@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/federation-grants-survive-logout.test.mts

@@ -1,464 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * A federation grant outlives the session it was agreed through, at both HTTP
- * logout endpoints (ADR 2026-09-17-federation-grants-offline-delegation).
- * Both close the session through core's session lifecycle, whose close work
- * reaches the grant store on no path, by construction. A proof of the helper is not a proof of the endpoints, so
- * this drives both, on the standalone, as a deployment composes them: a grant
- * seeded beside a live browser session, the session's records gone afterwards,
- * the grant and its credential exactly as they were, and `/token` still
- * disclosing.
- *
- * The seeded grant's access token is fresh, so the disclosure is the cached
- * one and no upstream is asked; the OIDC federation the connection names has
- * `discovery = false` and hand-typed endpoints so the deployment boots without
- * a network.
- */
-
-import { createHmac } from "node:crypto";
-import { fileURLToPath } from "node:url";
-import {
-	type AppConfig,
-	createApp,
-	createKeyStoreFactory,
-	defineModule,
-	type FederationTokenStore,
-	federationGrantAuthorizationRevision,
-	federationGrantIdentityRevision,
-	federationsOf,
-	InMemoryClientRepository,
-	InMemoryUserRepository,
-	type MemoryFederationGrantStore,
-	memoryRefreshTokenFamilyStoreModule,
-	registerBuiltinKeyStores,
-	type UserSessionStore,
-} from "@o3co/auth-provider-core";
-import { parseFile } from "@o3co/ts.hocon";
-import express from "express";
-import request from "supertest";
-import { afterEach, describe, expect, it } from "vitest";
-import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths } from "../configPath.mjs";
-import { templateReference } from "../modules.mjs";
-import { keyStoreSectionSchema } from "../sections.mjs";
-import {
-	type BothPhases,
-	bothPhasesOf,
-	capturedRenames,
-	libraryLayers,
-} from "./library-references.fixture.mjs";
-
-const DAY = 86_400_000;
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-const ISSUER = "https://auth.test";
-const JWT_SECRET = "federation-grants-survive-logout.at-least-32-bytes.ok";
-const UPSTREAM = "https://issuer.example";
-const UPSTREAM_CLIENT_ID = "provider-client";
-const ENCRYPTION_KEY = Buffer.alloc(32, 9).toString("base64");
-
-const CLIENT_ID = "worker";
-const CLIENT_SECRET = "worker-secret-value";
-const BASIC = `Basic ${Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64")}`;
-const USERNAME = "alice";
-const PASSWORD = "correct-horse-battery-staple";
-const SUB = "u-alice";
-
-const CONNECTION = "calendar";
-const SCOPES: readonly string[] = ["openid", "offline_access", "calendar.read"];
-const BOUNDARY = "production";
-const GRANT_ID = "g-1";
-const REFRESH_TOKEN = "SENTINEL-refresh-token";
-const ACCESS_TOKEN = "upstream-access-token";
-
-const ENV: Readonly<Record<string, string>> = {
-	// The logout here is a session without a second factor.
-	MFA_MODE: "off",
-	KEY_STORE_LOCAL_ALGORITHM: "HS256",
-	KEY_STORE_LOCAL_SECRET: JWT_SECRET,
-	OAUTH_JWT_ISSUER: ISSUER,
-	SESSION_STORE_SECRET: "federation-grants-survive-logout-session.at-least-32-bytes.ok",
-	SESSION_STORE_SECURE: "false",
-	SESSION_STORE_NAME: "auth.session",
-	SESSION_STORE_STORAGE_TYPE: "memory",
-	ADAPTERS_USER_REPOSITORY: "yaml",
-	REDIS_CLIENTS_URL: "redis://redis.test:6379",
-	ADAPTERS_USER_SESSION_STORES: "memory",
-	ADAPTERS_RATE_LIMITER: "memory",
-	ADAPTERS_CODE_REPOSITORY: "memory",
-	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
-	ADAPTERS_REPLAY_SEEN_SET: "memory",
-	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
-	ADAPTERS_CONSENT_STORE: "none",
-	ADAPTERS_FEDERATION_GRANT_STORE: "memory",
-	ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
-	FEDERATION_GRANTS_ENABLED: "true",
-	FEDERATION_GRANTS_CONSENT_URL: "/consent/grants",
-	// The connect flow is not driven here, and the bundled repository has no
-	// identity lookup; "unsupported" is the declaration a deployment without one
-	// makes, and what lets a connection be configured at all.
-	FEDERATION_GRANTS_IDENTITY_LOOKUP: "unsupported",
-};
-
-/**
- * The shipped configuration under the environment above, with the two lists
- * that have no environment form written over it: the
- * upstream federation the connection names, and the connection.
- */
-function resolveConfig(): BothPhases {
-	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	const layers = parseFile(envConfPath, { env: ENV })
-		.withFallback(parseFile(applicationConfPath, { env: ENV }))
-		.withFallback(parseFile(fileURLToPath(templateReference()), { env: ENV }))
-		.withFallback(libraryLayers(ENV));
-	const config = bothPhasesOf(layers, ENV);
-	return {
-		...config,
-		// What the resolution captured of the renamed variables.
-		"renamed-variables": capturedRenames(ENV),
-		core: {
-			...config.core,
-			federations: {
-				...federationsOf(config),
-				upstream: {
-					enabled: true,
-					type: "oidc",
-					issuer: UPSTREAM,
-					clientId: UPSTREAM_CLIENT_ID,
-					clientSecret: "provider-secret",
-					callbackURL: `${ISSUER}/session/oauth/federation/upstream/callback`,
-					scopes: [...SCOPES],
-					discovery: false,
-					endpoints: {
-						authorizationEndpoint: `${UPSTREAM}/authorize`,
-						tokenEndpoint: `${UPSTREAM}/token`,
-						jwksUri: `${UPSTREAM}/jwks`,
-					},
-					redirectAllowlist: [],
-				},
-			},
-		},
-		"redis-federation-grant-store": {
-			...(config["redis-federation-grant-store"] as object | undefined),
-			encryptionKeys: [{ id: "k-test", key: ENCRYPTION_KEY }],
-		},
-		"federation-grants": {
-			...config["federation-grants"],
-			connections: {
-				[CONNECTION]: {
-					federation: "upstream",
-					scopes: [...SCOPES],
-					boundary: BOUNDARY,
-					maxAccessTokenLifetime: 3600,
-					callbackURL: `${ISSUER}/session/federation-grants/callback/${CONNECTION}`,
-				},
-			},
-		},
-	} as BothPhases;
-}
-
-const testRepositoriesModule = defineModule({
-	name: "test:repositories",
-	provides: {
-		clientRepository: () =>
-			new InMemoryClientRepository(
-				new Map([
-					[
-						CLIENT_ID,
-						{
-							tokenEndpointAuthMethod: "client_secret_basic",
-							clientSecret: CLIENT_SECRET,
-							allowedRedirectUris: [],
-							allowedScopes: ["openid", "profile"],
-							allowedAudiences: [],
-							allowedGrantTypes: ["session"],
-							backchannelLogoutSessionRequired: true,
-							frontchannelLogoutSessionRequired: true,
-							allowedAzpForFederationToken: false,
-							allowedFederationGrantConnections: [CONNECTION],
-						},
-					],
-				]),
-			),
-		userRepository: () =>
-			new InMemoryUserRepository(
-				new Map([[USERNAME, { id: SUB, password: PASSWORD, email: "alice@example.com" }]]),
-			),
-	} as never,
-});
-
-// The template's `key-store` section, read by its own schema, without the
-// section's relocation bridge.
-const testKeyStoreModule = defineModule({
-	name: "key-store",
-	section: { schema: keyStoreSectionSchema },
-	provides: {
-		keyStore: async ({ section }) => {
-			const factory = createKeyStoreFactory();
-			registerBuiltinKeyStores(factory);
-			return factory.create({
-				type: "local",
-				...(section.local ?? {}),
-			});
-		},
-	},
-});
-
-/** The grant as the connect flow would have left it, a fresh upstream token in hand. */
-async function seedGrant(store: MemoryFederationGrantStore): Promise<void> {
-	const at = new Date();
-	// The revisions as `connections.mts` resolves them from the configuration
-	// above: the federation's issuer and client, the connection's scopes and
-	// boundary, no resource, no authorization parameters.
-	const resolved = {
-		upstreamIssuer: UPSTREAM,
-		upstreamClientId: UPSTREAM_CLIENT_ID,
-		scopes: SCOPES,
-		boundary: BOUNDARY,
-		authorizationParams: {},
-	};
-	await store.createPending({
-		id: GRANT_ID,
-		subject: SUB,
-		clientId: CLIENT_ID,
-		connection: CONNECTION,
-		intent: { handle: "h", expiresAt: new Date(at.getTime() + 600_000) },
-		now: at,
-	});
-	const written = await store.activate({
-		grantId: GRANT_ID,
-		intentHandle: "h",
-		authorization: {
-			identityRevision: federationGrantIdentityRevision(resolved),
-			authorizationRevision: federationGrantAuthorizationRevision(resolved),
-			upstream: { issuer: UPSTREAM, subject: "upstream-alice" },
-			scopes: [...SCOPES],
-			consent: { at, sid: "sid-consent", scopes: [...SCOPES] },
-			authorizedAt: at,
-			expiresAt: new Date(at.getTime() + 30 * DAY),
-			resource: undefined,
-		},
-		credentials: {
-			refreshToken: REFRESH_TOKEN,
-			accessToken: {
-				value: ACCESS_TOKEN,
-				tokenType: "Bearer",
-				obtainedAt: at,
-				issuedLifetime: 3600,
-				effectiveExpiresAt: new Date(at.getTime() + 3_600_000),
-				scopes: [...SCOPES],
-			},
-		},
-		now: at,
-	});
-	if (!written.ok) throw new Error("fixture: the grant was not activated");
-}
-
-const base64url = (value: unknown): string =>
-	Buffer.from(JSON.stringify(value)).toString("base64url");
-
-/**
- * An id_token for the session, signed with the deployment's own HS256 key, as
- * the RP would present it: `/oauth/logout` reads `sid` from the hint and from
- * nothing else.
- */
-function idTokenHint(sid: string): string {
-	const header = base64url({ alg: "HS256", kid: "v0", typ: "JWT" });
-	const now = Math.floor(Date.now() / 1000);
-	const payload = base64url({
-		iss: ISSUER,
-		sub: SUB,
-		aud: CLIENT_ID,
-		sid,
-		iat: now,
-		exp: now + 3600,
-	});
-	const signature = createHmac("sha256", JWT_SECRET)
-		.update(`${header}.${payload}`)
-		.digest("base64url");
-	return `${header}.${payload}.${signature}`;
-}
-
-const claimsOf = (jwt: string): Record<string, unknown> =>
-	JSON.parse(Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8")) as Record<
-		string,
-		unknown
-	>;
-
-describe("a grant outlives the browser session at both logout endpoints", () => {
-	let handleRef: Awaited<ReturnType<typeof createApp>> | undefined;
-
-	afterEach(async () => {
-		await handleRef?.dispose();
-		handleRef = undefined;
-	});
-
-	async function boot() {
-		const config = resolveConfig();
-		const handle = await createApp({
-			modules: buildModules(config, {
-				keyStoreModule: testKeyStoreModule,
-				repositoriesModule: testRepositoriesModule,
-				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-			}),
-			bootstrapComponents: { config, pathResolver: (s) => s },
-		});
-		handleRef = handle;
-		const components = handle.components as {
-			federationGrantStore: MemoryFederationGrantStore;
-			userSessionStore: UserSessionStore;
-			federationTokenStore: FederationTokenStore;
-		};
-		await seedGrant(components.federationGrantStore);
-		const app = express();
-		app.use(handle.router);
-		return { app, config, ...components };
-	}
-
-	/** The real browser half: a CSRF pair, a login, and the cookies plus the token the login reissued. */
-	async function login(app: express.Express, config: AppConfig) {
-		const csrfRes = await request(app).get("/session/csrf");
-		expect(csrfRes.status).toBe(200);
-		const csrfToken = csrfRes.body.csrf_token as string;
-		const headerName = csrfRes.body.header_name as string;
-		const csrfCookies = csrfRes.headers["set-cookie"] as unknown as string[];
-
-		const loginRes = await request(app)
-			.post("/session/login")
-			.set("Cookie", csrfCookies)
-			.set(headerName, csrfToken)
-			.type("form")
-			.send({ username: USERNAME, password: PASSWORD });
-		expect(loginRes.status).toBe(200);
-
-		const cookies = loginRes.headers["set-cookie"] as unknown as string[];
-		const csrfCookiePrefix = `${(config["session-store"] as { name: string }).name}.csrf=`;
-		const reissued = cookies
-			.find((c) => c.startsWith(csrfCookiePrefix))
-			?.slice(csrfCookiePrefix.length)
-			.split(";")[0];
-		expect(reissued).toBeDefined();
-		return { cookies, csrfToken: decodeURIComponent(reissued as string), headerName };
-	}
-
-	/** The session's `sid`, read off the access token the session grant mints for it. */
-	async function sidOf(app: express.Express, cookies: string[]): Promise<string> {
-		const res = await request(app)
-			.post("/oauth/token")
-			.set("Authorization", BASIC)
-			.set("Cookie", cookies)
-			.type("form")
-			.send({ grant_type: "session" });
-		expect(res.status).toBe(200);
-		const sid = claimsOf(res.body.access_token as string).sid;
-		expect(typeof sid).toBe("string");
-		return sid as string;
-	}
-
-	const disclose = (app: express.Express) =>
-		request(app)
-			.post(`/oauth/federation-grants/${GRANT_ID}/token`)
-			.set("Authorization", BASIC)
-			.send({ sub: SUB });
-
-	/**
-	 * What a logout has to leave: the record, its credential — the values, not
-	 * only a readable state, since a rotated or dropped refresh token beside an
-	 * untouched access token would still read `"ok"` — and a disclosure that
-	 * still answers.
-	 */
-	async function expectGrantUntouched(app: express.Express, store: MemoryFederationGrantStore) {
-		expect((await store.find(GRANT_ID, new Date()))?.status).toBe("active");
-		const opened = await store.open(GRANT_ID, new Date());
-		if (opened?.credentials.state !== "ok")
-			throw new Error("the grant's credential is not readable");
-		expect(opened.credentials.value).toMatchObject({
-			refreshToken: REFRESH_TOKEN,
-			accessToken: { value: ACCESS_TOKEN },
-		});
-		const response = await disclose(app);
-		expect(response.status).toBe(200);
-		expect(response.body.access_token).toBe(ACCESS_TOKEN);
-	}
-
-	it("POST /session/logout ends the session's own records and leaves the grant spendable", async () => {
-		const { app, config, federationGrantStore, userSessionStore, federationTokenStore } =
-			await boot();
-		const { cookies, csrfToken, headerName } = await login(app, config);
-		const sid = await sidOf(app, cookies);
-		// A session-bound upstream token beside the grant, keyed by this
-		// session: a record logout must end.
-		await federationTokenStore.attach(sid, "upstream", {
-			accessToken: "session-bound-upstream-token",
-			expiresAt: null,
-			// Every field is a required key; this record carries only the
-			// access token.
-			refreshToken: undefined,
-			idToken: undefined,
-			tokenType: undefined,
-			scope: undefined,
-			grantedScope: undefined,
-			obtainedAt: undefined,
-		});
-		expect(await userSessionStore.get(sid)).not.toBeNull();
-		await expectGrantUntouched(app, federationGrantStore);
-
-		const logout = await request(app)
-			.post("/session/logout")
-			.set("Cookie", cookies)
-			.set(headerName, csrfToken);
-		expect([200, 204]).toContain(logout.status);
-
-		// The session-bound records are gone ...
-		expect(await userSessionStore.get(sid)).toBeNull();
-		expect(await federationTokenStore.get(sid, "upstream")).toBeNull();
-		// ... and the grant is not among them.
-		await expectGrantUntouched(app, federationGrantStore);
-	});
-
-	it("POST /oauth/logout runs the cascade and leaves the grant spendable", async () => {
-		const { app, config, federationGrantStore, userSessionStore, federationTokenStore } =
-			await boot();
-		const { cookies } = await login(app, config);
-		const sid = await sidOf(app, cookies);
-		await federationTokenStore.attach(sid, "upstream", {
-			accessToken: "session-bound-upstream-token",
-			expiresAt: null,
-			// Every field is a required key; this record carries only the
-			// access token.
-			refreshToken: undefined,
-			idToken: undefined,
-			tokenType: undefined,
-			scope: undefined,
-			grantedScope: undefined,
-			obtainedAt: undefined,
-		});
-		expect(await userSessionStore.get(sid)).not.toBeNull();
-		await expectGrantUntouched(app, federationGrantStore);
-
-		const logout = await request(app)
-			.post("/oauth/logout")
-			.type("form")
-			.send({ id_token_hint: idTokenHint(sid) });
-		expect(logout.status).toBe(200);
-
-		expect(await userSessionStore.get(sid)).toBeNull();
-		expect(await federationTokenStore.get(sid, "upstream")).toBeNull();
-		await expectGrantUntouched(app, federationGrantStore);
-	});
-});

package/templates/standalone/src/__tests__/federation-token-refresh-outage.test.mts

@@ -1,141 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * `POST /oauth/federation/:name/token` ends a session's upstream tokens only
- * on the upstream's own verdict that the refresh token is bad (a structured
- * `invalid_grant` under a 4xx), and never while the upstream is down, whatever
- * the body of its 5xx says. An outage is `503`, and the tokens are kept for
- * the retry.
- *
- * Driven through the real Google adapter and its library (openid-client)
- * against a fake Google (`createFakeIdp`), so the errors the route classifies
- * are the ones the library raises: a 4xx whose body names a code is a
- * `ResponseBodyError` carrying `error` and `status`; a 5xx is an
- * `OperationProcessingError` raised over the `Response`, whose body the
- * library does not read.
- */
-
-import { createFakeIdp, type FakeIdp } from "@o3co/auth-provider-core/testing";
-import request from "supertest";
-import { afterEach, describe, expect, it } from "vitest";
-import {
-	accessTokenWithFamily,
-	GOOGLE_CLIENT_ID,
-	type GoogleSession,
-	signInLinkedToGoogle,
-} from "./google-session.fixture.mjs";
-
-const GOOGLE = {
-	issuer: "https://accounts.google.com",
-	authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth",
-	tokenEndpoint: "https://oauth2.googleapis.com/token",
-	jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
-	userinfoEndpoint: "https://www.googleapis.com/oauth2/v3/userinfo",
-};
-const STORED_REFRESH_TOKEN = "stored-refresh-token";
-
-describe("POST /oauth/federation/google/token: an upstream outage never ends the session's Google tokens", () => {
-	let session: GoogleSession | undefined;
-
-	afterEach(async () => {
-		await session?.dispose();
-		session = undefined;
-	});
-
-	/**
-	 * Alice's session with Google linked, its access token expired so the
-	 * route refreshes, and the fake Google answering the refresh with `status`
-	 * and `body`.
-	 */
-	async function refreshAnswered(status: number, body: Record<string, unknown>) {
-		const idp: FakeIdp = await createFakeIdp({ ...GOOGLE, clientId: GOOGLE_CLIENT_ID });
-		idp.tokenStatus = status;
-		idp.refusal = body;
-		session = await signInLinkedToGoogle({
-			google: { fetch: idp.fetch },
-			tokens: {
-				accessToken: "expired-upstream-access-token",
-				expiresAt: new Date(Date.now() - 60_000),
-				refreshToken: STORED_REFRESH_TOKEN,
-				idToken: undefined,
-				tokenType: "Bearer",
-				scope: "openid profile email",
-				grantedScope: "openid profile email",
-				obtainedAt: undefined,
-			},
-		});
-		const res = await request(session.app)
-			.post("/oauth/federation/google/token")
-			.set("Authorization", `Bearer ${accessTokenWithFamily(session.sid)}`)
-			.send();
-		// The library did ask Google: what follows is its reading of the answer.
-		expect(
-			idp.requests.filter(
-				(r) =>
-					`${r.url.origin}${r.url.pathname}` === GOOGLE.tokenEndpoint &&
-					r.body?.get("grant_type") === "refresh_token",
-			),
-		).toHaveLength(1);
-		return { res, ...session };
-	}
-
-	it("keeps them and answers 503 when Google answers 503 with a body naming invalid_grant", async () => {
-		const { res, sid, federationTokenStore, sessionLifecycle } = await refreshAnswered(503, {
-			error: "invalid_grant",
-			error_description: "Backend unavailable",
-		});
-
-		expect(res.status).toBe(503);
-		expect(res.body).toEqual({
-			error: "temporarily_unavailable",
-			error_description: "upstream federation provider temporarily unavailable",
-		});
-		expect((await federationTokenStore.get(sid, "google"))?.refreshToken).toBe(
-			STORED_REFRESH_TOKEN,
-		);
-		expect(await sessionLifecycle.federations(sid)).toEqual({
-			outcome: "listed",
-			federations: ["google"],
-		});
-	});
-
-	it("keeps them and answers 503 when Google answers 502 with no OAuth body at all", async () => {
-		const { res, sid, federationTokenStore } = await refreshAnswered(502, {});
-
-		expect(res.status).toBe(503);
-		expect((await federationTokenStore.get(sid, "google"))?.refreshToken).toBe(
-			STORED_REFRESH_TOKEN,
-		);
-	});
-
-	it("ends them on Google's structured 400 invalid_grant", async () => {
-		const { res, sid, federationTokenStore, sessionLifecycle } = await refreshAnswered(400, {
-			error: "invalid_grant",
-			error_description: "Token has been expired or revoked.",
-		});
-
-		expect(res.status).toBe(410);
-		expect(res.body.error).toBe("re_authentication_required");
-		expect(await federationTokenStore.get(sid, "google")).toBeNull();
-		// The route never writes the session's index: the link, now holding no
-		// credential, stays listed until federation logout or the session's end.
-		expect(await sessionLifecycle.federations(sid)).toEqual({
-			outcome: "listed",
-			federations: ["google"],
-		});
-	});
-});