@adonis-agora/authkit-server 0.47.0 → 0.48.0

package/build/src/host/controllers/account_mfa_controller.js

@@ -1,13 +1,29 @@
 import '../augmentations.js';
 import QRCode from 'qrcode';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
-import { translate } from '../i18n.js';
 import { supportsPasskeys } from '../../accounts/account_store.js';
-import { dispatchSecurityNotice } from '../security_notice_service.js';
+import { accountPath } from '../account_paths.js';
+import { translate } from '../i18n.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
+import { dispatchSecurityNotice } from '../security_notice_service.js';
 import { requireSudo } from '../sudo_mode.js';
 /** Desafio WebAuthn pendente (registro) guardado na sessão entre begin/finish. */
 const PASSKEY_REG_CHALLENGE_KEY = 'authkit_passkey_reg_challenge';
+/**
+ * `true` quando a requisição é uma NAVEGAÇÃO (form/browser) e não um XHR/fetch:
+ * o cliente aceita `text/html` e NÃO pede explicitamente `application/json`.
+ *
+ * Endpoints duais (JSON para o app React / redirect para o `<form>` clássico)
+ * decidem a resposta por aqui. Um `fetch` sem `Accept` explícito manda coringa
+ * (`*` + `/` + `*`) → não é navegação → JSON (mantém o comportamento de sempre
+ * da `mfa.edge`).
+ */
+function isNavigationRequest(ctx) {
+    const accept = (ctx.request.header('accept') ?? '').toLowerCase();
+    const wantsJson = accept.includes('application/json');
+    const wantsHtml = accept.includes('text/html');
+    return wantsHtml && !wantsJson;
+}
 /**
  * Console de MFA da conta (atrás do account_auth middleware). Enrollment TOTP
  * com QR, confirmação com código, exibição única dos recovery codes e disable.
@@ -90,8 +106,28 @@ export default class AccountMfaController {
         if (accountForNotice) {
             const ts = new Date().toISOString();
             const ip = ctx.request.ip?.() ?? null;
-            await dispatchSecurityNotice(ctx, { account: { id: userId, email: accountForNotice.email }, kind: 'passkey_added', ip, timestamp: ts }, cfg.mail, cfg.audit);
-            await dispatchSecurityNotice(ctx, { account: { id: userId, email: accountForNotice.email }, kind: 'mfa_enabled', ip, timestamp: ts }, cfg.mail, cfg.audit);
+            await dispatchSecurityNotice(ctx, {
+                account: { id: userId, email: accountForNotice.email },
+                kind: 'passkey_added',
+                ip,
+                timestamp: ts,
+            }, cfg.mail, cfg.audit);
+            await dispatchSecurityNotice(ctx, {
+                account: { id: userId, email: accountForNotice.email },
+                kind: 'mfa_enabled',
+                ip,
+                timestamp: ts,
+            }, cfg.mail, cfg.audit);
+        }
+        // Resposta DUAL. A cerimônia WebAuthn da tela built-in (`mfa.edge`) chama
+        // este endpoint por `fetch` e só olha `res.ok` — mas um `<form>` HTML
+        // clássico (progressive enhancement, ou host que POSTa a assertion sem JS)
+        // fica encarando o JSON `{ok:true}` cru. Navegação (o cliente ACEITA HTML e
+        // NÃO pede JSON) → redirect para a tela de MFA (respeitando `accountRoutes`);
+        // XHR/fetch → JSON de sempre. O fetch da view manda Accept coringa, então
+        // cai no ramo JSON e continua funcionando.
+        if (isNavigationRequest(ctx)) {
+            return ctx.response.redirect(accountPath('mfa'));
         }
         return { ok: true };
     }
@@ -116,9 +152,14 @@ export default class AccountMfaController {
         // Notificação de segurança: passkey_removed (best-effort).
         const accountForNotice = await cfg.accountStore.findById(userId);
         if (accountForNotice) {
-            await dispatchSecurityNotice(ctx, { account: { id: userId, email: accountForNotice.email }, kind: 'passkey_removed', ip: ctx.request.ip?.() ?? null, timestamp: new Date().toISOString() }, cfg.mail, cfg.audit);
+            await dispatchSecurityNotice(ctx, {
+                account: { id: userId, email: accountForNotice.email },
+                kind: 'passkey_removed',
+                ip: ctx.request.ip?.() ?? null,
+                timestamp: new Date().toISOString(),
+            }, cfg.mail, cfg.audit);
         }
-        return ctx.response.redirect('/account/mfa');
+        return ctx.response.redirect(accountPath('mfa'));
     }
     /** POST /account/mfa/enroll — gera segredo pendente + QR e mostra a confirmação. */
     async enroll(ctx) {
@@ -133,7 +174,7 @@ export default class AccountMfaController {
             return sudoResultEnroll;
         const started = await cfg.accountStore.startTotpEnrollment?.(userId);
         if (!started) {
-            return ctx.response.redirect('/account/mfa');
+            return ctx.response.redirect(accountPath('mfa'));
         }
         // QR renderizado server-side como data-URL e passado como prop.
