@adonis-agora/authkit-server 0.46.0 → 0.48.0

package/build/src/host/controllers/account_security_controller.js

@@ -1,21 +1,23 @@
-import "../augmentations.js";
-import { ACCOUNT_SESSION_KEY } from "../middleware/account_auth.js";
-import { supportsAccountSecurity, supportsAccountDeletion, supportsProfile, supportsPasswordHistory, } from "../../accounts/account_store.js";
-import { changePasswordValidator, changeEmailValidator, deleteAccountValidator, updateProfileValidator, } from "../validators.js";
-import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail, sendEmailChangedCompletedEmail, } from "../default_mailer.js";
-import { storeAvatar, isAvatarUploadSupported, AvatarUploadError, } from "../avatar_storage.js";
-import { translate } from "../i18n.js";
-import { TRUSTED_DEVICE_COOKIE } from "../trusted_device.js";
-import { AccountDeletionService } from "../account_deletion_service.js";
-import { AccountExportService } from "../account_export_service.js";
-import { AdminSessionsService } from "../admin_sessions_service.js";
-import { enrichSessionsWithContext } from "../session_context.js";
-import { PasswordPolicyError } from "../../password/password_manager.js";
-import { resolveRuntimeSettings } from "../runtime_settings.js";
-import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from "../runtime_toggles.js";
-import { dispatchSecurityNotice } from "../security_notice_service.js";
-import { requireSudo } from "../sudo_mode.js";
-import { syncAdonisAuthLogout } from "../adonis_auth_sync.js";
+import '../augmentations.js';
+import { supportsAccountDeletion, supportsAccountSecurity, supportsPasswordHistory, supportsProfile, } from '../../accounts/account_store.js';
+import { PasswordPolicyError } from '../../password/password_manager.js';
+import { AccountDeletionService } from '../account_deletion_service.js';
+import { AccountExportService } from '../account_export_service.js';
+import { getAccountLoginUrl } from '../account_login_url.js';
+import { accountPath } from '../account_paths.js';
+import { AdminSessionsService } from '../admin_sessions_service.js';
+import { syncAdonisAuthLogout } from '../adonis_auth_sync.js';
+import { AvatarUploadError, isAvatarUploadSupported, storeAvatar } from '../avatar_storage.js';
+import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail, sendEmailChangedCompletedEmail, } from '../default_mailer.js';
+import { translate } from '../i18n.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
+import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';
+import { dispatchSecurityNotice } from '../security_notice_service.js';
+import { enrichSessionsWithContext } from '../session_context.js';
+import { requireSudo } from '../sudo_mode.js';
+import { TRUSTED_DEVICE_COOKIE } from '../trusted_device.js';
+import { changeEmailValidator, changePasswordValidator, deleteAccountValidator, updateProfileValidator, } from '../validators.js';
 /** Resolve os password history settings em runtime (fail-safe). */
 async function resolvePasswordHistorySettings(ctx) {
     try {
@@ -51,7 +53,7 @@ async function resolveEmailChangeSettings(ctx) {
  */
 export default class AccountSecurityController {
     async index(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const render = cfg.render;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
@@ -63,35 +65,35 @@ export default class AccountSecurityController {
         const ownSessions = sessionsSupported
             ? await enrichSessionsWithContext(cfg, userId, await adminSessions.listSessions(userId))
             : [];
-        return render(ctx, "account/security", {
+        return render(ctx, 'account/security', {
             csrfToken: ctx.request.csrfToken,
             supported: supportsAccountSecurity(cfg.accountStore),
             profileSupported: supportsProfile(cfg.accountStore),
             // Só mostramos o input de arquivo se ALGUM backend (drive OU media) puder armazenar.
