@reventlessdev/reventless-local 3.0.0-alpha.275 → 3.0.0-alpha.277

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.277 (2026-10-01)
+
+### Bug Fixes
+
+* check a plugin's roles against the user pool's groups ([ddb3c42](https://github.com/ReventlessDev/reventless-core/commit/ddb3c422b7226a19800e781abd5f03af18867007))
+
+
+# 3.0.0-alpha.276 (2026-10-01)
+
+* feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))
+
+### BREAKING CHANGES
+
+* AllowGroups and AdminGroup are removed — write AllowRoles over
+the plugin's Roles.t, and use Role.admin / Platform.adminGroup(). Spec module
+types declare `type role`, and their rules are Authorization.rule<role>; a spec
+that writes its own rule declares `type role` (Reventless.Role.name for a rule
+over Authorization.permission). Role.name is a private string: make one from a
+string with Role.make.
+
+
+
 # 3.0.0-alpha.275 (2026-10-01)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.275",
+  "version": "3.0.0-alpha.277",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -34,24 +34,24 @@
     "graphql-yoga": "^5.21.0",
     "sury": "11.0.0",
     "ws": "^8.18.0",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
     "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.29",
-    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
     "@reventlessdev/rescript-node": "2.0.0-alpha.20",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.133",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.232",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.183",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.285",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.149",
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.31",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.155"
+    "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.287",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.234",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.151",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.135",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.157",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.31"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.95"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.96"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/Platform.res

@@ -73,6 +73,24 @@ let decodeUiFragmentRegistryEventEnvelope = (eventJson: JSON.t): option<
 // splitApi=true to serve core and plugin APIs on separate ports,
 // backend=Backend.Sqlite({...}) to opt into file-backed SQLite persistence.
 // Usage: module Platform = Platform.MakeWithConfig({let silent = true; let splitApi = false; let cloner = false; let backend = Backend.Memory})
+/** Which group stands for which role, only where the two differ; every other
+    role maps to the group of its own name. Call before `Make()`: the platform
+    resolves roles while it is built, and a mapping stated later is refused. */
+let roleGroups = Reventless.Role.setGroups
+
+/** The groups of a user pool this deployment did not create, which no accounts
+    manifest names. They count as provided by the check that every role a plugin
+    needs has a group. */
+let providedGroups = Reventless.Role.provideGroups
+
+/** The group a role resolves to — the name this platform writes into its
+    directives, its shell configuration and the elevated groups. For code that
+    grants access by group, so it never spells one itself. */
+let groupOf = Reventless.Role.groupOf
+
+/** `groupOf(Role.admin)`. */
+let adminGroup = Reventless.Role.adminGroup
+
 module MakeWithConfig = (
   Config: {
     let silent: bool
@@ -87,6 +105,11 @@ module MakeWithConfig = (
   // …) are no-ops in-memory. envVars are not propagated here because the
   // local platform has no per-component process boundary.
   let _ = Config.commandHandlerConfig
+
+  // What this platform provides for the roles its plugins need: every account it
+  // can sign in as, built-in and loaded alike, or the file the store will load
+  // when the servers start — after the plugins are built and checked.
+  Reventless.Role.provideGroupsFrom(UserStore.providedGroups)
   // Activate Pulumi mock mode — must happen before any component creation.
   // Idempotent, so safe to call even if TestRunner.setup() was already called.
   let _ = TestRunner.setup()
@@ -1789,7 +1812,7 @@ module MakeWithConfig = (
     // structure manually.
     pluginStructuresStore.contents->Dict.set(
       ReventlessCore.Platform_Admin_Structure.pluginId,
-      ReventlessCore.Platform_Admin_Structure.structure,
+      ReventlessCore.Platform_Admin_Structure.structure(),
     )
 
     let pluginQueryDbName = ReventlessCore.PluginsReadModelSpec.name
@@ -2422,6 +2445,10 @@ module MakeWithConfig = (
         }}`,
     )
 
+    // The role check below reads the accounts as they stand; a user store
+    // loaded from elsewhere after this would leave it compared with the wrong ones.
+    UserStore.pluginChecked := true
+
     // Set the active deploy target so resolveTargetGraphQL/MCP() and QueryDb serverRef/relayRef
     // route registrations to the correct server. Mirrors AWS resolveTargetApi() pattern.
     currentDeployTarget.contents = apiTarget

package/src/Platform.res.mjs

@@ -12,6 +12,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Plugin$Reventless from "@reventlessdev/reventless-spec/src/components/Plugin.res.mjs";
 import * as AnsiStyle$Reventless from "@reventlessdev/reventless-spec/src/AnsiStyle.res.mjs";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
@@ -140,6 +141,7 @@ function decodeUiFragmentRegistryEventEnvelope(eventJson) {
 }
 
 function MakeWithConfig(Config) {
+  Role$Reventless.provideGroupsFrom(UserStore$ReventlessLocal.providedGroups);
   TestRunner$ReventlessLocal.setup();
   let match = Config.backend;
   if (typeof match !== "object") {
@@ -1360,7 +1362,7 @@ function MakeWithConfig(Config) {
       connectPlugin(plugins$1);
       seedPluginStructuresStore(plugins$1);
     }
-    pluginStructuresStore.contents[Platform_Admin_Structure$ReventlessCore.pluginId] = Platform_Admin_Structure$ReventlessCore.structure;
+    pluginStructuresStore.contents[Platform_Admin_Structure$ReventlessCore.pluginId] = Platform_Admin_Structure$ReventlessCore.structure();
     CommandGeneratorResolvers_GraphQL$ReventlessLocal.setPluginStatusGate(field => {
       let parts = field.split("_");
       let pluginPrefix = Stdlib_Option.getOr(parts[0], "");
@@ -1753,6 +1755,7 @@ function MakeWithConfig(Config) {
     let tmp;
     tmp = apiTarget === "Domain" ? "Domain" : "Platform";
     log.info("Platform", undefined, `deployPlugin target=` + tmp);
+    UserStore$ReventlessLocal.pluginChecked.contents = true;
     currentDeployTarget.contents = apiTarget;
     StateViewSliceMaker.QueryDbResolvers.serverRef.contents = resolveTargetGraphQL();
     let tmp$1;
@@ -1905,6 +1908,7 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let backend = Backend$ReventlessLocal.fromEnv();
+  Role$Reventless.provideGroupsFrom(UserStore$ReventlessLocal.providedGroups);
   TestRunner$ReventlessLocal.setup();
   if (typeof backend !== "object") {
     BackendState$ReventlessLocal.setMemory();
@@ -3113,7 +3117,7 @@ function Make($star) {
       connectPlugin(plugins$1);
       seedPluginStructuresStore(plugins$1);
     }
-    pluginStructuresStore.contents[Platform_Admin_Structure$ReventlessCore.pluginId] = Platform_Admin_Structure$ReventlessCore.structure;
+    pluginStructuresStore.contents[Platform_Admin_Structure$ReventlessCore.pluginId] = Platform_Admin_Structure$ReventlessCore.structure();
     CommandGeneratorResolvers_GraphQL$ReventlessLocal.setPluginStatusGate(field => {
       let parts = field.split("_");
       let pluginPrefix = Stdlib_Option.getOr(parts[0], "");
@@ -3497,6 +3501,7 @@ function Make($star) {
     let tmp;
     tmp = apiTarget === "Domain" ? "Domain" : "Platform";
     log.info("Platform", undefined, `deployPlugin target=` + tmp);
+    UserStore$ReventlessLocal.pluginChecked.contents = true;
     currentDeployTarget.contents = apiTarget;
     StateViewSliceMaker.QueryDbResolvers.serverRef.contents = resolveTargetGraphQL();
     let tmp$1;
@@ -3642,6 +3647,14 @@ function Make($star) {
   };
 }
 
+let roleGroups = Role$Reventless.setGroups;
+
+let providedGroups = Role$Reventless.provideGroups;
+
+let groupOf = Role$Reventless.groupOf;
+
+let adminGroup = Role$Reventless.adminGroup;
+
 export {
   log,
   platformGraphQLRef,
@@ -3649,6 +3662,10 @@ export {
   platformMCPRef,
   decodePluginEventEnvelope,
   decodeUiFragmentRegistryEventEnvelope,
+  roleGroups,
+  providedGroups,
+  groupOf,
+  adminGroup,
   MakeWithConfig,
   Make,
 }

package/src/ShellConfig.res

@@ -41,7 +41,12 @@ let manifestUrlOf = (config: ReventlessInfra.Platform.bakedManifest): string =>
 // caller matching no declared group gets and what every existing deployment has.
 let journeyManifestsKey = "journeyManifestUrls"
 
-let computedKeys = ["manifestUrl", journeyManifestsKey, ReventlessCore.Platform_UiSlots.configKey]
+let computedKeys = [
+  "manifestUrl",
+  journeyManifestsKey,
+  ReventlessCore.Platform_UiSlots.configKey,
+  ReventlessCore.Platform_AdminGroup.configKey,
+]
 
 /**
  The overlay this platform puts on top of the shipped `config.json`.
@@ -69,6 +74,8 @@ let overlay = (
     )
   )
 
