@reventlessdev/reventless-local 3.0.0-alpha.276 → 3.0.0-alpha.277

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.277 (2026-10-01)
+
+### Bug Fixes
+
+* check a plugin's roles against the user pool's groups ([ddb3c42](https://github.com/ReventlessDev/reventless-core/commit/ddb3c422b7226a19800e781abd5f03af18867007))
+
+
 # 3.0.0-alpha.276 (2026-10-01)
 
 * feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.276",
+  "version": "3.0.0-alpha.277",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -34,19 +34,19 @@
     "graphql-yoga": "^5.21.0",
     "sury": "11.0.0",
     "ws": "^8.18.0",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
     "@reventlessdev/rescript-graphql-yoga": "1.0.0-alpha.29",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
     "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.233",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.286",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.134",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.184",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.156",
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.31",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.150"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.287",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.234",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.151",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.135",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.157",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.31"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Platform.res

@@ -107,12 +107,9 @@ module MakeWithConfig = (
   let _ = Config.commandHandlerConfig
 
   // What this platform provides for the roles its plugins need: every account it
-  // can sign in as, built-in and manifest alike. The manifest is read here rather
-  // than from the user store, which loads only when the servers start — after
-  // the plugins are built and checked.
-  Reventless.Role.provideGroupsFrom(() =>
-    LocalAuth.knownGroups()->Array.concat(Reventless.AccountsManifest.declaredGroups())
-  )
+  // can sign in as, built-in and loaded alike, or the file the store will load
+  // when the servers start — after the plugins are built and checked.
+  Reventless.Role.provideGroupsFrom(UserStore.providedGroups)
   // Activate Pulumi mock mode — must happen before any component creation.
   // Idempotent, so safe to call even if TestRunner.setup() was already called.
   let _ = TestRunner.setup()
@@ -2448,6 +2445,10 @@ module MakeWithConfig = (
         }}`,
     )
 
+    // The role check below reads the accounts as they stand; a user store
+    // loaded from elsewhere after this would leave it compared with the wrong ones.
+    UserStore.pluginChecked := true
+
     // Set the active deploy target so resolveTargetGraphQL/MCP() and QueryDb serverRef/relayRef
     // route registrations to the correct server. Mirrors AWS resolveTargetApi() pattern.
     currentDeployTarget.contents = apiTarget

package/src/Platform.res.mjs

@@ -26,12 +26,10 @@ import * as UiSlots$ReventlessLocal from "./UiSlots.res.mjs";
 import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/components/Component.res.mjs";
 import * as LocalBus$ReventlessLocal from "./adapter/LocalBus.res.mjs";
 import * as Api_Naming$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/Api_Naming.res.mjs";
-import * as LocalAuth$ReventlessLocal from "./adapter/Auth/LocalAuth.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
 import * as UserStore$ReventlessLocal from "./adapter/Auth/UserStore.res.mjs";
 import * as TestRunner$ReventlessLocal from "./test/TestRunner.res.mjs";
 import * as UiFragments$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateView/UiFragments.res.mjs";
-import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
 import * as ShellConfig$ReventlessLocal from "./ShellConfig.res.mjs";
@@ -143,7 +141,7 @@ function decodeUiFragmentRegistryEventEnvelope(eventJson) {
 }
 
 function MakeWithConfig(Config) {
-  Role$Reventless.provideGroupsFrom(() => LocalAuth$ReventlessLocal.knownGroups().concat(AccountsManifest$Reventless.declaredGroups()));
+  Role$Reventless.provideGroupsFrom(UserStore$ReventlessLocal.providedGroups);
   TestRunner$ReventlessLocal.setup();
   let match = Config.backend;
   if (typeof match !== "object") {
@@ -1757,6 +1755,7 @@ function MakeWithConfig(Config) {
     let tmp;
     tmp = apiTarget === "Domain" ? "Domain" : "Platform";
     log.info("Platform", undefined, `deployPlugin target=` + tmp);
+    UserStore$ReventlessLocal.pluginChecked.contents = true;
     currentDeployTarget.contents = apiTarget;
     StateViewSliceMaker.QueryDbResolvers.serverRef.contents = resolveTargetGraphQL();
     let tmp$1;
@@ -1909,7 +1908,7 @@ function MakeWithConfig(Config) {
 
 function Make($star) {
   let backend = Backend$ReventlessLocal.fromEnv();
-  Role$Reventless.provideGroupsFrom(() => LocalAuth$ReventlessLocal.knownGroups().concat(AccountsManifest$Reventless.declaredGroups()));
+  Role$Reventless.provideGroupsFrom(UserStore$ReventlessLocal.providedGroups);
   TestRunner$ReventlessLocal.setup();
   if (typeof backend !== "object") {
     BackendState$ReventlessLocal.setMemory();
@@ -3502,6 +3501,7 @@ function Make($star) {
     let tmp;
     tmp = apiTarget === "Domain" ? "Domain" : "Platform";
     log.info("Platform", undefined, `deployPlugin target=` + tmp);
+    UserStore$ReventlessLocal.pluginChecked.contents = true;
     currentDeployTarget.contents = apiTarget;
     StateViewSliceMaker.QueryDbResolvers.serverRef.contents = resolveTargetGraphQL();
     let tmp$1;

package/src/adapter/Auth/UserStore.res

@@ -56,12 +56,35 @@ type resolution =
 // auto-discovery before `Platform.startServers`.
 let resolved: ref<bool> = ref(false)
 
