@reventlessdev/reventless-spec 3.0.0-alpha.154 → 3.0.0-alpha.156

package/src/types/OwnerScope.res

@@ -67,8 +67,10 @@ elevation would let two views disagree about who an operator is, so a caller
 scoped on one view would be unscoped on the next — and the gap would appear one
 view at a time, as views were added.
 
-Resolved as: an explicit `setElevatedGroups` wins, else the environment, else
-empty. The env fallback exists because a deployment is **two kinds of process**,
+Resolved as: an explicit `setElevatedGroups` / `setElevatedRoles` (joined) wins,
+else the environment, else empty. Roles are resolved to groups here, so the
+environment carries groups and a runtime never needs the role mapping to read it.
+The env fallback exists because a deployment is **two kinds of process**,
 not one. On a cloud provider the read predicate for a table-backed view is baked
 into resolver source by the deploy program, while stamping and the SQL-backed
 reads run later inside separate function runtimes the deploy never enters. A
@@ -86,13 +88,39 @@ external _elevatedGroupsEnv: option<string> = "process.env.REVENTLESS_ELEVATED_G
 
 let explicitElevatedGroups: ref<option<array<string>>> = ref(None)
 
+/** The elevated list stated as roles, kept unresolved so a role mapping stated
+    after it still applies. */
+let explicitElevatedRoles: ref<option<array<Role.name>>> = ref(None)
+
 /** Set the list for this process. Wins over the environment — a platform root
     that states its operator groups in code means it, and should not be silently
     overridden by a stray variable. */
 let setElevatedGroups = (groups: array<string>) => explicitElevatedGroups := Some(groups)
 
+/** The same setting stated as roles, each resolved to the group that stands for
+    it. Joined with `setElevatedGroups` where a root states both. */
+let setElevatedRoles = (roles: array<Role.name>) => explicitElevatedRoles := Some(roles)
+
 /** Forget an explicit setting and fall back to the environment again. */
-let clearElevatedGroups = () => explicitElevatedGroups := None
+let clearElevatedGroups = () => {
+  explicitElevatedGroups := None
+  explicitElevatedRoles := None
+}
+
+/** The explicit settings joined, or `None` when neither was given. */
+let explicitElevated = (): option<array<string>> =>
+  switch (explicitElevatedGroups.contents, explicitElevatedRoles.contents) {
+  | (None, None) => None
+  | (groups, roles) =>
+    Some(
+      groups
+      ->Option.getOr([])
+      ->Array.concat(roles->Option.getOr([])->Array.map(Role.groupOf))
+      ->Set.fromArray
+      ->Set.values
+      ->Array.fromIterator,
+    )
+  }
 
 /**
 Name the elevated groups only where the deployment has not already answered.
@@ -111,16 +139,23 @@ environment: the more specific statement wins, and the default only fills silenc
 🚨 **An explicit empty list is an answer, and this must not fill it in.** A
 deployment that deliberately elevates nobody has decided that; a default landing
 on top would silently re-grant the cross-owner read it withheld. That is why this
-reads [explicitElevatedGroups] rather than [elevatedGroups] — the latter answers
+reads [explicitElevated] rather than [elevatedGroups] — the latter answers
 `[]` for "nobody" and for "nothing said" alike, and those must not be treated the
 same here.
 */
 let defaultElevatedGroups = (groups: array<string>) =>
-  switch (explicitElevatedGroups.contents, _elevatedGroupsEnv) {
+  switch (explicitElevated(), _elevatedGroupsEnv) {
   | (None, None) => explicitElevatedGroups := Some(groups)
   | _ => ()
   }
 
+/** `defaultElevatedGroups` stated as roles, resolved when read. */
+let defaultElevatedRoles = (roles: array<Role.name>) =>
+  switch (explicitElevated(), _elevatedGroupsEnv) {
+  | (None, None) => explicitElevatedRoles := Some(roles)
+  | _ => ()
+  }
+
 let parseElevatedGroups = (raw: string): array<string> =>
   raw
   ->String.split(",")
@@ -136,7 +171,7 @@ appearing later in a process still takes effect. Reading a raw ref would have
 frozen whichever half happened to be consulted first.
 */
 let elevatedGroups = (): array<string> =>
-  switch explicitElevatedGroups.contents {
+  switch explicitElevated() {
   | Some(groups) => groups
   | None =>
     switch _elevatedGroupsEnv {
@@ -207,6 +242,78 @@ let isExempt = (scope: t): bool =>
   | Owned(_) | Unidentified(_) => false
   }
 
+/**
+The classification as it travels on a command's envelope.
+
+`System` and `Elevated` collapse into `Exempt` here, unlike in `t`: the handler
+that reads the claim only asks whether the caller may act for anyone, and the
+audit distinction is already on the envelope as `meta.user`.
+*/
+let toClaim = (scope: t): Message.CallerClaim.t =>
+  switch scope {
+  | Owned({userId}) => Owned({userId: userId})
+  | System | Elevated(_) => Exempt
+  | Unidentified(_) => Unidentified
+  }
+
+/**
+Whether a command may act on a partition whose history records an owner.
+
+`ConflictingOwners` comes first and holds for every caller: two owners in one
+partition is a data defect, and picking either would be guessing whose thing it
+is. `CallerUnidentified` holds even on an empty history — a creating command
+from nobody has no owner to stamp.
+*/
+type acting =
+  | MayAct
+  | NotTheOwner({owner: string})
+  | CallerUnidentified
+  | ConflictingOwners(array<string>)
+  | OwnerUnreadable
+
+/**
+Apply the rule to a command's claim and the distinct owners its partition records.
+
+`recordedOwners: None` says the handler could not name the partition the command
+acts on, so it could not read who owns it. That refuses an owned caller rather
+than reading as "no owner yet", which would let anyone act.
+
+A missing claim is the platform acting for itself: the generator writes one on
+every command it issues, so a command without one reached the handler by an
+internal route — the same routes `@authorize` already trusts.
+*/
+let decideActing = (
+  ~claim: option<Message.CallerClaim.t>,
+  ~recordedOwners: option<array<string>>,
+): acting =>
+  switch (recordedOwners, claim) {
+  | (Some(owners), _) if owners->Array.length > 1 => ConflictingOwners(owners)
+  | (_, None | Some(Exempt)) => MayAct
+  | (_, Some(Unidentified)) => CallerUnidentified
+  | (None, Some(Owned(_))) => OwnerUnreadable
+  | (Some(owners), Some(Owned({userId}))) =>
+    switch owners[0] {
+    | Some(owner) if owner != userId => NotTheOwner({owner: owner})
+    | Some(_) | None => MayAct
+    }
+  }
+
+/**
+Add the owners one recorded event names to the ones already folded.
+
+`fields` are that event type's `@owner` fields (`Owner.fieldNamesByVariant`).
+Distinct, so a partition whose every event repeats the same owner folds to one.
+*/
+let recordOwners = (owners: array<string>, ~fields: array<string>, data: dict<JSON.t>): array<
+  string,
+> =>
+  fields->Array.reduce(owners, (acc, field) =>
+    switch data->Dict.get(field)->Option.flatMap(JSON.Decode.string) {
+    | Some(owner) if !(acc->Array.includes(owner)) => acc->Array.concat([owner])
+    | _ => acc
+    }
+  )
+
 /**
 What owner scoping does to one read of one view.
 

package/src/types/OwnerScope.res.mjs

@@ -1,7 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Role$Reventless from "./Role.res.mjs";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Identity$Reventless from "./Identity.res.mjs";
 
@@ -13,16 +15,34 @@ let explicitElevatedGroups = {
   contents: undefined
 };
 
+let explicitElevatedRoles = {
+  contents: undefined
+};
+
 function setElevatedGroups(groups) {
   explicitElevatedGroups.contents = groups;
 }
 
+function setElevatedRoles(roles) {
+  explicitElevatedRoles.contents = roles;
+}
+
 function clearElevatedGroups() {
   explicitElevatedGroups.contents = undefined;
+  explicitElevatedRoles.contents = undefined;
 }
 
