@reventlessdev/reventless-seed 1.0.0-alpha.20 → 1.0.0-alpha.22

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.22 (2026-09-16)
+
+### Bug Fixes
+
+* **aws:** make the demo accounts work on a pool that signs in by email ([97b036f](https://github.com/ReventlessDev/reventless-core/commit/97b036f86979ba55dbbf93d460fe8076c35abf1a))
+
+
+# 1.0.0-alpha.21 (2026-09-09)
+
+### Bug Fixes
+
+* **seed:** read the claims behind a JWT's JOSE header, not the header ([7d3b4fd](https://github.com/ReventlessDev/reventless-core/commit/7d3b4fd8ae6dfca90f3c16f29b2be67e4e26c28f))
+* **seed:** resolve the demo owners from the platform's own accounts ([7000bb3](https://github.com/ReventlessDev/reventless-core/commit/7000bb367cddbed532197c8b234cb3d0320c1c62))
+### Features
+
+* **seed:** choose the role a run acts as, instead of inheriting a stored one ([edf41ca](https://github.com/ReventlessDev/reventless-core/commit/edf41ca80f84bf340679f200ebfeeeb4a590ae03))
+* **seed:** let a caller ask whether a door opens, without walking through it ([342a142](https://github.com/ReventlessDev/reventless-core/commit/342a1429b6fba79ac46f395b801ce5a0f1e29567))
+
+
 # 1.0.0-alpha.20 (2026-09-08)
 
 ### Features

package/lib/bs/.compiler.log

@@ -1,2 +1,2 @@
-#Start(1788869322834)
-#Done(1788869322875)
+#Start(1789592211625)
+#Done(1789592211686)

package/lib/bs/ReventlessSeed.mlmap

@@ -3,6 +3,7 @@ Seed
 Seed_Client
 Seed_ClientTest
 Seed_Connect
+Seed_ConnectTest
 Seed_Prompt
 Seed_PromptTest
 Seed_Random

package/lib/bs/compiler-info.json

@@ -4,5 +4,5 @@
   "bsc_hash": "75e3a59c95cc953608fd3dd6ea6ed68141bba4414a20a52f114261b8a48385fa",
   "rescript_config_hash": "25cfff836d200084949fdfdfec2f6875901bfee1f04d84634eca252ef1ca1ef1",
   "runtime_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/runtime",
-  "generated_at": "1788869322878"
+  "generated_at": "1789592211689"
 }

package/lib/bs/src/Seed.res

@@ -16,12 +16,18 @@ module Connect = Seed_Connect
 exception Failed = Seed_Types.Failed
 
 // A live target a data set seeds against: an authenticated client, whether uploads
-// are skipped this run, and a label. Uploads mint through the domain API's
-// `Upload_Presign` mutation on the client (route B), so no upload endpoint is carried.
+// are skipped this run, a label, and who the run is acting as. Uploads mint through
+// the domain API's `Upload_Presign` mutation on the client (route B), so no upload
+// endpoint is carried.
 type connection = Seed_Connect.connection = {
   client: Seed_Client.t,
   uploadsSkipped: bool,
   label: string,
+  accounts: array<Seed_Users.user>,
+  caller: Seed_Users.user,
+  callerId: option<string>,
+  login: (~username: string, ~password: string) => promise<string>,
+  roleSwitch: option<Seed_Connect.roleSwitch>,
 }
 
 // A named, seedable data set. `seed` owns everything domain-specific.

package/lib/bs/src/Seed_Client.res

@@ -21,7 +21,8 @@ type response
 @val external setTimeout: (unit => unit, int) => unit = "setTimeout"
 @scope("Date") @val external nowMs: unit => float = "now"
 
-let sleep = (ms: int): promise<unit> => Promise.make((resolve, _) => setTimeout(() => resolve(), ms))
+let sleep = (ms: int): promise<unit> =>
+  Promise.make((resolve, _) => setTimeout(() => resolve(), ms))
 
