@reventlessdev/reventless-core 3.0.0-alpha.283 → 3.0.0-alpha.285

package/tests/commandgenerator/OwnerStampingTest.res

@@ -256,3 +256,93 @@ describe("the schema a generator is built with must answer for its commands:", (
     },
   )
 })
+
+// The claim a handler checks ownership against. It is written from the same
+// classification the stamp uses, on every command, whether or not the command
+// itself records an owner: the command that needs it most (`CancelOrder`) names
+// no owner of its own.
+describe("the caller claim on the envelope:", () => {
+  let claimOf = (cmd: Message.commandJson) => cmd.meta.callerClaim
+
+  let cancel = (~identity) =>
+    payload(
+      ~command="ImportProducts",
+      ~args=Dict.fromArray([("batchId", str("b-1")), ("source", str("acme"))]),
+      ~identity,
+    )
+
+  testPromise("an owned caller is claimed as that owner", async () => {
+    let _ = await generate(
+      cancel(~identity=cognito(~userId="cust-A", ~groups=["User"])),
+    )->Effect.runPromise
+    expect(lastPublished()->claimOf)->toEqual(Some(Message.CallerClaim.Owned({userId: "cust-A"})))
+  })
+
+  testPromise("an elevated caller and a system caller are claimed exempt", async () => {
+    let _ = await generate(
+      cancel(~identity=cognito(~userId="ops-1", ~groups=["Admin"])),
+    )->Effect.runPromise
+    let elevated = lastPublished()->claimOf
+    let _ = await generate(cancel(~identity=iam))->Effect.runPromise
+    expect((elevated, lastPublished()->claimOf))->toEqual((
+      Some(Message.CallerClaim.Exempt),
+      Some(Message.CallerClaim.Exempt),
+    ))
+  })
+
+  // Not refused here — the command records no owner, so `AllowAnonymous` still
+  // admits it. The claim is what lets the handler refuse it on an owned partition.
+  testPromise("an anonymous caller of an unowned command is claimed unidentified", async () => {
+    let _ = await generate(cancel(~identity=Reventless.Identity.anonymous))->Effect.runPromise
+    expect(lastPublished()->claimOf)->toEqual(Some(Message.CallerClaim.Unidentified))
+  })
+
+  // A client controls the arguments and nothing else. Naming the claim among them
+  // must neither reach the envelope nor survive into the command.
+  testPromise("a claim sent among the arguments is ignored", async () => {
+    let _ = await generate(
+      payload(
+        ~command="ImportProducts",
+        ~args=Dict.fromArray([
+          ("batchId", str("b-1")),
+          ("source", str("acme")),
+          ("callerClaim", str("Exempt")),
+          ("meta", JSON.Encode.object(Dict.fromArray([("callerClaim", str("Exempt"))]))),
+        ]),
+        ~identity=cognito(~userId="cust-A", ~groups=["User"]),
+      ),
+    )->Effect.runPromise
+    expect(lastPublished()->claimOf)->toEqual(Some(Message.CallerClaim.Owned({userId: "cust-A"})))
+  })
+
+  // Unlike the stamp, the claim needs no schema: the permissive generator that
+  // stamps nothing still classifies the caller.
+  testPromise("a permissive-schema generator still writes the claim", async () => {
+    let permissive = CommandGenerator_Callback.makeGenerateCommand(
+      ~publishJsons=async cmds => published := published.contents->Array.concat(cmds),
+      ~serviceName="Ordering",
+      ~commandSchema=S.json->S.castToUnknown,
+      ~componentKind=CommandGenerator_Callback.StateChangeSlice,
+      ~stripIdFromParams=false,
+    )
+    let _ = await permissive(
+      cancel(~identity=cognito(~userId="cust-A", ~groups=["User"])),
+    )->Effect.runPromise
+    expect(lastPublished()->claimOf)->toEqual(Some(Message.CallerClaim.Owned({userId: "cust-A"})))
+  })
+
+  // The claim belongs to the command alone. An event the command produces, and a
+  // command an automation issues in reaction to it, derive their envelope from
+  // it and must not inherit the caller.
+  testSync("a derived envelope does not inherit the claim", () => {
+    let parent: Message.meta = {
+      service: "Ordering",
+      time: "2024-01-01T00:00:00Z",
+      msgId: "m-1",
+      correlationId: "m-1",
+      user: "cust-A",
+      callerClaim: Message.CallerClaim.Owned({userId: "cust-A"}),
+    }
+    expect(Message.deriveMeta(~parent).callerClaim)->toEqual(None)
+  })
+})

package/tests/commandgenerator/OwnerStampingTest.res.mjs

@@ -9,6 +9,7 @@ import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/component
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as Message$ReventlessCore from "../../src/Message.res.mjs";
 import * as Plugin_ResolverError$ReventlessCore from "../../src/plugin/component/Plugin_ResolverError.res.mjs";
 import * as CommandGenerator_Callback$ReventlessCore from "../../src/components/CommandGenerator/CommandGenerator_Callback.res.mjs";
 
