@adonis-agora/authkit-client 1.0.0-rc.4 → 1.0.0-rc.6

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @adonis-agora/authkit-client
 
+## 1.0.0-rc.6
+
+### Minor Changes
+
+- [#474](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/474) [`df9e49d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/df9e49d7817c03a7cce4cac1df709c7788d6307c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - AuthKit's tables can live in their own database schema: `schema: { name: 'auth' }` in `defineConfig` puts every table AuthKit owns in `auth` (`"auth"."auth_settings"`) while the app stays in `public`. The schema is written into every statement, so it works on any connection and inside the app's own transaction, with no `searchPath` (which leaks across clients behind PgBouncer in transaction mode).
+  
+  - The boot creates the schema (`CREATE SCHEMA IF NOT EXISTS`; MySQL: `CREATE DATABASE IF NOT EXISTS`) when `autoManage` is on, and fails with a message naming the schema and the grant when the role cannot create it. `ensureAuthkitSchema(db, { schema })` does the same from a migration.
+  - Covers the OIDC adapter table (`adapters.database({ schema })` overrides), the Lucid keystore (`jwks.store: { driver: 'lucid', schema }` overrides), the account store's tables (MFA, password history, organizations), runtime settings, session revocations, the personal-agent tables and agent extensions (`PersonalAgentHost.table(name)`, `AuthkitTable.create(table, { table })`, `ensureAuthkitTables(db, tables, { schema })`; Poppy uses them and `ensurePoppySchema(db, { schema })`).
+  - authkit-client: `lucidRevocationStore({ schema })`.
+  - SQLite with `schema.name` fails the boot instead of ignoring the option.
+  - `agora:doctor` gains `authkit.db-schema`: the schema exists, the tables are in it, the connection can write there. Silent without `schema.name`.
+  - The key-rotation lock key includes the schema, so two installs in two schemas of one database do not share it.
+  
+  Without `schema.name` nothing changes.
+
+### Patch Changes
+
+- Updated dependencies [[`df9e49d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/df9e49d7817c03a7cce4cac1df709c7788d6307c)]:
+  - @adonis-agora/authkit-core@1.0.0-rc.2
+
+## 1.0.0-rc.5
+
+### Minor Changes
+
+- [#471](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/471) [`66ccc36`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/66ccc365dbbd7d9d5bf22dba7aad196aff9f5d4b) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Account console extensions from another app. An app that signs in through an authkit IdP can now add pages to the IdP's account console:
+  
+  - authkit-client binds the same `authkit.accountExtensions` registry, so packages register their pages the same way in both setups. With `accountConsole: { remote: true }` the app serves them at `/.well-known/agora-account-extensions` (mounted by `registerOidcClient`, or `registerAccountExtensionsEndpoint(router)`), only to requests the IdP signed for its client id with the scope `authkit:account-extensions`. `accountConsole.subject` maps the IdP account to the app's user.
+  - authkit-server: `accountConsole.remote: [{ clientId, url }]` lists those apps; their pages show in the console next to the in-process ones, with the same sign-in, sudo, confirmation, rate limit and audit rules.
+  - The contract types and validation now live in authkit-core (still exported from `@adonis-agora/authkit-server/account-extension`).
+
+### Patch Changes
+
+- Updated dependencies [[`66ccc36`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/66ccc365dbbd7d9d5bf22dba7aad196aff9f5d4b)]:
+  - @adonis-agora/authkit-core@1.0.0-rc.1
+
 ## 1.0.0-rc.4
 
 ### Minor Changes

package/build/index.d.ts

@@ -2,12 +2,14 @@ export type { Identity } from '@adonis-agora/authkit-core';
 export { configure } from './commands/configure.js';
 export type { AuthkitClientLogger, AuthkitClientManagerDeps, } from './providers/authkit_client_provider.js';
 export { AuthkitClientManager } from './providers/authkit_client_provider.js';
+export type { AccountExtensionsAnswer, AccountExtensionsVerifier, ServeAccountExtensionsInput, } from './src/account_extensions.js';
+export { ACCOUNT_EXTENSIONS_BINDING, ClientAccountExtensionRegistry, serveAccountExtensions, verifyAccountExtensionsToken, } from './src/account_extensions.js';
 export { Authenticator } from './src/authenticator.js';
 export type { AuthorizationRequest, CompleteAuthorizationParams, CompletedAuthorization, CreateAuthorizationRequestParams, OidcCallbackErrorCode, PendingAuthorization, } from './src/authorization.js';
 export { completeAuthorization, createAuthorizationRequest, OidcCallbackError, } from './src/authorization.js';
 export type { SessionIndex, SessionIndexEntry, ValidatedLogoutToken, ValidateLogoutTokenOptions, } from './src/backchannel_logout.js';
 export { BACKCHANNEL_LOGOUT_EVENT, InMemorySessionIndex, InvalidLogoutTokenError, validateLogoutToken, } from './src/backchannel_logout.js';
-export type { BackchannelLogoutCallback, BackchannelLogoutInput, ClientConfigInput, ResolvedClientConfig, } from './src/define_config.js';
+export type { BackchannelLogoutCallback, BackchannelLogoutInput, ClientAccountConsoleConfig, ClientConfigInput, ResolvedClientConfig, } from './src/define_config.js';
 export { defineConfig, resolvers } from './src/define_config.js';
 export type { DiscoverOptions, OidcEndpoints } from './src/discovery.js';
 export { conventionEndpoints, discoverEndpoints, OidcDiscoveryError } from './src/discovery.js';
@@ -34,7 +36,7 @@ export type { ClientTenancyOptions, ContextTenant, ContextTenantLink, TenantInpu
 export type { AuthorizeParams, EndSessionParams, ExchangeParams, RefreshParams, } from './src/oidc_login.js';
 export { buildAuthorizeUrl, buildEndSessionUrl, exchangeCode, exchangeToken, generatePkce, refreshTokens, } from './src/oidc_login.js';
 export type { PostLoginRedirects, RegisterOidcClientOptions, } from './src/register_oidc_client.js';
-export { registerOidcClient } from './src/register_oidc_client.js';
+export { registerAccountExtensionsEndpoint, registerOidcClient, } from './src/register_oidc_client.js';
 export type { LucidRevocationStoreOptions, RevocationStore, } from './src/revocation/revocation_store.js';
 export { DEFAULT_REVOCATION_TABLE, lucidRevocationStore, } from './src/revocation/revocation_store.js';
 export { AuthkitTenantToken, type AuthkitTenantTokenFn, type AuthkitTenantTokenOptions, authkitTenantToken, TenantTokenError, } from './src/tenant_token.js';

package/build/index.js

@@ -1,5 +1,6 @@
 export { configure } from './commands/configure.js';
 export { AuthkitClientManager } from './providers/authkit_client_provider.js';
+export { ACCOUNT_EXTENSIONS_BINDING, ClientAccountExtensionRegistry, serveAccountExtensions, verifyAccountExtensionsToken, } from './src/account_extensions.js';
 export { Authenticator } from './src/authenticator.js';
 export { completeAuthorization, createAuthorizationRequest, OidcCallbackError, } from './src/authorization.js';
 export { BACKCHANNEL_LOGOUT_EVENT, InMemorySessionIndex, InvalidLogoutTokenError, validateLogoutToken, } from './src/backchannel_logout.js';
@@ -17,7 +18,7 @@ export { default as AuthkitContextMiddleware } from './src/middleware/authkit_co
 export { default as BackchannelRevocationMiddleware } from './src/middleware/backchannel_revocation_middleware.js';
 export { default as RequireOrgMiddleware } from './src/middleware/require_org_middleware.js';
 export { buildAuthorizeUrl, buildEndSessionUrl, exchangeCode, exchangeToken, generatePkce, refreshTokens, } from './src/oidc_login.js';
-export { registerOidcClient } from './src/register_oidc_client.js';
+export { registerAccountExtensionsEndpoint, registerOidcClient, } from './src/register_oidc_client.js';
 export { DEFAULT_REVOCATION_TABLE, lucidRevocationStore, } from './src/revocation/revocation_store.js';
 export { AuthkitTenantToken, authkitTenantToken, TenantTokenError, } from './src/tenant_token.js';
 export { createUserinfoResolver, identityToUser, } from './src/user_resolvers.js';

package/build/providers/authkit_client_provider.d.ts

@@ -97,6 +97,12 @@ export declare class AuthkitClientManager {
      * Sempre seta `Cache-Control: no-store` (exigência do spec).
      */
     handleBackchannelLogout(ctx: HttpContext): Promise<unknown>;
+    /**
+     * Answers the IdP's account console (`GET`/`POST /.well-known/agora-account-extensions`): the
+     * manifest of this app's account extensions, or one call to them. 404 unless
+     * `accountConsole.remote` is on. Mounted by {@link registerOidcClient}.
+     */
+    handleAccountExtensions(ctx: HttpContext): Promise<unknown>;
     /**
      * Impersona `requestedSubject` via token-exchange (RFC 8693): guarda o token set
      * atual e o substitui pelo do alvo. Encapsula o malabarismo de session keys que o

package/build/providers/authkit_client_provider.js

@@ -5,6 +5,7 @@ import { randomUUID } from 'node:crypto';
 import { configProvider } from '@adonisjs/core';
 import { RuntimeException } from '@adonisjs/core/exceptions';
 import { decodeJwt } from 'jose';
+import { ACCOUNT_EXTENSIONS_BINDING, ClientAccountExtensionRegistry, serveAccountExtensions, } from '../src/account_extensions.js';
 import { Authenticator } from '../src/authenticator.js';
 import { assertCallbackBelongs, completeAuthorization, createAuthorizationRequest, } from '../src/authorization.js';
 import { validateLogoutToken } from '../src/backchannel_logout.js';
@@ -323,6 +324,44 @@ export class AuthkitClientManager {
         });
         return {};
     }
+    /**
+     * Answers the IdP's account console (`GET`/`POST /.well-known/agora-account-extensions`): the
+     * manifest of this app's account extensions, or one call to them. 404 unless
+     * `accountConsole.remote` is on. Mounted by {@link registerOidcClient}.
+     */
+    async handleAccountExtensions(ctx) {
+        const { request, response } = ctx;
+        response.header('Cache-Control', 'no-store');
+        const settings = this.config.accountConsole;
+        if (!settings?.remote)
+            return response.status(404).send({ error: { code: 'not_found' } });
+        let idp;
+        try {
+            idp = await this.#idp();
+        }
+        catch (error) {
+            this.#logger.warn({ err: error, issuer: this.config.issuer }, 'authkit-client: account extensions called while discovery is failing');
+            return response.status(503).send({ error: { code: 'temporarily_unavailable' } });
+        }
+        const resolver = ctx.containerResolver;
+        const registry = (await resolver.make(ACCOUNT_EXTENSIONS_BINDING));
+        const method = request.method();
+        const raw = method === 'POST' ? request.raw() : null;
+        const answer = await serveAccountExtensions({
+            method,
+            authorization: request.header('authorization'),
+            rawBody: typeof raw === 'string' ? raw : null,
+            extensions: typeof registry.extensions === 'function' ? registry.extensions() : [],
+            contract: registry.contract,
+            verifier: { issuer: idp.endpoints.issuer, clientId: this.config.clientId, keys: idp.keys },
+            config: settings,
+            make: (binding) => resolver.make(binding),
+            log: (message) => this.#logger.warn({}, message),
+        });
+        for (const [name, value] of Object.entries(answer.headers ?? {}))
+            response.header(name, value);
+        return response.status(answer.status).send(answer.body);
+    }
     /** Chave de sessão onde o token set ORIGINAL fica guardado durante a impersonação. */
     get #impersonatorKey() {
         return `${this.config.sessionKey}_impersonator`;
@@ -511,6 +550,14 @@ export default class AuthkitClientProvider {
         // bound by class, would silently get the real one. Not cached here, so a `swap` of the class
         // also reaches the string key, even after its first use.
         this.app.container.bind('authkit.client', (resolver) => resolver.make(AuthkitClientManager));
+        // Account console extensions register here from their `boot()`, exactly as next to
+        // authkit-server. When authkit-server is in this app too, its registry is the one bound.
+        if (!this.app.container.hasBinding(ACCOUNT_EXTENSIONS_BINDING)) {
+            const registry = new ClientAccountExtensionRegistry({
+                production: () => this.app.inProduction === true,
+            });
+            this.app.container.singleton(ACCOUNT_EXTENSIONS_BINDING, async () => registry);
+        }
     }
 }
 /** `sub` of a stored id_token, or undefined when there is none / it is unreadable. */

