@o3co/create-auth-provider 0.13.0 → 0.15.0

package/templates/standalone/src/__tests__/access-token-lifetime-alias.test.mts

@@ -0,0 +1,101 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * `oauth.accessToken.expiresIn` / OAUTH_ACCESS_TOKEN_EXPIRES_IN is a deprecated
+ * alias of `defaultExpiresIn`, and the composition says so once — the OR-9
+ * shape `repositories.code.type` already has.
+ *
+ * The line has to be exact in both directions. Core's `reference.conf` keeps
+ * the shipped lifetime on the deprecated key, so "the alias supplied the
+ * default" describes every deployment that set nothing; warning on that would
+ * train operators to ignore the line. Only an override of the old key is
+ * something to move.
+ */
+
+import { fileURLToPath } from "node:url";
+import { type AppConfig, AppConfigSchema } from "@o3co/auth-provider-core";
+import { parseFile } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { buildModules } from "../buildModules.mjs";
+import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+const REQUIRED_ENV = {
+	OAUTH_JWT_SECRET: "access-token-alias.at-least-32-bytes.ok",
+	OAUTH_JWT_ISSUER: "https://auth.test",
+	SESSION_SECRET: "access-token-alias-session.at-least-32-bytes.ok",
+};
+
+/** The shipped layers, resolved the way `app.mts` resolves them. */
+function loadShipped(env: Record<string, string> = {}): AppConfig {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "development");
+	const resolvedEnv = { ...REQUIRED_ENV, ...env };
+	return validate(
+		parseFile(envConfPath, { env: resolvedEnv })
+			.withFallback(parseFile(applicationConfPath, { env: resolvedEnv }))
+			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: resolvedEnv })),
+		AppConfigSchema,
+	);
+}
+
+/** Every console warning `buildModules` emits about the deprecated key. */
+function aliasWarnings(config: AppConfig): string[] {
+	const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+	buildModules(config);
+	return warn.mock.calls
+		.map((call) => String(call[0]))
+		.filter((message) => message.includes("oauth.accessToken.expiresIn"));
+}
+
+describe("the deprecated access-token lifetime alias", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("says nothing for a deployment that sets no lifetime at all", () => {
+		// Also what keeps the template's idea of "the shipped value" honest: it
+		// is measured against core's real `reference.conf`, so a change to the
+		// shipped literal fails here rather than warning every deployment.
+		expect(aliasWarnings(loadShipped())).toEqual([]);
+	});
+
+	it("says nothing for a deployment on the new variable", () => {
+		expect(aliasWarnings(loadShipped({ OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "900" }))).toEqual(
+			[],
+		);
+	});
+
+	it("warns once when OAUTH_ACCESS_TOKEN_EXPIRES_IN still decides the default", () => {
+		const warnings = aliasWarnings(loadShipped({ OAUTH_ACCESS_TOKEN_EXPIRES_IN: "900" }));
+		expect(warnings).toHaveLength(1);
+		expect(warnings[0]).toMatch(/deprecated/);
+		expect(warnings[0]).toMatch(/oauth\.accessToken\.defaultExpiresIn/);
+		expect(warnings[0]).toMatch(/OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN/);
+	});
+
+	it("warns for a hand-built configuration that overrides only the old key", () => {
+		const config = loadShipped();
+		expect(
+			aliasWarnings({
+				...config,
+				oauth: { ...config.oauth, accessToken: { expiresIn: 900 } },
+			}),
+		).toHaveLength(1);
+	});
+});

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -17,7 +17,11 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { type AppConfig, AppConfigSchema } from "@o3co/auth-provider-core";
+import {
+	type AppConfig,
+	AppConfigSchema,
+	resolveAccessTokenLifetime,
+} from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
 import { validate } from "@o3co/ts.hocon/zod";
 import { describe, expect, it } from "vitest";
@@ -83,6 +87,10 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	OAUTH_JWT_LEGACY_TYP_ACCEPT: "true",
 
 	// --- oauth tokens / policy ----------------------------------------
+	OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "900",
+	OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN: "7200",
+	// Deprecated alias of the default. Exported alongside the new variable on
+	// purpose, with a different value: the new variable must win.
 	OAUTH_ACCESS_TOKEN_EXPIRES_IN: "3600",
 	OAUTH_REFRESH_TOKEN_EXPIRES_IN: "86400",
 	OAUTH_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY: "reject",
@@ -151,7 +159,9 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
 	// #484: the replay seen-set behind private_key_jwt client authentication.
 	REPLAY_SEEN_SET_ADAPTER: "redis",
-	CONSENT_STORE_ADAPTER: "none",
+	// #561: the consent stores' shared backend and its namespace.
+	CONSENT_STORE_ADAPTER: "redis",
+	REDIS_CONSENT_STORE_KEY_PREFIX: "tenant-a:consent:",
 	REDIS_ACCESS_TOKEN_DENYLIST_KEY_PREFIX: "atdeny:",
 	REDIS_SESSION_STORES_KEY_PREFIX: "ss:",
 	REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX: "rtfam:",
@@ -164,6 +174,20 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	REDIS_FEDERATION_TOKEN_STORE_KEY_PREFIX: "ft:",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE: "required",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=",
+	// #593: federation grants — a user's standing consent that a client may
+	// obtain upstream tokens without them. The overrides `reference.conf`
+	// declares, and (slice 7) the two adapter switches the template composes
+	// the feature from.
+	FEDERATION_GRANTS_ENABLED: "true",
+	FEDERATION_GRANT_STORE_ADAPTER: "redis",
+	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "redis",
+	FEDERATION_GRANTS_ENCRYPTION_MODE: "required",
+	FEDERATION_GRANTS_ALLOW_KEEP_ON_SUBJECT_REVOCATION: "false",
+	// Slice 6: acquisition's two deployment decisions — whether the callback
+	// refuses an upstream account linked to another user, and the consent page.
+	FEDERATION_GRANTS_IDENTITY_LOOKUP: "required",
+	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
+	REDIS_FEDERATION_GRANT_STORE_KEY_PREFIX: "fg:",
 
 	// --- federation ---------------------------------------------------
 	FEDERATIONS_GOOGLE_ENABLED: "true",
@@ -185,6 +209,9 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	CLIENT_USER_AUTHENTICATE_URL: "https://users.example.com/authenticate",
 	CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL: "https://users.example.com/authenticate-by-token",
 	CLIENT_USER_LINK_FEDERATED_IDENTITY_URL: "https://users.example.com/link-federated-identity",
+	// #613: the Store's identity lookup for federation grants (D7 check 5).
+	CLIENT_USER_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL:
+		"https://users.example.com/find-subject-by-federated-identity",
 	CLIENT_USER_TIMEOUT: "5000",
 	CLIENT_USER_MAX_RESPONSE_BYTES: "1048576",
 	CLIENT_CODE_TYPE: "redis",
@@ -313,6 +340,10 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.oauth.resourceIndicator?.enabled).toBe(true);
 		expect(config.federations.google?.enabled).toBe(true);
 		expect(config.federations.oidc?.enabled).toBe(true);
+		// #593: the newest one, and the one where a leftover string would be
+		// read as "on" by a truthiness check and as "off" by `=== true` — a
+		// feature whose whole default is off.
+		expect(config.federationGrants?.enabled).toBe(true);
 	});
 
 	it("turns every non-boolean override into its declared type", () => {
@@ -320,11 +351,19 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.http.port).toBe(3000);
 		expect(config.http.readinessTimeoutMs).toBe(1500);
 		expect(config.http.trustProxy).toEqual(["10.0.0.0/8", "loopback"]);
-		expect(config.oauth.accessToken.expiresIn).toBe(3600);
+		// The new default wins over the deprecated variable, and the parsed
+		// config mirrors it onto the old key for readers that predate the split.
