@adonis-agora/authkit-server 1.0.0-rc.3 → 1.0.0-rc.5

package/build/src/doctor/doctor_input.d.ts

@@ -0,0 +1,27 @@
+import type { ApplicationService } from '@adonisjs/core/types';
+import { type DoctorInput, type Finding } from './checks.js';
+/** Logger mínimo para reportar peers instalados-mas-quebrados. */
+export interface CanImportLogger {
+    warning(msg: string): void;
+}
+/**
+ * Tenta importar um peer; `true` se importável.
+ *
+ * Distingue "não instalado" de "instalado mas quebrado": só um erro de
+ * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
+ * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
+ * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
+ * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
+ * como "ausente" e o diagnóstico mente.
+ */
+export declare function canImport(specifier: string, logger?: CanImportLogger): Promise<boolean>;
+/**
+ * Monta o `DoctorInput` a partir do app (config `authkit` resolvida, `session`, peers). Usado por
+ * `authkit:doctor` e pelos checks do `agora:doctor`. Lança se `config/authkit.ts` não resolver.
+ */
+export declare function buildDoctorInput(app: ApplicationService, logger?: CanImportLogger): Promise<DoctorInput>;
+/**
+ * O finding de idade da chave de assinatura managed (best-effort): `null` quando o jwks não é
+ * `managed` com store, ou quando o keystore não pôde ser lido.
+ */
+export declare function managedSigningKeyAgeFinding(app: ApplicationService, authkitConfig: Record<string, any> | null): Promise<Finding | null>;

package/build/src/doctor/doctor_input.js

@@ -0,0 +1,86 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { DatabaseAdapter } from '../adapters/database_adapter.js';
+import { resolveAuthkitConfig } from '../commands/resolve_config.js';
+import { defaultEncryptForStore } from '../define_config.js';
+import { signingKeyAgeDays } from '../keys/keystore.js';
+import { KeystoreCodec } from '../keys/keystore_codec.js';
+import { loadEncryptionService } from '../keys/keystore_crypto.js';
+import { KeystoreManager, resolveKeystoreVault } from '../keys/keystore_manager.js';
+import { signingKeyAgeFinding } from './checks.js';
+/**
+ * Tenta importar um peer; `true` se importável.
+ *
+ * Distingue "não instalado" de "instalado mas quebrado": só um erro de
+ * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
+ * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
+ * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
+ * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
+ * como "ausente" e o diagnóstico mente.
+ */
+export async function canImport(specifier, logger) {
+    try {
+        await import(__rewriteRelativeImportExtension(specifier));
+        return true;
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code !== 'ERR_MODULE_NOT_FOUND' && code !== 'MODULE_NOT_FOUND') {
+            logger?.warning(`⚠️  ${specifier} está instalado mas falhou ao carregar: ${err.message}`);
+        }
+        return false;
+    }
+}
+/**
+ * Monta o `DoctorInput` a partir do app (config `authkit` resolvida, `session`, peers). Usado por
+ * `authkit:doctor` e pelos checks do `agora:doctor`. Lança se `config/authkit.ts` não resolver.
+ */
+export async function buildDoctorInput(app, logger) {
+    const config = await app.container.make('config');
+    // `defineConfig` exporta um config provider — resolve antes de inspecionar,
+    // senão todo campo aparece como "ausente" (provider cru não tem issuer etc.).
+    const authkitConfig = await resolveAuthkitConfig(app, config.get('authkit', null));
+    const sessionConfig = config.get('session', null) ?? null;
+    return {
+        authkitConfig,
+        sessionConfig,
+        peers: {
+            session: await canImport('@adonisjs/session', logger),
+            shield: await canImport('@adonisjs/shield', logger),
+            ally: await canImport('@adonisjs/ally', logger),
+            limiter: await canImport('@adonisjs/limiter', logger),
+        },
+        __adapterClasses: { DatabaseAdapter },
+    };
+}
+/**
+ * O finding de idade da chave de assinatura managed (best-effort): `null` quando o jwks não é
+ * `managed` com store, ou quando o keystore não pôde ser lido.
+ */
+export async function managedSigningKeyAgeFinding(app, authkitConfig) {
+    const jwksInput = (authkitConfig?.jwksConfig ?? authkitConfig?.jwks);
+    if (jwksInput?.source !== 'managed' || !jwksInput?.store)
+        return null;
+    try {
+        const vault = resolveKeystoreVault(jwksInput.store, {
+            makePath: (p) => app.makePath(p),
+            container: app.container,
+        });
+        const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(jwksInput.store);
+        const enc = encrypt ? await loadEncryptionService().catch(() => undefined) : undefined;
+        const mgr = new KeystoreManager(vault, new KeystoreCodec({ encrypt, enc }), jwksInput.algorithm ?? 'RS256');
+        const store = await mgr.read().catch(() => null);
+        const maxAge = jwksInput.rotationDays ?? 90;
+        return signingKeyAgeFinding(signingKeyAgeDays(store), maxAge);
+    }
+    catch {
+        /* idade é best-effort no doctor */
+        return null;
+    }
+}

