@reventlessdev/reventless-core 3.0.0-alpha.285 → 3.0.0-alpha.287

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.287 (2026-10-01)
+
+**Note:** Version bump only for package @reventlessdev/reventless-core
+
+
+
+
+
+# 3.0.0-alpha.286 (2026-10-01)
+
+* feat!: roles a plugin declares, groups a platform provides ([43daace](https://github.com/ReventlessDev/reventless-core/commit/43daace6ca588afe22562d079af1e6f1da81942e))
+
+### BREAKING CHANGES
+
+* AllowGroups and AdminGroup are removed — write AllowRoles over
+the plugin's Roles.t, and use Role.admin / Platform.adminGroup(). Spec module
+types declare `type role`, and their rules are Authorization.rule<role>; a spec
+that writes its own rule declares `type role` (Reventless.Role.name for a rule
+over Authorization.permission). Role.name is a private string: make one from a
+string with Role.make.
+
+
+
 # 3.0.0-alpha.285 (2026-10-01)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.285",
+  "version": "3.0.0-alpha.287",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -29,21 +29,21 @@
     "sury": "11.0.0",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.20",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.11",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.22",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.20",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.21",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.185",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.157",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.155",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.38",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.183"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.39"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.95"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.96"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/Roles.res

@@ -0,0 +1,3 @@
+// The roles the platform's own components require. `Admin` is `Reventless.Role.admin`,
+// joined by name like any plugin's role.
+type t = Admin

package/src/Roles.res.mjs

@@ -0,0 +1,2 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+/* This output is empty. Its source's type definitions, externals and/or unused code got optimized away. */

package/src/admin/Platform_AdminGroup.res

@@ -0,0 +1,12 @@
+// The administrator group as the host shell reads it from `config.json`: the
+// group the platform gates its admin API on, from the same role-to-group
+// resolution as the server, so the two cannot disagree. Written only where the
+// deployment maps the administrator role away from its own name; the shell
+// reads an absent key as `Admin`, so a default deployment's file is unchanged.
+
+let configKey = "adminGroup"
+
+let configEntry = (): option<(string, JSON.t)> => {
+  let group = Reventless.Role.adminGroup()
+  group == (Reventless.Role.admin :> string) ? None : Some((configKey, JSON.Encode.string(group)))
+}

package/src/admin/Platform_AdminGroup.res.mjs

@@ -0,0 +1,23 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+
+let configKey = "adminGroup";
+
+function configEntry() {
+  let group = Role$Reventless.adminGroup();
+  if (group === Role$Reventless.admin) {
+    return;
+  } else {
+    return [
+      configKey,
+      group
+    ];
+  }
+}
+
+export {
+  configKey,
+  configEntry,
+}
+/* Role-Reventless Not a pure module */

package/src/admin/Platform_Admin_Structure.res

@@ -37,7 +37,8 @@ let pluginCommands: array<commandDef> = Plugin_Structure.extractCommandDefs(
   ~isAggregate=true,
   ~mutationFieldFor=variantName =>
     Api_Naming.adminField(~name=PluginSpec.name ++ "_" ++ variantName),
-  ~commandAuthorization=PluginSpec.commandAuthorization->Obj.magic,
+  ~commandAuthorization=command =>
+    PluginSpec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
   ~commandTransition=PluginSpec.commandTransition->Obj.magic,
   commandSchema,
 )
@@ -57,16 +58,19 @@ let pluginAggregate: writableDef = {
   chapter: None,
 }
 
-let pluginReadModel: queryableDef = Plugin_Structure.queryableDefFromSpec(
-  ~plugin=pluginId,
-  ~name=PluginsReadModelSpec.name,
-  ~stateSchema=PluginsReadModelSpec.stateSchema->S.castToUnknown,
-  ~authorization=PluginsReadModelSpec.authorization,
-  ~linkedWriteSide=["Plugin"],
-)
+// Functions, not values: the view's access keys are the group the platform maps
+// the administrator role to, and this module is evaluated before a root maps it.
+let pluginReadModel = (): queryableDef =>
+  Plugin_Structure.queryableDefFromSpec(
+    ~plugin=pluginId,
+    ~name=PluginsReadModelSpec.name,
+    ~stateSchema=PluginsReadModelSpec.stateSchema->S.castToUnknown,
+    ~authorization=PluginsReadModelSpec.authorization->Reventless.Authorization.named,
+    ~linkedWriteSide=["Plugin"],
+  )
 
