@owlmeans/client-auth 0.1.18-rc.9 → 0.1.18

package/src/manager/README.md

@@ -21,9 +21,9 @@ React components that handle various authentication scenarios:
 - **Tunnel Consumer**: Component for handling WebSocket authentication tunnels
 - **Credential Management**: Secure handling of user credentials
 
-### Module Integration
-The manager integrates with the OwlMeans module system to provide:
-- **Elevated Modules**: Enhanced modules with client-specific authentication handling
+### Entrypoint Integration
+The manager integrates with the OwlMeans entrypoint system to provide:
+- **Enhanced Entrypoints**: Entrypoints with client-specific authentication handling
 - **Route Protection**: Automatic authentication requirements for protected routes
 - **API Integration**: Seamless integration with authentication APIs
 
@@ -37,7 +37,7 @@ Comprehensive error handling for authentication scenarios:
 This manager is part of the `@owlmeans/client-auth` package:
 
 ```bash
-npm install @owlmeans/client-auth
+npm install @owlmeans/client-auth@^0.1.18
 ```
 
 ## API Reference
@@ -134,37 +134,22 @@ try {
 }
 ```
 
-### Modules
+### Entrypoints
 
-#### `modules`
-Pre-configured authentication modules for client applications.
-
-```typescript
-const modules: CommonModule[]
-```
-
-Contains elevated modules for:
-- `AUTHEN` - Base authentication module
-- `AUTHEN_INIT` - Authentication initialization
-- `AUTHEN_AUTHEN` - User authentication
-- `AUTHEN_RELY` - Authentication relay
-- `CAUTHEN` - Client authentication
-- `CAUTHEN_AUTHEN` - Client authentication handler
-- `CAUTHEN_AUTHEN_DEFAULT` - Default authentication component
-- `CAUTHEN_AUTHEN_TYPED` - Typed authentication component
-- `DISPATCHER` - Authentication dispatcher
+#### `entrypoints`
+The shared, immutable authentication declarations. Bind them into the client context alongside
+the application's own entrypoints.
 
 ## Usage Examples
 
 ### Basic Authentication Setup
 
 ```typescript
-import { modules } from '@owlmeans/client-auth/manager'
-import { makeClientContext } from '@owlmeans/client-context'
+import { entrypoints } from '@owlmeans/client-auth/manager'
+import { makeContext } from '@owlmeans/web-client'
 
-// Register authentication modules with context
-const context = makeClientContext(config)
-context.registerModules(modules)
+const context = makeContext(config)
+context.registerEntrypoints(entrypoints)
 
 await context.configure().init()
 ```
@@ -256,48 +241,27 @@ function RealtimeApp() {
 
 ### Custom Authentication Flow
 
-```typescript
-import { modules, AuthenCredError } from '@owlmeans/client-auth/manager'
-import { useModule } from '@owlmeans/client'
+Use the typed authentication protocols from `@owlmeans/auth-common`; the context supplies the
+registered client binding and infers the request and response types from the protocol.
 
-function CustomAuthFlow() {
-  const authModule = useModule('auth')
-  
-  const handleLogin = async (credentials) => {
-    try {
-      const initResponse = await authModule.init({
-        type: AuthenticationType.PasswordLogin
-      })
-      
-      const authResponse = await authModule.authenticate({
-        ...credentials,
-        challenge: initResponse.challenge
-      })
-      
-      console.log('Authentication successful:', authResponse)
-    } catch (error) {
-      if (error instanceof AuthenCredError) {
-        console.error('Invalid credentials:', error.message)
-      } else {
-        console.error('Authentication failed:', error)
-      }
-    }
+```typescript
+import { AuthenticationType } from '@owlmeans/auth'
+import { authProtocols } from '@owlmeans/auth-common'
+import { AuthenCredError } from '@owlmeans/client-auth/manager'
+import type { ClientContext } from '@owlmeans/client-context'
+
+async function authenticate(context: ClientContext, credentials: { username: string, password: string }) {
+  try {
+    const allowance = await context.entrypoint(authProtocols.init).call({
+      body: { type: AuthenticationType.PasswordLogin },
+    })
+    return await context.entrypoint(authProtocols.authenticate).call({
+      body: { ...credentials, challenge: allowance.challenge },
+    })
+  } catch (error) {
+    if (error instanceof AuthenCredError) console.error('Invalid credentials:', error.message)
+    throw error
   }
-
-  return (
-    <form onSubmit={(e) => {
-      e.preventDefault()
-      const formData = new FormData(e.target)
-      handleLogin({
-        username: formData.get('username'),
-        password: formData.get('password')
-      })
-    }}>
-      <input name="username" placeholder="Username" required />
-      <input name="password" type="password" placeholder="Password" required />
-      <button type="submit">Login</button>
-    </form>
-  )
 }
 ```
 
