@o3co/create-auth-provider 0.17.0-rc.3 → 0.17.0

package/templates/standalone/src/__tests__/redis-stand-in.fixture.mts

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * A TCP stand-in for a Redis server, for the tests that boot the template
+ * against a socket and need no real server: it records what each connection
+ * sends and answers only what boot needs — the handshake (`HELLO` refused, so
+ * the client speaks RESP2), `INFO` reporting `maxmemory-policy noeviction`,
+ * and `+OK` to anything else. It stores nothing and is not a Redis for data:
+ * a test that reads or writes a store needs a real server.
+ */
+
+import { once } from "node:events";
+import { type AddressInfo, createServer, type Socket } from "node:net";
+
+/** The first command `buffer` holds in full, as RESP sends it, and its length; `undefined` until it does. */
+function nextCommand(
+	buffer: string,
+): { readonly name: string; readonly length: number } | undefined {
+	const header = /^\*(\d+)\r\n/.exec(buffer);
+	if (header === null) return undefined;
+	let at = header[0].length;
+	const args: string[] = [];
+	for (let i = 0; i < Number(header[1]); i++) {
+		const bulk = /^\$(\d+)\r\n/.exec(buffer.slice(at));
+		if (bulk === null) return undefined;
+		const start = at + bulk[0].length;
+		const end = start + Number(bulk[1]);
+		if (buffer.length < end + 2) return undefined;
+		args.push(buffer.slice(start, end));
+		at = end + 2;
+	}
+	return { name: (args[0] ?? "").toLowerCase(), length: at };
+}
+
+/** What a server that runs `noeviction` and speaks RESP2 answers `name`. */
+function replyTo(name: string): string {
+	if (name === "hello") return "-NOPROTO unsupported protocol version\r\n";
+	if (name === "info") {
+		const info =
+			"# Memory\r\nmaxmemory_policy:noeviction\r\n# Persistence\r\naof_enabled:1\r\nloading:0\r\n";
+		return `$${Buffer.byteLength(info)}\r\n${info}\r\n`;
+	}
+	return "+OK\r\n";
+}
+
+/**
+ * A TCP server standing in for Redis: it records what each connection sends,
+ * and answers as a server running `noeviction` does — `HELLO` refused, so the
+ * client speaks RESP2, `INFO` with the policy, anything else `OK` — so a
+ * client dialled at it writes its handshake and the stores whose factories
+ * read the policy build.
+ */
+export async function listeningRedis(): Promise<{
+	readonly port: number;
+	readonly received: () => string;
+	readonly close: () => Promise<void>;
+}> {
+	const sockets = new Set<Socket>();
+	let received = "";
+	const server = createServer((socket) => {
+		sockets.add(socket);
+		let pending = "";
+		socket.on("close", () => sockets.delete(socket));
+		socket.on("data", (chunk) => {
+			received += chunk.toString("utf8");
+			pending += chunk.toString("utf8");
+			for (let command = nextCommand(pending); command; command = nextCommand(pending)) {
+				pending = pending.slice(command.length);
+				socket.write(replyTo(command.name));
+			}
+		});
+	});
+	server.listen(0, "127.0.0.1");
+	await once(server, "listening");
+	const { port } = server.address() as AddressInfo;
+	return {
+		port,
+		received: () => received,
+		close: async () => {
+			for (const socket of sockets) socket.destroy();
+			await new Promise<void>((resolve) => server.close(() => resolve()));
+		},
+	};
+}

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -56,6 +56,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "../buildModules.mjs";
 import { resolveConfigPaths } from "../configPath.mjs";
 import { templateReference } from "../modules.mjs";
+import { keyStoreSectionSchema } from "../sections.mjs";
 import {
 	type BothPhases,
 	bothPhasesOf,
@@ -198,16 +199,18 @@ const testRepositoriesModule = defineModule({
 	},
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/__tests__/repositories-logger.test.mts

