@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/audit-sink.test.mts

@@ -15,22 +15,19 @@
  */
 
 /**
- * #287 — the audit-event pipeline existed and the scaffold wired no sink, so
- * every security-relevant event the routes emit (`token.issued.failure`,
- * `authorize.rejected`, `rate_limit.unavailable`, …) was dropped by the
- * artifact operators actually deploy. `emitAuditEvent` is a no-op when the
- * slot is empty, so nothing failed and nothing warned: the deployment simply
- * had no audit trail.
+ * The scaffold wires an audit sink. `emitAuditEvent` is a no-op when the slot
+ * is empty, so without one every security-relevant event the routes emit
+ * (`token.issued.failure`, `authorize.rejected`, `rate_limit.unavailable`, …)
+ * is dropped, and nothing fails or warns.
  *
- * These tests pin the closure from three sides — the sink implementation, the
- * module that resolves it from config, and the manifest that must contain
- * exactly one provider for the slot.
+ * Pinned from three sides: the sink implementation, the module that resolves
+ * it from config, and the manifest, which must contain exactly one provider
+ * for the slot.
  */
 
 import { generateKeyPairSync } from "node:crypto";
 import { readFileSync } from "node:fs";
 import {
-	type AppConfig,
 	type AuditEvent,
 	type AuditSink,
 	createApp,
@@ -42,34 +39,56 @@ import {
 	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
+import { coreConfigForTests } from "@o3co/auth-provider-core/testing";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "../buildModules.mjs";
+import type { Switches } from "../configPath.mjs";
 import { createAppLogger, createAuditLogger, createLoggerAuditSink } from "../logger.mjs";
-import { auditSinkModule } from "../modules.mjs";
+import { auditSinkModuleFor } from "../modules.mjs";
+import { capturedRenames, shippedAdapters } from "./library-references.fixture.mjs";
 
 const keyPair = generateKeyPairSync("ed25519", {
 	publicKeyEncoding: { type: "spki", format: "pem" },
 	privateKeyEncoding: { type: "pkcs8", format: "pem" },
 });
 
-const baseConfig: AppConfig = {
-	http: { port: 0, trustProxy: false, readinessTimeoutMs: 1000 },
+/** The template modules' sections sit beside core's, so the configuration is wider than `AppConfig`. */
+const baseConfig: Switches & Record<string, unknown> = {
+	// The shipped selections, every store in this process.
+	adapters: {
+		...shippedAdapters(),
+		accessTokenDenylist: "memory",
+		replaySeenSet: "memory",
+		codeRepository: "memory",
+		userRepository: "yaml",
+	},
+	mfaMode: "off",
+	storeTransport: undefined,
+	// What a resolution under an environment that sets none captures of
+	// core's renamed variables.
+	...{
+		"renamed-variables": capturedRenames({}),
+	},
+	http: { port: 0, trustProxy: false, readinessTimeoutMs: 1000, cors: { allowedOrigins: [] } },
 	logging: { level: "silent" },
+	"key-store": {
+		provider: "local",
+		local: {
+			algorithm: "EdDSA",
+			kid: "v0",
+			privateKey: keyPair.privateKey,
+			publicKey: keyPair.publicKey,
+			previousKeys: [],
+		},
+	},
+	// The shipped `application.conf` expects no session requirement (ADR
+	// 2026-09-28-session-admission).
+	...coreConfigForTests({ federations: { google: { enabled: false } } }),
 	oauth: {
 		jwt: {
 			issuer: "https://auth.test",
-			signingKey: {
-				provider: "local",
-				local: {
-					algorithm: "EdDSA",
-					kid: "v0",
-					privateKey: keyPair.privateKey,
-					publicKey: keyPair.publicKey,
-					previousKeys: [],
-				},
-			},
 		},
 		accessToken: { expiresIn: 3600 },
 		refreshToken: {
@@ -79,9 +98,8 @@ const baseConfig: AppConfig = {
 		},
 		grants: {},
 		oidcMode: "oidc-required",
-		code: { adapter: "memory" as const },
 	},
-	session: {
+	"session-store": {
 		secret: "test-session-secret.at-least-32-bytes.ok",
 		name: "auth.sid",
 		maxAge: 3600000,
@@ -90,19 +108,12 @@ const baseConfig: AppConfig = {
 		domain: null,
 		storage: { type: "memory", redis: { url: "redis://localhost:6379" } },
 	},
-	rateLimit: {
-		login: { windowMs: 60000, limit: 10 },
-		failMode: "open",
-	},
-	federations: { google: { enabled: false } },
-	repositories: {
-		client: { type: "yaml", path: "./config/clients.yaml" },
-		user: { type: "yaml", path: "./config/users.yaml", timeout: 5000 },
-		code: { type: "memory", defaultExpiresIn: 600 },
+	session: {
+		loginPage: { url: "/login" },
+		rateLimit: { login: { windowMs: 60000, limit: 10 } },
 	},
-	endpoints: { login: { url: "/login" } },
-	cors: { allowedOrigins: [] },
-	audit: { sink: { type: "logger" } },
+	rateLimit: { failMode: "open" },
+	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
 };
 
 const CLIENT_ID = "audit-client";
@@ -143,7 +154,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
@@ -163,14 +174,14 @@ function fakeLogger(): Logger & { info: ReturnType<typeof vi.fn> } {
 	return self as unknown as Logger & { info: ReturnType<typeof vi.fn> };
 }
 
-/** Resolve `auditSink` the way the boot planner does: call the module's provider. */
-async function resolveSink(config: AppConfig): Promise<AuditSink> {
-	const provider = auditSinkModule.provides?.auditSink;
-	if (!provider) throw new Error("auditSinkModule must provide the auditSink slot");
-	return (await provider({ config } as never)) as AuditSink;
+/** Resolve `auditSink` the way the boot planner does: call the module's provider with its section. */
+async function resolveSink(sink: string, section?: Record<string, unknown>): Promise<AuditSink> {
+	const provider = auditSinkModuleFor(sink).provides?.auditSink;
+	if (!provider) throw new Error("the audit-sink module must provide the auditSink slot");
+	return (await provider({ section } as never)) as AuditSink;
 }
 
-describe("#287: the template's audit sink", () => {
+describe("the template's audit sink", () => {
 	describe("createLoggerAuditSink — one event, one line, through the app's own JSON stream", () => {
 		it("records the event through the injected logger", async () => {
 			const logger = fakeLogger();
@@ -218,11 +229,10 @@ describe("#287: the template's audit sink", () => {
 
 	describe("the audit trail is not gated by logging.level", () => {
 		it("keeps the audit logger at info while the app logger is silenced", () => {
-			// An audit trail is evidence, not diagnostics. `LOG_LEVEL=warn` is an
-			// ordinary production setting and `silent` is a legitimate one; if
-			// either silenced audit events, #287 would be back — the same silent
-			// drop, reached from the operator's side instead of the scaffold's.
-			const appLogger = createAppLogger({ ...baseConfig, logging: { level: "silent" } });
+			// An audit trail is evidence, not diagnostics. `LOGGING_LEVEL=warn` is an
+			// ordinary production setting and `silent` is a legitimate one;
+			// neither may silently drop audit events.
+			const appLogger = createAppLogger({ level: "silent" });
 			const auditLogger = createAuditLogger();
 			expect((appLogger as unknown as { level: string }).level).toBe("silent");
 			expect((auditLogger as unknown as { level: string }).level).toBe("info");
@@ -236,31 +246,24 @@ describe("#287: the template's audit sink", () => {
 		});
 	});
 
-	describe("auditSinkModule — resolves the sink from config", () => {
-		it("resolves the logger sink for the shipped default", async () => {
-			expect((await resolveSink(baseConfig)).kind).toBe("logger");
+	describe("the audit-sink module — builds the sink adapters.auditSink selects", () => {
+		it("builds the logger sink for the shipped selection", async () => {
+			expect((await resolveSink(baseConfig.adapters.auditSink)).kind).toBe("logger");
 		});
 
-		it("resolves core's built-in console sink when selected", async () => {
-			const sink = await resolveSink({ ...baseConfig, audit: { sink: { type: "console" } } });
-			expect(sink.kind).toBe("console");
+		it("builds core's built-in console sink when selected", async () => {
+			expect((await resolveSink("console")).kind).toBe("console");
 		});
 
-		it("still produces a sink when the audit section is absent entirely", async () => {
-			// The failure #287 describes is silent absence. A config that says
-			// nothing about auditing must land on a sink, not on `undefined`.
-			const { audit: _audit, ...withoutAudit } = baseConfig;
-			const sink = await resolveSink(withoutAudit as AppConfig);
-			expect(sink.kind).toBe("logger");
+		it("builds a sink with no audit-sink section at all", async () => {
+			expect((await resolveSink("logger", undefined)).kind).toBe("logger");
 		});
 
