@adonis-agora/authkit-server 0.47.0 → 0.48.0

package/build/src/host/admin_clients_service.js

@@ -89,11 +89,12 @@ export class AdminClientsService {
         // grantTypes derrubava token-exchange).
         const merged = {
             clientId,
-            redirectUris: input.redirectUris ?? (existing.redirect_uris ?? []),
-            postLogoutRedirectUris: input.postLogoutRedirectUris ?? (existing.post_logout_redirect_uris ?? []),
-            grantTypes: input.grantTypes ?? (existing.grant_types ?? []),
+            redirectUris: input.redirectUris ?? existing.redirect_uris ?? [],
+            postLogoutRedirectUris: input.postLogoutRedirectUris ?? existing.post_logout_redirect_uris ?? [],
+            grantTypes: input.grantTypes ?? existing.grant_types ?? [],
             tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ??
-                (existing.token_endpoint_auth_method ?? 'client_secret_basic'),
+                existing.token_endpoint_auth_method ??
+                'client_secret_basic',
             backchannelLogoutUri: input.backchannelLogoutUri ?? existing.backchannel_logout_uri,
             backchannelLogoutSessionRequired: input.backchannelLogoutSessionRequired ??
                 existing.backchannel_logout_session_required,

package/build/src/host/admin_console/admin_shell_controller.js

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { extname } from 'node:path';
-import { getAdminPrefix } from '../admin_prefix.js';
 import { resolveAccountRoles } from '../account_roles.js';
+import { getAdminPrefix } from '../admin_prefix.js';
 // ─── Shell HTML cache ─────────────────────────────────────────────────────────
 /**
  * Points to the Vite-built index.html inside build/host/ui-dist/.
@@ -147,7 +147,9 @@ export default class AdminShellController {
     async serveAsset(ctx) {
         // AdonisJS wildcard route `*` → params['*'] is an array of path segments.
         const wildcardParams = ctx.request.params()['*'];
-        const file = Array.isArray(wildcardParams) ? wildcardParams.join('/') : String(wildcardParams ?? '');
+        const file = Array.isArray(wildcardParams)
+            ? wildcardParams.join('/')
+            : String(wildcardParams ?? '');
         if (!file || file.includes('..') || file.includes('\0')) {
             return ctx.response.notFound();
         }

package/build/src/host/admin_console/console_audit_controller.js

@@ -1,5 +1,5 @@
 import '../augmentations.js';
-import { auditDto, apiError } from '../admin_api/dto.js';
+import { apiError, auditDto } from '../admin_api/dto.js';
 /**
  * Endpoints JSON do log de auditoria do console admin React.
  *

package/build/src/host/admin_console/console_clients_controller.js

@@ -1,7 +1,7 @@
 import '../augmentations.js';
+import { apiError, clientDto, createdClientDto } from '../admin_api/dto.js';
 import { AdminClientsService } from '../admin_clients_service.js';
-import { clientDto, createdClientDto, apiError } from '../admin_api/dto.js';
-import { clientInputValidator, clientCreateInput, clientPartialInput } from '../admin_validators.js';
+import { clientCreateInput, clientInputValidator, clientPartialInput, } from '../admin_validators.js';
 /**
  * Endpoints JSON de clients OIDC do console admin React.
  *
@@ -89,7 +89,9 @@ export default class ConsoleClientsController {
             newSecret = await svc.regenerateSecret(id);
         }
         catch (err) {
-            return ctx.response.status(409).send(apiError('not_applicable', err.message ?? 'Cannot regenerate secret for a public client.'));
+            return ctx.response
+                .status(409)
+                .send(apiError('not_applicable', err.message ?? 'Cannot regenerate secret for a public client.'));
         }
         await cfg.audit?.record({
             type: 'client.secret_regenerated',

package/build/src/host/admin_console/console_impersonation_controller.js

@@ -1,6 +1,6 @@
 import '../augmentations.js';
-import { buildImpersonationPanel } from '../impersonation.js';
 import { apiError } from '../admin_api/dto.js';
+import { buildImpersonationPanel } from '../impersonation.js';
 import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 /**
  * Endpoint JSON do painel de impersonation do console admin React.

package/build/src/host/admin_console/console_keys_controller.js

@@ -1,11 +1,9 @@
 import '../augmentations.js';
-import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { apiError } from '../admin_api/dto.js';
 import { buildKeysStatus, rotateNow } from '../key_rotation_actions.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
 function notSupported(ctx) {
-    return ctx.response
-        .status(501)
-        .send(apiError('not_implemented', 'jwks não é managed+store.'));
+    return ctx.response.status(501).send(apiError('not_implemented', 'jwks não é managed+store.'));
 }
 /**
  * Endpoints JSON de gestão da chave de assinatura managed para o console admin React.

package/build/src/host/admin_console/console_orgs_controller.js

@@ -1,9 +1,9 @@
 import '../augmentations.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { AdminOrgsService } from '../admin_api/admin_orgs_service.js';
+import { apiError, orgDetailDto, orgDto } from '../admin_api/dto.js';
+import { orgAddMemberValidator, orgCreateValidator, orgInvitationValidator, orgMemberRoleValidator, orgUpdateValidator, } from '../admin_validators.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { orgDto, orgDetailDto, apiError } from '../admin_api/dto.js';
-import { orgCreateValidator, orgUpdateValidator, orgAddMemberValidator, orgMemberRoleValidator, orgInvitationValidator, } from '../admin_validators.js';
 /**
  * Endpoints JSON de organizações do console admin React.
  * 404 honesto quando o store não suporta organizações (`capability_unsupported`).

package/build/src/host/admin_console/console_roles_controller.js

@@ -1,9 +1,9 @@
 import '../augmentations.js';
-import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { resolveEffectiveRolesCatalog, SETTING_KEYS, } from '../runtime_toggles.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { apiError } from '../admin_api/dto.js';
 import { roleCreateValidator, roleUpdateValidator } from '../admin_validators.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
+import { SETTING_KEYS, resolveEffectiveRolesCatalog, } from '../runtime_toggles.js';
 /** Regex de validação: nome de role — letras maiúsculas, dígitos e underscore. */
 const ROLE_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
 /** ADMIN é protegido: não pode ser removido. */
@@ -53,7 +53,12 @@ export default class ConsoleRolesController {
             newEntry.description = description;
         const updated = [...current.roles, newEntry].sort((a, b) => a.name.localeCompare(b.name));
         await rs.setSetting(SETTING_KEYS.ROLES_CATALOG, { roles: updated }, actorId);
-        await cfg.audit?.record({ type: 'roles_catalog.updated', actorId, ip, metadata: { action: 'create', role: name } });
+        await cfg.audit?.record({
+            type: 'roles_catalog.updated',
+            actorId,
+            ip,
+            metadata: { action: 'create', role: name },
+        });
         return { name, description: description || undefined };
     }
     /** PATCH {prefix}/api/roles/:name — { description? } */
@@ -72,11 +77,14 @@ export default class ConsoleRolesController {
         if (!current.roles.some((r) => r.name === roleName)) {
             return ctx.response.notFound(apiError('not_found', 'Role não encontrada.'));
         }
-        const updatedRoles = current.roles.map((r) => r.name === roleName
-            ? { name: r.name, ...(description ? { description } : {}) }
-            : r);
+        const updatedRoles = current.roles.map((r) => r.name === roleName ? { name: r.name, ...(description ? { description } : {}) } : r);
         await rs.setSetting(SETTING_KEYS.ROLES_CATALOG, { roles: updatedRoles }, actorId);
-        await cfg.audit?.record({ type: 'roles_catalog.updated', actorId, ip, metadata: { action: 'edit', role: roleName } });
+        await cfg.audit?.record({
+            type: 'roles_catalog.updated',
+            actorId,
+            ip,
+            metadata: { action: 'edit', role: roleName },
+        });
         const found = updatedRoles.find((r) => r.name === roleName);
         return found;
     }
@@ -88,7 +96,9 @@ export default class ConsoleRolesController {
         const ip = ctx.request.ip?.() ?? null;
         const roleName = decodeURIComponent(ctx.request.param('name'));
         if (roleName === PROTECTED_ROLE) {
-            return ctx.response.status(409).send(apiError('protected', cfg.messages['admin.roles.admin_protected'] ?? 'A role ADMIN é protegida.'));
+            return ctx.response
+                .status(409)
+                .send(apiError('protected', cfg.messages['admin.roles.admin_protected'] ?? 'A role ADMIN é protegida.'));
         }
         const rs = await resolveRuntimeSettings(ctx);
         if (!rs)
@@ -97,12 +107,20 @@ export default class ConsoleRolesController {
         if (!current.roles.some((r) => r.name === roleName)) {
             return ctx.response.notFound(apiError('not_found', 'Role não encontrada.'));
         }
-        let updatedRoles = current.roles.filter((r) => r.name !== roleName);
+        const updatedRoles = current.roles.filter((r) => r.name !== roleName);
         if (!updatedRoles.some((r) => r.name === PROTECTED_ROLE)) {
-            updatedRoles.unshift({ name: PROTECTED_ROLE, description: 'Full access to the admin console' });
+            updatedRoles.unshift({
+                name: PROTECTED_ROLE,
+                description: 'Full access to the admin console',
+            });
         }
         await rs.setSetting(SETTING_KEYS.ROLES_CATALOG, { roles: updatedRoles }, actorId);
-        await cfg.audit?.record({ type: 'roles_catalog.updated', actorId, ip, metadata: { action: 'delete', role: roleName } });
+        await cfg.audit?.record({
+            type: 'roles_catalog.updated',
+            actorId,
+            ip,
+            metadata: { action: 'delete', role: roleName },
+        });
         return { ok: true, deleted: roleName };
     }
 }

