@learncard/lca-api-service 1.4.0 → 1.5.1

package/serverless.yml

@@ -18,16 +18,14 @@ custom:
         number: 3
     config:
         CACHE_INSTANCE_SIZE: cache.t2.micro
-    # Lambda caps each function's environment at 4KB. Escrow config is only read
-    # by the trpc/api handlers, so it is attached per-function (not provider-wide)
-    # and unset keys are omitted entirely.
-    escrowEnvironment: ${file(./serverless.escrow-env.cjs)}
     esbuild:
         # serverless-esbuild does not support Bun as a Lambda artifact packager.
         # Bun remains the repo installer/runner; pnpm is used only for packaging externals.
         packager: pnpm
         plugins: esbuildPlugins.cjs
         bundle: true
+        # Deployment builds run once; avoid leaking rebuild contexts when plugins fail.
+        skipRebuild: true
         minify: true
         # @learncard/init's default (node.import) entry uses createRequire('./index.cjs'),
         # which esbuild cannot bundle — the emitted Lambda bundle is left with a runtime
@@ -133,37 +131,17 @@ provider:
     timeout: 29
     stage: ${opt:stage, "dev"}
     region: ${opt:region, "us-east-1"}
-    environment:
-        LAMBDA_STAGE: ${opt:stage, "dev"}
-        SEED: ${env:SEED, ''}
-        SA_SEED_KMS_KEY_ARN:
-            Fn::GetAtt: [SigningAuthoritySeedKey, Arn]
-        # First deployment upgrades readers only. Enable writes after every reader is compatible.
-        SA_SEED_ENCRYPT_WRITES: ${param:saSeedEncryptWrites, env:SA_SEED_ENCRYPT_WRITES, 'false'}
-        SA_SEED_ALLOW_LEGACY_READ: ${param:saSeedAllowLegacyRead, env:SA_SEED_ALLOW_LEGACY_READ, 'true'}
-        DOMAIN_NAME: ${env:DOMAIN_NAME, ''}
-        OPENAI_API_KEY: ${env:OPENAI_API_KEY, ''}
-        METABASE_SECRET_KEY: ${env:METABASE_SECRET_KEY, ''}
-        POSTMARK_SERVER_TOKEN: ${env:POSTMARK_SERVER_TOKEN, ''}
-        POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS: ${env:POSTMARK_LOGIN_CODE_TEMPLATE_ALIAS, ''}
-        POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS: ${env:POSTMARK_ENDORSEMENT_REQUEST_TEMPLATE_ALIAS, ''}
-        POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS: ${env:POSTMARK_RECOVERY_EMAIL_CODE_TEMPLATE_ALIAS, ''}
-        POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS: ${env:POSTMARK_RECOVERY_KEY_TEMPLATE_ALIAS, ''}
-        POSTMARK_FROM_EMAIL: ${env:POSTMARK_FROM_EMAIL, ''}
-        POSTMARK_BRAND_NAME: ${env:POSTMARK_BRAND_NAME, ''}
-        PORT: ${opt:httpPort, "3000"}
-        MONGO_URI: ${env:MONGO_URI, ''}
-        MONGO_DB_NAME: ${env:MONGO_DB_NAME, ''}
-        AUTHORIZED_DIDS: ${env:AUTHORIZED_DIDS, ''}
-        GOOGLE_APPLICATION_CREDENTIAL: ${env:GOOGLE_APPLICATION_CREDENTIAL, ''}
-        SCOUTS_SSO_CLIENT_SECRET: ${env:SCOUTS_SSO_CLIENT_SECRET, ''}
-        LEARN_CLOUD_URL: ${env:LEARN_CLOUD_URL, ''}
-        SENTRY_DSN: ${env:SENTRY_DSN, ''}
-        SENTRY_ENV: ${env:SENTRY_ENV, ''}
-        REDIS_HOST:
-            'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Address]
-        REDIS_PORT:
-            'Fn::GetAtt': [ElasticCacheCluster, RedisEndpoint.Port]
+    # Bundle mode emits only infra; fallback mode retains the existing GitHub secrets.
+    environment: ${file(./serverless.function-env.cjs):provider}
+    # Only didWeb/swagger use this generated role. Explicit function roles do not inherit it.
+    # Bundle access must not grant cryptographic use of the hosted signing-authority KMS key.
+    iam:
+        role:
+            statements:
+                - Effect: Allow
+                  Action: secretsmanager:GetSecretValue
+                  Resource:
+                      Fn::Sub: arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:lca-api/${sls:stage}/runtime-secrets-*
     tracing:
         apiGateway: true
         lambda: true
@@ -178,7 +156,7 @@ functions:
         handler: lambda.trpcHandler
         role: SigningAuthorityExecutionRole
         dependsOn: [SigningAuthoritySeedKeyPolicy]
-        environment: ${self:custom.escrowEnvironment}
+        environment: ${file(./serverless.function-env.cjs):api}
         vpc:
             securityGroupIds:
                 - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
@@ -191,7 +169,7 @@ functions:
         handler: lambda.openApiHandler
         role: SigningAuthorityExecutionRole
         dependsOn: [SigningAuthoritySeedKeyPolicy]
-        environment: ${self:custom.escrowEnvironment}
+        environment: ${file(./serverless.function-env.cjs):api}
         vpc:
             securityGroupIds:
                 - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
@@ -202,6 +180,7 @@ functions:
 
