@o3co/create-auth-provider 0.13.0 → 0.15.0

package/templates/standalone/src/__tests__/federation-grants-survive-logout.test.mts

@@ -0,0 +1,431 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * #593 acceptance criterion 8, at the two HTTP logout endpoints (D14).
+ *
+ * A federation grant outlives the session it was agreed through. The proof of
+ * that used to be a direct call to `cascadeLogout()` — which is the cascade
+ * `/oauth/logout` runs, and not what `/session/logout` runs: that endpoint has
+ * its own record hygiene (`invalidateSessionRecords`) and reaches the grant
+ * store on no path, by construction. A proof of the helper is not a proof of
+ * the endpoints. So this drives both, on the standalone, as a deployment
+ * composes them: a grant seeded beside a live browser session, the session's
+ * records gone afterwards, the grant and its credential exactly as they were,
+ * and `/token` still disclosing.
+ *
+ * The seeded grant's access token is fresh, so the disclosure is the cached
+ * one and no upstream is asked — the OIDC federation the connection names is
+ * configured with `discovery = false` and hand-typed endpoints so that the
+ * deployment boots without a network.
+ */
+
+import { createHmac } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import {
+	type AppConfig,
+	AppConfigSchema,
+	createApp,
+	createKeyStoreFactory,
+	defineModule,
+	type FederationTokenStore,
+	federationGrantAuthorizationRevision,
+	federationGrantIdentityRevision,
+	InMemoryClientRepository,
+	InMemoryUserRepository,
+	type MemoryFederationGrantStore,
+	memoryRefreshTokenFamilyStoreModule,
+	registerBuiltinKeyStores,
+	type UserSessionStore,
+} from "@o3co/auth-provider-core";
+import { parseFile } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+import express from "express";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import { buildModules } from "../buildModules.mjs";
+import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+
+const DAY = 86_400_000;
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+const ISSUER = "https://auth.test";
+const JWT_SECRET = "federation-grants-survive-logout.at-least-32-bytes.ok";
+const UPSTREAM = "https://issuer.example";
+const UPSTREAM_CLIENT_ID = "provider-client";
+const ENCRYPTION_KEY = Buffer.alloc(32, 9).toString("base64");
+
+const CLIENT_ID = "worker";
+const CLIENT_SECRET = "worker-secret-value";
+const BASIC = `Basic ${Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64")}`;
+const USERNAME = "alice";
+const PASSWORD = "correct-horse-battery-staple";
+const SUB = "u-alice";
+
+const CONNECTION = "calendar";
+const SCOPES: readonly string[] = ["openid", "offline_access", "calendar.read"];
+const BOUNDARY = "production";
+const GRANT_ID = "g-1";
+const REFRESH_TOKEN = "SENTINEL-refresh-token";
+const ACCESS_TOKEN = "upstream-access-token";
+
+const ENV: Readonly<Record<string, string>> = {
+	OAUTH_JWT_ALGORITHM: "HS256",
+	OAUTH_JWT_SECRET: JWT_SECRET,
+	OAUTH_JWT_ISSUER: ISSUER,
+	SESSION_SECRET: "federation-grants-survive-logout-session.at-least-32-bytes.ok",
+	SESSION_SECURE: "false",
+	SESSION_NAME: "auth.session",
+	SESSION_STORAGE_TYPE: "memory",
+	CLIENT_USER_TYPE: "yaml",
+	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
+	USER_SESSION_STORES_ADAPTER: "memory",
+	RATE_LIMITER_ADAPTER: "memory",
+	OAUTH_CODE_ADAPTER: "memory",
+	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+	REPLAY_SEEN_SET_ADAPTER: "memory",
+	FEDERATION_TOKEN_STORE_TYPE: "memory",
+	CONSENT_STORE_ADAPTER: "none",
+	FEDERATION_GRANT_STORE_ADAPTER: "memory",
+	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+	FEDERATION_GRANTS_ENABLED: "true",
+	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
+	// The connect flow is not driven here, and the bundled repository has no
+	// identity lookup; "unsupported" is the declaration a deployment without one
+	// makes (#613), and what lets a connection be configured at all.
+	FEDERATION_GRANTS_IDENTITY_LOOKUP: "unsupported",
+};
+
+/**
+ * The shipped configuration under the environment above, with the two lists
+ * that have no environment form (comment 9 on #593) written over it: the
+ * upstream federation the connection names, and the connection.
+ */
+function resolveConfig(): AppConfig {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
+	const config = validate(
+		parseFile(envConfPath, { env: ENV })
+			.withFallback(parseFile(applicationConfPath, { env: ENV }))
+			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: ENV })),
+		AppConfigSchema,
+	);
+	return {
+		...config,
+		federations: {
+			...config.federations,
+			upstream: {
+				enabled: true,
+				type: "oidc",
+				issuer: UPSTREAM,
+				clientId: UPSTREAM_CLIENT_ID,
+				clientSecret: "provider-secret",
+				callbackURL: `${ISSUER}/session/oauth/federation/upstream/callback`,
+				scopes: [...SCOPES],
+				discovery: false,
+				endpoints: {
+					authorizationEndpoint: `${UPSTREAM}/authorize`,
