@toa.io/extensions.exposition 1.0.0-alpha.21 → 1.0.0-alpha.210

package/source/directives/io/IO.ts

@@ -1,7 +1,8 @@
 import { Output } from './Output'
 import { Input } from './Input'
+import { Throttle } from './Throttle'
+import type * as http from '../../HTTP'
 import type { Constructor, Directive } from './Directive'
-import type { Input as Context } from '../../io'
 import type { DirectiveFamily } from '../../RTD'
 
 export class IO implements DirectiveFamily<Directive> {
@@ -10,7 +11,7 @@ export class IO implements DirectiveFamily<Directive> {
 
   public create (name: string, value: unknown): Directive {
     if (!(name in constructors))
-      throw new Error(`Directive 'io:${name}' is not implemented.`)
+      throw new Error(`Directive 'io:${name}' is not implemented`)
 
     const Directive = constructors[name]
 
@@ -19,25 +20,36 @@ export class IO implements DirectiveFamily<Directive> {
     return new Directive(value)
   }
 
-  public preflight (directives: Directive[], context: Context): null {
+  public preflight (directives: Directive[], context: http.Context): null {
     let restricted = false
 
     for (const directive of directives) {
       restricted ||= directive instanceof Output
 
-      directive.attach(context)
+      directive.preflight(context)
     }
 
     if (!restricted)
-      DENIAL.attach(context)
+      DENIAL.preflight(context)
 
     return null
   }
+
+  public async settle (directives: Directive[], context: http.Context, output: http.OutgoingMessage): Promise<void> {
+    for (const directive of directives)
+      await directive.settle?.(context, output)
+  }
+
+  public dispose (directives: Directive[]): void {
+    for (const directive of directives)
+      directive.dispose?.()
+  }
 }
 
 const constructors: Record<string, Constructor> = {
+  input: Input,
   output: Output,
-  input: Input
+  throttle: Throttle
 }
 
 const DENIAL: Output = new Output([])

package/source/directives/io/Input.ts

@@ -12,24 +12,27 @@ export class Input implements Directive {
   }
 
   public static validate (permissions: unknown): asserts permissions is Permissions {
-    schemas.input.validate(permissions, 'Incorrect \'io:input\' format')
+    schemas.input.validate<Permissions>(permissions, 'Incorrect \'io:input\' format')
   }
 
-  public attach (context: Context): void {
+  public preflight (context: Context): void {
     context.pipelines.body.push((body) => this.check(body))
   }
 
-  private check (body: unknown): unknown {
+  private check (body: unknown): Message | Message[] | undefined {
+    if (body === undefined)
+      return body
+
     try {
-      schemas.message.validate(body)
+      schemas.message.validate<Message | Message[]>(body)
     } catch {
-      throw new BadRequest('Invalid request body.')
+      throw new BadRequest('Invalid request body')
     }
 
     const property = this.violation(body)
 
     if (property !== undefined)
-      throw new BadRequest(`Unexpected input: ${property}.`)
+      throw new BadRequest(`Unexpected input: ${property}`)
 
     return body
   }

package/source/directives/io/Output.ts

@@ -1,4 +1,5 @@
 import { Stream } from 'node:stream'
+import { console } from 'openspan'
 import * as schemas from './schemas'
 import type { Message } from './Message'
 import type { Directive } from './Directive'
@@ -25,7 +26,7 @@ export class Output implements Directive {
     schemas.output.validate(permissions, 'Incorrect \'io:output\' format')
   }
 
-  public attach (context: Context): void {
+  public preflight (context: Context): void {
     context.pipelines.response.push(this.restriction(context))
   }
 
