@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/audit-sink.test.mts

@@ -15,16 +15,14 @@
  */
 
 /**
- * #287 — the audit-event pipeline existed and the scaffold wired no sink, so
- * every security-relevant event the routes emit (`token.issued.failure`,
- * `authorize.rejected`, `rate_limit.unavailable`, …) was dropped by the
- * artifact operators actually deploy. `emitAuditEvent` is a no-op when the
- * slot is empty, so nothing failed and nothing warned: the deployment simply
- * had no audit trail.
+ * The scaffold wires an audit sink. `emitAuditEvent` is a no-op when the slot
+ * is empty, so without one every security-relevant event the routes emit
+ * (`token.issued.failure`, `authorize.rejected`, `rate_limit.unavailable`, …)
+ * is dropped, and nothing fails or warns.
  *
- * These tests pin the closure from three sides — the sink implementation, the
- * module that resolves it from config, and the manifest that must contain
- * exactly one provider for the slot.
+ * Pinned from three sides: the sink implementation, the module that resolves
+ * it from config, and the manifest, which must contain exactly one provider
+ * for the slot.
  */
 
 import { generateKeyPairSync } from "node:crypto";
@@ -42,46 +40,67 @@ import {
 	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
+import { coreConfigForTests } from "@o3co/auth-provider-core/testing";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "../buildModules.mjs";
+import type { Switches } from "../configPath.mjs";
 import { createAppLogger, createAuditLogger, createLoggerAuditSink } from "../logger.mjs";
-import { auditSinkModule } from "../modules.mjs";
+import { auditSinkModuleFor } from "../modules.mjs";
+import { capturedRenames, shippedAdapters } from "./library-references.fixture.mjs";
 
 const keyPair = generateKeyPairSync("ed25519", {
 	publicKeyEncoding: { type: "spki", format: "pem" },
 	privateKeyEncoding: { type: "pkcs8", format: "pem" },
 });
 
-const baseConfig: AppConfig = {
-	http: { port: 0, trustProxy: false, readinessTimeoutMs: 1000 },
+/**
+ * Phase one's switches beside the configuration boot is handed; the template
+ * modules' sections sit beside core's, so the configuration is wider than
+ * `AppConfig`.
+ */
+const baseConfig: Switches & AppConfig & Record<string, unknown> = {
+	// The shipped selections, every store in this process.
+	adapters: {
+		...shippedAdapters(),
+		accessTokenDenylist: "memory",
+		replaySeenSet: "memory",
+		codeRepository: "memory",
+		userRepository: "yaml",
+	},
+	mfaMode: "off",
+	storeTransport: undefined,
+	// What a resolution under an environment that sets none captures of
+	// core's renamed variables.
+	...{
+		"renamed-variables": capturedRenames({}),
+	},
+	http: { port: 0, trustProxy: false, readinessTimeoutMs: 1000, cors: { allowedOrigins: [] } },
 	logging: { level: "silent" },
+	"key-store": {
+		provider: "local",
+		local: {
+			algorithm: "EdDSA",
+			kid: "v0",
+			privateKey: keyPair.privateKey,
+			publicKey: keyPair.publicKey,
+			previousKeys: [],
+		},
+	},
+	// The shipped `application.conf` expects no session requirement (ADR
+	// 2026-09-28-session-admission).
+	...coreConfigForTests({ federations: { google: { enabled: false, type: "google" } } }),
 	oauth: {
 		jwt: {
 			issuer: "https://auth.test",
-			signingKey: {
-				provider: "local",
-				local: {
-					algorithm: "EdDSA",
-					kid: "v0",
-					privateKey: keyPair.privateKey,
-					publicKey: keyPair.publicKey,
-					previousKeys: [],
-				},
-			},
-		},
-		accessToken: { expiresIn: 3600 },
-		refreshToken: {
-			expiresIn: 86400,
-			unknownFamilyPolicy: "reject" as const,
-			legacyRtPolicy: "reject" as const,
 		},
+		accessToken: { defaultExpiresIn: 3600 },
+		refreshToken: { expiresIn: 86400 },
 		grants: {},
 		oidcMode: "oidc-required",
-		code: { adapter: "memory" as const },
 	},
-	session: {
+	"session-store": {
 		secret: "test-session-secret.at-least-32-bytes.ok",
 		name: "auth.sid",
 		maxAge: 3600000,
@@ -90,19 +109,12 @@ const baseConfig: AppConfig = {
 		domain: null,
 		storage: { type: "memory", redis: { url: "redis://localhost:6379" } },
 	},
-	rateLimit: {
-		login: { windowMs: 60000, limit: 10 },
-		failMode: "open",
-	},
-	federations: { google: { enabled: false } },
-	repositories: {
-		client: { type: "yaml", path: "./config/clients.yaml" },
-		user: { type: "yaml", path: "./config/users.yaml", timeout: 5000 },
-		code: { type: "memory", defaultExpiresIn: 600 },
+	session: {
+		loginPage: { url: "/login" },
+		rateLimit: { login: { windowMs: 60000, limit: 10 } },
 	},
-	endpoints: { login: { url: "/login" } },
-	cors: { allowedOrigins: [] },
-	audit: { sink: { type: "logger" } },
+	rateLimit: { failMode: "open" },
+	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
 };
 
 const CLIENT_ID = "audit-client";
@@ -143,7 +155,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
@@ -163,14 +175,14 @@ function fakeLogger(): Logger & { info: ReturnType<typeof vi.fn> } {
 	return self as unknown as Logger & { info: ReturnType<typeof vi.fn> };
 }
 
-/** Resolve `auditSink` the way the boot planner does: call the module's provider. */
-async function resolveSink(config: AppConfig): Promise<AuditSink> {
-	const provider = auditSinkModule.provides?.auditSink;
-	if (!provider) throw new Error("auditSinkModule must provide the auditSink slot");
-	return (await provider({ config } as never)) as AuditSink;
+/** Resolve `auditSink` the way the boot planner does: call the module's provider with its section. */
+async function resolveSink(sink: string, section?: Record<string, unknown>): Promise<AuditSink> {
+	const provider = auditSinkModuleFor(sink).provides?.auditSink;
+	if (!provider) throw new Error("the audit-sink module must provide the auditSink slot");
+	return (await provider({ section } as never)) as AuditSink;
 }
 
-describe("#287: the template's audit sink", () => {
+describe("the template's audit sink", () => {
 	describe("createLoggerAuditSink — one event, one line, through the app's own JSON stream", () => {
 		it("records the event through the injected logger", async () => {
 			const logger = fakeLogger();
@@ -218,11 +230,10 @@ describe("#287: the template's audit sink", () => {
 
 	describe("the audit trail is not gated by logging.level", () => {
 		it("keeps the audit logger at info while the app logger is silenced", () => {
-			// An audit trail is evidence, not diagnostics. `LOG_LEVEL=warn` is an
-			// ordinary production setting and `silent` is a legitimate one; if
-			// either silenced audit events, #287 would be back — the same silent
-			// drop, reached from the operator's side instead of the scaffold's.
-			const appLogger = createAppLogger({ ...baseConfig, logging: { level: "silent" } });
+			// An audit trail is evidence, not diagnostics. `LOGGING_LEVEL=warn` is an
+			// ordinary production setting and `silent` is a legitimate one;
+			// neither may silently drop audit events.
+			const appLogger = createAppLogger({ level: "silent" });
 			const auditLogger = createAuditLogger();
 			expect((appLogger as unknown as { level: string }).level).toBe("silent");
 			expect((auditLogger as unknown as { level: string }).level).toBe("info");
@@ -236,31 +247,24 @@ describe("#287: the template's audit sink", () => {
 		});
 	});
 
-	describe("auditSinkModule — resolves the sink from config", () => {
-		it("resolves the logger sink for the shipped default", async () => {
-			expect((await resolveSink(baseConfig)).kind).toBe("logger");
+	describe("the audit-sink module — builds the sink adapters.auditSink selects", () => {
+		it("builds the logger sink for the shipped selection", async () => {
+			expect((await resolveSink(baseConfig.adapters.auditSink)).kind).toBe("logger");
 		});
 
-		it("resolves core's built-in console sink when selected", async () => {
-			const sink = await resolveSink({ ...baseConfig, audit: { sink: { type: "console" } } });
-			expect(sink.kind).toBe("console");
+		it("builds core's built-in console sink when selected", async () => {
+			expect((await resolveSink("console")).kind).toBe("console");
 		});
 
-		it("still produces a sink when the audit section is absent entirely", async () => {
-			// The failure #287 describes is silent absence. A config that says
-			// nothing about auditing must land on a sink, not on `undefined`.
-			const { audit: _audit, ...withoutAudit } = baseConfig;
-			const sink = await resolveSink(withoutAudit as AppConfig);
-			expect(sink.kind).toBe("logger");
+		it("builds a sink with no audit-sink section at all", async () => {
+			expect((await resolveSink("logger", undefined)).kind).toBe("logger");
 		});
 
-		it("refuses an unknown sink type at boot, naming what is registered", async () => {
-			// There is no "none" — #304's sink policy. An operator who writes one
-			// gets a boot failure naming the sinks that exist, not a silent
-			// deployment with no audit trail.
-			await expect(
-				resolveSink({ ...baseConfig, audit: { sink: { type: "none" } } }),
-			).rejects.toThrow(/none/);
+		it("refuses a sink no builder is registered under, naming it", async () => {
+			// There is no "none" sink. An operator who selects one gets a boot
+			// failure naming the sinks that exist, not a silent deployment with
+			// no audit trail.
+			await expect(resolveSink("none")).rejects.toThrow(/none/);
 		});
 	});
 
@@ -273,13 +277,13 @@ describe("#287: the template's audit sink", () => {
 			});
 			const providers = modules.filter((m) => Object.keys(m.provides ?? {}).includes("auditSink"));
 			expect(providers).toHaveLength(1);
-			expect(providers[0]?.name).toBe("standalone:audit-sink");
+			expect(providers[0]?.name).toBe("audit-sink");
 		});
 
-		it("the shipped application.conf selects a sink, and never 'none'", () => {
-			const conf = readFileSync(new URL("../../config/application.conf", import.meta.url), "utf8");
-			expect(conf).toMatch(/audit\s*\{[\s\S]*?sink\s*\{[\s\S]*?type\s*=\s*"logger"/);
-			expect(conf).not.toMatch(/type\s*=\s*"none"/);
+		it("the shipped reference.conf selects a sink, and never 'none'", () => {
+			const conf = readFileSync(new URL("../../config/reference.conf", import.meta.url), "utf8");
+			expect(conf).toMatch(/adapters\s*\{[\s\S]*?auditSink\s*=\s*"logger"/);
+			expect(conf).not.toMatch(/auditSink\s*=\s*"none"/);
 		});
 	});
 
@@ -292,11 +296,10 @@ describe("#287: the template's audit sink", () => {
 		});
 
 		it("records token.issued.failure for an unsupported grant_type", async () => {
-			// Before #287 this assertion could not fail: nothing filled the slot,
-			// so `emitAuditEvent` returned without recording anything.
+			// `emitAuditEvent` records nothing when the slot is empty.
 			const logger = fakeLogger();
 			const spyAuditModule = defineModule({
-				name: "standalone:audit-sink",
+				name: "audit-sink",
 				provides: { auditSink: () => createLoggerAuditSink(logger) },
 			});
 			const handle = await createApp({

