@adonis-agora/authkit-server 1.0.0-rc.0 → 1.0.0-rc.10

package/build/src/host/register_auth_host.js

@@ -1,3 +1,6 @@
+import { getBootedApp } from '../../services/booted_app.js';
+import { mountAccountExtensions } from '../account/mount.js';
+import { registerAgoraConsole } from '../console_switcher.js';
 import { resolveRateLimit } from '../define_config.js';
 import { accountHome } from './account_home.js';
 import { getAccountLoginUrl, setAccountLoginUrl } from './account_login_url.js';
@@ -5,10 +8,13 @@ import { accountPath, accountPathsMap, accountPrefix, joinAccountPath, setAccoun
 import { resolveAccountRoles } from './account_roles.js';
 import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 import { adminApiGuard } from './admin_api/admin_api_guard.js';
+import { adminAuthorizeChecker, appInProduction } from './admin_authorize.js';
+import { adminConsoleEntry } from './admin_console/admin_console_entry.js';
 import { normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './admin_prefix.js';
 import { getAuthHostConfig, markAuthHostAutoMounted, wasAuthHostAutoMounted, } from './auth_host_config.js';
-import { ensureConsoleSession } from './idp_session_bridge.js';
-import { POPPY_WEB_SESSION_KEY } from './poppy_session_key.js';
+import { consoleDeniedPage } from './console_denied_page.js';
+import { CONSOLE_SSO_CALLBACK_PATH, CONSOLE_SSO_START_PATH } from './console_sso.js';
+import { endBridgedIdpSession, ensureConsoleSession } from './idp_session_bridge.js';
 import { createAuthThrottles } from './rate_limit.js';
 import { redirectExact } from './redirect_exact.js';
 import { requestPathWithQuery } from './request_url.js';
@@ -67,7 +73,10 @@ async function checkAndRefreshIdle(ctx) {
         const lastSeen = ctx.session?.get(ACCOUNT_LAST_SEEN_KEY);
         const now = Date.now();
         if (lastSeen !== undefined && now - lastSeen > idleMs) {
-            // Idle excedido: encerra a sessão.
+            // Idle excedido: encerra a sessão. Console aberto pela sessão do IdP (SSO):
+            // encerra também essa sessão, senão a ponte reabriria o console no próximo
+            // request e o idle timeout não teria efeito.
+            await endBridgedIdpSession(ctx);
             ctx.session?.forget(ACCOUNT_SESSION_KEY);
             ctx.session?.forget(ACCOUNT_LAST_SEEN_KEY);
             return true;
@@ -81,6 +90,23 @@ async function checkAndRefreshIdle(ctx) {
         return false;
     }
 }
+/** Read-only twin of {@link checkAndRefreshIdle}: whether the idle timeout passed. Never writes. */
+async function isIdleExpired(ctx) {
+    try {
+        const runtimeSettings = await resolveRuntimeSettings(ctx);
+        if (!runtimeSettings)
+            return false;
+        const policy = await resolveEffectiveSessionPolicy(runtimeSettings);
+        const idleMs = policy.idleTimeoutMinutes * 60 * 1000;
+        if (idleMs <= 0)
+            return false;
+        const lastSeen = ctx.session?.get(ACCOUNT_LAST_SEEN_KEY);
+        return lastSeen !== undefined && Date.now() - lastSeen > idleMs;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Constrói a URL de redirect para o login da conta, preservando o destino
  * original como `return_to` (URL-encoded). A URL de destino é o path + query
@@ -114,10 +140,21 @@ function buildLoginRedirect(ctx, extra) {
  * classe NÃO era aplicada em runtime num grupo, deixando /account/tokens e
  * /account/mfa acessíveis sem sessão.
  */
-/** A sessão é do navegador de um personal agent Poppy (§5)? */
-function isPoppyBrowser(ctx) {
-    const marker = ctx.session?.get?.(POPPY_WEB_SESSION_KEY);
-    return typeof marker === 'object' && marker !== null && typeof marker.sessionId === 'string';
+/**
+ * A sessão é do navegador de um personal agent (`isAgentBrowser` de uma extension)? Um hook que
+ * lança conta como "é": na dúvida, o console fica fechado.
