@toa.io/extensions.exposition 1.0.0-alpha.291 → 1.0.0-alpha.293

package/source/Gateway.ts

@@ -1,390 +0,0 @@
-import assert from 'node:assert'
-import { setTimeout } from 'node:timers/promises'
-import { console } from 'openspan'
-import { Connector } from '@toa.io/core'
-import type { bindings } from '@toa.io/core/types'
-import * as http from './HTTP/index.js'
-import { DISCOVERY, MCP, RPC } from './const.js'
-import { rethrow } from './exceptions.js'
-import { decide } from './Branch.js'
-import { describing } from './Introspection.js'
-import { Explorer, looking } from './Discovery/index.js'
-import type { Interception } from './Interception.js'
-import type { Dispatcher } from './RPC/index.js'
-import type { Server } from './MCP/index.js'
-import type {
-  DirectiveFactory,
-  Method,
-  Node,
-  Parameter,
-  Tree,
-  Match
-} from './RTD/index.js'
-import type { Label } from './discovery.js'
-import type { Branch, Exposed } from './Branch.js'
-
-export class Gateway extends Connector {
-  private readonly broadcast: Broadcast
-  private readonly tree: Tree
-  private readonly interceptor: Interception
-  private readonly directives: DirectiveFactory
-
-  /** JSON-RPC is served only where the annotation asked for it. */
-  private readonly dispatcher: Dispatcher | null
-
-  /** And the same of MCP. */
-  private readonly mcp: Server | null
-
-  /** The tree, for every route at once. Served always, and so not nullable. */
-  private readonly explorer: Explorer
-  private readonly branches = new Map<string, Exposed>()
-  private lastMerge = 0
-  private widestGap = 0
-  private lastPing = 0
-  private stopped = false
-  private resolveFirstMerge: (() => void) | null = null
-
-  // eslint-disable-next-line max-params
-  public constructor(
-    broadcast: Broadcast,
-    tree: Tree,
-    interception: Interception,
-    directives: DirectiveFactory,
-    dispatcher: Dispatcher | null,
-    mcp: Server | null
-  ) {
-    super()
-
-    this.broadcast = broadcast
-    this.tree = tree
-    this.interceptor = interception
-    this.directives = directives
-    this.dispatcher = dispatcher
-    this.mcp = mcp
-    this.explorer = new Explorer(tree)
-
-    this.depends(broadcast)
-  }
-
-  public async process(context: http.Context): Promise<http.OutgoingMessage> {
-    const interception = await this.interceptor.intercept(context)
-
-    if (interception !== null) return interception
-
-    // request-scoped, before anything is routed: this is where a credential is read
-    await this.directives.preflight(context).catch(rethrow)
-
-    const response = await this.endpoint(context)
-
-    // request-scoped, on whatever is going back: this is where a credential is re-issued
-    await this.directives.depart(context, response).catch(rethrow)
-
-    return response
-  }
-
-  /**
-   * What answers the request: a pinned endpoint that makes calls of its own, or the route
-   * the path names.
-   */
-  private async endpoint(context: http.Context): Promise<http.OutgoingMessage> {
-    const route: http.Processor = async (call) => await this.route(call)
-
-    if (this.dispatcher !== null && context.url.pathname === RPC)
-      return await this.dispatcher.dispatch(context, route)
-
-    if (this.mcp !== null && context.url.pathname === MCP)
-      return await this.mcp.process(context, route)
-
-    // the page under this prefix is an interceptor's, and has already answered
-    if (context.url.pathname === DISCOVERY || context.url.pathname === DISCOVERY + '/')
-      return await this.explorer.process(context)
-
-    // a browser that asked for the trunk of an API is looking for the page, and where the
-    // application answers there itself, that is what answers
-    if (context.url.pathname === '/' && !this.serves(context)) {
-      const page = looking(context)
-
-      if (page !== null) return page
-    }
-
-    return await this.route(context)
-  }
-
-  /** Whether the application serves the trunk with the verb the request was made with. */
-  private serves(context: http.Context): boolean {
-    const match = this.tree.match('/')
-
-    return match !== null && context.request.method in match.node.methods
-  }
-
-  /**
-   * One call: everything that needs a node. A request makes one of these, and a request
-   * that carries several calls makes one per call.
