@adonis-agora/authkit-server 0.47.0 → 0.49.0

package/build/src/host/controllers/account_security_controller.js

@@ -1,22 +1,23 @@
-import "../augmentations.js";
-import { ACCOUNT_SESSION_KEY } from "../middleware/account_auth.js";
-import { getAccountLoginUrl } from "../account_login_url.js";
-import { supportsAccountSecurity, supportsAccountDeletion, supportsProfile, supportsPasswordHistory, } from "../../accounts/account_store.js";
-import { changePasswordValidator, changeEmailValidator, deleteAccountValidator, updateProfileValidator, } from "../validators.js";
-import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail, sendEmailChangedCompletedEmail, } from "../default_mailer.js";
-import { storeAvatar, isAvatarUploadSupported, AvatarUploadError, } from "../avatar_storage.js";
-import { translate } from "../i18n.js";
-import { TRUSTED_DEVICE_COOKIE } from "../trusted_device.js";
-import { AccountDeletionService } from "../account_deletion_service.js";
-import { AccountExportService } from "../account_export_service.js";
-import { AdminSessionsService } from "../admin_sessions_service.js";
-import { enrichSessionsWithContext } from "../session_context.js";
-import { PasswordPolicyError } from "../../password/password_manager.js";
-import { resolveRuntimeSettings } from "../runtime_settings.js";
-import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from "../runtime_toggles.js";
-import { dispatchSecurityNotice } from "../security_notice_service.js";
-import { requireSudo } from "../sudo_mode.js";
-import { syncAdonisAuthLogout } from "../adonis_auth_sync.js";
+import '../augmentations.js';
+import { supportsAccountDeletion, supportsAccountSecurity, supportsPasswordHistory, supportsProfile, } from '../../accounts/account_store.js';
+import { PasswordPolicyError } from '../../password/password_manager.js';
+import { AccountDeletionService } from '../account_deletion_service.js';
+import { AccountExportService } from '../account_export_service.js';
+import { getAccountLoginUrl } from '../account_login_url.js';
+import { accountPath } from '../account_paths.js';
+import { AdminSessionsService } from '../admin_sessions_service.js';
+import { syncAdonisAuthLogout } from '../adonis_auth_sync.js';
+import { AvatarUploadError, isAvatarUploadSupported, storeAvatar } from '../avatar_storage.js';
+import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail, sendEmailChangedCompletedEmail, } from '../default_mailer.js';
+import { translate } from '../i18n.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { resolveRuntimeSettings } from '../runtime_settings.js';
+import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';
+import { dispatchSecurityNotice } from '../security_notice_service.js';
+import { enrichSessionsWithContext } from '../session_context.js';
+import { requireSudo } from '../sudo_mode.js';
+import { TRUSTED_DEVICE_COOKIE } from '../trusted_device.js';
+import { changeEmailValidator, changePasswordValidator, deleteAccountValidator, updateProfileValidator, } from '../validators.js';
 /** Resolve os password history settings em runtime (fail-safe). */
 async function resolvePasswordHistorySettings(ctx) {
     try {
@@ -52,7 +53,7 @@ async function resolveEmailChangeSettings(ctx) {
  */
 export default class AccountSecurityController {
     async index(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const render = cfg.render;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
@@ -64,36 +65,37 @@ export default class AccountSecurityController {
         const ownSessions = sessionsSupported
             ? await enrichSessionsWithContext(cfg, userId, await adminSessions.listSessions(userId))
             : [];
-        return render(ctx, "account/security", {
+        const props = {
             csrfToken: ctx.request.csrfToken,
             supported: supportsAccountSecurity(cfg.accountStore),
             profileSupported: supportsProfile(cfg.accountStore),
             // Só mostramos o input de arquivo se ALGUM backend (drive OU media) puder armazenar.
