@o3co/create-auth-provider 0.11.0 → 0.12.0

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -142,6 +142,12 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT: "3",
 	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis:6379",
 	REFRESH_TOKEN_FAMILY_STORE_REDIS_PASSWORD: "rt-family-password",
+	// #456: the federation token store's Redis branch, which the README
+	// documented and which could not boot.
+	FEDERATION_TOKEN_STORE_TYPE: "redis",
+	REDIS_FEDERATION_TOKEN_STORE_KEY_PREFIX: "ft:",
+	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE: "required",
+	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=",
 
 	// --- federation ---------------------------------------------------
 	FEDERATIONS_GOOGLE_ENABLED: "true",
@@ -166,6 +172,12 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 
 	// --- endpoints ----------------------------------------------------
 	ENDPOINTS_LOGIN_URL: "/login",
+
+	// --- cors ---------------------------------------------------------
+	// #500: a list, in the only shape an environment variable can carry one.
+	// The schema splits and validates it; the `turns every non-boolean
+	// override into its declared type` case below pins the result.
+	CORS_ALLOWED_ORIGINS: "https://app.example.com,http://localhost:5173",
 };
 
 /**
@@ -184,6 +196,14 @@ const DELIBERATELY_UNSET: Readonly<Record<string, string>> = {
  * so a parse failure here is a red umbrella build that this repository can see
  * first. `SESSION_SECURE=false` is the one it cannot run without: the suite
  * speaks plain HTTP.
+ *
+ * The two `FEDERATION_TOKEN_STORE` lines are what #455 / #456 **require the
+ * umbrella compose to add**: the federation token store defaults to memory,
+ * and the standalone's memory module now declares itself replica-unsafe, so
+ * the umbrella's `DEPLOYMENT_MODE=multi` refuses it by name until the compose
+ * selects the Redis store and supplies its encryption key. Until that lands
+ * in `o3co/auth`, this transcription is ahead of the file it transcribes on
+ * exactly those two lines.
  */
 const UMBRELLA_E2E_ENV: Readonly<Record<string, string>> = {
 	OAUTH_JWT_ALGORITHM: "HS256",
@@ -198,6 +218,8 @@ const UMBRELLA_E2E_ENV: Readonly<Record<string, string>> = {
 	USER_SESSION_STORES_ADAPTER: "redis",
 	RATE_LIMITER_ADAPTER: "redis",
 	OAUTH_CODE_ADAPTER: "redis",
+	FEDERATION_TOKEN_STORE_TYPE: "redis",
+	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=",
 	CLIENT_USER_TYPE: "yaml",
 	OAUTH_RESOURCE_INDICATOR_ENABLED: "true",
 	OAUTH_REQUIRE_EMAIL_VERIFIED: "true",
@@ -278,6 +300,45 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.session.maxAge).toBe(3600000);
 		expect(config.session.csrf?.ttlSeconds).toBe(7200);
 		expect(config.oauth.nonce?.maxLength).toBe(256);
+		// #500: a comma-separated string becomes a list of origins, trimmed.
+		expect(config.cors?.allowedOrigins).toEqual([
+			"https://app.example.com",
+			"http://localhost:5173",
+		]);
+	});
+
+	describe("CORS_ALLOWED_ORIGINS (#500)", () => {
+		it("reads an exported-but-empty variable as no origins, not as an error", () => {
+			// The .env / compose / ConfigMap shape. "CORS off" is what both the
+			// unset key and the empty string mean, so they must agree.
+			const config = buildResolvedConfig({ ...DOCUMENTED_ENV, CORS_ALLOWED_ORIGINS: "" });
+			expect(config.cors?.allowedOrigins).toEqual([]);
+		});
+
+		it("fails boot on an origin that could never match, naming the key", () => {
+			// Every one of these parses as a URL and is a real typo: matching is
+			// exact string equality against the Origin header, so each would be
+			// an allowlist that admits nobody with nothing to say so.
+			for (const bad of [
+				"https://app.example.com/", // trailing slash
+				"https://app.example.com:443", // explicit default port
+				"https://*.example.com", // wildcard
+				"http://app.example.com", // plaintext off loopback
+				"https://app.example.com/callback", // a URL, not an origin
+			]) {
+				expect(() => buildResolvedConfig({ ...DOCUMENTED_ENV, CORS_ALLOWED_ORIGINS: bad })).toThrow(
+					/cors\.allowedOrigins/,
+				);
+			}
+		});
+
+		it("accepts the loopback http carve-out a dev front-end needs", () => {
+			const config = buildResolvedConfig({
+				...DOCUMENTED_ENV,
+				CORS_ALLOWED_ORIGINS: "http://localhost:5173,http://127.0.0.1:5173,https://app.example.com",
+			});
+			expect(config.cors?.allowedOrigins).toHaveLength(3);
+		});
 	});
 
 	it("parses the HS256 shape, whose strict union refuses asymmetric key fields", () => {
@@ -306,10 +367,12 @@ describe("#288: the shipped config boots with every documented override supplied
 	it("wires nothing replica-unsafe for the umbrella E2E environment", async () => {
 		// `DEPLOYMENT_MODE=multi` makes the provider audit its own store wiring
 		// at boot, so a config that parses but wires a memory store still fails
-		// there. Assert against the guard's own list rather than module names.
-		const { REPLICA_UNSAFE_MODULES } = await import("@o3co/auth-provider-core");
-		for (const name of buildModules(buildResolvedConfig(UMBRELLA_E2E_ENV)).map((m) => m.name)) {
-			expect(REPLICA_UNSAFE_MODULES).not.toContain(name);
+		// there. Ask each manifest, the way the guard does (#455): the exported
+		// name list covers core's modules only, and the template's own memory
+		// modules are precisely the ones it could not see.
+		const { replicaUnsafeReason } = await import("@o3co/auth-provider-core");
+		for (const module of buildModules(buildResolvedConfig(UMBRELLA_E2E_ENV))) {
+			expect(replicaUnsafeReason(module), module.name).toBeUndefined();
 		}
 	});
 

package/templates/standalone/src/__tests__/redis-rate-limiter-config-survives.test.mts

