@adonis-agora/authkit-server 0.76.0 → 0.78.0

package/build/src/agents/runtime.js

@@ -1,7 +1,13 @@
 import { supportsAccountStatus } from '../accounts/account_store.js';
+import { findMcpResource } from '../mcp/mcp_oauth.js';
 import { PersonalAgentVerifier } from './agent_identity.js';
 import { PersonalAgentDelegation } from './delegation_service.js';
 import { DelegationStore } from './delegation_store.js';
+import { PoppyClientRegistry } from './poppy/client_registry.js';
+import { hmacNonceSource } from './poppy/dpop.js';
+import { databaseReplayStore, memoryLimiter, memoryReplayStore, redisReplayStore, } from './poppy/replay.js';
+import { PoppyService, poppyUrls } from './poppy/service.js';
+import { PoppyStore } from './poppy/store.js';
 import { keystoreSigner } from './signer.js';
 /**
  * Deriva as URLs da ORIGEM do issuer configurado — nunca do Host da request
@@ -20,11 +26,77 @@ export function personalAgentUrls(oidcIssuer, prefix) {
     };
 }
 const runtimes = new WeakMap();
+/** Ponte Poppy → oidc-provider: Bearer de MCP de Sessions logadas viram access tokens dele. */
+function mcpBridge(service, poppyApis) {
+    return {
+        isMcpResource(url) {
+            try {
+                return findMcpResource(url, service.config.issuer, service.config.mcp) !== null;
+            }
+            catch {
+                return false;
+            }
+        },
+        async mint(input) {
+            const provider = service.provider;
+            if (!provider?.AccessToken || !provider?.Grant)
+                return null;
+            // Só faz sentido quando a integração MCP do authkit está ligada, ou o MCP é de `apis`.
+            if (!service.config.mcp?.enabled &&
+                !poppyApis.some((a) => a.type === 'mcp' && a.url.replace(/\/+$/, '') === input.resource.replace(/\/+$/, ''))) {
+                return null;
+            }
+            const remaining = Math.max(60, Math.floor((input.grantExpiresAt.getTime() - Date.now()) / 1000));
+            let grant = await provider.Grant.find(input.grantId);
+            if (!grant) {
+                grant = new provider.Grant({
+                    jti: input.grantId,
+                    accountId: input.accountId,
+                    clientId: input.clientId,
+                    expiresIn: remaining,
+                });
+                await grant.save();
+            }
+            const at = new provider.AccessToken({
+                accountId: input.accountId,
+                clientId: input.clientId,
+                grantId: input.grantId,
+                scope: input.scope,
+                gty: 'poppy',
+                expiresIn: input.expiresIn,
+            });
+            at.aud = input.resource;
+            return at.save();
+        },
+        async revoke(grantId) {
+            const provider = service.provider;
+            if (!provider?.Grant)
+                return;
+            await provider.AccessToken?.revokeByGrantId?.(grantId);
+            const grant = await provider.Grant.find(grantId);
+            if (grant)
+                await grant.destroy();
+        },
+    };
+}
+async function resolveReplay(replay, conn, make) {
+    if (replay === 'memory')
+        return memoryReplayStore();
+    if (replay === 'database')
+        return databaseReplayStore(conn);
+    if (typeof replay.claim === 'function')
+        return replay;
+    const name = replay.redis;
+    if (!make)
+        throw new Error('authkit: personalAgents.poppy.replay { redis } exige o container.');
+    const redis = await make('redis');
+    return redisReplayStore(redis.connection(name));
+}
 /**
  * Monta (uma vez por `OidcService`) o runtime de personal agents. `null` quando
  * `personalAgents` não está no config — as rotas respondem 404.
  */
-export function buildPersonalAgentsRuntime(service, makeDb) {
+export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
     let runtime = runtimes.get(service);
     if (!runtime) {
         runtime = (async () => {
@@ -32,25 +104,76 @@ export function buildPersonalAgentsRuntime(service, makeDb) {
             if (!config)
                 return null;
             const urls = personalAgentUrls(service.config.issuer, config.prefix);
-            let delegation = null;
-            if (config.delegation) {
+            // Conta apagada ou suspensa corta a delegação na hora.
+            const isAccountActive = async (accountId) => {
