@reventlessdev/reventless-core 3.0.0-alpha.284 → 3.0.0-alpha.286

package/src/components/Aggregate/Aggregate_Callback.res.mjs

@@ -8,9 +8,11 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
 import * as Stream from "effect/Stream";
 import * as Stdlib_Promise from "@rescript/runtime/lib/es6/Stdlib_Promise.js";
+import * as Owner$Reventless from "@reventlessdev/reventless-spec/src/components/Owner.res.mjs";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Lru$ReventlessCore from "../../util/Lru.res.mjs";
 import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Message$ReventlessCore from "../../Message.res.mjs";
 import * as LogFormat$ReventlessCore from "../../util/LogFormat.res.mjs";
 import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
@@ -29,21 +31,55 @@ function Make(Spec) {
       Spec.Id.makeFromString(param[0]),
       param[1]
     ]));
+    let ownerFieldsByEventType = Owner$Reventless.fieldNamesByVariant(Spec.eventSchema);
+    let actsOnOwned = Object.keys(ownerFieldsByEventType).length !== 0;
+    let recordEventOwners = (owners, event) => {
+      if (!actsOnOwned) {
+        return owners;
+      }
+      let match = Message$ReventlessCore.splitMessage(Message$ReventlessCore.encode(event, Spec.eventSchema));
+      let fields = ownerFieldsByEventType[match[0]];
+      if (fields !== undefined) {
+        return OwnerScope$Reventless.recordOwners(owners, fields, match[1]);
+      } else {
+        return owners;
+      }
+    };
     let processCommand = seq => ((param, topicItem) => {
       let reference = topicItem.reference;
       let command$p = topicItem.command;
-      let outcomes = param[1];
+      let outcomes = param[2];
+      let owners = param[1];
       let state = param[0];
       let meta = Message$ReventlessCore.deriveMeta(command$p.meta, undefined);
       let id = Spec.Id.toString(command$p.id);
-      let cmdName = LogFormat$ReventlessCore.bold(Message$ReventlessCore.variantNameOfJson(Message$ReventlessCore.encode(command$p.command, Spec.commandSchema)));
+      let cmdVariant = Message$ReventlessCore.variantNameOfJson(Message$ReventlessCore.encode(command$p.command, Spec.commandSchema));
+      let cmdName = LogFormat$ReventlessCore.bold(cmdVariant);
       Effect.runSync(EffectLogger$ReventlessCore.logDebug(comp, undefined, `deciding: id=` + id + ` seq=` + seq.toString() + ` cmd=` + cmdName));
+      let refusal = actsOnOwned ? CommandTopic_Helpers$ReventlessCore.ownershipRefusal(OwnerScope$Reventless.decideActing(command$p.meta.callerClaim, owners), Spec.name, cmdVariant) : undefined;
+      if (refusal !== undefined) {
+        let line = `refused: ` + refusal.rejected.errorDetail + ` id=` + id;
+        Effect.runSync(refusal.isDefect ? EffectLogger$ReventlessCore.logError(comp, undefined, line) : EffectLogger$ReventlessCore.logWarn(comp, undefined, line));
+        return [
+          state,
+          owners,
+          outcomes.concat([[
+              reference,
+              {
+                TAG: "CmdRefused",
+                _0: refusal
+              },
+              meta
+            ]])
+        ];
+      }
       let generatedEvents = Behavior.decide(state, command$p.command);
       if (generatedEvents.TAG === "Ok") {
         let generatedEvents$1 = generatedEvents._0;
         let newState = Stdlib_Array.reduce(generatedEvents$1, state, Behavior.evolve);
         return [
           newState,
+          Stdlib_Array.reduce(generatedEvents$1, owners, recordEventOwners),
           outcomes.concat([[
               reference,
               {
@@ -62,6 +98,7 @@ function Make(Spec) {
       Effect.runSync(EffectLogger$ReventlessCore.logError(comp, undefined, `decide rejected: ` + errorCode + ` ` + errorDetail + ` id=` + id));
       return [
         state,
+        owners,
         outcomes.concat([[
             reference,
             {
@@ -75,7 +112,10 @@ function Make(Spec) {
     });
     let replayCache = Lru$ReventlessCore.make(100);
     let resetCache = () => Lru$ReventlessCore.clear(replayCache);
-    let snapshotConfig = Behavior.snapshot;
+    let snapshotConfig = actsOnOwned ? undefined : Behavior.snapshot;
+    if (actsOnOwned && Stdlib_Option.isSome(Behavior.snapshot)) {
+      Effect.runSync(EffectLogger$ReventlessCore.logWarn(comp, undefined, "snapshots disabled: this aggregate records an @owner, which a snapshot does not carry"));
+    }
     let stateSchemaHash = snapshotConfig !== undefined ? HashObject(Object.fromEntries([[
           "state",
           SchemaWalker$ReventlessCore.describeSchema(snapshotConfig.stateSchema)
@@ -151,10 +191,12 @@ function Make(Spec) {
         let seedSeq = param[1];
         return Effect.tap(Stream.runFold(Ops.eventLog.replayStream(id, seedSeq), [
           param[0],
-          seedSeq
+          seedSeq,
+          []
         ], (param, ev) => [
           Behavior.evolve(param[0], ev),
-          param[1] + 1 | 0
+          param[1] + 1 | 0,
+          recordEventOwners(param[2], ev)
         ]), param => {
           let n = param[1];
