@reventlessdev/reventless-local 3.0.0-alpha.297 → 3.0.0-alpha.299

package/src/adapter/Auth/UserStore.res.mjs

@@ -1,12 +1,21 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as RoleCoverage$Reventless from "@reventlessdev/reventless-spec/src/types/RoleCoverage.res.mjs";
 import * as LocalAuth$ReventlessLocal from "./LocalAuth.res.mjs";
 import * as AccountsManifest$Reventless from "@reventlessdev/reventless-spec/src/types/AccountsManifest.res.mjs";
 
+let fromFile = {
+  contents: []
+};
+
 function _registerEntries(entries) {
   entries.forEach(param => {
     let username = param.username;
@@ -33,6 +42,7 @@ let pluginChecked = {
 function resetResolution() {
   resolved.contents = false;
   pluginChecked.contents = false;
+  fromFile.contents = [];
 }
 
 function providedGroups() {
@@ -54,6 +64,7 @@ function load(users, usersFile, param) {
   if (usersFile !== undefined) {
     return Stdlib_Result.map(AccountsManifest$Reventless.parseFile(usersFile), entries => {
       _registerEntries(entries);
+      fromFile.contents = entries.map(e => e.username);
       return {
         TAG: "UsersFile",
         _0: usersFile
@@ -64,6 +75,7 @@ function load(users, usersFile, param) {
   if (Nodefs.existsSync(defaultPath)) {
     return Stdlib_Result.map(AccountsManifest$Reventless.parseFile(defaultPath), entries => {
       _registerEntries(entries);
+      fromFile.contents = entries.map(e => e.username);
       return {
         TAG: "DefaultFile",
         _0: defaultPath
@@ -78,11 +90,118 @@ function load(users, usersFile, param) {
   }
 }
 
+function reload(path) {
+  let e = AccountsManifest$Reventless.parseFile(path);
+  if (e.TAG !== "Ok") {
+    return {
+      TAG: "Error",
+      _0: e._0
+    };
+  }
+  let entries = e._0;
+  let names = entries.map(e => e.username);
+  let dropped = fromFile.contents.filter(n => !names.includes(n));
+  dropped.forEach(username => LocalAuth$ReventlessLocal.Login.removeCredentials(username));
+  _registerEntries(entries);
+  fromFile.contents = names;
+  return {
+    TAG: "Ok",
+    _0: names.length.toString() + ` accounts` + (
+      Primitive_object.equal(dropped, []) ? "" : `, removed: ` + dropped.join(", ")
+    )
+  };
+}
+
+function unmetAfterReload() {
+  let provided = Role$Reventless.providedGroups();
+  if (provided !== undefined) {
+    return RoleCoverage$Reventless.unmet(RoleCoverage$Reventless.checked.contents, provided);
+  } else {
+    return [];
+  }
+}
+
+let _watcher = {
+  contents: undefined
+};
+
+let _pending = {
+  contents: undefined
+};
+
+function unwatch() {
+  Stdlib_Option.forEach(_watcher.contents, prim => {
+    prim.close();
+  });
+  _watcher.contents = undefined;
+  Stdlib_Option.forEach(_pending.contents, prim => {
+    clearTimeout(prim);
+  });
+  _pending.contents = undefined;
+}
+
+function watch(path) {
+  unwatch();
+  let dir = Nodepath.dirname(path);
+  let base = Nodepath.basename(path);
+  let last = {
+    contents: Nodefs.existsSync(path) ? Nodefs.readFileSync(path, "utf8") : ""
+  };
+  let w;
+  try {
+    w = Nodefs.watch(dir, (param, file) => {
+      if (Stdlib_Option.mapOr((file == null) ? undefined : Primitive_option.some(file), true, f => f === base)) {
+        Stdlib_Option.forEach(_pending.contents, prim => {
+          clearTimeout(prim);
+        });
+        _pending.contents = Primitive_option.some(setTimeout(() => {
+          _pending.contents = undefined;
+          let text;
+          try {
+            text = Nodefs.readFileSync(path, "utf8");
+          } catch (exn) {
+            return;
+          }
+          if (text === last.contents) {
+            return;
+          }
+          last.contents = text;
+          let said = reload(path);
+          if (said.TAG === "Ok") {
+            console.log(`[LocalAuth] ` + base + ` changed — reloaded ` + said._0 + `.`);
+            let missing = unmetAfterReload();
+            if (missing.length !== 0) {
+              console.warn(`[LocalAuth] No account is in the group of: ` + missing.map(RoleCoverage$Reventless.describe).join("; ") + ". Every such caller is refused until one is.");
+              return;
+            } else {
+              return;
+            }
+          }
+          console.warn(`[LocalAuth] ` + base + ` changed but was not read: ` + said._0);
+        }, 100));
+        return;
+      }
+    });
+  } catch (exn) {
+    return;
+  }
+  _watcher.contents = Primitive_option.some(w.unref());
+}
+
 function autoLoadOnce() {
-  if (!resolved.contents) {
-    load(undefined, undefined, undefined);
+  if (resolved.contents) {
+    return;
+  }
+  let match = load(undefined, undefined, undefined);
+  if (match.TAG !== "Ok") {
     return;
   }
+  let path = match._0;
+  if (typeof path !== "object") {
+    return;
+  } else {
+    return watch(path._0);
+  }
 }
 
