@o3co/create-auth-provider 0.17.0-rc.2 → 0.17.0-rc.4

package/templates/standalone/src/__tests__/mailpit-compose.test.mts

@@ -15,11 +15,12 @@
  */
 
 /**
- * The development compose run, `docker-compose.yml`, with MFA on as the
- * template ships it, and the Mailpit overlay, `docker-compose.mailpit.yml`: a
- * development run whose mail goes through the SMTP sender to Mailpit. It is an
- * overlay on `docker-compose.yml`, so a plain `docker compose up` starts no
- * Mailpit, and the production file names none. The compose files are read as
+ * The development compose run, `docker-compose.yml`, with MFA as the
+ * configuration's switch says (on as the template ships it), and the Mailpit
+ * overlay, `docker-compose.mailpit.yml`: a development run whose mail goes
+ * through the SMTP sender to Mailpit. It is an overlay on
+ * `docker-compose.yml`, so a plain `docker compose up` starts no Mailpit, and
+ * the production file names none. The compose files are read as
  * the fixed-shape files they are, and the process each run describes is booted
  * from the shipped files, as `app.mts` boots them, under the environment the
  * run sets: `.env.example`'s lines, then each compose file's `environment`, the
@@ -44,6 +45,7 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
 import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "#/configPath.mjs";
 import { createRecordingLogger } from "./all-modules-composition.fixture.mjs";
+import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
 
 vi.mock("redis", () => ({
 	createClient: vi.fn(() => ({
@@ -74,6 +76,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(
@@ -245,14 +251,15 @@ describe("the process each development run describes", () => {
 		};
 	}
 
-	it("boots docker-compose.yml's run with MFA required: development, the development mail sender, the MFA stores on its Redis", async () => {
+	it("boots docker-compose.yml's run with MFA as the configuration's switch says: development, the development mail sender, the MFA stores on its Redis", async () => {
 		const env = containerEnv(false);
 		// `app.mts`: CONFIG_ENV, then NODE_ENV, then development; the run sets neither.
 		expect(env.CONFIG_ENV ?? env.NODE_ENV).toBeUndefined();
 		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "development");
 		const own = readOwnLayers([envConfPath, applicationConfPath], { env });
 		const switches = readSwitches(own);
-		expect(switches.mfaMode).toBe("required");
+		const mode = configuredMfaMode("development");
+		expect(switches.mfaMode).toBe(mode);
 		// A hot reload restarts the process on every save, and Redis keeps the
 		// factors, and the sessions beside them, across it.
 		expect(switches.adapters).toMatchObject({
@@ -277,7 +284,7 @@ describe("the process each development run describes", () => {
 			"standard-development",
 		);
 		expect((handle.components.config as { mfa?: { mode?: unknown } } | undefined)?.mfa?.mode).toBe(
-			"required",
+			mode === "off" ? undefined : mode,
 		);
 	});
 
@@ -289,18 +296,27 @@ describe("the process each development run describes", () => {
 		expect(existsSync(resolveConfigPaths(configDir, configEnv as string).envConfPath)).toBe(true);
 	});
 
