@o3co/create-auth-provider 0.4.1 → 0.5.1

package/templates/standalone/src/modules.mts

@@ -0,0 +1,184 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import path from "node:path";
+import {
+	type AppConfig,
+	createFederationTokenStoreFactory,
+	createInMemorySessionFamilyIndex,
+	createInMemorySessionFederationIndex,
+	createInMemorySessionRPRegistry,
+	createInMemoryUserSessionStore,
+	createKeyStoreFactory,
+	createRepositoryFactories,
+	defineModule,
+	type Module,
+	registerBuiltinFederationTokenStores,
+	registerBuiltinKeyStores,
+} from "@o3co/auth-provider-core";
+import type { GoogleProviderConfig } from "@o3co/auth-provider-federation-google";
+import { registerBuiltinAdapters } from "@o3co/auth-provider-foundation";
+import {
+	redisCodeRepositoryBuilder,
+	redisFederationTokenStoreBuilder,
+} from "@o3co/auth-provider-redis";
+import { extractFederationSection } from "@o3co/auth-provider-session";
+
+/**
+ * Helper: turn a v0.4.x { type, [type]: {...} } adapter-config slice into the
+ * flat `{ type, ...rest }` shape consumed by AdapterFactory<T>.create().
+ *
+ * Composition-root concern; not a library export.
+ */
+function flattenAdapterConfig(
+	section: ({ type: string } | { provider: string }) & Record<string, unknown>,
+): { type: string } & Record<string, unknown> {
+	const selector =
+		(section as { type?: string; provider?: string }).type ??
+		(section as { provider?: string }).provider;
+	if (typeof selector !== "string") {
+		throw new TypeError("flattenAdapterConfig: section requires 'type' or 'provider' string");
+	}
+	const sub = section[selector];
+	const flattenedSub =
+		typeof sub === "object" && sub !== null && !Array.isArray(sub)
+			? (sub as Record<string, unknown>)
+			: {};
+	return { type: selector, ...flattenedSub };
+}
+
+/**
+ * KeyStore module — provides the JWT signing KeyStore from config.
+ *
+ * Per A2-γ §4 worked example. Composition-root-local: the standalone template
+ * uses the built-in local/jwks adapters; alternative deployments wire their
+ * own KeyStore via a different module of the same shape.
+ */
+export const keyStoreModule: Module = defineModule({
+	name: "standalone:key-store",
+	requires: ["config"] as const,
+	provides: {
+		keyStore: async ({ config }) => {
+			const factory = createKeyStoreFactory();
+			registerBuiltinKeyStores(factory);
+			return factory.create(flattenAdapterConfig((config as AppConfig).oauth.jwt.signingKey));
+		},
+	},
+});
+
+/**
+ * Repositories module — provides client / user / code repositories from
+ * `config.repositories.*` slices using the built-in adapter factories.
+ */
+export const repositoriesModule: Module = defineModule({
+	name: "standalone:repositories",
+	requires: ["config"] as const,
+	provides: {
+		clientRepository: async ({ config }) => {
+			const { clientFactory, userFactory } = createRepositoryFactories();
+			registerBuiltinAdapters({ userFactory });
+			const slice = flattenAdapterConfig(
+				(config as AppConfig).repositories.client as { type: string } & Record<string, unknown>,
+			);
+			if (typeof slice.path === "string") {
+				slice.path = path.resolve(process.cwd(), slice.path);
+			}
+			return clientFactory.create(slice);
+		},
+		userRepository: async ({ config }) => {
+			const { userFactory } = createRepositoryFactories();
+			registerBuiltinAdapters({ userFactory });
+			return userFactory.create(
+				flattenAdapterConfig(
+					(config as AppConfig).repositories.user as { type: string } & Record<string, unknown>,
+				),
+			);
+		},
+		codeRepository: async ({ config }) => {
+			const { userFactory, codeFactory } = createRepositoryFactories();
+			registerBuiltinAdapters({ userFactory });
+			codeFactory.register("redis", redisCodeRepositoryBuilder);
+			return codeFactory.create(
+				flattenAdapterConfig(
+					(config as AppConfig).repositories.code as { type: string } & Record<string, unknown>,
+				),
+			);
+		},
+	},
+});
+
+/**
+ * Stores module — provides the four-store user-session split + federation
+ * token store. The standalone template uses in-memory stores by default; a
+ * redis-backed deployment swaps this module for `@o3co/auth-provider-redis`'s
+ * equivalent (per A4 §10 / Phase 5).
+ */
+export const storesModule: Module = defineModule({
+	name: "standalone:stores",
+	requires: ["config"] as const,
+	provides: {
+		userSessionStore: () => createInMemoryUserSessionStore(),
+		sessionRPRegistry: () => createInMemorySessionRPRegistry(),
+		sessionFamilyIndex: () => createInMemorySessionFamilyIndex(),
+		sessionFederationIndex: () => createInMemorySessionFederationIndex(),
+		federationTokenStore: async ({ config }) => {
+			const factory = createFederationTokenStoreFactory();
+			registerBuiltinFederationTokenStores(factory);
+			factory.register("redis", redisFederationTokenStoreBuilder);
+			const slice = (
+				config as AppConfig & {
+					federationTokenStore?: { type: string } & Record<string, unknown>;
+				}
+			).federationTokenStore;
+			return factory.create(slice ? flattenAdapterConfig(slice) : { type: "memory" });
+		},
+	},
+});
+
+/**
+ * Google federation config bridge — supplies the typed `googleFederationConfig`
+ * ComponentMap slot from the `config.federations.google` slice.
+ *
+ * Per `@o3co/auth-provider-federation-google` README. Per-federation modules
+ * (Phase 7 A5) consume this slot; the bridge is the standalone composition
+ * root's responsibility because the slot's content is consumer-specific.
+ */
+export const googleFederationConfigModule: Module = defineModule({
+	name: "standalone:google-federation-config",
+	requires: ["config"] as const,
+	provides: {
+		googleFederationConfig: ({ config }): GoogleProviderConfig => {
+			const slice = extractFederationSection((config as AppConfig).federations, "google");
+			if (!slice) {
+				throw new Error(
+					"federations.google must be enabled with credentials when googleFederationModule is in the manifest",
+				);
+			}
+			const clientId = slice.clientId;
+			const clientSecret = slice.clientSecret;
+			const callbackURL = slice.callbackURL;
+			if (
+				typeof clientId !== "string" ||
+				typeof clientSecret !== "string" ||
+				typeof callbackURL !== "string"
+			) {
+				throw new Error(
+					"federations.google requires clientId, clientSecret, callbackURL when enabled",
+				);
+			}
+			return { clientId, clientSecret, callbackURL };
+		},
+	},
+});

package/templates/standalone/tests/index.test.js

@@ -172,8 +172,8 @@ describe("POST /oauth/token", () => {
 		expect(res.status).toBe(400);
 	});
 
-	it("returns 400 for grant_type=authorization without a code", async () => {
-		const res = await client.post("/oauth/token", "grant_type=authorization", {
+	it("returns 400 for grant_type=authorization_code without a code", async () => {
+		const res = await client.post("/oauth/token", "grant_type=authorization_code", {
 			headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		});
 		expect(res.status).toBe(400);

package/templates/standalone/tests/package.json

@@ -7,7 +7,6 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@noble/ed25519": "^3.0.1",
 		"axios": "^1.6.0",
 		"jsonwebtoken": "^9.0.3"
 	},

package/templates/standalone/tsconfig.json

@@ -1,6 +1,17 @@
 {
-	"extends": "../../tsconfig.base.json",
 	"compilerOptions": {
+		"target": "esnext",
+		"lib": ["esnext"],
+		"module": "nodenext",
+		"moduleResolution": "nodenext",
+		"declarationMap": true,
+		"declaration": true,
+		"emitDeclarationOnly": false,
+		"strict": true,
+		"forceConsistentCasingInFileNames": true,
+		"allowArbitraryExtensions": true,
+		"esModuleInterop": true,
+		"skipLibCheck": true,
 		"rootDir": "./src",
 		"outDir": "./dist",
 		"paths": {

package/templates/versions.json

@@ -1,9 +1,10 @@
 {
-	"@o3co/auth-provider-core": "0.0.0",
-	"@o3co/auth-provider-did": "0.0.0",
-	"@o3co/auth-provider-federation-google": "0.0.0",
-	"@o3co/auth-provider-federation-github": "0.0.0",
-	"@o3co/auth-provider-oauth": "0.0.0",
-	"@o3co/auth-provider-session": "0.0.0",
-	"@o3co/auth-provider-foundation": "0.0.0"
+	"@o3co/auth-provider-core": "0.5.1",
+	"@o3co/auth-provider-federation-google": "0.5.1",
+	"@o3co/auth-provider-federation-github": "0.5.1",
+	"@o3co/auth-provider-oauth": "0.5.1",
+	"@o3co/auth-provider-oauth-token-exchange": "0.5.1",
+	"@o3co/auth-provider-session": "0.5.1",
+	"@o3co/auth-provider-foundation": "0.5.1",
+	"@o3co/auth-provider-redis": "0.5.1"
 }

package/templates/standalone/tests/did-grant.test.js

@@ -1,193 +0,0 @@
-/*
- * Copyright 2026 1o1 Co. Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-import crypto from "node:crypto";
-import * as ed from "@noble/ed25519";
-import axios from "axios";
-import { describe, expect, it } from "vitest";
-
-const BASE_URL = process.env.API_BASE_URL || "http://localhost:3000";
-
-const client = axios.create({
-	baseURL: BASE_URL,
-	validateStatus: () => true,
-});
-
-// Helper: generate a valid DID auth request body
-const createDidAuthRequest = async (overrides = {}) => {
-	const privateKey = ed.utils.randomPrivateKey();
-	const publicKey = await ed.getPublicKeyAsync(privateKey);
-
-	const did = "did:example:registry.example.com:org:test";
-	const nonce = crypto.randomUUID();
-	const timestamp = new Date().toISOString();
-	const audience = "https://api.example.com";
-
-	const message = JSON.stringify({ did, timestamp, nonce, audience });
-	const messageBytes = new TextEncoder().encode(message);
-	const signature = await ed.signAsync(messageBytes, privateKey);
-
-	return {
-		grant_type: "did",
-		did,
-		signature: Buffer.from(signature).toString("base64"),
-		message,
-		publicKey: Buffer.from(publicKey).toString("base64"),
-		// Expose internals for test manipulation
-		_privateKey: privateKey,
-		_publicKey: publicKey,
-		_nonce: nonce,
-		...overrides,
-	};
-};
-
-describe("POST /oauth/token grant_type=did", () => {
-	it("returns a JWT access token for a valid DID authentication", async () => {
-		const body = await createDidAuthRequest();
-		const res = await client.post("/oauth/token", body);
-
-		expect(res.status).toBe(200);
-		expect(res.data.access_token).toBeDefined();
-		expect(res.data.token_type).toBe("Bearer");
-		// M2M: no refresh token
-		expect(res.data.refresh_token).toBeUndefined();
-	});
-
-	it("returns 401 for an invalid signature", async () => {
-		const body = await createDidAuthRequest();
-		// Corrupt the signature
-		body.signature = Buffer.from(
-			"invalid-signature-data-that-is-long-enough-to-be-64-bytes-padding!!",
-		).toString("base64");
-
-		const res = await client.post("/oauth/token", body);
-		expect(res.status).toBe(401);
-		expect(res.data.error).toBe("invalid_grant");
-	});
-
-	it("returns 400 for an expired timestamp", async () => {
-		const privateKey = ed.utils.randomPrivateKey();
-		const publicKey = await ed.getPublicKeyAsync(privateKey);
-
-		const did = "did:example:registry.example.com:org:test";
-		// Timestamp 10 minutes ago (exceeds 5 minute max age)
-		const timestamp = new Date(Date.now() - 10 * 60 * 1000).toISOString();
-		const nonce = crypto.randomUUID();
-
-		const message = JSON.stringify({ did, timestamp, nonce });
-		const messageBytes = new TextEncoder().encode(message);
-		const signature = await ed.signAsync(messageBytes, privateKey);
-
-		const res = await client.post("/oauth/token", {
-			grant_type: "did",
-			did,
-			signature: Buffer.from(signature).toString("base64"),
-			message,
-			publicKey: Buffer.from(publicKey).toString("base64"),
-		});
-
-		expect(res.status).toBe(400);
-		expect(res.data.error).toBe("invalid_request");
-		expect(res.data.error_description).toContain("timestamp");
-	});
-
-	it("returns 400 on nonce replay (same nonce used twice)", async () => {
-		const body = await createDidAuthRequest();
-
-		// First request should succeed
-		const res1 = await client.post("/oauth/token", body);
-		expect(res1.status).toBe(200);
-
-		// Second request with the same body (same nonce) should fail
-		const res2 = await client.post("/oauth/token", body);
-		expect(res2.status).toBe(400);
-		expect(res2.data.error).toBe("invalid_request");
-		expect(res2.data.error_description).toContain("nonce");
-	});
-
-	it("returns 400 when required fields are missing", async () => {
-		// Missing did
-		const res1 = await client.post("/oauth/token", {
-			grant_type: "did",
-			signature: "abc",
-			message: "{}",
-		});
-		expect(res1.status).toBe(400);
-		expect(res1.data.error).toBe("invalid_request");
-
-		// Missing signature
-		const res2 = await client.post("/oauth/token", {
-			grant_type: "did",
-			did: "did:example:test",
-			message: "{}",
-		});
-		expect(res2.status).toBe(400);
-
-		// Missing message
-		const res3 = await client.post("/oauth/token", {
-			grant_type: "did",
-			did: "did:example:test",
-			signature: "abc",
-		});
-		expect(res3.status).toBe(400);
-	});
-
-	it("returns 400 when message is not valid JSON", async () => {
-		const res = await client.post("/oauth/token", {
-			grant_type: "did",
-			did: "did:example:test",
-			signature: "abc",
-			message: "not-json",
-			publicKey: "abc",
-		});
-		expect(res.status).toBe(400);
-		expect(res.data.error_description).toContain("valid JSON");
-	});
-
-	it("returns 400 when message.did does not match top-level did", async () => {
-		const res = await client.post("/oauth/token", {
-			grant_type: "did",
-			did: "did:example:one",
-			signature: "abc",
-			message: JSON.stringify({
-				did: "did:example:other",
-				timestamp: new Date().toISOString(),
-				nonce: crypto.randomUUID(),
-			}),
-			publicKey: "abc",
-		});
-		expect(res.status).toBe(400);
-		expect(res.data.error_description).toContain("must match");
-	});
-
-	it("returns 400 when publicKey is missing", async () => {
-		const did = "did:example:test";
-		const message = JSON.stringify({
-			did,
-			timestamp: new Date().toISOString(),
-			nonce: crypto.randomUUID(),
-		});
-
-		const res = await client.post("/oauth/token", {
-			grant_type: "did",
-			did,
-			signature: "abc",
-			message,
-		});
-		expect(res.status).toBe(400);
-		expect(res.data.error_description).toContain("publicKey");
-	});
-});