@@ -408,18 +372,11 @@ Single-use token authentication for enhanced security.
 5. **Graceful Fallbacks**: Provide fallback UI for authentication failures
 6. **Security**: Never store sensitive credentials in local storage
 
-## Module Elevation
-
-The manager uses module elevation to enhance base authentication modules:
-
-```typescript
-// Base modules are elevated with client-specific handlers
-elevate(list, AUTHEN_INIT, true)           // API call elevation
-elevate(list, AUTHEN_AUTHEN, true)         // Authentication elevation
-elevate(list, CAUTHEN_AUTHEN_DEFAULT, handler(AuthenticationHOC()))  // Component handler
-```
+## Entrypoint wiring
 
-This provides seamless integration between the module system and React components.
+The manager exports a ready-to-use `entrypoints` collection. Compose it with the application's
+own declarations and use `bind`/`bindScreen` from `@owlmeans/client-entrypoint` when adding a
+custom client handler; handlers are attached to declaration objects, never looked up by alias.
 
 ## Dependencies
 
@@ -427,7 +384,7 @@ This manager depends on:
 - `@owlmeans/auth` - Core authentication functionality
 - `@owlmeans/auth-common` - Shared authentication components
 - `@owlmeans/client` - Client-side framework functionality
-- `@owlmeans/client-module` - Client module system
+- `@owlmeans/client-entrypoint` - Typed protocol binding system
 - `@owlmeans/error` - Error management system
 - `react` - React framework for UI components
 
@@ -436,4 +393,4 @@ This manager depends on:
 - [`@owlmeans/client-auth`](../../../README.md) - Parent client authentication package
 - [`@owlmeans/server-auth/manager`](../../../server-auth/src/manager/README.md) - Server-side authentication manager
 - [`@owlmeans/auth`](../../../auth/README.md) - Core authentication library
-- [`@owlmeans/client`](../../../client/README.md) - Client-side framework
+- [`@owlmeans/client`](../../../client/README.md) - Client-side framework

package/src/manager/components/authentication/control.ts

@@ -45,7 +45,7 @@ export const makeControl = (
       control.afterAuthenticate = plugins[control.type].afterAuthenticate
 
       const module = context.entrypoint<ClientEntrypoint<AllowanceResponse>>(AUTHEN_INIT)
-      const [allowance] = await module.call({ body: control.request })
+      const allowance = await module.call({ body: control.request })
 
       control.allowance = allowance
 
@@ -89,8 +89,8 @@ export const makeControl = (
         // We return back unwrapped challenge
         credentials.challenge = control.allowance?.challenge
 
-        const [token, status] = await context.entrypoint<ClientEntrypoint<AuthToken>>(AUTHEN_AUTHEN)
-          .call({ body: credentials })
+        const { value: token, outcome: status } = await context.entrypoint<ClientEntrypoint<AuthToken>>(AUTHEN_AUTHEN)
+          .invoke({ body: credentials })
 
         if (status === EntrypointOutcome.Ok && token.token != null
           && token.token !== '' && control.afterAuthenticate != null) {

package/src/manager/components/authentication/types.ts

@@ -2,7 +2,7 @@ import type {
   AllowanceRequest, AllowanceResponse, AuthCredentials, AuthenticationStage, AuthenticationType,
   AuthToken
 } from '@owlmeans/auth'
-import type { ModuleContextParams } from '@owlmeans/client'
+import type { EntrypointContextParams } from '@owlmeans/client'
 import type { FC } from 'react'
 import type { ClientContext } from '@owlmeans/client'
 import type { FlowService } from '@owlmeans/client-flow'
@@ -10,7 +10,7 @@ import type { ResilientError } from '@owlmeans/error'
 
