@adonis-agora/authkit-server 1.0.0-rc.10 → 1.0.0-rc.12

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.12
+
+### Minor Changes
+
+- [#474](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/474) [`df9e49d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/df9e49d7817c03a7cce4cac1df709c7788d6307c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - AuthKit's tables can live in their own database schema: `schema: { name: 'auth' }` in `defineConfig` puts every table AuthKit owns in `auth` (`"auth"."auth_settings"`) while the app stays in `public`. The schema is written into every statement, so it works on any connection and inside the app's own transaction, with no `searchPath` (which leaks across clients behind PgBouncer in transaction mode).
+  
+  - The boot creates the schema (`CREATE SCHEMA IF NOT EXISTS`; MySQL: `CREATE DATABASE IF NOT EXISTS`) when `autoManage` is on, and fails with a message naming the schema and the grant when the role cannot create it. `ensureAuthkitSchema(db, { schema })` does the same from a migration.
+  - Covers the OIDC adapter table (`adapters.database({ schema })` overrides), the Lucid keystore (`jwks.store: { driver: 'lucid', schema }` overrides), the account store's tables (MFA, password history, organizations), runtime settings, session revocations, the personal-agent tables and agent extensions (`PersonalAgentHost.table(name)`, `AuthkitTable.create(table, { table })`, `ensureAuthkitTables(db, tables, { schema })`; Poppy uses them and `ensurePoppySchema(db, { schema })`).
+  - authkit-client: `lucidRevocationStore({ schema })`.
+  - SQLite with `schema.name` fails the boot instead of ignoring the option.
+  - `agora:doctor` gains `authkit.db-schema`: the schema exists, the tables are in it, the connection can write there. Silent without `schema.name`.
+  - The key-rotation lock key includes the schema, so two installs in two schemas of one database do not share it.
+  
+  Without `schema.name` nothing changes.
+
+### Patch Changes
+
+- Updated dependencies [[`df9e49d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/df9e49d7817c03a7cce4cac1df709c7788d6307c)]:
+  - @adonis-agora/authkit-core@1.0.0-rc.2
+
+## 1.0.0-rc.11
+
+### Patch Changes
+
+- [#473](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/473) [`427c4a3`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/427c4a301907dc78d8e7c5405d4e73e29b8a2be4) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Every table AuthKit owns now uses one Lucid connection: `schema.connection` (default: the primary connection). Before, some of them followed other connections, so with the account model on a named connection the boot created a table on one connection and the code read it on another:
+  
+  - `auth_settings` (runtime settings, the settings CLI, `authkit:expire-scan`, the SDK's embedded driver) followed the account model's connection.
+  - `auth_mfa` and `auth_password_history` used the account model's connection.
+  - The built-in organization models had no connection, so they always used the primary one.
+  - `adapters.database()` and the `lucid` keystore without their own `connection` used the primary connection.
+  
+  They all use `schema.connection` now; `adapters.database({ connection })` and `jwks.store: { driver: 'lucid', connection }` still win when set. The app's account table stays on the account model's connection, and the boot adds the `login_methods` column there. If your app had `schema.connection` unset and the account model on a named connection, those tables move to the primary connection: set `schema.connection` to the connection where they already are.
+
 ## 1.0.0-rc.10
 
 ### Minor Changes

package/README.md

@@ -119,7 +119,7 @@ router.post('/auth/interaction/:uid/consent', [AuthInteractionController, 'conse
 
 Escolha o backend no `config/authkit.ts`:
 - `adapters.redis({ connection })` — requer `@adonisjs/redis` configurado.
-- `adapters.database({ connection? })` — Lucid; tabela `authkit_oidc_payloads`, criada pelo `ensureAuthkitSchema` no boot (com `schema: { autoManage: false }`, chame-o numa migração). A coluna indexada `account_id` mantém as buscas e revogações por conta em SQL; linhas antigas com `account_id` NULL continuam sendo encontradas. Postgres, MySQL e SQLite.
+- `adapters.database({ connection?, schema? })` — Lucid (default: `schema.connection`/`schema.name` do `defineConfig`); tabela `authkit_oidc_payloads`, criada pelo `ensureAuthkitSchema` no boot (com `schema: { autoManage: false }`, chame-o numa migração). A coluna indexada `account_id` mantém as buscas e revogações por conta em SQL; linhas antigas com `account_id` NULL continuam sendo encontradas. Postgres, MySQL e SQLite.
 
 ## Observabilidade
 

package/build/index.d.ts

@@ -15,7 +15,7 @@ export type { PersonalAgentIdentity } from './src/agents/agent_identity.js';
 export { PersonalAgentVerifier } from './src/agents/agent_identity.js';
 export type { PersonalAgentDelegationConfigInput, PersonalAgentRegistration, PersonalAgentResolver, PersonalAgentsConfigInput, ResolvedPersonalAgentsConfig, } from './src/agents/config.js';
 export type { DelegationContext, DelegationGrantSummary, DelegationReceipt, } from './src/agents/delegation_service.js';
-export type { AuthkitTable, PersonalAgentAccessTokens, PersonalAgentConsoleSummary, PersonalAgentExtension, PersonalAgentExtensionContext, PersonalAgentExtensionDefinition, PersonalAgentGrant, PersonalAgentGrantLedger, PersonalAgentGrantSummary, PersonalAgentHost, PersonalAgentProtocolRuntime, PersonalAgentRefreshToken, PersonalAgentRouteKit, ResolvedPersonalAgentExtension, } from './src/agents/extension.js';
+export type { AuthkitTable, AuthkitTableContext, PersonalAgentAccessTokens, PersonalAgentConsoleSummary, PersonalAgentExtension, PersonalAgentExtensionContext, PersonalAgentExtensionDefinition, PersonalAgentGrant, PersonalAgentGrantLedger, PersonalAgentGrantSummary, PersonalAgentHost, PersonalAgentProtocolRuntime, PersonalAgentRefreshToken, PersonalAgentRouteKit, ResolvedPersonalAgentExtension, } from './src/agents/extension.js';
 export type { PersonalAgentAuthOptions, PersonalAgentRequestContext, } from './src/agents/middleware.js';
 export { personalAgentAuth, personalAgentOf, personalAgentReceipt, personalAgentSecurity, personalAgentStepUp, } from './src/agents/middleware.js';
 export type { BuiltinProtocolId, PactOptions, PersonalAgentProtocol, } from './src/agents/protocol.js';
@@ -160,6 +160,7 @@ export { checkClientRegistration, classifyRedirect, type RedirectUriPolicy, type
 export { registerOidcRoutes } from './src/register_routes.js';
 export type { EnsureSchemaOptions, EnsureSchemaReport } from './src/schema/ensure.js';
 export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
+export { AuthkitSchemaError } from './src/schema/tables_location.js';
 export type { ServiceTenantInfo } from './src/service_tenants/client_metadata.js';
 export type { ResolvedServiceTenantResource, ResolvedServiceTenantsConfig, ServiceTenantResourceInput, ServiceTenantsConfigInput, } from './src/service_tenants/config.js';
 export { AuthkitTenantVerifier, type AuthkitTenantVerifierFn, type AuthkitTenantVerifierOptions, authkitTenantVerifier, type TenantTokenIssuer, type TenantVerifierInput, type VerifiedTenant, } from './src/service_tenants/tenant_verifier.js';

package/build/index.js

@@ -137,6 +137,7 @@ export { OidcService } from './src/provider/oidc_service.js';
 export { checkClientRegistration, classifyRedirect, RegistrationPolicyError, } from './src/provider/registration_policy.js';
 export { registerOidcRoutes } from './src/register_routes.js';
 export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
+export { AuthkitSchemaError } from './src/schema/tables_location.js';
 export { AuthkitTenantVerifier, authkitTenantVerifier, } from './src/service_tenants/tenant_verifier.js';
 export { authkitTenantLabels, } from './src/tenancy/tenant_labels.js';
 export { stubsRoot } from './stubs/main.js';

