@o3co/create-auth-provider 0.14.0 → 0.16.0

package/templates/standalone/src/__tests__/metrics.test.mts

@@ -138,13 +138,26 @@ describe("GET /metrics", () => {
 		// `close` fires without `finish` when a client or proxy gives up
 		// mid-handler, and those are disproportionately the slow and failing
 		// requests RED metrics exist to surface.
+		//
+		// Sequenced on the server's own events, never on a fixed wait: the abort
+		// goes out once the handler holds the request, and /metrics is read once
+		// the response has closed. A 30 ms sleep either side raced a loaded
+		// machine — an abort sent before the request reached its route was
+		// counted as `unmatched`, or not at all, and one whose close had not yet
+		// been processed was read as nothing.
 		const metrics = createMetrics();
 		const app = express();
 		app.use(metrics.middleware);
 		app.use(metrics.route(express, { probes: [], probeTimeoutMs: 100 }));
+		const handling = Promise.withResolvers<void>();
+		const closed = Promise.withResolvers<void>();
 		app.get("/slow", (_req, res) => {
-			// Never responds; the test aborts the socket instead.
-			void res;
+			// Never responds; the test aborts the socket instead. This listener is
+			// added after the metrics middleware's, and a response emits `close`
+			// to its listeners in the order they were added, so once it runs the
+			// request has been observed.
+			res.once("close", () => closed.resolve());
+			handling.resolve();
 		});
 
 		const server = await listenOnLoopback(app);
@@ -154,17 +167,19 @@ describe("GET /metrics", () => {
 			const pending = fetch(`http://127.0.0.1:${port}/slow`, {
 				signal: controller.signal,
 			}).catch(() => undefined);
-			await new Promise((resolve) => setTimeout(resolve, 30));
+			await handling.promise;
 			controller.abort();
 			await pending;
-			await new Promise((resolve) => setTimeout(resolve, 30));
+			await closed.promise;
 
 			const res = await request(app).get("/metrics");
 			const slow = res.text
 				.split("\n")
 				.filter((l) => l.startsWith("http_request_duration_seconds_count"))
 				.filter((l) => l.includes('route="/slow"'));
-			expect(slow.length).toBeGreaterThan(0);
+			// One request, counted once, under the route it had reached.
+			expect(slow).toHaveLength(1);
+			expect(slow[0]?.trim().endsWith(" 1")).toBe(true);
 		} finally {
 			server.close();
 		}

package/templates/standalone/src/__tests__/post-logout-redirect.test.mts

@@ -0,0 +1,187 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * A logout's `post_logout_redirect_uri` reaches the upstream federation's
+ * end-session call only once it has matched one of the client's registered
+ * `postLogoutRedirectUris` — at `/oauth/logout` and at
+ * `POST /oauth/federation/:name/logout` alike.
+ *
+ * Google publishes no end-session endpoint, and without one configured its
+ * adapter sends the browser straight to the `postLogoutRedirectUri` it is
+ * handed. Both logout routes used to hand it the caller's value unchecked,
+ * ahead of the allowlist check that guarded their own redirect, so a fresh
+ * id_token of the caller's own and `post_logout_redirect_uri=https://evil…`
+ * made this provider's origin answer `303` to any site. With an end-session
+ * endpoint configured, the unchecked value was forwarded to the upstream
+ * instead.
+ *
+ * The redirect asserted here is the one a browser would follow: the real
+ * Google adapter, composed as a deployment composes it
+ * (`google-session.fixture.mts`).
+ */
+
+import type express from "express";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	type GoogleSession,
+	type GoogleWiring,
+	idTokenHint,
+	REGISTERED_POST_LOGOUT_REDIRECT_URI as REGISTERED,
+	signInLinkedToGoogle,
+} from "./google-session.fixture.mjs";
+
+const UNREGISTERED = "https://evil.example/landing";
+const GOOGLE_LOGOUT = "https://accounts.google.com/Logout";
+const UPSTREAM_END_SESSION = "https://idp-logout.example/end-session";
+const UPSTREAM_ID_TOKEN = "upstream-id-token";
+
+/** Google's end-session endpoint, where a deployment names one. */
+const WITH_END_SESSION: GoogleWiring = { endSessionEndpoint: UPSTREAM_END_SESSION };
+
+describe("a logout's post_logout_redirect_uri reaches the upstream only once it is registered", () => {
+	let session: GoogleSession | undefined;
+
+	afterEach(async () => {
+		await session?.dispose();
+		session = undefined;
+	});
+
+	/** Alice signed in, with Google linked and its id_token held for the end-session call. */
+	async function signedInWithGoogle(google: GoogleWiring): Promise<GoogleSession> {
+		session = await signInLinkedToGoogle({
+			google,
+			tokens: {
+				accessToken: "upstream-access-token",
+				expiresAt: null,
+				refreshToken: undefined,
+				idToken: UPSTREAM_ID_TOKEN,
+				tokenType: "Bearer",
+				scope: undefined,
+				grantedScope: undefined,
+			},
+		});
+		return session;
+	}
+
+	const rpLogout = (app: express.Express, sid: string, postLogoutRedirectUri: string) =>
+		request(app)
+			.get("/oauth/logout")
+			.query({
+				id_token_hint: idTokenHint(sid),
+				post_logout_redirect_uri: postLogoutRedirectUri,
+				state: "s-1",
+			});
+
+	const federationLogout = (
+		app: express.Express,
+		accessToken: string,
+		postLogoutRedirectUri: string,
+	) =>
+		request(app)
+			.post("/oauth/federation/google/logout")
+			.set("Authorization", `Bearer ${accessToken}`)
+			.type("form")
+			.send({ post_logout_redirect_uri: postLogoutRedirectUri, state: "s-1" });
+
+	describe("GET /oauth/logout, Google with no end-session endpoint", () => {
+		it("does not send the browser to an unregistered post_logout_redirect_uri", async () => {
+			const { app, sid, userSessionStore } = await signedInWithGoogle("shipped");
+
+			const res = await rpLogout(app, sid, UNREGISTERED);
+
+			expect(res.status).toBe(303);
+			expect(new URL(res.headers.location as string).origin).not.toBe("https://evil.example");
+			// Google's own logout page: the adapter's answer when it is handed no
+			// redirect target, which is what an unregistered one now is.
+			expect(res.headers.location).toBe(`${GOOGLE_LOGOUT}?state=s-1`);
+			// The logout itself still happened.
+			expect(await userSessionStore.get(sid)).toBeNull();
+		});
+
+		it("still returns the browser to a registered post_logout_redirect_uri, with state", async () => {
+			const { app, sid, userSessionStore } = await signedInWithGoogle("shipped");
+
+			const res = await rpLogout(app, sid, REGISTERED);
+
+			expect(res.status).toBe(303);
+			expect(res.headers.location).toBe(`${REGISTERED}?state=s-1`);
+			expect(await userSessionStore.get(sid)).toBeNull();
+		});
+	});
+
+	describe("GET /oauth/logout, Google with a configured end-session endpoint", () => {
+		it("does not forward an unregistered post_logout_redirect_uri to the upstream", async () => {
+			const { app, sid } = await signedInWithGoogle(WITH_END_SESSION);
+
+			const res = await rpLogout(app, sid, UNREGISTERED);
+
+			expect(res.status).toBe(303);
+			const location = new URL(res.headers.location as string);
+			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
+			expect(location.searchParams.get("id_token_hint")).toBe(UPSTREAM_ID_TOKEN);
+			expect(location.searchParams.has("post_logout_redirect_uri")).toBe(false);
+			expect(res.headers.location).not.toContain("evil.example");
+		});
+
+		it("forwards a registered one", async () => {
+			const { app, sid } = await signedInWithGoogle(WITH_END_SESSION);
+
+			const res = await rpLogout(app, sid, REGISTERED);
+
+			expect(res.status).toBe(303);
+			const location = new URL(res.headers.location as string);
+			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
+			expect(location.searchParams.get("post_logout_redirect_uri")).toBe(REGISTERED);
+			expect(location.searchParams.get("state")).toBe("s-1");
+		});
+	});
+
+	describe("POST /oauth/federation/google/logout", () => {
+		it("does not send the browser to an unregistered post_logout_redirect_uri", async () => {
+			const { app, sid, accessToken, sessionFederationIndex } = await signedInWithGoogle("shipped");
+
+			const res = await federationLogout(app, accessToken, UNREGISTERED);
+
+			expect(res.status).toBe(303);
+			expect(new URL(res.headers.location as string).origin).not.toBe("https://evil.example");
+			expect(res.headers.location).toBe(`${GOOGLE_LOGOUT}?state=s-1`);
+			// The federation was disconnected all the same.
+			expect(await sessionFederationIndex.listFederations(sid)).not.toContain("google");
+		});
+
+		it("still returns the browser to one registered for the token's client", async () => {
+			const { app, accessToken } = await signedInWithGoogle("shipped");
+
+			const res = await federationLogout(app, accessToken, REGISTERED);
+
+			expect(res.status).toBe(303);
+			expect(res.headers.location).toBe(`${REGISTERED}?state=s-1`);
+		});
+
+		it("does not forward an unregistered one to a configured end-session endpoint", async () => {
+			const { app, accessToken } = await signedInWithGoogle(WITH_END_SESSION);
+
+			const res = await federationLogout(app, accessToken, UNREGISTERED);
+
+			expect(res.status).toBe(303);
+			const location = new URL(res.headers.location as string);
+			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
+			expect(location.searchParams.has("post_logout_redirect_uri")).toBe(false);
+		});
+	});
+});

package/templates/standalone/src/__tests__/redis-connection-error-log.test.mts

@@ -0,0 +1,139 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * What the template's shared Redis connection logs when the server refuses
+ * it: the real ioredis the template ships, against a TCP server that answers
+ * the way Redis answers a password it no longer accepts. ioredis puts the
+ * handshake it sent — `AUTH` and the password — on the error it emits, so
+ * the `error` listener must log core's `loggableError` projection, never
+ * the error. The logger here serialises every own property of what it is
+ * handed, as a deployment's logger may.
+ */
+
+import { once } from "node:events";
+import { type AddressInfo, createServer, type Socket } from "node:net";
+import type { LifecycleRegistrar, Logger } from "@o3co/auth-provider-core";
+import { describe, expect, it, vi } from "vitest";
+import { standaloneRedisClientsModule } from "#/modules.mjs";
+
+/** Redis's reply to a handshake whose password it does not accept. */
+const WRONGPASS = "-WRONGPASS invalid username-password pair or user is disabled.\r\n";
+
+/** The password the deployment is configured with, and the server no longer takes. */
+const STALE_PASSWORD = "stale-s3cret-redis-password";
+
+/** A TCP server that answers everything sent to it as Redis answers a refused password. */
+async function refusingRedis(): Promise<{ port: number; close: () => Promise<void> }> {
+	const sockets = new Set<Socket>();
+	const server = createServer((socket) => {
+		sockets.add(socket);
+		socket.on("close", () => sockets.delete(socket));
+		socket.on("data", () => {
+			socket.write(WRONGPASS);
+		});
+	});
+	server.listen(0, "127.0.0.1");
+	await once(server, "listening");
+	const { port } = server.address() as AddressInfo;
+	return {
+		port,
+		close: async () => {
+			for (const socket of sockets) socket.destroy();
+			await new Promise<void>((resolve) => server.close(() => resolve()));
+		},
+	};
+}
+
+/**
+ * A logger that serialises every own property of what it is handed, `cause`
+ * and non-enumerable fields included. `lines` is what it wrote; its levels
+ * are spies.
+ */
+const serialiseEverythingLogger = () => {
+	const lines: string[] = [];
+	const walk = (value: unknown, seen = new WeakSet<object>()): unknown => {
+		if (typeof value !== "object" || value === null) return value;
+		if (seen.has(value)) return "[circular]";
+		seen.add(value);
+		const out: Record<string, unknown> = {};
+		for (const key of Object.getOwnPropertyNames(value)) {
+			out[key] = walk((value as Record<string, unknown>)[key], seen);
+		}
+		return out;
+	};
+	const record = (level: string) =>
+		vi.fn((...args: unknown[]): void => {
+			lines.push(JSON.stringify({ level, args: walk(args) }));
+		});
+	const logger = {
+		trace: record("trace"),
+		debug: record("debug"),
+		info: record("info"),
+		warn: record("warn"),
+		error: record("error"),
+		fatal: record("fatal"),
+		child: () => logger,
+	};
+	return { logger: logger as typeof logger & Logger, lines };
+};
+
+describe("standaloneRedisClientsModule: the shared connection refused by the server", () => {
+	it("logs the connection's error as loggableError's projection, never the AUTH arguments ioredis puts on it", async () => {
+		const redis = await refusingRedis();
+		const cleanups: Array<() => Promise<void>> = [];
+		const lifecycleRegistrar: LifecycleRegistrar = {
+			register: (cleanup) => {
+				cleanups.push(cleanup);
+			},
+		};
+		const { logger, lines } = serialiseEverythingLogger();
+		const provides = (
+			standaloneRedisClientsModule as unknown as {
+				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
+			}
+		).provides;
+		try {
+			await provides.refreshTokenFamilyClient({
+				config: {
+					refreshTokenFamilyStore: {
+						redis: { url: `redis://127.0.0.1:${redis.port}`, password: STALE_PASSWORD },
+					},
+				},
+				lifecycleRegistrar,
+				logger,
+			});
+			await vi.waitFor(() => expect(logger.error).toHaveBeenCalled(), { timeout: 10_000 });
+		} finally {
+			// `io.quit()`, as `handle.dispose()` runs it.
+			await Promise.all(cleanups.map((cleanup) => cleanup().catch(() => {})));
+			await redis.close();
+		}
+
+		expect(logger.error).toHaveBeenCalledWith(
+			{
+				err: expect.objectContaining({
+					name: "ReplyError",
+					detail: expect.stringMatching(/^WRONGPASS /),
+					// Which command the server refused, and nothing it carried.
+					command: { name: "hello" },
+				}),
+			},
+			"standalone_redis_clients_error",
+		);
+		for (const line of lines) expect(line).not.toContain(STALE_PASSWORD);
+	});
+});

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -510,12 +510,22 @@ describe("#473: the Redis federation store's plaintext guard, booted from the sh
 		const config = resolveConfig({ ...PLAINTEXT_ENV, DEPLOYMENT_MODE: "single" });
 		handleRef = await boot(config, "development");
 		expect(handleRef.components.federationTokenStore?.kind).toBe("redis");
-		expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("allow-plaintext"));
+		expect(warnSpy).toHaveBeenCalledWith(
+			{ store: "federation-tokens", mode: "allow-plaintext" },
+			"federation_store_plaintext",
+		);
 	});
 
-	it("keeps the FEDERATION_TOKENS_ALLOW_INSECURE=1 escape hatch under multi, at CRITICAL", async () => {
+	it("keeps the FEDERATION_TOKENS_ALLOW_INSECURE=1 escape hatch under multi, logged at error", async () => {
 		process.env.FEDERATION_TOKENS_ALLOW_INSECURE = "1";
 		handleRef = await boot(resolveConfig(PLAINTEXT_ENV), "development");
-		expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining("CRITICAL"));
+		expect(errorSpy).toHaveBeenCalledWith(
+			expect.objectContaining({
+				store: "federation-tokens",
+				deploymentMode: "multi",
+				override: "FEDERATION_TOKENS_ALLOW_INSECURE",
+			}),
+			"federation_store_plaintext_override",
+		);
 	});
 });

package/templates/standalone/src/__tests__/router-error-answers.test.mts

@@ -0,0 +1,149 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template's composition, booted through core's `createApp` and mounted
+ * with no terminal handler of the template's after it — the router alone, as
+ * a composition root that copies nothing of `app.mts` mounts it.
+ *
+ * The OAuth and session routers parse their own bodies and have no error
+ * handler: a body parser's refusal on `/oauth/token`, `/oauth/introspect` or
+ * `/session/login`, and any error a route let through, went on to whatever
+ * the host had after the router. Only `app.mts` had a handler there, so any
+ * other host answered with Express's final handler — an HTML page, with the
+ * stack outside production, where V8's JSON error quotes the body it could
+ * not parse. The router core returns now answers them itself.
+ */
+
+import { defineModule } from "@o3co/auth-provider-core";
+import { Router } from "express";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	basic,
+	type Composition,
+	compose,
+	JSON_TYPE,
+	KIB,
+	M2M,
+	padJson,
+} from "./all-modules-composition.fixture.mjs";
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+});
+
+/** A route that lets an error through, contributed as a deployment adds one. */
+const throwingRouteModule = defineModule({
+	name: "test:throwing-route",
+	contributes: {
+		routes: [
+			() => {
+				const router = Router();
+				router.get("/", () => {
+					throw new Error("a store said something: escaped-error-marker");
+				});
+				return { id: "test:throwing-route", mountPath: "/throws", handler: router };
+			},
+		],
+	},
+});
+
+/** The composition, the router alone mounted. */
+const boot = async (): Promise<Composition> => {
+	current = await compose({
+		terminalErrorHandler: false,
+		extraModules: () => [throwingRouteModule],
+	});
+	return current;
+};
+
+/** The routes that parse a body, and what each needs to reach its parser. */
+const PARSING_ROUTES = [
+	["/oauth/token", { authorization: basic(M2M) }],
+	["/oauth/introspect", { authorization: basic(M2M) }],
+	["/session/login", {}],
+] as const;
+
+const errorLines = (c: Composition) => c.logger.lines.filter((line) => line.level === "error");
+
+describe("the composed router, mounted alone, answers a body parser's refusal", () => {
+	it.each(PARSING_ROUTES)(
+		"%s: malformed JSON is 400 in the envelope, nothing logged",
+		async (path, headers) => {
+			const c = await boot();
+			const res = await request(c.app)
+				.post(path)
+				.set(headers)
+				.set("Content-Type", JSON_TYPE)
+				.send('{"password":"body-secret-marker');
+
+			expect(res.status).toBe(400);
+			expect(res.headers["content-type"]).toMatch(/^application\/json/);
+			expect(res.body).toEqual({ error: "invalid_request", error_description: "malformed_body" });
+			expect(res.text).not.toContain("body-secret-marker");
+			expect(res.text).not.toMatch(/ at /);
+			expect(errorLines(c)).toEqual([]);
+		},
+	);
+
+	it.each(PARSING_ROUTES)(
+		"%s: a body over the parser's limit is 413 in the envelope, nothing logged",
+		async (path, headers) => {
+			const c = await boot();
+			const res = await request(c.app)
+				.post(path)
+				.set(headers)
+				.set("Content-Type", JSON_TYPE)
+				.send(padJson(200 * KIB));
+
+			expect(res.status).toBe(413);
+			expect(res.headers["content-type"]).toMatch(/^application\/json/);
+			expect(res.body).toEqual({ error: "invalid_request", error_description: "body_too_large" });
+			expect(errorLines(c)).toEqual([]);
+		},
+	);
+});
+
+describe("the composed router, mounted alone, answers an error a route let through", () => {
+	it("is 500 server_error in the envelope, logged once at error", async () => {
+		const c = await boot();
+		const res = await request(c.app).get("/throws");
+
+		expect(res.status).toBe(500);
+		expect(res.headers["content-type"]).toMatch(/^application\/json/);
+		expect(res.body).toEqual({ error: "server_error", error_description: "unexpected_error" });
+		expect(res.text).not.toContain("escaped-error-marker");
+		expect(errorLines(c)).toEqual([
+			{
+				level: "error",
+				args: [
+					{
+						endpoint: "/throws",
+						err: expect.objectContaining({
+							name: "Error",
+							detail: "a store said something: escaped-error-marker",
+						}),
+					},
+					"unhandled_request_error",
+				],
+			},
+		]);
+	});
+});

package/templates/standalone/src/__tests__/scaffold-assets.test.mts

@@ -412,3 +412,17 @@ function dockerignoreExcludes(dockerignore: string, file: string): boolean {
 	}
 	return excluded;
 }
+
+describe("#593 slice 7 — the compose files give the process time to finish a shutdown", () => {
+	it.each(["/docker-compose.yml", "/docker-compose.production.yml"])(
+		"%s declares a stop_grace_period covering the HTTP drain, the grants cleanup and an exit margin",
+		(rel) => {
+			// compose's own default is ten seconds — the drain budget alone. With
+			// federation grants on, the cleanup that drains a rotated credential's
+			// write gets 45 more, and SIGKILL must arrive after that, not during.
+			const match = /^\s+stop_grace_period:\s*(\d+)s\s*$/m.exec(read(rel));
+			expect(match, `${rel} has no stop_grace_period`).not.toBeNull();
+			expect(Number(match?.[1])).toBeGreaterThanOrEqual(60);
+		},
+	);
+});