package/build/src/account_extensions.d.ts

@@ -0,0 +1,49 @@
+import { type AccountExtension, BaseAccountExtensionRegistry } from '@adonis-agora/authkit-core';
+import { type JWTPayload, type JWTVerifyGetKey } from 'jose';
+import type { ClientAccountConsoleConfig } from './define_config.js';
+/** The container binding contributors register into (same name as authkit-server's). */
+export declare const ACCOUNT_EXTENSIONS_BINDING = "authkit.accountExtensions";
+/**
+ * The account extensions registry of an app whose IdP runs elsewhere. Contributors register
+ * exactly as they would next to authkit-server; this app then serves the pages to the IdP.
+ */
+export declare class ClientAccountExtensionRegistry extends BaseAccountExtensionRegistry {
+}
+/** What verifying a remote-extension token needs. */
+export interface AccountExtensionsVerifier {
+    issuer: string;
+    clientId: string;
+    keys: JWTVerifyGetKey;
+}
+/** A refusal: `status` plus the JSON body to send. */
+export interface AccountExtensionsAnswer {
+    status: number;
+    body: unknown;
+    headers?: Record<string, string>;
+}
+/** Verifies the IdP's token: signature, issuer, audience, `typ`, lifetime and scope. */
+export declare function verifyAccountExtensionsToken(authorization: string | undefined, verifier: AccountExtensionsVerifier): Promise<{
+    ok: true;
+    claims: JWTPayload;
+} | {
+    ok: false;
+    answer: AccountExtensionsAnswer;
+}>;
+export interface ServeAccountExtensionsInput {
+    method: string;
+    authorization: string | undefined;
+    /** The exact POST body (its hash is signed by the IdP). */
+    rawBody: string | null;
+    extensions: readonly AccountExtension[];
+    contract: number;
+    verifier: AccountExtensionsVerifier;
+    config: ClientAccountConsoleConfig;
+    make: (binding: string) => Promise<any>;
+    log?: (message: string) => void;
+}
+/**
+ * Answers the IdP: `GET` → the manifest, `POST` → one call (visible, load or action). Only a token
+ * the IdP signed for this app (audience = client id, scope `authkit:account-extensions`) gets in;
+ * a POST must also match the signed body hash and name the token's account.
+ */
+export declare function serveAccountExtensions(input: ServeAccountExtensionsInput): Promise<AccountExtensionsAnswer>;

package/build/src/account_extensions.js

@@ -0,0 +1,105 @@
+import { ACCOUNT_EXTENSIONS_MANIFEST_SUBJECT, ACCOUNT_EXTENSIONS_SCOPE, ACCOUNT_EXTENSIONS_TOKEN_MAX_TTL, ACCOUNT_EXTENSIONS_TOKEN_TYP, accountExtensionsBodyHash, BaseAccountExtensionRegistry, buildAccountExtensionsManifest, parseAccountExtensionCall, runAccountExtensionCall, } from '@adonis-agora/authkit-core';
+import { jwtVerify } from 'jose';
+import { DEFAULT_ALGS } from './jwks.js';
+/** The container binding contributors register into (same name as authkit-server's). */
+export const ACCOUNT_EXTENSIONS_BINDING = 'authkit.accountExtensions';
+/**
+ * The account extensions registry of an app whose IdP runs elsewhere. Contributors register
+ * exactly as they would next to authkit-server; this app then serves the pages to the IdP.
+ */
+export class ClientAccountExtensionRegistry extends BaseAccountExtensionRegistry {
+}
+const refuse = (status, code, message) => ({
+    status,
+    body: { error: { code, message } },
+    ...(status === 401
+        ? {
+            headers: {
+                'WWW-Authenticate': `Bearer error="${code}", scope="${ACCOUNT_EXTENSIONS_SCOPE}"`,
+            },
+        }
+        : {}),
+});
+/** Verifies the IdP's token: signature, issuer, audience, `typ`, lifetime and scope. */
+export async function verifyAccountExtensionsToken(authorization, verifier) {
+    const match = /^Bearer\s+(\S+)$/i.exec(authorization ?? '');
+    if (!match?.[1]) {
+        return { ok: false, answer: refuse(401, 'invalid_token', 'A bearer token is required.') };
+    }
+    let claims;
+    try {
+        ({ payload: claims } = await jwtVerify(match[1], verifier.keys, {
+            issuer: verifier.issuer,
+            audience: verifier.clientId,
+            typ: ACCOUNT_EXTENSIONS_TOKEN_TYP,
+            algorithms: DEFAULT_ALGS,
+            maxTokenAge: ACCOUNT_EXTENSIONS_TOKEN_MAX_TTL,
+            requiredClaims: ['exp', 'iat', 'sub'],
+        }));
+    }
+    catch {
+        return { ok: false, answer: refuse(401, 'invalid_token', 'The token is not valid.') };
+    }
+    if (claims.exp - claims.iat > ACCOUNT_EXTENSIONS_TOKEN_MAX_TTL) {
+        return { ok: false, answer: refuse(401, 'invalid_token', 'The token lives too long.') };
+    }
+    const scopes = typeof claims.scope === 'string' ? claims.scope.split(' ') : [];
+    if (!scopes.includes(ACCOUNT_EXTENSIONS_SCOPE)) {
+        return {
+            ok: false,
+            answer: refuse(403, 'insufficient_scope', `The token lacks "${ACCOUNT_EXTENSIONS_SCOPE}".`),
+        };
+    }
+    return { ok: true, claims };
+}
+/**
+ * Answers the IdP: `GET` → the manifest, `POST` → one call (visible, load or action). Only a token
+ * the IdP signed for this app (audience = client id, scope `authkit:account-extensions`) gets in;
+ * a POST must also match the signed body hash and name the token's account.
+ */
+export async function serveAccountExtensions(input) {
+    const verified = await verifyAccountExtensionsToken(input.authorization, input.verifier);
+    if (!verified.ok)
+        return verified.answer;
+    const { claims } = verified;
+    if (input.method === 'GET') {
+        if (claims.sub !== ACCOUNT_EXTENSIONS_MANIFEST_SUBJECT) {
+            return refuse(403, 'invalid_token', 'This token is not for the manifest.');
+        }
+        return { status: 200, body: buildAccountExtensionsManifest(input.extensions, input.contract) };
+    }
+    if (input.method !== 'POST') {
+        return {
+            status: 405,
+            body: { error: { code: 'method_not_allowed', message: 'GET or POST.' } },
+        };
+    }
+    if (input.rawBody === null || claims.bh !== accountExtensionsBodyHash(input.rawBody)) {
+        return refuse(403, 'invalid_token', 'The token does not match the body.');
+    }
+    let raw;
+    try {
+        raw = JSON.parse(input.rawBody);
+    }
+    catch {
+        raw = null;
+    }
+    const call = parseAccountExtensionCall(raw);
+    if (!call) {
+        return { status: 400, body: { error: { code: 'invalid_request', message: 'Bad call.' } } };
+    }
+    if (call.account.id !== claims.sub) {
+        return refuse(403, 'invalid_token', 'The token is for another account.');
+    }
+    return runAccountExtensionCall(input.extensions, call, {
+        ...(input.config.subject ? { subject: input.config.subject } : {}),
+        make: input.make,
+        ...(input.config.loadTimeoutMs !== undefined
+            ? { loadTimeoutMs: input.config.loadTimeoutMs }
+            : {}),
+        ...(input.config.actionTimeoutMs !== undefined
+            ? { actionTimeoutMs: input.config.actionTimeoutMs }
+            : {}),
+        ...(input.log ? { log: input.log } : {}),
+    });
+}

package/build/src/define_config.d.ts

@@ -1,4 +1,4 @@
-import type { Identity } from '@adonis-agora/authkit-core';
+import type { Identity, RunAccountExtensionCallOptions } from '@adonis-agora/authkit-core';
 import type { SessionIndex } from './backchannel_logout.js';
 import type { OidcEndpoints } from './discovery.js';
 import type { ResiliencePolicy } from './http/resilient_fetch.js';
@@ -23,6 +23,24 @@ export interface BackchannelLogoutInput {
     /** Store que persiste/consulta revogações (ex.: `lucidRevocationStore({ connection: 'auth' })`). */
     store: RevocationStore;
 }
+/** `accountConsole` in `config/authkit_client.ts`: pages this app serves for the IdP's account console. */
+export interface ClientAccountConsoleConfig {
+    /**
+     * Serve this app's account console extensions to the IdP over
+     * `/.well-known/agora-account-extensions` (the IdP lists this app in its own
+     * `accountConsole.remote`). Default `false`.
+     */
+    remote?: boolean;
+    /**
+     * Maps the IdP account to this app's subject (what billing, media and agents key on). Every
+     * extension receives it as `ctx.subject`. Default `{ type: 'User', id: account.id }`.
+     */
+    subject?: RunAccountExtensionCallOptions['subject'];
+    /** Budget of one page's `load()` / `visible()`, in ms. Default 5000. */
+    loadTimeoutMs?: number;
+    /** Budget of one action's `handle()`, in ms. Default 15000. */
+    actionTimeoutMs?: number;
+}
 export interface ClientConfigInput {
     issuer: string;
     clientId: string;
@@ -83,6 +101,8 @@ export interface ClientConfigInput {
      * `resolve`. No effect without `@adonis-agora/context`.
      */
     tenancy?: ClientTenancyOptions;
+    /** Account console pages this app serves to the IdP. See {@link ClientAccountConsoleConfig}. */
+    accountConsole?: ClientAccountConsoleConfig;
 }
 export interface ResolvedClientConfig {
     issuer: string;
@@ -110,5 +130,7 @@ export interface ResolvedClientConfig {
     endpoints?: Partial<OidcEndpoints>;
     /** Tenancy options. See {@link ClientConfigInput.tenancy}. */
     tenancy?: ClientTenancyOptions;
+    /** See {@link ClientConfigInput.accountConsole}. */
+    accountConsole?: ClientAccountConsoleConfig;
 }
 export declare function defineConfig(config: ClientConfigInput): import("@adonisjs/core/types").ConfigProvider<ResolvedClientConfig>;

package/build/src/define_config.js

@@ -36,6 +36,7 @@ export function defineConfig(config) {
                     : {},
             endpoints: config.endpoints,
             tenancy: config.tenancy ?? {},
+            ...(config.accountConsole ? { accountConsole: config.accountConsole } : {}),
         };
     });
 }

