@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.1

package/templates/standalone/src/__tests__/post-logout-redirect.test.mts

@@ -22,16 +22,11 @@
  *
  * Google publishes no end-session endpoint, and without one configured its
  * adapter sends the browser straight to the `postLogoutRedirectUri` it is
- * handed. Both logout routes used to hand it the caller's value unchecked,
- * ahead of the allowlist check that guarded their own redirect, so a fresh
- * id_token of the caller's own and `post_logout_redirect_uri=https://evil…`
- * made this provider's origin answer `303` to any site. With an end-session
- * endpoint configured, the unchecked value was forwarded to the upstream
- * instead.
- *
- * The redirect asserted here is the one a browser would follow: the real
- * Google adapter, composed as a deployment composes it
- * (`google-session.fixture.mts`).
+ * handed: unchecked, a caller's own fresh id_token would make this provider's
+ * origin answer `303` to any site. With an end-session endpoint configured,
+ * an unchecked value would be forwarded to the upstream instead. The real
+ * Google adapter is composed (`google-session.fixture.mts`), so the redirect
+ * asserted is the one a browser would follow.
  */
 
 import type express from "express";
@@ -73,6 +68,7 @@ describe("a logout's post_logout_redirect_uri reaches the upstream only once it
 				tokenType: "Bearer",
 				scope: undefined,
 				grantedScope: undefined,
+				obtainedAt: undefined,
 			},
 		});
 		return session;
@@ -107,7 +103,7 @@ describe("a logout's post_logout_redirect_uri reaches the upstream only once it
 			expect(res.status).toBe(303);
 			expect(new URL(res.headers.location as string).origin).not.toBe("https://evil.example");
 			// Google's own logout page: the adapter's answer when it is handed no
-			// redirect target, which is what an unregistered one now is.
+			// redirect target, which is what an unregistered one becomes.
 			expect(res.headers.location).toBe(`${GOOGLE_LOGOUT}?state=s-1`);
 			// The logout itself still happened.
 			expect(await userSessionStore.get(sid)).toBeNull();

package/templates/standalone/src/__tests__/redis-connection-error-log.test.mts

@@ -108,11 +108,7 @@ describe("standaloneRedisClientsModule: the shared connection refused by the ser
 		).provides;
 		try {
 			await provides.refreshTokenFamilyClient({
-				config: {
-					refreshTokenFamilyStore: {
-						redis: { url: `redis://127.0.0.1:${redis.port}`, password: STALE_PASSWORD },
-					},
-				},
+				section: { url: `redis://127.0.0.1:${redis.port}`, password: STALE_PASSWORD },
 				lifecycleRegistrar,
 				logger,
 			});

package/templates/standalone/src/__tests__/redis-rate-limiter-config-survives.test.mts

@@ -15,83 +15,82 @@
  */
 
 /**
- * #495 / #496 — end to end, through this template's real resolution chain.
- *
- * `app.mts` resolves `{env}.conf → application.conf → reference.conf` and
- * validates the result with `AppConfigSchema` before `buildModules` runs.
- * The schema strips what it does not declare, so a section declared by a
- * module rather than by core used to vanish at exactly that step — and,
- * because `redisRateLimiterModule.configSchema` carries a
- * `.default({ limit: 60, windowSeconds: 60 })`, the deployment that
- * `docker-compose.production.yml` ships (`RATE_LIMITER_ADAPTER: redis`) then
- * ran on 60 requests / 60 s no matter what the operator wrote.
- *
- * This starts from the shipped configuration, adds the two overrides an
- * operator writes in their own `application.conf` layer, and follows them all
- * the way to the limiter the module builds.
+ * Sections declared by a module rather than by core (`redis-rate-limiter`,
+ * `mtls`) survive this template's real resolution chain, end to end.
+ * Starting from the shipped configuration plus an operator's own layer, the
+ * overrides are followed through both configuration phases and `createApp`
+ * to the limiter the module builds. Were `redis-rate-limiter` lost, the
+ * module's default of 60 requests / 60 s would apply to the deployment
+ * `docker-compose.production.yml` ships (`ADAPTERS_RATE_LIMITER: redis`)
+ * whatever the operator wrote.
  */
 
