@toa.io/extensions.exposition 1.0.0-alpha.19 → 1.0.0-alpha.190

package/features/identity.tokens.feature

@@ -3,8 +3,8 @@ Feature: Tokens lifecycle
 
   Scenario: Switching to Token authentication scheme
     Given the `identity.basic` database contains:
-      | _id                              | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
     Given the annotation:
       """yaml
       /:
@@ -17,6 +17,7 @@ Feature: Tokens lifecycle
     When the following request is received:
       """
       GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
       authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
       accept: text/plain
       """
@@ -46,6 +47,7 @@ Feature: Tokens lifecycle
     When the following request is received:
       """
       GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
       authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
       accept: text/plain
       """
@@ -53,6 +55,7 @@ Feature: Tokens lifecycle
       """
       200 OK
       authorization: Token ${{ token }}
+      cache-control: no-store
 
       Hello
       """
@@ -60,6 +63,7 @@ Feature: Tokens lifecycle
     When the following request is received:
       """
       GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
       authorization: Token ${{ token }}
       accept: text/plain
       """
@@ -88,11 +92,12 @@ Feature: Tokens lifecycle
       refresh: 0.1
       """
     And the `identity.basic` database contains:
-      | _id                              | _version | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | 1        | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | _id                              | _version | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | 1        | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
     When the following request is received:
       """
       GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
       authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
       """
     Then the following reply is sent:
@@ -103,6 +108,7 @@ Feature: Tokens lifecycle
     When the following request is received:
       """
       PATCH /identity/basic/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
       authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
       content-type: application/yaml
 
@@ -116,102 +122,10 @@ Feature: Tokens lifecycle
     When the following request is received:
       """
       GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
       authorization: Token ${{ token }}
       """
     Then the following reply is sent:
       """
       401 Unauthorized
       """
-
-  Scenario: Issuing own token
-    Given the `identity.basic` database contains:
-      | _id                              | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      """
-    When the following request is received:
-      """
-      POST /identity/tokens/ HTTP/1.1
-      authorization: Token ${{ token }}
-      content-type: application/yaml
-
-      lifetime: 0
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """
-    # Token scheme must be used
-    When the following request is received:
-      """
-      POST /identity/tokens/ HTTP/1.1
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-
-      lifetime: 60
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: Responses with tokens comes with `no-store`
-    Given the `identity.tokens` configuration:
-      """yaml
-      refresh: 1
-      """
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        /hello/:id:
-          auth:id: id
-          GET:
-            dev:stub: Hello
-        /cacheable/:id:
-          auth:id: id
-          cache:control: max-age=10000
-          GET:
-            dev:stub: Keep it
-      """
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      cache-control: no-store
-      """
-    Then after 1 second
-    When the following request is received:
-      """
-      GET /cacheable/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ fresh_token }}
-      cache-control: no-store
-      """
-    When the following request is received:
-      """
-      GET /cacheable/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      authorization: Token ${{ fresh_token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: private, max-age=10000
-      """

package/features/identtiy.tokens.custom.feature

@@ -0,0 +1,247 @@
+@security
+Feature: Custom tokens
+
+  Background:
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role      |
+      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | efe3a65ebbee47ed95a73edd911ea328 | app:notes |
+    And the `identity.keys` database is empty
+    And the annotation:
+      """yaml
+      /:
+        /notes:
+          auth:role: app:notes
+          GET:
+            io:output: true
+            dev:stub:
+              access: granted!
+          POST:
+            io:output: true
+            dev:stub:
+              access: granted!
+          /public:
+            GET:
+              auth:role: app:notes:public
+              io:output: true
+              dev:stub:
+                access: granted!
+      """
+
+  Scenario: Issuing a token
+    When the following request is received:
+      """
+      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+      accept: application/yaml
+
+      label: Dev token
+      lifetime: 600
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      kid: ${{ kid }}
+      exp: ${{ exp }}
+      token: ${{ token }}
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: efe3a65ebbee47ed95a73edd911ea328
+      """
+
+    # debug LRU cache
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: Token with restricted scopes
+    When the following request is received:
+      """
+      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      label: Production token
+      lifetime: 0
+      scopes: [app:notes:public]
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      token: ${{ token }}
+      """
+    When the following request is received:
+      """
+      GET /notes/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+    When the following request is received:
+      """
+      GET /notes/public/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: Token with restricted permissions
+    When the following request is received:
+      """
+      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      label: Restricted token
+      lifetime: 0
+      permissions: {
+        /notes/: [GET]
+      }
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      token: ${{ token }}
+      """
+    When the following request is received:
+      """
+      GET /notes/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+    # method is not permitted
+    When the following request is received:
+      """
+      POST /notes/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+    # resource is not permitted
+    When the following request is received:
+      """
+      GET /notes/public/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Token revocation
+    Given the `identity.tokens` configuration:
+      """yaml
+      cache:
+        ttl: 1
+      """
+    When the following request is received:
+      """
+      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      label: One-time token
+      lifetime: 60
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      token: ${{ token }}
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: efe3a65ebbee47ed95a73edd911ea328
+      """
+    When the following request is received:
+      """
+      GET /identity/keys/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      - id: ${{ kid }}
+        label: One-time token
+        expires: ${{ expires }}
+        _created: ${{ created }}
+      """
+    When the following request is received:
+      """
+      DELETE /identity/keys/efe3a65ebbee47ed95a73edd911ea328/${{ kid }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    And after 1 second
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """

package/features/interruptions.feature

@@ -0,0 +1,19 @@
+Feature: Request interruptions
+
+  Scenario: Connection reset while processing a request
+    Given the annotation:
+      """yaml
+      /:
+        io:output: true
+        anonymous: true
+        dev:sleep: 3000
+        GET:
+          dev:stub: hello
+      """
+    When the following request is interrupted after 1 second:
+      """
+      GET / HTTP/1.1
+      sleep: 2000
+      """
+    Then after 2 seconds
+    And the process is running

package/features/introspection.feature

@@ -0,0 +1,153 @@
+Feature: Introspection
+
+  Scenario: Resource introspection
+    Given the `pots` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          GET: enumerate
+          POST: create
+      """
+    When the following request is received:
+      """
+      OPTIONS /pots/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      Allow: GET, POST
+
+      GET:
+        type: array
+        items:
+          type: object
+          properties:
+            id:
+              type: string
+              pattern: ^[a-fA-F0-9]{32}$
+            title:
+              type: string
+              maxLength: 64
+            volume:
+              type: number
+              exclusiveMinimum: 0
+              maximum: 1000
+            temperature:
+              type: number
+              exclusiveMinimum: 0
+              maximum: 300
+          additionalProperties: false
+          required:
+            - id
+            - title
+            - volume
+      POST:
+        input:
+          type: object
+          properties:
+            title:
+              type: string
+              maxLength: 64
+            temperature:
+              type: number
+              exclusiveMinimum: 0
+              maximum: 300
+            volume:
+              type: number
+              exclusiveMinimum: 0
+              maximum: 1000
+          additionalProperties: false
+          required:
+            - title
+            - volume
+        output:
+          type: object
+          properties:
+            id:
+              type: string
+              pattern: ^[a-fA-F0-9]{32}$
+          additionalProperties: false
+        errors:
+          - NO_WAY
+          - WONT_CREATE
+      """
+
+  Scenario: Introspection with route parameters
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:a:
+          io:output: true
+          PATCH: parameters
+      """
+    When the following request is received:
+      """
+      OPTIONS /echo/:a/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      Allow: PATCH
+
+      PATCH:
+        route:
+          a:
+            type: string
+        input:
+          type: object
+          properties:
+            b:
+              type: string
+        output:
+          type: object
+          properties:
+            a:
+              type: string
+            b:
+              type: string
+      """
+
+  Scenario: Introspection with query parameters
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          PATCH:
+            query:
+              parameters: [a]
+            endpoint: parameters
+      """
+    When the following request is received:
+      """
+      OPTIONS /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      Allow: PATCH
+
+      PATCH:
+        query:
+          a:
+            type: string
+        input:
+          type: object
+          properties:
+            b:
+              type: string
+        output:
+          type: object
+          properties:
+            a:
+              type: string
+            b:
+              type: string
+      """

package/features/io.feature

@@ -19,6 +19,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
+      host: nex.toa.io
       """
     Then the following reply is sent:
       """
@@ -28,6 +29,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       GET /pots/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent:
@@ -47,7 +49,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
-      accept: application/yaml
+      host: nex.toa.io
       """
     Then the following reply is sent:
       """
@@ -68,6 +70,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent:
@@ -85,6 +88,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       GET /pots/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent:
@@ -114,6 +118,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       POST /pots/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       content-type: application/yaml
 
@@ -142,6 +147,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       POST /pots/ HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
       content-type: application/yaml
 
@@ -158,6 +164,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       POST /pots/ HTTP/1.1
+      host: nex.toa.io
       content-type: application/yaml
 
       title: Hello
@@ -180,6 +187,7 @@ Feature: IO restrictions
     When the following request is received:
       """
       POST /pots/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       content-type: application/yaml
 

package/features/io.throttle.feature

@@ -0,0 +1,40 @@
+Feature: Request throttling
+
+  Scenario: Throttle requests to a path
+    Given the `echo.beacon` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:throttle:
+            key: [path]
+            requests: 1
+            interval: 1
+            cooldown: 1
+          GET:
+            endpoint: hello
+      """
+    When the following request is received:
+      """
+      GET /echo/beacon/ HTTP/1.1
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET /echo/beacon/ HTTP/1.1
+      """
+    Then the following reply is sent:
+      """
+      429 Too Many Requests
+      """
+    Then after 1 second
+    When the following request is received:
+      """
+      GET /echo/beacon/ HTTP/1.1
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """