@o3co/create-auth-provider 0.15.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/refresh-token-family-client-module.test.mts

@@ -16,10 +16,10 @@
 import type { LifecycleRegistrar } from "@o3co/auth-provider-core";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-// D-2 v2: ioredis Redis constructor capture. The module under test imports
+// ioredis Redis constructor capture. The module under test imports
 // `Redis` from "ioredis"; vi.mock replaces that import so the test never
 // opens a real socket. Captured arguments verify that the validated config
-// reaches the constructor (BLOCKER 1: schema strip closure).
+// reaches the constructor.
 const redisCtorCalls: Array<{ url: string; options: Record<string, unknown> | undefined }> = [];
 const quitSpies: Array<ReturnType<typeof vi.fn>> = [];
 const onSpies: Array<ReturnType<typeof vi.fn>> = [];
@@ -60,17 +60,10 @@ const importModule = async () =>
 		standaloneRedisClientsModule: import("@o3co/auth-provider-core").Module;
 	};
 
-// D-1 / D-5 are already merged on develop, so importing `standaloneRedisClientsModule`
-// from `../modules.mjs` is the natural integration point. Pre-fix the export does not
-// exist — TS error → RED.
+/** The module's own section, `redis-clients`, as boot hands it over. */
+const baseSection = { url: "redis://example.com:6379", password: "test-pw" };
 
-const baseConfig = {
-	refreshTokenFamilyStore: {
-		redis: { url: "redis://example.com:6379", password: "test-pw" },
-	},
-};
-
-describe("D-2 / standaloneRedisClientsModule", () => {
+describe("standaloneRedisClientsModule", () => {
 	beforeEach(() => {
 		redisCtorCalls.length = 0;
 		quitSpies.length = 0;
@@ -81,14 +74,14 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 		vi.restoreAllMocks();
 	});
 
-	it("passes operator-supplied Redis URL + password from config to the ioredis constructor (BLOCKER 1 closure)", async () => {
+	it("passes the operator's Redis URL and password from its section to the ioredis constructor", async () => {
 		const { standaloneRedisClientsModule } = await importModule();
 		const provides = (
 			standaloneRedisClientsModule as unknown as {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig } });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
 
 		expect(redisCtorCalls).toHaveLength(1);
 		expect(redisCtorCalls[0]?.url).toBe("redis://example.com:6379");
@@ -109,7 +102,7 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig }, lifecycleRegistrar });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection }, lifecycleRegistrar });
 
 		expect(registered).toHaveLength(1);
 		// Pre-drain: quit not yet called.
@@ -133,12 +126,12 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 		// after the factory resolves; the registrar branch is the only place
 		// `quit()` would be wired up in the no-real-shutdown unit-test path).
 		await expect(
-			provides.refreshTokenFamilyClient({ config: { ...baseConfig } }),
+			provides.refreshTokenFamilyClient({ section: { ...baseSection } }),
 		).resolves.toBeDefined();
 		expect(quitSpies[0]).not.toHaveBeenCalled();
 	});
 
-	it("fails fast when refreshTokenFamilyStore.redis.url is missing (no silent localhost fallback)", async () => {
+	it("fails fast on an empty redis-clients.url (no silent localhost fallback)", async () => {
 		const { standaloneRedisClientsModule } = await importModule();
 		const provides = (
 			standaloneRedisClientsModule as unknown as {
@@ -146,11 +139,12 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 			}
 		).provides;
 
-		// Operator deliberately removed the section — must throw instead of
-		// silently falling back to redis://localhost:6379 (which would re-
-		// introduce the OR-1 multi-replica failure mode in production).
-		await expect(provides.refreshTokenFamilyClient({ config: {} })).rejects.toThrow(
-			/refreshTokenFamilyStore\.redis\.url/,
+		// An operator who blanked the URL — must throw instead of silently
+		// falling back to redis://localhost:6379, which in production would
+		// leave each replica with refresh-token families the others cannot
+		// see. A section with no URL at all is refused by boot's parse of it.
+		await expect(provides.refreshTokenFamilyClient({ section: { url: "" } })).rejects.toThrow(
+			/redis-clients\.url/,
 		);
 		// And no ioredis instance was constructed because we threw before
 		// `new Redis(...)`.
@@ -164,12 +158,12 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig } });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
 
 		expect(onSpies[0]).toHaveBeenCalledWith("error", expect.any(Function));
 	});
 
-	it("bounds every command and every connect attempt (#286)", async () => {
+	it("bounds every command and every connect attempt", async () => {
 		// Without these the driver's defaults apply: no command timeout at all,
 		// a 10s connect timeout, and 20 reconnect attempts before a queued
 		// command is failed. A partition therefore parks in-flight `/token`
@@ -181,7 +175,7 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig } });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
 
 		const options = redisCtorCalls[0]?.options;
 		expect(options?.commandTimeout).toBe(1_000);
@@ -193,7 +187,7 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 		expect(options?.lazyConnect).toBe(false);
 	});
 
-	it("keeps the offline queue ON, explicitly, because one socket serves every purpose (#286)", async () => {
+	it("keeps the offline queue ON, explicitly, because one socket serves every purpose", async () => {
 		// `enableOfflineQueue` is a per-CONNECTION option and every adapter in
 		// this template draws from the single socket built below, so the
 		// "off for the rate limiter, on elsewhere" split is not expressible
@@ -207,18 +201,18 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig } });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
 
 		expect(redisCtorCalls[0]?.options?.enableOfflineQueue).toBe(true);
 	});
 
-	it("declares 'config' as required and both registrars as optional", async () => {
+	it("requires no configuration, and takes both registrars as optional", async () => {
 		const { standaloneRedisClientsModule } = await importModule();
 		const m = standaloneRedisClientsModule as {
 			requires?: readonly string[];
 			optional?: readonly string[];
 		};
-		expect(m.requires).toContain("config");
+		expect(m.requires ?? []).not.toContain("config");
 		expect(m.optional).toContain("lifecycleRegistrar");
 		expect(m.optional).toContain("readinessRegistrar");
 	});
@@ -238,12 +232,12 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 		const lifecycleRegistrar: LifecycleRegistrar = { register: () => {} };
 
 		await provides.refreshTokenFamilyClient({
-			config: { ...baseConfig },
+			section: { ...baseSection },
 			lifecycleRegistrar,
 			readinessRegistrar,
 		});
 		await provides.rateLimiterClient({
-			config: { ...baseConfig },
+			section: { ...baseSection },
 			lifecycleRegistrar,
 			readinessRegistrar,
 		});