@adonis-agora/authkit-server 0.75.0 → 0.77.0

package/build/src/host/custom_login.d.ts

@@ -0,0 +1,36 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/** A verified identity, obtained from trusted host logic rather than request.accountId. */
+export interface CustomLoginIdentity {
+    accountId: string;
+    /** Host-validated remember-me choice, subject to the runtime session policy. */
+    remember?: boolean;
+}
+/** Host-defined primary authentication. AuthKit owns policies, MFA and session completion. */
+export interface CustomLoginMethod {
+    /** Credential group, used to prevent repeating it as an additional MFA factor. */
+    readonly factorId?: string;
+    /** Set true only for proofs that do not authenticate with the account password. */
+    readonly passwordless?: boolean;
+    /** Optional challenge initiation; response shape, validation and delivery are host-owned. */
+    begin?(ctx: HttpContext): Promise<unknown>;
+    /** Validate/consume the primary proof, bound to this interaction. Null denies login. */
+    authenticate(ctx: HttpContext): Promise<CustomLoginIdentity | null>;
+}
+/** Constructors are resolved through the request container, including @inject dependencies. */
+export type CustomLoginMethodConstructor = new (...args: never[]) => CustomLoginMethod;
+export type CustomLoginMethodBinding = CustomLoginMethodConstructor | CustomLoginMethod;
+export type CustomLoginMethods = Readonly<Record<string, CustomLoginMethodBinding>>;
+export declare function isCustomLoginMethodId(method: string): boolean;
+/** Start a registered method's optional challenge within a valid OIDC login interaction. */
+export declare function beginCustomLogin(ctx: HttpContext, method: string): Promise<unknown>;
+/** Verify using a registered class/instance, then pass through the shared login gates. */
+export declare function authenticateCustomLogin(ctx: HttpContext, method: string): Promise<unknown>;
+/**
+ * Trusted host escape hatch for arbitrary flows. Call ONLY after validating a primary proof.
+ * Never forward an account ID supplied by the browser. Prefer a registered CustomLoginMethod.
+ */
+export declare function completeCustomLogin(ctx: HttpContext, input: CustomLoginIdentity & {
+    method: string;
+    factorId?: string;
+    passwordless?: boolean;
+}): Promise<unknown>;

package/build/src/host/custom_login.js

@@ -0,0 +1,76 @@
+import { Exception } from '@adonisjs/core/exceptions';
+import AuthInteractionController from './controllers/interaction_controller.js';
+export function isCustomLoginMethodId(method) {
+    return (/^[a-z][a-z0-9:_-]{0,63}$/.test(method) &&
+        !['pwd', 'email', 'mfa', 'totp', 'webauthn', 'recovery'].includes(method));
+}
+function failure(message, code, status = 422) {
+    return new Exception(message, { code, status });
+}
+async function resolveMethod(ctx, method) {
+    if (!isCustomLoginMethodId(method))
+        throw failure('Invalid custom login method', 'E_CUSTOM_LOGIN_METHOD');
+    const service = await ctx.containerResolver.make('authkit.server');
+    const details = await service.interactions.details(ctx);
+    if (details.uid !== ctx.request.param('uid') || details.prompt.name !== 'login') {
+        throw failure('Invalid login interaction', 'E_CUSTOM_LOGIN_INTERACTION');
+    }
+    const registry = service.config.customLoginMethods;
+    if (!registry || !Object.hasOwn(registry, method)) {
+        throw failure('Unknown custom login method', 'E_CUSTOM_LOGIN_METHOD');
+    }
+    const binding = registry[method];
+    return typeof binding === 'function' ? ctx.containerResolver.make(binding) : binding;
+}
+/** Start a registered method's optional challenge within a valid OIDC login interaction. */
+export async function beginCustomLogin(ctx, method) {
+    const handler = await resolveMethod(ctx, method);
+    if (!handler.begin)
+        throw failure('This method has no challenge initiation', 'E_CUSTOM_LOGIN_BEGIN');
+    return handler.begin(ctx);
+}
+/** Verify using a registered class/instance, then pass through the shared login gates. */
+export async function authenticateCustomLogin(ctx, method) {
+    const handler = await resolveMethod(ctx, method);
+    let identity;
+    try {
+        identity = await handler.authenticate(ctx);
+    }
+    catch (error) {
+        await recordFailure(ctx, method, 'method_error');
+        throw error;
+    }
+    if (!identity || typeof identity.accountId !== 'string' || !identity.accountId.trim()) {
+        await recordFailure(ctx, method, 'invalid_proof');
+        throw failure('Authentication failed', 'E_CUSTOM_LOGIN_FAILED');
+    }
+    return completeCustomLogin(ctx, {
+        ...identity,
+        method,
+        factorId: handler.factorId,
+        passwordless: handler.passwordless === true,
+    });
+}
+/**
+ * Trusted host escape hatch for arbitrary flows. Call ONLY after validating a primary proof.
+ * Never forward an account ID supplied by the browser. Prefer a registered CustomLoginMethod.
+ */
+export function completeCustomLogin(ctx, input) {
+    return new AuthInteractionController().completeCustomLogin(ctx, input);
+}
+async function recordFailure(ctx, method, reason) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const details = await service.interactions.details(ctx);
+    try {
+        await service.config.audit?.record({
+            type: 'login.failure',
+            accountId: null,
+            ip: ctx.request.ip(),
+            clientId: details.params.client_id ?? null,
+            metadata: { method, reason },
+        });
+    }
+    catch {
+        ctx.logger.warn('AuthKit custom login failure audit could not be recorded');
+    }
+}

package/build/src/host/custom_login_completion.d.ts

@@ -0,0 +1,4 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { CompleteLoginExtra } from '../provider/interaction_actions.js';
+/** Shared by direct custom completion and its TOTP/passkey continuation. */
+export declare function completeCustomLoginSession(ctx: HttpContext, accountId: string, extra: CompleteLoginExtra, rememberRequested?: boolean): Promise<unknown>;

package/build/src/host/custom_login_completion.js

@@ -0,0 +1,33 @@
+import { AdminSessionsService } from './admin_sessions_service.js';
+import { resolveRuntimeSettingsOrNoop } from './runtime_settings.js';
+import { resolveEffectiveSessionPolicy } from './runtime_toggles.js';
+/** Shared by direct custom completion and its TOTP/passkey continuation. */
+export async function completeCustomLoginSession(ctx, accountId, extra, rememberRequested = false) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const settings = await resolveRuntimeSettingsOrNoop(ctx);
+    const policy = await resolveEffectiveSessionPolicy(settings, service.config.ttl?.session ? Math.ceil(service.config.ttl.session / 3600) : undefined);
+    const sessions = policy.singleSession ? new AdminSessionsService(service) : undefined;
+    const previous = sessions?.canList ? await sessions.listSessions(accountId) : [];
+    const details = sessions?.canList ? await service.interactions.details(ctx) : undefined;
+    const currentIdpSession = details?.session?.uid
+        ? await service.provider.Session.findByUid(details.session.uid)
+        : undefined;
+    const result = await service.interactions.completeLogin(ctx, accountId, {
+        ...extra,
+        remember: policy.rememberEnabled && rememberRequested,
+    });
+    const denied = result !== null && typeof result === 'object' && 'ok' in result && result.ok === false;
+    if (!denied && sessions?.canList && previous.length) {
+        const previousIds = new Set(previous.map((session) => session.id));
+        const current = await sessions.listSessions(accountId);
+        const created = current.find((session) => !previousIds.has(session.id));
+        const revoked = await sessions.revokeAllExcept(accountId, created?.id ?? currentIdpSession?.id ?? '__none__');
+        await service.config.audit?.record({
+            type: 'session.single_enforced',
+            accountId,
+            ip: ctx.request.ip(),
+            metadata: { revokedCount: revoked.sessions },
+        });
+    }
+    return result;
+}

