@_mustachio/openauth 0.11.0 → 0.12.0

package/src/domain/callback.ts

@@ -58,6 +58,21 @@ export type HandleCallbackInput = {
   /** The raw `Request` for the upstream provider's redirect. */
   rawRequest: Request
   cookies: ReadonlyMap<string, string>
+  /**
+   * Resolved tenant for this request. The SP-initiated path derives
+   * the tenant from the consumed flow and ignores this. The
+   * **IdP-initiated** path (unsolicited POST, no flow) has nothing to
+   * derive from, so it uses this — populated by the HTTP layer from
+   * the tenant middleware. Absent ⇒ IdP-initiated is not attempted.
+   */
+  tenant?: TenantContext
+  /**
+   * Per-request issuer URL (HTTP layer). Used only by the
+   * IdP-initiated path to derive the SP entityID / ACS — the same
+   * derivation the AuthnRequest and metadata paths use, so the values
+   * cannot drift.
+   */
+  issuerUrl?: string
 }
 
 export type HandleCallbackDeps = {
@@ -81,24 +96,73 @@ export type HandleCallbackDeps = {
   ) => Record<string, unknown> | Promise<Record<string, unknown>>
 }
 
+/**
+ * The framework's MAC state envelope normally rides `?state=` on the
+ * upstream redirect. POST-binding callbacks carry it in the form body
+ * instead: OAuth `response_mode=form_post` uses `state`, SAML's
+ * HTTP-POST binding uses `RelayState`. Read the query first (cheap,
+ * the common case) and fall back to a **cloned** body read so the
+ * downstream method handler still gets an unconsumed request body
+ * (it needs it for `code` / `SAMLResponse`).
+ *
+ * Any body-parse failure degrades to "no state" — identical to the
+ * pre-existing behaviour when the query param is absent.
+ */
+async function extractCallbackState(req: Request): Promise<string | null> {
+  const fromQuery = new URL(req.url).searchParams.get("state")
+  if (fromQuery) return fromQuery
+  if (req.method !== "POST") return null
+  const ct = req.headers.get("content-type") ?? ""
+  if (!ct.includes("application/x-www-form-urlencoded")) return null
+  try {
+    const body = await req.clone().text()
+    const form = new URLSearchParams(body)
+    const v = form.get("state") ?? form.get("RelayState")
+    return v && v.length > 0 ? v : null
+  } catch {
+    return null
+  }
+}
+
 export async function handleCallback(
   input: HandleCallbackInput,
   deps: HandleCallbackDeps,
 ): Promise<Result<CallbackOutput, AuthError>> {
   const url = new URL(input.rawRequest.url)
-  const state = url.searchParams.get("state")
-  if (!state) {
-    return err(authError.invalidRequest("missing state parameter", "state"))
-  }
-  const envelopeRes = await verifyStateEnvelope(state, deps.stateKeys)
-  if (isErr(envelopeRes)) {
+  const state = await extractCallbackState(input.rawRequest)
+  // A SAML IdP-initiated POST may legitimately carry a `RelayState`
+  // (Okta/Entra deep-link tokens), so "RelayState present" does NOT
+  // imply "framework state envelope present". The envelope is only
+  // real if it MAC-verifies. When there is no verifiable envelope —
+  // none at all, or a value that fails verification — first try
+  // IdP-initiated (the only flowless path). Only if that is not a
+  // clean candidate do we emit the original error/audit, unchanged
+  // for every method that did not opt into `unsolicitedCallback`.
+  const envelopeRes = state
+    ? await verifyStateEnvelope(state, deps.stateKeys)
+    : null
+  if (envelopeRes === null || isErr(envelopeRes)) {
+    const idp = await tryIdpInitiated(input, deps, url)
+    if (idp) return idp
+    if (!state) {
+      return err(authError.invalidRequest("missing state parameter", "state"))
+    }
+    // State present but no valid envelope and not an IdP-init
+    // candidate — the original tampered/expired-envelope behaviour.
     await safeAudit(deps, {
       kind: "flow_replay_attempt",
       tenantId: null,
       flowId: "unknown",
       timestamp: deps.clock(),
     })
-    return err(authError.invalidRequest(envelopeRes.error.description, "state"))
+    return err(
+      authError.invalidRequest(
+        envelopeRes && isErr(envelopeRes)
+          ? envelopeRes.error.description
+          : "invalid state",
+        "state",
+      ),
+    )
   }
   const envelope = envelopeRes.value
 
