@reventlessdev/reventless-core 3.0.0-alpha.296 → 3.0.0-alpha.298

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs

@@ -7,6 +7,7 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Effect from "effect/Effect";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Message$Reventless from "@reventlessdev/reventless-spec/src/types/Message.res.mjs";
 import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
@@ -16,6 +17,9 @@ import * as OwnerScope$Reventless from "@reventlessdev/reventless-spec/src/types
 import * as Message$ReventlessCore from "../../Message.res.mjs";
 import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
 import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
+import * as ApiNoApiHelpers$ReventlessCore from "../Api/ApiNoApiHelpers.res.mjs";
+import * as InboundTranslationSlice$ReventlessInfra from "@reventlessdev/reventless-infra/src/components/InboundTranslationSlice.res.mjs";
+import * as InboundTranslationSlice_Webhook$ReventlessCore from "./InboundTranslationSlice_Webhook.res.mjs";
 
 let auditStatusSchema = Sury.union([
   Sury.literal("Success"),
@@ -28,7 +32,8 @@ let auditRowSchema = Sury.$schema(s => ({
   targetIds: s.m(Sury.$option(Sury.array(Sury.string))),
   commandCount: s.m(Sury.$option(Sury.int32)),
   error: s.m(Sury.$option(Sury.string)),
-  receivedAt: s.m(Sury.string)
+  receivedAt: s.m(Sury.string),
+  door: s.m(Sury.$option(InboundTranslationSlice$ReventlessInfra.doorSchema))
 }));
 
 function receiveResultToOutcome(result) {
@@ -87,26 +92,35 @@ function doorCaller(identity) {
   return Stdlib_Option.getOr((identity == null) ? undefined : Primitive_option.some(identity), Identity$Reventless.anonymous);
 }
 
+function exposesMutation(externalInputSchema) {
+  return !ApiNoApiHelpers$ReventlessCore.isNoApi(externalInputSchema);
+}
+
+function checkReachable(plugin, slice, mutation, webhook) {
+  if (!mutation && !webhook) {
+    return Stdlib_JsError.throwWithMessage(plugin + `: inbound translation slice ` + slice + ` has @noApi on externalInput and declares no endpoint, so nothing can reach it`);
+  }
+}
+
 function Make(Spec) {
   return Translation => {
     let auditLog = {};
     let makeMeta = () => Message$ReventlessCore.generateMeta(Spec.targetName, undefined, undefined, undefined, undefined, undefined, undefined, undefined);
     let messageOf = (exn, fallback) => Stdlib_Option.getOr(Stdlib_Option.flatMap(Stdlib_JsExn.fromException(exn), Stdlib_JsExn.message), fallback);
-    let succeed = (requestId, inputJson, targetIds) => {
-      let commandCount = targetIds.length;
+    let failWith = (requestId, input, door, errorCode, error) => {
       auditLog[requestId] = {
-        input: JSON.stringify(inputJson),
-        status: "Success",
-        targetIds: targetIds,
-        commandCount: commandCount,
-        receivedAt: new Date().toISOString()
+        input: input,