-	it("boots with MFA on and the SMTP sender in the mailSender slot, relaying to Mailpit", async () => {
-		const env = containerEnv();
+	/** The key the operator writes into `.env` for the Mailpit run (`openssl rand -base64 32`). */
+	const OWN_MFA_KEY = Buffer.alloc(32, 7).toString("base64");
+
+	/** The Mailpit run's modules and the configuration boot is handed, under `env`. */
+	function mailpitRun(env: Record<string, string>) {
 		const configEnv = env.CONFIG_ENV as string;
 		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
 		const own = readOwnLayers([envConfPath, applicationConfPath], { env });
 		const switches = readSwitches(own);
-		expect(switches.mfaMode).toBe("required");
-
 		const modules = buildModules(switches, {
 			environment: configEnv,
 			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
 		});
+		return { switches, modules, config: () => resolveForBoot(own, modules, switches) };
+	}
+
+	it("boots with the SMTP sender relaying to Mailpit: in the mailSender slot, with the operator's MFA key, while MFA is on (the configuration's switch); unread, with no mfa section, while it is off", async () => {
+		const env: Record<string, string> = { ...containerEnv(), MFA_ENCRYPTION_KEY: OWN_MFA_KEY };
+		const { switches, modules, config } = mailpitRun(env);
+		const mode = configuredMfaMode(env.CONFIG_ENV as string);
+		expect(switches.mfaMode).toBe(mode);
 		const names = modules.map((module) => module.name);
 		expect(names).toContain(standardSmtpMailSenderModule.name);
 		expect(names).not.toContain(
@@ -310,17 +326,68 @@ describe("the process each development run describes", () => {
 		const handle = await createApp({
 			modules,
 			bootstrapComponents: {
-				config: resolveForBoot(own, modules, switches),
+				config: config(),
 				pathResolver: (s: string) => s,
 				logger: createRecordingLogger(),
 			},
 		});
 		handles.push(handle);
-		expect((handle.components.mailSender as MailSender | undefined)?.kind).toBe("standard-smtp");
+		expect((handle.components.mailSender as MailSender | undefined)?.kind).toBe(
+			mode === "off" ? undefined : "standard-smtp",
+		);
+		const mfa = (
+			handle.components.config as {
+				mfa?: { mode?: unknown; encryptionKeys?: { key?: unknown }[] };
+			}
+		).mfa;
+		if (mode === "off") {
+			expect(mfa).toBeUndefined();
+		} else {
+			expect(mfa?.mode).toBe(mode);
+			expect(mfa?.encryptionKeys?.map((entry) => entry.key)).toEqual([OWN_MFA_KEY]);
+		}
 		expect(
 			(handle.components.config as Record<string, unknown> | undefined)?.[
 				"standard-smtp-mail-sender"
 			],
 		).toMatchObject({ host: "localhost", port: 1025, secure: "none" });
 	});
+
+	it("does not carry the development sample key: with MFA on, without MFA_ENCRYPTION_KEY the run is refused; with it off, nothing reads a key", async () => {
+		const env = containerEnv();
+		expect(env.MFA_ENCRYPTION_KEY).toBeUndefined();
+		const { modules, config } = mailpitRun(env);
+		if (configuredMfaMode(env.CONFIG_ENV as string) === "off") {
+			const handle = await createApp({
+				modules,
+				bootstrapComponents: {
+					config: config(),
+					pathResolver: (s: string) => s,
+					logger: createRecordingLogger(),
+				},
+			});
+			handles.push(handle);
+			expect(handle.components.config).not.toHaveProperty("mfa");
+			return;
+		}
+		const refused = await (async () => {
+			try {
+				handles.push(
+					await createApp({
+						modules,
+						bootstrapComponents: {
+							config: config(),
+							pathResolver: (s: string) => s,
+							logger: createRecordingLogger(),
+						},
+					}),
+				);
+			} catch (error) {
+				return error;
+			}
+			return undefined;
+		})();
+		expect(refused).toBeInstanceOf(Error);
+		expect(String((refused as Error).message)).toMatch(/mfa\.encryptionKeys/);
+	});
 });

package/templates/standalone/src/__tests__/mfa-switch.redis.test.mts

@@ -17,10 +17,10 @@
 /**
  * The template's MFA switch under the name production, where the MFA stores
  * must be shared: both on Redis, as a production deployment selects them.
- * ioredis is a stand-in, as in `all-modules-composition.multi.test.mts`:
- * nothing here issues a command, and the stores' durability check names what
- * it could not read and goes on. `packages/redis` runs the stores against a
- * real server.
+ * ioredis is a stand-in, as in `all-modules-composition.multi.test.mts`: it
+ * answers `INFO memory` as a default server does, so the stores' eviction gate
+ * passes, and their persistence check names what it could not read and goes
+ * on. `packages/redis` runs the stores against a real server.
  */
 
