@o3co/create-auth-provider 0.13.0 → 0.15.0

package/templates/standalone/src/__tests__/shutdown.test.mts

@@ -33,7 +33,13 @@
 import type { Server } from "node:http";
 import type { Logger } from "@o3co/auth-provider-core";
 import { describe, expect, it, vi } from "vitest";
-import { deferExit, installGracefulShutdown } from "../shutdown.mjs";
+import {
+	cleanupAllowanceFor,
+	deferExit,
+	FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS,
+	FEDERATION_GRANTS_CLEANUP_MARGIN_MS,
+	installGracefulShutdown,
+} from "../shutdown.mjs";
 
 /** A `Server` double whose `close` callback fires only when we say so. */
 function makeServer() {
@@ -80,7 +86,13 @@ const makeLogger = () => {
 };
 
 /** Drive one shutdown without touching the real `process` or exiting. */
-function install(opts: { cleanup?: () => void | Promise<void>; drainTimeoutMs?: number } = {}) {
+function install(
+	opts: {
+		cleanup?: () => void | Promise<void>;
+		drainTimeoutMs?: number;
+		cleanupTimeoutMs?: number;
+	} = {},
+) {
 	const { server, spies, finishDraining, failClose } = makeServer();
 	const logger = makeLogger();
 	const exit = vi.fn();
@@ -90,6 +102,7 @@ function install(opts: { cleanup?: () => void | Promise<void>; drainTimeoutMs?:
 		logger,
 		cleanup: opts.cleanup ?? (() => {}),
 		...(opts.drainTimeoutMs === undefined ? {} : { drainTimeoutMs: opts.drainTimeoutMs }),
+		...(opts.cleanupTimeoutMs === undefined ? {} : { cleanupTimeoutMs: opts.cleanupTimeoutMs }),
 		exit,
 		onSignal: (name, handler) => signals.set(name, handler),
 		offSignal: (name) => signals.delete(name),
@@ -322,3 +335,84 @@ describe("installGracefulShutdown (#290)", () => {
 		expect(signals.size).toBe(0);
 	});
 });
+
+describe("#593 slice 7: the cleanup allowance federation grants need", () => {
+	it("is at least the 45 seconds the package asks for, and only when the feature is on", () => {
+		// The package's drain waits for a rotated credential's write; the
+		// default cleanup budget is the ten-second drain, which is shorter than
+		// the upstream hard timeout and persist budget the feature ships with —
+		// a shutdown under it abandons exactly the write the drain exists for.
+		expect(FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS).toBeGreaterThanOrEqual(45_000);
+		expect(cleanupAllowanceFor({ federationGrants: { enabled: true } })).toEqual({
+			cleanupTimeoutMs: FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS,
+		});
+		// Off, nothing: the cleanup budget stays the drain's, as it was.
+		expect(cleanupAllowanceFor({ federationGrants: { enabled: false } })).toEqual({});
+		expect(cleanupAllowanceFor({})).toEqual({});
+	});
+
+	it("grows with the configured refresh tail, so a raised budget is not cut off by a fixed timer (Copilot, #614)", () => {
+		// The longest tail one refresh has: the upstream hard timeout, the
+		// persist budget and the wait for the lock, back to back, plus an exit
+		// margin. The shipped budgets (25 s + 3 s + 5 s) land exactly on the
+		// floor; a deployment that doubles its upstream timeout gets more.
+		const shipped = {
+			upstreamHardTimeoutMs: 25_000,
+			persistRetryBudgetMs: 3_000,
+			lockWaitMs: 5_000,
+		};
+		expect(
+			25_000 + 3_000 + 5_000 + FEDERATION_GRANTS_CLEANUP_MARGIN_MS,
+			"the margin is what makes the shipped budgets the floor",
+		).toBe(FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS);
+		expect(cleanupAllowanceFor({ federationGrants: { enabled: true, ...shipped } })).toEqual({
+			cleanupTimeoutMs: FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS,
+		});
+		expect(
+			cleanupAllowanceFor({
+				federationGrants: { enabled: true, ...shipped, upstreamHardTimeoutMs: 60_000 },
+			}),
+		).toEqual({ cleanupTimeoutMs: 60_000 + 3_000 + 5_000 + FEDERATION_GRANTS_CLEANUP_MARGIN_MS });
+		// Lowered budgets never go below the documented minimum, and a config
+		// without budgets (built by hand) gets the floor rather than a guess.
+		expect(
+			cleanupAllowanceFor({
+				federationGrants: { enabled: true, ...shipped, upstreamHardTimeoutMs: 1_000 },
+			}),
+		).toEqual({ cleanupTimeoutMs: FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS });
+		expect(
+			cleanupAllowanceFor({ federationGrants: { enabled: true, upstreamHardTimeoutMs: 90_000 } }),
+		).toEqual({ cleanupTimeoutMs: FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS });
+	});
+
+	it("never asks a timer for more than Node can count: an oversized sum is capped, not overflowed (Copilot, #614)", () => {
+		// setTimeout takes a 32-bit signed delay; past it the timer fires after
+		// about a millisecond, which would turn a generous allowance into none.
+		const oversized = cleanupAllowanceFor({
+			federationGrants: {
+				enabled: true,
+				upstreamHardTimeoutMs: 2_000_000_000,
+				persistRetryBudgetMs: 2_000_000_000,
+				lockWaitMs: 5_000,
+			},
+		});
+		expect(oversized).toEqual({ cleanupTimeoutMs: 2_147_483_647 });
+	});
+
+	it("is honoured by the shutdown: a cleanup that needs longer than the drain is given it", async () => {
+		vi.useFakeTimers();
+		try {
+			const { signals, finishDraining, exit } = install({
+				cleanup: () => new Promise<void>((resolve) => setTimeout(resolve, 30_000)),
+				drainTimeoutMs: 5_000,
+				...cleanupAllowanceFor({ federationGrants: { enabled: true } }),
+			});
+			signals.get("SIGTERM")?.();
+			finishDraining();
+			await vi.advanceTimersByTimeAsync(31_000);
+			expect(exit).toHaveBeenCalledExactlyOnceWith(0);
+		} finally {
+			vi.useRealTimers();
+		}
+	});
+});

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -486,6 +486,7 @@ describe("standalone smoke test", () => {
 				userSessionStores: { adapter: "redis" as const },
 				rateLimiter: { adapter: "redis" as const },
 				accessTokenDenylist: { adapter: "redis" as const },
+				consentStore: { adapter: "redis" as const },
 				oauth: { ...config.oauth, code: { adapter: "redis" as const } },
 			};
 			// No `refreshTokenFamilyModules` override: the default is the Redis

package/templates/standalone/src/__tests__/supertest-loopback.test.mts

@@ -0,0 +1,125 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * #556 — the server `request(app)` starts listens on the address supertest
+ * dials, in this project's own test run.
+ *
+ * Unpatched, supertest starts its server with `app.listen(0)` — the
+ * dual-stack wildcard `[::]:P` — and sends the request to `127.0.0.1:P`. On
+ * macOS the kernel can hand out a `P` another process already holds as
+ * `127.0.0.1:P`; the request then reaches that process, and if it never
+ * answers the test hangs until its timeout. `vitest.supertest-loopback.mts`
+ * (wired in through `setupFiles` in `vitest.config.mts`) binds the server to
+ * `127.0.0.1` instead. These tests fail if that wiring is lost.
+ */
+
+import http from "node:http";
+import net, { type AddressInfo } from "node:net";
+import express from "express";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+
+function helloApp() {
+	const app = express();
+	app.get("/hello", (_req, res) => {
+		res.status(200).send("hello");
+	});
+	return app;
+}
+
+/** Resolves with the address `server` binds, whoever calls `listen`. */
+function boundAddress(server: net.Server): Promise<AddressInfo> {
+	return new Promise((resolve) => {
+		server.once("listening", () => resolve(server.address() as AddressInfo));
+	});
+}
+
+describe("#556 — supertest's own server listens on the loopback address it dials", () => {
+	it("binds 127.0.0.1, not the dual-stack wildcard", async () => {
+		const server = http.createServer(helloApp());
+		const bound = boundAddress(server);
+
+		const res = await request(server).get("/hello");
+
+		expect(res.status).toBe(200);
+		expect(await bound).toMatchObject({ address: "127.0.0.1", family: "IPv4" });
+		// supertest still closes the server it started.
+		expect(server.listening).toBe(false);
+	});
+
+	it("rejects promptly with the request's own error when the request cannot be built", async () => {
+		// Node refuses this header value (ERR_INVALID_CHAR) while supertest builds
+		// the request. With the loopback bind that happens after the bind settles,
+		// outside the promise the test awaits; the throw must still reject that
+		// promise, as it does unpatched, and not become an unhandled rejection
+		// that leaves the request hanging until the test timeout.
+		const server = http.createServer(helloApp());
+
+		await expect(request(server).get("/hello").set("x-test", "bad\nvalue")).rejects.toMatchObject({
+			code: "ERR_INVALID_CHAR",
+		});
+		// The request never went out, so nothing would close the server it started.
+		expect(server.listening).toBe(false);
+	}, 5_000);
+
+	it("hands the same error to an .end() callback", async () => {
+		const server = http.createServer(helloApp());
+
+		const err = await new Promise<unknown>((resolve) => {
+			request(server)
+				.get("/hello")
+				.set("x-test", "bad\nvalue")
+				.end((error) => resolve(error));
+		});
+
+		expect(err).toMatchObject({ code: "ERR_INVALID_CHAR" });
+	}, 5_000);
+
+	it("serves requests an agent sends together over its one server", async () => {
+		const agent = request.agent(helloApp());
+
+		const responses = await Promise.all([agent.get("/hello"), agent.get("/hello")]);
+
+		expect(responses.map((res) => res.status)).toEqual([200, 200]);
+	});
+
+	it("fails the request, instead of hanging on another socket, when 127.0.0.1:P is taken", async () => {
+		// The collision the kernel produces by chance, produced on purpose: a
+		// socket that accepts and never answers holds 127.0.0.1:P, and the
+		// server supertest starts is steered onto P.
+		const held: net.Socket[] = [];
+		const squatter = net.createServer((socket) => {
+			held.push(socket);
+		});
+		await new Promise<void>((resolve) => squatter.listen(0, "127.0.0.1", resolve));
+		const { port } = squatter.address() as AddressInfo;
+
+		const server = http.createServer(helloApp());
+		const listen = server.listen.bind(server) as (...args: unknown[]) => net.Server;
+		(server as { listen: (...args: unknown[]) => net.Server }).listen = (_port, ...rest) =>
+			listen(port, ...rest);
+
+		try {
+			await expect(request(server).get("/hello")).rejects.toMatchObject({
+				code: "EADDRINUSE",
+			});
+		} finally {
+			for (const socket of held) socket.destroy();
+			squatter.close();
+		}
+	}, 5_000);
+});

package/templates/standalone/src/app.mts

@@ -29,7 +29,7 @@ import { buildModules } from "./buildModules.mjs";
 import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "./configPath.mjs";
 import { createAppLogger } from "./logger.mjs";
 import { createMetrics } from "./metrics.mjs";
-import { installGracefulShutdown } from "./shutdown.mjs";
+import { cleanupAllowanceFor, installGracefulShutdown } from "./shutdown.mjs";
 import { createTerminalErrorHandler } from "./terminalError.mjs";
 