             avatarUploadSupported: await isAvatarUploadSupported(cfg.uploads),
-            email: account?.email ?? "",
-            name: account?.name ?? "",
-            avatarUrl: account?.avatarUrl ?? "",
-            passwordChanged: ctx.session.flashMessages.get("passwordChanged") ?? null,
-            emailChangeRequested: ctx.session.flashMessages.get("emailChangeRequested") ?? null,
-            emailChanged: ctx.session.flashMessages.get("emailChanged") ?? null,
-            profileUpdated: ctx.session.flashMessages.get("profileUpdated") ?? null,
-            error: ctx.session.flashMessages.get("securityError") ?? null,
+            email: account?.email ?? '',
+            name: account?.name ?? '',
+            avatarUrl: account?.avatarUrl ?? '',
+            passwordChanged: ctx.session.flashMessages.get('passwordChanged') ?? null,
+            emailChangeRequested: ctx.session.flashMessages.get('emailChangeRequested') ?? null,
+            emailChanged: ctx.session.flashMessages.get('emailChanged') ?? null,
+            profileUpdated: ctx.session.flashMessages.get('profileUpdated') ?? null,
+            error: ctx.session.flashMessages.get('securityError') ?? null,
             trustedDevicesEnabled: cfg.trustedDevices.enabled,
-            trustedDevicesRevoked: ctx.session.flashMessages.get("trustedDevicesRevoked") ?? null,
+            trustedDevicesRevoked: ctx.session.flashMessages.get('trustedDevicesRevoked') ?? null,
             sessionsSupported,
             sessions: ownSessions.map((s) => ({
-                loginTs: s.loginTs ? new Date(s.loginTs * 1000).toISOString() : "",
-                browser: s.browser ?? "",
-                os: s.os ?? "",
-                ip: s.ip ?? "",
-                location: s.location ?? "",
+                loginTs: s.loginTs ? new Date(s.loginTs * 1000).toISOString() : '',
+                browser: s.browser ?? '',
+                os: s.os ?? '',
+                ip: s.ip ?? '',
+                location: s.location ?? '',
             })),
             // Export de dados (portabilidade) sempre disponível para a conta logada.
             exportSupported: true,
             // Deleção de conta (LGPD): só quando o store suporta hard delete.
             deletionSupported: supportsAccountDeletion(cfg.accountStore),
-            deleteError: ctx.session.flashMessages.get("deleteError") ?? null,
+            deleteError: ctx.session.flashMessages.get('deleteError') ?? null,
         });
     }
     /**
@@ -100,20 +102,20 @@ export default class AccountSecurityController {
      * NUNCA inclui segredos. Audita `account.exported`.
      */
     async exportData(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (cfg.accountLifecycle?.durable) {
             // OPT-IN durável: enfileira o workflow de export (coleta + persiste artefato
             // + entrega async). Isolado no subpath durável — só carregado neste ramo.
-            const { resolveWorkflowEngine, enqueueAccountExport } = await import("../durable/index.js");
+            const { resolveWorkflowEngine, enqueueAccountExport } = await import('../durable/index.js');
             const engine = await resolveWorkflowEngine(ctx.containerResolver);
             await enqueueAccountExport(engine, {
                 accountId: userId,
                 ip: ctx.request.ip?.() ?? null,
             });
-            ctx.session.flash("exportRequested", translate(cfg.messages, "account.export.requested"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('exportRequested', translate(cfg.messages, 'account.export.requested'));
+            return ctx.response.redirect(accountPath('security'));
         }
         // Caminho SÍNCRONO de sempre (byte-idêntico): download inline do JSON.
         const payload = await new AccountExportService(service).export(userId);
@@ -121,12 +123,12 @@ export default class AccountSecurityController {
             return ctx.response.notFound();
         }
         await cfg.audit?.record({
-            type: "account.exported",
+            type: 'account.exported',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
         });
-        ctx.response.header("content-type", "application/json; charset=utf-8");
-        ctx.response.header("content-disposition", `attachment; filename="authkit-data-export-${userId}.json"`);
+        ctx.response.header('content-type', 'application/json; charset=utf-8');
+        ctx.response.header('content-disposition', `attachment; filename="authkit-data-export-${userId}.json"`);
         return ctx.response.send(JSON.stringify(payload, null, 2));
     }
     /**
@@ -136,12 +138,12 @@ export default class AccountSecurityController {
      * completo e encerra a sessão.
