@adonis-agora/authkit-server 1.0.0-rc.2 → 1.0.0-rc.3

package/build/src/host/admin_console/console_clients_controller.d.ts

@@ -9,8 +9,11 @@ import type { HttpContext } from '@adonisjs/core/http';
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
+ * POST   {prefix}/api/clients/:id/disable     → stop issuing tokens to the client
+ * POST   {prefix}/api/clients/:id/enable      → issue tokens again
  */
 export default class ConsoleClientsController {
+    #private;
     /** GET {prefix}/api/clients */
     index(ctx: HttpContext): Promise<{
         data: {
@@ -25,6 +28,8 @@ export default class ConsoleClientsController {
             backchannelLogoutSessionRequired: boolean;
             clientName: string | null;
             logoUri: string | null;
+            disabled: boolean;
+            serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
         }[];
         canList: boolean;
     }>;
@@ -41,6 +46,8 @@ export default class ConsoleClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     /** POST {prefix}/api/clients */
     store(ctx: HttpContext): Promise<void | {
@@ -60,12 +67,46 @@ export default class ConsoleClientsController {
         backchannelLogoutSessionRequired: boolean;
         clientName: string | null;
         logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
     }>;
     /** DELETE {prefix}/api/clients/:id */
     destroy(ctx: HttpContext): Promise<void | {
         ok: boolean;
         deleted: string;
     }>;
+    /** POST {prefix}/api/clients/:id/disable */
+    disable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
+    /** POST {prefix}/api/clients/:id/enable */
+    enable(ctx: HttpContext): Promise<void | {
+        clientId: string;
+        confidential: boolean;
+        grantTypes: string[];
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+        tokenEndpointAuthMethod: string;
+        applicationType: import("../client_metadata.js").ApplicationType;
+        backchannelLogoutUri: string | null;
+        backchannelLogoutSessionRequired: boolean;
+        clientName: string | null;
+        logoUri: string | null;
+        disabled: boolean;
+        serviceTenant: import("../../service_tenants/client_metadata.ts").ServiceTenantInfo | null;
+    }>;
     /** POST {prefix}/api/clients/:id/regenerate-secret */
     regenerateSecret(ctx: HttpContext): Promise<void | {
         clientId: string;

package/build/src/host/admin_console/console_clients_controller.js

@@ -19,6 +19,8 @@ function invalidMetadata(ctx, err) {
  * PATCH  {prefix}/api/clients/:id             → atualizar metadata
  * DELETE {prefix}/api/clients/:id             → remover client
  * POST   {prefix}/api/clients/:id/regenerate-secret → gerar novo secret
+ * POST   {prefix}/api/clients/:id/disable     → stop issuing tokens to the client
+ * POST   {prefix}/api/clients/:id/enable      → issue tokens again
  */
 export default class ConsoleClientsController {
     /** GET {prefix}/api/clients */
@@ -107,6 +109,34 @@ export default class ConsoleClientsController {
         });
         return { ok: true, deleted: id };
     }
+    /** POST {prefix}/api/clients/:id/disable */
+    async disable(ctx) {
+        return this.#setDisabled(ctx, true);
+    }
+    /** POST {prefix}/api/clients/:id/enable */
+    async enable(ctx) {
+        return this.#setDisabled(ctx, false);
+    }
+    /** Disabled clients get `invalid_client` from the next request on. */
+    async #setDisabled(ctx, disabled) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const svc = new AdminClientsService(service);
+        const id = ctx.request.param('id');
+        if (!(await svc.setDisabled(id, disabled))) {
+            return ctx.response.notFound(apiError('not_found', 'Client não encontrado.'));
+        }
+        const client = await svc.find(id);
+        await service.config.audit?.record({
+            type: disabled ? 'client.disabled' : 'client.enabled',
+            clientId: id,
+            ip: ctx.request.ip?.() ?? null,
+            metadata: {
+                actor: 'admin-console',
+                ...(client?.serviceTenant ? { partition: client.serviceTenant.partition } : {}),
+            },
+        });
+        return clientDto(client);
+    }
     /** POST {prefix}/api/clients/:id/regenerate-secret */
     async regenerateSecret(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
@@ -129,7 +159,10 @@ export default class ConsoleClientsController {
             type: 'client.secret_regenerated',
             clientId: id,
             ip: ctx.request.ip?.() ?? null,
-            metadata: { actor: 'admin-console' },
+            metadata: {
+                actor: 'admin-console',
+                ...(existing.serviceTenant ? { partition: existing.serviceTenant.partition } : {}),
+            },
         });
         return { clientId: id, clientSecret: newSecret };
     }

