@reventlessdev/reventless-core 3.0.0-alpha.224 → 3.0.0-alpha.225

package/tests/admin/Platform_PluginStructuresApiTest.res.mjs

@@ -32,11 +32,13 @@ let publicRm = {
   searchableFields: publicRm_searchableFields,
   labelFieldSource: publicRm_labelFieldSource,
   statusField: undefined,
+  ownerField: undefined,
   visibility: undefined,
   chapter: publicRm_chapter,
   singleQueryField: publicRm_singleQueryField,
   idField: publicRm_idField,
-  idFieldSource: publicRm_idFieldSource
+  idFieldSource: publicRm_idFieldSource,
+  requiredAccess: undefined
 };
 
 let internalRm_consumedEventTypes = publicRm_consumedEventTypes;
@@ -67,11 +69,13 @@ let internalRm = {
   searchableFields: internalRm_searchableFields,
   labelFieldSource: internalRm_labelFieldSource,
   statusField: undefined,
+  ownerField: undefined,
   visibility: internalRm_visibility,
   chapter: internalRm_chapter,
   singleQueryField: internalRm_singleQueryField,
   idField: internalRm_idField,
-  idFieldSource: internalRm_idFieldSource
+  idFieldSource: internalRm_idFieldSource,
+  requiredAccess: undefined
 };
 
 let structure_readModels = [

package/tests/api/Api_IdsTest.res.mjs

@@ -77,7 +77,7 @@ globalThis.describe("filter.ids matches whichever form each side holds", () => {
         "ids",
         filterIds.map(prim => prim)
       ]]);
-    let conn = QueryDbListQuery$ReventlessCore.run([row(rowId)], args, GraphQL_FragmentGenerator$ReventlessCore.emptyCapability, "name", undefined);
+    let conn = QueryDbListQuery$ReventlessCore.run([row(rowId)], args, GraphQL_FragmentGenerator$ReventlessCore.emptyCapability, "name", undefined, undefined);
     return Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(conn), d => d["edges"]), Stdlib_JSON.Decode.array), []).length;
   };
   globalThis.test("storage key row, storage key filter", () => {

package/tests/api/OwnerScopeDiagnosticsTest.res

@@ -0,0 +1,109 @@
+open JestGlobals
+
+// This file asserts on EMITTED log output, so it pins the level it needs rather
+// than inheriting whatever the runner exported — `LOG_LEVEL=silent` would
+// suppress the warning and turn every case below green for the wrong reason.
+// `Logger` re-reads process.env on each call, so a file-scope assignment holds.
+NodeProcess.env->Dict.set("LOG_LEVEL", "warn")
+
+type consoleObj = {mutable log: string => unit}
+@val external console: consoleObj = "console"
+
+let capture = (fn: unit => unit): array<string> => {
+  let lines: array<string> = []
+  let original = console.log
+  console.log = s => lines->Array.push(s)
+  let result = try {
+    fn()
+    Ok()
+  } catch {
+  | e => Error(e)
+  }
+  console.log = original
+  switch result {
+  | Ok() => lines
+  | Error(e) => throw(e)
+  }
+}
+
+let warnFor = (~view, ~ownerField, ~elevated) => {
+  OwnerScopeDiagnostics.resetWarnings()
+  Reventless.OwnerScope.setElevatedGroups(elevated)
+  let lines = capture(() =>
+    OwnerScopeDiagnostics.warnIfNoElevatedGroups(~comp="Test", ~view, ~ownerField)
+  )
+  Reventless.OwnerScope.setElevatedGroups([])
+  lines
+}
+
+describe("OwnerScopeDiagnostics:", () => {
+  testSync("an owner-scoped view with no elevated groups warns", () =>
+    expect(warnFor(~view="Orders", ~ownerField=Some("customerId"), ~elevated=[])->Array.length)->toBe(
+      1,
+    )
+  )
+
+  // The consequence is the whole point of the line — an operator reading
+  // "configure elevated groups" without being told that admins are currently
+  // scoped has no reason to treat it as urgent.
+  testSync("the warning names the view, the field, and what will happen", () => {
+    let line =
+      warnFor(~view="Orders", ~ownerField=Some("customerId"), ~elevated=[])
+      ->Array.get(0)
+      ->Option.getOr("")
+    expect((
+      line->String.includes("Orders"),
+      line->String.includes("customerId"),
+      line->String.includes("only their own rows"),
+    ))->toEqual((true, true, true))
+  })
+
+  testSync("a view with no owner field is silent", () =>
+    expect(warnFor(~view="Products", ~ownerField=None, ~elevated=[])->Array.length)->toBe(0)
+  )
+
+  testSync("a configured deployment is silent", () =>
+    expect(
+      warnFor(~view="Orders", ~ownerField=Some("customerId"), ~elevated=["Admin"])->Array.length,
+    )->toBe(0)
+  )
+
+  // Registration runs more than once per process — tests build several
+  // platforms, a deploy walks every plugin. A line repeated per construction is
+  // one people learn to scroll past.
+  testSync("the same view warns once, not once per registration", () => {
+    OwnerScopeDiagnostics.resetWarnings()
+    Reventless.OwnerScope.setElevatedGroups([])
+    let lines = capture(() => {
+      OwnerScopeDiagnostics.warnIfNoElevatedGroups(
+        ~comp="Test",
+        ~view="Orders",
+        ~ownerField=Some("customerId"),
+      )
+      OwnerScopeDiagnostics.warnIfNoElevatedGroups(
+        ~comp="Test",
+        ~view="Orders",
+        ~ownerField=Some("customerId"),
+      )
+    })
+    expect(lines->Array.length)->toBe(1)
+  })
+
+  testSync("a second view gets its own warning", () => {
+    OwnerScopeDiagnostics.resetWarnings()
+    Reventless.OwnerScope.setElevatedGroups([])
+    let lines = capture(() => {
+      OwnerScopeDiagnostics.warnIfNoElevatedGroups(
+        ~comp="Test",
+        ~view="Orders",
+        ~ownerField=Some("customerId"),
+      )
+      OwnerScopeDiagnostics.warnIfNoElevatedGroups(
+        ~comp="Test",
+        ~view="Invoices",
+        ~ownerField=Some("payerId"),
+      )
+    })
+    expect(lines->Array.length)->toBe(2)
+  })
+})

