@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.282

package/source/directives/auth/Role.test.ts

@@ -1,17 +1,21 @@
+import { it, beforeEach, mock } from 'node:test'
+import assert from 'node:assert/strict'
+import { isDeepStrictEqual } from 'node:util'
+
 import { type Component } from '@toa.io/core'
 import { generate } from 'randomstring'
-import { Role } from './Role'
-import { type Identity } from './types'
-import type { Parameter } from '../../RTD'
+import { Role } from './Role.js'
+import { type Identity } from './types.js'
+import type { Parameter } from '../../RTD/index.js'
 
 const remote = {
-  invoke: jest.fn()
-} as unknown as jest.MockedObject<Component>
+  invoke: mock.fn()
+} as unknown as Component
 
 const discovery = Promise.resolve(remote)
 
 beforeEach(() => {
-  jest.clearAllMocks()
+  resetCalls()
 })
 
 it('should return false if not matched', async () => {
@@ -24,43 +28,42 @@ it('should return false if not matched', async () => {
     refresh: false
   }
 
-  remote.invoke.mockResolvedValueOnce(['guest'])
+  remote.invoke.mock.mockImplementationOnce(async () => ['guest'])
 
   const result = await directive.authorize(identity, undefined, [])
 
-  expect(result).toBe(false)
+  assert.strictEqual(result, false)
 
-  expect(remote.invoke)
-    .toBeCalledWith('list', {
+  assert.ok(remote.invoke.mock.calls.some((call: any) => call.arguments.length === 2 && isDeepStrictEqual(call.arguments[0], 'list') && isDeepStrictEqual(call.arguments[1], {
       query: {
-        criteria: `identity==${identity.id}`,
+        criteria: `identity=="${identity.id}"`,
         limit: 1024
       }
-    })
+    })))
 })
 
 it('should return true on exact match', async () => {
   const result = await match(['admin', 'user'], ['user'])
 
-  expect(result).toBe(true)
+  assert.strictEqual(result, true)
 })
 
 it('should return true on scope match', async () => {
   const result = await match(['system:identity:roles'], ['system'])
 
-  expect(result).toBe(true)
+  assert.strictEqual(result, true)
 })
 
 it('should return false on scope mismatch', async () => {
   const result = await match(['system:identity'], ['system:identity:roles'])
 
-  expect(result).toBe(false)
+  assert.strictEqual(result, false)
 })
 
 it('should return false on non-scope substring match', async () => {
   const result = await match(['system:identity'], ['system:iden'])
 
-  expect(result).toBe(false)
+  assert.strictEqual(result, false)
 })
 
 it('should return true on match with parameters', async () => {
@@ -70,7 +73,7 @@ it('should return true on match with parameters', async () => {
       value: '29e54ae1'
     }])
 
-  expect(result).toBe(true)
+  assert.strictEqual(result, true)
 })
 
 it('should return true on match with parameters', async () => {
@@ -80,7 +83,7 @@ it('should return true on match with parameters', async () => {
       value: '29e54ae1'
     }])
 
-  expect(result).toBe(true)
+  assert.strictEqual(result, true)
 })
 
 it('should return false on mismatch with parameters', async () => {
@@ -90,11 +93,10 @@ it('should return false on mismatch with parameters', async () => {
       value: '88584c9b'
     }])
 
-  expect(result).toBe(false)
+  assert.strictEqual(result, false)
 })
 
-async function match
-(expected: string[], actual: string[], parameters: Parameter[] = []): Promise<boolean> {
+async function match (expected: string[], actual: string[], parameters: Parameter[] = []): Promise<boolean> {
   const directive = new Role(expected, discovery)
 
   const identity: Identity = {
@@ -103,7 +105,17 @@ async function match
     refresh: false
   }
 
-  remote.invoke.mockResolvedValueOnce(actual)
+  remote.invoke.mock.mockImplementationOnce(async () => actual)
 
   return await directive.authorize(identity, undefined, parameters)
 }
+
+function resetCalls (target = [remote, discovery], seen = new Set()) {
+  if (target === null || typeof target !== 'object' || seen.has(target)) return
+
+  seen.add(target)
+
+  for (const value of Object.values(target))
+    if (typeof value === 'function' && value.mock !== undefined) value.mock.resetCalls()
+    else resetCalls(value, seen)
+}

package/source/directives/auth/Role.ts

@@ -1,7 +1,8 @@
 import assert from 'node:assert'
+import { quote } from '@toa.io/generic'
 import { type Component, type Query } from '@toa.io/core'
-import { type Directive, type Identity } from './types'
-import type { Parameter } from '../../RTD'
+import { type Directive, type Identity } from './types.js'
+import type { Parameter } from '../../RTD/index.js'
 
 export class Role implements Directive {
   public static remote: Component | null = null
@@ -15,29 +16,24 @@ export class Role implements Directive {
     this.dynamic = this.roles.some((role) => role.includes('{'))
   }
 
