@toa.io/extensions.exposition 1.0.0-alpha.26 → 1.0.0-alpha.262

package/features/identity.federation.feature

@@ -3,12 +3,11 @@ Feature: Identity Federation
 
   Background:
     Given the `identity.federation` database is empty
-    Given local IDP is running
+    And local IDP is running
 
-  Scenario: Getting identity for a new user
+  Scenario: Asymmetric tokens
     Given the `identity.federation` configuration:
       """yaml
-      explicit_identity_creation: false
       trust:
         - iss: http://localhost:44444
       """
@@ -19,7 +18,6 @@ Feature: Identity Federation
       host: nex.toa.io
       authorization: Bearer ${{ User.id_token }}
       accept: application/yaml
-      content-type: application/yaml
       """
     Then the following reply is sent:
       """
@@ -29,7 +27,6 @@ Feature: Identity Federation
       id: ${{ User.id }}
       roles: []
       """
-    # validate TOKEN
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
@@ -57,42 +54,28 @@ Feature: Identity Federation
 
       id: ${{ User.id }}
       """
-
-  Scenario: Getting identity for a user with symmetric tokens
-    Given the `identity.federation` configuration:
-      """yaml
-      explicit_identity_creation: false
-      trust:
-        - iss: http://localhost:44444
-          secrets:
-            HS384:
-              k1: the-secret
-      """
-    And the IDP HS384 token for GoodUser is issued with following secret:
-      """
-      the-secret
-      """
+    # credential id is detached from the Identity
     When the following request is received:
       """
-      GET /identity/ HTTP/1.1
+      GET /identity/federation/${{ User.id }}/ HTTP/1.1
       host: nex.toa.io
-      authorization: Bearer ${{ GoodUser.id_token }}
+      authorization: Bearer ${{ User.id_token }}
       accept: application/yaml
-      content-type: application/yaml
       """
     Then the following reply is sent:
       """
       200 OK
-      authorization: Token ${{ GoodUser.token }}
 
-      id: ${{ GoodUser.id }}
+      - id: ${{ User.credential }}
+        iss: http://localhost:44444
       """
 
-  Scenario: Creating an Identity using inception with existing credentials
+  Scenario: Creating an Identity using inception
     Given the `identity.federation` configuration:
       """yaml
       trust:
         - iss: http://localhost:44444
+      assert: false
       """
     Given the `users` is running with the following manifest:
       """yaml
@@ -100,8 +83,8 @@ Feature: Identity Federation
         /:
           anonymous: true
           POST:
-            io:output: true
-            incept: id
+            io:output: [id]
+            auth:incept: id
             endpoint: create
       """
     And the IDP token for Bill is issued
@@ -123,7 +106,7 @@ Feature: Identity Federation
 
       id: ${{ Bill.id }}
       """
-    # check that both tokens corresponds to the same id
+    # check that both tokens authenticate the created user's Identity
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
@@ -134,7 +117,9 @@ Feature: Identity Federation
     Then the following reply is sent:
       """
       200 OK
+
       id: ${{ Bill.id }}
+      roles: []
       """
     When the following request is received:
       """
@@ -146,7 +131,24 @@ Feature: Identity Federation
     Then the following reply is sent:
       """
       200 OK
+
       id: ${{ Bill.id }}
+      roles: []
+      """
+    # credential id is detached from the Identity
+    When the following request is received:
+      """
+      GET /identity/federation/${{ Bill.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bill.id_token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      - id: ${{ Bill.credential }}
+        iss: http://localhost:44444
       """
     And the following request is received:
       # same credentials
@@ -154,7 +156,7 @@ Feature: Identity Federation
       POST /users/ HTTP/1.1
       host: nex.toa.io
       authorization: Bearer ${{ Bill.id_token }}
-      content-type: text/plain
+      content-type: application/yaml
 
       name: Mary Louis
       """
@@ -166,14 +168,15 @@ Feature: Identity Federation
   Scenario: Granting a `system` role to a Principal
     Given the `identity.federation` configuration:
       """yaml
-      explicit_identity_creation: false
       trust:
         - iss: http://localhost:44444
       principal:
         iss: http://localhost:44444
-        sub: root-mock-id
+        sub: root
       """
     And the IDP token for root is issued
+
+    # create an identity
     When the following request is received:
       """
       GET /identity/ HTTP/1.1
@@ -182,7 +185,6 @@ Feature: Identity Federation
       accept: application/yaml
       content-type: application/yaml
       """
-    # create an identity
     Then the following reply is sent:
       """
       200 OK
@@ -190,6 +192,9 @@ Feature: Identity Federation
 
       id: ${{ root.id }}
       """
+
+    Then after 0.2 seconds
+
     # check the role
     When the following request is received:
       """
@@ -206,3 +211,175 @@ Feature: Identity Federation
       roles:
         - system
       """
+
+  Scenario: Adding federation to an existing identity
+    Given the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+    And the `identity.basic` database is empty
+
+    # create an identity
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: nex.toa.io
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set Bob.username }}
+      password: #{{ password 8 | set Bob.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ Bob.id }}
+      """
+
+    When the IDP token for Bob is issued
+
+    # add federation
+    When the following request is received:
+      """
+      POST /identity/federation/${{ Bob.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic Bob }}
+      content-type: application/yaml
+      accept: application/yaml
+
+      scheme: bearer
+      credentials: ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ Bob.credential }}
+      iss: http://localhost:44444
+      """
+    # the created credential is listed as is
+    When the following request is received:
+      """
+      GET /identity/federation/${{ Bob.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic Bob }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      - id: ${{ Bob.credential }}
+        iss: http://localhost:44444
+      """
+    And the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ Bob.id }}
+      """
+    # delete the federation credential
+    When the following request is received:
+      """
+      DELETE /identity/federation/${{ Bob.id }}/${{ Bob.credential }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic Bob }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    # add the same federation again
+    When the following request is received:
+      """
+      POST /identity/federation/${{ Bob.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic #{{ basic Bob }}
+      content-type: application/yaml
+      accept: application/yaml
+
+      scheme: bearer
+      credentials: ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    And the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ Bob.id }}
+      """
+
+  Scenario: Authorization code flow with secret
+    Given the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+          aud: nex
+          secret: secret
+      """
+    And auth code for Alice is issued for https://web.toa.io/callback/
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      authorization: Code ${{ Alice.code_credentials }}
+      host: nex.toa.io
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ Alice.token }}
+
+      id: ${{ Alice.id }}
+      """
+
+  Scenario: Authorization code flow with signature
+    Given the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+          aud: nex
+          signature:
+            iss: io.toa.nex.id
+            kid: key-id
+            key: |
+              -----BEGIN PRIVATE KEY-----
+              MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
+              TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
+              HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
+              -----END PRIVATE KEY-----
+      """
+    And auth code for Bob is issued for https://web.toa.io/callback/
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      authorization: Code ${{ Bob.code_credentials }}
+      host: nex.toa.io
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ Bob.token }}
+
+      id: ${{ Bob.id }}
+      """

package/features/identity.otp.feature

@@ -0,0 +1,101 @@
+Feature: OTP authentication
+
+  OTP credentials format is base64(username:password)
+
+  Background:
+    Given the `identity.otp` configuration:
+      """yaml
+      lifetime: 1
+      """
+    And the Gateway is running
+
+  Scenario: Authenticate using OTP
+    Given OTP for `alice` in `nex` authority is issued
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ token }}
+
+      id: ${{ id }}
+      """
+
+    # valid only once
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # same username is resolved to the same identity
+    Given OTP for `alice` in `nex` authority is issued
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ id }}
+      """
+
+    # expiration
+    Given OTP for `alice` in `nex` authority is issued
+    And after 1 second
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Generate own OTP
+    Given transient identity bob
+    When the following request is received:
+      """
+      POST /identity/otp/${{ bob.id }}/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ bob.token }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      code: '${{ bob.code }}'
+      """
+
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP #{{ otp bob }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: ${{ bob.id }}
+      """

package/features/identity.roles.feature

@@ -15,7 +15,7 @@ Feature: Roles management
       """yaml
       /:
         io:output: true
-        auth:role: test
+        auth:role: foo:bar
         GET:
           dev:stub:
             access: granted!
@@ -40,7 +40,7 @@ Feature: Roles management
       accept: application/yaml
       content-type: application/yaml
 
