@specific.dev/spectest 0.88.0 → 0.88.1

package/dist/components/emulate/service.js

@@ -26,11 +26,10 @@
 // `entry.mjs` routes by Host header, applies the per-provider path table,
 // and corrects the discovery document. It also re-issues every id_token
 // with one RSA key it generates at boot, and serves that key at the
-// provider's real JWKS URL. That single step covers three separate faults:
+// provider's real JWKS URL. This normalizes signing and issuer handling:
 // the Google emulator signs HS256 and publishes an empty JWKS (so nothing
-// can verify its token), the Microsoft one cannot put the tenant in its
-// issuer, and any future provider whose issuer is not its base URL is
-// handled in advance.
+// can verify its token), and providers whose issuer differs from their
+// base URL can declare it explicitly.
 //
 // The Dockerfile is deliberately CONSTANT — every provider package is
 // installed whether or not this component is the one using it. Two reasons:

package/dist/components/microsoft.d.ts

@@ -2,8 +2,8 @@ import type { ProviderOptions } from "./emulate/service.js";
 export interface MicrosoftOptions extends ProviderOptions {
     /**
      * Directory (tenant) the app signs in against — whatever its authority
-     * URL uses. It appears in the issuer and in every endpoint path, so a
-     * client that checks the issuer sees what it expects. Default `"common"`.
+     * URL uses. Sets the seeded users' and client's tenant as well as the
+     * issuer and endpoint paths. Default `"common"`.
      */
     tenantId?: string;
 }

package/dist/components/microsoft.js

@@ -8,16 +8,15 @@
 // widening what it serves is a table entry.
 import { emulatorService, oauthClients, resolveUsers } from "./emulate/service.js";
 function spec(users, opts) {
-    const authority = `https://login.microsoftonline.com/${opts.tenantId || "common"}`;
+    const tenantId = opts.tenantId || "common";
+    const authority = `https://login.microsoftonline.com/${tenantId}`;
     return {
         name: "microsoft",
         module: "@emulators/microsoft",
         pluginExport: "microsoftPlugin",
         baseUrl: "https://login.microsoftonline.com",
         hosts: ["login.microsoftonline.com", "graph.microsoft.com"],
-        // The emulator has no tenant, so its issuer is the bare host. A client
-        // that checks the issuer against the authority it configured would
-        // reject that; the re-issue step corrects it.
+        // Keep the re-issued token aligned with discovery and the seeded tenant.
         issuer: `${authority}/v2.0`,
         discovery: {
             issuer: `${authority}/v2.0`,
@@ -40,8 +39,8 @@ function spec(users, opts) {
             scopes: ["openid", "email", "profile", "User.Read"],
         },
         seed: {
-            users: users.map((u) => ({ email: u.email, name: u.name })),
-            ...oauthClients(opts.client),
+            users: users.map((u) => ({ email: u.email, name: u.name, tenant_id: tenantId })),
+            ...oauthClients(opts.client, { tenant_id: tenantId }),
         },
     };
 }

package/dist/index.d.ts

@@ -823,7 +823,7 @@ export type ServiceImage = {
  * Runs in `defineEnvironment`, and in the daemon's runtime `startService`
  * twin, inside the VM, where the repo sits at the project root. Existence
  * checks go through the project-file resolver, so the same rules as
- * `ctx.readProjectFile` apply (a `spectest/.envignore`d path is refused
+ * `ctx.readProjectFile` apply (a `spectest/.specignore`d path is refused
  * instead of read stale).
  */
 export declare function validateServiceImage(serviceName: string, image: ServiceImage): ServiceImage;

package/dist/index.js

@@ -253,7 +253,7 @@ const BUILD_TARGET_RE = /^[^\s]+$/;
  * Runs in `defineEnvironment`, and in the daemon's runtime `startService`
  * twin, inside the VM, where the repo sits at the project root. Existence
  * checks go through the project-file resolver, so the same rules as
- * `ctx.readProjectFile` apply (a `spectest/.envignore`d path is refused
+ * `ctx.readProjectFile` apply (a `spectest/.specignore`d path is refused
  * instead of read stale).
  */
 export function validateServiceImage(serviceName, image) {

package/dist/project-files.js

@@ -12,14 +12,14 @@
 // is correct for every file that is IN that hash. It can be behind for the two
 // kinds of file the hash excludes: `spectest/tests/**` (excluded so a test-only
 // edit keeps the fast start) and anything a project lists in
-// `spectest/.envignore`.
+// `spectest/.specignore`.
 //
 // Hence the rule below: a path under `spectest/` resolves against the app copy
 // first, because that copy is always current — this is what lets a fixture live
 // in `spectest/tests/fixtures/` and still be found after it was added. Any
 // other path resolves against /workspace, which the hash keeps current.
 //
-// The remaining hole is a file that `.envignore` excludes AND that sits outside
+// The remaining hole is a file that `.specignore` excludes AND that sits outside
 // `spectest/`: /workspace holds whatever the cold start uploaded, so a later
 // edit is invisible. Nothing can repair those bytes at read time, so we refuse
 // to read them instead of returning stale content. The control plane writes the
@@ -31,8 +31,8 @@ export const WORKSPACE = process.env.SPECTEST_WORKSPACE ?? "/workspace";
 /** The app dir; the user's `spectest/` sits directly under it. */
 export const APP_DIR = process.env.SPECTEST_APP_DIR ?? "/opt/spectest/app";
 /** Paths (repo-relative) the warm-template hash skipped because of
- *  `spectest/.envignore`. Written by the control plane at env start; absent
- *  when the project ships no `.envignore`. */
+ *  `spectest/.specignore`. Written by the control plane at env start; absent
+ *  when the project ships no `.specignore`. */
 const ENV_IGNORED_FILE = "/run/spectest-env-ignored.json";
 let _envIgnored;
 function envIgnored() {
@@ -44,7 +44,7 @@ function envIgnored() {
         paths = raw.paths ?? [];
     }
     catch {
-        /* No file (no .envignore, or an older env) — nothing to refuse. */
+        /* No file (no .specignore, or an older env) — nothing to refuse. */
     }
     _envIgnored = new Set(paths);
     return _envIgnored;
@@ -90,7 +90,7 @@ export function resolveProjectPath(p, opts = {}) {
             return app;
     }
     if (envIgnored().has(rel)) {
-        throw new Error(`project file "${p}" is excluded by spectest/.envignore, so the copy in the VM ` +
+        throw new Error(`project file "${p}" is excluded by the environment cache ignore rules, so the copy in the VM ` +
             `is whatever a cold start uploaded and can be out of date. Move it under ` +
             `spectest/tests/ (still cache-free, and always re-uploaded), or drop the pattern.`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.88.0",
+  "version": "0.88.1",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/emulate/entry.mjs

@@ -17,13 +17,11 @@
 //     origin. Real providers spread them over several hosts. We merge the
 //     real URLs in.
 //   * JWKS — we serve one RSA public key, for every provider.
-//   * id_token — we re-issue it: same claims, RS256, our key, and a
-//     corrected `iss` where the emulator cannot know it. This is one step
-//     that fixes three faults. The Google emulator signs HS256 and serves
-//     an empty JWKS, so no client can verify its token. The Microsoft one
-//     cannot put the tenant in the issuer, because it does not know it.
-//     And any future provider whose issuer does not match its base URL is
-//     covered in advance. No signature check is needed on the way in: the
+//   * id_token — we re-issue it: same claims, RS256, our key, and an
+//     explicit `iss` where the provider declares one. The Google emulator
+//     signs HS256 and serves an empty JWKS, so no client can verify its
+//     token. Providers whose issuer differs from their base URL can
+//     declare it explicitly. No signature check is needed on the way in: the
 //     token comes from an in-process function call, not from the network.
 //   * the account picker page — each button gets a `data-testid`, so a
 //     browser test has a stable locator.

package/src/components/emulate/service.ts

@@ -26,11 +26,10 @@
 // `entry.mjs` routes by Host header, applies the per-provider path table,
 // and corrects the discovery document. It also re-issues every id_token
 // with one RSA key it generates at boot, and serves that key at the
-// provider's real JWKS URL. That single step covers three separate faults:
+// provider's real JWKS URL. This normalizes signing and issuer handling:
 // the Google emulator signs HS256 and publishes an empty JWKS (so nothing
-// can verify its token), the Microsoft one cannot put the tenant in its
-// issuer, and any future provider whose issuer is not its base URL is
-// handled in advance.
+// can verify its token), and providers whose issuer differs from their
+// base URL can declare it explicitly.
 //
 // The Dockerfile is deliberately CONSTANT — every provider package is
 // installed whether or not this component is the one using it. Two reasons:

package/src/components/microsoft.ts

@@ -13,23 +13,22 @@ import { emulatorService, oauthClients, resolveUsers } from "./emulate/service.j
 export interface MicrosoftOptions extends ProviderOptions {
   /**
    * Directory (tenant) the app signs in against — whatever its authority
-   * URL uses. It appears in the issuer and in every endpoint path, so a
-   * client that checks the issuer sees what it expects. Default `"common"`.
+   * URL uses. Sets the seeded users' and client's tenant as well as the
+   * issuer and endpoint paths. Default `"common"`.
    */
   tenantId?: string;
 }
 
 function spec(users: ProviderUser[], opts: MicrosoftOptions): ProviderSpec {
-  const authority = `https://login.microsoftonline.com/${opts.tenantId || "common"}`;
+  const tenantId = opts.tenantId || "common";
+  const authority = `https://login.microsoftonline.com/${tenantId}`;
   return {
     name: "microsoft",
     module: "@emulators/microsoft",
     pluginExport: "microsoftPlugin",
     baseUrl: "https://login.microsoftonline.com",
     hosts: ["login.microsoftonline.com", "graph.microsoft.com"],
-    // The emulator has no tenant, so its issuer is the bare host. A client
-    // that checks the issuer against the authority it configured would
-    // reject that; the re-issue step corrects it.
+    // Keep the re-issued token aligned with discovery and the seeded tenant.
     issuer: `${authority}/v2.0`,
     discovery: {
       issuer: `${authority}/v2.0`,
@@ -52,8 +51,8 @@ function spec(users: ProviderUser[], opts: MicrosoftOptions): ProviderSpec {
       scopes: ["openid", "email", "profile", "User.Read"],
     },
     seed: {
-      users: users.map((u) => ({ email: u.email, name: u.name })),
-      ...oauthClients(opts.client),
+      users: users.map((u) => ({ email: u.email, name: u.name, tenant_id: tenantId })),
+      ...oauthClients(opts.client, { tenant_id: tenantId }),
     },
   };
 }

package/src/index.ts

@@ -1254,7 +1254,7 @@ const BUILD_TARGET_RE = /^[^\s]+$/;
  * Runs in `defineEnvironment`, and in the daemon's runtime `startService`
  * twin, inside the VM, where the repo sits at the project root. Existence
  * checks go through the project-file resolver, so the same rules as
- * `ctx.readProjectFile` apply (a `spectest/.envignore`d path is refused
+ * `ctx.readProjectFile` apply (a `spectest/.specignore`d path is refused
  * instead of read stale).
  */
 export function validateServiceImage(serviceName: string, image: ServiceImage): ServiceImage {

package/src/project-files.ts

@@ -12,14 +12,14 @@
 // is correct for every file that is IN that hash. It can be behind for the two
 // kinds of file the hash excludes: `spectest/tests/**` (excluded so a test-only
 // edit keeps the fast start) and anything a project lists in
-// `spectest/.envignore`.
+// `spectest/.specignore`.
 //
 // Hence the rule below: a path under `spectest/` resolves against the app copy
 // first, because that copy is always current — this is what lets a fixture live
 // in `spectest/tests/fixtures/` and still be found after it was added. Any
 // other path resolves against /workspace, which the hash keeps current.
 //
-// The remaining hole is a file that `.envignore` excludes AND that sits outside
+// The remaining hole is a file that `.specignore` excludes AND that sits outside
 // `spectest/`: /workspace holds whatever the cold start uploaded, so a later
 // edit is invisible. Nothing can repair those bytes at read time, so we refuse
 // to read them instead of returning stale content. The control plane writes the
@@ -34,8 +34,8 @@ export const WORKSPACE = process.env.SPECTEST_WORKSPACE ?? "/workspace";
 export const APP_DIR = process.env.SPECTEST_APP_DIR ?? "/opt/spectest/app";
 
 /** Paths (repo-relative) the warm-template hash skipped because of
- *  `spectest/.envignore`. Written by the control plane at env start; absent
- *  when the project ships no `.envignore`. */
+ *  `spectest/.specignore`. Written by the control plane at env start; absent
+ *  when the project ships no `.specignore`. */
 const ENV_IGNORED_FILE = "/run/spectest-env-ignored.json";
 
 let _envIgnored: Set<string> | undefined;
@@ -46,7 +46,7 @@ function envIgnored(): Set<string> {
     const raw = JSON.parse(readFileSync(ENV_IGNORED_FILE, "utf8")) as { paths?: string[] };
     paths = raw.paths ?? [];
   } catch {
-    /* No file (no .envignore, or an older env) — nothing to refuse. */
+    /* No file (no .specignore, or an older env) — nothing to refuse. */
   }
   _envIgnored = new Set(paths);
   return _envIgnored;
@@ -94,7 +94,7 @@ export function resolveProjectPath(p: string, opts: { record?: boolean } = {}):
   }
   if (envIgnored().has(rel)) {
     throw new Error(
-      `project file "${p}" is excluded by spectest/.envignore, so the copy in the VM ` +
+      `project file "${p}" is excluded by the environment cache ignore rules, so the copy in the VM ` +
         `is whatever a cold start uploaded and can be out of date. Move it under ` +
         `spectest/tests/ (still cache-free, and always re-uploaded), or drop the pattern.`,
     );