@o3co/create-auth-provider 0.16.0 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/google-federation-config-module.test.mts

@@ -1,199 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * #278: the bridge used to return only `{ clientId, clientSecret, callbackURL }`,
- * dropping the four fields the redirect policy reads. Nothing failed — the
- * policy was simply constructed with an empty config, and the generated app
- * silently ran without a redirect allowlist. These tests fail if the bridge
- * stops forwarding any of them.
- */
-
-import type { GoogleProviderConfig } from "@o3co/auth-provider-federation-google";
-import { describe, expect, it } from "vitest";
-import { googleFederationConfigModule } from "../modules.mjs";
-
-type ConfigFactory = (deps: { config: unknown }) => GoogleProviderConfig;
-
-const bridge = (
-	googleFederationConfigModule as unknown as {
-		provides: { googleFederationConfig: ConfigFactory };
-	}
-).provides.googleFederationConfig;
-
-/** Runs the bridge over a `federations.google` section in the flat shape. */
-function buildConfig(googleSection: Record<string, unknown>): GoogleProviderConfig {
-	return bridge({ config: { federations: { google: { enabled: true, ...googleSection } } } });
-}
-
-const credentials = {
-	clientId: "id",
-	clientSecret: "secret",
-	callbackURL: "https://auth.example.com/session/oauth/federation/google/callback",
-};
-
-describe("googleFederationConfigModule — redirect-policy plumbing (#278)", () => {
-	it("forwards sessionDomain, authCallbackUrl, clientUrl and redirectAllowlist", () => {
-		const out = buildConfig({
-			...credentials,
-			sessionDomain: ".example.com",
-			authCallbackUrl: "https://app.example.com/auth/callback",
-			clientUrl: "https://app.example.com/",
-			redirectAllowlist: ["https://app.example.com/dashboard"],
-		});
-
-		expect(out).toMatchObject({
-			...credentials,
-			sessionDomain: ".example.com",
-			authCallbackUrl: "https://app.example.com/auth/callback",
-			clientUrl: "https://app.example.com/",
-			redirectAllowlist: ["https://app.example.com/dashboard"],
-		});
-	});
-
-	it("omits the optional fields when the operator did not configure them", () => {
-		const out = buildConfig(credentials);
-
-		expect(out).toEqual(credentials);
-		expect("sessionDomain" in out).toBe(false);
-		expect("authCallbackUrl" in out).toBe(false);
-		expect("clientUrl" in out).toBe(false);
-		expect("redirectAllowlist" in out).toBe(false);
-	});
-
-	it("rejects a redirectAllowlist that is not an array", () => {
-		expect(() =>
-			buildConfig({ ...credentials, redirectAllowlist: "https://app.example.com/dashboard" }),
-		).toThrow(/redirectAllowlist/);
-	});
-
-	it("rejects a redirectAllowlist holding a non-string", () => {
-		expect(() => buildConfig({ ...credentials, redirectAllowlist: [42] })).toThrow(
-			/redirectAllowlist/,
-		);
-	});
-
-	it("rejects a non-string sessionDomain rather than forwarding it", () => {
-		expect(() => buildConfig({ ...credentials, sessionDomain: 42 })).toThrow(/sessionDomain/);
-	});
-
-	it("still rejects a section missing the credentials", () => {
-		expect(() => buildConfig({ clientId: "id" })).toThrow(/clientId, clientSecret, callbackURL/);
-	});
-
-	it("reads through the nested federation shape as well as the flat one", () => {
-		const out = bridge({
-			config: {
-				federations: {
-					google: {
-						enabled: true,
-						type: "google",
-						sessionDomain: ".example.com",
-						redirectAllowlist: ["https://app.example.com/dashboard"],
-						google: credentials,
-					},
-				},
-			},
-		});
-		expect(out.sessionDomain).toBe(".example.com");
-		expect(out.redirectAllowlist).toEqual(["https://app.example.com/dashboard"]);
-	});
-});
-
-describe("googleFederationConfigModule — requireAuthorizationResponseIss (#597)", () => {
