@adonis-agora/authkit-server 0.77.0 → 0.78.0

package/build/src/host/controllers/poppy_controller.js

@@ -0,0 +1,194 @@
+import { PoppyError } from '../../agents/poppy/errors.js';
+import { publicRequestUrl, writePoppyAuthError } from '../../agents/poppy/resource.js';
+import { loginPoppyBrowser } from '../../agents/poppy/web_session.js';
+import { personalAgentsFor } from '../../agents/runtime.js';
+function noStore(ctx) {
+    ctx.response.header('Cache-Control', 'no-store');
+    ctx.response.header('Pragma', 'no-cache');
+}
+function withNonce(ctx, poppy) {
+    const nonce = poppy.nonce();
+    if (nonce)
+        ctx.response.header('DPoP-Nonce', nonce);
+}
+function oauthError(ctx, error) {
+    noStore(ctx);
+    for (const [k, v] of Object.entries(error.headers))
+        ctx.response.header(k, v);
+    if (error.code === 'invalid_dpop_proof' || error.code === 'use_dpop_nonce') {
+        ctx.response.header('WWW-Authenticate', `DPoP error="${error.code}"`);
+    }
+    return ctx.response.status(error.status).json(error.toJSON());
+}
+async function poppyOr404(ctx) {
+    const poppy = (await personalAgentsFor(ctx))?.poppy ?? null;
+    if (!poppy)
+        ctx.response.notFound();
+    return poppy;
+}
+/** Formulário (`application/x-www-form-urlencoded`) da request. */
+function form(ctx) {
+    return ctx.request.all();
+}
+/**
+ * Endpoints server-to-server do Poppy (§3, §4): descoberta, metadata RFC 8414,
+ * token, revogação, device authorization, Mediated Sign-In e a sessão de
+ * navegador (§5). Todos isentos de CSRF — ver `authkitCsrfExceptions`.
+ */
+export default class PoppyController {
+    /** `GET /.well-known/poppy.json` — só no domínio da empresa (ignorando `www.`). */
+    async discovery(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        // `host()` mantém a porta (dev em `localhost:3333`): o `browser_session_endpoint` sai dele.
+        const doc = poppy.discoveryDocument(ctx.request.host() ?? ctx.request.hostname() ?? '');
+        if (!doc)
+            return ctx.response.notFound();
+        ctx.response.header('Access-Control-Allow-Origin', '*');
+        ctx.response.header('Cache-Control', 'public, max-age=300');
+        return ctx.response.json(doc);
+    }
+    /** `GET /.well-known/oauth-authorization-server{prefix}` (RFC 8414 + `poppy_domains`). */
+    async metadata(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        ctx.response.header('Access-Control-Allow-Origin', '*');
+        ctx.response.header('Cache-Control', 'public, max-age=300');
+        return ctx.response.json(poppy.authorizationServerMetadata());
+    }
+    async token(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        withNonce(ctx, poppy);
+        try {
+            const body = await poppy.token(form(ctx), ctx.request.header('dpop'));
+            noStore(ctx);
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    async deviceAuthorization(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        try {
+            const body = await poppy.deviceAuthorization(form(ctx));
+            noStore(ctx);
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /** RFC 7009: 200 também para token desconhecido. */
+    async revoke(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy)
+            return;
+        try {
+            await poppy.revoke(form(ctx));
+            noStore(ctx);
+            return ctx.response.status(200).send('');
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /** `POST auth.mediated.endpoint` (§4.7) — com o Session Token (DPoP). */
+    async mediatedStart(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy?.cfg.signIn.mediated)
+            return poppy ? ctx.response.notFound() : undefined;
+        const auth = await poppy.verifyAccess({
+            method: ctx.request.method(),
+            url: publicRequestUrl(ctx, poppy),
+            headers: ctx.request.headers(),
+        });
+        if (!auth.ok) {
+            const { ok: _ok, ...rest } = auth;
+            return writePoppyAuthError(ctx, { ok: false, ...rest });
+        }
+        try {
+            const body = await poppy.mediatedStart(auth.principal, auth.jkt, ctx.request.body(), ctx);
+            noStore(ctx);
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /** `POST {mediated}/{sign_in_id}` (§4.7). */
+    async mediatedCode(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy?.cfg.signIn.mediated)
+            return poppy ? ctx.response.notFound() : undefined;
+        const auth = await poppy.verifyAccess({
+            method: ctx.request.method(),
+            url: publicRequestUrl(ctx, poppy),
+            headers: ctx.request.headers(),
+        });
+        if (!auth.ok) {
+            const { ok: _ok, ...rest } = auth;
+            return writePoppyAuthError(ctx, { ok: false, ...rest });
+        }
+        try {
+            const body = await poppy.mediatedCode(auth.principal, auth.jkt, String(ctx.request.param('id') ?? ''), ctx.request.body());
+            noStore(ctx);
+            if (!body) {
+                return ctx.response
+                    .status(404)
+                    .json({ error: 'invalid_request', error_description: 'Unknown sign_in_id' });
+            }
+            return ctx.response.json(body);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return oauthError(ctx, error);
+            throw error;
+        }
+    }
+    /**
+     * `POST web.browser_session_endpoint` (§5): asserção no corpo → cookie do app
+     * para a Session e 303 para `return_to`; qualquer falha → 400, sem cookie.
