@o3co/create-auth-provider 0.17.0-rc.2 → 0.17.0-rc.4

package/templates/standalone/src/__tests__/all-modules-composition.multi.test.mts

@@ -78,6 +78,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(
@@ -182,12 +186,16 @@ describe('every module on, every shared store on Redis, core.deployment.mode = "
 		expect(current.handle.components.deploymentMode).toBe("multi");
 	});
 
-	it("boots as multi on DEPLOYMENT_MODE=multi beside CORE_DEPLOYMENT_MODE=multi, as the umbrella sets them", async () => {
-		current = await compose({
-			...MULTI,
-			env: { ...MULTI_ENV, DEPLOYMENT_MODE: "multi", CORE_DEPLOYMENT_MODE: "multi" },
+	it("refuses DEPLOYMENT_MODE=multi beside CORE_DEPLOYMENT_MODE=multi: the old name must be unset", async () => {
+		await expect(
+			compose({
+				...MULTI,
+				env: { ...MULTI_ENV, DEPLOYMENT_MODE: "multi", CORE_DEPLOYMENT_MODE: "multi" },
+			}),
+		).rejects.toMatchObject({
+			reason: "environment-variable-renamed",
+			details: { renamed: [{ from: "DEPLOYMENT_MODE", state: "different" }] },
 		});
-		expect(current.handle.components.deploymentMode).toBe("multi");
 	});
 
 	/**

package/templates/standalone/src/__tests__/config-notices.test.mts

@@ -149,6 +149,9 @@ describe("configDefaultsFor", () => {
 
 	it("takes nothing from the process's environment", () => {
 		vi.stubEnv("REDIS_CLIENTS_URL", "redis://operator.test:6379");
-		expect(configDefaultsFor(modules)[NOT_LOADED]).toEqual({ url: "redis://localhost:6379" });
+		expect(configDefaultsFor(modules)[NOT_LOADED]).toEqual({
+			url: "redis://localhost:6379",
+			assumeNoEviction: false,
+		});
 	});
 });

package/templates/standalone/src/__tests__/configured-mfa-mode.fixture.mts

@@ -0,0 +1,48 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The MFA switch, `mfaMode`, as this project's own configuration files write
+ * it with `MFA_MODE` unset: `{environment}.conf` over `application.conf` over
+ * the template's `config/reference.conf`. The template ships it `required`;
+ * a project `create-auth-provider --no-mfa` scaffolds writes it `off` at the
+ * end of its `application.conf`. A suite whose subject depends on the switch
+ * asserts what MFA on (`required`, as the template ships it) or off (as
+ * `--no-mfa` writes it) implies, so the suite that ships with a scaffold holds
+ * in either project. A project whose files write another mode, such as
+ * `optional`, is not what these suites claim to cover.
+ *
+ * Read with the HOCON parser alone, not through phase one (`readSwitches`),
+ * so that a suite about phase one can state what phase one should answer.
+ */
+
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { type Config, empty, parseFile } from "@o3co/ts.hocon";
+import { type MfaSwitch, mfaSwitchSchema } from "#/sections.mjs";
+
+const configDir = fileURLToPath(new URL("../../config", import.meta.url));
+
+/** `mfaMode` as the files selected by `environment` write it, with no variable set. */
+export function configuredMfaMode(environment: string): MfaSwitch {
+	const resolved = [`${environment}.conf`, "application.conf", "reference.conf"]
+		.reduce<Config>(
+			(layered, file) => layered.withFallback(parseFile(join(configDir, file), { env: {} })),
+			empty(),
+		)
+		.toObject() as Record<string, unknown>;
+	return mfaSwitchSchema.parse(resolved.mfaMode);
+}

package/templates/standalone/src/__tests__/core-federations.test.mts

@@ -22,9 +22,8 @@
  * bundles are listed whatever the map says (`federation-types.test.mts`
  * boots them). A variable the
  * template bound before, `FEDERATIONS_<NAME>_<KEY>`, set alone or beside its
- * new name at a different value is refused before any module is chosen,
- * naming the new variable and path and never a value; the two at one value
- * are accepted. The map written at the top level refuses boot, naming its
+ * new name, at any value, is refused before any module is chosen, naming the
+ * new variable and path and never a value. The map written at the top level refuses boot, naming its
  * paths under `core.federations`.
  */
 
@@ -206,9 +205,13 @@ describe("a variable the template bound before, FEDERATIONS_<NAME>_<KEY>", () =>
 	);
 
 	it.each(RENAMED)(
-		"core.federations.%s.%s: %s beside its new name at the same value is read",
-		(name, key, old, variable, value) => {
-			expect(String(federationsOf({ [old]: value, [variable]: value })[name]?.[key])).toBe(value);
+		"core.federations.%s.%s: %s beside its new name at the same value is refused all the same",
+		(_name, _key, old, variable, value) => {
+			const err = refusal({ [old]: value, [variable]: value });
+			expect(err).toMatchObject({
+				reason: "environment-variable-renamed",
+				details: { renamed: [{ from: old, state: "different" }] },
+			});
 		},
 	);
 });

package/templates/standalone/src/__tests__/core-sections.test.mts

@@ -20,8 +20,8 @@
  * environment, phase one's switches, then the layers over every loaded
  * package's `reference.conf` handed to boot. A path they moved from, written
  * in the operator's own layer, refuses boot naming the new one;
- * `DEPLOYMENT_MODE`, renamed `CORE_DEPLOYMENT_MODE`, refuses boot unless the
- * new name carries the same value.
+ * `DEPLOYMENT_MODE`, renamed `CORE_DEPLOYMENT_MODE`, refuses boot while it is
+ * set, whatever the new name holds.
  */
 
 import { BootError } from "@o3co/auth-provider-core";
@@ -176,10 +176,12 @@ describe("DEPLOYMENT_MODE, renamed CORE_DEPLOYMENT_MODE, through the template's
 		expect(err.message).not.toContain("new-mode-c81a");
 	});
 
-	it("set beside the new name at the same value: boots with that mode", async () => {
-		const composition = await boot({ DEPLOYMENT_MODE: "single", CORE_DEPLOYMENT_MODE: "single" });
+	it("set beside the new name at the same value: refused all the same", async () => {
+		const err = await refused({ DEPLOYMENT_MODE: "single", CORE_DEPLOYMENT_MODE: "single" });
 
-		expect(composition.handle.components.deploymentMode).toBe("single");
+		expect(err.details).toMatchObject({
+			renamed: [{ from: "DEPLOYMENT_MODE", to: "CORE_DEPLOYMENT_MODE", state: "different" }],
+		});
 	});
 
 	it("unset, with the new name set: boots with its mode", async () => {

package/templates/standalone/src/__tests__/documented-env-overrides.test.mts

@@ -44,7 +44,12 @@ import {
 	resolveLayers,
 	type Switches,
 } from "../configPath.mjs";
-import { httpModule, keyStoreModule, templateReference } from "../modules.mjs";
+import {
+	httpModule,
+	keyStoreModule,
+	standaloneRedisClientsModule,
+	templateReference,
+} from "../modules.mjs";
 
 /**
  * Boots the shipped config with EVERY documented override supplied the way an
@@ -134,7 +139,6 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	OAUTH_SESSION_ENABLED: "false",
 	OAUTH_AUTHORIZATION_GRANTS_AUTHORIZATION_CODE_ENABLED: "true",
 	OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_ENABLED: "true",
-	OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY: "reject",
 	OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED: "true",
 	OAUTH_AUTHORIZATION_GRANTS_JWT_BEARER_ENABLED: "false",
 
