@adonis-agora/authkit-server 1.0.0-rc.0 → 1.0.0-rc.1

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.1
+
+### Major Changes
+
+- [#451](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/451) [`1162aee`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/1162aeeee00d4706b8515d89e37f93d172cec44a) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - The account and admin consoles now sign in through the IdP login by default.
+  
+  - `accountSession.acceptIdpSession` defaults to `true`. Without a console session, `/account/*` and the admin console send the visitor to the IdP login (`/auth/console/sso`) and come back with the console open; a user already signed in to an app opens them directly.
+  - `/account/login` redirects to the IdP login. The password form stays at `/account/login?method=password` while password login is on.
+  - The console's idle timeout now also ends the IdP session the console was opened from, like "Sign out" already did.
+  - `accountSession: { acceptIdpSession: false }` with `authMethods: { password: false }` and no `accountLoginUrl` (passed to `registerAuthHost` or set in `routes`) now fails at boot when the routes are registered, since the consoles would have no way in. `authkit:doctor` warns about it, and when SSO is off.
+  - The client id `authkit-console` is reserved for the consoles' internal client (`response_type=none`, never listed in the console) and cannot be registered.
+  - New `admin.authorize`, the access check every `@adonis-agora` console takes: an inline function, an authorizer class (built through the container, so `@inject()` works) or a lazy import (`() => import('#policies/console_access')`). It runs after `admin.roles` (both must pass) on the shell and on every `{prefix}/api/*` route. An account without one of the roles still goes to `accountHome`.
+  - **Breaking:** without `admin.authorize`, the admin console is open outside production and answers 403 to every request in production. The app logs `[@adonis-agora/authkit-server] console has no \`authorize\` configured: …` once at boot, and `authkit:doctor` warns. To keep letting every admin in, set `admin: { enabled: true, roles: ['ADMIN'], authorize: () => true }`.
+  - An `authorize` denial answers 403 (an access-denied page, or `{ error: 'forbidden' }` for JSON); `reason: 'unauthenticated'` answers 401 (`{ error: 'unauthenticated' }`); `{ redirectTo }` redirects page navigations and answers 401 `{ error: 'unauthenticated', redirectTo }` to JSON calls; a thrown error is a 403.
+  - New `authorizeByToken({ token })`: a `ConsoleAuthorize` that allows `Authorization: Bearer <token>` (timing-safe compare) and answers 401 otherwise. An empty token throws when the config loads.
+  - The types `ConsoleAuthorize`, `ConsoleAuthorizer`, `ConsoleAuthorizerClass` and `ConsoleAuthorizeResult` are exported, next to `authorizeByToken`.
+
 ## 1.0.0-rc.0
 
 ### Major Changes

package/build/index.d.ts

@@ -30,6 +30,8 @@ export type { BuiltinProtocolId, PactOptions, PersonalAgentProtocol, } from './s
 export { pact, pactProtocol } from './src/agents/protocol.js';
 export type { AuditEvent, AuditEventType, AuditPage, AuditSink, ListAuditParams, StoredAuditEvent, } from './src/audit/audit_sink.js';
 export { lucidAuditSink } from './src/audit/lucid_audit_sink.js';
+export type { ConsoleAuthorize, ConsoleAuthorizeResult, ConsoleAuthorizer, ConsoleAuthorizerClass, } from './src/console_authorize.js';
+export { authorizeByToken } from './src/console_authorize.js';
 export type { AdminApiConfigInput, AdminConfigInput, AuthHostRenderer, AuthMethodsConfigInput, AuthServerConfigInput, AuthSocialConfig, DynamicRegistrationConfigInput, LoginConfigInput, OrganizationsConfigInput, PasswordlessConfigInput, RateLimitBucket, RateLimitConfigInput, RegistrationConfigInput, ResolvedAdminApiConfig, ResolvedAdminConfig, ResolvedAuthMethodsConfig, ResolvedDynamicRegistrationConfig, ResolvedLoginConfig, ResolvedNotificationsConfig, ResolvedOrganizationsConfig, ResolvedPasswordlessConfig, ResolvedRateLimitConfig, ResolvedRegistrationConfig, ResolvedServerConfig, ResolvedWebauthnConfig, WebauthnConfigInput, } from './src/define_config.js';
 export { adapters, defineConfig, resolveAdmin, resolveAdminApi, resolveAuthMethodsConfig, resolveDynamicRegistration, resolveLogin, resolveNotifications, resolveOrganizations, resolvePasswordless, resolveRateLimit, resolveRegistration, resolveWebauthn, toSeconds, } from './src/define_config.js';
 export type { EventsConfigInput, ResolvedEventsConfig } from './src/events/dispatcher.js';

package/build/index.js

@@ -19,6 +19,7 @@ export { isBlockedAddress, SafeFetchError, safeFetchJson, } from './src/agents/p
 export { poppyWebSession, poppyWebSessionOf, } from './src/agents/poppy/web_session.js';
 export { pact, pactProtocol } from './src/agents/protocol.js';
 export { lucidAuditSink } from './src/audit/lucid_audit_sink.js';
+export { authorizeByToken } from './src/console_authorize.js';
 export { adapters, defineConfig, resolveAdmin, resolveAdminApi, resolveAuthMethodsConfig, resolveDynamicRegistration, resolveLogin, resolveNotifications, resolveOrganizations, resolvePasswordless, resolveRateLimit, resolveRegistration, resolveWebauthn, toSeconds, } from './src/define_config.js';
 export { buildWebhookBody, composeAuditSink, resolveEvents, signWebhookBody, } from './src/events/dispatcher.js';
 export { inProcessAccessTokenVerifier, remoteAccessTokenVerifier, } from './src/host/access_token_verifier.js';

package/build/providers/authkit_server_provider.js

@@ -130,6 +130,7 @@ export default class AuthkitServerProvider {
             // Defaults estruturais de `config.routes` (o argumento ainda vence).
             routes: typeof config.routes === 'object' ? config.routes : undefined,
             lockedRouteOptions: config.lockedRouteOptions,
+            consoleNeedsLoginUrl: config.accountSession?.acceptIdpSession === false && config.authMethods?.password === false,
             personalAgents: config.personalAgents
                 ? {
                     prefix: config.personalAgents.prefix,
@@ -146,6 +147,13 @@ export default class AuthkitServerProvider {
                 }
                 : undefined,
         });
+        // Admin console without `admin.authorize`: open outside production, 403 in production.
+        // Said once, at boot.
+        if (config.admin.enabled && !config.admin.authorize) {
+            const { warnAdminConsoleUnauthorized } = await import('../src/host/admin_console_warning.js');
+            const logger = await this.app.container.make('logger').catch(() => null);
+            warnAdminConsoleUnauthorized(logger);
+        }
         // Poppy: o slot global que o `@adonis-agora/agent` usa para autenticar o endpoint de
         // conversas (e o MCP) sem importar este pacote — o contrato é o símbolo.
         if (config.personalAgents?.poppy) {

package/build/src/console_authorize.d.ts

@@ -0,0 +1,56 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * What a console `authorize` returns. Same shape in every `@adonis-agora` console.
+ *
+ * - `true` / `{ allowed: true }` → allowed
+ * - `false` / `{ allowed: false }` → 403
+ * - `{ allowed: false, reason: 'unauthenticated' }` → 401
+ * - `{ redirectTo }` → 302 to that path on a page navigation, 401 JSON on an API call
+ */
+export type ConsoleAuthorizeResult = boolean | {
+    allowed: true;
+} | {
+    allowed: false;
+    reason?: 'unauthenticated' | 'forbidden';
+} | {
+    redirectTo: string;
+};
+/** A class form, for an authorizer in its own file (`@inject()` works). */
+export interface ConsoleAuthorizer {
+    authorize(ctx: HttpContext): ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>;
+}
+export type ConsoleAuthorizerClass = new (...args: any[]) => ConsoleAuthorizer;
+/**
+ * Who may open a console: an inline function, an authorizer class, or a lazy
+ * import of a module whose default export is an authorizer class.
+ */
+export type ConsoleAuthorize = ((ctx: HttpContext) => ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>) | ConsoleAuthorizerClass | (() => Promise<{
+    default: ConsoleAuthorizerClass;
+}>);
+/** The normalized outcome of a `ConsoleAuthorize` call. */
+export type ConsoleAuthorizeDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    status: 401 | 403;
+    redirectTo?: string;
+};
+export declare function normalizeConsoleAuthorizeResult(result: unknown): ConsoleAuthorizeDecision;
+/**
+ * Turns a `ConsoleAuthorize` into a checker returning a normalized decision.
+ * A class is built through the container (so `@inject()` works); a lazy import
+ * runs once and its class is remembered. A thrown error is a denial (403).
+ */
+export declare function resolveConsoleAuthorize(authorize: ConsoleAuthorize): (ctx: HttpContext) => Promise<ConsoleAuthorizeDecision>;
+/**
+ * A `ConsoleAuthorize` that lets in requests carrying `Authorization: Bearer <token>`.
+ * The comparison is timing-safe. Anything else is `{ allowed: false, reason: 'unauthenticated' }`.
+ * Throws when `token` is empty, so a missing env var fails at config time.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') })
+ * ```
+ */
+export declare function authorizeByToken(options: {
+    token: string | undefined | null;
+}): (ctx: HttpContext) => ConsoleAuthorizeResult;

package/build/src/console_authorize.js

@@ -0,0 +1,85 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+function isAuthorizerClass(value) {
+    return (typeof value === 'function' &&
+        typeof value.prototype?.authorize === 'function');
+}
+function isLazyModule(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'default' in value &&
+        isAuthorizerClass(value.default));
+}
+export function normalizeConsoleAuthorizeResult(result) {
+    if (result === true)
+        return { allowed: true };
+    if (typeof result === 'object' && result !== null) {
+        const r = result;
+        if (typeof r.redirectTo === 'string' && r.redirectTo.length > 0) {
+            return { allowed: false, status: 401, redirectTo: r.redirectTo };
+        }
+        if (r.allowed === true)
+            return { allowed: true };
+        if (r.allowed === false && r.reason === 'unauthenticated') {
+            return { allowed: false, status: 401 };
+        }
+    }
+    // `false`, `{ allowed: false }` and anything unrecognized deny.
+    return { allowed: false, status: 403 };
+}
+async function runClass(Authorizer, ctx) {
+    const instance = (await ctx.containerResolver.make(Authorizer));
+    return instance.authorize(ctx);
+}
+/**
+ * Turns a `ConsoleAuthorize` into a checker returning a normalized decision.
+ * A class is built through the container (so `@inject()` works); a lazy import
+ * runs once and its class is remembered. A thrown error is a denial (403).
+ */
+export function resolveConsoleAuthorize(authorize) {
+    let lazyClass;
+    return async (ctx) => {
+        try {
+            if (isAuthorizerClass(authorize)) {
+                return normalizeConsoleAuthorizeResult(await runClass(authorize, ctx));
+            }
+            if (lazyClass)
+                return normalizeConsoleAuthorizeResult(await runClass(lazyClass, ctx));
+            const result = await authorize(ctx);
+            if (isLazyModule(result)) {
+                lazyClass = result.default;
+                return normalizeConsoleAuthorizeResult(await runClass(lazyClass, ctx));
+            }
+            return normalizeConsoleAuthorizeResult(result);
+        }
+        catch (error) {
+            ctx.logger?.warn?.({ err: error }, 'console authorize threw; access denied');
+            return { allowed: false, status: 403 };
+        }
+    };
+}
+/**
+ * A `ConsoleAuthorize` that lets in requests carrying `Authorization: Bearer <token>`.
+ * The comparison is timing-safe. Anything else is `{ allowed: false, reason: 'unauthenticated' }`.
+ * Throws when `token` is empty, so a missing env var fails at config time.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') })
+ * ```
+ */
+export function authorizeByToken(options) {
+    const token = options?.token;
+    if (typeof token !== 'string' || token.length === 0) {
+        throw new Error('authorizeByToken: `token` is empty. Set it (e.g. env CONSOLE_TOKEN).');
+    }
+    const expected = createHash('sha256').update(token).digest();
+    return (ctx) => {
+        const header = ctx.request.header('authorization');
+        const match = typeof header === 'string' ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+        if (match) {
+            const given = createHash('sha256').update(match[1]).digest();
+            if (timingSafeEqual(given, expected))
+                return { allowed: true };
+        }
+        return { allowed: false, reason: 'unauthenticated' };
+    };
+}

package/build/src/define_config.d.ts

@@ -4,6 +4,7 @@ import type { AccountStore, AuthAccount } from './accounts/account_store.js';
 import { type AdapterFactory, adapters, type OidcAdapterClass } from './adapters/factory.js';
 import { type PersonalAgentsConfigInput, type ResolvedPersonalAgentsConfig } from './agents/config.js';
 import type { AuditSink } from './audit/audit_sink.js';
+import type { ConsoleAuthorize } from './console_authorize.js';
 import { type EventsConfigInput } from './events/dispatcher.js';
 import { type BotProtectionConfigInput, type ResolvedBotProtectionConfig } from './host/bot_protection.js';
 import { type BrandingConfig } from './host/branding.js';
@@ -708,12 +709,21 @@ export interface AdminConfigInput {
      * default é decisão de major, mesma regra de `impersonation`).
      */
     impersonateAdmins?: boolean;
+    /**
+     * Access check for the console, run after `roles` (both must pass), on the shell
+     * and on every `{prefix}/api/*` route. An inline function, an authorizer class
+     * (`@inject()` works), a lazy import (`() => import('#policies/...')`) or
+     * `authorizeByToken({ token })`. Omitted: open outside production, 403 in production.
+     */
+    authorize?: ConsoleAuthorize;
 }
 export interface ResolvedAdminConfig {
     enabled: boolean;
     roles: string[];
     impersonation: boolean;
     impersonateAdmins: boolean;
+    /** `admin.authorize` as configured, or `null` when omitted. */
+    authorize: ConsoleAuthorize | null;
 }
 export declare function resolveAdmin(input?: AdminConfigInput): ResolvedAdminConfig;
 /**
@@ -1225,8 +1235,16 @@ export interface AuthServerConfigInput {
      * expiração), e o "Sair" do console encerra também a sessão do IdP. Contas
      * desabilitadas não entram. Operações sensíveis continuam pedindo sudo.
      *
-     * Default `false`: o console só aceita a própria sessão (`POST /account/login`),
-     * como sempre.
+     * Default `true`: o console é mais um app do IdP. Sem sessão, `/account/*` e o
+     * console admin mandam o visitante para o login do IdP (`/auth/console/sso`,
+     * client interno `authkit-console`) e voltam com o console aberto. Um único
+     * login, como no Keycloak, Okta e Google; o que protege as operações
+     * sensíveis é o sudo, não um segundo login.
+     *
+     * `false`: o console só aceita a própria sessão (`POST /account/login`, por
+     * senha). Com `authMethods: { password: false }` isso deixa o console sem
+     * nenhum jeito de entrar, então o boot recusa a combinação, a menos que
+     * `routes.accountLoginUrl` aponte para um login do próprio host.
      */
     accountSession?: {
         acceptIdpSession?: boolean;

package/build/src/define_config.js

@@ -193,6 +193,7 @@ export function resolveAdmin(input) {
         // registrado). Ver o docblock de `AdminConfigInput.impersonation`.
         impersonation: input?.impersonation !== false,
         impersonateAdmins: input?.impersonateAdmins !== false,
+        authorize: input?.authorize ?? null,
     };
 }
 /** Lê API keys de `AUTHKIT_ADMIN_API_KEY` (uma ou várias, separadas por vírgula). */
@@ -496,7 +497,7 @@ export function defineConfig(config) {
             lockedRouteOptions: deriveLockedRouteOptions(config),
             // Opt-in: ausente = authkit nunca toca `ctx.auth` (comportamento de sempre).
             adonisAuth: config.adonisAuth,
-            accountSession: { acceptIdpSession: config.accountSession?.acceptIdpSession === true },
+            accountSession: { acceptIdpSession: config.accountSession?.acceptIdpSession !== false },
         };
     });
 }

package/build/src/doctor/checks.d.ts

@@ -87,7 +87,7 @@ export declare function checkOtpLockout(input: DoctorInput): Finding | null;
 export declare function checkSudoMode(_input: DoctorInput): Finding | null;
 /** rateLimit ligado mas @adonisjs/limiter ausente → warn. */
 export declare function checkRateLimit(input: DoctorInput): Finding;
-/** admin.enabled mas sem roles → warn. Reporta o modo de UI ativo. */
+/** admin.enabled mas sem roles, ou sem `admin.authorize` → warn. Reporta o modo de UI ativo. */
 export declare function checkAdmin(input: DoctorInput): Finding | null;
 /** requireVerifiedEmail ligado mas o store não sabe checar verificação → warn. */
 export declare function checkRequireVerifiedEmail(input: DoctorInput): Finding | null;
@@ -214,6 +214,12 @@ export declare function checkPasskeyAutofill(input: DoctorInput): Finding | null
  * de TERCEIROS precisa saber que existe uma lista para fechar.
  */
 export declare function checkFirstPartyClients(input: DoctorInput): Finding | null;
+/**
+ * Como se entra no console de conta e no console admin. O default é o login do
+ * IdP (SSO, `accountSession.acceptIdpSession`); desligado, o console só tem o
+ * login próprio por senha.
+ */
+export declare function checkConsoleSignIn(input: DoctorInput): Finding | null;
 /**
  * Finding da idade da chave de assinatura managed. `ageDays === null` (sem
  * keystore em arquivo/cofre) → no-op `ok`. Acima de `maxAgeDays` → `warn`.

