@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/session-logout-invalidates-token.test.mts

@@ -18,22 +18,16 @@
  * `POST /session/logout` must invalidate the token the `session` grant minted
  * from the same browser session.
  *
- * This lives here rather than in `packages/session` or `packages/oauth`
- * because it is the one assertion neither package can make alone: the logout
- * endpoint is in `@o3co/auth-provider-session`, the introspection and userinfo
- * endpoints are in `@o3co/auth-provider-oauth`, and the two are siblings that
- * may not import each other. The standalone template is the composition root
- * where both are mounted on one app, so it is where the contract between them
- * is testable.
+ * Neither package can assert this alone: the logout endpoint is in
+ * `@o3co/auth-provider-session`, introspection and userinfo are in
+ * `@o3co/auth-provider-oauth`, and the two are siblings that may not import
+ * each other. This template is the composition root that mounts both.
  *
- * What it pins: #506 stamped `sid` on the `session` grant's access token and
- * gave `/oauth/introspect` the session-liveness check `/oauth/userinfo`
- * already ran. Both resolve the `UserSession` record — which `/session/logout`
- * used to leave alive, because it destroyed the cookie and nothing else. So in
- * the BFF / `auth.proxy` injection topology, whose logout IS this endpoint, an
- * access token minted from the session kept introspecting `active: true` and
- * kept answering at `/userinfo` for its full lifetime after the user logged
- * out. Only `/oauth/logout` with an `id_token_hint` was ever closed by #506.
+ * The `session` grant stamps `sid` on its access token, and `/oauth/introspect`
+ * and `/oauth/userinfo` both check that the `UserSession` it names is alive.
+ * In the BFF / `auth.proxy` injection topology, whose logout IS this endpoint,
+ * a logout that destroyed only the cookie would leave the token live at both
+ * for its full lifetime.
  */
 
 import { generateKeyPairSync } from "node:crypto";
@@ -48,10 +42,13 @@ import {
 	memoryRefreshTokenFamilyStoreModule,
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
+import { coreConfigForTests } from "@o3co/auth-provider-core/testing";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
+import type { Switches } from "../configPath.mjs";
+import { capturedRenames, inProcessAdapters } from "./library-references.fixture.mjs";
 
 const keyPair = generateKeyPairSync("ed25519", {
 	publicKeyEncoding: { type: "spki", format: "pem" },
@@ -64,36 +61,48 @@ const BASIC = `Basic ${Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("ba
 const USERNAME = "alice";
 const PASSWORD = "correct-horse-battery-staple";
 
-const config: AppConfig = {
-	http: { port: 0, trustProxy: false, readinessTimeoutMs: 1000 },
+/** The `http` module's section, as the hand-built configuration below carries it. */
+const HTTP = {
+	port: 0,
+	trustProxy: false,
+	readinessTimeoutMs: 1000,
+	cors: { allowedOrigins: [] as string[] },
+};
+
+/** The template modules' sections sit beside core's, so the configuration is wider than `AppConfig`. */
+const config: AppConfig & Record<string, unknown> = {
+	// What a resolution under an environment that sets none captures of
+	// core's renamed variables.
+	...{
+		"renamed-variables": capturedRenames({}),
+	},
+	http: HTTP,
 	logging: { level: "silent" },
+	"key-store": {
+		provider: "local",
+		local: {
+			algorithm: "EdDSA",
+			kid: "v0",
+			privateKey: keyPair.privateKey,
+			publicKey: keyPair.publicKey,
+			previousKeys: [],
+		},
+	},
+	// The session requirements this composition expects, as the shipped
+	// `application.conf` does (ADR 2026-09-28-session-admission): none.
+	...coreConfigForTests({ federations: { google: { enabled: false, type: "google" } } }),
 	oauth: {
 		jwt: {
 			issuer: "https://auth.test",
-			signingKey: {
-				provider: "local",
-				local: {
-					algorithm: "EdDSA",
-					kid: "v0",
-					privateKey: keyPair.privateKey,
-					publicKey: keyPair.publicKey,
-					previousKeys: [],
-				},
-			},
-		},
-		accessToken: { expiresIn: 3600 },
-		refreshToken: {
-			expiresIn: 86400,
-			unknownFamilyPolicy: "reject" as const,
-			legacyRtPolicy: "reject" as const,
 		},
-		// The grant this whole test is about: it mints straight from an
-		// authenticated browser session, which is the BFF topology.
-		grants: { session: { enabled: true } },
+		accessToken: { defaultExpiresIn: 3600 },
+		refreshToken: { expiresIn: 86400 },
 		oidcMode: "oidc-required",
-		code: { adapter: "memory" as const },
 	},
-	session: {
+	// The grant this whole test is about: it mints straight from an
+	// authenticated browser session, which is the BFF topology.
+	"oauth-session": { enabled: true },
+	"session-store": {
 		secret: "test-session-secret.at-least-32-bytes.ok",
 		name: "auth.sid",
 		maxAge: 3600000,
@@ -102,20 +111,21 @@ const config: AppConfig = {
 		domain: null,
 		storage: { type: "memory", redis: { url: "redis://localhost:6379" } },
 	},
-	rateLimit: {
-		login: { windowMs: 60000, limit: 100 },
-		failMode: "open",
-	},
-	federations: { google: { enabled: false } },
-	repositories: {
-		client: { type: "yaml", path: "./config/clients.yaml" },
-		user: { type: "yaml", path: "./config/users.yaml", timeout: 5000 },
-		code: { type: "memory", defaultExpiresIn: 600 },
+	session: {
+		loginPage: { url: "/login" },
+		rateLimit: { login: { windowMs: 60000, limit: 100 } },
 	},
-	endpoints: { login: { url: "/login" } },
-	cors: { allowedOrigins: [] },
+	rateLimit: { failMode: "open" },
+	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
 } as unknown as AppConfig;
 
