@reventlessdev/reventless-seed 1.0.0-alpha.20 → 1.0.0-alpha.22

package/src/Seed_Connect.res

@@ -9,6 +9,45 @@
 
 open Seed_Types
 
+// ── Active role ───────────────────────────────────────────────────────────────
+//
+// Both platforms narrow a token to the single role the caller last chose, and on
+// Cognito that choice is STORED — so an operator who acted as one role in the
+// host shell gets a narrowed token from the next seed login, days later, with
+// nothing in the seed's own environment to explain it. That is a refusal on the
+// first gated call and no way out of the terminal.
+
+/**
+ * Applies an active-role choice, if the platform offers one. `None` clears the
+ * choice and widens back to the caller's full membership.
+ *
+ * Returns the fresh bearer when the platform mints one itself, and `None` when
+ * the choice is merely stored and a re-authentication is what picks it up. The
+ * two platforms genuinely differ here: the local server re-issues on the spot,
+ * while Cognito's pre-token-generation trigger reads the stored row on the next
+ * login, so nothing changes until the seed authenticates again.
+ *
+ * Supplied by the platform adapter for the reason `~login` is: this package must
+ * not learn which provider signed the token, and the routes are not alike — a
+ * GraphQL mutation on one, an HTTP endpoint on the other.
+ */
+type roleSwitch = (~client: Seed_Client.t, ~role: option<string>) => promise<option<string>>
+
+/** What a run should act as. `Full` is the default because seeding wants every
+    right the account has; `Narrowed` exists so a run can deliberately act as one
+    role — the only way to exercise what a restricted caller is refused. */
+type roleChoice = Full | Narrowed(string)
+
+// `SEED_ROLE`: a role name, or `full`/`all` to clear. Honoured whether or not the
+// token arrived narrowed, so a deliberate narrowed run needs no TTY.
+let roleFromEnv = (): option<roleChoice> =>
+  Seed_Prompt.envValue("SEED_ROLE")->Option.map(v =>
+    switch v->String.toLowerCase {
+    | "full" | "all" | "none" | "clear" => Full
+    | _ => Narrowed(v)
+    }
+  )
+
 // Under route B the client mints uploads through the domain API's `Upload_Presign`
 // mutation (authenticated by the same bearer as commands), so a connection needs no
 // upload endpoint — just the authenticated client and whether uploads are skipped this
@@ -17,35 +56,168 @@ type connection = {
   client: Seed_Client.t,
   uploadsSkipped: bool,
   label: string,
+  // Every account the platform's accounts file declares — `[]` when there was no
+  // file, since the `REVENTLESS_DEMO_USER`/`REVENTLESS_DEMO_PASSWORD` path
+  // bypasses it entirely. A data set resolves a demo owner through this, so the
+  // id it seeds is the id the platform stamps rather than a literal that only
+  // happens to match one platform's accounts.
+  accounts: array<Seed_Users.user>,
+  // The account this run authenticated as, and the id its bearer actually
+  // carries — which is the only id available when there is no accounts file.
+  caller: Seed_Users.user,
+  callerId: option<string>,
+  // The login this run authenticated with, kept so a data set can mint a second
+  // client for another account. An owner-scoped read is only ever verified by
+  // the account the rows belong to: the seeding client is elevated, and an
+  // elevated token answers for every owner at once.
+  login: (~username: string, ~password: string) => promise<string>,
+  // How this platform stores an active-role choice, when it offers one at all.
+  // `None` means the deployment has no such door (a unified-mode AWS API does
+  // not carry `Platform_SetActiveRole`), and a narrowing can then only be
+  // reported, not fixed from here.
+  roleSwitch: option<roleSwitch>,
 }
 
+let announceIdentity = (client: Seed_Client.t, ~prefix: string="Acting as"): unit =>
+  switch Seed_Client.identitySummary(client) {
+  | Some(summary) => Console.log(`${prefix}: ${summary}`)
+  | None => ()
+  }
+
+/**
+ * Applies a role choice and leaves `client` holding a bearer that reflects it.
+ *
+ * The re-authentication is not optional bookkeeping: on Cognito the stored row
+ * is read at token generation, so a run that set a role and kept its old bearer
+ * would carry on with exactly the token it just tried to change.
+ */
+let applyRole = async (
+  ~client: Seed_Client.t,
+  ~roleSwitch: roleSwitch,
+  ~login: (~username: string, ~password: string) => promise<string>,
+  ~caller: Seed_Users.user,
+  ~role: option<string>,
+): unit => {
+  let minted = await roleSwitch(~client, ~role)
+  let token = switch minted {
+  | Some(fresh) => fresh
+  | None => await login(~username=caller.username, ~password=caller.password)
+  }
+  client->Seed_Client.useToken(token)
+  // A second line rather than a replacement, and worded so the pair reads as a
+  // change: the first says what the login gave, this says what the run proceeds
+  // under, and a reader needs both to see that the switch actually took.
+  client->announceIdentity(~prefix="Now acting as")
+}
+
+/**
+ * Chooses what the run acts as, when the platform lets it choose.
+ *
+ * Deliberately quiet on a healthy run: an unnarrowed token has nothing to ask
+ * about, so the common case gains no prompt. The menu appears only when the
+ * bearer arrived narrowed — the case where the account list says one thing and
+ * the token another, which is unreadable from the terminal without it.
+ *
+ * `SEED_ROLE` answers non-interactively and is honoured even when the token is
+ * NOT narrowed, which is what makes a deliberate restricted run possible: acting
+ * as one role is the only way to exercise what a restricted caller is refused.
+ *
+ * Without a TTY and without `SEED_ROLE` it proceeds untouched rather than
+ * throwing. A narrowing is not always fatal — narrowed to Admin is fine — so
+ * refusing to start would break runs that would have worked.
+ */
+let resolveRole = async (
+  ~client: Seed_Client.t,
+  ~roleSwitch: option<roleSwitch>,
+  ~login: (~username: string, ~password: string) => promise<string>,
+  ~caller: Seed_Users.user,
+): unit =>
+  switch roleSwitch {
+  | None => ()
+  | Some(roleSwitch) =>
+    let narrowedFrom = Seed_Client.narrowedFrom(client)
+    let chosen = switch roleFromEnv() {
+    | Some(choice) => Some(choice)
+    | None =>
+      switch narrowedFrom {
+      | Some(available) if available->Array.length > 1 && Seed_Prompt.hasTty() =>
+        Console.log("")
+        Console.log(
+          "This token is narrowed to one role. Seeding needs every right the account has;",
+        )
+        Console.log("clearing also widens your host-shell session, which shares the stored choice.")
+        let options = Array.concat(
+          [(`full membership (${available->Array.join(", ")})`, Full)],
+          available->Array.map(r => (r, Narrowed(r))),
+        )
+        Some(await Seed_Prompt.select(~title="Act as:", ~options, ~defaultIndex=0))
+      | _ => None
+      }
+    }
+    switch chosen {
+    | None => ()
+    | Some(Full) => await applyRole(~client, ~roleSwitch, ~login, ~caller, ~role=None)
+    | Some(Narrowed(role)) =>
+      await applyRole(~client, ~roleSwitch, ~login, ~caller, ~role=Some(role))
+    }
+  }
+
 /**
  * Prompts for credentials, calls `login` to mint a bearer, and returns a
  * connection with that bearer already applied. `login` returns the bearer so a
  * single `useToken` path serves every provider.
+ *
+ * `roleSwitch` is the platform's active-role door, when it has one; supplying it
+ * is what lets a narrowed token be widened here instead of in a browser.
  */
 let make = async (
   ~label: string,
   ~endpoint: string,
   ~login: (~username: string, ~password: string) => promise<string>,
+  ~roleSwitch: option<roleSwitch>=?,
   ~localDefaults: bool=false,
 ): connection => {
   // `SEED_SKIP_UPLOADS` forces the upload phase to no-op — seed domain data fast, or
   // skip a broken/absent upload path without editing the data set. The data set reads
   // `connection.uploadsSkipped` and reports the skip.
   let uploadsSkipped = Seed_Upload.uploadsSkipped()
-  let (username, password) = await Seed_Prompt.credentials(~localDefaults)
-  let token = await login(~username, ~password)
+  let {caller, accounts} = await Seed_Prompt.credentials(~localDefaults)
+  let token = await login(~username=caller.username, ~password=caller.password)
   let client = Seed_Client.make(~config={endpoint: endpoint})
   client->Seed_Client.useToken(token)
   // What the bearer grants, which is not always what the account list showed: a
   // token narrowed to one role presents that role alone. Said at login so the
   // run starts from the identity it will actually be refused or served under.
-  switch Seed_Client.identitySummary(client) {
-  | Some(summary) => Console.log(`Acting as: ${summary}`)
-  | None => ()
+  announceIdentity(client)
+  // Offered before anything is probed or written, so a narrowing is settled
+  // while the run can still be redirected rather than after a refusal.
+  await resolveRole(~client, ~roleSwitch, ~login, ~caller)
+  {
+    client,
+    uploadsSkipped,
+    label,
+    accounts,
+    caller,
+    callerId: Seed_Client.callerId(client),
+    login,
+    roleSwitch,
   }
-  {client, uploadsSkipped, label}
+}
+
+/**
+ * A second authenticated client, for one of the accounts the platform's accounts
+ * file declares. Same endpoint, same login route, a different bearer.
+ *
+ * It exists so a data set can read back what it seeded as the account the rows
+ * belong to. The seeding client cannot answer that question: it is elevated, so
+ * an owner-scoped view counts every owner's rows for it and reads non-empty
+ * whether or not a single row is reachable by the person it was seeded for.
+ */
+let clientFor = async (c: connection, ~account: Seed_Users.user): Seed_Client.t => {
+  let token = await c.login(~username=account.username, ~password=account.password)
+  let client = Seed_Client.make(~config={endpoint: Seed_Client.endpoint(c.client)})
+  client->Seed_Client.useToken(token)
+  client
 }
 
