@adonis-agora/authkit-server 0.75.0 → 0.77.0

package/build/src/host/controllers/account_apps_controller.js

@@ -1,7 +1,10 @@
 import '../augmentations.js';
+import { displayNameFor } from '../../agents/agent_identity.js';
+import { personalAgentsFor } from '../../agents/runtime.js';
 import { accountPath } from '../account_paths.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
+import { clientDisplayNames } from '../client_names.js';
 /**
  * Self-service de consentimento ("apps com acesso") no console de conta. Lista os
  * Grants da própria conta agrupados por client (resolvendo o nome do client da
@@ -19,13 +22,26 @@ export default class AccountAppsController {
         const sessions = new AdminSessionsService(service);
         const supported = sessions.canList;
         const grantList = supported ? await sessions.listGrants(accountId) : [];
-        // Resolve o nome amigável do client: clientId é o fallback (config estática não
-        // carrega um display name).
-        const nameOf = (clientId) => clientId ?? '';
+        // O nome que o client registrou; sem ele, o clientId.
+        const names = await clientDisplayNames(service, grantList.map((g) => g.clientId).filter((id) => !!id));
+        const nameOf = (clientId) => clientId ? (names.get(clientId) ?? clientId) : '';
         const revoked = ctx.session.flashMessages.get('appRevoked');
+        // Personal agents com delegação ativa (só quando a feature está ligada).
+        const agentsRuntime = await personalAgentsFor(ctx);
+        const agents = agentsRuntime?.delegation
+            ? await Promise.all((await agentsRuntime.delegation.listGrants(accountId)).map(async (g) => ({
+                id: g.id,
+                name: displayNameFor((await agentsRuntime.config.resolveAgent(g.clientId)) ?? {
+                    issuer: g.clientId,
+                    jwksUri: '',
+                }),
+                scopes: g.scopes,
+            })))
+            : null;
         return render(ctx, 'account/apps', {
             csrfToken: ctx.request.csrfToken,
             supported,
+            agents,
             revoked: revoked ?? null,
             apps: grantList
                 .filter((g) => !!g.clientId)
@@ -59,4 +75,24 @@ export default class AccountAppsController {
         ctx.session.flash('appRevoked', cfg.messages['account.apps.revoked'] ?? 'account.apps.revoked');
         return ctx.response.redirect(accountPath('apps'));
     }
+    /** POST /account/apps/agents/:grantId/revoke — revoga a delegação de um personal agent. */
+    async revokeAgent(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        if (!runtime?.delegation)
+            return ctx.response.notFound();
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const grantId = ctx.request.param('grantId');
+        if (await runtime.delegation.revokeGrant(accountId, grantId)) {
+            await cfg.audit?.record({
+                type: 'agent.grant_revoked',
+                accountId,
+                ip: ctx.request.ip?.() ?? null,
+                metadata: { grantId },
+            });
+        }
+        ctx.session.flash('appRevoked', cfg.messages['account.apps.revoked'] ?? 'account.apps.revoked');
+        return ctx.response.redirect(accountPath('apps'));
+    }
 }

package/build/src/host/controllers/account_orgs_controller.js

@@ -11,6 +11,7 @@ import { revokeOrgAccess } from '../org_access_revocation.js';
 // ponto de verdade único, para as duas superfícies nunca divergirem.
 import { effectiveOrgPolicy, orgPolicyDefaults } from '../org_policy.js';
 import { authkitOrigin } from '../origin.js';
+import { redirectExact } from '../redirect_exact.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { isRoleInCatalog, resolveEffectiveOrganizationsPolicy } from '../runtime_toggles.js';
 /**
@@ -257,7 +258,7 @@ export default class AccountOrgsController {
             const loginUrl = getAccountLoginUrl();
             const returnTo = encodeURIComponent(`${accountPath('orgs')}/invitations/${params.token}/accept`);
             const sep = loginUrl.includes('?') ? '&' : '?';
-            return response.redirect(`${loginUrl}${sep}returnTo=${returnTo}`);
+            return redirectExact(response, `${loginUrl}${sep}returnTo=${returnTo}`);
         }
         const tokenHash = createHash('sha256').update(params.token).digest('hex');
         const invitation = await store.findInvitationByTokenHash(tokenHash);

package/build/src/host/controllers/account_security_controller.js

@@ -158,15 +158,19 @@ export default class AccountSecurityController {
             return ctx.response.redirect(getAccountLoginUrl());
         }
         const { currentPassword, confirmEmail } = await ctx.request.validateUsing(deleteAccountValidator);
-        // Confirmação: senha atual correta OU e-mail digitado batendo com o da conta
-        // (case-insensitive). Sem nenhuma das duas → recusa (não deleta).
+        // Confirmação: senha atual correta OU e-mail digitado batendo com o da conta.
+        // Contas sem e-mail podem confirmar o telefone já verificado pelo host.
         let confirmed = false;
         if (currentPassword) {
             confirmed = !!(await store.verifyCredentials(account.email, currentPassword));
         }
         if (!confirmed && confirmEmail) {
-            confirmed =
-                normalizeEmailIdentifier(confirmEmail) === normalizeEmailIdentifier(account.email);
+            confirmed = account.email
+                ? normalizeEmailIdentifier(confirmEmail) === normalizeEmailIdentifier(account.email)
+                : !!account.phone &&
+                    /^[+\d\s().-]+$/.test(confirmEmail) &&
+                    /\d/.test(confirmEmail) &&
+                    confirmEmail.replace(/\D/g, '') === account.phone.replace(/\D/g, '');
         }
         if (!confirmed) {
             ctx.session.flash('deleteError', translate(cfg.messages, 'account.delete.invalid_confirmation'));

package/build/src/host/controllers/account_session_controller.js

@@ -8,6 +8,7 @@ import { translate } from '../i18n.js';
 import { endBridgedIdpSession } from '../idp_session_bridge.js';
 import { attemptPasswordLogin } from '../login_attempt.js';
 import { notifyLoginSuccess } from '../login_notify.js';
+import { redirectExact } from '../redirect_exact.js';
 import { resolveRuntimeSettings } from '../runtime_settings.js';
 import { markSudo } from '../sudo_mode.js';
 /**
@@ -110,7 +111,7 @@ export default class AccountSessionController {
         await syncAdonisAuthLogin(ctx, cfg, acc);
         await notifyLoginSuccess(ctx, cfg, { accountId: acc.id, email: acc.email, ip });
         // Redireciona pro destino original (validado), ou cai no accountHome configurado.
-        return ctx.response.redirect(returnTo ?? accountHome(cfg));
+        return redirectExact(ctx.response, returnTo ?? accountHome(cfg));
     }
     async logout(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');

package/build/src/host/controllers/agent_consent_controller.d.ts

@@ -0,0 +1,17 @@
+import '../augmentations.js';
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Tela de consentimento da delegação (PACT §5.3) — o `verification_uri` do
+ * device flow. Montada atrás do `accountGuard`: sem sessão o usuário passa pelo
+ * login DESTE app e volta com o `user_code` no `return_to`. O agente nunca vê
+ * esse login.
+ *
+ * Durante uma impersonation a tela recusa: um admin personificando alguém não
+ * pode entregar a conta dessa pessoa a um agente.
+ */
+export default class AgentConsentController {
+    /** GET {prefix}/consent?user_code=XXXX-XXXX */
+    show(ctx: HttpContext): Promise<any>;
+    /** POST {prefix}/consent — `decision=allow|deny`, `scope[]` marcados. */
+    decide(ctx: HttpContext): Promise<any>;
+}

