@adonis-agora/authkit-server 0.46.0 → 0.48.0

package/build/src/password/password_manager.js

@@ -1,7 +1,7 @@
 import { createHmac } from 'node:crypto';
-import { checkPasswordPolicy, policyViolationParams, resolvePasswordConfig, DEFAULT_PWNED_TIMEOUT_MS, } from './policy.js';
-import { isPasswordPwned } from './pwned.js';
 import { isCommonPassword } from './common_passwords.js';
+import { DEFAULT_PWNED_TIMEOUT_MS, checkPasswordPolicy, policyViolationParams, resolvePasswordConfig, } from './policy.js';
+import { isPasswordPwned } from './pwned.js';
 /** Erro de política/vazamento de senha — carrega a chave i18n + params. */
 export class PasswordPolicyError extends Error {
     key;
@@ -154,8 +154,8 @@ export class PasswordManager {
             }
             if (nativeOk) {
                 // Se este não é o pepper corrente → re-hash obrigatório com o corrente.
-                const isCurrentPepper = (p === currentPepper) || (!p && !this.pepper);
-                let rehash = isCurrentPepper ? false : true;
+                const isCurrentPepper = p === currentPepper || (!p && !this.pepper);
+                let rehash = !isCurrentPepper;
                 if (!rehash) {
                     try {
                         rehash = hooks.needsRehash(hashedPassword);

package/build/src/pat/lucid_pat_store.js

@@ -23,16 +23,12 @@ export function lucidPatStore(Model) {
                 tokenHash: hashPatToken(token),
                 scopes: input.scopes ?? [],
                 audience: input.audience ?? null,
-                expiresAt: input.expiresInDays
-                    ? DateTime.now().plus({ days: input.expiresInDays })
-                    : null,
+                expiresAt: input.expiresInDays ? DateTime.now().plus({ days: input.expiresInDays }) : null,
             });
             return { token, pat: toRecord(row) };
         },
         async listForAccount(accountId) {
-            const rows = await Model.query()
-                .where('user_id', accountId)
-                .orderBy('created_at', 'desc');
+            const rows = await Model.query().where('user_id', accountId).orderBy('created_at', 'desc');
             return rows.map(toRecord);
         },
         async revoke(accountId, id) {

package/build/src/pat/pat_tokens.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto';
 /** Gera um Personal Access Token opaco no formato `pat_<base64url>`. */
 export function generatePatToken() {
-    return 'pat_' + randomBytes(32).toString('base64url');
+    return `pat_${randomBytes(32).toString('base64url')}`;
 }
 /** SHA-256 (hex) do token — é o que se persiste; o token cru nunca é guardado. */
 export function hashPatToken(token) {

package/build/src/provider/interaction_actions.js

@@ -20,7 +20,7 @@ export function createInteractionActions(provider, deps) {
             const login = { accountId };
             if (extra?.acr)
                 login.acr = extra.acr;
-            if (extra?.amr && extra.amr.length)
+            if (extra?.amr?.length)
                 login.amr = extra.amr;
             // remember-me: `remember: false` → sessão transiente (transient: true no provider);
             // `remember: true` ou ausente → sessão persistente (padrão do oidc-provider).

package/build/src/provider/key_rotation_scheduler.js

@@ -27,7 +27,9 @@ export class KeyRotationScheduler {
     start() {
         if (this.#timer)
             return;
-        this.#timer = setInterval(() => { void this.tick(); }, this.opts.intervalMs);
+        this.#timer = setInterval(() => {
+            void this.tick();
+        }, this.opts.intervalMs);
         if (typeof this.#timer.unref === 'function')
             this.#timer.unref();
     }

package/build/src/provider/logout_sources.js

@@ -45,20 +45,14 @@ export function createLogoutSources(messages) {
         async logoutSource(ctx, form) {
             // Injeta o campo de confirmação dentro do form fornecido pela lib.
             const confirmedForm = form.replace(/<\/form>/, '<input type="hidden" name="logout" value="yes"/></form>');
-            ctx.body = page(t('logout.title'), `<div class="spinner" aria-hidden="true"></div>` +
-                `<h1>${esc(t('logout.title'))}</h1>` +
-                `<p>${esc(t('logout.body'))}</p>` +
-                confirmedForm +
-                `<noscript><button type="submit" form="op.logoutForm">${esc(t('logout.fallback'))}</button></noscript>` +
-                `<script>(function(){var f=document.forms['op.logoutForm'];if(f){f.submit();}})();</script>`);
+            ctx.body = page(t('logout.title'), `<div class="spinner" aria-hidden="true"></div><h1>${esc(t('logout.title'))}</h1><p>${esc(t('logout.body'))}</p>${confirmedForm}<noscript><button type="submit" form="op.logoutForm">${esc(t('logout.fallback'))}</button></noscript><script>(function(){var f=document.forms['op.logoutForm'];if(f){f.submit();}})();</script>`);
         },
         /**
          * Mostrada apenas quando NÃO há `post_logout_redirect_uri` (senão o provider
          * redireciona o browser direto pro RP). Tela de marca em vez do default.
          */
         async postLogoutSuccessSource(ctx) {
-            ctx.body = page(t('logout.success.title'), `<h1>${esc(t('logout.success.title'))}</h1>` +
-                `<p>${esc(t('logout.success.body'))}</p>`);
+            ctx.body = page(t('logout.success.title'), `<h1>${esc(t('logout.success.title'))}</h1>` + `<p>${esc(t('logout.success.body'))}</p>`);
         },
     };
 }

package/build/src/provider/oidc_service.d.ts

@@ -1,9 +1,9 @@
 import { type MetricsRecorder } from '@adonis-agora/authkit-core';
 import type { ResolvedServerConfig } from '../define_config.js';
-import { buildProvider, type SessionTtlHolder, type TokenTtlHolder } from './build_provider.js';
-import { type InteractionActions } from './interaction_actions.js';
 import { type ManagedKeyInfo } from '../keys/keystore.js';
 import type { KeystoreManager } from '../keys/keystore_manager.js';
+import { type SessionTtlHolder, type TokenTtlHolder, buildProvider } from './build_provider.js';
+import { type InteractionActions } from './interaction_actions.js';
 export declare class OidcService {
     #private;
     get provider(): ReturnType<typeof buildProvider>;

