@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/google-session.fixture.mts

@@ -15,28 +15,25 @@
  */
 
 /**
- * A browser session with Google linked, on the standalone as a deployment
- * composes it: `oauthModule`, the session module and the real Google adapter,
- * booted through `createApp` under the shipped configuration.
+ * A browser session with Google linked, on the standalone composed as a
+ * deployment does: `oauthEndpointsModule`, the session module and the real Google
+ * adapter — the Google federation type `buildModules` lists, handed the
+ * shipped `core.federations.google` entry — booted through `createApp` under
+ * the shipped configuration.
  *
- * The routes that act on a session's federation — the two logout routes and
- * `POST /oauth/federation/:name/token` — live in `@o3co/auth-provider-oauth`,
- * which depends on no adapter, so its own tests stand one in. What they hand
- * the adapter, and what they make of what its library raises, can only be
- * seen here.
+ * The two logout routes and `POST /oauth/federation/:name/token` live in
+ * `@o3co/auth-provider-oauth`, which depends on no adapter; only here can a
+ * test see what they hand the real adapter and what they make of what its
+ * library raises.
  *
- * Not `all-modules-composition.fixture.mts`: that one switches every module
- * on and signs with a key it keeps to itself. The tests here present an
- * `id_token_hint` and an access token of their own — a caller's, with the
- * claims the case needs — so the deployment signs with an HS256 secret this
- * file holds, and nothing but Google is federated.
+ * Unlike `all-modules-composition.fixture.mts`, the deployment signs with an
+ * HS256 secret this file holds, so tests can present an `id_token_hint` and
+ * access token of their own; nothing but Google is federated.
  */
 
 import { createHmac } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import {
-	type AppConfig,
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
@@ -46,20 +43,23 @@ import {
 	InMemoryUserRepository,
 	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
-	type SessionFederationIndex,
+	type SessionLifecycle,
 	type UserSessionStore,
 } from "@o3co/auth-provider-core";
-import {
-	type GoogleProviderConfig,
-	googleFederationModule,
-} from "@o3co/auth-provider-federation-google";
+import { googleFederationTypeModule } from "@o3co/auth-provider-federation-google";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import express from "express";
 import request from "supertest";
 import { expect } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "#/configPath.mjs";
+import { resolveConfigPaths } from "#/configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import {
+	type BothPhases,
+	bothPhasesOf,
+	capturedRenames,
+	libraryLayers,
+} from "./library-references.fixture.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 
@@ -82,53 +82,71 @@ const GOOGLE_CLIENT_SECRET = "google-secret";
 const GOOGLE_CALLBACK = `${ISSUER}/session/oauth/federation/google/callback`;
 
 const ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: JWT_SECRET,
+	// A session signed in through Google alone, no second factor.
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: JWT_SECRET,
 	OAUTH_JWT_ISSUER: ISSUER,
-	SESSION_SECRET: "google-session.fixture-session.at-least-32-bytes.ok",
-	SESSION_SECURE: "false",
-	SESSION_NAME: "auth.session",
-	SESSION_STORAGE_TYPE: "memory",
-	CLIENT_USER_TYPE: "yaml",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "memory",
-	RATE_LIMITER_ADAPTER: "memory",
-	OAUTH_CODE_ADAPTER: "memory",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-	REPLAY_SEEN_SET_ADAPTER: "memory",
-	FEDERATION_TOKEN_STORE_TYPE: "memory",
-	CONSENT_STORE_ADAPTER: "none",
+	SESSION_STORE_SECRET: "google-session.fixture-session.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "memory",
+	ADAPTERS_RATE_LIMITER: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+	ADAPTERS_CONSENT_STORE: "none",
 };
 
 /**
- * `"shipped"`: Google switched on the way an operator does, through its
- * environment variables and the template's own configuration bridge — which
- * has no setting for an end-session endpoint or a `fetch`. Otherwise the
- * adapter's configuration beyond its credentials, composed with
- * `googleFederationModule` directly.
+ * Google switched on the way an operator does, through its environment
+ * variables, and handled by the Google federation type the template lists.
+ * `"shipped"` is that alone. Otherwise, beside it: `endSessionEndpoint`, a key
+ * of the entry with no environment form, written into the entry as an
+ * operator's own layer would; and `fetch`, the one the type module is built
+ * with in place of the global one.
  */
 export type GoogleWiring =
 	| "shipped"
-	| Omit<GoogleProviderConfig, "clientId" | "clientSecret" | "callbackURL">;
+	| { readonly endSessionEndpoint?: string; readonly fetch?: typeof fetch };
+
+const GOOGLE_ENV: Readonly<Record<string, string>> = {
+	CORE_FEDERATIONS_GOOGLE_ENABLED: "true",
+	CORE_FEDERATIONS_GOOGLE_CLIENT_ID: GOOGLE_CLIENT_ID,
+	CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: GOOGLE_CLIENT_SECRET,
+	CORE_FEDERATIONS_GOOGLE_CALLBACK_URL: GOOGLE_CALLBACK,
+};
 