-		it("refuses an unknown sink type at boot, naming what is registered", async () => {
-			// There is no "none" — #304's sink policy. An operator who writes one
-			// gets a boot failure naming the sinks that exist, not a silent
-			// deployment with no audit trail.
-			await expect(
-				resolveSink({ ...baseConfig, audit: { sink: { type: "none" } } }),
-			).rejects.toThrow(/none/);
+		it("refuses a sink no builder is registered under, naming it", async () => {
+			// There is no "none" sink. An operator who selects one gets a boot
+			// failure naming the sinks that exist, not a silent deployment with
+			// no audit trail.
+			await expect(resolveSink("none")).rejects.toThrow(/none/);
 		});
 	});
 
@@ -273,13 +276,13 @@ describe("#287: the template's audit sink", () => {
 			});
 			const providers = modules.filter((m) => Object.keys(m.provides ?? {}).includes("auditSink"));
 			expect(providers).toHaveLength(1);
-			expect(providers[0]?.name).toBe("standalone:audit-sink");
+			expect(providers[0]?.name).toBe("audit-sink");
 		});
 
-		it("the shipped application.conf selects a sink, and never 'none'", () => {
-			const conf = readFileSync(new URL("../../config/application.conf", import.meta.url), "utf8");
-			expect(conf).toMatch(/audit\s*\{[\s\S]*?sink\s*\{[\s\S]*?type\s*=\s*"logger"/);
-			expect(conf).not.toMatch(/type\s*=\s*"none"/);
+		it("the shipped reference.conf selects a sink, and never 'none'", () => {
+			const conf = readFileSync(new URL("../../config/reference.conf", import.meta.url), "utf8");
+			expect(conf).toMatch(/adapters\s*\{[\s\S]*?auditSink\s*=\s*"logger"/);
+			expect(conf).not.toMatch(/auditSink\s*=\s*"none"/);
 		});
 	});
 
@@ -292,11 +295,10 @@ describe("#287: the template's audit sink", () => {
 		});
 
 		it("records token.issued.failure for an unsupported grant_type", async () => {
-			// Before #287 this assertion could not fail: nothing filled the slot,
-			// so `emitAuditEvent` returned without recording anything.
+			// `emitAuditEvent` records nothing when the slot is empty.
 			const logger = fakeLogger();
 			const spyAuditModule = defineModule({
-				name: "standalone:audit-sink",
+				name: "audit-sink",
 				provides: { auditSink: () => createLoggerAuditSink(logger) },
 			});
 			const handle = await createApp({

package/templates/standalone/src/__tests__/configPath.test.mts

@@ -16,8 +16,10 @@
 
 import { existsSync } from "node:fs";
 import { isAbsolute } from "node:path";
+import { fileURLToPath } from "node:url";
+import { coreReference } from "@o3co/auth-provider-core";
 import { describe, expect, it } from "vitest";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { resolveConfigPaths } from "../configPath.mjs";
 
 describe("resolveConfigPaths", () => {
 	it("accepts a configDirPath with a trailing slash (regression: fileURLToPath preserves trailing /)", () => {
@@ -51,17 +53,17 @@ describe("resolveConfigPaths", () => {
 	});
 });
 
-describe("resolveLibraryReferenceConfPath", () => {
-	it("returns an absolute path ending in reference.conf", () => {
-		const path = resolveLibraryReferenceConfPath();
-		expect(path.endsWith("reference.conf")).toBe(true);
-		// Use `isAbsolute` rather than `startsWith("/")` so the assertion
-		// holds on Windows (e.g. `C:\...`) as well as POSIX paths.
+describe("core's reference.conf, as the template layers it", () => {
+	// `coreReference()` names the file `@o3co/auth-provider-core` exports as
+	// `./reference.conf`: the one a composition root that installed the
+	// package would resolve, and the bottom of every layering the template
+	// makes (`readSwitches`, `resolveForBoot`).
+	it("is the file the package exports as ./reference.conf, and it exists", () => {
+		const path = fileURLToPath(coreReference());
 		expect(isAbsolute(path)).toBe(true);
-	});
-
-	it("points to a file that exists on disk", () => {
-		const path = resolveLibraryReferenceConfPath();
 		expect(existsSync(path)).toBe(true);
+		expect(path).toBe(
+			fileURLToPath(import.meta.resolve("@o3co/auth-provider-core/reference.conf")),
+		);
 	});
 });

package/templates/standalone/src/__tests__/core-federations.test.mts

@@ -0,0 +1,226 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The federations the template ships, in core's own section:
+ * `core.federations.google` and `core.federations.oidc`, each bound to the
+ * variables named after its paths (`CORE_FEDERATIONS_<NAME>_<KEY>`). Phase
+ * one chooses the federation modules from the map there. A variable the
+ * template bound before, `FEDERATIONS_<NAME>_<KEY>`, set alone or beside its
+ * new name at a different value is refused before any module is chosen,
+ * naming the new variable and path and never a value; the two at one value
+ * are accepted. The map written at the top level refuses boot, naming its
+ * paths under `core.federations`.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createApp } from "@o3co/auth-provider-core";
+import { afterAll, describe, expect, it } from "vitest";
+import { buildModules } from "#/buildModules.mjs";
+import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "#/configPath.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+/** The directories the operator layers are written to, removed after the suite. */
+const operatorDirs: string[] = [];
+afterAll(() => {
+	for (const dir of operatorDirs) rmSync(dir, { recursive: true, force: true });
+});
+
+/** The template's own files for the production environment, under an operator's layer when given. */
+function ownFiles(hocon?: string): string[] {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
+	if (hocon === undefined) return [envConfPath, applicationConfPath];
+	const dir = mkdtempSync(join(tmpdir(), "core-federations-"));
+	operatorDirs.push(dir);
+	const file = join(dir, "operator.conf");
+	writeFileSync(file, hocon);
+	return [file, envConfPath, applicationConfPath];
+}
+
+/** MFA, on by default, switched off: these are about the federations. */
+const MFA_OFF: Readonly<Record<string, string>> = { MFA_MODE: "off" };
+
+/** Phase one under `env` and an operator's `hocon`. */
+const switchesFrom = (env: Record<string, string> = {}, hocon?: string) =>
+	readSwitches(readOwnLayers(ownFiles(hocon), { env: { ...MFA_OFF, ...env } }));
+
+/** What phase one refuses under `env`. */
+function refusal(env: Record<string, string>): Error {
+	try {
+		switchesFrom(env);
+	} catch (err) {
+		return err as Error;
+	}
+	throw new Error("phase one read the switches");
+}
+
+/** The federations phase one reads, by name. */
+const federationsOf = (env: Record<string, string> = {}) =>
+	(switchesFrom(env).core as { federations?: Record<string, Record<string, unknown>> } | undefined)
+		?.federations ?? {};
+
+/** The modules phase one chooses under `env`, by name. */
+const moduleNames = (env: Record<string, string>) =>
+	buildModules(switchesFrom(env), { environment: "production" }).map((module) => module.name);
+
+/** Each variable the template binds: its key under the federation, the old name and the new. */
+const RENAMED = [
+	["google", "enabled", "FEDERATIONS_GOOGLE_ENABLED", "CORE_FEDERATIONS_GOOGLE_ENABLED", "true"],
+	[
+		"google",
+		"clientId",
+		"FEDERATIONS_GOOGLE_CLIENT_ID",
+		"CORE_FEDERATIONS_GOOGLE_CLIENT_ID",
+		"g-id",
+	],
+	[
+		"google",
+		"clientSecret",
+		"FEDERATIONS_GOOGLE_CLIENT_SECRET",
+		"CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET",
+		"g-secret",
+	],
+	[
+		"google",
+		"callbackURL",
+		"FEDERATIONS_GOOGLE_CALLBACK_URL",
+		"CORE_FEDERATIONS_GOOGLE_CALLBACK_URL",
+		"https://auth.test/session/oauth/federation/google/callback",
+	],
+	[
+		"google",
+		"accessType",
+		"FEDERATIONS_GOOGLE_ACCESS_TYPE",
+		"CORE_FEDERATIONS_GOOGLE_ACCESS_TYPE",
+		"online",
+	],
+	["oidc", "enabled", "FEDERATIONS_OIDC_ENABLED", "CORE_FEDERATIONS_OIDC_ENABLED", "true"],
+	["oidc", "issuer", "FEDERATIONS_OIDC_ISSUER", "CORE_FEDERATIONS_OIDC_ISSUER", "https://idp.test"],
+	["oidc", "clientId", "FEDERATIONS_OIDC_CLIENT_ID", "CORE_FEDERATIONS_OIDC_CLIENT_ID", "o-id"],
