@reventlessdev/reventless-core 3.0.0-alpha.223 → 3.0.0-alpha.225

package/tests/commandgenerator/OwnerStampingTest.res

@@ -0,0 +1,174 @@
+open JestGlobals
+
+S.enableJson()
+
+// Driven through `makeGenerateCommand` rather than by calling `stampOwnerFields`
+// directly. The unit under test is not really the stamp — it is the claim that
+// the stamp is reached on the path a command actually takes, which is the half a
+// direct call cannot establish. Both transports funnel through this function, so
+// what passes here is true of the local resolver and of AppSync alike.
+
+@schema
+type command =
+  | PlaceOrder({
+      orderId: @s.matches(Reventless.DcbTag.string) string,
+      customerId: @s.matches(Reventless.Owner.string) string,
+      note: string,
+    })
+  | // The control variant: same union, no owner. Whatever the caller sends here
+  // must survive untouched, or the stamp is reaching across constructors.
+  ImportProducts({batchId: @s.matches(Reventless.DcbTag.string) string, source: string})
+
+let published: ref<array<Message.commandJson>> = ref([])
+
+let generate = CommandGenerator_Callback.makeGenerateCommand(
+  ~publishJsons=async cmds => published := published.contents->Array.concat(cmds),
+  ~serviceName="Ordering",
+  ~commandSchema=commandSchema->S.castToUnknown,
+  ~componentKind=CommandGenerator_Callback.StateChangeSlice,
+  ~stripIdFromParams=false,
+)
+
+external asIdentity: 'a => Reventless.Identity.t = "%identity"
+
+let cognito = (~userId, ~groups): Reventless.Identity.t =>
+  asIdentity({"userId": userId, "username": userId, "groups": groups, "provider": "Cognito"})
+
+let iam: Reventless.Identity.t = asIdentity({
+  "userArn": "arn:aws:sts::1:assumed-role/Ingester",
+  "accountId": "1",
+  "username": "Ingester",
+  "provider": "IAM",
+})
+
+let payload = (~command, ~args: dict<JSON.t>, ~identity): CommandGenerator.payload =>
+  Obj.magic({
+    "command": command,
+    "arguments": Obj.magic(args),
+    "meta": {"ip": ["127.0.0.1"], "user": "test", "info": ""},
+    "identity": identity,
+  })
+
+let str = JSON.Encode.string
+
+let placeOrder = (~customerId, ~identity) =>
+  payload(
+    ~command="PlaceOrder",
+    ~args=Dict.fromArray([
+      ("orderId", str("o-1")),
+      ("customerId", str(customerId)),
+      ("note", str("gift wrap")),
+    ]),
+    ~identity,
+  )
+
+let fieldOf = (cmd: Message.commandJson, name) =>
+  cmd.commandJson->JSON.Decode.object->Option.flatMap(o => o->Dict.get(name))
+
+let lastPublished = () => published.contents->Array.getUnsafe(published.contents->Array.length - 1)
+
+let _ = beforeEach(() => {
+  published := []
+  Reventless.OwnerScope.setElevatedGroups(["Admin"])
+})
+
+describe("@owner stamping on the command path:", () => {
+  testPromise("an omitted owner field is filled from the caller", async () => {
+    let _ = await generate(
+      payload(
+        ~command="PlaceOrder",
+        ~args=Dict.fromArray([("orderId", str("o-1")), ("note", str(""))]),
+        ~identity=cognito(~userId="cust-A", ~groups=["User"]),
+      ),
+    )->Effect.runPromise
+    expect(lastPublished()->fieldOf("customerId"))->toEqual(Some(str("cust-A")))
+  })
+
+  // The decisive case. An implementation that fills only the absent field passes
+  // every other test in this file and hands one customer another's orders.
