@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.282

package/source/directives/auth/Authorization.ts

@@ -1,20 +1,30 @@
 import assert from 'node:assert'
 import { match } from 'matchacho'
-import * as http from '../../HTTP'
-import { Anonymous } from './Anonymous'
-import { Id } from './Id'
-import { Role } from './Role'
-import { Rule } from './Rule'
-import { Incept } from './Incept'
-import { Echo } from './Echo'
-import { Scheme } from './Scheme'
-import { Delegate } from './Delegate'
-import { split } from './split'
-import { PRIMARY, PROVIDERS } from './schemes'
-import type { Output } from '../../io'
+import { console } from 'openspan'
+import { Minimatch } from 'minimatch'
+import * as http from '../../HTTP/index.js'
+import { Anonymous } from './Anonymous.js'
+import { Id } from './Id.js'
+import { Role } from './Role.js'
+import { Rule } from './Rule.js'
+import { Incept } from './Incept.js'
+import { Assert } from './Assert.js'
+import { Echo } from './Echo.js'
+import { Scheme } from './Scheme.js'
+import { Delegate } from './Delegate.js'
+import { Federation } from './Federation.js'
+import { Anyone } from './Anyone.js'
+import { Input, type Declaration } from './Input.js'
+import { split } from './split.js'
+import { PRIMARY, provider as providerOf } from './schemes.js'
+import { ATOM_GROUP } from '../../const.js'
+import { Quotas, Sync } from '../io/lib/throttle/index.js'
+import { Keys } from '../io/lib/throttle/Keys.js'
+import type { Output } from '../../io.js'
 import type { Component } from '@toa.io/core'
-import type { Remotes } from '../../Remotes'
-import type { Parameter, DirectiveFamily } from '../../RTD'
+import type { Remotes } from '../../Remotes.js'
+import type { Parameter, DirectiveFamily } from '../../RTD/index.js'
+import type { Host } from '../../Factory.js'
 import type {
   AuthenticationResult,
   Ban,
@@ -22,10 +32,10 @@ import type {
   Discovery,
   Extension,
   Identity,
-  Input,
+  Context,
   Remote,
   Schemes
-} from './types'
+} from './types.js'
 
 export class Authorization implements DirectiveFamily<Directive, Extension> {
   public readonly depends: string[] = ['Vary']
@@ -37,9 +47,40 @@ export class Authorization implements DirectiveFamily<Directive, Extension> {
   private tokens: Component | null = null
   private bans: Component | null = null
 
+  /** Failed authentications per address, reconciled with the other gateways. */
+  private meter: Quotas | null = null
+  private sync: Sync | null = null
+
+  public mount (host: Host, options: http.Options): void {
+    this.sync?.dispose()
+    this.sync = null
+    this.meter = null
+
+    const bouncer = options.bouncer
+
+    // keyed by address, which is the deployment's to name, so off until it is set
+    if (bouncer === undefined)
+      return
+
+    this.meter = new Quotas({
+      keys: Keys.create([{ method: 'ip', options: BOUNCER }]),
+      requests: bouncer.attempts ?? ATTEMPTS,
+      interval: (bouncer.interval ?? INTERVAL) * 1000,
+      conditional: true, // charged on a rejection, not on a check
+      name: METER
+    })
+
+    this.sync = new Sync(host.atom(ATOM_GROUP))
+    this.sync.register(this.meter)
+  }
+
+  public dispose (): void {
+    this.sync?.dispose()
+  }
+
   public create (name: string, value: any, remotes: Remotes): Directive {
     assert.ok(name in constructors,
-      `Directive 'auth:${name}' is not implemented.`)
+      `Directive 'auth:${name}' is not implemented`)
 
     const Class = constructors[name]
 
@@ -49,36 +90,44 @@ export class Authorization implements DirectiveFamily<Directive, Extension> {
     return match(Class,
       Role, () => new Role(value as string | string[], this.discovery.roles),
       Rule, () => new Rule(value as Record<string, string>, this.create.bind(this)),
+      Input, () => new Input(value as Declaration[], this.create.bind(this)),
       Incept, () => new Incept(value as string, this.discovery),
+      Delegate, () => new Delegate(value as string, this.discovery.roles),
       () => new Class(value))
   }
 
+  public arrange (directives: Directive[]): void {
+    directives.sort((a, b) => (a.priority ?? 1) - (b.priority ?? 1))
+  }
+
   public async preflight (directives: Directive[],
-    input: Input,
+    context: Context,
     parameters: Parameter[]): Promise<Output> {
-    const identity = await this.resolve(input.authority, input.request.headers.authorization)
-
-    input.identity = identity
+    context.identity = await this.resolve(context)
 
     for (const directive of directives) {
-      const allow = await directive.authorize(identity, input, parameters)
+      const allow = await directive.authorize(context.identity, context, parameters)
 
       if (allow)
-        return directive.reply?.(identity) ?? null
+        if (this.permitted(context))
+          return directive.reply?.(context) ?? null
+        else
+          throw new http.Forbidden()
     }
 
-    if (identity === null)
+    if (context.identity === null)
       throw new http.Unauthorized()
     else
       throw new http.Forbidden()
   }
 
   public async settle (directives: Directive[],
-    request: Input,
+    context: Context,
     response: http.OutgoingMessage): Promise<void> {
-    for (const directive of directives) await directive.settle?.(request, response)
+    await Promise.all(directives.map(async (directive) =>
+      directive.settle?.(context, response)))
 
-    const identity = request.identity
+    const identity = context.identity
 
     if (identity === null)
       return
@@ -86,43 +135,69 @@ export class Authorization implements DirectiveFamily<Directive, Extension> {
     if (identity.scheme === PRIMARY && !identity.refresh)
       return
 
-    // Role directive may have already set the value
-    if (identity.roles === undefined)
-      await Role.set(identity, this.discovery.roles)
+    if (await this.banned(identity))
+      throw new http.Unauthorized()
 
+    // a token carries the roles it was issued with, and the refresh is where they are read again;
+    // any other scheme has just read them, unless a Role directive already did
+    if (identity.scheme === PRIMARY)
+      identity.roles = await Role.get(identity, this.discovery.roles)
+    else
+      identity.roles ??= await Role.get(identity, this.discovery.roles)
     this.tokens ??= await this.discovery.tokens
 
     const token = await this.tokens.invoke<string>('encrypt', {
-      input: { authority: request.authority, identity }
+      input: { authority: context.authority, identity }
     })
 
     const authorization = `Token ${token}`
 
     response.headers ??= new Headers()
     response.headers.set('authorization', authorization)
-    response.headers.append('cache-control', 'no-store')
+    response.headers.set('cache-control', 'no-store')
   }
 
-  private async resolve (authority: string, authorization: string | undefined): Promise<Identity | null> {
+  private async resolve (context: Context): Promise<Identity | null> {
+    const { authority } = context
+    const { authorization } = context.request.headers
+
     if (authorization === undefined)
       return null
 
+    const retry = this.meter?.check(context, NONE) ?? 0
+
+    if (retry > 0)
+      throw new http.TooManyRequests(retry)
+
     const [scheme, credentials] = split(authorization)
-    const provider = PROVIDERS[scheme]
+    const provider = providerOf(scheme)
 
-    if (!(provider in this.discovery))
-      throw new http.Unauthorized(`Unknown authentication scheme '${scheme}'.`)
+    if (provider === undefined)
+      throw new http.Unauthorized(`Unknown authentication scheme '${scheme}'`)
 
     this.schemes[scheme] ??= await this.discovery[provider]
 
     const result = await this.schemes[scheme].invoke<AuthenticationResult>('authenticate', {
       input: {
+        scheme,
         authority,
         credentials
       }
     })
 
-    if (result instanceof Error) return null
+    if (result instanceof Error) {
+      const code: string | unknown = (result as unknown as { code: string }).code
+
+      if (typeof code === 'string') {
+        console.info('Authentication failed', { code })
+
+        context.rejection = code
+      }
+
+      this.meter?.use(context, null)
+
+      return null
+    }
 
     const identity = result.identity
 
@@ -134,6 +209,16 @@ export class Authorization implements DirectiveFamily<Directive, Extension> {
     return identity
   }
 
+  private permitted (context: Context): boolean {
+    const permissions = context.identity?.permissions
+
+    if (permissions === undefined)
+      return true
+
+    // the route is matched on the normalized path, so the permission is too
+    return permits(permissions, context.request.method, context.url.pathname)
+  }
+
   private async banned (identity: Identity): Promise<boolean> {
     this.bans ??= await this.discovery.bans
 
@@ -143,15 +228,61 @@ export class Authorization implements DirectiveFamily<Directive, Extension> {
   }
 }
 
+/** Whether the permissions admit the method on the path the request is routed by. */
+export function permits (permissions: Record<string, string[]>, method: string, pathname: string): boolean {
+  return Object.entries(permissions).some(([pattern, methods]) =>
+    methods.some((allowed) => allowed === '*' || allowed === method) &&
+    glob(pattern).match(pathname))
+}
+
+/**
+ * `minimatch(str, pattern)` compiles the pattern on every call, and a permission is
+ * matched on every request the identity makes. Patterns arrive with an identity, hence
+ * the bound.
+ */
+function glob (pattern: string): Minimatch {
+  let compiled = GLOBS.get(pattern)
+
+  if (compiled === undefined) {
+    if (GLOBS.size >= GLOBS_LIMIT)
+      GLOBS.clear()
+
+    compiled = new Minimatch(pattern)
+
+    GLOBS.set(pattern, compiled)
+  }
+
+  return compiled
+}
+
+/** What an address may fail at once, and the seconds it takes to earn them back. */
+const ATTEMPTS = 20
+const INTERVAL = 60
+
+/** Who is speaking when a request cannot be keyed. */
+const BOUNCER = 'Authentication bouncer'
+
+/** The meter's name in the atom: `atom:exposition:meter:credentials:<address>`. */
+const METER = 'credentials'
+
+const NONE: Parameter[] = []
+
+const GLOBS = new Map<string, Minimatch>()
+const GLOBS_LIMIT = 1024
+
 const constructors: Record<string, new (value: any, argument?: any) => Directive> = {
   anonymous: Anonymous,
+  anyone: Anyone,
   id: Id,
   role: Role,
   rule: Rule,
   incept: Incept,
+  assert: Assert,
   scheme: Scheme,
   echo: Echo,
-  delegate: Delegate
+  delegate: Delegate,
+  claims: Federation,
+  input: Input
 }
 
-const REMOTES: Remote[] = ['basic', 'federation', 'tokens', 'roles', 'bans']
+const REMOTES: Remote[] = ['basic', 'federation', 'tokens', 'roles', 'bans', 'otp']

package/source/directives/auth/Delegate.ts

@@ -1,18 +1,22 @@
-import { BadRequest } from '../../HTTP'
-import { type Directive, type Identity } from './types'
-import type { Input } from '../../io'
+import { BadRequest } from '../../HTTP/index.js'
+import { Role } from './Role.js'
+import type { Context, Directive, Identity } from './types.js'
+import type { Component } from '@toa.io/core'
 
 export class Delegate implements Directive {
   private readonly property: string
+  private readonly discovery: Promise<Component>
 
-  public constructor (property: string) {
+  public constructor (property: string, discovery: Promise<Component>) {
     this.property = property
+    this.discovery = discovery
   }
 
-  public authorize (identity: Identity | null, context: Input): boolean {
+  public async authorize (identity: Identity | null, context: Context): Promise<boolean> {
     if (identity === null)
       return false
 
+    identity.roles ??= await Role.get(identity, this.discovery)
     context.pipelines.body.push((body) => this.embed(body, identity))
 
     return true
@@ -23,7 +27,7 @@ export class Delegate implements Directive {
       body = {}
 
     check(body)
-    body[this.property] = identity
+    body[this.property] = structuredClone(identity)
 
     return body
   }

package/source/directives/auth/Echo.ts

@@ -1,12 +1,22 @@
-import { type OutgoingMessage } from '../../HTTP'
-import { type Directive, type Identity } from './types'
+import { create } from './create.js'
+import type { OutgoingMessage } from '../../HTTP/index.js'
+import type { Directive, Identity, Context } from './types.js'
 
 export class Echo implements Directive {
-  public authorize (identity: Identity | null): boolean {
-    return identity !== null
+  public authorize (identity: Identity | null, context: Context): boolean {
+    if (identity === null && 'authorization' in context.request.headers)
+      return false
+
+    context.identity ??= create()
+
+    return true
   }
 
-  public reply (identity: Identity | null): OutgoingMessage {
-    return { body: identity }
+  public reply (context: Context): OutgoingMessage {
+    const body = context.identity!
+
+    return body.scheme === null
+      ? { status: 201, body }
+      : { body }
   }
 }

package/source/directives/auth/Federation.ts

@@ -0,0 +1,84 @@
+import assert from 'node:assert'
+import type { Directive, Identity, Context } from './types.js'
+import type { Parameter } from '../../RTD/index.js'
+
+export class Federation implements Directive {
+  private readonly matchers: Array<[keyof Claims, Matcher]>
+
+  public constructor (options: Options) {
+    this.matchers = (Object.entries(options) as Array<[keyof Claims, string]>)
+      .map(([key, value]) => [key, toMatcher(value)])
+
+    assert.ok(this.matchers.length > 0, '`auth:claims` requires at least one property defined')
+  }
+
+  public authorize (identity: Identity | null, context: Context, parameters: Parameter[]): boolean {
+    if (identity === null || !('claims' in identity))
+      return false
+
+    const claims = (identity as FederatedIdentity).claims
+
+    for (const [key, match] of this.matchers)
+      if (!match(claims[key], context, parameters))
+        return false
+
+    return true
+  }
+}
+
+function toMatcher (expression: string): Matcher {
+  if (expression.startsWith(':')) {
+    const key = expression.slice(1) as 'authority'
+
+    if (key === 'authority')
+      return (value, context) => matches(value, context[key])
+
+    if (key === 'domain')
+      return (value, context) => {
+        return Array.isArray(value)
+          ? value.some((iss) => codomain(iss, context))
+          : codomain(value, context)
+      }
+
+    throw new Error('Unknown `auth:claims` syntax: ' + expression)
+  }
+
+  if (expression.startsWith('/:')) {
+    const name = expression.slice(2)
+
+    return (value, _, parameters) => parameters
+      .some((parameter) => parameter.name === name && matches(value, parameter.value))
+  }
+
+  return (value) => matches(value, expression)
+}
+
+function matches (value: string | string[], reference: string): boolean {
+  return Array.isArray(value)
+    ? value.includes(reference)
+    : value === reference
+}
+
+function codomain (iss: string, context: Context): boolean {
+  const hostname = new URL(iss).hostname
+  const dot = hostname.indexOf('.')
+  const basename = dot === -1 ? hostname : hostname.slice(dot)
+
+  return context.authority.slice(-basename.length) === basename
+}
+
+type Matcher = (value: string | string[], context: Context, parameters: Parameter[]) => boolean
+
+interface Claims {
+  iss: string
+  sub: string
+  aud: string | string[]
+}
+
+interface Options extends Partial<Claims> {
+  iss: string
+}
+
+interface FederatedIdentity extends Identity {
+  claims: Claims
+}

package/source/directives/auth/Id.ts

@@ -1,5 +1,5 @@
-import { type Parameter } from '../../RTD'
-import { type Directive, type Identity } from './types'
+import { type Parameter } from '../../RTD/index.js'
+import { type Directive, type Identity } from './types.js'
 
 export class Id implements Directive {
   private readonly parameter: string
@@ -8,7 +8,7 @@ export class Id implements Directive {
     this.parameter = parameter
   }
 
-  public authorize (identity: Identity | null, _: any, parameters: Parameter[]): boolean {
+  public authorize (identity: Identity | null, _: unknown, parameters: Parameter[]): boolean {
     if (identity === null)
       return false
 

package/source/directives/auth/Incept.ts

@@ -1,39 +1,52 @@
-import { type Maybe } from '@toa.io/types'
-import * as http from '../../HTTP'
-import { type Directive, type Discovery, type Identity, type Input, type Schemes } from './types'
-import { split } from './split'
-import { PROVIDERS } from './schemes'
+import assert from 'node:assert'
+import { console } from 'openspan'
+import * as http from '../../HTTP/index.js'
+import { split } from './split.js'
+import { create } from './create.js'
+import { INCEPTION, UNKNOWN, provider as providerOf } from './schemes.js'
+import { Role } from './Role.js'
+import type { Component } from '@toa.io/core'
+import type { Maybe } from '@toa.io/types'
+import type { Directive, Discovery, Identity, Context, Schemes, Ban } from './types.js'
 
 export class Incept implements Directive {
-  private readonly property: string
-  private readonly discovery: Discovery
-  private readonly schemes: Schemes = {} as unknown as Schemes
+  private static readonly schemes: Schemes = {} as unknown as Schemes
+  private static discovery: Discovery
+  private static bans: Component | null = null
+
+  private readonly property: string | null
 
   public constructor (property: string, discovery: Discovery) {
+    assert.ok(property === null || typeof property === 'string',
+      '`auth:incept` value must be a string or null')
+
     this.property = property
-    this.discovery = discovery
+    Incept.discovery ??= discovery
   }
 
-  public authorize (identity: Identity | null, input: Input): boolean {
-    return identity === null && 'authorization' in input.request.headers
-  }
+  public static async incept (context: Context, id: string): Promise<Identity> {
+    const [scheme, credentials] = split(context.request.headers.authorization!)
+    const provider = providerOf(scheme)
 
-  public async settle (input: Input, response: http.OutgoingMessage): Promise<void> {
-    const id = response.body?.[this.property]
+    if (provider === undefined)
+      throw new http.BadRequest('Authentication scheme is not supported')
 
-    if (id === undefined)
-      throw new http.Conflict('Identity inception has failed as the response body ' +
-        ` does not contain the '${this.property}' property.`)
+    if (!INCEPTION.includes(provider))
+      throw new http.Unauthorized()
 
-    const [scheme, credentials] = split(input.request.headers.authorization!)
-    const provider = PROVIDERS[scheme]
+    Incept.bans ??= await Incept.discovery.bans
 
-    this.schemes[scheme] ??= await this.discovery[provider]
+    const ban = await Incept.bans.invoke<Ban>('observe', { query: { id } })
 
-    const identity = await this.schemes[scheme]
-      .invoke<Maybe<Identity>>('incept', {
+    if (ban.banned)
+      throw new http.Unauthorized()
+
+    Incept.schemes[scheme] ??= await Incept.discovery[provider]
+
+    const identity = await Incept.schemes[scheme].invoke<Maybe<Identity>>('incept', {
       input: {
-        authority: input.authority,
+        scheme,
+        authority: context.authority,
         id,
         credentials
       }
@@ -42,7 +55,51 @@ export class Incept implements Directive {
     if (identity instanceof Error)
       throw new http.UnprocessableEntity(identity)
 
-    input.identity = identity
-    input.identity.scheme = scheme
+    identity.scheme = scheme
+    identity.roles = []
+
+    return identity
+  }
+
+  /** Credentials that were rejected for any reason but being unknown are not incepted. */
+  public static acceptable (context: Context): boolean {
+    return context.request.headers.authorization === undefined || context.rejection === UNKNOWN
+  }
+
+  public authorize (identity: Identity | null, context: Context): boolean {
+    return identity === null && Incept.acceptable(context)
+  }
+
+  public reply (context: Context): http.OutgoingMessage | null {
+    if (this.property !== null)
+      return null
+
+    const body = create(context.request.headers.authorization)
+
+    return { body }
+  }
+
+  public async settle (context: Context, response: http.OutgoingMessage): Promise<void> {
+    const id = response.body?.[this.property ?? 'id']
+
+    if (id === undefined) {
+      console.debug('Inception skipped: response does not contain expected property', {
+        property: this.property,
+        response
+      })
+
+      return
+    }
+
+    assert(typeof id === 'string', `Response body property "${this.property}" expected to be a string`)
+
+    if (context.request.headers.authorization !== undefined)
+      context.identity = await Incept.incept(context, id)
+    else {
+      const identity = { id, scheme: null, refresh: true }
+      const roles = await Role.get(identity, Incept.discovery.roles)
+
+      context.identity = { ...identity, roles }
+    }
   }
 }

package/source/directives/auth/Input.ts

@@ -0,0 +1,71 @@
+import { Forbidden } from '../../HTTP/index.js'
+import type { Parameter } from '../../RTD/index.js'
+import type { Context, Directive, Identity, Create } from './types.js'
+
+export class Input implements Directive {
+  public priority = 0
+  private readonly statements: Statement[] = []
+
+  public constructor (declarations: Declaration[], create: Create) {
+    this.statements = declarations.map((declaration) => new Statement(declaration, create))
+  }
+
+  public async authorize (identity: Identity | null, context: Context, parameters: Parameter[]): Promise<boolean> {
+    context.pipelines.body.push(async (body) => this.check(identity, context, parameters, body))
+
+    return false
+  }
+
+  // eslint-disable-next-line max-params
+  private async check (identity: Identity | null, context: Context, parameters: Parameter[], body: unknown): Promise<unknown> {
+    if (body === undefined || body === null || body.constructor !== Object)
+      return body
+
+    const settled = await Promise.allSettled(this.statements.map(async (statement) =>
+      statement.check(identity, context, parameters, body as Body)))
+
+    for (const result of settled)
+      if (result.status === 'rejected')
+        throw result.reason
+
+    return body
+  }
+}
+
+class Statement {
+  private readonly properties: string[]
+  private readonly directives: Directive[] = []
+
+  public constructor ({ prop, ...directives }: Declaration, create: Create) {
+    this.properties = typeof prop === 'string' ? [prop] : prop
+
+    for (const [name, value] of Object.entries(directives)) {
+      const directive = create(name, value)
+
+      this.directives.push(directive)
+    }
+  }
+
+  // eslint-disable-next-line max-params
+  public async check (identity: Identity | null, context: Context, parameters: Parameter[], body: Body): Promise<void> {
+    const match = this.properties.some((property) => property in body)
+
+    if (!match)
+      return
+
+    for (const directive of this.directives) {
+      const authorized = await directive.authorize(identity, context, parameters)
+
+      if (!authorized)
+        throw new Forbidden('Input property is not authorized')
+    }
+  }
+}
+
+export interface Declaration {
+  [key: Exclude<string, 'prop'>]: unknown
+
+  prop: string | string[]
+}
+
+type Body = Record<string, unknown>