@adonis-agora/authkit-server 0.76.0 → 0.78.0

package/build/src/host/controllers/poppy_consent_controller.js

@@ -0,0 +1,173 @@
+import '../augmentations.js';
+import { personalAgentsFor } from '../../agents/runtime.js';
+import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
+import { impersonationState } from '../impersonation_session.js';
+import { redirectExact } from '../redirect_exact.js';
+/** A tela nunca pode ser emoldurada (clickjacking — ver `agent_consent_controller.ts`). */
+function denyFraming(ctx) {
+    ctx.response.header('X-Frame-Options', 'DENY');
+    ctx.response.header('Content-Security-Policy', "frame-ancestors 'none'");
+}
+function chosenScopes(ctx) {
+    const raw = ctx.request.input('scope');
+    return (Array.isArray(raw) ? raw : raw ? [raw] : []).map(String);
+}
+/**
+ * Telas do usuário no Poppy: o consentimento do Direct Sign-In (o
+ * `authorization_endpoint`, §4.5) e a do Device Sign-In (o `verification_uri`,
+ * §4.6). Montadas atrás do `accountGuard`: sem sessão, o usuário passa pelo login
+ * DESTE app e volta. Abrir o link nunca aprova sozinho — a aprovação é um POST
+ * com CSRF. Recusadas durante impersonation.
+ */
+export default class PoppyConsentController {
+    /** GET {prefix}/oauth/authorize */
+    async authorize(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        const poppy = runtime?.poppy;
+        if (!poppy?.cfg.signIn.direct)
+            return ctx.response.notFound();
+        denyFraming(ctx);
+        const service = await ctx.containerResolver.make('authkit.server');
+        const render = service.config.render;
+        if (impersonationState(ctx).active) {
+            return render(ctx, 'agents/consent', {
+                csrfToken: ctx.request.csrfToken,
+                action: poppy.urls.authorization,
+                request: null,
+                account: null,
+                error: 'agents.consent.impersonating',
+            });
+        }
+        const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const outcome = await poppy.startAuthorization(ctx.request.qs(), accountId);
+        if (outcome.kind === 'redirect')
+            return redirectExact(ctx.response, outcome.url);
+        if (outcome.kind === 'error') {
+            ctx.response.status(400);
+            return render(ctx, 'agents/done', { status: 'invalid', agentName: null, scopes: [] });
+        }
+        const account = await service.config.accountStore.findById(accountId);
+        return render(ctx, 'agents/consent', {
+            csrfToken: ctx.request.csrfToken,
+            action: poppy.urls.authorization,
+            request: {
+                agentName: outcome.request.agentName,
+                agentOrigin: outcome.request.agentOrigin,
+                logoUri: outcome.request.logoUri,
+                scopes: outcome.request.scopes,
+                hidden: [{ name: 'request_id', value: outcome.request.id }],
+            },
+            account: { email: account?.email ?? null },
+            error: null,
+        });
+    }
+    /** POST {prefix}/oauth/authorize — `request_id`, `decision=allow|deny`, `scope[]`. */
+    async decideAuthorization(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        const poppy = runtime?.poppy;
+        if (!poppy?.cfg.signIn.direct)
+            return ctx.response.notFound();
+        denyFraming(ctx);
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const render = cfg.render;
+        if (impersonationState(ctx).active) {
+            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+        }
+        const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const decided = await poppy.decideAuthorization({
+            requestId: String(ctx.request.input('request_id') ?? ''),
+            accountId,
+            allow: ctx.request.input('decision') === 'allow',
+            scopes: chosenScopes(ctx),
+        });
+        if (!decided) {
+            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+        }
+        await cfg.audit?.record({
+            type: decided.approved ? 'agent.delegation_approved' : 'agent.delegation_denied',
+            accountId,
+            clientId: decided.clientId,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: { protocol: 'poppy', signIn: 'direct', scopes: decided.approved ?? [] },
+        });
+        return redirectExact(ctx.response, decided.url);
+    }
+    /** GET {prefix}/device?user_code=XXXX-XXXX */