+        status: "Failure",
+        error: error,
+        receivedAt: new Date().toISOString(),
+        door: door
       };
       return {
-        TAG: "Ok",
+        TAG: "Error",
         _0: {
           requestId: requestId,
-          targetIds: targetIds,
-          commandCount: commandCount
+          error: error,
+          errorCode: errorCode
         }
       };
     };
@@ -129,21 +143,26 @@ function Make(Spec) {
         };
       }
     };
-    let receive = async (publishJsons, inputJson, caller) => {
+    let receive = async (publishJsons, inputJson, caller, doorOpt) => {
+      let door = doorOpt !== undefined ? doorOpt : "Mutation";
       let requestId = Uuid.v4();
-      let fail = (errorCode, error) => {
+      let fail = (errorCode, error) => failWith(requestId, JSON.stringify(inputJson), door, errorCode, error);
+      let succeed = extra => {
+        let commandCount = extra.length;
         auditLog[requestId] = {
           input: JSON.stringify(inputJson),
-          status: "Failure",
-          error: error,
-          receivedAt: new Date().toISOString()
+          status: "Success",
+          targetIds: extra,
+          commandCount: commandCount,
+          receivedAt: new Date().toISOString(),
+          door: door
         };
         return {
-          TAG: "Error",
+          TAG: "Ok",
           _0: {
             requestId: requestId,
-            error: error,
-            errorCode: errorCode
+            targetIds: extra,
+            commandCount: commandCount
           }
         };
       };
@@ -197,20 +216,24 @@ function Make(Spec) {
         return fail("Forbidden", Spec.name + `: the caller is not authorized for every command this input translates into`);
       }
       if (msgs.length === 0) {
-        return succeed(requestId, inputJson, []);
+        return succeed([]);
       }
       try {
         await publishJsons(msgs);
-        return succeed(requestId, inputJson, pairs.map(param => param[0]));
+        return succeed(pairs.map(param => param[0]));
       } catch (raw_exn$1) {
         let exn$1 = Primitive_exceptions.internalToException(raw_exn$1);
-        return fail(undefined, messageOf(exn$1, "publish failed"));
+        return fail("PublishFailed", messageOf(exn$1, "publish failed"));
       }
     };
+    let refuse = (body, errorCode, error) => failWith(Uuid.v4(), body, "Webhook", errorCode, error);
+    let webhook = Stdlib_Option.map(Spec.endpoint, endpoint => InboundTranslationSlice_Webhook$ReventlessCore.routeOf(Spec.name, endpoint));
     return {
       Spec: Spec,
       auditLog: auditLog,
-      receive: receive
+      receive: receive,
+      refuse: refuse,
+      webhook: webhook
     };
   };
 }
@@ -223,6 +246,8 @@ export {
   takeAuditRow,
   callerAdmits,
   doorCaller,
+  exposesMutation,
+  checkReachable,
   Make,
 }
 /* auditStatusSchema Not a pure module */

