@reventlessdev/reventless-core 3.0.0-alpha.284 → 3.0.0-alpha.286

package/src/plugin/component/Plugin_Builder.res.mjs

@@ -14,7 +14,9 @@ import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as Plugin$ReventlessCore from "./Plugin.res.mjs";
 import * as StackReference$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/StackReference.res.mjs";
 import * as Adapter$ReventlessCore from "../../adapter/Adapter.res.mjs";
+import * as RoleCoverage$Reventless from "@reventlessdev/reventless-spec/src/types/RoleCoverage.res.mjs";
 import * as Aggregate$ReventlessCore from "../../components/Aggregate/Aggregate.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../../components/Component.res.mjs";
 import * as ReadModel$ReventlessCore from "../../components/ReadModel/ReadModel.res.mjs";
 import * as Api_Naming$ReventlessCore from "../../components/Api/Api_Naming.res.mjs";
@@ -124,6 +126,7 @@ function Make(Spec) {
       let systemCallableComponents = systemCallableComponentsOpt !== undefined ? systemCallableComponentsOpt : [];
       let componentRuntime = componentRuntimeOpt !== undefined ? componentRuntimeOpt : ({});
       PluginRuntimeBuilder.registerPluginName(name);
+      Stdlib_Option.forEach(pluginStructure, s => RoleCoverage$Reventless.check(s, name));
       let version = PackageVersion$Reventless.fromCaller();
       return Component$ReventlessCore.make(ComponentType$ReventlessCore.toString(Plugin$ReventlessCore.componentType), name, (extra, extra$1) => {
         let _prevPluginName = Logger$ReventlessCore.currentPluginName.contents;
@@ -173,7 +176,7 @@ function Make(Spec) {
           if (fieldNames.length === 0) {
             return [];
           }
-          Stdlib_Option.forEach(Spec.hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, M.Spec.commandAuthorization));
+          Stdlib_Option.forEach(Spec.hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, command => Authorization$Reventless.named(M.Spec.commandAuthorization(command))));
           let aggDef = Stdlib_Option.flatMap(pluginStructure, s => s.aggregates.find(d => d.name === M.Spec.name));
           let fieldPermissions = {};
           filteredConstructorNames.forEach((cname, idx) => {
@@ -182,7 +185,7 @@ function Make(Spec) {
             let syntheticCmd = hasPayload ? ({
                 TAG: cname
               }) : cname;
-            let rule = M.Spec.commandAuthorization(syntheticCmd);
+            let rule = Authorization$Reventless.named(M.Spec.commandAuthorization(syntheticCmd));
             fieldPermissions[fieldName] = rule;
           });
           return [{
@@ -205,7 +208,7 @@ function Make(Spec) {
             returnTypeName: qn.returnTypeName,
             stateSchema: R.Spec.stateSchema,
             authorization: undefined,
-            permission: R.Spec.authorization,
+            permission: Authorization$Reventless.named(R.Spec.authorization),
             connectionSpec: true,
             subIdField: subIdField,
             indexQueries: indexes.length !== 0 ? indexes : undefined,

package/src/plugin/component/Plugin_Helpers.res

@@ -783,6 +783,15 @@ type pluginDeployedInfo = {
   deployedAt: string,
   actor: string,
   deploymentId: string,
+  /** The commit the deployment was built from, when CI or git could say. */
+  commit?: string,
+  /** The working tree had changes the commit does not hold. */
+  dirty?: bool,
+  /** What the environment is for, from the app's `environments.yaml`. */
+  purpose?: string,
+  tag?: string,
+  /** The pull request a review environment was deployed for. */
+  pullRequest?: int,
   kind?: pluginKind,
   displayName?: string,
   vendor?: string,
@@ -1141,7 +1150,8 @@ let registerAdminAggregateMutations = (
             ~kind=Aggregate,
             ~fields=fieldNames,
             ~commandSchema,
-            ~commandAuthorization=M.Spec.commandAuthorization->Obj.magic,
+            ~commandAuthorization=command =>
+              M.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
           )
         )
       }
@@ -1237,21 +1247,34 @@ let getInteropMeta = (): Pulumi.Output.t<JSON.t> => {
 }
 