@@ -40,19 +41,19 @@ export class Output implements Directive {
 
       if (typeof message.body !== 'object' || this.permissions.length === 0) {
         if (this.omitted)
-          console.warn('Permissions for \'io:output\' are not specified properly ' +
-            `(${context.request.url}). Response omitted.`)
+          console.warn('Permissions for \'io:output\' are not specified properly, response omitted',
+            { path: context.url.pathname })
 
         delete message.body
 
         return
       }
 
-      schemas.message.validate(message.body,
+      schemas.message.validate<Message>(message.body,
         '\'io:output\' expects response to be an object or array of objects')
 
       if (Array.isArray(message.body))
-        message.body = message.body.map((entity) => this.fit(entity))
+        message.body = message.body.map((entity) => this.fit(entity as Message))
       else
         message.body = this.fit(message.body)
     }

package/source/directives/io/Throttle.ts

@@ -0,0 +1,32 @@
+import { TooManyRequests } from '../../HTTP'
+import * as schemas from './schemas'
+import { parse, Quotas, type Declaration } from './lib/throttle'
+import type * as http from '../../HTTP'
+import type { Directive } from './Directive'
+
+export class Throttle implements Directive {
+  private readonly quotas: Quotas
+
+  public constructor (declaration: Declaration) {
+    const configuration = parse(declaration)
+
+    this.quotas = Quotas.create(configuration)
+  }
+
+  public static validate (declaration: unknown): asserts declaration is Declaration {
+    schemas.throttle.validate(declaration, 'Incorrect \'io:throttle\' format')
+  }
+
+  public preflight (context: http.Context): void {
+    if (!this.quotas.ok(context))
+      throw new TooManyRequests()
+  }
+
+  public settle (context: http.Context, output: http.OutgoingMessage): void {
+    this.quotas.use(context, output)
+  }
+
+  public dispose (): void {
+    this.quotas.dispose()
+  }
+}

package/source/directives/io/lib/throttle/Configuration.test.ts

@@ -0,0 +1,40 @@
+import { parse, type Configuration } from './Configuration'
+
+const rest: Omit<Configuration, 'key' | 'condition'> = {
+  interval: 1,
+  requests: 1,
+  cooldown: 1
+}
+
+it('should convert key', () => {
+  const result: Partial<Configuration> = {
+    key: [
+      {
+        method: 'ip'
+      }
+    ]
+  }
+
+  expect(parse({ key: 'ip', ...rest })).toMatchObject(result)
+  expect(parse({ key: ['ip'], ...rest })).toMatchObject(result)
+})
+
+it('should convert condition', () => {
+  expect(parse({ key: ['ip', 'path'], condition: { status: '404' }, ...rest })).toMatchObject({
+    condition: [
+      {
+        method: 'status',
+        options: '404'
+      }
+    ]
+  })
+
+  expect(parse({ key: 'ip', condition: { status: '404' }, ...rest })).toMatchObject({
+    condition: [
+      {
+        method: 'status',
+        options: '404'
+      }
+    ]
+  })
+})

package/source/directives/io/lib/throttle/Configuration.ts

@@ -0,0 +1,58 @@
+export interface Configuration {
+  key: KeyComponent[]
+  condition?: KeyCondition[]
+  requests: number
+  interval: number
+  cooldown: number
+}
+
+interface Rule<T, K = unknown> {
+  method: T
+  options?: K
+}
+
+export type KeyComponentMethod = 'ip' | 'path'
+export type KeyConditionMethod = 'status'
+
+export type KeyComponent = Rule<KeyComponentMethod>
+export type KeyCondition = Rule<KeyConditionMethod>
+
+type KeyDeclaration = KeyComponentMethod | KeyComponentMethod[]
+
+type ConditionDeclaration =
+  Record<KeyConditionMethod, unknown>
+  | Array<Record<KeyConditionMethod, unknown>>
+
+export interface Declaration extends Omit<Configuration, 'key' | 'condition'> {
+  key: KeyDeclaration
+  condition?: ConditionDeclaration
+}
+
+export function parse (declaration: Declaration): Configuration {
+  const { key, condition, requests, interval, cooldown } = declaration
+
+  return {
+    key: mapKey(key),
+    condition: mapCondition(condition),
+    requests,
+    interval: interval * 1000,
+    cooldown: cooldown * 1000
+  }
+}
+
+function mapKey (declaration: KeyDeclaration): KeyComponent[] {
+  const methods = Array.isArray(declaration) ? declaration : [declaration]
+
+  return methods.map((method) => ({ method }))
+}
+
+function mapCondition (declaration?: ConditionDeclaration): KeyCondition[] | undefined {
+  if (declaration === undefined)
+    return
+
+  // reduce to a single object, then map entries to rules
+  const conditions = Array.isArray(declaration) ? declaration : [declaration]
+  const single = conditions.reduce((acc, condition) => ({ ...acc, ...condition }), {})
+
+  return Object.entries(single).map(([method, options]) => ({ method, options })) as KeyCondition[]
+}