           let detail = seedSeq > 0 ? `(snapshot@` + seedSeq.toString() + `, ` + (n - seedSeq | 0).toString() + ` delta event(s))` : n.toString() + ` event(s)`;
@@ -199,35 +241,43 @@ function Make(Spec) {
       return outcomes.map(param => {
         let outcome = param[1];
         let reference = param[0];
-        if (outcome.TAG === "CmdOk") {
-          if (appendSucceeded) {
-            CommandTopic_Helpers$ReventlessCore.reportAccepted(Spec.name, reference, {
-              entityId: entityId,
-              eventCount: appendedEventCount
+        switch (outcome.TAG) {
+          case "CmdOk" :
+            if (appendSucceeded) {
+              CommandTopic_Helpers$ReventlessCore.reportAccepted(Spec.name, reference, {
+                entityId: entityId,
+                eventCount: appendedEventCount
+              });
+              return {
+                TAG: "Ok",
+                _0: reference
+              };
+            } else {
+              CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "InfrastructureFailure", reference, {
+                errorCode: "AppendFailed",
+                errorDetail: appendErrorDetail
+              });
+              return {
+                TAG: "Error",
+                _0: reference
+              };
+            }
+          case "CmdRejected" :
+            CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "DomainRejection", reference, {
+              errorCode: outcome.errorCode,
+              errorDetail: outcome.errorDetail
             });
             return {
               TAG: "Ok",
               _0: reference
             };
-          } else {
-            CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "InfrastructureFailure", reference, {
-              errorCode: "AppendFailed",
-              errorDetail: appendErrorDetail
-            });
+          case "CmdRefused" :
+            CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "AccessRefusal", reference, outcome._0.rejected);
             return {
-              TAG: "Error",
+              TAG: "Ok",
               _0: reference
             };
-          }
         }
-        CommandTopic_Helpers$ReventlessCore.reportRejected(Spec.name, "DomainRejection", reference, {
-          errorCode: outcome.errorCode,
-          errorDetail: outcome.errorDetail
-        });
-        return {
-          TAG: "Ok",
-          _0: reference
-        };
       });
     };
     let replayProcessAppend = (id, topicItemsForId) => {
@@ -235,35 +285,42 @@ function Make(Spec) {
       let match = Lru$ReventlessCore.get(replayCache, idStr);
       let readState;
       if (match !== undefined) {
+        let owners = match[2];
         let seqNr = match[1];
         let state = match[0];
         readState = Effect.map(EffectLogger$ReventlessCore.logInfo(comp, undefined, `replay skipped (cached): id=` + idStr + `, seq=` + seqNr.toString()), () => [
           state,
-          seqNr
+          seqNr,
+          owners
         ]);
       } else {
         readState = coldReadState(id);
       }
       return Effect.flatMap(readState, param => {
+        let initialOwners = param[2];
         let sequenceNr = param[1];
         let initialState = param[0];
         let match = Stdlib_Array.reduce(topicItemsForId, [
           initialState,
+          initialOwners,
           []
         ], processCommand(sequenceNr));
-        let outcomes = match[1];
+        let outcomes = match[2];
+        let finalOwners = match[1];
         let finalState = match[0];
         let eventsToAppend = outcomes.map(param => {
           let meta = param[2];
           let outcome = param[1];
-          if (outcome.TAG === "CmdOk") {
-            return outcome._0.map(event => ({
-              id: id,
-              meta: meta,
-              event: event
-            }));
-          } else {
-            return [];
+          switch (outcome.TAG) {
+            case "CmdOk" :
+              return outcome._0.map(event => ({
+                id: id,
+                meta: meta,
+                event: event
+              }));
+            case "CmdRejected" :
+            case "CmdRefused" :
+              return [];
           }
         }).flat();
         if (eventsToAppend.length !== 0) {
@@ -280,7 +337,8 @@ function Make(Spec) {
               let newSeq = sequenceNr + eventsToAppend.length | 0;
               Lru$ReventlessCore.put(replayCache, idStr, [
                 finalState,
-                newSeq
+                newSeq,
+                finalOwners
               ]);
               maybeWriteSnapshot(id, idStr, sequenceNr, newSeq, finalState);
               let perRef = reportFinalOutcomes(outcomes, idStr, true, eventsToAppend.length, undefined);
@@ -308,7 +366,8 @@ function Make(Spec) {
         }
         Lru$ReventlessCore.put(replayCache, idStr, [
           initialState,
-          sequenceNr
+          sequenceNr,
+          initialOwners
         ]);
         let perRef = reportFinalOutcomes(outcomes, idStr, true, 0, undefined);
         return Effect.map(EffectLogger$ReventlessCore.logInfo(comp, undefined, `no events produced: id=` + idStr), () => ({

package/src/components/AutomationSlice/AutomationSlice_Builder.res

@@ -54,7 +54,8 @@ module Make = (
       let stateSchema = AutomationSlice_Callback.todoRowSchema
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
 

package/src/components/CommandGenerator/CommandGenerator_Callback.res

@@ -55,13 +55,13 @@ let stampOwnerFields = (
   obj: dict<JSON.t>,
   ~commandSchema: S.t<unknown>,
   ~command: string,
-  ~identity: Reventless.Identity.t,
+  ~scope: Reventless.OwnerScope.t,
   ~serviceName: string,
 ) =>
   switch Reventless.Owner.variantFieldNames(commandSchema, ~variant=command) {
   | [] => ()
   | ownerFields =>
-    switch identity->Reventless.OwnerScope.resolve {
+    switch scope {
     | System | Elevated(_) => ()
     | Owned({userId}) =>
       ownerFields->Array.forEach(field => obj->Dict.set(field, JSON.Encode.string(userId)))
@@ -118,6 +118,11 @@ let makeGenerateCommand = (
   (payload: CommandGenerator.payload) =>
     Effect.sync(() => {
       let msgId = Message.uuid()
+      // One classification for the stamp below and for the claim the handler
+      // checks ownership against, so the two cannot disagree about the caller.
+      // The claim is built here and nowhere from the payload, which is all a
+      // client controls.
+      let scope = payload.identity->Reventless.OwnerScope.resolve
       let meta = {
         {
           Message.service: serviceName,
@@ -126,6 +131,7 @@ let makeGenerateCommand = (
           time: Message.nowAsISOString(),
           msgId,
           correlationId: msgId,
+          callerClaim: scope->Reventless.OwnerScope.toClaim,
         }
       }
       let params = switch payload.arguments
@@ -136,12 +142,7 @@ let makeGenerateCommand = (
             obj->Dict.delete("id")
           }
           obj->dropNullArguments
-          obj->stampOwnerFields(
-            ~commandSchema,
-            ~command=payload.command,
-            ~identity=payload.identity,
-            ~serviceName,
-          )
+          obj->stampOwnerFields(~commandSchema, ~command=payload.command, ~scope, ~serviceName)
           obj->Dict.toArray
         }
       | None =>

package/src/components/CommandGenerator/CommandGenerator_Callback.res.mjs

@@ -27,26 +27,25 @@ function clearCommandInterceptor() {
   commandInterceptorHook.contents = undefined;
 }
 
