@adonis-agora/authkit-server 0.47.0 → 0.49.0

package/build/src/host/admin_api/api_users_controller.js

@@ -1,10 +1,10 @@
-import "../augmentations.js";
-import { AdminUsersService } from "./admin_users_service.js";
-import { AdminSessionsService } from "../admin_sessions_service.js";
-import { enrichSessionsWithContext } from "../session_context.js";
-import { resolveRuntimeSettings } from "../runtime_settings.js";
-import { userDto, sessionDto, grantDto, apiError } from "./dto.js";
-import { adminUserCreateValidator, adminUserUpdateValidator, } from "../admin_validators.js";
+import '../augmentations.js';
+import { AdminSessionsService } from '../admin_sessions_service.js';
+import { adminUserCreateValidator, adminUserUpdateValidator } from '../admin_validators.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
+import { enrichSessionsWithContext } from '../session_context.js';
+import { AdminUsersService } from './admin_users_service.js';
+import { apiError, grantDto, sessionDto, userDto } from './dto.js';
 const PAGE_SIZE = 20;
 /**
  * Lê a config + monta o actor `admin-api` para auditoria. O `actorId` recebe o
@@ -13,12 +13,12 @@ const PAGE_SIZE = 20;
  * vazar o segredo. `null` apenas se a guard não anexou (defensivo).
  */
 async function ctxBits(ctx) {
-    const service = await ctx.containerResolver.make("authkit.server");
+    const service = await ctx.containerResolver.make('authkit.server');
     const cfg = service.config;
     const actor = {
         actorId: ctx.adminApiKeyId ?? null,
         ip: ctx.request.ip?.() ?? null,
-        source: "admin-api",
+        source: 'admin-api',
     };
     return { service, cfg, actor };
 }
@@ -30,10 +30,9 @@ export default class ApiUsersController {
     /** GET /users — listagem paginada com busca por e-mail. */
     async index(ctx) {
         const { cfg } = await ctxBits(ctx);
-        const search = ctx.request.input("search", "").trim();
-        const page = Math.max(1, Number.parseInt(ctx.request.input("page", "1"), 10) || 1);
-        const limit = Math.max(1, Math.min(100, Number.parseInt(ctx.request.input("limit", String(PAGE_SIZE)), 10) ||
-            PAGE_SIZE));
+        const search = ctx.request.input('search', '').trim();
+        const page = Math.max(1, Number.parseInt(ctx.request.input('page', '1'), 10) || 1);
+        const limit = Math.max(1, Math.min(100, Number.parseInt(ctx.request.input('limit', String(PAGE_SIZE)), 10) || PAGE_SIZE));
         const result = await cfg.accountStore.listAccounts({ search, page, limit });
         const users = new AdminUsersService(cfg);
         const data = await Promise.all(result.data.map(async (u) => userDto(u, await users.isDisabled(u.id))));
@@ -42,10 +41,10 @@ export default class ApiUsersController {
     /** GET /users/:id */
     async show(ctx) {
         const { cfg } = await ctxBits(ctx);
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const account = await cfg.accountStore.findById(id);
         if (!account)
-            return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         const disabled = await new AdminUsersService(cfg).isDisabled(id);
         return userDto(account, disabled);
     }
@@ -61,10 +60,10 @@ export default class ApiUsersController {
             invite: invite ?? false,
         }, actor);
         if (!result.ok) {
-            if (result.reason === "password_policy") {
-                return ctx.response.badRequest(apiError("password_policy", cfg.messages[result.messageKey] ?? result.messageKey));
+            if (result.reason === 'password_policy') {
+                return ctx.response.badRequest(apiError('password_policy', cfg.messages[result.messageKey] ?? result.messageKey));
             }
-            return ctx.response.conflict(apiError("email_taken", "Já existe uma conta com este e-mail."));
+            return ctx.response.conflict(apiError('email_taken', 'Já existe uma conta com este e-mail.'));
         }
         ctx.response.status(201);
         return { ...userDto(result.account), invited: result.invited };
@@ -72,10 +71,10 @@ export default class ApiUsersController {
     /** PATCH /users/:id — { globalRoles?, name?, avatarUrl? }. */
     async update(ctx) {
         const { cfg, actor } = await ctxBits(ctx);
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const account = await cfg.accountStore.findById(id);
         if (!account)
-            return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         const users = new AdminUsersService(cfg);
         const { globalRoles: roles, name, avatarUrl, } = await ctx.request.validateUsing(adminUserUpdateValidator);
         if (Array.isArray(roles)) {
@@ -83,11 +82,11 @@ export default class ApiUsersController {
             // Proteções de escalonamento/lockout: último admin + auto-rebaixamento.
             // O actorId vem do id da API key (M9); self-demote só aplica se identificável.
             const guard = await users.guardGlobalRolesChange(id, normalized, actor.actorId);
-            if (guard === "last_admin") {
