@toa.io/extensions.exposition 1.0.0-alpha.0 → 1.0.0-alpha.100

package/source/RTD/syntax/parse.ts

@@ -17,42 +17,56 @@ export function parse (input: object, shortcuts?: Shortcuts): Node {
   return node
 }
 
-function parseNode (input: object, shortcuts?: Shortcuts): Node {
+function parseNode (input: object | string, shortcuts?: Shortcuts): Node {
   const node = createNode()
 
-  for (const [key, value] of Object.entries(input)) {
-    if (PROPERTIES.includes(key as keyof Node)) {
-      node[key as keyof Node] = value
+  if (typeof input === 'string') {
+    node.forward = input
 
-      continue
-    }
+    return node
+  }
 
-    if (key[0] === '/') {
-      const route = parseRoute(key, value, shortcuts)
+  for (const [key, value] of Object.entries(input) as Array<[keyof Node, unknown]>)
+    switch (key) {
+      case 'protected':
+      case 'isolated':
+        node[key] = value as boolean
+        break
+      case 'forward':
+        node[key] = value as string
+        break
 
-      node.routes.push(route)
+      default:
+        // eslint-disable-next-line max-depth
+        if (key[0] === '/') {
+          const route = parseRoute(key, value as Node, shortcuts)
 
-      continue
-    }
+          node.routes.push(route)
 
-    if (verbs.has(key)) {
-      const method = parseMethod(key, value, shortcuts)
+          continue
+        }
 
-      node.methods.push(method)
+        // eslint-disable-next-line max-depth
+        if (verbs.has(key)) {
+          const method = parseMethod(key, value as Mapping, shortcuts)
 
-      continue
-    }
+          node.methods.push(method)
 
-    const directive = parseDirective(key, value, shortcuts)
+          continue
+        }
 
-    if (directive !== null) {
-      node.directives.push(directive)
+        // eslint-disable-next-line no-case-declarations
+        const directive = parseDirective(key, value, shortcuts)
 
-      continue
-    }
+        // eslint-disable-next-line max-depth
+        if (directive !== null) {
+          node.directives.push(directive)
 
-    throw new Error(`RTD parse error: unknown key '${key}'.`)
-  }
+          continue
+        }
+
+        throw new Error(`RTD parse error: unknown key '${key}'`)
+    }
 
   return node
 }
@@ -65,7 +79,7 @@ export function createNode (): Node {
   }
 }
 
-function parseRoute (path: string, value: object, shortcuts?: Shortcuts): Route {
+function parseRoute (path: string, value: Node, shortcuts?: Shortcuts): Route {
   const node = parse(value, shortcuts)
 
   return createRoute(path, node)
@@ -106,10 +120,10 @@ function parseQuery (mapping: any): void {
     return
 
   if (typeof query.limit === 'number')
-    query.limit = expandRange(query.limit)
+    query.limit = expandRange(query.limit as number)
 
   if (typeof query.omit === 'number')
-    query.omit = expandRange(query.omit)
+    query.omit = expandRange(query.omit as number)
 }
 
 function parseDirectives (mapping: Record<string, any>, shortcuts?: Shortcuts): Directive[] {
@@ -132,7 +146,7 @@ function parseDirectives (mapping: Record<string, any>, shortcuts?: Shortcuts):
 
 function parseDirective (key: string, value: any, shortcuts?: Shortcuts): Directive | null {
   if (shortcuts?.has(key) === true)
-    key = shortcuts.get(key) as string
+    key = shortcuts.get(key)! // eslint-disable-line @typescript-eslint/no-non-null-assertion
 
   const match = key.match(DIRECTIVE_RX)
 
@@ -149,6 +163,5 @@ function expandRange (range: number): Range {
 }
 
 const DIRECTIVE_RX = /^(?<family>\w{1,32}):(?<name>\w{1,32})$/
-const PROPERTIES: Array<keyof Node> = ['protected', 'isolated']
 
 export type Shortcuts = Map<string, string>

package/source/RTD/syntax/types.ts

@@ -1,6 +1,7 @@
 export interface Node {
   protected?: boolean
   isolated?: boolean
+  forward?: string
   routes: Route[]
   methods: Method[]
   directives: Directive[]
@@ -27,17 +28,18 @@ export interface Mapping {
   namespace?: string
   component?: string
   endpoint: string
-  query?: Query
+  query?: Query | null
 }
 
 export interface Query {
   id?: string
   criteria?: string
   sort?: string
-  omit: Range
-  limit: Range
+  omit?: Range
+  limit?: Range
   selectors?: string[]
   projection?: string[]
+  parameters?: string[]
 }
 
 export interface Range {
@@ -45,4 +47,4 @@ export interface Range {
   range: [number, number]
 }
 
