@adonis-agora/authkit-client 0.18.8 → 0.19.0

package/build/src/jwks.d.ts

@@ -0,0 +1,15 @@
+import { createRemoteJWKSet } from 'jose';
+/**
+ * Signature algorithms accepted by default on every JWT this package verifies
+ * (id_token, logout_token, access token). Asymmetric only — defence against
+ * alg confusion.
+ */
+export declare const DEFAULT_ALGS: string[];
+/**
+ * The remote key set at `uri`, one per URI for the whole process: keys are
+ * fetched once and reused (jose refetches on an unknown `kid`, so rotation
+ * works). A rotated `jwks_uri` simply gets its own entry.
+ */
+export declare function getJwks(uri: string): ReturnType<typeof createRemoteJWKSet>;
+/** Clears the remote key sets (tests). */
+export declare function clearJwksCache(): void;

package/build/src/jwks.js

@@ -0,0 +1,36 @@
+import { createRemoteJWKSet } from 'jose';
+/**
+ * Signature algorithms accepted by default on every JWT this package verifies
+ * (id_token, logout_token, access token). Asymmetric only — defence against
+ * alg confusion.
+ */
+export const DEFAULT_ALGS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+];
+const cache = new Map();
+/**
+ * The remote key set at `uri`, one per URI for the whole process: keys are
+ * fetched once and reused (jose refetches on an unknown `kid`, so rotation
+ * works). A rotated `jwks_uri` simply gets its own entry.
+ */
+export function getJwks(uri) {
+    let set = cache.get(uri);
+    if (!set) {
+        set = createRemoteJWKSet(new URL(uri));
+        cache.set(uri, set);
+    }
+    return set;
+}
+/** Clears the remote key sets (tests). */
+export function clearJwksCache() {
+    cache.clear();
+}

package/build/src/oidc_login.d.ts

@@ -20,6 +20,11 @@ export interface AuthorizeParams {
     scopes: string[];
     state: string;
     codeChallenge: string;
+    /**
+     * OIDC `nonce`, echoed back in the id_token and checked by `validateIdToken`.
+     * Binds the id_token to this authorization request (replay protection).
+     */
+    nonce?: string;
     /**
      * Endpoint de autorização do IdP — obtenha via `discoverEndpoints(issuer)`
      * para IdPs de terceiros. Default: `${issuer}/auth` (convenção oidc-provider).
@@ -28,7 +33,8 @@ export interface AuthorizeParams {
     /**
      * Parâmetros extras anexados à URL de autorização (ex.: `audience`, `prompt`,
      * `login_hint`, `ui_locales`, `acr_values`). Evita manipulação manual de URL no
-     * controller. Valores `undefined`/`null` são ignorados.
+     * controller. Valores `undefined`/`null` são ignorados, assim como as chaves que a
+     * própria função monta (`state`, `nonce`, `code_challenge`, `scope`, `client_id`…).
      */
     extraParams?: Record<string, string | number | undefined | null>;
 }

package/build/src/oidc_login.js

@@ -14,6 +14,17 @@ export async function generatePkce() {
     const challenge = base64url.encode(createHash('sha256').update(verifier).digest());
     return { verifier, challenge, method: 'S256' };
 }
+/** Parameters `buildAuthorizeUrl` owns; `extraParams` cannot override them. */
+const RESERVED_AUTHORIZE_PARAMS = new Set([
+    'client_id',
+    'response_type',
+    'redirect_uri',
+    'scope',
+    'state',
+    'nonce',
+    'code_challenge',
+    'code_challenge_method',
+]);
 export function buildAuthorizeUrl(p) {
     const url = new URL(p.authorizationEndpoint ?? `${p.issuer}/auth`);
     url.searchParams.set('client_id', p.clientId);
@@ -23,8 +34,14 @@ export function buildAuthorizeUrl(p) {
     url.searchParams.set('state', p.state);
     url.searchParams.set('code_challenge', p.codeChallenge);
     url.searchParams.set('code_challenge_method', 'S256');
+    if (p.nonce)
+        url.searchParams.set('nonce', p.nonce);
     if (p.extraParams) {
         for (const [key, value] of Object.entries(p.extraParams)) {
+            // A reserved key would silently replace the session-bound value (state, nonce,
+            // PKCE…) and the callback could never validate.
+            if (RESERVED_AUTHORIZE_PARAMS.has(key))
+                continue;
             if (value !== undefined && value !== null)
                 url.searchParams.set(key, String(value));
         }
@@ -62,8 +79,20 @@ async function tokenEndpoint(issuer, body, fetchImpl = fetch, endpoint, resilien
         headers: { 'content-type': 'application/x-www-form-urlencoded' },
         body: body.toString(),
     }, resilience, fetchImpl);
-    if (!res.ok)
-        throw new Error(`Token endpoint returned ${res.status}`);
+    if (!res.ok) {
+        // RFC 6749 §5.2: the body says why (`invalid_grant`, `not_allowed`…). Without it a
+        // misconfigured client is a bare "400" and the cause is only in the IdP's logs.
+        const detail = await res
+            .json()
+            .then((json) => {
+            const body = json;
+            return typeof body?.error === 'string'
+                ? `: ${body.error}${typeof body.error_description === 'string' ? ` (${body.error_description})` : ''}`
+                : '';
+        })
+            .catch(() => '');
+        throw new Error(`Token endpoint returned ${res.status}${detail}`);
+    }
     const json = (await res.json());
     return {
         idToken: json.id_token ?? '',

