@adonis-agora/authkit-server 1.0.0-rc.13 → 1.0.0-rc.14

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.14
+
+### Patch Changes
+
+- [#476](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/476) [`b9f9119`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/b9f9119a4a030b1fb03befd73d018abd88e8bf6c) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Default emails (new login / new device alerts, password reset, verification, magic link, sudo link, OTP unlock, email change, security notices, org invitations, `sendAuthkitCodeEmail`) now always use the host's `i18n.locale` and `branding`. They used to read the config through `ctx.containerResolver.app`, which a real request's container resolver does not have, so they silently fell back to English and the "AuthKit" brand. The mailer now uses the resolved config the caller already has, or resolves the `authkit.server` binding, and logs a warning once when it cannot find the config. The header falls back to `branding.company` when `branding.default` is absent.
+
 ## 1.0.0-rc.13
 
 ### Patch Changes

package/build/src/host/account_api/account_api_controller.js

@@ -404,7 +404,7 @@ export default class AccountApiController {
             });
         }
         else {
-            await sendEmailChangeConfirmationEmail(ctx, { email: newEmail, confirmUrl });
+            await sendEmailChangeConfirmationEmail(ctx, { email: newEmail, confirmUrl }, cfg);
         }
         if (account) {
             if (cfg.mail?.onEmailChangeNotice) {

package/build/src/host/account_api/account_orgs_api_controller.js

@@ -272,7 +272,7 @@ export default class AccountOrgsApiController {
             if (c.cfg.mail?.onOrgInvitation)
                 await c.cfg.mail.onOrgInvitation(payload);
             else
-                await sendOrgInvitationEmail(ctx, payload);
+                await sendOrgInvitationEmail(ctx, payload, c.cfg);
         }
         catch {
             /* best-effort */

package/build/src/host/admin_api/admin_orgs_service.js

@@ -314,7 +314,7 @@ export class AdminOrgsService {
                 await this.cfg.mail.onOrgInvitation(payload);
             }
             else if (ctx) {
-                await sendOrgInvitationEmail(ctx, payload);
+                await sendOrgInvitationEmail(ctx, payload, this.cfg);
             }
         }
         catch {

package/build/src/host/admin_api/admin_users_service.js

@@ -312,7 +312,7 @@ export class AdminUsersService {
             });
         }
         else {
-            await sendPasswordResetEmail(ctx, { email, resetUrl });
+            await sendPasswordResetEmail(ctx, { email, resetUrl }, this.cfg);
         }
     }
 }

package/build/src/host/controllers/account_orgs_controller.js

@@ -226,7 +226,7 @@ export default class AccountOrgsController {
                 await cfg.mail.onOrgInvitation(payload);
             }
             else {
-                await sendOrgInvitationEmail(ctx, payload);
+                await sendOrgInvitationEmail(ctx, payload, cfg);
             }
         }
         catch {

package/build/src/host/controllers/account_security_controller.js

@@ -439,7 +439,7 @@ export default class AccountSecurityController {
             await sendEmailChangeConfirmationEmail(ctx, {
                 email: newEmail,
                 confirmUrl,
-            });
+            }, cfg);
         }
         // 2. Aviso de segurança → e-mail ATUAL (best-effort, fail-safe).
         if (account) {

package/build/src/host/controllers/interaction_controller.js

@@ -1098,7 +1098,7 @@ export default class AuthInteractionController {
                 await cfg.mail.onOtpUnlock({ email: account.email, unlockUrl, token: raw }).catch(() => { });
             }
             else {
-                await sendOtpUnlockEmail(ctx, { email: account.email, unlockUrl }).catch(() => { });
+                await sendOtpUnlockEmail(ctx, { email: account.email, unlockUrl }, cfg).catch(() => { });
             }
         }
         catch {
@@ -1200,7 +1200,7 @@ export default class AuthInteractionController {
                     await cfg.mail.onMagicLink({ email: to, magicUrl, token: issued.token, code, channel });
                 }
                 else {
-                    await sendMagicLinkEmail(ctx, { email: to, magicUrl, code, channel });
+                    await sendMagicLinkEmail(ctx, { email: to, magicUrl, code, channel }, cfg);
                 }
             }
         }

package/build/src/host/controllers/registration_controller.js

@@ -210,7 +210,7 @@ export default class AuthRegistrationController {
                     await cfg.mail.onEmailVerification({ email: data.email, verifyUrl, token: issued.token });
                 }
                 else {
-                    await sendEmailVerificationEmail(ctx, { email: data.email, verifyUrl });
+                    await sendEmailVerificationEmail(ctx, { email: data.email, verifyUrl }, cfg);
                 }
             }
         }
@@ -255,7 +255,7 @@ export default class AuthRegistrationController {
                     await cfg.mail.onMagicLink({ email: to, magicUrl, token: issued.token, code });
                 }
                 else {
-                    await sendMagicLinkEmail(ctx, { email: to, magicUrl, code });
+                    await sendMagicLinkEmail(ctx, { email: to, magicUrl, code }, cfg);
                 }
             }
         }
@@ -279,7 +279,7 @@ export default class AuthRegistrationController {
                 await cfg.mail.onMagicLink({ email: data.email, magicUrl, token, code, kind: 'signup' });
             }
             else {
-                await sendMagicLinkEmail(ctx, { email: data.email, magicUrl, code });
+                await sendMagicLinkEmail(ctx, { email: data.email, magicUrl, code }, cfg);
             }
         }
         // Resposta uniforme: "enviamos um link" (não vaza existência da conta).
@@ -436,7 +436,7 @@ export default class AuthRegistrationController {
                 await cfg.mail.onPasswordReset({ email: to, resetUrl: url, token: result.token });
             }
             else {
-                await sendPasswordResetEmail(ctx, { email: to, resetUrl: url });
+                await sendPasswordResetEmail(ctx, { email: to, resetUrl: url }, cfg);
             }
         }
         return render(ctx, 'forgot', {

package/build/src/host/default_mailer.d.ts

@@ -21,6 +21,11 @@ type MailService = any;
  * @internal
  */
 export declare function __setMailLoaderForTests(fn: (() => Promise<MailService | null>) | undefined): void;
+/**
+ * Permite rearmar o warning "config não resolvido" (usado em testes).
+ * @internal
+ */
+export declare function __resetMailConfigWarningForTests(): void;
 /**
  * Envia o e-mail de redefinição de senha pelo mailer default do host.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.
@@ -28,7 +33,7 @@ export declare function __setMailLoaderForTests(fn: (() => Promise<MailService |
 export declare function sendPasswordResetEmail(ctx: HttpContext, data: {
     email: string;
     resetUrl: string;
-}): Promise<void>;
+}, cfg?: ResolvedServerConfig): Promise<void>;
 /**
  * Envia o e-mail de confirmação de TROCA de e-mail para o NOVO endereço.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.
@@ -36,7 +41,7 @@ export declare function sendPasswordResetEmail(ctx: HttpContext, data: {
 export declare function sendEmailChangeConfirmationEmail(ctx: HttpContext, data: {
     email: string;
     confirmUrl: string;
-}): Promise<void>;
+}, cfg?: ResolvedServerConfig): Promise<void>;
 /**
  * Envia o e-mail de alerta de NOVO acesso à conta (login de um IP novo).
  * Best-effort: no fallback (sem mail) loga o evento; nunca lança.
@@ -65,7 +70,7 @@ export declare function sendMagicLinkEmail(ctx: HttpContext, data: {
     magicUrl: string;
     code?: string;
     channel?: 'code' | 'link';
-}): Promise<void>;
+}, cfg?: ResolvedServerConfig): Promise<void>;
 /**
  * Envia um e-mail só com um código (sem link: quem digita é a pessoa, em outro lugar) pelo mailer
  * default do host, com o branding e o i18n do authkit. Os textos saem do catálogo pelas chaves
@@ -81,7 +86,7 @@ export declare function sendAuthkitCodeEmail(ctx: HttpContext, data: {
     /** Prefixo das chaves no catálogo (`'mail.poppy_sign_in'`). */
     messages: string;
     params?: Record<string, string | number>;
-}): Promise<void>;
+}, cfg?: ResolvedServerConfig): Promise<void>;
 /**
  * Envia o link de CONFIRMAÇÃO DE IDENTIDADE (sudo) pelo mailer default do host.
  *
@@ -111,7 +116,7 @@ export declare function sendAuthkitCodeEmail(ctx: HttpContext, data: {
 export declare function sendSudoLinkEmail(ctx: HttpContext, data: {
     email: string;
     sudoUrl: string;
-}): Promise<boolean>;
+}, cfg?: ResolvedServerConfig): Promise<boolean>;
 /**
  * Envia o e-mail de aviso de segurança ao e-mail ATUAL quando uma troca de
  * e-mail é solicitada ("Alguém pediu troca para X — se não foi você...").
@@ -149,7 +154,7 @@ export declare function sendSecurityNoticeEmail(ctx: HttpContext, cfg: ResolvedS
 export declare function sendOtpUnlockEmail(ctx: HttpContext, data: {
     email: string;
     unlockUrl: string;
-}): Promise<void>;
+}, cfg?: ResolvedServerConfig): Promise<void>;
 /**
  * Sends the organization invitation email through the host default mailer.
  *
@@ -170,7 +175,7 @@ export declare function sendOrgInvitationEmail(ctx: HttpContext, data: {
     role: string;
     acceptUrl: string;
     token: string;
-}): Promise<void>;
+}, cfg?: ResolvedServerConfig): Promise<void>;
 /**
  * Envia o e-mail de verificação pelo mailer default do host.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.
@@ -178,5 +183,5 @@ export declare function sendOrgInvitationEmail(ctx: HttpContext, data: {
 export declare function sendEmailVerificationEmail(ctx: HttpContext, data: {
     email: string;
     verifyUrl: string;
-}): Promise<void>;
+}, cfg?: ResolvedServerConfig): Promise<void>;
 export {};

package/build/src/host/default_mailer.js

@@ -6,6 +6,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
+import { getBootedApp } from '../../services/booted_app.js';
 import { accountPath } from './account_paths.js';
 import { renderTransactionalEmail } from './email_templates.js';
 import { resolveMessages, translate } from './i18n.js';
@@ -38,76 +39,116 @@ export function __setMailLoaderForTests(fn) {
         mailServicePromise = undefined;
     }
 }
+let warnedUnresolved = false;
 /**
- * Tenta descobrir o `from` default da config de mail do host. Se não houver,
- * retorna `undefined` (deixa o @adonisjs/mail aplicar o default da própria config).
+ * Permite rearmar o warning "config não resolvido" (usado em testes).
+ * @internal
  */
-function defaultFrom(ctx) {
-    try {
-        // Alcançamos as configs do HOST via o resolver do container. Esse formato é
-        // específico do app (a lib não conhece o shape das configs nem `containerResolver.app`
-        // é público), então tipamos apenas ESTE acesso como `unknown`/cast estreito — não o
-        // `HttpContext` inteiro.
-        const resolver = ctx.containerResolver;
-        const get = resolver.app?.config?.get;
-        // 1) `from` específico do authkit (defineConfig({ mail: { from } })) — PRIORIDADE:
-        // permite que o auth use um remetente próprio, diferente do e-mail geral do app.
-        const authkitFrom = get?.('authkit')?.mail?.from;
-        if (authkitFrom)
-            return authkitFrom;
-        // 2) `from` global do host (config/mail.ts).
-        const hostFrom = get?.('mail')?.from;
-        if (hostFrom)
-            return hostFrom;
-    }
-    catch {
-        // sem config resolvível — deixa o @adonisjs/mail decidir.
+export function __resetMailConfigWarningForTests() {
+    warnedUnresolved = false;
+}
+/**
+ * Encontra o config RESOLVIDO do authkit (`ResolvedServerConfig`).
+ *
+ * Por que não `ctx.containerResolver.app.config.get('authkit')`, como antes: o
+ * `ContainerResolver` do `@adonisjs/fold` não tem `.app` — então numa request real
+ * esse caminho dava `undefined` SEMPRE e todo e-mail default saía em `en` com a marca
+ * "AuthKit". E mesmo onde há um `app` (o ctx do SDK embedded), `config.get('authkit')`
+ * devolve o `ConfigProvider` preguiçoso do `defineConfig`, não o config resolvido —
+ * `.i18n`/`.branding`/`.mail` nunca existem nele.
+ *
+ * Ordem: o `cfg` que o chamador já tem → o binding `authkit.server` pelo container da
+ * request → pelo `app.container` do ctx → pelo app bootado capturado pelo provider.
+ */
+async function resolveServerConfig(ctx, cfg) {
+    if (cfg)
+        return cfg;
+    const resolver = ctx?.containerResolver;
+    const containers = [
+        () => resolver,
+        () => resolver?.app?.container,
+        () => getBootedApp().container,
+    ];
+    for (const container of containers) {
+        try {
+            const maker = container();
+            if (typeof maker?.make !== 'function')
+                continue;
+            const service = (await maker.make('authkit.server'));
+            if (service?.config)
+                return service.config;
+        }
+        catch {
+            // tenta o próximo; a falha final é avisada em `resolveMailSettings`.
+        }
     }
     return undefined;
 }
 /**
- * Resolve a marca default a partir do `config/authkit.ts` (branding.default +
- * company). Usada para o cabeçalho/cor de acento/rodapé dos e-mails. Cai num
- * default neutro se a config não for resolvível.
+ * O `from` global do `config/mail.ts` do host (um objeto simples, não um provider),
+ * lido do `app` do ctx (SDK embedded) ou do app bootado. Ausente → `undefined`, e o
+ * `@adonisjs/mail` decide.
  */
-function resolveBrand(ctx) {
-    try {