+ */
+function isAgentBrowser(ctx) {
+    for (const extension of getAuthHostConfig()?.personalAgents?.extensions ?? []) {
+        try {
+            if (extension.isAgentBrowser?.(ctx))
+                return true;
+        }
+        catch {
+            return true;
+        }
+    }
+    return false;
 }
 /**
  * `true` when the caller wants JSON (an `Accept` that prefers `application/json`,
@@ -142,9 +179,9 @@ function unauthenticated(ctx, redirectTo) {
     return redirectExact(ctx.response, redirectTo);
 }
 const accountGuard = async (ctx, next) => {
-    // O navegador de um personal agent Poppy (§5) não entra no console de conta nem
-    // nas telas de consentimento: a sessão é do agente, não do usuário.
-    if (isPoppyBrowser(ctx))
+    // O navegador de um personal agent não entra no console de conta nem nas telas de
+    // consentimento: a sessão é do agente, não do usuário.
+    if (isAgentBrowser(ctx))
         return ctx.response.status(403).send('');
     // Sessão do console — ou, com `accountSession.acceptIdpSession`, a do IdP (SSO).
     if (!(await ensureConsoleSession(ctx))) {
@@ -166,50 +203,139 @@ const accountGuard = async (ctx, next) => {
  *      (senão → `accountHome(cfg)`, default /account/security — NÃO revela a
  *      existência do /admin, e cai numa tela que o host controla via `accountHome`;
  *      se a tela default estiver desmontada, aponte `config.accountHome` para uma montada).
+ *   3. `config.admin.authorize` liberando (403/401/redirect conforme o resultado). Omitido:
+ *      aberto fora de produção, 403 em produção.
  * As roles permitidas são resolvidas em runtime do `authkit.server` (config lazy).
  */
 export const adminGuard = async (ctx, next) => {
+    const access = await evaluateAdminAccess(ctx);
+    switch (access.kind) {
+        case 'allowed':
+            return next();
+        case 'disabled':
+            // Defesa contra flag-drift: as rotas são montadas com `admin: true` em tempo de
+            // registro, ANTES de o config resolver. Se o config tiver `admin.enabled: false`,
+            // as rotas existem mas o console deve estar desligado — 404 (não vaza a existência).
+            return ctx.response.notFound();
+        case 'agent':
+            return ctx.response.status(403).send('');
+        case 'signed-out':
+            // `/account/login` é sempre o login da conta — NÃO muda com o prefixo admin.
+            return unauthenticated(ctx, buildLoginRedirect(ctx));
+        case 'idle':
+            return unauthenticated(ctx, buildLoginRedirect(ctx, 'reason=idle'));
+        case 'not-admin':
+            // Evita vazar a existência do console admin: redireciona para o accountHome
+            // (sem mostrar a URL do admin).
+            if (wantsJson(ctx)) {
+                return ctx.response
+                    .status(403)
+                    .send({ error: { code: 'forbidden', message: 'Admin role required.' } });
+            }
+            return redirectExact(ctx.response, accountHome(access.cfg));
+        case 'denied':
+            return consoleDenied(ctx, access.decision);
+    }
+};
+/**
+ * The admin console gate: the session, then `admin.roles`, then `admin.authorize`.
+ *
+ * `probe: true` is the console switcher asking from another console: it reads the idle timeout
+ * without refreshing or ending the session.
+ */
+async function evaluateAdminAccess(ctx, options = {}) {
     const service = await ctx.containerResolver.make('authkit.server');
     const cfg = service.config;
-    // Defesa contra flag-drift: as rotas são montadas com `admin: true` em tempo de
-    // registro, ANTES de o config resolver. Se o config tiver `admin.enabled: false`,
-    // as rotas existem mas o console deve estar desligado — 404 (não vaza a existência).
