@adonis-agora/authkit-server 1.0.0-rc.11 → 1.0.0-rc.13

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.13
+
+### Patch Changes
+
+- [#475](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/475) [`2ebb953`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/2ebb953d1d96eb128febc7cc0c3e6f55a6000cc2) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `agora:doctor`'s `authkit.shield` check now reads the app's `config/shield.ts` and only warns when shield's CSRF check would really reject one of authkit's server-to-server POST endpoints (`{mountPath}/token`, `/token/introspection`, `/token/revocation`, `/authkit/pat/introspect`, and the personal-agent OAuth endpoints when enabled). It mirrors shield: CSRF off or a `methods` list without POST passes, an empty `methods` checks every method, and `exceptRoutes` may be a function (probed with a token-less POST) or a route-pattern array. `authkitCsrfExceptions` now matches the pathname anchored (`/oidc` or `/oidc/...`) instead of a substring, so `/admin/oidc/x`, `/oidc-clients` or `?next=/oidc` are no longer exempted.
+
+## 1.0.0-rc.12
+
+### Minor Changes
+
+- [#474](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/474) [`df9e49d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/df9e49d7817c03a7cce4cac1df709c7788d6307c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - AuthKit's tables can live in their own database schema: `schema: { name: 'auth' }` in `defineConfig` puts every table AuthKit owns in `auth` (`"auth"."auth_settings"`) while the app stays in `public`. The schema is written into every statement, so it works on any connection and inside the app's own transaction, with no `searchPath` (which leaks across clients behind PgBouncer in transaction mode).
+  
+  - The boot creates the schema (`CREATE SCHEMA IF NOT EXISTS`; MySQL: `CREATE DATABASE IF NOT EXISTS`) when `autoManage` is on, and fails with a message naming the schema and the grant when the role cannot create it. `ensureAuthkitSchema(db, { schema })` does the same from a migration.
+  - Covers the OIDC adapter table (`adapters.database({ schema })` overrides), the Lucid keystore (`jwks.store: { driver: 'lucid', schema }` overrides), the account store's tables (MFA, password history, organizations), runtime settings, session revocations, the personal-agent tables and agent extensions (`PersonalAgentHost.table(name)`, `AuthkitTable.create(table, { table })`, `ensureAuthkitTables(db, tables, { schema })`; Poppy uses them and `ensurePoppySchema(db, { schema })`).
+  - authkit-client: `lucidRevocationStore({ schema })`.
+  - SQLite with `schema.name` fails the boot instead of ignoring the option.
+  - `agora:doctor` gains `authkit.db-schema`: the schema exists, the tables are in it, the connection can write there. Silent without `schema.name`.
+  - The key-rotation lock key includes the schema, so two installs in two schemas of one database do not share it.
+  
+  Without `schema.name` nothing changes.
+
+### Patch Changes
+
+- Updated dependencies [[`df9e49d`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/df9e49d7817c03a7cce4cac1df709c7788d6307c)]:
+  - @adonis-agora/authkit-core@1.0.0-rc.2
+
 ## 1.0.0-rc.11
 
 ### Patch Changes

package/README.md

@@ -119,7 +119,7 @@ router.post('/auth/interaction/:uid/consent', [AuthInteractionController, 'conse
 
 Escolha o backend no `config/authkit.ts`:
 - `adapters.redis({ connection })` — requer `@adonisjs/redis` configurado.
-- `adapters.database({ connection? })` — Lucid; tabela `authkit_oidc_payloads`, criada pelo `ensureAuthkitSchema` no boot (com `schema: { autoManage: false }`, chame-o numa migração). A coluna indexada `account_id` mantém as buscas e revogações por conta em SQL; linhas antigas com `account_id` NULL continuam sendo encontradas. Postgres, MySQL e SQLite.
+- `adapters.database({ connection?, schema? })` — Lucid (default: `schema.connection`/`schema.name` do `defineConfig`); tabela `authkit_oidc_payloads`, criada pelo `ensureAuthkitSchema` no boot (com `schema: { autoManage: false }`, chame-o numa migração). A coluna indexada `account_id` mantém as buscas e revogações por conta em SQL; linhas antigas com `account_id` NULL continuam sendo encontradas. Postgres, MySQL e SQLite.
 
