@toa.io/extensions.exposition 1.0.0-alpha.30 → 1.0.0-alpha.301

package/features/identity.roles.feature

@@ -1,267 +0,0 @@
-@security
-Feature: Roles management
-
-  Scenario: Granting a role to an Identity
-    # root:secret
-    # user:pass
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username | password                                                     |
-      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | root     | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
-      | 4344518184ad44228baffce7a44fd0b1 | nex       | user     | $2b$10$JoiAQUS7tzobDAFIDBWhWeEIJv933dQetyjRzSmfQGaJE5ZlJbmYy |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role                  |
-      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | system:identity:roles |
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        auth:role: test
-        GET:
-          dev:stub:
-            access: granted!
-      """
-    When the following request is received:
-      # user doesn't have the required role
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjpwYXNz
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-    When the following request is received:
-      # root adds a role to a user
-      """
-      POST /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic cm9vdDpzZWNyZXQ=
-      accept: application/yaml
-      content-type: application/yaml
-
-      role: test
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      grantor: 72cf9b0ab0ac4ab2b8036e4e940ddcae
-      """
-    When the following request is received:
-      # user now have the role
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic dXNlcjpwYXNz
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-
-  Scenario Outline: Delegating roles
-    # moderator:secret
-    # assistant:pass
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | moderator | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
-      | 4344518184ad44228baffce7a44fd0b1 | nex       | assistant | $2b$10$JoiAQUS7tzobDAFIDBWhWeEIJv933dQetyjRzSmfQGaJE5ZlJbmYy |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role                             |
-      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | system:identity:roles:delegation |
-      | 30c969e05ff6437097ed5f07fc52358e | 72cf9b0ab0ac4ab2b8036e4e940ddcae | app:moderation                   |
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        auth:role: app:moderation:photos
-        GET:
-          dev:stub:
-            access: granted!
-      """
-    When the following request is received:
-      # assistant doesn't have the required role
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic YXNzaXN0YW50OnBhc3M=
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-    When the following request is received:
-      # moderator delegates a role to an assistant
-      """
-      POST /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic bW9kZXJhdG9yOnNlY3JldA==
-      content-type: application/yaml
-
-      role: <role>
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """
-    When the following request is received:
-      # assistant has access
-      """
-      GET / HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic YXNzaXN0YW50OnBhc3M=
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    Examples:
-      | role                  |
-      | app:moderation        |
-      | app:moderation:photos |
-
-  Scenario: Delegating role out of own scope
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | moderator | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
-      | 4344518184ad44228baffce7a44fd0b1 | nex       | assistant | $2b$10$JoiAQUS7tzobDAFIDBWhWeEIJv933dQetyjRzSmfQGaJE5ZlJbmYy |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role                             |
-      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | system:identity:roles:delegation |
-      | 30c969e05ff6437097ed5f07fc52358e | 72cf9b0ab0ac4ab2b8036e4e940ddcae | app:moderation                   |
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        auth:role: app:moderation:photos
-        GET:
-          dev:stub:
-            access: granted!
-      """
-    When the following request is received:
-      """
-      POST /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      content-type: application/yaml
-      authorization: Basic bW9kZXJhdG9yOnNlY3JldA==
-
-      role: app:finance
-      """
-    Then the following reply is sent:
-      """
-      422 Unprocessable Entity
-
-      code: OUT_OF_SCOPE
-      """
-
-  Scenario: Delegating role without `system:identity:roles:delegation` role
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | moderator | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
-      | 4344518184ad44228baffce7a44fd0b1 | nex       | assistant | $2b$10$JoiAQUS7tzobDAFIDBWhWeEIJv933dQetyjRzSmfQGaJE5ZlJbmYy |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role           |
-      | 30c969e05ff6437097ed5f07fc52358e | 72cf9b0ab0ac4ab2b8036e4e940ddcae | app:moderation |
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        auth:role: app:moderation:photos
-        GET:
-          dev:stub:
-            access: granted!
-      """
-    When the following request is received:
-      """
-      POST /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
-      host: nex.toa.io
-      content-type: application/yaml
-      authorization: Basic bW9kZXJhdG9yOnNlY3JldA==
-
-      role: app:moderation
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario Outline: Invalid role name
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username | password                                                     |
-      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | root     | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role                  |
-      | 9c4702490ff84f2a9e1b1da2ab64bdd4 | 72cf9b0ab0ac4ab2b8036e4e940ddcae | system:identity:roles |
-    When the following request is received:
-      # root adds a role to a user
-      """
-      POST /identity/roles/4344518184ad44228baffce7a44fd0b1/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic cm9vdDpzZWNyZXQ=
-      content-type: application/yaml
-
-      role: <role>
-      """
-    Then the following reply is sent:
-      """
-      400 Bad Request
-      """
-    Examples:
-      | role          |
-      | app!          |
-      | app:          |
-      | app:no spaces |
-
-  Scenario: Dynamic roles
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | 72cf9b0ab0ac4ab2b8036e4e940ddcae | nex       | moderator | $2b$10$Qq/qnyyU5wjrbDXyWok14OnqAZv/z.pLhz.UddatjI6eHU/rFof4i |
-    And the `identity.roles` database contains:
-      | _id                              | identity                         | role                    |
-      | 30c969e05ff6437097ed5f07fc52358e | 72cf9b0ab0ac4ab2b8036e4e940ddcae | app:29e54ae1:moderation |
-    And the annotation:
-      """yaml
-      /:
-        /broken:
-          auth:role: app:{org}:moderation
-          GET:
-            dev:stub: never
-        /:org:
-          io:output: true
-          auth:role: app:{org}:moderation
-          GET:
-            dev:stub:
-              access: granted!
-      """
-    When the following request is received:
-      """
-      GET /29e54ae1/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic bW9kZXJhdG9yOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    When the following request is received:
-      """
-      GET /88584c9b/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic bW9kZXJhdG9yOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-    When the following request is received:
-      """
-      GET /broken/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic bW9kZXJhdG9yOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      500 Internal Server Error
-      """

package/features/identity.tokens.feature

@@ -1,229 +0,0 @@
-@security
-Feature: Tokens lifecycle
-
-  Scenario: Switching to Token authentication scheme
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        /hello/:id:
-          auth:id: id
-          GET:
-            dev:stub: Hello
-      """
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-type: text/plain
-      authorization: Token ${{ token }}
-
-      Hello
-      """
-
-  Scenario: Refreshing stale token
-    Given the `identity.tokens` configuration:
-      """yaml
-      refresh: 1
-      """
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        /hello/:id:
-          auth:id: id
-          GET:
-            dev:stub: Hello
-      """
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-
-      Hello
-      """
-    Then after 1 second
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      accept: text/plain
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token
-      cache-control: no-store
-
-      Hello
-      """
-
-  Scenario: Token revocation on password change
-    Given the annotation:
-      """yaml
-      /:
-        io:output: true
-        /:id:
-          id: id
-          GET:
-            dev:stub:
-              access: granted!
-      """
-    And the `identity.tokens` configuration:
-      """yaml
-      refresh: 0.1
-      """
-    And the `identity.basic` database contains:
-      | _id                              | _version | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | 1        | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    When the following request is received:
-      """
-      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      """
-    When the following request is received:
-      """
-      PATCH /identity/basic/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-
-      password: new-secret
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      """
-    Then after 0.2 seconds
-    When the following request is received:
-      """
-      GET /efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      401 Unauthorized
-      """
-
-  Scenario: Issuing own token
-    Given the `identity.basic` database contains:
-      | _id                              | authority | username  | password                                                     |
-      | efe3a65ebbee47ed95a73edd911ea328 | nex       | developer | $2b$10$ZRSKkgZoGnrcTNA5w5eCcu3pxDzdTduhteVYXcp56AaNcilNkwJ.O |
-    When the following request is received:
-      """
-      GET /identity/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      """
-    When the following request is received:
-      """
-      POST /identity/tokens/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      content-type: application/yaml
-
-      lifetime: 0
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """
-    # Token scheme must be used
-    When the following request is received:
-      """
-      POST /identity/tokens/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      content-type: application/yaml
-
-      lifetime: 60
-      """
-    Then the following reply is sent:
-      """
-      403 Forbidden
-      """
-
-  Scenario: Responses with tokens comes with `no-store`
-    Given the `identity.tokens` configuration:
-      """yaml
-      refresh: 1
-      """
-    And the annotation:
-      """yaml
-      /:
-        io:output: true
-        /hello/:id:
-          auth:id: id
-          GET:
-            dev:stub: Hello
-        /cacheable/:id:
-          auth:id: id
-          cache:control: max-age=10000
-          GET:
-            dev:stub: Keep it
-      """
-    When the following request is received:
-      """
-      GET /hello/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Basic ZGV2ZWxvcGVyOnNlY3JldA==
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ token }}
-      cache-control: no-store
-      """
-    Then after 1 second
-    When the following request is received:
-      """
-      GET /cacheable/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      authorization: Token ${{ fresh_token }}
-      cache-control: no-store
-      """
-    When the following request is received:
-      """
-      GET /cacheable/efe3a65ebbee47ed95a73edd911ea328/ HTTP/1.1
-      host: nex.toa.io
-      authorization: Token ${{ fresh_token }}
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      cache-control: private, max-age=10000
-      """