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res

@@ -0,0 +1,231 @@
+// The HTTP door of an inbound translation slice: find the slice a request's path
+// names, check its signature over the raw body, and hand the parsed body to
+// `receive` as the caller the endpoint stands for. Runtime-pure — the AWS command
+// Lambda and the local registry both serve through it.
+
+type request = {
+  method: string,
+  path: string,
+  /** Header names lower-cased. */
+  headers: dict<string>,
+  /** The body exactly as sent: a signature is over these bytes, not over a re-encoding. */
+  body: string,
+}
+
+type response = {status: int, body: string}
+
+/** An endpoint with its slice's role erased to a role name. */
+type route = {
+  slice: string,
+  path: string,
+  method: string,
+  auth: Reventless.InboundTranslationSlice.webhookAuth,
+  roles: array<Reventless.Role.name>,
+}
+
+/** A route and the slice operations that serve it. `receive` is the webhook door's. */
+type slice = {
+  route: route,
+  receive: (
+    JSON.t,
+    ~caller: Reventless.Identity.t,
+  ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>,
+  refuse: (
+    ~body: string,
+    ~errorCode: string,
+    string,
+  ) => promise<ReventlessInfra.InboundTranslationSlice.receiveResult>,
+}
+
+let normalizePath = (path: string): string =>
+  path->String.split("/")->Array.filter(segment => segment != "")->Array.join("/")
+
+let routeOf = (
+  ~slice: string,
+  endpoint: Reventless.InboundTranslationSlice.endpointConfig<'role>,
+): route => {
+  slice,
+  path: normalizePath(endpoint.path),
+  method: (endpoint.method->Option.getOr(Post) :> string),
+  auth: endpoint.auth,
+  roles: switch endpoint.role {
+  | Some(role) =>
+    Reventless.Authorization.AllowRoles([role])
+    ->Reventless.Authorization.named
+    ->Reventless.Authorization.rolesOf
+  | None => []
+  },
+}
+
+/** The environment variable a named secret is read from. */
+let secretEnvKey = (name: string): string =>
+  "REVENTLESS_WEBHOOK_SECRET_" ++ name->String.toUpperCase->String.replaceRegExp(/[^A-Z0-9]/g, "_")
+
+/** The secrets a variable holds: several, comma-separated, while one is rotated. */
+let secretsOf = (raw: string): array<string> =>
+  raw->String.split(",")->Array.map(String.trim)->Array.filter(secret => secret != "")
+
+@val external env: dict<string> = "process.env"
+
+let secretFromEnv = (name: string): option<string> => env->Dict.get(secretEnvKey(name))
+
+// Compares every character whatever the first difference, so the time taken does
+// not tell a forger how much of a guess was right.
+let sameText = (a: string, b: string): bool => {
+  let code = (text, i) => text->String.charCodeAt(i)->Option.getOr(0)
+  a->String.length == b->String.length && {
+      let diff = ref(0)
+      for i in 0 to a->String.length - 1 {
+        diff := diff.contents->Int.bitwiseOr(code(a, i)->Int.bitwiseXor(code(b, i)))
+      }
+      diff.contents == 0
+    }
+}
+
+let hmacHex = (~secret: string, text: string): string =>
+  NodeCrypto.createHmac("sha256", secret)->NodeCrypto.hmacUpdate(text)->NodeCrypto.hmacDigest("hex")
+
+/** Whether `body` carries a valid signature by one of `secrets`. */
+let verify = (
+  signature: Reventless.InboundTranslationSlice.signature,
+  ~secrets: array<string>,
+  ~headers: dict<string>,
+  ~body: string,
+  ~nowSeconds: float,
+): result<unit, string> => {
+  let header = name => headers->Dict.get(name->String.toLowerCase)
+  let given = switch (header(signature.header), signature.prefix) {
+  | (None, _) => Error(`missing ${signature.header} header`)
+  | (Some(raw), None) => Ok(raw)
+  | (Some(raw), Some(prefix)) if raw->String.startsWith(prefix) =>
+    Ok(raw->String.slice(~start=prefix->String.length))
+  | (Some(_), Some(prefix)) => Error(`${signature.header} does not start with "${prefix}"`)
+  }
+  let signed = switch signature.timestampHeader {
+  | None => Ok(body)
+  | Some(name) =>
+    switch header(name) {
+    | None => Error(`missing ${name} header`)
+    | Some(raw) =>
+      switch raw->Float.fromString {
+      | None => Error(`${name} is not a time in seconds`)
+      | Some(at)
+        if Math.abs(nowSeconds -. at) >
