@adonis-agora/authkit-server 0.58.2 → 0.59.0

package/build/index.d.ts

@@ -128,7 +128,7 @@ export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, Main
 export { resolveRegistration } from './src/define_config.js';
 export type { RegistrationConfigInput, ResolvedRegistrationConfig, } from './src/define_config.js';
 export { getAccountId, realAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';
-export { ACCOUNT_SESSION_KEY } from './src/host/middleware/account_auth.js';
+export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';
 export { rememberAccessToken, rememberRefreshToken, refreshAccessToken, startImpersonation, impersonationState, stopImpersonation, } from './src/host/impersonation_session.js';
 export type { StartImpersonationParams, ImpersonationState, } from './src/host/impersonation_session.js';
 export { SUDO_SESSION_KEY, SUDO_ACCOUNT_SESSION_KEY, SUDO_MODE_DEFAULTS, requireSudo, isSudoActive, markSudo, resolveEffectiveSudoMode, } from './src/host/sudo_mode.js';

package/build/index.js

@@ -87,7 +87,7 @@ export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
 export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
 export { resolveRegistration } from './src/define_config.js';
 export { getAccountId, realAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';
-export { ACCOUNT_SESSION_KEY } from './src/host/middleware/account_auth.js';
+export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';
 // Session impersonation — RP-side glue that routes through the IdP's RFC 8693
 // token-exchange (the IdP validates the admin role + audits). See
 // src/host/impersonation_session.ts.

package/build/src/accounts/lucid_account_store.js

@@ -165,7 +165,11 @@ export function lucidAccountStore(Model, options = {}) {
             return encrypter.decrypt(stored);
         },
         toAccount: (row) => ({
-            id: row.id,
+            // `String(...)`: o `id` do AuthAccount vira o claim `sub`, que a spec OIDC
+            // exige que seja string. Tabelas adotadas em brownfield quase sempre têm
+            // `id` INTEGER auto-increment, e sem a coerção o número vazava para o
+            // token (e para todo call-site tipado como string).
+            id: String(row.id),
             email: row.email,
             globalRoles: row.globalRoles ?? [],
             name: row.fullName ?? undefined,
@@ -251,6 +255,16 @@ export function lucidAccountStore(Model, options = {}) {
          */
         __mfaIssuer: mfaIssuer,
         __webauthn: options.webauthn,
+        /**
+         * O model Lucid por trás deste store — exposto para o `authkit:doctor`
+         * inspecionar `$columnsDefinitions` e avisar sobre colunas ausentes ANTES
+         * que o fluxo correspondente quebre em produção (ver
+         * `doctor/checks.ts#checkAccountStoreColumns`). Importa sobretudo em
+         * adoção brownfield, onde o model aponta para uma tabela `users` que já
+         * existia e não passou pelas migrations do authkit.
+         * NÃO faz parte do contrato AccountStore.
+         */
+        __model: Model,
     };
     // Histórico de senhas: capability-probed via tabela `auth_password_history`.
     // A versão síncrona não pode fazer o probe de DB, então a capability fica
@@ -287,7 +301,8 @@ export async function lucidAccountStoreAsync(Model, options = {}) {
                 sealSecret: (s) => s,
                 openSecret: (s) => s ?? null,
                 toAccount: (row) => ({
-                    id: row.id,
+                    // Ver a nota em `toAccount` acima: `sub` precisa ser string.
+                    id: String(row.id),
                     email: row.email,
                     globalRoles: row.globalRoles ?? [],
                     name: row.fullName ?? undefined,