+  testPromise("a FORGED owner field is overwritten, not respected", async () => {
+    let _ =
+      await generate(
+        placeOrder(~customerId="cust-B", ~identity=cognito(~userId="cust-A", ~groups=["User"])),
+      )->Effect.runPromise
+    expect(lastPublished()->fieldOf("customerId"))->toEqual(Some(str("cust-A")))
+  })
+
+  testPromise("non-owner fields of the same command are untouched", async () => {
+    let _ =
+      await generate(
+        placeOrder(~customerId="cust-B", ~identity=cognito(~userId="cust-A", ~groups=["User"])),
+      )->Effect.runPromise
+    expect(lastPublished()->fieldOf("note"))->toEqual(Some(str("gift wrap")))
+  })
+
+  testPromise("a command in the same union with no owner field is left alone", async () => {
+    let _ =
+      await generate(
+        payload(
+          ~command="ImportProducts",
+          ~args=Dict.fromArray([("batchId", str("b-1")), ("source", str("acme"))]),
+          ~identity=cognito(~userId="cust-A", ~groups=["User"]),
+        ),
+      )->Effect.runPromise
+    expect((lastPublished()->fieldOf("source"), lastPublished()->fieldOf("customerId")))->toEqual((
+      Some(str("acme")),
+      None,
+    ))
+  })
+
+  describe("exempt callers keep the value they sent:", () => {
+    // Acting on another principal's behalf must stay possible for those who may
+    // — otherwise an operator can never correct or back-fill anything.
+    testPromise("an elevated caller's chosen customerId survives", async () => {
+      let _ =
+        await generate(
+          placeOrder(~customerId="cust-B", ~identity=cognito(~userId="ops-1", ~groups=["Admin"])),
+        )->Effect.runPromise
+      expect(lastPublished()->fieldOf("customerId"))->toEqual(Some(str("cust-B")))
+    })
+
+    // The IAM shape carries no userId at all. Stamping it would write
+    // `undefined`; refusing it would break internal traffic. It is exempt.
+    testPromise("an IAM system caller's chosen customerId survives", async () => {
+      let _ =
+        await generate(placeOrder(~customerId="cust-B", ~identity=iam))->Effect.runPromise
+      expect(lastPublished()->fieldOf("customerId"))->toEqual(Some(str("cust-B")))
+    })
+  })
+
+  describe("a caller that cannot be identified is refused:", () => {
+    let refused = async p =>
+      switch await generate(p)->Effect.runPromise {
+      | _ => false
+      | exception _ => true
+      }
+
+    testPromise("an anonymous caller cannot place an owned command", async () =>
+      expect(
+        await refused(placeOrder(~customerId="cust-B", ~identity=Reventless.Identity.anonymous)),
+      )->toBe(true)
+    )
+
+    testPromise("nothing is published when the caller is refused", async () => {
+      let _ = await refused(
+        placeOrder(~customerId="cust-B", ~identity=Reventless.Identity.anonymous),
+      )
+      expect(published.contents->Array.length)->toBe(0)
+    })
+
+    // The refusal is scoped to commands that actually record an owner. An
+    // anonymous caller invoking an unowned command has nothing to prove, and
+    // refusing it here would silently narrow `AllowAnonymous`.