+     */
+    async browserSession(ctx) {
+        const poppy = await poppyOr404(ctx);
+        if (!poppy?.cfg.web?.browserSession)
+            return poppy ? ctx.response.notFound() : undefined;
+        noStore(ctx);
+        // A asserção vai NO CORPO, nunca na URL (§5).
+        if (ctx.request.qs().assertion !== undefined)
+            return badBrowserRequest(ctx);
+        let result;
+        try {
+            result = await poppy.verifyBrowserAssertion(ctx.request.input('assertion'), new URL(publicRequestUrl(ctx, poppy)).origin);
+        }
+        catch (error) {
+            if (error instanceof PoppyError)
+                return badBrowserRequest(ctx);
+            throw error;
+        }
+        await loginPoppyBrowser(ctx, result);
+        ctx.response.header('Location', result.returnTo);
+        return ctx.response.status(303).send('');
+    }
+}
+function badBrowserRequest(ctx) {
+    ctx.response.header('Content-Type', 'text/html; charset=utf-8');
+    return ctx.response
+        .status(400)
+        .send('<!doctype html><html><head><meta charset="utf-8"><title>Bad request</title></head><body><h1>Invalid browser session request</h1></body></html>');
+}

package/build/src/host/csrf.d.ts

@@ -10,6 +10,13 @@ export interface AuthkitCsrfOptions {
      * consentimento (`{prefix}/consent`) continua protegida.
      */
     personalAgentsPrefix?: string | false;
+    /**
+     * Prefixo do Poppy: isenta token/revoke/device authorization, o Mediated
+     * Sign-In e a sessão de navegador (POST cross-site autenticado pela asserção).
+     * Default: o do config. As telas `{prefix}/oauth/authorize` e `{prefix}/device`
+     * continuam protegidas. `false` desliga.
+     */
+    poppyPrefix?: string | false;
 }
 /**
  * Retorna `true` quando `url` é uma rota AuthKit que deve ser ISENTA de CSRF

package/build/src/host/csrf.js

@@ -16,6 +16,7 @@
  * ```
  */
 import { normalizePersonalAgentsPrefix } from '../agents/config.js';
+import { normalizePoppyPrefix } from '../agents/poppy/config.js';
 import { getAuthHostConfig } from './auth_host_config.js';
 /**
  * Retorna `true` quando `url` é uma rota AuthKit que deve ser ISENTA de CSRF
@@ -33,8 +34,22 @@ export function authkitCsrfExceptions(url, options = {}) {
             ? normalizePersonalAgentsPrefix(options.personalAgentsPrefix)
             : getAuthHostConfig()?.personalAgents?.prefix;
     const agentsOAuth = agentsPrefix ? `${agentsPrefix}/oauth/` : null;
+    const poppyPrefix = options.poppyPrefix === false
+        ? undefined
+        : options.poppyPrefix !== undefined
+            ? normalizePoppyPrefix(options.poppyPrefix)
+            : getAuthHostConfig()?.personalAgents?.poppyPrefix;
+    const path = url.split('?')[0];
+    const poppyExempt = !!poppyPrefix &&
+        (path === `${poppyPrefix}/oauth/token` ||
+            path === `${poppyPrefix}/oauth/revoke` ||
+            path === `${poppyPrefix}/oauth/device` ||
+            path === `${poppyPrefix}/sign-in` ||
+            path.startsWith(`${poppyPrefix}/sign-in/`) ||
+            path === `${poppyPrefix}/browser-session`);
     return (url.includes(mountPath) ||
         url.includes('/authkit/pat') ||
         (backchannel !== null && url === backchannel) ||
-        (agentsOAuth !== null && url.startsWith(agentsOAuth)));
+        (agentsOAuth !== null && url.startsWith(agentsOAuth)) ||
+        poppyExempt);
 }

package/build/src/host/i18n.d.ts

@@ -204,6 +204,8 @@ export declare const DEFAULT_MESSAGES: {
     'agents.done.revoke_hint': string;
     'agents.done.expired_title': string;
     'agents.done.expired_body': string;
+    'agents.done.invalid_title': string;
+    'agents.done.invalid_body': string;
     'account.apps.not_supported': string;
     'account.orgs.page_title': string;
     'account.orgs.title': string;
@@ -956,6 +958,8 @@ export declare const PT_BR_MESSAGES: {
     'agents.done.revoke_hint': string;
     'agents.done.expired_title': string;
     'agents.done.expired_body': string;
+    'agents.done.invalid_title': string;
+    'agents.done.invalid_body': string;
     'account.apps.not_supported': string;
     'account.orgs.page_title': string;
     'account.orgs.title': string;

package/build/src/host/i18n.js

@@ -212,6 +212,8 @@ export const DEFAULT_MESSAGES = {
     'agents.done.revoke_hint': 'To revoke this access later, go to the apps page of your account.',
     'agents.done.expired_title': 'Request expired',
     'agents.done.expired_body': 'This request is no longer valid. Ask your assistant to start again.',
+    'agents.done.invalid_title': 'Invalid request',
+    'agents.done.invalid_body': 'This sign-in link is not valid. Go back to your assistant and start again.',
     'account.apps.not_supported': 'The configured OIDC adapter does not support enumeration — listing apps is unavailable.',
     // Console de conta — organizations (account/orgs).
     'account.orgs.page_title': 'My Organizations',
@@ -1052,6 +1054,8 @@ export const PT_BR_MESSAGES = {
     'agents.done.revoke_hint': 'Para revogar este acesso depois, vá à página de apps da sua conta.',
     'agents.done.expired_title': 'Pedido expirado',
     'agents.done.expired_body': 'Este pedido não vale mais. Peça ao seu assistente para começar de novo.',
+    'agents.done.invalid_title': 'Pedido inválido',
+    'agents.done.invalid_body': 'Este link de acesso não é válido. Volte ao seu assistente e comece de novo.',
     'account.apps.not_supported': 'O adapter OIDC configurado não suporta enumeração — a listagem de apps fica indisponível.',
     // Console de conta — organizations (account/orgs).
     'account.orgs.page_title': 'Minhas Organizações',

package/build/src/host/poppy_session_key.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Session key que marca a sessão do navegador de um personal agent Poppy (§5):
+ * `{ sessionId, clientId, userId }`. Import-free (o barrel a reexporta — ver
+ * `account_session_key.ts`).
+ *
+ * Uma sessão marcada é do AGENTE, não do usuário: o console de conta, o admin e
+ * as telas de consentimento a recusam.
+ */
+export declare const POPPY_WEB_SESSION_KEY = "authkit_poppy_session";

package/build/src/host/poppy_session_key.js

@@ -0,0 +1,9 @@
+/**
+ * Session key que marca a sessão do navegador de um personal agent Poppy (§5):
+ * `{ sessionId, clientId, userId }`. Import-free (o barrel a reexporta — ver
+ * `account_session_key.ts`).
+ *
+ * Uma sessão marcada é do AGENTE, não do usuário: o console de conta, o admin e
+ * as telas de consentimento a recusam.
+ */
+export const POPPY_WEB_SESSION_KEY = 'authkit_poppy_session';

package/build/src/host/register_auth_host.js

@@ -8,6 +8,7 @@ import { adminApiGuard } from './admin_api/admin_api_guard.js';
 import { normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './admin_prefix.js';
 import { getAuthHostConfig, markAuthHostAutoMounted, wasAuthHostAutoMounted, } from './auth_host_config.js';
 import { ensureConsoleSession } from './idp_session_bridge.js';
+import { POPPY_WEB_SESSION_KEY } from './poppy_session_key.js';
 import { createAuthThrottles } from './rate_limit.js';
 import { redirectExact } from './redirect_exact.js';
 import { requestPathWithQuery } from './request_url.js';
@@ -113,7 +114,16 @@ function buildLoginRedirect(ctx, extra) {
  * classe NÃO era aplicada em runtime num grupo, deixando /account/tokens e
  * /account/mfa acessíveis sem sessão.
