ResolverError.throwCallerFault(
+        "Expected string | undefined, received null",
+      )
+    )
+    let caught = await invoke(resolver)
+    expect(
+      caught
+      ->Option.flatMap(JsExn.message)
+      ->Option.mapOr(false, m => m->String.includes("received null")),
+    )->toBe(true)
+  })
+
+  // The control, and the reason the mark exists: an internal failure is not the
+  // caller's business and must keep being masked.
+  testPromise("an unmarked failure is left to be masked", async () => {
+    let resolver = failingFixture(~namespace="Fault3", ~failWith=() =>
+      JsError.throwWithMessage("connection to the event store was reset")
+    )
+    let caught = await invoke(resolver)
+    expect(caught->Option.flatMap(JsExn.name))->not_->toEqual(Some("GraphQLError"))
+  })
+})

package/tests/adapter/CommandAuthorizationTest.res.mjs

@@ -2,11 +2,14 @@
 
 import * as S from "sury/src/S.res.mjs";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as TestRunner$ReventlessLocal from "../../src/test/TestRunner.res.mjs";
+import * as Plugin_ResolverError$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_ResolverError.res.mjs";
 import * as DomainGraphQL_Server$ReventlessLocal from "../../src/adapter/DomainGraphQL_Server.res.mjs";
 import * as CommandGeneratorResolvers_GraphQL$ReventlessLocal from "../../src/adapter/CommandGenerator/CommandGeneratorResolvers_GraphQL.res.mjs";
 
@@ -176,6 +179,63 @@ globalThis.describe("CommandGeneratorResolvers_GraphQL — per-constructor autho
   });
 });
 
+function failingFixture(namespace, failWith) {
+  let field = namespace + `_Add`;
+  CommandGeneratorResolvers_GraphQL$ReventlessLocal.register([field], commandSchema, commandAuthorization, DomainGraphQL_Server$ReventlessLocal.asInterface);
+  let generateCommand = _payload => Effect.promise(() => {
+    failWith();
+    return Promise.resolve({
+      TAG: "Accepted",
+      msgId: "unreachable",
+      eventCount: 0
+    });
+  });
+  CommandGeneratorResolvers_GraphQL$ReventlessLocal.bindHandler(field, generateCommand);
+  let r = DomainGraphQL_Server$ReventlessLocal.asInterface.getMutationResolver(field);
+  if (r !== undefined) {
+    return r;
+  } else {
+    return Stdlib_JsError.throwWithMessage("resolver not registered: " + field);
+  }
+}
+
+async function invoke(resolver) {
+  try {
+    await resolver(null, Object.fromEntries([[
+        "name",
+        "Books"
+      ]]), ctxFor(adminIdentity));
+    return;
+  } catch (raw_e) {
+    return Stdlib_JsExn.fromException(Primitive_exceptions.internalToException(raw_e));
+  }
+}
+
+globalThis.describe("CommandGeneratorResolvers_GraphQL — a failure the caller may read", () => {
+  globalThis.beforeEach(() => DomainGraphQL_Server$ReventlessLocal.asInterface.reset());
+  globalThis.test("a caller-fault failure is rethrown as an unmasked GraphQL error", async () => {
+    let resolver = failingFixture("Fault1", () => Plugin_ResolverError$ReventlessCore.throwCallerFault(`Error: Couldn't decode: Expected string | undefined, received null`));
+    let caught = await invoke(resolver);
+    globalThis.expect([
+      Stdlib_Option.flatMap(caught, Stdlib_JsExn.name),
+      Stdlib_Option.map(Stdlib_Option.flatMap(caught, prim => prim.extensions), e => e.code)
+    ]).toEqual([
+      "GraphQLError",
+      "BAD_USER_INPUT"
+    ]);
+  });
+  globalThis.test("and carries the reason it was given", async () => {
+    let resolver = failingFixture("Fault2", () => Plugin_ResolverError$ReventlessCore.throwCallerFault("Expected string | undefined, received null"));
+    let caught = await invoke(resolver);
+    globalThis.expect(Stdlib_Option.mapOr(Stdlib_Option.flatMap(caught, Stdlib_JsExn.message), false, m => m.includes("received null"))).toBe(true);
+  });
+  globalThis.test("an unmarked failure is left to be masked", async () => {
+    let resolver = failingFixture("Fault3", () => Stdlib_JsError.throwWithMessage("connection to the event store was reset"));
+    let caught = await invoke(resolver);
+    globalThis.expect(Stdlib_Option.flatMap(caught, Stdlib_JsExn.name)).not.toEqual("GraphQLError");
+  });
+});
+
 export {
   commandSchema,
   commandAuthorization,
@@ -186,5 +246,7 @@ export {
   getTypename,
   getErrorCode,
   buildFixture,
+  failingFixture,
+  invoke,
 }
 /*  Not a pure module */

