@o3co/create-auth-provider 0.17.0-rc.4 → 0.18.0-rc.1

package/dist/index.mjs

@@ -1,325 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import { spawnSync } from "node:child_process";
-import { appendFileSync, cpSync, existsSync, readdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { shouldCopyTemplateEntry } from "./internal/template-filter.mjs";
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const TEMPLATES_ROOT = resolve(__dirname, "../templates");
-/** The template a scaffold is made from when none is named. */
-export const DEFAULT_TEMPLATE = "standalone";
-/**
- * The templates under `templatesRoot`: every directory — not a symbolic link,
- * not dot-named — holding a `package.json`, sorted; none when the directory is
- * missing. This is the rule `scripts/templates.mjs` copies templates by, read
- * here from the copy, where `versions.json` sits beside them. A name is only
- * ever looked up in this list, so nothing outside the templates directory can
- * be named as a template.
- */
-export const availableTemplates = (templatesRoot = TEMPLATES_ROOT) => {
-    if (!existsSync(templatesRoot))
-        return [];
-    return readdirSync(templatesRoot, { withFileTypes: true })
-        .filter((entry) => entry.isDirectory() &&
-        !entry.name.startsWith(".") &&
-        existsSync(resolve(templatesRoot, entry.name, "package.json")))
-        .map((entry) => entry.name)
-        .sort();
-};
-/**
- * Why `template` cannot be scaffolded from `templates`, or `undefined` when it
- * can: none is bundled (a checkout that never ran the prebuild script), or it
- * is not one of them.
- */
-export const templateRefusal = (template, templates) => {
-    if (templates.length === 0) {
-        return `No templates found at ${TEMPLATES_ROOT}. If developing locally, run the prebuild script first.`;
-    }
-    if (!templates.includes(template)) {
-        return `Unknown template '${template}'. Available templates: ${templates.join(", ")}.`;
-    }
-    return undefined;
-};
-const getPackageVersions = () => {
-    const versionFile = resolve(__dirname, "../templates/versions.json");
-    if (existsSync(versionFile)) {
-        return JSON.parse(readFileSync(versionFile, "utf-8"));
-    }
-    return {};
-};
-const UNSCOPED_NAME_RE = /^[a-z0-9][a-z0-9-._~]*$/;
-const SCOPED_NAME_RE = /^@[a-z0-9][a-z0-9-._~]*\/[a-z0-9][a-z0-9-._~]*$/;
-const MAX_NAME_LEN = 214;
-export const isValidProjectName = (name) => {
-    if (name.length === 0 || name.length > MAX_NAME_LEN)
-        return false;
-    if (name === "." || name === "..")
-        return false;
-    return UNSCOPED_NAME_RE.test(name) || SCOPED_NAME_RE.test(name);
-};
-export const isValidDirName = (name) => {
-    if (name.length === 0 || name.length > MAX_NAME_LEN)
-        return false;
-    if (name === "." || name === "..")
-        return false;
-    return UNSCOPED_NAME_RE.test(name);
-};
-/**
- * Appended to the scaffold's `config/application.conf` by `noMfa`: the
- * template's switch `mfaMode` written off, then bound to `MFA_MODE` so the
- * variable wins over the written value. The MFA package stays a dependency.
- */
-const MFA_OFF_LINES = [
-    "",
-    "# written by create-app --no-mfa: MFA is off unless MFA_MODE turns it on",
-    'mfaMode = "off"',
-    // biome-ignore lint/suspicious/noTemplateCurlyInString: a HOCON substitution, not a template
-    "mfaMode = ${?MFA_MODE}",
-];
-export const scaffold = (targetDir, projectName, template = DEFAULT_TEMPLATE, options = {}) => {
-    const refusal = templateRefusal(template, availableTemplates());
-    if (refusal !== undefined)
-        throw new Error(refusal);
-    const templateDir = resolve(TEMPLATES_ROOT, template);
-    // Copy template to target
-    cpSync(templateDir, targetDir, {
-        recursive: true,
-        filter: (source) => shouldCopyTemplateEntry(source, templateDir),
-    });
-    // npm drops a file literally named `.gitignore` from a published package,
-    // so `copy-templates.mjs` stages it dot-less and it is restored here.
-    // Without it the first `git add .` in a scaffolded project commits the
-    // `.env` and the signing key the README's setup steps create.
-    const stagedGitignore = resolve(targetDir, "gitignore");
-    if (existsSync(stagedGitignore)) {
-        renameSync(stagedGitignore, resolve(targetDir, ".gitignore"));
-    }
-    if (options.noMfa === true) {
-        appendFileSync(resolve(targetDir, "config", "application.conf"), `${MFA_OFF_LINES.join("\n")}\n`);
-    }
-    // Rewrite package.json
-    const pkgPath = resolve(targetDir, "package.json");
-    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-    pkg.name = projectName;
-    // `"private": true` is deliberately kept: the scaffold is an identity
-    // provider (keys, config, policy), so an accidental `npm publish` must fail
-    // by default. An operator who means to publish removes the field.
-    // o3co/auth.policy-verifier's scaffolder does the same; change the two together.
-    // Replace all workspace:* references with per-package published versions
-    const versions = getPackageVersions();
-    for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
-        const deps = pkg[section];
-        if (!deps)
-            continue;
-        for (const [name, version] of Object.entries(deps)) {
-            if (version === "workspace:*") {
-                const resolved = versions[name];
-                if (!resolved) {
-                    throw new Error(`Cannot resolve version for workspace dependency "${name}". Ensure versions.json includes this package.`);
-                }
-                deps[name] = `^${resolved}`;
-            }
-        }
-    }
-    writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
-    // pnpm ≥10.29 reads `onlyBuiltDependencies` only from pnpm-workspace.yaml,
-    // even in single-package projects. The template cannot ship the file:
-    // inside the monorepo it would shadow the workspace root. So the scaffold
-    // writes it, mirroring the workspace root's allowlist.
-    writeFileSync(resolve(targetDir, "pnpm-workspace.yaml"), [
-        "# pnpm (>= 10.29) reads onlyBuiltDependencies from this file, even in a",
-        "# single-package project. bcrypt's install hook compiles the native addon",
-        "# on platforms with no shipped prebuild; without this allowlist pnpm",
-        "# silently skips the hook and bcrypt fails at require time there.",
-        "onlyBuiltDependencies:",
-        "  - bcrypt",
-        "",
-    ].join("\n"));
-};
-/**
- * `--lockfile-only` resolves the dependency graph without installing or
- * running any script. `--ignore-workspace` keeps the new project's lockfile
- * its own even when the target directory happens to sit inside somebody
- * else's pnpm workspace.
- */
-const LOCKFILE_ARGS = ["install", "--lockfile-only", "--ignore-workspace"];
-/**
- * Launchers tried in order: `pnpm` on PATH, then `corepack pnpm` for a machine
- * with Node's bundled corepack but no global pnpm. Only ENOENT falls through to
- * the next launcher; a non-zero exit would fail identically through any of
- * them, and other launch errors surface as themselves.
- */
-const LOCKFILE_LAUNCHERS = [["pnpm"], ["corepack", "pnpm"]];
-/**
- * Resolve the scaffolded project's dependency graph into `pnpm-lock.yaml`,
- * which the template's `pnpm install --frozen-lockfile` build needs. The
- * lockfile cannot ship with the template: the dependency set it pins exists
- * only after `scaffold` has replaced every `workspace:*`. Best-effort (it needs
- * a package manager and a reachable registry), so failure is a result, not a
- * throw.
- */
-export const generateLockfile = (targetDir) => {
-    const attempts = [];
-    for (const launcher of LOCKFILE_LAUNCHERS) {
-        const [bin, ...prefix] = launcher;
-        const args = [...prefix, ...LOCKFILE_ARGS];
-        const printable = [bin, ...args].join(" ");
-        const result = spawnSync(bin, args, {
-            cwd: targetDir,
-            stdio: "inherit",
-            shell: false,
-            env: { ...process.env, COREPACK_ENABLE_DOWNLOAD_PROMPT: "0" },
-        });
-        if (result.error) {
-            attempts.push(`${printable}: ${result.error.message}`);
-            // Only "not on PATH" is worth asking a different launcher about.
-            if (result.error.code === "ENOENT")
-                continue;
-            break;
-        }
-        if (result.status === 0)
-            return { ok: true, command: printable };
-        const how = result.status === null ? `killed by signal ${result.signal}` : `exit code ${result.status}`;
-        attempts.push(`${printable}: ${how}`);
-        break;
-    }
-    return { ok: false, reason: attempts.join("; ") };
-};
-/** The flags that take a value, as `--flag <value>` or `--flag=<value>`. */
-const VALUE_FLAGS = ["--dir", "--template"];
-const parseArgs = (args) => {
-    const positionals = [];
-    const values = new Map();
-    let lockfile = true;
-    let noMfa = false;
-    const setValue = (flag, value) => {
-        if (values.has(flag))
-            throw new Error(`${flag} specified more than once`);
-        if (value === "")
-            throw new Error(`${flag} requires a value`);
-        values.set(flag, value);
-    };
-    for (let i = 0; i < args.length; i++) {
-        const a = args[i];
-        const spaced = VALUE_FLAGS.find((flag) => a === flag);
-        const joined = VALUE_FLAGS.find((flag) => a.startsWith(`${flag}=`));
-        if (spaced !== undefined) {
-            if (i + 1 >= args.length)
-                throw new Error(`${spaced} requires a value`);
-            setValue(spaced, args[i + 1]);
-            i++;
-        }
-        else if (joined !== undefined) {
-            setValue(joined, a.slice(`${joined}=`.length));
-        }
-        else if (a === "--no-lockfile") {
-            lockfile = false;
-        }
-        else if (a === "--no-mfa") {
-            noMfa = true;
-        }
-        else if (a.startsWith("-")) {
-            // Treats `--` and any --unknown as an unknown flag.
-            throw new Error(`unknown flag: ${a}`);
-        }
-        else {
-            positionals.push(a);
-        }
-    }
-    if (positionals.length === 0)
-        throw new Error("missing <project-name>");
-    if (positionals.length > 1)
-        throw new Error("too many positional arguments");
-    return {
-        projectName: positionals[0],
-        dir: values.get("--dir"),
-        template: values.get("--template"),
-        lockfile,
-        noMfa,
-    };
-};
-const deriveDirName = (projectName, dir) => {
-    if (dir !== undefined)
-        return dir;
-    if (projectName.startsWith("@")) {
-        const pkgPart = projectName.split("/")[1];
-        if (!pkgPart) {
-            // Unreachable when projectName has passed isValidProjectName (SCOPED_NAME_RE
-            // guarantees a non-empty package segment after the single "/"). Guarded here
-            // so refactors that reorder validation cannot silently produce undefined.
-            throw new Error(`invariant: unvalidated scoped name ${projectName}`);
-        }
-        return pkgPart;
-    }
-    return projectName;
-};
-// CLI entry point
-export const main = () => {
-    const args = process.argv.slice(2);
-    let parsed;
-    try {
-        parsed = parseArgs(args);
-    }
-    catch (e) {
-        console.error(`Error: ${e.message}`);
-        console.error("Usage: @o3co/create-auth-provider <project-name> [--template <name>] [--dir <dir-name>] [--no-lockfile] [--no-mfa]");
-        console.error("<project-name> must be a valid npm package name (scoped like @scope/pkg, or unscoped).");
-        console.error(`--template names the template to copy (default: ${DEFAULT_TEMPLATE}); available: ${availableTemplates().join(", ")}.`);
-        process.exit(1);
-    }
-    const { projectName, dir, lockfile, noMfa } = parsed;
-    const template = parsed.template ?? DEFAULT_TEMPLATE;
-    if (!isValidProjectName(projectName)) {
-        console.error("Error: <project-name> must be a valid npm package name (scoped like @scope/pkg, or unscoped; max 214 chars; no backslashes; no extra '/' beyond the single scope separator).");
-        process.exit(1);
-    }
-    if (dir !== undefined && !isValidDirName(dir)) {
-        console.error("Error: --dir must be a valid unscoped package name (no '/', '\\', '@'; not '.' or '..'; max 214 chars).");
-        process.exit(1);
-    }
-    const refusal = templateRefusal(template, availableTemplates());
-    if (refusal !== undefined) {
-        console.error(`Error: ${refusal}`);
-        process.exit(1);
-    }
-    const dirName = deriveDirName(projectName, dir);
-    const targetDir = resolve(process.cwd(), dirName);
-    if (existsSync(targetDir)) {
-        console.error(`Error: Directory '${dirName}' already exists.`);
-        process.exit(1);
-    }
-    console.log(`Creating ${projectName} from the ${template} template...`);
-    scaffold(targetDir, projectName, template, { noMfa });
-    let lockfileGenerated = false;
-    if (lockfile) {
-        console.log("\nResolving dependencies into pnpm-lock.yaml...");
-        const result = generateLockfile(targetDir);
-        lockfileGenerated = result.ok;
-        if (!result.ok) {
-            console.error(`\nWarning: could not generate pnpm-lock.yaml (${result.reason}).`);
-            console.error(`Run 'pnpm install' in ${dirName} and commit pnpm-lock.yaml: the Dockerfile installs with --frozen-lockfile and will not build without it.`);
-        }
-    }
-    console.log(`\nDone! Created ${projectName} at ${targetDir}`);
-    if (lockfileGenerated) {
-        console.log("\nCommit pnpm-lock.yaml along with the rest: it is what makes 'docker build' reproducible.");
-    }
-    console.log(`\nNext steps:`);
-    console.log(`  cd ${dirName}`);
-    console.log("  pnpm install");
-    console.log("  pnpm run debug");
-};

