@toa.io/extensions.exposition 1.0.0-alpha.29 → 1.0.0-alpha.291

package/features/steps/IDP.ts

@@ -0,0 +1,361 @@
+import { once } from 'node:events'
+import * as crypto from 'node:crypto'
+import * as http from 'node:http'
+import * as assert from 'node:assert'
+import * as util from 'node:util'
+import { buffer } from 'node:stream/consumers'
+import tsflow from 'cucumber-tsflow'
+
+import { Captures } from './Captures.js'
+
+import type { AddressInfo } from 'node:net'
+
+const { binding, given, afterAll } = tsflow
+
+@binding([Captures])
+export class IDP {
+  private static server?: http.Server
+  private static privateKey?: crypto.KeyObject
+  private static issuer?: string
+  private static authCodes = new Map<string, AuthCode>()
+  private readonly captures: Captures
+
+  public constructor(captures: Captures) {
+    this.captures = captures
+  }
+
+  @afterAll()
+  public static async stop(): Promise<void> {
+    if (this.server instanceof http.Server) {
+      this.server.close()
+      await once(this.server, 'close')
+    }
+  }
+
+  @given(/local IDP is running/i)
+  public async start(): Promise<void> {
+    if (IDP.server instanceof http.Server) return
+
+    // creating the key
+    const { publicKey, privateKey } = await util.promisify(crypto.generateKeyPair)(
+      'rsa',
+      {
+        modulusLength: 2048
+      }
+    )
+
+    IDP.privateKey = privateKey
+
+    const jwk = JSON.stringify({
+      keys: [
+        {
+          use: 'sig',
+          alg: 'RS256',
+          ...publicKey.export({ format: 'jwk' })
+        }
+      ]
+    })
+
+    const JWK_ENDPOINT = '/.well-known/jwks'
+    const TOKEN_ENDPOINT = '/token'
+    const AUTH_ENDPOINT = '/authorize'
+
+    const server = http.createServer(async (request, response) => {
+      switch (request.url) {
+        case JWK_ENDPOINT:
+          response.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Content-Length': jwk.length,
+            'Cache-Control': 'no-cache, no-store, must-revalidate',
+            Pragma: 'no-cache',
+            Expires: '0'
+          })
+          response.end(jwk)
+          break
+
+        case '/.well-known/openid-configuration':
+          {
+            const openIdConfiguration = JSON.stringify({
+              issuer: IDP.issuer,
+              jwks_uri: IDP.issuer + JWK_ENDPOINT,
+              authorization_endpoint: IDP.issuer + AUTH_ENDPOINT,
+              token_endpoint: IDP.issuer + TOKEN_ENDPOINT,
+              response_types_supported: ['id_token', 'code'],
+              grant_types_supported: ['authorization_code'],
+              subject_types_supported: ['public'],
+              id_token_signing_alg_values_supported: ['RS256'],
+              scopes_supported: ['openid', 'email', 'profile']
+            })
+
+            response.writeHead(200, {
+              'Content-Type': 'application/json',
+              'Cache-Control': 'public, max-age=3600',
+              'Content-Length': openIdConfiguration.length
+            })
+
+            response.end(openIdConfiguration)
+          }
+
+          break
+
+        case TOKEN_ENDPOINT:
+          {
+            if (request.method !== 'POST') {
+              response.writeHead(405, { 'Content-Type': 'text/plain' })
+              response.end('Method not allowed')
+
+              return
+            }
+
+            const buf = await buffer(request)
+            const body = buf.toString('utf8')
+
+            const params = new URLSearchParams(body)
+            const grantType = params.get('grant_type')!
+            const code = params.get('code')!
+            const redirectUri = params.get('redirect_uri')!
+            const clientId = params.get('client_id')!
+
+            if (grantType !== 'authorization_code' || !code || !clientId) {
+              response.writeHead(400, { 'Content-Type': 'application/json' })
+              response.end(JSON.stringify({ error: 'invalid_request' }))
+            }
+
+            const codeData = IDP.authCodes.get(code)
+
+            if (
+              !codeData ||
+              codeData.expiresAt < Date.now() ||
+              codeData.clientId !== clientId ||
+              (redirectUri && codeData.redirectUri !== redirectUri)
+            ) {
+              response.writeHead(400, { 'Content-Type': 'application/json' })
+              response.end(JSON.stringify({ error: 'invalid_grant' }))
+
+              return
+            }
+