-export const verbs = new Set<string>(['GET', 'POST', 'PUT', 'PATCH', 'DELETE'])
+export const verbs = new Set<string>(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'LOCK', 'UNLOCK'])

package/source/Remotes.ts

@@ -1,24 +1,25 @@
-import { Locator, Connector, type Component } from '@toa.io/core'
+import { Locator, Connector, type Remote } from '@toa.io/core'
 import { type Bootloader } from './Factory'
 
 export class Remotes extends Connector {
   private readonly boot: Bootloader
-  private readonly remotes: Record<string, Promise<Component>> = {}
+  private readonly cache: Record<string, Promise<Remote>> = {}
 
   public constructor (boot: Bootloader) {
     super()
     this.boot = boot
   }
 
-  public async discover (namespace: string, name: string): Promise<Component> {
+  public async discover (namespace: string, name: string, version: string = 'local'): Promise<Remote> {
     const locator = new Locator(name, namespace)
+    const key = locator.id + ':' + version
 
-    this.remotes[locator.id] ??= this.create(locator)
+    this.cache[key] ??= this.locate(locator)
 
-    return await this.remotes[locator.id]
+    return this.cache[key]
   }
 
-  private async create (locator: Locator): Promise<Component> {
+  private async locate (locator: Locator): Promise<Remote> {
     const remote = await this.boot.remote(locator)
 
     this.depends(remote)

package/source/Tenant.ts

@@ -1,23 +1,17 @@
-import { Connector, type Locator, type bindings } from '@toa.io/core'
-import { type Label } from './discovery'
-import { type Branch } from './Branch'
-import type * as RTD from './RTD/syntax'
+import { Connector } from '@toa.io/core'
+import type { bindings } from '@toa.io/core'
+import type { Label } from './discovery'
+import type { Branch } from './Branch'
 
 export class Tenant extends Connector {
   private readonly broadcast: Broadcast
   private readonly branch: Branch
 
-  public constructor (broadcast: Broadcast, locator: Locator, node: RTD.Node) {
+  public constructor (broadcast: Broadcast, branch: Branch) {
     super()
 
     this.broadcast = broadcast
-
-    this.branch = {
-      namespace: locator.namespace,
-      component: locator.name,
-      isolated: locator.namespace === 'identity',
-      node
-    }
+    this.branch = branch
 
     this.depends(broadcast)
   }
@@ -25,14 +19,6 @@ export class Tenant extends Connector {
   public override async open (): Promise<void> {
     await this.expose()
     await this.broadcast.receive('ping', this.expose.bind(this))
-
-    console.info('Exposition Tenant for ' +
-      `'${this.branch.namespace}.${this.branch.component}' has started.`)
-  }
-
-  public override async dispose (): Promise<void> {
-    console.info('Exposition Tenant for ' +
-      `'${this.branch.namespace}.${this.branch.component}' has been stopped.`)
   }
 
   private async expose (): Promise<void> {

package/source/deployment.ts

@@ -1,3 +1,4 @@
+import assert from 'node:assert'
 import { type Dependency, type Service } from '@toa.io/operations'
 import { encode } from '@toa.io/generic'
 import { type Annotation } from './Annotation'
@@ -5,45 +6,59 @@ import * as schemas from './schemas'
 import { shortcuts } from './Directive'
 import { components } from './Composition'
 import { parse } from './RTD/syntax'
+import { DELAY, PORT } from './HTTP'
+
+export function deployment (_: unknown, annotation?: Annotation): Dependency {
+  assert.ok(annotation !== undefined, 'Exposition context annotation is required')
+  schemas.annotation.validate(annotation)
 
-export function deployment (_: unknown, annotation: Annotation | undefined): Dependency {
   const labels = components().labels
 
   const service: Service = {
     group: 'exposition',
     name: 'gateway',
-    port: 8000,
+    port: PORT,
     // eslint-disable-next-line @typescript-eslint/no-var-requires
     version: require('../package.json').version,
     variables: [],
-    components: labels
-  }
-
-  if (annotation?.host !== undefined)
-    service.ingress = {
-      host: annotation.host,
-      class: annotation.class,
-      annotations: annotation.annotations
+    components: labels,
+    ingress: { default: true, hosts: [] },
+    probe: {
+      path: '/.ready',
+      port: PORT,
+      delay: DELAY
     }
+  }
 
   if (annotation?.['/'] !== undefined) {
-    const node = { '/': annotation['/'] }
-    const tree = parse(node, shortcuts)
+    const tree = parse(annotation['/'], shortcuts)
 
-    service.variables.push({
+    service.variables!.push({
       name: 'TOA_EXPOSITION',
       value: encode(tree)
     })
   }
 
-  if (annotation?.debug === true)
-    service.variables.push({
-      name: 'TOA_EXPOSITION_DEBUG',
-      value: '1'
-    })
+  const { debug, trace, authorities } = annotation
 
-  if (annotation !== undefined)
-    schemas.annotaion.validate(annotation)
+  service.ingress!.hosts = Object.values(authorities)
+  service.ingress!.class = annotation.class
+  service.ingress!.annotations = annotation.annotations
+
+  const properties: Properties = { authorities }
+
+  if (debug === true)
+    properties.debug = true
+
+  if (trace === true)
+    properties.trace = true
+
+  service.variables!.push({
+    name: 'TOA_EXPOSITION_PROPERTIES',
+    value: encode(properties)
+  })
 
   return { services: [service] }
 }
+
+type Properties = Pick<Annotation, 'authorities' | 'debug' | 'trace'>

package/source/directives/auth/Anonymous.ts

@@ -8,7 +8,8 @@ export class Anonymous implements Directive {
   }
 
   public authorize (_: any, input: Input): boolean {
-    if ('authorization' in input.headers) return false
-    else return this.allow
+    return 'authorization' in input.request.headers
+      ? false
+      : this.allow
   }
 }

package/source/directives/auth/Anyone.ts

@@ -0,0 +1,13 @@
+import { type Directive, type Input } from './types'
+
+export class Anyone implements Directive {
+  private readonly allow: boolean
+
+  public constructor (allow: boolean) {
+    this.allow = allow
+  }
+
+  public authorize (_: any, input: Input): boolean {
+    return input.identity !== null && this.allow
+  }
+}

