@o3co/create-auth-provider 0.13.0 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-provider",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Scaffold a new o3co/auth.provider project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,7 +28,7 @@
     "node": ">=22.0.0"
   },
   "devDependencies": {
-    "@types/node": "^26.5.0",
+    "@types/node": "^26.5.1",
     "vitest": "^5.0.0"
   },
   "scripts": {

package/templates/standalone/.env.example

@@ -72,6 +72,11 @@ SESSION_NAME=auth.sid
 
 # Optional
 # HTTP_PORT=3000
+# OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN=3600
+# The most a token-exchange `expires_in` can obtain; unset = the default.
+# OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN=3600
+# DEPRECATED alias of OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN, read only while
+# that one is unset.
 # OAUTH_ACCESS_TOKEN_EXPIRES_IN=3600
 # OAUTH_REFRESH_TOKEN_EXPIRES_IN=86400
 # SESSION_MAX_AGE=3600000

package/templates/standalone/Dockerfile

@@ -103,7 +103,7 @@ CMD ["node", "dist/app.mjs"]
 #############################################
 FROM builder AS test
 
-COPY --chown=node:node vitest.config.mts ./
+COPY --chown=node:node vitest.config.mts vitest.supertest-loopback.mts ./
 COPY --chown=node:node tests/ ./tests/
 # #512: the suite reads these from the project root (scaffold-assets,
 # documented-env-overrides, smoke). The builder stage brings only what the

package/templates/standalone/README.ja.md

@@ -79,13 +79,18 @@ openssl pkey -in jwt-private.pem -pubout -out jwt-public.pem
 
 | 変数 | デフォルト | 説明 |
 |---|---|---|
-| `OAUTH_ACCESS_TOKEN_EXPIRES_IN` | `3600` | アクセストークンの有効期間（秒）。正の整数、上限は 1 年（`31536000`）。 |
+| `OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN` | `3600` | リクエストが有効期間を指定しないときに全グラントが発行するアクセストークンの有効期間（秒）。正の整数、上限は 1 年（`31536000`）。 |
+| `OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN` | デフォルトと同じ | token exchange リクエストの `expires_in` パラメータで得られる上限。超えるリクエストはこの値に切り詰められる。未設定ならデフォルトと同じで、設定しない限り延長されない。デフォルトがこれを超えると両キーを名指しして起動失敗。オフラインで検証するリソースサーバーに対し、交換で発行されたトークンが失効後も通用し得る期間の上限でもある。 |
+| `OAUTH_ACCESS_TOKEN_EXPIRES_IN` | — | `OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN` の**非推奨（deprecated）**エイリアス（config キーでは `oauth.accessToken.expiresIn` が `oauth.accessToken.defaultExpiresIn` のエイリアス）。新しい変数が未設定の間だけ読まれる。値は新しい変数へ移すこと。 |
 | `OAUTH_REFRESH_TOKEN_EXPIRES_IN` | `86400` | リフレッシュトークンの有効期間（秒）。正の整数、上限は 1 年（`31536000`）。 |
 
 これらを空文字で export すると fallback ではなく起動失敗になる: HOCON は `FOO=` を
 `""` に解決し、それが `0` に coerce され、有効期間 0 は「発行時点で期限切れ」の
 トークンを作るため。
 
+`expires_in` リクエストパラメータを読むのは token exchange（RFC 8693）だけで、
+他のグラントはそれを無視してデフォルトを発行する。
+
 ### グラントタイプ
 
 | 変数 | デフォルト | 説明 |

package/templates/standalone/README.md

@@ -113,6 +113,7 @@ Other multi-replica considerations covered by the default modules:
 - The user-session stores switch on `userSessionStores.adapter = "redis"` (`USER_SESSION_STORES_ADAPTER`), which wires `redisSessionStoresModule` off the shared ioredis connection — the one `REFRESH_TOKEN_FAMILY_STORE_REDIS_URL` configures.
 - The authorization-code repository switches on `oauth.code.adapter` (`OAUTH_CODE_ADAPTER`); the template ships `"redis"`, on that same connection. The older `repositories.code.type = "redis"` (`CLIENT_CODE_TYPE`) switch is still honoured with a deprecation warning at boot. `CLIENT_CODE_ENDPOINT_URI` (`repositories.code.redis.endpointUri`) is still bound by `config/application.conf` but nothing reads it: the Redis code repository has run on the shared connection since the `{ endpointUri }` builder shape was retired, so there is one Redis URL for every adapter and that variable is legacy.
 - The replay seen-set — the `jti` single-use record behind `private_key_jwt` client authentication (#484) — switches on `replaySeenSet.adapter` (`REPLAY_SEEN_SET_ADAPTER`); the template ships `"redis"` on the shared connection, and `memory` is refused under `DEPLOYMENT_MODE=multi` because a captured client assertion would replay once per replica.
+- The consent step for clients that are not first-party (#527) switches on `consentStore.adapter` (`CONSENT_STORE_ADAPTER`). It is off (`none`) by default; `memory` is refused under `DEPLOYMENT_MODE=multi`, because a consent granted on one replica would be asked for again on every other and a consent page's parked request would be unknown to the replica that receives the answer. `redis` (#561) keeps both on the shared connection. See [Consent Store](#consent-store).
 - The federation token store defaults to memory. Set `FEDERATION_TOKEN_STORE_TYPE=redis` (`federationTokenStore.type = "redis"`) and supply `REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY` — 32 bytes, base64-encoded (`openssl rand -base64 32`); the store encrypts the upstream refresh tokens it holds. It shares the ioredis socket configured by `REFRESH_TOKEN_FAMILY_STORE_REDIS_URL`. See [Federation Token Store](#federation-token-store).
 
 ## Usage
@@ -210,13 +211,18 @@ every relying party must be handed the shared secret — which also lets it
 
 | Variable | Default | Description |
 |---|---|---|
-| `OAUTH_ACCESS_TOKEN_EXPIRES_IN` | `3600` | Access token lifetime in seconds. Whole positive number, at most one year (`31536000`). |
+| `OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN` | `3600` | Access token lifetime in seconds that every grant mints when the request asks for none. Whole positive number, at most one year (`31536000`). |
+| `OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN` | the default | The most a token-exchange request's `expires_in` parameter can obtain; a larger request is clamped to it. Unset means the default, so no token is extended unless you set this. A default above it is a boot failure naming both keys. It also bounds how long an exchanged token outlives a revocation at a resource server that validates it offline. |
+| `OAUTH_ACCESS_TOKEN_EXPIRES_IN` | — | **Deprecated** alias of `OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN` (config key `oauth.accessToken.expiresIn`, of `oauth.accessToken.defaultExpiresIn`), read only while the new one is unset. Move the value to the new variable. |
 | `OAUTH_REFRESH_TOKEN_EXPIRES_IN` | `86400` | Refresh token lifetime in seconds. Whole positive number, at most one year (`31536000`). |
 
 Exporting one of these as an empty string is a boot failure, not a fallback:
 HOCON resolves `FOO=` to `""`, which coerces to `0`, and a zero lifetime mints
 tokens that have already expired.
 
+Only token exchange (RFC 8693) reads an `expires_in` request parameter; every
+other grant ignores it and mints the default.
+
 ### Grant Types
 
 | Variable | Default | Description |
@@ -417,7 +423,6 @@ needs a key.
 | Variable | Default | Description |
 |---|---|---|
 | `FEDERATION_TOKEN_STORE_TYPE` | `memory` | Federation token store backend: `memory` or `redis` |
-| `CONSENT_STORE_ADAPTER` | `none` | Consent store for clients that are not first-party (#527): `none` (such clients are refused) or `memory` (single replica) |
 | `REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY` | — | AES-256-GCM key for records at rest: 32 bytes, base64-encoded (`openssl rand -base64 32`). **Required** with `redis` unless the mode below is `allow-plaintext` |
 | `REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE` | `required` | `required` or `allow-plaintext`. Plaintext is refused when the config was selected by a production/staging environment (`CONFIG_ENV` or `NODE_ENV`) and under `DEPLOYMENT_MODE=multi` in any environment, unless `FEDERATION_TOKENS_ALLOW_INSECURE=1` is also set — development only |
 
@@ -425,6 +430,19 @@ needs a key.
 `scanFallback` migration flag live under `redisFederationTokenStore` in a
 config layer rather than behind an environment variable.
 
+### Consent Store
+
+Where an end-user's consent to a client that is not first-party is recorded,
+together with the `/authorize` request parked while the consent page asks
+(#527, #552). One switch wires both. `none` by default: such clients are
+refused and only first-party clients are served. `memory` forks per replica and
+is refused under `DEPLOYMENT_MODE=multi`; `redis` (#561) shares both over the
+socket configured by `REFRESH_TOKEN_FAMILY_STORE_REDIS_URL`.
+
+| Variable | Default | Description |
+|---|---|---|
+| `CONSENT_STORE_ADAPTER` | `none` | Consent store for clients that are not first-party (#527): `none` (such clients are refused), `memory` (single replica) or `redis` (shared, #561) |
+
 ### Redis Namespacing
 
 For multi-tenant Redis clusters, set deployment-specific key prefixes so two
@@ -436,9 +454,10 @@ auth.provider instances cannot collide in the same database:
 | `REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX` | `rtfam:` | Prefix for refresh-token family records. |
 | `CLIENT_CODE_KEY_PREFIX` | `oauth:code:` | Prefix for OAuth authorization codes. |
 | `REDIS_FEDERATION_TOKEN_STORE_KEY_PREFIX` | `ft:` | Prefix for federation token records, their per-session index and their lock keys. |
+| `REDIS_CONSENT_STORE_KEY_PREFIX` | `consent:` | Prefix for consent records and for parked consent requests with their per-session index (`CONSENT_STORE_ADAPTER=redis`, #561). |
 
 Use values that include the deployment name, for example `tenant-a:ss:`,
-`tenant-a:rtfam:`, `tenant-a:code:`, and `tenant-a:ft:`.
+`tenant-a:rtfam:`, `tenant-a:code:`, `tenant-a:ft:`, and `tenant-a:consent:`.
 
 ### Endpoints
 

package/templates/standalone/config/application.conf

@@ -162,7 +162,10 @@ replaySeenSet {
 # #527: where consent to a client that is not first-party is recorded.
 # "none" (the default) wires no store and such clients are refused at
 # /authorize; "memory" is single-replica only (refused under
-# DEPLOYMENT_MODE=multi by name).
+# DEPLOYMENT_MODE=multi by name); "redis" (#561) keeps the consent records and
+# the requests parked while the consent page asks on the shared ioredis socket,
+# and is what a deployment of more than one replica selects. Its key namespace
+# is REDIS_CONSENT_STORE_KEY_PREFIX (default "consent:").
 consentStore {
   adapter = "none"
   adapter = ${?CONSENT_STORE_ADAPTER}

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-provider-standalone",
-	"version": "0.13.0",
+	"version": "0.14.0",
 	"private": true,
 	"license": "Apache-2.0",
 	"engines": {
@@ -41,7 +41,7 @@
 	"devDependencies": {
 		"@types/express": "^5.0.6",
 		"@types/express-session": "^1",
-		"@types/node": "^26.5.0",
+		"@types/node": "^26.5.1",
 		"@types/supertest": "^7.2.1",
 		"supertest": "^7.1.0",
 		"tsx": "^4.23.13",