+                const store = service.config.accountStore;
+                if (!(await store.findById(accountId)))
+                    return false;
+                return !(supportsAccountStatus(store) && (await store.isDisabled(accountId)));
+            };
+            let conn = null;
+            if (config.delegation || config.poppy) {
                 const db = await makeDb();
                 const connection = service.config.schema.connection;
+                conn = () => (connection ? db.connection(connection) : db.connection());
+            }
+            const store = conn ? new DelegationStore(conn) : null;
+            let delegation = null;
+            if (config.delegation && store) {
                 delegation = new PersonalAgentDelegation({
                     cfg: config.delegation,
-                    store: new DelegationStore(() => connection ? db.connection(connection) : db.connection()),
+                    store,
                     signer: keystoreSigner(service),
                     urls: { issuer: urls.issuer, consent: urls.consent },
-                    // Conta apagada ou suspensa corta a delegação na hora.
-                    isAccountActive: async (accountId) => {
-                        const store = service.config.accountStore;
-                        if (!(await store.findById(accountId)))
-                            return false;
-                        return !(supportsAccountStatus(store) && (await store.isDisabled(accountId)));
-                    },
+                    isAccountActive,
+                });
+            }
+            let poppy = null;
+            if (config.poppy && store && conn) {
+                const cfg = config.poppy;
+                const limiter = cfg.rateLimit === false
+                    ? null
+                    : typeof cfg.rateLimit === 'function'
+                        ? cfg.rateLimit
+                        : memoryLimiter(cfg.rateLimit);
+                const secret = service.deriveSecret('poppy-dpop-nonce');
+                poppy = new PoppyService({
+                    cfg,
+                    urls: poppyUrls(service.config.issuer, cfg.prefix),
+                    store: new PoppyStore(conn),
+                    grants: store,
+                    registry: new PoppyClientRegistry(cfg, { fetchJson: options.fetchJson }),
+                    replay: await resolveReplay(cfg.replay, conn, options.make),
+                    limiter,
+                    nonces: hmacNonceSource(secret),
+                    isAccountActive,
+                    mcp: mcpBridge(service, cfg.apis),
+                    now: options.now,
                 });
             }
-            return { config, urls, verifier: new PersonalAgentVerifier(config), delegation };
+            const revokeAgentGrant = async (accountId, grantId) => {
+                if (grantId.startsWith('pgrant_')) {
+                    return poppy ? poppy.revokeAccountGrant(accountId, grantId) : false;
+                }
+                return delegation ? delegation.revokeGrant(accountId, grantId) : false;
+            };
+            const revokeAllAgentGrants = async (accountId) => {
+                let count = 0;
+                if (poppy)
+                    count += await poppy.revokeAllAccountGrants(accountId);
+                if (delegation)
+                    count += await delegation.revokeAllGrants(accountId);
+                return count;
+            };
+            return {
+                config,
+                urls,
+                verifier: new PersonalAgentVerifier(config),
+                delegation,
+                poppy,
+                revokeAgentGrant,
+                revokeAllAgentGrants,
+            };
         })();
         // Falha (DB indisponível) não fica em cache — a próxima request tenta de novo.
         runtime.catch(() => runtimes.delete(service));
@@ -61,5 +184,7 @@ export function buildPersonalAgentsRuntime(service, makeDb) {
 /** Runtime a partir de uma request. */
 export async function personalAgentsFor(ctx) {
     const service = await ctx.containerResolver.make('authkit.server');
-    return buildPersonalAgentsRuntime(service, () => ctx.containerResolver.make('lucid.db'));
+    return buildPersonalAgentsRuntime(service, () => ctx.containerResolver.make('lucid.db'), {
+        make: (binding) => ctx.containerResolver.make(binding),
+    });
 }

package/build/src/define_config.d.ts

@@ -8,12 +8,15 @@ import { type EventsConfigInput } from './events/dispatcher.js';
 import { type BotProtectionConfigInput, type ResolvedBotProtectionConfig } from './host/bot_protection.js';
 import { type BrandingConfig } from './host/branding.js';
 import { type PolicyRouteOption } from './host/config_locks.js';
+import type { CustomLoginMethods } from './host/custom_login.js';
+import type { CustomMfaMethods } from './host/custom_mfa.js';
 import type { ResolveGeo } from './host/geo.js';
 import { type AuthMessages, type I18nConfig } from './host/i18n.js';
 import { type OtpLoginConfigInput, type ResolvedOtpLoginConfig } from './host/otp_login.js';
 import type { AuthHostOptions } from './host/register_auth_host.js';
 import type { SudoMethod } from './host/sudo/types.js';
 import { type ResolvedTrustedDevicesConfig, type TrustedDevicesConfigInput } from './host/trusted_device.js';
+import type { WhatsappCodeSenderBinding } from './host/whatsapp_code_sender.js';
 import { type McpOAuthConfigInput, type ResolvedMcpOAuthConfig } from './mcp/mcp_oauth.js';
 import type { PatStore } from './pat/pat_store.js';
 import { type RedirectUriPolicy, type ResolvedRedirectUriPolicy, type ValidateRegistrationHook } from './provider/registration_policy.js';
@@ -759,6 +762,17 @@ export interface ResolvedInteractionRecoveryConfig {
     redirectTo?: string;
 }
 export interface AuthServerConfigInput {
+    /** Host-defined primary authentication classes or instances, keyed by stable method ID. */
+    customLoginMethods?: CustomLoginMethods;
+    /** Optional enrolled factor registry and total distinct factor count (primary included). */
+    mfa?: {
+        methods?: CustomMfaMethods;
+        requiredFactors?: number;
+    };
+    /** OTP delivery only. The host remains responsible for issuing and verifying codes. */
+    whatsapp?: {
+        sender: WhatsappCodeSenderBinding;
+    };
     issuer: string;
     adapter: AdapterFactory;
     /**
@@ -1152,6 +1166,16 @@ export interface AuthServerConfigInput {
     };
 }
 export interface ResolvedServerConfig {
+    customLoginMethods?: CustomLoginMethods;
+    /** Optional enrolled factor registry and total distinct factor count (primary included). */
+    mfa?: {
+        methods?: CustomMfaMethods;
+        requiredFactors?: number;
+    };
+    /** OTP delivery only. The host remains responsible for issuing and verifying codes. */
+    whatsapp?: {
+        sender: WhatsappCodeSenderBinding;
+    };
     issuer: string;
     AdapterClass: OidcAdapterClass;
     /**

package/build/src/define_config.js

@@ -273,6 +273,11 @@ export function jwksAutoFallbackWarning(storePath) {
     return `AuthKit: jwks 'auto' caiu no fallback de disco (${storePath}) — a chave privada de assinatura será persistida em arquivo. Para produção, defina AUTHKIT_JWKS (secret manager) ou configure jwks.store explicitamente.`;
 }
 export function defineConfig(config) {
+    const requiredFactors = config.mfa?.requiredFactors;
+    if (requiredFactors !== undefined &&
+        (!Number.isInteger(requiredFactors) || requiredFactors < 2 || requiredFactors > 8)) {
+        throw new Error('mfa.requiredFactors must be an integer between 2 and 8');
+    }
     return configProvider.create(async (app) => {
         const AdapterClass = await config.adapter.resolver(app);
         // `session.adapter` ausente ⇒ mesma classe do default (back-compat: o
@@ -348,6 +353,12 @@ export function defineConfig(config) {
             (personalAgents.prefix === oidcMount || personalAgents.prefix.startsWith(`${oidcMount}/`))) {
             throw new Error(`authkit: personalAgents.prefix "${personalAgents.prefix}" não pode ficar debaixo do mountPath do OIDC ("${oidcMount}").`);
         }
+        const poppyPrefix = personalAgents?.poppy?.prefix;
+        if (poppyPrefix &&
+            oidcMount &&
+            (poppyPrefix === oidcMount || poppyPrefix.startsWith(`${oidcMount}/`))) {
+            throw new Error(`authkit: personalAgents.poppy.prefix "${poppyPrefix}" não pode ficar debaixo do mountPath do OIDC ("${oidcMount}").`);
+        }
         // BACKSTOP DE SUDO. Um host cujo `sudo.methods` não tem um único método
         // satisfazível por conta sem senha fica bricado para TODA operação sob
         // `requireSudo` — e hoje isso só se descobre quando um usuário não consegue
@@ -394,6 +405,9 @@ export function defineConfig(config) {
                 return acc ? { id: acc.id } : null;
             },
             accountStore: config.accountStore,
+            customLoginMethods: config.customLoginMethods,
+            mfa: config.mfa,
+            whatsapp: config.whatsapp,
             patStore: config.patStore,
             mountPath: config.mountPath ?? '/oidc',
             accountHome: config.accountHome,

package/build/src/host/account_api/account_api_controller.d.ts

@@ -159,7 +159,18 @@ export default class AccountApiController {
     }>;
     /** Personal agents com delegação ativa na conta (scopes aprovados). */
     listAgents(ctx: HttpContext): Promise<void | {
-        agents: import("../../agents/delegation_service.ts").DelegationGrantSummary[];
+        agents: {
+            id: string;
+            clientId: string;
+            scopes: {
+                id: string;
+                description: string;
+            }[];
+            createdAt: Date;
+            updatedAt: Date;
+            expiresAt: Date;
+            protocol: string;
+        }[];
     }>;
     /** Revoga a delegação de um personal agent (efeito imediato nos tokens). */
     revokeAgent(ctx: HttpContext): Promise<void | {