-let resetResolution = (): unit => resolved := false
+/** Set once a plugin has been built, and with it the check that every role it
+    needs has a group among these accounts. */
+let pluginChecked: ref<bool> = ref(false)
+
+let resetResolution = (): unit => {
+  resolved := false
+  pluginChecked := false
+}
+
+/**
+The groups the store's accounts will belong to, for the role check, which runs
+before the servers start and load it: the loaded accounts once `load` has run,
+otherwise the default file `autoLoadOnce` will read (or the template `setup`
+makes it from). Never the working directory once another source was loaded.
+*/
+let providedGroups = (): array<string> =>
+  LocalAuth.knownGroups()->Array.concat(resolved.contents ? [] : AccountsManifest.declaredGroups())
 
 let load = (~users: option<array<entry>>=?, ~usersFile: option<string>=?, ()): result<
   resolution,
   string,
 > => {
+  // The default file is what the check already read; any other source arrives
+  // after it, and the check would have compared the plugins with other accounts.
+  if pluginChecked.contents && (users->Option.isSome || usersFile->Option.isSome) {
+    JsError.throwWithMessage(
+      "UserStore.load(~users / ~usersFile) after a plugin was built — the check that every role it needs has a group read other accounts. Call UserStore.load before deploying plugins.",
+    )
+  }
   resolved := true
   switch users {
   | Some(entries) =>

package/src/adapter/Auth/UserStore.res.mjs

@@ -3,6 +3,7 @@
 import * as Nodefs from "node:fs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as LocalAuth$ReventlessLocal from "./LocalAuth.res.mjs";
 import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 
@@ -25,11 +26,23 @@ let resolved = {
   contents: false
 };
 
+let pluginChecked = {
+  contents: false
+};
+
 function resetResolution() {
   resolved.contents = false;
+  pluginChecked.contents = false;
+}
+
+function providedGroups() {
+  return LocalAuth$ReventlessLocal.knownGroups().concat(resolved.contents ? [] : AccountsManifest$Reventless.declaredGroups());
 }
 
 function load(users, usersFile, param) {
+  if (pluginChecked.contents && (Stdlib_Option.isSome(users) || Stdlib_Option.isSome(usersFile))) {
+    Stdlib_JsError.throwWithMessage("UserStore.load(~users / ~usersFile) after a plugin was built — the check that every role it needs has a group read other accounts. Call UserStore.load before deploying plugins.");
+  }
   resolved.contents = true;
   if (users !== undefined) {
     _registerEntries(users);
@@ -84,7 +97,9 @@ export {
   _registerEntries,
   _defaultPath,
   resolved,
+  pluginChecked,
   resetResolution,
+  providedGroups,
   load,
   autoLoadOnce,
 }

package/tests/adapter/LocalAuthUserStoreTest.res

@@ -160,3 +160,76 @@ testPromise("autoLoadOnce is a no-op after an explicit load", async () => {
   | None => JsError.throwWithMessage("autoLoadOnce wiped explicit registration")
   }
 })
+
+// What the role check counts as provided, before the servers load the store.
+describe("UserStore.providedGroups", () => {
+  // Runs `f` in a directory holding `files` (path relative to it → contents).
+  let inDir = (files: array<(string, string)>, f) => {
+    let dir = NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), "reventless-provided-"]))
+    files->Array.forEach(((file, contents)) => {
+      let path = NodePath.join([dir, file])
+      NodeFs.mkdirSync(NodePath.dirname(path), {recursive: true})
+      NodeFs.writeFileSync(path, contents)
+    })
+    let cwd = NodeProcess.cwd()
+    NodeProcess.chdir(dir)
+    let result = try f() catch {
+    | exn =>
+      NodeProcess.chdir(cwd)
+      throw(exn)
+    }
+    NodeProcess.chdir(cwd)
+    NodeFs.rmSync(dir, {recursive: true, force: true})
+    result
+  }
+  let manifest = group => `- username: m\n  password: m\n  groups: [${group}]\n`
+  let has = (group, groups) => groups->Array.includes(group)
+
+  testSync("counts the default file the servers will load", () => {
+    resetAll()
+    let groups = inDir(
+      [(".reventless/users.yaml", manifest("Merchandiser"))],
+      () => UserStore.providedGroups(),
+    )
+    expect(has("Merchandiser", groups))->toBe(true)
+  })
+
+  testSync("counts the template where setup has not made the file yet", () => {
+    resetAll()
+    let groups = inDir(
+      [("users.example.yaml", manifest("Fulfilment"))],
+      () => UserStore.providedGroups(),
+    )
+    expect(has("Fulfilment", groups))->toBe(true)
+  })
+
+  testSync("once loaded from elsewhere, counts those accounts and not the directory's", () => {
+    resetAll()
+    let _ = UserStore.load(~users=[{username: "i", password: "i", groups: ["Inline"]}], ())
+    let groups = inDir(
+      [(".reventless/users.yaml", manifest("Merchandiser"))],
+      () => UserStore.providedGroups(),
+    )
+    expect((has("Inline", groups), has("Merchandiser", groups)))->toEqual((true, false))
+  })
+
+  testSync("loading other accounts after a plugin was checked is refused", () => {
+    resetAll()
+    UserStore.pluginChecked := true
+    let refused = switch UserStore.load(
+      ~users=[{username: "late", password: "l", groups: ["Late"]}],
+      (),
+    ) {
+    | _ => false
+    | exception JsExn(_) => true
+    }
+    expect(refused)->toBe(true)
+  })
+
+  testSync("the default load after a plugin was checked is the one the check read", () => {
+    resetAll()
+    UserStore.pluginChecked := true
+    let loaded = inDir([], () => UserStore.load()->Result.isOk)
+    expect(loaded)->toBe(true)
+  })
+})

