@adonis-agora/authkit-client 0.20.5 → 1.0.0-rc.0

package/build/src/host/authkit_client_guard.js

@@ -1,14 +1,21 @@
+import { errors } from '@adonisjs/auth';
 import { RuntimeException } from '@adonisjs/core/exceptions';
 import { getAuthkit } from './request_authenticator.js';
+function canBuildFromIdentity(provider) {
+    return (typeof provider.fromIdentity === 'function');
+}
 /**
- * Guard de `@adonisjs/auth` apoiado na sessão OIDC do `@adonis-agora/authkit-client`.
+ * Guard de `@adonisjs/auth` apoiado na sessão do `@adonis-agora/authkit-client`.
  *
  * A fonte da verdade de "quem está logado" é o `SessionResolver` do authkit
- * (JWT/opaco/PAT, conforme `config/authkit_client.ts`) — o guard NÃO reimplementa
- * resolução de sessão nem lê a sessão por conta própria. Ele só faz a ponte:
- * pega o `sub` da `Identity` (`identity.userId`) e pede o usuário do app ao
- * `provider`, exatamente como o `sessionGuard` nativo faria com o id que ele
- * guarda na sessão.
+ * (sessão OIDC, bearer JWT, opaco/introspecção ou PAT, conforme
+ * `config/authkit_client.ts` ou a opção `resolver` do guard). O guard não lê a
+ * sessão por conta própria.
+ *
+ * O usuário vem, nesta ordem: do `resolveUser` de `config/authkit_client.ts`
+ * (ex.: `lucidMirror`, que cria a linha local no primeiro login; é a MESMA
+ * instância de `ctx.authkit.getUser()`), do provider montando o usuário da
+ * `Identity` ({@link authkitIdentityProvider}), ou de `provider.findById(sub)`.
  *
  * Consequência: `middleware.auth()`, `ctx.auth.user`, `auth.check()` e o Bouncer
  * passam a funcionar sobre uma sessão do authkit.
@@ -16,19 +23,19 @@ import { getAuthkit } from './request_authenticator.js';
 export class AuthkitClientGuard {
     #ctx;
     #userProvider;
-    #unauthorized;
+    #resolver;
     #authkit;
     driverName = 'authkit_client';
     authenticationAttempted = false;
     isAuthenticated = false;
     user;
-    constructor(_name, ctx, userProvider, unauthorized) {
+    constructor(_name, ctx, userProvider, options = {}) {
         this.#ctx = ctx;
         this.#userProvider = userProvider;
-        this.#unauthorized = unauthorized;
+        this.#resolver = options.resolver;
     }
     /**
-     * O {@link Authenticator} do authkit desta request (a `Identity` crua,
+     * O {@link Authenticator} do authkit que este guard usou (a `Identity` crua,
      * `hasGlobalRole`, `toSharedProps`). Só existe depois de uma tentativa de
      * autenticação; use `ctx.authkit` (via `authkit_context_middleware`) quando
      * precisar dele em rota pública.
@@ -39,32 +46,60 @@ export class AuthkitClientGuard {
     #failed() {
         this.isAuthenticated = false;
         this.user = undefined;
-        return new this.#unauthorized('Invalid or expired user session', {
+        return new errors.E_UNAUTHORIZED_ACCESS('Invalid or expired user session', {
             guardDriverName: this.driverName,
         });
     }
     /**
-     * Autentica a request: resolve a sessão do authkit e mapeia o `sub` para o
-     * usuário do app via `provider.findById`. Lança `E_UNAUTHORIZED_ACCESS` (o
-     * MESMO erro dos guards nativos, então o `middleware.auth()` e o handler de
-     * exceção do host tratam igual) quando não há sessão OU quando a sessão é
-     * válida mas não existe usuário local correspondente (fail-closed).
+     * The authenticator for this request. Without a `resolver` option it is the
+     * request's shared `ctx.authkit`. With one, it is a separate authenticator over
+     * that resolver; it becomes `ctx.authkit` only when nothing set it yet.
+     */
+    async #authenticator() {
+        if (!this.#resolver)
+            return getAuthkit(this.#ctx);
+        const manager = await this.#ctx.containerResolver.make('authkit.client');
+        const authenticator = (await manager.createAuthenticator(this.#ctx, {
+            resolver: this.#resolver,
+        }));
+        const ctx = this.#ctx;
+        if (!ctx.authkit)
+            ctx.authkit = authenticator;
+        return authenticator;
+    }
+    /**
+     * Autentica a request. Lança `E_UNAUTHORIZED_ACCESS` (o MESMO erro dos guards
+     * nativos, então o `middleware.auth()` e o handler de exceção do host tratam
+     * igual) quando não há sessão OU quando a sessão é válida mas nenhuma fonte
+     * devolve usuário (fail-closed).
      */
     async authenticate() {
         if (this.authenticationAttempted)
             return this.getUserOrFail();
         this.authenticationAttempted = true;
-        const authkit = await getAuthkit(this.#ctx);
+        const authkit = await this.#authenticator();
         this.#authkit = authkit;
         const identity = await authkit.getIdentity();
         if (!identity)
             throw this.#failed();
-        // `identity.userId` É a claim `sub` — o único id estável por conta que a
-        // `Identity` tem. (Ela NÃO tem `id`.)
-        const providerUser = await this.#userProvider.findById(identity.userId);
-        if (!providerUser)
+        // `resolveUser` (ex.: `lucidMirror`) provisiona a linha local no primeiro
+        // login e devolve o usuário enriquecido; reaproveitá-lo mantém UMA instância
+        // por request, compartilhada com `ctx.authkit.getUser()`.
+        let user = null;
+        if (authkit.resolvesUser)
