okengine 0.4.3 → 0.5.0

package/src/plugins/auth-methods.test.ts

@@ -0,0 +1,176 @@
+/**
+ * Phase 2 Gate auth method plugins — username, anonymous, magic-link, email OTP.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { oke } from "../kernel/app.ts";
+import { resetFlowSeq } from "../kernel/flow.ts";
+import { resetBindings } from "../kernel/on.ts";
+import { anonymous } from "./anonymous.ts";
+import { emailOtp } from "./email-otp.ts";
+import { magicLink } from "./magic-link.ts";
+import { username } from "./username.ts";
+
+afterEach(() => {
+  resetBindings();
+  resetFlowSeq();
+});
+
+function authApp() {
+  return oke({
+    name: "auth-plugins",
+    env: "test",
+    registry: "ignore",
+    gate: {
+      auth: {
+        secret: "test-secret-at-least-16",
+        emailAndPassword: { enabled: true },
+      },
+    },
+  })
+    .plug(username())
+    .plug(anonymous())
+    .plug(magicLink({ exposeDevToken: true }))
+    .plug(emailOtp({ exposeDevOtp: true }));
+}
+
+describe("auth method plugins", () => {
+  test("bindings appear on router after .plug()", async () => {
+    const app = authApp();
+    expect(app.router.match("POST", "/auth/sign-up/username")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/sign-in/username")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/sign-in/anonymous")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/magic-link/request")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/magic-link/verify")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/email-otp/request")).toBeTruthy();
+    expect(app.router.match("POST", "/auth/email-otp/verify")).toBeTruthy();
+    await app.boot({ env: "test" });
+    await app.stop();
+  });
+
+  test("username sign-up + sign-in", async () => {
+    const app = authApp();
+    await app.boot({ env: "test" });
+
+    const signUp = await app.fetch(
+      new Request("http://localhost/auth/sign-up/username", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "alice", password: "CorrectHorse1" }),
+      }),
+    );
+    expect(signUp.status).toBe(200);
+    const created = (await signUp.json()) as {
+      data: { accessToken: string; userId: string };
+    };
+    expect(created.data.accessToken).toBeTruthy();
+    expect(created.data.userId).toBeTruthy();
+
+    const bad = await app.fetch(
+      new Request("http://localhost/auth/sign-in/username", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "alice", password: "wrong-password" }),
+      }),
+    );
+    const badBody = (await bad.json()) as { error: { data?: { reason?: string } } };
+    expect(badBody.error.data?.reason).toBe("invalid_credentials");
+
+    const signIn = await app.fetch(
+      new Request("http://localhost/auth/sign-in/username", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ username: "alice", password: "CorrectHorse1" }),
+      }),
+    );
+    expect(signIn.status).toBe(200);
+    const session = (await signIn.json()) as { data: { accessToken: string } };
+    expect(session.data.accessToken).toBeTruthy();
+
+    await app.stop();
+  });
+
+  test("anonymous sign-in issues session", async () => {
+    const app = authApp();
+    await app.boot({ env: "test" });
+
+    const res = await app.fetch(
+      new Request("http://localhost/auth/sign-in/anonymous", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      data: { accessToken: string; userId: string };
+    };
+    expect(body.data.accessToken).toBeTruthy();
+    expect(body.data.userId).toBeTruthy();
+
+    await app.stop();
+  });
+
+  test("magic-link request + verify with devToken", async () => {
+    const app = authApp();
+    await app.boot({ env: "test" });
+
+    const req = await app.fetch(
+      new Request("http://localhost/auth/magic-link/request", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ email: "ml@example.com" }),
+      }),
+    );
+    expect(req.status).toBe(200);
+    const requested = (await req.json()) as { data: { ok: true; devToken?: string } };
+    expect(requested.data.ok).toBe(true);
+    expect(requested.data.devToken).toBeTruthy();
+
+    const verify = await app.fetch(
+      new Request("http://localhost/auth/magic-link/verify", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: requested.data.devToken }),
+      }),
+    );
+    expect(verify.status).toBe(200);
+    const session = (await verify.json()) as { data: { accessToken: string; userId: string } };
+    expect(session.data.accessToken).toBeTruthy();
+    expect(session.data.userId).toBeTruthy();
+
+    await app.stop();
+  });
+
+  test("email OTP request + verify with devOtp", async () => {
+    const app = authApp();
+    await app.boot({ env: "test" });
+
+    const req = await app.fetch(
+      new Request("http://localhost/auth/email-otp/request", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ email: "otp@example.com" }),
+      }),
+    );
+    expect(req.status).toBe(200);
+    const requested = (await req.json()) as { data: { ok: true; devOtp?: string } };
+    expect(requested.data.devOtp).toMatch(/^\d{6}$/);
+
+    const verify = await app.fetch(
+      new Request("http://localhost/auth/email-otp/verify", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          email: "otp@example.com",
+          otp: requested.data.devOtp,
+        }),
+      }),
+    );
+    expect(verify.status).toBe(200);
+    const session = (await verify.json()) as { data: { accessToken: string } };
+    expect(session.data.accessToken).toBeTruthy();
+
+    await app.stop();
+  });
+});

