@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/post-logout-redirect.test.mts

@@ -1,183 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * A logout's `post_logout_redirect_uri` reaches the upstream federation's
- * end-session call only once it has matched one of the client's registered
- * `postLogoutRedirectUris` — at `/oauth/logout` and at
- * `POST /oauth/federation/:name/logout` alike.
- *
- * Google publishes no end-session endpoint, and without one configured its
- * adapter sends the browser straight to the `postLogoutRedirectUri` it is
- * handed: unchecked, a caller's own fresh id_token would make this provider's
- * origin answer `303` to any site. With an end-session endpoint configured,
- * an unchecked value would be forwarded to the upstream instead. The real
- * Google adapter is composed (`google-session.fixture.mts`), so the redirect
- * asserted is the one a browser would follow.
- */
-
-import type express from "express";
-import request from "supertest";
-import { afterEach, describe, expect, it } from "vitest";
-import {
-	type GoogleSession,
-	type GoogleWiring,
-	idTokenHint,
-	REGISTERED_POST_LOGOUT_REDIRECT_URI as REGISTERED,
-	signInLinkedToGoogle,
-} from "./google-session.fixture.mjs";
-
-const UNREGISTERED = "https://evil.example/landing";
-const GOOGLE_LOGOUT = "https://accounts.google.com/Logout";
-const UPSTREAM_END_SESSION = "https://idp-logout.example/end-session";
-const UPSTREAM_ID_TOKEN = "upstream-id-token";
-
-/** Google's end-session endpoint, where a deployment names one. */
-const WITH_END_SESSION: GoogleWiring = { endSessionEndpoint: UPSTREAM_END_SESSION };
-
-describe("a logout's post_logout_redirect_uri reaches the upstream only once it is registered", () => {
-	let session: GoogleSession | undefined;
-
-	afterEach(async () => {
-		await session?.dispose();
-		session = undefined;
-	});
-
-	/** Alice signed in, with Google linked and its id_token held for the end-session call. */
-	async function signedInWithGoogle(google: GoogleWiring): Promise<GoogleSession> {
-		session = await signInLinkedToGoogle({
-			google,
-			tokens: {
-				accessToken: "upstream-access-token",
-				expiresAt: null,
-				refreshToken: undefined,
-				idToken: UPSTREAM_ID_TOKEN,
-				tokenType: "Bearer",
-				scope: undefined,
-				grantedScope: undefined,
-				obtainedAt: undefined,
-			},
-		});
-		return session;
-	}
-
-	const rpLogout = (app: express.Express, sid: string, postLogoutRedirectUri: string) =>
-		request(app)
-			.get("/oauth/logout")
-			.query({
-				id_token_hint: idTokenHint(sid),
-				post_logout_redirect_uri: postLogoutRedirectUri,
-				state: "s-1",
-			});
-
-	const federationLogout = (
-		app: express.Express,
-		accessToken: string,
-		postLogoutRedirectUri: string,
-	) =>
-		request(app)
-			.post("/oauth/federation/google/logout")
-			.set("Authorization", `Bearer ${accessToken}`)
-			.type("form")
-			.send({ post_logout_redirect_uri: postLogoutRedirectUri, state: "s-1" });
-
-	describe("GET /oauth/logout, Google with no end-session endpoint", () => {
-		it("does not send the browser to an unregistered post_logout_redirect_uri", async () => {
-			const { app, sid, userSessionStore } = await signedInWithGoogle("shipped");
-
-			const res = await rpLogout(app, sid, UNREGISTERED);
-
-			expect(res.status).toBe(303);
-			expect(new URL(res.headers.location as string).origin).not.toBe("https://evil.example");
-			// Google's own logout page: the adapter's answer when it is handed no
-			// redirect target, which is what an unregistered one becomes.
-			expect(res.headers.location).toBe(`${GOOGLE_LOGOUT}?state=s-1`);
-			// The logout itself still happened.
-			expect(await userSessionStore.get(sid)).toBeNull();
-		});
-
-		it("still returns the browser to a registered post_logout_redirect_uri, with state", async () => {
-			const { app, sid, userSessionStore } = await signedInWithGoogle("shipped");
-
-			const res = await rpLogout(app, sid, REGISTERED);
-
-			expect(res.status).toBe(303);
-			expect(res.headers.location).toBe(`${REGISTERED}?state=s-1`);
-			expect(await userSessionStore.get(sid)).toBeNull();
-		});
-	});
-
-	describe("GET /oauth/logout, Google with a configured end-session endpoint", () => {
-		it("does not forward an unregistered post_logout_redirect_uri to the upstream", async () => {
-			const { app, sid } = await signedInWithGoogle(WITH_END_SESSION);
-
-			const res = await rpLogout(app, sid, UNREGISTERED);
-
-			expect(res.status).toBe(303);
-			const location = new URL(res.headers.location as string);
-			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
-			expect(location.searchParams.get("id_token_hint")).toBe(UPSTREAM_ID_TOKEN);
-			expect(location.searchParams.has("post_logout_redirect_uri")).toBe(false);
-			expect(res.headers.location).not.toContain("evil.example");
-		});
-
-		it("forwards a registered one", async () => {
-			const { app, sid } = await signedInWithGoogle(WITH_END_SESSION);
-
-			const res = await rpLogout(app, sid, REGISTERED);
-
-			expect(res.status).toBe(303);
-			const location = new URL(res.headers.location as string);
-			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
-			expect(location.searchParams.get("post_logout_redirect_uri")).toBe(REGISTERED);
-			expect(location.searchParams.get("state")).toBe("s-1");
-		});
-	});
-
-	describe("POST /oauth/federation/google/logout", () => {
-		it("does not send the browser to an unregistered post_logout_redirect_uri", async () => {
-			const { app, sid, accessToken, federationTokenStore } = await signedInWithGoogle("shipped");
-
-			const res = await federationLogout(app, accessToken, UNREGISTERED);
-
-			expect(res.status).toBe(303);
-			expect(new URL(res.headers.location as string).origin).not.toBe("https://evil.example");
-			expect(res.headers.location).toBe(`${GOOGLE_LOGOUT}?state=s-1`);
-			// The federation was disconnected all the same: its tokens are gone.
-			expect(await federationTokenStore.get(sid, "google")).toBeNull();
-		});
-
-		it("still returns the browser to one registered for the token's client", async () => {
-			const { app, accessToken } = await signedInWithGoogle("shipped");
-
-			const res = await federationLogout(app, accessToken, REGISTERED);
-
-			expect(res.status).toBe(303);
-			expect(res.headers.location).toBe(`${REGISTERED}?state=s-1`);
-		});
-
-		it("does not forward an unregistered one to a configured end-session endpoint", async () => {
-			const { app, accessToken } = await signedInWithGoogle(WITH_END_SESSION);
-
-			const res = await federationLogout(app, accessToken, UNREGISTERED);
-
-			expect(res.status).toBe(303);
-			const location = new URL(res.headers.location as string);
-			expect(`${location.origin}${location.pathname}`).toBe(UPSTREAM_END_SESSION);
-			expect(location.searchParams.has("post_logout_redirect_uri")).toBe(false);
-		});
-	});
-});

package/templates/standalone/src/__tests__/redis-assume-noeviction.test.mts

@@ -1,283 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * `redis-clients.assumeNoEviction` (`REDIS_CLIENTS_ASSUME_NO_EVICTION`), on a
- * Redis that will not report its eviction policy: every store on Redis, as a
- * multi-replica deployment selects them. ioredis is a stand-in that refuses
- * `INFO` and `CONFIG` as an ACL-restricted user's connection does; every
- * other command resolves to nothing. node-redis and connect-redis, behind
- * express-session's store, are stand-ins too, as in
- * `all-modules-composition.multi.test.mts`.
- */
-
-import { BootError } from "@o3co/auth-provider-core";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import {
-	type Composition,
-	compose,
-	MULTI_ENV,
-	SINGLE_ENV,
-} from "./all-modules-composition.fixture.mjs";
-
-vi.mock("redis", () => ({
-	createClient: vi.fn(() => ({
-		connect: vi.fn().mockResolvedValue(undefined),
-		quit: vi.fn().mockResolvedValue(undefined),
-		ping: vi.fn().mockResolvedValue("PONG"),
-		on: vi.fn(),
-	})),
-}));
-
-vi.mock("connect-redis", async () => {
-	const { EventEmitter } = await import("node:events");
-	// express-session subscribes to store events, so the stand-in is an emitter.
