@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/mfa-routes-budget.test.mts

@@ -1,122 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The MFA routes' budget the template ships: every `/session/mfa` POST is
- * limited under the prefix `mfa` by the wired limiter alone, and the
- * template's own `reference.conf` gives both limiters `limits.mfa`, 60
- * requests per 300 s. Followed through both configuration phases and
- * `createApp` to the limiter each module builds, in every environment the
- * template ships a file for.
- */
-
-import { fileURLToPath } from "node:url";
-import {
-	createApp,
-	defineModule,
-	memoryRateLimiterModule,
-	type RateLimiter,
-} from "@o3co/auth-provider-core";
-import { redisRateLimiterModule } from "@o3co/auth-provider-redis";
-import { afterEach, describe, expect, it } from "vitest";
-import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "../configPath.mjs";
-import { loggingModule } from "../modules.mjs";
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-/** The secrets `application.conf` substitutes: test-only values past the entropy floor. */
-const SECRETS = {
-	KEY_STORE_LOCAL_SECRET: "test-secret-mfa-routes-budget.at-least-32-bytes.ok",
-	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_STORE_SECRET: "test-session-secret-mfa-routes-budget.at-least-32-bytes.ok",
-	MFA_MODE: "off",
-};
-
-/** The windows, in seconds, the Redis limiter asked its client to count over. */
-const windows: number[] = [];
-
-/** The limiter a consumer of the slot is handed, as the MFA routes are. */
-let consumed: RateLimiter | undefined;
-const consumerModule = defineModule({
-	name: "test:rate-limiter-consumer",
-	requires: ["rateLimiter"] as const,
-	contributes: {
-		grantMiddleware: [
-			({ rateLimiter }) => {
-				consumed = rateLimiter;
-				return null;
-			},
-		],
-	},
-});
-
-const handles: { dispose(): Promise<void> }[] = [];
-afterEach(async () => {
-	await Promise.all(handles.splice(0).map((handle) => handle.dispose()));
-	consumed = undefined;
-	windows.splice(0);
-});
-
-/** The shipped configuration for `environment`, booted with the limiter `adapter` selects. */
-async function shippedLimiter(
-	environment: string,
-	adapter: "memory" | "redis",
-): Promise<RateLimiter> {
-	const env = { ...SECRETS, ADAPTERS_RATE_LIMITER: adapter };
-	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, environment);
-	const own = readOwnLayers([envConfPath, applicationConfPath], { env });
-	const switches = readSwitches(own);
-	expect(switches.adapters.rateLimiter).toBe(adapter);
-	const limiterModule = adapter === "redis" ? redisRateLimiterModule : memoryRateLimiterModule;
-	const modules = [limiterModule, consumerModule];
-	const handle = await createApp({
-		modules,
-		bootstrapComponents: {
-			config: resolveForBoot(own, [...modules, loggingModule], switches),
-			pathResolver: (s: string) => s,
-			// Counts one request per key, the way an untouched Redis counter would.
-			rateLimiterClient: {
-				incrementWithTtl: async (_key: string, windowSeconds: number) => {
-					windows.push(windowSeconds);
-					return 1;
-				},
-			} as never,
-		},
-	});
-	handles.push(handle);
-	if (consumed === undefined) throw new Error("the boot handed no consumer the limiter");
-	return consumed;
-}
-
-describe("the MFA routes' budget the template ships", () => {
-	it.each([
-		["development", "memory"],
-		["development", "redis"],
-		["production", "memory"],
-		["production", "redis"],
-	] as const)("is 60 per 300 s under %s on the %s limiter", async (environment, adapter) => {
-		const limiter = await shippedLimiter(environment, adapter);
-		const before = Date.now();
-		const decision = await limiter.check("mfa:ip:203.0.113.7", { ip: "203.0.113.7" });
-		expect(decision.allowed).toBe(true);
-		expect(decision.limit).toBe(60);
-		const windowSeconds =
-			adapter === "redis"
-				? windows[0]
-				: Math.round(((decision.resetAt?.getTime() ?? 0) - before) / 1000);
-		expect(windowSeconds).toBe(300);
-	});
-});