 // ---------------------------------------------------------------------------
-// Stack metadata export — environment, region, timestamp, actor, git SHA.
+// Stack metadata export — environment, region, timestamp, actor, commit.
 // Called from both exportPluginOutputs and exportPlatformOutputs.
 // ---------------------------------------------------------------------------
 let exportDeploymentMetadata = () => {
+  let provenance = Reventless.DeploymentProvenance.current()
+  let stack = Pulumi.Pulumi.getStackName()
+  let optional =
+    [
+      ("commit", provenance.commit),
+      ("purpose", provenance.purpose),
+      ("tag", provenance.tag),
+      ("pullRequest", provenance.pullRequest->Option.map(n => n->Int.toString)),
+    ]->Array.filterMap(((key, value)) => value->Option.map(v => (key, v)))
   let metadata =
     [
-      ("environment", Pulumi.Pulumi.getStackName()),
+      ("environment", provenance.environment->Option.getOr(stack)),
+      ("stack", stack),
       (
         "region",
         Pulumi.Config.make(Some("aws"))->Pulumi.Config.get("region")->Option.getOr("unknown"),
       ),
       ("timestamp", Date.make()->Date.toISOString),
-      ("gitSha", NodeProcess.env->Dict.get("GITHUB_SHA")->Option.getOr("unknown")),
+      ("gitSha", provenance.commit->Option.getOr("unknown")),
+      ("dirty", provenance.dirty ? "true" : "false"),
       ("actor", NodeProcess.env->Dict.get("GITHUB_ACTOR")->Option.getOr("unknown")),
-    ]->Dict.fromArray
+    ]
+    ->Array.concat(optional)
+    ->Dict.fromArray
   Pulumi.Pulumi.export(
     "deploymentMetadata",
     metadata->Dict.mapValues(JSON.Encode.string)->JSON.Encode.object->Pulumi.Output.make,
@@ -1595,6 +1618,7 @@ let exportPluginOutputs = (pluginOutputs: Plugin.outputs) => {
       ->Dict.get("GITHUB_SHA")
       ->Option.orElse(NodeProcess.env->Dict.get("CI_COMMIT_SHA"))
       ->Option.getOr(Date.make()->Date.toISOString)
+    let provenance = Reventless.DeploymentProvenance.current()
     let schemaFor = name => componentSchemaRegistry->Dict.get(name)->Option.getOr({})
     let resolveAggregates = pluginOutputs.aggregates->Pulumi.Output.flatMap(aggs =>
       aggs
@@ -1855,11 +1879,16 @@ let exportPluginOutputs = (pluginOutputs: Plugin.outputs) => {
           let info: pluginDeployedInfo = {
             name,
             version,
-            environment: Pulumi.Pulumi.getStackName(),
+            environment: provenance.environment->Option.getOr(Pulumi.Pulumi.getStackName()),
             stackName: Pulumi.Pulumi.getStackName(),
             deployedAt: Date.make()->Date.toISOString,
             actor,
             deploymentId,
+            commit: ?provenance.commit,
+            dirty: ?(provenance.dirty ? Some(true) : None),
+            purpose: ?provenance.purpose,
+            tag: ?provenance.tag,
+            pullRequest: ?provenance.pullRequest,
             kind: ?(meta->Option.flatMap(m => m.kind)),
             displayName: ?(meta->Option.flatMap(m => m.displayName)),
             vendor: ?(meta->Option.flatMap(m => m.vendor)),

