@owlmeans/client-auth 0.1.18-rc.2 → 0.1.18-rc.21

package/src/manager/components/authentication/control.ts

@@ -45,7 +45,7 @@ export const makeControl = (
       control.afterAuthenticate = plugins[control.type].afterAuthenticate
 
       const module = context.entrypoint<ClientEntrypoint<AllowanceResponse>>(AUTHEN_INIT)
-      const [allowance] = await module.call({ body: control.request })
+      const allowance = await module.call({ body: control.request })
 
       control.allowance = allowance
 
@@ -89,8 +89,8 @@ export const makeControl = (
         // We return back unwrapped challenge
         credentials.challenge = control.allowance?.challenge
 
-        const [token, status] = await context.entrypoint<ClientEntrypoint<AuthToken>>(AUTHEN_AUTHEN)
-          .call({ body: credentials })
+        const { value: token, outcome: status } = await context.entrypoint<ClientEntrypoint<AuthToken>>(AUTHEN_AUTHEN)
+          .invoke({ body: credentials })
 
         if (status === EntrypointOutcome.Ok && token.token != null
           && token.token !== '' && control.afterAuthenticate != null) {

package/src/manager/components/authentication/types.ts

@@ -2,7 +2,7 @@ import type {
   AllowanceRequest, AllowanceResponse, AuthCredentials, AuthenticationStage, AuthenticationType,
   AuthToken
 } from '@owlmeans/auth'
-import type { ModuleContextParams } from '@owlmeans/client'
+import type { EntrypointContextParams } from '@owlmeans/client'
 import type { FC } from 'react'
 import type { ClientContext } from '@owlmeans/client'
 import type { FlowService } from '@owlmeans/client-flow'
@@ -10,7 +10,7 @@ import type { ResilientError } from '@owlmeans/error'
 
 export type ClientAuthType = AuthenticationType | string
 
-export interface AuthenticationProps extends ModuleContextParams {
+export interface AuthenticationProps extends EntrypointContextParams {
   type?: ClientAuthType
   callback?: AuthenticationCallback
   source?: string

package/src/manager/components/tunnel-consumer.tsx

@@ -2,11 +2,11 @@ import { AuthenticationType } from '@owlmeans/auth'
 import { AuthenticationHOC } from './authentication/component.js'
 import type { FC } from 'react'
 import { useMemo } from 'react'
-import { useModule } from '@owlmeans/client'
+import { useEntrypoint } from '@owlmeans/client'
 import type { TunnelAuthenticationProps } from './types.js'
 
 export const TunnelConsumer: FC<Partial<TunnelAuthenticationProps>> = ({ ...props }) => {
-  const mod = useModule()
+  const mod = useEntrypoint()
   const Implementation = useMemo(
     () => AuthenticationHOC(undefined, AuthenticationType.WalletConsumer), []
   )

package/src/manager/{modules.ts → entrypoints.ts}

@@ -1,6 +1,6 @@
 
 import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER } from '@owlmeans/auth'
-import { modules as list } from '@owlmeans/auth-common'
+import { entrypoints as list } from '@owlmeans/auth-common'
 import { handler } from '@owlmeans/client'
 import { elevate, stab } from '@owlmeans/client-entrypoint'
 import { AuthenticationHOC } from './components/authentication/component.js'
@@ -13,6 +13,6 @@ elevate(list, CAUTHEN)
 elevate(list, CAUTHEN_AUTHEN)
 elevate(list, CAUTHEN_AUTHEN_DEFAULT, handler(AuthenticationHOC()))
 elevate(list, CAUTHEN_AUTHEN_TYPED, handler(AuthenticationHOC()))
-elevate(list, DISPATCHER, stab, { force: true })
+elevate(list, DISPATCHER, stab)
 
-export const modules = list
+export const entrypoints = list

package/src/manager/plugins/basic-ed25519.tsx

@@ -7,6 +7,13 @@ import { AuthenCredError } from '../errors.js'
 export const ed25519BasicUIPlugin: AuthenticationPlugin = {
   type: AuthenticationType.BasicEd25519,
 