+            const accessToken = crypto.randomBytes(32).toString('hex')
+            const idToken = this.generateIdToken(codeData.sub, codeData.email, clientId)
+
+            IDP.authCodes.delete(code)
+
+            response.writeHead(200, { 'Content-Type': 'application/json' }).end(
+              JSON.stringify({
+                access_token: accessToken,
+                token_type: 'Bearer',
+                id_token: idToken,
+                expires_in: 3600
+              })
+            )
+          }
+
+          break
+
+        default:
+          response.writeHead(404, 'Not found')
+          response.end()
+      }
+    })
+
+    // in Toa's own block, and out of the ephemeral range an arbitrary port would sit in
+    server.listen(31005, 'localhost')
+    await once(server, 'listening')
+
+    const address = server.address() as AddressInfo
+
+    console.log('IdP is listening on %s:%s', address.address, address.port)
+    IDP.server = server
+    IDP.issuer = `http://localhost:${address.port}`
+  }
+
+  @given('the IDP token for {word} is issued')
+  public async issueToken(user: string): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        email: user + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto
+      .createSign('RSA-SHA256')
+      .end(jwt)
+      .sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('the IDP random token is issued')
+  public async issueNewToken(): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const sub = Math.random().toString(36).substring(7)
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub,
+        aud: 'test',
+        email: sub + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto
+      .createSign('RSA-SHA256')
+      .end(jwt)
+      .sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set('random.sub', sub)
+    this.captures.set('random.email', sub + '@test.local')
+    this.captures.set('random.id_token', idToken)
+  }
+
+  @given('the IDP {word} token for {word} is issued with following secret:')
+  public async issueSymmetricToken(
+    alg: string,
+    user: string,
+    secret: string
+  ): Promise<void> {
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto
+      .createHmac(alg.replace(/^HS(\d{3})$/, 'sha$1'), secret)
+      .update(jwt)
+      .digest('base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('ID token with jti is issued for {word}')
+  public async issueTokenWithJti(user: string): Promise<void> {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub: user,
+        aud: 'test',
+        email: user + '@test.local',
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000),
+        jti: crypto.randomUUID()
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto
+      .createSign('RSA-SHA256')
+      .end(jwt)
+      .sign(IDP.privateKey, 'base64url')
+
+    const idToken = `${jwt}.${signature}`
+
+    this.captures.set(`${user}.id_token`, idToken)
+  }
+
+  @given('auth code for {word} is issued for {word}')
+  public async issueAuthCode(user: string, redirectUri: string): Promise<void> {
+    const code = crypto.randomBytes(16).toString('hex')
+    const email = user + '@test.local'
+    const clientId = 'nex'
+
+    IDP.authCodes.set(code, {
+      code,
+      sub: user,
+      email,
+      clientId,
+      redirectUri,
+      expiresAt: Date.now() + 60 * 1000
+    })
+
+    const json = JSON.stringify({ code, iss: IDP.issuer, for: redirectUri })
+    const base64 = Buffer.from(json).toString('base64')
+
+    this.captures.set(`${user}.auth_code`, code)
+    this.captures.set(`${user}.code_credentials`, base64)
+  }
+
+  private generateIdToken(sub: string, email: string, clientId: string): string {
+    assert.ok(IDP.privateKey, 'IdP private key is not available')
+    assert.ok(IDP.issuer, 'IdP issuer is not available')
+
+    const jwt = [
+      {
+        typ: 'JWT',
+        alg: 'RS256'
+      },
+      {
+        iss: IDP.issuer,
+        sub,
+        aud: clientId,
+        email,
+        iat: Math.floor(Date.now() / 1000),
+        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
+      }
+    ]
+      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
+      .join('.')
+
+    const signature = crypto
+      .createSign('RSA-SHA256')
+      .end(jwt)
+      .sign(IDP.privateKey, 'base64url')
+
+    return `${jwt}.${signature}`
+  }
+}
+
+interface AuthCode {
+  code: string
+  sub: string
+  email: string
+  clientId: string
+  redirectUri: string
+  expiresAt: number
+}

package/features/steps/Identity.ts

@@ -0,0 +1,54 @@
+import tsflow from 'cucumber-tsflow'
+
+import * as http from '@toa.io/agent'
+import { Parameters } from './Parameters.js'
+import { Captures } from './Captures.js'
+import { Gateway } from './Gateway.js'
+
+const { binding, given } = tsflow
+
+@binding([Gateway, Parameters, Captures])
+export class Identity {
+  private readonly gateway: Gateway
+  private readonly http: http.Agent
+  private readonly variables: Captures
+
+  public constructor(gateway: Gateway, parameters: Parameters, captures: Captures) {
+    this.gateway = gateway
+    this.http = new http.Agent(parameters.origin, captures)
+    this.variables = captures
+  }
+
+  @given('transient identity {word}')
+  public async transient(as: string): Promise<Principal> {
+    await this.gateway.start()
+
+    await this.http.request(`
+      GET /identity/ HTTP/1.1
+      host: nex.toa.io
+      accept: application/yaml
+    `)
+
+    this.http.responseIncludes(`
+      201 Created
+      authorization: Token \${{ ${as}.token }}
+
+      id: \${{ ${as}.id }}
+    `)
+
+    const id = this.variables.get(as + '.id')!
+    const token = this.variables.get(as + '.token')!
+
+    return { id, token }
+  }
+
+  @given('transient identity')
+  public async anonymous(): Promise<Principal> {
+    return await this.transient('identity')
+  }
+}
+
+export interface Principal {
+  id: string
+  token: string
+}

package/features/steps/OTP.ts

@@ -0,0 +1,42 @@
+import * as assert from 'node:assert'
+import tsflow from 'cucumber-tsflow'
+
+import * as boot from '@toa.io/boot'
+import { Locator, type Remote } from '@toa.io/core'
+import { Captures } from './Captures.js'
+
+const { binding, given } = tsflow
+
+@binding([Captures])
+export class OTP {
+  private captures: Captures
+  private otp: Remote | null = null
+
+  public constructor(captures: Captures) {
+    this.captures = captures
+  }
+
+  @given('OTP for `{word}` in `{word}` authority is issued')
+  public async issue(username: string, authority: string): Promise<void> {
+    this.otp ??= await this.connect()
+
+    const reply = await this.otp.invoke('issue', {
+      input: {
+        username,
+        authority
+      }
+    })
+
+    assert.ok(typeof reply.code === 'string')
+
+    const credentials = btoa(`${username}:${reply.code}`)
+
+    this.captures.set(`${username}.otp`, credentials)
+  }
+
+  private async connect(): Promise<Remote> {
+    const locator = new Locator('otp', 'identity')
+
+    return await boot.remote(locator)
+  }
+}

package/features/steps/Parameters.ts

@@ -1,21 +1,162 @@
+import { join } from 'node:path'
+import * as dotenv from 'dotenv'
 import { setDefaultTimeout } from '@cucumber/cucumber'
-import { encode } from '@toa.io/generic'
+import { environment as variables } from '@toa.io/generic'
+
+dotenv.config({ path: join(import.meta.dirname, '.env') })
+
+/**
+ * Not `PORT` and `PROBE`, which a deployment serves the gateway on: an application built on
+ * Toa is served on this machine too, and its own gateway holds those. See CONTRIBUTING.md.
+ */
+export const PORT = 31000
+export const PROBE = 31004
 
 export class Parameters {
   public readonly origin: string
 
-  public constructor () {
-    this.origin = 'http://127.0.0.1:8000'
+  public constructor() {
+    this.origin = `http://127.0.0.1:${PORT}`
   }
 }
 
-setDefaultTimeout(30 * 1000)
+setDefaultTimeout(60 * 1000)
+
+variables.set('TOA_DEV', '1')
+
+// a reply is checked against what the operation declares, so the suite runs Toa under the
+// contract it asks applications to keep
+if (!variables.has('TOA_ENV')) variables.set('TOA_ENV', 'local')
+
+// the gateway answers for itself, as it does in a deployment: telemetry's probe tracks the
+// nested composition, which connects before route discovery settles
+if (!variables.has('TOA_TELEMETRY_READY'))
+  variables.set('TOA_TELEMETRY_READY', JSON.stringify(false))
 
-process.env.TOA_DEV = '1'
+// export traces to the local Tempo (`docker compose up tempo grafana`),
+// unavailability of the endpoint is harmless
+if (!variables.has('TOA_TELEMETRY_TRACES'))
+  variables.set(
+    'TOA_TELEMETRY_TRACES',
+    JSON.stringify({
+      exporters: {
+        console: null,
+        otlp: { endpoint: 'http://localhost:31061' }
+      }
+    })
+  )
 
