@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/scaffold-assets.test.mts

@@ -15,22 +15,23 @@
  */
 
 /**
- * Issue #407 — scaffold hardening from the v0.10.0 release-cut audit.
- *
- * These pin the parts of the scaffold that are checkable from inside the
+ * Pins the parts of the scaffold that are checkable from inside the
  * repository. The scaffold is the artifact an operator actually deploys, and
- * every one of these was invisible until someone read the file: the container
+ * a mistake in it stays invisible until someone reads the file: the container
  * install losing an allowlist, the dev compose dialling a Redis that is not
- * there, and one `git add .` committing the signing key.
+ * there, one `git add .` committing the signing key.
  */
 
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { type AppConfig, AppConfigSchema } from "@o3co/auth-provider-core";
+import { BootError } from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import { describe, expect, it } from "vitest";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
+import { readAdapters } from "../adapters.mjs";
+import { buildModules } from "../buildModules.mjs";
+import { readOwnLayers, readSwitches, resolveConfigPaths } from "../configPath.mjs";
+import { templateReference } from "../modules.mjs";
+import { type Adapters, repositoriesSectionSchema } from "../sections.mjs";
 
 const standaloneDir = fileURLToPath(new URL("../..", import.meta.url));
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
@@ -38,17 +39,11 @@ const read = (rel: string): string => readFileSync(`${standaloneDir}${rel}`, "ut
 
 /**
  * The `environment:` entries of a compose file's `app` service, as the
- * environment the container would actually see.
- *
- * A hand-rolled reader rather than a YAML dependency: these two files are
- * fixed-shape artifacts in this repository, the block is flat `KEY: value`
- * scalars, and adding a parser to the template's dependency tree to read its
- * own scaffold would be a strange thing to ship to operators.
- *
- * Compose's `${VAR:?err}` required-variable form resolves from the operator's
- * shell or `.env`, so there is no literal value to record — the key is mapped
- * to `null`, which is the point of that form and what the assertions below
- * check for.
+ * environment the container would actually see. Hand-rolled rather than a
+ * YAML dependency: both files are fixed-shape, the block is flat `KEY: value`
+ * scalars, and the template should not ship a parser to read its own
+ * scaffold. Compose's `${VAR:?err}` required-variable form resolves from the
+ * operator's shell or `.env`, so its key is mapped to `null`.
  */
 function composeAppEnvironment(rel: string): Map<string, string | null> {
 	const lines = read(rel).split("\n");
@@ -67,51 +62,61 @@ function composeAppEnvironment(rel: string): Map<string, string | null> {
 	return env;
 }
 
-/** Resolve the shipped config layers under a given environment, as `src/app.mts` does. */
-function resolveWith(env: Record<string, string>, configEnv = "production"): AppConfig {
+/** The template's own layers under `env`, over its own reference, unparsed. */
+function ownResolved(
+	env: Record<string, string>,
+	configEnv = "production",
+): Record<string, unknown> {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
-	return validate(
-		parseFile(envConfPath, { env })
-			.withFallback(parseFile(applicationConfPath, { env }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
-		AppConfigSchema,
-	);
+	return parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.toObject() as Record<string, unknown>;
+}
+
+/** `session-store.storage.type` as the template's own layers resolve it under `env`. */
+function sessionStorageTypeWith(env: Record<string, string>): unknown {
+	const section = ownResolved(env)["session-store"] as
+		| { readonly storage?: { readonly type?: unknown } }
+		| undefined;
+	return section?.storage?.type;
+}
+
+/** The adapters phase one reads under `env`. */
+function adaptersWith(env: Record<string, string>, configEnv = "production"): Adapters {
+	return readAdapters(ownResolved(env, configEnv), env);
 }
 
