@toa.io/extensions.exposition 1.0.0-alpha.28 → 1.0.0-alpha.283

package/source/directives/map/Headers.ts

@@ -0,0 +1,45 @@
+import assert from 'node:assert'
+import { cors } from '../cors/index.js'
+import { Mapping } from './Mapping.js'
+import type { Input } from '../../io.js'
+
+/**
+ * Forbidden request header names: the browser sets them itself and a script cannot
+ * list them in `Access-Control-Request-Headers`, so there is nothing to advertise
+ * or vary on. The value is still read, it just never reaches CORS.
+ */
+const FORBIDDEN = new Set(['host', 'origin'])
+
+export class Headers extends Mapping<Record<string, string>> {
+  private readonly headers: string[]
+
+  public constructor (map: Record<string, string>) {
+    assert.ok(map.constructor === Object, '`map:headers` must be an object')
+
+    assert.ok(Object.values(map).every((value) => typeof value === 'string'),
+      '`map:headers` must be an object with string values')
+
+    super(map)
+
+    this.headers = Object.values(map).filter((header) => !FORBIDDEN.has(header))
+    this.headers.forEach((header) => cors.allow(header))
+  }
+
+  public properties (context: Input): Record<string, string> {
+    context.pipelines.response.push((response) => {
+      response.headers ??= new global.Headers()
+
+      for (const header of this.headers)
+        response.headers.append('vary', header)
+    })
+
+    return Object.entries(this.value).reduce((properties: Record<string, string>, [property, header]) => {
+      const value = context.request.headers[header]
+
+      if (value !== undefined)
+        properties[property] = Array.isArray(value) ? value.join(', ') : value
+
+      return properties
+    }, {})
+  }
+}

package/source/directives/map/Language.ts

@@ -0,0 +1,42 @@
+import assert from 'node:assert'
+import Negotiator from 'negotiator'
+import { cors } from '../cors/index.js'
+import { Mapping } from './Mapping.js'
+import { Languages } from './Languages.js'
+import type { Input } from '../../io.js'
+import type { Parameter } from '../../RTD/index.js'
+import type { Directive } from './Directive.js'
+
+export class Language extends Mapping<string> {
+  private languages: string[] | null = null
+
+  public constructor (property: string) {
+    assert.ok(typeof property === 'string', '`map:language` must be a string')
+
+    cors.allow('accept-language')
+    super(property)
+  }
+
+  public properties (context: Input, parameters: Parameter[], directives: Directive[]): Record<string, string> {
+    this.languages ??= this.resolve(directives)
+
+    const negotiator = new Negotiator(context.request)
+    const language = negotiator.language(this.languages) ?? this.languages[0]
+
+    context.pipelines.response.push((response) => {
+      response.headers ??= new Headers()
+      response.headers.set('content-language', language)
+      response.headers.append('vary', 'accept-language')
+    })
+
+    return { [this.value]: language }
+  }
+
+  private resolve (directives: Directive[]): string[] {
+    for (const directive of directives)
+      if (directive instanceof Languages)
+        return directive.value
+
+    throw new Error('Supported languages are not defined, add `map:languages` directive')
+  }
+}

package/source/directives/map/Languages.ts

@@ -0,0 +1,11 @@
+import assert from 'node:assert'
+import { Property } from './Properties.js'
+
+export class Languages extends Property<'languages'> {
+  public constructor (value: string[]) {
+    assert.ok(Array.isArray(value) && value.length > 0, '`map:languages` must be a non-empty array of strings')
+    assert.ok(value.every((language) => typeof language === 'string'), '`map:languages` must be an array of strings')
+
+    super('languages', value)
+  }
+}

package/source/directives/map/Map.ts

@@ -0,0 +1,63 @@
+import { match } from 'matchacho'
+import { properties, Property } from './Properties.js'
+import { Mapping } from './Mapping.js'
+import { Headers } from './Headers.js'
+import { Languages } from './Languages.js'
+import { Language } from './Language.js'
+import { Segments } from './Segments.js'
+import { Authority } from './Authority.js'
+import { BufferMapping } from './Buffer.js'
+import { Claims } from './Claims.js'
+import type { Directive } from './Directive.js'
+import type { Properties } from './Properties.js'
+import type { DirectiveFamily, Parameter } from '../../RTD/index.js'
+import type { Input, Output } from '../../io.js'
+import type { Remotes } from '../../Remotes.js'
+
+export class Map implements DirectiveFamily {
+  public readonly name = 'map'
+  public readonly mandatory = false
+
+  private remotes!: Remotes
+
+  public create (name: string, value: unknown, remotes: Remotes): Property | Mapping {
+    this.remotes = remotes
+
+    return match(name,
+      () => properties.has(name), (name: PN) => new Property(name, value as PV),
+      () => name in mappings, (name: keyof typeof mappings) => new mappings[name](value, remotes),
+      () => {
+        throw new Error(`Directive 'map:${name}' is not implemented`)
+      })
+  }
+
+  public async preflight (directives: Directive[], context: Input, parameters: Parameter[]): Promise<Output> {
+    const properties = {}
+
+    for (const directive of directives)
+      if (directive instanceof Mapping)
+        Object.assign(properties, await directive.properties(context, parameters, directives))
+
+    context.pipelines.body.push((body: unknown) => {
+      if (body === undefined || body === null || typeof body !== 'object')
+        return properties
+      else
+        return Object.assign(body, properties)
+    })
+
+    return null
+  }
+}
+
+type PN = keyof Properties
+type PV = Properties[PN]
+
+const mappings: Record<string, new (value: any, remotes: Remotes) => Directive> = {
+  authority: Authority,
+  buffer: BufferMapping,
+  headers: Headers,
+  languages: Languages,
+  language: Language,
+  segments: Segments,
+  claims: Claims
+}

package/source/directives/map/Mapping.ts

@@ -0,0 +1,19 @@
+import type { Remotes } from '../../Remotes.js'
+import type { Directive } from './Directive.js'
+import type { Input } from '../../io.js'
+import type { Parameter } from '../../RTD/index.js'
+
+export abstract class Mapping<T = unknown> {
+  protected value: T
+  protected remotes?: Remotes
+
+  protected constructor (value: T, remotes?: Remotes) {
+    this.value = value
+    this.remotes = remotes
+  }
+
+  public abstract properties (context: Input, parameters: Parameter[], directives: Directive[]): Output
+}
+
+type Properties = Record<string, unknown> | null
+type Output = Properties | Promise<Properties>

package/source/directives/{vary → map}/Properties.ts

@@ -1,5 +1,5 @@
 export interface Properties {
-  languages?: string[]
+  languages: string[]
 }
 
 export class Property<K extends keyof Properties = keyof Properties> {
@@ -12,6 +12,4 @@ export class Property<K extends keyof Properties = keyof Properties> {
   }
 }
 
-export const properties: Properties = {
-  languages: []
-}
+export const properties = new Set('languages')

package/source/directives/map/Segments.ts

@@ -0,0 +1,33 @@
+import assert from 'node:assert'
+import { Mapping } from './Mapping.js'
+import type { Parameter } from '../../RTD/index.js'
+
+export class Segments extends Mapping<Record<string, string>> {
+  public constructor (map: Record<string, string>) {
+    assert.ok(map.constructor === Object, '`map:segments` must be an object')
+
+    assert.ok(Object.values(map).every((value) => typeof value === 'string'),
+      '`map:segments ` must be an object with string values')
+
+    super(map)
+  }
+
+  public override properties (_: unknown, parameters: Parameter[]): Record<string, string> {
+    return Object.entries(this.value).reduce((properties: Record<string, string>, [property, parameter]) => {
+      const cut = parameter[0] === '~'
+
+      if (cut) parameter = parameter.slice(1)
+
+      const index = parameters.findIndex(({ name }) => name === parameter)
+
+      assert.ok(index > -1, `Route parameter '${parameter}' is missing`)
+
+      properties[property] = parameters[index].value
+
+      if (cut)
+        parameters.splice(index, 1)
+
+      return properties
+    }, {})
+  }
+}

package/source/directives/map/index.ts

@@ -0,0 +1,3 @@
+import { Map } from './Map.js'
+
+export const map = new Map()

