@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/redis-rate-limiter-config-survives.test.mts

@@ -1,214 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Sections declared by a module rather than by core (`redis-rate-limiter`,
- * `mtls`) survive this template's real resolution chain, end to end.
- * Starting from the shipped configuration plus an operator's own layer, the
- * overrides are followed through both configuration phases and `createApp`
- * to the limiter the module builds. Were `redis-rate-limiter` lost, the
- * module's default of 60 requests / 60 s would apply to the deployment
- * `docker-compose.production.yml` ships (`ADAPTERS_RATE_LIMITER: redis`)
- * whatever the operator wrote.
- */
-
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import {
-	type AppConfig,
-	createApp,
-	defineModule,
-	type RateLimiter,
-} from "@o3co/auth-provider-core";
-import { redisRateLimiterModule } from "@o3co/auth-provider-redis";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { readOwnLayers, readSwitches, resolveConfigPaths, resolveForBoot } from "../configPath.mjs";
-import { loggingModule } from "../modules.mjs";
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-/**
- * The secrets `application.conf` substitutes, plus the one
- * `docker-compose.production.yml` sets to put the OAuth endpoints behind a
- * shared limiter. Test-only values; the entropy floor applies to the two
- * secrets, and the `.` characters keep them out of the base64 alphabet so the
- * UTF-8 length is what counts.
- */
-const ENV = {
-	KEY_STORE_LOCAL_SECRET: "test-secret-rate-limiter-e2e.at-least-32-bytes.ok",
-	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_STORE_SECRET: "test-session-secret-rate-limiter-e2e.at-least-32-bytes.ok",
-	ADAPTERS_RATE_LIMITER: "redis",
-	MFA_MODE: "off",
-};
-
-/**
- * What an operator adds to their own `application.conf` layer: per-endpoint
- * budgets for the Redis limiter, and the mTLS posture from
- * `@o3co/auth-provider-mtls`. Neither section appears in anything this
- * template ships.
- */
-const OPERATOR_OVERRIDES = `
-redis-rate-limiter {
-  limits {
-    token { limit = 120, windowSeconds = 60 }
-    authorize { limit = 30, windowSeconds = 60 }
-  }
-}
-
-mtls {
-  enabled = true
-  mode = "full-pki"
-  trustedCas = ["-----BEGIN CERTIFICATE-----"]
-  fullPki {
-    revocation {
-      mode = "crl"
-      onUnavailable = "reject"
-      allowedHosts = ["crl.example.com"]
-    }
-  }
-}
-`;
-
-/** The composition's own files: the operator's layer over the shipped production ones. */
-function ownFiles(): string[] {
-	const operator = join(mkdtempSync(join(tmpdir(), "redis-rate-limiter-")), "operator.conf");
-	writeFileSync(operator, OPERATOR_OVERRIDES);
-	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	return [operator, envConfPath, applicationConfPath];
-}
-
-/** Counts one request per key, the way an untouched Redis counter would. */
-function makeCountingClient(): { incrementWithTtl: (key: string, ttl: number) => Promise<number> } {
-	return { incrementWithTtl: async () => 1 };
-}
-
-/** The limiter a consumer of the slot is handed, as a route module would be. */
-let consumed: RateLimiter | undefined;
-const consumerModule = defineModule({
-	name: "test:rate-limiter-consumer",
-	requires: ["rateLimiter"] as const,
-	contributes: {
-		grantMiddleware: [
-			({ rateLimiter }) => {
-				consumed = rateLimiter;
-				return null;
-			},
-		],
-	},
-});
-
-/** The shipped configuration through both phases, booted with the Redis limiter's module. */
-async function bootShipped() {
-	const own = readOwnLayers(ownFiles(), { env: ENV });
-	const switches = readSwitches(own);
-	const modules = [redisRateLimiterModule, consumerModule];
-	return {
-		switches,
-		handle: await createApp({
-			modules,
-			bootstrapComponents: {
-				// The template's own reference too, which its application.conf is layered over.