-        const resolver = ctx.containerResolver;
-        const branding = resolver.app?.config?.get?.('authkit')?.branding;
-        if (branding) {
-            return {
-                appName: branding.default?.appName || branding.company || 'AuthKit',
-                accent: branding.default?.accent,
-                company: branding.company,
-            };
+function hostMailFrom(ctx) {
+    const apps = [
+        () => ctx?.containerResolver?.app,
+        () => getBootedApp(),
+    ];
+    for (const app of apps) {
+        try {
+            const from = app()?.config?.get?.('mail')?.from;
+            if (from)
+                return from;
+        }
+        catch {
+            // sem app/config de mail — tenta o próximo.
         }
     }
-    catch {
-        // sem config authkit resolvível — usa default neutro.
-    }
-    return { appName: 'AuthKit' };
+    return undefined;
 }
 /**
- * Resolve o catálogo de mensagens i18n a partir do `config/authkit.ts` (i18n).
- * Cai no default (`en`) se a config não for resolvível. Usado para localizar
- * os e-mails transacionais (assunto/cabeçalho/corpo).
+ * Marca, i18n e `from` dos e-mails default, a partir do config resolvido.
+ *
+ * Sem config resolvível cai num default neutro (`en`, "AuthKit") — mas NUNCA em
+ * silêncio: avisa uma vez por processo, porque um e-mail no idioma/marca errados é
+ * exatamente o tipo de bug que só aparece na caixa de entrada de um usuário.
  */
-function resolveMailMessages(ctx) {
-    try {
-        const resolver = ctx.containerResolver;
-        const i18n = resolver.app?.config?.get?.('authkit')?.i18n;
-        return { messages: resolveMessages(i18n), locale: i18n?.locale ?? 'en' };
-    }
-    catch {
-        // sem config authkit resolvível — usa o default `en`.
-        return { messages: resolveMessages(), locale: 'en' };
-    }
+async function resolveMailSettings(ctx, cfg) {
+    const resolved = await resolveServerConfig(ctx, cfg);
+    if (!resolved) {
+        if (!warnedUnresolved) {
+            warnedUnresolved = true;
+            const message = 'authkit: config do authkit não resolvido para os e-mails default — usando locale `en` e a marca "AuthKit". Registre o AuthkitServerProvider ou passe o config resolvido.';
+            if (typeof ctx?.logger?.warn === 'function')
+                ctx.logger.warn(message);
+            else
+                console.warn(message);
+        }
+        // `en` de propósito: aqui NÃO há config nenhum (nem o default `pt-BR` do `defineConfig`,
+        // que um host sem `i18n` recebe pelo `cfg.locale` acima). Sem saber de quem é o app,
+        // o catálogo base — o único com todas as chaves — é o fallback honesto.
+        return { brand: { appName: 'AuthKit' }, messages: resolveMessages(), locale: 'en' };
+    }
+    const branding = resolved.branding;
+    return {
+        brand: {
+            // `branding.default` é opcional na prática (hosts declaram só `company` + `clients`):
+            // sem ele, o nome do app é a `company`.
+            appName: branding?.default?.appName || branding?.company || 'AuthKit',
+            accent: branding?.default?.accent,
+            company: branding?.company,
+        },
+        messages: resolved.messages ?? resolveMessages(),
+        locale: resolved.locale ?? 'en',
+        // `from` próprio do authkit tem prioridade; senão o `from` global do `config/mail.ts`.
+        from: resolved.mail?.from ?? hostMailFrom(ctx),
+    };
 }
-async function sendEmail(ctx, to, content) {
+async function sendEmail(settings, to, content) {
     const mail = await loadMail();
     if (!mail)
         return false;
-    const from = defaultFrom(ctx);
+    const { from } = settings;
     await mail.send((message) => {
         if (from)
             message.from(from);
@@ -119,10 +160,10 @@ async function sendEmail(ctx, to, content) {
  * Envia o e-mail de redefinição de senha pelo mailer default do host.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.
  */
-export async function sendPasswordResetEmail(ctx, data) {
+export async function sendPasswordResetEmail(ctx, data, cfg) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const content = renderTransactionalEmail({
             brand,
             locale,
@@ -134,7 +175,7 @@ export async function sendPasswordResetEmail(ctx, data) {
             ctaUrl: data.resetUrl,
             footnote: translate(t, 'mail.reset.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ resetUrl: data.resetUrl, email: data.email }, 'authkit: link de redefinição de senha (dev — @adonisjs/mail ausente)');
         }
@@ -147,10 +188,10 @@ export async function sendPasswordResetEmail(ctx, data) {
  * Envia o e-mail de confirmação de TROCA de e-mail para o NOVO endereço.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.
  */
-export async function sendEmailChangeConfirmationEmail(ctx, data) {
+export async function sendEmailChangeConfirmationEmail(ctx, data, cfg) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const content = renderTransactionalEmail({
             brand,
             locale,
@@ -162,7 +203,7 @@ export async function sendEmailChangeConfirmationEmail(ctx, data) {
             ctaUrl: data.confirmUrl,
             footnote: translate(t, 'mail.email_change.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ confirmUrl: data.confirmUrl, email: data.email }, 'authkit: link de confirmação de troca de e-mail (dev — @adonisjs/mail ausente)');
         }
@@ -177,8 +218,8 @@ export async function sendEmailChangeConfirmationEmail(ctx, data) {
  */
 export async function sendNewLoginEmail(ctx, cfg, data) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const origin = authkitOrigin(cfg);
         const intro = [
             translate(t, 'mail.new_login.intro'),
@@ -196,7 +237,7 @@ export async function sendNewLoginEmail(ctx, cfg, data) {
             ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.new_login.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ ip: data.ip, email: data.email }, 'authkit: alerta de novo acesso (dev — @adonisjs/mail ausente)');
         }
@@ -211,8 +252,8 @@ export async function sendNewLoginEmail(ctx, cfg, data) {
  */
 export async function sendNewDeviceLoginEmail(ctx, cfg, data) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const origin = authkitOrigin(cfg);
         const lines = [
             translate(t, 'mail.new_login.intro'),
@@ -233,7 +274,7 @@ export async function sendNewDeviceLoginEmail(ctx, cfg, data) {
             ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.new_login.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ ip: data.ip, email: data.email, userAgent: data.userAgent }, 'authkit: alerta de novo dispositivo (dev — @adonisjs/mail ausente)');
         }
@@ -246,10 +287,10 @@ export async function sendNewDeviceLoginEmail(ctx, cfg, data) {
  * Envia o e-mail de magic link (login passwordless) pelo mailer default do host.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.
  */
-export async function sendMagicLinkEmail(ctx, data) {
+export async function sendMagicLinkEmail(ctx, data, cfg) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         // Login choose-first: o `channel` decide o que o e-mail SURFA (os dois tokens
         // continuam emitidos co-locados a montante — isto é só renderização).
         //  - 'code'  → e-mail SÓ com o código (sem botão/link), quando há código;
@@ -285,7 +326,7 @@ export async function sendMagicLinkEmail(ctx, data) {
                 code: linkOnly ? undefined : data.code,
