@adonis-agora/authkit-server 0.34.0

package/package.json

@@ -0,0 +1,147 @@
+{
+  "name": "@adonis-agora/authkit-server",
+  "version": "0.34.0",
+  "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
+  "license": "MIT",
+  "author": "dudousxd",
+  "homepage": "https://github.com/DavideCarvalho/adonis-authkit/tree/main/packages/authkit-server#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/DavideCarvalho/adonis-authkit.git",
+    "directory": "packages/authkit-server"
+  },
+  "bugs": {
+    "url": "https://github.com/DavideCarvalho/adonis-authkit/issues"
+  },
+  "keywords": [
+    "adonisjs",
+    "oidc",
+    "oauth2",
+    "openid-connect",
+    "authentication",
+    "authkit",
+    "identity-provider",
+    "rate-limiting",
+    "mfa",
+    "totp"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./build/index.js",
+  "types": "./build/index.d.ts",
+  "files": [
+    "build",
+    "stubs"
+  ],
+  "exports": {
+    ".": "./build/index.js",
+    "./types": "./build/index.js",
+    "./durable": "./build/src/host/durable/index.js",
+    "./telescope": "./build/src/observability/telescope/index.js",
+    "./authkit_server_provider": "./build/providers/authkit_server_provider.js",
+    "./commands": "./build/commands/main.js",
+    "./commands/configure": "./build/commands/configure.js"
+  },
+  "adonisjs": {
+    "types": "@adonis-agora/authkit-server",
+    "providers": [
+      "@adonis-agora/authkit-server/authkit_server_provider"
+    ],
+    "commands": [
+      "@adonis-agora/authkit-server/commands"
+    ]
+  },
+  "peerDependencies": {
+    "@adonis-agora/durable": "^0.2.0",
+    "@adonis-agora/telescope": "^0.1.0",
+    "@adonisjs/ally": "6.3.0",
+    "@adonisjs/core": "7.3.3",
+    "@adonisjs/drive": "4.0.0",
+    "@adonisjs/lock": "2.1.0",
+    "@adonisjs/lucid": "22.4.2",
+    "@adonisjs/redis": "9.2.0",
+    "@adonisjs/session": "8.1.0",
+    "@adonisjs/shield": "9.0.0",
+    "edge.js": "6.5.1"
+  },
+  "peerDependenciesMeta": {
+    "@adonis-agora/durable": {
+      "optional": true
+    },
+    "@adonis-agora/telescope": {
+      "optional": true
+    },
+    "edge.js": {
+      "optional": true
+    },
+    "@adonisjs/ally": {
+      "optional": true
+    },
+    "@adonisjs/drive": {
+      "optional": true
+    },
+    "@adonisjs/lock": {
+      "optional": true
+    },
+    "@adonisjs/redis": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@simplewebauthn/server": "^13.3.1",
+    "@vinejs/vine": "4.4.0",
+    "jose": "^5.9.0",
+    "koa": "^3.2.1",
+    "koa-mount": "^4.2.0",
+    "oidc-provider": "^9.8.4",
+    "otplib": "^12.0.1",
+    "qrcode": "^1.5.4",
+    "@adonis-agora/authkit-core": "0.7.0"
+  },
+  "devDependencies": {
+    "@adonis-agora/durable": "^0.2.0",
+    "@adonis-agora/telescope": "^0.1.0",
+    "@adonisjs/ally": "6.3.0",
+    "@adonisjs/core": "7.3.3",
+    "@adonisjs/drive": "4.0.0",
+    "@adonisjs/lucid": "22.4.2",
+    "@adonisjs/session": "8.1.0",
+    "@adonisjs/shield": "9.0.0",
+    "@adonisjs/tsconfig": "2.0.0",
+    "@japa/assert": "4.2.0",
+    "@japa/runner": "5.3.0",
+    "@poppinss/ts-exec": "1.4.4",
+    "@types/koa": "^2.15.2",
+    "@types/koa-mount": "^4.0.5",
+    "@types/luxon": "3.7.1",
+    "@types/node": "25.9.1",
+    "@types/qrcode": "^1.5.5",
+    "better-sqlite3": "^11.0.0",
+    "edge.js": "6.5.1",
+    "ioredis": "5.4.2",
+    "ioredis-mock": "^8.9.0",
+    "luxon": "3.7.2",
+    "tailwindcss": "^3.4.19",
+    "typescript": "6.0.3",
+    "@vitejs/plugin-react": "6.0.2",
+    "@types/react": "19.2.15",
+    "@types/react-dom": "19.2.3",
+    "react": "19.2.6",
+    "react-dom": "19.2.6",
+    "vite": "8.0.14",
+    "@tanstack/react-query": "5.100.14",
+    "react-error-boundary": "6.1.2",
+    "nuqs": "2.8.9",
+    "recharts": "3.8.1",
+    "@adonis-agora/authkit-react": "0.12.0"
+  },
+  "scripts": {
+    "build": "node scripts/build_host_css.mjs && node scripts/build_ui.mjs && tsc && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/password/common_passwords.txt')\"",
+    "build:ui": "node scripts/build_ui.mjs",
+    "typecheck": "tsc --noEmit && node scripts/typecheck_ui.mjs",
+    "test": "node --import=@poppinss/ts-exec bin/test.ts",
+    "build:host-css": "node scripts/build_host_css.mjs"
+  }
+}