+  ReventlessCore.Platform_AdminGroup.configEntry()->Option.forEach(((k, v)) => out->Dict.set(k, v))
+
   bakedManifest->Option.forEach(config => {
     out->Dict.set("manifestUrl", JSON.Encode.string(manifestUrlOf(config)))
     // Omitted entirely when nothing is declared, so a single-audience deployment

package/src/ShellConfig.res.mjs

@@ -9,6 +9,7 @@ import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
 import * as HostShellDist$ReventlessLocal from "./HostShellDist.res.mjs";
 import * as Platform_UiSlots$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_UiSlots.res.mjs";
+import * as Platform_AdminGroup$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_AdminGroup.res.mjs";
 import * as Platform_BakedManifest$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_BakedManifest.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
@@ -26,7 +27,8 @@ let journeyManifestsKey = "journeyManifestUrls";
 let computedKeys = [
   "manifestUrl",
   journeyManifestsKey,
-  Platform_UiSlots$ReventlessCore.configKey
+  Platform_UiSlots$ReventlessCore.configKey,
+  Platform_AdminGroup$ReventlessCore.configKey
 ];
 
 function overlay(bakedManifest, uiSlotsFile, shellConfig) {
@@ -34,6 +36,9 @@ function overlay(bakedManifest, uiSlotsFile, shellConfig) {
   Stdlib_Option.forEach(uiSlotsFile, param => {
     out[Platform_UiSlots$ReventlessCore.configKey] = Platform_UiSlots$ReventlessCore.url;
   });
+  Stdlib_Option.forEach(Platform_AdminGroup$ReventlessCore.configEntry(), param => {
+    out[param[0]] = param[1];
+  });
   Stdlib_Option.forEach(bakedManifest, config => {
     out["manifestUrl"] = Platform_BakedManifest$ReventlessCore.urlForKey(config.key);
     let urls = Platform_BakedManifest$ReventlessCore.journeyUrls(config);

package/src/adapter/Auth/LocalAuth.res

@@ -21,19 +21,22 @@ let defaultUser: Identity.t = {
   provider: InMemory,
 }
 
-let adminUser: Identity.t = {
+// A function, not a value: the administrator's group is the one the platform
+// root maps `Role.admin` to, and this module is evaluated before the root runs.
+let adminUser = (): Identity.t => {
   userId: "local-admin",
   username: "admin",
-  groups: [AdminGroup.name, "User"],
+  groups: [Role.adminGroup(), "User"],
   provider: InMemory,
 }
 
 // ── User registry ─────────────────────────────────────────────────────────
 //
 // A `dict<Identity.t>` keyed by `username`. A4 hydrates this from
-// `.reventless/users.yaml`; tests inject via `registerUser`.
+// `.reventless/users.yaml`; tests inject via `registerUser`. The built-in
+// `admin` is answered on lookup, for the reason above, unless one is registered.
 
-let initialUsers = () => Dict.fromArray([("user", defaultUser), ("admin", adminUser)])
+let initialUsers = () => Dict.fromArray([("user", defaultUser)])
 
 let users: ref<dict<Identity.t>> = ref(initialUsers())
 
@@ -42,7 +45,19 @@ let registerUser = (~username: string, ~identity: Identity.t): unit =>
 
 let resetUsers = (): unit => users := initialUsers()
 
-let lookupUser = (username: string): option<Identity.t> => users.contents->Dict.get(username)
+let lookupUser = (username: string): option<Identity.t> =>
+  switch users.contents->Dict.get(username) {
+  | None if username == "admin" => Some(adminUser())
+  | found => found
+  }
+
+/** The groups of every account this adapter can authenticate as, built-in
+    included — what the local platform provides. */
+let knownGroups = (): array<string> =>
+  users.contents
+  ->Dict.valuesToArray
+  ->Array.concat([adminUser()])
+  ->Array.flatMap(identity => identity.groups)
 
 // ── Header parsing ────────────────────────────────────────────────────────
 

package/src/adapter/Auth/LocalAuth.res.mjs

@@ -6,9 +6,9 @@ import * as Nodepath from "node:path";
 import * as Nodecrypto from "node:crypto";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
 import * as Auth_ActiveRole$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_ActiveRole.res.mjs";
 
 let defaultUser_groups = ["User"];
@@ -20,29 +20,23 @@ let defaultUser = {
   provider: "InMemory"
 };
 
-let adminUser_groups = [
-  AdminGroup$Reventless.name,
-  "User"
-];
-
-let adminUser = {
-  userId: "local-admin",
-  username: "admin",
-  groups: adminUser_groups,
-  provider: "InMemory"
-};
+function adminUser() {
+  return {
+    userId: "local-admin",
+    username: "admin",
+    groups: [
+      Role$Reventless.adminGroup(),
+      "User"
+    ],
+    provider: "InMemory"
+  };
+}
 
 function initialUsers() {
-  return Object.fromEntries([
-    [
+  return Object.fromEntries([[
       "user",
       defaultUser
-    ],
-    [
-      "admin",
-      adminUser
-    ]
-  ]);
+    ]]);
 }
 
