@toa.io/extensions.exposition 1.0.0-alpha.6 → 1.0.0-alpha.60

package/features/annotation.feature

@@ -18,6 +18,7 @@ Feature: Annotation
     When the following request is received:
       """
       GET /foo/ HTTP/1.1
+      host: nex.toa.io
       accept: application/yaml
       """
     Then the following reply is sent:

package/features/auth.claim.feature

@@ -0,0 +1,170 @@
+@security
+Feature: Federated identity authentication
+
+  Background:
+    Given the `identity.federation` database is empty
+    And local IDP is running
+    And the IDP token for Bob is issued
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+
+  Scenario: Full claim
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claim:
+            iss: http://localhost:44444
+            aud: test
+            sub: Bob
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: Only `sub`
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claim:
+            sub: Bob
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: No `sub`
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claim:
+            iss: http://localhost:44444
+            aud: test
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: `sub` mismatch
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claim:
+            iss: http://localhost:44444
+            sub: Alice
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: `aud` mismatch
+    Given the annotation:
+      """yaml
+      /:
+        GET:
+          auth:claim:
+            iss: http://localhost:44444
+            aud: goalkeepers
+          dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: nex.toa.io
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+  Scenario: Matching authority and Route parameter
+    Given the annotation:
+      """yaml
+      authorities:
+        test: the.test.local
+      /:
+        /:id:
+          GET:
+            auth:claim:
+              aud: :authority
+              sub: /:id
+            dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET /Bob/ HTTP/1.1
+      host: the.test.local
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+  Scenario: `iss` matching authority common domain
+    Given the annotation:
+      """yaml
+      /:
+        /:id:
+          GET:
+            auth:claim:
+              iss: :domain
+              sub: /:id
+            dev:stub: ok
+      """
+
+    When the following request is received:
+      """
+      GET /Bob/ HTTP/1.1
+      host: localhost
+      authorization: Bearer ${{ Bob.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/authorities.basic.feature

@@ -0,0 +1,141 @@
+Feature: Basic credentials with authorities
+
+  Scenario: Basic credentials are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+        two: the.two.com
+      /:
+        /:id:
+          auth:id: id
+          io:output: true
+          GET:
+            dev:stub: Hello
+      """
+
+    # create basic credentials within the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set one.username }}
+      password: #{{ password 8 | set one.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ one.id }}
+      """
+
+    # create basic credentials within the `two` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set two.username }}
+      password: #{{ password 8 | set two.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ two.id }}
+      """
+
+    # access the resource with the `one` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # access the resource with the `two` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+    # create `one` credentials in the `two` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ one.username }}
+      password: ${{ one.password }}
+      """
+    Then the following reply is sent:
+      """
+      409 Conflict
+      """
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ one.username }}
+      password: ${{ one.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+
+    # create `two` credentials in the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: ${{ two.username }}
+      password: ${{ two.password }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """

package/features/authorities.feature

@@ -0,0 +1,32 @@
+Feature: Authorities
+
+  Scenario: Accessing an authority
+    Given the annotation:
+      """yaml
+      authorities:
+        example: the.example.com
+      /:
+        anonymous: true
+        GET:
+          dev:stub: Hello
+      """
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: the.example.com
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+    # arbitrary authorities are also allowed
+    When the following request is received:
+      """
+      GET / HTTP/1.1
+      host: the.other.com
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/authorities.federation.feature

@@ -0,0 +1,100 @@
+Feature: OIDC tokens with authorities
+
+  Scenario: OIDC tokens are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+      /:
+        /:id:
+          auth:id: id
+          GET:
+            dev:stub: Hello
+      """
+    And local IDP is running
+    And the `identity.federation` database is empty
+    And the `identity.federation` configuration:
+      """yaml
+      trust:
+        - iss: http://localhost:44444
+      """
+    And the IDP token for One is issued
+    And the IDP token for Two is issued
+
+    # create identities
+    When the following request is received:
+      """
+      POST /identity/federation/ HTTP/1.1
+      host: the.one.com
+      accept: application/yaml
+      content-type: application/yaml
+
+      credentials: ${{ One.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ One.id }}
+      """
+    When the following request is received:
+      """
+      POST /identity/federation/ HTTP/1.1
+      host: the.two.com
+      accept: application/yaml
+      content-type: application/yaml
+
+      credentials: ${{ Two.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+
+      id: ${{ Two.id }}
+      """
+
+    # access `one` authority
+    When the following request is received:
+      """
+      GET /${{ One.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Bearer ${{ One.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+
+    # authorization will create new identity within `one` authority
+    When the following request is received:
+      """
+      GET /${{ Two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Bearer ${{ Two.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+
+    # access `two` authority
+    When the following request is received:
+      """
+      GET /${{ One.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Bearer ${{ One.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      403 Forbidden
+      """
+    When the following request is received:
+      """
+      GET /${{ Two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Bearer ${{ Two.id_token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/authorities.tokens.feature

@@ -0,0 +1,117 @@
+Feature: Token credentials with authorities
+
+  Scenario: Tokens are scoped to authorities
+    Given the annotation:
+      """yaml
+      authorities:
+        one: the.one.com
+      /:
+        /:id:
+          auth:id: id
+          GET:
+            dev:stub: Hello
+      """
+
+    # create identity within the `one` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.one.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set one.username }}
+      password: '#{{ password 8 | set one.password }}'
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: the.one.com
+      accept: application/yaml
+      authorization: Basic #{{ basic one }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ one.token }}
+
+      id: ${{ one.id }}
+      """
+
+    # create identity within the `the.two.com` authority
+    When the following request is received:
+      """
+      POST /identity/basic/ HTTP/1.1
+      host: the.two.com
+      content-type: application/yaml
+      accept: application/yaml
+
+      username: #{{ id | set two.username }}
+      password: '#{{ password 8 | set two.password }}'
+      """
+    Then the following reply is sent:
+      """
+      201 Created
+      """
+    When the following request is received:
+      """
+      GET /identity/ HTTP/1.1
+      host: the.two.com
+      accept: application/yaml
+      authorization: Basic #{{ basic two }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      authorization: Token ${{ two.token }}
+
+      id: ${{ two.id }}
+      """
+
+    # access `one` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Token ${{ one.token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.one.com
+      authorization: Token ${{ two.token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+
+    # access `two` authority
+    When the following request is received:
+      """
+      GET /${{ one.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Token ${{ one.token }}
+      """
+    Then the following reply is sent:
+      """
+      401 Unauthorized
+      """
+    When the following request is received:
+      """
+      GET /${{ two.id }}/ HTTP/1.1
+      host: the.two.com
+      authorization: Token ${{ two.token }}
+      """
+    Then the following reply is sent:
+      """
+      200 OK
+      """

package/features/body.feature

@@ -5,11 +5,13 @@ Feature: Request body
       """yaml
       exposition:
         /:
+          io:output: true
           POST: create
       """
     When the following request is received:
       """
       POST /pots/ HTTP/1.1
+      host: nex.toa.io
       content-type: application/yaml
 
       title: Hello
@@ -31,6 +33,7 @@ Feature: Request body
     When the following request is received:
       """
       GET /echo/world/ HTTP/1.1
+      host: nex.toa.io
       accept: text/plain
       """
     Then the following reply is sent: