@maronn-openid-connect/cli 0.7.0 → 0.8.0

package/dist/frameworks/nextjs/conformance.js

@@ -0,0 +1,2447 @@
+import { DEFAULT_FEATURES } from '../../features.js';
+import { nextJsSupportedGrantTypes, nextJsSupportedScopes } from './metadata.js';
+export function nextJsConformanceTestTemplate(features = DEFAULT_FEATURES, scopes = []) {
+    return [
+        harnessSection(features, scopes),
+        discoverySection(features, scopes),
+        authorizationEndpointSection(features),
+        internalRedirectOriginSection(),
+        loginSection(),
+        consentSection(),
+        transactionBindingSection(features),
+        tokenEndpointSection(features),
+        userInfoSection(),
+        sessionSection(),
+        features.introspection ? introspectionSection() : '',
+        features.revocation ? revocationSection() : '',
+        scopes.length > 0 ? customScopesSection(scopes) : '',
+        features.par ? parSection() : '',
+        features.jarm ? jarmSection() : '',
+        features.tokenExchange ? tokenExchangeSection() : '',
+        features.idJag ? idJagSection() : '',
+        features.deviceAuthorizationGrant ? deviceAuthorizationSection() : '',
+        features.ciba ? cibaSection() : '',
+        features.jwtIntrospectionResponse && features.introspection
+            ? jwtIntrospectionResponseSection()
+            : '',
+        features.rpInitiatedLogout ? rpInitiatedLogoutSection() : '',
+        features.googleLogin ? googleLoginSection() : '',
+    ]
+        .filter((section) => section !== '')
+        .join('\n');
+}
+function harnessSection(features, scopes) {
+    const grantTypes = nextJsSupportedGrantTypes(features)
+        .map((grantType) => `        '${grantType}',`)
+        .join('\n');
+    const extraClients = [
+        ...(features.deviceAuthorizationGrant
+            ? [`    // RFC 8628 §3.4: a second device-grant client, to prove a device_code is
+    // refused when another client presents it.
+    {
+      clientId: 'conformance-device-client',
+      clientSecret: 'conformance-device-secret',
+      redirectUris: [redirectUri],
+      clientType: 'confidential',
+      grantTypes: ['urn:ietf:params:oauth:grant-type:device_code'],
+      tokenEndpointAuthMethod: 'client_secret_post',
+      responseTypes: ['code'],
+    },`]
+            : []),
+        ...(features.ciba
+            ? [`    // CIBA Core 1.0 §11: a second CIBA client, to prove an auth_req_id is
+    // refused when another client presents it.
+    {
+      clientId: 'conformance-ciba-client',
+      clientSecret: 'conformance-ciba-secret',
+      redirectUris: [redirectUri],
+      clientType: 'confidential',
+      grantTypes: ['urn:openid:params:grant-type:ciba'],
+      tokenEndpointAuthMethod: 'client_secret_post',
+      responseTypes: ['code'],
+    },`]
+            : []),
+    ]
+        .map((client) => '\n' + client)
+        .join('');
+    const googleEnvNames = features.googleLogin
+        ? `
+    'GOOGLE_CLIENT_ID',
+    'GOOGLE_HOSTED_DOMAIN',`
+        : '';
+    const googleEnv = features.googleLogin
+        ? `
+  // EXTENSION (google-login): configures config.googleLogin, so the login page
+  // renders the Google button and /login/google accepts callbacks.
+  process.env.GOOGLE_CLIENT_ID = 'conformance.apps.googleusercontent.com';`
+        : '';
+    const googleMock = features.googleLogin
+        ? `
+// EXTENSION (google-login): stands in for google-auth-library, which would
+// fetch Google's keys. The "ID token" a test posts is the JSON payload Google
+// would have signed, so every test decides exactly what Google asserts.
+vi.mock('@maronn-openid-connect/google-login', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@maronn-openid-connect/google-login')>()),
+  getDefaultGoogleIdTokenVerifier: () => ({
+    verify: async (idToken: string) => JSON.parse(idToken),
+  }),
+}));
+`
+        : '';
+    const routeImports = [
+        ...(features.introspection ? [`import * as introspect from '../introspect/route';`] : []),
+        ...(features.revocation ? [`import * as revoke from '../revoke/route';`] : []),
+        ...(features.par
+            ? [`import * as par from '../par/route';`, `import { parConfig } from '../par/config';`]
+            : []),
+        ...(features.idJag ? [`import { idJagConfig } from '../token/id-jag';`] : []),
+        ...(features.deviceAuthorizationGrant
+            ? [
+                `import * as deviceAuthorization from '../device_authorization/route';`,
+                `import * as device from '../device/route';`,
+                `import * as deviceLogin from '../device/login/route';`,
+                `import * as deviceApprove from '../device/approve/route';`,
+            ]
+            : []),
+        ...(features.ciba
+            ? [
+                `import * as backchannelAuthentication from '../backchannel_authentication/route';`,
+                `import * as ciba from '../ciba/route';`,
+                `import * as cibaLogin from '../ciba/login/route';`,
+                `import * as cibaApprove from '../ciba/approve/route';`,
+            ]
+            : []),
+        ...(features.rpInitiatedLogout
+            ? [
+                `import * as logout from '../logout/route';`,
+                `import * as logoutApprove from '../logout/approve/route';`,
+                `import { rpInitiatedLogoutConfig } from '../logout/config';`,
+            ]
+            : []),
+        ...(features.googleLogin ? [`import * as googleLogin from '../login/google/route';`] : []),
+    ];
+    const extraRouteImports = routeImports.length > 0 ? '\n' + routeImports.join('\n') : '';
+    const scopesImport = scopes.length > 0 ? `\nimport { RESTRICTED_SCOPE_SUBJECTS } from './scopes';` : '';
+    return `/**
+ * Contract test for the generated OpenID Provider.
+ *
+ * It drives the OP the way Next.js does — Route Handlers with a NextRequest,
+ * pages (React Server Components) rendered to HTML, Server Actions with the
+ * submitted FormData — and pins what the specifications require of each
+ * answer. No server is started: run it with \`vitest run\`.
+ *
+ * Next.js provides some functions only inside a real request, so they are
+ * replaced here:
+ * - cookies() (next/headers) reads and writes the cookie jar of the simulated
+ *   browser making the call — the same jar its Route Handler requests send and
+ *   update, so pages, Server Actions and Route Handlers see one browser.
+ * - redirect() and notFound() (next/navigation) throw a signal, which the
+ *   harness turns into what Next.js would answer: a redirect, or a 404.
+ *
+ * provider.ts reads its configuration from the environment on first import, so
+ * the environment is pinned in vi.hoisted(), before any import runs: a fixed
+ * issuer, the clients this test registers and an in-memory SQLite store.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { createElement, type ReactElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { NextRequest } from 'next/server';
+
+const { ISSUER, REDIRECT_URI, harness } = vi.hoisted(() => {
+  const issuer = 'http://localhost:3000';
+  const redirectUri = 'https://rp.example.com/callback';
+  const clients = [
+    {
+      clientId: 'conformance-client',
+      clientSecret: 'conformance-secret',
+      redirectUris: [redirectUri],
+      clientType: 'confidential',
+      // Registered for every grant this OP supports.
+      grantTypes: [
+${grantTypes}
+      ],
+      tokenEndpointAuthMethod: 'client_secret_post',
+      responseTypes: ['code'],
+    },
+    // RFC 6749 §2.3.1: a client that authenticates with HTTP Basic.
+    {
+      clientId: 'conformance-basic-client',
+      clientSecret: 'conformance-basic-secret',
+      redirectUris: [redirectUri],
+      clientType: 'confidential',
+      grantTypes: ['authorization_code'],
+      tokenEndpointAuthMethod: 'client_secret_basic',
+      responseTypes: ['code'],
+    },
+    // OAuth 2.1 §2.1: a public client, which has no secret.
+    {
+      clientId: 'conformance-public-client',
+      redirectUris: [redirectUri],
+      clientType: 'public',
+      grantTypes: ['authorization_code'],
+      tokenEndpointAuthMethod: 'none',
+      responseTypes: ['code'],
+    },${extraClients}
+  ];
+
+  process.env.OIDC_ISSUER = issuer;
+  process.env.OIDC_CLIENTS_JSON = JSON.stringify(clients);
+  process.env.OIDC_SIGNING_KEY_ID = 'conformance-key';
+  process.env.OIDC_SQLITE_PATH = ':memory:';
+  for (const name of [
+    'ISSUER',
+    'OIDC_CORS_ORIGINS',
+    'OIDC_ALLOW_NON_PKCE_AUTHORIZATION_CODE_FLOW',
+    'OIDC_ALLOW_UNSIGNED_REQUEST_OBJECT',
+    'UPSTASH_REDIS_REST_URL',
+    'UPSTASH_REDIS_REST_TOKEN',
+    'VERCEL',${googleEnvNames}
+  ]) {
+    delete process.env[name];
+  }${googleEnv}
+
+  /** What redirect() throws: the location the browser is sent to. */
+  class RedirectSignal extends Error {
+    constructor(readonly location: string) {
+      super('NEXT_REDIRECT ' + location);
+    }
+  }
+
+  /** What notFound() throws: Next.js answers with the not-found screen (404). */
+  class NotFoundSignal extends Error {
+    constructor() {
+      super('NEXT_HTTP_ERROR_FALLBACK;404');
+    }
+  }
+
+  return {
+    ISSUER: issuer,
+    REDIRECT_URI: redirectUri,
+    harness: {
+      RedirectSignal,
+      NotFoundSignal,
+      /** The cookie jar of the browser whose call is being handled. */
+      jar: new Map<string, string>(),
+      /** Every cookies().set() call, with the attributes it asked for. */
+      cookieWrites: [] as Array<{ name: string; value: string; options: Record<string, unknown> }>,
+    },
+  };
+});
+
+vi.mock('next/headers', () => ({
+  cookies: async () => ({
+    get: (name: string) => {
+      const value = harness.jar.get(name);
+      return value === undefined ? undefined : { name, value };
+    },
+    set: (name: string, value: string, options: Record<string, unknown> = {}) => {
+      harness.jar.set(name, value);
+      harness.cookieWrites.push({ name, value, options });
+    },
+    delete: (name: string) => {
+      harness.jar.delete(name);
+    },
+  }),
+}));
+
+vi.mock('next/navigation', () => ({
+  redirect: (location: string): never => {
+    throw new harness.RedirectSignal(location);
+  },
+  notFound: (): never => {
+    throw new harness.NotFoundSignal();
+  },
+}));
+${googleMock}
+import * as discovery from '../.well-known/openid-configuration/route';
+import * as jwks from '../.well-known/jwks.json/route';
+import * as authorize from '../authorize/route';
+import LoginPage from '../login/page';
+import { loginAction } from '../login/actions';
+import LoginNotFound from '../login/not-found';
+import LoginError from '../login/error';
+import ConsentPage from '../consent/page';
+import { consentAction } from '../consent/actions';
+import ConsentNotFound from '../consent/not-found';
+import ConsentError from '../consent/error';
+import OidcErrorPage from '../oidc-error/page';
+import * as token from '../token/route';
+import * as userinfo from '../userinfo/route';${extraRouteImports}
+import { config, resolvers, stores } from './provider';${scopesImport}
+
+type RouteHandler = (request: NextRequest) => Response | Promise<Response>;
+type RequestOptions = { method?: string; headers?: HeadersInit; body?: BodyInit };
+type Page<Query> = (props: { searchParams: Promise<Query> }) => Promise<ReactElement>;
+type ServerAction = (formData: FormData) => Promise<void>;
+
+/** What the browser gets from a page or a Server Action. */
+interface Outcome {
+  status: number;
+  /** Where redirect() sent the browser. */
+  location?: string;
+  /** The rendered page. */
+  html?: string;
+}
+
+/**
+ * One User-Agent. Its cookie jar is what Route Handlers receive in the Cookie
+ * header and what cookies() reads inside pages and Server Actions; Set-Cookie
+ * answers and cookies().set() both write back to it.
+ */
+class Browser {
+  readonly cookies = new Map<string, string>();
+
+  /** Send a request to a Route Handler. */
+  async request(handler: RouteHandler, url: string, options: RequestOptions = {}): Promise<Response> {
+    const headers = new Headers(options.headers);
+    if (this.cookies.size > 0) {
+      headers.set(
+        'Cookie',
+        [...this.cookies].map(([name, value]) => name + '=' + value).join('; '),
+      );
+    }
+    harness.jar = this.cookies;
+    let response: Response;
+    try {
+      response = await handler(
+        new NextRequest(new URL(url, ISSUER), { method: options.method, headers, body: options.body }),
+      );
+    } catch (error) {
+      response = answerSignal(error);
+    }
+    for (const setCookie of response.headers.getSetCookie()) {
+      this.storeCookie(setCookie);
+    }
+    return response;
+  }
+
+  /** POST a form to a Route Handler. */
+  post(handler: RouteHandler, url: string, fields: Record<string, string>, headers?: HeadersInit): Promise<Response> {
+    return this.request(handler, url, { method: 'POST', headers, body: new URLSearchParams(fields) });
+  }
+
+  /** Open a page: its HTML, or where it redirects, or a 404 from notFound(). */
+  async open<Query>(page: Page<Query>, query: Query): Promise<Outcome> {
+    harness.jar = this.cookies;
+    try {
+      return { status: 200, html: renderToStaticMarkup(await page({ searchParams: Promise.resolve(query) })) };
+    } catch (error) {
+      return outcomeOf(error, 307);
+    }
+  }
+
+  /** Render a page as this browser would see it. */
+  async render<Query>(page: Page<Query>, query: Query): Promise<string> {
+    return (await this.open(page, query)).html ?? '';
+  }
+
+  /**
+   * Submit a form to a Server Action: where it redirects the browser (Next.js
+   * answers a Server Action's redirect with 303), or a 404 from notFound().
+   */
+  async submit(action: ServerAction, fields: Record<string, string>): Promise<Outcome> {
+    const formData = new FormData();
+    for (const [name, value] of Object.entries(fields)) {
+      formData.set(name, value);
+    }
+    harness.jar = this.cookies;
+    try {
+      await action(formData);
+    } catch (error) {
+      return outcomeOf(error, 303);
+    }
+    throw new Error('The Server Action returned without redirecting');
+  }
+
+  private storeCookie(setCookie: string): void {
+    const [pair = '', ...attributes] = setCookie.split(';');
+    const separator = pair.indexOf('=');
+    const name = pair.slice(0, separator).trim();
+    const expired = attributes.some((attribute) => attribute.trim().toLowerCase() === 'max-age=0');
+    if (expired) {
+      this.cookies.delete(name);
+    } else {
+      this.cookies.set(name, pair.slice(separator + 1).trim());
+    }
+  }
+}
+
+/** What Next.js answers when a page or a Server Action calls redirect() or notFound(). */
+function outcomeOf(error: unknown, redirectStatus: number): Outcome {
+  if (error instanceof harness.RedirectSignal) return { status: redirectStatus, location: error.location };
+  if (error instanceof harness.NotFoundSignal) return { status: 404 };
+  throw error;
+}
+
+/** What Next.js answers when a Route Handler calls redirect() or notFound(). */
+function answerSignal(error: unknown): Response {
+  if (error instanceof harness.RedirectSignal) {
+    return new Response(null, { status: 307, headers: { Location: error.location } });
+  }
+  if (error instanceof harness.NotFoundSignal) return new Response(null, { status: 404 });
+  throw error;
+}
+
+/** RFC 7636 Appendix B: the example code_verifier and its S256 code_challenge. */
+const CODE_VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
+const CODE_CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+
+/** An authorization request of conformance-client; undefined drops a parameter. */
+function authorizationRequest(
+  overrides: Record<string, string | undefined> = {},
+): Record<string, string> {
+  const params: Record<string, string | undefined> = {
+    response_type: 'code',
+    client_id: 'conformance-client',
+    redirect_uri: REDIRECT_URI,
+    scope: 'openid profile',
+    state: 'conformance-state',
+    nonce: 'conformance-nonce',
+    code_challenge: CODE_CHALLENGE,
+    code_challenge_method: 'S256',
+    ...overrides,
+  };
+  return Object.fromEntries(
+    Object.entries(params).filter((entry): entry is [string, string] => entry[1] !== undefined),
+  );
+}
+
+function authorizeUrl(params: Record<string, string>, origin = ISSUER): string {
+  return origin + '/authorize?' + new URLSearchParams(params).toString();
+}
+
+function locationOf(response: Response): string {
+  return response.headers.get('Location') ?? '';
+}
+
+function transactionIdOf(location: string): string {
+  return new URL(location, ISSUER).searchParams.get('transaction_id') ?? '';
+}
+
+function csrfTokenOf(html: string): string {
+  return html.match(/name="csrf_token" value="([^"]+)"/)?.[1] ?? '';
+}
+
+/** Start an authorization request; resolves to its transaction_id. */
+async function startAuthorization(
+  browser: Browser,
+  params: Record<string, string> = authorizationRequest(),
+): Promise<string> {
+  return transactionIdOf(locationOf(await browser.request(authorize.GET, authorizeUrl(params))));
+}
+
+/** Sign in on the login page of a transaction; resolves to where the browser goes next. */
+async function logIn(browser: Browser, transactionId: string, username = 'testuser'): Promise<string> {
+  const html = await browser.render(LoginPage, { transaction_id: transactionId });
+  const outcome = await browser.submit(loginAction, {
+    transaction_id: transactionId,
+    csrf_token: csrfTokenOf(html),
+    username,
+    password: 'password',
+  });
+  return outcome.location ?? '';
+}
+
+/** Submit a consent decision from the consent page; undefined omits the action field. */
+async function decide(browser: Browser, transactionId: string, action: string | undefined): Promise<string> {
+  const html = await browser.render(ConsentPage, { transaction_id: transactionId });
+  const fields: Record<string, string> = { transaction_id: transactionId, csrf_token: csrfTokenOf(html) };
+  const outcome = await browser.submit(consentAction, action === undefined ? fields : { ...fields, action });
+  return outcome.location ?? '';
+}
+
+/**
+ * authorize → login → consent, the way a browser walks it; resolves to the
+ * authorization response the browser lands on. Pure data collection: it
+ * neither asserts nor branches, so every check stays in the it() blocks.
+ */
+async function signIn(
+  browser: Browser,
+  params: Record<string, string> = authorizationRequest(),
+  username = 'testuser',
+): Promise<URL> {
+  const transactionId = await startAuthorization(browser, params);
+  await logIn(browser, transactionId, username);
+  return new URL(await decide(browser, transactionId, 'approve'), ISSUER);
+}
+
+/** POST to the token endpoint as conformance-client (client_secret_post). */
+function tokenRequest(params: Record<string, string>): Promise<Response> {
+  return new Browser().post(token.POST, '/token', {
+    client_id: 'conformance-client',
+    client_secret: 'conformance-secret',
+    ...params,
+  });
+}
+
+function exchangeCode(code: string): Promise<Response> {
+  return tokenRequest({
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: REDIRECT_URI,
+    code_verifier: CODE_VERIFIER,
+  });
+}
+
+interface TokenResponse {
+  access_token: string;
+  token_type: string;
+  expires_in: number;
+  id_token: string;
+  refresh_token?: string;
+  scope: string;
+}
+
+/** Sign in and redeem the code; resolves to the token response. */
+async function issueTokens(
+  browser = new Browser(),
+  params: Record<string, string> = authorizationRequest(),
+): Promise<TokenResponse> {
+  const callback = await signIn(browser, params);
+  const response = await exchangeCode(callback.searchParams.get('code') ?? '');
+  return (await response.json()) as TokenResponse;
+}
+
+function userInfoRequest(accessToken: string): Promise<Response> {
+  return new Browser().request(userinfo.GET, '/userinfo', {
+    headers: { Authorization: 'Bearer ' + accessToken },
+  });
+}
+
+function basicAuthorization(clientId: string, clientSecret: string): string {
+  // RFC 6749 §2.3.1: both values are form-urlencoded before base64.
