@adonis-agora/authkit-server 0.76.0 → 0.78.0

package/build/src/host/custom_mfa.js

@@ -0,0 +1,268 @@
+import { randomUUID } from 'node:crypto';
+import { Exception } from '@adonisjs/core/exceptions';
+const FLOW_KEY = 'authkit_mfa_flow';
+const PENDING_KEY = 'authkit_mfa_pending';
+const FLOW_TTL = 10 * 60 * 1000;
+const MAX_ATTEMPTS = 5;
+const RESERVED = new Set(['totp', 'webauthn', 'recovery', 'pwd', 'email', 'mfa']);
+const isId = (value) => typeof value === 'string' && /^[a-z][a-z0-9:_-]{0,63}$/.test(value);
+export function isCustomMfaMethodId(method) {
+    return isId(method) && !RESERVED.has(method);
+}
+function failure(message) {
+    return new Exception(message, { code: 'E_CUSTOM_MFA', status: 422 });
+}
+export function initializeMfaFlow(ctx, input) {
+    if (!input.uid ||
+        !input.accountId ||
+        !isId(input.primaryMethod) ||
+        !isId(input.primaryFactorId) ||
+        !Number.isInteger(input.requiredFactors) ||
+        input.requiredFactors < 2 ||
+        input.requiredFactors > 8) {
+        throw failure('Invalid MFA flow');
+    }
+    ctx.session.put(FLOW_KEY, {
+        uid: input.uid,
+        accountId: input.accountId,
+        primaryMethod: input.primaryMethod,
+        primaryFactorId: input.primaryFactorId,
+        requiredFactors: input.requiredFactors,
+        passwordless: input.passwordless ?? input.primaryMethod !== 'pwd',
+        ...(input.remember !== undefined ? { remember: input.remember === true } : {}),
+        challengeId: randomUUID(),
+        completed: [],
+        startedMethods: [],
+        createdAt: Date.now(),
+        attempts: 0,
+    });
+}
+export function clearMfaFlow(ctx) {
+    ctx.session.forget(FLOW_KEY);
+}
+function invalidateMfaFlow(ctx) {
+    clearMfaFlow(ctx);
+    for (const key of [PENDING_KEY, 'authkit_mfa_primary', 'authkit_mfa_custom_primary'])
+        ctx.session.forget(key);
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object';
+}
+export function getMfaFlow(ctx) {
+    const flow = ctx.session.get(FLOW_KEY);
+    if (flow === undefined || flow === null)
+        return null;
+    const now = Date.now();
+    if (!isRecord(flow) ||
+        flow.uid !== ctx.request.param('uid') ||
+        typeof flow.accountId !== 'string' ||
+        !flow.accountId ||
+        flow.accountId !== ctx.session.get(PENDING_KEY) ||
+        !isId(flow.primaryMethod) ||
+        !isId(flow.primaryFactorId) ||
+        typeof flow.challengeId !== 'string' ||
+        !/^[a-f0-9-]{36}$/.test(flow.challengeId) ||
+        typeof flow.createdAt !== 'number' ||
+        !Number.isFinite(flow.createdAt) ||
+        flow.createdAt > now ||
+        now - flow.createdAt >= FLOW_TTL ||
+        typeof flow.requiredFactors !== 'number' ||
+        !Number.isInteger(flow.requiredFactors) ||
+        flow.requiredFactors < 2 ||
+        flow.requiredFactors > 8 ||
+        typeof flow.attempts !== 'number' ||
+        !Number.isInteger(flow.attempts) ||
+        flow.attempts < 0 ||
+        flow.attempts >= MAX_ATTEMPTS ||
+        (flow.remember !== undefined && typeof flow.remember !== 'boolean') ||
+        !Array.isArray(flow.startedMethods) ||
+        !flow.startedMethods.every((id) => isCustomMfaMethodId(id)) ||
+        !Array.isArray(flow.completed) ||
+        !flow.completed.every((entry) => isRecord(entry) &&
+            isId(entry.method) &&
+            isId(entry.factorId) &&
+            entry.factorId !== flow.primaryFactorId) ||
+        new Set(flow.completed.map((entry) => entry.factorId)).size !== flow.completed.length) {
+        invalidateMfaFlow(ctx);
+        return null;
+    }
+    return flow;
+}
+function requireFlow(ctx) {
+    const flow = getMfaFlow(ctx);
+    if (!flow)
+        throw failure('Missing or expired MFA flow');
+    return flow;
+}
+function requireCurrentFlow(ctx, previous) {
+    const current = requireFlow(ctx);
+    if (current.challengeId !== previous.challengeId)
+        throw failure('MFA challenge changed');
+    return current;
+}
+async function contextFor(ctx, accountId, uid, primaryMethod, challengeId) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const details = await service.interactions.details(ctx);
+    if (details.uid !== uid || uid !== ctx.request.param('uid') || details.prompt.name !== 'login') {
+        throw failure('Invalid MFA interaction');
+    }
+    const account = await service.config.accountStore.findById(accountId);
+    if (!account || account.id !== accountId)
+        throw failure('Invalid MFA account');
+    return { ctx, account, accountId, uid, primaryMethod, challengeId };
+}
+async function resolveHandler(ctx, id) {
+    if (!isCustomMfaMethodId(id))
+        throw failure('Invalid custom MFA method');
+    const service = await ctx.containerResolver.make('authkit.server');
+    const config = service.config;
+    const methods = config.mfa?.methods;
+    if (!methods || !Object.hasOwn(methods, id))
+        throw failure('Unknown custom MFA method');
+    const binding = methods[id];
+    const handler = typeof binding === 'function' ? await ctx.containerResolver.make(binding) : binding;
+    if (!handler ||
+        typeof handler.isEnabled !== 'function' ||
+        typeof handler.describe !== 'function' ||
+        typeof handler.verify !== 'function' ||
+        (handler.begin !== undefined && typeof handler.begin !== 'function') ||
+        (handler.factorId !== undefined && !isId(handler.factorId))) {
+        throw failure('Invalid custom MFA method');
+    }
+    return handler;
+}
+/** Only explicit public descriptor fields are passed to templates. */
+function descriptionProps(description) {
+    if (!description || typeof description.label !== 'string' || !description.label.trim()) {
+        throw failure('Invalid custom MFA method description');
+    }
+    if (description.fields !== undefined &&
+        (!Array.isArray(description.fields) || description.fields.length > 8)) {
+        throw failure('Invalid custom MFA method fields');
+    }
+    const fields = description.fields?.map((field) => {
+        if (!field ||
+            typeof field.name !== 'string' ||
+            !/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(field.name) ||
+            typeof field.label !== 'string' ||
+            (field.type !== undefined && !['text', 'password'].includes(field.type)) ||
+            (field.inputMode !== undefined && !['numeric', 'text'].includes(field.inputMode)) ||
+            (field.autoComplete !== undefined && typeof field.autoComplete !== 'string')) {
+            throw failure('Invalid custom MFA method fields');
+        }
+        return {
+            name: field.name,
+            label: field.label,
+            ...(field.type !== undefined ? { type: field.type } : {}),
+            ...(field.inputMode !== undefined ? { inputMode: field.inputMode } : {}),
+            ...(field.autoComplete !== undefined ? { autoComplete: field.autoComplete } : {}),
+        };
+    });
+    return { label: description.label, ...(fields ? { fields } : {}) };
+}
+export async function resolveCustomMfaMethods(ctx, accountId, uid, primaryMethod, challengeId) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const config = service.config;
+    const ids = Object.keys(config.mfa?.methods ?? {});
+    if (!ids.length)
+        return [];
+    const context = await contextFor(ctx, accountId, uid, primaryMethod, challengeId);
+    const descriptors = [];
+    for (const id of ids) {
+        const handler = await resolveHandler(ctx, id);
+        if (!(await handler.isEnabled(context)))
+            continue;
+        descriptors.push({