 export type ClientAuthType = AuthenticationType | string
 
-export interface AuthenticationProps extends ModuleContextParams {
+export interface AuthenticationProps extends EntrypointContextParams {
   type?: ClientAuthType
   callback?: AuthenticationCallback
   source?: string

package/src/manager/components/tunnel-consumer.tsx

@@ -2,11 +2,11 @@ import { AuthenticationType } from '@owlmeans/auth'
 import { AuthenticationHOC } from './authentication/component.js'
 import type { FC } from 'react'
 import { useMemo } from 'react'
-import { useModule } from '@owlmeans/client'
+import { useEntrypoint } from '@owlmeans/client'
 import type { TunnelAuthenticationProps } from './types.js'
 
 export const TunnelConsumer: FC<Partial<TunnelAuthenticationProps>> = ({ ...props }) => {
-  const mod = useModule()
+  const mod = useEntrypoint()
   const Implementation = useMemo(
     () => AuthenticationHOC(undefined, AuthenticationType.WalletConsumer), []
   )

package/src/manager/entrypoints.ts

@@ -0,0 +1,18 @@
+
+import { authProtocols } from '@owlmeans/auth-common'
+import { handler } from '@owlmeans/client'
+import { bind, bindScreen, stab } from '@owlmeans/client-entrypoint'
+import { AuthenticationHOC } from './components/authentication/component.js'
+
+/** Browser entrypoints for the manager's authentication flows. */
+export const entrypoints = [
+  bind(authProtocols.authen),
+  bind(authProtocols.init),
+  bind(authProtocols.authenticate),
+  bind(authProtocols.rely),
+  bind(authProtocols.client),
+  bind(authProtocols.login),
+  bindScreen(authProtocols.loginDefault, handler(AuthenticationHOC())),
+  bindScreen(authProtocols.loginTyped, handler(AuthenticationHOC())),
+  bindScreen(authProtocols.dispatcher, stab),
+]

package/src/manager/plugins/basic-ed25519.tsx

@@ -7,6 +7,13 @@ import { AuthenCredError } from '../errors.js'
 export const ed25519BasicUIPlugin: AuthenticationPlugin = {
   type: AuthenticationType.BasicEd25519,
 
+  method: { order: 300, icon: 'key', emphasis: 'secondary' },
+
+  // This package ships no UI family, so the form below is a `Renderer` a panel package assigns
+  // (`@owlmeans/web-panel/auth/plugins`, `@owlmeans/mui-panel/auth/plugins`). Until one does, the
+  // Implementation throws on mount — so the sign-in screen must not offer the method.
+  requiresRenderer: true,
+
   Implementation: Renderer => ({ type, stage, control, params }) => {
 
     type = type ?? AuthenticationType.BasicEd25519

package/src/manager/plugins/exports.ts

@@ -1,4 +1,7 @@
 export type * from './types.js'
+export * from './registry.js'
+export type * from './registry/types.js'
+export * from './methods.js'
 export * from './tunnel/index.js'
 export * from './basic-ed25519.js'
 export * from './re-captcha.js'

package/src/manager/plugins/index.ts

@@ -1,13 +1,20 @@
-import type { ClientAuthType } from '../components/index.js'
-
 import { AuthenticationType } from '@owlmeans/auth'
 import { ed25519BasicUIPlugin } from './basic-ed25519.js'
-import { AuthenticationPlugin } from './types.js'
 import { reCaptchaPlugin } from './re-captcha.js'
 import { tunnelConsumerUIPlugin } from './tunnel-consumer.js'
+import { pluginMethodSource } from './methods.js'
+import { loginMethodsHelper } from '../../login/methods.js'
+import { plugins } from './registry.js'
 
