@adonis-agora/authkit-server 1.0.0-rc.0 → 1.0.0-rc.2

package/build/src/agents/runtime.js

@@ -1,13 +1,9 @@
+import { getBootedApp } from '../../services/booted_app.js';
 import { supportsAccountStatus } from '../accounts/account_store.js';
 import { findMcpResource } from '../mcp/mcp_oauth.js';
 import { PersonalAgentVerifier } from './agent_identity.js';
 import { PersonalAgentDelegation } from './delegation_service.js';
 import { DelegationStore } from './delegation_store.js';
-import { PoppyClientRegistry } from './poppy/client_registry.js';
-import { hmacNonceSource } from './poppy/dpop.js';
-import { databaseReplayStore, memoryLimiter, memoryReplayStore, redisReplayStore, } from './poppy/replay.js';
-import { PoppyService, poppyUrls } from './poppy/service.js';
-import { PoppyStore } from './poppy/store.js';
 import { AgentRegistryStore } from './registry_store.js';
 import { keystoreSigner } from './signer.js';
 /**
@@ -27,9 +23,10 @@ export function personalAgentUrls(oidcIssuer, prefix) {
     };
 }
 const runtimes = new WeakMap();
-/** Ponte Poppy → oidc-provider: Bearer de MCP de Sessions logadas viram access tokens dele. */
-function mcpBridge(service, poppyApis) {
+/** Access tokens do oidc-provider para resources MCP (ver {@link PersonalAgentAccessTokens}). */
+function accessTokens(service) {
     return {
+        mcpEnabled: !!service.config.mcp?.enabled,
         isMcpResource(url) {
             try {
                 return findMcpResource(url, service.config.issuer, service.config.mcp) !== null;
@@ -42,11 +39,6 @@ function mcpBridge(service, poppyApis) {
             const provider = service.provider;
             if (!provider?.AccessToken || !provider?.Grant)
                 return null;
-            // Só faz sentido quando a integração MCP do authkit está ligada, ou o MCP é de `apis`.
-            if (!service.config.mcp?.enabled &&
-                !poppyApis.some((a) => a.type === 'mcp' && a.url.replace(/\/+$/, '') === input.resource.replace(/\/+$/, ''))) {
-                return null;
-            }
             const remaining = Math.max(60, Math.floor((input.grantExpiresAt.getTime() - Date.now()) / 1000));
             let grant = await provider.Grant.find(input.grantId);
             if (!grant) {
@@ -63,13 +55,13 @@ function mcpBridge(service, poppyApis) {
                 clientId: input.clientId,
                 grantId: input.grantId,
                 scope: input.scope,
-                gty: 'poppy',
+                gty: input.grantType,
                 expiresIn: input.expiresIn,
             });
             at.aud = input.resource;
             return at.save();
         },
-        async revoke(grantId) {
+        async revokeGrant(grantId) {
             const provider = service.provider;
             if (!provider?.Grant)
                 return;
@@ -80,18 +72,32 @@ function mcpBridge(service, poppyApis) {
         },
     };
 }
-async function resolveReplay(replay, conn, make) {
-    if (replay === 'memory')
-        return memoryReplayStore();
-    if (replay === 'database')
-        return databaseReplayStore(conn);
-    if (typeof replay.claim === 'function')
-        return replay;
-    const name = replay.redis;
-    if (!make)
-        throw new Error('authkit: personalAgents.poppy.replay { redis } exige o container.');
-    const redis = await make('redis');
-    return redisReplayStore(redis.connection(name));
+/** O ledger de grants visto por uma extension: só os ids com o prefixo dela. */
+function scopedLedger(store, prefix) {
+    const mine = (id) => typeof id === 'string' && id.startsWith(prefix);
+    return {
+        async insertGrant(grant) {
+            if (!mine(grant.id)) {
+                throw new Error(`authkit: grant "${grant.id}" fora do prefixo "${prefix}" da extension.`);
+            }
+            await store.insertGrant(grant);
+        },
+        async findGrant(id) {
+            return mine(id) ? store.findGrant(id) : null;
+        },
+        async listGrants(accountId) {
+            return (await store.listGrants(accountId)).filter((g) => mine(g.id));
+        },
+        async unrevokedGrantIdsOfClient(clientId) {
+            return (await store.unrevokedGrantIdsOfClient(clientId)).filter(mine);
+        },
+        async revokeGrantById(id, at) {
+            if (mine(id))
+                await store.revokeGrantById(id, at);
+        },
+        insertRefreshToken: (token) => store.insertRefreshToken(token),
