@toa.io/extensions.exposition 1.0.0-alpha.29 → 1.0.0-alpha.291

package/source/Gateway.ts

@@ -1,97 +1,390 @@
-import { type bindings, Connector } from '@toa.io/core'
-import * as http from './HTTP'
-import { rethrow } from './exceptions'
-import type { Interception } from './Interception'
-import type { Method, Parameter, Tree } from './RTD'
-import type { Label } from './discovery'
-import type { Branch } from './Branch'
+import assert from 'node:assert'
+import { setTimeout } from 'node:timers/promises'
+import { console } from 'openspan'
+import { Connector } from '@toa.io/core'
+import type { bindings } from '@toa.io/core/types'
+import * as http from './HTTP/index.js'
+import { DISCOVERY, MCP, RPC } from './const.js'
+import { rethrow } from './exceptions.js'
+import { decide } from './Branch.js'
+import { describing } from './Introspection.js'
+import { Explorer, looking } from './Discovery/index.js'
+import type { Interception } from './Interception.js'
+import type { Dispatcher } from './RPC/index.js'
+import type { Server } from './MCP/index.js'
+import type {
+  DirectiveFactory,
+  Method,
+  Node,
+  Parameter,
+  Tree,
+  Match
+} from './RTD/index.js'
+import type { Label } from './discovery.js'
+import type { Branch, Exposed } from './Branch.js'
 
 export class Gateway extends Connector {
   private readonly broadcast: Broadcast
   private readonly tree: Tree
   private readonly interceptor: Interception
+  private readonly directives: DirectiveFactory
 
-  public constructor (broadcast: Broadcast, tree: Tree, interception: Interception) {
+  /** JSON-RPC is served only where the annotation asked for it. */
+  private readonly dispatcher: Dispatcher | null
+
+  /** And the same of MCP. */
+  private readonly mcp: Server | null
+
+  /** The tree, for every route at once. Served always, and so not nullable. */
+  private readonly explorer: Explorer
+  private readonly branches = new Map<string, Exposed>()
+  private lastMerge = 0
+  private widestGap = 0
+  private lastPing = 0
+  private stopped = false
+  private resolveFirstMerge: (() => void) | null = null
+
+  // eslint-disable-next-line max-params
+  public constructor(
+    broadcast: Broadcast,
+    tree: Tree,
+    interception: Interception,
+    directives: DirectiveFactory,
+    dispatcher: Dispatcher | null,
+    mcp: Server | null
+  ) {
     super()
 
     this.broadcast = broadcast
     this.tree = tree
     this.interceptor = interception
+    this.directives = directives
+    this.dispatcher = dispatcher
+    this.mcp = mcp
+    this.explorer = new Explorer(tree)
 
     this.depends(broadcast)
   }
 
-  public async process (context: http.Context): Promise<http.OutgoingMessage> {
-    const interception = await context.timing.capture('intercept',
-      this.interceptor.intercept(context))
+  public async process(context: http.Context): Promise<http.OutgoingMessage> {
+    const interception = await this.interceptor.intercept(context)
 
-    if (interception !== null)
-      return interception
+    if (interception !== null) return interception
 
-    const match = this.tree.match(context.url.pathname)
+    // request-scoped, before anything is routed: this is where a credential is read
+    await this.directives.preflight(context).catch(rethrow)
 