package/build/src/doctor/checks.js

@@ -311,7 +311,7 @@ export function checkRateLimit(input) {
     }
     return { level: 'ok', message: 'rate-limiting on and @adonisjs/limiter available.' };
 }
-/** admin.enabled mas sem roles → warn. Reporta o modo de UI ativo. */
+/** admin.enabled mas sem roles, ou sem `admin.authorize` → warn. Reporta o modo de UI ativo. */
 export function checkAdmin(input) {
     const admin = input.authkitConfig?.admin;
     if (!admin || admin.enabled !== true)
@@ -323,6 +323,12 @@ export function checkAdmin(input) {
             message: 'admin console on, but no `admin.roles` — nobody will have access (the default ["ADMIN"] was not resolved here).',
         };
     }
+    if (!admin.authorize) {
+        return {
+            level: 'warn',
+            message: `admin console on for roles: ${roles.join(', ')}, but no \`admin.authorize\` — it is open outside production and denies every request in production. Set \`admin.authorize\` in config/authkit.ts.`,
+        };
+    }
     return {
         level: 'ok',
         message: `admin console on for roles: ${roles.join(', ')} (React SPA self-contained — JSON API under {prefix}/api/*).`,
@@ -908,6 +914,43 @@ export function checkFirstPartyClients(input) {
         message: `firstPartyClients: ${allowlist.length} client(s) receive the roles/organization claims (${allowlist.join(', ')}).`,
     };
 }
+/**
+ * Como se entra no console de conta e no console admin. O default é o login do
+ * IdP (SSO, `accountSession.acceptIdpSession`); desligado, o console só tem o
+ * login próprio por senha.
+ */
+export function checkConsoleSignIn(input) {
+    const cfg = input.authkitConfig;
+    if (!cfg)
+        return null;
+    const sso = cfg.accountSession?.acceptIdpSession !== false;
+    const passwordOff = cfg.authMethods?.password === false;
+    const routes = typeof cfg.routes === 'object' && cfg.routes ? cfg.routes : undefined;
+    if (!sso && passwordOff && !routes?.accountLoginUrl) {
+        return {
+            level: 'warn',
+            message: 'The account and admin consoles have no way to sign in unless `registerAuthHost` gets an ' +
+                '`accountLoginUrl`: `accountSession.acceptIdpSession` is false and password login is off ' +
+                '(`authMethods: { password: false }`), and route registration refuses to start without ' +
+                'one. Remove `acceptIdpSession: false` so the consoles sign in through the IdP, or point ' +
+                '`accountLoginUrl` at a login route of your app.',
+        };
+    }
+    if (!sso) {
+        return {
+            level: 'warn',
+            message: 'The consoles use their own password login (`accountSession.acceptIdpSession: false`): ' +
+                'users sign in twice, and passwordless accounts cannot open them. The default (SSO through ' +
+                'the IdP login) is recommended; sensitive operations still ask for sudo.',
+        };
+    }
+    return {
+        level: 'ok',
+        message: 'The consoles sign in through the IdP login (SSO). Sensitive operations ask for sudo. ' +
+            'Make sure admin accounts have MFA enrolled (or require it for everyone with ' +
+            '`mfa.requiredFactors`).',
+    };
+}
 /**
  * Finding da idade da chave de assinatura managed. `ageDays === null` (sem
  * keystore em arquivo/cofre) → no-op `ok`. Acima de `maxAgeDays` → `warn`.
@@ -1007,6 +1050,9 @@ export function runAllChecks(input) {
     const firstPartyClients = checkFirstPartyClients(input);
     if (firstPartyClients)
         findings.push(firstPartyClients);
+    const consoleSignIn = checkConsoleSignIn(input);
+    if (consoleSignIn)
+        findings.push(consoleSignIn);
     return findings;
 }
 /** Há algum finding de nível 'error'? (define o exit code). */

package/build/src/host/admin_clients_service.js

@@ -1,5 +1,6 @@
 import { randomBytes } from 'node:crypto';
-import { assertClientMetadata } from './client_metadata.js';
+import { assertClientMetadata, ClientMetadataError, } from './client_metadata.js';
+import { CONSOLE_SSO_CLIENT_ID } from './console_sso.js';
 /** Métodos públicos (sem segredo) — espelham os "non-secret" do oidc-provider. */
 const PUBLIC_AUTH_METHODS = new Set(['none']);
 /** Gera um identificador opaco no estilo do oidc-provider (~43 chars base64url). */
@@ -51,6 +52,7 @@ export class AdminClientsService {
      */
     async create(input) {
         const clientId = (input.clientId ?? '').trim() || randomId();
+        assertNotReservedClientId(clientId);
         const confidential = !PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod);
         const clientSecret = confidential ? randomId() : undefined;
         const payload = this.#buildPayload(clientId, input, clientSecret);
@@ -68,6 +70,7 @@ export class AdminClientsService {
      */
     async createWithSecret(input, providedSecret) {
         const clientId = (input.clientId ?? '').trim() || randomId();
+        assertNotReservedClientId(clientId);
         const confidential = !PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod);
         const clientSecret = confidential ? (providedSecret ?? randomId()) : undefined;
         const payload = this.#buildPayload(clientId, input, clientSecret);
@@ -215,3 +218,9 @@ export class AdminClientsService {
         return result;
     }
 }
+/** O `client_id` do client interno do console (ver `console_sso.ts`) não pode ser cadastrado. */
+function assertNotReservedClientId(clientId) {
+    if (clientId === CONSOLE_SSO_CLIENT_ID) {
+        throw new ClientMetadataError(`client_id "${clientId}" é reservado pelo authkit`);
+    }
+}

package/build/src/host/admin_console_warning.d.ts

@@ -0,0 +1,8 @@
+/** The boot warning for an admin console with no `admin.authorize`. Same wording in every console. */
+export declare const ADMIN_CONSOLE_NO_AUTHORIZE_WARNING = "[@adonis-agora/authkit-server] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/authkit.ts.";
+/** Logs {@link ADMIN_CONSOLE_NO_AUTHORIZE_WARNING} once per process. */
+export declare function warnAdminConsoleUnauthorized(logger: {
+    warn: (message: string) => unknown;
+} | null | undefined): boolean;
+/** Test helper: lets the warning fire again. */
+export declare function resetAdminConsoleWarning(): void;

package/build/src/host/admin_console_warning.js

@@ -0,0 +1,18 @@
+/** The boot warning for an admin console with no `admin.authorize`. Same wording in every console. */
+export const ADMIN_CONSOLE_NO_AUTHORIZE_WARNING = '[@adonis-agora/authkit-server] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/authkit.ts.';
+let warned = false;
+/** Logs {@link ADMIN_CONSOLE_NO_AUTHORIZE_WARNING} once per process. */
+export function warnAdminConsoleUnauthorized(logger) {
+    if (warned)
+        return false;
+    warned = true;
+    if (logger)
+        logger.warn(ADMIN_CONSOLE_NO_AUTHORIZE_WARNING);
+    else
+        console.warn(ADMIN_CONSOLE_NO_AUTHORIZE_WARNING);
+    return true;
+}
+/** Test helper: lets the warning fire again. */
+export function resetAdminConsoleWarning() {
+    warned = false;
+}

package/build/src/host/auth_host_config.d.ts

@@ -40,6 +40,11 @@ export interface AuthHostRuntimeConfig {
         prefix: string;
         poppyPrefix?: string;
     };
+    /**
+     * `accountSession.acceptIdpSession: false` com `authMethods: { password: false }`:
+     * o console só entra por um `accountLoginUrl` do host (`registerAuthHost` recusa sem ele).
+     */
+    consoleNeedsLoginUrl?: boolean;
     /**
      * API headless (Clerk-style). Presente quando o host a declarou — o provider o
      * stash no boot para `registerAuthHost` montar as rotas sem reler o config inteiro.

package/build/src/host/console_denied_page.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The page a browser gets when `admin.authorize` denies the admin console
+ * (403), or asks for a sign-in it cannot do itself (401). Self-contained: no
+ * script and no external asset, so any CSP renders it.
+ */
+export declare function consoleDeniedPage(status: 401 | 403): string;

package/build/src/host/console_denied_page.js

@@ -0,0 +1,18 @@
+/**
+ * The page a browser gets when `admin.authorize` denies the admin console
+ * (403), or asks for a sign-in it cannot do itself (401). Self-contained: no
+ * script and no external asset, so any CSP renders it.
+ */
+export function consoleDeniedPage(status) {
+    const title = status === 401 ? 'Sign in required' : 'Access denied';
+    const body = status === 401
+        ? 'This console needs credentials this request did not carry.'
+        : 'You do not have access to this console.';
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${title}</title>
+<style>body{font-family:system-ui,sans-serif;background:#f9fafb;color:#111827;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;padding:16px}
+.box{max-width:420px;text-align:center}h1{font-size:20px;margin:0 0 8px}p{color:#4b5563;font-size:14px;line-height:1.6;margin:0}
+.code{font-size:12px;color:#9ca3af;margin-bottom:8px}</style>
+</head><body><main class="box"><p class="code">${status}</p><h1>${title}</h1><p>${body}</p></main></body></html>`;
+}

package/build/src/host/console_sso.d.ts

@@ -0,0 +1,24 @@
+/** `client_id` do client interno do console. Reservado: não pode ser cadastrado. */
+export declare const CONSOLE_SSO_CLIENT_ID = "authkit-console";
+/** Rota que inicia o login do console pelo IdP. */
+export declare const CONSOLE_SSO_START_PATH = "/auth/console/sso";
+/** `redirect_uri` do client interno: valida o `state` e abre o console. */
+export declare const CONSOLE_SSO_CALLBACK_PATH = "/auth/console/callback";
+/** Chave da sessão Adonis com o `state` e o destino de um login em andamento. */
+export declare const CONSOLE_SSO_STATE_KEY = "authkit_console_sso";
+/** O que fica na sessão entre o início e o callback. */
+export interface ConsoleSsoState {
+    state: string;
+    returnTo: string | null;
+}
+/** Metadata do client interno para o `clients` estático do oidc-provider. */
+export declare function consoleSsoClientMetadata(issuer: string): Record<string, unknown>;
+/** Novo `state` opaco para um login do console. */
+export declare function newConsoleSsoState(): string;
+/**
+ * Path do authorize do provider. O issuer termina no `mountPath` (garantido por
+ * `registerAuthHost`), então o mount é o path do issuer.
+ */
+export declare function authorizationPath(issuer: string, provider?: any): string;
+/** URL do login do console pelo IdP, preservando o destino como `return_to`. */
+export declare function consoleSsoUrl(returnTo?: string | null): string;

package/build/src/host/console_sso.js

@@ -0,0 +1,70 @@
+/**
+ * Login do console pelo IdP (SSO), o jeito padrão de entrar em `/account/*` e no
+ * console admin.
+ *
+ * O console é tratado como mais um app do IdP, como o Keycloak faz com o
+ * `account-console` e o `security-admin-console`: sem sessão, o visitante vai
+ * para a tela de login do IdP (a mesma interaction de qualquer client: senha,
+ * magic link, OTP, passkey, social), volta, e a ponte de
+ * `idp_session_bridge.ts` abre o console para a conta da sessão do IdP.
+ *
+ * Para isso existe um client interno, `authkit-console`, injetado como client
+ * ESTÁTICO do provider (não fica no adapter, então não aparece na lista de
+ * clients do console nem pode ser editado):
+ *
+ *   - `response_types: ['none']`: o authorize não emite code nem token. O client
+ *     só usa o IdP para autenticar; o que abre o console é a sessão do IdP que o
+ *     login criou, lida pela ponte. Não há segredo, PKCE ou troca de code.
+ *   - o consent é concedido automaticamente (é a própria lib).
+ *   - a única `redirect_uri` é `/auth/console/callback`, no MESMO host do issuer.
+ *
+ * Só existe com `accountSession.acceptIdpSession` ligado (o default).
+ */
+import { randomBytes } from 'node:crypto';
+/** `client_id` do client interno do console. Reservado: não pode ser cadastrado. */
+export const CONSOLE_SSO_CLIENT_ID = 'authkit-console';
+/** Rota que inicia o login do console pelo IdP. */
+export const CONSOLE_SSO_START_PATH = '/auth/console/sso';
+/** `redirect_uri` do client interno: valida o `state` e abre o console. */
+export const CONSOLE_SSO_CALLBACK_PATH = '/auth/console/callback';
+/** Chave da sessão Adonis com o `state` e o destino de um login em andamento. */
+export const CONSOLE_SSO_STATE_KEY = 'authkit_console_sso';
+/** Metadata do client interno para o `clients` estático do oidc-provider. */
+export function consoleSsoClientMetadata(issuer) {
+    const origin = new URL(issuer).origin;
+    return {
+        client_id: CONSOLE_SSO_CLIENT_ID,
+        client_name: 'Account console',
+        application_type: 'web',
+        token_endpoint_auth_method: 'none',
+        response_types: ['none'],
+        grant_types: [],
+        redirect_uris: [`${origin}${CONSOLE_SSO_CALLBACK_PATH}`],
+    };
+}
+/** Novo `state` opaco para um login do console. */
+export function newConsoleSsoState() {
+    return randomBytes(24).toString('base64url');
+}
+/**
+ * Path do authorize do provider. O issuer termina no `mountPath` (garantido por
+ * `registerAuthHost`), então o mount é o path do issuer.
+ */
+export function authorizationPath(issuer, provider) {
+    const mount = new URL(issuer).pathname.replace(/\/+$/, '');
+    if (provider && typeof provider.pathFor === 'function') {
+        try {
+            return provider.pathFor('authorization', { mountPath: mount });
+        }
+        catch {
+            // cai no default do oidc-provider abaixo
+        }
+    }
+    return `${mount}/auth`;
+}
+/** URL do login do console pelo IdP, preservando o destino como `return_to`. */
+export function consoleSsoUrl(returnTo) {
+    if (!returnTo)
+        return CONSOLE_SSO_START_PATH;
+    return `${CONSOLE_SSO_START_PATH}?return_to=${encodeURIComponent(returnTo)}`;
+}

