@adonis-agora/authkit-server 1.0.0-rc.1 → 1.0.0-rc.11

package/build/src/doctor/checks.js

@@ -553,8 +553,8 @@ export function checkSettings(input) {
         // Table absent — opt-in feature, silently ok.
         return null;
     }
-    // Informa a conexão usada quando nomeada (ajuda a diagnosticar bugs de searchPath).
-    const connectionName = cfg.accountStore?.connectionName;
+    // Informa a conexão usada quando nomeada (a das tabelas do authkit).
+    const connectionName = cfg.schema?.connection;
     const connectionHint = connectionName ? ` (connection: '${connectionName}')` : '';
     // Table present — check if botProtection.verify is configured.
     const hasBotVerify = typeof cfg.botProtection?.verify === 'function';

package/build/src/doctor/doctor_input.d.ts

@@ -0,0 +1,27 @@
+import type { ApplicationService } from '@adonisjs/core/types';
+import { type DoctorInput, type Finding } from './checks.js';
+/** Logger mínimo para reportar peers instalados-mas-quebrados. */
+export interface CanImportLogger {
+    warning(msg: string): void;
+}
+/**
+ * Tenta importar um peer; `true` se importável.
+ *
+ * Distingue "não instalado" de "instalado mas quebrado": só um erro de
+ * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
+ * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
+ * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
+ * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
+ * como "ausente" e o diagnóstico mente.
+ */
+export declare function canImport(specifier: string, logger?: CanImportLogger): Promise<boolean>;
+/**
+ * Monta o `DoctorInput` a partir do app (config `authkit` resolvida, `session`, peers). Usado por
+ * `authkit:doctor` e pelos checks do `agora:doctor`. Lança se `config/authkit.ts` não resolver.
+ */
+export declare function buildDoctorInput(app: ApplicationService, logger?: CanImportLogger): Promise<DoctorInput>;
+/**
+ * O finding de idade da chave de assinatura managed (best-effort): `null` quando o jwks não é
+ * `managed` com store, ou quando o keystore não pôde ser lido.
+ */
+export declare function managedSigningKeyAgeFinding(app: ApplicationService, authkitConfig: Record<string, any> | null): Promise<Finding | null>;

package/build/src/doctor/doctor_input.js

@@ -0,0 +1,86 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { DatabaseAdapter } from '../adapters/database_adapter.js';
+import { resolveAuthkitConfig } from '../commands/resolve_config.js';
+import { defaultEncryptForStore } from '../define_config.js';
+import { signingKeyAgeDays } from '../keys/keystore.js';
+import { KeystoreCodec } from '../keys/keystore_codec.js';
+import { loadEncryptionService } from '../keys/keystore_crypto.js';
+import { KeystoreManager, resolveKeystoreVault } from '../keys/keystore_manager.js';
+import { signingKeyAgeFinding } from './checks.js';
+/**
+ * Tenta importar um peer; `true` se importável.
+ *
+ * Distingue "não instalado" de "instalado mas quebrado": só um erro de
+ * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
+ * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
+ * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
+ * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
+ * como "ausente" e o diagnóstico mente.
+ */
+export async function canImport(specifier, logger) {
+    try {
+        await import(__rewriteRelativeImportExtension(specifier));
+        return true;
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code !== 'ERR_MODULE_NOT_FOUND' && code !== 'MODULE_NOT_FOUND') {
+            logger?.warning(`⚠️  ${specifier} está instalado mas falhou ao carregar: ${err.message}`);
+        }
+        return false;
+    }
+}
+/**
+ * Monta o `DoctorInput` a partir do app (config `authkit` resolvida, `session`, peers). Usado por
+ * `authkit:doctor` e pelos checks do `agora:doctor`. Lança se `config/authkit.ts` não resolver.
+ */
+export async function buildDoctorInput(app, logger) {
+    const config = await app.container.make('config');
+    // `defineConfig` exporta um config provider — resolve antes de inspecionar,
+    // senão todo campo aparece como "ausente" (provider cru não tem issuer etc.).
+    const authkitConfig = await resolveAuthkitConfig(app, config.get('authkit', null));
+    const sessionConfig = config.get('session', null) ?? null;
+    return {
+        authkitConfig,
+        sessionConfig,
+        peers: {
+            session: await canImport('@adonisjs/session', logger),
+            shield: await canImport('@adonisjs/shield', logger),
+            ally: await canImport('@adonisjs/ally', logger),
+            limiter: await canImport('@adonisjs/limiter', logger),
+        },
+        __adapterClasses: { DatabaseAdapter },
+    };
+}
+/**
+ * O finding de idade da chave de assinatura managed (best-effort): `null` quando o jwks não é
+ * `managed` com store, ou quando o keystore não pôde ser lido.
+ */
+export async function managedSigningKeyAgeFinding(app, authkitConfig) {
+    const jwksInput = (authkitConfig?.jwksConfig ?? authkitConfig?.jwks);
+    if (jwksInput?.source !== 'managed' || !jwksInput?.store)
+        return null;
+    try {
+        const vault = resolveKeystoreVault(jwksInput.store, {
+            makePath: (p) => app.makePath(p),
+            container: app.container,
+        });
+        const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(jwksInput.store);
+        const enc = encrypt ? await loadEncryptionService().catch(() => undefined) : undefined;
+        const mgr = new KeystoreManager(vault, new KeystoreCodec({ encrypt, enc }), jwksInput.algorithm ?? 'RS256');
+        const store = await mgr.read().catch(() => null);
+        const maxAge = jwksInput.rotationDays ?? 90;
+        return signingKeyAgeFinding(signingKeyAgeDays(store), maxAge);
+    }
+    catch {
+        /* idade é best-effort no doctor */
+        return null;
+    }
+}