package/build/src/host/admin_console/console_sessions_controller.js

@@ -1,9 +1,9 @@
 import '../augmentations.js';
+import { apiError, grantDto, sessionDto } from '../admin_api/dto.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
-import { enrichSessionsWithContext } from '../session_context.js';
-import { sessionDto, grantDto, apiError } from '../admin_api/dto.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { sessionAccountValidator } from '../admin_validators.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { enrichSessionsWithContext } from '../session_context.js';
 /**
  * Endpoints JSON de sessões/grants do console admin React.
  *

package/build/src/host/admin_console/console_settings_controller.js

@@ -1,7 +1,7 @@
 import '../augmentations.js';
+import { apiError, settingDto } from '../admin_api/dto.js';
+import { SettingLockedError, isSettingLocked, lockedSettingKeys } from '../config_locks.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { settingDto, apiError } from '../admin_api/dto.js';
-import { isSettingLocked, lockedSettingKeys, SettingLockedError } from '../config_locks.js';
 /** 423 Locked: setting travada via defineConfig. */
 function lockedResponse(ctx, err) {
     return ctx.response
@@ -15,8 +15,8 @@ function notSupported(ctx) {
 function resolveOrgId(ctx) {
     const qs = ctx.request.qs();
     if ('organizationId' in qs) {
-        const v = qs['organizationId'];
-        return v && v.trim() ? v.trim() : null;
+        const v = qs.organizationId;
+        return v?.trim() ? v.trim() : null;
     }
     return null;
 }
@@ -80,7 +80,13 @@ export default class ConsoleSettingsController {
             metadata: { key, value: body.value, source: 'admin-console', organizationId: orgId },
         });
         const saved = await svc.getSetting(key, orgId);
-        return settingDto({ key, organizationId: orgId, value: saved, updatedAt: new Date(), updatedBy: null });
+        return settingDto({
+            key,
+            organizationId: orgId,
+            value: saved,
+            updatedAt: new Date(),
+            updatedBy: null,
+        });
     }
     /** DELETE {prefix}/api/settings/:key */
     async destroy(ctx) {

package/build/src/host/admin_console/console_users_controller.d.ts

@@ -1,5 +1,5 @@
-import "../augmentations.js";
-import type { HttpContext } from "@adonisjs/core/http";
+import '../augmentations.js';
+import type { HttpContext } from '@adonisjs/core/http';
 /**
  * Endpoints JSON de usuários do console admin React.
  *