@@ -0,0 +1,119 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The repositories module builds its user repository with the composition's
+ * logger: the yaml user builder's `user_repository_in_memory` line reaches the
+ * `logger` bootstrap component (the template's pino logger, at its level),
+ * not the console.
+ */
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	type BootstrapMap,
+	createApp,
+	defineModule,
+	type Logger,
+	type UserRepository,
+} from "@o3co/auth-provider-core";
+import {
+	CORE_RELOCATIONS,
+	makeValidCoreConfig,
+	renamedVariableCaptures,
+} from "@o3co/auth-provider-core/testing";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { repositoriesModuleFor } from "../modules.mjs";
+
+const spyLogger = () => {
+	const logger = {
+		trace: vi.fn(),
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn: vi.fn(),
+		error: vi.fn(),
+		fatal: vi.fn(),
+		child: vi.fn(),
+	};
+	logger.child.mockReturnValue(logger);
+	return logger;
+};
+
+describe("the repositories module's user repository", () => {
+	let dir: string;
+	beforeEach(() => {
+		dir = fs.mkdtempSync(path.join(os.tmpdir(), "repositories-logger-"));
+	});
+	afterEach(() => {
+		fs.rmSync(dir, { recursive: true, force: true });
+		vi.restoreAllMocks();
+	});
+
+	it("warns user_repository_in_memory on the composition's logger, built through createApp, and not on the console", async () => {
+		const usersPath = path.join(dir, "users.yaml");
+		fs.writeFileSync(usersPath, 'alice:\n  password: "plainpass"\n');
+		const clientsPath = path.join(dir, "clients.yaml");
+		fs.writeFileSync(clientsPath, "");
+		const consoleWarn = vi.spyOn(console, "warn").mockImplementation(() => {});
+		const logger = spyLogger();
+		let built: UserRepository | undefined;
+		const reader = defineModule({
+			name: "test:user-repository-reader",
+			requires: ["userRepository"] as const,
+			provides: {
+				userRepositoryRead: ({ userRepository }: { userRepository: UserRepository }) => {
+					built = userRepository;
+					return true;
+				},
+			},
+			lifecycle: { userRepositoryRead: { eager: true } },
+		} as never);
+
+		const repositories = repositoriesModuleFor({ client: "yaml", user: "yaml" });
+		const handle = await createApp({
+			modules: [repositories, reader],
+			bootstrapComponents: {
+				config: {
+					...makeValidCoreConfig(),
+					repositories: {
+						client: { yaml: { path: clientsPath } },
+						user: { yaml: { path: usersPath }, http: {} },
+					},
+					// What a resolution with none of the renamed variables set captures.
+					"renamed-variables": renamedVariableCaptures({
+						modules: [repositories],
+						core: CORE_RELOCATIONS,
+						env: {},
+					}),
+				},
+				pathResolver: (p: string) => p,
+				logger: logger as unknown as Logger,
+			} as unknown as BootstrapMap,
+		});
+		try {
+			expect((await built?.authenticate("alice", "plainpass"))?.username).toBe("alice");
+			expect(
+				logger.warn.mock.calls.filter(([, event]) => event === "user_repository_in_memory"),
+			).toEqual([[{ store: "userRepository", adapter: "yaml" }, "user_repository_in_memory"]]);
+			expect(
+				consoleWarn.mock.calls.filter((args) => args.includes("user_repository_in_memory")),
+			).toEqual([]);
+		} finally {
+			await handle.dispose();
+		}
+	});
+});

package/templates/standalone/src/__tests__/sections.test.mts

@@ -440,12 +440,20 @@ describe("key-store", () => {
 
 describe("redis-clients", () => {
 	it("accepts a URL, and a password beside it", () => {
-		expect(redisClientsSectionSchema.parse({ url: "redis://r:6379", password: "p" })).toEqual({
+		expect(
+			redisClientsSectionSchema.parse({
+				url: "redis://r:6379",
+				password: "p",
+				assumeNoEviction: false,
+			}),
+		).toEqual({
 			url: "redis://r:6379",
 			password: "p",
 			assumeNoEviction: false,
 		});
-		expect(redisClientsSectionSchema.parse({ url: "redis://r:6379" })).toEqual({
+		expect(
+			redisClientsSectionSchema.parse({ url: "redis://r:6379", assumeNoEviction: false }),
+		).toEqual({
 			url: "redis://r:6379",
 			assumeNoEviction: false,
 		});
@@ -476,7 +484,11 @@ describe("redis-clients", () => {
 	it.each([
 		["no URL", {}],
 		["a null URL", { url: null }],
-		["a key the section does not declare", { url: "redis://r:6379", db: 2 }],
+		[
+			"a key the section does not declare",
+			{ url: "redis://r:6379", db: 2, assumeNoEviction: false },
+		],
+		["no assumeNoEviction, which the template's reference.conf ships", { url: "redis://r:6379" }],
 	])("refuses %s", (_what, section) => {
 		expect(redisClientsSectionSchema.safeParse(section).success).toBe(false);
 	});

