@reventlessdev/online-shop-dcb-catalog 1.0.0-alpha.281 → 1.0.0-alpha.282

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.282 (2026-10-16)
+
+* feat!(inbound): a translation slice can declare a signed webhook URL ([0ad6994](https://github.com/ReventlessDev/reventless-core/commit/0ad69949fcc91c2756c60ca8cb120dd468841d8b))
+
+### BREAKING CHANGES
+
+* InboundTranslationSlice.Spec requires `endpoint`. Specs under
+@@reventless.spec get it from the PPX (republish reventless-ppx with this
+release); hand-written specs add `let endpoint = None`.
+
+
+
 # 1.0.0-alpha.281 (2026-10-16)
 
 **Note:** Version bump only for package @reventlessdev/online-shop-dcb-catalog

package/lib/bs/.compiler.log

@@ -1,2 +1,2 @@
-#Start(1792153343874)
-#Done(1792153346006)
+#Start(1792162610379)
+#Done(1792162613537)

package/lib/bs/compiler-info.json

@@ -4,5 +4,5 @@
   "bsc_hash": "1006241435e8d5052329c523202a7fe6359a37e1e1688c023d37d6a7ebb5fb6d",
   "rescript_config_hash": "ca6bf04caf4f6b27dbf31b935f934d99c6fe59248cc8b122f9cc48ff2675eb4a",
   "runtime_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/runtime",
-  "generated_at": "1792153346011"
+  "generated_at": "1792162613542"
 }

package/lib/bs/src/Plugin.res.mjs

@@ -282,7 +282,8 @@ function Make(Platform) {
     commandSchema: ImportProduct$CatalogPlugin.commandSchema,
     targetName: ImportProduct$CatalogPlugin.targetName,
     externalSystem: ImportProduct$CatalogPlugin.externalSystem,
-    authorizationOf: ImportProduct$CatalogPlugin.authorizationOf
+    authorizationOf: ImportProduct$CatalogPlugin.authorizationOf,
+    endpoint: ImportProduct$CatalogPlugin.endpoint
   })({
     translate: ImportProduct_Translation$CatalogPlugin.translate,
     moduleUrl: ImportProduct_Translation$CatalogPlugin.moduleUrl

package/lib/bs/src/Product/InboundTranslation/ImportProduct.res

@@ -1,7 +1,10 @@
 // ImportProduct InboundTranslationSlice.
 // Receives external supplier JSON, validates and translates to an AddProduct command.
+// The supplier posts to a signed webhook; the mutation stays as an operator's
+// replay door, which is why the command needs Admin rather than any signed-in user.
 
 @@reventless.spec
+@@reventless.authorize(AllowRoles([Admin]))
 
 @schema
 type externalInput = {
@@ -20,3 +23,17 @@ let targetName = "AddProduct"
 // Foreign system this anti-corruption slice receives product data from — drawn as an
 // external box outside the Catalog plugin in the Event Graph.
 let externalSystem = Some("SupplierFeed")
+
+// The supplier signs each post with the secret `supplierFeed`
+// (`pulumi config set --secret webhook:supplierFeed …` on AWS,
+// `REVENTLESS_WEBHOOK_SECRET_SUPPLIERFEED` locally); a signed post acts as Admin.
+let endpoint = Some({
+  Reventless.InboundTranslationSlice.path: "supplier-feed",
+  auth: SignedBody({
+    header: "X-Signature-256",
+    prefix: "sha256=",
+    timestampHeader: "X-Signature-Timestamp",
+    secret: "supplierFeed",
+  }),
+  role: Roles.Admin,
+})

package/lib/bs/src/Product/InboundTranslation/ImportProduct.res.mjs

@@ -21,7 +21,10 @@ let commandSchema = Sury.$schema(s => ({
 }));
 
 function authorizationOf(param) {
-  return "AllowAuthenticated";
+  return {
+    TAG: "AllowRoles",
+    _0: ["Admin"]
+  };
 }
 
 let traits = [];
@@ -34,6 +37,20 @@ let targetName = "AddProduct";
 
 let externalSystem = "SupplierFeed";
 
+let endpoint = {
+  path: "supplier-feed",
+  auth: {
+    TAG: "SignedBody",
+    _0: {
+      header: "X-Signature-256",
+      prefix: "sha256=",
+      timestampHeader: "X-Signature-Timestamp",
+      secret: "supplierFeed"
+    }
+  },
+  role: "Admin"
+};
+
 let moduleUrl = "@reventlessdev/online-shop-dcb-catalog/src/Product/InboundTranslation/ImportProduct.res.mjs";
 
 export {
@@ -43,6 +60,7 @@ export {
   commandSchema,
   targetName,
   externalSystem,
+  endpoint,
   moduleUrl,
   authorizationOf,
   traits,

package/lib/bs/tests/Product/InboundTranslation/ImportProduct_GWT.res.mjs

@@ -13,7 +13,8 @@ let include = InboundTranslation_GWT$ReventlessGwt.FromSlice({
   commandSchema: ImportProduct$CatalogPlugin.commandSchema,
   targetName: ImportProduct$CatalogPlugin.targetName,
   externalSystem: ImportProduct$CatalogPlugin.externalSystem,
-  authorizationOf: ImportProduct$CatalogPlugin.authorizationOf
+  authorizationOf: ImportProduct$CatalogPlugin.authorizationOf,
+  endpoint: ImportProduct$CatalogPlugin.endpoint
 })({
   translate: ImportProduct_Translation$CatalogPlugin.translate,
   moduleUrl: ImportProduct_Translation$CatalogPlugin.moduleUrl

package/lib/ocaml/.compiler.log

@@ -1,2 +1,2 @@
-#Start(1792153343874)
-#Done(1792153346006)
+#Start(1792162610379)
+#Done(1792162613537)

package/lib/ocaml/ImportProduct.res

@@ -1,7 +1,10 @@
 // ImportProduct InboundTranslationSlice.
 // Receives external supplier JSON, validates and translates to an AddProduct command.
+// The supplier posts to a signed webhook; the mutation stays as an operator's
+// replay door, which is why the command needs Admin rather than any signed-in user.
 
 @@reventless.spec
+@@reventless.authorize(AllowRoles([Admin]))
 
 @schema
 type externalInput = {
@@ -20,3 +23,17 @@ let targetName = "AddProduct"
 // Foreign system this anti-corruption slice receives product data from — drawn as an
 // external box outside the Catalog plugin in the Event Graph.
 let externalSystem = Some("SupplierFeed")
+
+// The supplier signs each post with the secret `supplierFeed`
+// (`pulumi config set --secret webhook:supplierFeed …` on AWS,
+// `REVENTLESS_WEBHOOK_SECRET_SUPPLIERFEED` locally); a signed post acts as Admin.
+let endpoint = Some({
+  Reventless.InboundTranslationSlice.path: "supplier-feed",
+  auth: SignedBody({
+    header: "X-Signature-256",
+    prefix: "sha256=",
+    timestampHeader: "X-Signature-Timestamp",
+    secret: "supplierFeed",
+  }),
+  role: Roles.Admin,
+})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/online-shop-dcb-catalog",
-  "version": "1.0.0-alpha.281",
+  "version": "1.0.0-alpha.282",
   "description": "Online Shop example — Catalog bounded context (Product & Category) using the DCB pattern",
   "license": "Apache-2.0",
   "jest": {
@@ -21,13 +21,13 @@
   },
   "dependencies": {
     "sury": "11.0.0",
-    "@reventlessdev/online-shop-dcb-catalog-spec": "1.0.0-alpha.166",
-    "@reventlessdev/online-shop-dcb-ordering-spec": "1.0.0-alpha.166",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.194",
-    "@reventlessdev/reventless-gwt": "1.0.0-alpha.245",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
-    "@reventlessdev/reventless-local": "3.0.0-alpha.288",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.166"
+    "@reventlessdev/online-shop-dcb-catalog-spec": "1.0.0-alpha.167",
+    "@reventlessdev/online-shop-dcb-ordering-spec": "1.0.0-alpha.167",
+    "@reventlessdev/rescript-pulumi-pulumi": "3.0.0-alpha.0",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.195",
+    "@reventlessdev/reventless-gwt": "1.0.0-alpha.246",
+    "@reventlessdev/reventless-local": "3.0.0-alpha.289",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.167"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/Plugin.res.mjs