package/stubs/config/authkit.stub

@@ -0,0 +1,20 @@
+{{{
+  exports({ to: app.configPath('authkit.ts') })
+}}}
+import env from '#start/env'
+import AuthUser from '#models/auth_user'
+import { defineConfig, adapters, lucidAccountStore } from '@adonis-agora/authkit-server'
+
+const authServerConfig = defineConfig({
+  issuer: env.get('AUTHKIT_ISSUER'),
+  adapter: adapters.redis({ connection: 'main' }),
+  jwks: { source: 'managed', algorithm: 'RS256' },
+  ttl: { accessToken: '15m', refreshToken: '30d' },
+  globalRolesClaim: 'roles',
+  accountStore: lucidAccountStore(AuthUser),
+  // Clients são gerenciados em runtime via console admin (/admin/clients) ou
+  // Admin API, sem necessidade de redeploy.
+  // Use: node ace authkit:clients:create --redirect-uri=https://app/cb
+})
+
+export default authServerConfig

package/stubs/config/authkit_react.stub

@@ -0,0 +1,52 @@
+{{{
+  exports({ to: app.configPath('authkit.ts'), overwrite: true })
+}}}
+import env from '#start/env'
+import AuthUser from '#models/auth_user'
+import { defineConfig, adapters, inertiaRenderer } from '@adonis-agora/authkit-server'
+
+const authServerConfig = defineConfig({
+  issuer: env.get('AUTHKIT_ISSUER'),
+  adapter: adapters.redis({ connection: 'main' }),
+  jwks: { source: 'managed', algorithm: 'RS256' },
+  clients: [
+    // registre seus clients OIDC aqui
+  ],
+  ttl: { accessToken: '15m', refreshToken: '30d' },
+  globalRolesClaim: 'roles',
+  findAccount: async (sub) => {
+    const user = await AuthUser.find(sub)
+    if (!user) return null
+    return { id: user.id, email: user.email, globalRoles: user.globalRoles }
+  },
+  verifyCredentials: async (email, password) => {
+    const user = await AuthUser.query().where('email', email).first()
+    if (!user || !(await user.verifyPassword(password))) return null
+    return { id: user.id }
+  },
+  /**
+   * Renderer Inertia/React: apenas as views listadas em `views` vão ao Inertia;
+   * as demais (incluindo todas as telas admin/*) recaem silenciosamente no
+   * renderer Edge built-in da lib — evitando SSR crash por página inexistente.
+   *
+   * A lista abaixo corresponde exatamente às páginas que o scaffold gerou.
+   * Adicione entradas aqui somente se criar a página React correspondente.
+   */
+  render: inertiaRenderer({
+    prefix: 'authkit',
+    views: [
+      'login',
+      'consent',
+      'signup',
+      'forgot',
+      'reset',
+      'verify-email',
+      'mfa-challenge',
+      'account/login',
+      'account/tokens',
+      'account/mfa',
+    ],
+  }),
+})
+
+export default authServerConfig

package/stubs/main.ts

@@ -0,0 +1,2 @@
+import { fileURLToPath } from 'node:url'
+export const stubsRoot = fileURLToPath(new URL('./', import.meta.url))

package/stubs/models/auth_user.stub

@@ -0,0 +1,22 @@
+{{{
+  exports({ to: app.makePath('app/models/auth_user.ts') })
+}}}
+import { BaseModel, column } from '@adonisjs/lucid/orm'
+import { compose } from '@adonisjs/core/helpers'
+import { withAuthUser, withCredentials } from '@adonis-agora/authkit-server'
+
+/**
+ * Por padrão o AuthKit cria/usa as tabelas na conexão DEFAULT da aplicação
+ * (config/database.ts) — não força nenhum banco/schema próprio.
+ *
+ * Se você quiser isolar o AuthKit num schema ou banco dedicado, defina uma
+ * conexão no config/database.ts do app e referencie aqui, ex.:
+ *
+ *   static connection = 'auth'
+ *
+ * (e aponte as migrations correspondentes para essa conexão).
+ */
+export default class AuthUser extends compose(BaseModel, withAuthUser(), withCredentials()) {
+  @column({ isPrimary: true })
+  declare id: string
+}

package/stubs/ui/edge/views/consent.edge

@@ -0,0 +1,13 @@
+{{{
+  exports({ to: app.makePath('resources/views/authkit/consent.edge') })
+}}}
+<!doctype html>
+<html lang="pt-br"><head><meta charset="utf-8"><title>Autorizar</title>
+<script src="https://cdn.tailwindcss.com"></script></head>
+<body class="min-h-screen flex items-center justify-center bg-gray-50">
+  <form method="POST" action="/auth/interaction/{{ uid }}/consent" class="w-full max-w-sm bg-white p-6 rounded-lg shadow">
+    <h1 class="text-lg font-semibold mb-2">Autorizar acesso</h1>
+    <p class="text-sm text-gray-600 mb-4">O app <strong>{{ params.client_id }}</strong> quer acessar sua conta.</p>
+    <button class="w-full bg-black text-white rounded py-2">Autorizar</button>
+  </form>
+</body></html>

package/stubs/ui/edge/views/login.edge

@@ -0,0 +1,19 @@
+{{{
+  exports({ to: app.makePath('resources/views/authkit/login.edge') })
+}}}
+<!doctype html>
+<html lang="pt-br"><head><meta charset="utf-8"><title>Entrar</title>
+<script src="https://cdn.tailwindcss.com"></script></head>
+<body class="min-h-screen flex items-center justify-center bg-gray-50">
+  <form method="POST" action="/auth/interaction/{{ uid }}/login" class="w-full max-w-sm bg-white p-6 rounded-lg shadow">
+    <h1 class="text-lg font-semibold mb-4">Entrar</h1>
+    @if(error)
+      <p class="text-red-600 text-sm mb-3">{{ error }}</p>
+    @end
+    <label class="block text-sm mb-1">E-mail</label>
+    <input name="email" type="email" required class="w-full border rounded px-3 py-2 mb-3" />
+    <label class="block text-sm mb-1">Senha</label>
+    <input name="password" type="password" required class="w-full border rounded px-3 py-2 mb-4" />
+    <button class="w-full bg-black text-white rounded py-2">Entrar</button>
+  </form>
+</body></html>

package/stubs/ui/react/components/auth_shell.tsx

@@ -0,0 +1,67 @@
+{{{
+  exports({ to: app.makePath('inertia/components/auth_shell.tsx') })
+}}}
+import type { ReactNode } from 'react'
+
+export interface AuthBrand {
+  appName: string
+  accent: string
+  accentSoft?: string
+  company?: string
+  tagline?: string
+  audienceLabel?: string
+}
+
+const COMPANY_FALLBACK = 'Acme'
+
+/**
+ * Layout de duas colunas para as telas de autenticacao do IdP.
+ * Painel esquerdo: marca (empresa guarda-chuva + produto). Painel direito: formulario.
+ */
+export default function AuthShell({
+  brand,
+  children,
+}: {
+  brand?: AuthBrand
+  children: ReactNode
+}) {
+  const accent = brand?.accent ?? '#111827'
+  const accentSoft = brand?.accentSoft ?? accent
+  const company = brand?.company ?? COMPANY_FALLBACK
+  const appName = brand?.appName ?? 'Sua conta'
+  const tagline = brand?.tagline ?? 'Acesso unificado'
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-100 p-4">
+      <div className="w-full max-w-4xl overflow-hidden rounded-2xl bg-white shadow-xl ring-1 ring-black/5 grid md:grid-cols-2">
+        {/* Painel da marca */}
+        <div
+          className="relative flex flex-col justify-between p-8 text-white md:p-10"
+          style={{ backgroundImage: `linear-gradient(135deg, ${accent} 0%, ${accentSoft} 100%)` }}
+        >
+          <div
+            className="text-xs font-semibold uppercase tracking-[0.2em] text-white/80"
+            aria-label="Empresa"
+          >
+            {company}
+          </div>
+
+          <div className="mt-10 md:mt-0">
+            <h2 className="text-2xl font-bold leading-tight md:text-3xl">{appName}</h2>
+            <p className="mt-2 text-sm text-white/85">{tagline}</p>
+            {brand?.audienceLabel && (
+              <span className="mt-4 inline-block rounded-full bg-white/20 px-3 py-1 text-xs font-medium uppercase tracking-wide text-white ring-1 ring-white/30">
+                {brand.audienceLabel}
+              </span>
+            )}
+          </div>
+
+          <div className="mt-10 text-xs text-white/60">© {company}</div>
+        </div>
+
+        {/* Painel do formulario */}
+        <div className="p-8 md:p-10">{children}</div>
+      </div>
+    </div>
+  )
+}

package/stubs/ui/react/pages/account/login.tsx

@@ -0,0 +1,56 @@
+{{{
+  exports({ to: app.makePath('inertia/pages/authkit/account/login.tsx') })
+}}}
+interface Props {
+  csrfToken: string
+  error?: string
+}
+
+export default function AccountLogin({ csrfToken, error }: Props) {
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-gray-100 p-4">
+      <form
+        method="POST"
+        action="/account/login"
+        className="w-full max-w-sm rounded-2xl bg-white p-8 shadow-xl ring-1 ring-black/5"
+      >
+        <input type="hidden" name="_csrf" value={csrfToken} />
+        <div className="text-xs font-semibold uppercase tracking-[0.2em] text-gray-400">Acme</div>
+        <h1 className="mt-2 text-xl font-semibold text-gray-900">Minha conta</h1>
+        <p className="mt-1 text-sm text-gray-500">Gerencie seus tokens de acesso.</p>
+
+        {error && <p className="mt-4 text-sm text-red-600">{error}</p>}
+
+        <label htmlFor="email" className="mt-6 mb-1 block text-sm font-medium text-gray-700">
+          E-mail
+        </label>
+        <input
+          id="email"
+          name="email"
+          type="email"
+          required
+          autoFocus
+          className="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none focus:border-gray-900"
+        />
+
+        <label htmlFor="password" className="mt-4 mb-1 block text-sm font-medium text-gray-700">
+          Senha
+        </label>
+        <input
+          id="password"
+          name="password"
+          type="password"
+          required
+          className="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none focus:border-gray-900"
+        />
+
+        <button
+          type="submit"
+          className="mt-6 w-full rounded-lg bg-gray-900 py-2.5 text-sm font-semibold text-white transition hover:opacity-90"
+        >
+          Entrar
+        </button>
+      </form>
+    </div>
+  )
+}

package/stubs/ui/react/pages/account/mfa.tsx

@@ -0,0 +1,132 @@
+{{{
+  exports({ to: app.makePath('inertia/pages/authkit/account/mfa.tsx') })
+}}}
+interface Props {
+  csrfToken: string
+  enabled: boolean
+  enrolling?: boolean
+  secret?: string | null
+  qrDataUrl?: string | null
+  error?: string
+  recoveryCodes?: string[] | null
+}
+
+export default function AccountMfa({
+  csrfToken,
+  enabled,
+  enrolling,
+  secret,
+  qrDataUrl,
+  error,
+  recoveryCodes,
+}: Props) {
+  return (
+    <div className="min-h-screen bg-gray-100 p-4">
+      <div className="mx-auto max-w-2xl">
+        <div className="flex items-center justify-between py-6">
+          <div>
+            <div className="text-xs font-semibold uppercase tracking-[0.2em] text-gray-400">Acme</div>
+            <h1 className="text-xl font-semibold text-gray-900">Verificação em duas etapas</h1>
+          </div>
+          <form method="POST" action="/account/logout">
+            <input type="hidden" name="_csrf" value={csrfToken} />
+            <button type="submit" className="text-sm text-gray-500 hover:underline">
+              Sair
+            </button>
+          </form>
+        </div>
+
+        {error && <p className="mb-4 text-sm text-red-600">{error}</p>}
+
+        {recoveryCodes && recoveryCodes.length > 0 && (
+          <div className="mb-6 rounded-lg border border-emerald-300 bg-emerald-50 p-4">
+            <p className="text-sm font-medium text-emerald-900">
+              Guarde seus códigos de recuperação — eles não serão mostrados de novo:
+            </p>
+            <ul className="mt-3 grid grid-cols-2 gap-2">
+              {recoveryCodes.map((rc) => (
+                <li key={rc}>
+                  <code className="block rounded bg-white px-3 py-2 text-sm text-emerald-800 ring-1 ring-emerald-200">
+                    {rc}
+                  </code>
+                </li>
+              ))}
+            </ul>
+          </div>
+        )}
+
+        {enrolling ? (
+          <div className="rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
+            <p className="text-sm text-gray-600">
+              Escaneie o QR code com seu app autenticador (Google Authenticator, 1Password, etc.).
+            </p>
+            {qrDataUrl && (
+              <img src={qrDataUrl} alt="QR code TOTP" className="mx-auto my-4 h-48 w-48" />
+            )}
+            {secret && (
+              <>
+                <p className="text-center text-xs text-gray-500">Ou informe manualmente:</p>
+                <code className="mx-auto mt-1 block w-fit break-all rounded bg-gray-100 px-3 py-2 text-sm text-gray-800">
+                  {secret}
+                </code>
+              </>
+            )}
+            <form method="POST" action="/account/mfa/confirm" className="mt-6">
+              <input type="hidden" name="_csrf" value={csrfToken} />
+              <label htmlFor="code" className="mb-1 block text-sm font-medium text-gray-700">
+                Código de confirmação
+              </label>
+              <input
+                id="code"
+                name="code"
+                inputMode="numeric"
+                pattern="[0-9]*"
+                maxLength={6}
+                autoFocus
+                className="w-full rounded-lg border border-gray-300 px-3 py-2 text-center text-lg tracking-[0.4em] outline-none focus:border-gray-900"
+              />
+              <button
+                type="submit"
+                className="mt-4 w-full rounded-lg bg-gray-900 py-2.5 text-sm font-semibold text-white"
+              >
+                Ativar verificação em duas etapas
+              </button>
+            </form>
+          </div>
+        ) : enabled ? (
+          <div className="rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
+            <p className="text-sm text-gray-700">
+              A verificação em duas etapas está{' '}
+              <span className="font-semibold text-emerald-700">ativa</span> nesta conta.
+            </p>
+            <form method="POST" action="/account/mfa/disable" className="mt-4">
+              <input type="hidden" name="_csrf" value={csrfToken} />
+              <button
+                type="submit"
+                className="rounded-lg border border-red-300 px-4 py-2 text-sm font-semibold text-red-600 hover:bg-red-50"
+              >
+                Desativar
+              </button>
+            </form>
+          </div>
+        ) : (
+          <div className="rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
+            <p className="text-sm text-gray-700">
+              A verificação em duas etapas está desativada. Ative-a para proteger sua conta com um app
+              autenticador.
+            </p>
+            <form method="POST" action="/account/mfa/enroll" className="mt-4">
+              <input type="hidden" name="_csrf" value={csrfToken} />
+              <button
+                type="submit"
+                className="rounded-lg bg-gray-900 px-4 py-2 text-sm font-semibold text-white"
+              >
+                Ativar verificação em duas etapas
+              </button>
+            </form>
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}

package/stubs/ui/react/pages/account/tokens.tsx

@@ -0,0 +1,88 @@
+{{{
+  exports({ to: app.makePath('inertia/pages/authkit/account/tokens.tsx') })
+}}}
+interface TokenRow {
+  id: string
+  name: string
+  scopes: string[]
+  audience: string | null
+  lastUsedAt: string | null
+  createdAt: string
+}
+interface Props {
+  csrfToken: string
+  createdToken: string | null
+  tokens: TokenRow[]
+}
+
+export default function AccountTokens({ csrfToken, createdToken, tokens }: Props) {
+  return (
+    <div className="min-h-screen bg-gray-100 p-4">
+      <div className="mx-auto max-w-2xl">
+        <div className="flex items-center justify-between py-6">
+          <div>
+            <div className="text-xs font-semibold uppercase tracking-[0.2em] text-gray-400">Acme</div>
+            <h1 className="text-xl font-semibold text-gray-900">Tokens de acesso</h1>
+          </div>
+          <form method="POST" action="/account/logout">
+            <input type="hidden" name="_csrf" value={csrfToken} />
+            <button type="submit" className="text-sm text-gray-500 hover:underline">
+              Sair
+            </button>
+          </form>
+        </div>
+
+        {createdToken && (
+          <div className="mb-6 rounded-lg border border-emerald-300 bg-emerald-50 p-4">
+            <p className="text-sm font-medium text-emerald-900">
+              Token criado — copie agora, não será mostrado de novo:
+            </p>
+            <code className="mt-2 block break-all rounded bg-white px-3 py-2 text-sm text-emerald-800 ring-1 ring-emerald-200">
+              {createdToken}
+            </code>
+          </div>
+        )}
+
+        <form
+          method="POST"
+          action="/account/tokens"
+          className="mb-6 flex gap-2 rounded-xl bg-white p-4 shadow-sm ring-1 ring-black/5"
+        >
+          <input type="hidden" name="_csrf" value={csrfToken} />
+          <input
+            name="name"
+            placeholder="Nome do token (ex.: CI deploy)"
+            className="flex-1 rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none focus:border-gray-900"
+          />
+          <button type="submit" className="rounded-lg bg-gray-900 px-4 text-sm font-semibold text-white">
+            Criar
+          </button>
+        </form>
+
+        <div className="overflow-hidden rounded-xl bg-white shadow-sm ring-1 ring-black/5">
+          {tokens.length === 0 ? (
+            <p className="p-6 text-sm text-gray-500">Nenhum token ainda.</p>
+          ) : (
+            tokens.map((t) => (
+              <div key={t.id} className="flex items-center justify-between border-b border-gray-100 p-4 last:border-0">
+                <div>
+                  <p className="text-sm font-medium text-gray-900">{t.name}</p>
+                  <p className="text-xs text-gray-500">
+                    Criado em {new Date(t.createdAt).toLocaleDateString('pt-BR')}
+                    {t.lastUsedAt ? ` · último uso ${new Date(t.lastUsedAt).toLocaleDateString('pt-BR')}` : ' · nunca usado'}
+                  </p>
+                </div>
+                <form method="POST" action={`/account/tokens/${t.id}/revoke`}>
+                  <input type="hidden" name="_csrf" value={csrfToken} />
+                  <button type="submit" className="text-sm text-red-600 hover:underline">
+                    Revogar
+                  </button>
+                </form>
+              </div>
+            ))
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}

package/stubs/ui/react/pages/consent.tsx

@@ -0,0 +1,39 @@
+{{{
+  exports({ to: app.makePath('inertia/pages/authkit/consent.tsx') })
+}}}
+import AuthShell, { type AuthBrand } from '../../components/auth_shell'
+
+export default function AuthkitConsent({
+  uid,
+  params,
+  csrfToken,
+  brand,
+}: {
+  uid: string
+  params: { client_id: string }
+  csrfToken: string
+  brand?: AuthBrand
+}) {
+  const accent = brand?.accent ?? '#111827'
+  const appName = brand?.appName ?? params.client_id
+
+  return (
+    <AuthShell brand={brand}>
+      <form method="POST" action={'/auth/interaction/' + uid + '/consent'}>
+        <input type="hidden" name="_csrf" value={csrfToken} />
+        <h1 className="text-xl font-semibold text-gray-900">Autorizar acesso</h1>
+        <p className="mt-2 text-sm text-gray-600">
+          O app <strong>{appName}</strong> quer acessar sua conta.
+        </p>
+
+        <button
+          type="submit"
+          className="mt-6 w-full rounded-lg py-2.5 text-sm font-semibold text-white transition hover:opacity-90"
+          style={{ backgroundColor: accent }}
+        >
+          Autorizar
+        </button>
+      </form>
+    </AuthShell>
+  )
+}