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { type AppConfig, AppConfigSchema, type RateLimiter } from "@o3co/auth-provider-core";
+import {
+	type AppConfig,
+	createApp,
+	defineModule,
+	type RateLimiter,
+} from "@o3co/auth-provider-core";
 import { redisRateLimiterModule } from "@o3co/auth-provider-redis";
-import { parseFile, parseString } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
-import { describe, expect, it } from "vitest";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "../configPath.mjs";
+import { loggingModule } from "../modules.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 
 /**
  * The secrets `application.conf` substitutes, plus the one
  * `docker-compose.production.yml` sets to put the OAuth endpoints behind a
- * shared limiter. Test-only values; #282's entropy floor applies to the two
+ * shared limiter. Test-only values; the entropy floor applies to the two
  * secrets, and the `.` characters keep them out of the base64 alphabet so the
  * UTF-8 length is what counts.
  */
 const ENV = {
-	OAUTH_JWT_SECRET: "test-secret-rate-limiter-e2e.at-least-32-bytes.ok",
+	KEY_STORE_LOCAL_SECRET: "test-secret-rate-limiter-e2e.at-least-32-bytes.ok",
 	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_SECRET: "test-session-secret-rate-limiter-e2e.at-least-32-bytes.ok",
-	RATE_LIMITER_ADAPTER: "redis",
+	SESSION_STORE_SECRET: "test-session-secret-rate-limiter-e2e.at-least-32-bytes.ok",
+	ADAPTERS_RATE_LIMITER: "redis",
+	MFA_MODE: "off",
 };
 
 /**
  * What an operator adds to their own `application.conf` layer: per-endpoint
  * budgets for the Redis limiter, and the mTLS posture from
  * `@o3co/auth-provider-mtls`. Neither section appears in anything this
- * template ships, which is why neither was ever covered by a `.conf` diff.
+ * template ships.
  */
 const OPERATOR_OVERRIDES = `
-redisRateLimiter {
+redis-rate-limiter {
   limits {
     token { limit = 120, windowSeconds = 60 }
     authorize { limit = 30, windowSeconds = 60 }
   }
 }
 
-oauth.mtls {
+mtls {
   enabled = true
   mode = "full-pki"
-  trusted-cas = ["-----BEGIN CERTIFICATE-----"]
-  full-pki {
+  trustedCas = ["-----BEGIN CERTIFICATE-----"]
+  fullPki {
     revocation {
       mode = "crl"
-      on-unavailable = "reject"
-      allowed-hosts = ["crl.example.com"]
+      onUnavailable = "reject"
+      allowedHosts = ["crl.example.com"]
     }
   }
 }
 `;
 
-function resolveShippedConfig(): AppConfig {
+/** The composition's own files: the operator's layer over the shipped production ones. */
+function ownFiles(): string[] {
+	const operator = join(mkdtempSync(join(tmpdir(), "redis-rate-limiter-")), "operator.conf");
+	writeFileSync(operator, OPERATOR_OVERRIDES);
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return validate(
-		parseString(OPERATOR_OVERRIDES, { env: ENV })
-			.withFallback(parseFile(envConfPath, { env: ENV }))
-			.withFallback(parseFile(applicationConfPath, { env: ENV }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: ENV })),
-		AppConfigSchema,
-	);
+	return [operator, envConfPath, applicationConfPath];
 }
 
 /** Counts one request per key, the way an untouched Redis counter would. */
@@ -99,79 +98,111 @@ function makeCountingClient(): { incrementWithTtl: (key: string, ttl: number) =>
 	return { incrementWithTtl: async () => 1 };
 }
 
-function buildLimiter(config: AppConfig): RateLimiter {
-	const provides = (
-		redisRateLimiterModule as unknown as {
-			provides: Record<string, (deps: Record<string, unknown>) => RateLimiter>;
-		}
-	).provides;
-	const provider = provides.rateLimiter;
-	if (!provider) throw new Error("redisRateLimiterModule no longer provides rateLimiter");
-	return provider({ config, rateLimiterClient: makeCountingClient() });
+/** The limiter a consumer of the slot is handed, as a route module would be. */
+let consumed: RateLimiter | undefined;
+const consumerModule = defineModule({
+	name: "test:rate-limiter-consumer",
+	requires: ["rateLimiter"] as const,
+	contributes: {
+		grantMiddleware: [
+			({ rateLimiter }) => {
+				consumed = rateLimiter;
+				return null;
+			},
+		],
+	},
+});
+
+/** The shipped configuration through both phases, booted with the Redis limiter's module. */
+async function bootShipped() {
+	const own = readOwnLayers(ownFiles(), { env: ENV });
+	const switches = readSwitches(own);
+	const modules = [redisRateLimiterModule, consumerModule];
+	return {
+		switches,
+		handle: await createApp({
+			modules,
+			bootstrapComponents: {
+				// The template's own reference too, which its application.conf is layered over.
+				config: resolveForBoot(own, [...modules, loggingModule], switches),
+				pathResolver: (s: string) => s,
+				rateLimiterClient: makeCountingClient() as never,
+			},
+		}),
+	};
 }
 
-describe("the shipped configuration reaches the Redis rate limiter (#495)", () => {
-	const config = resolveShippedConfig();
+let booted: Awaited<ReturnType<typeof bootShipped>>;
+let config: AppConfig;
+let limiter: RateLimiter;
+
+beforeAll(async () => {
+	booted = await bootShipped();
+	const parsed = booted.handle.components.config;
+	const built = consumed;
+	if (parsed === undefined || built === undefined) {
+		throw new Error("the boot filled no config, or handed no consumer the limiter");
+	}
+	config = parsed;
+	limiter = built;
+});
 
-	it("selects the Redis adapter the production compose file pins", () => {
-		expect(config.rateLimiter?.adapter).toBe("redis");
+afterAll(async () => {
+	await booted?.handle.dispose();
+});
+
+describe("the shipped configuration reaches the Redis rate limiter", () => {
+	it("selects the Redis adapter the production compose file pins, in phase one", () => {
+		expect(booted.switches.adapters.rateLimiter).toBe("redis");
 	});
 
-	it("carries the operator's per-endpoint budgets through the pre-parse", () => {
-		expect(config.redisRateLimiter?.limits).toEqual({
+	it("carries the operator's per-endpoint budgets through boot's parse", () => {
+		expect(
+			(config as unknown as Record<string, { limits?: unknown }>)["redis-rate-limiter"]?.limits,
+		).toEqual({
 			token: { limit: 120, windowSeconds: 60 },
 			authorize: { limit: 30, windowSeconds: 60 },
 		});
 	});
 
 	it("applies the declared budget at /token", async () => {
-		const decision = await buildLimiter(config).check("token:ip:203.0.113.5", {
-			ip: "203.0.113.5",
-		});
+		const decision = await limiter.check("token:ip:203.0.113.5", { ip: "203.0.113.5" });
 		expect(decision.limit).toBe(120);
 	});
 
 	it("applies the declared budget at /authorize", async () => {
-		const decision = await buildLimiter(config).check("authorize:ip:203.0.113.5", {
-			ip: "203.0.113.5",
-		});
+		const decision = await limiter.check("authorize:ip:203.0.113.5", { ip: "203.0.113.5" });
 		expect(decision.limit).toBe(30);
 	});
 
 	it("still falls back to the module's default where nothing is declared", async () => {
-		// The point of the assertion above: 60 is what EVERY endpoint got while
-		// the section was stripped, so a test that only saw 60 could not tell a
-		// working configuration from a lost one.
-		const decision = await buildLimiter(config).check("introspect:ip:203.0.113.5", {
-			ip: "203.0.113.5",
-		});
+		// 60 is what every endpoint would get were the section stripped, so the
+		// budgets above differ from it to tell a working configuration from a
+		// lost one.
+		const decision = await limiter.check("introspect:ip:203.0.113.5", { ip: "203.0.113.5" });
 		expect(decision.limit).toBe(60);
 	});
 
