@reventlessdev/reventless-core 3.0.0-alpha.224 → 3.0.0-alpha.225

package/tests/commandgenerator/OwnerStampingTest.res.mjs

@@ -0,0 +1,195 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Effect from "effect/Effect";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as CommandGenerator_Callback$ReventlessCore from "../../src/components/CommandGenerator/CommandGenerator_Callback.res.mjs";
+
+S.enableJson();
+
+let commandSchema = S.union([
+  S.schema(s => ({
+    TAG: "PlaceOrder",
+    orderId: s.m(DcbTag$Reventless.string),
+    customerId: s.m(Owner$Reventless.string),
+    note: s.m(S.string)
+  })),
+  S.schema(s => ({
+    TAG: "ImportProducts",
+    batchId: s.m(DcbTag$Reventless.string),
+    source: s.m(S.string)
+  }))
+]);
+
+let published = {
+  contents: []
+};
+
+let generate = CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(async cmds => {
+  published.contents = published.contents.concat(cmds);
+}, undefined, "Ordering", commandSchema, "StateChangeSlice", false);
+
+function cognito(userId, groups) {
+  return {
+    userId: userId,
+    username: userId,
+    groups: groups,
+    provider: "Cognito"
+  };
+}
+
+let iam = {
+  userArn: "arn:aws:sts::1:assumed-role/Ingester",
+  accountId: "1",
+  username: "Ingester",
+  provider: "IAM"
+};
+
+function payload(command, args, identity) {
+  return {
+    command: command,
+    arguments: args,
+    meta: {
+      ip: ["127.0.0.1"],
+      user: "test",
+      info: ""
+    },
+    identity: identity
+  };
+}
+
+function str(prim) {
+  return prim;
+}
+
+function placeOrder(customerId, identity) {
+  return payload("PlaceOrder", Object.fromEntries([
+    [
+      "orderId",
+      "o-1"
+    ],
+    [
+      "customerId",
+      customerId
+    ],
+    [
+      "note",
+      "gift wrap"
+    ]
+  ]), identity);
+}
+
+function fieldOf(cmd, name) {
+  return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(cmd.commandJson), o => o[name]);
+}
+
+function lastPublished() {
+  return published.contents[published.contents.length - 1 | 0];
+}
+
+globalThis.beforeEach(() => {
+  published.contents = [];
+  OwnerScope$Reventless.setElevatedGroups(["Admin"]);
+});
+
+globalThis.describe("@owner stamping on the command path:", () => {
+  globalThis.test("an omitted owner field is filled from the caller", async () => {
+    await Effect.runPromise(generate(payload("PlaceOrder", Object.fromEntries([
+      [
+        "orderId",
+        "o-1"
+      ],
+      [
+        "note",
+        ""
+      ]
+    ]), cognito("cust-A", ["User"]))));
+    globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")).toEqual("cust-A");
+  });
+  globalThis.test("a FORGED owner field is overwritten, not respected", async () => {
+    await Effect.runPromise(generate(placeOrder("cust-B", cognito("cust-A", ["User"]))));
+    globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")).toEqual("cust-A");
+  });
+  globalThis.test("non-owner fields of the same command are untouched", async () => {
+    await Effect.runPromise(generate(placeOrder("cust-B", cognito("cust-A", ["User"]))));
+    globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "note")).toEqual("gift wrap");
+  });
+  globalThis.test("a command in the same union with no owner field is left alone", async () => {
+    await Effect.runPromise(generate(payload("ImportProducts", Object.fromEntries([
+      [
+        "batchId",
+        "b-1"
+      ],
+      [
+        "source",
+        "acme"
+      ]
+    ]), cognito("cust-A", ["User"]))));
+    globalThis.expect([
+      fieldOf(published.contents[published.contents.length - 1 | 0], "source"),
+      fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")
+    ]).toEqual([
+      "acme",
+      undefined
+    ]);
+  });
+  globalThis.describe("exempt callers keep the value they sent:", () => {
+    globalThis.test("an elevated caller's chosen customerId survives", async () => {
+      await Effect.runPromise(generate(placeOrder("cust-B", cognito("ops-1", ["Admin"]))));
+      globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")).toEqual("cust-B");
+    });
+    globalThis.test("an IAM system caller's chosen customerId survives", async () => {
+      await Effect.runPromise(generate(placeOrder("cust-B", iam)));
+      globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "customerId")).toEqual("cust-B");
+    });
+  });
+  globalThis.describe("a caller that cannot be identified is refused:", () => {
+    let refused = async p => {
+      try {
+        await Effect.runPromise(generate(p));
+        return false;
+      } catch (exn) {
+        return true;
+      }
+    };
+    globalThis.test("an anonymous caller cannot place an owned command", async () => {
+      globalThis.expect(await refused(placeOrder("cust-B", Identity$Reventless.anonymous))).toBe(true);
+    });
+    globalThis.test("nothing is published when the caller is refused", async () => {
+      await refused(placeOrder("cust-B", Identity$Reventless.anonymous));
+      globalThis.expect(published.contents.length).toBe(0);
+    });
+    globalThis.test("an anonymous caller may still issue an unowned command", async () => {
+      await Effect.runPromise(generate(payload("ImportProducts", Object.fromEntries([
+        [
+          "batchId",
+          "b-1"
+        ],
+        [
+          "source",
+          "acme"
+        ]
+      ]), Identity$Reventless.anonymous)));
+      globalThis.expect(fieldOf(published.contents[published.contents.length - 1 | 0], "source")).toEqual("acme");
+    });
+  });
+});
+
+export {
+  commandSchema,
+  published,
+  generate,
+  cognito,
+  iam,
+  payload,
+  str,
+  placeOrder,
+  fieldOf,
+  lastPublished,
+}
+/*  Not a pure module */

