@toa.io/extensions.exposition 1.0.0-alpha.27 → 1.0.0-alpha.270

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/extensions.exposition",
-  "version": "1.0.0-alpha.27",
+  "version": "1.0.0-alpha.270",
   "description": "Toa Exposition",
   "author": "temich <tema.gurtovoy@gmail.com>",
   "homepage": "https://github.com/toa-io/toa#readme",
@@ -17,39 +17,50 @@
     "access": "public"
   },
   "dependencies": {
-    "@toa.io/core": "1.0.0-alpha.27",
-    "@toa.io/generic": "1.0.0-alpha.27",
-    "@toa.io/schemas": "1.0.0-alpha.27",
-    "bcryptjs": "2.4.3",
-    "error-value": "0.3.0",
-    "js-yaml": "4.1.0",
-    "matchacho": "0.3.5",
-    "msgpackr": "1.10.1",
-    "negotiator": "0.6.3",
+    "@simplewebauthn/server": "13.3.3",
+    "@toa.io/core": "1.0.0-alpha.270",
+    "@toa.io/generic": "1.0.0-alpha.254",
+    "@toa.io/schemas": "1.0.0-alpha.270",
+    "bcryptjs": "3.0.3",
+    "content-type": "2.1.0",
+    "error-value": "0.4.4",
+    "jose": "6.2.10",
+    "js-yaml": "5.4.1",
+    "lru-cache": "11.5.2",
+    "matchacho": "0.6.0",
+    "minimatch": "10.2.6",
+    "msgpackr": "2.1.0",
+    "negotiator": "1.1.0",
+    "openspan": "1.0.0-alpha.270",
     "paseto": "3.1.4"
   },
-  "jest": {
-    "preset": "ts-jest",
-    "testEnvironment": "node"
-  },
   "scripts": {
-    "test": "jest",
-    "transpile": "tsc && npm run transpile:bans && npm run transpile:basic && npm run transpile:tokens && npm run transpile:roles && npm run transpile:federation",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest",
+    "transpile": "tsc && npm run transpile:bans && npm run transpile:basic && npm run transpile:tokens && npm run transpile:roles && npm run transpile:federation && npm run transpile:credentials && npm run transpile:keys && npm run transpile:passkeys && npm run transpile:otp",
     "transpile:bans": "tsc -p ./components/identity.bans",
     "transpile:basic": "tsc -p ./components/identity.basic",
     "transpile:tokens": "tsc -p ./components/identity.tokens",
     "transpile:roles": "tsc -p ./components/identity.roles",
-    "pretranspile:federation": "js-yaml components/identity.federation/manifest.toa.yaml | jq -M '{ type: \"object\", properties: {configuration: .configuration.schema, entity: .entity.schema }, additionalProperties: false}' > schemas.json && json2ts -i schemas.json -o components/identity.federation/source/schemas.ts && rm schemas.json",
     "transpile:federation": "tsc -p ./components/identity.federation",
+    "transpile:credentials": "tsc -p ./components/identity.credentials",
+    "transpile:keys": "tsc -p ./components/identity.keys",
+    "transpile:passkeys": "tsc -p ./components/identity.passkeys",
+    "transpile:otp": "tsc -p ./components/identity.otp",
     "features": "cucumber-js",
-    "features:security": "cucumber-js --tags @security"
+    "features:security": "cucumber-js --tags @security",
+    "features:octets": "cucumber-js features/octets.*"
   },
   "devDependencies": {
-    "@toa.io/agent": "1.0.0-alpha.27",
-    "@toa.io/extensions.storages": "1.0.0-alpha.27",
-    "@types/bcryptjs": "2.4.3",
-    "@types/cors": "2.8.13",
-    "@types/negotiator": "0.6.1"
+    "@toa.io/extensions.storages": "*",
+    "@types/cors": "2.8.19",
+    "@types/negotiator": "0.6.5",
+    "jest-esbuild": "0.4.0"
+  },
+  "jest": {
+    "transform": {
+      "^.+\\.ts$": "jest-esbuild"
+    },
+    "testEnvironment": "node"
   },
-  "gitHead": "9bc4bdb919688c5272791020746f70d51a520750"
+  "gitHead": "94400bdd411b4c25074ffcf58184580ddd060268"
 }

package/readme.md

@@ -136,7 +136,13 @@ exposition:
 | `class`       | Ingress class.                                                                                                    |
 | `annotations` | Ingress annotations.                                                                                              |
 | `debug`       | Output server errors. Default `false`.                                                                            |
-| `trace`       | Output [server timing](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Server-Timing). Default `false`. |
+
+### Observability
+
+Each response contains a `ray` header with the trace ID of the request, and
+[server timing](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Server-Timing) headers.
+
+Incoming trace context is continued, see [Tracing](documentation/tracing.md).
 
 ### Context resources
 
@@ -180,6 +186,24 @@ exposition:
       GET: foo.bar.observe
 ```
 
+## Ready probe
+
+The gateway serves `GET /.ready` on port `8000` for Kubernetes startup/readiness probes.
+
+It returns `200` only after:
+
+1. The in-process identity composition has connected
+2. Initial route discovery has settled
+3. The HTTP server is listening
+
+Before listen, probes get connection refused; after listen but before ready, `503`.
+When ready, the process also sends `process.send('ready')` (for PM2 `wait_ready`).
+
+The nested identity composition shares this process. Deployment disables telemetry's port-`8001`
+probe (`TOA_TELEMETRY_READY=false`) so only the gateway `/.ready` is used.
+
+See also [telemetry ready probe](../telemetry/readme.md#ready-probe).
+
 ## See Also
 
 - [Protocol support](documentation/protocol.md)

package/schemas/annotation.cos.yaml

@@ -1,6 +1,17 @@
 authorities*: <string>
 class: string
+resources:
+  # `null` deploys the service without any, which every deployment has to state one way
+  # or the other — see `migrations/263.md`.
+  type: object
+  nullable: true
+  properties:
+    cpu: &constraint
+      type: array
+      items: { type: string }
+      minItems: 2
+      maxItems: 2
+    memory: *constraint
 annotations: <string>
 debug: boolean
-trace: boolean
 /: ~

package/schemas/io/throttle.cos.yaml

@@ -0,0 +1,42 @@
+definitions:
+  component: &component
+    anyOf:
+      - type: string
+        enum: [ip, path, route, identity]
+      - type: object
+        properties:
+          segment:
+            type: string
+        required: [segment]
+        additionalProperties: false
+  condition: &condition
+    type: object
+    properties:
+      status:
+        type: number
+type: object
+properties:
+  key:
+    anyOf:
+      - *component
+      - type: array
+        items: *component
+        minItems: 1
+  condition:
+    anyOf:
+      - *condition
+      - type: array
+        items: *condition
+        minItems: 1
+  requests:
+    type: integer
+    minimum: 1
+  interval:
+    description: Seconds
+    type: integer
+    minimum: 1
+additionalProperties: false
+required:
+  - key
+  - requests
+  - interval

package/schemas/method.cos.yaml

@@ -1,8 +1,9 @@
-verb: /^(GET|POST|PUT|PATCH|DELETE)$/
+verb: /^(GET|HEAD|POST|PUT|PATCH|DELETE|LOCK|UNLOCK)$/
 mapping:
   namespace: string
   component: string
   endpoint: string
   query:
     $ref: query
+  ...: false
 directives: [ref:directive]

package/schemas/node.cos.yaml

@@ -1,5 +1,7 @@
 protected: boolean
 isolated: boolean
+forward: string
 routes: [ref:route]
 methods: [ref:method]
 directives: [ref:directive]
+version: string

package/schemas/octets/put.cos.yaml

@@ -0,0 +1,28 @@
+type: object
+nullable: true
+properties:
+  location:
+    type: string
+  accept:
+    anyOf:
+      - type: string
+      - type: array
+        items:
+          type: string
+  limit:
+    type: string
+    pattern: ^(\d+(\.\d+)?)([kmgtKMBGT]i?)?[bB]?$
+  trust:
+    type: array
+    items:
+      type: string
+  workflow:
+    anyOf:
+      - &unit
+        type: object
+        patternProperties:
+          ^.+$:
+            type: string
+      - type: array
+        items: *unit
+additionalProperties: false

package/schemas/query.cos.yaml

@@ -1,17 +1,14 @@
-_: true
 id?: string
 criteria?: string
 sort?: string
-omit:
+search?: boolean
+sample?: integer
+omit?:
   $ref: range
-  default:
-    value: 0
-    range: [0, 1000]
-limit:
+limit?:
   $ref: range
-  default:
-    value: 10
-    range: [1, 1000]
-  required: [value]
 selectors?: [string]
 projection?: [string]
+parameters?: [string]
+deleted?: boolean
+_: true

package/schemas/querystring.cos.yaml

@@ -1,5 +1,6 @@
 id: string
 criteria: string
+search: string
 sort: string
 omit: number
 limit: number

package/source/Annotation.ts

@@ -1,8 +1,10 @@
+import type { Resources } from '@toa.io/operations'
+
 export interface Annotation {
   authorities: Record<string, string>
   class?: string
+  resources?: Resources
   annotations?: Record<string, string>
   debug?: boolean
-  trace?: boolean
   '/'?: object // parsed and validated by RTD.syntax.parse
 }

package/source/Branch.ts

@@ -5,4 +5,5 @@ export interface Branch {
   component: string
   isolated: boolean
   node: RTD.Node
+  version: string
 }

package/source/Composition.ts

@@ -18,12 +18,6 @@ export class Composition extends Connector {
     await composition.connect()
 
     this.depends(composition)
-
-    console.info('Composition complete.')
-  }
-
-  protected override dispose (): void {
-    console.info('Composition shutdown complete.')
   }
 }
 

package/source/Context.ts

@@ -1,8 +1,11 @@
 import type * as RTD from './RTD'
 
-export type Context = RTD.Context<Extension>
+// the trunk is built from the context annotation and belongs to no branch,
+// thus its endpoints must be fully qualified and are not versioned
+export type Context = RTD.Context<Extension | undefined>
 
 interface Extension {
   namespace: string
   component: string
+  version: string
 }

package/source/Directive.test.ts

@@ -10,15 +10,28 @@ const families: Array<jest.MockedObjectDeep<DirectiveFamily>> = [
     name: 'foo',
     mandatory: true,
     create: jest.fn((_0: any, _1: any, _2: any) => generate() as any),
+    arrange: jest.fn(),
     preflight: jest.fn(),
-    settle: jest.fn()
+    settle: jest.fn(),
+    dispose: jest.fn()
+  },
+  {
+    name: 'qux',
+    mandatory: true,
+    create: jest.fn((_0: any, _1: any, _2: any) => generate() as any),
+    arrange: jest.fn(),
+    preflight: jest.fn(),
+    settle: jest.fn(),
+    dispose: jest.fn()
   },
   {
     name: 'bar',
     mandatory: false,
     create: jest.fn((_0: string, _1: any, _2: any) => generate() as any),
+    arrange: jest.fn(),
     preflight: jest.fn(),
-    settle: jest.fn()
+    settle: jest.fn(),
+    dispose: jest.fn()
   }
 ]
 
@@ -27,11 +40,12 @@ let factory: DirectivesFactory
 beforeEach(() => {
   jest.clearAllMocks()
 
-  assert.ok(families[0].preflight !== undefined)
-  assert.ok(families[1].preflight !== undefined)
+  for (const family of families) {
+    assert.ok(family.preflight !== undefined)
+
+    family.preflight.mockImplementation(() => null)
+  }
 
-  families[0].preflight.mockImplementation(() => null)
-  families[1].preflight.mockImplementation(() => null)
   factory = new DirectivesFactory(families, {} as unknown as Remotes)
 })
 
@@ -51,12 +65,22 @@ it('should create directive', async () => {
 
   factory.create(declarations)
 
-  for (let i = 0; i < declarations.length; i++) {
-    expect(families[i].create.mock.calls[0][0]).toBe(declarations[i].name)
-    expect(families[i].create.mock.calls[0][1]).toBe(declarations[i].value)
+  for (const declaration of declarations) {
+    const family = families.find(({ name }) => name === declaration.family)!
