@reventlessdev/reventless-core 3.0.0-alpha.224 → 3.0.0-alpha.226

package/src/components/Api/QueryDbListQuery.res.mjs

@@ -48,7 +48,7 @@ function buildConnection(pageItems, hasNextPage, hasPreviousPage, cursorValueOf)
   };
 }
 
-function run(items, argsDict, capability, labelField, decodeLocalIdOpt) {
+function run(items, argsDict, capability, labelField, decodeLocalIdOpt, ownerScope) {
   let decodeLocalId = decodeLocalIdOpt !== undefined ? decodeLocalIdOpt : Api_Ids$ReventlessCore.toLocalId;
   let filterDict = Stdlib_Option.getOr(Stdlib_Option.flatMap(argsDict["filter"], Stdlib_JSON.Decode.object), {});
   let search = Stdlib_Option.flatMap(filterDict["search"], Stdlib_JSON.Decode.string);
@@ -95,8 +95,15 @@ function run(items, argsDict, capability, labelField, decodeLocalIdOpt) {
       passIds = true;
     }
     let passPerField = perFieldChecks.every(check => check(item));
-    if (passSearch && passPrefix && passIds) {
-      return passPerField;
+    let passOwner;
+    if (ownerScope !== undefined) {
+      let required = ownerScope[1];
+      passOwner = Stdlib_Option.mapOr(getFieldString(item, ownerScope[0]), false, v => v === required);
+    } else {
+      passOwner = true;
+    }
+    if (passSearch && passPrefix && passIds && passPerField) {
+      return passOwner;
     } else {
       return false;
     }

package/src/components/Api/SuryToJsonSchema.res

@@ -188,9 +188,17 @@ and withSemantic = (fieldSchema: JSON.t, sem: Reventless.Semantic.t): JSON.t =>
 // through here: nothing validates a read schema. A command schema is the input
 // of a form, and a field listed as required is one the form refuses to submit
 // without — which turned `imageUrl?` into a picture every product had to have.
+//
+// `owners` arrives the same way `optional` does — a list of field names read off
+// the sury schema by the caller — rather than as a case in the IR. The IR is
+// shape-driven, and ownership is not a shape: it says which principal a record
+// belongs to, leaving the field a plain string either way. Threading it here
+// also keeps it available on command variants, which carry no annotation spec
+// for `mergeAnnotations` to read.
 and objectRefToJsonSchema = (
   ~annotations: option<Reventless.StateAnnotations.stateAnnotationSpec>=?,
   ~optional: array<string>=[],
+  ~owners: array<string>=[],
   fields: dict<SchemaType.schemaType>,
 ): JSON.t => {
   let props = Dict.make()
@@ -203,6 +211,16 @@ and objectRefToJsonSchema = (
     | Some(spec) => mergeAnnotations(baseSchema, fieldName, spec)
     | None => baseSchema
     }
+    let withAnnotations = if owners->Array.includes(fieldName) {
+      switch withAnnotations->JSON.Decode.object {
+      | Some(obj) =>
+        obj->Dict.set("x-reventless-owner", JSON.Encode.bool(true))
+        JSON.Encode.object(obj)
+      | None => withAnnotations
+      }
+    } else {
+      withAnnotations
+    }
     props->Dict.set(fieldName, withAnnotations)
     if !(optional->Array.includes(fieldName)) {
       required->Array.push(fieldName)
@@ -227,6 +245,7 @@ let deriveObjectSchema = (schema: S.t<unknown>): JSON.t =>
     let objSchema = objectRefToJsonSchema(
       ~annotations?,
       ~optional=SchemaType.optionalFieldNames(schema),
+      ~owners=Reventless.Owner.fieldNames(schema),
       fields,
     )
     // Surface component-level hints on the top-level object schema.

package/src/components/Api/SuryToJsonSchema.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as SchemaType$ReventlessCore from "./SchemaType.res.mjs";
 import * as StateAnnotations$Reventless from "@reventlessdev/reventless-spec/src/components/StateAnnotations.res.mjs";
@@ -178,7 +179,7 @@ function fromSchemaType(st) {
           ]
         ]);
       case "ObjectRef" :
-        return objectRefToJsonSchema(undefined, undefined, st._1);
+        return objectRefToJsonSchema(undefined, undefined, undefined, st._1);
       case "Enum" :
         return Object.fromEntries([
           [
@@ -222,15 +223,28 @@ function withSemantic(fieldSchema, sem) {
   return obj;
 }
 