 /**
@@ -53,19 +225,77 @@ let make = async (
  * `/__inmemory/login` shape: POST `{username, password}` → `{token}`). Reuses
  * `Seed_Client.login` but hands the token back for `useToken`.
  */
-let viaLoginEndpoint = (~loginEndpoint: string) => async (
-  ~username: string,
-  ~password: string,
-): string => {
-  let client = Seed_Client.make(
-    ~config={endpoint: loginEndpoint, loginEndpoint, username, password},
-  )
-  await Seed_Client.login(client)
-  switch Seed_Client.currentToken(client) {
-  | Some(token) => token
-  | None => throw(Failed(`login at ${loginEndpoint} returned no token`))
+let viaLoginEndpoint = (~loginEndpoint: string) =>
+  async (~username: string, ~password: string): string => {
+    let client = Seed_Client.make(
+      ~config={endpoint: loginEndpoint, loginEndpoint, username, password},
+    )
+    await Seed_Client.login(client)
+    switch Seed_Client.currentToken(client) {
+    | Some(token) => token
+    | None => throw(Failed(`login at ${loginEndpoint} returned no token`))
+    }
+  }
+
+/**
+ * The local dev platform's active-role door: POST `/__inmemory/switch-role` with
+ * `{activeRole}` (null to clear) and the current bearer, which answers with a
+ * freshly minted one.
+ *
+ * The local server re-issues on the spot rather than storing a choice, so this
+ * returns the new token and no re-authentication follows. Its narrowing is also
+ * per-session, which is why a local seed never arrives narrowed on its own —
+ * this exists for a *deliberate* `SEED_ROLE` run, which is where a restricted
+ * caller's refusals can be exercised without a deployed stack.
+ */
+let viaSwitchRoleEndpoint = (~switchRoleEndpoint: string): roleSwitch =>
+  async (~client: Seed_Client.t, ~role: option<string>) => {
+    let token = switch Seed_Client.currentToken(client) {
+    | Some(t) => t
+    | None => throw(Failed("switch-role: no bearer to present — log in first"))
+    }
+    // Clearing OMITS the key rather than sending `null`. The local handler reads
+    // its body through `Obj.magic` into an `option<string>`, and ReScript spells
+    // absence `undefined` — so a JSON `null` arrives as a present value and the
+    // server tries to act as a role literally named "null", refusing with
+    // `Cannot act as "null": not a group this user holds`. An absent key is the
+    // only thing it reads as "no role", which is what widens back to full.
+    let body = JSON.stringify(
+      JSON.Encode.object(
+        switch role {
+        | Some(r) => Dict.fromArray([("activeRole", JSON.Encode.string(r))])
+        | None => Dict.make()
+        },
+      ),
+    )
+    let res = try await Seed_Client.fetch(
+      switchRoleEndpoint,
+      {
+        method: "POST",
+        headers: Dict.fromArray([
+          ("content-type", "application/json"),
+          ("authorization", `Bearer ${token}`),
+        ]),
+        body,
+      },
+    ) catch {
+    | _ => throw(Failed(`switch-role: cannot reach ${switchRoleEndpoint}`))
+    }
+    let json = await res->Seed_Client.responseJson
+    if !(res->Seed_Client.responseOk) {
+      throw(
+        Failed(
+          `switch-role at ${switchRoleEndpoint} failed with HTTP ${res
+            ->Seed_Client.responseStatus
+            ->Int.toString}: ${JSON.stringify(json)}`,
+        ),
+      )
+    }
+    switch json->Seed_Client.field("token")->Option.flatMap(Seed_Client.asString) {
+    | Some(fresh) => Some(fresh)
+    | None => throw(Failed(`switch-role at ${switchRoleEndpoint} returned no token`))
+    }
   }
-}
 
