@toa.io/extensions.exposition 1.0.0-alpha.292 → 1.0.0-alpha.293

package/features/steps/IDP.ts

@@ -1,361 +0,0 @@
-import { once } from 'node:events'
-import * as crypto from 'node:crypto'
-import * as http from 'node:http'
-import * as assert from 'node:assert'
-import * as util from 'node:util'
-import { buffer } from 'node:stream/consumers'
-import tsflow from 'cucumber-tsflow'
-
-import { Captures } from './Captures.js'
-
-import type { AddressInfo } from 'node:net'
-
-const { binding, given, afterAll } = tsflow
-
-@binding([Captures])
-export class IDP {
-  private static server?: http.Server
-  private static privateKey?: crypto.KeyObject
-  private static issuer?: string
-  private static authCodes = new Map<string, AuthCode>()
-  private readonly captures: Captures
-
-  public constructor(captures: Captures) {
-    this.captures = captures
-  }
-
-  @afterAll()
-  public static async stop(): Promise<void> {
-    if (this.server instanceof http.Server) {
-      this.server.close()
-      await once(this.server, 'close')
-    }
-  }
-
-  @given(/local IDP is running/i)
-  public async start(): Promise<void> {
-    if (IDP.server instanceof http.Server) return
-
-    // creating the key
-    const { publicKey, privateKey } = await util.promisify(crypto.generateKeyPair)(
-      'rsa',
-      {
-        modulusLength: 2048
-      }
-    )
-
-    IDP.privateKey = privateKey
-
-    const jwk = JSON.stringify({
-      keys: [
-        {
-          use: 'sig',
-          alg: 'RS256',
-          ...publicKey.export({ format: 'jwk' })
-        }
-      ]
-    })
-
-    const JWK_ENDPOINT = '/.well-known/jwks'
-    const TOKEN_ENDPOINT = '/token'
-    const AUTH_ENDPOINT = '/authorize'
-
-    const server = http.createServer(async (request, response) => {
-      switch (request.url) {
-        case JWK_ENDPOINT:
-          response.writeHead(200, {
-            'Content-Type': 'application/json',
-            'Content-Length': jwk.length,
-            'Cache-Control': 'no-cache, no-store, must-revalidate',
-            Pragma: 'no-cache',
-            Expires: '0'
-          })
-          response.end(jwk)
-          break
-
-        case '/.well-known/openid-configuration':
-          {
-            const openIdConfiguration = JSON.stringify({
-              issuer: IDP.issuer,
-              jwks_uri: IDP.issuer + JWK_ENDPOINT,
-              authorization_endpoint: IDP.issuer + AUTH_ENDPOINT,
-              token_endpoint: IDP.issuer + TOKEN_ENDPOINT,
-              response_types_supported: ['id_token', 'code'],
-              grant_types_supported: ['authorization_code'],
-              subject_types_supported: ['public'],
-              id_token_signing_alg_values_supported: ['RS256'],
-              scopes_supported: ['openid', 'email', 'profile']
-            })
-
-            response.writeHead(200, {
-              'Content-Type': 'application/json',
-              'Cache-Control': 'public, max-age=3600',
-              'Content-Length': openIdConfiguration.length
-            })
-
-            response.end(openIdConfiguration)
-          }
-
-          break
-
-        case TOKEN_ENDPOINT:
-          {
-            if (request.method !== 'POST') {
-              response.writeHead(405, { 'Content-Type': 'text/plain' })
-              response.end('Method not allowed')
-
-              return
-            }
-
-            const buf = await buffer(request)
-            const body = buf.toString('utf8')
-
-            const params = new URLSearchParams(body)
-            const grantType = params.get('grant_type')!
-            const code = params.get('code')!
-            const redirectUri = params.get('redirect_uri')!
-            const clientId = params.get('client_id')!
-
-            if (grantType !== 'authorization_code' || !code || !clientId) {
-              response.writeHead(400, { 'Content-Type': 'application/json' })
-              response.end(JSON.stringify({ error: 'invalid_request' }))
-            }
-
-            const codeData = IDP.authCodes.get(code)
-
-            if (
-              !codeData ||
-              codeData.expiresAt < Date.now() ||
-              codeData.clientId !== clientId ||
-              (redirectUri && codeData.redirectUri !== redirectUri)
-            ) {
-              response.writeHead(400, { 'Content-Type': 'application/json' })
-              response.end(JSON.stringify({ error: 'invalid_grant' }))
-
-              return
-            }
-
-            const accessToken = crypto.randomBytes(32).toString('hex')
-            const idToken = this.generateIdToken(codeData.sub, codeData.email, clientId)
-
-            IDP.authCodes.delete(code)
-
-            response.writeHead(200, { 'Content-Type': 'application/json' }).end(
-              JSON.stringify({
-                access_token: accessToken,
-                token_type: 'Bearer',
-                id_token: idToken,
-                expires_in: 3600
-              })
-            )
-          }
-
-          break
-
-        default:
-          response.writeHead(404, 'Not found')
-          response.end()
-      }
-    })
-
-    // in Toa's own block, and out of the ephemeral range an arbitrary port would sit in
-    server.listen(31005, 'localhost')
-    await once(server, 'listening')
-
-    const address = server.address() as AddressInfo
-
-    console.log('IdP is listening on %s:%s', address.address, address.port)
-    IDP.server = server
-    IDP.issuer = `http://localhost:${address.port}`
-  }
-
-  @given('the IDP token for {word} is issued')
-  public async issueToken(user: string): Promise<void> {
-    assert.ok(IDP.privateKey, 'IdP private key is not available')
-
-    const jwt = [
-      {
-        typ: 'JWT',
-        alg: 'RS256'
-      },
-      {
-        iss: IDP.issuer,
-        sub: user,
-        aud: 'test',
-        email: user + '@test.local',
-        iat: Math.floor(Date.now() / 1000),
-        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
-      }
-    ]
-      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
-      .join('.')
-
-    const signature = crypto
-      .createSign('RSA-SHA256')
-      .end(jwt)
-      .sign(IDP.privateKey, 'base64url')
-
-    const idToken = `${jwt}.${signature}`
-
-    this.captures.set(`${user}.id_token`, idToken)
-  }
-
-  @given('the IDP random token is issued')
-  public async issueNewToken(): Promise<void> {
-    assert.ok(IDP.privateKey, 'IdP private key is not available')
-
-    const sub = Math.random().toString(36).substring(7)
-
-    const jwt = [
-      {
-        typ: 'JWT',
-        alg: 'RS256'
-      },
-      {
-        iss: IDP.issuer,
-        sub,
-        aud: 'test',
-        email: sub + '@test.local',
-        iat: Math.floor(Date.now() / 1000),
-        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
-      }
-    ]
-      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
-      .join('.')
-
-    const signature = crypto
-      .createSign('RSA-SHA256')
-      .end(jwt)
-      .sign(IDP.privateKey, 'base64url')
-
-    const idToken = `${jwt}.${signature}`
-
-    this.captures.set('random.sub', sub)
-    this.captures.set('random.email', sub + '@test.local')
-    this.captures.set('random.id_token', idToken)
-  }
-
-  @given('the IDP {word} token for {word} is issued with following secret:')
-  public async issueSymmetricToken(
-    alg: string,
-    user: string,
-    secret: string
-  ): Promise<void> {
-    const jwt = [
-      {
-        typ: 'JWT',
-        alg
-      },
-      {
-        iss: IDP.issuer,
-        sub: user,
-        aud: 'test',
-        iat: Math.floor(Date.now() / 1000),
-        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
-      }
-    ]
-      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
-      .join('.')
-
-    const signature = crypto
-      .createHmac(alg.replace(/^HS(\d{3})$/, 'sha$1'), secret)
-      .update(jwt)
-      .digest('base64url')
-
-    const idToken = `${jwt}.${signature}`
-
-    this.captures.set(`${user}.id_token`, idToken)
-  }
-
-  @given('ID token with jti is issued for {word}')
-  public async issueTokenWithJti(user: string): Promise<void> {
-    assert.ok(IDP.privateKey, 'IdP private key is not available')
-
-    const jwt = [
-      {
-        typ: 'JWT',
-        alg: 'RS256'
-      },
-      {
-        iss: IDP.issuer,
-        sub: user,
-        aud: 'test',
-        email: user + '@test.local',
-        iat: Math.floor(Date.now() / 1000),
-        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000),
-        jti: crypto.randomUUID()
-      }
-    ]
-      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
-      .join('.')
-
-    const signature = crypto
-      .createSign('RSA-SHA256')
-      .end(jwt)
-      .sign(IDP.privateKey, 'base64url')
-
-    const idToken = `${jwt}.${signature}`
-
-    this.captures.set(`${user}.id_token`, idToken)
-  }
-
-  @given('auth code for {word} is issued for {word}')
-  public async issueAuthCode(user: string, redirectUri: string): Promise<void> {
-    const code = crypto.randomBytes(16).toString('hex')
-    const email = user + '@test.local'
-    const clientId = 'nex'
-
-    IDP.authCodes.set(code, {
-      code,
-      sub: user,
-      email,
-      clientId,
-      redirectUri,
-      expiresAt: Date.now() + 60 * 1000
-    })
-
-    const json = JSON.stringify({ code, iss: IDP.issuer, for: redirectUri })
-    const base64 = Buffer.from(json).toString('base64')
-
-    this.captures.set(`${user}.auth_code`, code)
-    this.captures.set(`${user}.code_credentials`, base64)
-  }
-
-  private generateIdToken(sub: string, email: string, clientId: string): string {
-    assert.ok(IDP.privateKey, 'IdP private key is not available')
-    assert.ok(IDP.issuer, 'IdP issuer is not available')
-
-    const jwt = [
-      {
-        typ: 'JWT',
-        alg: 'RS256'
-      },
-      {
-        iss: IDP.issuer,
-        sub,
-        aud: clientId,
-        email,
-        iat: Math.floor(Date.now() / 1000),
-        exp: Math.floor((Date.now() + 1000 * 60 * 5) / 1000)
-      }
-    ]
-      .map((v) => Buffer.from(JSON.stringify(v)).toString('base64url'))
-      .join('.')
-
-    const signature = crypto
-      .createSign('RSA-SHA256')
-      .end(jwt)
-      .sign(IDP.privateKey, 'base64url')
-
-    return `${jwt}.${signature}`
-  }
-}
-
-interface AuthCode {
-  code: string
-  sub: string
-  email: string
-  clientId: string
-  redirectUri: string
-  expiresAt: number
-}

package/features/steps/Identity.ts

@@ -1,54 +0,0 @@
-import tsflow from 'cucumber-tsflow'
-
-import * as http from '@toa.io/agent'
-import { Parameters } from './Parameters.js'
-import { Captures } from './Captures.js'
-import { Gateway } from './Gateway.js'
-
-const { binding, given } = tsflow
-
-@binding([Gateway, Parameters, Captures])
-export class Identity {
-  private readonly gateway: Gateway
-  private readonly http: http.Agent
-  private readonly variables: Captures
-
-  public constructor(gateway: Gateway, parameters: Parameters, captures: Captures) {
-    this.gateway = gateway
-    this.http = new http.Agent(parameters.origin, captures)
-    this.variables = captures
-  }
-
-  @given('transient identity {word}')
-  public async transient(as: string): Promise<Principal> {
-    await this.gateway.start()
-
-    await this.http.request(`
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-    `)
-
-    this.http.responseIncludes(`
-      201 Created
-      authorization: Token \${{ ${as}.token }}
-
-      id: \${{ ${as}.id }}
-    `)
-
-    const id = this.variables.get(as + '.id')!
-    const token = this.variables.get(as + '.token')!
-
-    return { id, token }
-  }
-
-  @given('transient identity')
-  public async anonymous(): Promise<Principal> {
-    return await this.transient('identity')
-  }
-}
-
-export interface Principal {
-  id: string
-  token: string
-}

package/features/steps/OTP.ts

@@ -1,42 +0,0 @@
-import * as assert from 'node:assert'
-import tsflow from 'cucumber-tsflow'
-
-import * as boot from '@toa.io/boot'
-import { Locator, type Remote } from '@toa.io/core'
-import { Captures } from './Captures.js'
-
-const { binding, given } = tsflow
-
-@binding([Captures])
-export class OTP {
-  private captures: Captures
-  private otp: Remote | null = null
-
-  public constructor(captures: Captures) {
-    this.captures = captures
-  }
-
-  @given('OTP for `{word}` in `{word}` authority is issued')
-  public async issue(username: string, authority: string): Promise<void> {
-    this.otp ??= await this.connect()
-
-    const reply = await this.otp.invoke('issue', {
-      input: {
-        username,
-        authority
-      }
-    })
-
-    assert.ok(typeof reply.code === 'string')
-
-    const credentials = btoa(`${username}:${reply.code}`)
-
-    this.captures.set(`${username}.otp`, credentials)
-  }
-
-  private async connect(): Promise<Remote> {
-    const locator = new Locator('otp', 'identity')
-
-    return await boot.remote(locator)
-  }
-}