-  public static async set (identity: Identity, discovery: Promise<Component>): Promise<void> {
+  public static async get (identity: Identity, discovery: Promise<Component>): Promise<string[]> {
     this.remote ??= await discovery
 
     const query: Query = {
-      criteria: `identity==${identity.id}`,
+      criteria: `identity==${quote(identity.id)}`,
       limit: 1024
     }
 
-    identity.roles = await this.remote.invoke('list', { query })
+    return await this.remote.invoke('list', { query })
   }
 
-  public async authorize
-  (identity: Identity | null, _: unknown, parameters: Parameter[]): Promise<boolean> {
+  public async authorize (identity: Identity | null, _: unknown, parameters: Parameter[]): Promise<boolean> {
     if (identity === null)
       return false
 
-    await Role.set(identity, this.discovery)
+    identity.roles ??= await Role.get(identity, this.discovery)
 
-    if (identity.roles!.length === 0) // Role.set()
-
-      return false
-
-    return this.match(identity.roles!, parameters)
+    return this.match(identity.roles, parameters)
   }
 
   private match (roles: string[], parameters: Parameter[]): boolean {
@@ -58,7 +54,7 @@ export class Role implements Directive {
       const value = parameters.find((parameter) => parameter.name === key)?.value
 
       assert.ok(value !== undefined,
-        `Role '${role}' requires '${key}' route parameter.`)
+        `Role '${role}' requires '${key}' route parameter`)
 
       return value
     }))

package/source/directives/auth/Rule.ts

@@ -1,5 +1,5 @@
-import { type Parameter } from '../../RTD'
-import type { Input, Directive, Identity } from './types'
+import { type Parameter } from '../../RTD/index.js'
+import type { Context, Directive, Identity, Create } from './types.js'
 
 export class Rule implements Directive {
   private readonly directives: Directive[] = []
@@ -12,10 +12,9 @@ export class Rule implements Directive {
     }
   }
 
-  public async authorize
-  (identity: Identity | null, input: Input, parameters: Parameter[]): Promise<boolean> {
+  public async authorize (identity: Identity | null, context: Context, parameters: Parameter[]): Promise<boolean> {
     for (const directive of this.directives) {
-      const authorized = await directive.authorize(identity, input, parameters)
+      const authorized = await directive.authorize(identity, context, parameters)
 
       if (!authorized)
         return false
@@ -24,5 +23,3 @@ export class Rule implements Directive {
     return true
   }
 }
-
-type Create = (name: string, value: any, ...args: any[]) => Directive

package/source/directives/auth/Scheme.ts

@@ -1,6 +1,6 @@
-import * as http from '../../HTTP'
-import { type Directive, type Identity, type Input } from './types'
-import { split } from './split'
+import * as http from '../../HTTP/index.js'
+import { type Directive, type Identity, type Context } from './types.js'
+import { split } from './split.js'
 
 export class Scheme implements Directive {
   private readonly scheme: string
@@ -11,15 +11,15 @@ export class Scheme implements Directive {
     this.Scheme = scheme[0].toUpperCase() + scheme.substring(1)
   }
 
-  public authorize (_: Identity | null, input: Input): boolean {
-    if (input.request.headers.authorization === undefined)
+  public authorize (_: Identity | null, context: Context): boolean {
+    if (context.request.headers.authorization === undefined)
       return false
 
-    const [scheme] = split(input.request.headers.authorization)
+    const [scheme] = split(context.request.headers.authorization)
 
     if (scheme !== this.scheme)
       throw new http.Forbidden(this.Scheme +
-        ' authentication scheme is required to access this resource.')
+        ' authentication scheme is required to access this resource')
 
     return false
   }

package/source/directives/auth/create.ts

@@ -0,0 +1,11 @@
+import { newid } from '@toa.io/generic'
+import type { Identity } from './types.js'
+
+export function create (credentials?: string): Identity {
+  return {
+    id: newid(),
+    scheme: credentials?.split(' ')[0] ?? null,
+    refresh: false,
+    roles: []
+  }
+}

package/source/directives/auth/index.ts

@@ -1,3 +1,3 @@
-import { Authorization } from './Authorization'
+import { Authorization } from './Authorization.js'
 
 export const authorization = new Authorization()

package/source/directives/auth/schemes.test.ts

@@ -0,0 +1,14 @@
+import { it } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { provider } from './schemes.js'
+
+it('should resolve a known scheme', () => {
+  assert.equal(provider('basic'), 'basic')
+  assert.equal(provider('bearer'), 'federation')
+})
+
+it('should not resolve a property of Object.prototype', () => {
+  for (const name of ['constructor', '__proto__', 'toString', 'hasOwnProperty'])
+    assert.equal(provider(name), undefined)
+})

package/source/directives/auth/schemes.ts

@@ -1,9 +1,26 @@
-import { type Remote, type Scheme } from './types'
+import type { Remote, Scheme } from './types.js'
 
 export const PROVIDERS: Record<Scheme, Remote> = {
   basic: 'basic',
   token: 'tokens',
-  bearer: 'federation'
+  bearer: 'federation',
+  code: 'federation',
+  otp: 'otp'
 }
 
+export const INCEPTION: Remote[] = ['basic', 'federation']
 export const PRIMARY: Scheme = 'token'
+
+/**
+ * The provider of a scheme, or nothing for a scheme that is not one — including a name a
+ * plain object answers on its own, like `constructor`.
+ */
+export function provider (scheme: string): Remote | undefined {
+  return Object.hasOwn(PROVIDERS, scheme) ? PROVIDERS[scheme as Scheme] : undefined
+}
+
+/**
+ * The rejection of credentials that are verifiable and owned by no identity: the one
+ * inception goes ahead with.
+ */
+export const UNKNOWN = 'NOT_FOUND'

package/source/directives/auth/split.ts

@@ -1,11 +1,11 @@
-import * as http from '../../HTTP'
-import { type Scheme } from './types'
+import * as http from '../../HTTP/index.js'
+import { type Scheme } from './types.js'
 
 export function split (authorization: string): [Scheme, string] {
   const space = authorization.indexOf(' ')
 
   if (space === -1)
-    throw new http.Unauthorized('Malformed authorization header.')
+    throw new http.Unauthorized('Malformed authorization header')
 
   const Scheme = authorization.slice(0, space)
   const scheme = Scheme.toLowerCase() as Scheme

package/source/directives/auth/types.ts

@@ -1,40 +1,48 @@
 import { type Component } from '@toa.io/core'
 import { type Maybe } from '@toa.io/types'
-import { type Parameter } from '../../RTD'
-import type * as http from '../../HTTP'
-import type * as io from '../../io'
+import { type Parameter } from '../../RTD/index.js'
+import type * as http from '../../HTTP/index.js'
+import type * as io from '../../io.js'
 
 export interface Directive {
+  priority?: number
+
   authorize: (
     identity: Identity | null,
-    input: Input,
+    context: Context,
     parameters: Parameter[]
   ) => boolean | Promise<boolean>
 
-  reply?: (identity: Identity | null) => http.OutgoingMessage
+  reply?: (context: Context) => http.OutgoingMessage | null
 
-  settle?: (request: Input, response: http.OutgoingMessage) => Promise<void>
+  settle?: (context: Context, response: http.OutgoingMessage) => Promise<void>
 }
 
 export interface Identity {
   readonly id: string
-  scheme: string
   roles?: string[]
+  permissions?: Record<string, string[]>
+  scheme: string | null // null for transient identities
   refresh: boolean
 }
 
 export interface Extension {
   identity: Identity | null
+
+  /** the error code the presented credentials were rejected with, when they were */
+  rejection?: string
 }
 
 export interface Ban {
   banned: boolean
 }
 
-export type Input = io.Input & Extension
+export type Context = io.Input & Extension
 export type AuthenticationResult = Maybe<{ identity: Identity, refresh: boolean }>
 
-export type Scheme = 'basic' | 'token' | 'bearer'
-export type Remote = 'basic' | 'federation' | 'tokens' | 'roles' | 'bans'
+export type Scheme = 'basic' | 'token' | 'bearer' | 'code' | 'otp'
+export type Remote = 'basic' | 'federation' | 'tokens' | 'roles' | 'bans' | 'otp'
 export type Discovery = Record<Remote, Promise<Component>>
 export type Schemes = Record<Scheme, Component>
+
+export type Create = (name: string, value: any, ...args: any[]) => Directive