+        signature.toleranceSeconds->Option.getOr(300)->Int.toFloat =>
+        Error(`${name} is outside the accepted window`)
+      | Some(_) => Ok(`${raw}.${body}`)
+      }
+    }
+  }
+  switch (given, signed) {
+  | (Error(msg), _) | (_, Error(msg)) => Error(msg)
+  | (Ok(given), Ok(text)) =>
+    let given = given->String.trim->String.toLowerCase
+    secrets->Array.some(secret => sameText(hmacHex(~secret, text), given))
+      ? Ok()
+      : Error(`${signature.header} does not match the body`)
+  }
+}
+
+/** Who a request that passed `route.auth` acts as. An open URL identifies nobody. */
+let callerOf = (route: route, ~signed: bool): Reventless.Identity.t =>
+  signed
+    ? {
+        userId: `webhook:${route.slice}`,
+        username: route.slice,
+        groups: route.roles->Array.map(Reventless.Role.groupOf),
+        provider: Custom("webhook"),
+      }
+    : Reventless.Identity.anonymous
+
+let json = (fields: array<(string, JSON.t)>): string =>
+  fields->Dict.fromArray->JSON.Encode.object->JSON.stringify
+
+let plain = (status, error) => {status, body: json([("error", JSON.Encode.string(error))])}
+
+/** The status a sender acts on: 2xx done, 5xx try again, any other 4xx do not. */
+let statusOf = (result: ReventlessInfra.InboundTranslationSlice.receiveResult): int =>
+  switch result {
+  | Ok(_) => 200
+  | Error({errorCode: "Unsigned"}) => 401
+  | Error({errorCode: "InvalidBody"}) => 400
+  | Error({errorCode: "Forbidden"}) => 403
+  | Error({errorCode: "PublishFailed"}) => 503
+  | Error(_) => 422
+  }
+
+let respond = (result: ReventlessInfra.InboundTranslationSlice.receiveResult): response => {
+  status: statusOf(result),
+  body: switch result {
+  | Ok({requestId, commandCount}) =>
+    json([
+      ("requestId", JSON.Encode.string(requestId)),
+      ("commandCount", JSON.Encode.int(commandCount)),
+    ])
+  | Error({requestId, error}) =>
+    json([("requestId", JSON.Encode.string(requestId)), ("error", JSON.Encode.string(error))])
+  },
+}
+
+/** Serve one request on its slice. A secret the platform does not have is a
+    misconfiguration, answered 500 and logged, never treated as open. */
+let serve = async (
+  slice: slice,
+  ~secretOf: string => option<string>=secretFromEnv,
+  ~nowSeconds: float=Date.now() /. 1000.,
+  request: request,
+): response =>
+  if request.method->String.toUpperCase != slice.route.method {
+    plain(405, `${slice.route.path} accepts ${slice.route.method}`)
+  } else {
+    let signed = switch slice.route.auth {
+    | Open => Ok(Ok(false))
+    | SignedBody(signature) =>
+      switch secretOf(signature.secret)->Option.mapOr([], secretsOf) {
+      | [] => Error(secretEnvKey(signature.secret))
+      | secrets =>
+        Ok(
+          verify(
+            signature,
+            ~secrets,
+            ~headers=request.headers,
+            ~body=request.body,
+            ~nowSeconds,
+          )->Result.map(() => true),
+        )
+      }
+    }
+    switch signed {
+    | Error(key) =>
+      EffectLogger.logError(
+        ~comp=`InboundTranslationSlice(${slice.route.slice})`,
+        `webhook secret ${key} is not set; refusing every request`,
+      )->Effect.runSync
+      plain(500, "webhook is not configured")
+    | Ok(Error(msg)) => respond(await slice.refuse(~body=request.body, ~errorCode="Unsigned", msg))
+    | Ok(Ok(signed)) =>
+      switch try Some(JSON.parseOrThrow(request.body)) catch {
+      | _ => None
+      } {
+      | None =>
+        respond(
+          await slice.refuse(~body=request.body, ~errorCode="InvalidBody", "body is not JSON"),
+        )
+      | Some(input) => respond(await slice.receive(input, ~caller=callerOf(slice.route, ~signed)))
+      }
+    }
+  }
+
+/** Serve a request on whichever slice its path names. */
+let dispatch = async (
+  slices: array<slice>,
+  ~secretOf=?,
+  ~nowSeconds=?,
+  request: request,
+): response => {
+  let path = normalizePath(request.path)
+  switch slices->Array.find(slice => slice.route.path == path) {
+  | Some(slice) => await serve(slice, ~secretOf?, ~nowSeconds?, request)
+  | None => plain(404, `no webhook at /${path}`)
+  }
+}

