@toa.io/extensions.exposition 1.0.0-alpha.10 → 1.0.0-alpha.101

package/source/directives/auth/Federation.ts

@@ -0,0 +1,84 @@
+import assert from 'node:assert'
+import type { Directive, Identity, Input } from './types'
+import type { Parameter } from '../../RTD'
+
+export class Federation implements Directive {
+  private readonly matchers: Array<[keyof Claims, Matcher]>
+
+  public constructor (options: Options) {
+    this.matchers = (Object.entries(options) as Array<[keyof Claims, string]>)
+      .map(([key, value]) => [key, toMatcher(value)])
+
+    assert.ok(this.matchers.length > 0, '`auth:claims` requires at least one property defined')
+  }
+
+  public authorize (identity: Identity | null, context: Input, parameters: Parameter[]): boolean {
+    if (identity === null || !('claims' in identity))
+      return false
+
+    const claims = (identity as FederatedIdentity).claims
+
+    for (const [key, match] of this.matchers)
+      if (!match(claims[key], context, parameters))
+        return false
+
+    return true
+  }
+}
+
+function toMatcher (expression: string): Matcher {
+  if (expression.startsWith(':')) {
+    const key = expression.slice(1) as 'authority'
+
+    if (key === 'authority')
+      return (value, context) => matches(value, context[key])
+
+    if (key === 'domain')
+      return (value, context) => {
+        return Array.isArray(value)
+          ? value.some((iss) => codomain(iss, context))
+          : codomain(value, context)
+      }
+
+    throw new Error('Unknown `auth:claims` syntax: ' + expression)
+  }
+
+  if (expression.startsWith('/:')) {
+    const name = expression.slice(2)
+
+    return (value, _, parameters) => parameters
+      .some((parameter) => parameter.name === name && matches(value, parameter.value))
+  }
+
+  return (value) => matches(value, expression)
+}
+
+function matches (value: string | string[], reference: string): boolean {
+  return Array.isArray(value)
+    ? value.includes(reference)
+    : value === reference
+}
+
+function codomain (iss: string, context: Input): boolean {
+  const hostname = new URL(iss).hostname
+  const dot = hostname.indexOf('.')
+  const basename = dot === -1 ? hostname : hostname.slice(dot)
+
+  return context.authority.slice(-basename.length) === basename
+}
+
+type Matcher = (value: string | string[], context: Input, parameters: Parameter[]) => boolean
+
+interface Claims {
+  iss: string
+  sub: string
+  aud: string | string[]
+}
+
+interface Options extends Partial<Claims> {
+  iss: string
+}
+
+interface FederatedIdentity extends Identity {
+  claims: Claims
+}

package/source/directives/auth/Incept.ts

@@ -23,7 +23,7 @@ export class Incept implements Directive {
 
     if (id === undefined)
       throw new http.Conflict('Identity inception has failed as the response body ' +
-        ` does not contain the '${this.property}' property.`)
+        `does not contain the '${this.property}' property`)
 
     const [scheme, credentials] = split(input.request.headers.authorization!)
     const provider = PROVIDERS[scheme]
@@ -31,15 +31,16 @@ export class Incept implements Directive {
     this.schemes[scheme] ??= await this.discovery[provider]
 
     const identity = await this.schemes[scheme]
-      .invoke<Maybe<Identity>>('create', {
+      .invoke<Maybe<Identity>>('incept', {
       input: {
+        authority: input.authority,
         id,
         credentials
       }
     })
 
     if (identity instanceof Error)
-      throw new http.Conflict(identity)
+      throw new http.UnprocessableEntity(identity)
 
     input.identity = identity
     input.identity.scheme = scheme

package/source/directives/auth/Role.test.ts

@@ -2,6 +2,7 @@ import { type Component } from '@toa.io/core'
 import { generate } from 'randomstring'
 import { Role } from './Role'
 import { type Identity } from './types'
+import type { Parameter } from '../../RTD'
 
 const remote = {
   invoke: jest.fn()
@@ -16,16 +17,26 @@ beforeEach(() => {
 it('should return false if not matched', async () => {
   const roles = ['admin', 'user']
   const directive = new Role(roles, discovery)
-  const identity: Identity = { id: generate(), scheme: '', refresh: false }
+
+  const identity: Identity = {
+    id: generate(),
+    scheme: '',
+    refresh: false
+  }
 
   remote.invoke.mockResolvedValueOnce(['guest'])
 