-let structure: pluginStructure = {
-  readModels: [pluginReadModel],
+let structure = (): pluginStructure => {
+  readModels: [pluginReadModel()],
   stateViewSlices: [],
   stateChangeSlices: [],
   aggregates: [pluginAggregate],

package/src/admin/Platform_Admin_Structure.res.mjs

@@ -1,5 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Api_Naming$ReventlessCore from "../components/Api/Api_Naming.res.mjs";
 import * as PluginSpec$ReventlessCore from "../plugin/lifecycle/PluginSpec.res.mjs";
 import * as Plugin_Structure$ReventlessCore from "../plugin/component/Plugin_Structure.res.mjs";
@@ -7,7 +8,7 @@ import * as PluginsReadModelSpec$ReventlessCore from "../plugin/lifecycle/Plugin
 
 let pluginId = "Platform";
 
-let pluginCommands = Plugin_Structure$ReventlessCore.extractCommandDefs(undefined, true, undefined, variantName => Api_Naming$ReventlessCore.adminField(PluginSpec$ReventlessCore.name + "_" + variantName), PluginSpec$ReventlessCore.commandAuthorization, PluginSpec$ReventlessCore.commandTransition, undefined, PluginSpec$ReventlessCore.commandSchema);
+let pluginCommands = Plugin_Structure$ReventlessCore.extractCommandDefs(undefined, true, undefined, variantName => Api_Naming$ReventlessCore.adminField(PluginSpec$ReventlessCore.name + "_" + variantName), command => Authorization$Reventless.named(PluginSpec$ReventlessCore.commandAuthorization(command)), PluginSpec$ReventlessCore.commandTransition, undefined, PluginSpec$ReventlessCore.commandSchema);
 
 let pluginAggregate_producedEventTypes = [];
 
@@ -31,39 +32,27 @@ let pluginAggregate = {
   chapter: undefined
 };
 
-let pluginReadModel = Plugin_Structure$ReventlessCore.queryableDefFromSpec(pluginId, PluginsReadModelSpec$ReventlessCore.name, PluginsReadModelSpec$ReventlessCore.stateSchema, PluginsReadModelSpec$ReventlessCore.authorization, undefined, undefined, ["Plugin"], undefined);
-
-let structure_readModels = [pluginReadModel];
-
-let structure_stateViewSlices = [];
-
-let structure_stateChangeSlices = [];
-
-let structure_aggregates = [pluginAggregate];
-
-let structure_automationSlices = [];
-
-let structure_outboundTranslationSlices = [];
-
-let structure_inboundTranslationSlices = [];
-
-let structure_extensions = [];
+function pluginReadModel() {
+  return Plugin_Structure$ReventlessCore.queryableDefFromSpec(pluginId, PluginsReadModelSpec$ReventlessCore.name, PluginsReadModelSpec$ReventlessCore.stateSchema, Authorization$Reventless.named(PluginsReadModelSpec$ReventlessCore.authorization), undefined, undefined, ["Plugin"], undefined);
+}
 
-let structure = {
-  readModels: structure_readModels,
-  stateViewSlices: structure_stateViewSlices,
-  stateChangeSlices: structure_stateChangeSlices,
-  aggregates: structure_aggregates,
-  automationSlices: structure_automationSlices,
-  outboundTranslationSlices: structure_outboundTranslationSlices,
-  inboundTranslationSlices: structure_inboundTranslationSlices,
-  extensions: structure_extensions,
-  extensionPoints: undefined,
-  requiredStores: undefined,
-  requiredStoreDeclarations: undefined,
-  requiredCapabilities: undefined,
-  traitDeclarations: undefined
-};
+function structure() {
+  return {
+    readModels: [pluginReadModel()],
+    stateViewSlices: [],
+    stateChangeSlices: [],
+    aggregates: [pluginAggregate],
+    automationSlices: [],
+    outboundTranslationSlices: [],
+    inboundTranslationSlices: [],
+    extensions: [],
+    extensionPoints: undefined,
+    requiredStores: undefined,
+    requiredStoreDeclarations: undefined,
+    requiredCapabilities: undefined,
+    traitDeclarations: undefined
+  };
+}
 
 let internalPluginDefinition = {
   id: pluginId + "@INTERNAL",

package/src/components/AutomationSlice/AutomationSlice_Builder.res

@@ -54,7 +54,8 @@ module Make = (
       let stateSchema = AutomationSlice_Callback.todoRowSchema
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
 

package/src/components/Counter/Counter_Builder.res

@@ -29,7 +29,8 @@ module Make = (
 
       let subIdConfig = None
       let config = Reventless.ReadModel.config()
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
 
