@stjoseph/prumo 0.5.1 → 0.6.1

package/dist/workspace-yaml.js

@@ -0,0 +1,91 @@
+// pnpm-workspace.yaml as Prumo writes it: `catalog:`, `catalogs:` with a block per named catalog, and `allowBuilds:`,
+// each a top-level key with its entries indented below it. An app that joins only adds to them: an entry already
+// there is the workspace's, and its version wins, since a team that moved it did so on purpose.
+const entryName = (line) => /^\s*'?([^'#\s][^':]*)'?\s*:/.exec(line)?.[1];
+const indentOf = (line) => line.length - line.trimStart().length;
+// The lines of a block's entries, from the line after its key to the first line indented no deeper than it.
+function block(lines, key, indent, from = 0, to = lines.length) {
+    const start = lines.findIndex((line, index) => index >= from && index < to && line === `${' '.repeat(indent)}${key}:`);
+    if (start === -1) {
+        return undefined;
+    }
+    let end = start + 1;
+    while (end < to && (lines[end]?.trim() === '' || indentOf(lines[end] ?? '') > indent)) {
+        end += 1;
+    }
+    // Blank lines before the next key belong to the gap, not to the block.
+    while (end > start + 1 && lines[end - 1]?.trim() === '') {
+        end -= 1;
+    }
+    return { start, end };
+}
+function addEntries(lines, where, entries, indent) {
+    const present = new Set(lines
+        .slice(where.start + 1, where.end)
+        .map(entryName)
+        .filter((name) => name !== undefined));
+    const missing = Object.keys(entries)
+        .filter((name) => !present.has(name))
+        .sort()
+        .map((name) => `${' '.repeat(indent)}'${name}': ${entries[name]}`);
+    lines.splice(where.end, 0, ...missing);
+}
+export function addToCatalogs(text, catalogs) {
+    const lines = text.replace(/\n$/, '').split('\n');
+    const catalog = block(lines, 'catalog', 0);
+    if (catalog === undefined) {
+        lines.push('', 'catalog:');
+        addEntries(lines, { start: lines.length - 1, end: lines.length }, catalogs.default, 2);
+    }
+    else {
+        addEntries(lines, catalog, catalogs.default, 2);
+    }
+    for (const [name, entries] of Object.entries(catalogs.named)) {
+        let named = block(lines, 'catalogs', 0);
+        if (named === undefined) {
+            lines.push('', 'catalogs:');
+            named = { start: lines.length - 1, end: lines.length };
+        }
+        const own = block(lines, name, 2, named.start + 1, named.end);
+        if (own === undefined) {
+            lines.splice(named.end, 0, `  ${name}:`);
+            addEntries(lines, { start: named.end, end: named.end + 1 }, entries, 4);
+        }
+        else {
+            addEntries(lines, own, entries, 4);
+        }
+    }
+    return `${lines.join('\n')}\n`;
+}
+// Each approval arrives with the comment above it that says why, as the template wrote them.
+export function addApprovals(text, approvals) {
+    const lines = text.replace(/\n$/, '').split('\n');
+    let builds = block(lines, 'allowBuilds', 0);
+    if (builds === undefined) {
+        if (approvals.length === 0) {
+            return text;
+        }
+        lines.push('', 'allowBuilds:');
+        builds = { start: lines.length - 1, end: lines.length };
+    }
+    const present = new Set(lines
+        .slice(builds.start + 1, builds.end)
+        .map(entryName)
+        .filter((name) => name !== undefined));
+    const added = [];
+    let comments = [];
+    for (const line of approvals) {
+        if (line.trimStart().startsWith('#')) {
+            comments.push(line);
+            continue;
+        }
+        const name = entryName(line);
+        if (name !== undefined && !present.has(name)) {
+            added.push(...comments, line);
+            present.add(name);
+        }
+        comments = [];
+    }
+    lines.splice(builds.end, 0, ...added);
+    return `${lines.join('\n')}\n`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stjoseph/prumo",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Scaffolds a TypeScript project and ships it the conventions it follows, in a .prumo/ folder any AI assistant reads.",
   "keywords": [
     "scaffolding",

package/templates/api/.env.example

@@ -10,6 +10,7 @@ POSTGRES_PORT=5432
 # Signs the access tokens. `prumo new` writes a random one into .env; never reuse it between environments.
 JWT_SECRET=replace-this-with-at-least-32-characters
 API_URL=http://localhost:3000
+# Every web app the API answers, comma-separated. The first is where MCP consent opens.
 WEB_ORIGIN=http://localhost:5173
 # prumo:social
 # The mobile app's scheme, as in app.json: where it is sent back after signing in with a provider.

