@toa.io/extensions.exposition 1.0.0-alpha.273 → 1.0.0-alpha.276

package/components/identity.tokens/source/authenticate.test.ts

@@ -1,6 +1,7 @@
 import { generate } from 'randomstring'
 import { Computation as Authenticate } from './authenticate'
 import type { Configuration, Context, DecryptOutput, Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let configuration: Configuration
 let context: Context
@@ -13,8 +14,8 @@ const authority = generate()
 beforeEach(() => {
   configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' }
     ],
     lifetime: 2592000,
     refresh: 600,
@@ -68,3 +69,7 @@ it.each([true, false])('should return stale: %s',
 
     expect(result).toEqual({ identity, refresh })
   })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/decrypt.test.ts

@@ -3,6 +3,7 @@ import { V3 } from 'paseto'
 import { Effect as Encrypt } from './encrypt'
 import { Computation as Decrypt } from './decrypt'
 import { type Configuration, type Context, type Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let configuration: Configuration
 let context: Context
@@ -15,10 +16,11 @@ const authority = generate()
 beforeEach(() => {
   configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'key1', key: '5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' },
-      { id: 'legacy1', key: 'k3.local.-498jfWenrZH-Dqw3-zQJih_hKzDgBgUMfe37OCqSOA', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      // keys are secrets, and a secret is an object
+      { id: 'key1', key: secret('5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' },
+      { id: 'legacy1', key: secret('k3.local.-498jfWenrZH-Dqw3-zQJih_hKzDgBgUMfe37OCqSOA'), format: 'paseto' }
     ],
     lifetime: 1000,
     refresh: 500,
@@ -77,7 +79,7 @@ it('should decrypt with key1', async () => {
 it('should decrypt legacy PASETO and require refresh', async () => {
   const identity: Identity = { id: generate(), roles: [] }
 
-  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key, {
+  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key.unwrap(), {
     footer: { kid: 'legacy0' }
   })
 
@@ -96,7 +98,7 @@ it('should separate JWE and PASETO keys with the same id by format', async () =>
 
   const identity: Identity = { id: generate(), roles: [] }
 
-  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key, {
+  const token = await V3.encrypt({ iss: authority, identity }, configuration.keys[2].key.unwrap(), {
     footer: { kid: 'key0' }
   })
 
@@ -125,7 +127,7 @@ it('should reject JWE with an unknown key', async () => {
   const token = await encrypt.execute({
     authority,
     identity: { id: generate(), roles: [] },
-    key: { id: 'missing', key: configuration.keys[0].key, label: 'missing' }
+    key: { id: 'missing', key: configuration.keys[0].key.unwrap(), label: 'missing' }
   })
 
   if (token instanceof Error)
@@ -133,3 +135,7 @@ it('should reject JWE with an unknown key', async () => {
 
   await expect(decrypt.execute(token)).resolves.toMatchObject({ code: 'INVALID_KEY' })
 })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/decrypt.ts

@@ -27,7 +27,7 @@ export class Computation implements Operation {
     for (const { id, key, format } of context.configuration.keys) {
       const branch = format === 'paseto' ? this.legacy : this.keys
 
-      branch[id] = { key }
+      branch[id] = { key: key.unwrap() }
     }
   }
 

package/components/identity.tokens/source/encrypt.test.ts

@@ -4,6 +4,7 @@ import { timeout } from '@toa.io/generic'
 import { Effect as Encrypt } from './encrypt'
 import { Computation as Decrypt } from './decrypt'
 import { type Context, type Identity } from './lib'
+import type { Secret } from '@toa.io/types'
 
 let encrypt: Encrypt
 let decrypt: Decrypt
@@ -18,8 +19,8 @@ const authority = generate()
 beforeEach(() => {
   context.configuration = {
     keys: [
-      { id: 'key0', key: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs' },
-      { id: 'legacy0', key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog', format: 'paseto' }
+      { id: 'key0', key: secret('sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs') },
+      { id: 'legacy0', key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'), format: 'paseto' }
     ],
     lifetime: 1,
     refresh: 2,
@@ -39,12 +40,12 @@ beforeEach(() => {
 it('should use the first encryption key as active and expose its id as kid', async () => {
   context.configuration.keys.unshift({
     id: 'legacy-first',
-    key: 'k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog',
+    key: secret('k3.local.m28p8SrbS467t-2IUjQuSOqmjvi24TbXhyjAW_dOrog'),
     format: 'paseto'
   })
   context.configuration.keys.push({
     id: 'key1',
-    key: '5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0'
+    key: secret('5I0iSKw3yfBkQ4AXfA8eR-tWR0Q1dpn4x3bPrPzHkP0')
   })
 
