@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/core-federations.test.mts

@@ -0,0 +1,249 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The federations the template ships, in core's own section:
+ * `core.federations.google` and `core.federations.oidc`, each naming its
+ * type and bound to the variables named after its paths
+ * (`CORE_FEDERATIONS_<NAME>_<KEY>`). The federation types the template
+ * bundles are listed whatever the map says (`federation-types.test.mts`
+ * boots them). A variable the
+ * template bound before, `FEDERATIONS_<NAME>_<KEY>`, set alone or beside its
+ * new name at a different value is refused before any module is chosen,
+ * naming the new variable and path and never a value; the two at one value
+ * are accepted. The map written at the top level refuses boot, naming its
+ * paths under `core.federations`.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { BootError, createApp } from "@o3co/auth-provider-core";
+import { afterAll, describe, expect, it } from "vitest";
+import { buildModules } from "#/buildModules.mjs";
+import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "#/configPath.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+/** The directories the operator layers are written to, removed after the suite. */
+const operatorDirs: string[] = [];
+afterAll(() => {
+	for (const dir of operatorDirs) rmSync(dir, { recursive: true, force: true });
+});
+
+/** The template's own files for the production environment, under an operator's layer when given. */
+function ownFiles(hocon?: string): string[] {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
+	if (hocon === undefined) return [envConfPath, applicationConfPath];
+	const dir = mkdtempSync(join(tmpdir(), "core-federations-"));
+	operatorDirs.push(dir);
+	const file = join(dir, "operator.conf");
+	writeFileSync(file, hocon);
+	return [file, envConfPath, applicationConfPath];
+}
+
+/** MFA, on by default, switched off: these are about the federations. */
+const MFA_OFF: Readonly<Record<string, string>> = { MFA_MODE: "off" };
+
+/** Phase one under `env` and an operator's `hocon`. */
+const switchesFrom = (env: Record<string, string> = {}, hocon?: string) =>
+	readSwitches(readOwnLayers(ownFiles(hocon), { env: { ...MFA_OFF, ...env } }));
+
+/** What phase one refuses under `env`. */
+function refusal(env: Record<string, string>): Error {
+	try {
+		switchesFrom(env);
+	} catch (err) {
+		return err as Error;
+	}
+	throw new Error("phase one read the switches");
+}
+
+/** The federations the composition hands boot under `env`, by name: phase one, then phase two. */
+function federationsOf(env: Record<string, string> = {}) {
+	const own = readOwnLayers(ownFiles(), { env: { ...MFA_OFF, ...env } });
+	const switches = readSwitches(own);
+	const modules = buildModules(switches, { environment: "production" });
+	const resolved = resolveForBoot(own, modules, switches) as unknown as {
+		readonly core?: { readonly federations?: Record<string, Record<string, unknown>> };
+	};
+	return resolved.core?.federations ?? {};
+}
+
+/** The modules phase one chooses under `env`, by name. */
+const moduleNames = (env: Record<string, string>) =>
+	buildModules(switchesFrom(env), { environment: "production" }).map((module) => module.name);
+
+/** Each variable the template binds: its key under the federation, the old name and the new. */
+const RENAMED = [
+	["google", "enabled", "FEDERATIONS_GOOGLE_ENABLED", "CORE_FEDERATIONS_GOOGLE_ENABLED", "true"],
+	[
+		"google",
+		"clientId",
+		"FEDERATIONS_GOOGLE_CLIENT_ID",
+		"CORE_FEDERATIONS_GOOGLE_CLIENT_ID",
+		"g-id",
+	],
+	[
+		"google",
+		"clientSecret",
+		"FEDERATIONS_GOOGLE_CLIENT_SECRET",
+		"CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET",
+		"g-secret",
+	],
+	[
+		"google",
+		"callbackURL",
+		"FEDERATIONS_GOOGLE_CALLBACK_URL",
+		"CORE_FEDERATIONS_GOOGLE_CALLBACK_URL",
+		"https://auth.test/session/oauth/federation/google/callback",
+	],
+	[
+		"google",
+		"accessType",
+		"FEDERATIONS_GOOGLE_ACCESS_TYPE",
+		"CORE_FEDERATIONS_GOOGLE_ACCESS_TYPE",
+		"online",
+	],
+	["oidc", "enabled", "FEDERATIONS_OIDC_ENABLED", "CORE_FEDERATIONS_OIDC_ENABLED", "true"],
+	["oidc", "issuer", "FEDERATIONS_OIDC_ISSUER", "CORE_FEDERATIONS_OIDC_ISSUER", "https://idp.test"],