@@ -0,0 +1,179 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * #495 / #496 — end to end, through this template's real resolution chain.
+ *
+ * `app.mts` resolves `{env}.conf → application.conf → reference.conf` and
+ * validates the result with `AppConfigSchema` before `buildModules` runs.
+ * The schema strips what it does not declare, so a section declared by a
+ * module rather than by core used to vanish at exactly that step — and,
+ * because `redisRateLimiterModule.configSchema` carries a
+ * `.default({ limit: 60, windowSeconds: 60 })`, the deployment that
+ * `docker-compose.production.yml` ships (`RATE_LIMITER_ADAPTER: redis`) then
+ * ran on 60 requests / 60 s no matter what the operator wrote.
+ *
+ * This starts from the shipped configuration, adds the two overrides an
+ * operator writes in their own `application.conf` layer, and follows them all
+ * the way to the limiter the module builds.
+ */
+
+import { fileURLToPath } from "node:url";
+import { type AppConfig, AppConfigSchema, type RateLimiter } from "@o3co/auth-provider-core";
+import { redisRateLimiterModule } from "@o3co/auth-provider-redis";
+import { parseFile, parseString } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+import { describe, expect, it } from "vitest";
+import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+/**
+ * The secrets `application.conf` substitutes, plus the one
+ * `docker-compose.production.yml` sets to put the OAuth endpoints behind a
+ * shared limiter. Test-only values; #282's entropy floor applies to the two
+ * secrets, and the `.` characters keep them out of the base64 alphabet so the
+ * UTF-8 length is what counts.
+ */
+const ENV = {
+	OAUTH_JWT_SECRET: "test-secret-rate-limiter-e2e.at-least-32-bytes.ok",
+	OAUTH_JWT_ISSUER: "https://auth.test",
+	SESSION_SECRET: "test-session-secret-rate-limiter-e2e.at-least-32-bytes.ok",
+	RATE_LIMITER_ADAPTER: "redis",
+};
+
+/**
+ * What an operator adds to their own `application.conf` layer: per-endpoint
+ * budgets for the Redis limiter, and the mTLS posture from
+ * `@o3co/auth-provider-mtls`. Neither section appears in anything this
+ * template ships, which is why neither was ever covered by a `.conf` diff.
+ */
+const OPERATOR_OVERRIDES = `
+redisRateLimiter {
+  limits {
+    token { limit = 120, windowSeconds = 60 }
+    authorize { limit = 30, windowSeconds = 60 }
+  }
+}
+
+oauth.mtls {
+  enabled = true
+  mode = "full-pki"
+  trusted-cas = ["-----BEGIN CERTIFICATE-----"]
+  full-pki {
+    revocation {
+      mode = "crl"
+      on-unavailable = "reject"
+      allowed-hosts = ["crl.example.com"]
+    }
+  }
+}
+`;
+
+function resolveShippedConfig(): AppConfig {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
+	return validate(
+		parseString(OPERATOR_OVERRIDES, { env: ENV })
+			.withFallback(parseFile(envConfPath, { env: ENV }))
+			.withFallback(parseFile(applicationConfPath, { env: ENV }))
+			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: ENV })),
+		AppConfigSchema,
+	);
+}
+
+/** Counts one request per key, the way an untouched Redis counter would. */
+function makeCountingClient(): { incrementWithTtl: (key: string, ttl: number) => Promise<number> } {
+	return { incrementWithTtl: async () => 1 };
+}
+
+function buildLimiter(config: AppConfig): RateLimiter {
+	const provides = (
+		redisRateLimiterModule as unknown as {
+			provides: Record<string, (deps: Record<string, unknown>) => RateLimiter>;
+		}
+	).provides;
+	const provider = provides.rateLimiter;
+	if (!provider) throw new Error("redisRateLimiterModule no longer provides rateLimiter");
+	return provider({ config, rateLimiterClient: makeCountingClient() });
+}
+
+describe("the shipped configuration reaches the Redis rate limiter (#495)", () => {
+	const config = resolveShippedConfig();
+
+	it("selects the Redis adapter the production compose file pins", () => {
+		expect(config.rateLimiter?.adapter).toBe("redis");
+	});
+
+	it("carries the operator's per-endpoint budgets through the pre-parse", () => {
+		expect(config.redisRateLimiter?.limits).toEqual({
+			token: { limit: 120, windowSeconds: 60 },
+			authorize: { limit: 30, windowSeconds: 60 },
+		});
+	});
+
+	it("applies the declared budget at /token", async () => {
+		const decision = await buildLimiter(config).check("token:ip:203.0.113.5", {
+			ip: "203.0.113.5",
+		});
+		expect(decision.limit).toBe(120);
+	});
+
+	it("applies the declared budget at /authorize", async () => {
+		const decision = await buildLimiter(config).check("authorize:ip:203.0.113.5", {
+			ip: "203.0.113.5",
+		});
+		expect(decision.limit).toBe(30);
+	});
+
+	it("still falls back to the module's default where nothing is declared", async () => {
+		// The point of the assertion above: 60 is what EVERY endpoint got while
+		// the section was stripped, so a test that only saw 60 could not tell a
+		// working configuration from a lost one.
+		const decision = await buildLimiter(config).check("introspect:ip:203.0.113.5", {
+			ip: "203.0.113.5",
+		});
+		expect(decision.limit).toBe(60);
+	});
+
+	it("keeps seeding /session/login from rateLimit.login", async () => {
+		// `resolveSeededLimitSpecs` reads a declared section, so this worked
+		// even while `redisRateLimiter` was being stripped — which is why the
+		// defect showed up only at the endpoints below it.
+		const decision = await buildLimiter(config).check("login:ip:203.0.113.5", {
+			ip: "203.0.113.5",
+		});
+		expect(decision.limit).toBe(config.rateLimit?.login.limit);
+	});
+});
+
+describe("the shipped configuration carries an mTLS posture through (#496)", () => {
+	const config = resolveShippedConfig();
+
+	it("keeps the operator's mTLS block instead of reporting mTLS off", () => {
+		expect(config.oauth.mtls).toEqual({
+			enabled: true,
+			mode: "full-pki",
+			"trusted-cas": ["-----BEGIN CERTIFICATE-----"],
+			"full-pki": {
+				revocation: {
+					mode: "crl",
+					"on-unavailable": "reject",
+					"allowed-hosts": ["crl.example.com"],
+				},
+			},
+		});
+	});
+});