-function resolveConfig(google: GoogleWiring): AppConfig {
-	const env: Record<string, string> =
-		google === "shipped"
-			? {
-					...ENV,
-					FEDERATIONS_GOOGLE_ENABLED: "true",
-					FEDERATIONS_GOOGLE_CLIENT_ID: GOOGLE_CLIENT_ID,
-					FEDERATIONS_GOOGLE_CLIENT_SECRET: GOOGLE_CLIENT_SECRET,
-					FEDERATIONS_GOOGLE_CALLBACK_URL: GOOGLE_CALLBACK,
-				}
-			: { ...ENV };
+function resolveConfig(google: GoogleWiring): BothPhases {
+	const env: Record<string, string> = { ...ENV, ...GOOGLE_ENV };
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return validate(
-		parseFile(envConfPath, { env })
-			.withFallback(parseFile(applicationConfPath, { env }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
-		AppConfigSchema,
-	) as AppConfig;
+	const layers = parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.withFallback(libraryLayers(env));
+	const config = bothPhasesOf(layers, env);
+	const endSessionEndpoint = google === "shipped" ? undefined : google.endSessionEndpoint;
+	const federations = config.core?.federations;
+	return {
+		...config,
+		...(endSessionEndpoint === undefined
+			? {}
+			: {
+					core: {
+						...config.core,
+						federations: {
+							...federations,
+							google: { ...federations?.google, endSessionEndpoint },
+						},
+					},
+				}),
+		// What the resolution captured of the renamed variables.
+		"renamed-variables": capturedRenames(env),
+	} as BothPhases;
 }
 
 const testRepositoriesModule = defineModule({
@@ -170,7 +188,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
@@ -216,15 +234,15 @@ export interface GoogleSession {
 	/** The access token the `session` grant minted for the session; it carries `azp`. */
 	readonly accessToken: string;
 	readonly userSessionStore: UserSessionStore;
-	readonly sessionFederationIndex: SessionFederationIndex;
+	readonly sessionLifecycle: SessionLifecycle;
 	readonly federationTokenStore: FederationTokenStore;
 	readonly dispose: () => Promise<void>;
 }
 
 /**
  * Boots the deployment, signs alice in with her password, and links Google to
- * her session as a federated sign-in would: the session's federation index
- * names it and the token store holds `tokens`.
+ * her session as a federated sign-in would: the token store holds `tokens`,
+ * and Google joins the session through its lifecycle.
  */
 export async function signInLinkedToGoogle(options: {
 	readonly google: GoogleWiring;
@@ -232,38 +250,24 @@ export async function signInLinkedToGoogle(options: {
 }): Promise<GoogleSession> {
 	const { google, tokens } = options;
 	const config = resolveConfig(google);
-	const googleModules =
-		google === "shipped"
-			? []
-			: [
-					googleFederationModule,
-					defineModule({
-						name: "test:google-federation-config",
-						provides: {
-							googleFederationConfig: (): GoogleProviderConfig => ({
-								clientId: GOOGLE_CLIENT_ID,
-								clientSecret: GOOGLE_CLIENT_SECRET,
-								callbackURL: GOOGLE_CALLBACK,
-								...google,
-							}),
-						},
-					}),
-				];
+	const upstreamFetch = google === "shipped" ? undefined : google.fetch;
+	const googleType = googleFederationTypeModule().name;
 	const handle = await createApp({
-		modules: [
-			...buildModules(config, {
-				keyStoreModule: testKeyStoreModule,
-				repositoriesModule: testRepositoriesModule,
-				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-			}),
-			...googleModules,
-		],
+		modules: buildModules(config, {
+			keyStoreModule: testKeyStoreModule,
+			repositoriesModule: testRepositoriesModule,
+			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+		}).map((module) =>
+			module.name === googleType && upstreamFetch !== undefined
+				? googleFederationTypeModule({ fetch: upstreamFetch })
+				: module,
+		),
 		bootstrapComponents: { config, pathResolver: (s) => s },
 	});
 	try {
 		const components = handle.components as {
 			userSessionStore: UserSessionStore;
-			sessionFederationIndex: SessionFederationIndex;
+			sessionLifecycle: SessionLifecycle;
 			federationTokenStore: FederationTokenStore;
 		};
 		const app = express();
@@ -292,10 +296,10 @@ export async function signInLinkedToGoogle(options: {
 		const sid = claims.sid as string;
 		expect(typeof sid).toBe("string");
 