      */
     async deleteAccount(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountDeletion(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         // Sudo mode gate (defesa em profundidade — confirmação inline continua abaixo).
         const sudoSettingsDel = await resolveRuntimeSettings(ctx);
@@ -150,7 +152,7 @@ export default class AccountSecurityController {
             return sudoResultDel;
         const account = await store.findById(userId);
         if (!account) {
-            return ctx.response.redirect("/account/login");
+            return ctx.response.redirect(getAccountLoginUrl());
         }
         const { currentPassword, confirmEmail } = await ctx.request.validateUsing(deleteAccountValidator);
         // Confirmação: senha atual correta OU e-mail digitado batendo com o da conta
@@ -160,25 +162,24 @@ export default class AccountSecurityController {
             confirmed = !!(await store.verifyCredentials(account.email, currentPassword));
         }
         if (!confirmed && confirmEmail) {
-            confirmed =
-                confirmEmail.trim().toLowerCase() === account.email.toLowerCase();
+            confirmed = confirmEmail.trim().toLowerCase() === account.email.toLowerCase();
         }
         if (!confirmed) {
-            ctx.session.flash("deleteError", translate(cfg.messages, "account.delete.invalid_confirmation"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('deleteError', translate(cfg.messages, 'account.delete.invalid_confirmation'));
+            return ctx.response.redirect(accountPath('security'));
         }
         const actor = {
             actorId: userId,
             ip: ctx.request.ip?.() ?? null,
-            source: "self",
+            source: 'self',
         };
         if (cfg.accountLifecycle?.durable) {
             // OPT-IN durável (self-service): logout IMEDIATO (revoga as sessões/grants
             // OIDC do ator de forma síncrona) + enfileira o resto do cascade async.
             // Isolado no subpath durável — só carregado neste ramo.
-            const { resolveWorkflowEngine, enqueueAccountDeletion } = await import("../durable/index.js");
+            const { resolveWorkflowEngine, enqueueAccountDeletion } = await import('../durable/index.js');
             try {
-                const { revokeSessions } = await import("../account_deletion_ops.js");
+                const { revokeSessions } = await import('../account_deletion_ops.js');
                 await revokeSessions(service, userId);
             }
             catch {
@@ -195,8 +196,8 @@ export default class AccountSecurityController {
         // Encerra a sessão e leva ao login com a mensagem de sucesso.
         ctx.session.forget(ACCOUNT_SESSION_KEY);
         await syncAdonisAuthLogout(ctx, cfg);
-        ctx.session.flash("accountDeleted", translate(cfg.messages, "account.delete.deleted"));
-        return ctx.response.redirect("/account/login");
+        ctx.session.flash('accountDeleted', translate(cfg.messages, 'account.delete.deleted'));
+        return ctx.response.redirect(getAccountLoginUrl());
     }
     /**
      * POST /account/security/trusted-devices/revoke
@@ -205,52 +206,52 @@ export default class AccountSecurityController {
      * server-side; re-enrolar o MFA invalida a confiança em TODOS os dispositivos.
      */
     async revokeTrustedDevices(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         ctx.response.clearCookie(TRUSTED_DEVICE_COOKIE);
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         await cfg.audit?.record({
-            type: "trusted_device.revoked",
+            type: 'trusted_device.revoked',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
         });
-        ctx.session.flash("trustedDevicesRevoked", translate(cfg.messages, "account.security.trusted_devices_revoked"));
-        return ctx.response.redirect("/account/security");
+        ctx.session.flash('trustedDevicesRevoked', translate(cfg.messages, 'account.security.trusted_devices_revoked'));
+        return ctx.response.redirect(accountPath('security'));
     }
     /** POST /account/security/profile — atualiza nome + avatar do próprio perfil. */
     async updateProfile(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsProfile(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         const { name, avatarUrl } = await ctx.request.validateUsing(updateProfileValidator);
         // Upload de avatar via o drive do app (opt-in pela presença do arquivo).
