okengine 0.4.3 → 0.5.0

package/src/plugins/magic-link.ts

@@ -0,0 +1,163 @@
+/**
+ * Magic-link Gate auth method plugin.
+ *
+ * Delivery via Channel is optional in v1 — when {@link MagicLinkOptions.exposeDevToken}
+ * is set, the request response includes `devToken` for tests / local DX.
+ */
+
+import {
+  createIdentityStore,
+  normalizeEmail,
+  type IdentityStore,
+  type UserIdentityRow,
+} from "../auth/identity.ts";
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import {
+  createVerificationStore,
+  hashChallenge,
+  putVerification,
+  type VerificationStore,
+} from "../auth/verification.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+const DEFAULT_TTL_MS = 10 * 60 * 1000;
+
+/** Options for {@link magicLink}. */
+export interface MagicLinkOptions extends AuthMethodOptions {
+  /** Challenge TTL (default 10m). */
+  readonly ttlMs?: number;
+  /** Identity store for email → user. */
+  readonly identities?: IdentityStore;
+  /** Verification / challenge store. */
+  readonly verifications?: VerificationStore;
+  /** Return raw token in the request response (test / local). */
+  readonly exposeDevToken?: boolean;
+}
+
+/**
+ * Magic-link request + verify (`oke_verifications` challenge rows).
+ *
+ * @param opts - TTL / stores / dev token
+ */
+export function magicLink(opts: MagicLinkOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const identities = opts.identities ?? createIdentityStore();
+  const verifications = opts.verifications ?? createVerificationStore();
+  const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+
+  const request = flow({
+    name: "auth.requestMagicLink",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ email: z.string().min(3) }),
+    out: z.object({
+      ok: z.literal(true),
+      devToken: z.string().optional(),
+    }),
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const email = normalizeEmail(input.email);
+      if (!email.includes("@")) return fail("AuthFailed", { reason: "invalid_email" });
+      const token = `ml_${crypto.randomUUID().replace(/-/g, "")}`;
+      const now = runtime.now();
+      putVerification(verifications, {
+        id: crypto.randomUUID(),
+        identifier: `magic:${email}`,
+        value: await hashChallenge(token),
+        expiresAt: now + ttlMs,
+        createdAt: now,
+        consumedAt: null,
+        attempts: 0,
+      });
+      return {
+        ok: true as const,
+        ...(opts.exposeDevToken ? { devToken: token } : {}),
+      };
+    },
+  });
+
+  const verify = flow({
+    name: "auth.verifyMagicLink",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ token: z.string().min(1) }),
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const hash = await hashChallenge(input.token);
+      const now = runtime.now();
+      let row:
+        | {
+            id: string;
+            identifier: string;
+            value: string;
+            expiresAt: number;
+            consumedAt: number | null;
+            attempts: number;
+          }
+        | undefined;
+      for (const candidate of verifications.rows.values()) {
+        if (!candidate.identifier.startsWith("magic:")) continue;
+        if (candidate.consumedAt !== null) continue;
+        if (candidate.expiresAt <= now) continue;
+        if (candidate.value === hash) {
+          row = candidate;
+          break;
+        }
+      }
+      if (!row) return fail("AuthFailed", { reason: "invalid_credentials" });
+      row.consumedAt = now;
+      const email = row.identifier.slice("magic:".length);
+      const user = ensureUserByEmail(identities, email, now);
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: user.id,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId: user.id,
+      };
+    },
+  });
+
+  return plugin("magicLink", { version: "0.0.1", config: { method: "magic-link" } })
+    .needs("auth")
+    .binding(bindPublicAuth("/magic-link/request", request, "otp"))
+    .binding(bindPublicAuth("/magic-link/verify", verify, "otp"));
+}
+
+function ensureUserByEmail(store: IdentityStore, email: string, now: number): UserIdentityRow {
+  const existingId = store.byEmail.get(email);
+  if (existingId) {
+    const existing = store.users.get(existingId);
+    if (existing) return existing;
+  }
+  const id = crypto.randomUUID();
+  const user: UserIdentityRow = {
+    id,
+    email,
+    name: email.split("@")[0] || "user",
+    emailVerified: true,
+    status: "active",
+    createdAt: now,
+    updatedAt: now,
+    extra: {},
+  };
+  store.users.set(id, user);
+  store.byEmail.set(email, id);
+  return user;
+}