+	["oidc", "clientId", "FEDERATIONS_OIDC_CLIENT_ID", "CORE_FEDERATIONS_OIDC_CLIENT_ID", "o-id"],
+	[
+		"oidc",
+		"clientSecret",
+		"FEDERATIONS_OIDC_CLIENT_SECRET",
+		"CORE_FEDERATIONS_OIDC_CLIENT_SECRET",
+		"o-secret",
+	],
+	[
+		"oidc",
+		"callbackURL",
+		"FEDERATIONS_OIDC_CALLBACK_URL",
+		"CORE_FEDERATIONS_OIDC_CALLBACK_URL",
+		"https://auth.test/session/oauth/federation/oidc/callback",
+	],
+] as const;
+
+describe("the federations the template ships, under core.federations", () => {
+	it("ships google and oidc disabled, each of the type of its name", () => {
+		const federations = federationsOf();
+		expect(federations.google).toMatchObject({ enabled: false, type: "google" });
+		expect(federations.oidc).toMatchObject({ enabled: false, type: "oidc" });
+	});
+
+	it.each(RENAMED)(
+		"reads core.federations.%s.%s from %s's new name",
+		(name, key, _old, variable, value) => {
+			expect(String(federationsOf({ [variable]: value })[name]?.[key])).toBe(value);
+		},
+	);
+
+	it("lists the same federation modules whether CORE_FEDERATIONS_GOOGLE_ENABLED is true or not", () => {
+		const federationModules = (env: Record<string, string>) =>
+			moduleNames(env).filter((name) => name === "federation-oidc" || name.endsWith("-type"));
+		expect(federationModules({ CORE_FEDERATIONS_GOOGLE_ENABLED: "true" })).toEqual([
+			"federation-google-type",
+			"federation-oidc",
+		]);
+		expect(federationModules({})).toEqual(
+			federationModules({ CORE_FEDERATIONS_GOOGLE_ENABLED: "true" }),
+		);
+	});
+});
+
+describe("a variable the template bound before, FEDERATIONS_<NAME>_<KEY>", () => {
+	it.each(RENAMED)(
+		"core.federations.%s.%s: %s set alone is refused before any module is chosen, naming %s",
+		(name, key, old, variable, value) => {
+			const err = refusal({ [old]: value });
+			expect(err).toBeInstanceOf(BootError);
+			expect(err.message).toContain(`${old} was renamed ${variable}`);
+			expect(err.message).toContain(`core.federations.${name}.${key}`);
+			expect(err).toMatchObject({
+				reason: "environment-variable-renamed",
+				details: {
+					reason: "environment-variable-renamed",
+					renamed: [
+						{
+							module: "core",
+							from: old,
+							to: variable,
+							path: `core.federations.${name}.${key}`,
+							state: "unset",
+						},
+					],
+				},
+			});
+		},
+	);
+
+	it.each(RENAMED)(
+		"core.federations.%s.%s: %s beside its new name at a different value is refused, quoting neither",
+		(_name, _key, old, variable) => {
+			const err = refusal({ [old]: "old-value-5e2d", [variable]: "new-value-c81a" });
+			expect(err).toMatchObject({
+				reason: "environment-variable-renamed",
+				details: { renamed: [{ from: old, state: "different" }] },
+			});
+			expect(err.message).toContain(old);
+			expect(err.message).not.toContain("old-value-5e2d");
+			expect(err.message).not.toContain("new-value-c81a");
+		},
+	);
+
+	it.each(RENAMED)(
+		"core.federations.%s.%s: %s beside its new name at the same value is read",
+		(name, key, old, variable, value) => {
+			expect(String(federationsOf({ [old]: value, [variable]: value })[name]?.[key])).toBe(value);
+		},
+	);
+});
+
+describe("the map written at the top level", () => {
+	it("refuses boot, naming its paths under core.federations", async () => {
+		const own = readOwnLayers(ownFiles("federations.okta.enabled = false\n"), {
+			env: {
+				...MFA_OFF,
+				KEY_STORE_LOCAL_SECRET: "core-federations-secret.at-least-32-bytes.ok",
+				OAUTH_JWT_ISSUER: "https://auth.test",
+				SESSION_STORE_SECRET: "core-federations-session.at-least-32-bytes.ok",
+			},
+		});
+		const switches = readSwitches(own);
+		const modules = buildModules(switches, { environment: "production" });
+		await expect(
+			createApp({
+				modules,
+				bootstrapComponents: {
+					config: resolveForBoot(own, modules, switches),
+					pathResolver: (s: string) => s,
+				} as never,
+			}),
+		).rejects.toMatchObject({
+			reason: "config-path-relocated",
+			details: {
+				relocated: [
+					expect.objectContaining({
+						from: "federations.okta.enabled",
+						to: "core.federations.okta.enabled",
+						environmentVariable: "CORE_FEDERATIONS_OKTA_ENABLED",
+					}),
+				],
+			},
+		});
+	});
+});

