@adonis-agora/authkit-server 0.35.0 → 0.36.0

package/build/host/views/signup.edge

@@ -36,11 +36,19 @@
             class="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-gray-900 focus:ring-2 focus:ring-gray-900" />
         </div>
 
-        <div class="mt-4">
-          <label for="password" class="mb-1 block text-sm font-medium text-gray-700">{{ t('signup.password_label') }}</label>
-          <input id="password" name="password" type="password" required minlength="8"
-            class="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-gray-900 focus:ring-2 focus:ring-gray-900" />
-        </div>
+        {{-- Cadastro passwordless: sem campo de senha. O login vem por magic link. --}}
+        @if(!passwordlessSignup)
+          <div class="mt-4">
+            <label for="password" class="mb-1 block text-sm font-medium text-gray-700">{{ t('signup.password_label') }}</label>
+            <input id="password" name="password" type="password" required minlength="8"
+              class="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-gray-900 focus:ring-2 focus:ring-gray-900" />
+          </div>
+        @end
+
+        {{-- Passwordless: confirmação de link enviado (anti-enumeração). --}}
+        @if(magicLinkSent)
+          <p class="mt-4 rounded-lg bg-green-50 px-3 py-2 text-sm text-green-700">{{ t('signup.magic_link_sent') }}</p>
+        @end
 
         {{-- Bot protection: container do widget (config-trusted; HTML do host renderizado raw). --}}
         @if(botProtection && botProtection.html)

package/build/src/define_config.d.ts

@@ -322,10 +322,19 @@ export interface PasswordlessConfigInput {
     magicLink?: boolean;
     /** Liga o "entrar com passkey" antes da senha. Default: false. */
     passkeyFirst?: boolean;
+    /**
+     * Liga o cadastro público passwordless: o signup pede só e-mail + nome (sem
+     * senha), cria a conta com uma senha aleatória inutilizável e envia um magic
+     * link que finaliza o login (o mesmo fluxo do login por magic link). Default:
+     * false. Exige que o accountStore implemente {@link MagicLinkCapability}; sem
+     * ela o cadastro passwordless fica indisponível e o fluxo de senha segue valendo.
+     */
+    signup?: boolean;
 }
 export interface ResolvedPasswordlessConfig {
     magicLink: boolean;
     passkeyFirst: boolean;
+    signup: boolean;
 }
 export declare function resolvePasswordless(input?: PasswordlessConfigInput): ResolvedPasswordlessConfig;
 /**

package/build/src/define_config.js

@@ -92,6 +92,7 @@ export function resolvePasswordless(input) {
     return {
         magicLink: input?.magicLink ?? false,
         passkeyFirst: input?.passkeyFirst ?? false,
+        signup: input?.signup ?? false,
     };
 }
 export function resolveLogin(input) {

package/build/src/host/controllers/registration_controller.d.ts

@@ -1,6 +1,7 @@
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
 export default class AuthRegistrationController {
+    #private;
     /** GET /auth/interaction/:uid/signup — tela de cadastro (dentro do fluxo OIDC). */
     showSignup(ctx: HttpContext): Promise<any>;
     /** POST /auth/interaction/:uid/signup — cria o usuário e finaliza o login. */

package/build/src/host/controllers/registration_controller.js

@@ -1,7 +1,8 @@
 import '../augmentations.js';
 import { brandFor } from '../branding.js';
-import { signupValidator, forgotPasswordValidator, resetPasswordValidator } from '../validators.js';
-import { sendPasswordResetEmail, sendEmailVerificationEmail } from '../default_mailer.js';
+import { randomBytes } from 'node:crypto';
+import { signupValidator, passwordlessSignupValidator, forgotPasswordValidator, resetPasswordValidator, } from '../validators.js';
+import { sendPasswordResetEmail, sendEmailVerificationEmail, sendMagicLinkEmail, } from '../default_mailer.js';
 import { translate } from '../i18n.js';
 import { PasswordPolicyError } from '../../password/password_manager.js';
 import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
@@ -54,6 +55,7 @@ export default class AuthRegistrationController {
             uid: details.uid,
             csrfToken: ctx.request.csrfToken,
             brand,
+            passwordlessSignup: cfg.passwordless?.signup ?? false,
             botProtection: effectiveBot?.on.includes('signup') ? effectiveBot.widget : undefined,
         });
     }
@@ -102,6 +104,12 @@ export default class AuthRegistrationController {
                 botProtection: effectiveBotSignup?.widget,
             });
         }
+        // Cadastro passwordless (config): só e-mail + nome. Cria conta com senha random
+        // inutilizável e envia um magic link — mesmo fluxo do login por magic link.
+        if (cfg.passwordless?.signup &&
+            typeof cfg.accountStore.issueMagicLinkToken === 'function') {
+            return this.#passwordlessSignup(ctx, { cfg, brand, details });
+        }
         const data = await ctx.request.validateUsing(signupValidator);
         const accountStore = cfg.accountStore;
         const existing = await accountStore.findByEmail(data.email);
@@ -183,6 +191,55 @@ export default class AuthRegistrationController {
             ctx.logger.error({ err: error, email: data.email }, 'authkit: falha ao enviar verificação de e-mail');
         }
     }
+    /**
+     * Cadastro passwordless: valida e-mail + nome, cria a conta (senha random
+     * inutilizável) se ainda não existe, emite um magic link e o envia. Sempre
+     * responde "link enviado" (anti-enumeração), exista a conta ou não. Consumir o
+     * link finaliza o login pelo fluxo de magic link já existente (GET /magic).
+     */
+    async #passwordlessSignup(ctx, deps) {
+        const { cfg, brand, details } = deps;
+        const render = cfg.render;
+        const accountStore = cfg.accountStore;
+        const uid = ctx.request.param('uid');
+        const data = await ctx.request.validateUsing(passwordlessSignupValidator);
+        // Cria a conta se ainda não existe. Senha random inutilizável: o login é 100%
+        // passwordless (mesmo precedente das contas criadas por identidade social).
+        const existing = await accountStore.findByEmail(data.email);
+        if (!existing) {
+            const created = await accountStore.create({
+                email: data.email,
+                fullName: data.fullName,
+                password: randomBytes(24).toString('hex'),
+            });
+            await cfg.audit?.record({
+                type: 'signup',
+                accountId: created.id,
+                email: data.email,
+                ip: ctx.request.ip?.() ?? null,
+                clientId: details.params.client_id ?? null,
+            });
+        }
+        // Emite + envia o magic link (mesma construção do login por magic link).
+        const issued = await accountStore.issueMagicLinkToken(data.email);
+        if (issued) {
+            const origin = `${ctx.request.protocol()}://${ctx.request.host()}`;
+            const magicUrl = `${origin}/auth/interaction/${uid}/magic?token=${encodeURIComponent(issued.token)}`;
+            if (cfg.mail?.onMagicLink) {
+                await cfg.mail.onMagicLink({ email: data.email, magicUrl, token: issued.token });
+            }
+            else {
+                await sendMagicLinkEmail(ctx, { email: data.email, magicUrl });
+            }
+        }
+        // Resposta uniforme: "enviamos um link" (não vaza existência da conta).
+        return render(ctx, 'signup', {
+            uid,
+            csrfToken: ctx.request.csrfToken,
+            brand,
+            magicLinkSent: true,
+        });
+    }
     /** GET /auth/forgot-password — tela standalone. */
     async showForgot(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');

package/build/src/host/i18n.d.ts

@@ -48,6 +48,7 @@ export declare const DEFAULT_MESSAGES: {
     "account.login.idle_timeout": string;
     "login.magic_link_button": string;
     "login.magic_link_sent": string;
+    "signup.magic_link_sent": string;
     "login.passkey_button": string;
     "signup.page_title": string;
     "signup.title": string;
@@ -734,6 +735,7 @@ export declare const PT_BR_MESSAGES: {
     "account.login.idle_timeout": string;
     "login.magic_link_button": string;
     "login.magic_link_sent": string;
+    "signup.magic_link_sent": string;
     "login.passkey_button": string;
     "signup.page_title": string;
     "signup.title": string;

package/build/src/host/i18n.js

@@ -39,6 +39,7 @@ export const DEFAULT_MESSAGES = {
     // Passwordless (login).
     "login.magic_link_button": "Email me a login link",
     "login.magic_link_sent": "If the account exists, we sent you a login link.",
+    "signup.magic_link_sent": "Check your email — we sent you a link to finish creating your account.",
     "login.passkey_button": "Sign in with a passkey",
     // Tela de cadastro (signup).
     "signup.page_title": "Create account",
@@ -803,6 +804,7 @@ export const PT_BR_MESSAGES = {
     // Passwordless (login).
     "login.magic_link_button": "Me envie um link de login",
     "login.magic_link_sent": "Se a conta existir, enviamos um link de login.",
+    "signup.magic_link_sent": "Enviamos um link para o seu e-mail. Abra-o para concluir o cadastro.",
     "login.passkey_button": "Entrar com passkey",
     // Tela de cadastro (signup).
     "signup.page_title": "Criar conta",

package/build/src/host/validators.d.ts

@@ -1,3 +1,17 @@
+/** Cadastro passwordless: só e-mail + nome (sem senha). O login vem por magic link. */
+export declare const passwordlessSignupValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    email: import("@vinejs/vine").VineString;
+    fullName: import("@vinejs/vine").VineString;
+}, {
+    email: string;
+    fullName: string;
+}, {
+    email: string;
+    fullName: string;
+}, {
+    email: string;
+    fullName: string;
+}>, Record<string, any> | undefined>;
 export declare const signupValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
     email: import("@vinejs/vine").VineString;
     fullName: import("@vinejs/vine").VineString;

package/build/src/host/validators.js

@@ -1,4 +1,9 @@
 import vine from '@vinejs/vine';
+/** Cadastro passwordless: só e-mail + nome (sem senha). O login vem por magic link. */
+export const passwordlessSignupValidator = vine.compile(vine.object({
+    email: vine.string().trim().email().normalizeEmail(),
+    fullName: vine.string().trim().minLength(2).maxLength(255),
+}));
 export const signupValidator = vine.compile(vine.object({
     email: vine.string().trim().email().normalizeEmail(),
     fullName: vine.string().trim().minLength(2).maxLength(255),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -140,7 +140,7 @@
     "react-error-boundary": "6.1.2",
     "nuqs": "2.8.9",
     "recharts": "3.8.1",
-    "@adonis-agora/authkit-react": "0.13.1"
+    "@adonis-agora/authkit-react": "0.14.0"
   },
   "scripts": {
     "build": "node scripts/build_host_css.mjs && node scripts/build_ui.mjs && tsc && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/password/common_passwords.txt')\"",