package/src/plugin/component/Plugin_Helpers.res.mjs

@@ -21,6 +21,7 @@ import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as Adapter$ReventlessCore from "../../adapter/Adapter.res.mjs";
 import * as Task$ReventlessInterop from "@reventlessdev/reventless-interop/src/components/Task.res.mjs";
 import * as Aggregate$ReventlessCore from "../../components/Aggregate/Aggregate.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../../components/Component.res.mjs";
 import * as ReadModel$ReventlessCore from "../../components/ReadModel/ReadModel.res.mjs";
 import * as Api_Naming$ReventlessCore from "../../components/Api/Api_Naming.res.mjs";
@@ -42,6 +43,7 @@ import * as ApiNoApiHelpers$ReventlessCore from "../../components/Api/ApiNoApiHe
 import * as AutomationSlice$ReventlessCore from "../../components/AutomationSlice/AutomationSlice.res.mjs";
 import * as Builder_Helpers$ReventlessCore from "../../components/Builder_Helpers.res.mjs";
 import * as Plugin_Callback$ReventlessCore from "./Plugin_Callback.res.mjs";
+import * as DeploymentProvenance$Reventless from "@reventlessdev/reventless-spec/src/types/DeploymentProvenance.res.mjs";
 import * as Plugin_BuiltHook$ReventlessCore from "./Plugin_BuiltHook.res.mjs";
 import * as StateChangeSlice$ReventlessCore from "../../components/StateChangeSlice/StateChangeSlice.res.mjs";
 import * as ExtensionPoint$ReventlessInterop from "@reventlessdev/reventless-interop/src/components/ExtensionPoint.res.mjs";
@@ -539,7 +541,7 @@ function registerAdminAggregateMutations(aggregates, hooks) {
     let fieldNames = filteredConstructorNames.map(cname => Api_Naming$ReventlessCore.adminField(M.Spec.name + "_" + cname));
     aggregateMutationFieldsRegistry[M.Spec.name] = fieldNames;
     if (fieldNames.length !== 0) {
-      return Stdlib_Option.forEach(hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, M.Spec.commandAuthorization));
+      return Stdlib_Option.forEach(hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, command => Authorization$Reventless.named(M.Spec.commandAuthorization(command))));
     }
   });
 }
@@ -607,10 +609,40 @@ function getInteropMeta() {
 }
 
 function exportDeploymentMetadata() {
+  let provenance = DeploymentProvenance$Reventless.current();
+  let stack = Pulumi.getStack();
+  let optional = Stdlib_Array.filterMap([
+    [
+      "commit",
+      provenance.commit
+    ],
+    [
+      "purpose",
+      provenance.purpose
+    ],
+    [
+      "tag",
+      provenance.tag
+    ],
+    [
+      "pullRequest",
+      Stdlib_Option.map(provenance.pullRequest, n => n.toString())
+    ]
+  ], param => {
+    let key = param[0];
+    return Stdlib_Option.map(param[1], v => [
+      key,
+      v
+    ]);
+  });
   let metadata = Object.fromEntries([
     [
       "environment",
-      Pulumi.getStack()
+      Stdlib_Option.getOr(provenance.environment, stack)
+    ],
+    [
+      "stack",
+      stack
     ],
     [
       "region",
@@ -622,13 +654,17 @@ function exportDeploymentMetadata() {
     ],
     [
       "gitSha",
-      Stdlib_Option.getOr(process.env["GITHUB_SHA"], "unknown")
+      Stdlib_Option.getOr(provenance.commit, "unknown")
+    ],
+    [
+      "dirty",
+      provenance.dirty ? "true" : "false"
     ],
     [
       "actor",
       Stdlib_Option.getOr(process.env["GITHUB_ACTOR"], "unknown")
     ]
-  ]);
+  ].concat(optional));
   Pulumi$Pulumi.$$export("deploymentMetadata", Pulumi.output(Stdlib_Dict.mapValues(metadata, prim => prim)));
 }
 
@@ -725,6 +761,7 @@ function exportPluginOutputs(pluginOutputs) {
   }
   let actor = Stdlib_Option.getOr(Stdlib_Option.orElse(Stdlib_Option.orElse(process.env["GITHUB_ACTOR"], process.env["CI_COMMIT_AUTHOR"]), process.env["USER"]), "local");
   let deploymentId = Stdlib_Option.getOr(Stdlib_Option.orElse(process.env["GITHUB_SHA"], process.env["CI_COMMIT_SHA"]), new Date().toISOString());
+  let provenance = DeploymentProvenance$Reventless.current();
   let resolveAggregates = Output$Pulumi.flatMap(pluginOutputs.aggregates, aggs => Pulumi.all(Object.entries(aggs).map(param => {
     let name = param[0];
     return Aggregate$ReventlessCore.toResolvedOutputs(param[1]).apply(resolved => ({
@@ -904,11 +941,16 @@ function exportPluginOutputs(pluginOutputs) {
       return hook({
         name: name,
         version: version,
-        environment: Pulumi.getStack(),
+        environment: Stdlib_Option.getOr(provenance.environment, Pulumi.getStack()),
         stackName: Pulumi.getStack(),
         deployedAt: new Date().toISOString(),
         actor: actor,
         deploymentId: deploymentId,
+        commit: provenance.commit,
+        dirty: provenance.dirty ? true : undefined,
+        purpose: provenance.purpose,
+        tag: provenance.tag,
+        pullRequest: provenance.pullRequest,
         kind: Stdlib_Option.flatMap(meta, m => m.kind),
         displayName: Stdlib_Option.flatMap(meta, m => m.displayName),
         vendor: Stdlib_Option.flatMap(meta, m => m.vendor),

package/src/plugin/component/Plugin_Structure.res

@@ -793,15 +793,32 @@ let commandLevelAndId = (
   }
 
 // The server's rule as keys a client checks against `identity.groups ++
-// config.accessTiers`; an any-of, since `isAllowed` is `some`. The rules asking
-// for nothing checkable — and `DenyAll` — publish no keys rather than an
+// config.accessTiers`; an any-of, since `isAllowed` is `some`. Mapped groups, not
+// role names: a key no token carries would gate the surface shut. The rules
+// asking for nothing checkable — and `DenyAll` — publish no keys rather than an
 // unsatisfiable one.
 let accessKeysFor = (rule: Reventless.Authorization.permission): option<array<string>> =>
-  switch rule {
-  | AllowGroups(groups) if groups->Array.length > 0 => Some(groups)
-  | AllowGroups(_) | AllowAuthenticated | AllowAnonymous | DenyAll => None
+  switch Reventless.Authorization.groupsOf(rule) {
+  | [] => None
+  | groups => Some(groups)
   }
 
+let nonEmpty = (xs: array<string>): option<array<string>> => xs->Array.length > 0 ? Some(xs) : None
+
+// The same rule's roles before mapping, which the deploy check compares with what
+// the platform provides.
+let rolesFor = (rule: Reventless.Authorization.permission): option<array<string>> =>
+  rule->Reventless.Authorization.rolesOf->Array.map(role => (role :> string))->nonEmpty
+
+// A stand-in for one constructor, the same shape the resolver builds at call time:
+// a payload-bearing variant compiles to `{TAG, ...}`, a payload-less one to a bare
+// string. Enough for the per-command switches the PPX generates, which match on
+// the constructor alone.
+let syntheticCommand = (~schema: S.t<unknown>, variantName: string): 'command =>
+  Reventless.DcbTag.isVariantPayloadBearing(schema, variantName)
+    ? {"TAG": variantName}->Obj.magic
+    : variantName->Obj.magic
+
 // Each mutation argument's GraphQL type onto its property, so a consumer declares
 // the variable the server expects. Mutates the freshly derived schema in place.
 let annotateArgTypes = (schema: JSON.t, argTypes: dict<string>): JSON.t => {
@@ -860,15 +877,8 @@ let toCommandDef = (
       ~variantName,
       properties,
     )
-    // Evaluated against a synthetic value per constructor, the same shape the
-    // resolver builds at call time: a payload-bearing variant compiles to
-    // `{TAG, ...}`, a payload-less one to a bare string.
-    let syntheticCommand: unknown = Reventless.DcbTag.isVariantPayloadBearing(
-      parentSchema,
-      variantName,
-    )
-      ? {"TAG": variantName}->Obj.magic
-      : variantName->Obj.magic
+    // Evaluated against a synthetic value per constructor; see `syntheticCommand`.
+    let syntheticCommand: unknown = syntheticCommand(~schema=parentSchema, variantName)
     // The spec's own switch, which is exhaustive — so it also speaks for a
     // constructor the host did not declare but spliced from a trait.
     //
@@ -937,7 +947,8 @@ let toCommandDef = (
       | Some(excluded) => !(excluded->Set.has(variantName))
       | None => true
       }
-    let requiredAccess = accessKeysFor(commandAuthorization(syntheticCommand))
+    let rule = commandAuthorization(syntheticCommand)
+    let requiredAccess = accessKeysFor(rule)
     // See the note on the record's `mutationField` for why a non-exposed
     // variant gets the empty sentinel. It has no callable field, and the
     // argument type names are composed *from* that field name, so there is
@@ -975,6 +986,7 @@ let toCommandDef = (
         ?allowedStatesSource,
         apiExposed: Some(apiExposed),
         requiredAccess,
+        requiredRoles: ?rolesFor(rule),
         // Resolved from this constructor's own properties, not the union's: two
         // commands in one slice can disagree about whether they record an owner,
         // and the write path stamps per constructor for the same reason.
@@ -1094,6 +1106,7 @@ let queryableDefFromSpec = (
     idField: keyField->Option.map(((f, _)) => f),
     idFieldSource: keyField->Option.map(((_, rung)) => rung),
     requiredAccess: accessKeysFor(authorization),
+    requiredRoles: ?rolesFor(authorization),
   }
 }
 
