@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/federation-grants-composition.test.mts

@@ -15,20 +15,19 @@
  */
 
 /**
- * #593 slice 7 — the standalone composes federation grants from its config.
+ * The standalone composes federation grants from its config.
  *
  * What is under test is the WIRING: which modules the switches select, that
  * the shared Redis client module provides the two slots the Redis stores
  * require, and that the refusals a wrong pairing earns come from the modules
  * themselves. The flows a connection needs are the package's own tests; a
  * connection here would need a live IdP, because the OIDC federation
- * discovers at boot.
+ * discovers at boot. It also pins what the consent answer accepts under the
+ * session module's own CSRF guard, the one the standalone composes.
  */
 
 import { fileURLToPath } from "node:url";
 import {
-	type AppConfig,
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
@@ -37,14 +36,21 @@ import {
 	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
+import { standardSmtpMailSenderConfigForTests } from "@o3co/auth-provider-standard/testing";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
-import { cleanupAllowanceFor, FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS } from "../shutdown.mjs";
+import { resolveConfigPaths } from "../configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import { installGracefulShutdown } from "../shutdown.mjs";
+import {
+	type BothPhases,
+	bothPhasesOf,
+	capturedRenames,
+	libraryLayers,
+} from "./library-references.fixture.mjs";
 
 // The same stand-ins `replica-safety.test.mts` boots under: no socket opens,
 // and the shared clients module's readiness probe gets its PONG.
@@ -101,44 +107,46 @@ vi.mock("ioredis", () => {
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 const ENCRYPTION_KEY = Buffer.alloc(32, 7).toString("base64");
 
-/** A single-replica deployment with every shared store on memory, grants off. */
+/** A single-replica deployment with every shared store on memory, grants off, MFA off. */
 const BASE_ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: "federation-grants-composition.at-least-32-bytes.ok",
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: "federation-grants-composition.at-least-32-bytes.ok",
 	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_SECRET: "federation-grants-composition-session.at-least-32-bytes.ok",
-	SESSION_SECURE: "false",
-	SESSION_NAME: "auth.session",
-	SESSION_STORAGE_TYPE: "memory",
-	CLIENT_USER_TYPE: "yaml",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "memory",
-	RATE_LIMITER_ADAPTER: "memory",
-	OAUTH_CODE_ADAPTER: "memory",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-	REPLAY_SEEN_SET_ADAPTER: "memory",
-	FEDERATION_TOKEN_STORE_TYPE: "memory",
-	CONSENT_STORE_ADAPTER: "none",
-	FEDERATION_GRANT_STORE_ADAPTER: "memory",
-	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+	SESSION_STORE_SECRET: "federation-grants-composition-session.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "memory",
+	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+	ADAPTERS_CONSENT_STORE: "none",
+	ADAPTERS_FEDERATION_GRANT_STORE: "memory",
+	ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 };
 
 /** The umbrella E2E's shape: every shared store on Redis, more than one replica. */
 const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
 	...BASE_ENV,
-	DEPLOYMENT_MODE: "multi",
-	SESSION_STORAGE_TYPE: "redis",
-	SESSION_STORAGE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "redis",
-	RATE_LIMITER_ADAPTER: "redis",
-	OAUTH_CODE_ADAPTER: "redis",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
-	REPLAY_SEEN_SET_ADAPTER: "redis",
-	FEDERATION_TOKEN_STORE_TYPE: "redis",
+	CORE_DEPLOYMENT_MODE: "multi",
+	SESSION_STORE_STORAGE_TYPE: "redis",
+	SESSION_STORE_STORAGE_REDIS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "redis",
+	ADAPTERS_RATE_LIMITER: "redis",
+	ADAPTERS_ATTEMPT_COUNTER: "redis",
+	ADAPTERS_CODE_REPOSITORY: "redis",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "redis",
+	ADAPTERS_REPLAY_SEEN_SET: "redis",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
-	CONSENT_STORE_ADAPTER: "redis",
-	FEDERATION_GRANT_STORE_ADAPTER: "redis",
-	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "redis",
+	ADAPTERS_CONSENT_STORE: "redis",
+	ADAPTERS_FEDERATION_GRANT_STORE: "redis",
+	ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "redis",
 };
 