-export const plugins: { [type: ClientAuthType]: AuthenticationPlugin } = {}
+export { plugins, createAuthPluginHelper, authPluginHelper } from './registry.js'
+export type { AuthPluginHelper } from './registry/types.js'
 
 plugins[AuthenticationType.BasicEd25519] = ed25519BasicUIPlugin
 plugins[AuthenticationType.ReCaptcha] = reCaptchaPlugin
 plugins[AuthenticationType.WalletConsumer] = tunnelConsumerUIPlugin
+
+// Registered from here, not from `login/`, so that importing `@owlmeans/client-auth/login` never
+// drags this module's React plugin implementations into a bundle that only wanted the login host.
+// A generated application imports the login subpath through `client-iam`; it must not gain three
+// authentication methods it never registered as a side effect of that.
+loginMethodsHelper.registerMethodSource(pluginMethodSource)

package/src/manager/plugins/methods.ts

@@ -0,0 +1,74 @@
+import { CAUTHEN_AUTHEN_TYPED } from '@owlmeans/auth'
+import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
+import { DEFAULT_METHOD_ORDER, LOGIN_SERVICE } from '../../login/consts.js'
+import type { LoginMethod, LoginMethodContext, LoginMethodSource, LoginService } from '../../login/types.js'
+import type { AuthenticationPlugin } from './types.js'
+import { authPluginHelper } from './registry.js'
+
+/**
+ * Whether a registered plugin may be put on the sign-in screen of THIS application.
+ *
+ * The registry is global and is filled by side-effect imports, so "registered" means only that
+ * some module was pulled into the bundle — three separate reasons why that is not enough:
+ *
+ * 1. No `method`: `re-captcha` is a STEP inside another flow, not a way to sign in.
+ * 2. No renderer: a plugin that declares `requiresRenderer` throws the moment its screen mounts
+ *    unless a UI package (`web-panel`, `mui-panel`) assigned one. An app that imported the plugin
+ *    host without that package would be offering buttons whose only outcome is a broken page.
+ * 3. Not wired: a plugin whose flow needs a service its context never appended fails on the
+ *    lookup instead. Packages register their plugins in groups, so an app that wanted one of them
+ *    gets the rest too, and the rest have to be able to say they do not apply here.
+ */
+const offerable = (plugin: AuthenticationPlugin, ctx: LoginMethodContext): boolean => {
+  if (plugin.method == null || plugin.method.hidden === true) {
+    return false
+  }
+  if (plugin.requiresRenderer === true && plugin.Renderer == null) {
+    return false
+  }
+
+  return plugin.method.available?.(ctx) !== false
+}
+
+/**
+ * Every registered authentication plugin that declares itself offerable, as a sign-in method.
+ */
+export const pluginMethodSource: LoginMethodSource = {
+  alias: 'authentication-plugins',
+
+  list: ctx => authPluginHelper.listAuthPlugins()
+    .filter(plugin => offerable(plugin, ctx))
+    .map((plugin): LoginMethod => {
+      const meta = plugin.method!
+      const type = plugin.type
+      const id = meta.id ?? type
+
+      return {
+        id, type,
+        ...(meta.label != null ? { label: meta.label } : {}),
+        i18nKey: meta.i18nKey ?? id,
+        ...(meta.icon != null ? { icon: meta.icon } : {}),
+        order: meta.order ?? DEFAULT_METHOD_ORDER,
+        ...(meta.emphasis != null ? { emphasis: meta.emphasis } : {}),
+        ...(meta.restricted === true ? { restricted: true } : {}),
+        params: { type },
+
+        // Non-async through the whole chain: `login.begin` opens the surrogate window in its first
+        // statement, and a window opened after the gesture has been handled is blocked.
+        start: methodCtx => {
+          const login = methodCtx.context.service<LoginService>(LOGIN_SERVICE)
+          const entrypoint = methodCtx.context.entrypoint<ClientEntrypoint>(CAUTHEN_AUTHEN_TYPED)
+          const url = entrypoint.path().replace(':type', encodeURIComponent(type))
+
+          return login.begin({
+            url,
+            // In an ordinary tab this keeps the application mounted, exactly as the pre-chooser
+            // dispatcher did; the surrogate plugin ignores it and opens a window instead.
+            ...(methodCtx.navigate != null
+              ? { navigate: () => methodCtx.navigate?.(CAUTHEN_AUTHEN_TYPED, { type }) }
+              : {}),
+          })
+        },
+      }
+    }),
+}

package/src/manager/plugins/re-captcha.tsx

@@ -5,6 +5,13 @@ import { useEffect } from 'react'
 export const reCaptchaPlugin: AuthenticationPlugin = {
   type: AuthenticationType.ReCaptcha,
 