-  const result = await directive.authorize(identity)
+  const result = await directive.authorize(identity, undefined, [])
 
   expect(result).toBe(false)
 
   expect(remote.invoke)
-    .toBeCalledWith('list', { query: { criteria: `identity==${identity.id}`, limit: 1024 } })
+    .toBeCalledWith('list', {
+      query: {
+        criteria: `identity==${identity.id}`,
+        limit: 1024
+      }
+    })
 })
 
 it('should return true on exact match', async () => {
@@ -52,11 +63,47 @@ it('should return false on non-scope substring match', async () => {
   expect(result).toBe(false)
 })
 
-async function match (expected: string[], actual: string[]): Promise<boolean> {
+it('should return true on match with parameters', async () => {
+  const result = await match(['app:{org}:reviews'],
+    ['app:29e54ae1:reviews'], [{
+      name: 'org',
+      value: '29e54ae1'
+    }])
+
+  expect(result).toBe(true)
+})
+
+it('should return true on match with parameters', async () => {
+  const result = await match(['app:{org}:reviews'],
+    ['app:29e54ae1:reviews'], [{
+      name: 'org',
+      value: '29e54ae1'
+    }])
+
+  expect(result).toBe(true)
+})
+
+it('should return false on mismatch with parameters', async () => {
+  const result = await match(['app:{org}:reviews'],
+    ['app:29e54ae1:reviews'], [{
+      name: 'org',
+      value: '88584c9b'
+    }])
+
+  expect(result).toBe(false)
+})
+
+async function match
+(expected: string[], actual: string[], parameters: Parameter[] = []): Promise<boolean> {
   const directive = new Role(expected, discovery)
-  const identity: Identity = { id: generate(), scheme: '', refresh: false }
+
+  const identity: Identity = {
+    id: generate(),
+    scheme: '',
+    refresh: false
+  }
 
   remote.invoke.mockResolvedValueOnce(actual)
 
-  return await directive.authorize(identity)
+  return await directive.authorize(identity, undefined, parameters)
 }

package/source/directives/auth/Role.ts

@@ -1,14 +1,18 @@
+import assert from 'node:assert'
 import { type Component, type Query } from '@toa.io/core'
 import { type Directive, type Identity } from './types'
+import type { Parameter } from '../../RTD'
 
 export class Role implements Directive {
   public static remote: Component | null = null
   private readonly roles: string[]
   private readonly discovery: Promise<Component>
+  private readonly dynamic: boolean
 
   public constructor (roles: string | string[], discovery: Promise<Component>) {
     this.roles = typeof roles === 'string' ? [roles] : roles
     this.discovery = discovery
+    this.dynamic = this.roles.some((role) => role.includes('{'))
   }
 
   public static async set (identity: Identity, discovery: Promise<Component>): Promise<void> {
@@ -22,37 +26,41 @@ export class Role implements Directive {
     identity.roles = await this.remote.invoke('list', { query })
   }
 
-  public async authorize (identity: Identity | null): Promise<boolean> {
+  public async authorize
+  (identity: Identity | null, _: unknown, parameters: Parameter[]): Promise<boolean> {
     if (identity === null)
       return false
 
     await Role.set(identity, this.discovery)
 
-    if (identity.roles === undefined)
+    if (identity.roles!.length === 0) // Role.set()
+
       return false
 
-    return this.match(identity.roles)
+    return this.match(identity.roles!, parameters)
   }
 
-  private match (roles: string[]): boolean {
+  private match (roles: string[], parameters: Parameter[]): boolean {
+    const required = this.dynamic ? this.substitute(parameters) : this.roles
+
     for (const role of roles) {
-      const index = this.roles.findIndex((expected) => compare(expected, role))
+      const ok = required.some((expected) => expected === role || expected.startsWith(role + ':'))
 
-      if (index !== -1)
+      if (ok)
         return true
     }
 
     return false
   }
-}
 
-function compare (expected: string, actual: string): boolean {
-  const exp = expected.split(':')
-  const act = actual.split(':')
+  private substitute (parameters: Parameter[]): string[] {
+    return this.roles.map((role) => role.replaceAll(/{(\w+)}/g, (_, key) => {
+      const value = parameters.find((parameter) => parameter.name === key)?.value
 