package/tests/api/OwnerScopeDiagnosticsTest.res.mjs

@@ -0,0 +1,91 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as OwnerScopeDiagnostics$ReventlessCore from "../../src/components/Api/OwnerScopeDiagnostics.res.mjs";
+
+process.env["LOG_LEVEL"] = "warn";
+
+function capture(fn) {
+  let lines = [];
+  let original = console.log;
+  console.log = s => {
+    lines.push(s);
+  };
+  let result;
+  try {
+    fn();
+    result = {
+      TAG: "Ok",
+      _0: undefined
+    };
+  } catch (raw_e) {
+    let e = Primitive_exceptions.internalToException(raw_e);
+    result = {
+      TAG: "Error",
+      _0: e
+    };
+  }
+  console.log = original;
+  if (result.TAG === "Ok") {
+    return lines;
+  }
+  throw result._0;
+}
+
+function warnFor(view, ownerField, elevated) {
+  OwnerScopeDiagnostics$ReventlessCore.resetWarnings();
+  OwnerScope$Reventless.setElevatedGroups(elevated);
+  let lines = capture(() => OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("Test", view, ownerField));
+  OwnerScope$Reventless.setElevatedGroups([]);
+  return lines;
+}
+
+globalThis.describe("OwnerScopeDiagnostics:", () => {
+  globalThis.test("an owner-scoped view with no elevated groups warns", () => {
+    globalThis.expect(warnFor("Orders", "customerId", []).length).toBe(1);
+  });
+  globalThis.test("the warning names the view, the field, and what will happen", () => {
+    let line = Stdlib_Option.getOr(warnFor("Orders", "customerId", [])[0], "");
+    globalThis.expect([
+      line.includes("Orders"),
+      line.includes("customerId"),
+      line.includes("only their own rows")
+    ]).toEqual([
+      true,
+      true,
+      true
+    ]);
+  });
+  globalThis.test("a view with no owner field is silent", () => {
+    globalThis.expect(warnFor("Products", undefined, []).length).toBe(0);
+  });
+  globalThis.test("a configured deployment is silent", () => {
+    globalThis.expect(warnFor("Orders", "customerId", ["Admin"]).length).toBe(0);
+  });
+  globalThis.test("the same view warns once, not once per registration", () => {
+    OwnerScopeDiagnostics$ReventlessCore.resetWarnings();
+    OwnerScope$Reventless.setElevatedGroups([]);
+    let lines = capture(() => {
+      OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("Test", "Orders", "customerId");
+      OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("Test", "Orders", "customerId");
+    });
+    globalThis.expect(lines.length).toBe(1);
+  });
+  globalThis.test("a second view gets its own warning", () => {
+    OwnerScopeDiagnostics$ReventlessCore.resetWarnings();
+    OwnerScope$Reventless.setElevatedGroups([]);
+    let lines = capture(() => {
+      OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("Test", "Orders", "customerId");
+      OwnerScopeDiagnostics$ReventlessCore.warnIfNoElevatedGroups("Test", "Invoices", "payerId");
+    });
+    globalThis.expect(lines.length).toBe(2);
+  });
+});
+
+export {
+  capture,
+  warnFor,
+}
+/*  Not a pure module */