package/source/directives/io/lib/throttle/Interval.ts

@@ -0,0 +1,31 @@
+import assert from 'node:assert'
+import { EventEmitter } from 'node:events'
+
+export class Interval extends EventEmitter {
+  public number: number = 0
+  private interval: ReturnType<typeof setInterval> | null = null
+
+  public constructor (interval: number) {
+    super()
+
+    const number = Math.ceil(Date.now() / interval)
+    const shift = number * interval - Date.now()
+
+    assert.ok(shift >= 0, 'shift must be positive')
+
+    setTimeout(() => this.start(interval), shift)
+  }
+
+  public start (interval: number): void {
+    this.interval = setInterval(() => this.emit('tick'), interval)
+  }
+
+  public dispose (): void {
+    if (this.interval !== null) {
+      clearInterval(this.interval)
+      this.interval = null
+    }
+
+    this.removeAllListeners()
+  }
+}

package/source/directives/io/lib/throttle/Keys.ts

@@ -0,0 +1,40 @@
+import { createHash } from 'node:crypto'
+import { Components, type Component } from './components'
+import { Conditions, type Condition } from './conditions'
+import type { KeyComponent, KeyCondition } from './Configuration'
+import type { Input as Context, Output } from '../../../../io'
+
+export class Keys {
+  private readonly components: Component[]
+  private readonly conditions?: Condition[]
+
+  public constructor (components: Component[], conditions?: Condition[]) {
+    this.components = components
+    this.conditions = conditions
+  }
+
+  public static create (componentRules: KeyComponent[], conditionRules?: KeyCondition[]): Keys {
+    const components = componentRules.map((rule) => new Components[rule.method](rule.options))
+    const conditions = conditionRules?.map((rule) => new Conditions[rule.method](rule.options))
+
+    return new this(components, conditions)
+  }
+
+  public get (context: Context): string {
+    const hash = createHash('sha256')
+
+    for (const component of this.components)
+      hash.update(component.get(context))
+
+    return hash.digest('hex')
+  }
+
+  public match (input: Context, output: Output): string | null {
+    const miss = this.conditions?.some((condition) => !condition.match(input, output))
+
+    if (miss === true)
+      return null
+    else
+      return this.get(input)
+  }
+}

package/source/directives/io/lib/throttle/Quota.ts

@@ -0,0 +1,22 @@
+export class Quota {
+  private readonly limit: number = 0
+  private used: number = 0
+
+  public constructor (limit: number) {
+    this.limit = limit
+  }
+
+  public get idle (): boolean {
+    return this.used === 0
+  }
+
+  public use (count = 1): boolean {
+    this.used += count
+
+    return this.used < this.limit
+  }
+
+  public reset (): void {
+    this.used = 0
+  }
+}