-	it("keeps seeding /session/login from rateLimit.login", async () => {
-		// `resolveSeededLimitSpecs` reads a declared section, so this worked
-		// even while `redisRateLimiter` was being stripped — which is why the
-		// defect showed up only at the endpoints below it.
-		const decision = await buildLimiter(config).check("login:ip:203.0.113.5", {
-			ip: "203.0.113.5",
-		});
-		expect(decision.limit).toBe(config.rateLimit?.login.limit);
+	it("applies no login budget without the session module: session.rateLimit.login is that module's to contribute", async () => {
+		// This boot loads the limiter alone. With the session module, the
+		// limiter applies the budget it contributes from session.rateLimit.login.
+		expect(config.session).toMatchObject({ rateLimit: { login: { limit: 20 } } });
+		const decision = await limiter.check("login:ip:203.0.113.5", { ip: "203.0.113.5" });
+		expect(decision.limit).toBe(60);
 	});
 });
 
-describe("the shipped configuration carries an mTLS posture through (#496)", () => {
-	const config = resolveShippedConfig();
-
+describe("the shipped configuration carries an mTLS posture through", () => {
 	it("keeps the operator's mTLS block instead of reporting mTLS off", () => {
-		expect(config.oauth.mtls).toEqual({
+		expect((config as unknown as { mtls?: unknown }).mtls).toEqual({
 			enabled: true,
 			mode: "full-pki",
-			"trusted-cas": ["-----BEGIN CERTIFICATE-----"],
-			"full-pki": {
+			trustedCas: ["-----BEGIN CERTIFICATE-----"],
+			fullPki: {
 				revocation: {
 					mode: "crl",
-					"on-unavailable": "reject",
-					"allowed-hosts": ["crl.example.com"],
+					onUnavailable: "reject",
+					allowedHosts: ["crl.example.com"],
 				},
 			},
 		});

package/templates/standalone/src/__tests__/refresh-token-family-client-module.test.mts

@@ -16,10 +16,10 @@
 import type { LifecycleRegistrar } from "@o3co/auth-provider-core";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-// D-2 v2: ioredis Redis constructor capture. The module under test imports
+// ioredis Redis constructor capture. The module under test imports
 // `Redis` from "ioredis"; vi.mock replaces that import so the test never
 // opens a real socket. Captured arguments verify that the validated config
-// reaches the constructor (BLOCKER 1: schema strip closure).
+// reaches the constructor.
 const redisCtorCalls: Array<{ url: string; options: Record<string, unknown> | undefined }> = [];
 const quitSpies: Array<ReturnType<typeof vi.fn>> = [];
 const onSpies: Array<ReturnType<typeof vi.fn>> = [];
@@ -60,17 +60,10 @@ const importModule = async () =>
 		standaloneRedisClientsModule: import("@o3co/auth-provider-core").Module;
 	};
 
-// D-1 / D-5 are already merged on develop, so importing `standaloneRedisClientsModule`
-// from `../modules.mjs` is the natural integration point. Pre-fix the export does not
-// exist — TS error → RED.
+/** The module's own section, `redis-clients`, as boot hands it over. */
+const baseSection = { url: "redis://example.com:6379", password: "test-pw" };
 
-const baseConfig = {
-	refreshTokenFamilyStore: {
-		redis: { url: "redis://example.com:6379", password: "test-pw" },
-	},
-};
-
-describe("D-2 / standaloneRedisClientsModule", () => {
+describe("standaloneRedisClientsModule", () => {
 	beforeEach(() => {
 		redisCtorCalls.length = 0;
 		quitSpies.length = 0;
@@ -81,14 +74,14 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 		vi.restoreAllMocks();
 	});
 
-	it("passes operator-supplied Redis URL + password from config to the ioredis constructor (BLOCKER 1 closure)", async () => {
+	it("passes the operator's Redis URL and password from its section to the ioredis constructor", async () => {
 		const { standaloneRedisClientsModule } = await importModule();
 		const provides = (
 			standaloneRedisClientsModule as unknown as {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig } });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
 
 		expect(redisCtorCalls).toHaveLength(1);
 		expect(redisCtorCalls[0]?.url).toBe("redis://example.com:6379");
@@ -109,7 +102,7 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig }, lifecycleRegistrar });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection }, lifecycleRegistrar });
 
 		expect(registered).toHaveLength(1);
 		// Pre-drain: quit not yet called.
@@ -133,12 +126,12 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 		// after the factory resolves; the registrar branch is the only place
 		// `quit()` would be wired up in the no-real-shutdown unit-test path).
 		await expect(
-			provides.refreshTokenFamilyClient({ config: { ...baseConfig } }),
+			provides.refreshTokenFamilyClient({ section: { ...baseSection } }),
 		).resolves.toBeDefined();
 		expect(quitSpies[0]).not.toHaveBeenCalled();
 	});
 
