@o3co/create-auth-provider 0.17.0 → 0.18.0-rc.1

package/templates/standalone/src/__tests__/startup-log-lines.test.mts

@@ -1,164 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * What the template writes while it starts: `src/app.mts` in a process of its
- * own, in development on the memory stores, until it listens and then until
- * it has shut down. Every line on stdout and on stderr is one JSON object from
- * the structured logger — a warning a store gives at boot included.
- */
-
-import { type ChildProcess, spawn } from "node:child_process";
-import { generateKeyPairSync } from "node:crypto";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { createRequire } from "node:module";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-import { listeningRedis } from "./redis-stand-in.fixture.mjs";
-
-const templateRoot = fileURLToPath(new URL("../..", import.meta.url));
-const tsxCli = createRequire(import.meta.url).resolve("tsx/cli");
-
-const keyPair = generateKeyPairSync("ed25519", {
-	publicKeyEncoding: { type: "spki", format: "pem" },
-	privateKeyEncoding: { type: "pkcs8", format: "pem" },
-});
-
-/** An empty client registry: a scaffolded project's clone has no `config/clients.yaml`. */
-const clientsFile = (() => {
-	const file = join(mkdtempSync(join(tmpdir(), "startup-log-lines-")), "clients.yaml");
-	writeFileSync(file, "");
-	return file;
-})();
-
-/**
- * The Redis the refresh-token family store's shared socket dials: a stand-in
- * that reports `noeviction`, so the store passes its eviction gate and the run
- * reaches no real server.
- */
-let redis: Awaited<ReturnType<typeof listeningRedis>>;
-
-beforeAll(async () => {
-	redis = await listeningRedis();
-});
-
-afterAll(async () => {
-	await redis?.close();
-});
-
-/**
- * Development, with every store the `adapters` section selects in memory.
- * The refresh-token family store has no memory choice in the template; its
- * shared Redis socket points at the stand-in above. Nothing is inherited from
- * the test runner's environment but PATH, so its NODE_ENV and LOGGING_LEVEL do
- * not reach the child.
- */
-const env = (): Readonly<Record<string, string>> => ({
-	PATH: process.env.PATH ?? "",
-	CONFIG_ENV: "development",
-	NODE_ENV: "development",
-	LOGGING_LEVEL: "info",
-	HTTP_PORT: "0",
-	OAUTH_JWT_ISSUER: "http://localhost:3000",
-	KEY_STORE_LOCAL_PRIVATE_KEY: keyPair.privateKey,
-	KEY_STORE_LOCAL_PUBLIC_KEY: keyPair.publicKey,
-	SESSION_STORE_SECRET: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
-	SESSION_STORE_SECURE: "false",
-	SESSION_STORE_NAME: "auth.sid",
-	SESSION_STORE_STORAGE_TYPE: "memory",
-	ADAPTERS_RATE_LIMITER: "memory",
-	ADAPTERS_ATTEMPT_COUNTER: "memory",
-	ADAPTERS_USER_SESSION_STORES: "memory",
-	ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
-	ADAPTERS_REPLAY_SEEN_SET: "memory",
-	ADAPTERS_CODE_REPOSITORY: "memory",
-	ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
-	ADAPTERS_MFA_FACTOR_STORE: "memory",
-	ADAPTERS_MFA_TRANSACTION_STORE: "memory",
-	REDIS_CLIENTS_URL: `redis://127.0.0.1:${redis.port}`,
-	REPOSITORIES_CLIENT_YAML_PATH: clientsFile,
-	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: "http://127.0.0.1:9/authenticate",
-	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: "http://127.0.0.1:9/authenticate-by-token",
-});
-
-interface Run {
-	readonly stdout: string;
-	readonly stderr: string;
-	readonly listened: boolean;
-}
-
-/** Starts the template, stops it once it listens (or gives up), and returns what it wrote. */
-function startAndStop(timeoutMs: number): Promise<Run> {
-	return new Promise((resolve, reject) => {
-		const child: ChildProcess = spawn(process.execPath, [tsxCli, "src/app.mts"], {
-			cwd: templateRoot,
-			env: env(),
-			stdio: ["ignore", "pipe", "pipe"],
-		});
-		let stdout = "";
-		let stderr = "";
-		let listened = false;
-		const stop = (): void => {
-			if (child.exitCode === null && child.signalCode === null) child.kill("SIGTERM");
-		};
-		const deadline = setTimeout(stop, timeoutMs);
-		child.stdout?.setEncoding("utf8").on("data", (chunk: string) => {
-			stdout += chunk;
-			if (!listened && stdout.includes('"msg":"server_listening"')) {
-				listened = true;
-				stop();
-			}
-		});
-		child.stderr?.setEncoding("utf8").on("data", (chunk: string) => {
-			stderr += chunk;
-		});
-		child.on("error", (err) => {
-			clearTimeout(deadline);
-			reject(err);
-		});
-		child.on("close", () => {
-			clearTimeout(deadline);
-			resolve({ stdout, stderr, listened });
-		});
-	});
-}
-
-/** Each line of `text` that is not one JSON object. */
