@adonis-agora/authkit-server 0.82.1 → 0.82.3

package/build/src/accounts/account_store.d.ts

@@ -608,6 +608,18 @@ export interface OrganizationsCapability {
     listOrgsForAccount(accountId: string): Promise<Array<OrgSummary & {
         role: string;
     }>>;
+    /**
+     * OPTIONAL: every org that has at least one member whose account exists, with
+     * its member count, in a bounded number of queries. Must return exactly what
+     * the admin fallback builds by walking `listAccounts` (admin order) and calling
+     * `listOrgsForAccount` per account: orgs in first-seen order, `role` being the
+     * role of the first member seen in that order, `memberCount` being
+     * `listOrgMembers(orgId).length`. Absent → the admin service uses that walk.
+     */
+    listAllOrgsWithMemberCount?(): Promise<Array<OrgSummary & {
+        role: string;
+        memberCount: number;
+    }>>;
     updateOrg(orgId: string, patch: {
         name?: string;
         logoUrl?: string | null;

package/build/src/accounts/lucid_account_store.js

@@ -1,4 +1,3 @@
-import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 import { PasswordManager } from '../password/password_manager.js';
 import { buildCore } from './lucid_store/core.js';
 import { buildLoginMethods, supportsLoginMethodsColumn } from './lucid_store/login_methods.js';
@@ -7,7 +6,7 @@ import { defaultOrganizationModels } from './lucid_store/organization_models.js'
 import { buildOrganizations } from './lucid_store/organizations.js';
 import { buildPasswordExpiration, buildPasswordHistory } from './lucid_store/password_hygiene.js';
 import { buildProviderIdentity } from './lucid_store/provider_identity.js';
-import { hasTable, } from './lucid_store/shared.js';
+import { defaultWebauthnCeremonies, hasTable, } from './lucid_store/shared.js';
 import { buildDeletion, buildEmailVerificationStatus, buildProfile, buildStatus, hasColumn, } from './lucid_store/status_profile.js';
 import { buildWebauthn } from './lucid_store/webauthn.js';
 export function resolveEmailTokens(input) {
@@ -122,6 +121,35 @@ function resolveAccountTable(Model) {
     }
     return undefined;
 }
+/** Up to this many ids, filter with `WHERE IN`; above it, read every id instead. */
+const ADMIN_ORDER_IN_LIMIT = 500;
+/**
+ * Of `accountIds`, the ones that exist, in the order `listAccounts` pages them
+ * (`ORDER BY email ASC`, sorted by the database so collation matches). One query,
+ * plain rows (no model hydration), primary key only.
+ */
+async function listAccountIdsInAdminOrder(Model, accountIds) {
+    if (accountIds.length === 0)
+        return [];
+    Model.boot?.();
+    const pk = Model.$columnsDefinitions?.get?.('id')?.columnName ?? 'id';
+    const readAll = async () => (await Model.query().select(pk).orderBy('email', 'asc').pojo());
+    let rows;
+    if (accountIds.length <= ADMIN_ORDER_IN_LIMIT) {
+        try {
+            rows = await Model.query().select(pk).whereIn(pk, accountIds).orderBy('email', 'asc').pojo();
+        }
+        catch {
+            // e.g. a member row whose account id doesn't fit the key type: the full read
+            // never binds member ids, exactly like the `listAccounts` walk.
+            rows = await readAll();
+        }
+    }
+    else {
+        rows = await readAll();
+    }
+    return rows.map((row) => String(row[pk]));
+}
 export function lucidAccountStore(Model, options = {}) {
     const mfaIssuer = options.mfaIssuer ?? 'AuthKit';
     const recoveryCodeCount = options.recoveryCodeCount ?? 8;
@@ -147,10 +175,7 @@ export function lucidAccountStore(Model, options = {}) {
     };
     // Cerimônias WebAuthn: reais por default, injetáveis para testes.
     const ceremonies = {
-        generateRegistrationOptions,
-        verifyRegistrationResponse,
-        generateAuthenticationOptions,
-        verifyAuthenticationResponse,
+        ...defaultWebauthnCeremonies,
         ...options.webauthnCeremonies,
     };
     const passwords = new PasswordManager(options.password, {
@@ -246,6 +271,7 @@ export function lucidAccountStore(Model, options = {}) {
                         const row = await Model.find(accountId);
                         return row?.email ?? null;
                     },
+                    listAccountIdsInAdminOrder: (accountIds) => listAccountIdsInAdminOrder(Model, accountIds),
                 }),
             }
             : {}),

package/build/src/accounts/lucid_store/organizations.d.ts

@@ -9,5 +9,11 @@ export interface OrgStoreContext {
     InvitationModel: any;
     /** Mapa accountId → email, para validar aceitação de convite. */
     findAccountEmail: (accountId: string) => Promise<string | null>;
+    /**
+     * Of the given account ids, the ones whose account exists, in the admin
+     * listing order (`listAccounts`: email asc). When present, the store exposes
+     * `listAllOrgsWithMemberCount` (bounded queries for the admin org list).
+     */
+    listAccountIdsInAdminOrder?: (accountIds: string[]) => Promise<string[]>;
 }
 export declare function buildOrganizations(ctx: OrgStoreContext): OrganizationsCapability;

package/build/src/accounts/lucid_store/organizations.js

@@ -1,5 +1,15 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { DateTime } from 'luxon';
+/** Max ids per `WHERE IN` (stays well below every dialect's bind-parameter limit). */
+const IN_CHUNK = 500;
+/** `Model.findMany` in chunks of {@link IN_CHUNK} ids. */
+async function findManyChunked(Model, ids) {
+    const rows = [];
+    for (let i = 0; i < ids.length; i += IN_CHUNK) {
+        rows.push(...(await Model.findMany(ids.slice(i, i + IN_CHUNK))));
+    }
+    return rows;
+}
 function toOrgSummary(row) {
     return {
         id: row.id,
@@ -49,8 +59,62 @@ async function countOwners(MemberModel, orgId) {
     return Number(result[0]?.$extras?.total ?? 0);
 }
 export function buildOrganizations(ctx) {
-    const { OrgModel, MemberModel, InvitationModel, findAccountEmail } = ctx;
+    const { OrgModel, MemberModel, InvitationModel, findAccountEmail, listAccountIdsInAdminOrder } = ctx;
     return {
+        ...(listAccountIdsInAdminOrder
+            ? {
+                /**
+                 * Admin org list in 3 queries (all memberships, the member accounts in
+                 * admin order, the orgs) instead of walking every account. Mirrors the
+                 * fallback in `AdminOrgsService.listOrgs` exactly: accounts in
+                 * `listAccounts` order (email asc), each account's memberships in the
+                 * same (natural) order `listOrgsForAccount` reads them, first sighting of
+                 * an org wins (its `role`), and `memberCount` counts every member row
+                 * (like `listOrgMembers(orgId).length`).
+                 */
+                async listAllOrgsWithMemberCount() {
+                    const memberships = await MemberModel.query();
+                    if (memberships.length === 0)
+                        return [];
+                    const byAccount = new Map();
+                    const memberCount = new Map();
+                    for (const m of memberships) {
+                        const accountId = String(m.accountId);
+                        const orgId = String(m.organizationId);
+                        memberCount.set(orgId, (memberCount.get(orgId) ?? 0) + 1);
+                        const list = byAccount.get(accountId);
+                        if (list)
+                            list.push(m);
+                        else
+                            byAccount.set(accountId, [m]);
+                    }
+                    const accountIds = await listAccountIdsInAdminOrder([...byAccount.keys()]);
+                    const orgs = new Map();
+                    for (const org of await findManyChunked(OrgModel, [...memberCount.keys()])) {
+                        orgs.set(String(org.id), org);
+                    }
+                    const result = [];
+                    const seen = new Set();
+                    for (const accountId of accountIds) {
+                        for (const m of byAccount.get(String(accountId)) ?? []) {
+                            const orgId = String(m.organizationId);
+                            if (seen.has(orgId))
+                                continue;
+                            const org = orgs.get(orgId);
+                            if (!org)
+                                continue;
+                            seen.add(orgId);
+                            result.push({
+                                ...toOrgSummary(org),
+                                role: m.role,
+                                memberCount: memberCount.get(orgId) ?? 0,
+                            });
+                        }
+                    }
+                    return result;
+                },
+            }
+            : {}),
         async createOrg(input) {
             const { randomUUID } = await import('node:crypto');
             const org = await OrgModel.create({