+					tokenEndpoint: `${UPSTREAM}/token`,
+					jwksUri: `${UPSTREAM}/jwks`,
+				},
+				redirectAllowlist: [],
+			},
+		},
+		federationGrants: {
+			...config.federationGrants,
+			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
+			connections: {
+				[CONNECTION]: {
+					federation: "upstream",
+					scopes: [...SCOPES],
+					boundary: BOUNDARY,
+					maxAccessTokenLifetime: 3600,
+					callbackURL: `${ISSUER}/session/federation-grants/callback/${CONNECTION}`,
+				},
+			},
+		},
+	} as AppConfig;
+}
+
+const testRepositoriesModule = defineModule({
+	name: "test:repositories",
+	provides: {
+		clientRepository: () =>
+			new InMemoryClientRepository(
+				new Map([
+					[
+						CLIENT_ID,
+						{
+							tokenEndpointAuthMethod: "client_secret_basic",
+							clientSecret: CLIENT_SECRET,
+							allowedRedirectUris: [],
+							allowedScopes: ["openid", "profile"],
+							allowedAudiences: [],
+							allowedGrantTypes: ["session"],
+							backchannelLogoutSessionRequired: true,
+							frontchannelLogoutSessionRequired: true,
+							allowedAzpForFederationToken: false,
+							allowedFederationGrantConnections: [CONNECTION],
+						},
+					],
+				]),
+			),
+		userRepository: () =>
+			new InMemoryUserRepository(
+				new Map([[USERNAME, { id: SUB, password: PASSWORD, email: "alice@example.com" }]]),
+			),
+	} as never,
+});
+
+const testKeyStoreModule = defineModule({
+	name: "test:key-store",
+	requires: ["config"] as const,
+	provides: {
+		keyStore: async ({ config: c }) => {
+			const factory = createKeyStoreFactory();
+			registerBuiltinKeyStores(factory);
+			return factory.create({
+				type: "local",
+				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+			});
+		},
+	},
+});
+
+/** The grant as the connect flow would have left it, a fresh upstream token in hand. */
+async function seedGrant(store: MemoryFederationGrantStore): Promise<void> {
+	const at = new Date();
+	// The revisions as `connections.mts` resolves them from the configuration
+	// above: the federation's issuer and client, the connection's scopes and
+	// boundary, no resource, no authorization parameters.
+	const resolved = {
+		upstreamIssuer: UPSTREAM,
+		upstreamClientId: UPSTREAM_CLIENT_ID,
+		scopes: SCOPES,
+		boundary: BOUNDARY,
+		authorizationParams: {},
+	};
+	await store.createPending({
+		id: GRANT_ID,
+		subject: SUB,
+		clientId: CLIENT_ID,
+		connection: CONNECTION,
+		intent: { handle: "h", expiresAt: new Date(at.getTime() + 600_000) },
+		now: at,
+	});
+	const written = await store.activate({
+		grantId: GRANT_ID,
+		intentHandle: "h",
+		authorization: {
+			identityRevision: federationGrantIdentityRevision(resolved),
+			authorizationRevision: federationGrantAuthorizationRevision(resolved),
+			upstream: { issuer: UPSTREAM, subject: "upstream-alice" },
+			scopes: [...SCOPES],
+			consent: { at, sid: "sid-consent", scopes: [...SCOPES] },
+			authorizedAt: at,
+			expiresAt: new Date(at.getTime() + 30 * DAY),
+		},
+		credentials: {
+			refreshToken: REFRESH_TOKEN,
+			accessToken: {
+				value: ACCESS_TOKEN,
+				tokenType: "Bearer",
+				obtainedAt: at,
+				issuedLifetime: 3600,
+				scopes: [...SCOPES],
+			},
+		},
+		now: at,
+	});
+	if (!written.ok) throw new Error("fixture: the grant was not activated");
+}
+
+const base64url = (value: unknown): string =>
+	Buffer.from(JSON.stringify(value)).toString("base64url");
+
+/**
+ * An id_token for the session, signed with the deployment's own HS256 key, as
+ * the RP would present it: `/oauth/logout` reads `sid` from the hint and from
+ * nothing else.
+ */
+function idTokenHint(sid: string): string {
+	const header = base64url({ alg: "HS256", kid: "v0", typ: "JWT" });
+	const now = Math.floor(Date.now() / 1000);
+	const payload = base64url({
+		iss: ISSUER,
+		sub: SUB,
+		aud: CLIENT_ID,
+		sid,
+		iat: now,
+		exp: now + 3600,
+	});
+	const signature = createHmac("sha256", JWT_SECRET)
+		.update(`${header}.${payload}`)
+		.digest("base64url");
+	return `${header}.${payload}.${signature}`;
+}
+
+const claimsOf = (jwt: string): Record<string, unknown> =>
+	JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8")) as Record<
+		string,
+		unknown
+	>;
+
+describe("#593 AC8: a grant outlives the browser session at both logout endpoints (D14)", () => {
+	let handleRef: Awaited<ReturnType<typeof createApp>> | undefined;
+
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	async function boot() {
+		const config = resolveConfig();
+		const handle = await createApp({
+			modules: buildModules(config, {
+				keyStoreModule: testKeyStoreModule,
+				repositoriesModule: testRepositoriesModule,
+				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+			}),
+			bootstrapComponents: { config, pathResolver: (s) => s },
+		});
+		handleRef = handle;
+		const components = handle.components as {
+			federationGrantStore: MemoryFederationGrantStore;
+			userSessionStore: UserSessionStore;
+			federationTokenStore: FederationTokenStore;
+		};
+		await seedGrant(components.federationGrantStore);
+		const app = express();
+		app.use(handle.router);
+		return { app, config, ...components };
+	}
+
+	/** The real browser half: a CSRF pair, a login, and the cookies plus the token the login reissued. */
+	async function login(app: express.Express, config: AppConfig) {
+		const csrfRes = await request(app).get("/session/csrf");
+		expect(csrfRes.status).toBe(200);
+		const csrfToken = csrfRes.body.csrf_token as string;
+		const headerName = csrfRes.body.header_name as string;
+		const csrfCookies = csrfRes.headers["set-cookie"] as unknown as string[];
+
+		const loginRes = await request(app)
+			.post("/session/login")
+			.set("Cookie", csrfCookies)
+			.set(headerName, csrfToken)
+			.type("form")
+			.send({ username: USERNAME, password: PASSWORD });
+		expect(loginRes.status).toBe(200);
+
+		const cookies = loginRes.headers["set-cookie"] as unknown as string[];
+		const csrfCookiePrefix = `${config.session.name}.csrf=`;
+		const reissued = cookies
+			.find((c) => c.startsWith(csrfCookiePrefix))
+			?.slice(csrfCookiePrefix.length)
+			.split(";")[0];
+		expect(reissued).toBeDefined();
+		return { cookies, csrfToken: decodeURIComponent(reissued as string), headerName };
+	}
+
+	/** The session's `sid`, read off the access token the session grant mints for it. */
+	async function sidOf(app: express.Express, cookies: string[]): Promise<string> {
+		const res = await request(app)
+			.post("/oauth/token")
+			.set("Authorization", BASIC)
+			.set("Cookie", cookies)
+			.type("form")
+			.send({ grant_type: "session" });
+		expect(res.status).toBe(200);
+		const sid = claimsOf(res.body.access_token as string).sid;
+		expect(typeof sid).toBe("string");
+		return sid as string;
+	}
+
+	const disclose = (app: express.Express) =>
+		request(app)
+			.post(`/oauth/federation-grants/${GRANT_ID}/token`)
+			.set("Authorization", BASIC)
+			.send({ sub: SUB });
+
+	/**
+	 * What a logout has to leave: the record, its credential — the values, not
+	 * only a readable state, since a rotated or dropped refresh token beside an
+	 * untouched access token would still read `"ok"` — and a disclosure that
+	 * still answers.
+	 */
+	async function expectGrantUntouched(app: express.Express, store: MemoryFederationGrantStore) {
+		expect((await store.find(GRANT_ID, new Date()))?.status).toBe("active");
+		const opened = await store.open(GRANT_ID, new Date());
+		if (opened?.credentials.state !== "ok")
+			throw new Error("the grant's credential is not readable");
+		expect(opened.credentials.value).toMatchObject({
+			refreshToken: REFRESH_TOKEN,
+			accessToken: { value: ACCESS_TOKEN },
+		});
+		const response = await disclose(app);
+		expect(response.status).toBe(200);
+		expect(response.body.access_token).toBe(ACCESS_TOKEN);
+	}
+
+	it("POST /session/logout ends the session's own records and leaves the grant spendable", async () => {
+		const { app, config, federationGrantStore, userSessionStore, federationTokenStore } =
+			await boot();
+		const { cookies, csrfToken, headerName } = await login(app, config);
+		const sid = await sidOf(app, cookies);
+		// A session-bound upstream token beside the grant: the record #276's
+		// guarantee is about, keyed by this session.
+		await federationTokenStore.attach(sid, "upstream", {
+			accessToken: "session-bound-upstream-token",
+			expiresAt: null,
+		});
+		expect(await userSessionStore.get(sid)).not.toBeNull();
+		await expectGrantUntouched(app, federationGrantStore);
+
+		const logout = await request(app)
+			.post("/session/logout")
+			.set("Cookie", cookies)
+			.set(headerName, csrfToken);
+		expect([200, 204]).toContain(logout.status);
+
+		// The session-bound records are gone (#276 holds) ...
+		expect(await userSessionStore.get(sid)).toBeNull();
+		expect(await federationTokenStore.get(sid, "upstream")).toBeNull();
+		// ... and the grant is not among them.
+		await expectGrantUntouched(app, federationGrantStore);
+	});
+
+	it("POST /oauth/logout runs the cascade and leaves the grant spendable", async () => {
+		const { app, config, federationGrantStore, userSessionStore, federationTokenStore } =
+			await boot();
+		const { cookies } = await login(app, config);
+		const sid = await sidOf(app, cookies);
+		await federationTokenStore.attach(sid, "upstream", {
+			accessToken: "session-bound-upstream-token",
+			expiresAt: null,
+		});
+		expect(await userSessionStore.get(sid)).not.toBeNull();
+		await expectGrantUntouched(app, federationGrantStore);
+
+		const logout = await request(app)
+			.post("/oauth/logout")
+			.type("form")
+			.send({ id_token_hint: idTokenHint(sid) });
+		expect(logout.status).toBe(200);
+
+		expect(await userSessionStore.get(sid)).toBeNull();
+		expect(await federationTokenStore.get(sid, "upstream")).toBeNull();
+		await expectGrantUntouched(app, federationGrantStore);
+	});
+});