+/** What phase one hands `buildModules`: the configuration, and every store in process. */
+const switches = {
+	...config,
+	adapters: inProcessAdapters(),
+	mfaMode: "off",
+} as unknown as Switches;
+
 const testRepositoriesModule = defineModule({
 	name: "test:repositories",
 	provides: {
@@ -154,7 +164,7 @@ const testKeyStoreModule = defineModule({
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 			});
 		},
 	},
@@ -170,7 +180,7 @@ describe("POST /session/logout invalidates the session grant's access token", ()
 
 	async function buildApp() {
 		const handle = await createApp({
-			modules: buildModules(config, {
+			modules: buildModules(switches, {
 				keyStoreModule: testKeyStoreModule,
 				repositoriesModule: testRepositoriesModule,
 				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
@@ -183,7 +193,7 @@ describe("POST /session/logout invalidates the session grant's access token", ()
 		app.use(
 			createReadinessRouter(express, {
 				probes: handle.readinessProbes,
-				timeoutMs: config.http.readinessTimeoutMs,
+				timeoutMs: HTTP.readinessTimeoutMs,
 			}),
 		);
 		app.use(handle.router);
@@ -212,12 +222,10 @@ describe("POST /session/logout invalidates the session grant's access token", ()
 		expect(loginRes.status).toBe(200);
 
 		const loginCookies = loginRes.headers["set-cookie"] as unknown as string[];
-		// The session cookie comes from the login response, and so does a FRESH
-		// CSRF cookie — the login handler reissues one on the regenerated
-		// session so the follow-up logout needs no second round trip. The
-		// mechanism is a signed double-submit, so the cookie's value IS the
-		// token the header has to echo; the pre-login token no longer matches.
-		const csrfCookiePrefix = `${config.session.name}.csrf=`;
+		// The mechanism is a signed double-submit, so the reissued cookie's
+		// value IS the token the header has to echo; the pre-login token no
+		// longer matches.
+		const csrfCookiePrefix = `${(config["session-store"] as { name: string }).name}.csrf=`;
 		const reissued = loginCookies
 			.find((c) => c.startsWith(csrfCookiePrefix))
 			?.slice(csrfCookiePrefix.length)
@@ -268,9 +276,9 @@ describe("POST /session/logout invalidates the session grant's access token", ()
 		expect(logoutRes.status).toBe(200);
 		expect(logoutRes.body).toMatchObject({ message: "Logged out successfully" });
 
-		// After it, the same token no longer authorizes anything. This is the
-		// assertion that failed before the fix: the `UserSession` record the
-		// liveness checks resolve outlived the logout.
+		// After it, the same token no longer authorizes anything: the
+		// `UserSession` record the liveness checks resolve does not outlive
+		// the logout.
 		const afterIntrospect = await request(app)
 			.post("/oauth/introspect")
 			.set("Authorization", BASIC)