package/build/src/doctor/index.d.ts

@@ -0,0 +1,5 @@
+import type { AgoraDoctorCheck } from './agora_doctor.js';
+export type { AgoraDoctorCheck, AgoraDoctorRegistry, AgoraDoctorReport, AgoraDoctorResult, AgoraDoctorStatus, } from './agora_doctor.js';
+export { AGORA_DOCTOR_BINDING, registerDoctorChecks } from './agora_doctor.js';
+/** authkit's checks, for `node ace agora:doctor --no-boot` (which imports this entry instead of booting). */
+export declare const agoraDoctorChecks: AgoraDoctorCheck[];

package/build/src/doctor/index.js

@@ -0,0 +1,4 @@
+import { authkitDoctorChecks } from './agora_checks.js';
+export { AGORA_DOCTOR_BINDING, registerDoctorChecks } from './agora_doctor.js';
+/** authkit's checks, for `node ace agora:doctor --no-boot` (which imports this entry instead of booting). */
+export const agoraDoctorChecks = authkitDoctorChecks();

package/build/src/host/access_token_verifier.js

@@ -41,6 +41,10 @@ function fromJwtPayload(payload) {
     if (typeof payload.sub !== 'string' || !payload.sub)
         return null;
     const clientId = payload.client_id;
+    // No user behind it: a `client_credentials` token (a service tenant's, for one) has
+    // `sub` = the client id (RFC 9068 §2.2) and never authenticates an account.
+    if (payload.sub === clientId)
+        return null;
     return {
         format: 'jwt',
         sub: payload.sub,
@@ -209,6 +213,9 @@ export function remoteAccessTokenVerifier(options) {
             return null;
         if (typeof body.sub !== 'string' || !body.sub)
             return null;
+        // `client_credentials` token: no account behind it.
+        if (body.sub === body.client_id)
+            return null;
         if (typeof body.exp === 'number' && body.exp <= Math.floor(Date.now() / 1000))
             return null;
         return {

package/build/src/host/account_api/account_api_controller.js

@@ -611,7 +611,7 @@ export default class AccountApiController {
     /** Personal agents com delegação ativa na conta (scopes aprovados). */
     async listAgents(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation && !runtime?.poppy) {
+        if (!runtime || (!runtime.delegation && runtime.extensions.size === 0)) {
             return ctx.response
                 .status(404)
                 .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));
@@ -620,16 +620,18 @@ export default class AccountApiController {
         const pact = runtime.delegation
             ? (await runtime.delegation.listGrants(userId)).map((g) => ({ ...g, protocol: 'pact' }))
             : [];
-        const poppy = runtime.poppy
-            ? (await runtime.poppy.listGrants(userId)).map((g) => ({ ...g, protocol: 'poppy' }))
-            : [];
-        return { agents: [...pact, ...poppy] };
+        const others = [];
+        for (const [protocol, { runtime: extension }] of runtime.extensions) {
+            for (const g of await extension.listAccountGrants(userId))
+                others.push({ ...g, protocol });
+        }
+        return { agents: [...pact, ...others] };
     }
     // ─── DELETE /account/api/agents/:id ──────────────────────────────────────
     /** Revoga a delegação de um personal agent (efeito imediato nos tokens). */
     async revokeAgent(ctx) {
         const runtime = await personalAgentsFor(ctx);
-        if (!runtime?.delegation && !runtime?.poppy) {
+        if (!runtime || (!runtime.delegation && runtime.extensions.size === 0)) {
             return ctx.response
                 .status(404)
                 .send(apiErr('capability_unsupported', 'Personal agent delegation is not enabled.'));

package/build/src/host/account_session_sign_in.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Abrir e fechar a sessão de CONTA do authkit (o cookie do console, `ACCOUNT_SESSION_KEY`) a partir
+ * de código de fora do host-kit — o navegador de um personal agent que entrou na conta, por
+ * exemplo. Sincroniza `ctx.auth` (`adonisAuth.guard`) como o login do próprio console.
+ *
+ * Estável no 1.x (usado pelas `personalAgents.extensions`).
+ */
+import type { HttpContext } from '@adonisjs/core/http';
+/** Liga a sessão de conta a `accountId` e sincroniza `ctx.auth`. Não regenera a sessão. */
+export declare function signInAccountSession(ctx: HttpContext, accountId: string): Promise<void>;
+/** Desliga a sessão de conta e sincroniza `ctx.auth`. Não regenera a sessão. */
+export declare function signOutAccountSession(ctx: HttpContext): Promise<void>;

package/build/src/host/account_session_sign_in.js

@@ -0,0 +1,19 @@
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
+import { syncAdonisAuthLogin, syncAdonisAuthLogout } from './adonis_auth_sync.js';
+/** Liga a sessão de conta a `accountId` e sincroniza `ctx.auth`. Não regenera a sessão. */
+export async function signInAccountSession(ctx, accountId) {
+    // Sem augmentation no barrel (ver `augmentation_isolation.spec.ts`): a sessão é lida sem tipo.
+    const session = ctx.session;
+    const service = await ctx.containerResolver.make('authkit.server');
+    session.put(ACCOUNT_SESSION_KEY, accountId);
+    const account = await service.config.accountStore.findById(accountId);
+    if (account)
+        await syncAdonisAuthLogin(ctx, service.config, account);
+}
+/** Desliga a sessão de conta e sincroniza `ctx.auth`. Não regenera a sessão. */
+export async function signOutAccountSession(ctx) {
+    const session = ctx.session;
+    const service = await ctx.containerResolver.make('authkit.server');
+    session.forget(ACCOUNT_SESSION_KEY);
+    await syncAdonisAuthLogout(ctx, service.config);
+}

package/build/src/host/admin_api/admin_users_service.d.ts

@@ -8,8 +8,11 @@ import type { SettingsCapability } from '../runtime_settings.js';
 export interface AdminActor {
     actorId: string | null;
     ip: string | null;
-    /** Marca metadata da auditoria — 'admin-api' nas escritas via REST, 'admin' no console HTML. */
-    source?: 'admin-api' | 'admin';
+    /**
+     * Marca metadata da auditoria — 'admin-api' nas escritas via REST, 'admin' no console HTML,
+     * 'mcp' nas ações dos dev tools (endpoint MCP do Agora).
+     */
+    source?: 'admin-api' | 'admin' | 'mcp';
 }
 /** Resultado da deleção via admin: false quando o store não suporta hard delete. */
 export type DeleteUserResult = {

package/build/src/host/admin_api/api_clients_controller.d.ts

@@ -6,6 +6,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  * em create/regenerate. Audita create/update/delete.
  */
 export default class ApiClientsController {
+    #private;
     index(ctx: HttpContext): Promise<{
         data: {
             clientId: string;
@@ -19,6 +20,8 @@ export default class ApiClientsController {
             backchannelLogoutSessionRequired: boolean;
             clientName: string | null;
             logoUri: string | null;
+            disabled: boolean;
+            serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
         }[];
         canList: boolean;
     }>;
@@ -34,6 +37,8 @@ export default class ApiClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     store(ctx: HttpContext): Promise<void | {
         clientId: string;
@@ -51,11 +56,43 @@ export default class ApiClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     regenerateSecret(ctx: HttpContext): Promise<void | {
         clientId: any;
         clientSecret: string;
     }>;
+    disable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
+    enable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
     destroy(ctx: HttpContext): Promise<{
         clientId: any;
         deleted: boolean;

