@o3co/create-auth-provider 0.17.0-rc.1 → 0.17.0-rc.2

package/templates/standalone/src/__tests__/federation-grants-composition.test.mts

@@ -28,7 +28,6 @@
 
 import { fileURLToPath } from "node:url";
 import {
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
@@ -39,19 +38,18 @@ import {
 } from "@o3co/auth-provider-core";
 import { standardSmtpMailSenderConfigForTests } from "@o3co/auth-provider-standard/testing";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, type Switches } from "../configPath.mjs";
+import { resolveConfigPaths } from "../configPath.mjs";
 import { templateReference } from "../modules.mjs";
 import { installGracefulShutdown } from "../shutdown.mjs";
 import {
+	type BothPhases,
+	bothPhasesOf,
 	capturedRenames,
 	libraryLayers,
-	rootSectionsOf,
-	sectionsCoreDoesNotDeclare,
 } from "./library-references.fixture.mjs";
 
 // The same stand-ins `replica-safety.test.mts` boots under: no socket opens,
@@ -140,6 +138,7 @@ const ALL_REDIS_ENV: Readonly<Record<string, string>> = {
 	SESSION_STORE_STORAGE_REDIS_URL: "redis://redis.test:6379",
 	ADAPTERS_USER_SESSION_STORES: "redis",
 	ADAPTERS_RATE_LIMITER: "redis",
+	ADAPTERS_ATTEMPT_COUNTER: "redis",
 	ADAPTERS_CODE_REPOSITORY: "redis",
 	ADAPTERS_ACCESS_TOKEN_DENYLIST: "redis",
 	ADAPTERS_REPLAY_SEEN_SET: "redis",
@@ -156,29 +155,24 @@ const GRANTS_ON: Readonly<Record<string, string>> = {
 	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
 };
 
-function resolveConfig(env: Record<string, string>): Switches {
+function resolveConfig(env: Record<string, string>): BothPhases {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
 	const layers = parseFile(envConfPath, { env })
 		.withFallback(parseFile(applicationConfPath, { env }))
 		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
 		.withFallback(libraryLayers(env));
-	const config = {
-		...sectionsCoreDoesNotDeclare(layers),
-		...validate(layers, AppConfigSchema),
-		...rootSectionsOf(layers, env),
-	};
+	const config = bothPhasesOf(layers, env);
 	// The key ring has no environment form (a list of { id, key } is HOCON's);
 	// the Redis grant store refuses to construct without one under "required".
 	return {
 		...config,
-		// What the resolution captured of core's renamed variables, which the
-		// schema's parse drops.
+		// What the resolution captured of the renamed variables.
 		"renamed-variables": capturedRenames(env),
 		"redis-federation-grant-store": {
 			...(config["redis-federation-grant-store"] as object | undefined),
 			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
 		},
-	} as Switches;
+	} as BothPhases;
 }
 
 const testRepositoriesModule = defineModule({
@@ -204,7 +198,7 @@ const testKeyStoreModule = defineModule({
 	},
 });
 
-const modulesFor = (config: Switches, memoryOnly = false, environment?: string) =>
+const modulesFor = (config: BothPhases, memoryOnly = false, environment?: string) =>
 	buildModules(config, {
 		keyStoreModule: testKeyStoreModule,
 		repositoriesModule: testRepositoriesModule,
@@ -212,13 +206,13 @@ const modulesFor = (config: Switches, memoryOnly = false, environment?: string)
 		...(environment === undefined ? {} : { environment }),
 	});
 
-const boot = (config: Switches, memoryOnly = false, environment?: string) =>
+const boot = (config: BothPhases, memoryOnly = false, environment?: string) =>
 	createApp({
 		modules: modulesFor(config, memoryOnly, environment),
 		bootstrapComponents: { config, pathResolver: (s) => s },
 	});
 
-const names = (config: Switches, memoryOnly = false) =>
+const names = (config: BothPhases, memoryOnly = false) =>
 	modulesFor(config, memoryOnly).map((m) => m.name);
 
 /**
@@ -322,7 +316,7 @@ describe("the standalone composes federation grants from its config", () => {
 		);
 		expect(installed).not.toContain("redis-federation-grant-store");
 		expect(installed).not.toContain("redis-federation-grant-intent-store");
-		// Listed ahead of oauthModule, as the template writes them: the
+		// Listed ahead of oauthEndpointsModule, as the template writes them: the
 		// template's choice, since each module parses its own bodies and the
 		// order does not change that; the browser half sits after the session
 		// middleware by its own `after`.
@@ -399,7 +393,7 @@ describe("the standalone composes federation grants from its config", () => {
 				upstreamHardTimeoutMs: 60_000,
 				refreshLockTtlMs: 65_000,
 			},
-		} as Switches;
+		} as BothPhases;
 		handleRef = await boot(raised, true);
 		expect(handleRef.cleanupAllowanceMs).toBe(60_000 + 3_000 + 5_000 + 12_000);
 
@@ -619,7 +613,7 @@ describe("the browser consent route parses its own body, with sessionModule list
 	});
 
 	/** The standalone's modules, with `sessionModule` moved ahead of the grant modules. */
-	const sessionFirst = (config: Switches) => {
+	const sessionFirst = (config: BothPhases) => {
 		const modules = modulesFor(config, true);
 		const session = modules.find((m) => m.name === "session");
 		if (session === undefined) throw new Error("sessionModule is not in the standalone's list");
@@ -693,7 +687,7 @@ describe("the grants consent answer is held to the session module's CSRF guard",
 		const trusting = {
 			...config,
 			session: { ...session, csrf: { ...session.csrf, trustedOrigins: [SIBLING] } },
-		} as Switches;
+		} as BothPhases;
 		handleRef = await boot(trusting, true);
 		return express().set("trust proxy", "loopback").use(handleRef.router);
 	};

package/templates/standalone/src/__tests__/federation-grants-survive-logout.test.mts

@@ -17,9 +17,8 @@
 /**
  * A federation grant outlives the session it was agreed through, at both HTTP
  * logout endpoints (ADR 2026-09-17-federation-grants-offline-delegation).
- * `/oauth/logout` runs `cascadeLogout()`; `/session/logout` has its own record
- * hygiene (`invalidateSessionRecords`) and reaches the grant store on no path,
- * by construction. A proof of the helper is not a proof of the endpoints, so
+ * Both close the session through core's session lifecycle, whose close work
+ * reaches the grant store on no path, by construction. A proof of the helper is not a proof of the endpoints, so
  * this drives both, on the standalone, as a deployment composes them: a grant
  * seeded beside a live browser session, the session's records gone afterwards,
  * the grant and its credential exactly as they were, and `/token` still
@@ -35,7 +34,6 @@ import { createHmac } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import {
 	type AppConfig,
-	AppConfigSchema,
 	createApp,
 	createKeyStoreFactory,
 	defineModule,
@@ -51,18 +49,17 @@ import {
 	type UserSessionStore,
 } from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
-import { validate } from "@o3co/ts.hocon/zod";
 import express from "express";
 import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths, type Switches } from "../configPath.mjs";
+import { resolveConfigPaths } from "../configPath.mjs";
 import { templateReference } from "../modules.mjs";
 import {
+	type BothPhases,
+	bothPhasesOf,
 	capturedRenames,
 	libraryLayers,
-	rootSectionsOf,
-	sectionsCoreDoesNotDeclare,
 } from "./library-references.fixture.mjs";
 
 const DAY = 86_400_000;
@@ -122,19 +119,16 @@ const ENV: Readonly<Record<string, string>> = {
  * that have no environment form written over it: the
  * upstream federation the connection names, and the connection.
  */
-function resolveConfig(): Switches {
+function resolveConfig(): BothPhases {
 	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
 	const layers = parseFile(envConfPath, { env: ENV })
 		.withFallback(parseFile(applicationConfPath, { env: ENV }))
 		.withFallback(parseFile(fileURLToPath(templateReference()), { env: ENV }))
 		.withFallback(libraryLayers(ENV));
-	const config = validate(layers, AppConfigSchema);
+	const config = bothPhasesOf(layers, ENV);
 	return {
-		...sectionsCoreDoesNotDeclare(layers),
-		...rootSectionsOf(layers, ENV),
 		...config,
-		// What the resolution captured of core's renamed variables, which the
-		// schema's parse drops.
+		// What the resolution captured of the renamed variables.
 		"renamed-variables": capturedRenames(ENV),
 		core: {
 			...config.core,
@@ -174,7 +168,7 @@ function resolveConfig(): Switches {
 				},
 			},
 		},
-	} as Switches;
+	} as BothPhases;
 }
 
 const testRepositoriesModule = defineModule({

package/templates/standalone/src/__tests__/federation-token-refresh-outage.test.mts

@@ -94,7 +94,7 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 	}
 
 	it("keeps them and answers 503 when Google answers 503 with a body naming invalid_grant", async () => {
-		const { res, sid, federationTokenStore, sessionFederationIndex } = await refreshAnswered(503, {
+		const { res, sid, federationTokenStore, sessionLifecycle } = await refreshAnswered(503, {
 			error: "invalid_grant",
 			error_description: "Backend unavailable",
 		});
@@ -107,7 +107,10 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 		expect((await federationTokenStore.get(sid, "google"))?.refreshToken).toBe(
 			STORED_REFRESH_TOKEN,
 		);
-		expect(await sessionFederationIndex.listFederations(sid)).toContain("google");
+		expect(await sessionLifecycle.federations(sid)).toEqual({
+			outcome: "listed",
+			federations: ["google"],
+		});
 	});
 
 	it("keeps them and answers 503 when Google answers 502 with no OAuth body at all", async () => {
@@ -120,7 +123,7 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 	});
 
 	it("ends them on Google's structured 400 invalid_grant", async () => {
-		const { res, sid, federationTokenStore, sessionFederationIndex } = await refreshAnswered(400, {
+		const { res, sid, federationTokenStore, sessionLifecycle } = await refreshAnswered(400, {
 			error: "invalid_grant",
 			error_description: "Token has been expired or revoked.",
 		});
@@ -130,6 +133,9 @@ describe("POST /oauth/federation/google/token: an upstream outage never ends the
 		expect(await federationTokenStore.get(sid, "google")).toBeNull();
 		// The route never writes the session's index: the link, now holding no
 		// credential, stays listed until federation logout or the session's end.
-		expect(await sessionFederationIndex.listFederations(sid)).toContain("google");
+		expect(await sessionLifecycle.federations(sid)).toEqual({
+			outcome: "listed",
+			federations: ["google"],
+		});
 	});
 });

package/templates/standalone/src/__tests__/federation-types.test.mts

@@ -0,0 +1,239 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The federations the template ships are handled by the modules of their
+ * types. The template loads the federation types it bundles, `google` and
+ * `oidc`, whatever the configuration enables, and core dispatches each
+ * enabled `core.federations` entry to the module of its `type`, under the
+ * entry's name: two entries of one type are two federations. The template
+ * reads no entry before boot, so a malformed one is core's to refuse, at its
+ * path.
+ */
+
+import { mkdtempSync, readdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import request from "supertest";
+import { afterEach, describe, expect, it } from "vitest";
+import { buildModules } from "#/buildModules.mjs";
+import { readOwnLayers, readSwitches, resolveConfigPaths, resolveLayers } from "#/configPath.mjs";
+import {
+	type Composition,
+	compose,
+	ISSUER,
+	ownFiles,
+	resolveConfig,
+	SINGLE_ENV,
+} from "./all-modules-composition.fixture.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+/** Google's authorization endpoint, where a Google federation's start sends the browser. */
+const GOOGLE_AUTHORIZE = "https://accounts.google.com/o/oauth2/v2/auth";
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+});
+
+/** Boots and remembers the composition, so `afterEach` disposes it. */
+async function boot(options: Parameters<typeof compose>[0] = {}): Promise<Composition> {
+	current = await compose(options);
+	return current;
+}
+
+/** What `compose` refuses under `options`. */
+async function refusal(options: Parameters<typeof compose>[0]): Promise<{
+	readonly reason?: string;
+	readonly message: string;
+}> {
+	try {
+		current = await compose(options);
+	} catch (err) {
+		return err as { reason?: string; message: string };
+	}
+	throw new Error("the composition booted");
+}
+
+/** `text` in a file of its own, for a layer above the composition's files. */
+function hoconFile(text: string): string {
+	const file = join(mkdtempSync(join(tmpdir(), "federation-types-")), "operator.conf");
+	writeFileSync(file, text);
+	return file;
+}
+
+/** The module names `buildModules` lists for `env`, federation ones only. */
+const federationModules = (env: Readonly<Record<string, string>>): string[] =>
+	buildModules(resolveConfig(env))
+		.map((module) => module.name)
+		.filter((name) => name.startsWith("federation-") && !name.startsWith("federation-grant"));
+
+/** Where the start of federation `name` sends the browser. */
+async function startOf(composed: Composition, name: string): Promise<URL> {
+	const res = await request(composed.app).get(`/session/oauth/federation/${name}`);
+	expect(res.status).toBe(302);
+	return new URL(res.headers.location as string);
+}
+
+describe("the federation types the template bundles", () => {
+	it("are listed whatever the configuration enables", () => {
+		const off = {
+			...SINGLE_ENV,
+			CORE_FEDERATIONS_GOOGLE_ENABLED: "false",
+			CORE_FEDERATIONS_OIDC_ENABLED: "false",
+		};
+		expect(federationModules(off)).toEqual(["federation-google-type", "federation-oidc"]);
+		expect(federationModules(SINGLE_ENV)).toEqual(["federation-google-type", "federation-oidc"]);
+	});
+
+	it("handle every entry the template ships, each of which names its type", () => {
+		const { applicationConfPath } = resolveConfigPaths(configDir, "production");
+		const resolved = resolveLayers(readOwnLayers([applicationConfPath], { env: {} }), []) as {
+			core?: { federations?: Record<string, { type?: unknown }> };
+		};
+		const types = Object.fromEntries(
+			Object.entries(resolved.core?.federations ?? {}).map(([name, entry]) => [name, entry.type]),
+		);
+		expect(types).toEqual({ google: "google", oidc: "oidc" });
+	});
+
+	it("boot the shipped Google federation, enabled, as the provider named google that its type built", async () => {
+		const composed = await boot();
+		const names = composed.modules.map((module) => module.name);
+		expect(names).toContain("federation-google-type");
+		expect(names).not.toContain("federation-google");
+		expect(composed.handle.components.federationProviders?.get("google")?.name).toBe("google");
+
+		const start = await startOf(composed, "google");
+		expect(`${start.origin}${start.pathname}`).toBe(GOOGLE_AUTHORIZE);
+		expect(start.searchParams.get("client_id")).toBe(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID);
+		expect(start.searchParams.get("redirect_uri")).toBe(
+			"http://localhost:3000/session/oauth/federation/google/callback",
+		);
+	});
+
+	it("boot a second entry of type google, under its own name, beside the shipped one", async () => {
+		const callbackURL = `${ISSUER}/session/oauth/federation/google-work/callback`;
+		const composed = await boot({
+			operatorHocon: `core.federations.google-work {
+  enabled = true
+  type = "google"
+  clientId = "google-work-client"
+  clientSecret = "google-work-secret"
+  callbackURL = ${JSON.stringify(callbackURL)}
+}
+`,
+		});
+		const providers = composed.handle.components.federationProviders;
+		expect([...(providers?.keys() ?? [])].sort()).toEqual(["google", "google-work", "oidc"]);
+		expect(providers?.get("google-work")?.name).toBe("google-work");
+
+		const work = await startOf(composed, "google-work");
+		expect(`${work.origin}${work.pathname}`).toBe(GOOGLE_AUTHORIZE);
+		expect(work.searchParams.get("client_id")).toBe("google-work-client");
+		expect(work.searchParams.get("redirect_uri")).toBe(callbackURL);
+		const shipped = await startOf(composed, "google");
+		expect(shipped.searchParams.get("client_id")).toBe(
+			SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID,
+		);
+	});
+
+	it("hand an entry to the type it names, not the type its name reads as", async () => {
+		// `google` of type `oidc` is a generic OIDC federation named google.
+		const composed = await boot({
+			operatorHocon: `core.federations.google { type = "oidc", issuer = ${JSON.stringify(SINGLE_ENV.CORE_FEDERATIONS_OIDC_ISSUER)} }\n`,
+		});
+		const start = await startOf(composed, "google");
+		expect(start.origin).toBe(SINGLE_ENV.CORE_FEDERATIONS_OIDC_ISSUER);
+		expect(start.searchParams.get("client_id")).toBe(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID);
+	});
+
+	it("register the type of every entry each shipped configuration file writes", () => {
+		const registered = new Set(
+			buildModules(resolveConfig(SINGLE_ENV)).flatMap((module) =>
+				Object.keys(module.contributes?.federationTypes ?? {}),
+			),
+		);
+		const written = readdirSync(configDir)
+			.filter((file) => file.endsWith(".conf"))
+			.flatMap((file) => {
+				const resolved = resolveLayers(readOwnLayers([join(configDir, file)], { env: {} }), []) as {
+					core?: { federations?: Record<string, { type?: unknown }> };
+				};
+				return Object.entries(resolved.core?.federations ?? {}).map(([name, entry]) => ({
+					file,
+					name,
+					type: entry.type,
+				}));
+			});
+		expect(written).not.toEqual([]);
+		expect(written.filter(({ type }) => typeof type !== "string" || !registered.has(type))).toEqual(
+			[],
+		);
+	});
+});
+
+describe("the template reads no federation entry before boot", () => {
+	it("passes a malformed entry through phase one, and boot refuses it at its path", async () => {
+		const operatorHocon = 'core.federations.okta { enabled = "maybe", type = "oidc" }\n';
+		expect(() =>
+			readSwitches(readOwnLayers([hoconFile(operatorHocon), ...ownFiles()], { env: SINGLE_ENV })),
+		).not.toThrow();
+		const err = await refusal({ operatorHocon });
+		expect(err.reason).toBe("config-validation-failed");
+		expect(err.message).toContain("core.federations.okta.enabled");
+	});
+
+	it.each([
+		["accessType", '"sometimes"'],
+		// A bare string where a list belongs: the natural typo.
+		["redirectAllowlist", '"https://app.test/home"'],
+		["sessionDomain", "42"],
+		["requireAuthorizationResponseIss", '"no"'],
+		// Only an environment variable's string is read as a flag's spelling.
+		["requireAuthorizationResponseIss", "1"],
+		["requireAuthorizationResponseIss", "[true]"],
+	])(
+		"leaves %s, a key of the entry's type, to the type's schema, which core refuses it by, at its path",
+		async (key, value) => {
+			const err = await refusal({ operatorHocon: `core.federations.google.${key} = ${value}\n` });
+			expect(err.reason).toBe("config-validation-failed");
+			expect(err.message).toContain(`core.federations.google.${key}`);
+		},
+	);
+});
+
+describe("an enabled Google federation's credentials", () => {
+	it.each([
+		["unset", undefined],
+		["exported empty", ""],
+	])(
+		"refuse the boot when the client secret is %s, at its path, quoting no value of the entry",
+		async (_case, secret) => {
+			const { CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: _shipped, ...env } = SINGLE_ENV;
+			const err = await refusal({
+				env: secret === undefined ? env : { ...env, CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: secret },
+			});
+			expect(err.reason).toBe("config-validation-failed");
+			expect(err.message).toContain("core.federations.google.clientSecret");
+			expect(err.message).not.toContain(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID as string);
+		},
+	);
+});