@reventlessdev/reventless-infra 3.0.0-alpha.188 → 3.0.0-alpha.190

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.190 (2026-10-10)
+
+* feat!: a command's rule is looked up by its name, without a cast ([5f02c40](https://github.com/ReventlessDev/reventless-core/commit/5f02c4081d077bf4a6951d8c9b2b16553a8ca87b))
+
+### BREAKING CHANGES
+
+* a spec that writes `commandAuthorization` by hand writes
+`authorizationOf = (name: string) => …` instead; the PPX refuses the old name.
+
+
+
+# 3.0.0-alpha.189 (2026-10-10)
+
+### Bug Fixes
+
+* an inbound translation is gated alike on every door, and encodes its commands by schema ([6ec3ce6](https://github.com/ReventlessDev/reventless-core/commit/6ec3ce672e53e2c162c64a90d103be691391be5e))
+
+
 # 3.0.0-alpha.188 (2026-10-08)
 
 **Note:** Version bump only for package @reventlessdev/reventless-infra

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-infra",
-  "version": "3.0.0-alpha.188",
+  "version": "3.0.0-alpha.190",
   "description": "Infrastructure types for Reventless framework",
   "license": "Apache-2.0",
   "jest": {
@@ -17,9 +17,9 @@
     "sury-ppx": "11.0.0",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.34",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.160",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.23",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1"
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.1",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.162"
   },
   "devDependencies": {
     "rescript": "12.3.1",

package/src/components/Api.res

@@ -93,11 +93,11 @@ type mutationSchemaEntry = {
   fieldNames: array<string>,
   commandSchema: S.t<unknown>,
   authorization?: Reventless.ReadModel.authorization,
-  /** Spec-level per-field authorization derived from `Spec.commandAuthorization`,
+  /** Spec-level per-field authorization derived from `Spec.authorizationOf`,
       keyed by mutation field name. Used by AWS to inject
       `@aws_cognito_user_pools(cognito_groups: ...)` per field (Stage E2 in
       `docs/plans/done/host-ui-login-core.md`). In-memory enforcement still happens
-      at the resolver layer via the same `commandAuthorization` function. */
+      at the resolver layer via the same `authorizationOf` function. */
   fieldPermissions?: dict<Reventless.Authorization.permission>,
   /** Opt a mutation field into deploy-time IAM (SigV4) invocation in addition to
       its Cognito authorization. When `true`, the AWS provider emits the

package/src/components/InboundTranslationSlice.res

@@ -24,15 +24,17 @@ type acceptedResult = {
 }
 
 /**
-A translation that was rejected -- by input parsing, by `translate`, by command
-encoding or by the publish itself.
+A translation that was rejected -- by input parsing, by `translate`, by an
+authorization check, by command encoding or by the publish itself.
 
 - `requestId` -- the key the audit row is stored under
 - `error` -- the rejection message
+- `errorCode` -- `"Forbidden"` for a refused caller; absent for a failed translation
 */
 type rejectedResult = {
   requestId: string,
   error: string,
+  errorCode?: string,
 }
 
 /**
@@ -45,10 +47,11 @@ type receiveResult = result<acceptedResult, rejectedResult>
 /**
 Runtime operations exposed by an `InboundTranslationSlice` component.
 
-- `receive` -- accept external input, translate it, and publish a command
+- `receive` -- accept external input, translate it, and publish its commands.
+  `caller` is who sent it; absent means the platform itself.
 */
 type operations = {
-  receive: JSON.t => promise<receiveResult>,
+  receive: (JSON.t, ~caller: Reventless.Identity.t=?) => promise<receiveResult>,
 }
 
 /**

package/src/types/ExtensionMapping.res

@@ -146,7 +146,7 @@ module NoDelegate = {
   let commandSchema = S.unit
   let moduleUrl: string = %raw(`import.meta.url`)
   type role = Reventless.Role.name
-  let commandAuthorization = (_: command): Reventless.Authorization.rule<role> => AllowAuthenticated
+  let authorizationOf = (_: string): Reventless.Authorization.rule<role> => AllowAuthenticated
   type lifecycleState = unit
   let commandTransition = (_: command): Reventless.Transition.t<lifecycleState> => Unrestricted
   let traits: array<Reventless.Trait.t> = []

package/src/types/ExtensionMapping.res.mjs

@@ -30,7 +30,7 @@ let commandSchema = Sury.$unit;
 
 let moduleUrl = import.meta.url;
 
-function commandAuthorization() {
+function authorizationOf(param) {
   return "AllowAuthenticated";
 }
 
@@ -47,7 +47,7 @@ let NoDelegate = {
   errorSchema: errorSchema,
   commandSchema: commandSchema,
   moduleUrl: moduleUrl,
-  commandAuthorization: commandAuthorization,
+  authorizationOf: authorizationOf,
   commandTransition: commandTransition,
   traits: traits
 };