@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/all-modules-composition.multi.test.mts

@@ -16,32 +16,31 @@
 
 /**
  * The all-modules composition of `all-modules-composition.test.mts` on more
- * than one replica: every shared store on Redis, `deployment.mode = "multi"`,
+ * than one replica: every shared store on Redis, `core.deployment.mode = "multi"`,
  * every module the template can turn on switched on together.
  *
- * What it holds: the replica-safety declarations hold with every module on —
- * the all-Redis composition boots with nothing declaring replica-unsafe state,
- * and each store switched back to memory is refused at boot, naming the
- * module — and the Redis adapters change nothing a client can see: the same
- * routes, the same discovery document as on one replica.
+ * With every module on, the all-Redis composition boots with nothing declaring
+ * replica-unsafe state, and each store switched back to memory is refused at
+ * boot, naming the module. The Redis adapters change nothing a client can
+ * see: the same routes, the same discovery document as on one replica.
  *
  * ioredis, node-redis and connect-redis are stand-ins, as in
- * `replica-safety.test.mts`: what is under test is the composition and the
- * boot's verdict, and nothing here issues a command. The template has no
- * Redis server to run against — `packages/redis` runs its adapters against
- * one.
+ * `replica-safety.test.mts`: nothing here issues a command. `packages/redis`
+ * runs its adapters against a real server.
  */
 
 import { type Module, replicaUnsafeReason } from "@o3co/auth-provider-core";
 import * as redisPackage from "@o3co/auth-provider-redis";
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
+import { readOwnLayers, resolveForBoot } from "#/configPath.mjs";
 import { standaloneRedisClientsModule } from "#/modules.mjs";
 import {
 	type Composition,
 	compose,
 	composedModules,
 	MULTI_ENV,
+	ownFiles,
 	resolveConfig,
 } from "./all-modules-composition.fixture.mjs";
 
@@ -110,7 +109,7 @@ const MULTI = { env: MULTI_ENV, shippedRefreshTokenFamilyStore: true } as const;
 
 /** What `buildModules` lists with every switch on and every shared store on Redis. */
 const ALL_ON_REDIS_MODULES = [
-	"sessionStoreModule",
+	"session-store",
 	"federation-grant-background",
 	"federation-grants",
 	"oauth",
@@ -118,19 +117,22 @@ const ALL_ON_REDIS_MODULES = [
 	"oauth-authorization",
 	"jwks",
 	"session",
-	"federation:google",
-	"standalone:google-federation-config",
-	"standalone:oidc-federation-config",
-	"federation:oidc:oidc",
-	"standalone:key-store",
+	"federation-google-type",
+	"federation-oidc",
+	"logging",
+	"http",
+	"key-store",
 	"test:repositories",
-	"standalone:audit-sink",
-	"standalone:redis-clients",
+	"audit-sink",
+	"standard-smtp-mail-sender",
+	"redis-clients",
 	"redis-federation-token-store",
 	"redis-federation-grant-store",
 	"redis-federation-grant-intent-store",
-	"redisSessionStores",
+	"redis-session-stores",
+	"core-session-lifecycle",
 	"redis-rate-limiter",
+	"redis-attempt-counter",
 	"redis-code-repository",
 	"redis-access-token-denylist",
 	"redis-replay-seen-set",
@@ -141,11 +143,18 @@ const ALL_ON_REDIS_MODULES = [
 	"subject-revocation-service",
 ];
 
-describe('every module on, every shared store on Redis, deployment.mode = "multi"', () => {
+describe('every module on, every shared store on Redis, core.deployment.mode = "multi"', () => {
 	it("lists every module, none declaring replica-unsafe state, and boots", async () => {
-		const modules = composedModules(resolveConfig(MULTI_ENV), MULTI);
+		const own = readOwnLayers(ownFiles(MULTI_ENV), { env: MULTI_ENV });
+		const config = resolveConfig(MULTI_ENV, own);
+		const modules = composedModules(config, MULTI);
 		expect(modules.map((m) => m.name)).toEqual(ALL_ON_REDIS_MODULES);
-		for (const module of modules) expect(replicaUnsafeReason(module), module.name).toBeUndefined();
+		// Each module's section at its name, as boot is handed it: a
+		// declaration made from the section is answered for it.
+		const sections = resolveForBoot(own, modules, config) as unknown as Record<string, unknown>;
+		for (const module of modules) {
+			expect(replicaUnsafeReason(module, sections[module.name]), module.name).toBeUndefined();
+		}
 		current = await compose(MULTI);
 		expect(current.handle.readinessProbes.map((p) => p.name)).toContain("redis");
 	});
@@ -166,21 +175,36 @@ describe('every module on, every shared store on Redis, deployment.mode = "multi
 		expect(discovery.body).toEqual(single.discovery);
 	});
 
+	it("boots as multi on CORE_DEPLOYMENT_MODE=multi alone", async () => {
+		expect(MULTI_ENV).toMatchObject({ CORE_DEPLOYMENT_MODE: "multi" });
+		expect(MULTI_ENV).not.toHaveProperty("DEPLOYMENT_MODE");
+		current = await compose(MULTI);
+		expect(current.handle.components.deploymentMode).toBe("multi");
+	});
+
+	it("boots as multi on DEPLOYMENT_MODE=multi beside CORE_DEPLOYMENT_MODE=multi, as the umbrella sets them", async () => {
+		current = await compose({
+			...MULTI,
+			env: { ...MULTI_ENV, DEPLOYMENT_MODE: "multi", CORE_DEPLOYMENT_MODE: "multi" },
+		});
+		expect(current.handle.components.deploymentMode).toBe("multi");
+	});
+
 	/**
 	 * Each store's switch back to memory, alone, with every module on. The
 	 * boot names the module that declared the state it would fork.
 	 */
 	const MEMORY_SWITCHES: ReadonlyArray<readonly [variable: string, module: string]> = [
-		["SESSION_STORAGE_TYPE", "sessionStoreModule"],
-		["USER_SESSION_STORES_ADAPTER", "standalone:in-memory-session-stores"],
-		["OAUTH_CODE_ADAPTER", "standalone:in-memory-code-repository"],
-		["FEDERATION_TOKEN_STORE_TYPE", "standalone:in-memory-federation-token-store"],
-		["RATE_LIMITER_ADAPTER", "core-rate-limiter-memory"],
-		["ACCESS_TOKEN_DENYLIST_ADAPTER", "core-access-token-denylist-memory"],
-		["REPLAY_SEEN_SET_ADAPTER", "core-replay-seen-set-memory"],
-		["CONSENT_STORE_ADAPTER", "core-consent-store-memory"],
-		["FEDERATION_GRANT_STORE_ADAPTER", "core-federation-grant-store-memory"],
-		["FEDERATION_GRANT_INTENT_STORE_ADAPTER", "core-federation-grant-intent-store-memory"],
+		["SESSION_STORE_STORAGE_TYPE", "session-store"],
+		["ADAPTERS_USER_SESSION_STORES", "standalone-in-memory-session-stores"],
+		["ADAPTERS_CODE_REPOSITORY", "standalone-in-memory-code-repository"],
+		["ADAPTERS_FEDERATION_TOKEN_STORE", "standalone-in-memory-federation-token-store"],
+		["ADAPTERS_RATE_LIMITER", "core-rate-limiter-memory"],
+		["ADAPTERS_ACCESS_TOKEN_DENYLIST", "core-access-token-denylist-memory"],
+		["ADAPTERS_REPLAY_SEEN_SET", "core-replay-seen-set-memory"],
+		["ADAPTERS_CONSENT_STORE", "core-consent-store-memory"],
+		["ADAPTERS_FEDERATION_GRANT_STORE", "core-federation-grant-store-memory"],
+		["ADAPTERS_FEDERATION_GRANT_INTENT_STORE", "core-federation-grant-intent-store-memory"],
 	];
 
 	it.each(MEMORY_SWITCHES)("%s=memory is refused at boot, naming %s", async (variable, module) => {
@@ -193,6 +217,18 @@ describe('every module on, every shared store on Redis, deployment.mode = "multi
 		});
 	});
 
+	it("ADAPTERS_ATTEMPT_COUNTER=memory is refused at boot: the login would count its attempts per replica", async () => {
+		await expect(
+			compose({ ...MULTI, env: { ...MULTI_ENV, ADAPTERS_ATTEMPT_COUNTER: "memory" } }),
+		).rejects.toMatchObject({
+			name: "BootError",
+			reason: "contribute-factory-failed",
+			cause: {
+				message: expect.stringContaining('no shared attemptCounter is wired for "login"'),
+			},
+		});
+	});
+
 	it("names every memory store together when every switch is memory", async () => {
 		const env = { ...MULTI_ENV };
 		for (const [variable] of MEMORY_SWITCHES) env[variable] = "memory";
@@ -212,8 +248,8 @@ describe("the shared Redis socket can back every store the Redis package ships",
 	 * the others to the manifest with the modules that read them (the device
 	 * grant's code store, WebAuthn's challenge store), and each requires its
 	 * client from this module. One it does not provide is a boot refused with
-	 * `missing-required-component` — the #439 shape, which `modules.mts`
-	 * guards against for the device-code store by name.
+	 * `missing-required-component`, which `modules.mts` guards against for
+	 * the device-code store by name.
 	 */
 	const storeModules: Module[] = Object.entries(redisPackage).flatMap(([name, value]) => {
 		if (name.endsWith("ModuleFor") && typeof value === "function") {
@@ -226,7 +262,7 @@ describe("the shared Redis socket can back every store the Redis package ships",
 	});
 
 	it.each(storeModules.map((m) => [m.name, m] as const))(
-		"%s: its client slot is provided by standalone:redis-clients",
+		"%s: its client slot is provided by redis-clients",
 		(_name, module) => {
 			const provided = Object.keys(standaloneRedisClientsModule.provides ?? {});
 			const clients = (module.requires ?? []).filter((slot) => String(slot).endsWith("Client"));