@toa.io/extensions.exposition 1.0.0-alpha.21 → 1.0.0-alpha.22

package/features/authorities.basic.feature

@@ -0,0 +1,140 @@
+Feature: Basic credentials with authorities
+
+  Scenario: Basic credentials are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+        two: the.two.com
+      /:
+        /:id:
+          auth:id: id
+          GET:
+            dev:stub: Hello
+      """
+
+    # create basic credentials within the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set one.username }}
+      password: '#{{ password 8 | set one.password }}'
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ one.id }}
+      """
+
+    # create basic credentials within the `two` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set two.username }}
+      password: '#{{ password 8 | set two.password }}'
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ two.id }}
+      """
+
+    # access the resource with the `one` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # access the resource with the `two` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+    # create `one` credentials in the `two` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ one.username }}
+      password: ${{ one.password }}
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ one.username }}
+      password: ${{ one.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+
+    # create `two` credentials in the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ two.username }}
+      password: ${{ two.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """

package/features/authorities.feature

@@ -0,0 +1,32 @@
+Feature: Authorities
+
+  Scenario: Accessing an authority
+    Given the annotation:
+      """yaml
+      authorities:
+        example: the.example.com
+      /:
+        anonymous: true
+        GET:
+          dev:stub: Hello
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: the.example.com
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: the.other.com
+      """
+    Then the following reply is sent:
+      """
+      404 Not Found
+
+      Unknown authority
+      """

package/features/authorities.federation.feature

@@ -0,0 +1,99 @@
+Feature: OIDC tokens with authorities
+
+  Scenario: OIDC tokens are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+        two: the.two.com
+      /:
+        /:id:
+          auth:id: id
+          GET:
+            dev:stub: Hello
+      """
+    And local IDP is running
+    And the `identity.federation` database is empty
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+    And the IDP token for One is issued
+    And the IDP token for Two is issued
+
+    # create identities
+    When the following request is received:
+      """
+      POST /identity/federation/ HTTP/1.1
+      host: the.one.com
+      accept: application/yaml
+      content-type: application/yaml
+
+      credentials: ${{ One.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ One.id }}
+      """
+    When the following request is received:
+      """
+      POST /identity/federation/ HTTP/1.1
+      host: the.two.com
+      accept: application/yaml
+      content-type: application/yaml
+
+      credentials: ${{ Two.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ Two.id }}
+      """
+
+    # access `one` authority
+    When the following request is received:
+      """
+      GET /${{ One.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Bearer ${{ One.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET /${{ Two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Bearer ${{ Two.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # access `two` authority
+    When the following request is received:
+      """
+      GET /${{ One.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Bearer ${{ One.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      GET /${{ Two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Bearer ${{ Two.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/authorities.tokens.feature

@@ -0,0 +1,118 @@
+Feature: Token credentials with authorities
+
+  Scenario: Tokens are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+        two: the.two.com
+      /:
+        /:id:
+          auth:id: id
+          GET:
+            dev:stub: Hello
+      """
+
+    # create identity within the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set one.username }}
+      password: '#{{ password 8 | set one.password }}'
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: the.one.com
+      accept: application/yaml
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ one.token }}
+
+      id: ${{ one.id }}
+      """
+
+    # create identity within the `two` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set two.username }}
+      password: '#{{ password 8 | set two.password }}'
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: the.two.com
+      accept: application/yaml
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ two.token }}
+
+      id: ${{ two.id }}
+      """
+
+    # access `one` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Token ${{ one.token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Token ${{ two.token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # access `two` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Token ${{ one.token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Token ${{ two.token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/body.feature

@@ -11,6 +11,7 @@ Feature: Request body
     When the following request is received:
       """
       POST /pots/ HTTP/1.1
+      host: nex.toa.io
       content-type: application/yaml
 
       title: Hello
@@ -32,6 +33,7 @@ Feature: Request body
     When the following request is received:
       """
       GET /echo/world/ HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
       """
     Then the following reply is sent:

package/features/cache.feature

@@ -4,8 +4,8 @@ Feature: Caching
     Given the `identity.basic` database contains:
       # developer:secret
       # user:12345
-      | _id                              | username  | password                                                     |
-      | b70a7dbca6b14a2eaac8a9eb4b2ff4db | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | _id                              | authority | username  | password                                                     |
+      | b70a7dbca6b14a2eaac8a9eb4b2ff4db | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
     Given the `identity.roles` database contains:
       | _id                              | identity                         | role      |
       | 775a648d054e4ce1a65f8f17e5b51803 | b70a7dbca6b14a2eaac8a9eb4b2ff4db | developer |
@@ -23,6 +23,7 @@ Feature: Caching
     When the following request is received:
       """
       GET / HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
       """
     Then the following reply is sent:
@@ -53,9 +54,22 @@ Feature: Caching
           GET:
             dev:stub: hello
       """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ token }}
+      cache-control: no-store
+      """
     When the following request is received:
       """
       GET / HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
       """
     Then the following reply is sent:
@@ -69,8 +83,9 @@ Feature: Caching
     When the following request is received:
       """
       GET /foo/ HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      authorization: Token ${{ token }}
       """
     Then the following reply is sent:
       """
@@ -83,8 +98,9 @@ Feature: Caching
     When the following request is received:
       """
       GET /bar/ HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      authorization: Token ${{ token }}
       """
     Then the following reply is sent:
       """
@@ -111,6 +127,7 @@ Feature: Caching
     When the following request is received:
       """
       POST / HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the reply does not contain:
@@ -130,8 +147,21 @@ Feature: Caching
       """
     When the following request is received:
       """
-      GET / HTTP/1.1
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
       authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ token }}
+      cache-control: no-store
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
       accept: text/plain
 
       """
@@ -155,6 +185,7 @@ Feature: Caching
     When the following request is received:
       """
       GET / HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
       """
     Then the reply does not contain:
@@ -178,6 +209,7 @@ Feature: Caching
     When the following request is received:
       """
       GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
       authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
       """
     # `no-store` when token is issued
@@ -185,10 +217,12 @@ Feature: Caching
       """
       200 OK
       authorization: Token ${{ token }}
+      cache-control: no-store
       """
     When the following request is received:
       """
       GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
       authorization: Token ${{ token }}
       """
     Then the following reply is sent:

package/features/cors.feature

@@ -12,6 +12,7 @@ Feature: CORS Support
     When the following request is received:
       """
       OPTIONS / HTTP/1.1
+      host: nex.toa.io
       origin: https://hello.world
       """
     Then the following reply is sent:
@@ -28,6 +29,7 @@ Feature: CORS Support
     When the following request is received:
       """
       GET /foo/ HTTP/1.1
+      host: nex.toa.io
       origin: https://hello.world
       """
     Then the following reply is sent:
@@ -49,6 +51,7 @@ Feature: CORS Support
     When the following request is received:
       """
       GET /bar/ HTTP/1.1
+      host: nex.toa.io
       origin: https://hello.world
       """
     Then the following reply is sent:
@@ -61,6 +64,7 @@ Feature: CORS Support
     When the following request is received:
       """
       GET /foo/ HTTP/1.1
+      host: nex.toa.io
       origin: https://hello.world
       """
     Then the following reply is sent:

package/features/directives.feature

@@ -13,6 +13,7 @@ Feature: Directives
     When the following request is received:
       """
       GET / HTTP/1.1
+      host: nex.toa.io
       accept: application/json
       """
     Then the following reply is sent:
@@ -38,6 +39,7 @@ Feature: Directives
     When the following request is received:
       """
       GET /pots/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent:
@@ -50,6 +52,7 @@ Feature: Directives
     When the following request is received:
       """
       GET /pots/non-existent/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent:

package/features/dynamic.feature

@@ -18,6 +18,7 @@ Feature: Dynamic tree updates
     When the following request is received:
       """
       GET /pots/ HTTP/1.1
+      host: nex.toa.io
       """
     Then the following reply is sent:
       """
@@ -34,6 +35,7 @@ Feature: Dynamic tree updates
     When the following request is received:
       """
       GET /pots/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent:
@@ -66,6 +68,7 @@ Feature: Dynamic tree updates
     When the following request is received:
       """
       GET /pots/big/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent:
@@ -98,6 +101,7 @@ Feature: Dynamic tree updates
     When the following request is received:
       """
       GET /pots/big/?criteria=temperature>50 HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent: