@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/store-credential.test.mts

@@ -16,25 +16,23 @@
 
 /**
  * The credential auth.provider presents to the Store, through the shipped
- * composition: `CLIENT_USER_BEARER_TOKEN` in the environment → the HOCON
- * layers → `AppConfigSchema` → the production `repositoriesModule` → the
+ * composition: `REPOSITORIES_USER_HTTP_BEARER_TOKEN` in the environment → the HOCON
+ * layers → the production `repositories` module's section → the
  * `"http"` user adapter → the `Authorization` header a real `node:http` Store
- * receives. Unset, the Store receives no `Authorization` header; set blank —
- * an exported-but-empty variable — the user repository is refused.
- *
- * And what a mismatch looks like from outside, with the app booted from the
- * shipped config through `createApp`: a Store that refuses the token with a
- * `401` and a `Bearer` challenge turns `POST /session/login` into a `503`
- * whose log line names the refused credential and never the token; a `401`
- * without the challenge is still a wrong password.
+ * receives. Unset, no header is sent; exported but empty, the user repository
+ * is refused. From outside the booted app, a Store's `401` with a `Bearer`
+ * challenge turns `POST /session/login` into a `503` whose log line names the
+ * refused credential and never the token; a `401` without the challenge is
+ * still a wrong password.
  */
 
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { createServer, type OutgoingHttpHeaders, type Server } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { inspect } from "node:util";
 import {
-	type AppConfig,
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
@@ -44,13 +42,19 @@ import {
 	type UserRepository,
 } from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import express from "express";
 import request from "supertest";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
-import { repositoriesModule } from "../modules.mjs";
+import { resolveConfigPaths } from "../configPath.mjs";
+import { repositoriesModuleFor, templateReference } from "../modules.mjs";
+import { repositoriesSectionSchema } from "../sections.mjs";
+import {
+	type BothPhases,
+	bothPhasesOf,
+	capturedRenames,
+	libraryLayers,
+} from "./library-references.fixture.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 
@@ -97,39 +101,47 @@ const recordingStore = async (
 };
 
 /** The shipped config for the production overlay, resolved against `env`. */
-const resolve = (env: Record<string, string>): AppConfig => {
+const resolve = (env: Record<string, string>): BothPhases => {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return validate(
-		parseFile(envConfPath, { env })
-			.withFallback(parseFile(applicationConfPath, { env }))
-			.withFallback(parseFile(resolveLibraryReferenceConfPath(), { env })),
-		AppConfigSchema,
-	);
+	const layers = parseFile(envConfPath, { env })
+		.withFallback(parseFile(applicationConfPath, { env }))
+		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
+		.withFallback(libraryLayers(env));
+	return {
+		...bothPhasesOf(layers, env),
+		// What the resolution captured of the renamed variables.
+		"renamed-variables": capturedRenames(env),
+	} as BothPhases;
 };
 
-/** The user repository the production `repositoriesModule` builds from `config`. */
-const userRepositoryFrom = (config: AppConfig): Promise<UserRepository> =>
+/** The user repository the production `repositories` module builds from `config`'s section. */
+const userRepositoryFrom = (config: BothPhases): Promise<UserRepository> =>
 	Promise.resolve(
-		repositoriesModule.provides?.userRepository?.({ config } as never) as
-			| UserRepository
-			| Promise<UserRepository>,
+		repositoriesModuleFor({
+			client: config.adapters.clientRepository,
+			user: config.adapters.userRepository,
+		}).provides?.userRepository?.({
+			section: repositoriesSectionSchema.parse(
+				(config as unknown as Record<string, unknown>).repositories,
+			),
+		} as never) as UserRepository | Promise<UserRepository>,
 	);
 
 const envFor = (origin: string): Record<string, string> => ({
-	OAUTH_JWT_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: "store-credential-composition.at-least-32-bytes.ok",
+	KEY_STORE_LOCAL_ALGORITHM: "HS256",
+	KEY_STORE_LOCAL_SECRET: "store-credential-composition.at-least-32-bytes.ok",
 	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_SECRET: "store-credential-composition-session.at-least-32-bytes.ok",
-	CLIENT_USER_TYPE: "http",
-	CLIENT_USER_AUTHENTICATE_URL: `${origin}/authenticate`,
-	CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL: `${origin}/authenticate-by-token`,
+	SESSION_STORE_SECRET: "store-credential-composition-session.at-least-32-bytes.ok",
+	ADAPTERS_USER_REPOSITORY: "http",
+	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: `${origin}/authenticate`,
+	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: `${origin}/authenticate-by-token`,
 });
 