@@ -1550,7 +1563,8 @@ let make = (
         singleQueryField: Some(qf.singleFieldName),
         idField: keyField->Option.map(((f, _)) => f),
         idFieldSource: keyField->Option.map(((_, rung)) => rung),
-        requiredAccess: accessKeysFor(R.Spec.authorization),
+        requiredAccess: accessKeysFor(R.Spec.authorization->Reventless.Authorization.named),
+        requiredRoles: ?rolesFor(R.Spec.authorization->Reventless.Authorization.named),
       }: Reventless.Plugin.queryableDef
     )
   })
@@ -1590,7 +1604,8 @@ let make = (
           singleQueryField: Some(qf.singleFieldName),
           idField: keyField->Option.map(((f, _)) => f),
           idFieldSource: keyField->Option.map(((_, rung)) => rung),
-          requiredAccess: accessKeysFor(SVS.Spec.authorization),
+          requiredAccess: accessKeysFor(SVS.Spec.authorization->Reventless.Authorization.named),
+          requiredRoles: ?rolesFor(SVS.Spec.authorization->Reventless.Authorization.named),
         }: Reventless.Plugin.queryableDef
       )
     })
@@ -1690,7 +1705,8 @@ let make = (
                 ~commandSchema=SCS.Spec.commandSchema->S.castToUnknown,
                 ~variant=variantName,
               ),
-            ~commandAuthorization=SCS.Spec.commandAuthorization->Obj.magic,
+            ~commandAuthorization=command =>
+              SCS.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
             ~commandTransition=SCS.Spec.commandTransition->Obj.magic,
             ~derivedEdgeFor=derivedEdgeFor(~component=SCS.Spec.name, ...),
             SCS.Spec.commandSchema->S.castToUnknown,
@@ -1724,7 +1740,8 @@ let make = (
               ~aggregate=A.Spec.name,
               ~command=variantName,
             ),
-          ~commandAuthorization=A.Spec.commandAuthorization->Obj.magic,
+          ~commandAuthorization=command =>
+            A.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
           ~commandTransition=A.Spec.commandTransition->Obj.magic,
           ~derivedEdgeFor=derivedEdgeFor(~component=A.Spec.name, ...),
           A.Spec.commandSchema->S.castToUnknown,
@@ -1798,6 +1815,22 @@ let make = (
       targetName: ITS.Spec.targetName,
       externalSystem: ITS.Spec.externalSystem,
       chapter: chapterOf(ITS.Spec.name),
+      // Per command, as the resolver evaluates the rule, then joined: the slice
+      // publishes no command defs to carry them.
+      requiredRoles: ?(
+        Reventless.DcbTag.extractAllVariantNames(ITS.Spec.commandSchema)
+        ->Array.flatMap(variantName =>
+          syntheticCommand(~schema=ITS.Spec.commandSchema->S.castToUnknown, variantName)
+          ->ITS.Spec.commandAuthorization
+          ->Reventless.Authorization.named
+          ->Reventless.Authorization.rolesOf
+          ->Array.map(role => (role :> string))
+        )
+        ->Set.fromArray
+        ->Set.values
+        ->Array.fromIterator
+        ->nonEmpty
+      ),
     })
 
   // ── Extensions ───────────────────────────────────────────────────────────

package/src/plugin/component/Plugin_Structure.res.mjs

@@ -21,6 +21,7 @@ import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as StorageRef$Reventless from "@reventlessdev/reventless-spec/src/semantic/StorageRef.res.mjs";
 import * as Transition$Reventless from "@reventlessdev/reventless-spec/src/types/Transition.res.mjs";
 import * as DisplayName$Reventless from "@reventlessdev/reventless-spec/src/components/DisplayName.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Api_Naming$ReventlessCore from "../../components/Api/Api_Naming.res.mjs";
 import * as CapabilityNeed$Reventless from "@reventlessdev/reventless-spec/src/semantic/CapabilityNeed.res.mjs";
 import * as SchemaType$ReventlessCore from "../../components/Api/SchemaType.res.mjs";
@@ -617,15 +618,32 @@ function commandLevelAndId(isAggregate, partitionKey, variantName, properties) {
 }
 
 function accessKeysFor(rule) {
-  if (typeof rule !== "object") {
-    return;
-  }
-  let groups = rule._0;
+  let groups = Authorization$Reventless.groupsOf(rule);
   if (groups.length !== 0) {
     return groups;
   }
 }
 
+function nonEmpty(xs) {
+  if (xs.length !== 0) {
+    return xs;
+  }
+}
+
+function rolesFor(rule) {
+  return nonEmpty(Authorization$Reventless.rolesOf(rule).map(role => role));
+}
+
+function syntheticCommand(schema, variantName) {
+  if (DcbTag$Reventless.isVariantPayloadBearing(schema, variantName)) {
+    return {
+      TAG: variantName
+    };
+  } else {
+    return variantName;
+  }
+}
+
 function annotateArgTypes(schema, argTypes) {
   Stdlib_Option.forEach(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(schema), o => o["properties"]), Stdlib_JSON.Decode.object), props => {
     Object.entries(props).forEach(param => {
@@ -644,10 +662,8 @@ function toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor
   let mkDef = (variantName, properties) => {
     let match = commandLevelAndId(isAggregate, partitionKey, variantName, properties);
     let aggregateIdField = match[1];
-    let syntheticCommand = DcbTag$Reventless.isVariantPayloadBearing(parentSchema, variantName) ? ({
-        TAG: variantName
-      }) : variantName;
-    let declared = commandTransition(syntheticCommand);
+    let syntheticCommand$1 = syntheticCommand(parentSchema, variantName);
+    let declared = commandTransition(syntheticCommand$1);
     let derived = derivedEdgeFor(variantName);
     let unrestricted = Transition$Reventless.isUnrestricted(declared);
     let match$1 = unrestricted ? undefined : Stdlib_Option.flatMap(derived, d => {
@@ -684,7 +700,8 @@ function toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor
       let excluded = ApiNoApiHelpers$ReventlessCore.getExcludedVariants(parentSchema);
       apiExposed = excluded !== undefined ? !excluded.has(variantName) : true;
     }
-    let requiredAccess = accessKeysFor(commandAuthorization(syntheticCommand));
+    let rule = commandAuthorization(syntheticCommand$1);
+    let requiredAccess = accessKeysFor(rule);
     let mutationField = apiExposed ? mutationFieldFor(variantName) : "";
     let jsonSchema = SuryToJsonSchema$ReventlessCore.deriveObjectSchema(apiExposed, mutationField, v);
     let annotatedSchema = apiExposed ? Stdlib_Option.mapOr(GraphQL_FragmentGenerator$ReventlessCore.mutationArgTypes(mutationField, v), jsonSchema, __x => annotateArgTypes(jsonSchema, __x)) : jsonSchema;
@@ -700,6 +717,7 @@ function toCommandDef(identityViews, isAggregate, partitionKey, mutationFieldFor
       allowedStatesSource: match$3[1],
       apiExposed: apiExposed,
       requiredAccess: requiredAccess,
+      requiredRoles: rolesFor(rule),
       ownerField: Owner$Reventless.fieldNamesOfProperties(properties)[0]
     };
   };
@@ -770,7 +788,8 @@ function queryableDefFromSpec(plugin, name, stateSchema, authorization, visibili
     singleQueryField: qf.singleFieldName,
     idField: Stdlib_Option.map(keyField, param => param[0]),
     idFieldSource: Stdlib_Option.map(keyField, param => param[1]),
-    requiredAccess: accessKeysFor(authorization)
+    requiredAccess: accessKeysFor(authorization),
+    requiredRoles: rolesFor(authorization)
   };
 }
 