         const qrDataUrl = await QRCode.toDataURL(started.otpauthUri);
@@ -176,11 +217,16 @@ export default class AccountMfaController {
         // Notificação de segurança: mfa_enabled (best-effort).
         const accountForMfaNotice = await cfg.accountStore.findById(userId);
         if (accountForMfaNotice) {
-            await dispatchSecurityNotice(ctx, { account: { id: userId, email: accountForMfaNotice.email }, kind: 'mfa_enabled', ip: ctx.request.ip?.() ?? null, timestamp: new Date().toISOString() }, cfg.mail, cfg.audit);
+            await dispatchSecurityNotice(ctx, {
+                account: { id: userId, email: accountForMfaNotice.email },
+                kind: 'mfa_enabled',
+                ip: ctx.request.ip?.() ?? null,
+                timestamp: new Date().toISOString(),
+            }, cfg.mail, cfg.audit);
         }
         // Mostra os recovery codes UMA vez (flash) e volta pro estado "ativado".
         ctx.session.flash('recoveryCodes', result.recoveryCodes ?? []);
-        return ctx.response.redirect('/account/mfa');
+        return ctx.response.redirect(accountPath('mfa'));
     }
     /** POST /account/mfa/disable — desliga o MFA. */
     async disable(ctx) {
@@ -201,8 +247,13 @@ export default class AccountMfaController {
         // Notificação de segurança: mfa_disabled (best-effort).
         const accountForDisableNotice = await cfg.accountStore.findById(userId);
         if (accountForDisableNotice) {
-            await dispatchSecurityNotice(ctx, { account: { id: userId, email: accountForDisableNotice.email }, kind: 'mfa_disabled', ip: ctx.request.ip?.() ?? null, timestamp: new Date().toISOString() }, cfg.mail, cfg.audit);
+            await dispatchSecurityNotice(ctx, {
+                account: { id: userId, email: accountForDisableNotice.email },
+                kind: 'mfa_disabled',
+                ip: ctx.request.ip?.() ?? null,
+                timestamp: new Date().toISOString(),
+            }, cfg.mail, cfg.audit);
         }
-        return ctx.response.redirect('/account/mfa');
+        return ctx.response.redirect(accountPath('mfa'));
     }
 }

package/build/src/host/controllers/account_orgs_controller.js

@@ -1,10 +1,11 @@
 import '../augmentations.js';
 import { supportsOrganizations } from '../../accounts/account_store.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
+import { accountPath } from '../account_paths.js';
+import { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, encodeActiveOrgCookie, } from '../active_org_cookie.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { isRoleInCatalog } from '../runtime_toggles.js';
-import { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, encodeActiveOrgCookie, } from '../active_org_cookie.js';
 /**
  * Console de conta — Organizations. Server-rendered, padrão dos outros controllers
  * de conta (account_tokens_controller, account_security_controller, etc.).
@@ -52,9 +53,7 @@ export default class AccountOrgsController {
             availableRoles: cfg.organizations.roles,
             messages,
         };
-        return cfg.render
-            ? cfg.render(ctx, 'account/orgs', props)
-            : response.notFound();
+        return cfg.render ? cfg.render(ctx, 'account/orgs', props) : response.notFound();
     }
     /** POST /account/orgs — criar nova org (requer allowSelfCreate). */
     async store(ctx) {
@@ -69,7 +68,7 @@ export default class AccountOrgsController {
         const name = request.input('name', '').trim();
         const slug = request.input('slug', '').trim();
         if (!name || !slug)
-            return response.redirect('/account/orgs');
+            return response.redirect(accountPath('orgs'));
         try {
             await store.createOrg({ name, slug, ownerAccountId: accountId });
             await cfg.audit?.record({ type: 'organization.created', accountId, metadata: { slug } });
@@ -77,7 +76,7 @@ export default class AccountOrgsController {
         catch {
             // slug duplicado ou outro erro — redireciona sem mensagem de erro específica
         }
-        return response.redirect('/account/orgs');
+        return response.redirect(accountPath('orgs'));
     }
     /** POST /account/orgs/:id/activate — define org ativa (valida membership). */
     async activate(ctx) {
@@ -91,12 +90,16 @@ export default class AccountOrgsController {
         const orgId = params.id;
         const membership = await store.getOrgMembership(orgId, accountId);
         if (!membership)
-            return response.redirect('/account/orgs');
+            return response.redirect(accountPath('orgs'));
         const org = await store.findOrgById(orgId);
         if (!org)
-            return response.redirect('/account/orgs');
+            return response.redirect(accountPath('orgs'));
         // Grava cookie de org ativa
-        const cookieValue = encodeActiveOrgCookie({ orgId, orgSlug: org.slug, orgRole: membership.role });
+        const cookieValue = encodeActiveOrgCookie({
+            orgId,
+            orgSlug: org.slug,
+            orgRole: membership.role,
+        });
         ctx.response.cookie(ACTIVE_ORG_COOKIE, cookieValue, {
             httpOnly: true,
             sameSite: 'lax',
@@ -104,8 +107,12 @@ export default class AccountOrgsController {
             secure: ctx.request.secure(),
             path: '/',
         });
-        await cfg.audit?.record({ type: 'organization.switched', accountId, metadata: { orgId, orgSlug: org.slug } });
-        return response.redirect('/account/orgs');
+        await cfg.audit?.record({
+            type: 'organization.switched',
+            accountId,
+            metadata: { orgId, orgSlug: org.slug },
+        });
+        return response.redirect(accountPath('orgs'));
     }
     /** POST /account/orgs/deactivate — remove org ativa. */
     async deactivate(ctx) {
@@ -115,7 +122,7 @@ export default class AccountOrgsController {
         const accountId = session.get(ACCOUNT_SESSION_KEY);
         ctx.response.clearCookie(ACTIVE_ORG_COOKIE, { path: '/' });
         await cfg.audit?.record({ type: 'organization.deactivated', accountId });
-        return response.redirect('/account/orgs');
+        return response.redirect(accountPath('orgs'));
     }
     /** POST /account/orgs/:id/leave — sai da org (verifica last_owner). */
     async leave(ctx) {
@@ -128,9 +135,13 @@ export default class AccountOrgsController {
             return response.forbidden();
         const result = await store.removeOrgMember(params.id, accountId);
         if (result.ok) {
-            await cfg.audit?.record({ type: 'organization.member_removed', accountId, metadata: { orgId: params.id, self: true } });
+            await cfg.audit?.record({
+                type: 'organization.member_removed',
+                accountId,
+                metadata: { orgId: params.id, self: true },
+            });
         }
-        return response.redirect('/account/orgs');
+        return response.redirect(accountPath('orgs'));
     }
     /** POST /account/orgs/:id/invite — convida membro por e-mail. */
     async invite(ctx) {
@@ -149,7 +160,7 @@ export default class AccountOrgsController {
         const email = request.input('email', '').trim();
         const role = request.input('role', 'member').trim();
         if (!email)
-            return response.redirect('/account/orgs');
+            return response.redirect(accountPath('orgs'));
         // H4: valida o role contra o catálogo efetivo de roles da org (runtime →
         // config → defaults). Role fora do catálogo é rejeitada (não cria convite).
         // Usa o helper PURO `isRoleInCatalog` (mesmo ponto de verdade do caminho admin).
@@ -160,7 +171,9 @@ export default class AccountOrgsController {
             invitationTtlHours: cfg.organizations.invitationTtlHours,
         }, params.id);
         if (!roleValid) {
-            return response.unprocessableEntity({ error: { code: 'invalid_role', message: 'Role inválida.' } });
+            return response.unprocessableEntity({
+                error: { code: 'invalid_role', message: 'Role inválida.' },
+            });
         }
         // H4: no fluxo member-facing, só um OWNER pode conceder a role `owner`.
         // Um admin (não-owner) tentando convidar como `owner` é escalonamento.
