@o3co/create-auth-policy-verifier 0.3.1

package/templates/standalone/docker-compose.test.yml

@@ -0,0 +1,5 @@
+services:
+  test:
+    build:
+      context: .
+      target: test

package/templates/standalone/docker-compose.yml

@@ -0,0 +1,13 @@
+services:
+  app:
+    build:
+      context: .
+      target: develop
+    ports:
+      - "3000:3000"
+    volumes:
+      - ./src:/home/node/src
+      - ./config:/home/node/config
+    env_file:
+      - path: .env
+        required: false

package/templates/standalone/package.json

@@ -0,0 +1,34 @@
+{
+	"name": "@o3co/auth-policy-verifier-standalone",
+	"version": "0.0.0",
+	"private": true,
+	"license": "Apache-2.0",
+	"packageManager": "pnpm@10.29.3",
+	"type": "module",
+	"engines": {
+		"node": ">=22.0.0"
+	},
+	"scripts": {
+		"build": "tsc",
+		"start": "node dist/main.mjs",
+		"test": "vitest run",
+		"debug": "NODE_OPTIONS='--conditions=development' tsx watch src/main.mts"
+	},
+	"dependencies": {
+		"@o3co/auth.policy-verifier.core": "workspace:*",
+		"@o3co/auth.policy-verifier.builtins": "workspace:*",
+		"@o3co/auth.policy-verifier.server": "workspace:*",
+		"@o3co/auth.utils": "^0.0.2",
+		"@o3co/ts.hocon": "^1.1.0",
+		"express": "^5.2.1"
+	},
+	"devDependencies": {
+		"@types/node": "^25.1.0",
+		"@types/supertest": "^7.2.0",
+		"jose": "^6.2.2",
+		"supertest": "^7.2.2",
+		"tsx": "^4.21.0",
+		"typescript": "^5.9.3",
+		"vitest": "^4.1.2"
+	}
+}

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -0,0 +1,103 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+/*
+ * Smoke tests for the standalone template.
+ *
+ * These tests verify that the app created by the standalone template boots correctly
+ * and that core HTTP endpoints respond as expected.
+ *
+ * The composition here intentionally mirrors main.mts — using builtinCollectorsModule
+ * and registry keys that match application.conf — so that renames or interface changes
+ * in the builtins package are caught here before reaching production.
+ *
+ * Note: ResourceActionPermissionRuleCollector is omitted from the smoke config because
+ * it requires a permission store (e.g. StaticPermissionCollector) to grant any access.
+ * The scope-based check via ResourceActionScopeRuleCollector is sufficient to exercise
+ * the allow/deny paths in isolation.
+ */
+import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
+import {
+	AppConfigSchema,
+	builtinKeyResolversModule,
+	createApp,
+} from "@o3co/auth.policy-verifier.server";
+import { SignJWT } from "jose";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+
+const JWT_SECRET = "standalone-smoke-secret";
+const secretKey = new TextEncoder().encode(JWT_SECRET);
+
+async function signToken(payload: Record<string, unknown>): Promise<string> {
+	return new SignJWT(payload).setProtectedHeader({ alg: "HS256" }).setIssuedAt().sign(secretKey);
+}
+
+// Config mirrors the structure of application.conf, using the same builtin registry keys.
+// PayloadScopeCollector extracts scopes from the JWT "scope" claim.
+// ResourceActionScopeRuleCollector requires scope "<action>:<resourceType>" to be present.
+// DotNotationResourceParser is the default and matches the omitted resource.parser in application.conf.
+const baseConfig = AppConfigSchema.parse({
+	oauth: { jwt: { secret: JWT_SECRET, validate: true } },
+	attribute: {
+		collectors: [
+			{ collector: "PayloadScopeCollector" },
+			{ collector: "PayloadSubjectIdCollector" },
+		],
+	},
+	rule: {
+		collectors: [{ collector: "ResourceActionScopeRuleCollector" }],
+	},
+	// resource.parser defaults to "DotNotationResourceParser" — matches application.conf omission
+});
+
+describe("standalone smoke", () => {
+	it("GET /healthcheck returns 200", async () => {
+		const app = await createApp({
+			pathResolver: (s: string) => s,
+			config: baseConfig,
+			modules: [builtinCollectorsModule, builtinKeyResolversModule],
+		});
+
+		const res = await request(app).get("/healthcheck");
+		expect(res.status).toBe(200);
+	});
+
+	it("POST /verify with sufficient scope returns 200 (allow)", async () => {
+		const app = await createApp({
+			pathResolver: (s: string) => s,
+			config: baseConfig,
+			modules: [builtinCollectorsModule, builtinKeyResolversModule],
+		});
+
+		// PayloadScopeCollector extracts "read:document" from the JWT scope claim.
+		// ResourceActionScopeRuleCollector requires scope "<action>:<resourceType>".
+		// DotNotationResourceParser maps "document" → resourceType "document".
+		const token = await signToken({ scope: "read:document" });
+		const res = await request(app)
+			.post("/verify")
+			.set("Authorization", `Bearer ${token}`)
+			.send({ resource: "document", action: "read" });
+
+		expect(res.status).toBe(200);
+		expect(res.body.decision).toBe("allow");
+	});
+
+	it("POST /verify with insufficient scope returns 403 (deny)", async () => {
+		const app = await createApp({
+			pathResolver: (s: string) => s,
+			config: baseConfig,
+			modules: [builtinCollectorsModule, builtinKeyResolversModule],
+		});
+
+		// Token has "write:document" but action is "read", so HasScope("read:document") fails.
+		const token = await signToken({ scope: "write:document" });
+		const res = await request(app)
+			.post("/verify")
+			.set("Authorization", `Bearer ${token}`)
+			.send({ resource: "document", action: "read" });
+
+		expect(res.status).toBe(403);
+		expect(res.body.decision).toBe("deny");
+	});
+});

package/templates/standalone/src/main.mts

@@ -0,0 +1,35 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+/*
+ * Standalone entrypoint — creates and starts the policy-verifier server.
+ */
+import { resolve } from "node:path";
+import { builtinCollectorsModule } from "@o3co/auth.policy-verifier.builtins";
+import {
+	AppConfigSchema,
+	builtinKeyResolversModule,
+	createApp,
+} from "@o3co/auth.policy-verifier.server";
+import { createLogger, gracefulShutdown } from "@o3co/auth.utils";
+import { parseFile } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+
+const logger = createLogger("policy-verifier");
+
+const config = validate(
+	parseFile(resolve(import.meta.dirname, "../config/application.conf")),
+	AppConfigSchema,
+);
+
+const app = await createApp({
+	pathResolver: import.meta.resolve,
+	config,
+	modules: [builtinCollectorsModule, builtinKeyResolversModule],
+});
+
+const server = app.listen(config.http.port, config.http.hostname, () => {
+	logger.info(`listening on http://${config.http.hostname}:${config.http.port}`);
+});
+
+gracefulShutdown(server);

package/templates/standalone/tsconfig.json

@@ -0,0 +1,27 @@
+{
+	"compilerOptions": {
+		"target": "esnext",
+		"lib": [
+			"esnext"
+		],
+		"module": "nodenext",
+		"moduleResolution": "nodenext",
+		"declarationMap": true,
+		"declaration": true,
+		"emitDeclarationOnly": false,
+		"strict": true,
+		"forceConsistentCasingInFileNames": true,
+		"allowArbitraryExtensions": true,
+		"esModuleInterop": true,
+		"skipLibCheck": true,
+		"rootDir": "./src",
+		"outDir": "./dist"
+	},
+	"include": [
+		"src/**/*"
+	],
+	"exclude": [
+		"node_modules",
+		"dist"
+	]
+}

package/templates/standalone/vitest.config.mts

@@ -0,0 +1,10 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+	test: {
+		include: ["src/**/__tests__/**/*.test.mts"],
+	},
+});

package/templates/versions.json

@@ -0,0 +1,5 @@
+{
+	"@o3co/auth.policy-verifier.core": "0.0.0",
+	"@o3co/auth.policy-verifier.builtins": "0.0.0",
+	"@o3co/auth.policy-verifier.server": "0.0.0"
+}