-				config: resolveForBoot(own, [...modules, loggingModule], switches),
-				pathResolver: (s: string) => s,
-				rateLimiterClient: makeCountingClient() as never,
-			},
-		}),
-	};
-}
-
-let booted: Awaited<ReturnType<typeof bootShipped>>;
-let config: AppConfig;
-let limiter: RateLimiter;
-
-beforeAll(async () => {
-	booted = await bootShipped();
-	const parsed = booted.handle.components.config;
-	const built = consumed;
-	if (parsed === undefined || built === undefined) {
-		throw new Error("the boot filled no config, or handed no consumer the limiter");
-	}
-	config = parsed;
-	limiter = built;
-});
-
-afterAll(async () => {
-	await booted?.handle.dispose();
-});
-
-describe("the shipped configuration reaches the Redis rate limiter", () => {
-	it("selects the Redis adapter the production compose file pins, in phase one", () => {
-		expect(booted.switches.adapters.rateLimiter).toBe("redis");
-	});
-
-	it("carries the operator's per-endpoint budgets through boot's parse, merged with the template's", () => {
-		expect(
-			(config as unknown as Record<string, { limits?: unknown }>)["redis-rate-limiter"]?.limits,
-		).toEqual({
-			token: { limit: 120, windowSeconds: 60 },
-			authorize: { limit: 30, windowSeconds: 60 },
-			mfa: { limit: 60, windowSeconds: 300 },
-		});
-	});
-
-	it("keeps the MFA routes' budget the template ships beside the operator's", async () => {
-		const decision = await limiter.check("mfa:ip:203.0.113.5", { ip: "203.0.113.5" });
-		expect(decision.limit).toBe(60);
-	});
-
-	it("applies the declared budget at /token", async () => {
-		const decision = await limiter.check("token:ip:203.0.113.5", { ip: "203.0.113.5" });
-		expect(decision.limit).toBe(120);
-	});
-
-	it("applies the declared budget at /authorize", async () => {
-		const decision = await limiter.check("authorize:ip:203.0.113.5", { ip: "203.0.113.5" });
-		expect(decision.limit).toBe(30);
-	});
-
-	it("still falls back to the module's default where nothing is declared", async () => {
-		// 60 is what every endpoint would get were the section stripped, so the
-		// budgets above differ from it to tell a working configuration from a
-		// lost one.
-		const decision = await limiter.check("introspect:ip:203.0.113.5", { ip: "203.0.113.5" });
-		expect(decision.limit).toBe(60);
-	});
-
-	it("applies no login budget: session.rateLimit.login is the session module's own attempt limit, which no limiter applies", async () => {
-		expect(config.session).toMatchObject({ rateLimit: { login: { limit: 20 } } });
-		const decision = await limiter.check("login:ip:203.0.113.5", { ip: "203.0.113.5" });
-		expect(decision.limit).toBe(60);
-	});
-});
-
-describe("the shipped configuration carries an mTLS posture through", () => {
-	it("keeps the operator's mTLS block instead of reporting mTLS off", () => {
-		expect((config as unknown as { mtls?: unknown }).mtls).toEqual({
-			enabled: true,
-			mode: "full-pki",
-			trustedCas: ["-----BEGIN CERTIFICATE-----"],
-			fullPki: {
-				revocation: {
-					mode: "crl",
-					onUnavailable: "reject",
-					allowedHosts: ["crl.example.com"],
-				},
-			},
-		});
-	});
-});

package/templates/standalone/src/__tests__/redis-stand-in.fixture.mts

@@ -1,98 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * A TCP stand-in for a Redis server, for the tests that boot the template
- * against a socket and need no real server: it records what each connection
- * sends and answers only what boot needs — the handshake (`HELLO` refused, so
- * the client speaks RESP2), `INFO` reporting `maxmemory-policy noeviction`,
- * and `+OK` to anything else. It stores nothing and is not a Redis for data:
- * a test that reads or writes a store needs a real server.
- */
-
-import { once } from "node:events";
-import { type AddressInfo, createServer, type Socket } from "node:net";
-
-/** The first command `buffer` holds in full, as RESP sends it, and its length; `undefined` until it does. */
-function nextCommand(
-	buffer: string,
-): { readonly name: string; readonly length: number } | undefined {
-	const header = /^\*(\d+)\r\n/.exec(buffer);
-	if (header === null) return undefined;
-	let at = header[0].length;
-	const args: string[] = [];
-	for (let i = 0; i < Number(header[1]); i++) {
-		const bulk = /^\$(\d+)\r\n/.exec(buffer.slice(at));
-		if (bulk === null) return undefined;
-		const start = at + bulk[0].length;
-		const end = start + Number(bulk[1]);
-		if (buffer.length < end + 2) return undefined;
-		args.push(buffer.slice(start, end));
-		at = end + 2;
-	}
-	return { name: (args[0] ?? "").toLowerCase(), length: at };
-}
-
-/** What a server that runs `noeviction` and speaks RESP2 answers `name`. */
-function replyTo(name: string): string {
-	if (name === "hello") return "-NOPROTO unsupported protocol version\r\n";
-	if (name === "info") {
-		const info =
-			"# Memory\r\nmaxmemory_policy:noeviction\r\n# Persistence\r\naof_enabled:1\r\nloading:0\r\n";
-		return `$${Buffer.byteLength(info)}\r\n${info}\r\n`;
-	}
-	return "+OK\r\n";
-}
-
-/**
- * A TCP server standing in for Redis: it records what each connection sends,
- * and answers as a server running `noeviction` does — `HELLO` refused, so the
- * client speaks RESP2, `INFO` with the policy, anything else `OK` — so a
- * client dialled at it writes its handshake and the stores whose factories
- * read the policy build.
