capsium 0.2.0 → 0.3.0

data/sig/capsium/reactor/authenticator.rbs

@@ -0,0 +1,40 @@
+module Capsium
+  class Reactor
+    # Request authentication and route authorization for the reactor
+    # (05x-authentication, ARCHITECTURE.md section 4b).
+    class Authenticator
+      LOGIN_PATH: String
+
+      attr_reader authentication: Package::Authentication
+      attr_reader deploy: Deploy
+
+      def initialize: (Package::Authentication authentication,
+                       deploy: Deploy deploy, package_path: String package_path,
+                       ?base_url: String? base_url,
+                       ?state_file: String? state_file) -> void
+
+      def enabled?: () -> bool
+
+      # The paths this authenticator answers itself (OAuth2 login and
+      # callback), mounted by the reactor.
+      def endpoints: () -> Array[String]
+
+      def endpoint?: (String path) -> bool
+
+      def serve_endpoint: (untyped request, untyped response) -> untyped
+
+      # The identity for a request — from the session cookie or Basic
+      # credentials — or nil. An identity always carries "roles"
+      # (possibly empty).
+      def authenticate: (untyped request) -> Hash[String, untyped]?
+
+      # 401, with a Basic challenge when basicAuth is enabled.
+      def challenge: (untyped response) -> untyped
+
+      # :ok, :unauthenticated or :forbidden for a route's accessControl
+      # ({"roles": [...], "authenticationRequired": bool}).
+      def authorize: (Hash[String, untyped]? identity,
+                      Hash[String, untyped]? access_control) -> (:ok | :unauthenticated | :forbidden)
+    end
+  end
+end

data/sig/capsium/reactor/deploy.rbs

@@ -0,0 +1,34 @@
+module Capsium
+  class Reactor
+    # Reactor-side deployment configuration (deploy.json): everything
+    # that must NOT ship in the package — OAuth2 client secrets, the
+    # session signing secret, role assignments, an alternate htpasswd
+    # file, the public base URL.
+    class Deploy
+      FILE: String
+      ENV_VAR: String
+
+      attr_reader config: Hash[String, untyped]
+
+      # Loads from an explicit path, an already-parsed Hash, or the
+      # CAPSIUM_DEPLOY environment variable; empty when unconfigured.
+      def self.load: (Hash[String, untyped] | String? source) -> Deploy
+
+      def initialize: (Hash[String, untyped] config) -> void
+
+      def authentication: () -> Hash[String, untyped]
+
+      def base_url: () -> String?
+
+      def client_secret: () -> String?
+
+      def session_secret: () -> String?
+
+      def passwd_file: () -> String?
+
+      # Role assignments keyed by identity name (basic-auth username,
+      # OAuth2 email or subject): {"alice": ["admin", "user"]}.
+      def roles: () -> Hash[String, Array[String]]
+    end
+  end
+end

data/sig/capsium/reactor/htpasswd.rbs

@@ -0,0 +1,36 @@
+module Capsium
+  class Reactor
+    # Apache htpasswd verification (05x-authentication). Supported hash
+    # formats: bcrypt ($2a$/$2b$/$2y$), Apache apr1 MD5 and md5-crypt
+    # ($apr1$/$1$), unsalted SHA-1 ({SHA}), and a crypt(3) fallback for
+    # the rest (platform-dependent).
+    class Htpasswd
+      # md5-crypt as deployed by Apache htpasswd, OpenSSL and glibc.
+      module Md5Crypt
+        ITOA64: String
+        DIGEST_GROUPS: Array[Array[Integer]]
+
+        def self.verify: (String hash, String password) -> bool
+
+        def self.digest: (String password, String salt, String magic) -> String
+
+        def self.initial_digest: (String password, String salt, String magic) -> String
+
+        def self.stretch_digest: (Integer iteration, String password, String salt, String final) -> String
+
+        def self.to64: (String final) -> String
+      end
+
+      attr_reader path: String
+
+      def initialize: (String path) -> void
+
+      def usernames: () -> Array[String]
+
+      def verify?: (String username, String password) -> bool
+    end
+
+    # Constant-time string comparison (length-check first).
+    def self.secure_compare: (String own, String theirs) -> bool
+  end
+end

