@toa.io/extensions.exposition 1.0.0-alpha.3 → 1.0.0-alpha.300

package/components/exposition.octets/manifest.toa.yaml

@@ -0,0 +1,58 @@
+namespace: exposition
+name: octets
+
+storages: ~
+
+operations:
+  put:
+    bindings: ~
+    input:
+      properties:
+        location:
+          type: string
+        accept:
+          type: string
+        limit:
+          type: number
+        trust: {}
+        storage:
+          type: string
+        request: {}
+      type: object
+      required:
+        - storage
+        - request
+    errors:
+      - LOCATION_UNTRUSTED
+      - LOCATION_LENGTH
+      - LOCATION_UNAVAILABLE
+      - INVALID_ID
+      # what the storage refuses with, passed on
+      - NOT_FOUND
+      - LIMIT_EXCEEDED
+      - NOT_ACCEPTABLE
+      - TYPE_MISMATCH
+  get: &simple
+    bindings: ~
+    # what the storage refuses with, passed on
+    errors:
+      - NOT_FOUND
+      - LIMIT_EXCEEDED
+      - NOT_ACCEPTABLE
+      - TYPE_MISMATCH
+    input:
+      properties:
+        range:
+          type: string
+        agent:
+          type: string
+        storage:
+          type: string
+        path:
+          type: string
+      type: object
+      required:
+        - storage
+        - path
+  head: *simple
+  delete: *simple

package/components/exposition.octets/operations/delete.js

@@ -0,0 +1,5 @@
+function del(input, context) {
+  return context.storages[input.storage].delete(input.path)
+}
+
+export { del as effect }

package/components/exposition.octets/operations/get.js

@@ -0,0 +1,8 @@
+async function get(input, context) {
+  return await context.storages[input.storage].get(input.path, {
+    range: input.range,
+    agent: input.agent
+  })
+}
+
+export { get as effect }

package/components/exposition.octets/operations/head.js

@@ -0,0 +1,5 @@
+async function head(input, context) {
+  return await context.storages[input.storage].head(input.path)
+}
+
+export { head as computation }

package/components/exposition.octets/operations/put.js

@@ -0,0 +1,142 @@
+import { Readable } from 'node:stream'
+import { posix } from 'node:path'
+import { match } from 'matchacho'
+
+async function put(input, context) {
+  const { storage, request, location, accept, limit, trust } = input
+  const url = request.url
+  const id = request.headers['content-id']
+  const claim = request.headers['content-type']
+  const attributes = parseAttributes(request.headers['content-attributes'])
+  const reference = request.headers['content-location']
+
+  /** @type {Readable} */
+  let body = request
+
+  const options = { claim, accept, attributes }
+
+  if (id !== undefined) {
+    if (!ID_RX.test(id)) return ERR_INVALID_ID
+
+    options.id = id
+  }
+
+  if (reference !== undefined) {
+    const length = Number.parseInt(request.headers['content-length'])
+
+    if (length !== 0) return ERR_LENGTH
+
+    if (!trusted(reference, trust)) return ERR_UNTRUSTED
+
+    body = await download(reference)
+
+    if (body instanceof Error) return body
+
+    options.origin = reference
+  }
+
+  if (limit !== undefined) options.limit = limit
+
+  const path = posix.resolve(url, location ?? '.')
+
+  return context.storages[storage].put(path, body, options)
+}
+
+/**
+ * @param {string | string[] | undefined} values
+ * @returns {Record<string, string>}
+ */
+function parseAttributes(values) {
+  const attributes = {}
+
+  if (values === undefined) return attributes
+
+  if (typeof values === 'string') values = values.split(',')
+
+  for (const pair of values) {
+    const eq = pair.indexOf('=')
+    const key = (eq === -1 ? pair : pair.slice(0, eq)).trim()
+
+    attributes[key] = eq === -1 ? 'true' : pair.slice(eq + 1).trim()
+  }
+
+  return attributes
+}
+
+/**
+ * @param {string} location
+ * @return {Readable | Error}
+ */
+async function download(location) {
+  const response = await fetch(location)
+
+  if (!response.ok) return ERR_UNAVAILABLE
+
+  return response.body === null
+    ? ERR_UNAVAILABLE
+    : Readable.fromWeb(
+        /** @type {import('node:stream/web').ReadableStream} **/ response.body
+      )
+}
+
+/**
+ * @param {string} location
+ * @param {Trust | undefined} trust
+ * @return {boolean}
+ */
+function trusted(location, trust) {
+  if (trust === undefined) return false
+
+  const url = toURL(location)
+
+  if (url === null) return false
+
+  for (const permission of trust) {
+    const ok = match(
+      permission,
+      String,
+      (origin) => url.origin === origin,
+      RegExp,
+      (pattern) => pattern.test(url.origin)
+    )
+
+    if (ok) return true
+  }
+
+  return false
+}
+
+function toURL(location) {
+  try {
+    return new URL(location)
+  } catch (error) {
+    return null
+  }
+}
+
+const ERR_UNTRUSTED = new (class LocationUntrustedError extends Error {
+  code = 'LOCATION_UNTRUSTED'
+  message = 'Location is not trusted'
+})()
+
+const ERR_LENGTH = new (class LocationLengthError extends Error {
+  code = 'LOCATION_LENGTH'
+  message = 'Content-Length must be 0 when Content-Location is used'
+})()
+
+const ERR_UNAVAILABLE = new (class LocationUnavailableError extends Error {
+  code = 'LOCATION_UNAVAILABLE'
+  message = 'Location is not available'
+})()
+
+const ERR_INVALID_ID = new (class InvalidIdError extends Error {
+  code = 'INVALID_ID'
+  message = 'Invalid Content-ID'
+})()
+
+const ID_RX = /^[a-zA-Z0-9-_]{1,32}$/
+
+/** @typedef {Array<string | RegExp>} Trust */
+/** @typedef {import('node:stream').Readable} Readable */
+
+export { put as effect }

package/components/exposition.octets/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "exposition.octets",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@aws-sdk/client-s3": "3.1125.0",
+    "@aws-sdk/lib-storage": "3.1125.0",
+    "cloudinary": "2.11.0"
+  }
+}

package/components/exposition.octets/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.

package/components/exposition.octets/types/toa.d.ts

@@ -0,0 +1,41 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options, RemoteError } from '@toa.io/core/types'
+
+export type PutInput = {
+  location?: string
+  accept?: string
+  limit?: number
+  trust?: unknown
+  storage: string
+  request: unknown
+}
+
+export type GetInput = {
+  range?: string
+  agent?: string
+  storage: string
+  path: string
+}
+
+export type HeadInput = {
+  range?: string
+  agent?: string
+  storage: string
+  path: string
+}
+
+export type DeleteInput = {
+  range?: string
+  agent?: string
+  storage: string
+  path: string
+}
+
+export interface Component {
+  put: (request: { input: PutInput, task?: boolean }, options?: Options) => Promise<unknown | RemoteError<"LOCATION_UNTRUSTED" | "LOCATION_LENGTH" | "LOCATION_UNAVAILABLE" | "INVALID_ID" | "NOT_FOUND" | "LIMIT_EXCEEDED" | "NOT_ACCEPTABLE" | "TYPE_MISMATCH">>
+  get: (request: { input: GetInput, task?: boolean }, options?: Options) => Promise<unknown | RemoteError<"NOT_FOUND" | "LIMIT_EXCEEDED" | "NOT_ACCEPTABLE" | "TYPE_MISMATCH">>
+  head: (request: { input: HeadInput, task?: boolean }, options?: Options) => Promise<unknown | RemoteError<"NOT_FOUND" | "LIMIT_EXCEEDED" | "NOT_ACCEPTABLE" | "TYPE_MISMATCH">>
+  delete: (request: { input: DeleteInput, task?: boolean }, options?: Options) => Promise<unknown | RemoteError<"NOT_FOUND" | "LIMIT_EXCEEDED" | "NOT_ACCEPTABLE" | "TYPE_MISMATCH">>
+}