-function linesThatAreNotJsonObjects(text: string): string[] {
-	return text
-		.split("\n")
-		.filter((line) => line.trim() !== "")
-		.filter((line) => {
-			try {
-				const parsed: unknown = JSON.parse(line);
-				return typeof parsed !== "object" || parsed === null || Array.isArray(parsed);
-			} catch {
-				return true;
-			}
-		});
-}
-
-describe("the template's startup output", () => {
-	it("is one JSON object per line on stdout and stderr, in development on the memory stores", async () => {
-		const run = await startAndStop(15_000);
-
-		expect(run.listened, `the template did not listen; stderr:\n${run.stderr}`).toBe(true);
-		expect(linesThatAreNotJsonObjects(run.stdout)).toEqual([]);
-		expect(linesThatAreNotJsonObjects(run.stderr)).toEqual([]);
-	}, 30_000);
-});

package/templates/standalone/src/__tests__/store-credential.test.mts

@@ -1,314 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * The credential auth.provider presents to the Store, through the shipped
- * composition: `REPOSITORIES_USER_HTTP_BEARER_TOKEN` in the environment → the HOCON
- * layers → the production `repositories` module's section → the
- * `"http"` user adapter → the `Authorization` header a real `node:http` Store
- * receives. Unset, no header is sent; exported but empty, the user repository
- * is refused. From outside the booted app, a Store's `401` with a `Bearer`
- * challenge turns `POST /session/login` into a `503` whose log line names the
- * refused credential and never the token; a `401` without the challenge is
- * still a wrong password.
- */
-
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { createServer, type OutgoingHttpHeaders, type Server } from "node:http";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { inspect } from "node:util";
-import {
-	createApp,
-	createKeyStoreFactory,
-	defineModule,
-	type Logger,
-	memoryRefreshTokenFamilyStoreModule,
-	registerBuiltinKeyStores,
-	type UserRepository,
-} from "@o3co/auth-provider-core";
-import { parseFile } from "@o3co/ts.hocon";
-import express from "express";
-import request from "supertest";
-import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
-import { buildModules } from "../buildModules.mjs";
-import { resolveConfigPaths } from "../configPath.mjs";
-import { repositoriesModuleFor, templateReference } from "../modules.mjs";
-import { keyStoreSectionSchema, repositoriesSectionSchema } from "../sections.mjs";
-import {
-	type BothPhases,
-	bothPhasesOf,
-	capturedRenames,
-	libraryLayers,
-} from "./library-references.fixture.mjs";
-
-const configDir = fileURLToPath(new URL("../../config", import.meta.url));
-
-/** 32 bytes of key material — what `openssl rand -hex 32` prints. */
-const TOKEN = "7d1f0c3b9a5e2d4f6a8c0e1b3d5f7a9c2e4b6d8f0a1c3e5b7d9f2a4c6e8b0d1f";
-
-let servers: Server[] = [];
-afterEach(async () => {
-	await Promise.all(
-		servers.map((server) => {
-			server.closeAllConnections();
-			return new Promise<void>((resolve) => server.close(() => resolve()));
-		}),
-	);
-	servers = [];
-});
-
-/** How the Store answers every request. */
-interface StoreAnswer {
-	readonly status: number;
-	readonly headers?: OutgoingHttpHeaders;
-	readonly body: unknown;
-}
-
-const USER: StoreAnswer = { status: 200, body: { id: "user-1", username: "alice" } };
-
-/** A Store on its own loopback port that records each request's Authorization header. */
-const recordingStore = async (
-	answer: StoreAnswer = USER,
-): Promise<{ origin: string; heard: (string | undefined)[] }> => {
-	const heard: (string | undefined)[] = [];
-	const server = createServer((req, res) => {
-		req.resume();
-		req.on("end", () => {
-			heard.push(req.headers.authorization);
-			res.writeHead(answer.status, { "Content-Type": "application/json", ...answer.headers });
-			res.end(JSON.stringify(answer.body));
-		});
-	});
-	servers.push(server);
-	await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
-	const { port } = server.address() as { port: number };
-	return { origin: `http://127.0.0.1:${port}`, heard };
-};
-
-/** The shipped config for the production overlay, resolved against `env`. */
-const resolve = (env: Record<string, string>): BothPhases => {
-	const { applicationConfPath, envConfPath } = resolveConfigPaths(configDir, "production");
-	const layers = parseFile(envConfPath, { env })
-		.withFallback(parseFile(applicationConfPath, { env }))
-		.withFallback(parseFile(fileURLToPath(templateReference()), { env }))
-		.withFallback(libraryLayers(env));
-	return {
-		...bothPhasesOf(layers, env),
-		// What the resolution captured of the renamed variables.
