@o3co/create-auth-provider 0.17.0-rc.2 → 0.17.0-rc.3

package/templates/standalone/src/__tests__/mfa-switch.test.mts

@@ -15,14 +15,15 @@
  */
 
 /**
- * The template's MFA switch, `mfaMode` (`MFA_MODE`): `off`, the
- * default, installs nothing of MFA; `optional` and `required` install the MFA
- * package's modules — the MFA module, the TOTP, recovery-code and email
- * factors, the operator reset — with the session package's login completion
- * and the two MFA stores `adapters` selects, and declare `mfa` in
- * `core.sessionRequirements.expected`. Booted through the all-modules
- * fixture, and, where the shipped user repository or the development files
- * are the question, the way `app.mts` boots.
+ * The template's MFA switch, `mfaMode` (`MFA_MODE`): `off` installs nothing of
+ * MFA; `optional` and `required` install the MFA package's modules — the MFA
+ * module, the TOTP, recovery-code and email factors, the operator reset —
+ * with the session package's login completion and the two MFA stores
+ * `adapters` selects, and declare `mfa` in `core.sessionRequirements.expected`.
+ * With `MFA_MODE` unset, the switch is what the project's files write
+ * (`configured-mfa-mode.fixture.mts`). Booted through the all-modules fixture,
+ * and, where the shipped user repository or the development files are the
+ * question, the way `app.mts` boots.
  */
 
 import { generateKeyPairSync } from "node:crypto";
@@ -43,6 +44,7 @@ import {
 } from "@o3co/auth-provider-core";
 import { MFA_DEVELOPMENT_SAMPLE_KEY, mfaModules, mfaResetModule } from "@o3co/auth-provider-mfa";
 import { loginCompletionModule } from "@o3co/auth-provider-session";
+import { parseFile } from "@o3co/ts.hocon";
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
@@ -53,20 +55,25 @@ import {
 	resolveConfigPaths,
 	resolveForBoot,
 } from "#/configPath.mjs";
+import { mfaModulesFor } from "#/mfaSwitch.mjs";
+import { templateReference } from "#/modules.mjs";
 import {
 	ALICE,
 	authorize,
 	type Composition,
+	codeFrom,
 	compose,
 	contributionNames,
 	cookiesOf,
 	createRecordingLogger,
 	ISSUER,
+	login,
 	ownFiles,
 	type RecordingLogger,
 	SINGLE_ENV,
 	WEB,
 } from "./all-modules-composition.fixture.mjs";
+import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
 
 /** 32 bytes, base64: a key of the deployment's own for the MFA key ring. */
 const MFA_KEY = Buffer.alloc(32, 9).toString("base64");
@@ -133,17 +140,22 @@ const textOf = (err: unknown): string => {
 const warned = (logger: RecordingLogger, event: string) =>
 	logger.lines.filter((line) => line.level === "warn" && line.args[1] === event);
 
-/** `env` with MFA_MODE unset: the switch as the template ships it. */
+/** `env` with MFA_MODE unset: the switch as the configuration's files write it (`configuredMfaMode`). */
 const unset = (env: Readonly<Record<string, string>>): Record<string, string> => {
 	const { MFA_MODE: _unset, ...rest } = env;
 	return rest;
 };
 
 describe("the switch is the template's own key, mfaMode, bound to MFA_MODE", () => {
-	it("is required unless MFA_MODE says otherwise", () => {
+	it("ships required in the template's reference.conf, which --no-mfa leaves as it is", () => {
+		const reference = parseFile(fileURLToPath(templateReference()), { env: {} }).toObject();
+		expect((reference as Record<string, unknown>).mfaMode).toBe("required");
+	});
+
+	it("is what the configuration's files write unless MFA_MODE says otherwise", () => {
 		const switches = (env: Readonly<Record<string, string>>) =>
 			readSwitches(readOwnLayers(ownFiles(), { env })).mfaMode;
-		expect(switches(unset(SINGLE_ENV))).toBe("required");
+		expect(switches(unset(SINGLE_ENV))).toBe(configuredMfaMode("production"));
 		for (const mode of ["off", "optional", "required"] as const) {
 			expect(switches({ ...SINGLE_ENV, MFA_MODE: mode })).toBe(mode);
 		}
@@ -200,22 +212,37 @@ describe("the switch is the template's own key, mfaMode, bound to MFA_MODE", ()
 	});
 });
 
-describe("MFA_MODE unset: the template requires a second factor", () => {
-	it("installs every MFA module and declares mfa, as MFA_MODE=required does", async () => {
+describe("MFA_MODE unset: the switch the configuration's files write decides (required as the template ships it)", () => {
+	const mode = configuredMfaMode("production");
+
+	it("installs every MFA module and declares mfa while the switch is on, and nothing of MFA while it is off", async () => {
 		current = await boot({ env: unset(on("required")) });
 		const names = current.modules.map((m) => m.name);
-		expect(names.filter((name) => MFA_MODULE_NAMES.includes(name)).sort()).toEqual(
-			MFA_MODULE_NAMES,
-		);
+		const installed = names.filter((name) => MFA_MODULE_NAMES.includes(name)).sort();
+		if (mode === "off") {
+			expect(installed).toEqual([]);
+			expect(current.config.core?.sessionRequirements?.expected ?? []).not.toContain("mfa");
+			expect(current.config).not.toHaveProperty("mfa");
+			return;
+		}
+		expect(installed).toEqual(MFA_MODULE_NAMES);
 		expect(current.config.core?.sessionRequirements).toEqual({
 			expected: ["mfa"],
 			secondFactorAuthority: "mfa",
 		});
-		expect((current.config as unknown as { mfa: { mode: unknown } }).mfa.mode).toBe("required");
+		expect((current.config as unknown as { mfa: { mode: unknown } }).mfa.mode).toBe(mode);
 	});
 
-	it("interrupts a password login, opening no session /authorize accepts", async () => {
+	it("interrupts a password login while the switch is on, opening no session /authorize accepts; lets it through to a code while off", async () => {
 		current = await boot({ env: unset(on("required")) });
+		if (mode === "off") {
+			const { res, cookies } = await login(current.app);
+			expect(res.status).toBe(200);
+			const answer = await authorize(current.app, cookies);
+			expect(String(answer.headers.location ?? "").startsWith(WEB.redirectUri)).toBe(true);
+			expect(codeFrom(answer)).not.toBe("");
+			return;
+		}
 		const csrf = await request(current.app).get("/session/csrf");
 		const res = await request(current.app)
 			.post("/session/login")
@@ -402,6 +429,24 @@ describe("the MFA stores in memory: development and test alone", () => {
 		expect((err as BootError).reason).toBe("config-validation-failed");
 	});
 
+	it("names each reason it read: no name at all, a name neither development nor test, production", () => {
+		const memory = (environment: string | undefined) => () =>
+			mfaModulesFor({
+				mode: "required",
+				adapters: { mfaFactorStore: "memory", mfaTransactionStore: "memory" },
+				storeTransport: undefined,
+				environment,
+			});
+		vi.stubEnv("CONFIG_ENV", "");
+		vi.stubEnv("NODE_ENV", "");
+		expect(memory(undefined)).toThrow(/refused because no environment is named/);
+		expect(memory(" Prod ")).toThrow(/the environment "prod" is not development or test/);
+		vi.stubEnv("NODE_ENV", "Production");
+		expect(memory("test")).toThrow(/NODE_ENV is "production"/);
+		vi.stubEnv("NODE_ENV", " Test\n");
+		expect(memory("development")().map((m) => m.name)).toContain(memoryMfaFactorStoreModule.name);
+	});
+
 	it.each(["development", "test"])("lets them in under %s", async (environment) => {
 		current = await compose({ env: on("required"), environment });
 		expect(current.modules.map((m) => m.name)).toContain(memoryMfaFactorStoreModule.name);
@@ -739,14 +784,27 @@ describe("a deployment that takes MFA's modules out of buildModules() under MFA_
 });
 