 // ── Configuration ───────────────────────────────────────────────────────────
 
@@ -68,6 +69,12 @@ let availableRolesClaim = "availableRoles"
 /** Group claim per provider, tried in order. */
 let groupClaimNames = ["cognito:groups", "groups"]
 
+/** Claim carrying the caller's id, per provider, tried in order. A Cognito JWT
+    says `sub`; the local dev token is a base64url `Identity.t`, whose field is
+    `userId`. Same shape as `groupClaimNames`, for the same reason: this harness
+    depends on no framework package and must not learn who signed the token. */
+let callerIdClaimNames = ["sub", "userId"]
+
 let decodeSegment = (segment: string): option<dict<JSON.t>> =>
   try {
     segment
@@ -79,10 +86,22 @@ let decodeSegment = (segment: string): option<dict<JSON.t>> =>
   | _ => None
   }
 
+/**
+ * A JOSE header rather than a claims set.
+ *
+ * RFC 7515 requires `alg` on the header, and nothing puts it on a payload. The
+ * test matters because a JWT header is base64url JSON exactly as the payload is,
+ * so it decodes just as readily — and it comes first.
+ */
+let isJoseHeader = (obj: dict<JSON.t>): bool => obj->Dict.get("alg")->Option.isSome
+
 /** The bearer's payload, from whichever segment carries it — a Cognito JWT puts
     it second and a local dev token first, so trying each in turn saves this from
     having to know which platform signed the token. A segment that is not a JSON
-    object (a signature) simply does not decode. */
+    object (a signature) simply does not decode, and a JOSE header is skipped:
+    it IS a decodable JSON object, so taking the first one that parsed read a
+    real Cognito token's `{kid, alg}` as its claims and found no groups and no
+    id in it — silently, since an unreadable token is not an error here. */
 let claims = (t: t): option<dict<JSON.t>> =>
   t.token->Option.flatMap(token =>
     token
@@ -90,7 +109,11 @@ let claims = (t: t): option<dict<JSON.t>> =>
     ->Array.reduce(None, (found, segment) =>
       switch found {
       | Some(_) => found
-      | None => decodeSegment(segment)
+      | None =>
+        switch decodeSegment(segment) {
+        | Some(obj) if obj->isJoseHeader => None
+        | decoded => decoded
+        }
       }
     )
   )
@@ -118,6 +141,31 @@ let effectiveGroups = (t: t): option<array<string>> =>
     }
   )
 
