@adonis-agora/authkit-server 1.0.0-rc.0 → 1.0.0-rc.2

package/build/src/host/account_api/account_api_controller.js

@@ -611,7 +611,7 @@ export default class AccountApiController {
     /** Personal agents com delegação ativa na conta (scopes aprovados). */
     async listAgents(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation && !runtime?.poppy) {
+        if (!runtime || (!runtime.delegation && runtime.extensions.size === 0)) {
             return ctx.response
                 .status(404)
                 .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));
@@ -620,16 +620,18 @@ export default class AccountApiController {
         const pact = runtime.delegation
             ? (await runtime.delegation.listGrants(userId)).map((g) => ({ ...g, protocol: 'pact' }))
             : [];
-        const poppy = runtime.poppy
-            ? (await runtime.poppy.listGrants(userId)).map((g) => ({ ...g, protocol: 'poppy' }))
-            : [];
-        return { agents: [...pact, ...poppy] };
+        const others = [];
+        for (const [protocol, { runtime: extension }] of runtime.extensions) {
+            for (const g of await extension.listAccountGrants(userId))
+                others.push({ ...g, protocol });
+        }
+        return { agents: [...pact, ...others] };
     }
     // ─── DELETE /account/api/agents/:id ──────────────────────────────────────
     /** Revoga a delegação de um personal agent (efeito imediato nos tokens). */
     async revokeAgent(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation && !runtime?.poppy) {
+        if (!runtime || (!runtime.delegation && runtime.extensions.size === 0)) {
             return ctx.response
                 .status(404)
                 .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));

package/build/src/host/account_session_sign_in.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Abrir e fechar a sessão de CONTA do authkit (o cookie do console, `ACCOUNT_SESSION_KEY`) a partir
+ * de código de fora do host-kit — o navegador de um personal agent que entrou na conta, por
+ * exemplo. Sincroniza `ctx.auth` (`adonisAuth.guard`) como o login do próprio console.
+ *
+ * Estável no 1.x (usado pelas `personalAgents.extensions`).
+ */
+import type { HttpContext } from '@adonisjs/core/http';
+/** Liga a sessão de conta a `accountId` e sincroniza `ctx.auth`. Não regenera a sessão. */
+export declare function signInAccountSession(ctx: HttpContext, accountId: string): Promise<void>;
+/** Desliga a sessão de conta e sincroniza `ctx.auth`. Não regenera a sessão. */
+export declare function signOutAccountSession(ctx: HttpContext): Promise<void>;

package/build/src/host/account_session_sign_in.js

@@ -0,0 +1,19 @@
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
+import { syncAdonisAuthLogin, syncAdonisAuthLogout } from './adonis_auth_sync.js';
+/** Liga a sessão de conta a `accountId` e sincroniza `ctx.auth`. Não regenera a sessão. */
+export async function signInAccountSession(ctx, accountId) {
+    // Sem augmentation no barrel (ver `augmentation_isolation.spec.ts`): a sessão é lida sem tipo.
+    const session = ctx.session;
+    const service = await ctx.containerResolver.make('authkit.server');
+    session.put(ACCOUNT_SESSION_KEY, accountId);
+    const account = await service.config.accountStore.findById(accountId);
+    if (account)
+        await syncAdonisAuthLogin(ctx, service.config, account);
+}
+/** Desliga a sessão de conta e sincroniza `ctx.auth`. Não regenera a sessão. */
+export async function signOutAccountSession(ctx) {
+    const session = ctx.session;
+    const service = await ctx.containerResolver.make('authkit.server');
+    session.forget(ACCOUNT_SESSION_KEY);
+    await syncAdonisAuthLogout(ctx, service.config);
+}