package/build/src/host/custom_mfa.d.ts

@@ -0,0 +1,77 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { AuthAccount } from '../accounts/account_store.js';
+export interface CustomMfaContext {
+    ctx: HttpContext;
+    account: AuthAccount;
+    accountId: string;
+    uid: string;
+    primaryMethod: string;
+    challengeId: string;
+}
+export interface CustomMfaField {
+    name: string;
+    label: string;
+    type?: 'text' | 'password';
+    inputMode?: 'numeric' | 'text';
+    autoComplete?: string;
+}
+export interface CustomMfaDescription {
+    label: string;
+    fields?: CustomMfaField[];
+}
+/** A host-defined enrolled factor. Verify and consume its proof within this challenge. */
+export interface CustomMfaMethod {
+    /** Methods sharing the same credential/channel must share a factorId. */
+    readonly factorId?: string;
+    isEnabled(context: CustomMfaContext): Promise<boolean>;
+    describe(context: CustomMfaContext): Promise<CustomMfaDescription>;
+    begin?(context: CustomMfaContext): Promise<void>;
+    verify(context: CustomMfaContext): Promise<boolean>;
+}
+export type CustomMfaMethodConstructor = new (...args: never[]) => CustomMfaMethod;
+export type CustomMfaMethodBinding = CustomMfaMethod | CustomMfaMethodConstructor;
+export type CustomMfaMethods = Readonly<Record<string, CustomMfaMethodBinding>>;
+export interface RuntimeMfaFlow {
+    uid: string;
+    accountId: string;
+    primaryMethod: string;
+    primaryFactorId: string;
+    challengeId: string;
+    /** Total distinct factors, including the authenticated primary factor. */
+    requiredFactors: number;
+    remember?: boolean;
+    passwordless?: boolean;
+    completed: Array<{
+        method: string;
+        factorId: string;
+    }>;
+    startedMethods: string[];
+    createdAt: number;
+    attempts: number;
+}
+export interface CustomMfaDescriptor extends CustomMfaDescription {
+    id: string;
+    factorId: string;
+    requiresBegin: boolean;
+}
+export declare function isCustomMfaMethodId(method: string): boolean;
+export declare function initializeMfaFlow(ctx: HttpContext, input: Pick<RuntimeMfaFlow, 'uid' | 'accountId' | 'primaryMethod' | 'primaryFactorId' | 'requiredFactors' | 'remember' | 'passwordless'>): void;
+export declare function clearMfaFlow(ctx: HttpContext): void;
+export declare function getMfaFlow(ctx: HttpContext): RuntimeMfaFlow | null;
+export declare function resolveCustomMfaMethods(ctx: HttpContext, accountId: string, uid: string, primaryMethod: string, challengeId: string): Promise<CustomMfaDescriptor[]>;
+export declare function customMfaViewProps(ctx: HttpContext): Promise<{
+    customMfaMethods: Array<CustomMfaDescriptor & {
+        beginUrl: string;
+        verifyUrl: string;
+        started: boolean;
+    }>;
+    completedMfaMethods: string[];
+    requiredMfaFactors: number;
+}>;
+export declare function beginCustomMfa(ctx: HttpContext, method: string): Promise<void>;
+export declare function verifyCustomMfa(ctx: HttpContext, method: string): Promise<boolean>;
+/** Call only after a trusted verifier consumes a proof; this does not finish the login. */
+export declare function recordVerifiedMfaFactor(ctx: HttpContext, method: string, factorId?: string): {
+    complete: boolean;
+    amr: string[];
+};

package/build/src/host/custom_mfa.js

@@ -0,0 +1,268 @@
+import { randomUUID } from 'node:crypto';
+import { Exception } from '@adonisjs/core/exceptions';
+const FLOW_KEY = 'authkit_mfa_flow';
+const PENDING_KEY = 'authkit_mfa_pending';
+const FLOW_TTL = 10 * 60 * 1000;
+const MAX_ATTEMPTS = 5;
+const RESERVED = new Set(['totp', 'webauthn', 'recovery', 'pwd', 'email', 'mfa']);
+const isId = (value) => typeof value === 'string' && /^[a-z][a-z0-9:_-]{0,63}$/.test(value);
+export function isCustomMfaMethodId(method) {
+    return isId(method) && !RESERVED.has(method);
+}
+function failure(message) {
+    return new Exception(message, { code: 'E_CUSTOM_MFA', status: 422 });
+}
+export function initializeMfaFlow(ctx, input) {
+    if (!input.uid ||
+        !input.accountId ||
+        !isId(input.primaryMethod) ||
+        !isId(input.primaryFactorId) ||
+        !Number.isInteger(input.requiredFactors) ||
+        input.requiredFactors < 2 ||
+        input.requiredFactors > 8) {
+        throw failure('Invalid MFA flow');
+    }
+    ctx.session.put(FLOW_KEY, {
+        uid: input.uid,
+        accountId: input.accountId,
+        primaryMethod: input.primaryMethod,
+        primaryFactorId: input.primaryFactorId,
+        requiredFactors: input.requiredFactors,
+        passwordless: input.passwordless ?? input.primaryMethod !== 'pwd',
+        ...(input.remember !== undefined ? { remember: input.remember === true } : {}),
+        challengeId: randomUUID(),
+        completed: [],
+        startedMethods: [],
+        createdAt: Date.now(),
+        attempts: 0,
+    });
+}
+export function clearMfaFlow(ctx) {
+    ctx.session.forget(FLOW_KEY);
+}
+function invalidateMfaFlow(ctx) {
+    clearMfaFlow(ctx);
+    for (const key of [PENDING_KEY, 'authkit_mfa_primary', 'authkit_mfa_custom_primary'])
+        ctx.session.forget(key);
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object';
+}
+export function getMfaFlow(ctx) {
+    const flow = ctx.session.get(FLOW_KEY);
+    if (flow === undefined || flow === null)
+        return null;
+    const now = Date.now();
+    if (!isRecord(flow) ||
+        flow.uid !== ctx.request.param('uid') ||
+        typeof flow.accountId !== 'string' ||
+        !flow.accountId ||
+        flow.accountId !== ctx.session.get(PENDING_KEY) ||
+        !isId(flow.primaryMethod) ||
+        !isId(flow.primaryFactorId) ||
+        typeof flow.challengeId !== 'string' ||
+        !/^[a-f0-9-]{36}$/.test(flow.challengeId) ||
+        typeof flow.createdAt !== 'number' ||
+        !Number.isFinite(flow.createdAt) ||
+        flow.createdAt > now ||
+        now - flow.createdAt >= FLOW_TTL ||
+        typeof flow.requiredFactors !== 'number' ||
+        !Number.isInteger(flow.requiredFactors) ||
+        flow.requiredFactors < 2 ||
+        flow.requiredFactors > 8 ||
+        typeof flow.attempts !== 'number' ||
+        !Number.isInteger(flow.attempts) ||
+        flow.attempts < 0 ||
+        flow.attempts >= MAX_ATTEMPTS ||
+        (flow.remember !== undefined && typeof flow.remember !== 'boolean') ||
+        !Array.isArray(flow.startedMethods) ||
+        !flow.startedMethods.every((id) => isCustomMfaMethodId(id)) ||
+        !Array.isArray(flow.completed) ||
+        !flow.completed.every((entry) => isRecord(entry) &&
+            isId(entry.method) &&
+            isId(entry.factorId) &&
+            entry.factorId !== flow.primaryFactorId) ||
+        new Set(flow.completed.map((entry) => entry.factorId)).size !== flow.completed.length) {
+        invalidateMfaFlow(ctx);
+        return null;
+    }
+    return flow;
+}
+function requireFlow(ctx) {
+    const flow = getMfaFlow(ctx);
+    if (!flow)
+        throw failure('Missing or expired MFA flow');
+    return flow;
+}
+function requireCurrentFlow(ctx, previous) {