-function objectRefToJsonSchema(annotations, optionalOpt, fields) {
+function objectRefToJsonSchema(annotations, optionalOpt, ownersOpt, fields) {
   let optional = optionalOpt !== undefined ? optionalOpt : [];
+  let owners = ownersOpt !== undefined ? ownersOpt : [];
   let props = {};
   let required = [];
   Object.entries(fields).forEach(param => {
     let fieldName = param[0];
     let baseSchema = fromSchemaType(param[1]);
     let withAnnotations = annotations !== undefined ? mergeAnnotations(baseSchema, fieldName, annotations) : baseSchema;
-    props[fieldName] = withAnnotations;
+    let withAnnotations$1;
+    if (owners.includes(fieldName)) {
+      let obj = Stdlib_JSON.Decode.object(withAnnotations);
+      if (obj !== undefined) {
+        obj["x-reventless-owner"] = true;
+        withAnnotations$1 = obj;
+      } else {
+        withAnnotations$1 = withAnnotations;
+      }
+    } else {
+      withAnnotations$1 = withAnnotations;
+    }
+    props[fieldName] = withAnnotations$1;
     if (!optional.includes(fieldName)) {
       required.push(fieldName);
       return;
@@ -264,7 +278,7 @@ function deriveObjectSchema(schema) {
       ]]);
   }
   let annotations = StateAnnotations$Reventless.getSpec(schema);
-  let objSchema = objectRefToJsonSchema(annotations, SchemaType$ReventlessCore.optionalFieldNames(schema), fields);
+  let objSchema = objectRefToJsonSchema(annotations, SchemaType$ReventlessCore.optionalFieldNames(schema), Owner$Reventless.fieldNames(schema), fields);
   if (annotations === undefined) {
     return objSchema;
   }

package/src/components/CommandGenerator/CommandGenerator_Callback.res

@@ -30,6 +30,48 @@ module type T = {
   let generateCommand: CommandGenerator.commandGenerator
 }
 
+/**
+Overwrite every `@owner`-marked field of the command being issued with the
+authenticated caller's id.
+
+Deliberately here rather than in a transport's resolver. The local GraphQL
+resolver and the AppSync mutation template build the same `payload` and both
+hand it to `makeGenerateCommand`, so this is the only place a single edit is
+true on both — and a rule enforced on one transport and not the other is worse
+than no rule, because it reads as enforced.
+
+**Overwrite, not fill-if-absent.** A caller who omits the field and a caller who
+sends someone else's id must produce the same row. Filling only the absent case
+passes every test that does not forge the field, and forging it is the whole
+attack.
+
+An exempt caller — the platform's own service traffic, or an operator — is left
+alone, so acting on another principal's behalf stays possible for those who may.
+A caller that cannot be identified is refused outright, but only for commands
+that actually carry an owner: an anonymous caller invoking an `AllowAnonymous`
+command with no owner field has nothing to prove and is not this rule's business.
+*/
+let stampOwnerFields = (
+  obj: dict<JSON.t>,
+  ~commandSchema: S.t<unknown>,
+  ~command: string,
+  ~identity: Reventless.Identity.t,
+  ~serviceName: string,
+) =>
+  switch Reventless.Owner.variantFieldNames(commandSchema, ~variant=command) {
+  | [] => ()
+  | ownerFields =>
+    switch identity->Reventless.OwnerScope.resolve {
+    | System | Elevated(_) => ()
+    | Owned({userId}) =>
+      ownerFields->Array.forEach(field => obj->Dict.set(field, JSON.Encode.string(userId)))
+    | Unidentified(why) =>
+      JsError.throwWithMessage(
+        `Forbidden: ${serviceName}.${command} records an owner, but the caller could not be identified (${why})`,
+      )
+    }
+  }
+
 let makeGenerateCommand = (
   ~publishJsons: CommandGenerator.publishJsons,
   ~publishJsonsAndWait: option<CommandTopic.publishJsonsAndWait>=?,
@@ -58,6 +100,12 @@ let makeGenerateCommand = (
           if stripIdFromParams {
             obj->Dict.delete("id")
           }
+          obj->stampOwnerFields(
+            ~commandSchema,
+            ~command=payload.command,
+            ~identity=payload.identity,
+            ~serviceName,
+          )
           obj->Dict.toArray
         }
       | None =>

package/src/components/CommandGenerator/CommandGenerator_Callback.res.mjs

@@ -5,8 +5,10 @@ import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Message$ReventlessCore from "../../Message.res.mjs";
 import * as LogFormat$ReventlessCore from "../../util/LogFormat.res.mjs";
 import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
@@ -24,6 +26,29 @@ function clearCommandInterceptor() {
   commandInterceptorHook.contents = undefined;
 }
 
+function stampOwnerFields(obj, commandSchema, command, identity, serviceName) {
+  let ownerFields = Owner$Reventless.variantFieldNames(commandSchema, command);
+  if (ownerFields.length === 0) {
+    return;
+  }
+  let why = OwnerScope$Reventless.resolve(identity, undefined);
+  if (typeof why !== "object") {
+    return;
+  }
+  switch (why.TAG) {
+    case "Elevated" :
+      return;
+    case "Owned" :
+      let userId = why.userId;
+      ownerFields.forEach(field => {
+        obj[field] = userId;
+      });
+      return;
+    case "Unidentified" :
+      return Stdlib_JsError.throwWithMessage(`Forbidden: ` + serviceName + `.` + command + ` records an owner, but the caller could not be identified (` + why._0 + `)`);
+  }
+}
+
 function makeGenerateCommand(publishJsons, publishJsonsAndWait, serviceName, commandSchema, componentKind, $staropt$star) {
   return payload => {
     let stripIdFromParams = $staropt$star !== undefined ? $staropt$star : true;
@@ -41,7 +66,7 @@ function makeGenerateCommand(publishJsons, publishJsonsAndWait, serviceName, com
         correlationId: msgId
       };
       let obj = Stdlib_Option.flatMap(JSON.stringify(payload.arguments), jsonString => Stdlib_JSON.Decode.object(JSON.parse(jsonString)));
-      let params = obj !== undefined ? (stripIdFromParams ? Stdlib_Dict.$$delete(obj, "id") : undefined, Object.entries(obj)) : Stdlib_JsError.throwWithMessage("Couldn't decode:" + Stdlib_Option.getOr(JSON.stringify(payload.arguments), "<payload.arguments>"));
+      let params = obj !== undefined ? (stripIdFromParams ? Stdlib_Dict.$$delete(obj, "id") : undefined, stampOwnerFields(obj, commandSchema, payload.command, payload.identity, serviceName), Object.entries(obj)) : Stdlib_JsError.throwWithMessage("Couldn't decode:" + Stdlib_Option.getOr(JSON.stringify(payload.arguments), "<payload.arguments>"));
       let commandStr = payload.command;
       let match = params.length;
       let commandJson = match !== 0 ? Object.fromEntries([[
@@ -155,6 +180,7 @@ export {
   commandInterceptorHook,
   registerCommandInterceptor,
   clearCommandInterceptor,
+  stampOwnerFields,
   makeGenerateCommand,
   Make,
 }