 // Step 1: Load and validate application config (HOCON → Zod schema).
@@ -164,8 +164,16 @@ await (async (): Promise<void> => {
 	// from the code you deploy. See `shutdown.mts` for the stated guarantees
 	// and for the deadline the previous implementation did not have. Size
 	// `drainTimeoutMs` below your orchestrator's kill grace period.
+	//
+	// #593 slice 7: with federation grants on, cleanup gets the longest refresh
+	// tail the configured budgets allow plus a margin — 45 s under the shipped
+	// ones — rather than inheriting the drain's ten: the dispose is what waits
+	// for a rotated credential's write. The compose files size
+	// `stop_grace_period` to cover the drain, this and an exit margin for the
+	// shipped budgets; a raised budget raises both.
 	installGracefulShutdown(server, {
 		logger,
 		cleanup: () => handle.dispose(),
+		...cleanupAllowanceFor(config),
 	});
 })();

package/templates/standalone/src/buildModules.mts

@@ -21,19 +21,26 @@ import {
 	type Module,
 	memoryAccessTokenDenylistModule,
 	memoryConsentStoreModule,
+	memoryFederationGrantIntentStoreModule,
+	memoryFederationGrantStoreModule,
 	memoryRateLimiterModule,
 	memoryReplaySeenSetModule,
 } from "@o3co/auth-provider-core";
 import { googleFederationModule } from "@o3co/auth-provider-federation-google";
+import { federationGrantsModules } from "@o3co/auth-provider-federation-grants";
 import { oidcFederationModule, oidcFederationNames } from "@o3co/auth-provider-federation-oidc";
 import {
 	oauthAuthorizationModule,
 	oauthModule,
 	oauthSessionModule,
+	subjectRevocationServiceModule,
 } from "@o3co/auth-provider-oauth";
 import {
 	redisAccessTokenDenylistModule,
 	redisCodeRepositoryModule,
+	redisConsentStoreModule,
+	redisFederationGrantIntentStoreModule,
+	redisFederationGrantStoreModuleFor,
 	redisFederationTokenStoreModuleFor,
 	redisRateLimiterModule,
 	redisRefreshTokenFamilyStoreModule,
@@ -102,6 +109,15 @@ export interface BuildModulesOverrides {
 	readonly auditSinkModule?: Module;
 }
 
+/**
+ * The access-token lifetime core's `reference.conf` ships on the deprecated
+ * `oauth.accessToken.expiresIn`. Not a default — nothing mints with it — only
+ * what an unmodified deployment carries there, so the deprecation line can tell
+ * an operator's override from the shipped value. Pinned against the real file
+ * by `access-token-lifetime-alias.test.mts`.
+ */
+const SHIPPED_ACCESS_TOKEN_EXPIRES_IN = 3600;
+
 /**
  * Compose the standalone v0.5.0 module list from `config`. Splitting this
  * out of `app.mts` keeps the composition root testable: a smoke test can
@@ -156,6 +172,7 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 	// first-party. `"none"` (the default) wires nothing — such clients are
 	// refused, as before — so a first-party-only deployment pays nothing and
 	// a multi-replica one is not handed a memory store it cannot run.
+	// `"redis"` (#561) is the store such a deployment selects.
 	const consentStoreAdapter = config.consentStore?.adapter ?? "none";
 	// #456: adapter switch for the federation token store. `"memory"` by
 	// default, the template's local-dev shape; `"redis"` mounts
@@ -163,6 +180,22 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 	// promised and what the previous factory-based module never delivered: it
 	// built the Redis store without a client and failed at boot.
 	const federationTokenStoreAdapter = config.federationTokenStore?.type ?? "memory";
+	// #593 slice 7: federation grants — a user's standing consent that a client
+	// may obtain upstream tokens with no session behind the call. Off by
+	// default, and off installs nothing: no store, no socket, no boot
+	// requirement a deployment that never asked for grants would have to meet.
+	// On, the routes and the background registry the shutdown drains come as a
+	// pair, each store follows its own switch (grants in Redis with acquisition
+	// in memory is a supported single-replica shape), and the subject-revocation
+	// service is installed so a credential change can reach the grants — its
+	// `federationGrantStore` edge is what makes "revoke everything this subject
+	// holds" include them. Enabling the feature is also a statement that the
+	// deployment has a consent page, a callback per connection and a user
+	// repository that covers each connection's registration; the routes module
+	// refuses at boot what is missing, naming it.
+	const federationGrantsEnabled = config.federationGrants?.enabled === true;
+	const federationGrantStoreAdapter = config.federationGrantStore?.adapter ?? "memory";
+	const federationGrantIntentStoreAdapter = config.federationGrantIntentStore?.adapter ?? "memory";
 
