@adonis-agora/authkit-server 0.36.0 → 0.37.0

package/build/index.d.ts

@@ -13,8 +13,8 @@ export { registerOidcRoutes } from './src/register_routes.js';
 export type { AuthServerConfigInput, ResolvedServerConfig, DynamicRegistrationConfigInput, ResolvedDynamicRegistrationConfig, AdminConfigInput, ResolvedAdminConfig, AdminApiConfigInput, ResolvedAdminApiConfig, } from './src/define_config.js';
 export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration } from './src/define_config.js';
 export type { WebauthnConfigInput, ResolvedWebauthnConfig } from './src/define_config.js';
-export { resolvePasswordless, resolveLogin } from './src/define_config.js';
-export type { PasswordlessConfigInput, ResolvedPasswordlessConfig, LoginConfigInput, ResolvedLoginConfig, } from './src/define_config.js';
+export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig } from './src/define_config.js';
+export type { PasswordlessConfigInput, ResolvedPasswordlessConfig, AuthMethodsConfigInput, ResolvedAuthMethodsConfig, LoginConfigInput, ResolvedLoginConfig, } from './src/define_config.js';
 export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
 export type { TrustedDevicesConfigInput, ResolvedTrustedDevicesConfig, TrustedDevicePayload, } from './src/host/trusted_device.js';
 export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
@@ -105,8 +105,8 @@ export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
 export type { KeysStatus as ServerKeysStatus } from './src/host/key_rotation_actions.js';
 export { resolveEffectiveBotProtection, } from './src/host/bot_protection.js';
 export type { BotProtectionSetting } from './src/host/bot_protection.js';
-export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, } from './src/host/runtime_toggles.js';
-export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, MaintenanceModeSetting, ResolvedMaintenanceMode, } from './src/host/runtime_toggles.js';
+export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
+export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, MaintenanceModeSetting, ResolvedMaintenanceMode, AuthMethodsSetting, ResolvedAuthMethods, AuthMethodsCapabilities, AuthMethodsConfigOverride, } from './src/host/runtime_toggles.js';
 export { resolveRegistration } from './src/define_config.js';
 export type { RegistrationConfigInput, ResolvedRegistrationConfig, } from './src/define_config.js';
 export { getAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';

package/build/index.js

@@ -9,7 +9,7 @@ export { withMfa } from './src/mixins/with_mfa.js';
 export { OidcService } from './src/provider/oidc_service.js';
 export { registerOidcRoutes } from './src/register_routes.js';
 export { resolveAdmin, resolveAdminApi, resolveWebauthn, resolveDynamicRegistration } from './src/define_config.js';
-export { resolvePasswordless, resolveLogin } from './src/define_config.js';
+export { resolvePasswordless, resolveLogin, resolveAuthMethodsConfig } from './src/define_config.js';
 export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload, TRUSTED_DEVICE_COOKIE, } from './src/host/trusted_device.js';
 export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
 export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account_store.js';
@@ -68,7 +68,7 @@ export { RuntimeSettings, supportsSettings } from './src/host/runtime_settings.j
 export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
 export { resolveEffectiveBotProtection, } from './src/host/bot_protection.js';
 // Runtime toggles (registration, require_verified_email, maintenance_mode).
-export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, } from './src/host/runtime_toggles.js';
+export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
 export { resolveRegistration } from './src/define_config.js';
 export { getAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';
 export { ACCOUNT_SESSION_KEY } from './src/host/middleware/account_auth.js';