package/templates/standalone/src/__tests__/core-sections.test.mts

@@ -0,0 +1,190 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Core's own settings under `core {}` and the JWKS module's under `jwks {}`,
+ * through the template's own reading: its layers read once under one
+ * environment, phase one's switches, then the layers over every loaded
+ * package's `reference.conf` handed to boot. A path they moved from, written
+ * in the operator's own layer, refuses boot naming the new one;
+ * `DEPLOYMENT_MODE`, renamed `CORE_DEPLOYMENT_MODE`, refuses boot unless the
+ * new name carries the same value.
+ */
+
+import { BootError } from "@o3co/auth-provider-core";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+	type ComposeOptions,
+	type Composition,
+	compose,
+	ISSUER,
+	SINGLE_ENV,
+} from "./all-modules-composition.fixture.mjs";
+
+/** The fixture's single-replica environment, with neither name of the replica count set. */
+const BASE: Readonly<Record<string, string>> = Object.fromEntries(
+	Object.entries(SINGLE_ENV).filter(
+		([name]) => name !== "DEPLOYMENT_MODE" && name !== "CORE_DEPLOYMENT_MODE",
+	),
+);
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+});
+
+/** Boots under `env` beside `BASE`, and remembers the composition so `afterEach` disposes it. */
+async function boot(env: Record<string, string>, more: ComposeOptions = {}): Promise<Composition> {
+	current = await compose({ env: { ...BASE, ...env }, ...more });
+	return current;
+}
+
+/** What boot refused with. */
+async function refused(env: Record<string, string>, more: ComposeOptions = {}): Promise<BootError> {
+	try {
+		await boot(env, more);
+	} catch (err) {
+		if (err instanceof BootError) return err;
+		throw err;
+	}
+	throw new Error("the composition booted");
+}
+
+describe("core's own settings and the JWKS module's, as the template reads them", () => {
+	it("boots the shipped configuration: core.sessionRequirements.expected is [], the replica count what CORE_DEPLOYMENT_MODE sets", async () => {
+		const composition = await boot({ CORE_DEPLOYMENT_MODE: "single" });
+
+		const config = composition.config as unknown as Record<string, unknown>;
+		expect(config.core).toMatchObject({ sessionRequirements: { expected: [] } });
+		expect(config).not.toHaveProperty("sessionRequirements");
+		expect(config).not.toHaveProperty("deployment");
+		expect(composition.handle.components.deploymentMode).toBe("single");
+	});
+
+	it("serves the JWKS at the path JWKS_PATH sets, for the max-age JWKS_CACHE_MAX_AGE sets, and advertises it as jwks_uri", async () => {
+		const composition = await boot({
+			CORE_DEPLOYMENT_MODE: "single",
+			JWKS_PATH: "/keys/jwks.json",
+			JWKS_CACHE_MAX_AGE: "600",
+		});
+
+		const jwks = await request(composition.app).get("/keys/jwks.json");
+		expect(jwks.status).toBe(200);
+		expect(jwks.headers["cache-control"]).toBe("public, max-age=600");
+		const discovery = await request(composition.app).get("/.well-known/openid-configuration");
+		expect(discovery.body.jwks_uri).toBe(`${ISSUER}/keys/jwks.json`);
+	});
+});
+
+describe("a path core's or the JWKS module's settings moved from, written in the operator's own layer", () => {
+	it.each([
+		[
+			'deployment.mode = "single"',
+			"core",
+			"deployment.mode",
+			"core.deployment.mode",
+			"CORE_DEPLOYMENT_MODE",
+		],
+		[
+			"sessionRequirements.expected = []",
+			"core",
+			"sessionRequirements.expected",
+			"core.sessionRequirements.expected",
+			undefined,
+		],
+		[
+			'oauth.jwt.jwksPath = "/keys/jwks.json"',
+			"jwks",
+			"oauth.jwt.jwksPath",
+			"jwks.path",
+			"JWKS_PATH",
+		],
+		[
+			"oauth.jwt.jwksCacheMaxAge = 60",
+			"jwks",
+			"oauth.jwt.jwksCacheMaxAge",
+			"jwks.cacheMaxAge",
+			"JWKS_CACHE_MAX_AGE",
+		],
+	])(
+		"%s: refused, naming %s's new path and the variable that binds it, if any",
+		async (hocon, module, from, to, variable) => {
+			const err = await refused(
+				{ CORE_DEPLOYMENT_MODE: "single" },
+				{ operatorHocon: `${hocon}\n` },
+			);
+
+			expect(err.details).toEqual({
+				reason: "config-path-relocated",
+				relocated: [
+					{
+						module,
+						from,
+						to,
+						...(variable === undefined ? {} : { environmentVariable: variable }),
+					},
+				],
+			});
+		},
+	);
+});
+
+describe("DEPLOYMENT_MODE, renamed CORE_DEPLOYMENT_MODE, through the template's reading", () => {
+	it("set alone: refused, naming the new variable and core.deployment.mode", async () => {
+		const err = await refused({ DEPLOYMENT_MODE: "single" });
+
+		expect(err.details).toEqual({
+			reason: "environment-variable-renamed",
+			renamed: [
+				{
+					module: "core",
+					from: "DEPLOYMENT_MODE",
+					to: "CORE_DEPLOYMENT_MODE",
+					path: "core.deployment.mode",
+					state: "unset",
+				},
+			],
+		});
+	});
+
+	it("set beside the new name at a different value: refused, naming neither value", async () => {
+		const err = await refused({
+			DEPLOYMENT_MODE: "old-mode-5e2d",
+			CORE_DEPLOYMENT_MODE: "new-mode-c81a",
+		});
+
+		expect(err.details).toMatchObject({
+			renamed: [{ from: "DEPLOYMENT_MODE", to: "CORE_DEPLOYMENT_MODE", state: "different" }],
+		});
+		expect(err.message).not.toContain("old-mode-5e2d");
+		expect(err.message).not.toContain("new-mode-c81a");
+	});
+
+	it("set beside the new name at the same value: boots with that mode", async () => {
+		const composition = await boot({ DEPLOYMENT_MODE: "single", CORE_DEPLOYMENT_MODE: "single" });
+
+		expect(composition.handle.components.deploymentMode).toBe("single");
+	});
+
+	it("unset, with the new name set: boots with its mode", async () => {
+		const composition = await boot({ CORE_DEPLOYMENT_MODE: "single" });
+
+		expect(composition.handle.components.deploymentMode).toBe("single");
+	});
+});