-		"renamed-variables": capturedRenames(env),
-	} as BothPhases;
-};
-
-/** The user repository the production `repositories` module builds from `config`'s section. */
-const userRepositoryFrom = (config: BothPhases): Promise<UserRepository> =>
-	Promise.resolve(
-		repositoriesModuleFor({
-			client: config.adapters.clientRepository,
-			user: config.adapters.userRepository,
-		}).provides?.userRepository?.({
-			section: repositoriesSectionSchema.parse(
-				(config as unknown as Record<string, unknown>).repositories,
-			),
-		} as never) as UserRepository | Promise<UserRepository>,
-	);
-
-const envFor = (origin: string): Record<string, string> => ({
-	KEY_STORE_LOCAL_ALGORITHM: "HS256",
-	KEY_STORE_LOCAL_SECRET: "store-credential-composition.at-least-32-bytes.ok",
-	OAUTH_JWT_ISSUER: "https://auth.test",
-	SESSION_STORE_SECRET: "store-credential-composition-session.at-least-32-bytes.ok",
-	ADAPTERS_USER_REPOSITORY: "http",
-	REPOSITORIES_USER_HTTP_AUTHENTICATE_URL: `${origin}/authenticate`,
-	REPOSITORIES_USER_HTTP_AUTHENTICATE_BY_TOKEN_URL: `${origin}/authenticate-by-token`,
-});
-
-describe("REPOSITORIES_USER_HTTP_BEARER_TOKEN reaches the Store through the shipped composition", () => {
-	it("sends Authorization: Bearer <token> on every Store call when the variable is set", async () => {
-		const { origin, heard } = await recordingStore();
-		const repo = await userRepositoryFrom(
-			resolve({ ...envFor(origin), REPOSITORIES_USER_HTTP_BEARER_TOKEN: TOKEN }),
-		);
-
-		await repo.authenticate("alice", "pass");
-		await repo.authenticateByToken("apple:a1");
-
-		expect(heard).toEqual([`Bearer ${TOKEN}`, `Bearer ${TOKEN}`]);
-	});
-
-	it("sends no Authorization header when the variable is unset", async () => {
-		const { origin, heard } = await recordingStore();
-		const repo = await userRepositoryFrom(resolve(envFor(origin)));
-
-		await repo.authenticate("alice", "pass");
-
-		expect(heard).toEqual([undefined]);
-	});
-
-	it("refuses the user repository when the variable is exported but empty", async () => {
-		const { origin, heard } = await recordingStore();
-		const config = resolve({ ...envFor(origin), REPOSITORIES_USER_HTTP_BEARER_TOKEN: "" });
-
-		await expect(userRepositoryFrom(config)).rejects.toThrow(/"bearerToken" must not be empty/);
-		expect(heard).toEqual([]);
-	});
-});
-
-describe("a token the Store refuses, seen from outside the booted app", () => {
-	/** Every store on memory, so the boot opens no socket but the Store's; MFA off. */
-	const MEMORY_ENV: Readonly<Record<string, string>> = {
-		MFA_MODE: "off",
-		SESSION_STORE_SECURE: "false",
-		SESSION_STORE_NAME: "auth.session",
-		SESSION_STORE_STORAGE_TYPE: "memory",
-		ADAPTERS_USER_SESSION_STORES: "memory",
-		ADAPTERS_RATE_LIMITER: "memory",
-		ADAPTERS_CODE_REPOSITORY: "memory",
-		ADAPTERS_ACCESS_TOKEN_DENYLIST: "memory",
-		ADAPTERS_REPLAY_SEEN_SET: "memory",
-		ADAPTERS_FEDERATION_TOKEN_STORE: "memory",
-		ADAPTERS_CONSENT_STORE: "none",
-		ADAPTERS_FEDERATION_GRANT_STORE: "memory",
-		ADAPTERS_FEDERATION_GRANT_INTENT_STORE: "memory",
-	};
-
-	// The template's `key-store` section, read by its own schema, without the
-	// section's relocation bridge.
-	const testKeyStoreModule = defineModule({
-		name: "key-store",
-		section: { schema: keyStoreSectionSchema },
-		provides: {
-			keyStore: async ({ section }) => {
-				const factory = createKeyStoreFactory();
-				registerBuiltinKeyStores(factory);
-				return factory.create({
-					type: "local",
-					...(section.local ?? {}),
-				});
-			},
-		},
-	});
-
-	/** Every log call, as the arguments it was made with. */
-	const capturingLogger = (): { logger: Logger; lines: { level: string; args: unknown[] }[] } => {
-		const lines: { level: string; args: unknown[] }[] = [];
-		const at =
-			(level: string) =>
-			(...args: unknown[]): void => {
-				lines.push({ level, args });
-			};
-		const logger = {
-			trace: at("trace"),
-			debug: at("debug"),
-			info: at("info"),
-			warn: at("warn"),
-			error: at("error"),
-			fatal: at("fatal"),
-			child: () => logger,
-		} as Logger;
-		return { logger, lines };
-	};
-
-	let handleRef: Awaited<ReturnType<typeof createApp>> | undefined;
-	afterEach(async () => {
-		await handleRef?.dispose();
-		handleRef = undefined;
-	});
-
-	/**
-	 * The client registry the boot reads, which this test brings itself.
-	 * `REPOSITORIES_CLIENT_YAML_PATH`'s default, `./config/clients.yaml`, is per-deployment: the
-	 * scaffold's `.gitignore` keeps it out of the project's repository, so a
-	 * fresh clone — a CI runner, the `test` image — has none. The login below
-	 * names no client, so an empty registry is all it needs.
-	 */
-	let registryDir: string;
-	let clientPath: string;
-	beforeAll(() => {
-		registryDir = mkdtempSync(join(tmpdir(), "store-credential-"));
-		clientPath = join(registryDir, "clients.yaml");
-		writeFileSync(clientPath, "# No clients: the login under test names none.\n");
-	});
-	afterAll(() => {
-		rmSync(registryDir, { recursive: true, force: true });
-	});
-
-	/**
-	 * The shipped config against a Store answering `answer`, booted with the
-	 * production repositories module; then a real browser login — a CSRF pair,
-	 * then the form post.
-	 */
-	const logInAgainst = async (answer: StoreAnswer) => {
-		const { origin, heard } = await recordingStore(answer);
-		const config = resolve({
-			...envFor(origin),
-			...MEMORY_ENV,
-			REPOSITORIES_CLIENT_YAML_PATH: clientPath,
-			REPOSITORIES_USER_HTTP_BEARER_TOKEN: TOKEN,
-		});
-		const { logger, lines } = capturingLogger();
-		handleRef = await createApp({
-			modules: buildModules(config, {
-				keyStoreModule: testKeyStoreModule,
-				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
-			}),
-			bootstrapComponents: { config, pathResolver: (s: string) => s, logger },
-		});
-		const app = express().use(handleRef.router);
-
-		const csrf = await request(app).get("/session/csrf");
-		expect(csrf.status).toBe(200);
-		const login = await request(app)
-			.post("/session/login")
-			.set("Cookie", csrf.headers["set-cookie"] as unknown as string[])
-			.set(csrf.body.header_name as string, csrf.body.csrf_token as string)
-			.type("form")
-			.send({ username: "alice", password: "correct-horse-battery-staple" });
-		const logged = lines.map((line) =>
-			inspect(line, { depth: Number.POSITIVE_INFINITY, showHidden: true }),
-		);
-		return { login, heard, logged };
-	};
-
-	it("answers the login 503 and logs the refused credential by name, never the token", async () => {
-		const { login, heard, logged } = await logInAgainst({
-			status: 401,
-			headers: { "WWW-Authenticate": 'Bearer error="invalid_token"' },
-			body: { error: "invalid_token" },
-		});
-
-		expect(heard).toEqual([`Bearer ${TOKEN}`]);
-		expect(login.status).toBe(503);
-		expect(login.body.error).toBe("temporarily_unavailable");
-		expect(logged.filter((line) => /refused this deployment's credential/.test(line))).toHaveLength(
-			1,
-		);
-		expect(logged.filter((line) => line.includes(TOKEN))).toEqual([]);
-	});
-
-	it("still answers a 401 without the challenge as a wrong password", async () => {
-		const { login, heard, logged } = await logInAgainst({
-			status: 401,
-			body: { error: "invalid_credentials" },
-		});
-
-		expect(heard).toEqual([`Bearer ${TOKEN}`]);
-		expect(login.status).toBe(401);
-		expect(login.body.error).toBe("invalid_credentials");
-		expect(logged.filter((line) => /refused this deployment's credential/.test(line))).toEqual([]);
-	});
-});