   encrypt.mount(context)
@@ -119,3 +120,7 @@ it('should encrypt without lifetime INSECURE', async () => {
 
   expect(decrypted.identity).toMatchObject(identity)
 })
+
+function secret (value: string): Secret {
+  return { unwrap: () => value }
+}

package/components/identity.tokens/source/encrypt.ts

@@ -13,7 +13,7 @@ export class Effect implements Operation {
     if (key === undefined)
       throw new TypeError('At least one JWE key must be configured')
 
-    this.key = key
+    this.key = { id: key.id, key: key.key.unwrap() }
     this.lifetime = context.configuration.lifetime * 1000
   }
 

package/components/identity.tokens/source/lib/types.ts

@@ -1,4 +1,4 @@
-import type { Call, Maybe, Observation, telemetry } from '@toa.io/types'
+import type { Call, Maybe, Observation, Secret, telemetry } from '@toa.io/types'
 
 export interface Context {
   local: {
@@ -31,7 +31,8 @@ export interface Configuration {
   }
 }
 
-export interface ConfiguredKey extends Pick<Key, 'id' | 'key'> {
+export interface ConfiguredKey extends Pick<Key, 'id'> {
+  key: Secret
   format?: 'jwe' | 'paseto'
 }
 

package/context.toa.yaml

@@ -10,9 +10,9 @@ configuration:
   identity.tokens:
     keys:
       - id: key0
-        key: sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs
+        key: $IDENTITY_TOKENS_ENCRYPTION_KEY0
       - id: legacy0
-        key: k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA
+        key: $IDENTITY_TOKENS_KEY0
         format: paseto
 
   identity.federation:

package/documentation/components.md

@@ -23,7 +23,7 @@ and pepper.
 configuration:
   identity.basic:
     rounds: 10 # salt rounds
-    pepper: '' # hashing pepper
+    pepper: $IDENTITY_BASIC_PEPPER # hashing pepper, a secret
 ```
 
 ### Credentials constraints

package/documentation/protocol.md

@@ -69,6 +69,30 @@ See also:
 - [Content-Type: multipart](https://learn.microsoft.com/en-us/previous-versions/office/developer/exchange-server-2010/aa493937(v=exchg.140))
   at Microsoft
 
+## HTTP version
+
+The gateway serves HTTP/1.1 by default. `protocol: h2c` serves cleartext HTTP/2 instead.
+
+```yaml
+exposition:
+  protocol: h2c
+  service:
+    annotations:
+      projectcontour.io/upstream-protocol.h2c: "8000"
+```
+
+`h2c` requires an ingress controller that proxies cleartext HTTP/2 upstream, and the
+annotation that controller reads to do so. Contour, Traefik and Envoy-based controllers
+proxy it; ingress-nginx does not. A cleartext HTTP/2 server answers nothing else on the
+same port: there is no ALPN to negotiate with, so a controller that speaks HTTP/1.1 upstream
+reaches nothing.
+
+Under `h2c` a request refused before its body is read is answered and then cancelled with
+`RST_STREAM(NO_ERROR)`. The reply arrives; the upload stops where it is. A client streaming
+a request body sees that body cancelled — in Node, `ERR_STREAM_PREMATURE_CLOSE` on the stream
+it passed, which throws if nothing handles it. A real failure shows in the reply, or in the
+request rejecting because no reply came. A buffered body is unaffected.
+
 ## CORS
 
 [CORS](https://www.w3.org/TR/2020/SPSD-cors-20200602/) is supported,

package/features/configuration.feature

@@ -0,0 +1,207 @@
+@security
+Feature: Configuration values
+
+  The values component declares how it is exposed in its own manifest, and that manifest
+  is what this mounts. Reading takes `system:configuration:get`, creating takes
+  `system:configuration:create`, and the one who creates is recorded as the originator.
+
+  Background:
+    # developer:secret, user:12345
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | e8e4f9c2a68d419b861403d71fabc915 | nex       | user      | $2b$10$Frszmrmsz9iwSXzBbRRMKeDVKsNxozkrLNSsN.SnVC.KPxLtQr/bK |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                     |
+      | 1c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | efe3a65ebbee47ed95a73edd911ea328 | system:configuration     |
+      | 2c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | e8e4f9c2a68d419b861403d71fabc915 | system:configuration:get |
+    And the `identity.bans` database is empty
+    And the `configuration.values` database is empty
+    And the configuration values are deployed:
+      """yaml
+      dummies.dummy:
+        epoch: e1
+        schema:
+          type: object
+          properties:
+            foo:
+              type: string
+            bar:
+              type: string
+              default: world
+        defaults:
+          foo: deployed
+      """
+    And the configuration values are running
+
+  Scenario: Reading the deployed configuration
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      configuration:
+        foo: deployed
+      schema:
+        type: object
+        properties:
+          foo:
+            type: string
+          bar:
+            type: string
+            default: world
+      epoch: e1
+      """
+
+  Scenario: Listing the configurations
+    When the following request is received:
+      """
+      GET /configuration/values/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      - component: dummies.dummy
+        epoch: e1
+        schema:
+          type: object
+          properties:
+            foo:
+              type: string
+            bar:
+              type: string
+              default: world
+        configuration:
+          foo: deployed
+      """
+
+  Scenario: Listing without the role
+    When the following request is received:
+      """
+      GET /configuration/values/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Reading without the role
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Reading the configuration of an unknown component
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.unknown/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    Then the following reply is sent:
+      """
+      404 Not Found
+      """
+
+  Scenario: Creating configuration
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/yaml
+
+      epoch: e1
+      """
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+        bar: world
+      epoch: e1
+      """
+
+  Scenario: Creating configuration without the role
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Creating configuration not fitting the schema
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      configuration:
+        foo:
+          nested: true
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """
+
+  Scenario: Creating configuration for an unknown component
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.unknown/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      configuration: {}
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """

package/features/identity.federation.feature

@@ -335,7 +335,11 @@ Feature: Identity Federation
       trust:
         - iss: http://localhost:44444
           aud: nex
-          secret: secret
+          secret: $IDP_SECRET
+      """
+    And the configuration secrets:
+      """yaml
+      IDP_SECRET: secret
       """
     And auth code for Alice is issued for https://web.toa.io/callback/
     When the following request is received:
@@ -362,12 +366,16 @@ Feature: Identity Federation
           signature:
             iss: io.toa.nex.id
             kid: key-id
-            key: |
-              -----BEGIN PRIVATE KEY-----
-              MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
-              TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
-              HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
-              -----END PRIVATE KEY-----
+            key: $IDP_KEY
+      """
+    And the configuration secrets:
+      """yaml
+      IDP_KEY: |
+        -----BEGIN PRIVATE KEY-----
+        MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
+        TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
+        HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
+        -----END PRIVATE KEY-----
       """
     And auth code for Bob is issued for https://web.toa.io/callback/
     When the following request is received:

package/features/introspection.map.feature

@@ -90,3 +90,19 @@ Feature: Reading the introspection map
       """
       403 Forbidden
       """
+
+  Scenario: The map does not take the application's root directives
+    Given the annotation of the introspection map under:
+      """yaml
+      /:
+        auth:anonymous: true
+      """
+    When the following request is received:
+      """
+      GET /introspection/nodes/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """

package/features/octets.cloudinary.feature

@@ -144,7 +144,10 @@ Feature: Octets with Cloudinary storage
       """
       200 OK
       content-type: video/mp4
-      transfer-encoding: chunked
+      """
+    And the reply does not contain:
+      """
+      content-length
       """
 
     # after a while, Cloudinary returns a content-length response
@@ -169,7 +172,10 @@ Feature: Octets with Cloudinary storage
       """
       200 OK
       content-type: video/mp4
-      transfer-encoding: chunked
+      """
+    And the reply does not contain:
+      """
+      content-length
       """
 
     When the following request is received:

package/features/octets.download.feature

@@ -18,6 +18,8 @@ Feature: Download external resources
               meta: true
       """
 
+    Given the length of `https://avatars.githubusercontent.com/u/92763022?s=48&v=4` is captured as `length`
+
     When the following request is received:
       """
       POST / HTTP/1.1
@@ -43,7 +45,7 @@ Feature: Download external resources
     Then the following reply is sent:
       """
       200 OK
-      content-length: 1288
+      content-length: ${{ length }}
       content-type: image/png
       etag: "${{ checksum }}"
       """

package/features/probes.feature

@@ -1,14 +1,18 @@
 Feature: Probes
 
-  Scenario: Startup probe
+  # The probe is on a port of its own: kubelet speaks HTTP/1.1, and the gateway may serve h2c.
+  Scenario: The gateway answers its readiness probe
+    Given the Gateway is running
+    When the ready probe is requested
+    Then the ready probe answers 200
+
+  Scenario: The traffic port does not serve the probe
     Given the Gateway is running
-    And after 15 seconds
     When the following request is received:
       """
       GET /.ready HTTP/1.1
       """
     Then the following reply is sent:
       """
-      200 OK
-      cache-control: no-store
+      404 Not Found
       """

package/features/steps/Common.ts

@@ -1,8 +1,16 @@
+import * as assert from 'node:assert'
 import { binding, given } from 'cucumber-tsflow'
 import { timeout } from '@toa.io/generic'
+import { Captures } from './Captures'
 
-@binding()
+@binding([Captures])
 export class Common {
+  private readonly captures: Captures
+
+  public constructor (captures: Captures) {
+    this.captures = captures
+  }
+
   @given('after {float} second(s)')
   public async timeout (interval: number): Promise<void> {
     await timeout(interval * 1000)
@@ -11,4 +19,19 @@ export class Common {
   @given('the process is running')
   public async noop (): Promise<void> {
   }
+
+  /**
+   * A remote resource is whatever it is today. A scenario downloading one compares the reply
+   * against what the origin actually serves, not against a literal that goes stale when it changes.
+   */
+  @given('the length of `{}` is captured as `{word}`')
+  public async length (url: string, name: string): Promise<void> {
+    const response = await fetch(url)
+
+    assert.equal(response.status, 200, `${url} answered ${response.status}`)
+
+    const body = await response.arrayBuffer()
+
+    this.captures.set(name, String(body.byteLength))
+  }
 }

package/features/steps/Components.ts

@@ -1,4 +1,5 @@
 import * as assert from 'node:assert'
+import { dirname, join } from 'node:path'
 import { after, binding, given } from 'cucumber-tsflow'
 import * as boot from '@toa.io/boot'
 import { timeout } from '@toa.io/generic'
@@ -9,6 +10,7 @@ import { Workspace } from './Workspace'
 import { components as map } from './map'
 
 const MAP = 'introspection'
+const VALUES = 'configuration'
 
 @binding([Workspace, Gateway])
 export class Components {
@@ -44,6 +46,25 @@ export class Components {
     await timeout(50) // discovery
   }
 
+  /** The values component, as the configuration extension ships it; the service hosts it alone. */
+  @given('the configuration values are running')
+  public async runValues (): Promise<void> {
+    assert.ok(!(VALUES in this.compositions), `Composition '${VALUES}' is already running`)
+
+    await this.gateway.start()
+
+    this.compositions[VALUES] = await boot.composition([values()])
+
+    await this.compositions[VALUES].connect()
+    await timeout(50) // discovery
+  }
+
+  /** What the deployment would tell the values service, as the scenario needs it. */
+  @given('the configuration values are deployed:')
+  public deployValues (yaml: string): void {
+    process.env.TOA_CONFIGURATION_VALUES = JSON.stringify(parse(yaml))
+  }
+
   @given('the `{word}` is stopped')
   public async stop (name: string): Promise<void> {
     assert.ok(name in this.compositions, `Composition '${name}' is not running`)
@@ -57,6 +78,8 @@ export class Components {
     const promises = Object.values(this.compositions).map((composition) => composition.disconnect())
 
     await Promise.all(promises)
+
+    delete process.env.TOA_CONFIGURATION_VALUES
   }
 
   private async runComponent (name: string, manifest?: object): Promise<void> {
@@ -75,3 +98,9 @@ export class Components {
     await timeout(50) // discovery
   }
 }
+
+function values (): string {
+  const root = dirname(require.resolve('@toa.io/extensions.configuration/package.json'))
+
+  return join(root, 'components', 'configuration.values')
+}