 import { BootError } from "@o3co/auth-provider-core";
@@ -36,6 +36,10 @@ vi.mock("ioredis", () => {
 		quit: async () => "OK",
 		disconnect: () => undefined,
 		ping: async () => "PONG",
+		// The Redis stores' eviction gate reads the policy from INFO memory: a
+		// default server's.
+		info: async (section: string) =>
+			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
 	};
 	const makeMockRedis = (): object =>
 		new Proxy(

package/templates/standalone/src/__tests__/mfa-switch.test.mts

@@ -15,14 +15,15 @@
  */
 
 /**
- * The template's MFA switch, `mfaMode` (`MFA_MODE`): `off`, the
- * default, installs nothing of MFA; `optional` and `required` install the MFA
- * package's modules — the MFA module, the TOTP, recovery-code and email
- * factors, the operator reset — with the session package's login completion
- * and the two MFA stores `adapters` selects, and declare `mfa` in
- * `core.sessionRequirements.expected`. Booted through the all-modules
- * fixture, and, where the shipped user repository or the development files
- * are the question, the way `app.mts` boots.
+ * The template's MFA switch, `mfaMode` (`MFA_MODE`): `off` installs nothing of
+ * MFA; `optional` and `required` install the MFA package's modules — the MFA
+ * module, the TOTP, recovery-code and email factors, the operator reset —
+ * with the session package's login completion and the two MFA stores
+ * `adapters` selects, and declare `mfa` in `core.sessionRequirements.expected`.
+ * With `MFA_MODE` unset, the switch is what the project's files write
+ * (`configured-mfa-mode.fixture.mts`). Booted through the all-modules fixture,
+ * and, where the shipped user repository or the development files are the
+ * question, the way `app.mts` boots.
  */
 
 import { generateKeyPairSync } from "node:crypto";
@@ -43,6 +44,7 @@ import {
 } from "@o3co/auth-provider-core";
 import { MFA_DEVELOPMENT_SAMPLE_KEY, mfaModules, mfaResetModule } from "@o3co/auth-provider-mfa";
 import { loginCompletionModule } from "@o3co/auth-provider-session";
+import { parseFile } from "@o3co/ts.hocon";
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
@@ -53,20 +55,25 @@ import {
 	resolveConfigPaths,
 	resolveForBoot,
 } from "#/configPath.mjs";
+import { mfaModulesFor } from "#/mfaSwitch.mjs";
+import { templateReference } from "#/modules.mjs";
 import {
 	ALICE,
 	authorize,
 	type Composition,
+	codeFrom,
 	compose,
 	contributionNames,
 	cookiesOf,
 	createRecordingLogger,
 	ISSUER,
+	login,
 	ownFiles,
 	type RecordingLogger,
 	SINGLE_ENV,
 	WEB,
 } from "./all-modules-composition.fixture.mjs";
+import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
 
 /** 32 bytes, base64: a key of the deployment's own for the MFA key ring. */
 const MFA_KEY = Buffer.alloc(32, 9).toString("base64");
@@ -133,17 +140,22 @@ const textOf = (err: unknown): string => {
 const warned = (logger: RecordingLogger, event: string) =>
 	logger.lines.filter((line) => line.level === "warn" && line.args[1] === event);
 
-/** `env` with MFA_MODE unset: the switch as the template ships it. */
+/** `env` with MFA_MODE unset: the switch as the configuration's files write it (`configuredMfaMode`). */
 const unset = (env: Readonly<Record<string, string>>): Record<string, string> => {
 	const { MFA_MODE: _unset, ...rest } = env;
 	return rest;
 };
 
 describe("the switch is the template's own key, mfaMode, bound to MFA_MODE", () => {
-	it("is required unless MFA_MODE says otherwise", () => {
+	it("ships required in the template's reference.conf, which --no-mfa leaves as it is", () => {
+		const reference = parseFile(fileURLToPath(templateReference()), { env: {} }).toObject();
+		expect((reference as Record<string, unknown>).mfaMode).toBe("required");
+	});
+
+	it("is what the configuration's files write unless MFA_MODE says otherwise", () => {
 		const switches = (env: Readonly<Record<string, string>>) =>
 			readSwitches(readOwnLayers(ownFiles(), { env })).mfaMode;
-		expect(switches(unset(SINGLE_ENV))).toBe("required");
+		expect(switches(unset(SINGLE_ENV))).toBe(configuredMfaMode("production"));
 		for (const mode of ["off", "optional", "required"] as const) {
 			expect(switches({ ...SINGLE_ENV, MFA_MODE: mode })).toBe(mode);
 		}
@@ -200,22 +212,37 @@ describe("the switch is the template's own key, mfaMode, bound to MFA_MODE", ()
 	});
 });
 
-describe("MFA_MODE unset: the template requires a second factor", () => {
-	it("installs every MFA module and declares mfa, as MFA_MODE=required does", async () => {
+describe("MFA_MODE unset: the switch the configuration's files write decides (required as the template ships it)", () => {
+	const mode = configuredMfaMode("production");
+
+	it("installs every MFA module and declares mfa while the switch is on, and nothing of MFA while it is off", async () => {
 		current = await boot({ env: unset(on("required")) });
 		const names = current.modules.map((m) => m.name);
-		expect(names.filter((name) => MFA_MODULE_NAMES.includes(name)).sort()).toEqual(
-			MFA_MODULE_NAMES,
-		);
+		const installed = names.filter((name) => MFA_MODULE_NAMES.includes(name)).sort();
+		if (mode === "off") {
+			expect(installed).toEqual([]);
+			expect(current.config.core?.sessionRequirements?.expected ?? []).not.toContain("mfa");
+			expect(current.config).not.toHaveProperty("mfa");
+			return;
+		}
+		expect(installed).toEqual(MFA_MODULE_NAMES);
 		expect(current.config.core?.sessionRequirements).toEqual({
 			expected: ["mfa"],
 			secondFactorAuthority: "mfa",
 		});
-		expect((current.config as unknown as { mfa: { mode: unknown } }).mfa.mode).toBe("required");
+		expect((current.config as unknown as { mfa: { mode: unknown } }).mfa.mode).toBe(mode);
 	});
 
-	it("interrupts a password login, opening no session /authorize accepts", async () => {
+	it("interrupts a password login while the switch is on, opening no session /authorize accepts; lets it through to a code while off", async () => {
 		current = await boot({ env: unset(on("required")) });
+		if (mode === "off") {
+			const { res, cookies } = await login(current.app);
+			expect(res.status).toBe(200);
+			const answer = await authorize(current.app, cookies);
+			expect(String(answer.headers.location ?? "").startsWith(WEB.redirectUri)).toBe(true);
+			expect(codeFrom(answer)).not.toBe("");
+			return;
+		}
 		const csrf = await request(current.app).get("/session/csrf");
 		const res = await request(current.app)
 			.post("/session/login")
@@ -402,6 +429,24 @@ describe("the MFA stores in memory: development and test alone", () => {
 		expect((err as BootError).reason).toBe("config-validation-failed");
 	});
 
+	it("names each reason it read: no name at all, a name neither development nor test, production", () => {
+		const memory = (environment: string | undefined) => () =>
+			mfaModulesFor({
+				mode: "required",
+				adapters: { mfaFactorStore: "memory", mfaTransactionStore: "memory" },
+				storeTransport: undefined,
+				environment,
+			});
+		vi.stubEnv("CONFIG_ENV", "");
+		vi.stubEnv("NODE_ENV", "");
+		expect(memory(undefined)).toThrow(/refused because no environment is named/);
+		expect(memory(" Prod ")).toThrow(/the environment "prod" is not development or test/);
+		vi.stubEnv("NODE_ENV", "Production");
+		expect(memory("test")).toThrow(/NODE_ENV is "production"/);
+		vi.stubEnv("NODE_ENV", " Test\n");
+		expect(memory("development")().map((m) => m.name)).toContain(memoryMfaFactorStoreModule.name);
+	});
+
 	it.each(["development", "test"])("lets them in under %s", async (environment) => {
 		current = await compose({ env: on("required"), environment });
 		expect(current.modules.map((m) => m.name)).toContain(memoryMfaFactorStoreModule.name);
@@ -739,14 +784,27 @@ describe("a deployment that takes MFA's modules out of buildModules() under MFA_
 });
 
