@adonis-agora/authkit-server 0.53.0 → 0.54.0

package/build/index.d.ts

@@ -136,3 +136,5 @@ export { completeSudo, fail as failSudo, LAST_METHOD_SESSION_KEY, } from './src/
 export { sudoContextFrom } from './src/host/sudo/runtime.js';
 export type { SudoMethod, SudoContext, SudoMethodDescriptor, SudoRouteHelpers, } from './src/host/sudo/types.js';
 export { authkitUserProvider } from './src/host/adonis_auth_user_provider.js';
+export { OidcRpGuard, oidcRpGuard } from './src/host/oidc_rp_guard.js';
+export type { OidcRpGuardOptions, OidcRpGuardEvents } from './src/host/oidc_rp_guard.js';

package/build/index.js

@@ -112,3 +112,8 @@ export { sudoContextFrom } from './src/host/sudo/runtime.js';
 // `adonisAuth: { guard: '...' }` in config/authkit.ts so the account console's
 // login/logout also sync ctx.auth. See src/host/adonis_auth_user_provider.ts.
 export { authkitUserProvider } from './src/host/adonis_auth_user_provider.js';
+// @adonisjs/auth integration (opt-in) — guard pra Relying Parties OIDC.
+// O RP não autentica ninguém (sem senha); a identidade vem da sessão gravada
+// pelo callback OIDC. Plugado em config/auth.ts, faz ctx.auth.user funcionar
+// nativamente em qualquer app que consome o issuer via Authorization Code + PKCE.
+export { OidcRpGuard, oidcRpGuard } from './src/host/oidc_rp_guard.js';

package/build/src/host/oidc_rp_guard.d.ts

@@ -0,0 +1,89 @@
+import { symbols } from '@adonisjs/auth';
+import type { AuthClientResponse, GuardConfigProvider, GuardContract } from '@adonisjs/auth/types';
+import type { SessionUserProviderContract } from '@adonisjs/auth/types/session';
+import type { HttpContext } from '@adonisjs/core/http';
+import type { ConfigProvider } from '@adonisjs/core/types';
+import type { EmitterLike } from '@adonisjs/core/types/events';
+type RealUser<UserProvider> = UserProvider extends SessionUserProviderContract<infer U> ? U : never;
+export type OidcRpGuardOptions<UserProvider extends SessionUserProviderContract<unknown>> = {
+    provider: UserProvider | ConfigProvider<UserProvider>;
+    sessionKey?: string;
+};
+export type OidcRpGuardEvents<User> = {
+    'oidc_rp:login_succeeded': {
+        ctx: HttpContext;
+        guardName: string;
+        user: User;
+    };
+    'oidc_rp:authentication_succeeded': {
+        ctx: HttpContext;
+        guardName: string;
+        user: User;
+    };
+    'oidc_rp:authentication_failed': {
+        ctx: HttpContext;
+        guardName: string;
+    };
+    'oidc_rp:logged_out': {
+        ctx: HttpContext;
+        guardName: string;
+        user: User | null;
+    };
+};
+/**
+ * Guard de `@adonisjs/auth` pra Relying Parties OIDC — o app não autentica
+ * ninguém (sem senha, sem remember-me); a identidade vem da sessão gravada
+ * pelo callback OIDC (`account_user_id`). O guard só LÊ essa chave e resolve
+ * o user via provider.
+ *
+ * ```ts
+ * // config/auth.ts
+ * import { oidcRpGuard } from '@adonis-agora/authkit-server'
+ * import { sessionUserProvider } from '@adonisjs/auth/session'
+ *
+ * const authConfig = defineConfig({
+ *   default: 'web',
+ *   guards: {
+ *     web: oidcRpGuard({
+ *       provider: sessionUserProvider({ model: () => import('#models/user') }),
+ *     }),
+ *   },
+ * })
+ * ```
+ *
+ * O callback OIDC do RP chama `ctx.auth.use('web').login(user)` pra gravar a
+ * sessão; a partir daí `ctx.auth.user`, `auth.check()`, `middleware.auth()` —
+ * tudo funciona nativamente.
+ */
+export declare class OidcRpGuard<UserProvider extends SessionUserProviderContract<unknown>> implements GuardContract<RealUser<UserProvider>> {
+    #private;
+    [symbols.GUARD_KNOWN_EVENTS]: OidcRpGuardEvents<RealUser<UserProvider>>;
+    driverName: "oidc_rp";
+    authenticationAttempted: boolean;
+    isAuthenticated: boolean;
+    isLoggedOut: boolean;
+    user?: RealUser<UserProvider>;
+    constructor(name: string, ctx: HttpContext, sessionKey: string, emitter: EmitterLike<OidcRpGuardEvents<RealUser<UserProvider>>>, userProvider: UserProvider);
+    getUserOrFail(): RealUser<UserProvider>;
+    /**
+     * Grava a identidade na sessão. Chamado pelo callback OIDC após validar o
+     * grant — o guard NÃO verifica credenciais, só persiste o id do user.
+     */
+    login(user: RealUser<UserProvider>): Promise<void>;
+    /**
+     * Limpa a identidade da sessão. O RP-initiated logout (redirect pro
+     * `end_session` do issuer) é responsabilidade do controller — o guard só
+     * cuida da sessão local.
+     */
+    logout(): Promise<void>;
+    authenticate(): Promise<RealUser<UserProvider>>;
+    check(): Promise<boolean>;
+    authenticateAsClient(user: RealUser<UserProvider>): Promise<AuthClientResponse>;
+}
+/**
+ * Factory de config pro `oidcRpGuard` — mesmo padrão do `sessionGuard()` de
+ * `@adonisjs/auth/session`. Retorna um `GuardConfigProvider` que o
+ * `defineConfig` de `config/auth.ts` resolve no boot.
+ */
+export declare function oidcRpGuard<UserProvider extends SessionUserProviderContract<unknown>>(config: OidcRpGuardOptions<UserProvider>): GuardConfigProvider<(ctx: HttpContext) => OidcRpGuard<UserProvider>>;
+export {};

package/build/src/host/oidc_rp_guard.js

@@ -0,0 +1,154 @@
+import { symbols } from '@adonisjs/auth';
+import { RuntimeException } from '@adonisjs/core/exceptions';
+import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
+/**
+ * Guard de `@adonisjs/auth` pra Relying Parties OIDC — o app não autentica
+ * ninguém (sem senha, sem remember-me); a identidade vem da sessão gravada
+ * pelo callback OIDC (`account_user_id`). O guard só LÊ essa chave e resolve
+ * o user via provider.
+ *
+ * ```ts
+ * // config/auth.ts
+ * import { oidcRpGuard } from '@adonis-agora/authkit-server'
+ * import { sessionUserProvider } from '@adonisjs/auth/session'
+ *
+ * const authConfig = defineConfig({
+ *   default: 'web',
+ *   guards: {
+ *     web: oidcRpGuard({
+ *       provider: sessionUserProvider({ model: () => import('#models/user') }),
+ *     }),
+ *   },
+ * })
+ * ```
+ *
+ * O callback OIDC do RP chama `ctx.auth.use('web').login(user)` pra gravar a
+ * sessão; a partir daí `ctx.auth.user`, `auth.check()`, `middleware.auth()` —
+ * tudo funciona nativamente.
+ */
+export class OidcRpGuard {
+    #name;
+    #ctx;
+    #sessionKey;
+    #emitter;
+    #userProvider;
+    [symbols.GUARD_KNOWN_EVENTS] = {};
+    driverName = 'oidc_rp';
+    authenticationAttempted = false;
+    isAuthenticated = false;
+    isLoggedOut = false;
+    user;
+    constructor(name, ctx, sessionKey, emitter, userProvider) {
+        this.#name = name;
+        this.#ctx = ctx;
+        this.#sessionKey = sessionKey;
+        this.#emitter = emitter;
+        this.#userProvider = userProvider;
+    }
+    getUserOrFail() {
+        if (!this.user) {
+            throw new RuntimeException('Cannot access user. Authentication has not been attempted or failed.');
+        }
+        return this.user;
+    }
+    /**
+     * Grava a identidade na sessão. Chamado pelo callback OIDC após validar o
+     * grant — o guard NÃO verifica credenciais, só persiste o id do user.
+     */
+    async login(user) {
+        const guardUser = await this.#userProvider.createUserForGuard(user);
+        this.#ctx.session.put(this.#sessionKey, String(guardUser.getId()));
+        this.user = user;
+        this.isAuthenticated = true;
+        this.authenticationAttempted = true;
+        this.#emitter.emit('oidc_rp:login_succeeded', {
+            ctx: this.#ctx,
+            guardName: this.#name,
+            user,
+        });
+    }
+    /**
+     * Limpa a identidade da sessão. O RP-initiated logout (redirect pro
+     * `end_session` do issuer) é responsabilidade do controller — o guard só
+     * cuida da sessão local.
+     */
+    async logout() {
+        const user = this.user ?? null;
+        this.#ctx.session.forget(this.#sessionKey);
+        this.user = undefined;
+        this.isAuthenticated = false;
+        this.isLoggedOut = true;
+        this.#emitter.emit('oidc_rp:logged_out', {
+            ctx: this.#ctx,
+            guardName: this.#name,
+            user,
+        });
+    }
+    async authenticate() {
+        if (this.authenticationAttempted) {
+            return this.getUserOrFail();
+        }
+        this.authenticationAttempted = true;
+        const userId = this.#ctx.session.get(this.#sessionKey);
+        if (!userId) {
+            this.#emitter.emit('oidc_rp:authentication_failed', {
+                ctx: this.#ctx,
+                guardName: this.#name,
+            });
+            throw new RuntimeException('Unauthorized', { cause: 'E_UNAUTHORIZED_ACCESS' });
+        }
+        const guardUser = await this.#userProvider.findById(userId);
+        if (!guardUser) {
+            this.#ctx.session.forget(this.#sessionKey);
+            this.#emitter.emit('oidc_rp:authentication_failed', {
+                ctx: this.#ctx,
+                guardName: this.#name,
+            });
+            throw new RuntimeException('Unauthorized', { cause: 'E_UNAUTHORIZED_ACCESS' });
+        }
+        this.user = guardUser.getOriginal();
+        this.isAuthenticated = true;
+        this.#emitter.emit('oidc_rp:authentication_succeeded', {
+            ctx: this.#ctx,
+            guardName: this.#name,
+            user: this.user,
+        });
+        return this.user;
+    }
+    async check() {
+        try {
+            await this.authenticate();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async authenticateAsClient(user) {
+        const guardUser = await this.#userProvider.createUserForGuard(user);
+        return { session: { [this.#sessionKey]: String(guardUser.getId()) } };
+    }
+}
+/**
+ * Factory de config pro `oidcRpGuard` — mesmo padrão do `sessionGuard()` de
+ * `@adonisjs/auth/session`. Retorna um `GuardConfigProvider` que o
+ * `defineConfig` de `config/auth.ts` resolve no boot.
+ */
+export function oidcRpGuard(config) {
+    return {
+        async resolver(name, app) {
+            const emitter = await app.container.make('emitter');
+            const sessionKey = config.sessionKey ?? ACCOUNT_SESSION_KEY;
+            let userProvider;
+            if (typeof config.provider.resolver === 'function') {
+                userProvider = await config.provider.resolver(app);
+            }
+            else {
+                userProvider = config.provider;
+            }
+            return (ctx) => {
+                return new OidcRpGuard(name, ctx, sessionKey, emitter, userProvider);
+            };
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",