@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/mailpit-compose.test.mts

@@ -1,393 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The development compose run, `docker-compose.yml`, with MFA as the
- * configuration's switch says (on as the template ships it), and the Mailpit
- * overlay, `docker-compose.mailpit.yml`: a development run whose mail goes
- * through the SMTP sender to Mailpit. It is an overlay on
- * `docker-compose.yml`, so a plain `docker compose up` starts no Mailpit, and
- * the production file names none. The compose files are read as
- * the fixed-shape files they are, and the process each run describes is booted
- * from the shipped files, as `app.mts` boots them, under the environment the
- * run sets: `.env.example`'s lines, then each compose file's `environment`, the
- * overlay's last. Redis is a stand-in: nothing here issues a command.
- */
-
-import { generateKeyPairSync } from "node:crypto";
-import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import {
-	createApp,
-	type MailSender,
-	memoryRefreshTokenFamilyStoreModule,
-} from "@o3co/auth-provider-core";
-import {
-	standardDevelopmentMailSenderModule,
-	standardSmtpMailSenderModule,
-} from "@o3co/auth-provider-standard";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { buildModules } from "#/buildModules.mjs";
-import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "#/configPath.mjs";
-import { createRecordingLogger } from "./all-modules-composition.fixture.mjs";
-import { configuredMfaMode } from "./configured-mfa-mode.fixture.mjs";
-
-vi.mock("redis", () => ({
-	createClient: vi.fn(() => ({
-		connect: vi.fn().mockResolvedValue(undefined),
-		quit: vi.fn().mockResolvedValue(undefined),
-		ping: vi.fn().mockResolvedValue("PONG"),
-		on: vi.fn(),
-	})),
-}));
-
-vi.mock("connect-redis", async () => {
-	const { EventEmitter } = await import("node:events");
-	// express-session subscribes to store events, so the stand-in is an emitter.
-	return {
-		RedisStore: class MockRedisStore extends EventEmitter {
-			get(): unknown {
-				return undefined;
-			}
-			set(): void {}
-			destroy(): void {}
-		},
-	};
-});
-
-vi.mock("ioredis", () => {
-	const explicit: Record<string, unknown> = {
-		on: () => undefined,
-		quit: async () => "OK",
-		disconnect: () => undefined,
-		ping: async () => "PONG",
-		// The Redis stores' eviction gate reads the policy from INFO memory: a
-		// default server's.
-		info: async (section: string) =>
-			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
-	};
-	const makeMockRedis = (): object =>
-		new Proxy(
-			{},
-			{
-				get(_target, prop) {
-					// A function-valued `then` would make the instance a thenable.
-					if (typeof prop !== "string" || prop === "then") return undefined;
-					if (prop === "duplicate") return makeMockRedis;
-					if (prop in explicit) return explicit[prop];
-					return async () => null;
-				},
-			},
-		);
-	function MockRedis(): object {
-		return makeMockRedis();
-	}
-	return { Redis: MockRedis, default: MockRedis };
-});
-
-const standaloneDir = fileURLToPath(new URL("../..", import.meta.url));
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-const read = (rel: string): string => readFileSync(join(standaloneDir, rel), "utf8");
-
-const OVERLAY = "docker-compose.mailpit.yml";
-
-/** The lines of a service's block in a compose file, comments and blank lines left out. */
-function serviceBlock(rel: string, name: string): string[] {
-	const lines = read(rel).split("\n");
-	const services = lines.findIndex((line) => /^services:\s*$/.test(line));
-	const start = lines.findIndex(
-		(line, at) => at > services && new RegExp(`^ {2}${name}:\\s*$`).test(line),
-	);
-	if (services === -1 || start === -1) return [];
-	const block: string[] = [];
-	for (const line of lines.slice(start + 1)) {
-		if (line.trim() === "" || /^\s*#/.test(line)) continue;
-		if (!/^ {4}/.test(line)) break;
-		block.push(line);
-	}
-	return block;
-}
-
-const unquote = (text: string): string => text.trim().replace(/^["']|["']$/g, "");
-
-/** A scalar key of a service's block. */
-function scalar(block: readonly string[], key: string): string | undefined {
-	for (const line of block) {
-		const match = new RegExp(`^ {4}${key}:\\s*(\\S.*)$`).exec(line);
-		if (match) return unquote(match[1] as string);
-	}
-	return undefined;
-}
-
-/** The entries under a key of a service's block, each trimmed. */
-function entries(block: readonly string[], key: string): string[] {
-	const at = block.findIndex((line) => new RegExp(`^ {4}${key}:\\s*$`).test(line));
-	if (at === -1) return [];
-	const found: string[] = [];
-	for (const line of block.slice(at + 1)) {
-		if (!/^ {6}/.test(line)) break;
-		found.push(line.trim());
-	}
-	return found;
-}
-
-/** The `- "…"` entries of a list, unquoted. */
-const listOf = (lines: readonly string[]): string[] =>
-	lines.map((line) => unquote(line.replace(/^-\s*/, "")));
-
-/** `.env.example`'s uncommented lines: what a `.env` copied from it sets. */
-function dotenvExample(): Record<string, string> {
-	const env: Record<string, string> = {};
-	for (const line of read(".env.example").split("\n")) {
-		const match = /^([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
-		if (match) env[match[1] as string] = match[2] as string;
-	}
-	return env;
-}
-
-/**
- * A service's `environment`, interpolated as compose does from the project's
- * `.env`: `${VAR:-default}` is the variable when it is set and not empty, the
- * default otherwise.
- */
-function environmentOf(
-	rel: string,
-	service: string,
-	dotenv: Readonly<Record<string, string>>,
-): Record<string, string> {
-	const env: Record<string, string> = {};
-	for (const line of entries(serviceBlock(rel, service), "environment")) {
-		const match = /^([A-Z][A-Z0-9_]*):\s*(.*)$/.exec(line);
-		if (!match) continue;
-		env[match[1] as string] = unquote(match[2] as string).replace(
-			/\$\{([A-Z][A-Z0-9_]*):-([^}]*)\}/g,
-			(_, name: string, fallback: string) => (dotenv[name] ? dotenv[name] : fallback),
-		);
-	}
-	return env;
-}
-
-describe("Mailpit runs only in the overlay", () => {
-	it("is not a service of the development or the production compose file", () => {
-		expect(serviceBlock("docker-compose.yml", "mailpit")).toEqual([]);
-		expect(serviceBlock("docker-compose.production.yml", "mailpit")).toEqual([]);
-		expect(read("docker-compose.production.yml")).not.toMatch(/mailpit/i);
-	});
-
-	it("runs a pinned Mailpit image in the app's network namespace", () => {
-		const mailpit = serviceBlock(OVERLAY, "mailpit");
-		expect(scalar(mailpit, "image")).toMatch(/^axllent\/mailpit:v\d+\.\d+\.\d+$/);
-		expect(scalar(mailpit, "network_mode")).toBe("service:app");
-	});
-
-	it("publishes Mailpit's web UI on loopback, from the app service that owns the namespace", () => {
-		expect(listOf(entries(serviceBlock(OVERLAY, "app"), "ports"))).toContain("127.0.0.1:8025:8025");
-	});
-
-	it("points the SMTP sender at Mailpit over the app's loopback, in plaintext", () => {
-		expect(environmentOf(OVERLAY, "app", {})).toMatchObject({
-			STANDARD_SMTP_MAIL_SENDER_HOST: "localhost",
-			STANDARD_SMTP_MAIL_SENDER_PORT: "1025",
-			STANDARD_SMTP_MAIL_SENDER_SECURE: "none",
-		});
-	});
-});
-
-describe("the process each development run describes", () => {
-	const handles: { dispose(): Promise<void> }[] = [];
-	afterEach(async () => {
-		for (const handle of handles.splice(0)) await handle.dispose();
-	});
-
-	const signingKey = generateKeyPairSync("ed25519", {
-		publicKeyEncoding: { type: "spki", format: "pem" },
-		privateKeyEncoding: { type: "pkcs8", format: "pem" },
-	});
-	const clientsFile = (() => {
-		const file = join(mkdtempSync(join(tmpdir(), "mailpit-compose-")), "clients.yaml");
-		writeFileSync(file, "");
-		return file;
-	})();
-
-	/** What the operator writes into `.env` beside `.env.example`'s lines: its required blanks. */
-	const OPERATOR: Readonly<Record<string, string>> = {
-		OAUTH_JWT_ISSUER: "http://localhost:3000",
-		KEY_STORE_LOCAL_PRIVATE_KEY: signingKey.privateKey,
-		KEY_STORE_LOCAL_PUBLIC_KEY: signingKey.publicKey,
-		SESSION_STORE_SECRET: "mailpit-compose-session-secret.at-least-32-bytes.ok",
-		REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: "https://users.test/authenticate",
-		REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: "https://users.test/by-token",
-		REPOSITORIES_CLIENT_YAML_PATH: clientsFile,
-	};
-
-	/**
-	 * The container's environment: `.env`, then each compose file's
-	 * `environment`, the overlay's last unless `overlay` is false.