 describe("the shipped configuration with nothing set about MFA", () => {
-	it("boots under CONFIG_ENV=development with MFA required: the sample key, the development mail sender, the MFA stores in memory", async () => {
+	it("boots under CONFIG_ENV=development with the switch its files write: with MFA on, on the sample key, the development mail sender and the MFA stores in memory", async () => {
+		const mode = configuredMfaMode("development");
 		const { logger, config } = await bootShipped(unset(SHIPPED_ENV), "development");
-		expect((config as unknown as { mfa: { mode: unknown } }).mfa.mode).toBe("required");
+		if (mode === "off") {
+			expect(config).not.toHaveProperty("mfa");
+			expect(config.core?.sessionRequirements?.expected ?? []).not.toContain("mfa");
+			expect(warned(logger, "mfa_development_sample_key_in_use")).toEqual([]);
+			return;
+		}
+		expect((config as unknown as { mfa: { mode: unknown } }).mfa.mode).toBe(mode);
 		expect(config.core?.sessionRequirements?.expected).toContain("mfa");
 		expect(warned(logger, "mfa_development_sample_key_in_use")).toHaveLength(1);
 	});
 
-	it("is refused in production before boot, naming the MFA stores, MFA_ENCRYPTION_KEY, the SMTP relay and MFA_MODE=off", async () => {
+	it("in production, with MFA on, is refused before boot, naming the MFA stores, MFA_ENCRYPTION_KEY, the SMTP relay and MFA_MODE=off; with it off, boots", async () => {
+		if (configuredMfaMode("production") === "off") {
+			const { config } = await bootShipped(unset(SHIPPED_ENV), "production");
+			expect(config).not.toHaveProperty("mfa");
+			expect(config.core?.sessionRequirements?.expected ?? []).not.toContain("mfa");
+			return;
+		}
 		let err: unknown;
 		await bootShipped(unset(SHIPPED_ENV), "production").catch((caught: unknown) => {
 			err = caught;

package/templates/standalone/src/__tests__/own-modules.test.mts

@@ -22,8 +22,8 @@
  * environment and HOCON overrides, through the template's real path:
  * `readOwnLayers`, then `resolveForBoot` over every loaded module's
  * reference, then `createApp`. A path a section moved from refuses boot
- * naming its new path, and a variable renamed with it refuses boot unless its
- * new name carries the same value.
+ * naming its new path, and a variable renamed with it refuses boot while its
+ * old name is set, whatever its new name holds.
  */
 
 import { generateKeyPairSync } from "node:crypto";
@@ -332,8 +332,19 @@ describe("logging", () => {
 		});
 	});
 
-	it("boots with LOG_LEVEL beside LOGGING_LEVEL at the same value", async () => {
-		const handle = await bootTemplate({ env: { LOG_LEVEL: "debug", LOGGING_LEVEL: "debug" } });
+	it("refuses LOG_LEVEL beside LOGGING_LEVEL at the same value", async () => {
+		await expect(
+			bootTemplate({ env: { LOG_LEVEL: "debug", LOGGING_LEVEL: "debug" } }),
+		).rejects.toMatchObject({
+			details: {
+				reason: "environment-variable-renamed",
+				renamed: [{ module: "logging", from: "LOG_LEVEL", state: "different" }],
+			},
+		});
+	});
+
+	it("boots with LOGGING_LEVEL alone", async () => {
+		const handle = await bootTemplate({ env: { LOGGING_LEVEL: "debug" } });
 		await handle.dispose();
 	});
 });
@@ -947,17 +958,32 @@ describe("key-store", () => {
 		});
 	});
 