package/source/directives/cache/Cache.ts

@@ -1,19 +1,19 @@
-import { Control } from './Control'
-import { Exact } from './Exact'
-import type { Input, Output } from '../../io'
-import type { Directive } from './types'
-import type { DirectiveFamily } from '../../RTD'
-import type * as http from '../../HTTP'
+import { Control } from './Control.js'
+import { Exact } from './Exact.js'
+import type { Output } from '../../io.js'
+import type { AuthenticatedContext, Directive } from './types.js'
+import type { DirectiveFamily } from '../../RTD/index.js'
+import type * as http from '../../HTTP/index.js'
 
 export class Cache implements DirectiveFamily<Directive> {
   public readonly name: string = 'cache'
-  public readonly mandatory: boolean = false
+  public readonly mandatory: boolean = true
 
   public create (name: string, value: any): Directive {
     const Class = constructors[name]
 
     if (Class === undefined)
-      throw new Error(`Directive 'cache:${name}' is not implemented.`)
+      throw new Error(`Directive 'cache:${name}' is not implemented`)
 
     return new Class(value)
   }
@@ -22,10 +22,23 @@ export class Cache implements DirectiveFamily<Directive> {
     return null
   }
 
-  public async settle
-  (directives: Directive[], input: Input, response: http.OutgoingMessage): Promise<void> {
+  public async settle (directives: Directive[], context: AuthenticatedContext, response: http.OutgoingMessage): Promise<void> {
+    const method = context.request.method
+
+    if (method !== 'GET' && method !== 'HEAD')
+      return
+
+    const directive = directives[0]
+
     response.headers ??= new Headers()
-    directives[0]?.set(input, response.headers)
+
+    if (directive === undefined) {
+      if (context.identity !== null && !Control.disabled(response.headers)) {
+        response.headers.set('cache-control', 'private')
+        response.headers.append('vary', 'authorization')
+      }
+    } else
+      directive.set(context, response.headers)
   }
 }
 

package/source/directives/cache/Control.ts

@@ -1,27 +1,38 @@
 import { match } from 'matchacho'
-import type { AuthenticatedContext, Directive } from './types'
+import type { AuthenticatedContext, Directive } from './types.js'
 
 export class Control implements Directive {
   protected readonly value: string
-  private cache: string | null = null
+  private control: string | null = null
   private vary: boolean = false
 
   public constructor (value: string) {
     this.value = value
   }
 
+  public static disabled (headers: Headers): boolean {
+    const value = headers.get('cache-control')
+
+    if (value === null)
+      return false
+
+    const directives = mask(value)
+
+    return (directives & NO_STORE) === NO_STORE
+  }
+
   public set (context: AuthenticatedContext, headers: Headers): void {
     if (!['GET', 'HEAD', 'OPTIONS'].includes(context.request.method))
       return
 
-    this.cache ??= this.resolve(context)
+    this.control ??= this.resolve(context)
 
-    if (this.disabled(headers))
+    if (Control.disabled(headers))
       return
 
-    headers.append('cache-control', this.cache)
+    headers.set('cache-control', this.control)
 
-    if (this.vary !== null)
+    if (this.vary)
       headers.append('vary', 'authorization')
   }
 
@@ -45,17 +56,6 @@ export class Control implements Directive {
 
     return this.value
   }
-
-  private disabled (headers: Headers): boolean {
-    const value = headers.get('cache-control')
-
-    if (value === null)
-      return false
-
-    const directives = mask(value)
-
-    return (directives & NO_STORE) === NO_STORE
-  }
 }
 
 function mask (value: string): number {

package/source/directives/cache/Exact.ts

@@ -1,4 +1,4 @@
-import { Control } from './Control'
+import { Control } from './Control.js'
 
 export class Exact extends Control {
   protected override resolve (): string {

package/source/directives/cache/index.ts

@@ -1,3 +1,3 @@
-import { Cache } from './Cache'
+import { Cache } from './Cache.js'
 
 export const cache = new Cache()

package/source/directives/cache/types.ts

@@ -1,4 +1,4 @@
-import type { Input } from '../../io'
+import type { Input } from '../../io.js'
 
 export interface Directive {
   set: (input: Input, headers: Headers) => void

package/source/directives/cors/CORS.ts

@@ -1,22 +1,24 @@
-import type { Input, Output } from '../../io'
-import type { Interceptor } from '../../Interception'
+import type { Input, Output } from '../../io.js'
+import type { Interceptor } from '../../Interception.js'
+
+/** What is allowed before any directive asks for more. */
+const REQUEST_HEADERS = [
+  'accept',
+  'authorization',
+  'content-type',
+  'if-match',
+  'if-none-match'
+]
 
 export class CORS implements Interceptor {
   public readonly name = 'cors'
 
-  private readonly requestHeaders = new Set<string>([
-    'accept',
-    'authorization',
-    'content-type',
-    'etag',
-    'if-match',
-    'if-none-match'
-  ])
+  private requestHeaders = new Set<string>(REQUEST_HEADERS)
 
   private readonly headers = new Headers({
-    'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE',
+    'access-control-allow-methods': 'GET, POST, PUT, PATCH, DELETE, LOCK, UNLOCK',
     'access-control-allow-credentials': 'true',
-    'access-control-allow-headers': Array.from(this.requestHeaders).join(', '),
+    'access-control-allow-headers': this.allowedHeaders(),
     'access-control-max-age': '3600',
     'cache-control': 'max-age=3600',
     vary: 'origin'
@@ -25,17 +27,18 @@ export class CORS implements Interceptor {
   public intercept (input: Input): Output {
     const origin = input.request.headers.origin
 
-    if (origin === undefined)
-      return null
-
-    if (input.request.method === 'OPTIONS')
+    if (origin !== undefined && input.request.method === 'OPTIONS')
       return this.preflightResponse(origin)
 
     input.pipelines.response.push((output) => {
       output.headers ??= new Headers()
-      output.headers.set('access-control-allow-origin', origin)
-      output.headers.set('access-control-expose-headers',
-        'authorization, content-type, content-length, etag')
+
+      if (origin !== undefined) {
+        output.headers.set('access-control-allow-origin', origin)
+        output.headers.set('access-control-allow-credentials', 'true')
+        output.headers.set('access-control-expose-headers',
+          'authorization, content-type, content-length, date, etag, last-modified')
+      }
 
       const method = input.request.method
 
@@ -46,9 +49,23 @@ export class CORS implements Interceptor {
     return null
   }
 
+  public reset (): void {
+    this.requestHeaders = new Set(REQUEST_HEADERS)
+    this.headers.set('access-control-allow-headers', this.allowedHeaders())
+  }
+
   public allow (header: string): void {
     this.requestHeaders.add(header.toLowerCase())
-    this.headers.set('access-control-allow-headers', Array.from(this.requestHeaders).join(', '))
+    this.headers.set('access-control-allow-headers', this.allowedHeaders())
+  }
+
+  /**
+   * Sorted, because the set is filled as branches merge and their order is not
+   * fixed — an unsorted value would differ between otherwise identical processes,
+   * and between one restart and the next.
+   */
+  private allowedHeaders (): string {
+    return Array.from(this.requestHeaders).sort().join(', ')
   }
 
   private preflightResponse (origin: string): Output {

package/source/directives/cors/index.ts

@@ -1,3 +1,3 @@
-import { CORS } from './CORS'
+import { CORS } from './CORS.js'
 
 export const cors = new CORS()

package/source/directives/dev/Development.ts

@@ -1,8 +1,10 @@
-import { Stub } from './Stub'
-import { Throw } from './Throw'
-import { type Directive } from './types'
-import type { Input, Output } from '../../io'
-import type { DirectiveFamily } from '../../RTD'
+import { Stub } from './Stub.js'
+import { Throw } from './Throw.js'
+import { Sleep } from './Sleep.js'
+import { Faulty } from './Faulty.js'
+import { type Directive } from './types.js'
+import type { Input, Output } from '../../io.js'
+import type { DirectiveFamily } from '../../RTD/index.js'
 
 export class Development implements DirectiveFamily<Directive> {
   public readonly name: string = 'dev'
@@ -12,24 +14,29 @@ export class Development implements DirectiveFamily<Directive> {
     const Class = constructors[name]
 
     if (Class === undefined)
-      throw new Error(`Directive 'dev:${name}' is not implemented.`)
+      throw new Error(`Directive 'dev:${name}' is not implemented`)
 
     return new Class(value)
   }
 
-  public preflight (directives: Directive[], input: Input): Output {
+  public async preflight (directives: Directive[], input: Input): Promise<Output> {
+    let output = null
+
     for (const directive of directives) {
-      const output = directive.apply(input)
+      const out = await directive.apply(input)
 
-      if (output !== null)
-        return output
+      if (out !== null)
+        if (output !== null) throw new Error('`dev` directives ambiguous output')
+        else output = out
     }
 
-    return null
+    return output
   }
 }
 
 const constructors: Record<string, new (value: any) => Directive> = {
   stub: Stub,
-  throw: Throw
+  throw: Throw,
+  sleep: Sleep,
+  faulty: Faulty
 }