 /** What enabling the feature adds: the switch, and the page boot requires. */
@@ -147,23 +155,24 @@ const GRANTS_ON: Readonly<Record<string, string>> = {
 	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
 };
 
-function resolveConfig(env: Record<string, string>): AppConfig {
+function resolveConfig(env: Record<string, string>): BothPhases {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	const config = validate(
-		parseFile(envConfPath, { env })
-			.withFallback(parseFile(applicationConfPath, { env }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
-		AppConfigSchema,
-	);
+	const layers = parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.withFallback(libraryLayers(env));
+	const config = bothPhasesOf(layers, env);
 	// The key ring has no environment form (a list of { id, key } is HOCON's);
 	// the Redis grant store refuses to construct without one under "required".
 	return {
 		...config,
-		federationGrants: {
-			...config.federationGrants,
+		// What the resolution captured of the renamed variables.
+		"renamed-variables": capturedRenames(env),
+		"redis-federation-grant-store": {
+			...(config["redis-federation-grant-store"] as object | undefined),
 			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
 		},
-	} as AppConfig;
+	} as BothPhases;
 }
 
 const testRepositoriesModule = defineModule({
@@ -183,13 +192,13 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
 });
 
-const modulesFor = (config: AppConfig, memoryOnly = false, environment?: string) =>
+const modulesFor = (config: BothPhases, memoryOnly = false, environment?: string) =>
 	buildModules(config, {
 		keyStoreModule: testKeyStoreModule,
 		repositoriesModule: testRepositoriesModule,
@@ -197,15 +206,65 @@ const modulesFor = (config: AppConfig, memoryOnly = false, environment?: string)
 		...(environment === undefined ? {} : { environment }),
 	});
 
-const boot = (config: AppConfig, memoryOnly = false, environment?: string) =>
+const boot = (config: BothPhases, memoryOnly = false, environment?: string) =>
 	createApp({
 		modules: modulesFor(config, memoryOnly, environment),
 		bootstrapComponents: { config, pathResolver: (s) => s },
 	});
 
-const names = (config: AppConfig, memoryOnly = false) =>
+const names = (config: BothPhases, memoryOnly = false) =>
 	modulesFor(config, memoryOnly).map((m) => m.name);
 
+/**
+ * `app.mts`'s shutdown over `handle`, with a server double whose drain ends at
+ * once and signals that are not the process's: the handle's own dispose and
+ * the allowance it reports.
+ */
+function shutDown(handle: Awaited<ReturnType<typeof boot>>) {
+	const logger = {
+		trace: vi.fn(),
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn: vi.fn(),
+		error: vi.fn(),
+		fatal: vi.fn(),
+		child: vi.fn(),
+	};
+	const exit = vi.fn();
+	const signals = new Map<string, () => void>();
+	const server = {
+		close: (callback?: (err?: Error) => void) => {
+			callback?.();
+			return server;
+		},
+		closeIdleConnections: () => undefined,
+		closeAllConnections: () => undefined,
+	};
+	installGracefulShutdown(server as never, {
+		logger: logger as never,
+		cleanup: () => handle.dispose(),
+		cleanupAllowanceMs: () => handle.cleanupAllowanceMs,
+		exit,
+		onSignal: (name, handler) => signals.set(name, handler),
+		offSignal: (name) => signals.delete(name),
+	});
+	return { logger, exit, sigterm: () => signals.get("SIGTERM")?.() };
+}
+
+/**
+ * Work the background registry holds open, as a refresh tail does, until the
+ * returned release: the drain waits for it.
+ */
+const holdTheDrainOpen = (handle: Awaited<ReturnType<typeof boot>>): (() => void) => {
+	let release!: () => void;
+	handle.components.federationGrantBackground?.register(
+		new Promise<void>((resolve) => {
+			release = () => resolve();
+		}),
+	);
+	return release;
+};
+
 const GRANT_MODULES = [
 	"federation-grants",
 	"federation-grant-background",
@@ -222,7 +281,7 @@ const messageChain = (err: unknown): string => {
 	return `${e.message ?? ""} ${e.cause?.message ?? ""}`;
 };
 
-describe("#593 slice 7: the standalone composes federation grants from its config", () => {
+describe("the standalone composes federation grants from its config", () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 
 	afterEach(async () => {
@@ -233,10 +292,10 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 	it("installs nothing of the feature while it is off, whatever the switches say", async () => {
 		// Off is the default, and off must cost nothing: no store, no socket, no
 		// boot requirement a deployment that never asked for grants would meet.
-		const config = resolveConfig({ ...BASE_ENV, FEDERATION_GRANT_STORE_ADAPTER: "redis" });
+		const config = resolveConfig({ ...BASE_ENV, ADAPTERS_FEDERATION_GRANT_STORE: "redis" });
 		const installed = names(config, true);
 		for (const name of GRANT_MODULES) expect(installed).not.toContain(name);
-		expect(installed).not.toContain("standalone:redis-clients");
+		expect(installed).not.toContain("redis-clients");
 
 		handleRef = await boot(config, true);
 		const app = express().use(handleRef.router);
@@ -257,10 +316,10 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		);
 		expect(installed).not.toContain("redis-federation-grant-store");
 		expect(installed).not.toContain("redis-federation-grant-intent-store");
-		// Listed ahead of oauthModule, as the template writes them — the
+		// Listed ahead of oauthEndpointsModule, as the template writes them: the
 		// template's choice, since each module parses its own bodies and the
-		// order no longer changes that; the browser half sits after the
-		// session middleware by its own `after`.
+		// order does not change that; the browser half sits after the session
+		// middleware by its own `after`.
 		expect(installed.indexOf("federation-grants")).toBeLessThan(installed.indexOf("oauth"));
 
 		handleRef = await boot(config, true);
@@ -269,6 +328,14 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		// not express's 404.
 		expect((await request(app).post("/oauth/federation-grants/g/status")).status).toBe(401);
 		expect(handleRef.components.subjectRevocationService).toBeDefined();
+		// The connect flow's login trip is the session module's loginEntry,
+		// built from the configured login page: the URL connect sends
+		// a browser that is not signed in to.
+		const page = (config.session as { loginPage: { url: string } }).loginPage.url;
+		const back = "https://auth.example/session/federation-grants/connect?request=h";
+		expect(handleRef.components.loginEntry?.urlFor(back)).toBe(
+			`${page}${page.includes("?") ? "&" : "?"}redirect_to=${encodeURIComponent(back)}`,
+		);
 	});
 
 	it("selects the Redis stores under the all-Redis environment, provides their clients, and boots under multi", async () => {
@@ -283,7 +350,7 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		);
 		expect(installed).not.toContain("core-federation-grant-store-memory");
 		expect(installed).not.toContain("core-federation-grant-intent-store-memory");
-		const clients = modules.find((m) => m.name === "standalone:redis-clients");
+		const clients = modules.find((m) => m.name === "redis-clients");
 		expect(Object.keys(clients?.provides ?? {})).toEqual(
 			expect.arrayContaining(["federationGrantStoreClient", "federationGrantIntentStoreClient"]),
 		);
@@ -292,13 +359,83 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		expect(handleRef.components.federationGrantStore?.kind).toBe("redis");
 	});
 
