@adonis-agora/authkit-server 1.0.0-rc.1 → 1.0.0-rc.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.1",
+  "version": "1.0.0-rc.11",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -41,12 +41,14 @@
   "exports": {
     ".": "./build/index.js",
     "./types": "./build/types.js",
+    "./account-extension": "./build/src/account/extension.js",
     "./services/main": "./build/services/main.js",
     "./durable": "./build/src/host/durable/index.js",
     "./telescope": "./build/src/observability/telescope/index.js",
     "./authkit_server_provider": "./build/providers/authkit_server_provider.js",
     "./commands": "./build/commands/main.js",
-    "./commands/configure": "./build/commands/configure.js"
+    "./commands/configure": "./build/commands/configure.js",
+    "./doctor": "./build/src/doctor/index.js"
   },
   "adonisjs": {
     "types": "@adonis-agora/authkit-server",
@@ -106,10 +108,10 @@
     }
   },
   "dependencies": {
-    "@adonis-agora/authkit-core": "1.0.0-rc.0",
+    "@adonis-agora/authkit-core": "1.0.0-rc.1",
     "@simplewebauthn/browser": "14.0.0",
     "@simplewebauthn/server": "14.1.0",
-    "jose": "6.2.15",
+    "jose": "6.2.16",
     "koa": "3.3.0",
     "koa-mount": "4.2.0",
     "oidc-provider": "9.13.3",
@@ -117,8 +119,8 @@
     "qrcode": "1.5.4"
   },
   "devDependencies": {
-    "@adonis-agora/authkit-react": "1.0.0-rc.0",
-    "@adonis-agora/durable": "0.59.0",
+    "@adonis-agora/authkit-react": "1.0.0-rc.4",
+    "@adonis-agora/durable": "0.60.0",
     "@adonis-agora/telescope": "0.27.1",
     "@adonisjs/ally": "6.3.2",
     "@adonisjs/auth": "10.1.0",
@@ -169,6 +171,7 @@
     "build": "node scripts/build_host_css.mjs && node scripts/build_webauthn.mjs && node scripts/build_ui.mjs && node -e \"const fs=require('node:fs');for(const d of ['build/stubs','build/host/views'])fs.rmSync(d,{recursive:true,force:true})\" && tsc && node -e \"require('node:fs').cpSync('src/host/assets','build/src/host/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/src/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/src/password/common_passwords.txt')\"",
     "build:ui": "node scripts/build_ui.mjs",
     "build:webauthn": "node scripts/build_webauthn.mjs",
+    "check:agora-doctor": "node ../../scripts/check-agora-doctor.mjs .",
     "check:host-css": "node scripts/check_host_css.mjs",
     "check:webauthn-bundle": "node scripts/check_webauthn_bundle.mjs",
     "typecheck": "tsc --noEmit && node scripts/typecheck_ui.mjs && node scripts/typecheck_tests.mjs",

package/build/src/agents/poppy/client_registry.d.ts

@@ -1,50 +0,0 @@
-/**
- * Identidade do personal agent no Poppy (§4.1): o `client_id` é uma URL HTTPS
- * que devolve o documento de metadata do agente (OAuth Client ID Metadata
- * Document). Buscamos (à prova de SSRF), validamos, guardamos em cache e
- * importamos as chaves públicas do `jwks_uri`.
- */
-import { type JWTVerifyGetKey } from 'jose';
-import type { ResolvedPoppyConfig } from './config.js';
-import { type JsonFetcher } from './safe_fetch.js';
-export interface PoppyClient {
-    clientId: string;
-    /** `client_name`, ou o host do `client_id`. */
-    name: string;
-    logoUri: string | null;
-    jwksUri: string;
-    redirectUris: string[];
-    extensions: Record<string, unknown>;
-    /** Chaves públicas do `jwks_uri`. */
-    keys: JWTVerifyGetKey;
-}
-/**
- * `redirect_uri` igual a uma entrada de `redirect_uris`; numa loopback redirect URI a porta não
- * conta (§4.2, RFC 8252 §7.3).
- */
-export declare function redirectUriAllowed(registered: string[], redirectUri: string): boolean;
-/** Valida um documento de metadata e devolve os campos usados. Lança `invalid_client`. */
-export declare function validateClientMetadata(fetchedFrom: string, doc: unknown, options?: {
-    allowHttp?: boolean;
-}): Omit<PoppyClient, 'keys'>;
-export interface PoppyClientRegistryOptions {
-    /** Busca de JSON. Default: {@link safeFetchJson}. */
-    fetchJson?: JsonFetcher;
-    now?: () => number;
-}
-/**
- * Resolve e valida agentes pelo `client_id`, com cache (respeita `max-age`,
- * entre 1 min e 24 h; falhas ficam 1 min em cache para que o mesmo `client_id`
- * não vire uma busca de saída por request).
- */
-export declare class PoppyClientRegistry {
-    #private;
-    constructor(cfg: ResolvedPoppyConfig, options?: PoppyClientRegistryOptions);
-    /**
-     * O agente, ou `invalid_client`: `client_id` não é HTTPS, bloqueado, não
-     * registrado (quando o app exige registro), metadata inválida/inalcançável.
-     */
-    resolve(clientId: unknown): Promise<PoppyClient>;
-    /** Nome de exibição sem falhar (console de conta): metadata em cache/buscada, ou o host. */
-    displayName(clientId: string): Promise<string>;
-}

package/build/src/agents/poppy/client_registry.js

@@ -1,260 +0,0 @@
-/**
- * Identidade do personal agent no Poppy (§4.1): o `client_id` é uma URL HTTPS
- * que devolve o documento de metadata do agente (OAuth Client ID Metadata
- * Document). Buscamos (à prova de SSRF), validamos, guardamos em cache e
- * importamos as chaves públicas do `jwks_uri`.
- */
-import { createLocalJWKSet } from 'jose';
-import { PoppyError } from './errors.js';
-import { insecureDevFetchJson, SafeFetchError, safeFetchJson, } from './safe_fetch.js';
-const MIN_TTL_MS = 60 * 1000;
-const MAX_TTL_MS = 24 * 3600 * 1000;
-const DEFAULT_TTL_MS = 3600 * 1000;
-const FAILURE_TTL_MS = 60 * 1000;
-const MAX_CACHED = 1000;
-/** Releitura do JWKS quando o `kid` não está no conjunto em cache — no máximo a cada 30 s. */
-const JWKS_REFRESH_COOLDOWN_MS = 30 * 1000;
-function hostOf(url) {
-    try {
-        return new URL(url).host.toLowerCase();
-    }
-    catch {
-        return null;
-    }
-}
-function isHttpsUrl(value, allowHttp = false) {
-    if (typeof value !== 'string')
-        return false;
-    try {
-        const url = new URL(value);
-        const schemeOk = url.protocol === 'https:' || (allowHttp && url.protocol === 'http:');
-        return schemeOk && !url.username && !url.password && !url.hash;
-    }
-    catch {
-        return false;
-    }
-}
-/** Loopback redirect URI (RFC 8252 §7.3): `http`, IP de loopback literal, sem fragmento. */
-function isLoopbackRedirect(value) {
-    if (typeof value !== 'string')
-        return false;
-    try {
-        const url = new URL(value);
-        return (url.protocol === 'http:' &&
-            (url.hostname === '127.0.0.1' || url.hostname === '[::1]') &&
-            !url.username &&
-            !url.password &&
-            !url.hash);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * `redirect_uri` igual a uma entrada de `redirect_uris`; numa loopback redirect URI a porta não
- * conta (§4.2, RFC 8252 §7.3).
- */
-export function redirectUriAllowed(registered, redirectUri) {
-    if (registered.includes(redirectUri))
-        return true;
-    if (!isLoopbackRedirect(redirectUri))
-        return false;
-    const withoutPort = (value) => {
-        const url = new URL(value);
-        url.port = '';
-        return url.toString();
-    };
-    return registered.some((r) => isLoopbackRedirect(r) && withoutPort(r) === withoutPort(redirectUri));
-}
-function ttlFrom(maxAge) {
-    if (maxAge === null)
-        return DEFAULT_TTL_MS;
-    return Math.min(MAX_TTL_MS, Math.max(MIN_TTL_MS, maxAge * 1000));
-}
-function setBounded(map, key, value) {
-    map.delete(key);
-    map.set(key, value);
-    if (map.size > MAX_CACHED)
-        map.delete(map.keys().next().value);
-}
-/** Valida um documento de metadata e devolve os campos usados. Lança `invalid_client`. */
-export function validateClientMetadata(fetchedFrom, doc, options = {}) {
-    const allowHttp = options.allowHttp === true;
-    const bad = (why) => new PoppyError('invalid_client', `client metadata: ${why}`);
-    if (!doc || typeof doc !== 'object' || Array.isArray(doc))
-        throw bad('not a JSON object');
-    const d = doc;
-    if (d.client_id !== fetchedFrom)
-        throw bad('client_id must equal the URL it was fetched from');
-    const host = hostOf(fetchedFrom);
-    if (!isHttpsUrl(d.jwks_uri, allowHttp) || hostOf(d.jwks_uri) !== host) {
-        throw bad('jwks_uri must be an HTTPS URL on the same domain as client_id');
-    }
-    const redirects = d.redirect_uris ?? [];
-    if (!Array.isArray(redirects))
-        throw bad('redirect_uris must be an array');
-    for (const uri of redirects) {
-        if (isLoopbackRedirect(uri))
-            continue;
-        if (!isHttpsUrl(uri, allowHttp) || hostOf(uri) !== host) {
-            throw bad('every redirect_uri must be an HTTPS URL on the same domain as client_id, or a loopback URI');
-        }
-    }
-    if (d.token_endpoint_auth_method !== 'private_key_jwt') {
-        throw bad('token_endpoint_auth_method must be private_key_jwt');
-    }
-    if (d.jwks !== undefined)
-        throw bad('keys are published at jwks_uri only');
-    const name = typeof d.client_name === 'string' && d.client_name.trim() ? d.client_name : host;
-    const extensions = d.extensions && typeof d.extensions === 'object' && !Array.isArray(d.extensions)
-        ? d.extensions
-        : {};
-    return {
-        clientId: fetchedFrom,
-        name: name.slice(0, 200),
-        logoUri: isHttpsUrl(d.logo_uri, allowHttp) ? d.logo_uri : null,
-        jwksUri: d.jwks_uri,
-        redirectUris: redirects,
-        extensions,
-    };
-}
-/** Só chaves públicas (§4.1) e pelo menos uma. */
-function validateJwks(doc) {
-    const keys = doc?.keys;
-    if (!Array.isArray(keys) || keys.length === 0) {
-        throw new PoppyError('invalid_client', 'jwks_uri must serve a non-empty JWK set');
-    }
-    for (const key of keys) {
-        if (!key || typeof key !== 'object')
-            throw new PoppyError('invalid_client', 'invalid JWK');
-        const k = key;
-        if ('d' in k || 'p' in k || 'q' in k || k.kty === 'oct') {
-            throw new PoppyError('invalid_client', 'jwks_uri must contain only public keys');
-        }
-    }
-    return { keys: keys };
-}
-/**
- * Resolve e valida agentes pelo `client_id`, com cache (respeita `max-age`,
- * entre 1 min e 24 h; falhas ficam 1 min em cache para que o mesmo `client_id`
- * não vire uma busca de saída por request).
- */
-export class PoppyClientRegistry {
-    #cfg;
-    #fetch;
-    #now;
-    #clients = new Map();
-    #jwks = new Map();
-    constructor(cfg, options = {}) {
-        this.#cfg = cfg;
-        this.#fetch =
-            options.fetchJson ??
-                (cfg.allowInsecureClientIds
-                    ? (url) => insecureDevFetchJson(url)
-                    : (url) => safeFetchJson(url));
-        this.#now = options.now ?? Date.now;
-    }
-    /**
-     * O agente, ou `invalid_client`: `client_id` não é HTTPS, bloqueado, não
-     * registrado (quando o app exige registro), metadata inválida/inalcançável.
-     */
-    async resolve(clientId) {
-        if (!isHttpsUrl(clientId, this.#cfg.allowInsecureClientIds)) {
-            throw new PoppyError('invalid_client', 'client_id must be an HTTPS URL');
-        }
-        if (await this.#cfg.clients.isBlocked(clientId)) {
-            throw new PoppyError('invalid_client', 'client_id is blocked');
-        }
-        if (this.#cfg.clients.requireRegistration &&
-            !(await this.#cfg.clients.isRegistered(clientId))) {
-            throw new PoppyError('invalid_client', 'client_id is not registered');
-        }
-        const meta = await this.#metadata(clientId);
-        return { ...meta, keys: this.#keySet(meta.jwksUri) };
-    }
-    /** Nome de exibição sem falhar (console de conta): metadata em cache/buscada, ou o host. */
-    async displayName(clientId) {
-        try {
-            return (await this.#metadata(clientId)).name;
-        }
-        catch {
-            return hostOf(clientId) ?? clientId;
-        }
-    }
-    #metadata(clientId) {
-        const now = this.#now();
-        const cached = this.#clients.get(clientId);
-        if (cached && cached.expiresAt > now)
-            return cached.value;
-        const entry = {
-            value: Promise.resolve(null),
-            expiresAt: now + FAILURE_TTL_MS,
-        };
-        entry.value = (async () => {
-            let fetched;
-            try {
-                fetched = await this.#fetch(clientId);
-            }
-            catch (error) {
-                const why = error instanceof SafeFetchError ? error.message : 'unreachable';
-                throw new PoppyError('invalid_client', `client metadata: ${why}`);
-            }
-            const meta = validateClientMetadata(clientId, fetched.body, {
-                allowHttp: this.#cfg.allowInsecureClientIds,
-            });
-            entry.expiresAt = this.#now() + ttlFrom(fetched.maxAge);
-            return meta;
-        })();
-        entry.value.catch(() => {
-            entry.expiresAt = this.#now() + FAILURE_TTL_MS;
-        });
-        setBounded(this.#clients, clientId, entry);
-        return entry.value;
-    }
-    #fetchJwks(jwksUri, force) {
-        const now = this.#now();
-        const cached = this.#jwks.get(jwksUri);
-        if (cached && cached.expiresAt > now && !force)
-            return cached.value;
-        if (cached && force && now - cached.fetchedAt < JWKS_REFRESH_COOLDOWN_MS)
-            return cached.value;
-        const entry = {
-            value: Promise.resolve({ keys: [] }),
-            expiresAt: now + FAILURE_TTL_MS,
-            fetchedAt: now,
-        };
-        entry.value = (async () => {
-            let fetched;
-            try {
-                fetched = await this.#fetch(jwksUri);
-            }
-            catch (error) {
-                const why = error instanceof SafeFetchError ? error.message : 'unreachable';
-                throw new PoppyError('invalid_client', `jwks_uri: ${why}`);
-            }
-            const jwks = validateJwks(fetched.body);
-            entry.expiresAt = this.#now() + ttlFrom(fetched.maxAge);
-            return jwks;
-        })();
-        entry.value.catch(() => {
-            entry.expiresAt = this.#now() + FAILURE_TTL_MS;
-        });
-        setBounded(this.#jwks, jwksUri, entry);
-        return entry.value;
-    }
-    /** `JWTVerifyGetKey` que relê o JWKS uma vez quando o `kid` é desconhecido (rotação). */
-    #keySet(jwksUri) {
-        return async (header, token) => {
-            const jwks = await this.#fetchJwks(jwksUri, false);
-            try {
-                return await createLocalJWKSet(jwks)(header, token);
-            }
-            catch (error) {
-                const refreshed = await this.#fetchJwks(jwksUri, true);
-                if (refreshed === jwks)
-                    throw error;
-                return createLocalJWKSet(refreshed)(header, token);
-            }
-        };
-    }
-}