-function defaultElevatedGroups(groups) {
+function explicitElevated() {
   let match = explicitElevatedGroups.contents;
+  let match$1 = explicitElevatedRoles.contents;
+  if (match === undefined && match$1 === undefined) {
+    return;
+  }
+  return Array.from(new Set(Stdlib_Option.getOr(match, []).concat(Stdlib_Option.getOr(match$1, []).map(Role$Reventless.groupOf))).values());
+}
+
+function defaultElevatedGroups(groups) {
+  let match = explicitElevated();
   let match$1 = process.env.REVENTLESS_ELEVATED_GROUPS;
   if (match !== undefined || match$1 !== undefined) {
     return;
@@ -32,12 +52,23 @@ function defaultElevatedGroups(groups) {
   }
 }
 
+function defaultElevatedRoles(roles) {
+  let match = explicitElevated();
+  let match$1 = process.env.REVENTLESS_ELEVATED_GROUPS;
+  if (match !== undefined || match$1 !== undefined) {
+    return;
+  } else {
+    explicitElevatedRoles.contents = roles;
+    return;
+  }
+}
+
 function parseElevatedGroups(raw) {
   return raw.split(",").map(prim => prim.trim()).filter(part => part.length > 0);
 }
 
 function elevatedGroups() {
-  let groups = explicitElevatedGroups.contents;
+  let groups = explicitElevated();
   if (groups !== undefined) {
     return groups;
   }
@@ -133,6 +164,75 @@ function isExempt(scope) {
   }
 }
 
+function toClaim(scope) {
+  if (typeof scope !== "object") {
+    return "Exempt";
+  }
+  switch (scope.TAG) {
+    case "Elevated" :
+      return "Exempt";
+    case "Owned" :
+      return {
+        TAG: "Owned",
+        userId: scope.userId
+      };
+    case "Unidentified" :
+      return "Unidentified";
+  }
+}
+
+function decideActing(claim, recordedOwners) {
+  if (recordedOwners !== undefined) {
+    if (recordedOwners.length > 1) {
+      return {
+        TAG: "ConflictingOwners",
+        _0: recordedOwners
+      };
+    }
+    if (claim !== undefined) {
+      if (typeof claim !== "object") {
+        claim === "Exempt";
+      } else {
+        let owner = recordedOwners[0];
+        if (owner !== undefined && owner !== claim.userId) {
+          return {
+            TAG: "NotTheOwner",
+            owner: owner
+          };
+        } else {
+          return "MayAct";
+        }
+      }
+    }
+  } else if (claim !== undefined) {
+    if (typeof claim === "object") {
+      return "OwnerUnreadable";
+    }
+    claim === "Exempt";
+  }
+  if (claim === undefined) {
+    return "MayAct";
+  }
+  if (typeof claim !== "object") {
+    if (claim === "Exempt") {
+      return "MayAct";
+    } else {
+      return "CallerUnidentified";
+    }
+  }
+}
+
+function recordOwners(owners, fields, data) {
+  return Stdlib_Array.reduce(fields, owners, (acc, field) => {
+    let owner = Stdlib_Option.flatMap(data[field], Stdlib_JSON.Decode.string);
+    if (owner !== undefined && !acc.includes(owner)) {
+      return acc.concat([owner]);
+    } else {
+      return acc;
+    }
+  });
+}
+
 function decide(identity, ownerField, elevatedOpt) {
   let elevated = elevatedOpt !== undefined ? elevatedOpt : elevatedGroups();
   if (ownerField === undefined) {
@@ -235,19 +335,26 @@ export {
   isJsString,
   systemProviders,
   explicitElevatedGroups,
+  explicitElevatedRoles,
   setElevatedGroups,
+  setElevatedRoles,
   clearElevatedGroups,
+  explicitElevated,
   defaultElevatedGroups,
+  defaultElevatedRoles,
   parseElevatedGroups,
   elevatedGroups,
   classify,
   resolve,
   ownerId,
   isExempt,
+  toClaim,
+  decideActing,
+  recordOwners,
   decide,
   scopeOf,
   decideRetired,
   retiredScopeOf,
   isRetiredValue,
 }
-/* Identity-Reventless Not a pure module */
+/* Role-Reventless Not a pure module */