-	it("is absent by default, so the provider's own default (required) applies", () => {
-		expect("requireAuthorizationResponseIss" in buildConfig(credentials)).toBe(false);
-	});
-
-	it("forwards the operator's escape hatch", () => {
-		expect(
-			buildConfig({ ...credentials, requireAuthorizationResponseIss: false })
-				.requireAuthorizationResponseIss,
-		).toBe(false);
-		expect(
-			buildConfig({ ...credentials, requireAuthorizationResponseIss: true })
-				.requireAuthorizationResponseIss,
-		).toBe(true);
-	});
-
-	it("reads the strings an environment override produces", () => {
-		expect(
-			buildConfig({ ...credentials, requireAuthorizationResponseIss: "false" })
-				.requireAuthorizationResponseIss,
-		).toBe(false);
-		expect(
-			buildConfig({ ...credentials, requireAuthorizationResponseIss: "true" })
-				.requireAuthorizationResponseIss,
-		).toBe(true);
-	});
-
-	it("reads the spellings every other env-overridable boolean accepts", () => {
-		for (const [raw, expected] of [
-			["False", false],
-			[" false ", false],
-			["0", false],
-			["TRUE", true],
-			["1", true],
-		] as const) {
-			expect(
-				buildConfig({ ...credentials, requireAuthorizationResponseIss: raw })
-					.requireAuthorizationResponseIss,
-			).toBe(expected);
-		}
-	});
-
-	it("refuses an empty value, which elsewhere reads as false: exported-but-empty must not switch this check off", () => {
-		expect(() => buildConfig({ ...credentials, requireAuthorizationResponseIss: "" })).toThrow(
-			/federations\.google\.requireAuthorizationResponseIss/,
-		);
-	});
-
-	it("refuses anything else: a typo must not silently switch the check off, or leave it on", () => {
-		for (const bad of ["no", "off", 0, 1, []]) {
-			expect(() => buildConfig({ ...credentials, requireAuthorizationResponseIss: bad })).toThrow(
-				/federations\.google\.requireAuthorizationResponseIss/,
-			);
-		}
-	});
-});
-
-describe("googleFederationConfigModule — accessType", () => {
-	// federation-google asks every sign-in for consent with offline access, so
-	// every session gets a refresh token; "online" is the operator's way to
-	// keep Google's consent screen to the first sign-in, at the price of no
-	// refresh token at all. A bridge that drops the field leaves the operator
-	// without that choice.
-	it("is absent by default, so the provider's own default (offline) applies", () => {
-		expect("accessType" in buildConfig(credentials)).toBe(false);
-	});
-
-	it("leaves a null accessType absent, never forwarded as null, which the provider refuses", () => {
-		expect("accessType" in buildConfig({ ...credentials, accessType: null })).toBe(false);
-	});
-
-	it("forwards offline and online", () => {
-		expect(buildConfig({ ...credentials, accessType: "online" }).accessType).toBe("online");
-		expect(buildConfig({ ...credentials, accessType: "offline" }).accessType).toBe("offline");
-	});
-
-	it("refuses anything else at boot, naming the key", () => {
-		for (const bad of ["", "offine", "Online", "true", false, 1]) {
-			expect(() => buildConfig({ ...credentials, accessType: bad })).toThrow(
-				/federations\.google\.accessType/,
-			);
-		}
-	});
-});

package/templates/standalone/src/__tests__/oidc-federation-config-module.test.mts

@@ -1,138 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import type { AppConfig } from "@o3co/auth-provider-core";
-import { makeValidAppConfig } from "@o3co/auth-provider-core/testing";
-import { describe, expect, it } from "vitest";
-import { buildModules } from "../buildModules.mjs";
-import { oidcFederationConfigModule } from "../modules.mjs";
-
-/**
- * #524: the scaffold turns every enabled `federations.<name>` of type
- * `oidc` into one instance of the generic OIDC federation module, fed by a
- * single config bridge. A deployment adds an IdP with configuration only.
- */
-type Factory = (deps: { config: unknown }) => Record<string, unknown>;
-
-const bridge = (
-	oidcFederationConfigModule as unknown as {
-		provides: { oidcFederationConfigs: Factory };
-	}
-).provides.oidcFederationConfigs;
-
-const okta = {
-	issuer: "https://dev-1.okta.test",
-	clientId: "okta-client",
-	clientSecret: "okta-secret",
-	callbackURL: "https://auth.test/session/oauth/federation/okta/callback",
-};
-
-/** Core's valid fixture, with the federations under test and every adapter on memory. */
-const configWith = (federations: Record<string, unknown>): AppConfig => {
-	const base = makeValidAppConfig();
-	return {
-		...base,
-		federations,
-		oauth: { ...base.oauth, code: { adapter: "memory" } },
-	} as unknown as AppConfig;
-};
-
-describe("oidcFederationConfigModule (#524)", () => {
-	it("has the scaffold's module name and reads config", () => {
-		expect(oidcFederationConfigModule.name).toBe("standalone:oidc-federation-config");
-		expect(oidcFederationConfigModule.requires).toEqual(["config"]);
-	});
-
-	it("reads every enabled oidc section into the slot, keyed by federation name", () => {
-		const out = bridge({
-			config: {
-				federations: {
-					okta: { enabled: true, type: "oidc", ...okta },
-					keycloak: {
-						enabled: true,
-						type: "oidc",
-						clientUrl: "https://app.test/",
-						oidc: {
-							issuer: "https://kc.test/realms/dev",
-							clientId: "kc-client",
-							clientSecret: "kc-secret",
-							callbackURL: "https://auth.test/session/oauth/federation/keycloak/callback",
-						},
-					},
-					google: {
-						enabled: true,
-						clientId: "g",
-						clientSecret: "s",
-						callbackURL: "https://auth.test/g",
-					},
-					paused: { enabled: false, type: "oidc", ...okta },
-				},
-			},
-		});
-		expect(Object.keys(out).sort()).toEqual(["keycloak", "okta"]);
-		expect(out.okta).toEqual(okta);
-		expect(out.keycloak).toMatchObject({
-			issuer: "https://kc.test/realms/dev",
-			clientUrl: "https://app.test/",
-		});
-	});
-
-	it("refuses a malformed section at boot, naming the field", () => {
-		const { issuer: _dropped, ...noIssuer } = okta;
-		expect(() =>
-			bridge({ config: { federations: { okta: { enabled: true, type: "oidc", ...noIssuer } } } }),
-		).toThrow(/federations\.okta\.issuer/);
-	});
-
-	it("is an empty slot when no section is of type oidc", () => {
-		expect(bridge({ config: { federations: { google: { enabled: false } } } })).toEqual({});
-	});
-});
-
-describe("buildModules gating for OIDC federations (#524)", () => {
-	it("lists one federation:oidc:<name> per enabled section, plus the bridge once", () => {
-		const names = buildModules(
-			configWith({
-				okta: { enabled: true, type: "oidc", ...okta },
-				keycloak: { enabled: true, type: "oidc", ...okta },
-				google: { enabled: false },
-			}),
-		).map((m) => m.name);
-		expect(names).toContain("federation:oidc:okta");
-		expect(names).toContain("federation:oidc:keycloak");
-		expect(names.filter((n) => n === "standalone:oidc-federation-config")).toHaveLength(1);
-		expect(names).not.toContain("federation:google");
-	});
-
-	it("a google section of type oidc is the generic provider, not the built-in Google pair", () => {
-		// The section's `type` names the implementation. Composing both would
-		// contribute the same federation and redirect-policy keys twice.
-		const names = buildModules(
-			configWith({ google: { enabled: true, type: "oidc", ...okta } }),
-		).map((m) => m.name);
-		expect(names).toContain("federation:oidc:google");
-		expect(names).not.toContain("federation:google");
-		expect(names).not.toContain("standalone:google-federation-config");
-	});
-
-	it("lists nothing OIDC when no section is enabled (the shipped default)", () => {
-		const names = buildModules(
-			configWith({ google: { enabled: false }, oidc: { enabled: false, type: "oidc" } }),
-		).map((m) => m.name);
-		expect(names.some((n) => n.startsWith("federation:oidc:"))).toBe(false);
-		expect(names).not.toContain("standalone:oidc-federation-config");
-	});
-});