@reventlessdev/reventless-seed 1.0.0-alpha.2 → 1.0.0-alpha.21

package/lib/ocaml/Seed_Runner.res

@@ -2,11 +2,8 @@
 
 open Seed_Types
 
-@scope("process") @val external exit: int => unit = "exit"
-@scope("process") @val external env: dict<string> = "env"
-
 let envOr = (key: string, fallback: string): string =>
-  env->Dict.get(key)->Option.getOr(fallback)
+  NodeProcess.env->Dict.get(key)->Option.getOr(fallback)
 
 /** One line of progress per phase, so a slow run never looks hung. */
 let report = (line: string): unit => Console.log(`  ${line}`)
@@ -60,14 +57,12 @@ let verifyViews = async (client: Seed_Client.t, ~views: array<view>): dict<int>
     Console.log(`  ${count->Int.toString->String.padStart(4, " ")}  ${name}${note}`)
   })
 
-  let empty =
-    views
-    ->Array.filterMap(v =>
-      switch v {
-      | Seeded(name) if counts->Dict.get(name)->Option.getOr(0) == 0 => Some(name)
-      | _ => None
-      }
-    )
+  let empty = views->Array.filterMap(v =>
+    switch v {
+    | Seeded(name) if counts->Dict.get(name)->Option.getOr(0) == 0 => Some(name)
+    | _ => None
+    }
+  )
   if empty->Array.length > 0 {
     throw(Failed(`these views are still empty after seeding: ${empty->Array.join(", ")}`))
   }
@@ -90,6 +85,33 @@ let warn = (warnings: array<string>): unit =>
     warnings->Array.forEach(w => Console.log(`  - ${w}`))
   }
 
+/**
+ * Pre-flight: refuse to seed onto a store that already holds data.
+ *
+ * The harness is a one-shot against a fresh store — a re-run would hit the
+ * domain's own duplicate rejections (`CategoryAlreadyExists`, …) and abort
+ * mid-phase. Catching it here, before any command is sent, turns that into an
+ * honest "nothing was written" startup abort instead of a misleading
+ * half-seeded one. It is the inverse of `verifyViews`: seeding refuses to start
+ * unless the store reads empty. Stops at the first non-empty probe view, so a
+ * populated store aborts after a single query.
+ */
+let assertStoreEmpty = async (client: Seed_Client.t, ~probeViews: array<string>): unit =>
+  for i in 0 to probeViews->Array.length - 1 {
+    switch probeViews->Array.get(i) {
+    | Some(name) =>
+      let count = await Seed_Client.countNodes(client, ~field=name)
+      if count > 0 {
+        throw(
+          Failed(
+            `the target store is not empty — "${name}" already holds ${count->Int.toString} row(s). Seeding is a one-shot against a fresh store; reset the store before re-running.`,
+          ),
+        )
+      }
+    | None => ()
+    }
+  }
+
 /**
  * Wraps a seed run. On failure it prints the cause and exits non-zero, saying
  * plainly that the store is now half-seeded — recovery is a reset, not a re-run.
@@ -100,7 +122,7 @@ let run = async (main: unit => promise<unit>): unit =>
     // Exit cleanly: HTTP keep-alive sockets (and, on the interactive path, the
     // readline/stdin handle) can otherwise keep the event loop alive so the CLI
     // appears to hang after a successful run.
-    exit(0)
+    NodeProcess.exit(0)
   } catch {
   | Failed(message) =>
     Console.error("")
@@ -108,15 +130,13 @@ let run = async (main: unit => promise<unit>): unit =>
     Console.error("fresh store once the cause below is fixed.")
     Console.error("")
     Console.error(message)
-    exit(1)
+    NodeProcess.exit(1)
   | exn =>
     Console.error("")
     Console.error("Seeding aborted with an unexpected error:")
     Console.error("")
-    Console.error(
-      exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown"),
-    )
-    exit(1)
+    Console.error(exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown"))
+    NodeProcess.exit(1)
   }
 
