@o3co/create-auth-provider 0.17.0-rc.3 → 0.17.0

package/templates/standalone/src/__tests__/frontchannel-logout-csp.test.mts

@@ -0,0 +1,168 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The front-channel logout page, served through the template behind its
+ * security headers, works under the one policy the response carries: its
+ * relying party's frame and its redirect are allowed, and nothing else is.
+ * Every other answer keeps the template's policy.
+ */
+
+import { createHash } from "node:crypto";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+import {
+	authorize,
+	basic,
+	codeFrom,
+	compose,
+	login,
+	PKCE,
+} from "./all-modules-composition.fixture.mjs";
+
+const RP = {
+	id: "rp-fc",
+	secret: "rp-fc-secret-long-enough",
+	redirectUri: "https://rp-fc.test/cb",
+	frontchannelLogoutUri: "https://rp-fc.test:8443/frontchannel-logout",
+	postLogoutRedirectUri: "https://rp-fc.test/signed-out",
+} as const;
+
+/** A serialized policy as directive name → sources; a directive named twice fails. */
+const parsePolicy = (policy: string): Map<string, string[]> => {
+	const directives = new Map<string, string[]>();
+	for (const part of policy.split(";")) {
+		const [name, ...sources] = part.trim().split(/\s+/);
+		if (name === undefined || name === "") continue;
+		if (directives.has(name)) throw new Error(`directive ${name} appears twice`);
+		directives.set(name, sources);
+	}
+	return directives;
+};
+
+/** The sources a fetch directive resolves to: its own, else `default-src`'s. */
+const effective = (policy: Map<string, string[]>, directive: string): string[] =>
+	policy.get(directive) ?? policy.get("default-src") ?? [];
+
+const decode = (value: string): string =>
+	value
+		.replace(/&quot;/g, '"')
+		.replace(/&#39;/g, "'")
+		.replace(/&lt;/g, "<")
+		.replace(/&gt;/g, ">")
+		.replace(/&amp;/g, "&");
+
+/** How many `Content-Security-Policy` header lines the response carried, as sent. */
+const policyHeaderCount = (response: object): number => {
+	const raw = (response as { res?: { rawHeaders?: unknown } }).res?.rawHeaders;
+	if (!Array.isArray(raw)) throw new Error("the response carries no raw headers");
+	return raw.filter(
+		(name, i) => i % 2 === 0 && String(name).toLowerCase() === "content-security-policy",
+	).length;
+};
+
+describe("the front-channel logout page under the template's security headers", () => {
+	it("is allowed its relying party's frame and its redirect by the one policy it is served with", async () => {
+		const { app, handle } = await compose({
+			extraClients: {
+				[RP.id]: {
+					tokenEndpointAuthMethod: "client_secret_basic",
+					clientSecret: RP.secret,
+					allowedRedirectUris: [RP.redirectUri],
+					allowedScopes: ["openid"],
+					allowedGrantTypes: ["authorization_code"],
+					frontchannelLogoutUri: RP.frontchannelLogoutUri,
+					postLogoutRedirectUris: [RP.postLogoutRedirectUri],
+					firstParty: true,
+				},
+			},
+		});
+		try {
+			// A session the relying party joined by exchanging a code.
+			const { cookies } = await login(app);
+			const exchanged = await request(app)
+				.post("/oauth/token")
+				.set("Authorization", basic(RP))
+				.type("form")
+				.send({
+					grant_type: "authorization_code",
+					code: codeFrom(await authorize(app, cookies, RP)),
+					redirect_uri: RP.redirectUri,
+					code_verifier: PKCE.verifier,
+				});
+			expect(exchanged.status).toBe(200);
+
+			const res = await request(app)
+				.get("/oauth/logout")
+				.set("Accept", "text/html")
+				.set("Cookie", cookies)
+				.query({
+					id_token_hint: exchanged.body.id_token as string,
+					post_logout_redirect_uri: RP.postLogoutRedirectUri,
+					state: "s-1",
+				});
+
+			expect(res.status).toBe(200);
+			expect(res.headers["content-type"]).toBe("text/html; charset=utf-8");
+			expect(policyHeaderCount(res)).toBe(1);
+			const policy = parsePolicy(res.headers["content-security-policy"] as string);
+
+			// The frame: the relying party's, from the one origin the policy allows.
+			const srcs = [...res.text.matchAll(/<iframe src="([^"]*)"/g)].map((m) => decode(m[1] ?? ""));
+			expect(srcs).toHaveLength(1);
+			expect(new URL(srcs[0] ?? "").origin).toBe("https://rp-fc.test:8443");
+			expect(effective(policy, "frame-src")).toEqual(["https://rp-fc.test:8443"]);
+
+			// The redirect: one inline script, allowed by its hash, sending the
+			// browser to the registered URI with the state.
+			const scripts = [
+				...res.text.matchAll(/<script data-target="([^"]*)" data-delay="(\d+)">([^<]*)<\/script>/g),
+			];
+			expect(scripts).toHaveLength(1);
+			expect(res.text.match(/<script/g)).toHaveLength(1);
+			const [, target, , text] = scripts[0] ?? [];
+			expect(decode(target ?? "")).toBe(`${RP.postLogoutRedirectUri}?state=s-1`);
+			const hash = createHash("sha256")
+				.update(text ?? "", "utf8")
+				.digest("base64");
+			expect(effective(policy, "script-src")).toEqual([`'sha256-${hash}'`]);
+
+			// Nothing else.
+			expect(policy.get("default-src")).toEqual(["'none'"]);
+			expect(effective(policy, "style-src")).toEqual(["'none'"]);
+			expect(effective(policy, "connect-src")).toEqual(["'none'"]);
+			expect(policy.get("frame-ancestors")).toEqual(["'none'"]);
+			expect(res.headers["cache-control"]).toBe("no-store");
+		} finally {
+			await handle.dispose();
+		}
+	});
+
+	it("leaves the template's policy on every other answer", async () => {
+		const { app, handle } = await compose();
+		try {
+			const res = await request(app).get("/.well-known/openid-configuration");
+
+			expect(policyHeaderCount(res)).toBe(1);
+			const policy = parsePolicy(res.headers["content-security-policy"] as string);
+			expect(policy.get("default-src")).toEqual(["'none'"]);
+			expect(policy.get("frame-ancestors")).toEqual(["'none'"]);
+			expect(effective(policy, "frame-src")).toEqual(["'none'"]);
+		} finally {
+			await handle.dispose();
+		}
+	});
+});