package/build/providers/authkit_server_provider.js

@@ -22,7 +22,7 @@ import { authkitDoctorChecks } from '../src/doctor/agora_checks.js';
 import { registerDoctorChecks } from '../src/doctor/agora_doctor.js';
 import { resolveAppKey } from '../src/host/app_key.js';
 import { resolveEffectiveKeyRotation } from '../src/host/key_rotation.js';
-import { RuntimeSettings } from '../src/host/runtime_settings.js';
+import { RuntimeSettings, settingsLocation } from '../src/host/runtime_settings.js';
 import { KeystoreCodec } from '../src/keys/keystore_codec.js';
 import { loadEncryptionService } from '../src/keys/keystore_crypto.js';
 import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
@@ -30,6 +30,7 @@ import { KeyRotationScheduler } from '../src/provider/key_rotation_scheduler.js'
 import { KeystoreReloadPoller } from '../src/provider/keystore_reload.js';
 import { OidcService } from '../src/provider/oidc_service.js';
 import { makeSingleFlightLock } from '../src/provider/single_flight_lock.js';
+import { AuthkitSchemaError } from '../src/schema/tables_location.js';
 export default class AuthkitServerProvider {
     app;
     constructor(app) {
@@ -286,7 +287,9 @@ export default class AuthkitServerProvider {
             const { ensureAuthkitSchema } = await import('../src/schema/ensure.js');
             const report = await ensureAuthkitSchema(db, {
                 connection: config.schema.connection,
+                schema: config.schema.name,
                 accountTable: config.accountStore?.accountTable,
+                accountConnection: config.accountStore?.connectionName,
                 tables: config.personalAgents?.extensions?.flatMap((e) => e.tables ?? []),
             });
             const logger = await this.app.container.make('logger').catch(() => null);
@@ -305,6 +308,10 @@ export default class AuthkitServerProvider {
             }
         }
         catch (error) {
+            // `schema.name` que o banco não aceita (SQLite, schema que o role não pode criar):
+            // derruba o boot com a mensagem — nunca segue com tabelas fora do schema pedido.
+            if (error instanceof AuthkitSchemaError)
+                throw error;
             const logger = await this.app.container.make('logger').catch(() => null);
             logger?.warn({ err: error }, 'authkit: schema auto-manage failed — features degrade gracefully; ' +
                 'run ensureAuthkitSchema() in a migration or fix DB connectivity');
@@ -364,10 +371,15 @@ export default class AuthkitServerProvider {
                 .resolve(this.app, value)
                 .catch(() => null))
             : null;
-        const connection = config?.schema?.connection;
         // RuntimeSettings sem request (mesmo padrão de expire_scan_command / security_notice_service).
-        const settings = new RuntimeSettings(db, connection ? { connection } : {});
-        const withLock = makeSingleFlightLock({ key: 'authkit:keys:rotate', ttlMs: 5 * 60_000 });
+        const settings = new RuntimeSettings(db, settingsLocation(config));
+        // Com `schema.name`, a chave do lock leva o schema: duas instalações em schemas
+        // diferentes do mesmo banco não disputam o mesmo lock.
+        const schemaName = config?.schema?.name;
+        const withLock = makeSingleFlightLock({
+            key: schemaName ? `authkit:${schemaName}:keys:rotate` : 'authkit:keys:rotate',
+            ttlMs: 5 * 60_000,
+        });
         const scheduler = new KeyRotationScheduler({
             policy: () => resolveEffectiveKeyRotation(settings),
             ageDays: () => svc.keystoreAgeDays(),

package/build/src/accounts/account_store.d.ts

@@ -688,13 +688,13 @@ export declare function supportsOrganizations(store: AccountStore): store is Acc
  */
 export type AccountStore = CoreAccountStore & {
     /**
-     * Nome da conexão Lucid usada por este store (deriva de `Model.connection` no
-     * store default — ver `lucid_account_store.ts`). Quando presente, os call-sites
-     * de RuntimeSettings o repassam como `{ connection }` para que o probe da tabela
-     * `auth_settings` seja searchPath-aware (auth vivendo numa conexão/schema
-     * próprios). Undefined → conexão default (back-compat total). É metadado
-     * opcional, não um método de capacidade — por isso `readonly` e fora dos
-     * blocos `Partial<...>` de capacidades probáveis.
+     * Nome da conexão Lucid da tabela da CONTA (deriva de `Model.connection` no
+     * store default — ver `lucid_account_store.ts`). O boot a usa para garantir a
+     * coluna `login_methods` na tabela da conta. As tabelas do authkit
+     * (`auth_settings` etc.) NÃO seguem esta conexão: usam `schema.connection`.
+     * Undefined → conexão default. É metadado opcional, não um método de
+     * capacidade — por isso `readonly` e fora dos blocos `Partial<...>` de
+     * capacidades probáveis.
      */
     readonly connectionName?: string;
     /**

package/build/src/accounts/lucid_account_store.d.ts

@@ -150,9 +150,9 @@ export interface LucidAccountStoreOptions {
      *   `ensureAuthkitSchema`, então o mapeamento não é decisão do host.
      * - `true` → idêntico ao default (atalho explícito; é o que apps existentes
      *   já usam e continua valendo).
-     * - `{ OrgModel, MemberModel, InvitationModel }` → escape hatch, para quem
-     *   guarda as tabelas de auth numa conexão/schema próprios (os defaults não
-     *   declaram `static connection`).
+     * - `{ OrgModel, MemberModel, InvitationModel }` → escape hatch, para usar
+     *   models próprios do host; eles rodam na conexão que declaram. Os defaults
+     *   seguem `schema.connection`, como toda tabela lib-owned.
      * - `false` → opt-out explícito: `OrganizationsCapability` AUSENTE no store.
      *   Use quando a dependência atual é `supportsOrganizations === false` (ex.:
      *   store/rotas que assumem a ausência). O `authkit:doctor` avisa se

