@reventlessdev/reventless-core 3.0.0-alpha.291 → 3.0.0-alpha.293

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res.mjs

@@ -55,8 +55,8 @@ function Make(QueryDbStorage) {
           let publishJsonsFn = param[1];
           let queryDbOps = param[0];
           return {
-            receive: async inputJson => {
-              let result = await Callback.receive(publishJsonsFn, inputJson);
+            receive: async (inputJson, caller) => {
+              let result = await Callback.receive(publishJsonsFn, inputJson, caller);
               await syncToQueryDb(queryDbOps, InboundTranslationSlice_Callback$ReventlessCore.requestIdOf(result));
               return result;
             }

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res

@@ -1,6 +1,6 @@
-// InboundTranslationSlice callback — receives external input and translates to commands.
-//
-// Maintains an audit log QueryDb and delegates translation to Translation.translate.
+// InboundTranslationSlice callback: parses external input, translates it into
+// commands, checks each against its own rule, and publishes them. Runtime-pure,
+// since the deployed DCB command Lambda imports it.
 
 @schema
 type auditStatus =
@@ -17,21 +17,8 @@ type auditRow = {
   receivedAt: string,
 }
 
-/**
-Map a `receive` outcome onto the `CommandResult` union the slice's mutation field
-declares, so both surfaces feed `CommandTopic.commandOutcomeToJson` rather than
-hand-rolling a second `__typename` writer.
-
-A translation can fan out across several targets; the mutation response reports
-the first target as `entityId` and the fan-out count as `eventCount`. The
-per-target detail stays queryable through the slice's audit read model. When the
-translation legitimately produced no command, `entityId` is omitted (encoding as
-`null`) rather than reporting a target that does not exist.
-
-Lives here rather than in `InboundTranslationSlice.res` because the deployed DCB
-command Lambda calls it at runtime, and the base module imports `@pulumi/pulumi`
-at deploy time — keeping this runtime-pure keeps Pulumi out of the Lambda graph.
-*/
+/** The `CommandResult` a `receive` outcome answers with: the first target as
+    `entityId` (omitted when nothing was produced), the fan-out as `eventCount`. */
 let receiveResultToOutcome = (
   result: ReventlessInfra.InboundTranslationSlice.receiveResult,
 ): CommandTopic.commandOutcome =>
@@ -41,37 +28,54 @@ let receiveResultToOutcome = (
     | Some(entityId) => Accepted({msgId: requestId, entityId, eventCount: commandCount})
     | None => Accepted({msgId: requestId, eventCount: commandCount})
     }
-  | Error({requestId, error}) =>
-    Rejected({msgId: requestId, errorCode: "TranslationFailed", errorDetail: Some(error)})
+  | Error({requestId, error, ?errorCode}) =>
+    Rejected({
+      msgId: requestId,
+      errorCode: errorCode->Option.getOr("TranslationFailed"),
+      errorDetail: Some(error),
+    })
   }
 
-/**
-The request a `receive` outcome belongs to, from either arm. Both carry the id
-that keys the outcome's audit row, so a caller draining the log does not have to
-match on the result to find its own row.
-*/
+/** The request a `receive` outcome belongs to, from either arm. */
 let requestIdOf = (result: ReventlessInfra.InboundTranslationSlice.receiveResult): string =>
   switch result {
   | Ok({requestId}) | Error({requestId}) => requestId
   }
 
-/**
-Remove one request's audit row from the in-memory log and hand it back.
-
-`auditLog` is a hand-off buffer between `receive` and whoever persists the row,
-not a log in its own right — the QueryDb it drains into is the durable one. It
-has to be emptied as it drains: the dict lives as long as the process (a warm
-Lambda container serves many requests), so a drain that walked the whole dict
-would rewrite every row the container had ever seen on every request — quadratic
-writes, unbounded retention, and, because the write is an overwrite by row id,
-resurrection of rows deleted from the table since.
-*/
+/** Remove one request's audit row from the in-memory log and hand it back. The
+    log outlives a request in a warm process, so draining all of it would rewrite
+    every row it ever held. */
 let takeAuditRow = (auditLog: Dict.t<auditRow>, requestId: string): option<auditRow> => {
   let row = auditLog->Dict.get(requestId)
   auditLog->Dict.delete(requestId)
   row
 }
 