package/templates/standalone/src/__tests__/device-code-store-client-module.test.mts

@@ -15,16 +15,14 @@
  */
 
 /**
- * `standaloneRedisClientsModule` provides `deviceCodeStoreClient` (#433).
+ * `standaloneRedisClientsModule` provides `deviceCodeStoreClient`.
  *
  * The template does not mount the device grant, so nothing in `buildModules`
- * selects `redisDeviceCodeStoreModule` today and the smoke test's client-slot
+ * selects `redisDeviceCodeStoreModule` and the smoke test's client-slot
  * invariant cannot see it. This pins the slot directly: a deployment that adds
- * `deviceGrantModule` to this manifest and picks the Redis store must not hit
- * the `missing-required-component` boot failure that #439 already paid for
- * once with the subject-level slots — a Redis-branch module whose required
- * client slot the shared clients module did not provide, caught only by the
- * umbrella e2e.
+ * `deviceAuthorizationGrantModule` to this manifest and picks the Redis store must not hit
+ * `missing-required-component` for a client slot the shared clients module
+ * does not provide.
  */
 
 import type { LifecycleRegistrar } from "@o3co/auth-provider-core";
@@ -52,13 +50,10 @@ vi.mock("ioredis", () => {
 
 const importModule = async () => await import("../modules.mjs");
 
-const baseConfig = {
-	refreshTokenFamilyStore: {
-		redis: { url: "redis://example.com:6379" },
-	},
-};
+/** The module's own section, `redis-clients`, as boot hands it over. */
+const baseSection = { url: "redis://example.com:6379" };
 
-describe("#433 / standaloneRedisClientsModule.deviceCodeStoreClient", () => {
+describe("standaloneRedisClientsModule.deviceCodeStoreClient", () => {
 	beforeEach(() => {
 		redisCtorCalls.length = 0;
 	});
@@ -87,10 +82,10 @@ describe("#433 / standaloneRedisClientsModule.deviceCodeStoreClient", () => {
 		const lifecycleRegistrar: LifecycleRegistrar = { register: () => {} };
 
 		const client = (await provides.deviceCodeStoreClient?.({
-			config: { ...baseConfig },
+			section: { ...baseSection },
 			lifecycleRegistrar,
 		})) as Record<string, unknown>;
-		await provides.rateLimiterClient?.({ config: { ...baseConfig }, lifecycleRegistrar });
+		await provides.rateLimiterClient?.({ section: { ...baseSection }, lifecycleRegistrar });
 
 		expect(redisCtorCalls).toHaveLength(1);
 		for (const method of ["create", "findPending", "decide", "poll", "remove"]) {