+    testPromise("an anonymous caller may still issue an unowned command", async () => {
+      let _ = await generate(
+        payload(
+          ~command="ImportProducts",
+          ~args=Dict.fromArray([("batchId", str("b-1")), ("source", str("acme"))]),
+          ~identity=Reventless.Identity.anonymous,
+        ),
+      )->Effect.runPromise
+      expect(lastPublished()->fieldOf("source"))->toEqual(Some(str("acme")))
+    })
+  })
+})

package/tests/commandgenerator/OwnerStampingTest.res.mjs

@@ -0,0 +1,195 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Effect from "effect/Effect";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as CommandGenerator_Callback$ReventlessCore from "../../src/components/CommandGenerator/CommandGenerator_Callback.res.mjs";
+
+S.enableJson();
+
+let commandSchema = S.union([
+  S.schema(s => ({
+    TAG: "PlaceOrder",
+    orderId: s.m(DcbTag$Reventless.string),
+    customerId: s.m(Owner$Reventless.string),
+    note: s.m(S.string)
+  })),
+  S.schema(s => ({
+    TAG: "ImportProducts",
+    batchId: s.m(DcbTag$Reventless.string),
+    source: s.m(S.string)
+  }))
+]);
+
+let published = {
+  contents: []
+};
+
+let generate = CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(async cmds => {
+  published.contents = published.contents.concat(cmds);
+}, undefined, "Ordering", commandSchema, "StateChangeSlice", false);
+
+function cognito(userId, groups) {
+  return {
+    userId: userId,
+    username: userId,
+    groups: groups,
+    provider: "Cognito"
+  };
+}
+
+let iam = {
+  userArn: "arn:aws:sts::1:assumed-role/Ingester",
+  accountId: "1",
+  username: "Ingester",
+  provider: "IAM"
+};
+
+function payload(command, args, identity) {
+  return {
+    command: command,
+    arguments: args,
+    meta: {
+      ip: ["127.0.0.1"],
+      user: "test",
+      info: ""
+    },
+    identity: identity
+  };
+}
+
+function str(prim) {
+  return prim;
+}
+
+function placeOrder(customerId, identity) {
+  return payload("PlaceOrder", Object.fromEntries([
+    [
+      "orderId",
+      "o-1"
+    ],
+    [
+      "customerId",
+      customerId
+    ],
+    [
+      "note",
+      "gift wrap"
+    ]
+  ]), identity);
+}
+
+function fieldOf(cmd, name) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(cmd.commandJson), o => o[name]);
+}
+
+function lastPublished() {
+  return published.contents[published.contents.length - 1 | 0];
+}
+
+globalThis.beforeEach(() => {
+  published.contents = [];
+  OwnerScope$Reventless.setElevatedGroups(["Admin"]);
+});
+
+globalThis.describe("@owner stamping on the command path:", () => {
+  globalThis.test("an omitted owner field is filled from the caller", async () => {
+    await Effect.runPromise(generate(payload("PlaceOrder", Object.fromEntries([
+      [
+        "orderId",
+        "o-1"
+      ],
+      [
+        "note",
+        ""
+      ]
+    ]), cognito("cust-A", ["User"]))));
+    globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")).toEqual("cust-A");
+  });
+  globalThis.test("a FORGED owner field is overwritten, not respected", async () => {
+    await Effect.runPromise(generate(placeOrder("cust-B", cognito("cust-A", ["User"]))));
+    globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")).toEqual("cust-A");
+  });
+  globalThis.test("non-owner fields of the same command are untouched", async () => {
+    await Effect.runPromise(generate(placeOrder("cust-B", cognito("cust-A", ["User"]))));
+    globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "note")).toEqual("gift wrap");
+  });
+  globalThis.test("a command in the same union with no owner field is left alone", async () => {
+    await Effect.runPromise(generate(payload("ImportProducts", Object.fromEntries([
+      [
+        "batchId",
+        "b-1"
+      ],
+      [
+        "source",
+        "acme"
+      ]
+    ]), cognito("cust-A", ["User"]))));
+    globalThis.expect([
+      fieldOf(published.contents[published.contents.length - 1 | 0], "source"),
+      fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")
+    ]).toEqual([
+      "acme",
+      undefined
+    ]);
+  });
+  globalThis.describe("exempt callers keep the value they sent:", () => {
+    globalThis.test("an elevated caller's chosen customerId survives", async () => {
+      await Effect.runPromise(generate(placeOrder("cust-B", cognito("ops-1", ["Admin"]))));
+      globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")).toEqual("cust-B");
+    });
