@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -15,63 +15,56 @@
  */
 
 /**
- * #455 / #456 — the standalone's own store modules under
- * `deployment.mode = "multi"`, booted the way an operator reaches them: from
- * the shipped HOCON with one environment variable flipped.
+ * The standalone's own store modules under `core.deployment.mode = "multi"`,
+ * booted the way an operator reaches them: from the shipped HOCON with one
+ * environment variable flipped.
  *
- * #455: the replica-safety guard keyed on core's module names, and this
- * template wires its *own* in-memory modules for three of the stores —
- * session stores, the code repository, the federation token store — under
- * names the guard had never heard of. `DEPLOYMENT_MODE=multi` with
- * `USER_SESSION_STORES_ADAPTER=memory` booted, and the refusal the README
- * promises did not fire for exactly the stores that fork per replica the
- * worst. Every memory branch is booted here under `"multi"` and must be
- * refused by name; the all-Redis environment must boot.
+ * - Every memory branch must be refused by name, and the all-Redis
+ *   environment must boot. The replica-safety guard reads each module's
+ *   manifest declaration, which covers the template's own in-memory modules
+ *   and express-session's store (`sessionStoreModule`, which declares from
+ *   its own section).
+ * - `federationTokenStore.type = "redis"` mounts
+ *   `redisFederationTokenStoreModule` off the shared ioredis socket.
+ * - The Redis federation store's `allow-plaintext` guard reads the
+ *   environment the config was selected by (`CONFIG_ENV || NODE_ENV`, passed
+ *   through `buildModules`) and refuses under `core.deployment.mode = "multi"` in
+ *   every environment.
  *
- * #456: `federationTokenStore.type = "redis"` was documented and could not
- * boot — the module went through the adapter factory without ever handing
- * the builder a client. The Redis branch now mounts
- * `redisFederationTokenStoreModule` off the shared ioredis socket; the boot
- * below is the test the README sentence never had.
- *
- * #474: express-session's own store was the one memory store the guard could
- * not see — `SESSION_STORAGE_TYPE=memory` is config, and `sessionStoreModule`'s
- * static manifest carried no declaration. `buildModules` now builds it from
- * the config (`sessionStoreModuleFor`), so it is refused by name like the rest.
- *
- * #473: the Redis federation store's `allow-plaintext` guard keyed off
- * `NODE_ENV` alone. It now reads the environment the config was selected by
- * (`CONFIG_ENV || NODE_ENV`, passed through `buildModules`) and refuses under
- * `deployment.mode = "multi"` in every environment.
- *
- * ioredis is mocked, as in `device-code-store-client-module.test.mts`: the
- * point is composition and the boot planner's stage-1 verdict, not Redis.
- * Nothing here issues a command. node-redis and connect-redis — the session
- * store's own connection — are mocked for the same reason, since #474 puts
- * `SESSION_STORAGE_TYPE=redis` in the baseline.
+ * ioredis, node-redis and connect-redis are mocked, as in
+ * `device-code-store-client-module.test.mts`: the point is composition and
+ * the boot planner's stage-1 verdict, not Redis. Nothing here issues a
+ * command.
  */
 
 import { fileURLToPath } from "node:url";
 import {
-	type AppConfig,
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
 	InMemoryClientRepository,
 	InMemoryUserRepository,
+	type Module,
 	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 	replicaUnsafeReason,
 } from "@o3co/auth-provider-core";
+import { sessionStoreModule } from "@o3co/auth-provider-session";
+import { standardSmtpMailSenderConfigForTests } from "@o3co/auth-provider-standard/testing";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
-
-// The redis session-store builder dynamically imports these (#474 puts the
-// Redis session store in the baseline); mock them so no socket opens.
+import { resolveConfigPaths } from "../configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import {
+	type BothPhases,
+	bothPhasesOf,
+	capturedRenames,
+	libraryLayers,
+} from "./library-references.fixture.mjs";
+
+// The redis session-store builder, which the baseline selects, dynamically
+// imports these; mock them so no socket opens.
 vi.mock("redis", () => ({
 	createClient: vi.fn(() => ({
 		connect: vi.fn().mockResolvedValue(undefined),
@@ -141,41 +134,47 @@ const ENCRYPTION_KEY = Buffer.alloc(32, 7).toString("base64");
 
 /**
  * The umbrella E2E's shape (`o3co/auth` `tests/docker-compose.yml`), with
- * every shared store on Redis — express-session's own included, since #474
- * put it under the guard. Each case below flips one variable off this.
+ * every shared store on Redis, express-session's own included, and MFA off
+ * as the umbrella sets it. Each case below flips one variable off this.
  */
 const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: "replica-safety-test-secret.at-least-32-bytes.ok",
+	MFA_MODE: "off",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: "replica-safety-test-secret.at-least-32-bytes.ok",
 	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_SECRET: "replica-safety-session-secret.at-least-32-bytes.ok",
-	SESSION_SECURE: "false",
-	SESSION_NAME: "auth.session",
-	SESSION_STORAGE_TYPE: "redis",
-	SESSION_STORAGE_REDIS_URL: "redis://redis.test:6379",
-	CLIENT_USER_TYPE: "yaml",
-	DEPLOYMENT_MODE: "multi",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis.test:6379",
-	USER_SESSION_STORES_ADAPTER: "redis",
-	RATE_LIMITER_ADAPTER: "redis",
-	OAUTH_CODE_ADAPTER: "redis",
-	ACCESS_TOKEN_DENYLIST_ADAPTER: "redis",
-	REPLAY_SEEN_SET_ADAPTER: "redis",
-	FEDERATION_TOKEN_STORE_TYPE: "redis",
+	SESSION_STORE_SECRET: "replica-safety-session-secret.at-least-32-bytes.ok",
+	SESSION_STORE_SECURE: "false",
+	SESSION_STORE_NAME: "auth.session",
+	SESSION_STORE_STORAGE_TYPE: "redis",
+	SESSION_STORE_STORAGE_REDIS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_REPOSITORY: "yaml",
+	CORE_DEPLOYMENT_MODE: "multi",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "redis",
+	ADAPTERS_RATE_LIMITER: "redis",
+	// The login's attempt counter, shared: per process, `multi` refuses the login.
+	ADAPTERS_ATTEMPT_COUNTER: "redis",
+	ADAPTERS_CODE_REPOSITORY: "redis",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "redis",
+	ADAPTERS_REPLAY_SEEN_SET: "redis",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: ENCRYPTION_KEY,
-	// #561: the consent step for clients that are not first-party, on the
+	// The consent step for clients that are not first-party, on the
 	// shared store — the one switch value `multi` accepts besides `none`.
-	CONSENT_STORE_ADAPTER: "redis",
+	ADAPTERS_CONSENT_STORE: "redis",
 };
 
-function resolveConfig(env: Record<string, string>): AppConfig {
+function resolveConfig(env: Record<string, string>): BothPhases {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return validate(
-		parseFile(envConfPath, { env })
-			.withFallback(parseFile(applicationConfPath, { env }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
-		AppConfigSchema,
-	);
+	const layers = parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.withFallback(libraryLayers(env));
+	return {
+		...bothPhasesOf(layers, env),
+		// What the resolution captured of the renamed variables.
+		"renamed-variables": capturedRenames(env),
+	} as BothPhases;
 }
 
 /** Drops a variable, so the HOCON default takes over. */
@@ -204,20 +203,27 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
 });
 
-const modulesFor = (config: AppConfig, environment?: string) =>
+const modulesFor = (config: BothPhases, environment?: string) =>
 	buildModules(config, {
 		keyStoreModule: testKeyStoreModule,
 		repositoriesModule: testRepositoriesModule,
 		...(environment === undefined ? {} : { environment }),
 	});
 
-const boot = (config: AppConfig, environment?: string) =>
+/**
+ * `module`'s section in `config`, for a declaration made from it: each module
+ * here that has one sits at its name.
+ */
+const sectionOf = (config: BothPhases, module: Module): unknown =>
+	(config as unknown as Record<string, unknown>)[module.name];
+
+const boot = (config: BothPhases, environment?: string) =>
 	createApp({
 		modules: modulesFor(config, environment),
 		bootstrapComponents: { config, pathResolver: (s) => s },
@@ -229,7 +235,7 @@ const messageChain = (err: unknown): string => {
 	return `${e.message ?? ""} ${e.cause?.message ?? ""}`;
 };
 
-describe('#455: the standalone\'s memory modules are refused under deployment.mode = "multi"', () => {
+describe('the standalone\'s memory modules are refused under core.deployment.mode = "multi"', () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 
 	afterEach(async () => {
@@ -238,21 +244,20 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 	});
 
 	const cases: ReadonlyArray<readonly [variable: string, module: string]> = [
-		// The template's own modules — the three the guard could not see.
-		["USER_SESSION_STORES_ADAPTER", "standalone:in-memory-session-stores"],
-		["OAUTH_CODE_ADAPTER", "standalone:in-memory-code-repository"],
-		["FEDERATION_TOKEN_STORE_TYPE", "standalone:in-memory-federation-token-store"],
-		// #474: express-session's own store. Not a module of this template but
-		// built here from its config, which is what lets the manifest declare.
-		["SESSION_STORAGE_TYPE", "sessionStoreModule"],
-		// #527: the consent store, wired only when the switch says so.
-		["CONSENT_STORE_ADAPTER", "core-consent-store-memory"],
-		// Core's, selected by the same kind of switch. The guard knew these by
-		// name; pinned so the name table's departure (#455) did not lose them.
-		["RATE_LIMITER_ADAPTER", "core-rate-limiter-memory"],
-		["ACCESS_TOKEN_DENYLIST_ADAPTER", "core-access-token-denylist-memory"],
-		// #484: the jti single-use record behind private_key_jwt client auth.
-		["REPLAY_SEEN_SET_ADAPTER", "core-replay-seen-set-memory"],
+		// The template's own modules.
+		["ADAPTERS_USER_SESSION_STORES", "standalone-in-memory-session-stores"],
+		["ADAPTERS_CODE_REPOSITORY", "standalone-in-memory-code-repository"],
+		["ADAPTERS_FEDERATION_TOKEN_STORE", "standalone-in-memory-federation-token-store"],
+		// express-session's own store. Not a module of this template: it
+		// declares from its own section, which boot parses.
+		["SESSION_STORE_STORAGE_TYPE", "session-store"],
+		// The consent store, wired only when the switch says so.
+		["ADAPTERS_CONSENT_STORE", "core-consent-store-memory"],
+		// Core's, selected by the same kind of switch.
+		["ADAPTERS_RATE_LIMITER", "core-rate-limiter-memory"],
+		["ADAPTERS_ACCESS_TOKEN_DENYLIST", "core-access-token-denylist-memory"],
+		// The jti single-use record behind private_key_jwt client auth.
+		["ADAPTERS_REPLAY_SEEN_SET", "core-replay-seen-set-memory"],
 	];
 
 	for (const [variable, module] of cases) {
@@ -269,14 +274,14 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 	it("names every memory module together when every switch is memory", async () => {
 		const config = resolveConfig({
 			...ALL_REDIS_ENV,
-			USER_SESSION_STORES_ADAPTER: "memory",
-			OAUTH_CODE_ADAPTER: "memory",
-			FEDERATION_TOKEN_STORE_TYPE: "memory",
-			SESSION_STORAGE_TYPE: "memory",
-			RATE_LIMITER_ADAPTER: "memory",
-			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-			REPLAY_SEEN_SET_ADAPTER: "memory",
-			CONSENT_STORE_ADAPTER: "memory",
+			ADAPTERS_USER_SESSION_STORES: "memory",
+			ADAPTERS_CODE_REPOSITORY: "memory",
+			ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+			SESSION_STORE_STORAGE_TYPE: "memory",
+			ADAPTERS_RATE_LIMITER: "memory",
+			ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+			ADAPTERS_REPLAY_SEEN_SET: "memory",
+			ADAPTERS_CONSENT_STORE: "memory",
 		});
 		await expect(boot(config)).rejects.toMatchObject({
 			reason: "replica-unsafe-adapter",
@@ -287,21 +292,21 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 	});
 
 	it("each standalone memory module declares its consequence on its own manifest", () => {
-		// The declaration is what the guard reads (#455), so it has to be on
+		// The declaration is what the guard reads, so it has to be on
 		// the module and it has to say what breaks — the guard quotes it.
 		const config = resolveConfig({
 			...ALL_REDIS_ENV,
-			USER_SESSION_STORES_ADAPTER: "memory",
-			OAUTH_CODE_ADAPTER: "memory",
-			FEDERATION_TOKEN_STORE_TYPE: "memory",
+			ADAPTERS_USER_SESSION_STORES: "memory",
+			ADAPTERS_CODE_REPOSITORY: "memory",
+			ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
 		});
 		const standaloneMemoryModules = modulesFor(config).filter((m) =>
-			m.name.startsWith("standalone:in-memory-"),
+			m.name.startsWith("standalone-in-memory-"),
 		);
 		expect(standaloneMemoryModules.map((m) => m.name).sort()).toEqual([
-			"standalone:in-memory-code-repository",
-			"standalone:in-memory-federation-token-store",
-			"standalone:in-memory-session-stores",
+			"standalone-in-memory-code-repository",
+			"standalone-in-memory-federation-token-store",
+			"standalone-in-memory-session-stores",
 		]);
 		for (const m of standaloneMemoryModules) {
 			expect(replicaUnsafeReason(m), m.name).toBeDefined();
@@ -312,14 +317,116 @@ describe('#455: the standalone\'s memory modules are refused under deployment.mo
 	it("boots the all-Redis environment, with nothing declaring replica-unsafe state", async () => {
 		const config = resolveConfig(ALL_REDIS_ENV);
 		for (const m of modulesFor(config)) {
-			expect(replicaUnsafeReason(m), m.name).toBeUndefined();
+			expect(replicaUnsafeReason(m, sectionOf(config, m)), m.name).toBeUndefined();
 		}
 		handleRef = await boot(config);
 		expect(handleRef).toBeDefined();
 	});
 });
 
-describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
+describe("express-session's store declares its replica safety from its own section", () => {
+	it("is the session package's sessionStoreModule, listed first", () => {
+		expect(modulesFor(resolveConfig(ALL_REDIS_ENV))[0]).toBe(sessionStoreModule);
+	});
+
+	/** Each way the storage type is set, laid over the all-Redis environment. */
+	const STORAGE: ReadonlyArray<readonly [string, Record<string, string>]> = [
+		[
+			"SESSION_STORE_STORAGE_TYPE=memory",
+			{ ...ALL_REDIS_ENV, SESSION_STORE_STORAGE_TYPE: "memory" },
+		],
+		["SESSION_STORE_STORAGE_TYPE=redis", ALL_REDIS_ENV],
+		[
+			"no SESSION_STORE_STORAGE_TYPE, the reference's default",
+			without(ALL_REDIS_ENV, "SESSION_STORE_STORAGE_TYPE"),
+		],
+		[
+			"the variable it was renamed from, SESSION_STORAGE_TYPE=memory",
+			{ ...without(ALL_REDIS_ENV, "SESSION_STORE_STORAGE_TYPE"), SESSION_STORAGE_TYPE: "memory" },
+		],
+	];
+	const MODES: ReadonlyArray<
+		readonly [string, (env: Record<string, string>) => Record<string, string>]
+	> = [
+		["multi", (env) => ({ ...env, CORE_DEPLOYMENT_MODE: "multi" })],
+		["single", (env) => ({ ...env, CORE_DEPLOYMENT_MODE: "single" })],
+		["unset", (env) => without(env, "CORE_DEPLOYMENT_MODE")],
+	];
+
+	/** What a boot of `modules` settles as: the refusal, or the replica-safety warnings it logged. */
+	async function outcomeOf(config: BothPhases, modules: readonly Module[]): Promise<unknown> {
+		const warn = vi.fn();
+		const logger = {
+			warn,
+			info: vi.fn(),
+			error: vi.fn(),
+			debug: vi.fn(),
+			trace: vi.fn(),
+			fatal: vi.fn(),
+			child: vi.fn(),
+		};
+		try {
+			const handle = await createApp({
+				modules: [...modules],
+				bootstrapComponents: { config, logger, pathResolver: (s: string) => s } as never,
+			});
+			await handle.dispose();
+		} catch (err) {
+			const e = err as { reason?: string; message?: string; details?: unknown };
+			return { refused: { reason: e.reason, message: e.message, details: e.details } };
+		}
+		return {
+			warned: warn.mock.calls.filter(([, event]) => event === "replica_unsafe_adapters"),
+		};
+	}
+
+	for (const [storage, env] of STORAGE) {
+		for (const [mode, withMode] of MODES) {
+			it(`${storage} under ${mode}`, async () => {
+				const config = resolveConfig(withMode(env));
+				const modules = modulesFor(config);
+				expect(modules[0]).toBe(sessionStoreModule);
+				const outcome = await outcomeOf(config, modules);
+				if (
+					storage === "SESSION_STORE_STORAGE_TYPE=redis" ||
+					storage === "no SESSION_STORE_STORAGE_TYPE, the reference's default"
+				) {
+					// A shared store: nothing is refused or warned about.
+					expect(outcome).toEqual({ warned: [] });
+				}
+				if (storage === "SESSION_STORE_STORAGE_TYPE=memory") {
+					const named = { modules: ["session-store"] };
+					expect(outcome).toEqual(
+						mode === "multi"
+							? {
+									refused: expect.objectContaining({
+										reason: "replica-unsafe-adapter",
+										message: expect.stringContaining(
+											"session-store: the express-session store forks per replica",
+										),
+										details: expect.objectContaining(named),
+									}),
+								}
+							: {
+									warned:
+										mode === "unset"
+											? [[expect.objectContaining(named), "replica_unsafe_adapters"]]
+											: [],
+								},
+					);
+				}
+				if (storage === "the variable it was renamed from, SESSION_STORAGE_TYPE=memory") {
+					// Refused as renamed before the replica-safety guard reads anything.
+					expect(outcome).toEqual({
+						refused: expect.objectContaining({ reason: "environment-variable-renamed" }),
+					});
+				}
+			});
+		}
+	}
+});
+
+describe('adapters.federationTokenStore = "redis" in the standalone', () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 
 	afterEach(async () => {
@@ -327,13 +434,11 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 		handleRef = undefined;
 	});
 
-	it("reaches the resolved config from FEDERATION_TOKEN_STORE_TYPE", () => {
-		// `AppConfigSchema` strips top-level keys it does not declare; the
-		// switch had to be declared before an env var could select anything.
-		expect(resolveConfig(ALL_REDIS_ENV).federationTokenStore?.type).toBe("redis");
+	it("reaches phase one's adapters from ADAPTERS_FEDERATION_TOKEN_STORE", () => {
+		expect(resolveConfig(ALL_REDIS_ENV).adapters.federationTokenStore).toBe("redis");
 		expect(
-			resolveConfig(without(ALL_REDIS_ENV, "FEDERATION_TOKEN_STORE_TYPE")).federationTokenStore
-				?.type,
+			resolveConfig(without(ALL_REDIS_ENV, "ADAPTERS_FEDERATION_TOKEN_STORE")).adapters
+				.federationTokenStore,
 		).toBe("memory");
 	});
 
@@ -341,8 +446,8 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 		const modules = modulesFor(resolveConfig(ALL_REDIS_ENV));
 		const names = modules.map((m) => m.name);
 		expect(names).toContain("redis-federation-token-store");
-		expect(names).toContain("standalone:redis-clients");
-		expect(names).not.toContain("standalone:in-memory-federation-token-store");
+		expect(names).toContain("redis-clients");
+		expect(names).not.toContain("standalone-in-memory-federation-token-store");
 		// Exactly one provider for the slot: both modules provide it, so
 		// selecting both would be a boot-time slot collision.
 		const providers = modules.filter((m) =>
@@ -355,18 +460,18 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 		// Every other store on memory, single replica: the Redis federation
 		// store still needs `federationTokenStoreClient`, which only the shared
 		// clients module provides. Without this the branch fails stage 1 with
-		// `missing-required-component` — the #439 shape, once more.
+		// `missing-required-component`.
 		const config = resolveConfig({
 			...ALL_REDIS_ENV,
-			DEPLOYMENT_MODE: "single",
-			USER_SESSION_STORES_ADAPTER: "memory",
-			OAUTH_CODE_ADAPTER: "memory",
-			RATE_LIMITER_ADAPTER: "memory",
-			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+			CORE_DEPLOYMENT_MODE: "single",
+			ADAPTERS_USER_SESSION_STORES: "memory",
+			ADAPTERS_CODE_REPOSITORY: "memory",
+			ADAPTERS_RATE_LIMITER: "memory",
+			ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
 		});
 		const names = modulesFor(config).map((m) => m.name);
 		expect(names).toContain("redis-federation-token-store");
-		expect(names).toContain("standalone:redis-clients");
+		expect(names).toContain("redis-clients");
 	});
 
 	it("boots, and the resolved store is the Redis adapter", async () => {
@@ -388,20 +493,20 @@ describe('#456: federationTokenStore.type = "redis" in the standalone', () => {
 		});
 	});
 
-	it("keeps the memory branch as it was: the default, in single mode, resolves the memory adapter", async () => {
+	it("keeps the memory branch: the default, in single mode, resolves the memory adapter", async () => {
 		const config = resolveConfig({
-			...without(ALL_REDIS_ENV, "FEDERATION_TOKEN_STORE_TYPE"),
-			DEPLOYMENT_MODE: "single",
+			...without(ALL_REDIS_ENV, "ADAPTERS_FEDERATION_TOKEN_STORE"),
+			CORE_DEPLOYMENT_MODE: "single",
 		});
 		const names = modulesFor(config).map((m) => m.name);
-		expect(names).toContain("standalone:in-memory-federation-token-store");
+		expect(names).toContain("standalone-in-memory-federation-token-store");
 		expect(names).not.toContain("redis-federation-token-store");
 		handleRef = await boot(config);
 		expect(handleRef.components.federationTokenStore?.kind).toBe("memory");
 	});
 });
 
-describe('#561: consentStore.adapter = "redis" in the standalone', () => {
+describe('consentStore.adapter = "redis" in the standalone', () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 
 	afterEach(async () => {
@@ -428,16 +533,16 @@ describe('#561: consentStore.adapter = "redis" in the standalone', () => {
 	it("pulls the shared clients module in for the consent stores alone", () => {
 		// Every other store on memory, single replica: the consent module still
 		// needs its two client slots, which only the shared clients module
-		// provides — the #439 shape otherwise.
+		// provides.
 		const config = resolveConfig({
 			...ALL_REDIS_ENV,
-			DEPLOYMENT_MODE: "single",
-			USER_SESSION_STORES_ADAPTER: "memory",
-			OAUTH_CODE_ADAPTER: "memory",
-			RATE_LIMITER_ADAPTER: "memory",
-			ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-			REPLAY_SEEN_SET_ADAPTER: "memory",
-			FEDERATION_TOKEN_STORE_TYPE: "memory",
+			CORE_DEPLOYMENT_MODE: "single",
+			ADAPTERS_USER_SESSION_STORES: "memory",
+			ADAPTERS_CODE_REPOSITORY: "memory",
+			ADAPTERS_RATE_LIMITER: "memory",
+			ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+			ADAPTERS_REPLAY_SEEN_SET: "memory",
+			ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
 		});
 		const names = buildModules(config, {
 			keyStoreModule: testKeyStoreModule,
@@ -445,17 +550,17 @@ describe('#561: consentStore.adapter = "redis" in the standalone', () => {
 			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 		}).map((m) => m.name);
 		expect(names).toContain("redis-consent-store");
-		expect(names).toContain("standalone:redis-clients");
+		expect(names).toContain("redis-clients");
 	});
 
-	it("boots under DEPLOYMENT_MODE=multi with both slots resolved to the Redis adapters", async () => {
+	it("boots under CORE_DEPLOYMENT_MODE=multi with both slots resolved to the Redis adapters", async () => {
 		handleRef = await boot(resolveConfig(ALL_REDIS_ENV));
 		expect(handleRef.components.consentStore?.kind).toBe("redis");
 		expect(handleRef.components.pendingConsentStore?.kind).toBe("redis");
 	});
 });
 
-describe("#473: the Redis federation store's plaintext guard, booted from the shipped config", () => {
+describe("the Redis federation store's plaintext guard, booted from the shipped config", () => {
 	let handleRef: Awaited<ReturnType<typeof boot>> | undefined;
 	let warnSpy: ReturnType<typeof vi.spyOn>;
 	let errorSpy: ReturnType<typeof vi.spyOn>;
@@ -486,28 +591,36 @@ describe("#473: the Redis federation store's plaintext guard, booted from the sh
 		REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE: "allow-plaintext",
 	};
 
-	it('is refused under deployment.mode = "multi" in a development environment', async () => {
-		// The umbrella shape with plaintext: refused before #473 only if
-		// NODE_ENV happened to say production. A multi-replica deployment is
-		// never a development box.
-		await expect(boot(resolveConfig(PLAINTEXT_ENV), "development")).rejects.toSatisfy(
-			(err: unknown) => /deployment\.mode is "multi"/.test(messageChain(err)),
+	it('is refused under core.deployment.mode = "multi" in an environment that is not production', async () => {
+		// The umbrella shape with plaintext. A multi-replica deployment is
+		// never a development box. A development configuration under multi is
+		// refused by the development mail sender first, so the environment here
+		// is another name that is not production, with the SMTP sender's section.
+		await expect(
+			boot({ ...resolveConfig(PLAINTEXT_ENV), ...standardSmtpMailSenderConfigForTests() }, "test"),
+		).rejects.toSatisfy((err: unknown) =>
+			/allow-plaintext[\s\S]*core\.deployment\.mode is "multi"/.test(messageChain(err)),
 		);
 		expect(errorSpy).not.toHaveBeenCalled();
 	});
 
 	it("is refused when the config was selected by CONFIG_ENV=production, whatever NODE_ENV says", async () => {
 		// `app.mts` selects `production.conf` by `CONFIG_ENV || NODE_ENV` and
-		// passes that name through `buildModules`; the guard used to read
-		// NODE_ENV alone and would have let this boot.
-		const config = resolveConfig({ ...PLAINTEXT_ENV, DEPLOYMENT_MODE: "single" });
+		// passes that name through `buildModules`; the guard reads that name,
+		// not NODE_ENV alone.
+		// Under production the template installs the SMTP sender's module, whose
+		// section the package's builder carries.
+		const config = {
+			...resolveConfig({ ...PLAINTEXT_ENV, CORE_DEPLOYMENT_MODE: "single" }),
+			...standardSmtpMailSenderConfigForTests(),
+		};
 		await expect(boot(config, "production")).rejects.toSatisfy((err: unknown) =>
-			/the environment is "production"/.test(messageChain(err)),
+			/allow-plaintext[\s\S]*the environment is "production"/.test(messageChain(err)),
 		);
 	});
 
 	it("boots with the plaintext warning in a development environment on a single replica", async () => {
-		const config = resolveConfig({ ...PLAINTEXT_ENV, DEPLOYMENT_MODE: "single" });
+		const config = resolveConfig({ ...PLAINTEXT_ENV, CORE_DEPLOYMENT_MODE: "single" });
 		handleRef = await boot(config, "development");
 		expect(handleRef.components.federationTokenStore?.kind).toBe("redis");
 		expect(warnSpy).toHaveBeenCalledWith(
@@ -518,7 +631,13 @@ describe("#473: the Redis federation store's plaintext guard, booted from the sh
 
 	it("keeps the FEDERATION_TOKENS_ALLOW_INSECURE=1 escape hatch under multi, logged at error", async () => {
 		process.env.FEDERATION_TOKENS_ALLOW_INSECURE = "1";
-		handleRef = await boot(resolveConfig(PLAINTEXT_ENV), "development");
+		// Under multi the development mail sender refuses a development
+		// configuration, so the environment here is another name that is not
+		// production, with the SMTP sender's section its module reads.
+		handleRef = await boot(
+			{ ...resolveConfig(PLAINTEXT_ENV), ...standardSmtpMailSenderConfigForTests() },
+			"test",
+		);
 		expect(errorSpy).toHaveBeenCalledWith(
 			expect.objectContaining({
 				store: "federation-tokens",

package/templates/standalone/src/__tests__/router-error-answers.test.mts

@@ -19,13 +19,10 @@
  * with no terminal handler of the template's after it — the router alone, as
  * a composition root that copies nothing of `app.mts` mounts it.
  *
- * The OAuth and session routers parse their own bodies and have no error
- * handler: a body parser's refusal on `/oauth/token`, `/oauth/introspect` or
- * `/session/login`, and any error a route let through, went on to whatever
- * the host had after the router. Only `app.mts` had a handler there, so any
- * other host answered with Express's final handler — an HTML page, with the
- * stack outside production, where V8's JSON error quotes the body it could
- * not parse. The router core returns now answers them itself.
+ * The router core returns answers a body parser's refusal and any error a
+ * route lets through itself. Left to Express's final handler, a host would
+ * answer with an HTML page carrying the stack outside production, where V8's
+ * JSON error quotes the body it could not parse.
  */
 
 import { defineModule } from "@o3co/auth-provider-core";