CoSecActions

The CoSec actions and resources of Wow's commands and service routes, one name whether CoSec decides the HTTP request or an authorizer decides the command in the process:

• a command is the action <context>:<command>, the command's name as the Manifest lists it (eshop-ordering:CreateOrder, shop:wow.lifecycle.DeleteAggregate), on the resource <aggregate>/<id> (order/o-1). The snapshot rebuild of an aggregate type is on snapshot/<aggregate>, and a job command on schedule/<job>;

• a service route is the action <context>:<route> on the resource route/<route>.

routes gives the HTTP side: CoSec's route map (cosec-routes.json) of the command and service routes of a Manifest. A route that names no aggregate id (a creation, a mounted or @Unaddressed command) is on <aggregate> alone, the id being the server's to choose: a policy for such a command names the aggregate type both with and without an id. So is the route of a command whose body names its aggregate (@AggregateId), whose action the authorizer then decides on <aggregate>/<id>, the id its body names. The query and state routes are not mapped: CoSec reads them as http:<METHOD> on their path. Nor are an internal command's (@InternalCommand): the public port does not serve them, so CoSec reads a request to one as it reads any unknown path, and its answer says nothing of the command.