@toa.io/extensions.exposition 1.0.0-alpha.278 → 1.0.0-alpha.282

package/features/identity.otp.feature

@@ -99,3 +99,44 @@ Feature: OTP authentication
 
       id: ${{ bob.id }}
       """
+
+  Scenario: Guessing OTP codes
+    Given the `identity.otp` configuration:
+      """yaml
+      lifetime: 60
+      attempts: 2
+      """
+    And the Gateway is running
+    And OTP for `alice` in `nex` authority is issued
+    # alice:wrong
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP YWxpY2U6d3Jvbmc=
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP YWxpY2U6d3Jvbmc=
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    # the attempts are spent, the code itself is refused
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: OTP ${{ alice.otp }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """

package/features/identity.roles.feature

@@ -314,3 +314,255 @@ Feature: Roles management
       """
       500 Internal Server Error
       """
+
+  Scenario: Role changes reach a Token holder at refresh
+    # root:secret
+    # user:pass
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username | password                                                     |
+      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | root     | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
+      | 4344518184ad44228baffce7a44fd0b1 | nex       | user     | $2b$10$JoiAQUS7tzobDAFIDBWhWeEIJv933dQetyjRzSmfQGaJE5ZlJbmYy |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                  |
+      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | system:identity:roles |
+    And the `identity.tokens` configuration:
+      """yaml
+      refresh: 1
+      """
+    And the annotation:
+      """yaml
+      /:
+        io:output: true
+        auth:role: foo:bar
+        GET:
+          dev:stub:
+            access: granted!
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjpwYXNz
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ token }}
+      """
+    When the following request is received:
+      # root grants a role to the user
+      """
+      POST /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic cm9vdDpzZWNyZXQ=
+      content-type: application/yaml
+
+      role: foo:bar
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    # the token was issued before the grant
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+    Then after 1 second
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ granted }}
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ granted }}
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      access: granted!
+      """
+    When the following request is received:
+      # root revokes the role
+      """
+      DELETE /identity/roles/4344518184ad44228baffce7a44fd0b1/foo:bar/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic cm9vdDpzZWNyZXQ=
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    Then after 1 second
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ granted }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ revoked }}
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ revoked }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Revoking a role without `system:identity:roles`
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username | password                                                     |
+      | 4344518184ad44228baffce7a44fd0b1 | nex       | user     | $2b$10$JoiAQUS7tzobDAFIDBWhWeEIJv933dQetyjRzSmfQGaJE5ZlJbmYy |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role    |
+      | 30c969e05ff6437097ed5f07fc52358e | 4344518184ad44228baffce7a44fd0b1 | foo:bar |
+    When the following request is received:
+      """
+      DELETE /identity/roles/4344518184ad44228baffce7a44fd0b1/foo:bar/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjpwYXNz
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Revoking a role revokes custom tokens
+    # root:secret
+    # user:pass
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username | password                                                     |
+      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | root     | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
+      | 4344518184ad44228baffce7a44fd0b1 | nex       | user     | $2b$10$JoiAQUS7tzobDAFIDBWhWeEIJv933dQetyjRzSmfQGaJE5ZlJbmYy |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                  |
+      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | system:identity:roles |
+      | 30c969e05ff6437097ed5f07fc52358e | 4344518184ad44228baffce7a44fd0b1 | foo:bar               |
+    And the `identity.keys` database is empty
+    And the `identity.tokens` configuration:
+      """yaml
+      cache:
+        ttl: 1
+      """
+    And the annotation:
+      """yaml
+      /:
+        io:output: true
+        auth:role: foo:bar
+        GET:
+          dev:stub:
+            access: granted!
+      """
+    When the following request is received:
+      """
+      POST /identity/tokens/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjpwYXNz
+      accept: application/yaml
+      content-type: application/yaml
+
+      label: Forever token
+      lifetime: 0
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      token: ${{ token }}
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      # root revokes the role
+      """
+      DELETE /identity/roles/4344518184ad44228baffce7a44fd0b1/foo:bar/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic cm9vdDpzZWNyZXQ=
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    # the key is revoked eventually, and the runtime forgets it after `cache.ttl`
+    Then after 2 seconds
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Delegating the right to delegate
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     |
+      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | moderator | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
+      | 4344518184ad44228baffce7a44fd0b1 | nex       | assistant | $2b$10$JoiAQUS7tzobDAFIDBWhWeEIJv933dQetyjRzSmfQGaJE5ZlJbmYy |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                             |
+      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | system:identity:roles:delegation |
+      | 30c969e05ff6437097ed5f07fc52358e | 72cf9b0ab0ac4ab2b8036e4e940ddcae | app:moderation                   |
+    When the following request is received:
+      """
+      POST /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      content-type: application/yaml
+      authorization: Basic bW9kZXJhdG9yOnNlY3JldA==
+
+      role: system:identity:roles:delegation
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+
+      code: INACCESSIBLE_SCOPE
+      """
+    When the following request is received:
+      """
+      GET /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+      authorization: Basic YXNzaXN0YW50OnBhc3M=
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      []
+      """

package/features/identity.tokens.custom.feature

@@ -283,3 +283,148 @@ Feature: Custom tokens
       """
       401 Unauthorized
       """
+
+  Scenario: Custom token is not refreshed
+    Given the `identity.tokens` configuration:
+      """yaml
+      refresh: 1
+      """
+    When the following request is received:
+      """
+      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      label: Restricted token
+      lifetime: 600
+      permissions:
+        /notes/: [GET]
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      token: ${{ token }}
+      """
+    And after 1 second
+    When the following request is received:
+      """
+      GET /notes/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    And the reply does not contain:
+      """
+      authorization: Token
+      """
+    When the following request is received:
+      """
+      GET /notes/public/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Permissions apply to the path the request is routed by
+    When the following request is received:
+      """
+      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      label: Public notes token
+      lifetime: 0
+      permissions:
+        /notes/public/: [GET]
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      token: ${{ token }}
+      """
+
+    # the query string is not part of the path
+    When the following request is received:
+      """
+      GET /notes/public/?page=2 HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: Changing the password revokes custom tokens
+    Given the `identity.basic` database contains:
+      | _id                              | _version | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | 1        | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+    And the `identity.tokens` configuration:
+      """yaml
+      cache:
+        ttl: 1
+      """
+    When the following request is received:
+      """
+      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      label: Forever token
+      lifetime: 0
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      token: ${{ token }}
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      PATCH /identity/basic/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      password: new-secret
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    # the runtime forgets the key after `cache.ttl`
+    Then after 1.5 seconds
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """

package/features/map.feature

@@ -235,6 +235,7 @@ Feature: HTTP context mapping
       """yaml
       trust:
         - iss: http://localhost:44444
+          aud: test
       """
     And the `echo` is running with the following manifest:
       """yaml
@@ -269,6 +270,7 @@ Feature: HTTP context mapping
       """yaml
       trust:
         - iss: http://localhost:44444
+          aud: test
       assert: false
       """
     And the `pots` is running with the following manifest:

package/features/steps/Gateway.ts

@@ -29,12 +29,18 @@ export class Gateway {
       process.env.TOA_EXPOSITION = JSON.stringify(tree)
     }
 
-    const { debug, authorities } = annotation
+    const { debug, authorities, bouncer, ip } = annotation
     const properties = Object.assign({}, DEFAULT_PROPERTIES)
 
     if (debug !== undefined)
       properties.debug = debug
 
+    if (bouncer !== undefined)
+      properties.bouncer = bouncer
+
+    if (ip !== undefined)
+      properties.ip = ip
+
     if (authorities !== undefined)
       properties.authorities = authorities
 
@@ -130,7 +136,7 @@ export class Gateway {
 
     this.writeConfiguration()
 
-    const factory = new Factory(boot)
+    const factory = new Factory(boot.host())
     const service = await factory.service()
 
     if (service === null)

package/features/steps/Realtime.ts

@@ -40,7 +40,7 @@ export class Realtime {
 
     process.env.TOA_REALTIME = JSON.stringify(routes)
 
-    const factory = new Factory(boot)
+    const factory = new Factory(boot.host())
 
     Realtime.instance = await factory.service()
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/extensions.exposition",
-  "version": "1.0.0-alpha.278",
+  "version": "1.0.0-alpha.282",
   "type": "module",
   "description": "Toa Exposition",
   "author": "temich <tema.gurtovoy@gmail.com>",
@@ -19,9 +19,9 @@
   },
   "dependencies": {
     "@simplewebauthn/server": "14.0.0",
-    "@toa.io/core": "1.0.0-alpha.278",
-    "@toa.io/generic": "1.0.0-alpha.278",
-    "@toa.io/schemas": "1.0.0-alpha.278",
+    "@toa.io/core": "1.0.0-alpha.282",
+    "@toa.io/generic": "1.0.0-alpha.282",
+    "@toa.io/schemas": "1.0.0-alpha.282",
     "bcryptjs": "3.0.3",
     "content-type": "3.0.0",
     "jose": "6.2.10",
@@ -56,5 +56,5 @@
     "@types/cors": "2.8.19",
     "@types/negotiator": "0.6.5"
   },
-  "gitHead": "5872815748eed8021ea99d7beca1602f4fc5c958"
+  "gitHead": "4007c814725dd015d3bbebb9a28e28a247645c4f"
 }

package/readme.md

@@ -136,6 +136,8 @@ exposition:
 | `class`       | Ingress class.                                                                                                    |
 | `annotations` | Ingress annotations.                                                                                              |
 | `debug`       | Output server errors. Default `false`.                                                                            |
+| `ip`          | Header the client address is read from. See [Client address](documentation/ip.md).                              |
+| `bouncer`     | Meter of failed authentications per address. See [Identity authentication](documentation/identity.md#failed-authentications). |
 
 ### Observability
 
@@ -201,6 +203,7 @@ See also [telemetry ready probe](../telemetry/readme.md#ready-probe) and
 ## See Also
 
