@reventlessdev/reventless-core 3.0.0-alpha.284 → 3.0.0-alpha.286

package/tests/commandgenerator/OwnerStampingTest.res

@@ -256,3 +256,93 @@ describe("the schema a generator is built with must answer for its commands:", (
     },
   )
 })
+
+// The claim a handler checks ownership against. It is written from the same
+// classification the stamp uses, on every command, whether or not the command
+// itself records an owner: the command that needs it most (`CancelOrder`) names
+// no owner of its own.
+describe("the caller claim on the envelope:", () => {
+  let claimOf = (cmd: Message.commandJson) => cmd.meta.callerClaim
+
+  let cancel = (~identity) =>
+    payload(
+      ~command="ImportProducts",
+      ~args=Dict.fromArray([("batchId", str("b-1")), ("source", str("acme"))]),
+      ~identity,
+    )
+
+  testPromise("an owned caller is claimed as that owner", async () => {
+    let _ = await generate(
+      cancel(~identity=cognito(~userId="cust-A", ~groups=["User"])),
+    )->Effect.runPromise
+    expect(lastPublished()->claimOf)->toEqual(Some(Message.CallerClaim.Owned({userId: "cust-A"})))
+  })
+
+  testPromise("an elevated caller and a system caller are claimed exempt", async () => {
+    let _ = await generate(
+      cancel(~identity=cognito(~userId="ops-1", ~groups=["Admin"])),
+    )->Effect.runPromise
+    let elevated = lastPublished()->claimOf
+    let _ = await generate(cancel(~identity=iam))->Effect.runPromise
+    expect((elevated, lastPublished()->claimOf))->toEqual((
+      Some(Message.CallerClaim.Exempt),
+      Some(Message.CallerClaim.Exempt),
+    ))
+  })
+
+  // Not refused here — the command records no owner, so `AllowAnonymous` still
+  // admits it. The claim is what lets the handler refuse it on an owned partition.
+  testPromise("an anonymous caller of an unowned command is claimed unidentified", async () => {
+    let _ = await generate(cancel(~identity=Reventless.Identity.anonymous))->Effect.runPromise
+    expect(lastPublished()->claimOf)->toEqual(Some(Message.CallerClaim.Unidentified))
+  })
+
+  // A client controls the arguments and nothing else. Naming the claim among them
+  // must neither reach the envelope nor survive into the command.
+  testPromise("a claim sent among the arguments is ignored", async () => {
+    let _ = await generate(
+      payload(
+        ~command="ImportProducts",
+        ~args=Dict.fromArray([
+          ("batchId", str("b-1")),
+          ("source", str("acme")),
+          ("callerClaim", str("Exempt")),
+          ("meta", JSON.Encode.object(Dict.fromArray([("callerClaim", str("Exempt"))]))),
+        ]),
+        ~identity=cognito(~userId="cust-A", ~groups=["User"]),
+      ),
+    )->Effect.runPromise
+    expect(lastPublished()->claimOf)->toEqual(Some(Message.CallerClaim.Owned({userId: "cust-A"})))
+  })
+
+  // Unlike the stamp, the claim needs no schema: the permissive generator that
+  // stamps nothing still classifies the caller.
+  testPromise("a permissive-schema generator still writes the claim", async () => {
+    let permissive = CommandGenerator_Callback.makeGenerateCommand(
+      ~publishJsons=async cmds => published := published.contents->Array.concat(cmds),
+      ~serviceName="Ordering",
+      ~commandSchema=S.json->S.castToUnknown,
+      ~componentKind=CommandGenerator_Callback.StateChangeSlice,
+      ~stripIdFromParams=false,
+    )
+    let _ = await permissive(
+      cancel(~identity=cognito(~userId="cust-A", ~groups=["User"])),
+    )->Effect.runPromise
+    expect(lastPublished()->claimOf)->toEqual(Some(Message.CallerClaim.Owned({userId: "cust-A"})))
+  })
+
+  // The claim belongs to the command alone. An event the command produces, and a
+  // command an automation issues in reaction to it, derive their envelope from
+  // it and must not inherit the caller.
+  testSync("a derived envelope does not inherit the claim", () => {
+    let parent: Message.meta = {
+      service: "Ordering",
+      time: "2024-01-01T00:00:00Z",
+      msgId: "m-1",
+      correlationId: "m-1",
+      user: "cust-A",
+      callerClaim: Message.CallerClaim.Owned({userId: "cust-A"}),
+    }
+    expect(Message.deriveMeta(~parent).callerClaim)->toEqual(None)
+  })
+})

package/tests/commandgenerator/OwnerStampingTest.res.mjs

@@ -9,6 +9,7 @@ import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/component
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
 import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
+import * as Message$ReventlessCore from "../../src/Message.res.mjs";
 import * as Plugin_ResolverError$ReventlessCore from "../../src/plugin/component/Plugin_ResolverError.res.mjs";
 import * as CommandGenerator_Callback$ReventlessCore from "../../src/components/CommandGenerator/CommandGenerator_Callback.res.mjs";
 