package/templates/standalone/src/__tests__/google-federation-config-module.test.mts

@@ -112,3 +112,60 @@ describe("googleFederationConfigModule — redirect-policy plumbing (#278)", ()
 		expect(out.redirectAllowlist).toEqual(["https://app.example.com/dashboard"]);
 	});
 });
+
+describe("googleFederationConfigModule — requireAuthorizationResponseIss (#597)", () => {
+	it("is absent by default, so the provider's own default (required) applies", () => {
+		expect("requireAuthorizationResponseIss" in buildConfig(credentials)).toBe(false);
+	});
+
+	it("forwards the operator's escape hatch", () => {
+		expect(
+			buildConfig({ ...credentials, requireAuthorizationResponseIss: false })
+				.requireAuthorizationResponseIss,
+		).toBe(false);
+		expect(
+			buildConfig({ ...credentials, requireAuthorizationResponseIss: true })
+				.requireAuthorizationResponseIss,
+		).toBe(true);
+	});
+
+	it("reads the strings an environment override produces", () => {
+		expect(
+			buildConfig({ ...credentials, requireAuthorizationResponseIss: "false" })
+				.requireAuthorizationResponseIss,
+		).toBe(false);
+		expect(
+			buildConfig({ ...credentials, requireAuthorizationResponseIss: "true" })
+				.requireAuthorizationResponseIss,
+		).toBe(true);
+	});
+
+	it("reads the spellings every other env-overridable boolean accepts", () => {
+		for (const [raw, expected] of [
+			["False", false],
+			[" false ", false],
+			["0", false],
+			["TRUE", true],
+			["1", true],
+		] as const) {
+			expect(
+				buildConfig({ ...credentials, requireAuthorizationResponseIss: raw })
+					.requireAuthorizationResponseIss,
+			).toBe(expected);
+		}
+	});
+
+	it("refuses an empty value, which elsewhere reads as false: exported-but-empty must not switch this check off", () => {
+		expect(() => buildConfig({ ...credentials, requireAuthorizationResponseIss: "" })).toThrow(
+			/federations\.google\.requireAuthorizationResponseIss/,
+		);
+	});
+
+	it("refuses anything else: a typo must not silently switch the check off, or leave it on", () => {
+		for (const bad of ["no", "off", 0, 1, []]) {
+			expect(() => buildConfig({ ...credentials, requireAuthorizationResponseIss: bad })).toThrow(
+				/federations\.google\.requireAuthorizationResponseIss/,
+			);
+		}
+	});
+});

