@adonis-agora/authkit-server 1.0.0-rc.2 → 1.0.0-rc.3

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @adonis-agora/authkit-server
 
+## 1.0.0-rc.3
+
+### Minor Changes
+
+- [#460](https://github.com/DavideCarvalho/adonis-agora-authkit/pull/460) [`1858ee8`](https://github.com/DavideCarvalho/adonis-agora-authkit/commit/1858ee837bb4edcf0578f86d224693ac9a86a495) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Service tenants: a client can act as one partition of another service, such as a durable control plane.
+  
+  - `serviceTenants: { resources: { 'urn:agora:durable': { expiresIn: 600 } } }` in `config/authkit.ts` declares the resources (RFC 8707) that issue service-tenant tokens: JWT access tokens (RFC 9068) with `aud` = the resource and the client's `partition` and `capabilities` as claims.
+  - A service-tenant client is confidential, uses only `client_credentials` and has no redirect URIs. Create and edit it from the console (**Service tenant** kind), the Admin API and the SDKs (`serviceTenant: { partition, capabilities? }`), or `node ace authkit:clients:create --partition=acme --capability=reports`.
+  - Any client can now be disabled and enabled again (console, `POST /clients/:id/disable|enable`, SDK `clients.disable/enable`): the token endpoint answers `invalid_client` from the next request on.
+  - `authkitTenantVerifier()` (authkit-server) verifies those tokens against the local issuer and keys and returns `{ tenant, capabilities }`; `authkitTenantToken({ issuer, clientId, clientSecret, resource })` (authkit-client) fetches, caches and refreshes them on the tenant side. Both fit durable's `verifyTenant` and `tenant.token` as a function or a class, without depending on durable.
+  - New audit events: `client.disabled`, `client.enabled`, `service_tenant.token_issued`.
+  - Access-token verification (`oidcBearerGuard`, in-process and remote) now refuses a token whose `sub` is a client (a `client_credentials` token), so a service-tenant token never authenticates a user.
+
 ## 1.0.0-rc.2
 
 ### Major Changes

package/build/commands/clients_create.d.ts

@@ -11,8 +11,10 @@ import type { CommandOptions } from '@adonisjs/core/types/ace';
  *   node ace authkit:clients:create --client-id=my-api --redirect-uri=https://api/cb --redirect-uri=https://api/cb2 --grant=client_credentials
  *   node ace authkit:clients:create --redirect-uri=https://app/cb --json
  *   node ace authkit:clients:create --client-id=my-mobile --native --redirect-uri=com.example.app:/oauth
+ *   node ace authkit:clients:create --client-id=worker-acme --partition=acme --capability=reports
  */
 export default class AuthkitClientsCreate extends BaseCommand {
+    #private;
     static commandName: string;
     static description: string;
     static help: string[];
@@ -25,6 +27,8 @@ export default class AuthkitClientsCreate extends BaseCommand {
     native?: boolean;
     backchannelLogoutUri?: string;
     clientSecret?: string;
+    partition?: string;
+    capability?: string[];
     json?: boolean;
     run(): Promise<void>;
 }

package/build/commands/clients_create.js

@@ -16,6 +16,7 @@ import { BaseCommand, flags } from '@adonisjs/core/ace';
  *   node ace authkit:clients:create --client-id=my-api --redirect-uri=https://api/cb --redirect-uri=https://api/cb2 --grant=client_credentials
  *   node ace authkit:clients:create --redirect-uri=https://app/cb --json
  *   node ace authkit:clients:create --client-id=my-mobile --native --redirect-uri=com.example.app:/oauth
+ *   node ace authkit:clients:create --client-id=worker-acme --partition=acme --capability=reports
  */
 export default class AuthkitClientsCreate extends BaseCommand {
     static commandName = 'authkit:clients:create';
@@ -41,9 +42,18 @@ export default class AuthkitClientsCreate extends BaseCommand {
         '  node ace authkit:clients:create --redirect-uri=https://app/cb --backchannel-logout-uri=https://app/bc',
         '  node ace authkit:clients:create --client-id=my-app --redirect-uri=https://a/cb --redirect-uri=https://b/cb --json',
         '  node ace authkit:clients:create --client-id=my-mobile --native --redirect-uri=com.example.app:/oauth',
+        '',
+        'Service tenant (a process that acts as one partition, e.g. a durable tenant pod):',
+        'use --partition (and --capability, repeatable). Implies a confidential client with',
+        'only the client_credentials grant and no redirect URIs. Needs serviceTenants.resources',
+        'in config/authkit.ts.',
+        '  node ace authkit:clients:create --client-id=worker-acme --partition=acme --capability=reports',
     ];
     static options = { startApp: true };
     async run() {
+        if (this.partition !== undefined || this.capability?.length) {
+            return this.#createServiceTenant();
+        }
         const redirectUris = this.redirectUri ?? [];
         if (redirectUris.length === 0) {
             this.logger.logError('❌ --redirect-uri é obrigatório. Passe ao menos uma URI de callback.');
@@ -120,6 +130,83 @@ export default class AuthkitClientsCreate extends BaseCommand {
             this.logger.info('');
         }
     }
+    /** `--partition`: a service tenant (client_credentials only, `partition` claim). */
+    async #createServiceTenant() {
+        if (!this.partition) {
+            this.logger.logError('❌ --capability needs --partition.');
+            this.exitCode = 1;
+            return;
+        }
+        const conflicting = [
+            this.redirectUri?.length && '--redirect-uri',
+            this.postLogoutUri?.length && '--post-logout-uri',
+            this.public && '--public',
+            this.native && '--native',
+            this.backchannelLogoutUri && '--backchannel-logout-uri',
+            this.grant?.some((g) => g !== 'client_credentials') && '--grant',
+        ].filter(Boolean);
+        if (conflicting.length) {
+            this.logger.logError(`❌ ${conflicting.join(', ')} cannot be used with --partition (a service tenant only uses client_credentials).`);
+            this.exitCode = 1;
+            return;
+        }
+        const service = await this.app.container.make('authkit.server');
+        const { AdminClientsService } = await import('../src/host/admin_clients_service.js');
+        const { ClientMetadataError } = await import('../src/host/client_metadata.js');
+        const svc = new AdminClientsService(service);
+        const input = {
+            clientId: this.clientId,
+            applicationType: 'web',
+            redirectUris: [],
+            postLogoutRedirectUris: [],
+            grantTypes: ['client_credentials'],
+            tokenEndpointAuthMethod: 'client_secret_basic',
+            serviceTenant: { partition: this.partition, capabilities: this.capability ?? [] },
+        };
+        let created;
+        try {
+            created = this.clientSecret
+                ? await svc.createWithSecret(input, this.clientSecret)
+                : await svc.create(input);
+        }
+        catch (err) {
+            if (err instanceof ClientMetadataError) {
+                this.logger.logError(`❌ ${err.message}`);
+                this.exitCode = 1;
+                return;
+            }
+            throw err;
+        }
+        const tenant = (await svc.find(created.clientId))?.serviceTenant;
+        await service.config.audit
+            ?.record({
+            type: 'client.created',
+            clientId: created.clientId,
+            ip: null,
+            metadata: { actor: 'cli', partition: tenant?.partition },
+        })
+            .catch(() => { });
+        if (this.json) {
+            this.logger.info(JSON.stringify({
+                clientId: created.clientId,
+                clientSecret: created.clientSecret,
+                grantTypes: ['client_credentials'],
+                serviceTenant: tenant,
+                resources: Object.keys(service.config.serviceTenants.resources),
+            }, null, 2));
+            return;
+        }
+        this.logger.success(`Service tenant created: ${created.clientId}`);
+        this.logger.info(`  partition:     ${tenant?.partition}`);
+        if (tenant?.capabilities.length) {
+            this.logger.info(`  capabilities:  ${tenant.capabilities.join(', ')}`);
+        }
+        this.logger.info(`  resources:     ${Object.keys(service.config.serviceTenants.resources).join(', ')}`);
+        this.logger.info('');
+        this.logger.success('CLIENT SECRET (shown ONCE - store it now):');
+        this.logger.success(`  ${created.clientSecret}`);
+        this.logger.info('');
+    }
 }
 __decorate([
     flags.string({ description: 'client_id desejado. Omitir gera um UUID aleatório.' })
@@ -155,6 +242,16 @@ __decorate([
         description: 'Usa este client_secret em vez de gerar um (client confidencial). Útil para manter o secret que os RPs já usam.',
     })
 ], AuthkitClientsCreate.prototype, "clientSecret", void 0);
+__decorate([
+    flags.string({
+        description: 'Service tenant: the partition its tokens act as (`partition` claim). Implies client_credentials only, no redirect URIs.',
+    })
+], AuthkitClientsCreate.prototype, "partition", void 0);
+__decorate([
+    flags.array({
+        description: 'Service tenant: capability granted in its tokens (repeatable). Needs --partition.',
+    })
+], AuthkitClientsCreate.prototype, "capability", void 0);
 __decorate([
     flags.boolean({
         description: 'Output em JSON machine-readable (inclui clientId e clientSecret).',