-	it("gives cleanup the documented 45 seconds under the shipped budgets, and nothing while off", () => {
-		// The allowance is derived from reference.conf's budgets; if those move,
-		// the number every README states moves with them, and this says so.
-		expect(cleanupAllowanceFor(resolveConfig({ ...BASE_ENV, ...GRANTS_ON }))).toEqual({
-			cleanupTimeoutMs: FEDERATION_GRANTS_CLEANUP_ALLOWANCE_MS,
-		});
-		expect(cleanupAllowanceFor(resolveConfig(BASE_ENV))).toEqual({});
+	it("gives cleanup the documented 45 seconds under the shipped budgets, not the drain's ten", async () => {
+		// reference.conf's budgets: 25 s + 3 s + 5 s, plus the 12-second margin.
+		handleRef = await boot(resolveConfig({ ...BASE_ENV, ...GRANTS_ON }), true);
+		expect(handleRef.cleanupAllowanceMs).toBe(45_000);
+
+		vi.useFakeTimers();
+		const release = holdTheDrainOpen(handleRef);
+		try {
+			const { logger, exit, sigterm } = shutDown(handleRef);
+			sigterm();
+			await vi.advanceTimersByTimeAsync(44_999);
+			expect(exit).not.toHaveBeenCalled();
+			await vi.advanceTimersByTimeAsync(1);
+			expect(logger.error).toHaveBeenCalledWith(
+				{ cleanupTimeoutMs: 45_000 },
+				"shutdown_cleanup_timed_out",
+			);
+			expect(exit).toHaveBeenCalledExactlyOnceWith(1);
+		} finally {
+			release();
+			vi.useRealTimers();
+		}
+	});
+
+	it("grows the allowance with a raised refresh budget", async () => {
+		const shipped = resolveConfig({ ...BASE_ENV, ...GRANTS_ON });
+		// The lock must outlive the raised hard timeout, or boot refuses first.
+		const raised = {
+			...shipped,
+			"federation-grants": {
+				...shipped["federation-grants"],
+				upstreamHardTimeoutMs: 60_000,
+				refreshLockTtlMs: 65_000,
+			},
+		} as BothPhases;
+		handleRef = await boot(raised, true);
+		expect(handleRef.cleanupAllowanceMs).toBe(60_000 + 3_000 + 5_000 + 12_000);
+
+		vi.useFakeTimers();
+		const release = holdTheDrainOpen(handleRef);
+		try {
+			const { logger, exit, sigterm } = shutDown(handleRef);
+			sigterm();
+			await vi.advanceTimersByTimeAsync(79_999);
+			expect(exit).not.toHaveBeenCalled();
+			await vi.advanceTimersByTimeAsync(1);
+			expect(logger.error).toHaveBeenCalledWith(
+				{ cleanupTimeoutMs: 80_000 },
+				"shutdown_cleanup_timed_out",
+			);
+		} finally {
+			release();
+			vi.useRealTimers();
+		}
+	});
+
+	it("reports no allowance while the feature is off, and cleanup's budget is the drain's ten seconds", async () => {
+		handleRef = await boot(resolveConfig(BASE_ENV), true);
+		expect(handleRef.cleanupAllowanceMs).toBeUndefined();
+		const { logger, exit, sigterm } = shutDown(handleRef);
+		sigterm();
+		await vi.waitFor(() => expect(exit).toHaveBeenCalledExactlyOnceWith(0));
+		expect(logger.info).toHaveBeenCalledWith(
+			{ drainTimeoutMs: 10_000, cleanupTimeoutMs: 10_000 },
+			"shutdown_draining",
+		);
+	});
+
+	it("covers a tail registered after the shutdown was installed", async () => {
+		handleRef = await boot(resolveConfig(BASE_ENV), true);
+		const { logger, sigterm } = shutDown(handleRef);
+		handleRef.components.lifecycleRegistrar?.register(async () => {}, { tailMs: 60_000 });
+		sigterm();
+		expect(logger.info).toHaveBeenCalledWith(
+			{ drainTimeoutMs: 10_000, cleanupTimeoutMs: 60_000 },
+			"shutdown_draining",
+		);
 	});
 
 	it("adds the shared Redis client for the grant stores alone", () => {
@@ -307,15 +444,15 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		const config = resolveConfig({
 			...BASE_ENV,
 			...GRANTS_ON,
-			FEDERATION_GRANT_STORE_ADAPTER: "redis",
-			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "redis",
+			ADAPTERS_FEDERATION_GRANT_STORE: "redis",
+			ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "redis",
 		});
-		expect(names(config, true)).toContain("standalone:redis-clients");
+		expect(names(config, true)).toContain("redis-clients");
 	});
 
 	it.each([
-		["FEDERATION_GRANT_STORE_ADAPTER", "core-federation-grant-store-memory"],
-		["FEDERATION_GRANT_INTENT_STORE_ADAPTER", "core-federation-grant-intent-store-memory"],
+		["ADAPTERS_FEDERATION_GRANT_STORE", "core-federation-grant-store-memory"],
+		["ADAPTERS_FEDERATION_GRANT_INTENT_STORE", "core-federation-grant-intent-store-memory"],
 	])("%s=memory is refused under multi, naming %s", async (variable, module) => {
 		const config = resolveConfig({ ...ALL_REDIS_ENV, ...GRANTS_ON, [variable]: "memory" });
 		await expect(boot(config)).rejects.toMatchObject({
@@ -325,15 +462,87 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		});
 	});
 
-	it("refuses Redis grants beside memory user-session stores, naming the boundary (D13)", async () => {
+	it.each([
+		[
+			"a __Secure- name that is not secure",
+			"name",
+			{ SESSION_STORE_NAME: "__Secure-auth.session", SESSION_STORE_SECURE: "false" },
+			/__Secure- prefix requires session-store\.secure=true/,
+		],
+		[
+			"a name that is not an RFC 6265 token",
+			"name",
+			{ SESSION_STORE_NAME: "auth session" },
+			/is not a cookie name \(an RFC 6265 token\)/,
+		],
+		[
+			"a domain that is a URL",
+			"domain",
+			{ SESSION_STORE_NAME: "auth.session", SESSION_STORE_DOMAIN: "https://auth.example.com" },
+			/is not a cookie domain/,
+		],
+	])(
+		"refuses at validation a session cookie no browser keeps, %s, naming session-store.%s, with or without the subject revocation service",
+		async (_what, key, cookie, refusal) => {
+			for (const grants of [{}, GRANTS_ON]) {
+				const caught = await boot(resolveConfig({ ...BASE_ENV, ...grants, ...cookie }), true).then(
+					async (handle) => {
+						await handle.dispose();
+						return undefined;
+					},
+					(err: unknown) => err,
+				);
+				expect(caught).toMatchObject({
+					name: "BootError",
+					reason: "config-validation-failed",
+					stage: "validateManifests",
+					details: {
+						issues: [expect.objectContaining({ path: ["session-store", key] })],
+					},
+				});
+				expect(messageChain(caught)).toMatch(refusal);
+			}
+		},
+	);
+
+	it.each([
+		// `config/application.conf`'s own cookie: `__Host-`, secure, host-only.
+		["the template's default", { SESSION_STORE_NAME: undefined, SESSION_STORE_SECURE: undefined }],
+		// `.env.example`'s plain-HTTP pair, which `make dev` runs with.
+		[".env.example's", { SESSION_STORE_NAME: "auth.sid", SESSION_STORE_SECURE: "false" }],
+		// `docker-compose.production.yml` restores the default name, secure.
+		[
+			"the production compose file's",
+			{ SESSION_STORE_NAME: "__Host-auth.session", SESSION_STORE_SECURE: "true" },
+		],
+		// o3co/auth's `tests/docker-compose.yml`, which the umbrella E2E boots.
+		["the umbrella E2E's", { SESSION_STORE_NAME: "auth.session", SESSION_STORE_SECURE: "false" }],
+	])(
+		"boots %s session cookie, with or without the subject revocation service",
+		async (_what, cookie) => {
+			const env: Record<string, string> = { ...BASE_ENV };
+			for (const [name, value] of Object.entries(cookie)) {
+				if (value === undefined) delete env[name];
+				else env[name] = value;
+			}
+			for (const grants of [{}, GRANTS_ON]) {
+				handleRef = await boot(resolveConfig({ ...env, ...grants }), true);
+				expect(handleRef.routes.map((r) => r.contribution.id)).toContain("session-middleware");
+				await handleRef.dispose();
+				handleRef = undefined;
+			}
+		},
+	);
+
+	it("refuses Redis grants beside memory user-session stores, naming the boundary", async () => {
 		// The grants would outlive the process; the boundary that ends them
 		// would not. The routes module refuses the pairing on a single replica
 		// too, and its message names the remedy.
 		const config = resolveConfig({
 			...BASE_ENV,
 			...GRANTS_ON,
-			FEDERATION_GRANT_STORE_ADAPTER: "redis",
-			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+			ADAPTERS_FEDERATION_GRANT_STORE: "redis",
+			ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 		});
 		let error: unknown;
 		try {
@@ -344,7 +553,7 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		expect(messageChain(error)).toMatch(/subject boundary is kept in "memory"/);
 	});
 
