@adonis-agora/authkit-server 0.34.0

package/build/src/accounts/lucid_store/organizations.js

@@ -0,0 +1,294 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { DateTime } from 'luxon';
+function toOrgSummary(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        slug: row.slug,
+        logoUrl: row.logoUrl ?? null,
+        metadata: row.metadata ?? null,
+        createdAt: toDateStr(row.createdAt),
+    };
+}
+function toDateStr(val) {
+    if (!val)
+        return new Date().toISOString();
+    if (typeof val === 'object' && 'toISO' in val)
+        return val.toISO() ?? new Date().toISOString();
+    if (val instanceof Date)
+        return val.toISOString();
+    return String(val);
+}
+function toDateStrOrNull(val) {
+    if (!val)
+        return null;
+    if (typeof val === 'object' && 'toISO' in val)
+        return val.toISO() ?? null;
+    if (val instanceof Date)
+        return val.toISOString();
+    return String(val);
+}
+function toOrgInvitation(row) {
+    return {
+        id: row.id,
+        organizationId: row.organizationId,
+        email: row.email,
+        role: row.role,
+        invitedBy: row.invitedBy,
+        expiresAt: toDateStr(row.expiresAt),
+        acceptedAt: toDateStrOrNull(row.acceptedAt),
+        createdAt: toDateStr(row.createdAt),
+    };
+}
+/** Conta os owners ativos de uma org. */
+async function countOwners(MemberModel, orgId) {
+    const result = await MemberModel.query()
+        .where('organization_id', orgId)
+        .where('role', 'owner')
+        .count('* as total');
+    return Number(result[0]?.$extras?.total ?? 0);
+}
+export function buildOrganizations(ctx) {
+    const { OrgModel, MemberModel, InvitationModel, findAccountEmail } = ctx;
+    return {
+        async createOrg(input) {
+            const { randomUUID } = await import('node:crypto');
+            const org = await OrgModel.create({
+                id: randomUUID(),
+                name: input.name,
+                slug: input.slug,
+                logoUrl: input.logoUrl ?? null,
+                metadata: input.metadata ?? null,
+            });
+            // Cria a membership do owner automaticamente
+            await MemberModel.create({
+                id: randomUUID(),
+                organizationId: org.id,
+                accountId: input.ownerAccountId,
+                role: 'owner',
+            });
+            return toOrgSummary(org);
+        },
+        async findOrgById(orgId) {
+            const row = await OrgModel.find(orgId);
+            return row ? toOrgSummary(row) : null;
+        },
+        async findOrgBySlug(slug) {
+            const row = await OrgModel.query().where('slug', slug).first();
+            return row ? toOrgSummary(row) : null;
+        },
+        async listOrgsForAccount(accountId) {
+            const memberships = await MemberModel.query().where('account_id', accountId);
+            const result = [];
+            for (const m of memberships) {
+                const org = await OrgModel.find(m.organizationId);
+                if (org)
+                    result.push({ ...toOrgSummary(org), role: m.role });
+            }
+            return result;
+        },
+        async updateOrg(orgId, patch) {
+            const row = await OrgModel.find(orgId);
+            if (!row)
+                return null;
+            if (patch.name !== undefined)
+                row.name = patch.name;
+            if (patch.logoUrl !== undefined)
+                row.logoUrl = patch.logoUrl;
+            if (patch.metadata !== undefined)
+                row.metadata = patch.metadata;
+            await row.save();
+            return toOrgSummary(row);
+        },
+        async deleteOrg(orgId) {
+            const row = await OrgModel.find(orgId);
+            if (!row)
+                return false;
+            await MemberModel.query().where('organization_id', orgId).delete();
+            await InvitationModel.query().where('organization_id', orgId).delete();
+            await row.delete();
+            return true;
+        },
+        async listOrgMembers(orgId) {
+            const rows = await MemberModel.query().where('organization_id', orgId);
+            return rows.map((r) => ({
+                accountId: r.accountId,
+                email: null, // o caller enriquece com findById se necessário
+                role: r.role,
+                joinedAt: toDateStr(r.createdAt),
+            }));
+        },
+        async addOrgMember(orgId, accountId, role) {
+            const { randomUUID } = await import('node:crypto');
+            // Upsert: se já existe, atualiza a role
+            const existing = await MemberModel.query()
+                .where('organization_id', orgId)
+                .where('account_id', accountId)
+                .first();
+            if (existing) {
+                existing.role = role;
+                await existing.save();
+            }
+            else {
+                await MemberModel.create({ id: randomUUID(), organizationId: orgId, accountId, role });
+            }
+        },
+        async removeOrgMember(orgId, accountId) {
+            const row = await MemberModel.query()
+                .where('organization_id', orgId)
+                .where('account_id', accountId)
+                .first();
+            if (!row)
+                return { ok: false, reason: 'not_found' };
+            // Invariante: org deve ter sempre >= 1 owner
+            if (row.role === 'owner') {
+                const ownerCount = await countOwners(MemberModel, orgId);
+                if (ownerCount <= 1)
+                    return { ok: false, reason: 'last_owner' };
+            }
+            await row.delete();
+            return { ok: true };
+        },
+        async updateOrgMemberRole(orgId, accountId, newRole) {
+            const row = await MemberModel.query()
+                .where('organization_id', orgId)
+                .where('account_id', accountId)
+                .first();
+            if (!row)
+                return { ok: false, reason: 'not_found' };
+            // Invariante: não rebaixa o último owner
+            if (row.role === 'owner' && newRole !== 'owner') {
+                const ownerCount = await countOwners(MemberModel, orgId);
+                if (ownerCount <= 1)
+                    return { ok: false, reason: 'last_owner' };
+            }
+            row.role = newRole;
+            await row.save();
+            return { ok: true };
+        },
+        async getOrgMembership(orgId, accountId) {
+            const row = await MemberModel.query()
+                .where('organization_id', orgId)
+                .where('account_id', accountId)
+                .first();
+            return row ? { role: row.role } : null;
+        },
+        async createOrgInvitation(input) {
+            const { randomUUID } = await import('node:crypto');
+            const token = randomBytes(32).toString('hex');
+            const tokenHash = createHash('sha256').update(token).digest('hex');
+            const expiresAt = DateTime.now().plus({ hours: input.ttlHours });
+            const inv = await InvitationModel.create({
+                id: randomUUID(),
+                organizationId: input.organizationId,
+                email: input.email,
+                role: input.role,
+                tokenHash,
+                invitedBy: input.invitedBy,
+                expiresAt,
+                acceptedAt: null,
+            });
+            return { invitation: toOrgInvitation(inv), token };
+        },
+        async findInvitationByTokenHash(tokenHash) {
+            const row = await InvitationModel.query().where('token_hash', tokenHash).first();
+            return row ? toOrgInvitation(row) : null;
+        },
+        async listPendingInvitationsForOrg(orgId) {
+            const rows = await InvitationModel.query()
+                .where('organization_id', orgId)
+                .whereNull('accepted_at');
+            return rows.map(toOrgInvitation);
+        },
+        async listPendingInvitationsForEmail(email) {
+            const rows = await InvitationModel.query()
+                .where('email', email)
+                .whereNull('accepted_at');
+            return rows.map(toOrgInvitation);
+        },
+        async acceptInvitation(invitationId, accountId) {
+            const inv = await InvitationModel.find(invitationId);
+            if (!inv)
+                return { ok: false, reason: 'not_found' };
+            // Verifica expiração (expiresAt pode ser DateTime Luxon, Date, ou string do SQLite)
+            let expiresMs;
+            const rawExpiry = inv.expiresAt;
+            if (rawExpiry && typeof rawExpiry === 'object' && 'toMillis' in rawExpiry) {
+                expiresMs = rawExpiry.toMillis();
+            }
+            else if (rawExpiry instanceof Date) {
+                expiresMs = rawExpiry.getTime();
+            }
+            else if (rawExpiry) {
+                // SQLite may return "YYYY-MM-DD HH:MM:SS" without T/Z
+                const normalized = String(rawExpiry).replace(' ', 'T') + (String(rawExpiry).includes('Z') ? '' : 'Z');
+                expiresMs = new Date(normalized).getTime();
+            }
+            else {
+                expiresMs = 0;
+            }
+            if (isNaN(expiresMs) || expiresMs < Date.now())
+                return { ok: false, reason: 'expired' };
+            // Verifica e-mail
+            const accountEmail = await findAccountEmail(accountId);
+            if (!accountEmail || accountEmail.toLowerCase() !== inv.email.toLowerCase()) {
+                return { ok: false, reason: 'email_mismatch' };
+            }
+            // Verifica se já é membro
+            const existing = await MemberModel.query()
+                .where('organization_id', inv.organizationId)
+                .where('account_id', accountId)
+                .first();
+            if (existing) {
+                // Já membro: marca aceito mesmo assim (idempotência)
+                inv.acceptedAt = DateTime.now();
+                await inv.save();
+                return { ok: true };
+            }
+            // Cria membership + marca accepted_at
+            const { randomUUID } = await import('node:crypto');
+            await MemberModel.create({
+                id: randomUUID(),
+                organizationId: inv.organizationId,
+                accountId,
+                role: inv.role,
+            });
+            inv.acceptedAt = DateTime.now();
+            await inv.save();
+            return { ok: true };
+        },
+        async revokeInvitation(organizationId, invitationId) {
+            // Escopado por org: exige que o convite pertença à org informada antes de
+            // deletar. Sem esse filtro, um owner/admin de qualquer org revogaria
+            // convites de outra org sabendo apenas o invitationId (IDOR cross-org).
+            const inv = await InvitationModel.query()
+                .where('id', invitationId)
+                .where('organization_id', organizationId)
+                .first();
+            if (!inv)
+                return false;
+            await inv.delete();
+            return true;
+        },
+        async removeAccountFromAllOrgs(accountId) {
+            // Memberships: remove todas, mesmo se for único owner (LGPD não pode bloquear)
+            const memberships = await MemberModel.query().where('account_id', accountId);
+            for (const m of memberships) {
+                await m.delete();
+            }
+            // Convites (pendentes) para o e-mail da conta
+            const email = await findAccountEmail(accountId);
+            let invCount = 0;
+            if (email) {
+                const invitations = await InvitationModel.query()
+                    .where('email', email)
+                    .whereNull('accepted_at');
+                for (const inv of invitations) {
+                    await inv.delete();
+                    invCount++;
+                }
+            }
+            return { memberships: memberships.length, invitations: invCount };
+        },
+    };
+}

package/build/src/accounts/lucid_store/password_hygiene.d.ts

@@ -0,0 +1,20 @@
+import type { PasswordExpirationCapability, PasswordHistoryCapability } from '../account_store.js';
+import type { LucidStoreContext } from './shared.js';
+/**
+ * Histórico de senhas (disallow_password_reuse). Só deve ser montado quando a
+ * tabela `auth_password_history` está presente (capability-probed via
+ * {@link hasTable} no `lucidAccountStore`).
+ *
+ * Tabela: `auth_password_history`
+ *   id          UUID/SERIAL PK
+ *   account_id  TEXT NOT NULL
+ *   password_hash TEXT NOT NULL
+ *   created_at  TIMESTAMP NOT NULL
+ */
+export declare function buildPasswordHistory(ctx: LucidStoreContext, db: any): PasswordHistoryCapability;
+/**
+ * Expiração de senha. Só deve ser montado quando o model tem a propriedade
+ * `passwordChangedAt` (coluna `password_changed_at`) — capability-probed via
+ * {@link hasColumn} no `lucidAccountStore`.
+ */
+export declare function buildPasswordExpiration(ctx: LucidStoreContext): PasswordExpirationCapability;

package/build/src/accounts/lucid_store/password_hygiene.js

@@ -0,0 +1,130 @@
+import { DateTime } from 'luxon';
+/** Stub de noop para quando não há verify disponível (fail-safe: não bloqueia). */
+const _noopVerify = async (_hash, _plain) => false;
+/**
+ * Histórico de senhas (disallow_password_reuse). Só deve ser montado quando a
+ * tabela `auth_password_history` está presente (capability-probed via
+ * {@link hasTable} no `lucidAccountStore`).
+ *
+ * Tabela: `auth_password_history`
+ *   id          UUID/SERIAL PK
+ *   account_id  TEXT NOT NULL
+ *   password_hash TEXT NOT NULL
+ *   created_at  TIMESTAMP NOT NULL
+ */
+export function buildPasswordHistory(ctx, db) {
+    /**
+     * Helper para query raw da tabela de histórico.
+     * Lucid expõe `db.query().from(table)` para SELECT e `db.table(table).insert()` para INSERT.
+     * Para DELETE usamos `db.query().from(table)`.
+     */
+    function qFrom() {
+        return db.query().from('auth_password_history');
+    }
+    return {
+        async isPasswordReused(accountId, plainPassword, count, nativeVerify) {
+            try {
+                const rows = await qFrom()
+                    .where('account_id', accountId)
+                    .orderBy('created_at', 'desc')
+                    .limit(count);
+                if (!rows || rows.length === 0)
+                    return false;
+                // Usa o hook do chamador quando fornecido; fallback: ctx.nativeVerifyHash.
+                const verify = (nativeVerify ?? null) || ctx.nativeVerifyHash || _noopVerify;
+                // Verifica a senha candidata contra cada hash do histórico.
+                for (const row of rows) {
+                    try {
+                        const matches = await verify(row.password_hash, plainPassword);
+                        if (matches)
+                            return true;
+                    }
+                    catch {
+                        // falha ao verificar um hash individual → ignora (hash de sistema legado etc.)
+                    }
+                }
+                return false;
+            }
+            catch {
+                // Falha de DB → fail-safe: não bloqueia (prefere availability).
+                return false;
+            }
+        },
+        async recordPasswordHistory(accountId, oldHash) {
+            try {
+                await db.table('auth_password_history').insert({
+                    account_id: accountId,
+                    password_hash: oldHash,
+                    created_at: DateTime.now().toISO(),
+                });
+            }
+            catch {
+                // Best-effort: falha silenciosa não impede a troca de senha.
+            }
+        },
+        async prunePasswordHistory(accountId, count) {
+            try {
+                // Busca os IDs dos últimos `count` registros.
+                const rows = await qFrom()
+                    .where('account_id', accountId)
+                    .orderBy('created_at', 'desc')
+                    .limit(count)
+                    .select('id');
+                if (rows.length < count)
+                    return; // menos registros que o limite → nada a podar
+                // Apaga os mais antigos (todos exceto os últimos `count`).
+                const keepIds = rows.map((r) => r.id);
+                await qFrom()
+                    .where('account_id', accountId)
+                    .whereNotIn('id', keepIds)
+                    .delete();
+            }
+            catch {
+                // Best-effort.
+            }
+        },
+    };
+}
+/**
+ * Expiração de senha. Só deve ser montado quando o model tem a propriedade
+ * `passwordChangedAt` (coluna `password_changed_at`) — capability-probed via
+ * {@link hasColumn} no `lucidAccountStore`.
+ */
+export function buildPasswordExpiration(ctx) {
+    const { Model } = ctx;
+    return {
+        async getPasswordChangedAt(accountId) {
+            try {
+                const row = await Model.find(accountId);
+                if (!row)
+                    return null;
+                const val = row.passwordChangedAt;
+                if (!val)
+                    return null;
+                // Suporta tanto DateTime do Luxon quanto Date nativo.
+                if (val instanceof Date)
+                    return val;
+                if (val && typeof val.toJSDate === 'function')
+                    return val.toJSDate();
+                if (typeof val === 'string')
+                    return new Date(val);
+                return null;
+            }
+            catch {
+                return null;
+            }
+        },
+        async touchPasswordChangedAt(accountId) {
+            try {
+                const row = await Model.find(accountId);
+                if (!row)
+                    return;
+                row.passwordChangedAt = DateTime.now();
+                await row.save();
+            }
+            catch {
+                // Best-effort.
+            }
+        },
+    };
+}

package/build/src/accounts/lucid_store/provider_identity.d.ts

@@ -0,0 +1,8 @@
+import type { ProviderIdentityCapability } from '../account_store.js';
+import type { LucidStoreContext } from './shared.js';
+/**
+ * Capacidade de account linking por identidade de provider (Google, GitHub, …).
+ * Só é montada quando o `providerIdentityModel` é fornecido — quando ausente, a
+ * capacidade inteira fica ABSENTE do store (sem método presente-mas-lançando).
+ */
+export declare function buildProviderIdentity(ctx: LucidStoreContext, ProviderIdentityModel: any): ProviderIdentityCapability;

package/build/src/accounts/lucid_store/provider_identity.js

@@ -0,0 +1,59 @@
+/**
+ * Capacidade de account linking por identidade de provider (Google, GitHub, …).
+ * Só é montada quando o `providerIdentityModel` é fornecido — quando ausente, a
+ * capacidade inteira fica ABSENTE do store (sem método presente-mas-lançando).
+ */
+export function buildProviderIdentity(ctx, ProviderIdentityModel) {
+    const { Model, toAccount } = ctx;
+    return {
+        async findByProviderIdentity(provider, providerUserId) {
+            const identity = await ProviderIdentityModel.query()
+                .where('provider', provider)
+                .where('providerUserId', providerUserId)
+                .first();
+            if (!identity)
+                return null;
+            const row = await Model.find(identity.accountId);
+            return row ? toAccount(row) : null;
+        },
+        async linkProviderIdentity(data) {
+            // Upsert idempotente na chave única (provider, providerUserId): atualiza
+            // account/email se já existir, cria caso contrário.
+            const existing = await ProviderIdentityModel.query()
+                .where('provider', data.provider)
+                .where('providerUserId', data.providerUserId)
+                .first();
+            if (existing) {
+                existing.accountId = data.accountId;
+                if (data.email !== undefined)
+                    existing.email = data.email;
+                await existing.save();
+                return;
+            }
+            await ProviderIdentityModel.create({
+                provider: data.provider,
+                providerUserId: data.providerUserId,
+                accountId: data.accountId,
+                email: data.email ?? null,
+            });
+        },
+        async unlinkAllProviderIdentities(accountId) {
+            const rows = await ProviderIdentityModel.query().where('accountId', accountId);
+            let count = 0;
+            for (const row of rows) {
+                await row.delete();
+                count++;
+            }
+            return count;
+        },
+        async listProviderIdentities(accountId) {
+            const rows = await ProviderIdentityModel.query().where('accountId', accountId);
+            // NUNCA expõe tokens — só os identificadores estáveis do provider + email.
+            return rows.map((r) => ({
+                provider: r.provider,
+                providerUserId: r.providerUserId,
+                email: r.email ?? null,
+            }));
+        },
+    };
+}

package/build/src/accounts/lucid_store/shared.d.ts

@@ -0,0 +1,113 @@
+import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
+import type { AuthAccount } from '../account_store.js';
+import type { AuditSink } from '../../audit/audit_sink.js';
+import type { PasswordManager } from '../../password/password_manager.js';
+/**
+ * Encripta/decripta um valor (ex.: o segredo TOTP) em repouso. Mantém a lib
+ * desacoplada do serviço de encryption do app — qualquer implementação que
+ * faça round-trip serve (em prod, normalmente o `@adonisjs/core/services/encryption`).
+ * `decrypt` retorna `null` se o valor foi adulterado/é inválido.
+ */
+export interface AccountSecretEncrypter {
+    encrypt(value: string): string;
+    decrypt(value: string): string | null;
+}
+/**
+ * Funções das cerimônias WebAuthn. Espelham a assinatura do `@simplewebauthn/server`
+ * (subconjunto usado). Injetáveis via {@link LucidAccountStoreOptions.webauthnCeremonies}
+ * para testes.
+ */
+export interface WebauthnCeremonies {
+    generateRegistrationOptions: typeof generateRegistrationOptions;
+    verifyRegistrationResponse: typeof verifyRegistrationResponse;
+    generateAuthenticationOptions: typeof generateAuthenticationOptions;
+    verifyAuthenticationResponse: typeof verifyAuthenticationResponse;
+}
+/** RP (Relying Party) do WebAuthn usado nas cerimônias. */
+export interface ResolvedRp {
+    rpName: string;
+    rpId: string;
+    origin: string | string[];
+}
+/**
+ * Contexto compartilhado pelos builders de capacidade. Carrega o model principal,
+ * os helpers de segredo e (quando configurados) os models/parametros das capacidades.
+ */
+export interface LucidStoreContext {
+    Model: any;
+    mfaIssuer: string;
+    recoveryCodeCount: number;
+    /** Encripta o segredo antes de persistir (no-op sem encrypter). */
+    sealSecret(secret: string): string;
+    /** Decripta o segredo armazenado; null em falha/adulteração (no-op sem encrypter). */
+    openSecret(stored: string | null | undefined): string | null;
+    toAccount(row: any): AuthAccount;
+    /**
+     * Gerência de senha: validação de política/vazamento (ao definir) e
+     * verificação com lazy rehash + legacy verifier (ao autenticar).
+     */
+    passwords: PasswordManager;
+    /**
+     * Sink de auditoria (best-effort), usado para o evento `password.rehashed`.
+     * Ausente → o evento não é emitido (capability-probed).
+     */
+    audit?: AuditSink;
+    /**
+     * Verifica uma senha em claro contra um hash armazenado usando o hasher nativo
+     * do app (Scrypt). Injetado pelo `lucidAccountStore` a partir do modelo. Usado
+     * pela verificação de histórico de senhas.
+     */
+    nativeVerifyHash?: (hash: string, plain: string) => Promise<boolean>;
+}
+export declare const sha256: (value: string) => string;
+/** Recovery code legível: 10 chars hex em duas metades (ex.: a1b2c-3d4e5). */
+export declare function generateRecoveryCode(): string;
+/** Comparação de hashes hex resistente a timing. */
+export declare function hashesEqual(a: string, b: string): boolean;
+/**
+ * Indica se o model Lucid tem sua tabela registrada no adapter do DB (runtime probe).
+ * Usado para detectar tabelas opcionais como auth_organizations/members/invitations.
+ * Mais robusto do que checar colunas: detecta a presença da tabela inteira.
+ * Em testes, as tabelas existem se foram criadas na migration do teste.
+ */
+export declare function hasTable(db: any, tableName: string): Promise<boolean>;
+/**
+ * Estado de MFA (lido de `auth_mfa`). Forma normalizada usada pela {@link MfaCapability}:
+ *  - `mfaEnabledAt` em EPOCH MS (ou null) — o trusted-device compara contra isso.
+ *  - `recoveryCodes` já desserializado (array de hashes) — o repo cuida do JSON.
+ */
+export interface MfaState {
+    totpSecret: string | null;
+    mfaEnabledAt: number | null;
+    recoveryCodes: string[] | null;
+    lastTotpStep: number | null;
+}
+/** Patch parcial para o upsert em `auth_mfa` — campos ausentes são preservados. */
+export interface MfaStatePatch {
+    totpSecret?: string | null;
+    /** Epoch ms (ou null para limpar). */
+    mfaEnabledAt?: number | null;
+    recoveryCodes?: string[] | null;
+    lastTotpStep?: number | null;
+}
+/**
+ * Repositório do estado de MFA na tabela LIB-OWNED `auth_mfa`, keyed por
+ * `account_id`. Acessa o banco pela CONEXÃO do próprio model (`Model.query().client`),
+ * a mesma usada pelo restante do store — sem exigir migration no host.
+ *
+ * O `upsert` é portável (sqlite + pg sem UPSERT nativo): tenta UPDATE pela PK;
+ * se não afetou nenhuma linha, faz INSERT. `recovery_codes` é serializado como
+ * JSON (string) na escrita e desserializado na leitura (aceita tanto string —
+ * sqlite/text — quanto array já parseado — pg jsonb).
+ */
+export declare function buildMfaStateRepo(Model: any): {
+    /** Lê o estado de MFA da conta; null se não há linha em `auth_mfa`. */
+    read(accountId: string): Promise<MfaState | null>;
+    /**
+     * Upsert parcial: cria a linha se não existir, senão atualiza apenas os campos
+     * presentes no patch (campos ausentes preservados). Portável (sqlite + pg).
+     */
+    upsert(accountId: string, patch: MfaStatePatch): Promise<void>;
+    /** Remove o estado de MFA da conta (disable / reset total). No-op se ausente. */
+    clear(accountId: string): Promise<void>;
+};