+            user = await authkit.getUser();
+        if (user === null || user === undefined) {
+            const provider = this.#userProvider;
+            // `identity.userId` É a claim `sub` — o único id estável por conta que a
+            // `Identity` tem. (Ela NÃO tem `id`.)
+            const guardUser = canBuildFromIdentity(provider)
+                ? await provider.fromIdentity(identity)
+                : await provider.findById(identity.userId);
+            user = guardUser?.getOriginal() ?? null;
+        }
+        if (user === null || user === undefined)
             throw this.#failed();
-        this.user = providerUser.getOriginal();
+        this.user = user;
         this.isAuthenticated = true;
         return this.user;
     }
@@ -75,7 +110,7 @@ export class AuthkitClientGuard {
             return true;
         }
         catch (error) {
-            if (error instanceof this.#unauthorized)
+            if (error instanceof errors.E_UNAUTHORIZED_ACCESS)
                 return false;
             throw error;
         }
@@ -83,7 +118,7 @@ export class AuthkitClientGuard {
     /** O usuário autenticado, ou `E_UNAUTHORIZED_ACCESS`. */
     getUserOrFail() {
         if (!this.user) {
-            throw new this.#unauthorized('Invalid or expired user session', {
+            throw new errors.E_UNAUTHORIZED_ACCESS('Invalid or expired user session', {
                 guardDriverName: this.driverName,
             });
         }
@@ -108,7 +143,8 @@ export class AuthkitClientGuard {
  * ```ts
  * import { defineConfig } from '@adonisjs/auth'
  * import { sessionUserProvider } from '@adonisjs/auth/session'
- * import { authkitClientGuard } from '@adonis-agora/authkit-client'
+ * import { authkitClientGuard, authkitIdentityProvider } from '@adonis-agora/authkit-client/auth'
+ * import { resolvers } from '@adonis-agora/authkit-client'
  *
  * export default defineConfig({
  *   default: 'web',
@@ -116,38 +152,53 @@ export class AuthkitClientGuard {
  *     web: authkitClientGuard({
  *       provider: sessionUserProvider({ model: () => import('#models/user') }),
  *     }),
+ *     // API routes authenticated by a bearer access token.
+ *     api: authkitClientGuard({
+ *       provider: authkitIdentityProvider(),
+ *       resolver: resolvers.jwt({ tokenSource: 'bearer' }),
+ *     }),
  *   },
  * })
  * ```
  *
- * O `provider` é o MESMO contrato do `sessionGuard` nativo, então qualquer user
- * provider de session serve. O `findById` recebe `identity.userId` (a claim
- * `sub`) — a coluna de id do model precisa ser essa (é o que o `lucidMirror()`
- * grava).
- *
- * Precedência com `resolveUser` de `config/authkit_client.ts`: são superfícies
- * SEPARADAS e ambas continuam valendo. `ctx.auth.user` (framework) vem SEMPRE do
- * `provider`; `ctx.authkit.getUser()` (authkit) continua vindo do `resolveUser`.
- * O guard nunca chama `resolveUser`. Com o guard configurado, o normal é apagar
- * o `resolveUser` e deixar só o `provider`.
+ * - `provider`: any session user provider. Its `findById` receives `identity.userId`
+ *   (the `sub` claim). With `resolveUser` in `config/authkit_client.ts`, the guard
+ *   uses that user first and the provider is the fallback.
+ * - `resolver`: replaces the resolver of `config/authkit_client.ts` for this guard
+ *   only (bearer JWT, opaque, PAT). Without it the guard uses the configured one.
  */
 export function authkitClientGuard(config) {
     return {
         async resolver(name, app) {
-            let unauthorized;
-            try {
-                const auth = (await import('@adonisjs/auth'));
-                unauthorized = auth.errors.E_UNAUTHORIZED_ACCESS;
-            }
-            catch (error) {
-                throw new RuntimeException('authkitClientGuard() precisa de "@adonisjs/auth" instalado (é um peer opcional do ' +
-                    '@adonis-agora/authkit-client, só necessário se você plugar este guard em config/auth.ts). ' +
-                    'Rode `npm i @adonisjs/auth` (ou pnpm/yarn).', { cause: error });
-            }
             const provider = 'resolver' in config.provider
                 ? (await config.provider.resolver(app))
                 : config.provider;
-            return (ctx) => new AuthkitClientGuard(name, ctx, provider, unauthorized);
+            return (ctx) => new AuthkitClientGuard(name, ctx, provider, { resolver: config.resolver });
         },
     };
 }
+/**
+ * User provider with no database: `ctx.auth.user` is the AuthKit {@link Identity}
+ * of the request (`userId`, `email`, `globalRoles`, `profile`, the raw claims).
+ * Use it when the app keeps no local user table, or for API guards that only need
+ * the token's subject. When `config/authkit_client.ts` sets `resolveUser`, the
+ * guard uses that user instead.
+ */
+export function authkitIdentityProvider() {
+    return new AuthkitIdentityProvider();
+}
+class AuthkitIdentityProvider {
+    #wrap(identity) {
+        return { getId: () => identity.userId, getOriginal: () => identity };
+    }
+    async fromIdentity(identity) {
+        return this.#wrap(identity);
+    }
+    async createUserForGuard(identity) {
+        return this.#wrap(identity);
+    }
+    /** There is no store to look an id up in: only the request's identity exists. */
+    async findById() {
+        return null;
+    }
+}

package/build/src/host/dashboard_guard.d.ts

@@ -6,15 +6,11 @@ export interface DashboardGuardOptions {
 /**
  * Core predicate behind {@link authkitDashboardAuthorize} and
  * {@link authkitDashboardMiddleware}: authenticated (a resolvable authkit `Identity`) AND holding
- * the configured global role — `ctx.auth.hasGlobalRole('ADMIN')`, the pattern hosts already
+ * the configured global role — `ctx.authkit.hasGlobalRole('ADMIN')`, the pattern hosts already
  * hand-roll per embedded admin dashboard (durable/media/agent/telescope).
  *
- * Resolves the session via {@link getAuthkit} rather than reading `ctx.auth` directly: `ctx.auth`'s
- * TYPE is host-owned (each app augments `HttpContext.auth` for its own user model, or leaves it to
- * `@adonisjs/auth`'s guard), so this module — shipped from the library, with no visibility into
- * that augmentation — can't assume its shape. `getAuthkit` is the one session-resolution path that
- * works either way (legacy `authkit_middleware`'s `ctx.auth` or the newer `authkitClientGuard`'s
- * `ctx.authkit`), memoizing so a second call in the same request is free.
+ * Resolves the session via {@link getAuthkit}, which memoizes on `ctx.authkit`, so a second call
+ * in the same request is free.
  */
 export declare function isAuthkitAdmin(ctx: HttpContext, options?: DashboardGuardOptions): Promise<boolean>;
 /**

package/build/src/host/dashboard_guard.js

@@ -6,15 +6,11 @@ const DEFAULT_ADMIN_ROLE = 'ADMIN';
 /**
  * Core predicate behind {@link authkitDashboardAuthorize} and
  * {@link authkitDashboardMiddleware}: authenticated (a resolvable authkit `Identity`) AND holding
- * the configured global role — `ctx.auth.hasGlobalRole('ADMIN')`, the pattern hosts already
+ * the configured global role — `ctx.authkit.hasGlobalRole('ADMIN')`, the pattern hosts already
  * hand-roll per embedded admin dashboard (durable/media/agent/telescope).
  *
- * Resolves the session via {@link getAuthkit} rather than reading `ctx.auth` directly: `ctx.auth`'s
- * TYPE is host-owned (each app augments `HttpContext.auth` for its own user model, or leaves it to
- * `@adonisjs/auth`'s guard), so this module — shipped from the library, with no visibility into
- * that augmentation — can't assume its shape. `getAuthkit` is the one session-resolution path that
- * works either way (legacy `authkit_middleware`'s `ctx.auth` or the newer `authkitClientGuard`'s
- * `ctx.authkit`), memoizing so a second call in the same request is free.
+ * Resolves the session via {@link getAuthkit}, which memoizes on `ctx.authkit`, so a second call
+ * in the same request is free.
  */
 export async function isAuthkitAdmin(ctx, options = {}) {
     const authkit = await getAuthkit(ctx);

package/build/src/host/request_authenticator.d.ts

@@ -1,3 +1,4 @@
+import '../../container_bindings.js';
 import type { HttpContext } from '@adonisjs/core/http';
 import type { Authenticator } from '../authenticator.js';
 /**
@@ -7,25 +8,42 @@ import type { Authenticator } from '../authenticator.js';
  * É o ÚNICO caminho de resolução de sessão da lib: passa pelo
  * `AuthkitClientManager`, então o refresh proativo do token (`maybeRefresh`), o
  * `SessionResolver` configurado, as métricas e a ponte do `@agora/context`
- * continuam valendo — tanto para quem usa `authkit_middleware` (legado) quanto
- * para quem usa o `authkitClientGuard` de `@adonisjs/auth`.
+ * continuam valendo — com ou sem o `authkitClientGuard` de `@adonisjs/auth`.
  *
  * Memoiza em `ctx.authkit` de propósito: quando o host registra o
  * `authkit_context_middleware` E o guard, os dois compartilham a MESMA
  * instância, e a sessão é resolvida (e o token renovado) uma vez só.
  */
-export declare function getAuthkit(ctx: HttpContext): Promise<Authenticator>;
+export declare function getAuthkit(ctx: HttpContext): Promise<Authenticator<AuthkitUser>>;
+/**
+ * Augment this interface to type the user that `ctx.authkit.getUser()` returns
+ * (whatever your `resolveUser` produces):
+ *
+ * ```ts
+ * // types/authkit.ts
+ * import type AppUser from '#models/app_user'
+ *
+ * declare module '@adonis-agora/authkit-client' {
+ *   interface AuthkitUserType {
+ *     user: AppUser
+ *   }
+ * }
+ * ```
+ */
+export interface AuthkitUserType {
+}
+/** The user type the app declared on {@link AuthkitUserType}, or `unknown`. */
+export type AuthkitUser = AuthkitUserType extends {
+    user: infer TUser;
+} ? TUser : unknown;
 declare module '@adonisjs/core/http' {
     interface HttpContext {
         /**
          * Superfície específica do authkit (`getIdentity`, `hasGlobalRole`, a
-         * `Identity` crua). Populada pelo `authkit_context_middleware` e, no
-         * caminho do guard, pelo próprio `authkitClientGuard` ao autenticar.
-         *
-         * Existe para que o `@adonisjs/auth` possa ser o dono de `ctx.auth` sem que
-         * o host perca o que só o authkit sabe. Quem NÃO usa o guard continua com o
-         * `Authenticator` do authkit direto em `ctx.auth` (ver `types.ts`).
+         * `Identity` crua, `getUser`). Populada pelo `authkit_context_middleware` e,
+         * no caminho do guard, pelo próprio `authkitClientGuard` ao autenticar.
+         * `ctx.auth` fica livre para o `@adonisjs/auth` (via `authkitClientGuard`).
          */
-        authkit: Authenticator;
+        authkit: Authenticator<AuthkitUser>;
     }
 }

package/build/src/host/request_authenticator.js

@@ -1,3 +1,6 @@
+// Side-effect import: carries the `authkit.client` container binding into the emitted
+// `.d.ts`, so `containerResolver.make('authkit.client')` is typed in a consumer's program.
+import '../../container_bindings.js';
 /**
  * Resolve (uma vez por request) o {@link Authenticator} do authkit e o memoiza
  * em `ctx.authkit`.
@@ -5,8 +8,7 @@
  * É o ÚNICO caminho de resolução de sessão da lib: passa pelo
  * `AuthkitClientManager`, então o refresh proativo do token (`maybeRefresh`), o
  * `SessionResolver` configurado, as métricas e a ponte do `@agora/context`
- * continuam valendo — tanto para quem usa `authkit_middleware` (legado) quanto
- * para quem usa o `authkitClientGuard` de `@adonisjs/auth`.
+ * continuam valendo — com ou sem o `authkitClientGuard` de `@adonisjs/auth`.
  *
  * Memoiza em `ctx.authkit` de propósito: quando o host registra o
  * `authkit_context_middleware` E o guard, os dois compartilham a MESMA
@@ -18,7 +20,7 @@ export async function getAuthkit(ctx) {
         return existing;
     const manager = await ctx.containerResolver.make('authkit.client');
     await manager.maybeRefresh(ctx);
-    const authenticator = await manager.createAuthenticator(ctx);
+    const authenticator = (await manager.createAuthenticator(ctx));
     ctx.authkit = authenticator;
     return authenticator;
 }

package/build/src/middleware/authkit_context_middleware.d.ts

@@ -1,3 +1,4 @@
+import '../../container_bindings.js';
 import type { HttpContext } from '@adonisjs/core/http';
 import type { NextFn } from '@adonisjs/core/types/http';
 /**
@@ -18,10 +19,8 @@ import type { NextFn } from '@adonisjs/core/types/http';
  * ])
  * ```
  *
- * Não substitui o `authkit_middleware`: quem NÃO usa `@adonisjs/auth` continua
- * com o `authkit_middleware`, que segue colocando o `Authenticator` em
- * `ctx.auth` como sempre. Registrar os dois não faz sentido (e resolveria a
- * sessão duas vezes em objetos distintos).
+ * Sem `@adonisjs/auth`, é ele sozinho que dá a sessão ao app: `ctx.authkit`
+ * em qualquer rota, e `auth_middleware` para exigir login.
  */
 export default class AuthkitContextMiddleware {
     handle(ctx: HttpContext, next: NextFn): Promise<any>;

package/build/src/middleware/authkit_context_middleware.js

@@ -1,3 +1,6 @@
+// Side-effect import: carries the `authkit.client` container binding into the emitted
+// `.d.ts` of the middleware an app registers in start/kernel.ts.
+import '../../container_bindings.js';
 import { getAuthkit } from '../host/request_authenticator.js';
 /**
  * Popula `ctx.authkit` (o `Authenticator` do authkit) e renova o token
@@ -17,10 +20,8 @@ import { getAuthkit } from '../host/request_authenticator.js';
  * ])
  * ```
  *
- * Não substitui o `authkit_middleware`: quem NÃO usa `@adonisjs/auth` continua
- * com o `authkit_middleware`, que segue colocando o `Authenticator` em
- * `ctx.auth` como sempre. Registrar os dois não faz sentido (e resolveria a
- * sessão duas vezes em objetos distintos).
+ * Sem `@adonisjs/auth`, é ele sozinho que dá a sessão ao app: `ctx.authkit`
+ * em qualquer rota, e `auth_middleware` para exigir login.
  */
 export default class AuthkitContextMiddleware {
     async handle(ctx, next) {

package/build/src/middleware/backchannel_revocation_middleware.d.ts

@@ -10,7 +10,7 @@ import type { NextFn } from '@adonisjs/core/types/http';
  *
  * No-op quando `backchannelLogout.store` não está configurado em `config/authkit_client.ts`.
  *
- * Ordem no kernel: DEPOIS do `authkit_middleware` (depende do `authkit.client`
+ * Ordem no kernel: DEPOIS do `authkit_context_middleware` (depende do `authkit.client`
  * resolvido), antes dos named middlewares de auth.
  */
 export default class BackchannelRevocationMiddleware {

package/build/src/middleware/backchannel_revocation_middleware.js

@@ -8,7 +8,7 @@
  *
  * No-op quando `backchannelLogout.store` não está configurado em `config/authkit_client.ts`.
  *
- * Ordem no kernel: DEPOIS do `authkit_middleware` (depende do `authkit.client`
+ * Ordem no kernel: DEPOIS do `authkit_context_middleware` (depende do `authkit.client`
  * resolvido), antes dos named middlewares de auth.
  */
 export default class BackchannelRevocationMiddleware {

package/build/src/middleware/require_org_middleware.d.ts

@@ -28,11 +28,12 @@ export interface RequireOrgMiddlewareOptions {
  * pior lugar para se cair por acidente. Fail-closed: sem sessão ou sem org, não
  * passa.
  *
- * Registre como named middleware e encadeie DEPOIS do de auth:
+ * Registre como named middleware e encadeie DEPOIS do `auth` (o
+ * `#middleware/auth_middleware` que o `node ace configure` publica):
  *
  * ```ts title="start/kernel.ts"
  * export const middleware = router.named({
- *   auth: () => import('@adonis-agora/authkit-client/auth_middleware'),
+ *   auth: () => import('#middleware/auth_middleware'),
  *   requireOrg: () => import('@adonis-agora/authkit-client/require_org_middleware'),
  * })
  * ```

package/build/src/middleware/require_org_middleware.js

@@ -1,4 +1,4 @@
-import { ctxAuth } from '../host/ctx_auth.js';
+import { getAuthkit } from '../host/request_authenticator.js';
 /**
  * Exige que a sessão tenha uma **organização ativa** (claim `org_id`, exposta
  * como `identity.orgId`).
@@ -10,11 +10,12 @@ import { ctxAuth } from '../host/ctx_auth.js';
  * pior lugar para se cair por acidente. Fail-closed: sem sessão ou sem org, não
  * passa.
  *
- * Registre como named middleware e encadeie DEPOIS do de auth:
+ * Registre como named middleware e encadeie DEPOIS do `auth` (o
+ * `#middleware/auth_middleware` que o `node ace configure` publica):
  *
  * ```ts title="start/kernel.ts"
  * export const middleware = router.named({
- *   auth: () => import('@adonis-agora/authkit-client/auth_middleware'),
+ *   auth: () => import('#middleware/auth_middleware'),
  *   requireOrg: () => import('@adonis-agora/authkit-client/require_org_middleware'),
  * })
  * ```
@@ -26,7 +27,7 @@ import { ctxAuth } from '../host/ctx_auth.js';
  */
 export default class RequireOrgMiddleware {
     async handle(ctx, next, options = {}) {
-        const identity = await ctxAuth(ctx).getIdentity();
+        const identity = await (await getAuthkit(ctx)).getIdentity();
         const orgId = identity?.orgId ?? null;
         const allowed = orgId !== null && (!options.oneOf || options.oneOf.includes(orgId));
         if (allowed)