package/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res.mjs

@@ -0,0 +1,294 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Float from "@rescript/runtime/lib/es6/Stdlib_Float.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Stdlib_String from "@rescript/runtime/lib/es6/Stdlib_String.js";
+import * as Effect from "effect/Effect";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Identity$Reventless from "@reventlessdev/reventless-spec/src/types/Identity.res.mjs";
+import * as Authorization$Reventless from "@reventlessdev/reventless-spec/src/types/Authorization.res.mjs";
+import * as EffectLogger$ReventlessCore from "../../util/EffectLogger.res.mjs";
+
+function normalizePath(path) {
+  return path.split("/").filter(segment => segment !== "").join("/");
+}
+
+function routeOf(slice, endpoint) {
+  let role = endpoint.role;
+  return {
+    slice: slice,
+    path: normalizePath(endpoint.path),
+    method: Stdlib_Option.getOr(endpoint.method, "POST"),
+    auth: endpoint.auth,
+    roles: role !== undefined ? Authorization$Reventless.rolesOf(Authorization$Reventless.named({
+        TAG: "AllowRoles",
+        _0: [Primitive_option.valFromOption(role)]
+      })) : []
+  };
+}
+
+function secretEnvKey(name) {
+  return "REVENTLESS_WEBHOOK_SECRET_" + name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+
+function secretsOf(raw) {
+  return raw.split(",").map(prim => prim.trim()).filter(secret => secret !== "");
+}
+
+function secretFromEnv(name) {
+  return process.env[secretEnvKey(name)];
+}
+
+function sameText(a, b) {
+  let code = (text, i) => Stdlib_Option.getOr(Stdlib_String.charCodeAt(text, i), 0);
+  if (a.length !== b.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0, i_finish = a.length; i < i_finish; ++i) {
+    diff = diff | code(a, i) ^ code(b, i);
+  }
+  return diff === 0;
+}
+
+function hmacHex(secret, text) {
+  return Nodecrypto.createHmac("sha256", secret).update(text).digest("hex");
+}
+
+function verify(signature, secrets, headers, body, nowSeconds) {
+  let match = headers[signature.header.toLowerCase()];
+  let match$1 = signature.prefix;
+  let given = match !== undefined ? (
+      match$1 !== undefined ? (
+          match.startsWith(match$1) ? ({
+              TAG: "Ok",
+              _0: match.slice(match$1.length)
+            }) : ({
+              TAG: "Error",
+              _0: signature.header + ` does not start with "` + match$1 + `"`
+            })
+        ) : ({
+          TAG: "Ok",
+          _0: match
+        })
+    ) : ({
+      TAG: "Error",
+      _0: `missing ` + signature.header + ` header`
+    });
+  let name = signature.timestampHeader;
+  let signed;
+  if (name !== undefined) {
+    let raw = headers[name.toLowerCase()];
+    if (raw !== undefined) {
+      let at = Stdlib_Float.fromString(raw);
+      signed = at !== undefined ? (
+          Math.abs(nowSeconds - at) > Stdlib_Option.getOr(signature.toleranceSeconds, 300) ? ({
+              TAG: "Error",
+              _0: name + ` is outside the accepted window`
+            }) : ({
+              TAG: "Ok",
+              _0: raw + `.` + body
+            })
+        ) : ({
+          TAG: "Error",
+          _0: name + ` is not a time in seconds`
+        });
+    } else {
+      signed = {
+        TAG: "Error",
+        _0: `missing ` + name + ` header`
+      };
+    }
+  } else {
+    signed = {
+      TAG: "Ok",
+      _0: body
+    };
+  }
+  if (given.TAG !== "Ok") {
+    return {
+      TAG: "Error",
+      _0: given._0
+    };
+  }
+  if (signed.TAG !== "Ok") {
+    return {
+      TAG: "Error",
+      _0: signed._0
+    };
+  }
+  let text = signed._0;
+  let given$1 = given._0.trim().toLowerCase();
+  if (secrets.some(secret => sameText(hmacHex(secret, text), given$1))) {
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  } else {
+    return {
+      TAG: "Error",
+      _0: signature.header + ` does not match the body`
+    };
+  }
+}
+
+function callerOf(route, signed) {
+  if (signed) {
+    return {
+      userId: `webhook:` + route.slice,
+      username: route.slice,
+      groups: route.roles.map(Role$Reventless.groupOf),
+      provider: {
+        TAG: "Custom",
+        _0: "webhook"
+      }
+    };
+  } else {
+    return Identity$Reventless.anonymous;
+  }
+}
+
+function json(fields) {
+  return JSON.stringify(Object.fromEntries(fields));
+}
+
+function plain(status, error) {
+  return {
+    status: status,
+    body: json([[
+        "error",
+        error
+      ]])
+  };
+}
+
+function statusOf(result) {
+  if (result.TAG === "Ok") {
+    return 200;
+  }
+  switch (result._0.errorCode) {
+    case "Forbidden" :
+      return 403;
+    case "InvalidBody" :
+      return 400;
+    case "PublishFailed" :
+      return 503;
+    case "Unsigned" :
+      return 401;
+    default:
+      return 422;
+  }
+}
+
+function respond(result) {
+  let tmp;
+  if (result.TAG === "Ok") {
+    let match = result._0;
+    tmp = json([
+      [
+        "requestId",
+        match.requestId
+      ],
+      [
+        "commandCount",
+        match.commandCount
+      ]
+    ]);
+  } else {
+    let match$1 = result._0;
+    tmp = json([
+      [
+        "requestId",
+        match$1.requestId
+      ],
+      [
+        "error",
+        match$1.error
+      ]
+    ]);
+  }
+  return {
+    status: statusOf(result),
+    body: tmp
+  };
+}
+
+async function serve(slice, secretOfOpt, nowSecondsOpt, request) {
+  let secretOf = secretOfOpt !== undefined ? secretOfOpt : secretFromEnv;
+  let nowSeconds = nowSecondsOpt !== undefined ? nowSecondsOpt : Date.now() / 1000;
+  if (request.method.toUpperCase() !== slice.route.method) {
+    return plain(405, slice.route.path + ` accepts ` + slice.route.method);
+  }
+  let signature = slice.route.auth;
+  let signed;
+  if (typeof signature !== "object") {
+    signed = {
+      TAG: "Ok",
+      _0: {
+        TAG: "Ok",
+        _0: false
+      }
+    };
+  } else {
+    let signature$1 = signature._0;
+    let secrets = Stdlib_Option.mapOr(secretOf(signature$1.secret), [], secretsOf);
+    signed = secrets.length !== 0 ? ({
+        TAG: "Ok",
+        _0: Stdlib_Result.map(verify(signature$1, secrets, request.headers, request.body, nowSeconds), () => true)
+      }) : ({
+        TAG: "Error",
+        _0: secretEnvKey(signature$1.secret)
+      });
+  }
+  if (signed.TAG === "Ok") {
+    let msg = signed._0;
+    if (msg.TAG !== "Ok") {
+      return respond(await slice.refuse(request.body, "Unsigned", msg._0));
+    }
+    let input;
+    try {
+      input = JSON.parse(request.body);
+    } catch (exn) {
+      input = undefined;
+    }
+    if (input !== undefined) {
+      return respond(await slice.receive(input, callerOf(slice.route, msg._0)));
+    } else {
+      return respond(await slice.refuse(request.body, "InvalidBody", "body is not JSON"));
+    }
+  }
+  Effect.runSync(EffectLogger$ReventlessCore.logError(`InboundTranslationSlice(` + slice.route.slice + `)`, undefined, `webhook secret ` + signed._0 + ` is not set; refusing every request`));
+  return plain(500, "webhook is not configured");
+}
+
+async function dispatch(slices, secretOf, nowSeconds, request) {
+  let path = normalizePath(request.path);
+  let slice = slices.find(slice => slice.route.path === path);
+  if (slice !== undefined) {
+    return await serve(slice, secretOf, nowSeconds, request);
+  } else {
+    return plain(404, `no webhook at /` + path);
+  }
+}
+
+export {
+  normalizePath,
+  routeOf,
+  secretEnvKey,
+  secretsOf,
+  secretFromEnv,
+  sameText,
+  hmacHex,
+  verify,
+  callerOf,
+  json,
+  plain,
+  statusOf,
+  respond,
+  serve,
+  dispatch,
+}
+/* node:crypto Not a pure module */

package/src/components/OutboundTranslationSlice/OutboundTranslationSlice_Builder.res

@@ -52,7 +52,7 @@ module Make = (
       let config = Reventless.ReadModel.config()
       let subIdConfig: option<Reventless.ReadModel.subIdConfig<state>> = None
       type role = Reventless.Role.name
-      let authorization: Reventless.Authorization.rule<role> = AllowAuthenticated
+      let authorization: Reventless.Authorization.rule<role> = Reventless.OwnerScope.operators()
       let visibility: Reventless.Visibility.t = Public
     }