@adonis-agora/authkit-server 0.47.0 → 0.49.0

package/build/providers/authkit_server_provider.js

@@ -2,18 +2,18 @@ import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { configProvider } from '@adonisjs/core';
 import { RuntimeException } from '@adonisjs/core/exceptions';
-import { OidcService } from '../src/provider/oidc_service.js';
-import { KeystoreReloadPoller } from '../src/provider/keystore_reload.js';
-import { KeyRotationScheduler } from '../src/provider/key_rotation_scheduler.js';
-import { makeSingleFlightLock } from '../src/provider/single_flight_lock.js';
+import { setBootedApp } from '../services/booted_app.js';
+import { defaultEncryptForStore } from '../src/define_config.js';
+import { resolveAppKey } from '../src/host/app_key.js';
 import { resolveEffectiveKeyRotation } from '../src/host/key_rotation.js';
 import { RuntimeSettings } from '../src/host/runtime_settings.js';
-import { defaultEncryptForStore } from '../src/define_config.js';
-import { resolveKeystoreVault, KeystoreManager } from '../src/keys/keystore_manager.js';
 import { KeystoreCodec } from '../src/keys/keystore_codec.js';
 import { loadEncryptionService } from '../src/keys/keystore_crypto.js';
-import { resolveAppKey } from '../src/host/app_key.js';
-import { setBootedApp } from '../services/booted_app.js';
+import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
+import { KeyRotationScheduler } from '../src/provider/key_rotation_scheduler.js';
+import { KeystoreReloadPoller } from '../src/provider/keystore_reload.js';
+import { OidcService } from '../src/provider/oidc_service.js';
+import { makeSingleFlightLock } from '../src/provider/single_flight_lock.js';
 export default class AuthkitServerProvider {
     app;
     constructor(app) {
@@ -112,7 +112,10 @@ export default class AuthkitServerProvider {
             if (jwksInput?.source === 'managed' && jwksInput?.store) {
                 const appRef = this.app;
                 const buildManager = async () => {
-                    const vault = resolveKeystoreVault(jwksInput.store, { makePath: (p) => appRef.makePath(p), container: appRef.container });
+                    const vault = resolveKeystoreVault(jwksInput.store, {
+                        makePath: (p) => appRef.makePath(p),
+                        container: appRef.container,
+                    });
                     const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(jwksInput.store);
                     // best-effort (≠ boot, que lança): se a encryption sumir em runtime, o reload
                     // degrada para "sem hot-reload" (o onError do poller engole) em vez de derrubar o processo.
@@ -130,7 +133,11 @@ export default class AuthkitServerProvider {
                 };
                 keystoreManager = async () => buildManager();
             }
-            return new OidcService(config, appKey, metrics, { jwksLoader, keystoreHead, keystoreManager });
+            return new OidcService(config, appKey, metrics, {
+                jwksLoader,
+                keystoreHead,
+                keystoreManager,
+            });
         });
         this.app.container.singleton('authkit.metrics', async () => {
             const value = this.app.config.get('authkit');
@@ -238,7 +245,9 @@ export default class AuthkitServerProvider {
         // conexão que o resto do authkit (mesmo padrão do expire_scan_command).
         const value = this.app.config.get('authkit');
         const config = value
-            ? (await configProvider.resolve(this.app, value).catch(() => null))
+            ? (await configProvider
+                .resolve(this.app, value)
+                .catch(() => null))
             : null;
         const connection = config?.schema?.connection;
         // RuntimeSettings sem request (mesmo padrão de expire_scan_command / security_notice_service).

package/build/services/main.d.ts

@@ -1,4 +1,4 @@
-import type { OidcService } from "../src/provider/oidc_service.js";
+import type { OidcService } from '../src/provider/oidc_service.js';
 /**
  * Acessor singleton do {@link OidcService}, seguindo a convenção `services/main` do
  * AdonisJS (igual `@adonisjs/lucid/services/db`, `@adonisjs/drive/services/main` e

package/build/services/main.js

@@ -1,4 +1,4 @@
-import { getBootedApp } from "./booted_app.js";
+import { getBootedApp } from './booted_app.js';
 /**
  * Acessor singleton do {@link OidcService}, seguindo a convenção `services/main` do
  * AdonisJS (igual `@adonisjs/lucid/services/db`, `@adonisjs/drive/services/main` e
@@ -23,6 +23,6 @@ import { getBootedApp } from "./booted_app.js";
 let service;
 const app = getBootedApp();
 await app.booted(async () => {
-    service = await app.container.make("authkit.server");
+    service = await app.container.make('authkit.server');
 });
 export { service as default };

package/build/src/accounts/lucid_account_store.d.ts

@@ -1,8 +1,8 @@
+import type { AuditSink } from '../audit/audit_sink.js';
+import { type PasswordConfigInput } from '../password/password_manager.js';
+import type { FetchLike, PwnedLogger } from '../password/pwned.js';
 import type { AccountStore } from './account_store.js';
 import { type AccountSecretEncrypter, type WebauthnCeremonies } from './lucid_store/shared.js';
-import { type PasswordConfigInput } from '../password/password_manager.js';
-import type { AuditSink } from '../audit/audit_sink.js';
-import type { PwnedLogger, FetchLike } from '../password/pwned.js';
 export type { AccountSecretEncrypter, WebauthnCeremonies };
 /**
  * Serviço de encryption do app (APP_KEY), carregado LAZY via import dinâmico.

package/build/src/accounts/lucid_account_store.js

@@ -1,13 +1,13 @@
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
-import { hasTable, } from './lucid_store/shared.js';
+import { PasswordManager } from '../password/password_manager.js';
 import { buildCore } from './lucid_store/core.js';
 import { buildMfa } from './lucid_store/mfa.js';
+import { buildOrganizations } from './lucid_store/organizations.js';
+import { buildPasswordExpiration, buildPasswordHistory } from './lucid_store/password_hygiene.js';
 import { buildProviderIdentity } from './lucid_store/provider_identity.js';
+import { hasTable, } from './lucid_store/shared.js';
+import { buildDeletion, buildEmailVerificationStatus, buildProfile, buildStatus, hasColumn, } from './lucid_store/status_profile.js';
 import { buildWebauthn } from './lucid_store/webauthn.js';
-import { buildStatus, buildProfile, buildEmailVerificationStatus, buildDeletion, hasColumn, } from './lucid_store/status_profile.js';
-import { buildOrganizations } from './lucid_store/organizations.js';
-import { buildPasswordHistory, buildPasswordExpiration } from './lucid_store/password_hygiene.js';
-import { PasswordManager } from '../password/password_manager.js';
 let encSvc;
 let encLoading;
 /** Resolve quando o `loadEncryption()` corrente terminar (sucesso OU falha). */
@@ -192,9 +192,7 @@ export function lucidAccountStore(Model, options = {}) {
         // Status (disable/enable) só quando o model tem a coluna `disabled_at`.
         ...(hasColumn(Model, 'disabledAt') ? buildStatus(ctx) : {}),
         // Perfil (nome/avatar) só quando o model tem ao menos uma das colunas.
-        ...(hasColumn(Model, 'fullName') || hasColumn(Model, 'avatarUrl')
-            ? buildProfile(ctx)
-            : {}),
+        ...(hasColumn(Model, 'fullName') || hasColumn(Model, 'avatarUrl') ? buildProfile(ctx) : {}),
         // Estado de verificação de e-mail (leitura) só quando o model tem a coluna.
         ...(hasColumn(Model, 'emailVerifiedAt') ? buildEmailVerificationStatus(ctx) : {}),
         // Deleção da conta: sempre disponível (qualquer model Lucid pode deletar).