package/templates/standalone/src/__tests__/google-session.fixture.mts

@@ -54,6 +54,7 @@ import { expect } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
 import { resolveConfigPaths } from "#/configPath.mjs";
 import { templateReference } from "../modules.mjs";
+import { keyStoreSectionSchema } from "../sections.mjs";
 import {
 	type BothPhases,
 	bothPhasesOf,
@@ -179,16 +180,18 @@ const testRepositoriesModule = defineModule({
 	} as never,
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},
@@ -216,11 +219,18 @@ export const idTokenHint = (sid: string): string => signed("JWT", { aud: CLIENT_
 
 /**
  * An access token for the session as the authorization-code grant issues it
- * to the client: `azp`, `sid` and a refresh-token `family_id`. The `session`
- * grant's token names no family, and the federation token route asks for one.
+ * to the client, for the client itself: `aud` and `azp`, `sid` and a
+ * refresh-token `family_id`. The `session` grant's token names no family, and
+ * the federation token route asks for one.
  */
 export const accessTokenWithFamily = (sid: string): string =>
-	signed("at+jwt", { azp: CLIENT_ID, sid, family_id: "family-1", scope: "openid" });
+	signed("at+jwt", {
+		aud: CLIENT_ID,
+		azp: CLIENT_ID,
+		sid,
+		family_id: "family-1",
+		scope: "openid",
+	});
 
 const claimsOf = (jwt: string): Record<string, unknown> =>
 	JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8")) as Record<

package/templates/standalone/src/__tests__/lifecycle-pending-close.test.mts

@@ -33,6 +33,7 @@ import {
 	redeem,
 	WEB,
 } from "./all-modules-composition.fixture.mjs";
+import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
 
 afterEach(() => {
 	vi.restoreAllMocks();
@@ -44,7 +45,9 @@ const claimsOf = (token: string): Record<string, unknown> =>
 
 describe("a session whose close is pending on a failed relying-party notice", () => {
 	it("is refused by introspection, userinfo and the session grant, its user session still there", async () => {
+		const peer = await backchannelPeer(503);
 		const { app, handle } = await compose({
+			config: withLoopbackRelyingParties,
 			extraClients: {
 				"rp-down": {
 					tokenEndpointAuthMethod: "client_secret_basic",
@@ -52,7 +55,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 					allowedRedirectUris: ["https://rp-down.test/cb"],
 					allowedScopes: ["openid"],
 					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: "https://rp-down.test/logout",
+					backchannelLogoutUri: peer.uri,
 				},
 			},
 		});
@@ -89,7 +92,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 				await lifecycle.join(sid, {
 					rp: {
 						clientId: "rp-down",
-						backchannelLogoutUri: "https://rp-down.test/logout",
+						backchannelLogoutUri: peer.uri,
 						backchannelLogoutSessionRequired: true,
 						frontchannelLogoutUri: undefined,
 						frontchannelLogoutSessionRequired: undefined,
@@ -98,11 +101,8 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 					familyId: "family-down",
 				}),
 			).toEqual({ outcome: "joined" });
-			const posted = vi
-				.spyOn(globalThis, "fetch")
-				.mockImplementation(async () => new Response(null, { status: 503 }));
 			expect((await lifecycle.close(sid, "rp_logout")).outcome).toBe("pending");
-			expect(posted).toHaveBeenCalled();
+			expect(peer.tokens.length).toBeGreaterThan(0);
 			expect(await sessions.get(sid)).not.toBeNull();
 
 			const afterIntrospect = await introspect();
@@ -121,11 +121,14 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 			});
 		} finally {
 			await handle.dispose();
+			await peer.close();
 		}
 	});
 
 	it("an RP-initiated logout whose notice fails answers success, and its session is refused by introspection, userinfo and the session grant", async () => {
+		const peer = await backchannelPeer(503);
 		const { app, handle } = await compose({
+			config: withLoopbackRelyingParties,
 			extraClients: {
 				"rp-down": {
 					tokenEndpointAuthMethod: "client_secret_basic",
@@ -133,7 +136,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 					allowedRedirectUris: ["https://rp-down.test/cb"],
 					allowedScopes: ["openid"],
 					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: "https://rp-down.test/logout",
+					backchannelLogoutUri: peer.uri,
 				},
 			},
 		});
@@ -166,7 +169,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 				await lifecycle.join(sid, {
 					rp: {
 						clientId: "rp-down",
-						backchannelLogoutUri: "https://rp-down.test/logout",
+						backchannelLogoutUri: peer.uri,
 						backchannelLogoutSessionRequired: true,
 						frontchannelLogoutUri: undefined,
 						frontchannelLogoutSessionRequired: undefined,
@@ -174,9 +177,6 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 					},
 				}),
 			).toEqual({ outcome: "joined" });
-			const posted = vi
-				.spyOn(globalThis, "fetch")
-				.mockImplementation(async () => new Response(null, { status: 503 }));
 
 			const logout = await request(app)
 				.post("/oauth/logout")
@@ -186,7 +186,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 			// The close committed with the notice pending: the logout succeeded.
 			expect(logout.status).toBe(200);
 			expect(logout.body).toEqual({ logged_out: true });
-			expect(posted).toHaveBeenCalled();
+			expect(peer.tokens.length).toBeGreaterThan(0);
 			expect(await sessions.get(sid)).not.toBeNull();
 
 			const introspected = await request(app)
@@ -211,6 +211,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 			});
 		} finally {
 			await handle.dispose();
+			await peer.close();
 		}
 	});
 });