package/build/src/host/admin_validators.d.ts

@@ -17,6 +17,19 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     backchannelLogoutSessionRequired: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine").VineBoolean>;
     clientName: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
     logoUri: import("@vinejs/vine/schema/base/literal").OptionalModifier<import("@vinejs/vine/schema/base/literal").NullableModifier<import("@vinejs/vine").VineString>>;
+    serviceTenant: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").NullableModifier<import("@vinejs/vine").VineObject<{
+        partition: import("@vinejs/vine").VineString;
+        capabilities: import("@vinejs/vine").OptionalModifier<import("@vinejs/vine").VineArray<import("@vinejs/vine").VineString>>;
+    }, {
+        capabilities?: string[] | null | undefined;
+        partition: string;
+    }, {
+        capabilities?: string[] | undefined;
+        partition: string;
+    }, {
+        capabilities?: string[] | undefined;
+        partition: string;
+    }>>>;
 }, {
     applicationType?: "native" | "web" | null | undefined;
     backchannelLogoutSessionRequired?: string | number | boolean | null | undefined;
@@ -27,6 +40,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | null | undefined;
     redirectUris?: string[] | null | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | null | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | null | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
@@ -38,6 +55,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }, {
     applicationType?: "native" | "web" | undefined;
@@ -49,6 +70,10 @@ export declare const clientInputValidator: import("@vinejs/vine").VineValidator<
     logoUri?: string | null | undefined;
     postLogoutRedirectUris?: string[] | undefined;
     redirectUris?: string[] | undefined;
+    serviceTenant?: {
+        capabilities?: string[] | undefined;
+        partition: string;
+    } | null | undefined;
     tokenEndpointAuthMethod?: "client_secret_basic" | "client_secret_post" | "none" | undefined;
 }>, Record<string, any> | undefined>;
 /** Forma validada de um client (saída do {@link clientInputValidator}). */
@@ -63,6 +88,10 @@ export type ClientInputFields = {
     backchannelLogoutSessionRequired?: boolean;
     clientName?: string | null;
     logoUri?: string | null;
+    serviceTenant?: {
+        partition: string;
+        capabilities?: string[];
+    } | null;
 };
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.

package/build/src/host/admin_validators.js

@@ -1,4 +1,5 @@
 import vine from '@vinejs/vine';
+import { CAPABILITY_PATTERN, MAX_CAPABILITIES, PARTITION_PATTERN, } from '../service_tenants/client_metadata.js';
 import { APPLICATION_TYPES, redirectUriProblem } from './client_metadata.js';
 import { normalizeEmailIdentifier } from './email_identifier.js';
 /**
@@ -103,6 +104,18 @@ export const clientInputValidator = vine.compile(vine.object({
     // `null` (update) removes them.
     clientName: vine.string().trim().maxLength(200).nullable().optional(),
     logoUri: vine.string().trim().url(URL_OPTS).nullable().optional(),
+    // Service tenant (`client_credentials` + partition claim). `null` (update) turns it
+    // back into a regular client.
+    serviceTenant: vine
+        .object({
+        partition: vine.string().trim().regex(PARTITION_PATTERN),
+        capabilities: vine
+            .array(vine.string().trim().regex(CAPABILITY_PATTERN))
+            .maxLength(MAX_CAPABILITIES)
+            .optional(),
+    })
+        .nullable()
+        .optional(),
 }));
 /**
  * Mapeia o input validado para um {@link ClientInput} COMPLETO (create), com defaults.
@@ -111,6 +124,21 @@ export const clientInputValidator = vine.compile(vine.object({
  */
 export function clientCreateInput(v) {
     const applicationType = v.applicationType ?? 'web';
+    // A service tenant only uses client_credentials: that is its default grant.
+    if (v.serviceTenant) {
+        return {
+            clientId: v.clientId?.trim() || undefined,
+            applicationType,
+            redirectUris: v.redirectUris ?? [],
+            postLogoutRedirectUris: v.postLogoutRedirectUris ?? [],
+            grantTypes: v.grantTypes ?? ['client_credentials'],
+            tokenEndpointAuthMethod: v.tokenEndpointAuthMethod ?? 'client_secret_basic',
+            backchannelLogoutUri: v.backchannelLogoutUri || undefined,
+            clientName: v.clientName || undefined,
+            logoUri: v.logoUri || undefined,
+            serviceTenant: v.serviceTenant,
+        };
+    }
     return {
         clientId: v.clientId?.trim() || undefined,
         applicationType,
@@ -148,6 +176,8 @@ export function clientPartialInput(v) {
         out.clientName = v.clientName?.trim() || null;
     if (v.logoUri !== undefined)
         out.logoUri = v.logoUri?.trim() || null;
+    if (v.serviceTenant !== undefined)
+        out.serviceTenant = v.serviceTenant;
     return out;
 }
 // ─── Usuários ───────────────────────────────────────────────────────────────

package/build/src/host/register_auth_host.js

@@ -997,6 +997,8 @@ export function registerAuthHost(router, opts = {}) {
             router.get(`${ap}/api/clients/:id`, [C.consoleClients, 'show']);
             router.patch(`${ap}/api/clients/:id`, [C.consoleClients, 'update']);
             router.delete(`${ap}/api/clients/:id`, [C.consoleClients, 'destroy']);
+            router.post(`${ap}/api/clients/:id/disable`, [C.consoleClients, 'disable']);
+            router.post(`${ap}/api/clients/:id/enable`, [C.consoleClients, 'enable']);
             router.post(`${ap}/api/clients/:id/regenerate-secret`, [
                 C.consoleClients,
                 'regenerateSecret',
@@ -1096,6 +1098,8 @@ export function registerAuthHost(router, opts = {}) {
             withApiThrottle(router.patch('/clients/:id', [C.apiClients, 'update']));
             withApiThrottle(router.post('/clients/:id/regenerate-secret', [C.apiClients, 'regenerateSecret']));
             withApiThrottle(router.delete('/clients/:id', [C.apiClients, 'destroy']));
+            withApiThrottle(router.post('/clients/:id/disable', [C.apiClients, 'disable']));
+            withApiThrottle(router.post('/clients/:id/enable', [C.apiClients, 'enable']));
             // Organizações.
             withApiThrottle(router.get('/organizations', [C.apiOrgs, 'index']));
             withApiThrottle(router.post('/organizations', [C.apiOrgs, 'store']));