         // Se um arquivo for enviado e o drive estiver disponível, a URL resultante
         // tem prioridade sobre o input de URL; senão caímos no avatarUrl (texto).
         let resolvedAvatarUrl = avatarUrl ?? null;
-        let via = "url";
-        const file = ctx.request.file("avatar", {
+        let via = 'url';
+        const file = ctx.request.file('avatar', {
             size: `${cfg.uploads.avatars.maxSizeMb}mb`,
-            extnames: ["jpg", "jpeg", "png", "webp"],
+            extnames: ['jpg', 'jpeg', 'png', 'webp'],
         });
         if (file) {
             try {
                 const uploadedUrl = await storeAvatar(ctx, cfg.uploads, file, userId, {
-                    extname: translate(cfg.messages, "account.profile.avatar_invalid_type"),
-                    size: translate(cfg.messages, "account.profile.avatar_too_large"),
+                    extname: translate(cfg.messages, 'account.profile.avatar_invalid_type'),
+                    size: translate(cfg.messages, 'account.profile.avatar_too_large'),
                 });
                 if (uploadedUrl) {
                     resolvedAvatarUrl = uploadedUrl;
-                    via = "upload";
+                    via = 'upload';
                 }
             }
             catch (error) {
                 if (error instanceof AvatarUploadError) {
-                    ctx.session.flash("securityError", error.message);
-                    return ctx.response.redirect("/account/security");
+                    ctx.session.flash('securityError', error.message);
+                    return ctx.response.redirect(accountPath('security'));
                 }
                 throw error;
             }
@@ -262,21 +263,21 @@ export default class AccountSecurityController {
             avatarUrl: resolvedAvatarUrl,
         });
         await cfg.audit?.record({
-            type: "profile.updated",
+            type: 'profile.updated',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
             metadata: { via },
         });
-        ctx.session.flash("profileUpdated", translate(cfg.messages, "account.profile.updated"));
-        return ctx.response.redirect("/account/security");
+        ctx.session.flash('profileUpdated', translate(cfg.messages, 'account.profile.updated'));
+        return ctx.response.redirect(accountPath('security'));
     }
     async changePassword(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         // Sudo mode gate (defesa em profundidade — a verificação de senha ATUAL continua abaixo).
         const sudoSettings = await resolveRuntimeSettings(ctx);
@@ -286,12 +287,10 @@ export default class AccountSecurityController {
         const { currentPassword, newPassword } = await ctx.request.validateUsing(changePasswordValidator);
         const account = await store.findById(userId);
         // Confirma a senha ATUAL pelo e-mail da conta.
-        const verified = account
-            ? await store.verifyCredentials(account.email, currentPassword)
-            : null;
+        const verified = account ? await store.verifyCredentials(account.email, currentPassword) : null;
         if (!verified) {
-            ctx.session.flash("securityError", translate(cfg.messages, "errors.invalid_credentials"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('securityError', translate(cfg.messages, 'errors.invalid_credentials'));
+            return ctx.response.redirect(accountPath('security'));
         }
         // Verificação de histórico de senhas (disallow_password_reuse).
         // Capability-probed: sem `isPasswordReused` ou com setting desligada → no-op.
@@ -300,13 +299,14 @@ export default class AccountSecurityController {
             if (histSettings.enabled) {
                 // Aplica o pepper à senha candidata antes de comparar com os hashes históricos
                 // (que foram gravados já com pepper). Pepper ausente → identidade.
-                const pepperedNew = cfg.accountStore.__passwordManager?.applyCurrentPepper?.(newPassword) ?? newPassword;
+                const pepperedNew = cfg.accountStore.__passwordManager?.applyCurrentPepper?.(newPassword) ??
+                    newPassword;
                 const reused = await store.isPasswordReused(userId, pepperedNew, histSettings.count);
                 if (reused) {
-                    ctx.session.flash("securityError", translate(cfg.messages, "password.reused", {
+                    ctx.session.flash('securityError', translate(cfg.messages, 'password.reused', {
                         count: histSettings.count,
                     }));
-                    return ctx.response.redirect("/account/security");
+                    return ctx.response.redirect(accountPath('security'));
                 }
                 // Grava o hash ATUAL no histórico antes de trocar.
                 // O hash atual está na linha do DB — buscamos via store.findById + raw model.
@@ -323,13 +323,13 @@ export default class AccountSecurityController {
         catch (error) {
             // Política de senha violada → flash com a regra e volta à tela de segurança.
             if (error instanceof PasswordPolicyError) {
-                ctx.session.flash("securityError", translate(cfg.messages, error.key, error.params));
-                return ctx.response.redirect("/account/security");
+                ctx.session.flash('securityError', translate(cfg.messages, error.key, error.params));
+                return ctx.response.redirect(accountPath('security'));
             }
             throw error;
         }
         await cfg.audit?.record({
-            type: "password.changed",
+            type: 'password.changed',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
         });
@@ -342,7 +342,7 @@ export default class AccountSecurityController {
             const sessions = new AdminSessionsService(service);
             const result = await sessions.revokeAll(userId);
             await cfg.audit?.record({
-                type: "session.revoked_all",
+                type: 'session.revoked_all',
                 accountId: userId,
                 actorId: userId,
                 ip: ctx.request.ip?.() ?? null,
@@ -351,7 +351,7 @@ export default class AccountSecurityController {
                     grants: result.grants,
                     accessTokens: result.accessTokens,
                     refreshTokens: result.refreshTokens,
-                    source: "password-change",
+                    source: 'password-change',
                 },
             });
         }
@@ -362,21 +362,21 @@ export default class AccountSecurityController {
         if (account) {
             await dispatchSecurityNotice(ctx, {
                 account: { id: userId, email: account.email },
-                kind: "password_changed",
+                kind: 'password_changed',
                 ip: ctx.request.ip?.() ?? null,
                 timestamp: new Date().toISOString(),
             }, cfg.mail, cfg.audit);
         }
-        ctx.session.flash("passwordChanged", translate(cfg.messages, "account.security.password_changed"));
-        return ctx.response.redirect("/account/security");
+        ctx.session.flash('passwordChanged', translate(cfg.messages, 'account.security.password_changed'));
+        return ctx.response.redirect(accountPath('security'));
     }
     async changeEmail(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         // Sudo mode gate.
         const sudoSettingsEmail = await resolveRuntimeSettings(ctx);
@@ -386,45 +386,45 @@ export default class AccountSecurityController {
         // Resolve os settings de troca de e-mail em runtime.
         const emailChangeSettings = await resolveEmailChangeSettings(ctx);
         if (!emailChangeSettings.enabled) {
-            ctx.session.flash("securityError", translate(cfg.messages, "account.security.email_change_disabled"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('securityError', translate(cfg.messages, 'account.security.email_change_disabled'));
+            return ctx.response.redirect(accountPath('security'));
         }
         const { currentPassword, newEmail } = await ctx.request.validateUsing(changeEmailValidator);
         const account = await store.findById(userId);
         // requirePassword: se ligado (default true), exige senha atual.
         if (emailChangeSettings.requirePassword) {
             if (!currentPassword) {
-                ctx.session.flash("securityError", translate(cfg.messages, "errors.invalid_credentials"));
-                return ctx.response.redirect("/account/security");
+                ctx.session.flash('securityError', translate(cfg.messages, 'errors.invalid_credentials'));
+                return ctx.response.redirect(accountPath('security'));
             }
             const verified = account
                 ? await store.verifyCredentials(account.email, currentPassword)
                 : null;
             if (!verified) {
-                ctx.session.flash("securityError", translate(cfg.messages, "errors.invalid_credentials"));
-                return ctx.response.redirect("/account/security");
+                ctx.session.flash('securityError', translate(cfg.messages, 'errors.invalid_credentials'));
+                return ctx.response.redirect(accountPath('security'));
             }
         }
         const issued = await store.requestEmailChange(userId, newEmail);
         if (!issued) {
-            ctx.session.flash("securityError", translate(cfg.messages, "errors.email_taken"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('securityError', translate(cfg.messages, 'errors.email_taken'));
+            return ctx.response.redirect(accountPath('security'));
         }
         await cfg.audit?.record({
-            type: "email_change.requested",
+            type: 'email_change.requested',
             accountId: userId,
             email: newEmail,
             ip: ctx.request.ip?.() ?? null,
         });
         const origin = `${ctx.request.protocol()}://${ctx.request.host()}`;
-        const confirmUrl = `${origin}/account/email/confirm?token=${encodeURIComponent(issued.token)}`;
+        const confirmUrl = `${origin}${accountPath('emailConfirm')}?token=${encodeURIComponent(issued.token)}`;
         // 1. Link de confirmação → NOVO e-mail (hook onEmailChangeConfirm > onEmailVerification > default).
         if (cfg.mail?.onEmailChangeConfirm) {
             await cfg.mail.onEmailChangeConfirm({
                 email: newEmail,
                 confirmUrl,
                 token: issued.token,
-                oldEmail: account?.email ?? "",
+                oldEmail: account?.email ?? '',
             });
         }
         else if (cfg.mail?.onEmailVerification) {
@@ -453,22 +453,22 @@ export default class AccountSecurityController {
                 });
             }
         }
-        ctx.session.flash("emailChangeRequested", translate(cfg.messages, "account.security.email_change_requested", {
+        ctx.session.flash('emailChangeRequested', translate(cfg.messages, 'account.security.email_change_requested', {
             email: newEmail,
         }));
-        return ctx.response.redirect("/account/security");
+        return ctx.response.redirect(accountPath('security'));
     }
     /**
      * POST /account/security/email/cancel — cancela uma troca de e-mail pendente
      * (limpa o token pending sem alterar o e-mail da conta).
      */
     async cancelEmailChange(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         // Implementação: issuePendingToken(userId, null) limpa o token; reutilizamos
         // requestEmailChange com um valor sentinela → não, melhor usar cancelEmailChange
@@ -477,7 +477,7 @@ export default class AccountSecurityController {
         // A forma mais limpa é verificar se o store tem cancelEmailChange; se não tiver,
         // chamamos requestEmailChange com o próprio e-mail atual (limpa o pending antigo).
         const cancelFn = store.cancelEmailChange;
-        if (typeof cancelFn === "function") {
+        if (typeof cancelFn === 'function') {
             await cancelFn.call(store, userId);
         }
         else {
@@ -491,27 +491,27 @@ export default class AccountSecurityController {
             }
         }
         await cfg.audit?.record({
-            type: "email_change.cancelled",
+            type: 'email_change.cancelled',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
         });
-        ctx.session.flash("emailChangeRequested", translate(cfg.messages, "account.security.email_change_cancelled"));
-        return ctx.response.redirect("/account/security");
+        ctx.session.flash('emailChangeRequested', translate(cfg.messages, 'account.security.email_change_cancelled'));
+        return ctx.response.redirect(accountPath('security'));
     }
     /** GET /account/email/confirm?token=... — consome o token e aplica o novo e-mail. */
     async confirmEmail(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const render = cfg.render;
         if (!supportsAccountSecurity(store)) {
-            return render(ctx, "account/email-confirmed", { ok: false });
+            return render(ctx, 'account/email-confirmed', { ok: false });
         }
-        const token = ctx.request.qs().token ?? "";
+        const token = ctx.request.qs().token ?? '';
         const result = await store.confirmEmailChange(token);
         if (result.ok) {
             await cfg.audit?.record({
-                type: "email_change.confirmed",
+                type: 'email_change.confirmed',
                 accountId: result.account.id,
                 email: result.newEmail,
                 ip: ctx.request.ip?.() ?? null,
@@ -537,12 +537,12 @@ export default class AccountSecurityController {
             // Notificação de segurança ao NOVO e-mail (email_changed) — best-effort.
             await dispatchSecurityNotice(ctx, {
                 account: { id: result.account.id, email: result.newEmail },
-                kind: "email_changed",
+                kind: 'email_changed',
                 ip: ctx.request.ip?.() ?? null,
                 timestamp: new Date().toISOString(),
                 metadata: { oldEmail: result.oldEmail, newEmail: result.newEmail },
             }, cfg.mail, cfg.audit);
         }
-        return render(ctx, "account/email-confirmed", { ok: result.ok });
+        return render(ctx, 'account/email-confirmed', { ok: result.ok });
     }
 }

package/build/src/host/controllers/account_session_controller.js

@@ -1,12 +1,13 @@
 import '../augmentations.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { accountHome } from '../account_home.js';
+import { getAccountLoginUrl } from '../account_login_url.js';
+import { syncAdonisAuthLogin, syncAdonisAuthLogout } from '../adonis_auth_sync.js';
 import { translate } from '../i18n.js';
 import { attemptPasswordLogin } from '../login_attempt.js';
 import { notifyLoginSuccess } from '../login_notify.js';
-import { markSudo } from '../sudo_mode.js';
-import { accountHome } from '../account_home.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { syncAdonisAuthLogin, syncAdonisAuthLogout } from '../adonis_auth_sync.js';
+import { markSudo } from '../sudo_mode.js';
 /**
  * Valida um valor de `return_to` recebido da query-string ou de um campo hidden.
  *
@@ -132,6 +133,7 @@ export default class AccountSessionController {
         await ctx.session.regenerate();
         // Opt-in: espelha o logout no guard de @adonisjs/auth (ver adonisAuth em define_config.ts).
         await syncAdonisAuthLogout(ctx, cfg);
-        return ctx.response.redirect('/account/login');
+        // Destino configurável (`accountLoginUrl`): default `/account/login`.
+        return ctx.response.redirect(getAccountLoginUrl());
     }
 }

package/build/src/host/controllers/account_tokens_controller.js

@@ -1,4 +1,5 @@
 import '../augmentations.js';
+import { accountPath } from '../account_paths.js';
 import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { requireSudo } from '../sudo_mode.js';
@@ -7,6 +8,11 @@ export default class AccountTokensController {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const render = cfg.render;
+        // PAT é capacidade opcional: sem `patStore` configurado, a tela não existe
+        // (404 limpo em vez de "Cannot read properties of undefined"). Tratado como
+        // orgs — a rota pode estar montada num host que não cabeou o store.
+        if (!cfg.patStore)
+            return ctx.response.notFound();
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const tokens = await cfg.patStore.listForAccount(userId);
         const createdToken = ctx.session.flashMessages.get('createdToken');
@@ -26,6 +32,9 @@ export default class AccountTokensController {
     async store(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
+        // Sem `patStore`: 404 limpo (ver `index`).
+        if (!cfg.patStore)
+            return ctx.response.notFound();
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         // Sudo mode gate.
         const sudoSettingsPat = await resolveRuntimeSettings(ctx);
@@ -41,11 +50,14 @@ export default class AccountTokensController {
             ip: ctx.request.ip?.() ?? null,
             metadata: { patId: pat.id, name: pat.name },
         });
-        return ctx.response.redirect('/account/tokens');
+        return ctx.response.redirect(accountPath('tokens'));
     }
     async destroy(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
+        // Sem `patStore`: 404 limpo (ver `index`).
+        if (!cfg.patStore)
+            return ctx.response.notFound();
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         // Sudo mode gate.
         const sudoSettingsPatRev = await resolveRuntimeSettings(ctx);
@@ -62,6 +74,6 @@ export default class AccountTokensController {
                 metadata: { patId },
             });
         }
-        return ctx.response.redirect('/account/tokens');
+        return ctx.response.redirect(accountPath('tokens'));
     }
 }