-	 */
-	function containerEnv(overlay = true): Record<string, string> {
-		const dotenv: Record<string, string> = { ...dotenvExample(), ...OPERATOR };
-		// The pem pair is given inline here; the paths name files this test has not written.
-		delete dotenv.KEY_STORE_LOCAL_PRIVATE_KEY_PATH;
-		delete dotenv.KEY_STORE_LOCAL_PUBLIC_KEY_PATH;
-		return {
-			...Object.fromEntries(Object.entries(dotenv).filter(([, value]) => value !== "")),
-			...environmentOf("docker-compose.yml", "app", dotenv),
-			...(overlay ? environmentOf(OVERLAY, "app", dotenv) : {}),
-		};
-	}
-
-	it("boots docker-compose.yml's run with MFA as the configuration's switch says: development, the development mail sender, the MFA stores on its Redis", async () => {
-		const env = containerEnv(false);
-		// `app.mts`: CONFIG_ENV, then NODE_ENV, then development; the run sets neither.
-		expect(env.CONFIG_ENV ?? env.NODE_ENV).toBeUndefined();
-		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "development");
-		const own = readOwnLayers([envConfPath, applicationConfPath], { env });
-		const switches = readSwitches(own);
-		const mode = configuredMfaMode("development");
-		expect(switches.mfaMode).toBe(mode);
-		// A hot reload restarts the process on every save, and Redis keeps the
-		// factors, and the sessions beside them, across it.
-		expect(switches.adapters).toMatchObject({
-			mfaFactorStore: "redis",
-			mfaTransactionStore: "redis",
-		});
-
-		const modules = buildModules(switches, {
-			environment: "development",
-			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-		});
-		const handle = await createApp({
-			modules,
-			bootstrapComponents: {
-				config: resolveForBoot(own, modules, switches),
-				pathResolver: (s: string) => s,
-				logger: createRecordingLogger(),
-			},
-		});
-		handles.push(handle);
-		expect((handle.components.mailSender as MailSender | undefined)?.kind).toBe(
-			"standard-development",
-		);
-		expect((handle.components.config as { mfa?: { mode?: unknown } } | undefined)?.mfa?.mode).toBe(
-			mode === "off" ? undefined : mode,
-		);
-	});
-
-	it("selects a configuration that is not development, so the SMTP sender is installed", () => {
-		const configEnv = containerEnv().CONFIG_ENV;
-		expect(configEnv).toBeDefined();
-		expect(configEnv).not.toBe("development");
-		// A missing `{ENV}.conf` is fatal at boot.