package/build/src/define_config.d.ts

@@ -337,6 +337,38 @@ export interface ResolvedPasswordlessConfig {
     signup: boolean;
 }
 export declare function resolvePasswordless(input?: PasswordlessConfigInput): ResolvedPasswordlessConfig;
+/**
+ * Fixa métodos de login PELO ARQUIVO DE CONFIG, com PRIORIDADE sobre o runtime
+ * setting `auth_methods` (o inverso do default — normalmente o runtime manda).
+ *
+ * Cada campo declarado aqui é AUTORITATIVO: o console admin não sobrescreve em
+ * runtime (a UI mostra o toggle travado, "definido no config"). Campos omitidos
+ * continuam controlados pelo runtime → default por capability.
+ *
+ * Guards preservados no resolver:
+ *   - Fixar um método em `true` só o liga se a CAPACIDADE existir (ex.: `magicLink: true`
+ *     sem store capaz continua oculto). Fixar em `false` é sempre respeitado.
+ *   - Fail-safe all-off: se pins + runtime zerarem TODOS os métodos, volta ao default
+ *     (nunca trancar todo mundo pra fora).
+ *
+ * @example
+ * // Login sem senha (magic-link + passkey), travado pelo config — sem comando por ambiente:
+ * authMethods: { password: false }
+ */
+export interface AuthMethodsConfigInput {
+    /** Fixa o login por senha. */
+    password?: boolean;
+    /** Fixa o login por magic link (respeitando a capacidade do store). */
+    magicLink?: boolean;
+    /** Fixa o "entrar com passkey" (respeitando a capacidade do store). */
+    passkey?: boolean;
+    /** Fixa o link "esqueci a senha" (só aparece com senha ligada, de qualquer forma). */
+    forgotPassword?: boolean;
+}
+/** authMethods resolvido: só os campos que o config FIXOU (os demais ficam a cargo do runtime). */
+export type ResolvedAuthMethodsConfig = AuthMethodsConfigInput;
+/** Normaliza o input: mantém só os campos booleanos declarados (os pins). */
+export declare function resolveAuthMethodsConfig(input?: AuthMethodsConfigInput): ResolvedAuthMethodsConfig;
 /**
  * Política de login por senha/identidade. Hoje cobre `requireVerifiedEmail`:
  * quando ligado, TODO fluxo de login que materializa uma sessão (login por senha,
@@ -604,6 +636,12 @@ export interface AuthServerConfigInput {
      * desligados. Exigem as capacidades correspondentes no accountStore.
      */
     passwordless?: PasswordlessConfigInput;
+    /**
+     * Fixa métodos de login pelo arquivo de config, com PRIORIDADE sobre o runtime
+     * setting `auth_methods`. Cada campo declarado trava o método (o console admin não
+     * sobrescreve). Default: `{}` (tudo controlado pelo runtime). Ver {@link AuthMethodsConfigInput}.
+     */
+    authMethods?: AuthMethodsConfigInput;
     /**
      * Política de login (hoje: `requireVerifiedEmail`). Default: tudo desligado.
      * `requireVerifiedEmail` é capability-probed (precisa de `isEmailVerified` no store).
@@ -758,6 +796,8 @@ export interface ResolvedServerConfig {
     botProtection?: ResolvedBotProtectionConfig;
     /** Passwordless resolvido (default tudo desligado). */
     passwordless: ResolvedPasswordlessConfig;
+    /** Métodos de login fixados pelo config (prioridade sobre runtime; default `{}`). */
+    authMethods: ResolvedAuthMethodsConfig;
     /** Política de login resolvida (requireVerifiedEmail; default desligado). */
     login: ResolvedLoginConfig;
     /** Configuração de cadastro público resolvida (enabled; default true). */