package/templates/standalone/src/__tests__/access-token-lifetime-alias.test.mts

@@ -0,0 +1,101 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * `oauth.accessToken.expiresIn` / OAUTH_ACCESS_TOKEN_EXPIRES_IN is a deprecated
+ * alias of `defaultExpiresIn`, and the composition says so once — the OR-9
+ * shape `repositories.code.type` already has.
+ *
+ * The line has to be exact in both directions. Core's `reference.conf` keeps
+ * the shipped lifetime on the deprecated key, so "the alias supplied the
+ * default" describes every deployment that set nothing; warning on that would
+ * train operators to ignore the line. Only an override of the old key is
+ * something to move.
+ */
+
+import { fileURLToPath } from "node:url";
+import { type AppConfig, AppConfigSchema } from "@o3co/auth-provider-core";
+import { parseFile } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { buildModules } from "../buildModules.mjs";
+import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+const REQUIRED_ENV = {
+	OAUTH_JWT_SECRET: "access-token-alias.at-least-32-bytes.ok",
+	OAUTH_JWT_ISSUER: "https://auth.test",
+	SESSION_SECRET: "access-token-alias-session.at-least-32-bytes.ok",
+};
+
+/** The shipped layers, resolved the way `app.mts` resolves them. */
+function loadShipped(env: Record<string, string> = {}): AppConfig {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "development");
+	const resolvedEnv = { ...REQUIRED_ENV, ...env };
+	return validate(
+		parseFile(envConfPath, { env: resolvedEnv })
+			.withFallback(parseFile(applicationConfPath, { env: resolvedEnv }))
+			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: resolvedEnv })),
+		AppConfigSchema,
+	);
+}
+
+/** Every console warning `buildModules` emits about the deprecated key. */
+function aliasWarnings(config: AppConfig): string[] {
+	const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+	buildModules(config);
+	return warn.mock.calls
+		.map((call) => String(call[0]))
+		.filter((message) => message.includes("oauth.accessToken.expiresIn"));
+}
+
+describe("the deprecated access-token lifetime alias", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("says nothing for a deployment that sets no lifetime at all", () => {
+		// Also what keeps the template's idea of "the shipped value" honest: it
+		// is measured against core's real `reference.conf`, so a change to the
+		// shipped literal fails here rather than warning every deployment.
+		expect(aliasWarnings(loadShipped())).toEqual([]);
+	});
+
+	it("says nothing for a deployment on the new variable", () => {
+		expect(aliasWarnings(loadShipped({ OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "900" }))).toEqual(
+			[],
+		);
+	});
+
+	it("warns once when OAUTH_ACCESS_TOKEN_EXPIRES_IN still decides the default", () => {
+		const warnings = aliasWarnings(loadShipped({ OAUTH_ACCESS_TOKEN_EXPIRES_IN: "900" }));
+		expect(warnings).toHaveLength(1);
+		expect(warnings[0]).toMatch(/deprecated/);
+		expect(warnings[0]).toMatch(/oauth\.accessToken\.defaultExpiresIn/);
+		expect(warnings[0]).toMatch(/OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN/);
+	});
+
+	it("warns for a hand-built configuration that overrides only the old key", () => {
+		const config = loadShipped();
+		expect(
+			aliasWarnings({
+				...config,
+				oauth: { ...config.oauth, accessToken: { expiresIn: 900 } },
+			}),
+		).toHaveLength(1);
+	});
+});

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -17,7 +17,11 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { type AppConfig, AppConfigSchema } from "@o3co/auth-provider-core";
+import {
+	type AppConfig,
+	AppConfigSchema,
+	resolveAccessTokenLifetime,
+} from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
 import { validate } from "@o3co/ts.hocon/zod";
 import { describe, expect, it } from "vitest";
@@ -83,6 +87,10 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	OAUTH_JWT_LEGACY_TYP_ACCEPT: "true",
 
 	// --- oauth tokens / policy ----------------------------------------
+	OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "900",
+	OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN: "7200",
+	// Deprecated alias of the default. Exported alongside the new variable on
+	// purpose, with a different value: the new variable must win.
 	OAUTH_ACCESS_TOKEN_EXPIRES_IN: "3600",
 	OAUTH_REFRESH_TOKEN_EXPIRES_IN: "86400",
 	OAUTH_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY: "reject",
@@ -151,7 +159,9 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
 	// #484: the replay seen-set behind private_key_jwt client authentication.
 	REPLAY_SEEN_SET_ADAPTER: "redis",
-	CONSENT_STORE_ADAPTER: "none",
+	// #561: the consent stores' shared backend and its namespace.
+	CONSENT_STORE_ADAPTER: "redis",
+	REDIS_CONSENT_STORE_KEY_PREFIX: "tenant-a:consent:",
 	REDIS_ACCESS_TOKEN_DENYLIST_KEY_PREFIX: "atdeny:",
 	REDIS_SESSION_STORES_KEY_PREFIX: "ss:",
 	REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX: "rtfam:",
@@ -320,11 +330,19 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.http.port).toBe(3000);
 		expect(config.http.readinessTimeoutMs).toBe(1500);
 		expect(config.http.trustProxy).toEqual(["10.0.0.0/8", "loopback"]);
-		expect(config.oauth.accessToken.expiresIn).toBe(3600);
+		// The new default wins over the deprecated variable, and the parsed
+		// config mirrors it onto the old key for readers that predate the split.
+		expect(resolveAccessTokenLifetime(config)).toEqual({
+			defaultExpiresIn: 900,
+			maxExpiresIn: 7200,
+		});
+		expect(config.oauth.accessToken.expiresIn).toBe(900);
 		expect(config.oauth.refreshToken.expiresIn).toBe(86400);
 		expect(config.session.maxAge).toBe(3600000);
 		expect(config.session.csrf?.ttlSeconds).toBe(7200);
 		expect(config.oauth.nonce?.maxLength).toBe(256);
+		expect(config.consentStore?.adapter).toBe("redis");
+		expect(config.redisConsentStore?.keyPrefix).toBe("tenant-a:consent:");
 		// #529: the comma-separated lists become lists, trimmed; the numbers, numbers.
 		expect(config.oauth.clientIdMetadataDocuments).toEqual({
 			enabled: true,
@@ -508,6 +526,26 @@ describe("#288: the shipped config boots with every documented override supplied
 			).toThrow(/allowUnmarkedClients/);
 		});
 