package/build/src/host/controllers/account_session_controller.js

@@ -3,6 +3,7 @@ import { accountHome } from '../account_home.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { syncAdonisAuthLogin, syncAdonisAuthLogout } from '../adonis_auth_sync.js';
+import { consoleSsoUrl } from '../console_sso.js';
 import { normalizeEmailIdentifier } from '../email_identifier.js';
 import { translate } from '../i18n.js';
 import { endBridgedIdpSession } from '../idp_session_bridge.js';
@@ -49,8 +50,16 @@ export default class AccountSessionController {
             return ctx.response.redirect(accountHome(cfg));
         }
         // Lê e valida o return_to da query-string — descarta valores inválidos (open-redirect).
-        const rawReturnTo = ctx.request.qs?.()?.return_to ?? ctx.request.input?.('return_to');
+        const qs = (ctx.request.qs?.() ?? {});
+        const rawReturnTo = qs.return_to ?? ctx.request.input?.('return_to');
         const returnTo = validateReturnTo(rawReturnTo);
+        // SSO (default): o console entra pelo login do IdP, a mesma tela de qualquer
+        // app. O formulário de senha daqui fica como porta alternativa
+        // (`?method=password`), e só quando a senha não foi desligada no config.
+        const passwordForm = qs.method === 'password' && cfg.authMethods?.password !== false;
+        if (cfg.accountSession?.acceptIdpSession === true && !passwordForm) {
+            return redirectExact(ctx.response, consoleSsoUrl(returnTo));
+        }
         const props = {
             csrfToken: ctx.request.csrfToken,
             returnTo,

package/build/src/host/controllers/console_sso_controller.d.ts

@@ -0,0 +1,12 @@
+import '../augmentations.js';
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Login do console pelo IdP (ver `console_sso.ts`).
+ *
+ *   GET /auth/console/sso?return_to=…   → authorize do client interno
+ *   GET /auth/console/callback?state=…  → valida o state, abre o console pela ponte
+ */
+export default class ConsoleSsoController {
+    start(ctx: HttpContext): Promise<unknown>;
+    callback(ctx: HttpContext): Promise<unknown>;
+}

package/build/src/host/controllers/console_sso_controller.js

@@ -0,0 +1,61 @@
+import '../augmentations.js';
+import { accountHome } from '../account_home.js';
+import { getAccountLoginUrl } from '../account_login_url.js';
+import { authorizationPath, CONSOLE_SSO_CALLBACK_PATH, CONSOLE_SSO_CLIENT_ID, CONSOLE_SSO_STATE_KEY, newConsoleSsoState, } from '../console_sso.js';
+import { ensureConsoleSession } from '../idp_session_bridge.js';
+import { redirectExact } from '../redirect_exact.js';
+import { validateReturnTo } from './account_session_controller.js';
+/**
+ * Login do console pelo IdP (ver `console_sso.ts`).
+ *
+ *   GET /auth/console/sso?return_to=…   → authorize do client interno
+ *   GET /auth/console/callback?state=…  → valida o state, abre o console pela ponte
+ */
+export default class ConsoleSsoController {
+    async start(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const returnTo = validateReturnTo(ctx.request.qs?.()?.return_to ?? ctx.request.input?.('return_to'));
+        // SSO desligado (`acceptIdpSession: false`): o console só tem o login próprio.
+        if (cfg.accountSession?.acceptIdpSession !== true) {
+            const login = getAccountLoginUrl();
+            const sep = login.includes('?') ? '&' : '?';
+            return redirectExact(ctx.response, returnTo ? `${login}${sep}return_to=${encodeURIComponent(returnTo)}` : login);
+        }
+        // Já tem sessão (de console ou do IdP): não precisa passar pelo IdP.
+        if (await ensureConsoleSession(ctx)) {
+            return redirectExact(ctx.response, returnTo ?? accountHome(cfg));
+        }
+        const state = newConsoleSsoState();
+        ctx.session.put(CONSOLE_SSO_STATE_KEY, { state, returnTo });
+        const origin = new URL(cfg.issuer).origin;
+        const query = new URLSearchParams({
+            client_id: CONSOLE_SSO_CLIENT_ID,
+            response_type: 'none',
+            scope: 'openid',
+            redirect_uri: `${origin}${CONSOLE_SSO_CALLBACK_PATH}`,
+            state,
+        });
+        return redirectExact(ctx.response, `${authorizationPath(cfg.issuer, service.provider)}?${query.toString()}`);
+    }
+    async callback(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const pending = ctx.session.get(CONSOLE_SSO_STATE_KEY);
+        ctx.session.forget(CONSOLE_SSO_STATE_KEY);
+        const qs = (ctx.request.qs?.() ?? {});
+        // `state` amarra o callback ao navegador que iniciou o login (anti-CSRF de login).
+        if (!pending || typeof qs.state !== 'string' || qs.state !== pending.state) {
+            return ctx.response.status(400).send('Invalid or expired sign-in request.');
+        }
+        // O IdP recusou (o usuário cancelou, conta desabilitada, …): sem console.
+        // Vai para a raiz, e não de volta ao console, para não entrar em loop.
+        if (typeof qs.error === 'string') {
+            return redirectExact(ctx.response, '/');
+        }
+        if (!(await ensureConsoleSession(ctx))) {
+            return redirectExact(ctx.response, '/');
+        }
+        return redirectExact(ctx.response, pending.returnTo ?? accountHome(cfg));
+    }
+}