-    if (!cfg.admin.enabled) {
-        return ctx.response.notFound();
-    }
-    if (isPoppyBrowser(ctx))
-        return ctx.response.status(403).send('');
+    if (!cfg.admin.enabled)
+        return { kind: 'disabled' };
+    if (isAgentBrowser(ctx))
+        return { kind: 'agent' };
     // Com `accountSession.acceptIdpSession`, a sessão do IdP também abre o console.
     await ensureConsoleSession(ctx);
     const accountId = ctx.session?.get(ACCOUNT_SESSION_KEY);
-    if (!accountId) {
-        // `/account/login` é sempre o login da conta — NÃO muda com o prefixo admin.
-        return unauthenticated(ctx, buildLoginRedirect(ctx));
-    }
+    if (!accountId)
+        return { kind: 'signed-out' };
     // Idle timeout: também protege o console admin.
-    const idleExpired = await checkAndRefreshIdle(ctx);
-    if (idleExpired) {
-        return unauthenticated(ctx, buildLoginRedirect(ctx, 'reason=idle'));
-    }
+    const idleExpired = options.probe ? await isIdleExpired(ctx) : await checkAndRefreshIdle(ctx);
+    if (idleExpired)
+        return { kind: 'idle' };
     const allowed = cfg.admin.roles;
     const account = await cfg.accountStore.findById(accountId);
     // Resolve roles through the host's role authority (`resolveTokenRoles`) when set — the same source
     // the token claim is minted from — so an app-role admin reaches the console. Falls back to the
     // account's stored `globalRoles` when no hook is configured.
     const roles = account ? await resolveAccountRoles(cfg, account) : [];
-    const isAdmin = roles.some((r) => allowed.includes(r));
-    if (!isAdmin) {
-        // Evita vazar a existência do console admin: redireciona para o accountHome
-        // (sem mostrar a URL do admin).
-        if (wantsJson(ctx)) {
+    if (!roles.some((r) => allowed.includes(r)))
+        return { kind: 'not-admin', cfg };
+    // `admin.authorize`, after the roles: both must pass. Omitted, the console is open
+    // outside production and closed (403) in production.
+    const decision = cfg.admin.authorize
+        ? await adminAuthorizeChecker(cfg.admin.authorize)(ctx)
+        : appInProduction()
+            ? { allowed: false, status: 403 }
+            : { allowed: true };
+    if (!decision.allowed)
+        return { kind: 'denied', decision };
+    return { kind: 'allowed' };
+}
+/**
+ * The admin console gate as the console switcher reads it: `{ allowed }`, never a response, never a
+ * throw. Used as the `authorize` of the admin console's `'agora.consoles'` entry.
+ */
+export async function adminConsoleDecision(ctx) {
+    try {
+        const access = await evaluateAdminAccess(ctx, { probe: true });
+        if (access.kind === 'allowed')
+            return { allowed: true };
+        const unauthenticated = access.kind === 'signed-out' ||
+            access.kind === 'idle' ||
+            (access.kind === 'denied' && access.decision.status === 401);
+        return { allowed: false, reason: unauthenticated ? 'unauthenticated' : 'forbidden' };
+    }
+    catch {
+        return { allowed: false, reason: 'forbidden' };
+    }
+}
+/**
+ * Registers the admin console in the shared `'agora.consoles'` registry, so every other
+ * `@adonis-agora` console's switcher can link to it. A no-op when the provider did not register the
+ * app (tests that mount routes on a bare router).