- */
-export async function listeningRedis(): Promise<{
-	readonly port: number;
-	readonly received: () => string;
-	readonly close: () => Promise<void>;
-}> {
-	const sockets = new Set<Socket>();
-	let received = "";
-	const server = createServer((socket) => {
-		sockets.add(socket);
-		let pending = "";
-		socket.on("close", () => sockets.delete(socket));
-		socket.on("data", (chunk) => {
-			received += chunk.toString("utf8");
-			pending += chunk.toString("utf8");
-			for (let command = nextCommand(pending); command; command = nextCommand(pending)) {
-				pending = pending.slice(command.length);
-				socket.write(replyTo(command.name));
-			}
-		});
-	});
-	server.listen(0, "127.0.0.1");
-	await once(server, "listening");
-	const { port } = server.address() as AddressInfo;
-	return {
-		port,
-		received: () => received,
-		close: async () => {
-			for (const socket of sockets) socket.destroy();
-			await new Promise<void>((resolve) => server.close(() => resolve()));
-		},
-	};
-}

package/templates/standalone/src/__tests__/refresh-token-family-client-module.test.mts

@@ -1,249 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-import type { LifecycleRegistrar } from "@o3co/auth-provider-core";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-// ioredis Redis constructor capture. The module under test imports
-// `Redis` from "ioredis"; vi.mock replaces that import so the test never
-// opens a real socket. Captured arguments verify that the validated config
-// reaches the constructor.
-const redisCtorCalls: Array<{ url: string; options: Record<string, unknown> | undefined }> = [];
-const quitSpies: Array<ReturnType<typeof vi.fn>> = [];
-const onSpies: Array<ReturnType<typeof vi.fn>> = [];
-
-vi.mock("ioredis", () => {
-	class MockRedis {
-		duplicate(): MockRedis {
-			return new MockRedis("redis://duplicate.local");
-		}
-		on = vi.fn();
-		quit = vi.fn(async () => "OK" as const);
-		ping = vi.fn(async () => "PONG" as const);
-		// Minimal command surface — `makeIoredisClients` only invokes these
-		// during construction in some paths; tests never exercise the wrapped
-		// client itself, so most stubs are unused.
-		set = vi.fn();
-		get = vi.fn();
-		pttl = vi.fn();
-		watch = vi.fn();
-		unwatch = vi.fn();
-		multi = vi.fn(() => ({
-			set: vi.fn().mockReturnThis(),
-			exec: vi.fn(async () => []),
-		}));
-
-		constructor(url: string, options?: Record<string, unknown>) {
-			redisCtorCalls.push({ url, options });
-			onSpies.push(this.on);
-			quitSpies.push(this.quit);
-		}
-	}
-	return { Redis: MockRedis, default: MockRedis };
-});
-
-// Imported AFTER vi.mock so the mocked ioredis is in scope.
-const importModule = async () =>
-	(await import("../modules.mjs")) as typeof import("../modules.mjs") & {
-		standaloneRedisClientsModule: import("@o3co/auth-provider-core").Module;
-	};
-
-/** The module's own section, `redis-clients`, as boot hands it over. */
-const baseSection = { url: "redis://example.com:6379", password: "test-pw" };
-
-describe("standaloneRedisClientsModule", () => {
-	beforeEach(() => {
-		redisCtorCalls.length = 0;
-		quitSpies.length = 0;
-		onSpies.length = 0;
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-	});
-
-	it("passes the operator's Redis URL and password from its section to the ioredis constructor", async () => {
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
-
-		expect(redisCtorCalls).toHaveLength(1);
-		expect(redisCtorCalls[0]?.url).toBe("redis://example.com:6379");
-		expect(redisCtorCalls[0]?.options?.password).toBe("test-pw");
-	});
-
-	it("registers io.quit() with lifecycleRegistrar when provided; drain calls quit exactly once", async () => {
-		const registered: Array<() => Promise<void>> = [];
-		const lifecycleRegistrar: LifecycleRegistrar = {
-			register: (cleanup) => {
-				registered.push(cleanup);
-			},
-		};
-
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-		await provides.refreshTokenFamilyClient({ section: { ...baseSection }, lifecycleRegistrar });
-
-		expect(registered).toHaveLength(1);
-		// Pre-drain: quit not yet called.
-		expect(quitSpies[0]).not.toHaveBeenCalled();
-
-		// Drain (simulate handle.dispose()).