package/build/src/host/admin_console/console_users_controller.js

@@ -1,13 +1,13 @@
-import "../augmentations.js";
-import { AdminUsersService } from "../admin_api/admin_users_service.js";
-import { AdminSessionsService } from "../admin_sessions_service.js";
-import { enrichSessionsWithContext } from "../session_context.js";
-import { resolveRuntimeSettings } from "../runtime_settings.js";
-import { resolveEffectiveRolesCatalog } from "../runtime_toggles.js";
-import { userDto, sessionDto, grantDto, apiError } from "../admin_api/dto.js";
-import { ACCOUNT_SESSION_KEY } from "../middleware/account_auth.js";
-import { supportsAccountDeletion, supportsAccountStatus, } from "../../accounts/account_store.js";
-import { adminUserCreateValidator, adminUserRolesValidator, } from "../admin_validators.js";
+import '../augmentations.js';
+import { supportsAccountDeletion, supportsAccountStatus } from '../../accounts/account_store.js';
+import { AdminUsersService } from '../admin_api/admin_users_service.js';
+import { apiError, grantDto, sessionDto, userDto } from '../admin_api/dto.js';
+import { AdminSessionsService } from '../admin_sessions_service.js';
+import { adminUserCreateValidator, adminUserRolesValidator } from '../admin_validators.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
+import { resolveEffectiveRolesCatalog } from '../runtime_toggles.js';
+import { enrichSessionsWithContext } from '../session_context.js';
 const PAGE_SIZE = 20;
 /**
  * Endpoints JSON de usuários do console admin React.
@@ -28,12 +28,11 @@ const PAGE_SIZE = 20;
 export default class ConsoleUsersController {
     /** GET {prefix}/api/users */
     async index(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
-        const search = ctx.request.input("search", "").trim();
-        const page = Math.max(1, Number.parseInt(ctx.request.input("page", "1"), 10) || 1);
-        const perPage = Math.max(1, Math.min(100, Number.parseInt(ctx.request.input("perPage", String(PAGE_SIZE)), 10) ||
-            PAGE_SIZE));
+        const search = ctx.request.input('search', '').trim();
+        const page = Math.max(1, Number.parseInt(ctx.request.input('page', '1'), 10) || 1);
+        const perPage = Math.max(1, Math.min(100, Number.parseInt(ctx.request.input('perPage', String(PAGE_SIZE)), 10) || PAGE_SIZE));
         const result = await cfg.accountStore.listAccounts({
             search,
             page,
@@ -45,12 +44,12 @@ export default class ConsoleUsersController {
     }
     /** GET {prefix}/api/users/:id */
     async show(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const account = await cfg.accountStore.findById(id);
         if (!account)
-            return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         const users = new AdminUsersService(cfg);
         const disabled = await users.isDisabled(id);
         // Sessões ativas (degradam quando adapter não enumera).
@@ -82,7 +81,7 @@ export default class ConsoleUsersController {
     }
     /** POST {prefix}/api/users */
     async store(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const actorId = ctx.session?.get(ACCOUNT_SESSION_KEY) ?? null;
         const ip = ctx.request.ip?.() ?? null;
@@ -93,45 +92,45 @@ export default class ConsoleUsersController {
             name: name ?? null,
             password: password ?? null,
             invite: invite ?? false,
-        }, { actorId, ip, source: "admin" });
+        }, { actorId, ip, source: 'admin' });
         if (!result.ok) {
-            if (result.reason === "password_policy") {
-                return ctx.response.badRequest(apiError("password_policy", cfg.messages[result.messageKey] ?? result.messageKey));
+            if (result.reason === 'password_policy') {
+                return ctx.response.badRequest(apiError('password_policy', cfg.messages[result.messageKey] ?? result.messageKey));
             }
-            return ctx.response.conflict(apiError("email_taken", "Já existe uma conta com este e-mail."));
+            return ctx.response.conflict(apiError('email_taken', 'Já existe uma conta com este e-mail.'));
         }
         ctx.response.status(201);
         return { ...userDto(result.account), invited: result.invited };
     }
     /** PATCH {prefix}/api/users/:id/roles */
     async updateRoles(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const account = await cfg.accountStore.findById(id);
         if (!account)
-            return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         const actorId = ctx.session?.get(ACCOUNT_SESSION_KEY) ?? null;
         const { roles: rolesInput } = await ctx.request.validateUsing(adminUserRolesValidator);
         const roles = Array.from(new Set((rolesInput ?? []).map((r) => r.trim()).filter(Boolean)));
         const users = new AdminUsersService(cfg);
         // Proteções de escalonamento/lockout: último admin + auto-rebaixamento.