package/src/types/Role.res

@@ -0,0 +1,143 @@
+/***
+A role is a job someone does — `Merchandiser`, `Fulfilment`, `Admin` — and is what
+a command or a view requires. A group is how an identity provider records that a
+person has one: the `groups` of a token, of a user pool, of `users.yaml`.
+
+Plugins speak of roles. Each declares the ones it uses as a payload-less variant in
+its own `src/Roles.res`, and the PPX turns `AllowRoles([Merchandiser])` into these
+names. Roles are joined by name, so two plugins that both declare `Fulfilment` mean
+the same role.
+
+The platform says which group stands for which role, only where they differ; every
+other role maps to the group of the same name. This module holds that mapping for
+the process, so enforcement, the published access keys and the deploy check all
+read one answer.
+*/
+
+/** A role's name before mapping. A string at run time, so it crosses every
+    boundary a group does, but private: a plugin's role comes from its own
+    `Roles.t` (the PPX checks the case, then calls `make`), and any other string
+    has to pass through `make` where a reader can see it is unchecked. */
+type name = private string
+
+external make: string => name = "%identity"
+external fromStringSchema: S.t<string> => S.t<name> = "%identity"
+
+let nameSchema: S.t<name> = fromStringSchema(S.string)
+
+/** The framework's administrator: members administer a deployment. */
+let admin: name = make("Admin")
+
+/**
+The renamed roles, resolved as an explicit `setGroups`, else the environment,
+else none.
+
+The environment exists for the same reason as `REVENTLESS_ELEVATED_GROUPS`: a
+deployment is two kinds of process, and a function runtime that evaluates a rule
+(the SQL-backed view reads) never runs the platform root that stated the mapping.
+`REVENTLESS_ROLE_GROUPS` carries only the renamed roles, as
+`Merchandiser=shop-merch-team,Fulfilment=shop-ops`.
+*/
+@val
+external _roleGroupsEnv: option<string> = "process.env.REVENTLESS_ROLE_GROUPS"
+
+let envKey = "REVENTLESS_ROLE_GROUPS"
+
+let explicitGroups: ref<option<array<(name, string)>>> = ref(None)
+
+/** Set once a platform has rendered something from the mapping — an AWS admin
+    API's directive is written while the platform is built. A mapping stated
+    after that would leave the two disagreeing. */
+let frozen = ref(false)
+
+let freeze = () => frozen := true
+
+/** State which group stands for which role, where the two differ. Wins over the
+    environment, like every other explicit platform setting. Refused once frozen,
+    rather than applying to half the deployment. */
+let setGroups = (pairs: array<(name, string)>) =>
+  if frozen.contents {
+    JsError.throwWithMessage(
+      "Role mapping stated after the platform was built — call roleGroups before Platform.Make().",
+    )
+  } else {
+    explicitGroups := Some(pairs)
+  }
+
+let clearGroups = () => {
+  explicitGroups := None
+  frozen := false
+}
+
+let parseGroups = (raw: string): array<(name, string)> =>
+  raw
+  ->String.split(",")
+  ->Array.filterMap(part =>
+    switch part->String.split("=")->Array.map(String.trim) {
+    | [role, group] if role != "" && group != "" => Some((make(role), group))
+    | _ => None
+    }
+  )
+
+/** The renamed roles in force, as `(role, group)`. */
+let renamed = (): array<(name, string)> =>
+  switch explicitGroups.contents {
+  | Some(pairs) => pairs
+  | None => _roleGroupsEnv->Option.mapOr([], parseGroups)
+  }
+
+/** The mapping as `REVENTLESS_ROLE_GROUPS` writes it, or `None` when no role is
+    renamed — absent rather than empty, as for the elevated groups. */
+let envValue = (): option<string> =>
+  switch renamed() {
+  | [] => None
+  | pairs =>
+    Some(pairs->Array.map(((role, group)) => `${(role :> string)}=${group}`)->Array.join(","))
+  }
+
+/** The group that stands for `role`. */
+let groupOf = (role: name): string =>
+  switch renamed()->Array.find(((r, _)) => r == role) {
+  | Some((_, group)) => group
+  | None => (role :> string)
+  }
+
+/** The group that stands for the administrator. Written into the admin API's
+    directives, the elevated default and the shell's configuration. */
+let adminGroup = (): string => groupOf(admin)
+
+/**
+Where the groups this deployment provides come from: the administrator group and
+accounts manifest a platform finds for itself, and the groups of a user pool it
+did not create, which the platform root declares.
+
+Sources rather than values, read when the check runs: a platform states them
+while its functor is applied, before the root has said how its roles map. Empty
+until a platform or a root says anything, which is how a check knows whether it
+has an answer to compare against.
+*/
+let groupSources: ref<array<unit => array<string>>> = ref([])
+
+let provideGroupsFrom = (source: unit => array<string>) =>
+  groupSources := groupSources.contents->Array.concat([source])
+
+let provideGroups = (groups: array<string>) => provideGroupsFrom(() => groups)
+
+let clearProvidedGroups = () => groupSources := []
+
+/** The groups a deployment provides: every source plus every group the mapping
+    names. `None` when nothing was provided — a process that is not a platform (a
+    unit test, a function runtime) has no answer to give. */
+let providedGroups = (): option<array<string>> =>
+  switch groupSources.contents {
+  | [] => None
+  | sources =>
+    Some(
+      sources
+      ->Array.flatMap(source => source())
+      ->Array.concat(renamed()->Array.map(((_, group)) => group))
+      ->Set.fromArray
+      ->Set.values
+      ->Array.fromIterator,
+    )
+  }

package/src/types/Role.res.mjs

@@ -0,0 +1,129 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Sury from "sury";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+
+let nameSchema = Sury.string;
+
+let admin = "Admin";
+
+let explicitGroups = {
+  contents: undefined
+};
+
+let frozen = {
+  contents: false
+};
+
+function freeze() {
+  frozen.contents = true;
+}
+
+function setGroups(pairs) {
+  if (frozen.contents) {
+    return Stdlib_JsError.throwWithMessage("Role mapping stated after the platform was built — call roleGroups before Platform.Make().");
+  } else {
+    explicitGroups.contents = pairs;
+    return;
+  }
+}
+
+function clearGroups() {
+  explicitGroups.contents = undefined;
+  frozen.contents = false;
+}
+
+function parseGroups(raw) {
+  return Stdlib_Array.filterMap(raw.split(","), part => {
+    let match = part.split("=").map(prim => prim.trim());
+    if (match.length !== 2) {
+      return;
+    }
+    let role = match[0];
+    let group = match[1];
+    if (role !== "" && group !== "") {
+      return [
+        role,
+        group
+      ];
+    }
+  });
+}
+
+function renamed() {
+  let pairs = explicitGroups.contents;
+  if (pairs !== undefined) {
+    return pairs;
+  } else {
+    return Stdlib_Option.mapOr(process.env.REVENTLESS_ROLE_GROUPS, [], parseGroups);
+  }
+}
+
+function envValue() {
+  let pairs = renamed();
+  if (pairs.length !== 0) {
+    return pairs.map(param => param[0] + `=` + param[1]).join(",");
+  }
+}
+
+function groupOf(role) {
+  let match = renamed().find(param => param[0] === role);
+  if (match !== undefined) {
+    return match[1];
+  } else {
+    return role;
+  }
+}
+
+function adminGroup() {
+  return groupOf(admin);
+}
+
+let groupSources = {
+  contents: []
+};
+
+function provideGroupsFrom(source) {
+  groupSources.contents = groupSources.contents.concat([source]);
+}
+
+function provideGroups(groups) {
+  provideGroupsFrom(() => groups);
+}
+
+function clearProvidedGroups() {
+  groupSources.contents = [];
+}
+
+function providedGroups() {
+  let sources = groupSources.contents;
+  if (sources.length !== 0) {
+    return Array.from(new Set(sources.flatMap(source => source()).concat(renamed().map(param => param[1]))).values());
+  }
+}
+
+let envKey = "REVENTLESS_ROLE_GROUPS";
+
+export {
+  nameSchema,
+  admin,
+  envKey,
+  explicitGroups,
+  frozen,
+  freeze,
+  setGroups,
+  clearGroups,
+  parseGroups,
+  renamed,
+  envValue,
+  groupOf,
+  adminGroup,
+  groupSources,
+  provideGroupsFrom,
+  provideGroups,
+  clearProvidedGroups,
+  providedGroups,
+}
+/* nameSchema Not a pure module */