 let users = {
@@ -58,7 +52,16 @@ function resetUsers() {
 }
 
 function lookupUser(username) {
-  return users.contents[username];
+  let found = users.contents[username];
+  if (found !== undefined || username !== "admin") {
+    return found;
+  } else {
+    return adminUser();
+  }
+}
+
+function knownGroups() {
+  return Object.values(users.contents).concat([adminUser()]).flatMap(identity => identity.groups);
 }
 
 function parseGroups(s) {
@@ -329,7 +332,7 @@ async function authenticate(ctx) {
   let userHeader = ctx.headers["X-User".toLowerCase()];
   let groupsHeader = ctx.headers["X-Groups".toLowerCase()];
   if (userHeader !== undefined) {
-    let identity$1 = users.contents[userHeader];
+    let identity$1 = lookupUser(userHeader);
     if (identity$1 === undefined) {
       return "Anonymous";
     }
@@ -371,6 +374,7 @@ export {
   registerUser,
   resetUsers,
   lookupUser,
+  knownGroups,
   parseGroups,
   getHeader,
   Login,

package/src/adapter/Auth/UserStore.res

@@ -56,12 +56,35 @@ type resolution =
 // auto-discovery before `Platform.startServers`.
 let resolved: ref<bool> = ref(false)
 
-let resetResolution = (): unit => resolved := false
+/** Set once a plugin has been built, and with it the check that every role it
+    needs has a group among these accounts. */
+let pluginChecked: ref<bool> = ref(false)
+
+let resetResolution = (): unit => {
+  resolved := false
+  pluginChecked := false
+}
+
+/**
+The groups the store's accounts will belong to, for the role check, which runs
+before the servers start and load it: the loaded accounts once `load` has run,
+otherwise the default file `autoLoadOnce` will read (or the template `setup`
+makes it from). Never the working directory once another source was loaded.
+*/
+let providedGroups = (): array<string> =>
+  LocalAuth.knownGroups()->Array.concat(resolved.contents ? [] : AccountsManifest.declaredGroups())
 
 let load = (~users: option<array<entry>>=?, ~usersFile: option<string>=?, ()): result<
   resolution,
   string,
 > => {
+  // The default file is what the check already read; any other source arrives
+  // after it, and the check would have compared the plugins with other accounts.
+  if pluginChecked.contents && (users->Option.isSome || usersFile->Option.isSome) {
+    JsError.throwWithMessage(
+      "UserStore.load(~users / ~usersFile) after a plugin was built — the check that every role it needs has a group read other accounts. Call UserStore.load before deploying plugins.",
+    )
+  }
   resolved := true
   switch users {
   | Some(entries) =>

package/src/adapter/Auth/UserStore.res.mjs

@@ -3,6 +3,7 @@
 import * as Nodefs from "node:fs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as LocalAuth$ReventlessLocal from "./LocalAuth.res.mjs";
 import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 
@@ -25,11 +26,23 @@ let resolved = {
   contents: false
 };
 
+let pluginChecked = {
+  contents: false
+};
+
 function resetResolution() {
   resolved.contents = false;
+  pluginChecked.contents = false;
+}
+
+function providedGroups() {
+  return LocalAuth$ReventlessLocal.knownGroups().concat(resolved.contents ? [] : AccountsManifest$Reventless.declaredGroups());
 }
 
 function load(users, usersFile, param) {
+  if (pluginChecked.contents && (Stdlib_Option.isSome(users) || Stdlib_Option.isSome(usersFile))) {
+    Stdlib_JsError.throwWithMessage("UserStore.load(~users / ~usersFile) after a plugin was built — the check that every role it needs has a group read other accounts. Call UserStore.load before deploying plugins.");
+  }
   resolved.contents = true;
   if (users !== undefined) {
     _registerEntries(users);
@@ -84,7 +97,9 @@ export {
   _registerEntries,
   _defaultPath,
   resolved,
+  pluginChecked,
   resetResolution,
+  providedGroups,
   load,
   autoLoadOnce,
 }

package/src/adapter/PlatformGraphQL_Server.res

@@ -41,7 +41,7 @@ let wrapAdmin = (resolvers: dict<ReventlessGraphqlServer.GraphQL_ServerInstance.
   resolvers
   ->Dict.toArray
   ->Array.forEach(((k, v)) =>
-    wrapped->Dict.set(k, Auth_GraphqlContext.requireGroup(~group=Reventless.AdminGroup.name, v))
+    wrapped->Dict.set(k, Auth_GraphqlContext.requireGroup(~group=Reventless.Role.adminGroup(), v))
   )
   wrapped
 }

package/src/adapter/PlatformGraphQL_Server.res.mjs

@@ -1,6 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
-import * as AdminGroup$Reventless from "@reventlessdev/reventless-spec/src/types/AdminGroup.res.mjs";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Auth_GraphqlContext$ReventlessLocal from "./Auth/Auth_GraphqlContext.res.mjs";
 import * as GraphQL_ServerInstance$ReventlessGraphqlServer from "@reventlessdev/reventless-graphql-server/src/GraphQL_ServerInstance.res.mjs";
 
