@o3co/create-auth-provider 0.17.0-rc.1 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/session-requirements.test.mts

@@ -20,7 +20,8 @@
  * — `[]` in the shipped `config/application.conf` — with `mfa` added when the
  * template's MFA switch, `mfaMode` (`MFA_MODE`), is not `off`
  * (`expectedSessionRequirements`); under that switch the template installs
- * the MFA module, whose requirement registers `mfa`. And what it hands boot
+ * the MFA module, whose requirement registers `mfa`; a value boot refuses is
+ * handed on as written, for boot to refuse. And what it hands boot
  * of the MFA module's section, `mfa`: nothing unless a loaded module owns it,
  * its mode written from the switch when the template installs MFA, and a
  * mode the configuration writes that the switch does not say refused.
@@ -38,8 +39,8 @@ import {
 	readSwitches,
 	resolveForBoot,
 	resolveLayers,
-	type Switches,
 } from "../configPath.mjs";
+import type { MfaSwitch } from "../sections.mjs";
 import {
 	type Composition,
 	compose,
@@ -119,6 +120,45 @@ describe("what the template expects of session admission", () => {
 		});
 	});
 
+	it.each([
+		["a name, not a list", 'core.sessionRequirements.expected = "risk"\n'],
+		["a list holding something other than a name", "core.sessionRequirements.expected = [1]\n"],
+		["a key core does not declare beside the list", "core.sessionRequirements.extra = 1\n"],
+	])(
+		"hands boot %s as written under the switch on, and boot refuses it naming core.sessionRequirements",
+		async (_label, operatorHocon) => {
+			const err = await refusal(
+				compose({
+					env: { ...SINGLE_ENV, ...MFA_ENV, MFA_MODE: "required" },
+					environment: "test",
+					operatorHocon,
+				}),
+			);
+			expect(err).toBeInstanceOf(BootError);
+			expect((err as BootError).reason).toBe("config-validation-failed");
+			expect(String((err as BootError).message)).toContain("core.sessionRequirements");
+		},
+	);
+
+	it("hands boot the configuration's own section as written under the switch off", () => {
+		const own = readOwnLayers(
+			[
+				operatorLayer(
+					'core.sessionRequirements { expected = ["risk"], secondFactorAuthority = "risk" }\n',
+				),
+				...ownFiles(),
+			],
+			{ env: SINGLE_ENV },
+		);
+		const resolved = resolveForBoot(own, [], readSwitches(own)) as unknown as {
+			readonly core?: { readonly sessionRequirements?: unknown };
+		};
+		expect(resolved.core?.sessionRequirements).toEqual({
+			expected: ["risk"],
+			secondFactorAuthority: "risk",
+		});
+	});
+
 	it("refuses the boot when the configuration expects mfa under the switch off: nothing registers it", async () => {
 		const err = await refusal(
 			compose({ operatorHocon: 'core.sessionRequirements.expected = ["mfa"]\n' }),
@@ -179,11 +219,19 @@ describe("what the template hands boot of the mfa section", () => {
 			} catch (caught) {
 				err = caught;
 			}
-			expect(err).toBeInstanceOf(RangeError);
-			const message = (err as RangeError).message;
+			expect(err).toBeInstanceOf(BootError);
+			expect(err).toMatchObject({
+				reason: "config-validation-failed",
+				details: {
+					issues: [{ code: "custom", path: ["mfa", "mode"] }],
+					modules: [{ module: "mfa", schemaPath: "mfa" }],
+				},
+			});
+			const message = (err as BootError).message;
 			expect(message).toContain("mfa.mode");
 			expect(message).toContain("mfaMode");
 			expect(message).not.toMatch(/"(?:off|optional|required)"/);
+			expect(JSON.stringify((err as BootError).details)).not.toMatch(/"(?:off|optional|required)"/);
 		},
 	);
 
@@ -200,8 +248,12 @@ describe("what the template hands boot of the mfa section", () => {
 			} catch (caught) {
 				err = caught;
 			}
-			expect(err).toBeInstanceOf(RangeError);
-			const message = (err as RangeError).message;
+			expect(err).toBeInstanceOf(BootError);
+			expect(err).toMatchObject({
+				reason: "config-validation-failed",
+				details: { issues: [{ code: "custom", path: ["mfa"] }] },
+			});
+			const message = (err as BootError).message;
 			expect(message).toMatch(/^mfa is written as a value/);
 			expect(message).not.toContain("remove mfa.mode");
 			expect(message).toContain("mfaMode");
@@ -219,33 +271,42 @@ describe("what the template hands boot of the mfa section", () => {
 		}
 	});
 
-	it("is refused through the composition as through phase two: before boot, under the switch off", async () => {
+	it("is refused through the composition as through phase two: by the template before boot, under the switch off", async () => {
 		const err = await refusal(compose({ operatorHocon: 'mfa.mode = "required"\n' }));
-		expect(err).toBeInstanceOf(RangeError);
-		expect(err).not.toBeInstanceOf(BootError);
-		expect((err as RangeError).message).toContain("mfaMode");
+		expect(err).toBeInstanceOf(BootError);
+		// The template's own check, not a schema's: one custom issue, in its words.
+		const message = /^mfa\.mode is written in the configuration and differs from mfaMode/;
+		expect(err).toMatchObject({
+			reason: "config-validation-failed",
+			message: expect.stringMatching(message),
+			details: {
+				issues: [
+					{ code: "custom", path: ["mfa", "mode"], message: expect.stringMatching(message) },
+				],
+				modules: [{ module: "mfa", schemaPath: "mfa" }],
+			},
+		});
+		expect((err as BootError).details).toMatchObject({ issues: { length: 1 } });
+		expect((err as BootError).message).toContain("mfaMode");
 	});
 });
 
 describe("expectedSessionRequirements", () => {
-	const of = (mfa: string, expected?: readonly string[], authority?: string) =>
-		expectedSessionRequirements({
-			mfaMode: mfa,
-			...(expected === undefined && authority === undefined
-				? {}
+	const of = (mfa: MfaSwitch, expected?: readonly string[], authority?: string) =>
+		expectedSessionRequirements(
+			expected === undefined && authority === undefined
+				? undefined
 				: {
-						core: {
-							sessionRequirements: {
-								...(expected === undefined ? {} : { expected }),
-								...(authority === undefined ? {} : { secondFactorAuthority: authority }),
-							},
-						},
-					}),
-		} as unknown as Switches);
+						...(expected === undefined ? {} : { expected }),
+						...(authority === undefined ? {} : { secondFactorAuthority: authority }),
+					},
+			mfa,
+		);
 	const AUTHORITY = { secondFactorAuthority: "mfa" } as const;
 
 	it("is the configuration's list, with mfa added once and named the second-factor authority when the switch is not off", () => {
-		expect(of("off", ["risk"])).toEqual({ expected: ["risk"] });
+		// `undefined`: the section is handed on as written.
+		expect(of("off", ["risk"])).toBeUndefined();
 		expect(of("optional", ["risk"])).toEqual({ expected: ["risk", "mfa"], ...AUTHORITY });
 		expect(of("required", ["mfa"])).toEqual({ expected: ["mfa"], ...AUTHORITY });
 		expect(of("required")).toEqual({ expected: ["mfa"], ...AUTHORITY });
@@ -260,15 +321,12 @@ describe("expectedSessionRequirements", () => {
 			expected: ["mfa", "risk", "mfa"],
 			...AUTHORITY,
 		});
-		expect(of("off", ["risk", "risk"])).toEqual({ expected: ["risk", "risk"] });
+		expect(of("off", ["risk", "risk"])).toBeUndefined();
 	});
 
 	it("accepts a written second-factor authority the switch says, and keeps one written under the switch off", () => {
 		expect(of("required", ["mfa"], "mfa")).toEqual({ expected: ["mfa"], ...AUTHORITY });
-		expect(of("off", ["risk"], "risk")).toEqual({
-			expected: ["risk"],
-			secondFactorAuthority: "risk",
-		});
+		expect(of("off", ["risk"], "risk")).toBeUndefined();
 	});
 
 	it("refuses, with the switch on, a written second-factor authority other than mfa, naming the key and the switch and quoting nothing", () => {
@@ -278,8 +336,18 @@ describe("expectedSessionRequirements", () => {
 		} catch (caught) {
 			err = caught;
 		}
-		expect(err).toBeInstanceOf(RangeError);
-		const message = (err as RangeError).message;
+		expect(err).toBeInstanceOf(BootError);
+		expect(err).toMatchObject({
+			reason: "config-validation-failed",
+			details: {
+				issues: [
+					{ code: "custom", path: ["core", "sessionRequirements", "secondFactorAuthority"] },
+				],
+				modules: [{ module: "core", schemaPath: "core" }],
+			},
+		});
+		expect(JSON.stringify((err as BootError).details)).not.toContain("sentinel-requirement");
+		const message = (err as BootError).message;
 		expect(message).toContain("core.sessionRequirements.secondFactorAuthority");
 		expect(message).toContain("mfaMode");
 		expect(message).toContain("MFA_MODE");
@@ -289,6 +357,21 @@ describe("expectedSessionRequirements", () => {
 	it("declares nothing when the configuration writes no list and the switch is off, so boot's own rule for an unwritten key applies", () => {
 		expect(of("off")).toBeUndefined();
 	});
+
+	it("hands on as written, under the switch on, what is not a section with a list of names, for boot to refuse", () => {
+		expect(expectedSessionRequirements("mfa", "required")).toBeUndefined();
+		expect(expectedSessionRequirements({ expected: "mfa" }, "required")).toBeUndefined();
+		expect(expectedSessionRequirements({ expected: ["mfa", 1] }, "required")).toBeUndefined();
+		expect(expectedSessionRequirements({}, "required")).toBeUndefined();
+	});
+
+	it("keeps, under the switch on, every other key written beside the list, for boot to refuse", () => {
+		expect(expectedSessionRequirements({ expected: [], extra: 1 }, "required")).toEqual({
+			expected: ["mfa"],
+			extra: 1,
+			...AUTHORITY,
+		});
+	});
 });
 
 /** `text` in a file of its own, a layer above the composition's files. */

package/templates/standalone/src/__tests__/shipped-config-notices.test.mts

@@ -0,0 +1,270 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template's shipped files, read as `app.mts` reads them in each mode the
+ * README documents, write no section for a module the mode does not load:
+ * every top-level section handed to boot is a loaded module's, core's own
+ * (`core`, `oauth`), one that sets nothing, or one equal to the
+ * configuration's defaults (`configDefaultsFor`). That is checked here
+ * directly, whatever core counts as read; booted, the same modes then have
+ * core name nothing in `config_sections_ignored` or
+ * `config_sections_not_loaded`.
+ *
+ * Redis is a stand-in: these boots read configuration, not stores.
+ */
+
+import { generateKeyPairSync } from "node:crypto";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { isDeepStrictEqual } from "node:util";
+import { createApp, type Module } from "@o3co/auth-provider-core";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { buildModules } from "#/buildModules.mjs";
+import {
+	configDefaultsFor,
+	readOwnLayers,
+	readSwitches,
+	resolveConfigPaths,
+	resolveForBoot,
+} from "#/configPath.mjs";
+import { createRecordingLogger, type RecordingLogger } from "./all-modules-composition.fixture.mjs";
+
+vi.mock("redis", () => ({
+	createClient: vi.fn(() => ({
+		connect: vi.fn().mockResolvedValue(undefined),
+		quit: vi.fn().mockResolvedValue(undefined),
+		ping: vi.fn().mockResolvedValue("PONG"),
+		on: vi.fn(),
+	})),
+}));
+
+vi.mock("connect-redis", async () => {
+	const { EventEmitter } = await import("node:events");
+	// express-session subscribes to store events, so the stand-in is an emitter.
+	return {
+		RedisStore: class MockRedisStore extends EventEmitter {
+			get(): unknown {
+				return undefined;
+			}
+			set(): void {}
+			destroy(): void {}
+		},
+	};
+});
+
+vi.mock("ioredis", () => {
+	const explicit: Record<string, unknown> = {
+		on: () => undefined,
+		quit: async () => "OK",
+		disconnect: () => undefined,
+		ping: async () => "PONG",
+	};
+	const makeMockRedis = (): object =>
+		new Proxy(
+			{},
+			{
+				get(_target, prop) {
+					// A function-valued `then` would make the instance a thenable.
+					if (typeof prop !== "string" || prop === "then") return undefined;
+					if (prop === "duplicate") return makeMockRedis;
+					if (prop in explicit) return explicit[prop];
+					return async () => null;
+				},
+			},
+		);
+	function MockRedis(): object {
+		return makeMockRedis();
+	}
+	return { Redis: MockRedis, default: MockRedis };
+});
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+const handles: { dispose(): Promise<void> }[] = [];
+afterEach(async () => {
+	for (const handle of handles.splice(0)) await handle.dispose();
+});
+
+const signingKey = generateKeyPairSync("ed25519", {
+	publicKeyEncoding: { type: "spki", format: "pem" },
+	privateKeyEncoding: { type: "pkcs8", format: "pem" },
+});
+const clientsFile = (() => {
+	const file = join(mkdtempSync(join(tmpdir(), "shipped-config-notices-")), "clients.yaml");
+	writeFileSync(file, "");
+	return file;
+})();
+
+/** What `.env.example` asks every deployment for, with the Store's user directory. */
+const REQUIRED: Readonly<Record<string, string>> = {
+	OAUTH_JWT_ISSUER: "https://auth.test",
+	KEY_STORE_LOCAL_PRIVATE_KEY: signingKey.privateKey,
+	KEY_STORE_LOCAL_PUBLIC_KEY: signingKey.publicKey,
+	SESSION_STORE_SECRET: "shipped-config-notices-session.at-least-32-bytes.ok",
+	REPOSITORIES_CLIENT_YAML_PATH: clientsFile,
+	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: "https://store.auth.test/authenticate",
+	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: "https://store.auth.test/by-token",
+};
+
+/** What `docker-compose.yml` sets for the app beside the operator's `.env`, with `.env.example`'s Redis URLs. */
+const COMPOSE: Readonly<Record<string, string>> = {
+	SESSION_STORE_STORAGE_REDIS_URL: "redis://redis.test:6379",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	ADAPTERS_USER_SESSION_STORES: "redis",
+	ADAPTERS_MFA_FACTOR_STORE: "redis",
+	ADAPTERS_MFA_TRANSACTION_STORE: "redis",
+};
+
+/** What MFA, on by default, needs outside development. */
+const MFA_OUTSIDE_DEVELOPMENT: Readonly<Record<string, string>> = {
+	MFA_ENCRYPTION_KEY: "bzNjbzptZmE6c2hpcHBlZC1jb25maWctbm90aWNlcyE=",
+	STANDARD_SMTP_MAIL_SENDER_HOST: "smtp.auth.test",
+	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
+};
+
+/** One replica, as `docker-compose.production.yml` runs it. */
+const PRODUCTION: Readonly<Record<string, string>> = {
+	...REQUIRED,
+	...COMPOSE,
+	...MFA_OUTSIDE_DEVELOPMENT,
+	CORE_DEPLOYMENT_MODE: "single",
+	HTTP_TRUST_PROXY: "loopback",
+};
+
+/** The README's multi-replica checklist: every shared store on Redis. */
+const MULTI: Readonly<Record<string, string>> = {
+	...PRODUCTION,
+	CORE_DEPLOYMENT_MODE: "multi",
+	ADAPTERS_RATE_LIMITER: "redis",
+	ADAPTERS_ATTEMPT_COUNTER: "redis",
+	ADAPTERS_FEDERATION_TOKEN_STORE: "redis",
+	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: "bzNjbzpmZWRlcmF0aW9uLXRva2Vucy1ub3RpY2VzISE=",
+};
+
+/** Every store in memory, MFA off: one process of local work with no Redis. */
+const IN_MEMORY: Readonly<Record<string, string>> = {
+	...REQUIRED,
+	MFA_MODE: "off",
+	SESSION_STORE_STORAGE_TYPE: "memory",
+	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
+	ADAPTERS_REPLAY_SEEN_SET: "memory",
+	ADAPTERS_CODE_REPOSITORY: "memory",
+};
+
+/** The composition's own files for `configEnv`, read as `app.mts` reads them, and what they choose. */
+function readShipped(configEnv: string, env: Readonly<Record<string, string>>) {
+	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
+	const own = readOwnLayers([envConfPath, applicationConfPath], { env });
+	const switches = readSwitches(own);
+	const modules = buildModules(switches, { environment: configEnv });
+	return { own, switches, modules };
+}
+
+/** Boots the template's own files for `configEnv` under `env`, as `app.mts` does. */
+async function bootShipped(
+	configEnv: string,
+	env: Readonly<Record<string, string>>,
+): Promise<{ readonly logger: RecordingLogger; readonly modules: readonly string[] }> {
+	const { own, switches, modules } = readShipped(configEnv, env);
+	const logger = createRecordingLogger();
+	const handle = await createApp({
+		modules,
+		bootstrapComponents: {
+			config: resolveForBoot(own, modules, switches),
+			configDefaults: configDefaultsFor(modules),
+			pathResolver: (s: string) => s,
+			logger,
+		},
+	});
+	handles.push(handle);
+	return { logger, modules: modules.map((module) => module.name) };
+}
+
+/** Core's own sections. */
+const CORE_SECTIONS: readonly string[] = ["core", "oauth"];
+
+/**
+ * Removed by boot before it parses the configuration: what the resolution saw
+ * of each renamed variable.
+ */
+const RENAMED_VARIABLES = "renamed-variables";
+
+/** Whether `value` sets anything: a value, or a section with one somewhere under it. */
+function setsAnything(value: unknown): boolean {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return true;
+	return Object.values(value).some(setsAnything);
+}
+
+/**
+ * The top-level sections of what `resolveForBoot` hands boot that are no
+ * loaded module's and not core's, set something, and differ from the
+ * configuration's defaults: settings for a module the composition does not
+ * load.
+ */
+function sectionsNothingLoadedReads(
+	configEnv: string,
+	env: Readonly<Record<string, string>>,
+): string[] {
+	const { own, switches, modules } = readShipped(configEnv, env);
+	const resolved = resolveForBoot(own, modules, switches) as unknown as Record<string, unknown>;
+	const defaults = configDefaultsFor(modules);
+	const sections = new Set(
+		modules.filter((module: Module) => module.section !== undefined).map((module) => module.name),
+	);
+	return Object.keys(resolved)
+		.filter((name) => !sections.has(name) && !CORE_SECTIONS.includes(name))
+		.filter((name) => name !== RENAMED_VARIABLES && setsAnything(resolved[name]))
+		.filter((name) => !isDeepStrictEqual(resolved[name], defaults[name]))
+		.sort();
+}
+
+/** What each warn line named `event` names. */
+const named = (logger: RecordingLogger, event: string): unknown[] =>
+	logger.lines
+		.filter((line) => line.level === "warn" && line.args[1] === event)
+		.map((line) => line.args[0]);
+
+/** Each mode the README documents: its name, the configuration it selects, its environment. */
+const MODES = [
+	["development, as docker-compose.yml runs it", "development", { ...REQUIRED, ...COMPOSE }],
+	["development, every store in memory", "development", IN_MEMORY],
+	["production, one replica", "production", PRODUCTION],
+	[
+		"production, one replica, the Redis rate limiter",
+		"production",
+		{ ...PRODUCTION, ADAPTERS_RATE_LIMITER: "redis" },
+	],
+	["production, every store in memory", "production", IN_MEMORY],
+	["production, more than one replica", "production", MULTI],
+] as const;
+
+describe("the shipped files write no section for a module the mode does not load", () => {
+	it.each(MODES)("%s", (_mode, configEnv, env) => {
+		expect(sectionsNothingLoadedReads(configEnv, env)).toEqual([]);
+	});
+});
+
+describe("a boot of the shipped files that changes nothing of them names no section", () => {
+	it.each(MODES)("%s", async (_mode, configEnv, env) => {
+		const { logger, modules } = await bootShipped(configEnv, env);
+		expect(modules).not.toContain("federation-grants");
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+	});
+});

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -30,6 +30,7 @@ import {
 	registerBuiltinKeyStores,
 } from "@o3co/auth-provider-core";
 import { coreConfigForTests } from "@o3co/auth-provider-core/testing";
+import type { OAuthSection } from "@o3co/auth-provider-oauth";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
@@ -82,17 +83,13 @@ const config: AppConfig & Record<string, unknown> = {
 	// A composition with a consumer of session admission states what it
 	// expects (ADR 2026-09-28-session-admission): the shipped
 	// `application.conf` expects none, and so does this hand-built config.
-	...coreConfigForTests({ federations: { google: { enabled: false } } }),
+	...coreConfigForTests({ federations: { google: { enabled: false, type: "google" } } }),
 	oauth: {
 		jwt: {
 			issuer: "https://auth.test",
 		},
-		accessToken: { expiresIn: 3600 },
-		refreshToken: {
-			expiresIn: 86400,
-			unknownFamilyPolicy: "reject" as const,
-			legacyRtPolicy: "reject" as const,
-		},
+		accessToken: { defaultExpiresIn: 3600 },
+		refreshToken: { expiresIn: 86400 },
 		grants: {},
 		oidcMode: "oidc-required",
 		// No `authorize` section: the first-party invariant is unconditional.
@@ -312,19 +309,16 @@ describe("standalone smoke test", () => {
 		const issuerConfig: AppConfig = {
 			...config,
 			oauth: {
-				...config.oauth,
-				jwt: { ...config.oauth.jwt, issuer: "https://auth.example.com" },
+				...(config.oauth as OAuthSection),
+				jwt: { ...(config.oauth as OAuthSection).jwt, issuer: "https://auth.example.com" },
 			},
 		};
 		const handle = await createApp({
-			modules: buildModules(
-				{ ...switches, oauth: issuerConfig.oauth },
-				{
-					keyStoreModule: testKeyStoreModule,
-					repositoriesModule: testRepositoriesModule,
-					refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-				},
-			),
+			modules: buildModules(switches, {
+				keyStoreModule: testKeyStoreModule,
+				repositoriesModule: testRepositoriesModule,
+				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+			}),
 			bootstrapComponents: { config: issuerConfig, pathResolver: (s) => s },
 		});
 		handleRef = handle;
@@ -368,12 +362,9 @@ describe("standalone smoke test", () => {
 	});
 
 	// A freshly scaffolded app must boot under the default
-	// `core.federations.google.enabled = false`. `buildModules` includes
-	// `googleFederationModule` and its config bridge only when enabled, since
-	// the bridge throws at boot when `extractFederationSection` returns
-	// undefined. The manifest is asserted directly, so a bypassed gate fails
-	// even if the bridge is later made tolerant of `undefined`; then the
-	// handle must still boot.
+	// `core.federations.google.enabled = false`. The federation types the
+	// template bundles are loaded whatever the configuration says, and with no
+	// entry enabled they handle nothing: no federation is registered.
 	it("boots when google federation is disabled (default scaffold config)", async () => {
 		const modules = buildModules(switches, {
 			keyStoreModule: testKeyStoreModule,
@@ -381,15 +372,15 @@ describe("standalone smoke test", () => {
 			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 		});
 		const moduleNames = modules.map((m) => m.name);
-		expect(moduleNames).not.toContain("federation-google");
-		expect(moduleNames).not.toContain("google-federation-config");
+		expect(moduleNames).toContain("federation-google-type");
+		expect(moduleNames).toContain("federation-oidc");
 
 		const handle = await createApp({
 			modules,
 			bootstrapComponents: { config, pathResolver: (s) => s },
 		});
 		handleRef = handle;
-		expect(handle).toBeDefined();
+		expect(handle.components.federationProviders?.size ?? 0).toBe(0);
 	});
 
 	// The composition root must default to the Redis-backed RT family store
@@ -452,7 +443,7 @@ describe("standalone smoke test", () => {
 			});
 			const names = modules.map((m) => m.name);
 			expect(names).toContain("redis-session-stores");
-			expect(names).not.toContain("stores");
+			expect(names).not.toContain("standalone-in-memory-session-stores");
 			expect(names).toContain("redis-clients");
 		});
 
@@ -626,7 +617,7 @@ describe("standalone smoke test", () => {
 				subject: "u1",
 				expiresIn: 3600,
 				tokenType: "at+jwt",
-				issuer: config.oauth.jwt.issuer,
+				issuer: (config.oauth as OAuthSection).jwt.issuer,
 			},
 		);
 

package/templates/standalone/src/__tests__/store-credential.test.mts

@@ -33,7 +33,6 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { inspect } from "node:util";
 import {
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
@@ -43,19 +42,18 @@ import {
 	type UserRepository,
 } from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import express from "express";
 import request from "supertest";
 import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, type Switches } from "../configPath.mjs";
+import { resolveConfigPaths } from "../configPath.mjs";
 import { repositoriesModuleFor, templateReference } from "../modules.mjs";
 import { repositoriesSectionSchema } from "../sections.mjs";
 import {
+	type BothPhases,
+	bothPhasesOf,
 	capturedRenames,
 	libraryLayers,
-	rootSectionsOf,
-	sectionsCoreDoesNotDeclare,
 } from "./library-references.fixture.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
@@ -103,24 +101,21 @@ const recordingStore = async (
 };
 
 /** The shipped config for the production overlay, resolved against `env`. */
-const resolve = (env: Record<string, string>): Switches => {
+const resolve = (env: Record<string, string>): BothPhases => {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
 	const layers = parseFile(envConfPath, { env })
 		.withFallback(parseFile(applicationConfPath, { env }))
 		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
 		.withFallback(libraryLayers(env));
 	return {
-		...sectionsCoreDoesNotDeclare(layers),
-		...rootSectionsOf(layers, env),
-		...validate(layers, AppConfigSchema),
-		// What the resolution captured of core's renamed variables, which the
-		// schema's parse drops.
+		...bothPhasesOf(layers, env),
+		// What the resolution captured of the renamed variables.
 		"renamed-variables": capturedRenames(env),
-	} as Switches;
+	} as BothPhases;
 };
 
 /** The user repository the production `repositories` module builds from `config`'s section. */
-const userRepositoryFrom = (config: Switches): Promise<UserRepository> =>
+const userRepositoryFrom = (config: BothPhases): Promise<UserRepository> =>
 	Promise.resolve(
 		repositoriesModuleFor({
 			client: config.adapters.clientRepository,