package/src/plugins/maintenance-mode.test.ts

@@ -18,7 +18,7 @@ beforeEach(() => {
 describe("maintenanceMode plugin", () => {
   test("returns 503 with ServiceUnavailable envelope and Retry-After", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint" }).plug(maintenanceMode({ retryAfter: 120 }));
+    const app = oke({ autoBoot: false, name: "maint" }).plug(maintenanceMode({ retryAfter: 120 }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -36,7 +36,9 @@ describe("maintenanceMode plugin", () => {
 
   test("enabled: false passes traffic through", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint-off" }).plug(maintenanceMode({ enabled: false }));
+    const app = oke({ autoBoot: false, name: "maint-off" }).plug(
+      maintenanceMode({ enabled: false }),
+    );
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -46,7 +48,9 @@ describe("maintenanceMode plugin", () => {
   test("allowPaths prefixes keep serving", async () => {
     on(http.get("/health"), flow({ name: "health.get", do: () => ({ up: true }) }));
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint-allow" }).plug(maintenanceMode({ allowPaths: ["/health"] }));
+    const app = oke({ autoBoot: false, name: "maint-allow" }).plug(
+      maintenanceMode({ allowPaths: ["/health"] }),
+    );
 
     const health = await app.fetch(new Request("http://localhost/health"));
     expect(health.status).toBe(200);
@@ -57,7 +61,7 @@ describe("maintenanceMode plugin", () => {
 
   test("bypass header lets operators through (any non-empty value)", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint-bypass" }).plug(
+    const app = oke({ autoBoot: false, name: "maint-bypass" }).plug(
       maintenanceMode({ bypassHeader: "x-ops-token" }),
     );
 
@@ -72,7 +76,7 @@ describe("maintenanceMode plugin", () => {
 
   test("the 503 still flows through onResponse (other plugins stamp it)", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "maint-stamp" }).plug(maintenanceMode());
+    const app = oke({ autoBoot: false, name: "maint-stamp" }).plug(maintenanceMode());
     app.hook("onResponse", (ctx) => {
       if (!ctx.response) return;
       const headers = new Headers(ctx.response.headers);