package/tests/adapter/LocalAuthUserStoreTest.res.mjs

@@ -3,7 +3,9 @@
 import * as Nodefs from "node:fs";
 import * as Nodeos from "node:os";
 import * as Nodepath from "node:path";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
 import * as UserStore$ReventlessLocal from "../../src/adapter/Auth/UserStore.res.mjs";
 
@@ -201,6 +203,96 @@ globalThis.test("autoLoadOnce is a no-op after an explicit load", async () => {
   }
 });
 
+globalThis.describe("UserStore.providedGroups", () => {
+  let inDir = (files, f) => {
+    let dir = Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), "reventless-provided-"));
+    files.forEach(param => {
+      let path = Nodepath.join(dir, param[0]);
+      Nodefs.mkdirSync(Nodepath.dirname(path), {
+        recursive: true
+      });
+      Nodefs.writeFileSync(path, param[1], "utf8");
+    });
+    let cwd = process.cwd();
+    process.chdir(dir);
+    let result;
+    try {
+      result = f();
+    } catch (exn) {
+      process.chdir(cwd);
+      throw exn;
+    }
+    process.chdir(cwd);
+    Nodefs.rmSync(dir, {
+      recursive: true,
+      force: true
+    });
+    return result;
+  };
+  globalThis.test("counts the default file the servers will load", () => {
+    resetAll();
+    let groups = inDir([[
+        ".reventless/users.yaml",
+        `- username: m\n  password: m\n  groups: [` + "Merchandiser" + `]\n`
+      ]], () => UserStore$ReventlessLocal.providedGroups());
+    globalThis.expect(groups.includes("Merchandiser")).toBe(true);
+  });
+  globalThis.test("counts the template where setup has not made the file yet", () => {
+    resetAll();
+    let groups = inDir([[
+        "users.example.yaml",
+        `- username: m\n  password: m\n  groups: [` + "Fulfilment" + `]\n`
+      ]], () => UserStore$ReventlessLocal.providedGroups());
+    globalThis.expect(groups.includes("Fulfilment")).toBe(true);
+  });
+  globalThis.test("once loaded from elsewhere, counts those accounts and not the directory's", () => {
+    resetAll();
+    UserStore$ReventlessLocal.load([{
+        username: "i",
+        password: "i",
+        groups: ["Inline"]
+      }], undefined, undefined);
+    let groups = inDir([[
+        ".reventless/users.yaml",
+        `- username: m\n  password: m\n  groups: [` + "Merchandiser" + `]\n`
+      ]], () => UserStore$ReventlessLocal.providedGroups());
+    globalThis.expect([
+      groups.includes("Inline"),
+      groups.includes("Merchandiser")
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+  globalThis.test("loading other accounts after a plugin was checked is refused", () => {
+    resetAll();
+    UserStore$ReventlessLocal.pluginChecked.contents = true;
+    let refused;
+    try {
+      UserStore$ReventlessLocal.load([{
+          username: "late",
+          password: "l",
+          groups: ["Late"]
+        }], undefined, undefined);
+      refused = false;
+    } catch (raw_exn) {
+      let exn = Primitive_exceptions.internalToException(raw_exn);
+      if (exn.RE_EXN_ID === "JsExn") {
+        refused = true;
+      } else {
+        throw exn;
+      }
+    }
+    globalThis.expect(refused).toBe(true);
+  });
+  globalThis.test("the default load after a plugin was checked is the one the check read", () => {
+    resetAll();
+    UserStore$ReventlessLocal.pluginChecked.contents = true;
+    let loaded = inDir([], () => Stdlib_Result.isOk(UserStore$ReventlessLocal.load(undefined, undefined, undefined)));
+    globalThis.expect(loaded).toBe(true);
+  });
+});
+
 export {
   resetAll,
   _writeYamlFile,