+            id,
+            factorId: handler.factorId ?? id,
+            requiresBegin: typeof handler.begin === 'function',
+            ...descriptionProps(await handler.describe(context)),
+        });
+    }
+    return descriptors;
+}
+export async function customMfaViewProps(ctx) {
+    const flow = requireFlow(ctx);
+    const descriptors = await resolveCustomMfaMethods(ctx, flow.accountId, flow.uid, flow.primaryMethod, flow.challengeId);
+    const used = new Set([flow.primaryFactorId, ...flow.completed.map((entry) => entry.factorId)]);
+    return {
+        customMfaMethods: descriptors
+            .filter((descriptor) => !used.has(descriptor.factorId))
+            .map((descriptor) => {
+            const base = `/auth/interaction/${encodeURIComponent(flow.uid)}/mfa/custom/${encodeURIComponent(descriptor.id)}`;
+            return {
+                ...descriptor,
+                beginUrl: `${base}/begin`,
+                verifyUrl: `${base}/verify`,
+                started: flow.startedMethods.includes(descriptor.id),
+            };
+        }),
+        completedMfaMethods: flow.completed.map((entry) => entry.method),
+        requiredMfaFactors: flow.requiredFactors,
+    };
+}
+async function activeHandler(ctx, method) {
+    const flow = requireFlow(ctx);
+    const context = await contextFor(ctx, flow.accountId, flow.uid, flow.primaryMethod, flow.challengeId);
+    const handler = await resolveHandler(ctx, method);
+    const factorId = handler.factorId ?? method;
+    if (factorId === flow.primaryFactorId ||
+        flow.completed.some((entry) => entry.factorId === factorId)) {
+        throw failure('MFA factor has already been authenticated');
+    }
+    if (!(await handler.isEnabled(context)))
+        throw failure('Custom MFA method is not enabled');
+    requireCurrentFlow(ctx, flow);
+    return { flow, context, handler };
+}
+export async function beginCustomMfa(ctx, method) {
+    const { flow, context, handler } = await activeHandler(ctx, method);
+    if (!handler.begin)
+        throw failure('Custom MFA method has no challenge initiation');
+    await handler.begin(context);
+    requireCurrentFlow(ctx, flow);
+    if (!flow.startedMethods.includes(method))
+        flow.startedMethods.push(method);
+    ctx.session.put(FLOW_KEY, flow);
+}
+export async function verifyCustomMfa(ctx, method) {
+    const { flow, context, handler } = await activeHandler(ctx, method);
+    if (handler.begin && !flow.startedMethods.includes(method))
+        throw failure('Custom MFA challenge has not started');
+    let verified;
+    try {
+        verified = (await handler.verify(context)) === true;
+    }
+    catch (error) {
+        requireCurrentFlow(ctx, flow);
+        failedProof(ctx, flow);
+        throw error;
+    }
+    requireCurrentFlow(ctx, flow);
+    if (!verified)
+        failedProof(ctx, flow);
+    return verified;
+}
+function failedProof(ctx, flow) {
+    flow.attempts++;
+    if (flow.attempts >= MAX_ATTEMPTS)
+        invalidateMfaFlow(ctx);
+    else
+        ctx.session.put(FLOW_KEY, flow);
+}
+/** Call only after a trusted verifier consumes a proof; this does not finish the login. */
+export function recordVerifiedMfaFactor(ctx, method, factorId = method) {
+    const flow = requireFlow(ctx);
+    if (!isId(method) ||
+        !isId(factorId) ||
+        factorId === flow.primaryFactorId ||
+        flow.completed.some((entry) => entry.factorId === factorId)) {
+        throw failure('MFA factor has already been authenticated or is invalid');
+    }
+    flow.completed.push({ method, factorId });
+    ctx.session.put(FLOW_KEY, flow);
+    return {
+        complete: 1 + flow.completed.length >= flow.requiredFactors,
+        amr: [flow.primaryMethod, ...flow.completed.map((entry) => entry.method)],
+    };
+}

package/build/src/host/i18n.d.ts

@@ -86,6 +86,8 @@ export declare const DEFAULT_MESSAGES: {
     'mfa_challenge.page_title': string;
     'mfa_challenge.title': string;
     'mfa_challenge.intro': string;
+    'mfa_challenge.start': string;
+    'mfa_challenge.progress': string;
     'mfa_challenge.code_label': string;
     'mfa_challenge.submit': string;
     'mfa_challenge.recovery_summary': string;
@@ -202,6 +204,8 @@ export declare const DEFAULT_MESSAGES: {
     'agents.done.revoke_hint': string;
     'agents.done.expired_title': string;
     'agents.done.expired_body': string;
+    'agents.done.invalid_title': string;
+    'agents.done.invalid_body': string;
     'account.apps.not_supported': string;
     'account.orgs.page_title': string;
     'account.orgs.title': string;
@@ -836,6 +840,8 @@ export declare const PT_BR_MESSAGES: {
     'mfa_challenge.page_title': string;
     'mfa_challenge.title': string;
     'mfa_challenge.intro': string;
+    'mfa_challenge.start': string;
+    'mfa_challenge.progress': string;
     'mfa_challenge.code_label': string;
     'mfa_challenge.submit': string;
     'mfa_challenge.recovery_summary': string;
@@ -952,6 +958,8 @@ export declare const PT_BR_MESSAGES: {
     'agents.done.revoke_hint': string;
     'agents.done.expired_title': string;
     'agents.done.expired_body': string;
+    'agents.done.invalid_title': string;
+    'agents.done.invalid_body': string;
     'account.apps.not_supported': string;
     'account.orgs.page_title': string;
     'account.orgs.title': string;

package/build/src/host/i18n.js

@@ -80,9 +80,11 @@ export const DEFAULT_MESSAGES = {
     'verify_email.invalid_title': 'Invalid link',
     'verify_email.invalid_body': 'The verification link is invalid or has already been used.',
     // Desafio de MFA no fluxo de login (mfa-challenge).
-    'mfa_challenge.page_title': 'Two-factor verification',
-    'mfa_challenge.title': 'Two-factor verification',
-    'mfa_challenge.intro': 'Open your authenticator app and enter the 6-digit code.',
+    'mfa_challenge.page_title': 'Multi-factor verification',
+    'mfa_challenge.title': 'Multi-factor verification',
+    'mfa_challenge.intro': 'Verify your identity using an available method.',
+    'mfa_challenge.start': 'Start verification',
+    'mfa_challenge.progress': '{completed} of {required} factors verified.',
     'mfa_challenge.code_label': 'Code',
     'mfa_challenge.submit': 'Verify',
     'mfa_challenge.recovery_summary': 'Use a recovery code',
@@ -210,6 +212,8 @@ export const DEFAULT_MESSAGES = {
     'agents.done.revoke_hint': 'To revoke this access later, go to the apps page of your account.',
     'agents.done.expired_title': 'Request expired',
     'agents.done.expired_body': 'This request is no longer valid. Ask your assistant to start again.',
+    'agents.done.invalid_title': 'Invalid request',
+    'agents.done.invalid_body': 'This sign-in link is not valid. Go back to your assistant and start again.',
     'account.apps.not_supported': 'The configured OIDC adapter does not support enumeration — listing apps is unavailable.',
     // Console de conta — organizations (account/orgs).
     'account.orgs.page_title': 'My Organizations',
@@ -920,9 +924,11 @@ export const PT_BR_MESSAGES = {
     'verify_email.invalid_title': 'Link inválido',
     'verify_email.invalid_body': 'O link de verificação é inválido ou já foi utilizado.',
     // Desafio de MFA no fluxo de login (mfa-challenge).
-    'mfa_challenge.page_title': 'Verificação em duas etapas',
-    'mfa_challenge.title': 'Verificação em duas etapas',
-    'mfa_challenge.intro': 'Abra seu app autenticador e informe o código de 6 dígitos.',
+    'mfa_challenge.page_title': 'Verificação multifator',
+    'mfa_challenge.title': 'Verificação multifator',
+    'mfa_challenge.intro': 'Verifique sua identidade usando um método disponível.',
+    'mfa_challenge.start': 'Iniciar verificação',
+    'mfa_challenge.progress': '{completed} de {required} fatores verificados.',
     'mfa_challenge.code_label': 'Código',
     'mfa_challenge.submit': 'Verificar',
     'mfa_challenge.recovery_summary': 'Usar um código de recuperação',
@@ -1048,6 +1054,8 @@ export const PT_BR_MESSAGES = {
     'agents.done.revoke_hint': 'Para revogar este acesso depois, vá à página de apps da sua conta.',
     'agents.done.expired_title': 'Pedido expirado',
     'agents.done.expired_body': 'Este pedido não vale mais. Peça ao seu assistente para começar de novo.',
+    'agents.done.invalid_title': 'Pedido inválido',
+    'agents.done.invalid_body': 'Este link de acesso não é válido. Volte ao seu assistente e comece de novo.',
     'account.apps.not_supported': 'O adapter OIDC configurado não suporta enumeração — a listagem de apps fica indisponível.',
     // Console de conta — organizations (account/orgs).
     'account.orgs.page_title': 'Minhas Organizações',

