@adonis-agora/authkit-server 0.35.0 → 0.37.0

package/build/host/views/signup.edge

@@ -36,11 +36,19 @@
             class="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-gray-900 focus:ring-2 focus:ring-gray-900" />
         </div>
 
-        <div class="mt-4">
-          <label for="password" class="mb-1 block text-sm font-medium text-gray-700">{{ t('signup.password_label') }}</label>
-          <input id="password" name="password" type="password" required minlength="8"
-            class="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-gray-900 focus:ring-2 focus:ring-gray-900" />
-        </div>
+        {{-- Cadastro passwordless: sem campo de senha. O login vem por magic link. --}}
+        @if(!passwordlessSignup)
+          <div class="mt-4">
+            <label for="password" class="mb-1 block text-sm font-medium text-gray-700">{{ t('signup.password_label') }}</label>
+            <input id="password" name="password" type="password" required minlength="8"
+              class="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-gray-900 focus:ring-2 focus:ring-gray-900" />
+          </div>
+        @end
+
+        {{-- Passwordless: confirmação de link enviado (anti-enumeração). --}}
+        @if(magicLinkSent)
+          <p class="mt-4 rounded-lg bg-green-50 px-3 py-2 text-sm text-green-700">{{ t('signup.magic_link_sent') }}</p>
+        @end
 
         {{-- Bot protection: container do widget (config-trusted; HTML do host renderizado raw). --}}
         @if(botProtection && botProtection.html)

package/build/index.d.ts

@@ -13,8 +13,8 @@ export { registerOidcRoutes } from './src/register_routes.js';
 export type { AuthServerConfigInput, ResolvedServerConfig, DynamicRegistrationConfigInput, ResolvedDynamicRegistrationConfig, AdminConfigInput, ResolvedAdminConfig, AdminApiConfigInput, ResolvedAdminApiConfig, } from './src/define_config.js';
 export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration } from './src/define_config.js';
 export type { WebauthnConfigInput, ResolvedWebauthnConfig } from './src/define_config.js';
-export { resolvePasswordless, resolveLogin } from './src/define_config.js';
-export type { PasswordlessConfigInput, ResolvedPasswordlessConfig, LoginConfigInput, ResolvedLoginConfig, } from './src/define_config.js';
+export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig } from './src/define_config.js';
+export type { PasswordlessConfigInput, ResolvedPasswordlessConfig, AuthMethodsConfigInput, ResolvedAuthMethodsConfig, LoginConfigInput, ResolvedLoginConfig, } from './src/define_config.js';
 export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
 export type { TrustedDevicesConfigInput, ResolvedTrustedDevicesConfig, TrustedDevicePayload, } from './src/host/trusted_device.js';
 export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
@@ -105,8 +105,8 @@ export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
 export type { KeysStatus as ServerKeysStatus } from './src/host/key_rotation_actions.js';
 export { resolveEffectiveBotProtection, } from './src/host/bot_protection.js';
 export type { BotProtectionSetting } from './src/host/bot_protection.js';
-export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, } from './src/host/runtime_toggles.js';
-export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, MaintenanceModeSetting, ResolvedMaintenanceMode, } from './src/host/runtime_toggles.js';
+export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
+export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, MaintenanceModeSetting, ResolvedMaintenanceMode, AuthMethodsSetting, ResolvedAuthMethods, AuthMethodsCapabilities, AuthMethodsConfigOverride, } from './src/host/runtime_toggles.js';
 export { resolveRegistration } from './src/define_config.js';
 export type { RegistrationConfigInput, ResolvedRegistrationConfig, } from './src/define_config.js';
 export { getAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';

package/build/index.js

@@ -9,7 +9,7 @@ export { withMfa } from './src/mixins/with_mfa.js';
 export { OidcService } from './src/provider/oidc_service.js';
 export { registerOidcRoutes } from './src/register_routes.js';
 export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration } from './src/define_config.js';
-export { resolvePasswordless, resolveLogin } from './src/define_config.js';
+export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig } from './src/define_config.js';
 export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
 export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
 export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account_store.js';
@@ -68,7 +68,7 @@ export { RuntimeSettings, supportsSettings } from './src/host/runtime_settings.j
 export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
 export { resolveEffectiveBotProtection, } from './src/host/bot_protection.js';
 // Runtime toggles (registration, require_verified_email, maintenance_mode).
-export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, } from './src/host/runtime_toggles.js';
+export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
 export { resolveRegistration } from './src/define_config.js';
 export { getAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';
 export { ACCOUNT_SESSION_KEY } from './src/host/middleware/account_auth.js';

package/build/src/define_config.d.ts

@@ -322,12 +322,53 @@ export interface PasswordlessConfigInput {
     magicLink?: boolean;
     /** Liga o "entrar com passkey" antes da senha. Default: false. */
     passkeyFirst?: boolean;
+    /**
+     * Liga o cadastro público passwordless: o signup pede só e-mail + nome (sem
+     * senha), cria a conta com uma senha aleatória inutilizável e envia um magic
+     * link que finaliza o login (o mesmo fluxo do login por magic link). Default:
+     * false. Exige que o accountStore implemente {@link MagicLinkCapability}; sem
+     * ela o cadastro passwordless fica indisponível e o fluxo de senha segue valendo.
+     */
+    signup?: boolean;
 }
 export interface ResolvedPasswordlessConfig {
     magicLink: boolean;
     passkeyFirst: boolean;
+    signup: boolean;
 }
 export declare function resolvePasswordless(input?: PasswordlessConfigInput): ResolvedPasswordlessConfig;
+/**
+ * Fixa métodos de login PELO ARQUIVO DE CONFIG, com PRIORIDADE sobre o runtime
+ * setting `auth_methods` (o inverso do default — normalmente o runtime manda).
+ *
+ * Cada campo declarado aqui é AUTORITATIVO: o console admin não sobrescreve em
+ * runtime (a UI mostra o toggle travado, "definido no config"). Campos omitidos
+ * continuam controlados pelo runtime → default por capability.
+ *
+ * Guards preservados no resolver:
+ *   - Fixar um método em `true` só o liga se a CAPACIDADE existir (ex.: `magicLink: true`
+ *     sem store capaz continua oculto). Fixar em `false` é sempre respeitado.
+ *   - Fail-safe all-off: se pins + runtime zerarem TODOS os métodos, volta ao default
+ *     (nunca trancar todo mundo pra fora).
+ *
+ * @example
+ * // Login sem senha (magic-link + passkey), travado pelo config — sem comando por ambiente:
+ * authMethods: { password: false }
+ */
+export interface AuthMethodsConfigInput {
+    /** Fixa o login por senha. */
+    password?: boolean;
+    /** Fixa o login por magic link (respeitando a capacidade do store). */
+    magicLink?: boolean;
+    /** Fixa o "entrar com passkey" (respeitando a capacidade do store). */
+    passkey?: boolean;
+    /** Fixa o link "esqueci a senha" (só aparece com senha ligada, de qualquer forma). */
+    forgotPassword?: boolean;
+}
+/** authMethods resolvido: só os campos que o config FIXOU (os demais ficam a cargo do runtime). */
+export type ResolvedAuthMethodsConfig = AuthMethodsConfigInput;
+/** Normaliza o input: mantém só os campos booleanos declarados (os pins). */
+export declare function resolveAuthMethodsConfig(input?: AuthMethodsConfigInput): ResolvedAuthMethodsConfig;
 /**
  * Política de login por senha/identidade. Hoje cobre `requireVerifiedEmail`:
  * quando ligado, TODO fluxo de login que materializa uma sessão (login por senha,
@@ -595,6 +636,12 @@ export interface AuthServerConfigInput {
      * desligados. Exigem as capacidades correspondentes no accountStore.
      */
     passwordless?: PasswordlessConfigInput;
+    /**
+     * Fixa métodos de login pelo arquivo de config, com PRIORIDADE sobre o runtime
+     * setting `auth_methods`. Cada campo declarado trava o método (o console admin não
+     * sobrescreve). Default: `{}` (tudo controlado pelo runtime). Ver {@link AuthMethodsConfigInput}.
+     */
+    authMethods?: AuthMethodsConfigInput;
     /**
      * Política de login (hoje: `requireVerifiedEmail`). Default: tudo desligado.
      * `requireVerifiedEmail` é capability-probed (precisa de `isEmailVerified` no store).
@@ -749,6 +796,8 @@ export interface ResolvedServerConfig {
     botProtection?: ResolvedBotProtectionConfig;
     /** Passwordless resolvido (default tudo desligado). */
     passwordless: ResolvedPasswordlessConfig;
+    /** Métodos de login fixados pelo config (prioridade sobre runtime; default `{}`). */
+    authMethods: ResolvedAuthMethodsConfig;
     /** Política de login resolvida (requireVerifiedEmail; default desligado). */
     login: ResolvedLoginConfig;
     /** Configuração de cadastro público resolvida (enabled; default true). */