package/templates/standalone/src/__tests__/session-lifecycle.test.mts

@@ -41,6 +41,7 @@ import {
 	WEB,
 	webTokens,
 } from "./all-modules-composition.fixture.mjs";
+import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
 
 afterEach(() => {
 	vi.restoreAllMocks();
@@ -68,7 +69,9 @@ describe("the template, which composes the session lifecycle module", () => {
 	});
 
 	it("tells a relying party that joined, through the oauth module's notifier, when the session closes", async () => {
+		const peer = await backchannelPeer();
 		const { handle } = await compose({
+			config: withLoopbackRelyingParties,
 			extraClients: {
 				"rp-bc": {
 					tokenEndpointAuthMethod: "client_secret_basic",
@@ -76,7 +79,7 @@ describe("the template, which composes the session lifecycle module", () => {
 					allowedRedirectUris: ["https://rp-bc.test/cb"],
 					allowedScopes: ["openid"],
 					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: "https://rp-bc.test/logout",
+					backchannelLogoutUri: peer.uri,
 				},
 			},
 		});
@@ -99,7 +102,7 @@ describe("the template, which composes the session lifecycle module", () => {
 			});
 			const rp = {
 				clientId: "rp-bc",
-				backchannelLogoutUri: "https://rp-bc.test/logout",
+				backchannelLogoutUri: peer.uri,
 				backchannelLogoutSessionRequired: true,
 				frontchannelLogoutUri: undefined,
 				frontchannelLogoutSessionRequired: undefined,
@@ -108,15 +111,9 @@ describe("the template, which composes the session lifecycle module", () => {
 			expect(await lifecycle.join("sid-bc", { rp, familyId: "family-bc" })).toEqual({
 				outcome: "joined",
 			});
-			const posted = vi
-				.spyOn(globalThis, "fetch")
-				.mockImplementation(async () => new Response(null, { status: 200 }));
 			expect((await lifecycle.close("sid-bc", "rp_logout")).outcome).toBe("done");
-			expect(posted).toHaveBeenCalledTimes(1);
-			const [url, init] = posted.mock.calls[0] as [string, RequestInit];
-			expect(url).toBe("https://rp-bc.test/logout");
-			const token = new URLSearchParams(String(init.body)).get("logout_token");
-			expect(claimsOf(token ?? "")).toMatchObject({
+			expect(peer.tokens).toHaveLength(1);
+			expect(claimsOf(peer.tokens[0] ?? "")).toMatchObject({
 				iss: ISSUER,
 				aud: "rp-bc",
 				sub: "u-bc",
@@ -124,6 +121,7 @@ describe("the template, which composes the session lifecycle module", () => {
 			});
 		} finally {
 			await handle.dispose();
+			await peer.close();
 		}
 	});
 

package/templates/standalone/src/__tests__/session-logout-invalidates-token.test.mts

@@ -48,6 +48,7 @@ import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
 import type { Switches } from "../configPath.mjs";
+import { keyStoreSectionSchema } from "../sections.mjs";
 import { capturedRenames, inProcessAdapters } from "./library-references.fixture.mjs";
 
 const keyPair = generateKeyPairSync("ed25519", {
@@ -117,6 +118,12 @@ const config: AppConfig & Record<string, unknown> = {
 	},
 	rateLimit: { failMode: "open" },
 	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
+	// The in-process limiter's section as core's `reference.conf` ships it.
+	"core-rate-limiter-memory": {
+		maxBuckets: 10000,
+		defaultLimit: { limit: 60, windowSeconds: 60 },
+		limits: {},
+	},
 } as unknown as AppConfig;
 
 /** What phase one hands `buildModules`: the configuration, and every store in process. */
@@ -155,16 +162,18 @@ const testRepositoriesModule = defineModule({
 	} as never,
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/__tests__/session-logout-lifecycle.test.mts