-		const session = await components.userSessionStore.get(sid);
-		if (session === null) throw new Error("fixture: the sign-in left no session");
-		await components.sessionFederationIndex.addFederation(sid, "google", session.expiresAt);
 		await components.federationTokenStore.attach(sid, "google", tokens);
+		expect(await components.sessionLifecycle.join(sid, { federation: "google" })).toEqual({
+			outcome: "joined",
+		});
 		return { app, sid, accessToken, ...components, dispose: () => handle.dispose() };
 	} catch (error) {
 		await handle.dispose();

package/templates/standalone/src/__tests__/host-routes.test.mts

@@ -15,17 +15,10 @@
  */
 
 /**
- * The host's own routes — liveness, readiness, the metrics scrape — mounted
- * as the process mounts them (`mountRoutes`), and what an error one of them
- * lets through is answered with.
- *
- * The composed router answers its own errors with core's terminal handler.
- * The host's routes sat in front of a handler of the template's own, which
- * answered in other words ("Internal server error"), took any 4xx `status`
- * for the client's mistake and answered it as one, handed an error on to
- * Express once the headers were out (whose final handler prints the stack),
- * and logged the path as it arrived. Core's handler is now the one after
- * them too, so a deployment answers every route's error the same way.
+ * The host's own routes (liveness, readiness, the metrics scrape), mounted as
+ * the process mounts them (`mountRoutes`), and what an error one of them lets
+ * through is answered with: core's terminal handler, the same one behind the
+ * composed router, so every route's error is answered the same way.
  */
 
 import type { Logger, ReadinessProbe } from "@o3co/auth-provider-core";

package/templates/standalone/src/__tests__/library-reference-resolution.smoke.test.mts

@@ -24,6 +24,6 @@ describe("library reference.conf subpath resolution", () => {
 		const path = fileURLToPath(url);
 		expect(existsSync(path)).toBe(true);
 		const content = readFileSync(path, "utf-8");
-		expect(content).toMatch(/oauth\s*\{/); // sanity: HOCON content
+		expect(content).toMatch(/^core\s*\{/m); // sanity: HOCON content, core's own section
 	});
 });

