@o3co/create-auth-provider 0.17.0-rc.4 → 0.17.0

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -36,7 +36,7 @@ import request from "supertest";
 import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
 import type { Switches } from "../configPath.mjs";
-import type { Adapters } from "../sections.mjs";
+import { type Adapters, keyStoreSectionSchema } from "../sections.mjs";
 import {
 	capturedRenames,
 	inProcessAdapters,
@@ -110,6 +110,12 @@ const config: AppConfig & Record<string, unknown> = {
 	},
 	rateLimit: { failMode: "open" },
 	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
+	// The in-process limiter's section as core's `reference.conf` ships it.
+	"core-rate-limiter-memory": {
+		maxBuckets: 10000,
+		defaultLimit: { limit: 60, windowSeconds: 60 },
+		limits: {},
+	},
 };
 
 /** What phase one hands `buildModules`: the configuration, with `changes` over every store in process. */
@@ -165,16 +171,18 @@ const testRepositoriesModule = defineModule({
 	},
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/__tests__/startup-log-lines.test.mts

@@ -28,7 +28,8 @@ import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { listeningRedis } from "./redis-stand-in.fixture.mjs";
 
 const templateRoot = fileURLToPath(new URL("../..", import.meta.url));
 const tsxCli = createRequire(import.meta.url).resolve("tsx/cli");
@@ -45,14 +46,29 @@ const clientsFile = (() => {
 	return file;
 })();
 
+/**
+ * The Redis the refresh-token family store's shared socket dials: a stand-in
+ * that reports `noeviction`, so the store passes its eviction gate and the run
+ * reaches no real server.
+ */
+let redis: Awaited<ReturnType<typeof listeningRedis>>;
+
+beforeAll(async () => {
+	redis = await listeningRedis();
+});
+
+afterAll(async () => {
+	await redis?.close();
+});
+
 /**
  * Development, with every store the `adapters` section selects in memory.
  * The refresh-token family store has no memory choice in the template; its
- * shared Redis socket points at a port nothing answers, so the run reaches no
- * real server. Nothing is inherited from the test runner's environment but
- * PATH, so its NODE_ENV and LOGGING_LEVEL do not reach the child.
+ * shared Redis socket points at the stand-in above. Nothing is inherited from
+ * the test runner's environment but PATH, so its NODE_ENV and LOGGING_LEVEL do
+ * not reach the child.
  */
-const ENV: Readonly<Record<string, string>> = {
+const env = (): Readonly<Record<string, string>> => ({
 	PATH: process.env.PATH ?? "",
 	CONFIG_ENV: "development",
 	NODE_ENV: "development",
@@ -74,11 +90,11 @@ const ENV: Readonly<Record<string, string>> = {
 	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
 	ADAPTERS_MFA_FACTOR_STORE: "memory",
 	ADAPTERS_MFA_TRANSACTION_STORE: "memory",
-	REDIS_CLIENTS_URL: "redis://127.0.0.1:9",
+	REDIS_CLIENTS_URL: `redis://127.0.0.1:${redis.port}`,
 	REPOSITORIES_CLIENT_YAML_PATH: clientsFile,
 	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: "http://127.0.0.1:9/authenticate",
 	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: "http://127.0.0.1:9/authenticate-by-token",
-};
+});
 
 interface Run {
 	readonly stdout: string;
@@ -91,7 +107,7 @@ function startAndStop(timeoutMs: number): Promise<Run> {
 	return new Promise((resolve, reject) => {
 		const child: ChildProcess = spawn(process.execPath, [tsxCli, "src/app.mts"], {
 			cwd: templateRoot,
-			env: ENV,
+			env: env(),
 			stdio: ["ignore", "pipe", "pipe"],
 		});
 		let stdout = "";

package/templates/standalone/src/__tests__/store-credential.test.mts

@@ -48,7 +48,7 @@ import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
 import { buildModules } from "../buildModules.mjs";
 import { resolveConfigPaths } from "../configPath.mjs";
 import { repositoriesModuleFor, templateReference } from "../modules.mjs";
-import { repositoriesSectionSchema } from "../sections.mjs";
+import { keyStoreSectionSchema, repositoriesSectionSchema } from "../sections.mjs";
 import {
 	type BothPhases,
 	bothPhasesOf,
@@ -186,16 +186,18 @@ describe("a token the Store refuses, seen from outside the booted app", () => {
 		ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
 	};
 
+	// The template's `key-store` section, read by its own schema, without the
+	// section's relocation bridge.
 	const testKeyStoreModule = defineModule({
-		name: "test:key-store",
-		requires: ["config"] as const,
+		name: "key-store",
+		section: { schema: keyStoreSectionSchema },
 		provides: {
-			keyStore: async ({ config: c }) => {
+			keyStore: async ({ section }) => {
 				const factory = createKeyStoreFactory();
 				registerBuiltinKeyStores(factory);
 				return factory.create({
 					type: "local",
-					...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+					...(section.local ?? {}),
 				});
 			},
 		},

package/templates/standalone/src/__tests__/upstream-amr.acceptance.test.mts

@@ -50,6 +50,7 @@ import { afterEach, describe, expect, it } from "vitest";
 import { buildModules } from "#/buildModules.mjs";
 import { resolveConfigPaths } from "#/configPath.mjs";
 import { templateReference } from "../modules.mjs";
+import { keyStoreSectionSchema } from "../sections.mjs";
 import {
 	type BothPhases,
 	bothPhasesOf,
@@ -181,16 +182,18 @@ const testRepositoriesModule = defineModule({
 	} as never,
 });
 
+// The template's `key-store` section, read by its own schema, without the
+// section's relocation bridge.
 const testKeyStoreModule = defineModule({
-	name: "test:key-store",
-	requires: ["config"] as const,
+	name: "key-store",
+	section: { schema: keyStoreSectionSchema },
 	provides: {
-		keyStore: async ({ config: c }) => {
+		keyStore: async ({ section }) => {
 			const factory = createKeyStoreFactory();
 			registerBuiltinKeyStores(factory);
 			return factory.create({
 				type: "local",
-				...((c as { "key-store"?: { local?: object } })["key-store"]?.local ?? {}),
+				...(section.local ?? {}),
 			});
 		},
 	},

package/templates/standalone/src/app.mts

@@ -16,7 +16,6 @@
 import { fileURLToPath } from "node:url";
 import { createApp } from "@o3co/auth-provider-core";
 import express from "express";
-import helmet from "helmet";
 import { buildModules } from "./buildModules.mjs";
 import {
 	configDefaultsFor,
@@ -31,6 +30,7 @@ import { listen } from "./listen.mjs";
 import { createAppLogger } from "./logger.mjs";
 import { createMetrics } from "./metrics.mjs";
 import { mountRoutes } from "./routes.mjs";
+import { securityHeaders } from "./securityHeaders.mjs";
 import { installGracefulShutdown } from "./shutdown.mjs";
 
 // Step 1: the configuration, in two phases (`configPath.mts`; template
@@ -57,16 +57,7 @@ await (async (): Promise<void> => {
 	// `trust proxy` is set from the `http` module's `httpSettings` once boot
 	// has it (step 3), before a request can arrive.
 	const app = express();
-	app.use(
-		helmet({
-			contentSecurityPolicy: {
-				directives: {
-					defaultSrc: ["'none'"],
-					frameAncestors: ["'none'"],
-				},
-			},
-		}),
-	);
+	app.use(securityHeaders());
 
 	// Timing middleware goes ahead of everything so the histogram covers the
 	// whole stack — including responses produced by middleware that short-circuits

package/templates/standalone/src/sections.mts

@@ -244,13 +244,14 @@ export const keyStoreSectionSchema = z
  * `redis-clients`: the one Redis connection every Redis-backed store shares.
  * `assumeNoEviction` is the operator's assertion that the server runs
  * `maxmemory-policy noeviction`, read by the Redis stores' eviction gate only
- * where the server will not report its policy.
+ * where the server will not report its policy; the template's
+ * `config/reference.conf` ships it false.
  */
 export const redisClientsSectionSchema = z
 	.object({
 		url: z.string(),
 		password: z.string().optional(),
-		assumeNoEviction: coerceBooleanFromEnv.default(false),
+		assumeNoEviction: coerceBooleanFromEnv,
 	})
 	.strict();
 

package/templates/standalone/src/securityHeaders.mts

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * The template's security headers, on every response: helmet's defaults with
+ * a Content-Security-Policy that allows nothing by default and no framing. A
+ * route whose page needs more sets that response's own policy in place of
+ * this one.
+ */
+
+import type { RequestHandler } from "express";
+import helmet from "helmet";
+
+export function securityHeaders(): RequestHandler {
+	return helmet({
+		contentSecurityPolicy: {
+			directives: {
+				defaultSrc: ["'none'"],
+				frameAncestors: ["'none'"],
+			},
+		},
+	});
+}

package/templates/versions.json

@@ -1,20 +1,20 @@
 {
-	"@o3co/auth-provider-core": "0.17.0-rc.4",
-	"@o3co/auth-provider-device-grant": "0.17.0-rc.4",
-	"@o3co/auth-provider-dpop": "0.17.0-rc.4",
-	"@o3co/auth-provider-mtls": "0.17.0-rc.4",
-	"@o3co/auth-provider-federation-apple": "0.17.0-rc.4",
-	"@o3co/auth-provider-federation-google": "0.17.0-rc.4",
-	"@o3co/auth-provider-federation-github": "0.17.0-rc.4",
-	"@o3co/auth-provider-federation-grants": "0.17.0-rc.4",
-	"@o3co/auth-provider-federation-oidc": "0.17.0-rc.4",
-	"@o3co/auth-provider-oauth": "0.17.0-rc.4",
-	"@o3co/auth-provider-oauth-token-exchange": "0.17.0-rc.4",
-	"@o3co/auth-provider-session": "0.17.0-rc.4",
-	"@o3co/auth-provider-foundation": "0.17.0-rc.4",
-	"@o3co/auth-provider-mfa": "0.17.0-rc.4",
-	"@o3co/auth-provider-redis": "0.17.0-rc.4",
-	"@o3co/auth-provider-standard": "0.17.0-rc.4",
-	"@o3co/auth-provider-test-kit": "0.17.0-rc.4",
-	"@o3co/auth-provider-webauthn": "0.17.0-rc.4"
+	"@o3co/auth-provider-core": "0.17.0",
+	"@o3co/auth-provider-device-grant": "0.17.0",
+	"@o3co/auth-provider-dpop": "0.17.0",
+	"@o3co/auth-provider-mtls": "0.17.0",
+	"@o3co/auth-provider-federation-apple": "0.17.0",
+	"@o3co/auth-provider-federation-google": "0.17.0",
+	"@o3co/auth-provider-federation-github": "0.17.0",
+	"@o3co/auth-provider-federation-grants": "0.17.0",
+	"@o3co/auth-provider-federation-oidc": "0.17.0",
+	"@o3co/auth-provider-oauth": "0.17.0",
+	"@o3co/auth-provider-oauth-token-exchange": "0.17.0",
+	"@o3co/auth-provider-session": "0.17.0",
+	"@o3co/auth-provider-foundation": "0.17.0",
+	"@o3co/auth-provider-mfa": "0.17.0",
+	"@o3co/auth-provider-redis": "0.17.0",
+	"@o3co/auth-provider-standard": "0.17.0",
+	"@o3co/auth-provider-test-kit": "0.17.0",
+	"@o3co/auth-provider-webauthn": "0.17.0"
 }