@toa.io/extensions.exposition 1.0.0-alpha.285 → 1.0.0-alpha.287

package/features/steps/Gateway.ts

@@ -3,24 +3,24 @@ import tsflow from 'cucumber-tsflow'
 import * as boot from '@toa.io/boot'
 import { type Connector } from '@toa.io/core'
 import { load as parse } from 'js-yaml'
-import { timeout } from '@toa.io/generic'
 import { Factory } from '../../source/index.js'
 import * as syntax from '../../source/RTD/syntax/index.js'
 import { shortcuts } from '../../source/Directive.js'
 import { manifests } from './map.js'
+import { PORT, PROBE } from './Parameters.js'
 import type * as http from '../../source/HTTP/index.js'
 
 const { after, afterAll, binding, given } = tsflow
 
 let instance: Connector | null = null
+let deployment: string | null = null
 
 @binding()
 export class Gateway {
-  private default: boolean = true
   private written: string[] = []
 
   @given('the annotation:')
-  public async annotate (yaml: string): Promise<void> {
+  public async annotate(yaml: string): Promise<void> {
     const annotation = parse(yaml) as Partial<http.Options> & { '/'?: object }
 
     if (annotation['/'] !== undefined) {
@@ -32,32 +32,21 @@ export class Gateway {
     const { debug, authorities, bouncer, ip, oauth, rpc, mcp } = annotation
     const properties = Object.assign({}, DEFAULT_PROPERTIES)
 
-    if (debug !== undefined)
-      properties.debug = debug
+    if (debug !== undefined) properties.debug = debug
 
-    if (bouncer !== undefined)
-      properties.bouncer = bouncer
+    if (bouncer !== undefined) properties.bouncer = bouncer
 
-    if (ip !== undefined)
-      properties.ip = ip
+    if (ip !== undefined) properties.ip = ip
 
-    if (authorities !== undefined)
-      properties.authorities = authorities
+    if (authorities !== undefined) properties.authorities = authorities
 
-    if (oauth !== undefined)
-      properties.oauth = oauth
+    if (oauth !== undefined) properties.oauth = oauth
 
-    if (rpc !== undefined)
-      properties.rpc = rpc
+    if (rpc !== undefined) properties.rpc = rpc
 
-    if (mcp !== undefined)
-      properties.mcp = mcp
+    if (mcp !== undefined) properties.mcp = mcp
 
     process.env.TOA_EXPOSITION_PROPERTIES = JSON.stringify(properties)
-
-    await Gateway.stop()
-
-    this.default = false
   }
 
   /**
@@ -65,16 +54,17 @@ export class Gateway {
    * exposition extension over them, so what lands here is what a deployment would carry.
    */
   @given('the annotation of the introspection map')
-  public async annotateMap (): Promise<void> {
+  public async annotateMap(): Promise<void> {
     await this.annotateMapUnder()
   }
 
   /** The same routes under a root of the scenario's own: what an application declares around the map. */
   @given('the annotation of the introspection map under:')
-  public async annotateMapUnder (yaml?: string): Promise<void> {
-    const tree: syntax.Node = yaml === undefined
-      ? { routes: [], methods: [], directives: [] }
-      : syntax.parse((parse(yaml) as { '/': object })['/'], shortcuts)
+  public async annotateMapUnder(yaml?: string): Promise<void> {
+    const tree: syntax.Node =
+      yaml === undefined
+        ? { routes: [], methods: [], directives: [] }
+        : syntax.parse((parse(yaml) as { '/': object })['/'], shortcuts)
 
     for (const manifest of await manifests()) {
       const node = manifest.extensions?.[EXPOSITION] as syntax.Node | undefined
@@ -87,14 +77,10 @@ export class Gateway {
 
     process.env.TOA_EXPOSITION = JSON.stringify(tree)
     process.env.TOA_EXPOSITION_PROPERTIES = JSON.stringify(DEFAULT_PROPERTIES)
-
-    await Gateway.stop()
-
-    this.default = false
   }
 
   @given('the `{word}` configuration:')
-  public async configure (id: string, yaml: string): Promise<void> {
+  public async configure(id: string, yaml: string): Promise<void> {
     const [name, namespace = 'default'] = id.split('.').reverse()
     const key = `TOA_CONFIGURATION_${namespace.toUpperCase()}_${name.toUpperCase()}`
     const def = DEFAULT_CONFIGURATION[id] ?? {}
@@ -105,91 +91,89 @@ export class Gateway {
     // outlives the secrets it points at, and the next scenario cannot resolve them
     this.written.push(key)
     process.env[key] = JSON.stringify(configuration)
-
-    await Gateway.stop()
-
-    this.default = false
   }
 
   /** The secrets a scenario's configuration refers to. */
   @given('the configuration secrets:')
-  public async secrets (yaml: string): Promise<void> {
+  public async secrets(yaml: string): Promise<void> {
     const secrets = parse(yaml) as Record<string, string>
 
     for (const [name, value] of Object.entries(secrets)) {
       this.written.push(SECRET + name)
       process.env[SECRET + name] = value
     }
-
-    await Gateway.stop()
-
-    this.default = false
   }
 
   @given('the branch TTL is {float} second(s)')
-  public async setBranchTTL (seconds: number): Promise<void> {
+  public async setBranchTTL(seconds: number): Promise<void> {
     process.env.__TESTING_EXPOSITION_BRANCH_TTL = String(seconds * 1000)
-
-    await Gateway.stop()
-
-    this.default = false
   }
 
   @given('the Gateway is running')
-  public async start (): Promise<void> {
-    if (instance !== null)
-      return
-
+  public async start(): Promise<void> {
     process.env.TOA_EXPOSITION ??= DEFAULT_TREE
     process.env.TOA_EXPOSITION_PROPERTIES ??= JSON.stringify(DEFAULT_PROPERTIES)
 
     this.writeConfiguration()
 
+    const signature = Gateway.signature()
+
+    /*
+     * A component is published without restarting the gateway, and a scenario that asks for
+     * the deployment already running gets that one. Only a different deployment is a restart,
+     * which is what an annotation, a configuration or a branch TTL of its own amounts to.
+     */
+    if (instance !== null && signature === deployment) return
+
+    await Gateway.stop()
+
     const factory = new Factory(boot.host())
     const service = await factory.service()
 
-    if (service === null)
-      throw new Error('?')
+    if (service === null) throw new Error('?')
 
     instance = service
 
     await service.connect()
 
-    /*
-     * The gateway waits for the branches it discovers, but a component's own resources —
-     * a storage, a queue — are still connecting when it answers. Fifty milliseconds was
-     * enough until the composition grew, then a hundred; a scenario that asks too early
-     * reads the 404 that precedes the route, which `realtime` was failing on in two runs
-     * of three. It is a sleep and not a poll, so it is raised rather than fixed.
-     */
-    await timeout(DISCOVERY)
+    deployment = signature
+  }
+
+  /** What the running gateway was built from: a different value is a different deployment. */
+  private static signature(): string {
+    const configuration = Object.keys(process.env)
+      .filter((key) => key.startsWith('TOA_CONFIGURATION_'))
+      .sort()
+      .map((key) => [key, process.env[key]])
+
+    return JSON.stringify([
+      process.env.TOA_EXPOSITION,
+      process.env.TOA_EXPOSITION_PROPERTIES,
+      process.env.__TESTING_EXPOSITION_BRANCH_TTL,
+      configuration
+    ])
   }
 
   @after()
-  public async cleanup (): Promise<void> {
+  public async cleanup(): Promise<void> {
     delete process.env.__TESTING_EXPOSITION_BRANCH_TTL
 
-    for (const key of this.written)
-      delete process.env[key]
+    for (const key of this.written) delete process.env[key]
 
     this.written = []
 
-    if (this.default)
-      return
-
     delete process.env.TOA_EXPOSITION
     delete process.env.TOA_EXPOSITION_PROPERTIES
-
-    await Gateway.stop()
   }
 
   @afterAll()
-  public static async stop (): Promise<void> {
+  public static async stop(): Promise<void> {
     await instance?.disconnect()
     instance = null
+    deployment = null
   }
 
-  private writeConfiguration (): void {
+  private writeConfiguration(): void {
     for (const [id, configuration] of Object.entries(DEFAULT_CONFIGURATION)) {
       const [name, namespace = 'default'] = id.split('.').reverse()
       const key = `TOA_CONFIGURATION_${namespace.toUpperCase()}_${name.toUpperCase()}`
@@ -217,13 +201,12 @@ const DEFAULT_TREE = JSON.stringify({
   ]
 } satisfies syntax.Node)
 
-/** Milliseconds a composition is given to finish connecting what it needs. */
-const DISCOVERY = 500
-
 const DEFAULT_PROPERTIES: Partial<http.Options> = {
   authorities: {
     nex: 'nex.toa.io'
   },
+  port: PORT,
+  probe: PROBE,
   // `npm run features:h2c` runs the whole suite over cleartext HTTP/2
   protocol: process.env.TOA_EXPOSITION_PROTOCOL === 'h2c' ? 'h2c' : 'h1'
 }

package/features/steps/HTTP.ts

@@ -17,25 +17,25 @@ const { binding, then, when } = tsflow
 export class HTTP extends http.Agent {
   private readonly gateway: Gateway
 
-  public constructor (gateway: Gateway, parameters: Parameters, captures: Captures) {
+  public constructor(gateway: Gateway, parameters: Parameters, captures: Captures) {
     super(parameters.origin, captures)
     this.gateway = gateway
   }
 
   @when('the following request is received:')
-  public override async request (input: string): Promise<any> {
+  public override async request(input: string): Promise<any> {
     await this.gateway.start()
 
     await super.request(input)
   }
 
   @then('the following reply is sent:')
-  public override responseIncludes (expected: string): void {
+  public override responseIncludes(expected: string): void {
     super.responseIncludes(expected)
   }
 
   @then('response body contains {word}-encoded value:')
-  public async bodyIs (format: string, yaml: string): Promise<void> {
+  public async bodyIs(format: string, yaml: string): Promise<void> {
     assert.ok(this.bytes !== null, 'Response body is not available')
 
     const value = encoders[format]?.(this.bytes)
@@ -45,12 +45,12 @@ export class HTTP extends http.Agent {
   }
 
   @then('the reply does not contain:')
-  public override responseExcludes (expected: string): void {
+  public override responseExcludes(expected: string): void {
     super.responseExcludes(expected)
   }
 
   @when('the stream of `{word}` is received with the following headers:')
-  public async streamRequest (filename: string, head: string): Promise<any> {
+  public async streamRequest(filename: string, head: string): Promise<any> {
     const stream = open(filename)
 
     await this.gateway.start()
@@ -58,30 +58,27 @@ export class HTTP extends http.Agent {
   }
 
   @then('the stream equals to `{word}` is sent with the following headers:')
-  public async responseStreamMatch (filename: string, head: string): Promise<any> {
+  public async responseStreamMatch(filename: string, head: string): Promise<any> {
     const stream = open(filename)
 
     await super.streamMatch(head, stream)
   }
 
   @when('the following request is interrupted after {float} second(s):')
-  public async interrupt (delay: number, input: string): Promise<any> {
+  public async interrupt(delay: number, input: string): Promise<any> {
     const controller = new AbortController()
 
     await this.gateway.start()
 
     setTimeout(() => {
-      if (pending)
-        controller.abort()
-      else
-        console.error('Request cannot be interrupted as it is already completed')
+      if (pending) controller.abort()
+      else console.error('Request cannot be interrupted as it is already completed')
     }, delay * 1000)
 
     let pending = true
 
     await super.fetch(input, { signal: controller.signal }).catch((e) => {
-      if (e.name !== 'AbortError')
-        throw e
+      if (e.name !== 'AbortError') throw e
     })
 
     pending = false
@@ -90,7 +87,7 @@ export class HTTP extends http.Agent {
 
 const FILES_DIR = path.resolve(import.meta.dirname, '../../../storages/source/test')
 
-function open (filename: string): Readable {
+function open(filename: string): Readable {
   return fs.createReadStream(path.join(FILES_DIR, filename))
 }
 

package/features/steps/IDP.ts

@@ -20,12 +20,12 @@ export class IDP {
   private static authCodes = new Map<string, AuthCode>()
   private readonly captures: Captures
 
-  public constructor (captures: Captures) {
+  public constructor(captures: Captures) {
     this.captures = captures
   }
 
   @afterAll()
-  public static async stop (): Promise<void> {
+  public static async stop(): Promise<void> {
     if (this.server instanceof http.Server) {
       this.server.close()
       await once(this.server, 'close')
@@ -33,25 +33,27 @@ export class IDP {
   }
 
   @given(/local IDP is running/i)
-  public async start (): Promise<void> {
+  public async start(): Promise<void> {
     if (IDP.server instanceof http.Server) return
 
     // creating the key
-    const {
-      publicKey,
-      privateKey
-    } = await util.promisify(crypto.generateKeyPair)('rsa', {
-      modulusLength: 2048
-    })
+    const { publicKey, privateKey } = await util.promisify(crypto.generateKeyPair)(
+      'rsa',
+      {
+        modulusLength: 2048
+      }
+    )
 
     IDP.privateKey = privateKey
 
     const jwk = JSON.stringify({
-      keys: [{
-        use: 'sig',
-        alg: 'RS256',
-        ...publicKey.export({ format: 'jwk' })
-      }]
+      keys: [
+        {
+          use: 'sig',
+          alg: 'RS256',
+          ...publicKey.export({ format: 'jwk' })
+        }
+      ]
     })
 
     const JWK_ENDPOINT = '/.well-known/jwks'
@@ -71,79 +73,83 @@ export class IDP {
           response.end(jwk)
           break
 
-        case '/.well-known/openid-configuration': {
-          const openIdConfiguration = JSON.stringify({
-            issuer: IDP.issuer,
-            jwks_uri: IDP.issuer + JWK_ENDPOINT,
-            authorization_endpoint: IDP.issuer + AUTH_ENDPOINT,
-            token_endpoint: IDP.issuer + TOKEN_ENDPOINT,
-            response_types_supported: ['id_token', 'code'],
-            grant_types_supported: ['authorization_code'],
-            subject_types_supported: ['public'],
-            id_token_signing_alg_values_supported: ['RS256'],
-            scopes_supported: ['openid', 'email', 'profile']
-          })
-
-          response.writeHead(200, {
-            'Content-Type': 'application/json',
-            'Cache-Control': 'public, max-age=3600',
-            'Content-Length': openIdConfiguration.length
-          })
-
-          response.end(openIdConfiguration)
-        }
-
-          break
-
-        case TOKEN_ENDPOINT: {
-          if (request.method !== 'POST') {
-            response.writeHead(405, { 'Content-Type': 'text/plain' })
-            response.end('Method not allowed')
-
-            return
-          }
-
-          const buf = await buffer(request)
-          const body = buf.toString('utf8')
-
-          const params = new URLSearchParams(body)
-          const grantType = params.get('grant_type')!
-          const code = params.get('code')!
-          const redirectUri = params.get('redirect_uri')!
-          const clientId = params.get('client_id')!
-
-          if (grantType !== 'authorization_code' || !code || !clientId) {
-            response.writeHead(400, { 'Content-Type': 'application/json' })
-            response.end(JSON.stringify({ error: 'invalid_request' }))
+        case '/.well-known/openid-configuration':
+          {
+            const openIdConfiguration = JSON.stringify({
+              issuer: IDP.issuer,
+              jwks_uri: IDP.issuer + JWK_ENDPOINT,
+              authorization_endpoint: IDP.issuer + AUTH_ENDPOINT,
+              token_endpoint: IDP.issuer + TOKEN_ENDPOINT,
+              response_types_supported: ['id_token', 'code'],
+              grant_types_supported: ['authorization_code'],
+              subject_types_supported: ['public'],
+              id_token_signing_alg_values_supported: ['RS256'],
+              scopes_supported: ['openid', 'email', 'profile']
+            })
+
+            response.writeHead(200, {
+              'Content-Type': 'application/json',
+              'Cache-Control': 'public, max-age=3600',
+              'Content-Length': openIdConfiguration.length
+            })
+
+            response.end(openIdConfiguration)
           }
 
-          const codeData = IDP.authCodes.get(code)
-
-          if (!codeData ||
-            codeData.expiresAt < Date.now() ||
-            codeData.clientId !== clientId ||
-            (redirectUri && codeData.redirectUri !== redirectUri)) {
-            response.writeHead(400, { 'Content-Type': 'application/json' })
-            response.end(JSON.stringify({ error: 'invalid_grant' }))
+          break
 
-            return
+        case TOKEN_ENDPOINT:
+          {
+            if (request.method !== 'POST') {
+              response.writeHead(405, { 'Content-Type': 'text/plain' })
+              response.end('Method not allowed')
+
+              return
+            }
+
+            const buf = await buffer(request)
+            const body = buf.toString('utf8')
+
+            const params = new URLSearchParams(body)
+            const grantType = params.get('grant_type')!
+            const code = params.get('code')!
+            const redirectUri = params.get('redirect_uri')!
+            const clientId = params.get('client_id')!
+
+            if (grantType !== 'authorization_code' || !code || !clientId) {
+              response.writeHead(400, { 'Content-Type': 'application/json' })
+              response.end(JSON.stringify({ error: 'invalid_request' }))
+            }
+
+            const codeData = IDP.authCodes.get(code)
+
+            if (
+              !codeData ||
+              codeData.expiresAt < Date.now() ||
+              codeData.clientId !== clientId ||
+              (redirectUri && codeData.redirectUri !== redirectUri)
+            ) {
+              response.writeHead(400, { 'Content-Type': 'application/json' })
+              response.end(JSON.stringify({ error: 'invalid_grant' }))
+
+              return
+            }
+
+            const accessToken = crypto.randomBytes(32).toString('hex')
+            const idToken = this.generateIdToken(codeData.sub, codeData.email, clientId)
+
+            IDP.authCodes.delete(code)
+
+            response.writeHead(200, { 'Content-Type': 'application/json' }).end(
+              JSON.stringify({
+                access_token: accessToken,
+                token_type: 'Bearer',
+                id_token: idToken,
+                expires_in: 3600
+              })
+            )
           }
 
-          const accessToken = crypto.randomBytes(32).toString('hex')
-          const idToken = this.generateIdToken(codeData.sub, codeData.email, clientId)
-
-          IDP.authCodes.delete(code)
-
-          response
-            .writeHead(200, { 'Content-Type': 'application/json' })
-            .end(JSON.stringify({
-              access_token: accessToken,
-              token_type: 'Bearer',
-              id_token: idToken,
-              expires_in: 3600
-            }))
-        }
-
           break
 
         default:
@@ -152,7 +158,8 @@ export class IDP {
       }
     })
 
-    server.listen(44444, 'localhost')
+    // in Toa's own block, and out of the ephemeral range an arbitrary port would sit in
+    server.listen(31005, 'localhost')
     await once(server, 'listening')
 
     const address = server.address() as AddressInfo
@@ -163,7 +170,7 @@ export class IDP {
   }
 
   @given('the IDP token for {word} is issued')
-  public async issueToken (user: string): Promise<void> {
+  public async issueToken(user: string): Promise<void> {
     assert.ok(IDP.privateKey, 'IdP private key is not available')
 
     const jwt = [
@@ -183,7 +190,10 @@ export class IDP {
       .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
       .join('.')
 