+		expect(resolveAccessTokenLifetime(config)).toEqual({
+			defaultExpiresIn: 900,
+			maxExpiresIn: 7200,
+		});
+		expect(config.oauth.accessToken.expiresIn).toBe(900);
 		expect(config.oauth.refreshToken.expiresIn).toBe(86400);
 		expect(config.session.maxAge).toBe(3600000);
 		expect(config.session.csrf?.ttlSeconds).toBe(7200);
 		expect(config.oauth.nonce?.maxLength).toBe(256);
+		expect(config.consentStore?.adapter).toBe("redis");
+		expect(config.redisConsentStore?.keyPrefix).toBe("tenant-a:consent:");
 		// #529: the comma-separated lists become lists, trimmed; the numbers, numbers.
 		expect(config.oauth.clientIdMetadataDocuments).toEqual({
 			enabled: true,
@@ -508,6 +547,26 @@ describe("#288: the shipped config boots with every documented override supplied
 			).toThrow(/allowUnmarkedClients/);
 		});
 
+		it("refuses an access-token default above the max, naming both keys", () => {
+			expect(() =>
+				buildResolvedConfig({
+					...DOCUMENTED_ENV,
+					OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN: "7200",
+					OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN: "3600",
+				}),
+			).toThrow(/defaultExpiresIn.*maxExpiresIn/s);
+		});
+
+		for (const name of [
+			"OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN",
+			"OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN",
+			"OAUTH_ACCESS_TOKEN_EXPIRES_IN",
+		]) {
+			it(`refuses an empty ${name} rather than minting already-expired tokens`, () => {
+				expect(() => buildResolvedConfig({ ...DOCUMENTED_ENV, [name]: "" })).toThrow();
+			});
+		}
+
 		it("still refuses an empty SESSION_CSRF_TTL_SECONDS (#272)", () => {
 			// Pinned alongside the boolean cases because it is the same trap
 			// read from the other side: for a *number*, empty means fail loudly.

package/templates/standalone/src/__tests__/federation-grants-composition.test.mts

@@ -0,0 +1,384 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * #593 slice 7 — the standalone composes federation grants from its config.
+ *
+ * What is under test is the WIRING: which modules the switches select, that
+ * the shared Redis client module provides the two slots the Redis stores
+ * require, and that the refusals a wrong pairing earns come from the modules
+ * themselves. The flows a connection needs are the package's own tests; a
+ * connection here would need a live IdP, because the OIDC federation
+ * discovers at boot.
+ */
+
+import { fileURLToPath } from "node:url";
+import {
+	type AppConfig,
+	AppConfigSchema,
+	createApp,
+	createKeyStoreFactory,
+	defineModule,
+	InMemoryClientRepository,
+	InMemoryUserRepository,
+	memoryRefreshTokenFamilyStoreModule,
+	registerBuiltinKeyStores,
+} from "@o3co/auth-provider-core";
+import { parseFile } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+import express from "express";
+import request from "supertest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { buildModules } from "../buildModules.mjs";
+import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { cleanupAllowanceFor, FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS } from "../shutdown.mjs";
+
+// The same stand-ins `replica-safety.test.mts` boots under: no socket opens,
+// and the shared clients module's readiness probe gets its PONG.