package/build/src/provider/oidc_service.js

@@ -2,21 +2,27 @@ import { timingSafeEqual } from 'node:crypto';
 import { NoopRecorder } from '@adonis-agora/authkit-core';
 import Koa from 'koa';
 import mount from 'koa-mount';
+import { readActiveOrgFromKoaCtx } from '../host/active_org_cookie.js';
+import { isFirstParty } from '../host/branding.js';
+import { listKeyInfos, signingKeyAgeDays } from '../keys/keystore.js';
 import { wireProviderEvents } from '../observability/wire_provider_events.js';
 import { buildProvider } from './build_provider.js';
 import { createInteractionActions } from './interaction_actions.js';
 import { registerTokenExchange } from './token_exchange.js';
-import { readActiveOrgFromKoaCtx } from '../host/active_org_cookie.js';
-import { isFirstParty } from '../host/branding.js';
-import { signingKeyAgeDays, listKeyInfos } from '../keys/keystore.js';
 export class OidcService {
     #provider;
     #callback;
     #interactions;
     #appKey;
-    get provider() { return this.#provider; }
-    get callback() { return this.#callback; }
-    get interactions() { return this.#interactions; }
+    get provider() {
+        return this.#provider;
+    }
+    get callback() {
+        return this.#callback;
+    }
+    get interactions() {
+        return this.#interactions;
+    }
     /** Pathname do issuer sem barra final (ex.: `/oidc`). Vazio quando montado na raiz. */
     mountPath;
     recorder;
@@ -83,9 +89,7 @@ export class OidcService {
                 // do closure `claims()`, pois o `ctx` da request vive neste escopo). Um client
                 // third-party NUNCA recebe roles/org — mesmo solicitando `scope=roles`.
                 const clientId = ctx?.oidc?.client?.clientId;
-                const firstParty = config.branding
-                    ? isFirstParty(config.branding, clientId)
-                    : false;
+                const firstParty = config.branding ? isFirstParty(config.branding, clientId) : false;
                 return {
                     accountId: user.id,
                     claims: async (_use, _scope) => {
@@ -103,9 +107,9 @@ export class OidcService {
                                 : (user.globalRoles ?? []);
                             // Emite claims de org somente quando há uma org ativa na sessão.
                             if (activeOrg) {
-                                base['org_id'] = activeOrg.orgId;
-                                base['org_slug'] = activeOrg.orgSlug;
-                                base['org_role'] = activeOrg.orgRole;
+                                base.org_id = activeOrg.orgId;
+                                base.org_slug = activeOrg.orgSlug;
+                                base.org_role = activeOrg.orgRole;
                             }
                         }
                         return base;
@@ -150,7 +154,9 @@ export class OidcService {
         else {
             callback = provider.callback();
         }
-        const interactions = createInteractionActions(provider, { verifyCredentials: config.verifyCredentials });
+        const interactions = createInteractionActions(provider, {
+            verifyCredentials: config.verifyCredentials,
+        });
         // Atribuição atômica no final: um throw antes deste ponto não corrompe o estado.
         this.#provider = provider;
         this.#callback = callback;
@@ -210,7 +216,9 @@ export class OidcService {
             const { newKid, retiredKids, store } = await m.rotate(keep, retire);
             await this.reloadKeys();
             const keptKids = store.keys.map((k) => k.kid);
-            await this.#config.audit?.record({ type: 'keys.rotated', metadata: { newKid, retiredKids, keptKids, retire } }).catch(() => { });
+            await this.#config.audit
+                ?.record({ type: 'keys.rotated', metadata: { newKid, retiredKids, keptKids, retire } })
+                .catch(() => { });
             return { newKid, retiredKids, keptKids };
         };
         // serializa: encadeia após a rotação em voo; cada caller recebe o resultado da SUA rotação

package/build/src/provider/single_flight_lock.js

@@ -8,9 +8,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 };
 async function defaultLoadLock() {
     const spec = '@adonisjs/lock/services/main';
-    return import(__rewriteRelativeImportExtension(spec))
-        .then((m) => m.default ?? null)
-        .catch(() => null);
+    return import(__rewriteRelativeImportExtension(spec)).then((m) => m.default ?? null).catch(() => null);
 }
 export function makeSingleFlightLock(opts) {
     const load = opts.loadLock ?? defaultLoadLock;

package/build/src/provider/token_exchange.d.ts

@@ -1,5 +1,5 @@
-import type { AuditSink } from '../audit/audit_sink.js';
 import type { AuthAccount } from '../accounts/account_store.js';
+import type { AuditSink } from '../audit/audit_sink.js';
 export interface TokenExchangeAccount {
     id: string;
     email?: string;

package/build/src/schema/ensure.js

@@ -255,7 +255,9 @@ export async function ensureAuthkitSchema(db, options = {}) {
             if (await columnExists(conn, def.name, column))
                 continue;
             await conn.schema.alterTable(def.name, (t) => add(t));
-            (report.altered[def.name] ??= []).push(column);
+            if (!report.altered[def.name])
+                report.altered[def.name] = [];
+            report.altered[def.name].push(column);
         }
     }
     return report;

package/build/stubs/ui/react/components/auth_shell.tsx

@@ -1,18 +1,18 @@
-{{{
-  exports({ to: app.makePath('inertia/components/auth_shell.tsx') })
-}}}
-import type { ReactNode } from 'react'
+{
+  exports({ to: app.makePath('inertia/components/auth_shell.tsx') });
+}
+import type { ReactNode } from 'react';
 
 export interface AuthBrand {
-  appName: string
-  accent: string
-  accentSoft?: string
-  company?: string
-  tagline?: string
-  audienceLabel?: string
+  appName: string;
+  accent: string;
+  accentSoft?: string;
+  company?: string;
+  tagline?: string;
+  audienceLabel?: string;
 }
 