 let parseString = AccountsManifest$Reventless.parseString;
@@ -94,6 +213,7 @@ let _defaultPath = AccountsManifest$Reventless.defaultPath;
 export {
   parseString,
   parseFile,
+  fromFile,
   _registerEntries,
   _defaultPath,
   resolved,
@@ -101,6 +221,12 @@ export {
   resetResolution,
   providedGroups,
   load,
+  reload,
+  unmetAfterReload,
+  _watcher,
+  _pending,
+  unwatch,
+  watch,
   autoLoadOnce,
 }
 /* node:fs Not a pure module */

package/src/adapter/CommandGenerator/CommandGeneratorResolvers_GraphQL.res

@@ -45,6 +45,35 @@ let rejectForbidden = (~field: string): JSON.t =>
     }),
   )
 
+// -- Limit on anonymous doors ---------------------------------------------------
+// A door whose rule admits callers who are not signed in is counted per source
+// address, whoever the caller turns out to be. See `LocalAnonymousLimit`.
+
+@get @return(nullable) external sourceAddressOf: JSON.t => option<string> = "sourceAddress"
+
+let rejectThrottled = (~field: string): JSON.t =>
+  CommandTopic.commandOutcomeToJson(
+    Rejected({
+      msgId: ReventlessCore.Message.uuid(),
+      errorCode: Reventless.CommandOutcome.code(Throttled),
+      errorDetail: Some(`Mutation.${field}: too many requests from this source; retry later`),
+      cause: InfrastructureFailure,
+    }),
+  )
+
+/** `Some(rejection)` when `rule` admits anonymous callers and this request's
+    source has spent its allowance for the door. */
+let throttled = (~rule: Reventless.Authorization.permission, ~field, ~ctx): option<JSON.t> =>
+  switch rule {
+  | AllowAnonymous
+    if !LocalAnonymousLimit.admit(
+      ~door=field,
+      ~source=ctx->sourceAddressOf->Option.getOr("unknown"),
+    ) =>
+    Some(rejectThrottled(~field))
+  | _ => None
+  }
+
 // -- Plugin status gate -------------------------------------------------------
 // Set by the platform after Admin.construct to wire a per-mutation lookup against
 // the Plugin read model. Takes a mutation field name (e.g. "Catalog_Product_Add"),
@@ -213,6 +242,8 @@ let register = (
           let rule = authorizationOf(commandName)
           if !Reventless.Authorization.isAllowed(rule, identity) {
             rejectForbidden(~field)
+          } else if throttled(~rule, ~field, ~ctx)->Option.isSome {
+            rejectThrottled(~field)
           } else {
             let payload: CommandGenerator.payload = {
               command: commandName,
@@ -283,6 +314,8 @@ let registerDcb = (
         let rule = authorizationOf(tag)
         if !Reventless.Authorization.isAllowed(rule, identity) {
           rejectForbidden(~field=fieldName)
+        } else if throttled(~rule, ~field=fieldName, ~ctx)->Option.isSome {
+          rejectThrottled(~field=fieldName)
         } else {
           let payload: CommandGenerator.payload = {
             command: tag,

