@toa.io/extensions.exposition 1.0.0-alpha.5 → 1.0.0-alpha.7

package/features/io.feature

@@ -0,0 +1,167 @@
+Feature: IO restrictions
+
+  Background:
+    Given the `pots` database contains:
+      | _id                              | title      | volume | temperature |
+      | 4c4759e6f9c74da989d64511df42d6f4 | First pot  | 100    | 80          |
+      | 99988d785d7d445cad45dbf8531f560b | Second pot | 200    | 30          |
+
+  Scenario: Output is omitted by default
+    Given the `pots` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          GET: enumerate
+          /:id:
+            GET: observe
+      """
+    When the following request is received:
+      """
+      GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-length: 0
+      """
+    When the following request is received:
+      """
+      GET /pots/ HTTP/1.1
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-length: 0
+      """
+
+  Scenario: Output is omitted by intention
+    Given the `pots` is running with the following manifest:
+      """yaml
+      exposition:
+        /:id:
+          io:output: false
+          GET: observe
+      """
+    When the following request is received:
+      """
+      GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-length: 0
+      """
+
+  Scenario: Output permissions
+    Given the `pots` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: [id, volume]
+          GET: enumerate
+          /:id:
+            GET: observe
+      """
+    When the following request is received:
+      """
+      GET /pots/4c4759e6f9c74da989d64511df42d6f4/ HTTP/1.1
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+
+      id: 4c4759e6f9c74da989d64511df42d6f4
+      volume: 100
+      """
+    And the reply does not contain:
+      """
+      title:
+      temperature:
+      """
+    When the following request is received:
+      """
+      GET /pots/ HTTP/1.1
+      accept: application/yaml
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+
+      - id: 4c4759e6f9c74da989d64511df42d6f4
+        volume: 100
+      - id: 99988d785d7d445cad45dbf8531f560b
+        volume: 200
+      """
+    And the reply does not contain:
+      """
+      title:
+      temperature:
+      """
+
+  Scenario: Input is unrestricted by default
+    Given the `pots` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          POST: create
+      """
+    When the following request is received:
+      """
+      POST /pots/ HTTP/1.1
+      accept: application/yaml
+      content-type: application/yaml
+
+      title: Hello
+      volume: 1.5
+      temperature: 80
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      title: Hello
+      volume: 1.5
+      temperature: 80
+      """
+
+  Scenario: Input permissions
+    Given the `pots` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:input: [title, volume]
+          POST: create
+      """
+    When the following request is received:
+      """
+      POST /pots/ HTTP/1.1
+      accept: text/plain
+      content-type: application/yaml
+
+      title: Hello
+      volume: 1.5
+      temperature: 80
+      """
+    Then the following reply is sent:
+      """
+      400 Bad Request
+
+      Unexpected input: temperature
+      """
+    When the following request is received:
+      """
+      POST /pots/ HTTP/1.1
+      content-type: application/yaml
+
+      title: Hello
+      volume: 1.5
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """

package/features/octets.entries.feature

@@ -4,6 +4,7 @@ Feature: Accessing entries
     Given the annotation:
       """yaml
       /:
+        io:output: true
         auth:anonymous: true
         octets:context: octets
         POST:
@@ -50,6 +51,7 @@ Feature: Accessing entries
     Given the annotation:
       """yaml
       /:
+        io:output: true
         auth:anonymous: true
         octets:context: octets
         POST:

package/features/octets.feature

@@ -4,6 +4,7 @@ Feature: Octets directive family
     Given the annotation:
       """yaml
       /:
+        io:output: true
         auth:anonymous: true
         octets:context: octets
         POST:
@@ -238,6 +239,7 @@ Feature: Octets directive family
     Given the annotation:
       """yaml
       /:
+        io:output: true
         auth:anonymous: true
         octets:context: octets
         POST:

package/features/octets.meta.feature

@@ -5,6 +5,7 @@ Feature: Octets `content-meta` header
     And the annotation:
       """yaml
       /:
+        io:output: true
         auth:anonymous: true
         octets:context: octets
         /*:
@@ -55,11 +56,11 @@ Feature: Octets `content-meta` header
     When the following request is received:
       """
       OPTIONS / HTTP/1.1
-      origin: http://example.com
+      origin: https://example.com
       """
     Then the following reply is sent:
       """
       204 No Content
-      access-control-allow-origin: http://example.com
-      access-control-allow-headers: accept, authorization, content-type, content-meta
+      access-control-allow-origin: https://example.com
+      access-control-allow-headers: accept, authorization, content-type, etag, if-match, if-none-match, content-meta
       """