-  for (let i = 0; i < act.length; i++)
-    if (exp[i] !== act[i])
-      return false
+      assert.ok(value !== undefined,
+        `Role '${role}' requires '${key}' route parameter`)
 
-  return true
+      return value
+    }))
+  }
 }

package/source/directives/auth/Scheme.ts

@@ -19,7 +19,7 @@ export class Scheme implements Directive {
 
     if (scheme !== this.scheme)
       throw new http.Forbidden(this.Scheme +
-        ' authentication scheme is required to access this resource.')
+        ' authentication scheme is required to access this resource')
 
     return false
   }

package/source/directives/auth/split.ts

@@ -5,7 +5,7 @@ export function split (authorization: string): [Scheme, string] {
   const space = authorization.indexOf(' ')
 
   if (space === -1)
-    throw new http.Unauthorized('Malformed authorization header.')
+    throw new http.Unauthorized('Malformed authorization header')
 
   const Scheme = authorization.slice(0, space)
   const scheme = Scheme.toLowerCase() as Scheme

package/source/directives/auth/types.ts

@@ -8,7 +8,7 @@ export interface Directive {
   authorize: (
     identity: Identity | null,
     input: Input,
-    parameters: Parameter[],
+    parameters: Parameter[]
   ) => boolean | Promise<boolean>
 
   reply?: (identity: Identity | null) => http.OutgoingMessage
@@ -18,7 +18,7 @@ export interface Directive {
 
 export interface Identity {
   readonly id: string
-  scheme: string
+  scheme: string | null // null for transient identities
   roles?: string[]
   refresh: boolean
 }

package/source/directives/cache/Cache.ts

@@ -1,19 +1,19 @@
 import { Control } from './Control'
 import { Exact } from './Exact'
-import type { Input, Output } from '../../io'
-import type { Directive } from './types'
+import type { Output } from '../../io'
+import type { AuthenticatedContext, Directive } from './types'
 import type { DirectiveFamily } from '../../RTD'
 import type * as http from '../../HTTP'
 
 export class Cache implements DirectiveFamily<Directive> {
   public readonly name: string = 'cache'
-  public readonly mandatory: boolean = false
+  public readonly mandatory: boolean = true
 
   public create (name: string, value: any): Directive {
     const Class = constructors[name]
 
     if (Class === undefined)
-      throw new Error(`Directive '${name}' is not provided by the '${this.name}' family.`)
+      throw new Error(`Directive 'cache:${name}' is not implemented`)
 
     return new Class(value)
   }
@@ -23,9 +23,16 @@ export class Cache implements DirectiveFamily<Directive> {
   }
 
   public async settle
-  (directives: Directive[], input: Input, response: http.OutgoingMessage): Promise<void> {
+  (directives: Directive[], context: AuthenticatedContext, response: http.OutgoingMessage): Promise<void> {
+    const directive = directives[0]
+
     response.headers ??= new Headers()
-    directives[0]?.set(input, response.headers)
+
+    if (directive === undefined) {
+      if (context.identity !== null && !Control.disabled(response.headers))
+        response.headers.set('cache-control', 'private')
+    } else
+      directive.set(context, response.headers)
   }
 }
 

package/source/directives/cache/Control.ts

@@ -4,56 +4,82 @@ import type { AuthenticatedContext, Directive } from './types'
 export class Control implements Directive {
   protected readonly value: string
   private cache: string | null = null
+  private vary: boolean = false
 
   public constructor (value: string) {
     this.value = value
   }
 
+  public static disabled (headers: Headers): boolean {
+    const value = headers.get('cache-control')
+
+    if (value === null)
+      return false
+
+    const directives = mask(value)
+
+    return (directives & NO_STORE) === NO_STORE
+  }
+
   public set (context: AuthenticatedContext, headers: Headers): void {
     if (!['GET', 'HEAD', 'OPTIONS'].includes(context.request.method))
       return
 
     this.cache ??= this.resolve(context)
 
+    if (Control.disabled(headers))
+      return
+
     headers.set('cache-control', this.cache)
+
+    if (this.vary !== null)
+      headers.append('vary', 'authorization')
   }
 
   protected resolve (request: AuthenticatedContext): string {
     if (request.identity === null)
       return this.value
 
