@toa.io/extensions.exposition 1.0.0-alpha.2 → 1.0.0-alpha.21

package/source/directives/auth/Role.test.ts

@@ -2,6 +2,7 @@ import { type Component } from '@toa.io/core'
 import { generate } from 'randomstring'
 import { Role } from './Role'
 import { type Identity } from './types'
+import type { Parameter } from '../../RTD'
 
 const remote = {
   invoke: jest.fn()
@@ -16,16 +17,26 @@ beforeEach(() => {
 it('should return false if not matched', async () => {
   const roles = ['admin', 'user']
   const directive = new Role(roles, discovery)
-  const identity: Identity = { id: generate(), scheme: '', refresh: false }
+
+  const identity: Identity = {
+    id: generate(),
+    scheme: '',
+    refresh: false
+  }
 
   remote.invoke.mockResolvedValueOnce(['guest'])
 
-  const result = await directive.authorize(identity)
+  const result = await directive.authorize(identity, undefined, [])
 
   expect(result).toBe(false)
 
   expect(remote.invoke)
-    .toBeCalledWith('list', { query: { criteria: `identity==${identity.id}`, limit: 1024 } })
+    .toBeCalledWith('list', {
+      query: {
+        criteria: `identity==${identity.id}`,
+        limit: 1024
+      }
+    })
 })
 
 it('should return true on exact match', async () => {
@@ -52,11 +63,47 @@ it('should return false on non-scope substring match', async () => {
   expect(result).toBe(false)
 })
 
-async function match (expected: string[], actual: string[]): Promise<boolean> {
+it('should return true on match with parameters', async () => {
+  const result = await match(['app:{org}:reviews'],
+    ['app:29e54ae1:reviews'], [{
+      name: 'org',
+      value: '29e54ae1'
+    }])
+
+  expect(result).toBe(true)
+})
+
+it('should return true on match with parameters', async () => {
+  const result = await match(['app:{org}:reviews'],
+    ['app:29e54ae1:reviews'], [{
+      name: 'org',
+      value: '29e54ae1'
+    }])
+
+  expect(result).toBe(true)
+})
+
+it('should return false on mismatch with parameters', async () => {
+  const result = await match(['app:{org}:reviews'],
+    ['app:29e54ae1:reviews'], [{
+      name: 'org',
+      value: '88584c9b'
+    }])
+
+  expect(result).toBe(false)
+})
+
+async function match
+(expected: string[], actual: string[], parameters: Parameter[] = []): Promise<boolean> {
   const directive = new Role(expected, discovery)
-  const identity: Identity = { id: generate(), scheme: '', refresh: false }
+
+  const identity: Identity = {
+    id: generate(),
+    scheme: '',
+    refresh: false
+  }
 
   remote.invoke.mockResolvedValueOnce(actual)
 
-  return await directive.authorize(identity)
+  return await directive.authorize(identity, undefined, parameters)
 }

package/source/directives/auth/Role.ts

@@ -1,56 +1,66 @@
+import assert from 'node:assert'
 import { type Component, type Query } from '@toa.io/core'
 import { type Directive, type Identity } from './types'
+import type { Parameter } from '../../RTD'
 
 export class Role implements Directive {
   public static remote: Component | null = null
   private readonly roles: string[]
   private readonly discovery: Promise<Component>
+  private readonly dynamic: boolean
 
   public constructor (roles: string | string[], discovery: Promise<Component>) {
     this.roles = typeof roles === 'string' ? [roles] : roles
     this.discovery = discovery
+    this.dynamic = this.roles.some((role) => role.includes('{'))
   }
 
   public static async set (identity: Identity, discovery: Promise<Component>): Promise<void> {
     this.remote ??= await discovery
 
-    const query: Query = { criteria: `identity==${identity.id}`, limit: 1024 }
-    const roles: string[] = await this.remote.invoke('list', { query })
+    const query: Query = {
+      criteria: `identity==${identity.id}`,
+      limit: 1024
+    }
 
-    identity.roles = roles
+    identity.roles = await this.remote.invoke('list', { query })
   }
 
-  public async authorize (identity: Identity | null): Promise<boolean> {
+  public async authorize
+  (identity: Identity | null, _: unknown, parameters: Parameter[]): Promise<boolean> {
     if (identity === null)
       return false
 
     await Role.set(identity, this.discovery)
 
-    if (identity.roles === undefined)
+    if (identity.roles!.length === 0) // Role.set()
+
       return false
 
-    return this.match(identity.roles)
+    return this.match(identity.roles!, parameters)
   }
 
-  private match (roles: string[]): boolean {
+  private match (roles: string[], parameters: Parameter[]): boolean {
+    const required = this.dynamic ? this.substitute(parameters) : this.roles
+
     for (const role of roles) {
-      const index = this.roles.findIndex((expected) => compare(expected, role))
+      const ok = required.some((expected) => expected === role || expected.startsWith(role + ':'))
 
-      if (index !== -1)
+      if (ok)
         return true
     }
 
     return false
   }
-}
 
-function compare (expected: string, actual: string): boolean {
-  const exp = expected.split(':')
-  const act = actual.split(':')
+  private substitute (parameters: Parameter[]): string[] {
+    return this.roles.map((role) => role.replaceAll(/{(\w+)}/g, (_, key) => {
+      const value = parameters.find((parameter) => parameter.name === key)?.value
 
-  for (let i = 0; i < act.length; i++)
-    if (exp[i] !== act[i])
-      return false
+      assert.ok(value !== undefined,
+        `Role '${role}' requires '${key}' route parameter.`)
 
-  return true
+      return value
+    }))
+  }
 }

package/source/directives/auth/Scheme.ts

@@ -12,10 +12,10 @@ export class Scheme implements Directive {
   }
 
   public authorize (_: Identity | null, input: Input): boolean {
-    if (input.headers.authorization === undefined)
+    if (input.request.headers.authorization === undefined)
       return false
 
-    const [scheme] = split(input.headers.authorization)
+    const [scheme] = split(input.request.headers.authorization)
 
     if (scheme !== this.scheme)
       throw new http.Forbidden(this.Scheme +

package/source/directives/auth/types.ts

@@ -8,7 +8,7 @@ export interface Directive {
   authorize: (
     identity: Identity | null,
     input: Input,
-    parameters: Parameter[],
+    parameters: Parameter[]
   ) => boolean | Promise<boolean>
 
   reply?: (identity: Identity | null) => http.OutgoingMessage

package/source/directives/cache/Cache.ts

@@ -2,10 +2,10 @@ import { Control } from './Control'
 import { Exact } from './Exact'
 import type { Input, Output } from '../../io'
 import type { Directive } from './types'
-import type { Family } from '../../Directive'
+import type { DirectiveFamily } from '../../RTD'
 import type * as http from '../../HTTP'
 
-export class Cache implements Family<Directive> {
+export class Cache implements DirectiveFamily<Directive> {
   public readonly name: string = 'cache'
   public readonly mandatory: boolean = false
 
@@ -13,7 +13,7 @@ export class Cache implements Family<Directive> {
     const Class = constructors[name]
 
     if (Class === undefined)
-      throw new Error(`Directive '${name}' is not provided by the '${this.name}' family.`)
+      throw new Error(`Directive 'cache:${name}' is not implemented.`)
 
     return new Class(value)
   }
@@ -23,9 +23,9 @@ export class Cache implements Family<Directive> {
   }
 
   public async settle
-  (directives: Directive[], request: Input, response: http.OutgoingMessage): Promise<void> {
+  (directives: Directive[], input: Input, response: http.OutgoingMessage): Promise<void> {
     response.headers ??= new Headers()
-    directives[0]?.set(request, response.headers)
+    directives[0]?.set(input, response.headers)
   }
 }
 

package/source/directives/cache/Control.ts

@@ -1,59 +1,85 @@
 import { match } from 'matchacho'
-import type { AuthenticatedRequest, Directive } from './types'
+import type { AuthenticatedContext, Directive } from './types'
 
 export class Control implements Directive {
   protected readonly value: string
   private cache: string | null = null
+  private vary: boolean = false
 
   public constructor (value: string) {
     this.value = value
   }
 
-  public set (request: AuthenticatedRequest, headers: Headers): void {
-    if (!['GET', 'HEAD', 'OPTIONS'].includes(request.method))
+  public set (context: AuthenticatedContext, headers: Headers): void {
+    if (!['GET', 'HEAD', 'OPTIONS'].includes(context.request.method))
       return
 