package/build/src/audit/audit_sink.d.ts

@@ -21,6 +21,16 @@ export interface AuditEvent {
     clientId?: string | null;
     /** Impersonation: quem agiu (o admin). */
     actorId?: string | null;
+    /**
+     * Organização (tenant) a que o evento pertence, quando houver. Campo de
+     * PRIMEIRA CLASSE — e não uma chave de `metadata` — de propósito: `metadata`
+     * é livre e por isso é DROPADO na projeção que vai para o barramento de
+     * diagnostics (ver `redactAuditEventForDiagnostics`), enquanto os ids internos
+     * opacos (`accountId`/`actorId`/`clientId`/`orgId`) são preservados. É esse
+     * campo que permite a um consumidor do barramento — p.ex. o provisioning do
+     * `@adonis-agora/authz` — saber QUAL tenant provisionar sem receber PII.
+     */
+    orgId?: string | null;
     ip?: string | null;
     metadata?: Record<string, unknown>;
 }

package/build/src/doctor/checks.d.ts

@@ -57,6 +57,19 @@ export declare function checkClients(input: DoctorInput): Finding;
 export declare function checkAdapterVolatility(input: DoctorInput): Finding | null;
 /** accountStore presente + quais capacidades implementa. */
 export declare function checkAccountStore(input: DoctorInput): Finding[];
+/**
+ * Valida que o model por trás do account store tem as colunas que o store
+ * escreve. Existe por causa da adoção brownfield: quando o host aponta o
+ * AuthKit para a tabela `users` que ele JÁ tinha, as colunas dos mixins
+ * (`password_reset_token`, `email_verification_token`, …) não existem, o app
+ * sobe normalmente, e a falha só aparece quando alguém clica em "esqueci minha
+ * senha" — em produção. Este check antecipa isso para o boot.
+ *
+ * Silencioso quando não há o que inspecionar: um store custom (não-Lucid) não
+ * expõe `__model`, e nesse caso o contrato é responsabilidade de quem o
+ * implementou.
+ */
+export declare function checkAccountStoreColumns(input: DoctorInput): Finding[];
 /** session provider configurado + warn se cookie store com tokenSets grandes. */
 export declare function checkSession(input: DoctorInput): Finding[];
 /** Hint de exceções de CSRF do shield para o mountPath. */

package/build/src/doctor/checks.js

@@ -134,6 +134,84 @@ export function checkAccountStore(input) {
     });
     return findings;
 }
+/**
+ * Propriedades do model que o account store Lucid escreve/lê, agrupadas pelo
+ * FLUXO que deixa de funcionar quando a coluna não existe. Agrupar por fluxo (e
+ * não listar colunas soltas) é o que torna o achado acionável: "falta
+ * `password_reset_token`" não diz nada a quem não conhece o interior da lib;
+ * "o reset de senha vai quebrar" diz.
+ */
+const REQUIRED_COLUMN_GROUPS = [
+    { flow: 'identity (every flow)', properties: ['email'] },
+    { flow: 'password login', properties: ['password'] },
+    { flow: 'role claims / admin', properties: ['globalRoles'] },
+    {
+        flow: 'password reset',
+        properties: ['passwordResetToken', 'passwordResetExpiresAt'],
+    },
+    {
+        flow: 'email verification',
+        properties: ['emailVerifiedAt', 'emailVerificationToken'],
+    },
+];
+/**
+ * Propriedades OPCIONAIS: a capability correspondente é detectada pela presença
+ * da coluna, então ausência é configuração válida (feature desligada) e nunca
+ * um erro — só vale reportar para que a ausência seja uma escolha, e não uma
+ * surpresa.
+ */
+const OPTIONAL_COLUMN_GROUPS = [
+    { capability: 'profile (name/avatar)', properties: ['fullName', 'avatarUrl'] },
+    { capability: 'disable/enable account', properties: ['disabledAt'] },
+    { capability: 'password expiration', properties: ['passwordChangedAt'] },
+];
+/**
+ * Valida que o model por trás do account store tem as colunas que o store
+ * escreve. Existe por causa da adoção brownfield: quando o host aponta o
+ * AuthKit para a tabela `users` que ele JÁ tinha, as colunas dos mixins
+ * (`password_reset_token`, `email_verification_token`, …) não existem, o app
+ * sobe normalmente, e a falha só aparece quando alguém clica em "esqueci minha
+ * senha" — em produção. Este check antecipa isso para o boot.
+ *
+ * Silencioso quando não há o que inspecionar: um store custom (não-Lucid) não
+ * expõe `__model`, e nesse caso o contrato é responsabilidade de quem o
+ * implementou.
+ */
+export function checkAccountStoreColumns(input) {
+    const store = input.authkitConfig?.accountStore;
+    const model = store?.__model;
+    const definitions = model?.$columnsDefinitions;
+    if (!definitions || typeof definitions.get !== 'function')
+        return [];
+    /** Nome da coluna real (o que o DBA procura), com fallback à propriedade. */
+    const columnOf = (property) => definitions.get(property)?.columnName ?? property;
+    const missing = (properties) => properties.filter((p) => !definitions.has(p));
+    const findings = [];
+    for (const { flow, properties } of REQUIRED_COLUMN_GROUPS) {
+        const absent = missing(properties);
+        if (absent.length === 0)
+            continue;
+        const named = absent.map((p) => `\`${p}\` (column \`${columnOf(p)}\`)`).join(', ');
+        findings.push({
+            level: 'error',
+            message: `accountStore model (${model.name ?? 'model'}) is missing ${named} — ${flow} will fail at runtime. Add the column(s) with a migration, or map an existing one with @column({ columnName: '…' }).`,
+        });
+    }
+    const off = OPTIONAL_COLUMN_GROUPS.filter((g) => missing(g.properties).length > 0);
+    if (off.length > 0) {
+        findings.push({
+            level: 'ok',
+            message: `Capabilities off (column absent): ${off.map((g) => g.capability).join(', ')}.`,
+        });
+    }
+    if (findings.every((f) => f.level === 'ok')) {
+        findings.unshift({
+            level: 'ok',
+            message: `accountStore model (${model.name ?? 'model'}) has every required column.`,
+        });
+    }
+    return findings;
+}
 /** session provider configurado + warn se cookie store com tokenSets grandes. */
 export function checkSession(input) {
     if (!input.peers.session) {
@@ -845,6 +923,7 @@ export function runAllChecks(input) {
     if (volatility)
         findings.push(volatility);
     findings.push(...checkAccountStore(input));
+    findings.push(...checkAccountStoreColumns(input));
     findings.push(...checkSession(input));
     findings.push(checkShield(input));
     findings.push(checkAlly(input));

package/build/src/events/dispatcher.d.ts

@@ -56,9 +56,13 @@ export declare function signWebhookBody(body: string, secret: string): string;
  *     e-mail). Nenhum data provider do dashboard lê `metadata`, então dropá-lo é
  *     seguro;
  *   - MANTÉM `type` (a família do evento — o que os providers agregam) e os ids
- *     internos opacos `accountId`/`actorId`/`clientId` (correlação de subject/actor
- *     no dashboard; NÃO são PII direta e, sem `email`/`ip`/`metadata` e com a linha
- *     da conta já deletada, não são reidentificáveis).
+ *     internos opacos `accountId`/`actorId`/`clientId`/`orgId` (correlação de
+ *     subject/actor/tenant no dashboard; NÃO são PII direta e, sem `email`/`ip`/
+ *     `metadata` e com a linha da conta já deletada, não são reidentificáveis).
+ *     O `orgId` está aqui porque é o que torna o barramento UTILIZÁVEL para
+ *     provisioning multi-tenant (o `@adonis-agora/authz` escuta
+ *     `agora:authkit:organization.*` e precisa saber qual tenant escopar) —
+ *     sem ele o consumidor recebia o tipo do evento e mais nada.
  *
  * Assim o Telescope nunca armazena PII bruta e a deleção de conta não precisa de uma
  * etapa de purge cross-lib. Os ramos `onEvent`/`webhook` (integrações que o host

