@o3co/create-auth-provider 0.15.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -15,45 +15,30 @@
  */
 
 /**
- * #455 / #456 — the standalone's own store modules under
- * `deployment.mode = "multi"`, booted the way an operator reaches them: from
- * the shipped HOCON with one environment variable flipped.
+ * The standalone's own store modules under `core.deployment.mode = "multi"`,
+ * booted the way an operator reaches them: from the shipped HOCON with one
+ * environment variable flipped.
  *
- * #455: the replica-safety guard keyed on core's module names, and this
- * template wires its *own* in-memory modules for three of the stores —
- * session stores, the code repository, the federation token store — under
- * names the guard had never heard of. `DEPLOYMENT_MODE=multi` with
- * `USER_SESSION_STORES_ADAPTER=memory` booted, and the refusal the README
- * promises did not fire for exactly the stores that fork per replica the
- * worst. Every memory branch is booted here under `"multi"` and must be
- * refused by name; the all-Redis environment must boot.
+ * - Every memory branch must be refused by name, and the all-Redis
+ *   environment must boot. The replica-safety guard reads each module's
+ *   manifest declaration, which covers the template's own in-memory modules
+ *   and express-session's store (`buildModules` builds it from config,
+ *   `sessionStoreModuleFor`).
+ * - `federationTokenStore.type = "redis"` mounts
+ *   `redisFederationTokenStoreModule` off the shared ioredis socket.
+ * - The Redis federation store's `allow-plaintext` guard reads the
+ *   environment the config was selected by (`CONFIG_ENV || NODE_ENV`, passed
+ *   through `buildModules`) and refuses under `core.deployment.mode = "multi"` in
+ *   every environment.
  *
- * #456: `federationTokenStore.type = "redis"` was documented and could not
- * boot — the module went through the adapter factory without ever handing
- * the builder a client. The Redis branch now mounts
- * `redisFederationTokenStoreModule` off the shared ioredis socket; the boot
- * below is the test the README sentence never had.
- *
- * #474: express-session's own store was the one memory store the guard could
- * not see — `SESSION_STORAGE_TYPE=memory` is config, and `sessionStoreModule`'s
- * static manifest carried no declaration. `buildModules` now builds it from
- * the config (`sessionStoreModuleFor`), so it is refused by name like the rest.
- *
- * #473: the Redis federation store's `allow-plaintext` guard keyed off
- * `NODE_ENV` alone. It now reads the environment the config was selected by
- * (`CONFIG_ENV || NODE_ENV`, passed through `buildModules`) and refuses under
- * `deployment.mode = "multi"` in every environment.
- *
- * ioredis is mocked, as in `device-code-store-client-module.test.mts`: the
- * point is composition and the boot planner's stage-1 verdict, not Redis.
- * Nothing here issues a command. node-redis and connect-redis — the session
- * store's own connection — are mocked for the same reason, since #474 puts
- * `SESSION_STORAGE_TYPE=redis` in the baseline.
+ * ioredis, node-redis and connect-redis are mocked, as in
+ * `device-code-store-client-module.test.mts`: the point is composition and
+ * the boot planner's stage-1 verdict, not Redis. Nothing here issues a
+ * command.
  */
 
 import { fileURLToPath } from "node:url";
 import {
-	type AppConfig,
 	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
@@ -64,14 +49,22 @@ import {
 	registerBuiltinKeyStores,
 	replicaUnsafeReason,
 } from "@o3co/auth-provider-core";
+import { standardSmtpMailSenderConfigForTests } from "@o3co/auth-provider-standard/testing";
 import { parseFile } from "@o3co/ts.hocon";
 import { validate } from "@o3co/ts.hocon/zod";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
-
-// The redis session-store builder dynamically imports these (#474 puts the
-// Redis session store in the baseline); mock them so no socket opens.
+import { resolveConfigPaths, type Switches } from "../configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import {
+	capturedRenames,
+	libraryLayers,
+	rootSectionsOf,
+	sectionsCoreDoesNotDeclare,
+} from "./library-references.fixture.mjs";
+
+// The redis session-store builder, which the baseline selects, dynamically
+// imports these; mock them so no socket opens.
 vi.mock("redis", () => ({
 	createClient: vi.fn(() => ({
 		connect: vi.fn().mockResolvedValue(undefined),
@@ -141,41 +134,48 @@ const ENCRYPTION_KEY = Buffer.alloc(32, 7).toString("base64");
 
 /**
  * The umbrella E2E's shape (`o3co/auth` `tests/docker-compose.yml`), with
- * every shared store on Redis — express-session's own included, since #474
- * put it under the guard. Each case below flips one variable off this.
+ * every shared store on Redis, express-session's own included, and MFA off
+ * as the umbrella sets it. Each case below flips one variable off this.
  */
 const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: "replica-safety-test-secret.at-least-32-bytes.ok",
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: "replica-safety-test-secret.at-least-32-bytes.ok",
 	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_SECRET: "replica-safety-session-secret.at-least-32-bytes.ok",
-	SESSION_SECURE: "false",
-	SESSION_NAME: "auth.session",
-	SESSION_STORAGE_TYPE: "redis",
-	SESSION_STORAGE_REDIS_URL: "redis://redis.test:6379",
-	CLIENT_USER_TYPE: "yaml",
-	DEPLOYMENT_MODE: "multi",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "redis",
-	RATE_LIMITER_ADAPTER: "redis",
-	OAUTH_CODE_ADAPTER: "redis",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
-	REPLAY_SEEN_SET_ADAPTER: "redis",
-	FEDERATION_TOKEN_STORE_TYPE: "redis",
+	SESSION_STORE_SECRET: "replica-safety-session-secret.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "redis",
+	SESSION_STORE_STORAGE_REDIS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	CORE_DEPLOYMENT_MODE: "multi",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "redis",
+	ADAPTERS_RATE_LIMITER: "redis",
+	ADAPTERS_CODE_REPOSITORY: "redis",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "redis",
+	ADAPTERS_REPLAY_SEEN_SET: "redis",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
-	// #561: the consent step for clients that are not first-party, on the
+	// The consent step for clients that are not first-party, on the
 	// shared store — the one switch value `multi` accepts besides `none`.
-	CONSENT_STORE_ADAPTER: "redis",
+	ADAPTERS_CONSENT_STORE: "redis",
 };
 
-function resolveConfig(env: Record<string, string>): AppConfig {
+function resolveConfig(env: Record<string, string>): Switches {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return validate(
-		parseFile(envConfPath, { env })
-			.withFallback(parseFile(applicationConfPath, { env }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
-		AppConfigSchema,
-	);
+	const layers = parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.withFallback(libraryLayers(env));
+	return {
+		...sectionsCoreDoesNotDeclare(layers),
+		...rootSectionsOf(layers, env),
+		...validate(layers, AppConfigSchema),
+		// What the resolution captured of core's renamed variables, which the
+		// schema's parse drops.
+		"renamed-variables": capturedRenames(env),
+	} as Switches;
 }
 
 /** Drops a variable, so the HOCON default takes over. */
@@ -204,20 +204,20 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
 });
 
-const modulesFor = (config: AppConfig, environment?: string) =>
+const modulesFor = (config: Switches, environment?: string) =>
 	buildModules(config, {
 		keyStoreModule: testKeyStoreModule,
 		repositoriesModule: testRepositoriesModule,
 		...(environment === undefined ? {} : { environment }),
 	});
 
-const boot = (config: AppConfig, environment?: string) =>
+const boot = (config: Switches, environment?: string) =>
 	createApp({
 		modules: modulesFor(config, environment),
 		bootstrapComponents: { config, pathResolver: (s) => s },
@@ -229,7 +229,7 @@ const messageChain = (err: unknown): string => {
 	return `${e.message ?? ""} ${e.cause?.message ?? ""}`;
 };
 
-describe('#455: the standalone\'s memory modules are refused under deployment.mode = "multi"', () => {
+describe('the standalone\'s memory modules are refused under core.deployment.mode = "multi"', () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 
 	afterEach(async () => {
@@ -238,21 +238,20 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 	});
 
 	const cases: ReadonlyArray<readonly [variable: string, module: string]> = [
-		// The template's own modules — the three the guard could not see.
-		["USER_SESSION_STORES_ADAPTER", "standalone:in-memory-session-stores"],
-		["OAUTH_CODE_ADAPTER", "standalone:in-memory-code-repository"],
-		["FEDERATION_TOKEN_STORE_TYPE", "standalone:in-memory-federation-token-store"],
-		// #474: express-session's own store. Not a module of this template but
+		// The template's own modules.
+		["ADAPTERS_USER_SESSION_STORES", "standalone-in-memory-session-stores"],
+		["ADAPTERS_CODE_REPOSITORY", "standalone-in-memory-code-repository"],
+		["ADAPTERS_FEDERATION_TOKEN_STORE", "standalone-in-memory-federation-token-store"],
+		// express-session's own store. Not a module of this template but
 		// built here from its config, which is what lets the manifest declare.
-		["SESSION_STORAGE_TYPE", "sessionStoreModule"],
-		// #527: the consent store, wired only when the switch says so.
-		["CONSENT_STORE_ADAPTER", "core-consent-store-memory"],
-		// Core's, selected by the same kind of switch. The guard knew these by
-		// name; pinned so the name table's departure (#455) did not lose them.
-		["RATE_LIMITER_ADAPTER", "core-rate-limiter-memory"],
-		["ACCESS_TOKEN_DENYLIST_ADAPTER", "core-access-token-denylist-memory"],
-		// #484: the jti single-use record behind private_key_jwt client auth.
-		["REPLAY_SEEN_SET_ADAPTER", "core-replay-seen-set-memory"],
+		["SESSION_STORE_STORAGE_TYPE", "session-store"],
+		// The consent store, wired only when the switch says so.
+		["ADAPTERS_CONSENT_STORE", "core-consent-store-memory"],
+		// Core's, selected by the same kind of switch.
+		["ADAPTERS_RATE_LIMITER", "core-rate-limiter-memory"],
+		["ADAPTERS_ACCESS_TOKEN_DENYLIST", "core-access-token-denylist-memory"],
+		// The jti single-use record behind private_key_jwt client auth.
+		["ADAPTERS_REPLAY_SEEN_SET", "core-replay-seen-set-memory"],
 	];
 
 	for (const [variable, module] of cases) {
@@ -269,14 +268,14 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 	it("names every memory module together when every switch is memory", async () => {
 		const config = resolveConfig({
 			...ALL_REDIS_ENV,
-			USER_SESSION_STORES_ADAPTER: "memory",
-			OAUTH_CODE_ADAPTER: "memory",
-			FEDERATION_TOKEN_STORE_TYPE: "memory",
-			SESSION_STORAGE_TYPE: "memory",
-			RATE_LIMITER_ADAPTER: "memory",
-			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-			REPLAY_SEEN_SET_ADAPTER: "memory",
-			CONSENT_STORE_ADAPTER: "memory",
+			ADAPTERS_USER_SESSION_STORES: "memory",
+			ADAPTERS_CODE_REPOSITORY: "memory",
+			ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+			SESSION_STORE_STORAGE_TYPE: "memory",
+			ADAPTERS_RATE_LIMITER: "memory",
+			ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+			ADAPTERS_REPLAY_SEEN_SET: "memory",
+			ADAPTERS_CONSENT_STORE: "memory",
 		});
 		await expect(boot(config)).rejects.toMatchObject({
 			reason: "replica-unsafe-adapter",
@@ -287,21 +286,21 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 	});
 
 	it("each standalone memory module declares its consequence on its own manifest", () => {
-		// The declaration is what the guard reads (#455), so it has to be on
+		// The declaration is what the guard reads, so it has to be on
 		// the module and it has to say what breaks — the guard quotes it.
 		const config = resolveConfig({
 			...ALL_REDIS_ENV,
-			USER_SESSION_STORES_ADAPTER: "memory",
-			OAUTH_CODE_ADAPTER: "memory",
-			FEDERATION_TOKEN_STORE_TYPE: "memory",
+			ADAPTERS_USER_SESSION_STORES: "memory",
+			ADAPTERS_CODE_REPOSITORY: "memory",
+			ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
 		});
 		const standaloneMemoryModules = modulesFor(config).filter((m) =>
-			m.name.startsWith("standalone:in-memory-"),
+			m.name.startsWith("standalone-in-memory-"),
 		);
 		expect(standaloneMemoryModules.map((m) => m.name).sort()).toEqual([
-			"standalone:in-memory-code-repository",
-			"standalone:in-memory-federation-token-store",
-			"standalone:in-memory-session-stores",
+			"standalone-in-memory-code-repository",
+			"standalone-in-memory-federation-token-store",
+			"standalone-in-memory-session-stores",
 		]);
 		for (const m of standaloneMemoryModules) {
 			expect(replicaUnsafeReason(m), m.name).toBeDefined();
@@ -319,7 +318,7 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 	});
 });
 
-describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
+describe('adapters.federationTokenStore = "redis" in the standalone', () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 
 	afterEach(async () => {
@@ -327,13 +326,11 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 		handleRef = undefined;
 	});
 
-	it("reaches the resolved config from FEDERATION_TOKEN_STORE_TYPE", () => {
-		// `AppConfigSchema` strips top-level keys it does not declare; the
-		// switch had to be declared before an env var could select anything.
-		expect(resolveConfig(ALL_REDIS_ENV).federationTokenStore?.type).toBe("redis");
+	it("reaches phase one's adapters from ADAPTERS_FEDERATION_TOKEN_STORE", () => {
+		expect(resolveConfig(ALL_REDIS_ENV).adapters.federationTokenStore).toBe("redis");
 		expect(
-			resolveConfig(without(ALL_REDIS_ENV, "FEDERATION_TOKEN_STORE_TYPE")).federationTokenStore
-				?.type,
+			resolveConfig(without(ALL_REDIS_ENV, "ADAPTERS_FEDERATION_TOKEN_STORE")).adapters
+				.federationTokenStore,
 		).toBe("memory");
 	});
 
@@ -341,8 +338,8 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 		const modules = modulesFor(resolveConfig(ALL_REDIS_ENV));
 		const names = modules.map((m) => m.name);
 		expect(names).toContain("redis-federation-token-store");
-		expect(names).toContain("standalone:redis-clients");
-		expect(names).not.toContain("standalone:in-memory-federation-token-store");
+		expect(names).toContain("redis-clients");
+		expect(names).not.toContain("standalone-in-memory-federation-token-store");
 		// Exactly one provider for the slot: both modules provide it, so
 		// selecting both would be a boot-time slot collision.
 		const providers = modules.filter((m) =>
@@ -355,18 +352,18 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 		// Every other store on memory, single replica: the Redis federation
 		// store still needs `federationTokenStoreClient`, which only the shared
 		// clients module provides. Without this the branch fails stage 1 with
-		// `missing-required-component` — the #439 shape, once more.
+		// `missing-required-component`.
 		const config = resolveConfig({
 			...ALL_REDIS_ENV,
-			DEPLOYMENT_MODE: "single",
-			USER_SESSION_STORES_ADAPTER: "memory",
-			OAUTH_CODE_ADAPTER: "memory",
-			RATE_LIMITER_ADAPTER: "memory",
-			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+			CORE_DEPLOYMENT_MODE: "single",
+			ADAPTERS_USER_SESSION_STORES: "memory",
+			ADAPTERS_CODE_REPOSITORY: "memory",
+			ADAPTERS_RATE_LIMITER: "memory",
+			ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
 		});
 		const names = modulesFor(config).map((m) => m.name);
 		expect(names).toContain("redis-federation-token-store");
-		expect(names).toContain("standalone:redis-clients");
+		expect(names).toContain("redis-clients");
 	});
 
 	it("boots, and the resolved store is the Redis adapter", async () => {
@@ -388,20 +385,20 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 		});
 	});
 
-	it("keeps the memory branch as it was: the default, in single mode, resolves the memory adapter", async () => {
+	it("keeps the memory branch: the default, in single mode, resolves the memory adapter", async () => {
 		const config = resolveConfig({
-			...without(ALL_REDIS_ENV, "FEDERATION_TOKEN_STORE_TYPE"),
-			DEPLOYMENT_MODE: "single",
+			...without(ALL_REDIS_ENV, "ADAPTERS_FEDERATION_TOKEN_STORE"),
+			CORE_DEPLOYMENT_MODE: "single",
 		});
 		const names = modulesFor(config).map((m) => m.name);
-		expect(names).toContain("standalone:in-memory-federation-token-store");
+		expect(names).toContain("standalone-in-memory-federation-token-store");
 		expect(names).not.toContain("redis-federation-token-store");
 		handleRef = await boot(config);
 		expect(handleRef.components.federationTokenStore?.kind).toBe("memory");
 	});
 });
 
-describe('#561: consentStore.adapter = "redis" in the standalone', () => {
+describe('consentStore.adapter = "redis" in the standalone', () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 
 	afterEach(async () => {
@@ -428,16 +425,16 @@ describe('#561: consentStore.adapter = "redis" in the standalone', () => {
 	it("pulls the shared clients module in for the consent stores alone", () => {
 		// Every other store on memory, single replica: the consent module still
 		// needs its two client slots, which only the shared clients module
-		// provides — the #439 shape otherwise.
+		// provides.
 		const config = resolveConfig({
 			...ALL_REDIS_ENV,
-			DEPLOYMENT_MODE: "single",
-			USER_SESSION_STORES_ADAPTER: "memory",
-			OAUTH_CODE_ADAPTER: "memory",
-			RATE_LIMITER_ADAPTER: "memory",
-			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-			REPLAY_SEEN_SET_ADAPTER: "memory",
-			FEDERATION_TOKEN_STORE_TYPE: "memory",
+			CORE_DEPLOYMENT_MODE: "single",
+			ADAPTERS_USER_SESSION_STORES: "memory",
+			ADAPTERS_CODE_REPOSITORY: "memory",
+			ADAPTERS_RATE_LIMITER: "memory",
+			ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+			ADAPTERS_REPLAY_SEEN_SET: "memory",
+			ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
 		});
 		const names = buildModules(config, {
 			keyStoreModule: testKeyStoreModule,
@@ -445,17 +442,17 @@ describe('#561: consentStore.adapter = "redis" in the standalone', () => {
 			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 		}).map((m) => m.name);
 		expect(names).toContain("redis-consent-store");
-		expect(names).toContain("standalone:redis-clients");
+		expect(names).toContain("redis-clients");
 	});
 
-	it("boots under DEPLOYMENT_MODE=multi with both slots resolved to the Redis adapters", async () => {
+	it("boots under CORE_DEPLOYMENT_MODE=multi with both slots resolved to the Redis adapters", async () => {
 		handleRef = await boot(resolveConfig(ALL_REDIS_ENV));
 		expect(handleRef.components.consentStore?.kind).toBe("redis");
 		expect(handleRef.components.pendingConsentStore?.kind).toBe("redis");
 	});
 });
 
-describe("#473: the Redis federation store's plaintext guard, booted from the shipped config", () => {
+describe("the Redis federation store's plaintext guard, booted from the shipped config", () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 	let warnSpy: ReturnType<typeof vi.spyOn>;
 	let errorSpy: ReturnType<typeof vi.spyOn>;
@@ -486,36 +483,60 @@ describe("#473: the Redis federation store's plaintext guard, booted from the sh
 		REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE: "allow-plaintext",
 	};
 
-	it('is refused under deployment.mode = "multi" in a development environment', async () => {
-		// The umbrella shape with plaintext: refused before #473 only if
-		// NODE_ENV happened to say production. A multi-replica deployment is
-		// never a development box.
-		await expect(boot(resolveConfig(PLAINTEXT_ENV), "development")).rejects.toSatisfy(
-			(err: unknown) => /deployment\.mode is "multi"/.test(messageChain(err)),
+	it('is refused under core.deployment.mode = "multi" in an environment that is not production', async () => {
+		// The umbrella shape with plaintext. A multi-replica deployment is
+		// never a development box. A development configuration under multi is
+		// refused by the development mail sender first, so the environment here
+		// is another name that is not production, with the SMTP sender's section.
+		await expect(
+			boot({ ...resolveConfig(PLAINTEXT_ENV), ...standardSmtpMailSenderConfigForTests() }, "test"),
+		).rejects.toSatisfy((err: unknown) =>
+			/allow-plaintext[\s\S]*core\.deployment\.mode is "multi"/.test(messageChain(err)),
 		);
 		expect(errorSpy).not.toHaveBeenCalled();
 	});
 
 	it("is refused when the config was selected by CONFIG_ENV=production, whatever NODE_ENV says", async () => {
 		// `app.mts` selects `production.conf` by `CONFIG_ENV || NODE_ENV` and
-		// passes that name through `buildModules`; the guard used to read
-		// NODE_ENV alone and would have let this boot.
-		const config = resolveConfig({ ...PLAINTEXT_ENV, DEPLOYMENT_MODE: "single" });
+		// passes that name through `buildModules`; the guard reads that name,
+		// not NODE_ENV alone.
+		// Under production the template installs the SMTP sender's module, whose
+		// section the package's builder carries.
+		const config = {
+			...resolveConfig({ ...PLAINTEXT_ENV, CORE_DEPLOYMENT_MODE: "single" }),
+			...standardSmtpMailSenderConfigForTests(),
+		};
 		await expect(boot(config, "production")).rejects.toSatisfy((err: unknown) =>
-			/the environment is "production"/.test(messageChain(err)),
+			/allow-plaintext[\s\S]*the environment is "production"/.test(messageChain(err)),
 		);
 	});
 
 	it("boots with the plaintext warning in a development environment on a single replica", async () => {
-		const config = resolveConfig({ ...PLAINTEXT_ENV, DEPLOYMENT_MODE: "single" });
+		const config = resolveConfig({ ...PLAINTEXT_ENV, CORE_DEPLOYMENT_MODE: "single" });
 		handleRef = await boot(config, "development");
 		expect(handleRef.components.federationTokenStore?.kind).toBe("redis");
-		expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining("allow-plaintext"));
+		expect(warnSpy).toHaveBeenCalledWith(
+			{ store: "federation-tokens", mode: "allow-plaintext" },
+			"federation_store_plaintext",
+		);
 	});
 
-	it("keeps the FEDERATION_TOKENS_ALLOW_INSECURE=1 escape hatch under multi, at CRITICAL", async () => {
+	it("keeps the FEDERATION_TOKENS_ALLOW_INSECURE=1 escape hatch under multi, logged at error", async () => {
 		process.env.FEDERATION_TOKENS_ALLOW_INSECURE = "1";
-		handleRef = await boot(resolveConfig(PLAINTEXT_ENV), "development");
-		expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining("CRITICAL"));
+		// Under multi the development mail sender refuses a development
+		// configuration, so the environment here is another name that is not
+		// production, with the SMTP sender's section its module reads.
+		handleRef = await boot(
+			{ ...resolveConfig(PLAINTEXT_ENV), ...standardSmtpMailSenderConfigForTests() },
+			"test",
+		);
+		expect(errorSpy).toHaveBeenCalledWith(
+			expect.objectContaining({
+				store: "federation-tokens",
+				deploymentMode: "multi",
+				override: "FEDERATION_TOKENS_ALLOW_INSECURE",
+			}),
+			"federation_store_plaintext_override",
+		);
 	});
 });