@@ -9,7 +9,7 @@ let instance = GraphQL_ServerInstance$ReventlessGraphqlServer.make("GraphQL:Plat
 function wrapAdmin(resolvers) {
   let wrapped = {};
   Object.entries(resolvers).forEach(param => {
-    wrapped[param[0]] = Auth_GraphqlContext$ReventlessLocal.requireGroup(AdminGroup$Reventless.name, param[1]);
+    wrapped[param[0]] = Auth_GraphqlContext$ReventlessLocal.requireGroup(Role$Reventless.adminGroup(), param[1]);
   });
   return wrapped;
 }

package/tests/ShellConfigTest.res

@@ -268,3 +268,34 @@ describe("ShellConfig.overlay — journeys", () => {
     )->toBe(true)
   )
 })
+
+describe("ShellConfig.overlay — adminGroup", () => {
+  testSync("is absent while the administrator role keeps its own name", () => {
+    Reventless.Role.clearGroups()
+    expect(
+      ShellConfig.overlay(~bakedManifest=None, ~shellConfig=None)->Dict.keysToArray,
+    )->toEqual([])
+  })
+
+  testSync("carries the group a renamed administrator role maps to", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.admin, "shop-admins")])
+    let out = ShellConfig.overlay(~bakedManifest=None, ~shellConfig=None)
+    Reventless.Role.clearGroups()
+    expect(out->str("adminGroup"))->toEqual(Some("shop-admins"))
+  })
+
+  // Computed from the role mapping, so a passthrough cannot point the shell at
+  // another group than the one the server gates on.
+  testSync("a shellConfig naming it is refused", () =>
+    expect(
+      threw(
+        () =>
+          ShellConfig.overlay(
+            ~bakedManifest=None,
+            ~shellConfig=Some(Dict.fromArray([("adminGroup", JSON.Encode.string("x"))])),
+          )->ignore,
+      ),
+    )->toBe(true)
+  )
+})

package/tests/ShellConfigTest.res.mjs

@@ -5,6 +5,7 @@ import * as Nodeos from "node:os";
 import * as Nodepath from "node:path";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as TestRunner$ReventlessLocal from "../src/test/TestRunner.res.mjs";
 import * as ShellConfig$ReventlessLocal from "../src/ShellConfig.res.mjs";
 
@@ -215,6 +216,31 @@ globalThis.describe("ShellConfig.overlay — journeys", () => {
   });
 });
 
+globalThis.describe("ShellConfig.overlay — adminGroup", () => {
+  globalThis.test("is absent while the administrator role keeps its own name", () => {
+    Role$Reventless.clearGroups();
+    globalThis.expect(Object.keys(ShellConfig$ReventlessLocal.overlay(undefined, undefined, undefined))).toEqual([]);
+  });
+  globalThis.test("carries the group a renamed administrator role maps to", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        Role$Reventless.admin,
+        "shop-admins"
+      ]]);
+    let out = ShellConfig$ReventlessLocal.overlay(undefined, undefined, undefined);
+    Role$Reventless.clearGroups();
+    globalThis.expect(str(out, "adminGroup")).toEqual("shop-admins");
+  });
+  globalThis.test("a shellConfig naming it is refused", () => {
+    globalThis.expect(threw(() => {
+      ShellConfig$ReventlessLocal.overlay(undefined, undefined, Object.fromEntries([[
+          "adminGroup",
+          "x"
+        ]]));
+    })).toBe(true);
+  });
+});
+
 export {
   manifest,
   str,

package/tests/adapter/CommandAuthorizationTest.res

@@ -1,7 +1,7 @@
 // Resolver-boundary tests for per-constructor authorization (A3.3 + A3.3b).
 // Mirrors the catalog Category aggregate's command shape: a record-payload
 // constructor `Add({name})` defaulting to AllowAuthenticated, plus a
-// payload-less `Archive` constrained to AllowGroups(["Admin"]).
+// payload-less `Archive` constrained to AllowRoles([Admin]).
 //
 // The PPX emits a `commandAuthorization` switch at compile time (see
 // examples/online-shop-hybrid/catalog/.../Category.res.mjs). This test hand-
@@ -23,11 +23,11 @@ type command =
   | Rename({name: string})
   | Archive
 
-// Matches the shape the PPX emits for `@authorize(AllowGroups(["Admin"]))` on
+// Matches the shape the PPX emits for `@authorize(AllowRoles([Admin]))` on
 // the payload-less `Archive` constructor with a file-level default.
 let commandAuthorization = (cmd: unknown): Reventless.Authorization.permission =>
   if (cmd->Obj.magic: 'a) === "Archive" {
-    AllowGroups(["Admin"])
+    AllowRoles([Reventless.Role.make("Admin")])
   } else {
     AllowAuthenticated
   }
@@ -189,6 +189,30 @@ describe("CommandGeneratorResolvers_GraphQL — per-constructor authorization",
     expect(calls.contents)->toEqual(["Add"])
   })
 