package/build/commands/commands.json

@@ -130,6 +130,20 @@
           "type": "string",
           "description": "Usa este client_secret em vez de gerar um (client confidencial)."
         },
+        {
+          "name": "partition",
+          "flagName": "partition",
+          "required": false,
+          "type": "string",
+          "description": "Service tenant: the partition its tokens act as (`partition` claim). Implies client_credentials only, no redirect URIs."
+        },
+        {
+          "name": "capability",
+          "flagName": "capability",
+          "required": false,
+          "type": "array",
+          "description": "Service tenant: capability granted in its tokens (repeatable). Needs --partition."
+        },
         {
           "name": "json",
           "flagName": "json",

package/build/index.d.ts

@@ -158,4 +158,7 @@ export { checkClientRegistration, classifyRedirect, type RedirectUriPolicy, type
 export { registerOidcRoutes } from './src/register_routes.js';
 export type { EnsureSchemaOptions, EnsureSchemaReport } from './src/schema/ensure.js';
 export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
+export type { ServiceTenantInfo } from './src/service_tenants/client_metadata.js';
+export type { ResolvedServiceTenantResource, ResolvedServiceTenantsConfig, ServiceTenantResourceInput, ServiceTenantsConfigInput, } from './src/service_tenants/config.js';
+export { AuthkitTenantVerifier, type AuthkitTenantVerifierFn, type AuthkitTenantVerifierOptions, authkitTenantVerifier, type TenantTokenIssuer, type TenantVerifierInput, type VerifiedTenant, } from './src/service_tenants/tenant_verifier.js';
 export { stubsRoot } from './stubs/main.js';

package/build/index.js

@@ -136,4 +136,5 @@ export { OidcService } from './src/provider/oidc_service.js';
 export { checkClientRegistration, classifyRedirect, RegistrationPolicyError, } from './src/provider/registration_policy.js';
 export { registerOidcRoutes } from './src/register_routes.js';
 export { ensureAuthkitSchema, ensureAuthkitTables } from './src/schema/ensure.js';
+export { AuthkitTenantVerifier, authkitTenantVerifier, } from './src/service_tenants/tenant_verifier.js';
 export { stubsRoot } from './stubs/main.js';