package/src/plugin/component/Plugin_Structure.res

@@ -299,10 +299,33 @@ let make = (
       }
     }
 
+  // A rule the server enforces, expressed as the keys a client checks against
+  // `identity.groups ++ config.accessTiers`. `AllowGroups` is satisfied by ANY of
+  // its groups (`Authorization.isAllowed` is `some`, not `every`), so the array is
+  // an any-of and a client must read it that way.
+  //
+  // `AllowAuthenticated` / `AllowAnonymous` ask for nothing a client can check —
+  // anyone holding a session already satisfies them — so they publish no keys
+  // rather than a key everyone holds.
+  //
+  // `DenyAll` also publishes none, deliberately. An unsatisfiable key would render
+  // as locked-with-upsell in a tiered shell: a surface advertised as purchasable
+  // that no purchase unlocks. A component nobody may call belongs in no menu, and
+  // that is an omission for the enumerating side to make, not a key to invent here.
+  let accessKeysFor = (rule: Reventless.Authorization.permission): option<array<string>> =>
+    switch rule {
+    | AllowGroups(groups) if groups->Array.length > 0 => Some(groups)
+    | AllowGroups(_) | AllowAuthenticated | AllowAnonymous | DenyAll => None
+    }
+
   let toCommandDef = (
     ~isAggregate,
     ~mutationFieldFor: string => string,
     ~parentSchema: S.t<unknown>,
+    // The PPX-generated `command => permission`. Per VARIANT, not per component:
+    // one aggregate carries commands with very different audiences, and a
+    // component-level shortcut would gate `AddProduct` and `PlaceOrder` alike.
+    ~commandAuthorization: unknown => Reventless.Authorization.permission,
     v: S.t<unknown>,
   ): option<Reventless.Plugin.commandDef> => {
     // Build a commandDef for one variant. `properties` is the variant's field dict —
@@ -329,6 +352,14 @@ let make = (
         | Some(excluded) => !(excluded->Set.has(variantName))
         | None => true
         }
+      // Evaluated against a synthetic value per constructor, the same shape the
+      // resolver builds at call time: a payload-bearing variant compiles to
+      // `{TAG, ...}`, a payload-less one to a bare string.
+      let syntheticCommand: unknown =
+        Reventless.DcbTag.isVariantPayloadBearing(parentSchema, variantName)
+          ? {"TAG": variantName}->Obj.magic
+          : variantName->Obj.magic
+      let requiredAccess = accessKeysFor(commandAuthorization(syntheticCommand))
       ({
         Reventless.Plugin.name: variantName,
         // The derived schema, not sury's raw one: `S.toJSONSchema` carries the
@@ -355,6 +386,11 @@ let make = (
         allowedStates,
         targetState,
         apiExposed: Some(apiExposed),
+        requiredAccess,
+        // Resolved from this constructor's own properties, not the union's: two
+        // commands in one slice can disagree about whether they record an owner,
+        // and the write path stamps per constructor for the same reason.
+        ownerField: Reventless.Owner.fieldNamesOfProperties(properties)->Array.get(0),
       }: Reventless.Plugin.commandDef)
     }
     switch v {
@@ -379,17 +415,29 @@ let make = (
   let extractCommandDefs = (
     ~isAggregate,
     ~mutationFieldFor: string => string,
+    ~commandAuthorization: unknown => Reventless.Authorization.permission,
     commandSchema: S.t<unknown>,
   ): array<Reventless.Plugin.commandDef> =>
     switch commandSchema {
     | Union({anyOf}) =>
       anyOf->Array.filterMap(v =>
-        toCommandDef(~isAggregate, ~mutationFieldFor, ~parentSchema=commandSchema, v)
+        toCommandDef(
+          ~isAggregate,
+          ~mutationFieldFor,
+          ~parentSchema=commandSchema,
+          ~commandAuthorization,
+          v,
+        )
       )
     | _ =>
       // Single-variant command types compile to a bare Object schema, not a Union.
-      toCommandDef(~isAggregate, ~mutationFieldFor, ~parentSchema=commandSchema, commandSchema)
-      ->Option.mapOr([], def => [def])
+      toCommandDef(
+        ~isAggregate,
+        ~mutationFieldFor,
+        ~parentSchema=commandSchema,
+        ~commandAuthorization,
+        commandSchema,
+      )->Option.mapOr([], def => [def])
     }
 