package/build/src/define_config.js

@@ -92,8 +92,24 @@ export function resolvePasswordless(input) {
     return {
         magicLink: input?.magicLink ?? false,
         passkeyFirst: input?.passkeyFirst ?? false,
+        signup: input?.signup ?? false,
     };
 }
+/** Normaliza o input: mantém só os campos booleanos declarados (os pins). */
+export function resolveAuthMethodsConfig(input) {
+    if (!input)
+        return {};
+    const out = {};
+    if (typeof input.password === "boolean")
+        out.password = input.password;
+    if (typeof input.magicLink === "boolean")
+        out.magicLink = input.magicLink;
+    if (typeof input.passkey === "boolean")
+        out.passkey = input.passkey;
+    if (typeof input.forgotPassword === "boolean")
+        out.forgotPassword = input.forgotPassword;
+    return out;
+}
 export function resolveLogin(input) {
     return {
         requireVerifiedEmail: input?.requireVerifiedEmail ?? false,
@@ -334,6 +350,7 @@ export function defineConfig(config) {
             trustedDevices: resolveTrustedDevices(config.trustedDevices),
             botProtection: resolveBotProtection(config.botProtection),
             passwordless: resolvePasswordless(config.passwordless),
+            authMethods: resolveAuthMethodsConfig(config.authMethods),
             login: resolveLogin(config.login),
             registration: resolveRegistration(config.registration),
             accessTokens: resolveAccessTokens(config.issuer, config.accessTokens),

package/build/src/host/config_locks.js

@@ -29,6 +29,10 @@ export function deriveLockedSettingKeys(config) {
             locked.push(key);
     };
     add(config.registration !== undefined, SETTING_KEYS.REGISTRATION);
+    // authMethods no config trava a key inteira `auth_methods`: os métodos passam a ser
+    // controlados pelo arquivo (via cfg.authMethods → configOverrides no resolver) e a UI
+    // desabilita os toggles com "definido via defineConfig".
+    add(config.authMethods !== undefined, SETTING_KEYS.AUTH_METHODS);
     add(config.login?.requireVerifiedEmail !== undefined, SETTING_KEYS.REQUIRE_VERIFIED_EMAIL);
     add(config.lockout !== undefined, SETTING_KEYS.LOCKOUT);
     add(config.rateLimit !== undefined, SETTING_KEYS.RATE_LIMIT);

package/build/src/host/controllers/interaction_controller.js

@@ -87,6 +87,7 @@ export default class AuthInteractionController {
             configuredSocialProviders,
             magicLinkCapable: magicLinkCapableConfig,
             passkeyCapable: false, // passkey-first depends on account — resolved in step 2
+            configOverrides: cfg.authMethods,
         });
         if (!email) {
             // Step 1: identifier (email only).

package/build/src/host/controllers/registration_controller.d.ts

@@ -1,6 +1,7 @@
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
 export default class AuthRegistrationController {
+    #private;
     /** GET /auth/interaction/:uid/signup — tela de cadastro (dentro do fluxo OIDC). */
     showSignup(ctx: HttpContext): Promise<any>;
     /** POST /auth/interaction/:uid/signup — cria o usuário e finaliza o login. */

