@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/federation-grants-survive-logout.test.mts

@@ -15,35 +15,32 @@
  */
 
 /**
- * #593 acceptance criterion 8, at the two HTTP logout endpoints (D14).
- *
- * A federation grant outlives the session it was agreed through. The proof of
- * that used to be a direct call to `cascadeLogout()` — which is the cascade
- * `/oauth/logout` runs, and not what `/session/logout` runs: that endpoint has
- * its own record hygiene (`invalidateSessionRecords`) and reaches the grant
- * store on no path, by construction. A proof of the helper is not a proof of
- * the endpoints. So this drives both, on the standalone, as a deployment
- * composes them: a grant seeded beside a live browser session, the session's
- * records gone afterwards, the grant and its credential exactly as they were,
- * and `/token` still disclosing.
+ * A federation grant outlives the session it was agreed through, at both HTTP
+ * logout endpoints (ADR 2026-09-17-federation-grants-offline-delegation).
+ * Both close the session through core's session lifecycle, whose close work
+ * reaches the grant store on no path, by construction. A proof of the helper is not a proof of the endpoints, so
+ * this drives both, on the standalone, as a deployment composes them: a grant
+ * seeded beside a live browser session, the session's records gone afterwards,
+ * the grant and its credential exactly as they were, and `/token` still
+ * disclosing.
  *
  * The seeded grant's access token is fresh, so the disclosure is the cached
- * one and no upstream is asked — the OIDC federation the connection names is
- * configured with `discovery = false` and hand-typed endpoints so that the
- * deployment boots without a network.
+ * one and no upstream is asked; the OIDC federation the connection names has
+ * `discovery = false` and hand-typed endpoints so the deployment boots without
+ * a network.
  */
 
 import { createHmac } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import {
 	type AppConfig,
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
 	type FederationTokenStore,
 	federationGrantAuthorizationRevision,
 	federationGrantIdentityRevision,
+	federationsOf,
 	InMemoryClientRepository,
 	InMemoryUserRepository,
 	type MemoryFederationGrantStore,
@@ -52,12 +49,18 @@ import {
 	type UserSessionStore,
 } from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { resolveConfigPaths } from "../configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import {
+	type BothPhases,
+	bothPhasesOf,
+	capturedRenames,
+	libraryLayers,
+} from "./library-references.fixture.mjs";
 
 const DAY = 86_400_000;
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
@@ -83,69 +86,78 @@ const REFRESH_TOKEN = "SENTINEL-refresh-token";
 const ACCESS_TOKEN = "upstream-access-token";
 
 const ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: JWT_SECRET,
+	// The logout here is a session without a second factor.
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: JWT_SECRET,
 	OAUTH_JWT_ISSUER: ISSUER,
-	SESSION_SECRET: "federation-grants-survive-logout-session.at-least-32-bytes.ok",
-	SESSION_SECURE: "false",
-	SESSION_NAME: "auth.session",
-	SESSION_STORAGE_TYPE: "memory",
-	CLIENT_USER_TYPE: "yaml",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "memory",
-	RATE_LIMITER_ADAPTER: "memory",
-	OAUTH_CODE_ADAPTER: "memory",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-	REPLAY_SEEN_SET_ADAPTER: "memory",
-	FEDERATION_TOKEN_STORE_TYPE: "memory",
-	CONSENT_STORE_ADAPTER: "none",
-	FEDERATION_GRANT_STORE_ADAPTER: "memory",
-	FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+	SESSION_STORE_SECRET: "federation-grants-survive-logout-session.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "memory",
+	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+	ADAPTERS_CONSENT_STORE: "none",
+	ADAPTERS_FEDERATION_GRANT_STORE: "memory",
+	ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 	FEDERATION_GRANTS_ENABLED: "true",
 	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
 	// The connect flow is not driven here, and the bundled repository has no
 	// identity lookup; "unsupported" is the declaration a deployment without one
-	// makes (#613), and what lets a connection be configured at all.
+	// makes, and what lets a connection be configured at all.
 	FEDERATION_GRANTS_IDENTITY_LOOKUP: "unsupported",
 };
 
