@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/federation-types.test.mts

@@ -1,239 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The federations the template ships are handled by the modules of their
- * types. The template loads the federation types it bundles, `google` and
- * `oidc`, whatever the configuration enables, and core dispatches each
- * enabled `core.federations` entry to the module of its `type`, under the
- * entry's name: two entries of one type are two federations. The template
- * reads no entry before boot, so a malformed one is core's to refuse, at its
- * path.
- */
-
-import { mkdtempSync, readdirSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import request from "supertest";
-import { afterEach, describe, expect, it } from "vitest";
-import { buildModules } from "#/buildModules.mjs";
-import { readOwnLayers, readSwitches, resolveConfigPaths, resolveLayers } from "#/configPath.mjs";
-import {
-	type Composition,
-	compose,
-	ISSUER,
-	ownFiles,
-	resolveConfig,
-	SINGLE_ENV,
-} from "./all-modules-composition.fixture.mjs";
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-/** Google's authorization endpoint, where a Google federation's start sends the browser. */
-const GOOGLE_AUTHORIZE = "https://accounts.google.com/o/oauth2/v2/auth";
-
-let current: Composition | undefined;
-
-afterEach(async () => {
-	await current?.handle.dispose();
-	current = undefined;
-});
-
-/** Boots and remembers the composition, so `afterEach` disposes it. */
-async function boot(options: Parameters<typeof compose>[0] = {}): Promise<Composition> {
-	current = await compose(options);
-	return current;
-}
-
-/** What `compose` refuses under `options`. */
-async function refusal(options: Parameters<typeof compose>[0]): Promise<{
-	readonly reason?: string;
-	readonly message: string;
-}> {
-	try {
-		current = await compose(options);
-	} catch (err) {
-		return err as { reason?: string; message: string };
-	}
-	throw new Error("the composition booted");
-}
-
-/** `text` in a file of its own, for a layer above the composition's files. */
-function hoconFile(text: string): string {
-	const file = join(mkdtempSync(join(tmpdir(), "federation-types-")), "operator.conf");
-	writeFileSync(file, text);
-	return file;
-}
-
-/** The module names `buildModules` lists for `env`, federation ones only. */
-const federationModules = (env: Readonly<Record<string, string>>): string[] =>
-	buildModules(resolveConfig(env))
-		.map((module) => module.name)
-		.filter((name) => name.startsWith("federation-") && !name.startsWith("federation-grant"));
-
-/** Where the start of federation `name` sends the browser. */
-async function startOf(composed: Composition, name: string): Promise<URL> {
-	const res = await request(composed.app).get(`/session/oauth/federation/${name}`);
-	expect(res.status).toBe(302);
-	return new URL(res.headers.location as string);
-}
-
-describe("the federation types the template bundles", () => {
-	it("are listed whatever the configuration enables", () => {
-		const off = {
-			...SINGLE_ENV,
-			CORE_FEDERATIONS_GOOGLE_ENABLED: "false",
-			CORE_FEDERATIONS_OIDC_ENABLED: "false",
-		};
-		expect(federationModules(off)).toEqual(["federation-google-type", "federation-oidc"]);
-		expect(federationModules(SINGLE_ENV)).toEqual(["federation-google-type", "federation-oidc"]);
-	});
-
-	it("handle every entry the template ships, each of which names its type", () => {
-		const { applicationConfPath } = resolveConfigPaths(configDir, "production");
-		const resolved = resolveLayers(readOwnLayers([applicationConfPath], { env: {} }), []) as {
-			core?: { federations?: Record<string, { type?: unknown }> };
-		};
-		const types = Object.fromEntries(
-			Object.entries(resolved.core?.federations ?? {}).map(([name, entry]) => [name, entry.type]),
-		);
-		expect(types).toEqual({ google: "google", oidc: "oidc" });
-	});
-
-	it("boot the shipped Google federation, enabled, as the provider named google that its type built", async () => {
-		const composed = await boot();
-		const names = composed.modules.map((module) => module.name);
-		expect(names).toContain("federation-google-type");
-		expect(names).not.toContain("federation-google");
-		expect(composed.handle.components.federationProviders?.get("google")?.name).toBe("google");
-
-		const start = await startOf(composed, "google");
-		expect(`${start.origin}${start.pathname}`).toBe(GOOGLE_AUTHORIZE);
-		expect(start.searchParams.get("client_id")).toBe(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID);
-		expect(start.searchParams.get("redirect_uri")).toBe(
-			"http://localhost:3000/session/oauth/federation/google/callback",
-		);
-	});
-
-	it("boot a second entry of type google, under its own name, beside the shipped one", async () => {
-		const callbackURL = `${ISSUER}/session/oauth/federation/google-work/callback`;
-		const composed = await boot({
-			operatorHocon: `core.federations.google-work {
-  enabled = true
-  type = "google"
-  clientId = "google-work-client"
-  clientSecret = "google-work-secret"
-  callbackURL = ${JSON.stringify(callbackURL)}
-}
-`,
-		});
-		const providers = composed.handle.components.federationProviders;
-		expect([...(providers?.keys() ?? [])].sort()).toEqual(["google", "google-work", "oidc"]);
-		expect(providers?.get("google-work")?.name).toBe("google-work");
-
-		const work = await startOf(composed, "google-work");
-		expect(`${work.origin}${work.pathname}`).toBe(GOOGLE_AUTHORIZE);
-		expect(work.searchParams.get("client_id")).toBe("google-work-client");
-		expect(work.searchParams.get("redirect_uri")).toBe(callbackURL);
-		const shipped = await startOf(composed, "google");
-		expect(shipped.searchParams.get("client_id")).toBe(
-			SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID,
-		);
-	});
-
-	it("hand an entry to the type it names, not the type its name reads as", async () => {
-		// `google` of type `oidc` is a generic OIDC federation named google.
-		const composed = await boot({
-			operatorHocon: `core.federations.google { type = "oidc", issuer = ${JSON.stringify(SINGLE_ENV.CORE_FEDERATIONS_OIDC_ISSUER)} }\n`,
-		});
-		const start = await startOf(composed, "google");
-		expect(start.origin).toBe(SINGLE_ENV.CORE_FEDERATIONS_OIDC_ISSUER);
-		expect(start.searchParams.get("client_id")).toBe(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID);
-	});
-
-	it("register the type of every entry each shipped configuration file writes", () => {
-		const registered = new Set(
-			buildModules(resolveConfig(SINGLE_ENV)).flatMap((module) =>
-				Object.keys(module.contributes?.federationTypes ?? {}),
-			),
-		);
-		const written = readdirSync(configDir)
-			.filter((file) => file.endsWith(".conf"))
-			.flatMap((file) => {
-				const resolved = resolveLayers(readOwnLayers([join(configDir, file)], { env: {} }), []) as {
-					core?: { federations?: Record<string, { type?: unknown }> };
-				};
-				return Object.entries(resolved.core?.federations ?? {}).map(([name, entry]) => ({
-					file,
-					name,
-					type: entry.type,
-				}));
-			});
-		expect(written).not.toEqual([]);
-		expect(written.filter(({ type }) => typeof type !== "string" || !registered.has(type))).toEqual(
-			[],
-		);
-	});
-});
-
-describe("the template reads no federation entry before boot", () => {
-	it("passes a malformed entry through phase one, and boot refuses it at its path", async () => {
-		const operatorHocon = 'core.federations.okta { enabled = "maybe", type = "oidc" }\n';
-		expect(() =>
-			readSwitches(readOwnLayers([hoconFile(operatorHocon), ...ownFiles()], { env: SINGLE_ENV })),
-		).not.toThrow();
-		const err = await refusal({ operatorHocon });
-		expect(err.reason).toBe("config-validation-failed");
-		expect(err.message).toContain("core.federations.okta.enabled");
-	});
-
-	it.each([
-		["accessType", '"sometimes"'],
-		// A bare string where a list belongs: the natural typo.
-		["redirectAllowlist", '"https://app.test/home"'],
-		["sessionDomain", "42"],
-		["requireAuthorizationResponseIss", '"no"'],
-		// Only an environment variable's string is read as a flag's spelling.
-		["requireAuthorizationResponseIss", "1"],
-		["requireAuthorizationResponseIss", "[true]"],
-	])(
-		"leaves %s, a key of the entry's type, to the type's schema, which core refuses it by, at its path",
-		async (key, value) => {
-			const err = await refusal({ operatorHocon: `core.federations.google.${key} = ${value}\n` });
-			expect(err.reason).toBe("config-validation-failed");
-			expect(err.message).toContain(`core.federations.google.${key}`);
-		},
-	);
-});
-
-describe("an enabled Google federation's credentials", () => {
-	it.each([
-		["unset", undefined],
-		["exported empty", ""],
-	])(
-		"refuse the boot when the client secret is %s, at its path, quoting no value of the entry",
-		async (_case, secret) => {
-			const { CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: _shipped, ...env } = SINGLE_ENV;
-			const err = await refusal({
-				env: secret === undefined ? env : { ...env, CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET: secret },
-			});
-			expect(err.reason).toBe("config-validation-failed");
-			expect(err.message).toContain("core.federations.google.clientSecret");
-			expect(err.message).not.toContain(SINGLE_ENV.CORE_FEDERATIONS_GOOGLE_CLIENT_ID as string);
-		},
-	);
-});

package/templates/standalone/src/__tests__/frontchannel-logout-csp.test.mts

@@ -1,168 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The front-channel logout page, served through the template behind its
- * security headers, works under the one policy the response carries: its
- * relying party's frame and its redirect are allowed, and nothing else is.
- * Every other answer keeps the template's policy.
- */
-
-import { createHash } from "node:crypto";
-import request from "supertest";
-import { describe, expect, it } from "vitest";
-import {
-	authorize,
-	basic,
-	codeFrom,
-	compose,
-	login,
-	PKCE,
-} from "./all-modules-composition.fixture.mjs";
-
-const RP = {
-	id: "rp-fc",
-	secret: "rp-fc-secret-long-enough",
-	redirectUri: "https://rp-fc.test/cb",
-	frontchannelLogoutUri: "https://rp-fc.test:8443/frontchannel-logout",
-	postLogoutRedirectUri: "https://rp-fc.test/signed-out",
-} as const;
-
-/** A serialized policy as directive name → sources; a directive named twice fails. */
-const parsePolicy = (policy: string): Map<string, string[]> => {
-	const directives = new Map<string, string[]>();
-	for (const part of policy.split(";")) {
-		const [name, ...sources] = part.trim().split(/\s+/);
-		if (name === undefined || name === "") continue;
-		if (directives.has(name)) throw new Error(`directive ${name} appears twice`);
-		directives.set(name, sources);
-	}
-	return directives;
-};
-
-/** The sources a fetch directive resolves to: its own, else `default-src`'s. */
-const effective = (policy: Map<string, string[]>, directive: string): string[] =>
-	policy.get(directive) ?? policy.get("default-src") ?? [];
-
-const decode = (value: string): string =>
-	value
-		.replace(/&quot;/g, '"')
-		.replace(/&#39;/g, "'")
-		.replace(/&lt;/g, "<")
-		.replace(/&gt;/g, ">")
-		.replace(/&amp;/g, "&");
-
-/** How many `Content-Security-Policy` header lines the response carried, as sent. */
-const policyHeaderCount = (response: object): number => {
-	const raw = (response as { res?: { rawHeaders?: unknown } }).res?.rawHeaders;
-	if (!Array.isArray(raw)) throw new Error("the response carries no raw headers");
-	return raw.filter(
-		(name, i) => i % 2 === 0 && String(name).toLowerCase() === "content-security-policy",
-	).length;
-};
-
-describe("the front-channel logout page under the template's security headers", () => {
-	it("is allowed its relying party's frame and its redirect by the one policy it is served with", async () => {
-		const { app, handle } = await compose({
-			extraClients: {
-				[RP.id]: {
-					tokenEndpointAuthMethod: "client_secret_basic",
-					clientSecret: RP.secret,
-					allowedRedirectUris: [RP.redirectUri],
-					allowedScopes: ["openid"],
-					allowedGrantTypes: ["authorization_code"],
-					frontchannelLogoutUri: RP.frontchannelLogoutUri,
-					postLogoutRedirectUris: [RP.postLogoutRedirectUri],
-					firstParty: true,
-				},
-			},
-		});
-		try {
-			// A session the relying party joined by exchanging a code.
-			const { cookies } = await login(app);
-			const exchanged = await request(app)
-				.post("/oauth/token")
-				.set("Authorization", basic(RP))
-				.type("form")
-				.send({
-					grant_type: "authorization_code",
-					code: codeFrom(await authorize(app, cookies, RP)),
-					redirect_uri: RP.redirectUri,
-					code_verifier: PKCE.verifier,
-				});
-			expect(exchanged.status).toBe(200);
-
-			const res = await request(app)
-				.get("/oauth/logout")
-				.set("Accept", "text/html")
-				.set("Cookie", cookies)
-				.query({
-					id_token_hint: exchanged.body.id_token as string,
-					post_logout_redirect_uri: RP.postLogoutRedirectUri,
-					state: "s-1",
-				});
-
-			expect(res.status).toBe(200);
-			expect(res.headers["content-type"]).toBe("text/html; charset=utf-8");
-			expect(policyHeaderCount(res)).toBe(1);
-			const policy = parsePolicy(res.headers["content-security-policy"] as string);
-
-			// The frame: the relying party's, from the one origin the policy allows.
-			const srcs = [...res.text.matchAll(/<iframe src="([^"]*)"/g)].map((m) => decode(m[1] ?? ""));
-			expect(srcs).toHaveLength(1);
-			expect(new URL(srcs[0] ?? "").origin).toBe("https://rp-fc.test:8443");
-			expect(effective(policy, "frame-src")).toEqual(["https://rp-fc.test:8443"]);
-
-			// The redirect: one inline script, allowed by its hash, sending the
-			// browser to the registered URI with the state.
-			const scripts = [
-				...res.text.matchAll(/<script data-target="([^"]*)" data-delay="(\d+)">([^<]*)<\/script>/g),
-			];
-			expect(scripts).toHaveLength(1);
-			expect(res.text.match(/<script/g)).toHaveLength(1);
-			const [, target, , text] = scripts[0] ?? [];
-			expect(decode(target ?? "")).toBe(`${RP.postLogoutRedirectUri}?state=s-1`);
-			const hash = createHash("sha256")
-				.update(text ?? "", "utf8")
-				.digest("base64");
-			expect(effective(policy, "script-src")).toEqual([`'sha256-${hash}'`]);
-
-			// Nothing else.
-			expect(policy.get("default-src")).toEqual(["'none'"]);
-			expect(effective(policy, "style-src")).toEqual(["'none'"]);
-			expect(effective(policy, "connect-src")).toEqual(["'none'"]);
-			expect(policy.get("frame-ancestors")).toEqual(["'none'"]);
-			expect(res.headers["cache-control"]).toBe("no-store");
-		} finally {
-			await handle.dispose();
-		}
-	});
-
-	it("leaves the template's policy on every other answer", async () => {
-		const { app, handle } = await compose();
-		try {
-			const res = await request(app).get("/.well-known/openid-configuration");
-
-			expect(policyHeaderCount(res)).toBe(1);
-			const policy = parsePolicy(res.headers["content-security-policy"] as string);
-			expect(policy.get("default-src")).toEqual(["'none'"]);
-			expect(policy.get("frame-ancestors")).toEqual(["'none'"]);
-			expect(effective(policy, "frame-src")).toEqual(["'none'"]);
-		} finally {
-			await handle.dispose();
-		}
-	});
-});