 	// OR-9: effective code-repo adapter. `oauth.code.adapter` is the
 	// authoritative switch; the legacy `repositories.code.type = "redis"`
@@ -184,6 +217,26 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		codeRepositoryAdapter = "memory";
 	}
 
+	// The access-token lifetime's deprecated alias: `oauth.accessToken.expiresIn`
+	// (OAUTH_ACCESS_TOKEN_EXPIRES_IN) is still read as the default while
+	// `defaultExpiresIn` is unset — `resolveAccessTokenLifetime` does that, and
+	// this only says so. Core's `reference.conf` keeps the shipped lifetime on
+	// the deprecated key, so "the alias supplied the default" is every
+	// deployment that set nothing; an override of it is the one case with
+	// something to move, the reading `legacyCodeType === "redis"` gives above.
+	// See CHANGELOG for the removal version.
+	const accessToken = config.oauth.accessToken;
+	if (
+		accessToken.defaultExpiresIn === undefined &&
+		accessToken.expiresIn !== SHIPPED_ACCESS_TOKEN_EXPIRES_IN
+	) {
+		console.warn(
+			"[buildModules] `oauth.accessToken.expiresIn` (OAUTH_ACCESS_TOKEN_EXPIRES_IN) is " +
+				"deprecated; use `oauth.accessToken.defaultExpiresIn` " +
+				"(OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN) instead — see CHANGELOG for the removal version.",
+		);
+	}
+
 	const refreshTokenFamilyModules: readonly Module[] = overrides.refreshTokenFamilyModules ?? [
 		redisRefreshTokenFamilyStoreModule,
 	];
@@ -202,7 +255,12 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		codeRepositoryAdapter === "redis" ||
 		accessTokenDenylistAdapter === "redis" ||
 		replaySeenSetAdapter === "redis" ||
-		federationTokenStoreAdapter === "redis";
+		consentStoreAdapter === "redis" ||
+		federationTokenStoreAdapter === "redis" ||
+		// Only while the feature is on: a switch left at "redis" for a feature
+		// that is off must not open a socket.
+		(federationGrantsEnabled &&
+			(federationGrantStoreAdapter === "redis" || federationGrantIntentStoreAdapter === "redis"));
 
 	// The four user-session stores switch on `userSessionStores.adapter`; the
 	// federation-token store is always wired and switches on its own key
@@ -237,10 +295,17 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 			? [redisAccessTokenDenylistModule]
 			: [memoryAccessTokenDenylistModule];
 
-	// #527: opt-in, memory only for now. The module declares itself
-	// replica-unsafe, so `deployment.mode = "multi"` refuses it by name.
+	// #527: opt-in. Each module provides both slots the consent step needs —
+	// the consent records and the requests parked while the page asks — so the
+	// two cannot be wired apart. The memory one declares itself replica-unsafe
+	// and `deployment.mode = "multi"` refuses it by name; the Redis one (#561)
+	// shares both over the ioredis socket.
 	const consentStoreModules: Module[] =
-		consentStoreAdapter === "memory" ? [memoryConsentStoreModule] : [];
+		consentStoreAdapter === "redis"
+			? [redisConsentStoreModule]
+			: consentStoreAdapter === "memory"
+				? [memoryConsentStoreModule]
+				: [];
 
 	// #455 / #456: mutually-exclusive federation-token-store pair, the same
 	// shape as the session stores. One module per adapter, so the memory one
@@ -260,6 +325,29 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 			? [redisFederationTokenStoreModuleFor({ environment: overrides.environment })]
 			: [inMemoryFederationTokenStoreModule];
 
+	// #593 slice 7: one module per store, nothing while the feature is off.
+	// The Redis grant store is built for this composition root so its
+	// plaintext guard knows which environment selected the config (#473), as
+	// the federation-token store's is. Both memory modules declare
+	// `replicaSafety`, so `deployment.mode = "multi"` refuses them by name; a
+	// Redis grant store beside memory user-session stores is refused by the
+	// routes module itself, because the grants would outlive the boundary that
+	// ends them (D13).
+	const federationGrantStoreModules: Module[] = !federationGrantsEnabled
+		? []
+		: federationGrantStoreAdapter === "redis"
+			? [
+					overrides.environment === undefined
+						? redisFederationGrantStoreModuleFor()
+						: redisFederationGrantStoreModuleFor({ environment: overrides.environment }),
+				]
+			: [memoryFederationGrantStoreModule];
+	const federationGrantIntentStoreModules: Module[] = !federationGrantsEnabled
+		? []
+		: federationGrantIntentStoreAdapter === "redis"
+			? [redisFederationGrantIntentStoreModule]
+			: [memoryFederationGrantIntentStoreModule];
+
 	return [
 		// D-5: sessionStoreModule wires the express-session middleware into the
 		// boot-planner-managed lifecycle. **Mount order is enforced by this
@@ -271,6 +359,13 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		// `session.storage.type = "memory"` declares itself replica-unsafe and
 		// `deployment.mode = "multi"` refuses it by name like the other stores.
 		sessionStoreModuleFor(config),
+		// #593 slice 7: before `oauthModule`, whose router mounts under the same
+		// `/oauth` prefix with body parsers of its own — mounted after it, a
+		// malformed body would be refused by the OAuth router's parser without
+		// this package's request id, `Cache-Control: no-store` or throttle (the
+		// package README's mounting-order rule). The browser half sits after the
+		// session middleware by its own `after`, wherever it is listed.
+		...(federationGrantsEnabled ? federationGrantsModules : []),
 		oauthModule({ config }),
 		oauthSessionModule({ config }),
 		oauthAuthorizationModule({ config }),
@@ -304,6 +399,9 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		// bundled into `storesModule` pre-Wave-5d, and the redis session-stores
 		// branch dropped the provider.
 		...federationTokenStoreModules,
+		// #593 slice 7: the grant store and the intent store, when the feature is on.
+		...federationGrantStoreModules,
+		...federationGrantIntentStoreModules,
 		// User-session-store family: redis (multi-replica) or memory (dev).
 		...sessionStoresModules,
 		// OAuth-endpoint rate limiter: redis (shared counters) or memory.
@@ -314,13 +412,19 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		// (single-instance dev). Always wired — see the switch above.
 		...accessTokenDenylistModules,
 		...replaySeenSetModules,
-		// Consent records for clients that are not first-party: memory, or
-		// nothing (#527).
+		// Consent records for clients that are not first-party: redis
+		// (multi-replica, #561), memory (single-instance), or nothing (#527).
 		...consentStoreModules,
 		// RT family store: redis by default (closes OR-1); override path
 		// swaps to `[memoryRefreshTokenFamilyStoreModule]` for unit tests.
 		...refreshTokenFamilyModules,
 		defaultRefreshTokenFamilyRotationModule,
 		defaultRefreshTokenFamilyRevocationModule,
+		// #593 slice 7: the composed "end everything this subject holds" a
+		// credential change calls, reached as `handle.components.subjectRevocationService`.
+		// Installed with the feature, which is what makes it reach the grants;
+		// the template never installed it before, so a deployment without
+		// grants is as it was — a Store there calls core's revokeAllForSubject.
+		...(federationGrantsEnabled ? [subjectRevocationServiceModule] : []),
 	];
 }