  */
+/** A sessão é do navegador de um personal agent Poppy (§5)? */
+function isPoppyBrowser(ctx) {
+    const marker = ctx.session?.get?.(POPPY_WEB_SESSION_KEY);
+    return typeof marker === 'object' && marker !== null && typeof marker.sessionId === 'string';
+}
 const accountGuard = async (ctx, next) => {
+    // O navegador de um personal agent Poppy (§5) não entra no console de conta nem
+    // nas telas de consentimento: a sessão é do agente, não do usuário.
+    if (isPoppyBrowser(ctx))
+        return ctx.response.status(403).send('');
     // Sessão do console — ou, com `accountSession.acceptIdpSession`, a do IdP (SSO).
     if (!(await ensureConsoleSession(ctx))) {
         return redirectExact(ctx.response, buildLoginRedirect(ctx));
@@ -145,6 +155,8 @@ export const adminGuard = async (ctx, next) => {
     if (!cfg.admin.enabled) {
         return ctx.response.notFound();
     }
+    if (isPoppyBrowser(ctx))
+        return ctx.response.status(403).send('');
     // Com `accountSession.acceptIdpSession`, a sessão do IdP também abre o console.
     await ensureConsoleSession(ctx);
     const accountId = ctx.session?.get(ACCOUNT_SESSION_KEY);
@@ -187,6 +199,8 @@ const C = {
     accountConfirm: () => import('./controllers/account_confirm_controller.js'),
     agentOAuth: () => import('./controllers/agent_oauth_controller.js'),
     agentConsent: () => import('./controllers/agent_consent_controller.js'),
+    poppy: () => import('./controllers/poppy_controller.js'),
+    poppyConsent: () => import('./controllers/poppy_consent_controller.js'),
     webauthnAsset: () => import('./controllers/webauthn_asset_controller.js'),
     logoutAsset: () => import('./controllers/logout_asset_controller.js'),
     passkeyAutofillAsset: () => import('./controllers/passkey_autofill_asset_controller.js'),
@@ -508,6 +522,52 @@ export function registerAuthHost(router, opts = {}) {
         })
             .use([accountGuard]);
     }
+    // Personal Agent Protocol (Poppy): descoberta, authorization server (token,
+    // revogação, device authorization), Mediated Sign-In e sessão de navegador —
+    // server-to-server ou POST cross-site do navegador do agente (sem CSRF, ver
+    // `authkitCsrfExceptions`). As telas do usuário (authorize/device) exigem a
+    // sessão de conta e mantêm o CSRF.
+    const poppyPrefix = hostCfg?.personalAgents?.poppyPrefix;
+    if (poppyPrefix) {
+        // Nomes explícitos: o Router nomeia pela dupla controller.método, e as duas URLs da metadata
+        // (RFC 8414 na raiz e debaixo do issuer) usam o mesmo — "poppy.metadata already exists" no boot.
+        router.get('/.well-known/poppy.json', [C.poppy, 'discovery']).as('authkit.poppy.discovery');
+        router
+            .get(`/.well-known/oauth-authorization-server${poppyPrefix}`, [C.poppy, 'metadata'])
+            .as('authkit.poppy.metadata');
+        router
+            .get(`${poppyPrefix}/.well-known/oauth-authorization-server`, [C.poppy, 'metadata'])
+            .as('authkit.poppy.metadata_under_issuer');
+        router.post(`${poppyPrefix}/oauth/token`, [C.poppy, 'token']).as('authkit.poppy.token');
+        router.post(`${poppyPrefix}/oauth/revoke`, [C.poppy, 'revoke']).as('authkit.poppy.revoke');
+        router
+            .post(`${poppyPrefix}/oauth/device`, [C.poppy, 'deviceAuthorization'])
+            .as('authkit.poppy.device_authorization');
+        // Credenciais e códigos de uso único: throttle por IP (§4.7 exige rate limit).