-      role: test
+      role: foo:bar
       """
     Then the following reply is sent:
       """
@@ -49,12 +49,40 @@ Feature: Roles management
       grantor: 72cf9b0ab0ac4ab2b8036e4e940ddcae
       """
     When the following request is received:
-      # user now have the role
+      # root adds a role to a user
+      """
+      POST /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic cm9vdDpzZWNyZXQ=
+      accept: application/yaml
+      content-type: application/yaml
+
+      role: foo:baz
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+
+    # user now have the role
+    When the following request is received:
       """
       GET / HTTP/1.1
       host: nex.toa.io
       authorization: Basic dXNlcjpwYXNz
       """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ token }}
+      """
+    # repeat with token
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
     Then the following reply is sent:
       """
       200 OK
@@ -153,7 +181,7 @@ Feature: Roles management
       """
       422 Unprocessable Entity
 
-      code: OUT_OF_SCOPE
+      code: INACCESSIBLE_SCOPE
       """
 
   Scenario: Delegating role without `system:identity:roles:delegation` role
@@ -187,6 +215,27 @@ Feature: Roles management
       403 Forbidden
       """
 
+  Scenario: Invalid identity id
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username | password                                                     |
+      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | root     | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                  |
+      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | system:identity:roles |
+    When the following request is received:
+      """
+      POST /identity/roles/invalid/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic cm9vdDpzZWNyZXQ=
+      content-type: application/yaml
+
+      role: app:test
+      """
+    Then the following reply is sent:
+      """
+      400 Bad Request
+      """
+
   Scenario Outline: Invalid role name
     Given the `identity.basic` database contains:
       | _id                              | authority | username | password                                                     |

package/features/identity.tokens.feature

@@ -24,8 +24,8 @@ Feature: Tokens lifecycle
     Then the following reply is sent:
       """
       200 OK
-      content-type: text/plain
       authorization: Token ${{ token }}
+      content-type: text/plain
 
       Hello
       """
@@ -55,6 +55,7 @@ Feature: Tokens lifecycle
       """
       200 OK
       authorization: Token ${{ token }}
+      cache-control: no-store
 
       Hello
       """
@@ -88,7 +89,7 @@ Feature: Tokens lifecycle
       """
     And the `identity.tokens` configuration:
       """yaml
-      refresh: 0.1
+      refresh: 1
       """
     And the `identity.basic` database contains:
       | _id                              | _version | authority | username  | password                                                     |
@@ -117,7 +118,7 @@ Feature: Tokens lifecycle
       """
       200 OK
       """
-    Then after 0.2 seconds
+    Then after 1.1 seconds
     When the following request is received:
       """
       GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
@@ -128,102 +129,3 @@ Feature: Tokens lifecycle
       """
       401 Unauthorized
       """
-
-  Scenario: Issuing own token
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      """
-    When the following request is received:
-      """
-      POST /identity/tokens/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      content-type: application/yaml
-
-      lifetime: 0
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """
-    # Token scheme must be used
-    When the following request is received:
-      """
-      POST /identity/tokens/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-
-      lifetime: 60
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: Responses with tokens comes with `no-store`
-    Given the `identity.tokens` configuration:
-      """yaml
-      refresh: 1
-      """
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        /hello/:id:
-          auth:id: id
-          GET:
-            dev:stub: Hello
-        /cacheable/:id:
-          auth:id: id
-          cache:control: max-age=10000
-          GET:
-            dev:stub: Keep it
-      """
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      cache-control: no-store
-      """
-    Then after 1 second
-    When the following request is received:
-      """
-      GET /cacheable/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ fresh_token }}
-      cache-control: no-store
-      """
-    When the following request is received:
-      """
-      GET /cacheable/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ fresh_token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: private, max-age=10000
-      """