   // ── Per-component event type extraction ────────────────────────────────────
@@ -671,6 +719,9 @@ let make = (
         searchableFields: label.searchableFields,
         labelFieldSource: Some(labelFieldSourceToString(label.source)),
         statusField: statusFieldFromStateSchema(~entityName=R.Spec.name, stateSchema),
+        // Same schema `statusField` reads, so the two cannot disagree about which
+        // fields this view has.
+        ownerField: Reventless.Owner.fieldNames(stateSchema)->Array.get(0),
         visibility: visibilityTag(R.Spec.visibility),
         chapter: chapterOf(R.Spec.name),
         // Taken from the `qf` record, never re-derived: `Api_Naming` is the only
@@ -679,6 +730,7 @@ let make = (
         singleQueryField: Some(qf.singleFieldName),
         idField: keyField->Option.map(((f, _)) => f),
         idFieldSource: keyField->Option.map(((_, rung)) => rung),
+        requiredAccess: accessKeysFor(R.Spec.authorization),
       }: Reventless.Plugin.queryableDef)
     })
 
@@ -702,11 +754,13 @@ let make = (
         searchableFields: label.searchableFields,
         labelFieldSource: Some(labelFieldSourceToString(label.source)),
         statusField: statusFieldFromStateSchema(~entityName=SVS.Spec.name, stateSchema),
+        ownerField: Reventless.Owner.fieldNames(stateSchema)->Array.get(0),
         visibility: visibilityTag(SVS.Spec.visibility),
         chapter: chapterOf(SVS.Spec.name),
         singleQueryField: Some(qf.singleFieldName),
         idField: keyField->Option.map(((f, _)) => f),
         idFieldSource: keyField->Option.map(((_, rung)) => rung),
+        requiredAccess: accessKeysFor(SVS.Spec.authorization),
       }: Reventless.Plugin.queryableDef)
     })
 
@@ -727,6 +781,7 @@ let make = (
               ~commandSchema=SCS.Spec.commandSchema->S.castToUnknown,
               ~variant=variantName,
             ),
+          ~commandAuthorization=SCS.Spec.commandAuthorization->Obj.magic,
           SCS.Spec.commandSchema->S.castToUnknown,
         ),
         producedEventTypes: produced,
@@ -750,6 +805,7 @@ let make = (
         commands: extractCommandDefs(
           ~isAggregate=true,
           ~mutationFieldFor=variantName => Api_Naming.aggregateMutationField(~plugin=name, ~aggregate=A.Spec.name, ~command=variantName),
+          ~commandAuthorization=A.Spec.commandAuthorization->Obj.magic,
           A.Spec.commandSchema->S.castToUnknown,
         ),
         producedEventTypes: produced,

