@toa.io/extensions.exposition 1.0.0-alpha.291 → 1.0.0-alpha.293

package/features/auth.bearer.feature

@@ -1,120 +0,0 @@
-@security
-Feature: More than one provider claims Bearer
-
-  An OpenID `id_token` and a token this gateway issued are both presented as `Bearer`,
-  and only their own provider can verify either. The gateway asks each in turn.
-
-  Background:
-    Given local IDP is running
-    And the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        /hello/:id:
-          auth:id: id
-          GET:
-            dev:stub: Hello
-      """
-
-  Scenario: A token this gateway issued is presented as Bearer
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      content-type: text/plain
-
-      Hello
-      """
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ token }}
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-type: text/plain
-
-      Hello
-      """
-    # the token was answered by its own provider, so nothing rotates it
-    And the reply does not contain:
-      """
-      authorization: Token
-      """
-
-  Scenario: A Bearer this gateway did not issue is answered by federation
-    Given the IDP token for Stranger is issued
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Stranger.id_token }}
-      accept: text/plain
-      """
-    # `identity.tokens` declines it, and federation rejects an issuer it does not trust
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: A malformed Bearer is rejected, not an error
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer not.a.token
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: Both kinds of Bearer against one authority
-    Given the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:31005
-          aud: test
-      """
-    And the IDP token for User is issued
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ User.id_token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ federated }}
-
-      id: ${{ User.id }}
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ federated }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ User.id }}
-      """

package/features/auth.claims.feature

@@ -1,171 +0,0 @@
-@security
-Feature: Federated identity authentication
-
-  Background:
-    Given the `identity.federation` database is empty
-    And local IDP is running
-    And the IDP token for Bob is issued
-    And the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:31005
-          aud: test
-      """
-
-  Scenario: Full claim
-    Given the annotation:
-      """yaml
-      /:
-        GET:
-          auth:claims:
-            iss: http://localhost:31005
-            aud: test
-            sub: Bob
-          dev:stub: ok
-      """
-
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-  Scenario: Only `sub`
-    Given the annotation:
-      """yaml
-      /:
-        GET:
-          auth:claims:
-            sub: Bob
-          dev:stub: ok
-      """
-
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-  Scenario: No `sub`
-    Given the annotation:
-      """yaml
-      /:
-        GET:
-          auth:claims:
-            iss: http://localhost:31005
-            aud: test
-          dev:stub: ok
-      """
-
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-  Scenario: `sub` mismatch
-    Given the annotation:
-      """yaml
-      /:
-        GET:
-          auth:claims:
-            iss: http://localhost:31005
-            sub: Alice
-          dev:stub: ok
-      """
-
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: `aud` mismatch
-    Given the annotation:
-      """yaml
-      /:
-        GET:
-          auth:claims:
-            iss: http://localhost:31005
-            aud: goalkeepers
-          dev:stub: ok
-      """
-
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: Matching authority and Route parameter
-    Given the annotation:
-      """yaml
-      authorities:
-        test: the.test.local
-      /:
-        /:id:
-          GET:
-            auth:claims:
-              aud: :authority
-              sub: /:id
-            dev:stub: ok
-      """
-
-    When the following request is received:
-      """
-      GET /Bob/ HTTP/1.1
-      host: the.test.local
-      authorization: Bearer ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-  Scenario: `iss` matching authority common domain
-    Given the annotation:
-      """yaml
-      /:
-        /:id:
-          GET:
-            auth:claims:
-              iss: :domain
-              sub: /:id
-            dev:stub: ok
-      """
-
-    When the following request is received:
-      """
-      GET /Bob/ HTTP/1.1
-      host: localhost
-      authorization: Bearer ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """

package/features/auth.incept.feature

@@ -1,166 +0,0 @@
-Feature: Identity inception
-
-  Scenario: Non-associated Identity inception
-    Given the `identity.basic` database is empty
-    When the following request is received:
-      """
-      POST /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjpwYXNzMTIzNA==
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      authorization: Token ${{ token }}
-
-      id: ${{ id }}
-      roles: []
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjpwYXNzMTIzNA==
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ id }}
-      roles: []
-      """
-
-  Scenario: Creating new Identity using inception with Basic scheme
-    Given the `users` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          POST:
-            io:input: [name]
-            io:output: true
-            incept: id
-            query: ~
-            endpoint: transit
-      """
-    When the following request is received:
-      """
-      POST /users/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic #{{ basic }}
-      accept: application/yaml
-      content-type: application/yaml
-
-      name: Bill Smith
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      authorization: Token ${{ token }}
-
-      id: ${{ id }}
-      """
-
-  Scenario: Inception with operation error
-    Given the `users` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          POST:
-            io:input: [name]
-            io:output: true
-            incept: id
-            endpoint: create
-      """
-    When the following request is received:
-      """
-      POST /users/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic #{{ basic }}
-      accept: application/yaml
-      content-type: application/yaml
-
-      name: return_error
-      """
-    Then the following reply is sent:
-      """
-      422 Unprocessable Entity
-      """
-
-  Scenario: Incept without credentials
-    Given the `echo` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          POST:
-            auth:incept: id
-            io:output: true
-            query: ~
-            endpoint: echo
-      """
-    And transient identity
-    When the following request is received:
-      """
-      POST /echo/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      content-type: application/yaml
-
-      id: ${{ identity.id }}
-      foo: bar
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      authorization: Token ${{ token }}
-
-      id: ${{ identity.id }}
-      foo: bar
-      """
-
-  Scenario: Inception with a wrong password for existing credentials
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     | VERSION |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O | 1       |
-    And the `users` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          POST:
-            io:input: [name]
-            io:output: true
-            incept: id
-            query: ~
-            endpoint: transit
-      """
-    # developer:wrong
-    When the following request is received:
-      """
-      POST /users/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      accept: application/yaml
-      content-type: application/yaml
-
-      name: Bill Smith
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-    # a token that does not decrypt
-    When the following request is received:
-      """
-      POST /users/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token garbage
-      accept: application/yaml
-      content-type: application/yaml
-
-      name: Bill Smith
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """

package/features/auth.input.feature

@@ -1,59 +0,0 @@
-Feature: Input properties authorization
-
-  Background:
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username | password                                                     |
-      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | root     | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role  |
-      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | app:b |
-
-  Scenario: Input properties authorization
-    Given the `echo` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          io:input: [a, b]
-          io:output: [a, b]
-          anonymous: true
-          auth:role: app:b
-          auth:input:
-            - prop: b
-              role: app:b
-          PUT: parameters
-      """
-
-    When the following request is received:
-      """
-      PUT /echo/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      content-type: application/yaml
-
-      a: foo
-      b: bar
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-
-      Input property is not authorized
-      """
-    When the following request is received:
-      """
-      PUT /echo/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic cm9vdDpzZWNyZXQ=
-      accept: application/yaml
-      content-type: application/yaml
-
-      a: foo
-      b: bar
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      a: foo
-      b: bar
-      """

package/features/authorities.basic.feature

@@ -1,141 +0,0 @@
-Feature: Basic credentials with authorities
-
-  Scenario: Basic credentials are scoped to authorities
-    Given the annotation:
-      """yaml
-      authorities:
-        one: the.one.com
-        two: the.two.com
-      /:
-        /:id:
-          auth:id: id
-          io:output: true
-          GET:
-            dev:stub: Hello
-      """
-
-    # create basic credentials within the `one` authority
-    When the following request is received:
-      """
-      POST /identity/basic/ HTTP/1.1
-      host: the.one.com
-      content-type: application/yaml
-      accept: application/yaml
-
-      username: #{{ id | set one.username }}
-      password: #{{ password 8 | set one.password }}
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      id: ${{ one.id }}
-      """
-
-    # create basic credentials within the `two` authority
-    When the following request is received:
-      """
-      POST /identity/basic/ HTTP/1.1
-      host: the.two.com
-      content-type: application/yaml
-      accept: application/yaml
-
-      username: #{{ id | set two.username }}
-      password: #{{ password 8 | set two.password }}
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      id: ${{ two.id }}
-      """
-
-    # access the resource with the `one` authority
-    When the following request is received:
-      """
-      GET /${{ one.id }}/ HTTP/1.1
-      host: the.one.com
-      authorization: Basic #{{ basic one }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    When the following request is received:
-      """
-      GET /${{ two.id }}/ HTTP/1.1
-      host: the.one.com
-      authorization: Basic #{{ basic two }}
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-    # access the resource with the `two` authority
-    When the following request is received:
-      """
-      GET /${{ one.id }}/ HTTP/1.1
-      host: the.two.com
-      authorization: Basic #{{ basic one }}
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-    When the following request is received:
-      """
-      GET /${{ two.id }}/ HTTP/1.1
-      host: the.two.com
-      authorization: Basic #{{ basic two }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-    # create `one` credentials in the `two` authority
-    When the following request is received:
-      """
-      POST /identity/basic/ HTTP/1.1
-      host: the.one.com
-      content-type: application/yaml
-      accept: application/yaml
-
-      username: ${{ one.username }}
-      password: ${{ one.password }}
-      """
-    Then the following reply is sent:
-      """
-      409 Conflict
-      """
-    When the following request is received:
-      """
-      POST /identity/basic/ HTTP/1.1
-      host: the.two.com
-      content-type: application/yaml
-      accept: application/yaml
-
-      username: ${{ one.username }}
-      password: ${{ one.password }}
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """
-
-    # create `two` credentials in the `one` authority
-    When the following request is received:
-      """
-      POST /identity/basic/ HTTP/1.1
-      host: the.one.com
-      content-type: application/yaml
-      accept: application/yaml
-
-      username: ${{ two.username }}
-      password: ${{ two.password }}
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """