@adonis-agora/authkit-server 1.0.0-rc.10 → 1.0.0-rc.11

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.11
+
+### Patch Changes
+
+- [#473](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/473) [`427c4a3`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/427c4a301907dc78d8e7c5405d4e73e29b8a2be4) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Every table AuthKit owns now uses one Lucid connection: `schema.connection` (default: the primary connection). Before, some of them followed other connections, so with the account model on a named connection the boot created a table on one connection and the code read it on another:
+  
+  - `auth_settings` (runtime settings, the settings CLI, `authkit:expire-scan`, the SDK's embedded driver) followed the account model's connection.
+  - `auth_mfa` and `auth_password_history` used the account model's connection.
+  - The built-in organization models had no connection, so they always used the primary one.
+  - `adapters.database()` and the `lucid` keystore without their own `connection` used the primary connection.
+  
+  They all use `schema.connection` now; `adapters.database({ connection })` and `jwks.store: { driver: 'lucid', connection }` still win when set. The app's account table stays on the account model's connection, and the boot adds the `login_methods` column there. If your app had `schema.connection` unset and the account model on a named connection, those tables move to the primary connection: set `schema.connection` to the connection where they already are.
+
 ## 1.0.0-rc.10
 
 ### Minor Changes

package/build/providers/authkit_server_provider.js

@@ -287,6 +287,7 @@ export default class AuthkitServerProvider {
             const report = await ensureAuthkitSchema(db, {
                 connection: config.schema.connection,
                 accountTable: config.accountStore?.accountTable,
+                accountConnection: config.accountStore?.connectionName,
                 tables: config.personalAgents?.extensions?.flatMap((e) => e.tables ?? []),
             });
             const logger = await this.app.container.make('logger').catch(() => null);

package/build/src/accounts/account_store.d.ts

@@ -688,13 +688,13 @@ export declare function supportsOrganizations(store: AccountStore): store is Acc
  */
 export type AccountStore = CoreAccountStore & {
     /**
-     * Nome da conexão Lucid usada por este store (deriva de `Model.connection` no
-     * store default — ver `lucid_account_store.ts`). Quando presente, os call-sites
-     * de RuntimeSettings o repassam como `{ connection }` para que o probe da tabela
-     * `auth_settings` seja searchPath-aware (auth vivendo numa conexão/schema
-     * próprios). Undefined → conexão default (back-compat total). É metadado
-     * opcional, não um método de capacidade — por isso `readonly` e fora dos
-     * blocos `Partial<...>` de capacidades probáveis.
+     * Nome da conexão Lucid da tabela da CONTA (deriva de `Model.connection` no
+     * store default — ver `lucid_account_store.ts`). O boot a usa para garantir a
+     * coluna `login_methods` na tabela da conta. As tabelas do authkit
+     * (`auth_settings` etc.) NÃO seguem esta conexão: usam `schema.connection`.
+     * Undefined → conexão default. É metadado opcional, não um método de
+     * capacidade — por isso `readonly` e fora dos blocos `Partial<...>` de
+     * capacidades probáveis.
      */
     readonly connectionName?: string;
     /**

package/build/src/accounts/lucid_account_store.d.ts

@@ -150,9 +150,9 @@ export interface LucidAccountStoreOptions {
      *   `ensureAuthkitSchema`, então o mapeamento não é decisão do host.
      * - `true` → idêntico ao default (atalho explícito; é o que apps existentes
      *   já usam e continua valendo).
-     * - `{ OrgModel, MemberModel, InvitationModel }` → escape hatch, para quem
-     *   guarda as tabelas de auth numa conexão/schema próprios (os defaults não
-     *   declaram `static connection`).
+     * - `{ OrgModel, MemberModel, InvitationModel }` → escape hatch, para usar
+     *   models próprios do host; eles rodam na conexão que declaram. Os defaults
+     *   seguem `schema.connection`, como toda tabela lib-owned.
      * - `false` → opt-out explícito: `OrganizationsCapability` AUSENTE no store.
      *   Use quando a dependência atual é `supportsOrganizations === false` (ex.:
      *   store/rotas que assumem a ausência). O `authkit:doctor` avisa se