package/build/src/host/admin_clients_service.js

@@ -1,5 +1,6 @@
 import { randomBytes } from 'node:crypto';
-import { assertClientMetadata } from './client_metadata.js';
+import { assertClientMetadata, ClientMetadataError, } from './client_metadata.js';
+import { CONSOLE_SSO_CLIENT_ID } from './console_sso.js';
 /** Métodos públicos (sem segredo) — espelham os "non-secret" do oidc-provider. */
 const PUBLIC_AUTH_METHODS = new Set(['none']);
 /** Gera um identificador opaco no estilo do oidc-provider (~43 chars base64url). */
@@ -51,6 +52,7 @@ export class AdminClientsService {
      */
     async create(input) {
         const clientId = (input.clientId ?? '').trim() || randomId();
+        assertNotReservedClientId(clientId);
         const confidential = !PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod);
         const clientSecret = confidential ? randomId() : undefined;
         const payload = this.#buildPayload(clientId, input, clientSecret);
@@ -68,6 +70,7 @@ export class AdminClientsService {
      */
     async createWithSecret(input, providedSecret) {
         const clientId = (input.clientId ?? '').trim() || randomId();
+        assertNotReservedClientId(clientId);
         const confidential = !PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod);
         const clientSecret = confidential ? (providedSecret ?? randomId()) : undefined;
         const payload = this.#buildPayload(clientId, input, clientSecret);
@@ -215,3 +218,9 @@ export class AdminClientsService {
         return result;
     }
 }
+/** O `client_id` do client interno do console (ver `console_sso.ts`) não pode ser cadastrado. */
+function assertNotReservedClientId(clientId) {
+    if (clientId === CONSOLE_SSO_CLIENT_ID) {
+        throw new ClientMetadataError(`client_id "${clientId}" é reservado pelo authkit`);
+    }
+}

package/build/src/host/admin_console/console_personal_agents_controller.d.ts

@@ -22,7 +22,7 @@ interface AgentEntry {
     connections: number;
 }
 /**
- * Endpoints JSON de personal agents (PACT e Poppy) do console admin React.
+ * Endpoints JSON de personal agents (PACT e `personalAgents.extensions`) do console admin React.
  *
  * GET    {prefix}/api/personal-agents                          → agentes (config + console + conectados)
  * GET    {prefix}/api/personal-agents/connections?clientId=&accountId=&protocol=&page=&size=
@@ -41,11 +41,6 @@ export default class ConsolePersonalAgentsController {
                 /** A lista do config é uma função do host (o console não enxerga). */
                 hostResolver: boolean;
             } | null;
-            poppy: {
-                requireRegistration: boolean;
-                hostResolver: boolean;
-                allowInsecureClientIds: boolean;
-            } | null;
         };
         agents: AgentEntry[];
     }>;

