@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/federation-grants-survive-logout.test.mts

@@ -15,22 +15,20 @@
  */
 
 /**
- * #593 acceptance criterion 8, at the two HTTP logout endpoints (D14).
- *
- * A federation grant outlives the session it was agreed through. The proof of
- * that used to be a direct call to `cascadeLogout()` — which is the cascade
- * `/oauth/logout` runs, and not what `/session/logout` runs: that endpoint has
- * its own record hygiene (`invalidateSessionRecords`) and reaches the grant
- * store on no path, by construction. A proof of the helper is not a proof of
- * the endpoints. So this drives both, on the standalone, as a deployment
- * composes them: a grant seeded beside a live browser session, the session's
- * records gone afterwards, the grant and its credential exactly as they were,
- * and `/token` still disclosing.
+ * A federation grant outlives the session it was agreed through, at both HTTP
+ * logout endpoints (ADR 2026-09-17-federation-grants-offline-delegation).
+ * `/oauth/logout` runs `cascadeLogout()`; `/session/logout` has its own record
+ * hygiene (`invalidateSessionRecords`) and reaches the grant store on no path,
+ * by construction. A proof of the helper is not a proof of the endpoints, so
+ * this drives both, on the standalone, as a deployment composes them: a grant
+ * seeded beside a live browser session, the session's records gone afterwards,
+ * the grant and its credential exactly as they were, and `/token` still
+ * disclosing.
  *
  * The seeded grant's access token is fresh, so the disclosure is the cached
- * one and no upstream is asked — the OIDC federation the connection names is
- * configured with `discovery = false` and hand-typed endpoints so that the
- * deployment boots without a network.
+ * one and no upstream is asked; the OIDC federation the connection names has
+ * `discovery = false` and hand-typed endpoints so the deployment boots without
+ * a network.
  */
 
 import { createHmac } from "node:crypto";
@@ -44,6 +42,7 @@ import {
 	type FederationTokenStore,
 	federationGrantAuthorizationRevision,
 	federationGrantIdentityRevision,
+	federationsOf,
 	InMemoryClientRepository,
 	InMemoryUserRepository,
 	type MemoryFederationGrantStore,
@@ -57,7 +56,14 @@ import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { resolveConfigPaths, type Switches } from "../configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import {
+	capturedRenames,
+	libraryLayers,
+	rootSectionsOf,
+	sectionsCoreDoesNotDeclare,
+} from "./library-references.fixture.mjs";
 
 const DAY = 86_400_000;
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
@@ -83,69 +89,81 @@ const REFRESH_TOKEN = "SENTINEL-refresh-token";
 const ACCESS_TOKEN = "upstream-access-token";
 
 const ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: JWT_SECRET,
+	// The logout here is a session without a second factor.
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: JWT_SECRET,
 	OAUTH_JWT_ISSUER: ISSUER,
-	SESSION_SECRET: "federation-grants-survive-logout-session.at-least-32-bytes.ok",
-	SESSION_SECURE: "false",
-	SESSION_NAME: "auth.session",
-	SESSION_STORAGE_TYPE: "memory",
-	CLIENT_USER_TYPE: "yaml",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "memory",
-	RATE_LIMITER_ADAPTER: "memory",
-	OAUTH_CODE_ADAPTER: "memory",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-	REPLAY_SEEN_SET_ADAPTER: "memory",
-	FEDERATION_TOKEN_STORE_TYPE: "memory",
-	CONSENT_STORE_ADAPTER: "none",
-	FEDERATION_GRANT_STORE_ADAPTER: "memory",
-	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+	SESSION_STORE_SECRET: "federation-grants-survive-logout-session.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "memory",
+	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+	ADAPTERS_CONSENT_STORE: "none",
+	ADAPTERS_FEDERATION_GRANT_STORE: "memory",
+	ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 	FEDERATION_GRANTS_ENABLED: "true",
 	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
 	// The connect flow is not driven here, and the bundled repository has no
 	// identity lookup; "unsupported" is the declaration a deployment without one
-	// makes (#613), and what lets a connection be configured at all.
+	// makes, and what lets a connection be configured at all.
 	FEDERATION_GRANTS_IDENTITY_LOOKUP: "unsupported",
 };
 
 /**
  * The shipped configuration under the environment above, with the two lists
- * that have no environment form (comment 9 on #593) written over it: the
+ * that have no environment form written over it: the
  * upstream federation the connection names, and the connection.
  */
-function resolveConfig(): AppConfig {
+function resolveConfig(): Switches {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	const config = validate(
-		parseFile(envConfPath, { env: ENV })
-			.withFallback(parseFile(applicationConfPath, { env: ENV }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: ENV })),
-		AppConfigSchema,
-	);
+	const layers = parseFile(envConfPath, { env: ENV })
+		.withFallback(parseFile(applicationConfPath, { env: ENV }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env: ENV }))
+		.withFallback(libraryLayers(ENV));
+	const config = validate(layers, AppConfigSchema);
 	return {
+		...sectionsCoreDoesNotDeclare(layers),
+		...rootSectionsOf(layers, ENV),
 		...config,
-		federations: {
-			...config.federations,
-			upstream: {
-				enabled: true,
-				type: "oidc",
-				issuer: UPSTREAM,
-				clientId: UPSTREAM_CLIENT_ID,
-				clientSecret: "provider-secret",
-				callbackURL: `${ISSUER}/session/oauth/federation/upstream/callback`,
-				scopes: [...SCOPES],
-				discovery: false,
-				endpoints: {
-					authorizationEndpoint: `${UPSTREAM}/authorize`,
-					tokenEndpoint: `${UPSTREAM}/token`,
-					jwksUri: `${UPSTREAM}/jwks`,
+		// What the resolution captured of core's renamed variables, which the
+		// schema's parse drops.
+		"renamed-variables": capturedRenames(ENV),
+		core: {
+			...config.core,
+			federations: {
+				...federationsOf(config),
+				upstream: {
+					enabled: true,
+					type: "oidc",
+					issuer: UPSTREAM,
+					clientId: UPSTREAM_CLIENT_ID,
+					clientSecret: "provider-secret",
+					callbackURL: `${ISSUER}/session/oauth/federation/upstream/callback`,
+					scopes: [...SCOPES],
+					discovery: false,
+					endpoints: {
+						authorizationEndpoint: `${UPSTREAM}/authorize`,
+						tokenEndpoint: `${UPSTREAM}/token`,
+						jwksUri: `${UPSTREAM}/jwks`,
+					},
+					redirectAllowlist: [],
 				},
-				redirectAllowlist: [],
 			},
 		},
-		federationGrants: {
-			...config.federationGrants,
+		"redis-federation-grant-store": {
+			...(config["redis-federation-grant-store"] as object | undefined),
 			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
+		},
+		"federation-grants": {
+			...config["federation-grants"],
 			connections: {
 				[CONNECTION]: {
 					federation: "upstream",
@@ -156,7 +174,7 @@ function resolveConfig(): AppConfig {
 				},
 			},
 		},
-	} as AppConfig;
+	} as Switches;
 }
 
 const testRepositoriesModule = defineModule({
@@ -198,7 +216,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
@@ -245,6 +263,7 @@ async function seedGrant(store: MemoryFederationGrantStore): Promise<void> {
 				tokenType: "Bearer",
 				obtainedAt: at,
 				issuedLifetime: 3600,
+				effectiveExpiresAt: new Date(at.getTime() + 3_600_000),
 				scopes: [...SCOPES],
 			},
 		},
@@ -284,7 +303,7 @@ const claimsOf = (jwt: string): Record<string, unknown> =>
 		unknown
 	>;
 
-describe("#593 AC8: a grant outlives the browser session at both logout endpoints (D14)", () => {
+describe("a grant outlives the browser session at both logout endpoints", () => {
 	let handleRef: Awaited<ReturnType<typeof createApp>> | undefined;
 
 	afterEach(async () => {
@@ -331,7 +350,7 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 		expect(loginRes.status).toBe(200);
 
 		const cookies = loginRes.headers["set-cookie"] as unknown as string[];
-		const csrfCookiePrefix = `${config.session.name}.csrf=`;
+		const csrfCookiePrefix = `${(config["session-store"] as { name: string }).name}.csrf=`;
 		const reissued = cookies
 			.find((c) => c.startsWith(csrfCookiePrefix))
 			?.slice(csrfCookiePrefix.length)
@@ -385,18 +404,19 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 			await boot();
 		const { cookies, csrfToken, headerName } = await login(app, config);
 		const sid = await sidOf(app, cookies);
-		// A session-bound upstream token beside the grant: the record #276's
-		// guarantee is about, keyed by this session.
+		// A session-bound upstream token beside the grant, keyed by this
+		// session: a record logout must end.
 		await federationTokenStore.attach(sid, "upstream", {
 			accessToken: "session-bound-upstream-token",
 			expiresAt: null,
-			// Every field is a required key since the #645 follow-up; this
-			// record carries only the access token.
+			// Every field is a required key; this record carries only the
+			// access token.
 			refreshToken: undefined,
 			idToken: undefined,
 			tokenType: undefined,
 			scope: undefined,
 			grantedScope: undefined,
+			obtainedAt: undefined,
 		});
 		expect(await userSessionStore.get(sid)).not.toBeNull();
 		await expectGrantUntouched(app, federationGrantStore);
@@ -407,7 +427,7 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 			.set(headerName, csrfToken);
 		expect([200, 204]).toContain(logout.status);
 
