@o3co/create-auth-provider 0.17.0-rc.4 → 0.17.0

package/templates/standalone/src/__tests__/google-session.fixture.mts

@@ -54,6 +54,7 @@ import { expect } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
 import { resolveConfigPaths } from "#/configPath.mjs";
 import { templateReference } from "../modules.mjs";
+import { keyStoreSectionSchema } from "../sections.mjs";
 import {
 	type BothPhases,
 	bothPhasesOf,
@@ -179,16 +180,18 @@ const testRepositoriesModule = defineModule({
 	} as never,
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},
@@ -216,11 +219,18 @@ export const idTokenHint = (sid: string): string => signed("JWT", { aud: CLIENT_
 
 /**
  * An access token for the session as the authorization-code grant issues it
- * to the client: `azp`, `sid` and a refresh-token `family_id`. The `session`
- * grant's token names no family, and the federation token route asks for one.
+ * to the client, for the client itself: `aud` and `azp`, `sid` and a
+ * refresh-token `family_id`. The `session` grant's token names no family, and
+ * the federation token route asks for one.
  */
 export const accessTokenWithFamily = (sid: string): string =>
-	signed("at+jwt", { azp: CLIENT_ID, sid, family_id: "family-1", scope: "openid" });
+	signed("at+jwt", {
+		aud: CLIENT_ID,
+		azp: CLIENT_ID,
+		sid,
+		family_id: "family-1",
+		scope: "openid",
+	});
 
 const claimsOf = (jwt: string): Record<string, unknown> =>
 	JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8")) as Record<

package/templates/standalone/src/__tests__/lifecycle-pending-close.test.mts

@@ -33,6 +33,7 @@ import {
 	redeem,
 	WEB,
 } from "./all-modules-composition.fixture.mjs";
+import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
 
 afterEach(() => {
 	vi.restoreAllMocks();
@@ -44,7 +45,9 @@ const claimsOf = (token: string): Record<string, unknown> =>
 
 describe("a session whose close is pending on a failed relying-party notice", () => {
 	it("is refused by introspection, userinfo and the session grant, its user session still there", async () => {
+		const peer = await backchannelPeer(503);
 		const { app, handle } = await compose({
+			config: withLoopbackRelyingParties,
 			extraClients: {
 				"rp-down": {
 					tokenEndpointAuthMethod: "client_secret_basic",
@@ -52,7 +55,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 					allowedRedirectUris: ["https://rp-down.test/cb"],
 					allowedScopes: ["openid"],
 					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: "https://rp-down.test/logout",
+					backchannelLogoutUri: peer.uri,
 				},
 			},
 		});
@@ -89,7 +92,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 				await lifecycle.join(sid, {
 					rp: {
 						clientId: "rp-down",
-						backchannelLogoutUri: "https://rp-down.test/logout",
+						backchannelLogoutUri: peer.uri,
 						backchannelLogoutSessionRequired: true,
 						frontchannelLogoutUri: undefined,
 						frontchannelLogoutSessionRequired: undefined,
@@ -98,11 +101,8 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 					familyId: "family-down",
 				}),
 			).toEqual({ outcome: "joined" });
-			const posted = vi
-				.spyOn(globalThis, "fetch")
-				.mockImplementation(async () => new Response(null, { status: 503 }));
 			expect((await lifecycle.close(sid, "rp_logout")).outcome).toBe("pending");
-			expect(posted).toHaveBeenCalled();
+			expect(peer.tokens.length).toBeGreaterThan(0);
 			expect(await sessions.get(sid)).not.toBeNull();
 
 			const afterIntrospect = await introspect();
@@ -121,11 +121,14 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 			});
 		} finally {
 			await handle.dispose();
+			await peer.close();
 		}
 	});
 