package/templates/standalone/src/__tests__/metrics.test.mts

@@ -37,6 +37,18 @@ function buildApp(probes: Parameters<ReturnType<typeof createMetrics>["route"]>[
 	return app;
 }
 
+/**
+ * Starts `app` on 127.0.0.1, the address the raw-socket tests dial. A hostless
+ * `listen(0)` binds `[::]`, and on macOS the port it gets can be one another
+ * process holds on 127.0.0.1 — the request then reaches that process and can
+ * hang until the test times out (#556).
+ */
+function listenOnLoopback(app: express.Express): Promise<ReturnType<express.Express["listen"]>> {
+	return new Promise((resolve) => {
+		const server = app.listen(0, "127.0.0.1", () => resolve(server));
+	});
+}
+
 describe("GET /metrics", () => {
 	it("serves the Prometheus text exposition format", async () => {
 		const res = await request(buildApp()).get("/metrics");
@@ -95,7 +107,7 @@ describe("GET /metrics", () => {
 		// route label, reachable without any access to /metrics. Sent over a real
 		// socket because supertest cannot express a non-standard method.
 		const app = buildApp();
-		const server = app.listen(0);
+		const server = await listenOnLoopback(app);
 		const port = (server.address() as { port: number }).port;
 		try {
 			for (const method of ["FOO", "M000001", "PURGE"]) {
@@ -135,7 +147,7 @@ describe("GET /metrics", () => {
 			void res;
 		});
 
-		const server = app.listen(0);
+		const server = await listenOnLoopback(app);
 		const port = (server.address() as { port: number }).port;
 		try {
 			const controller = new AbortController();

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -60,6 +60,7 @@ import {
 	defineModule,
 	InMemoryClientRepository,
 	InMemoryUserRepository,
+	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 	replicaUnsafeReason,
 } from "@o3co/auth-provider-core";
@@ -162,6 +163,9 @@ const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
 	REPLAY_SEEN_SET_ADAPTER: "redis",
 	FEDERATION_TOKEN_STORE_TYPE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
+	// #561: the consent step for clients that are not first-party, on the
+	// shared store — the one switch value `multi` accepts besides `none`.
+	CONSENT_STORE_ADAPTER: "redis",
 };
 
 function resolveConfig(env: Record<string, string>): AppConfig {
@@ -397,6 +401,60 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 	});
 });
 
