@reventlessdev/reventless-local 3.0.0-alpha.296 → 3.0.0-alpha.298

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.298 (2026-10-23)
+
+### Features
+
+* **aws:** a new account gets a domain user id, carried as a token claim from a pool-scoped identity store ([ccfc90c](https://github.com/ReventlessDev/reventless-core/commit/ccfc90ced0c211cab23843864a2b4e580001b3ae))
+
+
+# 3.0.0-alpha.297 (2026-10-22)
+
+### Bug Fixes
+
+* **local:** a plugin declaring a capability the local platform does not provision is told so ([0f4f504](https://github.com/ReventlessDev/reventless-core/commit/0f4f504e310fb001a760d738767590e91c8c7195))
+### Features
+
+* **local:** the local platform provisions an identity provider over the accounts file ([1a46867](https://github.com/ReventlessDev/reventless-core/commit/1a46867ac391b3b4a2d6973606d782547190dcb8))
+
+
 # 3.0.0-alpha.296 (2026-10-22)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-local",
-  "version": "3.0.0-alpha.296",
+  "version": "3.0.0-alpha.298",
   "description": "Local platform for Reventless (in-memory or SQLite backend, for development and testing without AWS)",
   "license": "Apache-2.0",
   "bin": {
@@ -40,13 +40,13 @@
     "@reventlessdev/rescript-mcp-sdk": "1.0.0-alpha.23",
     "@reventlessdev/rescript-node": "2.0.0-alpha.23",
     "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.305",
-    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.153",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.253",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.169",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.202",
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.36",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.174"
+    "@reventlessdev/reventless-graphql-server": "1.0.0-alpha.155",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.307",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.255",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.204",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.171",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.175",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.36"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/capability/Capability_IdentityProvider_UserStore.res

@@ -56,9 +56,13 @@ let make = (~path: option<string>=?, ()): IdentityProvider.t => {
     | Ok(username) if LocalAuth.Login.credentialsOf(~username)->Option.isSome => Error(Conflict)
     | Ok(username) =>
       let password = passwordOf(credential)
+      // Minted here, never the username: the id reaches the event log as
+      // `meta.user` and every `@owner` field, and a log keyed by login names
+      // cannot survive a rename or a move to another provider.
+      let userId = ReventlessCore.Auth_UserId.mint()
       switch AccountsManifest.editFile(
         ~path=file(),
-        ~edits=[Append({username, password, groups})],
+        ~edits=[Append({username, password, groups, userId})],
       ) {
       | Error(message) if message->String.endsWith("already declared in the manifest") =>
         Error(Conflict)
@@ -67,7 +71,7 @@ let make = (~path: option<string>=?, ()): IdentityProvider.t => {
         LocalAuth.Login.setCredentials(
           ~username,
           ~password,
-          ~identity=identityOf(~username, ~groups),
+          ~identity={...identityOf(~username, ~groups), userId},
         )
         Ok({IdentityProvider.providerId: username})
       }

package/src/capability/Capability_IdentityProvider_UserStore.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as LocalAuth$ReventlessLocal from "../adapter/Auth/LocalAuth.res.mjs";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 import * as IdentityProvider$Reventless from "@reventlessdev/reventless-spec/src/semantic/IdentityProvider.res.mjs";
 
@@ -60,16 +61,19 @@ function make(path, param) {
       };
     }
     let password = passwordOf(credential);
+    let userId = Auth_UserId$ReventlessCore.mint();
     let message = AccountsManifest$Reventless.editFile(Stdlib_Option.getOr(path, AccountsManifest$Reventless.defaultPath()), [{
         TAG: "Append",
         _0: {
           username: username,
           password: password,
-          groups: groups
+          groups: groups,
+          userId: userId
         }
       }]);
     if (message.TAG === "Ok") {
-      LocalAuth$ReventlessLocal.Login.setCredentials(username, password, identityOf(username, groups));
+      let newrecord = {...identityOf(username, groups)};
+      LocalAuth$ReventlessLocal.Login.setCredentials(username, password, (newrecord.userId = userId, newrecord));
       return {
         TAG: "Ok",
         _0: {

package/tests/capability/Capability_IdentityProvider_UserStoreTest.res

@@ -49,6 +49,8 @@ describe("Capability_IdentityProvider_UserStore", () => {
       (await LocalAuth.Login.issue(~username="new@example.com", ~password="secret-1"))->Result.isOk,
     )->toBe(true)
 