package/build/src/audit/audit_sink.d.ts

@@ -8,7 +8,7 @@
  * varre os `audit.record({ type: ... })` do `src/` e falha quando um evento
  * emitido não está aqui.
  */
-export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'impersonation.stopped', 'mfa.enabled', 'mfa.disabled', 'mfa.recovery_codes_regenerated', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'roles_catalog.updated', 'agent.delegation_approved', 'agent.delegation_denied', 'agent.grant_revoked', 'agent.grant_revoked_by_admin', 'agent.allowed', 'agent.blocked', 'agent.registry_removed'];
+export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'impersonation.stopped', 'mfa.enabled', 'mfa.disabled', 'mfa.recovery_codes_regenerated', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'client.disabled', 'client.enabled', 'service_tenant.token_issued', 'roles_catalog.updated', 'agent.delegation_approved', 'agent.delegation_denied', 'agent.grant_revoked', 'agent.grant_revoked_by_admin', 'agent.allowed', 'agent.blocked', 'agent.registry_removed'];
 /** Tipos de eventos de auditoria relevantes para segurança emitidos pelo IdP. */
 export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[number];
 /**

package/build/src/audit/audit_sink.js

@@ -107,6 +107,11 @@ export const AUDIT_EVENT_TYPES = [
     'session.revoked',
     'account.signed_out_all',
     'client.secret_regenerated',
+    // A client was disabled (no new tokens) or enabled again.
+    'client.disabled',
+    'client.enabled',
+    // A service tenant got a token (`partition`, `resource`, `jti` in the metadata).
+    'service_tenant.token_issued',
     'roles_catalog.updated',
     // Personal agents (PACT §5): o usuário aprovou/negou a delegação pedida por um
     // agente, ou revogou um grant no console. `clientId` = issuer do agente.

package/build/src/define_config.d.ts

@@ -22,6 +22,7 @@ import type { WhatsappCodeSenderBinding } from './host/whatsapp_code_sender.js';
 import { type McpOAuthConfigInput, type ResolvedMcpOAuthConfig } from './mcp/mcp_oauth.js';
 import type { PatStore } from './pat/pat_store.js';
 import { type RedirectUriPolicy, type ResolvedRedirectUriPolicy, type ValidateRegistrationHook } from './provider/registration_policy.js';
+import { type ResolvedServiceTenantsConfig, type ServiceTenantsConfigInput } from './service_tenants/config.js';
 export type { AuthAccount };
 export { adapters };
 export type AuthHostRenderer = (ctx: HttpContext, view: string, props: Record<string, unknown>) => unknown;
@@ -1113,6 +1114,19 @@ export interface AuthServerConfigInput {
      * `resources` mapeia resource indicators (RFC 8707) para audiences/scopes/formato/TTL por API.
      */
     accessTokens?: AccessTokensConfig;
+    /**
+     * Service tenants: confidential `client_credentials` clients that act as a partition of
+     * a resource server (e.g. a durable control plane). `resources` lists the resource
+     * indicators (RFC 8707) that issue their JWT access tokens (RFC 9068), each with an
+     * optional `expiresIn` (seconds, default 600), `audience` and `scopes`:
+     *
+     * ```ts
+     * serviceTenants: { resources: { 'urn:agora:durable': { expiresIn: 600 } } }
+     * ```
+     *
+     * Turns on the `client_credentials` grant. Default: off.
+     */
+    serviceTenants?: ServiceTenantsConfigInput;
     /**
      * Login OAuth de clientes MCP (Claude Code, Claude, ChatGPT, VS Code, Cursor): `true` liga o
      * registro dinâmico restrito aos redirects deles, o refresh token desses clientes e os
@@ -1355,6 +1369,8 @@ export interface ResolvedServerConfig {
     registration: ResolvedRegistrationConfig;
     /** Access Tokens resolvido (RFC 9068; default opaque). */
     accessTokens: ResolvedAccessTokensConfig;
+    /** Service tenants (always present; `enabled: false` when no resource is declared). */
+    serviceTenants: ResolvedServiceTenantsConfig;
     mcp: ResolvedMcpOAuthConfig;
     /** Console admin resolvido (sempre presente; default desligado). */
     admin: ResolvedAdminConfig;

