@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/session-lifecycle.test.mts

@@ -1,213 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The template composes core's session lifecycle module: it serves relying
- * parties, so boot holds it to a session-close notifier, which the oauth
- * module contributes.
- */
-
-import {
-	type FederationTokenStore,
-	readVersionedSessionLifecycle,
-	type SessionLifecycle,
-	type SessionLifecycleStore,
-	type SubjectSessionIndex,
-	type UserSessionStore,
-} from "@o3co/auth-provider-core";
-import request from "supertest";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import {
-	ALICE,
-	basic,
-	compose,
-	cookiesOf,
-	federatedCallback,
-	ISSUER,
-	login,
-	WEB,
-	webTokens,
-} from "./all-modules-composition.fixture.mjs";
-import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
-
-afterEach(() => {
-	vi.restoreAllMocks();
-});
-
-/** A JWT's claims, unverified. */
-const claimsOf = (token: string): Record<string, unknown> =>
-	JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
-
-describe("the template, which composes the session lifecycle module", () => {
-	it("boots, the oauth module's notifier contributed", async () => {
-		const { handle } = await compose();
-		try {
-			const lifecycle = handle.components.sessionLifecycle as SessionLifecycle | undefined;
-			expect(lifecycle).toBeDefined();
-			expect(handle.components.sessionCloseNotifierResolver?.get()).toBeDefined();
-			expect(await lifecycle?.close("no-such-session", "expiry")).toEqual({
-				outcome: "done",
-				rps: [],
-				federations: [],
-			});
-		} finally {
-			await handle.dispose();
-		}
-	});
-
-	it("tells a relying party that joined, through the oauth module's notifier, when the session closes", async () => {
-		const peer = await backchannelPeer();
-		const { handle } = await compose({
-			config: withLoopbackRelyingParties,
-			extraClients: {
-				"rp-bc": {
-					tokenEndpointAuthMethod: "client_secret_basic",
-					clientSecret: "rp-bc-secret-long-enough",
-					allowedRedirectUris: ["https://rp-bc.test/cb"],
-					allowedScopes: ["openid"],
-					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: peer.uri,
-				},
-			},
-		});
-		try {
-			const components = handle.components as Record<string, unknown>;
-			const lifecycle = components.sessionLifecycle as SessionLifecycle;
-			const sessions = components.userSessionStore as UserSessionStore;
-			const expiresAt = new Date(Date.now() + 3_600_000);
-			await sessions.create({
-				sid: "sid-bc",
-				sub: "u-bc",
-				authTime: new Date(),
-				expiresAt,
-				claims: {},
-				amr: ["pwd"],
-				authentication: undefined,
-			});
-			expect(await lifecycle.open("sid-bc", { sub: "u-bc", expiresAt })).toEqual({
-				outcome: "opened",
-			});
-			const rp = {
-				clientId: "rp-bc",
-				backchannelLogoutUri: peer.uri,
-				backchannelLogoutSessionRequired: true,
-				frontchannelLogoutUri: undefined,
-				frontchannelLogoutSessionRequired: undefined,
-				registeredAt: new Date(),
-			};
-			expect(await lifecycle.join("sid-bc", { rp, familyId: "family-bc" })).toEqual({
-				outcome: "joined",
-			});
-			expect((await lifecycle.close("sid-bc", "rp_logout")).outcome).toBe("done");
-			expect(peer.tokens).toHaveLength(1);
-			expect(claimsOf(peer.tokens[0] ?? "")).toMatchObject({
-				iss: ISSUER,
-				aud: "rp-bc",
-				sub: "u-bc",
-				sid: "sid-bc",
-			});
-		} finally {
-			await handle.dispose();
-			await peer.close();
-		}
-	});
-
-	it("opens a password login's session in the lifecycle, active with nothing joined yet", async () => {
-		const { app, handle } = await compose();
-		try {
-			expect((await login(app)).res.status).toBe(200);
-			const components = handle.components as Record<string, unknown>;
-			const [sid] = await (components.subjectSessionIndex as SubjectSessionIndex).listSids(
-				ALICE.sub,
-			);
-			const store = components.sessionLifecycleStore as SessionLifecycleStore;
-			const record = readVersionedSessionLifecycle(await store.read(String(sid)));
-			expect(record?.value).toMatchObject({ sub: ALICE.sub, state: "active", participants: [] });
-		} finally {
-			await handle.dispose();
-		}
-	});
-
-	it("joins a federated login's federation to the session's lifecycle record, beside its tokens, through the session module's federation routes", async () => {
-		const { app, handle, upstreams } = await compose();
-		try {
-			const callback = await (await federatedCallback(app, "oidc", upstreams.oidc))();
-			expect(callback.status).toBe(302);
-			expect(cookiesOf(callback)).not.toEqual([]);
-			const components = handle.components as Record<string, unknown>;
-			const [sid] = await (components.subjectSessionIndex as SubjectSessionIndex).listSids(
-				ALICE.sub,
-			);
-			const store = components.sessionLifecycleStore as SessionLifecycleStore;
-			const record = readVersionedSessionLifecycle(await store.read(String(sid)));
-			expect(record?.value).toMatchObject({ sub: ALICE.sub, state: "active" });
-			expect(record?.value.participants.map((p) => `${p.kind}:${p.id}`)).toEqual([
-				"federation:oidc",
-			]);
-			const tokens = components.federationTokenStore as FederationTokenStore;
-			expect(await tokens.get(String(sid), "oidc")).not.toBeNull();
-		} finally {
-			await handle.dispose();
-		}
-	});
-
-	it("joins a code exchange's relying party and family to the session's lifecycle record", async () => {
-		const { app, handle } = await compose();
-		try {
-			const tokens = await webTokens(app);
-			const claims = claimsOf(tokens.refresh_token ?? "");
-			const sid = String(claims.sid);
-			const store = (handle.components as Record<string, unknown>)
-				.sessionLifecycleStore as SessionLifecycleStore;
-			const record = readVersionedSessionLifecycle(await store.read(sid));
-			expect(record?.value.state).toBe("active");
-			expect(record?.value.participants.map((p) => `${p.kind}:${p.id}`)).toEqual([
-				`rp:${WEB.id}`,
-				`family:${String(claims.family_id)}`,
-			]);
-		} finally {
-			await handle.dispose();
-		}
-	});
-
-	it("closes the session through the lifecycle at /oauth/logout: the record closed, the session and its refresh token gone", async () => {
-		const { app, handle } = await compose();
-		try {
-			const tokens = await webTokens(app);
-			const sid = String(claimsOf(tokens.refresh_token ?? "").sid);
-			const components = handle.components as Record<string, unknown>;
-
-			const res = await request(app)
-				.post("/oauth/logout")
-				.type("form")
-				.send({ id_token_hint: tokens.id_token });
-
-			expect(res.status).toBe(200);
-			expect(res.body).toEqual({ logged_out: true });
-			const store = components.sessionLifecycleStore as SessionLifecycleStore;
-			expect(readVersionedSessionLifecycle(await store.read(sid))?.value.state).toBe("closed");
-			expect(await (components.userSessionStore as UserSessionStore).get(sid)).toBeNull();
-			const refreshed = await request(app)
-				.post("/oauth/token")
-				.set("Authorization", basic(WEB))
-				.type("form")
-				.send({ grant_type: "refresh_token", refresh_token: tokens.refresh_token });
-			expect(refreshed.status).toBe(400);
-		} finally {
-			await handle.dispose();
-		}
-	});
-});

package/templates/standalone/src/__tests__/session-logout-invalidates-token.test.mts

@@ -1,305 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * `POST /session/logout` must invalidate the token the `session` grant minted
- * from the same browser session.
- *
- * Neither package can assert this alone: the logout endpoint is in
- * `@o3co/auth-provider-session`, introspection and userinfo are in
- * `@o3co/auth-provider-oauth`, and the two are siblings that may not import
- * each other. This template is the composition root that mounts both.
- *
- * The `session` grant stamps `sid` on its access token, and `/oauth/introspect`
- * and `/oauth/userinfo` both check that the `UserSession` it names is alive.
- * In the BFF / `auth.proxy` injection topology, whose logout IS this endpoint,
- * a logout that destroyed only the cookie would leave the token live at both
- * for its full lifetime.
- */
-
-import { generateKeyPairSync } from "node:crypto";
-import {
-	type AppConfig,
-	createApp,
-	createKeyStoreFactory,
-	createReadinessRouter,
-	defineModule,
-	InMemoryClientRepository,
-	InMemoryUserRepository,
-	memoryRefreshTokenFamilyStoreModule,
-	registerBuiltinKeyStores,
-} from "@o3co/auth-provider-core";
-import { coreConfigForTests } from "@o3co/auth-provider-core/testing";
-import express from "express";
-import request from "supertest";
-import { afterEach, describe, expect, it } from "vitest";
-import { buildModules } from "../buildModules.mjs";
-import type { Switches } from "../configPath.mjs";
-import { keyStoreSectionSchema } from "../sections.mjs";
-import { capturedRenames, inProcessAdapters } from "./library-references.fixture.mjs";
-
-const keyPair = generateKeyPairSync("ed25519", {
-	publicKeyEncoding: { type: "spki", format: "pem" },
-	privateKeyEncoding: { type: "pkcs8", format: "pem" },
-});
-
-const CLIENT_ID = "bff-client";
-const CLIENT_SECRET = "bff-secret";
-const BASIC = `Basic ${Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64")}`;
-const USERNAME = "alice";
-const PASSWORD = "correct-horse-battery-staple";
-
-/** The `http` module's section, as the hand-built configuration below carries it. */
-const HTTP = {
-	port: 0,
-	trustProxy: false,
-	readinessTimeoutMs: 1000,
-	cors: { allowedOrigins: [] as string[] },
-};
-
-/** The template modules' sections sit beside core's, so the configuration is wider than `AppConfig`. */
-const config: AppConfig & Record<string, unknown> = {
-	// What a resolution under an environment that sets none captures of
-	// core's renamed variables.
-	...{
-		"renamed-variables": capturedRenames({}),
-	},
-	http: HTTP,
-	logging: { level: "silent" },
-	"key-store": {
-		provider: "local",
-		local: {
-			algorithm: "EdDSA",
-			kid: "v0",
-			privateKey: keyPair.privateKey,
-			publicKey: keyPair.publicKey,
-			previousKeys: [],
-		},
-	},
-	// The session requirements this composition expects, as the shipped
-	// `application.conf` does (ADR 2026-09-28-session-admission): none.
-	...coreConfigForTests({ federations: { google: { enabled: false, type: "google" } } }),
-	oauth: {
-		jwt: {
-			issuer: "https://auth.test",
-		},
-		accessToken: { defaultExpiresIn: 3600 },
-		refreshToken: { expiresIn: 86400 },
-		oidcMode: "oidc-required",
-	},
-	// The grant this whole test is about: it mints straight from an
-	// authenticated browser session, which is the BFF topology.
-	"oauth-session": { enabled: true },
-	"session-store": {
-		secret: "test-session-secret.at-least-32-bytes.ok",
-		name: "auth.sid",
-		maxAge: 3600000,
-		secure: false,
-		sameSite: "lax",
-		domain: null,
-		storage: { type: "memory", redis: { url: "redis://localhost:6379" } },
-	},
-	session: {
-		loginPage: { url: "/login" },
-		rateLimit: { login: { windowMs: 60000, limit: 100 } },
-	},
-	rateLimit: { failMode: "open" },
-	"standalone-in-memory-code-repository": { defaultExpiresIn: 600 },
-	// The in-process limiter's section as core's `reference.conf` ships it.
-	"core-rate-limiter-memory": {
-		maxBuckets: 10000,
-		defaultLimit: { limit: 60, windowSeconds: 60 },
-		limits: {},
-	},
-} as unknown as AppConfig;
-
-/** What phase one hands `buildModules`: the configuration, and every store in process. */
-const switches = {
-	...config,
-	adapters: inProcessAdapters(),
-	mfaMode: "off",
-} as unknown as Switches;
-
-const testRepositoriesModule = defineModule({
-	name: "test:repositories",
-	provides: {
-		clientRepository: () =>
-			new InMemoryClientRepository(
-				new Map([
-					[
-						CLIENT_ID,
-						{
-							tokenEndpointAuthMethod: "client_secret_basic",
-							clientSecret: CLIENT_SECRET,
-							allowedRedirectUris: [],
-							allowedScopes: ["openid", "profile"],
-							allowedAudiences: [],
-							allowedGrantTypes: ["session"],
-							backchannelLogoutSessionRequired: true,
-							frontchannelLogoutSessionRequired: true,
-							allowedAzpForFederationToken: false,
-						},
-					],
-				]),
-			),
-		userRepository: () =>
-			new InMemoryUserRepository(
-				new Map([[USERNAME, { id: "u-alice", password: PASSWORD, email: "alice@example.com" }]]),
-			),
-	} as never,
-});
-
-// The template's `key-store` section, read by its own schema, without the
-// section's relocation bridge.
-const testKeyStoreModule = defineModule({
-	name: "key-store",
-	section: { schema: keyStoreSectionSchema },
-	provides: {
-		keyStore: async ({ section }) => {
-			const factory = createKeyStoreFactory();
-			registerBuiltinKeyStores(factory);
-			return factory.create({
-				type: "local",
-				...(section.local ?? {}),
-			});
-		},
-	},
-});
-
-describe("POST /session/logout invalidates the session grant's access token", () => {
-	let handleRef: Awaited<ReturnType<typeof createApp>> | undefined;
-
-	afterEach(async () => {
-		await handleRef?.dispose();
-		handleRef = undefined;
-	});
-
-	async function buildApp() {
-		const handle = await createApp({
-			modules: buildModules(switches, {
-				keyStoreModule: testKeyStoreModule,
-				repositoriesModule: testRepositoriesModule,
-				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-			}),
-			bootstrapComponents: { config, pathResolver: (s) => s },
-		});
-		handleRef = handle;
-
-		const app = express();
-		app.use(
-			createReadinessRouter(express, {
-				probes: handle.readinessProbes,
-				timeoutMs: HTTP.readinessTimeoutMs,
-			}),
-		);
-		app.use(handle.router);
-		return app;
-	}
-
-	/**
-	 * Drives the real browser half: fetch a CSRF pair, log in, and return the
-	 * cookies plus the token the login response reissued. `/session/login`
-	 * hands back a fresh CSRF cookie precisely so the follow-up logout needs no
-	 * second round trip.
-	 */
-	async function login(app: express.Express) {
-		const csrfRes = await request(app).get("/session/csrf");
-		expect(csrfRes.status).toBe(200);
-		const csrfToken = csrfRes.body.csrf_token as string;
-		const headerName = csrfRes.body.header_name as string;
-		const csrfCookies = csrfRes.headers["set-cookie"] as unknown as string[];
-
-		const loginRes = await request(app)
-			.post("/session/login")
-			.set("Cookie", csrfCookies)
-			.set(headerName, csrfToken)
-			.type("form")
-			.send({ username: USERNAME, password: PASSWORD });
-		expect(loginRes.status).toBe(200);
-
-		const loginCookies = loginRes.headers["set-cookie"] as unknown as string[];
-		// The mechanism is a signed double-submit, so the reissued cookie's
-		// value IS the token the header has to echo; the pre-login token no
-		// longer matches.
-		const csrfCookiePrefix = `${(config["session-store"] as { name: string }).name}.csrf=`;
-		const reissued = loginCookies
-			.find((c) => c.startsWith(csrfCookiePrefix))
-			?.slice(csrfCookiePrefix.length)
-			.split(";")[0];
-		expect(reissued).toBeDefined();
-		return {
-			cookies: loginCookies,
-			csrfToken: decodeURIComponent(reissued as string),
-			headerName,
-		};
-	}
-
-	it("a token minted from the session stops introspecting active after the session logs out", async () => {
-		const app = await buildApp();
-		const { cookies, csrfToken, headerName } = await login(app);
-
-		// The BFF exchanges the browser session for an access token.
-		const tokenRes = await request(app)
-			.post("/oauth/token")
-			.set("Authorization", BASIC)
-			.set("Cookie", cookies)
-			.type("form")
-			.send({ grant_type: "session", scope: "openid profile" });
-		expect(tokenRes.status).toBe(200);
-		const accessToken = tokenRes.body.access_token as string;
-		expect(typeof accessToken).toBe("string");
-
-		// Before the logout the token is a live credential at both surfaces.
-		const beforeIntrospect = await request(app)
-			.post("/oauth/introspect")
-			.set("Authorization", BASIC)
-			.type("form")
-			.send({ token: accessToken });
-		expect(beforeIntrospect.status).toBe(200);
-		expect(beforeIntrospect.body.active).toBe(true);
-
-		const beforeUserinfo = await request(app)
-			.get("/oauth/userinfo")
-			.set("Authorization", `Bearer ${accessToken}`);
-		expect(beforeUserinfo.status).toBe(200);
-
-		// The logout the BFF topology actually performs — no id_token_hint, no
-		// `/oauth/logout`, just the session endpoint the browser calls.
-		const logoutRes = await request(app)
-			.post("/session/logout")
-			.set("Cookie", cookies)
-			.set(headerName, csrfToken);
-		expect(logoutRes.status).toBe(200);
-		expect(logoutRes.body).toMatchObject({ message: "Logged out successfully" });
-
-		// After it, the same token no longer authorizes anything: the
-		// `UserSession` record the liveness checks resolve does not outlive
-		// the logout.
-		const afterIntrospect = await request(app)
-			.post("/oauth/introspect")
-			.set("Authorization", BASIC)
-			.type("form")
-			.send({ token: accessToken });
-		expect(afterIntrospect.status).toBe(200);
-		expect(afterIntrospect.body.active).toBe(false);
-
-		const afterUserinfo = await request(app)
-			.get("/oauth/userinfo")
-			.set("Authorization", `Bearer ${accessToken}`);
-		expect(afterUserinfo.status).toBe(401);
-		expect(afterUserinfo.body.error_description).toBe("session_invalid");
-	});
-});

package/templates/standalone/src/__tests__/session-logout-lifecycle.test.mts

@@ -1,130 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The template with core's session lifecycle module: `POST /session/logout`
- * closes the session through it, so the browser's own logout revokes the
- * session's refresh-token families and tells its relying parties, as
- * `/oauth/logout` does.
- */
-
-import {
-	type RefreshTokenFamilyRevocation,
-	readVersionedSessionLifecycle,
-	type SessionLifecycle,
-	type SessionLifecycleStore,
-	type UserSessionStore,
-} from "@o3co/auth-provider-core";
-import request from "supertest";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { authorize, codeFrom, compose, login, redeem } from "./all-modules-composition.fixture.mjs";
-import { backchannelPeer, withLoopbackRelyingParties } from "./backchannel-peer.fixture.mjs";
-
-afterEach(() => {
-	vi.restoreAllMocks();
-});
-
-/** A JWT's claims, unverified. */
-const claimsOf = (token: string): Record<string, unknown> =>
-	JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
-
-/** The CSRF token a login reissued, read off its double-submit cookie. */
-const csrfTokenOf = (cookies: readonly string[]): string => {
-	const cookie = cookies.find((c) => /^[^=]*\.csrf=/.test(c));
-	if (cookie === undefined) throw new Error("the login reissued no CSRF cookie");
-	return decodeURIComponent(cookie.slice(cookie.indexOf("=") + 1).split(";")[0] ?? "");
-};
-
-describe("POST /session/logout with the session lifecycle module", () => {
-	it("revokes the session's families, tells its relying parties and closes its record", async () => {
-		const peer = await backchannelPeer();
-		const { app, handle } = await compose({
-			config: withLoopbackRelyingParties,
-			extraClients: {
-				"rp-bc": {
-					tokenEndpointAuthMethod: "client_secret_basic",
-					clientSecret: "rp-bc-secret-long-enough",
-					allowedRedirectUris: ["https://rp-bc.test/cb"],
-					allowedScopes: ["openid"],
-					allowedGrantTypes: ["authorization_code"],
-					backchannelLogoutUri: peer.uri,
-				},
-			},
-		});
-		try {
-			const components = handle.components as Record<string, unknown>;
-			const lifecycle = components.sessionLifecycle as SessionLifecycle;
-			const sessions = components.userSessionStore as UserSessionStore;
-			const families = components.refreshTokenFamilyRevocation as RefreshTokenFamilyRevocation;
-			const { cookies } = await login(app);
-			const exchanged = await redeem(app, codeFrom(await authorize(app, cookies)));
-			expect(exchanged.status).toBe(200);
-			const claims = claimsOf(exchanged.body.refresh_token as string);
-			const sid = String(claims.sid);
-			const familyId = String(claims.family_id);
-			expect(
-				await lifecycle.join(sid, {
-					rp: {
-						clientId: "rp-bc",
-						backchannelLogoutUri: peer.uri,
-						backchannelLogoutSessionRequired: true,
-						frontchannelLogoutUri: undefined,
-						frontchannelLogoutSessionRequired: undefined,
-						registeredAt: new Date(),
-					},
-				}),
-			).toEqual({ outcome: "joined" });
-			const csrfToken = csrfTokenOf(cookies);
-			const res = await request(app)
-				.post("/session/logout")
-				.set("Cookie", cookies)
-				.set("x-csrf-token", csrfToken);
-
-			expect(res.status).toBe(200);
-			expect(await families.isFamilyRevoked(familyId)).toBe(true);
-			expect(peer.tokens).toHaveLength(1);
-			expect(await sessions.get(sid)).toBeNull();
-			const store = components.sessionLifecycleStore as SessionLifecycleStore;
-			expect(readVersionedSessionLifecycle(await store.read(sid))?.value.state).toBe("closed");
-		} finally {
-			await handle.dispose();
-			await peer.close();
-		}
-	});
-
-	it("answers 503 when the close cannot commit, and the cookie still admits the session for a retry", async () => {
-		const { app, handle } = await compose();
-		try {
-			const { cookies } = await login(app);
-			const components = handle.components as Record<string, unknown>;
-			const store = components.sessionLifecycleStore as SessionLifecycleStore;
-			vi.spyOn(store, "beginClose").mockRejectedValue(new Error("lifecycle store down"));
-
-			const res = await request(app)
-				.post("/session/logout")
-				.set("Cookie", cookies)
-				.set("x-csrf-token", csrfTokenOf(cookies));
-
-			expect(res.status).toBe(503);
-			expect(res.body.error).toBe("temporarily_unavailable");
-			// The session is still live and its cookie still admits it.
-			const authorized = await authorize(app, cookies);
-			expect(codeFrom(authorized)).toEqual(expect.any(String));
-		} finally {
-			await handle.dispose();
-		}
-	});
-});