@@ -263,6 +327,150 @@ async function translate(
   }
 }
 
+/**
+ * IdP-initiated (unsolicited) SAML SSO — SAML-AD7, the one carve-out
+ * vs. OAuth/OIDC methods. There is no AuthnRequest, no MAC state
+ * envelope, and no flow record, so none of `handleCallback`'s gates
+ * apply. Returns `null` when this is **not** a clean IdP-init candidate
+ * (so the caller emits the normal "missing state" error — the
+ * conservative default); otherwise a final `CallbackOutput`.
+ *
+ * Trust chain (no flow to lean on):
+ *   - the assertion itself is signature/issuer/audience/conditions
+ *     verified by the method (`consumeAssertion`, IdP-init mode) plus
+ *     explicit assertion-ID replay dedup;
+ *   - the RP binding is NOT attacker-influenced — it comes from the
+ *     method's `unsolicitedBinding` (operator config), and is then
+ *     re-validated here against the tenant's registered client +
+ *     redirect URIs (open-redirect defence-in-depth). `RelayState` is
+ *     never interpreted as a redirect.
+ */
+async function tryIdpInitiated(
+  input: HandleCallbackInput,
+  deps: HandleCallbackDeps,
+  url: URL,
+): Promise<Result<CallbackOutput, AuthError> | null> {
+  if (input.rawRequest.method !== "POST") return null
+  if (!input.tenant || !input.issuerUrl) return null
+
+  const segments = url.pathname.split("/").filter(Boolean)
+  if (segments.length < 2 || segments[0] !== "cb") return null
+  const methodId = segments[1]!
+
+  const methodRes = await deps.methodCache.resolve(
+    input.tenant.config,
+    methodId,
+  )
+  if (isErr(methodRes)) return null
+  const method = methodRes.value
+  if (method.unsolicitedCallback !== true) return null
+
+  const callbackUrl = `${url.protocol}//${url.host}/cb/${methodId}`
+  const dispatched = await dispatchMethod({
+    method,
+    route: "GET /callback",
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: "/callback",
+    flow: null,
+    cookies: input.cookies,
+    sessionStore: deps.sessionStore,
+    dispatch: { state: "", callbackUrl, issuerUrl: input.issuerUrl },
+  })
+  if (isErr(dispatched)) return err(dispatched.error)
+
+  const result = dispatched.value
+  if (result.kind === "challenge") {
+    return ok({
+      kind: "challenge",
+      response: result.response,
+      setCookies: result.setCookies ?? [],
+      ...(result.cache !== undefined ? { cache: result.cache } : {}),
+    })
+  }
+  if (result.kind === "denied") {
+    await safeAudit(deps, {
+      kind: "authorize_failed",
+      tenantId: input.tenant.id,
+      clientId: "idp-initiated",
+      methodId,
+      methodKind: method.kind,
+      flowId: "idp-initiated",
+      reason: result.reason,
+      timestamp: deps.clock(),
+    })
+    return ok({
+      kind: "denied",
+      reason: result.reason,
+      setCookies: result.setCookies ?? [],
+    })
+  }
+  if (result.kind === "error") return err(result.error)
+
+  // success — must carry the operator-configured RP binding.
+  const binding = result.unsolicitedBinding
+  if (!binding) {
+    return err(
+      authError.internalError(
+        `method "${methodId}" handled an unsolicited callback but returned ` +
+          `no unsolicitedBinding`,
+      ),
+    )
+  }
+  // Open-redirect defence-in-depth: the binding is operator config, but
+  // still validate it against the tenant's registered client exactly
+  // as /authorize validates an RP's redirect_uri.
+  const client = input.tenant.config.clients.find(
+    (c) => c.id === binding.clientId,
+  )
+  if (!client) {
+    return err(
+      authError.invalidRequest(
+        `IdP-initiated binding references unknown client "${binding.clientId}"`,
+      ),
+    )
+  }
+  if (!client.redirectUris.includes(binding.redirectUri)) {
+    return err(
+      authError.invalidRequest(
+        `IdP-initiated redirect_uri "${binding.redirectUri}" is not ` +
+          `registered for client "${binding.clientId}"`,
+      ),
+    )
+  }
+
+  const code = (deps.newCodeId ?? randomToken)()
+  const now = deps.clock()
+  const saved = await saveEncryptedCode(
+    code,
+    {
+      tenantId: input.tenant.id,
+      clientId: binding.clientId,
+      appRedirectUri: binding.redirectUri,
+      // No RP-supplied OAuth state in an unsolicited flow; RelayState
+      // is opaque and intentionally NOT echoed as `state`.
+      appState: null,
+      scopes: binding.scopes,
+      methodId,
+      methodKind: method.kind,
+      context: input.tenant.request.custom ?? null,
+      providerSubject: result.providerSubject,
+      properties: result.properties,
+      authTime: Math.floor(now / 1000),
+      expiresAt: now + AUTH_CODE_TTL_MS,
+    },
+    AUTH_CODE_TTL_MS,
+    { keyStore: deps.keyStore, tokenStore: deps.tokenStore },
+  )
+  if (isErr(saved)) return err(saved.error)
+  return ok({
+    kind: "issue-code",
+    code,
+    appRedirectUri: binding.redirectUri,
+    appState: null,
+  })
+}
+
 function normalizePath(p: string): string {
   return p.replace(/\/+$/, "")
 }