-                return ctx.response.conflict(apiError("last_admin", "Não é possível remover a última conta com a role de administrador."));
+            if (guard === 'last_admin') {
+                return ctx.response.conflict(apiError('last_admin', 'Não é possível remover a última conta com a role de administrador.'));
             }
-            if (guard === "cannot_self_demote") {
-                return ctx.response.conflict(apiError("cannot_self_demote", "Você não pode remover a sua própria role de administrador."));
+            if (guard === 'cannot_self_demote') {
+                return ctx.response.conflict(apiError('cannot_self_demote', 'Você não pode remover a sua própria role de administrador.'));
             }
             // Valida contra o catálogo (mesmo caminho do console) — roles fora do
             // catálogo (e que o usuário não tinha) → 422.
@@ -96,7 +95,7 @@ export default class ApiUsersController {
             if (errorKey) {
                 return ctx.response
                     .status(422)
-                    .send(apiError("invalid_role", cfg.messages[errorKey] ?? errorKey));
+                    .send(apiError('invalid_role', cfg.messages[errorKey] ?? errorKey));
             }
         }
         if (name !== undefined || avatarUrl !== undefined) {
@@ -113,20 +112,20 @@ export default class ApiUsersController {
     /** DELETE /users/:id — deleção completa (cascade) da conta. */
     async destroy(ctx) {
         const { service, cfg, actor } = await ctxBits(ctx);
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         // OPT-IN durável: passa o enqueue (cascade async); senão delete() roda síncrono.
         const enqueue = cfg.accountLifecycle?.durable
-            ? (await import("../durable/index.js")).enqueueDeletionVia(ctx.containerResolver)
+            ? (await import('../durable/index.js')).enqueueDeletionVia(ctx.containerResolver)
             : undefined;
         const outcome = await new AdminUsersService(cfg).delete(service, id, actor, enqueue);
         if (!outcome.ok) {
-            if (outcome.reason === "not_found") {
-                return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            if (outcome.reason === 'not_found') {
+                return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
             }
-            return ctx.response.conflict(apiError("capability_unsupported", "O store de contas não suporta deletar usuários."));
+            return ctx.response.conflict(apiError('capability_unsupported', 'O store de contas não suporta deletar usuários.'));
         }
         // Modo durável: a deleção foi ENFILEIRADA (cascade async) — responde 202-style.
-        if ("enqueued" in outcome) {
+        if ('enqueued' in outcome) {
             return { id, deleted: true, enqueued: true, runId: outcome.runId };
         }
         return { id, deleted: true, ...outcome.result };
@@ -141,26 +140,26 @@ export default class ApiUsersController {
     }
     async #setStatus(ctx, disable) {
         const { cfg, actor } = await ctxBits(ctx);
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const applied = await new AdminUsersService(cfg).setStatus(id, disable, actor);
         if (!applied) {
-            return ctx.response.conflict(apiError("capability_unsupported", "O store de contas não suporta habilitar/desabilitar."));
+            return ctx.response.conflict(apiError('capability_unsupported', 'O store de contas não suporta habilitar/desabilitar.'));
         }
         return { id, disabled: disable };
     }
     /** POST /users/:id/reset-password — envia o e-mail de reset. */
     async resetPassword(ctx) {
         const { cfg, actor } = await ctxBits(ctx);
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const account = await new AdminUsersService(cfg).resetPassword(ctx, id, actor);
         if (!account)
-            return ctx.response.notFound(apiError("not_found", "Usuário não encontrado."));
+            return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         return { id, sent: true };
     }
     /** GET /users/:id/sessions — sessões (enriquecidas com contexto) + grants ativos. */
     async sessions(ctx) {
         const { service, cfg } = await ctxBits(ctx);
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const admin = new AdminSessionsService(service);
         const sessions = await enrichSessionsWithContext(cfg, id, await admin.listSessions(id));
         const grants = await admin.listGrants(id);
@@ -173,10 +172,10 @@ export default class ApiUsersController {
     /** POST /users/:id/revoke-sessions — revoga todas as sessões/grants. */
     async revokeSessions(ctx) {
         const { service, cfg, actor } = await ctxBits(ctx);
-        const id = ctx.request.param("id");
+        const id = ctx.request.param('id');
         const result = await new AdminSessionsService(service).revokeAll(id);
         await cfg.audit?.record({
-            type: "session.revoked_all",
+            type: 'session.revoked_all',
             accountId: id,
             actorId: actor.actorId,
             ip: actor.ip,