 	it("an RP-initiated logout whose notice fails answers success, and its session is refused by introspection, userinfo and the session grant", async () => {
+		const peer = await backchannelPeer(503);
 		const { app, handle } = await compose({
+			config: withLoopbackRelyingParties,
 			extraClients: {
 				"rp-down": {
 					tokenEndpointAuthMethod: "client_secret_basic",
@@ -133,7 +136,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 					allowedRedirectUris: ["https://rp-down.test/cb"],
 					allowedScopes: ["openid"],
 					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: "https://rp-down.test/logout",
+					backchannelLogoutUri: peer.uri,
 				},
 			},
 		});
@@ -166,7 +169,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 				await lifecycle.join(sid, {
 					rp: {
 						clientId: "rp-down",
-						backchannelLogoutUri: "https://rp-down.test/logout",
+						backchannelLogoutUri: peer.uri,
 						backchannelLogoutSessionRequired: true,
 						frontchannelLogoutUri: undefined,
 						frontchannelLogoutSessionRequired: undefined,
@@ -174,9 +177,6 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 					},
 				}),
 			).toEqual({ outcome: "joined" });
-			const posted = vi
-				.spyOn(globalThis, "fetch")
-				.mockImplementation(async () => new Response(null, { status: 503 }));
 
 			const logout = await request(app)
 				.post("/oauth/logout")
@@ -186,7 +186,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 			// The close committed with the notice pending: the logout succeeded.
 			expect(logout.status).toBe(200);
 			expect(logout.body).toEqual({ logged_out: true });
-			expect(posted).toHaveBeenCalled();
+			expect(peer.tokens.length).toBeGreaterThan(0);
 			expect(await sessions.get(sid)).not.toBeNull();
 
 			const introspected = await request(app)
@@ -211,6 +211,7 @@ describe("a session whose close is pending on a failed relying-party notice", ()
 			});
 		} finally {
 			await handle.dispose();
+			await peer.close();
 		}
 	});
 });

package/templates/standalone/src/__tests__/own-modules.test.mts

@@ -27,9 +27,7 @@
  */
 
 import { generateKeyPairSync } from "node:crypto";
-import { once } from "node:events";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { type AddressInfo, createServer, type Socket } from "node:net";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -47,8 +45,9 @@ import {
 	moduleReferences,
 	supportsMfaEnrollmentWitness,
 } from "@o3co/auth-provider-core";
-import { httpSettingsContract, packageReferenceProblems } from "@o3co/auth-provider-core/testing";
+import { packageReferenceProblems } from "@o3co/auth-provider-core/testing";
 import { HttpUserRepository } from "@o3co/auth-provider-foundation";
+import { httpSettingsContract } from "@o3co/auth-provider-test-kit";
 import { parseFile } from "@o3co/ts.hocon";
 import express from "express";
 import request from "supertest";
@@ -74,6 +73,7 @@ import {
 	standaloneRedisClientsModule,
 } from "../modules.mjs";
 import { repositoriesSectionSchema } from "../sections.mjs";
+import { listeningRedis } from "./redis-stand-in.fixture.mjs";
 
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 /** The template's own defaults: what its modules declare as their sections' reference. */
@@ -990,38 +990,6 @@ describe("key-store", () => {
 	});
 });
 
-/**
- * A TCP server standing in for Redis: it records what each connection sends
- * and answers nothing, so a client dialled at it connects and writes its
- * handshake.
- */
-async function listeningRedis(): Promise<{
-	readonly port: number;
-	readonly received: () => string;
-	readonly close: () => Promise<void>;
-}> {
-	const sockets = new Set<Socket>();
-	let received = "";
-	const server = createServer((socket) => {
-		sockets.add(socket);
-		socket.on("close", () => sockets.delete(socket));
-		socket.on("data", (chunk) => {
-			received += chunk.toString("utf8");
-		});
-	});
-	server.listen(0, "127.0.0.1");
-	await once(server, "listening");
-	const { port } = server.address() as AddressInfo;
-	return {
-		port,
-		received: () => received,
-		close: async () => {
-			for (const socket of sockets) socket.destroy();
-			await new Promise<void>((resolve) => server.close(() => resolve()));
-		},
-	};
-}
-
 describe("redis-clients", () => {
 	it("owns redis-clients, and reads it as its section rather than the configuration", () => {
 		expect(standaloneRedisClientsModule.name).toBe("redis-clients");

package/templates/standalone/src/__tests__/redis-assume-noeviction.test.mts

@@ -107,8 +107,11 @@ const MFA_ON_REDIS: Readonly<Record<string, string>> = {
 	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
 };
 
