@adonis-agora/authkit-server 0.77.0 → 0.79.0

package/build/src/host/ui-dist/index.html

@@ -8,7 +8,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600;700&family=JetBrains+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-CIqtoNcO.js"></script>
+    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-LrScaR9C.js"></script>
     <link rel="stylesheet" crossorigin href="/__AUTHKIT_BASE__/assets/index-DTSmD4RU.css">
   </head>
   <body>

package/build/src/provider/oidc_service.d.ts

@@ -25,6 +25,11 @@ export declare class OidcService {
     get signingJwks(): {
         keys: Record<string, any>[];
     };
+    /**
+     * @internal Segredo derivado da app key para um uso (`label`) — HMAC dos nonces
+     * DPoP do Poppy, por exemplo. Igual em todas as instâncias, sem expor a chave.
+     */
+    deriveSecret(label: string): Buffer;
     /** Pathname do issuer sem barra final (ex.: `/oidc`). Vazio quando montado na raiz. */
     readonly mountPath: string;
     readonly recorder: MetricsRecorder;

package/build/src/provider/oidc_service.js

@@ -1,4 +1,4 @@
-import { timingSafeEqual } from 'node:crypto';
+import { createHmac, timingSafeEqual } from 'node:crypto';
 import { NoopRecorder } from '@adonis-agora/authkit-core';
 import Koa from 'koa';
 import mount from 'koa-mount';
@@ -41,6 +41,13 @@ export class OidcService {
     get signingJwks() {
         return this.#signingJwks;
     }
+    /**
+     * @internal Segredo derivado da app key para um uso (`label`) — HMAC dos nonces
+     * DPoP do Poppy, por exemplo. Igual em todas as instâncias, sem expor a chave.
+     */
+    deriveSecret(label) {
+        return createHmac('sha256', this.#appKey).update(`authkit:${label}`).digest();
+    }
     /** Pathname do issuer sem barra final (ex.: `/oidc`). Vazio quando montado na raiz. */
     mountPath;
     recorder;
@@ -325,7 +332,7 @@ export class OidcService {
     /** Verifica client_id + client_secret contra os clients da config (p/ endpoints custom como introspecção de PAT). */
     verifyClientCredentials(clientId, clientSecret) {
         const client = this.#clients.find((c) => c.clientId === clientId);
-        if (!client || !client.clientSecret)
+        if (!client?.clientSecret)
             return false;
         const a = Buffer.from(client.clientSecret);
         const b = Buffer.from(clientSecret);

