@o3co/create-auth-provider 0.15.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/post-logout-redirect.test.mts

@@ -0,0 +1,183 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * A logout's `post_logout_redirect_uri` reaches the upstream federation's
+ * end-session call only once it has matched one of the client's registered
+ * `postLogoutRedirectUris` — at `/oauth/logout` and at
+ * `POST /oauth/federation/:name/logout` alike.
+ *
+ * Google publishes no end-session endpoint, and without one configured its
+ * adapter sends the browser straight to the `postLogoutRedirectUri` it is
+ * handed: unchecked, a caller's own fresh id_token would make this provider's
+ * origin answer `303` to any site. With an end-session endpoint configured,
+ * an unchecked value would be forwarded to the upstream instead. The real
+ * Google adapter is composed (`google-session.fixture.mts`), so the redirect
+ * asserted is the one a browser would follow.
+ */
+
+import type express from "express";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	type GoogleSession,
+	type GoogleWiring,
+	idTokenHint,
+	REGISTERED_POST_LOGOUT_REDIRECT_URI as REGISTERED,
+	signInLinkedToGoogle,
+} from "./google-session.fixture.mjs";
+
+const UNREGISTERED = "https://evil.example/landing";
+const GOOGLE_LOGOUT = "https://accounts.google.com/Logout";
+const UPSTREAM_END_SESSION = "https://idp-logout.example/end-session";
+const UPSTREAM_ID_TOKEN = "upstream-id-token";
+
+/** Google's end-session endpoint, where a deployment names one. */
+const WITH_END_SESSION: GoogleWiring = { endSessionEndpoint: UPSTREAM_END_SESSION };
+
+describe("a logout's post_logout_redirect_uri reaches the upstream only once it is registered", () => {
+	let session: GoogleSession | undefined;
+
+	afterEach(async () => {
+		await session?.dispose();
+		session = undefined;
+	});
+
+	/** Alice signed in, with Google linked and its id_token held for the end-session call. */
+	async function signedInWithGoogle(google: GoogleWiring): Promise<GoogleSession> {
+		session = await signInLinkedToGoogle({
+			google,
+			tokens: {
+				accessToken: "upstream-access-token",
+				expiresAt: null,
+				refreshToken: undefined,
+				idToken: UPSTREAM_ID_TOKEN,
+				tokenType: "Bearer",
+				scope: undefined,
+				grantedScope: undefined,
+				obtainedAt: undefined,
+			},
+		});
+		return session;
+	}
+
+	const rpLogout = (app: express.Express, sid: string, postLogoutRedirectUri: string) =>
+		request(app)
+			.get("/oauth/logout")
+			.query({
+				id_token_hint: idTokenHint(sid),
+				post_logout_redirect_uri: postLogoutRedirectUri,
+				state: "s-1",
+			});
+
+	const federationLogout = (
+		app: express.Express,
+		accessToken: string,
+		postLogoutRedirectUri: string,
+	) =>
+		request(app)
+			.post("/oauth/federation/google/logout")
+			.set("Authorization", `Bearer ${accessToken}`)
+			.type("form")
+			.send({ post_logout_redirect_uri: postLogoutRedirectUri, state: "s-1" });
+
+	describe("GET /oauth/logout, Google with no end-session endpoint", () => {
+		it("does not send the browser to an unregistered post_logout_redirect_uri", async () => {
+			const { app, sid, userSessionStore } = await signedInWithGoogle("shipped");
+
+			const res = await rpLogout(app, sid, UNREGISTERED);
+
+			expect(res.status).toBe(303);
+			expect(new URL(res.headers.location as string).origin).not.toBe("https://evil.example");
+			// Google's own logout page: the adapter's answer when it is handed no
+			// redirect target, which is what an unregistered one becomes.
+			expect(res.headers.location).toBe(`${GOOGLE_LOGOUT}?state=s-1`);
+			// The logout itself still happened.
+			expect(await userSessionStore.get(sid)).toBeNull();
+		});
+
+		it("still returns the browser to a registered post_logout_redirect_uri, with state", async () => {
+			const { app, sid, userSessionStore } = await signedInWithGoogle("shipped");
+
+			const res = await rpLogout(app, sid, REGISTERED);
+
+			expect(res.status).toBe(303);
+			expect(res.headers.location).toBe(`${REGISTERED}?state=s-1`);
+			expect(await userSessionStore.get(sid)).toBeNull();
+		});
+	});
+
+	describe("GET /oauth/logout, Google with a configured end-session endpoint", () => {
+		it("does not forward an unregistered post_logout_redirect_uri to the upstream", async () => {
+			const { app, sid } = await signedInWithGoogle(WITH_END_SESSION);
+
+			const res = await rpLogout(app, sid, UNREGISTERED);
+
+			expect(res.status).toBe(303);
+			const location = new URL(res.headers.location as string);
+			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
+			expect(location.searchParams.get("id_token_hint")).toBe(UPSTREAM_ID_TOKEN);
+			expect(location.searchParams.has("post_logout_redirect_uri")).toBe(false);
+			expect(res.headers.location).not.toContain("evil.example");
+		});
+
+		it("forwards a registered one", async () => {
+			const { app, sid } = await signedInWithGoogle(WITH_END_SESSION);
+
+			const res = await rpLogout(app, sid, REGISTERED);
+
+			expect(res.status).toBe(303);
+			const location = new URL(res.headers.location as string);
+			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
+			expect(location.searchParams.get("post_logout_redirect_uri")).toBe(REGISTERED);
+			expect(location.searchParams.get("state")).toBe("s-1");
+		});
+	});
+
+	describe("POST /oauth/federation/google/logout", () => {
+		it("does not send the browser to an unregistered post_logout_redirect_uri", async () => {
+			const { app, sid, accessToken, sessionFederationIndex } = await signedInWithGoogle("shipped");
+
+			const res = await federationLogout(app, accessToken, UNREGISTERED);
+
+			expect(res.status).toBe(303);
+			expect(new URL(res.headers.location as string).origin).not.toBe("https://evil.example");
+			expect(res.headers.location).toBe(`${GOOGLE_LOGOUT}?state=s-1`);
+			// The federation was disconnected all the same.
+			expect(await sessionFederationIndex.listFederations(sid)).not.toContain("google");
+		});
+
+		it("still returns the browser to one registered for the token's client", async () => {
+			const { app, accessToken } = await signedInWithGoogle("shipped");
+
+			const res = await federationLogout(app, accessToken, REGISTERED);
+
+			expect(res.status).toBe(303);
+			expect(res.headers.location).toBe(`${REGISTERED}?state=s-1`);
+		});
+
+		it("does not forward an unregistered one to a configured end-session endpoint", async () => {
+			const { app, accessToken } = await signedInWithGoogle(WITH_END_SESSION);
+
+			const res = await federationLogout(app, accessToken, UNREGISTERED);
+
+			expect(res.status).toBe(303);
+			const location = new URL(res.headers.location as string);
+			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
+			expect(location.searchParams.has("post_logout_redirect_uri")).toBe(false);
+		});
+	});
+});

package/templates/standalone/src/__tests__/redis-connection-error-log.test.mts

@@ -0,0 +1,135 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * What the template's shared Redis connection logs when the server refuses
+ * it: the real ioredis the template ships, against a TCP server that answers
+ * the way Redis answers a password it no longer accepts. ioredis puts the
+ * handshake it sent — `AUTH` and the password — on the error it emits, so
+ * the `error` listener must log core's `loggableError` projection, never
+ * the error. The logger here serialises every own property of what it is
+ * handed, as a deployment's logger may.
+ */
+
+import { once } from "node:events";
+import { type AddressInfo, createServer, type Socket } from "node:net";
+import type { LifecycleRegistrar, Logger } from "@o3co/auth-provider-core";
+import { describe, expect, it, vi } from "vitest";
+import { standaloneRedisClientsModule } from "#/modules.mjs";
+
+/** Redis's reply to a handshake whose password it does not accept. */
+const WRONGPASS = "-WRONGPASS invalid username-password pair or user is disabled.\r\n";
+
+/** The password the deployment is configured with, and the server no longer takes. */
+const STALE_PASSWORD = "stale-s3cret-redis-password";
+
+/** A TCP server that answers everything sent to it as Redis answers a refused password. */
+async function refusingRedis(): Promise<{ port: number; close: () => Promise<void> }> {
+	const sockets = new Set<Socket>();
+	const server = createServer((socket) => {
+		sockets.add(socket);
+		socket.on("close", () => sockets.delete(socket));
+		socket.on("data", () => {
+			socket.write(WRONGPASS);
+		});
+	});
+	server.listen(0, "127.0.0.1");
+	await once(server, "listening");
+	const { port } = server.address() as AddressInfo;
+	return {
+		port,
+		close: async () => {
+			for (const socket of sockets) socket.destroy();
+			await new Promise<void>((resolve) => server.close(() => resolve()));
+		},
+	};
+}
+
+/**
+ * A logger that serialises every own property of what it is handed, `cause`
+ * and non-enumerable fields included. `lines` is what it wrote; its levels
+ * are spies.
+ */
+const serialiseEverythingLogger = () => {
+	const lines: string[] = [];
+	const walk = (value: unknown, seen = new WeakSet<object>()): unknown => {
+		if (typeof value !== "object" || value === null) return value;
+		if (seen.has(value)) return "[circular]";
+		seen.add(value);
+		const out: Record<string, unknown> = {};
+		for (const key of Object.getOwnPropertyNames(value)) {
+			out[key] = walk((value as Record<string, unknown>)[key], seen);
+		}
+		return out;
+	};
+	const record = (level: string) =>
+		vi.fn((...args: unknown[]): void => {
+			lines.push(JSON.stringify({ level, args: walk(args) }));
+		});
+	const logger = {
+		trace: record("trace"),
+		debug: record("debug"),
+		info: record("info"),
+		warn: record("warn"),
+		error: record("error"),
+		fatal: record("fatal"),
+		child: () => logger,
+	};
+	return { logger: logger as typeof logger & Logger, lines };
+};
+
+describe("standaloneRedisClientsModule: the shared connection refused by the server", () => {
+	it("logs the connection's error as loggableError's projection, never the AUTH arguments ioredis puts on it", async () => {
+		const redis = await refusingRedis();
+		const cleanups: Array<() => Promise<void>> = [];
+		const lifecycleRegistrar: LifecycleRegistrar = {
+			register: (cleanup) => {
+				cleanups.push(cleanup);
+			},
+		};
+		const { logger, lines } = serialiseEverythingLogger();
+		const provides = (
+			standaloneRedisClientsModule as unknown as {
+				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
+			}
+		).provides;
+		try {
+			await provides.refreshTokenFamilyClient({
+				section: { url: `redis://127.0.0.1:${redis.port}`, password: STALE_PASSWORD },
+				lifecycleRegistrar,
+				logger,
+			});
+			await vi.waitFor(() => expect(logger.error).toHaveBeenCalled(), { timeout: 10_000 });
+		} finally {
+			// `io.quit()`, as `handle.dispose()` runs it.
+			await Promise.all(cleanups.map((cleanup) => cleanup().catch(() => {})));
+			await redis.close();
+		}
+
+		expect(logger.error).toHaveBeenCalledWith(
+			{
+				err: expect.objectContaining({
+					name: "ReplyError",
+					detail: expect.stringMatching(/^WRONGPASS /),
+					// Which command the server refused, and nothing it carried.
+					command: { name: "hello" },
+				}),
+			},
+			"standalone_redis_clients_error",
+		);
+		for (const line of lines) expect(line).not.toContain(STALE_PASSWORD);
+	});
+});

package/templates/standalone/src/__tests__/redis-rate-limiter-config-survives.test.mts