-	it("hands the Redis grant store the environment the config was selected by, so its plaintext guard reads it (#473)", async () => {
+	it("hands the Redis grant store the environment the config was selected by, so its plaintext guard reads it", async () => {
 		// The federation-token store's guard reads `environment` beside
 		// NODE_ENV so that CONFIG_ENV=production is production to it; the grant
 		// store's must too, or a deployment selecting its config by CONFIG_ENV
@@ -352,13 +561,19 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		const config = resolveConfig({
 			...BASE_ENV,
 			...GRANTS_ON,
-			USER_SESSION_STORES_ADAPTER: "redis",
-			FEDERATION_GRANT_STORE_ADAPTER: "redis",
-			FEDERATION_GRANTS_ENCRYPTION_MODE: "allow-plaintext",
+			ADAPTERS_USER_SESSION_STORES: "redis",
+			ADAPTERS_FEDERATION_GRANT_STORE: "redis",
+			REDIS_FEDERATION_GRANT_STORE_ENCRYPTION_MODE: "allow-plaintext",
 		});
 		let error: unknown;
 		try {
-			handleRef = await boot(config, false, "production");
+			// Under production the template installs the SMTP sender's module,
+			// whose section the package's builder carries.
+			handleRef = await boot(
+				{ ...config, ...standardSmtpMailSenderConfigForTests() },
+				false,
+				"production",
+			);
 		} catch (caught) {
 			error = caught;
 		}
@@ -374,9 +589,9 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 		const config = resolveConfig({
 			...BASE_ENV,
 			...GRANTS_ON,
-			USER_SESSION_STORES_ADAPTER: "redis",
-			FEDERATION_GRANT_STORE_ADAPTER: "redis",
-			FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+			ADAPTERS_USER_SESSION_STORES: "redis",
+			ADAPTERS_FEDERATION_GRANT_STORE: "redis",
+			ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 		});
 		handleRef = await boot(config);
 		expect(handleRef.components.federationGrantStore?.kind).toBe("redis");
@@ -386,10 +601,10 @@ describe("#593 slice 7: the standalone composes federation grants from its confi
 
 describe("the browser consent route parses its own body, with sessionModule listed ahead of it", () => {
 	// `sessionModule`'s routers are mounted at `/session`, the prefix the
-	// federation grants browser half mounts under too. Their parsers ran for
-	// every request beneath `/session`, so with `sessionModule` listed first
-	// the consent route's body arrived parsed — past its 16 KiB bound, its
-	// throttle-then-parse order and its JSON refusals.
+	// federation grants browser half mounts under too. If their parsers ran
+	// for every request beneath `/session`, then with `sessionModule` listed
+	// first the consent route's body would arrive parsed, past its 16 KiB
+	// bound, its throttle-then-parse order and its JSON refusals.
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 
 	afterEach(async () => {
@@ -398,7 +613,7 @@ describe("the browser consent route parses its own body, with sessionModule list
 	});
 