package/templates/standalone/src/__tests__/logout-session-cookie.test.mts

@@ -0,0 +1,113 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template's two logout endpoints and the session cookie: the session
+ * store module expires the cookie of a session destroyed during the request,
+ * whichever route destroyed it, so `POST /oauth/logout` — whose package knows
+ * no cookie name — and `POST /session/logout` both answer with the cookie
+ * expired, with the attributes the login set it with.
+ */
+
+import type { SessionCookiePolicy } from "@o3co/auth-provider-core";
+import request from "supertest";
+import { describe, expect, it } from "vitest";
+import { authorize, codeFrom, compose, login, redeem } from "./all-modules-composition.fixture.mjs";
+
+/** The `Set-Cookie` lines among `lines` for the cookie `name`. */
+const linesNamed = (lines: readonly string[], name: string): string[] =>
+	lines.filter((line) => line.startsWith(`${name}=`));
+
+/** A response's `Set-Cookie` lines. */
+const setCookies = (res: request.Response): string[] =>
+	([] as string[]).concat(res.headers["set-cookie"] ?? []);
+
+/** A `Set-Cookie` line's attributes, lower-cased, with its value and expiry left out. */
+const attributesOf = (line: string): string[] =>
+	line
+		.split(";")
+		.slice(1)
+		.map((part) => part.trim().toLowerCase())
+		.filter((part) => !part.startsWith("expires=") && !part.startsWith("max-age="))
+		.sort();
+
+/** The CSRF token a login reissued, read off its double-submit cookie. */
+const csrfTokenOf = (cookies: readonly string[]): string => {
+	const cookie = cookies.find((c) => /^[^=]*\.csrf=/.test(c));
+	if (cookie === undefined) throw new Error("the login reissued no CSRF cookie");
+	return decodeURIComponent(cookie.slice(cookie.indexOf("=") + 1).split(";")[0] ?? "");
+};
+
+/**
+ * The one `Set-Cookie` line of `res` for the session cookie, checked to
+ * expire it with the attributes of `setLine`, the line the login set it with.
+ */
+function expectExpired(res: request.Response, name: string, setLine: string): void {
+	const lines = linesNamed(setCookies(res), name);
+	expect(lines).toHaveLength(1);
+	const [line] = lines as [string];
+	expect(line.startsWith(`${name}=;`)).toBe(true);
+	expect(line).toContain("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
+	expect(attributesOf(line)).toEqual(attributesOf(setLine));
+}
+
+describe("the session cookie at the template's logout endpoints", () => {
+	it("POST /oauth/logout expires the session cookie, with the attributes the login set it with", async () => {
+		const { app, handle } = await compose();
+		try {
+			const policy = handle.components.sessionCookiePolicy as SessionCookiePolicy;
+			const { res: signedIn, cookies } = await login(app);
+			expect(signedIn.status).toBe(200);
+			const [setLine] = linesNamed(cookies, policy.name);
+			expect(setLine).toBeDefined();
+			const tokens = await redeem(app, codeFrom(await authorize(app, cookies)));
+			expect(tokens.status).toBe(200);
+
+			const res = await request(app)
+				.post("/oauth/logout")
+				.set("Cookie", cookies)
+				.type("form")
+				.send({ id_token_hint: tokens.body.id_token as string });
+
+			expect(res.status).toBe(200);
+			expect(res.body).toEqual({ logged_out: true });
+			expectExpired(res, policy.name, setLine as string);
+		} finally {
+			await handle.dispose();
+		}
+	});
+
+	it("POST /session/logout expires the session cookie, with the attributes the login set it with", async () => {
+		const { app, handle } = await compose();
+		try {
+			const policy = handle.components.sessionCookiePolicy as SessionCookiePolicy;
+			const { res: signedIn, cookies } = await login(app);
+			expect(signedIn.status).toBe(200);
+			const [setLine] = linesNamed(cookies, policy.name);
+			expect(setLine).toBeDefined();
+
+			const res = await request(app)
+				.post("/session/logout")
+				.set("Cookie", cookies)
+				.set("x-csrf-token", csrfTokenOf(cookies));
+
+			expect(res.status).toBe(200);
+			expectExpired(res, policy.name, setLine as string);
+		} finally {
+			await handle.dispose();
+		}
+	});
+});

package/templates/standalone/src/__tests__/own-modules.test.mts

@@ -27,9 +27,7 @@
  */
 
 import { generateKeyPairSync } from "node:crypto";
-import { once } from "node:events";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { type AddressInfo, createServer, type Socket } from "node:net";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -47,8 +45,9 @@ import {
 	moduleReferences,
 	supportsMfaEnrollmentWitness,
 } from "@o3co/auth-provider-core";
-import { httpSettingsContract, packageReferenceProblems } from "@o3co/auth-provider-core/testing";
+import { packageReferenceProblems } from "@o3co/auth-provider-core/testing";
 import { HttpUserRepository } from "@o3co/auth-provider-foundation";
+import { httpSettingsContract } from "@o3co/auth-provider-test-kit";
 import { parseFile } from "@o3co/ts.hocon";
 import express from "express";
 import request from "supertest";
@@ -74,6 +73,7 @@ import {
 	standaloneRedisClientsModule,
 } from "../modules.mjs";
 import { repositoriesSectionSchema } from "../sections.mjs";
+import { listeningRedis } from "./redis-stand-in.fixture.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 /** The template's own defaults: what its modules declare as their sections' reference. */
@@ -990,38 +990,6 @@ describe("key-store", () => {
 	});
 });
 