package/src/adapter/CommandGenerator/CommandGeneratorResolvers_GraphQL.res.mjs

@@ -5,6 +5,7 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
@@ -13,6 +14,7 @@ import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/ty
 import * as CommandOutcome$Reventless from "@reventlessdev/reventless-spec/src/components/CommandOutcome.res.mjs";
 import * as CommandTopic$ReventlessCore from "@reventlessdev/reventless-core/src/components/CommandTopic/CommandTopic.res.mjs";
 import * as GraphQL_CallerError$ReventlessLocal from "../GraphQL_CallerError.res.mjs";
+import * as LocalAnonymousLimit$ReventlessLocal from "../LocalAnonymousLimit.res.mjs";
 import * as Plugin_ResolverError$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_ResolverError.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
@@ -39,6 +41,22 @@ function rejectForbidden(field) {
   });
 }
 
+function rejectThrottled(field) {
+  return CommandTopic$ReventlessCore.commandOutcomeToJson({
+    TAG: "Rejected",
+    msgId: Message$ReventlessCore.uuid(),
+    errorCode: CommandOutcome$Reventless.code("Throttled"),
+    errorDetail: `Mutation.` + field + `: too many requests from this source; retry later`,
+    cause: "InfrastructureFailure"
+  });
+}
+
+function throttled(rule, field, ctx) {
+  if (typeof rule !== "object" && rule === "AllowAnonymous" && !LocalAnonymousLimit$ReventlessLocal.admit(field, Stdlib_Option.getOr(Primitive_option.fromNullable(ctx.sourceAddress), "unknown"))) {
+    return rejectThrottled(field);
+  }
+}
+
 let pluginStatusGate = {
   contents: undefined
 };
@@ -157,6 +175,9 @@ function register(fields, commandSchema, authorizationOf, server) {
       if (!Authorization$Reventless.isAllowed(rule, identity)) {
         return rejectForbidden(field);
       }
+      if (Stdlib_Option.isSome(throttled(rule, field, ctx))) {
+        return rejectThrottled(field);
+      }
       let payload_meta = {
         ip: [],
         user: identity.userId,
@@ -200,6 +221,9 @@ function registerDcb(fieldName, commandSchema, authorizationOf, server) {
     if (!Authorization$Reventless.isAllowed(rule, identity)) {
       return rejectForbidden(fieldName);
     }
+    if (Stdlib_Option.isSome(throttled(rule, fieldName, ctx))) {
+      return rejectThrottled(fieldName);
+    }
     let payload_meta = {
       ip: [],
       user: identity.userId,
@@ -255,6 +279,8 @@ let commandOutcomeToJson = CommandTopic$ReventlessCore.commandOutcomeToJson;
 export {
   extractIdentity,
   rejectForbidden,
+  rejectThrottled,
+  throttled,
   pluginStatusGate,
   setPluginStatusGate,
   resetPluginStatusGate,

package/src/adapter/CommandGenerator/InboundTranslationResolvers_GraphQL.res

@@ -15,7 +15,7 @@ let receiveRegistry: dict<receive> = Dict.make()
 
 type pendingCall = {
   inputJson: JSON.t,
-  caller: option<Reventless.Identity.t>,
+  caller?: Reventless.Identity.t,
   resolve: ReventlessInfra.InboundTranslationSlice.receiveResult => unit,
 }
 
@@ -47,7 +47,7 @@ let register = (
 
   let queuingReceive: receive = (inputJson, ~caller=?) =>
     Promise.make((resolve, _reject) => {
-      pendingQueue.contents->Array.push({inputJson, caller, resolve})
+      pendingQueue.contents->Array.push({inputJson, ?caller, resolve})
     })
   receiveRegistry->Dict.set(fieldName, queuingReceive)
 
@@ -61,6 +61,14 @@ let register = (
       permission->Option.mapOr(false, rule => Reventless.Authorization.isAllowed(rule, caller))
     if !admitted {
       CommandGeneratorResolvers_GraphQL.rejectForbidden(~field=fieldName)
+    } else if (
+      permission
+      ->Option.flatMap(rule =>
+        CommandGeneratorResolvers_GraphQL.throttled(~rule, ~field=fieldName, ~ctx)
+      )
+      ->Option.isSome
+    ) {
+      CommandGeneratorResolvers_GraphQL.rejectThrottled(~field=fieldName)
     } else {
       let receive = receiveRegistry->Dict.getUnsafe(fieldName)
       let result = await receive(args->Obj.magic, ~caller)
@@ -82,7 +90,7 @@ let bindReceive = (~fieldName: string, ~receive: receive) => {
   | Some(pendingQueue) =>
     let pending = pendingQueue.contents
     pendingQueue.contents = []
-    pending->Array.forEach(({inputJson, caller, resolve}) => {
+    pending->Array.forEach(({inputJson, ?caller, resolve}) => {
       let _ = receive(inputJson, ~caller?)->Promise.thenResolve(result => resolve(result))
     })
   | None => ()

package/src/adapter/CommandGenerator/InboundTranslationResolvers_GraphQL.res.mjs

@@ -33,6 +33,9 @@ function register(fieldName, externalInputSchema, permission, server) {
     if (!admitted) {
       return CommandGeneratorResolvers_GraphQL$ReventlessLocal.rejectForbidden(fieldName);
     }
+    if (Stdlib_Option.isSome(Stdlib_Option.flatMap(permission, rule => CommandGeneratorResolvers_GraphQL$ReventlessLocal.throttled(rule, fieldName, ctx)))) {
+      return CommandGeneratorResolvers_GraphQL$ReventlessLocal.rejectThrottled(fieldName);
+    }
     let receive = receiveRegistry[fieldName];
     let result = await receive(args, caller);
     return CommandTopic$ReventlessCore.commandOutcomeToJson(InboundTranslationSlice_Callback$ReventlessCore.receiveResultToOutcome(result));

package/src/adapter/DomainGraphQL_Server.res

@@ -908,7 +908,7 @@ let diagnostics = (): diagnostics => {
     resolverMutationCount: mutResolverNames->Array.length,
     resolverQueryCount: queryResolverNames->Array.length,
     mismatches,
-    fullSdl: lastFullSdl.contents,
+    fullSdl: ?lastFullSdl.contents,
     serverRunning: activeServer.contents->Option.isSome,
   }
 }

package/src/adapter/GraphQL_CallerError.res

@@ -17,3 +17,7 @@ external make: (string, {"extensions": {"code": string}}) => exn = "GraphQLError
     `BAD_USER_INPUT` sense. */
 let badUserInput = (message: string): exn =>
   make(message, {"extensions": {"code": "BAD_USER_INPUT"}})
+
+/** A door the caller's source has knocked on too often. The same code the
+    mutation side answers with, so a client reads one word for both. */
+let throttled = (message: string): exn => make(message, {"extensions": {"code": "Throttled"}})

package/src/adapter/GraphQL_CallerError.res.mjs

@@ -10,7 +10,16 @@ function badUserInput(message) {
   });
 }
 
+function throttled(message) {
+  return new Graphql.GraphQLError(message, {
+    extensions: {
+      code: "Throttled"
+    }
+  });
+}
+
 export {
   badUserInput,
+  throttled,
 }
 /* graphql Not a pure module */