+		it("refuses an access-token default above the max, naming both keys", () => {
+			expect(() =>
+				buildResolvedConfig({
+					...DOCUMENTED_ENV,
+					OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "7200",
+					OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN: "3600",
+				}),
+			).toThrow(/defaultExpiresIn.*maxExpiresIn/s);
+		});
+
+		for (const name of [
+			"OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN",
+			"OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN",
+			"OAUTH_ACCESS_TOKEN_EXPIRES_IN",
+		]) {
+			it(`refuses an empty ${name} rather than minting already-expired tokens`, () => {
+				expect(() => buildResolvedConfig({ ...DOCUMENTED_ENV, [name]: "" })).toThrow();
+			});
+		}
+
 		it("still refuses an empty SESSION_CSRF_TTL_SECONDS (#272)", () => {
 			// Pinned alongside the boolean cases because it is the same trap
 			// read from the other side: for a *number*, empty means fail loudly.

package/templates/standalone/src/__tests__/metrics.test.mts

@@ -37,6 +37,18 @@ function buildApp(probes: Parameters<ReturnType<typeof createMetrics>["route"]>[
 	return app;
 }
 
+/**
+ * Starts `app` on 127.0.0.1, the address the raw-socket tests dial. A hostless
+ * `listen(0)` binds `[::]`, and on macOS the port it gets can be one another
+ * process holds on 127.0.0.1 — the request then reaches that process and can
+ * hang until the test times out (#556).
+ */
+function listenOnLoopback(app: express.Express): Promise<ReturnType<express.Express["listen"]>> {
+	return new Promise((resolve) => {
+		const server = app.listen(0, "127.0.0.1", () => resolve(server));
+	});
+}
+
 describe("GET /metrics", () => {
 	it("serves the Prometheus text exposition format", async () => {
 		const res = await request(buildApp()).get("/metrics");
@@ -95,7 +107,7 @@ describe("GET /metrics", () => {
 		// route label, reachable without any access to /metrics. Sent over a real
 		// socket because supertest cannot express a non-standard method.
 		const app = buildApp();
-		const server = app.listen(0);
+		const server = await listenOnLoopback(app);
 		const port = (server.address() as { port: number }).port;
 		try {
 			for (const method of ["FOO", "M000001", "PURGE"]) {
@@ -135,7 +147,7 @@ describe("GET /metrics", () => {
 			void res;
 		});
 
-		const server = app.listen(0);
+		const server = await listenOnLoopback(app);
 		const port = (server.address() as { port: number }).port;
 		try {
 			const controller = new AbortController();

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -60,6 +60,7 @@ import {
 	defineModule,
 	InMemoryClientRepository,
 	InMemoryUserRepository,
+	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 	replicaUnsafeReason,
 } from "@o3co/auth-provider-core";
@@ -162,6 +163,9 @@ const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
 	REPLAY_SEEN_SET_ADAPTER: "redis",
 	FEDERATION_TOKEN_STORE_TYPE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
+	// #561: the consent step for clients that are not first-party, on the
+	// shared store — the one switch value `multi` accepts besides `none`.
+	CONSENT_STORE_ADAPTER: "redis",
 };
 
 function resolveConfig(env: Record<string, string>): AppConfig {
@@ -397,6 +401,60 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 	});
 });
 
+describe('#561: consentStore.adapter = "redis" in the standalone', () => {
+	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
+
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	it("selects the Redis consent module, providing both slots, and not the memory one", () => {
+		const modules = modulesFor(resolveConfig(ALL_REDIS_ENV));
+		const names = modules.map((m) => m.name);
+		expect(names).toContain("redis-consent-store");
+		expect(names).not.toContain("core-consent-store-memory");
+		// Exactly one provider for each slot: the consent step refuses a
+		// composition with one and not the other, and two would collide.
+		for (const slot of ["consentStore", "pendingConsentStore"]) {
+			const providers = modules.filter((m) => Object.keys(m.provides ?? {}).includes(slot));
+			expect(
+				providers.map((m) => m.name),
+				slot,
+			).toEqual(["redis-consent-store"]);
+		}
+	});
+
+	it("pulls the shared clients module in for the consent stores alone", () => {
+		// Every other store on memory, single replica: the consent module still
+		// needs its two client slots, which only the shared clients module
+		// provides — the #439 shape otherwise.
+		const config = resolveConfig({
+			...ALL_REDIS_ENV,
+			DEPLOYMENT_MODE: "single",
+			USER_SESSION_STORES_ADAPTER: "memory",
+			OAUTH_CODE_ADAPTER: "memory",
+			RATE_LIMITER_ADAPTER: "memory",
+			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+			REPLAY_SEEN_SET_ADAPTER: "memory",
+			FEDERATION_TOKEN_STORE_TYPE: "memory",
+		});
+		const names = buildModules(config, {
+			keyStoreModule: testKeyStoreModule,
+			repositoriesModule: testRepositoriesModule,
+			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+		}).map((m) => m.name);
+		expect(names).toContain("redis-consent-store");
+		expect(names).toContain("standalone:redis-clients");
+	});
+
+	it("boots under DEPLOYMENT_MODE=multi with both slots resolved to the Redis adapters", async () => {
+		handleRef = await boot(resolveConfig(ALL_REDIS_ENV));
+		expect(handleRef.components.consentStore?.kind).toBe("redis");
+		expect(handleRef.components.pendingConsentStore?.kind).toBe("redis");
+	});
+});
+
 describe("#473: the Redis federation store's plaintext guard, booted from the shipped config", () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 	let warnSpy: ReturnType<typeof vi.spyOn>;