-		// The session-bound records are gone (#276 holds) ...
+		// The session-bound records are gone ...
 		expect(await userSessionStore.get(sid)).toBeNull();
 		expect(await federationTokenStore.get(sid, "upstream")).toBeNull();
 		// ... and the grant is not among them.
@@ -422,13 +442,14 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 		await federationTokenStore.attach(sid, "upstream", {
 			accessToken: "session-bound-upstream-token",
 			expiresAt: null,
-			// Every field is a required key since the #645 follow-up; this
-			// record carries only the access token.
+			// Every field is a required key; this record carries only the
+			// access token.
 			refreshToken: undefined,
 			idToken: undefined,
 			tokenType: undefined,
 			scope: undefined,
 			grantedScope: undefined,
+			obtainedAt: undefined,
 		});
 		expect(await userSessionStore.get(sid)).not.toBeNull();
 		await expectGrantUntouched(app, federationGrantStore);

package/templates/standalone/src/__tests__/federation-token-refresh-outage.test.mts

@@ -16,8 +16,8 @@
 
 /**
  * `POST /oauth/federation/:name/token` ends a session's upstream tokens only
- * on the upstream's own verdict that the refresh token is bad — a structured
- * `invalid_grant` under a 4xx — and never while the upstream is down, whatever
+ * on the upstream's own verdict that the refresh token is bad (a structured
+ * `invalid_grant` under a 4xx), and never while the upstream is down, whatever
  * the body of its 5xx says. An outage is `503`, and the tokens are kept for
  * the retry.
  *
@@ -26,8 +26,7 @@
  * are the ones the library raises: a 4xx whose body names a code is a
  * `ResponseBodyError` carrying `error` and `status`; a 5xx is an
  * `OperationProcessingError` raised over the `Response`, whose body the
- * library does not read — and which the route used to answer `500
- * refresh_failed`, as if the upstream had said something it could not place.
+ * library does not read.
  */
 
 import { createFakeIdp, type FakeIdp } from "@o3co/auth-provider-core/testing";
@@ -76,6 +75,7 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 				tokenType: "Bearer",
 				scope: "openid profile email",
 				grantedScope: "openid profile email",
+				obtainedAt: undefined,
 			},
 		});
 		const res = await request(session.app)
@@ -128,6 +128,8 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 		expect(res.status).toBe(410);
 		expect(res.body.error).toBe("re_authentication_required");
 		expect(await federationTokenStore.get(sid, "google")).toBeNull();
-		expect(await sessionFederationIndex.listFederations(sid)).not.toContain("google");
+		// The route never writes the session's index: the link, now holding no
+		// credential, stays listed until federation logout or the session's end.
+		expect(await sessionFederationIndex.listFederations(sid)).toContain("google");
 	});
 });

package/templates/standalone/src/__tests__/google-federation-config-module.test.mts

@@ -15,11 +15,10 @@
  */
 
 /**
- * #278: the bridge used to return only `{ clientId, clientSecret, callbackURL }`,
- * dropping the four fields the redirect policy reads. Nothing failed — the
- * policy was simply constructed with an empty config, and the generated app
- * silently ran without a redirect allowlist. These tests fail if the bridge
- * stops forwarding any of them.
+ * The bridge forwards, beside `{ clientId, clientSecret, callbackURL }`, the
+ * four fields the redirect policy reads. A field it dropped would fail nothing
+ * at boot: the policy would be built as if the operator had not configured it.
+ * These tests fail if the bridge stops forwarding any of them.
  */
 
 import type { GoogleProviderConfig } from "@o3co/auth-provider-federation-google";
@@ -34,9 +33,11 @@ const bridge = (
 	}
 ).provides.googleFederationConfig;
 
-/** Runs the bridge over a `federations.google` section in the flat shape. */
+/** Runs the bridge over a `core.federations.google` entry in the flat shape. */
 function buildConfig(googleSection: Record<string, unknown>): GoogleProviderConfig {
-	return bridge({ config: { federations: { google: { enabled: true, ...googleSection } } } });
+	return bridge({
+		config: { core: { federations: { google: { enabled: true, ...googleSection } } } },
+	});
 }
 
 const credentials = {
@@ -45,7 +46,7 @@ const credentials = {
 	callbackURL: "https://auth.example.com/session/oauth/federation/google/callback",
 };
 