-    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+    const signature = crypto
+      .createSign('RSA-SHA256')
+      .end(jwt)
+      .sign(IDP.privateKey, 'base64url')
 
     const idToken = `${jwt}.${signature}`
 
@@ -191,7 +201,7 @@ export class IDP {
   }
 
   @given('the IDP random token is issued')
-  public async issueNewToken (): Promise<void> {
+  public async issueNewToken(): Promise<void> {
     assert.ok(IDP.privateKey, 'IdP private key is not available')
 
     const sub = Math.random().toString(36).substring(7)
@@ -213,7 +223,10 @@ export class IDP {
       .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
       .join('.')
 
-    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+    const signature = crypto
+      .createSign('RSA-SHA256')
+      .end(jwt)
+      .sign(IDP.privateKey, 'base64url')
 
     const idToken = `${jwt}.${signature}`
 
@@ -223,7 +236,11 @@ export class IDP {
   }
 
   @given('the IDP {word} token for {word} is issued with following secret:')
-  public async issueSymmetricToken (alg: string, user: string, secret: string): Promise<void> {
+  public async issueSymmetricToken(
+    alg: string,
+    user: string,
+    secret: string
+  ): Promise<void> {
     const jwt = [
       {
         typ: 'JWT',
@@ -240,7 +257,8 @@ export class IDP {
       .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
       .join('.')
 
-    const signature = crypto.createHmac(alg.replace(/^HS(\d{3})$/, 'sha$1'), secret)
+    const signature = crypto
+      .createHmac(alg.replace(/^HS(\d{3})$/, 'sha$1'), secret)
       .update(jwt)
       .digest('base64url')
 
@@ -250,7 +268,7 @@ export class IDP {
   }
 
   @given('ID token with jti is issued for {word}')
-  public async issueTokenWithJti (user: string): Promise<void> {
+  public async issueTokenWithJti(user: string): Promise<void> {
     assert.ok(IDP.privateKey, 'IdP private key is not available')
 
     const jwt = [
@@ -271,7 +289,10 @@ export class IDP {
       .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
       .join('.')
 
-    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+    const signature = crypto
+      .createSign('RSA-SHA256')
+      .end(jwt)
+      .sign(IDP.privateKey, 'base64url')
 
     const idToken = `${jwt}.${signature}`
 
@@ -279,7 +300,7 @@ export class IDP {
   }
 
   @given('auth code for {word} is issued for {word}')
-  public async issueAuthCode (user: string, redirectUri: string): Promise<void> {
+  public async issueAuthCode(user: string, redirectUri: string): Promise<void> {
     const code = crypto.randomBytes(16).toString('hex')
     const email = user + '@test.local'
     const clientId = 'nex'
@@ -300,7 +321,7 @@ export class IDP {
     this.captures.set(`${user}.code_credentials`, base64)
   }
 
-  private generateIdToken (sub: string, email: string, clientId: string): string {
+  private generateIdToken(sub: string, email: string, clientId: string): string {
     assert.ok(IDP.privateKey, 'IdP private key is not available')
     assert.ok(IDP.issuer, 'IdP issuer is not available')
 
@@ -321,7 +342,10 @@ export class IDP {
       .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
       .join('.')
 
-    const signature = crypto.createSign('RSA-SHA256').end(jwt).sign(IDP.privateKey, 'base64url')
+    const signature = crypto
+      .createSign('RSA-SHA256')
+      .end(jwt)
+      .sign(IDP.privateKey, 'base64url')
 
     return `${jwt}.${signature}`
   }