 /**
  * A compose file's `environment:` block, plus the secrets no compose file
  * carries (they come from `.env` or a compose secret) — the environment the
- * process would boot under.
- *
- * The key material follows what the file itself says: the production compose
- * points the EdDSA key paths at its mounted secrets, so leave the default
- * algorithm alone; the dev compose supplies no key at all, so give it the
- * HS256 shape, whose `.strict()` union member is exactly why the two cannot
- * share one map.
+ * process would boot under. The production compose points the EdDSA key
+ * paths at its mounted secrets, so the default algorithm stays; the dev
+ * compose supplies no key, so it gets the HS256 shape, whose `.strict()`
+ * union member is why the two cannot share one map.
  */
 function bootableEnv(rel: string): Record<string, string> {
 	const env: Record<string, string> = {
 		OAUTH_JWT_ISSUER: "https://auth.test",
-		SESSION_SECRET: "scaffold-assets-compose-session.at-least-32-bytes.ok",
+		SESSION_STORE_SECRET: "scaffold-assets-compose-session.at-least-32-bytes.ok",
 	};
 	for (const [key, value] of composeAppEnvironment(rel)) {
 		if (value !== null) env[key] = value;
 	}
-	if (env.OAUTH_JWT_PRIVATE_KEY_PATH === undefined) {
-		env.OAUTH_JWT_ALGORITHM = "HS256";
-		env.OAUTH_JWT_SECRET = "scaffold-assets-compose.at-least-32-bytes.ok";
+	if (env.KEY_STORE_LOCAL_PRIVATE_KEY_PATH === undefined) {
+		env.KEY_STORE_LOCAL_ALGORITHM = "HS256";
+		env.KEY_STORE_LOCAL_SECRET = "scaffold-assets-compose.at-least-32-bytes.ok";
 	}
 	return env;
 }
 
-describe("#407 — the Dockerfile installs with everything pnpm needs", () => {
+describe("the Dockerfile installs with everything pnpm needs", () => {
 	it("copies pnpm-workspace.yaml into the deps stage", () => {
 		// `create-auth-provider` generates it to carry the bcrypt
 		// `onlyBuiltDependencies` allowlist, because pnpm >= 10.29 reads that
-		// setting ONLY from this file — in single-package projects too (#360).
-		// A deps stage that copies `package.json` and the lockfile but not this
-		// runs allowlist-less, which re-creates #360 the day an alpine prebuild
-		// is missing and bcrypt has to compile.
+		// setting ONLY from this file — in single-package projects too. A deps
+		// stage without it runs allowlist-less, which leaves bcrypt unbuilt the
+		// day an alpine prebuild is missing and it has to compile.
 		const dockerfile = read("/Dockerfile");
 		const depsStage = dockerfile.slice(
 			dockerfile.indexOf("FROM node-base AS deps"),
@@ -119,8 +124,7 @@ describe("#407 — the Dockerfile installs with everything pnpm needs", () => {
 		);
 		// Matched as a COPY instruction, not as a substring of the stage: the
 		// comment above that COPY names the file too, so a substring check
-		// would keep passing if the instruction regressed and the comment
-		// stayed — which is the failure this test exists to catch.
+		// would keep passing without the instruction.
 		const copyLines = depsStage
 			.split("\n")
 			.filter((line) => /^COPY\b/.test(line.trim()) && !line.trim().startsWith("#"));
@@ -128,13 +132,19 @@ describe("#407 — the Dockerfile installs with everything pnpm needs", () => {
 	});
 });
 
-describe("#407 — the dev compose can reach every Redis it configures", () => {
+describe("the dev compose can reach every Redis it configures", () => {
 	it("sets every *_REDIS_URL the template config reads", () => {
-		// The template's application.conf substitutes several Redis URLs, each
-		// defaulting to `redis://localhost:6379` — which inside the container is
-		// the container itself. `.env.example` is what the compose file loads,
-		// so a URL missing from it is a boot that dials nothing.
-		const conf = read("/config/application.conf");
+		// The template's application.conf and its own reference.conf substitute
+		// several Redis URLs, each defaulting to `redis://localhost:6379` —
+		// which inside the container is the container itself. `.env.example` is
+		// what the compose file loads, so a URL missing from it is a boot that
+		// dials nothing.
+		// The captures of renamed variables (`renamed-variables { … }`) read an
+		// old name only to refuse it, and dial nothing.
+		const conf = (read("/config/application.conf") + read("/config/reference.conf")).replace(
+			/^renamed-variables \{[\s\S]*?^\}/m,
+			"",
+		);
 		const declared = [...conf.matchAll(/\$\{\?([A-Z0-9_]*REDIS_URL)\}/g)].map((m) => m[1]);
 		expect(declared.length).toBeGreaterThan(0);
 
@@ -146,7 +156,7 @@ describe("#407 — the dev compose can reach every Redis it configures", () => {
 	});
 });
 
-describe("#407 — the scaffold does not invite committing its own secrets", () => {
+describe("the scaffold does not invite committing its own secrets", () => {
 	it("ships a .gitignore", () => {
 		// Without one, the first `git add .` in a scaffolded project commits
 		// `.env` and `jwt-private.pem` — both of which the README tells the
@@ -168,7 +178,7 @@ describe("#407 — the scaffold does not invite committing its own secrets", ()
 	});
 });
 
-describe("#407 — the production compose matches the topology it documents", () => {
+describe("the production compose matches the topology it documents", () => {
 	it("does not publish the app port on every interface", () => {
 		// The README says to keep `/metrics` off the public listener and the
 		// file assumes TLS is terminated in front, so a bare "3000:3000"
@@ -179,38 +189,193 @@ describe("#407 — the production compose matches the topology it documents", ()
 	});
 });
 
+/**
+ * What `.gitignore` keeps out of git (secrets and per-machine configuration,
+ * the client registry among them) stays out of the build context too: the
+ * `Dockerfile` copies `config/`, so a `config/clients.yaml` in the working
+ * copy, client secrets included, would be baked into the runtime image.
+ * Production is given the registry from outside the image instead.
+ */
+describe("what .gitignore keeps out of git stays out of the image, and production is given it", () => {
+	/**
+	 * `.gitignore`'s "Secrets and per-machine configuration" section: each
+	 * pattern, with files it matches. A pattern without a `/` matches at any
+	 * depth in `.gitignore`, so those carry a nested file too — `.dockerignore`
+	 * anchors every pattern at the context root, where `*` stops at a `/`.
+	 */
+	const PER_DEPLOYMENT: Readonly<Record<string, readonly string[]>> = {
+		".env": [".env", "config/.env"],
+		".env.*": [".env.local", ".env.production", "config/.env.production"],
+		"*.pem": ["jwt-private.pem", "config/jwt-private.pem"],
+		"*.key": ["tls.key", "config/tls.key"],
+		"config/clients.yaml": ["config/clients.yaml"],
+		"config/*.local.conf": ["config/production.local.conf"],
+	};
+
+	/**
+	 * The committed files beside them, which the image does need. `.env.example`
+	 * is what `.gitignore` re-includes, at any depth: the same here.
+	 */
+	const COMMITTED = [
+		".env.example",
+		"config/.env.example",
+		"config/application.conf",
+		"config/development.conf",
+		"config/production.conf",
+		"config/mailpit.conf",
+		"config/clients.yaml.example",
+	] as const;
+
+	it("checks every pattern of .gitignore's secrets section", () => {
+		const lines = read("/.gitignore").split("\n");
+		const start = lines.indexOf("# Secrets and per-machine configuration");
+		expect(start).not.toBe(-1);
+		const section: string[] = [];
+		for (const line of lines.slice(start + 1)) {
+			if (line.trim() === "") break;
+			if (!line.startsWith("#") && !line.startsWith("!")) section.push(line.trim());
+		}
+		expect(section).toEqual(Object.keys(PER_DEPLOYMENT));
+	});
+
+	it.each(Object.entries(PER_DEPLOYMENT))(
+		"keeps what %s matches out of the build context",
+		(_, files) => {
+			const dockerignore = read("/.dockerignore");
+			for (const file of files) {
+				expect(dockerignoreExcludes(dockerignore, file), `${file} reaches the build context`).toBe(
+					true,
+				);
+			}
+		},
+	);
+
+	it("lets the committed configuration through", () => {
+		const dockerignore = read("/.dockerignore");
+		for (const file of COMMITTED) {
+			expect(dockerignoreExcludes(dockerignore, file), `${file} is excluded`).toBe(false);
+		}
+	});
+
+	it("gives the production compose's process the client registry, read-only, from outside the image", () => {
+		// A compose secret, like the key pair: mounted read-only under
+		// /run/secrets, never part of a layer.
+		const name = "client_registry";
+		expect(composeAppSecrets("/docker-compose.production.yml")).toContain(name);
+		expect(composeSecretFiles("/docker-compose.production.yml").get(name)).toBe(
+			"./config/clients.yaml",
+		);
+		// And the process reads it there, through the real config layers.
+		const env = bootableEnv("/docker-compose.production.yml");
+		expect(adaptersWith(env).clientRepository).toBe("yaml");
+		expect(repositoriesSectionSchema.parse(ownResolved(env).repositories).client.yaml.path).toBe(
+			`/run/secrets/${name}`,
+		);
+	});
+});
+
+/** The secrets a compose file's `app` service mounts. */
+function composeAppSecrets(rel: string): string[] {
+	const lines = read(rel).split("\n");
+	const start = lines.findIndex((line) => /^\s{4}secrets:\s*$/.test(line));
+	const names: string[] = [];
+	if (start === -1) return names;
+	for (const line of lines.slice(start + 1)) {
+		if (line.trim() === "" || /^\s*#/.test(line)) continue;
+		const match = /^\s{6}-\s*(\S+)\s*$/.exec(line);
+		if (!match) break;
+		names.push(match[1] as string);
+	}
+	return names;
+}
+
+/** A compose file's top-level `secrets:`, as each name's `file:`. */
+function composeSecretFiles(rel: string): Map<string, string> {
+	const lines = read(rel).split("\n");
+	const start = lines.findIndex((line) => /^secrets:\s*$/.test(line));
+	const files = new Map<string, string>();
+	if (start === -1) return files;
+	let name: string | undefined;
+	for (const line of lines.slice(start + 1)) {
+		if (line.trim() === "" || /^\s*#/.test(line)) continue;
+		if (!/^\s/.test(line)) break;
+		const entry = /^\s{2}([A-Za-z0-9_-]+):\s*$/.exec(line);
+		if (entry) {
+			name = entry[1];
+			continue;
+		}
+		const file = /^\s{4}file:\s*(\S+)\s*$/.exec(line);
+		if (file && name !== undefined) files.set(name, file[1] as string);
+	}
+	return files;
+}
+
 describe("the compose files put a store and its lifetime-sibling on the same backend", () => {
-	// The production compose set `SESSION_STORAGE_TYPE: redis` and left
-	// `USER_SESSION_STORES_ADAPTER` at its `memory` default. express-session
-	// then survives a restart and the `UserSession` it points at does not, so
-	// every browser comes back `isAuthenticated` with nothing behind it and
-	// /authorize loops until the cookie is deleted by hand.
-	//
-	// `DEPLOYMENT_MODE: single` is silent about this on purpose — the replica
+	// With express-session on Redis and the user-session stores on memory,
+	// express-session survives a restart and the `UserSession` it points at
+	// does not: every browser comes back `isAuthenticated` with nothing behind
+	// it and /authorize loops until the cookie is deleted by hand.
+	// `CORE_DEPLOYMENT_MODE: single` is silent about this on purpose — the replica
 	// guard answers "can these stores be shared", not "do these two stores have
 	// the same lifetime" — so nothing but this assertion stands behind it.
 	for (const file of ["/docker-compose.production.yml", "/docker-compose.yml"]) {
 		it(`${file} keeps the user-session stores with the express-session store`, () => {
-			const config = resolveWith(bootableEnv(file));
+			const env = bootableEnv(file);
 			// Resolved through the real config layers, not read off the file:
 			// what matters is the value the process ends up with, whether the
 			// compose stated it or `config/application.conf` did.
-			expect(config.session.storage?.type).toBe("redis");
-			expect(config.userSessionStores?.adapter).toBe("redis");
+			expect(sessionStorageTypeWith(env)).toBe("redis");
+			expect(adaptersWith(env).userSessionStores).toBe("redis");
 		});
 	}
 
 	it("the production compose leaves no store on memory while a sibling is on Redis", () => {
-		const config = resolveWith(bootableEnv("/docker-compose.production.yml"));
+		const env = bootableEnv("/docker-compose.production.yml");
 		// Every store whose records must outlive one process. The federation
 		// token store is deliberately absent: this template ships every
 		// federation disabled, so nothing writes to it, and turning it on needs
 		// an AES key the compose file must not invent.
-		expect(config.session.storage?.type).toBe("redis");
-		expect(config.userSessionStores?.adapter).toBe("redis");
-		expect(config.oauth.code?.adapter).toBe("redis");
-		expect(config.accessTokenDenylist?.adapter).toBe("redis");
-		expect(config.rateLimiter?.adapter).toBe("redis");
+		expect(sessionStorageTypeWith(env)).toBe("redis");
+		expect(adaptersWith(env)).toMatchObject({
+			userSessionStores: "redis",
+			codeRepository: "redis",
+			accessTokenDenylist: "redis",
+			rateLimiter: "redis",
+		});
+	});
+});
+
+/** `.env.example`'s uncommented lines that carry a value: what a `.env` copied from it sets. */
+function dotenvExample(): Record<string, string> {
+	const env: Record<string, string> = {};
+	for (const line of read("/.env.example").split("\n")) {
+		const match = /^([A-Z][A-Z0-9_]*)=(.+)$/.exec(line);
+		if (match) env[match[1] as string] = match[2] as string;
+	}
+	return env;
+}
+
+describe("the production compose leaves MFA on, for the deployment to decide", () => {
+	it("reads the switch as required, so a deployment that sets nothing about MFA is refused naming MFA_MODE=off", () => {
+		// `environment:` wins over `env_file`, so the compose file's block is
+		// laid over the `.env` copied from `.env.example`.
+		const env = { ...dotenvExample(), ...bootableEnv("/docker-compose.production.yml") };
+		// `app.mts`: CONFIG_ENV, then NODE_ENV, then development.
+		const configEnv = env.CONFIG_ENV || env.NODE_ENV || "development";
+		expect(configEnv).toBe("production");
+		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
+		const switches = readSwitches(readOwnLayers([envConfPath, applicationConfPath], { env }));
+		expect(switches.mfaMode).toBe("required");
+
+		let err: unknown;
+		try {
+			buildModules(switches, { environment: configEnv });
+		} catch (caught) {
+			err = caught;
+		}
+		expect(err).toBeInstanceOf(BootError);
+		expect((err as BootError).reason).toBe("config-validation-failed");
+		expect((err as BootError).message).toContain("MFA_MODE=off");
 	});
 });
 