 describe("the shipped configuration with nothing set about MFA", () => {
-	it("boots under CONFIG_ENV=development with MFA required: the sample key, the development mail sender, the MFA stores in memory", async () => {
+	it("boots under CONFIG_ENV=development with the switch its files write: with MFA on, on the sample key, the development mail sender and the MFA stores in memory", async () => {
+		const mode = configuredMfaMode("development");
 		const { logger, config } = await bootShipped(unset(SHIPPED_ENV), "development");
-		expect((config as unknown as { mfa: { mode: unknown } }).mfa.mode).toBe("required");
+		if (mode === "off") {
+			expect(config).not.toHaveProperty("mfa");
+			expect(config.core?.sessionRequirements?.expected ?? []).not.toContain("mfa");
+			expect(warned(logger, "mfa_development_sample_key_in_use")).toEqual([]);
+			return;
+		}
+		expect((config as unknown as { mfa: { mode: unknown } }).mfa.mode).toBe(mode);
 		expect(config.core?.sessionRequirements?.expected).toContain("mfa");
 		expect(warned(logger, "mfa_development_sample_key_in_use")).toHaveLength(1);
 	});
 
-	it("is refused in production before boot, naming the MFA stores, MFA_ENCRYPTION_KEY, the SMTP relay and MFA_MODE=off", async () => {
+	it("in production, with MFA on, is refused before boot, naming the MFA stores, MFA_ENCRYPTION_KEY, the SMTP relay and MFA_MODE=off; with it off, boots", async () => {
+		if (configuredMfaMode("production") === "off") {
+			const { config } = await bootShipped(unset(SHIPPED_ENV), "production");
+			expect(config).not.toHaveProperty("mfa");
+			expect(config.core?.sessionRequirements?.expected ?? []).not.toContain("mfa");
+			return;
+		}
 		let err: unknown;
 		await bootShipped(unset(SHIPPED_ENV), "production").catch((caught: unknown) => {
 			err = caught;

package/templates/standalone/src/__tests__/own-modules.test.mts

@@ -22,8 +22,8 @@
  * environment and HOCON overrides, through the template's real path:
  * `readOwnLayers`, then `resolveForBoot` over every loaded module's
  * reference, then `createApp`. A path a section moved from refuses boot
- * naming its new path, and a variable renamed with it refuses boot unless its
- * new name carries the same value.
+ * naming its new path, and a variable renamed with it refuses boot while its
+ * old name is set, whatever its new name holds.
  */
 
 import { generateKeyPairSync } from "node:crypto";
@@ -332,8 +332,19 @@ describe("logging", () => {
 		});
 	});
 
-	it("boots with LOG_LEVEL beside LOGGING_LEVEL at the same value", async () => {
-		const handle = await bootTemplate({ env: { LOG_LEVEL: "debug", LOGGING_LEVEL: "debug" } });
+	it("refuses LOG_LEVEL beside LOGGING_LEVEL at the same value", async () => {
+		await expect(
+			bootTemplate({ env: { LOG_LEVEL: "debug", LOGGING_LEVEL: "debug" } }),
+		).rejects.toMatchObject({
+			details: {
+				reason: "environment-variable-renamed",
+				renamed: [{ module: "logging", from: "LOG_LEVEL", state: "different" }],
+			},
+		});
+	});
+
+	it("boots with LOGGING_LEVEL alone", async () => {
+		const handle = await bootTemplate({ env: { LOGGING_LEVEL: "debug" } });
 		await handle.dispose();
 	});
 });
@@ -947,17 +958,32 @@ describe("key-store", () => {
 		});
 	});
 
-	it("boots with each old name beside its new one at the same value", async () => {
-		const handle = await bootTemplate({
-			env: {
-				OAUTH_JWT_PRIVATE_KEY: signingKey.privateKey,
-				OAUTH_JWT_PUBLIC_KEY: signingKey.publicKey,
-				OAUTH_JWT_KID: "k-both",
-				KEY_STORE_LOCAL_KID: "k-both",
+	it("refuses each old name beside its new one at the same value", async () => {
+		await expect(
+			bootTemplate({
+				env: {
+					OAUTH_JWT_PRIVATE_KEY: signingKey.privateKey,
+					OAUTH_JWT_PUBLIC_KEY: signingKey.publicKey,
+					OAUTH_JWT_KID: "k-both",
+					KEY_STORE_LOCAL_KID: "k-both",
+				},
+			}),
+		).rejects.toMatchObject({
+			details: {
+				reason: "environment-variable-renamed",
+				renamed: expect.arrayContaining([
+					expect.objectContaining({ from: "OAUTH_JWT_PRIVATE_KEY", state: "different" }),
+					expect.objectContaining({ from: "OAUTH_JWT_PUBLIC_KEY", state: "different" }),
+					expect.objectContaining({ from: "OAUTH_JWT_KID", state: "different" }),
+				]),
 			},
 		});
+	});
+
+	it("boots with each new name alone", async () => {
+		const handle = await bootTemplate({ env: { KEY_STORE_LOCAL_KID: "k-new" } });
 		try {
-			expect(handle.components.keyStore?.getSigningKidFallback()).toBe("k-both");
+			expect(handle.components.keyStore?.getSigningKidFallback()).toBe("k-new");
 		} finally {
 			await handle.dispose();
 		}

package/templates/standalone/src/__tests__/redis-assume-noeviction.test.mts

@@ -0,0 +1,214 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * `redis-clients.assumeNoEviction` (`REDIS_CLIENTS_ASSUME_NO_EVICTION`), on a
+ * Redis that will not report its eviction policy: every store on Redis, as a
+ * multi-replica deployment selects them. ioredis is a stand-in that refuses
+ * `INFO` and `CONFIG` as an ACL-restricted user's connection does; every
+ * other command resolves to nothing. node-redis and connect-redis, behind
+ * express-session's store, are stand-ins too, as in
+ * `all-modules-composition.multi.test.mts`.
+ */
+
+import { BootError } from "@o3co/auth-provider-core";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+	type Composition,
+	compose,
+	MULTI_ENV,
+	SINGLE_ENV,
+} from "./all-modules-composition.fixture.mjs";
+
+vi.mock("redis", () => ({
+	createClient: vi.fn(() => ({
+		connect: vi.fn().mockResolvedValue(undefined),
+		quit: vi.fn().mockResolvedValue(undefined),
+		ping: vi.fn().mockResolvedValue("PONG"),
+		on: vi.fn(),
+	})),
+}));
+
+vi.mock("connect-redis", async () => {
+	const { EventEmitter } = await import("node:events");
+	// express-session subscribes to store events, so the stand-in is an emitter.
+	return {
+		RedisStore: class MockRedisStore extends EventEmitter {
+			get(): unknown {
+				return undefined;
+			}
+			set(): void {}
+			destroy(): void {}
+		},
+	};
+});
+
+vi.mock("ioredis", () => {
+	const refused = async (): Promise<never> => {
+		throw Object.assign(new Error("NOPERM this user has no permissions to run this command"), {
+			name: "ReplyError",
+		});
+	};
+	const explicit: Record<string, unknown> = {
+		on: () => undefined,
+		quit: async () => "OK",
+		disconnect: () => undefined,
+		ping: async () => "PONG",
+		info: refused,
+		config: refused,
+	};
+	const makeMockRedis = (): object =>
+		new Proxy(
+			{},
+			{
+				get(_target, prop) {
+					// A function-valued `then` would make the instance a thenable.
+					if (typeof prop !== "string" || prop === "then") return undefined;
+					if (prop === "duplicate") return makeMockRedis;
+					if (prop in explicit) return explicit[prop];
+					return async () => null;
+				},
+			},
+		);
+	function MockRedis(): object {
+		return makeMockRedis();
+	}
+	return { Redis: MockRedis, default: MockRedis };
+});
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+});
+
+/** MFA required, both MFA stores on Redis, a key of the deployment's own and an SMTP relay. */
+const MFA_ON_REDIS: Readonly<Record<string, string>> = {
+	MFA_MODE: "required",
+	ADAPTERS_MFA_FACTOR_STORE: "redis",
+	ADAPTERS_MFA_TRANSACTION_STORE: "redis",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	MFA_ENCRYPTION_KEY: Buffer.alloc(32, 9).toString("base64"),
+	STANDARD_SMTP_MAIL_SENDER_HOST: "smtp.auth.test",
+	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
+};
+
+const composing = (env: Readonly<Record<string, string>>): Promise<unknown> =>
+	compose({ env, environment: "production", shippedRefreshTokenFamilyStore: true }).then(
+		(composition) => {
+			current = composition;
+			return undefined;
+		},
+		(caught: unknown) => caught,
+	);
+
+describe("a Redis that will not report its eviction policy", () => {
+	it.each([
+		["unset", MULTI_ENV],
+		["false", { ...MULTI_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
+		async (_label, env) => {
+			const err = await composing(env);
+			expect(err).toBeInstanceOf(BootError);
+			expect(err).toMatchObject({
+				reason: "provides-factory-failed",
+				cause: { name: "RedisStoreEvictableError", maxmemoryPolicy: undefined },
+			});
+		},
+	);
+
+	it("boots every store with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composing({ ...MULTI_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.modules.map((module) => module.name)).toEqual(
+			expect.arrayContaining([
+				"redis-attempt-counter",
+				"redis-session-stores",
+				"redis-federation-token-store",
+			]),
+		);
+	});
+
+	it("boots with redis-clients.assumeNoEviction = true written in HOCON", async () => {
+		const composition = await compose({
+			env: MULTI_ENV,
+			environment: "production",
+			shippedRefreshTokenFamilyStore: true,
+			operatorHocon: "redis-clients.assumeNoEviction = true\n",
+		});
+		current = composition;
+		expect(composition.handle).toBeDefined();
+	});
+});
+
+describe("the MFA stores on a Redis that will not report its eviction policy", () => {
+	/** Only the MFA stores on Redis: a refusal can come from no other store. */
+	const MFA_ONLY = { ...SINGLE_ENV, ...MFA_ON_REDIS };
+
+	it.each([
+		["unset", MFA_ONLY],
+		["false", { ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming an MFA store",
+		async (_label, env) => {
+			const err = await composing(env);
+			expect(err).toBeInstanceOf(BootError);
+			expect(err).toMatchObject({
+				reason: "provides-factory-failed",
+				cause: {
+					name: "RedisStoreEvictableError",
+					reason: expect.stringMatching(/^mfa-(factor|transaction)-store-evictable$/),
+					maxmemoryPolicy: undefined,
+				},
+			});
+		},
+	);
+
+	it("boots both MFA stores with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composing({ ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.modules.map((module) => module.name)).toEqual(
+			expect.arrayContaining(["redis-mfa-factor-store", "redis-mfa-transaction-store"]),
+		);
+		expect(current?.handle.components.mfaFactorStore?.kind).toBe("redis");
+		expect(current?.handle.components.mfaTransactionStore?.kind).toBe("redis");
+	});
+
+	it.each([
+		["unset", { ...MULTI_ENV, ...MFA_ON_REDIS }],
+		["false", { ...MULTI_ENV, ...MFA_ON_REDIS, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses every store on Redis with MFA on, REDIS_CLIENTS_ASSUME_NO_EVICTION %s",
+		async (_label, env) => {
+			expect(await composing(env)).toMatchObject({
+				reason: "provides-factory-failed",
+				cause: { name: "RedisStoreEvictableError", maxmemoryPolicy: undefined },
+			});
+		},
+	);
+
+	it("boots every store on Redis with MFA on and REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composing({ ...MULTI_ENV, ...MFA_ON_REDIS, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.handle.components.mfaFactorStore?.kind).toBe("redis");
+		expect(current?.handle.components.mfaTransactionStore?.kind).toBe("redis");
+	});
+});

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -102,6 +102,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(

package/templates/standalone/src/__tests__/scaffold-assets.test.mts

@@ -32,6 +32,7 @@ import { buildModules } from "../buildModules.mjs";
 import { readOwnLayers, readSwitches, resolveConfigPaths } from "../configPath.mjs";
 import { templateReference } from "../modules.mjs";
 import { type Adapters, repositoriesSectionSchema } from "../sections.mjs";
+import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
 
 const standaloneDir = fileURLToPath(new URL("../..", import.meta.url));
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
@@ -355,8 +356,8 @@ function dotenvExample(): Record<string, string> {
 	return env;
 }
 
-describe("the production compose leaves MFA on, for the deployment to decide", () => {
-	it("reads the switch as required, so a deployment that sets nothing about MFA is refused naming MFA_MODE=off", () => {
+describe("the production compose leaves MFA to the configuration's switch, for the deployment to decide", () => {
+	it("reads the switch as the configuration's files write it: on, a deployment that sets nothing about MFA is refused naming MFA_MODE=off; off, it installs nothing of MFA", () => {
 		// `environment:` wins over `env_file`, so the compose file's block is
 		// laid over the `.env` copied from `.env.example`.
 		const env = { ...dotenvExample(), ...bootableEnv("/docker-compose.production.yml") };
@@ -365,8 +366,14 @@ describe("the production compose leaves MFA on, for the deployment to decide", (
 		expect(configEnv).toBe("production");
 		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
 		const switches = readSwitches(readOwnLayers([envConfPath, applicationConfPath], { env }));
-		expect(switches.mfaMode).toBe("required");
+		const mode = configuredMfaMode(configEnv);
+		expect(switches.mfaMode).toBe(mode);
 
+		if (mode === "off") {
+			const names = buildModules(switches, { environment: configEnv }).map((m) => m.name);
+			expect(names.filter((name) => /mfa/i.test(name))).toEqual([]);
+			return;
+		}
 		let err: unknown;
 		try {
 			buildModules(switches, { environment: configEnv });

package/templates/standalone/src/__tests__/sections.test.mts

@@ -443,12 +443,36 @@ describe("redis-clients", () => {
 		expect(redisClientsSectionSchema.parse({ url: "redis://r:6379", password: "p" })).toEqual({
 			url: "redis://r:6379",
 			password: "p",
+			assumeNoEviction: false,
 		});
 		expect(redisClientsSectionSchema.parse({ url: "redis://r:6379" })).toEqual({
 			url: "redis://r:6379",
+			assumeNoEviction: false,
 		});
 	});
 
+	it.each([
+		[true, true],
+		["true", true],
+		["1", true],
+		["false", false],
+		["", false],
+	])("reads assumeNoEviction %j as %s", (given, read) => {
+		expect(
+			redisClientsSectionSchema.parse({ url: "redis://r:6379", assumeNoEviction: given })
+				.assumeNoEviction,
+		).toBe(read);
+	});
+
+	it("refuses an assumeNoEviction it cannot read as a boolean, naming the key", () => {
+		const parsed = redisClientsSectionSchema.safeParse({
+			url: "redis://r:6379",
+			assumeNoEviction: "yes",
+		});
+		expect(parsed.success).toBe(false);
+		expect(parsed.error?.issues[0]?.path).toEqual(["assumeNoEviction"]);
+	});
+
 	it.each([
 		["no URL", {}],
 		["a null URL", { url: null }],

package/templates/standalone/src/__tests__/shipped-config-notices.test.mts

@@ -74,6 +74,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(