package/source/directives/auth/Authorization.ts

@@ -0,0 +1,170 @@
+import assert from 'node:assert'
+import { match } from 'matchacho'
+import * as http from '../../HTTP'
+import { Anonymous } from './Anonymous'
+import { Id } from './Id'
+import { Role } from './Role'
+import { Rule } from './Rule'
+import { Incept } from './Incept'
+import { Echo } from './Echo'
+import { Scheme } from './Scheme'
+import { Delegate } from './Delegate'
+import { Federation } from './Federation'
+import { split } from './split'
+import { PRIMARY, PROVIDERS } from './schemes'
+import { Anyone } from './Anyone'
+import type { Output } from '../../io'
+import type { Component } from '@toa.io/core'
+import type { Remotes } from '../../Remotes'
+import type { Parameter, DirectiveFamily } from '../../RTD'
+import type {
+  AuthenticationResult,
+  Ban,
+  Directive,
+  Discovery,
+  Extension,
+  Identity,
+  Input,
+  Remote,
+  Schemes
+} from './types'
+
+export class Authorization implements DirectiveFamily<Directive, Extension> {
+  public readonly depends: string[] = ['Vary']
+  public readonly name: string = 'auth'
+  public readonly mandatory: boolean = true
+
+  private readonly schemes = {} as unknown as Schemes
+  private readonly discovery = {} as unknown as Discovery
+  private tokens: Component | null = null
+  private bans: Component | null = null
+
+  public create (name: string, value: any, remotes: Remotes): Directive {
+    assert.ok(name in constructors,
+      `Directive 'auth:${name}' is not implemented`)
+
+    const Class = constructors[name]
+
+    for (const name of REMOTES)
+      this.discovery[name] ??= remotes.discover('identity', name)
+
+    return match(Class,
+      Role, () => new Role(value as string | string[], this.discovery.roles),
+      Rule, () => new Rule(value as Record<string, string>, this.create.bind(this)),
+      Incept, () => new Incept(value as string, this.discovery),
+      Delegate, () => new Delegate(value as string, this.discovery.roles),
+      () => new Class(value))
+  }
+
+  public async preflight (directives: Directive[],
+    input: Input,
+    parameters: Parameter[]): Promise<Output> {
+    /**
+     * Some authentication scheme providers may create identity during authentication;
+     * therefore, we need to skip the authentication process if the Incept directive is present.
+     *
+     * If the provided credentials already exist,
+     * the inception will cause a unique constraint violation on the settle stage.
+     */
+    // const inception = directives.reduce((yes, directive) => yes || directive instanceof Incept, false)
+
+    input.identity = await this.resolve(input.authority, input.request.headers.authorization)
+
+    for (const directive of directives) {
+      const allow = await directive.authorize(input.identity, input, parameters)
+
+      if (allow)
+        return directive.reply?.(input.identity) ?? null
+    }
+
+    if (input.identity === null)
+      throw new http.Unauthorized()
+    else
+      throw new http.Forbidden()
+  }
+
+  public async settle (directives: Directive[],
+    input: Input,
+    response: http.OutgoingMessage): Promise<void> {
+    await Promise.all(directives.map(async (directive) =>
+      directive.settle?.(input, response)))
+
+    const identity = input.identity
+
+    if (identity === null)
+      return
+
+    if (identity.scheme === PRIMARY && !identity.refresh)
+      return
+
+    // Role directive may have already set the value
+    if (identity.roles === undefined)
+      await Role.set(identity, this.discovery.roles)
+
+    this.tokens ??= await this.discovery.tokens
+
+    const token = await this.tokens.invoke<string>('encrypt', {
+      input: { authority: input.authority, identity }
+    })
+
+    const authorization = `Token ${token}`
+
+    response.headers ??= new Headers()
+    response.headers.set('authorization', authorization)
+  }
+
+  private async resolve (authority: string, authorization: string | undefined): Promise<Identity | null> {
+    if (authorization === undefined)
+      return null
+
+    const [scheme, credentials] = split(authorization)
+    const provider = PROVIDERS[scheme]
+
+    if (!(provider in this.discovery))
+      throw new http.Unauthorized(`Unknown authentication scheme '${scheme}'`)
+
+    this.schemes[scheme] ??= await this.discovery[provider]
+
+    const result = await this.schemes[scheme].invoke<AuthenticationResult>('authenticate', {
+      input: {
+        authority,
+        credentials
+      }
+    })
+
+    if (result instanceof Error)
+      return null
+
+    const identity = result.identity
+
+    if (scheme !== PRIMARY && (await this.banned(identity))) throw new http.Unauthorized()
+
+    identity.scheme = scheme
+    identity.refresh = result.refresh
+
+    return identity
+  }
+
+  private async banned (identity: Identity): Promise<boolean> {
+    this.bans ??= await this.discovery.bans
+
+    const ban = await this.bans.invoke<Ban>('observe', { query: { id: identity.id } })
+
+    return ban.banned
+  }
+}
+
+const constructors: Record<string, new (value: any, argument?: any) => Directive> = {
+  anonymous: Anonymous,
+  anyone: Anyone,
+  id: Id,
+  role: Role,
+  rule: Rule,
+  incept: Incept,
+  scheme: Scheme,
+  echo: Echo,
+  delegate: Delegate,
+  claims: Federation
+}
+
+const REMOTES: Remote[] = ['basic', 'federation', 'tokens', 'roles', 'bans']