 let envOr = (key: string, fallback: string): string =>
   Seed_Prompt.envValue(key)->Option.getOr(fallback)
@@ -82,12 +312,21 @@ let local = (~graphql=?, ~login=?, ()): (unit => promise<connection>) => {
   let endpoint =
     graphql->Option.getOr(envOr("REVENTLESS_GRAPHQL_ENDPOINT", "http://localhost:4000/graphql"))
   let loginEndpoint =
-    login->Option.getOr(envOr("REVENTLESS_LOGIN_ENDPOINT", "http://localhost:4000/__inmemory/login"))
+    login->Option.getOr(
+      envOr("REVENTLESS_LOGIN_ENDPOINT", "http://localhost:4000/__inmemory/login"),
+    )
+  // The switch-role route sits beside the login one on the same server, so it is
+  // derived rather than configured — a second env var could name a different
+  // host from the login it is supposed to re-issue, which is the mismatch
+  // `LocalSeedTarget.loginFor` exists to prevent one level up.
+  let switchRoleEndpoint =
+    loginEndpoint->String.replace("/__inmemory/login", "/__inmemory/switch-role")
   () =>
     make(
       ~label="local",
       ~endpoint,
       ~login=viaLoginEndpoint(~loginEndpoint),
+      ~roleSwitch=viaSwitchRoleEndpoint(~switchRoleEndpoint),
       ~localDefaults=true,
     )
 }

package/src/Seed_Connect.res.mjs

@@ -6,26 +6,109 @@ import * as Seed_Client$ReventlessSeed from "./Seed_Client.res.mjs";
 import * as Seed_Prompt$ReventlessSeed from "./Seed_Prompt.res.mjs";
 import * as Seed_Upload$ReventlessSeed from "./Seed_Upload.res.mjs";
 
