@o3co/create-auth-provider 0.15.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/federation-grants-survive-logout.test.mts

@@ -15,22 +15,20 @@
  */
 
 /**
- * #593 acceptance criterion 8, at the two HTTP logout endpoints (D14).
- *
- * A federation grant outlives the session it was agreed through. The proof of
- * that used to be a direct call to `cascadeLogout()` — which is the cascade
- * `/oauth/logout` runs, and not what `/session/logout` runs: that endpoint has
- * its own record hygiene (`invalidateSessionRecords`) and reaches the grant
- * store on no path, by construction. A proof of the helper is not a proof of
- * the endpoints. So this drives both, on the standalone, as a deployment
- * composes them: a grant seeded beside a live browser session, the session's
- * records gone afterwards, the grant and its credential exactly as they were,
- * and `/token` still disclosing.
+ * A federation grant outlives the session it was agreed through, at both HTTP
+ * logout endpoints (ADR 2026-09-17-federation-grants-offline-delegation).
+ * `/oauth/logout` runs `cascadeLogout()`; `/session/logout` has its own record
+ * hygiene (`invalidateSessionRecords`) and reaches the grant store on no path,
+ * by construction. A proof of the helper is not a proof of the endpoints, so
+ * this drives both, on the standalone, as a deployment composes them: a grant
+ * seeded beside a live browser session, the session's records gone afterwards,
+ * the grant and its credential exactly as they were, and `/token` still
+ * disclosing.
  *
  * The seeded grant's access token is fresh, so the disclosure is the cached
- * one and no upstream is asked — the OIDC federation the connection names is
- * configured with `discovery = false` and hand-typed endpoints so that the
- * deployment boots without a network.
+ * one and no upstream is asked; the OIDC federation the connection names has
+ * `discovery = false` and hand-typed endpoints so the deployment boots without
+ * a network.
  */
 
 import { createHmac } from "node:crypto";
@@ -44,6 +42,7 @@ import {
 	type FederationTokenStore,
 	federationGrantAuthorizationRevision,
 	federationGrantIdentityRevision,
+	federationsOf,
 	InMemoryClientRepository,
 	InMemoryUserRepository,
 	type MemoryFederationGrantStore,
@@ -57,7 +56,14 @@ import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { resolveConfigPaths, type Switches } from "../configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import {
+	capturedRenames,
+	libraryLayers,
+	rootSectionsOf,
+	sectionsCoreDoesNotDeclare,
+} from "./library-references.fixture.mjs";
 
 const DAY = 86_400_000;
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
@@ -83,69 +89,81 @@ const REFRESH_TOKEN = "SENTINEL-refresh-token";
 const ACCESS_TOKEN = "upstream-access-token";
 
 const ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: JWT_SECRET,
+	// The logout here is a session without a second factor.
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: JWT_SECRET,
 	OAUTH_JWT_ISSUER: ISSUER,
-	SESSION_SECRET: "federation-grants-survive-logout-session.at-least-32-bytes.ok",
-	SESSION_SECURE: "false",
-	SESSION_NAME: "auth.session",
-	SESSION_STORAGE_TYPE: "memory",
-	CLIENT_USER_TYPE: "yaml",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "memory",
-	RATE_LIMITER_ADAPTER: "memory",
-	OAUTH_CODE_ADAPTER: "memory",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-	REPLAY_SEEN_SET_ADAPTER: "memory",
-	FEDERATION_TOKEN_STORE_TYPE: "memory",
-	CONSENT_STORE_ADAPTER: "none",
-	FEDERATION_GRANT_STORE_ADAPTER: "memory",
-	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+	SESSION_STORE_SECRET: "federation-grants-survive-logout-session.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "memory",
+	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+	ADAPTERS_CONSENT_STORE: "none",
+	ADAPTERS_FEDERATION_GRANT_STORE: "memory",
+	ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 	FEDERATION_GRANTS_ENABLED: "true",
 	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
 	// The connect flow is not driven here, and the bundled repository has no
 	// identity lookup; "unsupported" is the declaration a deployment without one
-	// makes (#613), and what lets a connection be configured at all.
+	// makes, and what lets a connection be configured at all.
 	FEDERATION_GRANTS_IDENTITY_LOOKUP: "unsupported",
 };
 
 /**
  * The shipped configuration under the environment above, with the two lists
- * that have no environment form (comment 9 on #593) written over it: the
+ * that have no environment form written over it: the
  * upstream federation the connection names, and the connection.
  */
-function resolveConfig(): AppConfig {
+function resolveConfig(): Switches {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	const config = validate(
-		parseFile(envConfPath, { env: ENV })
-			.withFallback(parseFile(applicationConfPath, { env: ENV }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: ENV })),
-		AppConfigSchema,
-	);
+	const layers = parseFile(envConfPath, { env: ENV })
+		.withFallback(parseFile(applicationConfPath, { env: ENV }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env: ENV }))
+		.withFallback(libraryLayers(ENV));
+	const config = validate(layers, AppConfigSchema);
 	return {
+		...sectionsCoreDoesNotDeclare(layers),
+		...rootSectionsOf(layers, ENV),
 		...config,
-		federations: {
-			...config.federations,
-			upstream: {
-				enabled: true,
-				type: "oidc",
-				issuer: UPSTREAM,
-				clientId: UPSTREAM_CLIENT_ID,
-				clientSecret: "provider-secret",
-				callbackURL: `${ISSUER}/session/oauth/federation/upstream/callback`,
-				scopes: [...SCOPES],
-				discovery: false,
-				endpoints: {
-					authorizationEndpoint: `${UPSTREAM}/authorize`,
-					tokenEndpoint: `${UPSTREAM}/token`,
-					jwksUri: `${UPSTREAM}/jwks`,
+		// What the resolution captured of core's renamed variables, which the
+		// schema's parse drops.
+		"renamed-variables": capturedRenames(ENV),
+		core: {
+			...config.core,
+			federations: {
+				...federationsOf(config),
+				upstream: {
+					enabled: true,
+					type: "oidc",
+					issuer: UPSTREAM,
+					clientId: UPSTREAM_CLIENT_ID,
+					clientSecret: "provider-secret",
+					callbackURL: `${ISSUER}/session/oauth/federation/upstream/callback`,
+					scopes: [...SCOPES],
+					discovery: false,
+					endpoints: {
+						authorizationEndpoint: `${UPSTREAM}/authorize`,
+						tokenEndpoint: `${UPSTREAM}/token`,
+						jwksUri: `${UPSTREAM}/jwks`,
+					},
+					redirectAllowlist: [],
 				},
-				redirectAllowlist: [],
 			},
 		},
-		federationGrants: {
-			...config.federationGrants,
+		"redis-federation-grant-store": {
+			...(config["redis-federation-grant-store"] as object | undefined),
 			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
+		},
+		"federation-grants": {
+			...config["federation-grants"],
 			connections: {
 				[CONNECTION]: {
 					federation: "upstream",
@@ -156,7 +174,7 @@ function resolveConfig(): AppConfig {
 				},
 			},
 		},
-	} as AppConfig;
+	} as Switches;
 }
 
 const testRepositoriesModule = defineModule({
@@ -198,7 +216,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
@@ -236,6 +254,7 @@ async function seedGrant(store: MemoryFederationGrantStore): Promise<void> {
 			consent: { at, sid: "sid-consent", scopes: [...SCOPES] },
 			authorizedAt: at,
 			expiresAt: new Date(at.getTime() + 30 * DAY),
+			resource: undefined,
 		},
 		credentials: {
 			refreshToken: REFRESH_TOKEN,
@@ -244,6 +263,7 @@ async function seedGrant(store: MemoryFederationGrantStore): Promise<void> {
 				tokenType: "Bearer",
 				obtainedAt: at,
 				issuedLifetime: 3600,
+				effectiveExpiresAt: new Date(at.getTime() + 3_600_000),
 				scopes: [...SCOPES],
 			},
 		},
@@ -283,7 +303,7 @@ const claimsOf = (jwt: string): Record<string, unknown> =>
 		unknown
 	>;
 
-describe("#593 AC8: a grant outlives the browser session at both logout endpoints (D14)", () => {
+describe("a grant outlives the browser session at both logout endpoints", () => {
 	let handleRef: Awaited<ReturnType<typeof createApp>> | undefined;
 
 	afterEach(async () => {
@@ -330,7 +350,7 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 		expect(loginRes.status).toBe(200);
 
 		const cookies = loginRes.headers["set-cookie"] as unknown as string[];
-		const csrfCookiePrefix = `${config.session.name}.csrf=`;
+		const csrfCookiePrefix = `${(config["session-store"] as { name: string }).name}.csrf=`;
 		const reissued = cookies
 			.find((c) => c.startsWith(csrfCookiePrefix))
 			?.slice(csrfCookiePrefix.length)
@@ -384,11 +404,19 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 			await boot();
 		const { cookies, csrfToken, headerName } = await login(app, config);
 		const sid = await sidOf(app, cookies);
-		// A session-bound upstream token beside the grant: the record #276's
-		// guarantee is about, keyed by this session.
+		// A session-bound upstream token beside the grant, keyed by this
+		// session: a record logout must end.
 		await federationTokenStore.attach(sid, "upstream", {
 			accessToken: "session-bound-upstream-token",
 			expiresAt: null,
+			// Every field is a required key; this record carries only the
+			// access token.
+			refreshToken: undefined,
+			idToken: undefined,
+			tokenType: undefined,
+			scope: undefined,
+			grantedScope: undefined,
+			obtainedAt: undefined,
 		});
 		expect(await userSessionStore.get(sid)).not.toBeNull();
 		await expectGrantUntouched(app, federationGrantStore);
@@ -399,7 +427,7 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 			.set(headerName, csrfToken);
 		expect([200, 204]).toContain(logout.status);
 
-		// The session-bound records are gone (#276 holds) ...
+		// The session-bound records are gone ...
 		expect(await userSessionStore.get(sid)).toBeNull();
 		expect(await federationTokenStore.get(sid, "upstream")).toBeNull();
 		// ... and the grant is not among them.
@@ -414,6 +442,14 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 		await federationTokenStore.attach(sid, "upstream", {
 			accessToken: "session-bound-upstream-token",
 			expiresAt: null,
+			// Every field is a required key; this record carries only the
+			// access token.
+			refreshToken: undefined,
+			idToken: undefined,
+			tokenType: undefined,
+			scope: undefined,
+			grantedScope: undefined,
+			obtainedAt: undefined,
 		});
 		expect(await userSessionStore.get(sid)).not.toBeNull();
 		await expectGrantUntouched(app, federationGrantStore);

package/templates/standalone/src/__tests__/federation-token-refresh-outage.test.mts

@@ -0,0 +1,135 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * `POST /oauth/federation/:name/token` ends a session's upstream tokens only
+ * on the upstream's own verdict that the refresh token is bad (a structured
+ * `invalid_grant` under a 4xx), and never while the upstream is down, whatever
+ * the body of its 5xx says. An outage is `503`, and the tokens are kept for
+ * the retry.
+ *
+ * Driven through the real Google adapter and its library (openid-client)
+ * against a fake Google (`createFakeIdp`), so the errors the route classifies
+ * are the ones the library raises: a 4xx whose body names a code is a
+ * `ResponseBodyError` carrying `error` and `status`; a 5xx is an
+ * `OperationProcessingError` raised over the `Response`, whose body the
+ * library does not read.
+ */
+
+import { createFakeIdp, type FakeIdp } from "@o3co/auth-provider-core/testing";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	accessTokenWithFamily,
+	GOOGLE_CLIENT_ID,
+	type GoogleSession,
+	signInLinkedToGoogle,
+} from "./google-session.fixture.mjs";
+
+const GOOGLE = {
+	issuer: "https://accounts.google.com",
+	authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
+	tokenEndpoint: "https://oauth2.googleapis.com/token",
+	jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
+	userinfoEndpoint: "https://www.googleapis.com/oauth2/v3/userinfo",
+};
+const STORED_REFRESH_TOKEN = "stored-refresh-token";
+
+describe("POST /oauth/federation/google/token: an upstream outage never ends the session's Google tokens", () => {
+	let session: GoogleSession | undefined;
+
+	afterEach(async () => {
+		await session?.dispose();
+		session = undefined;
+	});
+
+	/**
+	 * Alice's session with Google linked, its access token expired so the
+	 * route refreshes, and the fake Google answering the refresh with `status`
+	 * and `body`.
+	 */
+	async function refreshAnswered(status: number, body: Record<string, unknown>) {
+		const idp: FakeIdp = await createFakeIdp({ ...GOOGLE, clientId: GOOGLE_CLIENT_ID });
+		idp.tokenStatus = status;
+		idp.refusal = body;
+		session = await signInLinkedToGoogle({
+			google: { fetch: idp.fetch },
+			tokens: {
+				accessToken: "expired-upstream-access-token",
+				expiresAt: new Date(Date.now() - 60_000),
+				refreshToken: STORED_REFRESH_TOKEN,
+				idToken: undefined,
+				tokenType: "Bearer",
+				scope: "openid profile email",
+				grantedScope: "openid profile email",
+				obtainedAt: undefined,
+			},
+		});
+		const res = await request(session.app)
+			.post("/oauth/federation/google/token")
+			.set("Authorization", `Bearer ${accessTokenWithFamily(session.sid)}`)
+			.send();
+		// The library did ask Google: what follows is its reading of the answer.
+		expect(
+			idp.requests.filter(
+				(r) =>
+					`${r.url.origin}${r.url.pathname}` === GOOGLE.tokenEndpoint &&
+					r.body?.get("grant_type") === "refresh_token",
+			),
+		).toHaveLength(1);
+		return { res, ...session };
+	}
+
+	it("keeps them and answers 503 when Google answers 503 with a body naming invalid_grant", async () => {
+		const { res, sid, federationTokenStore, sessionFederationIndex } = await refreshAnswered(503, {
+			error: "invalid_grant",
+			error_description: "Backend unavailable",
+		});
+
+		expect(res.status).toBe(503);
+		expect(res.body).toEqual({
+			error: "temporarily_unavailable",
+			error_description: "upstream federation provider temporarily unavailable",
+		});
+		expect((await federationTokenStore.get(sid, "google"))?.refreshToken).toBe(
+			STORED_REFRESH_TOKEN,
+		);
+		expect(await sessionFederationIndex.listFederations(sid)).toContain("google");
+	});
+
+	it("keeps them and answers 503 when Google answers 502 with no OAuth body at all", async () => {
+		const { res, sid, federationTokenStore } = await refreshAnswered(502, {});
+
+		expect(res.status).toBe(503);
+		expect((await federationTokenStore.get(sid, "google"))?.refreshToken).toBe(
+			STORED_REFRESH_TOKEN,
+		);
+	});
+
+	it("ends them on Google's structured 400 invalid_grant", async () => {
+		const { res, sid, federationTokenStore, sessionFederationIndex } = await refreshAnswered(400, {
+			error: "invalid_grant",
+			error_description: "Token has been expired or revoked.",
+		});
+
+		expect(res.status).toBe(410);
+		expect(res.body.error).toBe("re_authentication_required");
+		expect(await federationTokenStore.get(sid, "google")).toBeNull();
+		// The route never writes the session's index: the link, now holding no
+		// credential, stays listed until federation logout or the session's end.
+		expect(await sessionFederationIndex.listFederations(sid)).toContain("google");
+	});
+});

package/templates/standalone/src/__tests__/google-federation-config-module.test.mts

@@ -15,11 +15,10 @@
  */
 
 /**
- * #278: the bridge used to return only `{ clientId, clientSecret, callbackURL }`,
- * dropping the four fields the redirect policy reads. Nothing failed — the
- * policy was simply constructed with an empty config, and the generated app
- * silently ran without a redirect allowlist. These tests fail if the bridge
- * stops forwarding any of them.
+ * The bridge forwards, beside `{ clientId, clientSecret, callbackURL }`, the
+ * four fields the redirect policy reads. A field it dropped would fail nothing
+ * at boot: the policy would be built as if the operator had not configured it.
+ * These tests fail if the bridge stops forwarding any of them.
  */
 
 import type { GoogleProviderConfig } from "@o3co/auth-provider-federation-google";
@@ -34,9 +33,11 @@ const bridge = (
 	}
 ).provides.googleFederationConfig;
 