package/build/src/schema/ensure.js

@@ -295,6 +295,158 @@ const TABLES = [
             created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
         },
     },
+    {
+        name: 'auth_agent_registry',
+        /**
+         * Agentes liberados (`allowed`) ou bloqueados (`blocked`) pelo console admin,
+         * somados ao `defineConfig` — PACT pelo `iss`, Poppy pelo `client_id`.
+         */
+        create: (t) => {
+            t.string('id').primary();
+            t.string('protocol', 16).notNullable();
+            t.string('identifier', 2048).notNullable();
+            t.string('status', 16).notNullable();
+            t.string('name').nullable();
+            t.string('jwks_uri', 2048).nullable();
+            t.string('updated_by').nullable();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+            t.dateTime('updated_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            protocol: (t) => t.string('protocol', 16),
+            identifier: (t) => t.string('identifier', 2048),
+            status: (t) => t.string('status', 16),
+            name: (t) => t.string('name').nullable(),
+            jwks_uri: (t) => t.string('jwks_uri', 2048).nullable(),
+            updated_by: (t) => t.string('updated_by').nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+            updated_at: (t) => t.dateTime('updated_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    /*
+     * Personal Agent Protocol (Poppy). Os Account Tokens são grants de
+     * `auth_agent_grants` (prefixo `pgrant_`) com o hash em
+     * `auth_agent_refresh_tokens`; aqui ficam Sessions, Session Tokens, pedidos de
+     * sign-in e os `jti` vistos. Mesmas regras de data das tabelas acima.
+     */
+    {
+        name: 'auth_poppy_sessions',
+        /**
+         * Uma Session: um usuário do agente (`user_id`, opaco) num agente
+         * (`client_id`). `account_id` é a conta a que ficou PRESA ao logar (não troca);
+         * `grant_id` o Account Token com que está logada agora (`null` = deslogada).
+         */
+        create: (t) => {
+            t.string('id').primary();
+            t.string('client_id', 2048).notNullable();
+            t.string('user_id').notNullable();
+            t.string('account_id').nullable().index();
+            t.string('grant_id').nullable().index();
+            t.text('scope').notNullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable();
+            t.dateTime('ended_at', { useTz: true, precision: 3 }).nullable();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+            t.dateTime('updated_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            client_id: (t) => t.string('client_id', 2048),
+            user_id: (t) => t.string('user_id'),
+            account_id: (t) => t.string('account_id').nullable().index(),
+            grant_id: (t) => t.string('grant_id').nullable().index(),
+            scope: (t) => t.text('scope'),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            ended_at: (t) => t.dateTime('ended_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+            updated_at: (t) => t.dateTime('updated_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_tokens',
+        /** Session Tokens — só o hash. `jkt` = chave DPoP; `null` = Bearer (MCP). */
+        create: (t) => {
+            t.string('token_hash', 64).primary();
+            t.string('session_id').notNullable().index();
+            t.string('client_id', 2048).notNullable();
+            t.string('user_id').notNullable();
+            t.string('account_id').nullable();
+            t.string('grant_id').nullable().index();
+            t.text('scope').notNullable();
+            t.string('resource', 2048).nullable();
+            t.string('jkt', 64).nullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            session_id: (t) => t.string('session_id').index(),
+            client_id: (t) => t.string('client_id', 2048),
+            user_id: (t) => t.string('user_id'),
+            account_id: (t) => t.string('account_id').nullable(),
+            grant_id: (t) => t.string('grant_id').nullable().index(),
+            scope: (t) => t.text('scope'),
+            resource: (t) => t.string('resource', 2048).nullable(),
+            jkt: (t) => t.string('jkt', 64).nullable(),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_requests',
+        /**
+         * Pedidos de sign-in: `authorize` (Direct — vira código após o consentimento),
+         * `device` (RFC 8628) e `mediated` (§4.7, aguardando o código de uso único).
+         * Códigos só como hash. Linhas expiradas são apagadas no próximo pedido.
+         */
+        create: (t) => {
+            t.string('id').primary();
+            t.string('kind', 16).notNullable();
+            t.string('code_hash', 64).nullable().unique();
+            t.string('user_code', 16).nullable().unique();
+            t.string('client_id', 2048).notNullable();
+            t.string('session_id').nullable();
+            t.string('account_id').nullable();
+            t.text('requested_scope').notNullable();
+            t.text('granted_scope').nullable();
+            t.string('redirect_uri', 2048).nullable();
+            t.string('code_challenge', 128).nullable();
+            t.string('status', 16).notNullable();
+            t.integer('attempts').notNullable().defaultTo(0);
+            t.integer('interval_seconds').nullable();
+            t.dateTime('last_polled_at', { useTz: true, precision: 3 }).nullable();
+            t.text('data').nullable();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+            t.dateTime('created_at', { useTz: true, precision: 3 }).notNullable();
+        },
+        columns: {
+            kind: (t) => t.string('kind', 16),
+            code_hash: (t) => t.string('code_hash', 64).nullable(),
+            user_code: (t) => t.string('user_code', 16).nullable(),
+            client_id: (t) => t.string('client_id', 2048),
+            session_id: (t) => t.string('session_id').nullable(),
+            account_id: (t) => t.string('account_id').nullable(),
+            requested_scope: (t) => t.text('requested_scope'),
+            granted_scope: (t) => t.text('granted_scope').nullable(),
+            redirect_uri: (t) => t.string('redirect_uri', 2048).nullable(),
+            code_challenge: (t) => t.string('code_challenge', 128).nullable(),
+            status: (t) => t.string('status', 16),
+            attempts: (t) => t.integer('attempts').defaultTo(0),
+            interval_seconds: (t) => t.integer('interval_seconds').nullable(),
+            last_polled_at: (t) => t.dateTime('last_polled_at', { useTz: true, precision: 3 }).nullable(),
+            data: (t) => t.text('data').nullable(),
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+            created_at: (t) => t.dateTime('created_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
+    {
+        name: 'auth_poppy_jtis',
+        /** `jti` já aceitos (asserções, provas DPoP), até expirarem — anti-replay entre instâncias. */
+        create: (t) => {
+            t.string('key', 100).primary();
+            t.dateTime('expires_at', { useTz: true, precision: 3 }).notNullable().index();
+        },
+        columns: {
+            expires_at: (t) => t.dateTime('expires_at', { useTz: true, precision: 3 }).nullable(),
+        },
+    },
 ];
 /**
  * Probe searchPath-aware: `schema.hasTable` no Postgres ignora o

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.77.0",
+  "version": "0.79.0",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -113,7 +113,7 @@
     "qrcode": "1.5.4"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-react": "0.23.0",
+    "@adonis-agora/authkit-react": "0.24.0",
     "@adonis-agora/durable": "0.40.0",
     "@adonis-agora/telescope": "0.21.1",
     "@adonisjs/ally": "6.3.0",