package/features/octets.workflows.feature

@@ -15,6 +15,7 @@ Feature: Octets storage workflows
               - add-baz: octets.tester.baz
               - diversify: octets.tester.diversify
         /*:
+          io:output: true
           GET:
             octets:fetch:
               meta: true

package/features/queries.feature

@@ -13,6 +13,7 @@ Feature: Queries
       """yaml
       exposition:
         /pot:
+          io:output: true
           GET: observe
       """
     When the following request is received:
@@ -35,6 +36,7 @@ Feature: Queries
       """yaml
       exposition:
         /:
+          io:output: true
           GET: enumerate
       """
     When the following request is received:
@@ -60,6 +62,7 @@ Feature: Queries
       """yaml
       exposition:
         /:
+          io:output: true
           GET: enumerate
       """
     When the following request is received:
@@ -85,6 +88,7 @@ Feature: Queries
       """yaml
       exposition:
         /:
+          io:output: true
           GET: enumerate
       """
     When the following request is received:
@@ -110,6 +114,7 @@ Feature: Queries
       """yaml
       exposition:
         /:id:
+          io:output: true
           GET: observe
       """
     When the following request is received:
@@ -127,11 +132,12 @@ Feature: Queries
       volume: 200
       """
 
-  Scenario: Request to a route with predefined criretia
+  Scenario: Request to a route with predefined criteria
     Given the `pots` is running with the following manifest:
       """yaml
       exposition:
         /big:
+          io:output: true
           GET:
             endpoint: enumerate
             query:
@@ -160,6 +166,7 @@ Feature: Queries
       """yaml
       exposition:
         /big:
+          io:output: true
           GET:
             endpoint: enumerate
             query:
@@ -186,6 +193,7 @@ Feature: Queries
       """yaml
       exposition:
         /hottest2:
+          io:output: true
           GET:
             endpoint: enumerate
             query:

package/features/response.feature

@@ -4,6 +4,7 @@ Feature: Response
     Given the annotation:
       """yaml
       /:
+        io:output: true
         GET:
           anonymous: true
           dev:stub: hello
@@ -25,6 +26,7 @@ Feature: Response
       """yaml
       exposition:
         /:
+          io:output: true
           GET: error
       """
     When the following request is received:
@@ -46,6 +48,7 @@ Feature: Response
       """yaml
       exposition:
         /:
+          io:output: true
           GET: error
       """
     When the following request is received:

package/features/routes.feature

@@ -6,12 +6,14 @@ Feature: Routes
       namespace: basic
 
       exposition:
-        /strict:
-          GET:
-            endpoint: greet
-        /shortcuts:
-          /operation:
-            GET: greet
+        /:
+          io:output: true
+          /strict:
+            GET:
+              endpoint: greet
+          /shortcuts:
+            /operation:
+              GET: greet
       """
     When the following request is received:
       """
@@ -34,6 +36,7 @@ Feature: Routes
       """yaml
       exposition:
         /:
+          io:output: true
           GET: greet
       """
     When the following request is received:
@@ -52,10 +55,12 @@ Feature: Routes
     Given the `greeter` is running with the following manifest:
       """yaml
       exposition:
-        /*:
-          GET: greet
-        /foo/*/bar:
-          GET: greet
+        /:
+          io:output: true
+          /*:
+            GET: greet
+          /foo/*/bar:
+            GET: greet
       """
     When the following request is received:
       """
@@ -94,12 +99,14 @@ Feature: Routes
       """yaml
       exposition:
         /:
+          io:output: true
           POST: create
       """
     And the `users.properties` is running with the following manifest:
       """yaml
       exposition:
         /:id:
+          io:output: true
           GET: observe
       """
     When the following request is received:

package/features/steps/components/pots/manifest.toa.yaml

@@ -14,11 +14,13 @@ operations:
     input:
       title*: .
       volume*: .
+      temperature: .
   transit:
     concurrency: retry
     input:
       title: .
       volume: .
+      temperature: .
   observe:
     output:
       id: string

package/features/steps/components/users/manifest.toa.yaml

@@ -1,4 +1,5 @@
 name: users
+version: 0.0.0
 
 entity:
   schema:

package/features/steps/components/users.properties/manifest.toa.yaml

@@ -1,5 +1,6 @@
 namespace: users
 name: properties
+version: 0.0.0
 
 entity:
   schema:

package/features/timing.feature

@@ -41,3 +41,26 @@ Feature: Server timing
       201 Created
       server-timing:
       """
+
+  Scenario: Octets timing
+    Given the annotation:
+      """yaml
+      trace: true
+      /:
+        io:output: true
+        auth:anonymous: true
+        octets:context: octets
+        POST:
+          octets:store: ~
+      """
+    When the stream of `lenna.png` is received with the following headers:
+      """
+      POST / HTTP/1.1
+      content-type: application/octet-stream
+      """
+    # to debug, break it and look at the console
+    Then the following reply is sent:
+      """
+      201 Created
+      server-timing:
+      """

package/features/vary.feature

@@ -5,6 +5,7 @@ Feature: The Vary directive family
       """yaml
       exposition:
         /:
+          io:output: true
           vary:languages: [en, fr]
           GET:
             vary:embed:
@@ -43,6 +44,7 @@ Feature: The Vary directive family
       """yaml
       exposition:
         /:
+          io:output: true
           GET:
             anonymous: true
             vary:embed:
@@ -62,12 +64,12 @@ Feature: The Vary directive family
       content-language: fr
       """
 
-
   Scenario: Embedding a value of an arbitrary header
     Given the `echo` is running with the following manifest:
       """yaml
       exposition:
         /:
+          io:output: true
           GET:
             vary:embed:
               name: :foo
@@ -88,11 +90,38 @@ Feature: The Vary directive family
       Hello bar
       """
 
+  Scenario: Embedding a `host` header value
+    Given the `echo` is running with the following manifest:
+      """yaml
+      exposition:
+        /:
+          io:output: true
+          GET:
+            vary:embed:
+              name: :Host
+            endpoint: compute
+      """
+    When the following request is received:
+      """
+      GET /echo/ HTTP/1.1
+      accept: application/yaml
+      foo: bar
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      content-type: application/yaml
+      vary: accept
+
+      Hello 127.0.0.1:8000
+      """
+
   Scenario Outline: Embedding a value from the list of options
     Given the `echo` is running with the following manifest:
         """yaml
         exposition:
           /:
+            io:output: true
             vary:languages: [en, fr]
             GET:
               vary:embed:
@@ -127,6 +156,7 @@ Feature: The Vary directive family
         """yaml
         exposition:
           /:
+            io:output: true
             vary:languages: [en, fr]
             GET:
               vary:embed:
@@ -140,11 +170,11 @@ Feature: The Vary directive family
     When the following request is received:
         """
         OPTIONS / HTTP/1.1
-        origin: http://example.com
+        origin: https://example.com
         access-control-request-headers: whatever
         """
     Then the following reply is sent:
         """
         204 No Content
-        access-control-allow-headers: accept, authorization, content-type, accept-language, foo, bar
+        access-control-allow-headers: accept, authorization, content-type, etag, if-match, if-none-match, accept-language, foo, bar
         """

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toa.io/extensions.exposition",
-  "version": "1.0.0-alpha.5",
+  "version": "1.0.0-alpha.7",
   "description": "Toa Exposition",
   "author": "temich <tema.gurtovoy@gmail.com>",
   "homepage": "https://github.com/toa-io/toa#readme",
@@ -17,9 +17,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@toa.io/core": "1.0.0-alpha.5",
-    "@toa.io/generic": "1.0.0-alpha.5",
-    "@toa.io/schemas": "1.0.0-alpha.5",
+    "@toa.io/core": "1.0.0-alpha.7",
+    "@toa.io/generic": "1.0.0-alpha.7",
+    "@toa.io/schemas": "1.0.0-alpha.7",
     "bcryptjs": "2.4.3",
     "error-value": "0.3.0",
     "js-yaml": "4.1.0",
@@ -43,11 +43,11 @@
     "features": "cucumber-js"
   },
   "devDependencies": {
-    "@toa.io/agent": "1.0.0-alpha.5",
-    "@toa.io/extensions.storages": "1.0.0-alpha.5",
+    "@toa.io/agent": "1.0.0-alpha.7",
+    "@toa.io/extensions.storages": "1.0.0-alpha.7",
     "@types/bcryptjs": "2.4.3",
     "@types/cors": "2.8.13",
     "@types/negotiator": "0.6.1"
   },
-  "gitHead": "1e4bb4ac28a6dddff1f4b8c5be7224fcdc47b847"
+  "gitHead": "4f5ac0bc342d4b7bd469fbe5c74266f050b55c9f"
 }