-const composing = (env: Readonly<Record<string, string>>): Promise<unknown> =>
-	compose({ env, environment: "production", shippedRefreshTokenFamilyStore: true }).then(
+const composing = (
+	env: Readonly<Record<string, string>>,
+	shippedRefreshTokenFamilyStore = true,
+): Promise<unknown> =>
+	compose({ env, environment: "production", shippedRefreshTokenFamilyStore }).then(
 		(composition) => {
 			current = composition;
 			return undefined;
@@ -157,9 +160,75 @@ describe("a Redis that will not report its eviction policy", () => {
 	});
 });
 
+describe("the shipped refresh-token family store on a Redis that will not report its eviction policy", () => {
+	it.each([
+		["unset", SINGLE_ENV],
+		["false", { ...SINGLE_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
+		async (_label, env) => {
+			expect(await composing(env)).toMatchObject({
+				reason: "provides-factory-failed",
+				details: {
+					module: "redis-refresh-token-family-store",
+					componentKey: "refreshTokenFamilyStore",
+				},
+				cause: {
+					name: "RedisStoreEvictableError",
+					reason: "refresh-token-family-store-evictable",
+					maxmemoryPolicy: undefined,
+				},
+			});
+		},
+	);
+
+	it("boots with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composing({ ...SINGLE_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.handle.components.refreshTokenFamilyStore?.kind).toBe("redis");
+	});
+});
+
+describe("the replay seen-set on a Redis that will not report its eviction policy", () => {
+	/** Only the seen-set on Redis: a refusal can come from no other store. */
+	const REPLAY_ONLY = {
+		...SINGLE_ENV,
+		ADAPTERS_REPLAY_SEEN_SET: "redis",
+		REDIS_CLIENTS_URL: "redis://redis.test:6379",
+	};
+	const composingReplayOnly = (env: Readonly<Record<string, string>>) => composing(env, false);
+
+	it.each([
+		["unset", REPLAY_ONLY],
+		["false", { ...REPLAY_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
+	])(
+		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
+		async (_label, env) => {
+			expect(await composingReplayOnly(env)).toMatchObject({
+				reason: "provides-factory-failed",
+				details: { module: "redis-replay-seen-set", componentKey: "replaySeenSet" },
+				cause: {
+					name: "RedisStoreEvictableError",
+					reason: "replay-seen-set-evictable",
+					maxmemoryPolicy: undefined,
+				},
+			});
+		},
+	);
+
+	it("boots with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
+		expect(
+			await composingReplayOnly({ ...REPLAY_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+		).toBeUndefined();
+		expect(current?.handle.components.replaySeenSet?.kind).toBe("redis");
+	});
+});
+
 describe("the MFA stores on a Redis that will not report its eviction policy", () => {
 	/** Only the MFA stores on Redis: a refusal can come from no other store. */
 	const MFA_ONLY = { ...SINGLE_ENV, ...MFA_ON_REDIS };
+	const composingMfaOnly = (env: Readonly<Record<string, string>>) => composing(env, false);
 
 	it.each([
 		["unset", MFA_ONLY],
@@ -167,7 +236,7 @@ describe("the MFA stores on a Redis that will not report its eviction policy", (
 	])(
 		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming an MFA store",
 		async (_label, env) => {
-			const err = await composing(env);
+			const err = await composingMfaOnly(env);
 			expect(err).toBeInstanceOf(BootError);
 			expect(err).toMatchObject({
 				reason: "provides-factory-failed",
@@ -182,7 +251,7 @@ describe("the MFA stores on a Redis that will not report its eviction policy", (
 
 	it("boots both MFA stores with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
 		expect(
-			await composing({ ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
+			await composingMfaOnly({ ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
 		).toBeUndefined();
 		expect(current?.modules.map((module) => module.name)).toEqual(
 			expect.arrayContaining(["redis-mfa-factor-store", "redis-mfa-transaction-store"]),

package/templates/standalone/src/__tests__/redis-stand-in.fixture.mts

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * A TCP stand-in for a Redis server, for the tests that boot the template
+ * against a socket and need no real server: it records what each connection
+ * sends and answers only what boot needs — the handshake (`HELLO` refused, so
+ * the client speaks RESP2), `INFO` reporting `maxmemory-policy noeviction`,
+ * and `+OK` to anything else. It stores nothing and is not a Redis for data:
+ * a test that reads or writes a store needs a real server.
+ */
+
+import { once } from "node:events";
+import { type AddressInfo, createServer, type Socket } from "node:net";
+
+/** The first command `buffer` holds in full, as RESP sends it, and its length; `undefined` until it does. */
+function nextCommand(
+	buffer: string,
+): { readonly name: string; readonly length: number } | undefined {
+	const header = /^\*(\d+)\r\n/.exec(buffer);
+	if (header === null) return undefined;
+	let at = header[0].length;
+	const args: string[] = [];
+	for (let i = 0; i < Number(header[1]); i++) {
+		const bulk = /^\$(\d+)\r\n/.exec(buffer.slice(at));
+		if (bulk === null) return undefined;
+		const start = at + bulk[0].length;
+		const end = start + Number(bulk[1]);
+		if (buffer.length < end + 2) return undefined;
+		args.push(buffer.slice(start, end));
+		at = end + 2;
+	}
+	return { name: (args[0] ?? "").toLowerCase(), length: at };
+}
+
+/** What a server that runs `noeviction` and speaks RESP2 answers `name`. */
+function replyTo(name: string): string {
+	if (name === "hello") return "-NOPROTO unsupported protocol version\r\n";
+	if (name === "info") {
+		const info =
+			"# Memory\r\nmaxmemory_policy:noeviction\r\n# Persistence\r\naof_enabled:1\r\nloading:0\r\n";
+		return `$${Buffer.byteLength(info)}\r\n${info}\r\n`;
+	}
+	return "+OK\r\n";
+}
+
+/**
+ * A TCP server standing in for Redis: it records what each connection sends,
+ * and answers as a server running `noeviction` does — `HELLO` refused, so the
+ * client speaks RESP2, `INFO` with the policy, anything else `OK` — so a
+ * client dialled at it writes its handshake and the stores whose factories
+ * read the policy build.
+ */
+export async function listeningRedis(): Promise<{
+	readonly port: number;
+	readonly received: () => string;
+	readonly close: () => Promise<void>;
+}> {
+	const sockets = new Set<Socket>();
+	let received = "";
+	const server = createServer((socket) => {
+		sockets.add(socket);
+		let pending = "";
+		socket.on("close", () => sockets.delete(socket));
+		socket.on("data", (chunk) => {
+			received += chunk.toString("utf8");
+			pending += chunk.toString("utf8");
+			for (let command = nextCommand(pending); command; command = nextCommand(pending)) {
+				pending = pending.slice(command.length);
+				socket.write(replyTo(command.name));
+			}
+		});
+	});
+	server.listen(0, "127.0.0.1");
+	await once(server, "listening");
+	const { port } = server.address() as AddressInfo;
+	return {
+		port,
+		received: () => received,
+		close: async () => {
+			for (const socket of sockets) socket.destroy();
+			await new Promise<void>((resolve) => server.close(() => resolve()));
+		},
+	};
+}

package/templates/standalone/src/__tests__/replica-safety.test.mts

@@ -56,6 +56,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { buildModules } from "../buildModules.mjs";
 import { resolveConfigPaths } from "../configPath.mjs";
 import { templateReference } from "../modules.mjs";
+import { keyStoreSectionSchema } from "../sections.mjs";
 import {
 	type BothPhases,
 	bothPhasesOf,
@@ -198,16 +199,18 @@ const testRepositoriesModule = defineModule({
 	},
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/__tests__/sections.test.mts

@@ -440,12 +440,20 @@ describe("key-store", () => {
 
 describe("redis-clients", () => {
 	it("accepts a URL, and a password beside it", () => {
-		expect(redisClientsSectionSchema.parse({ url: "redis://r:6379", password: "p" })).toEqual({
+		expect(
+			redisClientsSectionSchema.parse({
+				url: "redis://r:6379",
+				password: "p",
+				assumeNoEviction: false,
+			}),
+		).toEqual({
 			url: "redis://r:6379",
 			password: "p",
 			assumeNoEviction: false,
 		});
-		expect(redisClientsSectionSchema.parse({ url: "redis://r:6379" })).toEqual({
+		expect(
+			redisClientsSectionSchema.parse({ url: "redis://r:6379", assumeNoEviction: false }),
+		).toEqual({
 			url: "redis://r:6379",
 			assumeNoEviction: false,
 		});
@@ -476,7 +484,11 @@ describe("redis-clients", () => {
 	it.each([
 		["no URL", {}],
 		["a null URL", { url: null }],
-		["a key the section does not declare", { url: "redis://r:6379", db: 2 }],
+		[
+			"a key the section does not declare",
+			{ url: "redis://r:6379", db: 2, assumeNoEviction: false },
+		],
+		["no assumeNoEviction, which the template's reference.conf ships", { url: "redis://r:6379" }],
 	])("refuses %s", (_what, section) => {
 		expect(redisClientsSectionSchema.safeParse(section).success).toBe(false);
 	});

package/templates/standalone/src/__tests__/session-lifecycle.test.mts

@@ -41,6 +41,7 @@ import {
 	WEB,
 	webTokens,
 } from "./all-modules-composition.fixture.mjs";
+import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
 
 afterEach(() => {
 	vi.restoreAllMocks();
@@ -68,7 +69,9 @@ describe("the template, which composes the session lifecycle module", () => {
 	});
 
 	it("tells a relying party that joined, through the oauth module's notifier, when the session closes", async () => {
+		const peer = await backchannelPeer();
 		const { handle } = await compose({
+			config: withLoopbackRelyingParties,
 			extraClients: {
 				"rp-bc": {
 					tokenEndpointAuthMethod: "client_secret_basic",
@@ -76,7 +79,7 @@ describe("the template, which composes the session lifecycle module", () => {
 					allowedRedirectUris: ["https://rp-bc.test/cb"],
 					allowedScopes: ["openid"],
 					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: "https://rp-bc.test/logout",
+					backchannelLogoutUri: peer.uri,
 				},
 			},
 		});
@@ -99,7 +102,7 @@ describe("the template, which composes the session lifecycle module", () => {
 			});
 			const rp = {
 				clientId: "rp-bc",
-				backchannelLogoutUri: "https://rp-bc.test/logout",
+				backchannelLogoutUri: peer.uri,
 				backchannelLogoutSessionRequired: true,
 				frontchannelLogoutUri: undefined,
 				frontchannelLogoutSessionRequired: undefined,
@@ -108,15 +111,9 @@ describe("the template, which composes the session lifecycle module", () => {
 			expect(await lifecycle.join("sid-bc", { rp, familyId: "family-bc" })).toEqual({
 				outcome: "joined",
 			});
-			const posted = vi
-				.spyOn(globalThis, "fetch")
-				.mockImplementation(async () => new Response(null, { status: 200 }));
 			expect((await lifecycle.close("sid-bc", "rp_logout")).outcome).toBe("done");
-			expect(posted).toHaveBeenCalledTimes(1);
-			const [url, init] = posted.mock.calls[0] as [string, RequestInit];
-			expect(url).toBe("https://rp-bc.test/logout");
-			const token = new URLSearchParams(String(init.body)).get("logout_token");
-			expect(claimsOf(token ?? "")).toMatchObject({
+			expect(peer.tokens).toHaveLength(1);
+			expect(claimsOf(peer.tokens[0] ?? "")).toMatchObject({
 				iss: ISSUER,
 				aud: "rp-bc",
 				sub: "u-bc",
@@ -124,6 +121,7 @@ describe("the template, which composes the session lifecycle module", () => {
 			});
 		} finally {
 			await handle.dispose();
+			await peer.close();
 		}
 	});
 

package/templates/standalone/src/__tests__/session-logout-invalidates-token.test.mts