+  method: { order: 300, icon: 'key', emphasis: 'secondary' },
+
+  // This package ships no UI family, so the form below is a `Renderer` a panel package assigns
+  // (`@owlmeans/web-panel/auth/plugins`, `@owlmeans/mui-panel/auth/plugins`). Until one does, the
+  // Implementation throws on mount — so the sign-in screen must not offer the method.
+  requiresRenderer: true,
+
   Implementation: Renderer => ({ type, stage, control, params }) => {
 
     type = type ?? AuthenticationType.BasicEd25519

package/src/manager/plugins/exports.ts

@@ -1,4 +1,6 @@
 export type * from './types.js'
+export * from './registry.js'
+export * from './methods.js'
 export * from './tunnel/index.js'
 export * from './basic-ed25519.js'
 export * from './re-captcha.js'

package/src/manager/plugins/index.ts

@@ -1,13 +1,19 @@
-import type { ClientAuthType } from '../components/index.js'
-
 import { AuthenticationType } from '@owlmeans/auth'
 import { ed25519BasicUIPlugin } from './basic-ed25519.js'
-import { AuthenticationPlugin } from './types.js'
 import { reCaptchaPlugin } from './re-captcha.js'
 import { tunnelConsumerUIPlugin } from './tunnel-consumer.js'
+import { pluginMethodSource } from './methods.js'
+import { registerMethodSource } from '../../login/methods.js'
+import { plugins } from './registry.js'
 
-export const plugins: { [type: ClientAuthType]: AuthenticationPlugin } = {}
+export { plugins, registerAuthPlugin, getAuthPlugin, listAuthPlugins } from './registry.js'
 
 plugins[AuthenticationType.BasicEd25519] = ed25519BasicUIPlugin
 plugins[AuthenticationType.ReCaptcha] = reCaptchaPlugin
 plugins[AuthenticationType.WalletConsumer] = tunnelConsumerUIPlugin
+
+// Registered from here, not from `login/`, so that importing `@owlmeans/client-auth/login` never
+// drags this module's React plugin implementations into a bundle that only wanted the login host.
+// A generated application imports the login subpath through `client-iam`; it must not gain three
+// authentication methods it never registered as a side effect of that.
+registerMethodSource(pluginMethodSource)

package/src/manager/plugins/methods.ts

@@ -0,0 +1,74 @@
+import { CAUTHEN_AUTHEN_TYPED } from '@owlmeans/auth'
+import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
+import { DEFAULT_METHOD_ORDER, LOGIN_SERVICE } from '../../login/consts.js'
+import type { LoginMethod, LoginMethodContext, LoginMethodSource, LoginService } from '../../login/types.js'
+import type { AuthenticationPlugin } from './types.js'
+import { listAuthPlugins } from './registry.js'
+
+/**
+ * Whether a registered plugin may be put on the sign-in screen of THIS application.
+ *
+ * The registry is global and is filled by side-effect imports, so "registered" means only that
+ * some module was pulled into the bundle — three separate reasons why that is not enough:
+ *
+ * 1. No `method`: `re-captcha` is a STEP inside another flow, not a way to sign in.
+ * 2. No renderer: a plugin that declares `requiresRenderer` throws the moment its screen mounts
+ *    unless a UI package (`web-panel`, `mui-panel`) assigned one. An app that imported the plugin
+ *    host without that package would be offering buttons whose only outcome is a broken page.
+ * 3. Not wired: a plugin whose flow needs a service its context never appended fails on the
+ *    lookup instead. Packages register their plugins in groups, so an app that wanted one of them
+ *    gets the rest too, and the rest have to be able to say they do not apply here.
+ */
+const offerable = (plugin: AuthenticationPlugin, ctx: LoginMethodContext): boolean => {
+  if (plugin.method == null || plugin.method.hidden === true) {
+    return false
+  }
+  if (plugin.requiresRenderer === true && plugin.Renderer == null) {
+    return false
+  }
+
+  return plugin.method.available?.(ctx) !== false
+}
+
+/**
+ * Every registered authentication plugin that declares itself offerable, as a sign-in method.
+ */
+export const pluginMethodSource: LoginMethodSource = {
+  alias: 'authentication-plugins',
+
+  list: ctx => listAuthPlugins()
+    .filter(plugin => offerable(plugin, ctx))
+    .map((plugin): LoginMethod => {
+      const meta = plugin.method!
+      const type = plugin.type
+      const id = meta.id ?? type
+
+      return {
+        id, type,
+        ...(meta.label != null ? { label: meta.label } : {}),
+        i18nKey: meta.i18nKey ?? id,
+        ...(meta.icon != null ? { icon: meta.icon } : {}),
+        order: meta.order ?? DEFAULT_METHOD_ORDER,
+        ...(meta.emphasis != null ? { emphasis: meta.emphasis } : {}),
+        ...(meta.restricted === true ? { restricted: true } : {}),
+        params: { type },
+
+        // Non-async through the whole chain: `login.begin` opens the surrogate window in its first
+        // statement, and a window opened after the gesture has been handled is blocked.
+        start: methodCtx => {
+          const login = methodCtx.context.service<LoginService>(LOGIN_SERVICE)
+          const entrypoint = methodCtx.context.entrypoint<ClientEntrypoint>(CAUTHEN_AUTHEN_TYPED)
+          const url = entrypoint.path().replace(':type', encodeURIComponent(type))
+
+          return login.begin({
+            url,
+            // In an ordinary tab this keeps the application mounted, exactly as the pre-chooser
+            // dispatcher did; the surrogate plugin ignores it and opens a window instead.
+            ...(methodCtx.navigate != null
+              ? { navigate: () => methodCtx.navigate?.(CAUTHEN_AUTHEN_TYPED, { type }) }
+              : {}),
+          })
+        },
+      }
+    }),
+}

package/src/manager/plugins/re-captcha.tsx

@@ -5,6 +5,13 @@ import { useEffect } from 'react'
 export const reCaptchaPlugin: AuthenticationPlugin = {
   type: AuthenticationType.ReCaptcha,
 
+  // A STEP inside another flow, never a way to sign in — so it is registered and never offered.
+  method: { hidden: true },
+
+  // Its widget is a `Renderer` a panel package assigns. `hidden` already keeps it off the sign-in
+  // screen; this is what the flow that DOES drive it can check before handing it a stage.
+  requiresRenderer: true,
+
   Implementation: Renderer => ({ type, stage, control, params }) => {
     Renderer = Renderer ?? reCaptchaPlugin.Renderer
 

package/src/manager/plugins/registry.ts

@@ -0,0 +1,26 @@
+import type { ClientAuthType } from '../components/authentication/types.js'
+import type { AuthenticationPlugin } from './types.js'
+
+/**
+ * The registry every authentication plugin lands in.
+ *
+ * It stays a plain exported object, and every registration stays a plain assignment, because four
+ * packages already write into it from side-effect imports (`web-oidc-rp`, `mui-oidc-rp`,
+ * `web-auth`, and this package's own `index`). Hiding it behind an API would break all of them for
+ * no gain — the functions below simply read it.
+ *
+ * It lives in its own module rather than in `index.ts` so that the method source can read it
+ * without the two importing each other.
+ */
+export const plugins: { [type: ClientAuthType]: AuthenticationPlugin } = {}
+
+export const registerAuthPlugin = (plugin: AuthenticationPlugin): AuthenticationPlugin => {
+  plugins[plugin.type] = plugin
+
+  return plugin
+}
+
+export const getAuthPlugin = (type: ClientAuthType): AuthenticationPlugin | undefined =>
+  plugins[type]
+
+export const listAuthPlugins = (): AuthenticationPlugin[] => Object.values(plugins)

package/src/manager/plugins/tunnel-consumer.tsx

@@ -13,6 +13,12 @@ import { createWalletFacade } from './tunnel/wallet.js'
 export const tunnelConsumerUIPlugin: AuthenticationPlugin = {
   type: AuthenticationType.WalletConsumer,
 