 ## Observabilidade
 

package/build/index.d.ts

@@ -15,7 +15,7 @@ export type { PersonalAgentIdentity } from './src/agents/agent_identity.js';
 export { PersonalAgentVerifier } from './src/agents/agent_identity.js';
 export type { PersonalAgentDelegationConfigInput, PersonalAgentRegistration, PersonalAgentResolver, PersonalAgentsConfigInput, ResolvedPersonalAgentsConfig, } from './src/agents/config.js';
 export type { DelegationContext, DelegationGrantSummary, DelegationReceipt, } from './src/agents/delegation_service.js';
-export type { AuthkitTable, PersonalAgentAccessTokens, PersonalAgentConsoleSummary, PersonalAgentExtension, PersonalAgentExtensionContext, PersonalAgentExtensionDefinition, PersonalAgentGrant, PersonalAgentGrantLedger, PersonalAgentGrantSummary, PersonalAgentHost, PersonalAgentProtocolRuntime, PersonalAgentRefreshToken, PersonalAgentRouteKit, ResolvedPersonalAgentExtension, } from './src/agents/extension.js';
+export type { AuthkitTable, AuthkitTableContext, PersonalAgentAccessTokens, PersonalAgentConsoleSummary, PersonalAgentExtension, PersonalAgentExtensionContext, PersonalAgentExtensionDefinition, PersonalAgentGrant, PersonalAgentGrantLedger, PersonalAgentGrantSummary, PersonalAgentHost, PersonalAgentProtocolRuntime, PersonalAgentRefreshToken, PersonalAgentRouteKit, ResolvedPersonalAgentExtension, } from './src/agents/extension.js';
 export type { PersonalAgentAuthOptions, PersonalAgentRequestContext, } from './src/agents/middleware.js';
 export { personalAgentAuth, personalAgentOf, personalAgentReceipt, personalAgentSecurity, personalAgentStepUp, } from './src/agents/middleware.js';
 export type { BuiltinProtocolId, PactOptions, PersonalAgentProtocol, } from './src/agents/protocol.js';
@@ -160,6 +160,7 @@ export { checkClientRegistration, classifyRedirect, type RedirectUriPolicy, type
 export { registerOidcRoutes } from './src/register_routes.js';
 export type { EnsureSchemaOptions, EnsureSchemaReport } from './src/schema/ensure.js';
 export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
+export { AuthkitSchemaError } from './src/schema/tables_location.js';
 export type { ServiceTenantInfo } from './src/service_tenants/client_metadata.js';
 export type { ResolvedServiceTenantResource, ResolvedServiceTenantsConfig, ServiceTenantResourceInput, ServiceTenantsConfigInput, } from './src/service_tenants/config.js';
 export { AuthkitTenantVerifier, type AuthkitTenantVerifierFn, type AuthkitTenantVerifierOptions, authkitTenantVerifier, type TenantTokenIssuer, type TenantVerifierInput, type VerifiedTenant, } from './src/service_tenants/tenant_verifier.js';

package/build/index.js

@@ -137,6 +137,7 @@ export { OidcService } from './src/provider/oidc_service.js';
 export { checkClientRegistration, classifyRedirect, RegistrationPolicyError, } from './src/provider/registration_policy.js';
 export { registerOidcRoutes } from './src/register_routes.js';
 export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
+export { AuthkitSchemaError } from './src/schema/tables_location.js';
 export { AuthkitTenantVerifier, authkitTenantVerifier, } from './src/service_tenants/tenant_verifier.js';
 export { authkitTenantLabels, } from './src/tenancy/tenant_labels.js';
 export { stubsRoot } from './stubs/main.js';

