@o3co/create-auth-provider 0.17.0-rc.2 → 0.17.0-rc.3

package/templates/standalone/src/__tests__/core-federations.test.mts

@@ -22,9 +22,8 @@
  * bundles are listed whatever the map says (`federation-types.test.mts`
  * boots them). A variable the
  * template bound before, `FEDERATIONS_<NAME>_<KEY>`, set alone or beside its
- * new name at a different value is refused before any module is chosen,
- * naming the new variable and path and never a value; the two at one value
- * are accepted. The map written at the top level refuses boot, naming its
+ * new name, at any value, is refused before any module is chosen, naming the
+ * new variable and path and never a value. The map written at the top level refuses boot, naming its
  * paths under `core.federations`.
  */
 
@@ -206,9 +205,13 @@ describe("a variable the template bound before, FEDERATIONS_<NAME>_<KEY>", () =>
 	);
 
 	it.each(RENAMED)(
-		"core.federations.%s.%s: %s beside its new name at the same value is read",
-		(name, key, old, variable, value) => {
-			expect(String(federationsOf({ [old]: value, [variable]: value })[name]?.[key])).toBe(value);
+		"core.federations.%s.%s: %s beside its new name at the same value is refused all the same",
+		(_name, _key, old, variable, value) => {
+			const err = refusal({ [old]: value, [variable]: value });
+			expect(err).toMatchObject({
+				reason: "environment-variable-renamed",
+				details: { renamed: [{ from: old, state: "different" }] },
+			});
 		},
 	);
 });

package/templates/standalone/src/__tests__/core-sections.test.mts

@@ -20,8 +20,8 @@
  * environment, phase one's switches, then the layers over every loaded
  * package's `reference.conf` handed to boot. A path they moved from, written
  * in the operator's own layer, refuses boot naming the new one;
- * `DEPLOYMENT_MODE`, renamed `CORE_DEPLOYMENT_MODE`, refuses boot unless the
- * new name carries the same value.
+ * `DEPLOYMENT_MODE`, renamed `CORE_DEPLOYMENT_MODE`, refuses boot while it is
+ * set, whatever the new name holds.
  */
 
 import { BootError } from "@o3co/auth-provider-core";
@@ -176,10 +176,12 @@ describe("DEPLOYMENT_MODE, renamed CORE_DEPLOYMENT_MODE, through the template's
 		expect(err.message).not.toContain("new-mode-c81a");
 	});
 
-	it("set beside the new name at the same value: boots with that mode", async () => {
-		const composition = await boot({ DEPLOYMENT_MODE: "single", CORE_DEPLOYMENT_MODE: "single" });
+	it("set beside the new name at the same value: refused all the same", async () => {
+		const err = await refused({ DEPLOYMENT_MODE: "single", CORE_DEPLOYMENT_MODE: "single" });
 
-		expect(composition.handle.components.deploymentMode).toBe("single");
+		expect(err.details).toMatchObject({
+			renamed: [{ from: "DEPLOYMENT_MODE", to: "CORE_DEPLOYMENT_MODE", state: "different" }],
+		});
 	});
 
 	it("unset, with the new name set: boots with its mode", async () => {

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -44,7 +44,12 @@ import {
 	resolveLayers,
 	type Switches,
 } from "../configPath.mjs";
-import { httpModule, keyStoreModule, templateReference } from "../modules.mjs";
+import {
+	httpModule,
+	keyStoreModule,
+	standaloneRedisClientsModule,
+	templateReference,
+} from "../modules.mjs";
 
 /**
  * Boots the shipped config with EVERY documented override supplied the way an
@@ -195,6 +200,7 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	REDIS_REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT: "3",
 	REDIS_CLIENTS_URL: "redis://redis:6379",
 	REDIS_CLIENTS_PASSWORD: "rt-family-password",
+	REDIS_CLIENTS_ASSUME_NO_EVICTION: "true",
 	// The federation token store's Redis branch.
 	REDIS_FEDERATION_TOKEN_STORE_KEY_PREFIX: "ft:",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE: "required",
@@ -311,139 +317,139 @@ const DELIBERATELY_UNSET: Readonly<Record<string, string>> = {
 	OAUTH_AUTHORIZE_ALLOW_UNMARKED_CLIENTS:
 		"the variable of a removed key, and only captured — any value fails boot",
 	OAUTH_ACCESS_TOKEN_EXPIRES_IN:
-		"renamed OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN, and only captured — set at any value, beside its new name or not, it fails boot",
 	DEPLOYMENT_MODE:
-		"renamed CORE_DEPLOYMENT_MODE, and only captured — set alone, or to another value, it fails boot",
+		"renamed CORE_DEPLOYMENT_MODE, and only captured — set at any value, beside its new name or not, it fails boot",
 	MEMORY_RATE_LIMITER_MAX_BUCKETS:
-		"renamed CORE_RATE_LIMITER_MEMORY_MAX_BUCKETS, and only captured — set alone, or to another value, it fails boot",
+		"renamed CORE_RATE_LIMITER_MEMORY_MAX_BUCKETS, and only captured — set at any value, beside its new name or not, it fails boot",
 	RATE_LIMIT_FAIL_MODE:
-		"renamed REDIS_RATE_LIMITER_FAIL_MODE, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_RATE_LIMITER_FAIL_MODE, and only captured — set at any value, beside its new name or not, it fails boot",
 	REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX:
-		"renamed REDIS_REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX, and only captured — set at any value, beside its new name or not, it fails boot",
 	REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT:
-		"renamed REDIS_REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT, and only captured — set at any value, beside its new name or not, it fails boot",
 	FEDERATION_GRANTS_ENCRYPTION_MODE:
-		"renamed REDIS_FEDERATION_GRANT_STORE_ENCRYPTION_MODE, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_FEDERATION_GRANT_STORE_ENCRYPTION_MODE, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_TOKEN_BINDING_DISPATCH_POLICY:
-		"renamed CORE_TOKEN_BINDING_DISPATCH_POLICY, and only captured — set alone, or to another value, it fails boot",
+		"renamed CORE_TOKEN_BINDING_DISPATCH_POLICY, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_TOKEN_BINDING_BIND_CONFIDENTIAL_CLIENT_REFRESH_TOKENS:
-		"renamed CORE_TOKEN_BINDING_BIND_CONFIDENTIAL_CLIENT_REFRESH_TOKENS, and only captured — set alone, or to another value, it fails boot",
+		"renamed CORE_TOKEN_BINDING_BIND_CONFIDENTIAL_CLIENT_REFRESH_TOKENS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_SESSION_ENABLED:
-		"renamed OAUTH_SESSION_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_SESSION_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_AUTHORIZATION_CODE_ENABLED:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_AUTHORIZATION_CODE_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_AUTHORIZATION_CODE_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_REFRESH_TOKEN_ENABLED:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_CLIENT_CREDENTIALS_ENABLED:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_JWT_BEARER_ENABLED:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_JWT_BEARER_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_JWT_BEARER_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	ENDPOINTS_CONSENT_URL:
-		"renamed OAUTH_CONSENT_PAGE_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CONSENT_PAGE_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_ENABLED:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_ALLOWED_SCOPES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_SCOPES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_SCOPES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_ALLOWED_AUDIENCES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_AUDIENCES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_AUDIENCES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_ALLOWED_HOSTS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_HOSTS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_HOSTS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_DENIED_HOSTS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_DENIED_HOSTS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_DENIED_HOSTS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_MAX_BYTES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_BYTES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_BYTES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_TIMEOUT_MS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_TIMEOUT_MS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_TIMEOUT_MS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_CACHE_MAX_AGE_MS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_CACHE_MAX_AGE_MS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_CACHE_MAX_AGE_MS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_MAX_CACHE_ENTRIES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_CACHE_ENTRIES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_CACHE_ENTRIES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_STALE_IF_ERROR_MS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_STALE_IF_ERROR_MS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_STALE_IF_ERROR_MS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_NEGATIVE_CACHE_MS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_NEGATIVE_CACHE_MS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_NEGATIVE_CACHE_MS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_MAX_CONCURRENT_FETCHES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_CONCURRENT_FETCHES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_CONCURRENT_FETCHES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_AUTHORIZATION_CODE_PKCE_REQUIRE_S256:
 		"the authorization-code grant's pkce block was removed, and this is only captured — set at all, it fails boot",
 	ENDPOINTS_LOGIN_URL:
-		"renamed SESSION_LOGIN_PAGE_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_LOGIN_PAGE_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_SECRET:
-		"renamed SESSION_STORE_SECRET, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_SECRET, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_NAME:
-		"renamed SESSION_STORE_NAME, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_NAME, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_MAX_AGE:
-		"renamed SESSION_STORE_MAX_AGE, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_MAX_AGE, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_SECURE:
-		"renamed SESSION_STORE_SECURE, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_SECURE, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_SAME_SITE:
-		"renamed SESSION_STORE_SAME_SITE, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_SAME_SITE, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_DOMAIN:
-		"renamed SESSION_STORE_DOMAIN, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_DOMAIN, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_STORAGE_TYPE:
-		"renamed SESSION_STORE_STORAGE_TYPE, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_STORAGE_TYPE, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_STORAGE_REDIS_URL:
-		"renamed SESSION_STORE_STORAGE_REDIS_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_STORAGE_REDIS_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_STORAGE_REDIS_PASSWORD:
-		"renamed SESSION_STORE_STORAGE_REDIS_PASSWORD, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_STORAGE_REDIS_PASSWORD, and only captured — set at any value, beside its new name or not, it fails boot",
 	LOG_LEVEL:
-		"renamed LOGGING_LEVEL, and only captured — set alone, or to another value, it fails boot",
+		"renamed LOGGING_LEVEL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CORS_ALLOWED_ORIGINS:
-		"renamed HTTP_CORS_ALLOWED_ORIGINS, and only captured — set alone, or to another value, it fails boot",
+		"renamed HTTP_CORS_ALLOWED_ORIGINS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_SIGNING_KEY_PROVIDER:
-		"renamed KEY_STORE_PROVIDER, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_PROVIDER, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_ALGORITHM:
-		"renamed KEY_STORE_LOCAL_ALGORITHM, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_ALGORITHM, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_KID:
-		"renamed KEY_STORE_LOCAL_KID, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_KID, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_SECRET:
-		"renamed KEY_STORE_LOCAL_SECRET, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_SECRET, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_PRIVATE_KEY_PATH:
-		"renamed KEY_STORE_LOCAL_PRIVATE_KEY_PATH, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_PRIVATE_KEY_PATH, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_PUBLIC_KEY_PATH:
-		"renamed KEY_STORE_LOCAL_PUBLIC_KEY_PATH, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_PUBLIC_KEY_PATH, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_PRIVATE_KEY:
-		"renamed KEY_STORE_LOCAL_PRIVATE_KEY, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_PRIVATE_KEY, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_PUBLIC_KEY:
-		"renamed KEY_STORE_LOCAL_PUBLIC_KEY, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_PUBLIC_KEY, and only captured — set at any value, beside its new name or not, it fails boot",
 	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL:
-		"renamed REDIS_CLIENTS_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_CLIENTS_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	REFRESH_TOKEN_FAMILY_STORE_REDIS_PASSWORD:
-		"renamed REDIS_CLIENTS_PASSWORD, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_CLIENTS_PASSWORD, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_PATH:
-		"renamed REPOSITORIES_CLIENT_YAML_PATH, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_CLIENT_YAML_PATH, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_PATH:
-		"renamed REPOSITORIES_USER_YAML_PATH, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_YAML_PATH, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_AUTHENTICATE_URL:
-		"renamed REPOSITORIES_USER_HTTP_AUTHENTICATE_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_AUTHENTICATE_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL:
-		"renamed REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_LINK_FEDERATED_IDENTITY_URL:
-		"renamed REPOSITORIES_USER_HTTP_LINK_FEDERATED_IDENTITY_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_LINK_FEDERATED_IDENTITY_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL:
-		"renamed REPOSITORIES_USER_HTTP_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_BEARER_TOKEN:
-		"renamed REPOSITORIES_USER_HTTP_BEARER_TOKEN, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_BEARER_TOKEN, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_TIMEOUT:
-		"renamed REPOSITORIES_USER_HTTP_TIMEOUT, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_TIMEOUT, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_MAX_RESPONSE_BYTES:
-		"renamed REPOSITORIES_USER_HTTP_MAX_RESPONSE_BYTES, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_MAX_RESPONSE_BYTES, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_CODE_DEFAULT_EXPIRES_IN:
-		"renamed REDIS_CODE_REPOSITORY_DEFAULT_EXPIRES_IN (the Redis code repository) and STANDALONE_IN_MEMORY_CODE_REPOSITORY_DEFAULT_EXPIRES_IN (the in-process one), and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_CODE_REPOSITORY_DEFAULT_EXPIRES_IN (the Redis code repository) and STANDALONE_IN_MEMORY_CODE_REPOSITORY_DEFAULT_EXPIRES_IN (the in-process one), and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_CODE_KEY_PREFIX:
-		"renamed REDIS_CODE_REPOSITORY_KEY_PREFIX, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_CODE_REPOSITORY_KEY_PREFIX, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_CODE_ENDPOINT_URI:
 		"removed: the Redis code repository uses the shared redis-clients connection; only captured — set at all, it fails boot",
 	CLIENT_CODE_PASSWORD:
 		"removed: the Redis code repository uses the shared redis-clients connection; only captured — set at all, it fails boot",
 	ENDPOINTS_MFA_URL:
-		"renamed MFA_PAGE_URL, and only captured — set alone, or to another value, it fails boot where MFA is installed",
+		"renamed MFA_PAGE_URL, and only captured — set at any value, beside its new name or not, it fails boot where MFA is installed",
 	MFA_TOTP_ENABLED:
-		"renamed MFA_TOTP_FACTOR_ENABLED, and only captured — set alone, or to another value, it fails boot where MFA is installed",
+		"renamed MFA_TOTP_FACTOR_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot where MFA is installed",
 	MFA_TOTP_ISSUER:
-		"renamed MFA_TOTP_FACTOR_ISSUER, and only captured — set alone, or to another value, it fails boot where MFA is installed",
+		"renamed MFA_TOTP_FACTOR_ISSUER, and only captured — set at any value, beside its new name or not, it fails boot where MFA is installed",
 };
 
 /**
@@ -480,11 +486,11 @@ function commentedFederationBindings(): string {
 }
 
 /**
- * The provider environment `o3co/auth`'s `tests/docker-compose.yml` sets,
- * transcribed: each renamed variable under its old and its new name, the two
- * at one value. The umbrella E2E boots the shipped template with exactly this,
- * so a parse failure here is a red umbrella build that this repository can see
- * first. `SESSION_STORE_SECURE=false` is the one it cannot run without: the
+ * The provider environment `o3co/auth`'s `tests/docker-compose.yml` is to
+ * set, transcribed: each renamed variable under its new name alone, since an
+ * old name set refuses boot beside its new one too. The umbrella E2E boots
+ * the shipped template with this, so a parse failure here is a red umbrella
+ * build that this repository can see first. `SESSION_STORE_SECURE=false` is the one it cannot run without: the
  * suite speaks plain HTTP.
  *
  * The two `FEDERATION_TOKEN_STORE` lines are required: the federation token
@@ -493,37 +499,23 @@ function commentedFederationBindings(): string {
  * Redis store is selected with its encryption key.
  */
 const UMBRELLA_E2E_ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
 	KEY_STORE_LOCAL_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: "e2e-shared-hs256-secret.at-least-32-bytes.ok",
 	KEY_STORE_LOCAL_SECRET: "e2e-shared-hs256-secret.at-least-32-bytes.ok",
 	OAUTH_JWT_ISSUER: "https://auth.e2e.test",
-	SESSION_SECRET: "lO0QH09fuKSGuViZ9myJbH3jsgai99A2GpC3RYRuy6Y=",
 	SESSION_STORE_SECRET: "lO0QH09fuKSGuViZ9myJbH3jsgai99A2GpC3RYRuy6Y=",
-	SESSION_SECURE: "false",
 	SESSION_STORE_SECURE: "false",
-	SESSION_NAME: "auth.session",
 	SESSION_STORE_NAME: "auth.session",
-	DEPLOYMENT_MODE: "multi",
 	CORE_DEPLOYMENT_MODE: "multi",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis:6379",
 	REDIS_CLIENTS_URL: "redis://redis:6379",
-	SESSION_STORAGE_REDIS_URL: "redis://redis:6379",
 	SESSION_STORE_STORAGE_REDIS_URL: "redis://redis:6379",
-	USER_SESSION_STORES_ADAPTER: "redis",
 	ADAPTERS_USER_SESSION_STORES: "redis",
-	RATE_LIMITER_ADAPTER: "redis",
 	ADAPTERS_RATE_LIMITER: "redis",
-	OAUTH_CODE_ADAPTER: "redis",
 	ADAPTERS_CODE_REPOSITORY: "redis",
-	FEDERATION_TOKEN_STORE_TYPE: "redis",
 	ADAPTERS_FEDERATION_TOKEN_STORE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=",
-	CLIENT_USER_TYPE: "yaml",
 	ADAPTERS_USER_REPOSITORY: "yaml",
 	OAUTH_RESOURCE_INDICATOR_ENABLED: "true",
 	OAUTH_REQUIRE_EMAIL_VERIFIED: "true",
-	OAUTH_GRANTS_SESSION_ENABLED: "true",
 	OAUTH_SESSION_ENABLED: "true",
 	MFA_MODE: "off",
 };
@@ -782,6 +774,11 @@ describe("the shipped config boots with every documented override supplied as a
 		// A leftover string here would be read as "on" by a truthiness check
 		// and as "off" by `=== true`, for a feature whose whole default is off.
 		expect(federationGrantsSection(config).enabled).toBe(true);
+		expect(
+			standaloneRedisClientsModule.section?.schema.parse(
+				(config as Record<string, unknown>)["redis-clients"],
+			),
+		).toMatchObject({ assumeNoEviction: true });
 	});
 
 	it("turns every non-boolean override into its declared type", async () => {
@@ -1245,12 +1242,18 @@ describe("the shipped config boots with every documented override supplied as a
 			).rejects.toMatchObject({ reason: "environment-variable-renamed" });
 		});
 
-		it("boots with OAUTH_ACCESS_TOKEN_EXPIRES_IN beside its new name set to the same value, reading the new name", async () => {
-			const config = await bootParsed({
+		it("refuses OAUTH_ACCESS_TOKEN_EXPIRES_IN beside its new name set to the same value", async () => {
+			const booting = bootParsed({
 				...DOCUMENTED_ENV,
 				OAUTH_ACCESS_TOKEN_EXPIRES_IN:
 					DOCUMENTED_ENV.OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN as string,
 			});
+			await expect(booting).rejects.toMatchObject({ reason: "environment-variable-renamed" });
+			await expect(booting).rejects.toThrow(/unset OAUTH_ACCESS_TOKEN_EXPIRES_IN/);
+		});
+
+		it("boots with OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN alone, reading it", async () => {
+			const config = await bootParsed(DOCUMENTED_ENV);
 			expect(oauthSection(config).accessToken).toEqual({
 				defaultExpiresIn: 900,
 				maxExpiresIn: 7200,

package/templates/standalone/src/__tests__/federation-grants-composition.test.mts

@@ -85,6 +85,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(

package/templates/standalone/src/__tests__/mailpit-compose.test.mts

@@ -15,11 +15,12 @@
  */
 
 /**
- * The development compose run, `docker-compose.yml`, with MFA on as the
- * template ships it, and the Mailpit overlay, `docker-compose.mailpit.yml`: a
- * development run whose mail goes through the SMTP sender to Mailpit. It is an
- * overlay on `docker-compose.yml`, so a plain `docker compose up` starts no
- * Mailpit, and the production file names none. The compose files are read as
+ * The development compose run, `docker-compose.yml`, with MFA as the
+ * configuration's switch says (on as the template ships it), and the Mailpit
+ * overlay, `docker-compose.mailpit.yml`: a development run whose mail goes
+ * through the SMTP sender to Mailpit. It is an overlay on
+ * `docker-compose.yml`, so a plain `docker compose up` starts no Mailpit, and
+ * the production file names none. The compose files are read as
  * the fixed-shape files they are, and the process each run describes is booted
  * from the shipped files, as `app.mts` boots them, under the environment the
  * run sets: `.env.example`'s lines, then each compose file's `environment`, the
@@ -44,6 +45,7 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
 import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "#/configPath.mjs";
 import { createRecordingLogger } from "./all-modules-composition.fixture.mjs";
+import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
 
 vi.mock("redis", () => ({
 	createClient: vi.fn(() => ({
@@ -74,6 +76,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(
@@ -245,14 +251,15 @@ describe("the process each development run describes", () => {
 		};
 	}
 
-	it("boots docker-compose.yml's run with MFA required: development, the development mail sender, the MFA stores on its Redis", async () => {
+	it("boots docker-compose.yml's run with MFA as the configuration's switch says: development, the development mail sender, the MFA stores on its Redis", async () => {
 		const env = containerEnv(false);
 		// `app.mts`: CONFIG_ENV, then NODE_ENV, then development; the run sets neither.
 		expect(env.CONFIG_ENV ?? env.NODE_ENV).toBeUndefined();
 		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "development");
 		const own = readOwnLayers([envConfPath, applicationConfPath], { env });
 		const switches = readSwitches(own);
-		expect(switches.mfaMode).toBe("required");
+		const mode = configuredMfaMode("development");
+		expect(switches.mfaMode).toBe(mode);
 		// A hot reload restarts the process on every save, and Redis keeps the
 		// factors, and the sessions beside them, across it.
 		expect(switches.adapters).toMatchObject({
@@ -277,7 +284,7 @@ describe("the process each development run describes", () => {
 			"standard-development",
 		);
 		expect((handle.components.config as { mfa?: { mode?: unknown } } | undefined)?.mfa?.mode).toBe(
-			"required",
+			mode === "off" ? undefined : mode,
 		);
 	});
 
@@ -289,18 +296,27 @@ describe("the process each development run describes", () => {
 		expect(existsSync(resolveConfigPaths(configDir, configEnv as string).envConfPath)).toBe(true);
 	});
 
-	it("boots with MFA on and the SMTP sender in the mailSender slot, relaying to Mailpit", async () => {
-		const env = containerEnv();
+	/** The key the operator writes into `.env` for the Mailpit run (`openssl rand -base64 32`). */
+	const OWN_MFA_KEY = Buffer.alloc(32, 7).toString("base64");
+
+	/** The Mailpit run's modules and the configuration boot is handed, under `env`. */
+	function mailpitRun(env: Record<string, string>) {
 		const configEnv = env.CONFIG_ENV as string;
 		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
 		const own = readOwnLayers([envConfPath, applicationConfPath], { env });
 		const switches = readSwitches(own);
-		expect(switches.mfaMode).toBe("required");
-
 		const modules = buildModules(switches, {
 			environment: configEnv,
 			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 		});
+		return { switches, modules, config: () => resolveForBoot(own, modules, switches) };
+	}
+
+	it("boots with the SMTP sender relaying to Mailpit: in the mailSender slot, with the operator's MFA key, while MFA is on (the configuration's switch); unread, with no mfa section, while it is off", async () => {
+		const env: Record<string, string> = { ...containerEnv(), MFA_ENCRYPTION_KEY: OWN_MFA_KEY };
+		const { switches, modules, config } = mailpitRun(env);
+		const mode = configuredMfaMode(env.CONFIG_ENV as string);
+		expect(switches.mfaMode).toBe(mode);
 		const names = modules.map((module) => module.name);
 		expect(names).toContain(standardSmtpMailSenderModule.name);
 		expect(names).not.toContain(
@@ -310,17 +326,68 @@ describe("the process each development run describes", () => {
 		const handle = await createApp({
 			modules,
 			bootstrapComponents: {
-				config: resolveForBoot(own, modules, switches),
+				config: config(),
 				pathResolver: (s: string) => s,
 				logger: createRecordingLogger(),
 			},
 		});
 		handles.push(handle);
-		expect((handle.components.mailSender as MailSender | undefined)?.kind).toBe("standard-smtp");
+		expect((handle.components.mailSender as MailSender | undefined)?.kind).toBe(
+			mode === "off" ? undefined : "standard-smtp",
+		);
+		const mfa = (
+			handle.components.config as {
+				mfa?: { mode?: unknown; encryptionKeys?: { key?: unknown }[] };
+			}
+		).mfa;
+		if (mode === "off") {
+			expect(mfa).toBeUndefined();
+		} else {
+			expect(mfa?.mode).toBe(mode);
+			expect(mfa?.encryptionKeys?.map((entry) => entry.key)).toEqual([OWN_MFA_KEY]);
+		}
 		expect(
 			(handle.components.config as Record<string, unknown> | undefined)?.[
 				"standard-smtp-mail-sender"
 			],
 		).toMatchObject({ host: "localhost", port: 1025, secure: "none" });
 	});
+
+	it("does not carry the development sample key: with MFA on, without MFA_ENCRYPTION_KEY the run is refused; with it off, nothing reads a key", async () => {
+		const env = containerEnv();
+		expect(env.MFA_ENCRYPTION_KEY).toBeUndefined();
+		const { modules, config } = mailpitRun(env);
+		if (configuredMfaMode(env.CONFIG_ENV as string) === "off") {
+			const handle = await createApp({
+				modules,
+				bootstrapComponents: {
+					config: config(),
+					pathResolver: (s: string) => s,
+					logger: createRecordingLogger(),
+				},
+			});
+			handles.push(handle);
+			expect(handle.components.config).not.toHaveProperty("mfa");
+			return;
+		}
+		const refused = await (async () => {
+			try {
+				handles.push(
+					await createApp({
+						modules,
+						bootstrapComponents: {
+							config: config(),
+							pathResolver: (s: string) => s,
+							logger: createRecordingLogger(),
+						},
+					}),
+				);
+			} catch (error) {
+				return error;
+			}
+			return undefined;
+		})();
+		expect(refused).toBeInstanceOf(Error);
+		expect(String((refused as Error).message)).toMatch(/mfa\.encryptionKeys/);
+	});
 });

package/templates/standalone/src/__tests__/mfa-switch.redis.test.mts

@@ -17,10 +17,10 @@
 /**
  * The template's MFA switch under the name production, where the MFA stores
  * must be shared: both on Redis, as a production deployment selects them.
- * ioredis is a stand-in, as in `all-modules-composition.multi.test.mts`:
- * nothing here issues a command, and the stores' durability check names what
- * it could not read and goes on. `packages/redis` runs the stores against a
- * real server.
+ * ioredis is a stand-in, as in `all-modules-composition.multi.test.mts`: it
+ * answers `INFO memory` as a default server does, so the stores' eviction gate
+ * passes, and their persistence check names what it could not read and goes
+ * on. `packages/redis` runs the stores against a real server.
  */
 
 import { BootError } from "@o3co/auth-provider-core";
@@ -36,6 +36,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(