     didWeb:
         handler: lambda.didWebHandler
+        environment: ${file(./serverless.function-env.cjs):api}
         vpc:
             securityGroupIds:
                 - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
@@ -213,12 +192,29 @@ functions:
         url:
             cors: true
 
+    oidc:
+        handler: oidcLambda.handler
+        # Only this function may read the private signing key (see OidcExecutionRole).
+        role: OidcExecutionRole
+        environment: ${file(./serverless.function-env.cjs):oidc}
+        vpc:
+            securityGroupIds:
+                - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+            subnetIds:
+                - Ref: PrivateSubnetA
+        events:
+            - httpApi: GET /.well-known/openid-configuration
+            - httpApi: ANY /oidc/{proxy+}
+
     seedMigration:
         handler: seedMigrationLambda.handler
         role: SigningAuthorityExecutionRole
         timeout: 900
         reservedConcurrency: 1
         dependsOn: [SigningAuthoritySeedKeyPolicy]
+        # Shares the SigningAuthority role, so it reads the runtime bundle when present and
+        # falls back to the same credentials as trpc/api otherwise (it needs SEED + Mongo).
+        environment: ${file(./serverless.function-env.cjs):api}
         # IAM invoke only: intentionally no events, schedule, or function URL.
         vpc:
             securityGroupIds:
@@ -228,6 +224,12 @@ functions:
 
     swagger:
         handler: lambda.swaggerUiHandler
+        environment: ${file(./serverless.function-env.cjs):api}
+        vpc:
+            securityGroupIds:
+                - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+            subnetIds:
+                - Ref: PrivateSubnetA
         package:
             patterns:
                 - src/swagger-ui/**
@@ -235,7 +237,44 @@ functions:
             - httpApi: GET /docs
             - httpApi: GET /docs/{trpc+}
 
+    # Always deployed (no per-stage conditional: `schedule.enabled` needs a
+    # literal boolean, not an interpolated ESCROW_ENCLAVE_MODE env string);
+    # the handler itself no-ops when escrow is disabled for this stage/tenant.
+    escrowHoldReminders:
+        handler: lambda.escrowHoldRemindersHandler
+        timeout: 120
+        environment: ${file(./serverless.function-env.cjs):escrow}
+        vpc:
+            securityGroupIds:
+                - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+            subnetIds:
+                - Ref: PrivateSubnetA
+        events:
+            - schedule: rate(1 hour)
+
+    # Same always-deployed/no-op-when-disabled shape as escrowHoldReminders
+    # above; a bounded batch each run, so an hourly rate is generous relative
+    # to how quickly a key rotation's previous-key backlog should drain.
+    escrowBlobRewrap:
+        handler: lambda.escrowBlobRewrapHandler
+        timeout: 120
+        environment: ${file(./serverless.function-env.cjs):escrow}
+        vpc:
+            securityGroupIds:
+                - 'Fn::GetAtt': [ServerlessSecurityGroup, GroupId]
+            subnetIds:
+                - Ref: PrivateSubnetA
+        events:
+            - schedule: rate(1 hour)
+
 resources:
+    # Escrow enclave over PrivateLink: created only when the stage sets
+    # ESCROW_ENCLAVE_ENDPOINT_SERVICE_NAME (the enclave account's endpoint
+    # service). TLS trust for the hostname is pinned in enclaveTrustAnchors.ts.
+    Conditions:
+        EscrowEnclavePrivateLink:
+            Fn::Not:
+                - Fn::Equals: ['${env:ESCROW_ENCLAVE_ENDPOINT_SERVICE_NAME, ""}', '']
     Outputs:
         SigningAuthoritySeedKeyArn:
             Value:
@@ -259,6 +298,39 @@ resources:
                 ManagedPolicyArns:
                     - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
                     - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/AWSXRayDaemonWriteAccess
+                Policies:
+                    - PolicyName: runtime-secrets
+                      PolicyDocument:
+                          Version: '2012-10-17'
+                          Statement:
+                              # seedMigration shares this role; bundle access is acceptable for now.
+                              - Effect: Allow
+                                Action: secretsmanager:GetSecretValue
+                                Resource:
+                                    Fn::Sub: arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:lca-api/${sls:stage}/runtime-secrets-*
+        OidcExecutionRole:
+            Type: AWS::IAM::Role
+            Properties:
+                AssumeRolePolicyDocument:
+                    Version: '2012-10-17'
+                    Statement:
+                        - Effect: Allow
+                          Principal:
+                              Service: lambda.amazonaws.com
+                          Action: sts:AssumeRole
+                ManagedPolicyArns:
+                    - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
+                    - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/AWSXRayDaemonWriteAccess
+                Policies:
+                    - PolicyName: oidc-signing-key
+                      PolicyDocument:
+                          Version: '2012-10-17'
+                          Statement:
+                              # SecretString is the private JWK JSON; only its id belongs in Lambda env.
+                              - Effect: Allow
+                                Action: secretsmanager:GetSecretValue
+                                Resource:
+                                    Fn::Sub: arn:${AWS::Partition}:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:lca-api/${sls:stage}/oidc-signing-jwk-*
         SigningAuthoritySeedKey:
             Type: AWS::KMS::Key
             DeletionPolicy: Retain
@@ -346,6 +418,67 @@ resources:
             Type: AWS::EC2::VPC
             Properties:
                 CidrBlock: '10.0.0.0/16'
+                # A private hosted zone needs DNS hostnames; left at the default elsewhere.
+                EnableDnsHostnames:
+                    Fn::If: [EscrowEnclavePrivateLink, true, Ref: AWS::NoValue]
+        EscrowEnclaveEndpointSecurityGroup:
+            Type: AWS::EC2::SecurityGroup
+            Condition: EscrowEnclavePrivateLink
+            Properties:
+                GroupDescription: Escrow enclave PrivateLink endpoint, 8443 from lca-api only
+                VpcId:
+                    Ref: VPC
+                SecurityGroupIngress:
+                    - IpProtocol: tcp
+                      FromPort: 8443
+                      ToPort: 8443
+                      SourceSecurityGroupId:
+                          Ref: ServerlessSecurityGroup
+        EscrowEnclaveEndpoint:
+            Type: AWS::EC2::VPCEndpoint
+            Condition: EscrowEnclavePrivateLink
+            Properties:
+                VpcEndpointType: Interface
+                ServiceName: ${env:ESCROW_ENCLAVE_ENDPOINT_SERVICE_NAME, ''}
+                VpcId:
+                    Ref: VPC
+                SubnetIds:
+                    - Ref: PrivateSubnetA
+                SecurityGroupIds:
+                    - Ref: EscrowEnclaveEndpointSecurityGroup
+                PrivateDnsEnabled: false
+        EscrowEnclaveHostedZone:
+            Type: AWS::Route53::HostedZone
+            Condition: EscrowEnclavePrivateLink
+            Properties:
+                Name: ${env:ESCROW_ENCLAVE_HOSTNAME, ''}
+                VPCs:
+                    - VPCId:
+                          Ref: VPC
+                      VPCRegion: ${self:provider.region}
+        EscrowEnclaveDnsRecord:
+            Type: AWS::Route53::RecordSet
+            Condition: EscrowEnclavePrivateLink
+            Properties:
+                HostedZoneId:
+                    Ref: EscrowEnclaveHostedZone
+                Name: ${env:ESCROW_ENCLAVE_HOSTNAME, ''}
+                Type: A
+                # DnsEntries[0] is "<hosted zone id>:<regional endpoint DNS name>".
+                AliasTarget:
+                    HostedZoneId:
+                        Fn::Select:
+                            - 0
+                            - Fn::Split:
+                                  - ':'
+                                  - Fn::Select: [0, Fn::GetAtt: [EscrowEnclaveEndpoint, DnsEntries]]
+                    DNSName:
+                        Fn::Select:
+                            - 1
+                            - Fn::Split:
+                                  - ':'
+                                  - Fn::Select: [0, Fn::GetAtt: [EscrowEnclaveEndpoint, DnsEntries]]
+                    EvaluateTargetHealth: false
         IP:
             Type: AWS::EC2::EIP
             Properties:
@@ -456,6 +589,10 @@ resources:
             Properties:
                 AutoMinorVersionUpgrade: true
                 Engine: redis
+                # GETDEL (login codes/tickets/auth codes) needs Redis >= 6.2. The
+                # version is deliberately NOT pinned here: existing clusters are
+                # already on 7.x, and a pin below the running version is rejected
+                # by CloudFormation as a downgrade (failing the whole deploy).
                 CacheNodeType: ${self:custom.config.CACHE_INSTANCE_SIZE}
                 NumCacheNodes: 1
                 VpcSecurityGroupIds:

package/src/accesslayer/notifications/index.ts

@@ -12,12 +12,19 @@ export const getNotificationsCollection = () => {
 
 export const Notifications = getNotificationsCollection();
 
-Notifications.createIndex({ 'to.did': 1, read: 1, sent: -1, _id: 1 });
+// Fire-and-forget at module load: every Lambda imports this, so an uncaught
+// rejection (e.g. a Mongo connect that outlives a frozen invocation) would
+// crash whichever function thaws next.
+const logIndexFailure = (error: unknown): void => {
+    console.error('Notifications index creation failed:', error);
+};
+
+Notifications.createIndex({ 'to.did': 1, read: 1, sent: -1, _id: 1 }).catch(logIndexFailure);
 Notifications.createIndex({
     'to.did': 1,
     type: 1,
     'data.metadata.connectionPrompt.promptId': 1,
-});
+}).catch(logIndexFailure);
 
 const LEGACY_CREDENTIAL_REFRESH_INDEX = 'to.did_1_type_1_data.metadata.deliveryKey_1';
 const MANAGED_CREDENTIAL_REFRESH_INDEX = 'managed_credential_refresh_delivery_key_unique';

package/src/accesslayer/signing-authority/index.ts

@@ -7,4 +7,7 @@ export const getSigningAuthoritiesCollection = () => {
 
 export const SigningAuthorities = getSigningAuthoritiesCollection();
 
-SigningAuthorities.createIndex({ ownerDid: 1, name: 1 }, { unique: true });
+// Fire-and-forget at module load; see accesslayer/notifications for why it must not reject.
+SigningAuthorities.createIndex({ ownerDid: 1, name: 1 }, { unique: true }).catch(error => {
+    console.error('Signing authority unique index creation failed:', error);
+});

package/src/app.ts

@@ -12,6 +12,7 @@ import { preferencesRouter } from '@routes/preferences';
 import { keysRouter } from '@routes/keys';
 import { escrowRouter } from '@routes/escrow';
 import { qrLoginRouter } from '@routes/qr-login';
+import { authRouter } from '@routes/auth';
 import { testRouter, type TestRouter } from '@routes/test';
 import { environment } from '@environment';
 
@@ -28,6 +29,7 @@ const routes = {
     keys: keysRouter,
     escrow: escrowRouter,
     qrLogin: qrLoginRouter,
+    auth: authRouter,
 };
 
 export const appRouter = t.router<typeof routes & { test?: TestRouter }>({

package/src/cache/getDel.test.ts

@@ -0,0 +1,34 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import cache from '@cache';
+import { consumeMatchingCode } from './getDel';
+
+vi.mock('@cache', async () => {
+    const { default: Redis } = await import('ioredis-mock');
+    return { default: { node: new Redis() } };
+});
+
+afterEach(async () => {
+    await cache.node.flushall();
+});
+
+describe('consumeMatchingCode', () => {
+    it('preserves a valid code after a wrong guess', async () => {
+        await cache.node.set('login-code:test@example.com', '123456');
+        expect(await consumeMatchingCode('login-code:test@example.com', '000000')).toBe(false);
+        expect(await cache.node.get('login-code:test@example.com')).toBe('123456');
+    });
+
+    it('allows exactly one concurrent redemption and rejects replay', async () => {
+        await cache.node.set('login-code:test@example.com', '123456');
+        const results = await Promise.all([
+            consumeMatchingCode('login-code:test@example.com', '123456'),
+            consumeMatchingCode('login-code:test@example.com', '123456'),
+        ]);
+        expect(results.filter(Boolean)).toHaveLength(1);
+        expect(await consumeMatchingCode('login-code:test@example.com', '123456')).toBe(false);
+    });
+
+    it('rejects missing codes', async () => {
+        expect(await consumeMatchingCode('login-code:missing@example.com', '123456')).toBe(false);
+    });
+});

package/src/cache/getDel.ts

@@ -0,0 +1,32 @@
+import cache from '@cache';
+
+/**
+ * Atomically read-and-delete a key so its value can only ever be consumed once.
+ *
+ * Redis `GETDEL` is a single command, so concurrent redemptions return the value
+ * to exactly one caller — closing the read-then-delete race that `get` + `delete`
+ * would leave open. Used for login codes, login tickets and authorization codes.
+ *
+ * NOTE: `GETDEL` requires Redis >= 6.2. Deployed ElastiCache clusters are on 7.x
+ * (see the `ElasticCacheCluster` note in `serverless.yml`); `ioredis-mock`
+ * implements it for the no-Redis fallback.
+ */
+export const getDel = async (key: string): Promise<string | null> => {
+    const redis = cache.redis ?? cache.node;
+    return redis.getdel(key);
+};
+
+/** Consume a code only when its value matches, atomically preventing replay. */
+export const consumeMatchingCode = async (key: string, code: string): Promise<boolean> => {
+    const redis = cache.redis ?? cache.node;
+    const consumed = await redis.eval(
+        `if redis.call('GET', KEYS[1]) == ARGV[1] then
+            return redis.call('DEL', KEYS[1])
+        end
+        return 0`,
+        1,
+        key,
+        code
+    );
+    return consumed === 1;
+};

package/src/cache/index.ts

@@ -1,6 +1,6 @@
 /// <reference path="../global.d.ts" />
 
-import { environment } from '@environment';
+import { environment } from '@config/cacheEnvironment';
 import Redis, { RedisValue, RedisKey } from 'ioredis';
 import MemoryRedis, { Redis as RedisMockType } from 'ioredis-mock';
 

package/src/cache/login-tickets.ts

@@ -0,0 +1,26 @@
+import { randomBytes } from 'node:crypto';
+import cache from '@cache';
+import { getDel } from '@cache/getDel';
+
+export interface LoginTicketPayload {
+    subject: string;
+    email?: string;
+    emailVerified?: boolean;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    name?: string;
+    picture?: string;
+    identityKey: string;
+}
+
+export const issueLoginTicket = async (payload: LoginTicketPayload): Promise<string> => {
+    const ticket = randomBytes(32).toString('base64url');
+    const result = await cache.set(`login-ticket:${ticket}`, JSON.stringify(payload), 60);
+    if (result !== 'OK') throw new Error('Failed to persist login ticket');
+    return ticket;
+};
+
+export const redeemLoginTicket = async (ticket: string): Promise<LoginTicketPayload | null> => {
+    const raw = await getDel(`login-ticket:${ticket}`);
+    return raw ? (JSON.parse(raw) as LoginTicketPayload) : null;
+};

