@o3co/create-auth-provider 0.12.1 → 0.14.0

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -14,9 +14,14 @@
  * limitations under the License.
  */
 
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { type AppConfig, AppConfigSchema } from "@o3co/auth-provider-core";
+import {
+	type AppConfig,
+	AppConfigSchema,
+	resolveAccessTokenLifetime,
+} from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
 import { validate } from "@o3co/ts.hocon/zod";
 import { describe, expect, it } from "vitest";
@@ -82,6 +87,10 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	OAUTH_JWT_LEGACY_TYP_ACCEPT: "true",
 
 	// --- oauth tokens / policy ----------------------------------------
+	OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "900",
+	OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN: "7200",
+	// Deprecated alias of the default. Exported alongside the new variable on
+	// purpose, with a different value: the new variable must win.
 	OAUTH_ACCESS_TOKEN_EXPIRES_IN: "3600",
 	OAUTH_REFRESH_TOKEN_EXPIRES_IN: "86400",
 	OAUTH_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY: "reject",
@@ -95,6 +104,18 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	OAUTH_NONCE_MAX_LENGTH: "256",
 	OAUTH_TOKEN_EXCHANGE_MAX_ACTOR_CHAIN_DEPTH: "3",
 	OAUTH_RESOURCE_INDICATOR_ENABLED: "true",
+	OAUTH_CIMD_ENABLED: "true",
+	OAUTH_CIMD_ALLOWED_SCOPES: "read, write",
+	OAUTH_CIMD_ALLOWED_AUDIENCES: "https://mcp.example",
+	OAUTH_CIMD_ALLOWED_HOSTS: "client.example, .trusted.example",
+	OAUTH_CIMD_DENIED_HOSTS: "evil.example",
+	OAUTH_CIMD_MAX_BYTES: "8192",
+	OAUTH_CIMD_TIMEOUT_MS: "3000",
+	OAUTH_CIMD_CACHE_MAX_AGE_MS: "60000",
+	OAUTH_CIMD_MAX_CACHE_ENTRIES: "128",
+	OAUTH_CIMD_STALE_IF_ERROR_MS: "120000",
+	OAUTH_CIMD_NEGATIVE_CACHE_MS: "30000",
+	OAUTH_CIMD_MAX_CONCURRENT_FETCHES: "4",
 	OAUTH_TOKEN_BINDING_DISPATCH_POLICY: "intent-explicit",
 	OAUTH_TOKEN_BINDING_BIND_CONFIDENTIAL_CLIENT_REFRESH_TOKENS: "true",
 
@@ -136,6 +157,11 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	DEPLOYMENT_MODE: "multi",
 	USER_SESSION_STORES_ADAPTER: "redis",
 	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
+	// #484: the replay seen-set behind private_key_jwt client authentication.
+	REPLAY_SEEN_SET_ADAPTER: "redis",
+	// #561: the consent stores' shared backend and its namespace.
+	CONSENT_STORE_ADAPTER: "redis",
+	REDIS_CONSENT_STORE_KEY_PREFIX: "tenant-a:consent:",
 	REDIS_ACCESS_TOKEN_DENYLIST_KEY_PREFIX: "atdeny:",
 	REDIS_SESSION_STORES_KEY_PREFIX: "ss:",
 	REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX: "rtfam:",
@@ -154,6 +180,12 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	FEDERATIONS_GOOGLE_CLIENT_ID: "google-client-id",
 	FEDERATIONS_GOOGLE_CLIENT_SECRET: "google-client-secret",
 	FEDERATIONS_GOOGLE_CALLBACK_URL: "https://auth.test/session/oauth/federation/google/callback",
+	// #524: the generic OIDC federation the template ships disabled.
+	FEDERATIONS_OIDC_ENABLED: "true",
+	FEDERATIONS_OIDC_ISSUER: "https://idp.test",
+	FEDERATIONS_OIDC_CLIENT_ID: "oidc-client-id",
+	FEDERATIONS_OIDC_CLIENT_SECRET: "oidc-client-secret",
+	FEDERATIONS_OIDC_CALLBACK_URL: "https://auth.test/session/oauth/federation/oidc/callback",
 
 	// --- repositories -------------------------------------------------
 	CLIENT_TYPE: "yaml",
@@ -162,6 +194,7 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	CLIENT_USER_PATH: "./config/users.yaml",
 	CLIENT_USER_AUTHENTICATE_URL: "https://users.example.com/authenticate",
 	CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL: "https://users.example.com/authenticate-by-token",
+	CLIENT_USER_LINK_FEDERATED_IDENTITY_URL: "https://users.example.com/link-federated-identity",
 	CLIENT_USER_TIMEOUT: "5000",
 	CLIENT_USER_MAX_RESPONSE_BYTES: "1048576",
 	CLIENT_CODE_TYPE: "redis",
@@ -172,6 +205,7 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 
 	// --- endpoints ----------------------------------------------------
 	ENDPOINTS_LOGIN_URL: "/login",
+	ENDPOINTS_CONSENT_URL: "/consent",
 
 	// --- cors ---------------------------------------------------------
 	// #500: a list, in the only shape an environment variable can carry one.
@@ -288,6 +322,7 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.oauth.requireEmailVerified).toBe(true);
 		expect(config.oauth.resourceIndicator?.enabled).toBe(true);
 		expect(config.federations.google?.enabled).toBe(true);
+		expect(config.federations.oidc?.enabled).toBe(true);
 	});
 
 	it("turns every non-boolean override into its declared type", () => {
@@ -295,11 +330,34 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.http.port).toBe(3000);
 		expect(config.http.readinessTimeoutMs).toBe(1500);
 		expect(config.http.trustProxy).toEqual(["10.0.0.0/8", "loopback"]);
-		expect(config.oauth.accessToken.expiresIn).toBe(3600);
+		// The new default wins over the deprecated variable, and the parsed
+		// config mirrors it onto the old key for readers that predate the split.
+		expect(resolveAccessTokenLifetime(config)).toEqual({
+			defaultExpiresIn: 900,
+			maxExpiresIn: 7200,
+		});
+		expect(config.oauth.accessToken.expiresIn).toBe(900);
 		expect(config.oauth.refreshToken.expiresIn).toBe(86400);
 		expect(config.session.maxAge).toBe(3600000);
 		expect(config.session.csrf?.ttlSeconds).toBe(7200);
 		expect(config.oauth.nonce?.maxLength).toBe(256);
+		expect(config.consentStore?.adapter).toBe("redis");
+		expect(config.redisConsentStore?.keyPrefix).toBe("tenant-a:consent:");
+		// #529: the comma-separated lists become lists, trimmed; the numbers, numbers.
+		expect(config.oauth.clientIdMetadataDocuments).toEqual({
+			enabled: true,
+			allowedScopes: ["read", "write"],
+			allowedAudiences: ["https://mcp.example"],
+			allowedHosts: ["client.example", ".trusted.example"],
+			deniedHosts: ["evil.example"],
+			maxBytes: 8192,
+			timeoutMs: 3000,
+			maxCacheEntries: 128,
+			staleIfErrorMs: 120000,
+			negativeCacheMs: 30000,
+			maxConcurrentFetches: 4,
+			cacheMaxAgeMs: 60000,
+		});
 		// #500: a comma-separated string becomes a list of origins, trimmed.
 		expect(config.cors?.allowedOrigins).toEqual([
 			"https://app.example.com",
@@ -468,6 +526,26 @@ describe("#288: the shipped config boots with every documented override supplied
 			).toThrow(/allowUnmarkedClients/);
 		});
 
+		it("refuses an access-token default above the max, naming both keys", () => {
+			expect(() =>
+				buildResolvedConfig({
+					...DOCUMENTED_ENV,
+					OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "7200",
+					OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN: "3600",
+				}),
+			).toThrow(/defaultExpiresIn.*maxExpiresIn/s);
+		});
+
+		for (const name of [
+			"OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN",
+			"OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN",
+			"OAUTH_ACCESS_TOKEN_EXPIRES_IN",
+		]) {
+			it(`refuses an empty ${name} rather than minting already-expired tokens`, () => {
+				expect(() => buildResolvedConfig({ ...DOCUMENTED_ENV, [name]: "" })).toThrow();
+			});
+		}
+
 		it("still refuses an empty SESSION_CSRF_TTL_SECONDS (#272)", () => {
 			// Pinned alongside the boolean cases because it is the same trap
 			// read from the other side: for a *number*, empty means fail loudly.
@@ -477,10 +555,15 @@ describe("#288: the shipped config boots with every documented override supplied
 		});
 	});
 
-	it("resolves against the shipped standalone template, not a fixture", () => {
+	it("resolves against the shipped standalone artifact, not a fixture", () => {
 		// Guards the guard: if the paths above ever stop pointing at the real
-		// artifact these tests would pass while testing nothing.
-		expect(standaloneDir).toMatch(/templates[/\\]standalone[/\\]?$/);
+		// artifact these tests would pass while testing nothing. Checked by
+		// what the directory holds, not by what it is called: this file ships
+		// in every scaffolded project, and none of those lives at
+		// `templates/standalone` (#512).
+		for (const file of ["config/application.conf", "config/production.conf", "src/app.mts"]) {
+			expect(existsSync(join(standaloneDir, file)), file).toBe(true);
+		}
 		expect(liveSubstitutions().size).toBeGreaterThan(40);
 	});
 });

package/templates/standalone/src/__tests__/metrics.test.mts

@@ -37,6 +37,18 @@ function buildApp(probes: Parameters<ReturnType<typeof createMetrics>["route"]>[
 	return app;
 }
 
+/**
+ * Starts `app` on 127.0.0.1, the address the raw-socket tests dial. A hostless
+ * `listen(0)` binds `[::]`, and on macOS the port it gets can be one another
+ * process holds on 127.0.0.1 — the request then reaches that process and can
+ * hang until the test times out (#556).
+ */
+function listenOnLoopback(app: express.Express): Promise<ReturnType<express.Express["listen"]>> {
+	return new Promise((resolve) => {
+		const server = app.listen(0, "127.0.0.1", () => resolve(server));
+	});
+}
+
 describe("GET /metrics", () => {
 	it("serves the Prometheus text exposition format", async () => {
 		const res = await request(buildApp()).get("/metrics");
@@ -95,7 +107,7 @@ describe("GET /metrics", () => {
 		// route label, reachable without any access to /metrics. Sent over a real
 		// socket because supertest cannot express a non-standard method.
 		const app = buildApp();
-		const server = app.listen(0);
+		const server = await listenOnLoopback(app);
 		const port = (server.address() as { port: number }).port;
 		try {
 			for (const method of ["FOO", "M000001", "PURGE"]) {
@@ -135,7 +147,7 @@ describe("GET /metrics", () => {
 			void res;
 		});
 
-		const server = app.listen(0);
+		const server = await listenOnLoopback(app);
 		const port = (server.address() as { port: number }).port;
 		try {
 			const controller = new AbortController();

package/templates/standalone/src/__tests__/oidc-federation-config-module.test.mts