+/** Whether `caller` may send a command under `rule`. No caller, or a system
+    (IAM) caller, is the platform acting for itself and passes every rule. */
+let callerAdmits = (rule: Reventless.Authorization.permission, caller) =>
+  switch caller {
+  | None => true
+  | Some(identity) =>
+    switch Reventless.OwnerScope.classify(identity, ~elevated=[]) {
+    | System => true
+    | _ => Reventless.Authorization.isAllowed(rule, identity)
+    }
+  }
+
+/** What an inbound mutation's resolver sends a deployed handler. `identity` is
+    built by the resolver, and is null where the transport identified nobody. */
+type doorInvocation = {
+  fieldName: string,
+  arguments: JSON.t,
+  identity: Nullable.t<Reventless.Identity.t>,
+}
+
+/** The caller a door hands on: what its transport identified, else anonymous, so
+    a door that lost the identity refuses rather than acts as the platform. */
+let doorCaller = (identity: Nullable.t<Reventless.Identity.t>): Reventless.Identity.t =>
+  identity->Nullable.toOption->Option.getOr(Reventless.Identity.anonymous)
+
 module type T = {
   module Spec: Reventless.InboundTranslationSlice.Spec
   module Translation: Reventless.InboundTranslationSlice.Translation with module Spec := Spec
@@ -83,6 +87,7 @@ module type T = {
   let receive: (
     ReventlessInfra.CommandTopic.publishJsons,
     JSON.t,
+    ~caller: Reventless.Identity.t=?,
   ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>
 }
 
@@ -97,149 +102,105 @@ module Make = (
 
   let now = () => Date.make()->Date.toISOString
 
-  // InboundTranslationSlice ingests external (non-Reventless) messages — there's
-  // no upstream Reventless meta to derive from, so emitted commands are roots
-  // of a fresh correlation chain. `traceparent` populated from an inbound HTTP
-  // header would need to be threaded in here by the API/ingress adapter.
-  // `service` names the command's TARGET, as on the API path — see the note in
-  // `AutomationSlice_Callback`. The target's events are dispatched on it.
+  // External input has no upstream meta, so each command starts a correlation
+  // chain. `service` names the command's target, on which its events dispatch.
   let makeMeta = (): Reventless.Message.meta => Message.generateMeta(~service=Spec.targetName)
 