+    async device(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        const poppy = runtime?.poppy;
+        if (!poppy?.cfg.signIn.device)
+            return ctx.response.notFound();
+        denyFraming(ctx);
+        const service = await ctx.containerResolver.make('authkit.server');
+        const render = service.config.render;
+        const base = {
+            csrfToken: ctx.request.csrfToken,
+            action: poppy.urls.device,
+            request: null,
+            account: null,
+            error: null,
+        };
+        if (impersonationState(ctx).active) {
+            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.impersonating' });
+        }
+        const input = ctx.request.input('user_code');
+        if (!input)
+            return render(ctx, 'agents/consent', base);
+        const pending = await poppy.pendingDevice(input);
+        if (!pending) {
+            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.invalid_code' });
+        }
+        const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const account = await service.config.accountStore.findById(accountId);
+        return render(ctx, 'agents/consent', {
+            ...base,
+            request: {
+                userCode: pending.userCode,
+                agentName: pending.agentName,
+                agentOrigin: pending.agentOrigin,
+                scopes: pending.scopes,
+            },
+            account: { email: account?.email ?? null },
+        });
+    }
+    /** POST {prefix}/device — `user_code`, `decision`, `scope[]`. */
+    async decideDevice(ctx) {
+        const runtime = await personalAgentsFor(ctx);
+        const poppy = runtime?.poppy;
+        if (!poppy?.cfg.signIn.device)
+            return ctx.response.notFound();
+        denyFraming(ctx);
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const render = cfg.render;
+        if (impersonationState(ctx).active) {
+            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+        }
+        const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
+        const userCode = String(ctx.request.input('user_code') ?? '');
+        const pending = await poppy.pendingDevice(userCode);
+        const decided = await poppy.decideDevice({
+            userCode,
+            accountId,
+            allow: ctx.request.input('decision') === 'allow',
+            scopes: chosenScopes(ctx),
+        });
+        if (!decided || !pending) {
+            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+        }
+        await cfg.audit?.record({
+            type: decided.approved ? 'agent.delegation_approved' : 'agent.delegation_denied',
+            accountId,
+            clientId: decided.clientId,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: { protocol: 'poppy', signIn: 'device', scopes: decided.approved ?? [] },
+        });
+        return render(ctx, 'agents/done', {
+            status: decided.approved ? 'approved' : 'denied',
+            agentName: pending.agentName,
+            scopes: decided.approved ? poppy.describe(decided.approved) : [],
+        });
+    }
+}

package/build/src/host/controllers/poppy_controller.d.ts

@@ -0,0 +1,25 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Endpoints server-to-server do Poppy (§3, §4): descoberta, metadata RFC 8414,
+ * token, revogação, device authorization, Mediated Sign-In e a sessão de
+ * navegador (§5). Todos isentos de CSRF — ver `authkitCsrfExceptions`.
+ */
+export default class PoppyController {
+    /** `GET /.well-known/poppy.json` — só no domínio da empresa (ignorando `www.`). */
+    discovery(ctx: HttpContext): Promise<void>;
+    /** `GET /.well-known/oauth-authorization-server{prefix}` (RFC 8414 + `poppy_domains`). */
+    metadata(ctx: HttpContext): Promise<void>;
+    token(ctx: HttpContext): Promise<void>;
+    deviceAuthorization(ctx: HttpContext): Promise<void>;
+    /** RFC 7009: 200 também para token desconhecido. */
+    revoke(ctx: HttpContext): Promise<void>;
+    /** `POST auth.mediated.endpoint` (§4.7) — com o Session Token (DPoP). */
+    mediatedStart(ctx: HttpContext): Promise<void>;
+    /** `POST {mediated}/{sign_in_id}` (§4.7). */
+    mediatedCode(ctx: HttpContext): Promise<void>;
+    /**
+     * `POST web.browser_session_endpoint` (§5): asserção no corpo → cookie do app
+     * para a Session e 303 para `return_to`; qualquer falha → 400, sem cookie.
+     */
+    browserSession(ctx: HttpContext): Promise<void>;
+}

package/build/src/host/controllers/poppy_controller.js

@@ -0,0 +1,194 @@
+import { PoppyError } from '../../agents/poppy/errors.js';
+import { publicRequestUrl, writePoppyAuthError } from '../../agents/poppy/resource.js';
+import { loginPoppyBrowser } from '../../agents/poppy/web_session.js';
+import { personalAgentsFor } from '../../agents/runtime.js';
+function noStore(ctx) {
+    ctx.response.header('Cache-Control', 'no-store');
+    ctx.response.header('Pragma', 'no-cache');
+}
+function withNonce(ctx, poppy) {
+    const nonce = poppy.nonce();
+    if (nonce)
+        ctx.response.header('DPoP-Nonce', nonce);
+}
+function oauthError(ctx, error) {
+    noStore(ctx);
+    for (const [k, v] of Object.entries(error.headers))
+        ctx.response.header(k, v);
+    if (error.code === 'invalid_dpop_proof' || error.code === 'use_dpop_nonce') {
+        ctx.response.header('WWW-Authenticate', `DPoP error="${error.code}"`);
+    }
+    return ctx.response.status(error.status).json(error.toJSON());
+}
+async function poppyOr404(ctx) {
+    const poppy = (await personalAgentsFor(ctx))?.poppy ?? null;
+    if (!poppy)
+        ctx.response.notFound();
+    return poppy;
+}
+/** Formulário (`application/x-www-form-urlencoded`) da request. */
+function form(ctx) {
+    return ctx.request.all();
+}
+/**
+ * Endpoints server-to-server do Poppy (§3, §4): descoberta, metadata RFC 8414,
+ * token, revogação, device authorization, Mediated Sign-In e a sessão de
+ * navegador (§5). Todos isentos de CSRF — ver `authkitCsrfExceptions`.
+ */
+export default class PoppyController {
+    /** `GET /.well-known/poppy.json` — só no domínio da empresa (ignorando `www.`). */
+    async discovery(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        // `host()` mantém a porta (dev em `localhost:3333`): o `browser_session_endpoint` sai dele.
+        const doc = poppy.discoveryDocument(ctx.request.host() ?? ctx.request.hostname() ?? '');
+        if (!doc)
+            return ctx.response.notFound();
+        ctx.response.header('Access-Control-Allow-Origin', '*');
+        ctx.response.header('Cache-Control', 'public, max-age=300');
+        return ctx.response.json(doc);
+    }
+    /** `GET /.well-known/oauth-authorization-server{prefix}` (RFC 8414 + `poppy_domains`). */
+    async metadata(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        ctx.response.header('Access-Control-Allow-Origin', '*');
+        ctx.response.header('Cache-Control', 'public, max-age=300');
+        return ctx.response.json(poppy.authorizationServerMetadata());
+    }
+    async token(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        withNonce(ctx, poppy);
+        try {
+            const body = await poppy.token(form(ctx), ctx.request.header('dpop'));
+            noStore(ctx);
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    async deviceAuthorization(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        try {
+            const body = await poppy.deviceAuthorization(form(ctx));
+            noStore(ctx);
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /** RFC 7009: 200 também para token desconhecido. */
+    async revoke(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        try {
+            await poppy.revoke(form(ctx));
+            noStore(ctx);
+            return ctx.response.status(200).send('');
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /** `POST auth.mediated.endpoint` (§4.7) — com o Session Token (DPoP). */
+    async mediatedStart(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy?.cfg.signIn.mediated)
+            return poppy ? ctx.response.notFound() : undefined;
+        const auth = await poppy.verifyAccess({
+            method: ctx.request.method(),
+            url: publicRequestUrl(ctx, poppy),
+            headers: ctx.request.headers(),
+        });
+        if (!auth.ok) {
+            const { ok: _ok, ...rest } = auth;
+            return writePoppyAuthError(ctx, { ok: false, ...rest });
+        }
+        try {
+            const body = await poppy.mediatedStart(auth.principal, auth.jkt, ctx.request.body(), ctx);
+            noStore(ctx);
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /** `POST {mediated}/{sign_in_id}` (§4.7). */
+    async mediatedCode(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy?.cfg.signIn.mediated)
+            return poppy ? ctx.response.notFound() : undefined;
+        const auth = await poppy.verifyAccess({
+            method: ctx.request.method(),
+            url: publicRequestUrl(ctx, poppy),
+            headers: ctx.request.headers(),
+        });
+        if (!auth.ok) {
+            const { ok: _ok, ...rest } = auth;
+            return writePoppyAuthError(ctx, { ok: false, ...rest });
+        }
+        try {
+            const body = await poppy.mediatedCode(auth.principal, auth.jkt, String(ctx.request.param('id') ?? ''), ctx.request.body());
+            noStore(ctx);
+            if (!body) {
+                return ctx.response
+                    .status(404)
+                    .json({ error: 'invalid_request', error_description: 'Unknown sign_in_id' });
+            }
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /**
+     * `POST web.browser_session_endpoint` (§5): asserção no corpo → cookie do app
+     * para a Session e 303 para `return_to`; qualquer falha → 400, sem cookie.
+     */
+    async browserSession(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy?.cfg.web?.browserSession)
+            return poppy ? ctx.response.notFound() : undefined;
+        noStore(ctx);
+        // A asserção vai NO CORPO, nunca na URL (§5).
+        if (ctx.request.qs().assertion !== undefined)
+            return badBrowserRequest(ctx);
+        let result;
+        try {
+            result = await poppy.verifyBrowserAssertion(ctx.request.input('assertion'), new URL(publicRequestUrl(ctx, poppy)).origin);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return badBrowserRequest(ctx);
+            throw error;
+        }
+        await loginPoppyBrowser(ctx, result);
+        ctx.response.header('Location', result.returnTo);
+        return ctx.response.status(303).send('');
+    }
+}
+function badBrowserRequest(ctx) {
+    ctx.response.header('Content-Type', 'text/html; charset=utf-8');
+    return ctx.response
+        .status(400)
+        .send('<!doctype html><html><head><meta charset="utf-8"><title>Bad request</title></head><body><h1>Invalid browser session request</h1></body></html>');
+}

package/build/src/host/csrf.d.ts

@@ -10,6 +10,13 @@ export interface AuthkitCsrfOptions {
      * consentimento (`{prefix}/consent`) continua protegida.
      */
     personalAgentsPrefix?: string | false;
+    /**
+     * Prefixo do Poppy: isenta token/revoke/device authorization, o Mediated
+     * Sign-In e a sessão de navegador (POST cross-site autenticado pela asserção).
+     * Default: o do config. As telas `{prefix}/oauth/authorize` e `{prefix}/device`
+     * continuam protegidas. `false` desliga.
+     */
+    poppyPrefix?: string | false;
 }
 /**
  * Retorna `true` quando `url` é uma rota AuthKit que deve ser ISENTA de CSRF

package/build/src/host/csrf.js

@@ -16,6 +16,7 @@
  * ```
  */
 import { normalizePersonalAgentsPrefix } from '../agents/config.js';
+import { normalizePoppyPrefix } from '../agents/poppy/config.js';
 import { getAuthHostConfig } from './auth_host_config.js';
 /**
  * Retorna `true` quando `url` é uma rota AuthKit que deve ser ISENTA de CSRF
@@ -33,8 +34,22 @@ export function authkitCsrfExceptions(url, options = {}) {
             ? normalizePersonalAgentsPrefix(options.personalAgentsPrefix)
             : getAuthHostConfig()?.personalAgents?.prefix;
     const agentsOAuth = agentsPrefix ? `${agentsPrefix}/oauth/` : null;
+    const poppyPrefix = options.poppyPrefix === false
+        ? undefined
+        : options.poppyPrefix !== undefined
+            ? normalizePoppyPrefix(options.poppyPrefix)
+            : getAuthHostConfig()?.personalAgents?.poppyPrefix;
+    const path = url.split('?')[0];
+    const poppyExempt = !!poppyPrefix &&
+        (path === `${poppyPrefix}/oauth/token` ||
+            path === `${poppyPrefix}/oauth/revoke` ||
+            path === `${poppyPrefix}/oauth/device` ||
+            path === `${poppyPrefix}/sign-in` ||
+            path.startsWith(`${poppyPrefix}/sign-in/`) ||
+            path === `${poppyPrefix}/browser-session`);
     return (url.includes(mountPath) ||
         url.includes('/authkit/pat') ||
         (backchannel !== null && url === backchannel) ||
-        (agentsOAuth !== null && url.startsWith(agentsOAuth)));
+        (agentsOAuth !== null && url.startsWith(agentsOAuth)) ||
+        poppyExempt);
 }

package/build/src/host/custom_login.d.ts

@@ -0,0 +1,36 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/** A verified identity, obtained from trusted host logic rather than request.accountId. */
+export interface CustomLoginIdentity {
+    accountId: string;
+    /** Host-validated remember-me choice, subject to the runtime session policy. */
+    remember?: boolean;
+}
+/** Host-defined primary authentication. AuthKit owns policies, MFA and session completion. */
+export interface CustomLoginMethod {
+    /** Credential group, used to prevent repeating it as an additional MFA factor. */
+    readonly factorId?: string;
+    /** Set true only for proofs that do not authenticate with the account password. */
+    readonly passwordless?: boolean;
+    /** Optional challenge initiation; response shape, validation and delivery are host-owned. */
+    begin?(ctx: HttpContext): Promise<unknown>;
+    /** Validate/consume the primary proof, bound to this interaction. Null denies login. */
+    authenticate(ctx: HttpContext): Promise<CustomLoginIdentity | null>;
+}
+/** Constructors are resolved through the request container, including @inject dependencies. */
+export type CustomLoginMethodConstructor = new (...args: never[]) => CustomLoginMethod;
+export type CustomLoginMethodBinding = CustomLoginMethodConstructor | CustomLoginMethod;
+export type CustomLoginMethods = Readonly<Record<string, CustomLoginMethodBinding>>;
+export declare function isCustomLoginMethodId(method: string): boolean;
+/** Start a registered method's optional challenge within a valid OIDC login interaction. */
+export declare function beginCustomLogin(ctx: HttpContext, method: string): Promise<unknown>;
+/** Verify using a registered class/instance, then pass through the shared login gates. */
+export declare function authenticateCustomLogin(ctx: HttpContext, method: string): Promise<unknown>;
+/**
+ * Trusted host escape hatch for arbitrary flows. Call ONLY after validating a primary proof.
+ * Never forward an account ID supplied by the browser. Prefer a registered CustomLoginMethod.
+ */
+export declare function completeCustomLogin(ctx: HttpContext, input: CustomLoginIdentity & {
+    method: string;
+    factorId?: string;
+    passwordless?: boolean;
+}): Promise<unknown>;

package/build/src/host/custom_login.js

@@ -0,0 +1,76 @@
+import { Exception } from '@adonisjs/core/exceptions';
+import AuthInteractionController from './controllers/interaction_controller.js';
+export function isCustomLoginMethodId(method) {
+    return (/^[a-z][a-z0-9:_-]{0,63}$/.test(method) &&
+        !['pwd', 'email', 'mfa', 'totp', 'webauthn', 'recovery'].includes(method));
+}
+function failure(message, code, status = 422) {
+    return new Exception(message, { code, status });
+}
+async function resolveMethod(ctx, method) {
+    if (!isCustomLoginMethodId(method))
+        throw failure('Invalid custom login method', 'E_CUSTOM_LOGIN_METHOD');
+    const service = await ctx.containerResolver.make('authkit.server');
+    const details = await service.interactions.details(ctx);
+    if (details.uid !== ctx.request.param('uid') || details.prompt.name !== 'login') {
+        throw failure('Invalid login interaction', 'E_CUSTOM_LOGIN_INTERACTION');
+    }
+    const registry = service.config.customLoginMethods;
+    if (!registry || !Object.hasOwn(registry, method)) {
+        throw failure('Unknown custom login method', 'E_CUSTOM_LOGIN_METHOD');
+    }
+    const binding = registry[method];
+    return typeof binding === 'function' ? ctx.containerResolver.make(binding) : binding;
+}
+/** Start a registered method's optional challenge within a valid OIDC login interaction. */
+export async function beginCustomLogin(ctx, method) {
+    const handler = await resolveMethod(ctx, method);
+    if (!handler.begin)
+        throw failure('This method has no challenge initiation', 'E_CUSTOM_LOGIN_BEGIN');
+    return handler.begin(ctx);
+}
+/** Verify using a registered class/instance, then pass through the shared login gates. */
+export async function authenticateCustomLogin(ctx, method) {
+    const handler = await resolveMethod(ctx, method);
+    let identity;
+    try {
+        identity = await handler.authenticate(ctx);
+    }
+    catch (error) {
+        await recordFailure(ctx, method, 'method_error');
+        throw error;
+    }
+    if (!identity || typeof identity.accountId !== 'string' || !identity.accountId.trim()) {
+        await recordFailure(ctx, method, 'invalid_proof');
+        throw failure('Authentication failed', 'E_CUSTOM_LOGIN_FAILED');
+    }
+    return completeCustomLogin(ctx, {
+        ...identity,
+        method,
+        factorId: handler.factorId,
+        passwordless: handler.passwordless === true,
+    });
+}
+/**
+ * Trusted host escape hatch for arbitrary flows. Call ONLY after validating a primary proof.
+ * Never forward an account ID supplied by the browser. Prefer a registered CustomLoginMethod.
+ */
+export function completeCustomLogin(ctx, input) {
+    return new AuthInteractionController().completeCustomLogin(ctx, input);
+}
+async function recordFailure(ctx, method, reason) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const details = await service.interactions.details(ctx);
+    try {
+        await service.config.audit?.record({
+            type: 'login.failure',
+            accountId: null,
+            ip: ctx.request.ip(),
+            clientId: details.params.client_id ?? null,
+            metadata: { method, reason },
+        });
+    }
+    catch {
+        ctx.logger.warn('AuthKit custom login failure audit could not be recorded');
+    }
+}

package/build/src/host/custom_login_completion.d.ts

@@ -0,0 +1,4 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { CompleteLoginExtra } from '../provider/interaction_actions.js';
+/** Shared by direct custom completion and its TOTP/passkey continuation. */
+export declare function completeCustomLoginSession(ctx: HttpContext, accountId: string, extra: CompleteLoginExtra, rememberRequested?: boolean): Promise<unknown>;

package/build/src/host/custom_login_completion.js

@@ -0,0 +1,33 @@
+import { AdminSessionsService } from './admin_sessions_service.js';
+import { resolveRuntimeSettingsOrNoop } from './runtime_settings.js';
+import { resolveEffectiveSessionPolicy } from './runtime_toggles.js';
+/** Shared by direct custom completion and its TOTP/passkey continuation. */
+export async function completeCustomLoginSession(ctx, accountId, extra, rememberRequested = false) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const settings = await resolveRuntimeSettingsOrNoop(ctx);
+    const policy = await resolveEffectiveSessionPolicy(settings, service.config.ttl?.session ? Math.ceil(service.config.ttl.session / 3600) : undefined);
+    const sessions = policy.singleSession ? new AdminSessionsService(service) : undefined;
+    const previous = sessions?.canList ? await sessions.listSessions(accountId) : [];
+    const details = sessions?.canList ? await service.interactions.details(ctx) : undefined;
+    const currentIdpSession = details?.session?.uid
+        ? await service.provider.Session.findByUid(details.session.uid)
+        : undefined;
+    const result = await service.interactions.completeLogin(ctx, accountId, {
+        ...extra,
+        remember: policy.rememberEnabled && rememberRequested,
+    });
+    const denied = result !== null && typeof result === 'object' && 'ok' in result && result.ok === false;
+    if (!denied && sessions?.canList && previous.length) {
+        const previousIds = new Set(previous.map((session) => session.id));
+        const current = await sessions.listSessions(accountId);
+        const created = current.find((session) => !previousIds.has(session.id));