-	return {
-		RedisStore: class MockRedisStore extends EventEmitter {
-			get(): unknown {
-				return undefined;
-			}
-			set(): void {}
-			destroy(): void {}
-		},
-	};
-});
-
-vi.mock("ioredis", () => {
-	const refused = async (): Promise<never> => {
-		throw Object.assign(new Error("NOPERM this user has no permissions to run this command"), {
-			name: "ReplyError",
-		});
-	};
-	const explicit: Record<string, unknown> = {
-		on: () => undefined,
-		quit: async () => "OK",
-		disconnect: () => undefined,
-		ping: async () => "PONG",
-		info: refused,
-		config: refused,
-	};
-	const makeMockRedis = (): object =>
-		new Proxy(
-			{},
-			{
-				get(_target, prop) {
-					// A function-valued `then` would make the instance a thenable.
-					if (typeof prop !== "string" || prop === "then") return undefined;
-					if (prop === "duplicate") return makeMockRedis;
-					if (prop in explicit) return explicit[prop];
-					return async () => null;
-				},
-			},
-		);
-	function MockRedis(): object {
-		return makeMockRedis();
-	}
-	return { Redis: MockRedis, default: MockRedis };
-});
-
-let current: Composition | undefined;
-
-afterEach(async () => {
-	await current?.handle.dispose();
-	current = undefined;
-});
-
-/** MFA required, both MFA stores on Redis, a key of the deployment's own and an SMTP relay. */
-const MFA_ON_REDIS: Readonly<Record<string, string>> = {
-	MFA_MODE: "required",
-	ADAPTERS_MFA_FACTOR_STORE: "redis",
-	ADAPTERS_MFA_TRANSACTION_STORE: "redis",
-	REDIS_CLIENTS_URL: "redis://redis.test:6379",
-	MFA_ENCRYPTION_KEY: Buffer.alloc(32, 9).toString("base64"),
-	STANDARD_SMTP_MAIL_SENDER_HOST: "smtp.auth.test",
-	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
-};
-
-const composing = (
-	env: Readonly<Record<string, string>>,
-	shippedRefreshTokenFamilyStore = true,
-): Promise<unknown> =>
-	compose({ env, environment: "production", shippedRefreshTokenFamilyStore }).then(
-		(composition) => {
-			current = composition;
-			return undefined;
-		},
-		(caught: unknown) => caught,
-	);
-
-describe("a Redis that will not report its eviction policy", () => {
-	it.each([
-		["unset", MULTI_ENV],
-		["false", { ...MULTI_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
-	])(
-		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
-		async (_label, env) => {
-			const err = await composing(env);
-			expect(err).toBeInstanceOf(BootError);
-			expect(err).toMatchObject({
-				reason: "provides-factory-failed",
-				cause: { name: "RedisStoreEvictableError", maxmemoryPolicy: undefined },
-			});
-		},
-	);
-
-	it("boots every store with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
-		expect(
-			await composing({ ...MULTI_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
-		).toBeUndefined();
-		expect(current?.modules.map((module) => module.name)).toEqual(
-			expect.arrayContaining([
-				"redis-attempt-counter",
-				"redis-session-stores",
-				"redis-federation-token-store",
-			]),
-		);
-	});
-
-	it("boots with redis-clients.assumeNoEviction = true written in HOCON", async () => {
-		const composition = await compose({
-			env: MULTI_ENV,
-			environment: "production",
-			shippedRefreshTokenFamilyStore: true,
-			operatorHocon: "redis-clients.assumeNoEviction = true\n",
-		});
-		current = composition;
-		expect(composition.handle).toBeDefined();
-	});
-});
-
-describe("the shipped refresh-token family store on a Redis that will not report its eviction policy", () => {
-	it.each([
-		["unset", SINGLE_ENV],
-		["false", { ...SINGLE_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
-	])(
-		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
-		async (_label, env) => {
-			expect(await composing(env)).toMatchObject({
-				reason: "provides-factory-failed",
-				details: {
-					module: "redis-refresh-token-family-store",
-					componentKey: "refreshTokenFamilyStore",
-				},
-				cause: {
-					name: "RedisStoreEvictableError",
-					reason: "refresh-token-family-store-evictable",
-					maxmemoryPolicy: undefined,
-				},
-			});
-		},
-	);
-
-	it("boots with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
-		expect(
-			await composing({ ...SINGLE_ENV, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
-		).toBeUndefined();
