@toa.io/extensions.exposition 1.0.0-alpha.22 → 1.0.0-alpha.220

package/features/auth.claims.feature

@@ -0,0 +1,170 @@
+@security
+Feature: Federated identity authentication
+
+  Background:
+    Given the `identity.federation` database is empty
+    And local IDP is running
+    And the IDP token for Bob is issued
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+
+  Scenario: Full claim
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claims:
+            iss: http://localhost:44444
+            aud: test
+            sub: Bob
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: Only `sub`
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claims:
+            sub: Bob
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: No `sub`
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claims:
+            iss: http://localhost:44444
+            aud: test
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: `sub` mismatch
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claims:
+            iss: http://localhost:44444
+            sub: Alice
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: `aud` mismatch
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claims:
+            iss: http://localhost:44444
+            aud: goalkeepers
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Matching authority and Route parameter
+    Given the annotation:
+      """yaml
+      authorities:
+        test: the.test.local
+      /:
+        /:id:
+          GET:
+            auth:claims:
+              aud: :authority
+              sub: /:id
+            dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET /Bob/ HTTP/1.1
+      host: the.test.local
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: `iss` matching authority common domain
+    Given the annotation:
+      """yaml
+      /:
+        /:id:
+          GET:
+            auth:claims:
+              iss: :domain
+              sub: /:id
+            dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET /Bob/ HTTP/1.1
+      host: localhost
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/auth.incept.feature

@@ -0,0 +1,120 @@
+Feature: Identity inception
+
+  Scenario: Non-associated Identity inception
+    Given the `identity.basic` database is empty
+    When the following request is received:
+      """
+      POST /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjpwYXNzMTIzNA==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ id }}
+      roles: []
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjpwYXNzMTIzNA==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ id }}
+      roles: []
+      """
+
+  Scenario: Creating new Identity using inception with Basic scheme
+    Given the `users` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            io:input: [name]
+            io:output: true
+            incept: id
+            query: ~
+            endpoint: transit
+      """
+    When the following request is received:
+      """
+      POST /users/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic }}
+      accept: application/yaml
+      content-type: application/yaml
+
+      name: Bill Smith
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ id }}
+      """
+
+  Scenario: Inception with operation error
+    Given the `users` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            io:input: [name]
+            io:output: true
+            incept: id
+            endpoint: create
+      """
+    When the following request is received:
+      """
+      POST /users/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic }}
+      accept: application/yaml
+      content-type: application/yaml
+
+      name: return_error
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """
+
+  Scenario: Incept without credentials
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            auth:incept: id
+            io:output: true
+            query: ~
+            endpoint: echo
+      """
+    And transient identity
+    When the following request is received:
+      """
+      POST /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      content-type: application/yaml
+
+      id: ${{ identity.id }}
+      foo: bar
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ identity.id }}
+      foo: bar
+      """

package/features/auth.input.feature

@@ -0,0 +1,59 @@
+Feature: Input properties authorization
+
+  Background:
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username | password                                                     |
+      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | root     | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role  |
+      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | app:b |
+
+  Scenario: Input properties authorization
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:input: [a, b]
+          io:output: [a, b]
+          anonymous: true
+          auth:role: app:b
+          auth:input:
+            - prop: b
+              role: app:b
+          PUT: parameters
+      """
+
+    When the following request is received:
+      """
+      PUT /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      content-type: application/yaml
+
+      a: foo
+      b: bar
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+
+      Input property is not authorized
+      """
+    When the following request is received:
+      """
+      PUT /echo/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic cm9vdDpzZWNyZXQ=
+      accept: application/yaml
+      content-type: application/yaml
+
+      a: foo
+      b: bar
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      a: foo
+      b: bar
+      """

package/features/auth.issue.feature

@@ -0,0 +1,32 @@
+Feature: Issue authentication token for a response
+
+  Scenario: Issue token
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          POST:
+            auth:issue: id
+            io:output: true
+            query: ~
+            endpoint: echo
+      """
+    And transient identity
+    When the following request is received:
+      """
+      POST /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      content-type: application/yaml
+
+      id: ${{ identity.id }}
+      foo: bar
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      authorization: Token ${{ token }}
+
+      id: ${{ identity.id }}
+      foo: bar
+      """

package/features/authorities.basic.feature

@@ -9,6 +9,7 @@ Feature: Basic credentials with authorities
       /:
         /:id:
           auth:id: id
+          io:output: true
           GET:
             dev:stub: Hello
       """
@@ -22,7 +23,7 @@ Feature: Basic credentials with authorities
       accept: application/yaml
 