@@ -195,6 +199,7 @@ const DOCUMENTED_ENV: Readonly<Record<string, string>> = {
 	REDIS_REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT: "3",
 	REDIS_CLIENTS_URL: "redis://redis:6379",
 	REDIS_CLIENTS_PASSWORD: "rt-family-password",
+	REDIS_CLIENTS_ASSUME_NO_EVICTION: "true",
 	// The federation token store's Redis branch.
 	REDIS_FEDERATION_TOKEN_STORE_KEY_PREFIX: "ft:",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_MODE: "required",
@@ -311,139 +316,141 @@ const DELIBERATELY_UNSET: Readonly<Record<string, string>> = {
 	OAUTH_AUTHORIZE_ALLOW_UNMARKED_CLIENTS:
 		"the variable of a removed key, and only captured — any value fails boot",
 	OAUTH_ACCESS_TOKEN_EXPIRES_IN:
-		"renamed OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN, and only captured — set at any value, beside its new name or not, it fails boot",
 	DEPLOYMENT_MODE:
-		"renamed CORE_DEPLOYMENT_MODE, and only captured — set alone, or to another value, it fails boot",
+		"renamed CORE_DEPLOYMENT_MODE, and only captured — set at any value, beside its new name or not, it fails boot",
 	MEMORY_RATE_LIMITER_MAX_BUCKETS:
-		"renamed CORE_RATE_LIMITER_MEMORY_MAX_BUCKETS, and only captured — set alone, or to another value, it fails boot",
+		"renamed CORE_RATE_LIMITER_MEMORY_MAX_BUCKETS, and only captured — set at any value, beside its new name or not, it fails boot",
 	RATE_LIMIT_FAIL_MODE:
-		"renamed REDIS_RATE_LIMITER_FAIL_MODE, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_RATE_LIMITER_FAIL_MODE, and only captured — set at any value, beside its new name or not, it fails boot",
 	REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX:
-		"renamed REDIS_REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_REFRESH_TOKEN_FAMILY_STORE_KEY_PREFIX, and only captured — set at any value, beside its new name or not, it fails boot",
 	REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT:
-		"renamed REDIS_REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_REFRESH_TOKEN_FAMILY_STORE_CAS_RETRY_LIMIT, and only captured — set at any value, beside its new name or not, it fails boot",
 	FEDERATION_GRANTS_ENCRYPTION_MODE:
-		"renamed REDIS_FEDERATION_GRANT_STORE_ENCRYPTION_MODE, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_FEDERATION_GRANT_STORE_ENCRYPTION_MODE, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_TOKEN_BINDING_DISPATCH_POLICY:
-		"renamed CORE_TOKEN_BINDING_DISPATCH_POLICY, and only captured — set alone, or to another value, it fails boot",
+		"renamed CORE_TOKEN_BINDING_DISPATCH_POLICY, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_TOKEN_BINDING_BIND_CONFIDENTIAL_CLIENT_REFRESH_TOKENS:
-		"renamed CORE_TOKEN_BINDING_BIND_CONFIDENTIAL_CLIENT_REFRESH_TOKENS, and only captured — set alone, or to another value, it fails boot",
+		"renamed CORE_TOKEN_BINDING_BIND_CONFIDENTIAL_CLIENT_REFRESH_TOKENS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_SESSION_ENABLED:
-		"renamed OAUTH_SESSION_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_SESSION_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_AUTHORIZATION_CODE_ENABLED:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_AUTHORIZATION_CODE_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_AUTHORIZATION_CODE_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_REFRESH_TOKEN_ENABLED:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY, and only captured — set alone, or to another value, it fails boot",
+		"the variable of a removed key, and only captured — any value fails boot",
+	OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_UNKNOWN_FAMILY_POLICY:
+		"the variable of a removed key, and only captured — any value fails boot",
 	OAUTH_GRANTS_CLIENT_CREDENTIALS_ENABLED:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_JWT_BEARER_ENABLED:
-		"renamed OAUTH_AUTHORIZATION_GRANTS_JWT_BEARER_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_AUTHORIZATION_GRANTS_JWT_BEARER_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	ENDPOINTS_CONSENT_URL:
-		"renamed