+  // A STEP inside another flow, never a way to sign in — so it is registered and never offered.
+  method: { hidden: true },
+
+  // Its widget is a `Renderer` a panel package assigns. `hidden` already keeps it off the sign-in
+  // screen; this is what the flow that DOES drive it can check before handing it a stage.
+  requiresRenderer: true,
+
   Implementation: Renderer => ({ type, stage, control, params }) => {
     Renderer = Renderer ?? reCaptchaPlugin.Renderer
 

package/src/manager/plugins/registry/types.ts

@@ -0,0 +1,10 @@
+import type { ClientAuthType } from '../../components/authentication/types.js'
+import type { AuthenticationPlugin } from '../types.js'
+
+/** Reads and writes of the global authentication-plugin registry. */
+export interface AuthPluginHelper {
+  /** Register a plugin under its own `type`, replacing an earlier one; answers the plugin. */
+  registerAuthPlugin: (plugin: AuthenticationPlugin) => AuthenticationPlugin
+  getAuthPlugin: (type: ClientAuthType) => AuthenticationPlugin | undefined
+  listAuthPlugins: () => AuthenticationPlugin[]
+}

package/src/manager/plugins/registry.ts

@@ -0,0 +1,33 @@
+import type { ClientAuthType } from '../components/authentication/types.js'
+import type { AuthenticationPlugin } from './types.js'
+import type { AuthPluginHelper } from './registry/types.js'
+
+/**
+ * The registry every authentication plugin lands in.
+ *
+ * It stays a plain exported object, and every registration stays a plain assignment, because four
+ * packages already write into it from side-effect imports (`web-oidc-rp`, `mui-oidc-rp`,
+ * `web-auth`, and this package's own `index`). Hiding it behind an API would break all of them for
+ * no gain — the helper below simply reads it.
+ *
+ * It lives in its own module rather than in `index.ts` so that the method source can read it
+ * without the two importing each other.
+ */
+export const plugins: { [type: ClientAuthType]: AuthenticationPlugin } = {}
+
+export const createAuthPluginHelper = (): AuthPluginHelper => {
+  const registerAuthPlugin = (plugin: AuthenticationPlugin): AuthenticationPlugin => {
+    plugins[plugin.type] = plugin
+
+    return plugin
+  }
+
+  const getAuthPlugin = (type: ClientAuthType): AuthenticationPlugin | undefined =>
+    plugins[type]
+
+  const listAuthPlugins = (): AuthenticationPlugin[] => Object.values(plugins)
+
+  return { registerAuthPlugin, getAuthPlugin, listAuthPlugins }
+}
+
+export const authPluginHelper = createAuthPluginHelper()

package/src/manager/plugins/tunnel-consumer.tsx

@@ -5,7 +5,7 @@ import type { AuthenticationPlugin } from './types.js'
 import type { PinForm, TunnelAuthenticationRenderer } from './tunnel/types.js'
 import { useCallback, useEffect } from 'react'
 import type { Connection } from '@owlmeans/socket'
-import { isEventMessage, SocketTimeout } from '@owlmeans/socket'
+import { SocketTimeout, socketMessageHelper } from '@owlmeans/socket'
 import type { AuthenticationControl } from '../components/authentication/types.js'
 import { RELY_ACTION_TIMEOUT, RELY_PIN_PERFIX } from '@owlmeans/auth-common'
 import { createWalletFacade } from './tunnel/wallet.js'
@@ -13,12 +13,21 @@ import { createWalletFacade } from './tunnel/wallet.js'
 export const tunnelConsumerUIPlugin: AuthenticationPlugin = {
   type: AuthenticationType.WalletConsumer,
 
+  method: { order: 400, icon: 'wallet' },
+
+  // The PIN form is a `Renderer` a panel package assigns; without one the Implementation throws on
+  // mount, so the method must not be offered.
+  requiresRenderer: true,
+
   Implementation: renderer => ({ type, stage, control, params }) => {
     type = type ?? AuthenticationType.WalletConsumer
     const Renderer: TunnelAuthenticationRenderer | undefined = renderer
       ?? tunnelConsumerUIPlugin.Renderer
 
-    const connection = useWs(AUTHEN_RELY)
+    // A wallet-tunnel handshake is one-shot and stateful in the browser tab that started it — a
+    // reconnect would dial a brand-new rely session the wallet was never asked to approve, so a
+    // drop here is a real failure (`SocketTimeout` below), never something to retry underneath.
+    const connection = useWs(AUTHEN_RELY, undefined, { reconnect: false })
 
     if (Renderer == null) {
       throw new SyntaxError('Renderer is not defined for WalletConsumer plugin')
@@ -53,7 +62,7 @@ export const tunnelConsumerUIPlugin: AuthenticationPlugin = {
         }
 
         return connection.listen(async message => {
-          if (isEventMessage(message) && message.event === 'close') {
+          if (socketMessageHelper.isEventMessage(message) && message.event === 'close') {
             await control.setError(new SocketTimeout('rely'))
           }
         })

package/src/manager/plugins/types.ts

@@ -1,4 +1,6 @@
 import type { FC } from 'react'
+import type { LoginMethodEmphasis } from '@owlmeans/config'
+import type { LoginMethodContext } from '../../login/types.js'
 import type { AuthenticationControl, AuthenticationRenderer, AuthenticationRendererProps, } from '../components/authentication/types.js'
 
 export interface AuthenticationPlugin extends Pick<
@@ -7,6 +9,58 @@ export interface AuthenticationPlugin extends Pick<
   type: string
   Implementation: PluginImplemnetation
   Renderer?: AuthenticationRenderer
+  /**
+   * This plugin's `Implementation` cannot render without a `Renderer` a UI package supplies.
+   *
+   * It is declared rather than inferred because there is nothing to infer it from: a plugin that
+   * renders its own form and one that throws `Renderer is not defined` are the same object until
+   * the screen mounts. Declaring it is what lets the sign-in screen leave out a method whose
+   * renderer nobody registered, instead of offering a button that crashes the page it opens.
+   */
+  requiresRenderer?: boolean
+  /**
+   * How this method presents itself on the sign-in screen.
+   *
+   * Absent means the plugin is never OFFERED — it is still reachable by type, which is what a
+   * step-in-a-flow (re-captcha) and a plugin an app deep-links to both need. Every field is
+   * optional so an existing plugin object keeps type-checking without being touched.
+   */
+  method?: AuthMethodMeta
+}
+
+export interface AuthMethodMeta {
+  /** Defaults to the plugin's `type`. */
+  id?: string
+  /** Literal fallback used when no translation resolves. */
+  label?: string
+  /** Key under the `auth` library's `login.method.*`; defaults to the id. */
+  i18nKey?: string
+  /** Icon registry NAME, never markup — this package must stay free of an icon library. */
+  icon?: string
+  /** Ascending; default 100. */
+  order?: number
+  emphasis?: LoginMethodEmphasis
+  /**
+   * Never offered unless the configuration explicitly enables it.
+   *
+   * This is the secret-key gate: an operator login is registered like any other method and must
+   * not become offerable merely by being registered.
+   */
+  restricted?: boolean
+  /** Registered, but never a choice. */
+  hidden?: boolean
+  /**
+   * Whether the application this method is about to be offered in actually wired it.
+   *
+   * The plugin registry is global and is written to by side-effect imports, so being registered
+   * says only that some bundle pulled the module in — and modules arrive in groups. An app that
+   * wanted one method out of a package gets every method that package registers, including ones
+   * whose first act is to look up a service its context never appended. This is where a plugin
+   * says so, per context, at render time; `false` leaves it off the screen.
+   *
+   * Absent means "always", which is right for a plugin that needs nothing but itself.
+   */
+  available?: (ctx: LoginMethodContext) => boolean
 }
 
 export interface PluginImplemnetation {

package/src/service.ts

@@ -21,7 +21,7 @@ export const makeAuthService = (alias: string = DEFAULT_ALIAS): AuthService => {
     authenticate: async token => {
       const context = assertContext(service.ctx, location)
 
-      const [authToken] = await context.entrypoint<ClientEntrypoint<AuthToken>>(DISPATCHER_AUTHEN)
+      const authToken = await context.entrypoint<ClientEntrypoint<AuthToken>>(DISPATCHER_AUTHEN)
         .call({ body: token })
 
       await service.update(authToken.token)

package/tests/context.ts

@@ -1,4 +1,4 @@
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import type { BasicConfig, BasicContext } from '@owlmeans/context'
 import { createStaticResource } from '@owlmeans/static-resource'
 import { AUTH_RESOURCE, DEFAULT_ALIAS } from '../src/consts.js'
@@ -10,7 +10,6 @@ export const makeTestContext = () => {
   const cfg: BasicConfig = {
     ready: false,
     service: 'client-auth-tests',
-    layer: Layer.Application,
     type: AppType.Frontend,
     services: {},
   }

package/tests/i18n.spec.ts

@@ -0,0 +1,68 @@
+import { describe, expect, test } from 'bun:test'
+import en from '../src/login/i18n/en.json'
+import pl from '../src/login/i18n/pl.json'
+import ru from '../src/login/i18n/ru.json'
+import be from '../src/login/i18n/be.json'
+import uk from '../src/login/i18n/uk.json'
+import es from '../src/login/i18n/es.json'
+import de from '../src/login/i18n/de.json'
+import fr from '../src/login/i18n/fr.json'
+
+type Messages = { [key: string]: string | Messages }
+
+/** Every leaf as `branch.key` → message, however deep the resource nests. */
+const leaves = (messages: Messages, prefix = ''): Map<string, unknown> => {
+  const found = new Map<string, unknown>()
+  for (const [key, value] of Object.entries(messages)) {
+    const path = prefix === '' ? key : `${prefix}.${key}`
+    if (value != null && typeof value === 'object') {
+      for (const [leaf, message] of leaves(value, path)) found.set(leaf, message)
+    } else {
+      found.set(path, value)
+    }
+  }
+  return found
+}
+
+const placeholders = (message: string): string[] =>
+  [...message.matchAll(/\{\{\s*([\w-]+)\s*\}\}/g)].map(match => match[1]).sort()
+
+describe('client-auth login localization', () => {
+  const translations: Record<string, Messages> = { en, pl, ru, be, uk, es, de, fr }
+  const reference = leaves(en)
+
+  test('ships all eight languages with exact key parity at every depth', () => {
+    expect(Object.keys(translations).sort()).toEqual(['be', 'de', 'en', 'es', 'fr', 'pl', 'ru', 'uk'])
+    expect(reference.has('login.terms.accept')).toBe(true)
+    expect(reference.has('login.terms.notice')).toBe(true)
+    expect(reference.has('login.terms.revised')).toBe(true)
+    // The removed key never comes back once every renderer has moved off it.
+    expect(reference.has('login.terms.agreement')).toBe(false)
+
+    for (const [lng, messages] of Object.entries(translations)) {
+      const found = leaves(messages)
+      expect({ lng, keys: [...found.keys()].sort() }).toEqual({ lng, keys: [...reference.keys()].sort() })
+      for (const [key, message] of found) {
+        expect({ lng, key, filled: typeof message === 'string' && message.trim().length > 0 })
+          .toEqual({ lng, key, filled: true })
+      }
+    }
+  })
+
+  test('keeps the interpolation placeholders of every message', () => {
+    for (const [lng, messages] of Object.entries(translations)) {
+      for (const [key, message] of leaves(messages)) {
+        expect({ lng, key, placeholders: placeholders(String(message)) })
+          .toEqual({ lng, key, placeholders: placeholders(String(reference.get(key))) })
+      }
+    }
+  })
+
+  test('`login.terms.required` no longer names the Privacy Policy specifically', () => {
+    for (const [lng, messages] of Object.entries(translations)) {
+      const required = leaves(messages).get('login.terms.required')
+      expect({ lng, hasDocumentsToken: placeholders(String(required)).includes('documents') })
+        .toEqual({ lng, hasDocumentsToken: true })
+    }
+  })
+})