@reventlessdev/reventless-core 3.0.0-alpha.285 → 3.0.0-alpha.286

package/tests/admin/Platform_PluginStructuresApiTest.res.mjs

@@ -47,52 +47,20 @@ let publicRm = {
   requiredAccess: undefined
 };
 
-let internalRm_consumedEventTypes = publicRm_consumedEventTypes;
+let newrecord = {...publicRm};
 
-let internalRm_linkedWriteSide = publicRm_linkedWriteSide;
+newrecord.visibility = "Internal";
 
-let internalRm_searchableFields = publicRm_searchableFields;
+newrecord.queryField = "Catalog_ProductAudit";
 
-let internalRm_labelFieldSource = "annotation";
-
-let internalRm_visibility = "Internal";
-
-let internalRm_chapter = "Inventory";
-
-let internalRm_singleQueryField = "Catalog_Product";
-
-let internalRm_idField = "productId";
-
-let internalRm_idFieldSource = "convention";
-
-let internalRm = {
-  name: "ProductAudit",
-  queryField: "Catalog_ProductAudit",
-  schema: "{}",
-  consumedEventTypes: internalRm_consumedEventTypes,
-  linkedWriteSide: internalRm_linkedWriteSide,
-  labelField: "displayName",
-  searchableFields: internalRm_searchableFields,
-  labelFieldSource: internalRm_labelFieldSource,
-  lifecycleField: undefined,
-  ownerField: undefined,
-  retiredField: undefined,
-  retiredValues: undefined,
-  namedWhenRetired: undefined,
-  visibility: internalRm_visibility,
-  chapter: internalRm_chapter,
-  singleQueryField: internalRm_singleQueryField,
-  idField: internalRm_idField,
-  idFieldSource: internalRm_idFieldSource,
-  requiredAccess: undefined
-};
+newrecord.name = "ProductAudit";
 
 let structure_readModels = [
   publicRm,
-  internalRm
+  newrecord
 ];
 
-let structure_stateViewSlices = [internalRm];
+let structure_stateViewSlices = [newrecord];
 
 let structure_stateChangeSlices = [];
 
@@ -248,6 +216,8 @@ globalThis.describe("absent optional collections", () => {
   });
 });
 
+let internalRm = newrecord;
+
 export {
   publicRm,
   internalRm,
@@ -256,4 +226,4 @@ export {
   json,
   namesOf,
 }
-/* encoded Not a pure module */
+/*  Not a pure module */

package/tests/api/GraphQL_FragmentGeneratorTest.res

@@ -853,7 +853,7 @@ describe("@resolves / @resolvesMany reach the SDL", () => {
         () =>
           orderType(
             ~resolvedFields=Some(ResolvedFields.bothFields),
-            ~targetPermission=AllowGroups(["Admin"]),
+            ~targetPermission=AllowRoles([Reventless.Role.make("Admin")]),
           ),
       ),
     )->toBe(true)

package/tests/api/GraphQL_FragmentGeneratorTest.res.mjs

@@ -710,7 +710,7 @@ globalThis.describe("@resolves / @resolvesMany reach the SDL", () => {
   });
   globalThis.test("a target guarded differently from the parent is refused", () => {
     globalThis.expect(refused(() => orderType(bothFields, {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: ["Admin"]
     }))).toBe(true);
   });

package/tests/plugin/PluginStructureAccessTest.res

@@ -76,7 +76,7 @@ let viewNamed = name =>
   ->Option.flatMap(q => q.requiredAccess)
 
 describe("requiredAccess derived from the authorization rule", () => {
-  testSync("an AllowGroups command publishes its groups", () =>
+  testSync("an AllowRoles command publishes its groups", () =>
     expect(commandNamed("Restock"))->toEqual(Some(["Admin", "Ops"]))
   )
 
@@ -108,4 +108,33 @@ describe("requiredAccess derived from the authorization rule", () => {
       json->String.includes(`"requiredAccess":[]`),
     ))->toEqual((true, true, false))
   })
+
+  // The access keys are compared with a token's groups, so they are the groups
+  // the roles map to; the roles themselves travel beside them for the deploy
+  // check.
+  testSync("a renamed role publishes its group as the key and its role as the role", () => {
+    Reventless.Role.clearGroups()
+    Reventless.Role.setGroups([(Reventless.Role.make("Ops"), "shop-ops")])
+    let renamed = Plugin_Structure.make(
+      ~name="AccessPlugin",
+      ~stateChangeSlices=[module(PsGatedCommandsSlice)],
+    )
+    Reventless.Role.clearGroups()
+    let restock =
+      renamed.stateChangeSlices
+      ->Array.flatMap(w => w.commands)
+      ->Array.find(c => c.name === "Restock")
+    expect(restock->Option.map(c => (c.requiredAccess, c.requiredRoles)))->toEqual(
+      Some((Some(["Admin", "shop-ops"]), Some(["Admin", "Ops"]))),
+    )
+  })
+
+  testSync("a command that names no role publishes no roles", () =>
+    expect(
+      structure.stateChangeSlices
+      ->Array.flatMap(w => w.commands)
+      ->Array.find(c => c.name === "RequestRestock")
+      ->Option.flatMap(c => c.requiredRoles),
+    )->toEqual(None)
+  )
 })

package/tests/plugin/PluginStructureAccessTest.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
 import * as PsGatedView$ReventlessCore from "./StateView/PsGatedView.res.mjs";
 import * as PsOrdersView$ReventlessCore from "./StateView/PsOrdersView.res.mjs";
 import * as PsGatedCommands$ReventlessCore from "./StateChange/PsGatedCommands.res.mjs";
@@ -119,7 +120,7 @@ function viewNamed(name) {
 }
 
 globalThis.describe("requiredAccess derived from the authorization rule", () => {
-  globalThis.test("an AllowGroups command publishes its groups", () => {
+  globalThis.test("an AllowRoles command publishes its groups", () => {
     globalThis.expect(commandNamed("Restock")).toEqual([
       "Admin",
       "Ops"
@@ -146,6 +147,32 @@ globalThis.describe("requiredAccess derived from the authorization rule", () =>
       false
     ]);
   });
+  globalThis.test("a renamed role publishes its group as the key and its role as the role", () => {
+    Role$Reventless.clearGroups();
+    Role$Reventless.setGroups([[
+        "Ops",
+        "shop-ops"
+      ]]);
+    let renamed = Plugin_Structure$ReventlessCore.make("AccessPlugin", undefined, undefined, undefined, [PsGatedCommandsSlice], undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
+    Role$Reventless.clearGroups();
+    let restock = renamed.stateChangeSlices.flatMap(w => w.commands).find(c => c.name === "Restock");
+    globalThis.expect(Stdlib_Option.map(restock, c => [
+      c.requiredAccess,
+      c.requiredRoles
+    ])).toEqual([
+      [
+        "Admin",
+        "shop-ops"
+      ],
+      [
+        "Admin",
+        "Ops"
+      ]
+    ]);
+  });
+  globalThis.test("a command that names no role publishes no roles", () => {
+    globalThis.expect(Stdlib_Option.flatMap(structure.stateChangeSlices.flatMap(w => w.commands).find(c => c.name === "RequestRestock"), c => c.requiredRoles)).toEqual(undefined);
+  });
 });
 
 export {

package/tests/plugin/StateChange/PsGatedCommands.res

@@ -4,6 +4,14 @@
 
 @@reventless.spec("GatedCommands")
 
+// Declared here rather than in the package's `Roles.res`: the rule resolves
+// `Roles` by ordinary scoping, so a spec can name roles its package does not.
+module Roles = {
+  type t =
+    | Admin
+    | Ops
+}
+
 type state = bool
 let initialState = false
 
@@ -14,7 +22,7 @@ let evolve = (_state, _event) => true
 
 @schema
 type command =
-  | @authorize(AllowGroups(["Admin", "Ops"])) Restock({productId: string})
+  | @authorize(AllowRoles([Admin, Ops])) Restock({productId: string})
   | RequestRestock({productId: string})
 
 @schema

package/tests/plugin/StateChange/PsGatedCommands.res.mjs

@@ -3,6 +3,8 @@
 import * as Sury from "sury";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 
+let Roles = {};
+
 let consumedEventSchema = Sury.$schema(s => ({
   TAG: "StockLow",
   productId: s.m(DcbTag$Reventless.string)
@@ -46,7 +48,7 @@ function decide(_state, _command) {
 function commandAuthorization(command) {
   if (command.TAG === "Restock") {
     return {
-      TAG: "AllowGroups",
+      TAG: "AllowRoles",
       _0: [
         "Admin",
         "Ops"
@@ -76,6 +78,7 @@ let readConsistency = "EscalateOnRetry";
 export {
   name,
   Id,
+  Roles,
   initialState,
   consumedEventSchema,
   evolve,

package/tests/plugin/StateView/PsGatedView.res

@@ -1,7 +1,7 @@
 // Test fixture spec: a view whose module-level rule restricts who may read it.
 
 @@reventless.spec("GatedView")
-@@reventless.authorize(AllowGroups(["Admin"]))
+@@reventless.authorize(AllowRoles([Admin]))
 
 @schema
 type consumedEvent = OrderPlaced({orderId: string, customerName: string})

package/tests/plugin/StateView/PsGatedView.res.mjs

@@ -31,7 +31,7 @@ function project(param) {
 let config = ReadModel$Reventless.config(undefined, undefined, undefined);
 
 let authorization = {
-  TAG: "AllowGroups",
+  TAG: "AllowRoles",
   _0: ["Admin"]
 };
 

package/tests/plugin/pluginDefinitionRequiredScalars.txt

@@ -56,6 +56,7 @@
 .structure.aggregates[].commands[].references[].entity: string
 .structure.aggregates[].commands[].references[].fieldName: string
 .structure.aggregates[].commands[].requiredAccess[]: string
+.structure.aggregates[].commands[].requiredRoles[]: string
 .structure.aggregates[].commands[].schema: string
 .structure.aggregates[].consumedEventTypes[]: string
 .structure.aggregates[].errors[].name: string
@@ -91,6 +92,7 @@
 .structure.extensions[].name: string
 .structure.inboundTranslationSlices[].commandTypes[]: string
 .structure.inboundTranslationSlices[].name: string
+.structure.inboundTranslationSlices[].requiredRoles[]: string
 .structure.inboundTranslationSlices[].targetName: string
 .structure.outboundTranslationSlices[].consumedEventTypes[]: string
 # `consumedSources` is itself optional and is NEW, so no persisted payload
@@ -107,6 +109,7 @@
 .structure.readModels[].name: string
 .structure.readModels[].queryField: string
 .structure.readModels[].requiredAccess[]: string
+.structure.readModels[].requiredRoles[]: string
 .structure.readModels[].retiredValues[]: string
 .structure.readModels[].schema: string
 .structure.readModels[].searchableFields[]: string
@@ -138,6 +141,7 @@
 .structure.stateChangeSlices[].commands[].references[].entity: string
 .structure.stateChangeSlices[].commands[].references[].fieldName: string
 .structure.stateChangeSlices[].commands[].requiredAccess[]: string
+.structure.stateChangeSlices[].commands[].requiredRoles[]: string
 .structure.stateChangeSlices[].commands[].schema: string
 .structure.stateChangeSlices[].consumedEventTypes[]: string
 .structure.stateChangeSlices[].errors[].name: string
@@ -157,6 +161,7 @@
 .structure.stateViewSlices[].name: string
 .structure.stateViewSlices[].queryField: string
 .structure.stateViewSlices[].requiredAccess[]: string
+.structure.stateViewSlices[].requiredRoles[]: string
 .structure.stateViewSlices[].retiredValues[]: string
 .structure.stateViewSlices[].schema: string
 .structure.stateViewSlices[].searchableFields[]: string