package/build/src/events/dispatcher.js

@@ -20,6 +20,7 @@ export function buildWebhookBody(event) {
         accountId: event.accountId ?? null,
         email: event.email ?? null,
         clientId: event.clientId ?? null,
+        orgId: event.orgId ?? null,
         ip: event.ip ?? null,
         metadata: event.metadata ?? {},
         ts: new Date().toISOString(),
@@ -50,9 +51,13 @@ export function signWebhookBody(body, secret) {
  *     e-mail). Nenhum data provider do dashboard lê `metadata`, então dropá-lo é
  *     seguro;
  *   - MANTÉM `type` (a família do evento — o que os providers agregam) e os ids
- *     internos opacos `accountId`/`actorId`/`clientId` (correlação de subject/actor
- *     no dashboard; NÃO são PII direta e, sem `email`/`ip`/`metadata` e com a linha
- *     da conta já deletada, não são reidentificáveis).
+ *     internos opacos `accountId`/`actorId`/`clientId`/`orgId` (correlação de
+ *     subject/actor/tenant no dashboard; NÃO são PII direta e, sem `email`/`ip`/
+ *     `metadata` e com a linha da conta já deletada, não são reidentificáveis).
+ *     O `orgId` está aqui porque é o que torna o barramento UTILIZÁVEL para
+ *     provisioning multi-tenant (o `@adonis-agora/authz` escuta
+ *     `agora:authkit:organization.*` e precisa saber qual tenant escopar) —
+ *     sem ele o consumidor recebia o tipo do evento e mais nada.
  *
  * Assim o Telescope nunca armazena PII bruta e a deleção de conta não precisa de uma
  * etapa de purge cross-lib. Os ramos `onEvent`/`webhook` (integrações que o host
@@ -65,6 +70,7 @@ export function redactAuditEventForDiagnostics(event) {
         accountId: event.accountId ?? null,
         actorId: event.actorId ?? null,
         clientId: event.clientId ?? null,
+        orgId: event.orgId ?? null,
     };
 }
 /**

package/build/src/host/account_api/account_api_controller.js

@@ -31,13 +31,13 @@ import '../augmentations.js';
 import { supportsAccountSecurity, supportsOrganizations, supportsPasskeys, supportsProfile, } from '../../accounts/account_store.js';
 import { PasswordPolicyError } from '../../password/password_manager.js';
 import { accountPath } from '../account_paths.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { ACTIVE_ORG_COOKIE } from '../active_org_cookie.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { syncAdonisAuthLogout } from '../adonis_auth_sync.js';
 import { AvatarUploadError, isAvatarUploadSupported, storeAvatar } from '../avatar_storage.js';
 import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail } from '../default_mailer.js';
 import { translate } from '../i18n.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { authkitOrigin } from '../origin.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';

package/build/src/host/account_session_key.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Session key holding the signed-in account id for the account console.
+ *
+ * A module of its own, deliberately, and it must stay free of imports.
+ *
+ * The constant is re-exported from the package barrel, and it used to live in
+ * `middleware/account_auth.ts` — which side-effect-imports `../augmentations.js`
+ * to type `ctx.session` for its own body. That made every consumer of the barrel
+ * load `augmentations.d.ts`, and with it this package's
+ * `declare module '@adonisjs/core/http' { adminApiKeyId?: string }`.
+ *
+ * `adminApiKeyId` is a name only this library claims, so the blast radius was
+ * small — but that is nomenclature luck, not design. The sibling client package
+ * shipped the identical shape over `auth`, a name every app declares, and
+ * consumers went from 24 type errors to 351 with nothing pointing at the cause.
+ * A constant that hosts import should not be able to carry a `HttpContext`
+ * augmentation in with it.
+ *
+ * Keep this file import-free: anything it imports, the barrel inherits.
+ */
+export declare const ACCOUNT_SESSION_KEY = "account_user_id";