 	/** The standalone's modules, with `sessionModule` moved ahead of the grant modules. */
-	const sessionFirst = (config: AppConfig) => {
+	const sessionFirst = (config: BothPhases) => {
 		const modules = modulesFor(config, true);
 		const session = modules.find((m) => m.name === "session");
 		if (session === undefined) throw new Error("sessionModule is not in the standalone's list");
@@ -443,3 +658,123 @@ describe("the browser consent route parses its own body, with sessionModule list
 		expect(res.headers["cache-control"]).toContain("no-store");
 	});
 });
+
+describe("the grants consent answer is held to the session module's CSRF guard", () => {
+	// No browser is signed in here: an answer the guard accepts reaches the
+	// route's own `401 login_required`, and one it refuses stops at its `403`.
+	const CONSENT = "/session/federation-grants/consent";
+	const ISSUER_ORIGIN = "https://auth.test";
+	const SIBLING = "https://account.auth.test";
+	/** What the deployment's proxy forwards: the origin the browser addressed. */
+	const FORWARDED = { "X-Forwarded-Proto": "https", "X-Forwarded-Host": "auth.test" };
+	const CROSS_SITE = { error: "invalid_request", error_description: "cross-site answer refused" };
+	const NO_ORIGIN = {
+		error: "invalid_request",
+		error_description: "no origin and no valid csrf token",
+	};
+
+	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
+
+	afterEach(async () => {
+		await handleRef?.dispose();
+		handleRef = undefined;
+	});
+
+	/** The standalone with grants on and `SIBLING` on `session.csrf.trustedOrigins`, behind its proxy. */
+	const bootTrustingSibling = async () => {
+		const config = resolveConfig({ ...BASE_ENV, ...GRANTS_ON });
+		const session = config.session as { csrf?: object };
+		const trusting = {
+			...config,
+			session: { ...session, csrf: { ...session.csrf, trustedOrigins: [SIBLING] } },
+		} as BothPhases;
+		handleRef = await boot(trusting, true);
+		return express().set("trust proxy", "loopback").use(handleRef.router);
+	};
+
+	/** The token `GET /session/csrf` hands out, and the `Cookie` header that carries it back. */
+	const tokenFrom = async (app: express.Express) => {
+		const issued = await request(app).get("/session/csrf").set(FORWARDED);
+		expect(issued.status).toBe(200);
+		const [cookie] = (issued.headers["set-cookie"] as unknown as string[])[0]?.split(";") ?? [];
+		return { token: issued.body.csrf_token as string, cookie: cookie ?? "" };
+	};
+
+	const answer = (
+		app: express.Express,
+		headers: Readonly<Record<string, string>>,
+		body: Readonly<Record<string, string>> = {},
+	) =>
+		request(app)
+			.post(CONSENT)
+			.set(FORWARDED)
+			.set({ ...headers })
+			.type("form")
+			.send({ challenge: "c", decision: "accept", ...body });
+
+	it("accepts an Origin that is the request's own, as the proxy forwards it", async () => {
+		const app = await bootTrustingSibling();
+		const res = await answer(app, { Origin: ISSUER_ORIGIN, "Sec-Fetch-Site": "same-origin" });
+		expect(res.status).toBe(401);
+		expect(res.body.error).toBe("login_required");
+	});
+
+	it("refuses Origin: null, even with the token GET /session/csrf hands out", async () => {
+		const app = await bootTrustingSibling();
+		const { token, cookie } = await tokenFrom(app);
+		const res = await answer(
+			app,
+			{ Origin: "null", "Sec-Fetch-Site": "same-origin", Cookie: cookie },
+			{ csrf_token: token },
+		);
+		expect(res.status).toBe(403);
+		expect(res.body).toEqual(CROSS_SITE);
+	});
+
+	it("refuses an answer with no Origin, no Referer and no token, and accepts one echoing the token GET /session/csrf hands out", async () => {
+		const app = await bootTrustingSibling();
+		const refused = await answer(app, { "Sec-Fetch-Site": "same-origin" });
+		expect(refused.status).toBe(403);
+		expect(refused.body).toEqual(NO_ORIGIN);
+		const { token, cookie } = await tokenFrom(app);
+		const accepted = await answer(app, { Cookie: cookie }, { csrf_token: token });
+		expect(accepted.status).toBe(401);
+		expect(accepted.body.error).toBe("login_required");
+	});
+
+	it("accepts an answer with no Origin that echoes the token GET /session/csrf hands out in the x-csrf-token header", async () => {
+		const app = await bootTrustingSibling();
+		const { token, cookie } = await tokenFrom(app);
+		const res = await answer(app, { Cookie: cookie, "x-csrf-token": token });
+		expect(res.status).toBe(401);
+		expect(res.body.error).toBe("login_required");
+	});
+
+	it("refuses an answer with no Origin whose token is not its cookie's", async () => {
+		const app = await bootTrustingSibling();
+		const first = await tokenFrom(app);
+		const second = await tokenFrom(app);
+		const res = await answer(app, { Cookie: first.cookie }, { csrf_token: second.token });
+		expect(res.status).toBe(403);
+		expect(res.body).toEqual(NO_ORIGIN);
+	});
+
+	it("accepts an origin on session.csrf.trustedOrigins sending Sec-Fetch-Site: same-site", async () => {
+		const app = await bootTrustingSibling();
+		const res = await answer(app, { Origin: SIBLING, "Sec-Fetch-Site": "same-site" });
+		expect(res.status).toBe(401);
+		expect(res.body.error).toBe("login_required");
+	});
+
+	it("refuses a cross-site answer, even with the token", async () => {
+		const app = await bootTrustingSibling();
+		const { token, cookie } = await tokenFrom(app);
+		const res = await answer(
+			app,
+			{ Origin: "https://evil.test", "Sec-Fetch-Site": "cross-site", Cookie: cookie },
+			{ csrf_token: token },
+		);
+		expect(res.status).toBe(403);
+		expect(res.body).toEqual(CROSS_SITE);
+	});
+});