+    const current = requireFlow(ctx);
+    if (current.challengeId !== previous.challengeId)
+        throw failure('MFA challenge changed');
+    return current;
+}
+async function contextFor(ctx, accountId, uid, primaryMethod, challengeId) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const details = await service.interactions.details(ctx);
+    if (details.uid !== uid || uid !== ctx.request.param('uid') || details.prompt.name !== 'login') {
+        throw failure('Invalid MFA interaction');
+    }
+    const account = await service.config.accountStore.findById(accountId);
+    if (!account || account.id !== accountId)
+        throw failure('Invalid MFA account');
+    return { ctx, account, accountId, uid, primaryMethod, challengeId };
+}
+async function resolveHandler(ctx, id) {
+    if (!isCustomMfaMethodId(id))
+        throw failure('Invalid custom MFA method');
+    const service = await ctx.containerResolver.make('authkit.server');
+    const config = service.config;
+    const methods = config.mfa?.methods;
+    if (!methods || !Object.hasOwn(methods, id))
+        throw failure('Unknown custom MFA method');
+    const binding = methods[id];
+    const handler = typeof binding === 'function' ? await ctx.containerResolver.make(binding) : binding;
+    if (!handler ||
+        typeof handler.isEnabled !== 'function' ||
+        typeof handler.describe !== 'function' ||
+        typeof handler.verify !== 'function' ||
+        (handler.begin !== undefined && typeof handler.begin !== 'function') ||
+        (handler.factorId !== undefined && !isId(handler.factorId))) {
+        throw failure('Invalid custom MFA method');
+    }
+    return handler;
+}
+/** Only explicit public descriptor fields are passed to templates. */
+function descriptionProps(description) {
+    if (!description || typeof description.label !== 'string' || !description.label.trim()) {
+        throw failure('Invalid custom MFA method description');
+    }
+    if (description.fields !== undefined &&
+        (!Array.isArray(description.fields) || description.fields.length > 8)) {
+        throw failure('Invalid custom MFA method fields');
+    }
+    const fields = description.fields?.map((field) => {
+        if (!field ||
+            typeof field.name !== 'string' ||
+            !/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(field.name) ||
+            typeof field.label !== 'string' ||
+            (field.type !== undefined && !['text', 'password'].includes(field.type)) ||
+            (field.inputMode !== undefined && !['numeric', 'text'].includes(field.inputMode)) ||
+            (field.autoComplete !== undefined && typeof field.autoComplete !== 'string')) {
+            throw failure('Invalid custom MFA method fields');
+        }
+        return {
+            name: field.name,
+            label: field.label,
+            ...(field.type !== undefined ? { type: field.type } : {}),
+            ...(field.inputMode !== undefined ? { inputMode: field.inputMode } : {}),
+            ...(field.autoComplete !== undefined ? { autoComplete: field.autoComplete } : {}),
+        };
+    });
+    return { label: description.label, ...(fields ? { fields } : {}) };
+}
+export async function resolveCustomMfaMethods(ctx, accountId, uid, primaryMethod, challengeId) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const config = service.config;
+    const ids = Object.keys(config.mfa?.methods ?? {});
+    if (!ids.length)
+        return [];
+    const context = await contextFor(ctx, accountId, uid, primaryMethod, challengeId);
+    const descriptors = [];
+    for (const id of ids) {
+        const handler = await resolveHandler(ctx, id);
+        if (!(await handler.isEnabled(context)))
+            continue;
+        descriptors.push({
+            id,