-   */
-  private async route(context: http.Context): Promise<http.OutgoingMessage> {
-    const { node, parameters } = this.match(context)
-
-    if (context.request.method === 'OPTIONS')
-      return await this.explain(context, node, parameters)
-
-    let verb = context.request.method
-
-    if (!(verb in node.methods) && verb === 'HEAD' && 'GET' in node.methods) verb = 'GET'
-
-    if (!(verb in node.methods)) throw new http.MethodNotAllowed()
-
-    const method = node.methods[verb]
-
-    const interruption = await method.directives
-      .precall(context, parameters)
-      .catch(rethrow)
-    const response = interruption ?? (await this.call(method, context, parameters))
-
-    await method.directives.settle(context, response).catch(rethrow)
-
-    return response
-  }
-
-  protected override async open(): Promise<void> {
-    await this.discover()
-
-    // what is served besides the tree, so that turning one on can be seen to have worked
-    const pinned: string[] = []
-
-    if (this.dispatcher !== null) pinned.push(RPC)
-
-    if (this.mcp !== null) pinned.push(MCP)
-
-    console.info('Gateway started', {
-      endpoints: pinned.length === 0 ? 'none' : pinned.join(' ')
-    })
-  }
-
-  /**
-   * Both of these reach into components, and a dependency is torn down only once this has
-   * returned — where `dispose` runs after every one of them already has. The throttling
-   * ticker firing in between calls an endpoint that has just been unbound, and reports the
-   * refusal as a failure to reconcile.
-   */
-  protected override async close(): Promise<void> {
-    this.stopped = true
-
-    this.tree.dispose()
-  }
-
-  protected override dispose(): void {
-    console.info('Gateway is closed')
-  }
-
-  private match(context: http.Context): Match {
-    const match = this.tree.match(context.url.pathname)
-
-    if (match === null) {
-      // the route may be missing because an expose has been lost
-      this.reping()
-
-      throw new http.NotFound('Route not found')
-    }
-
-    if (match.node.forward === null) return match
-
-    const destination = match.node.forward.replace(/\/:([^/]+)/g, (_, name) => {
-      const value = match.parameters.find((parameter) => parameter.name === name)?.value
-
-      assert.ok(value !== undefined, `Forwarded parameter '${name}' not found`)
-
-      return `/${value}`
-    })
-
-    const forward = this.tree.match(destination)
-
-    assert.ok(forward !== null, 'Forwarded route not found')
-
-    return forward
-  }
-
-  private async call(
-    method: Method,
-    context: http.Context,
-    parameters: Parameter[]
-  ): Promise<http.OutgoingMessage> {
-    if (context.url.pathname[context.url.pathname.length - 1] !== '/')
-      throw new http.NotFound('Trailing slash is required')
-
-    if (context.encoder === null) throw new http.NotAcceptable()
-
-    if (method.endpoint === null) throw new http.MethodNotAllowed()
-
-    return (await method.endpoint
-      .call(context, parameters)
-      .catch(rethrow)) as http.OutgoingMessage
-  }
-
-  private async explain(
-    context: http.Context,
-    node: Node,
-    parameters: Parameter[]
-  ): Promise<http.OutgoingMessage> {
-    const { described, methods } = await node.explain(describing(context), parameters)
-    const verbs = Object.keys(methods)
-
-    // what a caller may not use is not a resource to them, and describing it would be the leak
-    if (verbs.length === 0 && Object.keys(node.methods).length > 0)
-      throw new http.Forbidden()
-
-    // what the resource is, beside the methods it serves; a verb is upper case and cannot
-    // collide with either key
-    return {
-      body: { ...described, ...methods },
-      headers: new Headers({ allow: verbs.join(', ') })
-    }
-  }
-
-  private async discover(): Promise<void> {
-    const first = new Promise<void>((resolve) => {
-      this.resolveFirstMerge = resolve
-    })
-
-    await this.broadcast.receive<Branch>('expose', this.merge.bind(this))
-
-    void this.knock()
-
-    await this.settled(first)
-  }
-
-  /**
-   * A single ping is enough only if every tenant is listening by then, which is
-   * not the case while the deployment is still rolling out.
