@o3co/create-auth-provider 0.8.0 → 0.9.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-provider",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Scaffold a new o3co/auth.provider project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,8 +28,8 @@
     "node": ">=18.19.0"
   },
   "devDependencies": {
-    "@types/node": "^25.7.0",
-    "vitest": "^4.1.6"
+    "@types/node": "^25.9.1",
+    "vitest": "^4.1.8"
   },
   "scripts": {
     "build": "tsc",

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-provider-standalone",
-	"version": "0.8.0",
+	"version": "0.9.0",
 	"private": true,
 	"license": "Apache-2.0",
 	"engines": {
@@ -28,24 +28,24 @@
 		"@o3co/auth-provider-foundation": "workspace:*",
 		"@o3co/auth-provider-redis": "workspace:*",
 		"@o3co/auth.utils": "^0.0.4",
-		"@o3co/ts.hocon": "^1.1.0",
+		"@o3co/ts.hocon": "^1.2.0",
 		"connect-redis": "^9.0.0",
 		"express": "^5.2.1",
 		"express-session": "^1.19.0",
 		"helmet": "^8.1.0",
-		"ioredis": "^5.4.1",
+		"ioredis": "^5.11.0",
 		"pino": "^10.3.1",
 		"redis": "^5.12.1"
 	},
 	"devDependencies": {
 		"@types/express": "^5.0.6",
 		"@types/express-session": "^1",
-		"@types/node": "^25.7.0",
+		"@types/node": "^25.9.1",
 		"@types/supertest": "^7.2.0",
 		"supertest": "^7.1.0",
-		"tsx": "^4.21.0",
+		"tsx": "^4.22.3",
 		"typescript": "^5.9.3",
-		"vitest": "^4.1.6"
+		"vitest": "^4.1.8"
 	},
 	"pnpm": {
 		"onlyBuiltDependencies": [

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -222,6 +222,42 @@ describe("standalone smoke test", () => {
 		expect(res.status).toBe(200);
 	});
 
+	it("issuer-configured buildModules serves the advertised jwks_uri (discovery <-> JWKS presence contract)", async () => {
+		// Guards the cross-module contract end-to-end against the REAL composition
+		// root: core's `jwksModule` contributes `jwks_uri` to discovery AND mounts
+		// the JWKS route, while `oauthModule` contributes the provider endpoints;
+		// core's aggregator assembles the document. If `buildModules` ever drops
+		// `jwksModule`, the issuer-configured composition now fails the discovery
+		// presence contract at boot (missing `jwks_uri`) — this test fails (RED) in
+		// that case. (The oauth package's integration test hand-composes both
+		// modules, so only a scaffold-level test like this can catch the
+		// composition root forgetting to wire jwksModule.)
+		const issuerConfig: AppConfig = {
+			...config,
+			oauth: {
+				...config.oauth,
+				jwt: { ...config.oauth.jwt, issuer: "https://auth.example.com" },
+			},
+		};
+		const handle = await createApp({
+			modules: buildModules(issuerConfig, {
+				keyStoreModule: testKeyStoreModule,
+				repositoriesModule: testRepositoriesModule,
+				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+			}),
+			bootstrapComponents: { config: issuerConfig, pathResolver: (s) => s },
+		});
+		handleRef = handle;
+		const app = express();
+		app.use(handle.router);
+		const disco = await request(app).get("/.well-known/openid-configuration");
+		expect(disco.status).toBe(200);
+		const jwksPath = new URL(disco.body.jwks_uri as string).pathname;
+		const res = await request(app).get(jwksPath);
+		expect(res.status).toBe(200);
+		expect(Array.isArray(res.body.keys)).toBe(true);
+	});
+
 	it("POST /oauth/token with unsupported grant_type returns 400", async () => {
 		const { app, handle } = await buildApp();
 		handleRef = handle;

package/templates/standalone/src/buildModules.mts

@@ -17,6 +17,7 @@ import {
 	type AppConfig,
 	defaultRefreshTokenFamilyRevocationModule,
 	defaultRefreshTokenFamilyRotationModule,
+	jwksModule,
 	type Module,
 	memoryRateLimiterModule,
 } from "@o3co/auth-provider-core";
@@ -165,6 +166,13 @@ export function buildModules(config: AppConfig, overrides: BuildModulesOverrides
 		oauthModule({ config }),
 		oauthSessionModule({ config }),
 		oauthAuthorizationModule({ config }),
+		// JWKS publishing — always wired (depends only on config + keyStore).
+		// Contributed by core's `jwksModule`, NOT oauthModule: a provider that
+		// signs tokens must publish its verification keys regardless of OIDC
+		// issuer config. Co-installed with oauthModule so the discovery
+		// `jwks_uri` (advertised by oauthModule when an issuer is set) always
+		// resolves to this mounted route.
+		jwksModule,
 		sessionModule,
 		...(googleEnabled ? [googleFederationModule, googleFederationConfigModule] : []),
 		overrides.keyStoreModule ?? keyStoreModule,

package/templates/versions.json

@@ -1,13 +1,13 @@
 {
-	"@o3co/auth-provider-core": "0.8.0",
-	"@o3co/auth-provider-dpop": "0.8.0",
-	"@o3co/auth-provider-mtls": "0.8.0",
-	"@o3co/auth-provider-federation-google": "0.8.0",
-	"@o3co/auth-provider-federation-github": "0.8.0",
-	"@o3co/auth-provider-oauth": "0.8.0",
-	"@o3co/auth-provider-oauth-token-exchange": "0.8.0",
-	"@o3co/auth-provider-session": "0.8.0",
-	"@o3co/auth-provider-foundation": "0.8.0",
-	"@o3co/auth-provider-redis": "0.8.0",
-	"@o3co/auth-provider-webauthn": "0.8.0"
+	"@o3co/auth-provider-core": "0.9.0",
+	"@o3co/auth-provider-dpop": "0.9.0",
+	"@o3co/auth-provider-mtls": "0.9.0",
+	"@o3co/auth-provider-federation-google": "0.9.0",
+	"@o3co/auth-provider-federation-github": "0.9.0",
+	"@o3co/auth-provider-oauth": "0.9.0",
+	"@o3co/auth-provider-oauth-token-exchange": "0.9.0",
+	"@o3co/auth-provider-session": "0.9.0",
+	"@o3co/auth-provider-foundation": "0.9.0",
+	"@o3co/auth-provider-redis": "0.9.0",
+	"@o3co/auth-provider-webauthn": "0.9.0"
 }