@@ -209,6 +210,92 @@ globalThis.describe("the schema a generator is built with must answer for its co
   });
 });
 
+globalThis.describe("the caller claim on the envelope:", () => {
+  let cancel = identity => payload("ImportProducts", Object.fromEntries([
+    [
+      "batchId",
+      "b-1"
+    ],
+    [
+      "source",
+      "acme"
+    ]
+  ]), identity);
+  globalThis.test("an owned caller is claimed as that owner", async () => {
+    await Effect.runPromise(generate(cancel(cognito("cust-A", ["User"]))));
+    globalThis.expect(published.contents[published.contents.length - 1 | 0].meta.callerClaim).toEqual({
+      TAG: "Owned",
+      userId: "cust-A"
+    });
+  });
+  globalThis.test("an elevated caller and a system caller are claimed exempt", async () => {
+    await Effect.runPromise(generate(cancel(cognito("ops-1", ["Admin"]))));
+    let elevated = published.contents[published.contents.length - 1 | 0].meta.callerClaim;
+    await Effect.runPromise(generate(cancel(iam)));
+    globalThis.expect([
+      elevated,
+      published.contents[published.contents.length - 1 | 0].meta.callerClaim
+    ]).toEqual([
+      "Exempt",
+      "Exempt"
+    ]);
+  });
+  globalThis.test("an anonymous caller of an unowned command is claimed unidentified", async () => {
+    await Effect.runPromise(generate(cancel(Identity$Reventless.anonymous)));
+    globalThis.expect(published.contents[published.contents.length - 1 | 0].meta.callerClaim).toEqual("Unidentified");
+  });
+  globalThis.test("a claim sent among the arguments is ignored", async () => {
+    await Effect.runPromise(generate(payload("ImportProducts", Object.fromEntries([
+      [
+        "batchId",
+        "b-1"
+      ],
+      [
+        "source",
+        "acme"
+      ],
+      [
+        "callerClaim",
+        "Exempt"
+      ],
+      [
+        "meta",
+        Object.fromEntries([[
+            "callerClaim",
+            "Exempt"
+          ]])
+      ]
+    ]), cognito("cust-A", ["User"]))));
+    globalThis.expect(published.contents[published.contents.length - 1 | 0].meta.callerClaim).toEqual({
+      TAG: "Owned",
+      userId: "cust-A"
+    });
+  });
+  globalThis.test("a permissive-schema generator still writes the claim", async () => {
+    let permissive = CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(async cmds => {
+      published.contents = published.contents.concat(cmds);
+    }, undefined, "Ordering", Sury.json, "StateChangeSlice", false, undefined);
+    await Effect.runPromise(permissive(cancel(cognito("cust-A", ["User"]))));
+    globalThis.expect(published.contents[published.contents.length - 1 | 0].meta.callerClaim).toEqual({
+      TAG: "Owned",
+      userId: "cust-A"
+    });
+  });
+  globalThis.test("a derived envelope does not inherit the claim", () => {
+    globalThis.expect(Message$ReventlessCore.deriveMeta({
+      service: "Ordering",
+      time: "2024-01-01T00:00:00Z",
+      user: "cust-A",
+      msgId: "m-1",
+      correlationId: "m-1",
+      callerClaim: {
+        TAG: "Owned",
+        userId: "cust-A"
+      }
+    }, undefined).callerClaim).toEqual(undefined);
+  });
+});
+
 export {
   commandSchema,
   published,

package/tests/commandtopic/CommandOutcomeHookTest.res

@@ -72,6 +72,7 @@ let seen = () =>
         switch cause {
         | DomainRejection => "rejected/domain"
         | InfrastructureFailure => "rejected/infrastructure"
+        | AccessRefusal => "rejected/access"
         },
         errorCode,
         0,

package/tests/commandtopic/CommandOutcomeHookTest.res.mjs

@@ -106,7 +106,17 @@ function seen() {
       ];
     }
     let tmp;
-    tmp = match.cause === "DomainRejection" ? "rejected/domain" : "rejected/infrastructure";
+    switch (match.cause) {
+      case "DomainRejection" :
+        tmp = "rejected/domain";
+        break;
+      case "InfrastructureFailure" :
+        tmp = "rejected/infrastructure";
+        break;
+      case "AccessRefusal" :
+        tmp = "rejected/access";
+        break;
+    }
     return [
       r.component,
       r.reference,