-describe("googleFederationConfigModule — redirect-policy plumbing (#278)", () => {
+describe("googleFederationConfigModule — redirect-policy plumbing", () => {
 	it("forwards sessionDomain, authCallbackUrl, clientUrl and redirectAllowlist", () => {
 		const out = buildConfig({
 			...credentials,
@@ -97,13 +98,15 @@ describe("googleFederationConfigModule — redirect-policy plumbing (#278)", ()
 	it("reads through the nested federation shape as well as the flat one", () => {
 		const out = bridge({
 			config: {
-				federations: {
-					google: {
-						enabled: true,
-						type: "google",
-						sessionDomain: ".example.com",
-						redirectAllowlist: ["https://app.example.com/dashboard"],
-						google: credentials,
+				core: {
+					federations: {
+						google: {
+							enabled: true,
+							type: "google",
+							sessionDomain: ".example.com",
+							redirectAllowlist: ["https://app.example.com/dashboard"],
+							google: credentials,
+						},
 					},
 				},
 			},
@@ -113,7 +116,7 @@ describe("googleFederationConfigModule — redirect-policy plumbing (#278)", ()
 	});
 });
 
-describe("googleFederationConfigModule — requireAuthorizationResponseIss (#597)", () => {
+describe("googleFederationConfigModule — requireAuthorizationResponseIss", () => {
 	it("is absent by default, so the provider's own default (required) applies", () => {
 		expect("requireAuthorizationResponseIss" in buildConfig(credentials)).toBe(false);
 	});
@@ -157,14 +160,14 @@ describe("googleFederationConfigModule — requireAuthorizationResponseIss (#597
 
 	it("refuses an empty value, which elsewhere reads as false: exported-but-empty must not switch this check off", () => {
 		expect(() => buildConfig({ ...credentials, requireAuthorizationResponseIss: "" })).toThrow(
-			/federations\.google\.requireAuthorizationResponseIss/,
+			/core\.federations\.google\.requireAuthorizationResponseIss/,
 		);
 	});
 
 	it("refuses anything else: a typo must not silently switch the check off, or leave it on", () => {
 		for (const bad of ["no", "off", 0, 1, []]) {
 			expect(() => buildConfig({ ...credentials, requireAuthorizationResponseIss: bad })).toThrow(
-				/federations\.google\.requireAuthorizationResponseIss/,
+				/core\.federations\.google\.requireAuthorizationResponseIss/,
 			);
 		}
 	});
@@ -192,7 +195,7 @@ describe("googleFederationConfigModule — accessType", () => {
 	it("refuses anything else at boot, naming the key", () => {
 		for (const bad of ["", "offine", "Online", "true", false, 1]) {
 			expect(() => buildConfig({ ...credentials, accessType: bad })).toThrow(
-				/federations\.google\.accessType/,
+				/core\.federations\.google\.accessType/,
 			);
 		}
 	});

package/templates/standalone/src/__tests__/google-session.fixture.mts

@@ -15,27 +15,23 @@
  */
 
 /**
- * A browser session with Google linked, on the standalone as a deployment
- * composes it: `oauthModule`, the session module and the real Google adapter,
- * booted through `createApp` under the shipped configuration.
+ * A browser session with Google linked, on the standalone composed as a
+ * deployment does: `oauthModule`, the session module and the real Google
+ * adapter, booted through `createApp` under the shipped configuration.
  *
- * The routes that act on a session's federation — the two logout routes and
- * `POST /oauth/federation/:name/token` — live in `@o3co/auth-provider-oauth`,
- * which depends on no adapter, so its own tests stand one in. What they hand
- * the adapter, and what they make of what its library raises, can only be
- * seen here.
+ * The two logout routes and `POST /oauth/federation/:name/token` live in
+ * `@o3co/auth-provider-oauth`, which depends on no adapter; only here can a
+ * test see what they hand the real adapter and what they make of what its
+ * library raises.
  *
- * Not `all-modules-composition.fixture.mts`: that one switches every module
- * on and signs with a key it keeps to itself. The tests here present an
- * `id_token_hint` and an access token of their own — a caller's, with the
- * claims the case needs — so the deployment signs with an HS256 secret this
- * file holds, and nothing but Google is federated.
+ * Unlike `all-modules-composition.fixture.mts`, the deployment signs with an
+ * HS256 secret this file holds, so tests can present an `id_token_hint` and
+ * access token of their own; nothing but Google is federated.
  */
 
