@adonis-agora/authkit-client 0.19.0 → 0.19.1

package/build/commands/configure.js

@@ -16,4 +16,10 @@ export async function configure(command) {
             AUTHKIT_REDIRECT_URI: `Env.schema.string({ format: 'url', tld: false })`,
         },
     });
+    // As rotas não são registradas pelo configure. O caminho é o `registerOidcClient`
+    // (startSession/endSession, RP-initiated logout, back-channel); o controller
+    // ejetado acima existe só para quem precisa customizar o fluxo.
+    command.logger.info('Registre as rotas de sessão em start/routes.ts com registerOidcClient(router) ' +
+        "(import { registerOidcClient } from '@adonis-agora/authkit-client'). " +
+        'O app/controllers/oidc_session_controller.ts publicado é só para customizar o fluxo.');
 }

package/build/stubs/controllers/oidc_session_controller.stub

@@ -7,7 +7,7 @@ import { AuthkitClientManager, OidcCallbackError } from '@adonis-agora/authkit-c
 
 /**
  * Login, callback and logout written out by hand. If you do not need to customise
- * them, `registerOidcClient(router)` registers the same three routes for you.
+ * them, registerOidcClient(router) registers the same three routes for you.
  */
 @inject()
 export default class OidcSessionController {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-client",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -83,7 +83,7 @@
     "jose": "6.2.12"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-server": "0.80.1",
+    "@adonis-agora/authkit-server": "0.80.2",
     "@adonis-agora/resilience": "0.3.7",
     "@adonisjs/auth": "10.1.0",
     "@adonisjs/core": "7.5.0",

package/skills/authkit-rp-client/SKILL.md

@@ -30,8 +30,9 @@ sources:
 `@adonis-agora/authkit-client` makes an AdonisJS app consume an OIDC provider (the
 AuthKit IdP or any other) with session-based auth: PKCE authorization-code login,
 locally-validated ID tokens (JWKS), typed `ctx.auth` per request. `configure`
-publishes `config/authkit_client.ts`, `OidcSessionController` (login/callback/logout)
-and registers the provider + middleware.
+publishes `config/authkit_client.ts` and registers the provider + middleware; the
+login/callback/logout routes come from `registerOidcClient(router)`. (`configure` also
+publishes an `OidcSessionController` stub, only for apps that must customise the flow.)
 
 ## Setup
 
@@ -58,13 +59,17 @@ export default authkitClientConfig
 ```ts
 // start/routes.ts
 import router from '@adonisjs/core/services/router'
-import OidcSessionController from '#controllers/oidc_session_controller'
+import { registerOidcClient } from '@adonis-agora/authkit-client'
 
-router.get('/auth/login', [OidcSessionController, 'login'])
-router.get('/auth/callback', [OidcSessionController, 'callback'])
-router.post('/auth/logout', [OidcSessionController, 'logout'])
+// /auth/login, /auth/callback, /auth/logout and /auth/backchannel-logout
+registerOidcClient(router)
 ```
 
+If you wire the scaffolded `OidcSessionController` instead, keep it on the manager:
+`startSession(ctx, tokenSet)` in the callback and `endSession(ctx)` in the logout —
+never a raw `session.put(sessionKey)` / `session.forget(sessionKey)`, which leaves a
+parked impersonation credential alive.
+
 Source: `packages/authkit-client/README.md`, `stubs/config/authkit_client.stub`.
 
 ## Core patterns

package/stubs/controllers/oidc_session_controller.stub

@@ -7,7 +7,7 @@ import { AuthkitClientManager, OidcCallbackError } from '@adonis-agora/authkit-c
 
 /**
  * Login, callback and logout written out by hand. If you do not need to customise
- * them, `registerOidcClient(router)` registers the same three routes for you.
+ * them, registerOidcClient(router) registers the same three routes for you.
  */
 @inject()
 export default class OidcSessionController {