@adonis-agora/authkit-server 0.82.0 → 0.82.2

package/build/src/accounts/lucid_account_store.js

@@ -1,4 +1,3 @@
-import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 import { PasswordManager } from '../password/password_manager.js';
 import { buildCore } from './lucid_store/core.js';
 import { buildLoginMethods, supportsLoginMethodsColumn } from './lucid_store/login_methods.js';
@@ -7,7 +6,7 @@ import { defaultOrganizationModels } from './lucid_store/organization_models.js'
 import { buildOrganizations } from './lucid_store/organizations.js';
 import { buildPasswordExpiration, buildPasswordHistory } from './lucid_store/password_hygiene.js';
 import { buildProviderIdentity } from './lucid_store/provider_identity.js';
-import { hasTable, } from './lucid_store/shared.js';
+import { defaultWebauthnCeremonies, hasTable, } from './lucid_store/shared.js';
 import { buildDeletion, buildEmailVerificationStatus, buildProfile, buildStatus, hasColumn, } from './lucid_store/status_profile.js';
 import { buildWebauthn } from './lucid_store/webauthn.js';
 export function resolveEmailTokens(input) {
@@ -147,10 +146,7 @@ export function lucidAccountStore(Model, options = {}) {
     };
     // Cerimônias WebAuthn: reais por default, injetáveis para testes.
     const ceremonies = {
-        generateRegistrationOptions,
-        verifyRegistrationResponse,
-        generateAuthenticationOptions,
-        verifyAuthenticationResponse,
+        ...defaultWebauthnCeremonies,
         ...options.webauthnCeremonies,
     };
     const passwords = new PasswordManager(options.password, {

package/build/src/accounts/lucid_store/organizations.js

@@ -79,9 +79,17 @@ export function buildOrganizations(ctx) {
         },
         async listOrgsForAccount(accountId) {
             const memberships = await MemberModel.query().where('account_id', accountId);
+            if (memberships.length === 0)
+                return [];
+            // One query for every org (by primary key, like `find`), instead of one per
+            // membership. The result keeps the memberships' order.
+            const ids = [...new Set(memberships.map((m) => m.organizationId))];
+            const orgs = new Map();
+            for (const org of await OrgModel.findMany(ids))
+                orgs.set(String(org.id), org);
             const result = [];
             for (const m of memberships) {
-                const org = await OrgModel.find(m.organizationId);
+                const org = orgs.get(String(m.organizationId));
                 if (org)
                     result.push({ ...toOrgSummary(org), role: m.role });
             }

package/build/src/accounts/lucid_store/shared.d.ts

@@ -1,4 +1,4 @@
-import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
+import type { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
 import type { AuditSink } from '../../audit/audit_sink.js';
 import type { PasswordManager } from '../../password/password_manager.js';
 import type { AuthAccount } from '../account_store.js';
@@ -23,6 +23,12 @@ export interface WebauthnCeremonies {
     generateAuthenticationOptions: typeof generateAuthenticationOptions;
     verifyAuthenticationResponse: typeof verifyAuthenticationResponse;
 }
+/**
+ * As cerimônias reais (default de {@link WebauthnCeremonies}). Todas já são
+ * assíncronas no `@simplewebauthn/server`; cada uma só espera o import lazy antes
+ * de delegar.
+ */
+export declare const defaultWebauthnCeremonies: WebauthnCeremonies;
 /** RP (Relying Party) do WebAuthn usado nas cerimônias. */
 export interface ResolvedRp {
     rpName: string;

package/build/src/accounts/lucid_store/shared.js

@@ -1,4 +1,28 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+/**
+ * `@simplewebauthn/server` carregado na primeira cerimônia, não no boot: a maioria
+ * dos processos (workers, ace, apps sem passkeys) nunca faz uma. Um import por
+ * processo; uma falha não fica em cache (a próxima cerimônia tenta de novo).
+ */
+let simpleWebauthn;
+function loadSimpleWebauthn() {
+    simpleWebauthn ??= import('@simplewebauthn/server').catch((error) => {
+        simpleWebauthn = undefined;
+        throw error;
+    });
+    return simpleWebauthn;
+}
+/**
+ * As cerimônias reais (default de {@link WebauthnCeremonies}). Todas já são
+ * assíncronas no `@simplewebauthn/server`; cada uma só espera o import lazy antes
+ * de delegar.
+ */
+export const defaultWebauthnCeremonies = {
+    generateRegistrationOptions: async (options) => (await loadSimpleWebauthn()).generateRegistrationOptions(options),
+    verifyRegistrationResponse: async (options) => (await loadSimpleWebauthn()).verifyRegistrationResponse(options),
+    generateAuthenticationOptions: async (options) => (await loadSimpleWebauthn()).generateAuthenticationOptions(options),
+    verifyAuthenticationResponse: async (options) => (await loadSimpleWebauthn()).verifyAuthenticationResponse(options),
+};
 export const sha256 = (value) => createHash('sha256').update(value).digest('hex');
 /** Recovery code legível: 10 chars hex em duas metades (ex.: a1b2c-3d4e5). */
 export function generateRecoveryCode() {