+  return 'Basic ' + btoa(encodeURIComponent(clientId) + ':' + encodeURIComponent(clientSecret));
+}
+
+function decodeJwt(jwt: string): { header: Record<string, unknown>; payload: Record<string, unknown> } {
+  const [header = '', payload = ''] = jwt.split('.');
+  return { header: decodeSegment(header), payload: decodeSegment(payload) };
+}
+
+function decodeSegment(segment: string): Record<string, unknown> {
+  return JSON.parse(Buffer.from(segment, 'base64url').toString('utf8')) as Record<string, unknown>;
+}
+
+/** Verify an RS256 JWS with the key the JWKS endpoint publishes under its kid. */
+async function verifiesWithPublishedKey(jwt: string): Promise<boolean> {
+  const [header = '', payload = '', signature = ''] = jwt.split('.');
+  const response = await new Browser().request(jwks.GET, '/.well-known/jwks.json');
+  const { keys } = (await response.json()) as { keys: Array<JsonWebKey & { kid?: string }> };
+  const jwk = keys.find((key) => key.kid === decodeSegment(header)['kid']);
+  if (!jwk) return false;
+  const key = await crypto.subtle.importKey(
+    'jwk',
+    jwk,
+    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+    false,
+    ['verify'],
+  );
+  return crypto.subtle.verify(
+    'RSASSA-PKCS1-v1_5',
+    key,
+    Buffer.from(signature, 'base64url'),
+    new TextEncoder().encode(header + '.' + payload),
+  );
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  config.issuer = ISSUER;
+});
+`;
+}
+function discoverySection(features, scopes) {
+    const endpoints = [
+        `      issuer: ISSUER,`,
+        `      authorization_endpoint: ISSUER + '/authorize',`,
+        `      token_endpoint: ISSUER + '/token',`,
+        `      userinfo_endpoint: ISSUER + '/userinfo',`,
+        `      jwks_uri: ISSUER + '/.well-known/jwks.json',`,
+        ...(features.introspection ? [`      introspection_endpoint: ISSUER + '/introspect',`] : []),
+        ...(features.revocation ? [`      revocation_endpoint: ISSUER + '/revoke',`] : []),
+        ...(features.par ? [`      pushed_authorization_request_endpoint: ISSUER + '/par',`] : []),
+        ...(features.deviceAuthorizationGrant
+            ? [`      device_authorization_endpoint: ISSUER + '/device_authorization',`]
+            : []),
+        ...(features.ciba
+            ? [`      backchannel_authentication_endpoint: ISSUER + '/backchannel_authentication',`]
+            : []),
+        ...(features.rpInitiatedLogout ? [`      end_session_endpoint: ISSUER + '/logout',`] : []),
+    ].join('\n');
+    const list = (values) => values.map((value) => `'${value}'`).join(', ');
+    const responseModes = features.jarm ? `'query', 'query.jwt', 'jwt'` : `'query'`;
+    const absentMembers = [
+        ...(features.introspection ? [] : ['introspection_endpoint']),
+        ...(features.revocation ? [] : ['revocation_endpoint']),
+        ...(features.par ? [] : ['pushed_authorization_request_endpoint']),
+        ...(features.deviceAuthorizationGrant ? [] : ['device_authorization_endpoint']),
+        ...(features.ciba
+            ? []
+            : ['backchannel_authentication_endpoint', 'backchannel_token_delivery_modes_supported']),
+        ...(features.rpInitiatedLogout ? [] : ['end_session_endpoint']),
+        ...(features.jarm ? [] : ['authorization_signing_alg_values_supported']),
+        ...(features.idJag
+            ? []
+            : ['identity_chaining_requested_token_types_supported', 'authorization_grant_profiles_supported']),
+        ...(features.introspection && features.jwtIntrospectionResponse
+            ? []
+            : ['introspection_signing_alg_values_supported']),
+    ];
+    const absentMembersTest = absentMembers.length > 0
+        ? `
+  it('should advertise nothing of the features this OP was generated without', async () => {
+    const { metadata } = await providerMetadata();
+    const absent = [
+${absentMembers.map((name) => `      '${name}',`).join('\n')}
+    ];
+
+    expect(absent.filter((name) => name in metadata)).toEqual([]);
+  });
+`
+        : '';
+    return `describe('Discovery (OIDC Discovery 1.0 §3 / §4)', () => {
+  async function providerMetadata(): Promise<{ response: Response; metadata: Record<string, unknown> }> {
+    const response = await new Browser().request(discovery.GET, '/.well-known/openid-configuration');
+    return { response, metadata: (await response.json()) as Record<string, unknown> };
+  }
+
+  it('should publish every endpoint on the issuer', async () => {
+    const { response, metadata } = await providerMetadata();
+
+    expect(response.status).toBe(200);
+    expect(metadata).toMatchObject({
+${endpoints}
+    });
+  });
+
+  it('should advertise exactly what this OP supports', async () => {
+    const { metadata } = await providerMetadata();
+
+    expect(metadata).toMatchObject({
+      response_types_supported: ['code'],
+      response_modes_supported: [${responseModes}],
+      grant_types_supported: [${list(nextJsSupportedGrantTypes(features))}],
+      scopes_supported: [${list(nextJsSupportedScopes(features, scopes))}],
+      id_token_signing_alg_values_supported: ['RS256'],
+      token_endpoint_auth_methods_supported: ['client_secret_basic', 'client_secret_post', 'none'],
+      code_challenge_methods_supported: ['S256'],
+      authorization_response_iss_parameter_supported: true,
+    });
+  });
+${absentMembersTest}
+  it('should let any origin read and cache the metadata', async () => {
+    const { response } = await providerMetadata();
+
+    expect(response.headers.get('Access-Control-Allow-Origin')).toBe('*');
+    expect(response.headers.get('Cache-Control')).toBe('public, max-age=3600');
+  });
+
+  it('should publish the signing key without its private members (RFC 7517 §4)', async () => {
+    const response = await new Browser().request(jwks.GET, '/.well-known/jwks.json');
+    const { keys } = (await response.json()) as { keys: Array<Record<string, unknown>> };
+
+    expect(response.status).toBe(200);
+    expect(keys.map((key) => [key.kid, key.kty, key.alg, key.use, key.d])).toEqual([
+      ['conformance-key', 'RSA', 'RS256', 'sig', undefined],
+    ]);
+  });
+});
+`;
+}
+function authorizationEndpointSection(features) {
+    const pkceTests = features.pkce
+        ? `
+  it('should require PKCE from every client (OAuth 2.1 §4.1.1)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ code_challenge: undefined, code_challenge_method: undefined })),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+    expect(location.searchParams.get('error')).toBe('invalid_request');
+    expect(location.searchParams.get('error_description')).toBe('Missing required parameter: code_challenge');
+  });
+`
+        : `
+  it('should let a confidential client omit PKCE (OIDF Basic OP compatibility)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ code_challenge: undefined, code_challenge_method: undefined })),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(ISSUER + '/login');
+  });
+
+  it('should still require PKCE from a public client (OAuth 2.1 §4.1.1)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(
+        authorizationRequest({
+          client_id: 'conformance-public-client',
+          code_challenge: undefined,
+          code_challenge_method: undefined,
+        }),
+      ),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+    expect(location.searchParams.get('error')).toBe('invalid_request');
+  });
+`;
+    const requestObjectTest = features.requestObject
+        ? `
+  it('should refuse an unsigned Request Object (OIDC Core 1.0 §6.1)', async () => {
+    const unsigned =
+      Buffer.from(JSON.stringify({ alg: 'none' })).toString('base64url') +
+      '.' +
+      Buffer.from(JSON.stringify(authorizationRequest())).toString('base64url') +
+      '.';
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ request: unsigned })),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(response.status).toBe(303);
+    expect(location.origin + location.pathname).toBe(ISSUER + '/oidc-error');
+    expect(location.searchParams.get('error')).toBe('invalid_request_object');
+  });
+`
+        : `
+  it('should refuse the request parameter (OIDC Core 1.0 §6.3)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ request: 'eyJhbGciOiJub25lIn0.e30.' })),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+    expect(location.searchParams.get('error')).toBe('request_not_supported');
+  });
+`;
+    return `describe('Authorization Endpoint (OIDC Core 1.0 §3.1.2)', () => {
+  it('should send the browser to the login page on the issuer with a new transaction', async () => {
+    const response = await new Browser().request(authorize.GET, authorizeUrl(authorizationRequest()));
+    const location = new URL(locationOf(response));
+
+    expect(response.status).toBe(302);
+    expect(location.origin + location.pathname).toBe(ISSUER + '/login');
+    expect(location.searchParams.get('transaction_id')).toMatch(/^[A-Za-z0-9_-]{43}$/);
+  });
+
+  it('should accept the request as a form POST (OIDC Core 1.0 §3.1.2.1)', async () => {
+    const response = await new Browser().post(authorize.POST, '/authorize', authorizationRequest());
+    const location = new URL(locationOf(response));
+
+    expect(response.status).toBe(302);
+    expect(location.origin + location.pathname).toBe(ISSUER + '/login');
+  });
+
+  it('should reject a POST body that is not form-encoded', async () => {
+    const response = await new Browser().request(authorize.POST, '/authorize', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(authorizationRequest()),
+    });
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({
+      error: 'invalid_request',
+      error_description: 'Authorization POST requests must use application/x-www-form-urlencoded',
+    });
+  });
+
+  it('should reject a repeated parameter without redirecting (RFC 6749 §3.1)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest()) + '&scope=openid',
+    );
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({
+      error: 'invalid_request',
+      error_description: 'Parameter "scope" must not be repeated',
+    });
+  });
+
+  it('should send an unregistered redirect_uri to the OP error page instead of redirecting (OIDC Core 1.0 §3.1.2.2)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ redirect_uri: 'https://attacker.example/callback' })),
+    );
+
+    expect(response.status).toBe(303);
+    expect(locationOf(response)).toBe(
+      ISSUER + '/oidc-error?error=invalid_request&error_description=redirect_uri+not+registered',
+    );
+  });
+
+  it('should answer the same error as JSON to a caller that accepts JSON', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ redirect_uri: 'https://attacker.example/callback' })),
+      { headers: { Accept: 'application/json' } },
+    );
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({
+      error: 'invalid_request',
+      error_description: 'redirect_uri not registered',
+    });
+  });
+
+  it('should render the error page with the error escaped', async () => {
+    const html = await new Browser().render(OidcErrorPage, {
+      error: 'invalid_request',
+      error_description: '<script>alert(1)</script>',
+    });
+
+    expect(html).toBe(
+      '<main><h1>Error</h1><p>invalid_request</p><p>&lt;script&gt;alert(1)&lt;/script&gt;</p></main>',
+    );
+  });
+
+  it('should return a redirectable error to the client with state and iss (RFC 9207 §2)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ response_type: 'token' })),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(response.status).toBe(302);
+    expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+    expect(Object.fromEntries(location.searchParams)).toEqual({
+      error: 'unsupported_response_type',
+      error_description: 'Unsupported response_type: token',
+      state: 'conformance-state',
+      iss: ISSUER,
+    });
+  });
+${pkceTests}${requestObjectTest}});
+`;
+}
+function internalRedirectOriginSection() {
+    return `describe('Internal redirect origin (OIDC Discovery 1.0 §3 / RFC 9700 §2.1)', () => {
+  it('should ignore the Host header when building the login redirect Location', async () => {
+    // Some platforms build request.url from the Host header, so an
+    // attacker-chosen Host arrives as an attacker-origin URL. Both are sent;
+    // neither may decide where transaction_id lands.
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest(), 'http://attacker.example'),
+      { headers: { Host: 'attacker.example' } },
+    );
+    const location = new URL(locationOf(response));
+
+    expect(response.status).toBe(302);
+    expect(location.origin + location.pathname).toBe(ISSUER + '/login');
+  });
+
+  it('should keep the login redirect Location on the issuer origin for a subpath issuer', async () => {
+    // '/login' is an absolute path, so a subpath issuer contributes only its
+    // origin. Mounting the generated routes under a subpath (basePath) is a
+    // separate concern this provider does not handle.
+    config.issuer = 'https://op.example.com/op';
+    const response = await new Browser().request(authorize.GET, authorizeUrl(authorizationRequest()));
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe('https://op.example.com/login');
+  });
+
+  it('should continue from login to consent on a path of this app', async () => {
+    // Server Actions redirect within the app, which Next.js resolves against
+    // the page the browser is on — never against a request header.