 /**
@@ -128,6 +148,9 @@ type dataSet = {
   name: string,
   label: string,
   seed: Seed_Connect.connection => promise<unit>,
+  // View names probed by the fresh-store guard before any command is sent; a
+  // non-empty one aborts the run at startup. Omit to skip the guard.
+  probeViews?: array<string>,
 }
 
 /**
@@ -142,7 +165,7 @@ let abortStartup = (message: string): unit => {
   Console.error("Seeding did not start — nothing was written. Fix the cause below and re-run.")
   Console.error("")
   Console.error(message)
-  exit(1)
+  NodeProcess.exit(1)
 }
 
 /**
@@ -179,6 +202,9 @@ let seed = (~sets: array<dataSet>, ~connect: unit => promise<Seed_Connect.connec
       }
       let connection = await connect()
       Seed_Prompt.close()
+      // Runs inside this pre-seed `try`, so refusing a non-empty store (or a
+      // failed probe query) is reported as "did not start", not "half-seeded".
+      await assertStoreEmpty(connection.client, ~probeViews=chosen.probeViews->Option.getOr([]))
       Some((chosen, connection))
     } catch {
     | Failed(message) =>

package/lib/ocaml/Seed_Upload.res

@@ -1,27 +1,26 @@
-// Seed-time asset upload against the framework's presign-shaped upload contract.
+// Seed-time asset upload against the framework's upload contract (route B).
 //
-// One code path for both providers: the AWS `Upload_Presign_S3` Function URL and
-// the local dev upload route expose the SAME shape — POST `{fileName,contentType}`
-// → `{uploadUrl, storageRef}`, then PUT the bytes to `uploadUrl`. `uploadAsset`
-// resolves `Ok(storageRef)` — the same same-origin `/{prefix}/{key}` ref a command
-// stores and the UI renders.
+// Minting is a GraphQL mutation on the domain API — `Upload_Presign(store, fileName,
+// contentType)` — authenticated by the same bearer the seed already uses for commands
+// (no separate endpoint, no anonymous surface). `uploadAsset` issues it through the
+// shared `Seed_Client`, then PUTs the bytes to the returned `uploadUrl` and resolves
+// `Ok(storageRef)` — the same `/{prefix}/{key}` ref a command stores and the UI renders.
 //
-// The seed runs under Node, so the returned `uploadUrl` is resolved to an
-// absolute URL against the endpoint's origin: AWS returns an absolute presigned
-// S3 URL (unchanged), while the local route returns a same-origin relative
-// `/{prefix}/{key}` that Node's `fetch` cannot PUT to until it is made absolute.
+// The seed runs under Node, so a relative `uploadUrl` (the local dev server returns a
+// same-origin `/{prefix}/{key}`) is resolved to an absolute URL against the client's
+// endpoint origin before the PUT; AWS returns an absolute presigned S3 URL (used as-is).
+// The PUT itself is unauthenticated — presigned on AWS, open on the local route.
 
 type fetchInit = {method: string, headers: dict<string>, body: string}
 type response
 
 @val external fetch: (string, fetchInit) => promise<response> = "fetch"
-@send external responseJson: response => promise<JSON.t> = "json"
 @send external responseText: response => promise<string> = "text"
 @get external responseOk: response => bool = "ok"
 @get external responseStatus: response => int = "status"
 
-// Resolve a possibly-relative URL against a base (WHATWG URL semantics: an
-// absolute `input` ignores `base`, a relative one is resolved against it).
+// Resolve a possibly-relative URL against a base (WHATWG URL semantics: an absolute
+// `input` ignores `base`, a relative one is resolved against it).
 type url
 @new external makeUrl: (string, string) => url = "URL"
 @get external urlHref: url => string = "href"
@@ -38,51 +37,52 @@ let asString = (json: JSON.t): option<string> =>
   | _ => None
   }
 