-async function make(label, endpoint, login, localDefaultsOpt) {
+function roleFromEnv() {
+  return Stdlib_Option.map(Seed_Prompt$ReventlessSeed.envValue("SEED_ROLE"), v => {
+    let match = v.toLowerCase();
+    switch (match) {
+      case "all" :
+      case "clear" :
+      case "full" :
+      case "none" :
+        return "Full";
+      default:
+        return {
+          TAG: "Narrowed",
+          _0: v
+        };
+    }
+  });
+}
+
+function announceIdentity(client, prefixOpt) {
+  let prefix = prefixOpt !== undefined ? prefixOpt : "Acting as";
+  let summary = Seed_Client$ReventlessSeed.identitySummary(client);
+  if (summary !== undefined) {
+    console.log(prefix + `: ` + summary);
+    return;
+  }
+}
+
+async function applyRole(client, roleSwitch, login, caller, role) {
+  let minted = await roleSwitch(client, role);
+  let token = minted !== undefined ? minted : await login(caller.username, caller.password);
+  Seed_Client$ReventlessSeed.useToken(client, token);
+  return announceIdentity(client, "Now acting as");
+}
+
+async function resolveRole(client, roleSwitch, login, caller) {
+  if (roleSwitch === undefined) {
+    return;
+  }
+  let narrowedFrom = Seed_Client$ReventlessSeed.narrowedFrom(client);
+  let choice = roleFromEnv();
+  let chosen;
+  if (choice !== undefined) {
+    chosen = choice;
+  } else if (narrowedFrom !== undefined && narrowedFrom.length > 1 && Seed_Prompt$ReventlessSeed.hasTty()) {
+    console.log("");
+    console.log("This token is narrowed to one role. Seeding needs every right the account has;");
+    console.log("clearing also widens your host-shell session, which shares the stored choice.");
+    let options = [[
+        `full membership (` + narrowedFrom.join(", ") + `)`,
+        "Full"
+      ]].concat(narrowedFrom.map(r => [
+      r,
+      {
+        TAG: "Narrowed",
+        _0: r
+      }
+    ]));
+    chosen = await Seed_Prompt$ReventlessSeed.select("Act as:", options, undefined, 0);
+  } else {
+    chosen = undefined;
+  }
+  if (chosen !== undefined) {
+    if (typeof chosen !== "object") {
+      return await applyRole(client, roleSwitch, login, caller, undefined);
+    } else {
+      return await applyRole(client, roleSwitch, login, caller, chosen._0);
+    }
+  }
+}
+
+async function make(label, endpoint, login, roleSwitch, localDefaultsOpt) {
   let localDefaults = localDefaultsOpt !== undefined ? localDefaultsOpt : false;
   let uploadsSkipped = Seed_Upload$ReventlessSeed.uploadsSkipped();
   let match = await Seed_Prompt$ReventlessSeed.credentials(localDefaults);
-  let token = await login(match[0], match[1]);
+  let caller = match.caller;
+  let token = await login(caller.username, caller.password);
   let client = Seed_Client$ReventlessSeed.make({
     endpoint: endpoint
   });
   Seed_Client$ReventlessSeed.useToken(client, token);
-  let summary = Seed_Client$ReventlessSeed.identitySummary(client);
-  if (summary !== undefined) {
-    console.log(`Acting as: ` + summary);
-  }
+  announceIdentity(client, undefined);
+  await resolveRole(client, roleSwitch, login, caller);
   return {
     client: client,
     uploadsSkipped: uploadsSkipped,
-    label: label
+    label: label,
+    accounts: match.accounts,
+    caller: caller,
+    callerId: Seed_Client$ReventlessSeed.callerId(client),
+    login: login,
+    roleSwitch: roleSwitch
   };
 }
 
+async function clientFor(c, account) {
+  let token = await c.login(account.username, account.password);
+  let client = Seed_Client$ReventlessSeed.make({
+    endpoint: Seed_Client$ReventlessSeed.endpoint(c.client)
+  });
+  Seed_Client$ReventlessSeed.useToken(client, token);
+  return client;
+}
+
 function viaLoginEndpoint(loginEndpoint) {
   return async (username, password) => {
     let client = Seed_Client$ReventlessSeed.make({
@@ -47,6 +130,66 @@ function viaLoginEndpoint(loginEndpoint) {
   };
 }
 
+function viaSwitchRoleEndpoint(switchRoleEndpoint) {
+  return async (client, role) => {
+    let t = Seed_Client$ReventlessSeed.currentToken(client);
+    let token;
+    if (t !== undefined) {
+      token = t;
+    } else {
+      throw {
+        RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+        _1: "switch-role: no bearer to present — log in first",
+        Error: new Error()
+      };
+    }
+    let body = JSON.stringify(role !== undefined ? Object.fromEntries([[
+          "activeRole",
+          role
+        ]]) : ({}));
+    let res;
+    try {
+      res = await fetch(switchRoleEndpoint, {
+        method: "POST",
+        headers: Object.fromEntries([
+          [
+            "content-type",
+            "application/json"
+          ],
+          [
+            "authorization",
+            `Bearer ` + token
+          ]
+        ]),
+        body: body
+      });
+    } catch (exn) {
+      throw {
+        RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+        _1: `switch-role: cannot reach ` + switchRoleEndpoint,
+        Error: new Error()
+      };
+    }
+    let json = await res.json();
+    if (!res.ok) {
+      throw {
+        RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+        _1: `switch-role at ` + switchRoleEndpoint + ` failed with HTTP ` + res.status.toString() + `: ` + JSON.stringify(json),
+        Error: new Error()
+      };
+    }
+    let fresh = Stdlib_Option.flatMap(Seed_Client$ReventlessSeed.field(json, "token"), Seed_Client$ReventlessSeed.asString);
+    if (fresh !== undefined) {
+      return fresh;
+    }
+    throw {
+      RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+      _1: `switch-role at ` + switchRoleEndpoint + ` returned no token`,
+      Error: new Error()
+    };
+  };
+}
+
 function envOr(key, fallback) {
   return Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue(key), fallback);
 }
@@ -54,12 +197,19 @@ function envOr(key, fallback) {
 function local(graphql, login, param) {
   let endpoint = Stdlib_Option.getOr(graphql, Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_GRAPHQL_ENDPOINT"), "http://localhost:4000/graphql"));
   let loginEndpoint = Stdlib_Option.getOr(login, Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_LOGIN_ENDPOINT"), "http://localhost:4000/__inmemory/login"));
-  return () => make("local", endpoint, viaLoginEndpoint(loginEndpoint), true);
+  let switchRoleEndpoint = loginEndpoint.replace("/__inmemory/login", "/__inmemory/switch-role");
+  return () => make("local", endpoint, viaLoginEndpoint(loginEndpoint), viaSwitchRoleEndpoint(switchRoleEndpoint), true);
 }
 
 export {
+  roleFromEnv,
+  announceIdentity,
+  applyRole,
+  resolveRole,
   make,
+  clientFor,
   viaLoginEndpoint,
+  viaSwitchRoleEndpoint,
   envOr,
   local,
 }

package/src/Seed_Prompt.res

@@ -63,12 +63,16 @@ let envValue = (key: string): option<string> =>
   | _ => None
   }
 
+/** Whether an interactive prompt is possible at all. Callers that can carry on
+    without an answer ask this first; a prompt nobody can answer is worse than a
+    default, because it turns a workable run into a hang or a throw. */
+let hasTty = (): bool => NodeProcess.stdin->NodeProcess.isTTY->Option.getOr(false)
+
 let requireTty = (): unit =>
-  if !(NodeProcess.stdin->NodeProcess.isTTY->Option.getOr(false)) {
+  if !hasTty() {
     throw(
       Failed(
-        "no TTY for an interactive prompt — set the documented SEED_* / REVENTLESS_DEMO_* " ++
-        "env vars to run non-interactively.",
+        "no TTY for an interactive prompt — set the documented SEED_* / REVENTLESS_DEMO_* " ++ "env vars to run non-interactively.",
       ),
     )
   }
@@ -125,12 +129,7 @@ let isAffirmative = (answer: string): bool =>
  * `defaultIndex` makes Enter a valid answer, selecting that 0-based option;
  * without one every reply must name a choice.
  */
-let select = async (
-  ~title: string,
-  ~options: array<(string, 'a)>,
-  ~env=?,
-  ~defaultIndex=?,
-): 'a =>
+let select = async (~title: string, ~options: array<(string, 'a)>, ~env=?, ~defaultIndex=?): 'a =>
   switch options {
   | [(_, only)] => only
   | _ =>
@@ -163,9 +162,7 @@ let select = async (
       | _ => ""
       }
       let rec pick = async (): 'a => {
-        let answer = await ask(
-          `\nSelect [1-${(options->Array.length)->Int.toString}]${hint}: `,
-        )
+        let answer = await ask(`\nSelect [1-${options->Array.length->Int.toString}]${hint}: `)
         switch (answer, fallback) {
         | ("", Some((_, value))) => value
         | _ =>
@@ -183,11 +180,31 @@ let select = async (
     }
   }
 