package/source/directives/io/lib/throttle/Quotas.test.ts

@@ -0,0 +1,136 @@
+import { setTimeout } from 'node:timers/promises'
+import { Quotas } from './Quotas'
+import type { Configuration } from './Configuration'
+import type { Input as Context, Output } from '../../../../io'
+
+let quotas: Quotas
+let configuration: Configuration
+let context: Context
+let output: Output
+
+beforeEach(() => {
+  output = { status: 200 }
+})
+
+describe('common', () => {
+  beforeEach(() => {
+    context = createContext()
+    configuration = createConfiguration()
+    quotas = Quotas.create(configuration)
+  })
+
+  it('should be ok', () => {
+    quotas.ok(context)
+    quotas.use(context, output)
+  })
+
+  it('should throttle', () => {
+    expect(quotas.ok(context)).toBe(true)
+
+    quotas.use(context, output)
+    quotas.use(context, output)
+
+    expect(quotas.ok(context)).toBe(false)
+  })
+
+  it('should unblock after cooldown', async () => {
+    quotas.use(context, output)
+    quotas.use(context, output)
+
+    expect(quotas.ok(context)).toBe(false)
+
+    await timeout(configuration.cooldown)
+
+    expect(quotas.ok(context)).toBe(true)
+  })
+
+  it('should reset after interval', async () => {
+    quotas.use(context, output)
+
+    // pseudo-synchronous intervals start somewhere between 0 and interval
+    await timeout(configuration.interval * 2)
+
+    quotas.use(context, output)
+
+    expect(quotas.ok(context)).toBe(true)
+  })
+})
+
+describe('path', () => {
+  beforeEach(() => {
+    configuration = createConfiguration()
+    quotas = Quotas.create(configuration)
+  })
+
+  it('should have separate quotas', () => {
+    const one = createContext({ url: new URL('http://localhost/one/') })
+    const two = createContext({ url: new URL('http://localhost/two/') })
+
+    quotas.use(one, output)
+    quotas.use(one, output)
+
+    expect(quotas.ok(one)).toBe(false)
+    expect(quotas.ok(two)).toBe(true)
+
+    quotas.use(two, output)
+    quotas.use(two, output)
+
+    expect(quotas.ok(two)).toBe(false)
+  })
+})
+
+describe('ip', () => {
+  beforeEach(() => {
+    configuration = createConfiguration({ key: [{ method: 'ip' }] })
+    quotas = Quotas.create(configuration)
+  })
+
+  it('should have separate quotas', () => {
+    const one = createContext({ request: { headers: { 'x-forwarded-for': '1.1.1.1' } } })
+    const two = createContext({ request: { headers: { 'x-forwarded-for': '2.2.2.2' } } })
+
+    quotas.use(one, output)
+    quotas.use(one, output)
+
+    expect(quotas.ok(one)).toBe(false)
+    expect(quotas.ok(two)).toBe(true)
+
+    quotas.use(two, output)
+    quotas.use(two, output)
+
+    expect(quotas.ok(two)).toBe(false)
+  })
+})
+
+describe('status', () => {
+  beforeEach(() => {
+    context = createContext()
+    configuration = createConfiguration({ condition: [{ method: 'status', options: 404 }] })
+    quotas = Quotas.create(configuration)
+  })
+
+  it('should not throttle on 200', () => {
+    quotas.use(context, output)
+
+    expect(quotas.ok(context)).toBe(true)
+  })
+
+  it('should throttle on 404', () => {
+    quotas.use(context, { status: 404 })
+    quotas.use(context, { status: 404 })
+
+    expect(quotas.ok(context)).toBe(false)
+  })
+})
+
+function createConfiguration (properties?: Partial<Configuration>): Configuration {
+  return Object.assign({ key: [{ method: 'path' }], requests: 2, interval: 10, cooldown: 10 }, properties)
+}
+
+function createContext (properties?: any): Context {
+  return Object.assign({ url: new URL('http://localhost/') }, properties) as unknown as Context
+}
+
+async function timeout (ms: number): Promise<void> {
+  await setTimeout(ms * 1.2)
+}

package/source/directives/io/lib/throttle/Quotas.ts

@@ -0,0 +1,83 @@
+import { console } from 'openspan'
+import { Keys } from './Keys'
+import { Quota } from './Quota'
+import { Interval } from './Interval'
+import type { Configuration } from './Configuration'
+import type { Input as Context, Output } from '../../../../io'
+
+export class Quotas {
+  private readonly requests: number
+  private readonly cooldown: number
+  private readonly interval: Interval
+  private readonly keys: Keys
+  private readonly quotas: Record<string, Quota | undefined> = {}
+  private readonly blocked: Record<string, boolean | undefined> = {}
+
+  public constructor (options: Options) {
+    this.requests = options.requests
+    this.cooldown = options.cooldown
+    this.interval = options.interval
+    this.keys = options.keys
+
+    this.interval.on('tick', this.reset)
+  }
+
+  public static create (configuration: Configuration): Quotas {
+    const requests = configuration.requests
+    const cooldown = configuration.cooldown
+    const keys = Keys.create(configuration.key, configuration.condition)
+    const interval = new Interval(configuration.interval)
+
+    return new this({ requests, cooldown, keys, interval })
+  }
+
+  public ok (context: Context): boolean {
+    const key = this.keys.get(context)
+
+    return this.blocked[key] !== true
+  }
+
+  public use (input: Context, output: Output): void {
+    const key = this.keys.match(input, output)
+
+    if (key === null)
+      return
+
+    this.quotas[key] ??= new Quota(this.requests)
+
+    const ok = this.quotas[key]!.use()
+
+    if (!ok)
+      this.block(key)
+  }
+
+  public dispose (): void {
+    this.interval.dispose()
+  }
+
+  private readonly reset = (): void => {
+    for (const key in this.quotas) {
+      const quota = this.quotas[key]!
+
+      if (quota.idle)
+        delete this.quotas[key]
+      else
+        quota.reset()
+    }
+  }
+
+  private block (key: string): void {
+    this.blocked[key] = true
+
+    setTimeout(() => delete this.blocked[key], this.cooldown)
+
+    console.info('Quota exceeded, key blocked', { key, cooldown: this.cooldown })
+  }
+}
+
+interface Options {
+  keys: Keys
+  requests: number
+  cooldown: number
+  interval: Interval
+}