@@ -209,6 +210,92 @@ globalThis.describe("the schema a generator is built with must answer for its co
   });
 });
 
+globalThis.describe("the caller claim on the envelope:", () => {
+  let cancel = identity => payload("ImportProducts", Object.fromEntries([
+    [
+      "batchId",
+      "b-1"
+    ],
+    [
+      "source",
+      "acme"
+    ]
+  ]), identity);
+  globalThis.test("an owned caller is claimed as that owner", async () => {
+    await Effect.runPromise(generate(cancel(cognito("cust-A", ["User"]))));
+    globalThis.expect(published.contents[published.contents.length - 1 | 0].meta.callerClaim).toEqual({
+      TAG: "Owned",
+      userId: "cust-A"
+    });
+  });
+  globalThis.test("an elevated caller and a system caller are claimed exempt", async () => {
+    await Effect.runPromise(generate(cancel(cognito("ops-1", ["Admin"]))));
+    let elevated = published.contents[published.contents.length - 1 | 0].meta.callerClaim;
+    await Effect.runPromise(generate(cancel(iam)));
+    globalThis.expect([
+      elevated,
+      published.contents[published.contents.length - 1 | 0].meta.callerClaim
+    ]).toEqual([
+      "Exempt",
+      "Exempt"
+    ]);
+  });
+  globalThis.test("an anonymous caller of an unowned command is claimed unidentified", async () => {
+    await Effect.runPromise(generate(cancel(Identity$Reventless.anonymous)));
+    globalThis.expect(published.contents[published.contents.length - 1 | 0].meta.callerClaim).toEqual("Unidentified");
+  });
+  globalThis.test("a claim sent among the arguments is ignored", async () => {
+    await Effect.runPromise(generate(payload("ImportProducts", Object.fromEntries([
+      [
+        "batchId",
+        "b-1"
+      ],
+      [
+        "source",
+        "acme"
+      ],
+      [
+        "callerClaim",
+        "Exempt"
+      ],
+      [
+        "meta",
+        Object.fromEntries([[
+            "callerClaim",
+            "Exempt"
+          ]])
+      ]
+    ]), cognito("cust-A", ["User"]))));
+    globalThis.expect(published.contents[published.contents.length - 1 | 0].meta.callerClaim).toEqual({
+      TAG: "Owned",
+      userId: "cust-A"
+    });
+  });
+  globalThis.test("a permissive-schema generator still writes the claim", async () => {
+    let permissive = CommandGenerator_Callback$ReventlessCore.makeGenerateCommand(async cmds => {
+      published.contents = published.contents.concat(cmds);
+    }, undefined, "Ordering", Sury.json, "StateChangeSlice", false, undefined);
+    await Effect.runPromise(permissive(cancel(cognito("cust-A", ["User"]))));
+    globalThis.expect(published.contents[published.contents.length - 1 | 0].meta.callerClaim).toEqual({
+      TAG: "Owned",
+      userId: "cust-A"
+    });
+  });
+  globalThis.test("a derived envelope does not inherit the claim", () => {
+    globalThis.expect(Message$ReventlessCore.deriveMeta({
+      service: "Ordering",
+      time: "2024-01-01T00:00:00Z",
+      user: "cust-A",
+      msgId: "m-1",
+      correlationId: "m-1",
+      callerClaim: {
+        TAG: "Owned",
+        userId: "cust-A"
+      }
+    }, undefined).callerClaim).toEqual(undefined);
+  });
+});
+
 export {
   commandSchema,
   published,

package/tests/commandtopic/CommandOutcomeHookTest.res

@@ -72,6 +72,7 @@ let seen = () =>
         switch cause {
         | DomainRejection => "rejected/domain"
         | InfrastructureFailure => "rejected/infrastructure"
+        | AccessRefusal => "rejected/access"
         },
         errorCode,
         0,