-describe("CLIENT_USER_BEARER_TOKEN reaches the Store through the shipped composition", () => {
+describe("REPOSITORIES_USER_HTTP_BEARER_TOKEN reaches the Store through the shipped composition", () => {
 	it("sends Authorization: Bearer <token> on every Store call when the variable is set", async () => {
 		const { origin, heard } = await recordingStore();
 		const repo = await userRepositoryFrom(
-			resolve({ ...envFor(origin), CLIENT_USER_BEARER_TOKEN: TOKEN }),
+			resolve({ ...envFor(origin), REPOSITORIES_USER_HTTP_BEARER_TOKEN: TOKEN }),
 		);
 
 		await repo.authenticate("alice", "pass");
@@ -149,7 +161,7 @@ describe("CLIENT_USER_BEARER_TOKEN reaches the Store through the shipped composi
 
 	it("refuses the user repository when the variable is exported but empty", async () => {
 		const { origin, heard } = await recordingStore();
-		const config = resolve({ ...envFor(origin), CLIENT_USER_BEARER_TOKEN: "" });
+		const config = resolve({ ...envFor(origin), REPOSITORIES_USER_HTTP_BEARER_TOKEN: "" });
 
 		await expect(userRepositoryFrom(config)).rejects.toThrow(/"bearerToken" must not be empty/);
 		expect(heard).toEqual([]);
@@ -157,20 +169,21 @@ describe("CLIENT_USER_BEARER_TOKEN reaches the Store through the shipped composi
 });
 
 describe("a token the Store refuses, seen from outside the booted app", () => {
-	/** Every store on memory, so the boot opens no socket but the Store's. */
+	/** Every store on memory, so the boot opens no socket but the Store's; MFA off. */
 	const MEMORY_ENV: Readonly<Record<string, string>> = {
-		SESSION_SECURE: "false",
-		SESSION_NAME: "auth.session",
-		SESSION_STORAGE_TYPE: "memory",
-		USER_SESSION_STORES_ADAPTER: "memory",
-		RATE_LIMITER_ADAPTER: "memory",
-		OAUTH_CODE_ADAPTER: "memory",
-		ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
-		REPLAY_SEEN_SET_ADAPTER: "memory",
-		FEDERATION_TOKEN_STORE_TYPE: "memory",
-		CONSENT_STORE_ADAPTER: "none",
-		FEDERATION_GRANT_STORE_ADAPTER: "memory",
-		FEDERATION_GRANT_INTENT_STORE_ADAPTER: "memory",
+		MFA_MODE: "off",
+		SESSION_STORE_SECURE: "false",
+		SESSION_STORE_NAME: "auth.session",
+		SESSION_STORE_STORAGE_TYPE: "memory",
+		ADAPTERS_USER_SESSION_STORES: "memory",
+		ADAPTERS_RATE_LIMITER: "memory",
+		ADAPTERS_CODE_REPOSITORY: "memory",
+		ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+		ADAPTERS_REPLAY_SEEN_SET: "memory",
+		ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
+		ADAPTERS_CONSENT_STORE: "none",
+		ADAPTERS_FEDERATION_GRANT_STORE: "memory",
+		ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 	};
 
 	const testKeyStoreModule = defineModule({
@@ -182,7 +195,7 @@ describe("a token the Store refuses, seen from outside the booted app", () => {
 				registerBuiltinKeyStores(factory);
 				return factory.create({
 					type: "local",
-					...((c as AppConfig).oauth.jwt.signingKey.local ?? {}),
+					...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
 				});
 			},
 		},
@@ -214,6 +227,24 @@ describe("a token the Store refuses, seen from outside the booted app", () => {
 		handleRef = undefined;
 	});
 
+	/**
+	 * The client registry the boot reads, which this test brings itself.
+	 * `REPOSITORIES_CLIENT_YAML_PATH`'s default, `./config/clients.yaml`, is per-deployment: the
+	 * scaffold's `.gitignore` keeps it out of the project's repository, so a
+	 * fresh clone — a CI runner, the `test` image — has none. The login below
+	 * names no client, so an empty registry is all it needs.
+	 */
+	let registryDir: string;
+	let clientPath: string;
+	beforeAll(() => {
+		registryDir = mkdtempSync(join(tmpdir(), "store-credential-"));
+		clientPath = join(registryDir, "clients.yaml");
+		writeFileSync(clientPath, "# No clients: the login under test names none.\n");
+	});
+	afterAll(() => {
+		rmSync(registryDir, { recursive: true, force: true });
+	});
+
 	/**
 	 * The shipped config against a Store answering `answer`, booted with the
 	 * production repositories module; then a real browser login — a CSRF pair,
@@ -221,7 +252,12 @@ describe("a token the Store refuses, seen from outside the booted app", () => {
 	 */
 	const logInAgainst = async (answer: StoreAnswer) => {
 		const { origin, heard } = await recordingStore(answer);
-		const config = resolve({ ...envFor(origin), ...MEMORY_ENV, CLIENT_USER_BEARER_TOKEN: TOKEN });
+		const config = resolve({
+			...envFor(origin),
+			...MEMORY_ENV,
+			REPOSITORIES_CLIENT_YAML_PATH: clientPath,
+			REPOSITORIES_USER_HTTP_BEARER_TOKEN: TOKEN,
+		});
 		const { logger, lines } = capturingLogger();
 		handleRef = await createApp({
 			modules: buildModules(config, {