package/build/src/register_oidc_client.js

@@ -1,5 +1,5 @@
-import { randomUUID } from 'node:crypto';
-import { buildAuthorizeUrl, buildEndSessionUrl, exchangeCode, generatePkce } from './oidc_login.js';
+import { OidcCallbackError } from './authorization.js';
+import { buildEndSessionUrl } from './oidc_login.js';
 /**
  * Registra as rotas OIDC de CLIENT (login/callback/logout [+ back-channel logout])
  * absorvendo o boilerplate que cada app reescrevia no OidcSessionController: PKCE +
@@ -29,25 +29,14 @@ export function registerOidcClient(router, options = {}) {
     // arrasta o code antigo para o authorize seguinte.
     const loginRoute = router.get(`${prefix}/login`, async (ctx) => {
         const manager = await ctx.containerResolver.make('authkit.client');
-        const cfg = manager.clientConfig;
-        const { verifier, challenge } = await generatePkce();
-        const state = randomUUID();
-        ctx.session?.put(pkceKey, { verifier, state });
         const extraParams = {};
         for (const param of passthrough) {
             const v = ctx.request.input(param);
             if (v !== undefined && v !== null && v !== '')
                 extraParams[param] = String(v);
         }
-        const url = buildAuthorizeUrl({
-            issuer: cfg.issuer,
-            clientId: cfg.clientId,
-            redirectUri: cfg.redirectUri,
-            scopes: cfg.scopes,
-            state,
-            codeChallenge: challenge,
-            ...(Object.keys(extraParams).length ? { extraParams } : {}),
-        });
+        const { url, pending } = await manager.createAuthorizationRequest({ extraParams });
+        ctx.session?.put(pkceKey, pending);
         return ctx.response.redirect().withQs(false).toPath(url);
     });
     if (options.loginMiddleware)
@@ -56,26 +45,28 @@ export function registerOidcClient(router, options = {}) {
     router
         .get(`${prefix}/callback`, async (ctx) => {
         const manager = await ctx.containerResolver.make('authkit.client');
-        const cfg = manager.clientConfig;
-        const { code, state } = ctx.request.qs();
-        const pkce = ctx.session?.get(pkceKey);
-        // Callback velho/expirado (state perdido ou code ausente) → recomeça o login.
-        if (!pkce || pkce.state !== state || !code) {
-            ctx.session?.forget(pkceKey);
-            return ctx.response.redirect().withQs(false).toPath(`${prefix}/login`);
+        const pending = ctx.session?.get(pkceKey);
+        // Single use, whatever the outcome.
+        ctx.session?.forget(pkceKey);
+        let tokenSet;
+        try {
+            ({ tokens: tokenSet } = await manager.completeAuthorization({
+                pending,
+                callbackParams: ctx.request.qs(),
+            }));
+        }
+        catch (error) {
+            // Stale/expired callback (lost state, no code) or the IdP sent the user back
+            // with an error (access_denied…) → restart the login, as before. A failed
+            // id_token check or token exchange is a real failure and propagates.
+            if (error instanceof OidcCallbackError && error.restartable) {
+                return ctx.response.redirect().withQs(false).toPath(`${prefix}/login`);
+            }
+            throw error;
         }
-        const tokenSet = await exchangeCode({
-            issuer: cfg.issuer,
-            clientId: cfg.clientId,
-            clientSecret: cfg.clientSecret,
-            redirectUri: cfg.redirectUri,
-            code,
-            codeVerifier: pkce.verifier,
-        });
         // startSession, não `put(sessionKey)`: um login novo no mesmo cookie jar não pode
         // herdar a credencial de impersonação parqueada pela sessão anterior.
         manager.startSession(ctx, tokenSet);
-        ctx.session?.forget(pkceKey);
         const authenticator = await manager.createAuthenticator(ctx);
         const identity = await authenticator.getIdentity();
         // 1) Hook do app tem prioridade quando retorna uma rota.
@@ -98,11 +89,19 @@ export function registerOidcClient(router, options = {}) {
         const postLogoutRedirectUri = typeof options.postLogoutRedirect === 'function'
             ? options.postLogoutRedirect(ctx)
             : (options.postLogoutRedirect ?? `${new URL(cfg.redirectUri).origin}/`);
+        // The local session is already gone. With no end_session_endpoint to send the
+        // browser to — the IdP publishes none (some Auth0 tenants) or discovery is
+        // failing right now — go straight to the destination instead of erroring.
+        const endSessionEndpoint = await manager.endpoints().then((endpoints) => endpoints.endSessionEndpoint, () => undefined);
+        if (!endSessionEndpoint) {
+            return ctx.response.redirect().withQs(false).toPath(postLogoutRedirectUri);
+        }
         const endSessionUrl = buildEndSessionUrl({
             issuer: cfg.issuer,
             idToken,
             postLogoutRedirectUri,
             clientId: cfg.clientId,
+            endSessionEndpoint,
         });
         return ctx.response.redirect().withQs(false).toPath(endSessionUrl);
     })

