@o3co/create-auth-provider 0.9.0 → 0.11.0

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -14,11 +14,14 @@
  * limitations under the License.
  */
 
+import { generateKeyPairSync } from "node:crypto";
 import { readFileSync } from "node:fs";
 import {
 	type AppConfig,
 	createApp,
+	createHealthcheckRouter,
 	createKeyStoreFactory,
+	createReadinessRouter,
 	defineModule,
 	generateToken,
 	InMemoryClientRepository,
@@ -33,17 +36,28 @@ import { buildModules } from "../buildModules.mjs";
 
 const dockerfile = readFileSync(new URL("../../Dockerfile", import.meta.url), "utf8");
 
+// #282: the template's shipped default is EdDSA with a published JWKS, so the
+// smoke test signs the way a real deployment of this scaffold does. Generated
+// per run — no key material is committed.
+const smokeKeyPair = generateKeyPairSync("ed25519", {
+	publicKeyEncoding: { type: "spki", format: "pem" },
+	privateKeyEncoding: { type: "pkcs8", format: "pem" },
+});
+
 const config: AppConfig = {
-	http: { port: 0, trustProxy: false },
+	http: { port: 0, trustProxy: false, readinessTimeoutMs: 1000 },
+	logging: { level: "silent" },
 	oauth: {
 		jwt: {
+			issuer: "https://auth.test",
 			signingKey: {
 				provider: "local",
 				local: {
-					algorithm: "HS256",
-					secret: "test-secret-for-smoke-test",
+					algorithm: "EdDSA",
 					kid: "v0",
-					previousSecrets: [],
+					privateKey: smokeKeyPair.privateKey,
+					publicKey: smokeKeyPair.publicKey,
+					previousKeys: [],
 				},
 			},
 		},
@@ -55,6 +69,8 @@ const config: AppConfig = {
 		},
 		grants: {},
 		oidcMode: "oidc-required",
+		// #330: no `authorize` section — the `allowUnmarkedClients` migration
+		// flag was removed; the first-party invariant is unconditional.
 		// OR-9: explicit memory adapter for the smoke test. The legacy
 		// `repositories.code.type` fallback would also pick memory here,
 		// but the explicit setting documents the intent and avoids
@@ -62,7 +78,8 @@ const config: AppConfig = {
 		code: { adapter: "memory" as const },
 	},
 	session: {
-		secret: "test-session-secret",
+		// #282: `session.secret` carries a 256-bit entropy floor.
+		secret: "test-session-secret.at-least-32-bytes.ok",
 		name: "auth.sid",
 		maxAge: 3600000,
 		secure: false,
@@ -173,9 +190,13 @@ describe("standalone smoke test", () => {
 		});
 
 		const app = express();
-		app.get("/_healthcheck", (_req, res) => {
-			res.status(200).json({ status: "ok" });
-		});
+		app.use(createHealthcheckRouter(express));
+		app.use(
+			createReadinessRouter(express, {
+				probes: handle.readinessProbes,
+				timeoutMs: config.http.readinessTimeoutMs,
+			}),
+		);
 		app.use(handle.router);
 		return { app, handle };
 	}
@@ -208,11 +229,34 @@ describe("standalone smoke test", () => {
 		expect(dockerfile).toMatch(
 			/CMD\s+wget\s+-q\s+-O\s+\/dev\/null\s+"http:\/\/localhost:[$]\{HTTP_PORT\}\/_healthcheck"\s+\|\|\s+exit\s+1/,
 		);
-		expect(dockerfile).toMatch(/FROM node-base AS deps[\s\S]*USER node[\s\S]*RUN pnpm install/);
+		expect(dockerfile).toMatch(
+			/FROM node-base AS deps[\s\S]*USER node[\s\S]*RUN pnpm install --frozen-lockfile/,
+		);
 		expect(dockerfile).toMatch(/FROM deps AS builder[\s\S]*USER node[\s\S]*RUN pnpm run build/);
+		// #289: dependencies are resolved exactly once, in `deps`. The runtime
+		// stage must take its node_modules from a prune of that same tree — a
+		// second `pnpm install` would be a second resolution, so its absence
+		// after the runtime FROM is part of the contract.
+		expect(dockerfile).toMatch(
+			/FROM deps AS prod-deps[\s\S]*USER node[\s\S]*RUN pnpm prune --prod/,
+		);
 		expect(dockerfile).toMatch(
-			/FROM node-base AS runtime[\s\S]*USER node[\s\S]*RUN pnpm install --prod/,
+			/FROM node-base AS runtime[\s\S]*COPY --from=prod-deps[\s\S]*USER node/,
 		);
+		expect(dockerfile.slice(dockerfile.indexOf("FROM node-base AS runtime"))).not.toContain(
+			"pnpm install",
+		);
+	});
+
+	it("Dockerfile pins its mutable build inputs (#289)", () => {
+		// Base image by digest — the tag alone is a moving pointer, and
+		// Dependabot's docker ecosystem bumps tag and digest together.
+		expect(dockerfile).toMatch(/FROM node:24-alpine@sha256:[0-9a-f]{64} AS node-base/);
+		// Global corepack by version — `npm install -g corepack` with no pin
+		// resolved whatever was latest at build time.
+		expect(dockerfile).toMatch(/npm install -g corepack@\d+\.\d+\.\d+ --force/);
+		// The lockfile is a required build input for --frozen-lockfile.
+		expect(dockerfile).toMatch(/COPY --chown=node:node package\.json pnpm-lock\.yaml/);
 	});
 
 	it("GET /_healthcheck returns 200", async () => {
@@ -222,6 +266,39 @@ describe("standalone smoke test", () => {
 		expect(res.status).toBe(200);
 	});
 
+	it("GET /readyz returns 200 for a memory-only composition with no probes", async () => {
+		// These smoke modules are all in-memory, so nothing registers a probe.
+		// Readiness must not invent a dependency that is not wired.
+		const { app, handle } = await buildApp();
+		handleRef = handle;
+		const res = await request(app).get("/readyz");
+		expect(res.status).toBe(200);
+		expect(res.body).toEqual({ status: "ready", checks: [] });
+	});
+
+	it("GET /readyz returns 503 naming the dependency when a probe fails", async () => {
+		const { handle } = await buildApp();
+		handleRef = handle;
+		const app = express();
+		app.use(
+			createReadinessRouter(express, {
+				probes: [
+					{
+						name: "redis",
+						check: async () => {
+							throw new Error("ECONNREFUSED");
+						},
+					},
+				],
+				timeoutMs: config.http.readinessTimeoutMs,
+			}),
+		);
+		const res = await request(app).get("/readyz");
+		expect(res.status).toBe(503);
+		expect(res.body.status).toBe("unready");
+		expect(res.body.checks[0].name).toBe("redis");
+	});
+
 	it("issuer-configured buildModules serves the advertised jwks_uri (discovery <-> JWKS presence contract)", async () => {
 		// Guards the cross-module contract end-to-end against the REAL composition
 		// root: core's `jwksModule` contributes `jwks_uri` to discovery AND mounts
@@ -256,6 +333,12 @@ describe("standalone smoke test", () => {
 		const res = await request(app).get(jwksPath);
 		expect(res.status).toBe(200);
 		expect(Array.isArray(res.body.keys)).toBe(true);
+		// #282: presence is no longer enough — the advertised jwks_uri must
+		// publish an actual verification key, and never the private half.
+		expect(res.body.keys).toHaveLength(1);
+		expect(res.body.keys[0].alg).toBe("EdDSA");
+		expect(res.body.keys[0].kid).toBe("v0");
+		expect(res.body.keys[0].d).toBeUndefined();
 	});
 
 	it("POST /oauth/token with unsupported grant_type returns 400", async () => {
@@ -386,6 +469,117 @@ describe("standalone smoke test", () => {
 			expect(names).not.toContain("standalone:stores");
 			expect(names).toContain("standalone:redis-clients");
 		});
+
+		// #321's `redisSessionStoresModule` requires the two subject-level client
+		// slots (`subjectSessionIndexClient`, `subjectRevocationClient`) its
+		// adapters consume, and the scaffold's shared ioredis module did not
+		// provide them — so `userSessionStores.adapter = "redis"`, the
+		// template's own multi-replica path, failed stage-1 boot with
+		// `missing-required-component`. Nothing here booted that branch: the
+		// tests above check which modules are selected, not whether the
+		// selection is satisfiable. This pins the invariant the shared clients
+		// module exists for: every `*Client` slot any selected module requires
+		// is one it provides.
+		it("standalone:redis-clients provides every *Client slot the Redis branches require", () => {
+			const allRedisConfig = {
+				...config,
+				userSessionStores: { adapter: "redis" as const },
+				rateLimiter: { adapter: "redis" as const },
+				accessTokenDenylist: { adapter: "redis" as const },
+				oauth: { ...config.oauth, code: { adapter: "redis" as const } },
+			};
+			// No `refreshTokenFamilyModules` override: the default is the Redis
+			// RT-family store, so `refreshTokenFamilyClient` is part of what the
+			// invariant covers. Still hermetic — buildModules opens no socket.
+			const modules = buildModules(allRedisConfig, {
+				keyStoreModule: testKeyStoreModule,
+				repositoriesModule: testRepositoriesModule,
+			});
+			const clients = modules.find((m) => m.name === "standalone:redis-clients");
+			expect(clients).toBeDefined();
+			const provided = new Set(Object.keys(clients?.provides ?? {}));
+			const requiredClientSlots = new Set(
+				modules.flatMap((m) => [...(m.requires ?? [])]).filter((key) => key.endsWith("Client")),
+			);
+			expect(requiredClientSlots.size).toBeGreaterThan(0);
+			const missing = [...requiredClientSlots].filter((key) => !provided.has(key));
+			expect(missing).toEqual([]);
+		});
+	});
+
+	// #277: the scaffold used to wire NO access-token denylist, so the
+	// `/oauth/revoke` it shipped answered 200 for an access token and left the
+	// JWT working until expiry. The template now always wires one, and its own
+	// application.conf selects the Redis-backed adapter — the memory one forks
+	// per replica and `deployment.mode = "multi"` refuses it.
+	describe("#277: access-token denylist wiring", () => {
+		it("always wires a denylist, so /oauth/revoke can keep its promise", () => {
+			const modules = buildModules(config, {
+				keyStoreModule: testKeyStoreModule,
+				repositoriesModule: testRepositoriesModule,
+				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+			});
+			const providesDenylist = modules.filter((m) =>
+				Object.keys(m.provides ?? {}).includes("accessTokenDenylist"),
+			);
+			expect(providesDenylist).toHaveLength(1);
+		});
+
+		it("defaults to the memory denylist when no adapter is configured", () => {
+			const modules = buildModules(config, {
+				keyStoreModule: testKeyStoreModule,
+				repositoriesModule: testRepositoriesModule,
+				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+			});
+			const names = modules.map((m) => m.name);
+			expect(names).toContain("core-access-token-denylist-memory");
+			expect(names).not.toContain("redis-access-token-denylist");
+		});
+
+		it("switches to the Redis denylist when accessTokenDenylist.adapter = 'redis'", () => {
+			const redisDenylistConfig = {
+				...config,
+				accessTokenDenylist: { adapter: "redis" as const },
+			};
+			const modules = buildModules(redisDenylistConfig, {
+				keyStoreModule: testKeyStoreModule,
+				repositoriesModule: testRepositoriesModule,
+				refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+			});
+			const names = modules.map((m) => m.name);
+			expect(names).toContain("redis-access-token-denylist");
+			expect(names).not.toContain("core-access-token-denylist-memory");
+			// The Redis branch must also pull in the shared ioredis socket, or the
+			// `accessTokenDenylistClient` slot has no provider and boot fails on a
+			// missing component instead of on the thing the operator changed.
+			expect(names).toContain("standalone:redis-clients");
+		});
+
+		it("the shipped application.conf selects the replica-safe adapter", () => {
+			// The template's own config is the artifact operators deploy. It runs
+			// with `deployment.mode = multi` in the umbrella E2E, which refuses
+			// every in-memory shared store — so shipping the memory denylist here
+			// would be a boot failure in the very stack that proves the scaffold
+			// works.
+			const conf = readFileSync(new URL("../../config/application.conf", import.meta.url), "utf8");
+			expect(conf).toMatch(/accessTokenDenylist\s*\{[\s\S]*?adapter\s*=\s*"redis"/);
+		});
+
+		it("keeps the composition boot-valid end to end", async () => {
+			// The core boot guard (#277 step 13.9) refuses a composition that reads
+			// the denylist slot without one. A scaffold that trips its own library's
+			// guard is not a scaffold.
+			const handle = await createApp({
+				modules: buildModules(config, {
+					keyStoreModule: testKeyStoreModule,
+					repositoriesModule: testRepositoriesModule,
+					refreshTokenFamilyModules: [memoryRefreshTokenFamilyStoreModule],
+				}),
+				bootstrapComponents: { config, pathResolver: (s) => s },
+			});
+			handleRef = handle;
+			expect(handle).toBeDefined();
+		});
 	});
 