package/source/directives/io/lib/throttle/components/Component.ts

@@ -0,0 +1,5 @@
+import type { Input as Context } from '../../../../../io'
+
+export interface Component {
+  get: (context: Context) => string
+}

package/source/directives/io/lib/throttle/components/IP.ts

@@ -0,0 +1,40 @@
+import type { Context } from '../../../../../HTTP'
+import type { Component } from './Component'
+
+export class IP implements Component {
+  public get (context: Context): string {
+    return this.xff(context) ?? context.request.socket.remoteAddress ?? ''
+  }
+
+  private xff (context: Context): string | undefined {
+    const xff = context.request.headers['x-forwarded-for']
+
+    if (xff === undefined || typeof xff === 'string')
+      return xff
+
+    let ip
+
+    for (const value of xff) {
+      ip = value.trim()
+
+      if (!local(ip))
+        return ip
+    }
+
+    return ip // last otherwise
+  }
+}
+
+function local (ip: string): boolean {
+  return (
+    ip === 'unknown' ||
+    ip === '' ||
+    ip === '127.0.0.1' ||
+    ip === '::1' ||
+    ip.startsWith('10.') ||
+    ip.startsWith('192.168.') ||
+    ip.match(/^172\.(1[6-9]|2[0-9]|3[0-1])\./) !== null ||
+    ip.startsWith('fd') ||
+    ip.startsWith('fe80:')
+  )
+}

package/source/directives/io/lib/throttle/components/Path.ts

@@ -0,0 +1,8 @@
+import type { Context } from '../../../../../HTTP'
+import type { Component } from './Component'
+
+export class Path implements Component {
+  public get (context: Context): string {
+    return context.url.pathname
+  }
+}

package/source/directives/io/lib/throttle/components/index.ts

@@ -0,0 +1,13 @@
+import { Path } from './Path'
+import { IP } from './IP'
+import type { KeyComponentMethod } from '../Configuration'
+import type { Component } from './Component'
+
+type Constructor<T> = new (options: unknown) => T
+
+export const Components: Record<KeyComponentMethod, Constructor<Component>> = {
+  ip: IP,
+  path: Path
+}
+
+export type { Component }

package/source/directives/io/lib/throttle/conditions/Condition.ts

@@ -0,0 +1,5 @@
+import type { Input, Output } from '../../../../../io'
+
+export interface Condition {
+  match: (input: Input, output: Output) => boolean
+}

package/source/directives/io/lib/throttle/conditions/Status.ts

@@ -0,0 +1,17 @@
+import assert from 'node:assert'
+import type { Input, Output } from '../../../../../io'
+import type { Condition } from './Condition'
+
+export class Status implements Condition {
+  private readonly status: number
+
+  public constructor (status: unknown) {
+    assert.ok(typeof status === 'number', 'Status must be a number')
+
+    this.status = status
+  }
+
+  public match (input: Input, output: Output): boolean {
+    return output?.status === this.status
+  }
+}

package/source/directives/io/lib/throttle/conditions/index.ts

@@ -0,0 +1,11 @@
+import { Status } from './Status'
+import type { KeyConditionMethod } from '../Configuration'
+import type { Condition } from './Condition'
+
+type Constructor<T> = new (options: unknown) => T
+
+export const Conditions: Record<KeyConditionMethod, Constructor<Condition>> = {
+  status: Status
+}
+
+export type { Condition }