package/build/src/define_config.js

@@ -95,6 +95,21 @@ export function resolvePasswordless(input) {
         signup: input?.signup ?? false,
     };
 }
+/** Normaliza o input: mantém só os campos booleanos declarados (os pins). */
+export function resolveAuthMethodsConfig(input) {
+    if (!input)
+        return {};
+    const out = {};
+    if (typeof input.password === "boolean")
+        out.password = input.password;
+    if (typeof input.magicLink === "boolean")
+        out.magicLink = input.magicLink;
+    if (typeof input.passkey === "boolean")
+        out.passkey = input.passkey;
+    if (typeof input.forgotPassword === "boolean")
+        out.forgotPassword = input.forgotPassword;
+    return out;
+}
 export function resolveLogin(input) {
     return {
         requireVerifiedEmail: input?.requireVerifiedEmail ?? false,
@@ -335,6 +350,7 @@ export function defineConfig(config) {
             trustedDevices: resolveTrustedDevices(config.trustedDevices),
             botProtection: resolveBotProtection(config.botProtection),
             passwordless: resolvePasswordless(config.passwordless),
+            authMethods: resolveAuthMethodsConfig(config.authMethods),
             login: resolveLogin(config.login),
             registration: resolveRegistration(config.registration),
             accessTokens: resolveAccessTokens(config.issuer, config.accessTokens),

package/build/src/host/config_locks.js

@@ -29,6 +29,10 @@ export function deriveLockedSettingKeys(config) {
             locked.push(key);
     };
     add(config.registration !== undefined, SETTING_KEYS.REGISTRATION);
+    // authMethods no config trava a key inteira `auth_methods`: os métodos passam a ser
+    // controlados pelo arquivo (via cfg.authMethods → configOverrides no resolver) e a UI
+    // desabilita os toggles com "definido via defineConfig".
+    add(config.authMethods !== undefined, SETTING_KEYS.AUTH_METHODS);
     add(config.login?.requireVerifiedEmail !== undefined, SETTING_KEYS.REQUIRE_VERIFIED_EMAIL);
     add(config.lockout !== undefined, SETTING_KEYS.LOCKOUT);
     add(config.rateLimit !== undefined, SETTING_KEYS.RATE_LIMIT);

package/build/src/host/controllers/interaction_controller.js

@@ -87,6 +87,7 @@ export default class AuthInteractionController {
             configuredSocialProviders,
             magicLinkCapable: magicLinkCapableConfig,
             passkeyCapable: false, // passkey-first depends on account — resolved in step 2
+            configOverrides: cfg.authMethods,
         });
         if (!email) {
             // Step 1: identifier (email only).

package/build/src/host/controllers/registration_controller.js

@@ -258,6 +258,7 @@ export default class AuthRegistrationController {
         const authMethods = await resolveEffectiveAuthMethods(runtimeSettings, {
             configuredSocialProviders: cfg.social?.providers ?? [],
             magicLinkCapable: cfg.passwordless?.magicLink && typeof cfg.accountStore.issueMagicLinkToken === 'function',
+            configOverrides: cfg.authMethods,
         });
         if (!authMethods.forgotPassword) {
             return ctx.response.notFound({ error: translate(cfg.messages, 'errors.not_found') });
@@ -286,6 +287,7 @@ export default class AuthRegistrationController {
         const authMethods = await resolveEffectiveAuthMethods(runtimeSettings, {
             configuredSocialProviders: cfg.social?.providers ?? [],
             magicLinkCapable: cfg.passwordless?.magicLink && typeof cfg.accountStore.issueMagicLinkToken === 'function',
+            configOverrides: cfg.authMethods,
         });
         if (!authMethods.forgotPassword) {
             return ctx.response.notFound({ error: translate(cfg.messages, 'errors.not_found') });

package/build/src/host/runtime_toggles.d.ts

@@ -202,7 +202,27 @@ export interface AuthMethodsCapabilities {
     magicLinkCapable?: boolean;
     /** Passkey-first disponível (config.passwordless.passkeyFirst && store tem passkeys). */
     passkeyCapable?: boolean;
+    /**
+     * Pins vindos do ARQUIVO DE CONFIG (`cfg.authMethods`): têm PRIORIDADE sobre o
+     * runtime setting `auth_methods`. Cada campo presente sobrescreve o valor resolvido
+     * do setting. Ligar respeita as capacidades (magicLink/passkey só ligam se capable);
+     * desligar é sempre respeitado. Campos ausentes seguem controlados pelo runtime.
+     */
+    configOverrides?: AuthMethodsConfigOverride;
 }
+/** Métodos que o config pode FIXAR (prioridade sobre runtime). Só os campos declarados travam. */
+export interface AuthMethodsConfigOverride {
+    password?: boolean;
+    magicLink?: boolean;
+    passkey?: boolean;
+    forgotPassword?: boolean;
+}
+/**
+ * Quais métodos estão TRAVADOS pelo config (para a UI admin mostrar o toggle
+ * desabilitado com "definido no arquivo de config"). É só a lista de campos
+ * booleanos presentes em `configOverrides`.
+ */
+export declare function configLockedAuthMethods(configOverrides?: AuthMethodsConfigOverride): Array<keyof AuthMethodsConfigOverride>;
 /**
  * Resolve os métodos de autenticação efetivos combinando config estático + setting
  * persistida em runtime + capabilities.