+  // The rule names the role; the resolver checks the group the platform maps it
+  // to, so a deployment that calls its administrators "ops" admits those.
+  testPromise("a renamed role admits its group and refuses the old name", async () => {
+    let (_, _, archiveResolver, calls) = buildFixture(~namespace="Cat8")
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.make("Admin"), "ops")])
+    let asOps = await archiveResolver(
+      JSON.Encode.null,
+      JSON.Encode.object(Dict.make()),
+      ctxFor({...userIdentity, groups: ["ops"]}),
+    )
+    let asAdminGroup = await archiveResolver(
+      JSON.Encode.null,
+      JSON.Encode.object(Dict.make()),
+      ctxFor(adminIdentity),
+    )
+    Reventless.Role.clearGroups()
+    expect((getTypename(asOps), getErrorCode(asAdminGroup)))->toEqual((
+      "CommandAccepted",
+      "Forbidden",
+    ))
+    expect(calls.contents)->toEqual(["Archive"])
+  })
+
   testPromise(
     "payload-less Archive registered as a GraphQL mutation field (no longer filtered)",
     async () => {

package/tests/adapter/CommandAuthorizationTest.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as TestRunner$ReventlessLocal from "../../src/test/TestRunner.res.mjs";
@@ -30,7 +31,7 @@ let commandSchema = Sury.union([
 function commandAuthorization(cmd) {
   if (cmd === "Archive") {
     return {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Admin"]
     };
   } else {
@@ -170,6 +171,27 @@ globalThis.describe("CommandGeneratorResolvers_GraphQL — per-constructor autho
     globalThis.expect(getTypename(response)).toEqual("CommandAccepted");
     globalThis.expect(match[3].contents).toEqual(["Add"]);
   });
+  globalThis.test("a renamed role admits its group and refuses the old name", async () => {
+    let match = buildFixture("Cat8");
+    let archiveResolver = match[2];
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        "Admin",
+        "ops"
+      ]]);
+    let newrecord = {...userIdentity};
+    let asOps = await archiveResolver(null, {}, ctxFor((newrecord.groups = ["ops"], newrecord)));
+    let asAdminGroup = await archiveResolver(null, {}, ctxFor(adminIdentity));
+    Role$Reventless.clearGroups();
+    globalThis.expect([
+      getTypename(asOps),
+      getErrorCode(asAdminGroup)
+    ]).toEqual([
+      "CommandAccepted",
+      "Forbidden"
+    ]);
+    globalThis.expect(match[3].contents).toEqual(["Archive"]);
+  });
   globalThis.test("payload-less Archive registered as a GraphQL mutation field (no longer filtered)", async () => {
     buildFixture("Cat7");
     let sdl = DomainGraphQL_Server$ReventlessLocal.asInterface.buildSdl();

package/tests/adapter/LocalAuthUserStoreTest.res

@@ -160,3 +160,76 @@ testPromise("autoLoadOnce is a no-op after an explicit load", async () => {
   | None => JsError.throwWithMessage("autoLoadOnce wiped explicit registration")
   }
 })
+
+// What the role check counts as provided, before the servers load the store.
+describe("UserStore.providedGroups", () => {
+  // Runs `f` in a directory holding `files` (path relative to it → contents).
+  let inDir = (files: array<(string, string)>, f) => {
+    let dir = NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), "reventless-provided-"]))
+    files->Array.forEach(((file, contents)) => {
+      let path = NodePath.join([dir, file])
+      NodeFs.mkdirSync(NodePath.dirname(path), {recursive: true})
+      NodeFs.writeFileSync(path, contents)
+    })
+    let cwd = NodeProcess.cwd()
+    NodeProcess.chdir(dir)
+    let result = try f() catch {
+    | exn =>
+      NodeProcess.chdir(cwd)
+      throw(exn)
+    }
+    NodeProcess.chdir(cwd)
+    NodeFs.rmSync(dir, {recursive: true, force: true})
+    result
+  }
+  let manifest = group => `- username: m\n  password: m\n  groups: [${group}]\n`
+  let has = (group, groups) => groups->Array.includes(group)
+
+  testSync("counts the default file the servers will load", () => {
+    resetAll()
+    let groups = inDir(
+      [(".reventless/users.yaml", manifest("Merchandiser"))],
+      () => UserStore.providedGroups(),
+    )
+    expect(has("Merchandiser", groups))->toBe(true)
+  })
+
+  testSync("counts the template where setup has not made the file yet", () => {
+    resetAll()
+    let groups = inDir(
+      [("users.example.yaml", manifest("Fulfilment"))],
+      () => UserStore.providedGroups(),
+    )
+    expect(has("Fulfilment", groups))->toBe(true)
+  })
+
+  testSync("once loaded from elsewhere, counts those accounts and not the directory's", () => {
+    resetAll()
+    let _ = UserStore.load(~users=[{username: "i", password: "i", groups: ["Inline"]}], ())
+    let groups = inDir(
+      [(".reventless/users.yaml", manifest("Merchandiser"))],
+      () => UserStore.providedGroups(),
+    )
+    expect((has("Inline", groups), has("Merchandiser", groups)))->toEqual((true, false))
+  })
+
+  testSync("loading other accounts after a plugin was checked is refused", () => {
+    resetAll()
+    UserStore.pluginChecked := true
+    let refused = switch UserStore.load(
+      ~users=[{username: "late", password: "l", groups: ["Late"]}],
+      (),
+    ) {
+    | _ => false
+    | exception JsExn(_) => true
+    }
+    expect(refused)->toBe(true)
+  })
+
+  testSync("the default load after a plugin was checked is the one the check read", () => {
+    resetAll()
+    UserStore.pluginChecked := true
+    let loaded = inDir([], () => UserStore.load()->Result.isOk)
+    expect(loaded)->toBe(true)
+  })
+})