package/features/steps/Parameters.ts

@@ -1,162 +0,0 @@
-import { join } from 'node:path'
-import * as dotenv from 'dotenv'
-import { setDefaultTimeout } from '@cucumber/cucumber'
-import { environment as variables } from '@toa.io/generic'
-
-dotenv.config({ path: join(import.meta.dirname, '.env') })
-
-/**
- * Not `PORT` and `PROBE`, which a deployment serves the gateway on: an application built on
- * Toa is served on this machine too, and its own gateway holds those. See CONTRIBUTING.md.
- */
-export const PORT = 31000
-export const PROBE = 31004
-
-export class Parameters {
-  public readonly origin: string
-
-  public constructor() {
-    this.origin = `http://127.0.0.1:${PORT}`
-  }
-}
-
-setDefaultTimeout(60 * 1000)
-
-variables.set('TOA_DEV', '1')
-
-// a reply is checked against what the operation declares, so the suite runs Toa under the
-// contract it asks applications to keep
-if (!variables.has('TOA_ENV')) variables.set('TOA_ENV', 'local')
-
-// the gateway answers for itself, as it does in a deployment: telemetry's probe tracks the
-// nested composition, which connects before route discovery settles
-if (!variables.has('TOA_TELEMETRY_READY'))
-  variables.set('TOA_TELEMETRY_READY', JSON.stringify(false))
-
-// export traces to the local Tempo (`docker compose up tempo grafana`),
-// unavailability of the endpoint is harmless
-if (!variables.has('TOA_TELEMETRY_TRACES'))
-  variables.set(
-    'TOA_TELEMETRY_TRACES',
-    JSON.stringify({
-      exporters: {
-        console: null,
-        otlp: { endpoint: 'http://localhost:31061' }
-      }
-    })
-  )
-
-/*
- * The page the gateway serves at `/.discovery/`, pointed at a fixture: the scenarios are
- * about the server, not the page, and none of them should need a UI build. Set here rather
- * than in a step because the gateway is not rebuilt between scenarios that share its
- * signature, so one flipping this would silently read whatever the last one left.
- */
-process.env.__TESTING_EXPOSITION_DISCOVERY_ROOT = join(
-  import.meta.dirname,
-  '..',
-  'site'
-)
-
-const environment = process.env.CLOUDINARY_ENVIRONMENT
-
-/**
- * A storage is built when a component's context is — for every scenario, not only for the ones
- * that reach for it — and a Cloudinary storage asks for the keys of a real account. A checkout
- * carries none, so these two are declared only where `features/steps/.env` names an environment.
- */
-const CLOUDINARY = {
-  cloudinary: {
-    provider: 'cloudinary',
-    environment,
-    type: 'image',
-    prefix: 'toa-dev',
-    transformations: [
-      {
-        extension: 'icon',
-        transformation: [
-          {
-            width: 48,
-            height: 48,
-            crop: 'fill'
-          },
-          {
-            border: '10px_solid_white'
-          }
-        ],
-        optional: true
-      },
-      {
-        extension: '(?<width>\\d*)x(?<height>\\d*)(z(?<zoom>\\d*))?',
-        transformation: {
-          width: '<width>',
-          height: '<height>',
-          zoom: '<zoom>',
-          crop: 'thumb',
-          gravity: 'face'
-        },
-        optional: true
-      },
-      {
-        extension: '\\[(?<width>\\d*)x(?<height>\\d*)\\](z(?<zoom>\\d+))?',
-        transformation: {
-          width: '<width>',
-          height: '<height>',
-          zoom: '<zoom>',
-          crop: 'fit'
-        },
-        optional: true
-      },
-      {
-        extension: '(?<format>jpeg|webp)',
-        transformation: {
-          fetch_format: '<format>'
-        },
-        optional: true
-      }
-    ]
-  },
-  cloudinary_video: {
-    provider: 'cloudinary',
-    environment,
-    type: 'video',
-    prefix: 'toa-dev',
-    eager: [
-      {
-        width: 200,
-        height: 200,
-        crop: 'fill'
-      }
-    ],
-    transformations: [
-      {
-        extension: '200x200',
-        transformation: {
-          width: 200,
-          height: 200,
-          crop: 'fill'
-        },
-        optional: true
-      },
-      {
-        extension: '(?<format>mp4|gif)',
-        transformation: {
-          quality: 'auto',
-          fetch_format: '<format>'
-        },
-        optional: true
-      }
-    ]
-  }
-}
-
-variables.set(
-  'TOA_STORAGES',
-  JSON.stringify({
-    octets: {
-      provider: 'tmp',
-      directory: Math.random().toString(36).substring(2)
-    },
-    ...(environment === undefined ? {} : CLOUDINARY)
-  })
-)

package/features/steps/Probe.ts

@@ -1,38 +0,0 @@
-import assert from 'node:assert'
-import { Agent, request } from 'undici'
-import tsflow from 'cucumber-tsflow'
-import { PATH } from '../../source/HTTP/index.js'
-import { PROBE } from './Parameters.js'
-
-const { after, binding, then, when } = tsflow
-
-@binding()
-export class Probe {
-  private readonly agent = new Agent()
-  private status: number | null = null
-  private headers: Record<string, string> = {}
-
-  @when('the ready probe is requested')
-  public async request(): Promise<void> {
-    const response = await request(`http://127.0.0.1:${PROBE}${PATH}`, {
-      dispatcher: this.agent
-    })
-
-    this.status = response.statusCode
-    this.headers = response.headers as Record<string, string>
-
-    await response.body.dump()
-  }
-
-  @then('the ready probe answers {int}')
-  public answers(status: number): void {
-    assert.equal(this.status, status)
-
-    if (status === 200) assert.equal(this.headers['cache-control'], 'no-store')
-  }
-
-  @after()
-  public async close(): Promise<void> {
-    await this.agent.close()
-  }
-}