package/templates/api/README.md

@@ -51,7 +51,8 @@ one comes from.
 <!-- prumo:mcp -->
 
 The MCP server answers at `/api/mcp`. This API is also the OAuth authorization server that issues its tokens: an MCP
-client finds it through `/.well-known/oauth-protected-resource`, and the user signs in and consents on the web app.
+client finds it through `/.well-known/oauth-protected-resource`, and the user signs in and consents on the first web
+app in `WEB_ORIGIN`.
 <!-- prumo:end-mcp -->
 
 ## Everyday commands

package/templates/api/scripts/ports.mjs

@@ -14,22 +14,23 @@ import { basename, dirname, join, resolve } from 'node:path'
 import { createInterface } from 'node:readline/promises'
 import { parseArgs } from 'node:util'
 
-// Where each app keeps its port, what it falls back to, and how its dev command is told about it.
-const APPS = {
+// Where an app of each type keeps its port, what it falls back to, and how its dev command is told about it.
+const TYPES = {
   api: { key: 'PORT', fallback: 3000, flag: [] },
   web: { key: 'WEB_PORT', fallback: 5173, flag: ['--port', '--strictPort'] },
   site: { key: 'SITE_PORT', fallback: 3200, flag: ['--port'] },
   mobile: { key: 'METRO_PORT', fallback: 8081, flag: ['--port'] },
 }
 
-// A port that moves takes these with it: the key to write, in which app, from which app's port.
+// A port that moves takes these with it: the key to write, in every app of which type. A list holds one URL per app,
+// so only the moving app's entry changes.
 const FOLLOWERS = {
   api: [
-    { app: 'api', key: 'API_URL' },
-    { app: 'web', key: 'VITE_API_URL' },
-    { app: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
+    { type: 'api', key: 'API_URL' },
+    { type: 'web', key: 'VITE_API_URL' },
+    { type: 'mobile', key: 'EXPO_PUBLIC_API_URL' },
   ],
-  web: [{ app: 'api', key: 'WEB_ORIGIN' }],
+  web: [{ type: 'api', key: 'WEB_ORIGIN', list: true }],
   site: [],
   mobile: [],
 }
@@ -117,36 +118,43 @@ function projectRoot() {
 const root = projectRoot()
 const workspace = existsSync(join(root, 'apps'))
 
-function directoryOf(type) {
-  return workspace ? join(root, 'apps', type) : root
+function readConfig() {
+  const path = join(root, '.prumo', 'config.json')
+
+  return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {}
 }
 
-function typeOf(directory) {
-  const name = basename(directory)
+// Every app of the project, as { name, type, directory }. A workspace lists its apps in .prumo/config.json; one written
+// before apps had names holds one per type, named after it. An alone project is its one app, named after its type.
+function projectApps() {
+  const config = readConfig()
+
+  if (!workspace) {
+    // A project is named by its author, so only .prumo/config.json says what it is.
+    const type = TYPES[basename(root)] !== undefined ? basename(root) : config.types?.[0]
 
-  if (APPS[name] !== undefined) {
-    return name
+    return type === undefined ? [] : [{ name: type, type, directory: root }]
   }
 
-  // An alone project is named by its author, so only .prumo/config.json says what it is.
-  const config = join(root, '.prumo', 'config.json')
-  const types = existsSync(config) ? JSON.parse(readFileSync(config, 'utf8')).types : []
+  const listed = config.apps ?? (config.types ?? []).map((type) => ({ name: type, type }))
 
-  return types[0]
+  return listed
+    .map((app) => ({ ...app, directory: join(root, 'apps', app.name) }))
+    .filter(
+      (app) => TYPES[app.type] !== undefined && existsSync(join(app.directory, 'package.json')),
+    )
 }
 
-function typesToCheck() {
-  if (!values.all) {
-    return [typeOf(here)]
-  }
+const apps = projectApps()
 