package/build/providers/authkit_server_provider.js

@@ -22,7 +22,7 @@ import { authkitDoctorChecks } from '../src/doctor/agora_checks.js';
 import { registerDoctorChecks } from '../src/doctor/agora_doctor.js';
 import { resolveAppKey } from '../src/host/app_key.js';
 import { resolveEffectiveKeyRotation } from '../src/host/key_rotation.js';
-import { RuntimeSettings } from '../src/host/runtime_settings.js';
+import { RuntimeSettings, settingsLocation } from '../src/host/runtime_settings.js';
 import { KeystoreCodec } from '../src/keys/keystore_codec.js';
 import { loadEncryptionService } from '../src/keys/keystore_crypto.js';
 import { KeystoreManager, resolveKeystoreVault } from '../src/keys/keystore_manager.js';
@@ -30,6 +30,7 @@ import { KeyRotationScheduler } from '../src/provider/key_rotation_scheduler.js'
 import { KeystoreReloadPoller } from '../src/provider/keystore_reload.js';
 import { OidcService } from '../src/provider/oidc_service.js';
 import { makeSingleFlightLock } from '../src/provider/single_flight_lock.js';
+import { AuthkitSchemaError } from '../src/schema/tables_location.js';
 export default class AuthkitServerProvider {
     app;
     constructor(app) {
@@ -286,6 +287,7 @@ export default class AuthkitServerProvider {
             const { ensureAuthkitSchema } = await import('../src/schema/ensure.js');
             const report = await ensureAuthkitSchema(db, {
                 connection: config.schema.connection,
+                schema: config.schema.name,
                 accountTable: config.accountStore?.accountTable,
                 accountConnection: config.accountStore?.connectionName,
                 tables: config.personalAgents?.extensions?.flatMap((e) => e.tables ?? []),
@@ -306,6 +308,10 @@ export default class AuthkitServerProvider {
             }
         }
         catch (error) {
+            // `schema.name` que o banco não aceita (SQLite, schema que o role não pode criar):
+            // derruba o boot com a mensagem — nunca segue com tabelas fora do schema pedido.
+            if (error instanceof AuthkitSchemaError)
+                throw error;
             const logger = await this.app.container.make('logger').catch(() => null);
             logger?.warn({ err: error }, 'authkit: schema auto-manage failed — features degrade gracefully; ' +
                 'run ensureAuthkitSchema() in a migration or fix DB connectivity');
@@ -365,10 +371,15 @@ export default class AuthkitServerProvider {
                 .resolve(this.app, value)
                 .catch(() => null))
             : null;
-        const connection = config?.schema?.connection;
         // RuntimeSettings sem request (mesmo padrão de expire_scan_command / security_notice_service).
-        const settings = new RuntimeSettings(db, connection ? { connection } : {});
-        const withLock = makeSingleFlightLock({ key: 'authkit:keys:rotate', ttlMs: 5 * 60_000 });
+        const settings = new RuntimeSettings(db, settingsLocation(config));
+        // Com `schema.name`, a chave do lock leva o schema: duas instalações em schemas
+        // diferentes do mesmo banco não disputam o mesmo lock.
+        const schemaName = config?.schema?.name;
+        const withLock = makeSingleFlightLock({
+            key: schemaName ? `authkit:${schemaName}:keys:rotate` : 'authkit:keys:rotate',
+            ttlMs: 5 * 60_000,
+        });
         const scheduler = new KeyRotationScheduler({
             policy: () => resolveEffectiveKeyRotation(settings),
             ageDays: () => svc.keystoreAgeDays(),

package/build/src/accounts/lucid_account_store.js

@@ -1,5 +1,5 @@
 import { PasswordManager } from '../password/password_manager.js';
-import { authkitTablesClient, BIND_TABLES_LOCATION, } from '../schema/tables_location.js';
+import { authkitTable, authkitTablesClient, BIND_TABLES_LOCATION, } from '../schema/tables_location.js';
 import { buildCore } from './lucid_store/core.js';
 import { buildLoginMethods, supportsLoginMethodsColumn } from './lucid_store/login_methods.js';
 import { buildMfa } from './lucid_store/mfa.js';
@@ -178,7 +178,7 @@ export function lucidAccountStore(Model, options = {}) {
         return authkitTablesClient(db, tablesLocation);
     };
     const orgModels = () => explicitOrgModels ??
-        (tablesLocation ? organizationModelsOn(tablesLocation.connection) : defaultOrganizationModels);
+        (tablesLocation ? organizationModelsOn(tablesLocation) : defaultOrganizationModels);
     const OrgModels = orgModelsOption === false ? undefined : orgModels;
     // RP do WebAuthn: usado nas cerimônias. Default do rpName cai no mfaIssuer.
     const webauthn = options.webauthn ?? {
@@ -204,6 +204,7 @@ export function lucidAccountStore(Model, options = {}) {
         emailVerificationTtlHours: emailTokens.verificationTtlHours,
         emailChangeTtlHours: emailTokens.changeTtlHours,
         tablesClient,
+        tableName: (name) => authkitTable(tablesLocation ?? undefined, name),
         // Encripta o segredo antes de persistir (no-op sem encrypter).
         sealSecret: (secret) => (encrypter ? encrypter.encrypt(secret) : secret),
         // Decripta o segredo armazenado; retorna null em falha/adulteração (no-op sem encrypter).
@@ -345,7 +346,7 @@ export function lucidAccountStore(Model, options = {}) {
     // Não-enumerável: o `defineConfig` informa `schema.connection` por aqui.
     Object.defineProperty(store, BIND_TABLES_LOCATION, {
         value: (location) => {
-            tablesLocation = { connection: location.connection };
+            tablesLocation = { connection: location.connection, schema: location.schema };
         },
     });
     return store;

package/build/src/accounts/lucid_store/mfa.js

@@ -19,7 +19,7 @@ import { buildMfaStateRepo, generateRecoveryCode, hashesEqual, sha256, } from '.
 const TOTP_PERIOD = 30;
 export function buildMfa(ctx) {
     const { Model, mfaIssuer, recoveryCodeCount, sealSecret, openSecret } = ctx;
-    const repo = buildMfaStateRepo(Model, ctx.tablesClient);
+    const repo = buildMfaStateRepo(Model, ctx.tablesClient, ctx.tableName);
     return {
         async getMfaState(accountId) {
             const state = await repo.read(accountId);

package/build/src/accounts/lucid_store/organization_models.d.ts

@@ -11,8 +11,8 @@ import type { DateTime } from 'luxon';
  * sintoma aparece longe da causa.
  *
  * Use com `organizationModels: true` em {@link lucidAccountStore}. Eles seguem a
- * conexão das tabelas do authkit (`schema.connection` do `defineConfig`, como
- * todas as tabelas lib-owned — ver {@link organizationModelsOn}). O caminho
+ * conexão e o schema das tabelas do authkit (`schema.connection`/`schema.name`
+ * do `defineConfig`, como todas as tabelas lib-owned — ver {@link organizationModelsOn}). O caminho
  * explícito (`{ OrgModel, MemberModel, InvitationModel }`) continua valendo como
  * escape hatch; aí a conexão é a que os models do host declaram.
  *
@@ -72,7 +72,11 @@ export type OrganizationModels = {
     InvitationModel: any;
 };
 /**
- * Os models default numa conexão Lucid nomeada (subclasses com `static connection`),
- * memoizados por conexão. `undefined` → os próprios defaults (conexão primária).
+ * Os models default onde vivem as tabelas do authkit: subclasses com `static connection`
+ * (`schema.connection`) e `static table` qualificada (`schema.name`), memoizadas por
+ * local. Sem conexão nem schema → os próprios defaults (conexão primária).
  */
-export declare function organizationModelsOn(connection: string | undefined): OrganizationModels;
+export declare function organizationModelsOn(location: {
+    connection?: string;
+    schema?: string;
+}): OrganizationModels;