+
+    expect(family.create.mock.calls[0][0]).toBe(declaration.name)
+    expect(family.create.mock.calls[0][1]).toBe(declaration.value)
   }
 })
 
+it('should pass the route to the families', async () => {
+  const route = '/' + generate()
+
+  factory.create([{ family: 'foo', name: generate(), value: generate() }], route)
+
+  expect(families[0].create.mock.calls[0][3]).toBe(route)
+})
+
 it('should throw error if directive family is not found', async () => {
   const declaration: syntax.Directive = {
     family: generate(),
@@ -65,7 +89,7 @@ it('should throw error if directive family is not found', async () => {
   }
 
   expect(() => factory.create([declaration]))
-    .toThrowError(`Directive family '${declaration.family}' is not found.`)
+    .toThrow(`Directive family '${declaration.family}' is not found`)
 })
 
 it('should apply directive', async () => {
@@ -95,3 +119,49 @@ it('should apply mandatory families', async () => {
 
   expect(families[0].preflight).toHaveBeenCalled()
 })
+
+describe('order', () => {
+  function order (): string[] {
+    return families
+      .filter(({ preflight }) => preflight!.mock.calls.length > 0)
+      .sort((a, b) => a.preflight!.mock.invocationCallOrder[0] -
+        b.preflight!.mock.invocationCallOrder[0])
+      .map(({ name }) => name)
+  }
+
+  it('should run mandatory families in their own order, whatever a manifest says', async () => {
+    // `qux` declared first, but `foo` is registered first and both are mandatory
+    const directives = factory.create([
+      { family: 'qux', name: generate(), value: generate() },
+      { family: 'foo', name: generate(), value: generate() }
+    ])
+
+    await directives.preflight(generate() as unknown as Context, [])
+
+    expect(order()).toStrictEqual(['foo', 'qux'])
+  })
+
+  it('should run a mandatory family before a declared one it is not declared with',
+    async () => {
+      // only `qux` is declared: `foo` still has to run first, not merely first of
+      // whatever had no declarations
+      const directives = factory.create([
+        { family: 'qux', name: generate(), value: generate() }
+      ])
+
+      await directives.preflight(generate() as unknown as Context, [])
+
+      expect(order()).toStrictEqual(['foo', 'qux'])
+    })
+
+  it('should run mandatory families before the rest', async () => {
+    const directives = factory.create([
+      { family: 'bar', name: generate(), value: generate() },
+      { family: 'qux', name: generate(), value: generate() }
+    ])
+
+    await directives.preflight(generate() as unknown as Context, [])
+
+    expect(order()).toStrictEqual(['foo', 'qux', 'bar'])
+  })
+})

package/source/Directive.ts

@@ -1,3 +1,4 @@
+import { console, type SpanOptions } from 'openspan'
 import type { Context, OutgoingMessage } from './HTTP'
 import type { Remotes } from './Remotes'
 import type { Output } from './io'
@@ -6,28 +7,54 @@ import type * as RTD from './RTD'
 export class Directives implements RTD.Directives {
   private readonly sets: RTD.DirectiveSet[]
 
+  /** the span of a stage depends only on the set, so it is built once per route */
+  private readonly spans: Spans[]
+
   public constructor (sets: RTD.DirectiveSet[]) {
     this.sets = sets
+    this.spans = sets.map((set) => ({
+      preflight: options(set, 'preflight'),
+      settle: options(set, 'settle')
+    }))
   }
 
   public async preflight (context: Context, parameters: RTD.Parameter[]): Promise<Output> {
-    for (const set of this.sets) {
+    let output = null
+
+    for (let i = 0; i < this.sets.length; i++) {
+      const set = this.sets[i]
+
       if (set.family.preflight === undefined)
         continue
 
-      const output = await set.family.preflight(set.directives, context, parameters)
+      const out = await console.span(this.spans[i].preflight,
+        async () => await set.family.preflight!(set.directives, context, parameters))
+
+      if (out === null)
+        continue
 
       if (output !== null)
-        return output
+        throw new Error('Multiple preflight directives responded')
+      else
+        output = out
     }
 
-    return null
+    return output
   }
 
   public async settle (context: Context, response: OutgoingMessage): Promise<void> {
-    for (const set of this.sets)
+    for (let i = 0; i < this.sets.length; i++) {