+describe('#561: consentStore.adapter = "redis" in the standalone', () => {
+	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
+
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	it("selects the Redis consent module, providing both slots, and not the memory one", () => {
+		const modules = modulesFor(resolveConfig(ALL_REDIS_ENV));
+		const names = modules.map((m) => m.name);
+		expect(names).toContain("redis-consent-store");
+		expect(names).not.toContain("core-consent-store-memory");
+		// Exactly one provider for each slot: the consent step refuses a
+		// composition with one and not the other, and two would collide.
+		for (const slot of ["consentStore", "pendingConsentStore"]) {
+			const providers = modules.filter((m) => Object.keys(m.provides ?? {}).includes(slot));
+			expect(
+				providers.map((m) => m.name),
+				slot,
+			).toEqual(["redis-consent-store"]);
+		}
+	});
+
+	it("pulls the shared clients module in for the consent stores alone", () => {
+		// Every other store on memory, single replica: the consent module still
+		// needs its two client slots, which only the shared clients module
+		// provides — the #439 shape otherwise.
+		const config = resolveConfig({
+			...ALL_REDIS_ENV,
+			DEPLOYMENT_MODE: "single",
+			USER_SESSION_STORES_ADAPTER: "memory",
+			OAUTH_CODE_ADAPTER: "memory",
+			RATE_LIMITER_ADAPTER: "memory",
+			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+			REPLAY_SEEN_SET_ADAPTER: "memory",
+			FEDERATION_TOKEN_STORE_TYPE: "memory",
+		});
+		const names = buildModules(config, {
+			keyStoreModule: testKeyStoreModule,
+			repositoriesModule: testRepositoriesModule,
+			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+		}).map((m) => m.name);
+		expect(names).toContain("redis-consent-store");
+		expect(names).toContain("standalone:redis-clients");
+	});
+
+	it("boots under DEPLOYMENT_MODE=multi with both slots resolved to the Redis adapters", async () => {
+		handleRef = await boot(resolveConfig(ALL_REDIS_ENV));
+		expect(handleRef.components.consentStore?.kind).toBe("redis");
+		expect(handleRef.components.pendingConsentStore?.kind).toBe("redis");
+	});
+});
+
 describe("#473: the Redis federation store's plaintext guard, booted from the shipped config", () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 	let warnSpy: ReturnType<typeof vi.spyOn>;

package/templates/standalone/src/__tests__/scaffold-assets.test.mts

@@ -324,6 +324,29 @@ describe("#512 — the shipped suite is green outside this repository", () => {
 			).toBe(false);
 		}
 	});
+
+	it("ships every setup file vitest.config.mts loads, into the `test` image as well (#556)", async () => {
+		// vitest refuses to start when a `setupFiles` entry is missing, so a setup
+		// file the image never copied fails the whole of `make test`, not one test.
+		const configPath = fileURLToPath(new URL("../../vitest.config.mts", import.meta.url));
+		const { default: config } = (await import(configPath)) as {
+			default: { test?: { setupFiles?: string | readonly string[] } };
+		};
+		const setupFiles = [config.test?.setupFiles ?? []].flat();
+		expect(setupFiles, "the #556 supertest loopback guard is not wired in").not.toHaveLength(0);
+
+		const copied = copiedIntoStage(read("/Dockerfile"), "test");
+		const dockerignore = read("/.dockerignore");
+		for (const entry of setupFiles) {
+			const file = entry.replace(/^\.\//, "");
+			expect(existsSync(`${standaloneDir}${file}`), `${file} does not exist`).toBe(true);
+			expect(copied.has(file), `${file} is not copied into the test image`).toBe(true);
+			expect(
+				dockerignoreExcludes(dockerignore, file),
+				`${file} is excluded from the build context`,
+			).toBe(false);
+		}
+	});
 });
 
 /**
@@ -389,3 +412,17 @@ function dockerignoreExcludes(dockerignore: string, file: string): boolean {
 	}
 	return excluded;
 }
+
+describe("#593 slice 7 — the compose files give the process time to finish a shutdown", () => {
+	it.each(["/docker-compose.yml", "/docker-compose.production.yml"])(
+		"%s declares a stop_grace_period covering the HTTP drain, the grants cleanup and an exit margin",
+		(rel) => {
+			// compose's own default is ten seconds — the drain budget alone. With
+			// federation grants on, the cleanup that drains a rotated credential's
+			// write gets 45 more, and SIGKILL must arrive after that, not during.
+			const match = /^\s+stop_grace_period:\s*(\d+)s\s*$/m.exec(read(rel));
+			expect(match, `${rel} has no stop_grace_period`).not.toBeNull();
+			expect(Number(match?.[1])).toBeGreaterThanOrEqual(60);
+		},
+	);
+});