@adonis-agora/authkit-server 0.90.2 → 1.0.0-rc.1

package/build/src/host/ui-dist/index.html

@@ -8,7 +8,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600;700&family=JetBrains+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-DUVBDAyh.js"></script>
+    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-D0EIeyKK.js"></script>
     <link rel="stylesheet" crossorigin href="/__AUTHKIT_BASE__/assets/index-DTSmD4RU.css">
   </head>
   <body>

package/build/src/password/password_manager.js

@@ -140,6 +140,11 @@ export class PasswordManager {
      * mantendo este manager desacoplado do Lucid.
      */
     async verify(hashedPassword, plainPassword, hooks) {
+        // No password at all (a form posted with only the e-mail): a failed check,
+        // not a TypeError from the HMAC/hasher.
+        if (typeof plainPassword !== 'string' || plainPassword === '') {
+            return { ok: false, rehash: false };
+        }
         const peppers = resolvePeppers(this.pepper);
         const currentPepper = Array.isArray(this.pepper) ? this.pepper[0] : (this.pepper ?? '');
         for (let i = 0; i < peppers.length; i++) {

package/build/src/provider/build_provider.js

@@ -1,7 +1,7 @@
 import * as oidc from 'oidc-provider';
 import { pickModelAdapterClass } from '../adapters/factory.js';
 import { normalizeActiveOrg, readActiveOrgFromKoaCtx } from '../host/active_org_cookie.js';
-import { assertClientMetadata } from '../host/client_metadata.js';
+import { consoleSsoClientMetadata } from '../host/console_sso.js';
 import { findMcpResource, mcpAuthorizeMiddleware } from '../mcp/mcp_oauth.js';
 import { createDeviceSources } from './device_sources.js';
 import { createLogoutSources } from './logout_sources.js';
@@ -130,6 +130,11 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
         }
         : {};
     const provider = new oidc.Provider(config.issuer, {
+        // Client interno do login do console pelo IdP (ver `host/console_sso.ts`).
+        // Estático: não passa pelo adapter, então não aparece no console de clients.
+        ...(config.accountSession?.acceptIdpSession
+            ? { clients: [consoleSsoClientMetadata(config.issuer)] }
+            : {}),
         // O ator (`act`, RFC 8693) dos access tokens de impersonation — ver
         // `impersonationExtraClaims` em `token_exchange.ts`. Sem isto o token trocado
         // não se distingue de um token do próprio alvo no resource server.
@@ -140,39 +145,6 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
         // `pickModelAdapterClass`, usada também pelos serviços que instanciam
         // adapter na mão. Sem `session.adapter`, as duas classes são a mesma.
         adapter: ((name) => new (pickModelAdapterClass(name, config.AdapterClass, config.SessionAdapterClass))(name)),
-        clients: config.clients.map((c) => {
-            const grants = c.grants ?? ['authorization_code', 'refresh_token'];
-            const tokenEndpointAuthMethod = c.tokenEndpointAuthMethod ?? (c.clientSecret ? 'client_secret_basic' : 'none');
-            // Clients do `defineConfig` passam pela MESMA validação do admin/CLI/import:
-            // um nativo com secret (ou redirect inválido pro tipo) falha no boot, não em runtime.
-            assertClientMetadata({
-                applicationType: c.applicationType ?? 'web',
-                tokenEndpointAuthMethod,
-                grantTypes: grants,
-                redirectUris: c.redirectUris,
-                postLogoutRedirectUris: c.postLogoutRedirectUris ?? [],
-            });
-            return {
-                client_id: c.clientId,
-                client_secret: c.clientSecret,
-                redirect_uris: c.redirectUris,
-                post_logout_redirect_uris: c.postLogoutRedirectUris ?? [],
-                grant_types: grants,
-                response_types: (c.grants ?? ['authorization_code']).includes('authorization_code')
-                    ? ['code']
-                    : [],
-                token_endpoint_auth_method: tokenEndpointAuthMethod,
-                // App nativo (RFC 8252): libera redirect de esquema privado/loopback. Sem a
-                // chave, o oidc-provider assume `web` — o comportamento de sempre.
-                ...(c.applicationType === 'native' ? { application_type: 'native' } : {}),
-                // OIDC Back-Channel Logout: só envia as chaves quando o client as declara,
-                // p/ não forçar metadata vazio em clients que não usam o recurso.
-                ...(c.backchannelLogoutUri ? { backchannel_logout_uri: c.backchannelLogoutUri } : {}),
-                ...(c.backchannelLogoutSessionRequired !== undefined
-                    ? { backchannel_logout_session_required: c.backchannelLogoutSessionRequired }
-                    : {}),
-            };
-        }),
         findAccount: options.findAccount,
         // Grant REAPROVEITADO (consent já lembrado): o org capturado no primeiro
         // consent ficaria VELHO se o usuário trocasse de org no console e voltasse a

package/build/src/provider/oidc_service.d.ts

@@ -104,6 +104,4 @@ export declare class OidcService {
      * é um detalhe interno acessível via o helper `weak_cache` do próprio provider.
      */
     evictDynamicClientCache(): Promise<void>;
-    /** Verifica client_id + client_secret contra os clients da config (p/ endpoints custom como introspecção de PAT). */
-    verifyClientCredentials(clientId: string, clientSecret: string): boolean;
 }

package/build/src/provider/oidc_service.js

@@ -1,4 +1,4 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
+import { createHmac } from 'node:crypto';
 import { NoopRecorder } from '@adonis-agora/authkit-core';
 import Koa from 'koa';
 import mount from 'koa-mount';
@@ -56,7 +56,6 @@ export class OidcService {
     sessionTtlHolder;
     /** Holder mutável dos TTLs de access/id/refresh tokens (lido sincronamente pelo oidc-provider). */
     tokenTtlHolder;
-    #clients;
     #config;
     /** Closures de acesso ao cofre de chaves (injetadas pelo provider para hot-reload). */
     #deps;
@@ -87,7 +86,6 @@ export class OidcService {
     }
     constructor(config, appKey, recorder = new NoopRecorder(), deps = {}) {
         this.#config = config;
-        this.#clients = config.clients ?? [];
         this.#appKey = appKey;
         this.recorder = recorder;
         this.#deps = deps;
@@ -340,13 +338,4 @@ export class OidcService {
             // imediata da entrada órfã. Best-effort — não propaga erro pro caminho da request.
         }
     }
-    /** Verifica client_id + client_secret contra os clients da config (p/ endpoints custom como introspecção de PAT). */
-    verifyClientCredentials(clientId, clientSecret) {
-        const client = this.#clients.find((c) => c.clientId === clientId);
-        if (!client?.clientSecret)
-            return false;
-        const a = Buffer.from(client.clientSecret);
-        const b = Buffer.from(clientSecret);
-        return a.length === b.length && timingSafeEqual(a, b);
-    }
 }

package/build/src/provider/token_exchange.d.ts

@@ -32,11 +32,9 @@ export interface TokenExchangeDeps {
      * Allowlist de roles que autorizam a impersonation. Default: `['ADMIN']`.
      * Aceita o papel EXATO (ex.: `'admin'` minúsculo) do app — resolve contra a
      * MESMA fonte de roles do `resolveTokenRoles`/`globalRoles`, não a um papel
-     * hardcoded. Mantém `adminRole` como alias singular para back-compat.
+     * hardcoded.
      */
     adminRoles?: string[];
-    /** @deprecated Use `adminRoles` (allowlist). Mantido como alias singular. */
-    adminRole?: string;
     /**
      * Resource indicators (RFC 8707) suportados pelo provider. Quando o pedido traz
      * `audience`/`resource`, validamos contra esta lista; um alvo não suportado é

package/build/src/provider/token_exchange.js

@@ -36,7 +36,7 @@ function intersectScopes(requested, allowed) {
     return out.join(' ');
 }
 export function registerTokenExchange(provider, deps) {
-    const adminRoles = deps.adminRoles ?? (deps.adminRole ? [deps.adminRole] : ['ADMIN']);
+    const adminRoles = deps.adminRoles ?? ['ADMIN'];
     const supportedResources = new Set(deps.supportedResources ?? []);
     const handler = async (ctx) => {
         const { params, client } = ctx.oidc;

package/build/stubs/config/authkit_react.stub

@@ -9,12 +9,12 @@ const authServerConfig = defineConfig({
   issuer: env.get('AUTHKIT_ISSUER'),
   adapter: adapters.redis({ connection: 'main' }),
   jwks: { source: 'managed', algorithm: 'RS256' },
-  clients: [
-    // registre seus clients OIDC aqui
-  ],
   ttl: { accessToken: '15m', refreshToken: '30d' },
   globalRolesClaim: 'roles',
   accountStore: lucidAccountStore(AuthUser),
+  // Clients são gerenciados em runtime via console admin (/admin/clients) ou
+  // Admin API, sem necessidade de redeploy.
+  // Use: node ace authkit:clients:create --redirect-uri=https://app/cb
   /**
    * Renderer Inertia/React: apenas as views listadas em "views" vão ao Inertia;
    * as demais (incluindo todas as telas admin/*) recaem silenciosamente no

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "0.90.2",
+  "version": "1.0.0-rc.1",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
   "repository": {
     "type": "git",
-    "url": "https://github.com/DavideCarvalho/adonis-agora-authkit.git",
+    "url": "git+https://github.com/DavideCarvalho/adonis-agora-authkit.git",
     "directory": "packages/authkit-server"
   },
   "homepage": "https://davidecarvalho.github.io/agora/docs/authkit",
@@ -35,7 +35,8 @@
   "files": [
     "build",
     "stubs",
-    "skills"
+    "skills",
+    "CHANGELOG.md"
   ],
   "exports": {
     ".": "./build/index.js",
@@ -60,9 +61,9 @@
     "node": ">=24"
   },
   "peerDependencies": {
-    "@adonis-agora/durable": ">=0.7.0 <1.0.0",
-    "@adonis-agora/media": ">=0.5.0 <1.0.0",
-    "@adonis-agora/telescope": ">=0.1.0 <1.0.0",
+    "@adonis-agora/durable": ">=0.7.0 <2.0.0 || >=1.0.0-rc.0 <2.0.0",
+    "@adonis-agora/media": ">=0.5.0 <2.0.0 || >=1.0.0-rc.0 <2.0.0",
+    "@adonis-agora/telescope": ">=0.1.0 <2.0.0 || >=1.0.0-rc.0 <2.0.0",
     "@adonisjs/ally": "^6.3.0",
     "@adonisjs/auth": "^10.1.0",
     "@adonisjs/core": "^7.5.0",
@@ -105,18 +106,18 @@
     }
   },
   "dependencies": {
-    "@adonis-agora/authkit-core": "0.10.1",
+    "@adonis-agora/authkit-core": "1.0.0-rc.0",
     "@simplewebauthn/browser": "14.0.0",
     "@simplewebauthn/server": "14.1.0",
     "jose": "6.2.15",
-    "koa": "3.2.1",
+    "koa": "3.3.0",
     "koa-mount": "4.2.0",
     "oidc-provider": "9.13.3",
-    "otplib": "13.5.0",
+    "otplib": "13.6.0",
     "qrcode": "1.5.4"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-react": "0.26.0",
+    "@adonis-agora/authkit-react": "1.0.0-rc.0",
     "@adonis-agora/durable": "0.59.0",
     "@adonis-agora/telescope": "0.27.1",
     "@adonisjs/ally": "6.3.2",
@@ -139,7 +140,7 @@
     "@types/koa": "3.0.3",
     "@types/koa-mount": "4.0.5",
     "@types/luxon": "3.7.6",
-    "@types/node": "26.6.5",
+    "@types/node": "26.6.6",
     "@types/qrcode": "1.5.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",

package/skills/authkit-interactions/SKILL.md

@@ -128,15 +128,42 @@ defineConfig({
   issuer: env.get('AUTHKIT_ISSUER'),
   adapter: adapters.database(),
   accountStore: lucidAccountStore(AuthUser),
-  render: inertiaRenderer(), // renders Inertia pages for /account/* and /auth/interaction/*
+  // `views` is required: only listed screens render as Inertia pages.
+  // Any other screen falls back to the built-in Edge view.
+  render: inertiaRenderer({ prefix: 'authkit', views: ['login', 'consent'] }),
 })
 ```
 
-Without any renderer, every `/account/*` and `/auth/interaction/*` request fails
-with an unexplained 500 (`render` is undefined).
+Every screen (login, signup, consent, MFA, `session-expired`, `throttled`,
+`agents/*`, `account/*`) renders through `render`, so any of them can be a host
+page. Type each page with `AuthkitScreenProps['<view>']` (it includes `messages`);
+the controllers are checked against the same types:
 
-Source: `src/define_config.ts` (`render` JSDoc), `index.ts` exports
-(`inertiaRenderer`, `edgeRenderer`).
+```tsx
+import type { AuthkitScreenProps } from '@adonis-agora/authkit-server'
+
+export default function SessionExpired({
+  loginUrl,
+  messages,
+}: AuthkitScreenProps['session-expired']) {
+  return <a href={loginUrl}>{messages['session_expired.login_link']}</a>
+}
+```
+
+- The page file must be `inertia/pages/<prefix>/<view>.tsx` with the view's
+  kebab-case name: Inertia resolves it by string, so a renamed file only fails at
+  runtime.
+- A screen of your own (a `render` wrapper that swaps `login` for an audience
+  variant, say) must be declared by augmenting `AuthkitScreenProps` in
+  `declare module '@adonis-agora/authkit-server'`; otherwise `views` rejects it.
+- Set `interactionRecovery: { redirectTo: '/auth/login' }` so `session-expired`
+  restarts the sign-in, not the account console's `/account/login`.
+- The admin console (`/admin`) is not themed: build a custom admin UI with the
+  admin query options of `@adonis-agora/authkit-react` instead. Account surfaces
+  inside the app use the React components or the account query options.
+
+Source: `src/host/screen_props.ts` (`AuthkitScreenProps`), `index.ts` exports
+(`inertiaRenderer`, `edgeRenderer`); docs page "Themed Screens".
 
 ### Pattern 4 — test flows without booting an IdP
 

package/stubs/config/authkit_react.stub

@@ -9,12 +9,12 @@ const authServerConfig = defineConfig({
   issuer: env.get('AUTHKIT_ISSUER'),
   adapter: adapters.redis({ connection: 'main' }),
   jwks: { source: 'managed', algorithm: 'RS256' },
-  clients: [
-    // registre seus clients OIDC aqui
-  ],
   ttl: { accessToken: '15m', refreshToken: '30d' },
   globalRolesClaim: 'roles',
   accountStore: lucidAccountStore(AuthUser),
+  // Clients são gerenciados em runtime via console admin (/admin/clients) ou
+  // Admin API, sem necessidade de redeploy.
+  // Use: node ace authkit:clients:create --redirect-uri=https://app/cb
   /**
    * Renderer Inertia/React: apenas as views listadas em "views" vão ao Inertia;
    * as demais (incluindo todas as telas admin/*) recaem silenciosamente no

package/build/src/commands/import_clients.d.ts

@@ -1,40 +0,0 @@
-import type { ClientConfig } from '@adonis-agora/authkit-core';
-import type { AdminClientsService } from '../host/admin_clients_service.js';
-/** Resultado da importação de um client individual. */
-export type ClientImportOutcome = 'created' | 'skipped' | 'error';
-/** Linha de relatório por client. */
-export interface ClientImportEntry {
-    clientId: string;
-    outcome: ClientImportOutcome;
-    /** Razão do erro ou 'already exists' no caso de skip. */
-    reason?: string;
-    /**
-     * Secret gerado (em claro, mostrado UMA vez) — presente apenas em `created` e
-     * somente quando o client é confidencial. Não recuperável depois.
-     */
-    clientSecret?: string;
-}
-/** Relatório agregado da operação. */
-export interface ClientsImportReport {
-    created: number;
-    skipped: number;
-    errors: number;
-    entries: ClientImportEntry[];
-}
-/**
- * Importa a lista de clients estáticos do config para o adapter/DB via
- * {@link AdminClientsService}. Idempotente: clients cujo `client_id` já existe no
- * adapter são pulados (preservando o secret original). O `client_secret` do config
- * estático é PRESERVADO na criação (passado diretamente como `clientId` ficará com
- * o secret original). Para clients sem secret (public), `clientSecret` fica omitido.
- *
- * A função é PURA quanto a I/O do config (recebe os records já parseados) —
- * testável em isolamento. O único I/O é via `svc` (adapter).
- *
- * @param clients - Lista de {@link ClientConfig} vindos de `config.clients`.
- * @param svc     - Serviço admin de clients (CRUD sobre o adapter).
- * @param options - `dryRun`: não persiste, só relata o que SERIA feito.
- */
-export declare function importClients(clients: ClientConfig[], svc: AdminClientsService, options?: {
-    dryRun?: boolean;
-}): Promise<ClientsImportReport>;

package/build/src/commands/import_clients.js

@@ -1,81 +0,0 @@
-/**
- * Importa a lista de clients estáticos do config para o adapter/DB via
- * {@link AdminClientsService}. Idempotente: clients cujo `client_id` já existe no
- * adapter são pulados (preservando o secret original). O `client_secret` do config
- * estático é PRESERVADO na criação (passado diretamente como `clientId` ficará com
- * o secret original). Para clients sem secret (public), `clientSecret` fica omitido.
- *
- * A função é PURA quanto a I/O do config (recebe os records já parseados) —
- * testável em isolamento. O único I/O é via `svc` (adapter).
- *
- * @param clients - Lista de {@link ClientConfig} vindos de `config.clients`.
- * @param svc     - Serviço admin de clients (CRUD sobre o adapter).
- * @param options - `dryRun`: não persiste, só relata o que SERIA feito.
- */
-export async function importClients(clients, svc, options = {}) {
-    const report = { created: 0, skipped: 0, errors: 0, entries: [] };
-    for (const client of clients) {
-        const clientId = client.clientId;
-        // Verifica se já existe no adapter.
-        let exists = false;
-        try {
-            const found = await svc.find(clientId);
-            exists = !!found;
-        }
-        catch (err) {
-            report.errors++;
-            report.entries.push({
-                clientId,
-                outcome: 'error',
-                reason: `falha ao verificar existência: ${err.message}`,
-            });
-            continue;
-        }
-        if (exists) {
-            report.skipped++;
-            report.entries.push({ clientId, outcome: 'skipped', reason: 'already exists' });
-            continue;
-        }
-        if (options.dryRun) {
-            // Dry-run: conta como "would create" sem persistir.
-            report.created++;
-            report.entries.push({ clientId, outcome: 'created' });
-            continue;
-        }
-        // Determina o auth method a partir do config estático.
-        const authMethod = client.tokenEndpointAuthMethod ?? (client.clientSecret ? 'client_secret_basic' : 'none');
-        const applicationType = client.applicationType ?? 'web';
-        try {
-            // Cria via AdminClientsService, que usa o mesmo caminho do console admin / registro dinâmico.
-            // Para preservar o client_secret do config estático, escrevemos diretamente via adapter —
-            // o `svc.create` gera um secret aleatório. Usamos a API interna do svc para construir o
-            // payload com o secret original e persistir.
-            const preservedSecret = client.clientSecret;
-            const created = await svc.createWithSecret({
-                clientId,
-                applicationType,
-                redirectUris: client.redirectUris ?? [],
-                postLogoutRedirectUris: client.postLogoutRedirectUris ?? [],
-                grantTypes: client.grants ?? ['authorization_code', 'refresh_token'],
-                tokenEndpointAuthMethod: authMethod,
-                backchannelLogoutUri: client.backchannelLogoutUri,
-                backchannelLogoutSessionRequired: client.backchannelLogoutSessionRequired,
-            }, preservedSecret);
-            report.created++;
-            report.entries.push({
-                clientId,
-                outcome: 'created',
-                clientSecret: created.clientSecret,
-            });
-        }
-        catch (err) {
-            report.errors++;
-            report.entries.push({
-                clientId,
-                outcome: 'error',
-                reason: err.message,
-            });
-        }
-    }
-    return report;
-}