package/build/src/host/admin_api/api_clients_controller.js

@@ -85,11 +85,16 @@ export default class ApiClientsController {
         const id = ctx.request.param('id');
         try {
             const secret = await svc.regenerateSecret(id);
+            const tenant = (await svc.find(id))?.serviceTenant;
             await service.config.audit?.record({
                 type: 'client.updated',
                 clientId: id,
                 ip: ctx.request.ip?.() ?? null,
-                metadata: { actor: 'admin-api', action: 'regenerate_secret' },
+                metadata: {
+                    actor: 'admin-api',
+                    action: 'regenerate_secret',
+                    ...(tenant ? { partition: tenant.partition } : {}),
+                },
             });
             return { clientId: id, clientSecret: secret };
         }
@@ -97,6 +102,31 @@ export default class ApiClientsController {
             return ctx.response.conflict(apiError('cannot_regenerate', e.message));
         }
     }
+    async disable(ctx) {
+        return this.#setDisabled(ctx, true);
+    }
+    async enable(ctx) {
+        return this.#setDisabled(ctx, false);
+    }
+    /** Disabled clients get `invalid_client` from the next request on. */
+    async #setDisabled(ctx, disabled) {
+        const { service, svc } = await clientsService(ctx);
+        const id = ctx.request.param('id');
+        if (!(await svc.setDisabled(id, disabled))) {
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        }
+        const client = await svc.find(id);
+        await service.config.audit?.record({
+            type: disabled ? 'client.disabled' : 'client.enabled',
+            clientId: id,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: {
+                actor: 'admin-api',
+                ...(client?.serviceTenant ? { partition: client.serviceTenant.partition } : {}),
+            },
+        });
+        return clientDto(client);
+    }
     async destroy(ctx) {
         const { service, svc } = await clientsService(ctx);
         const id = ctx.request.param('id');

package/build/src/host/admin_api/dto.d.ts

@@ -40,6 +40,8 @@ export declare function clientDto(client: AdminClient): {
     backchannelLogoutSessionRequired: boolean;
     clientName: string | null;
     logoUri: string | null;
+    disabled: boolean;
+    serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
 };
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */
 export declare function createdClientDto(created: CreatedClient): {
@@ -67,7 +69,7 @@ export declare function grantDto(grant: AdminGrant): {
 };
 export declare function auditDto(event: StoredAuditEvent): {
     id: string;
-    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
+    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.extension.action" | "account.extension.redirect" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.disabled" | "client.enabled" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "service_tenant.token_issued" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
     accountId: string | null;
     email: string | null;
     clientId: string | null;

package/build/src/host/admin_api/dto.js

@@ -32,6 +32,8 @@ export function clientDto(client) {
         backchannelLogoutSessionRequired: client.backchannelLogoutSessionRequired ?? false,
         clientName: client.clientName,
         logoUri: client.logoUri,
+        disabled: client.disabled,
+        serviceTenant: client.serviceTenant,
     };
 }
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */

package/build/src/host/admin_authorize.d.ts

@@ -0,0 +1,8 @@
+import { type ConsoleAuthorize, type ConsoleAuthorizeDecision } from '../console_authorize.js';
+/**
+ * Whether the app runs in production. Unknown (the provider did not register the
+ * app) counts as production, so an omitted `admin.authorize` fails closed.
+ */
+export declare function appInProduction(): boolean;
+/** The resolved `admin.authorize` checker (memoized per configured value). Never throws. */
+export declare function adminAuthorizeChecker(authorize: ConsoleAuthorize): (ctx: any) => Promise<ConsoleAuthorizeDecision>;

package/build/src/host/admin_authorize.js

@@ -0,0 +1,25 @@
+import { getBootedApp } from '../../services/booted_app.js';
+import { resolveConsoleAuthorize, } from '../console_authorize.js';
+/**
+ * Whether the app runs in production. Unknown (the provider did not register the
+ * app) counts as production, so an omitted `admin.authorize` fails closed.
+ */
+export function appInProduction() {
+    try {
+        return getBootedApp().inProduction !== false;
+    }
+    catch {
+        return true;
+    }
+}
+/** One checker per configured `admin.authorize`, so a lazy import runs once. */
+const adminAuthorizeCheckers = new WeakMap();
+/** The resolved `admin.authorize` checker (memoized per configured value). Never throws. */
+export function adminAuthorizeChecker(authorize) {
+    let checker = adminAuthorizeCheckers.get(authorize);
+    if (!checker) {
+        checker = resolveConsoleAuthorize(authorize);
+        adminAuthorizeCheckers.set(authorize, checker);
+    }
+    return checker;
+}