package/build/src/host/account_api/account_api_controller.js

@@ -617,20 +617,25 @@ export default class AccountApiController {
     /** Personal agents com delegação ativa na conta (scopes aprovados). */
     async listAgents(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation) {
+        if (!runtime?.delegation && !runtime?.poppy) {
             return ctx.response
                 .status(404)
                 .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));
         }
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
-        const grants = await runtime.delegation.listGrants(userId);
-        return { agents: grants };
+        const pact = runtime.delegation
+            ? (await runtime.delegation.listGrants(userId)).map((g) => ({ ...g, protocol: 'pact' }))
+            : [];
+        const poppy = runtime.poppy
+            ? (await runtime.poppy.listGrants(userId)).map((g) => ({ ...g, protocol: 'poppy' }))
+            : [];
+        return { agents: [...pact, ...poppy] };
     }
     // ─── DELETE /account/api/agents/:id ──────────────────────────────────────
     /** Revoga a delegação de um personal agent (efeito imediato nos tokens). */
     async revokeAgent(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation) {
+        if (!runtime?.delegation && !runtime?.poppy) {
             return ctx.response
                 .status(404)
                 .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));
@@ -638,7 +643,7 @@ export default class AccountApiController {
         const service = await ctx.containerResolver.make('authkit.server');
         const userId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const grantId = ctx.request.param('id');
-        if (!(await runtime.delegation.revokeGrant(userId, grantId))) {
+        if (!(await runtime.revokeAgentGrant(userId, grantId))) {
             return ctx.response.status(404).send(apiErr('not_found', 'Grant not found.'));
         }
         await service.config.audit?.record({

package/build/src/host/admin_sessions_service.js

@@ -87,13 +87,14 @@ export class AdminSessionsService {
     /**
      * Revogação total também corta os personal agents: "sair de todas as sessões",
      * reset de senha, a ação do admin e a exclusão de conta não podem deixar um
-     * agente agindo na conta. Sem `personalAgents.delegation` é no-op — e aí nem
-     * resolve o banco. Diferente do `recordSubRevocation`, uma falha AQUI propaga:
-     * não há outra camada que corte esses tokens.
+     * agente agindo na conta (delegações do PACT e Account Tokens do Poppy). Sem
+     * `personalAgents` é no-op — e aí nem resolve o banco. Diferente do
+     * `recordSubRevocation`, uma falha AQUI propaga: não há outra camada que corte
+     * esses tokens.
      */
     async #revokeAgentGrants(accountId) {
         const runtime = await buildPersonalAgentsRuntime(this.#oidc, () => getBootedApp().container.make('lucid.db'));
-        return runtime?.delegation ? runtime.delegation.revokeAllGrants(accountId) : 0;
+        return runtime ? runtime.revokeAllAgentGrants(accountId) : 0;
     }
     /**
      * Loga (best-effort, sem nunca lançar) a falha de {@link recordSubRevocation}. Prefere o
@@ -183,7 +184,9 @@ export class AdminSessionsService {
      */
     async listGrants(accountId) {
         const rows = await this.#listModel('Grant');
-        const grants = rows.filter((r) => r.payload.accountId === accountId);
+        // Os grants `pgrant_` são o espelho de um Account Token do Poppy (Bearer de MCP) — aparecem e
+        // são revogados como personal agent, não como app OIDC.
+        const grants = rows.filter((r) => r.payload.accountId === accountId && !r.id.startsWith('pgrant_'));
         if (grants.length === 0)
             return [];
         const atByGrant = await this.#countByGrant('AccessToken');

package/build/src/host/auth_host_config.d.ts

@@ -35,9 +35,10 @@ export interface AuthHostRuntimeConfig {
      * Ver `deriveLockedRouteOptions`.
      */
     lockedRouteOptions?: PolicyRouteOption[];
-    /** Personal agents ligados → prefixo das rotas deles (`/agents`). */
+    /** Personal agents ligados → prefixo das rotas deles (`/agents`) e do Poppy (`/poppy`). */
     personalAgents?: {
         prefix: string;
+        poppyPrefix?: string;
     };
     /**
      * API headless (Clerk-style). Presente quando o host a declarou — o provider o