+/** The id the bearer presents — what an `@owner` field is stamped with, and so
+    the only id a seed can key owner-scoped rows to and have an account read them
+    back. `None` when the token is opaque to us or names no id. */
+let callerId = (t: t): option<string> =>
+  callerIdClaimNames->Array.reduce(None, (found, name) =>
+    switch found {
+    | Some(_) => found
+    | None => t->claims->Option.flatMap(c => c->Dict.get(name))->Option.flatMap(JSON.Decode.string)
+    }
+  )
+
+/**
+ * The membership a narrowed token was reduced *from*, or `None` when the bearer
+ * is not narrowed.
+ *
+ * `availableRoles` is only written when a role was chosen, so its presence is
+ * the narrowing — the group claim alone cannot tell you, since a token carrying
+ * one group looks identical whether the account holds one or five.
+ */
+let narrowedFrom = (t: t): option<array<string>> =>
+  switch t->claimStrings(availableRolesClaim) {
+  | Some(available) if available->Array.length > 0 => Some(available)
+  | _ => None
+  }
+
 /** One line naming the identity the bearer carries, and — when it was narrowed —
     the membership it was narrowed from. The second half is the point: without it
     a refusal looks like a misconfigured grant rather than a role switch. */
@@ -178,8 +226,9 @@ let login = async (t: t): unit => {
     let detail = await res->responseText
     throw(
       Failed(
-        `login as "${username}" failed with HTTP ${(res->responseStatus)
-            ->Int.toString}: ${detail}`,
+        `login as "${username}" failed with HTTP ${res
+          ->responseStatus
+          ->Int.toString}: ${detail}`,
       ),
     )
   }
@@ -254,7 +303,19 @@ let attempts = 4
  * fixed delay would have the whole batch retry in lockstep and rebuild the same
  * burst that provoked the fault.
  */
-let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
+/** What a document came back as. `Errors` carries both the raw array — so a
+    caller can classify it, e.g. as a refusal — and the message `gql` would have
+    thrown, so the two paths cannot describe the same failure differently. */
+type failure = {errors: JSON.t, message: string}
+type outcome = Data(JSON.t) | Errors(failure)
+
+/**
+ * Sends one document and reports what came back, resending a transient fault
+ * along the way. Returning the errors rather than throwing is what lets a caller
+ * treat a refusal as an *answer* — which the authorization probe needs and
+ * seeding must never do.
+ */
+let gqlOutcome = async (t: t, ~query: string, ~label: string): outcome => {
   let headers = Dict.fromArray([("content-type", "application/json")])
   switch t.token {
   | Some(token) => headers->Dict.set("authorization", `Bearer ${token}`)
@@ -263,10 +324,9 @@ let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
   let body = JSON.stringify(
     JSON.Encode.object(Dict.fromArray([("query", JSON.Encode.string(query))])),
   )
-  let rec attempt = async (n: int): JSON.t => {
+  let rec attempt = async (n: int): outcome => {
     let res = try await fetch(t.config.endpoint, {method: "POST", headers, body}) catch {
-    | _ =>
-      throw(Failed(`${label}: cannot reach ${t.config.endpoint} — is the platform running?`))
+    | _ => throw(Failed(`${label}: cannot reach ${t.config.endpoint} — is the platform running?`))
     }
     let json = await res->responseJson
     switch json->field("errors") {
@@ -283,20 +343,52 @@ let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
         | Some(summary) => `\n  identity: ${summary}`
         | None => ""
         }
-        throw(
-          Failed(
-            `${label} failed\n  query: ${query}\n  response: ${JSON.stringify(
-                errors,
-              )}${identity}${tried}`,
-          ),
-        )
+        Errors({
+          errors,
+          message: `${label} failed\n  query: ${query}\n  response: ${JSON.stringify(
+              errors,
+            )}${identity}${tried}`,
+        })
       }
-    | None => json->field("data")->Option.getOr(JSON.Encode.null)
+    | None => Data(json->field("data")->Option.getOr(JSON.Encode.null))
     }
   }
   await attempt(1)
 }
 
+let gql = async (t: t, ~query: string, ~label: string): JSON.t =>
+  switch await gqlOutcome(t, ~query, ~label) {
+  | Data(data) => data
+  | Errors({message}) => throw(Failed(message))
+  }
+
+/**
+ * Whether the endpoint let this caller through, for a probe that means to find
+ * out rather than to succeed.
+ *
+ * Three outcomes and not two: "not refused" and "worked" are different claims,
+ * and collapsing them would let a misspelled field name read as a passing
+ * authorization check. `Granted` covers a domain rejection too — a
+ * `CommandRejected` arrives inside `data` with no GraphQL error, which is
+ * precisely how a probe confirms access without writing anything.
+ */
+type access =
+  | Granted
+  | Refused
+  | // Served, and carrying nothing. Its own case because the two platforms deny a
+  // read differently: AppSync answers `Unauthorized`, while the local resolver's
+  // interceptor returns an empty connection — so on local an unauthorized read
+  // and an empty view are the same response, and no caller can tell them apart.
+  // Naming it lets a probe say "consistent with a denial" instead of guessing.
+  Empty
+  | Broke(string)
+
+let checkAccess = async (t: t, ~query: string, ~label: string): access =>
+  switch await gqlOutcome(t, ~query, ~label) {
+  | Data(_) => Granted
+  | Errors({errors, message}) => errors->isDenied ? Refused : Broke(message)
+  }
+
 // ── Commands ────────────────────────────────────────────────────────────────
 
 let commandResultSelection = `__typename
@@ -328,6 +420,61 @@ let send = async (t: t, m: mutation, ~tolerate: array<string>=[]): option<string
   }
 }
 