package/src/types/RoleCoverage.res

@@ -0,0 +1,84 @@
+/***
+Whether a platform can provide every role a plugin needs.
+
+A rule naming a role no group stands for refuses everybody it was written for, and
+nothing says so until someone is refused on a deployed stack. So every role a
+component's rule names, and every elevated role, must map to a group the platform
+provides: the administrator group it declares, the groups of its accounts
+manifest, the groups the role mapping names, and any a root declares for a user
+pool it did not create.
+*/
+
+type need = {
+  plugin: string,
+  /** The component and, for a command, the command: `Product.AddProduct`. */
+  item: string,
+  role: Role.name,
+  group: string,
+}
+
+let needsOf = (structure: Plugin.pluginStructure, ~plugin: string): array<need> => {
+  let need = (item, role) => {plugin, item, role, group: Role.groupOf(role)}
+  let rolesOf = (item, roles: option<array<string>>) =>
+    roles->Option.getOr([])->Array.map(role => need(item, Role.make(role)))
+  let writable = (defs: array<Plugin.writableDef>) =>
+    defs->Array.flatMap(w =>
+      w.commands->Array.flatMap(c => rolesOf(`${w.name}.${c.name}`, c.requiredRoles))
+    )
+  let queryable = (defs: array<Plugin.queryableDef>) =>
+    defs->Array.flatMap(q => rolesOf(q.name, q.requiredRoles))
+  Array.flat([
+    writable(structure.aggregates),
+    writable(structure.stateChangeSlices),
+    structure.inboundTranslationSlices->Array.flatMap(s => rolesOf(s.name, s.requiredRoles)),
+    queryable(structure.readModels),
+    queryable(structure.stateViewSlices),
+  ])
+}
+
+/** The elevated roles as needs of the platform itself. */
+let elevatedNeeds = (roles: array<Role.name>): array<need> =>
+  roles->Array.map(role => {
+    plugin: "platform",
+    item: "elevated roles",
+    role,
+    group: Role.groupOf(role),
+  })
+
+let unmet = (needs: array<need>, ~provided: array<string>): array<need> =>
+  needs->Array.filter(n => !(provided->Array.includes(n.group)))
+
+let describe = (n: need): string => {
+  let role = (n.role :> string)
+  n.group == role
+    ? `${n.plugin}: ${n.item} needs the role ${role}`
+    : `${n.plugin}: ${n.item} needs the role ${role} (mapped to the group ${n.group})`
+}
+
+let unmetMessage = (missing: array<need>, ~provided: array<string>): string =>
+  `Roles this platform cannot provide — every caller would be refused:\n` ++
+  missing->Array.map(n => `  ${describe(n)}`)->Array.join("\n") ++
+  `\n  The platform provides the groups: ${provided->Array.join(", ")}.\n` ++
+  `  Add an account in that group to the accounts manifest (.reventless/users.yaml), ` ++
+  `map the role to a group that exists (Platform.roleGroups), or declare the groups ` ++ `of a user pool this deployment did not create (Platform.providedGroups).`
+
+/**
+Refuse a plugin needing a role nobody provides, and a deployment electing a role
+nobody provides. A no-op in a process where no platform stated what it provides
+(`Role.providedGroups()` is `None`), which is a unit test or a function runtime
+rather than a deployment.
+
+The elevated roles are checked with every plugin rather than once by the platform
+because a plugin's own stack builds no platform, and a check that runs in only one
+of the two programs is skipped in the other.
+*/
+let check = (structure: Plugin.pluginStructure, ~plugin: string): unit =>
+  switch Role.providedGroups() {
+  | None => ()
+  | Some(provided) =>
+    let elevated = OwnerScope.explicitElevatedRoles.contents->Option.getOr([])
+    switch unmet(needsOf(structure, ~plugin)->Array.concat(elevatedNeeds(elevated)), ~provided) {
+    | [] => ()
+    | missing => JsError.throwWithMessage(unmetMessage(missing, ~provided))
+    }
+  }