 /**
  * The shipped configuration under the environment above, with the two lists
- * that have no environment form (comment 9 on #593) written over it: the
+ * that have no environment form written over it: the
  * upstream federation the connection names, and the connection.
  */
-function resolveConfig(): AppConfig {
+function resolveConfig(): BothPhases {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	const config = validate(
-		parseFile(envConfPath, { env: ENV })
-			.withFallback(parseFile(applicationConfPath, { env: ENV }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env: ENV })),
-		AppConfigSchema,
-	);
+	const layers = parseFile(envConfPath, { env: ENV })
+		.withFallback(parseFile(applicationConfPath, { env: ENV }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env: ENV }))
+		.withFallback(libraryLayers(ENV));
+	const config = bothPhasesOf(layers, ENV);
 	return {
 		...config,
-		federations: {
-			...config.federations,
-			upstream: {
-				enabled: true,
-				type: "oidc",
-				issuer: UPSTREAM,
-				clientId: UPSTREAM_CLIENT_ID,
-				clientSecret: "provider-secret",
-				callbackURL: `${ISSUER}/session/oauth/federation/upstream/callback`,
-				scopes: [...SCOPES],
-				discovery: false,
-				endpoints: {
-					authorizationEndpoint: `${UPSTREAM}/authorize`,
-					tokenEndpoint: `${UPSTREAM}/token`,
-					jwksUri: `${UPSTREAM}/jwks`,
+		// What the resolution captured of the renamed variables.
+		"renamed-variables": capturedRenames(ENV),
+		core: {
+			...config.core,
+			federations: {
+				...federationsOf(config),
+				upstream: {
+					enabled: true,
+					type: "oidc",
+					issuer: UPSTREAM,
+					clientId: UPSTREAM_CLIENT_ID,
+					clientSecret: "provider-secret",
+					callbackURL: `${ISSUER}/session/oauth/federation/upstream/callback`,
+					scopes: [...SCOPES],
+					discovery: false,
+					endpoints: {
+						authorizationEndpoint: `${UPSTREAM}/authorize`,
+						tokenEndpoint: `${UPSTREAM}/token`,
+						jwksUri: `${UPSTREAM}/jwks`,
+					},
+					redirectAllowlist: [],
 				},
-				redirectAllowlist: [],
 			},
 		},
-		federationGrants: {
-			...config.federationGrants,
+		"redis-federation-grant-store": {
+			...(config["redis-federation-grant-store"] as object | undefined),
 			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
+		},
+		"federation-grants": {
+			...config["federation-grants"],
 			connections: {
 				[CONNECTION]: {
 					federation: "upstream",
@@ -156,7 +168,7 @@ function resolveConfig(): AppConfig {
 				},
 			},
 		},
-	} as AppConfig;
+	} as BothPhases;
 }
 
 const testRepositoriesModule = defineModule({
@@ -198,7 +210,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
@@ -245,6 +257,7 @@ async function seedGrant(store: MemoryFederationGrantStore): Promise<void> {
 				tokenType: "Bearer",
 				obtainedAt: at,
 				issuedLifetime: 3600,
+				effectiveExpiresAt: new Date(at.getTime() + 3_600_000),
 				scopes: [...SCOPES],
 			},
 		},
@@ -284,7 +297,7 @@ const claimsOf = (jwt: string): Record<string, unknown> =>
 		unknown
 	>;
 
-describe("#593 AC8: a grant outlives the browser session at both logout endpoints (D14)", () => {
+describe("a grant outlives the browser session at both logout endpoints", () => {
 	let handleRef: Awaited<ReturnType<typeof createApp>> | undefined;
 
 	afterEach(async () => {
@@ -331,7 +344,7 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 		expect(loginRes.status).toBe(200);
 
 		const cookies = loginRes.headers["set-cookie"] as unknown as string[];
-		const csrfCookiePrefix = `${config.session.name}.csrf=`;
+		const csrfCookiePrefix = `${(config["session-store"] as { name: string }).name}.csrf=`;
 		const reissued = cookies
 			.find((c) => c.startsWith(csrfCookiePrefix))
 			?.slice(csrfCookiePrefix.length)
@@ -385,18 +398,19 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 			await boot();
 		const { cookies, csrfToken, headerName } = await login(app, config);
 		const sid = await sidOf(app, cookies);
-		// A session-bound upstream token beside the grant: the record #276's
-		// guarantee is about, keyed by this session.
+		// A session-bound upstream token beside the grant, keyed by this
+		// session: a record logout must end.
 		await federationTokenStore.attach(sid, "upstream", {
 			accessToken: "session-bound-upstream-token",
 			expiresAt: null,
-			// Every field is a required key since the #645 follow-up; this
-			// record carries only the access token.
+			// Every field is a required key; this record carries only the
+			// access token.
 			refreshToken: undefined,
 			idToken: undefined,
 			tokenType: undefined,
 			scope: undefined,
 			grantedScope: undefined,
+			obtainedAt: undefined,
 		});
 		expect(await userSessionStore.get(sid)).not.toBeNull();
 		await expectGrantUntouched(app, federationGrantStore);
@@ -407,7 +421,7 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 			.set(headerName, csrfToken);
 		expect([200, 204]).toContain(logout.status);
 
-		// The session-bound records are gone (#276 holds) ...
+		// The session-bound records are gone ...
 		expect(await userSessionStore.get(sid)).toBeNull();
 		expect(await federationTokenStore.get(sid, "upstream")).toBeNull();
 		// ... and the grant is not among them.
@@ -422,13 +436,14 @@ describe("#593 AC8: a grant outlives the browser session at both logout endpoint
 		await federationTokenStore.attach(sid, "upstream", {
 			accessToken: "session-bound-upstream-token",
 			expiresAt: null,
-			// Every field is a required key since the #645 follow-up; this
-			// record carries only the access token.
+			// Every field is a required key; this record carries only the
+			// access token.
 			refreshToken: undefined,
 			idToken: undefined,
 			tokenType: undefined,
 			scope: undefined,
 			grantedScope: undefined,
+			obtainedAt: undefined,
 		});
 		expect(await userSessionStore.get(sid)).not.toBeNull();
 		await expectGrantUntouched(app, federationGrantStore);

package/templates/standalone/src/__tests__/federation-token-refresh-outage.test.mts

@@ -16,8 +16,8 @@
 
 /**
  * `POST /oauth/federation/:name/token` ends a session's upstream tokens only
- * on the upstream's own verdict that the refresh token is bad — a structured
- * `invalid_grant` under a 4xx — and never while the upstream is down, whatever
+ * on the upstream's own verdict that the refresh token is bad (a structured
+ * `invalid_grant` under a 4xx), and never while the upstream is down, whatever
  * the body of its 5xx says. An outage is `503`, and the tokens are kept for
  * the retry.
  *
@@ -26,8 +26,7 @@
  * are the ones the library raises: a 4xx whose body names a code is a
  * `ResponseBodyError` carrying `error` and `status`; a 5xx is an
  * `OperationProcessingError` raised over the `Response`, whose body the
- * library does not read — and which the route used to answer `500
- * refresh_failed`, as if the upstream had said something it could not place.
+ * library does not read.
  */
 
 import { createFakeIdp, type FakeIdp } from "@o3co/auth-provider-core/testing";
@@ -76,6 +75,7 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 				tokenType: "Bearer",
 				scope: "openid profile email",
 				grantedScope: "openid profile email",
+				obtainedAt: undefined,
 			},
 		});
 		const res = await request(session.app)
@@ -94,7 +94,7 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 	}
 
 	it("keeps them and answers 503 when Google answers 503 with a body naming invalid_grant", async () => {
-		const { res, sid, federationTokenStore, sessionFederationIndex } = await refreshAnswered(503, {
+		const { res, sid, federationTokenStore, sessionLifecycle } = await refreshAnswered(503, {
 			error: "invalid_grant",
 			error_description: "Backend unavailable",
 		});
@@ -107,7 +107,10 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 		expect((await federationTokenStore.get(sid, "google"))?.refreshToken).toBe(
 			STORED_REFRESH_TOKEN,
 		);
-		expect(await sessionFederationIndex.listFederations(sid)).toContain("google");
+		expect(await sessionLifecycle.federations(sid)).toEqual({
+			outcome: "listed",
+			federations: ["google"],
+		});
 	});
 
 	it("keeps them and answers 503 when Google answers 502 with no OAuth body at all", async () => {
@@ -120,7 +123,7 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 	});
 
 	it("ends them on Google's structured 400 invalid_grant", async () => {
-		const { res, sid, federationTokenStore, sessionFederationIndex } = await refreshAnswered(400, {
+		const { res, sid, federationTokenStore, sessionLifecycle } = await refreshAnswered(400, {
 			error: "invalid_grant",
 			error_description: "Token has been expired or revoked.",
 		});
@@ -128,6 +131,11 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 		expect(res.status).toBe(410);
 		expect(res.body.error).toBe("re_authentication_required");
 		expect(await federationTokenStore.get(sid, "google")).toBeNull();
-		expect(await sessionFederationIndex.listFederations(sid)).not.toContain("google");
+		// The route never writes the session's index: the link, now holding no
+		// credential, stays listed until federation logout or the session's end.
+		expect(await sessionLifecycle.federations(sid)).toEqual({
+			outcome: "listed",
+			federations: ["google"],
+		});
 	});
 });

