@reventlessdev/reventless-core 3.0.0-alpha.237 → 3.0.0-alpha.239

package/src/components/Dcb/Dcb_Builder.res

@@ -312,7 +312,7 @@ module Make = (
         // sweeps up sibling products. Cross-partition fan-out and capacity reads are
         // preserved (generalised rule 3). Safety guard: if any slice's partition is
         // ambiguous we keep the annotated values for the whole boundary rather than
-        // thread a partial inference. See docs/plans/dcb-tag-scope-inference.md.
+        // thread a partial inference. See docs/plans/done/dcb-tag-scope-inference.md.
         let inferenceShapes =
           stateChangeSlices->Array.map((module(Sc: StateChangeSlice.T)) =>
             Reventless.DcbTag.sliceShapeFromSchemas(
@@ -761,28 +761,80 @@ module Make = (
         // + AppSync direct invocations (CommandGenerator.payload format)
         let dcbHandlerBase = DcbCommandTopic.makeFilteringHandler(dcbCommandTopic)
 
-        // Shared generateCommand for AppSync direct invocations — all sync StateChangeSlices
-        // share the same DCB CommandTopic's publishJsons, so a single function suffices.
-        // commandSchema validation is skipped (permissive JSON.t schema) because AppSync
-        // already validates input against the SDL.
+        // generateCommand for AppSync direct invocations, one per command constructor.
+        //
+        // Every one of them shares this CommandTopic's publishJsons — the reason a
+        // single function used to suffice — and they differ in exactly one argument:
+        // the schema. That argument is not only a validator. `makeGenerateCommand`
+        // also reads it to find the fields a command marks as its owner, and stamps
+        // them with the caller. Handing it the permissive `S.json` (as this did, on
+        // the still-true grounds that AppSync has already validated against the SDL)
+        // makes that lookup answer "no owner fields" for every command there is — so
+        // the write publishes whatever owner the CLIENT sent, silently, and the row
+        // is wrong from then on.
+        //
+        // Per-slice decoding still happens inside `buildSliceHandler`; nothing here
+        // re-validates. The schema travels for what it says about ownership.
+        let dcbCommandSchemasByTag = {
+          let byTag = Dict.make()
+          stateChangeSlices->Array.forEach((module(S: StateChangeSlice.T)) => {
+            let commandSchema = S.Spec.commandSchema->Reventless.DcbTag.toUnknownSchema
+            if !(ApiNoApiHelpers.isNoApi(commandSchema)) {
+              Api_Naming.sliceMutationFields(
+                ~plugin=apiNamePrefix,
+                ~slice=S.Spec.name,
+                ~commandSchema,
+              )->Array.forEach(((_, tag)) => {
+                // The resolver injects the TAG alone, so two slices claiming one
+                // constructor name would make the stamp ambiguous — and the wrong
+                // arm of that ambiguity writes a row owned by nobody's decision.
+                // Multi-command slices cannot reach here (their mutation fields
+                // collide first), which leaves single-command slices, where the
+                // field names differ and nothing else would notice.
+                switch byTag->Dict.get(tag) {
+                | Some(_) =>
+                  log.error(
+                    ~comp="Dcb_Builder",
+                    `Two DCB slices in "${name}" both declare the command "${tag}". ` ++
+                    "Owner stamping resolves a command by that name alone, so it cannot " ++
+                    "tell them apart. Rename one of the constructors.",
+                  )
+                | None => byTag->Dict.set(tag, commandSchema)
+                }
+              })
+            }
+          })
+          byTag
+        }
+
         let dcbGenerateCommandOutput =
           dcbCommandTopic
           ->Component.operations
-          ->Pulumi.Output.apply(ops =>
-            CommandGenerator_Callback.makeGenerateCommand(
-              ~publishJsons=ops.publishJsons,
-              ~publishJsonsAndWait=?ops.publishJsonsAndWait,
-              ~serviceName=name,
-              ~commandSchema=S.json->S.castToUnknown,
-              ~componentKind=CommandGenerator_Callback.StateChangeSlice,
-              ~stripIdFromParams=false,
-            )
-          )
+          ->Pulumi.Output.apply(ops => {
+            let make = commandSchema =>
+              CommandGenerator_Callback.makeGenerateCommand(
+                ~publishJsons=ops.publishJsons,
+                ~publishJsonsAndWait=?ops.publishJsonsAndWait,
+                ~serviceName=name,
+                ~commandSchema,
+                ~componentKind=CommandGenerator_Callback.StateChangeSlice,
+                ~stripIdFromParams=false,
+              )
+            let byTag = Dict.make()
+            dcbCommandSchemasByTag
+            ->Dict.toArray
+            ->Array.forEach(((tag, schema)) => byTag->Dict.set(tag, make(schema)))
+            // A command no slice claims keeps the permissive generator — what every
+            // command got before this change — so nothing that reaches this handler
+            // by another route starts failing. It also cannot stamp, which is why
+            // the unknown case is logged rather than left to look like a success.
+            (byTag, make(S.json->S.castToUnknown))
+          })
 
         let dcbHandler =
           (dcbHandlerBase, inboundReceiversOutput, dcbGenerateCommandOutput)
           ->Pulumi.Output.all3
-          ->Pulumi.Output.apply(((baseHandler, receivers, generateCommand)) => {
+          ->Pulumi.Output.apply(((baseHandler, receivers, (generatorsByTag, generateFallback))) => {
             let composite = (event, ctx) => {
               let raw: dict<JSON.t> = event->Obj.magic
               switch raw->Dict.get("__inboundTranslation") {
@@ -810,6 +862,17 @@ module Make = (
                 switch (raw->Dict.get("command"), raw->Dict.get("arguments")) {
                 | (Some(JSON.String(_)), Some(_)) =>
                   let payload: CommandGenerator.payload = event->Obj.magic
+                  let generateCommand = switch generatorsByTag->Dict.get(payload.command) {
+                  | Some(g) => g
+                  | None =>
+                    log.warn(
+                      ~comp="Dcb_Builder",
+                      `No DCB slice in "${name}" declares the command "${payload.command}", ` ++
+                      "so it is dispatched without an owner stamp. Any field the command " ++
+                      "marks as its owner keeps the value the caller sent.",
+                    )
+                    generateFallback
+                  }
                   (generateCommand(payload)->Effect.map(msgId => msgId->Obj.magic))->Obj.magic
                 | _ => baseHandler(event, ctx)
                 }

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -422,13 +422,42 @@ function Make(DcbEventLogStorage) {
         ]);
       })).apply(pairs => Object.fromEntries(pairs));
       let dcbHandlerBase = DcbCommandTopic.makeFilteringHandler(dcbCommandTopic);
-      let dcbGenerateCommandOutput = Component$ReventlessCore.operations(dcbCommandTopic).apply(ops => CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(ops.publishJsons, ops.publishJsonsAndWait, name, S.json, "StateChangeSlice", false));
+      let byTag = {};
+      stateChangeSlices.forEach(S => {
+        let commandSchema = S.Spec.commandSchema;
+        if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
+          Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).forEach(param => {
+            let tag = param[1];
+            let match = byTag[tag];
+            if (match !== undefined) {
+              return log.error("Dcb_Builder", undefined, `Two DCB slices in "` + name + `" both declare the command "` + tag + `". ` + "Owner stamping resolves a command by that name alone, so it cannot tell them apart. Rename one of the constructors.");
+            } else {
+              byTag[tag] = commandSchema;
+              return;
+            }
+          });
+          return;
+        }
+      });
+      let dcbGenerateCommandOutput = Component$ReventlessCore.operations(dcbCommandTopic).apply(ops => {
+        let make = commandSchema => CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(ops.publishJsons, ops.publishJsonsAndWait, name, commandSchema, "StateChangeSlice", false);
+        let byTag$1 = {};
+        Object.entries(byTag).forEach(param => {
+          byTag$1[param[0]] = make(param[1]);
+        });
+        return [
+          byTag$1,
+          make(S.json)
+        ];
+      });
       let dcbHandler = Pulumi.all([
         dcbHandlerBase,
         inboundReceiversOutput,
         dcbGenerateCommandOutput
       ]).apply(param => {
-        let generateCommand = param[2];
+        let match = param[2];
+        let generateFallback = match[1];
+        let generatorsByTag = match[0];
         let receivers = param[1];
         let baseHandler = param[0];
         return (event, ctx) => {
@@ -448,11 +477,18 @@ function Make(DcbEventLogStorage) {
           }
           let match$1 = event["command"];
           let match$2 = event["arguments"];
-          if (typeof match$1 === "string" && match$2 !== undefined) {
-            return Effect.map(generateCommand(event), msgId => msgId);
-          } else {
+          if (match$1 === undefined) {
+            return baseHandler(event, ctx);
+          }
+          if (typeof match$1 !== "string") {
+            return baseHandler(event, ctx);
+          }
+          if (match$2 === undefined) {
             return baseHandler(event, ctx);
           }
+          let g = generatorsByTag[event.command];
+          let generateCommand = g !== undefined ? g : (log.warn("Dcb_Builder", undefined, `No DCB slice in "` + name + `" declares the command "` + event.command + `", ` + "so it is dispatched without an owner stamp. Any field the command marks as its owner keeps the value the caller sent."), generateFallback);
+          return Effect.map(generateCommand(event), msgId => msgId);
         };
       });
       let dcbResources = Object.values(stateChangeSlicesOutputs).flatMap(outputs => outputs.resources).concat(Object.values(inboundTranslationSlicesOutputs).flatMap(outputs => outputs.resources.concat(outputs.queryDb.resources)));

package/src/components/EventLog/EventLog.res

@@ -25,7 +25,7 @@ type appendError =
 // staleness — consumers ignore a snapshot whose hash differs from their current
 // state schema and fall back to full replay. Snapshots are a read optimization
 // only; the OCC append remains the sole consistency primitive
-// (docs/plans/aggregate-snapshotting.md).
+// (docs/plans/done/aggregate-snapshotting.md).
 type snapshot = {seqNr: int, state: JSON.t, schemaHash: string}
 
 type append<'id, 'event> = (int, 'id, array<'event>) => promise<result<unit, appendError>>

package/src/plugin/component/Plugin_Builder.res

@@ -249,6 +249,12 @@ module Make = (
       ) => {
         let qn = Api_Naming.queryFieldNamesForReadModel(~plugin=name, ~name=R.Spec.name)
         let subIdField = R.Spec.subIdConfig->Option.map(c => c.subIdField)
+        // An ordinary read model's `@index` reached the resolver layer
+        // (`QueryDbResolvers_{AppSync,Lambda}` build one per `config.indexes`)
+        // and never reached the schema, so AWS carried a resolver for a field
+        // its SDL did not declare. The DCB and admin entries have populated this
+        // all along; the omission here was the asymmetry, not the rule.
+        let indexes = R.Spec.config.indexes
         {
           ReventlessInfra.Api.singleFieldName: qn.singleFieldName,
           listFieldName: qn.listFieldName,
@@ -258,6 +264,7 @@ module Make = (
           permission: R.Spec.authorization,
           connectionSpec: true,
           subIdField: ?subIdField,
+          indexQueries: ?(indexes->Array.length > 0 ? Some(indexes) : None),
         }
       })
 

package/src/plugin/component/Plugin_Builder.res.mjs

@@ -194,6 +194,7 @@ function Make(Spec) {
         let queryEntriesFromReadModels = readModels.map(R => {
           let qn = Api_Naming$ReventlessCore.queryFieldNamesForReadModel(extra$1, R.Spec.name, undefined);
           let subIdField = Stdlib_Option.map(R.Spec.subIdConfig, c => c.subIdField);
+          let indexes = R.Spec.config.indexes;
           return {
             singleFieldName: qn.singleFieldName,
             listFieldName: qn.listFieldName,
@@ -202,7 +203,8 @@ function Make(Spec) {
             authorization: undefined,
             permission: R.Spec.authorization,
             connectionSpec: true,
-            subIdField: subIdField
+            subIdField: subIdField,
+            indexQueries: indexes.length !== 0 ? indexes : undefined
           };
         });
         let queryEntries = queryEntriesFromReadModels.concat(dcbResult.queryEntries);