package/tests/api/SuryToJsonSchemaTest.res

@@ -73,6 +73,51 @@ describe("SuryToJsonSchema:", () => {
     })
   })
 
+  describe("deriveObjectSchema with an owner field:", () => {
+    let ownerOf = (json, name) =>
+      getPropertyOf(json, name)->Option.flatMap(s => getProperty(s, "x-reventless-owner"))
+
+    let json = SuryToJsonSchema.deriveObjectSchema(
+      S.schema(s =>
+        {
+          "customerId": s.matches(Reventless.Owner.string),
+          "note": s.matches(S.string),
+        }
+      )->S.castToUnknown,
+    )
+
+    testSync("the marked field carries x-reventless-owner", () =>
+      expect(ownerOf(json, "customerId"))->toEqual(Some(JSON.Encode.bool(true)))
+    )
+
+    // The control: ownership is opt-in, and an unmarked string must stay one.
+    // Without this, a bug that marked every field would still pass above.
+    testSync("an unmarked string field carries nothing", () =>
+      expect(ownerOf(json, "note"))->toBe(None)
+    )
+
+    testSync("the field is still a plain string on the wire", () =>
+      expect(
+        getPropertyOf(json, "customerId")->Option.flatMap(s => getProperty(s, "type")),
+      )->toEqual(Some(JSON.Encode.string("string")))
+    )
+
+    // An optional field keeps its marker inside the union wrapper. A reader that
+    // only inspects the outer schema answers "not the owner" here — which for a
+    // predicate that scopes reads means an unscoped view, silently. This is the
+    // case `Owner.isFieldOwner` exists for.
+    testSync("an optional owner field is still recognised", () => {
+      let optJson = SuryToJsonSchema.deriveObjectSchema(
+        S.schema(s =>
+          {
+            "customerId": s.matches(S.option(Reventless.Owner.string)),
+          }
+        )->S.castToUnknown,
+      )
+      expect(ownerOf(optJson, "customerId"))->toEqual(Some(JSON.Encode.bool(true)))
+    })
+  })
+
   describe("deriveObjectSchema with stateAnnotations metadata:", () => {
     let withSpec = (schema, spec) =>
       schema->S.Metadata.set(~id=Reventless.StateAnnotations.stateAnnotationsId, spec)

package/tests/api/SuryToJsonSchemaTest.res.mjs

@@ -6,6 +6,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Email$Reventless from "@reventlessdev/reventless-spec/src/semantic/Email.res.mjs";
 import * as Money$Reventless from "@reventlessdev/reventless-spec/src/semantic/Money.res.mjs";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Percent$Reventless from "@reventlessdev/reventless-spec/src/semantic/Percent.res.mjs";
@@ -106,6 +107,28 @@ globalThis.describe("SuryToJsonSchema:", () => {
       globalThis.expect(Stdlib_Option.flatMap(getPropertyOf(json, "name"), s => getProperty(s, "format"))).toBe(undefined);
     });
   });
+  globalThis.describe("deriveObjectSchema with an owner field:", () => {
+    let ownerOf = (json, name) => Stdlib_Option.flatMap(getPropertyOf(json, name), s => getProperty(s, "x-reventless-owner"));
+    let json = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(S.schema(s => ({
+      customerId: s.m(Owner$Reventless.string),
+      note: s.m(S.string)
+    })));
+    globalThis.test("the marked field carries x-reventless-owner", () => {
+      globalThis.expect(ownerOf(json, "customerId")).toEqual(true);
+    });
+    globalThis.test("an unmarked string field carries nothing", () => {
+      globalThis.expect(ownerOf(json, "note")).toBe(undefined);
+    });
+    globalThis.test("the field is still a plain string on the wire", () => {
+      globalThis.expect(Stdlib_Option.flatMap(getPropertyOf(json, "customerId"), s => getProperty(s, "type"))).toEqual("string");
+    });
+    globalThis.test("an optional owner field is still recognised", () => {
+      let optJson = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(S.schema(s => ({
+        customerId: s.m(S.option(Owner$Reventless.string))
+      })));
+      globalThis.expect(ownerOf(optJson, "customerId")).toEqual(true);
+    });
+  });
   globalThis.describe("deriveObjectSchema with stateAnnotations metadata:", () => {
     let withSpec = (schema, spec) => S.Metadata.set(schema, StateAnnotations$Reventless.stateAnnotationsId, spec);
     globalThis.test("emits x-reventless-id on field listed in ids", () => {