@@ -48,6 +48,7 @@ import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
 import type { Switches } from "../configPath.mjs";
+import { keyStoreSectionSchema } from "../sections.mjs";
 import { capturedRenames, inProcessAdapters } from "./library-references.fixture.mjs";
 
 const keyPair = generateKeyPairSync("ed25519", {
@@ -117,6 +118,12 @@ const config: AppConfig & Record<string, unknown> = {
 	},
 	rateLimit: { failMode: "open" },
 	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
+	// The in-process limiter's section as core's `reference.conf` ships it.
+	"core-rate-limiter-memory": {
+		maxBuckets: 10000,
+		defaultLimit: { limit: 60, windowSeconds: 60 },
+		limits: {},
+	},
 } as unknown as AppConfig;
 
 /** What phase one hands `buildModules`: the configuration, and every store in process. */
@@ -155,16 +162,18 @@ const testRepositoriesModule = defineModule({
 	} as never,
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/__tests__/session-logout-lifecycle.test.mts

@@ -31,6 +31,7 @@ import {
 import request from "supertest";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { authorize, codeFrom, compose, login, redeem } from "./all-modules-composition.fixture.mjs";
+import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
 
 afterEach(() => {
 	vi.restoreAllMocks();
@@ -49,7 +50,9 @@ const csrfTokenOf = (cookies: readonly string[]): string => {
 
 describe("POST /session/logout with the session lifecycle module", () => {
 	it("revokes the session's families, tells its relying parties and closes its record", async () => {
+		const peer = await backchannelPeer();
 		const { app, handle } = await compose({
+			config: withLoopbackRelyingParties,
 			extraClients: {
 				"rp-bc": {
 					tokenEndpointAuthMethod: "client_secret_basic",
@@ -57,7 +60,7 @@ describe("POST /session/logout with the session lifecycle module", () => {
 					allowedRedirectUris: ["https://rp-bc.test/cb"],
 					allowedScopes: ["openid"],
 					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: "https://rp-bc.test/logout",
+					backchannelLogoutUri: peer.uri,
 				},
 			},
 		});
@@ -76,7 +79,7 @@ describe("POST /session/logout with the session lifecycle module", () => {
 				await lifecycle.join(sid, {
 					rp: {
 						clientId: "rp-bc",
-						backchannelLogoutUri: "https://rp-bc.test/logout",
+						backchannelLogoutUri: peer.uri,
 						backchannelLogoutSessionRequired: true,
 						frontchannelLogoutUri: undefined,
 						frontchannelLogoutSessionRequired: undefined,
@@ -84,10 +87,6 @@ describe("POST /session/logout with the session lifecycle module", () => {
 					},
 				}),
 			).toEqual({ outcome: "joined" });
-			const posted = vi
-				.spyOn(globalThis, "fetch")
-				.mockImplementation(async () => new Response(null, { status: 200 }));
-
 			const csrfToken = csrfTokenOf(cookies);
 			const res = await request(app)
 				.post("/session/logout")
@@ -96,12 +95,13 @@ describe("POST /session/logout with the session lifecycle module", () => {
 
 			expect(res.status).toBe(200);
 			expect(await families.isFamilyRevoked(familyId)).toBe(true);
-			expect(posted.mock.calls.map(([url]) => String(url))).toEqual(["https://rp-bc.test/logout"]);
+			expect(peer.tokens).toHaveLength(1);
 			expect(await sessions.get(sid)).toBeNull();
 			const store = components.sessionLifecycleStore as SessionLifecycleStore;
 			expect(readVersionedSessionLifecycle(await store.read(sid))?.value.state).toBe("closed");
 		} finally {
 			await handle.dispose();
+			await peer.close();
 		}
 	});