         const guard = await users.guardGlobalRolesChange(id, roles, actorId);
-        if (guard === "last_admin") {
+        if (guard === 'last_admin') {
             return ctx.response
                 .status(409)
-                .send(apiError("last_admin", "Não é possível remover a última conta com a role de administrador."));
+                .send(apiError('last_admin', 'Não é possível remover a última conta com a role de administrador.'));
         }
-        if (guard === "cannot_self_demote") {
+        if (guard === 'cannot_self_demote') {
             return ctx.response
                 .status(409)
-                .send(apiError("cannot_self_demote", "Você não pode remover a sua própria role de administrador."));
+                .send(apiError('cannot_self_demote', 'Você não pode remover a sua própria role de administrador.'));
         }
         // Resolve RuntimeSettings para validação contra catálogo (fail-safe).
         const runtimeSettings = await resolveRuntimeSettings(ctx);
         const errorKey = await users.setGlobalRolesValidated(id, roles, runtimeSettings);
         if (errorKey) {
-            return ctx.response.badRequest(apiError("invalid_role", cfg.messages[errorKey] ?? errorKey));
+            return ctx.response.badRequest(apiError('invalid_role', cfg.messages[errorKey] ?? errorKey));
         }
         const updated = await cfg.accountStore.findById(id);
         const disabled = await users.isDisabled(id);
@@ -146,24 +145,24 @@ export default class ConsoleUsersController {
         return this.#setStatus(ctx, false);
     }
     async #setStatus(ctx, disable) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const actorId = ctx.session?.get(ACCOUNT_SESSION_KEY) ?? null;
         const ip = ctx.request.ip?.() ?? null;
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const account = await cfg.accountStore.findById(id);
         if (!account)
-            return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         const users = new AdminUsersService(cfg);
         const applied = await users.setStatus(id, disable, {
             actorId,
             ip,
-            source: "admin",
+            source: 'admin',
         });
         if (!applied) {
             return ctx.response
                 .status(409)
-                .send(apiError("capability_unsupported", "O store não suporta habilitar/desabilitar contas."));
+                .send(apiError('capability_unsupported', 'O store não suporta habilitar/desabilitar contas.'));
         }
         const updated = await cfg.accountStore.findById(id);
         const disabled = await users.isDisabled(id);
@@ -171,41 +170,41 @@ export default class ConsoleUsersController {
     }
     /** POST {prefix}/api/users/:id/reset-password */
     async resetPassword(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const actorId = ctx.session?.get(ACCOUNT_SESSION_KEY) ?? null;
         const ip = ctx.request.ip?.() ?? null;
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const users = new AdminUsersService(cfg);
         const account = await users.resetPassword(ctx, id, {
             actorId,
             ip,
-            source: "admin",
+            source: 'admin',
         });
         if (!account)
-            return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         return { ok: true, email: account.email };
     }
     /** DELETE {prefix}/api/users/:id */
     async destroy(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const actorId = ctx.session?.get(ACCOUNT_SESSION_KEY) ?? null;
         const ip = ctx.request.ip?.() ?? null;
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const users = new AdminUsersService(cfg);
         // OPT-IN durável: passa o enqueue (cascade async); senão delete() roda síncrono.
         const enqueue = cfg.accountLifecycle?.durable
-            ? (await import("../durable/index.js")).enqueueDeletionVia(ctx.containerResolver)
+            ? (await import('../durable/index.js')).enqueueDeletionVia(ctx.containerResolver)
             : undefined;
-        const outcome = await users.delete(service, id, { actorId, ip, source: "admin" }, enqueue);
+        const outcome = await users.delete(service, id, { actorId, ip, source: 'admin' }, enqueue);
         if (!outcome.ok) {
-            if (outcome.reason === "not_found") {
-                return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            if (outcome.reason === 'not_found') {
+                return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
             }
             return ctx.response
                 .status(409)
-                .send(apiError("capability_unsupported", "O store não suporta deleção de contas."));
+                .send(apiError('capability_unsupported', 'O store não suporta deleção de contas.'));
         }
         return { ok: true, deleted: id };
     }