package/src/domain/method-dispatch.ts

@@ -16,10 +16,11 @@ import type {
   MethodContext,
   MethodDispatchData,
   MethodResult,
+  MethodScratch,
 } from "../types/method"
 import type { Result } from "../types/result"
 import { err, isErr, ok } from "../types/result"
-import type { TenantContext } from "../types/tenant"
+import type { TenantContext, TenantId } from "../types/tenant"
 
 export type RouteKey = `${"GET" | "POST"} ${string}`
 
@@ -62,6 +63,11 @@ export async function dispatchMethod(
     methodState: input.flow?.methodState ?? null,
     cookies: input.cookies,
     dispatch: input.dispatch,
+    methodScratch: buildMethodScratch(
+      input.sessionStore,
+      input.tenant.id,
+      input.method.id,
+    ),
   }
 
   let result: MethodResult<unknown, unknown>
@@ -93,3 +99,49 @@ export async function dispatchMethod(
 
   return ok(result)
 }
+
+/**
+ * Construct the scoped `MethodScratch` handed to a method handler. Keys
+ * are namespaced `scratch:<tenantId>:<methodId>:<userKey>` so a method
+ * instance can never read or clobber another instance's data — even
+ * across tenants on a shared store.
+ *
+ * When the underlying `SessionStore` doesn't implement
+ * `saveScratch` / `readScratch` / `deleteScratch`, every operation
+ * returns `unsupportedAdapter` so methods can surface a clean error
+ * rather than silently no-op.
+ */
+function buildMethodScratch(
+  store: SessionStore,
+  tenantId: TenantId,
+  methodId: string,
+): MethodScratch {
+  const prefix = `scratch:${tenantId}:${methodId}:`
+  const scope = (key: string): string => `${prefix}${key}`
+  const unsupported = (op: string): AuthError =>
+    authError.internalError(
+      `SessionStore does not implement ${op}; methodScratch is unavailable on this adapter`,
+    )
+
+  return {
+    put: async (key, value, ttlMs) => {
+      if (!store.saveScratch) return err(unsupported("saveScratch"))
+      if (ttlMs <= 0) {
+        return err(
+          authError.internalError(
+            `methodScratch.put: ttlMs must be positive, got ${ttlMs}`,
+          ),
+        )
+      }
+      return store.saveScratch(scope(key), value, ttlMs)
+    },
+    get: async (key) => {
+      if (!store.readScratch) return err(unsupported("readScratch"))
+      return store.readScratch(scope(key))
+    },
+    delete: async (key) => {
+      if (!store.deleteScratch) return err(unsupported("deleteScratch"))
+      return store.deleteScratch(scope(key))
+    },
+  }
+}

