@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/session-requirements.test.mts

@@ -1,382 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The template's posture on session admission. What it expects is its
- * configuration's `core.sessionRequirements.expected`
- * — `[]` in the shipped `config/application.conf` — with `mfa` added when the
- * template's MFA switch, `mfaMode` (`MFA_MODE`), is not `off`
- * (`expectedSessionRequirements`); under that switch the template installs
- * the MFA module, whose requirement registers `mfa`; a value boot refuses is
- * handed on as written, for boot to refuse. And what it hands boot
- * of the MFA module's section, `mfa`: nothing unless a loaded module owns it,
- * its mode written from the switch when the template installs MFA, and a
- * mode the configuration writes that the switch does not say refused.
- */
-
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { BootError, type Module } from "@o3co/auth-provider-core";
-import { afterEach, describe, expect, it } from "vitest";
-import { buildModules } from "../buildModules.mjs";
-import {
-	expectedSessionRequirements,
-	readOwnLayers,
-	readSwitches,
-	resolveForBoot,
-	resolveLayers,
-} from "../configPath.mjs";
-import type { MfaSwitch } from "../sections.mjs";
-import {
-	type Composition,
-	compose,
-	ownFiles,
-	SINGLE_ENV,
-} from "./all-modules-composition.fixture.mjs";
-
-let current: Composition | undefined;
-
-afterEach(async () => {
-	await current?.handle.dispose();
-	current = undefined;
-});
-
-/** The boot's refusal, or `undefined` when it booted (kept for disposal). */
-const refusal = (composing: Promise<Composition>): Promise<unknown> =>
-	composing.then(
-		(composition) => {
-			current = composition;
-			return undefined;
-		},
-		(caught: unknown) => caught,
-	);
-
-/** What MFA on needs in production beside the switch: a key, and a mail relay. */
-const MFA_ENV: Readonly<Record<string, string>> = {
-	MFA_ENCRYPTION_KEY: Buffer.alloc(32, 9).toString("base64"),
-	STANDARD_SMTP_MAIL_SENDER_HOST: "smtp.auth.test",
-	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
-};
-
-describe("what the template expects of session admission", () => {
-	it("is [] in the shipped configuration under MFA_MODE=off, and the composition boots with it", async () => {
-		const own = readOwnLayers(ownFiles(), { env: SINGLE_ENV });
-		expect(resolveLayers(own, []).core).toMatchObject({ sessionRequirements: { expected: [] } });
-		expect(readSwitches(own).mfaMode).toBe("off");
-		current = await compose();
-		expect(current.config).not.toHaveProperty("mfa");
-		expect(current.config.core?.sessionRequirements).toEqual({ expected: [] });
-		expect([...(current.handle.components.sessionRequirementResolver?.entries() ?? [])]).toEqual(
-			[],
-		);
-	});
-
-	it.each(["optional", "required"] as const)(
-		"adds mfa under MFA_MODE=%s, which the MFA module the template installs registers",
-		async (mode) => {
-			current = await compose({
-				env: { ...SINGLE_ENV, ...MFA_ENV, MFA_MODE: mode },
-				environment: "test",
-			});
-			expect(current.config.core?.sessionRequirements).toEqual({
-				expected: ["mfa"],
-				secondFactorAuthority: "mfa",
-			});
-			expect(
-				[...(current.handle.components.sessionRequirementResolver?.entries() ?? [])].map(
-					([name]) => name,
-				),
-			).toEqual(["mfa"]);
-		},
-	);
-
-	it("keeps an operator's own list and adds mfa beside it, overwriting nothing", async () => {
-		const err = await refusal(
-			compose({
-				env: { ...SINGLE_ENV, ...MFA_ENV, MFA_MODE: "required" },
-				environment: "test",
-				operatorHocon: 'core.sessionRequirements.expected = ["risk"]\n',
-			}),
-		);
-		expect(err).toBeInstanceOf(BootError);
-		expect((err as BootError).reason).toBe("session-requirement-missing");
-		expect((err as BootError).details).toMatchObject({
-			missing: ["risk"],
-			declared: ["risk", "mfa"],
-		});
-	});
-
-	it.each([
-		["a name, not a list", 'core.sessionRequirements.expected = "risk"\n'],
-		["a list holding something other than a name", "core.sessionRequirements.expected = [1]\n"],
-		["a key core does not declare beside the list", "core.sessionRequirements.extra = 1\n"],
-	])(
-		"hands boot %s as written under the switch on, and boot refuses it naming core.sessionRequirements",
-		async (_label, operatorHocon) => {
-			const err = await refusal(
-				compose({
-					env: { ...SINGLE_ENV, ...MFA_ENV, MFA_MODE: "required" },
-					environment: "test",
-					operatorHocon,
-				}),
-			);
-			expect(err).toBeInstanceOf(BootError);
-			expect((err as BootError).reason).toBe("config-validation-failed");
-			expect(String((err as BootError).message)).toContain("core.sessionRequirements");
-		},
-	);
-
-	it("hands boot the configuration's own section as written under the switch off", () => {
-		const own = readOwnLayers(
-			[
-				operatorLayer(
-					'core.sessionRequirements { expected = ["risk"], secondFactorAuthority = "risk" }\n',
-				),
-				...ownFiles(),
-			],
-			{ env: SINGLE_ENV },
-		);
-		const resolved = resolveForBoot(own, [], readSwitches(own)) as unknown as {
-			readonly core?: { readonly sessionRequirements?: unknown };
-		};
-		expect(resolved.core?.sessionRequirements).toEqual({
-			expected: ["risk"],
-			secondFactorAuthority: "risk",
-		});
-	});
-
-	it("refuses the boot when the configuration expects mfa under the switch off: nothing registers it", async () => {
-		const err = await refusal(
-			compose({ operatorHocon: 'core.sessionRequirements.expected = ["mfa"]\n' }),
-		);
-		expect(err).toBeInstanceOf(BootError);
-		expect((err as BootError).reason).toBe("session-requirement-missing");
-		expect((err as BootError).details).toMatchObject({
-			configKey: "core.sessionRequirements.expected",
-			missing: ["mfa"],
-		});
-	});
-});
-
-describe("what the template hands boot of the mfa section", () => {
-	const ownUnder = (env: Readonly<Record<string, string>>, hocon?: string) =>
-		readOwnLayers(hocon === undefined ? ownFiles() : [operatorLayer(hocon), ...ownFiles()], {
-			env,
-		});
-	/** A module whose section is `mfa`: resolveForBoot reads its name and section alone. */
-	const reader = { name: "mfa", section: {} } as unknown as Module;
-	const mfaOf = (resolved: unknown) => (resolved as { mfa?: unknown }).mfa;
-
-	it("hands none under the switch off unless a loaded module owns the section, whatever the configuration writes there", () => {
-		const own = ownUnder(SINGLE_ENV, 'mfa.page.url = "/my-mfa"\nmfa.mdoe = "required"\n');
-		const switches = readSwitches(own);
-		expect(resolveForBoot(own, [], switches)).not.toHaveProperty("mfa");
-		// A module the deployment adds that owns it: handed as written.
-		expect(mfaOf(resolveForBoot(own, [reader], switches))).toEqual({
-			page: { url: "/my-mfa" },
-			mdoe: "required",
-		});
-	});
-
-	it("hands it, owned by the MFA module the switch installs, with the mode written from the switch over the MFA package's default", () => {
-		for (const mode of ["optional", "required"] as const) {
-			// The switch written in a layer, MFA_MODE unset: the package's reference says off.
-			const { MFA_MODE: _unset, ...env } = SINGLE_ENV;
-			const own = ownUnder(env, `mfaMode = "${mode}"\n`);
-			const switches = readSwitches(own);
-			const modules = buildModules(switches, { environment: "test" });
-			expect(mfaOf(resolveForBoot(own, modules, switches)), mode).toMatchObject({ mode });
-		}
-	});
-
-	it.each([
-		["the switch off", {}, 'mfa.mode = "required"\n'],
-		["the switch off, the mode optional", {}, 'mfa.mode = "optional"\n'],
-		["MFA_MODE=optional", { MFA_MODE: "optional" }, 'mfa.mode = "required"\n'],
-		["MFA_MODE=required", { MFA_MODE: "required" }, 'mfa.mode = "optional"\n'],
-	])(
-		"refuses, under %s, an mfa.mode the configuration writes that the switch does not say, naming both keys and quoting nothing",
-		(_label, env, hocon) => {
-			const own = ownUnder({ ...SINGLE_ENV, ...env }, hocon);
-			const switches = readSwitches(own);
-			let err: unknown;
-			try {
-				resolveForBoot(own, [reader], switches);
-			} catch (caught) {
-				err = caught;
-			}
-			expect(err).toBeInstanceOf(BootError);
-			expect(err).toMatchObject({
-				reason: "config-validation-failed",
-				details: {
-					issues: [{ code: "custom", path: ["mfa", "mode"] }],
-					modules: [{ module: "mfa", schemaPath: "mfa" }],
-				},
-			});
-			const message = (err as BootError).message;
-			expect(message).toContain("mfa.mode");
-			expect(message).toContain("mfaMode");
-			expect(message).not.toMatch(/"(?:off|optional|required)"/);
-			expect(JSON.stringify((err as BootError).details)).not.toMatch(/"(?:off|optional|required)"/);
-		},
-	);
-
-	it.each([
-		["the switch off", {}],
-		["MFA_MODE=required", { MFA_MODE: "required" }],
-	])(
-		"refuses, under %s, an mfa written as a value, naming mfa itself and quoting nothing",
-		(_label, env) => {
-			const own = ownUnder({ ...SINGLE_ENV, ...env }, 'mfa = "required"\n');
-			let err: unknown;
-			try {
-				resolveForBoot(own, [reader], readSwitches(own));
-			} catch (caught) {
-				err = caught;
-			}
-			expect(err).toBeInstanceOf(BootError);
-			expect(err).toMatchObject({
-				reason: "config-validation-failed",
-				details: { issues: [{ code: "custom", path: ["mfa"] }] },
-			});
-			const message = (err as BootError).message;
-			expect(message).toMatch(/^mfa is written as a value/);
-			expect(message).not.toContain("remove mfa.mode");
-			expect(message).toContain("mfaMode");
-			expect(message).not.toMatch(/"(?:off|optional|required)"/);
-		},
-	);
-
-	it("accepts an mfa.mode the configuration writes that the switch says", () => {
-		for (const [env, hocon] of [
-			[{}, 'mfa.mode = "off"\n'],
-			[{ MFA_MODE: "required" }, 'mfa.mode = "required"\n'],
-		] as const) {
-			const own = ownUnder({ ...SINGLE_ENV, ...env }, hocon);
-			expect(() => resolveForBoot(own, [reader], readSwitches(own)), hocon).not.toThrow();
-		}
-	});
-
-	it("is refused through the composition as through phase two: by the template before boot, under the switch off", async () => {
-		const err = await refusal(compose({ operatorHocon: 'mfa.mode = "required"\n' }));
-		expect(err).toBeInstanceOf(BootError);
-		// The template's own check, not a schema's: one custom issue, in its words.
-		const message = /^mfa\.mode is written in the configuration and differs from mfaMode/;
-		expect(err).toMatchObject({
-			reason: "config-validation-failed",
-			message: expect.stringMatching(message),
-			details: {
-				issues: [
-					{ code: "custom", path: ["mfa", "mode"], message: expect.stringMatching(message) },
-				],
-				modules: [{ module: "mfa", schemaPath: "mfa" }],
-			},
-		});
-		expect((err as BootError).details).toMatchObject({ issues: { length: 1 } });
-		expect((err as BootError).message).toContain("mfaMode");
-	});
-});
-
-describe("expectedSessionRequirements", () => {
-	const of = (mfa: MfaSwitch, expected?: readonly string[], authority?: string) =>
-		expectedSessionRequirements(
-			expected === undefined && authority === undefined
-				? undefined
-				: {
-						...(expected === undefined ? {} : { expected }),
-						...(authority === undefined ? {} : { secondFactorAuthority: authority }),
-					},
-			mfa,
-		);
-	const AUTHORITY = { secondFactorAuthority: "mfa" } as const;
-
-	it("is the configuration's list, with mfa added once and named the second-factor authority when the switch is not off", () => {
-		// `undefined`: the section is handed on as written.
-		expect(of("off", ["risk"])).toBeUndefined();
-		expect(of("optional", ["risk"])).toEqual({ expected: ["risk", "mfa"], ...AUTHORITY });
-		expect(of("required", ["mfa"])).toEqual({ expected: ["mfa"], ...AUTHORITY });
-		expect(of("required")).toEqual({ expected: ["mfa"], ...AUTHORITY });
-	});
-
-	it("keeps the configuration's list as written, repeats included, and adds mfa only when it is absent", () => {
-		expect(of("required", ["risk", "risk"])).toEqual({
-			expected: ["risk", "risk", "mfa"],
-			...AUTHORITY,
-		});
-		expect(of("required", ["mfa", "risk", "mfa"])).toEqual({
-			expected: ["mfa", "risk", "mfa"],
-			...AUTHORITY,
-		});
-		expect(of("off", ["risk", "risk"])).toBeUndefined();
-	});
-
-	it("accepts a written second-factor authority the switch says, and keeps one written under the switch off", () => {
-		expect(of("required", ["mfa"], "mfa")).toEqual({ expected: ["mfa"], ...AUTHORITY });
-		expect(of("off", ["risk"], "risk")).toBeUndefined();
-	});
-
-	it("refuses, with the switch on, a written second-factor authority other than mfa, naming the key and the switch and quoting nothing", () => {
-		let err: unknown;
-		try {
-			of("required", ["mfa", "sentinel-requirement"], "sentinel-requirement");
-		} catch (caught) {
-			err = caught;
-		}
-		expect(err).toBeInstanceOf(BootError);
-		expect(err).toMatchObject({
-			reason: "config-validation-failed",
-			details: {
-				issues: [
-					{ code: "custom", path: ["core", "sessionRequirements", "secondFactorAuthority"] },
-				],
-				modules: [{ module: "core", schemaPath: "core" }],
-			},
-		});
-		expect(JSON.stringify((err as BootError).details)).not.toContain("sentinel-requirement");
-		const message = (err as BootError).message;
-		expect(message).toContain("core.sessionRequirements.secondFactorAuthority");
-		expect(message).toContain("mfaMode");
-		expect(message).toContain("MFA_MODE");
-		expect(message).not.toContain("sentinel-requirement");
-	});
-
-	it("declares nothing when the configuration writes no list and the switch is off, so boot's own rule for an unwritten key applies", () => {
-		expect(of("off")).toBeUndefined();
-	});
-
-	it("hands on as written, under the switch on, what is not a section with a list of names, for boot to refuse", () => {
-		expect(expectedSessionRequirements("mfa", "required")).toBeUndefined();
-		expect(expectedSessionRequirements({ expected: "mfa" }, "required")).toBeUndefined();
-		expect(expectedSessionRequirements({ expected: ["mfa", 1] }, "required")).toBeUndefined();
-		expect(expectedSessionRequirements({}, "required")).toBeUndefined();
-	});
-
-	it("keeps, under the switch on, every other key written beside the list, for boot to refuse", () => {
-		expect(expectedSessionRequirements({ expected: [], extra: 1 }, "required")).toEqual({
-			expected: ["mfa"],
-			extra: 1,
-			...AUTHORITY,
-		});
-	});
-});
-
-/** `text` in a file of its own, a layer above the composition's files. */
-function operatorLayer(text: string): string {
-	const file = join(mkdtempSync(join(tmpdir(), "session-requirements-")), "operator.conf");
-	writeFileSync(file, text);
-	return file;
-}

package/templates/standalone/src/__tests__/shipped-config-notices.test.mts

@@ -1,274 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The template's shipped files, read as `app.mts` reads them in each mode the
- * README documents, write no section for a module the mode does not load:
- * every top-level section handed to boot is a loaded module's, core's own
- * (`core`, `oauth`), one that sets nothing, or one equal to the
- * configuration's defaults (`configDefaultsFor`). That is checked here
- * directly, whatever core counts as read; booted, the same modes then have
- * core name nothing in `config_sections_ignored` or
- * `config_sections_not_loaded`.
- *
- * Redis is a stand-in: these boots read configuration, not stores.
- */
-
-import { generateKeyPairSync } from "node:crypto";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { isDeepStrictEqual } from "node:util";
-import { createApp, type Module } from "@o3co/auth-provider-core";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { buildModules } from "#/buildModules.mjs";
-import {
-	configDefaultsFor,
-	readOwnLayers,
-	readSwitches,
-	resolveConfigPaths,
-	resolveForBoot,
-} from "#/configPath.mjs";
-import { createRecordingLogger, type RecordingLogger } from "./all-modules-composition.fixture.mjs";
-
-vi.mock("redis", () => ({
-	createClient: vi.fn(() => ({
-		connect: vi.fn().mockResolvedValue(undefined),
-		quit: vi.fn().mockResolvedValue(undefined),
-		ping: vi.fn().mockResolvedValue("PONG"),
-		on: vi.fn(),
-	})),
-}));
-
-vi.mock("connect-redis", async () => {
-	const { EventEmitter } = await import("node:events");
-	// express-session subscribes to store events, so the stand-in is an emitter.
-	return {
-		RedisStore: class MockRedisStore extends EventEmitter {
-			get(): unknown {
-				return undefined;
-			}
-			set(): void {}
-			destroy(): void {}
-		},
-	};
-});
-
-vi.mock("ioredis", () => {
-	const explicit: Record<string, unknown> = {
-		on: () => undefined,
-		quit: async () => "OK",
-		disconnect: () => undefined,
-		ping: async () => "PONG",
-		// The Redis stores' eviction gate reads the policy from INFO memory: a
-		// default server's.
-		info: async (section: string) =>
-			section === "memory" ? "# Memory\r\nmaxmemory_policy:noeviction\r\n" : null,
-	};
-	const makeMockRedis = (): object =>
-		new Proxy(
-			{},
-			{
-				get(_target, prop) {
-					// A function-valued `then` would make the instance a thenable.
-					if (typeof prop !== "string" || prop === "then") return undefined;
-					if (prop === "duplicate") return makeMockRedis;
-					if (prop in explicit) return explicit[prop];
-					return async () => null;
-				},
-			},
-		);
-	function MockRedis(): object {
-		return makeMockRedis();
-	}
-	return { Redis: MockRedis, default: MockRedis };
-});
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-const handles: { dispose(): Promise<void> }[] = [];
-afterEach(async () => {
-	for (const handle of handles.splice(0)) await handle.dispose();
-});
-
-const signingKey = generateKeyPairSync("ed25519", {
-	publicKeyEncoding: { type: "spki", format: "pem" },
-	privateKeyEncoding: { type: "pkcs8", format: "pem" },
-});
-const clientsFile = (() => {
-	const file = join(mkdtempSync(join(tmpdir(), "shipped-config-notices-")), "clients.yaml");
-	writeFileSync(file, "");
-	return file;
-})();
-
-/** What `.env.example` asks every deployment for, with the Store's user directory. */
-const REQUIRED: Readonly<Record<string, string>> = {
-	OAUTH_JWT_ISSUER: "https://auth.test",
-	KEY_STORE_LOCAL_PRIVATE_KEY: signingKey.privateKey,
-	KEY_STORE_LOCAL_PUBLIC_KEY: signingKey.publicKey,
-	SESSION_STORE_SECRET: "shipped-config-notices-session.at-least-32-bytes.ok",
-	REPOSITORIES_CLIENT_YAML_PATH: clientsFile,
-	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: "https://store.auth.test/authenticate",
-	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: "https://store.auth.test/by-token",
-};
-
-/** What `docker-compose.yml` sets for the app beside the operator's `.env`, with `.env.example`'s Redis URLs. */
-const COMPOSE: Readonly<Record<string, string>> = {
-	SESSION_STORE_STORAGE_REDIS_URL: "redis://redis.test:6379",
-	REDIS_CLIENTS_URL: "redis://redis.test:6379",
-	ADAPTERS_USER_SESSION_STORES: "redis",
-	ADAPTERS_MFA_FACTOR_STORE: "redis",
-	ADAPTERS_MFA_TRANSACTION_STORE: "redis",
-};
-
-/** What MFA, on by default, needs outside development. */
-const MFA_OUTSIDE_DEVELOPMENT: Readonly<Record<string, string>> = {
-	MFA_ENCRYPTION_KEY: "bzNjbzptZmE6c2hpcHBlZC1jb25maWctbm90aWNlcyE=",
-	STANDARD_SMTP_MAIL_SENDER_HOST: "smtp.auth.test",
-	STANDARD_SMTP_MAIL_SENDER_FROM: "auth@auth.test",
-};
-
-/** One replica, as `docker-compose.production.yml` runs it. */
-const PRODUCTION: Readonly<Record<string, string>> = {
-	...REQUIRED,
-	...COMPOSE,
-	...MFA_OUTSIDE_DEVELOPMENT,
-	CORE_DEPLOYMENT_MODE: "single",
-	HTTP_TRUST_PROXY: "loopback",
-};
-
-/** The README's multi-replica checklist: every shared store on Redis. */
-const MULTI: Readonly<Record<string, string>> = {
-	...PRODUCTION,
-	CORE_DEPLOYMENT_MODE: "multi",
-	ADAPTERS_RATE_LIMITER: "redis",
-	ADAPTERS_ATTEMPT_COUNTER: "redis",
-	ADAPTERS_FEDERATION_TOKEN_STORE: "redis",
-	REDIS_FEDERATION_TOKEN_STORE_ENCRYPTION_KEY: "bzNjbzpmZWRlcmF0aW9uLXRva2Vucy1ub3RpY2VzISE=",
-};
-
-/** Every store in memory, MFA off: one process of local work with no Redis. */
-const IN_MEMORY: Readonly<Record<string, string>> = {
-	...REQUIRED,
-	MFA_MODE: "off",
-	SESSION_STORE_STORAGE_TYPE: "memory",
-	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
-	ADAPTERS_REPLAY_SEEN_SET: "memory",
-	ADAPTERS_CODE_REPOSITORY: "memory",
-};
-
-/** The composition's own files for `configEnv`, read as `app.mts` reads them, and what they choose. */
-function readShipped(configEnv: string, env: Readonly<Record<string, string>>) {
-	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, configEnv);
-	const own = readOwnLayers([envConfPath, applicationConfPath], { env });
-	const switches = readSwitches(own);
-	const modules = buildModules(switches, { environment: configEnv });
-	return { own, switches, modules };
-}
-
-/** Boots the template's own files for `configEnv` under `env`, as `app.mts` does. */
-async function bootShipped(
-	configEnv: string,
-	env: Readonly<Record<string, string>>,
-): Promise<{ readonly logger: RecordingLogger; readonly modules: readonly string[] }> {
-	const { own, switches, modules } = readShipped(configEnv, env);
-	const logger = createRecordingLogger();
-	const handle = await createApp({
-		modules,
-		bootstrapComponents: {
-			config: resolveForBoot(own, modules, switches),
-			configDefaults: configDefaultsFor(modules),
-			pathResolver: (s: string) => s,
-			logger,
-		},
-	});
-	handles.push(handle);
-	return { logger, modules: modules.map((module) => module.name) };
-}
-
-/** Core's own sections. */
-const CORE_SECTIONS: readonly string[] = ["core", "oauth"];
-
-/**
- * Removed by boot before it parses the configuration: what the resolution saw
- * of each renamed variable.
- */
-const RENAMED_VARIABLES = "renamed-variables";
-
-/** Whether `value` sets anything: a value, or a section with one somewhere under it. */
-function setsAnything(value: unknown): boolean {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return true;
-	return Object.values(value).some(setsAnything);
-}
-
-/**
- * The top-level sections of what `resolveForBoot` hands boot that are no
- * loaded module's and not core's, set something, and differ from the
- * configuration's defaults: settings for a module the composition does not
- * load.
- */
-function sectionsNothingLoadedReads(
-	configEnv: string,
-	env: Readonly<Record<string, string>>,
-): string[] {
-	const { own, switches, modules } = readShipped(configEnv, env);
-	const resolved = resolveForBoot(own, modules, switches) as unknown as Record<string, unknown>;
-	const defaults = configDefaultsFor(modules);
-	const sections = new Set(
-		modules.filter((module: Module) => module.section !== undefined).map((module) => module.name),
-	);
-	return Object.keys(resolved)
-		.filter((name) => !sections.has(name) && !CORE_SECTIONS.includes(name))
-		.filter((name) => name !== RENAMED_VARIABLES && setsAnything(resolved[name]))
-		.filter((name) => !isDeepStrictEqual(resolved[name], defaults[name]))
-		.sort();
-}
-
-/** What each warn line named `event` names. */
-const named = (logger: RecordingLogger, event: string): unknown[] =>
-	logger.lines
-		.filter((line) => line.level === "warn" && line.args[1] === event)
-		.map((line) => line.args[0]);
-
-/** Each mode the README documents: its name, the configuration it selects, its environment. */
-const MODES = [
-	["development, as docker-compose.yml runs it", "development", { ...REQUIRED, ...COMPOSE }],
-	["development, every store in memory", "development", IN_MEMORY],
-	["production, one replica", "production", PRODUCTION],
-	[
-		"production, one replica, the Redis rate limiter",
-		"production",
-		{ ...PRODUCTION, ADAPTERS_RATE_LIMITER: "redis" },
-	],
-	["production, every store in memory", "production", IN_MEMORY],
-	["production, more than one replica", "production", MULTI],
-] as const;
-
-describe("the shipped files write no section for a module the mode does not load", () => {
-	it.each(MODES)("%s", (_mode, configEnv, env) => {
-		expect(sectionsNothingLoadedReads(configEnv, env)).toEqual([]);
-	});
-});
-
-describe("a boot of the shipped files that changes nothing of them names no section", () => {
-	it.each(MODES)("%s", async (_mode, configEnv, env) => {
-		const { logger, modules } = await bootShipped(configEnv, env);
-		expect(modules).not.toContain("federation-grants");
-		expect(named(logger, "config_sections_ignored")).toEqual([]);
-		expect(named(logger, "config_sections_not_loaded")).toEqual([]);
-	});
-});