CallPermits

The commands each service may call on the internal port's call routes, by service name: wow.callers.<service>.commands, command names or patterns.

• A system command, one in the framework's namespace (wow.*: the lifecycle's delete, restore, owner and space transfers and tags, the snapshot rebuild, the schedules and the jobs), is refused unless an entry that names the system namespace (wow.) matches it, such as wow.lifecycle.DeleteAggregate or wow.lifecycle.*: a wildcard alone (*, shop.cart.*) never opens one.

• A domain command is allowed when the service's entries name no domain command; otherwise only those they match: the list then narrows the service to an allowlist.

An entry matches a command by its name (AddItem, wow.lifecycle.DeleteAggregate) or by its name qualified with its context and aggregate (shop.cart.AddItem); * stands for any characters. A service is the one the request names (Wow-Service, DeclaredServices); the lists catch a misconfiguration, not an attacker. A service without entries calls the domain commands alone.

The models each service may read on the internal port's read routes (reads, wow.callers.<service>.reads): by context.aggregate.model (ordering.order.snapshot, ordering.order.events, and ordering.order.state for the state reads) or a dataset's context.dataset, * standing for any characters. A service without entries reads every model the node serves; with entries, only those they match.