capsium 0.1.2 → 0.3.0

data/Rakefile

@@ -9,4 +9,11 @@ require "rubocop/rake_task"
 
 RuboCop::RakeTask.new
 
-task default: %i[spec rubocop]
+namespace :rbs do
+  desc "Validate the RBS signatures (sig/)"
+  task :validate do
+    sh "bundle exec rbs -I sig validate"
+  end
+end
+
+task default: %i[spec rubocop rbs:validate]

data/bin/console

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 require "bundler/setup"
-require "capsium"
+require File.expand_path("../lib/capsium", __dir__)
 
 # You can add fixtures and/or initialization code here to make experimenting
 # with your gem easier. You can also use a different console, if you like.

data/capsium.gemspec

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "lib/capsium/version"
+require File.expand_path("lib/capsium/version", __dir__)
 
 Gem::Specification.new do |spec|
   spec.name = "capsium"
@@ -8,14 +8,19 @@ Gem::Specification.new do |spec|
   spec.authors = ["Ribose Inc."]
   spec.email = ["open.source@ribose.com"]
 
-  spec.summary = "Capsium"
-  spec.description = "Capsium"
+  spec.summary = "Packager and reactor for Capsium packages (.cap)"
+  spec.description = "Capsium facilitates the creation, management and " \
+                     "deployment of content packages with ease. This gem " \
+                     "provides a structured way to handle content, data, " \
+                     "and metadata for various applications: it packages " \
+                     "them into .cap files and serves them over HTTP."
   spec.homepage = "https://github.com/capsiums/capsium"
   spec.license = "MIT"
 
   spec.metadata["homepage_uri"] = spec.homepage
   spec.metadata["source_code_uri"] = spec.homepage
   spec.metadata["changelog_uri"] = "https://github.com/capsiums/capsium/releases"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`
@@ -26,30 +31,18 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = ">= 2.7.0"
+  spec.required_ruby_version = ">= 3.2.0"
 
-  spec.add_dependency "cssminify"
+  spec.add_dependency "bcrypt"
   spec.add_dependency "csv"
-  spec.add_dependency "htmlcompressor"
-  spec.add_dependency "html-proofer"
-  spec.add_dependency "jekyll"
   spec.add_dependency "json"
   spec.add_dependency "json-schema"
   spec.add_dependency "listen"
+  spec.add_dependency "lutaml-model", ">= 0.8", "< 1.0"
   spec.add_dependency "marcel"
-  spec.add_dependency "rubyzip", "~> 2.3.2"
-  spec.add_dependency "scss_lint"
-  spec.add_dependency "shale"
+  spec.add_dependency "rubyzip", ">= 2.3.2", "< 4.0"
   spec.add_dependency "sqlite3"
   spec.add_dependency "thor"
-  spec.add_dependency "uglifier"
   spec.add_dependency "webrick"
   spec.add_dependency "yaml"
-
-  spec.add_development_dependency "pry"
-  spec.add_development_dependency "rack-test"
-  spec.add_development_dependency "rake", "~> 13.0"
-  spec.add_development_dependency "rspec", "~> 3.11"
-  spec.add_development_dependency "rubocop", "~> 1.58"
-  spec.add_development_dependency "rubocop-performance"
 end

data/exe/capsium

@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require "capsium/cli"
+require File.expand_path("../lib/capsium", __dir__)
 
 Capsium::Cli.start(ARGV)

data/lib/capsium/cli/convert.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Capsium
+  class Cli
+    class Convert < Thor
+      extend ThorExt::Start
+
+      desc "jekyll PACKAGE_FILE OUTPUT_DIRECTORY",
+           "Convert a Capsium package to a Jekyll site"
+
+      def jekyll(package_file, output_directory)
+        converter = Capsium::Converters::Jekyll.new(package_file,
+                                                    output_directory)
+        converter.convert
+      end
+    end
+  end
+end

data/lib/capsium/cli/formatting.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Capsium
+  class Cli < Thor
+    # Output formatting helpers for CLI subcommands.
+    module Formatting
+      private
+
+      def format_result(result)
+        line = "#{result.ok? ? 'PASS' : 'FAIL'} #{result.name}"
+        return line if result.messages.empty?
+
+        "#{line}: #{result.messages.join('; ')}"
+      end
+
+      # The resolved dependency tree (ARCHITECTURE.md section 4a): one
+      # line per dependency showing the declared GUID and range, the
+      # resolved version and the store .cap it resolved to, nested.
+      def print_dependency_tree(package, indent = "")
+        package.resolved_dependencies.each do |dep|
+          puts "#{indent}- #{dep.guid} (#{dep.range}) => #{dep.version} [#{dep.path}]"
+          print_dependency_tree(dep.package, "#{indent}  ")
+        end
+      end
+    end
+  end
+end

data/lib/capsium/cli/package.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Capsium
+  class Cli
+    class Package < Thor
+      extend ThorExt::Start
+      include Formatting
+
+      desc "info PACKAGE_PATH", "Display information about the package"
+      option :store, type: :string, desc: "Package store directory (default: CAPSIUM_STORE)"
+
+      def info(path_to_package)
+        package = Capsium::Package.new(path_to_package, store: options[:store])
+        puts "Package Path: #{package.path}"
+        puts "Routes: #{package.routes.to_hash}"
+        puts "Manifest: #{package.manifest.to_hash}"
+        print_dependency_tree(package)
+      end
+
+      desc "manifest PATH_TO_PACKAGE",
+           "Show the manifest content of the package"
+
+      def manifest(path_to_package)
+        package = Capsium::Package.new(path_to_package)
+        puts JSON.pretty_generate(package.manifest.to_hash)
+      end
+
+      desc "storage PATH_TO_PACKAGE", "Show the storage datasets of the package"
+
+      def storage(path_to_package)
+        package = Capsium::Package.new(path_to_package)
+        puts JSON.pretty_generate(package.storage.to_hash)
+      end
+
+      desc "routes PATH_TO_PACKAGE", "Show the routes of the package"
+
+      def routes(path_to_package)
+        package = Capsium::Package.new(path_to_package)
+        puts JSON.pretty_generate(package.routes.to_hash)
+      end
+
+      desc "metadata PATH_TO_PACKAGE", "Show the metadata of the package"
+
+      def metadata(path_to_package)
+        package = Capsium::Package.new(path_to_package)
+        puts JSON.pretty_generate(package.metadata.to_hash)
+      end
+
+      desc "pack PATH_TO_PACKAGE_FOLDER", "Package the files into the package"
+      option :force, type: :boolean, default: false, aliases: "-f"
+
+      def pack(path_to_package)
+        package = Capsium::Package.new(path_to_package)
+        packager = Capsium::Packager.new
+        packager.pack(package, options)
+      end
+
+      desc "unpack PACKAGE_FILE", "Unpack a .cap package into a directory"
+      option :output, type: :string, aliases: "-o", desc: "Output directory"
+
+      def unpack(path_to_package)
+        destination = options[:output] || File.basename(path_to_package, ".cap")
+        Capsium::Packager.new.unpack(path_to_package, destination)
+        puts "Package unpacked to: #{destination}"
+      end
+
+      desc "validate PACKAGE_PATH", "Validate a package directory or .cap file"
+
+      def validate(path_to_package)
+        results = Capsium::Package::Validator.new(path_to_package).run
+        results.each { |result| puts format_result(result) }
+        return if results.all?(&:ok?)
+
+        raise Thor::Error, "Package validation failed"
+      end
+
+      desc "sign PACKAGE_PATH --key KEY.pem [--cert CERT.pem]",
+           "Sign the package (RSA-SHA256) and record the signature in security.json"
+      option :key, type: :string, required: true,
+                   desc: "Path to the RSA private key PEM (min 2048 bits)"
+      option :cert, type: :string,
+                    desc: "Path to the X.509 certificate PEM (must match the key)"
+
+      def sign(path_to_package)
+        Capsium::Package::Signer.sign_package(path_to_package, options[:key], options[:cert])
+        puts "Package signed: #{path_to_package}"
+      end
+
+      desc "verify-signature PACKAGE_PATH [--cert CERT.pem]",
+           "Verify the package digital signature declared in security.json"
+      option :cert, type: :string,
+                    desc: "Path to the X.509 certificate or public key PEM " \
+                          "(defaults to the key embedded in the package)"
+
+      def verify_signature(path_to_package)
+        unless Capsium::Package::Signer.verify_package(path_to_package, options[:cert])
+          raise Thor::Error, "Signature verification failed: #{path_to_package}"
+        end
+
+        puts "Signature valid: #{path_to_package}"
+      rescue Capsium::Package::Signer::SignatureError => e
+        raise Thor::Error, e.message
+      end
+
+      desc "encrypt PACKAGE_PATH --public-key PUB.pem -o OUT.cap",
+           "Encrypt a package (AES-256-GCM, RSA-OAEP-SHA256 wrapped DEK)"
+      option :public_key, type: :string, required: true,
+                          desc: "Path to the recipient RSA public key or X.509 certificate PEM"
+      option :output, type: :string, required: true, aliases: "-o",
+                      desc: "Output path for the encrypted .cap"
+
+      def encrypt(path_to_package)
+        Capsium::Package::Cipher.new.encrypt(
+          path_to_package, options[:public_key], options[:output]
+        )
+        puts "Package encrypted: #{options[:output]}"
+      end
+
+      desc "decrypt PACKAGE_PATH --private-key PRIV.pem [-o OUT.cap]",
+           "Decrypt an encrypted package"
+      option :private_key, type: :string, required: true,
+                           desc: "Path to the recipient RSA private key PEM"
+      option :output, type: :string, aliases: "-o",
+                      desc: "Output path (default: <name>-decrypted.cap)"
+
+      def decrypt(path_to_package)
+        output = options[:output] || "#{File.basename(path_to_package, '.cap')}-decrypted.cap"
+        Capsium::Package::Cipher.new.decrypt(path_to_package, options[:private_key], output)
+        puts "Package decrypted: #{output}"
+      end
+
+      desc "test PACKAGE_PATH", "Run the package's tests/*.yaml suite (05x-testing DSL)"
+
+      def test(path_to_package)
+        package = Capsium::Package.new(path_to_package)
+        report = Capsium::Package::Testing::TestSuite.new(package).run
+        report.results.each { |result| puts format_result(result) }
+        if report.results.empty?
+          puts "No tests found (#{Capsium::Package::Testing::TestSuite::TESTS_DIR}/*.yaml)"
+        end
+        puts report.summary
+        raise Thor::Error, "Package tests failed" unless report.ok?
+      end
+    end
+  end
+end