package/templates/standalone/src/__tests__/router-error-answers.test.mts

@@ -0,0 +1,146 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template's composition, booted through core's `createApp` and mounted
+ * with no terminal handler of the template's after it — the router alone, as
+ * a composition root that copies nothing of `app.mts` mounts it.
+ *
+ * The router core returns answers a body parser's refusal and any error a
+ * route lets through itself. Left to Express's final handler, a host would
+ * answer with an HTML page carrying the stack outside production, where V8's
+ * JSON error quotes the body it could not parse.
+ */
+
+import { defineModule } from "@o3co/auth-provider-core";
+import { Router } from "express";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	basic,
+	type Composition,
+	compose,
+	JSON_TYPE,
+	KIB,
+	M2M,
+	padJson,
+} from "./all-modules-composition.fixture.mjs";
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+});
+
+/** A route that lets an error through, contributed as a deployment adds one. */
+const throwingRouteModule = defineModule({
+	name: "test:throwing-route",
+	contributes: {
+		routes: [
+			() => {
+				const router = Router();
+				router.get("/", () => {
+					throw new Error("a store said something: escaped-error-marker");
+				});
+				return { id: "test:throwing-route", mountPath: "/throws", handler: router };
+			},
+		],
+	},
+});
+
+/** The composition, the router alone mounted. */
+const boot = async (): Promise<Composition> => {
+	current = await compose({
+		terminalErrorHandler: false,
+		extraModules: () => [throwingRouteModule],
+	});
+	return current;
+};
+
+/** The routes that parse a body, and what each needs to reach its parser. */
+const PARSING_ROUTES = [
+	["/oauth/token", { authorization: basic(M2M) }],
+	["/oauth/introspect", { authorization: basic(M2M) }],
+	["/session/login", {}],
+] as const;
+
+const errorLines = (c: Composition) => c.logger.lines.filter((line) => line.level === "error");
+
+describe("the composed router, mounted alone, answers a body parser's refusal", () => {
+	it.each(PARSING_ROUTES)(
+		"%s: malformed JSON is 400 in the envelope, nothing logged",
+		async (path, headers) => {
+			const c = await boot();
+			const res = await request(c.app)
+				.post(path)
+				.set(headers)
+				.set("Content-Type", JSON_TYPE)
+				.send('{"password":"body-secret-marker');
+
+			expect(res.status).toBe(400);
+			expect(res.headers["content-type"]).toMatch(/^application\/json/);
+			expect(res.body).toEqual({ error: "invalid_request", error_description: "malformed_body" });
+			expect(res.text).not.toContain("body-secret-marker");
+			expect(res.text).not.toMatch(/ at /);
+			expect(errorLines(c)).toEqual([]);
+		},
+	);
+
+	it.each(PARSING_ROUTES)(
+		"%s: a body over the parser's limit is 413 in the envelope, nothing logged",
+		async (path, headers) => {
+			const c = await boot();
+			const res = await request(c.app)
+				.post(path)
+				.set(headers)
+				.set("Content-Type", JSON_TYPE)
+				.send(padJson(200 * KIB));
+
+			expect(res.status).toBe(413);
+			expect(res.headers["content-type"]).toMatch(/^application\/json/);
+			expect(res.body).toEqual({ error: "invalid_request", error_description: "body_too_large" });
+			expect(errorLines(c)).toEqual([]);
+		},
+	);
+});
+
+describe("the composed router, mounted alone, answers an error a route let through", () => {
+	it("is 500 server_error in the envelope, logged once at error", async () => {
+		const c = await boot();
+		const res = await request(c.app).get("/throws");
+
+		expect(res.status).toBe(500);
+		expect(res.headers["content-type"]).toMatch(/^application\/json/);
+		expect(res.body).toEqual({ error: "server_error", error_description: "unexpected_error" });
+		expect(res.text).not.toContain("escaped-error-marker");
+		expect(errorLines(c)).toEqual([
+			{
+				level: "error",
+				args: [
+					{
+						endpoint: "/throws",
+						err: expect.objectContaining({
+							name: "Error",
+							detail: "a store said something: escaped-error-marker",
+						}),
+					},
+					"unhandled_request_error",
+				],
+			},
+		]);
+	});
+});