package/templates/standalone/src/modules.mts

@@ -39,7 +39,11 @@ import {
 import type { GoogleProviderConfig } from "@o3co/auth-provider-federation-google";
 import { readOidcFederationConfigs } from "@o3co/auth-provider-federation-oidc";
 import { registerBuiltinAdapters } from "@o3co/auth-provider-foundation";
-import { makeIoredisClients } from "@o3co/auth-provider-redis/ioredis";
+import {
+	makeIoredisClients,
+	makeIoredisFederationGrantIntentStoreClient,
+	makeIoredisFederationGrantStoreClient,
+} from "@o3co/auth-provider-redis/ioredis";
 import { extractFederationSection } from "@o3co/auth-provider-session";
 // Named import is required here, not default. ioredis is CJS and its entry
 // does `module.exports = Redis` with the class re-exported as both `default`
@@ -361,11 +365,12 @@ export const storesModule: Module = defineModule({
 
 /**
  * Shared ioredis clients module — opens ONE long-lived ioredis connection
- * per replica, wraps it via `makeIoredisClients()` (returns 13 typed
+ * per replica, wraps it via `makeIoredisClients()` (returns 16 typed
  * per-purpose clients), and exposes the slots consumed by the standalone's
  * Redis-backed adapters (refresh-token-family + 4 user-session stores +
  * subject-level revocation index + watermark + rate limiter + code
- * repository + access-token denylist).
+ * repository + access-token denylist + replay seen-set + federation token
+ * store + device-code store + the consent stores).
  *
  * Per F4 PR1 (D-2 v2) + Wave 5d unification: the previous design opened a
  * separate ioredis socket per Redis-backed module (3+ sockets per replica).
@@ -437,6 +442,28 @@ export const standaloneRedisClientsModule: Module = defineModule({
 			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
 				.sessionFederationIndexClient;
 		},
+		// #593 slice 7: the grant store and the intent store, off the same
+		// socket. Consumed by the Redis grant modules when their switches say
+		// "redis"; provided whenever this module is installed, as every slot
+		// here is, because a slot is cheap and the socket is the cost.
+		federationGrantStoreClient: async ({
+			config,
+			lifecycleRegistrar,
+			readinessRegistrar,
+			logger,
+		}) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
+				.federationGrantStoreClient;
+		},
+		federationGrantIntentStoreClient: async ({
+			config,
+			lifecycleRegistrar,
+			readinessRegistrar,
+			logger,
+		}) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
+				.federationGrantIntentStoreClient;
+		},
 		// #484: the replay seen-set behind private_key_jwt client assertions.
 		replaySeenSetClient: async ({ config, lifecycleRegistrar, readinessRegistrar, logger }) => {
 			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
@@ -504,6 +531,23 @@ export const standaloneRedisClientsModule: Module = defineModule({
 			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
 				.deviceCodeStoreClient;
 		},
+		// #561: the consent stores' clients, off the same shared socket.
+		// `redisConsentStoreModule` requires both — it provides the consent
+		// records and the parked requests together — and `buildModules` selects
+		// it under `consentStore.adapter = "redis"`.
+		consentStoreClient: async ({ config, lifecycleRegistrar, readinessRegistrar, logger }) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
+				.consentStoreClient;
+		},
+		pendingConsentStoreClient: async ({
+			config,
+			lifecycleRegistrar,
+			readinessRegistrar,
+			logger,
+		}) => {
+			return getOrCreateClients(config as AppConfig, lifecycleRegistrar, readinessRegistrar, logger)
+				.pendingConsentStoreClient;
+		},
 		// #456: the federation-token-store client, off the same shared socket.
 		// `redisFederationTokenStoreModule` requires it, and nothing provided
 		// it — which is why the Redis branch of the federation store could not
@@ -612,13 +656,26 @@ const SHARED_REDIS_TIMEOUTS = {
 // on PR #121). When `lifecycleRegistrar` is undefined (test scenarios
 // that don't seed it), each call creates a fresh client; tests are
 // isolated and don't need cross-slot sharing.
-const clientsCache = new WeakMap<LifecycleRegistrar, ReturnType<typeof makeIoredisClients>>();
+/**
+ * Every per-purpose client off the one socket: the general bundle, plus the
+ * two the federation-grant stores need (#593 slice 7). Those two have their
+ * own factories in the Redis package, so a Cluster deployment can give the
+ * grants a connection of their own; this template shares the socket, as it
+ * does for every other store.
+ */
+type StandaloneRedisClients = ReturnType<typeof makeIoredisClients> & {
+	readonly federationGrantStoreClient: ReturnType<typeof makeIoredisFederationGrantStoreClient>;
+	readonly federationGrantIntentStoreClient: ReturnType<
+		typeof makeIoredisFederationGrantIntentStoreClient
+	>;
+};
+const clientsCache = new WeakMap<LifecycleRegistrar, StandaloneRedisClients>();
 function getOrCreateClients(
 	config: AppConfig,
 	lifecycleRegistrar: LifecycleRegistrar | undefined,
 	readinessRegistrar?: ReadinessRegistrar,
 	injectedLogger?: Logger,
-): ReturnType<typeof makeIoredisClients> {
+): StandaloneRedisClients {
 	const logger = injectedLogger ?? consoleLogger;
 	const cached = lifecycleRegistrar ? clientsCache.get(lifecycleRegistrar) : undefined;
 	if (cached) return cached;
@@ -658,7 +715,11 @@ function getOrCreateClients(
 	// The wrapper opens its own connections for refresh rotation
 	// (`refreshTokenFamilyClient.duplicate()`), which inherit no listeners from
 	// `io`; passing the logger lets those report through the same channel.
-	const clients = makeIoredisClients(io, { logger });
+	const clients: StandaloneRedisClients = {
+		...makeIoredisClients(io, { logger }),
+		federationGrantStoreClient: makeIoredisFederationGrantStoreClient(io),
+		federationGrantIntentStoreClient: makeIoredisFederationGrantIntentStoreClient(io),
+	};
 	if (lifecycleRegistrar) clientsCache.set(lifecycleRegistrar, clients);
 	return clients;
 }
@@ -685,6 +746,33 @@ function optionalString(
 	return { [field]: value };
 }
 