@@ -0,0 +1,138 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import type { AppConfig } from "@o3co/auth-provider-core";
+import { makeValidAppConfig } from "@o3co/auth-provider-core/testing";
+import { describe, expect, it } from "vitest";
+import { buildModules } from "../buildModules.mjs";
+import { oidcFederationConfigModule } from "../modules.mjs";
+
+/**
+ * #524: the scaffold turns every enabled `federations.<name>` of type
+ * `oidc` into one instance of the generic OIDC federation module, fed by a
+ * single config bridge. A deployment adds an IdP with configuration only.
+ */
+type Factory = (deps: { config: unknown }) => Record<string, unknown>;
+
+const bridge = (
+	oidcFederationConfigModule as unknown as {
+		provides: { oidcFederationConfigs: Factory };
+	}
+).provides.oidcFederationConfigs;
+
+const okta = {
+	issuer: "https://dev-1.okta.test",
+	clientId: "okta-client",
+	clientSecret: "okta-secret",
+	callbackURL: "https://auth.test/session/oauth/federation/okta/callback",
+};
+
+/** Core's valid fixture, with the federations under test and every adapter on memory. */
+const configWith = (federations: Record<string, unknown>): AppConfig => {
+	const base = makeValidAppConfig();
+	return {
+		...base,
+		federations,
+		oauth: { ...base.oauth, code: { adapter: "memory" } },
+	} as unknown as AppConfig;
+};
+
+describe("oidcFederationConfigModule (#524)", () => {
+	it("has the scaffold's module name and reads config", () => {
+		expect(oidcFederationConfigModule.name).toBe("standalone:oidc-federation-config");
+		expect(oidcFederationConfigModule.requires).toEqual(["config"]);
+	});
+
+	it("reads every enabled oidc section into the slot, keyed by federation name", () => {
+		const out = bridge({
+			config: {
+				federations: {
+					okta: { enabled: true, type: "oidc", ...okta },
+					keycloak: {
+						enabled: true,
+						type: "oidc",
+						clientUrl: "https://app.test/",
+						oidc: {
+							issuer: "https://kc.test/realms/dev",
+							clientId: "kc-client",
+							clientSecret: "kc-secret",
+							callbackURL: "https://auth.test/session/oauth/federation/keycloak/callback",
+						},
+					},
+					google: {
+						enabled: true,
+						clientId: "g",
+						clientSecret: "s",
+						callbackURL: "https://auth.test/g",
+					},
+					paused: { enabled: false, type: "oidc", ...okta },
+				},
+			},
+		});
+		expect(Object.keys(out).sort()).toEqual(["keycloak", "okta"]);
+		expect(out.okta).toEqual(okta);
+		expect(out.keycloak).toMatchObject({
+			issuer: "https://kc.test/realms/dev",
+			clientUrl: "https://app.test/",
+		});
+	});
+
+	it("refuses a malformed section at boot, naming the field", () => {
+		const { issuer: _dropped, ...noIssuer } = okta;
+		expect(() =>
+			bridge({ config: { federations: { okta: { enabled: true, type: "oidc", ...noIssuer } } } }),
+		).toThrow(/federations\.okta\.issuer/);
+	});
+
+	it("is an empty slot when no section is of type oidc", () => {
+		expect(bridge({ config: { federations: { google: { enabled: false } } } })).toEqual({});
+	});
+});
+
+describe("buildModules gating for OIDC federations (#524)", () => {
+	it("lists one federation:oidc:<name> per enabled section, plus the bridge once", () => {
+		const names = buildModules(
+			configWith({
+				okta: { enabled: true, type: "oidc", ...okta },
+				keycloak: { enabled: true, type: "oidc", ...okta },
+				google: { enabled: false },
+			}),
+		).map((m) => m.name);
+		expect(names).toContain("federation:oidc:okta");
+		expect(names).toContain("federation:oidc:keycloak");
+		expect(names.filter((n) => n === "standalone:oidc-federation-config")).toHaveLength(1);
+		expect(names).not.toContain("federation:google");
+	});
+
+	it("a google section of type oidc is the generic provider, not the built-in Google pair", () => {
+		// The section's `type` names the implementation. Composing both would
+		// contribute the same federation and redirect-policy keys twice.
+		const names = buildModules(
+			configWith({ google: { enabled: true, type: "oidc", ...okta } }),
+		).map((m) => m.name);
+		expect(names).toContain("federation:oidc:google");
+		expect(names).not.toContain("federation:google");
+		expect(names).not.toContain("standalone:google-federation-config");
+	});
+
+	it("lists nothing OIDC when no section is enabled (the shipped default)", () => {
+		const names = buildModules(
+			configWith({ google: { enabled: false }, oidc: { enabled: false, type: "oidc" } }),
+		).map((m) => m.name);
+		expect(names.some((n) => n.startsWith("federation:oidc:"))).toBe(false);
+		expect(names).not.toContain("standalone:oidc-federation-config");
+	});
+});

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -60,6 +60,7 @@ import {
 	defineModule,
 	InMemoryClientRepository,
 	InMemoryUserRepository,
+	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 	replicaUnsafeReason,
 } from "@o3co/auth-provider-core";
@@ -159,8 +160,12 @@ const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
 	RATE_LIMITER_ADAPTER: "redis",
 	OAUTH_CODE_ADAPTER: "redis",
 	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
+	REPLAY_SEEN_SET_ADAPTER: "redis",
 	FEDERATION_TOKEN_STORE_TYPE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
+	// #561: the consent step for clients that are not first-party, on the
+	// shared store — the one switch value `multi` accepts besides `none`.
+	CONSENT_STORE_ADAPTER: "redis",
 };
 
 function resolveConfig(env: Record<string, string>): AppConfig {
@@ -240,10 +245,14 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 		// #474: express-session's own store. Not a module of this template but
 		// built here from its config, which is what lets the manifest declare.
 		["SESSION_STORAGE_TYPE", "sessionStoreModule"],
+		// #527: the consent store, wired only when the switch says so.
+		["CONSENT_STORE_ADAPTER", "core-consent-store-memory"],
 		// Core's, selected by the same kind of switch. The guard knew these by
 		// name; pinned so the name table's departure (#455) did not lose them.
 		["RATE_LIMITER_ADAPTER", "core-rate-limiter-memory"],
 		["ACCESS_TOKEN_DENYLIST_ADAPTER", "core-access-token-denylist-memory"],
+		// #484: the jti single-use record behind private_key_jwt client auth.
+		["REPLAY_SEEN_SET_ADAPTER", "core-replay-seen-set-memory"],
 	];
 
 	for (const [variable, module] of cases) {
@@ -266,6 +275,8 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 			SESSION_STORAGE_TYPE: "memory",
 			RATE_LIMITER_ADAPTER: "memory",
 			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+			REPLAY_SEEN_SET_ADAPTER: "memory",
+			CONSENT_STORE_ADAPTER: "memory",
 		});
 		await expect(boot(config)).rejects.toMatchObject({
 			reason: "replica-unsafe-adapter",
@@ -390,6 +401,60 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 	});
 });
 
+describe('#561: consentStore.adapter = "redis" in the standalone', () => {
+	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
+
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	it("selects the Redis consent module, providing both slots, and not the memory one", () => {
+		const modules = modulesFor(resolveConfig(ALL_REDIS_ENV));
+		const names = modules.map((m) => m.name);
+		expect(names).toContain("redis-consent-store");
+		expect(names).not.toContain("core-consent-store-memory");
+		// Exactly one provider for each slot: the consent step refuses a
+		// composition with one and not the other, and two would collide.
+		for (const slot of ["consentStore", "pendingConsentStore"]) {
+			const providers = modules.filter((m) => Object.keys(m.provides ?? {}).includes(slot));
+			expect(
+				providers.map((m) => m.name),
+				slot,
+			).toEqual(["redis-consent-store"]);
+		}
+	});
+
+	it("pulls the shared clients module in for the consent stores alone", () => {
+		// Every other store on memory, single replica: the consent module still
+		// needs its two client slots, which only the shared clients module
+		// provides — the #439 shape otherwise.
+		const config = resolveConfig({
+			...ALL_REDIS_ENV,
+			DEPLOYMENT_MODE: "single",
+			USER_SESSION_STORES_ADAPTER: "memory",
+			OAUTH_CODE_ADAPTER: "memory",
+			RATE_LIMITER_ADAPTER: "memory",
+			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+			REPLAY_SEEN_SET_ADAPTER: "memory",
+			FEDERATION_TOKEN_STORE_TYPE: "memory",
+		});
+		const names = buildModules(config, {
+			keyStoreModule: testKeyStoreModule,
+			repositoriesModule: testRepositoriesModule,
+			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+		}).map((m) => m.name);
+		expect(names).toContain("redis-consent-store");
+		expect(names).toContain("standalone:redis-clients");
+	});
+
+	it("boots under DEPLOYMENT_MODE=multi with both slots resolved to the Redis adapters", async () => {
+		handleRef = await boot(resolveConfig(ALL_REDIS_ENV));
+		expect(handleRef.components.consentStore?.kind).toBe("redis");
+		expect(handleRef.components.pendingConsentStore?.kind).toBe("redis");
+	});
+});
+
 describe("#473: the Redis federation store's plaintext guard, booted from the shipped config", () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 	let warnSpy: ReturnType<typeof vi.spyOn>;