package/build/src/host/admin_prefix.js

@@ -22,7 +22,7 @@ let _prefix = DEFAULT_ADMIN_PREFIX;
 export function normalizeAdminPrefix(raw) {
     let p = raw.trim();
     if (!p.startsWith('/'))
-        p = '/' + p;
+        p = `/${p}`;
     p = p.replace(/\/+$/, '');
     return p || '/';
 }
@@ -53,7 +53,7 @@ let _apiPrefix = DEFAULT_ADMIN_API_PREFIX;
 export function normalizeAdminApiPrefix(raw) {
     let p = raw.trim();
     if (!p.startsWith('/'))
-        p = '/' + p;
+        p = `/${p}`;
     p = p.replace(/\/+$/, '');
     return p || '/';
 }

package/build/src/host/admin_sessions_service.js

@@ -230,9 +230,7 @@ export class AdminSessionsService {
         //
         // Sem sessão preservada (exceptSessionId não encontrado / sem loginTs), caímos
         // no default (`now`) — não há sessão nova a proteger nesse caminho.
-        const cutoff = typeof preserved?.loginTs === 'number'
-            ? new Date((preserved.loginTs - 1) * 1000)
-            : undefined;
+        const cutoff = typeof preserved?.loginTs === 'number' ? new Date((preserved.loginTs - 1) * 1000) : undefined;
         await this.recordSubRevocation(accountId, cutoff);
         return {
             sessions: sessionsToRevoke.length,

package/build/src/host/adonis_auth_sync.d.ts

@@ -1,6 +1,6 @@
 import type { HttpContext } from '@adonisjs/core/http';
-import type { ResolvedServerConfig } from '../define_config.js';
 import type { AuthAccount } from '../accounts/account_store.js';
+import type { ResolvedServerConfig } from '../define_config.js';
 /**
  * Sincroniza `ctx.auth` (`@adonisjs/auth`) com um login bem-sucedido no console
  * de conta do authkit. Ver `adonisAuth` em `define_config.ts` pro porquê: sem

package/build/src/host/adonis_auth_user_provider.d.ts

@@ -1,5 +1,5 @@
-import type { ConfigProvider } from '@adonisjs/core/types';
 import type { SessionUserProviderContract } from '@adonisjs/auth/types/session';
+import type { ConfigProvider } from '@adonisjs/core/types';
 import type { AuthAccount } from '../accounts/account_store.js';
 /**
  * User provider de `@adonisjs/auth` (session guard) apoiado no `accountStore`

package/build/src/host/app_key.js

@@ -4,7 +4,7 @@ import { RuntimeException } from '@adonisjs/core/exceptions';
  * LAZY do `register()`) para o erro de `appKey` ausente — um só lugar para
  * editar o texto, e garante que os dois caminhos falem exatamente a mesma coisa.
  */
-export const MISSING_APP_KEY_MESSAGE = 'APP_KEY ausente: defina `export const appKey = new Secret(env.get(\'APP_KEY\'))` em config/app.ts. ' +
+export const MISSING_APP_KEY_MESSAGE = "APP_KEY ausente: defina `export const appKey = new Secret(env.get('APP_KEY'))` em config/app.ts. " +
     'O @adonis-agora/authkit-server precisa dele para assinar os cookies do oidc-provider (NÃO usa config/encryption.ts).';
 /**
  * Lê e valida `app.appKey` (usado pelo oidc-provider para assinar cookies via