package/build/src/host/admin_console/console_personal_agents_controller.js

@@ -31,10 +31,21 @@ function enabledProtocols(runtime) {
     const out = [];
     if (runtime.config.pact)
         out.push('pact');
-    if (runtime.config.poppy)
-        out.push('poppy');
+    out.push(...runtime.extensions.keys());
     return out;
 }
+/** O protocolo dono de um grant, pelo prefixo do id. */
+function protocolOfGrant(runtime, grantId) {
+    for (const [id, { extension }] of runtime.extensions) {
+        if (grantId.startsWith(extension.grantIdPrefix))
+            return id;
+    }
+    return 'pact';
+}
+/** Prefixo de id dos grants de um protocolo (`agrant_` = PACT). */
+function grantPrefixOf(runtime, protocol) {
+    return runtime.extensions.get(protocol)?.extension.grantIdPrefix ?? 'agrant_';
+}
 function isUrl(value, allowHttp) {
     if (typeof value !== 'string' || value.length > 2048)
         return false;
@@ -52,14 +63,14 @@ function isUrl(value, allowHttp) {
 async function agentName(runtime, protocol, identifier, fallback) {
     if (fallback)
         return fallback;
-    if (protocol === 'poppy' && runtime.poppy) {
-        return runtime.poppy.registry.displayName(identifier);
-    }
+    const extension = runtime.extensions.get(protocol);
+    if (extension)
+        return extension.runtime.displayName(identifier);
     const registration = await runtime.config.resolveAgent(identifier);
     return displayNameFor(registration ?? { issuer: identifier, jwksUri: '' });
 }
 /**
- * Endpoints JSON de personal agents (PACT e Poppy) do console admin React.
+ * Endpoints JSON de personal agents (PACT e `personalAgents.extensions`) do console admin React.
  *
  * GET    {prefix}/api/personal-agents                          → agentes (config + console + conectados)
  * GET    {prefix}/api/personal-agents/connections?clientId=&accountId=&protocol=&page=&size=
@@ -105,17 +116,20 @@ export default class ConsolePersonalAgentsController {
                 e.jwksUri = agent.jwksUri;
                 names.set(keyOf('pact', agent.issuer), agent.name ?? null);
             }
-            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'pact')) {
+            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'agrant_')) {
                 entry('pact', clientId).connections = count;
             }
         }
-        if (cfg.poppy) {
-            for (const id of cfg.poppy.clients.registeredList ?? [])
-                entry('poppy', id).config = 'allowed';
-            for (const id of cfg.poppy.clients.blockedList ?? [])
-                entry('poppy', id).config = 'blocked';
-            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, 'poppy')) {
-                entry('poppy', clientId).connections = count;
+        const summaries = {};
+        for (const [protocol, { extension, runtime: ext }] of runtime.extensions) {
+            const summary = ext.consoleSummary();
+            summaries[protocol] = { label: extension.label, ...summary };
+            for (const id of summary.configured.allowed)
+                entry(protocol, id).config = 'allowed';
+            for (const id of summary.configured.blocked)
+                entry(protocol, id).config = 'blocked';
+            for (const [clientId, count] of await runtime.grants.countLiveGrantsByClient(now, extension.grantIdPrefix)) {
+                entry(protocol, clientId).connections = count;
             }
         }
         for (const row of await runtime.registry.list()) {
@@ -153,13 +167,17 @@ export default class ConsolePersonalAgentsController {
                         hostResolver: cfg.staticAgents === null,
                     }
                     : null,
-                poppy: cfg.poppy
-                    ? {
-                        requireRegistration: cfg.poppy.clients.requireRegistration,
-                        hostResolver: cfg.poppy.clients.registeredList === null || cfg.poppy.clients.blockedList === null,
-                        allowInsecureClientIds: cfg.poppy.allowInsecureClientIds,
-                    }
-                    : null,
+                ...Object.fromEntries(Object.entries(summaries).map(([protocol, summary]) => [
+                    protocol,
+                    {
+                        label: summary.label,
+                        requireRegistration: summary.requireRegistration,
+                        hostResolver: summary.hostResolver,
+                        allowHttpIdentifiers: summary.allowHttpIdentifiers,
+                        identifierLabel: summary.identifierLabel,
+                        identifierPlaceholder: summary.identifierPlaceholder ?? null,
+                    },
+                ])),
             },
             agents,
         };
@@ -172,11 +190,9 @@ export default class ConsolePersonalAgentsController {
         const qs = ctx.request.qs();
         const page = parseListPage(qs.page);
         const size = parseListSize(qs.size);
-        const protocol = qs.protocol === 'pact' || qs.protocol === 'poppy'
-            ? qs.protocol
-            : undefined;
+        const protocol = qs.protocol && enabledProtocols(runtime).includes(qs.protocol) ? qs.protocol : undefined;
         const filter = {
-            protocol,
+            idPrefix: protocol ? grantPrefixOf(runtime, protocol) : undefined,
             clientId: qs.clientId?.trim() || undefined,
             accountId: qs.accountId?.trim() || undefined,
         };
@@ -189,7 +205,7 @@ export default class ConsolePersonalAgentsController {
         const emails = new Map();
         const nameCache = new Map();
         const data = await Promise.all(rows.map(async (g) => {
-            const rowProtocol = g.id.startsWith('pgrant_') ? 'poppy' : 'pact';
+            const rowProtocol = protocolOfGrant(runtime, g.id);
             if (!emails.has(g.accountId)) {
                 const account = await store.findById(g.accountId).catch(() => null);
                 emails.set(g.accountId, account?.email ?? null);
@@ -248,17 +264,21 @@ export default class ConsolePersonalAgentsController {
         const invalid = (message) => ctx.response.unprocessableEntity(apiError('invalid_request', message));
         const protocol = body.protocol;
         if (!enabledProtocols(runtime).includes(protocol)) {
-            return invalid('`protocol` precisa ser um protocolo ligado (`pact` ou `poppy`).');
+            return invalid(`\`protocol\` precisa ser um protocolo ligado (${enabledProtocols(runtime)
+                .map((p) => `\`${p}\``)
+                .join(', ')}).`);
         }
         const status = body.status;
         if (status !== 'allowed' && status !== 'blocked') {
             return invalid('`status` precisa ser `allowed` ou `blocked`.');
         }
-        const allowHttp = protocol === 'poppy' && !!runtime.config.poppy?.allowInsecureClientIds;
+        const extension = runtime.extensions.get(protocol);
+        const summary = extension?.runtime.consoleSummary();
+        const allowHttp = !!summary?.allowHttpIdentifiers;
         const identifier = typeof body.identifier === 'string' ? body.identifier.trim() : '';
         if (!isUrl(identifier, allowHttp)) {
-            return invalid(protocol === 'poppy'
-                ? '`identifier` precisa ser o `client_id` do agente (URL HTTPS do documento de metadata).'
+            return invalid(summary
+                ? `\`identifier\` precisa ser uma URL ${allowHttp ? 'http(s)' : 'HTTPS'}: ${summary.identifierLabel}.`
                 : '`identifier` precisa ser o `iss` do agente (URL HTTPS).');
         }
         const name = typeof body.name === 'string' && body.name.trim() ? body.name.trim().slice(0, 200) : null;

package/build/src/host/admin_console_warning.d.ts

@@ -0,0 +1,8 @@
+/** The boot warning for an admin console with no `admin.authorize`. Same wording in every console. */
+export declare const ADMIN_CONSOLE_NO_AUTHORIZE_WARNING = "[@adonis-agora/authkit-server] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/authkit.ts.";
+/** Logs {@link ADMIN_CONSOLE_NO_AUTHORIZE_WARNING} once per process. */
+export declare function warnAdminConsoleUnauthorized(logger: {
+    warn: (message: string) => unknown;
+} | null | undefined): boolean;
+/** Test helper: lets the warning fire again. */
+export declare function resetAdminConsoleWarning(): void;

package/build/src/host/admin_console_warning.js

@@ -0,0 +1,18 @@
+/** The boot warning for an admin console with no `admin.authorize`. Same wording in every console. */
+export const ADMIN_CONSOLE_NO_AUTHORIZE_WARNING = '[@adonis-agora/authkit-server] console has no `authorize` configured: it is open outside production and denies every request in production. Set `authorize` in config/authkit.ts.';
+let warned = false;
+/** Logs {@link ADMIN_CONSOLE_NO_AUTHORIZE_WARNING} once per process. */
+export function warnAdminConsoleUnauthorized(logger) {
+    if (warned)
+        return false;
+    warned = true;
+    if (logger)
+        logger.warn(ADMIN_CONSOLE_NO_AUTHORIZE_WARNING);
+    else
+        console.warn(ADMIN_CONSOLE_NO_AUTHORIZE_WARNING);
+    return true;
+}
+/** Test helper: lets the warning fire again. */
+export function resetAdminConsoleWarning() {
+    warned = false;
+}

package/build/src/host/admin_sessions_service.js

@@ -87,7 +87,7 @@ export class AdminSessionsService {
     /**
      * Revogação total também corta os personal agents: "sair de todas as sessões",
      * reset de senha, a ação do admin e a exclusão de conta não podem deixar um
-     * agente agindo na conta (delegações do PACT e refresh tokens do Poppy). Sem
+     * agente agindo na conta (delegações do PACT e conexões das extensions). Sem
      * `personalAgents` é no-op — e aí nem resolve o banco. Diferente do
      * `recordSubRevocation`, uma falha AQUI propaga: não há outra camada que corte
      * esses tokens.
@@ -142,11 +142,14 @@ export class AdminSessionsService {
             return [];
         return (await adapter.list()).filter((r) => grantIds.has(r.payload.grantId));
     }
-    /** Grants da conta, exceto os espelhos `pgrant_` de refresh tokens do Poppy. */
+    /**
+     * Grants da conta, exceto os espelhos dos grants das `personalAgents.extensions` (os access
+     * tokens de MCP que elas emitem pelo oidc-provider usam o id do grant delas) — aparecem e são
+     * revogados como personal agent, não como app OIDC.
+     */
     async #accountGrants(accountId) {
-        // Os grants `pgrant_` são o espelho de um refresh token do Poppy (Bearer de MCP) — aparecem e
-        // são revogados como personal agent, não como app OIDC.
-        return (await this.#listModelOfAccount('Grant', accountId)).filter((r) => !r.id.startsWith('pgrant_'));
+        const prefixes = (this.#oidc.config.personalAgents?.extensions ?? []).map((e) => e.grantIdPrefix);
+        return (await this.#listModelOfAccount('Grant', accountId)).filter((r) => !prefixes.some((prefix) => r.id.startsWith(prefix)));
     }
     /**
      * Conta TODAS as sessões ativas do IdP (todas as contas). 0 quando o adapter não