-// A `fetch` that reports an unreachable endpoint as `Error` instead of throwing,
-// so the two-step upload can thread failures without exceptions.
+// Whether this run should skip uploads entirely. `SEED_SKIP_UPLOADS` seeds domain data
+// fast, or skips a broken/absent upload path without editing the data set.
+let uploadsSkipped = (): bool => Seed_Prompt.envValue("SEED_SKIP_UPLOADS")->Option.isSome
+
+// A `fetch` that reports an unreachable endpoint as `Error` instead of throwing.
 let tryFetch = async (url: string, init: fetchInit): result<response, string> =>
   try Ok(await fetch(url, init)) catch {
   | _ => Error(`cannot reach ${url}`)
   }
 
 /**
- * Uploads `bytes` under `fileName`/`contentType` through `uploadEndpoint` and
+ * Uploads `bytes` under `fileName`/`contentType` into `store` (the qualified
+ * `{plugin}.{store}` the asset's field declares, e.g. `"Catalog.productImages"`) and
  * resolves `Ok(storageRef)` (the stored `/{prefix}/{key}` ref), or `Error(msg)`
- * describing the step that failed. `authToken`, when supplied, is sent as a
- * Bearer on the presign request (the endpoint decides whether it is required;
- * the PUT itself is unauthenticated — presigned on AWS, open locally).
+ * describing the step that failed. Mints through the domain API's `Upload_Presign`
+ * mutation on `client`, then PUTs the bytes to the returned `uploadUrl`.
  */
 let uploadAsset = async (
-  ~uploadEndpoint: string,
+  ~client: Seed_Client.t,
+  ~store: string,
   ~bytes: string,
   ~fileName: string,
   ~contentType: string,
-  ~authToken: option<string>=?,
 ): result<string, string> => {
-  let presignHeaders = Dict.fromArray([("content-type", "application/json")])
-  authToken->Option.forEach(t => presignHeaders->Dict.set("authorization", `Bearer ${t}`))
-  let presignBody = JSON.stringify(
-    JSON.Encode.object(
-      Dict.fromArray([
-        ("fileName", JSON.Encode.string(fileName)),
-        ("contentType", JSON.Encode.string(contentType)),
-      ]),
-    ),
-  )
+  // GraphQL string literals: JSON-quote the argument values (JSON string escaping is a
+  // superset-safe subset of GraphQL's for these ASCII-ish inputs).
+  let q = s => JSON.stringify(JSON.Encode.string(s))
+  let query = `mutation { r: Upload_Presign(store: ${q(store)}, fileName: ${q(
+      fileName,
+    )}, contentType: ${q(contentType)}) { uploadUrl storageRef } }`
+
+  let presign = try Ok(await Seed_Client.gql(client, ~query, ~label="Upload_Presign")) catch {
+  | Seed_Types.Failed(m) => Error(m)
+  | _ => Error("Upload_Presign: unexpected error")
+  }
 
-  switch await tryFetch(uploadEndpoint, {method: "POST", headers: presignHeaders, body: presignBody}) {
-  | Error(m) => Error(`presign: ${m} — is the platform running?`)
-  | Ok(presignRes) if !(presignRes->responseOk) =>
-    let detail = await presignRes->responseText
-    Error(`presign failed with HTTP ${(presignRes->responseStatus)->Int.toString}: ${detail}`)
-  | Ok(presignRes) =>
-    let json = await presignRes->responseJson
+  switch presign {
+  | Error(m) => Error(`presign: ${m}`)
+  | Ok(data) =>
+    let r = data->field("r")->Option.getOr(JSON.Encode.null)
     switch (
-      json->field("uploadUrl")->Option.flatMap(asString),
-      json->field("storageRef")->Option.flatMap(asString),
+      r->field("uploadUrl")->Option.flatMap(asString),
+      r->field("storageRef")->Option.flatMap(asString),
     ) {
     | (Some(uploadUrl), Some(storageRef)) =>
-      let putUrl = urlHref(makeUrl(uploadUrl, uploadEndpoint))
+      let putUrl = urlHref(makeUrl(uploadUrl, Seed_Client.endpoint(client)))
       switch await tryFetch(
         putUrl,
         {method: "PUT", headers: Dict.fromArray([("content-type", contentType)]), body: bytes},
@@ -91,9 +91,9 @@ let uploadAsset = async (
       | Ok(putRes) if putRes->responseOk => Ok(storageRef)
       | Ok(putRes) =>
         let detail = await putRes->responseText
-        Error(`upload PUT failed with HTTP ${(putRes->responseStatus)->Int.toString}: ${detail}`)
+        Error(`upload PUT failed with HTTP ${putRes->responseStatus->Int.toString}: ${detail}`)
       }
-    | _ => Error("presign response missing uploadUrl/storageRef")
+    | _ => Error("Upload_Presign response missing uploadUrl/storageRef")
     }
   }
 }

