@o3co/create-auth-provider 0.15.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/store-credential.test.mts

@@ -0,0 +1,317 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The credential auth.provider presents to the Store, through the shipped
+ * composition: `REPOSITORIES_USER_HTTP_BEARER_TOKEN` in the environment → the HOCON
+ * layers → the production `repositories` module's section → the
+ * `"http"` user adapter → the `Authorization` header a real `node:http` Store
+ * receives. Unset, no header is sent; exported but empty, the user repository
+ * is refused. From outside the booted app, a Store's `401` with a `Bearer`
+ * challenge turns `POST /session/login` into a `503` whose log line names the
+ * refused credential and never the token; a `401` without the challenge is
+ * still a wrong password.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { createServer, type OutgoingHttpHeaders, type Server } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { inspect } from "node:util";
+import {
+	AppConfigSchema,
+	createApp,
+	createKeyStoreFactory,
+	defineModule,
+	type Logger,
+	memoryRefreshTokenFamilyStoreModule,
+	registerBuiltinKeyStores,
+	type UserRepository,
+} from "@o3co/auth-provider-core";
+import { parseFile } from "@o3co/ts.hocon";
+import { validate } from "@o3co/ts.hocon/zod";
+import express from "express";
+import request from "supertest";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import { buildModules } from "../buildModules.mjs";
+import { resolveConfigPaths, type Switches } from "../configPath.mjs";
+import { repositoriesModuleFor, templateReference } from "../modules.mjs";
+import { repositoriesSectionSchema } from "../sections.mjs";
+import {
+	capturedRenames,
+	libraryLayers,
+	rootSectionsOf,
+	sectionsCoreDoesNotDeclare,
+} from "./library-references.fixture.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+/** 32 bytes of key material — what `openssl rand -hex 32` prints. */
+const TOKEN = "7d1f0c3b9a5e2d4f6a8c0e1b3d5f7a9c2e4b6d8f0a1c3e5b7d9f2a4c6e8b0d1f";
+
+let servers: Server[] = [];
+afterEach(async () => {
+	await Promise.all(
+		servers.map((server) => {
+			server.closeAllConnections();
+			return new Promise<void>((resolve) => server.close(() => resolve()));
+		}),
+	);
+	servers = [];
+});
+
+/** How the Store answers every request. */
+interface StoreAnswer {
+	readonly status: number;
+	readonly headers?: OutgoingHttpHeaders;
+	readonly body: unknown;
+}
+
+const USER: StoreAnswer = { status: 200, body: { id: "user-1", username: "alice" } };
+
+/** A Store on its own loopback port that records each request's Authorization header. */
+const recordingStore = async (
+	answer: StoreAnswer = USER,
+): Promise<{ origin: string; heard: (string | undefined)[] }> => {
+	const heard: (string | undefined)[] = [];
+	const server = createServer((req, res) => {
+		req.resume();
+		req.on("end", () => {
+			heard.push(req.headers.authorization);
+			res.writeHead(answer.status, { "Content-Type": "application/json", ...answer.headers });
+			res.end(JSON.stringify(answer.body));
+		});
+	});
+	servers.push(server);
+	await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+	const { port } = server.address() as { port: number };
+	return { origin: `http://127.0.0.1:${port}`, heard };
+};
+
+/** The shipped config for the production overlay, resolved against `env`. */
+const resolve = (env: Record<string, string>): Switches => {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
+	const layers = parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.withFallback(libraryLayers(env));
+	return {
+		...sectionsCoreDoesNotDeclare(layers),
+		...rootSectionsOf(layers, env),
+		...validate(layers, AppConfigSchema),
+		// What the resolution captured of core's renamed variables, which the
+		// schema's parse drops.