package/templates/standalone/src/__tests__/library-references.fixture.mts

@@ -0,0 +1,188 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The libraries' layers beneath the template's own files, for a test that
+ * resolves its configuration by hand: the `reference.conf` of every package
+ * the template composes a module from, core's last, as `app.mts` layers them;
+ * the resolution handed to both phases at once; and what that resolution
+ * captures of the renamed variables.
+ */
+
+import { fileURLToPath } from "node:url";
+import {
+	type AppConfig,
+	memoryRateLimiterModule,
+	moduleReferences,
+} from "@o3co/auth-provider-core";
+import { CORE_RELOCATIONS, renamedVariableCaptures } from "@o3co/auth-provider-core/testing";
+import { federationGrantsModules } from "@o3co/auth-provider-federation-grants";
+import {
+	oauthAuthorizationGrantsModule,
+	oauthEndpointsModule,
+	oauthSessionGrantModule,
+} from "@o3co/auth-provider-oauth";
+import {
+	redisCodeRepositoryModule,
+	redisFederationGrantStoreModule,
+	redisRateLimiterModule,
+	redisRefreshTokenFamilyStoreModule,
+} from "@o3co/auth-provider-redis";
+import { sessionModule, sessionStoreModule } from "@o3co/auth-provider-session";
+import { type Config, empty, parseFile } from "@o3co/ts.hocon";
+import { readAdapters } from "../adapters.mjs";
+import { readSwitches, type Switches } from "../configPath.mjs";
+import {
+	httpModule,
+	inMemoryCodeRepositoryModule,
+	keyStoreModule,
+	loggingModule,
+	repositoriesModuleFor,
+	standaloneRedisClientsModule,
+	templateReference,
+} from "../modules.mjs";
+import { type Adapters, isPlainSection } from "../sections.mjs";
+
+/** The oauth package's modules: none reads the configuration it is handed. */
+const OAUTH_MODULES = [
+	oauthEndpointsModule,
+	oauthSessionGrantModule,
+	oauthAuthorizationGrantsModule,
+];
+
+/** The modules the template composes that declare a renamed variable. */
+const RENAMING_MODULES = [
+	memoryRateLimiterModule,
+	redisRateLimiterModule,
+	redisRefreshTokenFamilyStoreModule,
+	redisFederationGrantStoreModule,
+	...OAUTH_MODULES,
+	sessionModule,
+	sessionStoreModule,
+	loggingModule,
+	httpModule,
+	keyStoreModule,
+	standaloneRedisClientsModule,
+	repositoriesModuleFor({ client: "yaml", user: "yaml" }),
+	inMemoryCodeRepositoryModule,
+];
+
+/** Every package reference the template's modules declare, core's last. */
+const LIBRARY_REFERENCES: readonly URL[] = moduleReferences([
+	redisRateLimiterModule,
+	...federationGrantsModules,
+	...OAUTH_MODULES,
+	sessionModule,
+	sessionStoreModule,
+]);
+
+/** The libraries' references resolved under `env`, in the order `app.mts` layers them. */
+export function libraryLayers(env: Readonly<Record<string, string>>): Config {
+	return LIBRARY_REFERENCES.reduce<Config>(
+		(layered, reference) =>
+			layered.withFallback(parseFile(fileURLToPath(reference), { env: { ...env } })),
+		empty(),
+	);
+}
+
+/** Phase one's switches laid over the configuration boot parses. */
+export type BothPhases = Switches & AppConfig;
+
+/**
+ * `switches` laid over `resolved`, the configuration boot parses, as a test
+ * that hands one object to both phases does: the composition root's own keys
+ * beside the sections, and `federation-grants.enabled` written as phase one
+ * decided it into the section as resolved. Boot is so handed phase one's
+ * boolean, not the value as written, unlike `app.mts`; boot's refusal of a
+ * written value phase one installs the modules for is pinned in
+ * `two-phase-config.test.mts`.
+ */
+export function withSwitches(
+	resolved: Readonly<Record<string, unknown>>,
+	switches: Switches,
+): BothPhases {
+	const grants = resolved["federation-grants"];
+	return {
+		...resolved,
+		...switches,
+		"federation-grants": {
+			...(isPlainSection(grants) ? grants : {}),
+			...switches["federation-grants"],
+		},
+	} as unknown as BothPhases;
+}
+
+/**
+ * A resolution — `layers`, the template's `config/reference.conf` among them,
+ * under `env` — as a test that resolves by hand hands it to both phases at
+ * once: the configuration as resolved and unparsed, which boot parses as
+ * `app.mts` hands it on, with what phase one reads of it (`readSwitches`)
+ * laid over it — the composition root's `adapters` and `mfaMode`, the Store
+ * transport settings, and `federation-grants.enabled` as phase one decides
+ * it.
+ */
+export function bothPhasesOf(layers: Config, env: Readonly<Record<string, string>>): BothPhases {
+	return withSwitches(
+		layers.toObject() as Record<string, unknown>,
+		readSwitches({ config: layers, env }),
+	);
+}
+
+/**
+ * The composition root's `adapters` a resolution holds — `layers`, the
+ * template's `config/reference.conf` among them, under `env` — as phase one
+ * reads them.
+ */
+export function adaptersOf(layers: Config, env: Readonly<Record<string, string>>): Adapters {
+	return readAdapters(layers.toObject() as Record<string, unknown>, env);
+}
+
+/** The adapters the template ships, as its `config/reference.conf` sets them with no environment. */
+export function shippedAdapters(): Adapters {
+	return adaptersOf(parseFile(fileURLToPath(templateReference()), { env: {} }), {});
+}
+
+/** The shipped adapters with every store the template can hold in process there: no Redis connection needed. */
+export function inProcessAdapters(): Adapters {
+	return {
+		...shippedAdapters(),
+		rateLimiter: "memory",
+		userSessionStores: "memory",
+		accessTokenDenylist: "memory",
+		replaySeenSet: "memory",
+		federationTokenStore: "memory",
+		federationGrantStore: "memory",
+		federationGrantIntentStore: "memory",
+		mfaFactorStore: "memory",
+		mfaTransactionStore: "memory",
+		codeRepository: "memory",
+	};
+}
+
+/**
+ * The `renamed-variables` section a resolution under `env` holds: what every
+ * module above captures, and the Redis code repository's, which the
+ * in-process one's excludes from one composition (both declare
+ * CLIENT_CODE_DEFAULT_EXPIRES_IN renamed, each to its own new name).
+ */
+export function capturedRenames(
+	env: Readonly<Record<string, string | undefined>>,
+): Record<string, string | null> {
+	return {
+		...renamedVariableCaptures({ modules: [redisCodeRepositoryModule], env }),
+		...renamedVariableCaptures({ modules: RENAMING_MODULES, core: CORE_RELOCATIONS, env }),
+	};
+}