package/features/io.feature

@@ -1,205 +0,0 @@
-@security
-Feature: IO restrictions
-
-  Background:
-    Given the `pots` database contains:
-      | _id                              | title      | volume | temperature |
-      | 4c4759e6f9c74da989d64511df42d6f4 | First pot  | 100    | 80          |
-      | 99988d785d7d445cad45dbf8531f560b | Second pot | 200    | 30          |
-
-  Scenario: Output is omitted by default
-    Given the `pots` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          GET: enumerate
-          /:id:
-            GET: observe
-      """
-    When the following request is received:
-      """
-      GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
-      host: nex.toa.io
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-length: 0
-      """
-    When the following request is received:
-      """
-      GET /pots/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-length: 0
-      """
-
-  Scenario: Output is omitted by intention
-    Given the `pots` is running with the following manifest:
-      """yaml
-      exposition:
-        /:id:
-          io:output: false
-          GET: observe
-      """
-    When the following request is received:
-      """
-      GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-length: 0
-      """
-
-  Scenario: Output permissions
-    Given the `pots` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          io:output: [id, volume]
-          GET: enumerate
-          /:id:
-            GET: observe
-      """
-    When the following request is received:
-      """
-      GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-
-      id: 4c4759e6f9c74da989d64511df42d6f4
-      volume: 100
-      """
-    And the reply does not contain:
-      """
-      title:
-      temperature:
-      """
-    When the following request is received:
-      """
-      GET /pots/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      """
-    Then the following reply is sent:
-      """
-      200 OK
-      content-type: application/yaml
-
-      - id: 4c4759e6f9c74da989d64511df42d6f4
-        volume: 100
-      - id: 99988d785d7d445cad45dbf8531f560b
-        volume: 200
-      """
-    And the reply does not contain:
-      """
-      title:
-      temperature:
-      """
-
-  Scenario: Input is unrestricted by default
-    Given the `pots` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          io:output: true
-          POST: create
-      """
-    When the following request is received:
-      """
-      POST /pots/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      content-type: application/yaml
-
-      title: Hello
-      volume: 1.5
-      temperature: 80
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      title: Hello
-      volume: 1.5
-      temperature: 80
-      """
-
-  Scenario: Input permissions
-    Given the `pots` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          io:input: [title, volume]
-          io:output: [id]
-          POST: create
-      """
-    When the following request is received:
-      """
-      POST /pots/ HTTP/1.1
-      host: nex.toa.io
-      accept: text/plain
-      content-type: application/yaml
-
-      title: Hello
-      volume: 1.5
-      temperature: 80
-      """
-    Then the following reply is sent:
-      """
-      400 Bad Request
-
-      Unexpected input: temperature
-      """
-    When the following request is received:
-      """
-      POST /pots/ HTTP/1.1
-      host: nex.toa.io
-      content-type: application/yaml
-
-      title: Hello
-      volume: 1.5
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-      """
-
-  Scenario: IO shortcuts
-    Given the `pots` is running with the following manifest:
-      """yaml
-      exposition:
-        /:
-          input: [title, volume]
-          output: [id, title, volume]
-          POST: create
-      """
-    When the following request is received:
-      """
-      POST /pots/ HTTP/1.1
-      host: nex.toa.io
-      accept: application/yaml
-      content-type: application/yaml
-
-      title: Hello
-      volume: 1.5
-      """
-    Then the following reply is sent:
-      """
-      201 Created
-
-      id:
-      title: Hello
-      volume: 1.5
-      """