+  let messageOf = (exn, fallback) =>
+    exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr(fallback)
+
+  // One audit row per request, whatever the outcome.
+  let failWith = (~requestId, ~inputJson, ~errorCode=?, error) => {
+    auditLog->Dict.set(
+      requestId,
+      {input: inputJson->JSON.stringify, status: Failure, error, receivedAt: now()},
+    )
+    Error({ReventlessInfra.InboundTranslationSlice.requestId, error, ?errorCode})
+  }
+
+  let succeed = (~requestId, ~inputJson, targetIds) => {
+    let commandCount = targetIds->Array.length
+    auditLog->Dict.set(
+      requestId,
+      {
+        input: inputJson->JSON.stringify,
+        status: Success,
+        targetIds,
+        commandCount,
+        receivedAt: now(),
+      },
+    )
+    Ok({ReventlessInfra.InboundTranslationSlice.requestId, targetIds, commandCount})
+  }
+
+  // Encoded with the command's schema, the one its target decodes with.
+  let encode = ((targetId, cmd): (string, Spec.command)): result<
+    Reventless.Message.commandJson,
+    string,
+  > =>
+    try Ok({
+      id: targetId,
+      meta: makeMeta(),
+      commandJson: cmd->Reventless.Util_Sury.toJson(Spec.commandSchema),
+    }) catch {
+    | exn =>
+      EffectLogger.logError(
+        ~comp=`InboundTranslationSlice(${Spec.name})`,
+        `failed to encode command: ${messageOf(exn, "unknown")}`,
+      )->Effect.runSync
+      Error("failed to encode command")
+    }
+
   let receive = async (
     publishJsons: ReventlessInfra.CommandTopic.publishJsons,
     inputJson: JSON.t,
+    ~caller: option<Reventless.Identity.t>=?,
   ): ReventlessInfra.InboundTranslationSlice.receiveResult => {
     let requestId = Uuid.v4()
-
-    // Parse the external input
-    let input = try inputJson->S.parseOrThrow(~to=Spec.externalInputSchema)->Ok catch {
-    | exn =>
-      let msg =
-        exn
-        ->JsExn.fromException
-        ->Option.flatMap(JsExn.message)
-        ->Option.getOr("invalid input")
-      Error(msg)
+    let fail = (~errorCode=?, error) => failWith(~requestId, ~inputJson, ~errorCode?, error)
+    let parsed = try Ok(inputJson->S.parseOrThrow(~to=Spec.externalInputSchema)) catch {
+    | exn => Error(messageOf(exn, "invalid input"))
     }
 
-    switch input {
-    | Error(msg) =>
-      auditLog->Dict.set(
-        requestId,
-        {
-          input: inputJson->JSON.stringify,
-          status: Failure,
-          error: msg,
-          receivedAt: now(),
-        },
-      )
-      Error({requestId, error: msg})
-
+    switch parsed {
+    | Error(msg) => fail(msg)
     | Ok(input) =>
       switch Translation.translate(input) {
+      | Error(msg) => fail(msg)
       | Ok(pairs) =>
-        if pairs->Array.length === 0 {
-          auditLog->Dict.set(
-            requestId,
-            {
-              input: inputJson->JSON.stringify,
-              status: Success,
-              targetIds: [],
-              commandCount: 0,
-              receivedAt: now(),
-            },
-          )
-          Ok({requestId, targetIds: [], commandCount: 0})
-        } else {
-          // Encode all commands; abort on first encoding failure
-          let msgs = ref([])
-          let encodeError = ref(None)
-          pairs->Array.forEach(pair => {
-            let (targetId, cmd) = pair
-            if encodeError.contents->Option.isNone {
-              try {
-                let commandJson = cmd->JSON.stringifyAny->Option.getOrThrow->JSON.parseOrThrow
-                let msg: Reventless.Message.commandJson = {
-                  id: targetId,
-                  meta: makeMeta(),
-                  commandJson,
-                }
