@adonis-agora/authkit-server 0.90.2 → 1.0.0-rc.1

package/build/src/host/console_sso.d.ts

@@ -0,0 +1,24 @@
+/** `client_id` do client interno do console. Reservado: não pode ser cadastrado. */
+export declare const CONSOLE_SSO_CLIENT_ID = "authkit-console";
+/** Rota que inicia o login do console pelo IdP. */
+export declare const CONSOLE_SSO_START_PATH = "/auth/console/sso";
+/** `redirect_uri` do client interno: valida o `state` e abre o console. */
+export declare const CONSOLE_SSO_CALLBACK_PATH = "/auth/console/callback";
+/** Chave da sessão Adonis com o `state` e o destino de um login em andamento. */
+export declare const CONSOLE_SSO_STATE_KEY = "authkit_console_sso";
+/** O que fica na sessão entre o início e o callback. */
+export interface ConsoleSsoState {
+    state: string;
+    returnTo: string | null;
+}
+/** Metadata do client interno para o `clients` estático do oidc-provider. */
+export declare function consoleSsoClientMetadata(issuer: string): Record<string, unknown>;
+/** Novo `state` opaco para um login do console. */
+export declare function newConsoleSsoState(): string;
+/**
+ * Path do authorize do provider. O issuer termina no `mountPath` (garantido por
+ * `registerAuthHost`), então o mount é o path do issuer.
+ */
+export declare function authorizationPath(issuer: string, provider?: any): string;
+/** URL do login do console pelo IdP, preservando o destino como `return_to`. */
+export declare function consoleSsoUrl(returnTo?: string | null): string;

package/build/src/host/console_sso.js

@@ -0,0 +1,70 @@
+/**
+ * Login do console pelo IdP (SSO), o jeito padrão de entrar em `/account/*` e no
+ * console admin.
+ *
+ * O console é tratado como mais um app do IdP, como o Keycloak faz com o
+ * `account-console` e o `security-admin-console`: sem sessão, o visitante vai
+ * para a tela de login do IdP (a mesma interaction de qualquer client: senha,
+ * magic link, OTP, passkey, social), volta, e a ponte de
+ * `idp_session_bridge.ts` abre o console para a conta da sessão do IdP.
+ *
+ * Para isso existe um client interno, `authkit-console`, injetado como client
+ * ESTÁTICO do provider (não fica no adapter, então não aparece na lista de
+ * clients do console nem pode ser editado):
+ *
+ *   - `response_types: ['none']`: o authorize não emite code nem token. O client
+ *     só usa o IdP para autenticar; o que abre o console é a sessão do IdP que o
+ *     login criou, lida pela ponte. Não há segredo, PKCE ou troca de code.
+ *   - o consent é concedido automaticamente (é a própria lib).
+ *   - a única `redirect_uri` é `/auth/console/callback`, no MESMO host do issuer.
+ *
+ * Só existe com `accountSession.acceptIdpSession` ligado (o default).
+ */
+import { randomBytes } from 'node:crypto';
+/** `client_id` do client interno do console. Reservado: não pode ser cadastrado. */
+export const CONSOLE_SSO_CLIENT_ID = 'authkit-console';
+/** Rota que inicia o login do console pelo IdP. */
+export const CONSOLE_SSO_START_PATH = '/auth/console/sso';
+/** `redirect_uri` do client interno: valida o `state` e abre o console. */
+export const CONSOLE_SSO_CALLBACK_PATH = '/auth/console/callback';
+/** Chave da sessão Adonis com o `state` e o destino de um login em andamento. */
+export const CONSOLE_SSO_STATE_KEY = 'authkit_console_sso';
+/** Metadata do client interno para o `clients` estático do oidc-provider. */
+export function consoleSsoClientMetadata(issuer) {
+    const origin = new URL(issuer).origin;
+    return {
+        client_id: CONSOLE_SSO_CLIENT_ID,
+        client_name: 'Account console',
+        application_type: 'web',
+        token_endpoint_auth_method: 'none',
+        response_types: ['none'],
+        grant_types: [],
+        redirect_uris: [`${origin}${CONSOLE_SSO_CALLBACK_PATH}`],
+    };
+}
+/** Novo `state` opaco para um login do console. */
+export function newConsoleSsoState() {
+    return randomBytes(24).toString('base64url');
+}
+/**
+ * Path do authorize do provider. O issuer termina no `mountPath` (garantido por
+ * `registerAuthHost`), então o mount é o path do issuer.
+ */
+export function authorizationPath(issuer, provider) {
+    const mount = new URL(issuer).pathname.replace(/\/+$/, '');
+    if (provider && typeof provider.pathFor === 'function') {
+        try {
+            return provider.pathFor('authorization', { mountPath: mount });
+        }
+        catch {
+            // cai no default do oidc-provider abaixo
+        }
+    }
+    return `${mount}/auth`;
+}
+/** URL do login do console pelo IdP, preservando o destino como `return_to`. */
+export function consoleSsoUrl(returnTo) {
+    if (!returnTo)
+        return CONSOLE_SSO_START_PATH;
+    return `${CONSOLE_SSO_START_PATH}?return_to=${encodeURIComponent(returnTo)}`;
+}

package/build/src/host/controllers/account_apps_controller.js

@@ -4,7 +4,7 @@ import { personalAgentsFor } from '../../agents/runtime.js';
 import { accountPath } from '../account_paths.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
-import { clientDisplayNames } from '../client_names.js';
+import { clientDisplayInfo } from '../client_names.js';
 /**
  * Self-service de consentimento ("apps com acesso") no console de conta. Lista os
  * Grants da própria conta agrupados por client (resolvendo o nome do client da
@@ -23,8 +23,8 @@ export default class AccountAppsController {
         const supported = sessions.canList;
         const grantList = supported ? await sessions.listGrants(accountId) : [];
         // O nome que o client registrou; sem ele, o clientId.
-        const names = await clientDisplayNames(service, grantList.map((g) => g.clientId).filter((id) => !!id));
-        const nameOf = (clientId) => clientId ? (names.get(clientId) ?? clientId) : '';
+        const info = await clientDisplayInfo(service, grantList.map((g) => g.clientId).filter((id) => !!id));
+        const nameOf = (clientId) => clientId ? (info.get(clientId)?.name ?? clientId) : '';
         const revoked = ctx.session.flashMessages.get('appRevoked');
         // Personal agents com delegação ativa (só quando a feature está ligada).
         const agentsRuntime = await personalAgentsFor(ctx);
@@ -58,6 +58,7 @@ export default class AccountAppsController {
                 .map((g) => ({
                 clientId: g.clientId,
                 name: nameOf(g.clientId),
+                logoUrl: info.get(g.clientId)?.logoUrl ?? null,
                 accessTokens: g.accessTokens,
                 refreshTokens: g.refreshTokens,
             })),

package/build/src/host/controllers/account_confirm_controller.d.ts

@@ -9,13 +9,6 @@
  */
 import '../augmentations.js';
 import type { HttpContext } from '@adonisjs/core/http';
-import { sudoContextFrom } from '../sudo/runtime.js';
-/**
- * Reexport de compatibilidade. O construtor canônico do `SudoContext` vive em
- * `sudo/runtime.ts` (é runtime do SPI, não detalhe da tela); este caminho
- * antigo segue valendo para quem já o importava.
- */
-export { sudoContextFrom };
 export default class AccountConfirmController {
     show(ctx: HttpContext): Promise<unknown>;
 }

package/build/src/host/controllers/account_confirm_controller.js

@@ -9,12 +9,6 @@
  */
 import '../augmentations.js';
 import { configuredSudoMethods, isSudoMethodMounted, LAST_METHOD_SESSION_KEY, resolveAvailableMethods, sudoContextFrom, } from '../sudo/runtime.js';
-/**
- * Reexport de compatibilidade. O construtor canônico do `SudoContext` vive em
- * `sudo/runtime.ts` (é runtime do SPI, não detalhe da tela); este caminho
- * antigo segue valendo para quem já o importava.
- */
-export { sudoContextFrom };
 export default class AccountConfirmController {
     async show(ctx) {
         const c = await sudoContextFrom(ctx);

package/build/src/host/controllers/account_orgs_controller.d.ts

@@ -27,54 +27,4 @@ export default class AccountOrgsController {
     removeMember(ctx: HttpContext): Promise<void>;
     /** POST /account/orgs/:id/invitations/:invId/revoke */
     revokeInvitation(ctx: HttpContext): Promise<void>;
-    /**
-     * GET /account/orgs/json — lista as orgs do usuário logado com papel + se ativa.
-     * Usado pelo hook `useOrganizations()`.
-     */
-    listJson(ctx: HttpContext): Promise<void | {
-        supported: boolean;
-        activeOrgId: any;
-        orgs: {
-            id: string;
-            name: string;
-            slug: string;
-            logoUrl: string | null;
-            role: string;
-            isActive: boolean;
-        }[];
-    }>;
-    /**
-     * GET /account/orgs/:id/json — detalhes da org ativa (para uso pelo hook `useOrganization()`).
-     * Só retorna se o usuário é membro.
-     */
-    showJson(ctx: HttpContext): Promise<void | {
-        id: string;
-        name: string;
-        slug: string;
-        logoUrl: string | null;
-        role: string;
-        canManage: boolean;
-        members: {
-            accountId: string;
-            email: string | null;
-            role: string;
-            joinedAt: string;
-        }[];
-    }>;
-    /**
-     * GET /account/orgs/invitations/json — lista convites pendentes pro e-mail do usuário logado.
-     * Usado pelo hook `useOrgInvitations()`.
-     */
-    listInvitationsJson(ctx: HttpContext): Promise<void | {
-        invitations: {
-            id: string;
-            organizationId: string;
-            orgName: string;
-            orgSlug: string;
-            email: string;
-            role: string;
-            expiresAt: string;
-            createdAt: string;
-        }[];
-    }>;
 }