package/src/domain/method-route.ts

@@ -32,7 +32,14 @@ import type { SessionStore } from "../ports/session-store"
 import type { TokenStore } from "../ports/token-store"
 import { authError, type AuthError } from "../types/error"
 import type { FlowRecord } from "../types/flow"
-import type { MethodResult, CachePolicy, SetCookie } from "../types/method"
+import type { LogoutEventInput, LogoutHookResult } from "../types/idp"
+import type {
+  AuthMethod,
+  CachePolicy,
+  MethodDispatchData,
+  MethodResult,
+  SetCookie,
+} from "../types/method"
 import type { Result } from "../types/result"
 import { err, isErr, ok } from "../types/result"
 import type { TenantContext } from "../types/tenant"
@@ -42,6 +49,7 @@ import { AUTH_CODE_TTL_MS } from "./authorize"
 import { randomToken } from "./crypto"
 import { MethodCache } from "./method-cache"
 import { dispatchMethod, type RouteKey } from "./method-dispatch"
+import { revokeAllForSubject } from "./revoke"
 import { saveEncryptedCode } from "./token"
 
 export type MethodRouteOutput =
@@ -211,3 +219,184 @@ async function translate(
       return err(result.error)
   }
 }
+
+/**
+ * Anonymous public method route — the fourth, deliberately narrow,
+ * pipeline. Used only for route keys a method explicitly lists in
+ * `AuthMethod.publicRoutes` (today: SAML SP `GET /metadata`). No flow
+ * cookie, no flow record, no `SessionStore` read: the handler is a pure
+ * function of `tenant` + `dispatch` + captured config.
+ *
+ * Security: this re-checks `publicRoutes` membership against the
+ * resolved method. The HTTP layer also checks before routing here, but
+ * a domain function guarding a no-auth path must not trust its caller —
+ * the gate is enforced here too, fail-closed.
+ *
+ * Only `challenge` (the metadata document) and `denied` are sensible
+ * outcomes; `success` from a flowless route is a programming error
+ * (there is no flow to consume into an auth code) and surfaces as an
+ * internal error rather than silently authenticating.
+ */
+export type HandlePublicMethodRouteInput = {
+  rawRequest: Request
+  tenant: TenantContext
+  /** Pre-resolved by the HTTP layer (it needed it to detect the public route). */
+  method: AuthMethod
+  route: RouteKey
+  subPath: string
+  /** Issuer/callback context so the handler can derive stable URLs. */
+  dispatch: MethodDispatchData
+}
+
+export type HandlePublicMethodRouteDeps = {
+  sessionStore: SessionStore
+  /**
+   * Required for the upstream-logout path: when a public route returns a
+   * `challenge` carrying `logout`, the framework runs
+   * `revokeAllForSubject` for the host-named subject. Anonymous read-only
+   * public routes (`/metadata`-style) never touch this.
+   */
+  tokenStore: TokenStore
+  clock: () => number
+  auditLog?: AuditLog
+  /**
+   * See `IdPOptions.onLogout`. Absent ⇒ the framework still verifies +
+   * acknowledges the logout and audits it, but revokes nothing (it
+   * cannot resolve the upstream id to a subject without the host).
+   */
+  onLogout?: (
+    input: LogoutEventInput,
+  ) => Promise<LogoutHookResult> | LogoutHookResult
+}
+
+export type PublicMethodRouteOutput =
+  | { kind: "challenge"; response: Response; cache?: CachePolicy }
+  | { kind: "denied"; reason: string }
+
+export async function handlePublicMethodRoute(
+  input: HandlePublicMethodRouteInput,
+  deps: HandlePublicMethodRouteDeps,
+): Promise<Result<PublicMethodRouteOutput, AuthError>> {
+  if (!input.method.publicRoutes?.includes(input.route)) {
+    return err(
+      authError.invalidRequest(
+        `route "${input.route}" is not public on method "${input.method.id}"`,
+        "path",
+      ),
+    )
+  }
+
+  const dispatched = await dispatchMethod({
+    method: input.method,
+    route: input.route,
+    tenant: input.tenant,
+    request: input.rawRequest,
+    subPath: input.subPath,
+    flow: null,
+    cookies: new Map(),
+    sessionStore: deps.sessionStore,
+    dispatch: input.dispatch,
+  })
+  if (isErr(dispatched)) return err(dispatched.error)
+
+  const r = dispatched.value
+  switch (r.kind) {
+    case "challenge": {
+      // A verified upstream logout (SAML front-channel SLS): the method
+      // proved authenticity and built the `LogoutResponse`; the
+      // privileged side effect (host teardown + token revocation) runs
+      // here, where the ports live. Fail closed — if the side effect
+      // errors we do NOT hand back a `LogoutResponse` that would tell
+      // the IdP the user is logged out when they may not be.
+      if (r.logout) {
+        const sideEffect = await runUpstreamLogout(input, deps, r.logout)
+        if (isErr(sideEffect)) return err(sideEffect.error)
+      }
+      return ok({
+        kind: "challenge",
+        response: r.response,
+        ...(r.cache !== undefined ? { cache: r.cache } : {}),
+      })
+    }
+    case "denied":
+      return ok({ kind: "denied", reason: r.reason })
+    case "success":
+      return err(
+        authError.internalError(
+          `public route "${input.route}" on method "${input.method.id}" ` +
+            `returned success — a flowless route cannot authenticate`,
+        ),
+      )
+    case "error":
+      return err(r.error)
+  }
+}
+
+/**
+ * Run the privileged side effect for a verified upstream logout: fire
+ * the host's `onLogout` hook, then — if the host named a subject —
+ * revoke that subject's library-issued tokens via the same
+ * `revokeAllForSubject` primitive `/end_session` uses. Always emits a
+ * `session_logout` audit event (`via: "upstream_slo"`).
+ *
+ * The library cannot map the upstream `nameId` to an OIDC subject
+ * itself (that mapping lives in the host's `success` callback), so
+ * revocation is host-directed by design. A throwing hook or a failed
+ * revoke fails closed (`internal_error`) — the caller then withholds
+ * the `LogoutResponse`.
+ */
+async function runUpstreamLogout(
+  input: HandlePublicMethodRouteInput,
+  deps: HandlePublicMethodRouteDeps,
+  logout: { nameId?: string; sessionIndex?: string },
+): Promise<Result<void, AuthError>> {
+  let hookResult: LogoutHookResult = undefined
+  if (deps.onLogout) {
+    const evt: LogoutEventInput = {
+      tenant: input.tenant,
+      methodId: input.method.id,
+      methodKind: input.method.kind,
+      reason: "upstream_slo",
+      ...(logout.nameId !== undefined ? { nameId: logout.nameId } : {}),
+      ...(logout.sessionIndex !== undefined
+        ? { sessionIndex: logout.sessionIndex }
+        : {}),
+    }
+    try {
+      hookResult = await deps.onLogout(evt)
+    } catch (e) {
+      return err(
+        authError.internalError(
+          `onLogout hook threw during upstream Single Logout for method ` +
+            `"${input.method.id}"`,
+          e,
+        ),
+      )
+    }
+  }
+
+  const revokeSubject =
+    hookResult && typeof hookResult === "object"
+      ? hookResult.revokeSubject
+      : undefined
+
+  if (revokeSubject) {
+    const revoked = await revokeAllForSubject(input.tenant.id, revokeSubject, {
+      tokenStore: deps.tokenStore,
+      ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
+      clock: deps.clock,
+    })
+    if (isErr(revoked)) return err(revoked.error)
+  }
+
+  await safeAudit(deps, {
+    kind: "session_logout",
+    tenantId: input.tenant.id,
+    via: "upstream_slo",
+    methodId: input.method.id,
+    methodKind: input.method.kind,
+    ...(revokeSubject ? { subjectId: revokeSubject } : {}),
+    timestamp: deps.clock(),
+  })
+  return ok(undefined)
+}