             avatarUploadSupported: await isAvatarUploadSupported(cfg.uploads),
-            email: account?.email ?? "",
-            name: account?.name ?? "",
-            avatarUrl: account?.avatarUrl ?? "",
-            passwordChanged: ctx.session.flashMessages.get("passwordChanged") ?? null,
-            emailChangeRequested: ctx.session.flashMessages.get("emailChangeRequested") ?? null,
-            emailChanged: ctx.session.flashMessages.get("emailChanged") ?? null,
-            profileUpdated: ctx.session.flashMessages.get("profileUpdated") ?? null,
-            error: ctx.session.flashMessages.get("securityError") ?? null,
+            email: account?.email ?? '',
+            name: account?.name ?? '',
+            avatarUrl: account?.avatarUrl ?? '',
+            passwordChanged: ctx.session.flashMessages.get('passwordChanged') ?? null,
+            emailChangeRequested: ctx.session.flashMessages.get('emailChangeRequested') ?? null,
+            emailChanged: ctx.session.flashMessages.get('emailChanged') ?? null,
+            profileUpdated: ctx.session.flashMessages.get('profileUpdated') ?? null,
+            error: ctx.session.flashMessages.get('securityError') ?? null,
             trustedDevicesEnabled: cfg.trustedDevices.enabled,
-            trustedDevicesRevoked: ctx.session.flashMessages.get("trustedDevicesRevoked") ?? null,
+            trustedDevicesRevoked: ctx.session.flashMessages.get('trustedDevicesRevoked') ?? null,
             sessionsSupported,
             sessions: ownSessions.map((s) => ({
-                loginTs: s.loginTs ? new Date(s.loginTs * 1000).toISOString() : "",
-                browser: s.browser ?? "",
-                os: s.os ?? "",
-                ip: s.ip ?? "",
-                location: s.location ?? "",
+                loginTs: s.loginTs ? new Date(s.loginTs * 1000).toISOString() : '',
+                browser: s.browser ?? '',
+                os: s.os ?? '',
+                ip: s.ip ?? '',
+                location: s.location ?? '',
             })),
             // Export de dados (portabilidade) sempre disponível para a conta logada.
             exportSupported: true,
             // Deleção de conta (LGPD): só quando o store suporta hard delete.
             deletionSupported: supportsAccountDeletion(cfg.accountStore),
-            deleteError: ctx.session.flashMessages.get("deleteError") ?? null,
-        });
+            deleteError: ctx.session.flashMessages.get('deleteError') ?? null,
+        };
+        return render(ctx, 'account/security', props);
     }
     /**
      * GET /account/security/export — baixa um JSON com os dados da conta logada
@@ -101,20 +103,20 @@ export default class AccountSecurityController {
      * NUNCA inclui segredos. Audita `account.exported`.
      */
     async exportData(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (cfg.accountLifecycle?.durable) {
             // OPT-IN durável: enfileira o workflow de export (coleta + persiste artefato
             // + entrega async). Isolado no subpath durável — só carregado neste ramo.
-            const { resolveWorkflowEngine, enqueueAccountExport } = await import("../durable/index.js");
+            const { resolveWorkflowEngine, enqueueAccountExport } = await import('../durable/index.js');
             const engine = await resolveWorkflowEngine(ctx.containerResolver);
             await enqueueAccountExport(engine, {
                 accountId: userId,
                 ip: ctx.request.ip?.() ?? null,
             });
-            ctx.session.flash("exportRequested", translate(cfg.messages, "account.export.requested"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('exportRequested', translate(cfg.messages, 'account.export.requested'));
+            return ctx.response.redirect(accountPath('security'));
         }
         // Caminho SÍNCRONO de sempre (byte-idêntico): download inline do JSON.
         const payload = await new AccountExportService(service).export(userId);
@@ -122,12 +124,12 @@ export default class AccountSecurityController {
             return ctx.response.notFound();
         }
         await cfg.audit?.record({
-            type: "account.exported",
+            type: 'account.exported',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
         });
-        ctx.response.header("content-type", "application/json; charset=utf-8");
-        ctx.response.header("content-disposition", `attachment; filename="authkit-data-export-${userId}.json"`);
+        ctx.response.header('content-type', 'application/json; charset=utf-8');
+        ctx.response.header('content-disposition', `attachment; filename="authkit-data-export-${userId}.json"`);
         return ctx.response.send(JSON.stringify(payload, null, 2));
     }
     /**
@@ -137,12 +139,12 @@ export default class AccountSecurityController {
      * completo e encerra a sessão.
      */
     async deleteAccount(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountDeletion(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         // Sudo mode gate (defesa em profundidade — confirmação inline continua abaixo).
         const sudoSettingsDel = await resolveRuntimeSettings(ctx);
@@ -161,25 +163,24 @@ export default class AccountSecurityController {
             confirmed = !!(await store.verifyCredentials(account.email, currentPassword));
         }
         if (!confirmed && confirmEmail) {
-            confirmed =
-                confirmEmail.trim().toLowerCase() === account.email.toLowerCase();
+            confirmed = confirmEmail.trim().toLowerCase() === account.email.toLowerCase();
         }
         if (!confirmed) {
-            ctx.session.flash("deleteError", translate(cfg.messages, "account.delete.invalid_confirmation"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('deleteError', translate(cfg.messages, 'account.delete.invalid_confirmation'));
+            return ctx.response.redirect(accountPath('security'));
         }
         const actor = {
             actorId: userId,
             ip: ctx.request.ip?.() ?? null,
-            source: "self",
+            source: 'self',
         };
         if (cfg.accountLifecycle?.durable) {
             // OPT-IN durável (self-service): logout IMEDIATO (revoga as sessões/grants
             // OIDC do ator de forma síncrona) + enfileira o resto do cascade async.
             // Isolado no subpath durável — só carregado neste ramo.
-            const { resolveWorkflowEngine, enqueueAccountDeletion } = await import("../durable/index.js");
+            const { resolveWorkflowEngine, enqueueAccountDeletion } = await import('../durable/index.js');
             try {
-                const { revokeSessions } = await import("../account_deletion_ops.js");
+                const { revokeSessions } = await import('../account_deletion_ops.js');
                 await revokeSessions(service, userId);
             }
             catch {
@@ -196,7 +197,7 @@ export default class AccountSecurityController {
         // Encerra a sessão e leva ao login com a mensagem de sucesso.
         ctx.session.forget(ACCOUNT_SESSION_KEY);
         await syncAdonisAuthLogout(ctx, cfg);
-        ctx.session.flash("accountDeleted", translate(cfg.messages, "account.delete.deleted"));
+        ctx.session.flash('accountDeleted', translate(cfg.messages, 'account.delete.deleted'));
         return ctx.response.redirect(getAccountLoginUrl());
     }
     /**
@@ -206,52 +207,52 @@ export default class AccountSecurityController {
      * server-side; re-enrolar o MFA invalida a confiança em TODOS os dispositivos.
      */
     async revokeTrustedDevices(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         ctx.response.clearCookie(TRUSTED_DEVICE_COOKIE);
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         await cfg.audit?.record({
-            type: "trusted_device.revoked",
+            type: 'trusted_device.revoked',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
         });
-        ctx.session.flash("trustedDevicesRevoked", translate(cfg.messages, "account.security.trusted_devices_revoked"));
-        return ctx.response.redirect("/account/security");
+        ctx.session.flash('trustedDevicesRevoked', translate(cfg.messages, 'account.security.trusted_devices_revoked'));
+        return ctx.response.redirect(accountPath('security'));
     }
     /** POST /account/security/profile — atualiza nome + avatar do próprio perfil. */
     async updateProfile(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsProfile(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         const { name, avatarUrl } = await ctx.request.validateUsing(updateProfileValidator);
         // Upload de avatar via o drive do app (opt-in pela presença do arquivo).
         // Se um arquivo for enviado e o drive estiver disponível, a URL resultante
         // tem prioridade sobre o input de URL; senão caímos no avatarUrl (texto).
         let resolvedAvatarUrl = avatarUrl ?? null;
-        let via = "url";
-        const file = ctx.request.file("avatar", {
+        let via = 'url';
+        const file = ctx.request.file('avatar', {
             size: `${cfg.uploads.avatars.maxSizeMb}mb`,
-            extnames: ["jpg", "jpeg", "png", "webp"],
+            extnames: ['jpg', 'jpeg', 'png', 'webp'],
         });
         if (file) {
             try {
                 const uploadedUrl = await storeAvatar(ctx, cfg.uploads, file, userId, {
-                    extname: translate(cfg.messages, "account.profile.avatar_invalid_type"),
-                    size: translate(cfg.messages, "account.profile.avatar_too_large"),
+                    extname: translate(cfg.messages, 'account.profile.avatar_invalid_type'),
+                    size: translate(cfg.messages, 'account.profile.avatar_too_large'),
                 });
                 if (uploadedUrl) {
                     resolvedAvatarUrl = uploadedUrl;
-                    via = "upload";
+                    via = 'upload';
                 }
             }
             catch (error) {
                 if (error instanceof AvatarUploadError) {
-                    ctx.session.flash("securityError", error.message);
-                    return ctx.response.redirect("/account/security");
+                    ctx.session.flash('securityError', error.message);
+                    return ctx.response.redirect(accountPath('security'));
                 }
                 throw error;
             }
@@ -263,21 +264,21 @@ export default class AccountSecurityController {
             avatarUrl: resolvedAvatarUrl,
         });
         await cfg.audit?.record({
-            type: "profile.updated",
+            type: 'profile.updated',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
             metadata: { via },
         });
-        ctx.session.flash("profileUpdated", translate(cfg.messages, "account.profile.updated"));
-        return ctx.response.redirect("/account/security");
+        ctx.session.flash('profileUpdated', translate(cfg.messages, 'account.profile.updated'));
+        return ctx.response.redirect(accountPath('security'));
     }
     async changePassword(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         // Sudo mode gate (defesa em profundidade — a verificação de senha ATUAL continua abaixo).
         const sudoSettings = await resolveRuntimeSettings(ctx);
@@ -287,12 +288,10 @@ export default class AccountSecurityController {
         const { currentPassword, newPassword } = await ctx.request.validateUsing(changePasswordValidator);
         const account = await store.findById(userId);
         // Confirma a senha ATUAL pelo e-mail da conta.
-        const verified = account
-            ? await store.verifyCredentials(account.email, currentPassword)
-            : null;
+        const verified = account ? await store.verifyCredentials(account.email, currentPassword) : null;
         if (!verified) {
-            ctx.session.flash("securityError", translate(cfg.messages, "errors.invalid_credentials"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('securityError', translate(cfg.messages, 'errors.invalid_credentials'));
+            return ctx.response.redirect(accountPath('security'));
         }
         // Verificação de histórico de senhas (disallow_password_reuse).
         // Capability-probed: sem `isPasswordReused` ou com setting desligada → no-op.
@@ -301,13 +300,14 @@ export default class AccountSecurityController {
             if (histSettings.enabled) {
                 // Aplica o pepper à senha candidata antes de comparar com os hashes históricos
                 // (que foram gravados já com pepper). Pepper ausente → identidade.
-                const pepperedNew = cfg.accountStore.__passwordManager?.applyCurrentPepper?.(newPassword) ?? newPassword;
+                const pepperedNew = cfg.accountStore.__passwordManager?.applyCurrentPepper?.(newPassword) ??
+                    newPassword;
                 const reused = await store.isPasswordReused(userId, pepperedNew, histSettings.count);
                 if (reused) {
-                    ctx.session.flash("securityError", translate(cfg.messages, "password.reused", {
+                    ctx.session.flash('securityError', translate(cfg.messages, 'password.reused', {
                         count: histSettings.count,
                     }));
-                    return ctx.response.redirect("/account/security");
+                    return ctx.response.redirect(accountPath('security'));
                 }
                 // Grava o hash ATUAL no histórico antes de trocar.