+/**
+ * Whether this caller may issue one command — asked with the very document
+ * `send` would have sent, so what the probe tests is what the seed actually
+ * uses rather than a hand-built lookalike.
+ *
+ * Pair it with a payload the domain would refuse anyway. Then `Granted` arrives
+ * as a `CommandRejected` inside `data`, which appends nothing: the probe learns
+ * that the door opened without walking through it, and a regression that wrongly
+ * opens a door still writes no events.
+ */
+/** Refusal codes a command result carries. The two platforms answer a refused
+    command differently — AppSync rejects at the field and produces a GraphQL
+    `Unauthorized` error, while the local resolver runs the command handler and
+    answers `CommandRejected { errorCode: "Forbidden" }` inside `data`. Reading
+    only the first reports the second as allowed. */
+let deniedCommandCodes = ["Forbidden", "Unauthorized", "AccessDenied"]
+
+let isDeniedResult = (result: JSON.t): bool =>
+  switch (result->nodeString("errorCode"), result->nodeString("errorDetail")) {
+  | (Some(code), _) if deniedCommandCodes->Array.includes(code) => true
+  | (_, Some(detail)) => detail->String.toLowerCase->String.includes("not authorized")
+  | _ => false
+  }
+
+let checkCommandAccess = async (t: t, m: mutation): access =>
+  switch await gqlOutcome(
+    t,
+    ~query=`mutation { r: ${m.field}(${m.args->renderArgs}) { ${commandResultSelection} } }`,
+    ~label=m->describe,
+  ) {
+  | Errors({errors, message}) => errors->isDenied ? Refused : Broke(message)
+  // No GraphQL error is not yet a grant: the local platform's refusal lives in
+  // the command result, so the domain's own answer has to be read too. Any other
+  // rejection IS a grant — the door opened and the domain refused what came
+  // through it, which is exactly the outcome a non-writing probe wants.
+  | Data(data) =>
+    data->field("r")->Option.getOr(JSON.Encode.null)->isDeniedResult ? Refused : Granted
+  }
+
+/** Whether this caller may read one connection field. One row is enough: the
+    door is answered by the first request, not by the page behind it — but
+    whether a row came back is what separates a grant from a silent denial. */
+let checkQueryAccess = async (t: t, ~field as fieldName: string): access => {
+  let query = `{ ${fieldName}(first: 1) { edges { node { id } } } }`
+  switch await gqlOutcome(t, ~query, ~label=fieldName) {
+  | Errors({errors, message}) => errors->isDenied ? Refused : Broke(message)
+  | Data(data) =>
+    let edges = switch data->field(fieldName)->Option.flatMap(c => c->field("edges")) {
+    | Some(Array(rows)) => rows->Array.length
+    | _ => 0
+    }
+    edges > 0 ? Granted : Empty
+  }
+}
+
 let sendAll = async (t: t, mutations: array<mutation>): unit =>
   for i in 0 to mutations->Array.length - 1 {
     switch mutations->Array.get(i) {
@@ -342,12 +489,12 @@ let sendAll = async (t: t, mutations: array<mutation>): unit =>
  * Walks a Relay-style connection to the end. Connections page at 50 by default,
  * so any count taken from a single request silently truncates.
  */
-// `~args` is spliced into the connection's argument list — `"includeRetired: true"`
+let // `~args` is spliced into the connection's argument list — `"includeRetired: true"`
 // is the case it exists for, and the only way to read rows the resolvers withhold
 // by default. Literal GraphQL rather than a typed argument list because a seed
 // writes the query it means; the alternative is a builder that has to grow a case
 // per argument the platform adds.
-let queryAllNodes = async (
+queryAllNodes = async (
   t: t,
   ~field as fieldName: string,
   ~selection: string,
@@ -463,8 +610,9 @@ let waitForIds = async (
         missing->Array.length > 10 ? ` (+${(missing->Array.length - 10)->Int.toString} more)` : ""
       throw(
         Failed(
-          `only ${(found->Array.length)->Int.toString}/${(ids->Array.length)
-              ->Int.toString} ids reached ${fieldName} within ${timeoutMs->Int.toString}ms.\n  missing: ${shown}${extra}`,
+          `only ${found->Array.length->Int.toString}/${ids
+            ->Array.length
+            ->Int.toString} ids reached ${fieldName} within ${timeoutMs->Int.toString}ms.\n  missing: ${shown}${extra}`,
         ),
       )
     } else {