package/build/src/define_config.js

@@ -17,6 +17,7 @@ import { loadEncryptionService } from './keys/keystore_crypto.js';
 import { KeystoreManager, resolveKeystoreVault } from './keys/keystore_manager.js';
 import { mcpClientRegistration, resolveMcpOAuth, } from './mcp/mcp_oauth.js';
 import { OPEN_REGISTRATION_REDIRECT_POLICY, resolveRedirectUriPolicy, } from './provider/registration_policy.js';
+import { resolveServiceTenants, } from './service_tenants/config.js';
 export { adapters };
 const RATE_LIMIT_DEFAULTS = {
     login: { points: 10, duration: '1 min' },
@@ -475,6 +476,7 @@ export function defineConfig(config) {
                 : undefined,
             registration: resolveRegistration(config.registration),
             accessTokens: resolveAccessTokens(config.issuer, config.accessTokens),
+            serviceTenants: resolveServiceTenants(config.serviceTenants, config.accessTokens?.resources),
             mcp: resolveMcpOAuth(config.mcp),
             admin: resolveAdmin(config.admin),
             adminApi: resolveAdminApi(config.adminApi),

package/build/src/host/access_token_verifier.js

@@ -41,6 +41,10 @@ function fromJwtPayload(payload) {
     if (typeof payload.sub !== 'string' || !payload.sub)
         return null;
     const clientId = payload.client_id;
+    // No user behind it: a `client_credentials` token (a service tenant's, for one) has
+    // `sub` = the client id (RFC 9068 §2.2) and never authenticates an account.
+    if (payload.sub === clientId)
+        return null;
     return {
         format: 'jwt',
         sub: payload.sub,
@@ -209,6 +213,9 @@ export function remoteAccessTokenVerifier(options) {
             return null;
         if (typeof body.sub !== 'string' || !body.sub)
             return null;
+        // `client_credentials` token: no account behind it.
+        if (body.sub === body.client_id)
+            return null;
         if (typeof body.exp === 'number' && body.exp <= Math.floor(Date.now() / 1000))
             return null;
         return {

package/build/src/host/admin_api/api_clients_controller.d.ts

@@ -6,6 +6,7 @@ import type { HttpContext } from '@adonisjs/core/http';
  * em create/regenerate. Audita create/update/delete.
  */
 export default class ApiClientsController {
+    #private;
     index(ctx: HttpContext): Promise<{
         data: {
             clientId: string;
@@ -19,6 +20,8 @@ export default class ApiClientsController {
             backchannelLogoutSessionRequired: boolean;
             clientName: string | null;
             logoUri: string | null;
+            disabled: boolean;
+            serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
         }[];
         canList: boolean;
     }>;
@@ -34,6 +37,8 @@ export default class ApiClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     store(ctx: HttpContext): Promise<void | {
         clientId: string;
@@ -51,11 +56,43 @@ export default class ApiClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     regenerateSecret(ctx: HttpContext): Promise<void | {
         clientId: any;
         clientSecret: string;
     }>;
+    disable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
+    enable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
     destroy(ctx: HttpContext): Promise<{
         clientId: any;
         deleted: boolean;