package/build/src/host/account_session_key.js

@@ -0,0 +1,21 @@
+/**
+ * Session key holding the signed-in account id for the account console.
+ *
+ * A module of its own, deliberately, and it must stay free of imports.
+ *
+ * The constant is re-exported from the package barrel, and it used to live in
+ * `middleware/account_auth.ts` — which side-effect-imports `../augmentations.js`
+ * to type `ctx.session` for its own body. That made every consumer of the barrel
+ * load `augmentations.d.ts`, and with it this package's
+ * `declare module '@adonisjs/core/http' { adminApiKeyId?: string }`.
+ *
+ * `adminApiKeyId` is a name only this library claims, so the blast radius was
+ * small — but that is nomenclature luck, not design. The sibling client package
+ * shipped the identical shape over `auth`, a name every app declares, and
+ * consumers went from 24 type errors to 351 with nothing pointing at the cause.
+ * A constant that hosts import should not be able to carry a `HttpContext`
+ * augmentation in with it.
+ *
+ * Keep this file import-free: anything it imports, the barrel inherits.
+ */
+export const ACCOUNT_SESSION_KEY = 'account_user_id';

package/build/src/host/admin_api/admin_orgs_service.js

@@ -110,6 +110,7 @@ export class AdminOrgsService {
                 accountId: input.ownerAccountId,
                 actorId: actor.actorId,
                 ip: actor.ip,
+                orgId: org.id,
                 metadata: { slug: org.slug, ...(actor.source ? { actor: actor.source } : {}) },
             });
             return org;
@@ -137,6 +138,7 @@ export class AdminOrgsService {
                 type: 'organization.updated',
                 actorId: actor.actorId,
                 ip: actor.ip,
+                orgId,
                 metadata: { orgId, ...(actor.source ? { actor: actor.source } : {}) },
             });
             return updated;
@@ -158,6 +160,7 @@ export class AdminOrgsService {
             type: 'organization.deleted',
             actorId: actor.actorId,
             ip: actor.ip,
+            orgId,
             metadata: { orgId, slug: existing.slug, ...(actor.source ? { actor: actor.source } : {}) },
         });
         return { ok: true };
@@ -182,6 +185,7 @@ export class AdminOrgsService {
             type: 'organization.member_added',
             actorId: actor.actorId,
             ip: actor.ip,
+            orgId,
             metadata: {
                 orgId,
                 accountId: input.accountId,
@@ -209,6 +213,7 @@ export class AdminOrgsService {
             type: 'organization.member_removed',
             actorId: actor.actorId,
             ip: actor.ip,
+            orgId,
             metadata: {
                 orgId,
                 targetAccountId: accountId,
@@ -239,6 +244,7 @@ export class AdminOrgsService {
             type: 'organization.member_role_changed',
             actorId: actor.actorId,
             ip: actor.ip,
+            orgId,
             metadata: {
                 orgId,
                 targetAccountId: accountId,
@@ -301,6 +307,7 @@ export class AdminOrgsService {
             type: 'organization.invitation_sent',
             actorId: actor.actorId,
             ip: actor.ip,
+            orgId,
             metadata: {
                 orgId,
                 email: input.email,
@@ -327,6 +334,7 @@ export class AdminOrgsService {
             type: 'organization.invitation_revoked',
             actorId: actor.actorId,
             ip: actor.ip,
+            orgId,
             metadata: {
                 orgId,
                 invitationId,

package/build/src/host/admin_console/console_impersonation_controller.js

@@ -1,8 +1,8 @@
 import '../augmentations.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { apiError } from '../admin_api/dto.js';
 import { AdminClientsService } from '../admin_clients_service.js';
 import { buildImpersonationPanel } from '../impersonation.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettingsOrNoop } from '../runtime_settings.js';
 import { resolveEffectiveAdminImpersonation } from '../runtime_toggles.js';
 /**

package/build/src/host/admin_console/console_orgs_controller.js

@@ -1,8 +1,8 @@
 import '../augmentations.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { AdminOrgsService } from '../admin_api/admin_orgs_service.js';
 import { apiError, orgDetailDto, orgDto } from '../admin_api/dto.js';
 import { orgAddMemberValidator, orgCreateValidator, orgInvitationValidator, orgMemberRoleValidator, orgUpdateValidator, } from '../admin_validators.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { authkitOrigin } from '../origin.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 /**

package/build/src/host/admin_console/console_roles_controller.js

@@ -1,7 +1,7 @@
 import '../augmentations.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { apiError } from '../admin_api/dto.js';
 import { roleCreateValidator, roleUpdateValidator } from '../admin_validators.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { SETTING_KEYS, resolveEffectiveRolesCatalog, } from '../runtime_toggles.js';
 /** Regex de validação: nome de role — letras maiúsculas, dígitos e underscore. */

package/build/src/host/admin_console/console_sessions_controller.js

@@ -1,8 +1,8 @@
 import '../augmentations.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { apiError, grantDto, sessionDto } from '../admin_api/dto.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { sessionAccountValidator } from '../admin_validators.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { enrichSessionsWithContext } from '../session_context.js';
 /**
  * Endpoints JSON de sessões/grants do console admin React.

package/build/src/host/admin_console/console_users_controller.js

@@ -1,10 +1,10 @@
 import '../augmentations.js';
 import { supportsAccountDeletion, supportsAccountStatus } from '../../accounts/account_store.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { AdminUsersService } from '../admin_api/admin_users_service.js';
 import { apiError, grantDto, sessionDto, userDto } from '../admin_api/dto.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { adminUserCreateValidator, adminUserRolesValidator } from '../admin_validators.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { resolveEffectiveRolesCatalog } from '../runtime_toggles.js';
 import { enrichSessionsWithContext } from '../session_context.js';

package/build/src/host/console_session.js

@@ -1,6 +1,6 @@
 import { getAccountLoginUrl } from './account_login_url.js';
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 import { impersonationState } from './impersonation_session.js';
-import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
 /**
  * Helpers públicos para integrar a sessão do console do AuthKit com
  * qualquer coisa fora do pacote (ex.: proteger o dashboard do

package/build/src/host/controllers/account_apps_controller.js

@@ -1,7 +1,7 @@
 import '../augmentations.js';
 import { accountPath } from '../account_paths.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 /**
  * Self-service de consentimento ("apps com acesso") no console de conta. Lista os
  * Grants da própria conta agrupados por client (resolvendo o nome do client da

package/build/src/host/controllers/account_mfa_controller.js

@@ -2,8 +2,8 @@ import '../augmentations.js';
 import QRCode from 'qrcode';
 import { supportsPasskeys } from '../../accounts/account_store.js';
 import { accountPath } from '../account_paths.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { translate } from '../i18n.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { dispatchSecurityNotice } from '../security_notice_service.js';
 import { requireSudo } from '../sudo_mode.js';