+        withLogin(router.post(`${poppyPrefix}/sign-in`, [C.poppy, 'mediatedStart']).as('authkit.poppy.sign_in'));
+        withOtpLogin(router
+            .post(`${poppyPrefix}/sign-in/:id`, [C.poppy, 'mediatedCode'])
+            .as('authkit.poppy.sign_in_code'));
+        router
+            .post(`${poppyPrefix}/browser-session`, [C.poppy, 'browserSession'])
+            .as('authkit.poppy.browser_session');
+        router
+            .group(() => {
+            router
+                .get(`${poppyPrefix}/oauth/authorize`, [C.poppyConsent, 'authorize'])
+                .as('authkit.poppy.authorize');
+            router
+                .post(`${poppyPrefix}/oauth/authorize`, [C.poppyConsent, 'decideAuthorization'])
+                .as('authkit.poppy.authorize_decide');
+            withOtpLogin(router
+                .get(`${poppyPrefix}/device`, [C.poppyConsent, 'device'])
+                .as('authkit.poppy.device'));
+            withOtpLogin(router
+                .post(`${poppyPrefix}/device`, [C.poppyConsent, 'decideDevice'])
+                .as('authkit.poppy.device_decide'));
+        })
+            .use([accountGuard]);
+    }
     // Paths do console de conta (configuráveis/localizáveis via `accountRoutes`).
     // As TELAS vêm de `accountPath(key)` (prefixo + segmento configurável); os
     // action-subpaths concatenados (`/password`, `/enroll`, ...) são FIXOS —

package/build/src/provider/oidc_service.d.ts

@@ -25,6 +25,11 @@ export declare class OidcService {
     get signingJwks(): {
         keys: Record<string, any>[];
     };
+    /**
+     * @internal Segredo derivado da app key para um uso (`label`) — HMAC dos nonces
+     * DPoP do Poppy, por exemplo. Igual em todas as instâncias, sem expor a chave.
+     */
+    deriveSecret(label: string): Buffer;
     /** Pathname do issuer sem barra final (ex.: `/oidc`). Vazio quando montado na raiz. */
     readonly mountPath: string;
     readonly recorder: MetricsRecorder;

package/build/src/provider/oidc_service.js

@@ -1,4 +1,4 @@
-import { timingSafeEqual } from 'node:crypto';
+import { createHmac, timingSafeEqual } from 'node:crypto';
 import { NoopRecorder } from '@adonis-agora/authkit-core';
 import Koa from 'koa';
 import mount from 'koa-mount';
@@ -41,6 +41,13 @@ export class OidcService {
     get signingJwks() {
         return this.#signingJwks;
     }
+    /**
+     * @internal Segredo derivado da app key para um uso (`label`) — HMAC dos nonces
+     * DPoP do Poppy, por exemplo. Igual em todas as instâncias, sem expor a chave.
+     */
+    deriveSecret(label) {
+        return createHmac('sha256', this.#appKey).update(`authkit:${label}`).digest();
+    }
     /** Pathname do issuer sem barra final (ex.: `/oidc`). Vazio quando montado na raiz. */
     mountPath;
     recorder;
@@ -325,7 +332,7 @@ export class OidcService {
     /** Verifica client_id + client_secret contra os clients da config (p/ endpoints custom como introspecção de PAT). */
     verifyClientCredentials(clientId, clientSecret) {
         const client = this.#clients.find((c) => c.clientId === clientId);
-        if (!client || !client.clientSecret)
+        if (!client?.clientSecret)
             return false;
         const a = Buffer.from(client.clientSecret);
         const b = Buffer.from(clientSecret);

package/build/src/schema/ensure.js

@@ -295,6 +295,130 @@ const TABLES = [
             created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
         },
     },
+    /*
+     * Personal Agent Protocol (Poppy). Os Account Tokens são grants de
+     * `auth_agent_grants` (prefixo `pgrant_`) com o hash em
+     * `auth_agent_refresh_tokens`; aqui ficam Sessions, Session Tokens, pedidos de
+     * sign-in e os `jti` vistos. Mesmas regras de data das tabelas acima.
+     */
+    {
+        name: 'auth_poppy_sessions',
+        /**
+         * Uma Session: um usuário do agente (`user_id`, opaco) num agente
+         * (`client_id`). `account_id` é a conta a que ficou PRESA ao logar (não troca);
+         * `grant_id` o Account Token com que está logada agora (`null` = deslogada).