package/build/src/host/admin_api/api_clients_controller.js

@@ -85,11 +85,16 @@ export default class ApiClientsController {
         const id = ctx.request.param('id');
         try {
             const secret = await svc.regenerateSecret(id);
+            const tenant = (await svc.find(id))?.serviceTenant;
             await service.config.audit?.record({
                 type: 'client.updated',
                 clientId: id,
                 ip: ctx.request.ip?.() ?? null,
-                metadata: { actor: 'admin-api', action: 'regenerate_secret' },
+                metadata: {
+                    actor: 'admin-api',
+                    action: 'regenerate_secret',
+                    ...(tenant ? { partition: tenant.partition } : {}),
+                },
             });
             return { clientId: id, clientSecret: secret };
         }
@@ -97,6 +102,31 @@ export default class ApiClientsController {
             return ctx.response.conflict(apiError('cannot_regenerate', e.message));
         }
     }
+    async disable(ctx) {
+        return this.#setDisabled(ctx, true);
+    }
+    async enable(ctx) {
+        return this.#setDisabled(ctx, false);
+    }
+    /** Disabled clients get `invalid_client` from the next request on. */
+    async #setDisabled(ctx, disabled) {
+        const { service, svc } = await clientsService(ctx);
+        const id = ctx.request.param('id');
+        if (!(await svc.setDisabled(id, disabled))) {
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        }
+        const client = await svc.find(id);
+        await service.config.audit?.record({
+            type: disabled ? 'client.disabled' : 'client.enabled',
+            clientId: id,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: {
+                actor: 'admin-api',
+                ...(client?.serviceTenant ? { partition: client.serviceTenant.partition } : {}),
+            },
+        });
+        return clientDto(client);
+    }
     async destroy(ctx) {
         const { service, svc } = await clientsService(ctx);
         const id = ctx.request.param('id');

package/build/src/host/admin_api/dto.d.ts

@@ -40,6 +40,8 @@ export declare function clientDto(client: AdminClient): {
     backchannelLogoutSessionRequired: boolean;
     clientName: string | null;
     logoUri: string | null;
+    disabled: boolean;
+    serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
 };
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */
 export declare function createdClientDto(created: CreatedClient): {
@@ -67,7 +69,7 @@ export declare function grantDto(grant: AdminGrant): {
 };
 export declare function auditDto(event: StoredAuditEvent): {
     id: string;
-    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
+    type: "account.deleted" | "account.expiration_warned" | "account.expired_login_blocked" | "account.exported" | "account.locked" | "account.signed_out_all" | "agent.allowed" | "agent.blocked" | "agent.delegation_approved" | "agent.delegation_denied" | "agent.grant_revoked" | "agent.grant_revoked_by_admin" | "agent.registry_removed" | "bot_protection.rejected" | "client.created" | "client.deleted" | "client.disabled" | "client.enabled" | "client.secret_regenerated" | "client.updated" | "email.change_requested" | "email.changed" | "email_change.cancelled" | "email_change.confirmed" | "email_change.requested" | "email_verification.consumed" | "email_verification.issued" | "grant.revoked_by_user" | "impersonation" | "impersonation.panel_viewed" | "impersonation.stopped" | "keys.rotated" | "login.failure" | "login.magic_link_sent" | "login.new_device" | "login.new_ip_notified" | "login.otp_failed" | "login.otp_invalidated" | "login.otp_sent" | "login.otp_verified" | "login.success" | "maintenance.disabled" | "maintenance.enabled" | "mfa.disabled" | "mfa.enabled" | "mfa.recovery_codes_regenerated" | "organization.created" | "organization.deactivated" | "organization.deleted" | "organization.invitation_accepted" | "organization.invitation_revoked" | "organization.invitation_sent" | "organization.member_added" | "organization.member_removed" | "organization.member_role_changed" | "organization.member_role_updated" | "organization.switched" | "organization.updated" | "otp.locked" | "otp.unlock_failed" | "otp.unlocked" | "passkey.registered" | "passkey.removed" | "password.changed" | "password.expired_change_forced" | "password.rehashed" | "password_reset.consumed" | "password_reset.issued" | "pat.issued" | "pat.revoked" | "pat.used" | "profile.updated" | "roles_catalog.updated" | "security_notice.sent" | "service_tenant.token_issued" | "session.revoked" | "session.revoked_all" | "session.single_enforced" | "settings.updated" | "signup" | "sudo.confirmed" | "trusted_device.revoked" | "user.created" | "user.deleted" | "user.disabled" | "user.enabled" | "user.password_reset_sent";
     accountId: string | null;
     email: string | null;
     clientId: string | null;

