@toa.io/extensions.exposition 1.0.0-alpha.291 → 1.0.0-alpha.293

package/features/cache.feature

@@ -1,368 +0,0 @@
-@security
-Feature: Caching
-
-  Background:
-    Given the `identity.basic` database contains:
-      # developer:secret
-      # user:12345
-      | _id                              | authority | username  | password                                                     |
-      | b70a7dbca6b14a2eaac8a9eb4b2ff4db | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    Given the `identity.roles` database contains:
-      | _id                              | identity                         | role      |
-      | 775a648d054e4ce1a65f8f17e5b51803 | b70a7dbca6b14a2eaac8a9eb4b2ff4db | developer |
-
-  Scenario: Default caching
-    Given the annotation:
-      """yaml
-      /:
-        anonymous: true
-        GET:
-          dev:stub: foo
-        /private:
-          auth:role: developer
-          GET:
-            dev:stub: bar
-      """
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      """
-    Then the reply does not contain:
-      """
-      cache-control:
-      """
-    When the following request is received:
-      """
-      GET /private/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      cache-control: no-store
-      """
-
-  Scenario: Caching successful response
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        anonymous: true
-        GET:
-          cache:control: max-age=60000
-          dev:stub: hello
-      """
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: max-age=60000
-      content-type: text/plain
-
-      hello
-      """
-
-  Scenario: Nested cache directives
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        cache:control: max-age=30000
-        GET:
-          anonymous: true
-          dev:stub: hello
-        /foo:
-          auth:role: developer
-          GET:
-            dev:stub: hello
-        /bar:
-          auth:role: developer
-          cache:control: max-age=60000, public
-          GET:
-            dev:stub: hello
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      cache-control: no-store
-      """
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: max-age=30000
-      content-type: text/plain
-
-      hello
-      """
-    When the following request is received:
-      """
-      GET /foo/ HTTP/1.1
-      host: nex.toa.io
-      accept: text/plain
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: private, max-age=30000
-      content-type: text/plain
-
-      hello
-      """
-    When the following request is received:
-      """
-      GET /bar/ HTTP/1.1
-      host: nex.toa.io
-      accept: text/plain
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: no-cache, max-age=60000, public
-      content-type: text/plain
-
-      hello
-      """
-    And the reply does not contain:
-      """
-      cache-control: private, max-age=30000
-      """
-
-  Scenario: Cache-control is not added when request is unsafe
-    Given the annotation:
-      """yaml
-      /:
-        anonymous: true
-        cache:control: max-age=60000
-        POST:
-          dev:stub: hello
-      """
-    When the following request is received:
-      """
-      POST / HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      """
-    Then the reply does not contain:
-      """
-      cache-control: max-age=60000
-      """
-
-  Scenario: Cache-control is added without implicit modifications
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        auth:role: developer
-        cache:exact: max-age=60000, public
-        GET:
-          dev:stub: hello
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      cache-control: no-store
-      """
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      accept: text/plain
-
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: max-age=60000, public
-      content-type: text/plain
-
-      hello
-      """
-
-  Scenario: Response without caching
-    Given the annotation:
-      """yaml
-      /:
-        anonymous: true
-        GET:
-          dev:stub: hello
-      """
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      accept: text/plain
-      """
-    Then the reply does not contain:
-      """
-      cache-control:
-      """
-
-  Scenario: Private responses are sent with `vary: authorization`
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    And the annotation:
-      """yaml
-      /:
-        /:id:
-          auth:id: id
-          cache:control: max-age=10000
-          GET:
-            dev:stub: Keep it
-        /sessions/:id:
-          auth:id: id
-          GET:
-            dev:stub: Keep it
-      """
-    When the following request is received:
-      """
-      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      cache-control: no-store
-      """
-    When the following request is received:
-      """
-      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: private, max-age=10000
-      vary: authorization
-      """
-    When the following request is received:
-      """
-      GET /sessions/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: private
-      vary: authorization
-      """
-
-  Scenario: Authenticated `no-cache` responses
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    And the annotation:
-      """yaml
-      /:
-        /:id:
-          auth:id: id
-          cache:control: no-cache
-          GET:
-            dev:stub: Keep it
-      """
-    When the following request is received:
-      """
-      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    # no-store since the response contains the token
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      cache-control: no-store
-      """
-    When the following request is received:
-      """
-      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    # private is added since the response is authenticated
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: private, no-cache
-      """
-
-  Scenario: An exact value is set whatever the method
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        /tokens/:
-          anonymous: true
-          cache:exact: no-store
-          POST:
-            dev:stub: issued
-      """
-    When the following request is received:
-      """
-      POST /tokens/ HTTP/1.1
-      host: nex.toa.io
-      accept: text/plain
-      """
-    # whether a reply may be stored is not a question about the method's cacheability
-    Then the following reply is sent:
-      """
-      201 Created
-      cache-control: no-store
-      """
-
-  Scenario: Cacheability is still asked of safe methods only
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        /notes/:
-          anonymous: true
-          cache:control: max-age=60000, public
-          POST:
-            dev:stub: created
-      """
-    When the following request is received:
-      """
-      POST /notes/ HTTP/1.1
-      host: nex.toa.io
-      accept: text/plain
-      """
-    Then the reply does not contain:
-      """
-      cache-control:
-      """