@@ -31,6 +31,7 @@ import {
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { authorize, codeFrom, compose, login, redeem } from "./all-modules-composition.fixture.mjs";
+import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
 
 afterEach(() => {
 	vi.restoreAllMocks();
@@ -49,7 +50,9 @@ const csrfTokenOf = (cookies: readonly string[]): string => {
 
 describe("POST /session/logout with the session lifecycle module", () => {
 	it("revokes the session's families, tells its relying parties and closes its record", async () => {
+		const peer = await backchannelPeer();
 		const { app, handle } = await compose({
+			config: withLoopbackRelyingParties,
 			extraClients: {
 				"rp-bc": {
 					tokenEndpointAuthMethod: "client_secret_basic",
@@ -57,7 +60,7 @@ describe("POST /session/logout with the session lifecycle module", () => {
 					allowedRedirectUris: ["https://rp-bc.test/cb"],
 					allowedScopes: ["openid"],
 					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: "https://rp-bc.test/logout",
+					backchannelLogoutUri: peer.uri,
 				},
 			},
 		});
@@ -76,7 +79,7 @@ describe("POST /session/logout with the session lifecycle module", () => {
 				await lifecycle.join(sid, {
 					rp: {
 						clientId: "rp-bc",
-						backchannelLogoutUri: "https://rp-bc.test/logout",
+						backchannelLogoutUri: peer.uri,
 						backchannelLogoutSessionRequired: true,
 						frontchannelLogoutUri: undefined,
 						frontchannelLogoutSessionRequired: undefined,
@@ -84,10 +87,6 @@ describe("POST /session/logout with the session lifecycle module", () => {
 					},
 				}),
 			).toEqual({ outcome: "joined" });
-			const posted = vi
-				.spyOn(globalThis, "fetch")
-				.mockImplementation(async () => new Response(null, { status: 200 }));
-
 			const csrfToken = csrfTokenOf(cookies);
 			const res = await request(app)
 				.post("/session/logout")
@@ -96,12 +95,13 @@ describe("POST /session/logout with the session lifecycle module", () => {
 
 			expect(res.status).toBe(200);
 			expect(await families.isFamilyRevoked(familyId)).toBe(true);
-			expect(posted.mock.calls.map(([url]) => String(url))).toEqual(["https://rp-bc.test/logout"]);
+			expect(peer.tokens).toHaveLength(1);
 			expect(await sessions.get(sid)).toBeNull();
 			const store = components.sessionLifecycleStore as SessionLifecycleStore;
 			expect(readVersionedSessionLifecycle(await store.read(sid))?.value.state).toBe("closed");
 		} finally {
 			await handle.dispose();
+			await peer.close();
 		}
 	});
 

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -36,7 +36,7 @@ import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
 import type { Switches } from "../configPath.mjs";
-import type { Adapters } from "../sections.mjs";
+import { type Adapters, keyStoreSectionSchema } from "../sections.mjs";
 import {
 	capturedRenames,
 	inProcessAdapters,
@@ -110,6 +110,12 @@ const config: AppConfig & Record<string, unknown> = {
 	},
 	rateLimit: { failMode: "open" },
 	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
+	// The in-process limiter's section as core's `reference.conf` ships it.
+	"core-rate-limiter-memory": {
+		maxBuckets: 10000,
+		defaultLimit: { limit: 60, windowSeconds: 60 },
+		limits: {},
+	},
 };
 
 /** What phase one hands `buildModules`: the configuration, with `changes` over every store in process. */
@@ -165,16 +171,18 @@ const testRepositoriesModule = defineModule({
 	},
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/__tests__/startup-log-lines.test.mts

@@ -28,7 +28,8 @@ import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { listeningRedis } from "./redis-stand-in.fixture.mjs";
 
 const templateRoot = fileURLToPath(new URL("../..", import.meta.url));
 const tsxCli = createRequire(import.meta.url).resolve("tsx/cli");
@@ -45,14 +46,29 @@ const clientsFile = (() => {
 	return file;
 })();
 