+            factorId: handler.factorId ?? id,
+            requiresBegin: typeof handler.begin === 'function',
+            ...descriptionProps(await handler.describe(context)),
+        });
+    }
+    return descriptors;
+}
+export async function customMfaViewProps(ctx) {
+    const flow = requireFlow(ctx);
+    const descriptors = await resolveCustomMfaMethods(ctx, flow.accountId, flow.uid, flow.primaryMethod, flow.challengeId);
+    const used = new Set([flow.primaryFactorId, ...flow.completed.map((entry) => entry.factorId)]);
+    return {
+        customMfaMethods: descriptors
+            .filter((descriptor) => !used.has(descriptor.factorId))
+            .map((descriptor) => {
+            const base = `/auth/interaction/${encodeURIComponent(flow.uid)}/mfa/custom/${encodeURIComponent(descriptor.id)}`;
+            return {
+                ...descriptor,
+                beginUrl: `${base}/begin`,
+                verifyUrl: `${base}/verify`,
+                started: flow.startedMethods.includes(descriptor.id),
+            };
+        }),
+        completedMfaMethods: flow.completed.map((entry) => entry.method),
+        requiredMfaFactors: flow.requiredFactors,
+    };
+}
+async function activeHandler(ctx, method) {
+    const flow = requireFlow(ctx);
+    const context = await contextFor(ctx, flow.accountId, flow.uid, flow.primaryMethod, flow.challengeId);
+    const handler = await resolveHandler(ctx, method);
+    const factorId = handler.factorId ?? method;
+    if (factorId === flow.primaryFactorId ||
+        flow.completed.some((entry) => entry.factorId === factorId)) {
+        throw failure('MFA factor has already been authenticated');
+    }
+    if (!(await handler.isEnabled(context)))
+        throw failure('Custom MFA method is not enabled');
+    requireCurrentFlow(ctx, flow);
+    return { flow, context, handler };
+}
+export async function beginCustomMfa(ctx, method) {
+    const { flow, context, handler } = await activeHandler(ctx, method);
+    if (!handler.begin)
+        throw failure('Custom MFA method has no challenge initiation');
+    await handler.begin(context);
+    requireCurrentFlow(ctx, flow);
+    if (!flow.startedMethods.includes(method))
+        flow.startedMethods.push(method);
+    ctx.session.put(FLOW_KEY, flow);
+}
+export async function verifyCustomMfa(ctx, method) {
+    const { flow, context, handler } = await activeHandler(ctx, method);
+    if (handler.begin && !flow.startedMethods.includes(method))
+        throw failure('Custom MFA challenge has not started');
+    let verified;
+    try {
+        verified = (await handler.verify(context)) === true;
+    }
+    catch (error) {
+        requireCurrentFlow(ctx, flow);
+        failedProof(ctx, flow);
+        throw error;
+    }
+    requireCurrentFlow(ctx, flow);
+    if (!verified)
+        failedProof(ctx, flow);
+    return verified;
+}
+function failedProof(ctx, flow) {
+    flow.attempts++;
+    if (flow.attempts >= MAX_ATTEMPTS)
+        invalidateMfaFlow(ctx);
+    else
+        ctx.session.put(FLOW_KEY, flow);
+}
+/** Call only after a trusted verifier consumes a proof; this does not finish the login. */
+export function recordVerifiedMfaFactor(ctx, method, factorId = method) {
+    const flow = requireFlow(ctx);
+    if (!isId(method) ||
+        !isId(factorId) ||
+        factorId === flow.primaryFactorId ||
+        flow.completed.some((entry) => entry.factorId === factorId)) {
+        throw failure('MFA factor has already been authenticated or is invalid');
+    }
+    flow.completed.push({ method, factorId });
+    ctx.session.put(FLOW_KEY, flow);
+    return {
+        complete: 1 + flow.completed.length >= flow.requiredFactors,
+        amr: [flow.primaryMethod, ...flow.completed.map((entry) => entry.method)],
+    };
+}