@@ -1080,7 +1099,8 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
       singleQueryField: qf.singleFieldName,
       idField: Stdlib_Option.map(keyField, param => param[0]),
       idFieldSource: Stdlib_Option.map(keyField, param => param[1]),
-      requiredAccess: accessKeysFor(R.Spec.authorization)
+      requiredAccess: accessKeysFor(Authorization$Reventless.named(R.Spec.authorization)),
+      requiredRoles: rolesFor(Authorization$Reventless.named(R.Spec.authorization))
     };
   });
   let stateViewDefs = stateViewSlices.map((SVS, i) => {
@@ -1112,7 +1132,8 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
       singleQueryField: qf.singleFieldName,
       idField: Stdlib_Option.map(keyField, param => param[0]),
       idFieldSource: Stdlib_Option.map(keyField, param => param[1]),
-      requiredAccess: accessKeysFor(SVS.Spec.authorization)
+      requiredAccess: accessKeysFor(Authorization$Reventless.named(SVS.Spec.authorization)),
+      requiredRoles: rolesFor(Authorization$Reventless.named(SVS.Spec.authorization))
     };
   });
   let dcbSliceSchemas = stateChangeSlices.map(SCS => ({
@@ -1197,7 +1218,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let consumed = match$1[1];
     return {
       name: SCS.Spec.name,
-      commands: extractCommandDefs(identityViews, false, partitionBySlice[SCS.Spec.name], variantName => Api_Naming$ReventlessCore.sliceMutationFieldFor(name, SCS.Spec.name, SCS.Spec.commandSchema, variantName), SCS.Spec.commandAuthorization, SCS.Spec.commandTransition, extra => derivedEdgeFor(SCS.Spec.name, extra), SCS.Spec.commandSchema),
+      commands: extractCommandDefs(identityViews, false, partitionBySlice[SCS.Spec.name], variantName => Api_Naming$ReventlessCore.sliceMutationFieldFor(name, SCS.Spec.name, SCS.Spec.commandSchema, variantName), command => Authorization$Reventless.named(SCS.Spec.commandAuthorization(command)), SCS.Spec.commandTransition, extra => derivedEdgeFor(SCS.Spec.name, extra), SCS.Spec.commandSchema),
       producedEventTypes: produced,
       consumedEventTypes: consumed,
       linkedViews: linkedSvsFor(produced),
@@ -1212,7 +1233,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     let produced = match[1];
     return {
       name: A.Spec.name,
-      commands: extractCommandDefs(identityViews, true, undefined, variantName => Api_Naming$ReventlessCore.aggregateMutationField(name, A.Spec.name, variantName), A.Spec.commandAuthorization, A.Spec.commandTransition, extra => derivedEdgeFor(A.Spec.name, extra), A.Spec.commandSchema),
+      commands: extractCommandDefs(identityViews, true, undefined, variantName => Api_Naming$ReventlessCore.aggregateMutationField(name, A.Spec.name, variantName), command => Authorization$Reventless.named(A.Spec.commandAuthorization(command)), A.Spec.commandTransition, extra => derivedEdgeFor(A.Spec.name, extra), A.Spec.commandSchema),
       producedEventTypes: produced,
       consumedEventTypes: [],
       linkedViews: linkedSvsFor(produced).concat(linkedReadModelsFor(A.Spec.name)),
@@ -1246,7 +1267,8 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     commandTypes: qualify(name, DcbTag$Reventless.extractAllVariantNames(ITS.Spec.commandSchema)),
     targetName: ITS.Spec.targetName,
     externalSystem: ITS.Spec.externalSystem,
-    chapter: componentChapters[ITS.Spec.name]
+    chapter: componentChapters[ITS.Spec.name],
+    requiredRoles: nonEmpty(Array.from(new Set(DcbTag$Reventless.extractAllVariantNames(ITS.Spec.commandSchema).flatMap(variantName => Authorization$Reventless.rolesOf(Authorization$Reventless.named(ITS.Spec.commandAuthorization(syntheticCommand(ITS.Spec.commandSchema, variantName)))).map(role => role))).values()))
   }));
   let tableFailures = [];
   let tableWarnings = [];
@@ -1549,6 +1571,9 @@ export {
   isCreateCommandName,
   commandLevelAndId,
   accessKeysFor,
+  nonEmpty,
+  rolesFor,
+  syntheticCommand,
   annotateArgTypes,
   toCommandDef,
   extractCommandDefs,

package/src/plugin/lifecycle/PluginsReadModelSpec.res

@@ -10,7 +10,7 @@
 // this (spec-level `permission` outranks the legacy `{tableName, group}` pair),
 // and so does the `requiredAccess` the platform publishes — so a shell can gate
 // the Plugins view up front instead of offering it and meeting a refusal.
-@@reventless.authorize(AllowGroups(["Admin"]))
+@@reventless.authorize(AllowRoles([Admin]))
 
 // Current view — one row per plugin **name**, holding the currently-active
 // version's definition. Keyed by the aggregate id (= plugin name). The status

package/src/plugin/lifecycle/PluginsReadModelSpec.res.mjs

@@ -64,7 +64,7 @@ let stateSchema$1 = Sury.$Metadata_set(stateSchema, StateAnnotations$Reventless.
 });
 
 let authorization = {
-  TAG: "AllowGroups",
+  TAG: "AllowRoles",
   _0: ["Admin"]
 };
 

package/tests/admin/AdminApiSchemaDriftTest.res

@@ -254,7 +254,9 @@ let guards: array<guard> = [
     recordFields: schemaKeys(commandDefSchema),
     wireFields: jsonKeys(Platform_ComponentDefinitionsApi.encodeCommandDef(cmd)),
     wireOnly: [],
-    recordOnly: [],
+    // The roles behind `requiredAccess`, read by the deploy check in-process.
+    // A client gates on the mapped groups and has no use for role names.
+    recordOnly: ["requiredRoles"],
   },
   {
     gqlType: "Platform_EventDef",
@@ -286,7 +288,9 @@ let guards: array<guard> = [
     recordFields: schemaKeys(queryableDefSchema),
     wireFields: jsonKeys(Platform_ComponentDefinitionsApi.encodeQueryableDef(queryable)),
     wireOnly: [],
-    recordOnly: [],
+    // The roles behind `requiredAccess`, read by the deploy check in-process.
+    // A client gates on the mapped groups and has no use for role names.
+    recordOnly: ["requiredRoles"],
   },
   {
     gqlType: "Platform_AutomationSliceDef",
@@ -314,7 +318,9 @@ let guards: array<guard> = [
       Platform_ComponentDefinitionsApi.encodeInboundTranslationSliceDef(inbound),
     ),
     wireOnly: [],
-    recordOnly: [],
+    // The roles behind `requiredAccess`, read by the deploy check in-process.
+    // A client gates on the mapped groups and has no use for role names.
+    recordOnly: ["requiredRoles"],
   },
   {
     gqlType: "Platform_ExtensionDef",

package/tests/admin/AdminApiSchemaDriftTest.res.mjs

@@ -390,7 +390,7 @@ let guards = [
     recordFields: schemaKeys(Plugin$Reventless.commandDefSchema),
     wireFields: jsonKeys(Platform_ComponentDefinitionsApi$ReventlessCore.encodeCommandDef(cmd)),
     wireOnly: [],
-    recordOnly: []
+    recordOnly: ["requiredRoles"]
   },
   {
     gqlType: "Platform_EventDef",
@@ -422,7 +422,7 @@ let guards = [
     recordFields: schemaKeys(Plugin$Reventless.queryableDefSchema),
     wireFields: jsonKeys(Platform_ComponentDefinitionsApi$ReventlessCore.encodeQueryableDef(queryable)),
     wireOnly: [],
-    recordOnly: []
+    recordOnly: ["requiredRoles"]
   },
   {
     gqlType: "Platform_AutomationSliceDef",
@@ -446,7 +446,7 @@ let guards = [
     recordFields: schemaKeys(Plugin$Reventless.inboundTranslationSliceDefSchema),
     wireFields: jsonKeys(Platform_ComponentDefinitionsApi$ReventlessCore.encodeInboundTranslationSliceDef(inbound)),
     wireOnly: [],
-    recordOnly: []
+    recordOnly: ["requiredRoles"]
   },
   {
     gqlType: "Platform_ExtensionDef",