package/tests/plugin/PluginStructureAccessTest.res

@@ -0,0 +1,110 @@
+// `requiredAccess` is derived from the authorization rule the server enforces, so
+// what these assert is that the manifest cannot describe a different policy from
+// the one the resolver applies. A client uses the keys to stop offering what it
+// would be refused; it never decides anything with them.
+
+open JestGlobals
+
+type scsComponent = Component.t<
+  ReventlessInfra.StateChangeSlice.t,
+  ReventlessInfra.StateChangeSlice.outputs,
+  ReventlessInfra.StateChangeSlice.operations,
+>
+type svsComponent = Component.t<
+  ReventlessInfra.StateViewSlice.t,
+  ReventlessInfra.StateViewSlice.outputs,
+  ReventlessInfra.StateViewSlice.operations,
+>
+
+module PsGatedCommandsSlice: ReventlessInfra.StateChangeSlice.T = {
+  module Spec = PsGatedCommands
+  module Behavior = {
+    type state = PsGatedCommands.state
+    let initialState = PsGatedCommands.initialState
+    let evolve = PsGatedCommands.evolve
+    let decide = PsGatedCommands.decide
+    let moduleUrl = PsGatedCommands.moduleUrl
+  }
+  let isAsync = false
+  type component = scsComponent
+  let make = (
+    ~dcbEventLog as _,
+    ~publishJsons as _,
+    ~tagKeysByEventType as _=?,
+    ~crossPartitionTagKeys as _=?,
+    ~runtime as _=?,
+    ~opts as _=?,
+  ): component => Obj.magic(0)
+}
+
+module PsGatedViewSlice: ReventlessInfra.StateViewSlice.T = {
+  module Spec = PsGatedView
+  module Projection = {
+    let project = PsGatedView.project
+    let moduleUrl = PsGatedView.moduleUrl
+  }
+  type component = svsComponent
+  let make = (~dcbEventLog as _, ~runtime as _=?, ~opts as _=?): component => Obj.magic(0)
+}
+
+module PsOrdersViewSlice: ReventlessInfra.StateViewSlice.T = {
+  module Spec = PsOrdersView
+  module Projection = {
+    let project = PsOrdersView.project
+    let moduleUrl = PsOrdersView.moduleUrl
+  }
+  type component = svsComponent
+  let make = (~dcbEventLog as _, ~runtime as _=?, ~opts as _=?): component => Obj.magic(0)
+}
+
+let structure = Plugin_Structure.make(
+  ~name="AccessPlugin",
+  ~stateChangeSlices=[module(PsGatedCommandsSlice)],
+  ~stateViewSlices=[module(PsGatedViewSlice), module(PsOrdersViewSlice)],
+)
+
+let commandNamed = name =>
+  structure.stateChangeSlices
+  ->Array.flatMap(w => w.commands)
+  ->Array.find(c => c.name === name)
+  ->Option.flatMap(c => c.requiredAccess)
+
+let viewNamed = name =>
+  structure.stateViewSlices
+  ->Array.find(q => q.name === name)
+  ->Option.flatMap(q => q.requiredAccess)
+
+describe("requiredAccess derived from the authorization rule", () => {
+  testSync("an AllowGroups command publishes its groups", () =>
+    expect(commandNamed("Restock"))->toEqual(Some(["Admin", "Ops"]))
+  )
+
+  // The reason the rule is evaluated per constructor rather than per component:
+  // one slice, two audiences, and a component-level shortcut would gate both.
+  testSync("a sibling command in the same slice publishes nothing", () =>
+    expect(commandNamed("RequestRestock"))->toEqual(None)
+  )
+
+  testSync("a module-level rule reaches the view it guards", () =>
+    expect(viewNamed("GatedView"))->toEqual(Some(["Admin"]))
+  )
+
+  testSync("an unannotated view publishes nothing", () =>
+    expect(viewNamed("Orders"))->toEqual(None)
+  )
+
+  // Null rather than `[]` on the wire: "no key gates this" is one answer, and a
+  // def written before the field existed has to read as the same thing.
+  testSync("nothing to require encodes as null, not an empty list", () => {
+    let json =
+      Platform_ComponentDefinitionsApi.encodePluginStructureEntry(
+        ~pluginId="AccessPlugin",
+        structure,
+      )->JSON.stringify
+    expect((
+      json->String.includes(`"requiredAccess":null`),
+      json->String.includes(`"requiredAccess":["Admin","Ops"]`),
+      json->String.includes(`"requiredAccess":[]`),
+    ))->toEqual((true, true, false))
+  })
+})

package/tests/plugin/PluginStructureAccessTest.res.mjs

@@ -0,0 +1,144 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as PsGatedView$ReventlessCore from "./StateViewSlice/PsGatedView.res.mjs";
+import * as PsOrdersView$ReventlessCore from "./StateViewSlice/PsOrdersView.res.mjs";
+import * as PsGatedCommands$ReventlessCore from "./StateChangeSlice/PsGatedCommands.res.mjs";
+import * as Plugin_Structure$ReventlessCore from "../../src/plugin/component/Plugin_Structure.res.mjs";
+import * as Platform_ComponentDefinitionsApi$ReventlessCore from "../../src/admin/Platform_ComponentDefinitionsApi.res.mjs";
+
+let Behavior = {
+  initialState: false,
+  evolve: PsGatedCommands$ReventlessCore.evolve,
+  decide: PsGatedCommands$ReventlessCore.decide,
+  moduleUrl: PsGatedCommands$ReventlessCore.moduleUrl
+};
+
+function make(param, param$1, param$2, param$3, param$4, param$5) {
+  return 0;
+}
+
+let PsGatedCommandsSlice_Spec = {
+  name: PsGatedCommands$ReventlessCore.name,
+  moduleUrl: PsGatedCommands$ReventlessCore.moduleUrl,
+  Id: Id$Reventless.$$String,
+  consumedEventSchema: PsGatedCommands$ReventlessCore.consumedEventSchema,
+  errorSchema: PsGatedCommands$ReventlessCore.errorSchema,
+  eventSchema: PsGatedCommands$ReventlessCore.eventSchema,
+  commandSchema: PsGatedCommands$ReventlessCore.commandSchema,
+  commandAuthorization: PsGatedCommands$ReventlessCore.commandAuthorization,
+  readConsistency: PsGatedCommands$ReventlessCore.readConsistency
+};
+
+let PsGatedCommandsSlice = {
+  Spec: PsGatedCommandsSlice_Spec,
+  Behavior: Behavior,
+  isAsync: false,
+  make: make
+};
+
+let Projection = {
+  project: PsGatedView$ReventlessCore.project,
+  moduleUrl: PsGatedView$ReventlessCore.moduleUrl
+};
+
+function make$1(param, param$1, param$2) {
+  return 0;
+}
+
+let PsGatedViewSlice_Spec = {
+  name: PsGatedView$ReventlessCore.name,
+  moduleUrl: PsGatedView$ReventlessCore.moduleUrl,
+  stateSchema: PsGatedView$ReventlessCore.stateSchema,
+  consumedEventSchema: PsGatedView$ReventlessCore.consumedEventSchema,
+  config: PsGatedView$ReventlessCore.config,
+  subIdConfig: undefined,
+  authorization: PsGatedView$ReventlessCore.authorization,
+  visibility: PsGatedView$ReventlessCore.visibility
+};
+
+let PsGatedViewSlice = {
+  Spec: PsGatedViewSlice_Spec,
+  Projection: Projection,
+  make: make$1
+};
+
+let Projection$1 = {
+  project: PsOrdersView$ReventlessCore.project,
+  moduleUrl: PsOrdersView$ReventlessCore.moduleUrl
+};
+
+function make$2(param, param$1, param$2) {
+  return 0;
+}
+
+let PsOrdersViewSlice_Spec = {
+  name: PsOrdersView$ReventlessCore.name,
+  moduleUrl: PsOrdersView$ReventlessCore.moduleUrl,
+  stateSchema: PsOrdersView$ReventlessCore.stateSchema,
+  consumedEventSchema: PsOrdersView$ReventlessCore.consumedEventSchema,
+  config: PsOrdersView$ReventlessCore.config,
+  subIdConfig: undefined,
+  authorization: PsOrdersView$ReventlessCore.authorization,
+  visibility: PsOrdersView$ReventlessCore.visibility
+};
+
+let PsOrdersViewSlice = {
+  Spec: PsOrdersViewSlice_Spec,
+  Projection: Projection$1,
+  make: make$2
+};
+
+let structure = Plugin_Structure$ReventlessCore.make("AccessPlugin", undefined, undefined, [
+  PsGatedViewSlice,
+  PsOrdersViewSlice
+], [PsGatedCommandsSlice], undefined, undefined, undefined, undefined, undefined, undefined);
+
+function commandNamed(name) {
+  return Stdlib_Option.flatMap(structure.stateChangeSlices.flatMap(w => w.commands).find(c => c.name === name), c => c.requiredAccess);
+}
+
+function viewNamed(name) {
+  return Stdlib_Option.flatMap(structure.stateViewSlices.find(q => q.name === name), q => q.requiredAccess);
+}
+
+globalThis.describe("requiredAccess derived from the authorization rule", () => {
+  globalThis.test("an AllowGroups command publishes its groups", () => {
+    globalThis.expect(commandNamed("Restock")).toEqual([
+      "Admin",
+      "Ops"
+    ]);
+  });
+  globalThis.test("a sibling command in the same slice publishes nothing", () => {
+    globalThis.expect(commandNamed("RequestRestock")).toEqual(undefined);
+  });
+  globalThis.test("a module-level rule reaches the view it guards", () => {
+    globalThis.expect(viewNamed("GatedView")).toEqual(["Admin"]);
+  });
+  globalThis.test("an unannotated view publishes nothing", () => {
+    globalThis.expect(viewNamed("Orders")).toEqual(undefined);
+  });
+  globalThis.test("nothing to require encodes as null, not an empty list", () => {
+    let json = JSON.stringify(Platform_ComponentDefinitionsApi$ReventlessCore.encodePluginStructureEntry("AccessPlugin", structure));
+    globalThis.expect([
+      json.includes(`"requiredAccess":null`),
+      json.includes(`"requiredAccess":["Admin","Ops"]`),
+      json.includes(`"requiredAccess":[]`)
+    ]).toEqual([
+      true,
+      true,
+      false
+    ]);
+  });
+});
+
+export {
+  PsGatedCommandsSlice,
+  PsGatedViewSlice,
+  PsOrdersViewSlice,
+  structure,
+  commandNamed,
+  viewNamed,
+}
+/* structure Not a pure module */