package/tests/adapter/LocalAuthUserStoreTest.res.mjs

@@ -3,7 +3,9 @@
 import * as Nodefs from "node:fs";
 import * as Nodeos from "node:os";
 import * as Nodepath from "node:path";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
 import * as UserStore$ReventlessLocal from "../../src/adapter/Auth/UserStore.res.mjs";
 
@@ -201,6 +203,96 @@ globalThis.test("autoLoadOnce is a no-op after an explicit load", async () => {
   }
 });
 
+globalThis.describe("UserStore.providedGroups", () => {
+  let inDir = (files, f) => {
+    let dir = Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), "reventless-provided-"));
+    files.forEach(param => {
+      let path = Nodepath.join(dir, param[0]);
+      Nodefs.mkdirSync(Nodepath.dirname(path), {
+        recursive: true
+      });
+      Nodefs.writeFileSync(path, param[1], "utf8");
+    });
+    let cwd = process.cwd();
+    process.chdir(dir);
+    let result;
+    try {
+      result = f();
+    } catch (exn) {
+      process.chdir(cwd);
+      throw exn;
+    }
+    process.chdir(cwd);
+    Nodefs.rmSync(dir, {
+      recursive: true,
+      force: true
+    });
+    return result;
+  };
+  globalThis.test("counts the default file the servers will load", () => {
+    resetAll();
+    let groups = inDir([[
+        ".reventless/users.yaml",
+        `- username: m\n  password: m\n  groups: [` + "Merchandiser" + `]\n`
+      ]], () => UserStore$ReventlessLocal.providedGroups());
+    globalThis.expect(groups.includes("Merchandiser")).toBe(true);
+  });
+  globalThis.test("counts the template where setup has not made the file yet", () => {
+    resetAll();
+    let groups = inDir([[
+        "users.example.yaml",
+        `- username: m\n  password: m\n  groups: [` + "Fulfilment" + `]\n`
+      ]], () => UserStore$ReventlessLocal.providedGroups());
+    globalThis.expect(groups.includes("Fulfilment")).toBe(true);
+  });
+  globalThis.test("once loaded from elsewhere, counts those accounts and not the directory's", () => {
+    resetAll();
+    UserStore$ReventlessLocal.load([{
+        username: "i",
+        password: "i",
+        groups: ["Inline"]
+      }], undefined, undefined);
+    let groups = inDir([[
+        ".reventless/users.yaml",
+        `- username: m\n  password: m\n  groups: [` + "Merchandiser" + `]\n`
+      ]], () => UserStore$ReventlessLocal.providedGroups());
+    globalThis.expect([
+      groups.includes("Inline"),
+      groups.includes("Merchandiser")
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+  globalThis.test("loading other accounts after a plugin was checked is refused", () => {
+    resetAll();
+    UserStore$ReventlessLocal.pluginChecked.contents = true;
+    let refused;
+    try {
+      UserStore$ReventlessLocal.load([{
+          username: "late",
+          password: "l",
+          groups: ["Late"]
+        }], undefined, undefined);
+      refused = false;
+    } catch (raw_exn) {
+      let exn = Primitive_exceptions.internalToException(raw_exn);
+      if (exn.RE_EXN_ID === "JsExn") {
+        refused = true;
+      } else {
+        throw exn;
+      }
+    }
+    globalThis.expect(refused).toBe(true);
+  });
+  globalThis.test("the default load after a plugin was checked is the one the check read", () => {
+    resetAll();
+    UserStore$ReventlessLocal.pluginChecked.contents = true;
+    let loaded = inDir([], () => Stdlib_Result.isOk(UserStore$ReventlessLocal.load(undefined, undefined, undefined)));
+    globalThis.expect(loaded).toBe(true);
+  });
+});
+
 export {
   resetAll,
   _writeYamlFile,

