feat(auth): load immutable runtime projection snapshots

backend/src/auth/config.ts

@@ -228,7 +228,7 @@ function canonicalRevision(value: AuthenticationConfig): string {
   return createHash("sha256").update(JSON.stringify(canonicalize(value))).digest("hex");
 }
 
-function parseAuthenticationConfig(source: string): AuthenticationConfig {
+export function parseAuthenticationConfigSource(source: string): AuthenticationConfig {
   try {
     const document = parseDocument(source, { uniqueKeys: true });
     if (document.errors.length > 0 || document.warnings.length > 0) throw invalid();
@@ -254,7 +254,7 @@ function parseAuthenticationConfig(source: string): AuthenticationConfig {
 
 function loadAuthenticationConfigWithIdentity(path: string): { loaded: LoadedAuthConfig; identity: StorageIdentity } {
   const read = readBoundedConfig(path);
-  const value = parseAuthenticationConfig(read.source);
+  const value = parseAuthenticationConfigSource(read.source);
   return { loaded: { value, revision: canonicalRevision(value), sourcePath: path }, identity: read.identity };
 }
 
@@ -266,7 +266,7 @@ function loadWindowsAuthenticationConfig(
     const contents = bridge.readAuthConfig(path);
     if (!Buffer.isBuffer(contents) || contents.length === 0 || contents.length > MAX_AUTH_CONFIG_BYTES) throw invalid();
     const source = new TextDecoder("utf-8", { fatal: true }).decode(contents);
-    const value = parseAuthenticationConfig(source);
+    const value = parseAuthenticationConfigSource(source);
     return { value, revision: canonicalRevision(value), sourcePath: path };
   } catch {
     throw invalid();