package/templates/standalone/src/__tests__/federation-types.test.mts

@@ -0,0 +1,239 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The federations the template ships are handled by the modules of their
+ * types. The template loads the federation types it bundles, `google` and
+ * `oidc`, whatever the configuration enables, and core dispatches each
+ * enabled `core.federations` entry to the module of its `type`, under the
+ * entry's name: two entries of one type are two federations. The template
+ * reads no entry before boot, so a malformed one is core's to refuse, at its
+ * path.
+ */
+
+import { mkdtempSync, readdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import { buildModules } from "#/buildModules.mjs";
+import { readOwnLayers, readSwitches, resolveConfigPaths, resolveLayers } from "#/configPath.mjs";
+import {
+	type Composition,
+	compose,
+	ISSUER,
+	ownFiles,
+	resolveConfig,
+	SINGLE_ENV,
+} from "./all-modules-composition.fixture.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+/** Google's authorization endpoint, where a Google federation's start sends the browser. */
+const GOOGLE_AUTHORIZE = "https://accounts.google.com/o/oauth2/v2/auth";
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+});
+
+/** Boots and remembers the composition, so `afterEach` disposes it. */
+async function boot(options: Parameters<typeof compose>[0] = {}): Promise<Composition> {
+	current = await compose(options);
+	return current;
+}
+
+/** What `compose` refuses under `options`. */
+async function refusal(options: Parameters<typeof compose>[0]): Promise<{
+	readonly reason?: string;
+	readonly message: string;
+}> {
+	try {
+		current = await compose(options);
+	} catch (err) {
+		return err as { reason?: string; message: string };
+	}
+	throw new Error("the composition booted");
+}
+
+/** `text` in a file of its own, for a layer above the composition's files. */
+function hoconFile(text: string): string {
+	const file = join(mkdtempSync(join(tmpdir(), "federation-types-")), "operator.conf");
+	writeFileSync(file, text);
+	return file;
+}
+
+/** The module names `buildModules` lists for `env`, federation ones only. */
+const federationModules = (env: Readonly<Record<string, string>>): string[] =>
+	buildModules(resolveConfig(env))
+		.map((module) => module.name)
+		.filter((name) => name.startsWith("federation-") && !name.startsWith("federation-grant"));
+
+/** Where the start of federation `name` sends the browser. */
+async function startOf(composed: Composition, name: string): Promise<URL> {
+	const res = await request(composed.app).get(`/session/oauth/federation/${name}`);
+	expect(res.status).toBe(302);
+	return new URL(res.headers.location as string);
+}
+
+describe("the federation types the template bundles", () => {
+	it("are listed whatever the configuration enables", () => {
+		const off = {
+			...SINGLE_ENV,
+			CORE_FEDERATIONS_GOOGLE_ENABLED: "false",
+			CORE_FEDERATIONS_OIDC_ENABLED: "false",
+		};
+		expect(federationModules(off)).toEqual(["federation-google-type", "federation-oidc"]);
+		expect(federationModules(SINGLE_ENV)).toEqual(["federation-google-type", "federation-oidc"]);
+	});
+
+	it("handle every entry the template ships, each of which names its type", () => {
+		const { applicationConfPath } = resolveConfigPaths(configDir, "production");
+		const resolved = resolveLayers(readOwnLayers([applicationConfPath], { env: {} }), []) as {
+			core?: { federations?: Record<string, { type?: unknown }> };
+		};
+		const types = Object.fromEntries(
+			Object.entries(resolved.core?.federations ?? {}).map(([name, entry]) => [name, entry.type]),
+		);
+		expect(types).toEqual({ google: "google", oidc: "oidc" });
+	});
+
+	it("boot the shipped Google federation, enabled, as the provider named google that its type built", async () => {
+		const composed = await boot();
+		const names = composed.modules.map((module) => module.name);
+		expect(names).toContain("federation-google-type");
+		expect(names).not.toContain("federation-google");
+		expect(composed.handle.components.federationProviders?.get("google")?.name).toBe("google");
+
+		const start = await startOf(composed, "google");
+		expect(`${start.origin}${start.pathname}`).toBe(GOOGLE_AUTHORIZE);
+		expect(start.searchParams.get("client_id")).toBe(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID);
+		expect(start.searchParams.get("redirect_uri")).toBe(
+			"http://localhost:3000/session/oauth/federation/google/callback",
+		);
+	});
+
+	it("boot a second entry of type google, under its own name, beside the shipped one", async () => {
