@toa.io/extensions.exposition 1.0.0-alpha.2 → 1.0.0-alpha.200

package/features/steps/Database.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, binding, given } from 'cucumber-tsflow'
-import { type DataTable } from '@cucumber/cucumber'
 import { MongoClient } from 'mongodb'
+import type { Collection } from 'mongodb'
+import type { DataTable } from '@cucumber/cucumber'
 
 @binding()
 export class Database {
@@ -8,9 +9,7 @@ export class Database {
 
   @given('the `{word}` database contains:')
   public async upsert (id: string, table: DataTable): Promise<void> {
-    const [name, namespace = 'default'] = id.split('.').reverse()
-    const collection = Database.client.db(namespace).collection(name)
-
+    const collection = this.collection(id)
     const columns = table.raw()[0]
     const rows = table.rows()
     const documents: Document[] = []
@@ -22,7 +21,11 @@ export class Database {
         const str = rows[r][c]
         const int = parseInt(str)
 
-        document[columns[c]] = int.toString() === str ? int : str
+        document[columns[c]] = int.toString() === str
+          ? int
+          : str === 'null'
+            ? null
+            : str
       }
 
       documents.push(document)
@@ -36,10 +39,7 @@ export class Database {
 
   @given('the `{word}` database is empty')
   public async truncate (id: string): Promise<void> {
-    const [name, namespace = 'default'] = id.split('.').reverse()
-    const collection = Database.client.db(namespace).collection(name)
-
-    await collection.deleteMany({})
+    await this.collection(id).deleteMany({})
   }
 
   @beforeAll()
@@ -53,6 +53,13 @@ export class Database {
   public static async disconnect (): Promise<void> {
     await this.client.close()
   }
+
+  private collection (id: string): Collection {
+    const [name, namespace = 'default'] = id.split('.').reverse()
+    const collection = `${namespace}_${name}`.toLowerCase()
+
+    return Database.client.db('toa-dev').collection(collection)
+  }
 }
 
-type Document = Record<string, string | number>
+type Document = Record<string, string | number | null>

package/features/steps/Gateway.ts

@@ -6,6 +6,7 @@ import { encode, timeout } from '@toa.io/generic'
 import { Factory } from '../../source'
 import * as syntax from '../../source/RTD/syntax'
 import { shortcuts } from '../../source/Directive'
+import type * as http from '../../source/HTTP'
 
 let instance: Connector | null = null
 
@@ -23,8 +24,19 @@ export class Gateway {
       process.env.TOA_EXPOSITION = encode(tree)
     }
 
-    if (annotation.debug === true)
-      process.env.TOA_EXPOSITION_DEBUG = '1'
+    const { debug, trace, authorities } = annotation
+    const properties = Object.assign({}, DEFAULT_PROPERTIES)
+
+    if (debug !== undefined)
+      properties.debug = debug
+
+    if (trace !== undefined)
+      properties.trace = trace
+
+    if (authorities !== undefined)
+      properties.authorities = authorities
+
+    process.env.TOA_EXPOSITION_PROPERTIES = encode(properties)
 
     await Gateway.stop()
 
@@ -51,7 +63,8 @@ export class Gateway {
     if (instance !== null)
       return
 
-    process.env.TOA_EXPOSITION ??= DEFAULT_ANNOTATION
+    process.env.TOA_EXPOSITION ??= DEFAULT_TREE
+    process.env.TOA_EXPOSITION_PROPERTIES ??= encode(DEFAULT_PROPERTIES)
 
     this.writeConfiguration()
 
@@ -73,6 +86,7 @@ export class Gateway {
       return
 
     delete process.env.TOA_EXPOSITION
+    delete process.env.TOA_EXPOSITION_PROPERTIES
 
     await Gateway.stop()
   }
@@ -93,7 +107,7 @@ export class Gateway {
   }
 }
 
-const DEFAULT_ANNOTATION = encode({
+const DEFAULT_TREE = encode({
   routes: [],
   methods: [],
   directives: [
@@ -105,8 +119,16 @@ const DEFAULT_ANNOTATION = encode({
   ]
 } satisfies syntax.Node)
 