-function stampOwnerFields(obj, commandSchema, command, identity, serviceName) {
+function stampOwnerFields(obj, commandSchema, command, scope, serviceName) {
   let ownerFields = Owner$Reventless.variantFieldNames(commandSchema, command);
   if (ownerFields.length === 0) {
     return;
   }
-  let why = OwnerScope$Reventless.resolve(identity, undefined);
-  if (typeof why !== "object") {
+  if (typeof scope !== "object") {
     return;
   }
-  switch (why.TAG) {
+  switch (scope.TAG) {
     case "Elevated" :
       return;
     case "Owned" :
-      let userId = why.userId;
+      let userId = scope.userId;
       ownerFields.forEach(field => {
         obj[field] = userId;
       });
       return;
     case "Unidentified" :
-      return Plugin_ResolverError$ReventlessCore.throwCallerFault(`Forbidden: ` + serviceName + `.` + command + ` records an owner, but the caller could not be identified (` + why._0 + `)`);
+      return Plugin_ResolverError$ReventlessCore.throwCallerFault(`Forbidden: ` + serviceName + `.` + command + ` records an owner, but the caller could not be identified (` + scope._0 + `)`);
   }
 }
 
@@ -63,19 +62,22 @@ function makeGenerateCommand(publishJsons, publishJsonsAndWait, serviceName, com
   let stripIdFromParams = stripIdFromParamsOpt !== undefined ? stripIdFromParamsOpt : true;
   return payload => Effect.flatMap(Effect.tap(Effect.sync(() => {
     let msgId = Message$ReventlessCore.uuid();
+    let scope = OwnerScope$Reventless.resolve(payload.identity, undefined);
     let meta_time = Message$ReventlessCore.nowAsISOString();
     let meta_ip = Stdlib_Option.getOr(payload.meta.ip.shift(), "");
     let meta_user = payload.meta.user;
+    let meta_callerClaim = OwnerScope$Reventless.toClaim(scope);
     let meta = {
       service: serviceName,
       time: meta_time,
       ip: meta_ip,
       user: meta_user,
       msgId: msgId,
-      correlationId: msgId
+      correlationId: msgId,
+      callerClaim: meta_callerClaim
     };
     let obj = Stdlib_Option.flatMap(JSON.stringify(payload.arguments), jsonString => Stdlib_JSON.Decode.object(JSON.parse(jsonString)));
-    let params = obj !== undefined ? (stripIdFromParams ? Stdlib_Dict.$$delete(obj, "id") : undefined, dropNullArguments(obj), stampOwnerFields(obj, commandSchema, payload.command, payload.identity, serviceName), Object.entries(obj)) : Stdlib_JsError.throwWithMessage("Couldn't decode:" + Stdlib_Option.getOr(JSON.stringify(payload.arguments), "<payload.arguments>"));
+    let params = obj !== undefined ? (stripIdFromParams ? Stdlib_Dict.$$delete(obj, "id") : undefined, dropNullArguments(obj), stampOwnerFields(obj, commandSchema, payload.command, scope, serviceName), Object.entries(obj)) : Stdlib_JsError.throwWithMessage("Couldn't decode:" + Stdlib_Option.getOr(JSON.stringify(payload.arguments), "<payload.arguments>"));
     let commandStr = payload.command;
     let match = params.length;
     let commandJson = match !== 0 ? Object.fromEntries([[

package/src/components/CommandTopic/CommandTopic.res.mjs

@@ -35,6 +35,8 @@ let acceptedResultChannel = CommandTopic_Helpers$ReventlessCore.acceptedResultCh
 
 let rejectedResultChannel = CommandTopic_Helpers$ReventlessCore.rejectedResultChannel;
 
+let ownershipRefusal = CommandTopic_Helpers$ReventlessCore.ownershipRefusal;
+
 let reportAccepted = CommandTopic_Helpers$ReventlessCore.reportAccepted;
 
 let reportRejected = CommandTopic_Helpers$ReventlessCore.reportRejected;
@@ -64,6 +66,7 @@ export {
   fireCommandOutcome,
   acceptedResultChannel,
   rejectedResultChannel,
+  ownershipRefusal,
   reportAccepted,
   reportRejected,
   commandOutcomeToJson,

package/src/components/CommandTopic/CommandTopic_Helpers.res

@@ -25,8 +25,11 @@ Why a command was refused.
 which is the model working. `InfrastructureFailure` is the decision never landing: an event-log
 append that failed outright or exhausted its conflict retries. Both arrive on `reportRejected`,
 so without this a consumer would read a broken event log as a business rejection.
+
+`AccessRefusal` is the handler refusing before `decide` runs, because the caller does not
+own what the command acts on (`OwnerScope.decideActing`).
 */
-type refusalCause = DomainRejection | InfrastructureFailure
+type refusalCause = DomainRejection | InfrastructureFailure | AccessRefusal
 
 /**
 What became of one command. Constructors are prefixed to stay clear of `commandOutcome`'s
@@ -93,6 +96,39 @@ let acceptedResultChannel: ref<option<(string, acceptedResult) => unit>> = ref(N
 // `Rejected` outcomes that carry the real error code and detail.
 let rejectedResultChannel: ref<option<(string, rejectedResult) => unit>> = ref(None)
 
+/**
+Turn an `acting` verdict into the refusal a command handler reports, or `None` to let
+`decide` run.
+
+Shared by both handlers so they refuse in the same words. `errorCode` is `"Forbidden"`,
+the code an `@authorize` refusal carries, so a client handles both alike. `isDefect` marks
+a refusal that is the data's or the slice's fault rather than the caller's.
+*/
+type ownershipRefusal = {rejected: rejectedResult, isDefect: bool}
+
+let ownershipRefusal = (
+  verdict: Reventless.OwnerScope.acting,
+  ~component: string,
+  ~command: string,
+): option<ownershipRefusal> => {
+  let refuse = (~isDefect=false, why) => Some({
+    rejected: {errorCode: "Forbidden", errorDetail: `${component}.${command}: ${why}`},
+    isDefect,
+  })
+  switch verdict {
+  | MayAct => None
+  | NotTheOwner(_) => refuse("the caller does not own what this command acts on")
+  | CallerUnidentified => refuse("the caller could not be identified")
+  | ConflictingOwners(owners) =>
+    refuse(
+      ~isDefect=true,
+      `the history records ${owners->Array.length->Int.toString} different owners`,
+    )
+  | OwnerUnreadable =>
+    refuse(~isDefect=true, "the partition this command acts on could not be named")
+  }
+}
+
 // `~component` is the owning component's `Spec.name`: an outcome isn't interpretable without
 // knowing which component produced it, and the side-channel (keyed per inline dispatch) never
 // had to say. `~cause` is required rather than defaulted so a new rejection site has to state

package/src/components/CommandTopic/CommandTopic_Helpers.res.mjs

@@ -46,6 +46,34 @@ let rejectedResultChannel = {
   contents: undefined
 };
 
+function ownershipRefusal(verdict, component, command) {
+  let refuse = (isDefectOpt, why) => {
+    let isDefect = isDefectOpt !== undefined ? isDefectOpt : false;
+    return {
+      rejected: {
+        errorCode: "Forbidden",
+        errorDetail: component + `.` + command + `: ` + why
+      },
+      isDefect: isDefect
+    };
+  };
+  if (typeof verdict === "object") {
+    if (verdict.TAG === "NotTheOwner") {
+      return refuse(undefined, "the caller does not own what this command acts on");
+    } else {
+      return refuse(true, `the history records ` + verdict._0.length.toString() + ` different owners`);
+    }
+  }
+  switch (verdict) {
+    case "MayAct" :
+      return;
+    case "CallerUnidentified" :
+      return refuse(undefined, "the caller could not be identified");
+    case "OwnerUnreadable" :
+      return refuse(true, "the partition this command acts on could not be named");
+  }
+}
+
 function reportAccepted(component, reference, result) {
   Stdlib_Option.forEach(acceptedResultChannel.contents, cb => cb(reference, result));
   fireCommandOutcome(component, reference, {
@@ -227,6 +255,7 @@ export {
   fireCommandOutcome,
   acceptedResultChannel,
   rejectedResultChannel,
+  ownershipRefusal,
   reportAccepted,
   reportRejected,
   commandOutcomeToJson,

package/src/components/Counter/Counter_Builder.res

@@ -29,7 +29,8 @@ module Make = (
 
       let subIdConfig = None
       let config = Reventless.ReadModel.config()
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
 
@@ -48,7 +49,8 @@ module Make = (
 
       let subIdConfig = None
       let config = Reventless.ReadModel.config()
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
     module CountsDb = QueryDb_Builder.Make(

package/src/components/Dcb/Dcb_Builder.res

@@ -534,7 +534,8 @@ module Make = (
                 ~commandSchema,
               )->Array.map(((f, _)) => f),
               ~commandSchema,
-              ~commandAuthorization=S.Spec.commandAuthorization->Obj.magic,
+              ~commandAuthorization=command =>
+                S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
             )
           }
         })
@@ -549,7 +550,8 @@ module Make = (
                 ~commandSchema,
               )->Array.map(((f, _)) => f),
               ~commandSchema,
-              ~commandAuthorization=S.Spec.commandAuthorization->Obj.magic,
+              ~commandAuthorization=command =>
+                S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
             )
           }
         })
@@ -1076,8 +1078,8 @@ module Make = (
               )
             // One SDL field per constructor, each with its own constructor's args and
             // its own per-constructor authorization rule.
-            let commandAuthorization: unknown => Reventless.Authorization.permission =
-              S.Spec.commandAuthorization->Obj.magic
+            let commandAuthorization: unknown => Reventless.Authorization.permission = command =>
+              S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named
             let fieldPermissions = Dict.make()
             fieldSpecs->Array.forEach(((fieldName, ctor)) => {
               let hasPayload = Reventless.DcbTag.isVariantPayloadBearing(
@@ -1108,7 +1110,8 @@ module Make = (
           let fieldPermissions = Dict.make()
           switch permissionForFirstConstructor(
             ~commandSchema=ITS.Spec.commandSchema->Reventless.DcbTag.toUnknownSchema,
-            ~commandAuthorization=ITS.Spec.commandAuthorization->Obj.magic,
+            ~commandAuthorization=command =>
+              ITS.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
           ) {
           | Some(rule) => fieldPermissions->Dict.set(fieldName, rule)
           | None => ()
@@ -1142,7 +1145,7 @@ module Make = (
           returnTypeName: qn.returnTypeName,
           stateSchema: V.Spec.stateSchema->Reventless.DcbTag.toUnknownSchema,
           authorization: None,
-          permission: V.Spec.authorization,
+          permission: V.Spec.authorization->Reventless.Authorization.named,
           systemCallable: systemCallableComponents->Array.includes(V.Spec.name),
           includeIdParam: qn.includeIdParam,
           connectionSpec: true,