+		"renamed-variables": capturedRenames(env),
+	} as Switches;
+};
+
+/** The user repository the production `repositories` module builds from `config`'s section. */
+const userRepositoryFrom = (config: Switches): Promise<UserRepository> =>
+	Promise.resolve(
+		repositoriesModuleFor({
+			client: config.adapters.clientRepository,
+			user: config.adapters.userRepository,
+		}).provides?.userRepository?.({
+			section: repositoriesSectionSchema.parse(
+				(config as unknown as Record<string, unknown>).repositories,
+			),
+		} as never) as UserRepository | Promise<UserRepository>,
+	);
+
+const envFor = (origin: string): Record<string, string> => ({
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: "store-credential-composition.at-least-32-bytes.ok",
+	OAUTH_JWT_ISSUER: "https://auth.test",
+	SESSION_STORE_SECRET: "store-credential-composition-session.at-least-32-bytes.ok",
+	ADAPTERS_USER_REPOSITORY: "http",
+	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: `${origin}/authenticate`,
+	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: `${origin}/authenticate-by-token`,
+});
+
+describe("REPOSITORIES_USER_HTTP_BEARER_TOKEN reaches the Store through the shipped composition", () => {
+	it("sends Authorization: Bearer <token> on every Store call when the variable is set", async () => {
+		const { origin, heard } = await recordingStore();
+		const repo = await userRepositoryFrom(
+			resolve({ ...envFor(origin), REPOSITORIES_USER_HTTP_BEARER_TOKEN: TOKEN }),
+		);
+
+		await repo.authenticate("alice", "pass");
+		await repo.authenticateByToken("apple:a1");
+
+		expect(heard).toEqual([`Bearer ${TOKEN}`, `Bearer ${TOKEN}`]);
+	});
+
+	it("sends no Authorization header when the variable is unset", async () => {
+		const { origin, heard } = await recordingStore();
+		const repo = await userRepositoryFrom(resolve(envFor(origin)));
+
+		await repo.authenticate("alice", "pass");
+
+		expect(heard).toEqual([undefined]);
+	});
+
+	it("refuses the user repository when the variable is exported but empty", async () => {
+		const { origin, heard } = await recordingStore();
+		const config = resolve({ ...envFor(origin), REPOSITORIES_USER_HTTP_BEARER_TOKEN: "" });
+
+		await expect(userRepositoryFrom(config)).rejects.toThrow(/"bearerToken" must not be empty/);
+		expect(heard).toEqual([]);
+	});
+});
+
+describe("a token the Store refuses, seen from outside the booted app", () => {
+	/** Every store on memory, so the boot opens no socket but the Store's; MFA off. */
+	const MEMORY_ENV: Readonly<Record<string, string>> = {
+		MFA_MODE: "off",
+		SESSION_STORE_SECURE: "false",
+		SESSION_STORE_NAME: "auth.session",
+		SESSION_STORE_STORAGE_TYPE: "memory",
+		ADAPTERS_USER_SESSION_STORES: "memory",
+		ADAPTERS_RATE_LIMITER: "memory",
+		ADAPTERS_CODE_REPOSITORY: "memory",
+		ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+		ADAPTERS_REPLAY_SEEN_SET: "memory",
+		ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+		ADAPTERS_CONSENT_STORE: "none",
+		ADAPTERS_FEDERATION_GRANT_STORE: "memory",
+		ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
+	};
+
+	const testKeyStoreModule = defineModule({
+		name: "test:key-store",
+		requires: ["config"] as const,
+		provides: {
+			keyStore: async ({ config: c }) => {
+				const factory = createKeyStoreFactory();
+				registerBuiltinKeyStores(factory);
+				return factory.create({
+					type: "local",
+					...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				});
+			},
+		},
+	});
+
+	/** Every log call, as the arguments it was made with. */
+	const capturingLogger = (): { logger: Logger; lines: { level: string; args: unknown[] }[] } => {
+		const lines: { level: string; args: unknown[] }[] = [];
+		const at =
+			(level: string) =>
+			(...args: unknown[]): void => {
+				lines.push({ level, args });
+			};
+		const logger = {
+			trace: at("trace"),
+			debug: at("debug"),
+			info: at("info"),
+			warn: at("warn"),
+			error: at("error"),
+			fatal: at("fatal"),
+			child: () => logger,
+		} as Logger;
+		return { logger, lines };
+	};
+
+	let handleRef: Awaited<ReturnType<typeof createApp>> | undefined;
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	/**
+	 * The client registry the boot reads, which this test brings itself.
+	 * `REPOSITORIES_CLIENT_YAML_PATH`'s default, `./config/clients.yaml`, is per-deployment: the
+	 * scaffold's `.gitignore` keeps it out of the project's repository, so a
+	 * fresh clone — a CI runner, the `test` image — has none. The login below
+	 * names no client, so an empty registry is all it needs.
+	 */
+	let registryDir: string;
+	let clientPath: string;
+	beforeAll(() => {
+		registryDir = mkdtempSync(join(tmpdir(), "store-credential-"));
+		clientPath = join(registryDir, "clients.yaml");
+		writeFileSync(clientPath, "# No clients: the login under test names none.\n");
+	});
+	afterAll(() => {
+		rmSync(registryDir, { recursive: true, force: true });
+	});
+
+	/**
+	 * The shipped config against a Store answering `answer`, booted with the
+	 * production repositories module; then a real browser login — a CSRF pair,
+	 * then the form post.
+	 */
+	const logInAgainst = async (answer: StoreAnswer) => {
+		const { origin, heard } = await recordingStore(answer);
+		const config = resolve({
+			...envFor(origin),
+			...MEMORY_ENV,
+			REPOSITORIES_CLIENT_YAML_PATH: clientPath,
+			REPOSITORIES_USER_HTTP_BEARER_TOKEN: TOKEN,
+		});
+		const { logger, lines } = capturingLogger();
+		handleRef = await createApp({
+			modules: buildModules(config, {
+				keyStoreModule: testKeyStoreModule,
+				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+			}),
+			bootstrapComponents: { config, pathResolver: (s: string) => s, logger },
+		});
+		const app = express().use(handleRef.router);
+
+		const csrf = await request(app).get("/session/csrf");
+		expect(csrf.status).toBe(200);
+		const login = await request(app)
+			.post("/session/login")
+			.set("Cookie", csrf.headers["set-cookie"] as unknown as string[])
+			.set(csrf.body.header_name as string, csrf.body.csrf_token as string)
+			.type("form")
+			.send({ username: "alice", password: "correct-horse-battery-staple" });
+		const logged = lines.map((line) =>
+			inspect(line, { depth: Number.POSITIVE_INFINITY, showHidden: true }),
+		);
+		return { login, heard, logged };
+	};
+
+	it("answers the login 503 and logs the refused credential by name, never the token", async () => {
+		const { login, heard, logged } = await logInAgainst({
+			status: 401,
+			headers: { "WWW-Authenticate": 'Bearer error="invalid_token"' },
+			body: { error: "invalid_token" },
+		});
+
+		expect(heard).toEqual([`Bearer ${TOKEN}`]);
+		expect(login.status).toBe(503);
+		expect(login.body.error).toBe("temporarily_unavailable");
+		expect(logged.filter((line) => /refused this deployment's credential/.test(line))).toHaveLength(
+			1,
+		);
+		expect(logged.filter((line) => line.includes(TOKEN))).toEqual([]);
+	});
+
+	it("still answers a 401 without the challenge as a wrong password", async () => {
+		const { login, heard, logged } = await logInAgainst({
+			status: 401,
+			body: { error: "invalid_credentials" },
+		});
+
+		expect(heard).toEqual([`Bearer ${TOKEN}`]);
+		expect(login.status).toBe(401);
+		expect(login.body.error).toBe("invalid_credentials");
+		expect(logged.filter((line) => /refused this deployment's credential/.test(line))).toEqual([]);
+	});
+});

package/templates/standalone/src/__tests__/supertest-loopback.test.mts

@@ -15,16 +15,15 @@
  */
 
 /**
- * #556 — the server `request(app)` starts listens on the address supertest
- * dials, in this project's own test run.