package/build/src/accounts/lucid_account_store.js

@@ -1,8 +1,9 @@
 import { PasswordManager } from '../password/password_manager.js';
+import { authkitTable, authkitTablesClient, BIND_TABLES_LOCATION, } from '../schema/tables_location.js';
 import { buildCore } from './lucid_store/core.js';
 import { buildLoginMethods, supportsLoginMethodsColumn } from './lucid_store/login_methods.js';
 import { buildMfa } from './lucid_store/mfa.js';
-import { defaultOrganizationModels } from './lucid_store/organization_models.js';
+import { defaultOrganizationModels, organizationModelsOn, } from './lucid_store/organization_models.js';
 import { buildOrganizations } from './lucid_store/organizations.js';
 import { buildPasswordExpiration, buildPasswordHistory } from './lucid_store/password_hygiene.js';
 import { buildProviderIdentity } from './lucid_store/provider_identity.js';
@@ -162,11 +163,23 @@ export function lucidAccountStore(Model, options = {}) {
     // opt-out explícito é `false`. O trio explícito segue como escape hatch.
     const orgModelsOption = options.organizationModels;
     const usesDefaultOrgModels = orgModelsOption === undefined || orgModelsOption === true;
-    const OrgModels = orgModelsOption === false
-        ? undefined
-        : usesDefaultOrgModels
-            ? defaultOrganizationModels
-            : orgModelsOption;
+    const explicitOrgModels = orgModelsOption === false || usesDefaultOrgModels ? undefined : orgModelsOption;
+    /**
+     * Onde vivem as tabelas do AuthKit (`schema.connection`). O `defineConfig` informa
+     * via {@link BIND_TABLES_LOCATION} — o store é construído antes de o config existir.
+     * `null` = ainda não informado (store usado fora do `defineConfig`): as tabelas
+     * lib-owned seguem a conexão do model e os models de org default, a primária.
+     */
+    let tablesLocation = null;
+    const tablesClient = () => {
+        const db = Model.$adapter?.db;
+        if (!tablesLocation || !db)
+            return Model.query().client;
+        return authkitTablesClient(db, tablesLocation);
+    };
+    const orgModels = () => explicitOrgModels ??
+        (tablesLocation ? organizationModelsOn(tablesLocation) : defaultOrganizationModels);
+    const OrgModels = orgModelsOption === false ? undefined : orgModels;
     // RP do WebAuthn: usado nas cerimônias. Default do rpName cai no mfaIssuer.
     const webauthn = options.webauthn ?? {
         rpName: mfaIssuer,
@@ -190,6 +203,8 @@ export function lucidAccountStore(Model, options = {}) {
         audit: options.audit,
         emailVerificationTtlHours: emailTokens.verificationTtlHours,
         emailChangeTtlHours: emailTokens.changeTtlHours,
+        tablesClient,
+        tableName: (name) => authkitTable(tablesLocation ?? undefined, name),
         // Encripta o segredo antes de persistir (no-op sem encrypter).
         sealSecret: (secret) => (encrypter ? encrypter.encrypt(secret) : secret),
         // Decripta o segredo armazenado; retorna null em falha/adulteração (no-op sem encrypter).
@@ -264,9 +279,15 @@ export function lucidAccountStore(Model, options = {}) {
                 // NÃO faz parte do contrato AccountStore.
                 __organizationModelsSource: usesDefaultOrgModels ? 'default' : 'explicit',
                 ...buildOrganizations({
-                    OrgModel: OrgModels.OrgModel,
-                    MemberModel: OrgModels.MemberModel,
-                    InvitationModel: OrgModels.InvitationModel,
+                    get OrgModel() {
+                        return OrgModels().OrgModel;
+                    },
+                    get MemberModel() {
+                        return OrgModels().MemberModel;
+                    },
+                    get InvitationModel() {
+                        return OrgModels().InvitationModel;
+                    },
                     findAccountEmail: async (accountId) => {
                         const row = await Model.find(accountId);
                         return row?.email ?? null;
@@ -292,11 +313,10 @@ export function lucidAccountStore(Model, options = {}) {
             }
         },
         /**
-         * Nome da conexão Lucid usada por este store (deriva de `Model.connection`).
-         * Exposto para que os call-sites de RuntimeSettings possam passar
-         * `{ connection: store.connectionName }` e usar a conexão correta.
-         * Undefined quando o model usa a conexão default (back-compat total).
-         * NÃO faz parte do contrato AccountStore.
+         * Nome da conexão Lucid do MODEL da conta (deriva de `Model.connection`) — onde
+         * vive a tabela da conta (e a coluna `login_methods`). As tabelas do authkit
+         * NÃO seguem esta conexão: elas usam `schema.connection`.
+         * Undefined quando o model usa a conexão default.
          */
         connectionName: Model.connection ?? undefined,
         /**
@@ -318,10 +338,16 @@ export function lucidAccountStore(Model, options = {}) {
         __model: Model,
     };
     // Histórico de senhas: tabela lib-owned `auth_password_history`, pela conexão
-    // do model (resolvida a cada uso, como no MFA).
+    // das tabelas do authkit (resolvida a cada uso, como no MFA).
     Object.assign(store, buildPasswordHistory(ctx, {
-        query: () => Model.query().client.query(),
-        table: (name) => Model.query().client.table(name),
+        query: () => tablesClient().query(),
+        table: (name) => tablesClient().table(name),
     }));
+    // Não-enumerável: o `defineConfig` informa `schema.connection` por aqui.
+    Object.defineProperty(store, BIND_TABLES_LOCATION, {
+        value: (location) => {
+            tablesLocation = { connection: location.connection, schema: location.schema };
+        },
+    });
     return store;
 }

package/build/src/accounts/lucid_store/mfa.js

@@ -8,8 +8,8 @@ import { buildMfaStateRepo, generateRecoveryCode, hashesEqual, sha256, } from '.
  * {@link ensureAuthkitSchema}), keyed por `account_id`. O host NÃO precisa migrar
  * nada e o model não declara colunas de MFA.
  *
- * Acesso ao banco via a CONEXÃO do próprio model (`Model.query().client`), a mesma
- * usada pelo restante do store. O `email` (para o keyuri/QR) continua vindo do
+ * Acesso ao banco pela conexão das tabelas do authkit (`schema.connection`), a
+ * mesma em que o `autoManage` cria `auth_mfa`. O `email` (para o keyuri/QR) continua vindo do
  * model principal — só o ESTADO de MFA migrou para `auth_mfa`.
  */
 /**
@@ -19,7 +19,7 @@ import { buildMfaStateRepo, generateRecoveryCode, hashesEqual, sha256, } from '.
 const TOTP_PERIOD = 30;
 export function buildMfa(ctx) {
     const { Model, mfaIssuer, recoveryCodeCount, sealSecret, openSecret } = ctx;
-    const repo = buildMfaStateRepo(Model);
+    const repo = buildMfaStateRepo(Model, ctx.tablesClient, ctx.tableName);
     return {
         async getMfaState(accountId) {
             const state = await repo.read(accountId);

package/build/src/accounts/lucid_store/organization_models.d.ts

@@ -10,10 +10,11 @@ import type { DateTime } from 'luxon';
  * pelo `autoManage` sem que o model escrito à mão no host saiba dela, e o
  * sintoma aparece longe da causa.
  *
- * Use com `organizationModels: true` em {@link lucidAccountStore}. O caminho
+ * Use com `organizationModels: true` em {@link lucidAccountStore}. Eles seguem a
+ * conexão e o schema das tabelas do authkit (`schema.connection`/`schema.name`
+ * do `defineConfig`, como todas as tabelas lib-owned — ver {@link organizationModelsOn}). O caminho
  * explícito (`{ OrgModel, MemberModel, InvitationModel }`) continua valendo como
- * escape hatch — é para quem guarda as tabelas de auth numa conexão/schema
- * próprios (`static connection = 'auth'`), que estes defaults não declaram.
+ * escape hatch; aí a conexão é a que os models do host declaram.
  *
  * Não crie migration para estas tabelas: elas são criadas/atualizadas pelo
  * `schema.autoManage` do authkit.
@@ -65,3 +66,17 @@ export declare const defaultOrganizationModels: {
     readonly MemberModel: typeof AuthOrganizationMember;
     readonly InvitationModel: typeof AuthOrganizationInvitation;
 };
+export type OrganizationModels = {
+    OrgModel: any;
+    MemberModel: any;
+    InvitationModel: any;
+};
+/**
+ * Os models default onde vivem as tabelas do authkit: subclasses com `static connection`
+ * (`schema.connection`) e `static table` qualificada (`schema.name`), memoizadas por
+ * local. Sem conexão nem schema → os próprios defaults (conexão primária).
+ */
+export declare function organizationModelsOn(location: {
+    connection?: string;
+    schema?: string;
+}): OrganizationModels;