package/tests/adapter/LocalAuthLoginTest.res

@@ -178,3 +178,217 @@ testPromise("setCredentials mirrors identity into the X-User registry", async ()
   | _ => JsError.throwWithMessage("expected Authenticated(alice) via X-User")
   }
 })
+
+// ── Acting as one of the roles you hold ───────────────────────────────────
+//
+// The subset rule is the security-critical line of the feature: narrowing only,
+// never widening, so a client that tampers with the request can only ever reduce
+// its own privilege. The table below is the same one the Cognito minting path
+// has to satisfy — the two implementations cannot be shared across a process
+// boundary, so the cases are what keeps them from drifting.
+
+let multiRole: Reventless.Identity.t = {
+  userId: "u-carol",
+  username: "carol",
+  groups: ["Fulfilment", "Shopper"],
+  provider: InMemory,
+}
+
+let decodeOrThrow = token =>
+  switch LocalAuth.Login.verifyAndDecode(token) {
+  | Some(i) => i
+  | None => JsError.throwWithMessage("expected a verifiable token")
+  }
+
+let carolLoggedIn = () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="carol", ~password="carol-pw", ~identity=multiRole)
+}
+
+// The regression line. Every login that existed before this feature takes this
+// path, and it has to mint what it always minted.
+testPromise("a login naming no role mints exactly what it minted before", async () => {
+  carolLoggedIn()
+  let plain = switch await LocalAuth.Login.issue(~username="carol", ~password="carol-pw") {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  let identity = decodeOrThrow(plain)
+  expect(identity.groups)->toEqual(["Fulfilment", "Shopper"])
+  expect(identity.claims)->toEqual(None)
+})
+
+testPromise("a login naming a held role mints that role alone", async () => {
+  carolLoggedIn()
+  let token = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  let identity = decodeOrThrow(token)
+  // `groups` is what every enforcement point reads, so this is the assertion
+  // that the narrowing is real rather than cosmetic.
+  expect(identity.groups)->toEqual(["Shopper"])
+})
+
+testPromise("a narrowed token remembers the choice and what it gave up", async () => {
+  carolLoggedIn()
+  let token = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  let identity = decodeOrThrow(token)
+  expect((
+    identity->Reventless.Identity.getClaim("activeRole"),
+    identity->Reventless.Identity.getClaim("availableRoles"),
+  ))->toEqual((Some("Shopper"), Some("Fulfilment,Shopper")))
+})
+
+// The line that decides whether this is a security feature or a suggestion.
+// Refused, specifically — not ignored and minted at full membership, which is
+// the failure that would hand a tampering client everything it asked for.
+testPromise("a login naming a role the user does not hold is REFUSED", async () => {
+  carolLoggedIn()
+  switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Admin",
+  ) {
+  | Ok(_) => JsError.throwWithMessage("expected a request to widen to be refused")
+  | Error(msg) => expect(msg->String.includes("Admin"))->toEqual(true)
+  }
+})
+
+// Narrowing to a role you hold while *also* naming one you do not is the same
+// widening attempt wearing a disguise; there is no partial credit.
+testPromise("narrowing cannot smuggle a group in through the claims bag", async () => {
+  resetAll()
+  let withClaims: Reventless.Identity.t = {
+    ...multiRole,
+    claims: Dict.fromArray([("availableRoles", "Admin,Fulfilment,Shopper")]),
+  }
+  LocalAuth.Login.setCredentials(~username="carol", ~password="carol-pw", ~identity=withClaims)
+  switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Admin",
+  ) {
+  | Ok(_) =>
+    JsError.throwWithMessage("expected membership to be judged by groups, not by a claim")
+  | Error(_) => expect(true)->toEqual(true)
+  }
+})
+