+ */
+function announceAdminConsole(adminPrefix) {
+    let app;
+    try {
+        app = getBootedApp();
+    }
+    catch {
+        return;
+    }
+    void (async () => {
+        const logger = (await app.container.make('logger').catch(() => undefined));
+        await registerAgoraConsole(app, adminConsoleEntry(adminPrefix, adminConsoleDecision), logger);
+    })().catch(() => { });
+}
+/** The response for an `admin.authorize` denial: same rules in every `@adonis-agora` console. */
+function consoleDenied(ctx, decision) {
+    const json = wantsJson(ctx);
+    if (decision.redirectTo) {
+        if (json) {
             return ctx.response
-                .status(403)
-                .send({ error: { code: 'forbidden', message: 'Admin role required.' } });
+                .status(401)
+                .send({ error: 'unauthenticated', redirectTo: decision.redirectTo });
         }
-        return ctx.response.redirect(accountHome(cfg));
+        return redirectExact(ctx.response, decision.redirectTo);
     }
-    return next();
-};
+    if (decision.status === 401) {
+        if (json)
+            return ctx.response.status(401).send({ error: 'unauthenticated' });
+        ctx.response.header('Content-Type', 'text/html; charset=utf-8');
+        return ctx.response.status(401).send(consoleDeniedPage(401));
+    }
+    if (json)
+        return ctx.response.status(403).send({ error: 'forbidden' });
+    ctx.response.header('Content-Type', 'text/html; charset=utf-8');
+    return ctx.response.status(403).send(consoleDeniedPage(403));
+}
 const C = {
     oidc: () => import('../controllers/oidc_callback_controller.js'),
     authorizationServerMetadata: () => import('../controllers/authorization_server_metadata_controller.js'),
@@ -218,6 +344,7 @@ const C = {
     social: () => import('./controllers/social_controller.js'),
     patIntrospection: () => import('./controllers/pat_introspection_controller.js'),
     accountSession: () => import('./controllers/account_session_controller.js'),
+    consoleSso: () => import('./controllers/console_sso_controller.js'),
     accountTokens: () => import('./controllers/account_tokens_controller.js'),
     accountSecurity: () => import('./controllers/account_security_controller.js'),
     accountApps: () => import('./controllers/account_apps_controller.js'),
@@ -226,8 +353,6 @@ const C = {
     accountConfirm: () => import('./controllers/account_confirm_controller.js'),
     agentOAuth: () => import('./controllers/agent_oauth_controller.js'),
     agentConsent: () => import('./controllers/agent_consent_controller.js'),
-    poppy: () => import('./controllers/poppy_controller.js'),
-    poppyConsent: () => import('./controllers/poppy_consent_controller.js'),
     webauthnAsset: () => import('./controllers/webauthn_asset_controller.js'),
     logoutAsset: () => import('./controllers/logout_asset_controller.js'),
     passkeyAutofillAsset: () => import('./controllers/passkey_autofill_asset_controller.js'),
@@ -238,6 +363,7 @@ const C = {
     // Console React JSON API (session-authed, under {prefix}/api/*).
     consoleShell: () => import('./admin_console/admin_shell_controller.js'),
     consoleOverview: () => import('./admin_console/console_overview_controller.js'),
+    consoleSwitcher: () => import('./admin_console/console_switcher_controller.js'),
     consoleUsers: () => import('./admin_console/console_users_controller.js'),
     consoleSessions: () => import('./admin_console/console_sessions_controller.js'),
     consoleClients: () => import('./admin_console/console_clients_controller.js'),
@@ -380,6 +506,17 @@ export function registerAuthHost(router, opts = {}) {
     if (accountLoginUrlOpt !== undefined) {
         setAccountLoginUrl(accountLoginUrlOpt);
     }
+    // Console sem porta de entrada: SSO desligado (`acceptIdpSession: false`) deixa só o
+    // login próprio do console, que é por senha; com a senha desligada ninguém entra em
+    // `/account/*` nem no console admin. Só passa com um `accountLoginUrl` do host (aqui
+    // ou em `routes.accountLoginUrl`) — por isso a checagem é no registro, não no config.
+    if (hostCfg?.consoleNeedsLoginUrl && !accountLoginUrlOpt) {
+        throw new Error('authkit: `accountSession.acceptIdpSession: false` com `authMethods: { password: false }` ' +
+            'deixa o console de conta e o console admin sem nenhum jeito de entrar (o login próprio ' +
+            'do console é por senha). Remova `acceptIdpSession: false` (o default entra pelo login ' +
+            'do IdP) ou passe `accountLoginUrl` (no `registerAuthHost` ou em `routes`) apontando ' +
+            'para um login do seu app.');
+    }
     // Montagem por tela do console de conta. `undefined` → tudo montado;
     // `false` → nada; objeto → cada flag ausente default `true`.
     const accountOpt = opts.account ?? routesCfg?.account;
@@ -506,6 +643,13 @@ export function registerAuthHost(router, opts = {}) {
     // Provider OIDC (wildcard + root) — o que registerOidcRoutes fazia.
     router.any(`${mount}/*`, [C.oidc]).as('authkit.oidc.wildcard');
     router.any(mount, [C.oidc]).as('authkit.oidc.root');
+    // Login do console pelo IdP (SSO; client interno `authkit-console`, ver
+    // `console_sso.ts`). Sempre montado: com `acceptIdpSession: false` o início só
+    // redireciona para o login próprio do console.
+    router.get(CONSOLE_SSO_START_PATH, [C.consoleSso, 'start']).as('authkit.console_sso.start');
+    router
+        .get(CONSOLE_SSO_CALLBACK_PATH, [C.consoleSso, 'callback'])
+        .as('authkit.console_sso.callback');
     // Interaction (login multi-step + consent + signup).
     // Cada rota passa por `keep(key, …)`: entra em `AuthHostRouteMap.routes`/`urls` e
     // recebe o `extraMiddleware` do host (depois do throttle da lib).
@@ -590,56 +734,13 @@ export function registerAuthHost(router, opts = {}) {
         })
             .use([accountGuard]);
     }
-    // Personal Agent Protocol (Poppy): descoberta, authorization server (token,
-    // revogação, device authorization), Mediated Sign-In e sessão de navegador —
-    // server-to-server ou POST cross-site do navegador do agente (sem CSRF, ver
-    // `authkitCsrfExceptions`). As telas do usuário (authorize/device) exigem a
-    // sessão de conta e mantêm o CSRF.
-    const poppyPrefix = hostCfg?.personalAgents?.poppyPrefix;
-    if (poppyPrefix) {
-        // Nomes explícitos: o Router nomeia pela dupla controller.método, e as duas URLs da metadata
-        // (RFC 8414 na raiz e debaixo do issuer) usam o mesmo — "poppy.metadata already exists" no boot.
-        router.get('/.well-known/poppy.json', [C.poppy, 'discovery']).as('authkit.poppy.discovery');
-        router
-            .get('/.well-known/oauth-protected-resource', [C.poppy, 'protectedResource'])
-            .as('authkit.poppy.protected_resource');
-        router
-            .get(`/.well-known/oauth-authorization-server${poppyPrefix}`, [C.poppy, 'metadata'])
-            .as('authkit.poppy.metadata');
-        router
-            .get(`${poppyPrefix}/.well-known/oauth-authorization-server`, [C.poppy, 'metadata'])
-            .as('authkit.poppy.metadata_under_issuer');
-        router.post(`${poppyPrefix}/oauth/token`, [C.poppy, 'token']).as('authkit.poppy.token');
-        router.post(`${poppyPrefix}/oauth/revoke`, [C.poppy, 'revoke']).as('authkit.poppy.revoke');
-        router
-            .post(`${poppyPrefix}/oauth/device`, [C.poppy, 'deviceAuthorization'])
-            .as('authkit.poppy.device_authorization');
-        // A página grava um pedido sem autenticação: throttle por IP.
