@reventlessdev/reventless-local 3.0.0-alpha.221 → 3.0.0-alpha.222

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.222 (2026-08-14)
+
+### Features
+
+* **core:** one contract for which refusal a platform gave ([7705c13](https://github.com/ReventlessDev/reventless-core/commit/7705c13ec63f41a3a659bc98cfb45b880fd5b222))
+
+
 # 3.0.0-alpha.221 (2026-08-14)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.221",
+  "version": "3.0.0-alpha.222",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -35,17 +35,17 @@
     "sury": "11.0.0-alpha.4",
     "ws": "^8.18.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.21",
-    "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.27",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.21",
     "@reventlessdev/rescript-node": "2.0.0-alpha.6",
+    "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.27",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.233",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.81",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.180",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.97",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.234",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.82",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.181",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.141",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.98",
     "@reventlessdev/reventless-seed": "1.0.0-alpha.13",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.140",
     "@reventlessdev/reventless-spec": "3.0.0-alpha.113"
   },
   "devDependencies": {

package/src/Platform.res

@@ -2251,7 +2251,7 @@ module MakeWithConfig = (
     // extracts identity from the bearer token, same as the Domain server.
     // Without this, Platform_* queries / mutations run as `anonymous` and
     // skip the group authorization that AppSync would enforce via
-    // `@aws_auth(cognito_groups: ["Admin"])` in production. The Domain
+    // `@aws_cognito_user_pools(cognito_groups: ["Admin"])` in production. The Domain
     // server's `asInterface.start` accepts but ignores `~contextFactory`
     // because it always wires its own internal auth context.
     adminGraphQL.start(

package/src/adapter/Auth/Auth_GraphqlContext.res

@@ -7,8 +7,8 @@
 //   - Invalid bearer is rejected at HTTP level before this runs (see
 //     `DomainGraphQL_Server._dispatch`); on the admin server there is no
 //     dispatch layer, so an invalid bearer reaches this as an `AuthError`.
-//     AppSync enforces the same `@aws_auth(cognito_groups: ["Admin"])`
-//     directive at the schema layer in production.
+//     AppSync enforces the same `@aws_cognito_user_pools(cognito_groups:
+//     ["Admin"])` directive at the schema layer in production.
 //
 // The outcome is carried onto the context beside the identity, not folded into
 // it. Whether credentials verified and whether the verified caller holds a group
@@ -97,8 +97,9 @@ let extractAuthenticated = (ctx: JSON.t): bool =>
   }
 
 // An unauthorized caller reads the reason: `GraphQL_CallerError` explains why a
-// resolver has to construct the error rather than throw a bare one. Mirrors the
-// directive-level `@aws_auth` rejection that AppSync surfaces in production.
+// resolver has to construct the error rather than throw a bare one. The AWS
+// counterpart is the field-level refusal AppSync returns for a caller who fails
+// an `@aws_cognito_user_pools(cognito_groups: [...])` gate.
 let makeGraphqlError = GraphQL_CallerError.make
 
 /**
@@ -112,7 +113,7 @@ let makeGraphqlError = GraphQL_CallerError.make
 let unauthorizedError = (~group: string): exn =>
   makeGraphqlError(
     `Unauthorized: requires group "${group}"`,
-    {"extensions": {"code": "UNAUTHORIZED"}},
+    {"extensions": {"code": ReventlessCore.Auth_RefusalVocabulary.localIdentityCode}},
   )
 
 /**
@@ -128,13 +129,15 @@ let unauthorizedError = (~group: string): exn =>
 let forbiddenError = (~group: string): exn =>
   makeGraphqlError(
     `Forbidden: requires group "${group}"`,
-    {"extensions": {"code": "FORBIDDEN"}},
+    {"extensions": {"code": ReventlessCore.Auth_RefusalVocabulary.localEntitlementCode}},
   )
 
 // Wrap a resolver so it refuses a caller whose identity lacks the required
-// group. Mirrors AppSync's `@aws_auth(cognito_groups: [...])` semantics for
-// admin fields on the in-memory adapter, save that AppSync has one rejection to
-// give and this has two. Use for fields whose corresponding read-model entry
+// group. Mirrors AppSync's `@aws_cognito_user_pools(cognito_groups: [...])`
+// semantics for admin fields on the in-memory adapter. Both paths draw the same
+// two-way distinction — AppSync as HTTP 401 versus a field error, this as two
+// `extensions.code` values — and `ReventlessCore.Auth_RefusalVocabulary` is the
+// mapping between them. Use for fields whose corresponding read-model entry
 // carries `authorization: Some({group, ...})` — pass the group string here.
 let requireGroup = (~group: string, resolver: YG.resolverFn): YG.resolverFn =>
   async (root, args, ctx) => {

package/src/adapter/Auth/Auth_GraphqlContext.res.mjs

@@ -3,6 +3,7 @@
 import * as Graphql from "graphql";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as LocalAuth$ReventlessLocal from "./LocalAuth.res.mjs";
+import * as Auth_RefusalVocabulary$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_RefusalVocabulary.res.mjs";
 
 function extractHeaders(headers) {
   let acc = {};
@@ -74,7 +75,7 @@ function makeGraphqlError(prim0, prim1) {
 function unauthorizedError(group) {
   return new Graphql.GraphQLError(`Unauthorized: requires group "` + group + `"`, {
     extensions: {
-      code: "UNAUTHORIZED"
+      code: Auth_RefusalVocabulary$ReventlessCore.localIdentityCode
     }
   });
 }
@@ -82,7 +83,7 @@ function unauthorizedError(group) {
 function forbiddenError(group) {
   return new Graphql.GraphQLError(`Forbidden: requires group "` + group + `"`, {
     extensions: {
-      code: "FORBIDDEN"
+      code: Auth_RefusalVocabulary$ReventlessCore.localEntitlementCode
     }
   });
 }

package/src/adapter/PlatformGraphQL_Server.res

@@ -11,8 +11,8 @@
 // Authorization: every query AND mutation resolver registered here is
 // wrapped with `Auth_GraphqlContext.requireGroup(~group="Admin")` so
 // non-Admin identities are refused before the underlying resolver runs.
-// Mirrors AppSync's `@aws_auth(cognito_groups: ["Admin"])` directive that
-// gates Platform_* fields in the AWS adapter.
+// Mirrors AppSync's `@aws_cognito_user_pools(cognito_groups: ["Admin"])`
+// directive that gates Platform_* fields in the AWS adapter.
 //
 // The refusal names which kind it is: `FORBIDDEN` for a caller the server
 // identified who does not hold the group, `UNAUTHORIZED` for one it could not