@adonis-agora/authkit-client 1.0.0-rc.5 → 1.0.0-rc.6

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @adonis-agora/authkit-client
 
+## 1.0.0-rc.6
+
+### Minor Changes
+
+- [#474](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/474) [`df9e49d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/df9e49d7817c03a7cce4cac1df709c7788d6307c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - AuthKit's tables can live in their own database schema: `schema: { name: 'auth' }` in `defineConfig` puts every table AuthKit owns in `auth` (`"auth"."auth_settings"`) while the app stays in `public`. The schema is written into every statement, so it works on any connection and inside the app's own transaction, with no `searchPath` (which leaks across clients behind PgBouncer in transaction mode).
+  
+  - The boot creates the schema (`CREATE SCHEMA IF NOT EXISTS`; MySQL: `CREATE DATABASE IF NOT EXISTS`) when `autoManage` is on, and fails with a message naming the schema and the grant when the role cannot create it. `ensureAuthkitSchema(db, { schema })` does the same from a migration.
+  - Covers the OIDC adapter table (`adapters.database({ schema })` overrides), the Lucid keystore (`jwks.store: { driver: 'lucid', schema }` overrides), the account store's tables (MFA, password history, organizations), runtime settings, session revocations, the personal-agent tables and agent extensions (`PersonalAgentHost.table(name)`, `AuthkitTable.create(table, { table })`, `ensureAuthkitTables(db, tables, { schema })`; Poppy uses them and `ensurePoppySchema(db, { schema })`).
+  - authkit-client: `lucidRevocationStore({ schema })`.
+  - SQLite with `schema.name` fails the boot instead of ignoring the option.
+  - `agora:doctor` gains `authkit.db-schema`: the schema exists, the tables are in it, the connection can write there. Silent without `schema.name`.
+  - The key-rotation lock key includes the schema, so two installs in two schemas of one database do not share it.
+  
+  Without `schema.name` nothing changes.
+
+### Patch Changes
+
+- Updated dependencies [[`df9e49d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/df9e49d7817c03a7cce4cac1df709c7788d6307c)]:
+  - @adonis-agora/authkit-core@1.0.0-rc.2
+
 ## 1.0.0-rc.5
 
 ### Minor Changes

package/build/src/revocation/revocation_store.d.ts

@@ -37,11 +37,17 @@ export interface RevocationStore {
 }
 export interface LucidRevocationStoreOptions {
     /**
-     * Conexão Lucid a usar. Default: conexão primária. Aponte para uma conexão cujo
-     * `searchPath` enxergue o schema onde a tabela vive (ex.: `auth`). A tabela é
-     * compartilhável entre apps que apontam para o MESMO banco.
+     * Conexão Lucid a usar. Default: conexão primária. A tabela é compartilhável entre
+     * apps que apontam para o MESMO banco.
      */
     connection?: string;
+    /**
+     * Schema do banco onde a tabela vive (MySQL: o database) — o `schema.name` do
+     * authkit-server, ex.: `'auth'`. Escrito em cada statement (`"auth"."auth_session_revocations"`).
+     * Não use `searchPath` na conexão para isso: atrás de um PgBouncer em modo
+     * transaction, o `SET search_path` vaza para as conexões de outros clientes.
+     */
+    schema?: string;
     /** Nome da tabela. Default: `auth_session_revocations` (criada pelo schema auto-manage do server). */
     table?: string;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-client",
-  "version": "1.0.0-rc.5",
+  "version": "1.0.0-rc.6",
   "description": "AdonisJS OIDC/OAuth2 relying-party (client) toolkit: session-based authentication against an OpenID Connect identity provider, with JWT/PAT user resolvers and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -77,11 +77,11 @@
     }
   },
   "dependencies": {
-    "@adonis-agora/authkit-core": "1.0.0-rc.1",
+    "@adonis-agora/authkit-core": "1.0.0-rc.2",
     "jose": "6.2.16"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-server": "1.0.0-rc.10",
+    "@adonis-agora/authkit-server": "1.0.0-rc.12",
     "@adonis-agora/resilience": "0.4.3",
     "@adonisjs/auth": "10.1.0",
     "@adonisjs/core": "7.6.0",

package/skills/authkit-rp-client/SKILL.md

@@ -193,13 +193,15 @@ defineConfig({
   clientId: env.get('AUTHKIT_CLIENT_ID'),
   redirectUri: env.get('AUTHKIT_REDIRECT_URI'),
   resolver: resolvers.jwt(),
-  backchannelLogout: { store: lucidRevocationStore() },
+  backchannelLogout: { store: lucidRevocationStore() }, // with IdP schema.name: lucidRevocationStore({ schema: 'auth' })
 })
 ```
 
 Then apply `BackchannelRevocationMiddleware` (from
 `@adonis-agora/authkit-client/backchannel_revocation_middleware`) so revoked
-sessions are rejected per request. Custom needs: `onBackchannelLogout` receives the
+sessions are rejected per request. `lucidRevocationStore` accepts
+`{ connection?, schema?, table? }`; when the IdP uses `schema.name`, pass the same
+`schema` here so both sides use `"auth"."auth_session_revocations"`. Custom needs: `onBackchannelLogout` receives the
 validated `{ sid, sub }` (store runs first, then the hook).
 
 Source: `src/define_config.ts` (`BackchannelLogoutInput`), README.