@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.282

package/features/steps/Gateway.ts

@@ -1,42 +1,83 @@
-import { after, afterAll, binding, given } from 'cucumber-tsflow'
+import tsflow from 'cucumber-tsflow'
+
 import * as boot from '@toa.io/boot'
 import { type Connector } from '@toa.io/core'
-import { parse } from '@toa.io/yaml'
-import { encode, timeout } from '@toa.io/generic'
-import { Factory } from '../../source'
-import * as syntax from '../../source/RTD/syntax'
-import { shortcuts } from '../../source/Directive'
-import type * as http from '../../source/HTTP'
+import { load as parse } from 'js-yaml'
+import { timeout } from '@toa.io/generic'
+import { Factory } from '../../source/index.js'
+import * as syntax from '../../source/RTD/syntax/index.js'
+import { shortcuts } from '../../source/Directive.js'
+import { manifests } from './map.js'
+import type * as http from '../../source/HTTP/index.js'
+
+const { after, afterAll, binding, given } = tsflow
 
 let instance: Connector | null = null
 
 @binding()
 export class Gateway {
   private default: boolean = true
+  private written: string[] = []
 
   @given('the annotation:')
   public async annotate (yaml: string): Promise<void> {
-    const annotation = parse(yaml)
+    const annotation = parse(yaml) as Partial<http.Options> & { '/'?: object }
 
-    if ('/' in annotation) {
+    if (annotation['/'] !== undefined) {
       const tree = syntax.parse(annotation['/'], shortcuts)
 
-      process.env.TOA_EXPOSITION = encode(tree)
+      process.env.TOA_EXPOSITION = JSON.stringify(tree)
     }
 
-    const { debug, trace, authorities } = annotation
+    const { debug, authorities, bouncer, ip } = annotation
     const properties = Object.assign({}, DEFAULT_PROPERTIES)
 
     if (debug !== undefined)
       properties.debug = debug
 
-    if (trace !== undefined)
-      properties.trace = trace
+    if (bouncer !== undefined)
+      properties.bouncer = bouncer
+
+    if (ip !== undefined)
+      properties.ip = ip
 
     if (authorities !== undefined)
       properties.authorities = authorities
 
-    process.env.TOA_EXPOSITION_PROPERTIES = encode(properties)
+    process.env.TOA_EXPOSITION_PROPERTIES = JSON.stringify(properties)
+
+    await Gateway.stop()
+
+    this.default = false
+  }
+
+  /**
+   * The routes of the introspection map, taken from its own manifests. `norm` runs the
+   * exposition extension over them, so what lands here is what a deployment would carry.
+   */
+  @given('the annotation of the introspection map')
+  public async annotateMap (): Promise<void> {
+    await this.annotateMapUnder()
+  }
+
+  /** The same routes under a root of the scenario's own: what an application declares around the map. */
+  @given('the annotation of the introspection map under:')
+  public async annotateMapUnder (yaml?: string): Promise<void> {
+    const tree: syntax.Node = yaml === undefined
+      ? { routes: [], methods: [], directives: [] }
+      : syntax.parse((parse(yaml) as { '/': object })['/'], shortcuts)
+
+    for (const manifest of await manifests()) {
+      const node = manifest.extensions?.[EXPOSITION] as syntax.Node | undefined
+
+      if (node === undefined)
+        throw new Error(`'${manifest.namespace}.${manifest.name}' declares no exposition`)
+
+      tree.routes.push(...node.routes)
+    }
+
+    process.env.TOA_EXPOSITION = JSON.stringify(tree)
+    process.env.TOA_EXPOSITION_PROPERTIES = JSON.stringify(DEFAULT_PROPERTIES)
 
     await Gateway.stop()
 
@@ -48,10 +89,37 @@ export class Gateway {
     const [name, namespace = 'default'] = id.split('.').reverse()
     const key = `TOA_CONFIGURATION_${namespace.toUpperCase()}_${name.toUpperCase()}`
     const def = DEFAULT_CONFIGURATION[id] ?? {}
-    const patch: object = parse(yaml)
+    const patch = parse(yaml) as object
     const configuration = Object.assign({}, def, patch)
 
-    process.env[key] = encode(configuration)
+    // scenario-scoped, as the secrets it may refer to are: a configuration left behind
+    // outlives the secrets it points at, and the next scenario cannot resolve them
+    this.written.push(key)
+    process.env[key] = JSON.stringify(configuration)
+
+    await Gateway.stop()
+
+    this.default = false
+  }
+
+  /** The secrets a scenario's configuration refers to. */
+  @given('the configuration secrets:')
+  public async secrets (yaml: string): Promise<void> {
+    const secrets = parse(yaml) as Record<string, string>
+
+    for (const [name, value] of Object.entries(secrets)) {
+      this.written.push(SECRET + name)
+      process.env[SECRET + name] = value
+    }
+
+    await Gateway.stop()
+
+    this.default = false
+  }
+
+  @given('the branch TTL is {float} second(s)')
+  public async setBranchTTL (seconds: number): Promise<void> {
+    process.env.__TESTING_EXPOSITION_BRANCH_TTL = String(seconds * 1000)
 
     await Gateway.stop()
 
@@ -64,12 +132,12 @@ export class Gateway {
       return
 
     process.env.TOA_EXPOSITION ??= DEFAULT_TREE
-    process.env.TOA_EXPOSITION_PROPERTIES ??= encode(DEFAULT_PROPERTIES)
+    process.env.TOA_EXPOSITION_PROPERTIES ??= JSON.stringify(DEFAULT_PROPERTIES)
 
     this.writeConfiguration()
 
-    const factory = new Factory(boot)
-    const service = factory.service()
+    const factory = new Factory(boot.host())
+    const service = await factory.service()
 
     if (service === null)
       throw new Error('?')
@@ -82,6 +150,13 @@ export class Gateway {
 
   @after()
   public async cleanup (): Promise<void> {
+    delete process.env.__TESTING_EXPOSITION_BRANCH_TTL
+
+    for (const key of this.written)
+      delete process.env[key]
+
+    this.written = []
+
     if (this.default)
       return
 
@@ -102,12 +177,18 @@ export class Gateway {
       const [name, namespace = 'default'] = id.split('.').reverse()
       const key = `TOA_CONFIGURATION_${namespace.toUpperCase()}_${name.toUpperCase()}`
 
-      process.env[key] ??= encode(configuration)
+      process.env[key] ??= JSON.stringify(configuration)
     }
+
+    for (const [name, value] of Object.entries(DEFAULT_SECRETS))
+      process.env[SECRET + name] ??= value
   }
 }
 
-const DEFAULT_TREE = encode({
+const EXPOSITION = '@toa.io/extensions.exposition'
+const SECRET = 'TOA_CONFIGURATION__'
+
+const DEFAULT_TREE = JSON.stringify({
   routes: [],
   methods: [],
   directives: [
@@ -122,11 +203,31 @@ const DEFAULT_TREE = encode({
 const DEFAULT_PROPERTIES: Partial<http.Options> = {
   authorities: {
     nex: 'nex.toa.io'
-  }
+  },
+  // `npm run features:h2c` runs the whole suite over cleartext HTTP/2
+  protocol: process.env.TOA_EXPOSITION_PROTOCOL === 'h2c' ? 'h2c' : 'h1'
 }
 
+// the identity components boot inside the gateway, and without a variable each would wait
+// for the values service, which these features do not run
 const DEFAULT_CONFIGURATION: Record<string, object> = {
+  // a component declaring configuration waits for `configuration.values`, which these
+  // features do not run; the variable is the local override that stands in for it
+  'realtime.streams': {},
+  'identity.basic': {},
+  'identity.federation': {},
+  'identity.otp': {},
+  'identity.passkeys': {},
   'identity.tokens': {
-    key0: 'k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA'
+    keys: [
+      { id: 'key0', key: '$IDENTITY_TOKENS_KEY0' },
+      { id: 'legacy0', key: '$IDENTITY_TOKENS_LEGACY0', format: 'paseto' }
+    ]
   }
 }
+
+// a secret is given as a reference, and comes to the component as an object
+const DEFAULT_SECRETS: Record<string, string> = {
+  IDENTITY_TOKENS_KEY0: 'sTxL6qVOadKkUJwh3FveU53XgTEo3Sdfg7k2FfiIKfs',
+  IDENTITY_TOKENS_LEGACY0: 'k3.local.pIZT8-9Fa6U_QtfQHOSStfGtmyzPINyKQq2Xk-hd7vA'
+}

package/features/steps/HTTP.ts

@@ -1,19 +1,21 @@
 import * as assert from 'node:assert'
 import * as fs from 'node:fs'
 import * as path from 'node:path'
-import { binding, then, when } from 'cucumber-tsflow'
+import tsflow from 'cucumber-tsflow'
+
 import * as http from '@toa.io/agent'
 import * as msgpack from 'msgpackr'
 import * as YAML from 'js-yaml'
-import { Captures } from './Captures'
-import { Parameters } from './Parameters'
-import { Gateway } from './Gateway'
+import { Captures } from './Captures.js'
+import { Parameters } from './Parameters.js'
+import { Gateway } from './Gateway.js'
 import type { Readable } from 'node:stream'
 
+const { binding, then, when } = tsflow
+
 @binding([Gateway, Parameters, Captures])
 export class HTTP extends http.Agent {
   private readonly gateway: Gateway
-  private fetched: Response | null = null
 
   public constructor (gateway: Gateway, parameters: Parameters, captures: Captures) {
     super(parameters.origin, captures)
@@ -23,7 +25,8 @@ export class HTTP extends http.Agent {
   @when('the following request is received:')
   public override async request (input: string): Promise<any> {
     await this.gateway.start()
-    this.fetched = await super.request(input)
+
+    await super.request(input)
   }
 
   @then('the following reply is sent:')
@@ -33,10 +36,9 @@ export class HTTP extends http.Agent {
 
   @then('response body contains {word}-encoded value:')
   public async bodyIs (format: string, yaml: string): Promise<void> {
-    assert.ok(this.fetched !== null, 'Response is null')
+    assert.ok(this.bytes !== null, 'Response body is not available')
 
-    const buf = await this.fetched.arrayBuffer()
-    const value = encoders[format]?.(buf as Buffer)
+    const value = encoders[format]?.(this.bytes)
     const expected = YAML.load(yaml)
 
     assert.deepEqual(value, expected, 'Values are not equal')
@@ -61,12 +63,35 @@ export class HTTP extends http.Agent {
 
     await super.streamMatch(head, stream)
   }
+
+  @when('the following request is interrupted after {float} second(s):')
+  public async interrupt (delay: number, input: string): Promise<any> {
+    const controller = new AbortController()
+
+    await this.gateway.start()
+
+    setTimeout(() => {
+      if (pending)
+        controller.abort()
+      else
+        console.error('Request cannot be interrupted as it is already completed')
+    }, delay * 1000)
+
+    let pending = true
+
+    await super.fetch(input, { signal: controller.signal }).catch((e) => {
+      if (e.name !== 'AbortError')
+        throw e
+    })
+
+    pending = false
+  }
 }
 
-const FILEDIR = path.resolve(__dirname, '../../../storages/source/test')
+const FILES_DIR = path.resolve(import.meta.dirname, '../../../storages/source/test')
 
 function open (filename: string): Readable {
-  return fs.createReadStream(path.join(FILEDIR, filename))
+  return fs.createReadStream(path.join(FILES_DIR, filename))
 }
 
 const encoders: Record<string, (buf: Buffer | Uint8Array) => any> = {

package/features/steps/IDP.ts

@@ -0,0 +1,337 @@
+import { once } from 'node:events'
+import * as crypto from 'node:crypto'
+import * as http from 'node:http'
+import * as assert from 'node:assert'
+import * as util from 'node:util'
+import { buffer } from 'node:stream/consumers'
+import tsflow from 'cucumber-tsflow'
+
+import { Captures } from './Captures.js'
+
+import type { AddressInfo } from 'node:net'
+
+const { binding, given, afterAll } = tsflow
+
+@binding([Captures])
+export class IDP {
+  private static server?: http.Server
+  private static privateKey?: crypto.KeyObject
+  private static issuer?: string
+  private static authCodes = new Map<string, AuthCode>()
+  private readonly captures: Captures
+
+  public constructor (captures: Captures) {
+    this.captures = captures
+  }
+
+  @afterAll()
+  public static async stop (): Promise<void> {
+    if (this.server instanceof http.Server) {
+      this.server.close()
+      await once(this.server, 'close')
+    }
+  }
+
+  @given(/local IDP is running/i)
+  public async start (): Promise<void> {
+    if (IDP.server instanceof http.Server) return
+
+    // creating the key
+    const {
+      publicKey,
+      privateKey
+    } = await util.promisify(crypto.generateKeyPair)('rsa', {
+      modulusLength: 2048
+    })
+
+    IDP.privateKey = privateKey
+
+    const jwk = JSON.stringify({
+      keys: [{
+        use: 'sig',
+        alg: 'RS256',
+        ...publicKey.export({ format: 'jwk' })
+      }]
+    })
+
+    const JWK_ENDPOINT = '/.well-known/jwks'
+    const TOKEN_ENDPOINT = '/token'
+    const AUTH_ENDPOINT = '/authorize'
+
+    const server = http.createServer(async (request, response) => {
+      switch (request.url) {
+        case JWK_ENDPOINT:
+          response.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Content-Length': jwk.length,
+            'Cache-Control': 'no-cache, no-store, must-revalidate',
+            Pragma: 'no-cache',
+            Expires: '0'
+          })
+          response.end(jwk)
+          break
+
+        case '/.well-known/openid-configuration': {
+          const openIdConfiguration = JSON.stringify({
+            issuer: IDP.issuer,
+            jwks_uri: IDP.issuer + JWK_ENDPOINT,
+            authorization_endpoint: IDP.issuer + AUTH_ENDPOINT,
+            token_endpoint: IDP.issuer + TOKEN_ENDPOINT,
+            response_types_supported: ['id_token', 'code'],
+            grant_types_supported: ['authorization_code'],
+            subject_types_supported: ['public'],
+            id_token_signing_alg_values_supported: ['RS256'],
+            scopes_supported: ['openid', 'email', 'profile']
+          })
+
+          response.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'public, max-age=3600',
+            'Content-Length': openIdConfiguration.length
+          })
+
+          response.end(openIdConfiguration)
+        }
+
+          break
+
+        case TOKEN_ENDPOINT: {
+          if (request.method !== 'POST') {
+            response.writeHead(405, { 'Content-Type': 'text/plain' })
+            response.end('Method not allowed')
+
+            return
+          }
+
+          const buf = await buffer(request)
+          const body = buf.toString('utf8')
+
+          const params = new URLSearchParams(body)
+          const grantType = params.get('grant_type')!
+          const code = params.get('code')!
+          const redirectUri = params.get('redirect_uri')!
+          const clientId = params.get('client_id')!
+
+          if (grantType !== 'authorization_code' || !code || !clientId) {
+            response.writeHead(400, { 'Content-Type': 'application/json' })
+            response.end(JSON.stringify({ error: 'invalid_request' }))
+          }
+
+          const codeData = IDP.authCodes.get(code)
+
+          if (!codeData ||
+            codeData.expiresAt < Date.now() ||
+            codeData.clientId !== clientId ||
+            (redirectUri && codeData.redirectUri !== redirectUri)) {
+            response.writeHead(400, { 'Content-Type': 'application/json' })
+            response.end(JSON.stringify({ error: 'invalid_grant' }))
+
+            return
+          }
+
+          const accessToken = crypto.randomBytes(32).toString('hex')
+          const idToken = this.generateIdToken(codeData.sub, codeData.email, clientId)
+
+          IDP.authCodes.delete(code)
+
+          response
+            .writeHead(200, { 'Content-Type': 'application/json' })
+            .end(JSON.stringify({
+              access_token: accessToken,
+              token_type: 'Bearer',
+              id_token: idToken,
+              expires_in: 3600
+            }))
+        }
+
+          break
+
+        default:
+          response.writeHead(404, 'Not found')
+          response.end()
+      }
+    })
+
+    server.listen(44444, 'localhost')
+    await once(server, 'listening')
+
+    const address = server.address() as AddressInfo
+
+    console.log('IdP is listening on %s:%s', address.address, address.port)
+    IDP.server = server
+    IDP.issuer = `http://localhost:${address.port}`
+  }
+
+  @given('the IDP token for {word} is issued')
+  public async issueToken (user: string): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        email: user + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('the IDP random token is issued')
+  public async issueNewToken (): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const sub = Math.random().toString(36).substring(7)
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub,
+        aud: 'test',
+        email: sub + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set('random.sub', sub)
+    this.captures.set('random.email', sub + '@test.local')
+    this.captures.set('random.id_token', idToken)
+  }
+
+  @given('the IDP {word} token for {word} is issued with following secret:')
+  public async issueSymmetricToken (alg: string, user: string, secret: string): Promise<void> {
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createHmac(alg.replace(/^HS(\d{3})$/, 'sha$1'), secret)
+      .update(jwt)
+      .digest('base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('ID token with jti is issued for {word}')
+  public async issueTokenWithJti (user: string): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        email: user + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000),
+        jti: crypto.randomUUID()
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('auth code for {word} is issued for {word}')
+  public async issueAuthCode (user: string, redirectUri: string): Promise<void> {
+    const code = crypto.randomBytes(16).toString('hex')
+    const email = user + '@test.local'
+    const clientId = 'nex'
+
+    IDP.authCodes.set(code, {
+      code,
+      sub: user,
+      email,
+      clientId,
+      redirectUri,
+      expiresAt: Date.now() + 60 * 1000
+    })
+
+    const json = JSON.stringify({ code, iss: IDP.issuer, for: redirectUri })
+    const base64 = Buffer.from(json).toString('base64')
+
+    this.captures.set(`${user}.auth_code`, code)
+    this.captures.set(`${user}.code_credentials`, base64)
+  }
+
+  private generateIdToken (sub: string, email: string, clientId: string): string {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+    assert.ok(IDP.issuer, 'IdP issuer is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub,
+        aud: clientId,
+        email,
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+
+    return `${jwt}.${signature}`
+  }
+}
+
+interface AuthCode {
+  code: string
+  sub: string
+  email: string
+  clientId: string
+  redirectUri: string
+  expiresAt: number
+}

package/features/steps/Identity.ts

@@ -0,0 +1,54 @@
+import tsflow from 'cucumber-tsflow'
+
+import * as http from '@toa.io/agent'
+import { Parameters } from './Parameters.js'
+import { Captures } from './Captures.js'
+import { Gateway } from './Gateway.js'
+
+const { binding, given } = tsflow
+
+@binding([Gateway, Parameters, Captures])
+export class Identity {
+  private readonly gateway: Gateway
+  private readonly http: http.Agent
+  private readonly variables: Captures
+
+  public constructor (gateway: Gateway, parameters: Parameters, captures: Captures) {
+    this.gateway = gateway
+    this.http = new http.Agent(parameters.origin, captures)
+    this.variables = captures
+  }
+
+  @given('transient identity {word}')
+  public async transient (as: string): Promise<Principal> {
+    await this.gateway.start()
+
+    await this.http.request(`
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+    `)
+
+    this.http.responseIncludes(`
+      201 Created
+      authorization: Token \${{ ${as}.token }}
+
+      id: \${{ ${as}.id }}
+    `)
+
+    const id = this.variables.get(as + '.id')!
+    const token = this.variables.get(as + '.token')!
+
+    return { id, token }
+  }
+
+  @given('transient identity')
+  public async anonymous (): Promise<Principal> {
+    return await this.transient('identity')
+  }
+}
+
+export interface Principal {
+  id: string
+  token: string
+}