-   */
-  private async knock(): Promise<void> {
-    for (const delay of KNOCK_DELAYS) {
-      if (this.stopped) return
-
-      if (delay > 0) await setTimeout(delay, undefined, { ref: false })
-
-      await this.ping()
-    }
-  }
-
-  private async ping(): Promise<void> {
-    if (this.stopped) return
-
-    this.lastPing = Date.now()
-
-    await this.broadcast
-      .transmit<null>('ping', null)
-      .catch((exception: Error) =>
-        console.error('Discovery ping failed', { message: exception.message })
-      )
-  }
-
-  private reping(): void {
-    if (Date.now() - this.lastPing < PING_COOLDOWN) return
-
-    void this.ping()
-  }
-
-  private async settled(first: Promise<void>): Promise<void> {
-    const deadline = Date.now() + SETTLE_TIMEOUT
-    const abort = new AbortController()
-
-    // an uncancelled timer keeps the process alive long after the race is won
-    await Promise.race([
-      first,
-      setTimeout(SETTLE_TIMEOUT, undefined, { signal: abort.signal })
-    ])
-      .finally(() => {
-        abort.abort()
-      })
-      .catch(() => {})
-
-    if (this.lastMerge === 0) {
-      console.warn('Discovery timed out waiting for the first expose')
-
-      return
-    }
-
-    while (Date.now() - this.lastMerge < this.quiet()) {
-      if (Date.now() >= deadline) break
-
-      await setTimeout(SETTLE_POLL)
-    }
-  }
-
-  /**
-   * How long the branches must stay quiet before discovery counts as settled.
-   *
-   * Every tenant of a local composition answers the first ping at once, so a short window
-   * is enough; a rolling deployment brings them up seconds apart, and the window grows with
-   * the widest gap seen so far to keep waiting for the ones still starting.
-   */
-  private quiet(): number {
-    const adaptive = this.widestGap * SETTLE_QUIET_FACTOR
-
-    return Math.min(Math.max(adaptive, SETTLE_QUIET_MIN), SETTLE_QUIET_MAX)
-  }
-
-  private merge(branch: Branch): void {
-    const id = branch.namespace + '.' + branch.component
-
-    const attributes = {
-      namespace: branch.namespace,
-      component: branch.component,
-      version: branch.version
-    }
-
-    const exposed = this.branches.get(id)
-
-    if (exposed !== undefined)
-      switch (decide(exposed, branch)) {
-        // rebuilding an identical branch would only tear down its live endpoints
-        case 'refresh':
-          this.tree.refresh(exposed.nodes)
-          console.trace('Branch refreshed', attributes)
-
-          return
-
-        case 'superseded':
-          console.debug('Branch superseded', {
-            ...attributes,
-            timestamp: branch.timestamp,
-            exposed: exposed.timestamp
-          })
-
-          return
-      }
-
-    let nodes: Node[]
-
-    try {
-      nodes = this.tree.merge(branch.node, branch)
-    } catch (exception: unknown) {
-      const message = exception instanceof Error ? exception.message : 'Unknown error'
-
-      console.error('Branch merge exception', { message, ...attributes })
-
-      return
-    }
-
-    this.branches.set(id, { version: branch.version, timestamp: branch.timestamp, nodes })
-
-    if (this.lastMerge !== 0)
-      this.widestGap = Math.max(this.widestGap, Date.now() - this.lastMerge)
-
-    this.lastMerge = Date.now()
-    this.resolveFirstMerge?.()
-    this.resolveFirstMerge = null
-
-    console.info('Branch merged', attributes)
-  }
-}
-
-export type Broadcast = bindings.Broadcast<Label>
-
-const SETTLE_QUIET_MIN = 500
-const SETTLE_QUIET_MAX = 10_000
-const SETTLE_QUIET_FACTOR = 2
-const SETTLE_TIMEOUT = 30_000
-const SETTLE_POLL = 50
-const KNOCK_DELAYS = [0, 500, 1000, 1500]
-const PING_COOLDOWN = 5_000

package/source/HTTP/Context.ts

@@ -1,143 +0,0 @@
-import { buffer } from 'node:stream/consumers'
-import Negotiator from 'negotiator'
-import { console } from 'openspan'
-import { Timing } from './Timing.js'
-import { type Format, formats, types } from './formats/index.js'
-import { read } from './messages.js'
-import { address } from './address.js'
-import type { OutgoingMessage } from './messages.js'
-import type { IncomingMessage } from './types.js'
-
-export class Context {
-  public readonly authority: string
-  public readonly request: IncomingMessage
-
-  /** the client address, read as the deployment says; none otherwise, see `documentation/ip.md` */
-  public readonly ip: string | undefined
-  public readonly url: URL
-  public readonly subtype: string | null = null
-  public readonly encoder: Format | null = null
-  public readonly timing: Timing
-
-  /**
-   * Whether this is a procedure a request made, rather than the request. What forks one
-   * says so, and a directive that answers differently to a procedure than to a request
-   * reads it here.
-   */
-  public readonly procedural: boolean = false
-
-  /**
-   * Whether this describes a resource rather than calling one. What builds a describing
-   * context says so, and a directive that answers differently to a description than to a
-   * call reads it here.
-   */
-  public readonly exploratory: boolean = false
-
-  public readonly pipelines: Pipelines = {
-    body: [],
-    response: []
-  }
-
-  private consumed = false
-
-  // eslint-disable-next-line max-params
-  public constructor(
-    authority: string,
-    request: IncomingMessage,
-    properties: Properties,
-    url: URL
-  ) {
-    this.authority = authority
-    this.request = request
-    this.ip = address(request, properties.ip)
-
-    // parsed by the server, which had to parse it anyway to know the request is valid
-    this.url = url
-    this.timing = new Timing()
-    this.log(request)
-
-    const accept = this.request.headers.accept
-
-    if (accept !== undefined) {
-      const match = SUBTYPE.exec(accept)
-
-      if (match !== null) {
-        const { type, subtype, suffix } = match.groups!
-
-        this.request.headers.accept = `${type}/${suffix}`
-        this.subtype = subtype
-      }
-    }
-
-    const encoder = negotiate(this.request)
-
-    if (encoder !== undefined) this.encoder = encoder
-  }
-
-  public async buffer(): Promise<Buffer> {
-    this.consumed = true
-
-    return await buffer(this.request)
-  }
-
-  public async body<T>(): Promise<T> {
-    let value = this.consumed ? null : await read(this)
-
-    for (const transform of this.pipelines.body) value = await transform(value)
-
-    return value
-  }
-
-  private log(request: IncomingMessage): void {
-    // built only when the line is written, which at `info` it is not
-    console.debug('Received request', () => {
-      const headers = { ...request.headers }
-
-      if (headers.authorization !== undefined)
-        headers.authorization = SCHEME.exec(headers.authorization)?.[1] ?? '[malformed]'
-
-      return { method: request.method, url: request.url, headers }
-    })
-  }
-}
-
-/** The scheme of an `authorization` header; the value after it is a credential. */
-const SCHEME = /^(\w{1,32})(?: |$)/
-
-interface Pipelines {
-  body: Array<(input: unknown) => unknown>
-  response: Array<(output: OutgoingMessage) => void | Promise<void>>
-}
-
-interface Properties {
-  /** the header the client address is read from; the connection's without one */
-  ip?: string
-}
-
-/**
- * Negotiation parses the header and sorts the candidates, and the value repeats:
- * clients send one of a handful of `accept` strings. Bounded, the header is theirs.
- */
-function negotiate(request: IncomingMessage): Format | undefined {
-  const accept = request.headers.accept ?? ''
-  const known = NEGOTIATED.get(accept)
-
-  if (known !== undefined) return known === NONE ? undefined : known
-
-  const mediaType = new Negotiator(request).mediaType(types)
-  const encoder = mediaType === undefined ? undefined : formats[mediaType]
-
-  if (NEGOTIATED.size >= NEGOTIATED_LIMIT) NEGOTIATED.clear()
-
-  NEGOTIATED.set(accept, encoder ?? NONE)
-
-  return encoder
-}
-
-/** distinguishes "negotiated to nothing" from "not negotiated yet" */
-const NONE = Symbol('not acceptable') as unknown as Format
-const NEGOTIATED = new Map<string, Format>()
-const NEGOTIATED_LIMIT = 1024
-
-const SUBTYPE =
-  /^(?<type>\w{1,32})\/(vnd\.toa\.(?<subtype>\S{1,32})\+)(?<suffix>\S{1,32})$/

package/source/HTTP/Probe.ts

@@ -1,99 +0,0 @@
-import * as http from 'node:http'
-import { console } from 'openspan'
-
-/**
- * The readiness probe, on a port of its own.
- *
- * It cannot share the port the gateway serves traffic on: kubelet speaks HTTP/1.1 only, and a
- * cleartext HTTP/2 server answers nothing else on its port — there is no ALPN to negotiate with.
- *
- * It is the gateway's own readiness, not the process's. The identity composition nested in this
- * process connects before route discovery has settled, so a probe tied to that composition would
- * report ready while the gateway still had no routes and no open port.
- */
-export class Probe {
-  private readonly server = http.createServer()
-  private readonly port: number
-  private readonly path: string
-
-  private ready = false
-  private startedAt = 0
-  private listening = false
-  private skipped = false
-
-  public constructor(port: number, path: string = PATH) {
-    this.port = port
-    this.path = path
-
-    this.server.on('request', (request, response) => this.listener(request, response))
-  }
-
-  public async listen(): Promise<void> {
-    this.startedAt = Date.now()
-
-    try {
-      await new Promise<void>((resolve, reject) => {
-        this.server.once('error', reject)
-        this.server.listen(this.port, () => {
-          this.server.removeListener('error', reject)
-          resolve()
-        })
-      })
-    } catch (error: any) {
-      // processes sharing a host share the port; in a pod nothing else claims it
-      if (error?.code === 'EADDRINUSE') {
-        this.skipped = true
-
-        console.warn('Ready probe port already in use, skipping', { port: this.port })
-
-        return
-      }
-
-      throw error
-    }
-
-    this.listening = true
-
-    // a probe answers while the process runs; it must never be the reason it keeps running
-    this.server.unref()
-  }
-
-  /** The gateway is listening and has routes: answer `200`. */
-  public complete(): void {
-    this.ready = true
-
-    // the IPC signal is not tied to the probe: a process that gave up the shared port is
-    // still ready, and pm2 `wait_ready` would otherwise block until `listen_timeout`
-    process.send?.('ready')
-  }
-
-  public async close(): Promise<void> {
-    this.ready = false
-
-    if (!this.listening || this.skipped) return
-
-    this.listening = false
-
-    // keep-alive connections would otherwise hold the server handle, delaying the exit
-    this.server.closeAllConnections()
-
-    await new Promise<void>((resolve) => this.server.close(() => resolve()))
-  }
-
-  private listener(request: http.IncomingMessage, response: http.ServerResponse): void {
-    if (request.url !== this.path) {
-      response.writeHead(404).end()
-
-      return
-    }
-
-    if (this.ready) response.writeHead(200, { 'cache-control': 'no-store' }).end()
-    else {
-      const remaining = Math.ceil((Date.now() - this.startedAt) / 1000).toString()
-
-      response.writeHead(503, { 'retry-after': remaining }).end()
-    }
-  }
-}
-
-export const PATH = '/.ready'