-		expect(current?.handle.components.refreshTokenFamilyStore?.kind).toBe("redis");
-	});
-});
-
-describe("the replay seen-set on a Redis that will not report its eviction policy", () => {
-	/** Only the seen-set on Redis: a refusal can come from no other store. */
-	const REPLAY_ONLY = {
-		...SINGLE_ENV,
-		ADAPTERS_REPLAY_SEEN_SET: "redis",
-		REDIS_CLIENTS_URL: "redis://redis.test:6379",
-	};
-	const composingReplayOnly = (env: Readonly<Record<string, string>>) => composing(env, false);
-
-	it.each([
-		["unset", REPLAY_ONLY],
-		["false", { ...REPLAY_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
-	])(
-		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming the store",
-		async (_label, env) => {
-			expect(await composingReplayOnly(env)).toMatchObject({
-				reason: "provides-factory-failed",
-				details: { module: "redis-replay-seen-set", componentKey: "replaySeenSet" },
-				cause: {
-					name: "RedisStoreEvictableError",
-					reason: "replay-seen-set-evictable",
-					maxmemoryPolicy: undefined,
-				},
-			});
-		},
-	);
-
-	it("boots with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
-		expect(
-			await composingReplayOnly({ ...REPLAY_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
-		).toBeUndefined();
-		expect(current?.handle.components.replaySeenSet?.kind).toBe("redis");
-	});
-});
-
-describe("the MFA stores on a Redis that will not report its eviction policy", () => {
-	/** Only the MFA stores on Redis: a refusal can come from no other store. */
-	const MFA_ONLY = { ...SINGLE_ENV, ...MFA_ON_REDIS };
-	const composingMfaOnly = (env: Readonly<Record<string, string>>) => composing(env, false);
-
-	it.each([
-		["unset", MFA_ONLY],
-		["false", { ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
-	])(
-		"refuses the boot with REDIS_CLIENTS_ASSUME_NO_EVICTION %s, naming an MFA store",
-		async (_label, env) => {
-			const err = await composingMfaOnly(env);
-			expect(err).toBeInstanceOf(BootError);
-			expect(err).toMatchObject({
-				reason: "provides-factory-failed",
-				cause: {
-					name: "RedisStoreEvictableError",
-					reason: expect.stringMatching(/^mfa-(factor|transaction)-store-evictable$/),
-					maxmemoryPolicy: undefined,
-				},
-			});
-		},
-	);
-
-	it("boots both MFA stores with REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
-		expect(
-			await composingMfaOnly({ ...MFA_ONLY, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
-		).toBeUndefined();
-		expect(current?.modules.map((module) => module.name)).toEqual(
-			expect.arrayContaining(["redis-mfa-factor-store", "redis-mfa-transaction-store"]),
-		);
-		expect(current?.handle.components.mfaFactorStore?.kind).toBe("redis");
-		expect(current?.handle.components.mfaTransactionStore?.kind).toBe("redis");
-	});
-
-	it.each([
-		["unset", { ...MULTI_ENV, ...MFA_ON_REDIS }],
-		["false", { ...MULTI_ENV, ...MFA_ON_REDIS, REDIS_CLIENTS_ASSUME_NO_EVICTION: "false" }],
-	])(
-		"refuses every store on Redis with MFA on, REDIS_CLIENTS_ASSUME_NO_EVICTION %s",
-		async (_label, env) => {
-			expect(await composing(env)).toMatchObject({
-				reason: "provides-factory-failed",
-				cause: { name: "RedisStoreEvictableError", maxmemoryPolicy: undefined },
-			});
-		},
-	);
-
-	it("boots every store on Redis with MFA on and REDIS_CLIENTS_ASSUME_NO_EVICTION=true", async () => {
-		expect(
-			await composing({ ...MULTI_ENV, ...MFA_ON_REDIS, REDIS_CLIENTS_ASSUME_NO_EVICTION: "true" }),
-		).toBeUndefined();
-		expect(current?.handle.components.mfaFactorStore?.kind).toBe("redis");
-		expect(current?.handle.components.mfaTransactionStore?.kind).toBe("redis");
-	});
-});

package/templates/standalone/src/__tests__/redis-connection-error-log.test.mts

@@ -1,135 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * What the template's shared Redis connection logs when the server refuses
- * it: the real ioredis the template ships, against a TCP server that answers
- * the way Redis answers a password it no longer accepts. ioredis puts the
- * handshake it sent — `AUTH` and the password — on the error it emits, so
- * the `error` listener must log core's `loggableError` projection, never
- * the error. The logger here serialises every own property of what it is
- * handed, as a deployment's logger may.
- */
-
-import { once } from "node:events";
-import { type AddressInfo, createServer, type Socket } from "node:net";
-import type { LifecycleRegistrar, Logger } from "@o3co/auth-provider-core";
-import { describe, expect, it, vi } from "vitest";
-import { standaloneRedisClientsModule } from "#/modules.mjs";
-
-/** Redis's reply to a handshake whose password it does not accept. */
-const WRONGPASS = "-WRONGPASS invalid username-password pair or user is disabled.\r\n";
-
-/** The password the deployment is configured with, and the server no longer takes. */
-const STALE_PASSWORD = "stale-s3cret-redis-password";
-
-/** A TCP server that answers everything sent to it as Redis answers a refused password. */
-async function refusingRedis(): Promise<{ port: number; close: () => Promise<void> }> {
-	const sockets = new Set<Socket>();
-	const server = createServer((socket) => {
-		sockets.add(socket);
-		socket.on("close", () => sockets.delete(socket));
-		socket.on("data", () => {
-			socket.write(WRONGPASS);
-		});
-	});
-	server.listen(0, "127.0.0.1");
-	await once(server, "listening");
-	const { port } = server.address() as AddressInfo;
-	return {
-		port,
-		close: async () => {
-			for (const socket of sockets) socket.destroy();
-			await new Promise<void>((resolve) => server.close(() => resolve()));
-		},
-	};
-}
-
-/**
- * A logger that serialises every own property of what it is handed, `cause`
- * and non-enumerable fields included. `lines` is what it wrote; its levels
- * are spies.
- */
-const serialiseEverythingLogger = () => {
-	const lines: string[] = [];
-	const walk = (value: unknown, seen = new WeakSet<object>()): unknown => {
-		if (typeof value !== "object" || value === null) return value;
-		if (seen.has(value)) return "[circular]";
-		seen.add(value);
-		const out: Record<string, unknown> = {};
-		for (const key of Object.getOwnPropertyNames(value)) {
-			out[key] = walk((value as Record<string, unknown>)[key], seen);
-		}
-		return out;
-	};
-	const record = (level: string) =>
-		vi.fn((...args: unknown[]): void => {
-			lines.push(JSON.stringify({ level, args: walk(args) }));
-		});
-	const logger = {
-		trace: record("trace"),
-		debug: record("debug"),
-		info: record("info"),
-		warn: record("warn"),
-		error: record("error"),
-		fatal: record("fatal"),
-		child: () => logger,
-	};
-	return { logger: logger as typeof logger & Logger, lines };
-};
-
-describe("standaloneRedisClientsModule: the shared connection refused by the server", () => {
-	it("logs the connection's error as loggableError's projection, never the AUTH arguments ioredis puts on it", async () => {
-		const redis = await refusingRedis();
-		const cleanups: Array<() => Promise<void>> = [];
-		const lifecycleRegistrar: LifecycleRegistrar = {
-			register: (cleanup) => {
-				cleanups.push(cleanup);
-			},
-		};
-		const { logger, lines } = serialiseEverythingLogger();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-		try {
-			await provides.refreshTokenFamilyClient({
-				section: { url: `redis://127.0.0.1:${redis.port}`, password: STALE_PASSWORD },
-				lifecycleRegistrar,
-				logger,
-			});
-			await vi.waitFor(() => expect(logger.error).toHaveBeenCalled(), { timeout: 10_000 });
-		} finally {
-			// `io.quit()`, as `handle.dispose()` runs it.
-			await Promise.all(cleanups.map((cleanup) => cleanup().catch(() => {})));
-			await redis.close();
-		}
-
-		expect(logger.error).toHaveBeenCalledWith(
-			{
-				err: expect.objectContaining({
-					name: "ReplyError",
-					detail: expect.stringMatching(/^WRONGPASS /),
-					// Which command the server refused, and nothing it carried.
-					command: { name: "hello" },
-				}),
-			},
-			"standalone_redis_clients_error",
-		);
-		for (const line of lines) expect(line).not.toContain(STALE_PASSWORD);
-	});
-});