package/components/identity.bans/manifest.toa.yaml

@@ -2,17 +2,44 @@ namespace: identity
 name: bans
 
 entity:
-  schema:
+  associated: true
+  properties:
+    comment:
+      type: string
+    banned:
+      type: boolean
+    originator:
+      type: string
+  required:
+    - banned
+    - originator
+  blank:
     banned: false
-  dependent: true
 
 operations:
-  assign:
+  transit:
+    concurrency: retry
     input:
-      banned: true
+      properties:
+        comment:
+          type: string
+        banned:
+          type: boolean
+        originator:
+          properties:
+            id:
+              type: string
+          type: object
+      type: object
+      required:
+        - banned
+        - originator
 
 exposition:
   isolated: true
   /:id:
-    auth:role: system:identity:bans
-    PUT: assign
+    io:output: false
+    auth:rule:
+      role: system:identity:bans
+      delegate: originator
+    PUT: transit

package/components/identity.bans/operations/transit.js

@@ -0,0 +1,7 @@
+export function transition(input, object) {
+    object.banned = input.banned;
+    object.originator = input.originator.id;
+    object.comment = input.comment;
+    return object;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhbnNpdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS90cmFuc2l0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE1BQU0sVUFBVSxVQUFVLENBQUMsS0FBWSxFQUFFLE1BQWM7SUFDckQsTUFBTSxDQUFDLE1BQU0sR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFBO0lBQzVCLE1BQU0sQ0FBQyxVQUFVLEdBQUcsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUE7SUFDdkMsTUFBTSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFBO0lBRTlCLE9BQU8sTUFBTSxDQUFBO0FBQ2YsQ0FBQyJ9

package/components/identity.bans/source/transit.ts

@@ -0,0 +1,21 @@
+export function transition(input: Input, object: Entity): Entity {
+  object.banned = input.banned
+  object.originator = input.originator.id
+  object.comment = input.comment
+
+  return object
+}
+
+interface Entity {
+  banned: boolean
+  originator: string
+  comment?: string
+}
+
+interface Input {
+  banned: boolean
+  originator: {
+    id: string
+  }
+  comment?: string
+}

package/components/identity.bans/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../../../tsconfig.component.json",
+  "compilerOptions": {
+    "outDir": "./operations",
+    "rootDir": "./source"
+  },
+  "include": [
+    "source"
+  ]
+}

package/components/identity.bans/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.

package/components/identity.bans/types/toa.d.ts

@@ -0,0 +1,35 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options, Query } from '@toa.io/core/types'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  comment?: string
+  banned: boolean
+  originator: string
+  id: string
+  VERSION: number
+  CREATED: number
+  UPDATED: number
+  DELETED: number | null
+  REGION: number
+}
+
+export type TransitInput = {
+  comment?: string
+  banned: boolean
+  originator: {
+    id?: string
+  }
+}
+
+export interface Component {
+  transit: (request: { input: TransitInput, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+}

package/components/identity.basic/events/principal.js

@@ -1,9 +1,13 @@
-'use strict'
+export const condition = function (event, context) {
+  const principal = context.configuration.principal
 
-exports.condition = function (event, context) {
-  return event.state.username === context.configuration.principal
+  return (
+    principal !== undefined &&
+    event.state.authority === principal.authority &&
+    event.state.username === principal.username
+  )
 }
 
-exports.payload = function (event) {
+export const payload = function (event) {
   return { id: event.state.id }
 }

package/components/identity.basic/manifest.toa.yaml

@@ -2,49 +2,235 @@ namespace: identity
 name: basic
 
 entity:
-  schema:
-    username*: string
-    password*: string
-  dependent: true
+  associated: true
+  properties:
+    authority:
+      type: string
+    username:
+      type: string
+    password:
+      type: string
+  required:
+    - authority
+    - username
+    - password
 