package/templates/standalone/src/__tests__/supertest-loopback.test.mts

@@ -15,16 +15,15 @@
  */
 
 /**
- * #556 — the server `request(app)` starts listens on the address supertest
- * dials, in this project's own test run.
- *
- * Unpatched, supertest starts its server with `app.listen(0)` — the
- * dual-stack wildcard `[::]:P` — and sends the request to `127.0.0.1:P`. On
- * macOS the kernel can hand out a `P` another process already holds as
- * `127.0.0.1:P`; the request then reaches that process, and if it never
- * answers the test hangs until its timeout. `vitest.supertest-loopback.mts`
- * (wired in through `setupFiles` in `vitest.config.mts`) binds the server to
- * `127.0.0.1` instead. These tests fail if that wiring is lost.
+ * The server `request(app)` starts listens on the address supertest dials,
+ * in this project's own test run. Unpatched, supertest starts its server with
+ * `app.listen(0)` — the dual-stack wildcard `[::]:P` — and sends the request
+ * to `127.0.0.1:P`. On macOS the kernel can hand out a `P` another process
+ * already holds as `127.0.0.1:P`; the request then reaches that process, and
+ * if it never answers the test hangs until its timeout.
+ * `vitest.supertest-loopback.mts` (a `setupFiles` entry in
+ * `vitest.config.mts`) binds `127.0.0.1` instead; these tests fail if that
+ * wiring is lost.
  */
 
 import http from "node:http";
@@ -48,7 +47,62 @@ function boundAddress(server: net.Server): Promise<AddressInfo> {
 	});
 }
 
-describe("#556 — supertest's own server listens on the loopback address it dials", () => {
+/**
+ * An app whose `GET /hold/:name` waits in its handler until the test releases
+ * that name, so a test decides the order in which requests finish.
+ * `inFlight` holds the names whose handlers have not answered yet.
+ */
+function holdingApp() {
+	const gates = new Map<
+		string,
+		{ arrived: PromiseWithResolvers<void>; released: PromiseWithResolvers<void> }
+	>();
+	const gate = (name: string) => {
+		let found = gates.get(name);
+		if (!found) {
+			found = { arrived: Promise.withResolvers(), released: Promise.withResolvers() };
+			gates.set(name, found);
+		}
+		return found;
+	};
+	const inFlight = new Set<string>();
+	const app = express();
+	app.get("/hold/:name", async (req, res) => {
+		const { name } = req.params;
+		inFlight.add(name);
+		gate(name).arrived.resolve();
+		await gate(name).released.promise;
+		inFlight.delete(name);
+		res.status(200).send(name);
+	});
+	return {
+		app,
+		inFlight,
+		arrived: (name: string) => gate(name).arrived.promise,
+		release: (name: string) => gate(name).released.resolve(),
+		releaseAll: () => {
+			for (const { released } of gates.values()) released.resolve();
+		},
+	};
+}
+
+/**
+ * Records, for every `close` of `server`, which held requests it was still
+ * serving. A close that comes too early releases them all, so the test
+ * finishes and reports it instead of waiting on a close that waits on them.
+ */
+function recordCloses(server: http.Server, held: ReturnType<typeof holdingApp>): string[][] {
+	const closes: string[][] = [];
+	const close = server.close.bind(server);
+	server.close = ((callback?: (err?: Error) => void) => {
+		closes.push([...held.inFlight]);
+		held.releaseAll();
+		return close(callback);
+	}) as typeof server.close;
+	return closes;
+}
+
+describe("supertest's own server listens on the loopback address it dials", () => {
 	it("binds 127.0.0.1, not the dual-stack wildcard", async () => {
 		const server = http.createServer(helloApp());
 		const bound = boundAddress(server);
@@ -97,6 +151,123 @@ describe("#556 — supertest's own server listens on the loopback address it dia
 		expect(responses.map((res) => res.status)).toEqual([200, 200]);
 	});
 