package/build/src/host/controllers/registration_controller.js

@@ -1,7 +1,8 @@
 import '../augmentations.js';
 import { brandFor } from '../branding.js';
-import { signupValidator, forgotPasswordValidator, resetPasswordValidator } from '../validators.js';
-import { sendPasswordResetEmail, sendEmailVerificationEmail } from '../default_mailer.js';
+import { randomBytes } from 'node:crypto';
+import { signupValidator, passwordlessSignupValidator, forgotPasswordValidator, resetPasswordValidator, } from '../validators.js';
+import { sendPasswordResetEmail, sendEmailVerificationEmail, sendMagicLinkEmail, } from '../default_mailer.js';
 import { translate } from '../i18n.js';
 import { PasswordPolicyError } from '../../password/password_manager.js';
 import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
@@ -54,6 +55,7 @@ export default class AuthRegistrationController {
             uid: details.uid,
             csrfToken: ctx.request.csrfToken,
             brand,
+            passwordlessSignup: cfg.passwordless?.signup ?? false,
             botProtection: effectiveBot?.on.includes('signup') ? effectiveBot.widget : undefined,
         });
     }
@@ -102,6 +104,12 @@ export default class AuthRegistrationController {
                 botProtection: effectiveBotSignup?.widget,
             });
         }
+        // Cadastro passwordless (config): só e-mail + nome. Cria conta com senha random
+        // inutilizável e envia um magic link — mesmo fluxo do login por magic link.
+        if (cfg.passwordless?.signup &&
+            typeof cfg.accountStore.issueMagicLinkToken === 'function') {
+            return this.#passwordlessSignup(ctx, { cfg, brand, details });
+        }
         const data = await ctx.request.validateUsing(signupValidator);
         const accountStore = cfg.accountStore;
         const existing = await accountStore.findByEmail(data.email);
@@ -183,6 +191,55 @@ export default class AuthRegistrationController {
             ctx.logger.error({ err: error, email: data.email }, 'authkit: falha ao enviar verificação de e-mail');
         }
     }
+    /**
+     * Cadastro passwordless: valida e-mail + nome, cria a conta (senha random
+     * inutilizável) se ainda não existe, emite um magic link e o envia. Sempre
+     * responde "link enviado" (anti-enumeração), exista a conta ou não. Consumir o
+     * link finaliza o login pelo fluxo de magic link já existente (GET /magic).
+     */
+    async #passwordlessSignup(ctx, deps) {
+        const { cfg, brand, details } = deps;
+        const render = cfg.render;
+        const accountStore = cfg.accountStore;
+        const uid = ctx.request.param('uid');
+        const data = await ctx.request.validateUsing(passwordlessSignupValidator);
+        // Cria a conta se ainda não existe. Senha random inutilizável: o login é 100%
+        // passwordless (mesmo precedente das contas criadas por identidade social).
+        const existing = await accountStore.findByEmail(data.email);
+        if (!existing) {
+            const created = await accountStore.create({
+                email: data.email,
+                fullName: data.fullName,
+                password: randomBytes(24).toString('hex'),
+            });
+            await cfg.audit?.record({
+                type: 'signup',
+                accountId: created.id,
+                email: data.email,
+                ip: ctx.request.ip?.() ?? null,
+                clientId: details.params.client_id ?? null,
+            });
+        }
+        // Emite + envia o magic link (mesma construção do login por magic link).
+        const issued = await accountStore.issueMagicLinkToken(data.email);
+        if (issued) {
+            const origin = `${ctx.request.protocol()}://${ctx.request.host()}`;
+            const magicUrl = `${origin}/auth/interaction/${uid}/magic?token=${encodeURIComponent(issued.token)}`;
+            if (cfg.mail?.onMagicLink) {
+                await cfg.mail.onMagicLink({ email: data.email, magicUrl, token: issued.token });
+            }
+            else {
+                await sendMagicLinkEmail(ctx, { email: data.email, magicUrl });
+            }
+        }
+        // Resposta uniforme: "enviamos um link" (não vaza existência da conta).
+        return render(ctx, 'signup', {
+            uid,
+            csrfToken: ctx.request.csrfToken,
+            brand,
+            magicLinkSent: true,
+        });
+    }
     /** GET /auth/forgot-password — tela standalone. */
     async showForgot(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
@@ -201,6 +258,7 @@ export default class AuthRegistrationController {
         const authMethods = await resolveEffectiveAuthMethods(runtimeSettings, {
             configuredSocialProviders: cfg.social?.providers ?? [],
             magicLinkCapable: cfg.passwordless?.magicLink && typeof cfg.accountStore.issueMagicLinkToken === 'function',
+            configOverrides: cfg.authMethods,
         });
         if (!authMethods.forgotPassword) {
             return ctx.response.notFound({ error: translate(cfg.messages, 'errors.not_found') });
@@ -229,6 +287,7 @@ export default class AuthRegistrationController {
         const authMethods = await resolveEffectiveAuthMethods(runtimeSettings, {
             configuredSocialProviders: cfg.social?.providers ?? [],
             magicLinkCapable: cfg.passwordless?.magicLink && typeof cfg.accountStore.issueMagicLinkToken === 'function',
+            configOverrides: cfg.authMethods,
         });
         if (!authMethods.forgotPassword) {
             return ctx.response.notFound({ error: translate(cfg.messages, 'errors.not_found') });