package/build/src/host/controllers/account_orgs_controller.js

@@ -27,12 +27,10 @@ export default class AccountOrgsController {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const store = cfg.accountStore;
-        const messages = cfg.messages;
         if (!supportsOrganizations(store)) {
             return cfg.render
                 ? cfg.render(ctx, 'account/orgs', {
                     supported: false,
-                    messages,
                     csrfToken: ctx.request.csrfToken,
                 })
                 : response.notFound();
@@ -64,10 +62,11 @@ export default class AccountOrgsController {
             pendingInvitations: invitationsWithOrg,
             allowSelfCreate: policy.allowSelfCreate,
             availableRoles: policy.roles,
-            messages,
             csrfToken: ctx.request.csrfToken,
         };
-        return cfg.render ? cfg.render(ctx, 'account/orgs', props) : response.notFound();
+        return cfg.render
+            ? cfg.render(ctx, 'account/orgs', props)
+            : response.notFound();
     }
     /** POST /account/orgs — criar nova org (requer allowSelfCreate). */
     async store(ctx) {
@@ -265,11 +264,13 @@ export default class AccountOrgsController {
         const props = {
             invitation,
             token: params.token,
-            messages: cfg.messages,
             csrfToken: ctx.request.csrfToken,
         };
         return cfg.render
-            ? cfg.render(ctx, 'account/orgs', { ...props, subview: 'accept-invitation' })
+            ? cfg.render(ctx, 'account/orgs', {
+                ...props,
+                subview: 'accept-invitation',
+            })
             : response.notFound();
     }
     /** POST /account/orgs/invitations/:token/accept — processa aceite. */
@@ -351,111 +352,4 @@ export default class AccountOrgsController {
         });
         return response.redirect(accountPath('orgs'));
     }
-    // ──────────────────────────────────────────────────────────────────────────
-    // JSON endpoints — consumed by @adonis-agora/authkit-react hooks.
-    // ──────────────────────────────────────────────────────────────────────────
-    /**
-     * GET /account/orgs/json — lista as orgs do usuário logado com papel + se ativa.
-     * Usado pelo hook `useOrganizations()`.
-     */
-    async listJson(ctx) {
-        const { session, response, request } = ctx;
-        const service = await ctx.containerResolver.make('authkit.server');
-        const cfg = service.config;
-        const store = cfg.accountStore;
-        if (!supportsOrganizations(store))
-            return { supported: false, orgs: [], activeOrgId: null };
-        const accountId = session.get(ACCOUNT_SESSION_KEY);
-        if (!accountId)
-            return response.unauthorized({ message: 'Not authenticated.' });
-        const orgs = await store.listOrgsForAccount(accountId);
-        const activeOrgRaw = request.cookie(ACTIVE_ORG_COOKIE);
-        const activeOrgId = activeOrgRaw ? activeOrgRaw.split('\t')[0] : null;
-        return {
-            supported: true,
-            activeOrgId,
-            orgs: orgs.map((org) => ({
-                id: org.id,
-                name: org.name,
-                slug: org.slug,
-                logoUrl: org.logoUrl ?? null,
-                role: org.role,
-                isActive: org.id === activeOrgId,
-            })),
-        };
-    }
-    /**
-     * GET /account/orgs/:id/json — detalhes da org ativa (para uso pelo hook `useOrganization()`).
-     * Só retorna se o usuário é membro.
-     */
-    async showJson(ctx) {
-        const { session, response, params } = ctx;
-        const service = await ctx.containerResolver.make('authkit.server');
-        const cfg = service.config;
-        const store = cfg.accountStore;
-        if (!supportsOrganizations(store))
-            return response.notFound({ message: 'Not supported.' });
-        const accountId = session.get(ACCOUNT_SESSION_KEY);
-        if (!accountId)
-            return response.unauthorized({ message: 'Not authenticated.' });
-        const membership = await store.getOrgMembership(params.id, accountId);
-        if (!membership)
-            return response.notFound({ message: 'Organization not found or not a member.' });
-        const org = await store.findOrgById(params.id);
-        if (!org)
-            return response.notFound({ message: 'Organization not found.' });
-        const canManage = membership.role === 'owner' || membership.role === 'admin';
-        const members = canManage ? await store.listOrgMembers(params.id) : [];
-        const enrichedMembers = await Promise.all(members.map(async (m) => {
-            const account = await store.findById(m.accountId);
-            return {
-                accountId: m.accountId,
-                email: account?.email ?? null,
-                role: m.role,
-                joinedAt: m.joinedAt,
-            };
-        }));
-        return {
-            id: org.id,
-            name: org.name,
-            slug: org.slug,
-            logoUrl: org.logoUrl ?? null,
-            role: membership.role,
-            canManage,
-            members: enrichedMembers,
-        };
-    }
-    /**
-     * GET /account/orgs/invitations/json — lista convites pendentes pro e-mail do usuário logado.
-     * Usado pelo hook `useOrgInvitations()`.
-     */
-    async listInvitationsJson(ctx) {
-        const { session, response } = ctx;
-        const service = await ctx.containerResolver.make('authkit.server');
-        const cfg = service.config;
-        const store = cfg.accountStore;
-        if (!supportsOrganizations(store))
-            return { invitations: [] };
-        const accountId = session.get(ACCOUNT_SESSION_KEY);
-        if (!accountId)
-            return response.unauthorized({ message: 'Not authenticated.' });
-        const account = await store.findById(accountId);
-        if (!account)
-            return response.unauthorized({ message: 'Not authenticated.' });
-        const invitations = await store.listPendingInvitationsForEmail(account.email);
-        const enriched = await Promise.all(invitations.map(async (inv) => {
-            const org = await store.findOrgById(inv.organizationId);
-            return {
-                id: inv.id,
-                organizationId: inv.organizationId,
-                orgName: org?.name ?? inv.organizationId,
-                orgSlug: org?.slug ?? inv.organizationId,
-                email: inv.email,
-                role: inv.role,
-                expiresAt: inv.expiresAt,
-                createdAt: inv.createdAt,
-            };
-        }));
-        return { invitations: enriched };
-    }
 }

package/build/src/host/controllers/account_security_controller.js

@@ -426,7 +426,7 @@ export default class AccountSecurityController {
         });
         const origin = authkitOrigin(cfg);
         const confirmUrl = `${origin}${accountPath('emailConfirm')}?token=${encodeURIComponent(issued.token)}`;
-        // 1. Link de confirmação → NOVO e-mail (hook onEmailChangeConfirm > onEmailVerification > default).
+        // 1. Link de confirmação → NOVO e-mail (hook onEmailChangeConfirm > default).
         if (cfg.mail?.onEmailChangeConfirm) {
             await cfg.mail.onEmailChangeConfirm({
                 email: newEmail,
@@ -435,14 +435,6 @@ export default class AccountSecurityController {
                 oldEmail: account?.email ?? '',
             });
         }
-        else if (cfg.mail?.onEmailVerification) {
-            // Retrocompat: hook legado onEmailVerification (ainda funciona como override).
-            await cfg.mail.onEmailVerification({
-                email: newEmail,
-                verifyUrl: confirmUrl,
-                token: issued.token,
-            });
-        }
         else {
             await sendEmailChangeConfirmationEmail(ctx, {
                 email: newEmail,
@@ -513,7 +505,9 @@ export default class AccountSecurityController {
         const store = cfg.accountStore;
         const render = cfg.render;
         if (!supportsAccountSecurity(store)) {
-            return render(ctx, 'account/email-confirmed', { ok: false });
+            return render(ctx, 'account/email-confirmed', {
+                ok: false,
+            });
         }
         const token = ctx.request.qs().token ?? '';
         const result = await store.confirmEmailChange(token);
@@ -551,6 +545,8 @@ export default class AccountSecurityController {
                 metadata: { oldEmail: result.oldEmail, newEmail: result.newEmail },
             }, cfg.mail, cfg.audit, cfg);
         }
-        return render(ctx, 'account/email-confirmed', { ok: result.ok });
+        return render(ctx, 'account/email-confirmed', {
+            ok: result.ok,
+        });
     }
 }

package/build/src/host/controllers/account_session_controller.js

@@ -3,6 +3,7 @@ import { accountHome } from '../account_home.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { syncAdonisAuthLogin, syncAdonisAuthLogout } from '../adonis_auth_sync.js';
+import { consoleSsoUrl } from '../console_sso.js';
 import { normalizeEmailIdentifier } from '../email_identifier.js';
 import { translate } from '../i18n.js';
 import { endBridgedIdpSession } from '../idp_session_bridge.js';
@@ -49,8 +50,16 @@ export default class AccountSessionController {
             return ctx.response.redirect(accountHome(cfg));
         }
         // Lê e valida o return_to da query-string — descarta valores inválidos (open-redirect).
-        const rawReturnTo = ctx.request.qs?.()?.return_to ?? ctx.request.input?.('return_to');
+        const qs = (ctx.request.qs?.() ?? {});
+        const rawReturnTo = qs.return_to ?? ctx.request.input?.('return_to');
         const returnTo = validateReturnTo(rawReturnTo);
+        // SSO (default): o console entra pelo login do IdP, a mesma tela de qualquer
+        // app. O formulário de senha daqui fica como porta alternativa
+        // (`?method=password`), e só quando a senha não foi desligada no config.
+        const passwordForm = qs.method === 'password' && cfg.authMethods?.password !== false;
+        if (cfg.accountSession?.acceptIdpSession === true && !passwordForm) {
+            return redirectExact(ctx.response, consoleSsoUrl(returnTo));
+        }
         const props = {
             csrfToken: ctx.request.csrfToken,
             returnTo,

package/build/src/host/controllers/agent_consent_controller.js

@@ -51,14 +51,20 @@ export default class AgentConsentController {
             error: null,
         };
         if (impersonationState(ctx).active) {
-            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.impersonating' });
+            return render(ctx, 'agents/consent', {
+                ...base,
+                error: 'agents.consent.impersonating',
+            });
         }
         const input = ctx.request.input('user_code');
         if (!input)
             return render(ctx, 'agents/consent', base);
         const pending = await runtime.delegation.pendingRequest(input);
         if (!pending) {
-            return render(ctx, 'agents/consent', { ...base, error: 'agents.consent.invalid_code' });
+            return render(ctx, 'agents/consent', {
+                ...base,
+                error: 'agents.consent.invalid_code',
+            });
         }
         const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);
         const account = await service.config.accountStore.findById(accountId);
@@ -96,7 +102,11 @@ export default class AgentConsentController {
         const userCode = typeof rawCode === 'string' ? rawCode : '';
         const pending = await runtime.delegation.pendingRequest(userCode);
         if (!pending) {
-            return render(ctx, 'agents/done', { status: 'expired', agentName: null, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'expired',
+                agentName: null,
+                scopes: [],
+            });
         }
         const name = await agentName(runtime, pending.clientId);
         const raw = ctx.request.input('scope');
@@ -108,7 +118,11 @@ export default class AgentConsentController {
             // Negou ou desmarcou tudo. Se nem negar deu, o pedido mudou de estado no
             // meio do caminho (aprovado em outra aba, expirou).
             if (!(await runtime.delegation.deny({ userCode, accountId }))) {
-                return render(ctx, 'agents/done', { status: 'expired', agentName: name, scopes: [] });
+                return render(ctx, 'agents/done', {
+                    status: 'expired',
+                    agentName: name,
+                    scopes: [],
+                });
             }
             await cfg.audit?.record({
                 type: 'agent.delegation_denied',
@@ -117,7 +131,11 @@ export default class AgentConsentController {
                 ip: ctx.request.ip?.() ?? null,
                 metadata: { requested: pending.scopes.map((s) => s.id) },
             });
-            return render(ctx, 'agents/done', { status: 'denied', agentName: name, scopes: [] });
+            return render(ctx, 'agents/done', {
+                status: 'denied',
+                agentName: name,
+                scopes: [],
+            });
         }
         await cfg.audit?.record({
             type: 'agent.delegation_approved',

package/build/src/host/controllers/console_sso_controller.d.ts

@@ -0,0 +1,12 @@
+import '../augmentations.js';
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Login do console pelo IdP (ver `console_sso.ts`).
+ *
+ *   GET /auth/console/sso?return_to=…   → authorize do client interno
+ *   GET /auth/console/callback?state=…  → valida o state, abre o console pela ponte
+ */
+export default class ConsoleSsoController {
+    start(ctx: HttpContext): Promise<unknown>;
+    callback(ctx: HttpContext): Promise<unknown>;
+}

