@toa.io/extensions.exposition 1.0.0-alpha.15 → 1.0.0-alpha.150

package/features/map.feature

@@ -0,0 +1,304 @@
+Feature: HTTP context mapping
+
+  Scenario Outline: Mapping `<result>` language code
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          map:languages: [en, fr]
+          GET:
+            map:language: name # map resolved language code to the `name` property of the operation input
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      accept-language: <accept>
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+      content-language: <result>
+      vary: accept-language, accept
+
+      Hello <result>
+      """
+    Examples:
+      | accept | result |
+      | en     | en     |
+      | en_US  | en     |
+      | fr     | fr     |
+      | sw     | en     |
+
+  Scenario: Listing languages on the root
+    Given the annotation:
+    """
+    /:
+      languages: [en, fr]
+    """
+    And the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          GET:
+            anonymous: true
+            map:language: name
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept-language: fr
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-language: fr
+      """
+
+  Scenario: Headers used by mappings are added to CORS permissions
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          map:languages: [en, fr]
+          GET:
+            map:language: name
+            map:headers:
+              name: foo
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      OPTIONS / HTTP/1.1
+      host: nex.toa.io
+      origin: https://example.com
+      """
+    Then the following reply is sent:
+      """
+      204 No Content
+      access-control-allow-headers: accept, authorization, content-type, etag, if-match, if-none-match, accept-language, foo
+      """
+
+  Scenario: Mapping the value of an arbitrary header
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          GET:
+            map:headers:
+              name: foo
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      foo: bar
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+      vary: foo, accept
+
+      Hello bar
+      """
+
+  Scenario: Mapping the `host` header value
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          GET:
+            map:headers:
+              name: host
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      foo: bar
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+      vary: accept
+
+      Hello nex.toa.io
+      """
+
+  Scenario: Mapping a route parameter
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:friend:
+          io:output: true
+          GET:
+            map:segments:
+              name: ~friend
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      GET /echo/Ken/ HTTP/1.1
+      host: nex.toa.io
+      accept: text/plain
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      Hello Ken
+      """
+
+  Scenario: Mapping the authority
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+      """
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          GET:
+            io:output: true
+            map:authority: name
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      host: the.one.com
+      accept: text/plain
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      Hello one
+      """
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      host: the.two.com
+      accept: text/plain
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      Hello the.two.com
+      """
+
+  Scenario: Mapping OIDC token claims
+    Given local IDP is running
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+    And the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          GET:
+            anyone: true
+            io:output: true
+            map:claims:
+              name: email
+            endpoint: compute
+      """
+    And the IDP token for Alice is issued
+
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      authorization: Bearer ${{ Alice.id_token }}
+      host: the.two.com
+      accept: text/plain
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      Hello Alice@test.local
+      """
+
+  Scenario: Mapping Bearer token claims during inception
+    Given local IDP is running
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+    And the `pots` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            auth:incept: id
+            io:input: [title, volume]
+            io:output: [id, title, volume]
+            map:claims:
+              title: email
+            endpoint: create
+      """
+    And the IDP random token is issued
+
+    When the following request is received:
+      """
+      POST /pots/ HTTP/1.1
+      host: the.two.com
+      authorization: Bearer ${{ random.id_token }}
+      accept: application/yaml
+      content-type: application/yaml
+
+      volume: 1.5
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ id }}
+      title: ${{ random.email }}
+      volume: 1.5
+      """
+
+  Scenario: Mapping non-exposed properties
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          GET:
+            io:output: true
+            io:input: [] # disallow input
+            map:authority: name
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      host: the.one.com
+      accept: text/plain
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      Hello the.one.com
+      """

package/features/methods.feature

@@ -0,0 +1,47 @@
+Feature: Supported methods
+
+  Scenario Outline: <method> is supported
+    Given the annotation:
+      """yaml
+      /:
+        <method>:
+          dev:stub:
+            hello: world
+      """
+    And the `greeter` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          <method>:
+            dev:stub:
+              hello: world
+      """
+    Examples:
+      | method |
+      | GET    |
+      | POST   |
+      | PUT    |
+      | DELETE |
+      | PATCH  |
+      | LOCK   |
+      | UNLOCK |
+
+  Scenario: CORS allowed methods
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          dev:stub:
+            hello: world
+      """
+    When the following request is received:
+      """
+      OPTIONS / HTTP/1.1
+      host: nex.toa.io
+      origin: https://hello.world
+      """
+    Then the following reply is sent:
+      """
+      204 No Content
+      access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, LOCK, UNLOCK
+      """