-	it("boots with each old name beside its new one at the same value", async () => {
-		const handle = await bootTemplate({
-			env: {
-				OAUTH_JWT_PRIVATE_KEY: signingKey.privateKey,
-				OAUTH_JWT_PUBLIC_KEY: signingKey.publicKey,
-				OAUTH_JWT_KID: "k-both",
-				KEY_STORE_LOCAL_KID: "k-both",
+	it("refuses each old name beside its new one at the same value", async () => {
+		await expect(
+			bootTemplate({
+				env: {
+					OAUTH_JWT_PRIVATE_KEY: signingKey.privateKey,
+					OAUTH_JWT_PUBLIC_KEY: signingKey.publicKey,
+					OAUTH_JWT_KID: "k-both",
+					KEY_STORE_LOCAL_KID: "k-both",
+				},
+			}),
+		).rejects.toMatchObject({
+			details: {
+				reason: "environment-variable-renamed",
+				renamed: expect.arrayContaining([
+					expect.objectContaining({ from: "OAUTH_JWT_PRIVATE_KEY", state: "different" }),
+					expect.objectContaining({ from: "OAUTH_JWT_PUBLIC_KEY", state: "different" }),
+					expect.objectContaining({ from: "OAUTH_JWT_KID", state: "different" }),
+				]),
 			},
 		});
+	});
+
+	it("boots with each new name alone", async () => {
+		const handle = await bootTemplate({ env: { KEY_STORE_LOCAL_KID: "k-new" } });
 		try {
-			expect(handle.components.keyStore?.getSigningKidFallback()).toBe("k-both");
+			expect(handle.components.keyStore?.getSigningKidFallback()).toBe("k-new");
 		} finally {
 			await handle.dispose();
 		}