package/build/src/host/avatar_storage.js

@@ -43,9 +43,7 @@ let mediaModulePromise;
 async function loadMedia() {
     if (!mediaModulePromise) {
         const specifier = '@adonis-agora/media/single-file';
-        mediaModulePromise = import(__rewriteRelativeImportExtension(specifier))
-            .then((mod) => mod ?? null)
-            .catch(() => null);
+        mediaModulePromise = import(__rewriteRelativeImportExtension(specifier)).then((mod) => mod ?? null).catch(() => null);
     }
     return mediaModulePromise;
 }

package/build/src/host/config_locks.js

@@ -48,9 +48,7 @@ export class SettingLockedError extends Error {
     code = 'E_SETTING_LOCKED';
     key;
     constructor(key) {
-        super(`A setting "${key}" foi definida via defineConfig() e está travada — ` +
-            `não pode ser alterada em runtime (console/Admin API). ` +
-            `Remova-a do defineConfig para liberar a edição pela UI.`);
+        super(`A setting "${key}" foi definida via defineConfig() e está travada — não pode ser alterada em runtime (console/Admin API). Remova-a do defineConfig para liberar a edição pela UI.`);
         this.name = 'SettingLockedError';
         this.key = key;
     }

package/build/src/host/console_session.js

@@ -1,5 +1,5 @@
-import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
 import { getAccountLoginUrl } from './account_login_url.js';
+import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
 /**
  * Helpers públicos para integrar a sessão do console do AuthKit com
  * qualquer coisa fora do pacote (ex.: proteger o dashboard do

package/build/src/host/controllers/account_apps_controller.js

@@ -1,6 +1,7 @@
 import '../augmentations.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { accountPath } from '../account_paths.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 /**
  * Self-service de consentimento ("apps com acesso") no console de conta. Lista os
  * Grants da própria conta agrupados por client (resolvendo o nome do client da
@@ -56,6 +57,6 @@ export default class AccountAppsController {
             },
         });
         ctx.session.flash('appRevoked', cfg.messages['account.apps.revoked'] ?? 'account.apps.revoked');
-        return ctx.response.redirect('/account/apps');
+        return ctx.response.redirect(accountPath('apps'));
     }
 }

package/build/src/host/controllers/account_confirm_controller.js

@@ -8,7 +8,7 @@
  * A tela está atrás do `accountGuard` (requer sessão de conta ativa).
  */
 import '../augmentations.js';
-import { resolveAvailableMethods, configuredSudoMethods, isSudoMethodMounted, sudoContextFrom, LAST_METHOD_SESSION_KEY, } from '../sudo/runtime.js';
+import { LAST_METHOD_SESSION_KEY, configuredSudoMethods, isSudoMethodMounted, resolveAvailableMethods, sudoContextFrom, } from '../sudo/runtime.js';
 /**
  * Reexport de compatibilidade. O construtor canônico do `SudoContext` vive em
  * `sudo/runtime.ts` (é runtime do SPI, não detalhe da tela); este caminho
@@ -23,7 +23,6 @@ export default class AccountConfirmController {
         if (!methods.length) {
             // Nenhum método disponível é erro de CONFIGURAÇÃO do host, não usuário
             // preso: a tela informa e o log aponta o problema.
-            ;
             ctx.logger?.error({ accountId: c.accountId }, 'authkit: nenhum método de sudo disponível para a conta — verifique config.sudo.methods');
         }
         // FLAG-DRIFT: `config.sudo.methods` decide o que a tela OFERECE, mas as
@@ -35,10 +34,7 @@ export default class AccountConfirmController {
         // `configuredSudoMethods` devolve a própria lista montada.
         for (const m of methods) {
             if (!isSudoMethodMounted(m.id)) {
-                ;
-                ctx.logger?.warn({ method: m.id }, `authkit: método de sudo "${m.id}" está em config.sudo.methods mas não teve ` +
-                    'rotas montadas por registerAuthHost — a tela vai oferecer uma opção cujo ' +
-                    'endpoint não existe');
+                ctx.logger?.warn({ method: m.id }, `authkit: método de sudo "${m.id}" está em config.sudo.methods mas não teve rotas montadas por registerAuthHost — a tela vai oferecer uma opção cujo endpoint não existe`);
             }
         }
         return c.cfg.render(ctx, 'account/confirm', {