@adonis-agora/authkit-server 1.0.0-rc.15 → 1.0.0-rc.16

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.16
+
+### Patch Changes
+
+- [#483](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/483) [`dcfbed1`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/dcfbed164d3d79dae3f37ad70ad07b5450822887) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - The `authkit.server` service gains `bindBearerAccount(ctx, accountId)`. Code that verified an authkit access token outside `oidcBearerGuard` (for example `@adonis-agora/agent`'s dev MCP endpoint) calls it to put the caller on the request: `getAccountId(ctx)` and `realAccountId(ctx)` then return that account, and `impersonationState(ctx)` reports no impersonation. A console session on the same request still wins.
+
 ## 1.0.0-rc.15
 
 ### Patch Changes

package/build/src/host/bearer_account.d.ts

@@ -1,5 +1,13 @@
 /** Registra a conta autenticada via bearer nesta request. */
 export declare function setBearerAccountId(ctx: object, accountId: string): void;
+/**
+ * Vincula a conta de um bearer que foi autenticado FORA do `oidcBearerGuard`
+ * (ex.: o endpoint MCP do agent) a esta request, para que `getAccountId`,
+ * `realAccountId` e `impersonationState` vejam quem chamou. O chamador conta
+ * como "sem impersonation": qualquer impersonation bearer anterior desta request
+ * é esquecida.
+ */
+export declare function bindBearerAccount(ctx: object, accountId: string): void;
 /** Esquece a conta bearer desta request (falha de autenticação). */
 export declare function clearBearerAccountId(ctx: object): void;
 /**

package/build/src/host/bearer_account.js

@@ -16,6 +16,17 @@ const bearerImpersonations = new WeakMap();
 export function setBearerAccountId(ctx, accountId) {
     bearerAccounts.set(ctx, accountId);
 }
+/**
+ * Vincula a conta de um bearer que foi autenticado FORA do `oidcBearerGuard`
+ * (ex.: o endpoint MCP do agent) a esta request, para que `getAccountId`,
+ * `realAccountId` e `impersonationState` vejam quem chamou. O chamador conta
+ * como "sem impersonation": qualquer impersonation bearer anterior desta request
+ * é esquecida.
+ */
+export function bindBearerAccount(ctx, accountId) {
+    bearerAccounts.set(ctx, accountId);
+    bearerImpersonations.delete(ctx);
+}
 /** Esquece a conta bearer desta request (falha de autenticação). */
 export function clearBearerAccountId(ctx) {
     bearerAccounts.delete(ctx);

package/build/src/provider/oidc_service.d.ts

@@ -104,4 +104,12 @@ export declare class OidcService {
      * é um detalhe interno acessível via o helper `weak_cache` do próprio provider.
      */
     evictDynamicClientCache(): Promise<void>;
+    /**
+     * Vincula a conta de um access token que você verificou FORA do guard bearer do
+     * AuthKit (ex.: o endpoint MCP do `@adonis-agora/agent`) a esta request:
+     * `getAccountId(ctx)` e `realAccountId(ctx)` passam a devolver `accountId`, e
+     * `impersonationState(ctx)` responde "sem impersonation". Uma sessão de console
+     * na mesma request continua ganhando.
+     */
+    bindBearerAccount(ctx: object, accountId: string): void;
 }

package/build/src/provider/oidc_service.js

@@ -4,6 +4,7 @@ import Koa from 'koa';
 import mount from 'koa-mount';
 import { ProviderIdentities } from '../accounts/provider_identities.js';
 import { normalizeActiveOrg, readActiveOrgFromKoaCtx, verifyActiveOrgMembership, } from '../host/active_org_cookie.js';
+import { bindBearerAccount } from '../host/bearer_account.js';
 import { isFirstPartyClient } from '../host/branding.js';
 import { listKeyInfos, signingKeyAgeDays, toPublicJwks, } from '../keys/keystore.js';
 import { wireProviderEvents } from '../observability/wire_provider_events.js';
@@ -338,4 +339,14 @@ export class OidcService {
             // imediata da entrada órfã. Best-effort — não propaga erro pro caminho da request.
         }
     }
+    /**
+     * Vincula a conta de um access token que você verificou FORA do guard bearer do
+     * AuthKit (ex.: o endpoint MCP do `@adonis-agora/agent`) a esta request:
+     * `getAccountId(ctx)` e `realAccountId(ctx)` passam a devolver `accountId`, e
+     * `impersonationState(ctx)` responde "sem impersonation". Uma sessão de console
+     * na mesma request continua ganhando.
+     */
+    bindBearerAccount(ctx, accountId) {
+        bindBearerAccount(ctx, accountId);
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.15",
+  "version": "1.0.0-rc.16",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -165,7 +165,7 @@
     "tempura": "0.4.1",
     "testcontainers": "12.2.1",
     "typescript": "7.0.2",
-    "vite": "8.3.6"
+    "vite": "8.3.7"
   },
   "scripts": {
     "build": "node scripts/build_host_css.mjs && node scripts/build_webauthn.mjs && node scripts/build_ui.mjs && node -e \"const fs=require('node:fs');for(const d of ['build/stubs','build/host/views'])fs.rmSync(d,{recursive:true,force:true})\" && tsc && node -e \"require('node:fs').cpSync('src/host/assets','build/src/host/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/src/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/src/password/common_passwords.txt')\"",