@owlmeans/test-auth 0.1.18-rc.3 → 0.1.18-rc.31

package/README.md

@@ -20,7 +20,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.32
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/test-auth",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.499Z",
+  "version": "0.1.18-rc.31",
+  "generatedAt": "2026-09-22T12:36:21.786Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/testing-auth-unit/SKILL.md

@@ -1,12 +1,14 @@
 ---
 name: testing-auth-unit
-description: Category-B unit tests for OwlMeans Common — auth/authz packages where the test substitutes a fake authenticated identity via @owlmeans/test-auth. Auto-invoked when writing tests in auth, auth-common, basic-keys, basic-envelope, did, client-auth, client-did, server-auth, oidc, server-oidc-*, web-oidc-*, wled, client-payment.
+description: Category-B unit tests for OwlMeans Common — auth/authz packages where the test substitutes a fake authenticated identity via @owlmeans/test-auth. Auto-invoked when writing tests in auth, auth-common, auth-otp, basic-keys, basic-envelope, did, client-auth, client-did, client-iam, client-payment, mui-oidc-rp, oidc, server-auth, server-auth-otp, server-oidc-*, web-auth, web-oidc-*, wled.
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 
 # Auth Unit Tests — Category B
 
-Category B applies to the auth/authz packages: `auth`, `auth-common`, `basic-keys`, `basic-envelope`, `did`, `client-auth`, `client-did`, `server-auth`, `oidc`, `server-oidc-rp`, `server-oidc-provider`, `web-oidc-rp`, `web-oidc-provider`, `wled`, `client-payment`. These tests run under `bun test` (no Playwright even when there are React bits) and are the **only** place mocks are allowed — and only for authentication/authorization, via `@owlmeans/test-auth`.
+**Install:** `"@owlmeans/test-auth": "^0.1.18-rc.31"` in `devDependencies`
+
+Category B applies to the auth/authz packages: `auth`, `auth-common`, `auth-otp`, `basic-envelope`, `basic-keys`, `client-auth`, `client-did`, `client-iam`, `client-payment`, `did`, `mui-oidc-rp`, `oidc`, `server-auth`, `server-auth-otp`, `server-oidc-provider`, `server-oidc-rp`, `web-auth`, `web-oidc-provider`, `web-oidc-rp`, `wled`. These tests run under `bun test` (no Playwright even when there are React bits) and are the **only** place mocks are allowed — and only for authentication/authorization, via `@owlmeans/test-auth`.
 
 For background on the protocol you're mocking, read the `auth-protocol` skill.
 
@@ -14,23 +16,37 @@ For background on the protocol you're mocking, read the `auth-protocol` skill.
 
 | Helper | Purpose |
 |---|---|
-| `makeFixtureKeyPair(seed?)` | Deterministic Ed25519 `KeyPairModel`. Same seed → same keys. |
-| `makeMemoryTrustedResource(records?)` | `Resource<TrustedRecord>` that satisfies `trust()` lookups. |
-| `makeMockGuard({ alias?, auth?, allow? })` | `GuardService` resolving to a chosen `Auth`. |
-| `withAuth(ctx, auth)` | Registers a mock guard on `ctx` that resolves to `auth`. |
-| `signMockEnvelope(msg, type, kind?, kp?)` | Wraps `makeEnvelopeModel` with a fixture keypair. |
-| `makeBearer(auth, kp?)` | Produces an `ED25519-BASIC-TOKEN <encoded>` header. |
-| `SUPERUSER`, `USER`, `SERVICE` | Canonical `Auth` payload fixtures. |
+| `makeFixtureKeyPair(seed?)` | Deterministic Ed25519 `KeyPairModel`. Same seed → same keys; no seed → a fresh random pair. |
+| `makeMemoryTrustedResource(records?, alias?)` | `Resource<TrustedRecord>` that satisfies `trust()` lookups. `alias` defaults to `TRUSTED`. |
+| `makeMockGuard(opts?)` | `GuardService` resolving to a chosen `Auth`, registerable exactly like a real guard. |
+| `MockGuardOptions` | `{ alias?, auth?, allow?, token? }` — see below. |
+| `withAuth(ctx, auth, alias?)` | Registers a mock guard on `ctx` that resolves to `auth`, and returns `ctx`. |
+| `signMockEnvelope(msg, type, kind?, kp?)` | Wraps `makeEnvelopeModel` with a fixture keypair and signs it; `kind` defaults to `EnvelopeKind.Token`. |
+| `makeBearer(auth, kp?)` | Produces an `ED25519-BASIC-TOKEN <encoded>` header value from an `Auth`. |
+| `SUPERUSER`, `USER`, `SERVICE` | Canonical `Auth` payload fixtures (`Superuser` / `User` / `Service` roles, `scopes: ['*']`). |
+
+`MockGuardOptions` carries the whole seam: `auth` is what `handle` resolves into the response,
+`allow` is the predicate `match` reports (default: always match), `token` is what the client-side
+`authenticated()` answers, and `alias` defaults to `DEFAULT_GUARD` so the mock takes the place a
+real guard would occupy. `withAuth` is the shorthand for the common case.
+
+**The last registration for an alias wins.** `registerService` in `@owlmeans/context` assigns
+`services[service.alias]`, so it overwrites silently — there is no "first one keeps the slot".
+Register the mock **after** anything that appends a real guard under the same alias (an
+`append*` mixin the package documents, or a context factory that wires one), or give the mock
+its own alias and point the entrypoint's guard at that. A mock registered first and then
+overwritten leaves the spec exercising real cryptography and failing on a trusted-record
+lookup, which reads as an unrelated failure.
 
 ## `tests/context.ts` pattern
 
 ```ts
-import { AppType, Layer, makeBasicContext } from '@owlmeans/context'
+import { AppType, makeBasicContext } from '@owlmeans/context'
 import { makeMemoryTrustedResource, withAuth, USER } from '@owlmeans/test-auth'
 
 export const makeTestCtx = () => {
   const ctx = makeBasicContext({
-    ready: false, service: '<pkg>-tests', layer: Layer.Service, type: AppType.Backend,
+    ready: false, service: '<pkg>-tests', type: AppType.Backend, services: {},
   })
   ctx.registerResource(makeMemoryTrustedResource([
     { id: 'svc', name: 'svc', credential: '<fixture-pubkey>' },
@@ -40,6 +56,21 @@ export const makeTestCtx = () => {
 }
 ```
 
+One factory, one context: the trusted resource and the mock guard are registered inside it, in the
+order a real app's `makeContext` would.
+
+`makeMemoryTrustedResource` implements only `load`, `save` and `create` — enough for the `trust()`
+boundary and for seeding from a spec; every other resource method throws. A read takes an id or a
+single-field criteria over `id` or `name`, and anything wider is refused with
+`UnsupportedArgumentError` rather than scanned: a query the mock cannot answer exactly is a test
+reaching past its seam, and the honest fix is integration coverage.
+
+Every seeded record needs an `id`; a record without one is rejected on construction, and so is a
+`create` for an id already held. `trust(context, resource, userName)` looks up by `name` by
+default, so seed both fields. Give the record a `credential` (a public key) when the code under
+test only verifies, and a `secret` (a private key) when it must sign as the trusted party —
+`trust()` prefers `secret` and falls back to `credential`.
+
 The trusted resource, mock guard, and any fixture keys are the **only** mocks allowed. Everything else (the service under test, sibling packages it depends on) is the real thing.
 
 ## Spec shape
@@ -65,10 +96,10 @@ describe('@owlmeans/basic-keys — packAuthCredentials', () => {
 - **Mocks only for auth/authz.** No mocks for databases, network, or any sibling package. If you need one, move the spec to category C and write an integration test.
 - **Don't replicate `@owlmeans/test-auth` helpers in your package.** If you need a new mocking primitive (e.g. an OIDC userinfo endpoint stub), add it to `@owlmeans/test-auth` and its skill — never to a per-package `tests/`.
 - **Use deterministic seeds.** `makeFixtureKeyPair('<seed>')` keeps signatures stable run-to-run; random keypairs break snapshot-style assertions.
-- **Cover SKILL.md cases first.** The package's `.agents/skills/<pkg>/SKILL.md` documents the consumer-facing surface — that's the test priority order.
+- **Cover SKILL.md cases first.** The package's own skill (its directory under `.agents/skills/` — named for the skill, which is not always the package name) documents the consumer-facing surface, and that is the test priority order.
 - **Max 3-4 tests per method/function.** Same as category A.
 - **Don't test types or utils.**
 
 ## When you actually want OIDC end-to-end
 
-The current `@owlmeans/test-auth` does not ship a fake JWKS server. Use the real `makeOidcGuard` against the in-memory trusted resource and a fixture keypair. If a future test needs a hostable IdP fake, add it to `@owlmeans/test-auth` and document it here — don't bolt it on per package.
+`@owlmeans/test-auth` ships no fake JWKS server. Use the real `makeOidcGuard` against the in-memory trusted resource and a fixture keypair. If a future test needs a hostable IdP fake, add it to `@owlmeans/test-auth` and document it here — don't bolt it on per package.

package/build/trusted.d.ts

@@ -9,6 +9,10 @@ import type { Resource } from '@owlmeans/resource';
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export declare const makeMemoryTrustedResource: (records?: TrustedRecord[], alias?: string) => Resource<TrustedRecord>;
 //# sourceMappingURL=trusted.d.ts.map

package/build/trusted.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAWlD;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,aAC3B,aAAa,EAAE,UACjB,MAAM,KACZ,QAAQ,CAAC,aAAa,CAsDxB,CAAA"}
+{"version":3,"file":"trusted.d.ts","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAA0B,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAe1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,aAC3B,aAAa,EAAE,UACjB,MAAM,KACZ,QAAQ,CAAC,aAAa,CAqExB,CAAA"}

package/build/trusted.js

@@ -1,5 +1,8 @@
 import { appendContextual } from '@owlmeans/context';
+import { UnsupportedArgumentError } from '@owlmeans/resource';
 const TRUSTED_DEFAULT_ALIAS = 'TRUSTED';
+/** The fields a `trust()` lookup keys on — the only index this map has. */
+const SUPPORTED_FIELDS = ['id', 'name'];
 const notImplemented = (op) => {
     throw new Error(`@owlmeans/test-auth: in-memory TRUSTED resource does not implement ${op}()`);
 };
@@ -13,6 +16,10 @@ const getter = (record, field) => record[field];
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_ALIAS) => {
     const store = new Map();
@@ -29,16 +36,24 @@ export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_
         }
         return null;
     };
+    /**
+     * @throws {UnsupportedArgumentError} on criteria naming anything but one supported field.
+     */
+    const first = (idOrWhere) => {
+        if (typeof idOrWhere === 'string') {
+            return store.get(idOrWhere) ?? null;
+        }
+        const entries = Object.entries(idOrWhere).filter(([, value]) => value !== undefined);
+        const [entry, ...rest] = entries;
+        if (entry == null || rest.length > 0
+            || !SUPPORTED_FIELDS.includes(entry[0]) || typeof entry[1] !== 'string') {
+            throw new UnsupportedArgumentError('test-auth:trusted:where');
+        }
+        const [field, value] = entry;
+        return field === 'id' ? store.get(value) ?? null : findByField(value, field);
+    };
     const resource = {
-        load: async (id, field) => {
-            const fieldName = typeof field === 'string'
-                ? field
-                : field?.field;
-            if (fieldName != null && fieldName !== 'id') {
-                return findByField(id, fieldName) ?? null;
-            }
-            return store.get(id) ?? null;
-        },
+        load: async (idOrWhere, _opts) => first(idOrWhere),
         save: async (record) => {
             if (record.id == null) {
                 throw new Error('@owlmeans/test-auth: cannot save TRUSTED record without id');
@@ -58,9 +73,11 @@ export const makeMemoryTrustedResource = (records = [], alias = TRUSTED_DEFAULT_
         },
         get: () => notImplemented('get'),
         list: () => notImplemented('list'),
+        count: () => notImplemented('count'),
         update: () => notImplemented('update'),
         delete: () => notImplemented('delete'),
-        pick: () => notImplemented('pick'),
+        take: () => notImplemented('take'),
+        purge: () => notImplemented('purge'),
     };
     return appendContextual(alias, resource);
 };

package/build/trusted.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAIpD,MAAM,qBAAqB,GAAG,SAAS,CAAA;AAEvC,MAAM,cAAc,GAAG,CAAC,EAAU,EAAS,EAAE;IAC3C,MAAM,IAAI,KAAK,CAAC,sEAAsE,EAAE,IAAI,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,KAAa,EAAW,EAAE,CAC9D,MAA6C,CAAC,KAAK,CAAC,CAAA;AAEvD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAO,GAAoB,EAAE,EAC7B,KAAK,GAAW,qBAAqB,EACZ,EAAE;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAa,EAAwB,EAAE;QACzE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,MAAM,QAAQ,GAAqC;QACjD,IAAI,EAAE,KAAK,EAA8B,EAAU,EAAE,KAAe,EAAE,EAAE;YACtE,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ;gBACzC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAE,KAAwC,EAAE,KAAK,CAAA;YACpD,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAQ,WAAW,CAAC,EAAE,EAAE,SAAS,CAAiB,IAAI,IAAI,CAAA;YAC5D,CAAC;YACD,OAAQ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAsB,IAAI,IAAI,CAAA;QACpD,CAAC;QAED,IAAI,EAAE,KAAK,EAA8B,MAAqB,EAAE,EAAE;YAChE,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAc,CAAA;QACvB,CAAC;QAED,MAAM,EAAE,KAAK,EAA8B,MAAqB,EAAE,EAAE;YAClE,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACpF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAc,CAAA;QACvB,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;KACnC,CAAA;IAED,OAAO,gBAAgB,CAA0B,KAAK,EAAE,QAAQ,CAAC,CAAA;AACnE,CAAC,CAAA"}
+{"version":3,"file":"trusted.js","sourceRoot":"","sources":["../src/trusted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,MAAM,qBAAqB,GAAG,SAAS,CAAA;AAEvC,2EAA2E;AAC3E,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAEvC,MAAM,cAAc,GAAG,CAAC,EAAU,EAAS,EAAE;IAC3C,MAAM,IAAI,KAAK,CAAC,sEAAsE,EAAE,IAAI,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,KAAa,EAAW,EAAE,CAC9D,MAA6C,CAAC,KAAK,CAAC,CAAA;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,OAAO,GAAoB,EAAE,EAC7B,KAAK,GAAW,qBAAqB,EACZ,EAAE;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,KAAa,EAAwB,EAAE;QACzE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED;;OAEG;IACH,MAAM,KAAK,GAAG,CAAC,SAA2C,EAAwB,EAAE;QAClF,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAA;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;QACpF,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAA;QAChC,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;eAC/B,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,wBAAwB,CAAC,yBAAyB,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,KAAyB,CAAA;QAEhD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC,CAAA;IAED,MAAM,QAAQ,GAAqC;QACjD,IAAI,EAAE,KAAK,EACT,SAA2C,EAAE,KAAmC,EACjD,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;QAEpD,IAAI,EAAE,KAAK,EAAE,MAA8B,EAAE,EAAE;YAC7C,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAuB,CAAA;QAChC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,MAA8B,EAAE,EAAE;YAC/C,IAAI,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;YACjF,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACpF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAuB,CAAC,CAAA;YAC7C,OAAO,MAAuB,CAAA;QAChC,CAAC;QAED,GAAG,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;QACpC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;KACrC,CAAA;IAED,OAAO,gBAAgB,CAA0B,KAAK,EAAE,QAAQ,CAAC,CAAA;AACnE,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/test-auth",
-  "version": "0.1.18-rc.3",
+  "version": "0.1.18-rc.31",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,18 +21,18 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.3",
-    "@owlmeans/auth-common": "^0.1.18-rc.3",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.3",
-    "@owlmeans/basic-keys": "^0.1.18-rc.3",
-    "@owlmeans/context": "^0.1.18-rc.3",
-    "@owlmeans/entrypoint": "^0.1.18-rc.3",
-    "@owlmeans/resource": "^0.1.18-rc.3",
-    "@owlmeans/test": "^0.1.18-rc.3"
+    "@owlmeans/auth": "^0.1.18-rc.30",
+    "@owlmeans/auth-common": "^0.1.18-rc.32",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.31",
+    "@owlmeans/basic-keys": "^0.1.18-rc.33",
+    "@owlmeans/context": "^0.1.18-rc.28",
+    "@owlmeans/entrypoint": "^0.1.18-rc.31",
+    "@owlmeans/resource": "^0.1.18-rc.30",
+    "@owlmeans/test": "^0.1.18-rc.28"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.3.14",
+    "@types/bun": "^1.4.0",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"
   },

package/src/trusted.ts

@@ -1,9 +1,13 @@
 import { appendContextual } from '@owlmeans/context'
 import type { TrustedRecord } from '@owlmeans/auth-common'
-import type { Resource } from '@owlmeans/resource'
+import type { Criteria, FirstOptions, Resource } from '@owlmeans/resource'
+import { UnsupportedArgumentError } from '@owlmeans/resource'
 
 const TRUSTED_DEFAULT_ALIAS = 'TRUSTED'
 
+/** The fields a `trust()` lookup keys on — the only index this map has. */
+const SUPPORTED_FIELDS = ['id', 'name']
+
 const notImplemented = (op: string): never => {
   throw new Error(`@owlmeans/test-auth: in-memory TRUSTED resource does not implement ${op}()`)
 }
@@ -20,6 +24,10 @@ const getter = (record: TrustedRecord, field: string): unknown =>
  * `trust()` boundary plus straightforward seeding from tests. Other
  * operations throw, so tests that need them have to be honest about
  * adding integration coverage instead of leaning on the mock.
+ *
+ * A read takes an id or a single-field criteria over `id` or `name`. Anything
+ * wider is refused rather than scanned: the mock holds a handful of fixtures
+ * and a query it cannot answer exactly is a test reaching past its seam.
  */
 export const makeMemoryTrustedResource = (
   records: TrustedRecord[] = [],
@@ -40,26 +48,39 @@ export const makeMemoryTrustedResource = (
     return null
   }
 
+  /**
+   * @throws {UnsupportedArgumentError} on criteria naming anything but one supported field.
+   */
+  const first = (idOrWhere: string | Criteria<TrustedRecord>): TrustedRecord | null => {
+    if (typeof idOrWhere === 'string') {
+      return store.get(idOrWhere) ?? null
+    }
+
+    const entries = Object.entries(idOrWhere).filter(([, value]) => value !== undefined)
+    const [entry, ...rest] = entries
+    if (entry == null || rest.length > 0
+      || !SUPPORTED_FIELDS.includes(entry[0]) || typeof entry[1] !== 'string') {
+      throw new UnsupportedArgumentError('test-auth:trusted:where')
+    }
+    const [field, value] = entry as [string, string]
+
+    return field === 'id' ? store.get(value) ?? null : findByField(value, field)
+  }
+
   const resource: Partial<Resource<TrustedRecord>> = {
-    load: async <Type extends TrustedRecord>(id: string, field?: unknown) => {
-      const fieldName = typeof field === 'string'
-        ? field
-        : (field as { field?: string } | undefined)?.field
-      if (fieldName != null && fieldName !== 'id') {
-        return (findByField(id, fieldName) as Type | null) ?? null
-      }
-      return (store.get(id) as Type | undefined) ?? null
-    },
+    load: async (
+      idOrWhere: string | Criteria<TrustedRecord>, _opts?: FirstOptions<TrustedRecord>
+    ): Promise<TrustedRecord | null> => first(idOrWhere),
 
-    save: async <Type extends TrustedRecord>(record: Partial<Type>) => {
+    save: async (record: Partial<TrustedRecord>) => {
       if (record.id == null) {
         throw new Error('@owlmeans/test-auth: cannot save TRUSTED record without id')
       }
       store.set(record.id, record as TrustedRecord)
-      return record as Type
+      return record as TrustedRecord
     },
 
-    create: async <Type extends TrustedRecord>(record: Partial<Type>) => {
+    create: async (record: Partial<TrustedRecord>) => {
       if (record.id == null) {
         throw new Error('@owlmeans/test-auth: cannot create TRUSTED record without id')
       }
@@ -67,14 +88,16 @@ export const makeMemoryTrustedResource = (
         throw new Error(`@owlmeans/test-auth: TRUSTED record ${record.id} already exists`)
       }
       store.set(record.id, record as TrustedRecord)
-      return record as Type
+      return record as TrustedRecord
     },
 
     get: () => notImplemented('get'),
     list: () => notImplemented('list'),
+    count: () => notImplemented('count'),
     update: () => notImplemented('update'),
     delete: () => notImplemented('delete'),
-    pick: () => notImplemented('pick'),
+    take: () => notImplemented('take'),
+    purge: () => notImplemented('purge'),
   }
 
   return appendContextual<Resource<TrustedRecord>>(alias, resource)