@adonis-agora/authkit-client 0.20.5 → 1.0.0-rc.1

package/build/src/resolvers/dpop_proof.js

@@ -0,0 +1,92 @@
+import { createHash } from 'node:crypto';
+import { calculateJwkThumbprint, decodeProtectedHeader, EmbeddedJWK, jwtVerify, } from 'jose';
+/** Asymmetric algorithms accepted for DPoP proofs (RFC 9449 forbids symmetric ones). */
+export const DPOP_ALGORITHMS = ['ES256', 'ES384', 'ES512', 'EdDSA', 'PS256', 'RS256'];
+function htu(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return null;
+        url.hash = '';
+        url.search = '';
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+/** Bounded in-memory set of `jti`s seen within the proof window. */
+export class DpopReplayCache {
+    max;
+    #seen = new Map();
+    constructor(max = 10_000) {
+        this.max = max;
+    }
+    /** `true` the first time a `jti` is seen before `expiresAt` (ms). */
+    remember(jti, expiresAt, now) {
+        for (const [key, exp] of this.#seen) {
+            if (exp > now && this.#seen.size < this.max)
+                break;
+            this.#seen.delete(key);
+        }
+        const existing = this.#seen.get(jti);
+        if (existing !== undefined && existing > now)
+            return false;
+        this.#seen.set(jti, expiresAt);
+        return true;
+    }
+}
+/**
+ * Verifies a DPoP proof sent to a resource server (RFC 9449 §4.3, §7): one
+ * `dpop+jwt` proof signed by the public key in its own header, matching the
+ * request method and URL, fresh, not replayed, bound to the access token
+ * (`ath`) and to the key the token is bound to (`cnf.jkt`).
+ */
+export async function verifyDpopProof(input) {
+    const raw = input.proof;
+    if (!raw || (Array.isArray(raw) ? raw.length !== 1 : raw.includes(',')))
+        return false;
+    const proof = Array.isArray(raw) ? raw[0] : raw;
+    let jwk;
+    try {
+        const header = decodeProtectedHeader(proof);
+        if (header.typ !== 'dpop+jwt' || !header.alg || !DPOP_ALGORITHMS.includes(header.alg)) {
+            return false;
+        }
+        jwk = header.jwk;
+    }
+    catch {
+        return false;
+    }
+    if (!jwk || typeof jwk !== 'object' || 'd' in jwk || jwk.kty === 'oct')
+        return false;
+    const nowMs = (input.now ?? Date.now)();
+    let payload;
+    try {
+        ({ payload } = await jwtVerify(proof, EmbeddedJWK, {
+            algorithms: DPOP_ALGORITHMS,
+            typ: 'dpop+jwt',
+            currentDate: new Date(nowMs),
+        }));
+    }
+    catch {
+        return false;
+    }
+    const { jti, htm, htu: proofHtu, iat, ath } = payload;
+    if (typeof jti !== 'string' || jti.length < 8 || jti.length > 256)
+        return false;
+    if (typeof htm !== 'string' || htm !== input.method.toUpperCase())
+        return false;
+    const expectedHtu = htu(input.url);
+    if (typeof proofHtu !== 'string' || !expectedHtu || htu(proofHtu) !== expectedHtu)
+        return false;
+    const nowS = Math.floor(nowMs / 1000);
+    if (typeof iat !== 'number' || iat > nowS + 5 || iat < nowS - input.maxAge)
+        return false;
+    const tokenHash = createHash('sha256').update(input.accessToken).digest('base64url');
+    if (ath !== tokenHash)
+        return false;
+    if ((await calculateJwkThumbprint(jwk, 'sha256')) !== input.expectedJkt)
+        return false;
+    return input.replay.remember(jti, (iat + input.maxAge + 5) * 1000, nowMs);
+}

package/build/src/resolvers/factory.d.ts

@@ -2,6 +2,11 @@ import type { SessionResolver } from '@adonis-agora/authkit-core';
 import { type OidcEndpoints } from '../discovery.js';
 import { type TokenSource } from '../token_source.js';
 export interface JwtResolverFactoryConfig {
+    /**
+     * `session` (default) validates the ID token of the OIDC session. `bearer` reads
+     * the `Authorization` header (API routes): `Bearer <jwt>`, or `DPoP <jwt>` with a
+     * `DPoP` proof for sender-constrained tokens (`cnf.jkt`).
+     */
     tokenSource?: TokenSource;
     /** Explicit jwks_uri. Default: the discovered `jwks_uri` (`${issuer}/jwks` with discovery off). */
     jwksUri?: string;

