@toa.io/extensions.exposition 1.0.0-alpha.26 → 1.0.0-alpha.263

package/components/identity.tokens/source/lib/types.ts

@@ -0,0 +1,97 @@
+import type { Call, Maybe, Observation, telemetry } from '@toa.io/types'
+
+export interface Context {
+  local: {
+    observe: Observation<Entity>
+    encrypt: Call<Maybe<string>, EncryptInput>
+    decrypt: Call<Maybe<DecryptOutput>, string>
+  }
+  remote: {
+    identity: {
+      keys: {
+        observe: Observation<CustomKey>
+        create: Call<Key>
+      }
+      roles: {
+        list: Call<string[]>
+      }
+    }
+  }
+  configuration: Configuration
+  logs: telemetry.Logs
+}
+
+export interface Configuration {
+  readonly keys: ConfiguredKey[]
+  readonly lifetime: number
+  readonly refresh: number
+  readonly cache: {
+    max: number
+    ttl: number
+  }
+}
+
+export interface ConfiguredKey extends Pick<Key, 'id' | 'key'> {
+  format?: 'jwe' | 'paseto'
+}
+
+export interface Entity {
+  revokedAt?: number
+}
+
+export interface Identity extends Record<string, any> {
+  id: string
+  roles: string[]
+  permissions?: Record<string, string[]>
+}
+
+export interface AuthenticateInput {
+  authority: string
+  credentials: string
+}
+
+export interface AuthenticateOutput {
+  identity: Identity
+  refresh: boolean
+}
+
+export interface EncryptInput {
+  authority: string
+  identity: Identity
+  lifetime?: number
+  scopes?: string[]
+  permissions?: Record<string, string[]>
+  key?: Key
+}
+
+export interface DecryptOutput {
+  iss: string
+  iat: string
+  exp?: string
+  identity: Identity
+  refresh: boolean
+}
+
+export interface Claims {
+  identity: Identity
+  iss: string
+  iat: string
+  exp?: string
+}
+
+export interface JWEClaims {
+  identity: Identity
+  iss: string
+  iat: number
+  exp?: number
+}
+
+export interface Key {
+  id: string
+  key: string
+  label: string
+}
+
+export interface CustomKey extends Key {
+  identity: string
+}

package/components/identity.tokens/source/revoke.ts

@@ -1,5 +1,5 @@
-import { type Entity } from './types'
+import type { Entity } from './lib'
 
-export function transition (_: never, object: Entity): void {
+export function transition (_: unknown, object: Entity): void {
   object.revokedAt = Date.now()
 }

package/components/octets.storage/manifest.toa.yaml

@@ -4,18 +4,26 @@ name: storage
 storages: ~
 
 operations:
-  store:
+  put:
     bindings: ~
     input:
       storage*: string
       request*: ~
+      location: string
       accept: string
-      meta: <string>
-  fetch: &simple
+      limit: number
+      trust: ~ # array of strings or regular expressions
+    errors:
+      - LOCATION_UNTRUSTED
+      - LOCATION_LENGTH
+      - LOCATION_UNAVAILABLE
+      - INVALID_ID
+  get: &simple
     bindings: ~
     input:
       storage*: string
       path*: string
-  get: *simple
-  list: *simple
+      range: string
+      agent: string
+  head: *simple
   delete: *simple

package/components/octets.storage/operations/get.js

@@ -1,7 +1,7 @@
 'use strict'
 
-function get (input, context) {
-  return context.storages[input.storage].get(input.path)
+async function get (input, context) {
+  return await context.storages[input.storage].get(input.path, { range: input.range, agent: input.agent })
 }
 
-exports.computation = get
+exports.effect = get

package/components/octets.storage/operations/head.js

@@ -0,0 +1,7 @@
+'use strict'
+
+async function head (input, context) {
+  return await context.storages[input.storage].head(input.path)
+}
+
+exports.computation = head