package/lib/ocaml/Seed_Users.res

@@ -0,0 +1,92 @@
+// The dev accounts a seed run can log in as, read from `.reventless/users.yaml`.
+//
+// Both platforms keep that file beside the package the seed runs from: locally
+// the in-memory auth adapter loads it at startup, and on AWS it is the record of
+// what was created in the Cognito pool. Either way it already holds the
+// credentials an operator would otherwise retype, so the credential prompt
+// offers its entries instead of asking for a password nobody remembers.
+//
+// Absence is normal and silent — the caller falls back to asking. Nothing here
+// throws: a missing, unreadable or malformed file yields no accounts.
+
+@module("yaml") external parseYaml: string => JSON.t = "parse"
+
+/**
+ * One account: what to log in as, what to send with it, and — when the file
+ * records one — the id the platform stamps on rows this account writes.
+ *
+ * `userId` is optional because absence is normal on both platforms: a local file
+ * may omit it and let the auth adapter default it to the username, and a
+ * hand-maintained AWS file records subs the pool minted, so it can lag.
+ */
+type user = {
+  username: string,
+  password: string,
+  groups: array<string>,
+  userId: option<string>,
+}
+
+let asString = (json: JSON.t): option<string> =>
+  switch json {
+  | String(s) => Some(s)
+  | _ => None
+  }
+
+let userOf = (json: JSON.t): option<user> =>
+  switch json {
+  | Object(obj) =>
+    switch (
+      obj->Dict.get("username")->Option.flatMap(asString),
+      obj->Dict.get("password")->Option.flatMap(asString),
+    ) {
+    | (Some(username), Some(password)) =>
+      let groups = switch obj->Dict.get("groups") {
+      | Some(JSON.Array(items)) => items->Array.filterMap(asString)
+      | _ => []
+      }
+      Some({username, password, groups, userId: obj->Dict.get("userId")->Option.flatMap(asString)})
+    | _ => None
+    }
+  | _ => None
+  }
+
+/**
+ * The accounts a users.yaml document defines, in the order it defines them —
+ * the order is what makes "the first one" a stable default.
+ *
+ * An entry without both a username and a password is skipped rather than
+ * rejected: the file is hand-maintained, and one incomplete entry should not
+ * cost the operator the rest of the list.
+ */
+let parseString = (yamlText: string): array<user> => {
+  let doc = try parseYaml(yamlText) catch {
+  | _ => JSON.Null
+  }
+  switch doc {
+  | Array(items) => items->Array.filterMap(userOf)
+  | _ => []
+  }
+}
+
+/** Where the file lives for the platform being seeded — the seed runs from that
+    package's directory, which is the same cwd the local auth adapter reads. */
+let defaultPath = (): string => NodePath.join([NodeProcess.cwd(), ".reventless", "users.yaml"])
+
+/**
+ * The accounts on disk, with the path they came from. `None` when there is no
+ * readable file with at least one usable account, which the caller reads as
+ * "ask for credentials instead".
+ */
+let load = (~path: option<string>=?): option<(string, array<user>)> => {
+  let file = path->Option.getOr(defaultPath())
+  let users = try {
+    NodeFs.existsSync(file) ? parseString(NodeFs.readFileSync(file)) : []
+  } catch {
+  | _ => []
+  }
+  users->Array.length == 0 ? None : Some((file, users))
+}
+
+/** Menu label: the username, plus whatever groups the file records for it. */
+let label = (u: user): string =>
+  u.groups->Array.length == 0 ? u.username : `${u.username}  [${u.groups->Array.join(", ")}]`

package/lib/ocaml/Seed_UsersTest.res

@@ -0,0 +1,129 @@
+open JestGlobals
+
+// `.reventless/users.yaml` is hand-maintained and shared with the auth adapter,
+// so the seed reads it defensively: it must survive the comment blocks both
+// copies carry, must not reorder the accounts (the first one is the prompt's
+// default, so order IS the contract), and must never throw — a broken file costs
+// the menu, not the run.
+
+let document = `
+# Local dev users — a comment block like the real file carries.
+
+- username: admin
+  password: admin
+  groups: [Admin, Shopper]
+  userId: local-admin
+
+- username: shopper
+  password: Shopper-2026!
+  groups: [Shopper]
+
+- username: noGroups
+  password: pw
+`
+
+describe("Seed_Users.parseString:", () => {
+  testSync("reads every account, in the order the file defines them", () => {
+    let users = Seed_Users.parseString(document)
+    expect(users->Array.map(u => u.Seed_Users.username))->Expect.toEqual([
+      "admin",
+      "shopper",
+      "noGroups",
+    ])
+  })
+
+  testSync("carries the password beside the username", () => {
+    let users = Seed_Users.parseString(document)
+    expect(users->Array.map(u => u.Seed_Users.password))->Expect.toEqual([
+      "admin",
+      "Shopper-2026!",
+      "pw",
+    ])
+  })
+
+  testSync("keeps the groups, and reads a missing groups key as none", () => {
+    let users = Seed_Users.parseString(document)
+    expect(users->Array.map(u => u.Seed_Users.groups))->Expect.toEqual([
+      ["Admin", "Shopper"],
+      ["Shopper"],
+      [],
+    ])
+  })
+
+  // The half that was dropped, and the reason owner-scoped demo rows were keyed
+  // to ids nobody on a Cognito deployment holds: the file records the id the
+  // platform stamps, and reading it only for a password threw that away.
+  //
+  // Absent stays absent rather than defaulting to the username — a local file
+  // may omit it and let the auth adapter default it, and an AWS file records a
+  // sub no default could invent. Guessing here would look like an answer.
+  testSync("keeps the userId an entry declares, and reads a missing one as absent", () => {
+    let users = Seed_Users.parseString(document)
+    expect(users->Array.map(u => u.Seed_Users.userId))->Expect.toEqual([
+      Some("local-admin"),
+      None,
+      None,
+    ])
+  })
+
+  // An entry half-written by hand is the likely flaw in this file. Dropping it
+  // keeps the other accounts selectable; failing the parse would not.
+  testSync("skips an entry that names no password", () => {
+    let users = Seed_Users.parseString(`
+- username: admin
+  password: admin
+- username: halfWritten
+  groups: [Shopper]
+`)
+    expect(users->Array.map(u => u.Seed_Users.username))->Expect.toEqual(["admin"])
+  })
+
+  testSync("yields no accounts for a document that is not a list", () => {
+    expect(Seed_Users.parseString("users: {}")->Array.length)->Expect.toBe(0)
+  })
+
+  // The whole point of returning accounts rather than raising: the caller falls
+  // back to prompting, and it can only do that if nothing here escapes.
+  testSync("yields no accounts for malformed YAML instead of throwing", () => {
+    expect(Seed_Users.parseString("- username: [unclosed")->Array.length)->Expect.toBe(0)
+  })
+})
+
+describe("Seed_Users.load:", () => {
+  testSync("is silent about a file that is not there", () => {
+    expect(Seed_Users.load(~path="/nonexistent/.reventless/users.yaml"))->Expect.toBe(None)
+  })
+})
+
+describe("Seed_Users.label:", () => {
+  testSync("names the groups an account carries", () => {
+    expect(
+      Seed_Users.label({
+        username: "admin",
+        password: "x",
+        groups: ["Admin", "Shopper"],
+        userId: None,
+      }),
+    )->Expect.toBe("admin  [Admin, Shopper]")
+  })
+
+  testSync("is the bare username when the file records no groups", () => {
+    expect(
+      Seed_Users.label({username: "admin", password: "x", groups: [], userId: None}),
+    )->Expect.toBe("admin")
+  })
+
+  // The menu is unchanged by the id: an operator picks an account by name and
+  // membership, and a Cognito sub in the list would be noise at the one moment
+  // they are choosing a login.
+  testSync("says nothing about the userId", () => {
+    expect(
+      Seed_Users.label({
+        username: "admin",
+        password: "x",
+        groups: ["Admin"],
+        userId: Some("4275e4a4-00c1-70e1-1cb5-363b06b992b5"),
+      }),
+    )->Expect.toBe("admin  [Admin]")
+  })
+})

package/package.json

@@ -1,10 +1,15 @@
 {
   "name": "@reventlessdev/reventless-seed",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.21",
   "description": "Reusable harness for seeding a Reventless platform through its public GraphQL command API",
   "license": "Apache-2.0",
+  "dependencies": {
+    "yaml": "^2.8.3",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.11"
+  },
   "devDependencies": {
-    "rescript": "12.3.0"
+    "rescript": "12.3.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/rescript.json

@@ -12,9 +12,17 @@
     {
       "dir": "src",
       "subdirs": true
+    },
+    {
+      "dir": "tests",
+      "subdirs": true,
+      "type": "dev"
     }
   ],
-  "dependencies": [],
+  "dependencies": [
+    "@reventlessdev/rescript-node",
+    "@reventlessdev/rescript-jest"
+  ],
   "compiler-flags": [],
   "suffix": ".res.mjs"
 }

package/src/Seed.res

@@ -10,16 +10,24 @@ module Client = Seed_Client
 module Runner = Seed_Runner
 module Upload = Seed_Upload
 module Prompt = Seed_Prompt
+module Users = Seed_Users
 module Connect = Seed_Connect
 
 exception Failed = Seed_Types.Failed
 
-// A live target a data set seeds against: an authenticated client, the upload
-// endpoint (empty when the deployment serves no uploads), and a label.
+// A live target a data set seeds against: an authenticated client, whether uploads
+// are skipped this run, a label, and who the run is acting as. Uploads mint through
+// the domain API's `Upload_Presign` mutation on the client (route B), so no upload
+// endpoint is carried.
 type connection = Seed_Connect.connection = {
   client: Seed_Client.t,
-  uploadEndpoint: string,
+  uploadsSkipped: bool,
   label: string,
+  accounts: array<Seed_Users.user>,
+  caller: Seed_Users.user,
+  callerId: option<string>,
+  login: (~username: string, ~password: string) => promise<string>,
+  roleSwitch: option<Seed_Connect.roleSwitch>,
 }
 
 // A named, seedable data set. `seed` owns everything domain-specific.
@@ -27,6 +35,7 @@ type dataSet = Seed_Runner.dataSet = {
   name: string,
   label: string,
   seed: connection => promise<unit>,
+  probeViews?: array<string>,
 }
 
 type rec value = Seed_Types.value =

package/src/Seed.res.mjs

@@ -12,6 +12,8 @@ let Upload;
 
 let Prompt;
 
+let Users;
+
 let Connect;
 
 let Failed = Seed_Types$ReventlessSeed.Failed;
@@ -30,6 +32,7 @@ export {
   Runner,
   Upload,
   Prompt,
+  Users,
   Connect,
   Failed,
   mutation,