                 codeLabel: translate(t, 'mail.magic_link.code_label'),
             });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ magicUrl: data.magicUrl, email: data.email }, 'authkit: magic link de login (dev — @adonisjs/mail ausente)');
         }
@@ -303,10 +344,10 @@ export async function sendMagicLinkEmail(ctx, data) {
  *
  * Estável no 1.x (é o mailer das `personalAgents.extensions`).
  */
-export async function sendAuthkitCodeEmail(ctx, data) {
+export async function sendAuthkitCodeEmail(ctx, data, cfg) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const key = (name) => `${data.messages}.${name}`;
         const content = renderTransactionalEmail({
             brand,
@@ -318,7 +359,7 @@ export async function sendAuthkitCodeEmail(ctx, data) {
             code: data.code,
             codeLabel: translate(t, key('code_label'), data.params),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ email: data.email, code: data.code, messages: data.messages, ...(data.params ?? {}) }, 'authkit: código por e-mail (dev — @adonisjs/mail ausente)');
         }
@@ -353,10 +394,10 @@ export async function sendAuthkitCodeEmail(ctx, data) {
  * apagar o pendente da sessão e recusar — flashar "link enviado" deixaria o
  * usuário esperando um e-mail que nunca vem, na tela que já é o gargalo dele.
  */
-export async function sendSudoLinkEmail(ctx, data) {
+export async function sendSudoLinkEmail(ctx, data, cfg) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const content = renderTransactionalEmail({
             brand,
             locale,
@@ -368,7 +409,7 @@ export async function sendSudoLinkEmail(ctx, data) {
             ctaUrl: data.sudoUrl,
             footnote: translate(t, 'mail.sudo_link.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger?.info({ sudoUrl: data.sudoUrl, email: data.email }, 'authkit: link de confirmação de identidade (dev — @adonisjs/mail ausente)');
         }
@@ -386,8 +427,8 @@ export async function sendSudoLinkEmail(ctx, data) {
  */
 export async function sendEmailChangeNoticeEmail(ctx, cfg, data) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const origin = authkitOrigin(cfg);
         const content = renderTransactionalEmail({
             brand,
@@ -400,7 +441,7 @@ export async function sendEmailChangeNoticeEmail(ctx, cfg, data) {
             ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.email_change_notice.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ newEmail: data.newEmail, email: data.email }, 'authkit: aviso de troca de e-mail (dev — @adonisjs/mail ausente)');
         }
@@ -416,8 +457,8 @@ export async function sendEmailChangeNoticeEmail(ctx, cfg, data) {
  */
 export async function sendEmailChangedCompletedEmail(ctx, cfg, data) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const origin = authkitOrigin(cfg);
         const content = renderTransactionalEmail({
             brand,
@@ -433,7 +474,7 @@ export async function sendEmailChangedCompletedEmail(ctx, cfg, data) {
             ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.email_changed_completed.fallback'),
         });
-        const sent = await sendEmail(ctx, data.oldEmail, content);
+        const sent = await sendEmail(settings, data.oldEmail, content);
         if (!sent) {
             ctx.logger.info({ oldEmail: data.oldEmail, newEmail: data.newEmail }, 'authkit: confirmação de troca de e-mail concluída (dev — @adonisjs/mail ausente)');
         }
@@ -449,8 +490,8 @@ export async function sendEmailChangedCompletedEmail(ctx, cfg, data) {
  */
 export async function sendSecurityNoticeEmail(ctx, cfg, data) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const origin = authkitOrigin(cfg);
         const kindKey = `mail.security_notice.kind_${data.kind}`;