package/src/http/context.ts

@@ -17,6 +17,8 @@ import type { MethodCache } from "../domain/method-cache"
 import type { AuthError } from "../types/error"
 import type {
   ExchangeAudience,
+  LogoutEventInput,
+  LogoutHookResult,
   PersistUpstreamTokens,
   RegisterClient,
   RenderPicker,
@@ -49,6 +51,10 @@ export type HttpDeps = {
   callbackHostFor?: (tenantId: TenantId) => string
   resolveTenant: (req: Request) => Promise<Result<TenantId, AuthError>>
   success: (input: SuccessMapInput) => Promise<SubjectClaim>
+  /** See `IdPOptions.onLogout` — upstream Single Logout host hook. */
+  onLogout?: (
+    input: LogoutEventInput,
+  ) => Promise<LogoutHookResult> | LogoutHookResult
   persistUpstreamTokens?: PersistUpstreamTokens
   exchangeAudience?: ExchangeAudience
   renderPicker?: RenderPicker

package/src/http/cookies.ts

@@ -7,7 +7,7 @@
  * strip method-returned `Set-Cookie` / security / `Cache-Control` headers so
  * methods cannot bypass policy.
  */
-import type { SetCookie } from "../types/method"
+import type { CachePolicy, SetCookie } from "../types/method"
 
