@reventlessdev/reventless-core 3.0.0-alpha.296 → 3.0.0-alpha.297

package/CHANGELOG.md

@@ -3,6 +3,19 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.297 (2026-10-16)
+
+* fix(auth)!: only operators read the framework's own stores ([a2fd202](https://github.com/ReventlessDev/reventless-core/commit/a2fd2022b6876dae855b185df7f8263353fc971d))
+
+### BREAKING CHANGES
+
+* a caller outside the elevated groups is refused the
+framework's to-do, schedule and audit stores. On AWS, a roles-gated
+view's …ByIds, …Refs, …Items and …By<Index> fields refuse callers
+outside its roles.
+
+
+
 # 3.0.0-alpha.296 (2026-10-16)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-core",
-  "version": "3.0.0-alpha.296",
+  "version": "3.0.0-alpha.297",
   "description": "Core package for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -28,22 +28,22 @@
   "dependencies": {
     "sury": "11.0.0",
     "uuid": "^13.0.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
     "@reventlessdev/rescript-effect": "1.0.0-alpha.0",
+    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
     "@reventlessdev/rescript-fast-csv": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.12",
     "@reventlessdev/rescript-node": "2.0.0-alpha.22",
-    "@reventlessdev/rescript-hash-object": "1.2.0-alpha.15",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
     "@reventlessdev/rescript-ssh2": "2.0.0-alpha.23",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.40",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.165",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.193"
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.194",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.166"
   },
   "devDependencies": {
     "rescript": "12.3.1",
     "sury-ppx": "11.0.0",
-    "@reventlessdev/reventless-ppx": "1.0.0-alpha.101"
+    "@reventlessdev/reventless-ppx": "1.0.0-alpha.102"
   },
   "peerDependencies": {
     "rescript": "^12.3.1"

package/src/components/Api/GraphQL_FragmentGenerator.res

@@ -777,6 +777,21 @@ let mutationArgTypes = (~fieldName: string, variantSchema: S.t<unknown>): option
     out
   })
 
+/** Every query field `generate` emits for an entry, under the same conditions.
+    A platform gating an entry gates each of them: a door left out is open. */
+let queryFieldNamesOf = (entry: querySchemaEntry): array<string> => {
+  let byIds = entry.includeIdParam->Option.getOr(true) && entry.subIdField === None
+  let indexFields =
+    entry.indexQueries
+    ->Option.getOr([])
+    ->Array.filter(ic => !Reventless.ReadModel.isDerivedIndex(ic))
+    ->Array.map(ic => indexQueryFieldName(~singleFieldName=entry.singleFieldName, ~index=ic.index))
+  [entry.singleFieldName, entry.listFieldName]
+  ->Array.concat(byIds ? [entry.listFieldName ++ "ByIds", entry.listFieldName ++ "Refs"] : [])
+  ->Array.concat(entry.subIdField->Option.isSome ? [entry.singleFieldName ++ "Items"] : [])
+  ->Array.concat(indexFields)
+}
+
 // ── Main generate function ─────────────────────────────────────────────────
 
 let generate = (

package/src/components/Api/GraphQL_FragmentGenerator.res.mjs

@@ -529,6 +529,18 @@ function mutationArgTypes(fieldName, variantSchema) {
   });
 }
 
+function queryFieldNamesOf(entry) {
+  let byIds = Stdlib_Option.getOr(entry.includeIdParam, true) && entry.subIdField === undefined;
+  let indexFields = Stdlib_Option.getOr(entry.indexQueries, []).filter(ic => !ReadModel$Reventless.isDerivedIndex(ic)).map(ic => indexQueryFieldName(entry.singleFieldName, ic.index));
+  return [
+    entry.singleFieldName,
+    entry.listFieldName
+  ].concat(byIds ? [
+      entry.listFieldName + "ByIds",
+      entry.listFieldName + "Refs"
+    ] : []).concat(Stdlib_Option.isSome(entry.subIdField) ? [entry.singleFieldName + "Items"] : []).concat(indexFields);
+}
+
 function generate(mutationEntries, queryEntries) {
   let types = [];
   let mutations = [];
@@ -729,6 +741,7 @@ export {
   deriveIndexQueryField,
   deriveMutationFieldFromObject,
   mutationArgTypes,
+  queryFieldNamesOf,
   generate,
 }
 /* log Not a pure module */

package/src/components/AutomationSlice/AutomationSlice_Builder.res

@@ -63,7 +63,7 @@ module Make = (
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
       type role = Reventless.Role.name
-      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
+      let authorization: Reventless.Authorization.rule<role> = Reventless.OwnerScope.operators()
       let visibility: Reventless.Visibility.t = Public
     }
 
@@ -81,7 +81,7 @@ module Make = (
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
       type role = Reventless.Role.name
-      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
+      let authorization: Reventless.Authorization.rule<role> = Reventless.OwnerScope.operators()
       let visibility: Reventless.Visibility.t = Public
     }
     module SchedulesQueryDb = QueryDb_Builder.Make(

package/src/components/AutomationSlice/AutomationSlice_Builder.res.mjs

@@ -15,6 +15,7 @@ import * as Clock$Reventless from "@reventlessdev/reventless-spec/src/components
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as EventTopic$ReventlessCore from "../EventTopic/EventTopic.res.mjs";
 import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
@@ -36,6 +37,7 @@ function Make(RuntimeEnvironment) {
       let readsClock = mappedSources.includes(Clock$Reventless.name);
       let moduleUrl = import.meta.url;
       let config = ReadModel$Reventless.config(undefined, undefined, undefined);
+      let authorization = OwnerScope$Reventless.operators();
       let SpecificQueryDb = QueryDb_Builder$ReventlessCore.Make({
         Id: Id$Reventless.$$String,
         name: queryDbName,
@@ -43,13 +45,14 @@ function Make(RuntimeEnvironment) {
         stateSchema: AutomationSlice_Callback$ReventlessCore.todoRowSchema,
         config: config,
         subIdConfig: undefined,
-        authorization: "AllowAuthenticated",
+        authorization: authorization,
         visibility: "Public"
       })(QueryDbStorage)(QueryDbResolvers);
       let schedulesStoreName = Spec.name + "Schedule";
       let schedulesDbName = readsClock ? schedulesStoreName : undefined;
       let moduleUrl$1 = import.meta.url;
       let config$1 = ReadModel$Reventless.config(undefined, undefined, undefined);
+      let authorization$1 = OwnerScope$Reventless.operators();
       let SchedulesQueryDb = QueryDb_Builder$ReventlessCore.Make({
         Id: Id$Reventless.$$String,
         name: schedulesStoreName,
@@ -57,7 +60,7 @@ function Make(RuntimeEnvironment) {
         stateSchema: AutomationSlice_Schedules$ReventlessCore.rowSchema,
         config: config$1,
         subIdConfig: undefined,
-        authorization: "AllowAuthenticated",
+        authorization: authorization$1,
         visibility: "Public"
       })(QueryDbStorage)(QueryDbResolvers);
       let syncSchedules = async (ops, stored) => {

package/src/components/Dcb/Dcb_Builder.res

@@ -1138,6 +1138,9 @@ module Make = (
         }
       })
 
+      // What the framework keeps for a slice is read by the deployment's operators.
+      let operators = Reventless.OwnerScope.operators()
+
       let automationEntries = automationSlices->Array.map((module(A: AutomationSlice.T)) => {
         let qn = Api_Naming.queryFieldNamesForSliceQueryDb(~plugin=name, ~queryDbName=A.queryDbName)
         {
@@ -1148,6 +1151,7 @@ module Make = (
             A.Spec.todoItemSchema,
           )->S.castToUnknown,
           authorization: None,
+          permission: operators,
           connectionSpec: true,
         }
       })
@@ -1162,6 +1166,7 @@ module Make = (
             returnTypeName: qn.returnTypeName,
             stateSchema: AutomationSlice_Schedules.rowSchema->S.castToUnknown,
             authorization: None,
+            permission: operators,
             connectionSpec: true,
           }
         })
@@ -1181,6 +1186,7 @@ module Make = (
               O.Spec.outboundItemSchema,
             )->S.castToUnknown,
             authorization: None,
+            permission: operators,
             connectionSpec: true,
           }
         })
@@ -1197,6 +1203,7 @@ module Make = (
             returnTypeName: qn.returnTypeName,
             stateSchema: InboundTranslationSlice_Callback.auditRowSchema->S.castToUnknown,
             authorization: None,
+            permission: operators,
             connectionSpec: true,
           }
         })