-		expect(existsSync(resolveConfigPaths(configDir, configEnv as string).envConfPath)).toBe(true);
-	});
-
-	/** The key the operator writes into `.env` for the Mailpit run (`openssl rand -base64 32`). */
-	const OWN_MFA_KEY = Buffer.alloc(32, 7).toString("base64");
-
-	/** The Mailpit run's modules and the configuration boot is handed, under `env`. */
-	function mailpitRun(env: Record<string, string>) {
-		const configEnv = env.CONFIG_ENV as string;
-		const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
-		const own = readOwnLayers([envConfPath, applicationConfPath], { env });
-		const switches = readSwitches(own);
-		const modules = buildModules(switches, {
-			environment: configEnv,
-			refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-		});
-		return { switches, modules, config: () => resolveForBoot(own, modules, switches) };
-	}
-
-	it("boots with the SMTP sender relaying to Mailpit: in the mailSender slot, with the operator's MFA key, while MFA is on (the configuration's switch); unread, with no mfa section, while it is off", async () => {
-		const env: Record<string, string> = { ...containerEnv(), MFA_ENCRYPTION_KEY: OWN_MFA_KEY };
-		const { switches, modules, config } = mailpitRun(env);
-		const mode = configuredMfaMode(env.CONFIG_ENV as string);
-		expect(switches.mfaMode).toBe(mode);
-		const names = modules.map((module) => module.name);
-		expect(names).toContain(standardSmtpMailSenderModule.name);
-		expect(names).not.toContain(
-			standardDevelopmentMailSenderModule({ environment: "development" }).name,
-		);
-
-		const handle = await createApp({
-			modules,
-			bootstrapComponents: {
-				config: config(),
-				pathResolver: (s: string) => s,
-				logger: createRecordingLogger(),
-			},
-		});
-		handles.push(handle);
-		expect((handle.components.mailSender as MailSender | undefined)?.kind).toBe(
-			mode === "off" ? undefined : "standard-smtp",
-		);
-		const mfa = (
-			handle.components.config as {
-				mfa?: { mode?: unknown; encryptionKeys?: { key?: unknown }[] };
-			}
-		).mfa;
-		if (mode === "off") {
-			expect(mfa).toBeUndefined();
-		} else {
-			expect(mfa?.mode).toBe(mode);
-			expect(mfa?.encryptionKeys?.map((entry) => entry.key)).toEqual([OWN_MFA_KEY]);
-		}
-		expect(
-			(handle.components.config as Record<string, unknown> | undefined)?.[
-				"standard-smtp-mail-sender"
-			],
-		).toMatchObject({ host: "localhost", port: 1025, secure: "none" });
-	});
-
-	it("does not carry the development sample key: with MFA on, without MFA_ENCRYPTION_KEY the run is refused; with it off, nothing reads a key", async () => {
-		const env = containerEnv();
-		expect(env.MFA_ENCRYPTION_KEY).toBeUndefined();
-		const { modules, config } = mailpitRun(env);
-		if (configuredMfaMode(env.CONFIG_ENV as string) === "off") {
-			const handle = await createApp({
-				modules,
-				bootstrapComponents: {
-					config: config(),
-					pathResolver: (s: string) => s,
-					logger: createRecordingLogger(),
-				},
-			});
-			handles.push(handle);
-			expect(handle.components.config).not.toHaveProperty("mfa");
-			return;
-		}
-		const refused = await (async () => {
-			try {
-				handles.push(
-					await createApp({
-						modules,
-						bootstrapComponents: {
-							config: config(),
-							pathResolver: (s: string) => s,
-							logger: createRecordingLogger(),
-						},
-					}),
-				);
-			} catch (error) {
-				return error;
-			}
-			return undefined;
-		})();
-		expect(refused).toBeInstanceOf(Error);
-		expect(String((refused as Error).message)).toMatch(/mfa\.encryptionKeys/);
-	});
-});

package/templates/standalone/src/__tests__/metrics.test.mts

@@ -1,253 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import { request as httpRequest } from "node:http";
-import express from "express";
-import request from "supertest";
-import { describe, expect, it, vi } from "vitest";
-import { createMetrics } from "../metrics.mjs";
-
-function buildApp(probes: Parameters<ReturnType<typeof createMetrics>["route"]>[1]["probes"] = []) {
-	const metrics = createMetrics();
-	const app = express();
-	app.use(metrics.middleware);
-	app.use(metrics.route(express, { probes, probeTimeoutMs: 100 }));
-
-	const api = express.Router();
-	api.get("/widgets/:id", (_req, res) => {
-		res.status(200).json({ ok: true });
-	});
-	api.get("/boom", (_req, res) => {
-		res.status(500).json({ ok: false });
-	});
-	app.use("/api", api);
-	return app;
-}
-
-/**
- * Starts `app` on 127.0.0.1, the address the raw-socket tests dial. A hostless
- * `listen(0)` binds `[::]`, and on macOS the port it gets can be one another
- * process holds on 127.0.0.1 — the request then reaches that process and can
- * hang until the test times out.