package/features/configuration.feature

@@ -1,206 +0,0 @@
-@security
-Feature: Configuration values
-
-  The values component declares how it is exposed in its own manifest, and that manifest
-  is what this mounts. Reading takes `system:configuration:get`, creating takes
-  `system:configuration:create`, and the one who creates is recorded as the originator.
-
-  Background:
-    # developer:secret, user:12345
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-      | e8e4f9c2a68d419b861403d71fabc915 | nex       | user      | $2b$10$Frszmrmsz9iwSXzBbRRMKeDVKsNxozkrLNSsN.SnVC.KPxLtQr/bK |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role                     |
-      | 1c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | efe3a65ebbee47ed95a73edd911ea328 | system:configuration     |
-      | 2c0b2a3d4e5f4a6b8c7d9e0f1a2b3c4d | e8e4f9c2a68d419b861403d71fabc915 | system:configuration:get |
-    And the `identity.bans` database is empty
-    And the `configuration.values` database is empty
-    And the configuration values are deployed:
-      """yaml
-      dummies.dummy:
-        epoch: e1
-        schema:
-          type: object
-          properties:
-            foo:
-              type: string
-            bar:
-              type: string
-        defaults:
-          foo: deployed
-          bar: world
-      """
-    And the configuration values are running
-
-  Scenario: Reading the deployed configuration
-    When the following request is received:
-      """
-      GET /configuration/values/dummies.dummy/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjoxMjM0NQ==
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-type: application/yaml
-
-      configuration:
-        foo: deployed
-        bar: world
-      schema:
-        type: object
-        properties:
-          foo:
-            type: string
-          bar:
-            type: string
-      epoch: e1
-      """
-
-  Scenario: Listing the configurations
-    When the following request is received:
-      """
-      GET /configuration/values/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjoxMjM0NQ==
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-type: application/yaml
-
-      - component: dummies.dummy
-        epoch: e1
-        schema:
-          type: object
-          properties:
-            foo:
-              type: string
-            bar:
-              type: string
-        configuration:
-          foo: deployed
-          bar: world
-      """
-
-  Scenario: Listing without the role
-    When the following request is received:
-      """
-      GET /configuration/values/ HTTP/1.1
-      host: nex.toa.io
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: Reading without the role
-    When the following request is received:
-      """
-      GET /configuration/values/dummies.dummy/ HTTP/1.1
-      host: nex.toa.io
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: Reading the configuration of an unknown component
-    When the following request is received:
-      """
-      GET /configuration/values/dummies.unknown/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      404 Not Found
-      """
-
-  Scenario: Creating configuration
-    When the following request is received:
-      """
-      POST /configuration/values/dummies.dummy/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: application/yaml
-      content-type: application/yaml
-
-      configuration:
-        foo: created
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      content-type: application/yaml
-
-      epoch: e1
-      """
-    When the following request is received:
-      """
-      GET /configuration/values/dummies.dummy/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjoxMjM0NQ==
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-type: application/yaml
-
-      configuration:
-        foo: created
-      epoch: e1
-      """
-
-  Scenario: Creating configuration without the role
-    When the following request is received:
-      """
-      POST /configuration/values/dummies.dummy/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjoxMjM0NQ==
-      content-type: application/yaml
-
-      configuration:
-        foo: created
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: Creating configuration not fitting the schema
-    When the following request is received:
-      """
-      POST /configuration/values/dummies.dummy/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-
-      configuration:
-        foo:
-          nested: true
-      """
-    Then the following reply is sent:
-      """
-      422 Unprocessable Entity
-      """
-
-  Scenario: Creating configuration for an unknown component
-    When the following request is received:
-      """
-      POST /configuration/values/dummies.unknown/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-
-      configuration: {}
-      """
-    Then the following reply is sent:
-      """
-      422 Unprocessable Entity
-      """