+        findRefreshToken: (tokenHash) => store.findRefreshToken(tokenHash),
+    };
 }
 /**
  * Config com o registro do console por cima: um agente BLOQUEADO no console é
@@ -112,21 +118,7 @@ function withRegistry(config, registry) {
         }
         return null;
     };
-    const poppy = config.poppy;
-    return {
-        ...config,
-        resolveAgent,
-        poppy: poppy && {
-            ...poppy,
-            clients: {
-                ...poppy.clients,
-                isBlocked: async (id) => (await poppy.clients.isBlocked(id)) ||
-                    (await registry.find('poppy', id))?.status === 'blocked',
-                isRegistered: async (id) => (await poppy.clients.isRegistered(id)) ||
-                    (await registry.find('poppy', id))?.status === 'allowed',
-            },
-        },
-    };
+    return { ...config, resolveAgent };
 }
 /**
  * Monta (uma vez por `OidcService`) o runtime de personal agents. `null` quando
@@ -149,7 +141,7 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
             };
             let conn = null;
             const connection = service.config.schema.connection;
-            if (config.delegation || config.poppy) {
+            if (config.delegation || (config.extensions ?? []).length > 0) {
                 const db = await makeDb();
                 conn = () => (connection ? db.connection(connection) : db.connection());
             }
@@ -177,39 +169,53 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                     isAccountActive,
                 });
             }
-            let poppy = null;
-            if (effective.poppy && store && conn) {
-                const cfg = effective.poppy;
-                const limiter = cfg.rateLimit === false
-                    ? null
-                    : typeof cfg.rateLimit === 'function'
-                        ? cfg.rateLimit
-                        : memoryLimiter(cfg.rateLimit);
-                const secret = service.deriveSecret('poppy-dpop-nonce');
-                poppy = new PoppyService({
-                    cfg,
-                    urls: poppyUrls(service.config.issuer, cfg.prefix),
-                    store: new PoppyStore(conn),
-                    grants: store,
-                    registry: new PoppyClientRegistry(cfg, { fetchJson: options.fetchJson }),
-                    replay: await resolveReplay(cfg.replay, conn, options.make),
-                    limiter,
-                    nonces: hmacNonceSource(secret),
-                    isAccountActive,
-                    mcp: mcpBridge(service, cfg.apis),
-                    now: options.now,
-                });
+            const extensions = new Map();
+            const now = () => options.now?.() ?? new Date();
+            if (store && conn && registry) {
+                const db = conn;
+                const tokens = accessTokens(service);
+                for (const extension of config.extensions ?? []) {
+                    const runtime = await extension.setup({
+                        protocol: extension.id,
+                        issuer: service.config.issuer,
+                        db: () => db(),
+                        grants: scopedLedger(store, extension.grantIdPrefix),
+                        registryStatus: async (identifier) => (await registry.find(extension.id, identifier))?.status ?? null,
+                        deriveSecret: (label) => service.deriveSecret(label),
+                        isAccountActive,
+                        make: async (binding) => {
+                            if (!options.make) {
+                                throw new Error(`authkit: o binding "${binding}" exige o container do app.`);
+                            }
+                            return options.make(binding);
+                        },
+                        accessTokens: tokens,
+                        now,
+                    });
+                    extensions.set(extension.id, { extension, runtime });
+                }
             }
+            /** A extension dona de um grant, pelo prefixo do id. */
+            const ownerOf = (grantId) => {
+                for (const entry of extensions.values()) {
+                    if (grantId.startsWith(entry.extension.grantIdPrefix))
+                        return entry;
+                }
+                return null;
+            };
+            const isExtensionGrant = (grantId) => (config.extensions ?? []).some((e) => grantId.startsWith(e.grantIdPrefix));
             const revokeAgentGrant = async (accountId, grantId) => {
-                if (grantId.startsWith('pgrant_')) {
-                    return poppy ? poppy.revokeAccountGrant(accountId, grantId) : false;
+                if (isExtensionGrant(grantId)) {
+                    const owner = ownerOf(grantId);
+                    return owner ? owner.runtime.revokeAccountGrant(accountId, grantId) : false;
                 }
                 return delegation ? delegation.revokeGrant(accountId, grantId) : false;
             };
             const revokeAllAgentGrants = async (accountId) => {
                 let count = 0;
-                if (poppy)
-                    count += await poppy.revokeAllAccountGrants(accountId);
+                for (const { runtime } of extensions.values()) {
+                    count += await runtime.revokeAllAccountGrants(accountId);
+                }
                 if (delegation)
                     count += await delegation.revokeAllGrants(accountId);
                 return count;
@@ -222,10 +228,11 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                 // Expirado já não vale: revogar não muda nada (e não vira evento de auditoria).
                 if (!grant || grant.revokedAt || grant.expiresAt <= now)
                     return null;
-                if (grantId.startsWith('pgrant_')) {
-                    if (!poppy)
+                if (isExtensionGrant(grantId)) {
+                    const owner = ownerOf(grantId);
+                    if (!owner)
                         return null;
-                    await poppy.revokeGrant(grantId);
+                    await owner.runtime.revokeGrant(grantId);
                 }
                 else {
                     await store.revokeGrantById(grantId, now);
@@ -235,9 +242,11 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
             const disconnectAgent = async (protocol, identifier) => {
                 if (!store)
                     return 0;
-                if (protocol === 'poppy')
-                    return poppy ? poppy.disconnectClient(identifier) : 0;
-                const ids = (await store.unrevokedGrantIdsOfClient(identifier)).filter((id) => !id.startsWith('pgrant_'));
+                if (protocol !== 'pact') {
+                    const entry = extensions.get(protocol);
+                    return entry ? entry.runtime.disconnectAgent(identifier) : 0;
+                }
+                const ids = (await store.unrevokedGrantIdsOfClient(identifier)).filter((id) => !isExtensionGrant(id));
                 const at = options.now?.() ?? new Date();
                 for (const id of ids)
                     await store.revokeGrantById(id, at);
@@ -248,7 +257,7 @@ export function buildPersonalAgentsRuntime(service, makeDb, options = {}) {
                 urls,
                 verifier: new PersonalAgentVerifier(effective),
                 delegation,
-                poppy,
+                extensions,
                 revokeAgentGrant,
                 revokeAllAgentGrants,
                 registry,
@@ -270,3 +279,29 @@ export async function personalAgentsFor(ctx) {
         make: (binding) => ctx.containerResolver.make(binding),
     });
 }
+/**
+ * The runtime an extension's `setup` built (`personalAgents.extensions`), by protocol id. `null`
+ * when the extension is not configured (or there is no database). Takes the request, an explicit
+ * source (tests, scripts) or nothing (the booted app).
+ *
+ * Stable for 1.x — see `extension.ts`.
+ */
+export async function personalAgentExtensionRuntime(id, from) {
+    let runtime;
+    if (from && 'containerResolver' in from) {
+        runtime = await personalAgentsFor(from);
+    }
+    else if (from) {
+        const source = from;
+        runtime = await buildPersonalAgentsRuntime(source.service, () => source.db(), {
+            make: source.make ? (binding) => source.make(binding) : undefined,
+            now: source.now ? () => source.now() : undefined,
+        });
+    }
+    else {
+        const app = getBootedApp();
+        const service = (await app.container.make('authkit.server'));
+        runtime = await buildPersonalAgentsRuntime(service, () => app.container.make('lucid.db'), { make: (binding) => app.container.make(binding) });
+    }
+    return runtime?.extensions.get(id)?.runtime ?? null;
+}