@@ -48,7 +49,8 @@ module Make = (
 
       let subIdConfig = None
       let config = Reventless.ReadModel.config()
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
     module CountsDb = QueryDb_Builder.Make(

package/src/components/Dcb/Dcb_Builder.res

@@ -534,7 +534,8 @@ module Make = (
                 ~commandSchema,
               )->Array.map(((f, _)) => f),
               ~commandSchema,
-              ~commandAuthorization=S.Spec.commandAuthorization->Obj.magic,
+              ~commandAuthorization=command =>
+                S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
             )
           }
         })
@@ -549,7 +550,8 @@ module Make = (
                 ~commandSchema,
               )->Array.map(((f, _)) => f),
               ~commandSchema,
-              ~commandAuthorization=S.Spec.commandAuthorization->Obj.magic,
+              ~commandAuthorization=command =>
+                S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
             )
           }
         })
@@ -1076,8 +1078,8 @@ module Make = (
               )
             // One SDL field per constructor, each with its own constructor's args and
             // its own per-constructor authorization rule.
-            let commandAuthorization: unknown => Reventless.Authorization.permission =
-              S.Spec.commandAuthorization->Obj.magic
+            let commandAuthorization: unknown => Reventless.Authorization.permission = command =>
+              S.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named
             let fieldPermissions = Dict.make()
             fieldSpecs->Array.forEach(((fieldName, ctor)) => {
               let hasPayload = Reventless.DcbTag.isVariantPayloadBearing(
@@ -1108,7 +1110,8 @@ module Make = (
           let fieldPermissions = Dict.make()
           switch permissionForFirstConstructor(
             ~commandSchema=ITS.Spec.commandSchema->Reventless.DcbTag.toUnknownSchema,
-            ~commandAuthorization=ITS.Spec.commandAuthorization->Obj.magic,
+            ~commandAuthorization=command =>
+              ITS.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
           ) {
           | Some(rule) => fieldPermissions->Dict.set(fieldName, rule)
           | None => ()
@@ -1142,7 +1145,7 @@ module Make = (
           returnTypeName: qn.returnTypeName,
           stateSchema: V.Spec.stateSchema->Reventless.DcbTag.toUnknownSchema,
           authorization: None,
-          permission: V.Spec.authorization,
+          permission: V.Spec.authorization->Reventless.Authorization.named,
           systemCallable: systemCallableComponents->Array.includes(V.Spec.name),
           includeIdParam: qn.includeIdParam,
           connectionSpec: true,

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -13,6 +13,7 @@ import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as DcbValidation$Reventless from "@reventlessdev/reventless-spec/src/components/DcbValidation.res.mjs";
 import * as Api_Naming$ReventlessCore from "../Api/Api_Naming.res.mjs";
@@ -291,13 +292,13 @@ function Make(DcbEventLogStorage) {
         syncSlices.forEach(S => {
           let commandSchema = S.Spec.commandSchema;
           if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
-            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, S.Spec.commandAuthorization);
+            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, command => Authorization$Reventless.named(S.Spec.commandAuthorization(command)));
           }
         });
         asyncSlices.forEach(S => {
           let commandSchema = S.Spec.commandSchema;
           if (!ApiNoApiHelpers$ReventlessCore.isNoApi(commandSchema)) {
-            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, S.Spec.commandAuthorization);
+            return registerResolver("Dcb", Api_Naming$ReventlessCore.sliceMutationFields(apiNamePrefix, S.Spec.name, commandSchema).map(param => param[0]), commandSchema, command => Authorization$Reventless.named(S.Spec.commandAuthorization(command)));
           }
         });
       }
@@ -562,7 +563,6 @@ function Make(DcbEventLogStorage) {
           return;
         }
         let sliceDef = Stdlib_Option.flatMap(pluginStructure, s => s.stateChangeSlices.find(d => d.name === S.Spec.name));
-        let commandAuthorization = S.Spec.commandAuthorization;
         let fieldPermissions = {};
         fieldSpecs.forEach(param => {
           let ctor = param[1];
@@ -570,7 +570,7 @@ function Make(DcbEventLogStorage) {
           let syntheticCmd = hasPayload ? ({
               TAG: ctor
             }) : ctor;
-          fieldPermissions[param[0]] = commandAuthorization(syntheticCmd);
+          fieldPermissions[param[0]] = Authorization$Reventless.named(S.Spec.commandAuthorization(syntheticCmd));
         });
         return {
           fieldNames: fieldSpecs.map(param => param[0]),
@@ -585,7 +585,7 @@ function Make(DcbEventLogStorage) {
       let mutationEntriesFromInboundSlices = inboundTranslationSlices.map(ITS => {
         let fieldName = Api_Naming$ReventlessCore.sliceMutationField(name, ITS.Spec.name);
         let fieldPermissions = {};
-        let rule = permissionForFirstConstructor(ITS.Spec.commandSchema, ITS.Spec.commandAuthorization);
+        let rule = permissionForFirstConstructor(ITS.Spec.commandSchema, command => Authorization$Reventless.named(ITS.Spec.commandAuthorization(command)));
         if (rule !== undefined) {
           fieldPermissions[fieldName] = rule;
         }
@@ -609,7 +609,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: V.Spec.stateSchema,
           authorization: undefined,
-          permission: V.Spec.authorization,
+          permission: Authorization$Reventless.named(V.Spec.authorization),
           systemCallable: systemCallableComponents.includes(V.Spec.name),
           includeIdParam: qn.includeIdParam,
           connectionSpec: true,

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res

@@ -35,7 +35,8 @@ module Make = (
       let stateSchema = InboundTranslationSlice_Callback.auditRowSchema
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
 

package/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Builder.res

@@ -51,7 +51,8 @@ module Make = (
       let stateSchema = OutboundTranslationSlice_Callback.todoRowSchema
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
-      let authorization: Reventless.Authorization.permission = AllowAuthenticated
+      type role = Reventless.Role.name
+      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
       let visibility: Reventless.Visibility.t = Public
     }
 

package/src/components/QueryDb/QueryDb_Builder.res

@@ -55,7 +55,7 @@ module Make = (
       ~subIdField,
       ~idResolverConfigs=Spec.config.idResolvers,
       ~idsResolverConfigs=Spec.config.idsResolvers,
-      ~authorization=Spec.authorization,
+      ~authorization=Spec.authorization->Reventless.Authorization.named,
       ~opts,
     )
 

package/src/components/QueryDb/QueryDb_Builder.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as QueryDb$ReventlessCore from "./QueryDb.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as ComponentType$ReventlessCore from "../../ComponentType.res.mjs";
 import * as QueryDb_Operations$ReventlessCore from "./QueryDb_Operations.res.mjs";
@@ -29,7 +30,7 @@ function Make(Spec) {
           deleteBatch: Operations.deleteBatch
         };
       }));
-      let resolvers = Resolvers.make(none$1, api, apiRole, storage.dataSourceName, Spec.config.indexes, subIdField, Spec.config.idResolvers, Spec.config.idsResolvers, Spec.authorization, opts);
+      let resolvers = Resolvers.make(none$1, api, apiRole, storage.dataSourceName, Spec.config.indexes, subIdField, Spec.config.idResolvers, Spec.config.idsResolvers, Authorization$Reventless.named(Spec.authorization), opts);
       let outputs_resources = storage.resources.concat(resolvers.resources);
       let outputs_resolversMaker = resolvers.resourcesMaker;
       let outputs_dataSourceName = storage.dataSourceName;
@@ -50,4 +51,4 @@ function Make(Spec) {
 export {
   Make,
 }
-/* Component-ReventlessCore Not a pure module */
+/* Authorization-Reventless Not a pure module */