       username: #{{ id | set one.username }}
-      password: '#{{ password 8 | set one.password }}'
+      password: #{{ password 8 | set one.password }}
       """
     Then the following reply is sent:
       """
@@ -40,7 +41,7 @@ Feature: Basic credentials with authorities
       accept: application/yaml
 
       username: #{{ id | set two.username }}
-      password: '#{{ password 8 | set two.password }}'
+      password: #{{ password 8 | set two.password }}
       """
     Then the following reply is sent:
       """
@@ -106,7 +107,7 @@ Feature: Basic credentials with authorities
       """
     Then the following reply is sent:
       """
-      422 Unprocessable Entity
+      409 Conflict
       """
     When the following request is received:
       """

package/features/authorities.feature

@@ -19,6 +19,8 @@ Feature: Authorities
       """
       200 OK
       """
+
+    # arbitrary authorities are also allowed
     When the following request is received:
       """
       GET / HTTP/1.1
@@ -26,7 +28,5 @@ Feature: Authorities
       """
     Then the following reply is sent:
       """
-      404 Not Found
-
-      Unknown authority
+      200 OK
       """

package/features/authorities.federation.feature

@@ -1,55 +1,53 @@
 Feature: OIDC tokens with authorities
 
+  Background:
+    Given local IDP is running
+    And the `identity.federation` database is empty
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+
+
   Scenario: OIDC tokens are scoped to authorities
     Given the annotation:
       """yaml
       authorities:
         one: the.one.com
-        two: the.two.com
       /:
         /:id:
           auth:id: id
           GET:
             dev:stub: Hello
       """
-    And local IDP is running
-    And the `identity.federation` database is empty
-    And the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:44444
-      """
     And the IDP token for One is issued
     And the IDP token for Two is issued
 
     # create identities
     When the following request is received:
       """
-      POST /identity/federation/ HTTP/1.1
+      GET /identity/ HTTP/1.1
       host: the.one.com
+      authorization: Bearer ${{ One.id_token }}
       accept: application/yaml
-      content-type: application/yaml
-
-      credentials: ${{ One.id_token }}
       """
     Then the following reply is sent:
       """
-      201 Created
+      200 OK
 
       id: ${{ One.id }}
       """
     When the following request is received:
       """
-      POST /identity/federation/ HTTP/1.1
+      GET /identity/ HTTP/1.1
+      authorization: Bearer ${{ Two.id_token }}
       host: the.two.com
       accept: application/yaml
-      content-type: application/yaml
-
-      credentials: ${{ Two.id_token }}
       """
     Then the following reply is sent:
       """
-      201 Created
+      200 OK
 
       id: ${{ Two.id }}
       """
@@ -65,6 +63,8 @@ Feature: OIDC tokens with authorities
       """
       200 OK
       """
+
+    # authorization will create new identity within `one` authority
     When the following request is received:
       """
       GET /${{ Two.id }}/ HTTP/1.1
@@ -73,7 +73,7 @@ Feature: OIDC tokens with authorities
       """
     Then the following reply is sent:
       """
-      401 Unauthorized
+      403 Forbidden
       """
 
     # access `two` authority
@@ -85,7 +85,7 @@ Feature: OIDC tokens with authorities
       """
     Then the following reply is sent:
       """
-      401 Unauthorized
+      403 Forbidden
       """
     When the following request is received:
       """

package/features/authorities.tokens.feature

@@ -5,7 +5,6 @@ Feature: Token credentials with authorities
       """yaml
       authorities:
         one: the.one.com
-        two: the.two.com
       /:
         /:id:
           auth:id: id
@@ -43,7 +42,7 @@ Feature: Token credentials with authorities
       id: ${{ one.id }}
       """
 
-    # create identity within the `two` authority
+    # create identity within the `the.two.com` authority
     When the following request is received:
       """
       POST /identity/basic/ HTTP/1.1

package/features/body.feature

@@ -47,3 +47,30 @@ Feature: Request body
       | operation |
       | compute   |
       | affect    |
+
+  Scenario: JSON body with charset in content-type
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          POST:
+            endpoint: echo
+      """
+    When the following request is received:
+      """
+      POST /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/json
+      content-type: application/json; charset=utf-8
+
+      {"foo":"bar"}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/json
+      vary: accept
+
+      {"foo":"bar"}
+      """