package/build/src/accounts/lucid_store/organization_models.js

@@ -15,10 +15,11 @@ import { BaseModel, column } from '@adonisjs/lucid/orm';
  * pelo `autoManage` sem que o model escrito à mão no host saiba dela, e o
  * sintoma aparece longe da causa.
  *
- * Use com `organizationModels: true` em {@link lucidAccountStore}. O caminho
+ * Use com `organizationModels: true` em {@link lucidAccountStore}. Eles seguem a
+ * conexão e o schema das tabelas do authkit (`schema.connection`/`schema.name`
+ * do `defineConfig`, como todas as tabelas lib-owned — ver {@link organizationModelsOn}). O caminho
  * explícito (`{ OrgModel, MemberModel, InvitationModel }`) continua valendo como
- * escape hatch — é para quem guarda as tabelas de auth numa conexão/schema
- * próprios (`static connection = 'auth'`), que estes defaults não declaram.
+ * escape hatch; aí a conexão é a que os models do host declaram.
  *
  * Não crie migration para estas tabelas: elas são criadas/atualizadas pelo
  * `schema.autoManage` do authkit.
@@ -111,3 +112,34 @@ export const defaultOrganizationModels = {
     MemberModel: AuthOrganizationMember,
     InvitationModel: AuthOrganizationInvitation,
 };
+const modelsByLocation = new Map();
+/**
+ * Os models default onde vivem as tabelas do authkit: subclasses com `static connection`
+ * (`schema.connection`) e `static table` qualificada (`schema.name`), memoizadas por
+ * local. Sem conexão nem schema → os próprios defaults (conexão primária).
+ */
+export function organizationModelsOn(location) {
+    const { connection, schema } = location;
+    if (!connection && !schema)
+        return defaultOrganizationModels;
+    const key = `${connection ?? ''}\x00${schema ?? ''}`;
+    let models = modelsByLocation.get(key);
+    if (!models) {
+        const table = (name) => (schema ? `${schema}.${name}` : name);
+        class OrgModel extends AuthOrganization {
+            static table = table('auth_organizations');
+            static connection = connection;
+        }
+        class MemberModel extends AuthOrganizationMember {
+            static table = table('auth_organization_members');
+            static connection = connection;
+        }
+        class InvitationModel extends AuthOrganizationInvitation {
+            static table = table('auth_organization_invitations');
+            static connection = connection;
+        }
+        models = { OrgModel, MemberModel, InvitationModel };
+        modelsByLocation.set(key, models);
+    }
+    return models;
+}

package/build/src/accounts/lucid_store/organizations.d.ts

@@ -1,7 +1,7 @@
 import type { OrganizationsCapability } from '../account_store.js';
 /**
- * Contexto mínimo para o builder de organizations. Recebe os três models direto
- * (já construídos pelo lucidAccountStore).
+ * Contexto mínimo para o builder de organizations. Os três models são lidos a cada
+ * uso (podem ser getters — ver `lucidAccountStore`).
  */
 export interface OrgStoreContext {
     OrgModel: any;