package/build/src/accounts/lucid_store/core.js

@@ -1,6 +1,6 @@
 import { randomBytes } from 'node:crypto';
-import { DateTime } from 'luxon';
 import { Scrypt } from '@adonisjs/core/hash/drivers/scrypt';
+import { DateTime } from 'luxon';
 import { hasColumn } from './status_profile.js';
 /** Prefixo do token de troca de e-mail (reaproveita a coluna emailVerificationToken). */
 const EMAIL_CHANGE_PREFIX = 'ec:';

package/build/src/accounts/lucid_store/mfa.js

@@ -1,5 +1,5 @@
 import { authenticator } from 'otplib';
-import { generateRecoveryCode, hashesEqual, sha256, buildMfaStateRepo, } from './shared.js';
+import { buildMfaStateRepo, generateRecoveryCode, hashesEqual, sha256, } from './shared.js';
 /**
  * Capacidade de MFA / TOTP — LIB-OWNED.
  *

package/build/src/accounts/lucid_store/organizations.js

@@ -201,9 +201,7 @@ export function buildOrganizations(ctx) {
             return rows.map(toOrgInvitation);
         },
         async listPendingInvitationsForEmail(email) {
-            const rows = await InvitationModel.query()
-                .where('email', email)
-                .whereNull('accepted_at');
+            const rows = await InvitationModel.query().where('email', email).whereNull('accepted_at');
             return rows.map(toOrgInvitation);
         },
         async acceptInvitation(invitationId, accountId) {
@@ -227,7 +225,7 @@ export function buildOrganizations(ctx) {
             else {
                 expiresMs = 0;
             }
-            if (isNaN(expiresMs) || expiresMs < Date.now())
+            if (Number.isNaN(expiresMs) || expiresMs < Date.now())
                 return { ok: false, reason: 'expired' };
             // Verifica e-mail
             const accountEmail = await findAccountEmail(accountId);

package/build/src/accounts/lucid_store/password_hygiene.js

@@ -74,10 +74,7 @@ export function buildPasswordHistory(ctx, db) {
                     return; // menos registros que o limite → nada a podar
                 // Apaga os mais antigos (todos exceto os últimos `count`).
                 const keepIds = rows.map((r) => r.id);
-                await qFrom()
-                    .where('account_id', accountId)
-                    .whereNotIn('id', keepIds)
-                    .delete();
+                await qFrom().where('account_id', accountId).whereNotIn('id', keepIds).delete();
             }
             catch {
                 // Best-effort.

package/build/src/accounts/lucid_store/shared.d.ts

@@ -1,7 +1,7 @@
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
-import type { AuthAccount } from '../account_store.js';
 import type { AuditSink } from '../../audit/audit_sink.js';
 import type { PasswordManager } from '../../password/password_manager.js';
+import type { AuthAccount } from '../account_store.js';
 /**
  * Encripta/decripta um valor (ex.: o segredo TOTP) em repouso. Mantém a lib
  * desacoplada do serviço de encryption do app — qualquer implementação que

package/build/src/accounts/lucid_stores.d.ts

@@ -1,7 +1,7 @@
-import { type LucidAccountStoreOptions } from './lucid_account_store.js';
-import type { AccountStore } from './account_store.js';
-import type { PatStore } from '../pat/pat_store.js';
 import type { AuditSink } from '../audit/audit_sink.js';
+import type { PatStore } from '../pat/pat_store.js';
+import type { AccountStore } from './account_store.js';
+import { type LucidAccountStoreOptions } from './lucid_account_store.js';
 /** Models Lucid (compostos dos mixins do authkit) para montar os stores de uma vez. */
 export interface LucidStoresModels {
     /** Model de `withAuthUser()` (+withCredentials/+withMfa). Obrigatório. */

package/build/src/accounts/lucid_stores.js

@@ -1,6 +1,6 @@
-import { lucidAccountStore } from './lucid_account_store.js';
-import { lucidPatStore } from '../pat/lucid_pat_store.js';
 import { lucidAuditSink } from '../audit/lucid_audit_sink.js';
+import { lucidPatStore } from '../pat/lucid_pat_store.js';
+import { lucidAccountStore } from './lucid_account_store.js';
 /**
  * Conveniência que monta `accountStore` (+ `patStore` + `audit`) a partir dos models,
  * declarando `mfaIssuer`/`webauthn`/`encrypter` UMA vez. Substitui o wiring repetido

package/build/src/adapters/database_adapter.js

@@ -52,7 +52,9 @@ export class DatabaseAdapter {
         if (!found)
             return;
         found.consumed = Math.floor(Date.now() / 1000);
-        await this.#query().where('id', id).update({ payload: JSON.stringify(found) });
+        await this.#query()
+            .where('id', id)
+            .update({ payload: JSON.stringify(found) });
     }
     async destroy(id) {
         await this.#query().where('id', id).delete();

package/build/src/adapters/factory.js

@@ -1,5 +1,5 @@
-import { RedisAdapter } from './redis_adapter.js';
 import { DatabaseAdapter } from './database_adapter.js';
+import { RedisAdapter } from './redis_adapter.js';
 export const adapters = {
     /**
      * Factory para o adapter Redis. O consumidor precisa ter o @adonisjs/redis

package/build/src/adapters/redis_adapter.js

@@ -88,7 +88,8 @@ export class RedisAdapter {
         const gk = this.#grantKey(grantId);
         const keys = await this.redis.lrange(gk, 0, -1);
         const multi = this.redis.multi();
-        keys.forEach((k) => multi.del(k));
+        for (const k of keys)
+            multi.del(k);
         multi.del(gk);
         await multi.exec();
     }

package/build/src/commands/expire_scan_command.js

@@ -27,9 +27,9 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
-import { resolveAuthkitConfig } from './resolve_config.js';
 import { RuntimeSettings } from '../host/runtime_settings.js';
 import { resolveEffectiveAccountExpiration } from '../host/runtime_toggles.js';
+import { resolveAuthkitConfig } from './resolve_config.js';
 // ---------------------------------------------------------------------------
 // Core logic (pura, testável sem Ace)
 // ---------------------------------------------------------------------------
@@ -101,7 +101,11 @@ export async function runExpireScan(app, opts) {
             else if (warnDays > 0 && lastMs < warnCutoffMs) {
                 // A expirar em breve.
                 const daysUntilExpiry = Math.ceil((lastMs + inactiveDays * 24 * 60 * 60 * 1000 - nowMs) / (24 * 60 * 60 * 1000));
-                warnSoon.push({ accountId: account.id, email: account.email, expiresInDays: daysUntilExpiry });
+                warnSoon.push({
+                    accountId: account.id,
+                    email: account.email,
+                    expiresInDays: daysUntilExpiry,
+                });
                 if (warn && !dryRun) {
                     // Verifica se já foi avisado dentro da janela de warnDays dias.
                     const alreadyWarned = await wasWarnedRecently(audit, account.id, warnDays);
@@ -150,7 +154,12 @@ export async function runExpireScan(app, opts) {
 /** Retorna o timestamp em ms do último login.success da conta, ou null se nunca logou. */
 async function getLastLoginMs(audit, accountId) {
     try {
-        const result = await audit.list({ type: 'login.success', subject: accountId, page: 1, limit: 1 });
+        const result = await audit.list({
+            type: 'login.success',
+            subject: accountId,
+            page: 1,
+            limit: 1,
+        });
         if (result.data.length === 0)
             return null;
         const createdAt = result.data[0].createdAt;
@@ -169,7 +178,12 @@ async function getLastLoginMs(audit, accountId) {
  */
 async function wasWarnedRecently(audit, accountId, warnDays) {
     try {
-        const result = await audit.list({ type: 'account.expiration_warned', subject: accountId, page: 1, limit: 1 });
+        const result = await audit.list({
+            type: 'account.expiration_warned',
+            subject: accountId,
+            page: 1,
+            limit: 1,
+        });
         if (result.data.length === 0)
             return false;
         const lastWarned = result.data[0].createdAt;
@@ -201,7 +215,7 @@ async function sendWarnEmail(cfg, account, expiresInDays) {
         await mail.send((message) => {
             message
                 .to(account.email)
-                .subject(`Your account will be deactivated due to inactivity`)
+                .subject('Your account will be deactivated due to inactivity')
                 .html(`<p>Your account will be deactivated in <strong>${expiresInDays} day(s)</strong> due to inactivity. Sign in to keep your account active.</p>`)
                 .text(`Your account will be deactivated in ${expiresInDays} day(s) due to inactivity. Sign in to keep your account active.`);
         });

