Building and testing

The workspace's crates, the checks every change passes, and the live test suites that run against a TessariDB node.

The server is a Cargo workspace on Rust 1.98 (edition 2024).

Crate	Role
`tessari-oauth-constants`	every limit and alphabet, with its unit and source
`tessari-oauth-types`	protocol values as types, and the error taxonomy
`tessari-oauth-core`	the protocol core, pure and testable without a server
`tessari-oauth-storage`	persistence on TessariDB, by domain
`tessari-oauth-infrastructure`	database connection, key custody, guarded outbound HTTP
`tessari-oauth-observability`	tracing and metrics, with secrets kept out of logs
`tessari-oauth-api`	protocol, account and admin routes
`tessari-oauth-daemons`	expiry, key rotation, logout delivery
`tessari-oauth-node`	the `tessaridb-oauth` binary

Checks

cargo build
cargo t          # every library and integration test
cargo lint       # clippy over all targets with warnings denied
cargo fmt --all --check
cargo deny check # licences, advisories, sources

The pages

The sign-in, consent, account and console pages are TypeScript in crates/tessari-oauth-api/pages/, and their built output is committed to crates/tessari-oauth-api/assets/, so building the server needs no Node. After changing the source, run npm install once and npm run build there; npm run verify type-checks, runs the page tests and fails when the committed assets differ from a rebuild.

Live tests

Tests that need a TessariDB node are marked ignored and run against a node you name:

docker run -d --rm --name oauth-live -p 127.0.0.1:39601:9080 \
  -e TESSARIDB_INITIAL_USER=oauth -e TESSARIDB_INITIAL_PASSWORD="$PASSWORD" \
  tessaridb/tessaridb:0.38.2
TESSARIDB_OAUTH_TEST_STORE=127.0.0.1:39601 TESSARIDB_OAUTH_TEST_USER=oauth \
  TESSARIDB_OAUTH_TEST_PASSWORD="$PASSWORD" \
  cargo test -p tessari-oauth-storage --test live -- --ignored

Each test works in a namespace of its own; a run removes the namespaces earlier runs left before its first test starts, so the suite can run repeatedly against one node. The two TLS tests also need a node serving TLS (TESSARIDB_OAUTH_TEST_TLS_STORE), the PEM of the authority that signed its certificate (TESSARIDB_OAUTH_TEST_TLS_AUTHORITY) and one of an unrelated authority (TESSARIDB_OAUTH_TEST_TLS_OTHER_AUTHORITY). The regions test needs a second node standing for another region, with its owner (TESSARIDB_OAUTH_TEST_PEER_STORE, _PEER_USER, _PEER_PASSWORD).