-    if (match === null)
-      throw new http.NotFound('Route not found')
+    const response = await this.endpoint(context)
+
+    // request-scoped, on whatever is going back: this is where a credential is re-issued
+    await this.directives.depart(context, response).catch(rethrow)
+
+    return response
+  }
+
+  /**
+   * What answers the request: a pinned endpoint that makes calls of its own, or the route
+   * the path names.
+   */
+  private async endpoint(context: http.Context): Promise<http.OutgoingMessage> {
+    const route: http.Processor = async (call) => await this.route(call)
+
+    if (this.dispatcher !== null && context.url.pathname === RPC)
+      return await this.dispatcher.dispatch(context, route)
+
+    if (this.mcp !== null && context.url.pathname === MCP)
+      return await this.mcp.process(context, route)
+
+    // the page under this prefix is an interceptor's, and has already answered
+    if (context.url.pathname === DISCOVERY || context.url.pathname === DISCOVERY + '/')
+      return await this.explorer.process(context)
+
+    // a browser that asked for the trunk of an API is looking for the page, and where the
+    // application answers there itself, that is what answers
+    if (context.url.pathname === '/' && !this.serves(context)) {
+      const page = looking(context)
+
+      if (page !== null) return page
+    }
+
+    return await this.route(context)
+  }
+
+  /** Whether the application serves the trunk with the verb the request was made with. */
+  private serves(context: http.Context): boolean {
+    const match = this.tree.match('/')
+
+    return match !== null && context.request.method in match.node.methods
+  }
+
+  /**
+   * One call: everything that needs a node. A request makes one of these, and a request
+   * that carries several calls makes one per call.
+   */
+  private async route(context: http.Context): Promise<http.OutgoingMessage> {
+    const { node, parameters } = this.match(context)
+
+    if (context.request.method === 'OPTIONS')
+      return await this.explain(context, node, parameters)
 
-    const { node, parameters } = match
+    let verb = context.request.method
 
-    if (!(context.request.method in node.methods))
-      throw new http.MethodNotAllowed()
+    if (!(verb in node.methods) && verb === 'HEAD' && 'GET' in node.methods) verb = 'GET'
 
-    const method = node.methods[context.request.method]
+    if (!(verb in node.methods)) throw new http.MethodNotAllowed()
 
-    const interruption = await context.timing.capture('preflight',
-      method.directives.preflight(context, parameters)).catch(rethrow)
+    const method = node.methods[verb]
 
-    const response = interruption ??
-      await context.timing.capture('call', this.call(method, context, parameters))
+    const interruption = await method.directives
+      .precall(context, parameters)
+      .catch(rethrow)
+    const response = interruption ?? (await this.call(method, context, parameters))
 
-    await context.timing.capture('settle',
-      method.directives.settle(context, response)).catch(rethrow)
+    await method.directives.settle(context, response).catch(rethrow)
 
     return response
   }
 
-  protected override async open (): Promise<void> {
+  protected override async open(): Promise<void> {
     await this.discover()
 
-    console.info('Gateway has started and is awaiting resource branches')
+    // what is served besides the tree, so that turning one on can be seen to have worked
+    const pinned: string[] = []
+
+    if (this.dispatcher !== null) pinned.push(RPC)
+
+    if (this.mcp !== null) pinned.push(MCP)
+
+    console.info('Gateway started', {
+      endpoints: pinned.length === 0 ? 'none' : pinned.join(' ')
+    })
+  }
+
+  /**
+   * Both of these reach into components, and a dependency is torn down only once this has
+   * returned — where `dispose` runs after every one of them already has. The throttling
+   * ticker firing in between calls an endpoint that has just been unbound, and reports the
+   * refusal as a failure to reconcile.
+   */
+  protected override async close(): Promise<void> {
+    this.stopped = true
+
+    this.tree.dispose()
   }
 
-  protected override dispose (): void {
+  protected override dispose(): void {
     console.info('Gateway is closed')
   }
 
-  private async call (method: Method, context: http.Context, parameters: Parameter[]): Promise<http.OutgoingMessage> {
+  private match(context: http.Context): Match {
+    const match = this.tree.match(context.url.pathname)
+
+    if (match === null) {
+      // the route may be missing because an expose has been lost
+      this.reping()
+
+      throw new http.NotFound('Route not found')
+    }
+
+    if (match.node.forward === null) return match
+
+    const destination = match.node.forward.replace(/\/:([^/]+)/g, (_, name) => {
+      const value = match.parameters.find((parameter) => parameter.name === name)?.value
+
+      assert.ok(value !== undefined, `Forwarded parameter '${name}' not found`)
+
+      return `/${value}`
+    })
+
+    const forward = this.tree.match(destination)
+
+    assert.ok(forward !== null, 'Forwarded route not found')
+
+    return forward
+  }
+
+  private async call(
+    method: Method,
+    context: http.Context,
+    parameters: Parameter[]
+  ): Promise<http.OutgoingMessage> {
     if (context.url.pathname[context.url.pathname.length - 1] !== '/')
       throw new http.NotFound('Trailing slash is required')
 
-    if (context.encoder === null)
-      throw new http.NotAcceptable()
+    if (context.encoder === null) throw new http.NotAcceptable()
 
-    if (method.endpoint === null)
-      throw new http.MethodNotAllowed()
+    if (method.endpoint === null) throw new http.MethodNotAllowed()
 
-    return await method.endpoint
+    return (await method.endpoint
       .call(context, parameters)
-      .catch(rethrow) as http.OutgoingMessage
+      .catch(rethrow)) as http.OutgoingMessage
+  }
+
+  private async explain(
+    context: http.Context,
+    node: Node,
+    parameters: Parameter[]
+  ): Promise<http.OutgoingMessage> {
+    const { described, methods } = await node.explain(describing(context), parameters)
+    const verbs = Object.keys(methods)
+
+    // what a caller may not use is not a resource to them, and describing it would be the leak
+    if (verbs.length === 0 && Object.keys(node.methods).length > 0)
+      throw new http.Forbidden()
+
+    // what the resource is, beside the methods it serves; a verb is upper case and cannot
+    // collide with either key
+    return {
+      body: { ...described, ...methods },
+      headers: new Headers({ allow: verbs.join(', ') })
+    }
   }
 
-  private async discover (): Promise<void> {
+  private async discover(): Promise<void> {
+    const first = new Promise<void>((resolve) => {
+      this.resolveFirstMerge = resolve
+    })
+
     await this.broadcast.receive<Branch>('expose', this.merge.bind(this))
-    await this.broadcast.transmit<null>('ping', null)
+
+    void this.knock()
+
+    await this.settled(first)
   }
 
-  private merge (branch: Branch): void {
+  /**
+   * A single ping is enough only if every tenant is listening by then, which is
+   * not the case while the deployment is still rolling out.
+   */
+  private async knock(): Promise<void> {
+    for (const delay of KNOCK_DELAYS) {
+      if (this.stopped) return
+
+      if (delay > 0) await setTimeout(delay, undefined, { ref: false })
+
+      await this.ping()
+    }
+  }
+
+  private async ping(): Promise<void> {
+    if (this.stopped) return
+
+    this.lastPing = Date.now()
+
+    await this.broadcast
+      .transmit<null>('ping', null)
+      .catch((exception: Error) =>
+        console.error('Discovery ping failed', { message: exception.message })
+      )
+  }
+
+  private reping(): void {
+    if (Date.now() - this.lastPing < PING_COOLDOWN) return
+
+    void this.ping()
+  }
+
+  private async settled(first: Promise<void>): Promise<void> {
+    const deadline = Date.now() + SETTLE_TIMEOUT
+    const abort = new AbortController()
+
+    // an uncancelled timer keeps the process alive long after the race is won
+    await Promise.race([
+      first,
+      setTimeout(SETTLE_TIMEOUT, undefined, { signal: abort.signal })
+    ])
+      .finally(() => {
+        abort.abort()
+      })
+      .catch(() => {})
+
+    if (this.lastMerge === 0) {
+      console.warn('Discovery timed out waiting for the first expose')
+
+      return
+    }
+
+    while (Date.now() - this.lastMerge < this.quiet()) {
+      if (Date.now() >= deadline) break
+
+      await setTimeout(SETTLE_POLL)
+    }
+  }
+
+  /**
+   * How long the branches must stay quiet before discovery counts as settled.
+   *
+   * Every tenant of a local composition answers the first ping at once, so a short window
+   * is enough; a rolling deployment brings them up seconds apart, and the window grows with
+   * the widest gap seen so far to keep waiting for the ones still starting.
+   */
+  private quiet(): number {
+    const adaptive = this.widestGap * SETTLE_QUIET_FACTOR
+
+    return Math.min(Math.max(adaptive, SETTLE_QUIET_MIN), SETTLE_QUIET_MAX)
+  }
+
+  private merge(branch: Branch): void {
+    const id = branch.namespace + '.' + branch.component
+
+    const attributes = {
+      namespace: branch.namespace,
+      component: branch.component,
+      version: branch.version
+    }
+
+    const exposed = this.branches.get(id)
+
+    if (exposed !== undefined)
+      switch (decide(exposed, branch)) {
+        // rebuilding an identical branch would only tear down its live endpoints
+        case 'refresh':
+          this.tree.refresh(exposed.nodes)
+          console.trace('Branch refreshed', attributes)
+
+          return
+
+        case 'superseded':
+          console.debug('Branch superseded', {
+            ...attributes,
+            timestamp: branch.timestamp,
+            exposed: exposed.timestamp
+          })
+
+          return
+      }
+
+    let nodes: Node[]
+
     try {
-      this.tree.merge(branch.node, branch)
+      nodes = this.tree.merge(branch.node, branch)
+    } catch (exception: unknown) {
+      const message = exception instanceof Error ? exception.message : 'Unknown error'
+
+      console.error('Branch merge exception', { message, ...attributes })
 
-      console.info('Resource branch of ' +
-        `'${branch.namespace}.${branch.component}' has been merged`)
-    } catch (exception) {
-      console.error(exception)
+      return
     }
+
+    this.branches.set(id, { version: branch.version, timestamp: branch.timestamp, nodes })
+
+    if (this.lastMerge !== 0)
+      this.widestGap = Math.max(this.widestGap, Date.now() - this.lastMerge)
+
+    this.lastMerge = Date.now()
+    this.resolveFirstMerge?.()
+    this.resolveFirstMerge = null
+
+    console.info('Branch merged', attributes)
   }
 }
 
 export type Broadcast = bindings.Broadcast<Label>
+
+const SETTLE_QUIET_MIN = 500
+const SETTLE_QUIET_MAX = 10_000
+const SETTLE_QUIET_FACTOR = 2
+const SETTLE_TIMEOUT = 30_000
+const SETTLE_POLL = 50
+const KNOCK_DELAYS = [0, 500, 1000, 1500]
+const PING_COOLDOWN = 5_000

package/source/HTTP/Context.ts

@@ -1,89 +1,143 @@
+import { buffer } from 'node:stream/consumers'
 import Negotiator from 'negotiator'
-import { Timing } from './Timing'
-import { type Format, formats, types } from './formats'
-import { read } from './messages'
-import type { OutgoingMessage } from './messages'
-import type * as http from 'node:http'
+import { console } from 'openspan'
+import { Timing } from './Timing.js'
+import { type Format, formats, types } from './formats/index.js'
+import { read } from './messages.js'
+import { address } from './address.js'
+import type { OutgoingMessage } from './messages.js'
+import type { IncomingMessage } from './types.js'
 
 export class Context {
   public readonly authority: string
   public readonly request: IncomingMessage
+
+  /** the client address, read as the deployment says; none otherwise, see `documentation/ip.md` */
+  public readonly ip: string | undefined
   public readonly url: URL
   public readonly subtype: string | null = null
   public readonly encoder: Format | null = null
   public readonly timing: Timing
-  public readonly debug: boolean
+
+  /**
+   * Whether this is a procedure a request made, rather than the request. What forks one
+   * says so, and a directive that answers differently to a procedure than to a request
+   * reads it here.
+   */
+  public readonly procedural: boolean = false
+
+  /**
+   * Whether this describes a resource rather than calling one. What builds a describing
+   * context says so, and a directive that answers differently to a description than to a
+   * call reads it here.
+   */
+  public readonly exploratory: boolean = false
 
   public readonly pipelines: Pipelines = {
     body: [],
     response: []
   }
 
-  public constructor (authority: string, request: IncomingMessage, properties: Properties) {
+  private consumed = false
+
+  // eslint-disable-next-line max-params
+  public constructor(
+    authority: string,
+    request: IncomingMessage,
+    properties: Properties,
+    url: URL
+  ) {
     this.authority = authority
     this.request = request
+    this.ip = address(request, properties.ip)
 
-    this.url = new URL(request.url, `https://${request.headers.host}`)
-    this.timing = new Timing(properties.trace)
-    this.debug = properties.debug
+    // parsed by the server, which had to parse it anyway to know the request is valid
+    this.url = url
+    this.timing = new Timing()
+    this.log(request)
 
-    if (this.debug)
-      this.log(request)
+    const accept = this.request.headers.accept
 
-    if (this.request.headers.accept !== undefined) {
-      const match = SUBTYPE.exec(this.request.headers.accept)
+    if (accept !== undefined) {
+      const match = SUBTYPE.exec(accept)
 
       if (match !== null) {
-        const {
-          type,
-          subtype,
-          suffix
-        } = match.groups!
+        const { type, subtype, suffix } = match.groups!
 
         this.request.headers.accept = `${type}/${suffix}`
         this.subtype = subtype
       }
     }
 
-    const negotiator = new Negotiator(this.request)
-    const mediaType = negotiator.mediaType(types)
+    const encoder = negotiate(this.request)
 
-    if (mediaType !== undefined)
-      this.encoder = formats[mediaType]
+    if (encoder !== undefined) this.encoder = encoder
   }
 
-  public async body<T> (): Promise<T> {
-    const value = await read(this)
+  public async buffer(): Promise<Buffer> {
+    this.consumed = true
 
-    return this.pipelines.body.length === 0
-      ? value
-      : this.pipelines.body.reduce((value, transform) => transform(value), value)
+    return await buffer(this.request)
   }
 
-  private log (request: IncomingMessage): void {
-    const message = `${request.method} ${request.url}`
-    const { authorization, ...headers } = request.headers
+  public async body<T>(): Promise<T> {
+    let value = this.consumed ? null : await read(this)
 
-    if (authorization !== undefined)
-      headers.authorization = authorization.slice(0, authorization.indexOf(' '))
+    for (const transform of this.pipelines.body) value = await transform(value)
 
-    console.debug(message, headers)
+    return value
   }
-}
 
-export interface IncomingMessage extends http.IncomingMessage {
-  url: string
-  method: string
+  private log(request: IncomingMessage): void {
+    // built only when the line is written, which at `info` it is not
+    console.debug('Received request', () => {
+      const headers = { ...request.headers }
+
+      if (headers.authorization !== undefined)
+        headers.authorization = SCHEME.exec(headers.authorization)?.[1] ?? '[malformed]'
+
+      return { method: request.method, url: request.url, headers }
+    })
+  }
 }
 
+/** The scheme of an `authorization` header; the value after it is a credential. */
+const SCHEME = /^(\w{1,32})(?: |$)/
+
 interface Pipelines {
   body: Array<(input: unknown) => unknown>
-  response: Array<(output: OutgoingMessage) => void>
+  response: Array<(output: OutgoingMessage) => void | Promise<void>>
 }
 
 interface Properties {
-  debug: boolean
-  trace: boolean
+  /** the header the client address is read from; the connection's without one */
+  ip?: string
 }
 
-const SUBTYPE = /^(?<type>\w{1,32})\/(vnd\.toa\.(?<subtype>\S{1,32})\+)(?<suffix>\S{1,32})$/
+/**
+ * Negotiation parses the header and sorts the candidates, and the value repeats:
+ * clients send one of a handful of `accept` strings. Bounded, the header is theirs.
+ */
+function negotiate(request: IncomingMessage): Format | undefined {
+  const accept = request.headers.accept ?? ''
+  const known = NEGOTIATED.get(accept)
+
+  if (known !== undefined) return known === NONE ? undefined : known
+
+  const mediaType = new Negotiator(request).mediaType(types)
+  const encoder = mediaType === undefined ? undefined : formats[mediaType]
+
+  if (NEGOTIATED.size >= NEGOTIATED_LIMIT) NEGOTIATED.clear()
+
+  NEGOTIATED.set(accept, encoder ?? NONE)
+
+  return encoder
+}
+
+/** distinguishes "negotiated to nothing" from "not negotiated yet" */
+const NONE = Symbol('not acceptable') as unknown as Format
+const NEGOTIATED = new Map<string, Format>()
+const NEGOTIATED_LIMIT = 1024
+
+const SUBTYPE =
+  /^(?<type>\w{1,32})\/(vnd\.toa\.(?<subtype>\S{1,32})\+)(?<suffix>\S{1,32})$/