package/build/src/audit/audit_sink.js

@@ -114,7 +114,7 @@ export const AUDIT_EVENT_TYPES = [
     'agent.delegation_denied',
     'agent.grant_revoked',
     // Console admin: um admin revogou a conexão de um usuário, ou liberou/bloqueou um
-    // agente (PACT pelo `iss`, Poppy pelo `client_id`).
+    // agente (PACT pelo `iss`; uma extension pelo identificador dela).
     'agent.grant_revoked_by_admin',
     'agent.allowed',
     'agent.blocked',

package/build/src/console_authorize.d.ts

@@ -0,0 +1,56 @@
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * What a console `authorize` returns. Same shape in every `@adonis-agora` console.
+ *
+ * - `true` / `{ allowed: true }` → allowed
+ * - `false` / `{ allowed: false }` → 403
+ * - `{ allowed: false, reason: 'unauthenticated' }` → 401
+ * - `{ redirectTo }` → 302 to that path on a page navigation, 401 JSON on an API call
+ */
+export type ConsoleAuthorizeResult = boolean | {
+    allowed: true;
+} | {
+    allowed: false;
+    reason?: 'unauthenticated' | 'forbidden';
+} | {
+    redirectTo: string;
+};
+/** A class form, for an authorizer in its own file (`@inject()` works). */
+export interface ConsoleAuthorizer {
+    authorize(ctx: HttpContext): ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>;
+}
+export type ConsoleAuthorizerClass = new (...args: any[]) => ConsoleAuthorizer;
+/**
+ * Who may open a console: an inline function, an authorizer class, or a lazy
+ * import of a module whose default export is an authorizer class.
+ */
+export type ConsoleAuthorize = ((ctx: HttpContext) => ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>) | ConsoleAuthorizerClass | (() => Promise<{
+    default: ConsoleAuthorizerClass;
+}>);
+/** The normalized outcome of a `ConsoleAuthorize` call. */
+export type ConsoleAuthorizeDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    status: 401 | 403;
+    redirectTo?: string;
+};
+export declare function normalizeConsoleAuthorizeResult(result: unknown): ConsoleAuthorizeDecision;
+/**
+ * Turns a `ConsoleAuthorize` into a checker returning a normalized decision.
+ * A class is built through the container (so `@inject()` works); a lazy import
+ * runs once and its class is remembered. A thrown error is a denial (403).
+ */
+export declare function resolveConsoleAuthorize(authorize: ConsoleAuthorize): (ctx: HttpContext) => Promise<ConsoleAuthorizeDecision>;
+/**
+ * A `ConsoleAuthorize` that lets in requests carrying `Authorization: Bearer <token>`.
+ * The comparison is timing-safe. Anything else is `{ allowed: false, reason: 'unauthenticated' }`.
+ * Throws when `token` is empty, so a missing env var fails at config time.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') })
+ * ```
+ */
+export declare function authorizeByToken(options: {
+    token: string | undefined | null;
+}): (ctx: HttpContext) => ConsoleAuthorizeResult;