package/src/plugins/compression.test.ts

@@ -38,7 +38,7 @@ describe("acceptsGzip", () => {
 describe("compression plugin", () => {
   test("gzips a large JSON body when the client accepts gzip", async () => {
     on(http.get("/big"), flow({ name: "big.get", do: bigPayload }));
-    const app = oke({ name: "zip" }).plug(compression());
+    const app = oke({ autoBoot: false, name: "zip" }).plug(compression());
 
     const res = await app.fetch(
       new Request("http://localhost/big", { headers: { "accept-encoding": "gzip" } }),
@@ -59,7 +59,7 @@ describe("compression plugin", () => {
 
   test("passes through untouched without Accept-Encoding: gzip", async () => {
     on(http.get("/big"), flow({ name: "big.get", do: bigPayload }));
-    const app = oke({ name: "zip-plain" }).plug(compression());
+    const app = oke({ autoBoot: false, name: "zip-plain" }).plug(compression());
 
     const res = await app.fetch(new Request("http://localhost/big"));
 
@@ -70,7 +70,7 @@ describe("compression plugin", () => {
 
   test("skips bodies under minSize", async () => {
     on(http.get("/small"), flow({ name: "small.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "zip-small" }).plug(compression());
+    const app = oke({ autoBoot: false, name: "zip-small" }).plug(compression());
 
     const res = await app.fetch(
       new Request("http://localhost/small", { headers: { "accept-encoding": "gzip" } }),
@@ -81,7 +81,7 @@ describe("compression plugin", () => {
 
   test("minSize: 0 compresses even tiny bodies", async () => {
     on(http.get("/small"), flow({ name: "small.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "zip-zero" }).plug(compression({ minSize: 0 }));
+    const app = oke({ autoBoot: false, name: "zip-zero" }).plug(compression({ minSize: 0 }));
 
     const res = await app.fetch(
       new Request("http://localhost/small", { headers: { "accept-encoding": "gzip" } }),
@@ -112,7 +112,7 @@ describe("compression plugin", () => {
           ),
       }),
     );
-    const app = oke({ name: "zip-skip" }).plug(compression());
+    const app = oke({ autoBoot: false, name: "zip-skip" }).plug(compression());
 
     const img = await app.fetch(
       new Request("http://localhost/img", { headers: { "accept-encoding": "gzip" } }),

package/src/plugins/config-source.test.ts

@@ -156,7 +156,7 @@ describe("configSource — plugin wiring", () => {
     });
 
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cfg-live" }).plug(maintenanceMode(source));
+    const app = oke({ autoBoot: false, name: "cfg-live" }).plug(maintenanceMode(source));
 
     expect((await app.fetch(new Request("http://localhost/x"))).status).toBe(200);
 

package/src/plugins/cors.test.ts

@@ -29,7 +29,9 @@ function preflight(path = "/x", headers: Record<string, string> = {}): Request {
 describe("cors plugin — preflight", () => {
   test("answers preflight for a path bound to another method (edge)", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-pre" }).plug(cors({ origin: "https://app.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-pre" }).plug(
+      cors({ origin: "https://app.example.com" }),
+    );
 
     const res = await app.fetch(preflight());
 
@@ -41,7 +43,9 @@ describe("cors plugin — preflight", () => {
 
   test("denied origins get a 204 without CORS headers — the browser blocks quietly", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-deny" }).plug(cors({ origin: "https://other.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-deny" }).plug(
+      cors({ origin: "https://other.example.com" }),
+    );
 
     const res = await app.fetch(preflight());
 
@@ -51,7 +55,7 @@ describe("cors plugin — preflight", () => {
 
   test("no origin configured answers nothing — cross-origin closed by default", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-closed" }).plug(cors());
+    const app = oke({ autoBoot: false, name: "cors-closed" }).plug(cors());
 
     const res = await app.fetch(preflight());
     expect(res.headers.get("access-control-allow-origin")).toBeNull();
@@ -59,7 +63,7 @@ describe("cors plugin — preflight", () => {
 
   test("a plain unmatched OPTIONS without preflight headers still 404s", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-404" }).plug(cors({ origin: "*" }));
+    const app = oke({ autoBoot: false, name: "cors-404" }).plug(cors({ origin: "*" }));
 
     const res = await app.fetch(new Request("http://localhost/x", { method: "OPTIONS" }));
     expect(res.status).toBe(404);
@@ -67,7 +71,7 @@ describe("cors plugin — preflight", () => {
 
   test("reflects request headers by default, honors configured lists and maxAge", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-hdr" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-hdr" }).plug(
       cors({ origin: "*", maxAge: 600, allowedHeaders: ["x-custom"] }),
     );
 
@@ -88,7 +92,7 @@ describe("cors plugin — preflight", () => {
 
   test("allowlist + credentials reflects only listed origins", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-cred" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-cred" }).plug(
       cors({ origin: ["https://app.example.com", "https://admin.example.com"], credentials: true }),
     );
 
@@ -106,7 +110,7 @@ describe("cors plugin — preflight", () => {
 describe("cors plugin — actual requests", () => {
   test("allowed origins get allow-origin (+ exposed headers) on matched responses", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-actual" }).plug(
       cors({ origin: ["https://app.example.com"], exposedHeaders: ["x-total"] }),
     );
 
@@ -121,7 +125,7 @@ describe("cors plugin — actual requests", () => {
 
   test("allowlist + credentials on matched responses reflects only listed origins", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual-cred" }).plug(
+    const app = oke({ autoBoot: false, name: "cors-actual-cred" }).plug(
       cors({ origin: ["https://app.example.com"], credentials: true }),
     );
 
@@ -142,7 +146,9 @@ describe("cors plugin — actual requests", () => {
 
   test("denied origins get no CORS headers on matched responses", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-actual-deny" }).plug(cors({ origin: "https://ok.example.com" }));
+    const app = oke({ autoBoot: false, name: "cors-actual-deny" }).plug(
+      cors({ origin: "https://ok.example.com" }),
+    );
 
     const res = await app.fetch(
       new Request("http://localhost/x", { headers: { origin: "https://evil.example.com" } }),
@@ -154,7 +160,7 @@ describe("cors plugin — actual requests", () => {
 
   test("requests without an Origin header are untouched", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "cors-no-origin" }).plug(cors({ origin: "*" }));
+    const app = oke({ autoBoot: false, name: "cors-no-origin" }).plug(cors({ origin: "*" }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
     expect(res.headers.get("access-control-allow-origin")).toBeNull();

package/src/plugins/csrf.test.ts

@@ -22,7 +22,7 @@ function mutating(headers: Record<string, string> = {}): Request {
 function appWith(options: Parameters<typeof csrf>[0]) {
   on(http.post("/transfer"), flow({ name: "transfer.create", do: () => ({ moved: true }) }));
   on(http.get("/balance"), flow({ name: "balance.get", do: () => ({ balance: 5 }) }));
-  return oke({ name: `csrf-${crypto.randomUUID()}` }).plug(csrf(options));
+  return oke({ autoBoot: false, name: `csrf-${crypto.randomUUID()}` }).plug(csrf(options));
 }
 