package/build/src/adapters/database_adapter.js

@@ -119,7 +119,8 @@ export class DatabaseAdapter {
             const accountId = payload.accountId;
             row.account_id = typeof accountId === 'string' && accountId ? accountId : null;
         }
-        const existing = await this.#query().where('id', id).first();
+        // Only whether the row exists matters: don't read the (possibly large) payload back.
+        const existing = await this.#query().where('id', id).select('id').first();
         if (existing) {
             await this.#query().where('id', id).update(row);
         }

package/build/src/adapters/redis_adapter.js

@@ -101,15 +101,23 @@ export class RedisAdapter {
         return this.find(id);
     }
     async consume(id) {
-        const found = await this.find(id);
-        if (!found)
+        const key = this.#key(id);
+        // GET + TTL in one round trip (a pipeline, read-only: nothing changes before the SET).
+        const results = await this.redis.pipeline().get(key).ttl(key).exec();
+        const [getError, data] = results?.[0] ?? [null, null];
+        if (getError)
+            throw getError;
+        if (!data)
             return;
+        const [ttlError, ttl] = results?.[1] ?? [null, -1];
+        if (ttlError)
+            throw ttlError;
+        const found = JSON.parse(data);
         found.consumed = Math.floor(Date.now() / 1000);
-        const ttl = await this.redis.ttl(this.#key(id));
         if (ttl > 0)
-            await this.redis.set(this.#key(id), JSON.stringify(found), 'EX', ttl);
+            await this.redis.set(key, JSON.stringify(found), 'EX', ttl);
         else
-            await this.redis.set(this.#key(id), JSON.stringify(found));
+            await this.redis.set(key, JSON.stringify(found));
     }
     async destroy(id) {
         await this.redis.del(this.#key(id));

package/build/src/host/persistent_rp_session.js

@@ -1,6 +1,25 @@
 import { ACCOUNT_IDP_SESSION_KEY, readIdpSession } from './idp_session_bridge.js';
 import { impersonationState } from './impersonation_session.js';
 import { assertAccountEnabled } from './login_attempt.js';
+/**
+ * How long (seconds) a renewal stays good enough: a linked RP whose IdP session was
+ * renewed less than this ago, with the current TTL, is not renewed again. Without
+ * it every authenticated request wrote the IdP session row and re-sent its cookie.
+ */
+const RENEW_RESOLUTION_SEC = 60;
+/**
+ * The linked RP's IdP session already expires between `ttl - RENEW_RESOLUTION_SEC`
+ * and `ttl` from now, i.e. it was renewed with this TTL moments ago. Renewing again
+ * would only move the expiry by those few seconds. A session that expires LATER
+ * than `now + ttl` (the TTL was lowered) is still renewed, which shortens it.
+ * Restoration (no local login yet) always renews.
+ */
+function renewedRecently(idp, ttl, current, linkedUid) {
+    if (!current || linkedUid !== idp.uid || typeof idp.exp !== 'number')
+        return false;
+    const remaining = idp.exp - Date.now() / 1000;
+    return remaining <= ttl && remaining > ttl - RENEW_RESOLUTION_SEC;
+}
 /** Same-host RP restoration: the signed IdP cookie is the persistent credential. */
 export async function ensureRpSession(ctx, sessionKey) {
     const service = await ctx.containerResolver.make('authkit.server');
@@ -39,7 +58,7 @@ export async function ensureRpSession(ctx, sessionKey) {
     }
     const adapter = service.provider.Session.adapter;
     const ttl = service.sessionTtlHolder.rememberSec;
-    if (adapter.renewSession) {
+    if (adapter.renewSession && !renewedRecently(idp, ttl, current, linkedUid)) {
         if (!(await adapter.renewSession(idp.id, ttl))) {
             if (linkedUid)
                 ctx.session.clear();