package/templates/standalone/src/__tests__/scaffold-assets.test.mts

@@ -244,3 +244,171 @@ describe("#407 — the two READMEs agree on security advice", () => {
 		expect(read("/README.ja.md")).not.toMatch(/HTTP_TRUST_PROXY=true/);
 	});
 });
+
+/**
+ * Issue #512 — the suite that ships with a scaffolded project has to be green
+ * in that project, not only in this workspace.
+ *
+ * A scaffold installs `@o3co/auth-provider-*` from npm, where the packages sit
+ * under `node_modules` and vitest externalizes them: Node loads them natively
+ * and their own `import "ioredis"` / `import "redis"` never meet the
+ * `vi.mock` registry. In this workspace the same packages are symlinks to
+ * source outside `node_modules`, vitest inlines them, and the mocks apply —
+ * which is how replica-safety.test.mts stayed green here while dialling
+ * `redis.test` for real in every scaffold. The second half is `make test`:
+ * it runs this suite inside the `test` image, where a file the Dockerfile
+ * never copied simply does not exist.
+ */
+describe("#512 — the shipped suite is green outside this repository", () => {
+	it("runs the published packages through vitest, so module mocks reach them", async () => {
+		// The config is loaded, not grepped: what matters is the value vitest
+		// resolves, and a `server.deps.inline` naming the wrong package would
+		// satisfy a substring check just as well.
+		const configPath = fileURLToPath(new URL("../../vitest.config.mts", import.meta.url));
+		const { default: config } = (await import(configPath)) as {
+			default: {
+				test?: { server?: { deps?: { inline?: ReadonlyArray<string | RegExp> | true } } };
+			};
+		};
+		const inline = config.test?.server?.deps?.inline;
+		expect(inline).toBeDefined();
+		if (inline === true) return;
+		for (const name of [
+			"@o3co/auth-provider-core",
+			"@o3co/auth-provider-redis",
+			"@o3co/auth-provider-session",
+		]) {
+			expect(
+				(inline ?? []).some((m) => (m instanceof RegExp ? m.test(name) : m === name)),
+				`${name} is not inlined`,
+			).toBe(true);
+		}
+	});
+
+	/**
+	 * Every file this suite reads from the project root. `config/` and `src/`
+	 * reach the image through the builder stage; these do not, so the `test`
+	 * stage has to bring them — and `.dockerignore` has to let them into the
+	 * build context first.
+	 */
+	const READ_FROM_THE_PROJECT_ROOT = [
+		"Dockerfile",
+		".dockerignore",
+		".env.example",
+		".gitignore",
+		"README.md",
+		"README.ja.md",
+		"docker-compose.yml",
+		"docker-compose.production.yml",
+	] as const;
+
+	it("reads only files the template actually ships", () => {
+		for (const file of READ_FROM_THE_PROJECT_ROOT) {
+			expect(existsSync(`${standaloneDir}${file}`), file).toBe(true);
+		}
+	});
+
+	it("copies each of them into the image the `test` target runs", () => {
+		const copied = copiedIntoStage(read("/Dockerfile"), "test");
+		for (const file of READ_FROM_THE_PROJECT_ROOT) {
+			expect(copied.has(file), `${file} is not copied into the test image`).toBe(true);
+		}
+	});
+
+	it("lets each of them through .dockerignore", () => {
+		const dockerignore = read("/.dockerignore");
+		for (const file of READ_FROM_THE_PROJECT_ROOT) {
+			expect(
+				dockerignoreExcludes(dockerignore, file),
+				`${file} is excluded from the build context`,
+			).toBe(false);
+		}
+	});
+
+	it("ships every setup file vitest.config.mts loads, into the `test` image as well (#556)", async () => {
+		// vitest refuses to start when a `setupFiles` entry is missing, so a setup
+		// file the image never copied fails the whole of `make test`, not one test.
+		const configPath = fileURLToPath(new URL("../../vitest.config.mts", import.meta.url));
+		const { default: config } = (await import(configPath)) as {
+			default: { test?: { setupFiles?: string | readonly string[] } };
+		};
+		const setupFiles = [config.test?.setupFiles ?? []].flat();
+		expect(setupFiles, "the #556 supertest loopback guard is not wired in").not.toHaveLength(0);
+
+		const copied = copiedIntoStage(read("/Dockerfile"), "test");
+		const dockerignore = read("/.dockerignore");