 operations:
   transit:
     concurrency: retry
+    output: &id
+      type: object
+      required: [id]
+      properties:
+        id: { type: string }
     input:
-      username: string
-      password: string
-  incept:
+      properties:
+        username:
+          type: string
+        password:
+          type: string
+        authority:
+          type: string
+        inception:
+          description: Whether the credentials are being created rather than changed
+          type: boolean
+      type: object
+    errors: &transit.errors
+      - PRINCIPAL_LOCKED
+      - INVALID_USERNAME
+      - INVALID_PASSWORD
+      - EXISTS
+  create:
     forward: transit
     query: false
     input:
-      username*: string
-      password*: string
-  create:
+      properties:
+        authority:
+          type: string
+        username:
+          type: string
+        password:
+          type: string
+      type: object
+      required:
+        - authority
+        - username
+        - password
+    errors: *transit.errors
+  add:
     input:
-      id*: string
-      credentials*: string
+      properties:
+        id:
+          type: string
+        authority:
+          type: string
+        username:
+          type: string
+        password:
+          type: string
+      type: object
+      required:
+        - id
+        - authority
+        - username
+        - password
+    errors: *transit.errors
+  incept:
+    input:
+      properties:
+        authority:
+          type: string
+        id:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - authority
+        - id
+        - credentials
     output:
-      id: string
+      properties:
+        id:
+          type: string
+      type: object
+    errors:
+      - INVALID_CREDENTIALS
   authenticate:
-    input: string
+    input:
+      properties:
+        authority:
+          type: string
+        credentials:
+          type: string
+      type: object
+      required:
+        - authority
+        - credentials
     output:
-      identity:
-        id: string
+      properties:
+        identity:
+          properties:
+            id:
+              type: string
+          type: object
+      type: object
+    errors:
+      - NOT_FOUND
+      - PASSWORD_MISMATCH
+  check:
+    input:
+      type: object
+      properties:
+        username:
+          type: string
+          minLength: 1
+      required:
+        - username
+    output: { type: 'null' }
+  info:
+    input:
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      type: object
+      required:
+        - authority
+        - identity
+    output:
+      type: object
+      nullable: true
+      additionalProperties: false
+      properties:
+        username:
+          type: string
+      required:
+        - username
+  delete:
+    input:
+      properties:
+        authority:
+          type: string
+        identity:
+          type: string
+      type: object
+      required:
+        - authority
+        - identity
 
 configuration:
-  rounds: 10
-  pepper: ''
-  principal: string
-  username+: ^\S{1,128}$
-  password+: ^\S{8,32}$
+  schema:
+    type: object
+    properties:
+      rounds:
+        type: integer
+        minimum: 1
+      pepper:
+        description: Hashing pepper, a secret
+        type: string
+        format: secret
+      principal:
+        description: Basic credentials whose Identity is granted the `system` role
+        type: object
+        properties:
+          authority:
+            type: string
+          username:
+            type: string
+        required:
+          - authority
+          - username
+        additionalProperties: false
+      username:
+        type: array
+        items:
+          type: string
+      password:
+        type: array
+        items:
+          type: string
+    # every one of them has a default, so the component reads them without checking
+    required: [rounds, username, password]
+
+  defaults:
+    rounds: 10
+    username:
+    - ^.{1,128}$
+    password:
+    - ^.{8,32}$
 
 exposition:
   isolated: true
   /:
-    anonymous: true
-    POST: incept
+    POST:
+      anonymous: true
+      map:authority: authority
+      io:output: [id]
+      endpoint: create
   /:id:
+    io:output: [id]
+    io:input: [username, password]
     auth:role: system:identity:basic
-    auth:scheme: basic
     auth:id: id
-    PATCH: transit
+    PATCH:
+      auth:scheme: basic
+      endpoint: transit
+    POST:
+      map:authority: authority
+      map:segments:
+        id: id
+      endpoint: add
+    DELETE:
+      map:authority: authority
+      map:segments:
+        identity: id
+      io:output: false
+      endpoint: delete
+
+  /usernames/:username:
+    GET:
+      map:authority: authority
+      anonymous: true
+      endpoint: check