package/build/src/host/admin_clients_service.d.ts

@@ -1,4 +1,5 @@
 import type { OidcService } from '../provider/oidc_service.js';
+import { type ServiceTenantInfo } from '../service_tenants/client_metadata.js';
 import { type ApplicationType } from './client_metadata.js';
 /** Métodos de autenticação no token endpoint suportados pelo formulário admin. */
 export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
@@ -30,6 +31,15 @@ export interface ClientInput {
      * `backchannelLogoutUri` não está definido.
      */
     backchannelLogoutSessionRequired?: boolean;
+    /**
+     * Makes the client a service tenant: confidential, `client_credentials` only, no
+     * redirect URIs; its tokens carry `partition` and `capabilities`. On update, `null`
+     * turns it back into a regular client; absent keeps the current value.
+     */
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    } | null;
 }
 /** Client persistido, apresentado ao console admin. */
 export interface AdminClient {
@@ -49,6 +59,10 @@ export interface AdminClient {
     clientName: string | null;
     /** `logo_uri` registrado, ou `null`. */
     logoUri: string | null;
+    /** Disabled clients get no tokens (`invalid_client`) until enabled again. */
+    disabled: boolean;
+    /** Service-tenant settings, or `null` for a regular client. */
+    serviceTenant: ServiceTenantInfo | null;
 }
 /** Resultado de uma criação: o client + o secret em claro (mostrado UMA vez). */
 export interface CreatedClient {
@@ -94,6 +108,12 @@ export declare class AdminClientsService {
      * PRESERVANDO o client_secret existente. Lança se o client não existe.
      */
     update(clientId: string, input: Partial<ClientInput>): Promise<void>;
+    /**
+     * Disables or re-enables a client. A disabled client gets `invalid_client` on every
+     * endpoint from the next request on (tokens already issued stay valid until they
+     * expire). Returns `false` when the client does not exist.
+     */
+    setDisabled(clientId: string, disabled: boolean): Promise<boolean>;
     /**
      * Regenera o client_secret de um client confidencial, preservando o resto da
      * metadata. Retorna o novo secret em claro (mostrado UMA vez). Lança se o