package/build/src/accounts/lucid_account_store.js

@@ -1,8 +1,9 @@
 import { PasswordManager } from '../password/password_manager.js';
+import { authkitTablesClient, BIND_TABLES_LOCATION, } from '../schema/tables_location.js';
 import { buildCore } from './lucid_store/core.js';
 import { buildLoginMethods, supportsLoginMethodsColumn } from './lucid_store/login_methods.js';
 import { buildMfa } from './lucid_store/mfa.js';
-import { defaultOrganizationModels } from './lucid_store/organization_models.js';
+import { defaultOrganizationModels, organizationModelsOn, } from './lucid_store/organization_models.js';
 import { buildOrganizations } from './lucid_store/organizations.js';
 import { buildPasswordExpiration, buildPasswordHistory } from './lucid_store/password_hygiene.js';
 import { buildProviderIdentity } from './lucid_store/provider_identity.js';
@@ -162,11 +163,23 @@ export function lucidAccountStore(Model, options = {}) {
     // opt-out explícito é `false`. O trio explícito segue como escape hatch.
     const orgModelsOption = options.organizationModels;
     const usesDefaultOrgModels = orgModelsOption === undefined || orgModelsOption === true;
-    const OrgModels = orgModelsOption === false
-        ? undefined
-        : usesDefaultOrgModels
-            ? defaultOrganizationModels
-            : orgModelsOption;
+    const explicitOrgModels = orgModelsOption === false || usesDefaultOrgModels ? undefined : orgModelsOption;
+    /**
+     * Onde vivem as tabelas do AuthKit (`schema.connection`). O `defineConfig` informa
+     * via {@link BIND_TABLES_LOCATION} — o store é construído antes de o config existir.
+     * `null` = ainda não informado (store usado fora do `defineConfig`): as tabelas
+     * lib-owned seguem a conexão do model e os models de org default, a primária.
+     */
+    let tablesLocation = null;
+    const tablesClient = () => {
+        const db = Model.$adapter?.db;
+        if (!tablesLocation || !db)
+            return Model.query().client;
+        return authkitTablesClient(db, tablesLocation);
+    };
+    const orgModels = () => explicitOrgModels ??
+        (tablesLocation ? organizationModelsOn(tablesLocation.connection) : defaultOrganizationModels);
+    const OrgModels = orgModelsOption === false ? undefined : orgModels;
     // RP do WebAuthn: usado nas cerimônias. Default do rpName cai no mfaIssuer.
     const webauthn = options.webauthn ?? {
         rpName: mfaIssuer,
@@ -190,6 +203,7 @@ export function lucidAccountStore(Model, options = {}) {
         audit: options.audit,
         emailVerificationTtlHours: emailTokens.verificationTtlHours,
         emailChangeTtlHours: emailTokens.changeTtlHours,
+        tablesClient,
         // Encripta o segredo antes de persistir (no-op sem encrypter).
         sealSecret: (secret) => (encrypter ? encrypter.encrypt(secret) : secret),
         // Decripta o segredo armazenado; retorna null em falha/adulteração (no-op sem encrypter).
@@ -264,9 +278,15 @@ export function lucidAccountStore(Model, options = {}) {
                 // NÃO faz parte do contrato AccountStore.
                 __organizationModelsSource: usesDefaultOrgModels ? 'default' : 'explicit',
                 ...buildOrganizations({
-                    OrgModel: OrgModels.OrgModel,
-                    MemberModel: OrgModels.MemberModel,
-                    InvitationModel: OrgModels.InvitationModel,
+                    get OrgModel() {
+                        return OrgModels().OrgModel;
+                    },
+                    get MemberModel() {
+                        return OrgModels().MemberModel;
+                    },
+                    get InvitationModel() {
+                        return OrgModels().InvitationModel;
+                    },
                     findAccountEmail: async (accountId) => {
                         const row = await Model.find(accountId);
                         return row?.email ?? null;
@@ -292,11 +312,10 @@ export function lucidAccountStore(Model, options = {}) {
             }
         },
         /**
-         * Nome da conexão Lucid usada por este store (deriva de `Model.connection`).
-         * Exposto para que os call-sites de RuntimeSettings possam passar
-         * `{ connection: store.connectionName }` e usar a conexão correta.
-         * Undefined quando o model usa a conexão default (back-compat total).
-         * NÃO faz parte do contrato AccountStore.
+         * Nome da conexão Lucid do MODEL da conta (deriva de `Model.connection`) — onde
+         * vive a tabela da conta (e a coluna `login_methods`). As tabelas do authkit
+         * NÃO seguem esta conexão: elas usam `schema.connection`.
+         * Undefined quando o model usa a conexão default.
          */
         connectionName: Model.connection ?? undefined,
         /**
@@ -318,10 +337,16 @@ export function lucidAccountStore(Model, options = {}) {
         __model: Model,
     };
     // Histórico de senhas: tabela lib-owned `auth_password_history`, pela conexão
-    // do model (resolvida a cada uso, como no MFA).
+    // das tabelas do authkit (resolvida a cada uso, como no MFA).
     Object.assign(store, buildPasswordHistory(ctx, {
-        query: () => Model.query().client.query(),
-        table: (name) => Model.query().client.table(name),
+        query: () => tablesClient().query(),
+        table: (name) => tablesClient().table(name),
     }));
+    // Não-enumerável: o `defineConfig` informa `schema.connection` por aqui.
+    Object.defineProperty(store, BIND_TABLES_LOCATION, {
+        value: (location) => {
+            tablesLocation = { connection: location.connection };
+        },
+    });
     return store;
 }

package/build/src/accounts/lucid_store/mfa.js

@@ -8,8 +8,8 @@ import { buildMfaStateRepo, generateRecoveryCode, hashesEqual, sha256, } from '.
  * {@link ensureAuthkitSchema}), keyed por `account_id`. O host NÃO precisa migrar
  * nada e o model não declara colunas de MFA.
  *
- * Acesso ao banco via a CONEXÃO do próprio model (`Model.query().client`), a mesma
- * usada pelo restante do store. O `email` (para o keyuri/QR) continua vindo do
+ * Acesso ao banco pela conexão das tabelas do authkit (`schema.connection`), a
+ * mesma em que o `autoManage` cria `auth_mfa`. O `email` (para o keyuri/QR) continua vindo do
  * model principal — só o ESTADO de MFA migrou para `auth_mfa`.
  */
 /**
@@ -19,7 +19,7 @@ import { buildMfaStateRepo, generateRecoveryCode, hashesEqual, sha256, } from '.
 const TOTP_PERIOD = 30;
 export function buildMfa(ctx) {
     const { Model, mfaIssuer, recoveryCodeCount, sealSecret, openSecret } = ctx;
-    const repo = buildMfaStateRepo(Model);
+    const repo = buildMfaStateRepo(Model, ctx.tablesClient);
     return {
         async getMfaState(accountId) {
             const state = await repo.read(accountId);