package/build/src/commands/settings_commands.js

@@ -15,8 +15,8 @@
  * Todas suportam --json para output machine-readable.
  */
 import { RuntimeSettings } from '../host/runtime_settings.js';
-import { resolveAuthkitConfig } from './resolve_config.js';
 import { SETTING_KEYS } from '../host/runtime_toggles.js';
+import { resolveAuthkitConfig } from './resolve_config.js';
 // ---------------------------------------------------------------------------
 // Known-key shape validators (best-effort — warn only, não rejeita)
 // ---------------------------------------------------------------------------
@@ -31,7 +31,13 @@ function validateKnownKey(key, value) {
     const obj = value;
     switch (key) {
         case SETTING_KEYS.LOCKOUT: {
-            const fields = ['enabled', 'maxAttempts', 'windowSec', 'baseLockoutSec', 'maxLockoutSec'];
+            const fields = [
+                'enabled',
+                'maxAttempts',
+                'windowSec',
+                'baseLockoutSec',
+                'maxLockoutSec',
+            ];
             for (const f of fields) {
                 if (f in obj && f === 'enabled' && typeof obj[f] !== 'boolean')
                     return `lockout.${f} must be boolean`;
@@ -55,13 +61,19 @@ function validateKnownKey(key, value) {
             return null;
         }
         case SETTING_KEYS.PASSWORD_POLICY: {
-            const boolFields = ['requireUppercase', 'requireLowercase', 'requireNumbers', 'requireSymbols', 'checkPwned'];
+            const boolFields = [
+                'requireUppercase',
+                'requireLowercase',
+                'requireNumbers',
+                'requireSymbols',
+                'checkPwned',
+            ];
             for (const f of boolFields) {
                 if (f in obj && typeof obj[f] !== 'boolean')
                     return `password_policy.${f} must be boolean`;
             }
             if ('minLength' in obj && typeof obj.minLength !== 'number')
-                return `password_policy.minLength must be number`;
+                return 'password_policy.minLength must be number';
             return null;
         }
         case SETTING_KEYS.NOTIFICATIONS: {
@@ -145,7 +157,12 @@ export async function settingsList(app, opts) {
     }
     const rows = await svc.listSettings();
     if (opts.json) {
-        opts.logger.info(JSON.stringify(rows.map((r) => ({ key: r.key, value: r.value, updatedAt: r.updatedAt, updatedBy: r.updatedBy }))));
+        opts.logger.info(JSON.stringify(rows.map((r) => ({
+            key: r.key,
+            value: r.value,
+            updatedAt: r.updatedAt,
+            updatedBy: r.updatedBy,
+        }))));
         return;
     }
     if (rows.length === 0) {