-const COMPANY_FALLBACK = 'Acme'
+const COMPANY_FALLBACK = 'Acme';
 
 /**
  * Layout de duas colunas para as telas de autenticacao do IdP.
@@ -22,14 +22,14 @@ export default function AuthShell({
   brand,
   children,
 }: {
-  brand?: AuthBrand
-  children: ReactNode
+  brand?: AuthBrand;
+  children: ReactNode;
 }) {
-  const accent = brand?.accent ?? '#111827'
-  const accentSoft = brand?.accentSoft ?? accent
-  const company = brand?.company ?? COMPANY_FALLBACK
-  const appName = brand?.appName ?? 'Sua conta'
-  const tagline = brand?.tagline ?? 'Acesso unificado'
+  const accent = brand?.accent ?? '#111827';
+  const accentSoft = brand?.accentSoft ?? accent;
+  const company = brand?.company ?? COMPANY_FALLBACK;
+  const appName = brand?.appName ?? 'Sua conta';
+  const tagline = brand?.tagline ?? 'Acesso unificado';
 
   return (
     <div className="min-h-screen flex items-center justify-center bg-gray-100 p-4">
@@ -63,5 +63,5 @@ export default function AuthShell({
         <div className="p-8 md:p-10">{children}</div>
       </div>
     </div>
-  )
+  );
 }

package/build/stubs/ui/react/pages/account/login.tsx

@@ -1,9 +1,9 @@
-{{{
-  exports({ to: app.makePath('inertia/pages/authkit/account/login.tsx') })
-}}}
+{
+  exports({ to: app.makePath('inertia/pages/authkit/account/login.tsx') });
+}
 interface Props {
-  csrfToken: string
-  error?: string
+  csrfToken: string;
+  error?: string;
 }
 
 export default function AccountLogin({ csrfToken, error }: Props) {
@@ -29,7 +29,6 @@ export default function AccountLogin({ csrfToken, error }: Props) {
           name="email"
           type="email"
           required
-          autoFocus
           className="w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none focus:border-gray-900"
         />
 
@@ -52,5 +51,5 @@ export default function AccountLogin({ csrfToken, error }: Props) {
         </button>
       </form>
     </div>
-  )
+  );
 }

package/build/stubs/ui/react/pages/account/mfa.tsx

@@ -1,14 +1,14 @@
-{{{
-  exports({ to: app.makePath('inertia/pages/authkit/account/mfa.tsx') })
-}}}
+{
+  exports({ to: app.makePath('inertia/pages/authkit/account/mfa.tsx') });
+}
 interface Props {
-  csrfToken: string
-  enabled: boolean
-  enrolling?: boolean
-  secret?: string | null
-  qrDataUrl?: string | null
-  error?: string
-  recoveryCodes?: string[] | null
+  csrfToken: string;
+  enabled: boolean;
+  enrolling?: boolean;
+  secret?: string | null;
+  qrDataUrl?: string | null;
+  error?: string;
+  recoveryCodes?: string[] | null;
 }
 
 export default function AccountMfa({
@@ -25,7 +25,9 @@ export default function AccountMfa({
       <div className="mx-auto max-w-2xl">
         <div className="flex items-center justify-between py-6">
           <div>
-            <div className="text-xs font-semibold uppercase tracking-[0.2em] text-gray-400">Acme</div>
+            <div className="text-xs font-semibold uppercase tracking-[0.2em] text-gray-400">
+              Acme
+            </div>
             <h1 className="text-xl font-semibold text-gray-900">Verificação em duas etapas</h1>
           </div>
           <form method="POST" action="/account/logout">
@@ -82,7 +84,6 @@ export default function AccountMfa({
                 inputMode="numeric"
                 pattern="[0-9]*"
                 maxLength={6}
-                autoFocus
                 className="w-full rounded-lg border border-gray-300 px-3 py-2 text-center text-lg tracking-[0.4em] outline-none focus:border-gray-900"
               />
               <button
@@ -112,8 +113,8 @@ export default function AccountMfa({
         ) : (
           <div className="rounded-xl bg-white p-6 shadow-sm ring-1 ring-black/5">
             <p className="text-sm text-gray-700">
-              A verificação em duas etapas está desativada. Ative-a para proteger sua conta com um app
-              autenticador.
+              A verificação em duas etapas está desativada. Ative-a para proteger sua conta com um
+              app autenticador.
             </p>
             <form method="POST" action="/account/mfa/enroll" className="mt-4">
               <input type="hidden" name="_csrf" value={csrfToken} />
@@ -128,5 +129,5 @@ export default function AccountMfa({
         )}
       </div>
     </div>
-  )
+  );
 }

package/build/stubs/ui/react/pages/account/tokens.tsx

@@ -1,18 +1,18 @@
-{{{
-  exports({ to: app.makePath('inertia/pages/authkit/account/tokens.tsx') })
-}}}
+{
+  exports({ to: app.makePath('inertia/pages/authkit/account/tokens.tsx') });
+}
 interface TokenRow {
-  id: string
-  name: string
-  scopes: string[]
-  audience: string | null
-  lastUsedAt: string | null
-  createdAt: string
+  id: string;
+  name: string;
+  scopes: string[];
+  audience: string | null;
+  lastUsedAt: string | null;
+  createdAt: string;
 }
 interface Props {
-  csrfToken: string
-  createdToken: string | null
-  tokens: TokenRow[]
+  csrfToken: string;
+  createdToken: string | null;
+  tokens: TokenRow[];
 }
 
 export default function AccountTokens({ csrfToken, createdToken, tokens }: Props) {
@@ -21,7 +21,9 @@ export default function AccountTokens({ csrfToken, createdToken, tokens }: Props
       <div className="mx-auto max-w-2xl">
         <div className="flex items-center justify-between py-6">
           <div>
-            <div className="text-xs font-semibold uppercase tracking-[0.2em] text-gray-400">Acme</div>
+            <div className="text-xs font-semibold uppercase tracking-[0.2em] text-gray-400">
+              Acme
+            </div>
             <h1 className="text-xl font-semibold text-gray-900">Tokens de acesso</h1>
           </div>
           <form method="POST" action="/account/logout">
@@ -54,7 +56,10 @@ export default function AccountTokens({ csrfToken, createdToken, tokens }: Props
             placeholder="Nome do token (ex.: CI deploy)"
             className="flex-1 rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none focus:border-gray-900"
           />
-          <button type="submit" className="rounded-lg bg-gray-900 px-4 text-sm font-semibold text-white">
+          <button
+            type="submit"
+            className="rounded-lg bg-gray-900 px-4 text-sm font-semibold text-white"
+          >
             Criar
           </button>
         </form>
@@ -64,12 +69,17 @@ export default function AccountTokens({ csrfToken, createdToken, tokens }: Props
             <p className="p-6 text-sm text-gray-500">Nenhum token ainda.</p>
           ) : (
             tokens.map((t) => (
-              <div key={t.id} className="flex items-center justify-between border-b border-gray-100 p-4 last:border-0">
+              <div
+                key={t.id}
+                className="flex items-center justify-between border-b border-gray-100 p-4 last:border-0"
+              >
                 <div>
                   <p className="text-sm font-medium text-gray-900">{t.name}</p>
                   <p className="text-xs text-gray-500">
                     Criado em {new Date(t.createdAt).toLocaleDateString('pt-BR')}
-                    {t.lastUsedAt ? ` · último uso ${new Date(t.lastUsedAt).toLocaleDateString('pt-BR')}` : ' · nunca usado'}
+                    {t.lastUsedAt
+                      ? ` · último uso ${new Date(t.lastUsedAt).toLocaleDateString('pt-BR')}`
+                      : ' · nunca usado'}
                   </p>
                 </div>
                 <form method="POST" action={`/account/tokens/${t.id}/revoke`}>
@@ -84,5 +94,5 @@ export default function AccountTokens({ csrfToken, createdToken, tokens }: Props
         </div>
       </div>
     </div>
-  )
+  );
 }

package/build/stubs/ui/react/pages/consent.tsx

@@ -1,7 +1,7 @@
-{{{
-  exports({ to: app.makePath('inertia/pages/authkit/consent.tsx') })
-}}}
-import AuthShell, { type AuthBrand } from '../../components/auth_shell'
+{
+  exports({ to: app.makePath('inertia/pages/authkit/consent.tsx') });
+}
+import AuthShell, { type AuthBrand } from '../../components/auth_shell';
 
 export default function AuthkitConsent({
   uid,
@@ -9,17 +9,17 @@ export default function AuthkitConsent({
   csrfToken,
   brand,
 }: {
-  uid: string
-  params: { client_id: string }
-  csrfToken: string
-  brand?: AuthBrand
+  uid: string;
+  params: { client_id: string };
+  csrfToken: string;
+  brand?: AuthBrand;
 }) {
-  const accent = brand?.accent ?? '#111827'
-  const appName = brand?.appName ?? params.client_id
+  const accent = brand?.accent ?? '#111827';
+  const appName = brand?.appName ?? params.client_id;
 
   return (
     <AuthShell brand={brand}>
-      <form method="POST" action={'/auth/interaction/' + uid + '/consent'}>
+      <form method="POST" action={`/auth/interaction/${uid}/consent`}>
         <input type="hidden" name="_csrf" value={csrfToken} />
         <h1 className="text-xl font-semibold text-gray-900">Autorizar acesso</h1>
         <p className="mt-2 text-sm text-gray-600">
@@ -35,5 +35,5 @@ export default function AuthkitConsent({
         </button>
       </form>
     </AuthShell>
-  )
+  );
 }

package/build/stubs/ui/react/pages/forgot.tsx

@@ -1,10 +1,10 @@
-{{{
-  exports({ to: app.makePath('inertia/pages/authkit/forgot.tsx') })
-}}}
-import AuthShell from '../../components/auth_shell'
+{
+  exports({ to: app.makePath('inertia/pages/authkit/forgot.tsx') });
+}
+import AuthShell from '../../components/auth_shell';
 
 const inputClass =
-  'w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-transparent focus:ring-2 focus:ring-gray-800'
+  'w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-transparent focus:ring-2 focus:ring-gray-800';
 
 export default function AuthkitForgot({ csrfToken, sent }: { csrfToken: string; sent?: boolean }) {
   if (sent) {
@@ -15,7 +15,7 @@ export default function AuthkitForgot({ csrfToken, sent }: { csrfToken: string;
           Se o e-mail existir, enviaremos instruções de redefinição.
         </p>
       </AuthShell>
-    )
+    );
   }
 
   return (
@@ -40,5 +40,5 @@ export default function AuthkitForgot({ csrfToken, sent }: { csrfToken: string;
         </button>
       </form>
     </AuthShell>
-  )
+  );
 }

package/build/stubs/ui/react/pages/login.tsx

@@ -1,10 +1,10 @@
-{{{
-  exports({ to: app.makePath('inertia/pages/authkit/login.tsx') })
-}}}
-import AuthShell, { type AuthBrand } from '../../components/auth_shell'
+{
+  exports({ to: app.makePath('inertia/pages/authkit/login.tsx') });
+}
+import AuthShell, { type AuthBrand } from '../../components/auth_shell';
 
 const inputClass =
-  'w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-transparent focus:ring-2'
+  'w-full rounded-lg border border-gray-300 px-3 py-2 text-sm outline-none transition focus:border-transparent focus:ring-2';
 
 export default function AuthkitLogin({
   uid,
@@ -15,21 +15,21 @@ export default function AuthkitLogin({
   error,
   brand,
 }: {
-  uid: string
-  csrfToken: string
-  step?: 'identifier' | 'password'
-  email?: string
-  account?: { fullName: string | null; globalRoles: string[] } | null
-  error?: string
-  brand?: AuthBrand
+  uid: string;
+  csrfToken: string;
+  step?: 'identifier' | 'password';
+  email?: string;
+  account?: { fullName: string | null; globalRoles: string[] } | null;
+  error?: string;
+  brand?: AuthBrand;
 }) {
-  const accent = brand?.accent ?? '#111827'
-  const focusStyle = { ['--tw-ring-color' as any]: accent }
+  const accent = brand?.accent ?? '#111827';
+  const focusStyle = { ['--tw-ring-color' as any]: accent };
 
   if (step === 'identifier') {
     return (
       <AuthShell brand={brand}>
-        <form method="POST" action={'/auth/interaction/' + uid + '/identifier'}>
+        <form method="POST" action={`/auth/interaction/${uid}/identifier`}>
           <input type="hidden" name="_csrf" value={csrfToken} />
           <h1 className="text-xl font-semibold text-gray-900">Entrar</h1>
           <p className="mt-1 text-sm text-gray-500">Informe seu e-mail para continuar.</p>
@@ -45,7 +45,6 @@ export default function AuthkitLogin({
               name="email"
               type="email"
               required
-              autoFocus
               className={inputClass}
               style={focusStyle}
             />
@@ -60,7 +59,7 @@ export default function AuthkitLogin({
           </button>
 
           <div className="mt-4 flex justify-between text-sm text-gray-600">
-            <a href={'/auth/interaction/' + uid + '/signup'} className="hover:underline">
+            <a href={`/auth/interaction/${uid}/signup`} className="hover:underline">
               Criar conta
             </a>
             <a href="/auth/forgot-password" className="hover:underline">
@@ -76,7 +75,7 @@ export default function AuthkitLogin({
         </div>
 
         <a
-          href={'/auth/google/redirect/' + uid}
+          href={`/auth/google/redirect/${uid}`}
           className="flex w-full items-center justify-center gap-2 rounded-lg border border-gray-300 bg-white py-2.5 text-sm font-medium text-gray-700 transition hover:bg-gray-50"
         >
           <svg className="h-4 w-4" viewBox="0 0 24 24" aria-hidden="true">
@@ -100,15 +99,15 @@ export default function AuthkitLogin({
           Entrar com Google
         </a>
       </AuthShell>
-    )
+    );
   }
 
   // step === 'password'
-  const isAdmin = account?.globalRoles?.includes('ADMIN') ?? false
+  const isAdmin = account?.globalRoles?.includes('ADMIN') ?? false;
 
   return (
     <AuthShell brand={brand}>
-      <form method="POST" action={'/auth/interaction/' + uid + '/login'}>
+      <form method="POST" action={`/auth/interaction/${uid}/login`}>
         <input type="hidden" name="_csrf" value={csrfToken} />
 
         {account?.fullName ? (
@@ -127,7 +126,7 @@ export default function AuthkitLogin({
         <div className="mt-1 flex items-center gap-2">
           <span className="text-sm text-gray-500">{email}</span>
           <a
-            href={'/auth/interaction/' + uid + '/switch'}
+            href={`/auth/interaction/${uid}/switch`}
             className="text-xs font-medium hover:underline"
             style={{ color: accent }}
           >
@@ -146,7 +145,6 @@ export default function AuthkitLogin({
             name="password"
             type="password"
             required
-            autoFocus
             className={inputClass}
             style={focusStyle}
           />
@@ -167,5 +165,5 @@ export default function AuthkitLogin({
         </div>
       </form>
     </AuthShell>
-  )
+  );
 }