+const DEFAULT_PROPERTIES: Partial<http.Options> = {
+  authorities: {
+    nex: 'nex.toa.io'
+  }
+}
+
 const DEFAULT_CONFIGURATION: Record<string, object> = {
   'identity.tokens': {
-    key0: 'k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA'
+    keys: {
+      0: 'k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA'
+    }
   }
 }

package/features/steps/HTTP.ts

@@ -36,7 +36,7 @@ export class HTTP extends http.Agent {
     assert.ok(this.fetched !== null, 'Response is null')
 
     const buf = await this.fetched.arrayBuffer()
-    const value = encoders[format]?.(buf as Buffer)
+    const value = encoders[format]?.(buf as unknown as Buffer)
     const expected = YAML.load(yaml)
 
     assert.deepEqual(value, expected, 'Values are not equal')
@@ -61,12 +61,35 @@ export class HTTP extends http.Agent {
 
     await super.streamMatch(head, stream)
   }
+
+  @when('the following request is interrupted after {float} second(s):')
+  public async interrupt (delay: number, input: string): Promise<any> {
+    const controller = new AbortController()
+
+    await this.gateway.start()
+
+    setTimeout(() => {
+      if (pending)
+        controller.abort()
+      else
+        console.error('Request cannot be interrupted as it is already completed')
+    }, delay * 1000)
+
+    let pending = true
+
+    await super.fetch(input, { signal: controller.signal }).catch((e) => {
+      if (e.name !== 'AbortError')
+        throw e
+    })
+
+    pending = false
+  }
 }
 
-const FILEDIR = path.resolve(__dirname, '../../../storages/source/test')
+const FILES_DIR = path.resolve(__dirname, '../../../storages/source/test')
 
 function open (filename: string): Readable {
-  return fs.createReadStream(path.join(FILEDIR, filename))
+  return fs.createReadStream(path.join(FILES_DIR, filename))
 }
 