package/tests/commandtopic/CommandOutcomeHookTest.res.mjs

@@ -106,7 +106,17 @@ function seen() {
       ];
     }
     let tmp;
-    tmp = match.cause === "DomainRejection" ? "rejected/domain" : "rejected/infrastructure";
+    switch (match.cause) {
+      case "DomainRejection" :
+        tmp = "rejected/domain";
+        break;
+      case "InfrastructureFailure" :
+        tmp = "rejected/infrastructure";
+        break;
+      case "AccessRefusal" :
+        tmp = "rejected/access";
+        break;
+    }
     return [
       r.component,
       r.reference,

package/tests/plugin/PluginStructureAccessTest.res

@@ -76,7 +76,7 @@ let viewNamed = name =>
   ->Option.flatMap(q => q.requiredAccess)
 
 describe("requiredAccess derived from the authorization rule", () => {
-  testSync("an AllowGroups command publishes its groups", () =>
+  testSync("an AllowRoles command publishes its groups", () =>
     expect(commandNamed("Restock"))->toEqual(Some(["Admin", "Ops"]))
   )
 
@@ -108,4 +108,33 @@ describe("requiredAccess derived from the authorization rule", () => {
       json->String.includes(`"requiredAccess":[]`),
     ))->toEqual((true, true, false))
   })
+
+  // The access keys are compared with a token's groups, so they are the groups
+  // the roles map to; the roles themselves travel beside them for the deploy
+  // check.
+  testSync("a renamed role publishes its group as the key and its role as the role", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.make("Ops"), "shop-ops")])
+    let renamed = Plugin_Structure.make(
+      ~name="AccessPlugin",
+      ~stateChangeSlices=[module(PsGatedCommandsSlice)],
+    )
+    Reventless.Role.clearGroups()
+    let restock =
+      renamed.stateChangeSlices
+      ->Array.flatMap(w => w.commands)
+      ->Array.find(c => c.name === "Restock")
+    expect(restock->Option.map(c => (c.requiredAccess, c.requiredRoles)))->toEqual(
+      Some((Some(["Admin", "shop-ops"]), Some(["Admin", "Ops"]))),
+    )
+  })
+
+  testSync("a command that names no role publishes no roles", () =>
+    expect(
+      structure.stateChangeSlices
+      ->Array.flatMap(w => w.commands)
+      ->Array.find(c => c.name === "RequestRestock")
+      ->Option.flatMap(c => c.requiredRoles),
+    )->toEqual(None)
+  )
 })

package/tests/plugin/PluginStructureAccessTest.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as PsGatedView$ReventlessCore from "./StateView/PsGatedView.res.mjs";
 import * as PsOrdersView$ReventlessCore from "./StateView/PsOrdersView.res.mjs";
 import * as PsGatedCommands$ReventlessCore from "./StateChange/PsGatedCommands.res.mjs";
@@ -119,7 +120,7 @@ function viewNamed(name) {
 }
 
 globalThis.describe("requiredAccess derived from the authorization rule", () => {
-  globalThis.test("an AllowGroups command publishes its groups", () => {
+  globalThis.test("an AllowRoles command publishes its groups", () => {
     globalThis.expect(commandNamed("Restock")).toEqual([
       "Admin",
       "Ops"
@@ -146,6 +147,32 @@ globalThis.describe("requiredAccess derived from the authorization rule", () =>
       false
     ]);
   });
+  globalThis.test("a renamed role publishes its group as the key and its role as the role", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        "Ops",
+        "shop-ops"
+      ]]);
+    let renamed = Plugin_Structure$ReventlessCore.make("AccessPlugin", undefined, undefined, undefined, [PsGatedCommandsSlice], undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+    Role$Reventless.clearGroups();
+    let restock = renamed.stateChangeSlices.flatMap(w => w.commands).find(c => c.name === "Restock");
+    globalThis.expect(Stdlib_Option.map(restock, c => [
+      c.requiredAccess,
+      c.requiredRoles
+    ])).toEqual([
+      [
+        "Admin",
+        "shop-ops"
+      ],
+      [
+        "Admin",
+        "Ops"
+      ]
+    ]);
+  });
+  globalThis.test("a command that names no role publishes no roles", () => {
+    globalThis.expect(Stdlib_Option.flatMap(structure.stateChangeSlices.flatMap(w => w.commands).find(c => c.name === "RequestRestock"), c => c.requiredRoles)).toEqual(undefined);
+  });
 });
 
 export {

package/tests/plugin/StateChange/PsGatedCommands.res

@@ -4,6 +4,14 @@
 
 @@reventless.spec("GatedCommands")
 
+// Declared here rather than in the package's `Roles.res`: the rule resolves
+// `Roles` by ordinary scoping, so a spec can name roles its package does not.
+module Roles = {
+  type t =
+    | Admin
+    | Ops
+}
+
 type state = bool
 let initialState = false
 
@@ -14,7 +22,7 @@ let evolve = (_state, _event) => true
 
 @schema
 type command =
-  | @authorize(AllowGroups(["Admin", "Ops"])) Restock({productId: string})
+  | @authorize(AllowRoles([Admin, Ops])) Restock({productId: string})
   | RequestRestock({productId: string})
 
 @schema

package/tests/plugin/StateChange/PsGatedCommands.res.mjs

@@ -3,6 +3,8 @@
 import * as Sury from "sury";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 
+let Roles = {};
+
 let consumedEventSchema = Sury.$schema(s => ({
   TAG: "StockLow",
   productId: s.m(DcbTag$Reventless.string)
@@ -46,7 +48,7 @@ function decide(_state, _command) {
 function commandAuthorization(command) {
   if (command.TAG === "Restock") {
     return {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: [
         "Admin",
         "Ops"
@@ -76,6 +78,7 @@ let readConsistency = "EscalateOnRetry";
 export {
   name,
   Id,
+  Roles,
   initialState,
   consumedEventSchema,
   evolve,

package/tests/plugin/StateView/PsGatedView.res

@@ -1,7 +1,7 @@
 // Test fixture spec: a view whose module-level rule restricts who may read it.
 
 @@reventless.spec("GatedView")
-@@reventless.authorize(AllowGroups(["Admin"]))
+@@reventless.authorize(AllowRoles([Admin]))
 
 @schema
 type consumedEvent = OrderPlaced({orderId: string, customerName: string})

package/tests/plugin/StateView/PsGatedView.res.mjs

@@ -31,7 +31,7 @@ function project(param) {
 let config = ReadModel$Reventless.config(undefined, undefined, undefined);
 
 let authorization = {
-  TAG: "AllowGroups",
+  TAG: "AllowRoles",
   _0: ["Admin"]
 };
 

package/tests/plugin/pluginDefinitionRequiredScalars.txt

@@ -56,6 +56,7 @@
 .structure.aggregates[].commands[].references[].entity: string
 .structure.aggregates[].commands[].references[].fieldName: string
 .structure.aggregates[].commands[].requiredAccess[]: string
+.structure.aggregates[].commands[].requiredRoles[]: string
 .structure.aggregates[].commands[].schema: string
 .structure.aggregates[].consumedEventTypes[]: string
 .structure.aggregates[].errors[].name: string
@@ -91,6 +92,7 @@
 .structure.extensions[].name: string
 .structure.inboundTranslationSlices[].commandTypes[]: string
 .structure.inboundTranslationSlices[].name: string
+.structure.inboundTranslationSlices[].requiredRoles[]: string
 .structure.inboundTranslationSlices[].targetName: string
 .structure.outboundTranslationSlices[].consumedEventTypes[]: string
 # `consumedSources` is itself optional and is NEW, so no persisted payload
@@ -107,6 +109,7 @@
 .structure.readModels[].name: string
 .structure.readModels[].queryField: string
 .structure.readModels[].requiredAccess[]: string
+.structure.readModels[].requiredRoles[]: string
 .structure.readModels[].retiredValues[]: string
 .structure.readModels[].schema: string
 .structure.readModels[].searchableFields[]: string
@@ -138,6 +141,7 @@
 .structure.stateChangeSlices[].commands[].references[].entity: string
 .structure.stateChangeSlices[].commands[].references[].fieldName: string
 .structure.stateChangeSlices[].commands[].requiredAccess[]: string
+.structure.stateChangeSlices[].commands[].requiredRoles[]: string
 .structure.stateChangeSlices[].commands[].schema: string
 .structure.stateChangeSlices[].consumedEventTypes[]: string
 .structure.stateChangeSlices[].errors[].name: string
@@ -157,6 +161,7 @@
 .structure.stateViewSlices[].name: string
 .structure.stateViewSlices[].queryField: string
 .structure.stateViewSlices[].requiredAccess[]: string
+.structure.stateViewSlices[].requiredRoles[]: string
 .structure.stateViewSlices[].retiredValues[]: string
 .structure.stateViewSlices[].schema: string
 .structure.stateViewSlices[].searchableFields[]: string