data/lib/capsium/cli/reactor.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Capsium
+  class Cli
+    class Reactor < Thor
+      extend ThorExt::Start
+
+      desc "serve PACKAGE_PATH",
+           "Start the Capsium reactor to serve the package"
+      option :port, type: :numeric, default: Capsium::Reactor::DEFAULT_PORT
+      option :do_not_listen, type: :boolean, default: false
+      option :store, type: :string,
+                     desc: "Package store directory for dependency " \
+                           "resolution (default: CAPSIUM_STORE)"
+      option :deploy, type: :string,
+                      desc: "deploy.json with reactor-side secrets " \
+                            "(default: CAPSIUM_DEPLOY)"
+
+      def serve(path_to_package)
+        reactor = Capsium::Reactor.new(
+          package: path_to_package,
+          port: options[:port],
+          do_not_listen: options[:do_not_listen],
+          store: options[:store],
+          deploy: options[:deploy]
+        )
+        reactor.serve
+      ensure
+        reactor&.package&.cleanup
+      end
+    end
+  end
+end

data/lib/capsium/cli.rb

@@ -1,107 +1,15 @@
 # frozen_string_literal: true
 
-# lib/capsium/cli.rb
 require "thor"
-require_relative "package"
-require_relative "reactor"
-require_relative "thor_ext"
-require_relative "converters/jekyll"
 
 module Capsium
   class Cli < Thor
     extend ThorExt::Start
 
-    class Package < Thor
-      extend ThorExt::Start
-
-      desc "info PACKAGE_PATH", "Display information about the package"
-
-      def info(path_to_package)
-        package = Capsium::Package.new(path_to_package)
-        puts "Package Path: #{package.path}"
-        puts "Routes: #{package.routes.as_json}"
-        puts "Manifest: #{package.manifest.as_json}"
-      end
-
-      desc "manifest PATH_TO_PACKAGE",
-           "Show the manifest content of the package"
-
-      def manifest(path_to_package)
-        package = Capsium::Package.new(path_to_package)
-        puts JSON.pretty_generate(package.manifest.as_json)
-      end
-
-      desc "storage PATH_TO_PACKAGE", "Show the storage datasets of the package"
-
-      def storage(path_to_package)
-        package = Capsium::Package.new(path_to_package)
-        puts JSON.pretty_generate(package.storage.as_json)
-      end
-
-      desc "routes PATH_TO_PACKAGE", "Show the routes of the package"
-
-      def routes(path_to_package)
-        package = Capsium::Package.new(path_to_package)
-        puts JSON.pretty_generate(package.routes.as_json)
-      end
-
-      desc "metadata PATH_TO_PACKAGE", "Show the metadata of the package"
-
-      def metadata(path_to_package)
-        package = Capsium::Package.new(path_to_package)
-        puts JSON.pretty_generate(package.metadata.as_json)
-      end
-
-      desc "pack PATH_TO_PACKAGE_FOLDER", "Package the files into the package"
-      option :force, type: :boolean, default: false, aliases: "-f"
-
-      def pack(path_to_package)
-        package = Capsium::Package.new(path_to_package)
-        packager = Capsium::Packager.new
-        packager.pack(package, options)
-      rescue StandardError => e
-        puts e
-        puts e.inspect
-        puts e.backtrace
-      end
-    end
-
-    class Reactor < Thor
-      extend ThorExt::Start
-
-      desc "serve PACKAGE_PATH",
-           "Start the Capsium reactor to serve the package"
-      option :port, type: :numeric, default: Capsium::Reactor::DEFAULT_PORT
-      option :do_not_listen, type: :boolean, default: false
-
-      def serve(path_to_package)
-        reactor = Capsium::Reactor.new(
-          package: path_to_package,
-          port: options[:port],
-          do_not_listen: options[:do_not_listen],
-        )
-        reactor.serve
-      rescue StandardError => e
-        puts e
-        puts e.inspect
-        puts e.backtrace
-      ensure
-        reactor.package.cleanup
-      end
-    end
-
-    class Convert < Thor
-      extend ThorExt::Start
-
-      desc "jekyll PACKAGE_FILE OUTPUT_DIRECTORY",
-           "Convert a Capsium package to a Jekyll site"
-
-      def jekyll(package_file, output_directory)
-        converter = Capsium::Converters::Jekyll.new(package_file,
-                                                    output_directory)
-        converter.convert
-      end
-    end
+    autoload :Convert, "capsium/cli/convert"
+    autoload :Formatting, "capsium/cli/formatting"
+    autoload :Package, "capsium/cli/package"
+    autoload :Reactor, "capsium/cli/reactor"
 
     desc "package SUBCOMMAND ...ARGS", "Manage packages"
     subcommand "package", Capsium::Cli::Package

data/lib/capsium/converters/jekyll.rb

@@ -1,9 +1,8 @@
 # frozen_string_literal: true
 
-# lib/capsium/converters/jekyll.rb
 require "fileutils"
-require "json"
-require "capsium/package"
+require "pathname"
+require "yaml"
 
 module Capsium
   module Converters
@@ -38,7 +37,7 @@ module Capsium
           "baseurl" => "",
           "url" => "",
           "markdown" => "kramdown",
-          "theme" => "minima",
+          "theme" => "minima"
         }
         write_file("_config.yml", config.to_yaml)
       end
@@ -51,7 +50,7 @@ module Capsium
 