         const kindLabel = translate(t, kindKey);
@@ -471,7 +512,7 @@ export async function sendSecurityNoticeEmail(ctx, cfg, data) {
             ctaUrl: `${origin}${accountPath('security')}`,
             footnote: translate(t, 'mail.security_notice.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ kind: data.kind, email: data.email }, 'authkit: notificação de segurança (dev — @adonisjs/mail ausente)');
         }
@@ -484,10 +525,10 @@ export async function sendSecurityNoticeEmail(ctx, cfg, data) {
  * Envia o e-mail de desbloqueio do fator OTP (quando TOTP/recovery excede maxAttempts).
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.
  */
-export async function sendOtpUnlockEmail(ctx, data) {
+export async function sendOtpUnlockEmail(ctx, data, cfg) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const content = renderTransactionalEmail({
             brand,
             locale,
@@ -499,7 +540,7 @@ export async function sendOtpUnlockEmail(ctx, data) {
             ctaUrl: data.unlockUrl,
             footnote: translate(t, 'mail.otp_unlock.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ unlockUrl: data.unlockUrl, email: data.email }, 'authkit: link de desbloqueio OTP (dev — @adonisjs/mail ausente)');
         }
@@ -520,10 +561,10 @@ export async function sendOtpUnlockEmail(ctx, data) {
  *
  * Best-effort: never throws — invitation creation must not depend on delivery.
  */
-export async function sendOrgInvitationEmail(ctx, data) {
+export async function sendOrgInvitationEmail(ctx, data, cfg) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const content = renderTransactionalEmail({
             brand,
             locale,
@@ -535,7 +576,7 @@ export async function sendOrgInvitationEmail(ctx, data) {
             ctaUrl: data.acceptUrl,
             footnote: translate(t, 'mail.org_invitation.fallback'),
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger?.info({
                 acceptUrl: data.acceptUrl,
@@ -553,10 +594,10 @@ export async function sendOrgInvitationEmail(ctx, data) {
  * Envia o e-mail de verificação pelo mailer default do host.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.
  */
-export async function sendEmailVerificationEmail(ctx, data) {
+export async function sendEmailVerificationEmail(ctx, data, cfg) {
     try {
-        const brand = resolveBrand(ctx);
-        const { messages: t, locale } = resolveMailMessages(ctx);
+        const settings = await resolveMailSettings(ctx, cfg);
+        const { brand, messages: t, locale } = settings;
         const content = renderTransactionalEmail({
             brand,
             locale,
@@ -567,7 +608,7 @@ export async function sendEmailVerificationEmail(ctx, data) {
             ctaLabel: translate(t, 'mail.verify.cta'),
             ctaUrl: data.verifyUrl,
         });
-        const sent = await sendEmail(ctx, data.email, content);
+        const sent = await sendEmail(settings, data.email, content);
         if (!sent) {
             ctx.logger.info({ verifyUrl: data.verifyUrl, email: data.email }, 'authkit: link de verificação de e-mail (dev — @adonisjs/mail ausente)');
         }

package/build/src/host/sudo/methods/magic_link.js

@@ -154,7 +154,7 @@ export function magicLink() {
                         delivered = true;
                     }
                     else {
-                        delivered = await sendSudoLinkEmail(ctx, { email: c.account.email, sudoUrl });
+                        delivered = await sendSudoLinkEmail(ctx, { email: c.account.email, sudoUrl }, c.cfg);
                     }
                 }
                 catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.13",
+  "version": "1.0.0-rc.14",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",