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -13,6 +13,7 @@ import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as DcbValidation$Reventless from "@reventlessdev/reventless-spec/src/components/DcbValidation.res.mjs";
 import * as Api_Naming$ReventlessCore from "../Api/Api_Naming.res.mjs";
@@ -291,13 +292,13 @@ function Make(DcbEventLogStorage) {
         syncSlices.forEach(S => {
           let commandSchema = S.Spec.commandSchema;
           if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
-            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, S.Spec.commandAuthorization);
+            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, command => Authorization$Reventless.named(S.Spec.commandAuthorization(command)));
           }
         });
         asyncSlices.forEach(S => {
           let commandSchema = S.Spec.commandSchema;
           if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
-            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, S.Spec.commandAuthorization);
+            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, command => Authorization$Reventless.named(S.Spec.commandAuthorization(command)));
           }
         });
       }
@@ -562,7 +563,6 @@ function Make(DcbEventLogStorage) {
           return;
         }
         let sliceDef = Stdlib_Option.flatMap(pluginStructure, s => s.stateChangeSlices.find(d => d.name === S.Spec.name));
-        let commandAuthorization = S.Spec.commandAuthorization;
         let fieldPermissions = {};
         fieldSpecs.forEach(param => {
           let ctor = param[1];
@@ -570,7 +570,7 @@ function Make(DcbEventLogStorage) {
           let syntheticCmd = hasPayload ? ({
               TAG: ctor
             }) : ctor;
-          fieldPermissions[param[0]] = commandAuthorization(syntheticCmd);
+          fieldPermissions[param[0]] = Authorization$Reventless.named(S.Spec.commandAuthorization(syntheticCmd));
         });
         return {
           fieldNames: fieldSpecs.map(param => param[0]),
@@ -585,7 +585,7 @@ function Make(DcbEventLogStorage) {
       let mutationEntriesFromInboundSlices = inboundTranslationSlices.map(ITS => {
         let fieldName = Api_Naming$ReventlessCore.sliceMutationField(name, ITS.Spec.name);
         let fieldPermissions = {};
-        let rule = permissionForFirstConstructor(ITS.Spec.commandSchema, ITS.Spec.commandAuthorization);
+        let rule = permissionForFirstConstructor(ITS.Spec.commandSchema, command => Authorization$Reventless.named(ITS.Spec.commandAuthorization(command)));
         if (rule !== undefined) {
           fieldPermissions[fieldName] = rule;
         }
@@ -609,7 +609,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: V.Spec.stateSchema,
           authorization: undefined,
-          permission: V.Spec.authorization,
+          permission: Authorization$Reventless.named(V.Spec.authorization),
           systemCallable: systemCallableComponents.includes(V.Spec.name),
           includeIdParam: qn.includeIdParam,
           connectionSpec: true,

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res

@@ -35,7 +35,8 @@ module Make = (
       let stateSchema = InboundTranslationSlice_Callback.auditRowSchema
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
 

package/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Builder.res

@@ -51,7 +51,8 @@ module Make = (
       let stateSchema = OutboundTranslationSlice_Callback.todoRowSchema
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
 

package/src/components/QueryDb/QueryDb_Builder.res

@@ -55,7 +55,7 @@ module Make = (
       ~subIdField,
       ~idResolverConfigs=Spec.config.idResolvers,
       ~idsResolverConfigs=Spec.config.idsResolvers,
-      ~authorization=Spec.authorization,
+      ~authorization=Spec.authorization->Reventless.Authorization.named,
       ~opts,
     )
 

package/src/components/QueryDb/QueryDb_Builder.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as QueryDb$ReventlessCore from "./QueryDb.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as ComponentType$ReventlessCore from "../../ComponentType.res.mjs";
 import * as QueryDb_Operations$ReventlessCore from "./QueryDb_Operations.res.mjs";
@@ -29,7 +30,7 @@ function Make(Spec) {
           deleteBatch: Operations.deleteBatch
         };
       }));
-      let resolvers = Resolvers.make(none$1, api, apiRole, storage.dataSourceName, Spec.config.indexes, subIdField, Spec.config.idResolvers, Spec.config.idsResolvers, Spec.authorization, opts);
+      let resolvers = Resolvers.make(none$1, api, apiRole, storage.dataSourceName, Spec.config.indexes, subIdField, Spec.config.idResolvers, Spec.config.idsResolvers, Authorization$Reventless.named(Spec.authorization), opts);
       let outputs_resources = storage.resources.concat(resolvers.resources);
       let outputs_resolversMaker = resolvers.resourcesMaker;
       let outputs_dataSourceName = storage.dataSourceName;
@@ -50,4 +51,4 @@ function Make(Spec) {
 export {
   Make,
 }
-/* Component-ReventlessCore Not a pure module */
+/* Authorization-Reventless Not a pure module */