       def copy_content_files(package)
         package.content_files.each do |file_path|
-          relative_path = Pathname.new(file_path).relative_path_from(Pathname.new(package.instance_variable_get(:@path)))
+          relative_path = Pathname.new(file_path).relative_path_from(Pathname.new(package.path))
           output_path = File.join(@output_directory, relative_path)
           FileUtils.mkdir_p(File.dirname(output_path))
           FileUtils.cp(file_path, output_path)
@@ -63,8 +62,7 @@ module Capsium
           route.path == "/"
         end
         if root_route
-          index_path = File.join(package.instance_variable_get(:@path),
-                                 root_route.target.file)
+          index_path = File.join(package.path, root_route.resource)
           index_content = File.read(index_path)
           write_file("index.html", index_content)
         else

data/lib/capsium/converters.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Capsium
+  module Converters
+    autoload :Jekyll, "capsium/converters/jekyll"
+  end
+end

data/lib/capsium/package/authentication.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "forwardable"
+
+module Capsium
+  class Package
+    # Loads a package's authentication.json (ARCHITECTURE.md section 4b).
+    class Authentication
+      extend Forwardable
+
+      attr_reader :path, :config
+
+      def_delegators :@config, :to_json, :to_hash
+
+      def initialize(path)
+        @path = path
+        @config = File.exist?(path) ? AuthenticationConfig.from_json(File.read(path)) : nil
+      end
+
+      def present?
+        !@config.nil?
+      end
+
+      def basic_auth
+        @config&.authentication&.basic_auth
+      end
+
+      def oauth2
+        @config&.authentication&.oauth2
+      end
+
+      # Whether any authentication method is enabled.
+      def enabled?
+        !!(basic_auth&.enabled? || oauth2&.enabled?)
+      end
+    end
+  end
+end

data/lib/capsium/package/authentication_config.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "json"
+require "lutaml/model"
+
+module Capsium
+  class Package
+    # The "basicAuth" object of authentication.json (ARCHITECTURE.md
+    # section 4b): Apache-style Basic authentication verified against an
+    # htpasswd file. "passwdFile" is a package-relative path (password
+    # hashes, not plaintext secrets, so it may ship in the package);
+    # deploy.json may override it with a reactor-side file.
+    class BasicAuthConfig < Lutaml::Model::Serializable
+      attribute :enabled, :boolean, default: false
+      attribute :passwd_file, :string
+      attribute :realm, :string, default: "capsium"
+
+      json do
+        map :enabled, to: :enabled
+        map "passwdFile", to: :passwd_file
+        map :realm, to: :realm
+      end
+
+      def enabled?
+        !!enabled
+      end
+    end
+
+    # The "oauth2" object of authentication.json: an OAuth2
+    # authorization-code flow. The client secret is NEVER read from the
+    # package — it comes from deploy.json or reactor configuration.
+    class OAuth2Config < Lutaml::Model::Serializable
+      attribute :enabled, :boolean, default: false
+      attribute :provider, :string
+      attribute :client_id, :string
+      attribute :authorization_url, :string
+      attribute :token_url, :string
+      attribute :userinfo_url, :string
+      attribute :redirect_path, :string, default: "/auth/callback"
+      attribute :scopes, :string, collection: true, default: []
+
+      json do
+        map :enabled, to: :enabled
+        map :provider, to: :provider
+        map "clientId", to: :client_id
+        map "authorizationUrl", to: :authorization_url
+        map "tokenUrl", to: :token_url
+        map "userinfoUrl", to: :userinfo_url
+        map "redirectPath", to: :redirect_path
+        map :scopes, to: :scopes
+      end
+
+      def enabled?
+        !!enabled
+      end
+    end
+
+    # The "authentication" object of authentication.json.
+    class AuthenticationData < Lutaml::Model::Serializable
+      attribute :basic_auth, BasicAuthConfig
+      attribute :oauth2, OAuth2Config
+
+      json do
+        map "basicAuth", to: :basic_auth
+        map :oauth2, to: :oauth2
+      end
+    end
+
+    # Canonical authentication.json model (ARCHITECTURE.md section 4b).
+    class AuthenticationConfig < Lutaml::Model::Serializable
+      attribute :authentication, AuthenticationData
+
+      json do
+        map :authentication, to: :authentication
+      end
+    end
+  end
+end