+		for (const entry of setupFiles) {
+			const file = entry.replace(/^\.\//, "");
+			expect(existsSync(`${standaloneDir}${file}`), `${file} does not exist`).toBe(true);
+			expect(copied.has(file), `${file} is not copied into the test image`).toBe(true);
+			expect(
+				dockerignoreExcludes(dockerignore, file),
+				`${file} is excluded from the build context`,
+			).toBe(false);
+		}
+	});
+});
+
+/**
+ * The build-context sources every `COPY` in `stage` and its ancestors brings
+ * into the image. `COPY --from=` is skipped — it reads another stage, not
+ * the context — and `--chown` / other flags are dropped. Sources are
+ * normalised to the bare entry name (`./config/` → `config`).
+ */
+function copiedIntoStage(dockerfile: string, stage: string): Set<string> {
+	const stages = new Map<string, { parent: string; sources: string[] }>();
+	let current: { parent: string; sources: string[] } | undefined;
+	// Continuation lines are joined first, so a multi-line instruction reads
+	// as one.
+	for (const line of dockerfile.replace(/\\\n/g, " ").split("\n")) {
+		const text = line.trim();
+		if (text === "" || text.startsWith("#")) continue;
+		const from = /^FROM\s+(\S+)(?:\s+AS\s+(\S+))?/i.exec(text);
+		if (from) {
+			const parent = from[1] as string;
+			current = { parent, sources: [] };
+			stages.set(from[2] ?? parent, current);
+			continue;
+		}
+		if (!current || !/^COPY\b/i.test(text)) continue;
+		const args = text.split(/\s+/).slice(1);
+		if (args.some((a) => a.startsWith("--from="))) continue;
+		const operands = args.filter((a) => !a.startsWith("--"));
+		for (const source of operands.slice(0, -1)) {
+			current.sources.push(source.replace(/^\.\//, "").replace(/\/$/, ""));
+		}
+	}
+	const copied = new Set<string>();
+	for (let name: string | undefined = stage; name !== undefined; ) {
+		const s = stages.get(name);
+		if (!s) break;
+		for (const source of s.sources) copied.add(source);
+		name = s.parent;
+	}
+	return copied;
+}
+
+/**
+ * Whether `.dockerignore` keeps a root-level entry out of the build context.
+ * The last matching pattern wins and a leading `!` re-includes; `*` and `?`
+ * stop at a `/` while `**` does not — the subset of Docker's matching that
+ * root-level file names exercise.
+ */
+function dockerignoreExcludes(dockerignore: string, file: string): boolean {
+	let excluded = false;
+	for (const raw of dockerignore.split("\n")) {
+		const line = raw.trim();
+		if (line === "" || line.startsWith("#")) continue;
+		const negated = line.startsWith("!");
+		const pattern = negated ? line.slice(1) : line;
+		// `**` is split out first so the single-`*` rewrite cannot see it.
+		const segment = (s: string): string =>
+			s
+				.replace(/[.+^${}()|[\]\\]/g, "\\$&")
+				.replace(/\*/g, "[^/]*")
+				.replace(/\?/g, "[^/]");
+		const regex = new RegExp(`^${pattern.split("**").map(segment).join(".*")}$`);
+		if (regex.test(file)) excluded = !negated;
+	}
+	return excluded;
+}

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -251,7 +251,7 @@ describe("standalone smoke test", () => {
 	it("Dockerfile pins its mutable build inputs (#289)", () => {
 		// Base image by digest — the tag alone is a moving pointer, and
 		// Dependabot's docker ecosystem bumps tag and digest together.
-		expect(dockerfile).toMatch(/FROM node:24-alpine@sha256:[0-9a-f]{64} AS node-base/);
+		expect(dockerfile).toMatch(/FROM node:26-alpine@sha256:[0-9a-f]{64} AS node-base/);
 		// Global corepack by version — `npm install -g corepack` with no pin
 		// resolved whatever was latest at build time.
 		expect(dockerfile).toMatch(/npm install -g corepack@\d+\.\d+\.\d+ --force/);
@@ -486,6 +486,7 @@ describe("standalone smoke test", () => {
 				userSessionStores: { adapter: "redis" as const },
 				rateLimiter: { adapter: "redis" as const },
 				accessTokenDenylist: { adapter: "redis" as const },
+				consentStore: { adapter: "redis" as const },
 				oauth: { ...config.oauth, code: { adapter: "redis" as const } },
 			};
 			// No `refreshTokenFamilyModules` override: the default is the Redis