package/build/src/host/controllers/interaction_controller.js

@@ -5,6 +5,7 @@ import { AdminSessionsService } from '../admin_sessions_service.js';
 import { guardBotProtection, resolveEffectiveBotProtection } from '../bot_protection.js';
 import { brandFor, isFirstParty } from '../branding.js';
 import { consentRequestParams } from '../consent_params.js';
+import { CONSOLE_SSO_CLIENT_ID } from '../console_sso.js';
 import { isCustomLoginMethodId } from '../custom_login.js';
 import { completeCustomLoginSession } from '../custom_login_completion.js';
 import { beginCustomMfa, clearMfaFlow, customMfaViewProps, getMfaFlow, initializeMfaFlow, recordVerifiedMfaFactor, resolveCustomMfaMethods, verifyCustomMfa, } from '../custom_mfa.js';
@@ -254,7 +255,8 @@ export default class AuthInteractionController {
             }
         }
         if (details.prompt.name === 'consent' &&
-            isFirstParty(cfg.branding, details.params.client_id)) {
+            (details.params.client_id === CONSOLE_SSO_CLIENT_ID ||
+                isFirstParty(cfg.branding, details.params.client_id))) {
             // Clients first-party: auto-concede o consent (pula a tela de consent).
             // interactions.consent monta o Grant + interactionFinished e escreve o
             // redirect de volta para o client — opera via provider.interactionDetails,

package/build/src/host/register_auth_host.d.ts

@@ -20,6 +20,8 @@ export declare function wantsJson(ctx: any): boolean;
  *      (senão → `accountHome(cfg)`, default /account/security — NÃO revela a
  *      existência do /admin, e cai numa tela que o host controla via `accountHome`;
  *      se a tela default estiver desmontada, aponte `config.accountHome` para uma montada).
+ *   3. `config.admin.authorize` liberando (403/401/redirect conforme o resultado). Omitido:
+ *      aberto fora de produção, 403 em produção.
  * As roles permitidas são resolvidas em runtime do `authkit.server` (config lazy).
  */
 export declare const adminGuard: (ctx: any, next: () => Promise<void>) => Promise<any>;

package/build/src/host/register_auth_host.js

@@ -1,3 +1,5 @@
+import { getBootedApp } from '../../services/booted_app.js';
+import { resolveConsoleAuthorize, } from '../console_authorize.js';
 import { resolveRateLimit } from '../define_config.js';
 import { accountHome } from './account_home.js';
 import { getAccountLoginUrl, setAccountLoginUrl } from './account_login_url.js';
@@ -7,7 +9,9 @@ import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 import { adminApiGuard } from './admin_api/admin_api_guard.js';
 import { normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './admin_prefix.js';
 import { getAuthHostConfig, markAuthHostAutoMounted, wasAuthHostAutoMounted, } from './auth_host_config.js';
-import { ensureConsoleSession } from './idp_session_bridge.js';
+import { consoleDeniedPage } from './console_denied_page.js';
+import { CONSOLE_SSO_CALLBACK_PATH, CONSOLE_SSO_START_PATH } from './console_sso.js';
+import { endBridgedIdpSession, ensureConsoleSession } from './idp_session_bridge.js';
 import { POPPY_WEB_SESSION_KEY } from './poppy_session_key.js';
 import { createAuthThrottles } from './rate_limit.js';
 import { redirectExact } from './redirect_exact.js';
@@ -67,7 +71,10 @@ async function checkAndRefreshIdle(ctx) {
         const lastSeen = ctx.session?.get(ACCOUNT_LAST_SEEN_KEY);
         const now = Date.now();
         if (lastSeen !== undefined && now - lastSeen > idleMs) {
-            // Idle excedido: encerra a sessão.
+            // Idle excedido: encerra a sessão. Console aberto pela sessão do IdP (SSO):
+            // encerra também essa sessão, senão a ponte reabriria o console no próximo
+            // request e o idle timeout não teria efeito.
+            await endBridgedIdpSession(ctx);
             ctx.session?.forget(ACCOUNT_SESSION_KEY);
             ctx.session?.forget(ACCOUNT_LAST_SEEN_KEY);
             return true;
@@ -166,6 +173,8 @@ const accountGuard = async (ctx, next) => {
  *      (senão → `accountHome(cfg)`, default /account/security — NÃO revela a
  *      existência do /admin, e cai numa tela que o host controla via `accountHome`;
  *      se a tela default estiver desmontada, aponte `config.accountHome` para uma montada).
+ *   3. `config.admin.authorize` liberando (403/401/redirect conforme o resultado). Omitido:
+ *      aberto fora de produção, 403 em produção.
  * As roles permitidas são resolvidas em runtime do `authkit.server` (config lazy).
  */
 export const adminGuard = async (ctx, next) => {
@@ -206,10 +215,63 @@ export const adminGuard = async (ctx, next) => {
                 .status(403)
                 .send({ error: { code: 'forbidden', message: 'Admin role required.' } });
         }
-        return ctx.response.redirect(accountHome(cfg));
+        return redirectExact(ctx.response, accountHome(cfg));
     }
+    // `admin.authorize`, after the roles: both must pass. Omitted, the console is open
+    // outside production and closed (403) in production.
+    const decision = cfg.admin.authorize
+        ? await adminAuthorizeChecker(cfg.admin.authorize)(ctx)
+        : appInProduction()
+            ? { allowed: false, status: 403 }
+            : { allowed: true };
+    if (!decision.allowed)
+        return consoleDenied(ctx, decision);
     return next();
 };
+/**
+ * Whether the app runs in production. Unknown (the provider did not register the
+ * app) counts as production, so an omitted `admin.authorize` fails closed.
+ */
+function appInProduction() {
+    try {
+        return getBootedApp().inProduction !== false;
+    }
+    catch {
+        return true;
+    }
+}
+/** The response for an `admin.authorize` denial: same rules in every `@adonis-agora` console. */
+function consoleDenied(ctx, decision) {
+    const json = wantsJson(ctx);
+    if (decision.redirectTo) {
+        if (json) {
+            return ctx.response
+                .status(401)
+                .send({ error: 'unauthenticated', redirectTo: decision.redirectTo });
+        }
+        return redirectExact(ctx.response, decision.redirectTo);
+    }
+    if (decision.status === 401) {
+        if (json)
+            return ctx.response.status(401).send({ error: 'unauthenticated' });
+        ctx.response.header('Content-Type', 'text/html; charset=utf-8');
+        return ctx.response.status(401).send(consoleDeniedPage(401));
+    }
+    if (json)
+        return ctx.response.status(403).send({ error: 'forbidden' });
+    ctx.response.header('Content-Type', 'text/html; charset=utf-8');
+    return ctx.response.status(403).send(consoleDeniedPage(403));
+}
+/** One checker per configured `admin.authorize`, so a lazy import runs once. */
+const adminAuthorizeCheckers = new WeakMap();
+function adminAuthorizeChecker(authorize) {
+    let checker = adminAuthorizeCheckers.get(authorize);
+    if (!checker) {
+        checker = resolveConsoleAuthorize(authorize);
+        adminAuthorizeCheckers.set(authorize, checker);
+    }
+    return checker;
+}
 const C = {
     oidc: () => import('../controllers/oidc_callback_controller.js'),
     authorizationServerMetadata: () => import('../controllers/authorization_server_metadata_controller.js'),
@@ -218,6 +280,7 @@ const C = {
     social: () => import('./controllers/social_controller.js'),
     patIntrospection: () => import('./controllers/pat_introspection_controller.js'),
     accountSession: () => import('./controllers/account_session_controller.js'),
+    consoleSso: () => import('./controllers/console_sso_controller.js'),
     accountTokens: () => import('./controllers/account_tokens_controller.js'),
     accountSecurity: () => import('./controllers/account_security_controller.js'),
     accountApps: () => import('./controllers/account_apps_controller.js'),
@@ -380,6 +443,17 @@ export function registerAuthHost(router, opts = {}) {
     if (accountLoginUrlOpt !== undefined) {
         setAccountLoginUrl(accountLoginUrlOpt);
     }
+    // Console sem porta de entrada: SSO desligado (`acceptIdpSession: false`) deixa só o
+    // login próprio do console, que é por senha; com a senha desligada ninguém entra em
+    // `/account/*` nem no console admin. Só passa com um `accountLoginUrl` do host (aqui
+    // ou em `routes.accountLoginUrl`) — por isso a checagem é no registro, não no config.
+    if (hostCfg?.consoleNeedsLoginUrl && !accountLoginUrlOpt) {
+        throw new Error('authkit: `accountSession.acceptIdpSession: false` com `authMethods: { password: false }` ' +
+            'deixa o console de conta e o console admin sem nenhum jeito de entrar (o login próprio ' +
+            'do console é por senha). Remova `acceptIdpSession: false` (o default entra pelo login ' +
+            'do IdP) ou passe `accountLoginUrl` (no `registerAuthHost` ou em `routes`) apontando ' +
+            'para um login do seu app.');
+    }
     // Montagem por tela do console de conta. `undefined` → tudo montado;
     // `false` → nada; objeto → cada flag ausente default `true`.
     const accountOpt = opts.account ?? routesCfg?.account;
@@ -506,6 +580,13 @@ export function registerAuthHost(router, opts = {}) {
     // Provider OIDC (wildcard + root) — o que registerOidcRoutes fazia.
     router.any(`${mount}/*`, [C.oidc]).as('authkit.oidc.wildcard');
     router.any(mount, [C.oidc]).as('authkit.oidc.root');
+    // Login do console pelo IdP (SSO; client interno `authkit-console`, ver
+    // `console_sso.ts`). Sempre montado: com `acceptIdpSession: false` o início só
+    // redireciona para o login próprio do console.
+    router.get(CONSOLE_SSO_START_PATH, [C.consoleSso, 'start']).as('authkit.console_sso.start');
+    router
+        .get(CONSOLE_SSO_CALLBACK_PATH, [C.consoleSso, 'callback'])
+        .as('authkit.console_sso.callback');
     // Interaction (login multi-step + consent + signup).
     // Cada rota passa por `keep(key, …)`: entra em `AuthHostRouteMap.routes`/`urls` e
     // recebe o `extraMiddleware` do host (depois do throttle da lib).

package/build/src/provider/build_provider.js

@@ -1,6 +1,7 @@
 import * as oidc from 'oidc-provider';
 import { pickModelAdapterClass } from '../adapters/factory.js';
 import { normalizeActiveOrg, readActiveOrgFromKoaCtx } from '../host/active_org_cookie.js';
+import { consoleSsoClientMetadata } from '../host/console_sso.js';
 import { findMcpResource, mcpAuthorizeMiddleware } from '../mcp/mcp_oauth.js';
 import { createDeviceSources } from './device_sources.js';
 import { createLogoutSources } from './logout_sources.js';
@@ -129,6 +130,11 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
         }
         : {};
     const provider = new oidc.Provider(config.issuer, {
+        // Client interno do login do console pelo IdP (ver `host/console_sso.ts`).
+        // Estático: não passa pelo adapter, então não aparece no console de clients.
+        ...(config.accountSession?.acceptIdpSession
+            ? { clients: [consoleSsoClientMetadata(config.issuer)] }
+            : {}),
         // O ator (`act`, RFC 8693) dos access tokens de impersonation — ver
         // `impersonationExtraClaims` em `token_exchange.ts`. Sem isto o token trocado
         // não se distingue de um token do próprio alvo no resource server.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.0",
+  "version": "1.0.0-rc.1",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -110,10 +110,10 @@
     "@simplewebauthn/browser": "14.0.0",
     "@simplewebauthn/server": "14.1.0",
     "jose": "6.2.15",
-    "koa": "3.2.1",
+    "koa": "3.3.0",
     "koa-mount": "4.2.0",
     "oidc-provider": "9.13.3",
-    "otplib": "13.5.0",
+    "otplib": "13.6.0",
     "qrcode": "1.5.4"
   },
   "devDependencies": {
@@ -140,7 +140,7 @@
     "@types/koa": "3.0.3",
     "@types/koa-mount": "4.0.5",
     "@types/luxon": "3.7.6",
-    "@types/node": "26.6.5",
+    "@types/node": "26.6.6",
     "@types/qrcode": "1.5.6",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",