@@ -15,83 +15,82 @@
  */
 
 /**
- * #495 / #496 — end to end, through this template's real resolution chain.
- *
- * `app.mts` resolves `{env}.conf → application.conf → reference.conf` and
- * validates the result with `AppConfigSchema` before `buildModules` runs.
- * The schema strips what it does not declare, so a section declared by a
- * module rather than by core used to vanish at exactly that step — and,
- * because `redisRateLimiterModule.configSchema` carries a
- * `.default({ limit: 60, windowSeconds: 60 })`, the deployment that
- * `docker-compose.production.yml` ships (`RATE_LIMITER_ADAPTER: redis`) then
- * ran on 60 requests / 60 s no matter what the operator wrote.
- *
- * This starts from the shipped configuration, adds the two overrides an
- * operator writes in their own `application.conf` layer, and follows them all
- * the way to the limiter the module builds.
+ * Sections declared by a module rather than by core (`redis-rate-limiter`,
+ * `mtls`) survive this template's real resolution chain, end to end.
+ * Starting from the shipped configuration plus an operator's own layer, the
+ * overrides are followed through both configuration phases and `createApp`
+ * to the limiter the module builds. Were `redis-rate-limiter` lost, the
+ * module's default of 60 requests / 60 s would apply to the deployment
+ * `docker-compose.production.yml` ships (`ADAPTERS_RATE_LIMITER: redis`)
+ * whatever the operator wrote.
  */
 
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { type AppConfig, AppConfigSchema, type RateLimiter } from "@o3co/auth-provider-core";
+import {
+	type AppConfig,
+	createApp,
+	defineModule,
+	type RateLimiter,
+} from "@o3co/auth-provider-core";
 import { redisRateLimiterModule } from "@o3co/auth-provider-redis";
-import { parseFile, parseString } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
-import { describe, expect, it } from "vitest";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "../configPath.mjs";
+import { loggingModule } from "../modules.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 
 /**
  * The secrets `application.conf` substitutes, plus the one
  * `docker-compose.production.yml` sets to put the OAuth endpoints behind a
- * shared limiter. Test-only values; #282's entropy floor applies to the two
+ * shared limiter. Test-only values; the entropy floor applies to the two
  * secrets, and the `.` characters keep them out of the base64 alphabet so the
  * UTF-8 length is what counts.
  */
 const ENV = {
-	OAUTH_JWT_SECRET: "test-secret-rate-limiter-e2e.at-least-32-bytes.ok",
+	KEY_STORE_LOCAL_SECRET: "test-secret-rate-limiter-e2e.at-least-32-bytes.ok",
 	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_SECRET: "test-session-secret-rate-limiter-e2e.at-least-32-bytes.ok",
-	RATE_LIMITER_ADAPTER: "redis",
+	SESSION_STORE_SECRET: "test-session-secret-rate-limiter-e2e.at-least-32-bytes.ok",
+	ADAPTERS_RATE_LIMITER: "redis",
+	MFA_MODE: "off",
 };
 
 /**
  * What an operator adds to their own `application.conf` layer: per-endpoint
  * budgets for the Redis limiter, and the mTLS posture from
  * `@o3co/auth-provider-mtls`. Neither section appears in anything this
- * template ships, which is why neither was ever covered by a `.conf` diff.
+ * template ships.
  */
 const OPERATOR_OVERRIDES = `
-redisRateLimiter {
+redis-rate-limiter {
   limits {
     token { limit = 120, windowSeconds = 60 }
     authorize { limit = 30, windowSeconds = 60 }
   }
 }
 