+/**
+ * The Redis the refresh-token family store's shared socket dials: a stand-in
+ * that reports `noeviction`, so the store passes its eviction gate and the run
+ * reaches no real server.
+ */
+let redis: Awaited<ReturnType<typeof listeningRedis>>;
+
+beforeAll(async () => {
+	redis = await listeningRedis();
+});
+
+afterAll(async () => {
+	await redis?.close();
+});
+
 /**
  * Development, with every store the `adapters` section selects in memory.
  * The refresh-token family store has no memory choice in the template; its
- * shared Redis socket points at a port nothing answers, so the run reaches no
- * real server. Nothing is inherited from the test runner's environment but
- * PATH, so its NODE_ENV and LOGGING_LEVEL do not reach the child.
+ * shared Redis socket points at the stand-in above. Nothing is inherited from
+ * the test runner's environment but PATH, so its NODE_ENV and LOGGING_LEVEL do
+ * not reach the child.
  */
-const ENV: Readonly<Record<string, string>> = {
+const env = (): Readonly<Record<string, string>> => ({
 	PATH: process.env.PATH ?? "",
 	CONFIG_ENV: "development",
 	NODE_ENV: "development",
@@ -74,11 +90,11 @@ const ENV: Readonly<Record<string, string>> = {
 	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
 	ADAPTERS_MFA_FACTOR_STORE: "memory",
 	ADAPTERS_MFA_TRANSACTION_STORE: "memory",
-	REDIS_CLIENTS_URL: "redis://127.0.0.1:9",
+	REDIS_CLIENTS_URL: `redis://127.0.0.1:${redis.port}`,
 	REPOSITORIES_CLIENT_YAML_PATH: clientsFile,
 	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: "http://127.0.0.1:9/authenticate",
 	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: "http://127.0.0.1:9/authenticate-by-token",
-};
+});
 
 interface Run {
 	readonly stdout: string;
@@ -91,7 +107,7 @@ function startAndStop(timeoutMs: number): Promise<Run> {
 	return new Promise((resolve, reject) => {
 		const child: ChildProcess = spawn(process.execPath, [tsxCli, "src/app.mts"], {
 			cwd: templateRoot,
-			env: ENV,
+			env: env(),
 			stdio: ["ignore", "pipe", "pipe"],
 		});
 		let stdout = "";

package/templates/standalone/src/__tests__/store-credential.test.mts

@@ -48,7 +48,7 @@ import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
 import { resolveConfigPaths } from "../configPath.mjs";
 import { repositoriesModuleFor, templateReference } from "../modules.mjs";
-import { repositoriesSectionSchema } from "../sections.mjs";
+import { keyStoreSectionSchema, repositoriesSectionSchema } from "../sections.mjs";
 import {
 	type BothPhases,
 	bothPhasesOf,
@@ -186,16 +186,18 @@ describe("a token the Store refuses, seen from outside the booted app", () => {
 		ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 	};
 
+	// The template's `key-store` section, read by its own schema, without the
+	// section's relocation bridge.
 	const testKeyStoreModule = defineModule({
-		name: "test:key-store",
-		requires: ["config"] as const,
+		name: "key-store",
+		section: { schema: keyStoreSectionSchema },
 		provides: {
-			keyStore: async ({ config: c }) => {
+			keyStore: async ({ section }) => {
 				const factory = createKeyStoreFactory();
 				registerBuiltinKeyStores(factory);
 				return factory.create({
 					type: "local",
-					...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+					...(section.local ?? {}),
 				});
 			},
 		},

package/templates/standalone/src/__tests__/upstream-amr.acceptance.test.mts

@@ -50,6 +50,7 @@ import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
 import { resolveConfigPaths } from "#/configPath.mjs";
 import { templateReference } from "../modules.mjs";
+import { keyStoreSectionSchema } from "../sections.mjs";
 import {
 	type BothPhases,
 	bothPhasesOf,
@@ -181,16 +182,18 @@ const testRepositoriesModule = defineModule({
 	} as never,
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/app.mts

@@ -16,7 +16,6 @@
 import { fileURLToPath } from "node:url";
 import { createApp } from "@o3co/auth-provider-core";
 import express from "express";
-import helmet from "helmet";
 import { buildModules } from "./buildModules.mjs";
 import {
 	configDefaultsFor,
@@ -31,6 +30,7 @@ import { listen } from "./listen.mjs";
 import { createAppLogger } from "./logger.mjs";
 import { createMetrics } from "./metrics.mjs";
 import { mountRoutes } from "./routes.mjs";
+import { securityHeaders } from "./securityHeaders.mjs";
 import { installGracefulShutdown } from "./shutdown.mjs";
 
 // Step 1: the configuration, in two phases (`configPath.mts`; template
@@ -57,16 +57,7 @@ await (async (): Promise<void> => {
 	// `trust proxy` is set from the `http` module's `httpSettings` once boot
 	// has it (step 3), before a request can arrive.
 	const app = express();
-	app.use(
-		helmet({
-			contentSecurityPolicy: {
-				directives: {
-					defaultSrc: ["'none'"],
-					frameAncestors: ["'none'"],
-				},
-			},
-		}),
-	);
+	app.use(securityHeaders());
 
 	// Timing middleware goes ahead of everything so the histogram covers the
 	// whole stack — including responses produced by middleware that short-circuits