package/build/src/host/admin_clients_service.js

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto';
+import { CLIENT_DISABLED_KEY, isClientDisabled, normalizeServiceTenant, SERVICE_TENANT_KEY, serviceTenantOf, } from '../service_tenants/client_metadata.js';
 import { assertClientMetadata, ClientMetadataError, } from './client_metadata.js';
 import { CONSOLE_SSO_CLIENT_ID } from './console_sso.js';
 /** Métodos públicos (sem segredo) — espelham os "non-secret" do oidc-provider. */
@@ -111,14 +112,37 @@ export class AdminClientsService {
             logoUri: input.logoUri === null
                 ? undefined
                 : (input.logoUri ?? existing.logo_uri),
+            serviceTenant: input.serviceTenant === undefined
+                ? serviceTenantOf(existing)
+                : input.serviceTenant,
         };
         const confidential = !PUBLIC_AUTH_METHODS.has(merged.tokenEndpointAuthMethod);
         // Mantém o secret atual se continua confidencial; se virou public, remove-o.
         const clientSecret = confidential ? (previousSecret ?? randomId()) : undefined;
         const payload = this.#buildPayload(clientId, merged, clientSecret);
+        if (isClientDisabled(existing))
+            payload[CLIENT_DISABLED_KEY] = true;
         await this.#adapter.upsert(clientId, payload, 0);
         await this.oidc.evictDynamicClientCache();
     }
+    /**
+     * Disables or re-enables a client. A disabled client gets `invalid_client` on every
+     * endpoint from the next request on (tokens already issued stay valid until they
+     * expire). Returns `false` when the client does not exist.
+     */
+    async setDisabled(clientId, disabled) {
+        const existing = await this.#adapter.find(clientId);
+        if (!existing)
+            return false;
+        const payload = { ...existing };
+        if (disabled)
+            payload[CLIENT_DISABLED_KEY] = true;
+        else
+            delete payload[CLIENT_DISABLED_KEY];
+        await this.#adapter.upsert(clientId, payload, 0);
+        await this.oidc.evictDynamicClientCache();
+        return true;
+    }
     /**
      * Regenera o client_secret de um client confidencial, preservando o resto da
      * metadata. Retorna o novo secret em claro (mostrado UMA vez). Lança se o
@@ -148,6 +172,8 @@ export class AdminClientsService {
      * `client_metadata.ts`). Lança `ClientMetadataError`.
      */
     #assertValid(input) {
+        if (input.serviceTenant)
+            this.#assertServiceTenant(input);
         assertClientMetadata({
             applicationType: input.applicationType ?? 'web',
             tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
@@ -156,6 +182,27 @@ export class AdminClientsService {
             postLogoutRedirectUris: input.postLogoutRedirectUris,
         });
     }
+    /** Rules of a service-tenant client (see {@link ClientInput.serviceTenant}). */
+    #assertServiceTenant(input) {
+        if (!this.oidc.config.serviceTenants?.enabled) {
+            throw new ClientMetadataError('service tenants are not enabled: declare serviceTenants.resources in config/authkit.ts');
+        }
+        if (PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod)) {
+            throw new ClientMetadataError('a service tenant must be confidential (it has a secret)');
+        }
+        if ((input.applicationType ?? 'web') !== 'web') {
+            throw new ClientMetadataError('a service tenant must be a web (server) client');
+        }
+        if (input.grantTypes.length !== 1 || input.grantTypes[0] !== 'client_credentials') {
+            throw new ClientMetadataError('a service tenant can only use the client_credentials grant');
+        }
+        if (input.redirectUris.length || input.postLogoutRedirectUris.length) {
+            throw new ClientMetadataError('a service tenant has no redirect URIs');
+        }
+        if (input.backchannelLogoutUri) {
+            throw new ClientMetadataError('a service tenant has no back-channel logout URI');
+        }
+    }
     /**
      * Monta o payload na forma snake_case que o oidc-provider espera/persiste —
      * verificada contra o que o registro dinâmico (RFC 7591) grava. As chaves de
@@ -193,6 +240,12 @@ export class AdminClientsService {
                 payload.backchannel_logout_session_required = input.backchannelLogoutSessionRequired;
             }
         }
+        if (input.serviceTenant) {
+            const tenant = normalizeServiceTenant(input.serviceTenant);
+            if (typeof tenant === 'string')
+                throw new ClientMetadataError(tenant);
+            payload[SERVICE_TENANT_KEY] = tenant;
+        }
         return payload;
     }
     /** Projeta um payload persistido para a forma exibida no console admin. */
@@ -209,6 +262,8 @@ export class AdminClientsService {
             applicationType: p.application_type === 'native' ? 'native' : 'web',
             clientName: typeof p.client_name === 'string' && p.client_name ? p.client_name : null,
             logoUri: typeof p.logo_uri === 'string' && p.logo_uri ? p.logo_uri : null,
+            disabled: isClientDisabled(p),
+            serviceTenant: serviceTenantOf(p),
         };
         if (p.backchannel_logout_uri) {
             result.backchannelLogoutUri = p.backchannel_logout_uri;

package/build/src/host/admin_console/admin_console_entry.d.ts

@@ -0,0 +1,14 @@
+import type { HttpContext } from '@adonisjs/core/http';
+import { type AgoraConsoleEntry, type AgoraConsoleRegistry, type AgoraConsoleSearchHit } from '../../console_switcher.js';
+/** The admin console's id in the `'agora.consoles'` registry. */
+export declare const ADMIN_CONSOLE_ID = "authkit";
+/** The `'agora.consoles'` registry, or `null` (none bound, or no booted app). */
+export declare function consoleRegistry(): Promise<AgoraConsoleRegistry | null>;
+/**
+ * Global search of the admin console: users by email (as the account store's `listAccounts`
+ * search matches them), and organizations by name or slug.
+ * Each hit opens the matching drawer in the console.
+ */
+export declare function searchAdminConsole(ctx: HttpContext, adminPrefix: string, query: string, limit: number): Promise<AgoraConsoleSearchHit[]>;
+/** The admin console's registry entry, for the shell mounted at `adminPrefix`. */
+export declare function adminConsoleEntry(adminPrefix: string, authorize: AgoraConsoleEntry['authorize']): AgoraConsoleEntry;