@adonis-agora/authkit-react 1.0.0-rc.1 → 1.0.0-rc.2

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @adonis-agora/authkit-react
 
+## 1.0.0-rc.2
+
+### Minor Changes
+
+- [#460](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/460) [`1858ee8`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/1858ee837bb4edcf0578f86d224693ac9a86a495) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Service tenants: a client can act as one partition of another service, such as a durable control plane.
+  
+  - `serviceTenants: { resources: { 'urn:agora:durable': { expiresIn: 600 } } }` in `config/authkit.ts` declares the resources (RFC 8707) that issue service-tenant tokens: JWT access tokens (RFC 9068) with `aud` = the resource and the client's `partition` and `capabilities` as claims.
+  - A service-tenant client is confidential, uses only `client_credentials` and has no redirect URIs. Create and edit it from the console (**Service tenant** kind), the Admin API and the SDKs (`serviceTenant: { partition, capabilities? }`), or `node ace authkit:clients:create --partition=acme --capability=reports`.
+  - Any client can now be disabled and enabled again (console, `POST /clients/:id/disable|enable`, SDK `clients.disable/enable`): the token endpoint answers `invalid_client` from the next request on.
+  - `authkitTenantVerifier()` (authkit-server) verifies those tokens against the local issuer and keys and returns `{ tenant, capabilities }`; `authkitTenantToken({ issuer, clientId, clientSecret, resource })` (authkit-client) fetches, caches and refreshes them on the tenant side. Both fit durable's `verifyTenant` and `tenant.token` as a function or a class, without depending on durable.
+  - New audit events: `client.disabled`, `client.enabled`, `service_tenant.token_issued`.
+  - Access-token verification (`oidcBearerGuard`, in-process and remote) now refuses a token whose `sub` is a client (a `client_credentials` token), so a service-tenant token never authenticates a user.
+
 ## 1.0.0-rc.1
 