-/** Runs the bridge over a `federations.google` section in the flat shape. */
+/** Runs the bridge over a `core.federations.google` entry in the flat shape. */
 function buildConfig(googleSection: Record<string, unknown>): GoogleProviderConfig {
-	return bridge({ config: { federations: { google: { enabled: true, ...googleSection } } } });
+	return bridge({
+		config: { core: { federations: { google: { enabled: true, ...googleSection } } } },
+	});
 }
 
 const credentials = {
@@ -45,7 +46,7 @@ const credentials = {
 	callbackURL: "https://auth.example.com/session/oauth/federation/google/callback",
 };
 
-describe("googleFederationConfigModule — redirect-policy plumbing (#278)", () => {
+describe("googleFederationConfigModule — redirect-policy plumbing", () => {
 	it("forwards sessionDomain, authCallbackUrl, clientUrl and redirectAllowlist", () => {
 		const out = buildConfig({
 			...credentials,
@@ -97,13 +98,15 @@ describe("googleFederationConfigModule — redirect-policy plumbing (#278)", ()
 	it("reads through the nested federation shape as well as the flat one", () => {
 		const out = bridge({
 			config: {
-				federations: {
-					google: {
-						enabled: true,
-						type: "google",
-						sessionDomain: ".example.com",
-						redirectAllowlist: ["https://app.example.com/dashboard"],
-						google: credentials,
+				core: {
+					federations: {
+						google: {
+							enabled: true,
+							type: "google",
+							sessionDomain: ".example.com",
+							redirectAllowlist: ["https://app.example.com/dashboard"],
+							google: credentials,
+						},
 					},
 				},
 			},
@@ -113,7 +116,7 @@ describe("googleFederationConfigModule — redirect-policy plumbing (#278)", ()
 	});
 });
 
-describe("googleFederationConfigModule — requireAuthorizationResponseIss (#597)", () => {
+describe("googleFederationConfigModule — requireAuthorizationResponseIss", () => {
 	it("is absent by default, so the provider's own default (required) applies", () => {
 		expect("requireAuthorizationResponseIss" in buildConfig(credentials)).toBe(false);
 	});
@@ -157,14 +160,42 @@ describe("googleFederationConfigModule — requireAuthorizationResponseIss (#597
 
 	it("refuses an empty value, which elsewhere reads as false: exported-but-empty must not switch this check off", () => {
 		expect(() => buildConfig({ ...credentials, requireAuthorizationResponseIss: "" })).toThrow(
-			/federations\.google\.requireAuthorizationResponseIss/,
+			/core\.federations\.google\.requireAuthorizationResponseIss/,
 		);
 	});
 
 	it("refuses anything else: a typo must not silently switch the check off, or leave it on", () => {
 		for (const bad of ["no", "off", 0, 1, []]) {
 			expect(() => buildConfig({ ...credentials, requireAuthorizationResponseIss: bad })).toThrow(
-				/federations\.google\.requireAuthorizationResponseIss/,
+				/core\.federations\.google\.requireAuthorizationResponseIss/,
+			);
+		}
+	});
+});
+
+describe("googleFederationConfigModule — accessType", () => {
+	// federation-google asks every sign-in for consent with offline access, so
+	// every session gets a refresh token; "online" is the operator's way to
+	// keep Google's consent screen to the first sign-in, at the price of no
+	// refresh token at all. A bridge that drops the field leaves the operator
+	// without that choice.
+	it("is absent by default, so the provider's own default (offline) applies", () => {
+		expect("accessType" in buildConfig(credentials)).toBe(false);
+	});
+
+	it("leaves a null accessType absent, never forwarded as null, which the provider refuses", () => {
+		expect("accessType" in buildConfig({ ...credentials, accessType: null })).toBe(false);
+	});
+
+	it("forwards offline and online", () => {
+		expect(buildConfig({ ...credentials, accessType: "online" }).accessType).toBe("online");
+		expect(buildConfig({ ...credentials, accessType: "offline" }).accessType).toBe("offline");
+	});
+
+	it("refuses anything else at boot, naming the key", () => {
+		for (const bad of ["", "offine", "Online", "true", false, 1]) {
+			expect(() => buildConfig({ ...credentials, accessType: bad })).toThrow(
+				/core\.federations\.google\.accessType/,
 			);
 		}
 	});