@adonis-agora/authkit-server 1.0.0-rc.0 → 1.0.0-rc.10

package/build/src/host/admin_clients_service.js

@@ -1,5 +1,7 @@
 import { randomBytes } from 'node:crypto';
-import { assertClientMetadata } from './client_metadata.js';
+import { CLIENT_DISABLED_KEY, isClientDisabled, normalizeServiceTenant, SERVICE_TENANT_KEY, serviceTenantOf, } from '../service_tenants/client_metadata.js';
+import { assertClientMetadata, ClientMetadataError, } from './client_metadata.js';
+import { CONSOLE_SSO_CLIENT_ID } from './console_sso.js';
 /** Métodos públicos (sem segredo) — espelham os "non-secret" do oidc-provider. */
 const PUBLIC_AUTH_METHODS = new Set(['none']);
 /** Gera um identificador opaco no estilo do oidc-provider (~43 chars base64url). */
@@ -51,6 +53,7 @@ export class AdminClientsService {
      */
     async create(input) {
         const clientId = (input.clientId ?? '').trim() || randomId();
+        assertNotReservedClientId(clientId);
         const confidential = !PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod);
         const clientSecret = confidential ? randomId() : undefined;
         const payload = this.#buildPayload(clientId, input, clientSecret);
@@ -68,6 +71,7 @@ export class AdminClientsService {
      */
     async createWithSecret(input, providedSecret) {
         const clientId = (input.clientId ?? '').trim() || randomId();
+        assertNotReservedClientId(clientId);
         const confidential = !PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod);
         const clientSecret = confidential ? (providedSecret ?? randomId()) : undefined;
         const payload = this.#buildPayload(clientId, input, clientSecret);
@@ -108,14 +112,37 @@ export class AdminClientsService {
             logoUri: input.logoUri === null
                 ? undefined
                 : (input.logoUri ?? existing.logo_uri),
+            serviceTenant: input.serviceTenant === undefined
+                ? serviceTenantOf(existing)
+                : input.serviceTenant,
         };
         const confidential = !PUBLIC_AUTH_METHODS.has(merged.tokenEndpointAuthMethod);
         // Mantém o secret atual se continua confidencial; se virou public, remove-o.
         const clientSecret = confidential ? (previousSecret ?? randomId()) : undefined;
         const payload = this.#buildPayload(clientId, merged, clientSecret);
+        if (isClientDisabled(existing))
+            payload[CLIENT_DISABLED_KEY] = true;
         await this.#adapter.upsert(clientId, payload, 0);
         await this.oidc.evictDynamicClientCache();
     }
+    /**
+     * Disables or re-enables a client. A disabled client gets `invalid_client` on every
+     * endpoint from the next request on (tokens already issued stay valid until they
+     * expire). Returns `false` when the client does not exist.
+     */
+    async setDisabled(clientId, disabled) {
+        const existing = await this.#adapter.find(clientId);
+        if (!existing)
+            return false;
+        const payload = { ...existing };
+        if (disabled)
+            payload[CLIENT_DISABLED_KEY] = true;
+        else
+            delete payload[CLIENT_DISABLED_KEY];
+        await this.#adapter.upsert(clientId, payload, 0);
+        await this.oidc.evictDynamicClientCache();
+        return true;
+    }
     /**
      * Regenera o client_secret de um client confidencial, preservando o resto da
      * metadata. Retorna o novo secret em claro (mostrado UMA vez). Lança se o
@@ -145,6 +172,8 @@ export class AdminClientsService {
      * `client_metadata.ts`). Lança `ClientMetadataError`.
      */
     #assertValid(input) {
+        if (input.serviceTenant)
+            this.#assertServiceTenant(input);
         assertClientMetadata({
             applicationType: input.applicationType ?? 'web',
             tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
@@ -153,6 +182,27 @@ export class AdminClientsService {
             postLogoutRedirectUris: input.postLogoutRedirectUris,
         });
     }
+    /** Rules of a service-tenant client (see {@link ClientInput.serviceTenant}). */
+    #assertServiceTenant(input) {
+        if (!this.oidc.config.serviceTenants?.enabled) {
+            throw new ClientMetadataError('service tenants are not enabled: declare serviceTenants.resources in config/authkit.ts');
+        }
+        if (PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod)) {
+            throw new ClientMetadataError('a service tenant must be confidential (it has a secret)');
+        }
+        if ((input.applicationType ?? 'web') !== 'web') {
+            throw new ClientMetadataError('a service tenant must be a web (server) client');
+        }
+        if (input.grantTypes.length !== 1 || input.grantTypes[0] !== 'client_credentials') {
+            throw new ClientMetadataError('a service tenant can only use the client_credentials grant');
+        }
+        if (input.redirectUris.length || input.postLogoutRedirectUris.length) {
+            throw new ClientMetadataError('a service tenant has no redirect URIs');
+        }
+        if (input.backchannelLogoutUri) {
+            throw new ClientMetadataError('a service tenant has no back-channel logout URI');
+        }
+    }
     /**
      * Monta o payload na forma snake_case que o oidc-provider espera/persiste —
      * verificada contra o que o registro dinâmico (RFC 7591) grava. As chaves de
@@ -190,6 +240,12 @@ export class AdminClientsService {
                 payload.backchannel_logout_session_required = input.backchannelLogoutSessionRequired;
             }
         }
+        if (input.serviceTenant) {
+            const tenant = normalizeServiceTenant(input.serviceTenant);
+            if (typeof tenant === 'string')
+                throw new ClientMetadataError(tenant);
+            payload[SERVICE_TENANT_KEY] = tenant;
+        }
         return payload;
     }
     /** Projeta um payload persistido para a forma exibida no console admin. */
@@ -206,6 +262,8 @@ export class AdminClientsService {
             applicationType: p.application_type === 'native' ? 'native' : 'web',
             clientName: typeof p.client_name === 'string' && p.client_name ? p.client_name : null,
             logoUri: typeof p.logo_uri === 'string' && p.logo_uri ? p.logo_uri : null,
+            disabled: isClientDisabled(p),
+            serviceTenant: serviceTenantOf(p),
         };
         if (p.backchannel_logout_uri) {
             result.backchannelLogoutUri = p.backchannel_logout_uri;
@@ -215,3 +273,9 @@ export class AdminClientsService {
         return result;
     }
 }
+/** O `client_id` do client interno do console (ver `console_sso.ts`) não pode ser cadastrado. */
+function assertNotReservedClientId(clientId) {
+    if (clientId === CONSOLE_SSO_CLIENT_ID) {
+        throw new ClientMetadataError(`client_id "${clientId}" é reservado pelo authkit`);
+    }
+}