package/build/src/host/admin_api/dto.d.ts

@@ -1,9 +1,9 @@
 import type { AuthAccount } from '../../accounts/account_store.js';
-import type { OrgSummary, OrgMember, OrgInvitation } from '../../accounts/account_store.js';
-import type { OrgDetail } from './admin_orgs_service.js';
-import type { AdminClient, CreatedClient } from '../admin_clients_service.js';
-import type { AdminSession, AdminGrant } from '../admin_sessions_service.js';
+import type { OrgInvitation, OrgMember, OrgSummary } from '../../accounts/account_store.js';
 import type { StoredAuditEvent } from '../../audit/audit_sink.js';
+import type { AdminClient, CreatedClient } from '../admin_clients_service.js';
+import type { AdminGrant, AdminSession } from '../admin_sessions_service.js';
+import type { OrgDetail } from './admin_orgs_service.js';
 /** Projeta uma conta para a forma JSON (camelCase) da Admin REST API. */
 export declare function userDto(account: AuthAccount, disabled?: boolean): {
     id: string;

package/build/src/host/admin_clients_service.js

@@ -89,11 +89,12 @@ export class AdminClientsService {
         // grantTypes derrubava token-exchange).
         const merged = {
             clientId,
-            redirectUris: input.redirectUris ?? (existing.redirect_uris ?? []),
-            postLogoutRedirectUris: input.postLogoutRedirectUris ?? (existing.post_logout_redirect_uris ?? []),
-            grantTypes: input.grantTypes ?? (existing.grant_types ?? []),
+            redirectUris: input.redirectUris ?? existing.redirect_uris ?? [],
+            postLogoutRedirectUris: input.postLogoutRedirectUris ?? existing.post_logout_redirect_uris ?? [],
+            grantTypes: input.grantTypes ?? existing.grant_types ?? [],
             tokenEndpointAuthMethod: input.tokenEndpointAuthMethod ??
-                (existing.token_endpoint_auth_method ?? 'client_secret_basic'),
+                existing.token_endpoint_auth_method ??
+                'client_secret_basic',
             backchannelLogoutUri: input.backchannelLogoutUri ?? existing.backchannel_logout_uri,
             backchannelLogoutSessionRequired: input.backchannelLogoutSessionRequired ??
                 existing.backchannel_logout_session_required,

package/build/src/host/admin_console/admin_shell_controller.js

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { extname } from 'node:path';
-import { getAdminPrefix } from '../admin_prefix.js';
 import { resolveAccountRoles } from '../account_roles.js';
+import { getAdminPrefix } from '../admin_prefix.js';
 // ─── Shell HTML cache ─────────────────────────────────────────────────────────
 /**
  * Points to the Vite-built index.html inside build/host/ui-dist/.
@@ -147,7 +147,9 @@ export default class AdminShellController {
     async serveAsset(ctx) {
         // AdonisJS wildcard route `*` → params['*'] is an array of path segments.
         const wildcardParams = ctx.request.params()['*'];
-        const file = Array.isArray(wildcardParams) ? wildcardParams.join('/') : String(wildcardParams ?? '');
+        const file = Array.isArray(wildcardParams)
+            ? wildcardParams.join('/')
+            : String(wildcardParams ?? '');
         if (!file || file.includes('..') || file.includes('\0')) {
             return ctx.response.notFound();
         }

package/build/src/host/admin_console/console_audit_controller.js

@@ -1,5 +1,5 @@
 import '../augmentations.js';
-import { auditDto, apiError } from '../admin_api/dto.js';
+import { apiError, auditDto } from '../admin_api/dto.js';
 /**
  * Endpoints JSON do log de auditoria do console admin React.
  *

package/build/src/host/admin_console/console_clients_controller.js

@@ -1,7 +1,7 @@
 import '../augmentations.js';
+import { apiError, clientDto, createdClientDto } from '../admin_api/dto.js';
 import { AdminClientsService } from '../admin_clients_service.js';
-import { clientDto, createdClientDto, apiError } from '../admin_api/dto.js';
-import { clientInputValidator, clientCreateInput, clientPartialInput } from '../admin_validators.js';
+import { clientCreateInput, clientInputValidator, clientPartialInput, } from '../admin_validators.js';
 /**
  * Endpoints JSON de clients OIDC do console admin React.
  *
@@ -89,7 +89,9 @@ export default class ConsoleClientsController {
             newSecret = await svc.regenerateSecret(id);
         }
         catch (err) {
-            return ctx.response.status(409).send(apiError('not_applicable', err.message ?? 'Cannot regenerate secret for a public client.'));
+            return ctx.response
+                .status(409)
+                .send(apiError('not_applicable', err.message ?? 'Cannot regenerate secret for a public client.'));
         }
         await cfg.audit?.record({
             type: 'client.secret_regenerated',

package/build/src/host/admin_console/console_impersonation_controller.js

@@ -1,6 +1,6 @@
 import '../augmentations.js';
-import { buildImpersonationPanel } from '../impersonation.js';
 import { apiError } from '../admin_api/dto.js';
+import { buildImpersonationPanel } from '../impersonation.js';
 import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 /**
  * Endpoint JSON do painel de impersonation do console admin React.

package/build/src/host/admin_console/console_keys_controller.js

@@ -1,11 +1,9 @@
 import '../augmentations.js';
-import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { apiError } from '../admin_api/dto.js';
 import { buildKeysStatus, rotateNow } from '../key_rotation_actions.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
 function notSupported(ctx) {
-    return ctx.response
-        .status(501)
-        .send(apiError('not_implemented', 'jwks não é managed+store.'));
+    return ctx.response.status(501).send(apiError('not_implemented', 'jwks não é managed+store.'));
 }
 /**
  * Endpoints JSON de gestão da chave de assinatura managed para o console admin React.

package/build/src/host/admin_console/console_orgs_controller.js

@@ -1,9 +1,9 @@
 import '../augmentations.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { AdminOrgsService } from '../admin_api/admin_orgs_service.js';
+import { apiError, orgDetailDto, orgDto } from '../admin_api/dto.js';
+import { orgAddMemberValidator, orgCreateValidator, orgInvitationValidator, orgMemberRoleValidator, orgUpdateValidator, } from '../admin_validators.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { orgDto, orgDetailDto, apiError } from '../admin_api/dto.js';
-import { orgCreateValidator, orgUpdateValidator, orgAddMemberValidator, orgMemberRoleValidator, orgInvitationValidator, } from '../admin_validators.js';
 /**
  * Endpoints JSON de organizações do console admin React.
  * 404 honesto quando o store não suporta organizações (`capability_unsupported`).

package/build/src/host/admin_console/console_roles_controller.js

@@ -1,9 +1,9 @@
 import '../augmentations.js';
-import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { resolveEffectiveRolesCatalog, SETTING_KEYS, } from '../runtime_toggles.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { apiError } from '../admin_api/dto.js';
 import { roleCreateValidator, roleUpdateValidator } from '../admin_validators.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
+import { SETTING_KEYS, resolveEffectiveRolesCatalog, } from '../runtime_toggles.js';
 /** Regex de validação: nome de role — letras maiúsculas, dígitos e underscore. */
 const ROLE_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
 /** ADMIN é protegido: não pode ser removido. */
@@ -53,7 +53,12 @@ export default class ConsoleRolesController {
             newEntry.description = description;
         const updated = [...current.roles, newEntry].sort((a, b) => a.name.localeCompare(b.name));
         await rs.setSetting(SETTING_KEYS.ROLES_CATALOG, { roles: updated }, actorId);
-        await cfg.audit?.record({ type: 'roles_catalog.updated', actorId, ip, metadata: { action: 'create', role: name } });
+        await cfg.audit?.record({
+            type: 'roles_catalog.updated',
+            actorId,
+            ip,
+            metadata: { action: 'create', role: name },
+        });
         return { name, description: description || undefined };
     }
     /** PATCH {prefix}/api/roles/:name — { description? } */
@@ -72,11 +77,14 @@ export default class ConsoleRolesController {
         if (!current.roles.some((r) => r.name === roleName)) {
             return ctx.response.notFound(apiError('not_found', 'Role não encontrada.'));
         }
-        const updatedRoles = current.roles.map((r) => r.name === roleName
-            ? { name: r.name, ...(description ? { description } : {}) }
-            : r);
+        const updatedRoles = current.roles.map((r) => r.name === roleName ? { name: r.name, ...(description ? { description } : {}) } : r);
         await rs.setSetting(SETTING_KEYS.ROLES_CATALOG, { roles: updatedRoles }, actorId);
-        await cfg.audit?.record({ type: 'roles_catalog.updated', actorId, ip, metadata: { action: 'edit', role: roleName } });
+        await cfg.audit?.record({
+            type: 'roles_catalog.updated',
+            actorId,
+            ip,
+            metadata: { action: 'edit', role: roleName },
+        });
         const found = updatedRoles.find((r) => r.name === roleName);
         return found;
     }
@@ -88,7 +96,9 @@ export default class ConsoleRolesController {
         const ip = ctx.request.ip?.() ?? null;
         const roleName = decodeURIComponent(ctx.request.param('name'));
         if (roleName === PROTECTED_ROLE) {
-            return ctx.response.status(409).send(apiError('protected', cfg.messages['admin.roles.admin_protected'] ?? 'A role ADMIN é protegida.'));
+            return ctx.response
+                .status(409)
+                .send(apiError('protected', cfg.messages['admin.roles.admin_protected'] ?? 'A role ADMIN é protegida.'));
         }
         const rs = await resolveRuntimeSettings(ctx);
         if (!rs)
@@ -97,12 +107,20 @@ export default class ConsoleRolesController {
         if (!current.roles.some((r) => r.name === roleName)) {
             return ctx.response.notFound(apiError('not_found', 'Role não encontrada.'));
         }
-        let updatedRoles = current.roles.filter((r) => r.name !== roleName);
+        const updatedRoles = current.roles.filter((r) => r.name !== roleName);
         if (!updatedRoles.some((r) => r.name === PROTECTED_ROLE)) {
-            updatedRoles.unshift({ name: PROTECTED_ROLE, description: 'Full access to the admin console' });
+            updatedRoles.unshift({
+                name: PROTECTED_ROLE,
+                description: 'Full access to the admin console',
+            });
         }
         await rs.setSetting(SETTING_KEYS.ROLES_CATALOG, { roles: updatedRoles }, actorId);
-        await cfg.audit?.record({ type: 'roles_catalog.updated', actorId, ip, metadata: { action: 'delete', role: roleName } });
+        await cfg.audit?.record({
+            type: 'roles_catalog.updated',
+            actorId,
+            ip,
+            metadata: { action: 'delete', role: roleName },
+        });
         return { ok: true, deleted: roleName };
     }
 }

package/build/src/host/admin_console/console_sessions_controller.js

@@ -1,9 +1,9 @@
 import '../augmentations.js';
+import { apiError, grantDto, sessionDto } from '../admin_api/dto.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
-import { enrichSessionsWithContext } from '../session_context.js';
-import { sessionDto, grantDto, apiError } from '../admin_api/dto.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { sessionAccountValidator } from '../admin_validators.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { enrichSessionsWithContext } from '../session_context.js';
 /**
  * Endpoints JSON de sessões/grants do console admin React.
  *

package/build/src/host/admin_console/console_settings_controller.js

@@ -1,7 +1,7 @@
 import '../augmentations.js';
+import { apiError, settingDto } from '../admin_api/dto.js';
+import { SettingLockedError, isSettingLocked, lockedSettingKeys } from '../config_locks.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { settingDto, apiError } from '../admin_api/dto.js';
-import { isSettingLocked, lockedSettingKeys, SettingLockedError } from '../config_locks.js';
 /** 423 Locked: setting travada via defineConfig. */
 function lockedResponse(ctx, err) {
     return ctx.response
@@ -15,8 +15,8 @@ function notSupported(ctx) {
 function resolveOrgId(ctx) {
     const qs = ctx.request.qs();
     if ('organizationId' in qs) {
-        const v = qs['organizationId'];
-        return v && v.trim() ? v.trim() : null;
+        const v = qs.organizationId;
+        return v?.trim() ? v.trim() : null;
     }
     return null;
 }
@@ -80,7 +80,13 @@ export default class ConsoleSettingsController {
             metadata: { key, value: body.value, source: 'admin-console', organizationId: orgId },
         });
         const saved = await svc.getSetting(key, orgId);
-        return settingDto({ key, organizationId: orgId, value: saved, updatedAt: new Date(), updatedBy: null });
+        return settingDto({
+            key,
+            organizationId: orgId,
+            value: saved,
+            updatedAt: new Date(),
+            updatedBy: null,
+        });
     }
     /** DELETE {prefix}/api/settings/:key */
     async destroy(ctx) {

package/build/src/host/admin_console/console_users_controller.d.ts

@@ -1,5 +1,5 @@
-import "../augmentations.js";
-import type { HttpContext } from "@adonisjs/core/http";
+import '../augmentations.js';
+import type { HttpContext } from '@adonisjs/core/http';
 /**
  * Endpoints JSON de usuários do console admin React.
  *