package/build/src/host/controllers/agent_consent_controller.js

@@ -0,0 +1,138 @@
+import '../augmentations.js';
+import { displayNameFor } from '../../agents/agent_identity.js';
+import { personalAgentsFor } from '../../agents/runtime.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
+import { impersonationState } from '../impersonation_session.js';
+async function agentName(runtime, issuer) {
+    const registration = await runtime.config.resolveAgent(issuer);
+    return displayNameFor(registration ?? { issuer, jwksUri: '' });
+}
+/** Host do issuer para exibição — um resolver do host pode devolver issuer que não é URL. */
+function originOf(issuer) {
+    try {
+        return new URL(issuer).host;
+    }
+    catch {
+        return issuer;
+    }
+}
+/**
+ * Anti-clickjacking: o atacante pega um código na própria sessão de agente e
+ * emoldura o link já preenchido — um clique em "Permitir" entregaria a conta.
+ * A tela nunca pode ser renderizada num frame, com ou sem o shield do host.
+ */
+function denyFraming(ctx) {
+    ctx.response.header('X-Frame-Options', 'DENY');
+    ctx.response.header('Content-Security-Policy', "frame-ancestors 'none'");
+}
+/**
+ * Tela de consentimento da delegação (PACT §5.3) — o `verification_uri` do
+ * device flow. Montada atrás do `accountGuard`: sem sessão o usuário passa pelo
+ * login DESTE app e volta com o `user_code` no `return_to`. O agente nunca vê
+ * esse login.
+ *
+ * Durante uma impersonation a tela recusa: um admin personificando alguém não
+ * pode entregar a conta dessa pessoa a um agente.
+ */
+export default class AgentConsentController {
+    /** GET {prefix}/consent?user_code=XXXX-XXXX */
+    async show(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        if (!runtime?.delegation)
+            return ctx.response.notFound();
+        denyFraming(ctx);
+        const service = await ctx.containerResolver.make('authkit.server');
+        const render = service.config.render;
+        const base = {
+            csrfToken: ctx.request.csrfToken,
+            action: runtime.urls.consent,
+            request: null,
+            account: null,
+            error: null,
+        };
+        if (impersonationState(ctx).active) {
+            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.impersonating' });
+        }
+        const input = ctx.request.input('user_code');
+        if (!input)
+            return render(ctx, 'agents/consent', base);
+        const pending = await runtime.delegation.pendingRequest(input);
+        if (!pending) {
+            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.invalid_code' });
+        }
+        const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const account = await service.config.accountStore.findById(accountId);
+        return render(ctx, 'agents/consent', {
+            ...base,
+            request: {
+                userCode: pending.userCode,
+                agentName: await agentName(runtime, pending.clientId),
+                agentOrigin: originOf(pending.clientId),
+                scopes: pending.scopes,
+            },
+            account: { email: account?.email ?? null },
+        });
+    }
+    /** POST {prefix}/consent — `decision=allow|deny`, `scope[]` marcados. */
+    async decide(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        if (!runtime?.delegation)
+            return ctx.response.notFound();
+        denyFraming(ctx);
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const render = cfg.render;
+        if (impersonationState(ctx).active) {
+            return render(ctx, 'agents/consent', {
+                csrfToken: ctx.request.csrfToken,
+                action: runtime.urls.consent,
+                request: null,
+                account: null,
+                error: 'agents.consent.impersonating',
+            });
+        }
+        const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const rawCode = ctx.request.input('user_code');
+        const userCode = typeof rawCode === 'string' ? rawCode : '';
+        const pending = await runtime.delegation.pendingRequest(userCode);
+        if (!pending) {
+            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+        }
+        const name = await agentName(runtime, pending.clientId);
+        const raw = ctx.request.input('scope');
+        const chosen = (Array.isArray(raw) ? raw : raw ? [raw] : []).map(String);
+        const approved = ctx.request.input('decision') === 'allow'
+            ? await runtime.delegation.approve({ userCode, accountId, scopes: chosen })
+            : null;
+        if (!approved) {
+            // Negou ou desmarcou tudo. Se nem negar deu, o pedido mudou de estado no
+            // meio do caminho (aprovado em outra aba, expirou).
+            if (!(await runtime.delegation.deny({ userCode, accountId }))) {
+                return render(ctx, 'agents/done', { status: 'expired', agentName: name, scopes: [] });
+            }
+            await cfg.audit?.record({
+                type: 'agent.delegation_denied',
+                accountId,
+                clientId: pending.clientId,
+                ip: ctx.request.ip?.() ?? null,
+                metadata: { requested: pending.scopes.map((s) => s.id) },
+            });
+            return render(ctx, 'agents/done', { status: 'denied', agentName: name, scopes: [] });
+        }
+        await cfg.audit?.record({
+            type: 'agent.delegation_approved',
+            accountId,
+            clientId: pending.clientId,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: { grantId: approved.grantId, scopes: approved.scopes },
+        });
+        return render(ctx, 'agents/done', {
+            status: 'approved',
+            agentName: name,
+            scopes: approved.scopes.map((id) => ({
+                id,
+                description: runtime.delegation.scopes[id] ?? id,
+            })),
+        });
+    }
+}

package/build/src/host/controllers/agent_oauth_controller.d.ts

@@ -0,0 +1,23 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Authorization server de delegação para personal agents (PACT §5.3): metadata
+ * RFC 8414, JWKS e os endpoints RFC 8628 que o AGENTE chama. O cliente OAuth é
+ * o agente, autenticado pelo JWT dele em `Authorization: Bearer` em toda
+ * chamada — `client_id` tem de ser o `iss` desse JWT.
+ */
+export default class AgentOAuthController {
+    #private;
+    metadata(ctx: HttpContext): Promise<void | {
+        issuer: string;
+        device_authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        scopes_supported: string[];
+        grant_types_supported: string[];
+        response_types_supported: never[];
+    }>;
+    /** Chaves que assinam tokens de delegação e recibos — as mesmas do IdP. */
+    jwks(ctx: HttpContext): Promise<any>;
+    deviceAuthorization(ctx: HttpContext): Promise<void>;
+    token(ctx: HttpContext): Promise<void>;
+}

package/build/src/host/controllers/agent_oauth_controller.js

@@ -0,0 +1,110 @@
+import { AgentOAuthError, DEVICE_CODE_GRANT_TYPE, REFRESH_TOKEN_GRANT_TYPE, } from '../../agents/delegation_service.js';
+import { personalAgentUnauthorized } from '../../agents/middleware.js';
+import { personalAgentsFor } from '../../agents/runtime.js';
+function noStore(ctx) {
+    ctx.response.header('Cache-Control', 'no-store');
+    ctx.response.header('Pragma', 'no-cache');
+}
+function oauthError(ctx, error) {
+    noStore(ctx);
+    return ctx.response
+        .status(error.status)
+        .json({ error: error.code, error_description: error.description });
+}
+/**
+ * Authorization server de delegação para personal agents (PACT §5.3): metadata
+ * RFC 8414, JWKS e os endpoints RFC 8628 que o AGENTE chama. O cliente OAuth é
+ * o agente, autenticado pelo JWT dele em `Authorization: Bearer` em toda
+ * chamada — `client_id` tem de ser o `iss` desse JWT.
+ */
+export default class AgentOAuthController {
+    async metadata(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        if (!runtime?.delegation)
+            return ctx.response.notFound();
+        ctx.response.header('Access-Control-Allow-Origin', '*');
+        return {
+            issuer: runtime.urls.issuer,
+            device_authorization_endpoint: runtime.urls.deviceAuthorization,
+            token_endpoint: runtime.urls.token,
+            jwks_uri: runtime.urls.jwks,
+            scopes_supported: Object.keys(runtime.delegation.scopes),
+            grant_types_supported: [DEVICE_CODE_GRANT_TYPE, REFRESH_TOKEN_GRANT_TYPE],
+            response_types_supported: [],
+            // Sem `token_endpoint_auth_methods_supported`: o agente se autentica com o
+            // JWT dele em `Authorization: Bearer` (PACT §5.3), método sem nome
+            // registrado — anunciar `private_key_jwt` levaria um cliente genérico a
+            // mandar `client_assertion` e tomar 401.
+        };
+    }
+    /** Chaves que assinam tokens de delegação e recibos — as mesmas do IdP. */
+    async jwks(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        if (!runtime?.delegation)
+            return ctx.response.notFound();
+        const service = await ctx.containerResolver.make('authkit.server');
+        ctx.response.header('Access-Control-Allow-Origin', '*');
+        ctx.response.header('Cache-Control', 'public, max-age=300');
+        return service.publicJwks;
+    }