+        const revoked = await sessions.revokeAllExcept(accountId, created?.id ?? currentIdpSession?.id ?? '__none__');
+        await service.config.audit?.record({
+            type: 'session.single_enforced',
+            accountId,
+            ip: ctx.request.ip(),
+            metadata: { revokedCount: revoked.sessions },
+        });
+    }
+    return result;
+}

package/build/src/host/custom_mfa.d.ts

@@ -0,0 +1,77 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import type { AuthAccount } from '../accounts/account_store.js';
+export interface CustomMfaContext {
+    ctx: HttpContext;
+    account: AuthAccount;
+    accountId: string;
+    uid: string;
+    primaryMethod: string;
+    challengeId: string;
+}
+export interface CustomMfaField {
+    name: string;
+    label: string;
+    type?: 'text' | 'password';
+    inputMode?: 'numeric' | 'text';
+    autoComplete?: string;
+}
+export interface CustomMfaDescription {
+    label: string;
+    fields?: CustomMfaField[];
+}
+/** A host-defined enrolled factor. Verify and consume its proof within this challenge. */
+export interface CustomMfaMethod {
+    /** Methods sharing the same credential/channel must share a factorId. */
+    readonly factorId?: string;
+    isEnabled(context: CustomMfaContext): Promise<boolean>;
+    describe(context: CustomMfaContext): Promise<CustomMfaDescription>;
+    begin?(context: CustomMfaContext): Promise<void>;
+    verify(context: CustomMfaContext): Promise<boolean>;
+}
+export type CustomMfaMethodConstructor = new (...args: never[]) => CustomMfaMethod;
+export type CustomMfaMethodBinding = CustomMfaMethod | CustomMfaMethodConstructor;
+export type CustomMfaMethods = Readonly<Record<string, CustomMfaMethodBinding>>;
+export interface RuntimeMfaFlow {
+    uid: string;
+    accountId: string;
+    primaryMethod: string;
+    primaryFactorId: string;
+    challengeId: string;
+    /** Total distinct factors, including the authenticated primary factor. */
+    requiredFactors: number;
+    remember?: boolean;
+    passwordless?: boolean;
+    completed: Array<{
+        method: string;
+        factorId: string;
+    }>;
+    startedMethods: string[];
+    createdAt: number;
+    attempts: number;
+}
+export interface CustomMfaDescriptor extends CustomMfaDescription {
+    id: string;
+    factorId: string;
+    requiresBegin: boolean;
+}
+export declare function isCustomMfaMethodId(method: string): boolean;
+export declare function initializeMfaFlow(ctx: HttpContext, input: Pick<RuntimeMfaFlow, 'uid' | 'accountId' | 'primaryMethod' | 'primaryFactorId' | 'requiredFactors' | 'remember' | 'passwordless'>): void;
+export declare function clearMfaFlow(ctx: HttpContext): void;
+export declare function getMfaFlow(ctx: HttpContext): RuntimeMfaFlow | null;
+export declare function resolveCustomMfaMethods(ctx: HttpContext, accountId: string, uid: string, primaryMethod: string, challengeId: string): Promise<CustomMfaDescriptor[]>;
+export declare function customMfaViewProps(ctx: HttpContext): Promise<{
+    customMfaMethods: Array<CustomMfaDescriptor & {
+        beginUrl: string;
+        verifyUrl: string;
+        started: boolean;
+    }>;
+    completedMfaMethods: string[];
+    requiredMfaFactors: number;
+}>;
+export declare function beginCustomMfa(ctx: HttpContext, method: string): Promise<void>;
+export declare function verifyCustomMfa(ctx: HttpContext, method: string): Promise<boolean>;
+/** Call only after a trusted verifier consumes a proof; this does not finish the login. */
+export declare function recordVerifiedMfaFactor(ctx: HttpContext, method: string, factorId?: string): {
+    complete: boolean;
+    amr: string[];
+};