@adonis-agora/authkit-server 0.55.0 → 0.55.1

package/build/src/provider/oidc_service.js

@@ -128,6 +128,11 @@ export class OidcService {
                 findAccount: config.findAccount,
                 globalRolesClaim: config.globalRolesClaim,
                 resolveTokenRoles: config.resolveTokenRoles,
+                // Allowlist de roles que autorizam impersonation — a MESMA de
+                // `config.admin.roles` usada pelos guards do console (default
+                // `['ADMIN']`). Permite que um host use papel próprio (ex.: `admin`
+                // minúsculo num store de roles próprio) sem alterar `globalRoles`.
+                adminRoles: config.admin.roles,
                 // Resource indicators (RFC 8707) suportados: o `audience` default + cada
                 // resource declarado. Usado para validar `audience`/`resource` no pedido de
                 // token-exchange — alvos fora desta lista são rejeitados (invalid_target).

package/build/src/provider/token_exchange.d.ts

@@ -14,6 +14,11 @@ export interface TokenExchangeDeps {
      * `target.globalRoles ?? []` (unchanged behavior). Mirrors the mint-time hook used
      * by the authorization-code flow so impersonated tokens source roles from the same
      * authority (e.g. @adonis-agora/authz) or custom store.
+     *
+     * The SAME hook also gates the ACTOR (the admin trying to impersonate): its roles
+     * are resolved through it too, so an app that keeps roles in its own table
+     * (e.g. via `@adonis-agora/authz`) can impersonate without storing roles in the
+     * authkit `globalRoles` column. When omitted, falls back to `actor.globalRoles`.
      */
     resolveTokenRoles?: (account: AuthAccount, context: {
         clientId?: string;
@@ -23,6 +28,14 @@ export interface TokenExchangeDeps {
             orgRole: string;
         } | null;
     }) => string[] | Promise<string[]>;
+    /**
+     * Allowlist de roles que autorizam a impersonation. Default: `['ADMIN']`.
+     * Aceita o papel EXATO (ex.: `'admin'` minúsculo) do app — resolve contra a
+     * MESMA fonte de roles do `resolveTokenRoles`/`globalRoles`, não a um papel
+     * hardcoded. Mantém `adminRole` como alias singular para back-compat.
+     */
+    adminRoles?: string[];
+    /** @deprecated Use `adminRoles` (allowlist). Mantido como alias singular. */
     adminRole?: string;
     /**
      * Resource indicators (RFC 8707) suportados pelo provider. Quando o pedido traz

package/build/src/provider/token_exchange.js

@@ -16,7 +16,7 @@ function intersectScopes(requested, allowed) {
     return out.join(' ');
 }
 export function registerTokenExchange(provider, deps) {
-    const adminRole = deps.adminRole ?? 'ADMIN';
+    const adminRoles = deps.adminRoles ?? (deps.adminRole ? [deps.adminRole] : ['ADMIN']);
     const supportedResources = new Set(deps.supportedResources ?? []);
     const handler = async (ctx) => {
         const { params, client } = ctx.oidc;
@@ -36,7 +36,22 @@ export function registerTokenExchange(provider, deps) {
             throw new errors.InvalidGrant('subject_token was not issued to this client');
         }
         const actor = await deps.findAccount(subjectAt.accountId);
-        if (!actor || !(actor.globalRoles ?? []).includes(adminRole)) {
+        if (!actor) {
+            throw new errors.InvalidGrant('actor not permitted to impersonate');
+        }
+        // Resolve as roles do ATOR pela MESMA fonte do claim (resolveTokenRoles
+        // quando o host configura — ex.: roles em tabela própria via
+        // `@adonis-agora/authz`), com fallback pro `globalRoles` do store. Sem isso
+        // um host que não grava roles na coluna `globalRoles` do authkit nunca
+        // conseguiria impersonar (o gate bateria sempre em `[]`). Mesmo padrão do
+        // console (`resolveAccountRoles` em `host/account_roles.ts`).
+        const actorRoles = deps.resolveTokenRoles
+            ? await deps.resolveTokenRoles(actor, {
+                clientId: client?.clientId,
+                activeOrg: null,
+            })
+            : (actor.globalRoles ?? []);
+        if (!actorRoles.some((r) => adminRoles.includes(r))) {
             throw new errors.InvalidGrant('actor not permitted to impersonate');
         }
         const targetId = params.requested_subject;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.55.0",
+  "version": "0.55.1",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",