@toa.io/extensions.exposition 1.0.0-alpha.291 → 1.0.0-alpha.293

package/features/identity.tokens.custom.feature

@@ -1,430 +0,0 @@
-@security
-Feature: Custom tokens
-
-  Background:
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role      |
-      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | efe3a65ebbee47ed95a73edd911ea328 | app:notes |
-    And the `identity.keys` database is empty
-    And the annotation:
-      """yaml
-      /:
-        /notes:
-          auth:role: app:notes
-          GET:
-            io:output: true
-            dev:stub:
-              access: granted!
-          POST:
-            io:output: true
-            dev:stub:
-              access: granted!
-          /public:
-            GET:
-              auth:role: app:notes:public
-              io:output: true
-              dev:stub:
-                access: granted!
-      """
-
-  Scenario: Issuing a token
-    When the following request is received:
-      """
-      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-      accept: application/yaml
-
-      label: Dev token
-      lifetime: 600
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      kid: ${{ kid }}
-      exp: ${{ exp }}
-      token: ${{ token }}
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: efe3a65ebbee47ed95a73edd911ea328
-      """
-
-    # debug LRU cache
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-  Scenario: Issuing a token for another identity
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-      | e8e4f9c2a68d419b861403d71fabc915 | nex       | user      | $2b$10$Frszmrmsz9iwSXzBbRRMKeDVKsNxozkrLNSsN.SnVC.KPxLtQr/bK |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role                   |
-      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | efe3a65ebbee47ed95a73edd911ea328 | system:identity:tokens |
-    When the following request is received:
-      """
-      POST /identity/tokens/e8e4f9c2a68d419b861403d71fabc915/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-      accept: application/yaml
-
-      label: On behalf
-      lifetime: 600
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      token: ${{ token }}
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: e8e4f9c2a68d419b861403d71fabc915
-      """
-
-  Scenario: Token with restricted scopes
-    When the following request is received:
-      """
-      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: application/yaml
-      content-type: application/yaml
-
-      label: Production token
-      lifetime: 0
-      scopes: [app:notes:public]
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      token: ${{ token }}
-      """
-    When the following request is received:
-      """
-      GET /notes/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-    When the following request is received:
-      """
-      GET /notes/public/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-  Scenario: Token with restricted permissions
-    When the following request is received:
-      """
-      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: application/yaml
-      content-type: application/yaml
-
-      label: Restricted token
-      lifetime: 0
-      permissions:
-        /notes/: [GET]
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      token: ${{ token }}
-      """
-    When the following request is received:
-      """
-      GET /notes/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-    # method is not permitted
-    When the following request is received:
-      """
-      POST /notes/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-    # resource is not permitted
-    When the following request is received:
-      """
-      GET /notes/public/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: Token revocation
-    Given the `identity.tokens` configuration:
-      """yaml
-      cache:
-        ttl: 1
-      """
-    When the following request is received:
-      """
-      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: application/yaml
-      content-type: application/yaml
-
-      label: One-time token
-      lifetime: 60
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      token: ${{ token }}
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: efe3a65ebbee47ed95a73edd911ea328
-      """
-    When the following request is received:
-      """
-      GET /identity/keys/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      - id: ${{ kid }}
-        CREATED: ${{ created }}
-        label: One-time token
-        expires: ${{ expires }}
-      """
-    When the following request is received:
-      """
-      DELETE /identity/keys/efe3a65ebbee47ed95a73edd911ea328/${{ kid }}/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    And after 1 second
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: Custom token is not refreshed
-    Given the `identity.tokens` configuration:
-      """yaml
-      refresh: 1
-      """
-    When the following request is received:
-      """
-      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: application/yaml
-      content-type: application/yaml
-
-      label: Restricted token
-      lifetime: 600
-      permissions:
-        /notes/: [GET]
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      token: ${{ token }}
-      """
-    And after 1 second
-    When the following request is received:
-      """
-      GET /notes/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    And the reply does not contain:
-      """
-      authorization: Token
-      """
-    When the following request is received:
-      """
-      GET /notes/public/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: Permissions apply to the path the request is routed by
-    When the following request is received:
-      """
-      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: application/yaml
-      content-type: application/yaml
-
-      label: Public notes token
-      lifetime: 0
-      permissions:
-        /notes/public/: [GET]
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      token: ${{ token }}
-      """
-
-    # the query string is not part of the path
-    When the following request is received:
-      """
-      GET /notes/public/?page=2 HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-  Scenario: Changing the password revokes custom tokens
-    Given the `identity.basic` database contains:
-      | _id                              | VERSION | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | 1       | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    And the `identity.tokens` configuration:
-      """yaml
-      cache:
-        ttl: 1
-      """
-    When the following request is received:
-      """
-      POST /identity/tokens/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: application/yaml
-      content-type: application/yaml
-
-      label: Forever token
-      lifetime: 0
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      token: ${{ token }}
-      """
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    When the following request is received:
-      """
-      PATCH /identity/basic/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-
-      password: new-secret
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    # the runtime forgets the key after `cache.ttl`
-    Then after 1.5 seconds
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """

package/features/identity.tokens.feature

@@ -1,131 +0,0 @@
-@security
-Feature: Tokens lifecycle
-
-  Scenario: Switching to Token authentication scheme
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        /hello/:id:
-          auth:id: id
-          GET:
-            dev:stub: Hello
-      """
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      content-type: text/plain
-
-      Hello
-      """
-
-  Scenario: Refreshing stale token
-    Given the `identity.tokens` configuration:
-      """yaml
-      refresh: 1
-      """
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        /hello/:id:
-          auth:id: id
-          GET:
-            dev:stub: Hello
-      """
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      cache-control: no-store
-
-      Hello
-      """
-    Then after 1 second
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token
-      cache-control: no-store
-
-      Hello
-      """
-
-  Scenario: Token revocation on password change
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        /:id:
-          id: id
-          GET:
-            dev:stub:
-              access: granted!
-      """
-    And the `identity.tokens` configuration:
-      """yaml
-      refresh: 1
-      """
-    And the `identity.basic` database contains:
-      | _id                              | VERSION | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | 1       | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    When the following request is received:
-      """
-      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      """
-    When the following request is received:
-      """
-      PATCH /identity/basic/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-
-      password: new-secret
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    Then after 1.1 seconds
-    When the following request is received:
-      """
-      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """

package/features/interruptions.feature

@@ -1,20 +0,0 @@
-@timing
-Feature: Request interruptions
-
-  Scenario: Connection reset while processing a request
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        anonymous: true
-        dev:sleep: 3000
-        GET:
-          dev:stub: hello
-      """
-    When the following request is interrupted after 1 second:
-      """
-      GET / HTTP/1.1
-      sleep: 2000
-      """
-    Then after 2 seconds
-    And the process is running