package/templates/standalone/src/__tests__/session-logout-lifecycle.test.mts

@@ -0,0 +1,130 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template with core's session lifecycle module: `POST /session/logout`
+ * closes the session through it, so the browser's own logout revokes the
+ * session's refresh-token families and tells its relying parties, as
+ * `/oauth/logout` does.
+ */
+
+import {
+	type RefreshTokenFamilyRevocation,
+	readVersionedSessionLifecycle,
+	type SessionLifecycle,
+	type SessionLifecycleStore,
+	type UserSessionStore,
+} from "@o3co/auth-provider-core";
+import request from "supertest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { authorize, codeFrom, compose, login, redeem } from "./all-modules-composition.fixture.mjs";
+
+afterEach(() => {
+	vi.restoreAllMocks();
+});
+
+/** A JWT's claims, unverified. */
+const claimsOf = (token: string): Record<string, unknown> =>
+	JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+
+/** The CSRF token a login reissued, read off its double-submit cookie. */
+const csrfTokenOf = (cookies: readonly string[]): string => {
+	const cookie = cookies.find((c) => /^[^=]*\.csrf=/.test(c));
+	if (cookie === undefined) throw new Error("the login reissued no CSRF cookie");
+	return decodeURIComponent(cookie.slice(cookie.indexOf("=") + 1).split(";")[0] ?? "");
+};
+
+describe("POST /session/logout with the session lifecycle module", () => {
+	it("revokes the session's families, tells its relying parties and closes its record", async () => {
+		const { app, handle } = await compose({
+			extraClients: {
+				"rp-bc": {
+					tokenEndpointAuthMethod: "client_secret_basic",
+					clientSecret: "rp-bc-secret-long-enough",
+					allowedRedirectUris: ["https://rp-bc.test/cb"],
+					allowedScopes: ["openid"],
+					allowedGrantTypes: ["authorization_code"],
+					backchannelLogoutUri: "https://rp-bc.test/logout",
+				},
+			},
+		});
+		try {
+			const components = handle.components as Record<string, unknown>;
+			const lifecycle = components.sessionLifecycle as SessionLifecycle;
+			const sessions = components.userSessionStore as UserSessionStore;
+			const families = components.refreshTokenFamilyRevocation as RefreshTokenFamilyRevocation;
+			const { cookies } = await login(app);
+			const exchanged = await redeem(app, codeFrom(await authorize(app, cookies)));
+			expect(exchanged.status).toBe(200);
+			const claims = claimsOf(exchanged.body.refresh_token as string);
+			const sid = String(claims.sid);
+			const familyId = String(claims.family_id);
+			expect(
+				await lifecycle.join(sid, {
+					rp: {
+						clientId: "rp-bc",
+						backchannelLogoutUri: "https://rp-bc.test/logout",
+						backchannelLogoutSessionRequired: true,
+						frontchannelLogoutUri: undefined,
+						frontchannelLogoutSessionRequired: undefined,
+						registeredAt: new Date(),
+					},
+				}),
+			).toEqual({ outcome: "joined" });
+			const posted = vi
+				.spyOn(globalThis, "fetch")
+				.mockImplementation(async () => new Response(null, { status: 200 }));
+
+			const csrfToken = csrfTokenOf(cookies);
+			const res = await request(app)
+				.post("/session/logout")
+				.set("Cookie", cookies)
+				.set("x-csrf-token", csrfToken);
+
+			expect(res.status).toBe(200);
+			expect(await families.isFamilyRevoked(familyId)).toBe(true);
+			expect(posted.mock.calls.map(([url]) => String(url))).toEqual(["https://rp-bc.test/logout"]);
+			expect(await sessions.get(sid)).toBeNull();
+			const store = components.sessionLifecycleStore as SessionLifecycleStore;
+			expect(readVersionedSessionLifecycle(await store.read(sid))?.value.state).toBe("closed");
+		} finally {
+			await handle.dispose();
+		}
+	});
+
+	it("answers 503 when the close cannot commit, and the cookie still admits the session for a retry", async () => {
+		const { app, handle } = await compose();
+		try {
+			const { cookies } = await login(app);
+			const components = handle.components as Record<string, unknown>;
+			const store = components.sessionLifecycleStore as SessionLifecycleStore;
+			vi.spyOn(store, "beginClose").mockRejectedValue(new Error("lifecycle store down"));
+
+			const res = await request(app)
+				.post("/session/logout")
+				.set("Cookie", cookies)
+				.set("x-csrf-token", csrfTokenOf(cookies));
+
+			expect(res.status).toBe(503);
+			expect(res.body.error).toBe("temporarily_unavailable");
+			// The session is still live and its cookie still admits it.
+			const authorized = await authorize(app, cookies);
+			expect(codeFrom(authorized)).toEqual(expect.any(String));
+		} finally {
+			await handle.dispose();
+		}
+	});
+});