package/src/adapter/LocalAnonymousLimit.res

@@ -0,0 +1,35 @@
+// The local platform's limit on doors open to callers who are not signed in:
+// requests per source address per window, read from
+// `REVENTLESS_ANONYMOUS_REQUEST_LIMIT` (`10/3600` when unset).
+//
+// One limiter for the process, built on first use so a test can set the
+// variable first. A value that does not parse fails the request rather than
+// falling back: a limit someone set and mistyped must not quietly become one they
+// did not choose.
+
+let limiter: ref<option<ReventlessCore.AnonymousLimiter.t>> = ref(None)
+
+let configured = (): Reventless.AnonymousRequestLimit.t =>
+  switch NodeProcess.env->Dict.get(Reventless.AnonymousRequestLimit.envKey) {
+  | None | Some("") => Reventless.AnonymousRequestLimit.default
+  | Some(raw) =>
+    switch Reventless.AnonymousRequestLimit.parse(raw) {
+    | Ok(limit) => limit
+    | Error(message) => JsError.throwWithMessage(message)
+    }
+  }
+
+let current = (): ReventlessCore.AnonymousLimiter.t =>
+  switch limiter.contents {
+  | Some(l) => l
+  | None =>
+    let l = ReventlessCore.AnonymousLimiter.make(~limit=configured())
+    limiter := Some(l)
+    l
+  }
+
+/** Forget every count and re-read the configuration on next use. */
+let reset = () => limiter := None
+
+/** Whether one more request from `source` reaches `door`. */
+let admit = (~door: string, ~source: string): bool => current().admit(~door, ~source)

package/src/adapter/LocalAnonymousLimit.res.mjs

@@ -0,0 +1,52 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as AnonymousLimiter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Throttle/AnonymousLimiter.res.mjs";
+import * as AnonymousRequestLimit$Reventless from "@reventlessdev/reventless-spec/src/types/AnonymousRequestLimit.res.mjs";
+
+let limiter = {
+  contents: undefined
+};
+
+function configured() {
+  let raw = process.env[AnonymousRequestLimit$Reventless.envKey];
+  if (raw === undefined) {
+    return AnonymousRequestLimit$Reventless.default;
+  }
+  if (raw === "") {
+    return AnonymousRequestLimit$Reventless.default;
+  }
+  let limit = AnonymousRequestLimit$Reventless.parse(raw);
+  if (limit.TAG === "Ok") {
+    return limit._0;
+  } else {
+    return Stdlib_JsError.throwWithMessage(limit._0);
+  }
+}
+
+function current() {
+  let l = limiter.contents;
+  if (l !== undefined) {
+    return l;
+  }
+  let l$1 = AnonymousLimiter$ReventlessCore.make(configured(), undefined);
+  limiter.contents = l$1;
+  return l$1;
+}
+
+function reset() {
+  limiter.contents = undefined;
+}
+
+function admit(door, source) {
+  return current().admit(door, source);
+}
+
+export {
+  limiter,
+  configured,
+  current,
+  reset,
+  admit,
+}
+/* No side effect */

package/src/adapter/LocalCapabilities.res

@@ -39,12 +39,14 @@ let registerIdentityProvider = (provider: Reventless.IdentityProvider.t) =>
     read off the same refs `capabilities()` reads, so it cannot disagree with
     what a slice is handed. Geocoding is never here — no local geocoder exists. */
 let provisioned = (): array<Reventless.CapabilityNeed.t> =>
-  Array.concat(
+  [
     messagingSenderRef.contents == "" ? [] : [Reventless.CapabilityNeed.Messaging],
     identityProviderRef.contents.operations == []
       ? []
       : [Reventless.CapabilityNeed.IdentityProvider],
-  )
+    // Always: an in-memory stash needs nothing a root could fail to provide.
+    [Reventless.CapabilityNeed.Stash],
+  ]->Array.flat
 