package/features/octets.cloudinary.feature

@@ -0,0 +1,71 @@
+Feature: Octets with Cloudinary storage
+
+  Background:
+    Given the annotation:
+      """yaml
+      /:
+        io:output: true
+        auth:anonymous: true
+        octets:context: cloudinary
+        POST:
+          octets:put: ~
+        /*:
+          GET:
+            octets:get: ~
+          DELETE:
+            octets:delete: ~
+      """
+
+  Scenario: Upload an image
+    When the stream of `lenna.png` is received with the following headers:
+      """
+      POST / HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      content-type: application/octet-stream
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/yaml
+
+      id: ${{ id }}
+      type: image/png
+      size: 473831
+      """
+    When the following request is received:
+      """
+      GET /${{ id }} HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the stream equals to `lenna.png` is sent with the following headers:
+      """
+      200 OK
+      content-type: image/png
+      content-length: 473831
+      """
+
+  Scenario: Image transformations
+    When the stream of `lenna.png` is received with the following headers:
+      """
+      POST / HTTP/1.1
+      host: nex.toa.io
+      content-type: image/png
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ id }}
+      """
+    When the following request is received:
+      """
+      GET /${{ id }}.48x48.jpeg HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the stream equals to `lenna.48x48.jpeg` is sent with the following headers:
+      """
+      200 OK
+      content-type: image/jpeg
+      """

package/features/octets.download.feature

@@ -0,0 +1,189 @@
+Feature: Download external resources
+
+  Scenario Outline: Download from trusted location defined as <type>
+    Given the annotation:
+      """yaml
+      /:
+        io:output: true
+        auth:anonymous: true
+        octets:context: octets
+        POST:
+          octets:put:
+            trust:
+              - <location> # <type>
+              - https://github.com
+        /*:
+          GET:
+            octets:get:
+              meta: true
+      """
+
+    When the following request is received:
+      """
+      POST / HTTP/1.1
+      host: nex.toa.io
+      content-location: https://avatars.githubusercontent.com/u/92763022?s=48&v=4
+      content-length: 0
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ id }}
+      type: image/png
+      """
+
+    When the following request is received:
+      """
+      GET /${{ id }} HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: image/png
+      content-length: 1288
+      etag: "${{ id }}"
+      """
+
+    # origin is stored in the entry
+    When the following request is received:
+      """
+      GET /${{ id }} HTTP/1.1
+      host: nex.toa.io
+      accept: application/vnd.toa.octets.entry+yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      id: ${{ id }}
+      type: image/png
+      origin: https://avatars.githubusercontent.com/u/92763022?s=48&v=4
+      """
+
+    # untrusted location
+    When the following request is received:
+      """
+      POST / HTTP/1.1
+      host: nex.toa.io
+      content-location: https://github.githubassets.com/assets/yolo-default-be0bbff04951.png
+      content-length: 0
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+
+      Location is not trusted
+      """
+
+    # content-length must be 0
+    When the following request is received:
+      """
+      POST / HTTP/1.1
+      host: nex.toa.io
+      content-location: https://avatars.githubusercontent.com/u/92763022?s=48&v=4
+      content-length: 1
+      accept: application/yaml
+
+      1
+      """
+    Then the following reply is sent:
+      """
+      400 Bad Request
+
+      Content-Length must be 0 when Content-Location is used
+      """
+
+    # invalid content-location
+    When the following request is received:
+      """
+      POST / HTTP/1.1
+      host: nex.toa.io
+      content-location: Hello there!
+      content-length: 0
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+
+      Location is not trusted
+      """
+
+    # unavailable location
+    When the following request is received:
+      """
+      POST / HTTP/1.1
+      host: nex.toa.io
+      content-location: https://github.com/toa-io/no
+      content-length: 0
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      404 Not Found
+
+      Location is not available
+      """
+
+    Examples:
+      | type       | location                                   |
+      | origin     | https://avatars.githubusercontent.com      |
+      | expression | /^https://avatars\.githubusercontent\.com/ |
+
+  Scenario: Download size limit
+    Given the annotation:
+      """yaml
+      /:
+        io:output: true
+        auth:anonymous: true
+        octets:context: octets
+        POST:
+          octets:put:
+            limit: 1kb
+            trust:
+              - https://avatars.githubusercontent.com
+      """
+    When the following request is received:
+      """
+      POST / HTTP/1.1
+      host: nex.toa.io
+      content-location: https://avatars.githubusercontent.com/u/92763022?s=48&v=4
+      content-length: 0
+      accept: text/plain
+      """
+    Then the following reply is sent:
+      """
+      413 Request Entity Too Large
+
+      Size limit is 1kb
+      """
+
+  Scenario: Allow `content-location` request header
+    Given the annotation:
+      """yaml
+      /:
+        io:output: true
+        auth:anonymous: true
+        octets:context: octets
+        POST:
+          octets:put:
+            limit: 1kb
+            trust:
+              - https://avatars.githubusercontent.com
+      """
+    When the following request is received:
+      """
+      OPTIONS / HTTP/1.1
+      host: nex.toa.io
+      origin: https://hello.world
+      """
+    Then the following reply is sent:
+      """
+      204 No Content
+      access-control-allow-headers: accept, authorization, content-type, etag, if-match, if-none-match, content-attributes, content-location
+      """