+	it("closes an agent's one server after the last request sent over it, not the first", async () => {
+		// The request built first is the one whose call bound the server. Closing
+		// the server when that one finishes, as supertest 7.2 does, resets the
+		// connection of a request still on its way: ECONNRESET on Node 26.
+		const held = holdingApp();
+		const server = http.createServer(held.app);
+		const closes = recordCloses(server, held);
+		const agent = request.agent(server);
+
+		const first = agent.get("/hold/first");
+		const second = agent.get("/hold/second");
+		const both = Promise.all([first, second]);
+		await Promise.all([held.arrived("first"), held.arrived("second")]);
+		held.release("first");
+		await first;
+		held.release("second");
+
+		expect((await both).map((res) => res.text)).toEqual(["first", "second"]);
+		expect(closes).toEqual([[]]);
+		expect(server.listening).toBe(false);
+	});
+
+	it("keeps it open for a request sent while the server is already serving another", async () => {
+		const held = holdingApp();
+		const server = http.createServer(held.app);
+		const closes = recordCloses(server, held);
+		const agent = request.agent(server);
+
+		// A Test is sent when it is first awaited or `then`ed; the identity
+		// `then` sends each one here, before the test waits for its arrival.
+		const first = agent.get("/hold/first").then((res) => res);
+		await held.arrived("first");
+		const late = agent.get("/hold/late").then((res) => res);
+		await held.arrived("late");
+		held.release("first");
+		await first;
+		held.release("late");
+
+		expect((await late).text).toBe("late");
+		expect(closes).toEqual([[]]);
+		expect(server.listening).toBe(false);
+	});
+
+	it("binds again for a request built before the server was closed, and sent after", async () => {
+		const agent = request.agent(helloApp());
+
+		const first = agent.get("/hello");
+		const second = agent.get("/hello");
+
+		expect((await first).status).toBe(200);
+		expect((await second).status).toBe(200);
+	});
+
+	it("joins the bind another request made since, for a request built before the server was closed", async () => {
+		// Built on the first bind, sent while a later request is being served
+		// on the second: it joins that bind — one server, two requests in
+		// flight — and the server closes once, after the last of them.
+		const held = holdingApp();
+		const server = http.createServer(held.app);
+		const closes = recordCloses(server, held);
+		const agent = request.agent(server);
+
+		const early = agent.get("/hold/early");
+		const first = agent.get("/hold/first").then((res) => res);
+		await held.arrived("first");
+		held.release("first");
+		expect((await first).text).toBe("first");
+		expect(server.listening).toBe(false);
+
+		const second = agent.get("/hold/second").then((res) => res);
+		await held.arrived("second");
+		const earlySent = early.then((res) => res);
+		await held.arrived("early");
+		held.release("second");
+		expect((await second).text).toBe("second");
+		expect(server.listening).toBe(true);
+		held.release("early");
+
+		expect((await earlySent).text).toBe("early");
+		expect(closes).toEqual([[], []]);
+		expect(server.listening).toBe(false);
+	});
+
+	it("serves a request built on a bind that failed, once another request has bound the server again", async () => {
+		// The first `listen` lands on a port another socket holds; the bind
+		// fails, and the request built on it is not sent until a later request
+		// has bound the server on a free port. It joins that bind rather than
+		// failing with the error of the one it was built on.
+		const held: net.Socket[] = [];
+		const squatter = net.createServer((socket) => {
+			held.push(socket);
+		});
+		await new Promise<void>((resolve) => squatter.listen(0, "127.0.0.1", resolve));
+		const { port } = squatter.address() as AddressInfo;
+
+		const server = http.createServer(helloApp());
+		const listen = server.listen.bind(server) as (...args: unknown[]) => net.Server;
+		let steered = false;
+		(server as { listen: (...args: unknown[]) => net.Server }).listen = (requested, ...rest) => {
+			if (steered) return listen(requested, ...rest);
+			steered = true;
+			return listen(port, ...rest);
+		};
+
+		try {
+			const failed = new Promise<void>((resolve) => server.once("error", () => resolve()));
+			const builtOnTheFailedBind = request(server).get("/hello");
+			await failed;
+			expect((await request(server).get("/hello")).status).toBe(200);
+			expect((await builtOnTheFailedBind).status).toBe(200);
+			expect(server.listening).toBe(false);
+		} finally {
+			for (const socket of held) socket.destroy();
+			squatter.close();
+		}
+	}, 5_000);
+
 	it("fails the request, instead of hanging on another socket, when 127.0.0.1:P is taken", async () => {
 		// The collision the kernel produces by chance, produced on purpose: a
 		// socket that accepts and never answers holds 127.0.0.1:P, and the