@toa.io/extensions.exposition 1.0.0-alpha.14 → 1.0.0-alpha.143

package/features/auth.incept.feature

@@ -0,0 +1,120 @@
+Feature: Identity inception
+
+  Scenario: Non-associated Identity inception
+    Given the `identity.basic` database is empty
+    When the following request is received:
+      """
+      POST /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjpwYXNzMTIzNA==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ id }}
+      roles: []
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjpwYXNzMTIzNA==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ id }}
+      roles: []
+      """
+
+  Scenario: Creating new Identity using inception with Basic scheme
+    Given the `users` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            io:input: [name]
+            io:output: true
+            incept: id
+            query: ~
+            endpoint: transit
+      """
+    When the following request is received:
+      """
+      POST /users/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic }}
+      accept: application/yaml
+      content-type: application/yaml
+
+      name: Bill Smith
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ id }}
+      """
+
+  Scenario: Inception with operation error
+    Given the `users` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            io:input: [name]
+            io:output: true
+            incept: id
+            endpoint: create
+      """
+    When the following request is received:
+      """
+      POST /users/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic }}
+      accept: application/yaml
+      content-type: application/yaml
+
+      name: return_error
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """
+
+  Scenario: Incept without credentials
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            auth:incept: id
+            io:output: true
+            query: ~
+            endpoint: echo
+      """
+    And transient identity
+    When the following request is received:
+      """
+      POST /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      content-type: application/yaml
+
+      id: ${{ identity.id }}
+      foo: bar
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ identity.id }}
+      foo: bar
+      """

package/features/auth.input.feature

@@ -0,0 +1,59 @@
+Feature: Input properties authorization
+
+  Background:
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username | password                                                     |
+      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | root     | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role  |
+      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | app:b |
+
+  Scenario: Input properties authorization
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:input: [a, b]
+          io:output: [a, b]
+          anonymous: true
+          auth:role: app:b
+          auth:input:
+            - prop: b
+              role: app:b
+          PUT: parameters
+      """
+
+    When the following request is received:
+      """
+      PUT /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      content-type: application/yaml
+
+      a: foo
+      b: bar
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+
+      Input property is not authorized
+      """
+    When the following request is received:
+      """
+      PUT /echo/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic cm9vdDpzZWNyZXQ=
+      accept: application/yaml
+      content-type: application/yaml
+
+      a: foo
+      b: bar
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      a: foo
+      b: bar
+      """

package/features/auth.issue.feature

@@ -0,0 +1,32 @@
+Feature: Issue authentication token for a response
+
+  Scenario: Issue token
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            auth:issue: id
+            io:output: true
+            query: ~
+            endpoint: echo
+      """
+    And transient identity
+    When the following request is received:
+      """
+      POST /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      content-type: application/yaml
+
+      id: ${{ identity.id }}
+      foo: bar
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ identity.id }}
+      foo: bar
+      """

package/features/authorities.basic.feature

@@ -0,0 +1,141 @@
+Feature: Basic credentials with authorities
+
+  Scenario: Basic credentials are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+        two: the.two.com
+      /:
+        /:id:
+          auth:id: id
+          io:output: true
+          GET:
+            dev:stub: Hello
+      """
+
+    # create basic credentials within the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set one.username }}
+      password: #{{ password 8 | set one.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ one.id }}
+      """
+
+    # create basic credentials within the `two` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set two.username }}
+      password: #{{ password 8 | set two.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ two.id }}
+      """
+
+    # access the resource with the `one` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # access the resource with the `two` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+    # create `one` credentials in the `two` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ one.username }}
+      password: ${{ one.password }}
+      """
+    Then the following reply is sent:
+      """
+      409 Conflict
+      """
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ one.username }}
+      password: ${{ one.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+
+    # create `two` credentials in the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ two.username }}
+      password: ${{ two.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """

package/features/authorities.feature

@@ -0,0 +1,32 @@
+Feature: Authorities
+
+  Scenario: Accessing an authority
+    Given the annotation:
+      """yaml
+      authorities:
+        example: the.example.com
+      /:
+        anonymous: true
+        GET:
+          dev:stub: Hello
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: the.example.com
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+    # arbitrary authorities are also allowed
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: the.other.com
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/authorities.federation.feature

@@ -0,0 +1,100 @@
+Feature: OIDC tokens with authorities
+
+  Background:
+    Given local IDP is running
+    And the `identity.federation` database is empty
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      implicit: true
+      """
+
+
+  Scenario: OIDC tokens are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+      /:
+        /:id:
+          auth:id: id
+          GET:
+            dev:stub: Hello
+      """
+    And the IDP token for One is issued
+    And the IDP token for Two is issued
+
+    # create identities
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: the.one.com
+      authorization: Bearer ${{ One.id_token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ One.id }}
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      authorization: Bearer ${{ Two.id_token }}
+      host: the.two.com
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ Two.id }}
+      """
+
+    # access `one` authority
+    When the following request is received:
+      """
+      GET /${{ One.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Bearer ${{ One.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+    # authorization will create new identity within `one` authority
+    When the following request is received:
+      """
+      GET /${{ Two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Bearer ${{ Two.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+    # access `two` authority
+    When the following request is received:
+      """
+      GET /${{ One.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Bearer ${{ One.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+    When the following request is received:
+      """
+      GET /${{ Two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Bearer ${{ Two.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/authorities.tokens.feature

@@ -0,0 +1,117 @@
+Feature: Token credentials with authorities
+
+  Scenario: Tokens are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+      /:
+        /:id:
+          auth:id: id
+          GET:
+            dev:stub: Hello
+      """
+
+    # create identity within the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set one.username }}
+      password: '#{{ password 8 | set one.password }}'
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: the.one.com
+      accept: application/yaml
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ one.token }}
+
+      id: ${{ one.id }}
+      """
+
+    # create identity within the `the.two.com` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set two.username }}
+      password: '#{{ password 8 | set two.password }}'
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: the.two.com
+      accept: application/yaml
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ two.token }}
+
+      id: ${{ two.id }}
+      """
+
+    # access `one` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Token ${{ one.token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Token ${{ two.token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # access `two` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Token ${{ one.token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Token ${{ two.token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/body.feature

@@ -11,6 +11,7 @@ Feature: Request body
     When the following request is received:
       """
       POST /pots/ HTTP/1.1
+      host: nex.toa.io
       content-type: application/yaml
 
       title: Hello
@@ -32,6 +33,7 @@ Feature: Request body
     When the following request is received:
       """
       GET /echo/world/ HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
       """
     Then the following reply is sent: