@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/lifecycle-pending-close.test.mts

@@ -1,217 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The template with core's session lifecycle module: a close whose
- * relying-party notice fails stays pending, its user session still there,
- * and from its commit no token reader treats the session as live —
- * introspection, userinfo and the session grant all refuse it.
- */
-
-import type { SessionLifecycle, UserSessionStore } from "@o3co/auth-provider-core";
-import request from "supertest";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import {
-	authorize,
-	basic,
-	codeFrom,
-	compose,
-	login,
-	redeem,
-	WEB,
-} from "./all-modules-composition.fixture.mjs";
-import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
-
-afterEach(() => {
-	vi.restoreAllMocks();
-});
-
-/** A JWT's claims, unverified. */
-const claimsOf = (token: string): Record<string, unknown> =>
-	JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
-
-describe("a session whose close is pending on a failed relying-party notice", () => {
-	it("is refused by introspection, userinfo and the session grant, its user session still there", async () => {
-		const peer = await backchannelPeer(503);
-		const { app, handle } = await compose({
-			config: withLoopbackRelyingParties,
-			extraClients: {
-				"rp-down": {
-					tokenEndpointAuthMethod: "client_secret_basic",
-					clientSecret: "rp-down-secret-long-enough",
-					allowedRedirectUris: ["https://rp-down.test/cb"],
-					allowedScopes: ["openid"],
-					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: peer.uri,
-				},
-			},
-		});
-		try {
-			const components = handle.components as Record<string, unknown>;
-			const lifecycle = components.sessionLifecycle as SessionLifecycle;
-			const sessions = components.userSessionStore as UserSessionStore;
-			const { cookies } = await login(app);
-			const sessionGrant = () =>
-				request(app)
-					.post("/oauth/token")
-					.set("Authorization", basic(WEB))
-					.set("Cookie", cookies)
-					.type("form")
-					.send({ grant_type: "session", scope: "openid profile" });
-			const issued = await sessionGrant();
-			expect(issued.status).toBe(200);
-			const accessToken = issued.body.access_token as string;
-			const sid = String(claimsOf(accessToken).sid);
-			const introspect = () =>
-				request(app)
-					.post("/oauth/introspect")
-					.set("Authorization", basic(WEB))
-					.type("form")
-					.send({ token: accessToken });
-			const userinfo = () =>
-				request(app).get("/oauth/userinfo").set("Authorization", `Bearer ${accessToken}`);
-			expect((await introspect()).body.active).toBe(true);
-			expect((await userinfo()).status).toBe(200);
-
-			// A relying party joins with its family; its back-channel endpoint is
-			// down, so the close commits with its notice pending.
-			expect(
-				await lifecycle.join(sid, {
-					rp: {
-						clientId: "rp-down",
-						backchannelLogoutUri: peer.uri,
-						backchannelLogoutSessionRequired: true,
-						frontchannelLogoutUri: undefined,
-						frontchannelLogoutSessionRequired: undefined,
-						registeredAt: new Date(),
-					},
-					familyId: "family-down",
-				}),
-			).toEqual({ outcome: "joined" });
-			expect((await lifecycle.close(sid, "rp_logout")).outcome).toBe("pending");
-			expect(peer.tokens.length).toBeGreaterThan(0);
-			expect(await sessions.get(sid)).not.toBeNull();
-
-			const afterIntrospect = await introspect();
-			expect(afterIntrospect.status).toBe(200);
-			expect(afterIntrospect.body).toEqual({ active: false });
-
-			const afterUserinfo = await userinfo();
-			expect(afterUserinfo.status).toBe(401);
-			expect(afterUserinfo.body.error_description).toBe("session_invalid");
-
-			const again = await sessionGrant();
-			expect(again.status).toBe(400);
-			expect(again.body).toMatchObject({
-				error: "invalid_grant",
-				error_description: "session_invalid",
-			});
-		} finally {
-			await handle.dispose();
-			await peer.close();
-		}
-	});
-
-	it("an RP-initiated logout whose notice fails answers success, and its session is refused by introspection, userinfo and the session grant", async () => {
-		const peer = await backchannelPeer(503);
-		const { app, handle } = await compose({
-			config: withLoopbackRelyingParties,
-			extraClients: {
-				"rp-down": {
-					tokenEndpointAuthMethod: "client_secret_basic",
-					clientSecret: "rp-down-secret-long-enough",
-					allowedRedirectUris: ["https://rp-down.test/cb"],
-					allowedScopes: ["openid"],
-					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: peer.uri,
-				},
-			},
-		});
-		try {
-			const components = handle.components as Record<string, unknown>;
-			const lifecycle = components.sessionLifecycle as SessionLifecycle;
-			const sessions = components.userSessionStore as UserSessionStore;
-			const { cookies } = await login(app);
-			// The code exchange joins the session; its id_token is the logout's hint.
-			const exchanged = await redeem(app, codeFrom(await authorize(app, cookies)));
-			expect(exchanged.status).toBe(200);
-			const idToken = exchanged.body.id_token as string;
-			const sid = String(claimsOf(idToken).sid);
-			const sessionGrant = () =>
-				request(app)
-					.post("/oauth/token")
-					.set("Authorization", basic(WEB))
-					.set("Cookie", cookies)
-					.type("form")
-					.send({ grant_type: "session", scope: "openid profile" });
-			const issued = await sessionGrant();
-			expect(issued.status).toBe(200);
-			// A session-grant token carries the session and no family.
-			const accessToken = issued.body.access_token as string;
-			expect(claimsOf(accessToken)).toMatchObject({ sid });
-			expect(claimsOf(accessToken).family_id).toBeUndefined();
-
-			// A relying party whose back-channel endpoint is down joins the session.
-			expect(
-				await lifecycle.join(sid, {
-					rp: {
-						clientId: "rp-down",
-						backchannelLogoutUri: peer.uri,
-						backchannelLogoutSessionRequired: true,
-						frontchannelLogoutUri: undefined,
-						frontchannelLogoutSessionRequired: undefined,
-						registeredAt: new Date(),
-					},
-				}),
-			).toEqual({ outcome: "joined" });
-
-			const logout = await request(app)
-				.post("/oauth/logout")
-				.type("form")
-				.send({ id_token_hint: idToken });
-
-			// The close committed with the notice pending: the logout succeeded.
-			expect(logout.status).toBe(200);
-			expect(logout.body).toEqual({ logged_out: true });
-			expect(peer.tokens.length).toBeGreaterThan(0);
-			expect(await sessions.get(sid)).not.toBeNull();
-
-			const introspected = await request(app)
-				.post("/oauth/introspect")
-				.set("Authorization", basic(WEB))
-				.type("form")
-				.send({ token: accessToken });
-			expect(introspected.status).toBe(200);
-			expect(introspected.body).toEqual({ active: false });
-
-			const userinfo = await request(app)
-				.get("/oauth/userinfo")
-				.set("Authorization", `Bearer ${accessToken}`);
-			expect(userinfo.status).toBe(401);
-			expect(userinfo.body.error_description).toBe("session_invalid");
-
-			const again = await sessionGrant();
-			expect(again.status).toBe(400);
-			expect(again.body).toMatchObject({
-				error: "invalid_grant",
-				error_description: "session_invalid",
-			});
-		} finally {
-			await handle.dispose();
-			await peer.close();
-		}
-	});
-});

package/templates/standalone/src/__tests__/listen.test.mts

@@ -1,121 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Starting the listener: one object-first `server_listening` line once the
- * socket is bound, and none for a port that was never bound. `listen` wires
- * the server's events itself rather than trust `app.listen`, whose Express 5
- * callback is handed the bind `error` as well as `listening`.
- */
-
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import type { Logger } from "@o3co/auth-provider-core";
-import express from "express";
-import { afterEach, describe, expect, it } from "vitest";
-import { listen } from "#/listen.mjs";
-
-/** A logger that records what each level is handed. */
-function recordingLogger(): { logger: Logger; calls: Array<{ level: string; args: unknown[] }> } {
-	const calls: Array<{ level: string; args: unknown[] }> = [];
-	const record =
-		(level: string) =>
-		(...args: unknown[]): void => {
-			calls.push({ level, args });
-		};
-	const logger: Logger = {
-		trace: record("trace"),
-		debug: record("debug"),
-		info: record("info"),
-		warn: record("warn"),
-		error: record("error"),
-		fatal: record("fatal"),
-		child: () => logger,
-	};
-	return { logger, calls };
-}
-
-const opened: Server[] = [];
-
-afterEach(async () => {
-	await Promise.all(
-		opened.splice(0).map((server) => new Promise<void>((resolve) => server.close(() => resolve()))),
-	);
-});
-
-describe("listen", () => {
-	it("says server_listening once, object-first, with the port the socket holds", async () => {
-		const { logger, calls } = recordingLogger();
-		const server = await listen(express(), 0, logger);
-		opened.push(server);
-		const { port } = server.address() as AddressInfo;
-		expect(port).toBeGreaterThan(0);
-		expect(calls).toEqual([{ level: "info", args: [{ port }, "server_listening"] }]);
-	});
-
-	it("logs a server error after the bind — server_error, the projection — rather than swallowing it", async () => {
-		// Every `error` after the bind (accept EMFILE) is logged: a spent
-		// once-listener would lose the first, and with no listener left the
-		// second would be thrown out of the process.
-		const { logger, calls } = recordingLogger();
-		const server = await listen(express(), 0, logger);
-		opened.push(server);
-		calls.length = 0;
-
-		const failure = Object.assign(new Error("accept EMFILE"), { code: "EMFILE" });
-		server.emit("error", failure);
-		server.emit("error", failure);
-
-		expect(calls).toEqual([
-			{
-				level: "error",
-				args: [{ err: expect.objectContaining({ name: "Error", code: "EMFILE" }) }, "server_error"],
-			},
-			{
-				level: "error",
-				args: [{ err: expect.objectContaining({ name: "Error", code: "EMFILE" }) }, "server_error"],
-			},
-		]);
-		const line = calls[0]?.args[0] as { err: unknown };
-		expect(line.err).not.toBeInstanceOf(Error);
-	});
-
-	it("leaves the bound server one error listener, server_error's: the bind's own is removed", async () => {
-		// The listener that turns a bind failure into a rejection has done its
-		// job once the socket is bound. Left attached, it would take every
-		// later error beside server_error's — a callback already spent.
-		const { logger } = recordingLogger();
-		const server = await listen(express(), 0, logger);
-		opened.push(server);
-
-		expect(server.listenerCount("error")).toBe(1);
-		// And nothing of `listen`'s own left on `listening`: an http.Server
-		// keeps one there itself (its connection tracking).
-		expect(server.listenerCount("listening")).toBe(createServer().listenerCount("listening"));
-	});
-
-	it("rejects with the server's error for a port already bound, and announces nothing", async () => {
-		const holder = createServer();
-		// Every interface, as `server.listen(port)` binds, so the two collide.
-		await new Promise<void>((resolve) => holder.listen(0, resolve));
-		opened.push(holder);
-		const { port } = holder.address() as AddressInfo;
-
-		const { logger, calls } = recordingLogger();
-		await expect(listen(express(), port, logger)).rejects.toMatchObject({ code: "EADDRINUSE" });
-		expect(calls).toEqual([]);
-	});
-});

package/templates/standalone/src/__tests__/logger-projection.test.mts

@@ -1,77 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * What the template's own logger writes for a projected error — the line on
- * stdout, from `createAppLogger` in a process of its own, as the service
- * writes it. Every field of core's `loggableError` projection must reach
- * it, at every level of the cause chain: the logger's `err` serializer must
- * not take the projection for an Error and fold its causes into one message.
- */
-
-import { execFileSync } from "node:child_process";
-import { createRequire } from "node:module";
-import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
-
-const templateRoot = fileURLToPath(new URL("../..", import.meta.url));
-const tsxCli = createRequire(import.meta.url).resolve("tsx/cli");
-
-/**
- * A request failure caused by a Store failure caused by a parse failure,
- * logged through `createAppLogger` in a child process; the line it wrote.
- */
-const SCRIPT = `
-const { createAppLogger } = await import("./src/logger.mts");
-const { loggableError } = await import("@o3co/auth-provider-core");
-let parse;
-try { JSON.parse('{"a":1,'); } catch (err) { parse = err; }
-const store = Object.assign(new Error("the Store could not be read", { cause: parse }), {
-	name: "StoreTransportError", code: "ECONNREFUSED", reason: "unreachable", storeStatus: 503,
-});
-const failed = Object.assign(new Error("request failed", { cause: store }), {
-	type: "upstream.failed", status: 502,
-});
-createAppLogger({ level: "info" }).error({ err: loggableError(failed) }, "unhandled_request_error");
-`;
-
-describe("createAppLogger writes a projected error whole", () => {
-	it("keeps every field of every level of the cause chain on the line", () => {
-		const stdout = execFileSync(
-			process.execPath,
-			[tsxCli, "--input-type=module", "--eval", SCRIPT],
-			{ cwd: templateRoot, encoding: "utf8" },
-		);
-		const line = JSON.parse(stdout.trim().split("\n").at(-1) ?? "{}") as {
-			msg?: string;
-			err?: Record<string, unknown>;
-		};
-
-		expect(line.msg).toBe("unhandled_request_error");
-		expect(line.err).toMatchObject({
-			name: "Error",
-			type: "upstream.failed",
-			status: 502,
-			cause: {
-				name: "StoreTransportError",
-				code: "ECONNREFUSED",
-				reason: "unreachable",
-				storeStatus: 503,
-				cause: { name: "SyntaxError", position: 7 },
-			},
-		});
-	});
-});

package/templates/standalone/src/__tests__/logout-session-cookie.test.mts

@@ -1,113 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The template's two logout endpoints and the session cookie: the session
- * store module expires the cookie of a session destroyed during the request,
- * whichever route destroyed it, so `POST /oauth/logout` — whose package knows
- * no cookie name — and `POST /session/logout` both answer with the cookie
- * expired, with the attributes the login set it with.
- */
-
-import type { SessionCookiePolicy } from "@o3co/auth-provider-core";
-import request from "supertest";
-import { describe, expect, it } from "vitest";
-import { authorize, codeFrom, compose, login, redeem } from "./all-modules-composition.fixture.mjs";
-
-/** The `Set-Cookie` lines among `lines` for the cookie `name`. */
-const linesNamed = (lines: readonly string[], name: string): string[] =>
-	lines.filter((line) => line.startsWith(`${name}=`));
-
-/** A response's `Set-Cookie` lines. */
-const setCookies = (res: request.Response): string[] =>
-	([] as string[]).concat(res.headers["set-cookie"] ?? []);
-
-/** A `Set-Cookie` line's attributes, lower-cased, with its value and expiry left out. */
-const attributesOf = (line: string): string[] =>
-	line
-		.split(";")
-		.slice(1)
-		.map((part) => part.trim().toLowerCase())
-		.filter((part) => !part.startsWith("expires=") && !part.startsWith("max-age="))
-		.sort();
-
-/** The CSRF token a login reissued, read off its double-submit cookie. */
-const csrfTokenOf = (cookies: readonly string[]): string => {
-	const cookie = cookies.find((c) => /^[^=]*\.csrf=/.test(c));
-	if (cookie === undefined) throw new Error("the login reissued no CSRF cookie");
-	return decodeURIComponent(cookie.slice(cookie.indexOf("=") + 1).split(";")[0] ?? "");
-};
-
-/**
- * The one `Set-Cookie` line of `res` for the session cookie, checked to
- * expire it with the attributes of `setLine`, the line the login set it with.
- */
-function expectExpired(res: request.Response, name: string, setLine: string): void {
-	const lines = linesNamed(setCookies(res), name);
-	expect(lines).toHaveLength(1);
-	const [line] = lines as [string];
-	expect(line.startsWith(`${name}=;`)).toBe(true);
-	expect(line).toContain("Expires=Thu, 01 Jan 1970 00:00:00 GMT");
-	expect(attributesOf(line)).toEqual(attributesOf(setLine));
-}
-
-describe("the session cookie at the template's logout endpoints", () => {
-	it("POST /oauth/logout expires the session cookie, with the attributes the login set it with", async () => {
-		const { app, handle } = await compose();
-		try {
-			const policy = handle.components.sessionCookiePolicy as SessionCookiePolicy;
-			const { res: signedIn, cookies } = await login(app);
-			expect(signedIn.status).toBe(200);
-			const [setLine] = linesNamed(cookies, policy.name);
-			expect(setLine).toBeDefined();
-			const tokens = await redeem(app, codeFrom(await authorize(app, cookies)));
-			expect(tokens.status).toBe(200);
-
-			const res = await request(app)
-				.post("/oauth/logout")
-				.set("Cookie", cookies)
-				.type("form")
-				.send({ id_token_hint: tokens.body.id_token as string });
-
-			expect(res.status).toBe(200);
-			expect(res.body).toEqual({ logged_out: true });
-			expectExpired(res, policy.name, setLine as string);
-		} finally {
-			await handle.dispose();
-		}
-	});
-
-	it("POST /session/logout expires the session cookie, with the attributes the login set it with", async () => {
-		const { app, handle } = await compose();
-		try {
-			const policy = handle.components.sessionCookiePolicy as SessionCookiePolicy;
-			const { res: signedIn, cookies } = await login(app);
-			expect(signedIn.status).toBe(200);
-			const [setLine] = linesNamed(cookies, policy.name);
-			expect(setLine).toBeDefined();
-
-			const res = await request(app)
-				.post("/session/logout")
-				.set("Cookie", cookies)
-				.set("x-csrf-token", csrfTokenOf(cookies));
-
-			expect(res.status).toBe(200);
-			expectExpired(res, policy.name, setLine as string);
-		} finally {
-			await handle.dispose();
-		}
-	});
-});

package/templates/standalone/src/__tests__/mail-sender.test.mts

@@ -1,134 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The mail sender the template installs behind core's `mailSender` slot,
- * both from `@o3co/auth-provider-standard`: the development sender where the
- * configuration was selected as development — the name `app.mts` defaults
- * to — the SMTP sender's module under any other name, and none when
- * `buildModules` is told no name. A deployment's own sender modules, passed
- * as `mailSenderModules`, replace that choice under every name. Nothing in
- * the template reads the slot: this is the wiring alone.
- */
-
-import { defineModule, type MailSender, type Module } from "@o3co/auth-provider-core";
-import {
-	standardDevelopmentMailSenderModule,
-	standardSmtpMailSenderModule,
-} from "@o3co/auth-provider-standard";
-import { afterEach, describe, expect, it } from "vitest";
-import { buildModules } from "#/buildModules.mjs";
-import {
-	type Composition,
-	compose,
-	resolveConfig,
-	SINGLE_ENV,
-} from "./all-modules-composition.fixture.mjs";
-
-const DEVELOPMENT = standardDevelopmentMailSenderModule({ environment: "development" }).name;
-const SMTP = standardSmtpMailSenderModule.name;
-
-/** A deployment's own sender, built at boot so the slot holds it with nothing reading it. */
-const OWN_SENDER: MailSender = {
-	kind: "deployment-own",
-	send: async () => ({ outcome: "delivered" }),
-};
-const ownSenderModule: Module = defineModule({
-	name: "deployment-own-mail-sender",
-	lifecycle: { mailSender: { eager: true } },
-	provides: { mailSender: () => OWN_SENDER },
-});
-const OWN = ownSenderModule.name;
-
-/** The mail sender modules `buildModules` lists for `environment`. */
-const senders = (
-	environment: string | undefined,
-	mailSenderModules?: readonly Module[],
-): string[] =>
-	buildModules(resolveConfig(SINGLE_ENV), {
-		...(environment === undefined ? {} : { environment }),
-		...(mailSenderModules === undefined ? {} : { mailSenderModules }),
-	})
-		.map((module) => module.name)
-		.filter((name) => name === DEVELOPMENT || name === SMTP || name === OWN);
-
-const ENVIRONMENTS = ["development", "production", "staging", "test", "Development"] as const;
-
-describe("the template's mail sender", () => {
-	let current: Composition | undefined;
-	afterEach(async () => {
-		await current?.handle.dispose();
-		current = undefined;
-	});
-
-	it("is the development sender in development, and none where no environment is named", () => {
-		expect(senders("development")).toEqual([DEVELOPMENT]);
-		expect(senders(undefined)).toEqual([]);
-	});
-
-	it("is the SMTP sender's module under any other environment", () => {
-		for (const environment of ["production", "staging", "test", "Development"]) {
-			expect(senders(environment), environment).toEqual([SMTP]);
-		}
-	});
-
-	it("fills the slot with the development sender when the composition boots in development", async () => {
-		current = await compose({ environment: "development" });
-		expect((current.handle.components.mailSender as MailSender | undefined)?.kind).toBe(
-			"standard-development",
-		);
-	});
-
-	it("boots in production with the SMTP sender's module installed and no SMTP settings, building no sender where nothing reads the slot", async () => {
-		current = await compose();
-		expect(current.modules.map((module) => module.name)).toContain(SMTP);
-		expect(current.handle.components.mailSender).toBeUndefined();
-	});
-
-	describe("given the deployment's own sender modules", () => {
-		it("installs them in place of the bundled sender, under every environment name and none", () => {
-			for (const environment of [...ENVIRONMENTS, undefined]) {
-				expect(senders(environment, [ownSenderModule]), String(environment)).toEqual([OWN]);
-			}
-		});
-
-		it("installs no sender at all when the list is empty", () => {
-			for (const environment of [...ENVIRONMENTS, undefined]) {
-				expect(senders(environment, []), String(environment)).toEqual([]);
-			}
-		});
-
-		it.each(["development", "production"])(
-			"fills the slot with the deployment's sender when the composition boots in %s",
-			async (environment) => {
-				current = await compose({ environment, mailSenderModules: [ownSenderModule] });
-				const names = current.modules.map((module) => module.name);
-				expect(names).toContain(OWN);
-				expect(names).not.toContain(DEVELOPMENT);
-				expect(names).not.toContain(SMTP);
-				expect(current.handle.components.mailSender).toBe(OWN_SENDER);
-			},
-		);
-
-		it("boots in production with no sender when the list is empty", async () => {
-			current = await compose({ environment: "production", mailSenderModules: [] });
-			const names = current.modules.map((module) => module.name);
-			expect(names).not.toContain(DEVELOPMENT);
-			expect(names).not.toContain(SMTP);
-			expect(current.handle.components.mailSender).toBeUndefined();
-		});
-	});
-});