 describe("csrf plugin", () => {

package/src/plugins/email-otp.ts

@@ -0,0 +1,161 @@
+/**
+ * Email OTP Gate auth method plugin.
+ */
+
+import {
+  createIdentityStore,
+  normalizeEmail,
+  type IdentityStore,
+  type UserIdentityRow,
+} from "../auth/identity.ts";
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import {
+  createVerificationStore,
+  findActiveVerification,
+  generateOtp,
+  hashChallenge,
+  putVerification,
+  type VerificationStore,
+} from "../auth/verification.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+const DEFAULT_TTL_MS = 10 * 60 * 1000;
+const MAX_ATTEMPTS = 5;
+
+/** Options for {@link emailOtp}. */
+export interface EmailOtpOptions extends AuthMethodOptions {
+  /** Challenge TTL (default 10m). */
+  readonly ttlMs?: number;
+  readonly identities?: IdentityStore;
+  readonly verifications?: VerificationStore;
+  /** Return raw OTP in the request response (test / local). */
+  readonly exposeDevOtp?: boolean;
+}
+
+/**
+ * Email OTP request + verify (6-digit, hashed, 5 attempts).
+ *
+ * @param opts - TTL / stores / dev OTP
+ */
+export function emailOtp(opts: EmailOtpOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const identities = opts.identities ?? createIdentityStore();
+  const verifications = opts.verifications ?? createVerificationStore();
+  const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+
+  const request = flow({
+    name: "auth.requestEmailOtp",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ email: z.string().min(3) }),
+    out: z.object({
+      ok: z.literal(true),
+      devOtp: z.string().optional(),
+    }),
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const email = normalizeEmail(input.email);
+      if (!email.includes("@")) return fail("AuthFailed", { reason: "invalid_email" });
+      const otp = generateOtp(6);
+      const now = runtime.now();
+      // Invalidate prior active challenges for this email.
+      for (const row of verifications.rows.values()) {
+        if (row.identifier === `email-otp:${email}` && row.consumedAt === null) {
+          row.consumedAt = now;
+        }
+      }
+      putVerification(verifications, {
+        id: crypto.randomUUID(),
+        identifier: `email-otp:${email}`,
+        value: await hashChallenge(otp),
+        expiresAt: now + ttlMs,
+        createdAt: now,
+        consumedAt: null,
+        attempts: 0,
+      });
+      return {
+        ok: true as const,
+        ...(opts.exposeDevOtp ? { devOtp: otp } : {}),
+      };
+    },
+  });
+
+  const verify = flow({
+    name: "auth.verifyEmailOtp",
+    unit: "auth",
+    plane: "user",
+    in: z.object({
+      email: z.string().min(3),
+      otp: z.string().min(4).max(8),
+    }),
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const email = normalizeEmail(input.email);
+      const now = runtime.now();
+      const row = findActiveVerification(verifications, `email-otp:${email}`, now);
+      if (!row) return fail("AuthFailed", { reason: "invalid_credentials" });
+      if (row.attempts >= MAX_ATTEMPTS) {
+        row.consumedAt = now;
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      const hash = await hashChallenge(input.otp.trim());
+      if (hash !== row.value) {
+        row.attempts += 1;
+        if (row.attempts >= MAX_ATTEMPTS) row.consumedAt = now;
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      row.consumedAt = now;
+      const user = ensureUserByEmail(identities, email, now);
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: user.id,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId: user.id,
+      };
+    },
+  });
+
+  return plugin("emailOtp", { version: "0.0.1", config: { method: "email-otp" } })
+    .needs("auth")
+    .binding(bindPublicAuth("/email-otp/request", request, "otp"))
+    .binding(bindPublicAuth("/email-otp/verify", verify, "otp"));
+}
+
+function ensureUserByEmail(store: IdentityStore, email: string, now: number): UserIdentityRow {
+  const existingId = store.byEmail.get(email);
+  if (existingId) {
+    const existing = store.users.get(existingId);
+    if (existing) return existing;
+  }
+  const id = crypto.randomUUID();
+  const user: UserIdentityRow = {
+    id,
+    email,
+    name: email.split("@")[0] || "user",
+    emailVerified: true,
+    status: "active",
+    createdAt: now,
+    updatedAt: now,
+    extra: {},
+  };
+  store.users.set(id, user);
+  store.byEmail.set(email, id);
+  return user;
+}

package/src/plugins/index.ts

@@ -4,6 +4,7 @@
  * `.plug()`.
  */
 
+export { anonymous, type AnonymousPluginOptions } from "./anonymous.ts";
 export { compression, type CompressionOptions } from "./compression.ts";
 export {
   configSource,
@@ -15,8 +16,23 @@ export {
 } from "./config-source.ts";
 export { cors, type CorsOptions } from "./cors.ts";
 export { csrf, type CsrfOptions } from "./csrf.ts";
+export { emailOtp, type EmailOtpOptions } from "./email-otp.ts";
 export { ipAllowlist, type IpAllowlistOptions } from "./ip-allowlist.ts";
+export { magicLink, type MagicLinkOptions } from "./magic-link.ts";
 export { maintenanceMode, type MaintenanceModeOptions } from "./maintenance-mode.ts";
+export {
+  createPasskeyStore,
+  passkey,
+  type PasskeyCredential,
+  type PasskeyOptions,
+  type PasskeyStore,
+} from "./passkey.ts";
+export {
+  createPhoneStore,
+  phoneNumber,
+  type PhoneNumberOptions,
+  type PhoneStore,
+} from "./phone-number.ts";
 export {
   defaultCspDirectives,
   securityHeaders,
@@ -24,3 +40,18 @@ export {
   type HstsOptions,
   type SecurityHeadersOptions,
 } from "./security-headers.ts";
+export {
+  createTwoFactorStore,
+  twoFactor,
+  verifyTotp,
+  type TwoFactorOptions,
+  type TwoFactorRow,
+  type TwoFactorStore,
+} from "./two-factor.ts";
+export {
+  createUsernameStore,
+  username,
+  type UsernamePluginOptions,
+  type UsernameRow,
+  type UsernameStore,
+} from "./username.ts";

