@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.282

package/features/authorities.federation.feature

@@ -1,55 +1,54 @@
 Feature: OIDC tokens with authorities
 
+  Background:
+    Given local IDP is running
+    And the `identity.federation` database is empty
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+          aud: test
+      """
+
+
   Scenario: OIDC tokens are scoped to authorities
     Given the annotation:
       """yaml
       authorities:
         one: the.one.com
-        two: the.two.com
       /:
         /:id:
           auth:id: id
           GET:
             dev:stub: Hello
       """
-    And local IDP is running
-    And the `identity.federation` database is empty
-    And the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:44444
-      """
     And the IDP token for One is issued
     And the IDP token for Two is issued
 
     # create identities
     When the following request is received:
       """
-      POST /identity/federation/ HTTP/1.1
+      GET /identity/ HTTP/1.1
       host: the.one.com
+      authorization: Bearer ${{ One.id_token }}
       accept: application/yaml
-      content-type: application/yaml
-
-      credentials: ${{ One.id_token }}
       """
     Then the following reply is sent:
       """
-      201 Created
+      200 OK
 
       id: ${{ One.id }}
       """
     When the following request is received:
       """
-      POST /identity/federation/ HTTP/1.1
+      GET /identity/ HTTP/1.1
+      authorization: Bearer ${{ Two.id_token }}
       host: the.two.com
       accept: application/yaml
-      content-type: application/yaml
-
-      credentials: ${{ Two.id_token }}
       """
     Then the following reply is sent:
       """
-      201 Created
+      200 OK
 
       id: ${{ Two.id }}
       """
@@ -65,6 +64,8 @@ Feature: OIDC tokens with authorities
       """
       200 OK
       """
+
+    # authorization will create new identity within `one` authority
     When the following request is received:
       """
       GET /${{ Two.id }}/ HTTP/1.1
@@ -73,7 +74,7 @@ Feature: OIDC tokens with authorities
       """
     Then the following reply is sent:
       """
-      401 Unauthorized
+      403 Forbidden
       """
 
     # access `two` authority
@@ -85,7 +86,7 @@ Feature: OIDC tokens with authorities
       """
     Then the following reply is sent:
       """
-      401 Unauthorized
+      403 Forbidden
       """
     When the following request is received:
       """

package/features/authorities.tokens.feature

@@ -5,7 +5,6 @@ Feature: Token credentials with authorities
       """yaml
       authorities:
         one: the.one.com
-        two: the.two.com
       /:
         /:id:
           auth:id: id
@@ -43,7 +42,7 @@ Feature: Token credentials with authorities
       id: ${{ one.id }}
       """
 
-    # create identity within the `two` authority
+    # create identity within the `the.two.com` authority
     When the following request is received:
       """
       POST /identity/basic/ HTTP/1.1

package/features/body.feature

@@ -47,3 +47,30 @@ Feature: Request body
       | operation |
       | compute   |
       | affect    |
+
+  Scenario: JSON body with charset in content-type
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          POST:
+            endpoint: echo
+      """
+    When the following request is received:
+      """
+      POST /echo/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/json
+      content-type: application/json; charset=utf-8
+
+      {"foo":"bar"}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/json
+      vary: accept
+
+      {"foo":"bar"}
+      """

package/features/cache.feature

@@ -1,3 +1,4 @@
+@security
 Feature: Caching
 
   Background:
@@ -10,6 +11,40 @@ Feature: Caching
       | _id                              | identity                         | role      |
       | 775a648d054e4ce1a65f8f17e5b51803 | b70a7dbca6b14a2eaac8a9eb4b2ff4db | developer |
 