package/tests/plugin/StateChangeSlice/PsGatedCommands.res

@@ -0,0 +1,28 @@
+// Test fixture spec: one slice carrying commands with different audiences.
+// `Restock` is operator-only, `RequestRestock` is open to anyone signed in —
+// which is the case a component-level access rule would get wrong.
+
+@@reventless.spec("GatedCommands")
+
+type state = bool
+let initialState = false
+
+@schema
+type consumedEvent = StockLow({productId: string})
+
+let evolve = (_state, _event) => true
+
+@schema
+type command =
+  | @authorize(AllowGroups(["Admin", "Ops"])) Restock({productId: string})
+  | RequestRestock({productId: string})
+
+@schema
+type error = UnknownProduct
+
+@schema
+type event =
+  | Restocked({productId: string})
+  | RestockRequested({productId: string})
+
+let decide = (_state, _command): result<array<event>, error> => Ok([])

package/tests/plugin/StateChangeSlice/PsGatedCommands.res.mjs

@@ -0,0 +1,84 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+
+let consumedEventSchema = S.schema(s => ({
+  TAG: "StockLow",
+  productId: s.m(DcbTag$Reventless.string)
+}));
+
+function evolve(_state, _event) {
+  return true;
+}
+
+let commandSchema = S.union([
+  S.schema(s => ({
+    TAG: "Restock",
+    productId: s.m(DcbTag$Reventless.string)
+  })),
+  S.schema(s => ({
+    TAG: "RequestRestock",
+    productId: s.m(DcbTag$Reventless.string)
+  }))
+]);
+
+let errorSchema = S.literal("UnknownProduct");
+
+let eventSchema = S.union([
+  S.schema(s => ({
+    TAG: "Restocked",
+    productId: s.m(DcbTag$Reventless.string)
+  })),
+  S.schema(s => ({
+    TAG: "RestockRequested",
+    productId: s.m(DcbTag$Reventless.string)
+  }))
+]);
+
+function decide(_state, _command) {
+  return {
+    TAG: "Ok",
+    _0: []
+  };
+}
+
+function commandAuthorization(command) {
+  if (command.TAG === "Restock") {
+    return {
+      TAG: "AllowGroups",
+      _0: [
+        "Admin",
+        "Ops"
+      ]
+    };
+  } else {
+    return "AllowAuthenticated";
+  }
+}
+
+let name = "GatedCommands";
+
+let Id;
+
+let initialState = false;
+
+let moduleUrl = "@reventlessdev/reventless-core/tests/plugin/StateChangeSlice/PsGatedCommands.res.mjs";
+
+let readConsistency = "EscalateOnRetry";
+
+export {
+  name,
+  Id,
+  initialState,
+  consumedEventSchema,
+  evolve,
+  commandSchema,
+  errorSchema,
+  eventSchema,
+  decide,
+  moduleUrl,
+  commandAuthorization,
+  readConsistency,
+}
+/* consumedEventSchema Not a pure module */