package/build/src/doctor/index.d.ts

@@ -0,0 +1,5 @@
+import type { AgoraDoctorCheck } from './agora_doctor.js';
+export type { AgoraDoctorCheck, AgoraDoctorRegistry, AgoraDoctorReport, AgoraDoctorResult, AgoraDoctorStatus, } from './agora_doctor.js';
+export { AGORA_DOCTOR_BINDING, registerDoctorChecks } from './agora_doctor.js';
+/** authkit's checks, for `node ace agora:doctor --no-boot` (which imports this entry instead of booting). */
+export declare const agoraDoctorChecks: AgoraDoctorCheck[];

package/build/src/doctor/index.js

@@ -0,0 +1,4 @@
+import { authkitDoctorChecks } from './agora_checks.js';
+export { AGORA_DOCTOR_BINDING, registerDoctorChecks } from './agora_doctor.js';
+/** authkit's checks, for `node ace agora:doctor --no-boot` (which imports this entry instead of booting). */
+export const agoraDoctorChecks = authkitDoctorChecks();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.3",
+  "version": "1.0.0-rc.5",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -46,7 +46,8 @@
     "./telescope": "./build/src/observability/telescope/index.js",
     "./authkit_server_provider": "./build/providers/authkit_server_provider.js",
     "./commands": "./build/commands/main.js",
-    "./commands/configure": "./build/commands/configure.js"
+    "./commands/configure": "./build/commands/configure.js",
+    "./doctor": "./build/src/doctor/index.js"
   },
   "adonisjs": {
     "types": "@adonis-agora/authkit-server",
@@ -109,7 +110,7 @@
     "@adonis-agora/authkit-core": "1.0.0-rc.0",
     "@simplewebauthn/browser": "14.0.0",
     "@simplewebauthn/server": "14.1.0",
-    "jose": "6.2.15",
+    "jose": "6.2.16",
     "koa": "3.3.0",
     "koa-mount": "4.2.0",
     "oidc-provider": "9.13.3",
@@ -118,7 +119,7 @@
   },
   "devDependencies": {
     "@adonis-agora/authkit-react": "1.0.0-rc.2",
-    "@adonis-agora/durable": "0.59.0",
+    "@adonis-agora/durable": "0.60.0",
     "@adonis-agora/telescope": "0.27.1",
     "@adonisjs/ally": "6.3.2",
     "@adonisjs/auth": "10.1.0",
@@ -169,6 +170,7 @@
     "build": "node scripts/build_host_css.mjs && node scripts/build_webauthn.mjs && node scripts/build_ui.mjs && node -e \"const fs=require('node:fs');for(const d of ['build/stubs','build/host/views'])fs.rmSync(d,{recursive:true,force:true})\" && tsc && node -e \"require('node:fs').cpSync('src/host/assets','build/src/host/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/src/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/src/password/common_passwords.txt')\"",
     "build:ui": "node scripts/build_ui.mjs",
     "build:webauthn": "node scripts/build_webauthn.mjs",
+    "check:agora-doctor": "node ../../scripts/check-agora-doctor.mjs .",
     "check:host-css": "node scripts/check_host_css.mjs",
     "check:webauthn-bundle": "node scripts/check_webauthn_bundle.mjs",
     "typecheck": "tsc --noEmit && node scripts/typecheck_ui.mjs && node scripts/typecheck_tests.mjs",