package/build/src/resolvers/factory.js

@@ -34,6 +34,7 @@ export const resolvers = {
                     audience: rc.clientId,
                     globalRolesClaim: rc.globalRolesClaim,
                     getToken: (httpCtx) => getTokenFromSource(httpCtx, tokenSource, rc.sessionKey),
+                    authorizationHeader: tokenSource === 'bearer',
                 });
             },
         };

package/build/src/resolvers/jwt_resolver.d.ts

@@ -14,8 +14,17 @@ export interface JwtResolverConfig {
     algorithms?: string[];
     /** de onde extrair o token cru no request; injetado pelo factory */
     getToken?: (ctx: HttpContext) => string | null;
+    /**
+     * Read the token from the `Authorization` header (API routes) instead of
+     * `getToken`. `Bearer <token>` and `DPoP <token>` (with its `DPoP` proof header)
+     * are accepted; a DPoP-bound token (`cnf.jkt`) sent as `Bearer` is refused.
+     */
+    authorizationHeader?: boolean;
+    /** Acceptance window of DPoP proofs, in seconds. Default: 300. */
+    dpopMaxAge?: number;
 }
 export declare class JwtResolver implements SessionResolver {
+    #private;
     private config;
     constructor(config: JwtResolverConfig);
     /** Valida um JWT cru e monta a Identity (ou null se inválido). */

package/build/src/resolvers/jwt_resolver.js

@@ -1,13 +1,15 @@
 import { jwtVerify } from 'jose';
 import { DEFAULT_ALGS, getJwks } from '../jwks.js';
+import { DpopReplayCache, verifyDpopProof } from './dpop_proof.js';
 import { buildIdentityFromClaims } from './identity.js';
 export class JwtResolver {
     config;
+    #replay = new DpopReplayCache();
     constructor(config) {
         this.config = config;
     }
-    /** Valida um JWT cru e monta a Identity (ou null se inválido). */
-    async resolveToken(token) {
+    /** The verified claims of a raw JWT, or `null`. */
+    async #verify(token) {
         const endpoints = await this.config.endpoints();
         if (!endpoints)
             return null;
@@ -21,16 +23,58 @@ export class JwtResolver {
             // uma identidade válida exige um subject (`sub`)
             if (!payload.sub)
                 return null;
-            return buildIdentityFromClaims(payload, this.config.globalRolesClaim);
+            return payload;
         }
         catch {
             return null;
         }
     }
+    #identity(claims) {
+        return claims ? buildIdentityFromClaims(claims, this.config.globalRolesClaim) : null;
+    }
+    /** Valida um JWT cru e monta a Identity (ou null se inválido). */
+    async resolveToken(token) {
+        return this.#identity(await this.#verify(token));
+    }
     async resolve(ctx) {
+        if (this.config.authorizationHeader)
+            return this.#resolveAuthorization(ctx);
         const token = this.config.getToken?.(ctx) ?? null;
         if (!token)
             return null;
         return this.resolveToken(token);
     }
+    async #resolveAuthorization(ctx) {
+        const header = ctx.request.header('authorization');
+        if (!header)
+            return null;
+        const [scheme, token, ...rest] = header.trim().split(/\s+/);
+        if (!token || rest.length > 0)
+            return null;
+        const claims = await this.#verify(token);
+        if (!claims)
+            return null;
+        const jkt = claims.cnf?.jkt;
+        switch (scheme?.toLowerCase()) {
+            case 'bearer':
+                // RFC 9449 §7.1: a DPoP-bound token is not a bearer token.
+                return typeof jkt === 'string' ? null : this.#identity(claims);
+            case 'dpop': {
+                if (typeof jkt !== 'string')
+                    return null;
+                const valid = await verifyDpopProof({
+                    proof: ctx.request.header('dpop'),
+                    method: ctx.request.method(),
+                    url: ctx.request.completeUrl(false),
+                    accessToken: token,
+                    expectedJkt: jkt,
+                    maxAge: this.config.dpopMaxAge ?? 300,
+                    replay: this.#replay,
+                });
+                return valid ? this.#identity(claims) : null;
+            }
+            default:
+                return null;
+        }
+    }
 }

package/build/stubs/config/auth.stub

@@ -0,0 +1,30 @@
+{{{
+  exports({ to: app.configPath('auth.ts') })
+}}}
+import { defineConfig } from '@adonisjs/auth'
+import { sessionUserProvider } from '@adonisjs/auth/session'
+import type { InferAuthenticators } from '@adonisjs/auth/types'
+import { authkitClientGuard } from '@adonis-agora/authkit-client/auth'
+
+/**
+ * ctx.auth is backed by the AuthKit session. The guard takes the user from
+ * resolveUser in config/authkit_client.ts when you set one (e.g. lucidMirror,
+ * which creates the local row on first login), and falls back to this provider
+ * otherwise. The model's primary key must be the IdP's sub.
+ */
+const authConfig = defineConfig({
+  default: 'web',
+  guards: {
+    web: authkitClientGuard({
+      provider: sessionUserProvider({
+        model: () => import('{{ modelImport }}'),
+      }),
+    }),
+  },
+})
+
+export default authConfig
+
+declare module '@adonisjs/auth/types' {
+  export interface Authenticators extends InferAuthenticators<typeof authConfig> {}
+}

package/build/stubs/config/authkit_client.stub

@@ -10,7 +10,8 @@ const authkitClientConfig = defineConfig({
   clientSecret: env.get('AUTHKIT_CLIENT_SECRET'),
   redirectUri: env.get('AUTHKIT_REDIRECT_URI'),
   resolver: resolvers.jwt({ tokenSource: 'session' }),
-  // resolveUser: async (identity) => User.find(identity.userId),
+  // Creates/updates the local user on each login; ctx.auth.user is this user.
+  // resolveUser: lucidMirror(User, { sync: (identity) => ({ email: identity.email }) }),
   // Roles do app? Configure resolveRoles no @adonis-agora/authz (não aqui — o AuthKit só autentica).
 })
 

package/build/stubs/middleware/auth_middleware.stub

@@ -0,0 +1,25 @@
+{{{
+  exports({ to: app.middlewarePath('auth_middleware.ts') })
+}}}
+import type { HttpContext } from '@adonisjs/core/http'
+import type { NextFn } from '@adonisjs/core/types/http'
+import type { Authenticators } from '@adonisjs/auth/types'
+
+/**
+ * Denies access to unauthenticated requests and sends them to the AuthKit
+ * login route registered by registerOidcClient(router).
+ */
+export default class AuthMiddleware {
+  redirectTo = '/auth/login'
+
+  async handle(
+    ctx: HttpContext,
+    next: NextFn,
+    options: {
+      guards?: (keyof Authenticators)[]
+    } = {}
+  ) {
+    await ctx.auth.authenticateUsing(options.guards, { loginRoute: this.redirectTo })
+    return next()
+  }
+}

package/build/stubs/middleware/silent_auth_middleware.stub

@@ -0,0 +1,16 @@
+{{{
+  exports({ to: app.middlewarePath('silent_auth_middleware.ts') })
+}}}
+import type { HttpContext } from '@adonisjs/core/http'
+import type { NextFn } from '@adonisjs/core/types/http'
+
+/**
+ * Checks the AuthKit session without requiring one, so ctx.auth.user is set
+ * on routes that also serve guests.
+ */
+export default class SilentAuthMiddleware {
+  async handle(ctx: HttpContext, next: NextFn) {
+    await ctx.auth.check()
+    return next()
+  }
+}

package/build/types.d.ts

@@ -1,43 +1,16 @@
-import './container_bindings.js';
+import './src/host/request_authenticator.js';
 import type { AuthkitClientManager } from './providers/authkit_client_provider.js';
 import type { Authenticator } from './src/authenticator.js';
 /**
- * OPT-IN typing for `ctx.auth`.
+ * Types of `@adonis-agora/authkit-client`.
  *
- * Reference this module from your app when you want `ctx.auth` typed as
- * AuthKit's `Authenticator` and you are NOT declaring the property yourself:
+ * Importing this module brings the container bindings (`authkit.client`) and the
+ * `ctx.authkit` declaration into your program. `ctx.auth` belongs to
+ * `@adonisjs/auth`; use `authkitClientGuard` to back it with the AuthKit session.
  *
  * ```ts
  * // any file in your app, e.g. app/types.ts
  * import '@adonis-agora/authkit-client/types'
  * ```
- *
- * NOTHING in this package imports this module on your behalf, and that is the
- * point. `Authenticator` is generic (`Authenticator<TUser>`), and most apps
- * declare their own augmentation so `auth.getUser()` returns their user model:
- *
- * ```ts
- * declare module '@adonisjs/core/http' {
- *   interface HttpContext {
- *     auth: Authenticator<AppUser>
- *   }
- * }
- * ```
- *
- * Two declarations of the same property with different types do not merge —
- * they conflict, and because `skipLibCheck` is on in every AdonisJS app the
- * conflict is never reported: one simply wins by include order. When the
- * library's won, `auth.getUser()` collapsed to `unknown` across the whole app.
- * So the library ships the declaration and lets you decide whether to load it,
- * rather than forcing it through a middleware import.
- *
- * The container bindings come along with it (see `container_bindings.ts`); they
- * are also available on their own, which is what the provider and the middleware
- * use.
  */
-declare module '@adonisjs/core/http' {
-    interface HttpContext {
-        auth: Authenticator;
-    }
-}
 export type { Authenticator, AuthkitClientManager };