+/**
+ * The account a run authenticated as, alongside every account the platform's
+ * accounts file declares.
+ *
+ * `accounts` is `[]` whenever no file was read — the
+ * `REVENTLESS_DEMO_USER`/`REVENTLESS_DEMO_PASSWORD` path bypasses it entirely,
+ * and so does typing both halves — so a consumer must handle empty rather than
+ * assume the file was there. `caller` is always populated, but carries no
+ * `groups` and no `userId` on those paths: nothing read them off a file.
+ */
+type resolved = {caller: Seed_Users.user, accounts: array<Seed_Users.user>}
+
+let typedUser = (~username: string, ~password: string): Seed_Users.user => {
+  username,
+  password,
+  groups: [],
+  userId: None,
+  demoOwner: None,
+}
+
 // Typing both halves is the fallback, not the first offer: it is what happens
 // when the platform keeps no accounts file. `envUser` is threaded in so a
 // `REVENTLESS_DEMO_USER` that named nobody in the file still skips the username
 // prompt rather than asking for a name that was already given.
-let askCredentials = async (~localDefaults: bool, ~envUser: option<string>): (string, string) => {
+let askCredentials = async (~localDefaults: bool, ~envUser: option<string>): Seed_Users.user => {
   let username = switch envUser {
   | Some(u) => u
   | None =>
@@ -202,7 +219,7 @@ let askCredentials = async (~localDefaults: bool, ~envUser: option<string>): (st
     let entered = await askHidden(localDefaults ? "Password [admin]: " : "Password: ")
     entered == "" && localDefaults ? "admin" : entered
   }
-  (username, password)
+  typedUser(~username, ~password)
 }
 
 // The accounts file the platform already keeps (`.reventless/users.yaml`, or
@@ -212,7 +229,12 @@ let askCredentials = async (~localDefaults: bool, ~envUser: option<string>): (st
 // A named `REVENTLESS_DEMO_USER` picks its entry directly; otherwise the file's
 // accounts are offered in the order it defines them, first as the default.
 // `None` means the file has nothing to offer and the caller should ask.
-let fromUsersFile = async (~envUser: option<string>): option<(string, string)> =>
+//
+// The whole list travels back with the chosen account, not just the credentials
+// it supplied: the file is also the only place a demo owner's id can be looked
+// up, and reading it once to pick a login and never again is what let a data set
+// seed rows under ids nobody on the platform holds.
+let fromUsersFile = async (~envUser: option<string>): option<resolved> =>
   switch Seed_Users.load(~path=?envValue("SEED_USERS_FILE")) {
   | None => None
   | Some((path, users)) =>
@@ -233,7 +255,7 @@ let fromUsersFile = async (~envUser: option<string>): option<(string, string)> =
     // operator checks when owner-scoped rows turn up under the wrong account.
     chosen->Option.map(u => {
       Console.log(`Logging in as ${u.username} (from ${path})`)
-      (u.username, u.password)
+      {caller: u, accounts: users}
     })
   }
 
@@ -245,19 +267,22 @@ let fromUsersFile = async (~envUser: option<string>): option<(string, string)> =
  * `.reventless/users.yaml` supplies the accounts to choose from, and only a
  * platform without one falls back to typing both halves — where, with
  * `localDefaults`, empty input means `admin`/`admin`.
+ *
+ * Returns the resolved account rather than a pair, and the accounts file
+ * alongside it when there was one — see `resolved`.
  */
-let credentials = async (~localDefaults: bool=false): (string, string) => {
+let credentials = async (~localDefaults: bool=false): resolved => {
   let envUser = envValue("REVENTLESS_DEMO_USER")
-  let (username, password) = switch (envUser, envValue("REVENTLESS_DEMO_PASSWORD")) {
-  | (Some(u), Some(p)) => (u, p)
+  let resolved = switch (envUser, envValue("REVENTLESS_DEMO_PASSWORD")) {
+  | (Some(username), Some(password)) => {caller: typedUser(~username, ~password), accounts: []}
   | _ =>
     switch await fromUsersFile(~envUser) {
-    | Some(pair) => pair
-    | None => await askCredentials(~localDefaults, ~envUser)
+    | Some(resolved) => resolved
+    | None => {caller: await askCredentials(~localDefaults, ~envUser), accounts: []}
     }
   }
-  if username == "" || password == "" {
+  if resolved.caller.username == "" || resolved.caller.password == "" {
     throw(Failed("username and password are required."))
   }
-  (username, password)
+  resolved
 }