-    const directives = this.mask()
+    const directives = mask(this.value)
+
+    if ((directives & PRIVATE) === PRIVATE)
+      this.vary = true
 
     if ((directives & (PUBLIC | NO_CACHE)) === PUBLIC)
       return 'no-cache, ' + this.value
 
-    if ((directives & (PUBLIC | PRIVATE)) === 0)
+    if ((directives & (PUBLIC | PRIVATE)) === 0) {
+      this.vary = true
+
       return 'private, ' + this.value
+    }
 
     return this.value
   }
+}
 
-  private mask (): number {
-    const directives = this.value.match(DIRECTIVES_RX)
+function mask (value: string): number {
+  const directives = value.match(DIRECTIVES_RX)
 
-    if (directives === null)
-      return 0
+  if (directives === null)
+    return 0
 
-    let mask = 0
+  let mask = 0
 
-    for (const directive of directives)
-      mask |= match<number>(directive,
-        'private', PRIVATE,
-        'public', PUBLIC,
-        'no-cache', NO_CACHE,
-        0)
+  for (const directive of directives)
+    mask |= match<number>(directive,
+      'private', PRIVATE,
+      'public', PUBLIC,
+      'no-cache', NO_CACHE,
+      'no-store', NO_STORE,
+      0)
 
-    return mask
-  }
+  return mask
 }
 
-const DIRECTIVES_RX = /\b(private|public|no-cache)\b/ig
+const DIRECTIVES_RX = /\b(private|public|no-cache|no-store)\b/ig
 
 const PUBLIC = 1
 const PRIVATE = 2
 const NO_CACHE = 4
+const NO_STORE = 8

package/source/directives/cors/CORS.ts

@@ -14,7 +14,7 @@ export class CORS implements Interceptor {
   ])
 
   private readonly headers = new Headers({
-    'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE',
+    'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE, LOCK, UNLOCK',
     'access-control-allow-credentials': 'true',
     'access-control-allow-headers': Array.from(this.requestHeaders).join(', '),
     'access-control-max-age': '3600',
@@ -34,6 +34,7 @@ export class CORS implements Interceptor {
     input.pipelines.response.push((output) => {
       output.headers ??= new Headers()
       output.headers.set('access-control-allow-origin', origin)
+      output.headers.set('access-control-allow-credentials', 'true')
       output.headers.set('access-control-expose-headers',
         'authorization, content-type, content-length, etag')
 

package/source/directives/dev/Development.ts

@@ -12,7 +12,7 @@ export class Development implements DirectiveFamily<Directive> {
     const Class = constructors[name]
 
     if (Class === undefined)
-      throw new Error(`Directive '${name}' is not provided by the '${this.name}' family.`)
+      throw new Error(`Directive 'dev:${name}' is not implemented`)
 
     return new Class(value)
   }

package/source/directives/flow/Compose.ts

@@ -0,0 +1,68 @@
+import { once } from 'node:events'
+import * as assert from 'node:assert'
+import { Readable } from 'node:stream'
+import { console } from 'openspan'
+import type { Directive } from './types'
+import type { Input as Context } from '../../io'
+import type { OutgoingMessage } from '../../HTTP'
+
+export class Compose implements Directive {
+  private readonly expression: Expression
+
+  public constructor (composition: any) {
+    this.expression = compile(composition as object)
+  }
+
+  public attach (context: Context): void {
+    context.pipelines.response.push(async (message: OutgoingMessage) => {
+      if (!(message.body instanceof Readable)) {
+        console.warn('Response body is not a stream, skipping composition')
+
+        return
+      }
+
+      assert.ok(message.body instanceof Readable, 'Response body is not a stream')
+
+      // @ts-expect-error -- objectMode is not defined in the type definition
+      assert.ok(message.body._readableState.objectMode, 'Response stream is not in object mode')
+
+      const $ = await this.compose(message.body)
+
+      message.body = this.expression($)
+    })
+  }
+
+  private async compose (stream: Readable): Promise<unknown[]> {
+    const $: unknown[] = []
+
+    stream.on('data', (data) => $.push(data))
+
+    await once(stream, 'end')
+
+    return $
+  }
+}
+
+function compile (composition: object): Expression {
+  // eslint-disable-next-line @typescript-eslint/no-implied-eval,no-new-func
+  return new Function('$', `return ${json(composition)}`) as Expression
+}
+
+function json (node: object | string): string {
+  if (typeof node === 'string')
+    if (node.startsWith('\\'))
+      return `"${node}"`
+    else
+      return node
+
+  if (Array.isArray(node))
+    return `[${node.map((v) => json(v as object | string)).join(',')}]`
+
+  if (node.constructor !== Object)
+    return JSON.stringify(node)
+
+  return '{' + Object.entries(node)
+    .map(([key, value]) => `"${key}": ${json(value as object | string)}`).join(',') + '}'
+}
+
+type Expression = ($: unknown[]) => unknown