package/components/octets.storage/operations/put.js

@@ -0,0 +1,135 @@
+'use strict'
+
+const { Readable } = require('node:stream')
+const { posix } = require('node:path')
+const { Err } = require('error-value')
+const { match } = require('matchacho')
+
+async function put (input, context) {
+  const { storage, request, location, accept, limit, trust } = input
+  const url = request.url
+  const id = request.headers['content-id']
+  const claim = request.headers['content-type']
+  const attributes = parseAttributes(request.headers['content-attributes'])
+  const reference = request.headers['content-location']
+
+  /** @type {Readable} */
+  let body = request
+
+  const options = { claim, accept, attributes }
+
+  if (id !== undefined) {
+    if (!ID_RX.test(id))
+      return ERR_INVALID_ID
+
+    options.id = id
+  }
+
+  if (reference !== undefined) {
+    const length = Number.parseInt(request.headers['content-length'])
+
+    if (length !== 0)
+      return ERR_LENGTH
+
+    if (!trusted(reference, trust))
+      return ERR_UNTRUSTED
+
+    body = await download(reference)
+
+    if (body instanceof Error)
+      return body
+
+    options.origin = reference
+  }
+
+  if (limit !== undefined)
+    options.limit = limit
+
+  const path = posix.resolve(url, location ?? '.')
+
+  return context.storages[storage].put(path, body, options)
+}
+
+/**
+ * @param {string | string[] | undefined} values
+ * @returns {Record<string, string>}
+ */
+function parseAttributes (values) {
+  const attributes = {}
+
+  if (values === undefined)
+    return attributes
+
+  if (typeof values === 'string')
+    values = values.split(',')
+
+  for (const pair of values) {
+    const eq = pair.indexOf('=')
+    const key = (eq === -1 ? pair : pair.slice(0, eq)).trim()
+
+    attributes[key] = eq === -1 ? 'true' : pair.slice(eq + 1).trim()
+  }
+
+  return attributes
+}
+
+/**
+ * @param {string} location
+ * @return {Readable | Error}
+ */
+async function download (location) {
+  const response = await fetch(location)
+
+  if (!response.ok)
+    return ERR_UNAVAILABLE
+
+  return response.body === null ? ERR_UNAVAILABLE : Readable.fromWeb(
+    /** @type {import('node:stream/web').ReadableStream} **/ response.body)
+
+}
+
+/**
+ * @param {string} location
+ * @param {Trust | undefined} trust
+ * @return {boolean}
+ */
+function trusted (location, trust) {
+  if (trust === undefined)
+    return false
+
+  const url = toURL(location)
+
+  if (url === null)
+    return false
+
+  for (const permission of trust) {
+    const ok = match(permission,
+      String, (origin) => url.origin === origin,
+      RegExp, (pattern) => pattern.test(url.origin))
+
+    if (ok)
+      return true
+  }
+
+  return false
+}
+
+function toURL (location) {
+  try {
+    return new URL(location)
+  } catch (error) {
+    return null
+  }
+}
+
+const ERR_UNTRUSTED = new Err('LOCATION_UNTRUSTED', 'Location is not trusted')
+const ERR_LENGTH = new Err('LOCATION_LENGTH', 'Content-Length must be 0 when Content-Location is used')
+const ERR_UNAVAILABLE = new Err('LOCATION_UNAVAILABLE', 'Location is not available')
+const ERR_INVALID_ID = new Err('INVALID_ID', 'Invalid Content-ID')
+
+const ID_RX = /^[a-zA-Z0-9-_]{1,32}$/
+
+exports.effect = put
+
+/** @typedef {Array<string | RegExp>} Trust */
+/** @typedef {import('node:stream').Readable} Readable */

package/{components/context.toa.yaml → context.toa.yaml}

@@ -1,7 +1,6 @@
 # used for development only
 
 name: exposition
-packages: '*'
 registry: localhost
 
 amqp: amqp://localhost
@@ -9,7 +8,12 @@ mongodb: mongodb://localhost
 
 configuration:
   identity.tokens:
-    key0: k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA
+    keys:
+      - id: key0
+        key: sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs
+      - id: legacy0
+        key: k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA
+        format: paseto
 
   identity.federation:
     trust:

package/cucumber.js

@@ -1,6 +1,6 @@
 module.exports = {
   default: {
-    requireModule: ['ts-node/register'],
+    requireModule: ['ts-node/register/transpile-only'],
     require: ['./features/**/*.ts'],
     failFast: true
   }

package/documentation/access.md

@@ -25,7 +25,11 @@ responds with an authorization error.
 Grants access if its value is `true` and no credentials were provided[^1].
 
 [^1]: Credentials in the request make the
-response [non-cachable](https://datatracker.ietf.org/doc/html/rfc7234#section-3).
+response [non-cacheable](https://datatracker.ietf.org/doc/html/rfc7234#section-3).
+
+### `anyone`
+
+Grants access if its value is `true` and valid credentials were provided.
 
