@o3co/create-auth-provider 0.17.0-rc.1 → 0.17.0-rc.3

package/templates/standalone/src/__tests__/all-modules-composition.test.mts

@@ -34,11 +34,10 @@
  */
 
 import { readdirSync, readFileSync } from "node:fs";
-import { federationsOf } from "@o3co/auth-provider-core";
+import { type AppConfig, federationsOf } from "@o3co/auth-provider-core";
 import type express from "express";
 import request from "supertest";
 import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
-import type { Switches } from "#/configPath.mjs";
 import {
 	ALICE,
 	AS_LISTED,
@@ -107,17 +106,17 @@ async function boot(options: Parameters<typeof compose>[0] = {}): Promise<Compos
 const TEMPLATE_PACKAGES: Readonly<Record<string, string>> = {
 	"@o3co/auth-provider-core":
 		"jwksModule, the memory stores, the refresh-token family rotation and revocation",
-	"@o3co/auth-provider-federation-google": "googleFederationModule",
+	"@o3co/auth-provider-federation-google": "googleFederationTypeModule, the google type",
 	"@o3co/auth-provider-federation-grants": "federationGrantsModules",
-	"@o3co/auth-provider-federation-oidc": "oidcFederationModule, one per `oidc` section",
+	"@o3co/auth-provider-federation-oidc": "oidcFederationTypeModule, the oidc type",
 	"@o3co/auth-provider-foundation":
 		"the HTTP user repository adapter; foundationMfaFactorStoreModule under MFA_MODE with adapters.mfaFactorStore = store (tools/composition boots it)",
 	"@o3co/auth-provider-mfa":
 		"mfaModules (mfaTotpFactorModule, mfaRecoveryCodeFactorModule, mfaEmailFactorModule, mfaModule) and mfaResetModule, under MFA_MODE (mfa-switch.test.mts)",
 	"@o3co/auth-provider-oauth":
-		"oauthModule, oauthSessionModule, oauthAuthorizationModule, subjectRevocationServiceModule",
+		"oauthEndpointsModule, oauthSessionGrantModule, oauthAuthorizationGrantsModule, subjectRevocationServiceModule",
 	"@o3co/auth-provider-redis": "the Redis stores (all-modules-composition.multi.test.mts)",
-	"@o3co/auth-provider-session": "sessionModule, sessionStoreModuleFor",
+	"@o3co/auth-provider-session": "sessionModule, sessionStoreModule",
 	"@o3co/auth-provider-standard":
 		"standardSmtpMailSenderModule; standardDevelopmentMailSenderModule in development",
 };
@@ -131,10 +130,10 @@ const TEMPLATE_PACKAGES: Readonly<Record<string, string>> = {
  * here, through this file's fixture.
  */
 const NOT_IN_TEMPLATE: Readonly<Record<string, string>> = {
-	"@o3co/auth-provider-device-grant": "deviceGrantModule",
+	"@o3co/auth-provider-device-grant": "deviceAuthorizationGrantModule",
 	"@o3co/auth-provider-dpop": "dpopModule",
-	"@o3co/auth-provider-federation-apple": "appleFederationModule",
-	"@o3co/auth-provider-federation-github": "githubFederationModule",
+	"@o3co/auth-provider-federation-apple": "appleFederationTypeModule",
+	"@o3co/auth-provider-federation-github": "githubFederationTypeModule",
 	"@o3co/auth-provider-mtls": "mtlsModule",
 	"@o3co/auth-provider-oauth-token-exchange": "tokenExchangeModule",
 	"@o3co/auth-provider-test-kit": "no module: contract suites and fakes, for tests",
@@ -184,10 +183,8 @@ const ALL_ON_MODULES = [
 	"oauth-authorization",
 	"jwks",
 	"session",
-	"federation-google",
-	"google-federation-config",
-	"oidc-federation-config",
-	"federation-oidc-oidc",
+	"federation-google-type",
+	"federation-oidc",
 	"logging",
 	"http",
 	"key-store",
@@ -198,6 +195,7 @@ const ALL_ON_MODULES = [
 	"core-federation-grant-store-memory",
 	"core-federation-grant-intent-store-memory",
 	"standalone-in-memory-session-stores",
+	"core-session-lifecycle",
 	"core-rate-limiter-memory",
 	"standalone-in-memory-code-repository",
 	"core-access-token-denylist-memory",
@@ -237,13 +235,18 @@ describe("every module the template can turn on boots together", () => {
 		);
 	});
 