+/**
+ * An optional boolean from the `federations.google` slice. HOCON gives a
+ * boolean; an environment override (`${?VAR}`) gives the string, in the
+ * spellings core's `coerceBooleanFromEnv` accepts: "true" / "false" / "1" /
+ * "0", trimmed and in any case. One deliberate difference: that coercion reads
+ * an empty value as false, and this refuses it. HOCON substitutes an
+ * exported-but-empty variable as "", and for a security switch that must not
+ * quietly turn the check off. Anything else is refused too — a typo that
+ * silently reads as either value is worse than a boot failure.
+ */
+function optionalBoolean(
+	slice: Record<string, unknown>,
+	field: string,
+): Record<string, boolean> | Record<string, never> {
+	const value = slice[field];
+	if (value === undefined || value === null) return {};
+	if (typeof value === "boolean") return { [field]: value };
+	if (typeof value === "string") {
+		const normalized = value.trim().toLowerCase();
+		if (normalized === "true" || normalized === "1") return { [field]: true };
+		if (normalized === "false" || normalized === "0") return { [field]: false };
+	}
+	throw new Error(
+		`federations.google.${field} must be one of true, false, "true", "false", "1" or "0" when present`,
+	);
+}
+
 /**
  * Google federation config bridge — supplies the typed `googleFederationConfig`
  * ComponentMap slot from the `config.federations.google` slice.
@@ -751,6 +839,8 @@ export const googleFederationConfigModule: Module = defineModule({
 				...optionalString(slice, "sessionDomain"),
 				...optionalString(slice, "authCallbackUrl"),
 				...optionalString(slice, "clientUrl"),
+				// #597: absent means the provider's default, which is to require it.
+				...optionalBoolean(slice, "requireAuthorizationResponseIss"),
 			};
 		},
 	},