package/build/src/console_authorize.js

@@ -0,0 +1,85 @@
+import { createHash, timingSafeEqual } from 'node:crypto';
+function isAuthorizerClass(value) {
+    return (typeof value === 'function' &&
+        typeof value.prototype?.authorize === 'function');
+}
+function isLazyModule(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'default' in value &&
+        isAuthorizerClass(value.default));
+}
+export function normalizeConsoleAuthorizeResult(result) {
+    if (result === true)
+        return { allowed: true };
+    if (typeof result === 'object' && result !== null) {
+        const r = result;
+        if (typeof r.redirectTo === 'string' && r.redirectTo.length > 0) {
+            return { allowed: false, status: 401, redirectTo: r.redirectTo };
+        }
+        if (r.allowed === true)
+            return { allowed: true };
+        if (r.allowed === false && r.reason === 'unauthenticated') {
+            return { allowed: false, status: 401 };
+        }
+    }
+    // `false`, `{ allowed: false }` and anything unrecognized deny.
+    return { allowed: false, status: 403 };
+}
+async function runClass(Authorizer, ctx) {
+    const instance = (await ctx.containerResolver.make(Authorizer));
+    return instance.authorize(ctx);
+}
+/**
+ * Turns a `ConsoleAuthorize` into a checker returning a normalized decision.
+ * A class is built through the container (so `@inject()` works); a lazy import
+ * runs once and its class is remembered. A thrown error is a denial (403).
+ */
+export function resolveConsoleAuthorize(authorize) {
+    let lazyClass;
+    return async (ctx) => {
+        try {
+            if (isAuthorizerClass(authorize)) {
+                return normalizeConsoleAuthorizeResult(await runClass(authorize, ctx));
+            }
+            if (lazyClass)
+                return normalizeConsoleAuthorizeResult(await runClass(lazyClass, ctx));
+            const result = await authorize(ctx);
+            if (isLazyModule(result)) {
+                lazyClass = result.default;
+                return normalizeConsoleAuthorizeResult(await runClass(lazyClass, ctx));
+            }
+            return normalizeConsoleAuthorizeResult(result);
+        }
+        catch (error) {
+            ctx.logger?.warn?.({ err: error }, 'console authorize threw; access denied');
+            return { allowed: false, status: 403 };
+        }
+    };
+}
+/**
+ * A `ConsoleAuthorize` that lets in requests carrying `Authorization: Bearer <token>`.
+ * The comparison is timing-safe. Anything else is `{ allowed: false, reason: 'unauthenticated' }`.
+ * Throws when `token` is empty, so a missing env var fails at config time.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: env.get('CONSOLE_TOKEN') })
+ * ```
+ */
+export function authorizeByToken(options) {
+    const token = options?.token;
+    if (typeof token !== 'string' || token.length === 0) {
+        throw new Error('authorizeByToken: `token` is empty. Set it (e.g. env CONSOLE_TOKEN).');
+    }
+    const expected = createHash('sha256').update(token).digest();
+    return (ctx) => {
+        const header = ctx.request.header('authorization');
+        const match = typeof header === 'string' ? /^Bearer\s+(.+)$/i.exec(header.trim()) : null;
+        if (match) {
+            const given = createHash('sha256').update(match[1]).digest();
+            if (timingSafeEqual(given, expected))
+                return { allowed: true };
+        }
+        return { allowed: false, reason: 'unauthenticated' };
+    };
+}

package/build/src/define_config.d.ts

@@ -4,6 +4,7 @@ import type { AccountStore, AuthAccount } from './accounts/account_store.js';
 import { type AdapterFactory, adapters, type OidcAdapterClass } from './adapters/factory.js';
 import { type PersonalAgentsConfigInput, type ResolvedPersonalAgentsConfig } from './agents/config.js';
 import type { AuditSink } from './audit/audit_sink.js';
+import type { ConsoleAuthorize } from './console_authorize.js';
 import { type EventsConfigInput } from './events/dispatcher.js';
 import { type BotProtectionConfigInput, type ResolvedBotProtectionConfig } from './host/bot_protection.js';
 import { type BrandingConfig } from './host/branding.js';
@@ -111,18 +112,6 @@ export interface MailHooks {
         email: string;
         sudoUrl: string;
     }) => Promise<void>;
-    /**
-     * Código do Mediated Sign-In pronto do Poppy (`poppyEmailCodeSignIn`): um personal
-     * agent quer entrar na conta e a pessoa precisa dar o código a ele. Sem o hook, o
-     * host-kit envia pelo mailer default, com branding e i18n.
-     */
-    onPoppySignInCode?: (data: {
-        email: string;
-        code: string;
-        /** Nome do agente (metadata dele, ou o host do `client_id`). */
-        agentName: string;
-        expiresInMinutes: number;
-    }) => Promise<void>;
     /**
      * Disparado num login bem-sucedido a partir de um IP NOVO para a conta (nenhum
      * `login.success` anterior desse IP no audit sink), quando `notifications.newLoginEmail`
@@ -708,12 +697,21 @@ export interface AdminConfigInput {
      * default é decisão de major, mesma regra de `impersonation`).
      */
     impersonateAdmins?: boolean;
+    /**
+     * Access check for the console, run after `roles` (both must pass), on the shell
+     * and on every `{prefix}/api/*` route. An inline function, an authorizer class
+     * (`@inject()` works), a lazy import (`() => import('#policies/...')`) or
+     * `authorizeByToken({ token })`. Omitted: open outside production, 403 in production.
+     */
+    authorize?: ConsoleAuthorize;
 }
 export interface ResolvedAdminConfig {
     enabled: boolean;
     roles: string[];
     impersonation: boolean;
     impersonateAdmins: boolean;
+    /** `admin.authorize` as configured, or `null` when omitted. */
+    authorize: ConsoleAuthorize | null;
 }
 export declare function resolveAdmin(input?: AdminConfigInput): ResolvedAdminConfig;
 /**
@@ -1225,8 +1223,16 @@ export interface AuthServerConfigInput {
      * expiração), e o "Sair" do console encerra também a sessão do IdP. Contas
      * desabilitadas não entram. Operações sensíveis continuam pedindo sudo.
      *
-     * Default `false`: o console só aceita a própria sessão (`POST /account/login`),
-     * como sempre.
+     * Default `true`: o console é mais um app do IdP. Sem sessão, `/account/*` e o
+     * console admin mandam o visitante para o login do IdP (`/auth/console/sso`,
+     * client interno `authkit-console`) e voltam com o console aberto. Um único
+     * login, como no Keycloak, Okta e Google; o que protege as operações
+     * sensíveis é o sudo, não um segundo login.
+     *
+     * `false`: o console só aceita a própria sessão (`POST /account/login`, por
+     * senha). Com `authMethods: { password: false }` isso deixa o console sem
+     * nenhum jeito de entrar, então o boot recusa a combinação, a menos que
+     * `routes.accountLoginUrl` aponte para um login do próprio host.
      */
     accountSession?: {
         acceptIdpSession?: boolean;

package/build/src/define_config.js

@@ -6,7 +6,7 @@ import { composeAuditSink, resolveEvents } from './events/dispatcher.js';
 import { resolveBotProtection, } from './host/bot_protection.js';
 import { resolveBranding } from './host/branding.js';
 import { deriveLockedRouteOptions, deriveLockedSettingKeys, } from './host/config_locks.js';
-import { resolveMessages } from './host/i18n.js';
+import { registerExtensionMessages, resolveMessages, } from './host/i18n.js';
 import { resolveOtpLoginConfig, } from './host/otp_login.js';
 import { edgeRenderer } from './host/renderers/edge_renderer.js';
 import { warnUnsatisfiableSudoConfig } from './host/sudo/satisfiability.js';
@@ -193,6 +193,7 @@ export function resolveAdmin(input) {
         // registrado). Ver o docblock de `AdminConfigInput.impersonation`.
         impersonation: input?.impersonation !== false,
         impersonateAdmins: input?.impersonateAdmins !== false,
+        authorize: input?.authorize ?? null,
     };
 }
 /** Lê API keys de `AUTHKIT_ADMIN_API_KEY` (uma ou várias, separadas por vírgula). */
@@ -342,7 +343,7 @@ export function defineConfig(config) {
         }
         // Personal agents com delegação assinam tokens e recibos com este keystore,
         // e o PACT só admite ES256/RS256 — falha no boot, não na primeira troca de token.
-        const personalAgents = resolvePersonalAgentsConfig(config.personalAgents);
+        const personalAgents = resolvePersonalAgentsConfig(config.personalAgents, config.issuer);
         if (personalAgents?.delegation)
             assertDelegationSigningKey(jwks);
         // Debaixo do mountPath, a rota curinga do oidc-provider (`${mount}/*`)
@@ -354,11 +355,13 @@ export function defineConfig(config) {
             (personalAgents.prefix === oidcMount || personalAgents.prefix.startsWith(`${oidcMount}/`))) {
             throw new Error(`authkit: personalAgents.prefix "${personalAgents.prefix}" não pode ficar debaixo do mountPath do OIDC ("${oidcMount}").`);
         }
-        const poppyPrefix = personalAgents?.poppy?.prefix;
-        if (poppyPrefix &&
-            oidcMount &&
-            (poppyPrefix === oidcMount || poppyPrefix.startsWith(`${oidcMount}/`))) {
-            throw new Error(`authkit: personalAgents.poppy.prefix "${poppyPrefix}" não pode ficar debaixo do mountPath do OIDC ("${oidcMount}").`);
+        for (const extension of personalAgents?.extensions ?? []) {
+            if (extension.messages)
+                registerExtensionMessages(extension.messages);
+            if (oidcMount &&
+                (extension.prefix === oidcMount || extension.prefix.startsWith(`${oidcMount}/`))) {
+                throw new Error(`authkit: o prefixo "${extension.prefix}" de personalAgents.extensions "${extension.id}" não pode ficar debaixo do mountPath do OIDC ("${oidcMount}").`);
+            }
         }
         // BACKSTOP DE SUDO. Um host cujo `sudo.methods` não tem um único método
         // satisfazível por conta sem senha fica bricado para TODA operação sob
@@ -496,7 +499,7 @@ export function defineConfig(config) {
             lockedRouteOptions: deriveLockedRouteOptions(config),
             // Opt-in: ausente = authkit nunca toca `ctx.auth` (comportamento de sempre).
             adonisAuth: config.adonisAuth,
-            accountSession: { acceptIdpSession: config.accountSession?.acceptIdpSession === true },
+            accountSession: { acceptIdpSession: config.accountSession?.acceptIdpSession !== false },
         };
     });
 }

package/build/src/doctor/checks.d.ts

@@ -87,7 +87,7 @@ export declare function checkOtpLockout(input: DoctorInput): Finding | null;
 export declare function checkSudoMode(_input: DoctorInput): Finding | null;
 /** rateLimit ligado mas @adonisjs/limiter ausente → warn. */
 export declare function checkRateLimit(input: DoctorInput): Finding;
-/** admin.enabled mas sem roles → warn. Reporta o modo de UI ativo. */
+/** admin.enabled mas sem roles, ou sem `admin.authorize` → warn. Reporta o modo de UI ativo. */
 export declare function checkAdmin(input: DoctorInput): Finding | null;
 /** requireVerifiedEmail ligado mas o store não sabe checar verificação → warn. */
 export declare function checkRequireVerifiedEmail(input: DoctorInput): Finding | null;
@@ -214,6 +214,12 @@ export declare function checkPasskeyAutofill(input: DoctorInput): Finding | null
  * de TERCEIROS precisa saber que existe uma lista para fechar.
  */
 export declare function checkFirstPartyClients(input: DoctorInput): Finding | null;
+/**
+ * Como se entra no console de conta e no console admin. O default é o login do
+ * IdP (SSO, `accountSession.acceptIdpSession`); desligado, o console só tem o
+ * login próprio por senha.
+ */
+export declare function checkConsoleSignIn(input: DoctorInput): Finding | null;
 /**
  * Finding da idade da chave de assinatura managed. `ageDays === null` (sem
  * keystore em arquivo/cofre) → no-op `ok`. Acima de `maxAgeDays` → `warn`.