package/build/src/host/runtime_toggles.js

@@ -127,6 +127,22 @@ export async function resolveEffectiveMaintenanceMode(settings) {
         message: typeof setting.message === 'string' ? setting.message : undefined,
     };
 }
+/**
+ * Quais métodos estão TRAVADOS pelo config (para a UI admin mostrar o toggle
+ * desabilitado com "definido no arquivo de config"). É só a lista de campos
+ * booleanos presentes em `configOverrides`.
+ */
+export function configLockedAuthMethods(configOverrides) {
+    if (!configOverrides)
+        return [];
+    const keys = [
+        'password',
+        'magicLink',
+        'passkey',
+        'forgotPassword',
+    ];
+    return keys.filter((k) => typeof configOverrides[k] === 'boolean');
+}
 /**
  * Resolve os métodos de autenticação efetivos combinando config estático + setting
  * persistida em runtime + capabilities.
@@ -143,7 +159,7 @@ export async function resolveEffectiveMaintenanceMode(settings) {
  *   6. Qualquer erro DB → defaults derivados do config (fail-safe total).
  */
 export async function resolveEffectiveAuthMethods(settings, capabilities = {}) {
-    const { configuredSocialProviders = [], magicLinkCapable = false, passkeyCapable = false, } = capabilities;
+    const { configuredSocialProviders = [], magicLinkCapable = false, passkeyCapable = false, configOverrides, } = capabilities;
     // Defaults derivados do config/capabilities.
     const configDefaults = {
         password: true,
@@ -153,47 +169,55 @@ export async function resolveEffectiveAuthMethods(settings, capabilities = {}) {
         forgotPassword: true,
         passkeyAutofill: passkeyCapable, // on por default quando passkey disponível
     };
+    // 1) Runtime setting sobre os defaults (setting ausente/inválida → só defaults).
     const raw = await settings.getSetting(SETTING_KEYS.AUTH_METHODS);
-    if (raw === null || raw === undefined)
-        return configDefaults;
-    if (typeof raw !== 'object' || Array.isArray(raw))
-        return configDefaults; // shape inválida
-    const s = raw;
-    // Aplica campo a campo, com fallback ao default quando o campo está ausente.
-    const passwordEnabled = typeof s.password === 'boolean' ? s.password : configDefaults.password;
-    const magicLinkEnabled = typeof s.magicLink === 'boolean' ? s.magicLink : configDefaults.magicLink;
-    const passkeyEnabled = typeof s.passkey === 'boolean' ? s.passkey : configDefaults.passkey;
+    const s = raw !== null && raw !== undefined && typeof raw === 'object' && !Array.isArray(raw)
+        ? raw
+        : {};
+    let password = typeof s.password === 'boolean' ? s.password : configDefaults.password;
+    let magicLink = typeof s.magicLink === 'boolean' ? s.magicLink : configDefaults.magicLink;
+    let passkey = typeof s.passkey === 'boolean' ? s.passkey : configDefaults.passkey;
     // Social: interseção com os providers do config (setting não pode ligar o que não existe).
-    let socialEnabled;
-    if (Array.isArray(s.social)) {
-        socialEnabled = s.social.filter((p) => configuredSocialProviders.includes(p));
-    }
-    else {
-        socialEnabled = configDefaults.social;
-    }
-    // forgotPassword: derivado automaticamente — sem senha NUNCA existe esqueci-senha.
-    const forgotPasswordEnabled = passwordEnabled && (typeof s.forgotPassword === 'boolean' ? s.forgotPassword : true);
+    const social = Array.isArray(s.social)
+        ? s.social.filter((p) => configuredSocialProviders.includes(p))
+        : configDefaults.social;
+    // 2) Pins do config: PRIORIDADE sobre o setting. Ligar respeita a capacidade;
+    //    desligar sempre vale. `password` não tem guard de capacidade.
+    if (configOverrides) {
+        if (typeof configOverrides.password === 'boolean')
+            password = configOverrides.password;
+        if (typeof configOverrides.magicLink === 'boolean')
+            magicLink = configOverrides.magicLink && magicLinkCapable;
+        if (typeof configOverrides.passkey === 'boolean')
+            passkey = configOverrides.passkey && passkeyCapable;
+    }
+    // forgotPassword: derivado — sem senha NUNCA existe esqueci-senha. O pin/setting só
+    // pode DESLIGAR (nunca ligar sem senha). Precedência: pin do config > setting > default(on).
+    const forgotPasswordRequested = typeof configOverrides?.forgotPassword === 'boolean'
+        ? configOverrides.forgotPassword
+        : typeof s.forgotPassword === 'boolean'
+            ? s.forgotPassword
+            : true;
+    const forgotPassword = password && forgotPasswordRequested;
     // passkeyAutofill: só faz sentido quando passkey está ligado.
-    const passkeyAutofillEnabled = passkeyEnabled &&
+    const passkeyAutofill = passkey &&
         (typeof s.passkeyAutofill === 'boolean' ? s.passkeyAutofill : configDefaults.passkeyAutofill);
     const resolved = {
-        password: passwordEnabled,
-        magicLink: magicLinkEnabled,
-        passkey: passkeyEnabled,
-        social: socialEnabled,
-        forgotPassword: forgotPasswordEnabled,
-        passkeyAutofill: passkeyAutofillEnabled,
+        password,
+        magicLink,
+        passkey,
+        social,
+        forgotPassword,
+        passkeyAutofill,
     };
-    // FAIL-SAFE all-off: se todos ficaram false/vazio, volta ao config derivado.
-    const allOff = !resolved.password &&
-        !resolved.magicLink &&
-        !resolved.passkey &&
-        resolved.social.length === 0;
+    // FAIL-SAFE all-off: se pins + setting zerarem TODOS os métodos, volta ao config derivado
+    // (nunca deixar a tela sem método / trancar todo mundo pra fora).
+    const allOff = !resolved.password && !resolved.magicLink && !resolved.passkey && resolved.social.length === 0;
     if (allOff) {
         // eslint-disable-next-line no-console
-        console.warn('[authkit] auth_methods setting deixou todos os métodos desligados — ' +
+        console.warn('[authkit] auth_methods (config pins + setting) deixou todos os métodos desligados — ' +
             'revertendo para os defaults do config (fail-safe). ' +
-            'Verifique a setting auth_methods no console admin.');
+            'Verifique cfg.authMethods e a setting auth_methods no console admin.');
         return configDefaults;
     }
     return resolved;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -140,7 +140,7 @@
     "react-error-boundary": "6.1.2",
     "nuqs": "2.8.9",
     "recharts": "3.8.1",
-    "@adonis-agora/authkit-react": "0.14.0"
+    "@adonis-agora/authkit-react": "0.16.0"
   },
   "scripts": {
     "build": "node scripts/build_host_css.mjs && node scripts/build_ui.mjs && tsc && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/password/common_passwords.txt')\"",