@@ -235,31 +400,25 @@ describe("the production compose refuses to guess HTTP_TRUST_PROXY", () => {
 	});
 });
 
-describe("#407 — the two READMEs agree on security advice", () => {
+describe("the READMEs' security advice", () => {
 	it("does not recommend HTTP_TRUST_PROXY=true in the Japanese README", () => {
-		// #292 made `trust proxy` a CIDR/hop policy precisely because `true`
-		// means "believe the leftmost forwarded entry from whoever opened the
-		// connection". The English README warns against it; the Japanese one
-		// still recommended it, so the two disagreed on which is safe.
+		// `trust proxy` is a CIDR/hop policy because `true` means "believe the
+		// leftmost forwarded entry from whoever opened the connection". The
+		// English README warns against it, and the Japanese one must agree.
 		expect(read("/README.ja.md")).not.toMatch(/HTTP_TRUST_PROXY=true/);
 	});
 });
 
 /**
- * Issue #512 — the suite that ships with a scaffolded project has to be green
- * in that project, not only in this workspace.
- *
- * A scaffold installs `@o3co/auth-provider-*` from npm, where the packages sit
- * under `node_modules` and vitest externalizes them: Node loads them natively
- * and their own `import "ioredis"` / `import "redis"` never meet the
- * `vi.mock` registry. In this workspace the same packages are symlinks to
- * source outside `node_modules`, vitest inlines them, and the mocks apply —
- * which is how replica-safety.test.mts stayed green here while dialling
- * `redis.test` for real in every scaffold. The second half is `make test`:
- * it runs this suite inside the `test` image, where a file the Dockerfile
- * never copied simply does not exist.
+ * The suite that ships with a scaffolded project has to be green in that
+ * project, not only in this workspace. A scaffold installs
+ * `@o3co/auth-provider-*` from npm, under `node_modules`, where vitest
+ * externalizes them and their own `import "ioredis"` / `import "redis"` never
+ * meet the `vi.mock` registry unless inlined; here they are symlinks vitest
+ * inlines anyway. And `make test` runs this suite inside the `test` image,
+ * where a file the Dockerfile never copied does not exist.
  */
-describe("#512 — the shipped suite is green outside this repository", () => {
+describe("the shipped suite carries what it needs to run outside this repository", () => {
 	it("runs the published packages through vitest, so module mocks reach them", async () => {
 		// The config is loaded, not grepped: what matters is the value vitest
 		// resolves, and a `server.deps.inline` naming the wrong package would
@@ -300,6 +459,7 @@ describe("#512 — the shipped suite is green outside this repository", () => {
 		"README.ja.md",
 		"docker-compose.yml",
 		"docker-compose.production.yml",
+		"docker-compose.mailpit.yml",
 	] as const;
 
 	it("reads only files the template actually ships", () => {
@@ -325,7 +485,7 @@ describe("#512 — the shipped suite is green outside this repository", () => {
 		}
 	});
 
-	it("ships every setup file vitest.config.mts loads, into the `test` image as well (#556)", async () => {
+	it("ships every setup file vitest.config.mts loads, into the `test` image as well", async () => {
 		// vitest refuses to start when a `setupFiles` entry is missing, so a setup
 		// file the image never copied fails the whole of `make test`, not one test.
 		const configPath = fileURLToPath(new URL("../../vitest.config.mts", import.meta.url));
@@ -333,7 +493,7 @@ describe("#512 — the shipped suite is green outside this repository", () => {
 			default: { test?: { setupFiles?: string | readonly string[] } };
 		};
 		const setupFiles = [config.test?.setupFiles ?? []].flat();
-		expect(setupFiles, "the #556 supertest loopback guard is not wired in").not.toHaveLength(0);
+		expect(setupFiles, "the supertest loopback guard is not wired in").not.toHaveLength(0);
 
 		const copied = copiedIntoStage(read("/Dockerfile"), "test");
 		const dockerignore = read("/.dockerignore");
@@ -389,31 +549,46 @@ function copiedIntoStage(dockerfile: string, stage: string): Set<string> {
 }
 
 /**
- * Whether `.dockerignore` keeps a root-level entry out of the build context.
- * The last matching pattern wins and a leading `!` re-includes; `*` and `?`
- * stop at a `/` while `**` does not — the subset of Docker's matching that
- * root-level file names exercise.
+ * Whether `.dockerignore` keeps a file out of the build context, as Docker
+ * decides it (moby's patternmatcher): patterns are anchored at the context
+ * root, the last matching one wins and a leading `!` re-includes; `*` and `?`
+ * stop at a `/`, `**` does not, and `**` followed by `/` also matches no
+ * directory at all; a pattern that matches one of the file's parent
+ * directories matches the file.
  */
 function dockerignoreExcludes(dockerignore: string, file: string): boolean {
+	const parents = file.split("/").slice(0, -1);
+	const candidates = [file, ...parents.map((_, i) => parents.slice(0, i + 1).join("/"))];
 	let excluded = false;
 	for (const raw of dockerignore.split("\n")) {
 		const line = raw.trim();
 		if (line === "" || line.startsWith("#")) continue;
 		const negated = line.startsWith("!");
-		const pattern = negated ? line.slice(1) : line;
-		// `**` is split out first so the single-`*` rewrite cannot see it.
-		const segment = (s: string): string =>
-			s
-				.replace(/[.+^${}()|[\]\\]/g, "\\$&")
-				.replace(/\*/g, "[^/]*")
-				.replace(/\?/g, "[^/]");
-		const regex = new RegExp(`^${pattern.split("**").map(segment).join(".*")}$`);
-		if (regex.test(file)) excluded = !negated;
+		// Cleaned as Docker cleans a pattern (`filepath.Clean`): a leading `/`
+		// or `./` and a trailing `/` say nothing about what it matches.
+		const pattern = (negated ? line.slice(1) : line).replace(/^(\.?\/)+/, "").replace(/\/+$/, "");
+		let source = "";
+		for (let i = 0; i < pattern.length; ) {
+			if (pattern.startsWith("**/", i)) {
+				source += "(?:.*/)?";
+				i += 3;
+			} else if (pattern.startsWith("**", i)) {
+				source += ".*";
+				i += 2;
+			} else {
+				const char = pattern[i] as string;
+				source +=
+					char === "*" ? "[^/]*" : char === "?" ? "[^/]" : char.replace(/[.+^${}()|[\]\\]/, "\\$&");
+				i += 1;
+			}
+		}
+		const regex = new RegExp(`^${source}$`);
+		if (candidates.some((candidate) => regex.test(candidate))) excluded = !negated;
 	}
 	return excluded;
 }
 
-describe("#593 slice 7 — the compose files give the process time to finish a shutdown", () => {
+describe("the compose files give the process time to finish a shutdown", () => {
 	it.each(["/docker-compose.yml", "/docker-compose.production.yml"])(
 		"%s declares a stop_grace_period covering the HTTP drain, the grants cleanup and an exit margin",
 		(rel) => {