+         */
+        create: (t) => {
+            t.string('id').primary();
+            t.string('client_id', 2048).notNullable();
+            t.string('user_id').notNullable();
+            t.string('account_id').nullable().index();
+            t.string('grant_id').nullable().index();
+            t.text('scope').notNullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable();
+            t.dateTime('ended_at', { useTz: true, precision: 3 }).nullable();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+            t.dateTime('updated_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            client_id: (t) => t.string('client_id', 2048),
+            user_id: (t) => t.string('user_id'),
+            account_id: (t) => t.string('account_id').nullable().index(),
+            grant_id: (t) => t.string('grant_id').nullable().index(),
+            scope: (t) => t.text('scope'),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            ended_at: (t) => t.dateTime('ended_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+            updated_at: (t) => t.dateTime('updated_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_tokens',
+        /** Session Tokens — só o hash. `jkt` = chave DPoP; `null` = Bearer (MCP). */
+        create: (t) => {
+            t.string('token_hash', 64).primary();
+            t.string('session_id').notNullable().index();
+            t.string('client_id', 2048).notNullable();
+            t.string('user_id').notNullable();
+            t.string('account_id').nullable();
+            t.string('grant_id').nullable().index();
+            t.text('scope').notNullable();
+            t.string('resource', 2048).nullable();
+            t.string('jkt', 64).nullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            session_id: (t) => t.string('session_id').index(),
+            client_id: (t) => t.string('client_id', 2048),
+            user_id: (t) => t.string('user_id'),
+            account_id: (t) => t.string('account_id').nullable(),
+            grant_id: (t) => t.string('grant_id').nullable().index(),
+            scope: (t) => t.text('scope'),
+            resource: (t) => t.string('resource', 2048).nullable(),
+            jkt: (t) => t.string('jkt', 64).nullable(),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_requests',
+        /**
+         * Pedidos de sign-in: `authorize` (Direct — vira código após o consentimento),
+         * `device` (RFC 8628) e `mediated` (§4.7, aguardando o código de uso único).
+         * Códigos só como hash. Linhas expiradas são apagadas no próximo pedido.
+         */
+        create: (t) => {
+            t.string('id').primary();
+            t.string('kind', 16).notNullable();
+            t.string('code_hash', 64).nullable().unique();
+            t.string('user_code', 16).nullable().unique();
+            t.string('client_id', 2048).notNullable();
+            t.string('session_id').nullable();
+            t.string('account_id').nullable();
+            t.text('requested_scope').notNullable();
+            t.text('granted_scope').nullable();
+            t.string('redirect_uri', 2048).nullable();
+            t.string('code_challenge', 128).nullable();
+            t.string('status', 16).notNullable();
+            t.integer('attempts').notNullable().defaultTo(0);
+            t.integer('interval_seconds').nullable();
+            t.dateTime('last_polled_at', { useTz: true, precision: 3 }).nullable();
+            t.text('data').nullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            kind: (t) => t.string('kind', 16),
+            code_hash: (t) => t.string('code_hash', 64).nullable(),
+            user_code: (t) => t.string('user_code', 16).nullable(),
+            client_id: (t) => t.string('client_id', 2048),
+            session_id: (t) => t.string('session_id').nullable(),
+            account_id: (t) => t.string('account_id').nullable(),
+            requested_scope: (t) => t.text('requested_scope'),
+            granted_scope: (t) => t.text('granted_scope').nullable(),
+            redirect_uri: (t) => t.string('redirect_uri', 2048).nullable(),
+            code_challenge: (t) => t.string('code_challenge', 128).nullable(),
+            status: (t) => t.string('status', 16),
+            attempts: (t) => t.integer('attempts').defaultTo(0),
+            interval_seconds: (t) => t.integer('interval_seconds').nullable(),
+            last_polled_at: (t) => t.dateTime('last_polled_at', { useTz: true, precision: 3 }).nullable(),
+            data: (t) => t.text('data').nullable(),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_jtis',
+        /** `jti` já aceitos (asserções, provas DPoP), até expirarem — anti-replay entre instâncias. */
+        create: (t) => {
+            t.string('key', 100).primary();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+        },
+        columns: {
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
 ];
 /**
  * Probe searchPath-aware: `schema.hasTable` no Postgres ignora o

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.77.0",
+  "version": "0.78.0",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",