+// A narrowed token has to survive the same round trip an ordinary one does, or
+// the narrowing would hold only until the next request.
+testPromise("a narrowed token authenticates as the narrowed identity", async () => {
+  carolLoggedIn()
+  let token = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  let result = await LocalAuth.authenticate(
+    buildContext([("authorization", "Bearer " ++ token)]),
+  )
+  switch result {
+  | Authenticated(identity) => expect(identity.groups)->toEqual(["Shopper"])
+  | _ => JsError.throwWithMessage("expected the narrowed token to authenticate")
+  }
+})
+
+// The login response echoes this, and it has to describe the token it ships
+// beside rather than the account behind it.
+testPromise("the minted identity matches the token, not the stored user", async () => {
+  carolLoggedIn()
+  let minted = LocalAuth.Login.mintedIdentity(~username="carol", ~activeRole=Some("Shopper"))
+  let stored = LocalAuth.lookupUser("carol")
+  expect((
+    minted->Option.mapOr([], i => i.groups),
+    stored->Option.mapOr([], i => i.groups),
+  ))->toEqual((["Shopper"], ["Fulfilment", "Shopper"]))
+})
+
+// ── Switching an existing session ─────────────────────────────────────────
+//
+// A switch is not a re-authentication: the client holds a token, not a
+// password. Possession of a token this server signed is proof of the
+// credentials that produced it, so the switch re-mints from the token — and
+// re-reads membership from the store, never from the token's own record of it.
+
+testPromise("a session can be re-minted as one of its roles", async () => {
+  carolLoggedIn()
+  let wide = switch await LocalAuth.Login.issue(~username="carol", ~password="carol-pw") {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  switch LocalAuth.Login.reissue(~token=wide, ~activeRole=Some("Shopper")) {
+  | Ok(t) => expect(decodeOrThrow(t).groups)->toEqual(["Shopper"])
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+})
+
+// Switching back is the other half of a switcher, and it is not an escalation:
+// the set being widened to is the one the store says the caller holds.
+testPromise("a narrowed session can widen back to its full membership", async () => {
+  carolLoggedIn()
+  let narrow = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  switch LocalAuth.Login.reissue(~token=narrow, ~activeRole=None) {
+  | Ok(t) =>
+    let identity = decodeOrThrow(t)
+    expect((identity.groups, identity.claims))->toEqual((["Fulfilment", "Shopper"], None))
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+})
+
+// 🚨 The assertion that keeps `availableRoles` from becoming an authority. A
+// narrowed token carries the record of what it gave up; if the switch trusted
+// that record instead of the store, a token forged with a wider claim — or a
+// role revoked since issuance — would widen right back into it.
+testPromise("switching judges membership from the store, not the token's claim", async () => {
+  carolLoggedIn()
+  let narrow = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  // The store loses the role while the token still remembers it.
+  LocalAuth.Login.setCredentials(
+    ~username="carol",
+    ~password="carol-pw",
+    ~identity={...multiRole, groups: ["Shopper"]},
+  )
+  switch LocalAuth.Login.reissue(~token=narrow, ~activeRole=Some("Fulfilment")) {
+  | Ok(_) =>
+    JsError.throwWithMessage("expected a revoked role to be unreachable via the token's claim")
+  | Error(_) => expect(true)->toEqual(true)
+  }
+})
+
+testPromise("switching refuses a token this server did not sign", async () => {
+  carolLoggedIn()
+  switch LocalAuth.Login.reissue(~token="not.a-real-token", ~activeRole=Some("Shopper")) {
+  | Ok(_) => JsError.throwWithMessage("expected an unverifiable token to be refused")
+  | Error(msg) => expect(msg)->toEqual("Invalid token")
+  }
+})

package/tests/adapter/LocalAuthLoginTest.res.mjs

@@ -1,6 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
 
 let alice_groups = ["Editor"];
@@ -36,7 +38,7 @@ function resetAll() {
 globalThis.test("issue returns Ok(token) for valid credentials", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   if (result.TAG !== "Ok") {
     return Stdlib_JsError.throwWithMessage("unexpected Error: " + result._0);
   }
@@ -46,7 +48,7 @@ globalThis.test("issue returns Ok(token) for valid credentials", async () => {
 
 globalThis.test("issue returns Error for unknown username", async () => {
   resetAll();
-  let result = await LocalAuth$ReventlessLocal.Login.issue("ghost", "x");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("ghost", "x", undefined);
   if (result.TAG === "Ok") {
     return Stdlib_JsError.throwWithMessage("expected Error");
   }
@@ -55,7 +57,7 @@ globalThis.test("issue returns Error for unknown username", async () => {
 globalThis.test("issue returns Error for wrong password", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "WRONG");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "WRONG", undefined);
   if (result.TAG === "Ok") {
     return Stdlib_JsError.throwWithMessage("expected Error");
   }
@@ -64,7 +66,7 @@ globalThis.test("issue returns Error for wrong password", async () => {
 globalThis.test("verifyAndDecode round-trips the identity for a fresh token", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let identity = LocalAuth$ReventlessLocal.Login.verifyAndDecode(token);
@@ -81,7 +83,7 @@ globalThis.test("verifyAndDecode round-trips the identity for a fresh token", as
 globalThis.test("verifyAndDecode rejects a tampered payload", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let parts = token.split(".");
@@ -100,7 +102,7 @@ globalThis.test("verifyAndDecode rejects a tampered payload", async () => {
 globalThis.test("verifyAndDecode rejects a tampered signature", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("alice", "alice-pw", alice);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let match = LocalAuth$ReventlessLocal.Login.verifyAndDecode(token + "x");
@@ -120,7 +122,7 @@ globalThis.test("verifyAndDecode rejects a malformed token (no dot)", async () =
 globalThis.test("authenticate accepts a valid Bearer token", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("bob", "bob-pw", bob);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
@@ -158,7 +160,7 @@ globalThis.test("authenticate rejects invalid Bearer even when X-User is present
 globalThis.test("Bearer outranks X-User when both present and Bearer is valid", async () => {
   resetAll();
   LocalAuth$ReventlessLocal.Login.setCredentials("bob", "bob-pw", bob);
-  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw");
+  let t = await LocalAuth$ReventlessLocal.Login.issue("bob", "bob-pw", undefined);
   let token;
   token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage("issue failed: " + t._0);
   let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([
@@ -198,10 +200,191 @@ globalThis.test("setCredentials mirrors identity into the X-User registry", asyn
   globalThis.expect(identity.groups).toEqual(["Editor"]);
 });
 