package/src/components/StateViewSlice/StateViewSlice_Builder.res

@@ -33,6 +33,7 @@ module Make = (
       let stateSchema = Spec.stateSchema
       let config = Spec.config
       let subIdConfig = Spec.subIdConfig
+      type role = Spec.role
       let authorization = Spec.authorization
       let visibility = Spec.visibility
     }

package/src/plugin/api/PluginBaseFragment.res

@@ -38,7 +38,7 @@ let queryEntries: array<querySchemaEntry> = [
     // read: the entry path uses only the group, and the per-`@index` auth-table
     // pipeline params come from `indexConfig.authorization`, which is untouched.
     authorization: None,
-    permission: PluginsReadModelSpec.authorization,
+    permission: PluginsReadModelSpec.authorization->Reventless.Authorization.named,
     // No `excludeFields`: the three fields this entry used to name are declared
     // `@internal` on the spec, and `deriveObjectTypeWithNested` reads that off the
     // schema itself.

package/src/plugin/api/PluginBaseFragment.res.mjs

@@ -2,6 +2,7 @@
 
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Api_Naming$ReventlessCore from "../../components/Api/Api_Naming.res.mjs";
 import * as PluginSpec$ReventlessCore from "../lifecycle/PluginSpec.res.mjs";
 import * as ApiNoApiHelpers$ReventlessCore from "../../components/Api/ApiNoApiHelpers.res.mjs";
@@ -20,7 +21,7 @@ let queryEntries = [{
     stateSchema: PluginsReadModelSpec$ReventlessCore.stateSchema,
     specName: PluginsReadModelSpec$ReventlessCore.name,
     authorization: undefined,
-    permission: PluginsReadModelSpec$ReventlessCore.authorization,
+    permission: Authorization$Reventless.named(PluginsReadModelSpec$ReventlessCore.authorization),
     subIdField: Stdlib_Option.map(undefined, c => c.subIdField),
     indexQueries: indexQueriesOfConfig(PluginsReadModelSpec$ReventlessCore.config)
   }];

package/src/plugin/component/Plugin_Builder.res

@@ -214,7 +214,8 @@ module Make = (
                 ~kind=Aggregate,
                 ~fields=fieldNames,
                 ~commandSchema,
-                ~commandAuthorization=M.Spec.commandAuthorization->Obj.magic,
+                ~commandAuthorization=command =>
+                  M.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
               )
             )
             let aggDef =
@@ -235,7 +236,8 @@ module Make = (
                 cname,
               )
               let syntheticCmd: unknown = hasPayload ? {"TAG": cname}->Obj.magic : cname->Obj.magic
-              let rule = M.Spec.commandAuthorization(syntheticCmd->Obj.magic)
+              let rule =
+                M.Spec.commandAuthorization(syntheticCmd->Obj.magic)->Reventless.Authorization.named
               fieldPermissions->Dict.set(fieldName, rule)
             })
             [
@@ -272,7 +274,7 @@ module Make = (
           returnTypeName: qn.returnTypeName,
           stateSchema: R.Spec.stateSchema->S.castToUnknown,
           authorization: None,
-          permission: R.Spec.authorization,
+          permission: R.Spec.authorization->Reventless.Authorization.named,
           connectionSpec: true,
           ?subIdField,
           indexQueries: ?(indexes->Array.length > 0 ? Some(indexes) : None),
@@ -1149,6 +1151,8 @@ module Make = (
     ~opts=?,
   ) => {
     PluginRuntimeBuilder.registerPluginName(name)
+    // Here, outside any `Output.apply`, so a preview refuses the plugin too.
+    pluginStructure->Option.forEach(s => Reventless.RoleCoverage.check(s, ~plugin=name))
     let version = Reventless.PackageVersion.fromCaller()
     Component.make(
       ~componentType=Plugin.componentType->ComponentType.toString,

package/src/plugin/component/Plugin_Builder.res.mjs

@@ -14,7 +14,9 @@ import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as Plugin$ReventlessCore from "./Plugin.res.mjs";
 import * as StackReference$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/StackReference.res.mjs";
 import * as Adapter$ReventlessCore from "../../adapter/Adapter.res.mjs";
+import * as RoleCoverage$Reventless from "@reventlessdev/reventless-spec/src/types/RoleCoverage.res.mjs";
 import * as Aggregate$ReventlessCore from "../../components/Aggregate/Aggregate.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../../components/Component.res.mjs";
 import * as ReadModel$ReventlessCore from "../../components/ReadModel/ReadModel.res.mjs";
 import * as Api_Naming$ReventlessCore from "../../components/Api/Api_Naming.res.mjs";
@@ -124,6 +126,7 @@ function Make(Spec) {
       let systemCallableComponents = systemCallableComponentsOpt !== undefined ? systemCallableComponentsOpt : [];
       let componentRuntime = componentRuntimeOpt !== undefined ? componentRuntimeOpt : ({});
       PluginRuntimeBuilder.registerPluginName(name);
+      Stdlib_Option.forEach(pluginStructure, s => RoleCoverage$Reventless.check(s, name));
       let version = PackageVersion$Reventless.fromCaller();
       return Component$ReventlessCore.make(ComponentType$ReventlessCore.toString(Plugin$ReventlessCore.componentType), name, (extra, extra$1) => {
         let _prevPluginName = Logger$ReventlessCore.currentPluginName.contents;
@@ -173,7 +176,7 @@ function Make(Spec) {
           if (fieldNames.length === 0) {
             return [];
           }
-          Stdlib_Option.forEach(Spec.hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, M.Spec.commandAuthorization));
+          Stdlib_Option.forEach(Spec.hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, command => Authorization$Reventless.named(M.Spec.commandAuthorization(command))));
           let aggDef = Stdlib_Option.flatMap(pluginStructure, s => s.aggregates.find(d => d.name === M.Spec.name));
           let fieldPermissions = {};
           filteredConstructorNames.forEach((cname, idx) => {
@@ -182,7 +185,7 @@ function Make(Spec) {
             let syntheticCmd = hasPayload ? ({
                 TAG: cname
               }) : cname;
-            let rule = M.Spec.commandAuthorization(syntheticCmd);
+            let rule = Authorization$Reventless.named(M.Spec.commandAuthorization(syntheticCmd));
             fieldPermissions[fieldName] = rule;
           });
           return [{
@@ -205,7 +208,7 @@ function Make(Spec) {
             returnTypeName: qn.returnTypeName,
             stateSchema: R.Spec.stateSchema,
             authorization: undefined,
-            permission: R.Spec.authorization,
+            permission: Authorization$Reventless.named(R.Spec.authorization),
             connectionSpec: true,
             subIdField: subIdField,
             indexQueries: indexes.length !== 0 ? indexes : undefined,

package/src/plugin/component/Plugin_Helpers.res

@@ -1150,7 +1150,8 @@ let registerAdminAggregateMutations = (
             ~kind=Aggregate,
             ~fields=fieldNames,
             ~commandSchema,
-            ~commandAuthorization=M.Spec.commandAuthorization->Obj.magic,
+            ~commandAuthorization=command =>
+              M.Spec.commandAuthorization(command->Obj.magic)->Reventless.Authorization.named,
           )
         )
       }

package/src/plugin/component/Plugin_Helpers.res.mjs

@@ -21,6 +21,7 @@ import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
 import * as Adapter$ReventlessCore from "../../adapter/Adapter.res.mjs";
 import * as Task$ReventlessInterop from "@reventlessdev/reventless-interop/src/components/Task.res.mjs";
 import * as Aggregate$ReventlessCore from "../../components/Aggregate/Aggregate.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../../components/Component.res.mjs";
 import * as ReadModel$ReventlessCore from "../../components/ReadModel/ReadModel.res.mjs";
 import * as Api_Naming$ReventlessCore from "../../components/Api/Api_Naming.res.mjs";
@@ -540,7 +541,7 @@ function registerAdminAggregateMutations(aggregates, hooks) {
     let fieldNames = filteredConstructorNames.map(cname => Api_Naming$ReventlessCore.adminField(M.Spec.name + "_" + cname));
     aggregateMutationFieldsRegistry[M.Spec.name] = fieldNames;
     if (fieldNames.length !== 0) {
-      return Stdlib_Option.forEach(hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, M.Spec.commandAuthorization));
+      return Stdlib_Option.forEach(hooks.mutationResolverHook, registerResolver => registerResolver("Aggregate", fieldNames, commandSchema, command => Authorization$Reventless.named(M.Spec.commandAuthorization(command))));
     }
   });
 }