package/build/src/host/i18n.d.ts

@@ -86,6 +86,8 @@ export declare const DEFAULT_MESSAGES: {
     'mfa_challenge.page_title': string;
     'mfa_challenge.title': string;
     'mfa_challenge.intro': string;
+    'mfa_challenge.start': string;
+    'mfa_challenge.progress': string;
     'mfa_challenge.code_label': string;
     'mfa_challenge.submit': string;
     'mfa_challenge.recovery_summary': string;
@@ -97,6 +99,11 @@ export declare const DEFAULT_MESSAGES: {
     'consent.title': string;
     'consent.body': string;
     'consent.submit': string;
+    'consent.scopes_title': string;
+    'consent.scope.profile': string;
+    'consent.scope.email': string;
+    'consent.scope.offline_access': string;
+    'consent.scope.roles': string;
     'account.login.page_title': string;
     'account.login.title': string;
     'account.login.intro': string;
@@ -175,6 +182,28 @@ export declare const DEFAULT_MESSAGES: {
     'account.apps.revoke': string;
     'account.apps.revoke_confirm': string;
     'account.apps.revoked': string;
+    'account.apps.agents_title': string;
+    'account.apps.agents_intro': string;
+    'account.apps.agents_empty': string;
+    'agents.consent.page_title': string;
+    'agents.consent.title': string;
+    'agents.consent.body': string;
+    'agents.consent.signed_in_as': string;
+    'agents.consent.scopes_label': string;
+    'agents.consent.code': string;
+    'agents.consent.allow': string;
+    'agents.consent.deny': string;
+    'agents.consent.enter_code_title': string;
+    'agents.consent.enter_code_body': string;
+    'agents.consent.continue': string;
+    'agents.consent.invalid_code': string;
+    'agents.consent.impersonating': string;
+    'agents.done.approved_title': string;
+    'agents.done.denied_title': string;
+    'agents.done.return': string;
+    'agents.done.revoke_hint': string;
+    'agents.done.expired_title': string;
+    'agents.done.expired_body': string;
     'account.apps.not_supported': string;
     'account.orgs.page_title': string;
     'account.orgs.title': string;
@@ -809,6 +838,8 @@ export declare const PT_BR_MESSAGES: {
     'mfa_challenge.page_title': string;
     'mfa_challenge.title': string;
     'mfa_challenge.intro': string;
+    'mfa_challenge.start': string;
+    'mfa_challenge.progress': string;
     'mfa_challenge.code_label': string;
     'mfa_challenge.submit': string;
     'mfa_challenge.recovery_summary': string;
@@ -820,6 +851,11 @@ export declare const PT_BR_MESSAGES: {
     'consent.title': string;
     'consent.body': string;
     'consent.submit': string;
+    'consent.scopes_title': string;
+    'consent.scope.profile': string;
+    'consent.scope.email': string;
+    'consent.scope.offline_access': string;
+    'consent.scope.roles': string;
     'account.login.page_title': string;
     'account.login.title': string;
     'account.login.intro': string;
@@ -898,6 +934,28 @@ export declare const PT_BR_MESSAGES: {
     'account.apps.revoke': string;
     'account.apps.revoke_confirm': string;
     'account.apps.revoked': string;
+    'account.apps.agents_title': string;
+    'account.apps.agents_intro': string;
+    'account.apps.agents_empty': string;
+    'agents.consent.page_title': string;
+    'agents.consent.title': string;
+    'agents.consent.body': string;
+    'agents.consent.signed_in_as': string;
+    'agents.consent.scopes_label': string;
+    'agents.consent.code': string;
+    'agents.consent.allow': string;
+    'agents.consent.deny': string;
+    'agents.consent.enter_code_title': string;
+    'agents.consent.enter_code_body': string;
+    'agents.consent.continue': string;
+    'agents.consent.invalid_code': string;
+    'agents.consent.impersonating': string;
+    'agents.done.approved_title': string;
+    'agents.done.denied_title': string;
+    'agents.done.return': string;
+    'agents.done.revoke_hint': string;
+    'agents.done.expired_title': string;
+    'agents.done.expired_body': string;
     'account.apps.not_supported': string;
     'account.orgs.page_title': string;
     'account.orgs.title': string;