+	[
+		"oidc",
+		"clientSecret",
+		"FEDERATIONS_OIDC_CLIENT_SECRET",
+		"CORE_FEDERATIONS_OIDC_CLIENT_SECRET",
+		"o-secret",
+	],
+	[
+		"oidc",
+		"callbackURL",
+		"FEDERATIONS_OIDC_CALLBACK_URL",
+		"CORE_FEDERATIONS_OIDC_CALLBACK_URL",
+		"https://auth.test/session/oauth/federation/oidc/callback",
+	],
+] as const;
+
+describe("the federations the template ships, under core.federations", () => {
+	it("ships google and oidc disabled, oidc of type oidc", () => {
+		const federations = federationsOf();
+		expect(federations.google?.enabled).toBe(false);
+		expect(federations.oidc).toMatchObject({ enabled: false, type: "oidc" });
+	});
+
+	it.each(RENAMED)(
+		"reads core.federations.%s.%s from %s's new name",
+		(name, key, _old, variable, value) => {
+			expect(String(federationsOf({ [variable]: value })[name]?.[key])).toBe(value);
+		},
+	);
+
+	it("chooses the Google federation's modules when CORE_FEDERATIONS_GOOGLE_ENABLED is true, and none while it is not", () => {
+		expect(moduleNames({ CORE_FEDERATIONS_GOOGLE_ENABLED: "true" })).toContain("federation-google");
+		expect(moduleNames({})).not.toContain("federation-google");
+	});
+
+	it("chooses an OIDC federation's module for an entry of type oidc written under core.federations", () => {
+		const names = buildModules(
+			switchesFrom(
+				{},
+				'core.federations.okta { enabled = true, type = "oidc", issuer = "https://okta.test", clientId = "c", clientSecret = "s", callbackURL = "https://auth.test/session/oauth/federation/okta/callback" }\n',
+			),
+			{ environment: "production" },
+		).map((module) => module.name);
+		expect(names).toContain("federation-oidc-okta");
+	});
+});
+
+describe("a variable the template bound before, FEDERATIONS_<NAME>_<KEY>", () => {
+	it.each(RENAMED)(
+		"core.federations.%s.%s: %s set alone is refused before any module is chosen, naming %s",
+		(name, key, old, variable, value) => {
+			const err = refusal({ [old]: value });
+			expect(err).toBeInstanceOf(RangeError);
+			expect(err.message).toContain(`${old} was renamed ${variable}`);
+			expect(err.message).toContain(`core.federations.${name}.${key}`);
+		},
+	);
+
+	it.each(RENAMED)(
+		"core.federations.%s.%s: %s beside its new name at a different value is refused, quoting neither",
+		(_name, _key, old, variable) => {
+			const err = refusal({ [old]: "old-value-5e2d", [variable]: "new-value-c81a" });
+			expect(err.message).toContain(old);
+			expect(err.message).not.toContain("old-value-5e2d");
+			expect(err.message).not.toContain("new-value-c81a");
+		},
+	);
+
+	it.each(RENAMED)(
+		"core.federations.%s.%s: %s beside its new name at the same value is read",
+		(name, key, old, variable, value) => {
+			expect(String(federationsOf({ [old]: value, [variable]: value })[name]?.[key])).toBe(value);
+		},
+	);
+});
+
+describe("the map written at the top level", () => {
+	it("refuses boot, naming its paths under core.federations", async () => {
+		const own = readOwnLayers(ownFiles("federations.okta.enabled = false\n"), {
+			env: {
+				...MFA_OFF,
+				KEY_STORE_LOCAL_SECRET: "core-federations-secret.at-least-32-bytes.ok",
+				OAUTH_JWT_ISSUER: "https://auth.test",
+				SESSION_STORE_SECRET: "core-federations-session.at-least-32-bytes.ok",
+			},
+		});
+		const switches = readSwitches(own);
+		const modules = buildModules(switches, { environment: "production" });
+		await expect(
+			createApp({
+				modules,
+				bootstrapComponents: {
+					config: resolveForBoot(own, modules, switches),
+					pathResolver: (s: string) => s,
+				} as never,
+			}),
+		).rejects.toMatchObject({
+			reason: "config-path-relocated",
+			details: {
+				relocated: [
+					expect.objectContaining({
+						from: "federations.okta.enabled",
+						to: "core.federations.okta.enabled",
+						environmentVariable: "CORE_FEDERATIONS_OKTA_ENABLED",
+					}),
+				],
+			},
+		});
+	});
+});