- */
-function listenOnLoopback(app: express.Express): Promise<ReturnType<express.Express["listen"]>> {
-	return new Promise((resolve) => {
-		const server = app.listen(0, "127.0.0.1", () => resolve(server));
-	});
-}
-
-describe("GET /metrics", () => {
-	it("serves the Prometheus text exposition format", async () => {
-		const res = await request(buildApp()).get("/metrics");
-
-		expect(res.status).toBe(200);
-		expect(res.headers["content-type"]).toContain("text/plain");
-		// Node process defaults are namespaced so they cannot collide with
-		// anything else scraped from the same job.
-		expect(res.text).toContain("auth_provider_process_cpu_user_seconds_total");
-	});
-
-	it("records latency by method, route and status", async () => {
-		const app = buildApp();
-		await request(app).get("/api/widgets/42");
-		await request(app).get("/api/boom");
-
-		const res = await request(app).get("/metrics");
-
-		expect(res.text).toContain('route="/api/widgets/:id"');
-		expect(res.text).toContain('status="200"');
-		expect(res.text).toContain('status="500"');
-	});
-
-	it("labels by the route pattern, not the URL, so the label set stays bounded", async () => {
-		// Labelling by path would mint a series per id and eventually take down
-		// the system that is supposed to be watching this one.
-		const app = buildApp();
-		for (const id of ["1", "2", "3"]) {
-			await request(app).get(`/api/widgets/${id}`);
-		}
-
-		const res = await request(app).get("/metrics");
-		const series = res.text
-			.split("\n")
-			.filter((l) => l.startsWith("http_request_duration_seconds_count"));
-
-		expect(series.some((l) => l.includes('route="/api/widgets/:id"'))).toBe(true);
-		expect(res.text).not.toContain('route="/api/widgets/1"');
-	});
-
-	it("collapses unmatched requests into a single bucket", async () => {
-		// 404 probes from the internet carry attacker-chosen paths.
-		const app = buildApp();
-		await request(app).get(`/nope/${"x".repeat(50)}`);
-
-		const res = await request(app).get("/metrics");
-
-		expect(res.text).toContain('route="unmatched"');
-		expect(res.text).not.toContain("xxxxx");
-	});
-
-	it("collapses unknown HTTP methods into one label", async () => {
-		// req.method is attacker-controlled — Node's HTTP parser accepts any
-		// valid token, so `FOO` and `M000001` arrive as readily as `GET`. An
-		// unbounded method label is the same cardinality bomb as an unbounded
-		// route label, reachable without any access to /metrics. Sent over a real
-		// socket because supertest cannot express a non-standard method.
-		const app = buildApp();
-		const server = await listenOnLoopback(app);
-		const port = (server.address() as { port: number }).port;
-		try {
-			for (const method of ["FOO", "M000001", "PURGE"]) {
-				await new Promise<void>((resolve) => {
-					const req = httpRequest(
-						{ host: "127.0.0.1", port, path: "/api/widgets/1", method },
-						(res) => {
-							res.resume();
-							res.once("end", resolve);
-						},
-					);
-					req.once("error", () => resolve());
-					req.end();
-				});
-			}
-
-			const res = await request(app).get("/metrics");
-
-			expect(res.text).toContain('method="other"');
-			expect(res.text).not.toContain('method="M000001"');
-			expect(res.text).not.toContain('method="FOO"');
-		} finally {
-			server.close();
-		}
-	});
-
-	it("counts a request whose client disconnects before the response finishes", async () => {
-		// `close` fires without `finish` when a client or proxy gives up
-		// mid-handler, and those are disproportionately the slow and failing
-		// requests RED metrics exist to surface. Sequenced on the server's own
-		// events, never on a fixed wait: the abort goes out once the handler
-		// holds the request, and /metrics is read once the response has closed.
-		const metrics = createMetrics();
-		const app = express();
-		app.use(metrics.middleware);
-		app.use(metrics.route(express, { probes: [], probeTimeoutMs: 100 }));
-		const handling = Promise.withResolvers<void>();
-		const closed = Promise.withResolvers<void>();
-		app.get("/slow", (_req, res) => {
-			// Never responds; the test aborts the socket instead. This listener is
-			// added after the metrics middleware's, and a response emits `close`
-			// to its listeners in the order they were added, so once it runs the
-			// request has been observed.
-			res.once("close", () => closed.resolve());
-			handling.resolve();
-		});
-
-		const server = await listenOnLoopback(app);
-		const port = (server.address() as { port: number }).port;
-		try {
-			const controller = new AbortController();
-			const pending = fetch(`http://127.0.0.1:${port}/slow`, {
-				signal: controller.signal,
-			}).catch(() => undefined);
-			await handling.promise;
-			controller.abort();
-			await pending;
-			await closed.promise;
-
-			const res = await request(app).get("/metrics");
-			const slow = res.text
-				.split("\n")
-				.filter((l) => l.startsWith("http_request_duration_seconds_count"))
-				.filter((l) => l.includes('route="/slow"'));
-			// One request, counted once, under the route it had reached.
-			expect(slow).toHaveLength(1);
-			expect(slow[0]?.trim().endsWith(" 1")).toBe(true);
-		} finally {
-			server.close();
-		}
-	});
-
-	it("observes a response exactly once even though both finish and close fire", async () => {
-		const app = buildApp();
-		await request(app).get("/api/widgets/1");
-
-		const res = await request(app).get("/metrics");
-		const line = res.text
-			.split("\n")
-			.find(
-				(l) =>
-					l.startsWith("http_request_duration_seconds_count") &&
-					l.includes('route="/api/widgets/:id"'),
-			);
-		expect(line?.trim().endsWith(" 1")).toBe(true);
-	});
-
-	it("publishes a per-dependency gauge from the readiness probes", async () => {
-		const app = buildApp([
-			{ name: "redis", check: async () => "PONG" },
-			{
-				name: "session-store",
-				check: async () => {
-					throw new Error("ECONNREFUSED");
-				},
-			},
-		]);
-
-		const res = await request(app).get("/metrics");
-
-		expect(res.text).toContain('auth_dependency_up{dependency="redis"} 1');
-		expect(res.text).toContain('auth_dependency_up{dependency="session-store"} 0');
-	});
-
-	it("re-samples dependencies on every scrape instead of caching a verdict", async () => {
-		let healthy = true;
-		const app = buildApp([
-			{
-				name: "redis",
-				check: async () => {
-					if (!healthy) throw new Error("down");
-					return "PONG";
-				},
-			},
-		]);
-
-		expect((await request(app).get("/metrics")).text).toContain(
-			'auth_dependency_up{dependency="redis"} 1',
-		);
-		healthy = false;
-		expect((await request(app).get("/metrics")).text).toContain(
-			'auth_dependency_up{dependency="redis"} 0',
-		);
-	});
-
-	it("joins an in-flight probe rather than issuing one per scrape", async () => {
-		// A partitioned backend never answers, and a scrape loop would otherwise
-		// stack one command per scrape against the dependency already in trouble.
-		const check = vi.fn(() => new Promise(() => {}));
-		const app = buildApp([{ name: "redis", check }]);
-
-		await request(app).get("/metrics");
-		await request(app).get("/metrics");
-
-		expect(check).toHaveBeenCalledTimes(1);
-	});
-
-	it("is never cached", async () => {
-		const res = await request(buildApp()).get("/metrics");
-
-		expect(res.headers["cache-control"]).toBe("no-store");
-	});
-});