-                msgs.contents = msgs.contents->Array.concat([msg])
-              } catch {
-              | exn =>
-                let errMsg =
-                  exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown")
-                EffectLogger.logError(
-                  ~comp=`InboundTranslationSlice(${Spec.name})`,
-                  `failed to encode command: ${errMsg}`,
-                )->Effect.runSync
-                encodeError := Some("failed to encode command")
-              }
-            }
-          })
-
-          switch encodeError.contents {
-          | Some(msg) =>
-            auditLog->Dict.set(
-              requestId,
-              {
-                input: inputJson->JSON.stringify,
-                status: Failure,
-                error: msg,
-                receivedAt: now(),
-              },
+        switch pairs->Array.reduce(Ok([]), (acc, pair) =>
+          switch (acc, encode(pair)) {
+          | (Ok(msgs), Ok(msg)) => Ok(msgs->Array.concat([msg]))
+          | (Error(_) as failed, _) => failed
+          | (_, Error(msg)) => Error(msg)
+          }
+        ) {
+        | Error(msg) => fail(msg)
+        // Each command against its own rule, read by the name it encodes to; one
+        // refused refuses the message.
+        | Ok(msgs)
+          if msgs->Array.some(({commandJson}) =>
+            !callerAdmits(
+              commandJson
+              ->Reventless.Message.variantNameOfJson
+              ->Spec.authorizationOf
+              ->Reventless.Authorization.named,
+              caller,
             )
-            Error({requestId, error: msg})
-          | None =>
-            try {
-              await publishJsons(msgs.contents)
-              let targetIds = pairs->Array.map(pair => {
-                let (targetId, _) = pair
-                targetId
-              })
-              auditLog->Dict.set(
-                requestId,
-                {
-                  input: inputJson->JSON.stringify,
-                  status: Success,
-                  targetIds,
-                  commandCount: pairs->Array.length,
-                  receivedAt: now(),
-                },
-              )
-              Ok({requestId, targetIds, commandCount: pairs->Array.length})
-            } catch {
-            | exn =>
-              let msg =
-                exn
-                ->JsExn.fromException
-                ->Option.flatMap(JsExn.message)
-                ->Option.getOr("publish failed")
-              auditLog->Dict.set(
-                requestId,
-                {
-                  input: inputJson->JSON.stringify,
-                  status: Failure,
-                  error: msg,
-                  receivedAt: now(),
-                },
-              )
-              Error({requestId, error: msg})
-            }
+          ) =>
+          fail(
+            ~errorCode="Forbidden",
+            `${Spec.name}: the caller is not authorized for every command this input translates into`,
+          )
+        | Ok([]) => succeed(~requestId, ~inputJson, [])
+        | Ok(msgs) =>
+          try {
+            await publishJsons(msgs)
+            succeed(~requestId, ~inputJson, pairs->Array.map(((targetId, _)) => targetId))
+          } catch {
+          | exn => fail(messageOf(exn, "publish failed"))
           }
         }
-
-      | Error(msg) =>
-        auditLog->Dict.set(
-          requestId,
-          {
-            input: inputJson->JSON.stringify,
-            status: Failure,
-            error: msg,
-            receivedAt: now(),
-          },
-        )
-        Error({requestId, error: msg})
       }
     }
   }