-	it("fails fast when refreshTokenFamilyStore.redis.url is missing (no silent localhost fallback)", async () => {
+	it("fails fast on an empty redis-clients.url (no silent localhost fallback)", async () => {
 		const { standaloneRedisClientsModule } = await importModule();
 		const provides = (
 			standaloneRedisClientsModule as unknown as {
@@ -146,11 +139,12 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 			}
 		).provides;
 
-		// Operator deliberately removed the section — must throw instead of
-		// silently falling back to redis://localhost:6379 (which would re-
-		// introduce the OR-1 multi-replica failure mode in production).
-		await expect(provides.refreshTokenFamilyClient({ config: {} })).rejects.toThrow(
-			/refreshTokenFamilyStore\.redis\.url/,
+		// An operator who blanked the URL — must throw instead of silently
+		// falling back to redis://localhost:6379, which in production would
+		// leave each replica with refresh-token families the others cannot
+		// see. A section with no URL at all is refused by boot's parse of it.
+		await expect(provides.refreshTokenFamilyClient({ section: { url: "" } })).rejects.toThrow(
+			/redis-clients\.url/,
 		);
 		// And no ioredis instance was constructed because we threw before
 		// `new Redis(...)`.
@@ -164,12 +158,12 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig } });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
 
 		expect(onSpies[0]).toHaveBeenCalledWith("error", expect.any(Function));
 	});
 
-	it("bounds every command and every connect attempt (#286)", async () => {
+	it("bounds every command and every connect attempt", async () => {
 		// Without these the driver's defaults apply: no command timeout at all,
 		// a 10s connect timeout, and 20 reconnect attempts before a queued
 		// command is failed. A partition therefore parks in-flight `/token`
@@ -181,7 +175,7 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig } });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
 
 		const options = redisCtorCalls[0]?.options;
 		expect(options?.commandTimeout).toBe(1_000);
@@ -193,7 +187,7 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 		expect(options?.lazyConnect).toBe(false);
 	});
 
-	it("keeps the offline queue ON, explicitly, because one socket serves every purpose (#286)", async () => {
+	it("keeps the offline queue ON, explicitly, because one socket serves every purpose", async () => {
 		// `enableOfflineQueue` is a per-CONNECTION option and every adapter in
 		// this template draws from the single socket built below, so the
 		// "off for the rate limiter, on elsewhere" split is not expressible
@@ -207,18 +201,18 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
 			}
 		).provides;
-		await provides.refreshTokenFamilyClient({ config: { ...baseConfig } });
+		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
 
 		expect(redisCtorCalls[0]?.options?.enableOfflineQueue).toBe(true);
 	});
 
-	it("declares 'config' as required and both registrars as optional", async () => {
+	it("requires no configuration, and takes both registrars as optional", async () => {
 		const { standaloneRedisClientsModule } = await importModule();
 		const m = standaloneRedisClientsModule as {
 			requires?: readonly string[];
 			optional?: readonly string[];
 		};
-		expect(m.requires).toContain("config");
+		expect(m.requires ?? []).not.toContain("config");
 		expect(m.optional).toContain("lifecycleRegistrar");
 		expect(m.optional).toContain("readinessRegistrar");
 	});
@@ -238,12 +232,12 @@ describe("D-2 / standaloneRedisClientsModule", () => {
 		const lifecycleRegistrar: LifecycleRegistrar = { register: () => {} };
 
 		await provides.refreshTokenFamilyClient({
-			config: { ...baseConfig },
+			section: { ...baseSection },
 			lifecycleRegistrar,
 			readinessRegistrar,
 		});
 		await provides.rateLimiterClient({
-			config: { ...baseConfig },
+			section: { ...baseSection },
 			lifecycleRegistrar,
 			readinessRegistrar,
 		});