package/build/src/host/idp_session_bridge.d.ts

@@ -27,7 +27,10 @@ import type { HttpContext } from '@adonisjs/core/http';
 /** Chave da sessão Adonis com o `uid` da sessão do IdP que originou o console. */
 export declare const ACCOUNT_IDP_SESSION_KEY = "authkit_idp_session_uid";
 /** O que interessa de uma sessão do oidc-provider (instância do model `Session`). */
-interface IdpSession {
+export interface IdpSession {
+    id: string;
+    transient?: boolean;
+    exp: number;
     uid: string;
     accountId?: string;
     destroy(): Promise<void>;
@@ -37,7 +40,7 @@ interface IdpSession {
  * provider faz: cookie `_session` assinado com as keys do provider, e o registro
  * no adapter, que já descarta expirados). `null` sem sessão logada.
  */
-export declare function readIdpSession(ctx: HttpContext, service: any): Promise<IdpSession | null>;
+export declare function readIdpSession(ctx: HttpContext, service: any, strict?: boolean): Promise<IdpSession | null>;
 /**
  * Garante a sessão do console, aceitando a sessão do IdP quando configurado.
  * Devolve `true` quando o request tem (ou passou a ter) sessão de console.
@@ -52,4 +55,3 @@ export declare function ensureConsoleSession(ctx: HttpContext): Promise<boolean>
  * própria ponte e o "Sair" não teria efeito. No-op fora da ponte.
  */
 export declare function endBridgedIdpSession(ctx: HttpContext): Promise<void>;
-export {};

package/build/src/host/idp_session_bridge.js

@@ -9,7 +9,7 @@ export const ACCOUNT_IDP_SESSION_KEY = 'authkit_idp_session_uid';
  * provider faz: cookie `_session` assinado com as keys do provider, e o registro
  * no adapter, que já descarta expirados). `null` sem sessão logada.
  */
-export async function readIdpSession(ctx, service) {
+export async function readIdpSession(ctx, service, strict = false) {
     const provider = service?.provider;
     if (!provider?.Session || typeof provider.createContext !== 'function')
         return null;
@@ -21,7 +21,9 @@ export async function readIdpSession(ctx, service) {
         const session = (await provider.Session.find(id));
         return session?.accountId ? session : null;
     }
-    catch {
+    catch (error) {
+        if (strict)
+            throw error;
         // Fail-safe: sem ponte (o guard segue para o login normal).
         return null;
     }
@@ -81,8 +83,8 @@ export async function ensureConsoleSession(ctx) {
     // o login do console faz.
     await ctx.session.regenerate();
     ctx.session.put(ACCOUNT_SESSION_KEY, account.id);
-    ctx.session.put(ACCOUNT_IDP_SESSION_KEY, idp.uid);
     await syncAdonisAuthLogin(ctx, cfg, account);
+    ctx.session.put(ACCOUNT_IDP_SESSION_KEY, idp.uid);
     return true;
 }
 /**

package/build/src/host/oidc_rp_guard.d.ts

@@ -4,6 +4,7 @@ import type { SessionUserProviderContract } from '@adonisjs/auth/types/session';
 import type { HttpContext } from '@adonisjs/core/http';
 import type { ConfigProvider } from '@adonisjs/core/types';
 import type { EmitterLike } from '@adonisjs/core/types/events';
+import { type PersistentRpOptions } from './persistent_rp_session.js';
 type RealUser<UserProvider> = UserProvider extends SessionUserProviderContract<infer U> ? U : never;
 /**
  * Construtor do `E_UNAUTHORIZED_ACCESS` do `@adonisjs/auth` — a MESMA classe que
@@ -27,6 +28,8 @@ export declare function loadUnauthorizedAccess(guardFactoryName?: string): Promi
 export type OidcRpGuardOptions<UserProvider extends SessionUserProviderContract<unknown>> = {
     provider: UserProvider | ConfigProvider<UserProvider>;
     sessionKey?: string;
+    /** Same-host IdP: restore and renew remembered logins. Default: false. */
+    acceptIdpSession?: PersistentRpOptions['acceptIdpSession'];
 };
 export type OidcRpGuardEvents<User> = {
     'oidc_rp:login_succeeded': {
@@ -76,13 +79,14 @@ export type OidcRpGuardEvents<User> = {
  */
 export declare class OidcRpGuard<UserProvider extends SessionUserProviderContract<unknown>> implements GuardContract<RealUser<UserProvider>> {
     #private;
+    private persistent;
     [symbols.GUARD_KNOWN_EVENTS]: OidcRpGuardEvents<RealUser<UserProvider>>;
     driverName: 'oidc_rp';
     authenticationAttempted: boolean;
     isAuthenticated: boolean;
     isLoggedOut: boolean;
     user?: RealUser<UserProvider>;
-    constructor(name: string, ctx: HttpContext, sessionKey: string, emitter: EmitterLike<OidcRpGuardEvents<RealUser<UserProvider>>>, userProvider: UserProvider, unauthorized?: UnauthorizedAccessConstructor);
+    constructor(name: string, ctx: HttpContext, sessionKey: string, emitter: EmitterLike<OidcRpGuardEvents<RealUser<UserProvider>>>, userProvider: UserProvider, unauthorized?: UnauthorizedAccessConstructor, persistent?: PersistentRpOptions);
     getUserOrFail(): RealUser<UserProvider>;
     /**
      * Grava a identidade na sessão. Chamado pelo callback OIDC após validar o

package/build/src/host/oidc_rp_guard.js

@@ -1,5 +1,7 @@
 import { RuntimeException } from '@adonisjs/core/exceptions';
 import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
+import { ACCOUNT_IDP_SESSION_KEY } from './idp_session_bridge.js';
+import { endRpSession, ensureRpSession, } from './persistent_rp_session.js';
 /** Memo do construtor entre instâncias — o `import()` só paga o custo uma vez. */
 let cachedUnauthorizedAccess;
 /** O construtor já resolvido por {@link loadUnauthorizedAccess}, se houver. */
@@ -52,6 +54,7 @@ export async function loadUnauthorizedAccess(guardFactoryName = 'oidcRpGuard') {
  * tudo funciona nativamente.
  */
 export class OidcRpGuard {
+    persistent;
     #name;
     #ctx;
     #sessionKey;
@@ -63,7 +66,8 @@ export class OidcRpGuard {
     isAuthenticated = false;
     isLoggedOut = false;
     user;
-    constructor(name, ctx, sessionKey, emitter, userProvider, unauthorized) {
+    constructor(name, ctx, sessionKey, emitter, userProvider, unauthorized, persistent = {}) {
+        this.persistent = persistent;
         this.#name = name;
         this.#ctx = ctx;
         this.#sessionKey = sessionKey;
@@ -96,6 +100,8 @@ export class OidcRpGuard {
      */
     async login(user) {
         const guardUser = await this.#userProvider.createUserForGuard(user);
+        if (this.persistent.acceptIdpSession)
+            this.#ctx.session.forget(ACCOUNT_IDP_SESSION_KEY);
         this.#ctx.session.put(this.#sessionKey, String(guardUser.getId()));
         this.user = user;
         this.isAuthenticated = true;
@@ -113,6 +119,8 @@ export class OidcRpGuard {
      */
     async logout() {
         const user = this.user ?? null;
+        if (this.persistent.acceptIdpSession)
+            await endRpSession(this.#ctx);
         this.#ctx.session.forget(this.#sessionKey);
         this.user = undefined;
         this.isAuthenticated = false;
@@ -129,6 +137,11 @@ export class OidcRpGuard {
         }
         this.authenticationAttempted = true;
         this.#unauthorized ??= await loadUnauthorizedAccess();
+        const acceptIdp = typeof this.persistent.acceptIdpSession === 'function'
+            ? this.persistent.acceptIdpSession(this.#ctx)
+            : this.persistent.acceptIdpSession;
+        if (acceptIdp)
+            await ensureRpSession(this.#ctx, this.#sessionKey);
         const userId = this.#ctx.session.get(this.#sessionKey);
         if (!userId) {
             this.#emitter.emit('oidc_rp:authentication_failed', {
@@ -197,7 +210,7 @@ export function oidcRpGuard(config) {
                 userProvider = config.provider;
             }
             return (ctx) => {
-                return new OidcRpGuard(name, ctx, sessionKey, emitter, userProvider, unauthorized);
+                return new OidcRpGuard(name, ctx, sessionKey, emitter, userProvider, unauthorized, { acceptIdpSession: config.acceptIdpSession });
             };
         },
     };

package/build/src/host/persistent_rp_session.d.ts

@@ -0,0 +1,8 @@
+import type { HttpContext } from '@adonisjs/core/http';
+export interface PersistentRpOptions {
+    acceptIdpSession?: boolean | ((ctx: HttpContext) => boolean);
+}
+/** Same-host RP restoration: the signed IdP cookie is the persistent credential. */
+export declare function ensureRpSession(ctx: HttpContext, sessionKey: string): Promise<void>;
+/** Logout must revoke the credential that could otherwise restore the RP. */
+export declare function endRpSession(ctx: HttpContext): Promise<void>;