@@ -282,7 +282,8 @@ function Make(Platform) {
     commandSchema: ImportProduct$CatalogPlugin.commandSchema,
     targetName: ImportProduct$CatalogPlugin.targetName,
     externalSystem: ImportProduct$CatalogPlugin.externalSystem,
-    authorizationOf: ImportProduct$CatalogPlugin.authorizationOf
+    authorizationOf: ImportProduct$CatalogPlugin.authorizationOf,
+    endpoint: ImportProduct$CatalogPlugin.endpoint
   })({
     translate: ImportProduct_Translation$CatalogPlugin.translate,
     moduleUrl: ImportProduct_Translation$CatalogPlugin.moduleUrl

package/src/Product/InboundTranslation/ImportProduct.res

@@ -1,7 +1,10 @@
 // ImportProduct InboundTranslationSlice.
 // Receives external supplier JSON, validates and translates to an AddProduct command.
+// The supplier posts to a signed webhook; the mutation stays as an operator's
+// replay door, which is why the command needs Admin rather than any signed-in user.
 
 @@reventless.spec
+@@reventless.authorize(AllowRoles([Admin]))
 
 @schema
 type externalInput = {
@@ -20,3 +23,17 @@ let targetName = "AddProduct"
 // Foreign system this anti-corruption slice receives product data from — drawn as an
 // external box outside the Catalog plugin in the Event Graph.
 let externalSystem = Some("SupplierFeed")
+
+// The supplier signs each post with the secret `supplierFeed`
+// (`pulumi config set --secret webhook:supplierFeed …` on AWS,
+// `REVENTLESS_WEBHOOK_SECRET_SUPPLIERFEED` locally); a signed post acts as Admin.
+let endpoint = Some({
+  Reventless.InboundTranslationSlice.path: "supplier-feed",
+  auth: SignedBody({
+    header: "X-Signature-256",
+    prefix: "sha256=",
+    timestampHeader: "X-Signature-Timestamp",
+    secret: "supplierFeed",
+  }),
+  role: Roles.Admin,
+})

package/src/Product/InboundTranslation/ImportProduct.res.mjs

@@ -21,7 +21,10 @@ let commandSchema = Sury.$schema(s => ({
 }));
 
 function authorizationOf(param) {
-  return "AllowAuthenticated";
+  return {
+    TAG: "AllowRoles",
+    _0: ["Admin"]
+  };
 }
 
 let traits = [];
@@ -34,6 +37,20 @@ let targetName = "AddProduct";
 
 let externalSystem = "SupplierFeed";
 
+let endpoint = {
+  path: "supplier-feed",
+  auth: {
+    TAG: "SignedBody",
+    _0: {
+      header: "X-Signature-256",
+      prefix: "sha256=",
+      timestampHeader: "X-Signature-Timestamp",
+      secret: "supplierFeed"
+    }
+  },
+  role: "Admin"
+};
+
 let moduleUrl = "@reventlessdev/online-shop-dcb-catalog/src/Product/InboundTranslation/ImportProduct.res.mjs";
 
 export {
@@ -43,6 +60,7 @@ export {
   commandSchema,
   targetName,
   externalSystem,
+  endpoint,
   moduleUrl,
   authorizationOf,
   traits,

package/tests/Product/InboundTranslation/ImportProduct_GWT.res.mjs

@@ -13,7 +13,8 @@ let include = InboundTranslation_GWT$ReventlessGwt.FromSlice({
   commandSchema: ImportProduct$CatalogPlugin.commandSchema,
   targetName: ImportProduct$CatalogPlugin.targetName,
   externalSystem: ImportProduct$CatalogPlugin.externalSystem,
-  authorizationOf: ImportProduct$CatalogPlugin.authorizationOf
+  authorizationOf: ImportProduct$CatalogPlugin.authorizationOf,
+  endpoint: ImportProduct$CatalogPlugin.endpoint
 })({
   translate: ImportProduct_Translation$CatalogPlugin.translate,
   moduleUrl: ImportProduct_Translation$CatalogPlugin.moduleUrl