@adonis-agora/authkit-client 0.16.0 → 0.17.0

package/build/index.d.ts

@@ -16,6 +16,8 @@ export { default as BackchannelRevocationMiddleware } from './src/middleware/bac
 export { authkitClientGuard, AuthkitClientGuard } from './src/host/authkit_client_guard.js';
 export type { UnauthorizedAccessConstructor } from './src/host/authkit_client_guard.js';
 export { getAuthkit } from './src/host/request_authenticator.js';
+export { isAuthkitAdmin, authkitDashboardAuthorize, authkitDashboardMiddleware, } from './src/host/dashboard_guard.js';
+export type { DashboardGuardOptions } from './src/host/dashboard_guard.js';
 export { default as AuthkitContextMiddleware } from './src/middleware/authkit_context_middleware.js';
 export { lucidMirror } from './src/lucid_mirror.js';
 export type { LucidMirrorOptions } from './src/lucid_mirror.js';

package/build/index.js

@@ -9,6 +9,7 @@ export { lucidRevocationStore, DEFAULT_REVOCATION_TABLE, } from './src/revocatio
 export { default as BackchannelRevocationMiddleware } from './src/middleware/backchannel_revocation_middleware.js';
 export { authkitClientGuard, AuthkitClientGuard } from './src/host/authkit_client_guard.js';
 export { getAuthkit } from './src/host/request_authenticator.js';
+export { isAuthkitAdmin, authkitDashboardAuthorize, authkitDashboardMiddleware, } from './src/host/dashboard_guard.js';
 export { default as AuthkitContextMiddleware } from './src/middleware/authkit_context_middleware.js';
 export { lucidMirror } from './src/lucid_mirror.js';
 export { registerOidcClient } from './src/register_oidc_client.js';

package/build/src/host/dashboard_guard.d.ts

@@ -0,0 +1,52 @@
+import type { HttpContext } from '@adonisjs/core/http';
+export interface DashboardGuardOptions {
+    /** Global role required to pass the gate. Default `'ADMIN'`. */
+    role?: string;
+}
+/**
+ * Core predicate behind {@link authkitDashboardAuthorize} and
+ * {@link authkitDashboardMiddleware}: authenticated (a resolvable authkit `Identity`) AND holding
+ * the configured global role — `ctx.auth.hasGlobalRole('ADMIN')`, the pattern hosts already
+ * hand-roll per embedded admin dashboard (durable/media/agent/telescope).
+ *
+ * Resolves the session via {@link getAuthkit} rather than reading `ctx.auth` directly: `ctx.auth`'s
+ * TYPE is host-owned (each app augments `HttpContext.auth` for its own user model, or leaves it to
+ * `@adonisjs/auth`'s guard), so this module — shipped from the library, with no visibility into
+ * that augmentation — can't assume its shape. `getAuthkit` is the one session-resolution path that
+ * works either way (legacy `authkit_middleware`'s `ctx.auth` or the newer `authkitClientGuard`'s
+ * `ctx.authkit`), memoizing so a second call in the same request is free.
+ */
+export declare function isAuthkitAdmin(ctx: HttpContext, options?: DashboardGuardOptions): Promise<boolean>;
+/**
+ * Adapter for the `authorize: (ctx) => boolean` shape that `@adonis-agora/durable`,
+ * `@adonis-agora/agent` and `@adonis-agora/telescope` dashboard configs expect. A `false` return
+ * makes the provider reply `403 { error: 'forbidden' }` — the provider's own behavior, unchanged
+ * here.
+ *
+ * ```ts
+ * // config/durable_dashboard.ts
+ * import { defineConfig } from '@adonis-agora/durable/dashboard'
+ * import { authkitDashboardAuthorize } from '@adonis-agora/authkit-client'
+ *
+ * export default defineConfig({
+ *   authorize: authkitDashboardAuthorize(),
+ * })
+ * ```
+ */
+export declare function authkitDashboardAuthorize(options?: DashboardGuardOptions): (ctx: HttpContext) => Promise<boolean>;
+/**
+ * Adapter for the `middleware: (ctx, next) => Promise<void>` shape that
+ * `@adonis-agora/media`'s dashboard config expects. Mirrors the hand-rolled `requireAdmin` apps
+ * wrote themselves: no session -> `401`; session without the role -> `403`; otherwise `next()`.
+ *
+ * ```ts
+ * // config/media_dashboard.ts
+ * import { defineConfig } from '@adonis-agora/media/dashboard'
+ * import { authkitDashboardMiddleware } from '@adonis-agora/authkit-client'
+ *
+ * export default defineConfig({
+ *   middleware: authkitDashboardMiddleware(),
+ * })
+ * ```
+ */
+export declare function authkitDashboardMiddleware(options?: DashboardGuardOptions): (ctx: HttpContext, next: () => Promise<void>) => Promise<void>;

package/build/src/host/dashboard_guard.js

@@ -0,0 +1,72 @@
+import { getAuthkit } from './request_authenticator.js';
+/** Global role that counts as "admin" when the caller doesn't override it. Mirrors the default
+ *  used across `@adonis-agora/authkit-server`'s own admin console (`admin.roles`, `adminRoles` on
+ *  impersonation/token-exchange) — same convention, not a new one. */
+const DEFAULT_ADMIN_ROLE = 'ADMIN';
+/**
+ * Core predicate behind {@link authkitDashboardAuthorize} and
+ * {@link authkitDashboardMiddleware}: authenticated (a resolvable authkit `Identity`) AND holding
+ * the configured global role — `ctx.auth.hasGlobalRole('ADMIN')`, the pattern hosts already
+ * hand-roll per embedded admin dashboard (durable/media/agent/telescope).
+ *
+ * Resolves the session via {@link getAuthkit} rather than reading `ctx.auth` directly: `ctx.auth`'s
+ * TYPE is host-owned (each app augments `HttpContext.auth` for its own user model, or leaves it to
+ * `@adonisjs/auth`'s guard), so this module — shipped from the library, with no visibility into
+ * that augmentation — can't assume its shape. `getAuthkit` is the one session-resolution path that
+ * works either way (legacy `authkit_middleware`'s `ctx.auth` or the newer `authkitClientGuard`'s
+ * `ctx.authkit`), memoizing so a second call in the same request is free.
+ */
+export async function isAuthkitAdmin(ctx, options = {}) {
+    const authkit = await getAuthkit(ctx);
+    if (!(await authkit.check()))
+        return false;
+    return authkit.hasGlobalRole(options.role ?? DEFAULT_ADMIN_ROLE);
+}
+/**
+ * Adapter for the `authorize: (ctx) => boolean` shape that `@adonis-agora/durable`,
+ * `@adonis-agora/agent` and `@adonis-agora/telescope` dashboard configs expect. A `false` return
+ * makes the provider reply `403 { error: 'forbidden' }` — the provider's own behavior, unchanged
+ * here.
+ *
+ * ```ts
+ * // config/durable_dashboard.ts
+ * import { defineConfig } from '@adonis-agora/durable/dashboard'
+ * import { authkitDashboardAuthorize } from '@adonis-agora/authkit-client'
+ *
+ * export default defineConfig({
+ *   authorize: authkitDashboardAuthorize(),
+ * })
+ * ```
+ */
+export function authkitDashboardAuthorize(options = {}) {
+    return (ctx) => isAuthkitAdmin(ctx, options);
+}
+/**
+ * Adapter for the `middleware: (ctx, next) => Promise<void>` shape that
+ * `@adonis-agora/media`'s dashboard config expects. Mirrors the hand-rolled `requireAdmin` apps
+ * wrote themselves: no session -> `401`; session without the role -> `403`; otherwise `next()`.
+ *
+ * ```ts
+ * // config/media_dashboard.ts
+ * import { defineConfig } from '@adonis-agora/media/dashboard'
+ * import { authkitDashboardMiddleware } from '@adonis-agora/authkit-client'
+ *
+ * export default defineConfig({
+ *   middleware: authkitDashboardMiddleware(),
+ * })
+ * ```
+ */
+export function authkitDashboardMiddleware(options = {}) {
+    return async (ctx, next) => {
+        const authkit = await getAuthkit(ctx);
+        if (!(await authkit.check())) {
+            ctx.response.unauthorized({ message: 'Authentication required' });
+            return;
+        }
+        if (!authkit.hasGlobalRole(options.role ?? DEFAULT_ADMIN_ROLE)) {
+            ctx.response.forbidden({ message: 'Admin access required' });
+            return;
+        }
+        await next();
+    };
+}

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@adonis-agora/authkit-client",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
   "homepage": "https://github.com/DavideCarvalho/adonis-authkit/tree/main/packages/authkit-client#readme",
   "repository": {
     "type": "git",
-    "url": "https://github.com/DavideCarvalho/adonis-authkit.git",
+    "url": "https://github.com/DavideCarvalho/adonis-agora-authkit.git",
     "directory": "packages/authkit-client"
   },
   "bugs": {
@@ -39,6 +39,7 @@
     "./services/main": "./build/services/main.js",
     "./authkit_client_provider": "./build/providers/authkit_client_provider.js",
     "./auth": "./build/src/host/authkit_client_guard.js",
+    "./dashboard_guard": "./build/src/host/dashboard_guard.js",
     "./authkit_middleware": "./build/src/middleware/authkit_middleware.js",
     "./authkit_context_middleware": "./build/src/middleware/authkit_context_middleware.js",
     "./backchannel_revocation_middleware": "./build/src/middleware/backchannel_revocation_middleware.js",
@@ -74,23 +75,23 @@
     }
   },
   "dependencies": {
-    "jose": "^5.9.0",
+    "jose": "5.10.0",
     "@adonis-agora/authkit-core": "0.7.0"
   },
   "devDependencies": {
     "@adonisjs/auth": "10.1.0",
-    "@adonisjs/core": "7.3.5",
-    "@adonis-agora/resilience": "^0.1.0",
+    "@adonisjs/core": "7.4.0",
+    "@adonis-agora/resilience": "0.3.1",
     "@adonisjs/session": "8.1.0",
     "@adonisjs/lucid": "22.4.2",
     "@adonisjs/tsconfig": "2.0.0",
     "@japa/assert": "4.2.0",
     "@japa/runner": "5.3.0",
     "@poppinss/ts-exec": "1.4.4",
-    "ioredis-mock": "^8.9.0",
+    "ioredis-mock": "8.13.1",
     "@types/node": "25.9.1",
     "typescript": "6.0.3",
-    "@adonis-agora/authkit-server": "0.55.0"
+    "@adonis-agora/authkit-server": "0.56.0"
   },
   "scripts": {
     "build": "tsc && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\"",