package/src/plugin/component/Plugin_Structure.res.mjs

@@ -4,6 +4,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Primitive_int from "@rescript/runtime/lib/es6/Primitive_int.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Belt_SetString from "@rescript/runtime/lib/es6/Belt_SetString.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
@@ -269,7 +270,16 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
       ];
     }
   };
-  let toCommandDef = (isAggregate, mutationFieldFor, parentSchema, v) => {
+  let accessKeysFor = rule => {
+    if (typeof rule !== "object") {
+      return;
+    }
+    let groups = rule._0;
+    if (groups.length !== 0) {
+      return groups;
+    }
+  };
+  let toCommandDef = (isAggregate, mutationFieldFor, parentSchema, commandAuthorization, v) => {
     let mkDef = (variantName, properties) => {
       let match = commandLevelAndId(isAggregate, variantName, properties);
       let references = extractReferences(properties);
@@ -280,6 +290,10 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
         let excluded = ApiNoApiHelpers$ReventlessCore.getExcludedVariants(parentSchema);
         apiExposed = excluded !== undefined ? !excluded.has(variantName) : true;
       }
+      let syntheticCommand = DcbTag$Reventless.isVariantPayloadBearing(parentSchema, variantName) ? ({
+          TAG: variantName
+        }) : variantName;
+      let requiredAccess = accessKeysFor(commandAuthorization(syntheticCommand));
       return {
         name: variantName,
         schema: JSON.stringify(SuryToJsonSchema$ReventlessCore.deriveObjectSchema(v)),
@@ -289,7 +303,9 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
         references: references,
         allowedStates: allowedStates,
         targetState: targetState,
-        apiExposed: apiExposed
+        apiExposed: apiExposed,
+        requiredAccess: requiredAccess,
+        ownerField: Owner$Reventless.fieldNamesOfProperties(properties)[0]
       };
     };
     switch (v.type) {
@@ -315,11 +331,11 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
         return;
     }
   };
-  let extractCommandDefs = (isAggregate, mutationFieldFor, commandSchema) => {
+  let extractCommandDefs = (isAggregate, mutationFieldFor, commandAuthorization, commandSchema) => {
     if (commandSchema.type === "union") {
-      return Stdlib_Array.filterMap(commandSchema.anyOf, v => toCommandDef(isAggregate, mutationFieldFor, commandSchema, v));
+      return Stdlib_Array.filterMap(commandSchema.anyOf, v => toCommandDef(isAggregate, mutationFieldFor, commandSchema, commandAuthorization, v));
     } else {
-      return Stdlib_Option.mapOr(toCommandDef(isAggregate, mutationFieldFor, commandSchema, commandSchema), [], def => [def]);
+      return Stdlib_Option.mapOr(toCommandDef(isAggregate, mutationFieldFor, commandSchema, commandAuthorization, commandSchema), [], def => [def]);
     }
   };
   let scsProduced = stateChangeSlices.map(SCS => [
@@ -513,11 +529,13 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
       searchableFields: label.searchableFields,
       labelFieldSource: labelFieldSourceToString(label.source),
       statusField: statusFieldFromStateSchema(R.Spec.name, stateSchema),
+      ownerField: Owner$Reventless.fieldNames(stateSchema)[0],
       visibility: visibilityTag(R.Spec.visibility),
       chapter: componentChapters[R.Spec.name],
       singleQueryField: qf.singleFieldName,
       idField: Stdlib_Option.map(keyField, param => param[0]),
-      idFieldSource: Stdlib_Option.map(keyField, param => param[1])
+      idFieldSource: Stdlib_Option.map(keyField, param => param[1]),
+      requiredAccess: accessKeysFor(R.Spec.authorization)
     };
   });
   let stateViewDefs = stateViewSlices.map((SVS, i) => {
@@ -537,11 +555,13 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
       searchableFields: label.searchableFields,
       labelFieldSource: labelFieldSourceToString(label.source),
       statusField: statusFieldFromStateSchema(SVS.Spec.name, stateSchema),
+      ownerField: Owner$Reventless.fieldNames(stateSchema)[0],
       visibility: visibilityTag(SVS.Spec.visibility),
       chapter: componentChapters[SVS.Spec.name],
       singleQueryField: qf.singleFieldName,
       idField: Stdlib_Option.map(keyField, param => param[0]),
-      idFieldSource: Stdlib_Option.map(keyField, param => param[1])
+      idFieldSource: Stdlib_Option.map(keyField, param => param[1]),
+      requiredAccess: accessKeysFor(SVS.Spec.authorization)
     };
   });
   let stateChangeDefs = stateChangeSlices.map((SCS, i) => {
@@ -551,7 +571,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let consumed = match$1[1];
     return {
       name: SCS.Spec.name,
-      commands: extractCommandDefs(false, variantName => Api_Naming$ReventlessCore.sliceMutationFieldFor(name, SCS.Spec.name, SCS.Spec.commandSchema, variantName), SCS.Spec.commandSchema),
+      commands: extractCommandDefs(false, variantName => Api_Naming$ReventlessCore.sliceMutationFieldFor(name, SCS.Spec.name, SCS.Spec.commandSchema, variantName), SCS.Spec.commandAuthorization, SCS.Spec.commandSchema),
       producedEventTypes: produced,
       consumedEventTypes: consumed,
       linkedViews: linkedSvsFor(produced),
@@ -566,7 +586,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let produced = match[1];
     return {
       name: A.Spec.name,
-      commands: extractCommandDefs(true, variantName => Api_Naming$ReventlessCore.aggregateMutationField(name, A.Spec.name, variantName), A.Spec.commandSchema),
+      commands: extractCommandDefs(true, variantName => Api_Naming$ReventlessCore.aggregateMutationField(name, A.Spec.name, variantName), A.Spec.commandAuthorization, A.Spec.commandSchema),
       producedEventTypes: produced,
       consumedEventTypes: [],
       linkedViews: linkedSvsFor(produced).concat(linkedReadModelsFor(A.Spec.name)),