package/src/components/Dcb/Dcb_Builder.res.mjs

@@ -13,6 +13,7 @@ import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
 import * as Logger$ReventlessCore from "../../util/Logger.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as DcbValidation$Reventless from "@reventlessdev/reventless-spec/src/components/DcbValidation.res.mjs";
@@ -612,6 +613,7 @@ function Make(DcbEventLogStorage) {
           resolvedFields: resolvedFields
         };
       });
+      let operators = OwnerScope$Reventless.operators();
       let automationEntries = automationSlices.map(A => {
         let qn = Api_Naming$ReventlessCore.queryFieldNamesForSliceQueryDb(name, A.queryDbName, undefined);
         return {
@@ -620,6 +622,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: AutomationSlice_Callback$ReventlessCore.todoRowSchemaFor(A.Spec.todoItemSchema),
           authorization: undefined,
+          permission: operators,
           connectionSpec: true
         };
       });
@@ -631,6 +634,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: AutomationSlice_Schedules$ReventlessCore.rowSchema,
           authorization: undefined,
+          permission: operators,
           connectionSpec: true
         };
       }));
@@ -642,6 +646,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchemaFor(O.Spec.outboundItemSchema),
           authorization: undefined,
+          permission: operators,
           connectionSpec: true
         };
       });
@@ -653,6 +658,7 @@ function Make(DcbEventLogStorage) {
           returnTypeName: qn.returnTypeName,
           stateSchema: InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema,
           authorization: undefined,
+          permission: operators,
           connectionSpec: true
         };
       });

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res

@@ -36,7 +36,7 @@ module Make = (
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
       type role = Reventless.Role.name
-      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
+      let authorization: Reventless.Authorization.rule<role> = Reventless.OwnerScope.operators()
       let visibility: Reventless.Visibility.t = Public
     }
 

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Builder.res.mjs

@@ -3,6 +3,7 @@
 import * as Id$Reventless from "@reventlessdev/reventless-spec/src/types/Id.res.mjs";
 import * as Pulumi from "@pulumi/pulumi";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as ComponentType$ReventlessCore from "../../ComponentType.res.mjs";
 import * as QueryDb_Builder$ReventlessCore from "../QueryDb/QueryDb_Builder.res.mjs";
@@ -16,6 +17,7 @@ function Make(QueryDbStorage) {
       let queryDbName = Spec.name + "Audit";
       let moduleUrl = import.meta.url;
       let config = ReadModel$Reventless.config(undefined, undefined, undefined);
+      let authorization = OwnerScope$Reventless.operators();
       let SpecificQueryDb = QueryDb_Builder$ReventlessCore.Make({
         Id: Id$Reventless.$$String,
         name: queryDbName,
@@ -23,7 +25,7 @@ function Make(QueryDbStorage) {
         stateSchema: InboundTranslationSlice_Callback$ReventlessCore.auditRowSchema,
         config: config,
         subIdConfig: undefined,
-        authorization: "AllowAuthenticated",
+        authorization: authorization,
         visibility: "Public"
       })(QueryDbStorage)(QueryDbResolvers);
       let syncToQueryDb = async (queryDbOps, requestId) => {

package/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Builder.res

@@ -52,7 +52,7 @@ module Make = (
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
       type role = Reventless.Role.name
-      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
+      let authorization: Reventless.Authorization.rule<role> = Reventless.OwnerScope.operators()
       let visibility: Reventless.Visibility.t = Public
     }
 

package/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Builder.res.mjs

@@ -17,6 +17,7 @@ import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js
 import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
 import * as DcbDecode$Reventless from "@reventlessdev/reventless-spec/src/components/DcbDecode.res.mjs";
 import * as ReadModel$Reventless from "@reventlessdev/reventless-spec/src/components/ReadModel.res.mjs";
+import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types/OwnerScope.res.mjs";
 import * as Message$ReventlessCore from "../../Message.res.mjs";
 import * as Component$ReventlessCore from "../Component.res.mjs";
 import * as EventTopic$ReventlessCore from "../EventTopic/EventTopic.res.mjs";
@@ -35,6 +36,7 @@ function Make(RuntimeEnvironment) {
       let queryDbName = Spec.name + "Todo";
       let moduleUrl = import.meta.url;
       let config = ReadModel$Reventless.config(undefined, undefined, undefined);
+      let authorization = OwnerScope$Reventless.operators();
       let SpecificQueryDb = QueryDb_Builder$ReventlessCore.Make({
         Id: Id$Reventless.$$String,
         name: queryDbName,
@@ -42,7 +44,7 @@ function Make(RuntimeEnvironment) {
         stateSchema: OutboundTranslationSlice_Callback$ReventlessCore.todoRowSchema,
         config: config,
         subIdConfig: undefined,
-        authorization: "AllowAuthenticated",
+        authorization: authorization,
         visibility: "Public"
       })(QueryDbStorage)(QueryDbResolvers);
       let SpecificEventCollector = EventCollector_Builder$ReventlessCore.Make(RuntimeEnvironment)(EventCollectorChannel);