@reventlessdev/reventless-spec 3.0.0-alpha.165 → 3.0.0-alpha.166

package/CHANGELOG.md

@@ -3,6 +3,19 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.166 (2026-10-16)
+
+* fix(auth)!: only operators read the framework's own stores ([a2fd202](https://github.com/ReventlessDev/reventless-core/commit/a2fd2022b6876dae855b185df7f8263353fc971d))
+
+### BREAKING CHANGES
+
+* a caller outside the elevated groups is refused the
+framework's to-do, schedule and audit stores. On AWS, a roles-gated
+view's …ByIds, …Refs, …Items and …By<Index> fields refuse callers
+outside its roles.
+
+
+
 # 3.0.0-alpha.165 (2026-10-16)
 
 * feat!(automation): schedules set by events ([53bc436](https://github.com/ReventlessDev/reventless-core/commit/53bc4363dffce81ef36475728bf0dae704716021))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-spec",
-  "version": "3.0.0-alpha.165",
+  "version": "3.0.0-alpha.166",
   "description": "Specifications for Reventless",
   "license": "Apache-2.0",
   "bin": {

package/src/types/OwnerScope.res

@@ -180,6 +180,30 @@ let elevatedGroups = (): array<string> =>
     }
   }
 
+/** The role that stands for an elevated group: the one mapped to it, else the
+    role of the same name. Refused when that role was mapped elsewhere, since no
+    role then names the group and a rule would silently admit someone else. */
+let roleForGroup = (group: string): Role.name =>
+  switch Role.renamed()->Array.find(((_, g)) => g == group) {
+  | Some((role, _)) => role
+  | None if Role.groupOf(Role.make(group)) == group => Role.make(group)
+  | None =>
+    JsError.throwWithMessage(
+      `Elevated group "${group}" has no role standing for it: role "${group}" stands for ` ++
+      `group "${Role.groupOf(Role.make(group))}". Map a role to "${group}" with roleGroups.`,
+    )
+  }
+
+/**
+The deployment's operators as a rule: the roles standing for the elevated
+groups. For what the framework keeps for itself, such as an automation's to-do
+list. An empty list admits nobody. Read when called, after the root has stated
+its operators and its role mapping.
+*/
+let operators = (): Authorization.permission => AllowRoles(
+  elevatedGroups()->Array.map(roleForGroup),
+)
+
 // Order matters: the provider is examined before `userId`, because the IAM
 // caller fails the `userId` test for a reason that has nothing to do with being
 // anonymous and must not be refused as though it did.

package/src/types/OwnerScope.res.mjs

@@ -3,6 +3,7 @@
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Role$Reventless from "./Role.res.mjs";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Identity$Reventless from "./Identity.res.mjs";
@@ -80,6 +81,24 @@ function elevatedGroups() {
   }
 }
 
+function roleForGroup(group) {
+  let match = Role$Reventless.renamed().find(param => param[1] === group);
+  if (match !== undefined) {
+    return match[0];
+  } else if (Role$Reventless.groupOf(group) === group) {
+    return group;
+  } else {
+    return Stdlib_JsError.throwWithMessage(`Elevated group "` + group + `" has no role standing for it: role "` + group + `" stands for ` + (`group "` + Role$Reventless.groupOf(group) + `". Map a role to "` + group + `" with roleGroups.`));
+  }
+}
+
+function operators() {
+  return {
+    TAG: "AllowRoles",
+    _0: elevatedGroups().map(roleForGroup)
+  };
+}
+
 function classify(identity, elevated) {
   let provider = identity.provider;
   let providerName = isJsString(provider) ? provider : undefined;
@@ -344,6 +363,8 @@ export {
   defaultElevatedRoles,
   parseElevatedGroups,
   elevatedGroups,
+  roleForGroup,
+  operators,
   classify,
   resolve,
   ownerId,