+vi.mock("redis", () => ({
+	createClient: vi.fn(() => ({
+		connect: vi.fn().mockResolvedValue(undefined),
+		quit: vi.fn().mockResolvedValue(undefined),
+		ping: vi.fn().mockResolvedValue("PONG"),
+		on: vi.fn(),
+	})),
+}));
+
+vi.mock("connect-redis", async () => {
+	const { EventEmitter } = await import("node:events");
+	return {
+		RedisStore: class MockRedisStore extends EventEmitter {
+			constructor(_opts: { client: unknown }) {
+				super();
+			}
+			get(): unknown {
+				return undefined;
+			}
+			set(): void {}
+			destroy(): void {}
+		},
+	};
+});
+
+vi.mock("ioredis", () => {
+	const explicit: Record<string, unknown> = {
+		on: () => undefined,
+		quit: async () => "OK",
+		disconnect: () => undefined,
+		ping: async () => "PONG",
+	};
+	const makeMockRedis = (): object =>
+		new Proxy(
+			{},
+			{
+				get(_target, prop) {
+					if (typeof prop !== "string" || prop === "then") return undefined;
+					if (prop === "duplicate") return makeMockRedis;
+					if (prop in explicit) return explicit[prop];
+					return async () => null;
+				},
+			},
+		);
+	function MockRedis(): object {
+		return makeMockRedis();
+	}
+	return { Redis: MockRedis, default: MockRedis };
+});
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+const ENCRYPTION_KEY = Buffer.alloc(32, 7).toString("base64");
+
+/** A single-replica deployment with every shared store on memory, grants off. */
+const BASE_ENV: Readonly<Record<string, string>> = {
+	OAUTH_JWT_ALGORITHM: "HS256",
+	OAUTH_JWT_SECRET: "federation-grants-composition.at-least-32-bytes.ok",
+	OAUTH_JWT_ISSUER: "https://auth.test",
+	SESSION_SECRET: "federation-grants-composition-session.at-least-32-bytes.ok",
+	SESSION_SECURE: "false",
+	SESSION_NAME: "auth.session",
+	SESSION_STORAGE_TYPE: "memory",
+	CLIENT_USER_TYPE: "yaml",
+	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
+	USER_SESSION_STORES_ADAPTER: "memory",
+	RATE_LIMITER_ADAPTER: "memory",
+	OAUTH_CODE_ADAPTER: "memory",
+	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+	REPLAY_SEEN_SET_ADAPTER: "memory",
+	FEDERATION_TOKEN_STORE_TYPE: "memory",
+	CONSENT_STORE_ADAPTER: "none",
+	FEDERATION_GRANT_STORE_ADAPTER: "memory",
+	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+};
+
+/** The umbrella E2E's shape: every shared store on Redis, more than one replica. */
+const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
+	...BASE_ENV,
+	DEPLOYMENT_MODE: "multi",
+	SESSION_STORAGE_TYPE: "redis",
+	SESSION_STORAGE_REDIS_URL: "redis://redis.test:6379",
+	USER_SESSION_STORES_ADAPTER: "redis",
+	RATE_LIMITER_ADAPTER: "redis",
+	OAUTH_CODE_ADAPTER: "redis",
+	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
+	REPLAY_SEEN_SET_ADAPTER: "redis",
+	FEDERATION_TOKEN_STORE_TYPE: "redis",
+	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
+	CONSENT_STORE_ADAPTER: "redis",
+	FEDERATION_GRANT_STORE_ADAPTER: "redis",
+	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "redis",
+};
+
+/** What enabling the feature adds: the switch, and the page boot requires. */
+const GRANTS_ON: Readonly<Record<string, string>> = {
+	FEDERATION_GRANTS_ENABLED: "true",
+	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
+};
+
+function resolveConfig(env: Record<string, string>): AppConfig {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
+	const config = validate(
+		parseFile(envConfPath, { env })
+			.withFallback(parseFile(applicationConfPath, { env }))
+			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
+		AppConfigSchema,
+	);
+	// The key ring has no environment form (a list of { id, key } is HOCON's);
+	// the Redis grant store refuses to construct without one under "required".
