@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/audit-sink.test.mts

@@ -1,355 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The scaffold wires an audit sink. `emitAuditEvent` is a no-op when the slot
- * is empty, so without one every security-relevant event the routes emit
- * (`token.issued.failure`, `authorize.rejected`, `rate_limit.unavailable`, …)
- * is dropped, and nothing fails or warns.
- *
- * Pinned from three sides: the sink implementation, the module that resolves
- * it from config, and the manifest, which must contain exactly one provider
- * for the slot.
- */
-
-import { generateKeyPairSync } from "node:crypto";
-import { readFileSync } from "node:fs";
-import {
-	type AppConfig,
-	type AuditEvent,
-	type AuditSink,
-	createApp,
-	createKeyStoreFactory,
-	defineModule,
-	InMemoryClientRepository,
-	InMemoryUserRepository,
-	type Logger,
-	memoryRefreshTokenFamilyStoreModule,
-	registerBuiltinKeyStores,
-} from "@o3co/auth-provider-core";
-import { coreConfigForTests } from "@o3co/auth-provider-core/testing";
-import express from "express";
-import request from "supertest";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { buildModules } from "../buildModules.mjs";
-import type { Switches } from "../configPath.mjs";
-import { createAppLogger, createAuditLogger, createLoggerAuditSink } from "../logger.mjs";
-import { auditSinkModuleFor } from "../modules.mjs";
-import { keyStoreSectionSchema } from "../sections.mjs";
-import { capturedRenames, shippedAdapters } from "./library-references.fixture.mjs";
-
-const keyPair = generateKeyPairSync("ed25519", {
-	publicKeyEncoding: { type: "spki", format: "pem" },
-	privateKeyEncoding: { type: "pkcs8", format: "pem" },
-});
-
-/**
- * Phase one's switches beside the configuration boot is handed; the template
- * modules' sections sit beside core's, so the configuration is wider than
- * `AppConfig`.
- */
-const baseConfig: Switches & AppConfig & Record<string, unknown> = {
-	// The shipped selections, every store in this process.
-	adapters: {
-		...shippedAdapters(),
-		accessTokenDenylist: "memory",
-		replaySeenSet: "memory",
-		codeRepository: "memory",
-		userRepository: "yaml",
-	},
-	mfaMode: "off",
-	storeTransport: undefined,
-	// What a resolution under an environment that sets none captures of
-	// core's renamed variables.
-	...{
-		"renamed-variables": capturedRenames({}),
-	},
-	http: { port: 0, trustProxy: false, readinessTimeoutMs: 1000, cors: { allowedOrigins: [] } },
-	logging: { level: "silent" },
-	"key-store": {
-		provider: "local",
-		local: {
-			algorithm: "EdDSA",
-			kid: "v0",
-			privateKey: keyPair.privateKey,
-			publicKey: keyPair.publicKey,
-			previousKeys: [],
-		},
-	},
-	// The shipped `application.conf` expects no session requirement (ADR
-	// 2026-09-28-session-admission).
-	...coreConfigForTests({ federations: { google: { enabled: false, type: "google" } } }),
-	oauth: {
-		jwt: {
-			issuer: "https://auth.test",
-		},
-		accessToken: { defaultExpiresIn: 3600 },
-		refreshToken: { expiresIn: 86400 },
-		grants: {},
-		oidcMode: "oidc-required",
-	},
-	"session-store": {
-		secret: "test-session-secret.at-least-32-bytes.ok",
-		name: "auth.sid",
-		maxAge: 3600000,
-		secure: false,
-		sameSite: "lax",
-		domain: null,
-		storage: { type: "memory", redis: { url: "redis://localhost:6379" } },
-	},
-	session: {
-		loginPage: { url: "/login" },
-		rateLimit: { login: { windowMs: 60000, limit: 10 } },
-	},
-	rateLimit: { failMode: "open" },
-	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
-	// The in-process limiter's section as core's `reference.conf` ships it.
-	"core-rate-limiter-memory": {
-		maxBuckets: 10000,
-		defaultLimit: { limit: 60, windowSeconds: 60 },
-		limits: {},
-	},
-};
-
-const CLIENT_ID = "audit-client";
-const CLIENT_SECRET = "audit-secret";
-const BASIC_AUTH = `Basic ${Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64")}`;
-
-const testRepositoriesModule = defineModule({
-	name: "test:repositories",
-	provides: {
-		clientRepository: () =>
-			new InMemoryClientRepository(
-				new Map([
-					[
-						CLIENT_ID,
-						{
-							tokenEndpointAuthMethod: "client_secret_basic",
-							clientSecret: CLIENT_SECRET,
-							allowedRedirectUris: [],
-							allowedScopes: [],
-							allowedAudiences: [],
-							backchannelLogoutSessionRequired: true,
-							frontchannelLogoutSessionRequired: true,
-							allowedAzpForFederationToken: false,
-						},
-					],
-				]),
-			),
-		userRepository: () => new InMemoryUserRepository(new Map()),
-	},
-});
-
-// The template's `key-store` section, read by its own schema, without the
-// section's relocation bridge.
-const testKeyStoreModule = defineModule({
-	name: "key-store",
-	section: { schema: keyStoreSectionSchema },
-	provides: {
-		keyStore: async ({ section }) => {
-			const factory = createKeyStoreFactory();
-			registerBuiltinKeyStores(factory);
-			return factory.create({
-				type: "local",
-				...(section.local ?? {}),
-			});
-		},
-	},
-});
-
-/** Minimal `Logger` double — the interface is pino's, so only what we assert on. */
-function fakeLogger(): Logger & { info: ReturnType<typeof vi.fn> } {
-	const self = {
-		trace: vi.fn(),
-		debug: vi.fn(),
-		info: vi.fn(),
-		warn: vi.fn(),
-		error: vi.fn(),
-		fatal: vi.fn(),
-		child: () => self,
-	};
-	return self as unknown as Logger & { info: ReturnType<typeof vi.fn> };
-}
-
-/** Resolve `auditSink` the way the boot planner does: call the module's provider with its section. */
-async function resolveSink(sink: string, section?: Record<string, unknown>): Promise<AuditSink> {
-	const provider = auditSinkModuleFor(sink).provides?.auditSink;
-	if (!provider) throw new Error("the audit-sink module must provide the auditSink slot");
-	return (await provider({ section } as never)) as AuditSink;
-}
-
-describe("the template's audit sink", () => {
-	describe("createLoggerAuditSink — one event, one line, through the app's own JSON stream", () => {
-		it("records the event through the injected logger", async () => {
-			const logger = fakeLogger();
-			const sink = createLoggerAuditSink(logger);
-			const event: AuditEvent = {
-				timestamp: new Date("2026-08-27T00:00:00Z"),
-				type: "authorize.rejected",
-				clientId: "c1",
-				subject: "u1",
-				details: { reason: "client_not_first_party" },
-			};
-
-			await sink.record(event);
-
-			expect(logger.info).toHaveBeenCalledTimes(1);
-			const [payload, message] = logger.info.mock.calls[0] as [Record<string, unknown>, string];
-			// The event type doubles as the message so an operator can alert on
-			// the name without a JSON path, matching how this template's other
-			// structured events are named.
-			expect(message).toBe("authorize.rejected");
-			expect(payload.audit).toMatchObject({
-				type: "authorize.rejected",
-				clientId: "c1",
-				subject: "u1",
-			});
-		});
-
-		it("nests the event under `audit` so it cannot collide with pino's own keys", async () => {
-			// `level`, `time`, `name` and `msg` belong to the log envelope. An
-			// event spread at the top level would let a future audit field
-			// overwrite one of them and corrupt the line for every consumer.
-			const logger = fakeLogger();
-			await createLoggerAuditSink(logger).record({
-				timestamp: new Date("2026-08-27T00:00:00Z"),
-				type: "rate_limit.unavailable",
-			});
-			const [payload] = logger.info.mock.calls[0] as [Record<string, unknown>];
-			expect(Object.keys(payload)).toEqual(["audit"]);
-		});
-
-		it("reports the sink kind it was registered under", () => {
-			expect(createLoggerAuditSink(fakeLogger()).kind).toBe("logger");
-		});
-	});
-
-	describe("the audit trail is not gated by logging.level", () => {
-		it("keeps the audit logger at info while the app logger is silenced", () => {
-			// An audit trail is evidence, not diagnostics. `LOGGING_LEVEL=warn` is an
-			// ordinary production setting and `silent` is a legitimate one;
-			// neither may silently drop audit events.
-			const appLogger = createAppLogger({ level: "silent" });
-			const auditLogger = createAuditLogger();
-			expect((appLogger as unknown as { level: string }).level).toBe("silent");
-			expect((auditLogger as unknown as { level: string }).level).toBe("info");
-		});
-
-		it("names the audit stream so it is separable from application logs", () => {
-			const bindings = (
-				createAuditLogger() as unknown as { bindings(): Record<string, unknown> }
-			).bindings();
-			expect(bindings.name).toBe("audit");
-		});
-	});
-
-	describe("the audit-sink module — builds the sink adapters.auditSink selects", () => {
-		it("builds the logger sink for the shipped selection", async () => {
-			expect((await resolveSink(baseConfig.adapters.auditSink)).kind).toBe("logger");
-		});
-
-		it("builds core's built-in console sink when selected", async () => {
-			expect((await resolveSink("console")).kind).toBe("console");
-		});
-
-		it("builds a sink with no audit-sink section at all", async () => {
-			expect((await resolveSink("logger", undefined)).kind).toBe("logger");
-		});
-
-		it("refuses a sink no builder is registered under, naming it", async () => {
-			// There is no "none" sink. An operator who selects one gets a boot
-			// failure naming the sinks that exist, not a silent deployment with
-			// no audit trail.
-			await expect(resolveSink("none")).rejects.toThrow(/none/);
-		});
-	});
-
-	describe("buildModules — the slot is filled in the manifest operators deploy", () => {
-		it("wires exactly one auditSink provider", () => {
-			const modules = buildModules(baseConfig, {
-				keyStoreModule: testKeyStoreModule,
-				repositoriesModule: testRepositoriesModule,
-				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-			});
-			const providers = modules.filter((m) => Object.keys(m.provides ?? {}).includes("auditSink"));
-			expect(providers).toHaveLength(1);
-			expect(providers[0]?.name).toBe("audit-sink");
-		});
-
-		it("the shipped reference.conf selects a sink, and never 'none'", () => {
-			const conf = readFileSync(new URL("../../config/reference.conf", import.meta.url), "utf8");
-			expect(conf).toMatch(/adapters\s*\{[\s\S]*?auditSink\s*=\s*"logger"/);
-			expect(conf).not.toMatch(/auditSink\s*=\s*"none"/);
-		});
-	});
-
-	describe("end to end: an OAuth failure reaches the sink", () => {
-		let handleRef: { dispose(): Promise<void> } | undefined;
-
-		afterEach(async () => {
-			await handleRef?.dispose();
-			handleRef = undefined;
-		});
-
-		it("records token.issued.failure for an unsupported grant_type", async () => {
-			// `emitAuditEvent` records nothing when the slot is empty.
-			const logger = fakeLogger();
-			const spyAuditModule = defineModule({
-				name: "audit-sink",
-				provides: { auditSink: () => createLoggerAuditSink(logger) },
-			});
-			const handle = await createApp({
-				modules: buildModules(baseConfig, {
-					keyStoreModule: testKeyStoreModule,
-					repositoriesModule: testRepositoriesModule,
-					refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-					auditSinkModule: spyAuditModule,
-				}),
-				bootstrapComponents: { config: baseConfig, pathResolver: (s) => s },
-			});
-			handleRef = handle;
-
-			const app = express();
-			app.use(handle.router);
-			const res = await request(app)
-				.post("/oauth/token")
-				.set("Authorization", BASIC_AUTH)
-				.type("form")
-				.send({ grant_type: "definitely-not-a-grant" });
-
-			expect(res.status).toBe(400);
-			// `emitAuditEvent` is fire-and-forget; let the detached promise settle.
-			await new Promise((r) => setImmediate(r));
-			const types = logger.info.mock.calls.map(
-				(call) => (call[0] as { audit: AuditEvent }).audit.type,
-			);
-			expect(types).toContain("token.issued.failure");
-		});
-
-		it("boots the shipped manifest with its own audit sink wired", async () => {
-			const handle = await createApp({
-				modules: buildModules(baseConfig, {
-					keyStoreModule: testKeyStoreModule,
-					repositoriesModule: testRepositoriesModule,
-					refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-				}),
-				bootstrapComponents: { config: baseConfig, pathResolver: (s) => s },
-			});
-			handleRef = handle;
-			expect(handle).toBeDefined();
-		});
-	});
-});

package/templates/standalone/src/__tests__/backchannel-peer.fixture.mts

@@ -1,64 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * A relying party's back-channel logout endpoint on loopback, for the
- * template's tests: it answers every POST with one status and keeps each
- * `logout_token` it was sent. The composition reaches it only with its host
- * in `core.outbound.internalHosts` (`withLoopbackRelyingParties`).
- */
-
-import { createServer } from "node:http";
-import type { AddressInfo } from "node:net";
-import type { AppConfig } from "@o3co/auth-provider-core";
-import { withOutbound } from "@o3co/auth-provider-core/testing";
-
-export interface BackchannelPeer {
-	/** The endpoint, `http://127.0.0.1:<port>/logout`. */
-	readonly uri: string;
-	/** Each `logout_token` posted to it, in order. */
-	readonly tokens: readonly string[];
-	close(): Promise<void>;
-}
-
-/** A loopback back-channel endpoint answering `status` to every POST. */
-export async function backchannelPeer(status = 200): Promise<BackchannelPeer> {
-	const tokens: string[] = [];
-	const server = createServer((req, res) => {
-		let body = "";
-		req.setEncoding("utf8");
-		req.on("data", (chunk: string) => {
-			body += chunk;
-		});
-		req.on("end", () => {
-			const token = new URLSearchParams(body).get("logout_token");
-			if (token !== null) tokens.push(token);
-			res.writeHead(status);
-			res.end();
-		});
-	});
-	await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
-	const { port } = server.address() as AddressInfo;
-	return {
-		uri: `http://127.0.0.1:${port}/logout`,
-		tokens,
-		close: () => new Promise<void>((resolve) => server.close(() => resolve())),
-	};
-}
-
-/** `config` with loopback listed in `core.outbound.internalHosts`, so a `BackchannelPeer` is reachable. */
-export const withLoopbackRelyingParties = (config: AppConfig): AppConfig =>
-	withOutbound(config, { internalHosts: ["127.0.0.1"] }) as AppConfig;

package/templates/standalone/src/__tests__/config-notices.test.mts

@@ -1,157 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Core's notices about configuration nothing loaded reads, through the
- * template's own reading: the template hands boot the configuration's
- * defaults (`configDefaultsFor`), and core alone decides what is named. A
- * section the template's `reference.conf` sets for a module the composition
- * does not load is silent while it is as that file sets it, and
- * `config_sections_not_loaded` once the operator's layer or the environment
- * changes it; a section no loaded package sets is `config_sections_ignored`;
- * a renamed variable no loaded module declares is
- * `environment_variables_not_applied`.
- */
-
-import { fileURLToPath } from "node:url";
-import { moduleReferences } from "@o3co/auth-provider-core";
-import { parseFile } from "@o3co/ts.hocon";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { configDefaultsFor } from "#/configPath.mjs";
-import {
-	type ComposeOptions,
-	type Composition,
-	compose,
-	composedModules,
-	type RecordingLogger,
-	resolveConfig,
-	SINGLE_ENV,
-} from "./all-modules-composition.fixture.mjs";
-
-let current: Composition | undefined;
-
-afterEach(async () => {
-	await current?.handle.dispose();
-	current = undefined;
-	vi.unstubAllEnvs();
-});
-
-const boot = async (options: ComposeOptions): Promise<Composition> => {
-	current = await compose(options);
-	return current;
-};
-
-/** What each warn line named `event` names: its `sections` or `variables`. */
-const named = (logger: RecordingLogger, event: string): unknown[] =>
-	logger.lines
-		.filter((line) => line.level === "warn" && line.args[1] === event)
-		.map((line) => line.args[0]);
-
-/** `redis-clients` is the template's module, which no store on Redis loads under SINGLE_ENV. */
-const NOT_LOADED = "redis-clients";
-
-describe("a section the template's reference.conf sets for a module the composition does not load", () => {
-	it("is handed to boot and named by nothing while it is as that file sets it", async () => {
-		const { logger, resolved, modules } = await boot({ env: SINGLE_ENV });
-		expect(modules.map((m) => m.name)).not.toContain(NOT_LOADED);
-		expect(resolved).toHaveProperty([NOT_LOADED]);
-		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
-		expect(named(logger, "config_sections_ignored")).toEqual([]);
-	});
-
-	it("is config_sections_not_loaded once the operator's layer changes it", async () => {
-		const { logger } = await boot({
-			env: SINGLE_ENV,
-			operatorHocon: `${NOT_LOADED}.url = "redis://elsewhere.test:6379"\n`,
-		});
-		expect(named(logger, "config_sections_not_loaded")).toEqual([{ sections: [NOT_LOADED] }]);
-		expect(named(logger, "config_sections_ignored")).toEqual([]);
-	});
-
-	it("is config_sections_not_loaded once the environment changes it, and the variable environment_variables_not_applied", async () => {
-		const { logger } = await boot({
-			env: { ...SINGLE_ENV, REDIS_CLIENTS_URL: "redis://elsewhere.test:6379" },
-		});
-		expect(named(logger, "config_sections_not_loaded")).toEqual([{ sections: [NOT_LOADED] }]);
-		expect(named(logger, "config_sections_ignored")).toEqual([]);
-		expect(named(logger, "environment_variables_not_applied")).toEqual([
-			{ variables: ["REDIS_CLIENTS_URL"] },
-		]);
-	});
-});
-
-describe("the limiter sections the template's reference.conf writes for both limiters", () => {
-	it.each(["memory", "redis"] as const)(
-		"are named by nothing with the %s limiter wired",
-		async (rateLimiter) => {
-			const { logger, modules } = await boot({
-				env: { ...SINGLE_ENV, ADAPTERS_RATE_LIMITER: rateLimiter },
-			});
-			expect(modules.map((m) => m.name)).toContain(
-				rateLimiter === "redis" ? "redis-rate-limiter" : "core-rate-limiter-memory",
-			);
-			expect(named(logger, "config_sections_not_loaded")).toEqual([]);
-			expect(named(logger, "config_sections_ignored")).toEqual([]);
-		},
-	);
-});
-
-describe("a section no loaded package's reference.conf sets", () => {
-	it("is config_sections_ignored: a misspelt section name", async () => {
-		const { logger } = await boot({
-			env: SINGLE_ENV,
-			operatorHocon: 'redis-client.url = "redis://elsewhere.test:6379"\n',
-		});
-		expect(named(logger, "config_sections_ignored")).toEqual([{ sections: ["redis-client"] }]);
-		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
-	});
-});
-
-describe("a renamed variable a loaded package captures and no loaded module declares", () => {
-	it("is environment_variables_not_applied: RATE_LIMIT_FAIL_MODE with the Redis package loaded but not its rate limiter", async () => {
-		const { logger, modules } = await boot({
-			env: { ...SINGLE_ENV, ADAPTERS_CODE_REPOSITORY: "redis", RATE_LIMIT_FAIL_MODE: "closed" },
-		});
-		expect(modules.map((m) => m.name)).not.toContain("redis-rate-limiter");
-		expect(named(logger, "environment_variables_not_applied")).toEqual([
-			{ variables: ["RATE_LIMIT_FAIL_MODE"] },
-		]);
-		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
-		expect(named(logger, "config_sections_ignored")).toEqual([]);
-	});
-});
-
-describe("configDefaultsFor", () => {
-	const modules = composedModules(resolveConfig(SINGLE_ENV));
-
-	it("is every loaded package's reference.conf, core's last, resolved with no environment", () => {
-		const references = moduleReferences(modules).map((reference) =>
-			parseFile(fileURLToPath(reference), { env: {} }),
-		);
-		const expected = references
-			.slice(1)
-			.reduce((config, next) => config.withFallback(next), references[0]);
-		expect(configDefaultsFor(modules)).toEqual(expected?.toObject());
-	});
-
-	it("takes nothing from the process's environment", () => {
-		vi.stubEnv("REDIS_CLIENTS_URL", "redis://operator.test:6379");
-		expect(configDefaultsFor(modules)[NOT_LOADED]).toEqual({
-			url: "redis://localhost:6379",
-			assumeNoEviction: false,
-		});
-	});
-});

package/templates/standalone/src/__tests__/configPath.test.mts

@@ -1,69 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { existsSync } from "node:fs";
-import { isAbsolute } from "node:path";
-import { fileURLToPath } from "node:url";
-import { coreReference } from "@o3co/auth-provider-core";
-import { describe, expect, it } from "vitest";
-import { resolveConfigPaths } from "../configPath.mjs";
-
-describe("resolveConfigPaths", () => {
-	it("accepts a configDirPath with a trailing slash (regression: fileURLToPath preserves trailing /)", () => {
-		const { applicationConfPath, envConfPath } = resolveConfigPaths(
-			"/home/node/templates/standalone/config/",
-			"production",
-		);
-		expect(applicationConfPath).toBe("/home/node/templates/standalone/config/application.conf");
-		expect(envConfPath).toBe("/home/node/templates/standalone/config/production.conf");
-	});
-
-	it("accepts a configDirPath without a trailing slash", () => {
-		const { applicationConfPath, envConfPath } = resolveConfigPaths(
-			"/home/node/templates/standalone/config",
-			"development",
-		);
-		expect(applicationConfPath).toBe("/home/node/templates/standalone/config/application.conf");
-		expect(envConfPath).toBe("/home/node/templates/standalone/config/development.conf");
-	});
-
-	it("rejects env names that resolve outside configDirPath (path traversal)", () => {
-		expect(() =>
-			resolveConfigPaths("/home/node/templates/standalone/config/", "../secrets"),
-		).toThrow(/resolves outside/);
-	});
-
-	it("rejects env names containing a path separator", () => {
-		expect(() =>
-			resolveConfigPaths("/home/node/templates/standalone/config/", "nested/env"),
-		).toThrow(/resolves outside/);
-	});
-});
-
-describe("core's reference.conf, as the template layers it", () => {
-	// `coreReference()` names the file `@o3co/auth-provider-core` exports as
-	// `./reference.conf`: the one a composition root that installed the
-	// package would resolve, and the bottom of every layering the template
-	// makes (`readSwitches`, `resolveForBoot`).
-	it("is the file the package exports as ./reference.conf, and it exists", () => {
-		const path = fileURLToPath(coreReference());
-		expect(isAbsolute(path)).toBe(true);
-		expect(existsSync(path)).toBe(true);
-		expect(path).toBe(
-			fileURLToPath(import.meta.resolve("@o3co/auth-provider-core/reference.conf")),
-		);
-	});
-});