 ### `id`
 
@@ -37,11 +41,8 @@ the directive's value.
 Given the Route declaration and corresponding HTTP request:
 
 ```yaml
-# context.toa.yaml
-
-exposition:
-  /users/:user-id:
-    id: "user-id"
+/users/:user-id:
+  id: "user-id"
 ```
 
 ```http
@@ -57,11 +58,8 @@ is `87480f2bd88048518c529d7957475ecd`.
 Grants access if resolved Identity has a role matching the directive's value or one of its values.
 
 ```yaml
-# context.toa.yaml
-
-exposition:
-  /code:
-    role: [developer, reviewer]
+/code:
+  role: [developer, reviewer]
 ```
 
 Access will be granted if the resolved Identity has a role that matches `developer` or `reviewer`.
@@ -73,11 +71,50 @@ Read [Roles](#roles) section for more details.
 The `role` directive can be used with a placeholder in the route.
 
 ```yaml
-# context.toa.yaml
+/:org-id:
+  role: app:{org-id}:moderator
+```
 
-exposition:
-  /:org-id:
-    role: app:{org-id}:moderator
+### `claims`
+
+Grants access if `Bearer` authentication scheme is used
+and the Token's claims matches the specified values.
+
+```yaml
+/:
+  auth:claims:
+    iss: https://id.example.com
+    sub: someone
+    aud: stars
+```
+
+> If OIDC token claim contains `aud`
+> as [an array](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation), the
+> directive will match if at least one value.
+
+At least one property is required.
+
+Values may refer to the Route parameters or the request authority:
+
+```yaml
+/secrets/:org-id:
+  auth:claims:
+    iss: https://id.org.com
+    sub: /:org-id
+    aud: :authority
+```
+
+An expression `:domain` will match if the domain in the value of `iss` matches the request
+authority, excluding the most specific subdomain.
+
+Issuer `https://accounts.example.com` matches request authorities `images.example.com`
+and `sub.images.example.com`, but not `images.another.com`.
+
+```yaml
+/images/:user-id:
+  auth:claims:
+    iss: :domain
+    sub: /:org-id
 ```
 
 ### `rule`
@@ -88,17 +125,34 @@ directives grant access. The value of the `rule` directive can be a single Rule
 #### Example
 
 ```yaml
-# context.toa.yaml
-
-exposition:
-  /commits/:user-id:
-    rule:
-      id: user-id
-      role: developer
+/commits/:user-id:
+  rule:
+    id: user-id
+    role: developer
 ```
 
 Access will be granted if an Identity matches a `user-id` placeholder and has a Role of `developer`.
 
+### `input`
+
+Restricts access based on the request body (which must be an object).
+
+```yaml
+/commits/:id:
+  PUT:
+    auth:role: [developer, reviewer]
+    auth:input:
+      - prop: approved
+        role: reviewer
+      - prop: message
+        role: developer
+```
+
+The example above restricts access to the `approved` property of the request body to the identity
+with the `reviewer` role, and the `message` property to the identity with the `developer` role.
+
+> `auth:input` directive does not grant access by itself.
+
 ### `delegate`
 
 Embeds the value of the current Identity into the request body as a property named after the value
@@ -124,11 +178,8 @@ directive.
 #### Example
 
 ```yaml
-# context.toa.yaml
-
-/exposition:
-  /commits/:user-id:
-    role: developer:senior
+/commits/:user-id:
+  role: developer:senior
 ```
 
 The example above defines a `role` directive with the specified `developer:senior` Role Scope.

package/documentation/authorities.md

@@ -17,16 +17,9 @@ exposition:
     two: the.two.com
 ```
 
-## Ingress
+## Mappings
 
-Each host in the authority definition is used to create a Kubernetes Ingress resource.
-
-> If the application is accessed with the `:authority` that does not match the authority definition,
-> the response with `404` status code is returned.
-
-## Embedding
-
-To pass the requested authority to the operation call, [`vary:embed` directive](vary.md#embeddings)
+To pass the requested authority to the operation call, [`map:authority` directive](map.md#authority)
 can be used.
 
 ```yaml
@@ -35,11 +28,13 @@ can be used.
 exposition:
   /:
     GET:
-      vary:embed:
-        app: authority
+      map:authority: hostname
       endpoint: observe
 ```
 
+If the value of the `authority` pseudo-header is not present in the `authorities` definition,
+then the value is embedded as is.
+
 ## Identity
 
 Credentials stored or issued by the [authentication system](identity.md) are associated with an