package/tests/commandgenerator/OwnerStampingTest.res

@@ -0,0 +1,174 @@
+open JestGlobals
+
+S.enableJson()
+
+// Driven through `makeGenerateCommand` rather than by calling `stampOwnerFields`
+// directly. The unit under test is not really the stamp — it is the claim that
+// the stamp is reached on the path a command actually takes, which is the half a
+// direct call cannot establish. Both transports funnel through this function, so
+// what passes here is true of the local resolver and of AppSync alike.
+
+@schema
+type command =
+  | PlaceOrder({
+      orderId: @s.matches(Reventless.DcbTag.string) string,
+      customerId: @s.matches(Reventless.Owner.string) string,
+      note: string,
+    })
+  | // The control variant: same union, no owner. Whatever the caller sends here
+  // must survive untouched, or the stamp is reaching across constructors.
+  ImportProducts({batchId: @s.matches(Reventless.DcbTag.string) string, source: string})
+
+let published: ref<array<Message.commandJson>> = ref([])
+
+let generate = CommandGenerator_Callback.makeGenerateCommand(
+  ~publishJsons=async cmds => published := published.contents->Array.concat(cmds),
+  ~serviceName="Ordering",
+  ~commandSchema=commandSchema->S.castToUnknown,
+  ~componentKind=CommandGenerator_Callback.StateChangeSlice,
+  ~stripIdFromParams=false,
+)
+
+external asIdentity: 'a => Reventless.Identity.t = "%identity"
+
+let cognito = (~userId, ~groups): Reventless.Identity.t =>
+  asIdentity({"userId": userId, "username": userId, "groups": groups, "provider": "Cognito"})
+
+let iam: Reventless.Identity.t = asIdentity({
+  "userArn": "arn:aws:sts::1:assumed-role/Ingester",
+  "accountId": "1",
+  "username": "Ingester",
+  "provider": "IAM",
+})
+
+let payload = (~command, ~args: dict<JSON.t>, ~identity): CommandGenerator.payload =>
+  Obj.magic({
+    "command": command,
+    "arguments": Obj.magic(args),
+    "meta": {"ip": ["127.0.0.1"], "user": "test", "info": ""},
+    "identity": identity,
+  })
+
+let str = JSON.Encode.string
+
+let placeOrder = (~customerId, ~identity) =>
+  payload(
+    ~command="PlaceOrder",
+    ~args=Dict.fromArray([
+      ("orderId", str("o-1")),
+      ("customerId", str(customerId)),
+      ("note", str("gift wrap")),
+    ]),
+    ~identity,
+  )
+
+let fieldOf = (cmd: Message.commandJson, name) =>
+  cmd.commandJson->JSON.Decode.object->Option.flatMap(o => o->Dict.get(name))
+
+let lastPublished = () => published.contents->Array.getUnsafe(published.contents->Array.length - 1)
+
+let _ = beforeEach(() => {
+  published := []
+  Reventless.OwnerScope.setElevatedGroups(["Admin"])
+})
+
+describe("@owner stamping on the command path:", () => {
+  testPromise("an omitted owner field is filled from the caller", async () => {
+    let _ = await generate(
+      payload(
+        ~command="PlaceOrder",
+        ~args=Dict.fromArray([("orderId", str("o-1")), ("note", str(""))]),
+        ~identity=cognito(~userId="cust-A", ~groups=["User"]),
+      ),
+    )->Effect.runPromise
+    expect(lastPublished()->fieldOf("customerId"))->toEqual(Some(str("cust-A")))
+  })
+
+  // The decisive case. An implementation that fills only the absent field passes
+  // every other test in this file and hands one customer another's orders.
+  testPromise("a FORGED owner field is overwritten, not respected", async () => {
+    let _ =
+      await generate(
+        placeOrder(~customerId="cust-B", ~identity=cognito(~userId="cust-A", ~groups=["User"])),
+      )->Effect.runPromise
+    expect(lastPublished()->fieldOf("customerId"))->toEqual(Some(str("cust-A")))
+  })
+
+  testPromise("non-owner fields of the same command are untouched", async () => {
+    let _ =
+      await generate(
+        placeOrder(~customerId="cust-B", ~identity=cognito(~userId="cust-A", ~groups=["User"])),
+      )->Effect.runPromise
+    expect(lastPublished()->fieldOf("note"))->toEqual(Some(str("gift wrap")))
+  })
+
+  testPromise("a command in the same union with no owner field is left alone", async () => {
+    let _ =
+      await generate(
+        payload(
+          ~command="ImportProducts",
+          ~args=Dict.fromArray([("batchId", str("b-1")), ("source", str("acme"))]),
+          ~identity=cognito(~userId="cust-A", ~groups=["User"]),
+        ),
+      )->Effect.runPromise
+    expect((lastPublished()->fieldOf("source"), lastPublished()->fieldOf("customerId")))->toEqual((
+      Some(str("acme")),
+      None,
+    ))
+  })
+
+  describe("exempt callers keep the value they sent:", () => {
+    // Acting on another principal's behalf must stay possible for those who may
+    // — otherwise an operator can never correct or back-fill anything.
+    testPromise("an elevated caller's chosen customerId survives", async () => {
+      let _ =
+        await generate(
+          placeOrder(~customerId="cust-B", ~identity=cognito(~userId="ops-1", ~groups=["Admin"])),
+        )->Effect.runPromise
+      expect(lastPublished()->fieldOf("customerId"))->toEqual(Some(str("cust-B")))
+    })
+
+    // The IAM shape carries no userId at all. Stamping it would write
+    // `undefined`; refusing it would break internal traffic. It is exempt.
+    testPromise("an IAM system caller's chosen customerId survives", async () => {
+      let _ =
+        await generate(placeOrder(~customerId="cust-B", ~identity=iam))->Effect.runPromise
+      expect(lastPublished()->fieldOf("customerId"))->toEqual(Some(str("cust-B")))
+    })
+  })
+
+  describe("a caller that cannot be identified is refused:", () => {
+    let refused = async p =>
+      switch await generate(p)->Effect.runPromise {
+      | _ => false
+      | exception _ => true
+      }
+
+    testPromise("an anonymous caller cannot place an owned command", async () =>
+      expect(
+        await refused(placeOrder(~customerId="cust-B", ~identity=Reventless.Identity.anonymous)),
+      )->toBe(true)
+    )
+
+    testPromise("nothing is published when the caller is refused", async () => {
+      let _ = await refused(
+        placeOrder(~customerId="cust-B", ~identity=Reventless.Identity.anonymous),
+      )
+      expect(published.contents->Array.length)->toBe(0)
+    })
+
+    // The refusal is scoped to commands that actually record an owner. An
+    // anonymous caller invoking an unowned command has nothing to prove, and
+    // refusing it here would silently narrow `AllowAnonymous`.
+    testPromise("an anonymous caller may still issue an unowned command", async () => {
+      let _ = await generate(
+        payload(
+          ~command="ImportProducts",
+          ~args=Dict.fromArray([("batchId", str("b-1")), ("source", str("acme"))]),
+          ~identity=Reventless.Identity.anonymous,
+        ),
+      )->Effect.runPromise
+      expect(lastPublished()->fieldOf("source"))->toEqual(Some(str("acme")))
+    })
+  })
+})