 /**
 The warning for a plugin declaring needs this platform does not provision, or
@@ -69,6 +71,8 @@ let unmetWarning = (~declared: array<(string, string)>): option<string> =>
           `\n  Messaging is \`Capability_Messaging_Log.make()\`, passed to the platform as ` ++ `\`~messagingSender\`.`
         | IdentityProvider =>
           `\n  IdentityProvider is \`Capability_IdentityProvider_UserStore.make()\`, passed to the ` ++ `platform as \`~identityProvider\`.`
+        // Never unmet here: the local platform always provisions one.
+        | Stash => ``
         }
       )
       ->Belt.Set.String.fromArray
@@ -77,9 +81,17 @@ let unmetWarning = (~declared: array<(string, string)>): option<string> =>
     )
   }
 
+// One stash for the process: the door that puts and the slice that takes both run
+// here, and a stash per call would hand the slice an empty one.
+let stash = ref(ReventlessCore.Stash_Memory_Backend.make())
+
+/** A fresh stash, for a test that must not see another's values. */
+let resetStash = () => stash := ReventlessCore.Stash_Memory_Backend.make()
+
 let capabilities = (): Reventless.Capabilities.t => {
   geocode: Reventless.Capabilities.none.geocode,
   messaging: ReventlessCore.Messaging_Log_Backend.provider(~sender=messagingSenderRef.contents),
   identityProvider: identityProviderRef.contents,
   secrets: ReventlessCore.Secrets_Node_Backend.provider,
+  stash: stash.contents,
 }

package/src/adapter/LocalCapabilities.res.mjs

@@ -5,6 +5,7 @@ import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js
 import * as Capabilities$Reventless from "@reventlessdev/reventless-spec/src/semantic/Capabilities.res.mjs";
 import * as CapabilityNeed$Reventless from "@reventlessdev/reventless-spec/src/semantic/CapabilityNeed.res.mjs";
 import * as Secrets_Node_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Secrets/Secrets_Node_Backend.res.mjs";
+import * as Stash_Memory_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Stash/Stash_Memory_Backend.res.mjs";
 import * as Messaging_Log_Backend$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Messaging/Messaging_Log_Backend.res.mjs";
 
 let messagingSenderRef = {
@@ -24,9 +25,11 @@ function registerIdentityProvider(provider) {
 }
 
 function provisioned() {
-  return (
-    messagingSenderRef.contents === "" ? [] : ["Messaging"]
-  ).concat(Primitive_object.equal(identityProviderRef.contents.operations, []) ? [] : ["IdentityProvider"]);
+  return [
+    messagingSenderRef.contents === "" ? [] : ["Messaging"],
+    Primitive_object.equal(identityProviderRef.contents.operations, []) ? [] : ["IdentityProvider"],
+    ["Stash"]
+  ].flat();
 }
 
 function unmetWarning(declared) {
@@ -41,17 +44,28 @@ function unmetWarning(declared) {
           return `\n  Messaging is \`Capability_Messaging_Log.make()\`, passed to the platform as \`~messagingSender\`.`;
         case "IdentityProvider" :
           return `\n  IdentityProvider is \`Capability_IdentityProvider_UserStore.make()\`, passed to the platform as \`~identityProvider\`.`;
+        case "Stash" :
+          return ``;
       }
     }))).join("");
   }
 }
 
+let stash = {
+  contents: Stash_Memory_Backend$ReventlessCore.make(undefined)
+};
+
+function resetStash() {
+  stash.contents = Stash_Memory_Backend$ReventlessCore.make(undefined);
+}
+
 function capabilities() {
   return {
     geocode: Capabilities$Reventless.none.geocode,
     messaging: Messaging_Log_Backend$ReventlessCore.provider(messagingSenderRef.contents),
     identityProvider: identityProviderRef.contents,
-    secrets: Secrets_Node_Backend$ReventlessCore.provider
+    secrets: Secrets_Node_Backend$ReventlessCore.provider,
+    stash: stash.contents
   };
 }
 