+    async deviceAuthorization(ctx) {
+        const auth = await this.#authenticate(ctx);
+        if (!auth)
+            return;
+        try {
+            const body = await auth.runtime.delegation.requestDevice(auth.agent, ctx.request.input('scope'));
+            noStore(ctx);
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof AgentOAuthError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    async token(ctx) {
+        const auth = await this.#authenticate(ctx);
+        if (!auth)
+            return;
+        const delegation = auth.runtime.delegation;
+        try {
+            const grantType = ctx.request.input('grant_type');
+            const body = grantType === DEVICE_CODE_GRANT_TYPE
+                ? await delegation.exchangeDeviceCode(auth.agent, ctx.request.input('device_code'))
+                : grantType === REFRESH_TOKEN_GRANT_TYPE
+                    ? await delegation.refresh(auth.agent, ctx.request.input('refresh_token'))
+                    : null;
+            if (!body) {
+                throw new AgentOAuthError('unsupported_grant_type', 'Unsupported grant_type');
+            }
+            noStore(ctx);
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof AgentOAuthError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /**
+     * JWT do agente + `client_id` coerente. Já respondeu (401/404) quando
+     * devolve `null`.
+     */
+    async #authenticate(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        if (!runtime?.delegation) {
+            ctx.response.notFound();
+            return null;
+        }
+        const agent = await runtime.verifier.verify(ctx.request.header('authorization'));
+        if (!agent) {
+            personalAgentUnauthorized(ctx, runtime.config.protocol);
+            return null;
+        }
+        if (ctx.request.input('client_id') !== agent.issuer) {
+            oauthError(ctx, new AgentOAuthError('invalid_client', 'client_id must equal the personal-agent issuer', 401));
+            return null;
+        }
+        return { runtime, agent };
+    }
+}

package/build/src/host/controllers/interaction_controller.d.ts

@@ -1,7 +1,14 @@
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
+import { type CustomLoginIdentity } from '../custom_login.js';
 export default class AuthInteractionController {
     #private;
+    /** Shared completion for trusted host authentication; primary proof is the host's responsibility. */
+    completeCustomLogin(ctx: HttpContext, input: CustomLoginIdentity & {
+        method: string;
+        factorId?: string;
+        passwordless?: boolean;
+    }): Promise<unknown>;
     show(ctx: HttpContext): Promise<any>;
     /**
      * POST /auth/interaction/:uid/identifier
@@ -29,7 +36,12 @@ export default class AuthInteractionController {
      * 2º fator: lê o accountId pendente da sessão e aceita um código TOTP (`code`)
      * OU um recovery code (`recoveryCode`). Em caso de sucesso finaliza a interaction.
      */
-    mfaVerify(ctx: HttpContext): Promise<any>;
+    private renderMfaChallenge;
+    private configuredMfaGate;
+    customMfaBegin(ctx: HttpContext): Promise<unknown>;
+    customMfaVerify(ctx: HttpContext): Promise<unknown>;
+    private finishVerifiedMfa;
+    mfaVerify(ctx: HttpContext): Promise<unknown>;
     /**
      * true se o authorize request exige MFA via acr_values (contém o mfaAcr da
      * config de step-up). `acr_values` é a string separada por espaços padrão OIDC.