@adonis-agora/authkit-server 0.59.0 → 0.60.0

package/build/index.d.ts

@@ -23,8 +23,8 @@ export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account
 export { lucidStores } from './src/accounts/lucid_stores.js';
 export type { LucidStoresModels, LucidStoresOptions, LucidStoresResult, } from './src/accounts/lucid_stores.js';
 export type { LucidAccountStoreOptions, AccountSecretEncrypter, } from './src/accounts/lucid_account_store.js';
-export type { AccountStore, CoreAccountStore, AdminCapability, MfaCapability, WebauthnCapability, ProviderIdentityCapability, ProviderIdentitySummary, AccountSecurityCapability, AccountStatusCapability, ProfileCapability, MagicLinkCapability, OtpLoginCapability, OtpLoginVerifyResult, EmailVerificationStatusCapability, AccountDeletionCapability, AccountImportCapability, ImportAccountInput, AuthAccount, CreateAccountInput, LinkProviderIdentityInput, ListAccountsParams, Paginated, PasskeySummary, } from './src/accounts/account_store.js';
-export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, } from './src/accounts/account_store.js';
+export type { AccountStore, CoreAccountStore, AdminCapability, MfaCapability, WebauthnCapability, ProviderIdentityCapability, ProviderIdentitySummary, AccountSecurityCapability, AccountStatusCapability, ProfileCapability, MagicLinkCapability, OtpLoginCapability, OtpLoginVerifyResult, EmailVerificationStatusCapability, AccountDeletionCapability, AccountImportCapability, ImportAccountInput, AuthAccount, CreateAccountInput, LinkProviderIdentityInput, ListAccountsParams, Paginated, PasskeySummary, LoginMethodsPreferenceCapability, } from './src/accounts/account_store.js';
+export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, supportsLoginMethodsPreference, } from './src/accounts/account_store.js';
 export { type OtpLoginConfigInput, type ResolvedOtpLoginConfig, type OtpVerifyOutcome, resolveOtpLoginConfig, generateOtpCode, evaluateLoginOtp, OTP_LOGIN_DEFAULTS, } from './src/host/otp_login.js';
 export { PasswordManager, PasswordPolicyError, } from './src/password/password_manager.js';
 export type { PasswordConfigInput, LegacyPasswordVerifier, PasswordVerifyResult, } from './src/password/password_manager.js';
@@ -125,6 +125,8 @@ export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
 export type { BotProtectionSetting } from './src/host/bot_protection.js';
 export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
 export type { SettingKey, RegistrationSetting, RequireVerifiedEmailSetting, MaintenanceModeSetting, ResolvedMaintenanceMode, AuthMethodsSetting, ResolvedAuthMethods, AuthMethodsCapabilities, AuthMethodsConfigOverride, } from './src/host/runtime_toggles.js';
+export { USER_LOGIN_METHOD_KEYS, normalizeUserLoginMethods, parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from './src/host/user_login_methods.js';
+export type { UserLoginMethodKey, UserLoginMethods, ResolvedUserLoginMethods, } from './src/host/user_login_methods.js';
 export { resolveRegistration } from './src/define_config.js';
 export type { RegistrationConfigInput, ResolvedRegistrationConfig, } from './src/define_config.js';
 export { getAccountId, realAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';

package/build/index.js

@@ -14,7 +14,7 @@ export { resolveTrustedDevices, isTrustedDeviceValid, buildTrustedDevicePayload,
 export { resolveBotProtection, botProtectionApplies, extractBotToken, verifyBotProtection, guardBotProtection, DEFAULT_BOT_TOKEN_FIELDS, } from './src/host/bot_protection.js';
 export { lucidAccountStore, appKeyEncrypter } from './src/accounts/lucid_account_store.js';
 export { lucidStores } from './src/accounts/lucid_stores.js';
-export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, } from './src/accounts/account_store.js';
+export { supportsMfa, supportsPasskeys, supportsProviderIdentity, supportsAccountSecurity, supportsAccountStatus, supportsProfile, supportsMagicLink, supportsOtpLogin, supportsEmailVerificationStatus, supportsAccountDeletion, supportsAccountImport, supportsLoginMethodsPreference, } from './src/accounts/account_store.js';
 // Login por OTP (código digitável): config + helpers puros.
 export { resolveOtpLoginConfig, generateOtpCode, evaluateLoginOtp, OTP_LOGIN_DEFAULTS, } from './src/host/otp_login.js';
 // Gerência de senha: lazy rehash + legacy verifier, política e checagem de vazamento.
@@ -85,6 +85,8 @@ export { buildKeysStatus, rotateNow } from './src/host/key_rotation_actions.js';
 export { resolveEffectiveBotProtection } from './src/host/bot_protection.js';
 // Runtime toggles (registration, require_verified_email, maintenance_mode).
 export { SETTING_KEYS, resolveEffectiveRegistration, resolveEffectiveRequireVerifiedEmail, resolveEffectiveMaintenanceMode, resolveEffectiveAuthMethods, configLockedAuthMethods, } from './src/host/runtime_toggles.js';
+// Tipos de login POR USUÁRIO (self-service no console de conta).
+export { USER_LOGIN_METHOD_KEYS, normalizeUserLoginMethods, parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from './src/host/user_login_methods.js';
 export { resolveRegistration } from './src/define_config.js';
 export { getAccountId, realAccountId, hasAccountSession, consoleLoginUrl, } from './src/host/console_session.js';
 export { ACCOUNT_SESSION_KEY } from './src/host/account_session_key.js';

package/build/src/accounts/account_store.d.ts

@@ -1,4 +1,5 @@
 /** DTO público da conta — o que o provider e os controllers enxergam. Nunca um model Lucid. */
+import type { UserLoginMethods } from '../host/user_login_methods.js';
 export interface AuthAccount {
     id: string;
     email: string;
@@ -211,6 +212,22 @@ export interface ProviderIdentitySummary {
     providerUserId: string;
     email?: string | null;
 }
+/**
+ * Preferência POR USUÁRIO de tipos de login (self-service no console de conta).
+ * CAPACIDADE opcional, montada quando o model tem a coluna `login_methods`
+ * (JSONB) — hosts adotam por migração própria. `null` = sem preferência (herda
+ * os métodos globais efetivos). Ver `host/user_login_methods.ts` para o shape
+ * canônico (`UserLoginMethods`) e a semântica da interseção.
+ */
+export interface LoginMethodsPreferenceCapability {
+    /** Lê a preferência da conta; null quando não há preferência persistida. */
+    getLoginMethods(accountId: string): Promise<UserLoginMethods | null>;
+    /**
+     * Grava a preferência da conta. Objeto vazio ou null REMOVE a preferência
+     * (volta a herdar os globais). No-op se a conta não existe.
+     */
+    setLoginMethods(accountId: string, methods: UserLoginMethods | null): Promise<void>;
+}
 /**
  * MFA / TOTP. Stores sem suporte a MFA omitem a capacidade inteira; o interaction
  * flow trata a ausência como "MFA desligado".
@@ -599,7 +616,7 @@ export type AccountStore = CoreAccountStore & {
      * blocos `Partial<...>` de capacidades probáveis.
      */
     readonly connectionName?: string;
-} & Partial<MfaCapability & WebauthnCapability & ProviderIdentityCapability & AccountSecurityCapability & AccountStatusCapability & ProfileCapability & MagicLinkCapability & OtpLoginCapability & EmailVerificationStatusCapability & AccountDeletionCapability & AccountImportCapability & OrganizationsCapability & PasswordHistoryCapability & PasswordExpirationCapability>;
+} & Partial<MfaCapability & WebauthnCapability & ProviderIdentityCapability & AccountSecurityCapability & AccountStatusCapability & ProfileCapability & MagicLinkCapability & OtpLoginCapability & EmailVerificationStatusCapability & AccountDeletionCapability & AccountImportCapability & OrganizationsCapability & PasswordHistoryCapability & PasswordExpirationCapability & LoginMethodsPreferenceCapability>;
 /** Type guard: o store implementa a capacidade de MFA / TOTP. */
 export declare function supportsMfa(store: AccountStore): store is AccountStore & MfaCapability;
 /**
@@ -634,3 +651,5 @@ export declare function supportsAccountImport(store: AccountStore): store is Acc
 export declare function supportsPasswordHistory(store: AccountStore): store is AccountStore & PasswordHistoryCapability;
 /** Type guard: o store implementa expiração de senha (password_changed_at coluna). */
 export declare function supportsPasswordExpiration(store: AccountStore): store is AccountStore & PasswordExpirationCapability;
+/** Type guard: o store implementa a preferência por usuário de tipos de login. */
+export declare function supportsLoginMethodsPreference(store: AccountStore): store is AccountStore & LoginMethodsPreferenceCapability;

package/build/src/accounts/account_store.js

@@ -63,3 +63,7 @@ export function supportsPasswordHistory(store) {
 export function supportsPasswordExpiration(store) {
     return typeof store.getPasswordChangedAt === 'function';
 }
+/** Type guard: o store implementa a preferência por usuário de tipos de login. */
+export function supportsLoginMethodsPreference(store) {
+    return typeof store.getLoginMethods === 'function';
+}

package/build/src/accounts/lucid_account_store.js

@@ -1,6 +1,7 @@
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 import { PasswordManager } from '../password/password_manager.js';
 import { buildCore } from './lucid_store/core.js';
+import { buildLoginMethods, supportsLoginMethodsColumn } from './lucid_store/login_methods.js';
 import { buildMfa } from './lucid_store/mfa.js';
 import { buildOrganizations } from './lucid_store/organizations.js';
 import { buildPasswordExpiration, buildPasswordHistory } from './lucid_store/password_hygiene.js';
@@ -212,6 +213,9 @@ export function lucidAccountStore(Model, options = {}) {
         ...buildDeletion(ctx),
         // Expiração de senha: só quando o model tem a coluna `password_changed_at`.
         ...(hasColumn(Model, 'passwordChangedAt') ? buildPasswordExpiration(ctx) : {}),
+        // Preferência por usuário de tipos de login: só quando o model tem a coluna
+        // `login_methods` (JSONB). Sem a coluna → capacidade ausente (feature no-op).
+        ...(supportsLoginMethodsColumn(Model) ? buildLoginMethods(ctx) : {}),
         // Organizations (multi-tenancy): só quando os três models foram fornecidos.
         ...(OrgModels
             ? buildOrganizations({

package/build/src/accounts/lucid_store/login_methods.d.ts

@@ -0,0 +1,11 @@
+import type { LoginMethodsPreferenceCapability } from '../account_store.js';
+import type { LucidStoreContext } from './shared.js';
+/**
+ * Preferência por usuário de tipos de login sobre a coluna `login_methods`
+ * (JSONB) do model. Só deve ser montada quando a coluna existe
+ * ({@link hasColumn}) — caso contrário a capacidade fica ausente e a feature
+ * degrada para no-op (hosts adotam por migração própria).
+ */
+export declare function buildLoginMethods(ctx: LucidStoreContext): LoginMethodsPreferenceCapability;
+/** Indica se o model suporta a preferência de tipos de login (coluna presente). */
+export declare function supportsLoginMethodsColumn(Model: any): boolean;

package/build/src/accounts/lucid_store/login_methods.js

@@ -0,0 +1,32 @@
+import { normalizeUserLoginMethods } from '../../host/user_login_methods.js';
+import { hasColumn } from './status_profile.js';
+/**
+ * Preferência por usuário de tipos de login sobre a coluna `login_methods`
+ * (JSONB) do model. Só deve ser montada quando a coluna existe
+ * ({@link hasColumn}) — caso contrário a capacidade fica ausente e a feature
+ * degrada para no-op (hosts adotam por migração própria).
+ */
+export function buildLoginMethods(ctx) {
+    const { Model } = ctx;
+    return {
+        async getLoginMethods(accountId) {
+            const row = await Model.find(accountId);
+            if (!row)
+                return null;
+            return normalizeUserLoginMethods(row.loginMethods);
+        },
+        async setLoginMethods(accountId, methods) {
+            const row = await Model.find(accountId);
+            if (!row)
+                return;
+            // Objeto vazio/null → grava null (sem preferência = herda globais).
+            const value = methods && Object.keys(methods).length > 0 ? normalizeUserLoginMethods(methods) : null;
+            row.loginMethods = value;
+            await row.save();
+        },
+    };
+}
+/** Indica se o model suporta a preferência de tipos de login (coluna presente). */
+export function supportsLoginMethodsColumn(Model) {
+    return hasColumn(Model, 'loginMethods');
+}