 /** Parse an incoming `Cookie:` header into a read-only map. */
 export function parseCookieHeader(header: string | null): Map<string, string> {
@@ -117,6 +117,24 @@ const STRIPPED_HEADERS = [
   "cache-control",
 ] as const
 
+/**
+ * Serialize a `MethodResult.challenge`'s `CachePolicy` into a
+ * `Cache-Control` header value. The framework owns this header (methods
+ * cannot set it directly — see `STRIPPED_HEADERS`); a method opts into
+ * caching via the typed `cache` field and this renders it. Absent /
+ * `maxAge: 0` ⇒ `no-store` (the safe default for auth UI).
+ */
+export function cacheControlHeader(cache: CachePolicy | undefined): string {
+  if (!cache) return "no-store"
+  if ((cache.maxAge ?? -1) === 0) return "no-store"
+  const parts: string[] = []
+  if (cache.isPrivate) parts.push("private")
+  if (cache.maxAge !== undefined) parts.push(`max-age=${cache.maxAge}`)
+  if (cache.sMaxAge !== undefined) parts.push(`s-maxage=${cache.sMaxAge}`)
+  if (cache.immutable) parts.push("immutable")
+  return parts.length ? parts.join(", ") : "no-store"
+}
+
 export type ApplyOptions = {
   setCookies?: SetCookie[]
   cookieDefaults?: CookieDefaults

package/src/http/handlers/authorize.ts

@@ -24,7 +24,7 @@ import type {
 import type { PickerContext, PickerMethod } from "../../types/picker"
 import { renderPicker as renderDefaultPicker } from "../../ui/picker"
 
-import { applyResponsePolicy } from "../cookies"
+import { applyResponsePolicy, cacheControlHeader } from "../cookies"
 import type { HttpContext, HttpDeps } from "../context"
 import {
   authorizeDirectErrorResponse,
@@ -209,7 +209,7 @@ export function makeAuthorizeHandler(deps: HttpDeps) {
         return applyResponsePolicy(out.response, {
           setCookies: [flowCookie, ...out.setCookies],
           cookieDefaults: deps.cookieDefaults,
-          cacheControl: cacheControlFor(out.cache),
+          cacheControl: cacheControlHeader(out.cache),
         })
       }
       case "issue-code": {
@@ -341,22 +341,3 @@ function clearFlowCookie() {
   }
 }
 
-function cacheControlFor(
-  cache:
-    | {
-        maxAge?: number
-        sMaxAge?: number
-        isPrivate?: boolean
-        immutable?: boolean
-      }
-    | undefined,
-): string {
-  if (!cache) return "no-store"
-  if ((cache.maxAge ?? -1) === 0) return "no-store"
-  const parts: string[] = []
-  if (cache.isPrivate) parts.push("private")
-  if (cache.maxAge !== undefined) parts.push(`max-age=${cache.maxAge}`)
-  if (cache.sMaxAge !== undefined) parts.push(`s-maxage=${cache.sMaxAge}`)
-  if (cache.immutable) parts.push("immutable")
-  return parts.length ? parts.join(", ") : "no-store"
-}

package/src/http/handlers/callback.ts

@@ -16,8 +16,16 @@ import { authorizeDirectErrorResponse } from "../errors"
 
 export function makeCallbackHandler(deps: HttpDeps) {
   return async (c: HttpContext): Promise<Response> => {
+    const tenant = c.get("tenant")
     const result = await handleCallback(
-      { rawRequest: c.req.raw, cookies: c.get("cookies") },
+      {
+        rawRequest: c.req.raw,
+        cookies: c.get("cookies"),
+        // Only the IdP-initiated (no-state) path reads these; the
+        // SP-initiated path derives tenant from the consumed flow.
+        ...(tenant ? { tenant } : {}),
+        issuerUrl: c.get("issuerUrl"),
+      },
       {
         configStore: deps.configStore,
         sessionStore: deps.sessionStore,