-oauth.mtls {
+mtls {
   enabled = true
   mode = "full-pki"
-  trusted-cas = ["-----BEGIN CERTIFICATE-----"]
-  full-pki {
+  trustedCas = ["-----BEGIN CERTIFICATE-----"]
+  fullPki {
     revocation {
       mode = "crl"
-      on-unavailable = "reject"
-      allowed-hosts = ["crl.example.com"]
+      onUnavailable = "reject"
+      allowedHosts = ["crl.example.com"]
     }
   }
 }
 `;
 
-function resolveShippedConfig(): AppConfig {
+/** The composition's own files: the operator's layer over the shipped production ones. */
+function ownFiles(): string[] {
+	const operator = join(mkdtempSync(join(tmpdir(), "redis-rate-limiter-")), "operator.conf");
+	writeFileSync(operator, OPERATOR_OVERRIDES);
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return validate(
-		parseString(OPERATOR_OVERRIDES, { env: ENV })
-			.withFallback(parseFile(envConfPath, { env: ENV }))
-			.withFallback(parseFile(applicationConfPath, { env: ENV }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: ENV })),
-		AppConfigSchema,
-	);
+	return [operator, envConfPath, applicationConfPath];
 }
 
 /** Counts one request per key, the way an untouched Redis counter would. */
@@ -99,79 +98,111 @@ function makeCountingClient(): { incrementWithTtl: (key: string, ttl: number) =>
 	return { incrementWithTtl: async () => 1 };
 }
 
-function buildLimiter(config: AppConfig): RateLimiter {
-	const provides = (
-		redisRateLimiterModule as unknown as {
-			provides: Record<string, (deps: Record<string, unknown>) => RateLimiter>;
-		}
-	).provides;
-	const provider = provides.rateLimiter;
-	if (!provider) throw new Error("redisRateLimiterModule no longer provides rateLimiter");
-	return provider({ config, rateLimiterClient: makeCountingClient() });
+/** The limiter a consumer of the slot is handed, as a route module would be. */
+let consumed: RateLimiter | undefined;
+const consumerModule = defineModule({
+	name: "test:rate-limiter-consumer",
+	requires: ["rateLimiter"] as const,
+	contributes: {
+		grantMiddleware: [
+			({ rateLimiter }) => {
+				consumed = rateLimiter;
+				return null;
+			},
+		],
+	},
+});
+
+/** The shipped configuration through both phases, booted with the Redis limiter's module. */
+async function bootShipped() {
+	const own = readOwnLayers(ownFiles(), { env: ENV });
+	const switches = readSwitches(own);
+	const modules = [redisRateLimiterModule, consumerModule];
+	return {
+		switches,
+		handle: await createApp({
+			modules,
+			bootstrapComponents: {
+				// The template's own reference too, which its application.conf is layered over.
+				config: resolveForBoot(own, [...modules, loggingModule], switches),
+				pathResolver: (s: string) => s,
+				rateLimiterClient: makeCountingClient() as never,
+			},
+		}),
+	};
 }
 
-describe("the shipped configuration reaches the Redis rate limiter (#495)", () => {
-	const config = resolveShippedConfig();
+let booted: Awaited<ReturnType<typeof bootShipped>>;
+let config: AppConfig;
+let limiter: RateLimiter;
+
+beforeAll(async () => {
+	booted = await bootShipped();
+	const parsed = booted.handle.components.config;
+	const built = consumed;
+	if (parsed === undefined || built === undefined) {
+		throw new Error("the boot filled no config, or handed no consumer the limiter");
+	}
+	config = parsed;
+	limiter = built;
+});
 
-	it("selects the Redis adapter the production compose file pins", () => {
-		expect(config.rateLimiter?.adapter).toBe("redis");
+afterAll(async () => {
+	await booted?.handle.dispose();
+});
+
+describe("the shipped configuration reaches the Redis rate limiter", () => {
+	it("selects the Redis adapter the production compose file pins, in phase one", () => {
+		expect(booted.switches.adapters.rateLimiter).toBe("redis");
 	});
 