package/build/src/accounts/lucid_store/organization_models.d.ts

@@ -10,10 +10,11 @@ import type { DateTime } from 'luxon';
  * pelo `autoManage` sem que o model escrito à mão no host saiba dela, e o
  * sintoma aparece longe da causa.
  *
- * Use com `organizationModels: true` em {@link lucidAccountStore}. O caminho
+ * Use com `organizationModels: true` em {@link lucidAccountStore}. Eles seguem a
+ * conexão das tabelas do authkit (`schema.connection` do `defineConfig`, como
+ * todas as tabelas lib-owned — ver {@link organizationModelsOn}). O caminho
  * explícito (`{ OrgModel, MemberModel, InvitationModel }`) continua valendo como
- * escape hatch — é para quem guarda as tabelas de auth numa conexão/schema
- * próprios (`static connection = 'auth'`), que estes defaults não declaram.
+ * escape hatch; aí a conexão é a que os models do host declaram.
  *
  * Não crie migration para estas tabelas: elas são criadas/atualizadas pelo
  * `schema.autoManage` do authkit.
@@ -65,3 +66,13 @@ export declare const defaultOrganizationModels: {
     readonly MemberModel: typeof AuthOrganizationMember;
     readonly InvitationModel: typeof AuthOrganizationInvitation;
 };
+export type OrganizationModels = {
+    OrgModel: any;
+    MemberModel: any;
+    InvitationModel: any;
+};
+/**
+ * Os models default numa conexão Lucid nomeada (subclasses com `static connection`),
+ * memoizados por conexão. `undefined` → os próprios defaults (conexão primária).
+ */
+export declare function organizationModelsOn(connection: string | undefined): OrganizationModels;

package/build/src/accounts/lucid_store/organization_models.js

@@ -15,10 +15,11 @@ import { BaseModel, column } from '@adonisjs/lucid/orm';
  * pelo `autoManage` sem que o model escrito à mão no host saiba dela, e o
  * sintoma aparece longe da causa.
  *
- * Use com `organizationModels: true` em {@link lucidAccountStore}. O caminho
+ * Use com `organizationModels: true` em {@link lucidAccountStore}. Eles seguem a
+ * conexão das tabelas do authkit (`schema.connection` do `defineConfig`, como
+ * todas as tabelas lib-owned — ver {@link organizationModelsOn}). O caminho
  * explícito (`{ OrgModel, MemberModel, InvitationModel }`) continua valendo como
- * escape hatch — é para quem guarda as tabelas de auth numa conexão/schema
- * próprios (`static connection = 'auth'`), que estes defaults não declaram.
+ * escape hatch; aí a conexão é a que os models do host declaram.
  *
  * Não crie migration para estas tabelas: elas são criadas/atualizadas pelo
  * `schema.autoManage` do authkit.
@@ -111,3 +112,30 @@ export const defaultOrganizationModels = {
     MemberModel: AuthOrganizationMember,
     InvitationModel: AuthOrganizationInvitation,
 };
+const modelsByConnection = new Map();
+/**
+ * Os models default numa conexão Lucid nomeada (subclasses com `static connection`),
+ * memoizados por conexão. `undefined` → os próprios defaults (conexão primária).
+ */
+export function organizationModelsOn(connection) {
+    if (!connection)
+        return defaultOrganizationModels;
+    let models = modelsByConnection.get(connection);
+    if (!models) {
+        class OrgModel extends AuthOrganization {
+            static table = 'auth_organizations';
+            static connection = connection;
+        }
+        class MemberModel extends AuthOrganizationMember {
+            static table = 'auth_organization_members';
+            static connection = connection;
+        }
+        class InvitationModel extends AuthOrganizationInvitation {
+            static table = 'auth_organization_invitations';
+            static connection = connection;
+        }
+        models = { OrgModel, MemberModel, InvitationModel };
+        modelsByConnection.set(connection, models);
+    }
+    return models;
+}

package/build/src/accounts/lucid_store/organizations.d.ts

@@ -1,7 +1,7 @@
 import type { OrganizationsCapability } from '../account_store.js';
 /**
- * Contexto mínimo para o builder de organizations. Recebe os três models direto
- * (já construídos pelo lucidAccountStore).
+ * Contexto mínimo para o builder de organizations. Os três models são lidos a cada
+ * uso (podem ser getters — ver `lucidAccountStore`).
  */
 export interface OrgStoreContext {
     OrgModel: any;