package/src/config/applyDockerStageConfig.ts

@@ -0,0 +1,6 @@
+import { applyLcaApiStageConfig } from './stageConfig';
+
+// Side-effect import: runs before @environment is evaluated so Docker/local processes
+// pick up checked-in per-stage config. Keyed on CONFIG_STAGE (Lambda uses LAMBDA_STAGE);
+// explicit non-empty env values from the developer's .env still win.
+applyLcaApiStageConfig(process.env.CONFIG_STAGE);

package/src/config/cacheEnvironment.ts

@@ -0,0 +1,34 @@
+import 'dotenv/config';
+
+import { z } from 'zod';
+import {
+    optionalEnvironmentPort,
+    optionalEnvironmentString,
+    parseEnvironment,
+} from '@learncard/helpers';
+
+/**
+ * Focused environment contract for the Redis-backed cache so `src/cache/index.ts`
+ * can boot without the full schema's required SEED/MONGO. The cache reads only
+ * REDIS_HOST/REDIS_PORT, mirroring the parsers used by the full schema.
+ */
+export const cacheEnvironmentShape = {
+    REDIS_HOST: optionalEnvironmentString,
+    REDIS_PORT: optionalEnvironmentPort,
+} satisfies z.ZodRawShape;
+
+export const cacheEnvironmentSchema = z.object(cacheEnvironmentShape);
+
+export type CacheEnvironment = z.output<typeof cacheEnvironmentSchema>;
+
+export const parseCacheEnvironment = (
+    raw: Record<string, unknown>,
+    source = 'process environment'
+): CacheEnvironment =>
+    parseEnvironment(cacheEnvironmentSchema, raw, {
+        project: 'lca-api (cache)',
+        source,
+        examplePath: 'services/learn-card-network/lca-api/.env.example',
+    });
+
+export const environment = parseCacheEnvironment(process.env);

package/src/config/environment.test.ts

@@ -1,5 +1,18 @@
-import { describe, expect, it } from 'vitest';
-import { parseLcaApiEnvironment } from './environment';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { isEscrowReleaseKillSwitchEnabled, parseLcaApiEnvironment } from './environment';
+
+afterEach(() => vi.unstubAllEnvs());
+
+describe('live escrow release kill switch', () => {
+    it.each(['1', 'true'])('blocks releases for %s', value => {
+        vi.stubEnv('ESCROW_RELEASE_KILL_SWITCH', value);
+        expect(isEscrowReleaseKillSwitchEnabled()).toBe(true);
+    });
+    it.each(['0', 'false', ''])('allows releases for %s', value => {
+        vi.stubEnv('ESCROW_RELEASE_KILL_SWITCH', value);
+        expect(isEscrowReleaseKillSwitchEnabled()).toBe(false);
+    });
+});
 
 const production = {
     NODE_ENV: 'production',
@@ -114,3 +127,33 @@ describe('signing-authority seed environment', () => {
         ).not.toThrow();
     });
 });
+
+describe('Keycloak startup configuration', () => {
+    it.each([undefined, '', '   ', ' , , '])('rejects missing audiences: %s', audiences => {
+        expect(() =>
+            parseLcaApiEnvironment({
+                NODE_ENV: 'test',
+                IS_OFFLINE: 'true',
+                KEYCLOAK_ISSUERS: 'https://identity.example/realms/learncard',
+                KEYCLOAK_AUDIENCES: audiences,
+            })
+        ).toThrow(/KEYCLOAK_AUDIENCES/);
+    });
+    it('allows disabled Keycloak and valid issuer/audience configuration', () => {
+        expect(() =>
+            parseLcaApiEnvironment({
+                NODE_ENV: 'test',
+                IS_OFFLINE: 'true',
+                KEYCLOAK_ISSUERS: ' , ',
+            })
+        ).not.toThrow();
+        expect(() =>
+            parseLcaApiEnvironment({
+                NODE_ENV: 'test',
+                IS_OFFLINE: 'true',
+                KEYCLOAK_ISSUERS: 'https://identity.example/realms/learncard',
+                KEYCLOAK_AUDIENCES: ' , learncard-app, ',
+            })
+        ).not.toThrow();
+    });
+});