package/src/plugins/passkey.ts

@@ -0,0 +1,216 @@
+/**
+ * Passkey (WebAuthn-shaped) Gate auth method plugin — simplified v1 ceremony.
+ *
+ * Registration / authentication accept attestation-like payloads for tests
+ * without a full WebAuthn library. Production should replace the ceremony
+ * with a standards-compliant verifier.
+ */
+
+import {
+  createVerificationStore,
+  hashChallenge,
+  putVerification,
+  type VerificationStore,
+} from "../auth/verification.ts";
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  bindSessionAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+/** Stored passkey credential (simplified). */
+export interface PasskeyCredential {
+  readonly credentialId: string;
+  readonly userId: string;
+  readonly publicKey: string;
+  counter: number;
+  readonly createdAt: number;
+}
+
+/** In-memory passkey store. */
+export interface PasskeyStore {
+  readonly byCredentialId: Map<string, PasskeyCredential>;
+  readonly byUserId: Map<string, PasskeyCredential[]>;
+}
+
+/**
+ * Create an empty passkey store.
+ */
+export function createPasskeyStore(): PasskeyStore {
+  return { byCredentialId: new Map(), byUserId: new Map() };
+}
+
+/** Options for {@link passkey}. */
+export interface PasskeyOptions extends AuthMethodOptions {
+  readonly passkeys?: PasskeyStore;
+  readonly challenges?: VerificationStore;
+  /** Relying party id (default `localhost`). */
+  readonly rpId?: string;
+}
+
+/**
+ * Passkey register / authenticate options + simplified ceremony (`oke_passkeys`).
+ *
+ * @param opts - Stores / RP id
+ */
+export function passkey(opts: PasskeyOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const passkeys = opts.passkeys ?? createPasskeyStore();
+  const challenges = opts.challenges ?? createVerificationStore();
+  const rpId = opts.rpId ?? "localhost";
+
+  const registerOptions = flow({
+    name: "auth.passkeyRegisterOptions",
+    unit: "auth",
+    plane: "user",
+    out: z.object({
+      challenge: z.string(),
+      rpId: z.string(),
+      userId: z.string(),
+    }),
+    errors: { AuthFailed },
+    do: async (_input, fx) => {
+      const userId = fx.auth.userId;
+      if (!userId) return fail("AuthFailed", { reason: "unauthenticated" });
+      const challenge = crypto.randomUUID().replace(/-/g, "");
+      const now = runtime.now();
+      putVerification(challenges, {
+        id: crypto.randomUUID(),
+        identifier: `passkey-reg:${userId}`,
+        value: await hashChallenge(challenge),
+        expiresAt: now + 5 * 60 * 1000,
+        createdAt: now,
+        consumedAt: null,
+        attempts: 0,
+      });
+      return { challenge, rpId, userId };
+    },
+  });
+
+  const register = flow({
+    name: "auth.passkeyRegister",
+    unit: "auth",
+    plane: "user",
+    in: z.object({
+      credentialId: z.string().min(1),
+      publicKey: z.string().min(1),
+      userId: z.string().min(1),
+      challenge: z.string().optional(),
+    }),
+    out: z.object({ ok: z.literal(true) }),
+    errors: { AuthFailed },
+    do: async (input, fx) => {
+      const sessionUser = fx.auth.userId;
+      if (!sessionUser || sessionUser !== input.userId) {
+        return fail("AuthFailed", { reason: "unauthenticated" });
+      }
+      if (input.challenge) {
+        const hash = await hashChallenge(input.challenge);
+        const now = runtime.now();
+        let found = false;
+        for (const row of challenges.rows.values()) {
+          if (row.identifier !== `passkey-reg:${input.userId}`) continue;
+          if (row.consumedAt !== null || row.expiresAt <= now) continue;
+          if (row.value === hash) {
+            row.consumedAt = now;
+            found = true;
+            break;
+          }
+        }
+        if (!found) return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      if (passkeys.byCredentialId.has(input.credentialId)) {
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      const cred: PasskeyCredential = {
+        credentialId: input.credentialId,
+        userId: input.userId,
+        publicKey: input.publicKey,
+        counter: 0,
+        createdAt: runtime.now(),
+      };
+      passkeys.byCredentialId.set(cred.credentialId, cred);
+      const list = passkeys.byUserId.get(cred.userId) ?? [];
+      list.push(cred);
+      passkeys.byUserId.set(cred.userId, list);
+      return { ok: true as const };
+    },
+  });
+
+  const authenticateOptions = flow({
+    name: "auth.passkeyAuthenticateOptions",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ email: z.string().optional() }),
+    out: z.object({
+      challenge: z.string(),
+      rpId: z.string(),
+      allowCredentials: z.array(z.string()),
+    }),
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const challenge = crypto.randomUUID().replace(/-/g, "");
+      const now = runtime.now();
+      const key = input.email?.trim().toLowerCase() || "anonymous";
+      putVerification(challenges, {
+        id: crypto.randomUUID(),
+        identifier: `passkey-auth:${key}`,
+        value: await hashChallenge(challenge),
+        expiresAt: now + 5 * 60 * 1000,
+        createdAt: now,
+        consumedAt: null,
+        attempts: 0,
+      });
+      // Simplified: empty allow list when no email mapping (caller supplies credentialId).
+      return { challenge, rpId, allowCredentials: [] as string[] };
+    },
+  });
+
+  const authenticate = flow({
+    name: "auth.passkeyAuthenticate",
+    unit: "auth",
+    plane: "user",
+    in: z.object({
+      credentialId: z.string().min(1),
+      userId: z.string().min(1),
+    }),
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      // Simplified v1: presence of stored credential + matching userId issues a session.
+      const cred = passkeys.byCredentialId.get(input.credentialId);
+      if (!cred || cred.userId !== input.userId) {
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      cred.counter += 1;
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: cred.userId,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId: cred.userId,
+      };
+    },
+  });
+
+  return plugin("passkey", { version: "0.0.1", config: { method: "passkey" } })
+    .needs("auth")
+    .table("oke_passkeys", undefined, { plane: "user", description: "WebAuthn credentials" })
+    .binding(bindSessionAuth("/passkey/register/options", registerOptions))
+    .binding(bindSessionAuth("/passkey/register", register))
+    .binding(bindPublicAuth("/passkey/authenticate/options", authenticateOptions, "otp"))
+    .binding(bindPublicAuth("/passkey/authenticate", authenticate, "otp"));
+}

package/src/plugins/phone-number.ts

@@ -0,0 +1,149 @@
+/**
+ * Phone-number OTP Gate auth method plugin (E.164).
+ */
+
+import { issueSessionWithScopes } from "../auth/sessions.ts";
+import {
+  createVerificationStore,
+  findActiveVerification,
+  generateOtp,
+  hashChallenge,
+  putVerification,
+  type VerificationStore,
+} from "../auth/verification.ts";
+import { plugin, type PluginDef } from "../kernel/plugin.ts";
+import {
+  AuthFailed,
+  AuthRateLimited,
+  SessionTokensOut,
+  bindPublicAuth,
+  createMethodRuntime,
+  fail,
+  flow,
+  z,
+  type AuthMethodOptions,
+} from "./auth/shared.ts";
+
+const E164 = /^\+[1-9]\d{7,14}$/;
+const DEFAULT_TTL_MS = 10 * 60 * 1000;
+const MAX_ATTEMPTS = 5;
+
+/** Phone principal store (phone → userId). */
+export interface PhoneStore {
+  readonly byPhone: Map<string, string>;
+}
+
+/**
+ * Create an empty phone → user map.
+ */
+export function createPhoneStore(): PhoneStore {
+  return { byPhone: new Map() };
+}
+
+/** Options for {@link phoneNumber}. */
+export interface PhoneNumberOptions extends AuthMethodOptions {
+  readonly ttlMs?: number;
+  readonly phones?: PhoneStore;
+  readonly verifications?: VerificationStore;
+  /** Return raw OTP in the request response (test / local). */
+  readonly exposeDevOtp?: boolean;
+}
+
+/**
+ * Phone OTP request + verify (E.164, 6-digit, hashed, 5 attempts).
+ *
+ * @param opts - TTL / stores / dev OTP
+ */
+export function phoneNumber(opts: PhoneNumberOptions = {}): PluginDef {
+  const runtime = createMethodRuntime(opts);
+  const phones = opts.phones ?? createPhoneStore();
+  const verifications = opts.verifications ?? createVerificationStore();
+  const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+
+  const request = flow({
+    name: "auth.requestPhoneOtp",
+    unit: "auth",
+    plane: "user",
+    in: z.object({ phone: z.string().min(8) }),
+    out: z.object({
+      ok: z.literal(true),
+      devOtp: z.string().optional(),
+    }),
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const phone = input.phone.trim();
+      if (!E164.test(phone)) return fail("AuthFailed", { reason: "invalid_phone" });
+      const otp = generateOtp(6);
+      const now = runtime.now();
+      for (const row of verifications.rows.values()) {
+        if (row.identifier === `phone-otp:${phone}` && row.consumedAt === null) {
+          row.consumedAt = now;
+        }
+      }
+      putVerification(verifications, {
+        id: crypto.randomUUID(),
+        identifier: `phone-otp:${phone}`,
+        value: await hashChallenge(otp),
+        expiresAt: now + ttlMs,
+        createdAt: now,
+        consumedAt: null,
+        attempts: 0,
+      });
+      return {
+        ok: true as const,
+        ...(opts.exposeDevOtp ? { devOtp: otp } : {}),
+      };
+    },
+  });
+
+  const verify = flow({
+    name: "auth.verifyPhoneOtp",
+    unit: "auth",
+    plane: "user",
+    in: z.object({
+      phone: z.string().min(8),
+      otp: z.string().min(4).max(8),
+    }),
+    out: SessionTokensOut,
+    errors: { AuthFailed, AuthRateLimited },
+    do: async (input) => {
+      const phone = input.phone.trim();
+      if (!E164.test(phone)) return fail("AuthFailed", { reason: "invalid_phone" });
+      const now = runtime.now();
+      const row = findActiveVerification(verifications, `phone-otp:${phone}`, now);
+      if (!row) return fail("AuthFailed", { reason: "invalid_credentials" });
+      if (row.attempts >= MAX_ATTEMPTS) {
+        row.consumedAt = now;
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      const hash = await hashChallenge(input.otp.trim());
+      if (hash !== row.value) {
+        row.attempts += 1;
+        if (row.attempts >= MAX_ATTEMPTS) row.consumedAt = now;
+        return fail("AuthFailed", { reason: "invalid_credentials" });
+      }
+      row.consumedAt = now;
+      let userId = phones.byPhone.get(phone);
+      if (!userId) {
+        userId = crypto.randomUUID();
+        phones.byPhone.set(phone, userId);
+      }
+      const issued = await issueSessionWithScopes(runtime.sessions, runtime.crypto, {
+        id: userId,
+        plane: "user",
+        scopes: [],
+      });
+      return {
+        accessToken: issued.accessToken,
+        refreshToken: issued.refreshToken,
+        accessExpiresAt: issued.accessExpiresAt,
+        userId,
+      };
+    },
+  });
+
+  return plugin("phoneNumber", { version: "0.0.1", config: { method: "phone-number" } })
+    .needs("auth")
+    .binding(bindPublicAuth("/phone/request", request, "otp"))
+    .binding(bindPublicAuth("/phone/verify", verify, "otp"));
+}

package/src/plugins/security-headers.test.ts

@@ -19,7 +19,7 @@ beforeEach(() => {
 describe("securityHeaders plugin", () => {
   test("sets the default trio on a successful response", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec" }).plug(securityHeaders());
+    const app = oke({ autoBoot: false, name: "sec" }).plug(securityHeaders());
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -32,7 +32,7 @@ describe("securityHeaders plugin", () => {
 
   test("helmet-parity defaults: agent cluster, dns prefetch, download, cross-domain, xss filter", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-parity" }).plug(securityHeaders());
+    const app = oke({ autoBoot: false, name: "sec-parity" }).plug(securityHeaders());
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -45,7 +45,7 @@ describe("securityHeaders plugin", () => {
 
   test("each parity default can be switched off", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-off" }).plug(
+    const app = oke({ autoBoot: false, name: "sec-off" }).plug(
       securityHeaders({
         originAgentCluster: false,
         dnsPrefetchControl: false,
@@ -65,7 +65,7 @@ describe("securityHeaders plugin", () => {
 
   test("dnsPrefetchControl allow, custom cross-domain policy, COEP stamps when configured", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-tuned" }).plug(
+    const app = oke({ autoBoot: false, name: "sec-tuned" }).plug(
       securityHeaders({
         dnsPrefetchControl: { allow: true },
         permittedCrossDomainPolicies: "by-content-type",
@@ -92,7 +92,7 @@ describe("securityHeaders plugin", () => {
             }),
         }),
       );
-      return oke({ name }).plug(securityHeaders(options));
+      return oke({ autoBoot: false, name }).plug(securityHeaders(options));
     };
 