+  method: { order: 400, icon: 'wallet' },
+
+  // The PIN form is a `Renderer` a panel package assigns; without one the Implementation throws on
+  // mount, so the method must not be offered.
+  requiresRenderer: true,
+
   Implementation: renderer => ({ type, stage, control, params }) => {
     type = type ?? AuthenticationType.WalletConsumer
     const Renderer: TunnelAuthenticationRenderer | undefined = renderer

package/src/manager/plugins/types.ts

@@ -1,4 +1,6 @@
 import type { FC } from 'react'
+import type { LoginMethodEmphasis } from '@owlmeans/config'
+import type { LoginMethodContext } from '../../login/types.js'
 import type { AuthenticationControl, AuthenticationRenderer, AuthenticationRendererProps, } from '../components/authentication/types.js'
 
 export interface AuthenticationPlugin extends Pick<
@@ -7,6 +9,58 @@ export interface AuthenticationPlugin extends Pick<
   type: string
   Implementation: PluginImplemnetation
   Renderer?: AuthenticationRenderer
+  /**
+   * This plugin's `Implementation` cannot render without a `Renderer` a UI package supplies.
+   *
+   * It is declared rather than inferred because there is nothing to infer it from: a plugin that
+   * renders its own form and one that throws `Renderer is not defined` are the same object until
+   * the screen mounts. Declaring it is what lets the sign-in screen leave out a method whose
+   * renderer nobody registered, instead of offering a button that crashes the page it opens.
+   */
+  requiresRenderer?: boolean
+  /**
+   * How this method presents itself on the sign-in screen.
+   *
+   * Absent means the plugin is never OFFERED — it is still reachable by type, which is what a
+   * step-in-a-flow (re-captcha) and a plugin an app deep-links to both need. Every field is
+   * optional so an existing plugin object keeps type-checking without being touched.
+   */
+  method?: AuthMethodMeta
+}
+
+export interface AuthMethodMeta {
+  /** Defaults to the plugin's `type`. */
+  id?: string
+  /** Literal fallback used when no translation resolves. */
+  label?: string
+  /** Key under the `auth` library's `login.method.*`; defaults to the id. */
+  i18nKey?: string
+  /** Icon registry NAME, never markup — this package must stay free of an icon library. */
+  icon?: string
+  /** Ascending; default 100. */
+  order?: number
+  emphasis?: LoginMethodEmphasis
+  /**
+   * Never offered unless the configuration explicitly enables it.
+   *
+   * This is the secret-key gate: an operator login is registered like any other method and must
+   * not become offerable merely by being registered.
+   */
+  restricted?: boolean
+  /** Registered, but never a choice. */
+  hidden?: boolean
+  /**
+   * Whether the application this method is about to be offered in actually wired it.
+   *
+   * The plugin registry is global and is written to by side-effect imports, so being registered
+   * says only that some bundle pulled the module in — and modules arrive in groups. An app that
+   * wanted one method out of a package gets every method that package registers, including ones
+   * whose first act is to look up a service its context never appended. This is where a plugin
+   * says so, per context, at render time; `false` leaves it off the screen.
+   *
+   * Absent means "always", which is right for a plugin that needs nothing but itself.
+   */
+  available?: (ctx: LoginMethodContext) => boolean
 }
 
 export interface PluginImplemnetation {

package/src/service.ts

@@ -21,7 +21,7 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
     authenticate: async token => {
       const context = assertContext(service.ctx, location)
 
-      const [authToken] = await context.entrypoint<ClientEntrypoint<AuthToken>>(DISPATCHER_AUTHEN)
+      const authToken = await context.entrypoint<ClientEntrypoint<AuthToken>>(DISPATCHER_AUTHEN)
         .call({ body: token })
 
       await service.update(authToken.token)

package/tests/context.ts

@@ -1,4 +1,4 @@
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import type { BasicConfig, BasicContext } from '@owlmeans/context'
 import { createStaticResource } from '@owlmeans/static-resource'
 import { AUTH_RESOURCE, DEFAULT_ALIAS } from '../src/consts.js'
@@ -10,7 +10,6 @@ export const makeTestContext = () => {
   const cfg: BasicConfig = {
     ready: false,
     service: 'client-auth-tests',
-    layer: Layer.Application,
     type: AppType.Frontend,
     services: {},
   }

package/tests/login.spec.ts

@@ -0,0 +1,313 @@
+import { describe, test, expect } from 'bun:test'
+import { makeTestContext } from './context.js'
+import { appendLogin, makeLoginService } from '../src/login/service.js'
+import { resolveLoginMethods, primaryLoginMethod, registerMethodSource } from '../src/login/methods.js'
+import { resolveCredit } from '../src/login/credit.js'
+import { pluginMethodSource } from '../src/manager/plugins/methods.js'
+import { registerAuthPlugin } from '../src/manager/plugins/registry.js'
+import type { AuthenticationPlugin } from '../src/manager/plugins/types.js'
+import { resumeAction, ResumeAction, loginAttemptError } from '../src/login/resume.js'
+import { LoginOutcome } from '../src/login/types.js'
+import type {
+  LoginEnv, LoginMethod, LoginMethodContext, LoginPlugin, LoginService,
+} from '../src/login/types.js'
+import type { BasicContext, BasicConfig } from '@owlmeans/context'
+
+/**
+ * A hand-written environment descriptor.
+ *
+ * `LoginEnv` exists precisely so a plugin's decisions can be exercised without a DOM — a stubbed
+ * `window` would prove that the stub behaves, not that the cascade does.
+ */
+const env = (over?: Partial<LoginEnv>): LoginEnv => ({
+  hasWindow: true, embedded: false, surrogate: false, hasOpener: false, ...over,
+})
+
+const stubPlugin = (over: Partial<LoginPlugin> & { alias: string }): LoginPlugin => ({
+  begin: async () => LoginOutcome.Passed,
+  authorize: async () => LoginOutcome.Passed,
+  complete: async () => LoginOutcome.Passed,
+  ...over,
+})
+
+const bootstrap = (): [BasicContext<BasicConfig>, LoginService] => {
+  const context = makeTestContext()
+  const contextual = appendLogin(context)
+
+  return [context, contextual.login()]
+}
+
+const methodCtx = (context: BasicContext<BasicConfig>, over?: Partial<LoginEnv>): LoginMethodContext =>
+  ({ context, env: env(over) })
+
+const method = (over: Partial<LoginMethod> & { id: string }): LoginMethod => ({
+  start: async () => LoginOutcome.Passed, ...over,
+})
+
+describe('login plugin host', () => {
+  test('the cascade picks the highest-priority plugin whose match holds', () => {
+    const service = makeLoginService()
+    service.registerPlugin(stubPlugin({ alias: 'default', priority: 0, match: () => true }))
+    service.registerPlugin(stubPlugin({
+      alias: 'framed', priority: 100, match: candidate => candidate.embedded,
+    }))
+
+    expect(service.plugin(env()).alias).toBe('default')
+    expect(service.plugin(env({ embedded: true })).alias).toBe('framed')
+  })
+
+  test('a plugin with no resume yields Passed, so an ordinary tab is untouched', async () => {
+    const [, service] = bootstrap()
+    service.registerPlugin(stubPlugin({ alias: 'plain', match: () => true }))
+
+    expect(await service.resume('a-token')).toBe(LoginOutcome.Passed)
+  })
+
+  test('a plugin with a resume is asked instead', async () => {