package/build/types.js

@@ -1 +1 @@
-import './container_bindings.js';
+import './src/host/request_authenticator.js';

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@adonis-agora/authkit-client",
-  "version": "0.20.5",
+  "version": "1.0.0-rc.1",
   "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
   "repository": {
     "type": "git",
-    "url": "https://github.com/DavideCarvalho/adonis-agora-authkit.git",
+    "url": "git+https://github.com/DavideCarvalho/adonis-agora-authkit.git",
     "directory": "packages/authkit-client"
   },
   "homepage": "https://davidecarvalho.github.io/agora/docs/authkit",
@@ -33,7 +33,8 @@
   "files": [
     "build",
     "stubs",
-    "skills"
+    "skills",
+    "CHANGELOG.md"
   ],
   "exports": {
     ".": "./build/index.js",
@@ -41,14 +42,11 @@
     "./container_bindings": "./build/container_bindings.js",
     "./services/main": "./build/services/main.js",
     "./authkit_client_provider": "./build/providers/authkit_client_provider.js",
-    "./auth": "./build/src/host/authkit_client_guard.js",
+    "./auth": "./build/auth.js",
     "./dashboard_guard": "./build/src/host/dashboard_guard.js",
-    "./authkit_middleware": "./build/src/middleware/authkit_middleware.js",
-    "./authkit_context_middleware": "./build/src/middleware/authkit_context_middleware.js",
+    "./authkit_context_middleware": "./build/authkit_context_middleware.js",
     "./backchannel_revocation_middleware": "./build/src/middleware/backchannel_revocation_middleware.js",
-    "./auth_middleware": "./build/src/middleware/auth_middleware.js",
     "./require_org_middleware": "./build/src/middleware/require_org_middleware.js",
-    "./silent_auth_middleware": "./build/src/middleware/silent_auth_middleware.js",
     "./commands": "./build/commands/configure.js"
   },
   "adonisjs": {
@@ -64,16 +62,13 @@
     "node": ">=24"
   },
   "peerDependencies": {
-    "@adonis-agora/resilience": ">=0.1.0 <1.0.0",
+    "@adonis-agora/resilience": ">=0.1.0 <2.0.0 || >=1.0.0-rc.0 <2.0.0",
     "@adonisjs/auth": "^10.1.0",
     "@adonisjs/core": "^7.5.0",
     "@adonisjs/lucid": "^22.4.2",
     "@adonisjs/session": "^8.1.0"
   },
   "peerDependenciesMeta": {
-    "@adonisjs/auth": {
-      "optional": true
-    },
     "@adonisjs/lucid": {
       "optional": true
     },
@@ -82,11 +77,11 @@
     }
   },
   "dependencies": {
-    "@adonis-agora/authkit-core": "0.10.1",
+    "@adonis-agora/authkit-core": "1.0.0-rc.0",
     "jose": "6.2.15"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-server": "0.90.1",
+    "@adonis-agora/authkit-server": "1.0.0-rc.1",
     "@adonis-agora/resilience": "0.4.3",
     "@adonisjs/auth": "10.1.0",
     "@adonisjs/core": "7.6.0",
@@ -95,9 +90,9 @@
     "@adonisjs/tsconfig": "2.0.0",
     "@japa/assert": "4.2.0",
     "@japa/runner": "5.4.0",
-    "@poppinss/ts-exec": "1.5.1",
+    "@poppinss/ts-exec": "1.5.2",
     "@tanstack/intent": "0.5.6",
-    "@types/node": "26.6.5",
+    "@types/node": "26.6.6",
     "ioredis-mock": "8.13.1",
     "tempura": "0.4.1",
     "testcontainers": "12.2.1",