package/build/src/host/auth_host_config.d.ts

@@ -1,4 +1,5 @@
 import type { HttpContext } from '@adonisjs/core/http';
+import type { ResolvedPersonalAgentExtension } from '../agents/extension.js';
 import type { AuthSocialConfig, ResolvedRateLimitConfig } from '../define_config.js';
 import type { PolicyRouteOption } from './config_locks.js';
 import type { AuthHostOptions } from './register_auth_host.js';
@@ -35,11 +36,19 @@ export interface AuthHostRuntimeConfig {
      * Ver `deriveLockedRouteOptions`.
      */
     lockedRouteOptions?: PolicyRouteOption[];
-    /** Personal agents ligados → prefixo das rotas deles (`/agents`) e do Poppy (`/poppy`). */
+    /**
+     * Personal agents ligados → prefixo das rotas do PACT (`/agents`) e as
+     * `personalAgents.extensions` resolvidas (rotas, isenções de CSRF, navegador do agente).
+     */
     personalAgents?: {
         prefix: string;
-        poppyPrefix?: string;
+        extensions?: readonly ResolvedPersonalAgentExtension[];
     };
+    /**
+     * `accountSession.acceptIdpSession: false` com `authMethods: { password: false }`:
+     * o console só entra por um `accountLoginUrl` do host (`registerAuthHost` recusa sem ele).
+     */
+    consoleNeedsLoginUrl?: boolean;
     /**
      * API headless (Clerk-style). Presente quando o host a declarou — o provider o
      * stash no boot para `registerAuthHost` montar as rotas sem reler o config inteiro.

package/build/src/host/console_denied_page.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The page a browser gets when `admin.authorize` denies the admin console
+ * (403), or asks for a sign-in it cannot do itself (401). Self-contained: no
+ * script and no external asset, so any CSP renders it.
+ */
+export declare function consoleDeniedPage(status: 401 | 403): string;

package/build/src/host/console_denied_page.js

@@ -0,0 +1,18 @@
+/**
+ * The page a browser gets when `admin.authorize` denies the admin console
+ * (403), or asks for a sign-in it cannot do itself (401). Self-contained: no
+ * script and no external asset, so any CSP renders it.
+ */
+export function consoleDeniedPage(status) {
+    const title = status === 401 ? 'Sign in required' : 'Access denied';
+    const body = status === 401
+        ? 'This console needs credentials this request did not carry.'
+        : 'You do not have access to this console.';
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${title}</title>
+<style>body{font-family:system-ui,sans-serif;background:#f9fafb;color:#111827;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;padding:16px}
+.box{max-width:420px;text-align:center}h1{font-size:20px;margin:0 0 8px}p{color:#4b5563;font-size:14px;line-height:1.6;margin:0}
+.code{font-size:12px;color:#9ca3af;margin-bottom:8px}</style>
+</head><body><main class="box"><p class="code">${status}</p><h1>${title}</h1><p>${body}</p></main></body></html>`;
+}