     const removed = await poweredByApp({}, "sec-pb-off").fetch(new Request("http://localhost/x"));
@@ -112,7 +112,7 @@ describe("securityHeaders plugin", () => {
 
   test("structured CSP merges over helmet's defaults, camelCase keys, report-only mode", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-csp-builder" }).plug(
+    const app = oke({ autoBoot: false, name: "sec-csp-builder" }).plug(
       securityHeaders({
         contentSecurityPolicy: {
           directives: { scriptSrc: ["'self'", "https://cdn.example.com"] },
@@ -132,7 +132,7 @@ describe("securityHeaders plugin", () => {
 
   test("structured CSP with useDefaults: false emits exactly the given directives", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-csp-bare" }).plug(
+    const app = oke({ autoBoot: false, name: "sec-csp-bare" }).plug(
       securityHeaders({
         contentSecurityPolicy: { useDefaults: false, directives: { "default-src": ["'none'"] } },
       }),
@@ -155,7 +155,7 @@ describe("securityHeaders plugin", () => {
         fail("Forbidden", {}),
       ),
     );
-    const app = oke({ name: "sec-fail" }).plug(securityHeaders());
+    const app = oke({ autoBoot: false, name: "sec-fail" }).plug(securityHeaders());
 
     const res = await app.fetch(new Request("http://localhost/deny"));
 
@@ -165,7 +165,7 @@ describe("securityHeaders plugin", () => {
 
   test("adds CSP only when configured", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-csp" }).plug(
+    const app = oke({ autoBoot: false, name: "sec-csp" }).plug(
       securityHeaders({ contentSecurityPolicy: "default-src 'self'" }),
     );
 
@@ -176,7 +176,7 @@ describe("securityHeaders plugin", () => {
 
   test("HSTS is off by default", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-hsts-off" }).plug(securityHeaders());
+    const app = oke({ autoBoot: false, name: "sec-hsts-off" }).plug(securityHeaders());
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -185,7 +185,7 @@ describe("securityHeaders plugin", () => {
 
   test("hsts: true stamps a one-year max-age", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-hsts-on" }).plug(securityHeaders({ hsts: true }));
+    const app = oke({ autoBoot: false, name: "sec-hsts-on" }).plug(securityHeaders({ hsts: true }));
 
     const res = await app.fetch(new Request("http://localhost/x"));
 
@@ -194,7 +194,7 @@ describe("securityHeaders plugin", () => {
 
   test("hsts object tunes max-age, subdomains, preload", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-hsts-tuned" }).plug(
+    const app = oke({ autoBoot: false, name: "sec-hsts-tuned" }).plug(
       securityHeaders({ hsts: { maxAge: 63072000, includeSubDomains: true, preload: true } }),
     );
 
@@ -207,7 +207,7 @@ describe("securityHeaders plugin", () => {
 
   test("permissions-policy and cross-origin policies stamp when configured", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-extra" }).plug(
+    const app = oke({ autoBoot: false, name: "sec-extra" }).plug(
       securityHeaders({
         permissionsPolicy: "camera=(), microphone=()",
         crossOriginOpenerPolicy: "same-origin",
@@ -224,7 +224,7 @@ describe("securityHeaders plugin", () => {
 
   test("an explicit app-set value wins by default", async () => {
     on(http.get("/x"), flow({ name: "x.get", do: () => ({ ok: true }) }));
-    const app = oke({ name: "sec-keep" });
+    const app = oke({ autoBoot: false, name: "sec-keep" });
     app.hook("onResponse", (ctx) => {
       if (!ctx.response) return;
       const headers = new Headers(ctx.response.headers);