- *
- * Unpatched, supertest starts its server with `app.listen(0)` — the
- * dual-stack wildcard `[::]:P` — and sends the request to `127.0.0.1:P`. On
- * macOS the kernel can hand out a `P` another process already holds as
- * `127.0.0.1:P`; the request then reaches that process, and if it never
- * answers the test hangs until its timeout. `vitest.supertest-loopback.mts`
- * (wired in through `setupFiles` in `vitest.config.mts`) binds the server to
- * `127.0.0.1` instead. These tests fail if that wiring is lost.
+ * The server `request(app)` starts listens on the address supertest dials,
+ * in this project's own test run. Unpatched, supertest starts its server with
+ * `app.listen(0)` — the dual-stack wildcard `[::]:P` — and sends the request
+ * to `127.0.0.1:P`. On macOS the kernel can hand out a `P` another process
+ * already holds as `127.0.0.1:P`; the request then reaches that process, and
+ * if it never answers the test hangs until its timeout.
+ * `vitest.supertest-loopback.mts` (a `setupFiles` entry in
+ * `vitest.config.mts`) binds `127.0.0.1` instead; these tests fail if that
+ * wiring is lost.
  */
 
 import http from "node:http";
@@ -48,7 +47,62 @@ function boundAddress(server: net.Server): Promise<AddressInfo> {
 	});
 }
 
-describe("#556 — supertest's own server listens on the loopback address it dials", () => {
+/**
+ * An app whose `GET /hold/:name` waits in its handler until the test releases
+ * that name, so a test decides the order in which requests finish.
+ * `inFlight` holds the names whose handlers have not answered yet.
+ */
+function holdingApp() {
+	const gates = new Map<
+		string,
+		{ arrived: PromiseWithResolvers<void>; released: PromiseWithResolvers<void> }
+	>();
+	const gate = (name: string) => {
+		let found = gates.get(name);
+		if (!found) {
+			found = { arrived: Promise.withResolvers(), released: Promise.withResolvers() };
+			gates.set(name, found);
+		}
+		return found;
+	};
+	const inFlight = new Set<string>();
+	const app = express();
+	app.get("/hold/:name", async (req, res) => {
+		const { name } = req.params;
+		inFlight.add(name);
+		gate(name).arrived.resolve();
+		await gate(name).released.promise;
+		inFlight.delete(name);
+		res.status(200).send(name);
+	});
+	return {
+		app,
+		inFlight,
+		arrived: (name: string) => gate(name).arrived.promise,
+		release: (name: string) => gate(name).released.resolve(),
+		releaseAll: () => {
+			for (const { released } of gates.values()) released.resolve();
+		},
+	};
+}
+
+/**
+ * Records, for every `close` of `server`, which held requests it was still
+ * serving. A close that comes too early releases them all, so the test
+ * finishes and reports it instead of waiting on a close that waits on them.
+ */
+function recordCloses(server: http.Server, held: ReturnType<typeof holdingApp>): string[][] {
+	const closes: string[][] = [];
+	const close = server.close.bind(server);
+	server.close = ((callback?: (err?: Error) => void) => {
+		closes.push([...held.inFlight]);
+		held.releaseAll();
+		return close(callback);
+	}) as typeof server.close;
+	return closes;
+}
+
+describe("supertest's own server listens on the loopback address it dials", () => {
 	it("binds 127.0.0.1, not the dual-stack wildcard", async () => {
 		const server = http.createServer(helloApp());
 		const bound = boundAddress(server);
@@ -97,6 +151,123 @@ describe("#556 — supertest's own server listens on the loopback address it dia
 		expect(responses.map((res) => res.status)).toEqual([200, 200]);
 	});
 
+	it("closes an agent's one server after the last request sent over it, not the first", async () => {
+		// The request built first is the one whose call bound the server. Closing
+		// the server when that one finishes, as supertest 7.2 does, resets the
+		// connection of a request still on its way: ECONNRESET on Node 26.