 	// OR-9 (Wave 5d): adapter switch for the OAuth code repository. Closes
@@ -476,9 +670,17 @@ describe("standalone smoke test", () => {
 			type: "local",
 			...(config.oauth.jwt.signingKey.local ?? {}),
 		});
+		// The token must carry the deployment's configured `iss`: introspection
+		// pins it (RFC 9068 §4), and since #266 every deployment has one.
 		const { token } = await generateToken(
 			{},
-			{ keyStore, subject: "u1", expiresIn: 3600, tokenType: "at+jwt" },
+			{
+				keyStore,
+				subject: "u1",
+				expiresIn: 3600,
+				tokenType: "at+jwt",
+				issuer: config.oauth.jwt.issuer,
+			},
 		);
 
 		const res = await request(app)

package/templates/standalone/src/__tests__/terminal-error.test.mts

@@ -0,0 +1,96 @@
+/*
+ * Copyright 2026 1o1 Co. Ltd.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { Logger } from "@o3co/auth-provider-core";
+import express from "express";
+import request from "supertest";
+import { describe, expect, it, vi } from "vitest";
+import { createTerminalErrorHandler } from "../terminalError.mjs";
+
+const makeLogger = () => {
+	const error = vi.fn();
+	const logger = {
+		error,
+		warn: vi.fn(),
+		info: vi.fn(),
+		debug: vi.fn(),
+	} as unknown as Logger;
+	return { logger, error };
+};
+
+const makeApp = (logger: Logger) => {
+	const app = express();
+	app.use(express.json());
+	app.post("/echo", (_req, res) => {
+		res.status(200).json({ ok: true });
+	});
+	app.get("/boom", () => {
+		throw new Error("route exploded");
+	});
+	app.use(createTerminalErrorHandler(logger));
+	return app;
+};
+
+describe("terminal error handler (#293 item 8)", () => {
+	it("answers malformed JSON with the client's 400 in the shared envelope, not Express's HTML page", async () => {
+		const { logger, error } = makeLogger();
+		const res = await request(makeApp(logger))
+			.post("/echo")
+			.set("Content-Type", "application/json")
+			.send("{not json");
+
+		expect(res.status).toBe(400);
+		expect(res.headers["content-type"]).toContain("application/json");
+		expect(res.body.error).toBe("invalid_request");
+		// The client's malformed body is not a server error worth an error line.
+		expect(error).not.toHaveBeenCalled();
+	});
+
+	it("keeps the body parser's own status for an over-limit body (413)", async () => {
+		const { logger } = makeLogger();
+		const app = express();
+		app.use(express.json({ limit: 16 }));
+		app.post("/echo", (_req, res) => {
+			res.status(200).json({ ok: true });
+		});
+		app.use(createTerminalErrorHandler(logger));
+
+		const res = await request(app)
+			.post("/echo")
+			.set("Content-Type", "application/json")
+			.send(JSON.stringify({ pad: "x".repeat(64) }));
+
+		expect(res.status).toBe(413);
+		expect(res.body.error).toBe("invalid_request");
+		expect(res.body.error_description).toBe("request body too large");
+	});
+
+	it("answers an unexpected route throw with 500 server_error and logs it structurally", async () => {
+		const { logger, error } = makeLogger();
+		const res = await request(makeApp(logger)).get("/boom");
+
+		expect(res.status).toBe(500);
+		expect(res.body).toEqual({
+			error: "server_error",
+			error_description: "Internal server error",
+		});
+		// No stack trace on the wire — the envelope is the whole body.
+		expect(JSON.stringify(res.body)).not.toContain("route exploded");
+		expect(error).toHaveBeenCalledWith(
+			expect.objectContaining({ endpoint: "/boom" }),
+			"unhandled_request_error",
+		);
+	});
+});