package/build/src/host/admin_console/admin_console_entry.d.ts

@@ -0,0 +1,14 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import { type AgoraConsoleEntry, type AgoraConsoleRegistry, type AgoraConsoleSearchHit } from '../../console_switcher.js';
+/** The admin console's id in the `'agora.consoles'` registry. */
+export declare const ADMIN_CONSOLE_ID = "authkit";
+/** The `'agora.consoles'` registry, or `null` (none bound, or no booted app). */
+export declare function consoleRegistry(): Promise<AgoraConsoleRegistry | null>;
+/**
+ * Global search of the admin console: users by email (as the account store's `listAccounts`
+ * search matches them), and organizations by name or slug.
+ * Each hit opens the matching drawer in the console.
+ */
+export declare function searchAdminConsole(ctx: HttpContext, adminPrefix: string, query: string, limit: number): Promise<AgoraConsoleSearchHit[]>;
+/** The admin console's registry entry, for the shell mounted at `adminPrefix`. */
+export declare function adminConsoleEntry(adminPrefix: string, authorize: AgoraConsoleEntry['authorize']): AgoraConsoleEntry;

package/build/src/host/admin_console/admin_console_entry.js

@@ -0,0 +1,80 @@
+import { getBootedApp } from '../../../services/booted_app.js';
+import { supportsOrganizations } from '../../accounts/account_store.js';
+import { readAgoraConsoles, } from '../../console_switcher.js';
+/** The admin console's id in the `'agora.consoles'` registry. */
+export const ADMIN_CONSOLE_ID = 'authkit';
+/** The `'agora.consoles'` registry, or `null` (none bound, or no booted app). */
+export async function consoleRegistry() {
+    try {
+        return await readAgoraConsoles(getBootedApp());
+    }
+    catch {
+        return null;
+    }
+}
+const ORG_CACHE_MS = 30_000;
+const orgCache = new WeakMap();
+/** The store's organizations, cached for 30 s per store so a search session does one query. */
+function cachedOrgs(store, load) {
+    const hit = orgCache.get(store);
+    if (hit && Date.now() - hit.at < ORG_CACHE_MS)
+        return hit.rows;
+    const rows = load();
+    orgCache.set(store, { at: Date.now(), rows });
+    rows.catch(() => orgCache.delete(store));
+    return rows;
+}
+/**
+ * Global search of the admin console: users by email (as the account store's `listAccounts`
+ * search matches them), and organizations by name or slug.
+ * Each hit opens the matching drawer in the console.
+ */
+export async function searchAdminConsole(ctx, adminPrefix, query, limit) {
+    const service = await ctx.containerResolver.make('authkit.server');
+    const store = service.config.accountStore;
+    const hits = [];
+    const accounts = await store.listAccounts({ search: query, page: 1, size: limit });
+    for (const account of accounts.data.slice(0, limit)) {
+        hits.push({
+            title: account.email,
+            subtitle: account.name ? `User · ${account.name}` : 'User',
+            href: `${adminPrefix}?view=users&user=${encodeURIComponent(account.id)}`,
+        });
+    }
+    // Organizations only from a store that lists them in one query, for queries of 2+ characters,
+    // from a list cached briefly per process: search runs on every (debounced) keystroke.
+    if (hits.length < limit && query.length >= 2 && supportsOrganizations(store)) {
+        const listAll = store
+            .listAllOrgsWithMemberCount;
+        if (typeof listAll === 'function') {
+            const needle = query.toLowerCase();
+            const orgs = await cachedOrgs(store, () => listAll.call(store));
+            for (const org of orgs) {
+                if (hits.length >= limit)
+                    break;
+                if (!org.name.toLowerCase().includes(needle) && !org.slug.toLowerCase().includes(needle)) {
+                    continue;
+                }
+                hits.push({
+                    title: org.name,
+                    subtitle: `Organization · ${org.slug}`,
+                    href: `${adminPrefix}?view=orgs&org=${encodeURIComponent(org.id)}`,
+                });
+            }
+        }
+    }
+    return hits;
+}
+/** The admin console's registry entry, for the shell mounted at `adminPrefix`. */
+export function adminConsoleEntry(adminPrefix, authorize) {
+    return {
+        id: ADMIN_CONSOLE_ID,
+        title: 'Identity',
+        package: '@adonis-agora/authkit-server',
+        icon: 'identity',
+        path: adminPrefix,
+        order: 90,
+        authorize,
+        search: (ctx, query, limit) => searchAdminConsole(ctx, adminPrefix, query, limit),
+    };
+}

package/build/src/host/admin_console/admin_shell_controller.js

@@ -1,8 +1,10 @@
 import { readFile } from 'node:fs/promises';
 import { extname } from 'node:path';
+import { countOtherConsoles } from '../../console_switcher.js';
 import { accountPath } from '../account_paths.js';
 import { resolveAccountRoles, rolesManagedExternally } from '../account_roles.js';
 import { getAdminPrefix } from '../admin_prefix.js';
+import { ADMIN_CONSOLE_ID, consoleRegistry } from './admin_console_entry.js';
 // ─── Shell HTML cache ─────────────────────────────────────────────────────────
 /**
  * Points to the Vite-built index.html inside build/host/ui-dist/.
@@ -141,6 +143,9 @@ export default class AdminShellController {
             }
         }
         const adminBase = getAdminPrefix();
+        // Console switcher: only announced when other `@adonis-agora` consoles are registered; the SPA
+        // then asks the endpoint which of them this viewer may open.
+        const others = countOtherConsoles(await consoleRegistry(), ADMIN_CONSOLE_ID);
         const authkitConfig = {
             adminBase,
             csrfToken: ctx.request.csrfToken ?? null,
@@ -152,6 +157,9 @@ export default class AdminShellController {
                 // Confirmação de identidade (sudo) das ações destrutivas.
                 confirm: accountPath('confirm'),
             },
+            ...(others > 0 ? { switcher: { endpoint: `${adminBase}/api/consoles`, others } } : {}),
+            // Global search (Ctrl/Cmd-K) across this console and every other one the viewer may open.
+            search: { endpoint: `${adminBase}/api/consoles/search` },
             features: {
                 // A página de personal agents só aparece com `personalAgents` no config.
                 personalAgents: !!cfg.personalAgents,

package/build/src/host/admin_console/console_clients_controller.d.ts

@@ -9,8 +9,11 @@ import type { HttpContext } from '@adonisjs/core/http';
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
+ * POST   {prefix}/api/clients/:id/disable     → stop issuing tokens to the client
+ * POST   {prefix}/api/clients/:id/enable      → issue tokens again
  */
 export default class ConsoleClientsController {
+    #private;
     /** GET {prefix}/api/clients */
     index(ctx: HttpContext): Promise<{
         data: {
@@ -25,6 +28,8 @@ export default class ConsoleClientsController {
             backchannelLogoutSessionRequired: boolean;
             clientName: string | null;
             logoUri: string | null;
+            disabled: boolean;
+            serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
         }[];
         canList: boolean;
     }>;
@@ -41,6 +46,8 @@ export default class ConsoleClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     /** POST {prefix}/api/clients */
     store(ctx: HttpContext): Promise<void | {
@@ -60,12 +67,46 @@ export default class ConsoleClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     /** DELETE {prefix}/api/clients/:id */
     destroy(ctx: HttpContext): Promise<void | {
         ok: boolean;
         deleted: string;
     }>;
+    /** POST {prefix}/api/clients/:id/disable */
+    disable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
+    /** POST {prefix}/api/clients/:id/enable */
+    enable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
     /** POST {prefix}/api/clients/:id/regenerate-secret */
     regenerateSecret(ctx: HttpContext): Promise<void | {
         clientId: string;

package/build/src/host/admin_console/console_clients_controller.js

@@ -19,6 +19,8 @@ function invalidMetadata(ctx, err) {
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
+ * POST   {prefix}/api/clients/:id/disable     → stop issuing tokens to the client
+ * POST   {prefix}/api/clients/:id/enable      → issue tokens again
  */
 export default class ConsoleClientsController {
     /** GET {prefix}/api/clients */
@@ -107,6 +109,34 @@ export default class ConsoleClientsController {
         });
         return { ok: true, deleted: id };
     }
+    /** POST {prefix}/api/clients/:id/disable */
+    async disable(ctx) {
+        return this.#setDisabled(ctx, true);
+    }
+    /** POST {prefix}/api/clients/:id/enable */
+    async enable(ctx) {
+        return this.#setDisabled(ctx, false);
+    }
+    /** Disabled clients get `invalid_client` from the next request on. */
+    async #setDisabled(ctx, disabled) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const svc = new AdminClientsService(service);
+        const id = ctx.request.param('id');
+        if (!(await svc.setDisabled(id, disabled))) {
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        }
+        const client = await svc.find(id);
+        await service.config.audit?.record({
+            type: disabled ? 'client.disabled' : 'client.enabled',
+            clientId: id,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: {
+                actor: 'admin-console',
+                ...(client?.serviceTenant ? { partition: client.serviceTenant.partition } : {}),
+            },
+        });
+        return clientDto(client);
+    }
     /** POST {prefix}/api/clients/:id/regenerate-secret */
     async regenerateSecret(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
@@ -129,7 +159,10 @@ export default class ConsoleClientsController {
             type: 'client.secret_regenerated',
             clientId: id,
             ip: ctx.request.ip?.() ?? null,
-            metadata: { actor: 'admin-console' },
+            metadata: {
+                actor: 'admin-console',
+                ...(existing.serviceTenant ? { partition: existing.serviceTenant.partition } : {}),
+            },
         });
         return { clientId: id, clientSecret: newSecret };
     }

package/build/src/host/admin_console/console_personal_agents_controller.d.ts

@@ -22,7 +22,7 @@ interface AgentEntry {
     connections: number;
 }
 /**
- * Endpoints JSON de personal agents (PACT e Poppy) do console admin React.
+ * Endpoints JSON de personal agents (PACT e `personalAgents.extensions`) do console admin React.
  *
  * GET    {prefix}/api/personal-agents                          → agentes (config + console + conectados)
  * GET    {prefix}/api/personal-agents/connections?clientId=&accountId=&protocol=&page=&size=
@@ -41,11 +41,6 @@ export default class ConsolePersonalAgentsController {
                 /** A lista do config é uma função do host (o console não enxerga). */
                 hostResolver: boolean;
             } | null;
-            poppy: {
-                requireRegistration: boolean;
-                hostResolver: boolean;
-                allowInsecureClientIds: boolean;
-            } | null;
         };
         agents: AgentEntry[];
     }>;

