@adonis-agora/authkit-server 0.81.3 → 0.82.1

package/build/src/host/ui-dist/index.html

@@ -8,7 +8,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600;700&family=JetBrains+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-CIv26Mfg.js"></script>
+    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-C1eSfG8B.js"></script>
     <link rel="stylesheet" crossorigin href="/__AUTHKIT_BASE__/assets/index-DTSmD4RU.css">
   </head>
   <body>

package/build/src/pat/lucid_pat_store.js

@@ -1,5 +1,7 @@
 import { DateTime } from 'luxon';
 import { generatePatToken, hashPatToken } from './pat_tokens.js';
+/** Resolução de `lastUsedAt`: um uso dentro desta janela não regrava a linha. */
+const LAST_USED_RESOLUTION_MS = 60_000;
 /**
  * Implementação default do {@link PatStore} sobre um model Lucid composto de
  * `withPersonalAccessToken()`. A coluna DB `user_id` é mapeada de `accountId`.
@@ -43,10 +45,14 @@ export function lucidPatStore(Model) {
             const row = await Model.query().where('token_hash', hash).first();
             if (!row)
                 return null;
-            if (row.expiresAt && row.expiresAt < DateTime.now())
+            const now = DateTime.now();
+            if (row.expiresAt && row.expiresAt < now)
                 return null;
-            row.lastUsedAt = DateTime.now();
-            await row.save();
+            if (!row.lastUsedAt ||
+                now.toMillis() - row.lastUsedAt.toMillis() >= LAST_USED_RESOLUTION_MS) {
+                row.lastUsedAt = now;
+                await row.save();
+            }
             return {
                 accountId: row.userId,
                 scopes: row.scopes ?? [],

package/build/src/pat/pat_store.d.ts

@@ -5,6 +5,7 @@ export interface PatRecord {
     scopes: string[];
     audience: string | null;
     createdAt: string;
+    /** Last successful lookup, at a one-minute resolution (`lucidPatStore` writes it at most once a minute). */
     lastUsedAt: string | null;
     expiresAt: string | null;
 }

package/build/src/schema/ensure.d.ts

@@ -38,6 +38,8 @@ export interface EnsureSchemaReport {
     created: string[];
     /** Colunas adicionadas em tabelas já existentes: tabela → colunas. */
     altered: Record<string, string[]>;
+    /** Índices criados em tabelas já existentes: tabela → nomes. Ausente quando nenhum. */
+    indexed?: Record<string, string[]>;
     /**
      * Desfecho da coluna `login_methods`. `ensured: false` significa que a tabela
      * da conta não existe no banco, então NADA foi feito — e é o caso que
@@ -53,5 +55,8 @@ export interface EnsureSchemaReport {
  * Garante que as tabelas do authkit existem e têm todas as colunas que esta
  * versão da lib espera. Aditivo e idempotente — seguro de rodar em todo boot
  * e dentro de migrations.
+ *
+ * `db` é o manager (`Database`, no boot) ou o client da própria migration
+ * (`this.db`, um `QueryClient`/`TransactionClient`, usado como está).
  */
 export declare function ensureAuthkitSchema(db: any, options?: EnsureSchemaOptions): Promise<EnsureSchemaReport>;

package/build/src/schema/ensure.js

@@ -23,6 +23,11 @@
  * }
  * ```
  */
+/** Busca por conta (`account_id`) e limpeza dos expirados (`expires_at`). */
+const OIDC_PAYLOAD_INDEXES = [
+    { name: 'authkit_oidc_payloads_account_idx', columns: ['model_name', 'account_id'] },
+    { name: 'authkit_oidc_payloads_expires_idx', columns: ['expires_at'] },
+];
 const TABLES = [
     {
         name: 'authkit_oidc_payloads',
@@ -35,6 +40,9 @@ const TABLES = [
             t.string('uid', 255).nullable().index();
             t.timestamp('expires_at', { useTz: true }).nullable();
             t.primary(['model_name', 'id']);
+            t.string('account_id', 255).nullable();
+            for (const index of OIDC_PAYLOAD_INDEXES)
+                t.index(index.columns, index.name);
         },
         columns: {
             id: (t) => t.string('id', 255),
@@ -44,7 +52,9 @@ const TABLES = [
             user_code: (t) => t.string('user_code', 255).nullable().index(),
             uid: (t) => t.string('uid', 255).nullable().index(),
             expires_at: (t) => t.timestamp('expires_at', { useTz: true }).nullable(),
+            account_id: (t) => t.string('account_id', 255).nullable(),
         },
+        indexes: OIDC_PAYLOAD_INDEXES,
     },
     {
         name: 'auth_settings',
@@ -448,12 +458,56 @@ const TABLES = [
         },
     },
 ];
+/** Linhas de um `rawQuery`, no formato de cada driver (pg, mysql2, sqlite). */
+function catalogRows(result) {
+    if (Array.isArray(result))
+        return Array.isArray(result[0]) ? result[0] : result;
+    return result?.rows ?? [];
+}
+async function catalogHas(conn, sql, bindings) {
+    return catalogRows(await conn.rawQuery(sql, bindings)).length > 0;
+}
+const SQLITE_DIALECTS = new Set(['sqlite3', 'better-sqlite3', 'libsql']);
+/**
+ * Nome de tabela (`tabela` ou `schema.tabela`) como o `to_regclass` espera, com cada
+ * parte entre aspas — o mesmo identificador que o knex gera.
+ */
+function pgRelation(table) {
+    return table
+        .split('.')
+        .map((part) => `"${part.replace(/"/g, '""')}"`)
+        .join('.');
+}
+/** `[schema, tabela]` para o MySQL; sem schema explícito vale o `database()` corrente. */
+function mysqlRelation(table) {
+    const dot = table.indexOf('.');
+    return dot === -1 ? [null, table] : [table.slice(0, dot), table.slice(dot + 1)];
+}
 /**
- * Probe searchPath-aware: `schema.hasTable` no Postgres ignora o
- * search_path, então testamos com um SELECT de verdade (mesma técnica do
- * RuntimeSettings).
+ * Existência de tabela, coluna e índice pelo CATÁLOGO do dialeto, nunca por um
+ * SELECT na própria tabela: dentro de uma transação do Postgres (uma migration do
+ * host), um SELECT numa tabela ausente aborta a transação inteira. No Postgres a
+ * resolução é pelo search_path (`to_regclass`), como faz uma query de verdade.
+ * Dialeto sem consulta conhecida cai no SELECT de prova.
  */
 async function tableExists(conn, table) {
+    const dialect = conn.dialect?.name;
+    if (dialect === 'postgres' || dialect === 'redshift') {
+        const found = catalogRows(await conn.rawQuery('select to_regclass(?) as oid', [pgRelation(table)]));
+        return found[0]?.oid != null;
+    }
+    if (dialect === 'mysql') {
+        const [schema, name] = mysqlRelation(table);
+        return catalogHas(conn, 'select 1 from information_schema.tables where table_schema = coalesce(?, database()) and table_name = ? limit 1', [schema, name]);
+    }
+    if (dialect && SQLITE_DIALECTS.has(dialect)) {
+        return catalogHas(conn, "select 1 from sqlite_master where type = 'table' and name = ?", [
+            table,
+        ]);
+    }
+    if (dialect === 'mssql') {
+        return catalogHas(conn, "select 1 where object_id(?, 'U') is not null", [table]);
+    }
     try {
         await conn.from(table).limit(1);
         return true;
@@ -463,6 +517,20 @@ async function tableExists(conn, table) {
     }
 }
 async function columnExists(conn, table, column) {
+    const dialect = conn.dialect?.name;
+    if (dialect === 'postgres' || dialect === 'redshift') {
+        return catalogHas(conn, 'select 1 from pg_attribute where attrelid = to_regclass(?) and attname = ? and attnum > 0 and not attisdropped', [pgRelation(table), column]);
+    }
+    if (dialect === 'mysql') {
+        const [schema, name] = mysqlRelation(table);
+        return catalogHas(conn, 'select 1 from information_schema.columns where table_schema = coalesce(?, database()) and table_name = ? and column_name = ? limit 1', [schema, name, column]);
+    }
+    if (dialect && SQLITE_DIALECTS.has(dialect)) {
+        return catalogHas(conn, 'select 1 from pragma_table_info(?) where name = ?', [table, column]);
+    }
+    if (dialect === 'mssql') {
+        return catalogHas(conn, 'select 1 where col_length(?, ?) is not null', [table, column]);
+    }
     try {
         await conn.from(table).select(column).limit(1);
         return true;
@@ -471,13 +539,62 @@ async function columnExists(conn, table, column) {
         return false;
     }
 }
+/** O índice existe? Por nome, no catálogo do dialeto. `null` = dialeto sem consulta conhecida. */
+async function indexExists(conn, table, name) {
+    const dialect = conn.dialect?.name;
+    if (dialect === 'postgres' || dialect === 'redshift') {
+        const found = catalogRows(await conn.rawQuery('select to_regclass(?) as oid', [name]));
+        return found[0]?.oid != null;
+    }
+    if (dialect === 'mysql') {
+        const [schema, relation] = mysqlRelation(table);
+        return catalogHas(conn, 'select 1 from information_schema.statistics where table_schema = coalesce(?, database()) and table_name = ? and index_name = ? limit 1', [schema, relation, name]);
+    }
+    if (dialect && SQLITE_DIALECTS.has(dialect)) {
+        return catalogHas(conn, "select 1 from sqlite_master where type = 'index' and name = ?", [
+            name,
+        ]);
+    }
+    if (dialect === 'mssql') {
+        return catalogHas(conn, 'select 1 from sys.indexes where name = ? and object_id = object_id(?)', [name, table]);
+    }
+    return null;
+}
+/**
+ * Cria o índice quando falta. Idempotente: um índice já existente (inclusive
+ * criado por outra instância no mesmo boot) não é erro.
+ */
+async function ensureIndex(conn, table, index) {
+    if ((await indexExists(conn, table, index.name)) === true)
+        return false;
+    try {
+        await conn.schema.alterTable(table, (t) => t.index(index.columns, index.name));
+        return true;
+    }
+    catch (error) {
+        const exists = await indexExists(conn, table, index.name).catch(() => null);
+        if (exists === true)
+            return false;
+        if (exists === null && /already exists|duplicate/i.test(String(error?.message))) {
+            return false;
+        }
+        throw error;
+    }
+}
 /**
  * Garante que as tabelas do authkit existem e têm todas as colunas que esta
  * versão da lib espera. Aditivo e idempotente — seguro de rodar em todo boot
  * e dentro de migrations.
+ *
+ * `db` é o manager (`Database`, no boot) ou o client da própria migration
+ * (`this.db`, um `QueryClient`/`TransactionClient`, usado como está).
  */
 export async function ensureAuthkitSchema(db, options = {}) {
-    const conn = options.connection ? db.connection(options.connection) : db.connection();
+    const conn = typeof db.connection !== 'function'
+        ? db
+        : options.connection
+            ? db.connection(options.connection)
+            : db.connection();
     const report = {
         created: [],
         altered: {},
@@ -507,6 +624,15 @@ export async function ensureAuthkitSchema(db, options = {}) {
                 report.altered[def.name] = [];
             report.altered[def.name].push(column);
         }
+        for (const index of def.indexes ?? []) {
+            if (!(await ensureIndex(conn, def.name, index)))
+                continue;
+            if (!report.indexed)
+                report.indexed = {};
+            if (!report.indexed[def.name])