-        withLogin(router
-            .get(`${poppyPrefix}/browser-session`, [C.poppy, 'browserSessionPage'])
-            .as('authkit.poppy.browser_session_page'));
-        router
-            .post(`${poppyPrefix}/browser-session`, [C.poppy, 'browserSession'])
-            .as('authkit.poppy.browser_session');
-        router
-            .post(`${poppyPrefix}/browser-session/authorize`, [C.poppy, 'browserSessionAuthorize'])
-            .as('authkit.poppy.browser_session_authorize');
-        router
-            .group(() => {
-            router
-                .get(`${poppyPrefix}/oauth/authorize`, [C.poppyConsent, 'authorize'])
-                .as('authkit.poppy.authorize');
-            router
-                .post(`${poppyPrefix}/oauth/authorize`, [C.poppyConsent, 'decideAuthorization'])
-                .as('authkit.poppy.authorize_decide');
-            withOtpLogin(router
-                .get(`${poppyPrefix}/device`, [C.poppyConsent, 'device'])
-                .as('authkit.poppy.device'));
-            withOtpLogin(router
-                .post(`${poppyPrefix}/device`, [C.poppyConsent, 'decideDevice'])
-                .as('authkit.poppy.device_decide'));
-        })
-            .use([accountGuard]);
+    // `personalAgents.extensions`: cada uma monta as rotas dela, com o guard de conta e os
+    // buckets de rate limit das telas embutidas.
+    for (const extension of hostCfg?.personalAgents?.extensions ?? []) {
+        extension.routes?.(router, {
+            accountGuard,
+            throttle: { login: (route) => withLogin(route), otp: (route) => withOtpLogin(route) },
+        });
     }
     // Paths do console de conta (configuráveis/localizáveis via `accountRoutes`).
     // As TELAS vêm de `accountPath(key)` (prefixo + segmento configurável); os
@@ -888,6 +989,36 @@ export function registerAuthHost(router, opts = {}) {
         router.post(`${apiBase}/mfa/passkeys/verify`, [C.accountMfaApi, 'passkeyRegisterVerify']);
     })
         .use([accountGuard]);
+    // Account console extensions (`@adonis-agora/authkit-server/account-extension`): pages other
+    // packages register from their provider's `boot()`. Same guard as the built-in screens; the
+    // page routes mount once every provider booted. `account: false` turns them off too.
+    const extensionEntries = [];
+    if (accountOpt !== false) {
+        const builtins = {};
+        if (mountSecurity)
+            builtins.security = securityPath;
+        if (mountMfa)
+            builtins.mfa = mfaPath;
+        if (mountTokens)
+            builtins.tokens = tokensPath;
+        if (mountApps)
+            builtins.apps = appsPath;
+        if (mountOrgs)
+            builtins.orgs = orgsPath;
+        mountAccountExtensions(router, {
+            guard: accountGuard,
+            ...(throttles
+                ? { throttle: { html: throttles.accountActions, json: throttles.accountActionsJson } }
+                : {}),
+            overrides: hostCfg?.accountConsole?.extensions,
+            ...(hostCfg?.accountConsole?.remote ? { remote: hostCfg.accountConsole.remote } : {}),
+            ...(hostCfg?.accountConsole?.actionTimeoutMs !== undefined
+                ? { actionTimeoutMs: hostCfg.accountConsole.actionTimeoutMs }
+                : {}),
+            builtins,
+            entries: extensionEntries,
+        });
+    }
     // API headless (Clerk-style) — montada fora do `accountGuard` (não depende da
     // sessão de CONTA), autenticada pelo resolver do host (`headless.resolveAccountId`).
     // `PUT` usa CSRF igual à API do console (middleware de shield do host).
@@ -913,6 +1044,8 @@ export function registerAuthHost(router, opts = {}) {
         resolvedAdminPrefix = ap;
         // Persiste no singleton de processo para que controllers e views usem o mesmo prefixo.
         setAdminPrefix(ap);
+        // Announce the console to the other `@adonis-agora` consoles (the switcher).
+        announceAdminConsole(ap);
         router
             .group(() => {
             // Console admin (SPA React self-contained): todas as rotas GET servem o
@@ -926,6 +1059,10 @@ export function registerAuthHost(router, opts = {}) {
             // ─── JSON API do console (session-authed via adminGuard upstream) ─────
             // GET {ap}/api/overview
             router.get(`${ap}/api/overview`, [C.consoleOverview, 'handle']);
+            // Console switcher: the other `@adonis-agora` consoles this viewer may open, and the
+            // global search across them (search BEFORE the list: fixed path first).
+            router.get(`${ap}/api/consoles/search`, [C.consoleSwitcher, 'search']);
+            router.get(`${ap}/api/consoles`, [C.consoleSwitcher, 'index']);
             // Usuários.
             router.get(`${ap}/api/users`, [C.consoleUsers, 'index']);
             router.get(`${ap}/api/users/:id`, [C.consoleUsers, 'show']);
@@ -951,6 +1088,8 @@ export function registerAuthHost(router, opts = {}) {
             router.get(`${ap}/api/clients/:id`, [C.consoleClients, 'show']);
             router.patch(`${ap}/api/clients/:id`, [C.consoleClients, 'update']);
             router.delete(`${ap}/api/clients/:id`, [C.consoleClients, 'destroy']);
+            router.post(`${ap}/api/clients/:id/disable`, [C.consoleClients, 'disable']);
+            router.post(`${ap}/api/clients/:id/enable`, [C.consoleClients, 'enable']);
             router.post(`${ap}/api/clients/:id/regenerate-secret`, [
                 C.consoleClients,
                 'regenerateSecret',
@@ -1050,6 +1189,8 @@ export function registerAuthHost(router, opts = {}) {
             withApiThrottle(router.patch('/clients/:id', [C.apiClients, 'update']));
             withApiThrottle(router.post('/clients/:id/regenerate-secret', [C.apiClients, 'regenerateSecret']));
             withApiThrottle(router.delete('/clients/:id', [C.apiClients, 'destroy']));
+            withApiThrottle(router.post('/clients/:id/disable', [C.apiClients, 'disable']));
+            withApiThrottle(router.post('/clients/:id/enable', [C.apiClients, 'enable']));
             // Organizações.
             withApiThrottle(router.get('/organizations', [C.apiOrgs, 'index']));
             withApiThrottle(router.post('/organizations', [C.apiOrgs, 'store']));
@@ -1107,6 +1248,7 @@ export function registerAuthHost(router, opts = {}) {
                 mfa: mountMfa,
                 apps: mountApps,
             },
+            extensions: extensionEntries,
         },
         admin: resolvedAdminPrefix ? { prefix: resolvedAdminPrefix } : null,
         adminApi: resolvedAdminApiPrefix ? { prefix: resolvedAdminApiPrefix } : null,

package/build/src/host/renderers/edge_renderer.js

@@ -1,3 +1,4 @@
+import { accountNavFor } from '../../account/runtime.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
 import { accountPathsMap } from '../account_paths.js';
 import { DEFAULT_MESSAGES, translate } from '../i18n.js';
@@ -40,9 +41,13 @@ export async function renderEdgeView(ctx, view, props) {
     // `accountRoutes` — sem cada view conhecer o prefixo. Os action-subpaths
     // fixos (`/password`, `/passkeys/verify`, ...) são concatenados na própria view.
     const accountPaths = accountPathsMap();
+    // `accountNav` como prop global das telas do console de conta: telas embutidas montadas e
+    // páginas de extension visíveis para a conta (partial `authkit::account/partials/nav`).
+    const accountNav = props.accountNav ?? (await accountNavFor(ctx, view, props));
     return ctx.view.render(`authkit::${view}`, {
         loginUrl,
         accountPaths,
+        accountNav,
         ...props,
         t,
         messages,

package/build/src/host/renderers/inertia_renderer.js

@@ -1,3 +1,4 @@
+import { accountNavFor } from '../../account/runtime.js';
 import { DEFAULT_MESSAGES } from '../i18n.js';
 import { renderEdgeView } from './edge_renderer.js';
 /**
@@ -68,6 +69,11 @@ export function inertiaRenderer(opts) {
         // Happy path: view vai ao Inertia.