package/build/src/accounts/lucid_store/organization_models.js

@@ -16,8 +16,8 @@ import { BaseModel, column } from '@adonisjs/lucid/orm';
  * sintoma aparece longe da causa.
  *
  * Use com `organizationModels: true` em {@link lucidAccountStore}. Eles seguem a
- * conexão das tabelas do authkit (`schema.connection` do `defineConfig`, como
- * todas as tabelas lib-owned — ver {@link organizationModelsOn}). O caminho
+ * conexão e o schema das tabelas do authkit (`schema.connection`/`schema.name`
+ * do `defineConfig`, como todas as tabelas lib-owned — ver {@link organizationModelsOn}). O caminho
  * explícito (`{ OrgModel, MemberModel, InvitationModel }`) continua valendo como
  * escape hatch; aí a conexão é a que os models do host declaram.
  *
@@ -112,30 +112,34 @@ export const defaultOrganizationModels = {
     MemberModel: AuthOrganizationMember,
     InvitationModel: AuthOrganizationInvitation,
 };
-const modelsByConnection = new Map();
+const modelsByLocation = new Map();
 /**
- * Os models default numa conexão Lucid nomeada (subclasses com `static connection`),
- * memoizados por conexão. `undefined` → os próprios defaults (conexão primária).
+ * Os models default onde vivem as tabelas do authkit: subclasses com `static connection`
+ * (`schema.connection`) e `static table` qualificada (`schema.name`), memoizadas por
+ * local. Sem conexão nem schema → os próprios defaults (conexão primária).
  */
-export function organizationModelsOn(connection) {
-    if (!connection)
+export function organizationModelsOn(location) {
+    const { connection, schema } = location;
+    if (!connection && !schema)
         return defaultOrganizationModels;
-    let models = modelsByConnection.get(connection);
+    const key = `${connection ?? ''}\x00${schema ?? ''}`;
+    let models = modelsByLocation.get(key);
     if (!models) {
+        const table = (name) => (schema ? `${schema}.${name}` : name);
         class OrgModel extends AuthOrganization {
-            static table = 'auth_organizations';
+            static table = table('auth_organizations');
             static connection = connection;
         }
         class MemberModel extends AuthOrganizationMember {
-            static table = 'auth_organization_members';
+            static table = table('auth_organization_members');
             static connection = connection;
         }
         class InvitationModel extends AuthOrganizationInvitation {
-            static table = 'auth_organization_invitations';
+            static table = table('auth_organization_invitations');
             static connection = connection;
         }
         models = { OrgModel, MemberModel, InvitationModel };
-        modelsByConnection.set(connection, models);
+        modelsByLocation.set(key, models);
     }
     return models;
 }

package/build/src/accounts/lucid_store/password_hygiene.js

@@ -17,8 +17,10 @@ export function buildPasswordHistory(ctx, db) {
      * Lucid expõe `db.query().from(table)` para SELECT e `db.table(table).insert()` para INSERT.
      * Para DELETE usamos `db.query().from(table)`.
      */
+    // Lido a cada uso: o `defineConfig` informa o schema depois de o store existir.
+    const table = () => ctx.tableName ? ctx.tableName('auth_password_history') : 'auth_password_history';
     function qFrom() {
-        return db.query().from('auth_password_history');
+        return db.query().from(table());
     }
     return {
         async isPasswordReused(accountId, plainPassword, count, nativeVerify) {
@@ -51,7 +53,7 @@ export function buildPasswordHistory(ctx, db) {
         },
         async recordPasswordHistory(accountId, oldHash) {
             try {
-                await db.table('auth_password_history').insert({
+                await db.table(table()).insert({
                     account_id: accountId,
                     password_hash: oldHash,
                     created_at: DateTime.now().toISO(),

package/build/src/accounts/lucid_store/shared.d.ts

@@ -84,6 +84,11 @@ export interface LucidStoreContext {
      * → the model's connection (a store used without `defineConfig`).
      */
     tablesClient?: () => any;
+    /**
+     * Nome de uma tabela do authkit como os statements a escrevem: com `schema.name`,
+     * `schema.tabela` (o knex cita cada parte). Ausente → o nome puro.
+     */
+    tableName?: (name: string) => string;
 }
 export declare const sha256: (value: string) => string;
 /** Recovery code legível: 10 chars hex em duas metades (ex.: a1b2c-3d4e5). */
@@ -121,7 +126,7 @@ export interface MfaStatePatch {
  * JSON (string) na escrita e desserializado na leitura (aceita tanto string —
  * sqlite/text — quanto array já parseado — pg jsonb).
  */
-export declare function buildMfaStateRepo(Model: any, tablesClient?: () => any): {
+export declare function buildMfaStateRepo(Model: any, tablesClient?: () => any, tableName?: (name: string) => string): {
     /** Lê o estado de MFA da conta; null se não há linha em `auth_mfa`. */
     read(accountId: string): Promise<MfaState | null>;
     /**

package/build/src/accounts/lucid_store/shared.js

@@ -49,8 +49,9 @@ export function hashesEqual(a, b) {
  * JSON (string) na escrita e desserializado na leitura (aceita tanto string —
  * sqlite/text — quanto array já parseado — pg jsonb).
  */
-export function buildMfaStateRepo(Model, tablesClient) {
-    const TABLE = 'auth_mfa';
+export function buildMfaStateRepo(Model, tablesClient, tableName = (name) => name) {
+    // Lido a cada uso: o `defineConfig` informa o schema depois de o store existir.
+    const table = () => tableName('auth_mfa');
     /** QueryClient das tabelas do authkit (equivale ao `db` do password_history). */
     function client() {
         return tablesClient ? tablesClient() : Model.query().client;
@@ -92,7 +93,7 @@ export function buildMfaStateRepo(Model, tablesClient) {
     return {
         /** Lê o estado de MFA da conta; null se não há linha em `auth_mfa`. */
         async read(accountId) {
-            const row = await client().from(TABLE).where('account_id', accountId).first();
+            const row = await client().from(table()).where('account_id', accountId).first();
             if (!row)
                 return null;
             return {
@@ -126,17 +127,17 @@ export function buildMfaStateRepo(Model, tablesClient) {
             }
             if ('lastTotpStep' in patch)
                 update.last_totp_step = patch.lastTotpStep ?? null;
-            const affected = await client().from(TABLE).where('account_id', accountId).update(update);
+            const affected = await client().from(table()).where('account_id', accountId).update(update);
             // knex update retorna o nº de linhas afetadas (0 = linha ainda não existe).
             if (!affected) {
                 await client()
-                    .table(TABLE)
+                    .table(table())
                     .insert({ account_id: accountId, ...update });
             }
         },
         /** Remove o estado de MFA da conta (disable / reset total). No-op se ausente. */
         async clear(accountId) {
-            await client().from(TABLE).where('account_id', accountId).delete();
+            await client().from(table()).where('account_id', accountId).delete();
         },
     };
 }

package/build/src/accounts/lucid_store/webauthn.js

@@ -8,7 +8,7 @@ export function buildWebauthn(ctx, Credential, webauthn, ceremonies) {
     const { Model } = ctx;
     // Estado de MFA é LIB-OWNED (tabela `auth_mfa`): registrar uma passkey habilita
     // o MFA gravando `mfa_enabled_at` em `auth_mfa`, não numa coluna do model.
-    const mfaState = buildMfaStateRepo(Model, ctx.tablesClient);
+    const mfaState = buildMfaStateRepo(Model, ctx.tablesClient, ctx.tableName);
     return {
         async generatePasskeyRegistrationOptions(accountId) {
             const row = await Model.find(accountId);

package/build/src/adapters/database_adapter.d.ts

@@ -1,10 +1,16 @@
 import type { Database } from '@adonisjs/lucid/database';
 import type { EnumeratedArtifact, OidcAdapter, OidcPayload } from './adapter_contract.js';
+/** Nome da tabela (sem schema). O adapter recebe o nome já qualificado pelo factory. */
+export declare const OIDC_PAYLOADS_TABLE = "authkit_oidc_payloads";
 export declare class DatabaseAdapter implements OidcAdapter {
     #private;
     private name;
     private db;
-    constructor(name: string, db: Database);
+    /** `authkit_oidc_payloads`, qualificada com `schema.name` quando há schema. */
+    private table;
+    constructor(name: string, db: Database, 
+    /** `authkit_oidc_payloads`, qualificada com `schema.name` quando há schema. */
+    table?: string);
     upsert(id: string, payload: OidcPayload, expiresIn: number): Promise<void>;
     renewSession(id: string, expiresIn: number): Promise<boolean>;
     find(id: string): Promise<OidcPayload | undefined>;

package/build/src/adapters/database_adapter.js

@@ -1,4 +1,5 @@
-const TABLE = 'authkit_oidc_payloads';
+/** Nome da tabela (sem schema). O adapter recebe o nome já qualificado pelo factory. */
+export const OIDC_PAYLOADS_TABLE = 'authkit_oidc_payloads';
 /** Intervalo mínimo, por conexão, entre duas limpezas das linhas expiradas. */
 const PRUNE_INTERVAL_MS = 10 * 60_000;
 /** Quanto tempo a ausência da coluna `account_id` vale antes de re-checar. */
@@ -6,11 +7,17 @@ const ACCOUNT_COLUMN_RECHECK_MS = 60_000;
 /** Tamanho máximo de uma lista `IN (...)`. */
 const IN_CHUNK = 500;
 const connectionStates = new WeakMap();
-function connectionState(db) {
-    let state = connectionStates.get(db);
+/** Estado por conexão E tabela (duas instalações em schemas diferentes não se misturam). */
+function connectionState(db, table) {
+    let byTable = connectionStates.get(db);
+    if (!byTable) {
+        byTable = new Map();
+        connectionStates.set(db, byTable);
+    }
+    let state = byTable.get(table);
     if (!state) {
         state = { accountColumn: null, accountColumnRecheckAt: 0, nextPruneAt: 0 };
-        connectionStates.set(db, state);
+        byTable.set(table, state);
     }
     return state;
 }
@@ -29,12 +36,16 @@ function chunks(items) {
 export class DatabaseAdapter {
     name;
     db;
-    constructor(name, db) {
+    table;
+    constructor(name, db, 
+    /** `authkit_oidc_payloads`, qualificada com `schema.name` quando há schema. */
+    table = OIDC_PAYLOADS_TABLE) {
         this.name = name;
         this.db = db;
+        this.table = table;
     }
     #query() {
-        return this.db.query().from(TABLE).where('model_name', this.name);
+        return this.db.query().from(this.table).where('model_name', this.name);
     }
     /**
      * Valor de `expires_at` (gravação e comparação) para o dialeto da conexão. No
@@ -43,7 +54,7 @@ export class DatabaseAdapter {
      * driver serializa no formato do banco — o MySQL recusa o ISO com `Z`.
      */
     #timestamp(ms) {
-        const state = connectionState(this.db);
+        const state = connectionState(this.db, this.table);
         if (state.dialect === undefined) {
             // O factory passa o manager (`Database`) ou um `QueryClient` de conexão nomeada.
             const db = this.db;
@@ -66,13 +77,13 @@ export class DatabaseAdapter {
      * re-checado, para pegar o ALTER do boot que rodou depois do primeiro request.
      */
     async #hasAccountColumn() {
-        const state = connectionState(this.db);
+        const state = connectionState(this.db, this.table);
         if (state.accountColumn === true)
             return true;
         if (state.accountColumn === false && state.accountColumnRecheckAt > Date.now())
             return false;
         try {
-            await this.db.query().from(TABLE).select('account_id').limit(1);
+            await this.db.query().from(this.table).select('account_id').limit(1);
             state.accountColumn = true;
         }
         catch {
@@ -88,7 +99,7 @@ export class DatabaseAdapter {
      * do caminho do request e nunca lança.
      */
     #maybePrune() {
-        const state = connectionState(this.db);
+        const state = connectionState(this.db, this.table);
         const now = Date.now();
         if (state.nextPruneAt > now)
             return;
@@ -96,7 +107,7 @@ export class DatabaseAdapter {
         Promise.resolve()
             .then(() => this.db
             .query()
-            .from(TABLE)
+            .from(this.table)
             .whereNotNull('expires_at')
             .where('expires_at', '<=', this.#timestamp(now))
             .delete())
@@ -125,7 +136,7 @@ export class DatabaseAdapter {
             await this.#query().where('id', id).update(row);
         }
         else {
-            await this.db.table(TABLE).insert(row);
+            await this.db.table(this.table).insert(row);
         }
         this.#maybePrune();
     }
@@ -185,7 +196,7 @@ export class DatabaseAdapter {
         await this.#query().where('id', id).delete();
     }
     async revokeByGrantId(grantId) {
-        await this.db.query().from(TABLE).where('grant_id', grantId).delete();
+        await this.db.query().from(this.table).where('grant_id', grantId).delete();
     }
     /**
      * Enumeração genérica dos artefatos do model deste adapter (id + payload).