package/source/directives/flow/Fetch.ts

@@ -0,0 +1,86 @@
+import { Readable } from 'node:stream'
+import assert from 'node:assert'
+import { match } from 'matchacho'
+import { NotFound } from '../../HTTP'
+import type { Directive } from './types'
+import type { ReadableStream } from 'node:stream/web'
+import type { Remotes } from '../../Remotes'
+import type { Maybe } from '@toa.io/types'
+import type { Component } from '@toa.io/core'
+import type { Output } from '../../io'
+import type { Input } from '../octets/types'
+import type { Parameter } from '../../RTD'
+
+export class Fetch implements Directive {
+  private readonly connecting: Promise<Component>
+  private remote: Component | null = null
+  private readonly operation: string
+
+  public constructor (endpoint: string, discovery: Remotes) {
+    assert.equal(typeof endpoint, 'string', '`flow:fetch` must be a string')
+
+    const [operation, name, namespace = 'default'] = endpoint.split('.').reverse()
+
+    this.operation = operation
+    this.connecting = discovery.discover(namespace, name)
+  }
+
+  public async apply (input: Input, parameters: Parameter[]): Promise<Output> {
+    if ('if-none-match' in input.request.headers)
+      return { status: 304 }
+
+    this.remote ??= await this.connecting
+
+    const request = await this.remote.invoke<Maybe<Request | string>>(this.operation, {
+      input: {
+        authority: input.authority,
+        path: input.request.url,
+        parameters: Object.fromEntries(parameters.map(({ name, value }) => [name, value]))
+      }
+    })
+
+    if (request instanceof Error)
+      throw new NotFound(request)
+
+    const { url, options } = match<Request>(request,
+      String, { url: request },
+      (request: Request): Request => ({
+        url: request.url,
+        options: {
+          method: request.options?.method ?? 'GET',
+          body: request.options?.body,
+          headers: request.options?.headers
+        }
+      }))
+
+    const response = await fetch(url, options)
+
+    if (!response.ok)
+      throw new NotFound()
+
+    const headers = new Headers()
+
+    for (const header of ['content-type', 'content-length', 'etag']) {
+      const value = response.headers.get(header)
+
+      if (value !== null)
+        headers.set(header, value)
+    }
+
+    return {
+      headers,
+      body: response.body === null ? null : Readable.fromWeb(response.body as ReadableStream)
+    }
+  }
+}
+
+interface Request {
+  url: string
+  options?: RequestOptions
+}
+
+interface RequestOptions {
+  method?: string
+  body?: string
+  headers?: Record<string, string>
+}

package/source/directives/flow/Flow.ts

@@ -0,0 +1,42 @@
+import { Fetch } from './Fetch'
+import { Compose } from './Compose'
+import type { Directive } from './types'
+import type { Input, Output } from '../../io'
+import type { DirectiveFamily, Parameter } from '../../RTD'
+import type { Remotes } from '../../Remotes'
+
+export class Flow implements DirectiveFamily<Directive> {
+  public readonly name: string = 'flow'
+  public readonly mandatory: boolean = false
+
+  public create (name: string, value: unknown, remotes: Remotes): Directive {
+    const Class = constructors[name]
+
+    if (Class === undefined)
+      throw new Error(`Directive '${this.name}:${name}' is not implemented`)
+
+    return new Class(value, remotes)
+  }
+
+  public async preflight (directives: Directive[], input: Input, parameters: Parameter[]): Promise<Output> {
+    for (const directive of directives) {
+      if (directive.attach !== undefined)
+        directive.attach(input)
+
+      if (directive.apply === undefined)
+        continue
+
+      const output = await directive.apply(input, parameters)
+
+      if (output !== null)
+        return output
+    }
+
+    return null
+  }
+}
+
+const constructors: Record<string, new (value: any, discovery: Remotes) => Directive> = {
+  fetch: Fetch,
+  compose: Compose
+}