package/build/src/host/i18n.d.ts

@@ -48,6 +48,7 @@ export declare const DEFAULT_MESSAGES: {
     "account.login.idle_timeout": string;
     "login.magic_link_button": string;
     "login.magic_link_sent": string;
+    "signup.magic_link_sent": string;
     "login.passkey_button": string;
     "signup.page_title": string;
     "signup.title": string;
@@ -734,6 +735,7 @@ export declare const PT_BR_MESSAGES: {
     "account.login.idle_timeout": string;
     "login.magic_link_button": string;
     "login.magic_link_sent": string;
+    "signup.magic_link_sent": string;
     "login.passkey_button": string;
     "signup.page_title": string;
     "signup.title": string;

package/build/src/host/i18n.js

@@ -39,6 +39,7 @@ export const DEFAULT_MESSAGES = {
     // Passwordless (login).
     "login.magic_link_button": "Email me a login link",
     "login.magic_link_sent": "If the account exists, we sent you a login link.",
+    "signup.magic_link_sent": "Check your email — we sent you a link to finish creating your account.",
     "login.passkey_button": "Sign in with a passkey",
     // Tela de cadastro (signup).
     "signup.page_title": "Create account",
@@ -803,6 +804,7 @@ export const PT_BR_MESSAGES = {
     // Passwordless (login).
     "login.magic_link_button": "Me envie um link de login",
     "login.magic_link_sent": "Se a conta existir, enviamos um link de login.",
+    "signup.magic_link_sent": "Enviamos um link para o seu e-mail. Abra-o para concluir o cadastro.",
     "login.passkey_button": "Entrar com passkey",
     // Tela de cadastro (signup).
     "signup.page_title": "Criar conta",

package/build/src/host/runtime_toggles.d.ts

@@ -202,7 +202,27 @@ export interface AuthMethodsCapabilities {
     magicLinkCapable?: boolean;
     /** Passkey-first disponível (config.passwordless.passkeyFirst && store tem passkeys). */
     passkeyCapable?: boolean;
+    /**
+     * Pins vindos do ARQUIVO DE CONFIG (`cfg.authMethods`): têm PRIORIDADE sobre o
+     * runtime setting `auth_methods`. Cada campo presente sobrescreve o valor resolvido
+     * do setting. Ligar respeita as capacidades (magicLink/passkey só ligam se capable);
+     * desligar é sempre respeitado. Campos ausentes seguem controlados pelo runtime.
+     */
+    configOverrides?: AuthMethodsConfigOverride;
 }
+/** Métodos que o config pode FIXAR (prioridade sobre runtime). Só os campos declarados travam. */
+export interface AuthMethodsConfigOverride {
+    password?: boolean;
+    magicLink?: boolean;
+    passkey?: boolean;
+    forgotPassword?: boolean;
+}
+/**
+ * Quais métodos estão TRAVADOS pelo config (para a UI admin mostrar o toggle
+ * desabilitado com "definido no arquivo de config"). É só a lista de campos
+ * booleanos presentes em `configOverrides`.
+ */
+export declare function configLockedAuthMethods(configOverrides?: AuthMethodsConfigOverride): Array<keyof AuthMethodsConfigOverride>;
 /**
  * Resolve os métodos de autenticação efetivos combinando config estático + setting
  * persistida em runtime + capabilities.

package/build/src/host/runtime_toggles.js

@@ -127,6 +127,22 @@ export async function resolveEffectiveMaintenanceMode(settings) {
         message: typeof setting.message === 'string' ? setting.message : undefined,
     };
 }
+/**
+ * Quais métodos estão TRAVADOS pelo config (para a UI admin mostrar o toggle
+ * desabilitado com "definido no arquivo de config"). É só a lista de campos
+ * booleanos presentes em `configOverrides`.
+ */
+export function configLockedAuthMethods(configOverrides) {
+    if (!configOverrides)
+        return [];
+    const keys = [
+        'password',
+        'magicLink',
+        'passkey',
+        'forgotPassword',
+    ];
+    return keys.filter((k) => typeof configOverrides[k] === 'boolean');
+}
 /**
  * Resolve os métodos de autenticação efetivos combinando config estático + setting
  * persistida em runtime + capabilities.
@@ -143,7 +159,7 @@ export async function resolveEffectiveMaintenanceMode(settings) {
  *   6. Qualquer erro DB → defaults derivados do config (fail-safe total).
  */
 export async function resolveEffectiveAuthMethods(settings, capabilities = {}) {
-    const { configuredSocialProviders = [], magicLinkCapable = false, passkeyCapable = false, } = capabilities;
+    const { configuredSocialProviders = [], magicLinkCapable = false, passkeyCapable = false, configOverrides, } = capabilities;
     // Defaults derivados do config/capabilities.
     const configDefaults = {
         password: true,
@@ -153,47 +169,55 @@ export async function resolveEffectiveAuthMethods(settings, capabilities = {}) {
         forgotPassword: true,
         passkeyAutofill: passkeyCapable, // on por default quando passkey disponível
     };
+    // 1) Runtime setting sobre os defaults (setting ausente/inválida → só defaults).
     const raw = await settings.getSetting(SETTING_KEYS.AUTH_METHODS);
-    if (raw === null || raw === undefined)
-        return configDefaults;
-    if (typeof raw !== 'object' || Array.isArray(raw))
-        return configDefaults; // shape inválida
-    const s = raw;
-    // Aplica campo a campo, com fallback ao default quando o campo está ausente.
-    const passwordEnabled = typeof s.password === 'boolean' ? s.password : configDefaults.password;
-    const magicLinkEnabled = typeof s.magicLink === 'boolean' ? s.magicLink : configDefaults.magicLink;
-    const passkeyEnabled = typeof s.passkey === 'boolean' ? s.passkey : configDefaults.passkey;
+    const s = raw !== null && raw !== undefined && typeof raw === 'object' && !Array.isArray(raw)
+        ? raw
+        : {};
+    let password = typeof s.password === 'boolean' ? s.password : configDefaults.password;
+    let magicLink = typeof s.magicLink === 'boolean' ? s.magicLink : configDefaults.magicLink;
+    let passkey = typeof s.passkey === 'boolean' ? s.passkey : configDefaults.passkey;
     // Social: interseção com os providers do config (setting não pode ligar o que não existe).
-    let socialEnabled;
-    if (Array.isArray(s.social)) {
-        socialEnabled = s.social.filter((p) => configuredSocialProviders.includes(p));
-    }
-    else {
-        socialEnabled = configDefaults.social;
-    }
-    // forgotPassword: derivado automaticamente — sem senha NUNCA existe esqueci-senha.
-    const forgotPasswordEnabled = passwordEnabled && (typeof s.forgotPassword === 'boolean' ? s.forgotPassword : true);
+    const social = Array.isArray(s.social)
+        ? s.social.filter((p) => configuredSocialProviders.includes(p))
+        : configDefaults.social;
+    // 2) Pins do config: PRIORIDADE sobre o setting. Ligar respeita a capacidade;
+    //    desligar sempre vale. `password` não tem guard de capacidade.
+    if (configOverrides) {
+        if (typeof configOverrides.password === 'boolean')
+            password = configOverrides.password;
+        if (typeof configOverrides.magicLink === 'boolean')
+            magicLink = configOverrides.magicLink && magicLinkCapable;
+        if (typeof configOverrides.passkey === 'boolean')
+            passkey = configOverrides.passkey && passkeyCapable;
+    }
+    // forgotPassword: derivado — sem senha NUNCA existe esqueci-senha. O pin/setting só
+    // pode DESLIGAR (nunca ligar sem senha). Precedência: pin do config > setting > default(on).
+    const forgotPasswordRequested = typeof configOverrides?.forgotPassword === 'boolean'
+        ? configOverrides.forgotPassword
+        : typeof s.forgotPassword === 'boolean'
+            ? s.forgotPassword
+            : true;
+    const forgotPassword = password && forgotPasswordRequested;
     // passkeyAutofill: só faz sentido quando passkey está ligado.
-    const passkeyAutofillEnabled = passkeyEnabled &&
+    const passkeyAutofill = passkey &&
         (typeof s.passkeyAutofill === 'boolean' ? s.passkeyAutofill : configDefaults.passkeyAutofill);
     const resolved = {
-        password: passwordEnabled,
-        magicLink: magicLinkEnabled,
-        passkey: passkeyEnabled,
-        social: socialEnabled,
-        forgotPassword: forgotPasswordEnabled,
-        passkeyAutofill: passkeyAutofillEnabled,
+        password,
+        magicLink,
+        passkey,
+        social,
+        forgotPassword,
+        passkeyAutofill,
     };
-    // FAIL-SAFE all-off: se todos ficaram false/vazio, volta ao config derivado.
-    const allOff = !resolved.password &&
-        !resolved.magicLink &&
-        !resolved.passkey &&
-        resolved.social.length === 0;
+    // FAIL-SAFE all-off: se pins + setting zerarem TODOS os métodos, volta ao config derivado
+    // (nunca deixar a tela sem método / trancar todo mundo pra fora).
+    const allOff = !resolved.password && !resolved.magicLink && !resolved.passkey && resolved.social.length === 0;
     if (allOff) {
         // eslint-disable-next-line no-console
-        console.warn('[authkit] auth_methods setting deixou todos os métodos desligados — ' +
+        console.warn('[authkit] auth_methods (config pins + setting) deixou todos os métodos desligados — ' +
             'revertendo para os defaults do config (fail-safe). ' +
-            'Verifique a setting auth_methods no console admin.');
+            'Verifique cfg.authMethods e a setting auth_methods no console admin.');
         return configDefaults;
     }
     return resolved;