+		const held = holdingApp();
+		const server = http.createServer(held.app);
+		const closes = recordCloses(server, held);
+		const agent = request.agent(server);
+
+		const first = agent.get("/hold/first");
+		const second = agent.get("/hold/second");
+		const both = Promise.all([first, second]);
+		await Promise.all([held.arrived("first"), held.arrived("second")]);
+		held.release("first");
+		await first;
+		held.release("second");
+
+		expect((await both).map((res) => res.text)).toEqual(["first", "second"]);
+		expect(closes).toEqual([[]]);
+		expect(server.listening).toBe(false);
+	});
+
+	it("keeps it open for a request sent while the server is already serving another", async () => {
+		const held = holdingApp();
+		const server = http.createServer(held.app);
+		const closes = recordCloses(server, held);
+		const agent = request.agent(server);
+
+		// A Test is sent when it is first awaited or `then`ed; the identity
+		// `then` sends each one here, before the test waits for its arrival.
+		const first = agent.get("/hold/first").then((res) => res);
+		await held.arrived("first");
+		const late = agent.get("/hold/late").then((res) => res);
+		await held.arrived("late");
+		held.release("first");
+		await first;
+		held.release("late");
+
+		expect((await late).text).toBe("late");
+		expect(closes).toEqual([[]]);
+		expect(server.listening).toBe(false);
+	});
+
+	it("binds again for a request built before the server was closed, and sent after", async () => {
+		const agent = request.agent(helloApp());
+
+		const first = agent.get("/hello");
+		const second = agent.get("/hello");
+
+		expect((await first).status).toBe(200);
+		expect((await second).status).toBe(200);
+	});
+
+	it("joins the bind another request made since, for a request built before the server was closed", async () => {
+		// Built on the first bind, sent while a later request is being served
+		// on the second: it joins that bind — one server, two requests in
+		// flight — and the server closes once, after the last of them.
+		const held = holdingApp();
+		const server = http.createServer(held.app);
+		const closes = recordCloses(server, held);
+		const agent = request.agent(server);
+
+		const early = agent.get("/hold/early");
+		const first = agent.get("/hold/first").then((res) => res);
+		await held.arrived("first");
+		held.release("first");
+		expect((await first).text).toBe("first");
+		expect(server.listening).toBe(false);
+
+		const second = agent.get("/hold/second").then((res) => res);
+		await held.arrived("second");
+		const earlySent = early.then((res) => res);
+		await held.arrived("early");
+		held.release("second");
+		expect((await second).text).toBe("second");
+		expect(server.listening).toBe(true);
+		held.release("early");
+
+		expect((await earlySent).text).toBe("early");
+		expect(closes).toEqual([[], []]);
+		expect(server.listening).toBe(false);
+	});
+
+	it("serves a request built on a bind that failed, once another request has bound the server again", async () => {
+		// The first `listen` lands on a port another socket holds; the bind
+		// fails, and the request built on it is not sent until a later request
+		// has bound the server on a free port. It joins that bind rather than
+		// failing with the error of the one it was built on.
+		const held: net.Socket[] = [];
+		const squatter = net.createServer((socket) => {
+			held.push(socket);
+		});
+		await new Promise<void>((resolve) => squatter.listen(0, "127.0.0.1", resolve));
+		const { port } = squatter.address() as AddressInfo;
+
+		const server = http.createServer(helloApp());
+		const listen = server.listen.bind(server) as (...args: unknown[]) => net.Server;
+		let steered = false;
+		(server as { listen: (...args: unknown[]) => net.Server }).listen = (requested, ...rest) => {
+			if (steered) return listen(requested, ...rest);
+			steered = true;
+			return listen(port, ...rest);
+		};
+
+		try {
+			const failed = new Promise<void>((resolve) => server.once("error", () => resolve()));
+			const builtOnTheFailedBind = request(server).get("/hello");
+			await failed;
+			expect((await request(server).get("/hello")).status).toBe(200);
+			expect((await builtOnTheFailedBind).status).toBe(200);
+			expect(server.listening).toBe(false);
+		} finally {
+			for (const socket of held) socket.destroy();
+			squatter.close();
+		}
+	}, 5_000);
+
 	it("fails the request, instead of hanging on another socket, when 127.0.0.1:P is taken", async () => {
 		// The collision the kernel produces by chance, produced on purpose: a
 		// socket that accepts and never answers holds 127.0.0.1:P, and the