data/sig/capsium/reactor/oauth2.rbs

@@ -0,0 +1,31 @@
+module Capsium
+  class Reactor
+    # OAuth2 authorization-code flow client (05x-authentication), used by
+    # the Authenticator. Talks to the provider over net/http; the client
+    # secret never comes from the package.
+    class OAuth2
+      # The token exchange or userinfo fetch failed at the provider.
+      class FlowError < Capsium::Error
+      end
+
+      GRANT_TYPE: String
+
+      attr_reader config: Package::OAuth2Config
+
+      def initialize: (Package::OAuth2Config config, client_secret: String client_secret,
+                       session: Session session, ?base_url: String? base_url) -> void
+
+      # The provider URL the login endpoint redirects the browser to.
+      def authorization_url: (untyped request) -> String
+
+      def valid_state?: (String? state) -> bool
+
+      # Exchanges the authorization code and fetches the userinfo
+      # claims. Returns the raw userinfo hash; raises FlowError on
+      # provider errors.
+      def complete: (String? code, untyped request) -> Hash[String, untyped]
+
+      def callback_uri: (untyped request) -> String
+    end
+  end
+end

data/sig/capsium/reactor/serving.rbs

@@ -0,0 +1,22 @@
+module Capsium
+  class Reactor
+    # Serving of resolved routes (static files through the merged view,
+    # datasets, handler-route 501s), mixed into Reactor. Includes route
+    # inheritance processing per 05x-routing.
+    module Serving
+      private
+
+      def serve_route: (Package::Route route, untyped response) -> untyped
+
+      def serve_file: (Package::Route route, untyped response) -> untyped
+
+      def inherited_processing: (Package::Route route, String body, Hash[String, String] headers) -> [String, Hash[String, String]]
+
+      def content_type_for: (Package::Route route, String content_path) -> String
+
+      def headers_for: (Package::Route route) -> Hash[String, String]
+
+      def serve_dataset: (String dataset_name, untyped response) -> untyped
+    end
+  end
+end

data/sig/capsium/reactor/session.rbs

@@ -0,0 +1,36 @@
+module Capsium
+  class Reactor
+    # HMAC-SHA256 signed session cookies (05x-authentication). The
+    # signing secret comes from deploy.json (sessionSecret) or is
+    # generated and persisted reactor-side (never in the package).
+    class Session
+      COOKIE_NAME: String
+      SECRET_BYTES: Integer
+
+      def self.hmac: (String secret, String data) -> String
+
+      # The persisted reactor-side secret: loaded from state_file when
+      # present, generated and written (mode 0600) otherwise.
+      def self.load_or_generate_secret: (String? state_file) -> String
+
+      attr_reader secret: String
+
+      def initialize: (?secret: String? secret, ?state_file: String? state_file) -> void
+
+      # HMAC-SHA256 of data with the session secret (hex).
+      def sign: (String data) -> String
+
+      def encode: (Hash[String, untyped] payload) -> String
+
+      # The verified payload, or nil when the cookie is missing or the
+      # signature does not match.
+      def decode: (String? cookie_value) -> Hash[String, untyped]?
+
+      # The identity for a request's Cookie header, or nil.
+      def identity_from: (untyped request) -> Hash[String, untyped]?
+
+      # A Set-Cookie value establishing the identity session.
+      def cookie_for: (Hash[String, untyped] identity) -> String
+    end
+  end
+end

data/sig/capsium/reactor.rbs

@@ -3,6 +3,8 @@ module Capsium
   # Monitoring HTTP API (ARCHITECTURE.md section 7) and reloads the
   # package on filesystem changes.
   class Reactor
+    include Serving
+
     DEFAULT_PORT: Integer
     DEFAULT_CACHE_CONTROL: String
 
@@ -14,10 +16,13 @@ module Capsium
     attr_reader server: untyped
     attr_reader server_thread: Thread?
     attr_reader introspection: Introspection
+    attr_reader authenticator: Authenticator
 
     def initialize: (package: Package | String package, ?port: Integer port,
                      ?cache_control: String? cache_control,
-                     ?do_not_listen: bool do_not_listen) -> void
+                     ?do_not_listen: bool do_not_listen,
+                     ?store: (Package::Store | String)? store,
+                     ?deploy: (Hash[String, untyped] | String)? deploy) -> void
 