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs

@@ -3,11 +3,18 @@
 import * as Sury from "sury";
 import * as Uuid from "uuid";
 import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Message$Reventless from "@reventlessdev/reventless-spec/src/types/Message.res.mjs";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
 import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Util_Sury$Reventless from "@reventlessdev/reventless-spec/src/util/Util_Sury.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Message$ReventlessCore from "../../Message.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
 
 let auditStatusSchema = Sury.union([
@@ -49,7 +56,7 @@ function receiveResultToOutcome(result) {
   return {
     TAG: "Rejected",
     msgId: match$1.requestId,
-    errorCode: "TranslationFailed",
+    errorCode: Stdlib_Option.getOr(match$1.errorCode, "TranslationFailed"),
     errorDetail: match$1.error
   };
 }
@@ -64,158 +71,140 @@ function takeAuditRow(auditLog, requestId) {
   return row;
 }
 
+function callerAdmits(rule, caller) {
+  if (caller === undefined) {
+    return true;
+  }
+  let match = OwnerScope$Reventless.classify(caller, []);
+  if (typeof match !== "object") {
+    return true;
+  } else {
+    return Authorization$Reventless.isAllowed(rule, caller);
+  }
+}
+
+function doorCaller(identity) {
+  return Stdlib_Option.getOr((identity == null) ? undefined : Primitive_option.some(identity), Identity$Reventless.anonymous);
+}
+
 function Make(Spec) {
   return Translation => {
     let auditLog = {};
     let makeMeta = () => Message$ReventlessCore.generateMeta(Spec.targetName, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
-    let receive = async (publishJsons, inputJson) => {
-      let requestId = Uuid.v4();
-      let input;
+    let messageOf = (exn, fallback) => Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), fallback);
+    let succeed = (requestId, inputJson, targetIds) => {
+      let commandCount = targetIds.length;
+      auditLog[requestId] = {
+        input: JSON.stringify(inputJson),
+        status: "Success",
+        targetIds: targetIds,
+        commandCount: commandCount,
+        receivedAt: new Date().toISOString()
+      };
+      return {
+        TAG: "Ok",
+        _0: {
+          requestId: requestId,
+          targetIds: targetIds,
+          commandCount: commandCount
+        }
+      };
+    };
+    let encode = param => {
       try {
-        input = {
+        return {
           TAG: "Ok",
-          _0: Sury.parseOrThrow(inputJson, Spec.externalInputSchema)
+          _0: {
+            id: param[0],
+            meta: makeMeta(),
+            commandJson: Util_Sury$Reventless.toJson(param[1], Spec.commandSchema)
+          }
         };
       } catch (raw_exn) {
         let exn = Primitive_exceptions.internalToException(raw_exn);
-        let msg = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "invalid input");
-        input = {
+        Effect.runSync(EffectLogger$ReventlessCore.logError(`InboundTranslationSlice(` + Spec.name + `)`, undefined, `failed to encode command: ` + messageOf(exn, "unknown")));
+        return {
           TAG: "Error",
-          _0: msg
+          _0: "failed to encode command"
         };
       }
-      if (input.TAG === "Ok") {
-        let pairs = Translation.translate(input._0);
-        if (pairs.TAG === "Ok") {
-          let pairs$1 = pairs._0;
-          if (pairs$1.length === 0) {
-            auditLog[requestId] = {
-              input: JSON.stringify(inputJson),
-              status: "Success",
-              targetIds: [],
-              commandCount: 0,
-              receivedAt: new Date().toISOString()
-            };
-            return {
-              TAG: "Ok",
-              _0: {
-                requestId: requestId,
-                targetIds: [],
-                commandCount: 0
-              }
-            };
-          }
-          let msgs = {
-            contents: []
-          };
-          let encodeError = {
-            contents: undefined
-          };
-          pairs$1.forEach(pair => {
-            if (!Stdlib_Option.isNone(encodeError.contents)) {
-              return;
-            }
-            try {
-              let commandJson = JSON.parse(Stdlib_Option.getOrThrow(JSON.stringify(pair[1]), undefined));
-              let msg_id = pair[0];
-              let msg_meta = makeMeta();
-              let msg = {
-                id: msg_id,
-                meta: msg_meta,
-                commandJson: commandJson
-              };
-              msgs.contents = msgs.contents.concat([msg]);
-              return;
-            } catch (raw_exn) {
-              let exn = Primitive_exceptions.internalToException(raw_exn);
-              let errMsg = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), "unknown");
-              Effect.runSync(EffectLogger$ReventlessCore.logError(`InboundTranslationSlice(` + Spec.name + `)`, undefined, `failed to encode command: ` + errMsg));