OAUTH_CONSENT_PAGE_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CONSENT_PAGE_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_ENABLED:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ENABLED, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_ALLOWED_SCOPES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_SCOPES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_SCOPES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_ALLOWED_AUDIENCES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_AUDIENCES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_AUDIENCES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_ALLOWED_HOSTS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_HOSTS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_ALLOWED_HOSTS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_DENIED_HOSTS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_DENIED_HOSTS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_DENIED_HOSTS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_MAX_BYTES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_BYTES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_BYTES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_TIMEOUT_MS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_TIMEOUT_MS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_TIMEOUT_MS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_CACHE_MAX_AGE_MS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_CACHE_MAX_AGE_MS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_CACHE_MAX_AGE_MS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_MAX_CACHE_ENTRIES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_CACHE_ENTRIES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_CACHE_ENTRIES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_STALE_IF_ERROR_MS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_STALE_IF_ERROR_MS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_STALE_IF_ERROR_MS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_NEGATIVE_CACHE_MS:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_NEGATIVE_CACHE_MS, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_NEGATIVE_CACHE_MS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_CIMD_MAX_CONCURRENT_FETCHES:
-		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_CONCURRENT_FETCHES, and only captured — set alone, or to another value, it fails boot",
+		"renamed OAUTH_CLIENT_ID_METADATA_DOCUMENTS_MAX_CONCURRENT_FETCHES, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_GRANTS_AUTHORIZATION_CODE_PKCE_REQUIRE_S256:
 		"the authorization-code grant's pkce block was removed, and this is only captured — set at all, it fails boot",
 	ENDPOINTS_LOGIN_URL:
-		"renamed SESSION_LOGIN_PAGE_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_LOGIN_PAGE_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_SECRET:
-		"renamed SESSION_STORE_SECRET, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_SECRET, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_NAME:
-		"renamed SESSION_STORE_NAME, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_NAME, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_MAX_AGE:
-		"renamed SESSION_STORE_MAX_AGE, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_MAX_AGE, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_SECURE:
-		"renamed SESSION_STORE_SECURE, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_SECURE, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_SAME_SITE:
-		"renamed SESSION_STORE_SAME_SITE, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_SAME_SITE, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_DOMAIN:
-		"renamed SESSION_STORE_DOMAIN, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_DOMAIN, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_STORAGE_TYPE:
-		"renamed SESSION_STORE_STORAGE_TYPE, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_STORAGE_TYPE, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_STORAGE_REDIS_URL:
-		"renamed SESSION_STORE_STORAGE_REDIS_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_STORAGE_REDIS_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	SESSION_STORAGE_REDIS_PASSWORD:
-		"renamed SESSION_STORE_STORAGE_REDIS_PASSWORD, and only captured — set alone, or to another value, it fails boot",
+		"renamed SESSION_STORE_STORAGE_REDIS_PASSWORD, and only captured — set at any value, beside its new name or not, it fails boot",
 	LOG_LEVEL:
-		"renamed LOGGING_LEVEL, and only captured — set alone, or to another value, it fails boot",
+		"renamed LOGGING_LEVEL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CORS_ALLOWED_ORIGINS:
-		"renamed HTTP_CORS_ALLOWED_ORIGINS, and only captured — set alone, or to another value, it fails boot",
+		"renamed HTTP_CORS_ALLOWED_ORIGINS, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_SIGNING_KEY_PROVIDER:
-		"renamed KEY_STORE_PROVIDER, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_PROVIDER, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_ALGORITHM:
-		"renamed KEY_STORE_LOCAL_ALGORITHM, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_ALGORITHM, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_KID:
-		"renamed KEY_STORE_LOCAL_KID, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_KID, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_SECRET:
-		"renamed KEY_STORE_LOCAL_SECRET, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_SECRET, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_PRIVATE_KEY_PATH:
-		"renamed KEY_STORE_LOCAL_PRIVATE_KEY_PATH, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_PRIVATE_KEY_PATH, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_PUBLIC_KEY_PATH:
-		"renamed KEY_STORE_LOCAL_PUBLIC_KEY_PATH, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_PUBLIC_KEY_PATH, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_PRIVATE_KEY:
-		"renamed KEY_STORE_LOCAL_PRIVATE_KEY, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_PRIVATE_KEY, and only captured — set at any value, beside its new name or not, it fails boot",
 	OAUTH_JWT_PUBLIC_KEY:
-		"renamed KEY_STORE_LOCAL_PUBLIC_KEY, and only captured — set alone, or to another value, it fails boot",
+		"renamed KEY_STORE_LOCAL_PUBLIC_KEY, and only captured — set at any value, beside its new name or not, it fails boot",
 	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL:
-		"renamed REDIS_CLIENTS_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_CLIENTS_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	REFRESH_TOKEN_FAMILY_STORE_REDIS_PASSWORD:
-		"renamed REDIS_CLIENTS_PASSWORD, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_CLIENTS_PASSWORD, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_PATH:
-		"renamed REPOSITORIES_CLIENT_YAML_PATH, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_CLIENT_YAML_PATH, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_PATH:
-		"renamed REPOSITORIES_USER_YAML_PATH, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_YAML_PATH, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_AUTHENTICATE_URL:
-		"renamed REPOSITORIES_USER_HTTP_AUTHENTICATE_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_AUTHENTICATE_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_AUTHENTICATE_BY_TOKEN_URL:
-		"renamed REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_LINK_FEDERATED_IDENTITY_URL:
-		"renamed REPOSITORIES_USER_HTTP_LINK_FEDERATED_IDENTITY_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_LINK_FEDERATED_IDENTITY_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL:
-		"renamed REPOSITORIES_USER_HTTP_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_BEARER_TOKEN:
-		"renamed REPOSITORIES_USER_HTTP_BEARER_TOKEN, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_BEARER_TOKEN, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_TIMEOUT:
-		"renamed REPOSITORIES_USER_HTTP_TIMEOUT, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_TIMEOUT, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_USER_MAX_RESPONSE_BYTES:
-		"renamed REPOSITORIES_USER_HTTP_MAX_RESPONSE_BYTES, and only captured — set alone, or to another value, it fails boot",
+		"renamed REPOSITORIES_USER_HTTP_MAX_RESPONSE_BYTES, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_CODE_DEFAULT_EXPIRES_IN:
-		"renamed REDIS_CODE_REPOSITORY_DEFAULT_EXPIRES_IN (the Redis code repository) and STANDALONE_IN_MEMORY_CODE_REPOSITORY_DEFAULT_EXPIRES_IN (the in-process one), and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_CODE_REPOSITORY_DEFAULT_EXPIRES_IN (the Redis code repository) and STANDALONE_IN_MEMORY_CODE_REPOSITORY_DEFAULT_EXPIRES_IN (the in-process one), and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_CODE_KEY_PREFIX:
-		"renamed REDIS_CODE_REPOSITORY_KEY_PREFIX, and only captured — set alone, or to another value, it fails boot",
+		"renamed REDIS_CODE_REPOSITORY_KEY_PREFIX, and only captured — set at any value, beside its new name or not, it fails boot",
 	CLIENT_CODE_ENDPOINT_URI:
 		"removed: the Redis code repository uses the shared redis-clients connection; only captured — set at all, it fails boot",
 	CLIENT_CODE_PASSWORD:
 		"removed: the Redis code repository uses the shared redis-clients connection; only captured — set at all, it fails boot",
 	ENDPOINTS_MFA_URL:
-		"renamed MFA_PAGE_URL, and only captured — set alone, or to another value, it fails boot where MFA is installed",
+		"renamed MFA_PAGE_URL, and only captured — set at any value, beside its new name or not, it fails boot where MFA is installed",
 	MFA_TOTP_ENABLED:
-		"renamed MFA_TOTP_FACTOR_ENABLED, and only captured — set alone, or to another value, it fails boot where MFA is installed",
+		"renamed MFA_TOTP_FACTOR_ENABLED, and only captured — set at any value, beside its new name or not, it fails boot where MFA is installed",
 	MFA_TOTP_ISSUER:
-		"renamed MFA_TOTP_FACTOR_ISSUER, and only captured — set alone, or to another value, it fails boot where MFA is installed",
+		"renamed MFA_TOTP_FACTOR_ISSUER, and only captured — set at any value, beside its new name or not, it fails boot where MFA is installed",
 };
 