package/build/src/resolvers/factory.d.ts

@@ -1,8 +1,9 @@
 import type { SessionResolver } from '@adonis-agora/authkit-core';
+import { type OidcEndpoints } from '../discovery.js';
 import { type TokenSource } from '../token_source.js';
 export interface JwtResolverFactoryConfig {
     tokenSource?: TokenSource;
-    /** jwks_uri explícito; se omitido, é `${issuer}/jwks` (rota padrão do oidc-provider) */
+    /** Explicit jwks_uri. Default: the discovered `jwks_uri` (`${issuer}/jwks` with discovery off). */
     jwksUri?: string;
 }
 export interface PatResolverFactoryConfig {
@@ -15,7 +16,7 @@ export interface OpaqueResolverFactoryConfig {
      * guardado no TokenSet; `bearer` introspecta o token do header Authorization (APIs).
      */
     tokenSource?: TokenSource;
-    /** Endpoint de introspection; default `${issuer}/token/introspection` (oidc-provider). */
+    /** Introspection endpoint. Default: the discovered one (`${issuer}/token/introspection` with discovery off). */
     introspectionUrl?: string;
     /**
      * TTL (ms) do cache de respostas `active:true`. Default 0 (revogação imediata).
@@ -30,6 +31,12 @@ export interface ResolverContext {
     clientSecret?: string;
     sessionKey: string;
     globalRolesClaim: string;
+    /** The IdP endpoints (discovery + overrides), cached by the caller — call it per request. */
+    endpoints: () => Promise<OidcEndpoints>;
+    /** Where a resolver reports that the IdP cannot serve it (e.g. no introspection). */
+    logger: {
+        warn(obj: object, msg: string): void;
+    };
 }
 export interface ResolverFactory {
     resolver(ctx: ResolverContext): Promise<SessionResolver>;

package/build/src/resolvers/factory.js

@@ -1,16 +1,36 @@
+import { OidcDiscoveryError } from '../discovery.js';
 import { getTokenFromSource } from '../token_source.js';
 import { JwtResolver } from './jwt_resolver.js';
 import { OpaqueResolver } from './opaque_resolver.js';
 import { PatResolver } from './pat_resolver.js';
+/**
+ * The current endpoints, or `null` while discovery fails (and nothing was ever
+ * discovered): a request then resolves to no identity — the same outcome as an
+ * unreachable JWKS — instead of failing every request, public pages included via
+ * silent auth. Any other error is a configuration error and throws.
+ */
+async function currentEndpoints(rc) {
+    try {
+        return await rc.endpoints();
+    }
+    catch (error) {
+        if (error instanceof OidcDiscoveryError)
+            return null;
+        throw error;
+    }
+}
 export const resolvers = {
     jwt(config = {}) {
         const tokenSource = config.tokenSource ?? 'session';
         return {
             async resolver(rc) {
-                const jwksUri = config.jwksUri ?? `${rc.issuer}/jwks`;
                 return new JwtResolver({
-                    issuer: rc.issuer,
-                    jwksUri,
+                    endpoints: async () => {
+                        const endpoints = await currentEndpoints(rc);
+                        if (!endpoints)
+                            return null;
+                        return { issuer: endpoints.issuer, jwksUri: config.jwksUri ?? endpoints.jwksUri };
+                    },
                     audience: rc.clientId,
                     globalRolesClaim: rc.globalRolesClaim,
                     getToken: (httpCtx) => getTokenFromSource(httpCtx, tokenSource, rc.sessionKey),
@@ -35,9 +55,21 @@ export const resolvers = {
                 if (!rc.clientSecret) {
                     throw new Error('resolvers.opaque requer um client confidencial (clientSecret) para introspection');
                 }
-                const introspectionUrl = config.introspectionUrl ?? `${rc.issuer}/token/introspection`;
+                let warned = false;
                 return new OpaqueResolver({
-                    introspectionUrl,
+                    introspectionUrl: async () => {
+                        if (config.introspectionUrl)
+                            return config.introspectionUrl;
+                        const endpoints = await currentEndpoints(rc);
+                        if (!endpoints)
+                            return null;
+                        if (!endpoints.introspectionEndpoint && !warned) {
+                            warned = true;
+                            rc.logger.warn({ issuer: rc.issuer }, 'authkit-client: the IdP publishes no introspection_endpoint, so resolvers.opaque ' +
+                                'resolves every request to no identity — set introspectionUrl');
+                        }
+                        return endpoints.introspectionEndpoint ?? null;
+                    },
                     clientId: rc.clientId,
                     clientSecret: rc.clientSecret,
                     tokenSource,

package/build/src/resolvers/jwt_resolver.d.ts

@@ -1,8 +1,13 @@
 import type { Identity, SessionResolver } from '@adonis-agora/authkit-core';
 import type { HttpContext } from '@adonisjs/core/http';
+import type { OidcEndpoints } from '../discovery.js';
 export interface JwtResolverConfig {
-    issuer: string;
-    jwksUri: string;
+    /**
+     * Issuer and jwks_uri to verify against, read on every token so a rotated
+     * `jwks_uri` / `issuer` takes effect without a restart. `null` (discovery is
+     * failing) resolves to no identity.
+     */
+    endpoints: () => Promise<Pick<OidcEndpoints, 'issuer' | 'jwksUri'> | null>;
     audience: string;
     globalRolesClaim: string;
     /** algoritmos de assinatura aceitos (defesa contra alg-confusion). Default: asimétricos. */
@@ -11,7 +16,6 @@ export interface JwtResolverConfig {
     getToken?: (ctx: HttpContext) => string | null;
 }
 export declare class JwtResolver implements SessionResolver {
-    #private;
     private config;
     constructor(config: JwtResolverConfig);
     /** Valida um JWT cru e monta a Identity (ou null se inválido). */

package/build/src/resolvers/jwt_resolver.js

@@ -1,29 +1,20 @@
-import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { jwtVerify } from 'jose';
+import { DEFAULT_ALGS, getJwks } from '../jwks.js';
 import { buildIdentityFromClaims } from './identity.js';
-const DEFAULT_ALGS = [
-    'RS256',
-    'RS384',
-    'RS512',
-    'PS256',
-    'PS384',
-    'PS512',
-    'ES256',
-    'ES384',
-    'ES512',
-    'EdDSA',
-];
 export class JwtResolver {
     config;
-    #jwks;
     constructor(config) {
         this.config = config;
-        this.#jwks = createRemoteJWKSet(new URL(config.jwksUri));
     }
     /** Valida um JWT cru e monta a Identity (ou null se inválido). */
     async resolveToken(token) {
+        const endpoints = await this.config.endpoints();
+        if (!endpoints)
+            return null;
+        const keys = getJwks(endpoints.jwksUri);
         try {
-            const { payload } = await jwtVerify(token, this.#jwks, {
-                issuer: this.config.issuer,
+            const { payload } = await jwtVerify(token, keys, {
+                issuer: endpoints.issuer,
                 audience: this.config.audience,
                 algorithms: this.config.algorithms ?? DEFAULT_ALGS,
             });

package/build/src/resolvers/opaque_resolver.d.ts

@@ -6,8 +6,11 @@ type FetchImpl = (url: string, init: any) => Promise<{
     json: () => Promise<any>;
 }>;
 export interface OpaqueResolverConfig {
-    /** Endpoint de introspection do IdP (RFC 7662). Ex.: `${issuer}/token/introspection`. */
-    introspectionUrl: string;
+    /**
+     * Endpoint de introspection do IdP (RFC 7662), lido a cada request. `null` (o IdP
+     * não publica um, ou o discovery está falhando) resolve para nenhuma identidade.
+     */
+    introspectionUrl: () => Promise<string | null>;
     /** client_id usado para autenticar a introspection (client confidencial). */
     clientId: string;
     /** client_secret correspondente (Basic auth). */

package/build/src/resolvers/opaque_resolver.js

@@ -33,8 +33,11 @@ export class OpaqueResolver {
             if (hit && this.#now() - hit.storedAt < ttl)
                 return hit.identity;
         }
+        const introspectionUrl = await this.config.introspectionUrl();
+        if (!introspectionUrl)
+            return null;
         const basic = Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString('base64');
-        const data = await introspectToken(this.config.introspectionUrl, token, { type: 'basic', value: basic }, { tokenTypeHint: 'access_token', fetchImpl: this.config.fetchImpl });
+        const data = await introspectToken(introspectionUrl, token, { type: 'basic', value: basic }, { tokenTypeHint: 'access_token', fetchImpl: this.config.fetchImpl });
         if (!data) {
             this.#cache.delete(token);
             return null;

package/build/src/verify_access_token.d.ts

@@ -33,5 +33,3 @@ export interface JwtAccessTokenClaims extends JWTPayload {
  * claims validadas no caminho feliz.
  */
 export declare function verifyJwtAccessToken(token: string, options: VerifyJwtAccessTokenOptions): Promise<JwtAccessTokenClaims>;
-/** Limpa o cache de JWKS remotos (útil em testes). */
-export declare function clearJwksCache(): void;

package/build/src/verify_access_token.js

@@ -1,26 +1,5 @@
-import { createRemoteJWKSet, jwtVerify } from 'jose';
-const DEFAULT_ALGS = [
-    'RS256',
-    'RS384',
-    'RS512',
-    'PS256',
-    'PS384',
-    'PS512',
-    'ES256',
-    'ES384',
-    'ES512',
-    'EdDSA',
-];
-// Cache de keysets remotos por jwks_uri — evita refazer fetch/parse por request.
-const jwksCache = new Map();
-function getJwks(uri) {
-    let set = jwksCache.get(uri);
-    if (!set) {
-        set = createRemoteJWKSet(new URL(uri));
-        jwksCache.set(uri, set);
-    }
-    return set;
-}
+import { jwtVerify } from 'jose';
+import { DEFAULT_ALGS, getJwks } from './jwks.js';
 /**
  * Verifica um JWT AT (RFC 9068). Lança (via jose) se a assinatura/claims forem
  * inválidas ou se o `typ` não for `at+jwt` (a menos que `allowAnyTyp`). Retorna as
@@ -37,7 +16,3 @@ export async function verifyJwtAccessToken(token, options) {
     });
     return payload;
 }
-/** Limpa o cache de JWKS remotos (útil em testes). */
-export function clearJwksCache() {
-    jwksCache.clear();
-}

package/build/stubs/controllers/oidc_session_controller.stub

@@ -1,42 +1,47 @@
 {{{
   exports({ to: app.makePath('app/controllers/oidc_session_controller.ts') })
 }}}
+import { inject } from '@adonisjs/core'
 import type { HttpContext } from '@adonisjs/core/http'
-import { buildAuthorizeUrl, exchangeCode, generatePkce } from '@adonis-agora/authkit-client'
-import { randomUUID } from 'node:crypto'
+import { AuthkitClientManager, OidcCallbackError } from '@adonis-agora/authkit-client'
 
+/**
+ * Login, callback and logout written out by hand. If you do not need to customise
+ * them, `registerOidcClient(router)` registers the same three routes for you.
+ */
+@inject()
 export default class OidcSessionController {
-  async login(ctx: HttpContext) {
-    const manager = await ctx.containerResolver.make('authkit.client')
-    const cfg = manager.clientConfig
-    const { verifier, challenge } = await generatePkce()
-    const state = randomUUID()
-    ctx.session.put('authkit_pkce', { verifier, state })
-    const url = buildAuthorizeUrl({
-      issuer: cfg.issuer, clientId: cfg.clientId, redirectUri: cfg.redirectUri,
-      scopes: cfg.scopes, state, codeChallenge: challenge,
-    })
-    return ctx.response.redirect(url)
+  constructor(protected authkit: AuthkitClientManager) {}
+
+  async login({ session, response }: HttpContext) {
+    // Fresh state + nonce + PKCE, against the endpoints discovered from the issuer.
+    const { url, pending } = await this.authkit.createAuthorizationRequest()
+    session.put('authkit_pkce', pending)
+    return response.redirect(url)
   }
 
   async callback(ctx: HttpContext) {
-    const manager = await ctx.containerResolver.make('authkit.client')
-    const cfg = manager.clientConfig
-    const { code, state } = ctx.request.qs()
-    const pkce = ctx.session.get('authkit_pkce')
-    if (!pkce || pkce.state !== state) return ctx.response.badRequest({ error: 'state inválido' })
-    const tokenSet = await exchangeCode({
-      issuer: cfg.issuer, clientId: cfg.clientId, clientSecret: cfg.clientSecret,
-      redirectUri: cfg.redirectUri, code, codeVerifier: pkce.verifier,
-    })
-    manager.startSession(ctx, tokenSet)
-    ctx.session.forget('authkit_pkce')
+    const pending = ctx.session.pull('authkit_pkce')
+    try {
+      // Checks state and iss, exchanges the code and validates the id_token (nonce included).
+      const { tokens: tokenSet } = await this.authkit.completeAuthorization({
+        pending,
+        callbackParams: ctx.request.qs(),
+      })
+      // startSession (not session.put) drops any impersonation parked by a previous session.
+      this.authkit.startSession(ctx, tokenSet)
+    } catch (error) {
+      // Stale callback, or the IdP sent the user back with an error (access_denied…).
+      if (error instanceof OidcCallbackError && error.restartable) {
+        return ctx.response.redirect('/auth/login')
+      }
+      throw error
+    }
     return ctx.response.redirect('/')
   }
 
   async logout(ctx: HttpContext) {
-    const manager = await ctx.containerResolver.make('authkit.client')
-    manager.endSession(ctx)
+    this.authkit.endSession(ctx)
     return ctx.response.redirect('/')
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-client",
-  "version": "0.18.8",
+  "version": "0.19.0",
   "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -62,10 +62,10 @@
   },
   "peerDependencies": {
     "@adonis-agora/resilience": ">=0.1.0 <1.0.0",
-    "@adonisjs/auth": "10.1.0",
-    "@adonisjs/core": "7.5.0",
-    "@adonisjs/lucid": "22.4.2",
-    "@adonisjs/session": "8.1.0"
+    "@adonisjs/auth": "^10.1.0",
+    "@adonisjs/core": "^7.5.0",
+    "@adonisjs/lucid": "^22.4.2",
+    "@adonisjs/session": "^8.1.0"
   },
   "peerDependenciesMeta": {
     "@adonisjs/auth": {
@@ -83,7 +83,7 @@
     "jose": "6.2.12"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-server": "0.74.0",
+    "@adonis-agora/authkit-server": "0.80.1",
     "@adonis-agora/resilience": "0.3.7",
     "@adonisjs/auth": "10.1.0",
     "@adonisjs/core": "7.5.0",
@@ -97,6 +97,7 @@
     "@types/node": "26.5.1",
     "ioredis-mock": "8.13.1",
     "tempura": "0.4.1",
+    "testcontainers": "12.2.1",
     "typescript": "7.0.2"
   },
   "scripts": {