package/features/cors.feature

@@ -1,127 +0,0 @@
-@security
-Feature: CORS Support
-
-  Scenario: Basic CORS permissions
-    Given the annotation:
-      """yaml
-      /:
-        anonymous: true
-        /foo:
-          GET:
-            dev:stub: Hello
-      """
-    When the following request is received:
-      """
-      OPTIONS / HTTP/1.1
-      access-control-request-method: GET
-      host: nex.toa.io
-      origin: https://hello.world
-      """
-    Then the following reply is sent:
-      """
-      204 No Content
-      access-control-allow-credentials: true
-      access-control-allow-headers: accept, authorization, content-type, if-match, if-none-match
-      access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, LOCK, UNLOCK, OPTIONS
-      access-control-allow-origin: https://hello.world
-      access-control-max-age: 3600
-      cache-control: max-age=3600
-      vary: origin
-      """
-    When the following request is received:
-      """
-      GET /foo/ HTTP/1.1
-      host: nex.toa.io
-      origin: https://hello.world
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      access-control-allow-credentials: true
-      access-control-allow-origin: https://hello.world
-      access-control-expose-headers: authorization, content-type, content-length, date, etag, last-modified
-      vary: origin
-      """
-
-  Scenario: An OPTIONS that is not a preflight
-    A preflight is `OPTIONS` carrying `Access-Control-Request-Method`, and only that. A
-    browser puts `Origin` on every request whose method is not `GET` or `HEAD`, its own
-    `OPTIONS` included — so one answered as a preflight is a resource no page can introspect.
-
-    Given the annotation:
-      """yaml
-      /:
-        anonymous: true
-        /foo:
-          io:output: true
-          GET:
-            dev:stub: Hello
-      """
-    When the following request is received:
-      """
-      OPTIONS /foo/ HTTP/1.1
-      host: nex.toa.io
-      origin: https://hello.world
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      access-control-allow-origin: https://hello.world
-      Allow: GET
-      vary: origin
-      """
-
-  Scenario: Always vary CORS
-    Given the annotation:
-      """yaml
-      /:
-        anonymous: true
-        GET:
-          dev:stub: hello
-      """
-    When the following request is received:
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      vary: origin
-      """
-
-  Scenario: Errors have CORS headers
-    Given the annotation:
-      """yaml
-      /:
-        /foo:
-          GET:
-            dev:stub: Hello
-      """
-    When the following request is received:
-      """
-      GET /bar/ HTTP/1.1
-      host: nex.toa.io
-      origin: https://hello.world
-      """
-    Then the following reply is sent:
-      """
-      404 Not Found
-      access-control-allow-origin: https://hello.world
-      access-control-expose-headers: authorization, content-type, content-length, date, etag, last-modified
-      vary: origin
-      """
-    When the following request is received:
-      """
-      GET /foo/ HTTP/1.1
-      host: nex.toa.io
-      origin: https://hello.world
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      access-control-allow-origin: https://hello.world
-      access-control-expose-headers: authorization, content-type, content-length, date, etag, last-modified
-      vary: origin
-      """