package/build/src/host/controllers/account_apps_controller.js

@@ -28,7 +28,7 @@ export default class AccountAppsController {
         const revoked = ctx.session.flashMessages.get('appRevoked');
         // Personal agents com delegação ativa (só quando a feature está ligada).
         const agentsRuntime = await personalAgentsFor(ctx);
-        const agents = agentsRuntime?.delegation
+        const pactAgents = agentsRuntime?.delegation
             ? await Promise.all((await agentsRuntime.delegation.listGrants(accountId)).map(async (g) => ({
                 id: g.id,
                 name: displayNameFor((await agentsRuntime.config.resolveAgent(g.clientId)) ?? {
@@ -38,6 +38,16 @@ export default class AccountAppsController {
                 scopes: g.scopes,
             })))
             : null;
+        // Account Tokens do Poppy: o agente é desconectado pela mesma lista (§4.9).
+        const poppy = agentsRuntime?.poppy;
+        const poppyAgents = poppy
+            ? await Promise.all((await poppy.listGrants(accountId)).map(async (g) => ({
+                id: g.id,
+                name: await poppy.registry.displayName(g.clientId),
+                scopes: g.scopes,
+            })))
+            : null;
+        const agents = pactAgents || poppyAgents ? [...(pactAgents ?? []), ...(poppyAgents ?? [])] : null;
         return render(ctx, 'account/apps', {
             csrfToken: ctx.request.csrfToken,
             supported,
@@ -78,13 +88,13 @@ export default class AccountAppsController {
     /** POST /account/apps/agents/:grantId/revoke — revoga a delegação de um personal agent. */
     async revokeAgent(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation)
+        if (!runtime?.delegation && !runtime?.poppy)
             return ctx.response.notFound();
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const grantId = ctx.request.param('grantId');
-        if (await runtime.delegation.revokeGrant(accountId, grantId)) {
+        if (await runtime.revokeAgentGrant(accountId, grantId)) {
             await cfg.audit?.record({
                 type: 'agent.grant_revoked',
                 accountId,

package/build/src/host/controllers/account_security_controller.js

@@ -158,15 +158,19 @@ export default class AccountSecurityController {
             return ctx.response.redirect(getAccountLoginUrl());
         }
         const { currentPassword, confirmEmail } = await ctx.request.validateUsing(deleteAccountValidator);
-        // Confirmação: senha atual correta OU e-mail digitado batendo com o da conta
-        // (case-insensitive). Sem nenhuma das duas → recusa (não deleta).
+        // Confirmação: senha atual correta OU e-mail digitado batendo com o da conta.
+        // Contas sem e-mail podem confirmar o telefone já verificado pelo host.
         let confirmed = false;
         if (currentPassword) {
             confirmed = !!(await store.verifyCredentials(account.email, currentPassword));
         }
         if (!confirmed && confirmEmail) {
-            confirmed =
-                normalizeEmailIdentifier(confirmEmail) === normalizeEmailIdentifier(account.email);
+            confirmed = account.email
+                ? normalizeEmailIdentifier(confirmEmail) === normalizeEmailIdentifier(account.email)
+                : !!account.phone &&
+                    /^[+\d\s().-]+$/.test(confirmEmail) &&
+                    /\d/.test(confirmEmail) &&
+                    confirmEmail.replace(/\D/g, '') === account.phone.replace(/\D/g, '');
         }
         if (!confirmed) {
             ctx.session.flash('deleteError', translate(cfg.messages, 'account.delete.invalid_confirmation'));

package/build/src/host/controllers/interaction_controller.d.ts

@@ -1,7 +1,14 @@
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
+import { type CustomLoginIdentity } from '../custom_login.js';
 export default class AuthInteractionController {
     #private;
+    /** Shared completion for trusted host authentication; primary proof is the host's responsibility. */
+    completeCustomLogin(ctx: HttpContext, input: CustomLoginIdentity & {
+        method: string;
+        factorId?: string;
+        passwordless?: boolean;
+    }): Promise<unknown>;
     show(ctx: HttpContext): Promise<any>;
     /**
      * POST /auth/interaction/:uid/identifier
@@ -29,7 +36,12 @@ export default class AuthInteractionController {
      * 2º fator: lê o accountId pendente da sessão e aceita um código TOTP (`code`)
      * OU um recovery code (`recoveryCode`). Em caso de sucesso finaliza a interaction.
      */
-    mfaVerify(ctx: HttpContext): Promise<any>;
+    private renderMfaChallenge;
+    private configuredMfaGate;
+    customMfaBegin(ctx: HttpContext): Promise<unknown>;
+    customMfaVerify(ctx: HttpContext): Promise<unknown>;
+    private finishVerifiedMfa;
+    mfaVerify(ctx: HttpContext): Promise<unknown>;
     /**
      * true se o authorize request exige MFA via acr_values (contém o mfaAcr da
      * config de step-up). `acr_values` é a string separada por espaços padrão OIDC.