-  return Object.keys(APPS).filter((type) => existsSync(join(directoryOf(type), 'package.json')))
+function appsToCheck() {
+  return values.all ? apps : apps.filter((app) => app.directory === here)
 }
 
-function portOf(type) {
-  const app = APPS[type]
+function portOf(app) {
+  const { key, fallback } = TYPES[app.type]
 
-  return Number(envValue(readEnv(directoryOf(type)), app.key) ?? app.fallback)
+  return Number(envValue(readEnv(app.directory), key) ?? fallback)
 }
 
 function listening(host, port) {
@@ -269,22 +277,31 @@ async function nextFree(from) {
   throw new Failure('port_busy', `No free port between ${from + 1} and ${from + PORTS_TRIED - 1}.`)
 }
 
-function movePort(type, port) {
-  const app = APPS[type]
+function movePort(app, from, port) {
+  const before = `http://localhost:${from}`
+  const after = `http://localhost:${port}`
 
-  writeEnvValue(directoryOf(type), app.key, port)
+  writeEnvValue(app.directory, TYPES[app.type].key, port)
 
-  for (const follower of FOLLOWERS[type]) {
-    const directory = directoryOf(follower.app)
+  for (const follower of FOLLOWERS[app.type]) {
+    for (const other of apps.filter((each) => each.type === follower.type)) {
+      const current = envValue(readEnv(other.directory), follower.key)
+      const entries = (current ?? '').split(',').map((entry) => entry.trim())
+      const value =
+        follower.list && current !== undefined
+          ? (entries.includes(before)
+              ? entries.map((entry) => (entry === before ? after : entry))
+              : [...entries, after]
+            ).join(',')
+          : after
 
-    if (existsSync(join(directory, 'package.json'))) {
-      writeEnvValue(directory, follower.key, `http://localhost:${port}`)
+      writeEnvValue(other.directory, follower.key, value)
     }
   }
 }
 
-async function settle(type) {
-  const port = portOf(type)
+async function settle(app) {
+  const port = portOf(app)
 
   if (!(await taken(port))) {
     return port
@@ -292,12 +309,12 @@ async function settle(type) {
 
   const found = holders(port)
 
-  say(`${type} wants port ${port}, held by ${describe(found)}.`)
+  say(`${app.name} wants port ${port}, held by ${describe(found)}.`)
 
   const moved = async () => {
     const free = await nextFree(port)
-    movePort(type, free)
-    say(`${type} moved to port ${free}, written to .env.`)
+    movePort(app, port, free)
+    say(`${app.name} moved to port ${free}, written to .env.`)
     return free
   }
 
@@ -311,7 +328,7 @@ async function settle(type) {
   if (!interactive) {
     throw new Failure(
       'port_busy',
-      `Port ${port} is in use by ${describe(found)}. Pass --kill to stop it, or --change to move ${type} to the next free port.`,
+      `Port ${port} is in use by ${describe(found)}. Pass --kill to stop it, or --change to move ${app.name} to the next free port.`,
     )
   }
 
@@ -669,10 +686,8 @@ async function main() {
   const starting = command === undefined ? undefined : startJob()
 
   try {
-    for (const type of typesToCheck()) {
-      if (type !== undefined) {
-        ports[type] = await settle(type)
-      }
+    for (const app of appsToCheck()) {
+      ports[app.name] = await settle(app)
     }
   } catch (error) {
     ;(await starting)?.close()
@@ -685,10 +700,10 @@ async function main() {
 
   // Only an app tells its command which port to use. A workspace root wraps `pnpm`, which would pass a stray
   // `--port` on to every app it runs.
-  const [type] = values.all ? [] : Object.keys(ports)
-  const flag = APPS[type ?? '']?.flag ?? []
+  const [app] = values.all ? [] : appsToCheck()
+  const flag = app === undefined ? [] : TYPES[app.type].flag
   const withPort = flag.flatMap((entry) =>
-    entry === '--port' ? ['--port', String(ports[type])] : [entry],
+    entry === '--port' ? ['--port', String(ports[app.name])] : [entry],
   )
   // Before the command starts, so that it and everything it starts are members from their first instant.
   const job = await starting

package/templates/api/src/infra/config/env.ts

@@ -1,6 +1,9 @@
 import { existsSync } from 'node:fs'
 import { z } from 'zod'
 
+// Written as a browser sends it in an Origin header: scheme, host and port, with no path or trailing slash.
+const origin = z.url().transform((url) => new URL(url).origin)
+
 const envSchema = z.object({
   NODE_ENV: z.enum(['development', 'test', 'production']),
   PORT: z.coerce.number().int().min(1).max(65535),
@@ -8,7 +11,11 @@ const envSchema = z.object({
   JWT_SECRET: z.string().min(32),
   // Where this API is reached from outside: the issuer of its tokens, and what decides whether cookies are Secure.
   API_URL: z.url(),
-  WEB_ORIGIN: z.string().min(1),
+  // Every web app this API answers, comma-separated. The first is the one MCP consent opens on.
+  WEB_ORIGIN: z
+    .string()
+    .transform((value) => value.split(',').map((origin) => origin.trim()))
+    .pipe(z.tuple([origin], origin)),
   // prumo:social
   // Where a mobile app is sent back after signing in with a provider: its own scheme, as in app.json.
   MOBILE_APP_SCHEME: z

package/templates/api/src/infra/http/controllers/oauth.controller.ts

@@ -129,8 +129,8 @@ export async function oauthController(fastify: FastifyInstance): Promise<void> {
           scopesSupported,
         )
 
-        // Signing in, if needed, and the consent itself happen on the web app.
-        return reply.redirect(`${env.WEB_ORIGIN}/consent?request=${authorization.id}`)
+        // Signing in, if needed, and the consent itself happen on the first web app.
+        return reply.redirect(`${env.WEB_ORIGIN[0]}/consent?request=${authorization.id}`)
       } catch (error) {
         if (error instanceof AuthorizationRequestError) {
           return reply.redirect(

package/templates/api/src/infra/http/controllers/social.controller.ts

@@ -51,10 +51,14 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
     path: '/api/auth/social',
   } as const
 
-  const back = (client: SocialClient, query: Record<string, string>) =>
+  // A web app is sent back to itself, so only an origin this API trusts is ever a destination.
+  const trusted = (origin: string | undefined) =>
+    origin !== undefined && env.WEB_ORIGIN.includes(origin) ? origin : env.WEB_ORIGIN[0]
+
+  const back = (client: SocialClient, origin: string, query: Record<string, string>) =>
     client === 'mobile'
       ? `${env.MOBILE_APP_SCHEME}://social?${new URLSearchParams(query)}`
-      : `${env.WEB_ORIGIN}/sign-in?${new URLSearchParams(query)}`
+      : `${origin}/sign-in?${new URLSearchParams(query)}`
 
   // Apple's answer is a form.
   app.addContentTypeParser(
@@ -73,11 +77,19 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
         querystring: z.object({
           client: z.enum(['web', 'mobile']).default('web'),
           returnTo: z.string().max(512).optional(),
+          // The web app that started, when there are several; one the API does not trust is refused.
+          origin: z.string().max(512).optional(),
         }),
       },
     },
     async (request, reply) => {
-      const { client, returnTo } = request.query
+      const { client, returnTo, origin: requested } = request.query
+
+      if (requested !== undefined && !env.WEB_ORIGIN.includes(requested)) {
+        throw new HttpError(422, 'origin is not one of the web apps this API trusts')
+      }
+
+      const origin = client === 'web' ? trusted(requested) : ''
 
       if (client === 'mobile' && env.MOBILE_APP_SCHEME === undefined) {
         throw new HttpError(
@@ -92,8 +104,9 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
         returnTo: safePath(returnTo),
       })
 
-      // The client rides beside the token, so an error found before the flow is read still goes to the right place.
-      reply.setCookie(BROWSER_COOKIE, `${client}~${started.browserToken}`, {
+      // The client and its origin ride beside the token, so an error found before the flow is read still goes to the
+      // right place.
+      reply.setCookie(BROWSER_COOKIE, `${client}~${origin}~${started.browserToken}`, {
         ...cookie,
         maxAge: BROWSER_COOKIE_MAX_AGE_S,
       })
@@ -132,16 +145,17 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
       },
     },
     async (request, reply) => {
-      const [client, browserToken] = (request.cookies[BROWSER_COOKIE] ?? 'web~').split('~') as [
-        SocialClient,
-        string,
-      ]
+      const [client, written, browserToken] = (request.cookies[BROWSER_COOKIE] ?? 'web~~').split(
+        '~',
+      ) as [SocialClient, string | undefined, string | undefined]
+      // Read back through the list, so a cookie edited by hand cannot name a destination of its own.
+      const origin = trusted(written)
       const { state, code, error } = request.query
 
       reply.clearCookie(BROWSER_COOKIE, cookie)
 
       if (error !== undefined || state === undefined || code === undefined) {
-        return reply.redirect(back(client, { error: 'social_sign_in_failed' }))
+        return reply.redirect(back(client, origin, { error: 'social_sign_in_failed' }))
       }
 
       try {
@@ -154,15 +168,17 @@ export async function socialController(fastify: FastifyInstance): Promise<void>
         })
 
         if (outcome.client === 'mobile') {
-          return reply.redirect(back('mobile', { code: outcome.code }))
+          return reply.redirect(back('mobile', origin, { code: outcome.code }))
         }
 
         setCookies(reply, outcome.tokens)
 
-        return reply.redirect(`${env.WEB_ORIGIN}${outcome.returnTo}`)
+        return reply.redirect(`${origin}${outcome.returnTo}`)
       } catch (caught) {
         if (caught instanceof DomainError) {
-          return reply.redirect(back(client, { error: caught.code ?? 'social_sign_in_failed' }))
+          return reply.redirect(
+            back(client, origin, { error: caught.code ?? 'social_sign_in_failed' }),
+          )
         }
 
         throw caught

package/templates/api/src/infra/http/hooks/origin.hook.ts

@@ -4,9 +4,9 @@ import { HttpError } from '@/infra/http/errors/http-error'
 const SAFE = new Set(['GET', 'HEAD', 'OPTIONS'])
 
 // A cookie is sent by the browser whoever wrote the page, so a request that changes something and leans on one must
-// come from the web app. Without a cookie there is nothing for another site to borrow: a native app and an MCP
-// client send a bearer, and pass.
-export function registerOriginCheck(app: FastifyInstance, webOrigin: string): void {
+// come from one of the web apps. Without a cookie there is nothing for another site to borrow: a native app and an
+// MCP client send a bearer, and pass.
+export function registerOriginCheck(app: FastifyInstance, webOrigins: string[]): void {
   app.addHook('onRequest', async (request) => {
     const leansOnCookie =
       request.headers.cookie !== undefined && request.headers.authorization === undefined
@@ -15,7 +15,7 @@ export function registerOriginCheck(app: FastifyInstance, webOrigin: string): vo
       return
     }
 
-    if (request.headers.origin !== webOrigin) {
+    if (request.headers.origin === undefined || !webOrigins.includes(request.headers.origin)) {
       throw new HttpError(403, 'Cross-origin request refused')
     }
   })

package/templates/api/src/infra/social/openid-identity-providers.adapter.ts

@@ -1,4 +1,4 @@
-import { importPKCS8, SignJWT } from 'jose'
+import { importPKCS8, SignJWT } from 'jose' // prumo:apple
 import * as oidc from 'openid-client'
 import { SocialSignInFailedError } from '@/domain/auth/errors/social-sign-in-failed.error'
 import type {

package/templates/api/test/infra/config/env.spec.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest'
+import { validate } from '@/infra/config/env'
+
+const RAW = {
+  NODE_ENV: 'test',
+  PORT: '3000',
+  DATABASE_URL: 'postgres://app:app@localhost:5432/app',
+  JWT_SECRET: 'test-secret-that-is-at-least-32-characters',
+  API_URL: 'http://localhost:3000',
+  LOG_LEVEL: 'error',
+}
+
+describe('WEB_ORIGIN', () => {
+  it('holds every web app, comma-separated, written as a browser sends its origin', () => {
+    const env = validate({ ...RAW, WEB_ORIGIN: 'http://localhost:5173, http://localhost:5174/' })
+
+    expect(env.WEB_ORIGIN).toEqual(['http://localhost:5173', 'http://localhost:5174'])
+  })
+
+  it('refuses an empty list and an entry that is not a URL', () => {
+    expect(() => validate({ ...RAW, WEB_ORIGIN: '' })).toThrow('WEB_ORIGIN')
+    expect(() => validate({ ...RAW, WEB_ORIGIN: 'http://localhost:5173,backoffice' })).toThrow(
+      'WEB_ORIGIN',
+    )
+  })
+})

package/templates/api/test/infra/http/controllers/auth.controller.spec.ts

@@ -1,3 +1,4 @@
+import { testEnv } from '@test/support/setup'
 import { ORIGIN, PASSWORD, testApp } from '@test/support/test-app'
 import type { FastifyInstance, LightMyRequestResponse } from 'fastify'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
@@ -83,6 +84,29 @@ describe('auth controller, on the web', () => {
   })
 })
 
+describe('auth controller, with several web apps', () => {
+  it('lets each of them lean on its cookie, and tells the browser so', async () => {
+    const backoffice = 'http://localhost:5174'
+    const several = await testApp({ env: { ...testEnv(), WEB_ORIGIN: [ORIGIN, backoffice] } })
+    const cookie = `access_token=${cookiesOf((await several.signUp()).response).access_token}`
+    const signedOut = await several.app.inject({
+      method: 'POST',
+      url: '/api/auth/sign-out',
+      headers: { cookie, origin: backoffice },
+    })
+    const preflight = await several.app.inject({
+      method: 'OPTIONS',
+      url: '/api/auth/sign-out',
+      headers: { origin: backoffice, 'access-control-request-method': 'POST' },
+    })
+
+    expect(signedOut.statusCode).toBe(204)
+    expect(preflight.headers['access-control-allow-origin']).toBe(backoffice)
+
+    await several.app.close()
+  })
+})
+
 describe('auth controller, for a native client', () => {
   it('hands the tokens over in the body, and accepts them as a bearer', async () => {
     const { response } = await signUp({ bearer: true })

package/templates/api/test/infra/http/controllers/social.controller.spec.ts

@@ -6,6 +6,7 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { IDENTITY_PROVIDERS } from '@/domain/auth/ports/identity-providers.port'
 
 const WEB = 'http://localhost:5173'
+const BACKOFFICE = 'http://localhost:5174'
 
 // Whichever provider the project kept: the flow is the same for each.
 const PROVIDER = [
@@ -26,7 +27,7 @@ function stateOf(response: LightMyRequestResponse): string {
 
 beforeEach(async () => {
   ;({ app } = await testApp({
-    env: { ...testEnv(), MOBILE_APP_SCHEME: 'acme' },
+    env: { ...testEnv(), WEB_ORIGIN: [WEB, BACKOFFICE], MOBILE_APP_SCHEME: 'acme' },
     configure: (container) =>
       container.register(IDENTITY_PROVIDERS, { useValue: new FakeIdentityProviders() }),
   }))
@@ -69,6 +70,27 @@ describe('social sign-in on the web', () => {
     expect(back.headers.location).toBe(`${WEB}/`)
   })
 
+  it('sends each web app back to itself, and refuses an origin it does not trust', async () => {
+    const started = await app.inject({
+      url: `/api/auth/social/${PROVIDER}?returnTo=/orders&origin=${encodeURIComponent(BACKOFFICE)}`,
+    })
+    const back = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?code=c&state=${stateOf(started)}`,
+      headers: { cookie: browserCookie(started) },
+    })
+    const failed = await app.inject({
+      url: `/api/auth/social/${PROVIDER}/callback?error=access_denied`,
+      headers: { cookie: browserCookie(started) },
+    })
+    const foreign = await app.inject({
+      url: `/api/auth/social/${PROVIDER}?origin=${encodeURIComponent('https://evil.example')}`,
+    })
+
+    expect(back.headers.location).toBe(`${BACKOFFICE}/orders`)
+    expect(failed.headers.location).toBe(`${BACKOFFICE}/sign-in?error=social_sign_in_failed`)
+    expect(foreign.statusCode).toBe(422)
+  })
+
   it('turns a form post, as Apple sends, into a redirect the browser’s cookie comes with', async () => {
     const posted = await app.inject({
       method: 'POST',

package/templates/api/test/support/setup.ts

@@ -25,7 +25,7 @@ export function testEnv(): Env {
     DATABASE_URL: databaseUrl,
     JWT_SECRET: 'test-secret-that-is-at-least-32-characters',
     API_URL: 'http://localhost:3000',
-    WEB_ORIGIN: 'http://localhost:5173',
+    WEB_ORIGIN: ['http://localhost:5173'],
     LOG_LEVEL: 'error',
   }
 }