package/schemas/io/input.cos.yaml

@@ -0,0 +1,3 @@
+type: array
+items:
+  type: string

package/schemas/io/message.cos.yaml

@@ -0,0 +1,5 @@
+oneOf:
+  - type: object
+  - type: array
+    items:
+      type: object

package/schemas/io/output.cos.yaml

@@ -0,0 +1,5 @@
+oneOf:
+  - type: boolean
+  - type: array
+    items:
+      type: string

package/source/Gateway.ts

@@ -22,7 +22,7 @@ export class Gateway extends Connector {
   }
 
   public async process (context: http.Context): Promise<http.OutgoingMessage> {
-    const interception = await context.timing.capture('gate:intercept',
+    const interception = await context.timing.capture('intercept',
       this.interceptor.intercept(context))
 
     if (interception !== null)
@@ -43,13 +43,13 @@ export class Gateway extends Connector {
 
     const method = node.methods[context.request.method]
 
-    const interruption = await context.timing.capture('gate:preflight',
+    const interruption = await context.timing.capture('preflight',
       method.directives.preflight(context, parameters))
 
     const response = interruption ??
-      await context.timing.capture('gate:call', this.call(method, context, parameters))
+      await context.timing.capture('call', this.call(method, context, parameters))
 
-    await context.timing.capture('gate:settle', method.directives.settle(context, response))
+    await context.timing.capture('settle', method.directives.settle(context, response))
 
     return response
   }

package/source/HTTP/Server.ts

@@ -102,7 +102,7 @@ export class Server extends Connector {
         else
           status = 200
 
-      response.statusCode = status
+      response.statusCode = message.status = status
       write(context, response, message)
     }
   }
@@ -116,7 +116,7 @@ export class Server extends Connector {
         ? exception.status
         : 500
 
-      const message: OutgoingMessage = {}
+      const message: OutgoingMessage = { status: response.statusCode }
       const verbose = exception instanceof ClientError || this.properties.debug
 
       if (verbose)

package/source/HTTP/messages.ts

@@ -29,7 +29,7 @@ export async function read (context: Context): Promise<any> {
     throw new UnsupportedMediaType()
 
   const format = formats[type]
-  const buf = await context.timing.capture('req:buffer', buffer(context.request))
+  const buf = await context.timing.capture('buffer', buffer(context.request))
 
   try {
     return format.decode(buf)

package/source/directives/auth/Authorization.ts

@@ -37,10 +37,10 @@ export class Authorization implements DirectiveFamily<Directive, Extension> {
   private bans: Component | null = null
 
   public create (name: string, value: any, remotes: Remotes): Directive {
-    assert.ok(name in CLASSES,
+    assert.ok(name in constructors,
       `Directive '${name}' is not provided by the '${this.name}' family.`)
 
-    const Class = CLASSES[name]
+    const Class = constructors[name]
 
     for (const name of REMOTES)
       this.discovery[name] ??= remotes.discover('identity', name)
@@ -132,7 +132,7 @@ export class Authorization implements DirectiveFamily<Directive, Extension> {
   }
 }
 
-const CLASSES: Record<string, new (value: any, argument?: any) => Directive> = {
+const constructors: Record<string, new (value: any, argument?: any) => Directive> = {
   anonymous: Anonymous,
   id: Id,
   role: Role,

package/source/directives/index.ts

@@ -1,11 +1,12 @@
-import { dev } from './dev'
 import { authorization } from './auth'
 import { cache } from './cache'
-import { octets } from './octets'
 import { cors } from './cors'
+import { dev } from './dev'
+import { octets } from './octets'
+import { io } from './io'
 import { vary } from './vary'
 import type { DirectiveFamily } from '../RTD'
 import type { Interceptor } from '../Interception'
 
-export const families: DirectiveFamily[] = [authorization, cache, octets, vary, dev]
+export const families: DirectiveFamily[] = [authorization, io, cache, vary, octets, dev]
 export const interceptors: Interceptor[] = [cors]