package/build/src/register_oidc_client.d.ts

@@ -1,4 +1,4 @@
-import type { Identity } from '@adonis-agora/authkit-core';
+import { type Identity } from '@adonis-agora/authkit-core';
 import type { HttpContext, Router } from '@adonisjs/core/http';
 /**
  * Mapa role → rota de redirect pós-login. `byGlobalRole` checa as roles globais do
@@ -24,6 +24,11 @@ export interface RegisterOidcClientOptions {
     postLogoutRedirect?: string | ((ctx: HttpContext) => string);
     /** Registra também `POST {prefix}/backchannel-logout` (OIDC Back-Channel Logout). Default: true. */
     backchannelLogout?: boolean;
+    /**
+     * Registra também `GET`/`POST /.well-known/agora-account-extensions` (account console pages this
+     * app serves to the IdP; 404 until `accountConsole.remote` is on). Default: true.
+     */
+    accountExtensions?: boolean;
     /**
      * Middleware(s) aplicados à rota de login (ex.: `middleware.guest()`). Array no
      * formato aceito por `.use()` do AdonisJS.
@@ -47,3 +52,10 @@ export interface RegisterOidcClientOptions {
  * ```
  */
 export declare function registerOidcClient(router: Router, options?: RegisterOidcClientOptions): void;
+/**
+ * Mounts `GET`/`POST /.well-known/agora-account-extensions`, where the IdP's account console
+ * fetches this app's account extension pages (answers 404 until `accountConsole.remote` is on).
+ * {@link registerOidcClient} calls it; call it yourself when you mount the client routes by hand.
+ * The IdP POSTs without a CSRF token: add the path to shield's `csrf.exceptRoutes`.
+ */
+export declare function registerAccountExtensionsEndpoint(router: Router): void;

package/build/src/register_oidc_client.js

@@ -1,3 +1,4 @@
+import { ACCOUNT_EXTENSIONS_WELL_KNOWN } from '@adonis-agora/authkit-core';
 import { OidcCallbackError } from './authorization.js';
 import { buildEndSessionUrl } from './oidc_login.js';
 /**
@@ -114,6 +115,22 @@ export function registerOidcClient(router, options = {}) {
         })
             .as('auth.backchannel_logout');
     }
+    if (options.accountExtensions !== false)
+        registerAccountExtensionsEndpoint(router);
+}
+/**
+ * Mounts `GET`/`POST /.well-known/agora-account-extensions`, where the IdP's account console
+ * fetches this app's account extension pages (answers 404 until `accountConsole.remote` is on).
+ * {@link registerOidcClient} calls it; call it yourself when you mount the client routes by hand.
+ * The IdP POSTs without a CSRF token: add the path to shield's `csrf.exceptRoutes`.
+ */
+export function registerAccountExtensionsEndpoint(router) {
+    const handle = async (ctx) => {
+        const manager = await ctx.containerResolver.make('authkit.client');
+        return manager.handleAccountExtensions(ctx);
+    };
+    router.get(ACCOUNT_EXTENSIONS_WELL_KNOWN, handle).as('authkit.account_extensions');
+    router.post(ACCOUNT_EXTENSIONS_WELL_KNOWN, handle).as('authkit.account_extensions.call');
 }
 /** Resolve o destino pós-login a partir do mapa de redirects por role global (do token). */
 function resolveDestination(identity, redirects) {

package/build/src/revocation/revocation_store.d.ts

@@ -37,11 +37,17 @@ export interface RevocationStore {
 }
 export interface LucidRevocationStoreOptions {
     /**
-     * Conexão Lucid a usar. Default: conexão primária. Aponte para uma conexão cujo
-     * `searchPath` enxergue o schema onde a tabela vive (ex.: `auth`). A tabela é
-     * compartilhável entre apps que apontam para o MESMO banco.
+     * Conexão Lucid a usar. Default: conexão primária. A tabela é compartilhável entre
+     * apps que apontam para o MESMO banco.
      */
     connection?: string;
+    /**
+     * Schema do banco onde a tabela vive (MySQL: o database) — o `schema.name` do
+     * authkit-server, ex.: `'auth'`. Escrito em cada statement (`"auth"."auth_session_revocations"`).
+     * Não use `searchPath` na conexão para isso: atrás de um PgBouncer em modo
+     * transaction, o `SET search_path` vaza para as conexões de outros clientes.
+     */
+    schema?: string;
     /** Nome da tabela. Default: `auth_session_revocations` (criada pelo schema auto-manage do server). */
     table?: string;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-client",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0-rc.6",
   "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -77,11 +77,11 @@
     }
   },
   "dependencies": {
-    "@adonis-agora/authkit-core": "1.0.0-rc.0",
+    "@adonis-agora/authkit-core": "1.0.0-rc.2",
     "jose": "6.2.16"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-server": "1.0.0-rc.7",
+    "@adonis-agora/authkit-server": "1.0.0-rc.12",
     "@adonis-agora/resilience": "0.4.3",
     "@adonisjs/auth": "10.1.0",
     "@adonisjs/core": "7.6.0",

package/skills/authkit-rp-client/SKILL.md

@@ -193,13 +193,15 @@ defineConfig({
   clientId: env.get('AUTHKIT_CLIENT_ID'),
   redirectUri: env.get('AUTHKIT_REDIRECT_URI'),
   resolver: resolvers.jwt(),
-  backchannelLogout: { store: lucidRevocationStore() },
+  backchannelLogout: { store: lucidRevocationStore() }, // with IdP schema.name: lucidRevocationStore({ schema: 'auth' })
 })
 ```
 
 Then apply `BackchannelRevocationMiddleware` (from
 `@adonis-agora/authkit-client/backchannel_revocation_middleware`) so revoked
-sessions are rejected per request. Custom needs: `onBackchannelLogout` receives the
+sessions are rejected per request. `lucidRevocationStore` accepts
+`{ connection?, schema?, table? }`; when the IdP uses `schema.name`, pass the same
+`schema` here so both sides use `"auth"."auth_session_revocations"`. Custom needs: `onBackchannelLogout` receives the
 validated `{ sid, sub }` (store runs first, then the hook).
 
 Source: `src/define_config.ts` (`BackchannelLogoutInput`), README.