 /**
@@ -480,11 +487,11 @@ function commentedFederationBindings(): string {
 }
 
 /**
- * The provider environment `o3co/auth`'s `tests/docker-compose.yml` sets,
- * transcribed: each renamed variable under its old and its new name, the two
- * at one value. The umbrella E2E boots the shipped template with exactly this,
- * so a parse failure here is a red umbrella build that this repository can see
- * first. `SESSION_STORE_SECURE=false` is the one it cannot run without: the
+ * The provider environment `o3co/auth`'s `tests/docker-compose.yml` is to
+ * set, transcribed: each renamed variable under its new name alone, since an
+ * old name set refuses boot beside its new one too. The umbrella E2E boots
+ * the shipped template with this, so a parse failure here is a red umbrella
+ * build that this repository can see first. `SESSION_STORE_SECURE=false` is the one it cannot run without: the
  * suite speaks plain HTTP.
  *
  * The two `FEDERATION_TOKEN_STORE` lines are required: the federation token
@@ -493,37 +500,23 @@ function commentedFederationBindings(): string {
  * Redis store is selected with its encryption key.
  */
 const UMBRELLA_E2E_ENV: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ALGORITHM: "HS256",
 	KEY_STORE_LOCAL_ALGORITHM: "HS256",
-	OAUTH_JWT_SECRET: "e2e-shared-hs256-secret.at-least-32-bytes.ok",
 	KEY_STORE_LOCAL_SECRET: "e2e-shared-hs256-secret.at-least-32-bytes.ok",
 	OAUTH_JWT_ISSUER: "https://auth.e2e.test",
-	SESSION_SECRET: "lO0QH09fuKSGuViZ9myJbH3jsgai99A2GpC3RYRuy6Y=",
 	SESSION_STORE_SECRET: "lO0QH09fuKSGuViZ9myJbH3jsgai99A2GpC3RYRuy6Y=",
-	SESSION_SECURE: "false",
 	SESSION_STORE_SECURE: "false",
-	SESSION_NAME: "auth.session",
 	SESSION_STORE_NAME: "auth.session",
-	DEPLOYMENT_MODE: "multi",
 	CORE_DEPLOYMENT_MODE: "multi",
-	REFRESH_TOKEN_FAMILY_STORE_REDIS_URL: "redis://redis:6379",
 	REDIS_CLIENTS_URL: "redis://redis:6379",
-	SESSION_STORAGE_REDIS_URL: "redis://redis:6379",
 	SESSION_STORE_STORAGE_REDIS_URL: "redis://redis:6379",
-	USER_SESSION_STORES_ADAPTER: "redis",
 	ADAPTERS_USER_SESSION_STORES: "redis",
-	RATE_LIMITER_ADAPTER: "redis",
 	ADAPTERS_RATE_LIMITER: "redis",
-	OAUTH_CODE_ADAPTER: "redis",
 	ADAPTERS_CODE_REPOSITORY: "redis",
-	FEDERATION_TOKEN_STORE_TYPE: "redis",
 	ADAPTERS_FEDERATION_TOKEN_STORE: "redis",
 	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=",
-	CLIENT_USER_TYPE: "yaml",
 	ADAPTERS_USER_REPOSITORY: "yaml",
 	OAUTH_RESOURCE_INDICATOR_ENABLED: "true",
 	OAUTH_REQUIRE_EMAIL_VERIFIED: "true",
-	OAUTH_GRANTS_SESSION_ENABLED: "true",
 	OAUTH_SESSION_ENABLED: "true",
 	MFA_MODE: "off",
 };
@@ -782,6 +775,11 @@ describe("the shipped config boots with every documented override supplied as a
 		// A leftover string here would be read as "on" by a truthiness check
 		// and as "off" by `=== true`, for a feature whose whole default is off.
 		expect(federationGrantsSection(config).enabled).toBe(true);
+		expect(
+			standaloneRedisClientsModule.section?.schema.parse(
+				(config as Record<string, unknown>)["redis-clients"],
+			),
+		).toMatchObject({ assumeNoEviction: true });
 	});
 
 	it("turns every non-boolean override into its declared type", async () => {
@@ -1245,12 +1243,18 @@ describe("the shipped config boots with every documented override supplied as a
 			).rejects.toMatchObject({ reason: "environment-variable-renamed" });
 		});
 
-		it("boots with OAUTH_ACCESS_TOKEN_EXPIRES_IN beside its new name set to the same value, reading the new name", async () => {
-			const config = await bootParsed({
+		it("refuses OAUTH_ACCESS_TOKEN_EXPIRES_IN beside its new name set to the same value", async () => {
+			const booting = bootParsed({
 				...DOCUMENTED_ENV,
 				OAUTH_ACCESS_TOKEN_EXPIRES_IN:
 					DOCUMENTED_ENV.OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN as string,
 			});
+			await expect(booting).rejects.toMatchObject({ reason: "environment-variable-renamed" });
+			await expect(booting).rejects.toThrow(/unset OAUTH_ACCESS_TOKEN_EXPIRES_IN/);
+		});
+
+		it("boots with OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN alone, reading it", async () => {
+			const config = await bootParsed(DOCUMENTED_ENV);
 			expect(oauthSection(config).accessToken).toEqual({
 				defaultExpiresIn: 900,
 				maxExpiresIn: 7200,

package/templates/standalone/src/__tests__/federation-grants-composition.test.mts

@@ -85,6 +85,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(

package/templates/standalone/src/__tests__/logout-session-cookie.test.mts

@@ -0,0 +1,113 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template's two logout endpoints and the session cookie: the session
+ * store module expires the cookie of a session destroyed during the request,
+ * whichever route destroyed it, so `POST /oauth/logout` — whose package knows
+ * no cookie name — and `POST /session/logout` both answer with the cookie
+ * expired, with the attributes the login set it with.
+ */
+
+import type { SessionCookiePolicy } from "@o3co/auth-provider-core";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+import { authorize, codeFrom, compose, login, redeem } from "./all-modules-composition.fixture.mjs";
+
+/** The `Set-Cookie` lines among `lines` for the cookie `name`. */
+const linesNamed = (lines: readonly string[], name: string): string[] =>
+	lines.filter((line) => line.startsWith(`${name}=`));
+
+/** A response's `Set-Cookie` lines. */
+const setCookies = (res: request.Response): string[] =>
+	([] as string[]).concat(res.headers["set-cookie"] ?? []);
+
+/** A `Set-Cookie` line's attributes, lower-cased, with its value and expiry left out. */
+const attributesOf = (line: string): string[] =>
+	line
+		.split(";")
+		.slice(1)
+		.map((part) => part.trim().toLowerCase())
+		.filter((part) => !part.startsWith("expires=") && !part.startsWith("max-age="))
+		.sort();
+
+/** The CSRF token a login reissued, read off its double-submit cookie. */
+const csrfTokenOf = (cookies: readonly string[]): string => {
+	const cookie = cookies.find((c) => /^[^=]*\.csrf=/.test(c));
+	if (cookie === undefined) throw new Error("the login reissued no CSRF cookie");
+	return decodeURIComponent(cookie.slice(cookie.indexOf("=") + 1).split(";")[0] ?? "");
+};
+
+/**
+ * The one `Set-Cookie` line of `res` for the session cookie, checked to
+ * expire it with the attributes of `setLine`, the line the login set it with.
+ */
+function expectExpired(res: request.Response, name: string, setLine: string): void {
+	const lines = linesNamed(setCookies(res), name);
+	expect(lines).toHaveLength(1);
+	const [line] = lines as [string];
+	expect(line.startsWith(`${name}=;`)).toBe(true);
+	expect(line).toContain("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
+	expect(attributesOf(line)).toEqual(attributesOf(setLine));
+}
+
+describe("the session cookie at the template's logout endpoints", () => {
+	it("POST /oauth/logout expires the session cookie, with the attributes the login set it with", async () => {
+		const { app, handle } = await compose();
+		try {
+			const policy = handle.components.sessionCookiePolicy as SessionCookiePolicy;
+			const { res: signedIn, cookies } = await login(app);
+			expect(signedIn.status).toBe(200);
+			const [setLine] = linesNamed(cookies, policy.name);
+			expect(setLine).toBeDefined();
+			const tokens = await redeem(app, codeFrom(await authorize(app, cookies)));
+			expect(tokens.status).toBe(200);
+
+			const res = await request(app)
+				.post("/oauth/logout")
+				.set("Cookie", cookies)
+				.type("form")
+				.send({ id_token_hint: tokens.body.id_token as string });
+
+			expect(res.status).toBe(200);
+			expect(res.body).toEqual({ logged_out: true });
+			expectExpired(res, policy.name, setLine as string);
+		} finally {
+			await handle.dispose();
+		}
+	});
+
+	it("POST /session/logout expires the session cookie, with the attributes the login set it with", async () => {
+		const { app, handle } = await compose();
+		try {
+			const policy = handle.components.sessionCookiePolicy as SessionCookiePolicy;
+			const { res: signedIn, cookies } = await login(app);
+			expect(signedIn.status).toBe(200);
+			const [setLine] = linesNamed(cookies, policy.name);
+			expect(setLine).toBeDefined();
+
+			const res = await request(app)
+				.post("/session/logout")
+				.set("Cookie", cookies)
+				.set("x-csrf-token", csrfTokenOf(cookies));
+
+			expect(res.status).toBe(200);
+			expectExpired(res, policy.name, setLine as string);
+		} finally {
+			await handle.dispose();
+		}
+	});
+});