package/tests/adapter/QueryDbListResolverTest.res

@@ -145,7 +145,8 @@ let buildFixture = async (~name: string, ~indexes: array<Reventless.ReadModel.in
     type state = rowState
     let config = Reventless.ReadModel.config()
     let subIdConfig = None
-    let authorization: Reventless.Authorization.permission = AllowAuthenticated
+    type role = Reventless.Role.name
+    let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
     let visibility: Reventless.Visibility.t = Public
   }
 
@@ -646,7 +647,8 @@ let buildSubIdFixture = async (~name: string) => {
       Reventless.ReadModel.subIdField: "lineNo",
       getSubId: (state: lineState) => state.lineNo,
     })
-    let authorization: Reventless.Authorization.permission = AllowAuthenticated
+    type role = Reventless.Role.name
+    let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
     let visibility: Reventless.Visibility.t = Public
   }
 

package/tests/adapter/QueryDbResolvedFieldsTest.res

@@ -96,7 +96,8 @@ let buildFixture = async (
     type state = productRow
     let config = Reventless.ReadModel.config()
     let subIdConfig = None
-    let authorization: Reventless.Authorization.permission = AllowAuthenticated
+    type role = Reventless.Role.name
+    let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
     let visibility: Reventless.Visibility.t = Public
   }
 
@@ -125,7 +126,8 @@ let buildFixture = async (
       ],
     )
     let subIdConfig = None
-    let authorization: Reventless.Authorization.permission = AllowAuthenticated
+    type role = Reventless.Role.name
+    let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
     let visibility: Reventless.Visibility.t = Public
   }
 

package/tests/components/inboundtranslationslice/InboundTranslationSliceCallbackTest.res

@@ -222,7 +222,9 @@ describe("InboundTranslationSlice Callback", () => {
             ),
           )
 
-          let commandAuthorization = (_: command): Reventless.Authorization.permission =>
+          type role = Reventless.Role.name
+
+          let commandAuthorization = (_: command): Reventless.Authorization.rule<role> =>
             AllowAuthenticated
           type lifecycleState = unit
           let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> =>
@@ -289,7 +291,9 @@ describe("InboundTranslationSlice Callback", () => {
 
           let translate = (_input: externalInput) => Ok([])
 
-          let commandAuthorization = (_: command): Reventless.Authorization.permission =>
+          type role = Reventless.Role.name
+
+          let commandAuthorization = (_: command): Reventless.Authorization.rule<role> =>
             AllowAuthenticated
           type lifecycleState = unit
           let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> =>

package/tests/plugin/PluginBehavior_GWT.res.mjs

@@ -9,13 +9,15 @@ let PluginTest = Behavior_GWT$ReventlessGwt.MakeFromAggregate({
   name: PluginSpec$ReventlessCore.name,
   commandSchema: PluginSpec$ReventlessCore.commandSchema,
   eventSchema: PluginSpec$ReventlessCore.eventSchema,
-  errorSchema: PluginSpec$ReventlessCore.errorSchema
+  errorSchema: PluginSpec$ReventlessCore.errorSchema,
+  commandAuthorization: PluginSpec$ReventlessCore.commandAuthorization
 })({
   Spec: {
     name: PluginSpec$ReventlessCore.name,
     commandSchema: PluginSpec$ReventlessCore.commandSchema,
     eventSchema: PluginSpec$ReventlessCore.eventSchema,
-    errorSchema: PluginSpec$ReventlessCore.errorSchema
+    errorSchema: PluginSpec$ReventlessCore.errorSchema,
+    commandAuthorization: PluginSpec$ReventlessCore.commandAuthorization
   },
   initialState: PluginBehavior$ReventlessCore.initialState,
   evolve: PluginBehavior$ReventlessCore.evolve,

package/tests/plugin/UiFragmentRegistry_GWT.res.mjs

@@ -10,7 +10,8 @@ let Test = Behavior_GWT$ReventlessGwt.Make({
   consumedEventSchema: UiFragmentRegistry$ReventlessCore.consumedEventSchema,
   commandSchema: UiFragmentRegistry$ReventlessCore.commandSchema,
   errorSchema: UiFragmentRegistry$ReventlessCore.errorSchema,
-  eventSchema: UiFragmentRegistry$ReventlessCore.eventSchema
+  eventSchema: UiFragmentRegistry$ReventlessCore.eventSchema,
+  commandAuthorization: UiFragmentRegistry$ReventlessCore.commandAuthorization
 })({
   initialState: undefined,
   evolve: UiFragmentRegistry_Behavior$ReventlessCore.evolve,