-	it("carries the operator's per-endpoint budgets through the pre-parse", () => {
-		expect(config.redisRateLimiter?.limits).toEqual({
+	it("carries the operator's per-endpoint budgets through boot's parse", () => {
+		expect(
+			(config as unknown as Record<string, { limits?: unknown }>)["redis-rate-limiter"]?.limits,
+		).toEqual({
 			token: { limit: 120, windowSeconds: 60 },
 			authorize: { limit: 30, windowSeconds: 60 },
 		});
 	});
 
 	it("applies the declared budget at /token", async () => {
-		const decision = await buildLimiter(config).check("token:ip:203.0.113.5", {
-			ip: "203.0.113.5",
-		});
+		const decision = await limiter.check("token:ip:203.0.113.5", { ip: "203.0.113.5" });
 		expect(decision.limit).toBe(120);
 	});
 
 	it("applies the declared budget at /authorize", async () => {
-		const decision = await buildLimiter(config).check("authorize:ip:203.0.113.5", {
-			ip: "203.0.113.5",
-		});
+		const decision = await limiter.check("authorize:ip:203.0.113.5", { ip: "203.0.113.5" });
 		expect(decision.limit).toBe(30);
 	});
 
 	it("still falls back to the module's default where nothing is declared", async () => {
-		// The point of the assertion above: 60 is what EVERY endpoint got while
-		// the section was stripped, so a test that only saw 60 could not tell a
-		// working configuration from a lost one.
-		const decision = await buildLimiter(config).check("introspect:ip:203.0.113.5", {
-			ip: "203.0.113.5",
-		});
+		// 60 is what every endpoint would get were the section stripped, so the
+		// budgets above differ from it to tell a working configuration from a
+		// lost one.
+		const decision = await limiter.check("introspect:ip:203.0.113.5", { ip: "203.0.113.5" });
 		expect(decision.limit).toBe(60);
 	});
 
-	it("keeps seeding /session/login from rateLimit.login", async () => {
-		// `resolveSeededLimitSpecs` reads a declared section, so this worked
-		// even while `redisRateLimiter` was being stripped — which is why the
-		// defect showed up only at the endpoints below it.
-		const decision = await buildLimiter(config).check("login:ip:203.0.113.5", {
-			ip: "203.0.113.5",
-		});
-		expect(decision.limit).toBe(config.rateLimit?.login.limit);
+	it("applies no login budget without the session module: session.rateLimit.login is that module's to contribute", async () => {
+		// This boot loads the limiter alone. With the session module, the
+		// limiter applies the budget it contributes from session.rateLimit.login.
+		expect(config.session).toMatchObject({ rateLimit: { login: { limit: 20 } } });
+		const decision = await limiter.check("login:ip:203.0.113.5", { ip: "203.0.113.5" });
+		expect(decision.limit).toBe(60);
 	});
 });
 
-describe("the shipped configuration carries an mTLS posture through (#496)", () => {
-	const config = resolveShippedConfig();
-
+describe("the shipped configuration carries an mTLS posture through", () => {
 	it("keeps the operator's mTLS block instead of reporting mTLS off", () => {
-		expect(config.oauth.mtls).toEqual({
+		expect((config as unknown as { mtls?: unknown }).mtls).toEqual({
 			enabled: true,
 			mode: "full-pki",
-			"trusted-cas": ["-----BEGIN CERTIFICATE-----"],
-			"full-pki": {
+			trustedCas: ["-----BEGIN CERTIFICATE-----"],
+			fullPki: {
 				revocation: {
 					mode: "crl",
-					"on-unavailable": "reject",
-					"allowed-hosts": ["crl.example.com"],
+					onUnavailable: "reject",
+					allowedHosts: ["crl.example.com"],
 				},
 			},
 		});