+	return {
+		...config,
+		federationGrants: {
+			...config.federationGrants,
+			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
+		},
+	} as AppConfig;
+}
+
+const testRepositoriesModule = defineModule({
+	name: "test:repositories",
+	provides: {
+		clientRepository: () => new InMemoryClientRepository(new Map()),
+		userRepository: () => new InMemoryUserRepository(new Map()),
+	},
+});
+
+const testKeyStoreModule = defineModule({
+	name: "test:key-store",
+	requires: ["config"] as const,
+	provides: {
+		keyStore: async ({ config: c }) => {
+			const factory = createKeyStoreFactory();
+			registerBuiltinKeyStores(factory);
+			return factory.create({
+				type: "local",
+				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+			});
+		},
+	},
+});
+
+const modulesFor = (config: AppConfig, memoryOnly = false, environment?: string) =>
+	buildModules(config, {
+		keyStoreModule: testKeyStoreModule,
+		repositoriesModule: testRepositoriesModule,
+		...(memoryOnly ? { refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule] } : {}),
+		...(environment === undefined ? {} : { environment }),
+	});
+
+const boot = (config: AppConfig, memoryOnly = false, environment?: string) =>
+	createApp({
+		modules: modulesFor(config, memoryOnly, environment),
+		bootstrapComponents: { config, pathResolver: (s) => s },
+	});
+
+const names = (config: AppConfig, memoryOnly = false) =>
+	modulesFor(config, memoryOnly).map((m) => m.name);
+
+const GRANT_MODULES = [
+	"federation-grants",
+	"federation-grant-background",
+	"core-federation-grant-store-memory",
+	"core-federation-grant-intent-store-memory",
+	"redis-federation-grant-store",
+	"redis-federation-grant-intent-store",
+	"subject-revocation-service",
+];
+
+/** The message of a boot failure and of the module error it wraps, together. */
+const messageChain = (err: unknown): string => {
+	const e = err as { message?: string; cause?: { message?: string } };
+	return `${e.message ?? ""} ${e.cause?.message ?? ""}`;
+};
+
+describe("#593 slice 7: the standalone composes federation grants from its config", () => {
+	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
+
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	it("installs nothing of the feature while it is off, whatever the switches say", async () => {
+		// Off is the default, and off must cost nothing: no store, no socket, no
+		// boot requirement a deployment that never asked for grants would meet.
+		const config = resolveConfig({ ...BASE_ENV, FEDERATION_GRANT_STORE_ADAPTER: "redis" });
+		const installed = names(config, true);
+		for (const name of GRANT_MODULES) expect(installed).not.toContain(name);
+		expect(installed).not.toContain("standalone:redis-clients");
+
+		handleRef = await boot(config, true);
+		const app = express().use(handleRef.router);
+		expect((await request(app).post("/oauth/federation-grants/g/status")).status).toBe(404);
+	});
+
+	it("boots on memory stores with no connection, and mounts the routes", async () => {
+		const config = resolveConfig({ ...BASE_ENV, ...GRANTS_ON });
+		const installed = names(config, true);
+		expect(installed).toEqual(
+			expect.arrayContaining([
+				"federation-grant-background",
+				"federation-grants",
+				"core-federation-grant-store-memory",
+				"core-federation-grant-intent-store-memory",
+				"subject-revocation-service",
+			]),
+		);
+		expect(installed).not.toContain("redis-federation-grant-store");
+		expect(installed).not.toContain("redis-federation-grant-intent-store");
+		// The routes precede oauthModule's body parsers (the package README's
+		// mounting-order rule), and the browser half sits after the session
+		// middleware by its own `after`.
+		expect(installed.indexOf("federation-grants")).toBeLessThan(installed.indexOf("oauth"));
+
+		handleRef = await boot(config, true);
+		const app = express().use(handleRef.router);
+		// Mounted: the JSON router answers for itself (client authentication),
+		// not express's 404.
+		expect((await request(app).post("/oauth/federation-grants/g/status")).status).toBe(401);
+		expect(handleRef.components.subjectRevocationService).toBeDefined();
+	});
+
+	it("selects the Redis stores under the all-Redis environment, provides their clients, and boots under multi", async () => {
+		const config = resolveConfig({ ...ALL_REDIS_ENV, ...GRANTS_ON });
+		const modules = modulesFor(config);
+		const installed = modules.map((m) => m.name);
+		expect(installed).toEqual(
+			expect.arrayContaining([
+				"redis-federation-grant-store",
+				"redis-federation-grant-intent-store",
+			]),
+		);
+		expect(installed).not.toContain("core-federation-grant-store-memory");
+		expect(installed).not.toContain("core-federation-grant-intent-store-memory");
+		const clients = modules.find((m) => m.name === "standalone:redis-clients");
+		expect(Object.keys(clients?.provides ?? {})).toEqual(
+			expect.arrayContaining(["federationGrantStoreClient", "federationGrantIntentStoreClient"]),
+		);
+
+		handleRef = await boot(config);
+		expect(handleRef.components.federationGrantStore?.kind).toBe("redis");
+	});
+
+	it("gives cleanup the documented 45 seconds under the shipped budgets, and nothing while off", () => {
+		// The allowance is derived from reference.conf's budgets; if those move,
+		// the number every README states moves with them, and this says so.