package/lib/bs/src/Seed_Client.res.mjs

@@ -37,6 +37,11 @@ let groupClaimNames = [
   "groups"
 ];
 
+let callerIdClaimNames = [
+  "sub",
+  "userId"
+];
+
 function decodeSegment(segment) {
   try {
     return Stdlib_JSON.Decode.object(JSON.parse(Buffer.from(segment, "base64url").toString("utf8")));
@@ -45,12 +50,20 @@ function decodeSegment(segment) {
   }
 }
 
+function isJoseHeader(obj) {
+  return Stdlib_Option.isSome(obj["alg"]);
+}
+
 function claims(t) {
   return Stdlib_Option.flatMap(t.token, token => Stdlib_Array.reduce(token.split("."), undefined, (found, segment) => {
     if (found !== undefined) {
       return found;
+    }
+    let obj = decodeSegment(segment);
+    if (obj !== undefined && Stdlib_Option.isSome(obj["alg"])) {
+      return;
     } else {
-      return decodeSegment(segment);
+      return obj;
     }
   }));
 }
@@ -81,6 +94,23 @@ function effectiveGroups(t) {
   });
 }
 
+function callerId(t) {
+  return Stdlib_Array.reduce(callerIdClaimNames, undefined, (found, name) => {
+    if (found !== undefined) {
+      return found;
+    } else {
+      return Stdlib_Option.flatMap(Stdlib_Option.flatMap(claims(t), c => c[name]), Stdlib_JSON.Decode.string);
+    }
+  });
+}
+
+function narrowedFrom(t) {
+  let available = claimStrings(t, availableRolesClaim);
+  if (available !== undefined && available.length !== 0) {
+    return available;
+  }
+}
+
 function identitySummary(t) {
   return Stdlib_Option.map(effectiveGroups(t), groups => {
     let held = groups.length === 0 ? "no groups" : groups.join(", ");
@@ -213,7 +243,7 @@ function isDenied(errors) {
   }
 }
 
-async function gql(t, query, label) {
+async function gqlOutcome(t, query, label) {
   let headers = Object.fromEntries([[
       "content-type",
       "application/json"
@@ -244,7 +274,10 @@ async function gql(t, query, label) {
     let json = await res.json();
     let errors = field(json, "errors");
     if (errors === undefined) {
-      return Stdlib_Option.getOr(field(json, "data"), null);
+      return {
+        TAG: "Data",
+        _0: Stdlib_Option.getOr(field(json, "data"), null)
+      };
     }
     if (isTransient(errors) && n < 4) {
       await sleep((250 * (1 << (n - 1 | 0)) | 0) + (Math.random() * 250 | 0) | 0);
@@ -253,15 +286,45 @@ async function gql(t, query, label) {
     let tried = n > 1 ? `\n  gave up after ` + n.toString() + ` attempts` : "";
     let summary = isDenied(errors) ? identitySummary(t) : undefined;
     let identity = summary !== undefined ? `\n  identity: ` + summary : "";
-    throw {
-      RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
-      _1: label + ` failed\n  query: ` + query + `\n  response: ` + JSON.stringify(errors) + identity + tried,
-      Error: new Error()
+    return {
+      TAG: "Errors",
+      _0: {
+        errors: errors,
+        message: label + ` failed\n  query: ` + query + `\n  response: ` + JSON.stringify(errors) + identity + tried
+      }
     };
   };
   return await attempt(1);
 }
 
+async function gql(t, query, label) {
+  let data = await gqlOutcome(t, query, label);
+  if (data.TAG === "Data") {
+    return data._0;
+  }
+  throw {
+    RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+    _1: data._0.message,
+    Error: new Error()
+  };
+}
+
+async function checkAccess(t, query, label) {
+  let match = await gqlOutcome(t, query, label);
+  if (match.TAG === "Data") {
+    return "Granted";
+  }
+  let match$1 = match._0;
+  if (isDenied(match$1.errors)) {
+    return "Refused";
+  } else {
+    return {
+      TAG: "Broke",
+      _0: match$1.message
+    };
+  }
+}
+
 let commandResultSelection = `__typename
   ... on CommandAccepted { eventCount }
   ... on CommandRejected { errorCode errorDetail }`;
@@ -291,6 +354,68 @@ async function send(t, m, tolerateOpt) {
   };
 }
 
+let deniedCommandCodes = [
+  "Forbidden",
+  "Unauthorized",
+  "AccessDenied"
+];
+
+function isDeniedResult(result) {
+  let match = nodeString(result, "errorCode");
+  let match$1 = nodeString(result, "errorDetail");
+  if (match !== undefined && deniedCommandCodes.includes(match)) {
+    return true;
+  }
+  if (match$1 !== undefined) {
+    return match$1.toLowerCase().includes("not authorized");
+  } else {
+    return false;
+  }
+}
+
+async function checkCommandAccess(t, m) {
+  let data = await gqlOutcome(t, `mutation { r: ` + m.field + `(` + Seed_Types$ReventlessSeed.renderArgs(m.args) + `) { ` + commandResultSelection + ` } }`, Seed_Types$ReventlessSeed.describe(m));
+  if (data.TAG === "Data") {
+    if (isDeniedResult(Stdlib_Option.getOr(field(data._0, "r"), null))) {
+      return "Refused";
+    } else {
+      return "Granted";
+    }
+  }
+  let match = data._0;
+  if (isDenied(match.errors)) {
+    return "Refused";
+  } else {
+    return {
+      TAG: "Broke",
+      _0: match.message
+    };
+  }
+}
+
+async function checkQueryAccess(t, fieldName) {
+  let query = `{ ` + fieldName + `(first: 1) { edges { node { id } } } }`;
+  let data = await gqlOutcome(t, query, fieldName);
+  if (data.TAG === "Data") {
+    let match = Stdlib_Option.flatMap(field(data._0, fieldName), c => field(c, "edges"));
+    let edges = Array.isArray(match) ? match.length : 0;
+    if (edges > 0) {
+      return "Granted";
+    } else {
+      return "Empty";
+    }
+  }
+  let match$1 = data._0;
+  if (isDenied(match$1.errors)) {
+    return "Refused";
+  } else {
+    return {
+      TAG: "Broke",
+      _0: match$1.message
+    };
+  }
+}
+
 async function sendAll(t, mutations) {
   for (let i = 0, i_finish = mutations.length; i < i_finish; ++i) {
     let m = mutations[i];
@@ -407,11 +532,15 @@ export {
   activeRoleClaim,
   availableRolesClaim,
   groupClaimNames,
+  callerIdClaimNames,
   decodeSegment,
+  isJoseHeader,
   claims,
   asStrings,
   claimStrings,
   effectiveGroups,
+  callerId,
+  narrowedFrom,
   identitySummary,
   field,
   asString,
@@ -421,9 +550,15 @@ export {
   isTransient,
   isDenied,
   attempts,
+  gqlOutcome,
   gql,
+  checkAccess,
   commandResultSelection,
   send,
+  deniedCommandCodes,
+  isDeniedResult,
+  checkCommandAccess,
+  checkQueryAccess,
   sendAll,
   queryAllNodes,
   countNodes,