+                report.indexed[def.name] = [];
+            report.indexed[def.name].push(index.name);
+        }
     }
     // Coluna `login_methods` na tabela da CONTA — a tabela é HOST-owned (não está
     // em TABLES porque o nome/shape são decisão do app), mas a LIB consome a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.81.3",
+  "version": "0.82.1",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -105,7 +105,7 @@
     }
   },
   "dependencies": {
-    "@adonis-agora/authkit-core": "0.10.0",
+    "@adonis-agora/authkit-core": "0.10.1",
     "@simplewebauthn/browser": "14.0.0",
     "@simplewebauthn/server": "14.0.3",
     "jose": "6.2.13",
@@ -116,30 +116,30 @@
     "qrcode": "1.5.4"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-react": "0.25.0",
-    "@adonis-agora/durable": "0.45.0",
-    "@adonis-agora/telescope": "0.22.0",
+    "@adonis-agora/authkit-react": "0.25.1",
+    "@adonis-agora/durable": "0.53.0",
+    "@adonis-agora/telescope": "0.23.0",
     "@adonisjs/ally": "6.3.2",
     "@adonisjs/auth": "10.1.0",
     "@adonisjs/core": "7.6.0",
     "@adonisjs/drive": "4.0.0",
     "@adonisjs/lucid": "22.4.2",
     "@adonisjs/redis": "11.0.0",
-    "@adonisjs/session": "8.1.0",
+    "@adonisjs/session": "8.3.0",
     "@adonisjs/shield": "9.0.0",
     "@adonisjs/tsconfig": "2.0.0",
     "@japa/assert": "4.2.0",
-    "@japa/runner": "5.3.0",
-    "@poppinss/ts-exec": "1.4.4",
+    "@japa/runner": "5.4.0",
+    "@poppinss/ts-exec": "1.5.1",
     "@tailwindcss/cli": "4.3.3",
-    "@tanstack/intent": "0.4.0",
-    "@tanstack/react-query": "5.102.8",
+    "@tanstack/intent": "0.5.6",
+    "@tanstack/react-query": "5.104.5",
     "@types/better-sqlite3": "9.6.0",
     "@types/ioredis-mock": "8.2.8",
     "@types/koa": "3.0.3",
     "@types/koa-mount": "4.0.5",
     "@types/luxon": "3.7.6",
-    "@types/node": "26.5.1",
+    "@types/node": "26.6.5",
     "@types/qrcode": "1.5.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
@@ -151,15 +151,18 @@
     "ioredis": "6.0.0",
     "ioredis-mock": "8.13.1",
     "luxon": "3.7.2",
+    "mysql2": "3.24.6",
     "nuqs": "2.10.2",
+    "pg": "8.23.1",
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "react-error-boundary": "6.1.6",
     "recharts": "3.10.1",
     "reflect-metadata": "0.2.2",
     "tempura": "0.4.1",
+    "testcontainers": "12.2.1",
     "typescript": "7.0.2",
-    "vite": "8.3.4"
+    "vite": "8.3.5"
   },
   "scripts": {
     "build": "node scripts/build_host_css.mjs && node scripts/build_webauthn.mjs && node scripts/build_ui.mjs && node -e \"const fs=require('node:fs');for(const d of ['build/stubs','build/host/views'])fs.rmSync(d,{recursive:true,force:true})\" && tsc && node -e \"require('node:fs').cpSync('src/host/assets','build/src/host/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/src/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/src/password/common_passwords.txt')\"",

package/skills/authkit-idp-setup/SKILL.md

@@ -83,8 +83,12 @@ export default authServerConfig
 
 `adapter` is where oidc-provider persists grants/tokens/codes: `adapters.redis({
 connection })` requires `@adonisjs/redis` configured; `adapters.database({
-connection? })` uses Lucid and requires running the `authkit_oidc_payloads`
-migration. `accountStore` is the identity contract — `lucidAccountStore(AuthUser)`
+connection? })` uses Lucid and stores artifacts in `authkit_oidc_payloads`, which
+`ensureAuthkitSchema` creates on boot (with `schema: { autoManage: false }`, call it
+from a migration). The table carries an indexed `account_id` column so per-account
+session lookups and revocation stay in SQL; rows with a NULL `account_id` are still
+found and get classified on read, so no backfill is needed. Works on Postgres,
+MySQL and SQLite; expired rows are pruned every 10 minutes per connection. `accountStore` is the identity contract — `lucidAccountStore(AuthUser)`
 derives `findAccount`/`verifyCredentials` from your user model.
 
 Source: `stubs/config/authkit.stub`, `src/define_config.ts` (`AuthServerConfigInput`),