+    globalThis.test("an IAM system caller's chosen customerId survives", async () => {
+      await Effect.runPromise(generate(placeOrder("cust-B", iam)));
+      globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")).toEqual("cust-B");
+    });
+  });
+  globalThis.describe("a caller that cannot be identified is refused:", () => {
+    let refused = async p => {
+      try {
+        await Effect.runPromise(generate(p));
+        return false;
+      } catch (exn) {
+        return true;
+      }
+    };
+    globalThis.test("an anonymous caller cannot place an owned command", async () => {
+      globalThis.expect(await refused(placeOrder("cust-B", Identity$Reventless.anonymous))).toBe(true);
+    });
+    globalThis.test("nothing is published when the caller is refused", async () => {
+      await refused(placeOrder("cust-B", Identity$Reventless.anonymous));
+      globalThis.expect(published.contents.length).toBe(0);
+    });
+    globalThis.test("an anonymous caller may still issue an unowned command", async () => {
+      await Effect.runPromise(generate(payload("ImportProducts", Object.fromEntries([
+        [
+          "batchId",
+          "b-1"
+        ],
+        [
+          "source",
+          "acme"
+        ]
+      ]), Identity$Reventless.anonymous)));
+      globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "source")).toEqual("acme");
+    });
+  });
+});
+
+export {
+  commandSchema,
+  published,
+  generate,
+  cognito,
+  iam,
+  payload,
+  str,
+  placeOrder,
+  fieldOf,
+  lastPublished,
+}
+/*  Not a pure module */

package/tests/plugin/PluginStructureAccessTest.res

@@ -0,0 +1,110 @@
+// `requiredAccess` is derived from the authorization rule the server enforces, so
+// what these assert is that the manifest cannot describe a different policy from
+// the one the resolver applies. A client uses the keys to stop offering what it
+// would be refused; it never decides anything with them.
+
+open JestGlobals
+
+type scsComponent = Component.t<
+  ReventlessInfra.StateChangeSlice.t,
+  ReventlessInfra.StateChangeSlice.outputs,
+  ReventlessInfra.StateChangeSlice.operations,
+>
+type svsComponent = Component.t<
+  ReventlessInfra.StateViewSlice.t,
+  ReventlessInfra.StateViewSlice.outputs,
+  ReventlessInfra.StateViewSlice.operations,
+>
+
+module PsGatedCommandsSlice: ReventlessInfra.StateChangeSlice.T = {
+  module Spec = PsGatedCommands
+  module Behavior = {
+    type state = PsGatedCommands.state
+    let initialState = PsGatedCommands.initialState
+    let evolve = PsGatedCommands.evolve
+    let decide = PsGatedCommands.decide
+    let moduleUrl = PsGatedCommands.moduleUrl
+  }
+  let isAsync = false
+  type component = scsComponent
+  let make = (
+    ~dcbEventLog as _,
+    ~publishJsons as _,
+    ~tagKeysByEventType as _=?,
+    ~crossPartitionTagKeys as _=?,
+    ~runtime as _=?,
+    ~opts as _=?,
+  ): component => Obj.magic(0)
+}
+
+module PsGatedViewSlice: ReventlessInfra.StateViewSlice.T = {
+  module Spec = PsGatedView
+  module Projection = {
+    let project = PsGatedView.project
+    let moduleUrl = PsGatedView.moduleUrl
+  }
+  type component = svsComponent
+  let make = (~dcbEventLog as _, ~runtime as _=?, ~opts as _=?): component => Obj.magic(0)
+}
+
+module PsOrdersViewSlice: ReventlessInfra.StateViewSlice.T = {
+  module Spec = PsOrdersView
+  module Projection = {
+    let project = PsOrdersView.project
+    let moduleUrl = PsOrdersView.moduleUrl
+  }
+  type component = svsComponent
+  let make = (~dcbEventLog as _, ~runtime as _=?, ~opts as _=?): component => Obj.magic(0)
+}
+
+let structure = Plugin_Structure.make(
+  ~name="AccessPlugin",
+  ~stateChangeSlices=[module(PsGatedCommandsSlice)],
+  ~stateViewSlices=[module(PsGatedViewSlice), module(PsOrdersViewSlice)],
+)
+
+let commandNamed = name =>
+  structure.stateChangeSlices
+  ->Array.flatMap(w => w.commands)
+  ->Array.find(c => c.name === name)
+  ->Option.flatMap(c => c.requiredAccess)
+
+let viewNamed = name =>
+  structure.stateViewSlices
+  ->Array.find(q => q.name === name)
+  ->Option.flatMap(q => q.requiredAccess)
+
+describe("requiredAccess derived from the authorization rule", () => {
+  testSync("an AllowGroups command publishes its groups", () =>
+    expect(commandNamed("Restock"))->toEqual(Some(["Admin", "Ops"]))
+  )
+
+  // The reason the rule is evaluated per constructor rather than per component:
+  // one slice, two audiences, and a component-level shortcut would gate both.
+  testSync("a sibling command in the same slice publishes nothing", () =>
+    expect(commandNamed("RequestRestock"))->toEqual(None)
+  )
+
+  testSync("a module-level rule reaches the view it guards", () =>
+    expect(viewNamed("GatedView"))->toEqual(Some(["Admin"]))
+  )
+
+  testSync("an unannotated view publishes nothing", () =>
+    expect(viewNamed("Orders"))->toEqual(None)
+  )
+
+  // Null rather than `[]` on the wire: "no key gates this" is one answer, and a
+  // def written before the field existed has to read as the same thing.
+  testSync("nothing to require encodes as null, not an empty list", () => {
+    let json =
+      Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
+        ~pluginId="AccessPlugin",
+        structure,
+      )->JSON.stringify
+    expect((
+      json->String.includes(`"requiredAccess":null`),
+      json->String.includes(`"requiredAccess":["Admin","Ops"]`),
+      json->String.includes(`"requiredAccess":[]`),
+    ))->toEqual((true, true, false))
+  })
+})

package/tests/plugin/PluginStructureAccessTest.res.mjs

@@ -0,0 +1,144 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as PsGatedView$ReventlessCore from "./StateViewSlice/PsGatedView.res.mjs";
+import * as PsOrdersView$ReventlessCore from "./StateViewSlice/PsOrdersView.res.mjs";
+import * as PsGatedCommands$ReventlessCore from "./StateChangeSlice/PsGatedCommands.res.mjs";
+import * as Plugin_Structure$ReventlessCore from "../../src/plugin/component/Plugin_Structure.res.mjs";
+import * as Platform_ComponentDefinitionsApi$ReventlessCore from "../../src/admin/Platform_ComponentDefinitionsApi.res.mjs";
+
+let Behavior = {
+  initialState: false,
+  evolve: PsGatedCommands$ReventlessCore.evolve,
+  decide: PsGatedCommands$ReventlessCore.decide,
+  moduleUrl: PsGatedCommands$ReventlessCore.moduleUrl
+};
+
+function make(param, param$1, param$2, param$3, param$4, param$5) {
+  return 0;
+}
+
+let PsGatedCommandsSlice_Spec = {
+  name: PsGatedCommands$ReventlessCore.name,
+  moduleUrl: PsGatedCommands$ReventlessCore.moduleUrl,
+  Id: Id$Reventless.$$String,
+  consumedEventSchema: PsGatedCommands$ReventlessCore.consumedEventSchema,
+  errorSchema: PsGatedCommands$ReventlessCore.errorSchema,
+  eventSchema: PsGatedCommands$ReventlessCore.eventSchema,
+  commandSchema: PsGatedCommands$ReventlessCore.commandSchema,
+  commandAuthorization: PsGatedCommands$ReventlessCore.commandAuthorization,
+  readConsistency: PsGatedCommands$ReventlessCore.readConsistency
+};
+
+let PsGatedCommandsSlice = {
+  Spec: PsGatedCommandsSlice_Spec,
+  Behavior: Behavior,
+  isAsync: false,
+  make: make
+};
+
+let Projection = {
+  project: PsGatedView$ReventlessCore.project,
+  moduleUrl: PsGatedView$ReventlessCore.moduleUrl
+};
+
+function make$1(param, param$1, param$2) {
+  return 0;
+}
+
+let PsGatedViewSlice_Spec = {
+  name: PsGatedView$ReventlessCore.name,
+  moduleUrl: PsGatedView$ReventlessCore.moduleUrl,
+  stateSchema: PsGatedView$ReventlessCore.stateSchema,
+  consumedEventSchema: PsGatedView$ReventlessCore.consumedEventSchema,
+  config: PsGatedView$ReventlessCore.config,
+  subIdConfig: undefined,
+  authorization: PsGatedView$ReventlessCore.authorization,
+  visibility: PsGatedView$ReventlessCore.visibility
+};
+
+let PsGatedViewSlice = {
+  Spec: PsGatedViewSlice_Spec,
+  Projection: Projection,
+  make: make$1
+};
+
+let Projection$1 = {
+  project: PsOrdersView$ReventlessCore.project,
+  moduleUrl: PsOrdersView$ReventlessCore.moduleUrl
+};
+
+function make$2(param, param$1, param$2) {
+  return 0;
+}
+
+let PsOrdersViewSlice_Spec = {
+  name: PsOrdersView$ReventlessCore.name,
+  moduleUrl: PsOrdersView$ReventlessCore.moduleUrl,
+  stateSchema: PsOrdersView$ReventlessCore.stateSchema,
+  consumedEventSchema: PsOrdersView$ReventlessCore.consumedEventSchema,
+  config: PsOrdersView$ReventlessCore.config,
+  subIdConfig: undefined,
+  authorization: PsOrdersView$ReventlessCore.authorization,
+  visibility: PsOrdersView$ReventlessCore.visibility
+};
+
+let PsOrdersViewSlice = {
+  Spec: PsOrdersViewSlice_Spec,
+  Projection: Projection$1,
+  make: make$2
+};
+
+let structure = Plugin_Structure$ReventlessCore.make("AccessPlugin", undefined, undefined, [
+  PsGatedViewSlice,
+  PsOrdersViewSlice
+], [PsGatedCommandsSlice], undefined, undefined, undefined, undefined, undefined, undefined);
+
+function commandNamed(name) {
+  return Stdlib_Option.flatMap(structure.stateChangeSlices.flatMap(w => w.commands).find(c => c.name === name), c => c.requiredAccess);
+}
+
+function viewNamed(name) {
+  return Stdlib_Option.flatMap(structure.stateViewSlices.find(q => q.name === name), q => q.requiredAccess);
+}
+
+globalThis.describe("requiredAccess derived from the authorization rule", () => {
+  globalThis.test("an AllowGroups command publishes its groups", () => {
+    globalThis.expect(commandNamed("Restock")).toEqual([
+      "Admin",
+      "Ops"
+    ]);
+  });
+  globalThis.test("a sibling command in the same slice publishes nothing", () => {
+    globalThis.expect(commandNamed("RequestRestock")).toEqual(undefined);
+  });
+  globalThis.test("a module-level rule reaches the view it guards", () => {
+    globalThis.expect(viewNamed("GatedView")).toEqual(["Admin"]);
+  });
+  globalThis.test("an unannotated view publishes nothing", () => {
+    globalThis.expect(viewNamed("Orders")).toEqual(undefined);
+  });
+  globalThis.test("nothing to require encodes as null, not an empty list", () => {
+    let json = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("AccessPlugin", structure));
+    globalThis.expect([
+      json.includes(`"requiredAccess":null`),
+      json.includes(`"requiredAccess":["Admin","Ops"]`),
+      json.includes(`"requiredAccess":[]`)
+    ]).toEqual([
+      true,
+      true,
+      false
+    ]);
+  });
+});
+
+export {
+  PsGatedCommandsSlice,
+  PsGatedViewSlice,
+  PsOrdersViewSlice,
+  structure,
+  commandNamed,
+  viewNamed,
+}
+/* structure Not a pure module */