package/templates/standalone/src/__tests__/scaffold-assets.test.mts

@@ -324,6 +324,29 @@ describe("#512 — the shipped suite is green outside this repository", () => {
 			).toBe(false);
 		}
 	});
+
+	it("ships every setup file vitest.config.mts loads, into the `test` image as well (#556)", async () => {
+		// vitest refuses to start when a `setupFiles` entry is missing, so a setup
+		// file the image never copied fails the whole of `make test`, not one test.
+		const configPath = fileURLToPath(new URL("../../vitest.config.mts", import.meta.url));
+		const { default: config } = (await import(configPath)) as {
+			default: { test?: { setupFiles?: string | readonly string[] } };
+		};
+		const setupFiles = [config.test?.setupFiles ?? []].flat();
+		expect(setupFiles, "the #556 supertest loopback guard is not wired in").not.toHaveLength(0);
+
+		const copied = copiedIntoStage(read("/Dockerfile"), "test");
+		const dockerignore = read("/.dockerignore");
+		for (const entry of setupFiles) {
+			const file = entry.replace(/^\.\//, "");
+			expect(existsSync(`${standaloneDir}${file}`), `${file} does not exist`).toBe(true);
+			expect(copied.has(file), `${file} is not copied into the test image`).toBe(true);
+			expect(
+				dockerignoreExcludes(dockerignore, file),
+				`${file} is excluded from the build context`,
+			).toBe(false);
+		}
+	});
 });
 
 /**

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -486,6 +486,7 @@ describe("standalone smoke test", () => {
 				userSessionStores: { adapter: "redis" as const },
 				rateLimiter: { adapter: "redis" as const },
 				accessTokenDenylist: { adapter: "redis" as const },
+				consentStore: { adapter: "redis" as const },
 				oauth: { ...config.oauth, code: { adapter: "redis" as const } },
 			};
 			// No `refreshTokenFamilyModules` override: the default is the Redis

package/templates/standalone/src/__tests__/supertest-loopback.test.mts

@@ -0,0 +1,125 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * #556 — the server `request(app)` starts listens on the address supertest
+ * dials, in this project's own test run.
+ *
+ * Unpatched, supertest starts its server with `app.listen(0)` — the
+ * dual-stack wildcard `[::]:P` — and sends the request to `127.0.0.1:P`. On
+ * macOS the kernel can hand out a `P` another process already holds as
+ * `127.0.0.1:P`; the request then reaches that process, and if it never
+ * answers the test hangs until its timeout. `vitest.supertest-loopback.mts`
+ * (wired in through `setupFiles` in `vitest.config.mts`) binds the server to
+ * `127.0.0.1` instead. These tests fail if that wiring is lost.
+ */
+
+import http from "node:http";
+import net, { type AddressInfo } from "node:net";
+import express from "express";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+
+function helloApp() {
+	const app = express();
+	app.get("/hello", (_req, res) => {
+		res.status(200).send("hello");
+	});
+	return app;
+}
+
+/** Resolves with the address `server` binds, whoever calls `listen`. */
+function boundAddress(server: net.Server): Promise<AddressInfo> {
+	return new Promise((resolve) => {
+		server.once("listening", () => resolve(server.address() as AddressInfo));
+	});
+}
+
+describe("#556 — supertest's own server listens on the loopback address it dials", () => {
+	it("binds 127.0.0.1, not the dual-stack wildcard", async () => {
+		const server = http.createServer(helloApp());
+		const bound = boundAddress(server);
+
+		const res = await request(server).get("/hello");
+
+		expect(res.status).toBe(200);
+		expect(await bound).toMatchObject({ address: "127.0.0.1", family: "IPv4" });
+		// supertest still closes the server it started.
+		expect(server.listening).toBe(false);
+	});
+
+	it("rejects promptly with the request's own error when the request cannot be built", async () => {
+		// Node refuses this header value (ERR_INVALID_CHAR) while supertest builds
+		// the request. With the loopback bind that happens after the bind settles,
+		// outside the promise the test awaits; the throw must still reject that
+		// promise, as it does unpatched, and not become an unhandled rejection
+		// that leaves the request hanging until the test timeout.
+		const server = http.createServer(helloApp());
+
+		await expect(request(server).get("/hello").set("x-test", "bad\nvalue")).rejects.toMatchObject({
+			code: "ERR_INVALID_CHAR",
+		});
+		// The request never went out, so nothing would close the server it started.
+		expect(server.listening).toBe(false);
+	}, 5_000);
+
+	it("hands the same error to an .end() callback", async () => {
+		const server = http.createServer(helloApp());
+
+		const err = await new Promise<unknown>((resolve) => {
+			request(server)
+				.get("/hello")
+				.set("x-test", "bad\nvalue")
+				.end((error) => resolve(error));
+		});
+
+		expect(err).toMatchObject({ code: "ERR_INVALID_CHAR" });
+	}, 5_000);
+
+	it("serves requests an agent sends together over its one server", async () => {
+		const agent = request.agent(helloApp());
+
+		const responses = await Promise.all([agent.get("/hello"), agent.get("/hello")]);
+
+		expect(responses.map((res) => res.status)).toEqual([200, 200]);
+	});
+
+	it("fails the request, instead of hanging on another socket, when 127.0.0.1:P is taken", async () => {
+		// The collision the kernel produces by chance, produced on purpose: a
+		// socket that accepts and never answers holds 127.0.0.1:P, and the
+		// server supertest starts is steered onto P.
+		const held: net.Socket[] = [];
+		const squatter = net.createServer((socket) => {
+			held.push(socket);
+		});
+		await new Promise<void>((resolve) => squatter.listen(0, "127.0.0.1", resolve));
+		const { port } = squatter.address() as AddressInfo;
+
+		const server = http.createServer(helloApp());
+		const listen = server.listen.bind(server) as (...args: unknown[]) => net.Server;
+		(server as { listen: (...args: unknown[]) => net.Server }).listen = (_port, ...rest) =>
+			listen(port, ...rest);
+
+		try {
+			await expect(request(server).get("/hello")).rejects.toMatchObject({
+				code: "EADDRINUSE",
+			});
+		} finally {
+			for (const socket of held) socket.destroy();
+			squatter.close();
+		}
+	}, 5_000);
+});

package/templates/standalone/src/buildModules.mts

@@ -34,6 +34,7 @@ import {
 import {
 	redisAccessTokenDenylistModule,
 	redisCodeRepositoryModule,
+	redisConsentStoreModule,
 	redisFederationTokenStoreModuleFor,
 	redisRateLimiterModule,
 	redisRefreshTokenFamilyStoreModule,
@@ -102,6 +103,15 @@ export interface BuildModulesOverrides {
 	readonly auditSinkModule?: Module;
 }
 
+/**
+ * The access-token lifetime core's `reference.conf` ships on the deprecated
+ * `oauth.accessToken.expiresIn`. Not a default — nothing mints with it — only
+ * what an unmodified deployment carries there, so the deprecation line can tell
+ * an operator's override from the shipped value. Pinned against the real file
+ * by `access-token-lifetime-alias.test.mts`.
+ */
+const SHIPPED_ACCESS_TOKEN_EXPIRES_IN = 3600;
+
 /**
  * Compose the standalone v0.5.0 module list from `config`. Splitting this
  * out of `app.mts` keeps the composition root testable: a smoke test can
@@ -156,6 +166,7 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 	// first-party. `"none"` (the default) wires nothing — such clients are
 	// refused, as before — so a first-party-only deployment pays nothing and
 	// a multi-replica one is not handed a memory store it cannot run.
+	// `"redis"` (#561) is the store such a deployment selects.
 	const consentStoreAdapter = config.consentStore?.adapter ?? "none";
 	// #456: adapter switch for the federation token store. `"memory"` by
 	// default, the template's local-dev shape; `"redis"` mounts
@@ -184,6 +195,26 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		codeRepositoryAdapter = "memory";
 	}
 
+	// The access-token lifetime's deprecated alias: `oauth.accessToken.expiresIn`
+	// (OAUTH_ACCESS_TOKEN_EXPIRES_IN) is still read as the default while
+	// `defaultExpiresIn` is unset — `resolveAccessTokenLifetime` does that, and
+	// this only says so. Core's `reference.conf` keeps the shipped lifetime on
+	// the deprecated key, so "the alias supplied the default" is every
+	// deployment that set nothing; an override of it is the one case with
+	// something to move, the reading `legacyCodeType === "redis"` gives above.
+	// See CHANGELOG for the removal version.
+	const accessToken = config.oauth.accessToken;
+	if (
+		accessToken.defaultExpiresIn === undefined &&
+		accessToken.expiresIn !== SHIPPED_ACCESS_TOKEN_EXPIRES_IN
+	) {
+		console.warn(
+			"[buildModules] `oauth.accessToken.expiresIn` (OAUTH_ACCESS_TOKEN_EXPIRES_IN) is " +
+				"deprecated; use `oauth.accessToken.defaultExpiresIn` " +
+				"(OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN) instead — see CHANGELOG for the removal version.",
+		);
+	}
+
 	const refreshTokenFamilyModules: readonly Module[] = overrides.refreshTokenFamilyModules ?? [
 		redisRefreshTokenFamilyStoreModule,
 	];
@@ -202,6 +233,7 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		codeRepositoryAdapter === "redis" ||
 		accessTokenDenylistAdapter === "redis" ||
 		replaySeenSetAdapter === "redis" ||
+		consentStoreAdapter === "redis" ||
 		federationTokenStoreAdapter === "redis";
 
 	// The four user-session stores switch on `userSessionStores.adapter`; the
@@ -237,10 +269,17 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 			? [redisAccessTokenDenylistModule]
 			: [memoryAccessTokenDenylistModule];
 
-	// #527: opt-in, memory only for now. The module declares itself
-	// replica-unsafe, so `deployment.mode = "multi"` refuses it by name.
+	// #527: opt-in. Each module provides both slots the consent step needs —
+	// the consent records and the requests parked while the page asks — so the
+	// two cannot be wired apart. The memory one declares itself replica-unsafe
+	// and `deployment.mode = "multi"` refuses it by name; the Redis one (#561)
+	// shares both over the ioredis socket.
 	const consentStoreModules: Module[] =
-		consentStoreAdapter === "memory" ? [memoryConsentStoreModule] : [];
+		consentStoreAdapter === "redis"
+			? [redisConsentStoreModule]
+			: consentStoreAdapter === "memory"
+				? [memoryConsentStoreModule]
+				: [];
 
 	// #455 / #456: mutually-exclusive federation-token-store pair, the same
 	// shape as the session stores. One module per adapter, so the memory one
@@ -314,8 +353,8 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		// (single-instance dev). Always wired — see the switch above.
 		...accessTokenDenylistModules,
 		...replaySeenSetModules,
-		// Consent records for clients that are not first-party: memory, or
-		// nothing (#527).
+		// Consent records for clients that are not first-party: redis
+		// (multi-replica, #561), memory (single-instance), or nothing (#527).
 		...consentStoreModules,
 		// RT family store: redis by default (closes OR-1); override path
 		// swaps to `[memoryRefreshTokenFamilyStoreModule]` for unit tests.

package/templates/standalone/src/modules.mts

@@ -361,11 +361,12 @@ export const storesModule: Module = defineModule({
 
 /**
  * Shared ioredis clients module — opens ONE long-lived ioredis connection
- * per replica, wraps it via `makeIoredisClients()` (returns 13 typed
+ * per replica, wraps it via `makeIoredisClients()` (returns 16 typed
  * per-purpose clients), and exposes the slots consumed by the standalone's
  * Redis-backed adapters (refresh-token-family + 4 user-session stores +
  * subject-level revocation index + watermark + rate limiter + code
- * repository + access-token denylist).
+ * repository + access-token denylist + replay seen-set + federation token
+ * store + device-code store + the consent stores).
  *
  * Per F4 PR1 (D-2 v2) + Wave 5d unification: the previous design opened a
  * separate ioredis socket per Redis-backed module (3+ sockets per replica).
@@ -504,6 +505,23 @@ export const standaloneRedisClientsModule: Module = defineModule({
 			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
 				.deviceCodeStoreClient;
 		},
+		// #561: the consent stores' clients, off the same shared socket.
+		// `redisConsentStoreModule` requires both — it provides the consent
+		// records and the parked requests together — and `buildModules` selects
+		// it under `consentStore.adapter = "redis"`.
+		consentStoreClient: async ({ config, lifecycleRegistrar, readinessRegistrar, logger }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
+				.consentStoreClient;
+		},
+		pendingConsentStoreClient: async ({
+			config,
+			lifecycleRegistrar,
+			readinessRegistrar,
+			logger,
+		}) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
+				.pendingConsentStoreClient;
+		},
 		// #456: the federation-token-store client, off the same shared socket.
 		// `redisFederationTokenStoreModule` requires it, and nothing provided
 		// it — which is why the Redis branch of the federation store could not

package/templates/standalone/vitest.config.mts

@@ -20,5 +20,11 @@ export default defineConfig({
 		// monorepo the same packages are symlinks to source and are inlined
 		// anyway; this makes the two layouts behave the same.
 		server: { deps: { inline: [/@o3co\/auth-provider-/] } },
+		// #556: the server `request(app)` starts listens on 127.0.0.1, the
+		// address supertest dials. Unpatched, macOS can give it a port another
+		// process holds on 127.0.0.1, and the request hangs on that process until
+		// the test timeout. Rationale and mechanics in the file itself. The
+		// Dockerfile `test` stage copies it; scaffold-assets.test.mts checks that.
+		setupFiles: ["./vitest.supertest-loopback.mts"],
 	},
 });

package/templates/standalone/vitest.supertest-loopback.mts

@@ -0,0 +1,231 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * vitest setup file (#556): the server supertest starts listens on the
+ * address supertest dials.
+ *
+ * `request(app)` / `request.agent(app)` start a server with `app.listen(0)`
+ * and send the request to `127.0.0.1:<port>`. A hostless `listen` binds the
+ * dual-stack wildcard `[::]:P`, and on macOS (BSD `SO_REUSEADDR` semantics —
+ * libuv sets it on every TCP listener) the kernel will choose a `P` that
+ * another process already holds as `127.0.0.1:P`. The more specific socket
+ * wins, so the test's request is delivered to that process. When it accepts
+ * and never answers — an editor helper, in the case that was caught — the
+ * request hangs until the test timeout, in whichever supertest test drew the
+ * port, and passes on the next run. Linux refuses the conflicting bind
+ * (EADDRINUSE), so CI does not show it.
+ *
+ * Binding `127.0.0.1` explicitly removes both halves: the kernel will not
+ * give out a `127.0.0.1:P` someone else holds, and against a wildcard holder
+ * our specific socket is the one that receives. A specific-host `listen` is
+ * asynchronous (it goes through `dns.lookup`), and supertest reads the port
+ * synchronously in its constructor, so the URL is completed when the request
+ * is sent (`end`, which `then` and `expect(..., fn)` go through). A server the
+ * test started itself is never touched.
+ *
+ * supertest is loaded from the package that owns the running test file (the
+ * nearest `package.json` above it), so the patched class is the one that test
+ * imports, whatever directory vitest was started from. A package that does
+ * not declare supertest is left alone. Everything else this file cannot do —
+ * no test path, a declared supertest that does not load, a supertest whose
+ * internals no longer look like this — throws, so the guard is never silently
+ * off.
+ *
+ * This file is part of the project template and ships with every scaffold.
+ * The auth.provider workspace loads this same file for its packages (see
+ * `WORKSPACE_TEST_SETUP` in its `vitest.shared.mts`).
+ */
+
+import { once } from "node:events";
+import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import type { Server } from "node:net";
+import { dirname, join } from "node:path";
+import { Server as TlsServer } from "node:tls";
+import { expect } from "vitest";
+
+const LOOPBACK = "127.0.0.1";
+const PATCHED = Symbol.for("o3co.auth.provider.supertest-loopback");
+const PENDING = Symbol("o3co.auth.provider.supertest-loopback.pending");
+
+type Pending = {
+	readonly server: Server;
+	readonly protocol: string;
+	readonly path: string;
+	/** Settles on `listening`, rejects on a listen `error`. */
+	readonly ready: Promise<unknown>;
+};
+
+type TestInstance = {
+	url: string;
+	_server?: Server;
+	[PENDING]?: Pending;
+};
+
+type TestPrototype = {
+	serverAddress(this: TestInstance, app: Server, path: string): string;
+	end(this: TestInstance, fn?: (err: unknown, res?: unknown) => void): TestInstance;
+	[PATCHED]?: true;
+};
+
+const DEPENDENCY_FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies",
+] as const;
+
+/** The nearest `package.json` at or above `dir`. */
+function owningManifest(dir: string): string | undefined {
+	for (let current = dir; ; current = dirname(current)) {
+		const candidate = join(current, "package.json");
+		if (existsSync(candidate)) return candidate;
+		if (dirname(current) === current) return undefined;
+	}
+}
+
+/** supertest's `Test.prototype` as the running test file sees it, or `undefined` when its package has no supertest. */
+function supertestFor(testPath: string): TestPrototype | undefined {
+	const manifestPath = owningManifest(dirname(testPath));
+	if (!manifestPath) {
+		throw new Error(`vitest.supertest-loopback.mts: no package.json above ${testPath}.`);
+	}
+	const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as Record<string, unknown>;
+	const declared = DEPENDENCY_FIELDS.some(
+		(field) => (manifest[field] as Record<string, unknown> | undefined)?.supertest !== undefined,
+	);
+	if (!declared) return undefined;
+
+	let supertest: { Test?: { prototype: TestPrototype } };
+	try {
+		supertest = createRequire(manifestPath)("supertest");
+	} catch (cause) {
+		throw new Error(
+			`vitest.supertest-loopback.mts: ${manifestPath} declares supertest, but it cannot be loaded from there; the #556 loopback guard would be off.`,
+			{ cause },
+		);
+	}
+	const proto = supertest.Test?.prototype;
+	if (typeof proto?.serverAddress !== "function" || typeof proto.end !== "function") {
+		throw new Error(
+			"vitest.supertest-loopback.mts: supertest no longer exposes Test.prototype.serverAddress/end; " +
+				"re-check the #556 loopback guard against the installed supertest before removing it.",
+		);
+	}
+	return proto;
+}
+
+/**
+ * The bind in progress per server. A second request on a server whose bind has
+ * not finished (an agent's requests sent together share one server) waits on
+ * the same bind instead of calling `listen` twice — and, like unpatched
+ * supertest when it finds a server already listening, does not own it.
+ */
+const binding = new WeakMap<Server, Promise<unknown>>();
+
+/**
+ * A throw from the test's own callback, raised where it cannot propagate to
+ * the test: reported as an uncaught exception, which fails the run by name,
+ * instead of an unhandled rejection of a promise nobody holds.
+ */
+function rethrowOutsideThisChain(err: unknown): void {
+	process.nextTick(() => {
+		throw err;
+	});
+}
+
+function patch(proto: TestPrototype): void {
+	if (proto[PATCHED]) return;
+	const originalServerAddress = proto.serverAddress;
+	const originalEnd = proto.end;
+
+	proto.serverAddress = function serverAddress(app, path) {
+		// Already listening: the test owns the server and chose its address.
+		if (app.address()) return originalServerAddress.call(this, app, path);
+
+		const protocol = app instanceof TlsServer ? "https" : "http";
+		let ready = binding.get(app);
+		if (!ready) {
+			// supertest closes `_server` after the response, as it does for the
+			// server it would have started itself.
+			this._server = app.listen(0, LOOPBACK);
+			// Subscribed now, not in `end`: a listen error emitted before the test
+			// sends the request must still reach it, not crash the worker as an
+			// unhandled 'error' event.
+			const bound = once(app, "listening");
+			binding.set(app, bound);
+			bound.then(
+				() => binding.delete(app),
+				() => binding.delete(app),
+			);
+			ready = bound;
+		}
+		this[PENDING] = { server: app, protocol, path, ready };
+		// No port yet; `end` fills it in before anything is sent.
+		return `${protocol}://${LOOPBACK}${path}`;
+	};
+
+	proto.end = function end(fn) {
+		const pending = this[PENDING];
+		if (!pending) return originalEnd.call(this, fn);
+		this[PENDING] = undefined;
+
+		const { server, protocol, path, ready } = pending;
+		let called = false;
+		const callback = (err: unknown, res?: unknown) => {
+			called = true;
+			fn?.(err, res);
+		};
+		// Unpatched, whatever `end` throws while building the request (a header
+		// value Node refuses, a body that will not serialize) reaches the caller
+		// at once — and `then` runs `end` inside a promise executor, so the
+		// awaited request rejects with it. Deferred, there is no caller left: the
+		// throw, like a failed bind, is handed to the request's callback, which
+		// is what rejects that promise. Nothing here may reject: a rejection of
+		// this chain is one nobody awaits.
+		const fail = (err: unknown) => {
+			if (called) return rethrowOutsideThisChain(err);
+			// The request never went out, so supertest will not close the server
+			// this request started.
+			if (this._server?.listening) this._server.close();
+			try {
+				callback(err);
+			} catch (thrown) {
+				rethrowOutsideThisChain(thrown);
+			}
+		};
+		ready
+			.then(() => {
+				const { port } = server.address() as { port: number };
+				this.url = `${protocol}://${LOOPBACK}:${port}${path}`;
+				originalEnd.call(this, callback);
+			})
+			.catch(fail);
+		return this;
+	};
+
+	proto[PATCHED] = true;
+}
+
+const { testPath } = expect.getState();
+if (!testPath) {
+	throw new Error(
+		"vitest.supertest-loopback.mts: vitest did not say which test file this setup runs for, so the #556 loopback guard cannot find supertest.",
+	);
+}
+const proto = supertestFor(testPath);
+if (proto) patch(proto);