         // `messages` vai como shared prop para as páginas React traduzirem.
         const messages = await resolveMessagesFromCtx(ctx);
-        return ctx.inertia.render(`${opts.prefix}/${view}`, { ...props, messages });
+        const accountNav = props.accountNav ?? (await accountNavFor(ctx, view, props));
+        return ctx.inertia.render(`${opts.prefix}/${view}`, {
+            ...(accountNav ? { accountNav } : {}),
+            ...props,
+            messages,
+        });
     };
 }

package/build/src/host/screen_props.d.ts

@@ -8,6 +8,8 @@
  * typed per view, so a controller that drifts from these types fails the
  * package's `tsc`.
  */
+import type { ResolvedActionStep } from '../account/http.js';
+import type { AccountNavEntry, ResolvedAccountPage } from '../account/runtime.js';
 import type { OrgInvitation, OrgMember, OrgSummary } from '../accounts/account_store.js';
 import type { PatRecord } from '../pat/pat_store.js';
 import type { AccountConfirmProps, AccountEmailConfirmedProps, AccountLoginProps, AccountMfaProps, AccountSecurityProps } from './account_screen_props.js';
@@ -183,16 +185,22 @@ export interface ThrottledProps extends WithMessages {
     retryUrl: string;
 }
 /** The agent asking for access, on `agents/consent`. */
+/** One scope on the personal-agent consent screen. */
+export interface AgentConsentScope {
+    id: string;
+    description: string;
+    /** i18n key shown instead of `description` (an extension's message). */
+    descriptionKey?: string;
+    /** Not ticked for the person: granted only if they tick it themselves. */
+    optIn?: boolean;
+}
 export interface AgentConsentRequest {
     /** Device-flow user code, when the agent uses it. */
     userCode?: string;
     agentName: string | null;
     agentOrigin: string | null;
     logoUri?: string | null;
-    scopes: Array<{
-        id: string;
-        description: string;
-    }>;
+    scopes: Array<AgentConsentScope>;
     /** Extra hidden form fields to send back. */
     hidden?: Array<{
         name: string;
@@ -216,10 +224,7 @@ export interface AgentsConsentProps extends WithMessages {
 export interface AgentsDoneProps extends WithMessages {
     status: 'approved' | 'denied' | 'expired' | 'invalid';
     agentName: string | null;
-    scopes: Array<{
-        id: string;
-        description: string;
-    }>;
+    scopes: Array<AgentConsentScope>;
 }
 /** `account/apps` — apps and personal agents with access to the account. */
 export interface AccountAppsProps extends WithMessages {
@@ -276,6 +281,31 @@ export interface AccountOrgsProps extends WithMessages {
     invitation?: OrgInvitation | null;
     token?: string;
 }
+/**
+ * `account/extension` — a page an account console extension added. `page` is the resolved page
+ * (texts translated, values formatted); `step` is set on the confirmation step of an action.
+ * `accountNav` (the console navigation) is added by the renderer to every account screen.
+ */
+export interface AccountExtensionProps extends WithMessages {
+    csrfToken: string;
+    page: ResolvedAccountPage;
+    step: ResolvedActionStep | null;
+    flash: {
+        tone: 'success' | 'danger';
+        text: string;
+    } | null;
+    /** The response's CSP nonce, for the scripts of `component` blocks. */
+    cspNonce: string | null;
+    accountNav?: AccountNavEntry[] | null;
+    /** `<html lang>` of the console locale. */
+    htmlLang?: string;
+    /** Edge only: the `<script>` tag of a `component` block's script (nonce included). */
+    scriptTag?: (script: {
+        src: string;
+        integrity: string | null;
+        module: boolean;
+    }) => string;
+}
 /** Props of every screen, by view name. */
 export interface AuthkitScreenProps {
     login: LoginProps;
@@ -299,6 +329,7 @@ export interface AuthkitScreenProps {
     'account/orgs': AccountOrgsProps;
     'account/confirm': AccountConfirmProps;
     'account/email-confirmed': AccountEmailConfirmedProps;
+    'account/extension': AccountExtensionProps;
 }
 /** Every screen authkit-server renders. */
 export type AuthkitScreen = keyof AuthkitScreenProps;