package/templates/standalone/src/__tests__/mfa-switch.redis.test.mts

@@ -1,127 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The template's MFA switch under the name production, where the MFA stores
- * must be shared: both on Redis, as a production deployment selects them.
- * ioredis is a stand-in, as in `all-modules-composition.multi.test.mts`: it
- * answers `INFO memory` as a default server does, so the stores' eviction gate
- * passes, and their persistence check names what it could not read and goes
- * on. `packages/redis` runs the stores against a real server.
- */
-
-import { BootError } from "@o3co/auth-provider-core";
-import { MFA_DEVELOPMENT_SAMPLE_KEY } from "@o3co/auth-provider-mfa";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { type Composition, compose, SINGLE_ENV } from "./all-modules-composition.fixture.mjs";
-
-vi.mock("ioredis", () => {
-	// Constructible, quits cleanly, answers the readiness probe's `ping`;
-	// every other command resolves to nothing.
-	const explicit: Record<string, unknown> = {
-		on: () => undefined,
-		quit: async () => "OK",
-		disconnect: () => undefined,
-		ping: async () => "PONG",
-		// The Redis stores' eviction gate reads the policy from INFO memory: a
-		// default server's.
-		info: async (section: string) =>
-			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
-	};
-	const makeMockRedis = (): object =>
-		new Proxy(
-			{},
-			{
-				get(_target, prop) {
-					// A function-valued `then` would make the instance a thenable.
-					if (typeof prop !== "string" || prop === "then") return undefined;
-					if (prop === "duplicate") return makeMockRedis;
-					if (prop in explicit) return explicit[prop];
-					return async () => null;
-				},
-			},
-		);
-	function MockRedis(): object {
-		return makeMockRedis();
-	}
-	return { Redis: MockRedis, default: MockRedis };
-});
-
-let current: Composition | undefined;
-
-afterEach(async () => {
-	await current?.handle.dispose();
-	current = undefined;
-});
-
-/** MFA required in production, both MFA stores on Redis, a key of the deployment's own and an SMTP relay. */
-const PRODUCTION_ENV: Readonly<Record<string, string>> = {
-	...SINGLE_ENV,
-	MFA_MODE: "required",
-	ADAPTERS_MFA_FACTOR_STORE: "redis",
-	ADAPTERS_MFA_TRANSACTION_STORE: "redis",
-	REDIS_CLIENTS_URL: "redis://redis.test:6379",
-	MFA_ENCRYPTION_KEY: Buffer.alloc(32, 9).toString("base64"),
-	STANDARD_SMTP_MAIL_SENDER_HOST: "smtp.auth.test",
-	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
-};
-
-/** An error's message with every cause's under it. */
-const textOf = (err: unknown): string => {
-	const parts: string[] = [];
-	for (let at: unknown = err; at instanceof Error; at = at.cause) parts.push(at.message);
-	return parts.join(" <- ");
-};
-
-const refusal = (composing: Promise<Composition>): Promise<unknown> =>
-	composing.then(
-		(composition) => {
-			current = composition;
-			return undefined;
-		},
-		(caught: unknown) => caught,
-	);
-
-describe("MFA_MODE=required under the name production, the MFA stores on Redis", () => {
-	it("boots, the requirement registered as the second-factor authority", async () => {
-		current = await compose({ env: PRODUCTION_ENV, environment: "production" });
-		const names = current.modules.map((m) => m.name);
-		expect(names).toContain("redis-mfa-factor-store");
-		expect(names).toContain("redis-mfa-transaction-store");
-		expect(
-			current.handle.components.sessionRequirementResolver?.get("mfa")?.secondFactorAuthority,
-		).toBe(true);
-	});
-
-	it("refuses the development sample key, naming MFA_ENCRYPTION_KEY and quoting no key", async () => {
-		const err = await refusal(
-			compose({
-				env: { ...PRODUCTION_ENV, MFA_ENCRYPTION_KEY: MFA_DEVELOPMENT_SAMPLE_KEY },
-				environment: "production",
-			}),
-		);
-		expect(err).toBeInstanceOf(BootError);
-		expect(textOf(err)).toContain("MFA_ENCRYPTION_KEY");
-		expect(textOf(err)).not.toContain(MFA_DEVELOPMENT_SAMPLE_KEY);
-	});
-
-	it("refuses without an SMTP relay, naming STANDARD_SMTP_MAIL_SENDER_HOST", async () => {
-		const { STANDARD_SMTP_MAIL_SENDER_HOST: _host, ...env } = PRODUCTION_ENV;
-		const err = await refusal(compose({ env, environment: "production" }));
-		expect(err).toBeInstanceOf(BootError);
-		expect(textOf(err)).toContain("STANDARD_SMTP_MAIL_SENDER_HOST");
-	});
-});