-              encodeError.contents = "failed to encode command";
-              return;
-            }
-          });
-          let msg$1 = encodeError.contents;
-          if (msg$1 !== undefined) {
-            auditLog[requestId] = {
-              input: JSON.stringify(inputJson),
-              status: "Failure",
-              error: msg$1,
-              receivedAt: new Date().toISOString()
-            };
-            return {
-              TAG: "Error",
-              _0: {
-                requestId: requestId,
-                error: msg$1
-              }
-            };
-          }
-          try {
-            await publishJsons(msgs.contents);
-            let targetIds = pairs$1.map(pair => pair[0]);
-            auditLog[requestId] = {
-              input: JSON.stringify(inputJson),
-              status: "Success",
-              targetIds: targetIds,
-              commandCount: pairs$1.length,
-              receivedAt: new Date().toISOString()
-            };
-            return {
-              TAG: "Ok",
-              _0: {
-                requestId: requestId,
-                targetIds: targetIds,
-                commandCount: pairs$1.length
-              }
-            };
-          } catch (raw_exn$1) {
-            let exn$1 = Primitive_exceptions.internalToException(raw_exn$1);
-            let msg$2 = Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn$1), Stdlib_JsExn.message), "publish failed");
-            auditLog[requestId] = {
-              input: JSON.stringify(inputJson),
-              status: "Failure",
-              error: msg$2,
-              receivedAt: new Date().toISOString()
-            };
-            return {
-              TAG: "Error",
-              _0: {
-                requestId: requestId,
-                error: msg$2
-              }
-            };
-          }
-        } else {
-          let msg$3 = pairs._0;
-          auditLog[requestId] = {
-            input: JSON.stringify(inputJson),
-            status: "Failure",
-            error: msg$3,
-            receivedAt: new Date().toISOString()
-          };
-          return {
-            TAG: "Error",
-            _0: {
-              requestId: requestId,
-              error: msg$3
-            }
-          };
-        }
-      } else {
-        let msg$4 = input._0;
+    };
+    let receive = async (publishJsons, inputJson, caller) => {
+      let requestId = Uuid.v4();
+      let fail = (errorCode, error) => {
         auditLog[requestId] = {
           input: JSON.stringify(inputJson),
           status: "Failure",
-          error: msg$4,
+          error: error,
           receivedAt: new Date().toISOString()
         };
         return {
           TAG: "Error",
           _0: {
             requestId: requestId,
-            error: msg$4
+            error: error,
+            errorCode: errorCode
           }
         };
+      };
+      let parsed;
+      try {
+        parsed = {
+          TAG: "Ok",
+          _0: Sury.parseOrThrow(inputJson, Spec.externalInputSchema)
+        };
+      } catch (raw_exn) {
+        let exn = Primitive_exceptions.internalToException(raw_exn);
+        parsed = {
+          TAG: "Error",
+          _0: messageOf(exn, "invalid input")
+        };
+      }
+      if (parsed.TAG !== "Ok") {
+        return fail(undefined, parsed._0);
+      }
+      let msg = Translation.translate(parsed._0);
+      if (msg.TAG !== "Ok") {
+        return fail(undefined, msg._0);
+      }
+      let pairs = msg._0;
+      let msg$1 = Stdlib_Array.reduce(pairs, {
+        TAG: "Ok",
+        _0: []
+      }, (acc, pair) => {
+        let match = encode(pair);
+        if (acc.TAG === "Ok") {
+          if (match.TAG === "Ok") {
+            return {
+              TAG: "Ok",
+              _0: acc._0.concat([match._0])
+            };
+          } else {
+            return {
+              TAG: "Error",
+              _0: match._0
+            };
+          }
+        } else {
+          return acc;
+        }
+      });
+      if (msg$1.TAG !== "Ok") {
+        return fail(undefined, msg$1._0);
+      }
+      let msgs = msg$1._0;
+      if (msgs.some(param => !callerAdmits(Authorization$Reventless.named(Spec.authorizationOf(Message$Reventless.variantNameOfJson(param.commandJson))), caller))) {
+        return fail("Forbidden", Spec.name + `: the caller is not authorized for every command this input translates into`);
+      }
+      if (msgs.length === 0) {
+        return succeed(requestId, inputJson, []);
+      }
+      try {
+        await publishJsons(msgs);
+        return succeed(requestId, inputJson, pairs.map(param => param[0]));
+      } catch (raw_exn$1) {
+        let exn$1 = Primitive_exceptions.internalToException(raw_exn$1);
+        return fail(undefined, messageOf(exn$1, "publish failed"));
       }
     };
     return {
@@ -232,6 +221,8 @@ export {
   receiveResultToOutcome,
   requestIdOf,
   takeAuditRow,
+  callerAdmits,
+  doorCaller,
   Make,
 }
 /* auditStatusSchema Not a pure module */