package/templates/versions.json

@@ -1,16 +1,16 @@
 {
-	"@o3co/auth-provider-core": "0.13.0",
-	"@o3co/auth-provider-device-grant": "0.13.0",
-	"@o3co/auth-provider-dpop": "0.13.0",
-	"@o3co/auth-provider-mtls": "0.13.0",
-	"@o3co/auth-provider-federation-apple": "0.13.0",
-	"@o3co/auth-provider-federation-google": "0.13.0",
-	"@o3co/auth-provider-federation-github": "0.13.0",
-	"@o3co/auth-provider-federation-oidc": "0.13.0",
-	"@o3co/auth-provider-oauth": "0.13.0",
-	"@o3co/auth-provider-oauth-token-exchange": "0.13.0",
-	"@o3co/auth-provider-session": "0.13.0",
-	"@o3co/auth-provider-foundation": "0.13.0",
-	"@o3co/auth-provider-redis": "0.13.0",
-	"@o3co/auth-provider-webauthn": "0.13.0"
+	"@o3co/auth-provider-core": "0.14.0",
+	"@o3co/auth-provider-device-grant": "0.14.0",
+	"@o3co/auth-provider-dpop": "0.14.0",
+	"@o3co/auth-provider-mtls": "0.14.0",
+	"@o3co/auth-provider-federation-apple": "0.14.0",
+	"@o3co/auth-provider-federation-google": "0.14.0",
+	"@o3co/auth-provider-federation-github": "0.14.0",
+	"@o3co/auth-provider-federation-oidc": "0.14.0",
+	"@o3co/auth-provider-oauth": "0.14.0",
+	"@o3co/auth-provider-oauth-token-exchange": "0.14.0",
+	"@o3co/auth-provider-session": "0.14.0",
+	"@o3co/auth-provider-foundation": "0.14.0",
+	"@o3co/auth-provider-redis": "0.14.0",
+	"@o3co/auth-provider-webauthn": "0.14.0"
 }