package/build/src/doctor/checks.js

@@ -311,7 +311,7 @@ export function checkRateLimit(input) {
     }
     return { level: 'ok', message: 'rate-limiting on and @adonisjs/limiter available.' };
 }
-/** admin.enabled mas sem roles → warn. Reporta o modo de UI ativo. */
+/** admin.enabled mas sem roles, ou sem `admin.authorize` → warn. Reporta o modo de UI ativo. */
 export function checkAdmin(input) {
     const admin = input.authkitConfig?.admin;
     if (!admin || admin.enabled !== true)
@@ -323,6 +323,12 @@ export function checkAdmin(input) {
             message: 'admin console on, but no `admin.roles` — nobody will have access (the default ["ADMIN"] was not resolved here).',
         };
     }
+    if (!admin.authorize) {
+        return {
+            level: 'warn',
+            message: `admin console on for roles: ${roles.join(', ')}, but no \`admin.authorize\` — it is open outside production and denies every request in production. Set \`admin.authorize\` in config/authkit.ts.`,
+        };
+    }
     return {
         level: 'ok',
         message: `admin console on for roles: ${roles.join(', ')} (React SPA self-contained — JSON API under {prefix}/api/*).`,
@@ -908,6 +914,43 @@ export function checkFirstPartyClients(input) {
         message: `firstPartyClients: ${allowlist.length} client(s) receive the roles/organization claims (${allowlist.join(', ')}).`,
     };
 }
+/**
+ * Como se entra no console de conta e no console admin. O default é o login do
+ * IdP (SSO, `accountSession.acceptIdpSession`); desligado, o console só tem o
+ * login próprio por senha.
+ */
+export function checkConsoleSignIn(input) {
+    const cfg = input.authkitConfig;
+    if (!cfg)
+        return null;
+    const sso = cfg.accountSession?.acceptIdpSession !== false;
+    const passwordOff = cfg.authMethods?.password === false;
+    const routes = typeof cfg.routes === 'object' && cfg.routes ? cfg.routes : undefined;
+    if (!sso && passwordOff && !routes?.accountLoginUrl) {
+        return {
+            level: 'warn',
+            message: 'The account and admin consoles have no way to sign in unless `registerAuthHost` gets an ' +
+                '`accountLoginUrl`: `accountSession.acceptIdpSession` is false and password login is off ' +
+                '(`authMethods: { password: false }`), and route registration refuses to start without ' +
+                'one. Remove `acceptIdpSession: false` so the consoles sign in through the IdP, or point ' +
+                '`accountLoginUrl` at a login route of your app.',
+        };
+    }
+    if (!sso) {
+        return {
+            level: 'warn',
+            message: 'The consoles use their own password login (`accountSession.acceptIdpSession: false`): ' +
+                'users sign in twice, and passwordless accounts cannot open them. The default (SSO through ' +
+                'the IdP login) is recommended; sensitive operations still ask for sudo.',
+        };
+    }
+    return {
+        level: 'ok',
+        message: 'The consoles sign in through the IdP login (SSO). Sensitive operations ask for sudo. ' +
+            'Make sure admin accounts have MFA enrolled (or require it for everyone with ' +
+            '`mfa.requiredFactors`).',
+    };
+}
 /**
  * Finding da idade da chave de assinatura managed. `ageDays === null` (sem
  * keystore em arquivo/cofre) → no-op `ok`. Acima de `maxAgeDays` → `warn`.
@@ -1007,6 +1050,9 @@ export function runAllChecks(input) {
     const firstPartyClients = checkFirstPartyClients(input);
     if (firstPartyClients)
         findings.push(firstPartyClients);
+    const consoleSignIn = checkConsoleSignIn(input);
+    if (consoleSignIn)
+        findings.push(consoleSignIn);
     return findings;
 }
 /** Há algum finding de nível 'error'? (define o exit code). */