package/build/src/host/admin_api/dto.js

@@ -32,6 +32,8 @@ export function clientDto(client) {
         backchannelLogoutSessionRequired: client.backchannelLogoutSessionRequired ?? false,
         clientName: client.clientName,
         logoUri: client.logoUri,
+        disabled: client.disabled,
+        serviceTenant: client.serviceTenant,
     };
 }
 /** Inclui o secret (mostrado UMA vez) em create/regenerate. */

package/build/src/host/admin_clients_service.d.ts

@@ -1,4 +1,5 @@
 import type { OidcService } from '../provider/oidc_service.js';
+import { type ServiceTenantInfo } from '../service_tenants/client_metadata.js';
 import { type ApplicationType } from './client_metadata.js';
 /** Métodos de autenticação no token endpoint suportados pelo formulário admin. */
 export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';
@@ -30,6 +31,15 @@ export interface ClientInput {
      * `backchannelLogoutUri` não está definido.
      */
     backchannelLogoutSessionRequired?: boolean;
+    /**
+     * Makes the client a service tenant: confidential, `client_credentials` only, no
+     * redirect URIs; its tokens carry `partition` and `capabilities`. On update, `null`
+     * turns it back into a regular client; absent keeps the current value.
+     */
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    } | null;
 }
 /** Client persistido, apresentado ao console admin. */
 export interface AdminClient {
@@ -49,6 +59,10 @@ export interface AdminClient {
     clientName: string | null;
     /** `logo_uri` registrado, ou `null`. */
     logoUri: string | null;
+    /** Disabled clients get no tokens (`invalid_client`) until enabled again. */
+    disabled: boolean;
+    /** Service-tenant settings, or `null` for a regular client. */
+    serviceTenant: ServiceTenantInfo | null;
 }
 /** Resultado de uma criação: o client + o secret em claro (mostrado UMA vez). */
 export interface CreatedClient {
@@ -94,6 +108,12 @@ export declare class AdminClientsService {
      * PRESERVANDO o client_secret existente. Lança se o client não existe.
      */
     update(clientId: string, input: Partial<ClientInput>): Promise<void>;
+    /**
+     * Disables or re-enables a client. A disabled client gets `invalid_client` on every
+     * endpoint from the next request on (tokens already issued stay valid until they
+     * expire). Returns `false` when the client does not exist.
+     */
+    setDisabled(clientId: string, disabled: boolean): Promise<boolean>;
     /**
      * Regenera o client_secret de um client confidencial, preservando o resto da
      * metadata. Retorna o novo secret em claro (mostrado UMA vez). Lança se o

