Files
Frederik Prijck 6127d2e901 fix(auth0): correct and expand the Fastify reference (supersedes #113)
Supersedes #113, which was opened against the pre-consolidation `auth0-fastify`
skill. Ports what survived the re-architecture, fixes a rendering bug, corrects
three API inaccuracies, and adds the first eval coverage for this framework.

## Bug fix

`reply.view('views/home.ejs')` cannot render. `@fastify/view` resolves the
template name relative to its `root` option (`./views`), so the path resolved
to `./views/views/home.ejs`. Fixed to the bare name.

## Accuracy fixes

Verified against `auth0-fastify` v1.5.0 and `@auth0/auth0-server-js` 1.11.0:

- `appBaseUrl` is required only when `domain` is a string; optional with a
  resolver function
- `getAccessToken()` resolves to a `TokenSet` — read `.accessToken`
- `logout()` returns a `URL` object; redirect with `.href`
- `sessionStore` is required for back-channel logout — the default stateless
  store cannot revoke sessions by logout token
- `getAccessToken({ audience })` requires MRRT to be enabled on the tenant

## Other changes

- Version lookup uses `gh api` with a tag-prefix filter instead of
  `releases/latest`, which can return the sibling `auth0-fastify-api` package
- Upstream fetch example wraps `fetch`/`response.json()` in a try-catch to
  return 502 instead of 500 on network failures
- MD031: blank lines around fenced code block in agent-instruction blockquote

## Eval coverage

This framework had none. Adds:

- **Routing:** `integrate-fastify-web` + `integrate-fastify-api`
- **Behavioral:** `evals/behavioral/cases/fastify.json`, 16 graders
  (14 machine + 2 judge)
2026-09-01 13:34:01 +02:00
..