feat: centralize application framework primitives

packages/auth/test/engine.test.ts

@@ -4,6 +4,25 @@ import { MemoryAuthStore } from "../src/stores/memory.ts";
 import { generateTotp } from "../src/totp/index.ts";
 import type { AuthDeliveryMessage, PasskeyProvider } from "../src/types.ts";
 
+test("authentication storage factories resolve lazily and only once", async () => {
+  let calls = 0;
+  const backing = new MemoryAuthStore();
+  const engine = createAuthEngine({
+    store: () => {
+      calls++;
+      return backing;
+    },
+    secret: "a secure test secret that is longer than thirty-two characters",
+  });
+
+  expect(calls).toBe(0);
+  expect(engine.store).toBeDefined();
+  expect(calls).toBe(0);
+  await engine.getUser("missing");
+  await engine.getUser("still-missing");
+  expect(calls).toBe(1);
+});
+
 function fixture() {
   let time = 1_720_000_000_000;
   let seed = 11;

packages/auth/test/oauth-http.test.ts

@@ -0,0 +1,67 @@
+import { afterEach, expect, test } from "bun:test";
+import { createContext, withContextHeaders } from "@wrnexus/core";
+import type { OAuthProvider } from "@wrnexus/oauth";
+import { createAuthEngine } from "../src/engine.ts";
+import { createAuthHttpHandlers } from "../src/http/index.ts";
+import { MemoryAuthStore } from "../src/stores/memory.ts";
+
+const realFetch = globalThis.fetch;
+afterEach(() => {
+  globalThis.fetch = realFetch;
+});
+
+test("configured OAuth owns PKCE state, callback, and session establishment", async () => {
+  const provider: OAuthProvider = {
+    name: "example",
+    authorizeUrl: "https://identity.example/authorize",
+    tokenUrl: "https://identity.example/token",
+    userInfoUrl: "https://identity.example/user",
+    scopes: ["openid", "email"],
+    clientId: "client",
+    clientSecret: "secret",
+    mapProfile: (raw) => ({
+      id: String(raw.id),
+      email: String(raw.email),
+      raw,
+    }),
+  };
+  const engine = createAuthEngine({
+    store: new MemoryAuthStore(),
+    secret: "oauth-http-secret-that-is-longer-than-thirty-two-characters",
+  });
+  const handlers = createAuthHttpHandlers({
+    engine,
+    baseUrl: "https://app.example",
+    oauth: { example: provider },
+  });
+  const startRequest = new Request(
+    "https://app.example/api/auth/oauth/example?returnTo=%2Fdashboard",
+  );
+  const startCtx = createContext(startRequest, new URL(startRequest.url));
+  startCtx.params = { provider: "example" };
+  const start = await handlers.startOAuth(startCtx);
+  expect(start.status).toBe(302);
+  const location = new URL(start.headers.get("location")!);
+  expect(location.searchParams.get("code_challenge_method")).toBe("S256");
+  const issued = withContextHeaders(startCtx, start).headers.get("set-cookie")!;
+
+  const replies = [
+    Response.json({ access_token: "access", token_type: "Bearer" }),
+    Response.json({ id: "provider-user", email: "oauth@example.test" }),
+  ];
+  const mock: typeof fetch = Object.assign(async () => replies.shift()!, {
+    preconnect: () => undefined,
+  });
+  globalThis.fetch = mock;
+
+  const callbackRequest = new Request(
+    `https://app.example/api/auth/oauth/example/callback?code=code&state=${encodeURIComponent(location.searchParams.get("state")!)}`,
+    { headers: { cookie: issued.split(";", 1)[0]! } },
+  );
+  const callbackCtx = createContext(callbackRequest, new URL(callbackRequest.url));
+  callbackCtx.params = { provider: "example" };
+  const callback = await handlers.completeOAuth(callbackCtx);
+  expect(callback.status).toBe(303);
+  expect(callback.headers.get("location")).toBe("https://app.example/dashboard");
+  expect(callbackCtx.user).toMatchObject({ id: expect.any(String) });
+});

packages/auth/test/plugin.test.ts

@@ -1,7 +1,7 @@
 import { expect, test } from "bun:test";
 import type { Context } from "@wrnexus/core";
 import { createPluginRunner } from "@wrnexus/plugin";
-import { authPlugin } from "../src/plugin.ts";
+import { authPlugin, validateProductionAuthConfig } from "../src/plugin.ts";
 import { AUTH_ROUTE_DEFINITIONS } from "../src/routes/definitions.ts";
 import { readFileSync } from "node:fs";
 import { createAuthEngine } from "../src/engine.ts";
@@ -65,6 +65,21 @@ test("plugin contributes components, runtime, styles, migration, and toolbar", a
   expect(contributions.middleware).toHaveLength(1);
 });
 
+test("production auth validation rejects development secrets and origins", () => {
+  expect(() =>
+    validateProductionAuthConfig(
+      { baseUrl: "http://localhost:3000" },
+      { AUTH_SECRET: "change-me" },
+    ),
+  ).toThrow("AUTH_SECRET");
+  expect(() =>
+    validateProductionAuthConfig(
+      { baseUrl: "http://app.example" },
+      { AUTH_SECRET: "a-production-secret-that-is-longer-than-thirty-two-characters" },
+    ),
+  ).toThrow("HTTPS");
+});
+
 test("unconfigured automatic discovery fails closed for routes, middleware, and migrations", async () => {
   const metadata = new Map<string, unknown>();
   const runner = createPluginRunner(authPlugin(), {