-/**
- * A TCP server standing in for Redis: it records what each connection sends
- * and answers nothing, so a client dialled at it connects and writes its
- * handshake.
- */
-async function listeningRedis(): Promise<{
-	readonly port: number;
-	readonly received: () => string;
-	readonly close: () => Promise<void>;
-}> {
-	const sockets = new Set<Socket>();
-	let received = "";
-	const server = createServer((socket) => {
-		sockets.add(socket);
-		socket.on("close", () => sockets.delete(socket));
-		socket.on("data", (chunk) => {
-			received += chunk.toString("utf8");
-		});
-	});
-	server.listen(0, "127.0.0.1");
-	await once(server, "listening");
-	const { port } = server.address() as AddressInfo;
-	return {
-		port,
-		received: () => received,
-		close: async () => {
-			for (const socket of sockets) socket.destroy();
-			await new Promise<void>((resolve) => server.close(() => resolve()));
-		},
-	};
-}
-
 describe("redis-clients", () => {
 	it("owns redis-clients, and reads it as its section rather than the configuration", () => {
 		expect(standaloneRedisClientsModule.name).toBe("redis-clients");

package/templates/standalone/src/__tests__/redis-assume-noeviction.test.mts

@@ -107,8 +107,11 @@ const MFA_ON_REDIS: Readonly<Record<string, string>> = {
 	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
 };
 
-const composing = (env: Readonly<Record<string, string>>): Promise<unknown> =>
-	compose({ env, environment: "production", shippedRefreshTokenFamilyStore: true }).then(
+const composing = (
+	env: Readonly<Record<string, string>>,
+	shippedRefreshTokenFamilyStore = true,
+): Promise<unknown> =>
+	compose({ env, environment: "production", shippedRefreshTokenFamilyStore }).then(
 		(composition) => {
 			current = composition;
 			return undefined;
@@ -157,9 +160,75 @@ describe("a Redis that will not report its eviction policy", () => {
 	});
 });
 
+describe("the shipped refresh-token family store on a Redis that will not report its eviction policy", () => {
+	it.each([
+		["unset", SINGLE_ENV],
+		["false", { ...SINGLE_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
+		async (_label, env) => {
+			expect(await composing(env)).toMatchObject({
+				reason: "provides-factory-failed",
+				details: {
+					module: "redis-refresh-token-family-store",
+					componentKey: "refreshTokenFamilyStore",
+				},
+				cause: {
+					name: "RedisStoreEvictableError",
+					reason: "refresh-token-family-store-evictable",
+					maxmemoryPolicy: undefined,
+				},
+			});
+		},
+	);
+
+	it("boots with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composing({ ...SINGLE_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.handle.components.refreshTokenFamilyStore?.kind).toBe("redis");
+	});
+});
+
+describe("the replay seen-set on a Redis that will not report its eviction policy", () => {
+	/** Only the seen-set on Redis: a refusal can come from no other store. */
+	const REPLAY_ONLY = {
+		...SINGLE_ENV,
+		ADAPTERS_REPLAY_SEEN_SET: "redis",
+		REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	};
+	const composingReplayOnly = (env: Readonly<Record<string, string>>) => composing(env, false);
+
+	it.each([
+		["unset", REPLAY_ONLY],
+		["false", { ...REPLAY_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
+		async (_label, env) => {
+			expect(await composingReplayOnly(env)).toMatchObject({
+				reason: "provides-factory-failed",
+				details: { module: "redis-replay-seen-set", componentKey: "replaySeenSet" },
+				cause: {
+					name: "RedisStoreEvictableError",
+					reason: "replay-seen-set-evictable",
+					maxmemoryPolicy: undefined,
+				},
+			});
+		},
+	);
+
+	it("boots with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composingReplayOnly({ ...REPLAY_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.handle.components.replaySeenSet?.kind).toBe("redis");
+	});
+});
+
 describe("the MFA stores on a Redis that will not report its eviction policy", () => {
 	/** Only the MFA stores on Redis: a refusal can come from no other store. */
 	const MFA_ONLY = { ...SINGLE_ENV, ...MFA_ON_REDIS };
+	const composingMfaOnly = (env: Readonly<Record<string, string>>) => composing(env, false);
 
 	it.each([
 		["unset", MFA_ONLY],
@@ -167,7 +236,7 @@ describe("the MFA stores on a Redis that will not report its eviction policy", (
 	])(
 		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming an MFA store",
 		async (_label, env) => {
-			const err = await composing(env);
+			const err = await composingMfaOnly(env);
 			expect(err).toBeInstanceOf(BootError);
 			expect(err).toMatchObject({
 				reason: "provides-factory-failed",
@@ -182,7 +251,7 @@ describe("the MFA stores on a Redis that will not report its eviction policy", (
 
 	it("boots both MFA stores with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
 		expect(
-			await composing({ ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+			await composingMfaOnly({ ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
 		).toBeUndefined();
 		expect(current?.modules.map((module) => module.name)).toEqual(
 			expect.arrayContaining(["redis-mfa-factor-store", "redis-mfa-transaction-store"]),