 ### Major Changes

package/build/index.d.ts

@@ -4,7 +4,7 @@ export type { AuthkitClient, AuthkitClientOptions, } from './src/client/client.j
 export { AuthkitClientError, createAuthkitClient, } from './src/client/client.js';
 export type { AuthkitClientProviderProps } from './src/client/context.js';
 export { AuthkitClientProvider, createAuthkitQueryClient, useAuthkitClient, } from './src/client/context.js';
-export type { AcceptOrgInvitationResult, AccountAgentGrant, AccountAgentsResult, AccountAppEntry, AccountAppsResult, AccountCapabilities, AccountLoginMethodsResult, AccountMe, AccountMfaStatus, AccountOrgDetail, AccountOrgEntry, AccountOrgInvitationsResult, AccountOrgsResult, AccountPasskeysResult, AccountSecurityOverview, AccountSessionEntry, AccountSessionsResult, AccountTokensResult, ActivateOrgResult, AdminClient, AdminClientListResult, AdminGrantEntry, AdminOrgDetail, AdminOrgEntry, AdminOrgInvitation, AdminOrgListResult, AdminOrgMember, AdminOverview, AdminSessionEntry, AdminUser, AdminUserListResult, ApiErrorBody, AuditEventEntry, AuditListParams, AuditListResult, ChangePasswordInput, CreateAccountOrgInput, CreateClientInput, CreatedAccountOrgResult, CreatedClientResult, CreatedOrgInvitationResult, CreatedPatResult, CreateOrgInput, CreateRoleInput, CreateTokenInput, CreateUserInput, DailyPoint, DeactivateOrgResult, DeletedResult, EmailChangeResult, ImpersonationPanel, InviteOrgMemberInput, KeysRotateInput, KeysRotateResult, KeysStatus, LeaveOrgResult, ListMeta, ManagedKeyInfo, MfaConfirmResult, MfaDisableResult, MfaEnrollResult, MfaRecoveryCodesResult, OkResult, PasskeyRegistrationOptions, PasskeySummaryEntry, PatEntry, PersonalAgentConnection, PersonalAgentConnectionsParams, PersonalAgentConnectionsResult, PersonalAgentEntry, PersonalAgentExtensionOverview, PersonalAgentListStatus, PersonalAgentPactOverview, PersonalAgentProtocol, PersonalAgentRegistryInput, PersonalAgentRegistryResult, PersonalAgentsOverview, RegenerateSecretResult, RemoveOrgMemberResult, RemovePasskeyResult, RequestEmailChangeInput, ResetPasswordResult, RevokeAllResult, RevokeAppResult, RevokeOrgInvitationResult, RevokeOthersResult, RevokeSessionResult, RevokeSessionsResult, RevokeTokenResult, RoleCatalogEntry, RoleListResult, SettingEntry, SettingListResult, UpdateClientInput, UpdateLoginMethodsResult, UpdateOrgInput, UpdateOrgMemberRoleResult, UpdateProfileInput, UpdateProfileResult, UpdateRoleInput, UpdateUserInput, UserLoginMethodsInput, UserSessionsResult, } from './src/client/types.js';
+export type { AcceptOrgInvitationResult, AccountAgentGrant, AccountAgentsResult, AccountAppEntry, AccountAppsResult, AccountCapabilities, AccountLoginMethodsResult, AccountMe, AccountMfaStatus, AccountOrgDetail, AccountOrgEntry, AccountOrgInvitationsResult, AccountOrgsResult, AccountPasskeysResult, AccountSecurityOverview, AccountSessionEntry, AccountSessionsResult, AccountTokensResult, ActivateOrgResult, AdminClient, AdminClientListResult, AdminGrantEntry, AdminOrgDetail, AdminOrgEntry, AdminOrgInvitation, AdminOrgListResult, AdminOrgMember, AdminOverview, AdminSessionEntry, AdminUser, AdminUserListResult, ApiErrorBody, AuditEventEntry, AuditListParams, AuditListResult, ChangePasswordInput, CreateAccountOrgInput, CreateClientInput, CreatedAccountOrgResult, CreatedClientResult, CreatedOrgInvitationResult, CreatedPatResult, CreateOrgInput, CreateRoleInput, CreateTokenInput, CreateUserInput, DailyPoint, DeactivateOrgResult, DeletedResult, EmailChangeResult, ImpersonationPanel, InviteOrgMemberInput, KeysRotateInput, KeysRotateResult, KeysStatus, LeaveOrgResult, ListMeta, ManagedKeyInfo, MfaConfirmResult, MfaDisableResult, MfaEnrollResult, MfaRecoveryCodesResult, OkResult, PasskeyRegistrationOptions, PasskeySummaryEntry, PatEntry, PersonalAgentConnection, PersonalAgentConnectionsParams, PersonalAgentConnectionsResult, PersonalAgentEntry, PersonalAgentExtensionOverview, PersonalAgentListStatus, PersonalAgentPactOverview, PersonalAgentProtocol, PersonalAgentRegistryInput, PersonalAgentRegistryResult, PersonalAgentsOverview, RegenerateSecretResult, RemoveOrgMemberResult, RemovePasskeyResult, RequestEmailChangeInput, ResetPasswordResult, RevokeAllResult, RevokeAppResult, RevokeOrgInvitationResult, RevokeOthersResult, RevokeSessionResult, RevokeSessionsResult, RevokeTokenResult, RoleCatalogEntry, RoleListResult, ServiceTenantSettings, SettingEntry, SettingListResult, UpdateClientInput, UpdateLoginMethodsResult, UpdateOrgInput, UpdateOrgMemberRoleResult, UpdateProfileInput, UpdateProfileResult, UpdateRoleInput, UpdateUserInput, UserLoginMethodsInput, UserSessionsResult, } from './src/client/types.js';
 export type { AuthenticatedProps, GuestProps, } from './src/components/authenticated.js';
 export { Authenticated, Guest } from './src/components/authenticated.js';
 export type { AuthorizedAppsProps } from './src/components/authorized_apps.js';
@@ -75,7 +75,7 @@ export { runPasskeyAssertion, runPasskeyRegistration } from './src/passkey/sudo.
 export type { AuthProviderProps } from './src/provider.js';
 export { AuthContext, AuthProvider } from './src/provider.js';
 export { useAccountAcceptOrgInvitationMutationOptions, useAccountActivateOrgMutationOptions, useAccountAgentsQueryOptions, useAccountCreateOrgMutationOptions, useAccountDeactivateOrgMutationOptions, useAccountInviteOrgMemberMutationOptions, useAccountLeaveOrgMutationOptions, useAccountOrgInvitationsQueryOptions, useAccountOrgQueryOptions, useAccountOrgsQueryOptions, useAccountRemoveOrgMemberMutationOptions, useAccountRevokeAllSessionsMutationOptions, useAccountRevokeOrgInvitationMutationOptions, useAccountSessionsQueryOptions, useAccountUpdateOrgMemberRoleMutationOptions, useAppsQueryOptions, useCancelEmailChangeMutationOptions, useChangePasswordMutationOptions, useConfirmTotpMutationOptions, useCreateTokenMutationOptions, useDisableTotpMutationOptions, useEmailChangeMutationOptions, useEnrollTotpMutationOptions, useLoginMethodsQueryOptions, useMeQueryOptions, useMfaQueryOptions, usePasskeysQueryOptions, useRegenerateRecoveryCodesMutationOptions, useRegisterPasskeyMutationOptions, useRemovePasskeyMutationOptions, useRevokeAccountAgentMutationOptions, useRevokeAppMutationOptions, useRevokeOtherSessionsMutationOptions, useRevokeSessionMutationOptions, useRevokeTokenMutationOptions, useSecurityQueryOptions, useTokensQueryOptions, useUpdateLoginMethodsMutationOptions, useUpdateProfileMutationOptions, } from './src/queries/account/index.js';
-export { useAddOrgMemberMutationOptions, useAuditQueryOptions, useClientQueryOptions, useClientsQueryOptions, useCreateClientMutationOptions, useCreateOrgInvitationMutationOptions, useCreateOrgMutationOptions, useCreateRoleMutationOptions, useCreateUserMutationOptions, useDeleteClientMutationOptions, useDeleteOrgMutationOptions, useDeleteRoleMutationOptions, useDeleteUserMutationOptions, useDisableUserMutationOptions, useEnableUserMutationOptions, useImpersonationQueryOptions, useKeysQueryOptions, useOrgQueryOptions, useOrgsQueryOptions, useOverviewQueryOptions, usePersonalAgentConnectionsQueryOptions, usePersonalAgentsQueryOptions, useRegenerateClientSecretMutationOptions, useRemoveOrgMemberMutationOptions, useRemovePersonalAgentEntryMutationOptions, useRemoveSettingMutationOptions, useResetPasswordMutationOptions, useRevokeAllSessionsMutationOptions, useRevokeOrgInvitationMutationOptions, useRevokePersonalAgentConnectionMutationOptions, useRevokeUserSessionsMutationOptions, useRolesQueryOptions, useRotateKeysMutationOptions, useSessionsQueryOptions, useSetPersonalAgentStatusMutationOptions, useSetSettingMutationOptions, useSettingsQueryOptions, useUpdateClientMutationOptions, useUpdateOrgMemberRoleMutationOptions, useUpdateOrgMutationOptions, useUpdateRoleMutationOptions, useUpdateUserMutationOptions, useUserQueryOptions, useUserSessionsQueryOptions, useUsersQueryOptions, } from './src/queries/admin/index.js';
+export { useAddOrgMemberMutationOptions, useAuditQueryOptions, useClientQueryOptions, useClientsQueryOptions, useCreateClientMutationOptions, useCreateOrgInvitationMutationOptions, useCreateOrgMutationOptions, useCreateRoleMutationOptions, useCreateUserMutationOptions, useDeleteClientMutationOptions, useDeleteOrgMutationOptions, useDeleteRoleMutationOptions, useDeleteUserMutationOptions, useDisableUserMutationOptions, useEnableUserMutationOptions, useImpersonationQueryOptions, useKeysQueryOptions, useOrgQueryOptions, useOrgsQueryOptions, useOverviewQueryOptions, usePersonalAgentConnectionsQueryOptions, usePersonalAgentsQueryOptions, useRegenerateClientSecretMutationOptions, useRemoveOrgMemberMutationOptions, useRemovePersonalAgentEntryMutationOptions, useRemoveSettingMutationOptions, useResetPasswordMutationOptions, useRevokeAllSessionsMutationOptions, useRevokeOrgInvitationMutationOptions, useRevokePersonalAgentConnectionMutationOptions, useRevokeUserSessionsMutationOptions, useRolesQueryOptions, useRotateKeysMutationOptions, useSessionsQueryOptions, useSetClientDisabledMutationOptions, useSetPersonalAgentStatusMutationOptions, useSetSettingMutationOptions, useSettingsQueryOptions, useUpdateClientMutationOptions, useUpdateOrgMemberRoleMutationOptions, useUpdateOrgMutationOptions, useUpdateRoleMutationOptions, useUpdateUserMutationOptions, useUserQueryOptions, useUserSessionsQueryOptions, useUsersQueryOptions, } from './src/queries/admin/index.js';
 export { authkitKeys } from './src/queries/keys.js';
 export { hasAllGlobalRoles, hasAnyGlobalRole, hasGlobalRole, } from './src/roles.js';
 export type { AuthSharedProps, AuthState, AuthUser } from './src/types.js';

package/build/index.js

@@ -37,7 +37,7 @@ export { registerPasskeyJson } from './src/passkey/json_registration.js';
 export { runPasskeyAssertion, runPasskeyRegistration } from './src/passkey/sudo.js';
 export { AuthContext, AuthProvider } from './src/provider.js';
 export { useAccountAcceptOrgInvitationMutationOptions, useAccountActivateOrgMutationOptions, useAccountAgentsQueryOptions, useAccountCreateOrgMutationOptions, useAccountDeactivateOrgMutationOptions, useAccountInviteOrgMemberMutationOptions, useAccountLeaveOrgMutationOptions, useAccountOrgInvitationsQueryOptions, useAccountOrgQueryOptions, useAccountOrgsQueryOptions, useAccountRemoveOrgMemberMutationOptions, useAccountRevokeAllSessionsMutationOptions, useAccountRevokeOrgInvitationMutationOptions, useAccountSessionsQueryOptions, useAccountUpdateOrgMemberRoleMutationOptions, useAppsQueryOptions, useCancelEmailChangeMutationOptions, useChangePasswordMutationOptions, useConfirmTotpMutationOptions, useCreateTokenMutationOptions, useDisableTotpMutationOptions, useEmailChangeMutationOptions, useEnrollTotpMutationOptions, useLoginMethodsQueryOptions, useMeQueryOptions, useMfaQueryOptions, usePasskeysQueryOptions, useRegenerateRecoveryCodesMutationOptions, useRegisterPasskeyMutationOptions, useRemovePasskeyMutationOptions, useRevokeAccountAgentMutationOptions, useRevokeAppMutationOptions, useRevokeOtherSessionsMutationOptions, useRevokeSessionMutationOptions, useRevokeTokenMutationOptions, useSecurityQueryOptions, useTokensQueryOptions, useUpdateLoginMethodsMutationOptions, useUpdateProfileMutationOptions, } from './src/queries/account/index.js';
-export { useAddOrgMemberMutationOptions, useAuditQueryOptions, useClientQueryOptions, useClientsQueryOptions, useCreateClientMutationOptions, useCreateOrgInvitationMutationOptions, useCreateOrgMutationOptions, useCreateRoleMutationOptions, useCreateUserMutationOptions, useDeleteClientMutationOptions, useDeleteOrgMutationOptions, useDeleteRoleMutationOptions, useDeleteUserMutationOptions, useDisableUserMutationOptions, useEnableUserMutationOptions, useImpersonationQueryOptions, useKeysQueryOptions, useOrgQueryOptions, useOrgsQueryOptions, useOverviewQueryOptions, usePersonalAgentConnectionsQueryOptions, usePersonalAgentsQueryOptions, useRegenerateClientSecretMutationOptions, useRemoveOrgMemberMutationOptions, useRemovePersonalAgentEntryMutationOptions, useRemoveSettingMutationOptions, useResetPasswordMutationOptions, useRevokeAllSessionsMutationOptions, useRevokeOrgInvitationMutationOptions, useRevokePersonalAgentConnectionMutationOptions, useRevokeUserSessionsMutationOptions, useRolesQueryOptions, useRotateKeysMutationOptions, useSessionsQueryOptions, useSetPersonalAgentStatusMutationOptions, useSetSettingMutationOptions, useSettingsQueryOptions, useUpdateClientMutationOptions, useUpdateOrgMemberRoleMutationOptions, useUpdateOrgMutationOptions, useUpdateRoleMutationOptions, useUpdateUserMutationOptions, useUserQueryOptions, useUserSessionsQueryOptions, useUsersQueryOptions, } from './src/queries/admin/index.js';
+export { useAddOrgMemberMutationOptions, useAuditQueryOptions, useClientQueryOptions, useClientsQueryOptions, useCreateClientMutationOptions, useCreateOrgInvitationMutationOptions, useCreateOrgMutationOptions, useCreateRoleMutationOptions, useCreateUserMutationOptions, useDeleteClientMutationOptions, useDeleteOrgMutationOptions, useDeleteRoleMutationOptions, useDeleteUserMutationOptions, useDisableUserMutationOptions, useEnableUserMutationOptions, useImpersonationQueryOptions, useKeysQueryOptions, useOrgQueryOptions, useOrgsQueryOptions, useOverviewQueryOptions, usePersonalAgentConnectionsQueryOptions, usePersonalAgentsQueryOptions, useRegenerateClientSecretMutationOptions, useRemoveOrgMemberMutationOptions, useRemovePersonalAgentEntryMutationOptions, useRemoveSettingMutationOptions, useResetPasswordMutationOptions, useRevokeAllSessionsMutationOptions, useRevokeOrgInvitationMutationOptions, useRevokePersonalAgentConnectionMutationOptions, useRevokeUserSessionsMutationOptions, useRolesQueryOptions, useRotateKeysMutationOptions, useSessionsQueryOptions, useSetClientDisabledMutationOptions, useSetPersonalAgentStatusMutationOptions, useSetSettingMutationOptions, useSettingsQueryOptions, useUpdateClientMutationOptions, useUpdateOrgMemberRoleMutationOptions, useUpdateOrgMutationOptions, useUpdateRoleMutationOptions, useUpdateUserMutationOptions, useUserQueryOptions, useUserSessionsQueryOptions, useUsersQueryOptions, } from './src/queries/admin/index.js';
 export { authkitKeys } from './src/queries/keys.js';
 export { hasAllGlobalRoles, hasAnyGlobalRole, hasGlobalRole, } from './src/roles.js';
 export { useAuth } from './src/use_auth.js';

package/build/src/client/client.d.ts

@@ -56,6 +56,8 @@ declare class AuthkitClient {
             readonly create: (data?: CreateClientInput) => Promise<CreatedClientResult>;
             readonly update: (id: string, data?: UpdateClientInput) => Promise<AdminClient>;
             readonly remove: (id: string) => Promise<DeletedResult>;
+            readonly disable: (id: string) => Promise<AdminClient>;
+            readonly enable: (id: string) => Promise<AdminClient>;
             readonly regenerateSecret: (id: string) => Promise<RegenerateSecretResult>;
         };
         readonly roles: {

package/build/src/client/client.js

@@ -122,6 +122,8 @@ class AuthkitClient {
             create: (data) => this.post(this.b('/clients'), data),
             update: (id, data) => this.patch(this.b(`/clients/${encodeURIComponent(id)}`), data),
             remove: (id) => this.delete(this.b(`/clients/${encodeURIComponent(id)}`)),
+            disable: (id) => this.post(this.b(`/clients/${encodeURIComponent(id)}/disable`)),
+            enable: (id) => this.post(this.b(`/clients/${encodeURIComponent(id)}/enable`)),
             regenerateSecret: (id) => this.post(this.b(`/clients/${encodeURIComponent(id)}/regenerate-secret`)),
         },
         roles: {

package/build/src/client/types.d.ts

@@ -78,6 +78,12 @@ export interface AdminClient {
     backchannelLogoutSessionRequired: boolean;
     clientName: string | null;
     logoUri: string | null;
+    disabled?: boolean;
+    serviceTenant?: ServiceTenantSettings | null;
+}
+export interface ServiceTenantSettings {
+    partition: string;
+    capabilities: string[];
 }
 export interface AdminClientListResult {
     data: AdminClient[];
@@ -102,11 +108,19 @@ export interface CreateClientInput {
     backchannelLogoutSessionRequired?: boolean;
     clientName?: string;
     logoUri?: string;
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    };
 }
-export type UpdateClientInput = Omit<CreateClientInput, 'backchannelLogoutUri' | 'clientName' | 'logoUri'> & {
+export type UpdateClientInput = Omit<CreateClientInput, 'backchannelLogoutUri' | 'clientName' | 'logoUri' | 'serviceTenant'> & {
     backchannelLogoutUri?: string | null;
     clientName?: string | null;
     logoUri?: string | null;
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    } | null;
 };
 export interface RoleCatalogEntry {
     name: string;

package/build/src/queries/admin/index.d.ts

@@ -84,6 +84,13 @@ export declare function useDeleteClientMutationOptions(id: string): {
     mutationKey: string[];
     mutationFn: () => Promise<DeletedResult>;
 };
+export declare function useSetClientDisabledMutationOptions(): {
+    mutationKey: string[];
+    mutationFn: ({ id, disabled }: {
+        id: string;
+        disabled: boolean;
+    }) => Promise<AdminClient>;
+};
 export declare function useRegenerateClientSecretMutationOptions(id: string): {
     mutationKey: string[];
     mutationFn: () => Promise<RegenerateSecretResult>;

package/build/src/queries/admin/index.js

@@ -129,6 +129,13 @@ export function useDeleteClientMutationOptions(id) {
         mutationFn: () => client.admin.clients.remove(id),
     };
 }
+export function useSetClientDisabledMutationOptions() {
+    const client = useAuthkitClient();
+    return {
+        mutationKey: ['authkit', 'admin', 'clients', 'disabled'],
+        mutationFn: ({ id, disabled }) => disabled ? client.admin.clients.disable(id) : client.admin.clients.enable(id),
+    };
+}
 export function useRegenerateClientSecretMutationOptions(id) {
     const client = useAuthkitClient();
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-react",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0-rc.2",
   "description": "Frontend ergonomics over AuthKit for AdonisJS + Inertia + React apps: a typed useAuth() hook, role-gating hooks and gating components.",
   "license": "MIT",
   "author": "dudousxd",