@adonis-agora/authkit-client 0.9.0

package/build/src/user_resolvers.js

@@ -0,0 +1,42 @@
+/**
+ * Converte uma `Identity` (claims OIDC validadas) num objeto de usuário simples.
+ * Pode ser usada diretamente como `resolveUser: identityToUser`.
+ */
+export function identityToUser(identity) {
+    return {
+        id: identity.userId,
+        email: identity.email,
+        name: identity.profile?.name,
+        avatarUrl: identity.profile?.avatarUrl,
+        globalRoles: identity.globalRoles,
+    };
+}
+/**
+ * Fábrica de um `resolveUser` que busca o usuário no endpoint userinfo do IdP
+ * usando o access token. Caminho recomendado quando o app precisa de dados
+ * além do que o token carrega (topologia de bancos separados).
+ *
+ * Sem access token (ex.: tokenSource bearer só com ID token), faz fallback
+ * para `identityToUser(identity)`.
+ */
+export function createUserinfoResolver(options = {}) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const endpoint = options.userinfoEndpoint ??
+        (options.issuer ? `${options.issuer.replace(/\/$/, '')}/me` : undefined);
+    return async function resolveUser(identity, context = {}) {
+        const accessToken = context.accessToken;
+        if (!accessToken || !endpoint) {
+            return identityToUser(identity);
+        }
+        const res = await fetchImpl(endpoint, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${accessToken}`, accept: 'application/json' },
+        });
+        if (!res.ok) {
+            throw new Error(`userinfo falhou: HTTP ${res.status}`);
+        }
+        const claims = (await res.json());
+        // mescla identity (base) com o que veio do userinfo (sobrescreve)
+        return { ...identityToUser(identity), ...claims };
+    };
+}

package/build/src/verify_access_token.d.ts

@@ -0,0 +1,37 @@
+import { type JWTPayload } from 'jose';
+/**
+ * Verificação LOCAL de um JWT Access Token (RFC 9068) emitido pelo AuthKit server
+ * com `accessTokens: { format: 'jwt' }`. Valida a assinatura contra o JWKS remoto
+ * (cacheado) do IdP — SEM round-trip de introspecção — e impõe as regras do perfil
+ * RFC 9068: header `typ: at+jwt`, `iss`/`aud` esperados e claims obrigatórias.
+ *
+ * Barato e stateless: o `createRemoteJWKSet` busca o jwks_uri uma vez e cacheia as
+ * chaves (rotação é tolerada — o jose recarrega ao ver um `kid` novo). Útil para um
+ * resource server que recebe o AT no header Authorization e quer validar sem chamar
+ * o /introspect a cada request.
+ */
+export interface VerifyJwtAccessTokenOptions {
+    /** Issuer esperado (a claim `iss`). */
+    issuer: string;
+    /** jwks_uri do IdP (do discovery). */
+    jwksUri: string;
+    /** Audience esperada (a claim `aud`) — a URI/identificador desta API. */
+    audience: string | string[];
+    /** Algoritmos de assinatura aceitos (defesa contra alg-confusion). Default: asimétricos. */
+    algorithms?: string[];
+    /** Aceita JWS com qualquer `typ` (desliga a checagem RFC 9068 `at+jwt`). Default: false. */
+    allowAnyTyp?: boolean;
+}
+/** Claims de um JWT AT RFC 9068 validado. */
+export interface JwtAccessTokenClaims extends JWTPayload {
+    client_id?: string;
+    scope?: string;
+}
+/**
+ * Verifica um JWT AT (RFC 9068). Lança (via jose) se a assinatura/claims forem
+ * inválidas ou se o `typ` não for `at+jwt` (a menos que `allowAnyTyp`). Retorna as
+ * claims validadas no caminho feliz.
+ */
+export declare function verifyJwtAccessToken(token: string, options: VerifyJwtAccessTokenOptions): Promise<JwtAccessTokenClaims>;
+/** Limpa o cache de JWKS remotos (útil em testes). */
+export declare function clearJwksCache(): void;

package/build/src/verify_access_token.js

@@ -0,0 +1,43 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+const DEFAULT_ALGS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+];
+// Cache de keysets remotos por jwks_uri — evita refazer fetch/parse por request.
+const jwksCache = new Map();
+function getJwks(uri) {
+    let set = jwksCache.get(uri);
+    if (!set) {
+        set = createRemoteJWKSet(new URL(uri));
+        jwksCache.set(uri, set);
+    }
+    return set;
+}
+/**
+ * Verifica um JWT AT (RFC 9068). Lança (via jose) se a assinatura/claims forem
+ * inválidas ou se o `typ` não for `at+jwt` (a menos que `allowAnyTyp`). Retorna as
+ * claims validadas no caminho feliz.
+ */
+export async function verifyJwtAccessToken(token, options) {
+    const jwks = getJwks(options.jwksUri);
+    const { payload } = await jwtVerify(token, jwks, {
+        issuer: options.issuer,
+        audience: options.audience,
+        algorithms: options.algorithms ?? DEFAULT_ALGS,
+        // RFC 9068 §2.1: o header DEVE ser `typ: "at+jwt"`. jose valida quando passamos `typ`.
+        ...(options.allowAnyTyp ? {} : { typ: 'at+jwt' }),
+    });
+    return payload;
+}
+/** Limpa o cache de JWKS remotos (útil em testes). */
+export function clearJwksCache() {
+    jwksCache.clear();
+}

package/build/stubs/config/authkit_client.stub

@@ -0,0 +1,17 @@
+{{{
+  exports({ to: app.configPath('authkit_client.ts') })
+}}}
+import env from '#start/env'
+import { defineConfig, resolvers } from '@adonis-agora/authkit-client'
+
+const authkitClientConfig = defineConfig({
+  issuer: env.get('AUTHKIT_ISSUER'),
+  clientId: env.get('AUTHKIT_CLIENT_ID'),
+  clientSecret: env.get('AUTHKIT_CLIENT_SECRET'),
+  redirectUri: env.get('AUTHKIT_REDIRECT_URI'),
+  resolver: resolvers.jwt({ tokenSource: 'session' }),
+  // resolveUser: async (identity) => User.find(identity.userId),
+  // resolveAppRoles: async (identity) => RoleService.appRolesFor(identity.userId),
+})
+
+export default authkitClientConfig

package/build/stubs/controllers/oidc_session_controller.stub

@@ -0,0 +1,42 @@
+{{{
+  exports({ to: app.makePath('app/controllers/oidc_session_controller.ts') })
+}}}
+import type { HttpContext } from '@adonisjs/core/http'
+import { buildAuthorizeUrl, exchangeCode, generatePkce } from '@adonis-agora/authkit-client'
+import { randomUUID } from 'node:crypto'
+
+export default class OidcSessionController {
+  async login(ctx: HttpContext) {
+    const manager = await ctx.containerResolver.make('authkit.client')
+    const cfg = manager.clientConfig
+    const { verifier, challenge } = await generatePkce()
+    const state = randomUUID()
+    ctx.session.put('authkit_pkce', { verifier, state })
+    const url = buildAuthorizeUrl({
+      issuer: cfg.issuer, clientId: cfg.clientId, redirectUri: cfg.redirectUri,
+      scopes: cfg.scopes, state, codeChallenge: challenge,
+    })
+    return ctx.response.redirect(url)
+  }
+
+  async callback(ctx: HttpContext) {
+    const manager = await ctx.containerResolver.make('authkit.client')
+    const cfg = manager.clientConfig
+    const { code, state } = ctx.request.qs()
+    const pkce = ctx.session.get('authkit_pkce')
+    if (!pkce || pkce.state !== state) return ctx.response.badRequest({ error: 'state inválido' })
+    const tokenSet = await exchangeCode({
+      issuer: cfg.issuer, clientId: cfg.clientId, clientSecret: cfg.clientSecret,
+      redirectUri: cfg.redirectUri, code, codeVerifier: pkce.verifier,
+    })
+    ctx.session.put(cfg.sessionKey, tokenSet)
+    ctx.session.forget('authkit_pkce')
+    return ctx.response.redirect('/')
+  }
+
+  async logout(ctx: HttpContext) {
+    const manager = await ctx.containerResolver.make('authkit.client')
+    ctx.session.forget(manager.clientConfig.sessionKey)
+    return ctx.response.redirect('/')
+  }
+}

package/build/stubs/main.d.ts

@@ -0,0 +1 @@
+export declare const stubsRoot: string;

package/build/stubs/main.js

@@ -0,0 +1,2 @@
+import { fileURLToPath } from 'node:url';
+export const stubsRoot = fileURLToPath(new URL('./', import.meta.url));

package/build/types.d.ts

@@ -0,0 +1,13 @@
+import type { Authenticator } from './src/authenticator.js';
+import type { AuthkitClientManager } from './providers/authkit_client_provider.js';
+declare module '@adonisjs/core/http' {
+    interface HttpContext {
+        auth: Authenticator;
+    }
+}
+declare module '@adonisjs/core/types' {
+    interface ContainerBindings {
+        'authkit.client': AuthkitClientManager;
+    }
+}
+export type { Authenticator, AuthkitClientManager };

package/build/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "@adonis-agora/authkit-client",
+  "version": "0.9.0",
+  "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
+  "license": "MIT",
+  "author": "dudousxd",
+  "homepage": "https://github.com/DavideCarvalho/adonis-authkit/tree/main/packages/authkit-client#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/DavideCarvalho/adonis-authkit.git",
+    "directory": "packages/authkit-client"
+  },
+  "bugs": {
+    "url": "https://github.com/DavideCarvalho/adonis-authkit/issues"
+  },
+  "keywords": [
+    "adonisjs",
+    "oidc",
+    "oauth2",
+    "openid-connect",
+    "authentication",
+    "authkit",
+    "relying-party",
+    "jwt"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./build/index.js",
+  "types": "./build/index.d.ts",
+  "files": [
+    "build",
+    "stubs"
+  ],
+  "exports": {
+    ".": "./build/index.js",
+    "./types": "./build/index.js",
+    "./authkit_client_provider": "./build/providers/authkit_client_provider.js",
+    "./authkit_middleware": "./build/src/middleware/authkit_middleware.js",
+    "./backchannel_revocation_middleware": "./build/src/middleware/backchannel_revocation_middleware.js",
+    "./auth_middleware": "./build/src/middleware/auth_middleware.js",
+    "./silent_auth_middleware": "./build/src/middleware/silent_auth_middleware.js",
+    "./commands": "./build/commands/configure.js"
+  },
+  "adonisjs": {
+    "types": "@adonis-agora/authkit-client",
+    "providers": [
+      "@adonis-agora/authkit-client/authkit_client_provider"
+    ],
+    "commands": [
+      "@adonis-agora/authkit-client/commands"
+    ]
+  },
+  "peerDependencies": {
+    "@adonisjs/core": "7.3.3",
+    "@adonisjs/session": "8.1.0",
+    "@adonisjs/lucid": "22.4.2",
+    "@adonis-agora/resilience": "^0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@adonisjs/lucid": {
+      "optional": true
+    },
+    "@adonis-agora/resilience": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "jose": "^5.9.0",
+    "@adonis-agora/authkit-core": "0.7.0"
+  },
+  "devDependencies": {
+    "@adonisjs/core": "7.3.3",
+    "@adonis-agora/resilience": "^0.1.0",
+    "@adonisjs/session": "8.1.0",
+    "@adonisjs/lucid": "22.4.2",
+    "@adonisjs/tsconfig": "2.0.0",
+    "@japa/assert": "4.2.0",
+    "@japa/runner": "5.3.0",
+    "@poppinss/ts-exec": "1.4.4",
+    "ioredis-mock": "^8.9.0",
+    "@types/node": "25.9.1",
+    "typescript": "6.0.3",
+    "@adonis-agora/authkit-server": "0.34.0"
+  },
+  "scripts": {
+    "build": "tsc && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\"",
+    "typecheck": "tsc --noEmit",
+    "test": "node --import=@poppinss/ts-exec bin/test.ts"
+  }
+}

package/stubs/config/authkit_client.stub

@@ -0,0 +1,17 @@
+{{{
+  exports({ to: app.configPath('authkit_client.ts') })
+}}}
+import env from '#start/env'
+import { defineConfig, resolvers } from '@adonis-agora/authkit-client'
+
+const authkitClientConfig = defineConfig({
+  issuer: env.get('AUTHKIT_ISSUER'),
+  clientId: env.get('AUTHKIT_CLIENT_ID'),
+  clientSecret: env.get('AUTHKIT_CLIENT_SECRET'),
+  redirectUri: env.get('AUTHKIT_REDIRECT_URI'),
+  resolver: resolvers.jwt({ tokenSource: 'session' }),
+  // resolveUser: async (identity) => User.find(identity.userId),
+  // resolveAppRoles: async (identity) => RoleService.appRolesFor(identity.userId),
+})
+
+export default authkitClientConfig

package/stubs/controllers/oidc_session_controller.stub

@@ -0,0 +1,42 @@
+{{{
+  exports({ to: app.makePath('app/controllers/oidc_session_controller.ts') })
+}}}
+import type { HttpContext } from '@adonisjs/core/http'
+import { buildAuthorizeUrl, exchangeCode, generatePkce } from '@adonis-agora/authkit-client'
+import { randomUUID } from 'node:crypto'
+
+export default class OidcSessionController {
+  async login(ctx: HttpContext) {
+    const manager = await ctx.containerResolver.make('authkit.client')
+    const cfg = manager.clientConfig
+    const { verifier, challenge } = await generatePkce()
+    const state = randomUUID()
+    ctx.session.put('authkit_pkce', { verifier, state })
+    const url = buildAuthorizeUrl({
+      issuer: cfg.issuer, clientId: cfg.clientId, redirectUri: cfg.redirectUri,
+      scopes: cfg.scopes, state, codeChallenge: challenge,
+    })
+    return ctx.response.redirect(url)
+  }
+
+  async callback(ctx: HttpContext) {
+    const manager = await ctx.containerResolver.make('authkit.client')
+    const cfg = manager.clientConfig
+    const { code, state } = ctx.request.qs()
+    const pkce = ctx.session.get('authkit_pkce')
+    if (!pkce || pkce.state !== state) return ctx.response.badRequest({ error: 'state inválido' })
+    const tokenSet = await exchangeCode({
+      issuer: cfg.issuer, clientId: cfg.clientId, clientSecret: cfg.clientSecret,
+      redirectUri: cfg.redirectUri, code, codeVerifier: pkce.verifier,
+    })
+    ctx.session.put(cfg.sessionKey, tokenSet)
+    ctx.session.forget('authkit_pkce')
+    return ctx.response.redirect('/')
+  }
+
+  async logout(ctx: HttpContext) {
+    const manager = await ctx.containerResolver.make('authkit.client')
+    ctx.session.forget(manager.clientConfig.sessionKey)
+    return ctx.response.redirect('/')
+  }
+}

package/stubs/main.ts

@@ -0,0 +1,2 @@
+import { fileURLToPath } from 'node:url'
+export const stubsRoot = fileURLToPath(new URL('./', import.meta.url))