+      const set = this.sets[i]
+
       if (set.family.settle !== undefined)
-        await set.family.settle(set.directives, context, response)
+        await console.span(this.spans[i].settle,
+          async () => await set.family.settle!(set.directives, context, response))
+    }
+  }
+
+  public dispose (): void {
+    for (const set of this.sets)
+      set.family.dispose?.(set.directives)
   }
 }
 
@@ -35,6 +62,7 @@ export class DirectivesFactory implements RTD.DirectiveFactory {
   private readonly remotes: Remotes
   private readonly families: Record<string, RTD.DirectiveFamily> = {}
   private readonly mandatory: string[] = []
+  private readonly instances: Directives[] = []
 
   public constructor (families: RTD.DirectiveFamily[], remotes: Remotes) {
     for (const family of families) {
@@ -47,23 +75,24 @@ export class DirectivesFactory implements RTD.DirectiveFactory {
     this.remotes = remotes
   }
 
-  public create (declarations: RTD.syntax.Directive[]): Directives {
+  public create (declarations: RTD.syntax.Directive[], route: string = ''): Directives {
     const groups: Record<string, any> = {}
     const mandatory = new Set(this.mandatory)
 
-    declarations.sort((a, b) =>
-      (mandatory.has(b.family) ? 1 : 0) - (mandatory.has(a.family) ? 1 : 0))
+    const names: Record<string, string[]> = {}
 
     for (const declaration of declarations) {
       const family = this.families[declaration.family]
 
       if (family === undefined)
-        throw new Error(`Directive family '${declaration.family}' is not found.`)
+        throw new Error(`Directive family '${declaration.family}' is not found`)
 
-      const directive = family.create(declaration.name, declaration.value, this.remotes)
+      const directive = family.create(declaration.name, declaration.value, this.remotes, route)
 
       groups[family.name] ??= []
       groups[family.name].push(directive)
+      names[family.name] ??= []
+      names[family.name].push(`${declaration.family}:${declaration.name}`)
       mandatory.delete(family.name)
     }
 
@@ -72,25 +101,69 @@ export class DirectivesFactory implements RTD.DirectiveFactory {
     for (const family of mandatory)
       sets.push({
         family: this.families[family],
-        directives: []
+        directives: [],
+        names: []
       })
 
     for (const [family, directives] of Object.entries(groups))
       sets.push({
         family: this.families[family],
-        directives
+        directives,
+        names: names[family]
       })
 
-    return new Directives(sets)
+    // Mandatory families run in the order they are registered in, not in the order a
+    // manifest happens to mention them: `auth` must resolve the identity before `io`
+    // can key a quota on it, and a request it denies should not reach `io` at all.
+    // The rest keep the order they were declared in, the sort being stable.
+    sets.sort((a, b) => this.rank(a.family.name) - this.rank(b.family.name))
+
+    // whatever order a family needs among its own directives is fixed here, not per request
+    for (const set of sets)
+      set.family.arrange?.(set.directives)
+
+    const directives = new Directives(sets)
+
+    this.instances.push(directives)
+
+    return directives
+  }
+
+  public dispose (): void {
+    for (const directives of this.instances)
+      directives.dispose()
+  }
+
+  /** Mandatory families first, in their own order; everything else keeps its own. */
+  private rank (family: string): number {
+    const index = this.mandatory.indexOf(family)
+
+    return index === -1 ? this.mandatory.length : index
   }
 }
 
+function options (set: RTD.DirectiveSet, stage: 'preflight' | 'settle'): SpanOptions {
+  const options: SpanOptions = { name: `${set.family.name} ${stage}` }
+
+  if (set.names !== undefined && set.names.length > 0)
+    options.attributes = { directives: Array.from(new Set(set.names)).join(' ') }
+
+  return options
+}
+
+interface Spans {
+  preflight: SpanOptions
+  settle: SpanOptions
+}
+
 export const shortcuts: RTD.syntax.Shortcuts = new Map([
   ['anonymous', 'auth:anonymous'],
+  ['anyone', 'auth:anyone'],
   ['id', 'auth:id'],
   ['role', 'auth:role'],
   ['rule', 'auth:rule'],
   ['incept', 'auth:incept'],
   ['input', 'io:input'],
-  ['output', 'io:output']
+  ['output', 'io:output'],
+  ['languages', 'map:languages']
 ])