package/build/src/accounts/lucid_store/shared.d.ts

@@ -1,4 +1,4 @@
-import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
+import type { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
 import type { AuditSink } from '../../audit/audit_sink.js';
 import type { PasswordManager } from '../../password/password_manager.js';
 import type { AuthAccount } from '../account_store.js';
@@ -23,6 +23,12 @@ export interface WebauthnCeremonies {
     generateAuthenticationOptions: typeof generateAuthenticationOptions;
     verifyAuthenticationResponse: typeof verifyAuthenticationResponse;
 }
+/**
+ * As cerimônias reais (default de {@link WebauthnCeremonies}). Todas já são
+ * assíncronas no `@simplewebauthn/server`; cada uma só espera o import lazy antes
+ * de delegar.
+ */
+export declare const defaultWebauthnCeremonies: WebauthnCeremonies;
 /** RP (Relying Party) do WebAuthn usado nas cerimônias. */
 export interface ResolvedRp {
     rpName: string;

package/build/src/accounts/lucid_store/shared.js

@@ -1,4 +1,28 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+/**
+ * `@simplewebauthn/server` carregado na primeira cerimônia, não no boot: a maioria
+ * dos processos (workers, ace, apps sem passkeys) nunca faz uma. Um import por
+ * processo; uma falha não fica em cache (a próxima cerimônia tenta de novo).
+ */
+let simpleWebauthn;
+function loadSimpleWebauthn() {
+    simpleWebauthn ??= import('@simplewebauthn/server').catch((error) => {
+        simpleWebauthn = undefined;
+        throw error;
+    });
+    return simpleWebauthn;
+}
+/**
+ * As cerimônias reais (default de {@link WebauthnCeremonies}). Todas já são
+ * assíncronas no `@simplewebauthn/server`; cada uma só espera o import lazy antes
+ * de delegar.
+ */
+export const defaultWebauthnCeremonies = {
+    generateRegistrationOptions: async (options) => (await loadSimpleWebauthn()).generateRegistrationOptions(options),
+    verifyRegistrationResponse: async (options) => (await loadSimpleWebauthn()).verifyRegistrationResponse(options),
+    generateAuthenticationOptions: async (options) => (await loadSimpleWebauthn()).generateAuthenticationOptions(options),
+    verifyAuthenticationResponse: async (options) => (await loadSimpleWebauthn()).verifyAuthenticationResponse(options),
+};
 export const sha256 = (value) => createHash('sha256').update(value).digest('hex');
 /** Recovery code legível: 10 chars hex em duas metades (ex.: a1b2c-3d4e5). */
 export function generateRecoveryCode() {

package/build/src/host/admin_api/admin_orgs_service.js

@@ -55,6 +55,11 @@ export class AdminOrgsService {
         const store = this.cfg.accountStore;
         if (!supportsOrganizations(store))
             return { ok: false, reason: 'not_supported' };
+        // Fast path: stores that can answer in a bounded number of queries (the Lucid
+        // store does). Same list, same order as the walk below.
+        if (typeof store.listAllOrgsWithMemberCount === 'function') {
+            return store.listAllOrgsWithMemberCount();
+        }
         // O store não tem listAllOrgs — acumulamos via memberships de todas as contas.
         // Para admin, fazemos um listAccounts full e coletamos todas as orgs únicas.
         // Mais eficiente: usa a tabela de organizations diretamente pelo listOrgMembers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.82.1",
+  "version": "0.82.3",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",