@adonis-agora/authkit-server 0.43.0 → 0.44.0

package/build/src/host/account_roles.d.ts

@@ -0,0 +1,26 @@
+import type { AuthAccount } from '../accounts/account_store.js';
+/** The slice of the resolved config the role resolution needs (structurally typed). */
+type RoleResolverConfig = {
+    resolveTokenRoles?: (account: AuthAccount, context: {
+        clientId?: string;
+        activeOrg?: {
+            orgId: string;
+            orgSlug: string;
+            orgRole: string;
+        } | null;
+    }) => string[] | Promise<string[]>;
+};
+/**
+ * An account's effective roles for host-side gating (the admin console).
+ *
+ * When the host configures `resolveTokenRoles`, that hook is the single source of an account's roles
+ * — the same one the OIDC `roles` claim is minted from — so console access tracks the host's role
+ * authority (e.g. an app that keeps roles in its own table via `@adonis-agora/authz`) instead of the
+ * account's stored `globalRoles`. Falls back to `account.globalRoles ?? []` when no hook is set, so
+ * default behavior is unchanged.
+ *
+ * The console is not OIDC-client- or org-scoped for role purposes, so the hook is called with an
+ * empty context (`clientId: undefined`, `activeOrg: null`).
+ */
+export declare function resolveAccountRoles(cfg: RoleResolverConfig, account: AuthAccount): Promise<string[]>;
+export {};

package/build/src/host/account_roles.js

@@ -0,0 +1,18 @@
+/**
+ * An account's effective roles for host-side gating (the admin console).
+ *
+ * When the host configures `resolveTokenRoles`, that hook is the single source of an account's roles
+ * — the same one the OIDC `roles` claim is minted from — so console access tracks the host's role
+ * authority (e.g. an app that keeps roles in its own table via `@adonis-agora/authz`) instead of the
+ * account's stored `globalRoles`. Falls back to `account.globalRoles ?? []` when no hook is set, so
+ * default behavior is unchanged.
+ *
+ * The console is not OIDC-client- or org-scoped for role purposes, so the hook is called with an
+ * empty context (`clientId: undefined`, `activeOrg: null`).
+ */
+export async function resolveAccountRoles(cfg, account) {
+    if (cfg.resolveTokenRoles) {
+        return cfg.resolveTokenRoles(account, { clientId: undefined, activeOrg: null });
+    }
+    return account.globalRoles ?? [];
+}

package/build/src/host/admin_console/admin_shell_controller.js

@@ -1,6 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { extname } from 'node:path';
 import { getAdminPrefix } from '../admin_prefix.js';
+import { resolveAccountRoles } from '../account_roles.js';
 // ─── Shell HTML cache ─────────────────────────────────────────────────────────
 /**
  * Points to the Vite-built index.html inside build/host/ui-dist/.
@@ -120,7 +121,7 @@ export default class AdminShellController {
                 currentUser = {
                     id: account.id,
                     email: account.email,
-                    roles: account.globalRoles ?? [],
+                    roles: await resolveAccountRoles(cfg, account),
                 };
             }
         }

package/build/src/host/register_auth_host.js

@@ -2,6 +2,7 @@ import { resolveRateLimit } from '../define_config.js';
 import { createAuthThrottles } from './rate_limit.js';
 import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
 import { accountHome } from './account_home.js';
+import { resolveAccountRoles } from './account_roles.js';
 import { adminApiGuard } from './admin_api/admin_api_guard.js';
 import { setAdminPrefix, normalizeAdminPrefix, setAdminApiPrefix, normalizeAdminApiPrefix, } from './admin_prefix.js';
 import { resolveRuntimeSettings } from './runtime_settings.js';
@@ -112,7 +113,10 @@ export const adminGuard = async (ctx, next) => {
     }
     const allowed = cfg.admin.roles;
     const account = await cfg.accountStore.findById(accountId);
-    const roles = account?.globalRoles ?? [];
+    // Resolve roles through the host's role authority (`resolveTokenRoles`) when set — the same source
+    // the token claim is minted from — so an app-role admin reaches the console. Falls back to the
+    // account's stored `globalRoles` when no hook is configured.
+    const roles = account ? await resolveAccountRoles(cfg, account) : [];
     const isAdmin = roles.some((r) => allowed.includes(r));
     if (!isAdmin) {
         // Evita vazar a existência do console admin: redireciona para o accountHome

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",