package/build/src/host/validators.d.ts

@@ -1,3 +1,17 @@
+/** Cadastro passwordless: só e-mail + nome (sem senha). O login vem por magic link. */
+export declare const passwordlessSignupValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
+    email: import("@vinejs/vine").VineString;
+    fullName: import("@vinejs/vine").VineString;
+}, {
+    email: string;
+    fullName: string;
+}, {
+    email: string;
+    fullName: string;
+}, {
+    email: string;
+    fullName: string;
+}>, Record<string, any> | undefined>;
 export declare const signupValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
     email: import("@vinejs/vine").VineString;
     fullName: import("@vinejs/vine").VineString;

package/build/src/host/validators.js

@@ -1,4 +1,9 @@
 import vine from '@vinejs/vine';
+/** Cadastro passwordless: só e-mail + nome (sem senha). O login vem por magic link. */
+export const passwordlessSignupValidator = vine.compile(vine.object({
+    email: vine.string().trim().email().normalizeEmail(),
+    fullName: vine.string().trim().minLength(2).maxLength(255),
+}));
 export const signupValidator = vine.compile(vine.object({
     email: vine.string().trim().email().normalizeEmail(),
     fullName: vine.string().trim().minLength(2).maxLength(255),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -140,7 +140,7 @@
     "react-error-boundary": "6.1.2",
     "nuqs": "2.8.9",
     "recharts": "3.8.1",
-    "@adonis-agora/authkit-react": "0.13.1"
+    "@adonis-agora/authkit-react": "0.16.0"
   },
   "scripts": {
     "build": "node scripts/build_host_css.mjs && node scripts/build_ui.mjs && tsc && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/password/common_passwords.txt')\"",