package/dist/internal/template-filter.d.mts

@@ -1,14 +0,0 @@
-/**
- * Decide whether `cpSync` should copy a given source path.
- *
- * Only segments inside `templateRoot` are checked against EXCLUDED_DIRS; the
- * install prefix above it (e.g. `~/.npm/_npx/<hash>/node_modules/...` under
- * `npx`) is ignored, or every file would be rejected whenever the package
- * itself lives under a `node_modules` directory.
- *
- * `pathSep` lets tests exercise POSIX and Windows separators on any host.
- * Production callers keep the `path.sep` default: `cpSync` passes
- * backslash-delimited paths on Windows.
- */
-export declare const shouldCopyTemplateEntry: (source: string, templateRoot: string, pathSep?: string) => boolean;
-//# sourceMappingURL=template-filter.d.mts.map

package/dist/internal/template-filter.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template-filter.d.mts","sourceRoot":"","sources":["../../src/internal/template-filter.mts"],"names":[],"mappings":"AAuBA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GACnC,QAAQ,MAAM,EACd,cAAc,MAAM,EACpB,UAAS,MAAY,KACnB,OAMF,CAAC"}

package/dist/internal/template-filter.mjs

@@ -1,42 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-//
-// INTERNAL — not exposed via the package's `exports` map. Reachable only from
-// other files in this package (and its tests). See package.json `exports`.
-//
-import { sep } from "node:path";
-const EXCLUDED_DIRS = new Set(["node_modules", "dist"]);
-/**
- * Decide whether `cpSync` should copy a given source path.
- *
- * Only segments inside `templateRoot` are checked against EXCLUDED_DIRS; the
- * install prefix above it (e.g. `~/.npm/_npx/<hash>/node_modules/...` under
- * `npx`) is ignored, or every file would be rejected whenever the package
- * itself lives under a `node_modules` directory.
- *
- * `pathSep` lets tests exercise POSIX and Windows separators on any host.
- * Production callers keep the `path.sep` default: `cpSync` passes
- * backslash-delimited paths on Windows.
- */
-export const shouldCopyTemplateEntry = (source, templateRoot, pathSep = sep) => {
-    if (source === templateRoot)
-        return true;
-    const prefix = templateRoot.endsWith(pathSep) ? templateRoot : `${templateRoot}${pathSep}`;
-    if (!source.startsWith(prefix))
-        return true;
-    const rel = source.slice(prefix.length);
-    return !rel.split(pathSep).some((s) => EXCLUDED_DIRS.has(s));
-};

package/templates/standalone/.dockerignore

@@ -1,23 +0,0 @@
-node_modules
-dist
-.git
-Makefile
-# #705: the secrets and the per-deployment configuration that `.gitignore`
-# keeps out of git stay out of the build context as well. The builder stage
-# COPYs `config/` and the runtime image takes it from there, so a
-# `config/clients.yaml` in the working copy — client secrets included — was
-# baked into a layer that travels with every push; the production compose
-# mounts the registry instead. This is `.gitignore`'s secrets section, written
-# with `**/` where it matches at any depth: a `.dockerignore` pattern is
-# anchored at the context root. Keep the two in step; scaffold-assets.test.mts
-# checks that they are.
-**/.env*
-!**/.env.example
-**/*.pem
-**/*.key
-config/clients.yaml
-config/*.local.conf
-# .gitignore, the READMEs and the compose files stay in the context: the
-# `test` image copies them because the shipped suite reads them (#512). The
-# runtime image never copies them, so they cost the context a few kilobytes
-# and the image nothing.

package/templates/standalone/.env.example

@@ -1,152 +0,0 @@
-# Canonical issuer stamped as `iss` on every token this deployment mints.
-# Absolute https URL (http only for a loopback host), no query or fragment.
-# Boot fails when unset — it is never derived from the Host header.
-OAUTH_JWT_ISSUER=
-
-# --- JWT signing key (required) ---------------------------------------------
-# The default algorithm is EdDSA (Ed25519). There is no key-material default:
-# a deployment that sets none fails at boot naming the keys to set, rather than
-# quietly signing with something guessable.
-#
-#   openssl genpkey -algorithm ed25519 -out jwt-private.pem
-#   openssl pkey -in jwt-private.pem -pubout -out jwt-public.pem
-#
-# Keep jwt-private.pem out of version control and off the image.
-KEY_STORE_LOCAL_PRIVATE_KEY_PATH=./jwt-private.pem
-KEY_STORE_LOCAL_PUBLIC_KEY_PATH=./jwt-public.pem
-# KEY_STORE_LOCAL_ALGORITHM=EdDSA          # EdDSA | ES256 | RS256 | HS256
-# KEY_STORE_LOCAL_KID=v0
-#
-# HS256 alternative — symmetric, so /.well-known/jwks.json publishes NOTHING
-# and every relying party must hold a secret that can also MINT tokens. Only
-# for deployments that verify in-process. Needs >= 32 bytes (256 bits):
-#   openssl rand -hex 32
-# Hex/base64 values are measured DECODED, so a 32-character hex string counts
-# as 16 bytes and is refused.
-# KEY_STORE_LOCAL_ALGORITHM=HS256
-# KEY_STORE_LOCAL_SECRET=
-
-# --- Session (required) ------------------------------------------------------
-# Signs the cookie that IS the authenticated session, so guessing it forges
-# logins. Same >= 32-byte floor and same decoded measurement:
-#   openssl rand -hex 32
-SESSION_STORE_SECRET=
-
-# User repository
-# Both URLs carry plaintext user credentials to the upstream store, so both must
-# be absolute https URLs. http:// is accepted only for a loopback host
-# (localhost, 127.0.0.0/8, [::1]) — a private-range address or a compose service
-# name such as http://user-service:8080 still needs https. Boot fails otherwise.
-# Each must be the endpoint that answers: no request follows a 3xx, so a URL that
-# redirects fails every call.
-REPOSITORIES_USER_HTTP_AUTHENTICATE_URL=
-REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL=
-# With MFA on: the Store's endpoint the MFA enrollment witness is written to,
-# so a Store that loses a subject's factors cannot open a first binding to
-# whoever holds the password. Your Store must then answer `mfaEnrolled` on
-# both URLs above. Unset, boot warns (mfa_enrollment_witness_unwritable).
-# REPOSITORIES_USER_HTTP_MARK_MFA_ENROLLED_URL=https://users.example.com/mfa/enrolled
-# The credential this server presents to the Store: every Store request carries
-# `Authorization: Bearer <token>`. Without one, anyone who can reach the Store
-# can resolve an identity to its user, so your Store should refuse any request
-# without it, with 401 and `WWW-Authenticate: Bearer error="invalid_token"`
-# (which this server then reports as an outage naming the refused credential).
-# The one token goes to every Store URL above: they must be one trust domain.
-# At least 32 bytes, measured like SESSION_STORE_SECRET; boot fails on a weak or
-# malformed value. Left commented out because a blank value is refused too:
-#   openssl rand -hex 32
-# REPOSITORIES_USER_HTTP_BEARER_TOKEN=
-
-# --- Reverse proxy (required in production) -----------------------------------
-# Express `trust proxy`. Set this to the address or CIDR range of whatever
-# terminates TLS in front of this service — `10.0.0.0/8`, or `loopback` for a
-# sidecar on the same host. Comma-separate several.
-#
-# Prefer naming the hop over `true`: `true` believes a forwarded client address
-# from anyone who can reach this process, and with it any rate-limit identity.
-# Left EMPTY here because it cannot be guessed; `docker-compose.production.yml`
-# refuses to start until it is set, since without it the Secure cookie is never
-# set, the CSRF origin check 403s every browser POST, and every IP-keyed rate
-# limit shares one bucket. A plain-HTTP local run needs nothing here.
-HTTP_TRUST_PROXY=
-
-# Redis (session storage + the shared client socket)
-# Use redis://redis:6379 when running via docker compose
-SESSION_STORE_STORAGE_REDIS_URL=redis://redis:6379
-# #407: this one backs the SHARED ioredis socket -- the refresh-token family
-# store, the access-token denylist and the rate limiter all ride on it. It
-# defaults to redis://localhost:6379, which inside the container is the
-# container, so leaving it unset makes the compose boot dial nothing.
-REDIS_CLIENTS_URL=redis://redis:6379
-# The Redis stores refuse to boot unless the server reports maxmemory-policy
-# noeviction (README: Multi-replica deployments). Only for a server that does
-# run noeviction but will not report it (INFO and CONFIG refused to this user):
-# REDIS_CLIENTS_ASSUME_NO_EVICTION=true
-
-# --- Federation grants (#593, optional) --------------------------------------
-# Offline delegation of an upstream IdP's tokens to a backend or an agent, on a
-# consent that survives logout. Off by default; on, boot refuses what is
-# missing by name. The consent page is yours (README: Federation Grants). The
-# connections and the encryption key ring are lists, so they live in a HOCON
-# layer, not here. Both stores ship as none: select each (redis, or memory on
-# one replica) with the two ADAPTERS_ lines below. Redis GRANTS need
-# ADAPTERS_USER_SESSION_STORES=redis beside them (the compose files set it) —
-# the grants would outlive a memory boundary that ends them.
-# FEDERATION_GRANTS_ENABLED=true
-# FEDERATION_GRANTS_CONSENT_URL=/consent/grants
-# `required` seals credentials under redis-federation-grant-store.encryptionKeys (HOCON);
-# `allow-plaintext` is refused in production/staging and under multi.
-# REDIS_FEDERATION_GRANT_STORE_ENCRYPTION_MODE=required
-# `required` needs a user repository that covers every connection's
-# registration: the shipped http one asks your Store at the URL below and
-# covers what repositories.user.http.federatedIdentityLookupCoverage (HOCON)
-# declares; `unsupported` records that the check is not made.
-# FEDERATION_GRANTS_IDENTITY_LOOKUP=required
-# REPOSITORIES_USER_HTTP_FIND_SUBJECT_BY_FEDERATED_IDENTITY_URL=https://users.example.com/find-subject-by-federated-identity
-# ADAPTERS_FEDERATION_GRANT_STORE=redis
-# ADAPTERS_FEDERATION_GRANT_INTENT_STORE=redis
-
-# --- Multi-factor authentication (on by default) -----------------------------
-# MFA_MODE: required (the default: every password login needs a second
-# factor) | optional | off. The MFA page is yours (README: Multi-factor
-# authentication). Development needs nothing here: config/development.conf
-# holds a sample key, the codes are logged, and docker-compose.yml keeps the
-# two MFA stores on its Redis. Outside development, set all of the following,
-# or boot is refused naming them:
-# - the two MFA stores, which ship in memory, refused outside development and
-#   test since a restart empties them of every factor: redis (or, for the
-#   factors, store);
-# - a key of your own (openssl rand -base64 32);
-# - the SMTP relay the account-email proof and the email factor's codes go
-#   through.
-# The MFA page's URL defaults to /mfa, which you must serve, in development
-# too, or every password login stops there.
-# ADAPTERS_MFA_FACTOR_STORE=redis
-# ADAPTERS_MFA_TRANSACTION_STORE=redis
-# MFA_ENCRYPTION_KEY=
-# STANDARD_SMTP_MAIL_SENDER_HOST=smtp.example.com
-# STANDARD_SMTP_MAIL_SENDER_FROM=auth@example.com
-# MFA_PAGE_URL=/mfa
-# Or run without MFA:
-# MFA_MODE=off
-# To read the mail in development, leave every STANDARD_SMTP_MAIL_SENDER_*
-# unset (USER and PASSWORD included), set MFA_ENCRYPTION_KEY to a key of your
-# own (the run does not use the development sample key), and run the Mailpit
-# overlay, which sets the sender's variables (README: Mailpit for the SMTP sender):
-#   docker compose -f docker-compose.yml -f docker-compose.mailpit.yml up --build
-
-# Development (override for local HTTP).
-# The default cookie name carries the `__Host-` prefix, which browsers only
-# accept on a Secure cookie — so dropping Secure means renaming the cookie too,
-# or boot refuses the combination.
-SESSION_STORE_SECURE=false
-SESSION_STORE_NAME=auth.sid
-
-# Optional
-# HTTP_PORT=3000
-# OAUTH_ACCESS_TOKEN_DEFAULT_EXPIRES_IN=3600
-# The most a token-exchange `expires_in` can obtain; unset = the default.
-# OAUTH_ACCESS_TOKEN_MAX_EXPIRES_IN=3600
-# OAUTH_REFRESH_TOKEN_EXPIRES_IN=86400
-# SESSION_STORE_MAX_AGE=3600000
-# SESSION_STORE_SAME_SITE=lax             # `none` additionally requires SESSION_STORE_SECURE=true