package/build/src/accounts/lucid_store/organizations.js

@@ -59,7 +59,10 @@ async function countOwners(MemberModel, orgId) {
     return Number(result[0]?.$extras?.total ?? 0);
 }
 export function buildOrganizations(ctx) {
-    const { OrgModel, MemberModel, InvitationModel, findAccountEmail, listAccountIdsInAdminOrder } = ctx;
+    // Os models são lidos do ctx a CADA uso (não desestruturados): o `lucidAccountStore`
+    // troca os models default pelos da conexão das tabelas do authkit quando o
+    // `defineConfig` informa o `schema.connection`, depois de construir o store.
+    const { findAccountEmail, listAccountIdsInAdminOrder } = ctx;
     return {
         ...(listAccountIdsInAdminOrder
             ? {
@@ -73,7 +76,7 @@ export function buildOrganizations(ctx) {
                  * (like `listOrgMembers(orgId).length`).
                  */
                 async listAllOrgsWithMemberCount() {
-                    const memberships = await MemberModel.query();
+                    const memberships = await ctx.MemberModel.query();
                     if (memberships.length === 0)
                         return [];
                     const byAccount = new Map();
@@ -90,7 +93,7 @@ export function buildOrganizations(ctx) {
                     }
                     const accountIds = await listAccountIdsInAdminOrder([...byAccount.keys()]);
                     const orgs = new Map();
-                    for (const org of await findManyChunked(OrgModel, [...memberCount.keys()])) {
+                    for (const org of await findManyChunked(ctx.OrgModel, [...memberCount.keys()])) {
                         orgs.set(String(org.id), org);
                     }
                     const result = [];
@@ -117,7 +120,7 @@ export function buildOrganizations(ctx) {
             : {}),
         async createOrg(input) {
             const { randomUUID } = await import('node:crypto');
-            const org = await OrgModel.create({
+            const org = await ctx.OrgModel.create({
                 id: randomUUID(),
                 name: input.name,
                 slug: input.slug,
@@ -125,7 +128,7 @@ export function buildOrganizations(ctx) {
                 metadata: input.metadata ?? null,
             });
             // Cria a membership do owner automaticamente
-            await MemberModel.create({
+            await ctx.MemberModel.create({
                 id: randomUUID(),
                 organizationId: org.id,
                 accountId: input.ownerAccountId,
@@ -134,28 +137,28 @@ export function buildOrganizations(ctx) {
             return toOrgSummary(org);
         },
         async findOrgById(orgId) {
-            const row = await OrgModel.find(orgId);
+            const row = await ctx.OrgModel.find(orgId);
             return row ? toOrgSummary(row) : null;
         },
         async findOrgsByIds(orgIds) {
             const ids = [...new Set(orgIds)];
             if (ids.length === 0)
                 return [];
-            return (await findManyChunked(OrgModel, ids)).map(toOrgSummary);
+            return (await findManyChunked(ctx.OrgModel, ids)).map(toOrgSummary);
         },
         async findOrgBySlug(slug) {
-            const row = await OrgModel.query().where('slug', slug).first();
+            const row = await ctx.OrgModel.query().where('slug', slug).first();
             return row ? toOrgSummary(row) : null;
         },
         async listOrgsForAccount(accountId) {
-            const memberships = await MemberModel.query().where('account_id', accountId);
+            const memberships = await ctx.MemberModel.query().where('account_id', accountId);
             if (memberships.length === 0)
                 return [];
             // One query for every org (by primary key, like `find`), instead of one per
             // membership. The result keeps the memberships' order.
             const ids = [...new Set(memberships.map((m) => m.organizationId))];
             const orgs = new Map();
-            for (const org of await OrgModel.findMany(ids))
+            for (const org of await ctx.OrgModel.findMany(ids))
                 orgs.set(String(org.id), org);
             const result = [];
             for (const m of memberships) {
@@ -166,7 +169,7 @@ export function buildOrganizations(ctx) {
             return result;
         },
         async updateOrg(orgId, patch) {
-            const row = await OrgModel.find(orgId);
+            const row = await ctx.OrgModel.find(orgId);
             if (!row)
                 return null;
             if (patch.name !== undefined)
@@ -179,16 +182,16 @@ export function buildOrganizations(ctx) {
             return toOrgSummary(row);
         },
         async deleteOrg(orgId) {
-            const row = await OrgModel.find(orgId);
+            const row = await ctx.OrgModel.find(orgId);
             if (!row)
                 return false;
-            await MemberModel.query().where('organization_id', orgId).delete();
-            await InvitationModel.query().where('organization_id', orgId).delete();
+            await ctx.MemberModel.query().where('organization_id', orgId).delete();
+            await ctx.InvitationModel.query().where('organization_id', orgId).delete();
             await row.delete();
             return true;
         },
         async listOrgMembers(orgId) {
-            const rows = await MemberModel.query().where('organization_id', orgId);
+            const rows = await ctx.MemberModel.query().where('organization_id', orgId);
             return rows.map((r) => ({
                 accountId: r.accountId,
                 email: null, // o caller enriquece com findById se necessário
@@ -199,7 +202,7 @@ export function buildOrganizations(ctx) {
         async addOrgMember(orgId, accountId, role) {
             const { randomUUID } = await import('node:crypto');
             // Upsert: se já existe, atualiza a role
-            const existing = await MemberModel.query()
+            const existing = await ctx.MemberModel.query()
                 .where('organization_id', orgId)
                 .where('account_id', accountId)
                 .first();
@@ -208,11 +211,11 @@ export function buildOrganizations(ctx) {
                 await existing.save();
             }
             else {
-                await MemberModel.create({ id: randomUUID(), organizationId: orgId, accountId, role });
+                await ctx.MemberModel.create({ id: randomUUID(), organizationId: orgId, accountId, role });
             }
         },
         async removeOrgMember(orgId, accountId) {
-            const row = await MemberModel.query()
+            const row = await ctx.MemberModel.query()
                 .where('organization_id', orgId)
                 .where('account_id', accountId)
                 .first();
@@ -220,7 +223,7 @@ export function buildOrganizations(ctx) {
                 return { ok: false, reason: 'not_found' };
             // Invariante: org deve ter sempre >= 1 owner
             if (row.role === 'owner') {
-                const ownerCount = await countOwners(MemberModel, orgId);
+                const ownerCount = await countOwners(ctx.MemberModel, orgId);
                 if (ownerCount <= 1)
                     return { ok: false, reason: 'last_owner' };
             }
@@ -228,7 +231,7 @@ export function buildOrganizations(ctx) {
             return { ok: true };
         },
         async updateOrgMemberRole(orgId, accountId, newRole) {
-            const row = await MemberModel.query()
+            const row = await ctx.MemberModel.query()
                 .where('organization_id', orgId)
                 .where('account_id', accountId)
                 .first();
@@ -236,7 +239,7 @@ export function buildOrganizations(ctx) {
                 return { ok: false, reason: 'not_found' };
             // Invariante: não rebaixa o último owner
             if (row.role === 'owner' && newRole !== 'owner') {
-                const ownerCount = await countOwners(MemberModel, orgId);
+                const ownerCount = await countOwners(ctx.MemberModel, orgId);
                 if (ownerCount <= 1)
                     return { ok: false, reason: 'last_owner' };
             }
@@ -245,7 +248,7 @@ export function buildOrganizations(ctx) {
             return { ok: true };
         },
         async getOrgMembership(orgId, accountId) {
-            const row = await MemberModel.query()
+            const row = await ctx.MemberModel.query()
                 .where('organization_id', orgId)
                 .where('account_id', accountId)
                 .first();
@@ -256,7 +259,7 @@ export function buildOrganizations(ctx) {
             const token = randomBytes(32).toString('hex');
             const tokenHash = createHash('sha256').update(token).digest('hex');
             const expiresAt = DateTime.now().plus({ hours: input.ttlHours });
-            const inv = await InvitationModel.create({
+            const inv = await ctx.InvitationModel.create({
                 id: randomUUID(),
                 organizationId: input.organizationId,
                 email: input.email,
@@ -269,21 +272,21 @@ export function buildOrganizations(ctx) {
             return { invitation: toOrgInvitation(inv), token };
         },
         async findInvitationByTokenHash(tokenHash) {
-            const row = await InvitationModel.query().where('token_hash', tokenHash).first();
+            const row = await ctx.InvitationModel.query().where('token_hash', tokenHash).first();
             return row ? toOrgInvitation(row) : null;
         },
         async listPendingInvitationsForOrg(orgId) {
-            const rows = await InvitationModel.query()
+            const rows = await ctx.InvitationModel.query()
                 .where('organization_id', orgId)
                 .whereNull('accepted_at');
             return rows.map(toOrgInvitation);
         },
         async listPendingInvitationsForEmail(email) {
-            const rows = await InvitationModel.query().where('email', email).whereNull('accepted_at');
+            const rows = await ctx.InvitationModel.query().where('email', email).whereNull('accepted_at');
             return rows.map(toOrgInvitation);
         },
         async acceptInvitation(invitationId, accountId) {
-            const inv = await InvitationModel.find(invitationId);
+            const inv = await ctx.InvitationModel.find(invitationId);
             if (!inv)
                 return { ok: false, reason: 'not_found' };
             // Verifica expiração (expiresAt pode ser DateTime Luxon, Date, ou string do SQLite)
@@ -311,7 +314,7 @@ export function buildOrganizations(ctx) {
                 return { ok: false, reason: 'email_mismatch' };
             }
             // Verifica se já é membro
-            const existing = await MemberModel.query()
+            const existing = await ctx.MemberModel.query()
                 .where('organization_id', inv.organizationId)
                 .where('account_id', accountId)
                 .first();
@@ -323,7 +326,7 @@ export function buildOrganizations(ctx) {
             }
             // Cria membership + marca accepted_at
             const { randomUUID } = await import('node:crypto');
-            await MemberModel.create({
+            await ctx.MemberModel.create({
                 id: randomUUID(),
                 organizationId: inv.organizationId,
                 accountId,
@@ -337,7 +340,7 @@ export function buildOrganizations(ctx) {
             // Escopado por org: exige que o convite pertença à org informada antes de
             // deletar. Sem esse filtro, um owner/admin de qualquer org revogaria
             // convites de outra org sabendo apenas o invitationId (IDOR cross-org).
-            const inv = await InvitationModel.query()
+            const inv = await ctx.InvitationModel.query()
                 .where('id', invitationId)
                 .where('organization_id', organizationId)
                 .first();
@@ -348,7 +351,7 @@ export function buildOrganizations(ctx) {
         },
         async removeAccountFromAllOrgs(accountId) {
             // Memberships: remove todas, mesmo se for único owner (LGPD não pode bloquear)
-            const memberships = await MemberModel.query().where('account_id', accountId);
+            const memberships = await ctx.MemberModel.query().where('account_id', accountId);
             for (const m of memberships) {
                 await m.delete();
             }
@@ -356,7 +359,7 @@ export function buildOrganizations(ctx) {
             const email = await findAccountEmail(accountId);
             let invCount = 0;
             if (email) {
-                const invitations = await InvitationModel.query()
+                const invitations = await ctx.InvitationModel.query()
                     .where('email', email)
                     .whereNull('accepted_at');
                 for (const inv of invitations) {

package/build/src/accounts/lucid_store/shared.d.ts

@@ -78,6 +78,12 @@ export interface LucidStoreContext {
      * recovery da conta. Ver nota de `emailVerificationTtlHours`.
      */
     emailChangeTtlHours?: number;
+    /**
+     * Query client for AuthKit's own tables (`auth_mfa`, `auth_password_history`):
+     * `schema.connection` of `defineConfig`, NOT the account model's connection. Absent
+     * → the model's connection (a store used without `defineConfig`).
+     */
+    tablesClient?: () => any;
 }
 export declare const sha256: (value: string) => string;
 /** Recovery code legível: 10 chars hex em duas metades (ex.: a1b2c-3d4e5). */
@@ -105,15 +111,17 @@ export interface MfaStatePatch {
 }
 /**
  * Repositório do estado de MFA na tabela LIB-OWNED `auth_mfa`, keyed por
- * `account_id`. Acessa o banco pela CONEXÃO do próprio model (`Model.query().client`),
- * a mesma usada pelo restante do store — sem exigir migration no host.
+ * `account_id`. Acessa o banco pela conexão das tabelas do authkit
+ * (`schema.connection`, via `tablesClient`), a mesma em que o `autoManage` cria a
+ * tabela — sem exigir migration no host. Sem `tablesClient` (store fora do
+ * `defineConfig`), cai na conexão do model.
  *
  * O `upsert` é portável (sqlite + pg sem UPSERT nativo): tenta UPDATE pela PK;
  * se não afetou nenhuma linha, faz INSERT. `recovery_codes` é serializado como
  * JSON (string) na escrita e desserializado na leitura (aceita tanto string —
  * sqlite/text — quanto array já parseado — pg jsonb).
  */
-export declare function buildMfaStateRepo(Model: any): {
+export declare function buildMfaStateRepo(Model: any, tablesClient?: () => any): {
     /** Lê o estado de MFA da conta; null se não há linha em `auth_mfa`. */
     read(accountId: string): Promise<MfaState | null>;
     /**

package/build/src/accounts/lucid_store/shared.js

@@ -39,19 +39,21 @@ export function hashesEqual(a, b) {
 }
 /**
  * Repositório do estado de MFA na tabela LIB-OWNED `auth_mfa`, keyed por
- * `account_id`. Acessa o banco pela CONEXÃO do próprio model (`Model.query().client`),
- * a mesma usada pelo restante do store — sem exigir migration no host.
+ * `account_id`. Acessa o banco pela conexão das tabelas do authkit
+ * (`schema.connection`, via `tablesClient`), a mesma em que o `autoManage` cria a
+ * tabela — sem exigir migration no host. Sem `tablesClient` (store fora do
+ * `defineConfig`), cai na conexão do model.
  *
  * O `upsert` é portável (sqlite + pg sem UPSERT nativo): tenta UPDATE pela PK;
  * se não afetou nenhuma linha, faz INSERT. `recovery_codes` é serializado como
  * JSON (string) na escrita e desserializado na leitura (aceita tanto string —
  * sqlite/text — quanto array já parseado — pg jsonb).
  */
-export function buildMfaStateRepo(Model) {
+export function buildMfaStateRepo(Model, tablesClient) {
     const TABLE = 'auth_mfa';
-    /** QueryClient ligado à conexão do model (equivale ao `db` do password_history). */
+    /** QueryClient das tabelas do authkit (equivale ao `db` do password_history). */
     function client() {
-        return Model.query().client;
+        return tablesClient ? tablesClient() : Model.query().client;
     }
     /** Normaliza `recovery_codes` vindo do banco (json string OU array já parseado). */
     function parseRecoveryCodes(raw) {

package/build/src/accounts/lucid_store/webauthn.js

@@ -8,7 +8,7 @@ export function buildWebauthn(ctx, Credential, webauthn, ceremonies) {
     const { Model } = ctx;
     // Estado de MFA é LIB-OWNED (tabela `auth_mfa`): registrar uma passkey habilita
     // o MFA gravando `mfa_enabled_at` em `auth_mfa`, não numa coluna do model.
-    const mfaState = buildMfaStateRepo(Model);
+    const mfaState = buildMfaStateRepo(Model, ctx.tablesClient);
     return {
         async generatePasskeyRegistrationOptions(accountId) {
             const row = await Model.find(accountId);

package/build/src/adapters/factory.d.ts

@@ -1,8 +1,16 @@
 import type { ApplicationService } from '@adonisjs/core/types';
 import type { OidcAdapter } from './adapter_contract.js';
 export type OidcAdapterClass = new (name: string) => OidcAdapter;
+/** What `defineConfig` hands every adapter factory. */
+export interface AdapterResolveContext {
+    /**
+     * `schema.connection` of `defineConfig`: the Lucid connection AuthKit's tables live
+     * on. A database adapter without its own `connection` uses it.
+     */
+    connection?: string;
+}
 export interface AdapterFactory {
-    resolver(app: ApplicationService): Promise<OidcAdapterClass>;
+    resolver(app: ApplicationService, context?: AdapterResolveContext): Promise<OidcAdapterClass>;
 }
 /**
  * Modelos do oidc-provider de vida curta, amarrados ao ciclo da sessão de
@@ -35,7 +43,10 @@ export interface RedisAdapterConfig {
     prefix?: string;
 }
 export interface DatabaseAdapterConfig {
-    /** nome da conexão Lucid (default: a primária) */
+    /**
+     * Nome da conexão Lucid. Default: `schema.connection` do `defineConfig` (a conexão
+     * de todas as tabelas do authkit), e sem ela a primária.
+     */
     connection?: string;
 }
 export declare const adapters: {

package/build/src/adapters/factory.js

@@ -67,9 +67,9 @@ export const adapters = {
      */
     database(config = {}) {
         return {
-            async resolver(app) {
+            async resolver(app, context) {
                 const db = await app.container.make('lucid.db');
-                const connection = config.connection;
+                const connection = config.connection ?? context?.connection;
                 const conn = connection ? db.connection(connection) : db;
                 return class extends DatabaseAdapter {
                     constructor(name) {

package/build/src/commands/expire_scan_command.js

@@ -54,7 +54,7 @@ export async function runExpireScan(app, opts) {
     let runtimeSettings = null;
     try {
         const db = await app.container.make('lucid.db');
-        const connection = accountStore?.connectionName;
+        const connection = cfg.schema?.connection;
         runtimeSettings = new RuntimeSettings(db, connection ? { connection } : {});
     }
     catch {

package/build/src/commands/settings_commands.js

@@ -131,11 +131,11 @@ function validateKnownKey(key, value) {
 async function resolveSettingsService(app) {
     try {
         const db = await app.container.make('lucid.db');
-        // Tenta derivar a conexão do accountStore para probe searchPath-aware.
+        // `auth_settings` vive na conexão das tabelas do authkit (`schema.connection`).
         let connection;
         try {
             const cfg = await resolveCfg(app);
-            connection = cfg?.accountStore?.connectionName;
+            connection = cfg?.schema?.connection;
         }
         catch {
             // Silencioso: sem config → default connection.

package/build/src/define_config.d.ts

@@ -1190,7 +1190,10 @@ export interface AuthServerConfigInput {
      *   adiciona colunas novas (aditivo — nunca dropa nem altera tipos).
      * - `autoManage: false`: nada roda no boot; gerencie o schema você mesmo —
      *   de preferência chamando `ensureAuthkitSchema(this.db)` numa migration.
-     * - `connection`: conexão Lucid a usar (default: primária).
+     * - `connection`: a conexão Lucid de TODAS as tabelas do authkit (default:
+     *   primária) — as acima, o `authkit_keystore`, as de extensions e a do
+     *   `adapters.database()`/keystore `lucid` quando eles não declaram a própria.
+     *   A tabela da conta NÃO entra: fica na conexão do model da conta.
      */
     schema?: {
         autoManage?: boolean;

package/build/src/define_config.js

@@ -17,6 +17,7 @@ import { loadEncryptionService } from './keys/keystore_crypto.js';
 import { KeystoreManager, resolveKeystoreVault } from './keys/keystore_manager.js';
 import { mcpClientRegistration, resolveMcpOAuth, } from './mcp/mcp_oauth.js';
 import { OPEN_REGISTRATION_REDIRECT_POLICY, resolveRedirectUriPolicy, } from './provider/registration_policy.js';
+import { bindTablesLocation } from './schema/tables_location.js';
 import { resolveServiceTenants, } from './service_tenants/config.js';
 export { adapters };
 const RATE_LIMIT_DEFAULTS = {
@@ -284,15 +285,20 @@ export function defineConfig(config) {
         (!Number.isInteger(requiredFactors) || requiredFactors < 2 || requiredFactors > 8)) {
         throw new Error('mfa.requiredFactors must be an integer between 2 and 8');
     }
+    // Toda tabela do AuthKit vive em `schema.connection` — inclusive as que o store da
+    // conta lê (auth_mfa, auth_password_history, organizations), que antes seguiam a
+    // conexão do model da conta.
+    bindTablesLocation(config.accountStore, { connection: config.schema?.connection });
     return configProvider.create(async (app) => {
-        const AdapterClass = await config.adapter.resolver(app);
+        const tablesContext = { connection: config.schema?.connection };
+        const AdapterClass = await config.adapter.resolver(app, tablesContext);
         // `session.adapter` ausente ⇒ mesma classe do default (back-compat: o
         // dispatcher vira identidade e tudo continua no adapter único de hoje).
         const SessionAdapterClass = config.session?.adapter
-            ? await config.session.adapter.resolver(app)
+            ? await config.session.adapter.resolver(app, tablesContext)
             : AdapterClass;
         // `jwks: 'auto'` → resolve env-aware: AUTHKIT_JWKS inline, senão managed em arquivo.
-        const jwksConfig = config.jwks === 'auto'
+        const jwksInput = config.jwks === 'auto'
             ? process.env.AUTHKIT_JWKS
                 ? {
                     source: 'jwks',
@@ -304,6 +310,14 @@ export function defineConfig(config) {
                     store: 'tmp/authkit_jwks.json',
                 }
             : config.jwks;
+        // Keystore no Lucid sem conexão própria fica na conexão das tabelas do authkit.
+        const jwksStore = jwksInput.store;
+        const jwksConfig = jwksStore?.driver === 'lucid' && !jwksStore.connection && config.schema?.connection
+            ? {
+                ...jwksInput,
+                store: { ...jwksStore, connection: config.schema.connection },
+            }
+            : jwksInput;
         if (config.jwks === 'auto' && !process.env.AUTHKIT_JWKS) {
             const warning = jwksAutoFallbackWarning(jwksConfig.store ?? null);
             if (warning) {

package/build/src/doctor/checks.js

@@ -553,8 +553,8 @@ export function checkSettings(input) {
         // Table absent — opt-in feature, silently ok.
         return null;
     }
-    // Informa a conexão usada quando nomeada (ajuda a diagnosticar bugs de searchPath).
-    const connectionName = cfg.accountStore?.connectionName;
+    // Informa a conexão usada quando nomeada (a das tabelas do authkit).
+    const connectionName = cfg.schema?.connection;
     const connectionHint = connectionName ? ` (connection: '${connectionName}')` : '';
     // Table present — check if botProtection.verify is configured.
     const hasBotVerify = typeof cfg.botProtection?.verify === 'function';

package/build/src/host/runtime_settings.d.ts

@@ -92,10 +92,10 @@ export interface RuntimeSettingsOptions {
     /** TTL do cache em ms. Default: 15_000 (15s). */
     ttlMs?: number;
     /**
-     * Nome da conexão Lucid a usar (ex.: 'auth'). Quando presente, todas as
-     * queries usam `db.connection(name)` em vez da conexão default. Necessário
-     * quando o schema de auth vive numa conexão nomeada com searchPath próprio.
-     * Ausente (ou undefined) → conexão default (back-compat total).
+     * Nome da conexão Lucid a usar (ex.: 'auth') — a `schema.connection` do
+     * `defineConfig`, onde vivem as tabelas do authkit. Quando presente, todas as
+     * queries usam `db.connection(name)` em vez da conexão default.
+     * Ausente (ou undefined) → conexão default.
      */
     connection?: string;
 }
@@ -171,8 +171,8 @@ export declare class RuntimeSettings implements SettingsCapability {
  *
  * Esta fábrica SUBSTITUI ~16 cópias do mesmo bloco db/connection que viviam sob
  * nomes distintos (`getRuntimeSettings`, `getSettingsService`,
- * `getRuntimeSettingsForSudo`) e elimina o cast `as any` (via `connectionName`
- * tipado em {@link AccountStore}).
+ * `getRuntimeSettingsForSudo`). A conexão é `schema.connection`, a de todas as
+ * tabelas do authkit.
  *
  * @example
  * ```ts

package/build/src/host/runtime_settings.js

@@ -312,8 +312,8 @@ export class RuntimeSettings {
  *
  * Esta fábrica SUBSTITUI ~16 cópias do mesmo bloco db/connection que viviam sob
  * nomes distintos (`getRuntimeSettings`, `getSettingsService`,
- * `getRuntimeSettingsForSudo`) e elimina o cast `as any` (via `connectionName`
- * tipado em {@link AccountStore}).
+ * `getRuntimeSettingsForSudo`). A conexão é `schema.connection`, a de todas as
+ * tabelas do authkit.
  *
  * @example
  * ```ts
@@ -325,7 +325,8 @@ export async function resolveRuntimeSettings(ctx) {
     try {
         const db = await ctx.containerResolver.make('lucid.db');
         const service = await ctx.containerResolver.make('authkit.server').catch(() => null);
-        const connection = service?.config?.accountStore?.connectionName;
+        // `auth_settings` vive na conexão das tabelas do authkit, não na do model da conta.
+        const connection = service?.config?.schema?.connection;
         return new RuntimeSettings(db, connection ? { connection } : {});
     }
     catch {

package/build/src/schema/ensure.d.ts

@@ -25,8 +25,17 @@
  */
 import type { AuthkitTable } from '../agents/extension.js';
 export interface EnsureSchemaOptions {
-    /** Conexão Lucid a usar. Default: conexão primária. */
+    /**
+     * Conexão Lucid das tabelas do authkit (`schema.connection`). Default: conexão
+     * primária. Ignorada quando `db` já é um client (o `this.db` de uma migration).
+     */
     connection?: string;
+    /**
+     * Conexão Lucid do model da conta, onde vive a tabela da conta (a coluna
+     * `login_methods`). Default: a conexão primária — NÃO a das tabelas do authkit.
+     * O provider passa a do `accountStore` no boot. Ignorada quando `db` já é um client.
+     */
+    accountConnection?: string;
     /**
      * Tabelas de `personalAgents.extensions` (`tables` de cada uma), garantidas junto. O provider
      * passa as do config no boot.