-process.env.TOA_STORAGES = encode({
-  octets: {
-    provider: 'tmp',
-    directory: 'exposition'
+/*
+ * The page the gateway serves at `/.discovery/`, pointed at a fixture: the scenarios are
+ * about the server, not the page, and none of them should need a UI build. Set here rather
+ * than in a step because the gateway is not rebuilt between scenarios that share its
+ * signature, so one flipping this would silently read whatever the last one left.
+ */
+process.env.__TESTING_EXPOSITION_DISCOVERY_ROOT = join(
+  import.meta.dirname,
+  '..',
+  'site'
+)
+
+const environment = process.env.CLOUDINARY_ENVIRONMENT
+
+/**
+ * A storage is built when a component's context is — for every scenario, not only for the ones
+ * that reach for it — and a Cloudinary storage asks for the keys of a real account. A checkout
+ * carries none, so these two are declared only where `features/steps/.env` names an environment.
+ */
+const CLOUDINARY = {
+  cloudinary: {
+    provider: 'cloudinary',
+    environment,
+    type: 'image',
+    prefix: 'toa-dev',
+    transformations: [
+      {
+        extension: 'icon',
+        transformation: [
+          {
+            width: 48,
+            height: 48,
+            crop: 'fill'
+          },
+          {
+            border: '10px_solid_white'
+          }
+        ],
+        optional: true
+      },
+      {
+        extension: '(?<width>\\d*)x(?<height>\\d*)(z(?<zoom>\\d*))?',
+        transformation: {
+          width: '<width>',
+          height: '<height>',
+          zoom: '<zoom>',
+          crop: 'thumb',
+          gravity: 'face'
+        },
+        optional: true
+      },
+      {
+        extension: '\\[(?<width>\\d*)x(?<height>\\d*)\\](z(?<zoom>\\d+))?',
+        transformation: {
+          width: '<width>',
+          height: '<height>',
+          zoom: '<zoom>',
+          crop: 'fit'
+        },
+        optional: true
+      },
+      {
+        extension: '(?<format>jpeg|webp)',
+        transformation: {
+          fetch_format: '<format>'
+        },
+        optional: true
+      }
+    ]
+  },
+  cloudinary_video: {
+    provider: 'cloudinary',
+    environment,
+    type: 'video',
+    prefix: 'toa-dev',
+    eager: [
+      {
+        width: 200,
+        height: 200,
+        crop: 'fill'
+      }
+    ],
+    transformations: [
+      {
+        extension: '200x200',
+        transformation: {
+          width: 200,
+          height: 200,
+          crop: 'fill'
+        },
+        optional: true
+      },
+      {
+        extension: '(?<format>mp4|gif)',
+        transformation: {
+          quality: 'auto',
+          fetch_format: '<format>'
+        },
+        optional: true
+      }
+    ]
   }
-})
+}
+
+variables.set(
+  'TOA_STORAGES',
+  JSON.stringify({
+    octets: {
+      provider: 'tmp',
+      directory: Math.random().toString(36).substring(2)
+    },
+    ...(environment === undefined ? {} : CLOUDINARY)
+  })
+)

package/features/steps/Probe.ts

@@ -0,0 +1,38 @@
+import assert from 'node:assert'
+import { Agent, request } from 'undici'
+import tsflow from 'cucumber-tsflow'
+import { PATH } from '../../source/HTTP/index.js'
+import { PROBE } from './Parameters.js'
+
+const { after, binding, then, when } = tsflow
+
+@binding()
+export class Probe {
+  private readonly agent = new Agent()
+  private status: number | null = null
+  private headers: Record<string, string> = {}
+
+  @when('the ready probe is requested')
+  public async request(): Promise<void> {
+    const response = await request(`http://127.0.0.1:${PROBE}${PATH}`, {
+      dispatcher: this.agent
+    })
+
+    this.status = response.statusCode
+    this.headers = response.headers as Record<string, string>
+
+    await response.body.dump()
+  }
+
+  @then('the ready probe answers {int}')
+  public answers(status: number): void {
+    assert.equal(this.status, status)
+
+    if (status === 200) assert.equal(this.headers['cache-control'], 'no-store')
+  }
+
+  @after()
+  public async close(): Promise<void> {
+    await this.agent.close()
+  }
+}