+		expect(cleanupAllowanceFor(resolveConfig({ ...BASE_ENV, ...GRANTS_ON }))).toEqual({
+			cleanupTimeoutMs: FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS,
+		});
+		expect(cleanupAllowanceFor(resolveConfig(BASE_ENV))).toEqual({});
+	});
+
+	it("adds the shared Redis client for the grant stores alone", () => {
+		// Every other adapter on memory and the RT family store overridden: only
+		// the two grant switches ask for Redis, and that is enough.
+		const config = resolveConfig({
+			...BASE_ENV,
+			...GRANTS_ON,
+			FEDERATION_GRANT_STORE_ADAPTER: "redis",
+			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "redis",
+		});
+		expect(names(config, true)).toContain("standalone:redis-clients");
+	});
+
+	it.each([
+		["FEDERATION_GRANT_STORE_ADAPTER", "core-federation-grant-store-memory"],
+		["FEDERATION_GRANT_INTENT_STORE_ADAPTER", "core-federation-grant-intent-store-memory"],
+	])("%s=memory is refused under multi, naming %s", async (variable, module) => {
+		const config = resolveConfig({ ...ALL_REDIS_ENV, ...GRANTS_ON, [variable]: "memory" });
+		await expect(boot(config)).rejects.toMatchObject({
+			name: "BootError",
+			reason: "replica-unsafe-adapter",
+			details: { modules: [module] },
+		});
+	});
+
+	it("refuses Redis grants beside memory user-session stores, naming the boundary (D13)", async () => {
+		// The grants would outlive the process; the boundary that ends them
+		// would not. The routes module refuses the pairing on a single replica
+		// too, and its message names the remedy.
+		const config = resolveConfig({
+			...BASE_ENV,
+			...GRANTS_ON,
+			FEDERATION_GRANT_STORE_ADAPTER: "redis",
+			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+		});
+		let error: unknown;
+		try {
+			handleRef = await boot(config);
+		} catch (caught) {
+			error = caught;
+		}
+		expect(messageChain(error)).toMatch(/subject boundary is kept in "memory"/);
+	});
+
+	it("hands the Redis grant store the environment the config was selected by, so its plaintext guard reads it (#473)", async () => {
+		// The federation-token store's guard reads `environment` beside
+		// NODE_ENV so that CONFIG_ENV=production is production to it; the grant
+		// store's must too, or a deployment selecting its config by CONFIG_ENV
+		// with NODE_ENV unset would keep its refresh tokens in plaintext.
+		const config = resolveConfig({
+			...BASE_ENV,
+			...GRANTS_ON,
+			USER_SESSION_STORES_ADAPTER: "redis",
+			FEDERATION_GRANT_STORE_ADAPTER: "redis",
+			FEDERATION_GRANTS_ENCRYPTION_MODE: "allow-plaintext",
+		});
+		let error: unknown;
+		try {
+			handleRef = await boot(config, false, "production");
+		} catch (caught) {
+			error = caught;
+		}
+		expect(messageChain(error)).toMatch(/federation-grants[\s\S]*allow-plaintext[\s\S]*production/);
+		// The same config under the test environment boots: it is the name that
+		// selected the config, not a hard refusal of plaintext.
+		handleRef = await boot(config);
+		expect(handleRef.components.federationGrantStore?.kind).toBe("redis");
+	});
+
+	it("keeps Redis grants beside memory intents on a single replica", async () => {
+		// A restart loses flows in progress and no established grant.
+		const config = resolveConfig({
+			...BASE_ENV,
+			...GRANTS_ON,
+			USER_SESSION_STORES_ADAPTER: "redis",
+			FEDERATION_GRANT_STORE_ADAPTER: "redis",
+			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+		});
+		handleRef = await boot(config);
+		expect(handleRef.components.federationGrantStore?.kind).toBe("redis");
+		expect(names(config)).toContain("core-federation-grant-intent-store-memory");
+	});
+});