package/build/src/resolvers/dpop_proof.d.ts

@@ -0,0 +1,34 @@
+/** Asymmetric algorithms accepted for DPoP proofs (RFC 9449 forbids symmetric ones). */
+export declare const DPOP_ALGORITHMS: string[];
+export interface VerifyDpopProofInput {
+    /** The `DPoP` request header. */
+    proof: string | string[] | undefined;
+    /** The request method. */
+    method: string;
+    /** The request URL; the query and fragment are ignored. */
+    url: string;
+    /** The access token sent with the proof, bound through `ath`. */
+    accessToken: string;
+    /** The `cnf.jkt` of the access token. */
+    expectedJkt: string;
+    /** Acceptance window for `iat`, in seconds. */
+    maxAge: number;
+    /** Seen `jti`s, to refuse a replayed proof. */
+    replay: DpopReplayCache;
+    now?: () => number;
+}
+/** Bounded in-memory set of `jti`s seen within the proof window. */
+export declare class DpopReplayCache {
+    #private;
+    private readonly max;
+    constructor(max?: number);
+    /** `true` the first time a `jti` is seen before `expiresAt` (ms). */
+    remember(jti: string, expiresAt: number, now: number): boolean;
+}
+/**
+ * Verifies a DPoP proof sent to a resource server (RFC 9449 §4.3, §7): one
+ * `dpop+jwt` proof signed by the public key in its own header, matching the
+ * request method and URL, fresh, not replayed, bound to the access token
+ * (`ath`) and to the key the token is bound to (`cnf.jkt`).
+ */
+export declare function verifyDpopProof(input: VerifyDpopProofInput): Promise<boolean>;

package/build/src/resolvers/dpop_proof.js

@@ -0,0 +1,92 @@
+import { createHash } from 'node:crypto';
+import { calculateJwkThumbprint, decodeProtectedHeader, EmbeddedJWK, jwtVerify, } from 'jose';
+/** Asymmetric algorithms accepted for DPoP proofs (RFC 9449 forbids symmetric ones). */
+export const DPOP_ALGORITHMS = ['ES256', 'ES384', 'ES512', 'EdDSA', 'PS256', 'RS256'];
+function htu(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return null;
+        url.hash = '';
+        url.search = '';
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+/** Bounded in-memory set of `jti`s seen within the proof window. */
+export class DpopReplayCache {
+    max;
+    #seen = new Map();
+    constructor(max = 10_000) {
+        this.max = max;
+    }
+    /** `true` the first time a `jti` is seen before `expiresAt` (ms). */
+    remember(jti, expiresAt, now) {
+        for (const [key, exp] of this.#seen) {
+            if (exp > now && this.#seen.size < this.max)
+                break;
+            this.#seen.delete(key);
+        }
+        const existing = this.#seen.get(jti);
+        if (existing !== undefined && existing > now)
+            return false;
+        this.#seen.set(jti, expiresAt);
+        return true;
+    }
+}
+/**
+ * Verifies a DPoP proof sent to a resource server (RFC 9449 §4.3, §7): one
+ * `dpop+jwt` proof signed by the public key in its own header, matching the
+ * request method and URL, fresh, not replayed, bound to the access token
+ * (`ath`) and to the key the token is bound to (`cnf.jkt`).
+ */
+export async function verifyDpopProof(input) {
+    const raw = input.proof;
+    if (!raw || (Array.isArray(raw) ? raw.length !== 1 : raw.includes(',')))
+        return false;
+    const proof = Array.isArray(raw) ? raw[0] : raw;
+    let jwk;
+    try {
+        const header = decodeProtectedHeader(proof);
+        if (header.typ !== 'dpop+jwt' || !header.alg || !DPOP_ALGORITHMS.includes(header.alg)) {
+            return false;
+        }
+        jwk = header.jwk;
+    }
+    catch {
+        return false;
+    }
+    if (!jwk || typeof jwk !== 'object' || 'd' in jwk || jwk.kty === 'oct')
+        return false;
+    const nowMs = (input.now ?? Date.now)();
+    let payload;
+    try {
+        ({ payload } = await jwtVerify(proof, EmbeddedJWK, {
+            algorithms: DPOP_ALGORITHMS,
+            typ: 'dpop+jwt',
+            currentDate: new Date(nowMs),
+        }));
+    }
+    catch {
+        return false;
+    }
+    const { jti, htm, htu: proofHtu, iat, ath } = payload;
+    if (typeof jti !== 'string' || jti.length < 8 || jti.length > 256)
+        return false;
+    if (typeof htm !== 'string' || htm !== input.method.toUpperCase())
+        return false;
+    const expectedHtu = htu(input.url);
+    if (typeof proofHtu !== 'string' || !expectedHtu || htu(proofHtu) !== expectedHtu)
+        return false;
+    const nowS = Math.floor(nowMs / 1000);
+    if (typeof iat !== 'number' || iat > nowS + 5 || iat < nowS - input.maxAge)
+        return false;
+    const tokenHash = createHash('sha256').update(input.accessToken).digest('base64url');
+    if (ath !== tokenHash)
+        return false;
+    if ((await calculateJwkThumbprint(jwk, 'sha256')) !== input.expectedJkt)
+        return false;
+    return input.replay.remember(jti, (iat + input.maxAge + 5) * 1000, nowMs);
+}

package/build/src/resolvers/factory.d.ts

@@ -2,6 +2,11 @@ import type { SessionResolver } from '@adonis-agora/authkit-core';
 import { type OidcEndpoints } from '../discovery.js';
 import { type TokenSource } from '../token_source.js';
 export interface JwtResolverFactoryConfig {
+    /**
+     * `session` (default) validates the ID token of the OIDC session. `bearer` reads
+     * the `Authorization` header (API routes): `Bearer <jwt>`, or `DPoP <jwt>` with a
+     * `DPoP` proof for sender-constrained tokens (`cnf.jkt`).
+     */
     tokenSource?: TokenSource;
     /** Explicit jwks_uri. Default: the discovered `jwks_uri` (`${issuer}/jwks` with discovery off). */
     jwksUri?: string;

package/build/src/resolvers/factory.js

@@ -34,6 +34,7 @@ export const resolvers = {
                     audience: rc.clientId,
                     globalRolesClaim: rc.globalRolesClaim,
                     getToken: (httpCtx) => getTokenFromSource(httpCtx, tokenSource, rc.sessionKey),
+                    authorizationHeader: tokenSource === 'bearer',
                 });
             },
         };

package/build/src/resolvers/jwt_resolver.d.ts

@@ -14,8 +14,17 @@ export interface JwtResolverConfig {
     algorithms?: string[];
     /** de onde extrair o token cru no request; injetado pelo factory */
     getToken?: (ctx: HttpContext) => string | null;
+    /**
+     * Read the token from the `Authorization` header (API routes) instead of
+     * `getToken`. `Bearer <token>` and `DPoP <token>` (with its `DPoP` proof header)
+     * are accepted; a DPoP-bound token (`cnf.jkt`) sent as `Bearer` is refused.
+     */
+    authorizationHeader?: boolean;
+    /** Acceptance window of DPoP proofs, in seconds. Default: 300. */
+    dpopMaxAge?: number;
 }
 export declare class JwtResolver implements SessionResolver {
+    #private;
     private config;
     constructor(config: JwtResolverConfig);
     /** Valida um JWT cru e monta a Identity (ou null se inválido). */