@toa.io/extensions.exposition 1.0.0-alpha.291 → 1.0.0-alpha.293

package/features/identity.feature

@@ -1,240 +0,0 @@
-Feature: Identity resource
-
-  Scenario: Requesting own Identity
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role            |
-      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | efe3a65ebbee47ed95a73edd911ea328 | developer       |
-      | 88ec8e348a5c48aaa2d25faa904cd9ff | efe3a65ebbee47ed95a73edd911ea328 | system:identity |
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ User.token }}
-
-      id: efe3a65ebbee47ed95a73edd911ea328
-      roles:
-        - developer
-        - system:identity
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ User.token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ User.id }}
-      roles:
-        - developer
-        - system:identity
-      """
-    # checking that it returns the same id for given token
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ User.token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ User.id }}
-      roles:
-        - developer
-        - system:identity
-      """
-
-  Scenario: Getting transient Identity
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      authorization: Token ${{ token }}
-
-      id: ${{ id }}
-      roles: []
-      """
-
-  Scenario: Requesting Identity with non-existent credentials
-    Given the `identity.basic` database is empty
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjpwYXNzMTIzNA==
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: Authenticating with a scheme named after an object property
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Constructor abc
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: __proto__ abc
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: Failing authentication repeatedly
-    Given the annotation:
-      """yaml
-      ip: x-real-ip
-      bouncer:
-        attempts: 2
-        interval: 60
-      """
-    # developer:wrong
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      x-real-ip: 203.0.113.9
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      x-real-ip: 203.0.113.9
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-    # the address has spent its attempts, and earns one back in interval / attempts seconds
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      x-real-ip: 203.0.113.9
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      """
-    Then the following reply is sent:
-      """
-      429 Too Many Requests
-      retry-after: 30
-      """
-    # a request without credentials is not metered
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """
-
-  Scenario: Failing authentication behind a trusted proxy
-    Given the annotation:
-      """yaml
-      ip: x-real-ip
-      bouncer:
-        attempts: 1
-        interval: 60
-      """
-    # developer:wrong
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      x-real-ip: 203.0.113.1
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      x-real-ip: 203.0.113.1
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      """
-    Then the following reply is sent:
-      """
-      429 Too Many Requests
-      """
-    # another address, as the proxy reports it
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      x-real-ip: 203.0.113.2
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: Failing authentication without a client address
-    Given the annotation:
-      """yaml
-      ip: x-real-ip
-      bouncer:
-        attempts: 1
-        interval: 60
-      """
-    # the header the address is read from is not sent, so nothing is metered
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOndyb25n
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """

package/features/identity.federation.feature

@@ -1,396 +0,0 @@
-@security
-Feature: Identity Federation
-
-  Background:
-    Given the `identity.federation` database is empty
-    And local IDP is running
-
-  Scenario: Asymmetric tokens
-    Given the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:31005
-          aud: test
-      """
-    And the IDP token for User is issued
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ User.id_token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ User.token }}
-
-      id: ${{ User.id }}
-      roles: []
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      authorization: Token ${{ User.token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ User.id }}
-      """
-    # ensuring identity idempotency
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ User.id_token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ User.id }}
-      """
-    # credential id is detached from the Identity
-    When the following request is received:
-      """
-      GET /identity/federation/${{ User.id }}/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ User.id_token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      - id: ${{ User.credential }}
-        iss: http://localhost:31005
-      """
-
-  Scenario: Creating an Identity using inception
-    Given the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:31005
-          aud: test
-      assert: false
-      """
-    Given the `users` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          anonymous: true
-          POST:
-            io:output: [id]
-            auth:incept: id
-            endpoint: create
-      """
-    And the IDP token for Bill is issued
-    When the following request is received:
-      # identity inception
-      """
-      POST /users/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bill.id_token }}
-      accept: application/yaml
-      content-type: application/yaml
-
-      name: Bill Smith
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      authorization: Token ${{ Bill.token }}
-
-      id: ${{ Bill.id }}
-      """
-    # check that both tokens authenticate the created user's Identity
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ Bill.token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ Bill.id }}
-      roles: []
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bill.id_token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ Bill.id }}
-      roles: []
-      """
-    # credential id is detached from the Identity
-    When the following request is received:
-      """
-      GET /identity/federation/${{ Bill.id }}/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bill.id_token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      - id: ${{ Bill.credential }}
-        iss: http://localhost:31005
-      """
-    And the following request is received:
-      # same credentials
-      """
-      POST /users/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bill.id_token }}
-      content-type: application/yaml
-
-      name: Mary Louis
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: Granting a `system` role to a Principal
-    Given the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:31005
-          aud: test
-      principal:
-        authority: nex
-        iss: http://localhost:31005
-        sub: root
-      """
-    And the IDP token for root is issued
-
-    # create an identity
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ root.id_token }}
-      accept: application/yaml
-      content-type: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ root.token }}
-
-      id: ${{ root.id }}
-      """
-
-    # the Role is granted before the reply, so the Token that reply carries holds it
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      authorization: Token ${{ root.token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ root.id }}
-      roles:
-        - system
-      """
-
-  Scenario: Adding federation to an existing identity
-    Given the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:31005
-          aud: test
-      """
-    And the `identity.basic` database is empty
-
-    # create an identity
-    When the following request is received:
-      """
-      POST /identity/basic/ HTTP/1.1
-      host: nex.toa.io
-      content-type: application/yaml
-      accept: application/yaml
-
-      username: #{{ id | set Bob.username }}
-      password: #{{ password 8 | set Bob.password }}
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      id: ${{ Bob.id }}
-      """
-
-    When the IDP token for Bob is issued
-
-    # add federation
-    When the following request is received:
-      """
-      POST /identity/federation/${{ Bob.id }}/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic #{{ basic Bob }}
-      content-type: application/yaml
-      accept: application/yaml
-
-      scheme: bearer
-      credentials: ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      id: ${{ Bob.credential }}
-      iss: http://localhost:31005
-      """
-    # the created credential is listed as is
-    When the following request is received:
-      """
-      GET /identity/federation/${{ Bob.id }}/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic #{{ basic Bob }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      - id: ${{ Bob.credential }}
-        iss: http://localhost:31005
-      """
-    And the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bob.id_token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ Bob.id }}
-      """
-    # delete the federation credential
-    When the following request is received:
-      """
-      DELETE /identity/federation/${{ Bob.id }}/${{ Bob.credential }}/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic #{{ basic Bob }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    # add the same federation again
-    When the following request is received:
-      """
-      POST /identity/federation/${{ Bob.id }}/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic #{{ basic Bob }}
-      content-type: application/yaml
-      accept: application/yaml
-
-      scheme: bearer
-      credentials: ${{ Bob.id_token }}
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """
-    And the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Bearer ${{ Bob.id_token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: ${{ Bob.id }}
-      """
-
-  Scenario: Authorization code flow with secret
-    Given the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:31005
-          aud: nex
-          secret: $IDP_SECRET
-      """
-    And the configuration secrets:
-      """yaml
-      IDP_SECRET: secret
-      """
-    And auth code for Alice is issued for https://web.toa.io/callback/
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      authorization: Code ${{ Alice.code_credentials }}
-      host: nex.toa.io
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ Alice.token }}
-
-      id: ${{ Alice.id }}
-      """
-
-  Scenario: Authorization code flow with signature
-    Given the `identity.federation` configuration:
-      """yaml
-      trust:
-        - iss: http://localhost:31005
-          aud: nex
-          signature:
-            iss: io.toa.nex.id
-            kid: key-id
-            key: $IDP_KEY
-      """
-    And the configuration secrets:
-      """yaml
-      IDP_KEY: |
-        -----BEGIN PRIVATE KEY-----
-        MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg9x9DatwH0GZHSCo9
-        TMHTVXyeY0YQ8qb73jHV2v4MsyehRANCAAQwaYlna2hSV3G/RIlNLV41lg8Pm4Kf
-        HfCuKKiw3BIJTnSArAMJLSy1vYwSIMHz720mkmWTrWuQkkjvkDpZxfRv
-        -----END PRIVATE KEY-----
-      """
-    And auth code for Bob is issued for https://web.toa.io/callback/
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      authorization: Code ${{ Bob.code_credentials }}
-      host: nex.toa.io
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ Bob.token }}
-
-      id: ${{ Bob.id }}
-      """