package/source/directives/auth/Delegate.ts

@@ -0,0 +1,42 @@
+import { BadRequest } from '../../HTTP'
+import { type Directive, type Identity } from './types'
+import { Role } from './Role'
+import type { Component } from '@toa.io/core'
+import type { Input } from '../../io'
+
+export class Delegate implements Directive {
+  private readonly property: string
+  private readonly discovery: Promise<Component>
+
+  public constructor (property: string, discovery: Promise<Component>) {
+    this.property = property
+    this.discovery = discovery
+  }
+
+  public async authorize (identity: Identity | null, context: Input): Promise<boolean> {
+    if (identity === null)
+      return false
+
+    if (identity.roles === undefined)
+      await Role.set(identity, this.discovery)
+
+    context.pipelines.body.push((body) => this.embed(body, identity))
+
+    return true
+  }
+
+  private embed (body: unknown, identity: Identity): Record<string, unknown> {
+    if (body === undefined)
+      body = {}
+
+    check(body)
+    body[this.property] = structuredClone(identity)
+
+    return body
+  }
+}
+
+function check (body: unknown): asserts body is Record<string, unknown> {
+  if (typeof body !== 'object' || body === null)
+    throw new BadRequest('Invalid request body')
+}

package/source/directives/auth/Echo.ts

@@ -1,12 +1,26 @@
-import { type OutgoingMessage } from '../../HTTP'
-import { type Directive, type Identity } from './types'
+import { newid } from '@toa.io/generic'
+import type { OutgoingMessage } from '../../HTTP'
+import type { Directive, Identity, Input } from './types'
 
 export class Echo implements Directive {
-  public authorize (identity: Identity | null): boolean {
-    return identity !== null
+  public authorize (identity: Identity | null, input: Input): boolean {
+    if (identity === null && 'authorization' in input.request.headers)
+      return false
+
+    input.identity ??= this.create()
+
+    return true
   }
 
   public reply (identity: Identity | null): OutgoingMessage {
-    return { body: identity }
+    const body = identity!
+
+    return body.scheme === null
+      ? { status: 201, body }
+      : { body }
+  }
+
+  private create (): Identity {
+    return { id: newid(), scheme: null, refresh: false, roles: [] }
   }
 }

package/source/directives/auth/Federation.ts

@@ -0,0 +1,84 @@
+import assert from 'node:assert'
+import type { Directive, Identity, Input } from './types'
+import type { Parameter } from '../../RTD'
+
+export class Federation implements Directive {
+  private readonly matchers: Array<[keyof Claims, Matcher]>
+
+  public constructor (options: Options) {
+    this.matchers = (Object.entries(options) as Array<[keyof Claims, string]>)
+      .map(([key, value]) => [key, toMatcher(value)])
+
+    assert.ok(this.matchers.length > 0, '`auth:claims` requires at least one property defined')
+  }
+
+  public authorize (identity: Identity | null, context: Input, parameters: Parameter[]): boolean {
+    if (identity === null || !('claims' in identity))
+      return false
+
+    const claims = (identity as FederatedIdentity).claims
+
+    for (const [key, match] of this.matchers)
+      if (!match(claims[key], context, parameters))
+        return false
+
+    return true
+  }
+}
+
+function toMatcher (expression: string): Matcher {
+  if (expression.startsWith(':')) {
+    const key = expression.slice(1) as 'authority'
+
+    if (key === 'authority')
+      return (value, context) => matches(value, context[key])
+
+    if (key === 'domain')
+      return (value, context) => {
+        return Array.isArray(value)
+          ? value.some((iss) => codomain(iss, context))
+          : codomain(value, context)
+      }
+
+    throw new Error('Unknown `auth:claims` syntax: ' + expression)
+  }
+
+  if (expression.startsWith('/:')) {
+    const name = expression.slice(2)
+
+    return (value, _, parameters) => parameters
+      .some((parameter) => parameter.name === name && matches(value, parameter.value))
+  }
+
+  return (value) => matches(value, expression)
+}
+
+function matches (value: string | string[], reference: string): boolean {
+  return Array.isArray(value)
+    ? value.includes(reference)
+    : value === reference
+}
+
+function codomain (iss: string, context: Input): boolean {
+  const hostname = new URL(iss).hostname
+  const dot = hostname.indexOf('.')
+  const basename = dot === -1 ? hostname : hostname.slice(dot)
+
+  return context.authority.slice(-basename.length) === basename
+}
+
+type Matcher = (value: string | string[], context: Input, parameters: Parameter[]) => boolean
+
+interface Claims {
+  iss: string
+  sub: string
+  aud: string | string[]
+}
+
+interface Options extends Partial<Claims> {
+  iss: string
+}
+
+interface FederatedIdentity extends Identity {
+  claims: Claims
+}