package/src/plugins/ip-allowlist.test.ts

@@ -26,7 +26,7 @@ function get(ip?: string): Request {
 describe("ipAllowlist plugin", () => {
   test("allow list: listed IPs pass, others get 403 Forbidden", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
+    const app = oke({ autoBoot: false, name: "ips" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
 
     const ok = await app.fetch(get("203.0.113.7"));
     expect(ok.status).toBe(200);
@@ -40,7 +40,9 @@ describe("ipAllowlist plugin", () => {
 
   test("deny list: blocked IPs get 403 ip_denied, others pass", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-deny" }).plug(ipAllowlist({ deny: ["198.51.100.9"] }));
+    const app = oke({ autoBoot: false, name: "ips-deny" }).plug(
+      ipAllowlist({ deny: ["198.51.100.9"] }),
+    );
 
     const blocked = await app.fetch(get("198.51.100.9"));
     expect(blocked.status).toBe(403);
@@ -53,7 +55,7 @@ describe("ipAllowlist plugin", () => {
 
   test("deny wins over allow on overlap", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-both" }).plug(
+    const app = oke({ autoBoot: false, name: "ips-both" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], deny: ["203.0.113.7"] }),
     );
 
@@ -63,7 +65,9 @@ describe("ipAllowlist plugin", () => {
 
   test("XFF last hop is the client; a spoofed first hop cannot bypass allow", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-xff" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
+    const app = oke({ autoBoot: false, name: "ips-xff" }).plug(
+      ipAllowlist({ allow: ["203.0.113.7"] }),
+    );
 
     // Attacker-controlled first hop + trusted proxy appended the real client (last).
     const spoofedFirst = await app.fetch(get("203.0.113.7, 198.51.100.9"));
@@ -75,7 +79,9 @@ describe("ipAllowlist plugin", () => {
 
   test("spoofed first hop cannot bypass a deny rule", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-xff-deny" }).plug(ipAllowlist({ deny: ["198.51.100.9"] }));
+    const app = oke({ autoBoot: false, name: "ips-xff-deny" }).plug(
+      ipAllowlist({ deny: ["198.51.100.9"] }),
+    );
 
     // Spoof a non-denied IP first; proxy appended the real (denied) client last.
     const spoofed = await app.fetch(get("203.0.113.7, 198.51.100.9"));
@@ -88,7 +94,7 @@ describe("ipAllowlist plugin", () => {
   test("trustedProxyDepth selects the hop behind N trusted proxies", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
     // Chain: spoofed, real-client, cdn-egress — depth 2 skips the nearest proxy hop.
-    const app = oke({ name: "ips-depth" }).plug(
+    const app = oke({ autoBoot: false, name: "ips-depth" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], trustedProxyDepth: 2 }),
     );
 
@@ -108,7 +114,9 @@ describe("ipAllowlist plugin", () => {
 
   test("missing header: denied when allow is set, permitted for deny-only", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const strict = oke({ name: "ips-missing-allow" }).plug(ipAllowlist({ allow: ["203.0.113.7"] }));
+    const strict = oke({ autoBoot: false, name: "ips-missing-allow" }).plug(
+      ipAllowlist({ allow: ["203.0.113.7"] }),
+    );
 
     const denied = await strict.fetch(get());
     expect(denied.status).toBe(403);
@@ -117,14 +125,16 @@ describe("ipAllowlist plugin", () => {
     resetFlowSeq();
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
 
-    const lax = oke({ name: "ips-missing-deny" }).plug(ipAllowlist({ deny: ["198.51.100.9"] }));
+    const lax = oke({ autoBoot: false, name: "ips-missing-deny" }).plug(
+      ipAllowlist({ deny: ["198.51.100.9"] }),
+    );
     const ok = await lax.fetch(get());
     expect(ok.status).toBe(200);
   });
 
   test("custom header name is honored", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "ips-custom" }).plug(
+    const app = oke({ autoBoot: false, name: "ips-custom" }).plug(
       ipAllowlist({ allow: ["203.0.113.7"], header: "x-real-ip" }),
     );