package/build/src/host/console_sso.d.ts

@@ -0,0 +1,24 @@
+/** `client_id` do client interno do console. Reservado: não pode ser cadastrado. */
+export declare const CONSOLE_SSO_CLIENT_ID = "authkit-console";
+/** Rota que inicia o login do console pelo IdP. */
+export declare const CONSOLE_SSO_START_PATH = "/auth/console/sso";
+/** `redirect_uri` do client interno: valida o `state` e abre o console. */
+export declare const CONSOLE_SSO_CALLBACK_PATH = "/auth/console/callback";
+/** Chave da sessão Adonis com o `state` e o destino de um login em andamento. */
+export declare const CONSOLE_SSO_STATE_KEY = "authkit_console_sso";
+/** O que fica na sessão entre o início e o callback. */
+export interface ConsoleSsoState {
+    state: string;
+    returnTo: string | null;
+}
+/** Metadata do client interno para o `clients` estático do oidc-provider. */
+export declare function consoleSsoClientMetadata(issuer: string): Record<string, unknown>;
+/** Novo `state` opaco para um login do console. */
+export declare function newConsoleSsoState(): string;
+/**
+ * Path do authorize do provider. O issuer termina no `mountPath` (garantido por
+ * `registerAuthHost`), então o mount é o path do issuer.
+ */
+export declare function authorizationPath(issuer: string, provider?: any): string;
+/** URL do login do console pelo IdP, preservando o destino como `return_to`. */
+export declare function consoleSsoUrl(returnTo?: string | null): string;

package/build/src/host/console_sso.js

@@ -0,0 +1,70 @@
+/**
+ * Login do console pelo IdP (SSO), o jeito padrão de entrar em `/account/*` e no
+ * console admin.
+ *
+ * O console é tratado como mais um app do IdP, como o Keycloak faz com o
+ * `account-console` e o `security-admin-console`: sem sessão, o visitante vai
+ * para a tela de login do IdP (a mesma interaction de qualquer client: senha,
+ * magic link, OTP, passkey, social), volta, e a ponte de
+ * `idp_session_bridge.ts` abre o console para a conta da sessão do IdP.
+ *
+ * Para isso existe um client interno, `authkit-console`, injetado como client
+ * ESTÁTICO do provider (não fica no adapter, então não aparece na lista de
+ * clients do console nem pode ser editado):
+ *
+ *   - `response_types: ['none']`: o authorize não emite code nem token. O client
+ *     só usa o IdP para autenticar; o que abre o console é a sessão do IdP que o
+ *     login criou, lida pela ponte. Não há segredo, PKCE ou troca de code.
+ *   - o consent é concedido automaticamente (é a própria lib).
+ *   - a única `redirect_uri` é `/auth/console/callback`, no MESMO host do issuer.
+ *
+ * Só existe com `accountSession.acceptIdpSession` ligado (o default).
+ */
+import { randomBytes } from 'node:crypto';
+/** `client_id` do client interno do console. Reservado: não pode ser cadastrado. */
+export const CONSOLE_SSO_CLIENT_ID = 'authkit-console';
+/** Rota que inicia o login do console pelo IdP. */
+export const CONSOLE_SSO_START_PATH = '/auth/console/sso';
+/** `redirect_uri` do client interno: valida o `state` e abre o console. */
+export const CONSOLE_SSO_CALLBACK_PATH = '/auth/console/callback';
+/** Chave da sessão Adonis com o `state` e o destino de um login em andamento. */
+export const CONSOLE_SSO_STATE_KEY = 'authkit_console_sso';
+/** Metadata do client interno para o `clients` estático do oidc-provider. */
+export function consoleSsoClientMetadata(issuer) {
+    const origin = new URL(issuer).origin;
+    return {
+        client_id: CONSOLE_SSO_CLIENT_ID,
+        client_name: 'Account console',
+        application_type: 'web',
+        token_endpoint_auth_method: 'none',
+        response_types: ['none'],
+        grant_types: [],
+        redirect_uris: [`${origin}${CONSOLE_SSO_CALLBACK_PATH}`],
+    };
+}
+/** Novo `state` opaco para um login do console. */
+export function newConsoleSsoState() {
+    return randomBytes(24).toString('base64url');
+}
+/**
+ * Path do authorize do provider. O issuer termina no `mountPath` (garantido por
+ * `registerAuthHost`), então o mount é o path do issuer.
+ */
+export function authorizationPath(issuer, provider) {
+    const mount = new URL(issuer).pathname.replace(/\/+$/, '');
+    if (provider && typeof provider.pathFor === 'function') {
+        try {
+            return provider.pathFor('authorization', { mountPath: mount });
+        }
+        catch {
+            // cai no default do oidc-provider abaixo
+        }
+    }
+    return `${mount}/auth`;
+}
+/** URL do login do console pelo IdP, preservando o destino como `return_to`. */
+export function consoleSsoUrl(returnTo) {
+    if (!returnTo)
+        return CONSOLE_SSO_START_PATH;
+    return `${CONSOLE_SSO_START_PATH}?return_to=${encodeURIComponent(returnTo)}`;
+}

package/build/src/host/controllers/account_apps_controller.js

@@ -38,16 +38,19 @@ export default class AccountAppsController {
                 scopes: g.scopes,
             })))
             : null;
-        // Refresh tokens do Poppy: o agente é desconectado pela mesma lista (§5.5).
-        const poppy = agentsRuntime?.poppy;
-        const poppyAgents = poppy
-            ? await Promise.all((await poppy.listGrants(accountId)).map(async (g) => ({
-                id: g.id,
-                name: await poppy.registry.displayName(g.clientId),
-                scopes: g.scopes,
-            })))
-            : null;
-        const agents = pactAgents || poppyAgents ? [...(pactAgents ?? []), ...(poppyAgents ?? [])] : null;
+        // Conexões das `personalAgents.extensions`: desconectadas pela mesma lista.
+        let extensionAgents = null;
+        for (const { runtime } of agentsRuntime?.extensions.values() ?? []) {
+            extensionAgents ??= [];
+            for (const g of await runtime.listAccountGrants(accountId)) {
+                extensionAgents.push({
+                    id: g.id,
+                    name: await runtime.displayName(g.clientId),
+                    scopes: g.scopes,
+                });
+            }
+        }
+        const agents = pactAgents || extensionAgents ? [...(pactAgents ?? []), ...(extensionAgents ?? [])] : null;
         return render(ctx, 'account/apps', {
             csrfToken: ctx.request.csrfToken,
             supported,
@@ -89,8 +92,9 @@ export default class AccountAppsController {
     /** POST /account/apps/agents/:grantId/revoke — revoga a delegação de um personal agent. */
     async revokeAgent(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation && !runtime?.poppy)
+        if (!runtime || (!runtime.delegation && runtime.extensions.size === 0)) {
             return ctx.response.notFound();
+        }
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
         const accountId = ctx.session.get(ACCOUNT_SESSION_KEY);

package/build/src/host/controllers/account_session_controller.js

@@ -3,6 +3,7 @@ import { accountHome } from '../account_home.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
 import { ACCOUNT_SESSION_KEY } from '../account_session_key.js';
 import { syncAdonisAuthLogin, syncAdonisAuthLogout } from '../adonis_auth_sync.js';
+import { consoleSsoUrl } from '../console_sso.js';
 import { normalizeEmailIdentifier } from '../email_identifier.js';
 import { translate } from '../i18n.js';
 import { endBridgedIdpSession } from '../idp_session_bridge.js';
@@ -49,8 +50,16 @@ export default class AccountSessionController {
             return ctx.response.redirect(accountHome(cfg));
         }
         // Lê e valida o return_to da query-string — descarta valores inválidos (open-redirect).
-        const rawReturnTo = ctx.request.qs?.()?.return_to ?? ctx.request.input?.('return_to');
+        const qs = (ctx.request.qs?.() ?? {});
+        const rawReturnTo = qs.return_to ?? ctx.request.input?.('return_to');
         const returnTo = validateReturnTo(rawReturnTo);
+        // SSO (default): o console entra pelo login do IdP, a mesma tela de qualquer
+        // app. O formulário de senha daqui fica como porta alternativa
+        // (`?method=password`), e só quando a senha não foi desligada no config.
+        const passwordForm = qs.method === 'password' && cfg.authMethods?.password !== false;
+        if (cfg.accountSession?.acceptIdpSession === true && !passwordForm) {
+            return redirectExact(ctx.response, consoleSsoUrl(returnTo));
+        }
         const props = {
             csrfToken: ctx.request.csrfToken,
             returnTo,

package/build/src/host/controllers/console_sso_controller.d.ts

@@ -0,0 +1,12 @@
+import '../augmentations.js';
+import type { HttpContext } from '@adonisjs/core/http';
+/**
+ * Login do console pelo IdP (ver `console_sso.ts`).
+ *
+ *   GET /auth/console/sso?return_to=…   → authorize do client interno
+ *   GET /auth/console/callback?state=…  → valida o state, abre o console pela ponte
+ */
+export default class ConsoleSsoController {
+    start(ctx: HttpContext): Promise<unknown>;
+    callback(ctx: HttpContext): Promise<unknown>;
+}

package/build/src/host/controllers/console_sso_controller.js

@@ -0,0 +1,61 @@
+import '../augmentations.js';
+import { accountHome } from '../account_home.js';
+import { getAccountLoginUrl } from '../account_login_url.js';
+import { authorizationPath, CONSOLE_SSO_CALLBACK_PATH, CONSOLE_SSO_CLIENT_ID, CONSOLE_SSO_STATE_KEY, newConsoleSsoState, } from '../console_sso.js';
+import { ensureConsoleSession } from '../idp_session_bridge.js';
+import { redirectExact } from '../redirect_exact.js';
+import { validateReturnTo } from './account_session_controller.js';
+/**
+ * Login do console pelo IdP (ver `console_sso.ts`).
+ *
+ *   GET /auth/console/sso?return_to=…   → authorize do client interno
+ *   GET /auth/console/callback?state=…  → valida o state, abre o console pela ponte
+ */
+export default class ConsoleSsoController {
+    async start(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const returnTo = validateReturnTo(ctx.request.qs?.()?.return_to ?? ctx.request.input?.('return_to'));
+        // SSO desligado (`acceptIdpSession: false`): o console só tem o login próprio.
+        if (cfg.accountSession?.acceptIdpSession !== true) {
+            const login = getAccountLoginUrl();
+            const sep = login.includes('?') ? '&' : '?';
+            return redirectExact(ctx.response, returnTo ? `${login}${sep}return_to=${encodeURIComponent(returnTo)}` : login);
+        }
+        // Já tem sessão (de console ou do IdP): não precisa passar pelo IdP.
+        if (await ensureConsoleSession(ctx)) {
+            return redirectExact(ctx.response, returnTo ?? accountHome(cfg));
+        }
+        const state = newConsoleSsoState();
+        ctx.session.put(CONSOLE_SSO_STATE_KEY, { state, returnTo });
+        const origin = new URL(cfg.issuer).origin;
+        const query = new URLSearchParams({
+            client_id: CONSOLE_SSO_CLIENT_ID,
+            response_type: 'none',
+            scope: 'openid',
+            redirect_uri: `${origin}${CONSOLE_SSO_CALLBACK_PATH}`,
+            state,
+        });
+        return redirectExact(ctx.response, `${authorizationPath(cfg.issuer, service.provider)}?${query.toString()}`);
+    }
+    async callback(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const pending = ctx.session.get(CONSOLE_SSO_STATE_KEY);
+        ctx.session.forget(CONSOLE_SSO_STATE_KEY);
+        const qs = (ctx.request.qs?.() ?? {});
+        // `state` amarra o callback ao navegador que iniciou o login (anti-CSRF de login).
+        if (!pending || typeof qs.state !== 'string' || qs.state !== pending.state) {
+            return ctx.response.status(400).send('Invalid or expired sign-in request.');
+        }
+        // O IdP recusou (o usuário cancelou, conta desabilitada, …): sem console.
+        // Vai para a raiz, e não de volta ao console, para não entrar em loop.
+        if (typeof qs.error === 'string') {
+            return redirectExact(ctx.response, '/');
+        }
+        if (!(await ensureConsoleSession(ctx))) {
+            return redirectExact(ctx.response, '/');
+        }
+        return redirectExact(ctx.response, pending.returnTo ?? accountHome(cfg));
+    }
+}