-		await registered[0]?.();
-		expect(quitSpies[0]).toHaveBeenCalledTimes(1);
-	});
-
-	it("does not crash when lifecycleRegistrar is absent (graceful no-op, no quit registered)", async () => {
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-
-		// No lifecycleRegistrar key in deps — must not throw and must NOT
-		// register a cleanup (verified by the absence of any quit invocation
-		// after the factory resolves; the registrar branch is the only place
-		// `quit()` would be wired up in the no-real-shutdown unit-test path).
-		await expect(
-			provides.refreshTokenFamilyClient({ section: { ...baseSection } }),
-		).resolves.toBeDefined();
-		expect(quitSpies[0]).not.toHaveBeenCalled();
-	});
-
-	it("fails fast on an empty redis-clients.url (no silent localhost fallback)", async () => {
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-
-		// An operator who blanked the URL — must throw instead of silently
-		// falling back to redis://localhost:6379, which in production would
-		// leave each replica with refresh-token families the others cannot
-		// see. A section with no URL at all is refused by boot's parse of it.
-		await expect(provides.refreshTokenFamilyClient({ section: { url: "" } })).rejects.toThrow(
-			/redis-clients\.url/,
-		);
-		// And no ioredis instance was constructed because we threw before
-		// `new Redis(...)`.
-		expect(redisCtorCalls).toHaveLength(0);
-	});
-
-	it("attaches an error event handler to the ioredis client (prevents unhandled-error crash)", async () => {
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
-
-		expect(onSpies[0]).toHaveBeenCalledWith("error", expect.any(Function));
-	});
-
-	it("bounds every command and every connect attempt", async () => {
-		// Without these the driver's defaults apply: no command timeout at all,
-		// a 10s connect timeout, and 20 reconnect attempts before a queued
-		// command is failed. A partition therefore parks in-flight `/token`
-		// requests indefinitely instead of erroring, which is what stops the
-		// fail-closed rate-limit policy from ever shedding load.
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
-
-		const options = redisCtorCalls[0]?.options;
-		expect(options?.commandTimeout).toBe(1_000);
-		expect(options?.connectTimeout).toBe(5_000);
-		expect(options?.maxRetriesPerRequest).toBe(3);
-		// `lazyConnect: false` is the driver default, but it is declared in
-		// SHARED_REDIS_TIMEOUTS as a load-bearing decision (connect at boot,
-		// not at first command) — pin it so a future flip has to come here.
-		expect(options?.lazyConnect).toBe(false);
-	});
-
-	it("keeps the offline queue ON, explicitly, because one socket serves every purpose", async () => {
-		// `enableOfflineQueue` is a per-CONNECTION option and every adapter in
-		// this template draws from the single socket built below, so the
-		// "off for the rate limiter, on elsewhere" split is not expressible
-		// here. Asserting the explicit `true` rather than accepting the
-		// driver default is the point: the value is a decision (see the
-		// comment in `getOrCreateClients`), and a future change that wants
-		// `false` has to come through this test.
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-		await provides.refreshTokenFamilyClient({ section: { ...baseSection } });
-
-		expect(redisCtorCalls[0]?.options?.enableOfflineQueue).toBe(true);
-	});
-
-	it("requires no configuration, and takes both registrars as optional", async () => {
-		const { standaloneRedisClientsModule } = await importModule();
-		const m = standaloneRedisClientsModule as {
-			requires?: readonly string[];
-			optional?: readonly string[];
-		};
-		expect(m.requires ?? []).not.toContain("config");
-		expect(m.optional).toContain("lifecycleRegistrar");
-		expect(m.optional).toContain("readinessRegistrar");
-	});
-
-	it("registers one readiness probe for the shared connection, not one per slot", async () => {
-		// Every Redis-backed adapter draws from a single socket, so a probe per
-		// consumed slot would report the same connection six times.
-		const probes: Array<{ name: string; check: () => Promise<unknown> }> = [];
-		const readinessRegistrar = { register: (p: (typeof probes)[number]) => probes.push(p) };
-
-		const { standaloneRedisClientsModule } = await importModule();
-		const provides = (
-			standaloneRedisClientsModule as unknown as {
-				provides: Record<string, (deps: Record<string, unknown>) => Promise<unknown>>;
-			}
-		).provides;
-		const lifecycleRegistrar: LifecycleRegistrar = { register: () => {} };
-
-		await provides.refreshTokenFamilyClient({
-			section: { ...baseSection },
-			lifecycleRegistrar,
-			readinessRegistrar,
-		});
-		await provides.rateLimiterClient({
-			section: { ...baseSection },
-			lifecycleRegistrar,
-			readinessRegistrar,
-		});
-
-		expect(redisCtorCalls).toHaveLength(1);
-		expect(probes.map((p) => p.name)).toEqual(["redis"]);
-		await expect(probes[0]?.check()).resolves.toBe("PONG");
-	});
-});