+    let mintedNow = LocalAuth.lookupUser("new@example.com")->Option.map(i => i.userId)
+
     restartFrom(file)
     expect(
       (await LocalAuth.Login.issue(~username="new@example.com", ~password="secret-1"))->Result.isOk,
@@ -56,6 +58,10 @@ describe("Capability_IdentityProvider_UserStore", () => {
     expect(LocalAuth.lookupUser("new@example.com")->Option.map(i => i.groups))->toEqual(
       Some(["Shopper"]),
     )
+    // The domain id is minted, not the login name, and the file carries the
+    // same one the running process handed out.
+    expect(mintedNow->Option.map(ReventlessCore.Auth_UserId.isMinted))->toEqual(Some(true))
+    expect(LocalAuth.lookupUser("new@example.com")->Option.map(i => i.userId))->toEqual(mintedNow)
   })
 
   testPromise("the same contact twice is a Conflict, not a second account", async () => {

package/tests/capability/Capability_IdentityProvider_UserStoreTest.res.mjs

@@ -8,6 +8,7 @@ import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as LocalAuth$ReventlessLocal from "../../src/adapter/Auth/LocalAuth.res.mjs";
 import * as UserStore$ReventlessLocal from "../../src/adapter/Auth/UserStore.res.mjs";
+import * as Auth_UserId$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Auth/Auth_UserId.res.mjs";
 import * as Capability_IdentityProvider_UserStore$ReventlessLocal from "../../src/capability/Capability_IdentityProvider_UserStore.res.mjs";
 
 function email(address) {
@@ -65,9 +66,12 @@ globalThis.describe("Capability_IdentityProvider_UserStore", () => {
       }
     });
     globalThis.expect(Stdlib_Result.isOk(await LocalAuth$ReventlessLocal.Login.issue("new@example.com", "secret-1", undefined))).toBe(true);
+    let mintedNow = Stdlib_Option.map(LocalAuth$ReventlessLocal.lookupUser("new@example.com"), i => i.userId);
     restartFrom(file);
     globalThis.expect(Stdlib_Result.isOk(await LocalAuth$ReventlessLocal.Login.issue("new@example.com", "secret-1", undefined))).toBe(true);
     globalThis.expect(Stdlib_Option.map(LocalAuth$ReventlessLocal.lookupUser("new@example.com"), i => i.groups)).toEqual(["Shopper"]);
+    globalThis.expect(Stdlib_Option.map(mintedNow, Auth_UserId$ReventlessCore.isMinted)).toEqual(true);
+    globalThis.expect(Stdlib_Option.map(LocalAuth$ReventlessLocal.lookupUser("new@example.com"), i => i.userId)).toEqual(mintedNow);
   });
   globalThis.test("the same contact twice is a Conflict, not a second account", async () => {
     resetAll();

package/tests/capability/LocalCapabilitiesTest.res.mjs

@@ -0,0 +1,61 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
+import * as LocalCapabilities$ReventlessLocal from "../../src/adapter/LocalCapabilities.res.mjs";
+import * as Capability_IdentityProvider_UserStore$ReventlessLocal from "../../src/capability/Capability_IdentityProvider_UserStore.res.mjs";
+
+let declared = [
+  [
+    "Geocoding",
+    "GeocodeAddress"
+  ],
+  [
+    "Messaging",
+    "SendNotification"
+  ],
+  [
+    "IdentityProvider",
+    "CreateAccount"
+  ]
+];
+
+function reset() {
+  LocalCapabilities$ReventlessLocal.registerMessagingSender("");
+  LocalCapabilities$ReventlessLocal.registerIdentityProvider(Capabilities$Reventless.none.identityProvider);
+}
+
+globalThis.describe("LocalCapabilities.unmetWarning", () => {
+  globalThis.test("a bare platform provisions nothing, and the warning names each need once", () => {
+    reset();
+    globalThis.expect(LocalCapabilities$ReventlessLocal.provisioned()).toEqual([]);
+    let message = Stdlib_Option.getOr(LocalCapabilities$ReventlessLocal.unmetWarning(declared), "");
+    globalThis.expect(message.includes("Geocoding (GeocodeAddress)")).toBe(true);
+    globalThis.expect(message.includes("Capability_Messaging_Log.make()")).toBe(true);
+    globalThis.expect(message.includes("Capability_IdentityProvider_UserStore.make()")).toBe(true);
+  });
+  globalThis.test("a registered provider leaves the warning", () => {
+    reset();
+    LocalCapabilities$ReventlessLocal.registerMessagingSender("Shop <shop@example.test>");
+    LocalCapabilities$ReventlessLocal.registerIdentityProvider(Capability_IdentityProvider_UserStore$ReventlessLocal.make("/nonexistent/users.yaml", undefined));
+    globalThis.expect(LocalCapabilities$ReventlessLocal.provisioned()).toEqual([
+      "Messaging",
+      "IdentityProvider"
+    ]);
+    let message = Stdlib_Option.getOr(LocalCapabilities$ReventlessLocal.unmetWarning(declared), "");
+    globalThis.expect(message.includes("Messaging")).toBe(false);
+    globalThis.expect(message.includes("IdentityProvider")).toBe(false);
+    globalThis.expect(message.includes("Geocoding")).toBe(true);
+    reset();
+  });
+  globalThis.test("a plugin declaring nothing gets no warning", () => {
+    reset();
+    globalThis.expect(LocalCapabilities$ReventlessLocal.unmetWarning([])).toEqual(undefined);
+  });
+});
+
+export {
+  declared,
+  reset,
+}
+/*  Not a pure module */