package/build/src/host/persistent_rp_session.js

@@ -0,0 +1,74 @@
+import { ACCOUNT_IDP_SESSION_KEY, readIdpSession } from './idp_session_bridge.js';
+import { impersonationState } from './impersonation_session.js';
+import { assertAccountEnabled } from './login_attempt.js';
+/** Same-host RP restoration: the signed IdP cookie is the persistent credential. */
+export async function ensureRpSession(ctx, sessionKey) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    // Provider interactions write to the raw Node response. Regenerating Adonis's
+    // session there migrates its data after headers are sent, leaving the browser
+    // with the old cookie and losing the pending RP state/PKCE verifier.
+    const path = ctx.request.url?.().split('?', 1)[0] ?? '';
+    const mount = service.mountPath || service.config.mountPath;
+    if (path.startsWith('/auth/interaction/') ||
+        (mount && mount !== '/' && (path === mount || path.startsWith(`${mount}/`))) ||
+        ctx.route?.name === 'authkit.oidc.root' ||
+        ctx.route?.name === 'authkit.oidc.wildcard')
+        return;
+    const current = ctx.session.get(sessionKey);
+    const linkedUid = ctx.session.get(ACCOUNT_IDP_SESSION_KEY);
+    const idp = await readIdpSession(ctx, service, true);
+    const realId = current ? (impersonationState(ctx).impersonatorId ?? current) : undefined;
+    if (current && linkedUid && (!idp || idp.uid !== linkedUid || idp.accountId !== realId)) {
+        ctx.session.clear();
+        return;
+    }
+    // An existing local login cannot silently become a different IdP account.
+    if (current && (!idp || idp.accountId !== realId || idp.transient))
+        return;
+    if (!idp?.accountId || idp.transient)
+        return;
+    const account = await service.config.accountStore.findById(idp.accountId);
+    if (!account ||
+        !(await assertAccountEnabled(service.config, account.id, {
+            email: account.email ?? '',
+            ip: ctx.request.ip(),
+        })).allowed) {
+        if (current)
+            ctx.session.clear();
+        return;
+    }
+    const adapter = service.provider.Session.adapter;
+    const ttl = service.sessionTtlHolder.rememberSec;
+    if (adapter.renewSession) {
+        if (!(await adapter.renewSession(idp.id, ttl))) {
+            if (linkedUid)
+                ctx.session.clear();
+            return;
+        }
+        const kctx = service.provider.createContext(ctx.request.request, ctx.response.response);
+        kctx.cookies.set(service.provider.cookieName('session'), idp.id, {
+            signed: true,
+            httpOnly: true,
+            sameSite: 'lax',
+            path: '/',
+            secure: kctx.secure,
+            maxAge: ttl * 1000,
+            overwrite: true,
+        });
+    }
+    // Custom adapters without atomic renewal restore until the existing IdP expiry.
+    if (!current) {
+        await ctx.session.regenerate();
+        ctx.session.put(sessionKey, account.id);
+    }
+    ctx.session.put(ACCOUNT_IDP_SESSION_KEY, idp.uid);
+}
+/** Logout must revoke the credential that could otherwise restore the RP. */
+export async function endRpSession(ctx) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const idp = await readIdpSession(ctx, service, true);
+    // The browser's signed IdP credential must be revoked even after its RP expired.
+    if (idp)
+        await idp.destroy();
+    ctx.session.forget(ACCOUNT_IDP_SESSION_KEY);
+}

package/build/src/host/poppy_session_key.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Session key que marca a sessão do navegador de um personal agent Poppy (§5):
+ * `{ sessionId, clientId, userId }`. Import-free (o barrel a reexporta — ver
+ * `account_session_key.ts`).
+ *
+ * Uma sessão marcada é do AGENTE, não do usuário: o console de conta, o admin e
+ * as telas de consentimento a recusam.
+ */
+export declare const POPPY_WEB_SESSION_KEY = "authkit_poppy_session";

package/build/src/host/poppy_session_key.js

@@ -0,0 +1,9 @@
+/**
+ * Session key que marca a sessão do navegador de um personal agent Poppy (§5):
+ * `{ sessionId, clientId, userId }`. Import-free (o barrel a reexporta — ver
+ * `account_session_key.ts`).
+ *
+ * Uma sessão marcada é do AGENTE, não do usuário: o console de conta, o admin e
+ * as telas de consentimento a recusam.
+ */
+export const POPPY_WEB_SESSION_KEY = 'authkit_poppy_session';