package/templates/standalone/src/__tests__/three-tier-resolution.test.mts

@@ -19,6 +19,7 @@ import { type AppConfig, AppConfigSchema } from "@o3co/auth-provider-core";
 import { parseFile } from "@o3co/ts.hocon";
 import { validate } from "@o3co/ts.hocon/zod";
 import { describe, expect, it } from "vitest";
+import { buildModules } from "../buildModules.mjs";
 import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPath.mjs";
 
 // config/ is two levels above this test file:
@@ -26,10 +27,13 @@ import { resolveConfigPaths, resolveLibraryReferenceConfPath } from "../configPa
 const configDir = fileURLToPath(new URL("../../config", import.meta.url));
 
 // Provide required secrets so AppConfigSchema parse succeeds. These are
-// test-only values — no real keys are embedded here.
+// test-only values — no real keys are embedded here. #282: SESSION_SECRET
+// carries a 256-bit entropy floor, so these clear it (the '.' characters keep
+// them outside the base64 alphabet, so the UTF-8 length is what counts).
 const testEnv = {
-	OAUTH_JWT_SECRET: "test-secret-three-tier",
-	SESSION_SECRET: "test-session-secret-three-tier",
+	OAUTH_JWT_SECRET: "test-secret-three-tier.at-least-32-bytes.ok",
+	OAUTH_JWT_ISSUER: "https://auth.test",
+	SESSION_SECRET: "test-session-secret-three-tier.at-least-32-bytes.ok",
 };
 
 function buildResolvedConfig(env: string, extraEnv: Record<string, string> = {}): AppConfig {
@@ -75,10 +79,15 @@ describe("three-tier HOCON resolution (env → application.conf → reference.co
 		// so OAUTH_GRANTS_AUTHORIZATION_CODE_ENABLED=false reaches the resolved value.
 		// Without the repeated env line, the substitution at reference.conf is
 		// shadowed by the template's literal `true`.
-		// Note: ts.hocon substitutes env vars as strings; the schema (passthrough)
-		// preserves the string. The assertion checks the string form so that
-		// the precedence invariant is testable now; a future schema-coercion PR
-		// (separate from this one) will make this resolve to boolean false.
+		// Note: ts.hocon substitutes env vars as strings, and `oauth.grants` is
+		// `z.object({}).passthrough()` — an open tree each grant module's own
+		// `configSchema` validates — so no shape-walking coercion reaches this
+		// leaf and the string survives to the resolved config. #288 unified the
+		// coercion for every DECLARED boolean in the schema and deliberately
+		// left this one alone: every consumer of a grant's `enabled`
+		// (`GrantRegistry.isEnabled`, `oauthAuthorization`, `oauthSession`)
+		// already reads `true` and `"true"` as enabled and everything else,
+		// `"false"` included, as not-enabled.
 		const config = buildResolvedConfig("development", {
 			OAUTH_GRANTS_AUTHORIZATION_CODE_ENABLED: "false",
 		});
@@ -114,4 +123,105 @@ describe("three-tier HOCON resolution (env → application.conf → reference.co
 		});
 		expect(config.oauth.resourceIndicator?.enabled).toBe(true);
 	});
+
+	// #287 — the audit trail as the shipped artifact resolves it. The section is
+	// declared in core's schema for a load-bearing reason: `AppConfigSchema` is
+	// a plain `z.object` and strips what it does not declare, so an undeclared
+	// `audit` block would vanish between `parseFile` and `buildModules` and the
+	// sink selector would read `undefined` while the config sat in the file
+	// looking effective. These assertions run the real three-tier merge, so they
+	// fail if either layer stops carrying the key.
+	describe("#287: the audit sink as the shipped artifact resolves it", () => {
+		it("resolves audit.sink.type to the template's logger sink with nothing set", () => {
+			const config = buildResolvedConfig("production");
+			expect(config.audit?.sink.type).toBe("logger");
+		});
+
+		it("wires exactly one auditSink provider for that resolved config", () => {
+			const modules = buildModules(buildResolvedConfig("production"));
+			const providers = modules.filter((m) => Object.keys(m.provides ?? {}).includes("auditSink"));
+			expect(providers).toHaveLength(1);
+		});
+
+		it("lets an operator select core's built-in console sink by env var", () => {
+			// The env-override line has to be repeated at the template layer or
+			// the literal `"logger"` shadows reference.conf's substitution — the
+			// same precedence rule the grant tests above pin.
+			const config = buildResolvedConfig("production", { AUDIT_SINK_TYPE: "console" });
+			expect(config.audit?.sink.type).toBe("console");
+		});
+
+		it("reference.conf's own default is a sink, not a drop", () => {
+			// A consumer that resolves against reference.conf alone still lands on
+			// a sink. #304's sink policy is stdout JSON, never "none", and the
+			// library layer has to hold that on its own — a composition root that
+			// forgets to override it must not thereby lose its audit trail.
+			const referenceOnly = validate(
+				parseFile(resolveLibraryReferenceConfPath(), { env: testEnv }),
+				AppConfigSchema,
+			);
+			expect(referenceOnly.audit?.sink.type).toBe("console");
+		});
+	});
+
+	// #277 — this is the shape the umbrella E2E (o3co/auth) boots: the shipped
+	// application.conf, `DEPLOYMENT_MODE=multi`, and one shared ioredis socket.
+	// The assertions below are what keep that stack booting: a memory denylist
+	// under `multi` is refused by the replica-safety guard, and NO denylist is
+	// refused by the #277 guard, so the template has to land on "redis" without
+	// the deployment naming it.
+	describe("#277: access-token revocation as the shipped artifact resolves it", () => {
+		it("resolves accessTokenDenylist.adapter to redis with nothing set", () => {
+			const config = buildResolvedConfig("production");
+			expect(config.accessTokenDenylist?.adapter).toBe("redis");
+		});
+
+		it("resolves oauth.revocation.accessToken to denylist with nothing set", () => {
+			const config = buildResolvedConfig("production");
+			expect(config.oauth.revocation?.accessToken).toBe("denylist");
+		});
+
+		it("picks the replica-safe denylist module for that resolved config", () => {
+			const names = buildModules(buildResolvedConfig("production")).map((m) => m.name);
+			expect(names).toContain("redis-access-token-denylist");
+			expect(names).not.toContain("core-access-token-denylist-memory");
+		});
+
+		it("leaves nothing replica-unsafe under the umbrella E2E's environment", async () => {
+			// The environment `o3co/auth`'s tests/docker-compose.yml sets. Under
+			// `DEPLOYMENT_MODE=multi` the replica-safety guard fails boot naming
+			// every in-memory shared store, so the denylist this change adds has to
+			// come out of that environment as the Redis one — from the template's
+			// own config, since the compose file names no denylist variable.
+			// Asserted against the guard's own list rather than a module name, so a
+			// rename cannot quietly invalidate it.
+			const { REPLICA_UNSAFE_MODULES } = await import("@o3co/auth-provider-core");
+			const config = buildResolvedConfig("production", {
+				USER_SESSION_STORES_ADAPTER: "redis",
+				RATE_LIMITER_ADAPTER: "redis",
+				OAUTH_CODE_ADAPTER: "redis",
+			});
+			const names = buildModules(config).map((m) => m.name);
+			expect(names).toContain("redis-access-token-denylist");
+			for (const name of names) {
+				expect(REPLICA_UNSAFE_MODULES).not.toContain(name);
+			}
+		});
+
+		it("lets a single-instance deployment opt down to memory by env var", () => {
+			const config = buildResolvedConfig("production", {
+				ACCESS_TOKEN_DENYLIST_ADAPTER: "memory",
+			});
+			expect(config.accessTokenDenylist?.adapter).toBe("memory");
+			const names = buildModules(config).map((m) => m.name);
+			expect(names).toContain("core-access-token-denylist-memory");
+		});
+
+		it("lets a deployment declare access-token revocation unsupported by env var", () => {
+			const config = buildResolvedConfig("production", {
+				OAUTH_REVOCATION_ACCESS_TOKEN: "unsupported",
+			});
+			expect(config.oauth.revocation?.accessToken).toBe("unsupported");
+		});
+	});
 });