package/source/directives/oauth/Discovery.ts

@@ -0,0 +1,76 @@
+import { documents, type Documents } from './documents.js'
+import type * as http from '../../HTTP/index.js'
+import type { Input, Output } from '../../io.js'
+import type { Interceptor } from '../../Interception.js'
+
+/**
+ * What a client reads before it can authenticate: where the authorization server is, and
+ * what this resource expects. Both are fixed paths a specification names, both must be
+ * answered to anyone, and both are a function of the annotation alone — nothing is read to
+ * build them, so they are built once per authority and served as they are.
+ *
+ * An interceptor rather than a route because `auth` runs before any directive: a client
+ * re-reading discovery while holding a stale token would have it verified, and then be
+ * refused a document that has to be public.
+ */
+export class Discovery implements Interceptor {
+  /**
+   * A map, because the key is the request's authority and an unconfigured host is passed
+   * through as itself: `Host: constructor` names something a plain object answers on its own.
+   */
+  private readonly authorities = new Map<string, Documents>()
+
+  public mount (options: http.Options): void {
+    this.authorities.clear()
+
+    if (options.oauth === undefined)
+      return
+
+    for (const [authority, host] of Object.entries(options.authorities))
+      this.authorities.set(authority, documents(origin(host), options.oauth))
+  }
+
+  public reset (): void {
+    this.authorities.clear()
+  }
+
+  public intercept (input: Input): Output {
+    const known = this.authorities.get(input.authority)
+
+    if (known === undefined)
+      return null
+
+    // every reply, not just a document's: the challenge is what points a client here
+    input.pipelines.response.push((response) => {
+      if (response.status !== UNAUTHORIZED)
+        return
+
+      response.headers ??= new Headers()
+      response.headers.set('www-authenticate', known.challenge(input.url.pathname))
+    })
+
+    const body = known.read(input.url.pathname)
+
+    if (body === undefined)
+      return null
+
+    return { body, headers: new Headers({ 'cache-control': 'public, max-age=3600' }) }
+  }
+}
+
+/**
+ * The absolute URL an authority is reached at. Loopback is served over http and everything
+ * else over https: the gateway may sit behind a terminating proxy, so the connection does
+ * not say which, and the configured host does. Taken from the configuration rather than
+ * from the request's `host`, which is the client's to write.
+ */
+function origin (host: string): string {
+  const name = host.split(':')[0]
+
+  const loopback = name === 'localhost' || name === '127.0.0.1' || name === '[::1]' ||
+    name.endsWith('.localhost')
+
+  return `${loopback ? 'http' : 'https'}://${host}`
+}
+
+const UNAUTHORIZED = 401

package/source/directives/oauth/documents.ts

@@ -0,0 +1,113 @@
+import type { OAuth } from '../../Annotation.js'
+
+/** The discovery documents of one authority, and the challenge that points at them. */
+export interface Documents {
+  /** The document a path names, or nothing when it names none. */
+  read: (pathname: string) => object | undefined
+
+  /** `WWW-Authenticate` for a request to this path, which names the resource it failed at. */
+  challenge: (pathname: string) => string
+}
+
+export function documents (issuer: string, oauth: OAuth): Documents {
+  const server = authorizationServer(issuer, oauth)
+  const resources = protectedResources(issuer, oauth)
+  const scope = oauth.scopes === undefined ? '' : `, scope="${oauth.scopes.join(' ')}"`
+
+  function read (pathname: string): object | undefined {
+    if (pathname === AUTHORIZATION_SERVER || pathname === OPENID_CONFIGURATION)
+      return server
+
+    if (pathname.startsWith(PROTECTED_RESOURCE))
+      return resources.get(pathname.slice(PROTECTED_RESOURCE.length))
+
+    return undefined
+  }
+
+  function challenge (pathname: string): string {
+    return `Bearer resource_metadata="${issuer}${PROTECTED_RESOURCE}${suffix(oauth, pathname)}"${scope}`
+  }
+
+  return { read, challenge }
+}
+
+/**
+ * RFC 8414. `authorization_endpoint` is the application's own page and may be anywhere;
+ * everything else this extension serves. Both flags are load-bearing for a client that
+ * prefers Client ID Metadata Documents: without either it falls back to registration.
+ */
+function authorizationServer (issuer: string, oauth: OAuth): object {
+  const metadata: Record<string, unknown> = {
+    issuer,
+    authorization_endpoint: oauth.authorize,
+    token_endpoint: `${issuer}${TOKEN}`,
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code'],
+    code_challenge_methods_supported: ['S256'],
+    token_endpoint_auth_methods_supported: ['none'],
+    client_id_metadata_document_supported: true,
+    authorization_response_iss_parameter_supported: true
+  }
+
+  if (oauth.registration === 'open')
+    metadata.registration_endpoint = `${issuer}${REGISTRATION}`
+
+  if (oauth.scopes !== undefined)
+    metadata.scopes_supported = oauth.scopes
+
+  return metadata
+}
+
+/**
+ * RFC 9728, keyed by the path the well-known segment is followed by: a client resolving
+ * `https://host/mcp` reads `/.well-known/oauth-protected-resource/mcp`, and one that names
+ * no path reads the document at the origin.
+ */
+function protectedResources (issuer: string, oauth: OAuth): Map<string, object> {
+  const map = new Map<string, object>()
+
+  for (const path of oauth.resources ?? [])
+    map.set(canonical(path), resource(issuer, canonical(path), oauth))
+
+  map.set('', resource(issuer, '', oauth))
+
+  return map
+}
+
+function resource (issuer: string, path: string, oauth: OAuth): object {
+  const metadata: Record<string, unknown> = {
+    resource: issuer + path,
+    authorization_servers: [issuer],
+    bearer_methods_supported: ['header']
+  }
+
+  if (oauth.scopes !== undefined)
+    metadata.scopes_supported = oauth.scopes
+
+  return metadata
+}
+
+/** The document a request to this path was refused against: the longest resource holding it. */
+function suffix (oauth: OAuth, pathname: string): string {
+  let longest = ''
+
+  for (const path of oauth.resources ?? [])
+    if (pathname.startsWith(path) && path.length > longest.length)
+      longest = path
+
+  return canonical(longest)
+}
+
+/**
+ * A resource is identified without its trailing slash — the form MCP asks for — while a
+ * route is declared with one, so `/mcp/` identifies `…/mcp`.
+ */
+function canonical (path: string): string {
+  return path.endsWith('/') ? path.slice(0, -1) : path
+}
+
+const AUTHORIZATION_SERVER = '/.well-known/oauth-authorization-server'
+const PROTECTED_RESOURCE = '/.well-known/oauth-protected-resource'
+const OPENID_CONFIGURATION = '/.well-known/openid-configuration'
+const TOKEN = '/identity/grants/'
+const REGISTRATION = '/identity/clients/'

package/source/directives/oauth/index.ts

@@ -0,0 +1,3 @@
+import { Discovery } from './Discovery.js'
+
+export const discovery = new Discovery()

package/source/directives/octets/Context.ts

@@ -1,6 +1,6 @@
-import * as schemas from './schemas'
-import { Directive } from './Directive'
-import type { Output } from '../../io'
+import assert from 'node:assert'
+import { Directive } from './Directive.js'
+import type { Output } from '../../io.js'
 
 export class Context extends Directive {
   public readonly targeted = false
@@ -8,7 +8,8 @@ export class Context extends Directive {
 
   public constructor (value: unknown) {
     super()
-    schemas.context.validate(value)
+
+    assert.ok(typeof value === 'string', 'Directive \'octets:context\' must must be a string')
 
     this.storage = value
   }

package/source/directives/octets/Delete.ts

@@ -1,15 +1,15 @@
 import { Readable } from 'stream'
-import { NotFound } from '../../HTTP'
-import * as schemas from './schemas'
-import { Workflow } from './workflows'
-import { Directive } from './Directive'
-import type { Parameter } from '../../RTD'
-import type { Unit } from './workflows'
-import type { Maybe } from '@toa.io/types'
+import { NotFound } from '../../HTTP/index.js'
+import * as schemas from './schemas.js'
+import { Workflow } from './workflows/index.js'
+import { Directive } from './Directive.js'
+import type { Parameter } from '../../RTD/index.js'
+import type { Unit, Location } from './workflows/index.js'
+import type { Maybe } from '@toa.io/core'
 import type { Component } from '@toa.io/core'
-import type { Output } from '../../io'
-import type { Input } from './types'
-import type { Remotes } from '../../Remotes'
+import type { Output } from '../../io.js'
+import type { Input } from './types.js'
+import type { Remotes } from '../../Remotes.js'
 import type { Entry } from '@toa.io/extensions.storages'
 
 export class Delete extends Directive {
@@ -17,7 +17,7 @@ export class Delete extends Directive {
 
   private readonly workflow?: Workflow
   private readonly discovery: Promise<Component>
-  private storage: Component | null = null
+  private storage!: Component
 
   public constructor (options: Options | null, discovery: Promise<Component>, remotes: Remotes) {
     super()
@@ -32,20 +32,20 @@ export class Delete extends Directive {
   public async apply (storage: string, input: Input, parameters: Parameter[]): Promise<Output> {
     this.storage ??= await this.discovery
 
-    const entry = await this.storage.invoke<Maybe<Entry>>('get',
-      {
-        input: {
-          storage,
-          path: input.request.url
-        }
-      })
-
-    if (entry instanceof Error)
-      throw new NotFound()
-
     const output: Output = {}
 
     if (this.workflow !== undefined) {
+      const entry = await this.storage.invoke<Maybe<Entry>>('head',
+        {
+          input: {
+            storage,
+            path: input.request.url
+          }
+        })
+
+      if (entry instanceof Error)
+        throw new NotFound()
+
       output.status = 202
       output.body = Readable.from(this.execute(input, storage, entry, parameters))
     } else
@@ -55,8 +55,7 @@ export class Delete extends Directive {
   }
 
   private async delete (storage: string, input: Input): Promise<void> {
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-    await this.storage!.invoke('delete',
+    await this.storage.invoke('delete',
       {
         input: {
           storage,
@@ -66,10 +65,14 @@ export class Delete extends Directive {
   }
 
   // eslint-disable-next-line max-params
-  private async * execute
-  (input: Input, storage: string, entry: Entry, parameters: Parameter[]): AsyncGenerator {
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-    for await (const chunk of this.workflow!.execute(input, storage, entry, parameters)) {
+  private async * execute (input: Input, storage: string, entry: Entry, parameters: Parameter[]): AsyncGenerator {
+    const location: Location = {
+      storage,
+      authority: input.authority,
+      path: input.request.url
+    }
+
+    for await (const chunk of this.workflow!.execute(location, entry, parameters)) {
       yield chunk
 
       if (typeof chunk === 'object' && chunk !== null && 'error' in chunk)

package/source/directives/octets/Directive.ts

@@ -1,6 +1,6 @@
-import type { Input } from './types'
-import type { Parameter } from '../../RTD'
-import type * as io from '../../io'
+import type { Input } from './types.js'
+import type { Parameter } from '../../RTD/index.js'
+import type * as io from '../../io.js'
 
 export abstract class Directive {
   public readonly name = 'octets.' + this.constructor.name.toLowerCase()

package/source/directives/octets/Get.ts

@@ -0,0 +1,96 @@
+import { Forbidden, NotFound } from '../../HTTP/index.js'
+import * as schemas from './schemas.js'
+import { Directive } from './Directive.js'
+import type { Maybe } from '@toa.io/core'
+import type { Entry, Stream } from '@toa.io/extensions.storages'
+import type { Component } from '@toa.io/core'
+import type { Output } from '../../io.js'
+import type { Input } from './types.js'
+
+export class Get extends Directive {
+  public readonly targeted = true
+
+  private readonly options: Required<Options> = {
+    meta: false
+  }
+
+  private readonly discovery: Promise<Component>
+  private storage!: Component
+
+  public constructor (options: Options | null, discovery: Promise<Component>) {
+    super()
+
+    schemas.get.validate(options)
+    Object.assign(this.options, options)
+
+    this.discovery = discovery
+  }
+
+  public async apply (storage: string, input: Input): Promise<Output> {
+    this.storage ??= await this.discovery
+
+    if (input.subtype === 'octets.entry')
+      if (this.options.meta)
+        return this.head(storage, input)
+      else
+        throw new Forbidden('Metadata is not accessible')
+    else
+      return await this.get(storage, input)
+  }
+
+  private async get (storage: string, input: Input): Promise<Output> {
+    if ('if-none-match' in input.request.headers)
+      return { status: 304 }
+
+    const endpoint = input.request.method === 'GET' ? 'get' : 'head'
+
+    const entry = await this.storage.invoke<Maybe<Stream>>(endpoint, {
+      input: {
+        storage,
+        path: input.request.url,
+        range: input.request.headers.range,
+        agent: input.request.headers['user-agent']
+      }
+    })
+
+    if (entry instanceof Error)
+      throw new NotFound()
+
+    const headers = new Headers({
+      'content-type': entry.type,
+      etag: `"${entry.checksum}"`
+    })
+
+    if (entry.range !== undefined)
+      headers.set('content-range', entry.range)
+
+    // an absent content-length is what says the length is unknown; naming the encoding
+    // is redundant over HTTP/1.1 and forbidden over HTTP/2
+    if (entry.size !== null)
+      headers.set('content-length', entry.size.toString())
+
+    return {
+      status: entry.partial === true ? 206 : 200,
+      headers,
+      body: endpoint === 'get' ? entry.stream : undefined
+    }
+  }
+
+  private async head (storage: string, input: Input): Promise<Output> {
+    const entry = await this.storage.invoke<Maybe<Entry>>('head', {
+      input: {
+        storage,
+        path: input.request.url
+      }
+    })
+
+    if (entry instanceof Error)
+      throw new NotFound()
+
+    return { body: entry }
+  }
+}
+
+export interface Options {
+  meta?: boolean
+}