 const encoders: Record<string, (buf: Buffer | Uint8Array) => any> = {

package/features/steps/IDP.ts

@@ -0,0 +1,334 @@
+import { once } from 'node:events'
+import * as crypto from 'node:crypto'
+import * as http from 'node:http'
+import * as assert from 'node:assert'
+import * as util from 'node:util'
+import { buffer } from 'node:stream/consumers'
+import { binding, given, afterAll } from 'cucumber-tsflow'
+import { Captures } from './Captures'
+
+import type { AddressInfo } from 'node:net'
+
+@binding([Captures])
+export class IDP {
+  private static server?: http.Server
+  private static privateKey?: crypto.KeyObject
+  private static issuer?: string
+  private static authCodes = new Map<string, AuthCode>()
+  private readonly captures: Captures
+
+  public constructor (captures: Captures) {
+    this.captures = captures
+  }
+
+  @afterAll()
+  public static async stop (): Promise<void> {
+    if (this.server instanceof http.Server) {
+      this.server.close()
+      await once(this.server, 'close')
+    }
+  }
+
+  @given(/local IDP is running/i)
+  public async start (): Promise<void> {
+    if (IDP.server instanceof http.Server) return
+
+    // creating the key
+    const {
+      publicKey,
+      privateKey
+    } = await util.promisify(crypto.generateKeyPair)('rsa', {
+      modulusLength: 2048
+    })
+
+    IDP.privateKey = privateKey
+
+    const jwk = JSON.stringify({
+      keys: [{
+        use: 'sig',
+        alg: 'RS256',
+        ...publicKey.export({ format: 'jwk' })
+      }]
+    })
+
+    const JWK_ENDPOINT = '/.well-known/jwks'
+    const TOKEN_ENDPOINT = '/token'
+    const AUTH_ENDPOINT = '/authorize'
+
+    const server = http.createServer(async (request, response) => {
+      switch (request.url) {
+        case JWK_ENDPOINT:
+          response.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Content-Length': jwk.length,
+            'Cache-Control': 'no-cache, no-store, must-revalidate',
+            Pragma: 'no-cache',
+            Expires: '0'
+          })
+          response.end(jwk)
+          break
+
+        case '/.well-known/openid-configuration': {
+          const openIdConfiguration = JSON.stringify({
+            issuer: IDP.issuer,
+            jwks_uri: IDP.issuer + JWK_ENDPOINT,
+            authorization_endpoint: IDP.issuer + AUTH_ENDPOINT,
+            token_endpoint: IDP.issuer + TOKEN_ENDPOINT,
+            response_types_supported: ['id_token', 'code'],
+            grant_types_supported: ['authorization_code'],
+            subject_types_supported: ['public'],
+            id_token_signing_alg_values_supported: ['RS256'],
+            scopes_supported: ['openid', 'email', 'profile']
+          })
+
+          response.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'public, max-age=3600',
+            'Content-Length': openIdConfiguration.length
+          })
+
+          response.end(openIdConfiguration)
+        }
+
+          break
+
+        case TOKEN_ENDPOINT: {
+          if (request.method !== 'POST') {
+            response.writeHead(405, { 'Content-Type': 'text/plain' })
+            response.end('Method not allowed')
+
+            return
+          }
+
+          const buf = await buffer(request)
+          const body = buf.toString('utf8')
+
+          const params = new URLSearchParams(body)
+          const grantType = params.get('grant_type')!
+          const code = params.get('code')!
+          const redirectUri = params.get('redirect_uri')!
+          const clientId = params.get('client_id')!
+
+          if (grantType !== 'authorization_code' || !code || !clientId) {
+            response.writeHead(400, { 'Content-Type': 'application/json' })
+            response.end(JSON.stringify({ error: 'invalid_request' }))
+          }
+
+          const codeData = IDP.authCodes.get(code)
+
+          if (!codeData ||
+            codeData.expiresAt < Date.now() ||
+            codeData.clientId !== clientId ||
+            (redirectUri && codeData.redirectUri !== redirectUri)) {
+            response.writeHead(400, { 'Content-Type': 'application/json' })
+            response.end(JSON.stringify({ error: 'invalid_grant' }))
+
+            return
+          }
+
+          const accessToken = crypto.randomBytes(32).toString('hex')
+          const idToken = this.generateIdToken(codeData.sub, codeData.email, clientId)
+
+          IDP.authCodes.delete(code)
+
+          response
+            .writeHead(200, { 'Content-Type': 'application/json' })
+            .end(JSON.stringify({
+              access_token: accessToken,
+              token_type: 'Bearer',
+              id_token: idToken,
+              expires_in: 3600
+            }))
+        }
+
+          break
+
+        default:
+          response.writeHead(404, 'Not found')
+          response.end()
+      }
+    })
+
+    server.listen(44444, 'localhost')
+    await once(server, 'listening')
+
+    const address = server.address() as AddressInfo
+
+    console.log('IdP is listening on %s:%s', address.address, address.port)
+    IDP.server = server
+    IDP.issuer = `http://localhost:${address.port}`
+  }
+
+  @given('the IDP token for {word} is issued')
+  public async issueToken (user: string): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        email: user + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('the IDP random token is issued')
+  public async issueNewToken (): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const sub = Math.random().toString(36).substring(7)
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub,
+        aud: 'test',
+        email: sub + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set('random.sub', sub)
+    this.captures.set('random.email', sub + '@test.local')
+    this.captures.set('random.id_token', idToken)
+  }
+
+  @given('the IDP {word} token for {word} is issued with following secret:')
+  public async issueSymmetricToken (alg: string, user: string, secret: string): Promise<void> {
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createHmac(alg.replace(/^HS(\d{3})$/, 'sha$1'), secret)
+      .update(jwt)
+      .digest('base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('ID token with jti is issued for {word}')
+  public async issueTokenWithJti (user: string): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        email: user + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000),
+        jti: crypto.randomUUID()
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('auth code for {word} is issued for {word}')
+  public async issueAuthCode (user: string, redirectUri: string): Promise<void> {
+    const code = crypto.randomBytes(16).toString('hex')
+    const email = user + '@test.local'
+    const clientId = 'nex'
+
+    IDP.authCodes.set(code, {
+      code,
+      sub: user,
+      email,
+      clientId,
+      redirectUri,
+      expiresAt: Date.now() + 60 * 1000
+    })
+
+    const json = JSON.stringify({ code, iss: IDP.issuer, for: redirectUri })
+    const base64 = Buffer.from(json).toString('base64')
+
+    this.captures.set(`${user}.auth_code`, code)
+    this.captures.set(`${user}.code_credentials`, base64)
+  }
+
+  private generateIdToken (sub: string, email: string, clientId: string): string {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+    assert.ok(IDP.issuer, 'IdP issuer is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub,
+        aud: clientId,
+        email,
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+
+    return `${jwt}.${signature}`
+  }
+}
+
+interface AuthCode {
+  code: string
+  sub: string
+  email: string
+  clientId: string
+  redirectUri: string
+  expiresAt: number
+}