+let multiRole_groups = [
+  "Fulfilment",
+  "Shopper"
+];
+
+let multiRole = {
+  userId: "u-carol",
+  username: "carol",
+  groups: multiRole_groups,
+  provider: "InMemory"
+};
+
+function decodeOrThrow(token) {
+  let i = LocalAuth$ReventlessLocal.Login.verifyAndDecode(token);
+  if (i !== undefined) {
+    return i;
+  } else {
+    return Stdlib_JsError.throwWithMessage("expected a verifiable token");
+  }
+}
+
+function carolLoggedIn() {
+  resetAll();
+  LocalAuth$ReventlessLocal.Login.setCredentials("carol", "carol-pw", multiRole);
+}
+
+globalThis.test("a login naming no role mints exactly what it minted before", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", undefined);
+  let plain;
+  plain = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let identity = decodeOrThrow(plain);
+  globalThis.expect(identity.groups).toEqual([
+    "Fulfilment",
+    "Shopper"
+  ]);
+  globalThis.expect(identity.claims).toEqual(undefined);
+});
+
+globalThis.test("a login naming a held role mints that role alone", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let identity = decodeOrThrow(token);
+  globalThis.expect(identity.groups).toEqual(["Shopper"]);
+});
+
+globalThis.test("a narrowed token remembers the choice and what it gave up", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let identity = decodeOrThrow(token);
+  globalThis.expect([
+    Identity$Reventless.getClaim(identity, "activeRole"),
+    Identity$Reventless.getClaim(identity, "availableRoles")
+  ]).toEqual([
+    "Shopper",
+    "Fulfilment,Shopper"
+  ]);
+});
+
+globalThis.test("a login naming a role the user does not hold is REFUSED", async () => {
+  carolLoggedIn();
+  let msg = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Admin");
+  if (msg.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected a request to widen to be refused");
+  }
+  globalThis.expect(msg._0.includes("Admin")).toEqual(true);
+});
+
+globalThis.test("narrowing cannot smuggle a group in through the claims bag", async () => {
+  resetAll();
+  let newrecord = {...multiRole};
+  newrecord.claims = Object.fromEntries([[
+      "availableRoles",
+      "Admin,Fulfilment,Shopper"
+    ]]);
+  LocalAuth$ReventlessLocal.Login.setCredentials("carol", "carol-pw", newrecord);
+  let match = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Admin");
+  if (match.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected membership to be judged by groups, not by a claim");
+  }
+  globalThis.expect(true).toEqual(true);
+});
+
+globalThis.test("a narrowed token authenticates as the narrowed identity", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let token;
+  token = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let result = await LocalAuth$ReventlessLocal.authenticate(buildContext([[
+      "authorization",
+      "Bearer " + token
+    ]]));
+  if (typeof result !== "object") {
+    return Stdlib_JsError.throwWithMessage("expected the narrowed token to authenticate");
+  }
+  if (result.TAG !== "Authenticated") {
+    return Stdlib_JsError.throwWithMessage("expected the narrowed token to authenticate");
+  }
+  globalThis.expect(result._0.groups).toEqual(["Shopper"]);
+});
+
+globalThis.test("the minted identity matches the token, not the stored user", async () => {
+  carolLoggedIn();
+  let minted = LocalAuth$ReventlessLocal.Login.mintedIdentity("carol", "Shopper");
+  let stored = LocalAuth$ReventlessLocal.lookupUser("carol");
+  globalThis.expect([
+    Stdlib_Option.mapOr(minted, [], i => i.groups),
+    Stdlib_Option.mapOr(stored, [], i => i.groups)
+  ]).toEqual([
+    ["Shopper"],
+    [
+      "Fulfilment",
+      "Shopper"
+    ]
+  ]);
+});
+
+globalThis.test("a session can be re-minted as one of its roles", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", undefined);
+  let wide;
+  wide = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let t$1 = LocalAuth$ReventlessLocal.Login.reissue(wide, "Shopper");
+  if (t$1.TAG !== "Ok") {
+    return Stdlib_JsError.throwWithMessage(t$1._0);
+  }
+  globalThis.expect(decodeOrThrow(t$1._0).groups).toEqual(["Shopper"]);
+});
+
+globalThis.test("a narrowed session can widen back to its full membership", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let narrow;
+  narrow = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let t$1 = LocalAuth$ReventlessLocal.Login.reissue(narrow, undefined);
+  if (t$1.TAG !== "Ok") {
+    return Stdlib_JsError.throwWithMessage(t$1._0);
+  }
+  let identity = decodeOrThrow(t$1._0);
+  globalThis.expect([
+    identity.groups,
+    identity.claims
+  ]).toEqual([
+    [
+      "Fulfilment",
+      "Shopper"
+    ],
+    undefined
+  ]);
+});
+
+globalThis.test("switching judges membership from the store, not the token's claim", async () => {
+  carolLoggedIn();
+  let t = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", "Shopper");
+  let narrow;
+  narrow = t.TAG === "Ok" ? t._0 : Stdlib_JsError.throwWithMessage(t._0);
+  let newrecord = {...multiRole};
+  LocalAuth$ReventlessLocal.Login.setCredentials("carol", "carol-pw", (newrecord.groups = ["Shopper"], newrecord));
+  let match = LocalAuth$ReventlessLocal.Login.reissue(narrow, "Fulfilment");
+  if (match.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected a revoked role to be unreachable via the token's claim");
+  }
+  globalThis.expect(true).toEqual(true);
+});
+
+globalThis.test("switching refuses a token this server did not sign", async () => {
+  carolLoggedIn();
+  let msg = LocalAuth$ReventlessLocal.Login.reissue("not.a-real-token", "Shopper");
+  if (msg.TAG === "Ok") {
+    return Stdlib_JsError.throwWithMessage("expected an unverifiable token to be refused");
+  }
+  globalThis.expect(msg._0).toEqual("Invalid token");
+});
+
 export {
   alice,
   bob,
   buildContext,
   resetAll,
+  multiRole,
+  decodeOrThrow,
+  carolLoggedIn,
 }
 /*  Not a pure module */

package/tests/adapter/LocalAuthUserStoreTest.res.mjs

@@ -81,7 +81,7 @@ globalThis.test("load(~users) registers credentials and returns InlineUsers", as
   } else {
     Stdlib_JsError.throwWithMessage("load failed: " + msg._0);
   }
-  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("alice", "alice-pw", undefined);
   if (result.TAG !== "Ok") {
     Stdlib_JsError.throwWithMessage("issue rejected loaded credentials: " + result._0);
   }
@@ -112,7 +112,7 @@ globalThis.test("load(~usersFile) reads a YAML file from disk", async () => {
   } else {
     Stdlib_JsError.throwWithMessage("load failed: " + msg._0);
   }
-  let result = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw");
+  let result = await LocalAuth$ReventlessLocal.Login.issue("carol", "carol-pw", undefined);
   if (result.TAG !== "Ok") {
     Stdlib_JsError.throwWithMessage("issue rejected file-loaded credentials: " + result._0);
   }