package/tests/plugin/StateViewSlice/PsGatedView.res

@@ -0,0 +1,15 @@
+// Test fixture spec: a view whose module-level rule restricts who may read it.
+
+@@reventless.spec("GatedView")
+@@reventless.authorize(AllowGroups(["Admin"]))
+
+@schema
+type consumedEvent = OrderPlaced({orderId: string, customerName: string})
+
+@schema
+type state = {orderId: string, customerName: string}
+
+let project = ({event}: Reventless.StateViewSlice.consumed<consumedEvent>) =>
+  switch event {
+  | OrderPlaced({orderId, customerName}) => [Set(orderId, {orderId, customerName})]
+  }

package/tests/plugin/StateViewSlice/PsGatedView.res.mjs

@@ -0,0 +1,60 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as S from "sury/src/S.res.mjs";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
+
+let consumedEventSchema = S.schema(s => ({
+  TAG: "OrderPlaced",
+  orderId: s.m(DcbTag$Reventless.string),
+  customerName: s.m(S.string)
+}));
+
+let stateSchema = S.schema(s => ({
+  orderId: s.m(S.string),
+  customerName: s.m(S.string)
+}));
+
+function project(param) {
+  let event = param.event;
+  let orderId = event.orderId;
+  return [{
+      TAG: "Set",
+      _0: orderId,
+      _1: {
+        orderId: orderId,
+        customerName: event.customerName
+      }
+    }];
+}
+
+let config = ReadModel$Reventless.config(undefined, undefined, undefined);
+
+let authorization = {
+  TAG: "AllowGroups",
+  _0: ["Admin"]
+};
+
+let name = "GatedView";
+
+let Id;
+
+let subIdConfig;
+
+let moduleUrl = "@reventlessdev/reventless-core/tests/plugin/StateViewSlice/PsGatedView.res.mjs";
+
+let visibility = "Public";
+
+export {
+  name,
+  Id,
+  consumedEventSchema,
+  stateSchema,
+  project,
+  config,
+  subIdConfig,
+  moduleUrl,
+  authorization,
+  visibility,
+}
+/* consumedEventSchema Not a pure module */

package/tests/plugin/pluginDefinitionRequiredScalars.txt

@@ -41,6 +41,7 @@
 .structure.aggregates[].commands[].name: string
 .structure.aggregates[].commands[].references[].entity: string
 .structure.aggregates[].commands[].references[].fieldName: string
+.structure.aggregates[].commands[].requiredAccess[]: string
 .structure.aggregates[].commands[].schema: string
 .structure.aggregates[].consumedEventTypes[]: string
 .structure.aggregates[].errors[].name: string
@@ -77,6 +78,7 @@
 .structure.readModels[].linkedWriteSide[]: string
 .structure.readModels[].name: string
 .structure.readModels[].queryField: string
+.structure.readModels[].requiredAccess[]: string
 .structure.readModels[].schema: string
 .structure.readModels[].searchableFields[]: string
 .structure.requiredStoreDeclarations[].component: string
@@ -88,6 +90,7 @@
 .structure.stateChangeSlices[].commands[].name: string
 .structure.stateChangeSlices[].commands[].references[].entity: string
 .structure.stateChangeSlices[].commands[].references[].fieldName: string
+.structure.stateChangeSlices[].commands[].requiredAccess[]: string
 .structure.stateChangeSlices[].commands[].schema: string
 .structure.stateChangeSlices[].consumedEventTypes[]: string
 .structure.stateChangeSlices[].errors[].name: string
@@ -106,6 +109,7 @@
 .structure.stateViewSlices[].linkedWriteSide[]: string
 .structure.stateViewSlices[].name: string
 .structure.stateViewSlices[].queryField: string
+.structure.stateViewSlices[].requiredAccess[]: string
 .structure.stateViewSlices[].schema: string
 .structure.stateViewSlices[].searchableFields[]: string
 .version: string