package/features/steps/Identity.ts

@@ -0,0 +1,51 @@
+import { binding, given } from 'cucumber-tsflow'
+import * as http from '@toa.io/agent'
+import { Parameters } from './Parameters'
+import { Captures } from './Captures'
+import { Gateway } from './Gateway'
+
+@binding([Gateway, Parameters, Captures])
+export class Identity {
+  private readonly gateway: Gateway
+  private readonly http: http.Agent
+  private readonly variables: Captures
+
+  public constructor (gateway: Gateway, parameters: Parameters, captures: Captures) {
+    this.gateway = gateway
+    this.http = new http.Agent(parameters.origin, captures)
+    this.variables = captures
+  }
+
+  @given('transient identity {word}')
+  public async transient (as: string): Promise<Principal> {
+    await this.gateway.start()
+
+    await this.http.request(`
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+    `)
+
+    this.http.responseIncludes(`
+      201 Created
+      authorization: Token \${{ ${as}.token }}
+
+      id: \${{ ${as}.id }}
+    `)
+
+    const id = this.variables.get(as + '.id')!
+    const token = this.variables.get(as + '.token')!
+
+    return { id, token }
+  }
+
+  @given('transient identity')
+  public async anonymous (): Promise<Principal> {
+    return await this.transient('identity')
+  }
+}
+
+export interface Principal {
+  id: string
+  token: string
+}

package/features/steps/OTP.ts

@@ -0,0 +1,39 @@
+import * as assert from 'node:assert'
+import { binding, given } from 'cucumber-tsflow'
+import * as boot from '@toa.io/boot'
+import { Locator, type Remote } from '@toa.io/core'
+import { Captures } from './Captures'
+
+@binding([Captures])
+export class OTP {
+  private captures: Captures
+  private otp: Remote | null = null
+
+  public constructor (captures: Captures) {
+    this.captures = captures
+  }
+
+  @given('OTP for `{word}` in `{word}` authority is issued')
+  public async issue (username: string, authority: string): Promise<void> {
+    this.otp ??= await this.connect()
+
+    const reply = await this.otp.invoke('issue', {
+      input: {
+        username,
+        authority
+      }
+    })
+
+    assert.ok(typeof reply.code === 'string')
+
+    const credentials = btoa(`${username}:${reply.code}`)
+
+    this.captures.set(`${username}.otp`, credentials)
+  }
+
+  private async connect (): Promise<Remote> {
+    const locator = new Locator('otp', 'identity')
+
+    return await boot.remote(locator)
+  }
+}