package/build/src/host/controllers/account_orgs_controller.js

@@ -2,9 +2,9 @@ import '../augmentations.js';
 import { supportsOrganizations } from '../../accounts/account_store.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
 import { accountPath } from '../account_paths.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { ACTIVE_ORG_COOKIE, ACTIVE_ORG_COOKIE_TTL, encodeActiveOrgCookie, } from '../active_org_cookie.js';
 import { sendOrgInvitationEmail } from '../default_mailer.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { authkitOrigin } from '../origin.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { isRoleInCatalog } from '../runtime_toggles.js';
@@ -72,8 +72,13 @@ export default class AccountOrgsController {
         if (!name || !slug)
             return response.redirect(accountPath('orgs'));
         try {
-            await store.createOrg({ name, slug, ownerAccountId: accountId });
-            await cfg.audit?.record({ type: 'organization.created', accountId, metadata: { slug } });
+            const org = await store.createOrg({ name, slug, ownerAccountId: accountId });
+            await cfg.audit?.record({
+                type: 'organization.created',
+                accountId,
+                orgId: org.id,
+                metadata: { slug },
+            });
         }
         catch {
             // slug duplicado ou outro erro — redireciona sem mensagem de erro específica
@@ -112,6 +117,7 @@ export default class AccountOrgsController {
         await cfg.audit?.record({
             type: 'organization.switched',
             accountId,
+            orgId,
             metadata: { orgId, orgSlug: org.slug },
         });
         return response.redirect(accountPath('orgs'));
@@ -140,6 +146,7 @@ export default class AccountOrgsController {
             await cfg.audit?.record({
                 type: 'organization.member_removed',
                 accountId,
+                orgId: params.id,
                 metadata: { orgId: params.id, self: true },
             });
         }
@@ -217,6 +224,7 @@ export default class AccountOrgsController {
         await cfg.audit?.record({
             type: 'organization.invitation_sent',
             accountId,
+            orgId: params.id,
             metadata: { orgId: params.id, email, role },
         });
         return response.redirect(accountPath('orgs'));
@@ -270,6 +278,7 @@ export default class AccountOrgsController {
             await cfg.audit?.record({
                 type: 'organization.invitation_accepted',
                 accountId,
+                orgId: invitation.organizationId,
                 metadata: { orgId: invitation.organizationId, invitationId: invitation.id },
             });
         }
@@ -294,6 +303,7 @@ export default class AccountOrgsController {
             await cfg.audit?.record({
                 type: 'organization.member_removed',
                 actorId,
+                orgId: params.id,
                 metadata: { orgId: params.id, targetAccountId: params.accountId },
             });
         }
@@ -318,6 +328,7 @@ export default class AccountOrgsController {
         await cfg.audit?.record({
             type: 'organization.invitation_revoked',
             actorId,
+            orgId: params.id,
             metadata: { orgId: params.id, invitationId: params.invId },
         });
         return response.redirect(accountPath('orgs'));

package/build/src/host/controllers/account_security_controller.js

@@ -5,12 +5,12 @@ import { AccountDeletionService } from '../account_deletion_service.js';
 import { AccountExportService } from '../account_export_service.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
 import { accountPath } from '../account_paths.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { syncAdonisAuthLogout } from '../adonis_auth_sync.js';
 import { AvatarUploadError, isAvatarUploadSupported, storeAvatar } from '../avatar_storage.js';
 import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail, sendEmailChangedCompletedEmail, } from '../default_mailer.js';
 import { translate } from '../i18n.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { authkitOrigin } from '../origin.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';

package/build/src/host/controllers/account_session_controller.js

@@ -1,11 +1,11 @@
 import '../augmentations.js';
 import { accountHome } from '../account_home.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { syncAdonisAuthLogin, syncAdonisAuthLogout } from '../adonis_auth_sync.js';
 import { translate } from '../i18n.js';
 import { attemptPasswordLogin } from '../login_attempt.js';
 import { notifyLoginSuccess } from '../login_notify.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { markSudo } from '../sudo_mode.js';
 /**

package/build/src/host/controllers/account_tokens_controller.js

@@ -1,6 +1,6 @@
 import '../augmentations.js';
 import { accountPath } from '../account_paths.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { requireSudo } from '../sudo_mode.js';
 export default class AccountTokensController {

package/build/src/host/impersonation_session.js

@@ -1,4 +1,4 @@
-import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 /**
  * Ergonômico de SESSÃO de browser no RP para "personificar" (impersonate) um
  * usuário e navegar como ele — roteado pelo token-exchange RFC 8693 que o IdP já