-    this.cache ??= this.resolve(request)
+    this.cache ??= this.resolve(context)
 
-    headers.set('cache-control', this.cache)
+    if (this.disabled(headers))
+      return
+
+    headers.append('cache-control', this.cache)
+
+    if (this.vary !== null)
+      headers.append('vary', 'authorization')
   }
 
-  protected resolve (request: AuthenticatedRequest): string {
+  protected resolve (request: AuthenticatedContext): string {
     if (request.identity === null)
       return this.value
 
-    const directives = this.mask()
+    const directives = mask(this.value)
+
+    if ((directives & PRIVATE) === PRIVATE)
+      this.vary = true
 
     if ((directives & (PUBLIC | NO_CACHE)) === PUBLIC)
       return 'no-cache, ' + this.value
 
-    if ((directives & (PUBLIC | PRIVATE)) === 0)
+    if ((directives & (PUBLIC | PRIVATE)) === 0) {
+      this.vary = true
+
       return 'private, ' + this.value
+    }
 
     return this.value
   }
 
-  private mask (): number {
-    const directives = this.value.match(DIRECTIVES_RX)
-
-    if (directives === null)
-      return 0
+  private disabled (headers: Headers): boolean {
+    const value = headers.get('cache-control')
 
-    let mask = 0
+    if (value === null)
+      return false
 
-    for (const directive of directives)
-      mask |= match<number>(directive,
-        'private', PRIVATE,
-        'public', PUBLIC,
-        'no-cache', NO_CACHE,
-        0)
+    const directives = mask(value)
 
-    return mask
+    return (directives & NO_STORE) === NO_STORE
   }
 }
 
-const DIRECTIVES_RX = /\b(private|public|no-cache)\b/ig
+function mask (value: string): number {
+  const directives = value.match(DIRECTIVES_RX)
+
+  if (directives === null)
+    return 0
+
+  let mask = 0
+
+  for (const directive of directives)
+    mask |= match<number>(directive,
+      'private', PRIVATE,
+      'public', PUBLIC,
+      'no-cache', NO_CACHE,
+      'no-store', NO_STORE,
+      0)
+
+  return mask
+}
+
+const DIRECTIVES_RX = /\b(private|public|no-cache|no-store)\b/ig
 
 const PUBLIC = 1
 const PRIVATE = 2
 const NO_CACHE = 4
+const NO_STORE = 8

package/source/directives/cache/types.ts

@@ -4,6 +4,6 @@ export interface Directive {
   set: (input: Input, headers: Headers) => void
 }
 
-export interface AuthenticatedRequest extends Input {
+export interface AuthenticatedContext extends Input {
   identity?: unknown | null
 }

package/source/directives/cors/CORS.ts

@@ -3,26 +3,32 @@ import type { Interceptor } from '../../Interception'
 
 export class CORS implements Interceptor {
   public readonly name = 'cors'
-  public readonly mandatory = true
 
-  private readonly allowedHeaders = new Set<string>(['accept', 'authorization', 'content-type'])
+  private readonly requestHeaders = new Set<string>([
+    'accept',
+    'authorization',
+    'content-type',
+    'etag',
+    'if-match',
+    'if-none-match'
+  ])
 
   private readonly headers = new Headers({
     'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE',
     'access-control-allow-credentials': 'true',
-    'access-control-allow-headers': Array.from(this.allowedHeaders).join(', '),
+    'access-control-allow-headers': Array.from(this.requestHeaders).join(', '),
     'access-control-max-age': '3600',
-    'cache-control': 'public, max-age=3600',
+    'cache-control': 'max-age=3600',
     vary: 'origin'
   })
 
   public intercept (input: Input): Output {
-    const origin = input.headers.origin
+    const origin = input.request.headers.origin
 
     if (origin === undefined)
       return null
 
-    if (input.method === 'OPTIONS')
+    if (input.request.method === 'OPTIONS')
       return this.preflightResponse(origin)
 
     input.pipelines.response.push((output) => {
@@ -31,16 +37,18 @@ export class CORS implements Interceptor {
       output.headers.set('access-control-expose-headers',
         'authorization, content-type, content-length, etag')
 
-      if (input.method === 'GET' || input.method === 'HEAD' || input.method === 'OPTIONS')
+      const method = input.request.method
+
+      if (method === 'GET' || method === 'HEAD' || method === 'OPTIONS')
         output.headers.append('vary', 'origin')
     })
 
     return null
   }
 
-  public allowHeader (header: string): void {
-    this.allowedHeaders.add(header.toLowerCase())
-    this.headers.set('access-control-allow-headers', Array.from(this.allowedHeaders).join(', '))
+  public allow (header: string): void {
+    this.requestHeaders.add(header.toLowerCase())
+    this.headers.set('access-control-allow-headers', Array.from(this.requestHeaders).join(', '))
   }
 
   private preflightResponse (origin: string): Output {

package/source/directives/dev/Development.ts

@@ -2,17 +2,17 @@ import { Stub } from './Stub'
 import { Throw } from './Throw'
 import { type Directive } from './types'
 import type { Input, Output } from '../../io'
-import type { Family } from '../../Directive'
+import type { DirectiveFamily } from '../../RTD'
 
-export class Development implements Family<Directive> {
+export class Development implements DirectiveFamily<Directive> {
   public readonly name: string = 'dev'
   public readonly mandatory: boolean = false
 
-  public create (name: string, value: any): Directive {
+  public create (name: string, value: unknown): Directive {
     const Class = constructors[name]
 
     if (Class === undefined)
-      throw new Error(`Directive '${name}' is not provided by the '${this.name}' family.`)
+      throw new Error(`Directive 'dev:${name}' is not implemented.`)
 
     return new Class(value)
   }

package/source/directives/index.ts

@@ -1,11 +1,13 @@
-import { dev } from './dev'
 import { authorization } from './auth'
 import { cache } from './cache'
-import { octets } from './octets'
 import { cors } from './cors'
+import { dev } from './dev'
+import { octets } from './octets'
+import { io } from './io'
 import { vary } from './vary'
-import type { Family } from '../Directive'
+import { req } from './require'
+import type { DirectiveFamily } from '../RTD'
 import type { Interceptor } from '../Interception'
 
-export const families: Family[] = [authorization, cache, octets, vary, dev]
+export const families: DirectiveFamily[] = [authorization, io, cache, vary, req, octets, dev]
 export const interceptors: Interceptor[] = [cors]

package/source/directives/io/Directive.ts

@@ -0,0 +1,11 @@
+import type { Input } from '../../io'
+
+export interface Directive {
+  attach: (context: Input) => void
+}
+
+export interface Constructor {
+  validate: (value: unknown) => void
+
+  new (value: any): Directive
+}

package/source/directives/io/IO.ts

@@ -0,0 +1,43 @@
+import { Output } from './Output'
+import { Input } from './Input'
+import type { Constructor, Directive } from './Directive'
+import type { Input as Context } from '../../io'
+import type { DirectiveFamily } from '../../RTD'
+
+export class IO implements DirectiveFamily<Directive> {
+  public readonly name = 'io'
+  public readonly mandatory = true
+
+  public create (name: string, value: unknown): Directive {
+    if (!(name in constructors))
+      throw new Error(`Directive 'io:${name}' is not implemented.`)
+
+    const Directive = constructors[name]
+
+    Directive.validate(value)
+
+    return new Directive(value)
+  }
+
+  public preflight (directives: Directive[], context: Context): null {
+    let restricted = false
+
+    for (const directive of directives) {
+      restricted ||= directive instanceof Output
+
+      directive.attach(context)
+    }
+
+    if (!restricted)
+      DENIAL.attach(context)
+
+    return null
+  }
+}
+
+const constructors: Record<string, Constructor> = {
+  output: Output,
+  input: Input
+}
+
+const DENIAL: Output = new Output([])