                 // O hash atual está na linha do DB — buscamos via store.findById + raw model.
@@ -324,13 +324,13 @@ export default class AccountSecurityController {
         catch (error) {
             // Política de senha violada → flash com a regra e volta à tela de segurança.
             if (error instanceof PasswordPolicyError) {
-                ctx.session.flash("securityError", translate(cfg.messages, error.key, error.params));
-                return ctx.response.redirect("/account/security");
+                ctx.session.flash('securityError', translate(cfg.messages, error.key, error.params));
+                return ctx.response.redirect(accountPath('security'));
             }
             throw error;
         }
         await cfg.audit?.record({
-            type: "password.changed",
+            type: 'password.changed',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
         });
@@ -343,7 +343,7 @@ export default class AccountSecurityController {
             const sessions = new AdminSessionsService(service);
             const result = await sessions.revokeAll(userId);
             await cfg.audit?.record({
-                type: "session.revoked_all",
+                type: 'session.revoked_all',
                 accountId: userId,
                 actorId: userId,
                 ip: ctx.request.ip?.() ?? null,
@@ -352,7 +352,7 @@ export default class AccountSecurityController {
                     grants: result.grants,
                     accessTokens: result.accessTokens,
                     refreshTokens: result.refreshTokens,
-                    source: "password-change",
+                    source: 'password-change',
                 },
             });
         }
@@ -363,21 +363,21 @@ export default class AccountSecurityController {
         if (account) {
             await dispatchSecurityNotice(ctx, {
                 account: { id: userId, email: account.email },
-                kind: "password_changed",
+                kind: 'password_changed',
                 ip: ctx.request.ip?.() ?? null,
                 timestamp: new Date().toISOString(),
             }, cfg.mail, cfg.audit);
         }
-        ctx.session.flash("passwordChanged", translate(cfg.messages, "account.security.password_changed"));
-        return ctx.response.redirect("/account/security");
+        ctx.session.flash('passwordChanged', translate(cfg.messages, 'account.security.password_changed'));
+        return ctx.response.redirect(accountPath('security'));
     }
     async changeEmail(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         // Sudo mode gate.
         const sudoSettingsEmail = await resolveRuntimeSettings(ctx);
@@ -387,45 +387,45 @@ export default class AccountSecurityController {
         // Resolve os settings de troca de e-mail em runtime.
         const emailChangeSettings = await resolveEmailChangeSettings(ctx);
         if (!emailChangeSettings.enabled) {
-            ctx.session.flash("securityError", translate(cfg.messages, "account.security.email_change_disabled"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('securityError', translate(cfg.messages, 'account.security.email_change_disabled'));
+            return ctx.response.redirect(accountPath('security'));
         }
         const { currentPassword, newEmail } = await ctx.request.validateUsing(changeEmailValidator);
         const account = await store.findById(userId);
         // requirePassword: se ligado (default true), exige senha atual.
         if (emailChangeSettings.requirePassword) {
             if (!currentPassword) {
-                ctx.session.flash("securityError", translate(cfg.messages, "errors.invalid_credentials"));
-                return ctx.response.redirect("/account/security");
+                ctx.session.flash('securityError', translate(cfg.messages, 'errors.invalid_credentials'));
+                return ctx.response.redirect(accountPath('security'));
             }
             const verified = account
                 ? await store.verifyCredentials(account.email, currentPassword)
                 : null;
             if (!verified) {
-                ctx.session.flash("securityError", translate(cfg.messages, "errors.invalid_credentials"));
-                return ctx.response.redirect("/account/security");
+                ctx.session.flash('securityError', translate(cfg.messages, 'errors.invalid_credentials'));
+                return ctx.response.redirect(accountPath('security'));
             }
         }
         const issued = await store.requestEmailChange(userId, newEmail);
         if (!issued) {
-            ctx.session.flash("securityError", translate(cfg.messages, "errors.email_taken"));
-            return ctx.response.redirect("/account/security");
+            ctx.session.flash('securityError', translate(cfg.messages, 'errors.email_taken'));
+            return ctx.response.redirect(accountPath('security'));
         }
         await cfg.audit?.record({
-            type: "email_change.requested",
+            type: 'email_change.requested',
             accountId: userId,
             email: newEmail,
             ip: ctx.request.ip?.() ?? null,
         });
         const origin = `${ctx.request.protocol()}://${ctx.request.host()}`;
-        const confirmUrl = `${origin}/account/email/confirm?token=${encodeURIComponent(issued.token)}`;
+        const confirmUrl = `${origin}${accountPath('emailConfirm')}?token=${encodeURIComponent(issued.token)}`;
         // 1. Link de confirmação → NOVO e-mail (hook onEmailChangeConfirm > onEmailVerification > default).
         if (cfg.mail?.onEmailChangeConfirm) {
             await cfg.mail.onEmailChangeConfirm({
                 email: newEmail,
                 confirmUrl,
                 token: issued.token,
-                oldEmail: account?.email ?? "",
+                oldEmail: account?.email ?? '',
             });
         }
         else if (cfg.mail?.onEmailVerification) {
@@ -454,22 +454,22 @@ export default class AccountSecurityController {
                 });
             }
         }
-        ctx.session.flash("emailChangeRequested", translate(cfg.messages, "account.security.email_change_requested", {
+        ctx.session.flash('emailChangeRequested', translate(cfg.messages, 'account.security.email_change_requested', {
             email: newEmail,
         }));
-        return ctx.response.redirect("/account/security");
+        return ctx.response.redirect(accountPath('security'));
     }
     /**
      * POST /account/security/email/cancel — cancela uma troca de e-mail pendente
      * (limpa o token pending sem alterar o e-mail da conta).
      */
     async cancelEmailChange(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         if (!supportsAccountSecurity(store)) {
-            return ctx.response.redirect("/account/security");
+            return ctx.response.redirect(accountPath('security'));
         }
         // Implementação: issuePendingToken(userId, null) limpa o token; reutilizamos
         // requestEmailChange com um valor sentinela → não, melhor usar cancelEmailChange
@@ -478,7 +478,7 @@ export default class AccountSecurityController {
         // A forma mais limpa é verificar se o store tem cancelEmailChange; se não tiver,
         // chamamos requestEmailChange com o próprio e-mail atual (limpa o pending antigo).
         const cancelFn = store.cancelEmailChange;
-        if (typeof cancelFn === "function") {
+        if (typeof cancelFn === 'function') {
             await cancelFn.call(store, userId);
         }
         else {
@@ -492,27 +492,27 @@ export default class AccountSecurityController {
             }
         }
         await cfg.audit?.record({
-            type: "email_change.cancelled",
+            type: 'email_change.cancelled',
             accountId: userId,
             ip: ctx.request.ip?.() ?? null,
         });
-        ctx.session.flash("emailChangeRequested", translate(cfg.messages, "account.security.email_change_cancelled"));
-        return ctx.response.redirect("/account/security");
+        ctx.session.flash('emailChangeRequested', translate(cfg.messages, 'account.security.email_change_cancelled'));
+        return ctx.response.redirect(accountPath('security'));
     }
     /** GET /account/email/confirm?token=... — consome o token e aplica o novo e-mail. */
     async confirmEmail(ctx) {
-        const service = await ctx.containerResolver.make("authkit.server");
+        const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
         const render = cfg.render;
         if (!supportsAccountSecurity(store)) {
-            return render(ctx, "account/email-confirmed", { ok: false });
+            return render(ctx, 'account/email-confirmed', { ok: false });
         }
-        const token = ctx.request.qs().token ?? "";
+        const token = ctx.request.qs().token ?? '';
         const result = await store.confirmEmailChange(token);
         if (result.ok) {
             await cfg.audit?.record({
-                type: "email_change.confirmed",
+                type: 'email_change.confirmed',
                 accountId: result.account.id,
                 email: result.newEmail,
                 ip: ctx.request.ip?.() ?? null,
@@ -538,12 +538,12 @@ export default class AccountSecurityController {
             // Notificação de segurança ao NOVO e-mail (email_changed) — best-effort.
