@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/configured-mfa-mode.fixture.mts

@@ -1,48 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The MFA switch, `mfaMode`, as this project's own configuration files write
- * it with `MFA_MODE` unset: `{environment}.conf` over `application.conf` over
- * the template's `config/reference.conf`. The template ships it `required`;
- * a project `create-auth-provider --no-mfa` scaffolds writes it `off` at the
- * end of its `application.conf`. A suite whose subject depends on the switch
- * asserts what MFA on (`required`, as the template ships it) or off (as
- * `--no-mfa` writes it) implies, so the suite that ships with a scaffold holds
- * in either project. A project whose files write another mode, such as
- * `optional`, is not what these suites claim to cover.
- *
- * Read with the HOCON parser alone, not through phase one (`readSwitches`),
- * so that a suite about phase one can state what phase one should answer.
- */
-
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { type Config, empty, parseFile } from "@o3co/ts.hocon";
-import { type MfaSwitch, mfaSwitchSchema } from "#/sections.mjs";
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-/** `mfaMode` as the files selected by `environment` write it, with no variable set. */
-export function configuredMfaMode(environment: string): MfaSwitch {
-	const resolved = [`${environment}.conf`, "application.conf", "reference.conf"]
-		.reduce<Config>(
-			(layered, file) => layered.withFallback(parseFile(join(configDir, file), { env: {} })),
-			empty(),
-		)
-		.toObject() as Record<string, unknown>;
-	return mfaSwitchSchema.parse(resolved.mfaMode);
-}

package/templates/standalone/src/__tests__/core-federations.test.mts

@@ -1,252 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The federations the template ships, in core's own section:
- * `core.federations.google` and `core.federations.oidc`, each naming its
- * type and bound to the variables named after its paths
- * (`CORE_FEDERATIONS_<NAME>_<KEY>`). The federation types the template
- * bundles are listed whatever the map says (`federation-types.test.mts`
- * boots them). A variable the
- * template bound before, `FEDERATIONS_<NAME>_<KEY>`, set alone or beside its
- * new name, at any value, is refused before any module is chosen, naming the
- * new variable and path and never a value. The map written at the top level refuses boot, naming its
- * paths under `core.federations`.
- */
-
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { BootError, createApp } from "@o3co/auth-provider-core";
-import { afterAll, describe, expect, it } from "vitest";
-import { buildModules } from "#/buildModules.mjs";
-import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "#/configPath.mjs";
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-/** The directories the operator layers are written to, removed after the suite. */
-const operatorDirs: string[] = [];
-afterAll(() => {
-	for (const dir of operatorDirs) rmSync(dir, { recursive: true, force: true });
-});
-
-/** The template's own files for the production environment, under an operator's layer when given. */
-function ownFiles(hocon?: string): string[] {
-	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	if (hocon === undefined) return [envConfPath, applicationConfPath];
-	const dir = mkdtempSync(join(tmpdir(), "core-federations-"));
-	operatorDirs.push(dir);
-	const file = join(dir, "operator.conf");
-	writeFileSync(file, hocon);
-	return [file, envConfPath, applicationConfPath];
-}
-
-/** MFA, on by default, switched off: these are about the federations. */
-const MFA_OFF: Readonly<Record<string, string>> = { MFA_MODE: "off" };
-
-/** Phase one under `env` and an operator's `hocon`. */
-const switchesFrom = (env: Record<string, string> = {}, hocon?: string) =>
-	readSwitches(readOwnLayers(ownFiles(hocon), { env: { ...MFA_OFF, ...env } }));
-
-/** What phase one refuses under `env`. */
-function refusal(env: Record<string, string>): Error {
-	try {
-		switchesFrom(env);
-	} catch (err) {
-		return err as Error;
-	}
-	throw new Error("phase one read the switches");
-}
-
-/** The federations the composition hands boot under `env`, by name: phase one, then phase two. */
-function federationsOf(env: Record<string, string> = {}) {
-	const own = readOwnLayers(ownFiles(), { env: { ...MFA_OFF, ...env } });
-	const switches = readSwitches(own);
-	const modules = buildModules(switches, { environment: "production" });
-	const resolved = resolveForBoot(own, modules, switches) as unknown as {
-		readonly core?: { readonly federations?: Record<string, Record<string, unknown>> };
-	};
-	return resolved.core?.federations ?? {};
-}
-
-/** The modules phase one chooses under `env`, by name. */
-const moduleNames = (env: Record<string, string>) =>
-	buildModules(switchesFrom(env), { environment: "production" }).map((module) => module.name);
-
-/** Each variable the template binds: its key under the federation, the old name and the new. */
-const RENAMED = [
-	["google", "enabled", "FEDERATIONS_GOOGLE_ENABLED", "CORE_FEDERATIONS_GOOGLE_ENABLED", "true"],
-	[
-		"google",
-		"clientId",
-		"FEDERATIONS_GOOGLE_CLIENT_ID",
-		"CORE_FEDERATIONS_GOOGLE_CLIENT_ID",
-		"g-id",
-	],
-	[
-		"google",
-		"clientSecret",
-		"FEDERATIONS_GOOGLE_CLIENT_SECRET",
-		"CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET",
-		"g-secret",
-	],
-	[
-		"google",
-		"callbackURL",
-		"FEDERATIONS_GOOGLE_CALLBACK_URL",
-		"CORE_FEDERATIONS_GOOGLE_CALLBACK_URL",
-		"https://auth.test/session/oauth/federation/google/callback",
-	],
-	[
-		"google",
-		"accessType",
-		"FEDERATIONS_GOOGLE_ACCESS_TYPE",
-		"CORE_FEDERATIONS_GOOGLE_ACCESS_TYPE",
-		"online",
-	],
-	["oidc", "enabled", "FEDERATIONS_OIDC_ENABLED", "CORE_FEDERATIONS_OIDC_ENABLED", "true"],
-	["oidc", "issuer", "FEDERATIONS_OIDC_ISSUER", "CORE_FEDERATIONS_OIDC_ISSUER", "https://idp.test"],
-	["oidc", "clientId", "FEDERATIONS_OIDC_CLIENT_ID", "CORE_FEDERATIONS_OIDC_CLIENT_ID", "o-id"],
-	[
-		"oidc",
-		"clientSecret",
-		"FEDERATIONS_OIDC_CLIENT_SECRET",
-		"CORE_FEDERATIONS_OIDC_CLIENT_SECRET",
-		"o-secret",
-	],
-	[
-		"oidc",
-		"callbackURL",
-		"FEDERATIONS_OIDC_CALLBACK_URL",
-		"CORE_FEDERATIONS_OIDC_CALLBACK_URL",
-		"https://auth.test/session/oauth/federation/oidc/callback",
-	],
-] as const;
-
-describe("the federations the template ships, under core.federations", () => {
-	it("ships google and oidc disabled, each of the type of its name", () => {
-		const federations = federationsOf();
-		expect(federations.google).toMatchObject({ enabled: false, type: "google" });
-		expect(federations.oidc).toMatchObject({ enabled: false, type: "oidc" });
-	});
-
-	it.each(RENAMED)(
-		"reads core.federations.%s.%s from %s's new name",
-		(name, key, _old, variable, value) => {
-			expect(String(federationsOf({ [variable]: value })[name]?.[key])).toBe(value);
-		},
-	);
-
-	it("lists the same federation modules whether CORE_FEDERATIONS_GOOGLE_ENABLED is true or not", () => {
-		const federationModules = (env: Record<string, string>) =>
-			moduleNames(env).filter((name) => name === "federation-oidc" || name.endsWith("-type"));
-		expect(federationModules({ CORE_FEDERATIONS_GOOGLE_ENABLED: "true" })).toEqual([
-			"federation-google-type",
-			"federation-oidc",
-		]);
-		expect(federationModules({})).toEqual(
-			federationModules({ CORE_FEDERATIONS_GOOGLE_ENABLED: "true" }),
-		);
-	});
-});
-
-describe("a variable the template bound before, FEDERATIONS_<NAME>_<KEY>", () => {
-	it.each(RENAMED)(
-		"core.federations.%s.%s: %s set alone is refused before any module is chosen, naming %s",
-		(name, key, old, variable, value) => {
-			const err = refusal({ [old]: value });
-			expect(err).toBeInstanceOf(BootError);
-			expect(err.message).toContain(`${old} was renamed ${variable}`);
-			expect(err.message).toContain(`core.federations.${name}.${key}`);
-			expect(err).toMatchObject({
-				reason: "environment-variable-renamed",
-				details: {
-					reason: "environment-variable-renamed",
-					renamed: [
-						{
-							module: "core",
-							from: old,
-							to: variable,
-							path: `core.federations.${name}.${key}`,
-							state: "unset",
-						},
-					],
-				},
-			});
-		},
-	);
-
-	it.each(RENAMED)(
-		"core.federations.%s.%s: %s beside its new name at a different value is refused, quoting neither",
-		(_name, _key, old, variable) => {
-			const err = refusal({ [old]: "old-value-5e2d", [variable]: "new-value-c81a" });
-			expect(err).toMatchObject({
-				reason: "environment-variable-renamed",
-				details: { renamed: [{ from: old, state: "different" }] },
-			});
-			expect(err.message).toContain(old);
-			expect(err.message).not.toContain("old-value-5e2d");
-			expect(err.message).not.toContain("new-value-c81a");
-		},
-	);
-
-	it.each(RENAMED)(
-		"core.federations.%s.%s: %s beside its new name at the same value is refused all the same",
-		(_name, _key, old, variable, value) => {
-			const err = refusal({ [old]: value, [variable]: value });
-			expect(err).toMatchObject({
-				reason: "environment-variable-renamed",
-				details: { renamed: [{ from: old, state: "different" }] },
-			});
-		},
-	);
-});
-
-describe("the map written at the top level", () => {
-	it("refuses boot, naming its paths under core.federations", async () => {
-		const own = readOwnLayers(ownFiles("federations.okta.enabled = false\n"), {
-			env: {
-				...MFA_OFF,
-				KEY_STORE_LOCAL_SECRET: "core-federations-secret.at-least-32-bytes.ok",
-				OAUTH_JWT_ISSUER: "https://auth.test",
-				SESSION_STORE_SECRET: "core-federations-session.at-least-32-bytes.ok",
-			},
-		});
-		const switches = readSwitches(own);
-		const modules = buildModules(switches, { environment: "production" });
-		await expect(
-			createApp({
-				modules,
-				bootstrapComponents: {
-					config: resolveForBoot(own, modules, switches),
-					pathResolver: (s: string) => s,
-				} as never,
-			}),
-		).rejects.toMatchObject({
-			reason: "config-path-relocated",
-			details: {
-				relocated: [
-					expect.objectContaining({
-						from: "federations.okta.enabled",
-						to: "core.federations.okta.enabled",
-						environmentVariable: "CORE_FEDERATIONS_OKTA_ENABLED",
-					}),
-				],
-			},
-		});
-	});
-});

package/templates/standalone/src/__tests__/core-sections.test.mts

@@ -1,192 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Core's own settings under `core {}` and the JWKS module's under `jwks {}`,
- * through the template's own reading: its layers read once under one
- * environment, phase one's switches, then the layers over every loaded
- * package's `reference.conf` handed to boot. A path they moved from, written
- * in the operator's own layer, refuses boot naming the new one;
- * `DEPLOYMENT_MODE`, renamed `CORE_DEPLOYMENT_MODE`, refuses boot while it is
- * set, whatever the new name holds.
- */
-
-import { BootError } from "@o3co/auth-provider-core";
-import request from "supertest";
-import { afterEach, describe, expect, it } from "vitest";
-import {
-	type ComposeOptions,
-	type Composition,
-	compose,
-	ISSUER,
-	SINGLE_ENV,
-} from "./all-modules-composition.fixture.mjs";
-
-/** The fixture's single-replica environment, with neither name of the replica count set. */
-const BASE: Readonly<Record<string, string>> = Object.fromEntries(
-	Object.entries(SINGLE_ENV).filter(
-		([name]) => name !== "DEPLOYMENT_MODE" && name !== "CORE_DEPLOYMENT_MODE",
-	),
-);
-
-let current: Composition | undefined;
-
-afterEach(async () => {
-	await current?.handle.dispose();
-	current = undefined;
-});
-
-/** Boots under `env` beside `BASE`, and remembers the composition so `afterEach` disposes it. */
-async function boot(env: Record<string, string>, more: ComposeOptions = {}): Promise<Composition> {
-	current = await compose({ env: { ...BASE, ...env }, ...more });
-	return current;
-}
-
-/** What boot refused with. */
-async function refused(env: Record<string, string>, more: ComposeOptions = {}): Promise<BootError> {
-	try {
-		await boot(env, more);
-	} catch (err) {
-		if (err instanceof BootError) return err;
-		throw err;
-	}
-	throw new Error("the composition booted");
-}
-
-describe("core's own settings and the JWKS module's, as the template reads them", () => {
-	it("boots the shipped configuration: core.sessionRequirements.expected is [], the replica count what CORE_DEPLOYMENT_MODE sets", async () => {
-		const composition = await boot({ CORE_DEPLOYMENT_MODE: "single" });
-
-		const config = composition.config as unknown as Record<string, unknown>;
-		expect(config.core).toMatchObject({ sessionRequirements: { expected: [] } });
-		expect(config).not.toHaveProperty("sessionRequirements");
-		expect(config).not.toHaveProperty("deployment");
-		expect(composition.handle.components.deploymentMode).toBe("single");
-	});
-
-	it("serves the JWKS at the path JWKS_PATH sets, for the max-age JWKS_CACHE_MAX_AGE sets, and advertises it as jwks_uri", async () => {
-		const composition = await boot({
-			CORE_DEPLOYMENT_MODE: "single",
-			JWKS_PATH: "/keys/jwks.json",
-			JWKS_CACHE_MAX_AGE: "600",
-		});
-
-		const jwks = await request(composition.app).get("/keys/jwks.json");
-		expect(jwks.status).toBe(200);
-		expect(jwks.headers["cache-control"]).toBe("public, max-age=600");
-		const discovery = await request(composition.app).get("/.well-known/openid-configuration");
-		expect(discovery.body.jwks_uri).toBe(`${ISSUER}/keys/jwks.json`);
-	});
-});
-
-describe("a path core's or the JWKS module's settings moved from, written in the operator's own layer", () => {
-	it.each([
-		[
-			'deployment.mode = "single"',
-			"core",
-			"deployment.mode",
-			"core.deployment.mode",
-			"CORE_DEPLOYMENT_MODE",
-		],
-		[
-			"sessionRequirements.expected = []",
-			"core",
-			"sessionRequirements.expected",
-			"core.sessionRequirements.expected",
-			undefined,
-		],
-		[
-			'oauth.jwt.jwksPath = "/keys/jwks.json"',
-			"jwks",
-			"oauth.jwt.jwksPath",
-			"jwks.path",
-			"JWKS_PATH",
-		],
-		[
-			"oauth.jwt.jwksCacheMaxAge = 60",
-			"jwks",
-			"oauth.jwt.jwksCacheMaxAge",
-			"jwks.cacheMaxAge",
-			"JWKS_CACHE_MAX_AGE",
-		],
-	])(
-		"%s: refused, naming %s's new path and the variable that binds it, if any",
-		async (hocon, module, from, to, variable) => {
-			const err = await refused(
-				{ CORE_DEPLOYMENT_MODE: "single" },
-				{ operatorHocon: `${hocon}\n` },
-			);
-
-			expect(err.details).toEqual({
-				reason: "config-path-relocated",
-				relocated: [
-					{
-						module,
-						from,
-						to,
-						...(variable === undefined ? {} : { environmentVariable: variable }),
-					},
-				],
-			});
-		},
-	);
-});
-
-describe("DEPLOYMENT_MODE, renamed CORE_DEPLOYMENT_MODE, through the template's reading", () => {
-	it("set alone: refused, naming the new variable and core.deployment.mode", async () => {
-		const err = await refused({ DEPLOYMENT_MODE: "single" });
-
-		expect(err.details).toEqual({
-			reason: "environment-variable-renamed",
-			renamed: [
-				{
-					module: "core",
-					from: "DEPLOYMENT_MODE",
-					to: "CORE_DEPLOYMENT_MODE",
-					path: "core.deployment.mode",
-					state: "unset",
-				},
-			],
-		});
-	});
-
-	it("set beside the new name at a different value: refused, naming neither value", async () => {
-		const err = await refused({
-			DEPLOYMENT_MODE: "old-mode-5e2d",
-			CORE_DEPLOYMENT_MODE: "new-mode-c81a",
-		});
-
-		expect(err.details).toMatchObject({
-			renamed: [{ from: "DEPLOYMENT_MODE", to: "CORE_DEPLOYMENT_MODE", state: "different" }],
-		});
-		expect(err.message).not.toContain("old-mode-5e2d");
-		expect(err.message).not.toContain("new-mode-c81a");
-	});
-
-	it("set beside the new name at the same value: refused all the same", async () => {
-		const err = await refused({ DEPLOYMENT_MODE: "single", CORE_DEPLOYMENT_MODE: "single" });
-
-		expect(err.details).toMatchObject({
-			renamed: [{ from: "DEPLOYMENT_MODE", to: "CORE_DEPLOYMENT_MODE", state: "different" }],
-		});
-	});
-
-	it("unset, with the new name set: boots with its mode", async () => {
-		const composition = await boot({ CORE_DEPLOYMENT_MODE: "single" });
-
-		expect(composition.handle.components.deploymentMode).toBe("single");
-	});
-});

package/templates/standalone/src/__tests__/device-code-store-client-module.test.mts

@@ -1,95 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * `standaloneRedisClientsModule` provides `deviceCodeStoreClient`.
- *
- * The template does not mount the device grant, so nothing in `buildModules`
- * selects `redisDeviceCodeStoreModule` and the smoke test's client-slot
- * invariant cannot see it. This pins the slot directly: a deployment that adds
- * `deviceAuthorizationGrantModule` to this manifest and picks the Redis store must not hit
- * `missing-required-component` for a client slot the shared clients module
- * does not provide.
- */
-
-import type { LifecycleRegistrar } from "@o3co/auth-provider-core";
-import { redisDeviceCodeStoreModule } from "@o3co/auth-provider-redis";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const redisCtorCalls: Array<{ url: string }> = [];
-
-vi.mock("ioredis", () => {
-	class MockRedis {
-		on = vi.fn();
-		quit = vi.fn(async () => "OK" as const);
-		ping = vi.fn(async () => "PONG" as const);
-		eval = vi.fn();
-		evalsha = vi.fn();
-		duplicate(): MockRedis {
-			return new MockRedis("redis://duplicate.local");
-		}
-		constructor(url: string) {
-			redisCtorCalls.push({ url });
-		}
-	}
-	return { Redis: MockRedis, default: MockRedis };
-});
-
-const importModule = async () => await import("../modules.mjs");
-
-/** The module's own section, `redis-clients`, as boot hands it over. */
-const baseSection = { url: "redis://example.com:6379" };
-
-describe("standaloneRedisClientsModule.deviceCodeStoreClient", () => {
-	beforeEach(() => {
-		redisCtorCalls.length = 0;
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-	});
-
-	it("provides every *Client slot redisDeviceCodeStoreModule requires", async () => {
-		const { standaloneRedisClientsModule } = await importModule();
-		const provided = new Set(Object.keys(standaloneRedisClientsModule.provides ?? {}));
-		const required = [...(redisDeviceCodeStoreModule.requires ?? [])].filter((key) =>
-			key.endsWith("Client"),
-		);
-		expect(required).toEqual(["deviceCodeStoreClient"]);
-		expect(required.filter((key) => !provided.has(key))).toEqual([]);
-	});
-
-	it("resolves the client off the one shared socket, not a second connection", async () => {
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-		const lifecycleRegistrar: LifecycleRegistrar = { register: () => {} };
-
-		const client = (await provides.deviceCodeStoreClient?.({
-			section: { ...baseSection },
-			lifecycleRegistrar,
-		})) as Record<string, unknown>;
-		await provides.rateLimiterClient?.({ section: { ...baseSection }, lifecycleRegistrar });
-
-		expect(redisCtorCalls).toHaveLength(1);
-		for (const method of ["create", "findPending", "decide", "poll", "remove"]) {
-			expect(typeof client[method], `deviceCodeStoreClient.${method}`).toBe("function");
-		}
-	});
-});