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+
+    expect(await logIn(browser, transactionId)).toBe('/consent?transaction_id=' + transactionId);
+  });
+});
+`;
+}
+function loginSection() {
+    return `describe('Login page and loginAction (OIDC Core 1.0 §3.1.2.3)', () => {
+  it('should render the login form for the transaction', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    const html = await browser.render(LoginPage, { transaction_id: transactionId });
+
+    expect(html).toContain('<input type="hidden" name="transaction_id" value="' + transactionId + '"/>');
+    expect(csrfTokenOf(html)).toMatch(/^[A-Za-z0-9_-]{43}$/);
+  });
+
+  it('should pre-fill the username from login_hint (OIDC Core 1.0 §3.1.2.1)', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser, authorizationRequest({ login_hint: 'testuser' }));
+    const html = await browser.render(LoginPage, { transaction_id: transactionId });
+
+    expect(html).toContain('<input type="text" id="username" required="" name="username" value="testuser"/>');
+  });
+
+  it('should start the OP session in an HttpOnly, Secure, SameSite=Lax cookie', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    await logIn(browser, transactionId);
+    const sessionCookie = harness.cookieWrites.filter((write) => write.name === 'session_id').at(-1);
+
+    expect(sessionCookie?.value).toBe(browser.cookies.get('session_id'));
+    expect(sessionCookie?.options).toEqual({ httpOnly: true, secure: true, sameSite: 'lax', path: '/' });
+  });
+
+  it('should send a failed login back to the form with the attempts remaining', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    const html = await browser.render(LoginPage, { transaction_id: transactionId });
+    const outcome = await browser.submit(loginAction, {
+      transaction_id: transactionId,
+      csrf_token: csrfTokenOf(html),
+      username: 'testuser',
+      password: 'wrong-password',
+    });
+
+    expect(outcome).toEqual({
+      status: 303,
+      location: '/login?transaction_id=' + transactionId + '&error=invalid_credentials&remaining=4',
+    });
+    expect(browser.cookies.has('session_id')).toBe(false);
+  });
+
+  it('should render the failed login message', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    const html = await browser.render(LoginPage, {
+      transaction_id: transactionId,
+      error: 'invalid_credentials',
+      remaining: '4',
+    });
+
+    expect(html).toContain('<p role="alert" style="color:red">Invalid credentials. Attempts remaining: 4</p>');
+  });
+
+  it('should end the transaction on the OP error page after too many failed attempts', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    const csrfToken = csrfTokenOf(await browser.render(LoginPage, { transaction_id: transactionId }));
+    const outcomes: Outcome[] = [];
+    for (let attempt = 0; attempt < 5; attempt++) {
+      outcomes.push(
+        await browser.submit(loginAction, {
+          transaction_id: transactionId,
+          csrf_token: csrfToken,
+          username: 'testuser',
+          password: 'wrong-password',
+        }),
+      );
+    }
+
+    expect(outcomes.at(-1)).toEqual({
+      status: 303,
+      location:
+        '/oidc-error?error=max_attempts_exceeded&error_description=' +
+        'Too+many+login+attempts.+Start+again+from+the+application.',
+    });
+    expect(await browser.open(LoginPage, { transaction_id: transactionId })).toEqual({ status: 404 });
+  });
+
+  it('should send a submission with a wrong csrf_token to the OP error page', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    const outcome = await browser.submit(loginAction, {
+      transaction_id: transactionId,
+      csrf_token: 'forged',
+      username: 'testuser',
+      password: 'password',
+    });
+
+    expect(outcome).toEqual({
+      status: 303,
+      location: '/oidc-error?error=invalid_csrf_token&error_description=Invalid+CSRF+token.',
+    });
+    expect(browser.cookies.has('session_id')).toBe(false);
+  });
+
+  describe('Error screens (Next.js not-found.js / error.js)', () => {
+    it('should answer 404 with not-found.tsx for an unknown transaction', async () => {
+      expect(await new Browser().open(LoginPage, { transaction_id: 'unknown-transaction' })).toEqual({ status: 404 });
+    });
+
+    it('should answer 404 when transaction_id is missing', async () => {
+      expect(await new Browser().open(LoginPage, {})).toEqual({ status: 404 });
+    });
+
+    it('should answer 404 to a login submitted for an unknown transaction', async () => {
+      const outcome = await new Browser().submit(loginAction, {
+        transaction_id: 'unknown-transaction',
+        csrf_token: 'unknown',
+        username: 'testuser',
+        password: 'password',
+      });
+
+      expect(outcome).toEqual({ status: 404 });
+    });
+
+    it('should tell the End-User to start again from the application (not-found.tsx)', () => {
+      expect(renderToStaticMarkup(createElement(LoginNotFound))).toBe(
+        '<main><h1>Error</h1><p>transaction_not_found</p>' +
+          '<p>This sign-in request was not found or has expired. Start again from the application.</p></main>',
+      );
+    });
+
+    it('should show the digest of an unexpected error but never its message (error.tsx)', () => {
+      const error = Object.assign(new Error('connect ECONNREFUSED 10.0.0.5:6379'), { digest: '2938471023' });
+      const html = renderToStaticMarkup(createElement(LoginError, { error, retry: () => undefined }));
+
+      expect(html).toBe(
+        '<main><h1>Error</h1><p>server_error</p><p>Reference: 2938471023</p>' +
+          '<button type="button">Try again</button></main>',
+      );
+    });
+  });
+});
+`;
+}
+function consentSection() {
+    return `describe('Consent page and consentAction (OIDC Core 1.0 §3.1.2.4)', () => {
+  it('should show the client and the requested scopes', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    await logIn(browser, transactionId);
+    const html = await browser.render(ConsentPage, { transaction_id: transactionId });
+
+    expect(html).toContain('<strong>conformance-client</strong>');
+    expect(html).toContain('<ul><li>openid</li><li>profile</li></ul>');
+  });
+
+  it('should send the browser back to login when the transaction has no signed-in user', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+
+    expect(await decide(browser, transactionId, 'approve')).toBe('/login?transaction_id=' + transactionId);
+  });
+
+  it('should send a decision with a wrong csrf_token to the OP error page', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    await logIn(browser, transactionId);
+    const outcome = await browser.submit(consentAction, {
+      transaction_id: transactionId,
+      csrf_token: 'forged',
+      action: 'approve',
+    });
+
+    expect(outcome).toEqual({
+      status: 303,
+      location: '/oidc-error?error=invalid_csrf_token&error_description=Invalid+CSRF+token.',
+    });
+  });
+
+  describe('Error screens (Next.js not-found.js / error.js)', () => {
+    it('should answer 404 with not-found.tsx for an unknown transaction', async () => {
+      expect(await new Browser().open(ConsentPage, { transaction_id: 'unknown-transaction' })).toEqual({ status: 404 });
+    });
+
+    it('should answer 404 to a decision submitted for an unknown transaction', async () => {
+      const outcome = await new Browser().submit(consentAction, {
+        transaction_id: 'unknown-transaction',
+        csrf_token: 'unknown',
+        action: 'approve',
+      });
+
+      expect(outcome).toEqual({ status: 404 });
+    });
+
+    it('should tell the End-User to start again from the application (not-found.tsx)', () => {
+      expect(renderToStaticMarkup(createElement(ConsentNotFound))).toBe(
+        '<main><h1>Error</h1><p>transaction_not_found</p>' +
+          '<p>This sign-in request was not found or has expired. Start again from the application.</p></main>',
+      );
+    });
+
+    it('should show the digest of an unexpected error but never its message (error.tsx)', () => {
+      const error = Object.assign(new Error('connect ECONNREFUSED 10.0.0.5:6379'), { digest: '2938471023' });
+      const html = renderToStaticMarkup(createElement(ConsentError, { error, retry: () => undefined }));
+
+      expect(html).toBe(
+        '<main><h1>Error</h1><p>server_error</p><p>Reference: 2938471023</p>' +
+          '<button type="button">Try again</button></main>',
+      );
+    });
+  });
+
+  describe('Consent decision value (OIDC Core 1.0 §3.1.2.4)', () => {
+    const invalidDecision =
+      '/oidc-error?error=invalid_request&error_description=' +
+      'Invalid+consent+decision.+Please+use+the+Approve+or+Deny+button.';
+
+    async function signedInTransaction(browser: Browser): Promise<string> {
+      const transactionId = await startAuthorization(browser);
+      await logIn(browser, transactionId);
+      return transactionId;
+    }
+
+    it('should issue an authorization code when the consent form sends action=approve', async () => {
+      const browser = new Browser();
+      const location = new URL(await decide(browser, await signedInTransaction(browser), 'approve'));
+
+      expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+      expect([...location.searchParams.keys()]).toEqual(['code', 'state', 'iss']);
+      expect(location.searchParams.get('state')).toBe('conformance-state');
+      expect(location.searchParams.get('iss')).toBe(ISSUER);
+    });
+
+    it('should redirect with error=access_denied when the consent form sends action=deny', async () => {
+      const browser = new Browser();
+      const transactionId = await signedInTransaction(browser);
+      const location = new URL(await decide(browser, transactionId, 'deny'));
+
+      expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+      expect(Object.fromEntries(location.searchParams)).toEqual({
+        error: 'access_denied',
+        state: 'conformance-state',
+        iss: ISSUER,
+      });
+      expect(await stores.transactionStore.get('auth_txn:' + transactionId)).toBe(null);
+    });
+
+    it('should not issue an authorization code when the consent form omits the action parameter', async () => {
+      const browser = new Browser();
+
+      expect(await decide(browser, await signedInTransaction(browser), undefined)).toBe(invalidDecision);
+    });
+
+    it('should not issue an authorization code when the consent form sends an empty action value', async () => {
+      const browser = new Browser();
+
+      expect(await decide(browser, await signedInTransaction(browser), '')).toBe(invalidDecision);
+    });
+
+    it('should not issue an authorization code when the consent form sends an unknown action value', async () => {
+      const browser = new Browser();
+
+      expect(await decide(browser, await signedInTransaction(browser), 'allow')).toBe(invalidDecision);
+    });
+
+    it('should not record consent via recordConsent when the action value is unrecognized', async () => {
+      const recordConsent = vi.spyOn(resolvers.consentResolver, 'recordConsent');
+      const browser = new Browser();
+      await decide(browser, await signedInTransaction(browser), 'allow');
+
+      expect(recordConsent).not.toHaveBeenCalled();
+    });
+
+    it('should keep the transaction open after an unrecognized action value', async () => {
+      const browser = new Browser();
+      const transactionId = await signedInTransaction(browser);
+      await decide(browser, transactionId, 'allow');
+      const location = new URL(await decide(browser, transactionId, 'approve'));
+
+      expect(location.searchParams.get('code')).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    });
+  });
+});
+`;
+}
+function transactionBindingSection(features) {
+    if (!features.transactionBinding) {
+        return `describe('Auth transaction User-Agent binding (disabled by default)', () => {
+  it('should let another browser holding the transaction_id continue the transaction', async () => {
+    // Generate with --enable transaction-binding to refuse this: without it,
+    // transaction_id alone is enough to drive login and consent.
+    const transactionId = await startAuthorization(new Browser());
+
+    expect(await logIn(new Browser(), transactionId)).toBe('/consent?transaction_id=' + transactionId);
+  });
+});
+`;
+    }
+    return `describe('Auth transaction User-Agent binding (OIDC Core 1.0 §3.1.2.3 / §3.1.2.4)', () => {
+  it('should hand the binding secret to the browser in an HttpOnly cookie scoped to the transaction', async () => {
+    const response = await new Browser().request(authorize.GET, authorizeUrl(authorizationRequest()));
+    const transactionId = transactionIdOf(locationOf(response));
+
+    expect(response.headers.getSetCookie()).toEqual([
+      expect.stringMatching(
+        new RegExp('^oidc_txn_' + transactionId + '=[A-Za-z0-9_-]{43}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=600$'),
+      ),
+    ]);
+  });
+
+  const notThisBrowser =
+    '/oidc-error?error=invalid_transaction_binding&error_description=' +
+    'This+authorization+transaction+was+not+started+by+this+browser.';
+
+  it('should send another browser holding the transaction_id from the login page to the OP error page', async () => {
+    const transactionId = await startAuthorization(new Browser());
+
+    expect(await new Browser().open(LoginPage, { transaction_id: transactionId })).toEqual({
+      status: 307,
+      location: notThisBrowser,
+    });
+  });
+
+  it('should refuse a login submitted by another browser holding the transaction_id', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    const csrfToken = csrfTokenOf(await browser.render(LoginPage, { transaction_id: transactionId }));
+    const attacker = new Browser();
+    const outcome = await attacker.submit(loginAction, {
+      transaction_id: transactionId,
+      csrf_token: csrfToken,
+      username: 'testuser',
+      password: 'password',
+    });
+
+    expect(outcome).toEqual({ status: 303, location: notThisBrowser });
+    expect(attacker.cookies.has('session_id')).toBe(false);
+  });
+
+  it('should send another browser holding the transaction_id from the consent page to the OP error page', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    await logIn(browser, transactionId);
+
+    expect(await new Browser().open(ConsentPage, { transaction_id: transactionId })).toEqual({
+      status: 307,
+      location: notThisBrowser,
+    });
+  });
+
+  it('should refuse a consent decision from another browser holding the transaction_id', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    await logIn(browser, transactionId);
+    const csrfToken = csrfTokenOf(await browser.render(ConsentPage, { transaction_id: transactionId }));
+    const outcome = await new Browser().submit(consentAction, {
+      transaction_id: transactionId,
+      csrf_token: csrfToken,
+      action: 'approve',
+    });
+
+    expect(outcome).toEqual({ status: 303, location: notThisBrowser });
+  });
+
+  it('should drop the binding cookie once the decision is made', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser);
+    await logIn(browser, transactionId);
+    await decide(browser, transactionId, 'approve');
+
+    expect(browser.cookies.has('oidc_txn_' + transactionId)).toBe(false);
+  });
+});
+`;
+}
+function tokenEndpointSection(features) {
+    const refreshTests = features.refreshToken
+        ? `
+  it('should rotate the refresh token and revoke the family on reuse (OAuth 2.1 §4.3.1)', async () => {
+    const tokens = await issueTokens();
+    const refresh = (refreshToken: string) =>
+      tokenRequest({ grant_type: 'refresh_token', refresh_token: refreshToken });
+    const rotated = (await (await refresh(tokens.refresh_token ?? '')).json()) as TokenResponse;
+    const reuse = await refresh(tokens.refresh_token ?? '');
+    const afterReuse = await refresh(rotated.refresh_token ?? '');
+
+    expect(rotated.refresh_token).toMatch(/^[A-Za-z0-9_-]+$/);
+    expect(rotated.refresh_token).not.toBe(tokens.refresh_token);
+    expect(reuse.status).toBe(400);
+    expect(((await reuse.json()) as { error: string }).error).toBe('invalid_grant');
+    expect(afterReuse.status).toBe(400);
+  });
+`
+        : `
+  it('should not issue a refresh token', async () => {
+    const tokens = await issueTokens();
+
+    expect(tokens.refresh_token).toBe(undefined);
+  });
+
+  it('should refuse the refresh_token grant', async () => {
+    const response = await tokenRequest({ grant_type: 'refresh_token', refresh_token: 'unused' });
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('unsupported_grant_type');
+  });
+`;
+    const disabledGrants = [
+        ...(features.tokenExchange || features.idJag
+            ? []
+            : ['urn:ietf:params:oauth:grant-type:token-exchange']),
+        ...(features.deviceAuthorizationGrant ? [] : ['urn:ietf:params:oauth:grant-type:device_code']),
+        ...(features.ciba ? [] : ['urn:openid:params:grant-type:ciba']),
+    ];
+    const disabledGrantsTest = disabledGrants.length > 0
+        ? `
+  it('should answer unsupported_grant_type for the grants of features this OP was generated without (RFC 6749 §5.2)', async () => {
+    const grantTypes = [
+${disabledGrants.map((grantType) => `      '${grantType}',`).join('\n')}
+    ];
+    const answers = await Promise.all(
+      grantTypes.map(async (grantType) => {
+        const response = await tokenRequest({ grant_type: grantType });
+        return [response.status, ((await response.json()) as { error: string }).error];
+      }),
+    );
+
+    expect(answers).toEqual(grantTypes.map(() => [400, 'unsupported_grant_type']));
+  });
+`
+        : '';
+    return `describe('Token Endpoint (OIDC Core 1.0 §3.1.3)', () => {
+  it('should exchange the code for tokens that must not be cached', async () => {
+    const callback = await signIn(new Browser());
+    const response = await exchangeCode(callback.searchParams.get('code') ?? '');
+    const body = (await response.json()) as TokenResponse;
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('Cache-Control')).toBe('no-store');
+    expect(response.headers.get('Pragma')).toBe('no-cache');
+    expect(body).toMatchObject({ token_type: 'Bearer', expires_in: 3600, scope: 'openid profile' });
+  });
+
+  it('should issue an ID Token for the signed-in user (OIDC Core 1.0 §2)', async () => {
+    const tokens = await issueTokens();
+
+    expect(decodeJwt(tokens.id_token).payload).toMatchObject({
+      iss: ISSUER,
+      sub: 'testuser',
+      aud: 'conformance-client',
+      nonce: 'conformance-nonce',
+    });
+  });
+
+  it('should sign the ID Token with the key the JWKS endpoint publishes', async () => {
+    const tokens = await issueTokens();
+
+    expect(decodeJwt(tokens.id_token).header).toMatchObject({ alg: 'RS256', kid: 'conformance-key' });
+    expect(await verifiesWithPublishedKey(tokens.id_token)).toBe(true);
+  });
+
+  it('should reject a body that is not form-encoded (RFC 6749 §4.1.3)', async () => {
+    const response = await new Browser().request(token.POST, '/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ grant_type: 'authorization_code' }),
+    });
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({
+      error: 'invalid_request',
+      error_description: 'Token requests must use application/x-www-form-urlencoded',
+    });
+  });
+
+  it('should reject a repeated parameter (RFC 6749 §3.2)', async () => {
+    const response = await new Browser().request(token.POST, '/token', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: 'grant_type=authorization_code&code=a&code=b',
+    });
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({
+      error: 'invalid_request',
+      error_description: 'Parameter "code" must not be repeated',
+    });
+  });
+
+  it('should answer a wrong client_secret with 401 invalid_client (RFC 6749 §5.2)', async () => {
+    const response = await tokenRequest({
+      grant_type: 'authorization_code',
+      code: 'unused',
+      client_secret: 'wrong-secret',
+    });
+
+    expect(response.status).toBe(401);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_client');
+  });
+
+  it('should challenge a failed HTTP Basic authentication with WWW-Authenticate (RFC 6749 §5.2)', async () => {
+    const response = await new Browser().post(
+      token.POST,
+      '/token',
+      { grant_type: 'authorization_code', code: 'unused' },
+      { Authorization: basicAuthorization('conformance-basic-client', 'wrong-secret') },
+    );
+
+    expect(response.status).toBe(401);
+    expect(response.headers.get('WWW-Authenticate')).toBe('Basic realm="Client Authentication"');
+  });
+
+  it('should authenticate a client_secret_basic client from the Authorization header', async () => {
+    const callback = await signIn(new Browser(), authorizationRequest({ client_id: 'conformance-basic-client' }));
+    const response = await new Browser().post(
+      token.POST,
+      '/token',
+      {
+        grant_type: 'authorization_code',
+        code: callback.searchParams.get('code') ?? '',
+        redirect_uri: REDIRECT_URI,
+        code_verifier: CODE_VERIFIER,
+      },
+      { Authorization: basicAuthorization('conformance-basic-client', 'conformance-basic-secret') },
+    );
+
+    expect(response.status).toBe(200);
+  });
+
+  it('should refuse a code_verifier that does not match the code_challenge (RFC 7636 §4.6)', async () => {
+    const callback = await signIn(new Browser());
+    const response = await tokenRequest({
+      grant_type: 'authorization_code',
+      code: callback.searchParams.get('code') ?? '',
+      redirect_uri: REDIRECT_URI,
+      code_verifier: 'wrong-verifier-wrong-verifier-wrong-verifier-wrong',
+    });
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_grant');
+  });
+
+  it('should refuse a reused code and revoke the tokens issued from it (OAuth 2.1 §4.1.2)', async () => {
+    const callback = await signIn(new Browser());
+    const code = callback.searchParams.get('code') ?? '';
+    const tokens = (await (await exchangeCode(code)).json()) as TokenResponse;
+    const reuse = await exchangeCode(code);
+    const userInfo = await userInfoRequest(tokens.access_token);
+
+    expect(reuse.status).toBe(400);
+    expect(((await reuse.json()) as { error: string }).error).toBe('invalid_grant');
+    expect(userInfo.status).toBe(401);
+  });
+${refreshTests}${disabledGrantsTest}
+  it('should answer a CORS preflight for the configured origin', async () => {
+    const response = await new Browser().request(token.OPTIONS, '/token', {
+      method: 'OPTIONS',
+      headers: { Origin: ISSUER, 'Access-Control-Request-Method': 'POST' },
+    });
+
+    expect(response.status).toBe(204);
+    expect(Object.fromEntries(response.headers)).toEqual({
+      'access-control-allow-origin': ISSUER,
+      'access-control-allow-methods': 'POST,GET,OPTIONS',
+      'access-control-allow-headers': 'Authorization,Content-Type',
+      'access-control-max-age': '600',
+      vary: 'Origin',
+    });
+  });
+});
+`;
+}
+function userInfoSection() {
+    return `describe('UserInfo Endpoint (OIDC Core 1.0 §5.3)', () => {
+  it('should return the claims of the granted scopes (OIDC Core 1.0 §5.4)', async () => {
+    const tokens = await issueTokens();
+    const response = await userInfoRequest(tokens.access_token);
+
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({
+      sub: 'testuser',
+      name: 'Test User',
+      family_name: 'User',
+      given_name: 'Test',
+      middle_name: 'Q',
+      nickname: 'testy',
+      preferred_username: 'testuser',
+      profile: 'https://op.example.com/users/testuser',
+      picture: 'https://op.example.com/users/testuser/avatar.png',
+      website: 'https://testuser.example.com',
+      gender: 'unspecified',
+      birthdate: '1990-01-01',
+      zoneinfo: 'Asia/Tokyo',
+      locale: 'en-US',
+      updated_at: 1700000000,
+    });
+  });
+
+  it('should accept the access token in a form-encoded POST body (RFC 6750 §2.2)', async () => {
+    const tokens = await issueTokens();
+    const response = await new Browser().post(userinfo.POST, '/userinfo', { access_token: tokens.access_token });
+
+    expect(response.status).toBe(200);
+    expect(((await response.json()) as { sub: string }).sub).toBe('testuser');
+  });
+
+  it('should challenge a request without an access token (RFC 6750 §3)', async () => {
+    const response = await new Browser().request(userinfo.GET, '/userinfo');
+
+    expect(response.status).toBe(401);
+    expect(response.headers.get('WWW-Authenticate')).toBe('Bearer realm="UserInfo"');
+    expect(await response.json()).toEqual({ error: 'invalid_token', error_description: 'Access token is required' });
+  });
+
+  it('should reject an access token this OP did not issue', async () => {
+    const response = await userInfoRequest('unknown-access-token');
+
+    expect(response.status).toBe(401);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_token');
+  });
+});
+`;
+}
+function sessionSection() {
+    return `describe('OP session (OIDC Core 1.0 §3.1.2.1 / §3.1.2.3)', () => {
+  it('should reuse the session and the consent already given (single sign-on)', async () => {
+    const browser = new Browser();
+    await signIn(browser);
+    const response = await browser.request(authorize.GET, authorizeUrl(authorizationRequest()));
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+    expect(location.searchParams.get('code')).toMatch(/^[A-Za-z0-9_-]{43}$/);
+  });
+
+  it('should show the consent page again for prompt=consent', async () => {
+    const browser = new Browser();
+    await signIn(browser);
+    const response = await browser.request(authorize.GET, authorizeUrl(authorizationRequest({ prompt: 'consent' })));
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(ISSUER + '/consent');
+  });
+
+  it('should ask for a new login for prompt=login even with a session', async () => {
+    const browser = new Browser();
+    await signIn(browser);
+    const response = await browser.request(authorize.GET, authorizeUrl(authorizationRequest({ prompt: 'login' })));
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(ISSUER + '/login');
+  });
+
+  it('should answer prompt=none without a session with login_required', async () => {
+    const response = await new Browser().request(authorize.GET, authorizeUrl(authorizationRequest({ prompt: 'none' })));
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+    expect(location.searchParams.get('error')).toBe('login_required');
+    expect(location.searchParams.get('state')).toBe('conformance-state');
+  });
+
+  it('should issue a code for prompt=none with a session and consent', async () => {
+    const browser = new Browser();
+    await signIn(browser);
+    const response = await browser.request(authorize.GET, authorizeUrl(authorizationRequest({ prompt: 'none' })));
+    const location = new URL(locationOf(response));
+
+    expect(location.origin + location.pathname).toBe(REDIRECT_URI);
+    expect(location.searchParams.get('code')).toMatch(/^[A-Za-z0-9_-]{43}$/);
+  });
+});
+`;
+}
+function introspectionSection() {
+    return `describe('Token Introspection (RFC 7662)', () => {
+  function introspectToken(tokenValue: string, clientSecret = 'conformance-secret'): Promise<Response> {
+    return new Browser().post(introspect.POST, '/introspect', {
+      token: tokenValue,
+      client_id: 'conformance-client',
+      client_secret: clientSecret,
+    });
+  }
+
+  it('should describe an active access token (RFC 7662 §2.2)', async () => {
+    const tokens = await issueTokens();
+    const response = await introspectToken(tokens.access_token);
+
+    expect(response.status).toBe(200);
+    expect(await response.json()).toMatchObject({
+      active: true,
+      client_id: 'conformance-client',
+      sub: 'testuser',
+      scope: 'openid profile',
+      iss: ISSUER,
+    });
+  });
+
+  it('should answer active=false for a token this OP did not issue', async () => {
+    const response = await introspectToken('unknown-token');
+
+    expect(await response.json()).toEqual({ active: false });
+  });
+
+  it('should require client authentication (RFC 7662 §2.1)', async () => {
+    const response = await introspectToken('unknown-token', 'wrong-secret');
+
+    expect(response.status).toBe(401);
+  });
+});
+`;
+}
+function revocationSection() {
+    return `describe('Token Revocation (RFC 7009)', () => {
+  function revokeToken(tokenValue: string): Promise<Response> {
+    return new Browser().post(revoke.POST, '/revoke', {
+      token: tokenValue,
+      client_id: 'conformance-client',
+      client_secret: 'conformance-secret',
+    });
+  }
+
+  it('should revoke an access token so it is no longer accepted (RFC 7009 §2.1)', async () => {
+    const tokens = await issueTokens();
+    const response = await revokeToken(tokens.access_token);
+    const userInfo = await userInfoRequest(tokens.access_token);
+
+    expect(response.status).toBe(200);
+    expect(userInfo.status).toBe(401);
+  });
+
+  it('should answer 200 for a token this OP did not issue (RFC 7009 §2.2)', async () => {
+    const response = await revokeToken('unknown-token');
+
+    expect(response.status).toBe(200);
+  });
+});
+`;
+}
+function customScopesSection(scopes) {
+    const scope = scopes[0] ?? '';
+    return `describe('Custom scopes (scopes.ts)', () => {
+  afterEach(() => {
+    delete RESTRICTED_SCOPE_SUBJECTS['${scope}'];
+  });
+
+  it('should grant a declared custom scope', async () => {
+    const tokens = await issueTokens(new Browser(), authorizationRequest({ scope: 'openid ${scope}' }));
+
+    expect(tokens.scope).toBe('openid ${scope}');
+  });
+
+  it('should reject a scope that was not declared (RFC 6749 §3.3)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ scope: 'openid undeclared.scope' })),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(location.searchParams.get('error')).toBe('invalid_scope');
+    expect(location.searchParams.get('error_description')).toBe('Unsupported scope: undeclared.scope');
+  });
+
+  it('should drop a scope the End-User may not be granted (resolveGrantableScopes)', async () => {
+    RESTRICTED_SCOPE_SUBJECTS['${scope}'] = ['otheruser'];
+    const tokens = await issueTokens(new Browser(), authorizationRequest({ scope: 'openid ${scope}' }));
+
+    expect(tokens.scope).toBe('openid');
+  });
+});
+`;
+}
+function parSection() {
+    return `describe('Pushed Authorization Requests (RFC 9126)', () => {
+  function pushAuthorizationRequest(clientSecret = 'conformance-secret'): Promise<Response> {
+    return new Browser().post(par.POST, '/par', {
+      ...authorizationRequest(),
+      client_secret: clientSecret,
+    });
+  }
+
+  async function requestUri(): Promise<string> {
+    return ((await (await pushAuthorizationRequest()).json()) as { request_uri: string }).request_uri;
+  }
+
+  it('should answer 201 with a request_uri that must not be cached (RFC 9126 §2.2)', async () => {
+    const response = await pushAuthorizationRequest();
+    const body = (await response.json()) as { request_uri: string; expires_in: number };
+
+    expect(response.status).toBe(201);
+    expect(response.headers.get('Cache-Control')).toBe('no-cache, no-store');
+    expect(body.request_uri).toMatch(/^urn:ietf:params:oauth:request_uri:[A-Za-z0-9_-]+$/);
+    expect(body.expires_in).toBe(60);
+  });
+
+  it('should complete the flow from the pushed request (RFC 9126 §4)', async () => {
+    const callback = await signIn(new Browser(), { client_id: 'conformance-client', request_uri: await requestUri() });
+    const response = await exchangeCode(callback.searchParams.get('code') ?? '');
+
+    expect(callback.searchParams.get('state')).toBe('conformance-state');
+    expect(response.status).toBe(200);
+  });
+
+  it('should refuse a used request_uri without redirecting (RFC 9126 §7.3)', async () => {
+    const uri = await requestUri();
+    const params = { client_id: 'conformance-client', request_uri: uri };
+    await new Browser().request(authorize.GET, authorizeUrl(params));
+    const replay = await new Browser().request(authorize.GET, authorizeUrl(params));
+    const location = new URL(locationOf(replay));
+
+    expect(replay.status).toBe(303);
+    expect(location.origin + location.pathname).toBe(ISSUER + '/oidc-error');
+    expect(location.searchParams.get('error')).toBe('invalid_request_uri');
+  });
+
+  it('should require client authentication (RFC 9126 §2.1)', async () => {
+    const response = await pushAuthorizationRequest('wrong-secret');
+
+    expect(response.status).toBe(401);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_client');
+  });
+
+  it('should refuse a request_uri inside a pushed request (RFC 9126 §2.1)', async () => {
+    const response = await new Browser().post(par.POST, '/par', {
+      ...authorizationRequest(),
+      client_secret: 'conformance-secret',
+      request_uri: 'urn:ietf:params:oauth:request_uri:pushed-elsewhere',
+    });
+
+    expect(response.status).toBe(400);
+    expect(await response.json()).toEqual({
+      error: 'invalid_request',
+      error_description: 'request_uri MUST NOT be included in a pushed authorization request',
+    });
+  });
+
+  it('should validate the request like the authorization endpoint before storing it (RFC 9126 §2.1)', async () => {
+    const response = await new Browser().post(par.POST, '/par', {
+      ...authorizationRequest({ redirect_uri: 'https://attacker.example/callback' }),
+      client_secret: 'conformance-secret',
+    });
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_request');
+  });
+
+  it('should refuse a request_uri presented with another client_id (RFC 9126 §4)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl({ client_id: 'conformance-basic-client', request_uri: await requestUri() }),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(response.status).toBe(303);
+    expect(location.origin + location.pathname).toBe(ISSUER + '/oidc-error');
+    expect(location.searchParams.get('error')).toBe('invalid_request_uri');
+  });
+
+  describe('Required pushed requests (RFC 9126 §5)', () => {
+    afterEach(() => {
+      parConfig.requirePushedAuthorizationRequests = false;
+    });
+
+    it('should refuse an authorization request that was not pushed', async () => {
+      parConfig.requirePushedAuthorizationRequests = true;
+      const response = await new Browser().request(authorize.GET, authorizeUrl(authorizationRequest()));
+      const location = new URL(locationOf(response));
+
+      expect(location.origin + location.pathname).toBe(ISSUER + '/oidc-error');
+      expect(location.searchParams.get('error')).toBe('invalid_request');
+    });
+
+    it('should advertise require_pushed_authorization_requests in discovery', async () => {
+      parConfig.requirePushedAuthorizationRequests = true;
+      const response = await new Browser().request(discovery.GET, '/.well-known/openid-configuration');
+
+      expect(((await response.json()) as Record<string, unknown>).require_pushed_authorization_requests).toBe(true);
+    });
+  });
+});
+`;
+}
+function jarmSection() {
+    return `describe('JWT Secured Authorization Response Mode (JARM)', () => {
+  it('should return the authorization response as one signed JWT (JARM §2.3.1)', async () => {
+    const callback = await signIn(new Browser(), authorizationRequest({ response_mode: 'query.jwt' }));
+    const response = callback.searchParams.get('response') ?? '';
+
+    expect([...callback.searchParams.keys()]).toEqual(['response']);
+    expect(decodeJwt(response).payload).toMatchObject({
+      iss: ISSUER,
+      aud: 'conformance-client',
+      state: 'conformance-state',
+    });
+    expect(await verifiesWithPublishedKey(response)).toBe(true);
+  });
+
+  it('should return a denial as a signed error JWT (JARM §2.1)', async () => {
+    const browser = new Browser();
+    const transactionId = await startAuthorization(browser, authorizationRequest({ response_mode: 'query.jwt' }));
+    await logIn(browser, transactionId);
+    const callback = new URL(await decide(browser, transactionId, 'deny'));
+
+    expect(decodeJwt(callback.searchParams.get('response') ?? '').payload).toMatchObject({
+      iss: ISSUER,
+      aud: 'conformance-client',
+      error: 'access_denied',
+      state: 'conformance-state',
+    });
+  });
+
+  it('should answer the single sign-on fast path with a signed JWT whose code is redeemable', async () => {
+    // This path answers inside the authorize Route Handler, not the consent
+    // Server Action, so both places that sign are covered.
+    const browser = new Browser();
+    await signIn(browser);
+    const response = await browser.request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ response_mode: 'query.jwt' })),
+    );
+    const location = new URL(locationOf(response));
+    const jwt = location.searchParams.get('response') ?? '';
+    const tokenResponse = await exchangeCode(String(decodeJwt(jwt).payload.code ?? ''));
+
+    expect([...location.searchParams.keys()]).toEqual(['response']);
+    expect(await verifiesWithPublishedKey(jwt)).toBe(true);
+    expect(tokenResponse.status).toBe(200);
+  });
+
+  it('should answer prompt=none without a session with a signed error JWT', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ response_mode: 'query.jwt', prompt: 'none' })),
+    );
+    const jwt = new URL(locationOf(response)).searchParams.get('response') ?? '';
+
+    expect(decodeJwt(jwt).payload).toMatchObject({
+      iss: ISSUER,
+      aud: 'conformance-client',
+      error: 'login_required',
+      state: 'conformance-state',
+    });
+  });
+
+  it('should accept the jwt shorthand for query.jwt (JARM §2.3.4)', async () => {
+    const callback = await signIn(new Browser(), authorizationRequest({ response_mode: 'jwt' }));
+
+    expect([...callback.searchParams.keys()]).toEqual(['response']);
+  });
+
+  it('should advertise the response modes and the signing algorithm (JARM §4)', async () => {
+    const response = await new Browser().request(discovery.GET, '/.well-known/openid-configuration');
+
+    expect(await response.json()).toMatchObject({
+      response_modes_supported: ['query', 'query.jwt', 'jwt'],
+      authorization_signing_alg_values_supported: ['RS256'],
+    });
+  });
+
+  it('should refuse fragment.jwt with a plain query error (JARM §2.3.2)', async () => {
+    const response = await new Browser().request(
+      authorize.GET,
+      authorizeUrl(authorizationRequest({ response_mode: 'fragment.jwt' })),
+    );
+    const location = new URL(locationOf(response));
+
+    expect(Object.fromEntries(location.searchParams)).toEqual({
+      error: 'invalid_request',
+      error_description: 'response_mode fragment.jwt is not supported',
+      state: 'conformance-state',
+      iss: ISSUER,
+    });
+  });
+});
+`;
+}
+function tokenExchangeSection() {
+    return `describe('Token Exchange (RFC 8693)', () => {
+  const TOKEN_EXCHANGE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+  const ACCESS_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token';
+
+  it('should exchange an access token for one of narrower scope (RFC 8693 §2.2)', async () => {
+    const tokens = await issueTokens();
+    const response = await tokenRequest({
+      grant_type: TOKEN_EXCHANGE,
+      subject_token: tokens.access_token,
+      subject_token_type: ACCESS_TOKEN_TYPE,
+      scope: 'openid',
+    });
+    const body = (await response.json()) as TokenResponse & { issued_token_type: string };
+
+    expect(response.status).toBe(200);
+    expect(body).toMatchObject({ issued_token_type: ACCESS_TOKEN_TYPE, token_type: 'Bearer', scope: 'openid' });
+    expect(decodeJwt(body.access_token).payload).toMatchObject({ sub: 'testuser', scope: 'openid' });
+  });
+
+  it('should reject a subject_token this OP did not issue (RFC 8693 §2.2.2)', async () => {
+    const response = await tokenRequest({
+      grant_type: TOKEN_EXCHANGE,
+      subject_token: 'unknown-token',
+      subject_token_type: ACCESS_TOKEN_TYPE,
+    });
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_request');
+  });
+});
+`;
+}
+function idJagSection() {
+    return `describe('Identity Assertion JWT Authorization Grant (ID-JAG)', () => {
+  const TOKEN_EXCHANGE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+  const ID_JAG_TYPE = 'urn:ietf:params:oauth:token-type:id-jag';
+  const ID_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id_token';
+  const RESOURCE_AS = 'https://as.example.net';
+
+  afterEach(() => {
+    idJagConfig.allowedAudiences = [];
+  });
+
+  function requestIdJag(idToken: string): Promise<Response> {
+    return tokenRequest({
+      grant_type: TOKEN_EXCHANGE,
+      requested_token_type: ID_JAG_TYPE,
+      subject_token: idToken,
+      subject_token_type: ID_TOKEN_TYPE,
+      audience: RESOURCE_AS,
+    });
+  }
+
+  it('should issue a signed ID-JAG for an allowed resource authorization server (draft §4.3)', async () => {
+    idJagConfig.allowedAudiences = [RESOURCE_AS];
+    const tokens = await issueTokens();
+    const response = await requestIdJag(tokens.id_token);
+    const body = (await response.json()) as { access_token: string; issued_token_type: string; token_type: string };
+
+    expect(response.status).toBe(200);
+    expect(body).toMatchObject({ issued_token_type: ID_JAG_TYPE, token_type: 'N_A' });
+    expect(decodeJwt(body.access_token).header.typ).toBe('oauth-id-jag+jwt');
+    expect(decodeJwt(body.access_token).payload).toMatchObject({
+      iss: ISSUER,
+      sub: 'testuser',
+      aud: RESOURCE_AS,
+      client_id: 'conformance-client',
+    });
+    expect(await verifiesWithPublishedKey(body.access_token)).toBe(true);
+  });
+
+  it('should refuse an audience that is not allowed', async () => {
+    const tokens = await issueTokens();
+    const response = await requestIdJag(tokens.id_token);
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_target');
+  });
+
+  it('should refuse to redeem an ID-JAG at the identity provider that issued it (draft §9.3)', async () => {
+    idJagConfig.allowedAudiences = [RESOURCE_AS];
+    const tokens = await issueTokens();
+    const issued = (await (await requestIdJag(tokens.id_token)).json()) as { access_token: string };
+    const response = await tokenRequest({
+      grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+      assertion: issued.access_token,
+    });
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_grant');
+  });
+
+  it('should advertise the identity chaining metadata', async () => {
+    const response = await new Browser().request(discovery.GET, '/.well-known/openid-configuration');
+
+    expect(await response.json()).toMatchObject({
+      identity_chaining_requested_token_types_supported: [ID_JAG_TYPE],
+      authorization_grant_profiles_supported: ['urn:ietf:params:oauth:grant-profile:id-jag'],
+    });
+  });
+});
+`;
+}
+function deviceAuthorizationSection() {
+    return `describe('Device Authorization Grant (RFC 8628)', () => {
+  const DEVICE_CODE = 'urn:ietf:params:oauth:grant-type:device_code';
+
+  interface DeviceAuthorizationResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+  }
+
+  async function startDeviceAuthorization(): Promise<DeviceAuthorizationResponse> {
+    const response = await new Browser().post(deviceAuthorization.POST, '/device_authorization', {
+      client_id: 'conformance-client',
+      client_secret: 'conformance-secret',
+      scope: 'openid profile',
+    });
+    return (await response.json()) as DeviceAuthorizationResponse;
+  }
+
+  function poll(deviceCode: string, clientId = 'conformance-client', clientSecret = 'conformance-secret'): Promise<Response> {
+    return new Browser().post(token.POST, '/token', {
+      grant_type: DEVICE_CODE,
+      device_code: deviceCode,
+      client_id: clientId,
+      client_secret: clientSecret,
+    });
+  }
+
+  /** The verification steps on the second device; resolves to the final screen. */
+  async function approveOnSecondDevice(browser: Browser, userCode: string): Promise<Response> {
+    const loginScreen = await (await browser.post(device.POST, '/device', { user_code: userCode })).text();
+    const approvalScreen = await (
+      await browser.post(deviceLogin.POST, '/device/login', {
+        user_code: userCode,
+        csrf_token: csrfTokenOf(loginScreen),
+        username: 'testuser',
+        password: 'password',
+      })
+    ).text();
+    return browser.post(deviceApprove.POST, '/device/approve', {
+      user_code: userCode,
+      csrf_token: csrfTokenOf(approvalScreen),
+      decision: 'approve',
+    });
+  }
+
+  it('should answer the device authorization request (RFC 8628 §3.2)', async () => {
+    const body = await startDeviceAuthorization();
+
+    expect(body).toMatchObject({
+      verification_uri: ISSUER + '/device',
+      expires_in: 600,
+      interval: 5,
+    });
+    expect(body.user_code).toMatch(/^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$/);
+    expect(body.verification_uri_complete).toBe(ISSUER + '/device?user_code=' + encodeURIComponent(body.user_code));
+  });
+
+  it('should answer authorization_pending until the user decides (RFC 8628 §3.5)', async () => {
+    const response = await poll((await startDeviceAuthorization()).device_code);
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('authorization_pending');
+  });
+
+  it('should issue tokens after the user approves on a second device', async () => {
+    const { device_code: deviceCode, user_code: userCode } = await startDeviceAuthorization();
+    const completed = await approveOnSecondDevice(new Browser(), userCode);
+    const response = await poll(deviceCode);
+    const tokens = (await response.json()) as TokenResponse;
+
+    expect(completed.status).toBe(200);
+    expect(response.status).toBe(200);
+    expect(tokens).toMatchObject({ token_type: 'Bearer', scope: 'openid profile' });
+    expect(decodeJwt(tokens.id_token).payload).toMatchObject({ sub: 'testuser', aud: 'conformance-client' });
+  });
+
+  it('should refuse the sign-in step without the browser binding cookie (RFC 8628 §5.4)', async () => {
+    const { user_code: userCode } = await startDeviceAuthorization();
+    const loginScreen = await (await new Browser().post(device.POST, '/device', { user_code: userCode })).text();
+    const response = await new Browser().post(deviceLogin.POST, '/device/login', {
+      user_code: userCode,
+      csrf_token: csrfTokenOf(loginScreen),
+      username: 'testuser',
+      password: 'password',
+    });
+
+    expect(response.status).toBe(403);
+  });
+
+  it('should refuse a device_code presented by another client (RFC 8628 §3.4)', async () => {
+    const { device_code: deviceCode, user_code: userCode } = await startDeviceAuthorization();
+    await approveOnSecondDevice(new Browser(), userCode);
+    const response = await poll(deviceCode, 'conformance-device-client', 'conformance-device-secret');
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_grant');
+  });
+});
+`;
+}
+function cibaSection() {
+    return `describe('CIBA (CIBA Core 1.0, poll mode)', () => {
+  const CIBA = 'urn:openid:params:grant-type:ciba';
+
+  async function requestAuthentication(loginHint = 'testuser'): Promise<Response> {
+    return new Browser().post(backchannelAuthentication.POST, '/backchannel_authentication', {
+      client_id: 'conformance-client',
+      client_secret: 'conformance-secret',
+      scope: 'openid profile',
+      login_hint: loginHint,
+    });
+  }
+
+  async function authReqId(): Promise<string> {
+    return ((await (await requestAuthentication()).json()) as { auth_req_id: string }).auth_req_id;
+  }
+
+  function poll(id: string, clientId = 'conformance-client', clientSecret = 'conformance-secret'): Promise<Response> {
+    return new Browser().post(token.POST, '/token', {
+      grant_type: CIBA,
+      auth_req_id: id,
+      client_id: clientId,
+      client_secret: clientSecret,
+    });
+  }
+
+  /** The user signs in at /ciba and approves the request id; resolves to the final screen. */
+  async function approveOnOwnBrowser(browser: Browser, id: string): Promise<Response> {
+    const loginScreen = await (await browser.request(ciba.GET, '/ciba')).text();
+    const pendingRequests = await (
+      await browser.post(cibaLogin.POST, '/ciba/login', {
+        login_transaction_id: loginScreen.match(/name="login_transaction_id" value="([^"]+)"/)?.[1] ?? '',
+        csrf_token: csrfTokenOf(loginScreen),
+        username: 'testuser',
+        password: 'password',
+      })
+    ).text();
+    // Every pending request of the user is listed, each in its own form.
+    const form =
+      pendingRequests.split('<form').find((html) => html.includes('name="auth_req_id" value="' + id + '"')) ?? '';
+    return browser.post(cibaApprove.POST, '/ciba/approve', {
+      auth_req_id: id,
+      csrf_token: csrfTokenOf(form),
+      decision: 'approve',
+    });
+  }
+
+  it('should accept a request for a known user (CIBA Core 1.0 §7.3)', async () => {
+    const response = await requestAuthentication();
+    const body = (await response.json()) as { auth_req_id: string; expires_in: number; interval: number };
+
+    expect(response.status).toBe(200);
+    expect(body).toMatchObject({ expires_in: 120, interval: 5 });
+    expect(body.auth_req_id).toMatch(/^[A-Za-z0-9_-]+$/);
+  });
+
+  it('should reject a login_hint that names no user (CIBA Core 1.0 §13)', async () => {
+    const response = await requestAuthentication('nobody');
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('unknown_user_id');
+  });
+
+  it('should answer authorization_pending until the user decides (CIBA Core 1.0 §11)', async () => {
+    const response = await poll(await authReqId());
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('authorization_pending');
+  });
+
+  it('should issue tokens after the user approves on their own browser', async () => {
+    const id = await authReqId();
+    const completed = await approveOnOwnBrowser(new Browser(), id);
+    const response = await poll(id);
+    const tokens = (await response.json()) as TokenResponse;
+
+    expect(completed.status).toBe(200);
+    expect(response.status).toBe(200);
+    expect(decodeJwt(tokens.id_token).payload).toMatchObject({ sub: 'testuser', aud: 'conformance-client' });
+  });
+
+  it('should refuse the sign-in form without the browser binding cookie', async () => {
+    const loginScreen = await (await new Browser().request(ciba.GET, '/ciba')).text();
+    const response = await new Browser().post(cibaLogin.POST, '/ciba/login', {
+      login_transaction_id: loginScreen.match(/name="login_transaction_id" value="([^"]+)"/)?.[1] ?? '',
+      csrf_token: csrfTokenOf(loginScreen),
+      username: 'testuser',
+      password: 'password',
+    });
+
+    expect(response.status).toBe(403);
+  });
+
+  it('should refuse an auth_req_id presented by another client (CIBA Core 1.0 §11)', async () => {
+    const response = await poll(await authReqId(), 'conformance-ciba-client', 'conformance-ciba-secret');
+
+    expect(response.status).toBe(400);
+    expect(((await response.json()) as { error: string }).error).toBe('invalid_grant');
+  });
+});
+`;
+}
+function jwtIntrospectionResponseSection() {
+    return `describe('JWT Response for Token Introspection (RFC 9701)', () => {
+  it('should answer the issuing client with a signed introspection JWT (RFC 9701 §5)', async () => {
+    const tokens = await issueTokens();
+    const response = await new Browser().post(
+      introspect.POST,
+      '/introspect',
+      { token: tokens.access_token, client_id: 'conformance-client', client_secret: 'conformance-secret' },
+      { Accept: 'application/token-introspection+jwt' },
+    );
+    const jwt = await response.text();
+
+    expect(response.headers.get('Content-Type')).toBe('application/token-introspection+jwt');
+    expect(decodeJwt(jwt).header.typ).toBe('token-introspection+jwt');
+    expect(decodeJwt(jwt).payload).toMatchObject({
+      iss: ISSUER,
+      aud: 'conformance-client',
+      token_introspection: { active: true, sub: 'testuser', client_id: 'conformance-client' },
+    });
+    expect(await verifiesWithPublishedKey(jwt)).toBe(true);
+  });
+
+  it('should disclose nothing about the token to a caller that is not its audience (RFC 9701 §5)', async () => {
+    const tokens = await issueTokens();
+    const response = await new Browser().post(
+      introspect.POST,
+      '/introspect',
+      { token: tokens.access_token },
+      {
+        Accept: 'application/token-introspection+jwt',
+        Authorization: basicAuthorization('conformance-basic-client', 'conformance-basic-secret'),
+      },
+    );
+    const jwt = await response.text();
+
+    expect(decodeJwt(jwt).payload).toMatchObject({ aud: 'conformance-basic-client' });
+    expect(decodeJwt(jwt).payload.token_introspection).toEqual({ active: false });
+  });
+
+  it('should not answer an unauthenticated request with a signed response (RFC 9701 §5)', async () => {
+    const tokens = await issueTokens();
+    const response = await new Browser().post(
+      introspect.POST,
+      '/introspect',
+      { token: tokens.access_token },
+      { Accept: 'application/token-introspection+jwt' },
+    );
+
+    expect(response.status).toBe(401);
+    expect(response.headers.get('Content-Type')).toBe('application/json');
+  });
+
+  it('should advertise the introspection signing algorithm', async () => {
+    const response = await new Browser().request(discovery.GET, '/.well-known/openid-configuration');
+
+    expect(((await response.json()) as Record<string, unknown>).introspection_signing_alg_values_supported).toEqual([
+      'RS256',
+    ]);
+  });
+});
+`;
+}
+function rpInitiatedLogoutSection() {
+    return `describe('RP-Initiated Logout 1.0', () => {
+  const POST_LOGOUT_REDIRECT_URI = 'https://rp.example.com/logged-out';
+
+  afterEach(() => {
+    rpInitiatedLogoutConfig.postLogoutRedirectUris = {};
+  });
+
+  it('should end the session and return to the registered URI for a valid id_token_hint (§2 / §3)', async () => {
+    rpInitiatedLogoutConfig.postLogoutRedirectUris = { 'conformance-client': [POST_LOGOUT_REDIRECT_URI] };
+    const browser = new Browser();
+    const tokens = await issueTokens(browser);
+    const response = await browser.request(
+      logout.GET,
+      '/logout?' +
+        new URLSearchParams({
+          id_token_hint: tokens.id_token,
+          post_logout_redirect_uri: POST_LOGOUT_REDIRECT_URI,
+          state: 'logout-state',
+        }).toString(),
+    );
+    const silent = await browser.request(authorize.GET, authorizeUrl(authorizationRequest({ prompt: 'none' })));
+
+    expect(response.status).toBe(302);
+    expect(locationOf(response)).toBe(POST_LOGOUT_REDIRECT_URI + '?state=logout-state');
+    expect(browser.cookies.has('session_id')).toBe(false);
+    expect(new URL(locationOf(silent)).searchParams.get('error')).toBe('login_required');
+  });
+
+  it('should ask for confirmation when no id_token_hint is presented (§2)', async () => {
+    const browser = new Browser();
+    await signIn(browser);
+    const confirmation = await browser.request(logout.GET, '/logout');
+    const response = await browser.post(logoutApprove.POST, '/logout/approve', {
+      csrf_token: csrfTokenOf(await confirmation.text()),
+    });
+
+    expect(confirmation.status).toBe(200);
+    expect(response.status).toBe(200);
+    expect(browser.cookies.has('session_id')).toBe(false);
+  });
+
+  it('should accept the logout request as a form POST (§2)', async () => {
+    rpInitiatedLogoutConfig.postLogoutRedirectUris = { 'conformance-client': [POST_LOGOUT_REDIRECT_URI] };
+    const browser = new Browser();
+    const tokens = await issueTokens(browser);
+    const response = await browser.post(logout.POST, '/logout', {
+      id_token_hint: tokens.id_token,
+      post_logout_redirect_uri: POST_LOGOUT_REDIRECT_URI,
+      state: 'logout-state',
+    });
+
+    expect(response.status).toBe(302);
+    expect(locationOf(response)).toBe(POST_LOGOUT_REDIRECT_URI + '?state=logout-state');
+  });
+
+  it('should not redirect to a post_logout_redirect_uri that is not registered (§3)', async () => {
+    const browser = new Browser();
+    const tokens = await issueTokens(browser);
+    const response = await browser.request(
+      logout.GET,
+      '/logout?' +
+        new URLSearchParams({
+          id_token_hint: tokens.id_token,
+          post_logout_redirect_uri: 'https://attacker.example/logged-out',
+        }).toString(),
+    );
+
+    expect(response.status).toBe(200);
+    expect(response.headers.get('Location')).toBe(null);
+    expect(browser.cookies.has('session_id')).toBe(false);
+  });
+
+  it('should refuse an approval from a browser without the confirmation cookie', async () => {
+    const browser = new Browser();
+    await signIn(browser);
+    const confirmation = await (await browser.request(logout.GET, '/logout')).text();
+    const response = await new Browser().post(logoutApprove.POST, '/logout/approve', {
+      csrf_token: csrfTokenOf(confirmation),
+    });
+
+    expect(response.status).toBe(400);
+    expect(browser.cookies.has('session_id')).toBe(true);
+  });
+
+  it('should refuse a confirmation without the matching csrf_token', async () => {
+    const browser = new Browser();
+    await signIn(browser);
+    await browser.request(logout.GET, '/logout');
+    const response = await browser.post(logoutApprove.POST, '/logout/approve', { csrf_token: 'forged' });
+
+    expect(response.status).toBe(400);
+    expect(browser.cookies.has('session_id')).toBe(true);
+  });
+});
+`;
+}
+function googleLoginSection() {
+    return `describe('Sign in with Google (redirect mode)', () => {
+  const GOOGLE_CLIENT_ID = 'conformance.apps.googleusercontent.com';
+  const configuredGoogleLogin = config.googleLogin;
+
+  afterEach(() => {
+    config.googleLogin = configuredGoogleLogin;
+  });
+
+  /** Start a transaction and render its login page, which issues the nonce. */
+  async function loginPage(browser: Browser): Promise<{ transactionId: string; html: string }> {
+    const transactionId = await startAuthorization(browser);
+    return { transactionId, html: await browser.render(LoginPage, { transaction_id: transactionId }) };
+  }
+
+  /** The ID token payload Google would assert for this login page's nonce. */
+  function googleIdToken(loginPageHtml: string, claims: Record<string, unknown> = {}): string {
+    const now = Math.floor(Date.now() / 1000);
+    return JSON.stringify({
+      iss: 'https://accounts.google.com',
+      aud: GOOGLE_CLIENT_ID,
+      sub: '1234567890',
+      email: 'conformance@example.com',
+      email_verified: true,
+      nonce: loginPageHtml.match(/data-nonce="([^"]+)"/)?.[1] ?? '',
+      iat: now,
+      exp: now + 300,
+      ...claims,
+    });
+  }
+
+  /**
+   * POST the callback the way Google Identity Services does: it sets the
+   * g_csrf_token cookie and posts the same value (double-submit).
+   */
+  function postCallback(browser: Browser, credential: string, postedCsrfToken = 'double-submit'): Promise<Response> {
+    browser.cookies.set('g_csrf_token', 'double-submit');
+    return browser.post(googleLogin.POST, '/login/google', { credential, g_csrf_token: postedCsrfToken });
+  }
+
+  it('should render the Google button with the login_uri of this OP', async () => {
+    const { html } = await loginPage(new Browser());
+
+    expect(html).toContain('data-login_uri="' + ISSUER + '/login/google"');
+    expect(html).toContain('data-client_id="' + GOOGLE_CLIENT_ID + '"');
+  });
+
+  it('should sign in with the Google account and continue to consent', async () => {
+    const browser = new Browser();
+    const { transactionId, html } = await loginPage(browser);
+    const response = await postCallback(browser, googleIdToken(html));
+    const callback = new URL(await decide(browser, transactionId, 'approve'));
+    const tokens = (await (await exchangeCode(callback.searchParams.get('code') ?? '')).json()) as TokenResponse;
+
+    expect(response.status).toBe(302);
+    expect(locationOf(response)).toBe(ISSUER + '/consent?transaction_id=' + transactionId);
+    expect(decodeJwt(tokens.id_token).payload.sub).toBe('google:1234567890');
+  });
+
+  it('should send a callback without the double-submit cookie to the OP error page', async () => {
+    const browser = new Browser();
+    const { html } = await loginPage(browser);
+    const response = await browser.post(googleLogin.POST, '/login/google', {
+      credential: googleIdToken(html),
+      g_csrf_token: 'double-submit',
+    });
+
+    expect(response.status).toBe(303);
+    expect(locationOf(response)).toBe(
+      ISSUER + '/oidc-error?error=csrf_token_missing_in_cookie&error_description=No+CSRF+token+in+Cookie.',
+    );
+    expect(browser.cookies.has('session_id')).toBe(false);
+  });
+
+  it('should send a g_csrf_token that does not match its cookie to the OP error page', async () => {
+    const browser = new Browser();
+    const { html } = await loginPage(browser);
+    const response = await postCallback(browser, googleIdToken(html), 'forged');
+
+    expect(response.status).toBe(303);
+    expect(locationOf(response)).toBe(
+      ISSUER + '/oidc-error?error=csrf_token_mismatch&error_description=Failed+to+verify+double+submit+cookie.',
+    );
+    expect(browser.cookies.has('session_id')).toBe(false);
+  });
+
+  it('should send a replayed ID token, whose nonce is single use, to the OP error page', async () => {
+    const browser = new Browser();
+    const { html } = await loginPage(browser);
+    const credential = googleIdToken(html);
+    await postCallback(browser, credential);
+    const replay = await postCallback(new Browser(), credential);
+
+    expect(replay.status).toBe(303);
+    expect(locationOf(replay)).toBe(
+      ISSUER +
+        '/oidc-error?error=login_nonce_not_found&error_description=' +
+        'Google+login+attempt+not+found.+The+login+page+may+have+expired+or+the+credential+was+already+used.',
+    );
+  });
+
+  it('should send an account outside the configured hosted domain to the OP error page', async () => {
+    config.googleLogin = { clientId: GOOGLE_CLIENT_ID, hostedDomain: 'example.com' };
+    const browser = new Browser();
+    const { html } = await loginPage(browser);
+    const response = await postCallback(browser, googleIdToken(html, { hd: 'other.example' }));
+
+    expect(response.status).toBe(303);
+    expect(locationOf(response)).toBe(
+      ISSUER +
+        '/oidc-error?error=invalid_hosted_domain&error_description=' +
+        'ID+token+hd+does+not+match+the+allowed+hosted+domain',
+    );
+    expect(browser.cookies.has('session_id')).toBe(false);
+  });
+
+  it('should send a callback whose transaction has expired to the OP error page', async () => {
+    const browser = new Browser();
+    const { transactionId, html } = await loginPage(browser);
+    await stores.transactionStore.delete('auth_txn:' + transactionId);
+    const response = await postCallback(browser, googleIdToken(html));
+
+    expect(response.status).toBe(303);
+    expect(locationOf(response)).toBe(
+      ISSUER +
+        '/oidc-error?error=transaction_not_found&error_description=' +
+        'Auth+transaction+not+found.+The+session+may+have+expired.',
+    );
+    expect(browser.cookies.has('session_id')).toBe(false);
+  });
+
+  it('should answer 404 while Google login is not configured', async () => {
+    config.googleLogin = undefined;
+    const response = await postCallback(new Browser(), '{}');
+
+    expect(response.status).toBe(404);
+  });
+});
+`;
+}
+//# sourceMappingURL=conformance.js.map