package/build/src/accounts/lucid_store/organizations.js

@@ -59,7 +59,10 @@ async function countOwners(MemberModel, orgId) {
     return Number(result[0]?.$extras?.total ?? 0);
 }
 export function buildOrganizations(ctx) {
-    const { OrgModel, MemberModel, InvitationModel, findAccountEmail, listAccountIdsInAdminOrder } = ctx;
+    // Os models são lidos do ctx a CADA uso (não desestruturados): o `lucidAccountStore`
+    // troca os models default pelos da conexão das tabelas do authkit quando o
+    // `defineConfig` informa o `schema.connection`, depois de construir o store.
+    const { findAccountEmail, listAccountIdsInAdminOrder } = ctx;
     return {
         ...(listAccountIdsInAdminOrder
             ? {
@@ -73,7 +76,7 @@ export function buildOrganizations(ctx) {
                  * (like `listOrgMembers(orgId).length`).
                  */
                 async listAllOrgsWithMemberCount() {
-                    const memberships = await MemberModel.query();
+                    const memberships = await ctx.MemberModel.query();
                     if (memberships.length === 0)
                         return [];
                     const byAccount = new Map();
@@ -90,7 +93,7 @@ export function buildOrganizations(ctx) {
                     }
                     const accountIds = await listAccountIdsInAdminOrder([...byAccount.keys()]);
                     const orgs = new Map();
-                    for (const org of await findManyChunked(OrgModel, [...memberCount.keys()])) {
+                    for (const org of await findManyChunked(ctx.OrgModel, [...memberCount.keys()])) {
                         orgs.set(String(org.id), org);
                     }
                     const result = [];
@@ -117,7 +120,7 @@ export function buildOrganizations(ctx) {
             : {}),
         async createOrg(input) {
             const { randomUUID } = await import('node:crypto');
-            const org = await OrgModel.create({
+            const org = await ctx.OrgModel.create({
                 id: randomUUID(),
                 name: input.name,
                 slug: input.slug,
@@ -125,7 +128,7 @@ export function buildOrganizations(ctx) {
                 metadata: input.metadata ?? null,
             });
             // Cria a membership do owner automaticamente
-            await MemberModel.create({
+            await ctx.MemberModel.create({
                 id: randomUUID(),
                 organizationId: org.id,
                 accountId: input.ownerAccountId,
@@ -134,28 +137,28 @@ export function buildOrganizations(ctx) {
             return toOrgSummary(org);
         },
         async findOrgById(orgId) {
-            const row = await OrgModel.find(orgId);
+            const row = await ctx.OrgModel.find(orgId);
             return row ? toOrgSummary(row) : null;
         },
         async findOrgsByIds(orgIds) {
             const ids = [...new Set(orgIds)];
             if (ids.length === 0)
                 return [];
-            return (await findManyChunked(OrgModel, ids)).map(toOrgSummary);
+            return (await findManyChunked(ctx.OrgModel, ids)).map(toOrgSummary);
         },
         async findOrgBySlug(slug) {
-            const row = await OrgModel.query().where('slug', slug).first();
+            const row = await ctx.OrgModel.query().where('slug', slug).first();
             return row ? toOrgSummary(row) : null;
         },
         async listOrgsForAccount(accountId) {
-            const memberships = await MemberModel.query().where('account_id', accountId);
+            const memberships = await ctx.MemberModel.query().where('account_id', accountId);
             if (memberships.length === 0)
                 return [];
             // One query for every org (by primary key, like `find`), instead of one per
             // membership. The result keeps the memberships' order.
             const ids = [...new Set(memberships.map((m) => m.organizationId))];
             const orgs = new Map();
-            for (const org of await OrgModel.findMany(ids))
+            for (const org of await ctx.OrgModel.findMany(ids))
                 orgs.set(String(org.id), org);
             const result = [];
             for (const m of memberships) {
@@ -166,7 +169,7 @@ export function buildOrganizations(ctx) {
             return result;
         },
         async updateOrg(orgId, patch) {
-            const row = await OrgModel.find(orgId);
+            const row = await ctx.OrgModel.find(orgId);
             if (!row)
                 return null;
             if (patch.name !== undefined)
@@ -179,16 +182,16 @@ export function buildOrganizations(ctx) {
             return toOrgSummary(row);
         },
         async deleteOrg(orgId) {
-            const row = await OrgModel.find(orgId);
+            const row = await ctx.OrgModel.find(orgId);
             if (!row)
                 return false;
-            await MemberModel.query().where('organization_id', orgId).delete();
-            await InvitationModel.query().where('organization_id', orgId).delete();
+            await ctx.MemberModel.query().where('organization_id', orgId).delete();
+            await ctx.InvitationModel.query().where('organization_id', orgId).delete();
             await row.delete();
             return true;
         },
         async listOrgMembers(orgId) {
-            const rows = await MemberModel.query().where('organization_id', orgId);
+            const rows = await ctx.MemberModel.query().where('organization_id', orgId);
             return rows.map((r) => ({
                 accountId: r.accountId,
                 email: null, // o caller enriquece com findById se necessário
@@ -199,7 +202,7 @@ export function buildOrganizations(ctx) {
         async addOrgMember(orgId, accountId, role) {
             const { randomUUID } = await import('node:crypto');
             // Upsert: se já existe, atualiza a role
-            const existing = await MemberModel.query()
+            const existing = await ctx.MemberModel.query()
                 .where('organization_id', orgId)
                 .where('account_id', accountId)
                 .first();
@@ -208,11 +211,11 @@ export function buildOrganizations(ctx) {
                 await existing.save();
             }
             else {
-                await MemberModel.create({ id: randomUUID(), organizationId: orgId, accountId, role });
+                await ctx.MemberModel.create({ id: randomUUID(), organizationId: orgId, accountId, role });
             }
         },
         async removeOrgMember(orgId, accountId) {
-            const row = await MemberModel.query()
+            const row = await ctx.MemberModel.query()
                 .where('organization_id', orgId)
                 .where('account_id', accountId)
                 .first();
@@ -220,7 +223,7 @@ export function buildOrganizations(ctx) {
                 return { ok: false, reason: 'not_found' };
             // Invariante: org deve ter sempre >= 1 owner
             if (row.role === 'owner') {
-                const ownerCount = await countOwners(MemberModel, orgId);
+                const ownerCount = await countOwners(ctx.MemberModel, orgId);
                 if (ownerCount <= 1)
                     return { ok: false, reason: 'last_owner' };
             }
@@ -228,7 +231,7 @@ export function buildOrganizations(ctx) {
             return { ok: true };
         },
         async updateOrgMemberRole(orgId, accountId, newRole) {
-            const row = await MemberModel.query()
+            const row = await ctx.MemberModel.query()
                 .where('organization_id', orgId)
                 .where('account_id', accountId)
                 .first();
@@ -236,7 +239,7 @@ export function buildOrganizations(ctx) {
                 return { ok: false, reason: 'not_found' };
             // Invariante: não rebaixa o último owner
             if (row.role === 'owner' && newRole !== 'owner') {
-                const ownerCount = await countOwners(MemberModel, orgId);
+                const ownerCount = await countOwners(ctx.MemberModel, orgId);
                 if (ownerCount <= 1)
                     return { ok: false, reason: 'last_owner' };
             }
@@ -245,7 +248,7 @@ export function buildOrganizations(ctx) {
             return { ok: true };
         },
         async getOrgMembership(orgId, accountId) {
-            const row = await MemberModel.query()
+            const row = await ctx.MemberModel.query()
                 .where('organization_id', orgId)
                 .where('account_id', accountId)
                 .first();
@@ -256,7 +259,7 @@ export function buildOrganizations(ctx) {
             const token = randomBytes(32).toString('hex');
             const tokenHash = createHash('sha256').update(token).digest('hex');
             const expiresAt = DateTime.now().plus({ hours: input.ttlHours });
-            const inv = await InvitationModel.create({
+            const inv = await ctx.InvitationModel.create({
                 id: randomUUID(),
                 organizationId: input.organizationId,
                 email: input.email,
@@ -269,21 +272,21 @@ export function buildOrganizations(ctx) {
             return { invitation: toOrgInvitation(inv), token };
         },
         async findInvitationByTokenHash(tokenHash) {
-            const row = await InvitationModel.query().where('token_hash', tokenHash).first();
+            const row = await ctx.InvitationModel.query().where('token_hash', tokenHash).first();
             return row ? toOrgInvitation(row) : null;
         },
         async listPendingInvitationsForOrg(orgId) {
-            const rows = await InvitationModel.query()
+            const rows = await ctx.InvitationModel.query()
                 .where('organization_id', orgId)
                 .whereNull('accepted_at');
             return rows.map(toOrgInvitation);
         },
         async listPendingInvitationsForEmail(email) {
-            const rows = await InvitationModel.query().where('email', email).whereNull('accepted_at');
+            const rows = await ctx.InvitationModel.query().where('email', email).whereNull('accepted_at');
             return rows.map(toOrgInvitation);
         },
         async acceptInvitation(invitationId, accountId) {
-            const inv = await InvitationModel.find(invitationId);
+            const inv = await ctx.InvitationModel.find(invitationId);
             if (!inv)
                 return { ok: false, reason: 'not_found' };
             // Verifica expiração (expiresAt pode ser DateTime Luxon, Date, ou string do SQLite)
@@ -311,7 +314,7 @@ export function buildOrganizations(ctx) {
                 return { ok: false, reason: 'email_mismatch' };
             }
             // Verifica se já é membro
-            const existing = await MemberModel.query()
+            const existing = await ctx.MemberModel.query()
                 .where('organization_id', inv.organizationId)
                 .where('account_id', accountId)
                 .first();
@@ -323,7 +326,7 @@ export function buildOrganizations(ctx) {
             }
             // Cria membership + marca accepted_at
             const { randomUUID } = await import('node:crypto');
-            await MemberModel.create({
+            await ctx.MemberModel.create({
                 id: randomUUID(),
                 organizationId: inv.organizationId,
                 accountId,
@@ -337,7 +340,7 @@ export function buildOrganizations(ctx) {
             // Escopado por org: exige que o convite pertença à org informada antes de
             // deletar. Sem esse filtro, um owner/admin de qualquer org revogaria
             // convites de outra org sabendo apenas o invitationId (IDOR cross-org).
-            const inv = await InvitationModel.query()
+            const inv = await ctx.InvitationModel.query()
                 .where('id', invitationId)
                 .where('organization_id', organizationId)
                 .first();
@@ -348,7 +351,7 @@ export function buildOrganizations(ctx) {
         },
         async removeAccountFromAllOrgs(accountId) {
             // Memberships: remove todas, mesmo se for único owner (LGPD não pode bloquear)
-            const memberships = await MemberModel.query().where('account_id', accountId);
+            const memberships = await ctx.MemberModel.query().where('account_id', accountId);
             for (const m of memberships) {
                 await m.delete();
             }
@@ -356,7 +359,7 @@ export function buildOrganizations(ctx) {
             const email = await findAccountEmail(accountId);
             let invCount = 0;
             if (email) {
-                const invitations = await InvitationModel.query()
+                const invitations = await ctx.InvitationModel.query()
                     .where('email', email)
                     .whereNull('accepted_at');
                 for (const inv of invitations) {