     def serve: () -> untyped
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: capsium
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Ribose Inc.
@@ -9,6 +9,20 @@ bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: bcrypt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: csv
   requirement: !ruby/object:Gem::Requirement
@@ -204,45 +218,100 @@ files:
 - lib/capsium.rb
 - lib/capsium/cli.rb
 - lib/capsium/cli/convert.rb
+- lib/capsium/cli/formatting.rb
 - lib/capsium/cli/package.rb
 - lib/capsium/cli/reactor.rb
 - lib/capsium/converters.rb
 - lib/capsium/converters/jekyll.rb
 - lib/capsium/package.rb
+- lib/capsium/package/authentication.rb
+- lib/capsium/package/authentication_config.rb
+- lib/capsium/package/cipher.rb
+- lib/capsium/package/composition.rb
 - lib/capsium/package/dataset.rb
+- lib/capsium/package/dependency_resolver.rb
+- lib/capsium/package/encryption_config.rb
 - lib/capsium/package/manifest.rb
 - lib/capsium/package/manifest_config.rb
+- lib/capsium/package/merged_view.rb
 - lib/capsium/package/metadata.rb
 - lib/capsium/package/metadata_config.rb
+- lib/capsium/package/preparation.rb
 - lib/capsium/package/routes.rb
 - lib/capsium/package/routes_config.rb
 - lib/capsium/package/security.rb
 - lib/capsium/package/security_config.rb
+- lib/capsium/package/signer.rb
 - lib/capsium/package/storage.rb
 - lib/capsium/package/storage_config.rb
+- lib/capsium/package/store.rb
+- lib/capsium/package/testing.rb
+- lib/capsium/package/testing/config_test.rb
+- lib/capsium/package/testing/context.rb
+- lib/capsium/package/testing/data_validation_test.rb
+- lib/capsium/package/testing/file_test.rb
+- lib/capsium/package/testing/report.rb
+- lib/capsium/package/testing/route_test.rb
+- lib/capsium/package/testing/test_case.rb
+- lib/capsium/package/testing/test_suite.rb
 - lib/capsium/package/validator.rb
+- lib/capsium/package/verification.rb
+- lib/capsium/package/version.rb
 - lib/capsium/packager.rb
 - lib/capsium/reactor.rb
+- lib/capsium/reactor/authenticator.rb
+- lib/capsium/reactor/deploy.rb
+- lib/capsium/reactor/htpasswd.rb
 - lib/capsium/reactor/introspection.rb
+- lib/capsium/reactor/oauth2.rb
+- lib/capsium/reactor/serving.rb
+- lib/capsium/reactor/session.rb
 - lib/capsium/thor_ext.rb
 - lib/capsium/version.rb
 - sig/capsium.rbs
 - sig/capsium/package.rbs
+- sig/capsium/package/authentication.rbs
+- sig/capsium/package/authentication_config.rbs
+- sig/capsium/package/cipher.rbs
+- sig/capsium/package/composition.rbs
 - sig/capsium/package/dataset.rbs
+- sig/capsium/package/dependency_resolver.rbs
+- sig/capsium/package/encryption_config.rbs
 - sig/capsium/package/manifest.rbs
 - sig/capsium/package/manifest_config.rbs
+- sig/capsium/package/merged_view.rbs
 - sig/capsium/package/metadata.rbs
 - sig/capsium/package/metadata_config.rbs
+- sig/capsium/package/preparation.rbs
 - sig/capsium/package/routes.rbs
 - sig/capsium/package/routes_config.rbs
 - sig/capsium/package/security.rbs
 - sig/capsium/package/security_config.rbs
+- sig/capsium/package/signer.rbs
 - sig/capsium/package/storage.rbs
 - sig/capsium/package/storage_config.rbs
+- sig/capsium/package/store.rbs
+- sig/capsium/package/testing.rbs
+- sig/capsium/package/testing/config_test.rbs
+- sig/capsium/package/testing/context.rbs
+- sig/capsium/package/testing/data_validation_test.rbs
+- sig/capsium/package/testing/file_test.rbs
+- sig/capsium/package/testing/report.rbs
+- sig/capsium/package/testing/route_test.rbs
+- sig/capsium/package/testing/test_case.rbs
+- sig/capsium/package/testing/test_suite.rbs
 - sig/capsium/package/validator.rbs
+- sig/capsium/package/verification.rbs
+- sig/capsium/package/version.rbs
 - sig/capsium/packager.rbs
 - sig/capsium/reactor.rbs
+- sig/capsium/reactor/authenticator.rbs
+- sig/capsium/reactor/deploy.rbs
+- sig/capsium/reactor/htpasswd.rbs
 - sig/capsium/reactor/introspection.rbs
+- sig/capsium/reactor/oauth2.rbs
+- sig/capsium/reactor/serving.rbs
+- sig/capsium/reactor/session.rbs
 homepage: https://github.com/capsiums/capsium
 licenses:
 - MIT