package/templates/standalone/src/__tests__/redis-assume-noeviction.test.mts

@@ -0,0 +1,214 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * `redis-clients.assumeNoEviction` (`REDIS_CLIENTS_ASSUME_NO_EVICTION`), on a
+ * Redis that will not report its eviction policy: every store on Redis, as a
+ * multi-replica deployment selects them. ioredis is a stand-in that refuses
+ * `INFO` and `CONFIG` as an ACL-restricted user's connection does; every
+ * other command resolves to nothing. node-redis and connect-redis, behind
+ * express-session's store, are stand-ins too, as in
+ * `all-modules-composition.multi.test.mts`.
+ */
+
+import { BootError } from "@o3co/auth-provider-core";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+	type Composition,
+	compose,
+	MULTI_ENV,
+	SINGLE_ENV,
+} from "./all-modules-composition.fixture.mjs";
+
+vi.mock("redis", () => ({
+	createClient: vi.fn(() => ({
+		connect: vi.fn().mockResolvedValue(undefined),
+		quit: vi.fn().mockResolvedValue(undefined),
+		ping: vi.fn().mockResolvedValue("PONG"),
+		on: vi.fn(),
+	})),
+}));
+
+vi.mock("connect-redis", async () => {
+	const { EventEmitter } = await import("node:events");
+	// express-session subscribes to store events, so the stand-in is an emitter.
+	return {
+		RedisStore: class MockRedisStore extends EventEmitter {
+			get(): unknown {
+				return undefined;
+			}
+			set(): void {}
+			destroy(): void {}
+		},
+	};
+});
+
+vi.mock("ioredis", () => {
+	const refused = async (): Promise<never> => {
+		throw Object.assign(new Error("NOPERM this user has no permissions to run this command"), {
+			name: "ReplyError",
+		});
+	};
+	const explicit: Record<string, unknown> = {
+		on: () => undefined,
+		quit: async () => "OK",
+		disconnect: () => undefined,
+		ping: async () => "PONG",
+		info: refused,
+		config: refused,
+	};
+	const makeMockRedis = (): object =>
+		new Proxy(
+			{},
+			{
+				get(_target, prop) {
+					// A function-valued `then` would make the instance a thenable.
+					if (typeof prop !== "string" || prop === "then") return undefined;
+					if (prop === "duplicate") return makeMockRedis;
+					if (prop in explicit) return explicit[prop];
+					return async () => null;
+				},
+			},
+		);
+	function MockRedis(): object {
+		return makeMockRedis();
+	}
+	return { Redis: MockRedis, default: MockRedis };
+});
+
+let current: Composition | undefined;
+
+afterEach(async () => {
+	await current?.handle.dispose();
+	current = undefined;
+});
+
+/** MFA required, both MFA stores on Redis, a key of the deployment's own and an SMTP relay. */
+const MFA_ON_REDIS: Readonly<Record<string, string>> = {
+	MFA_MODE: "required",
+	ADAPTERS_MFA_FACTOR_STORE: "redis",
+	ADAPTERS_MFA_TRANSACTION_STORE: "redis",
+	REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	MFA_ENCRYPTION_KEY: Buffer.alloc(32, 9).toString("base64"),
+	STANDARD_SMTP_MAIL_SENDER_HOST: "smtp.auth.test",
+	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
+};
+
+const composing = (env: Readonly<Record<string, string>>): Promise<unknown> =>
+	compose({ env, environment: "production", shippedRefreshTokenFamilyStore: true }).then(
+		(composition) => {
+			current = composition;
+			return undefined;
+		},
+		(caught: unknown) => caught,
+	);
+
+describe("a Redis that will not report its eviction policy", () => {
+	it.each([
+		["unset", MULTI_ENV],
+		["false", { ...MULTI_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
+		async (_label, env) => {
+			const err = await composing(env);
+			expect(err).toBeInstanceOf(BootError);
+			expect(err).toMatchObject({
+				reason: "provides-factory-failed",
+				cause: { name: "RedisStoreEvictableError", maxmemoryPolicy: undefined },
+			});
+		},
+	);
+
+	it("boots every store with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composing({ ...MULTI_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.modules.map((module) => module.name)).toEqual(
+			expect.arrayContaining([
+				"redis-attempt-counter",
+				"redis-session-stores",
+				"redis-federation-token-store",
+			]),
+		);
+	});
+
+	it("boots with redis-clients.assumeNoEviction = true written in HOCON", async () => {
+		const composition = await compose({
+			env: MULTI_ENV,
+			environment: "production",
+			shippedRefreshTokenFamilyStore: true,
+			operatorHocon: "redis-clients.assumeNoEviction = true\n",
+		});
+		current = composition;
+		expect(composition.handle).toBeDefined();
+	});
+});
+
+describe("the MFA stores on a Redis that will not report its eviction policy", () => {
+	/** Only the MFA stores on Redis: a refusal can come from no other store. */
+	const MFA_ONLY = { ...SINGLE_ENV, ...MFA_ON_REDIS };
+
+	it.each([
+		["unset", MFA_ONLY],
+		["false", { ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming an MFA store",
+		async (_label, env) => {
+			const err = await composing(env);
+			expect(err).toBeInstanceOf(BootError);
+			expect(err).toMatchObject({
+				reason: "provides-factory-failed",
+				cause: {
+					name: "RedisStoreEvictableError",
+					reason: expect.stringMatching(/^mfa-(factor|transaction)-store-evictable$/),
+					maxmemoryPolicy: undefined,
+				},
+			});
+		},
+	);
+
+	it("boots both MFA stores with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composing({ ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.modules.map((module) => module.name)).toEqual(
+			expect.arrayContaining(["redis-mfa-factor-store", "redis-mfa-transaction-store"]),
+		);
+		expect(current?.handle.components.mfaFactorStore?.kind).toBe("redis");
+		expect(current?.handle.components.mfaTransactionStore?.kind).toBe("redis");
+	});
+
+	it.each([
+		["unset", { ...MULTI_ENV, ...MFA_ON_REDIS }],
+		["false", { ...MULTI_ENV, ...MFA_ON_REDIS, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses every store on Redis with MFA on, REDIS_CLIENTS_ASSUME_NO_EVICTION %s",
+		async (_label, env) => {
+			expect(await composing(env)).toMatchObject({
+				reason: "provides-factory-failed",
+				cause: { name: "RedisStoreEvictableError", maxmemoryPolicy: undefined },
+			});
+		},
+	);
+
+	it("boots every store on Redis with MFA on and REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composing({ ...MULTI_ENV, ...MFA_ON_REDIS, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.handle.components.mfaFactorStore?.kind).toBe("redis");
+		expect(current?.handle.components.mfaTransactionStore?.kind).toBe("redis");
+	});
+});