 import { createHmac } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import {
-	type AppConfig,
 	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
@@ -59,7 +55,14 @@ import express from "express";
 import request from "supertest";
 import { expect } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "#/configPath.mjs";
+import { resolveConfigPaths, type Switches } from "#/configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import {
+	capturedRenames,
+	libraryLayers,
+	rootSectionsOf,
+	sectionsCoreDoesNotDeclare,
+} from "./library-references.fixture.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 
@@ -82,22 +85,24 @@ const GOOGLE_CLIENT_SECRET = "google-secret";
 const GOOGLE_CALLBACK = `${ISSUER}/session/oauth/federation/google/callback`;
 
 const ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: JWT_SECRET,
+	// A session signed in through Google alone, no second factor.
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: JWT_SECRET,
 	OAUTH_JWT_ISSUER: ISSUER,
-	SESSION_SECRET: "google-session.fixture-session.at-least-32-bytes.ok",
-	SESSION_SECURE: "false",
-	SESSION_NAME: "auth.session",
-	SESSION_STORAGE_TYPE: "memory",
-	CLIENT_USER_TYPE: "yaml",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "memory",
-	RATE_LIMITER_ADAPTER: "memory",
-	OAUTH_CODE_ADAPTER: "memory",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-	REPLAY_SEEN_SET_ADAPTER: "memory",
-	FEDERATION_TOKEN_STORE_TYPE: "memory",
-	CONSENT_STORE_ADAPTER: "none",
+	SESSION_STORE_SECRET: "google-session.fixture-session.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "memory",
+	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+	ADAPTERS_CONSENT_STORE: "none",
 };
 
 /**
@@ -111,24 +116,30 @@ export type GoogleWiring =
 	| "shipped"
 	| Omit<GoogleProviderConfig, "clientId" | "clientSecret" | "callbackURL">;
 
-function resolveConfig(google: GoogleWiring): AppConfig {
+function resolveConfig(google: GoogleWiring): Switches {
 	const env: Record<string, string> =
 		google === "shipped"
 			? {
 					...ENV,
-					FEDERATIONS_GOOGLE_ENABLED: "true",
-					FEDERATIONS_GOOGLE_CLIENT_ID: GOOGLE_CLIENT_ID,
-					FEDERATIONS_GOOGLE_CLIENT_SECRET: GOOGLE_CLIENT_SECRET,
-					FEDERATIONS_GOOGLE_CALLBACK_URL: GOOGLE_CALLBACK,
+					CORE_FEDERATIONS_GOOGLE_ENABLED: "true",
+					CORE_FEDERATIONS_GOOGLE_CLIENT_ID: GOOGLE_CLIENT_ID,
+					CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: GOOGLE_CLIENT_SECRET,
+					CORE_FEDERATIONS_GOOGLE_CALLBACK_URL: GOOGLE_CALLBACK,
 				}
 			: { ...ENV };
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return validate(
-		parseFile(envConfPath, { env })
-			.withFallback(parseFile(applicationConfPath, { env }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
-		AppConfigSchema,
-	) as AppConfig;
+	const layers = parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.withFallback(libraryLayers(env));
+	return {
+		...sectionsCoreDoesNotDeclare(layers),
+		...rootSectionsOf(layers, env),
+		...validate(layers, AppConfigSchema),
+		// What the resolution captured of core's renamed variables, which the
+		// schema's parse drops.
+		"renamed-variables": capturedRenames(env),
+	} as Switches;
 }
 
 const testRepositoriesModule = defineModule({
@@ -170,7 +181,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/__tests__/host-routes.test.mts

@@ -15,17 +15,10 @@
  */
 
 /**
- * The host's own routes — liveness, readiness, the metrics scrape — mounted
- * as the process mounts them (`mountRoutes`), and what an error one of them
- * lets through is answered with.
- *
- * The composed router answers its own errors with core's terminal handler.
- * The host's routes sat in front of a handler of the template's own, which
- * answered in other words ("Internal server error"), took any 4xx `status`
- * for the client's mistake and answered it as one, handed an error on to
- * Express once the headers were out (whose final handler prints the stack),
- * and logged the path as it arrived. Core's handler is now the one after
- * them too, so a deployment answers every route's error the same way.
+ * The host's own routes (liveness, readiness, the metrics scrape), mounted as
+ * the process mounts them (`mountRoutes`), and what an error one of them lets
+ * through is answered with: core's terminal handler, the same one behind the
+ * composed router, so every route's error is answered the same way.
  */
 
 import type { Logger, ReadinessProbe } from "@o3co/auth-provider-core";