@adonis-agora/authkit-server 0.90.2 → 1.0.0-rc.1

package/build/src/host/admin_clients_service.js

@@ -1,5 +1,6 @@
 import { randomBytes } from 'node:crypto';
-import { assertClientMetadata } from './client_metadata.js';
+import { assertClientMetadata, ClientMetadataError, } from './client_metadata.js';
+import { CONSOLE_SSO_CLIENT_ID } from './console_sso.js';
 /** Métodos públicos (sem segredo) — espelham os "non-secret" do oidc-provider. */
 const PUBLIC_AUTH_METHODS = new Set(['none']);
 /** Gera um identificador opaco no estilo do oidc-provider (~43 chars base64url). */
@@ -51,6 +52,7 @@ export class AdminClientsService {
      */
     async create(input) {
         const clientId = (input.clientId ?? '').trim() || randomId();
+        assertNotReservedClientId(clientId);
         const confidential = !PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod);
         const clientSecret = confidential ? randomId() : undefined;
         const payload = this.#buildPayload(clientId, input, clientSecret);
@@ -60,15 +62,15 @@ export class AdminClientsService {
         return { clientId, clientSecret };
     }
     /**
-     * Cria um client PRESERVANDO um `clientSecret` fornecido externamente (em vez de
-     * gerar um aleatório). Útil para migração de clients estáticos do config, onde o
-     * secret original deve ser preservado para não quebrar apps já configurados.
+     * Cria um client com um `clientSecret` fornecido externamente (em vez de gerar
+     * um aleatório) — ex.: para manter o secret que os RPs já usam.
      *
      * Para clients públicos (auth method `none`), `providedSecret` é ignorado.
      * Lança se o `clientId` já existir no adapter — chame `find` antes.
      */
     async createWithSecret(input, providedSecret) {
         const clientId = (input.clientId ?? '').trim() || randomId();
+        assertNotReservedClientId(clientId);
         const confidential = !PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod);
         const clientSecret = confidential ? (providedSecret ?? randomId()) : undefined;
         const payload = this.#buildPayload(clientId, input, clientSecret);
@@ -98,9 +100,17 @@ export class AdminClientsService {
                 existing.token_endpoint_auth_method ??
                 'client_secret_basic',
             applicationType: input.applicationType ?? existing.application_type ?? 'web',
-            backchannelLogoutUri: input.backchannelLogoutUri ?? existing.backchannel_logout_uri,
+            backchannelLogoutUri: input.backchannelLogoutUri === null
+                ? undefined
+                : (input.backchannelLogoutUri ?? existing.backchannel_logout_uri),
             backchannelLogoutSessionRequired: input.backchannelLogoutSessionRequired ??
                 existing.backchannel_logout_session_required,
+            clientName: input.clientName === null
+                ? undefined
+                : (input.clientName ?? existing.client_name),
+            logoUri: input.logoUri === null
+                ? undefined
+                : (input.logoUri ?? existing.logo_uri),
         };
         const confidential = !PUBLIC_AUTH_METHODS.has(merged.tokenEndpointAuthMethod);
         // Mantém o secret atual se continua confidencial; se virou public, remove-o.
@@ -173,6 +183,10 @@ export class AdminClientsService {
         // sempre (sem `application_type` o oidc-provider assume `web`).
         if (input.applicationType === 'native')
             payload.application_type = 'native';
+        if (input.clientName)
+            payload.client_name = input.clientName;
+        if (input.logoUri)
+            payload.logo_uri = input.logoUri;
         if (input.backchannelLogoutUri) {
             payload.backchannel_logout_uri = input.backchannelLogoutUri;
             if (input.backchannelLogoutSessionRequired !== undefined) {
@@ -188,11 +202,13 @@ export class AdminClientsService {
         const result = {
             clientId: row.clientId,
             confidential: !!p.client_secret,
-            grants: p.grant_types ?? ['authorization_code', 'refresh_token'],
+            grantTypes: p.grant_types ?? ['authorization_code', 'refresh_token'],
             redirectUris: p.redirect_uris ?? [],
             postLogoutRedirectUris: p.post_logout_redirect_uris ?? [],
             tokenEndpointAuthMethod: authMethod,
             applicationType: p.application_type === 'native' ? 'native' : 'web',
+            clientName: typeof p.client_name === 'string' && p.client_name ? p.client_name : null,
+            logoUri: typeof p.logo_uri === 'string' && p.logo_uri ? p.logo_uri : null,
         };
         if (p.backchannel_logout_uri) {
             result.backchannelLogoutUri = p.backchannel_logout_uri;
@@ -202,3 +218,9 @@ export class AdminClientsService {
         return result;
     }
 }
+/** O `client_id` do client interno do console (ver `console_sso.ts`) não pode ser cadastrado. */
+function assertNotReservedClientId(clientId) {
+    if (clientId === CONSOLE_SSO_CLIENT_ID) {
+        throw new ClientMetadataError(`client_id "${clientId}" é reservado pelo authkit`);
+    }
+}

package/build/src/host/admin_console/admin_shell_controller.d.ts

@@ -1,4 +1,19 @@
 import type { HttpContext } from '@adonisjs/core/http';
+/** Id of the JSON data block the SPA reads its config from. */
+export declare const ADMIN_CONFIG_ELEMENT_ID = "authkit-admin-config";
+/**
+ * Serializes the config for an HTML data block: `<`, `>`, `&` and the JS line
+ * separators are escaped so no value can close the `<script>` element.
+ */
+export declare function serializeConfigBlock(config: Record<string, unknown>): string;
+/**
+ * Embeds the config as a `<script type="application/json">` data block right
+ * after `<body>`. A data block is never executed, so a strict CSP
+ * (`script-src 'self' 'nonce-…'`) leaves it alone; the SPA parses it.
+ * Also rewrites `/__AUTHKIT_BASE__/` → actual adminBase so all asset URLs
+ * produced by Vite (base: '/__AUTHKIT_BASE__/') resolve correctly at runtime.
+ */
+export declare function prepareShell(html: string, config: Record<string, unknown>): string;
 /**
  * Controla o serving do console admin React (Missão B).
  *
@@ -6,7 +21,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  * `serveAsset`  — serve arquivos estáticos do build (JS/CSS/fonts/images) com cache.
  *
  * O shell HTML é o index.html produzido pelo Vite build em `build/host/ui-dist/`.
- * O servidor injeta `window.__AUTHKIT__` e reescreve o placeholder de base dinâmica
+ * O servidor embute a config num data block JSON (`#authkit-admin-config`) e reescreve o placeholder de base dinâmica
  * `/__AUTHKIT_BASE__/` → `${adminBase}/assets/` para que todos os imports de assets
  * Vite resolvam corretamente independente do prefixo admin configurado.
  *

package/build/src/host/admin_console/admin_shell_controller.js

@@ -50,19 +50,33 @@ then restart the server.</p>
     }
 }
 // ─── Config injection ─────────────────────────────────────────────────────────
+/** Id of the JSON data block the SPA reads its config from. */
+export const ADMIN_CONFIG_ELEMENT_ID = 'authkit-admin-config';
 /**
- * Injects `window.__AUTHKIT__` into the HTML shell right after `<body>`.
+ * Serializes the config for an HTML data block: `<`, `>`, `&` and the JS line
+ * separators are escaped so no value can close the `<script>` element.
+ */
+export function serializeConfigBlock(config) {
+    return JSON.stringify(config)
+        .replace(/</g, '\\u003c')
+        .replace(/>/g, '\\u003e')
+        .replace(/&/g, '\\u0026')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
+/**
+ * Embeds the config as a `<script type="application/json">` data block right
+ * after `<body>`. A data block is never executed, so a strict CSP
+ * (`script-src 'self' 'nonce-…'`) leaves it alone; the SPA parses it.
  * Also rewrites `/__AUTHKIT_BASE__/` → actual adminBase so all asset URLs
  * produced by Vite (base: '/__AUTHKIT_BASE__/') resolve correctly at runtime.
  */
-function prepareShell(html, config) {
+export function prepareShell(html, config) {
     const adminBase = config.adminBase;
     // 1. Rewrite the Vite placeholder base in ALL occurrences (src/href attributes).
-    //    Vite puts `/__AUTHKIT_BASE__/assets/foo.js` so we rewrite `/__AUTHKIT_BASE__/`
-    //    to `${adminBase}/` so asset URLs become `${adminBase}/assets/foo.js`.
     const rewritten = html.replaceAll('/__AUTHKIT_BASE__/', `${adminBase}/`);
-    // 2. Inject config script right after <body>.
-    const script = `<script>window.__AUTHKIT__=${JSON.stringify(config)};</script>`;
+    // 2. Inject the config data block right after <body>.
+    const script = `<script type="application/json" id="${ADMIN_CONFIG_ELEMENT_ID}">${serializeConfigBlock(config)}</script>`;
     const bodyIdx = rewritten.indexOf('<body');
     if (bodyIdx === -1)
         return script + rewritten;
@@ -97,7 +111,7 @@ const MIME = {
  * `serveAsset`  — serve arquivos estáticos do build (JS/CSS/fonts/images) com cache.
  *
  * O shell HTML é o index.html produzido pelo Vite build em `build/host/ui-dist/`.
- * O servidor injeta `window.__AUTHKIT__` e reescreve o placeholder de base dinâmica
+ * O servidor embute a config num data block JSON (`#authkit-admin-config`) e reescreve o placeholder de base dinâmica
  * `/__AUTHKIT_BASE__/` → `${adminBase}/assets/` para que todos os imports de assets
  * Vite resolvam corretamente independente do prefixo admin configurado.
  *

package/build/src/host/admin_console/console_clients_controller.d.ts

@@ -5,6 +5,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  *
  * GET    {prefix}/api/clients                 → lista clients dinâmicos
  * POST   {prefix}/api/clients                 → criar client (secret retornado UMA vez)
+ * GET    {prefix}/api/clients/:id             → um client (404 se não existir)
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
@@ -15,16 +16,32 @@ export default class ConsoleClientsController {
         data: {
             clientId: string;
             confidential: boolean;
-            grants: string[];
+            grantTypes: string[];
             redirectUris: string[];
             postLogoutRedirectUris: string[];
             tokenEndpointAuthMethod: string;
             applicationType: import("../client_metadata.js").ApplicationType;
             backchannelLogoutUri: string | null;
             backchannelLogoutSessionRequired: boolean;
+            clientName: string | null;
+            logoUri: string | null;
         }[];
         canList: boolean;
     }>;
+    /** GET {prefix}/api/clients/:id */
+    show(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+    }>;
     /** POST {prefix}/api/clients */
     store(ctx: HttpContext): Promise<void | {
         clientId: string;
@@ -34,13 +51,15 @@ export default class ConsoleClientsController {
     update(ctx: HttpContext): Promise<void | {
         clientId: string;
         confidential: boolean;
-        grants: string[];
+        grantTypes: string[];
         redirectUris: string[];
         postLogoutRedirectUris: string[];
         tokenEndpointAuthMethod: string;
         applicationType: import("../client_metadata.js").ApplicationType;
         backchannelLogoutUri: string | null;
         backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
     }>;
     /** DELETE {prefix}/api/clients/:id */
     destroy(ctx: HttpContext): Promise<void | {

package/build/src/host/admin_console/console_clients_controller.js

@@ -15,6 +15,7 @@ function invalidMetadata(ctx, err) {
  *
  * GET    {prefix}/api/clients                 → lista clients dinâmicos
  * POST   {prefix}/api/clients                 → criar client (secret retornado UMA vez)
+ * GET    {prefix}/api/clients/:id             → um client (404 se não existir)
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
@@ -30,6 +31,14 @@ export default class ConsoleClientsController {
         const clients = await svc.list();
         return { data: clients.map(clientDto), canList: true };
     }
+    /** GET {prefix}/api/clients/:id */
+    async show(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const client = await new AdminClientsService(service).find(ctx.request.param('id'));
+        if (!client)
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        return clientDto(client);
+    }
     /** POST {prefix}/api/clients */
     async store(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');

package/build/src/host/admin_console/console_impersonation_controller.js

@@ -49,11 +49,7 @@ export default class ConsoleImpersonationController {
         if (!account) {
             return ctx.response.notFound(apiError('not_found', 'Usuário não encontrado.'));
         }
-        // Clients de RUNTIME. `cfg.clients` é sempre `[]` num host real — clients
-        // vivem no adapter, criados pelo console/Admin API/`authkit:clients:create`.
-        // Ler só o config fazia o painel devolver 404 SEMPRE, que é por que o botão
-        // do console nunca funcionou. O fallback para o config cobre hosts legados
-        // com clients estáticos e adapters que não enumeram.
+        // Clients vivem no adapter, criados pelo console/Admin API/`authkit:clients:create`.
         const panel = buildImpersonationPanel(cfg, targetId, await listRuntimeClients(service));
         if (!panel) {
             return ctx.response.notFound(apiError('no_token_exchange_client', 'Nenhum client habilitado ao grant token-exchange encontrado.'));
@@ -83,8 +79,7 @@ export default class ConsoleImpersonationController {
 }
 /**
  * Clients persistidos que podem hospedar o token-exchange. Best-effort: um
- * adapter sem `list` (ou que falhe) devolve lista vazia e o
- * `buildImpersonationPanel` cai no `cfg.clients`.
+ * adapter sem `list` (ou que falhe) devolve lista vazia e o painel responde 404.
  */
 async function listRuntimeClients(service) {
     try {
@@ -93,7 +88,7 @@ async function listRuntimeClients(service) {
             return [];
         return (await clients.list()).map((c) => ({
             clientId: c.clientId,
-            grants: c.grants,
+            grantTypes: c.grantTypes,
             confidential: c.confidential,
         }));
     }

package/build/src/host/admin_console/console_overview_controller.d.ts

@@ -5,7 +5,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  *
  * Métricas-resumo do IdP para o dashboard do console React. Reutiliza
  * `computeAdminStats` (mesma fonte do console Edge) e adiciona:
- * - `clientsCount`   — número de clients na config
+ * - `clientsCount`   — número de clients no adapter (0 quando o adapter não enumera)
  * - `auditTotal`     — total de eventos de auditoria (0 quando sink não suporta)
  * - `recentEvents`   — últimos 5 eventos de auditoria ([] quando não suporta)
  */
@@ -20,7 +20,7 @@ export default class ConsoleOverviewController {
         signUpsPerDay: import("../admin_stats_service.js").DailyPoint[];
         windowDays: number;
         auditSupported: boolean;
-        clientsCount: any;
+        clientsCount: number;
         auditTotal: any;
         recentEvents: any;
     }>;

package/build/src/host/admin_console/console_overview_controller.js

@@ -1,5 +1,6 @@
 import '../augmentations.js';
 import { LIST_FIRST_PAGE } from '../../pagination.js';
+import { AdminClientsService } from '../admin_clients_service.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { computeAdminStats } from '../admin_stats_service.js';
 /**
@@ -7,7 +8,7 @@ import { computeAdminStats } from '../admin_stats_service.js';
  *
  * Métricas-resumo do IdP para o dashboard do console React. Reutiliza
  * `computeAdminStats` (mesma fonte do console Edge) e adiciona:
- * - `clientsCount`   — número de clients na config
+ * - `clientsCount`   — número de clients no adapter (0 quando o adapter não enumera)
  * - `auditTotal`     — total de eventos de auditoria (0 quando sink não suporta)
  * - `recentEvents`   — últimos 5 eventos de auditoria ([] quando não suporta)
  */
@@ -17,7 +18,8 @@ export default class ConsoleOverviewController {
         const cfg = service.config;
         const sessions = new AdminSessionsService(service);
         const stats = await computeAdminStats(cfg, sessions);
-        const clientsCount = cfg.clients.length;
+        const clients = new AdminClientsService(service);
+        const clientsCount = clients.canList ? (await clients.list()).length : 0;
         const recentResult = typeof cfg.audit?.list === 'function'
             ? await cfg.audit.list({ page: LIST_FIRST_PAGE, size: 5 })
             : null;

package/build/src/host/admin_console_warning.d.ts

@@ -0,0 +1,8 @@
+/** The boot warning for an admin console with no `admin.authorize`. Same wording in every console. */
+export declare const ADMIN_CONSOLE_NO_AUTHORIZE_WARNING = "[@adonis-agora/authkit-server] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/authkit.ts.";
+/** Logs {@link ADMIN_CONSOLE_NO_AUTHORIZE_WARNING} once per process. */
+export declare function warnAdminConsoleUnauthorized(logger: {
+    warn: (message: string) => unknown;
+} | null | undefined): boolean;
+/** Test helper: lets the warning fire again. */
+export declare function resetAdminConsoleWarning(): void;

package/build/src/host/admin_console_warning.js

@@ -0,0 +1,18 @@
+/** The boot warning for an admin console with no `admin.authorize`. Same wording in every console. */
+export const ADMIN_CONSOLE_NO_AUTHORIZE_WARNING = '[@adonis-agora/authkit-server] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/authkit.ts.';
+let warned = false;
+/** Logs {@link ADMIN_CONSOLE_NO_AUTHORIZE_WARNING} once per process. */
+export function warnAdminConsoleUnauthorized(logger) {
+    if (warned)
+        return false;
+    warned = true;
+    if (logger)
+        logger.warn(ADMIN_CONSOLE_NO_AUTHORIZE_WARNING);
+    else
+        console.warn(ADMIN_CONSOLE_NO_AUTHORIZE_WARNING);
+    return true;
+}
+/** Test helper: lets the warning fire again. */
+export function resetAdminConsoleWarning() {
+    warned = false;
+}

package/build/src/host/admin_validators.d.ts

@@ -4,8 +4,7 @@ import { type ApplicationType } from './client_metadata.js';
  * Input de client OIDC — serve create E update (PATCH). Tudo opcional: no create
  * o controller aplica defaults (ver {@link clientCreateInput}); no update os campos
  * ausentes (undefined) são preservados pelo `AdminClientsService.update` (merge,
- * ver {@link clientPartialInput}). `grants` é aceito como alias de `grantTypes`
- * (o DTO de saída usa `grants`).
+ * ver {@link clientPartialInput}).
  */
 export declare const clientInputValidator: import("@vinejs/vine").VineValidator<import("@vinejs/vine").VineObject<{
     clientId: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
@@ -13,37 +12,41 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     redirectUris: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineString>>;
     postLogoutRedirectUris: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineString>>;
     grantTypes: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineEnum<readonly ["authorization_code", "refresh_token", "client_credentials", "urn:ietf:params:oauth:grant-type:token-exchange"]>>>;
-    grants: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineEnum<readonly ["authorization_code", "refresh_token", "client_credentials", "urn:ietf:params:oauth:grant-type:token-exchange"]>>>;
     tokenEndpointAuthMethod: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineEnum<readonly ["client_secret_basic", "client_secret_post", "none"]>>;
-    backchannelLogoutUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineString>;
+    backchannelLogoutUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
     backchannelLogoutSessionRequired: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineBoolean>;
+    clientName: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
+    logoUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
 }, {
     applicationType?: "native" | "web" | null | undefined;
     backchannelLogoutSessionRequired?: string | number | boolean | null | undefined;
     backchannelLogoutUri?: string | null | undefined;
     clientId?: string | null | undefined;
+    clientName?: string | null | undefined;
     grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | null | undefined;
-    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | null | undefined;
+    logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | null | undefined;
     redirectUris?: string[] | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | null | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
     backchannelLogoutSessionRequired?: boolean | undefined;
-    backchannelLogoutUri?: string | undefined;
+    backchannelLogoutUri?: string | null | undefined;
     clientId?: string | undefined;
+    clientName?: string | null | undefined;
     grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
-    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
+    logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
     backchannelLogoutSessionRequired?: boolean | undefined;
-    backchannelLogoutUri?: string | undefined;
+    backchannelLogoutUri?: string | null | undefined;
     clientId?: string | undefined;
+    clientName?: string | null | undefined;
     grantTypes?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
-    grants?: ("authorization_code" | "client_credentials" | "refresh_token" | "urn:ietf:params:oauth:grant-type:token-exchange")[] | undefined;
+    logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
@@ -55,10 +58,11 @@ export type ClientInputFields = {
     redirectUris?: string[];
     postLogoutRedirectUris?: string[];
     grantTypes?: string[];
-    grants?: string[];
     tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
-    backchannelLogoutUri?: string;
+    backchannelLogoutUri?: string | null;
     backchannelLogoutSessionRequired?: boolean;
+    clientName?: string | null;
+    logoUri?: string | null;
 };
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.

package/build/src/host/admin_validators.js

@@ -83,8 +83,7 @@ const grantTypeArray = vine.array(vine.enum(ALLOWED_GRANT_TYPES));
  * Input de client OIDC — serve create E update (PATCH). Tudo opcional: no create
  * o controller aplica defaults (ver {@link clientCreateInput}); no update os campos
  * ausentes (undefined) são preservados pelo `AdminClientsService.update` (merge,
- * ver {@link clientPartialInput}). `grants` é aceito como alias de `grantTypes`
- * (o DTO de saída usa `grants`).
+ * ver {@link clientPartialInput}).
  */
 export const clientInputValidator = vine.compile(vine.object({
     clientId: vine.string().trim().optional(),
@@ -96,11 +95,14 @@ export const clientInputValidator = vine.compile(vine.object({
     postLogoutRedirectUris: redirectUriArray.optional(),
     // grant_types restrito à allowlist; `implicit` e desconhecidos viram 422 (M10).
     grantTypes: grantTypeArray.optional(),
-    grants: grantTypeArray.optional(),
     tokenEndpointAuthMethod: authMethod.optional(),
     // backchannel_logout_uri também precisa ser URI absoluta (L10).
-    backchannelLogoutUri: vine.string().trim().url(URL_OPTS).optional(),
+    // `null` (update) remove a URI.
+    backchannelLogoutUri: vine.string().trim().url(URL_OPTS).nullable().optional(),
     backchannelLogoutSessionRequired: vine.boolean().optional(),
+    // `null` (update) removes them.
+    clientName: vine.string().trim().maxLength(200).nullable().optional(),
+    logoUri: vine.string().trim().url(URL_OPTS).nullable().optional(),
 }));
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.
@@ -114,10 +116,12 @@ export function clientCreateInput(v) {
         applicationType,
         redirectUris: v.redirectUris ?? [],
         postLogoutRedirectUris: v.postLogoutRedirectUris ?? [],
-        grantTypes: v.grantTypes ?? v.grants ?? [],
+        grantTypes: v.grantTypes ?? [],
         tokenEndpointAuthMethod: v.tokenEndpointAuthMethod ?? (applicationType === 'native' ? 'none' : 'client_secret_basic'),
         backchannelLogoutUri: v.backchannelLogoutUri || undefined,
         backchannelLogoutSessionRequired: v.backchannelLogoutSessionRequired,
+        clientName: v.clientName || undefined,
+        logoUri: v.logoUri || undefined,
     };
 }
 /**
@@ -132,15 +136,18 @@ export function clientPartialInput(v) {
         out.redirectUris = v.redirectUris;
     if (v.postLogoutRedirectUris !== undefined)
         out.postLogoutRedirectUris = v.postLogoutRedirectUris;
-    const grants = v.grantTypes ?? v.grants;
-    if (grants !== undefined)
-        out.grantTypes = grants;
+    if (v.grantTypes !== undefined)
+        out.grantTypes = v.grantTypes;
     if (v.tokenEndpointAuthMethod !== undefined)
         out.tokenEndpointAuthMethod = v.tokenEndpointAuthMethod;
     if (v.backchannelLogoutUri !== undefined)
-        out.backchannelLogoutUri = v.backchannelLogoutUri.trim() || undefined;
+        out.backchannelLogoutUri = v.backchannelLogoutUri?.trim() || null;
     if (v.backchannelLogoutSessionRequired !== undefined)
         out.backchannelLogoutSessionRequired = v.backchannelLogoutSessionRequired;
+    if (v.clientName !== undefined)
+        out.clientName = v.clientName?.trim() || null;
+    if (v.logoUri !== undefined)
+        out.logoUri = v.logoUri?.trim() || null;
     return out;
 }
 // ─── Usuários ───────────────────────────────────────────────────────────────

package/build/src/host/auth_host_config.d.ts

@@ -40,6 +40,11 @@ export interface AuthHostRuntimeConfig {
         prefix: string;
         poppyPrefix?: string;
     };
+    /**
+     * `accountSession.acceptIdpSession: false` com `authMethods: { password: false }`:
+     * o console só entra por um `accountLoginUrl` do host (`registerAuthHost` recusa sem ele).
+     */
+    consoleNeedsLoginUrl?: boolean;
     /**
      * API headless (Clerk-style). Presente quando o host a declarou — o provider o
      * stash no boot para `registerAuthHost` montar as rotas sem reler o config inteiro.

package/build/src/host/client_names.d.ts

@@ -2,10 +2,17 @@
  * Nome de exibição de cada client: o `client_name` que ele registrou (um cliente MCP registra o
  * seu, ex.: "Claude Code"), senão o próprio `client_id`. Client que sumiu do adapter → o id.
  */
-export declare function clientDisplayNames(service: {
+export declare function clientDisplayNames(service: ClientLookup, clientIds: string[]): Promise<Map<string, string>>;
+type ClientLookup = {
     provider: {
         Client: {
             find(id: string): Promise<any>;
         };
     };
-}, clientIds: string[]): Promise<Map<string, string>>;
+};
+/** Nome de exibição e logo (`logo_uri` registrado, ou `null`) de cada client. */
+export declare function clientDisplayInfo(service: ClientLookup, clientIds: string[]): Promise<Map<string, {
+    name: string;
+    logoUrl: string | null;
+}>>;
+export {};

package/build/src/host/client_names.js

@@ -3,10 +3,18 @@
  * seu, ex.: "Claude Code"), senão o próprio `client_id`. Client que sumiu do adapter → o id.
  */
 export async function clientDisplayNames(service, clientIds) {
-    const names = new Map();
+    const info = await clientDisplayInfo(service, clientIds);
+    return new Map([...info].map(([id, v]) => [id, v.name]));
+}
+/** Nome de exibição e logo (`logo_uri` registrado, ou `null`) de cada client. */
+export async function clientDisplayInfo(service, clientIds) {
+    const info = new Map();
     await Promise.all([...new Set(clientIds)].map(async (clientId) => {
         const client = await service.provider.Client.find(clientId).catch(() => null);
-        names.set(clientId, client?.clientName || clientId);
+        info.set(clientId, {
+            name: client?.clientName || clientId,
+            logoUrl: typeof client?.logoUri === 'string' && client.logoUri ? client.logoUri : null,
+        });
     }));
-    return names;
+    return info;
 }

package/build/src/host/consent_params.d.ts

@@ -0,0 +1,7 @@
+import type { ConsentRequestParams } from './screen_props.js';
+/**
+ * The interaction's request parameters for the consent screen: `client_id` and the
+ * standard string parameters are guaranteed strings (or absent); everything else is
+ * passed through untouched.
+ */
+export declare function consentRequestParams(raw: Record<string, unknown> | undefined): ConsentRequestParams;

package/build/src/host/consent_params.js

@@ -0,0 +1,27 @@
+/** Optional standard parameters of an authorization request, typed as strings. */
+const CONSENT_STRING_PARAMS = [
+    'redirect_uri',
+    'response_type',
+    'scope',
+    'state',
+    'prompt',
+    'nonce',
+    'code_challenge',
+    'code_challenge_method',
+];
+/**
+ * The interaction's request parameters for the consent screen: `client_id` and the
+ * standard string parameters are guaranteed strings (or absent); everything else is
+ * passed through untouched.
+ */
+export function consentRequestParams(raw) {
+    const params = { ...raw, client_id: String(raw?.client_id ?? '') };
+    for (const key of CONSENT_STRING_PARAMS) {
+        const value = raw?.[key];
+        if (typeof value === 'string')
+            params[key] = value;
+        else
+            delete params[key];
+    }
+    return params;
+}

package/build/src/host/console_denied_page.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The page a browser gets when `admin.authorize` denies the admin console
+ * (403), or asks for a sign-in it cannot do itself (401). Self-contained: no
+ * script and no external asset, so any CSP renders it.
+ */
+export declare function consoleDeniedPage(status: 401 | 403): string;

package/build/src/host/console_denied_page.js

@@ -0,0 +1,18 @@
+/**
+ * The page a browser gets when `admin.authorize` denies the admin console
+ * (403), or asks for a sign-in it cannot do itself (401). Self-contained: no
+ * script and no external asset, so any CSP renders it.
+ */
+export function consoleDeniedPage(status) {
+    const title = status === 401 ? 'Sign in required' : 'Access denied';
+    const body = status === 401
+        ? 'This console needs credentials this request did not carry.'
+        : 'You do not have access to this console.';
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${title}</title>
+<style>body{font-family:system-ui,sans-serif;background:#f9fafb;color:#111827;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;padding:16px}
+.box{max-width:420px;text-align:center}h1{font-size:20px;margin:0 0 8px}p{color:#4b5563;font-size:14px;line-height:1.6;margin:0}
+.code{font-size:12px;color:#9ca3af;margin-bottom:8px}</style>
+</head><body><main class="box"><p class="code">${status}</p><h1>${title}</h1><p>${body}</p></main></body></html>`;
+}