@reventlessdev/reventless-core 3.0.0-alpha.290 → 3.0.0-alpha.292

package/src/plugin/component/Plugin_Structure.res

@@ -819,6 +819,20 @@ let syntheticCommand = (~schema: S.t<unknown>, variantName: string): 'command =>
     ? {"TAG": variantName}->Obj.magic
     : variantName->Obj.magic
 
+// Each constructor's rule, read off its stand-in.
+let constructorPermissions = (
+  ~commandSchema: S.t<unknown>,
+  ~commandAuthorization: 'command => Reventless.Authorization.permission,
+): array<Reventless.Authorization.permission> =>
+  Reventless.DcbTag.extractAllVariantNames(commandSchema)->Array.map(variantName =>
+    syntheticCommand(~schema=commandSchema, variantName)->commandAuthorization
+  )
+
+// An inbound slice's gate where no command exists yet: any constructor's rule.
+// Both the deployed gate and the local resolver apply this one.
+let inboundDoorPermission = (~commandSchema, ~commandAuthorization) =>
+  constructorPermissions(~commandSchema, ~commandAuthorization)->Reventless.Authorization.anyOf
+
 // Each mutation argument's GraphQL type onto its property, so a consumer declares
 // the variable the server expects. Mutates the freshly derived schema in place.
 let annotateArgTypes = (schema: JSON.t, argTypes: dict<string>): JSON.t => {
@@ -1815,17 +1829,16 @@ let make = (
       targetName: ITS.Spec.targetName,
       externalSystem: ITS.Spec.externalSystem,
       chapter: chapterOf(ITS.Spec.name),
-      // Per command, as the resolver evaluates the rule, then joined: the slice
-      // publishes no command defs to carry them.
+      // Every role a constructor names: the door's, plus those only the
+      // per-command check reads, which must map to a group all the same.
       requiredRoles: ?(
-        Reventless.DcbTag.extractAllVariantNames(ITS.Spec.commandSchema)
-        ->Array.flatMap(variantName =>
-          syntheticCommand(~schema=ITS.Spec.commandSchema->S.castToUnknown, variantName)
-          ->ITS.Spec.commandAuthorization
-          ->Reventless.Authorization.named
-          ->Reventless.Authorization.rolesOf
-          ->Array.map(role => (role :> string))
+        constructorPermissions(
+          ~commandSchema=ITS.Spec.commandSchema->S.castToUnknown,
+          ~commandAuthorization=cmd =>
+            ITS.Spec.commandAuthorization(cmd)->Reventless.Authorization.named,
         )
+        ->Array.flatMap(Reventless.Authorization.rolesOf)
+        ->Array.map(role => (role :> string))
         ->Set.fromArray
         ->Set.values
         ->Array.fromIterator

package/src/plugin/component/Plugin_Structure.res.mjs

@@ -644,6 +644,14 @@ function syntheticCommand(schema, variantName) {
   }
 }
 
+function constructorPermissions(commandSchema, commandAuthorization) {
+  return DcbTag$Reventless.extractAllVariantNames(commandSchema).map(variantName => commandAuthorization(syntheticCommand(commandSchema, variantName)));
+}
+
+function inboundDoorPermission(commandSchema, commandAuthorization) {
+  return Authorization$Reventless.anyOf(constructorPermissions(commandSchema, commandAuthorization));
+}
+
 function annotateArgTypes(schema, argTypes) {
   Stdlib_Option.forEach(Stdlib_Option.flatMap(Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(schema), o => o["properties"]), Stdlib_JSON.Decode.object), props => {
     Object.entries(props).forEach(param => {
@@ -1268,7 +1276,7 @@ function make(name, aggregatesOpt, readModelsOpt, stateViewSlicesOpt, stateChang
     targetName: ITS.Spec.targetName,
     externalSystem: ITS.Spec.externalSystem,
     chapter: componentChapters[ITS.Spec.name],
-    requiredRoles: nonEmpty(Array.from(new Set(DcbTag$Reventless.extractAllVariantNames(ITS.Spec.commandSchema).flatMap(variantName => Authorization$Reventless.rolesOf(Authorization$Reventless.named(ITS.Spec.commandAuthorization(syntheticCommand(ITS.Spec.commandSchema, variantName)))).map(role => role))).values()))
+    requiredRoles: nonEmpty(Array.from(new Set(constructorPermissions(ITS.Spec.commandSchema, cmd => Authorization$Reventless.named(ITS.Spec.commandAuthorization(cmd))).flatMap(Authorization$Reventless.rolesOf).map(role => role)).values()))
   }));
   let tableFailures = [];
   let tableWarnings = [];
@@ -1574,6 +1582,8 @@ export {
   nonEmpty,
   rolesFor,
   syntheticCommand,
+  constructorPermissions,
+  inboundDoorPermission,
   annotateArgTypes,
   toCommandDef,
   extractCommandDefs,

package/tests/plugin/PluginStructureAccessTest.res

@@ -138,3 +138,59 @@ describe("requiredAccess derived from the authorization rule", () => {
     )->toEqual(None)
   )
 })
+
+module PsTwoRuleFeed = {
+  let name = "PsTwoRuleFeed"
+  let moduleUrl = "ps-two-rule-feed://spec"
+  @schema type externalInput = {sku: string}
+  @schema type command = AddProduct({sku: string}) | AddCategory({sku: string})
+  let targetName = "AddProduct"
+  let externalSystem = None
+  type role = Reventless.Role.name
+  let commandAuthorization = (command: command): Reventless.Authorization.rule<role> =>
+    switch command {
+    | AddProduct(_) => AllowRoles([Reventless.Role.make("Merchandiser")])
+    | AddCategory(_) => AllowRoles([Reventless.Role.make("Admin")])
+    }
+}
+
+module PsTwoRuleFeedSlice: ReventlessInfra.InboundTranslationSlice.T = {
+  module Spec = PsTwoRuleFeed
+  module Translation = {
+    let translate = (_: PsTwoRuleFeed.externalInput) => Ok([])
+    let moduleUrl = PsTwoRuleFeed.moduleUrl
+  }
+  type component = Component.t<
+    ReventlessInfra.InboundTranslationSlice.t,
+    ReventlessInfra.InboundTranslationSlice.outputs,
+    ReventlessInfra.InboundTranslationSlice.operations,
+  >
+  let queryDbName = "PsTwoRuleFeedAudit"
+  let make = (~publishJsons as _, ~runtime as _=?, ~opts as _=?): component => Obj.magic(0)
+}
+
+describe("an inbound slice's roles", () => {
+  let door = Dcb_Builder.inboundDoorPermission(
+    PsTwoRuleFeed.commandSchema,
+    PsTwoRuleFeed.commandAuthorization,
+  )
+
+  testSync("the door admits any constructor's roles", () =>
+    expect(door->Option.map(Reventless.Authorization.rolesOf))->toEqual(
+      Some([Reventless.Role.make("Merchandiser"), Reventless.Role.make("Admin")]),
+    )
+  )
+
+  testSync("requiredRoles are the door's roles", () => {
+    let inbound =
+      Plugin_Structure.make(
+        ~name="AccessPlugin",
+        ~inboundTranslationSlices=[module(PsTwoRuleFeedSlice)],
+      ).inboundTranslationSlices->Array.get(0)
+    let doorRoles =
+      door->Option.map(
+        rule => rule->Reventless.Authorization.rolesOf->Array.map(r => (r :> string)),
+      )
+    expect(inbound->Option.flatMap(s => s.requiredRoles))->toEqual(doorRoles)
+  })
+})

package/tests/plugin/PluginStructureAccessTest.res.mjs

@@ -1,8 +1,11 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Sury from "sury";
 import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
+import * as Dcb_Builder$ReventlessCore from "../../src/components/Dcb/Dcb_Builder.res.mjs";
 import * as PsGatedView$ReventlessCore from "./StateView/PsGatedView.res.mjs";
 import * as PsOrdersView$ReventlessCore from "./StateView/PsOrdersView.res.mjs";
 import * as PsGatedCommands$ReventlessCore from "./StateChange/PsGatedCommands.res.mjs";
@@ -175,6 +178,88 @@ globalThis.describe("requiredAccess derived from the authorization rule", () =>
   });
 });
 
+let moduleUrl = "ps-two-rule-feed://spec";
+
+let externalInputSchema = Sury.$schema(s => ({
+  sku: s.m(Sury.string)
+}));
+
+let commandSchema = Sury.union([
+  Sury.$schema(s => ({
+    TAG: "AddProduct",
+    sku: s.m(Sury.string)
+  })),
+  Sury.$schema(s => ({
+    TAG: "AddCategory",
+    sku: s.m(Sury.string)
+  }))
+]);
+
+function commandAuthorization(command) {
+  if (command.TAG === "AddProduct") {
+    return {
+      TAG: "AllowRoles",
+      _0: ["Merchandiser"]
+    };
+  } else {
+    return {
+      TAG: "AllowRoles",
+      _0: ["Admin"]
+    };
+  }
+}
+
+let traits = [];
+
+let PsTwoRuleFeed = {
+  name: "PsTwoRuleFeed",
+  moduleUrl: moduleUrl,
+  externalInputSchema: externalInputSchema,
+  commandSchema: commandSchema,
+  targetName: "AddProduct",
+  externalSystem: undefined,
+  commandAuthorization: commandAuthorization,
+  traits: traits
+};
+
+function translate(param) {
+  return {
+    TAG: "Ok",
+    _0: []
+  };
+}
+
+let Translation = {
+  translate: translate,
+  moduleUrl: moduleUrl
+};
+
+function make$3(param, param$1, param$2) {
+  return 0;
+}
+
+let PsTwoRuleFeedSlice = {
+  Spec: PsTwoRuleFeed,
+  Translation: Translation,
+  queryDbName: "PsTwoRuleFeedAudit",
+  make: make$3
+};
+
+globalThis.describe("an inbound slice's roles", () => {
+  let door = Dcb_Builder$ReventlessCore.inboundDoorPermission(commandSchema, commandAuthorization);
+  globalThis.test("the door admits any constructor's roles", () => {
+    globalThis.expect(Stdlib_Option.map(door, Authorization$Reventless.rolesOf)).toEqual([
+      "Merchandiser",
+      "Admin"
+    ]);
+  });
+  globalThis.test("requiredRoles are the door's roles", () => {
+    let inbound = Plugin_Structure$ReventlessCore.make("AccessPlugin", undefined, undefined, undefined, undefined, undefined, undefined, [PsTwoRuleFeedSlice], undefined, undefined, undefined, undefined, undefined).inboundTranslationSlices[0];
+    let doorRoles = Stdlib_Option.map(door, rule => Authorization$Reventless.rolesOf(rule).map(r => r));
+    globalThis.expect(Stdlib_Option.flatMap(inbound, s => s.requiredRoles)).toEqual(doorRoles);
+  });
+});
+
 export {
   PsGatedCommandsSlice,
   PsGatedViewSlice,
@@ -182,5 +267,7 @@ export {
   structure,
   commandNamed,
   viewNamed,
+  PsTwoRuleFeed,
+  PsTwoRuleFeedSlice,
 }
 /* structure Not a pure module */