package/build/src/host/middleware/account_auth.d.ts

@@ -1,7 +1,8 @@
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
 import type { NextFn } from '@adonisjs/core/types/http';
-export declare const ACCOUNT_SESSION_KEY = "account_user_id";
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
+export { ACCOUNT_SESSION_KEY };
 export default class AccountAuthMiddleware {
     handle(ctx: HttpContext, next: NextFn): Promise<any>;
 }

package/build/src/host/middleware/account_auth.js

@@ -1,6 +1,7 @@
 import '../augmentations.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
-export const ACCOUNT_SESSION_KEY = 'account_user_id';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
+export { ACCOUNT_SESSION_KEY };
 export default class AccountAuthMiddleware {
     async handle(ctx, next) {
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);

package/build/src/host/oidc_rp_guard.js

@@ -1,5 +1,5 @@
 import { RuntimeException } from '@adonisjs/core/exceptions';
-import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 /** Memo do construtor entre instâncias — o `import()` só paga o custo uma vez. */
 let cachedUnauthorizedAccess;
 /**

package/build/src/host/register_auth_host.js

@@ -3,10 +3,10 @@ import { accountHome } from './account_home.js';
 import { getAccountLoginUrl, setAccountLoginUrl } from './account_login_url.js';
 import { accountPath, accountPathsMap, accountPrefix, joinAccountPath, setAccountPaths, } from './account_paths.js';
 import { resolveAccountRoles } from './account_roles.js';
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 import { adminApiGuard } from './admin_api/admin_api_guard.js';
 import { normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './admin_prefix.js';
 import { getAuthHostConfig, markAuthHostAutoMounted, wasAuthHostAutoMounted, } from './auth_host_config.js';
-import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
 import { createAuthThrottles } from './rate_limit.js';
 import { resolveRuntimeSettings } from './runtime_settings.js';
 import { resolveEffectiveSessionPolicy } from './runtime_toggles.js';

package/build/src/host/sudo/runtime.js

@@ -1,8 +1,8 @@
 import { accountHome } from '../account_home.js';
 import { accountPath } from '../account_paths.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { validateReturnTo } from '../controllers/account_session_controller.js';
 import { translate } from '../i18n.js';
-import { ACCOUNT_SESSION_KEY } from '../middleware/account_auth.js';
 import { markSudo } from '../sudo_mode.js';
 /** Último método usado com sucesso — só ordena a tela, não restringe nada. */
 export const LAST_METHOD_SESSION_KEY = 'authkit_sudo_last_method';

package/build/src/host/sudo_mode.js

@@ -14,7 +14,7 @@
  * `SUDO_ACCOUNT_SESSION_KEY`.
  */
 import { accountPath } from './account_paths.js';
-import { ACCOUNT_SESSION_KEY } from './middleware/account_auth.js';
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 import { SETTING_KEYS } from './runtime_toggles.js';
 export const SUDO_MODE_DEFAULTS = {
     enabled: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.58.2",
+  "version": "0.59.0",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -108,7 +108,7 @@
     "oidc-provider": "9.11.3",
     "otplib": "12.0.1",
     "qrcode": "1.5.4",
-    "@adonis-agora/authkit-core": "0.7.1"
+    "@adonis-agora/authkit-core": "0.8.0"
   },
   "devDependencies": {
     "@adonis-agora/durable": "0.22.0",
@@ -150,7 +150,7 @@
     "react-error-boundary": "6.1.2",
     "nuqs": "2.9.5",
     "recharts": "3.10.1",
-    "@adonis-agora/authkit-react": "0.19.0"
+    "@adonis-agora/authkit-react": "0.19.1"
   },
   "scripts": {
     "build": "node scripts/build_host_css.mjs && node scripts/build_webauthn.mjs && node scripts/build_ui.mjs && node -e \"const fs=require('node:fs');for(const d of ['build/stubs','build/host/views'])fs.rmSync(d,{recursive:true,force:true})\" && tsc && node -e \"require('node:fs').cpSync('src/host/assets','build/src/host/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/src/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/src/password/common_passwords.txt')\"",