package/build/src/host/account_api/account_api_controller.d.ts

@@ -30,6 +30,7 @@
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
 export default class AccountApiController {
+    #private;
     /** Perfil + flags do usuário logado. */
     me(ctx: HttpContext): Promise<void | {
         id: any;
@@ -171,6 +172,43 @@ export default class AccountApiController {
             available: any;
         };
     }>;
+    /**
+     * Preferência POR USUÁRIO de tipos de login + o catálogo do que está
+     * disponível/travado. A interseção com os métodos globais efetivos é feita
+     * AQUI (a UI mostra o estado final; o enforcement no login reusa o resolver).
+     */
+    getLoginMethods(ctx: HttpContext): Promise<{
+        supported: false;
+        methods: null;
+        available: null;
+        locked: null;
+    } | {
+        supported: true;
+        methods: any;
+        available: {
+            password: boolean;
+            magicLink: boolean;
+            passkey: boolean;
+            social: string[];
+            forgotPassword: boolean;
+        };
+        locked: {
+            password: boolean;
+            magicLink: boolean;
+            passkey: boolean;
+            social: boolean;
+        };
+    }>;
+    /** Grava a preferência de tipos de login do usuário logado. */
+    updateLoginMethods(ctx: HttpContext): Promise<void | {
+        ok: boolean;
+        methods: {
+            password?: boolean;
+            magicLink?: boolean;
+            passkey?: boolean;
+            social?: boolean;
+        };
+    }>;
     /** Lista passkeys do usuário logado. */
     listPasskeys(ctx: HttpContext): Promise<{
         supported: boolean;

package/build/src/host/account_api/account_api_controller.js

@@ -28,7 +28,7 @@
  *   GET  /account/api/orgs/invitations     → convites pendentes
  */
 import '../augmentations.js';
-import { supportsAccountSecurity, supportsOrganizations, supportsPasskeys, supportsProfile, } from '../../accounts/account_store.js';
+import { supportsAccountSecurity, supportsLoginMethodsPreference, supportsMagicLink, supportsOrganizations, supportsPasskeys, supportsProfile, } from '../../accounts/account_store.js';
 import { PasswordPolicyError } from '../../password/password_manager.js';
 import { accountPath } from '../account_paths.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
@@ -39,11 +39,12 @@ import { AvatarUploadError, isAvatarUploadSupported, storeAvatar } from '../avat
 import { sendEmailChangeConfirmationEmail, sendEmailChangeNoticeEmail } from '../default_mailer.js';
 import { translate } from '../i18n.js';
 import { authkitOrigin } from '../origin.js';
-import { resolveRuntimeSettings } from '../runtime_settings.js';
-import { resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';
+import { resolveRuntimeSettings, resolveRuntimeSettingsOrNoop } from '../runtime_settings.js';
+import { configLockedAuthMethods, resolveEffectiveAuthMethods, resolveEffectiveEmailChange, resolveEffectivePasswordHistory, } from '../runtime_toggles.js';
 import { dispatchSecurityNotice } from '../security_notice_service.js';
 import { enrichSessionsWithContext } from '../session_context.js';
 import { SUDO_MODE_DEFAULTS, isSudoActive, requireSudo, resolveEffectiveSudoMode, } from '../sudo_mode.js';
+import { parseUserLoginMethodsPayload, resolveEffectiveUserLoginMethods, } from '../user_login_methods.js';
 import { changeEmailValidator, changePasswordValidator, updateProfileValidator, } from '../validators.js';
 // ---------------------------------------------------------------------------
 // Helpers (shared with existing controllers — kept local to avoid coupling)
@@ -641,6 +642,86 @@ export default class AccountApiController {
             recovery: { available: enabled },
         };
     }
+    // ─── GET /account/api/login-methods ─────────────────────────────────────
+    /**
+     * Preferência POR USUÁRIO de tipos de login + o catálogo do que está
+     * disponível/travado. A interseção com os métodos globais efetivos é feita
+     * AQUI (a UI mostra o estado final; o enforcement no login reusa o resolver).
+     */
+    async getLoginMethods(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const supported = supportsLoginMethodsPreference(cfg.accountStore);
+        if (!supported) {
+            return { supported: false, methods: null, available: null, locked: null };
+        }
+        const pref = await cfg.accountStore.getLoginMethods(userId);
+        const { resolved: global, locked: cfgLocked } = await this.#resolveGlobalAuthMethods(ctx, cfg);
+        const effective = resolveEffectiveUserLoginMethods(global, pref);
+        return {
+            supported: true,
+            // Preferência crua do usuário (o que ELE escolheu; null = sem preferência).
+            methods: pref ?? {},
+            // Estado final por método (global ∩ preferência) — o que a tela de login mostra.
+            available: {
+                password: effective.password,
+                magicLink: effective.magicLink,
+                passkey: effective.passkey,
+                social: effective.social,
+                forgotPassword: effective.forgotPassword,
+            },
+            // Métodos que o usuário NÃO pode controlar (globalmente off ou pin de config).
+            // Pin de config: `cfgLocked` lista as chaves fixadas no arquivo de config.
+            locked: {
+                password: !global.password || cfgLocked.includes('password'),
+                magicLink: !global.magicLink || cfgLocked.includes('magicLink'),
+                passkey: !global.passkey || cfgLocked.includes('passkey'),
+                social: global.social.length === 0,
+            },
+        };
+    }
+    // ─── PUT /account/api/login-methods ─────────────────────────────────────
+    /** Grava a preferência de tipos de login do usuário logado. */
+    async updateLoginMethods(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        if (!supportsLoginMethodsPreference(cfg.accountStore)) {
+            return ctx.response.notFound(apiErr('not_supported', 'Login methods preference not supported.'));
+        }
+        const parsed = parseUserLoginMethodsPayload(ctx.request.body());
+        if (!parsed.ok) {
+            return ctx.response.badRequest(apiErr(parsed.error, 'Invalid login methods payload.'));
+        }
+        // All-off guard server-side: a preferência não pode zerar todos os métodos
+        // GLOBAIS disponíveis. Um `false` que deixaria zero métodos é recusado.
+        const { resolved: global } = await this.#resolveGlobalAuthMethods(ctx, cfg);
+        const value = { ...parsed.value };
+        const wouldBeAllOff = (value.password === false || !global.password) &&
+            (value.magicLink === false || !global.magicLink) &&
+            (value.passkey === false || !global.passkey) &&
+            (value.social === false || global.social.length === 0);
+        if (wouldBeAllOff) {
+            return ctx.response.badRequest(apiErr('all_methods_off', 'Cannot disable every login method.'));
+        }
+        await cfg.accountStore.setLoginMethods(userId, Object.keys(value).length > 0 ? value : null);
+        return { ok: true, methods: value };
+    }
+    /**
+     * Métodos globais efetivos + pins de config, compartilhados pelos handlers
+     * acima. Fail-safe: erro → defaults conservadores.
+     */
+    async #resolveGlobalAuthMethods(ctx, cfg) {
+        const settings = await resolveRuntimeSettingsOrNoop(ctx);
+        const resolved = await resolveEffectiveAuthMethods(settings, {
+            configuredSocialProviders: cfg.social?.providers ?? [],
+            magicLinkCapable: cfg.passwordless?.magicLink && supportsMagicLink(cfg.accountStore),
+            passkeyCapable: supportsPasskeys(cfg.accountStore),
+            configOverrides: cfg.authMethods,
+        });
+        return { resolved, locked: configLockedAuthMethods(cfg.authMethods) };
+    }
     // ─── GET /account/api/passkeys ──────────────────────────────────────────
     /** Lista passkeys do usuário logado. */
     async listPasskeys(ctx) {

package/build/src/host/controllers/interaction_controller.js

@@ -1,5 +1,5 @@
 import '../augmentations.js';
-import { supportsMagicLink, supportsOtpLogin, supportsPasskeys, } from '../../accounts/account_store.js';
+import { supportsLoginMethodsPreference, supportsMagicLink, supportsOtpLogin, supportsPasskeys, } from '../../accounts/account_store.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
 import { brandFor, isFirstParty } from '../branding.js';
@@ -14,6 +14,7 @@ import { createOtpLockout, generateOtpUnlockToken, rawToDbOtpUnlockToken, resolv
 import { resolveRuntimeSettingsOrNoop } from '../runtime_settings.js';
 import { resolveEffectiveAuthMethods, resolveEffectiveMaintenanceMode, resolveEffectiveRegistration, resolveEffectiveSessionPolicy, } from '../runtime_toggles.js';
 import { TRUSTED_DEVICE_COOKIE, buildTrustedDevicePayload, isTrustedDeviceValid, } from '../trusted_device.js';
+import { normalizeUserLoginMethods, resolveEffectiveUserLoginMethods, } from '../user_login_methods.js';
 /**
  * Chave i18n do erro de status de conta (disabled/expired) compartilhada pelos
  * fluxos passwordless (magic link, OTP, passkey).
@@ -73,6 +74,44 @@ export default class AuthInteractionController {
             otpEnabled,
         };
     }
+    /**
+     * Métodos de login com a preferência POR USUÁRIO aplicada (interseção global ×
+     * `login_methods` da conta). Usado em TODO render/POST que já conhece o email
+     * (passo 2+ do login) — o passo 1 (identifier) não tem usuário, então usa só o
+     * global via {@link #loginMethods}.
+     *
+     * Fail-safe: store sem a capacidade, conta inexistente ou qualquer erro →
+     * métodos globais sem alteração (a preferência nunca derruba o login).
+     */
+    async #userScopedLoginMethods(ctx, cfg, email, runtimeSettings) {
+        const base = await this.#loginMethods(ctx, cfg, runtimeSettings);
+        if (!email)
+            return base;
+        try {
+            if (!supportsLoginMethodsPreference(cfg.accountStore))
+                return base;
+            const acc = await cfg.accountStore.findByEmail(email);
+            if (!acc)
+                return base;
+            const pref = await cfg.accountStore.getLoginMethods(acc.id);
+            const normalized = normalizeUserLoginMethods(pref);
+            if (!normalized)
+                return base;
+            const scoped = resolveEffectiveUserLoginMethods(base.authMethods, normalized);
+            const magicLinkCapableConfig = cfg.passwordless.magicLink && supportsMagicLink(cfg.accountStore);
+            return {
+                ...base,
+                authMethods: scoped,
+                magicLinkAvailable: scoped.magicLink && magicLinkCapableConfig,
+                // OTP é extensão do magic link — desligar magic link desliga o código.
+                otpEnabled: base.otpEnabled && scoped.magicLink,
+            };
+        }
+        catch {
+            // Preferência nunca derruba o login.
+            return base;
+        }
+    }
     async show(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
@@ -129,7 +168,11 @@ export default class AuthInteractionController {
         // `authMethods`, `magicLinkAvailable` e `otpEnabled` saiam POR CONSTRUÇÃO
         // (o seletor choose-first precisa de `otpEnabled` para oferecer "código").
         // Passa o runtimeSettings já resolvido para maintenance (sem 2ª resolução).
-        const loginMethods = await this.#loginMethods(ctx, cfg, runtimeSettingsForMaintenance);
+        // Com email na sessão (passo 2+), aplica a preferência POR USUÁRIO — os
+        // métodos que o dono da conta desligou não aparecem nem aqui nem nos POSTs.
+        const loginMethods = email
+            ? await this.#userScopedLoginMethods(ctx, cfg, email, runtimeSettingsForMaintenance)
+            : await this.#loginMethods(ctx, cfg, runtimeSettingsForMaintenance);
         const authMethods = loginMethods.authMethods;
         if (!email) {
             // Step 1: identifier (email only).
@@ -215,7 +258,7 @@ export default class AuthInteractionController {
                 ? { fullName: found.name ?? null, globalRoles: found.globalRoles ?? [] }
                 : null;
             return render(ctx, 'login', {
-                ...(await this.#loginMethods(ctx, cfg)),
+                ...(await this.#userScopedLoginMethods(ctx, cfg, email, runtimeSettings)),
                 uid: ctx.request.param('uid'),
                 csrfToken: ctx.request.csrfToken,
                 step: 'password',
@@ -226,6 +269,35 @@ export default class AuthInteractionController {
                 botProtection: effectiveBotLogin?.widget,
             });
         }
+        // Preferência por usuário: senha desligada para ESTA conta → recusa ANTES de
+        // verificar credenciais (mesma tela/erro de credencial inválida — não vaza
+        // se a conta existe nem qual preferência está gravada).
+        const userMethodsForLogin = await this.#userScopedLoginMethods(ctx, cfg, email, runtimeSettings);
+        if (!userMethodsForLogin.authMethods.password) {
+            const found = await cfg.accountStore.findByEmail(email);
+            const account = found
+                ? { fullName: found.name ?? null, globalRoles: found.globalRoles ?? [] }
+                : null;
+            await cfg.audit?.record({
+                type: 'login.failure',
+                ip,
+                clientId,
+                metadata: { stage: 'password', reason: 'method_disabled_by_user' },
+            });
+            return render(ctx, 'login', {
+                ...userMethodsForLogin,
+                uid: ctx.request.param('uid'),
+                csrfToken: ctx.request.csrfToken,
+                step: 'password',
+                email,
+                account,
+                error: translate(cfg.messages, 'errors.invalid_credentials'),
+                brand,
+                botProtection: effectiveBotLogin?.on.includes('login')
+                    ? effectiveBotLogin.widget
+                    : undefined,
+            });
+        }
         // Verificamos as credenciais ANTES de finalizar a interaction, porque com MFA
         // ligado precisamos exigir o 2º fator e NÃO podemos chamar interactionFinished
         // ainda. A sequência verificação + lockout + auditoria de falha é centralizada
@@ -260,7 +332,7 @@ export default class AuthInteractionController {
                 ? { fullName: found.name ?? null, globalRoles: found.globalRoles ?? [] }
                 : null;
             return render(ctx, 'login', {
-                ...(await this.#loginMethods(ctx, cfg)),
+                ...userMethodsForLogin,
                 uid: ctx.request.param('uid'),
                 csrfToken: ctx.request.csrfToken,
                 step: 'password',
@@ -633,6 +705,24 @@ export default class AuthInteractionController {
         // o e-mail e a tela mostrem SÓ aquele método. Ausente/ inválido = both (histórico).
         // NÃO condiciona a emissão de token — os dois continuam saindo co-locados.
         const channel = normalizeLoginChannel(ctx.request.input('channel'));
+        // Preferência por usuário: magic link desligado para ESTA conta → não emite
+        // token (resposta uniforme "enviado", sem vazar a preferência).
+        const userScopedMethods = email && cfg.passwordless.magicLink && supportsMagicLink(cfg.accountStore)
+            ? await this.#userScopedLoginMethods(ctx, cfg, email)
+            : null;
+        if (userScopedMethods && !userScopedMethods.authMethods.magicLink) {
+            return render(ctx, 'login', {
+                ...userScopedMethods,
+                uid,
+                csrfToken: ctx.request.csrfToken,
+                step: 'password',
+                email,
+                account: null,
+                brand,
+                magicLinkSent: true,
+                magicChannel: 'none',
+            });
+        }
         if (cfg.passwordless.magicLink && supportsMagicLink(cfg.accountStore) && email) {
             const ip = ctx.request.ip?.() ?? null;
             const clientId = details.params.client_id ?? null;
@@ -676,7 +766,9 @@ export default class AuthInteractionController {
         // `otpEnabled` vem do spread de `#loginMethods` (mesmo valor do `otpEnabled`
         // local usado acima para decidir a emissão) — não re-declarado aqui.
         return render(ctx, 'login', {
-            ...(await this.#loginMethods(ctx, cfg)),
+            ...(email
+                ? await this.#userScopedLoginMethods(ctx, cfg, email)
+                : await this.#loginMethods(ctx, cfg)),
             uid,
             csrfToken: ctx.request.csrfToken,
             step: 'password',
@@ -715,6 +807,31 @@ export default class AuthInteractionController {
             });
             return ctx.response.redirect(`/auth/interaction/${uid}`);
         }
+        // Preferência por usuário: magic link desligado para esta conta (p. ex. o
+        // token foi emitido antes de o usuário desligar o método) → não materializa
+        // a sessão; volta ao login com erro genérico (não vaza a preferência).
+        const magicScoped = await this.#userScopedLoginMethods(ctx, cfg, acc.email);
+        if (!magicScoped.authMethods.magicLink) {
+            await cfg.audit?.record({
+                type: 'login.failure',
+                accountId: acc.id,
+                email: acc.email,
+                ip,
+                clientId,
+                metadata: { stage: 'magic_link', reason: 'method_disabled_by_user' },
+            });
+            const render = cfg.render;
+            return render(ctx, 'login', {
+                ...magicScoped,
+                uid,
+                csrfToken: ctx.request.csrfToken,
+                step: 'password',
+                email: acc.email,
+                account: null,
+                brand: brandFor(cfg.branding, clientId ?? undefined, undefined),
+                error: translate(cfg.messages, 'errors.invalid_credentials'),
+            });
+        }
         // E-mail não verificado (LGPD/compliance): mesmo com o link válido, não
         // materializa a sessão se a política exige verificação. Volta ao login com erro.
         const magicLinkRuntimeSettings = await resolveRuntimeSettingsOrNoop(ctx);
@@ -729,7 +846,7 @@ export default class AuthInteractionController {
             });
             const render = cfg.render;
             return render(ctx, 'login', {
-                ...(await this.#loginMethods(ctx, cfg)),
+                ...(await this.#userScopedLoginMethods(ctx, cfg, acc.email)),
                 uid,
                 csrfToken: ctx.request.csrfToken,
                 step: 'password',
@@ -762,7 +879,7 @@ export default class AuthInteractionController {
         if (!magicLinkStatusGate.allowed) {
             const render = cfg.render;
             return render(ctx, 'login', {
-                ...(await this.#loginMethods(ctx, cfg)),
+                ...(await this.#userScopedLoginMethods(ctx, cfg, acc.email)),
                 uid,
                 csrfToken: ctx.request.csrfToken,
                 step: 'password',
@@ -814,10 +931,10 @@ export default class AuthInteractionController {
             maxAttempts: cfg.login.otp.maxAttempts,
         });
         // Re-render da tela "link enviado" com o campo de código + erro localizado.
-        // `otpEnabled` vem do spread de `#loginMethods` (aqui, após a guarda acima,
-        // vale `true`) — não re-declarado inline.
+        // `otpEnabled` vem do spread (scoped — OTP é extensão do magic link, e a
+        // preferência do usuário que desligou magic link já foi barrada acima).
         const renderOtpError = async (messageKey) => render(ctx, 'login', {
-            ...(await this.#loginMethods(ctx, cfg)),
+            ...(await this.#userScopedLoginMethods(ctx, cfg, email)),
             uid,
             csrfToken: ctx.request.csrfToken,
             step: 'password',
@@ -842,7 +959,7 @@ export default class AuthInteractionController {
                     metadata: { stage: 'otp', reason: 'unverified' },
                 });
                 return render(ctx, 'login', {
-                    ...(await this.#loginMethods(ctx, cfg)),
+                    ...(await this.#userScopedLoginMethods(ctx, cfg, result.account.email)),
                     uid,
                     csrfToken: ctx.request.csrfToken,
                     step: 'password',
@@ -868,7 +985,7 @@ export default class AuthInteractionController {
             });
             if (!otpStatusGate.allowed) {
                 return render(ctx, 'login', {
-                    ...(await this.#loginMethods(ctx, cfg)),
+                    ...(await this.#userScopedLoginMethods(ctx, cfg, result.account.email)),
                     uid,
                     csrfToken: ctx.request.csrfToken,
                     step: 'password',
@@ -1033,6 +1150,36 @@ export default class AuthInteractionController {
                 false)
             : false;
         ctx.session.forget(PASSKEY_AUTH_CHALLENGE_KEY);
+        // Preferência por usuário: passkey desligada para esta conta → recusa a
+        // assertion. Checamos DEPOIS de `ok` para não revelar a preferência no
+        // timing de uma assertion inválida. Aqui vale SÓ a preferência explícita do
+        // usuário (`pref.passkey === false`): os switches globais de passkey já são
+        // aplicados na RENDERIZAÇÃO do botão/passkey-first (e o desafio MFA usa
+        // passkey como 2º fator independente do passkey-first).
+        if (ok && accountId && supportsLoginMethodsPreference(cfg.accountStore)) {
+            const prefAccount = await cfg.accountStore.findById(accountId);
+            const pref = prefAccount
+                ? normalizeUserLoginMethods(await cfg.accountStore.getLoginMethods(prefAccount.id))
+                : null;
+            if (pref?.passkey === false) {
+                await cfg.audit?.record({
+                    type: 'login.failure',
+                    accountId,
+                    ip,
+                    clientId,
+                    metadata: { stage: 'mfa', method: 'webauthn', reason: 'method_disabled_by_user' },
+                });
+                return render(ctx, 'mfa-challenge', {
+                    uid: ctx.request.param('uid'),
+                    csrfToken: ctx.request.csrfToken,
+                    error: translate(cfg.messages, 'mfa_challenge.passkey_error'),
+                    brand,
+                    passkeyAvailable: false,
+                    trustedDevicesEnabled: cfg.trustedDevices.enabled,
+                    trustedDeviceDays: cfg.trustedDevices.days,
+                });
+            }
+        }
         if (!ok) {
             await cfg.audit?.record({
                 type: 'login.failure',