-	it("registers every federation and every grant a module contributes", async () => {
+	it("registers a federation for every enabled entry of a type a module contributes, and every grant", async () => {
 		const { modules, handle, app } = await boot();
-		const federations = modules.flatMap((m) => contributionNames(m, "federations")).sort();
-		expect(federations).toEqual(["google", "oidc"]);
-		expect([...(handle.components.federationProviders?.keys() ?? [])].sort()).toEqual(federations);
-
-		const grants = modules.flatMap((m) => contributionNames(m, "grants")).sort();
+		const types = modules.flatMap((m) => contributionNames(m, "federationTypes")).sort();
+		expect(types).toEqual(["google", "oidc"]);
+		// The shipped entries are named after their types.
+		expect([...(handle.components.federationProviders?.keys() ?? [])].sort()).toEqual(types);
+
+		// What boot registered: a module's grant switched off by its section
+		// answers `null` and registers nothing.
+		const grants = [...(handle.components.grantHandlerResolver?.entries() ?? [])]
+			.map(([grantType]) => grantType)
+			.sort();
 		expect(grants).toEqual(ENABLED_GRANTS);
 		const discovery = await request(app).get("/.well-known/openid-configuration");
 		expect([...discovery.body.grant_types_supported].sort()).toEqual(grants);
@@ -387,18 +390,21 @@ describe("discovery", () => {
 	});
 
 	/** The grant connections dropped: they name the OIDC federation. */
-	const withoutConnections = (config: Switches): Switches =>
+	const withoutConnections = (config: AppConfig): AppConfig =>
 		({
 			...config,
-			"federation-grants": { ...config["federation-grants"], connections: {} },
-		}) as Switches;
+			"federation-grants": {
+				...(config["federation-grants"] as Record<string, unknown>),
+				connections: {},
+			},
+		}) as AppConfig;
 
 	const FEATURE_SWITCHES: ReadonlyArray<
 		readonly [
 			feature: string,
 			variable: string,
 			path: string,
-			config: ((config: Switches) => Switches) | undefined,
+			config: ((config: AppConfig) => AppConfig) | undefined,
 		]
 	> = [
 		["federation grants", "FEDERATION_GRANTS_ENABLED", "/oauth/federation-grants", undefined],
@@ -579,13 +585,13 @@ describe("every module's primary route answers in the one app", () => {
 	knownDefect(
 		"a federation enabled from the documented variables alone either refuses to boot or completes a login",
 		async () => {
-			const withoutLanding = (config: Switches): Switches => {
+			const withoutLanding = (config: AppConfig): AppConfig => {
 				const federations = federationsOf(config) as Record<string, Record<string, unknown>>;
 				const { clientUrl: _dropped, ...oidc } = federations.oidc ?? {};
 				return {
 					...config,
 					core: { ...config.core, federations: { ...federations, oidc } },
-				} as unknown as Switches;
+				} as unknown as AppConfig;
 			};
 			let composed: Composition;
 			try {
@@ -609,7 +615,7 @@ describe("every module's primary route answers in the one app", () => {
 		},
 	);
 
-	it("a federation grant is lodged, beside oauthModule under /oauth", async () => {
+	it("a federation grant is lodged, beside oauthEndpointsModule under /oauth", async () => {
 		const { app } = await boot();
 		const res = await lodgeGrant(app);
 		expect(res.status).toBe(201);
@@ -651,7 +657,7 @@ describe.each([AS_LISTED, REVERSED] satisfies ModuleOrder[])(
 		});
 
 		it.each(TRANSFERS)(
-			"federation grants keep their 16 KiB bound beneath oauthModule's /oauth, a body sent %s",
+			"federation grants keep their 16 KiB bound beneath oauthEndpointsModule's /oauth, a body sent %s",
 			async (_transfer, send) => {
 				for (const type of [JSON_TYPE, FORM_TYPE]) {
 					const body =
@@ -823,6 +829,16 @@ const oidcCallback = async (app: express.Express, outage: Outage, c: Composition
 const VERIFIER_WARN =
 	"core's verifier (`verifyJwt`, `packages/core/src/jwt/verify.mts`) writes its own `jwt_verify_rejected` warn (`reason: \"revocation_unavailable\"`) beside the route's error line: two lines for one outage (the runbook's outage table documents both)";
 
+/** The CSRF token the session middleware set in `cookies`, for a request that mutates. */
+const csrfTokenOf = (cookies: readonly string[]): string => {
+	const cookie = cookies.find((c) => /^[^=]*\.csrf=/.test(c));
+	if (cookie === undefined) throw new Error("the login reissued no CSRF cookie");
+	return decodeURIComponent(cookie.slice(cookie.indexOf("=") + 1).split(";")[0] ?? "");
+};
+
+const ROLLBACK_CLOSE_LOGS =
+	"a login that fails after its record's open closes that record (`packages/session/src/establish-session.mts`), and the close's own work meets the same outage: core's session lifecycle (`packages/core/src/session-lifecycle/service.mts`) warns `session_close_item_failed` for the item and keeps the close pending for its sweep, a second line for one outage";
+
 const OUTAGES: readonly OutageCase[] = [
 	{
 		module: "oauth-authorization",
@@ -832,22 +848,6 @@ const OUTAGES: readonly OutageCase[] = [
 		answer: { status: 503, error: "temporarily_unavailable" },
 		event: "authorization_grant_store_unavailable",
 	},
-	{
-		module: "oauth-authorization",
-		slot: "sessionFamilyIndex",
-		surface: "the code exchange",
-		run: codeExchange,
-		answer: { status: 503, error: "temporarily_unavailable" },
-		event: "authorization_grant_store_unavailable",
-	},
-	{
-		module: "oauth-authorization",
-		slot: "sessionRPRegistry",
-		surface: "the code exchange",
-		run: codeExchange,
-		answer: { status: 503, error: "temporarily_unavailable" },
-		event: "authorization_grant_store_unavailable",
-	},
 	{
 		module: "oauth",
 		slot: "codeRepository",
@@ -925,6 +925,47 @@ const OUTAGES: readonly OutageCase[] = [
 		event: "userinfo_store_unavailable",
 		unrelatedWarns: ["jwt_verify_aud_skipped"],
 	},
+	{
+		module: "oauth",
+		slot: "sessionLifecycleStore",
+		surface: "/oauth/userinfo",
+		run: async (app, outage) => {
+			const { access_token } = await webTokens(app);
+			outage.down = true;
+			return request(app).get("/oauth/userinfo").set("Authorization", `Bearer ${access_token}`);
+		},
+		answer: { status: 503, error: "temporarily_unavailable" },
+		event: "userinfo_store_unavailable",
+		unrelatedWarns: ["jwt_verify_aud_skipped"],
+	},
+	{
+		module: "oauth",
+		slot: "sessionLifecycleStore",
+		surface: "POST /oauth/logout",
+		run: async (app, outage) => {
+			const { id_token } = await webTokens(app);
+			outage.down = true;
+			return request(app).post("/oauth/logout").type("form").send({ id_token_hint: id_token });
+		},
+		answer: { status: 503, error: "temporarily_unavailable" },
+		event: "logout_store_unavailable",
+		unrelatedWarns: ["jwt_verify_aud_skipped"],
+	},
+	{
+		module: "session",
+		slot: "sessionLifecycleStore",
+		surface: "POST /session/logout",
+		run: async (app, outage) => {
+			const { cookies } = await login(app);
+			outage.down = true;
+			return request(app)
+				.post("/session/logout")
+				.set("Cookie", cookies)
+				.set("x-csrf-token", csrfTokenOf(cookies));
+		},
+		answer: { status: 503, error: "temporarily_unavailable" },
+		event: "session_logout_store_unavailable",
+	},
 	{
 		module: "oauth-session",
 		slot: "userSessionStore",
@@ -981,6 +1022,7 @@ const OUTAGES: readonly OutageCase[] = [
 		},
 		answer: { status: 503, error: "temporarily_unavailable" },
 		event: "login_store_unavailable",
+		defects: { "no-warn": ROLLBACK_CLOSE_LOGS },
 	},
 	{
 		module: "session",
@@ -1041,14 +1083,7 @@ const OUTAGES: readonly OutageCase[] = [
 		run: oidcCallback,
 		answer: { status: 503, error: "temporarily_unavailable" },
 		event: "federation_callback_store_unavailable",
-	},
-	{
-		module: "session",
-		slot: "sessionFederationIndex",
-		surface: "the OIDC federation callback",
-		run: oidcCallback,
-		answer: { status: 503, error: "temporarily_unavailable" },
-		event: "federation_callback_store_unavailable",
+		defects: { "no-warn": ROLLBACK_CLOSE_LOGS },
 	},
 	{
 		module: "core (rate-limit guard)",

package/templates/standalone/src/__tests__/audit-sink.test.mts

@@ -28,6 +28,7 @@
 import { generateKeyPairSync } from "node:crypto";
 import { readFileSync } from "node:fs";
 import {
+	type AppConfig,
 	type AuditEvent,
 	type AuditSink,
 	createApp,
@@ -54,8 +55,12 @@ const keyPair = generateKeyPairSync("ed25519", {
 	privateKeyEncoding: { type: "pkcs8", format: "pem" },
 });
 
-/** The template modules' sections sit beside core's, so the configuration is wider than `AppConfig`. */
-const baseConfig: Switches & Record<string, unknown> = {
+/**
+ * Phase one's switches beside the configuration boot is handed; the template
+ * modules' sections sit beside core's, so the configuration is wider than
+ * `AppConfig`.
+ */
+const baseConfig: Switches & AppConfig & Record<string, unknown> = {
 	// The shipped selections, every store in this process.
 	adapters: {
 		...shippedAdapters(),
@@ -85,17 +90,13 @@ const baseConfig: Switches & Record<string, unknown> = {
 	},
 	// The shipped `application.conf` expects no session requirement (ADR
 	// 2026-09-28-session-admission).
-	...coreConfigForTests({ federations: { google: { enabled: false } } }),
+	...coreConfigForTests({ federations: { google: { enabled: false, type: "google" } } }),
 	oauth: {
 		jwt: {
 			issuer: "https://auth.test",
 		},
-		accessToken: { expiresIn: 3600 },
-		refreshToken: {
-			expiresIn: 86400,
-			unknownFamilyPolicy: "reject" as const,
-			legacyRtPolicy: "reject" as const,
-		},
+		accessToken: { defaultExpiresIn: 3600 },
+		refreshToken: { expiresIn: 86400 },
 		grants: {},
 		oidcMode: "oidc-required",
 	},

package/templates/standalone/src/__tests__/config-notices.test.mts

@@ -0,0 +1,157 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Core's notices about configuration nothing loaded reads, through the
+ * template's own reading: the template hands boot the configuration's
+ * defaults (`configDefaultsFor`), and core alone decides what is named. A
+ * section the template's `reference.conf` sets for a module the composition
+ * does not load is silent while it is as that file sets it, and
+ * `config_sections_not_loaded` once the operator's layer or the environment
+ * changes it; a section no loaded package sets is `config_sections_ignored`;
+ * a renamed variable no loaded module declares is
+ * `environment_variables_not_applied`.
+ */
+
+import { fileURLToPath } from "node:url";
+import { moduleReferences } from "@o3co/auth-provider-core";
+import { parseFile } from "@o3co/ts.hocon";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { configDefaultsFor } from "#/configPath.mjs";
+import {
+	type ComposeOptions,
+	type Composition,
+	compose,
+	composedModules,
+	type RecordingLogger,
+	resolveConfig,
+	SINGLE_ENV,
+} from "./all-modules-composition.fixture.mjs";
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+	vi.unstubAllEnvs();
+});
+
+const boot = async (options: ComposeOptions): Promise<Composition> => {
+	current = await compose(options);
+	return current;
+};
+
+/** What each warn line named `event` names: its `sections` or `variables`. */
+const named = (logger: RecordingLogger, event: string): unknown[] =>
+	logger.lines
+		.filter((line) => line.level === "warn" && line.args[1] === event)
+		.map((line) => line.args[0]);
+
+/** `redis-clients` is the template's module, which no store on Redis loads under SINGLE_ENV. */
+const NOT_LOADED = "redis-clients";
+
+describe("a section the template's reference.conf sets for a module the composition does not load", () => {
+	it("is handed to boot and named by nothing while it is as that file sets it", async () => {
+		const { logger, resolved, modules } = await boot({ env: SINGLE_ENV });
+		expect(modules.map((m) => m.name)).not.toContain(NOT_LOADED);
+		expect(resolved).toHaveProperty([NOT_LOADED]);
+		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+	});
+
+	it("is config_sections_not_loaded once the operator's layer changes it", async () => {
+		const { logger } = await boot({
+			env: SINGLE_ENV,
+			operatorHocon: `${NOT_LOADED}.url = "redis://elsewhere.test:6379"\n`,
+		});
+		expect(named(logger, "config_sections_not_loaded")).toEqual([{ sections: [NOT_LOADED] }]);
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+	});
+
+	it("is config_sections_not_loaded once the environment changes it, and the variable environment_variables_not_applied", async () => {
+		const { logger } = await boot({
+			env: { ...SINGLE_ENV, REDIS_CLIENTS_URL: "redis://elsewhere.test:6379" },
+		});
+		expect(named(logger, "config_sections_not_loaded")).toEqual([{ sections: [NOT_LOADED] }]);
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+		expect(named(logger, "environment_variables_not_applied")).toEqual([
+			{ variables: ["REDIS_CLIENTS_URL"] },
+		]);
+	});
+});
+
+describe("the limiter sections the template's reference.conf writes for both limiters", () => {
+	it.each(["memory", "redis"] as const)(
+		"are named by nothing with the %s limiter wired",
+		async (rateLimiter) => {
+			const { logger, modules } = await boot({
+				env: { ...SINGLE_ENV, ADAPTERS_RATE_LIMITER: rateLimiter },
+			});
+			expect(modules.map((m) => m.name)).toContain(
+				rateLimiter === "redis" ? "redis-rate-limiter" : "core-rate-limiter-memory",
+			);
+			expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+			expect(named(logger, "config_sections_ignored")).toEqual([]);
+		},
+	);
+});
+
+describe("a section no loaded package's reference.conf sets", () => {
+	it("is config_sections_ignored: a misspelt section name", async () => {
+		const { logger } = await boot({
+			env: SINGLE_ENV,
+			operatorHocon: 'redis-client.url = "redis://elsewhere.test:6379"\n',
+		});
+		expect(named(logger, "config_sections_ignored")).toEqual([{ sections: ["redis-client"] }]);
+		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+	});
+});
+
+describe("a renamed variable a loaded package captures and no loaded module declares", () => {
+	it("is environment_variables_not_applied: RATE_LIMIT_FAIL_MODE with the Redis package loaded but not its rate limiter", async () => {
+		const { logger, modules } = await boot({
+			env: { ...SINGLE_ENV, ADAPTERS_CODE_REPOSITORY: "redis", RATE_LIMIT_FAIL_MODE: "closed" },
+		});
+		expect(modules.map((m) => m.name)).not.toContain("redis-rate-limiter");
+		expect(named(logger, "environment_variables_not_applied")).toEqual([
+			{ variables: ["RATE_LIMIT_FAIL_MODE"] },
+		]);
+		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
+		expect(named(logger, "config_sections_ignored")).toEqual([]);
+	});
+});
+
+describe("configDefaultsFor", () => {
+	const modules = composedModules(resolveConfig(SINGLE_ENV));
+
+	it("is every loaded package's reference.conf, core's last, resolved with no environment", () => {
+		const references = moduleReferences(modules).map((reference) =>
+			parseFile(fileURLToPath(reference), { env: {} }),
+		);
+		const expected = references
+			.slice(1)
+			.reduce((config, next) => config.withFallback(next), references[0]);
+		expect(configDefaultsFor(modules)).toEqual(expected?.toObject());
+	});
+
+	it("takes nothing from the process's environment", () => {
+		vi.stubEnv("REDIS_CLIENTS_URL", "redis://operator.test:6379");
+		expect(configDefaultsFor(modules)[NOT_LOADED]).toEqual({
+			url: "redis://localhost:6379",
+			assumeNoEviction: false,
+		});
+	});
+});

package/templates/standalone/src/__tests__/configured-mfa-mode.fixture.mts

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The MFA switch, `mfaMode`, as this project's own configuration files write
+ * it with `MFA_MODE` unset: `{environment}.conf` over `application.conf` over
+ * the template's `config/reference.conf`. The template ships it `required`;
+ * a project `create-auth-provider --no-mfa` scaffolds writes it `off` at the
+ * end of its `application.conf`. A suite whose subject depends on the switch
+ * asserts what MFA on (`required`, as the template ships it) or off (as
+ * `--no-mfa` writes it) implies, so the suite that ships with a scaffold holds
+ * in either project. A project whose files write another mode, such as
+ * `optional`, is not what these suites claim to cover.
+ *
+ * Read with the HOCON parser alone, not through phase one (`readSwitches`),
+ * so that a suite about phase one can state what phase one should answer.
+ */
+
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { type Config, empty, parseFile } from "@o3co/ts.hocon";
+import { type MfaSwitch, mfaSwitchSchema } from "#/sections.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+/** `mfaMode` as the files selected by `environment` write it, with no variable set. */
+export function configuredMfaMode(environment: string): MfaSwitch {
+	const resolved = [`${environment}.conf`, "application.conf", "reference.conf"]
+		.reduce<Config>(
+			(layered, file) => layered.withFallback(parseFile(join(configDir, file), { env: {} })),
+			empty(),
+		)
+		.toObject() as Record<string, unknown>;
+	return mfaSwitchSchema.parse(resolved.mfaMode);
+}

package/templates/standalone/src/__tests__/core-federations.test.mts

@@ -16,13 +16,14 @@
 
 /**
  * The federations the template ships, in core's own section:
- * `core.federations.google` and `core.federations.oidc`, each bound to the
- * variables named after its paths (`CORE_FEDERATIONS_<NAME>_<KEY>`). Phase
- * one chooses the federation modules from the map there. A variable the
+ * `core.federations.google` and `core.federations.oidc`, each naming its
+ * type and bound to the variables named after its paths
+ * (`CORE_FEDERATIONS_<NAME>_<KEY>`). The federation types the template
+ * bundles are listed whatever the map says (`federation-types.test.mts`
+ * boots them). A variable the
  * template bound before, `FEDERATIONS_<NAME>_<KEY>`, set alone or beside its
- * new name at a different value is refused before any module is chosen,
- * naming the new variable and path and never a value; the two at one value
- * are accepted. The map written at the top level refuses boot, naming its
+ * new name, at any value, is refused before any module is chosen, naming the
+ * new variable and path and never a value. The map written at the top level refuses boot, naming its
  * paths under `core.federations`.
  */
 
@@ -30,7 +31,7 @@ import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { createApp } from "@o3co/auth-provider-core";
+import { BootError, createApp } from "@o3co/auth-provider-core";
 import { afterAll, describe, expect, it } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
 import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "#/configPath.mjs";
@@ -71,10 +72,16 @@ function refusal(env: Record<string, string>): Error {
 	throw new Error("phase one read the switches");
 }
 
-/** The federations phase one reads, by name. */
-const federationsOf = (env: Record<string, string> = {}) =>
-	(switchesFrom(env).core as { federations?: Record<string, Record<string, unknown>> } | undefined)
-		?.federations ?? {};
+/** The federations the composition hands boot under `env`, by name: phase one, then phase two. */
+function federationsOf(env: Record<string, string> = {}) {
+	const own = readOwnLayers(ownFiles(), { env: { ...MFA_OFF, ...env } });
+	const switches = readSwitches(own);
+	const modules = buildModules(switches, { environment: "production" });
+	const resolved = resolveForBoot(own, modules, switches) as unknown as {
+		readonly core?: { readonly federations?: Record<string, Record<string, unknown>> };
+	};
+	return resolved.core?.federations ?? {};
+}
 
 /** The modules phase one chooses under `env`, by name. */
 const moduleNames = (env: Record<string, string>) =>
@@ -131,9 +138,9 @@ const RENAMED = [
 ] as const;
 
 describe("the federations the template ships, under core.federations", () => {
-	it("ships google and oidc disabled, oidc of type oidc", () => {
+	it("ships google and oidc disabled, each of the type of its name", () => {
 		const federations = federationsOf();
-		expect(federations.google?.enabled).toBe(false);
+		expect(federations.google).toMatchObject({ enabled: false, type: "google" });
 		expect(federations.oidc).toMatchObject({ enabled: false, type: "oidc" });
 	});
 
@@ -144,20 +151,16 @@ describe("the federations the template ships, under core.federations", () => {
 		},
 	);
 
-	it("chooses the Google federation's modules when CORE_FEDERATIONS_GOOGLE_ENABLED is true, and none while it is not", () => {
-		expect(moduleNames({ CORE_FEDERATIONS_GOOGLE_ENABLED: "true" })).toContain("federation-google");
-		expect(moduleNames({})).not.toContain("federation-google");
-	});
-
-	it("chooses an OIDC federation's module for an entry of type oidc written under core.federations", () => {
-		const names = buildModules(
-			switchesFrom(
-				{},
-				'core.federations.okta { enabled = true, type = "oidc", issuer = "https://okta.test", clientId = "c", clientSecret = "s", callbackURL = "https://auth.test/session/oauth/federation/okta/callback" }\n',
-			),
-			{ environment: "production" },
-		).map((module) => module.name);
-		expect(names).toContain("federation-oidc-okta");
+	it("lists the same federation modules whether CORE_FEDERATIONS_GOOGLE_ENABLED is true or not", () => {
+		const federationModules = (env: Record<string, string>) =>
+			moduleNames(env).filter((name) => name === "federation-oidc" || name.endsWith("-type"));
+		expect(federationModules({ CORE_FEDERATIONS_GOOGLE_ENABLED: "true" })).toEqual([
+			"federation-google-type",
+			"federation-oidc",
+		]);
+		expect(federationModules({})).toEqual(
+			federationModules({ CORE_FEDERATIONS_GOOGLE_ENABLED: "true" }),
+		);
 	});
 });
 
@@ -166,9 +169,24 @@ describe("a variable the template bound before, FEDERATIONS_<NAME>_<KEY>", () =>
 		"core.federations.%s.%s: %s set alone is refused before any module is chosen, naming %s",
 		(name, key, old, variable, value) => {
 			const err = refusal({ [old]: value });
-			expect(err).toBeInstanceOf(RangeError);
+			expect(err).toBeInstanceOf(BootError);
 			expect(err.message).toContain(`${old} was renamed ${variable}`);
 			expect(err.message).toContain(`core.federations.${name}.${key}`);
+			expect(err).toMatchObject({
+				reason: "environment-variable-renamed",
+				details: {
+					reason: "environment-variable-renamed",
+					renamed: [
+						{
+							module: "core",
+							from: old,
+							to: variable,
+							path: `core.federations.${name}.${key}`,
+							state: "unset",
+						},
+					],
+				},
+			});
 		},
 	);
 
@@ -176,6 +194,10 @@ describe("a variable the template bound before, FEDERATIONS_<NAME>_<KEY>", () =>
 		"core.federations.%s.%s: %s beside its new name at a different value is refused, quoting neither",
 		(_name, _key, old, variable) => {
 			const err = refusal({ [old]: "old-value-5e2d", [variable]: "new-value-c81a" });
+			expect(err).toMatchObject({
+				reason: "environment-variable-renamed",
+				details: { renamed: [{ from: old, state: "different" }] },
+			});
 			expect(err.message).toContain(old);
 			expect(err.message).not.toContain("old-value-5e2d");
 			expect(err.message).not.toContain("new-value-c81a");
@@ -183,9 +205,13 @@ describe("a variable the template bound before, FEDERATIONS_<NAME>_<KEY>", () =>
 	);
 
 	it.each(RENAMED)(
-		"core.federations.%s.%s: %s beside its new name at the same value is read",
-		(name, key, old, variable, value) => {
-			expect(String(federationsOf({ [old]: value, [variable]: value })[name]?.[key])).toBe(value);
+		"core.federations.%s.%s: %s beside its new name at the same value is refused all the same",
+		(_name, _key, old, variable, value) => {
+			const err = refusal({ [old]: value, [variable]: value });
+			expect(err).toMatchObject({
+				reason: "environment-variable-renamed",
+				details: { renamed: [{ from: old, state: "different" }] },
+			});
 		},
 	);
 });