package/build/src/adapters/factory.d.ts

@@ -8,6 +8,8 @@ export interface AdapterResolveContext {
      * on. A database adapter without its own `connection` uses it.
      */
     connection?: string;
+    /** `schema.name` of `defineConfig`. A database adapter without its own `schema` uses it. */
+    schema?: string;
 }
 export interface AdapterFactory {
     resolver(app: ApplicationService, context?: AdapterResolveContext): Promise<OidcAdapterClass>;
@@ -48,6 +50,11 @@ export interface DatabaseAdapterConfig {
      * de todas as tabelas do authkit), e sem ela a primária.
      */
     connection?: string;
+    /**
+     * Schema do banco da tabela `authkit_oidc_payloads` (MySQL: o database). Default:
+     * `schema.name` do `defineConfig`. Vai escrito em cada statement — nunca via searchPath.
+     */
+    schema?: string;
 }
 export declare const adapters: {
     /**

package/build/src/adapters/factory.js

@@ -1,4 +1,5 @@
-import { DatabaseAdapter } from './database_adapter.js';
+import { assertSchemaSupported, authkitTable, validateSchemaName, } from '../schema/tables_location.js';
+import { DatabaseAdapter, OIDC_PAYLOADS_TABLE } from './database_adapter.js';
 import { RedisAdapter } from './redis_adapter.js';
 /**
  * Modelos do oidc-provider de vida curta, amarrados ao ciclo da sessão de
@@ -70,10 +71,13 @@ export const adapters = {
             async resolver(app, context) {
                 const db = await app.container.make('lucid.db');
                 const connection = config.connection ?? context?.connection;
+                const schema = validateSchemaName(config.schema ?? context?.schema, 'adapters.database({ schema })');
                 const conn = connection ? db.connection(connection) : db;
+                assertSchemaSupported(connection ? conn : db.connection(), schema);
+                const table = authkitTable({ schema }, OIDC_PAYLOADS_TABLE);
                 return class extends DatabaseAdapter {
                     constructor(name) {
-                        super(name, conn);
+                        super(name, conn, table);
                     }
                 };
             },

package/build/src/agents/delegation_store.d.ts

@@ -46,8 +46,12 @@ export interface LiveGrantFilter {
 export declare class DelegationStore {
     #private;
     private conn;
+    /** Nome da tabela como os statements o escrevem (`schema.tabela` com `schema.name`). */
+    private t;
     /** `conn` = uma conexão Lucid (`db.connection(name?)`) — ou uma transação. */
-    constructor(conn: () => any);
+    constructor(conn: () => any, 
+    /** Nome da tabela como os statements o escrevem (`schema.tabela` com `schema.name`). */
+    t?: (name: string) => string);
     insertDevice(row: Omit<DeviceCodeRow, 'accountId' | 'grantId' | 'lastPolledAt'>): Promise<void>;
     findDeviceByCodeHash(hash: string): Promise<DeviceCodeRow | null>;
     findDeviceByUserCode(userCode: string): Promise<DeviceCodeRow | null>;