@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/lifecycle-pending-close.test.mts

@@ -0,0 +1,216 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template with core's session lifecycle module: a close whose
+ * relying-party notice fails stays pending, its user session still there,
+ * and from its commit no token reader treats the session as live —
+ * introspection, userinfo and the session grant all refuse it.
+ */
+
+import type { SessionLifecycle, UserSessionStore } from "@o3co/auth-provider-core";
+import request from "supertest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+	authorize,
+	basic,
+	codeFrom,
+	compose,
+	login,
+	redeem,
+	WEB,
+} from "./all-modules-composition.fixture.mjs";
+
+afterEach(() => {
+	vi.restoreAllMocks();
+});
+
+/** A JWT's claims, unverified. */
+const claimsOf = (token: string): Record<string, unknown> =>
+	JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+
+describe("a session whose close is pending on a failed relying-party notice", () => {
+	it("is refused by introspection, userinfo and the session grant, its user session still there", async () => {
+		const { app, handle } = await compose({
+			extraClients: {
+				"rp-down": {
+					tokenEndpointAuthMethod: "client_secret_basic",
+					clientSecret: "rp-down-secret-long-enough",
+					allowedRedirectUris: ["https://rp-down.test/cb"],
+					allowedScopes: ["openid"],
+					allowedGrantTypes: ["authorization_code"],
+					backchannelLogoutUri: "https://rp-down.test/logout",
+				},
+			},
+		});
+		try {
+			const components = handle.components as Record<string, unknown>;
+			const lifecycle = components.sessionLifecycle as SessionLifecycle;
+			const sessions = components.userSessionStore as UserSessionStore;
+			const { cookies } = await login(app);
+			const sessionGrant = () =>
+				request(app)
+					.post("/oauth/token")
+					.set("Authorization", basic(WEB))
+					.set("Cookie", cookies)
+					.type("form")
+					.send({ grant_type: "session", scope: "openid profile" });
+			const issued = await sessionGrant();
+			expect(issued.status).toBe(200);
+			const accessToken = issued.body.access_token as string;
+			const sid = String(claimsOf(accessToken).sid);
+			const introspect = () =>
+				request(app)
+					.post("/oauth/introspect")
+					.set("Authorization", basic(WEB))
+					.type("form")
+					.send({ token: accessToken });
+			const userinfo = () =>
+				request(app).get("/oauth/userinfo").set("Authorization", `Bearer ${accessToken}`);
+			expect((await introspect()).body.active).toBe(true);
+			expect((await userinfo()).status).toBe(200);
+
+			// A relying party joins with its family; its back-channel endpoint is
+			// down, so the close commits with its notice pending.
+			expect(
+				await lifecycle.join(sid, {
+					rp: {
+						clientId: "rp-down",
+						backchannelLogoutUri: "https://rp-down.test/logout",
+						backchannelLogoutSessionRequired: true,
+						frontchannelLogoutUri: undefined,
+						frontchannelLogoutSessionRequired: undefined,
+						registeredAt: new Date(),
+					},
+					familyId: "family-down",
+				}),
+			).toEqual({ outcome: "joined" });
+			const posted = vi
+				.spyOn(globalThis, "fetch")
+				.mockImplementation(async () => new Response(null, { status: 503 }));
+			expect((await lifecycle.close(sid, "rp_logout")).outcome).toBe("pending");
+			expect(posted).toHaveBeenCalled();
+			expect(await sessions.get(sid)).not.toBeNull();
+
+			const afterIntrospect = await introspect();
+			expect(afterIntrospect.status).toBe(200);
+			expect(afterIntrospect.body).toEqual({ active: false });
+
+			const afterUserinfo = await userinfo();
+			expect(afterUserinfo.status).toBe(401);
+			expect(afterUserinfo.body.error_description).toBe("session_invalid");
+
+			const again = await sessionGrant();
+			expect(again.status).toBe(400);
+			expect(again.body).toMatchObject({
+				error: "invalid_grant",
+				error_description: "session_invalid",
+			});
+		} finally {
+			await handle.dispose();
+		}
+	});
+
+	it("an RP-initiated logout whose notice fails answers success, and its session is refused by introspection, userinfo and the session grant", async () => {
+		const { app, handle } = await compose({
+			extraClients: {
+				"rp-down": {
+					tokenEndpointAuthMethod: "client_secret_basic",
+					clientSecret: "rp-down-secret-long-enough",
+					allowedRedirectUris: ["https://rp-down.test/cb"],
+					allowedScopes: ["openid"],
+					allowedGrantTypes: ["authorization_code"],
+					backchannelLogoutUri: "https://rp-down.test/logout",
+				},
+			},
+		});
+		try {
+			const components = handle.components as Record<string, unknown>;
+			const lifecycle = components.sessionLifecycle as SessionLifecycle;
+			const sessions = components.userSessionStore as UserSessionStore;
+			const { cookies } = await login(app);
+			// The code exchange joins the session; its id_token is the logout's hint.
+			const exchanged = await redeem(app, codeFrom(await authorize(app, cookies)));
+			expect(exchanged.status).toBe(200);
+			const idToken = exchanged.body.id_token as string;
+			const sid = String(claimsOf(idToken).sid);
+			const sessionGrant = () =>
+				request(app)
+					.post("/oauth/token")
+					.set("Authorization", basic(WEB))
+					.set("Cookie", cookies)
+					.type("form")
+					.send({ grant_type: "session", scope: "openid profile" });
+			const issued = await sessionGrant();
+			expect(issued.status).toBe(200);
+			// A session-grant token carries the session and no family.
+			const accessToken = issued.body.access_token as string;
+			expect(claimsOf(accessToken)).toMatchObject({ sid });
+			expect(claimsOf(accessToken).family_id).toBeUndefined();
+
+			// A relying party whose back-channel endpoint is down joins the session.
+			expect(
+				await lifecycle.join(sid, {
+					rp: {
+						clientId: "rp-down",
+						backchannelLogoutUri: "https://rp-down.test/logout",
+						backchannelLogoutSessionRequired: true,
+						frontchannelLogoutUri: undefined,
+						frontchannelLogoutSessionRequired: undefined,
+						registeredAt: new Date(),
+					},
+				}),
+			).toEqual({ outcome: "joined" });
+			const posted = vi
+				.spyOn(globalThis, "fetch")
+				.mockImplementation(async () => new Response(null, { status: 503 }));
+
+			const logout = await request(app)
+				.post("/oauth/logout")
+				.type("form")
+				.send({ id_token_hint: idToken });
+
+			// The close committed with the notice pending: the logout succeeded.
+			expect(logout.status).toBe(200);
+			expect(logout.body).toEqual({ logged_out: true });
+			expect(posted).toHaveBeenCalled();
+			expect(await sessions.get(sid)).not.toBeNull();
+
+			const introspected = await request(app)
+				.post("/oauth/introspect")
+				.set("Authorization", basic(WEB))
+				.type("form")
+				.send({ token: accessToken });
+			expect(introspected.status).toBe(200);
+			expect(introspected.body).toEqual({ active: false });
+
+			const userinfo = await request(app)
+				.get("/oauth/userinfo")
+				.set("Authorization", `Bearer ${accessToken}`);
+			expect(userinfo.status).toBe(401);
+			expect(userinfo.body.error_description).toBe("session_invalid");
+
+			const again = await sessionGrant();
+			expect(again.status).toBe(400);
+			expect(again.body).toMatchObject({
+				error: "invalid_grant",
+				error_description: "session_invalid",
+			});
+		} finally {
+			await handle.dispose();
+		}
+	});
+});

package/templates/standalone/src/__tests__/listen.test.mts

@@ -16,16 +16,9 @@
 
 /**
  * Starting the listener: one object-first `server_listening` line once the
- * socket is bound — and none for a port that was never bound.
- *
- * The line used to be a template string, `Server is running on
- * http://localhost:<port>`, which a log pipeline indexes as free text rather
- * than as an event with a port. And the standalone called Express 5's
- * `app.listen`, which hands its callback the server's `error` as well as its
- * `listening`: a callback that ignored its argument announced a server on a
- * port another process held, while the error that should have ended the
- * process was swallowed. `listen` now builds the server and wires its events
- * itself.
+ * socket is bound, and none for a port that was never bound. `listen` wires
+ * the server's events itself rather than trust `app.listen`, whose Express 5
+ * callback is handed the bind `error` as well as `listening`.
  */
 
 import { createServer, type Server } from "node:http";
@@ -74,9 +67,9 @@ describe("listen", () => {
 	});
 
 	it("logs a server error after the bind — server_error, the projection — rather than swallowing it", async () => {
-		// Once the socket is bound, a later `error` (accept EMFILE) went to
-		// Express 5's spent listen callback and was lost — and the one after
-		// it, with no listener left, threw out of the process.
+		// Every `error` after the bind (accept EMFILE) is logged: a spent
+		// once-listener would lose the first, and with no listener left the
+		// second would be thrown out of the process.
 		const { logger, calls } = recordingLogger();
 		const server = await listen(express(), 0, logger);
 		opened.push(server);

package/templates/standalone/src/__tests__/logger-projection.test.mts

@@ -45,7 +45,7 @@ const store = Object.assign(new Error("the Store could not be read", { cause: pa
 const failed = Object.assign(new Error("request failed", { cause: store }), {
 	type: "upstream.failed", status: 502,
 });
-createAppLogger({ logging: { level: "info" } }).error({ err: loggableError(failed) }, "unhandled_request_error");
+createAppLogger({ level: "info" }).error({ err: loggableError(failed) }, "unhandled_request_error");
 `;
 
 describe("createAppLogger writes a projected error whole", () => {

package/templates/standalone/src/__tests__/mail-sender.test.mts

@@ -0,0 +1,134 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The mail sender the template installs behind core's `mailSender` slot,
+ * both from `@o3co/auth-provider-standard`: the development sender where the
+ * configuration was selected as development — the name `app.mts` defaults
+ * to — the SMTP sender's module under any other name, and none when
+ * `buildModules` is told no name. A deployment's own sender modules, passed
+ * as `mailSenderModules`, replace that choice under every name. Nothing in
+ * the template reads the slot: this is the wiring alone.
+ */
+
+import { defineModule, type MailSender, type Module } from "@o3co/auth-provider-core";
+import {
+	standardDevelopmentMailSenderModule,
+	standardSmtpMailSenderModule,
+} from "@o3co/auth-provider-standard";
+import { afterEach, describe, expect, it } from "vitest";
+import { buildModules } from "#/buildModules.mjs";
+import {
+	type Composition,
+	compose,
+	resolveConfig,
+	SINGLE_ENV,
+} from "./all-modules-composition.fixture.mjs";
+
+const DEVELOPMENT = standardDevelopmentMailSenderModule({ environment: "development" }).name;
+const SMTP = standardSmtpMailSenderModule.name;
+
+/** A deployment's own sender, built at boot so the slot holds it with nothing reading it. */
+const OWN_SENDER: MailSender = {
+	kind: "deployment-own",
+	send: async () => ({ outcome: "delivered" }),
+};
+const ownSenderModule: Module = defineModule({
+	name: "deployment-own-mail-sender",
+	lifecycle: { mailSender: { eager: true } },
+	provides: { mailSender: () => OWN_SENDER },
+});
+const OWN = ownSenderModule.name;
+
+/** The mail sender modules `buildModules` lists for `environment`. */
+const senders = (
+	environment: string | undefined,
+	mailSenderModules?: readonly Module[],
+): string[] =>
+	buildModules(resolveConfig(SINGLE_ENV), {
+		...(environment === undefined ? {} : { environment }),
+		...(mailSenderModules === undefined ? {} : { mailSenderModules }),
+	})
+		.map((module) => module.name)
+		.filter((name) => name === DEVELOPMENT || name === SMTP || name === OWN);
+
+const ENVIRONMENTS = ["development", "production", "staging", "test", "Development"] as const;
+
+describe("the template's mail sender", () => {
+	let current: Composition | undefined;
+	afterEach(async () => {
+		await current?.handle.dispose();
+		current = undefined;
+	});
+
+	it("is the development sender in development, and none where no environment is named", () => {
+		expect(senders("development")).toEqual([DEVELOPMENT]);
+		expect(senders(undefined)).toEqual([]);
+	});
+
+	it("is the SMTP sender's module under any other environment", () => {
+		for (const environment of ["production", "staging", "test", "Development"]) {
+			expect(senders(environment), environment).toEqual([SMTP]);
+		}
+	});
+
+	it("fills the slot with the development sender when the composition boots in development", async () => {
+		current = await compose({ environment: "development" });
+		expect((current.handle.components.mailSender as MailSender | undefined)?.kind).toBe(
+			"standard-development",
+		);
+	});
+
+	it("boots in production with the SMTP sender's module installed and no SMTP settings, building no sender where nothing reads the slot", async () => {
+		current = await compose();
+		expect(current.modules.map((module) => module.name)).toContain(SMTP);
+		expect(current.handle.components.mailSender).toBeUndefined();
+	});
+
+	describe("given the deployment's own sender modules", () => {
+		it("installs them in place of the bundled sender, under every environment name and none", () => {
+			for (const environment of [...ENVIRONMENTS, undefined]) {
+				expect(senders(environment, [ownSenderModule]), String(environment)).toEqual([OWN]);
+			}
+		});
+
+		it("installs no sender at all when the list is empty", () => {
+			for (const environment of [...ENVIRONMENTS, undefined]) {
+				expect(senders(environment, []), String(environment)).toEqual([]);
+			}
+		});
+
+		it.each(["development", "production"])(
+			"fills the slot with the deployment's sender when the composition boots in %s",
+			async (environment) => {
+				current = await compose({ environment, mailSenderModules: [ownSenderModule] });
+				const names = current.modules.map((module) => module.name);
+				expect(names).toContain(OWN);
+				expect(names).not.toContain(DEVELOPMENT);
+				expect(names).not.toContain(SMTP);
+				expect(current.handle.components.mailSender).toBe(OWN_SENDER);
+			},
+		);
+
+		it("boots in production with no sender when the list is empty", async () => {
+			current = await compose({ environment: "production", mailSenderModules: [] });
+			const names = current.modules.map((module) => module.name);
+			expect(names).not.toContain(DEVELOPMENT);
+			expect(names).not.toContain(SMTP);
+			expect(current.handle.components.mailSender).toBeUndefined();
+		});
+	});
+});