 - [Protocol support](documentation/protocol.md)
+- [Client address](documentation/ip.md)
 - [Resource Tree Definition](documentation/tree.md)
 - [Identity authentication](documentation/identity.md)
 - [Access authorization](documentation/access.md)

package/schemas/annotation.cos.yaml

@@ -34,6 +34,19 @@ properties:
             type: string
   debug:
     type: boolean
+  ip:
+    type: string
+    minLength: 1
+  bouncer:
+    type: object
+    properties:
+      attempts:
+        type: integer
+        minimum: 1
+      interval:
+        type: integer
+        minimum: 1
+    additionalProperties: false
   protocol:
     type: string
     enum: [h1, h2c]
@@ -46,3 +59,6 @@ properties:
 type: object
 required:
   - authorities
+dependencies:
+  bouncer:
+    - ip

package/source/Annotation.ts

@@ -17,5 +17,19 @@ export interface Annotation {
   service?: { annotations?: Record<string, string> }
 
   debug?: boolean
+
+  /** The header the client address is read from; the connection's without one. See `ip.md`. */
+  ip?: string
+
+  /** Failed authentications an address may make; none are metered unless set. See `identity.md`. */
+  bouncer?: Bouncer
   '/'?: object // parsed and validated by RTD.syntax.parse
 }
+
+export interface Bouncer {
+  /** what an address may fail at once, 20 by default */
+  attempts?: number
+
+  /** seconds it takes to earn them back, 60 by default */
+  interval?: number
+}

package/source/Composition.ts

@@ -1,19 +1,19 @@
 import { readdirSync, type Dirent } from 'node:fs'
 import { resolve } from 'node:path'
 import { Connector } from '@toa.io/core'
-import { type Bootloader } from './Factory.js'
+import { type Host } from './Factory.js'
 
 export class Composition extends Connector {
-  private readonly boot: Bootloader
+  private readonly host: Host
 
-  public constructor (boot: Bootloader) {
+  public constructor (host: Host) {
     super()
-    this.boot = boot
+    this.host = host
   }
 
   protected override async open (): Promise<void> {
     const paths = find()
-    const composition = await this.boot.composition(paths)
+    const composition = await this.host.composition(paths)
 
     await composition.connect()
 

package/source/Directive.test.ts

@@ -5,6 +5,7 @@ import { generate } from 'randomstring'
 import { DirectivesFactory } from './Directive.js'
 import type { syntax, DirectiveFamily } from './RTD/index.js'
 import type { Remotes } from './Remotes.js'
+import type { Host } from './Factory.js'
 import type { Context } from './HTTP/index.js'
 
 const sequence: string[] = []
@@ -51,7 +52,8 @@ beforeEach(() => {
     family.preflight.mock.mockImplementation(() => { sequence.push(family.name); return null })
   }
 
-  factory = new DirectivesFactory(families, {} as unknown as Remotes)
+  factory = new DirectivesFactory(families, {} as unknown as Remotes, {} as unknown as Host,
+    { authorities: {} })
 })
 
 it('should create directive', async () => {

package/source/Directive.ts

@@ -1,6 +1,7 @@
 import { console, type SpanOptions } from 'openspan'
-import type { Context, OutgoingMessage } from './HTTP/index.js'
+import type { Context, OutgoingMessage, Options } from './HTTP/index.js'
 import type { Remotes } from './Remotes.js'
+import type { Host } from './Factory.js'
 import type { Output } from './io.js'
 import type * as RTD from './RTD/index.js'
 
@@ -64,8 +65,11 @@ export class DirectivesFactory implements RTD.DirectiveFactory {
   private readonly mandatory: string[] = []
   private readonly instances: Directives[] = []
 
-  public constructor (families: RTD.DirectiveFamily[], remotes: Remotes) {
+  // eslint-disable-next-line max-params
+  public constructor (families: RTD.DirectiveFamily[], remotes: Remotes, host: Host,
+    options: Options) {
     for (const family of families) {
+      family.mount?.(host, options)
       this.families[family.name] = family
 
       if (family.mandatory)

package/source/Endpoint.ts

@@ -1,6 +1,7 @@
 import { Readable } from 'node:stream'
 import { console } from 'openspan'
 import { Mapping } from './Mapping.js'
+import { redact } from './redact.js'
 import * as http from './HTTP/index.js'
 import type { Introspection, Schema } from './Introspection.js'
 import type { Remote } from '@toa.io/core'
@@ -29,11 +30,12 @@ export class Endpoint implements RTD.Endpoint {
 
     const endpoint = this.remote.locator.id + '.' + this.endpoint
 
-    console.debug('Calling operation', { endpoint, request })
+    console.debug('Calling operation', { endpoint, request: redact(request) })
 
     const reply = await this.remote.invoke(this.endpoint, request)
 
-    console.debug('Received reply', { endpoint, reply: reply instanceof Readable ? '[Readable stream]' : reply })
+    console.debug('Received reply',
+      { endpoint, reply: reply instanceof Readable ? '[Readable stream]' : redact(reply) })
 
     if (reply instanceof Error)
       throw new http.UnprocessableEntity(reply)