@reventlessdev/reventless-local 3.0.0-alpha.218 → 3.0.0-alpha.220

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.220 (2026-08-13)
+
+### Features
+
+* **aws:** narrow the token to the role a caller chose to act as ([194332f](https://github.com/ReventlessDev/reventless-core/commit/194332fa0af8e13417f72d57904e2ed469747dde))
+
+
+# 3.0.0-alpha.219 (2026-08-13)
+
+**Note:** Version bump only for package @reventlessdev/reventless-local
+
+
+
+
+
 # 3.0.0-alpha.218 (2026-08-13)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.218",
+  "version": "3.0.0-alpha.220",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -36,17 +36,17 @@
     "ws": "^8.18.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.27",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.21",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.5",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.230",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.78",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.177",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.232",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.80",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.179",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.139",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.96",
     "@reventlessdev/reventless-seed": "1.0.0-alpha.12",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.94",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.112",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.138"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.112"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/adapter/Auth/LocalAuth.res

@@ -139,33 +139,18 @@ module Login = {
   }
 
   /**
-   Claim naming the role the caller chose to act as. Present only on a narrowed
-   token, so its presence *is* the answer to "am I acting as one of my roles?".
-
-   Kept apart from `groups` even though a narrowed token's groups are exactly
-   this one role, because the two say different things: `groups` is what every
-   enforcement point evaluates, and this is what the caller asked for. A client
-   reading the choice out of the group array would be depending on the current
-   shape of the narrowing rather than on the choice itself.
+   The claim names a narrowed token carries, shared with the Cognito minting
+   path — a client must not have to know which platform signed its token to read
+   its own active role. See `ReventlessCore.Auth_ActiveRole` for what each means
+   and why `availableRoles` is never an authorization input.
+
+   Both are present only on a narrowed token, which is what keeps an ordinary
+   login byte-identical to what it minted before any of this existed: an
+   unnarrowed token's `groups` already *are* the full membership, so there is
+   nothing to remember.
    */
-  let activeRoleClaim = "activeRole"
-
-  /**
-   Claim naming the roles the caller gave up by narrowing — their full
-   membership, comma-joined as the `X-Groups` header already joins groups.
-
-   🚨 **Never read this for authorization.** It exists so a client can offer the
-   switch back, and it is by definition wider than what the caller is currently
-   permitted. Every enforcement point in the system reads `groups`; this claim is
-   the one piece of an identity that deliberately describes privilege the caller
-   does *not* currently have.
-
-   Present only on a narrowed token, which is also what keeps an ordinary login
-   byte-identical to what it minted before any of this existed: an unnarrowed
-   token's `groups` already *are* the full membership, so there is nothing to
-   remember.
-   */
-  let availableRolesClaim = "availableRoles"
+  let activeRoleClaim = ReventlessCore.Auth_ActiveRole.activeRoleClaim
+  let availableRolesClaim = ReventlessCore.Auth_ActiveRole.availableRolesClaim
 
   /**
    Narrow an identity to one of its own roles.

package/src/adapter/Auth/LocalAuth.res.mjs

@@ -5,6 +5,7 @@ import * as Nodecrypto from "node:crypto";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 
 let defaultUser_groups = ["User"];
 
@@ -118,10 +119,6 @@ function _b64urlDecode(s) {
   }
 }
 
-let activeRoleClaim = "activeRole";
-
-let availableRolesClaim = "availableRoles";
-
 function narrow(identity, activeRole) {
   if (!identity.groups.includes(activeRole)) {
     return {
@@ -131,8 +128,8 @@ function narrow(identity, activeRole) {
   }
   let existing = identity.claims;
   let claims = existing !== undefined ? Object.fromEntries(Object.entries(existing)) : ({});
-  claims[activeRoleClaim] = activeRole;
-  claims[availableRolesClaim] = identity.groups.join(",");
+  claims[Auth_ActiveRole$ReventlessCore.activeRoleClaim] = activeRole;
+  claims[Auth_ActiveRole$ReventlessCore.availableRolesClaim] = identity.groups.join(",");
   let newrecord = {...identity};
   return {
     TAG: "Ok",
@@ -240,8 +237,8 @@ let Login = {
   _sign: _sign,
   _b64urlEncode: _b64urlEncode,
   _b64urlDecode: _b64urlDecode,
-  activeRoleClaim: activeRoleClaim,
-  availableRolesClaim: availableRolesClaim,
+  activeRoleClaim: Auth_ActiveRole$ReventlessCore.activeRoleClaim,
+  availableRolesClaim: Auth_ActiveRole$ReventlessCore.availableRolesClaim,
   narrow: narrow,
   issue: issue,
   mintedIdentity: mintedIdentity,

package/tests/adapter/LocalAuthLoginTest.res

@@ -392,3 +392,47 @@ testPromise("switching refuses a token this server did not sign", async () => {
   | Error(msg) => expect(msg)->toEqual("Invalid token")
   }
 })
+
+// ── The shared conformance table ──────────────────────────────────────────
+//
+// The cases above were written against this path. `ReventlessCore.Auth_ActiveRole`
+// holds them in a form the Cognito path runs too — the two minting
+// implementations cannot share code across a process boundary, so a table both
+// drive is what keeps them from drifting. A case added there fails here until
+// this path satisfies it, which is the point.
+
+describe("the conformance table, minted locally", () => {
+  ReventlessCore.Auth_ActiveRole.conformanceCases->Array.forEach(({
+    label,
+    membership,
+    requested,
+    expected,
+  }) =>
+    testPromise(label, async () => {
+      resetAll()
+      LocalAuth.Login.setCredentials(
+        ~username="conformance",
+        ~password="pw",
+        ~identity={
+          userId: "u-conformance",
+          username: "conformance",
+          groups: membership,
+          provider: InMemory,
+        },
+      )
+      let minted = await LocalAuth.Login.issue(
+        ~username="conformance",
+        ~password="pw",
+        ~activeRole=?requested,
+      )
+      switch (minted, expected) {
+      | (Ok(token), Some(groups)) => expect(decodeOrThrow(token).groups)->toEqual(groups)
+      // `None` means refused — not honoured, not ignored, and not reduced to the
+      // empty set. A token minted here at all would be the vulnerability.
+      | (Ok(_), None) => JsError.throwWithMessage("expected the request to be refused")
+      | (Error(msg), Some(_)) => JsError.throwWithMessage("expected a token, got: " ++ msg)
+      | (Error(_), None) => expect(true)->toEqual(true)
+      }
+    })
+  )
+})

package/tests/adapter/LocalAuthLoginTest.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
+import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 
 let alice_groups = ["Editor"];
 
@@ -378,6 +379,37 @@ globalThis.test("switching refuses a token this server did not sign", async () =
   globalThis.expect(msg._0).toEqual("Invalid token");
 });
 
+globalThis.describe("the conformance table, minted locally", () => {
+  Auth_ActiveRole$ReventlessCore.conformanceCases.forEach(param => {
+    let expected = param.expected;
+    let requested = param.requested;
+    let membership = param.membership;
+    globalThis.test(param.label, async () => {
+      resetAll();
+      LocalAuth$ReventlessLocal.Login.setCredentials("conformance", "pw", {
+        userId: "u-conformance",
+        username: "conformance",
+        groups: membership,
+        provider: "InMemory"
+      });
+      let minted = await LocalAuth$ReventlessLocal.Login.issue("conformance", "pw", requested);
+      if (minted.TAG === "Ok") {
+        if (expected !== undefined) {
+          globalThis.expect(decodeOrThrow(minted._0).groups).toEqual(expected);
+          return;
+        } else {
+          return Stdlib_JsError.throwWithMessage("expected the request to be refused");
+        }
+      } else if (expected !== undefined) {
+        return Stdlib_JsError.throwWithMessage("expected a token, got: " + minted._0);
+      } else {
+        globalThis.expect(true).toEqual(true);
+        return;
+      }
+    });
+  });
+});
+
 export {
   alice,
   bob,