package/templates/standalone/src/__tests__/config-notices.test.mts

@@ -0,0 +1,154 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Core's notices about configuration nothing loaded reads, through the
+ * template's own reading: the template hands boot the configuration's
+ * defaults (`configDefaultsFor`), and core alone decides what is named. A
+ * section the template's `reference.conf` sets for a module the composition
+ * does not load is silent while it is as that file sets it, and
+ * `config_sections_not_loaded` once the operator's layer or the environment
+ * changes it; a section no loaded package sets is `config_sections_ignored`;
+ * a renamed variable no loaded module declares is
+ * `environment_variables_not_applied`.
+ */
+
+import { fileURLToPath } from "node:url";
+import { moduleReferences } from "@o3co/auth-provider-core";
+import { parseFile } from "@o3co/ts.hocon";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { configDefaultsFor } from "#/configPath.mjs";
+import {
+	type ComposeOptions,
+	type Composition,
+	compose,
+	composedModules,
+	type RecordingLogger,
+	resolveConfig,
+	SINGLE_ENV,
+} from "./all-modules-composition.fixture.mjs";
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+	vi.unstubAllEnvs();
+});
+
+const boot = async (options: ComposeOptions): Promise<Composition> => {
+	current = await compose(options);
+	return current;
+};
+
+/** What each warn line named `event` names: its `sections` or `variables`. */
+const named = (logger: RecordingLogger, event: string): unknown[] =>
+	logger.lines
+		.filter((line) => line.level === "warn" && line.args[1] === event)
+		.map((line) => line.args[0]);
+
+/** `redis-clients` is the template's module, which no store on Redis loads under SINGLE_ENV. */
+const NOT_LOADED = "redis-clients";
+
+describe("a section the template's reference.conf sets for a module the composition does not load", () => {
+	it("is handed to boot and named by nothing while it is as that file sets it", async () => {
+		const { logger, resolved, modules } = await boot({ env: SINGLE_ENV });
+		expect(modules.map((m) => m.name)).not.toContain(NOT_LOADED);
+		expect(resolved).toHaveProperty([NOT_LOADED]);
+		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+	});
+
+	it("is config_sections_not_loaded once the operator's layer changes it", async () => {
+		const { logger } = await boot({
+			env: SINGLE_ENV,
+			operatorHocon: `${NOT_LOADED}.url = "redis://elsewhere.test:6379"\n`,
+		});
+		expect(named(logger, "config_sections_not_loaded")).toEqual([{ sections: [NOT_LOADED] }]);
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+	});
+
+	it("is config_sections_not_loaded once the environment changes it, and the variable environment_variables_not_applied", async () => {
+		const { logger } = await boot({
+			env: { ...SINGLE_ENV, REDIS_CLIENTS_URL: "redis://elsewhere.test:6379" },
+		});
+		expect(named(logger, "config_sections_not_loaded")).toEqual([{ sections: [NOT_LOADED] }]);
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+		expect(named(logger, "environment_variables_not_applied")).toEqual([
+			{ variables: ["REDIS_CLIENTS_URL"] },
+		]);
+	});
+});
+
+describe("the limiter sections the template's reference.conf writes for both limiters", () => {
+	it.each(["memory", "redis"] as const)(
+		"are named by nothing with the %s limiter wired",
+		async (rateLimiter) => {
+			const { logger, modules } = await boot({
+				env: { ...SINGLE_ENV, ADAPTERS_RATE_LIMITER: rateLimiter },
+			});
+			expect(modules.map((m) => m.name)).toContain(
+				rateLimiter === "redis" ? "redis-rate-limiter" : "core-rate-limiter-memory",
+			);
+			expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+			expect(named(logger, "config_sections_ignored")).toEqual([]);
+		},
+	);
+});
+
+describe("a section no loaded package's reference.conf sets", () => {
+	it("is config_sections_ignored: a misspelt section name", async () => {
+		const { logger } = await boot({
+			env: SINGLE_ENV,
+			operatorHocon: 'redis-client.url = "redis://elsewhere.test:6379"\n',
+		});
+		expect(named(logger, "config_sections_ignored")).toEqual([{ sections: ["redis-client"] }]);
+		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+	});
+});
+
+describe("a renamed variable a loaded package captures and no loaded module declares", () => {
+	it("is environment_variables_not_applied: RATE_LIMIT_FAIL_MODE with the Redis package loaded but not its rate limiter", async () => {
+		const { logger, modules } = await boot({
+			env: { ...SINGLE_ENV, ADAPTERS_CODE_REPOSITORY: "redis", RATE_LIMIT_FAIL_MODE: "closed" },
+		});
+		expect(modules.map((m) => m.name)).not.toContain("redis-rate-limiter");
+		expect(named(logger, "environment_variables_not_applied")).toEqual([
+			{ variables: ["RATE_LIMIT_FAIL_MODE"] },
+		]);
+		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+	});
+});
+
+describe("configDefaultsFor", () => {
+	const modules = composedModules(resolveConfig(SINGLE_ENV));
+
+	it("is every loaded package's reference.conf, core's last, resolved with no environment", () => {
+		const references = moduleReferences(modules).map((reference) =>
+			parseFile(fileURLToPath(reference), { env: {} }),
+		);
+		const expected = references
+			.slice(1)
+			.reduce((config, next) => config.withFallback(next), references[0]);
+		expect(configDefaultsFor(modules)).toEqual(expected?.toObject());
+	});
+
+	it("takes nothing from the process's environment", () => {
+		vi.stubEnv("REDIS_CLIENTS_URL", "redis://operator.test:6379");
+		expect(configDefaultsFor(modules)[NOT_LOADED]).toEqual({ url: "redis://localhost:6379" });
+	});
+});

package/templates/standalone/src/__tests__/configPath.test.mts

@@ -16,8 +16,10 @@
 
 import { existsSync } from "node:fs";
 import { isAbsolute } from "node:path";
+import { fileURLToPath } from "node:url";
+import { coreReference } from "@o3co/auth-provider-core";
 import { describe, expect, it } from "vitest";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { resolveConfigPaths } from "../configPath.mjs";
 
 describe("resolveConfigPaths", () => {
 	it("accepts a configDirPath with a trailing slash (regression: fileURLToPath preserves trailing /)", () => {
@@ -51,17 +53,17 @@ describe("resolveConfigPaths", () => {
 	});
 });
 
-describe("resolveLibraryReferenceConfPath", () => {
-	it("returns an absolute path ending in reference.conf", () => {
-		const path = resolveLibraryReferenceConfPath();
-		expect(path.endsWith("reference.conf")).toBe(true);
-		// Use `isAbsolute` rather than `startsWith("/")` so the assertion
-		// holds on Windows (e.g. `C:\...`) as well as POSIX paths.
+describe("core's reference.conf, as the template layers it", () => {
+	// `coreReference()` names the file `@o3co/auth-provider-core` exports as
+	// `./reference.conf`: the one a composition root that installed the
+	// package would resolve, and the bottom of every layering the template
+	// makes (`readSwitches`, `resolveForBoot`).
+	it("is the file the package exports as ./reference.conf, and it exists", () => {
+		const path = fileURLToPath(coreReference());
 		expect(isAbsolute(path)).toBe(true);
-	});
-
-	it("points to a file that exists on disk", () => {
-		const path = resolveLibraryReferenceConfPath();
 		expect(existsSync(path)).toBe(true);
+		expect(path).toBe(
+			fileURLToPath(import.meta.resolve("@o3co/auth-provider-core/reference.conf")),
+		);
 	});
 });