package/build/src/host/admin_clients_service.js

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto';
+import { CLIENT_DISABLED_KEY, isClientDisabled, normalizeServiceTenant, SERVICE_TENANT_KEY, serviceTenantOf, } from '../service_tenants/client_metadata.js';
 import { assertClientMetadata, ClientMetadataError, } from './client_metadata.js';
 import { CONSOLE_SSO_CLIENT_ID } from './console_sso.js';
 /** Métodos públicos (sem segredo) — espelham os "non-secret" do oidc-provider. */
@@ -111,14 +112,37 @@ export class AdminClientsService {
             logoUri: input.logoUri === null
                 ? undefined
                 : (input.logoUri ?? existing.logo_uri),
+            serviceTenant: input.serviceTenant === undefined
+                ? serviceTenantOf(existing)
+                : input.serviceTenant,
         };
         const confidential = !PUBLIC_AUTH_METHODS.has(merged.tokenEndpointAuthMethod);
         // Mantém o secret atual se continua confidencial; se virou public, remove-o.
         const clientSecret = confidential ? (previousSecret ?? randomId()) : undefined;
         const payload = this.#buildPayload(clientId, merged, clientSecret);
+        if (isClientDisabled(existing))
+            payload[CLIENT_DISABLED_KEY] = true;
         await this.#adapter.upsert(clientId, payload, 0);
         await this.oidc.evictDynamicClientCache();
     }
+    /**
+     * Disables or re-enables a client. A disabled client gets `invalid_client` on every
+     * endpoint from the next request on (tokens already issued stay valid until they
+     * expire). Returns `false` when the client does not exist.
+     */
+    async setDisabled(clientId, disabled) {
+        const existing = await this.#adapter.find(clientId);
+        if (!existing)
+            return false;
+        const payload = { ...existing };
+        if (disabled)
+            payload[CLIENT_DISABLED_KEY] = true;
+        else
+            delete payload[CLIENT_DISABLED_KEY];
+        await this.#adapter.upsert(clientId, payload, 0);
+        await this.oidc.evictDynamicClientCache();
+        return true;
+    }
     /**
      * Regenera o client_secret de um client confidencial, preservando o resto da
      * metadata. Retorna o novo secret em claro (mostrado UMA vez). Lança se o
@@ -148,6 +172,8 @@ export class AdminClientsService {
      * `client_metadata.ts`). Lança `ClientMetadataError`.
      */
     #assertValid(input) {
+        if (input.serviceTenant)
+            this.#assertServiceTenant(input);
         assertClientMetadata({
             applicationType: input.applicationType ?? 'web',
             tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
@@ -156,6 +182,27 @@ export class AdminClientsService {
             postLogoutRedirectUris: input.postLogoutRedirectUris,
         });
     }
+    /** Rules of a service-tenant client (see {@link ClientInput.serviceTenant}). */
+    #assertServiceTenant(input) {
+        if (!this.oidc.config.serviceTenants?.enabled) {
+            throw new ClientMetadataError('service tenants are not enabled: declare serviceTenants.resources in config/authkit.ts');
+        }
+        if (PUBLIC_AUTH_METHODS.has(input.tokenEndpointAuthMethod)) {
+            throw new ClientMetadataError('a service tenant must be confidential (it has a secret)');
+        }
+        if ((input.applicationType ?? 'web') !== 'web') {
+            throw new ClientMetadataError('a service tenant must be a web (server) client');
+        }
+        if (input.grantTypes.length !== 1 || input.grantTypes[0] !== 'client_credentials') {
+            throw new ClientMetadataError('a service tenant can only use the client_credentials grant');
+        }
+        if (input.redirectUris.length || input.postLogoutRedirectUris.length) {
+            throw new ClientMetadataError('a service tenant has no redirect URIs');
+        }
+        if (input.backchannelLogoutUri) {
+            throw new ClientMetadataError('a service tenant has no back-channel logout URI');
+        }
+    }
     /**
      * Monta o payload na forma snake_case que o oidc-provider espera/persiste —
      * verificada contra o que o registro dinâmico (RFC 7591) grava. As chaves de
@@ -193,6 +240,12 @@ export class AdminClientsService {
                 payload.backchannel_logout_session_required = input.backchannelLogoutSessionRequired;
             }
         }
+        if (input.serviceTenant) {
+            const tenant = normalizeServiceTenant(input.serviceTenant);
+            if (typeof tenant === 'string')
+                throw new ClientMetadataError(tenant);
+            payload[SERVICE_TENANT_KEY] = tenant;
+        }
         return payload;
     }
     /** Projeta um payload persistido para a forma exibida no console admin. */
@@ -209,6 +262,8 @@ export class AdminClientsService {
             applicationType: p.application_type === 'native' ? 'native' : 'web',
             clientName: typeof p.client_name === 'string' && p.client_name ? p.client_name : null,
             logoUri: typeof p.logo_uri === 'string' && p.logo_uri ? p.logo_uri : null,
+            disabled: isClientDisabled(p),
+            serviceTenant: serviceTenantOf(p),
         };
         if (p.backchannel_logout_uri) {
             result.backchannelLogoutUri = p.backchannel_logout_uri;