+  Scenario: Default caching
+    Given the annotation:
+      """yaml
+      /:
+        anonymous: true
+        GET:
+          dev:stub: foo
+        /private:
+          auth:role: developer
+          GET:
+            dev:stub: bar
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the reply does not contain:
+      """
+      cache-control:
+      """
+    When the following request is received:
+      """
+      GET /private/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      cache-control: no-store
+      """
+
   Scenario: Caching successful response
     Given the annotation:
       """yaml
@@ -29,8 +64,8 @@ Feature: Caching
     Then the following reply is sent:
       """
       200 OK
-      content-type: text/plain
       cache-control: max-age=60000
+      content-type: text/plain
 
       hello
       """
@@ -75,8 +110,8 @@ Feature: Caching
     Then the following reply is sent:
       """
       200 OK
-      content-type: text/plain
       cache-control: max-age=30000
+      content-type: text/plain
 
       hello
       """
@@ -90,8 +125,8 @@ Feature: Caching
     Then the following reply is sent:
       """
       200 OK
-      content-type: text/plain
       cache-control: private, max-age=30000
+      content-type: text/plain
 
       hello
       """
@@ -105,8 +140,8 @@ Feature: Caching
     Then the following reply is sent:
       """
       200 OK
-      content-type: text/plain
       cache-control: no-cache, max-age=60000, public
+      content-type: text/plain
 
       hello
       """
@@ -168,8 +203,8 @@ Feature: Caching
     Then the following reply is sent:
       """
       200 OK
-      content-type: text/plain
       cache-control: max-age=60000, public
+      content-type: text/plain
 
       hello
       """
@@ -195,8 +230,8 @@ Feature: Caching
 
   Scenario: Private responses are sent with `vary: authorization`
     Given the `identity.basic` database contains:
-      | _id                              | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
     And the annotation:
       """yaml
       /:
@@ -205,6 +240,10 @@ Feature: Caching
           cache:control: max-age=10000
           GET:
             dev:stub: Keep it
+        /sessions/:id:
+          auth:id: id
+          GET:
+            dev:stub: Keep it
       """
     When the following request is received:
       """
@@ -212,7 +251,6 @@ Feature: Caching
       host: nex.toa.io
       authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
       """
-    # `no-store` when token is issued
     Then the following reply is sent:
       """
       200 OK
@@ -231,3 +269,54 @@ Feature: Caching
       cache-control: private, max-age=10000
       vary: authorization
       """
+    When the following request is received:
+      """
+      GET /sessions/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      cache-control: private
+      vary: authorization
+      """
+
+  Scenario: Authenticated `no-cache` responses
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+    And the annotation:
+      """yaml
+      /:
+        /:id:
+          auth:id: id
+          cache:control: no-cache
+          GET:
+            dev:stub: Keep it
+      """
+    When the following request is received:
+      """
+      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    # no-store since the response contains the token
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ token }}
+      cache-control: no-store
+      """
+    When the following request is received:
+      """
+      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Token ${{ token }}
+      """
+    # private is added since the response is authenticated
+    Then the following reply is sent:
+      """
+      200 OK
+      cache-control: private, no-cache
+      """

package/features/configuration.feature

@@ -0,0 +1,207 @@
+@security
+Feature: Configuration values
+
+  The values component declares how it is exposed in its own manifest, and that manifest
+  is what this mounts. Reading takes `system:configuration:get`, creating takes
+  `system:configuration:create`, and the one who creates is recorded as the originator.
+
+  Background:
+    # developer:secret, user:12345
+    Given the `identity.basic` database contains:
+      | _id                              | authority | username  | password                                                     |
+      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
+      | e8e4f9c2a68d419b861403d71fabc915 | nex       | user      | $2b$10$Frszmrmsz9iwSXzBbRRMKeDVKsNxozkrLNSsN.SnVC.KPxLtQr/bK |
+    And the `identity.roles` database contains:
+      | _id                              | identity                         | role                     |
+      | 1c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | efe3a65ebbee47ed95a73edd911ea328 | system:configuration     |
+      | 2c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | e8e4f9c2a68d419b861403d71fabc915 | system:configuration:get |
+    And the `identity.bans` database is empty
+    And the `configuration.values` database is empty
+    And the configuration values are deployed:
+      """yaml
+      dummies.dummy:
+        epoch: e1
+        schema:
+          type: object
+          properties:
+            foo:
+              type: string
+            bar:
+              type: string
+              default: world
+        defaults:
+          foo: deployed
+      """
+    And the configuration values are running
+
+  Scenario: Reading the deployed configuration
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      configuration:
+        foo: deployed
+      schema:
+        type: object
+        properties:
+          foo:
+            type: string
+          bar:
+            type: string
+            default: world
+      epoch: e1
+      """
+
+  Scenario: Listing the configurations
+    When the following request is received:
+      """
+      GET /configuration/values/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      - component: dummies.dummy
+        epoch: e1
+        schema:
+          type: object
+          properties:
+            foo:
+              type: string
+            bar:
+              type: string
+              default: world
+        configuration:
+          foo: deployed
+      """
+
+  Scenario: Listing without the role
+    When the following request is received:
+      """
+      GET /configuration/values/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Reading without the role
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+  Scenario: Reading the configuration of an unknown component
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.unknown/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      """
+    Then the following reply is sent:
+      """
+      404 Not Found
+      """
+
+  Scenario: Creating configuration
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      accept: application/yaml
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      content-type: application/yaml
+
+      epoch: e1
+      """
+    When the following request is received:
+      """
+      GET /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+        bar: world
+      epoch: e1
+      """
+
+  Scenario: Creating configuration without the role
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic dXNlcjoxMjM0NQ==
+      content-type: application/yaml
+
+      configuration:
+        foo: created
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Creating configuration not fitting the schema
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.dummy/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      configuration:
+        foo:
+          nested: true
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """
+
+  Scenario: Creating configuration for an unknown component
+    When the following request is received:
+      """
+      POST /configuration/values/dummies.unknown/ HTTP/1.1
+      host: nex.toa.io
+      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
+      content-type: application/yaml
+
+      configuration: {}
+      """
+    Then the following reply is sent:
+      """
+      422 Unprocessable Entity
+      """

package/features/cors.feature

@@ -1,6 +1,7 @@
+@security
 Feature: CORS Support
 
-  Scenario: Using CORS
+  Scenario: Basic CORS permissions
     Given the annotation:
       """yaml
       /:
@@ -18,10 +19,10 @@ Feature: CORS Support
     Then the following reply is sent:
       """
       204 No Content
-      access-control-allow-origin: https://hello.world
-      access-control-allow-methods: GET, POST, PUT, PATCH, DELETE
-      access-control-allow-headers: accept, authorization, content-type, etag, if-match, if-none-match
       access-control-allow-credentials: true
+      access-control-allow-headers: accept, authorization, content-type, if-match, if-none-match
+      access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, LOCK, UNLOCK
+      access-control-allow-origin: https://hello.world
       access-control-max-age: 3600
       cache-control: max-age=3600
       vary: origin
@@ -35,12 +36,32 @@ Feature: CORS Support
     Then the following reply is sent:
       """
       200 OK
+      access-control-allow-credentials: true
       access-control-allow-origin: https://hello.world
-      access-control-expose-headers: authorization, content-type, content-length, etag
+      access-control-expose-headers: authorization, content-type, content-length, date, etag, last-modified
+      vary: origin
+      """
+
+  Scenario: Always vary CORS
+    Given the annotation:
+      """yaml
+      /:
+        anonymous: true
+        GET:
+          dev:stub: hello
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      """
+    Then the following reply is sent:
+      """
+      200 OK
       vary: origin
       """
 
-  Scenario: Errors contain CORS headers
+  Scenario: Errors have CORS headers
     Given the annotation:
       """yaml
       /:
@@ -58,7 +79,7 @@ Feature: CORS Support
       """
       404 Not Found
       access-control-allow-origin: https://hello.world
-      access-control-expose-headers: authorization, content-type, content-length, etag
+      access-control-expose-headers: authorization, content-type, content-length, date, etag, last-modified
       vary: origin
       """
     When the following request is received:
@@ -71,6 +92,6 @@ Feature: CORS Support
       """
       401 Unauthorized
       access-control-allow-origin: https://hello.world
-      access-control-expose-headers: authorization, content-type, content-length, etag
+      access-control-expose-headers: authorization, content-type, content-length, date, etag, last-modified
       vary: origin
       """