package/build/src/host/controllers/console_sso_controller.js

@@ -0,0 +1,61 @@
+import '../augmentations.js';
+import { accountHome } from '../account_home.js';
+import { getAccountLoginUrl } from '../account_login_url.js';
+import { authorizationPath, CONSOLE_SSO_CALLBACK_PATH, CONSOLE_SSO_CLIENT_ID, CONSOLE_SSO_STATE_KEY, newConsoleSsoState, } from '../console_sso.js';
+import { ensureConsoleSession } from '../idp_session_bridge.js';
+import { redirectExact } from '../redirect_exact.js';
+import { validateReturnTo } from './account_session_controller.js';
+/**
+ * Login do console pelo IdP (ver `console_sso.ts`).
+ *
+ *   GET /auth/console/sso?return_to=…   → authorize do client interno
+ *   GET /auth/console/callback?state=…  → valida o state, abre o console pela ponte
+ */
+export default class ConsoleSsoController {
+    async start(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const returnTo = validateReturnTo(ctx.request.qs?.()?.return_to ?? ctx.request.input?.('return_to'));
+        // SSO desligado (`acceptIdpSession: false`): o console só tem o login próprio.
+        if (cfg.accountSession?.acceptIdpSession !== true) {
+            const login = getAccountLoginUrl();
+            const sep = login.includes('?') ? '&' : '?';
+            return redirectExact(ctx.response, returnTo ? `${login}${sep}return_to=${encodeURIComponent(returnTo)}` : login);
+        }
+        // Já tem sessão (de console ou do IdP): não precisa passar pelo IdP.
+        if (await ensureConsoleSession(ctx)) {
+            return redirectExact(ctx.response, returnTo ?? accountHome(cfg));
+        }
+        const state = newConsoleSsoState();
+        ctx.session.put(CONSOLE_SSO_STATE_KEY, { state, returnTo });
+        const origin = new URL(cfg.issuer).origin;
+        const query = new URLSearchParams({
+            client_id: CONSOLE_SSO_CLIENT_ID,
+            response_type: 'none',
+            scope: 'openid',
+            redirect_uri: `${origin}${CONSOLE_SSO_CALLBACK_PATH}`,
+            state,
+        });
+        return redirectExact(ctx.response, `${authorizationPath(cfg.issuer, service.provider)}?${query.toString()}`);
+    }
+    async callback(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const pending = ctx.session.get(CONSOLE_SSO_STATE_KEY);
+        ctx.session.forget(CONSOLE_SSO_STATE_KEY);
+        const qs = (ctx.request.qs?.() ?? {});
+        // `state` amarra o callback ao navegador que iniciou o login (anti-CSRF de login).
+        if (!pending || typeof qs.state !== 'string' || qs.state !== pending.state) {
+            return ctx.response.status(400).send('Invalid or expired sign-in request.');
+        }
+        // O IdP recusou (o usuário cancelou, conta desabilitada, …): sem console.
+        // Vai para a raiz, e não de volta ao console, para não entrar em loop.
+        if (typeof qs.error === 'string') {
+            return redirectExact(ctx.response, '/');
+        }
+        if (!(await ensureConsoleSession(ctx))) {
+            return redirectExact(ctx.response, '/');
+        }
+        return redirectExact(ctx.response, pending.returnTo ?? accountHome(cfg));
+    }
+}

package/build/src/host/controllers/interaction_controller.js

@@ -4,6 +4,8 @@ import { resolveAccountRoles } from '../account_roles.js';
 import { AdminSessionsService } from '../admin_sessions_service.js';
 import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
 import { brandFor, isFirstParty } from '../branding.js';
+import { consentRequestParams } from '../consent_params.js';
+import { CONSOLE_SSO_CLIENT_ID } from '../console_sso.js';
 import { isCustomLoginMethodId } from '../custom_login.js';
 import { completeCustomLoginSession } from '../custom_login_completion.js';
 import { beginCustomMfa, clearMfaFlow, customMfaViewProps, getMfaFlow, initializeMfaFlow, recordVerifiedMfaFactor, resolveCustomMfaMethods, verifyCustomMfa, } from '../custom_mfa.js';
@@ -253,7 +255,8 @@ export default class AuthInteractionController {
             }
         }
         if (details.prompt.name === 'consent' &&
-            isFirstParty(cfg.branding, details.params.client_id)) {
+            (details.params.client_id === CONSOLE_SSO_CLIENT_ID ||
+                isFirstParty(cfg.branding, details.params.client_id))) {
             // Clients first-party: auto-concede o consent (pula a tela de consent).
             // interactions.consent monta o Grant + interactionFinished e escreve o
             // redirect de volta para o client — opera via provider.interactionDetails,
@@ -264,7 +267,7 @@ export default class AuthInteractionController {
             // Consent or other prompts — unchanged
             return render(ctx, 'consent', {
                 uid: details.uid,
-                params: details.params,
+                params: consentRequestParams(details.params),
                 csrfToken: ctx.request.csrfToken,
                 brand,
                 ...(await consentSubject(service, details, cfg.messages)),
@@ -1950,7 +1953,10 @@ export default class AuthInteractionController {
                     ip,
                     metadata: { reason: 'token_expired' },
                 });
-                return render(ctx, 'otp-unlock', { ok: false, expired: true });
+                return render(ctx, 'otp-unlock', {
+                    ok: false,
+                    expired: true,
+                });
             }
             // Token válido: zera o lock OTP + limpa o token do DB.
             const runtimeForOtp = await resolveRuntimeSettingsOrNoop(ctx);