+    const [, service] = bootstrap()
+    service.registerPlugin(stubPlugin({
+      alias: 'framed', match: () => true, resume: async () => LoginOutcome.Handled,
+    }))
+
+    expect(await service.resume('a-token')).toBe(LoginOutcome.Handled)
+  })
+
+  test('a refusing precondition stops the flow before any plugin runs', async () => {
+    const [, service] = bootstrap()
+    let started = false
+    service.registerPlugin(stubPlugin({
+      alias: 'plain', match: () => true,
+      begin: async () => { started = true; return LoginOutcome.Handled },
+    }))
+    service.registerPrecondition({ alias: 'refuse', check: () => false })
+
+    expect(await service.begin({ url: '/dispatcher' })).toBe(LoginOutcome.Gesture)
+    expect(started).toBe(false)
+  })
+
+  test('a passing precondition lets the plugin run', async () => {
+    const [, service] = bootstrap()
+    service.registerPlugin(stubPlugin({
+      alias: 'plain', match: () => true, begin: async () => LoginOutcome.Handled,
+    }))
+    service.registerPrecondition({ alias: 'allow', check: () => true })
+
+    expect(await service.begin({ url: '/dispatcher' })).toBe(LoginOutcome.Handled)
+  })
+
+  test('a plugin with no logout still ends the session it was asked to end', async () => {
+    const [context, service] = bootstrap()
+    context.configure()
+    await context.init()
+    service.registerPlugin(stubPlugin({ alias: 'plain', match: () => true }))
+    const auth = context.service<{ token?: string, update: (t?: string) => Promise<void> }>('auth')
+
+    expect(await service.logout({ url: '' })).toBe(LoginOutcome.Passed)
+    expect(auth.token == null || auth.token === '').toBe(true)
+  })
+})
+
+describe('login method resolution', () => {
+  test('methods sort by declared order, ties by id', () => {
+    const context = makeTestContext()
+    const source = {
+      alias: 'test', list: () => [
+        method({ id: 'b', order: 10 }), method({ id: 'a', order: 10 }), method({ id: 'z', order: 1 }),
+      ],
+    }
+
+    const resolved = resolveLoginMethods(methodCtx(context), undefined, [source])
+
+    expect(resolved.map(item => item.id)).toEqual(['z', 'a', 'b'])
+  })
+
+  test('a restricted method is not offered until the configuration asks for it', () => {
+    const context = makeTestContext()
+    const source = {
+      alias: 'test', list: () => [method({ id: 'ordinary' }), method({ id: 'operator', restricted: true })],
+    }
+
+    expect(resolveLoginMethods(methodCtx(context), undefined, [source]).map(m => m.id))
+      .toEqual(['ordinary'])
+    expect(resolveLoginMethods(
+      methodCtx(context), { overrides: { operator: { enabled: true } } }, [source]
+    ).map(m => m.id).sort()).toEqual(['operator', 'ordinary'])
+    expect(resolveLoginMethods(
+      methodCtx(context), { methods: ['operator'] }, [source]
+    ).map(m => m.id)).toEqual(['operator'])
+  })
+
+  test('an explicit list is both the filter and the order', () => {
+    const context = makeTestContext()
+    const source = {
+      alias: 'test', list: () => [method({ id: 'a' }), method({ id: 'b' }), method({ id: 'c' })],
+    }
+
+    expect(resolveLoginMethods(methodCtx(context), { methods: ['c', 'a'] }, [source]).map(m => m.id))
+      .toEqual(['c', 'a'])
+  })
+
+  test('a source that throws is skipped rather than taking the screen down', () => {
+    const context = makeTestContext()
+    const broken = { alias: 'broken', list: () => { throw new Error('misconfigured') } }
+    const working = { alias: 'working', list: () => [method({ id: 'ok' })] }
+
+    expect(resolveLoginMethods(methodCtx(context), undefined, [broken, working]).map(m => m.id))
+      .toEqual(['ok'])
+  })
+
+  test('the primary method is the first emphasised one, else the first', () => {
+    expect(primaryLoginMethod([
+      method({ id: 'a' }), method({ id: 'b', emphasis: 'primary' }),
+    ])?.id).toBe('b')
+    expect(primaryLoginMethod([method({ id: 'a' })])?.id).toBe('a')
+    expect(primaryLoginMethod([])).toBeNull()
+  })
+
+  test('a globally registered source reaches the resolver', () => {
+    const context = makeTestContext()
+    registerMethodSource({ alias: 'global-test', list: () => [method({ id: 'global' })] })
+
+    expect(resolveLoginMethods(methodCtx(context)).map(m => m.id)).toContain('global')
+  })
+})
+
+describe('the credit line', () => {
+  const year = new Date().getFullYear()
+
+  test('is a copyright NOTICE — the mark and the year, not a bare name', () => {
+    expect(resolveCredit({ product: 'OwlMeans', organization: 'OwlMeans' }).line)
+      .toBe(`© ${year} OwlMeans`)
+  })
+
+  test('pairs the product with the notice when the product is not the holder', () => {
+    expect(resolveCredit({ product: 'Taskly', organization: 'Acme' }).line)
+      .toBe(`Taskly — © ${year} Acme`)
+  })
+
+  test('falls back to the entity slug when the organization has no name', () => {
+    expect(resolveCredit({ product: 'Taskly', entity: 'acme-7f2' }).line)
+      .toBe(`Taskly — © ${year} acme-7f2`)
+  })
+
+  test('a first year in the past makes the notice a range', () => {
+    expect(resolveCredit({ organization: 'Acme', since: 2019 }).line).toBe(`© 2019–${year} Acme`)
+    // The current year is not a range, and neither is one a skewed clock puts ahead of it.
+    expect(resolveCredit({ organization: 'Acme', since: year }).line).toBe(`© ${year} Acme`)
+    expect(resolveCredit({ organization: 'Acme', since: year + 5 }).line).toBe(`© ${year} Acme`)
+  })
+
+  test('an explicit holder is who the notice names', () => {
+    expect(resolveCredit({ product: 'Taskly', organization: 'Taskly', holder: 'Acme Inc.' }).line)
+      .toBe(`Taskly — © ${year} Acme Inc.`)
+  })
+
+  test('an owner\'s own wording is used verbatim', () => {
+    expect(resolveCredit({ organization: 'Acme', copyright: '© Acme. All rights reserved.' }).line)
+      .toBe('© Acme. All rights reserved.')
+  })
+
+  test('switching the notice off leaves the bare pairing it used to be', () => {
+    expect(resolveCredit({ product: 'Taskly', organization: 'Acme', copyright: false }).line)
+      .toBe('Taskly — Acme')
+    expect(resolveCredit({ product: 'Taskly', copyright: false }).line).toBe('Taskly')
+  })
+
+  test('a literal line replaces the composition entirely', () => {
+    expect(resolveCredit({ product: 'Taskly', organization: 'Acme', line: '© Acme' }).line)
+      .toBe('© Acme')
+  })
+
+  test('nobody to name is nothing to render', () => {
+    expect(resolveCredit().line).toBeNull()
+  })
+
+  test('an EMPTY value is unset, not a value', () => {
+    // Exactly what a platform delivers for branding it does not have: every key present, the
+    // undelivered ones empty. `??` does not fall through an empty string, so the organization
+    // used to win the chain and compose "pisteva — " with nothing after the dash.
+    expect(resolveCredit({}, { name: 'pisteva', organization: '', entity: '' }).line)
+      .toBe(`© ${year} pisteva`)
+    expect(resolveCredit({ line: '', product: '', organization: '' }, { name: 'Taskly' }).line)
+      .toBe(`© ${year} Taskly`)
+    expect(resolveCredit({ copyright: '  ' }, { name: 'Taskly' }).line).toBe(`© ${year} Taskly`)
+    expect(resolveCredit({}, {}, '').line).toBeNull()
+  })
+
+  test('the platform credit is on unless it is switched off', () => {
+    expect(resolveCredit().poweredBy).toBe(true)
+    expect(resolveCredit({ poweredBy: false }).poweredBy).toBe(false)
+  })
+})
+
+describe('the authentication-plugin method source', () => {
+  const plugin = (
+    over: Partial<AuthenticationPlugin> & { type: string }
+  ): AuthenticationPlugin => ({ Implementation: () => () => null, ...over })
+
+  const offered = (context: BasicContext<BasicConfig>): string[] =>
+    pluginMethodSource.list(methodCtx(context)).map(item => item.id)
+
+  test('a plugin that declares no method is not a way to sign in', () => {
+    const context = makeTestContext()
+    registerAuthPlugin(plugin({ type: 'step-in-a-flow' }))
+    registerAuthPlugin(plugin({ type: 'offerable', method: {} }))
+
+    expect(offered(context)).toContain('offerable')
+    expect(offered(context)).not.toContain('step-in-a-flow')
+  })
+
+  test('a plugin that needs a renderer nobody assigned is left off the screen', () => {
+    const context = makeTestContext()
+    // Exactly the state an app is in when it imported the plugin host but not a panel package:
+    // the plugin is registered, and mounting its screen throws.
+    registerAuthPlugin(plugin({ type: 'needs-ui', method: {}, requiresRenderer: true }))
+
+    expect(offered(context)).not.toContain('needs-ui')
+
+    registerAuthPlugin(plugin({
+      type: 'needs-ui', method: {}, requiresRenderer: true, Renderer: () => null,
+    }))
+
+    expect(offered(context)).toContain('needs-ui')
+  })
+
+  test('a plugin whose own wiring is absent says so and is left off', () => {
+    const context = makeTestContext()
+    registerAuthPlugin(plugin({
+      type: 'needs-wiring', method: { available: ctx => ctx.context.hasService('never-appended') },
+    }))
+
+    expect(offered(context)).not.toContain('needs-wiring')
+  })
+})
+
+describe('a finished sign-in attempt', () => {
+  test('reports every outcome that leaves the user on the screen', () => {
+    // The regression: a method that could not build an authorization URL returned `Passed`, the
+    // screen rendered nothing, and the button read as broken. `Passed` is a valid answer TO A
+    // DISPATCHER, which has a continuation; a screen does not.
+    expect(loginAttemptError(LoginOutcome.Passed)).toBe('login.error.failed')
+    expect(loginAttemptError(LoginOutcome.Failed)).toBe('login.error.failed')
+    expect(loginAttemptError(LoginOutcome.Gesture)).toBe('login.error.blocked')
+  })
+
+  test('says nothing when the attempt actually went somewhere', () => {
+    expect(loginAttemptError(LoginOutcome.Handled)).toBeNull()
+    expect(loginAttemptError(LoginOutcome.Redirected)).toBeNull()
+    expect(loginAttemptError(LoginOutcome.Orphaned)).toBeNull()
+    expect(loginAttemptError(null)).toBeNull()
+  })
+})
+
+describe('resume outcomes', () => {
+  test('map to exactly one action each', () => {
+    expect(resumeAction(LoginOutcome.Handled)).toBe(ResumeAction.Stop)
+    expect(resumeAction(LoginOutcome.Redirected)).toBe(ResumeAction.Stop)
+    expect(resumeAction(LoginOutcome.Orphaned)).toBe(ResumeAction.Render)
+    expect(resumeAction(LoginOutcome.Failed)).toBe(ResumeAction.Render)
+    expect(resumeAction(LoginOutcome.Gesture)).toBe(ResumeAction.Render)
+    // The ordinary tab: keep the session and carry on. This is the one that must never change.
+    expect(resumeAction(LoginOutcome.Passed)).toBe(ResumeAction.Navigate)
+  })
+})

package/build/manager/modules.d.ts

@@ -1,2 +0,0 @@
-export declare const modules: import("@owlmeans/entrypoint").CommonEntrypoint[];
-//# sourceMappingURL=modules.d.ts.map

package/build/manager/modules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../../src/manager/modules.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,OAAO,mDAAO,CAAA"}