@@ -177,7 +190,7 @@ export default class AccountOrgsController {
         // Dispara e-mail via mail hook (best-effort)
         if (cfg.mail?.onOrgInvitation) {
             const org = await store.findOrgById(params.id);
-            const acceptUrl = `${ctx.request.protocol()}://${ctx.request.host()}/account/orgs/invitations/${token}/accept`;
+            const acceptUrl = `${ctx.request.protocol()}://${ctx.request.host()}${accountPath('orgs')}/invitations/${token}/accept`;
             try {
                 await cfg.mail.onOrgInvitation({
                     email,
@@ -198,7 +211,7 @@ export default class AccountOrgsController {
             accountId,
             metadata: { orgId: params.id, email, role },
         });
-        return response.redirect('/account/orgs');
+        return response.redirect(accountPath('orgs'));
     }
     /** GET /account/orgs/invitations/:token/accept — mostra tela de aceite. */
     async showAcceptInvitation(ctx) {
@@ -213,7 +226,7 @@ export default class AccountOrgsController {
         if (!accountId) {
             // Não logado: redireciona para login (configurável) com return URL
             const loginUrl = getAccountLoginUrl();
-            const returnTo = encodeURIComponent(`/account/orgs/invitations/${params.token}/accept`);
+            const returnTo = encodeURIComponent(`${accountPath('orgs')}/invitations/${params.token}/accept`);
             const sep = loginUrl.includes('?') ? '&' : '?';
             return response.redirect(`${loginUrl}${sep}returnTo=${returnTo}`);
         }
@@ -243,7 +256,7 @@ export default class AccountOrgsController {
         const tokenHash = createHash('sha256').update(params.token).digest('hex');
         const invitation = await store.findInvitationByTokenHash(tokenHash);
         if (!invitation)
-            return response.redirect('/account/orgs');
+            return response.redirect(accountPath('orgs'));
         const result = await store.acceptInvitation(invitation.id, accountId);
         if (result.ok) {
             await cfg.audit?.record({
@@ -252,7 +265,7 @@ export default class AccountOrgsController {
                 metadata: { orgId: invitation.organizationId, invitationId: invitation.id },
             });
         }
-        return response.redirect('/account/orgs');
+        return response.redirect(accountPath('orgs'));
     }
     /** POST /account/orgs/:id/members/:accountId/remove */
     async removeMember(ctx) {
@@ -264,7 +277,8 @@ export default class AccountOrgsController {
         if (!supportsOrganizations(store))
             return response.forbidden();
         const actorMembership = await store.getOrgMembership(params.id, actorId);
-        if (!actorMembership || (actorMembership.role !== 'owner' && actorMembership.role !== 'admin')) {
+        if (!actorMembership ||
+            (actorMembership.role !== 'owner' && actorMembership.role !== 'admin')) {
             return response.forbidden();
         }
         const result = await store.removeOrgMember(params.id, params.accountId);
@@ -275,7 +289,7 @@ export default class AccountOrgsController {
                 metadata: { orgId: params.id, targetAccountId: params.accountId },
             });
         }
-        return response.redirect('/account/orgs');
+        return response.redirect(accountPath('orgs'));
     }
     /** POST /account/orgs/:id/invitations/:invId/revoke */
     async revokeInvitation(ctx) {
@@ -287,7 +301,8 @@ export default class AccountOrgsController {
         if (!supportsOrganizations(store))
             return response.forbidden();
         const actorMembership = await store.getOrgMembership(params.id, actorId);
-        if (!actorMembership || (actorMembership.role !== 'owner' && actorMembership.role !== 'admin')) {
+        if (!actorMembership ||
+            (actorMembership.role !== 'owner' && actorMembership.role !== 'admin')) {
             return response.forbidden();
         }
         // Escopado por org (params.id já validado acima): impede IDOR cross-org.
@@ -297,7 +312,7 @@ export default class AccountOrgsController {
             actorId,
             metadata: { orgId: params.id, invitationId: params.invId },
         });
-        return response.redirect('/account/orgs');
+        return response.redirect(accountPath('orgs'));
     }
     // ──────────────────────────────────────────────────────────────────────────
     // JSON endpoints — consumed by @adonis-agora/authkit-react hooks.
@@ -356,7 +371,12 @@ export default class AccountOrgsController {
         const members = canManage ? await store.listOrgMembers(params.id) : [];
         const enrichedMembers = await Promise.all(members.map(async (m) => {
             const account = await store.findById(m.accountId);
-            return { accountId: m.accountId, email: account?.email ?? null, role: m.role, joinedAt: m.joinedAt };
+            return {
+                accountId: m.accountId,
+                email: account?.email ?? null,
+                role: m.role,
+                joinedAt: m.joinedAt,
+            };
         }));
         return {
             id: org.id,

package/build/src/host/controllers/account_security_controller.d.ts

@@ -1,5 +1,5 @@
-import "../augmentations.js";
-import type { HttpContext } from "@adonisjs/core/http";
+import '../augmentations.js';
+import type { HttpContext } from '@adonisjs/core/http';
 /**
  * Self-service de segurança da conta (console de conta): trocar a senha e o
  * e-mail. A troca de senha exige a senha ATUAL (verifyCredentials). A troca de