package/source/directives/io/Input.ts

@@ -0,0 +1,50 @@
+import { BadRequest } from '../../HTTP'
+import * as schemas from './schemas'
+import type { Message } from './Message'
+import type { Directive } from './Directive'
+import type { Input as Context } from '../../io'
+
+export class Input implements Directive {
+  private readonly permissions: Permissions
+
+  public constructor (permissions: Permissions) {
+    this.permissions = permissions
+  }
+
+  public static validate (permissions: unknown): asserts permissions is Permissions {
+    schemas.input.validate(permissions, 'Incorrect \'io:input\' format')
+  }
+
+  public attach (context: Context): void {
+    context.pipelines.body.push((body) => this.check(body))
+  }
+
+  private check (body: unknown): unknown {
+    try {
+      schemas.message.validate(body)
+    } catch {
+      throw new BadRequest('Invalid request body.')
+    }
+
+    const property = this.violation(body)
+
+    if (property !== undefined)
+      throw new BadRequest(`Unexpected input: ${property}.`)
+
+    return body
+  }
+
+  private violation (value: Message | Message[]): string | undefined {
+    if (!Array.isArray(value))
+      return Object.keys(value).find((key) => !this.permissions.includes(key))
+
+    for (const item of value) {
+      const property = this.violation(item)
+
+      if (property !== undefined)
+        return property
+    }
+  }
+}
+
+export type Permissions = string[]

package/source/directives/io/Message.ts

@@ -0,0 +1 @@
+export type Message = Record<string, unknown>

package/source/directives/io/Output.ts

@@ -0,0 +1,69 @@
+import { Stream } from 'node:stream'
+import * as schemas from './schemas'
+import type { Message } from './Message'
+import type { Directive } from './Directive'
+import type { Input as Context } from '../../io'
+import type { OutgoingMessage } from '../../HTTP'
+
+export class Output implements Directive {
+  private readonly disabled: boolean = false
+  private readonly omitted: boolean = true
+  private readonly permissions: string[] = []
+
+  public constructor (permissions: Permissions) {
+    if (typeof permissions === 'boolean')
+      if (permissions)
+        this.disabled = true
+      else
+        this.omitted = false
+
+    else
+      this.permissions = permissions
+  }
+
+  public static validate (permissions: unknown): asserts permissions is Permissions {
+    schemas.output.validate(permissions, 'Incorrect \'io:output\' format')
+  }
+
+  public attach (context: Context): void {
+    context.pipelines.response.push(this.restriction(context))
+  }
+
+  private restriction (context: Context) {
+    return (message: OutgoingMessage): void => {
+      const error = message.status !== undefined && message.status >= 300
+      const stream = message.body instanceof Stream
+      const none = message.body === undefined || message.body === null
+
+      if (this.disabled || error || stream || none)
+        return
+
+      if (typeof message.body !== 'object' || this.permissions.length === 0) {
+        if (this.omitted)
+          console.warn('Permissions for \'io:output\' are not specified properly ' +
+            `(${context.request.url}). Response omitted.`)
+
+        delete message.body
+
+        return
+      }
+
+      schemas.message.validate(message.body,
+        '\'io:output\' expects response to be an object or array of objects')
+
+      if (Array.isArray(message.body))
+        message.body = message.body.map((entity) => this.fit(entity))
+      else
+        message.body = this.fit(message.body)
+    }
+  }
+
+  private fit (message: Message): Message | undefined {
+    const entries = Object.entries(message)
+      .filter(([key]) => this.permissions.includes(key))
+
+    return Object.fromEntries(entries)
+  }
+}
+
+export type Permissions = string[] | boolean

package/source/directives/io/index.ts

@@ -0,0 +1,3 @@
+import { IO } from './IO'
+
+export const io = new IO()

package/source/directives/io/schemas.ts

@@ -0,0 +1,12 @@
+import { resolve } from 'node:path'
+import schemas, { type Schema } from '@toa.io/schemas'
+import type { Permissions as InputPermissions } from './Input'
+import type { Permissions as OutputPermissions } from './Output'
+import type { Message } from './Message'
+
+const path = resolve(__dirname, '../../../schemas/io')
+const namespace = schemas.namespace(path)
+
+export const message: Schema<Message | Message[]> = namespace.schema('message')
+export const input: Schema<InputPermissions> = namespace.schema('input')
+export const output: Schema<OutputPermissions> = namespace.schema('output')

package/source/directives/octets/Context.ts

@@ -1,18 +1,19 @@
 import * as schemas from './schemas'
+import { Directive } from './Directive'
 import type { Output } from '../../io'
-import type { Directive } from './types'
 
-export class Context implements Directive {
+export class Context extends Directive {
   public readonly targeted = false
   public readonly storage: string
 
-  public constructor (value: any) {
+  public constructor (value: unknown) {
+    super()
     schemas.context.validate(value)
 
     this.storage = value
   }
 
-  public apply (): Output {
+  public async apply (): Promise<Output> {
     return null
   }
 }