package/build/src/define_config.d.ts

@@ -1,16 +1,16 @@
-import type { HttpContext } from "@adonisjs/core/http";
-import type { AccessTokenFormat, AccessTokensConfig, ClientConfig, JwksConfig, KeystoreStoreConfig, ObservabilityConfig, TtlConfig } from "@adonis-agora/authkit-core";
-import { adapters, type AdapterFactory, type OidcAdapterClass } from "./adapters/factory.js";
-import type { AccountStore, AuthAccount } from "./accounts/account_store.js";
-import type { PatStore } from "./pat/pat_store.js";
-import type { AuditSink } from "./audit/audit_sink.js";
-import type { SudoMethod } from "./host/sudo/types.js";
-import { type EventsConfigInput } from "./events/dispatcher.js";
-import type { BrandingConfig } from "./host/branding.js";
-import { type AuthMessages, type I18nConfig } from "./host/i18n.js";
-import { type ResolvedTrustedDevicesConfig, type TrustedDevicesConfigInput } from "./host/trusted_device.js";
-import { type BotProtectionConfigInput, type ResolvedBotProtectionConfig } from "./host/bot_protection.js";
-import type { ResolveGeo } from "./host/geo.js";
+import type { AccessTokenFormat, AccessTokensConfig, ClientConfig, JwksConfig, KeystoreStoreConfig, ObservabilityConfig, TtlConfig } from '@adonis-agora/authkit-core';
+import type { HttpContext } from '@adonisjs/core/http';
+import type { AccountStore, AuthAccount } from './accounts/account_store.js';
+import { type AdapterFactory, type OidcAdapterClass, adapters } from './adapters/factory.js';
+import type { AuditSink } from './audit/audit_sink.js';
+import { type EventsConfigInput } from './events/dispatcher.js';
+import { type BotProtectionConfigInput, type ResolvedBotProtectionConfig } from './host/bot_protection.js';
+import type { BrandingConfig } from './host/branding.js';
+import type { ResolveGeo } from './host/geo.js';
+import { type AuthMessages, type I18nConfig } from './host/i18n.js';
+import type { SudoMethod } from './host/sudo/types.js';
+import { type ResolvedTrustedDevicesConfig, type TrustedDevicesConfigInput } from './host/trusted_device.js';
+import type { PatStore } from './pat/pat_store.js';
 export { adapters };
 export type { AuthAccount };
 export type AuthHostRenderer = (ctx: HttpContext, view: string, props: Record<string, unknown>) => unknown;
@@ -120,7 +120,7 @@ export interface MailHooks {
             id: string;
             email: string;
         };
-        kind: "password_changed" | "mfa_enabled" | "mfa_disabled" | "passkey_added" | "passkey_removed" | "email_changed";
+        kind: 'password_changed' | 'mfa_enabled' | 'mfa_disabled' | 'passkey_added' | 'passkey_removed' | 'email_changed';
         ip?: string | null;
         userAgent?: string | null;
         timestamp: string;
@@ -282,7 +282,7 @@ export interface UploadsConfigInput {
          * `'builtin'` força o `@adonisjs/drive`; `'media'` força o media (degrada para
          * o input de URL se indisponível).
          */
-        storage?: "auto" | "builtin" | "media";
+        storage?: 'auto' | 'builtin' | 'media';
         /** Disk do `@adonisjs/drive` a usar (backend builtin). Default: o disk DEFAULT do app. */
         disk?: string;
         /** Diretório/prefixo das chaves (backend builtin). Default: 'authkit/avatars'. */
@@ -298,7 +298,7 @@ export interface UploadsConfigInput {
 export interface ResolvedUploadsConfig {
     avatars: {
         /** Backend ativo (default 'auto'). */
-        storage: "auto" | "builtin" | "media";
+        storage: 'auto' | 'builtin' | 'media';
         /** Disk explícito; `undefined` = disk DEFAULT do app (backend builtin). */
         disk?: string;
         directory: string;
@@ -524,7 +524,7 @@ export interface AdminApiConfigInput {
      * `AUTHKIT_ADMIN_API_KEY` (uma ou várias, separadas por vírgula). Elimina o
      * spread condicional `...(env.get('AUTHKIT_ADMIN_API_KEY') ? {...} : {})`.
      */
-    apiKeys?: string[] | "env";
+    apiKeys?: string[] | 'env';
 }
 export interface ResolvedAdminApiConfig {
     enabled: boolean;
@@ -550,7 +550,7 @@ export interface OrganizationsConfigInput {
      * emite org_id/org_slug/org_role da org ativa da sessão via cookie assinado.
      * Default: 'active'.
      */
-    claimStrategy?: "active";
+    claimStrategy?: 'active';
 }
 export interface ResolvedOrganizationsConfig {
     /** `undefined` = auto (decide em runtime pelo capability-probing do store). */
@@ -558,7 +558,7 @@ export interface ResolvedOrganizationsConfig {
     roles: string[];
     allowSelfCreate: boolean;
     invitationTtlHours: number;
-    claimStrategy: "active";
+    claimStrategy: 'active';
 }
 export declare function resolveOrganizations(input?: OrganizationsConfigInput): ResolvedOrganizationsConfig;
 /**
@@ -601,7 +601,7 @@ export interface AuthServerConfigInput {
      * persistido em arquivo (`tmp/authkit_jwks.json`) p/ dev. Elimina o ternário
      * env-aware que todo app escrevia.
      */
-    jwks: JwksConfig | "auto";
+    jwks: JwksConfig | 'auto';
     ttl?: TtlConfig;
     /** Nome da CLAIM (não do scope) onde os papéis globais são emitidos. Default: 'roles'. */
     globalRolesClaim?: string;