             await dispatchSecurityNotice(ctx, {
                 account: { id: result.account.id, email: result.newEmail },
-                kind: "email_changed",
+                kind: 'email_changed',
                 ip: ctx.request.ip?.() ?? null,
                 timestamp: new Date().toISOString(),
                 metadata: { oldEmail: result.oldEmail, newEmail: result.newEmail },
             }, cfg.mail, cfg.audit);
         }
-        return render(ctx, "account/email-confirmed", { ok: result.ok });
+        return render(ctx, 'account/email-confirmed', { ok: result.ok });
     }
 }

package/build/src/host/controllers/account_session_controller.js

@@ -1,13 +1,13 @@
 import '../augmentations.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { accountHome } from '../account_home.js';
+import { getAccountLoginUrl } from '../account_login_url.js';
+import { syncAdonisAuthLogin, syncAdonisAuthLogout } from '../adonis_auth_sync.js';
 import { translate } from '../i18n.js';
 import { attemptPasswordLogin } from '../login_attempt.js';
 import { notifyLoginSuccess } from '../login_notify.js';
-import { markSudo } from '../sudo_mode.js';
-import { accountHome } from '../account_home.js';
-import { getAccountLoginUrl } from '../account_login_url.js';
+import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { syncAdonisAuthLogin, syncAdonisAuthLogout } from '../adonis_auth_sync.js';
+import { markSudo } from '../sudo_mode.js';
 /**
  * Valida um valor de `return_to` recebido da query-string ou de um campo hidden.
  *
@@ -48,7 +48,11 @@ export default class AccountSessionController {
         // Lê e valida o return_to da query-string — descarta valores inválidos (open-redirect).
         const rawReturnTo = ctx.request.qs?.()?.return_to ?? ctx.request.input?.('return_to');
         const returnTo = validateReturnTo(rawReturnTo);
-        return render(ctx, 'account/login', { csrfToken: ctx.request.csrfToken, returnTo });
+        const props = {
+            csrfToken: ctx.request.csrfToken,
+            returnTo,
+        };
+        return render(ctx, 'account/login', props);
     }
     async login(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
@@ -74,7 +78,7 @@ export default class AccountSessionController {
             settings: settings ?? undefined,
         });
         if (!result.ok) {
-            return render(ctx, 'account/login', {
+            const props = {
                 csrfToken: ctx.request.csrfToken,
                 returnTo,
                 error: result.locked
@@ -84,7 +88,8 @@ export default class AccountSessionController {
                     : result.disabled
                         ? translate(cfg.messages, 'errors.account_disabled')
                         : translate(cfg.messages, 'errors.invalid_credentials'),
-            });
+            };
+            return render(ctx, 'account/login', props);
         }
         const acc = result.account;
         // M5 (session fixation): regenera a sessão IMEDIATAMENTE após autenticar e

package/build/src/host/controllers/account_tokens_controller.js

@@ -1,4 +1,5 @@
 import '../augmentations.js';
+import { accountPath } from '../account_paths.js';
 import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { requireSudo } from '../sudo_mode.js';
@@ -49,7 +50,7 @@ export default class AccountTokensController {
             ip: ctx.request.ip?.() ?? null,
             metadata: { patId: pat.id, name: pat.name },
         });
-        return ctx.response.redirect('/account/tokens');
+        return ctx.response.redirect(accountPath('tokens'));
     }
     async destroy(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
@@ -73,6 +74,6 @@ export default class AccountTokensController {
                 metadata: { patId },
             });
         }
-        return ctx.response.redirect('/account/tokens');
+        return ctx.response.redirect(accountPath('tokens'));
     }
 }