package/build/src/host/admin_console/console_personal_agents_controller.js

@@ -31,10 +31,21 @@ function enabledProtocols(runtime) {
     const out = [];
     if (runtime.config.pact)
         out.push('pact');
-    if (runtime.config.poppy)
-        out.push('poppy');
+    out.push(...runtime.extensions.keys());
     return out;
 }
+/** O protocolo dono de um grant, pelo prefixo do id. */
+function protocolOfGrant(runtime, grantId) {
+    for (const [id, { extension }] of runtime.extensions) {
+        if (grantId.startsWith(extension.grantIdPrefix))
+            return id;
+    }
+    return 'pact';
+}
+/** Prefixo de id dos grants de um protocolo (`agrant_` = PACT). */
+function grantPrefixOf(runtime, protocol) {
+    return runtime.extensions.get(protocol)?.extension.grantIdPrefix ?? 'agrant_';
+}
 function isUrl(value, allowHttp) {
     if (typeof value !== 'string' || value.length > 2048)
         return false;
@@ -52,14 +63,14 @@ function isUrl(value, allowHttp) {
 async function agentName(runtime, protocol, identifier, fallback) {
     if (fallback)
         return fallback;
-    if (protocol === 'poppy' && runtime.poppy) {
-        return runtime.poppy.registry.displayName(identifier);
-    }
+    const extension = runtime.extensions.get(protocol);
+    if (extension)
+        return extension.runtime.displayName(identifier);
     const registration = await runtime.config.resolveAgent(identifier);
     return displayNameFor(registration ?? { issuer: identifier, jwksUri: '' });
 }
 /**
- * Endpoints JSON de personal agents (PACT e Poppy) do console admin React.
+ * Endpoints JSON de personal agents (PACT e `personalAgents.extensions`) do console admin React.
  *
  * GET    {prefix}/api/personal-agents                          → agentes (config + console + conectados)
  * GET    {prefix}/api/personal-agents/connections?clientId=&accountId=&protocol=&page=&size=
@@ -105,17 +116,20 @@ export default class ConsolePersonalAgentsController {
                 e.jwksUri = agent.jwksUri;
                 names.set(keyOf('pact', agent.issuer), agent.name ?? null);
             }
-            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'pact')) {
+            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'agrant_')) {
                 entry('pact', clientId).connections = count;
             }
         }
-        if (cfg.poppy) {
-            for (const id of cfg.poppy.clients.registeredList ?? [])
-                entry('poppy', id).config = 'allowed';
-            for (const id of cfg.poppy.clients.blockedList ?? [])
-                entry('poppy', id).config = 'blocked';
-            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'poppy')) {
-                entry('poppy', clientId).connections = count;
+        const summaries = {};
+        for (const [protocol, { extension, runtime: ext }] of runtime.extensions) {
+            const summary = ext.consoleSummary();
+            summaries[protocol] = { label: extension.label, ...summary };
+            for (const id of summary.configured.allowed)
+                entry(protocol, id).config = 'allowed';
+            for (const id of summary.configured.blocked)
+                entry(protocol, id).config = 'blocked';
+            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, extension.grantIdPrefix)) {
+                entry(protocol, clientId).connections = count;
             }
         }
         for (const row of await runtime.registry.list()) {
@@ -153,13 +167,17 @@ export default class ConsolePersonalAgentsController {
                         hostResolver: cfg.staticAgents === null,
                     }
                     : null,
-                poppy: cfg.poppy
-                    ? {
-                        requireRegistration: cfg.poppy.clients.requireRegistration,
-                        hostResolver: cfg.poppy.clients.registeredList === null || cfg.poppy.clients.blockedList === null,
-                        allowInsecureClientIds: cfg.poppy.allowInsecureClientIds,
-                    }
-                    : null,
+                ...Object.fromEntries(Object.entries(summaries).map(([protocol, summary]) => [
+                    protocol,
+                    {
+                        label: summary.label,
+                        requireRegistration: summary.requireRegistration,
+                        hostResolver: summary.hostResolver,
+                        allowHttpIdentifiers: summary.allowHttpIdentifiers,
+                        identifierLabel: summary.identifierLabel,
+                        identifierPlaceholder: summary.identifierPlaceholder ?? null,
+                    },
+                ])),
             },
             agents,
         };
@@ -172,11 +190,9 @@ export default class ConsolePersonalAgentsController {
         const qs = ctx.request.qs();
         const page = parseListPage(qs.page);
         const size = parseListSize(qs.size);
-        const protocol = qs.protocol === 'pact' || qs.protocol === 'poppy'
-            ? qs.protocol
-            : undefined;
+        const protocol = qs.protocol && enabledProtocols(runtime).includes(qs.protocol) ? qs.protocol : undefined;
         const filter = {
-            protocol,
+            idPrefix: protocol ? grantPrefixOf(runtime, protocol) : undefined,
             clientId: qs.clientId?.trim() || undefined,
             accountId: qs.accountId?.trim() || undefined,
         };
@@ -189,7 +205,7 @@ export default class ConsolePersonalAgentsController {
         const emails = new Map();
         const nameCache = new Map();
         const data = await Promise.all(rows.map(async (g) => {
-            const rowProtocol = g.id.startsWith('pgrant_') ? 'poppy' : 'pact';
+            const rowProtocol = protocolOfGrant(runtime, g.id);
             if (!emails.has(g.accountId)) {
                 const account = await store.findById(g.accountId).catch(() => null);
                 emails.set(g.accountId, account?.email ?? null);
@@ -248,17 +264,21 @@ export default class ConsolePersonalAgentsController {
         const invalid = (message) => ctx.response.unprocessableEntity(apiError('invalid_request', message));
         const protocol = body.protocol;
         if (!enabledProtocols(runtime).includes(protocol)) {
-            return invalid('`protocol` precisa ser um protocolo ligado (`pact` ou `poppy`).');
+            return invalid(`\`protocol\` precisa ser um protocolo ligado (${enabledProtocols(runtime)
+                .map((p) => `\`${p}\``)
+                .join(', ')}).`);
         }
         const status = body.status;
         if (status !== 'allowed' && status !== 'blocked') {
             return invalid('`status` precisa ser `allowed` ou `blocked`.');
         }
-        const allowHttp = protocol === 'poppy' && !!runtime.config.poppy?.allowInsecureClientIds;
+        const extension = runtime.extensions.get(protocol);
+        const summary = extension?.runtime.consoleSummary();
+        const allowHttp = !!summary?.allowHttpIdentifiers;
         const identifier = typeof body.identifier === 'string' ? body.identifier.trim() : '';
         if (!isUrl(identifier, allowHttp)) {
-            return invalid(protocol === 'poppy'
-                ? '`identifier` precisa ser o `client_id` do agente (URL HTTPS do documento de metadata).'
+            return invalid(summary
+                ? `\`identifier\` precisa ser uma URL ${allowHttp ? 'http(s)' : 'HTTPS'}: ${summary.identifierLabel}.`
                 : '`identifier` precisa ser o `iss` do agente (URL HTTPS).');
         }
         const name = typeof body.name === 'string' && body.name.trim() ? body.name.trim().slice(0, 200) : null;

package/build/src/host/admin_console/console_switcher_controller.d.ts

@@ -0,0 +1,11 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * The console switcher endpoints of the admin console (behind the admin console's own guard).
+ *
+ * GET {prefix}/api/consoles           → the other consoles this viewer may open
+ * GET {prefix}/api/consoles/search?q= → hits from every console this viewer may open
+ */
+export default class ConsoleSwitcherController {
+    index(ctx: HttpContext): Promise<import("../../console_switcher.js").VisibleConsoles>;
+    search(ctx: HttpContext): Promise<import("../../console_switcher.js").ConsoleSearchResults>;
+}

package/build/src/host/admin_console/console_switcher_controller.js

@@ -0,0 +1,23 @@
+import { listVisibleConsoles, searchConsoles } from '../../console_switcher.js';
+import { ADMIN_CONSOLE_ID, consoleRegistry } from './admin_console_entry.js';
+/**
+ * The console switcher endpoints of the admin console (behind the admin console's own guard).
+ *
+ * GET {prefix}/api/consoles           → the other consoles this viewer may open
+ * GET {prefix}/api/consoles/search?q= → hits from every console this viewer may open
+ */
+export default class ConsoleSwitcherController {
+    async index(ctx) {
+        const body = await listVisibleConsoles(await consoleRegistry(), ADMIN_CONSOLE_ID, ctx, {
+            logger: ctx.logger,
+        });
+        ctx.response.header('Cache-Control', 'private, no-store');
+        return body;
+    }
+    async search(ctx) {
+        const q = ctx.request.input('q', '');
+        const body = await searchConsoles(await consoleRegistry(), ADMIN_CONSOLE_ID, ctx, typeof q === 'string' ? q : '', { logger: ctx.logger });
+        ctx.response.header('Cache-Control', 'private, no-store');
+        return body;
+    }
+}

package/build/src/host/admin_console_warning.d.ts

@@ -0,0 +1,8 @@
+/** The boot warning for an admin console with no `admin.authorize`. Same wording in every console. */
+export declare const ADMIN_CONSOLE_NO_AUTHORIZE_WARNING = "[@adonis-agora/authkit-server] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/authkit.ts.";
+/** Logs {@link ADMIN_CONSOLE_NO_AUTHORIZE_WARNING} once per process. */
+export declare function warnAdminConsoleUnauthorized(logger: {
+    warn: (message: string) => unknown;
+} | null | undefined): boolean;
+/** Test helper: lets the warning fire again. */
+export declare function resetAdminConsoleWarning(): void;

package/build/src/host/admin_console_warning.js

@@ -0,0 +1,18 @@
+/** The boot warning for an admin console with no `admin.authorize`. Same wording in every console. */
+export const ADMIN_CONSOLE_NO_AUTHORIZE_WARNING = '[@adonis-agora/authkit-server] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/authkit.ts.';
+let warned = false;
+/** Logs {@link ADMIN_CONSOLE_NO_AUTHORIZE_WARNING} once per process. */
+export function warnAdminConsoleUnauthorized(logger) {
+    if (warned)
+        return false;
+    warned = true;
+    if (logger)
+        logger.warn(ADMIN_CONSOLE_NO_AUTHORIZE_WARNING);
+    else
+        console.warn(ADMIN_CONSOLE_NO_AUTHORIZE_WARNING);
+    return true;
+}
+/** Test helper: lets the warning fire again. */
+export function resetAdminConsoleWarning() {
+    warned = false;
+}

package/build/src/host/admin_sessions_service.js

@@ -87,7 +87,7 @@ export class AdminSessionsService {
     /**
      * Revogação total também corta os personal agents: "sair de todas as sessões",
      * reset de senha, a ação do admin e a exclusão de conta não podem deixar um
-     * agente agindo na conta (delegações do PACT e refresh tokens do Poppy). Sem
+     * agente agindo na conta (delegações do PACT e conexões das extensions). Sem
      * `personalAgents` é no-op — e aí nem resolve o banco. Diferente do
      * `recordSubRevocation`, uma falha AQUI propaga: não há outra camada que corte
      * esses tokens.
@@ -142,11 +142,14 @@ export class AdminSessionsService {
             return [];
         return (await adapter.list()).filter((r) => grantIds.has(r.payload.grantId));
     }
-    /** Grants da conta, exceto os espelhos `pgrant_` de refresh tokens do Poppy. */
+    /**
+     * Grants da conta, exceto os espelhos dos grants das `personalAgents.extensions` (os access
+     * tokens de MCP que elas emitem pelo oidc-provider usam o id do grant delas) — aparecem e são
+     * revogados como personal agent, não como app OIDC.
+     */
     async #accountGrants(accountId) {
-        // Os grants `pgrant_` são o espelho de um refresh token do Poppy (Bearer de MCP) — aparecem e
-        // são revogados como personal agent, não como app OIDC.
-        return (await this.#listModelOfAccount('Grant', accountId)).filter((r) => !r.id.startsWith('pgrant_'));
+        const prefixes = (this.#oidc.config.personalAgents?.extensions ?? []).map((e) => e.grantIdPrefix);
+        return (await this.#listModelOfAccount('Grant', accountId)).filter((r) => !prefixes.some((prefix) => r.id.startsWith(prefix)));
     }
     /**
      * Conta TODAS as sessões ativas do IdP (todas as contas). 0 quando o adapter não