What problem does it solve? After wiring Overlens login or token validation into a project, developers lack a deterministic way to prove the integration actually honors the Overlens contract. This Skill drops in a ready-made test suite that turns "I think it works" into a green pnpm test run — fully offline, with no Docker, no network, and no real IDP. ## Core Features & Use Cases - Resource Server conformance: Wrap your JWT validator in a small adapter and the kit asserts valid tokens are accepted while expired, wrong-audience, HS256/alg:none, unknown-kid, and insufficient-scope tokens are rejected. - Client/BFF conformance: An in-process mock IDP drives your client through login, callback, refresh, and logout, asserting PKCE handling, state-mismatch (CSRF) rejection, code-reuse rejection, and refresh rotation. - Raw testing primitives: Mint valid tokens, forge negative tokens, serve a mock JWKS, or script mock-IDP failures for custom assertions, plus an idp-doctor preflight CLI to catch config drift before pointing at a real environment. - Use Case: You just added an Overlens AuthGuard to a NestJS API. Run this Skill to generate a conformance test that proves your guard accepts valid RS256 tokens and rejects every forged variant — all in Jest or Vitest with zero network calls. ## Quick Start Ask the assistant to add integration tests that prove my Overlens authentication integration is correct.