+		const callbackURL = `${ISSUER}/session/oauth/federation/google-work/callback`;
+		const composed = await boot({
+			operatorHocon: `core.federations.google-work {
+  enabled = true
+  type = "google"
+  clientId = "google-work-client"
+  clientSecret = "google-work-secret"
+  callbackURL = ${JSON.stringify(callbackURL)}
+}
+`,
+		});
+		const providers = composed.handle.components.federationProviders;
+		expect([...(providers?.keys() ?? [])].sort()).toEqual(["google", "google-work", "oidc"]);
+		expect(providers?.get("google-work")?.name).toBe("google-work");
+
+		const work = await startOf(composed, "google-work");
+		expect(`${work.origin}${work.pathname}`).toBe(GOOGLE_AUTHORIZE);
+		expect(work.searchParams.get("client_id")).toBe("google-work-client");
+		expect(work.searchParams.get("redirect_uri")).toBe(callbackURL);
+		const shipped = await startOf(composed, "google");
+		expect(shipped.searchParams.get("client_id")).toBe(
+			SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID,
+		);
+	});
+
+	it("hand an entry to the type it names, not the type its name reads as", async () => {
+		// `google` of type `oidc` is a generic OIDC federation named google.
+		const composed = await boot({
+			operatorHocon: `core.federations.google { type = "oidc", issuer = ${JSON.stringify(SINGLE_ENV.CORE_FEDERATIONS_OIDC_ISSUER)} }\n`,
+		});
+		const start = await startOf(composed, "google");
+		expect(start.origin).toBe(SINGLE_ENV.CORE_FEDERATIONS_OIDC_ISSUER);
+		expect(start.searchParams.get("client_id")).toBe(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID);
+	});
+
+	it("register the type of every entry each shipped configuration file writes", () => {
+		const registered = new Set(
+			buildModules(resolveConfig(SINGLE_ENV)).flatMap((module) =>
+				Object.keys(module.contributes?.federationTypes ?? {}),
+			),
+		);
+		const written = readdirSync(configDir)
+			.filter((file) => file.endsWith(".conf"))
+			.flatMap((file) => {
+				const resolved = resolveLayers(readOwnLayers([join(configDir, file)], { env: {} }), []) as {
+					core?: { federations?: Record<string, { type?: unknown }> };
+				};
+				return Object.entries(resolved.core?.federations ?? {}).map(([name, entry]) => ({
+					file,
+					name,
+					type: entry.type,
+				}));
+			});
+		expect(written).not.toEqual([]);
+		expect(written.filter(({ type }) => typeof type !== "string" || !registered.has(type))).toEqual(
+			[],
+		);
+	});
+});
+
+describe("the template reads no federation entry before boot", () => {
+	it("passes a malformed entry through phase one, and boot refuses it at its path", async () => {
+		const operatorHocon = 'core.federations.okta { enabled = "maybe", type = "oidc" }\n';
+		expect(() =>
+			readSwitches(readOwnLayers([hoconFile(operatorHocon), ...ownFiles()], { env: SINGLE_ENV })),
+		).not.toThrow();
+		const err = await refusal({ operatorHocon });
+		expect(err.reason).toBe("config-validation-failed");
+		expect(err.message).toContain("core.federations.okta.enabled");
+	});
+
+	it.each([
+		["accessType", '"sometimes"'],
+		// A bare string where a list belongs: the natural typo.
+		["redirectAllowlist", '"https://app.test/home"'],
+		["sessionDomain", "42"],
+		["requireAuthorizationResponseIss", '"no"'],
+		// Only an environment variable's string is read as a flag's spelling.
+		["requireAuthorizationResponseIss", "1"],
+		["requireAuthorizationResponseIss", "[true]"],
+	])(
+		"leaves %s, a key of the entry's type, to the type's schema, which core refuses it by, at its path",
+		async (key, value) => {
+			const err = await refusal({ operatorHocon: `core.federations.google.${key} = ${value}\n` });
+			expect(err.reason).toBe("config-validation-failed");
+			expect(err.message).toContain(`core.federations.google.${key}`);
+		},
+	);
+});
+
+describe("an enabled Google federation's credentials", () => {
+	it.each([
+		["unset", undefined],
+		["exported empty", ""],
+	])(
+		"refuse the boot when the client secret is %s, at its path, quoting no value of the entry",
+		async (_case, secret) => {
+			const { CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: _shipped, ...env } = SINGLE_ENV;
+			const err = await refusal({
+				env: secret === undefined ? env : { ...env, CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: secret },
+			});
+			expect(err.reason).toBe("config-validation-failed");
+			expect(err.message).toContain("core.federations.google.clientSecret");
+			expect(err.message).not.toContain(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID as string);
+		},
+	);
+});