@o3co/create-auth-provider 0.14.0 → 0.16.0

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -52,6 +52,7 @@ import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPa
 const standaloneDir = fileURLToPath(new URL("../..", import.meta.url));
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 const readmePath = fileURLToPath(new URL("../../README.md", import.meta.url));
+const readmeJaPath = fileURLToPath(new URL("../../README.ja.md", import.meta.url));
 
 /**
  * Every environment variable the shipped artifact documents, with a value in
@@ -174,12 +175,27 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	REDIS_FEDERATION_TOKEN_STORE_KEY_PREFIX: "ft:",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE: "required",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=",
+	// #593: federation grants — a user's standing consent that a client may
+	// obtain upstream tokens without them. The overrides `reference.conf`
+	// declares, and (slice 7) the two adapter switches the template composes
+	// the feature from.
+	FEDERATION_GRANTS_ENABLED: "true",
+	FEDERATION_GRANT_STORE_ADAPTER: "redis",
+	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "redis",
+	FEDERATION_GRANTS_ENCRYPTION_MODE: "required",
+	FEDERATION_GRANTS_ALLOW_KEEP_ON_SUBJECT_REVOCATION: "false",
+	// Slice 6: acquisition's two deployment decisions — whether the callback
+	// refuses an upstream account linked to another user, and the consent page.
+	FEDERATION_GRANTS_IDENTITY_LOOKUP: "required",
+	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
+	REDIS_FEDERATION_GRANT_STORE_KEY_PREFIX: "fg:",
 
 	// --- federation ---------------------------------------------------
 	FEDERATIONS_GOOGLE_ENABLED: "true",
 	FEDERATIONS_GOOGLE_CLIENT_ID: "google-client-id",
 	FEDERATIONS_GOOGLE_CLIENT_SECRET: "google-client-secret",
 	FEDERATIONS_GOOGLE_CALLBACK_URL: "https://auth.test/session/oauth/federation/google/callback",
+	FEDERATIONS_GOOGLE_ACCESS_TYPE: "online",
 	// #524: the generic OIDC federation the template ships disabled.
 	FEDERATIONS_OIDC_ENABLED: "true",
 	FEDERATIONS_OIDC_ISSUER: "https://idp.test",
@@ -195,8 +211,13 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	CLIENT_USER_AUTHENTICATE_URL: "https://users.example.com/authenticate",
 	CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL: "https://users.example.com/authenticate-by-token",
 	CLIENT_USER_LINK_FEDERATED_IDENTITY_URL: "https://users.example.com/link-federated-identity",
+	// #613: the Store's identity lookup for federation grants (D7 check 5).
+	CLIENT_USER_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL:
+		"https://users.example.com/find-subject-by-federated-identity",
 	CLIENT_USER_TIMEOUT: "5000",
 	CLIENT_USER_MAX_RESPONSE_BYTES: "1048576",
+	// The credential the http user adapter presents to the Store; >= 32 bytes.
+	CLIENT_USER_BEARER_TOKEN: "0328d706529061d93abd6d826e09ef0f0a1e71a12af813b29e5cd2977b7dc63a",
 	CLIENT_CODE_TYPE: "redis",
 	CLIENT_CODE_DEFAULT_EXPIRES_IN: "600",
 	CLIENT_CODE_ENDPOINT_URI: "redis://redis:6379",
@@ -289,11 +310,9 @@ function substitutionsIn(path: string): Set<string> {
  * The underscore is what separates an environment variable from the HTTP
  * methods in the endpoint table, which share the shouting-case shape.
  */
-function documentedInReadme(): Set<string> {
+function documentedInReadme(path: string = readmePath): Set<string> {
 	const found = new Set<string>();
-	for (const match of readFileSync(readmePath, "utf8").matchAll(
-		/^\|\s*`([A-Z][A-Z0-9_]*)`\s*\|/gm,
-	)) {
+	for (const match of readFileSync(path, "utf8").matchAll(/^\|\s*`([A-Z][A-Z0-9_]*)`\s*\|/gm)) {
 		const name = match[1] as string;
 		if (name.includes("_")) found.add(name);
 	}
@@ -323,6 +342,10 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.oauth.resourceIndicator?.enabled).toBe(true);
 		expect(config.federations.google?.enabled).toBe(true);
 		expect(config.federations.oidc?.enabled).toBe(true);
+		// #593: the newest one, and the one where a leftover string would be
+		// read as "on" by a truthiness check and as "off" by `=== true` — a
+		// feature whose whole default is off.
+		expect(config.federationGrants?.enabled).toBe(true);
 	});
 
 	it("turns every non-boolean override into its declared type", () => {
@@ -330,6 +353,7 @@ describe("#288: the shipped config boots with every documented override supplied
 		expect(config.http.port).toBe(3000);
 		expect(config.http.readinessTimeoutMs).toBe(1500);
 		expect(config.http.trustProxy).toEqual(["10.0.0.0/8", "loopback"]);
+		expect(config.federations.google?.accessType).toBe("online");
 		// The new default wins over the deprecated variable, and the parsed
 		// config mirrors it onto the old key for readers that predate the split.
 		expect(resolveAccessTokenLifetime(config)).toEqual({
@@ -501,12 +525,23 @@ describe("#288: the shipped config boots with every documented override supplied
 		});
 
 		it("covers every environment variable the README documents", () => {
-			const uncovered = [...documentedInReadme()].filter(
+			const uncovered = [...documentedInReadme(), ...documentedInReadme(readmeJaPath)].filter(
 				(name) => !(name in DOCUMENTED_ENV) && !(name in DELIBERATELY_UNSET),
 			);
 			expect(uncovered).toEqual([]);
 		});
 
+		it("documents the same variables in README.md and README.ja.md", () => {
+			// The Japanese README carries the same facts (AGENTS.md): a row added
+			// to one and not the other is a variable one audience never hears of.
+			const en = documentedInReadme();
+			const ja = documentedInReadme(readmeJaPath);
+			expect({
+				onlyInEnglish: [...en].filter((name) => !ja.has(name)).sort(),
+				onlyInJapanese: [...ja].filter((name) => !en.has(name)).sort(),
+			}).toEqual({ onlyInEnglish: [], onlyInJapanese: [] });
+		});
+
 		it("exercises no variable the config layers no longer substitute", () => {
 			// Catches the reverse drift: a README row (and a test entry) left
 			// behind by a key that was removed from the HOCON.

package/templates/standalone/src/__tests__/federation-grants-composition.test.mts

@@ -0,0 +1,445 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * #593 slice 7 — the standalone composes federation grants from its config.
+ *
+ * What is under test is the WIRING: which modules the switches select, that
+ * the shared Redis client module provides the two slots the Redis stores
+ * require, and that the refusals a wrong pairing earns come from the modules
+ * themselves. The flows a connection needs are the package's own tests; a
+ * connection here would need a live IdP, because the OIDC federation
+ * discovers at boot.
+ */
+
+import { fileURLToPath } from "node:url";
+import {
+	type AppConfig,
+	AppConfigSchema,
+	createApp,
+	createKeyStoreFactory,
+	defineModule,
+	InMemoryClientRepository,
+	InMemoryUserRepository,
+	memoryRefreshTokenFamilyStoreModule,
+	registerBuiltinKeyStores,
+} from "@o3co/auth-provider-core";
+import { parseFile } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+import express from "express";
+import request from "supertest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { buildModules } from "../buildModules.mjs";
+import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { cleanupAllowanceFor, FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS } from "../shutdown.mjs";
+
+// The same stand-ins `replica-safety.test.mts` boots under: no socket opens,
+// and the shared clients module's readiness probe gets its PONG.
+vi.mock("redis", () => ({
+	createClient: vi.fn(() => ({
+		connect: vi.fn().mockResolvedValue(undefined),
+		quit: vi.fn().mockResolvedValue(undefined),
+		ping: vi.fn().mockResolvedValue("PONG"),
+		on: vi.fn(),
+	})),
+}));
+
+vi.mock("connect-redis", async () => {
+	const { EventEmitter } = await import("node:events");
+	return {
+		RedisStore: class MockRedisStore extends EventEmitter {
+			constructor(_opts: { client: unknown }) {
+				super();
+			}
+			get(): unknown {
+				return undefined;
+			}
+			set(): void {}
+			destroy(): void {}
+		},
+	};
+});
+
+vi.mock("ioredis", () => {
+	const explicit: Record<string, unknown> = {
+		on: () => undefined,
+		quit: async () => "OK",
+		disconnect: () => undefined,
+		ping: async () => "PONG",
+	};
+	const makeMockRedis = (): object =>
+		new Proxy(
+			{},
+			{
+				get(_target, prop) {
+					if (typeof prop !== "string" || prop === "then") return undefined;
+					if (prop === "duplicate") return makeMockRedis;
+					if (prop in explicit) return explicit[prop];
+					return async () => null;
+				},
+			},
+		);
+	function MockRedis(): object {
+		return makeMockRedis();
+	}
+	return { Redis: MockRedis, default: MockRedis };
+});
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+const ENCRYPTION_KEY = Buffer.alloc(32, 7).toString("base64");
+
+/** A single-replica deployment with every shared store on memory, grants off. */
+const BASE_ENV: Readonly<Record<string, string>> = {
+	OAUTH_JWT_ALGORITHM: "HS256",
+	OAUTH_JWT_SECRET: "federation-grants-composition.at-least-32-bytes.ok",
+	OAUTH_JWT_ISSUER: "https://auth.test",
+	SESSION_SECRET: "federation-grants-composition-session.at-least-32-bytes.ok",
+	SESSION_SECURE: "false",
+	SESSION_NAME: "auth.session",
+	SESSION_STORAGE_TYPE: "memory",
+	CLIENT_USER_TYPE: "yaml",
+	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
+	USER_SESSION_STORES_ADAPTER: "memory",
+	RATE_LIMITER_ADAPTER: "memory",
+	OAUTH_CODE_ADAPTER: "memory",
+	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+	REPLAY_SEEN_SET_ADAPTER: "memory",
+	FEDERATION_TOKEN_STORE_TYPE: "memory",
+	CONSENT_STORE_ADAPTER: "none",
+	FEDERATION_GRANT_STORE_ADAPTER: "memory",
+	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+};
+
+/** The umbrella E2E's shape: every shared store on Redis, more than one replica. */
+const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
+	...BASE_ENV,
+	DEPLOYMENT_MODE: "multi",
+	SESSION_STORAGE_TYPE: "redis",
+	SESSION_STORAGE_REDIS_URL: "redis://redis.test:6379",
+	USER_SESSION_STORES_ADAPTER: "redis",
+	RATE_LIMITER_ADAPTER: "redis",
+	OAUTH_CODE_ADAPTER: "redis",
+	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
+	REPLAY_SEEN_SET_ADAPTER: "redis",
+	FEDERATION_TOKEN_STORE_TYPE: "redis",
+	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
+	CONSENT_STORE_ADAPTER: "redis",
+	FEDERATION_GRANT_STORE_ADAPTER: "redis",
+	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "redis",
+};
+
+/** What enabling the feature adds: the switch, and the page boot requires. */
+const GRANTS_ON: Readonly<Record<string, string>> = {
+	FEDERATION_GRANTS_ENABLED: "true",
+	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
+};
+
+function resolveConfig(env: Record<string, string>): AppConfig {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
+	const config = validate(
+		parseFile(envConfPath, { env })
+			.withFallback(parseFile(applicationConfPath, { env }))
+			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
+		AppConfigSchema,
+	);
+	// The key ring has no environment form (a list of { id, key } is HOCON's);
+	// the Redis grant store refuses to construct without one under "required".
+	return {
+		...config,
+		federationGrants: {
+			...config.federationGrants,
+			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
+		},
+	} as AppConfig;
+}
+
+const testRepositoriesModule = defineModule({
+	name: "test:repositories",
+	provides: {
+		clientRepository: () => new InMemoryClientRepository(new Map()),
+		userRepository: () => new InMemoryUserRepository(new Map()),
+	},
+});
+
+const testKeyStoreModule = defineModule({
+	name: "test:key-store",
+	requires: ["config"] as const,
+	provides: {
+		keyStore: async ({ config: c }) => {
+			const factory = createKeyStoreFactory();
+			registerBuiltinKeyStores(factory);
+			return factory.create({
+				type: "local",
+				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+			});
+		},
+	},
+});
+
+const modulesFor = (config: AppConfig, memoryOnly = false, environment?: string) =>
+	buildModules(config, {
+		keyStoreModule: testKeyStoreModule,
+		repositoriesModule: testRepositoriesModule,
+		...(memoryOnly ? { refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule] } : {}),
+		...(environment === undefined ? {} : { environment }),
+	});
+
+const boot = (config: AppConfig, memoryOnly = false, environment?: string) =>
+	createApp({
+		modules: modulesFor(config, memoryOnly, environment),
+		bootstrapComponents: { config, pathResolver: (s) => s },
+	});
+
+const names = (config: AppConfig, memoryOnly = false) =>
+	modulesFor(config, memoryOnly).map((m) => m.name);
+
+const GRANT_MODULES = [
+	"federation-grants",
+	"federation-grant-background",
+	"core-federation-grant-store-memory",
+	"core-federation-grant-intent-store-memory",
+	"redis-federation-grant-store",
+	"redis-federation-grant-intent-store",
+	"subject-revocation-service",
+];
+
+/** The message of a boot failure and of the module error it wraps, together. */
+const messageChain = (err: unknown): string => {
+	const e = err as { message?: string; cause?: { message?: string } };
+	return `${e.message ?? ""} ${e.cause?.message ?? ""}`;
+};
+
+describe("#593 slice 7: the standalone composes federation grants from its config", () => {
+	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
+
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	it("installs nothing of the feature while it is off, whatever the switches say", async () => {
+		// Off is the default, and off must cost nothing: no store, no socket, no
+		// boot requirement a deployment that never asked for grants would meet.
+		const config = resolveConfig({ ...BASE_ENV, FEDERATION_GRANT_STORE_ADAPTER: "redis" });
+		const installed = names(config, true);
+		for (const name of GRANT_MODULES) expect(installed).not.toContain(name);
+		expect(installed).not.toContain("standalone:redis-clients");
+
+		handleRef = await boot(config, true);
+		const app = express().use(handleRef.router);
+		expect((await request(app).post("/oauth/federation-grants/g/status")).status).toBe(404);
+	});
+
+	it("boots on memory stores with no connection, and mounts the routes", async () => {
+		const config = resolveConfig({ ...BASE_ENV, ...GRANTS_ON });
+		const installed = names(config, true);
+		expect(installed).toEqual(
+			expect.arrayContaining([
+				"federation-grant-background",
+				"federation-grants",
+				"core-federation-grant-store-memory",
+				"core-federation-grant-intent-store-memory",
+				"subject-revocation-service",
+			]),
+		);
+		expect(installed).not.toContain("redis-federation-grant-store");
+		expect(installed).not.toContain("redis-federation-grant-intent-store");
+		// Listed ahead of oauthModule, as the template writes them — the
+		// template's choice, since each module parses its own bodies and the
+		// order no longer changes that; the browser half sits after the
+		// session middleware by its own `after`.
+		expect(installed.indexOf("federation-grants")).toBeLessThan(installed.indexOf("oauth"));
+
+		handleRef = await boot(config, true);
+		const app = express().use(handleRef.router);
+		// Mounted: the JSON router answers for itself (client authentication),
+		// not express's 404.
+		expect((await request(app).post("/oauth/federation-grants/g/status")).status).toBe(401);
+		expect(handleRef.components.subjectRevocationService).toBeDefined();
+	});
+
+	it("selects the Redis stores under the all-Redis environment, provides their clients, and boots under multi", async () => {
+		const config = resolveConfig({ ...ALL_REDIS_ENV, ...GRANTS_ON });
+		const modules = modulesFor(config);
+		const installed = modules.map((m) => m.name);
+		expect(installed).toEqual(
+			expect.arrayContaining([
+				"redis-federation-grant-store",
+				"redis-federation-grant-intent-store",
+			]),
+		);
+		expect(installed).not.toContain("core-federation-grant-store-memory");
+		expect(installed).not.toContain("core-federation-grant-intent-store-memory");
+		const clients = modules.find((m) => m.name === "standalone:redis-clients");
+		expect(Object.keys(clients?.provides ?? {})).toEqual(
+			expect.arrayContaining(["federationGrantStoreClient", "federationGrantIntentStoreClient"]),
+		);
+
+		handleRef = await boot(config);
+		expect(handleRef.components.federationGrantStore?.kind).toBe("redis");
+	});
+
+	it("gives cleanup the documented 45 seconds under the shipped budgets, and nothing while off", () => {
+		// The allowance is derived from reference.conf's budgets; if those move,
+		// the number every README states moves with them, and this says so.
+		expect(cleanupAllowanceFor(resolveConfig({ ...BASE_ENV, ...GRANTS_ON }))).toEqual({
+			cleanupTimeoutMs: FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS,
+		});
+		expect(cleanupAllowanceFor(resolveConfig(BASE_ENV))).toEqual({});
+	});
+
+	it("adds the shared Redis client for the grant stores alone", () => {
+		// Every other adapter on memory and the RT family store overridden: only
+		// the two grant switches ask for Redis, and that is enough.
+		const config = resolveConfig({
+			...BASE_ENV,
+			...GRANTS_ON,
+			FEDERATION_GRANT_STORE_ADAPTER: "redis",
+			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "redis",
+		});
+		expect(names(config, true)).toContain("standalone:redis-clients");
+	});
+
+	it.each([
+		["FEDERATION_GRANT_STORE_ADAPTER", "core-federation-grant-store-memory"],
+		["FEDERATION_GRANT_INTENT_STORE_ADAPTER", "core-federation-grant-intent-store-memory"],
+	])("%s=memory is refused under multi, naming %s", async (variable, module) => {
+		const config = resolveConfig({ ...ALL_REDIS_ENV, ...GRANTS_ON, [variable]: "memory" });
+		await expect(boot(config)).rejects.toMatchObject({
+			name: "BootError",
+			reason: "replica-unsafe-adapter",
+			details: { modules: [module] },
+		});
+	});
+
+	it("refuses Redis grants beside memory user-session stores, naming the boundary (D13)", async () => {
+		// The grants would outlive the process; the boundary that ends them
+		// would not. The routes module refuses the pairing on a single replica
+		// too, and its message names the remedy.
+		const config = resolveConfig({
+			...BASE_ENV,
+			...GRANTS_ON,
+			FEDERATION_GRANT_STORE_ADAPTER: "redis",
+			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+		});
+		let error: unknown;
+		try {
+			handleRef = await boot(config);
+		} catch (caught) {
+			error = caught;
+		}
+		expect(messageChain(error)).toMatch(/subject boundary is kept in "memory"/);
+	});
+
+	it("hands the Redis grant store the environment the config was selected by, so its plaintext guard reads it (#473)", async () => {
+		// The federation-token store's guard reads `environment` beside
+		// NODE_ENV so that CONFIG_ENV=production is production to it; the grant
+		// store's must too, or a deployment selecting its config by CONFIG_ENV
+		// with NODE_ENV unset would keep its refresh tokens in plaintext.
+		const config = resolveConfig({
+			...BASE_ENV,
+			...GRANTS_ON,
+			USER_SESSION_STORES_ADAPTER: "redis",
+			FEDERATION_GRANT_STORE_ADAPTER: "redis",
+			FEDERATION_GRANTS_ENCRYPTION_MODE: "allow-plaintext",
+		});
+		let error: unknown;
+		try {
+			handleRef = await boot(config, false, "production");
+		} catch (caught) {
+			error = caught;
+		}
+		expect(messageChain(error)).toMatch(/federation-grants[\s\S]*allow-plaintext[\s\S]*production/);
+		// The same config under the test environment boots: it is the name that
+		// selected the config, not a hard refusal of plaintext.
+		handleRef = await boot(config);
+		expect(handleRef.components.federationGrantStore?.kind).toBe("redis");
+	});
+
+	it("keeps Redis grants beside memory intents on a single replica", async () => {
+		// A restart loses flows in progress and no established grant.
+		const config = resolveConfig({
+			...BASE_ENV,
+			...GRANTS_ON,
+			USER_SESSION_STORES_ADAPTER: "redis",
+			FEDERATION_GRANT_STORE_ADAPTER: "redis",
+			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+		});
+		handleRef = await boot(config);
+		expect(handleRef.components.federationGrantStore?.kind).toBe("redis");
+		expect(names(config)).toContain("core-federation-grant-intent-store-memory");
+	});
+});
+
+describe("the browser consent route parses its own body, with sessionModule listed ahead of it", () => {
+	// `sessionModule`'s routers are mounted at `/session`, the prefix the
+	// federation grants browser half mounts under too. Their parsers ran for
+	// every request beneath `/session`, so with `sessionModule` listed first
+	// the consent route's body arrived parsed — past its 16 KiB bound, its
+	// throttle-then-parse order and its JSON refusals.
+	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
+
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	/** The standalone's modules, with `sessionModule` moved ahead of the grant modules. */
+	const sessionFirst = (config: AppConfig) => {
+		const modules = modulesFor(config, true);
+		const session = modules.find((m) => m.name === "session");
+		if (session === undefined) throw new Error("sessionModule is not in the standalone's list");
+		const rest = modules.filter((m) => m !== session);
+		const at = rest.findIndex((m) => m.name.startsWith("federation-grant"));
+		return [...rest.slice(0, at), session, ...rest.slice(at)];
+	};
+
+	const bootSessionFirst = async () => {
+		const config = resolveConfig({ ...BASE_ENV, ...GRANTS_ON });
+		handleRef = await createApp({
+			modules: sessionFirst(config),
+			bootstrapComponents: { config, pathResolver: (s) => s },
+		});
+		return express().use(handleRef.router);
+	};
+
+	const CONSENT = "/session/federation-grants/consent";
+
+	it("refuses a body over 16 KiB with the route's own 413", async () => {
+		const app = await bootSessionFirst();
+
+		const res = await request(app)
+			.post(CONSENT)
+			.set("Content-Type", "application/json")
+			.send(JSON.stringify({ challenge: "c", decision: "accept", pad: "a".repeat(40 * 1024) }));
+
+		expect(res.status).toBe(413);
+		expect(res.body).toEqual({ error: "invalid_request", error_description: "body_too_large" });
+	});
+
+	it("refuses malformed JSON with the route's own 400", async () => {
+		const app = await bootSessionFirst();
+
+		const res = await request(app)
+			.post(CONSENT)
+			.set("Content-Type", "application/json")
+			.send("{not json");
+
+		expect(res.status).toBe(400);
+		expect(res.body).toEqual({ error: "invalid_request", error_description: "malformed_body" });
+		expect(res.headers["cache-control"]).toContain("no-store");
+	});
+});