package/build/src/schema/ensure.js

@@ -23,6 +23,7 @@
  * }
  * ```
  */
+import { authkitTablesClient } from './tables_location.js';
 /** Busca por conta (`account_id`) e limpeza dos expirados (`expires_at`). */
 const OIDC_PAYLOAD_INDEXES = [
     { name: 'authkit_oidc_payloads_account_idx', columns: ['model_name', 'account_id'] },
@@ -500,11 +501,7 @@ async function ensureTables(conn, tables, report) {
  * uma extension expor o próprio `ensure*Schema()` para migrations do host. Estável no 1.x.
  */
 export async function ensureAuthkitTables(db, tables, options = {}) {
-    const conn = typeof db.connection !== 'function'
-        ? db
-        : options.connection
-            ? db.connection(options.connection)
-            : db.connection();
+    const conn = authkitTablesClient(db, { connection: options.connection });
     const report = {
         created: [],
         altered: {},
@@ -521,11 +518,7 @@ export async function ensureAuthkitTables(db, tables, options = {}) {
  * (`this.db`, um `QueryClient`/`TransactionClient`, usado como está).
  */
 export async function ensureAuthkitSchema(db, options = {}) {
-    const conn = typeof db.connection !== 'function'
-        ? db
-        : options.connection
-            ? db.connection(options.connection)
-            : db.connection();
+    const conn = authkitTablesClient(db, { connection: options.connection });
     const report = {
         created: [],
         altered: {},
@@ -547,11 +540,15 @@ export async function ensureAuthkitSchema(db, options = {}) {
     // `users` fixo: com a conta em `auth_users` (o nome que o próprio scaffold da
     // lib usa), o `users` fixo acertava uma tabela qualquer de mesmo nome e a
     // coluna ia parar no lugar errado sem erro nenhum.
+    //
+    // A tabela da conta fica na conexão do MODEL da conta, não na das tabelas do
+    // authkit (`schema.connection`).
     const accountTable = options.accountTable ?? 'users';
-    if (await tableExists(conn, accountTable)) {
+    const accountConn = authkitTablesClient(db, { connection: options.accountConnection });
+    if (await tableExists(accountConn, accountTable)) {
         try {
-            if (!(await columnExists(conn, accountTable, 'login_methods'))) {
-                await conn.schema.alterTable(accountTable, (t) => {
+            if (!(await columnExists(accountConn, accountTable, 'login_methods'))) {
+                await accountConn.schema.alterTable(accountTable, (t) => {
                     t.jsonb('login_methods').nullable();
                 });
                 report.altered[accountTable] = ['login_methods'];
@@ -568,7 +565,7 @@ export async function ensureAuthkitSchema(db, options = {}) {
              * o boot não avisava nada — o silêncio que este bloco existe para acabar.
              * (Mesma semântica do probe de `createTable` logo acima.)
              */
-            if (await columnExists(conn, accountTable, 'login_methods')) {
+            if (await columnExists(accountConn, accountTable, 'login_methods')) {
                 report.loginMethods.ensured = true;
             }
             else {

package/build/src/schema/tables_location.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Where AuthKit's OWN tables live (`auth_settings`, `auth_mfa`, `auth_password_history`,
+ * the organization tables, `authkit_oidc_payloads`, the personal-agent tables, the
+ * `authkit_keystore` of the Lucid keystore, and the tables of agent extensions).
+ *
+ * The rule: every lib-owned table goes through `schema.connection` of `defineConfig`
+ * (default: the primary Lucid connection). The app's account table is not lib-owned: it
+ * stays on the account model's connection (`static connection` of the model).
+ */
+export interface AuthkitTablesLocation {
+    /** Lucid connection name. `undefined` = the primary connection. */
+    connection?: string;
+}
+/**
+ * The query client for AuthKit's tables. `db` is the Lucid manager (`Database`) or a
+ * client the caller already holds (a migration's `this.db`, a transaction), which is
+ * used as is.
+ */
+export declare function authkitTablesClient(db: any, location?: AuthkitTablesLocation): any;
+/**
+ * Hidden hook a store built by `lucidAccountStore` exposes so `defineConfig` can tell it
+ * where AuthKit's tables live (the store is built before `defineConfig` sees the `schema`
+ * option). Not part of the `AccountStore` contract.
+ */
+export declare const BIND_TABLES_LOCATION: unique symbol;
+/** Hands `location` to a store that accepts it (see {@link BIND_TABLES_LOCATION}). */
+export declare function bindTablesLocation(store: unknown, location: AuthkitTablesLocation): void;

package/build/src/schema/tables_location.js

@@ -0,0 +1,22 @@
+/**
+ * The query client for AuthKit's tables. `db` is the Lucid manager (`Database`) or a
+ * client the caller already holds (a migration's `this.db`, a transaction), which is
+ * used as is.
+ */
+export function authkitTablesClient(db, location = {}) {
+    if (typeof db?.connection !== 'function')
+        return db;
+    return location.connection ? db.connection(location.connection) : db.connection();
+}
+/**
+ * Hidden hook a store built by `lucidAccountStore` exposes so `defineConfig` can tell it
+ * where AuthKit's tables live (the store is built before `defineConfig` sees the `schema`
+ * option). Not part of the `AccountStore` contract.
+ */
+export const BIND_TABLES_LOCATION = Symbol.for('authkit.bindTablesLocation');
+/** Hands `location` to a store that accepts it (see {@link BIND_TABLES_LOCATION}). */
+export function bindTablesLocation(store, location) {
+    const bind = store?.[BIND_TABLES_LOCATION];
+    if (typeof bind === 'function')
+        bind(location);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.10",
+  "version": "1.0.0-rc.11",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",