@@ -62,6 +76,8 @@ export {
   registerIdentityProvider,
   provisioned,
   unmetWarning,
+  stash,
+  resetStash,
   capabilities,
 }
-/* Capabilities-Reventless Not a pure module */
+/* stash Not a pure module */

package/src/adapter/QueryDb/QueryDbResolvers_GraphQL.res

@@ -43,6 +43,8 @@ module Make = (Bus: LocalBus.T) => {
   // `Identity.t` to `ctx.identity`. Fallback to anonymous only when ctx is
   // malformed.
 
+  @get @return(nullable) external sourceAddressOf: JSON.t => option<string> = "sourceAddress"
+
   let extractIdentity = (ctx: JSON.t): Reventless.Identity.t => {
     try {
       switch (ctx->Obj.magic)["identity"]->Nullable.toOption {
@@ -133,6 +135,26 @@ module Make = (Bus: LocalBus.T) => {
       // the user-supplied interceptor (mirrors mutation enforcement).
       if !Reventless.Authorization.isAllowed(authorization, identity) {
         Deny("Forbidden")
+      } else if (
+        // A view open to callers who are not signed in is counted per source
+        // address like any anonymous door, whoever the caller turns out to be.
+        switch authorization {
+        | AllowAnonymous =>
+          !LocalAnonymousLimit.admit(
+            ~door=name,
+            ~source=ctx->sourceAddressOf->Option.getOr("unknown"),
+          )
+        | _ => false
+        }
+      ) {
+        // An error, not a denial: a denied read answers an empty page, and an
+        // empty page from this door would read as "nothing to say" — a visitor
+        // asking which roles are open would be told all of them are.
+        throw(
+          GraphQL_CallerError.throttled(
+            `Query.${name}: too many requests from this source; retry later`,
+          ),
+        )
       } else {
         switch QueryDb_Callback.queryInterceptorHook.contents {
         | None => Allow

package/src/adapter/QueryDb/QueryDbResolvers_GraphQL.res.mjs

@@ -9,6 +9,7 @@ import * as Effect from "effect/Effect";
 import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
 import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as RowImage$Reventless from "@reventlessdev/reventless-spec/src/semantic/RowImage.res.mjs";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
@@ -21,6 +22,7 @@ import * as SortKey_Filter$ReventlessLocal from "./SortKey_Filter.res.mjs";
 import * as QueryDbListQuery$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/QueryDbListQuery.res.mjs";
 import * as QueryDb_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/QueryDb/QueryDb_Callback.res.mjs";
 import * as GraphQL_CallerError$ReventlessLocal from "../GraphQL_CallerError.res.mjs";
+import * as LocalAnonymousLimit$ReventlessLocal from "../LocalAnonymousLimit.res.mjs";
 import * as DomainGraphQL_Server$ReventlessLocal from "../DomainGraphQL_Server.res.mjs";
 import * as OwnerScopeDiagnostics$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/OwnerScopeDiagnostics.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
@@ -87,6 +89,11 @@ function Make(Bus) {
           _0: "Forbidden"
         };
       }
+      let tmp;
+      tmp = typeof authorization !== "object" && authorization === "AllowAnonymous" ? !LocalAnonymousLimit$ReventlessLocal.admit(name, Stdlib_Option.getOr(Primitive_option.fromNullable(ctx.sourceAddress), "unknown")) : false;
+      if (tmp) {
+        throw GraphQL_CallerError$ReventlessLocal.throttled(`Query.` + name + `: too many requests from this source; retry later`);
+      }
       let interceptor = QueryDb_Callback$ReventlessCore.queryInterceptorHook.contents;
       if (interceptor !== undefined) {
         return await interceptor(identity, name, args);